v1.9.0-rc.7

Seventh release candidate for v1.9.0. Cut from protected main at
b97432bc1d5298407046e599248bc62a6f09ce37 (release record PR #54), carrying the two
rc.6 refresh-cycle robustness fixes found in downstream review
(PR #49, merged at af54f2810ed9d94fbfbb9b92ecf500ceaba18ddb, all required
contexts green). No feature changes since rc.6.

What changed since rc.6

• Refresh reminders name the deployment's own field — the refresh-entry
  workflow reads the schema's entry.verified_key from the script instead of
  assuming a field literally named verified, so a catalog that renamed its
  verified-date field is told to stamp the right key.
• The verification sweep's issue bodies travel by file, not environment —
  the sweep hands its drafted issue bodies to the follow-up step through a
  file under the runner's temp directory ($SWEEP_ISSUES_FILE) instead of a
  step output, so a sweep that drafts many reminders in one run can no longer
  hit the runner's per-environment-entry size cap; count, slugs and
  max_new remain ordinary outputs.

npm run verify recorded at release-record commit
f1e5699f147ce770137cc50d3d7c86c372c83a37: 799 Node tests across 3 suites,
233 Ruby tests with 578 assertions, 109 build-matrix tests across 6 suites,
plus every non-browser release gate.

Full details: CHANGELOG
and the release-readiness status.

Known notes

• Code-scanning alerts #42 (js/client-side-request-forgery on
  assets/js/search-worker.js) remains a documented false positive awaiting
  maintainer dismissal in the repository Security tab (#43 was dismissed).
• BCHC consumed v1.9.0-rc.6 via
  its update PR #30
  on 2026-08-28 and is locked there; the rc.6 feature adoption and drill
  records followed in BCHC PRs #31 and #33. The rc.7 candidate update PR
  follows from rerunning Update from PHCT against this tag — no ownership
  contract changes since rc.6, so no migration is required first.

Rollback point

v1.9.0-rc.6 at c33e76b05fda6a9bdaa7beea7527414b13d74c1b.

🤖 Generated with Claude Code