The release gate's content-commit derivation binds the receipts to the released version with a string equality that admits two empty versions: a released tree with no dated CHANGELOG heading, or with no CHANGELOG.md at all, derives the nearest receipts directory, and the previous release's PROMOTE receipts admit it. releaseVersionAt returns an empty version with no error for a missing file, against its own comment. Reachable on the hand-pushed-tag path, where the verify job's receipts step runs and nothing cross-checks the tag against the CHANGELOG.

The release gate's content-commit derivation binds the receipts to the released version with a string equality that admits two empty versions: a released tree with no dated CHANGELOG heading, or with no CHANGELOG.md at all, derives the nearest receipts directory, and the previous release's PROMOTE receipts admit it. releaseVersionAt returns an empty version with no error for a missing file, against its own comment. Reachable on the hand-pushed-tag path, where the verify job's receipts step runs and nothing cross-checks the tag against the CHANGELOG.

Grounds

• pursued: a released tree naming no version refuses with a fail-closed message naming CHANGELOG (TestDeriveReleaseContentSha_RefusesAReleasedTreeWithNoVersion, review probes S6 and S6b); a derived sha for either shape would show it wrong.