A pre-release CHANGELOG head such as '## [1.0.0-rc.1] - <date>' is invisible to the dated-heading reader, so the release gate's version binding compares against the previous version and the previous release's receipts admit the release. The release workflow's tag pattern accepts -rc and +build suffixes, so a hand-pushed pre-release tag reaches the gate. The derivation should refuse when the newest release heading is one the reader cannot parse.

A pre-release CHANGELOG head such as '## [1.0.0-rc.1] - <date>' is invisible to the dated-heading reader, so the release gate's version binding compares against the previous version and the previous release's receipts admit the release. The release workflow's tag pattern accepts -rc and +build suffixes, so a hand-pushed pre-release tag reaches the gate. The derivation should refuse when the newest release heading is one the reader cannot parse.

Grounds

• pursued: a pre-release, build-metadata or undated newest heading refuses naming the heading (TestDeriveReleaseContentSha_RefusesAnUnparseableNewestHeading, review probe S5); deriving the previous cut's receipts under such a head would show it wrong.