v1.7.4

Two production advisories, and the three capture faults a 118.7 MB transcript uncovered

Take this one. It patches a high and a critical advisory in dependencies
that ship with the CLI.

package	severity	advisory
@modelcontextprotocol/sdk → 1.32.1	high	OAuth client could send credentials to an authorization server the MCP server chose (GHSA-6qxp-vccf-f47h)
proxy-addr → 2.0.8	critical	IP spoofing via an IPv4-mapped IPv6 trust subnet (GHSA-jqcg-44mw-7w3h)

source-map-js moves to 1.2.2 as well — dev-only, so no gate was watching it.
npm audit --omit=dev --audit-level=low is 0.

---

A large transcript could not be captured at all (#1168)

A 118,728,820-byte session transcript produced this:

{"outcome":"usage","error":"Staging rejected: this transaction was bound by a verification that issued a receipt, and none was presented. …"}

Receipt handling was working. The quote matcher built one array element per
character, and Array.push refuses past V8's FixedArray ceiling — measured
here at 112,813,858 elements, which is why 100 MB passed and 118.7 MB did
not. The verifier caught that RangeError, bound the transaction to an empty
verification, issued a receipt and then returned without it. The nonce was left
bound to a verification nobody could stage.

The matcher now builds nothing proportional to its input: a quote is matched
against the original text by a pattern that reproduces the whitespace collapse,
and the lines around a match are found by walking outward from it. The
matching rule has not moved — a new suite holds it to the rule the module
documents, from both sides, including twelve cases where a regex
metacharacter in a quote must stay literal.

A verification that cannot run no longer binds anything: the transaction stays
prepared, carries reason: "internal-error" with the exception's own message,
and can be verified again.

An empty verification now says which empty it is (#1169)

Unfetched notes, an unreadable history, a held lock and an internal error all
answered with the same bytes:

{"validation_result":"empty","accepted":[],"rejected":[],"incomplete":true}

Each now carries a reason code and a detail sentence naming the move that
resolves it — for an unfetched mirror, commitlore doctor --fix or fetching
refs/notes/*. verify_capture forwards both. On the CLI the three host
conditions report as operational (exit 3); internal (exit 4) stays for the
exception nobody anticipated.

A staged capture can be withdrawn (#1170)

commitlore pending rm <nonce> --force withdraws a staged transaction before
the commit. applied stays refused with or without the flag: its trailer is
already in a commit message and only the post-commit hook can finish the job.

A second stage on the same tree no longer replaces the first in silence. It
stamps superseded_by, the capture output names what it replaced, pending ls
shows superseded-by <nonce>, and doctor reports superseded captures as
superseded instead of as captures that "expired before reaching a commit and
were dropped".

What it does not do is collect them: a staged file is never garbage
collected, because withdrawing its replacement makes it the newest candidate
again.

---

This is a patch release. One flag is added, pending rm --force; no trailer key
or host setting changes.

Canonical source: 71db889; Canonical
dist/commitlore.mjs SHA-256:
f56490048e6baedb9999019aeaef3a150f67659ef50a6de244dfd074456fe771

Full Changelog: v1.7.3...v1.7.4