v3.4.0

What's Changed

• fix(site/r): R38 correctness fix + delegationPosture across the fixture corpus by @c-1k in #96
• fix(anchor): an unparseable successor pin must reach the verdict by @c-1k in #103
• fix(budget): distinguish an absent spend ledger from an unreadable one by @c-1k in #100
• fix(harden): fail closed on input that cannot be interpreted by @c-1k in #98
• fix(policy): policy loading and rule evaluation fail closed by @c-1k in #97
• feat(cli): usertrust policy validate, and a health line that reports rule count by @c-1k in #108
• chore(deps): bump nanoid from 3.3.11 to 3.3.18 in /site by @dependabot[bot] in #94
• chore(deps): bump js-yaml from 4.1.1 to 4.3.1 in /site by @dependabot[bot] in #93
• deps: bump brace-expansion from 5.0.8 to 5.0.9 by @dependabot[bot] in #78
• fix(verify): render an anomaly-killed call as ABORTED, not PENDING by @c-1k in #101
• test(harden): count sanitizers by shape, not by name by @c-1k in #107
• fix(health): derive entropy signals from real producer output by @c-1k in #99
• deps(dev): bump the dev group across 1 directory with 6 updates by @dependabot[bot] in #90
• feat(verify): usertrust-verify receipt — the offline ut1 verifier by @c-1k in #106
• fix(headless): void claimed holds that settle never posted by @c-1k in #112
• fix(policy): host-owned scope is the only input to scopePatterns by @c-1k in #111
• fix(openclaw): default wrapStreamFn aliases so real providers are governed by @c-1k in #110
• fix(claude-code): size holds on both legs and stop stealing unmatched holds by @c-1k in #113
• fix(server): accept computeMs on HTTP settle by @c-1k in #114
• fix(ui): do not treat an anchor file's existence as a verdict by @c-1k in #115
• docs: stop advertising removed proxy mode by @c-1k in #116
• fix(policy): remove unread PolicyContext.timeWindows by @c-1k in #117
• docs(policy): name the default rules that actually ship by @c-1k in #118
• refactor(policy): delete unused isBudgetExceeded helper by @c-1k in #119
• feat(site): the amount says what it covers, and what it bounds (R39/R40/R41) by @c-1k in #109
• fix(site): the ledger's Rekor pass does not independently earn the anchored rung by @c-1k in #120
• feat(site): visitor receipt card — action on the stage, invoice beneath by @c-1k in #121
• feat(site): the visitor card is the receipt by @c-1k in #122
• fix(audit): canonicalize holes and functions; refuse unparseable lines by @c-1k in #123
• docs(receipts): put the receipt spec under version control by @c-1k in #125
• docs(receipts): adopt the v0.2 resolver spec as normative; re-pin §6a by @c-1k in #126
• deps: bump minimatch from 10.2.5 to 10.2.6 in the production group across 1 directory by @dependabot[bot] in #77
• test(pricing): name the consequence of lowering the sonnet-5 row by @c-1k in #144
• fix: make the first five minutes accurate (provider-auth hint + require() support) by @c-1k in #147

Full Changelog: v3.3.1...v3.4.0