v0.12.0

The release that settled which language the code is written in.

Identifiers, comments, docstrings and test names: Japanese is gone from src/, tests/,
scripts/, alembic/ and compose/. It remains in the three places where the Japanese
is the product, the message catalogues, the ja field of each error code and the
Japanese navigation of the documentation site, so the screens and the CLI still speak
both languages.

The same release widened the end-to-end suite from 13 checks to 54 and added the tool
that builds the ledger it runs against. It also records what did not reproduce, because
a check that cannot fail is not counted as cover.

Added

• The code is now written in English throughout: identifiers, comments, docstrings
  and test names, across src/, tests/, scripts/, alembic/ and compose/,
  including renaming 493 test functions.

  Japanese remains in the three places where the Japanese is the product: the message
  catalogues (api/i18n/ and cli_i18n.py), the ja field of each error code, which is
  what the reference page prints, and the Japanese navigation of the documentation site.
  The screens and the CLI still speak both languages.

  The documentation (this changelog, STATUS and docs/*.ja.md) stays in Japanese. The
  readers are different people: whoever reads the code is working on the implementation,
  and that is better in one language.

  A check watches it (test_the_code_is_written_in_english). A rule like this decays
  one file at a time, because a Japanese comment added next to Japanese comments looks
  like it belongs.

  The migration files were renamed too (b5f83e2c9014_namespace_rules.py and the rest).
  The revision ids are unchanged, so the chain and any applied history stay as they
  were.

• A tool that builds the ledger for the end-to-end suite (scripts/seed_e2e.py). It
  creates the NAANs, organisations, principals with their keys and the admin password, and
  --arks N fills the ledger with ARKs in mixed states (published, reserved, held,
  tombstoned, qualified, withdrawn).

  tests/e2e/ calls it. Writing the same setup inside the suite would leave one of the
  two stale — and because the suite calls it, the tool cannot rot either. Checking by
  hand starts from the same ledger; the keys are printed as they are issued.

  The setup goes through the CLI — a path operators do not use is not a check of
  anything. It can also top up a half-built ledger, because a suite that fails stops
  halfway and "the NAAN exists but no organisation does" is an ordinary state.

• The end-to-end suite went from 13 checks to 54 (tests/e2e/). Same shape as before
  (PostgreSQL in docker, a minter and a resolver under uvicorn), a much wider surface:

  	what it watches
  test_shape	the split of roles, /healthz and /readyz, .well-known/ark, the CLI and the API agreeing on the count
  test_resolution	inherited qualifiers, label case, hyphens, ?info and ??, a delegated NAAN going to its delegate and an unknown one to the global resolver, the CSP on the public page
  test_lifecycle	reserved → published → withdrawn → republished → deleted, update, bulk, an explicitly registered qualifier, hold, tombstone
  test_authz	outside the scope, no reach into another organisation, a stopped principal, the daily quota, client_credentials
  test_admin_ui	signing in with a password and withdrawing, then republishing, from the form; refusals that do not differ on whether the user exists
  test_hardening	ARKHE_ALLOWED_HOSTS, a closed resolver (which resolves the unpublished)
  test_concurrency	32 simultaneous sends of one request_id, 32 simultaneous mints, simultaneous withdrawals

  It was verified to bite. Remove the ARKHE_ALLOWED_HOSTS middleware from
  create_app and test_a_host_that_was_not_allowed_is_refused fails — that setting was dead until
  0.9.2 (declared, documented, read by nothing). The rest of the suite assembles the app
  by hand, so a missing middleware is invisible to it.

• What did not reproduce is written down too. Firing 32 resends of one request_id
  from pre-opened sockets (1.3 ms of spread) does not open the _commit_or_replay
  race — the first commits before any other reaches _replay, with four workers as
  well. Reverting the fix does not fail the check, and the check says so, so that nobody
  reads it as the guard for that race. A check that cannot fail is not counted as cover.

Fixed

• Three remaining count(*) calls are gone (the minting quota, the check for part
  references, the admin overview). The counted column is named — count(*) counts
  rows, so an index alone cannot answer it, and it costs more as the ledger grows. When
  domain.stats was fixed this way in 0.6.0, these three were left behind.

  A check now watches for it (test_every_count_names_its_column). Fixing the three that
  exist today is not enough; the next person writes func.count() again.

---

Changelog in Japanese
· Full Changelog: v0.11.0...v0.12.0