v3.12.0

Safety record

Audit record → · Release notes →

No four-corpus audit backs this release, and this is a release that asks for
one. The checklist requires a corpus run when detection or conversion policy
changes. Detection is untouched — no detector file changed — but
ConversionPolicy did change, so the exemption v3.11.2 claimed is not available
here. The v3.11.0 figures are not evidence about this build.

What supports it instead: 727 unit tests, the nine-phase GUI suite, the detector
parity check, and a mutation check on each of the twelve fixes — the change
reverted, the intended test required to fail, the file restored byte-identical
and confirmed by hash.

The nine-phase GUI smoke suite gated this release, as it has since v3.11.2 —
inside the release job, against the published executable, between packaging and
publication. A failure would have stopped publication rather than been noticed
afterwards.

Code signing did not run. The signing secrets are not configured, so the step
was skipped: the archives below are unsigned, and the GUI suite drove an
unsigned executable. The claim that the suite drives the signed binary remains
unproven, as it was for v3.11.2.

Before you upgrade

Exit codes and report contents change in both directions, which is why this is a
minor and not a patch.

Situation	Before	After
-FailOnChanges on a tree already in an alias of the target	2	0
A file valid for 64 KiB and invalid afterwards	Unchanged, 0	Error, 3
-Plan over a source that cannot be decoded	Convert, 0	Refuse, 3
An unexpected exception during a scan	run-ending crash	one row, 3
A -Validate row outside the allowed list	empty reason	CharsetNotAllowed

The first row is the one most likely to be noticed: -Target unicode, ucs-2
or utf-16le on a tree already in UTF-16LE used to rewrite every file to
identical bytes, resetting every modification time and — with -Backup —
leaving a .bak and an .ecmeta.json beside each. Identity is now the resolved
code page rather than the charset's label, so those runs do nothing at all.

Coverage output gains two lines, for folders skipped by name and folders that
could not be read. Standard output written to a console now uses that console's
encoding rather than UTF-8; redirected output is unchanged.

Conversion semantics stay at 6, the plan schema at 5, the journal schema
at 4. These changes make EC refuse more and convert less, which the
approved-decision ceiling already permits, so a plan written by an earlier build
still means what it meant.

What's Changed

• Record v3.11.2, and what it says about these records by @amrali-eg in #77
• Fix twelve findings from an independent review, and release v3.12.0 by @amrali-eg in #78

Full Changelog: v3.11.2...v3.12.0