docs(release): work the v1.2.0 manual pass, and record what it found

[plearaj]

Both manifests already declare 1.2.0 and the changelog already leads with it, while the last published release is v1.1.0 — so this is release prep for the version that section describes, not a version bump.

Two commits' worth of documentation, and one finding that is not documentation.

The changelog was missing a user-facing fix

e2094da (a spread call is still a call) shipped without an entry. It belongs in 1.2.0's Fixed section: calls composed with [...first(), ...second()] were absent from every generated call graph, and a call missing from the graph reaches the quality report as an unreached finding — which reads as delete this.

Nothing else since v1.1.0 is unrecorded. All 22 commits were checked against the changelog's six subsections.

Release readiness, audited

• 604 pytest, 72 node — green on this tree.
• Both packages ship the identical 22 templates, byte-for-byte: the wheel check the publish workflow runs was run locally, and the npm tarball's template set was diffed against the wheel's. scripts/ reaches neither package.
• Changelog reaches both packages; CHANGELOG.md is in npm files and the sdist include list.

The manual pass — RELEASE-CHECK-2026-08-28.md

Steps 1–3, 5 and 6 of scripts/prepublish-check.js, against pages built from this branch's scaffolds and this repository's own map. Every number in the document was read out of the live page in headless Chromium, not out of the source that produced it.

Two things this release changed were confirmed in the rendered page rather than in the template:

• The report and the bundle both print Ran and found nothing: unreached, single-responsibility, … — on a report where every SOLID and DEPTH detector is clean, that is the difference between "checked, nothing found" and a silence that reads as "never checked".
• The flow page has 0 <marker> elements and 0 url(# references in its whole serialized DOM, which is what keeps a generated page out of corporate mail quarantine.

Step 5 was made stronger than the v1.1.0 pass: rather than reading the --accent variable back, the same page was built from the stock theme and from a user theme and the painted colour compared — .coverage-banner h2 goes rgb(145,132,217) → rgb(255,45,149) in dark and rgb(93,82,148) → rgb(0,139,69) in light.

Step 4 was not performed and is recorded as outstanding. It needs a real host — Claude Code, Copilot, Codex or Antigravity — to watch discover the skill; this environment has none. It is still owed before publishing.

Step 6 ran the tracers over 45,000 real functions

Tracer	Corpus	Files	Functions	Call edges	Entry points	Components
trace_python.py	CPython 3.11 standard library	670	14,720	16,887	34	—
trace_typescript.mjs	PrimeVue 5.0.1	820	5,817	3,381	0	423
trace_typescript.mjs	TypeScript compiler	9	20,892	80,827	1	8
trace_rust.py	serde_json + 10 dependencies, vendored	339	6,302	7,433	6	—
trace_java.py	Gson, Commons Lang 3, Guava, JUnit console, picocli	1,000	18,131	15,424	2	—
trace_c_family.py	/usr/include	4,145	12,765	6,387	0	—

423 components against PrimeVue's 416 .vue files is the componentsFound sanity check the checklist asks for.

Both zeroes were checked rather than accepted. Java found 0 across the three pure libraries; the only two static void main matches in them are inside Javadoc, which the tracer masks. Adding JUnit's console launcher and picocli took it to exactly 2 — ConsoleLauncher.java:32 and AutoComplete.java:72, the only two real ones in the corpus, out of five files matching the text. The C family's 0 in a header tree is correct; the one int main( in /usr/include is inside a #define.

What the pass found: id collisions on ordinary code

scripts/build-map.py asserts ids are unique across the merged catalog. It fired.

Corpus	Functions	Duplicated ids
CPython standard library	14,720	158
/usr/include	12,765	106
PrimeVue	5,817	107
Five Java libraries	18,131	42
TypeScript compiler	20,892	4
serde_json and dependencies	6,302	0

Not a minified-code curiosity — three mechanisms, each of them ordinary:

1. derive_id folds two names onto one id, and assign_ids counts names. The _l<line> suffix is applied when a file defines the same name twice, but the id is a slug that lowercases and replaces everything outside [a-z0-9_]. So Python's __add__ and add, Java's Builder constructor and builder() factory, C++'s __waiter and ~__waiter — every class with a destructor — and _M_x versus _M_X are all distinct names deriving one id, counted as unique, given no suffix.
2. Two definitions on one line — 105 of PrimeVue's 107, 45 of /usr/include's 106. _l<line> cannot separate them and no record carries a column.
3. Two paths folding to one slug — 10 in the standard library, all distutils/_msvccompiler.py versus distutils/msvccompiler.py: the leading _ becomes a separator and collapses into the one before it.

The consequence is not cosmetic. /code-flow.quality computes unreached by subtracting reached ids from catalogued ids, so two functions under one id means reaching either reports both reached — a genuinely unreachable function goes silently missing from the findings, which is the failure mode detectorsSkipped and the "ran and found nothing" line exist to prevent.

Not fixed in this PR. Mechanisms 1 and 2 are contained. Mechanism 3 is not: it cannot be fixed by a rule that decides collisions "from the file's own contents", which is how the id rule is stated verbatim in all four host templates — so fixing it means changing that documented contract and giving up the property that moving an unrelated file never renames anything. That is a decision about what v1.2.0 is, not a defect to quietly patch during release prep. The defect predates this release; it has been there since the tracers landed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D377rQ9d7U39y7AQ2zNgAg

---

Generated by Claude Code