v1.5.3.1 — the v1.5.3 tarball did not pass its own gate

No runtime code changes — the plugin behaves identically to v1.5.3. What changed is that the artifact you install now verifies itself.

Why this exists

make ci run against git archive v1.5.3 — the tarball users actually install — failed four tests. All four were environment artifacts, not defects: every cited file was present in the tarball, and the checks were asking git questions of a tree that is not a git repository.

This project treats a red that carries no information about the thing it claims to check as a defect in its own right — the same rank it gives a false green. So it is fixed rather than explained away.

• A citation check built its file set from git ls-files, which returns empty outside a work tree. Three cited files were reported "not in the repository" while all three shipped. Now derived from git when the tree is a work tree and from the filesystem otherwise — in a clone the git answer is stronger (tracked implies present) and is preferred; in an export there is nothing to be tracked by, and "the file shipped" is exactly the right question of a release artifact.
• A skip guard named the wrong precondition. It gated on the git binary, but scripts/install.sh deploys the committed HEAD via git archive and refuses without a work tree and a commit. In the export the binary check passed, the installer correctly refused, and the test reported a failure about backup behaviour it had never reached.

And the gap that had no test at all

Nothing pinned the version. make ci passed identically before and after the v1.5.3 manifest bump, so the four places stating the current version were kept in step entirely by hand. A release shipping with README.md still telling users to pin the previous tag would have been green all the way through the gate.

tests/test_version_consistency.py pins the manifest against plugin_meta, the CHANGELOG entry and that it is the newest, README's pinned-install example, AGENTS.md's project line and open-items heading, and references/system-map.md.

It also pins the other half of the rule: historical version prose must survive. Without that, every check above could be satisfied tomorrow by scrubbing older releases out of the record — and this repo treats rewriting history to match today as a defect.

The pin proved itself on its own release: bumping the manifest alone failed five ways until all four sites were brought into step.

Verified

make ci EXIT 0 in a clone and against git archive of the tagged commit — 1706 tests both ways, 41 tracked docs, no drift. scripts/verdict.py still blob 57062e71; floorsynth still exactly 10 blocking emitters.

Everything in v1.5.3 applies unchanged — the live false GREEN it closed, and the two claims it withdrew.