v0.2.9 — Identity Activation

What's Changed

• docs(adr): M5 is identity activation — retrieval leaves the cut, and the warehouse producer emits only what a human enrolled by @msywulak in #5199
• docs(agents): comment-analyzer enforces concise plain-English (de-slop) comment rules by @msywulak in #5210
• refactor(brain): retire catalog:slack-history — one Slack install, not two (#5203) by @msywulak in #5209
• docs(adr): ADR-0040 — the class-major ingest contract (#5200) by @msywulak in #5211
• docs(adr): ADR-0041 — the Coverage Surface counts what it can see (#96 grill) by @msywulak in #5217
• docs(guides): the Claim Vocabulary approval surface gets a guide (#5158) by @msywulak in #5218
• feat(brain): the class coverage contract — vendor-public, staleness capability, denominator source (#5212) by @msywulak in #5219
• chore(ci): type-check and lint scripts/, and fix what that surfaced (#5173) by @msywulak in #5220
• feat(brain): the enrollment surface — a human names what the warehouse producer may emit (#5196) by @msywulak in #5221
• chore(brain): generate the remaining six mutation tables from checked-in mutation lists (#5061) by @msywulak in #5222
• docs(agents): comment-analyzer reports adjacent de-slop candidates, advisory only by @msywulak in #5223
• perf(ci): shard mutation-tables four ways, and retire the "free" claim by @msywulak in #5224
• docs(roadmap): record the 08-14 batch, the shard PR, and the adjacent-comment change by @msywulak in #5225
• feat(brain): the tier-1 warehouse fact producer — enrollment-scoped, fail-closed, tension-only by @msywulak in #5226
• docs(roadmap): record #5042 — the warehouse producer, and three fixes that reproduced their own defect by @msywulak in #5227
• docs(roadmap): #5042's follow-ups are filed, not just recorded by @msywulak in #5231
• feat(brain): the entity store and its entity-edge producer (#5043) by @msywulak in #5232
• sec(brain): brand the snapshot REQUEST, not just the verdict (#5230) by @msywulak in #5234
• docs(roadmap): record #5230 — one invariant, three mechanisms, nine false claims by @msywulak in #5241
• docs: the Company Atlas guides move to atlas-* URLs, with Caddy 308s on both mounts (#5083) by @msywulak in #5236
• chore(brain): rename the two ingest catalog rows to Company Atlas — as a migration (#5082) by @msywulak in #5235
• feat(brain): denominator snapshots — scheduled enumeration writing dated survey-unit rosters (#5213) by @msywulak in #5238
• docs(roadmap): record #5213 — the denominator snapshots, and four fixes that landed nowhere by @msywulak in #5244
• refactor(scripts): injectable roots for check-docs-brain-snippets, so its fixtures stop rewriting tracked source (#5172) by @msywulak in #5237
• docs(roadmap): record #5172 — the fixture suite that rewrote tracked source (#5237) by @msywulak in #5245
• docs(roadmap): record #5083 and #5082 — the two batch entries their workers did not write by @msywulak in #5246
• chore(agents): collapse the duplicated skill layers onto the upstream plugin by @msywulak in #5251
• chore: bundle 1 — small CI / scripts / docs hardening (#5247, #5242, #5243) by @msywulak in #5252
• docs(roadmap): record bundle 1 (#5252) by @msywulak in #5253
• refactor(brain): whole-file name allowlist for the SQL-gate bypass set (#5249) by @msywulak in #5254
• feat(brain): SQL digests on the snapshot mismatch log — a forgery no longer reads as a replay (#5248) by @msywulak in #5256
• sec(settings): the security-audit line masks a secret setting's value (#5180) by @msywulak in #5259
• fix(brain): carry the seam-read ratchet past the validator — runSnapshot, loadEntity and the transaction catch (#5257) by @msywulak in #5258
• fix(brain): the catalog seeder stops reporting rows it never wrote, and the last customer-read "brain source" string is renamed (#5239, #5240) by @msywulak in #5260
• fix(agents): enforce the review panel's read-only contract in the tool grant (#5267) by @msywulak in #5268
• refactor(db): derive HardDeleteCounts from the purge registry, and the child-parent relation once (#5176) by @msywulak in #5261
• fix(db,settings): a blocked catalog row stops reporting as preserved, and the settings audit row stops carrying plaintext (#5266, #5270, #5262) by @msywulak in #5271
• docs(roadmap): record #5271 — the prose was wrong nine times and the code once by @msywulak in #5274
• docs(roadmap): annotate #5262's entry — the mechanism it was praised for was falsified by @msywulak in #5275
• fix(db): classify unique violations on the WRAPPED shape — four dead 409s, and a fifth site the fix exposed (#5272) by @msywulak in #5279
• refactor(brain): the SQL-gate allowlist's completeness direction, and EntityEdgeOutcome (#5255, #5277) by @msywulak in #5278
• docs(roadmap): record #5255 + #5277 — one claim was wrong four times running (#5278) by @msywulak in #5280

Full Changelog: v0.2.8...v0.2.9