AOCI-CODE v0.1.0-rc12

AOCI-CODE v0.1.0-rc12 is built from e48115c2560ef3b8e99488c7ce147aa20afc8584.

Seven fixes for repositories governed without a human in the loop, surfaced by
the first agent that drives the MCP end to end (aoci-agent) and by a
contributor governing a Volumes repository on Windows (#46, #47), plus one
test-only guard for the driver audit table. Two fixes close a Volumes v1
deadlock in the Managed Scope transaction; five correct counts, warnings, and
refusals. Each fix carries a test that fails without it, and the real-repository
harness now walks the deadlock path itself (56 scenarios and a new lifecycle
governance walk). Nothing in the nine-tool surface or any governance identity
changes.

• Let a Volumes v1 repository with a changed source activate a policy change.
  A policy edit (a scope rule, a budget) makes desired differ from active, and
  every authoring path refuses to write until one governed Apply activates it.
  That Apply refused to plan while any index-role source had changed since the
  Baseline (managed_scope_index_source_stale), and the Entry candidate that
  clears the block under Legacy was projected into the Root manifest under
  Volumes, where aoci.txt holds no Entries. A repository with one changed
  file and one pending rule had no legal move (#47). A policy-only Scope
  Change now plans over a changed source in Volumes: the postimage Baseline
  keeps the fingerprint the Entry was bound to, the plan reports the path
  under source_stale_retained, and the next aoci_maintain plans the source
  as it always did. A Volumes candidate set that carries entries,
  dispositions, or a header is refused before projection with
  managed_scope_volumes_entry_candidates_unsupported. Legacy keeps failing
  closed, and a plan without retention serializes as before, so no in-flight
  plan_id changes.
• Name the field in a refused candidate set. managed_scope_entry_candidate_invalid
  and scope_entry_disposition_invalid named only the path, so the operator
  read the validator to learn that candidate_id, review_status, and
  current_entry_sha256 were required (#46). The refusal now names the
  position and the field (entries[1]: candidate_id is empty), the digest
  mismatches say which digest they compare, and the candidate set is
  documented field by field in docs/managed-scope-and-budget.md.
• Count a fresh file once. A source created after the last scan has no Entry
  and no Baseline fingerprint, so drift classification files it under both
  Missing and Unbaselined, and Maintain's authoring_batch and Guide's batch
  added the lists: two new files promised total_targets 4 and remaining 2
  with continuation_required true while the plan held exactly two
  candidates, and a curation-excluded file was counted although no candidate
  would ever carry it, so remaining never reached zero. Maintain and Guide now
  derive the total from the one authoring-work set Maintain plans from, so the
  batch, the plan, and Guide agree; verify's unresolved-path counts stop
  double-counting the same file. Candidates were never duplicated; only the
  counts were.
• Warn about an E tag that contradicts the file length in Volumes v1. The
  write path read the E-scale thresholds from the Code Volume's own header,
  which in Volumes v1 is one marker line; the dictionary lives in Meta, so no
  threshold was ever found and a four-line file tagged L applied without a
  word. Volumes writes now read the thresholds from Meta's code dictionary
  alone (each Meta section declares its own E Scale line) and answer the
  advisory warning Legacy answers, now localized in both layouts, under
  audit.warnings; the S-quota advisory reads the same dictionary. Nothing
  is rejected.
• Name the candidate and field in a batch binding defect. An empty
  candidate_id or a malformed source_sha256 answered a bare bad_args that
  named nothing, and a model that had mistyped one field received the same
  rejection for every resubmission. The rejection now carries a Repair Finding
  with the candidate's position, path, field, and repair action, in the
  vocabulary of the candidate's own domain, with no formal write started.
• Refuse brace alternation in a scope rule. The glob compiler treats { as a
  literal, so assets/*.{png,jpg} was accepted and matched nothing; adding or
  editing such a rule now fails with the spellings that work. A persisted rule
  is not touched, so no repository stops loading.
• Skip a discovered server whose working directory was deleted. /proc
  reports such a directory as <dir> (deleted), and the status page joined
  that text into a root that does not exist.
• Guard the driver audit table in docs/supply-chain.md against go.mod.
  The pre-tag adversarial review had to move that tag-pinned table's pgx and
  mysql rows by hand after the rc11 driver bumps, because nothing read it. A
  contract test now fails when a listed module's pinned version differs from
  the version go.mod requires, and requires the openGauss row to keep
  resolving through the local replace to the patched tree under
  third_party/. Tests and documentation only; the nine-tool MCP surface and
  every governance identity are unchanged.

The first public availability date for v0.1.0-rc12 is 2026-09-15.

See docs/install.md and docs/supply-chain.md for asset verification.