v0.2.1

Not breaking. Every fix below is an internal correctness or security fix; no config schema or
CLI surface changed. All 16 crates are live on crates.io at 0.2.1 (verified via the crates.io API
and a real cargo install --locked from the published registry, then a genuine
init/ingest/report/doctor run against the installed binary).

An independent review of the report-example redesign + measurement-bug-fix PR found and fixed six
real defects before merging:

1. Script injection in the shipped report renderer. Tool names read from the transcript
   reached an inline <script> block via HTML-only escaping — a real script-injection path
   present in every generated report. Fixed with proper JSON escaping and DOM-safe (textContent)
   rendering.
2. The blind-store honesty guarantee failed on exactly the input it was written for. A
   legacy/offloaded-only store rendered confidently clean instead of flagged blind. Fixed by
   deriving the flag from run coverage, not scan hits.
3. Offloading a large tool_use.input silently zeroed six detectors — rework, hotspots,
   agent spawns, skill usage, TodoWrite, and the task ledger. Fixed with a declared
   per-tool-type bulk-subfield list.
4. HUB.aisp asserted a false equation inside its own self-certifying evidence block. Fixed
   and re-verified against a freshly migrated store via a real schema dump.
5. Re-ingest silently double-counted instead of fixing the partial validation caveat it was
   meant to remedy. Fixed with one mechanism: clear a turn's facts before re-deriving them
   (ADR-131).
6. pytest's verdict matcher accepted plain prose as a test result. Fixed, and the guard test
   corrected to assert the refusal it was meant to.

A second, independent adversarial review pass then caught what the first pass missed: the
identical 139-vs-136 defect in a second example report, a self-contradicting crate count in
README.md, a duplicated crate-table row in two HTML pages, and a missing executive-summary
section in one report that its own HTML twin already had. All fixed and re-verified.

Verified before this release: cargo test --workspace green at 699 (0 failed, 6 ignored),
checksums regenerated and verified clean (89/89), scripts/public-export.sh --check IN SYNC,
banned-framing-lint clean, and a full outside reproduction: installing purely from crates.io and
re-rendering the shipped example matched the published report on 99 of 101 fields (the two that
differ — source_db_hash, report.id — are documented as expected to vary between ingests).

Full details: CHANGELOG.md

v0.2.0

Breaking. All 16 crates went live on crates.io on 2026-08-17 (human go-ahead given, verified
via a real cargo install --locked from the published registry). A [privacy] config key is
removed with no compatibility shim, the capture schema moved six migrations (v17 → v23), and
stored-data semantics changed — a v17 store from a 0.1.x install migrates automatically on the
next write.

Six real findings from an external reviewer, fixed

An external reviewer ran BAR Observatory 0.1.1 against real sessions and reported six reproducible
defects. All six are closed as of this release:

1. The [privacy] config table was fully decorative — zero code paths read it. Replaced by a
   real [redact] table that every field of which is actually read.
2. Archival ingest silently misresolved the workspace root, masking real edits and rendering a
   clean, empty report with no indication anything went wrong. Fixed with a disclosed
   workspace-root precedence chain, always visible in the report.
3. Write-seam masking damaged error detection itself — redaction ran before the error/pairing
   detectors ever saw the string. Fixed by moving redaction to the render/export seam only;
   storage is now always verbatim.
4. Masking could produce a "plausible" but silently empty result. Every not_observed result
   now carries a reason code instead of a bare, unexplained empty.
5. The parser catalogue advertised 4 languages, shipped 1. pytest/npm/generic-exit matchers
   are now implemented and covered by fixture tests.
6. Nothing recorded how any resolved value was derived. The report now names which layer/rung
   won for config resolution, workspace-root resolution, and the redaction policy in effect.

Also fixed this release

• A real capture-parsing bug in bar-proxy's bodies channel (Anthropic /count_tokens
  diagnostic responses were being dead-lettered as unparseable).
• bar --help and bare bar exited 2 instead of printing usage and exiting 0 — the first thing a
  new user hits.
• bar doctor — a real, working self-diagnostic (store validity, capture health, lifecycle, DLQ
  status in one command).

Full details: CHANGELOG.md