Development record

abcd embargo publish can never publish an advisory handled the way the security rule asks: its plan includes an advisory only when the advisory's record is resolved in the release, but the security rule keeps that record out of every committed tree until the advisory is published. On 2026-10-17 the plan for v0.15.0 left out an advisory whose fix had shipped in v0.15.0 with the reason that its record is not resolved there, and it was published by hand through the forge API instead, as the release-chain advisory was before it.