feat(phase-59): Guardrails and Inventory — release checks, orphan triage, planning truth

[RichardHightower]

Summary

v3.2 Prove It starts here. v3.1 made the claims true; this phase makes the next release unable to lie about what it is, inventories the March work nobody merged, and puts the backlog on GitHub.

Closes the 2026-09-01 incident: git push origin v3.1.0 tagged a stale local ref (acc7294, Cargo.toml 2.7.0) and published it for 17 minutes. The four-binary archive guard from #37 held; nothing else did.

59-01 Release pipeline checks

• New guard job in release.yml runs before any platform build:
  • tagged commit must be an ancestor of origin/main
  • workspace.package.version must equal the tag minus v
  • CHANGELOG.md must have a ## vX.Y.Z section (that section is the release notes; generate_release_notes: false)
• Publish job uses if: success() — a custom if replaces the implicit needed-jobs check, so success() is load-bearing. The previous if: always() && !cancelled() is how a three-archive release could ship.
• All five platform archives are required before action-gh-release.
• docs/RELEASING.md documents git tag -a vX.Y.Z <sha>. v9.9.9-test does not match the tag trigger; live verify is workflow_dispatch + dry_run: true.
• Unit tests in scripts/release-guards-test.sh cover the incident (version mismatch) and a commit not on main. They run on every PR (Release Guard Scripts → CI Success).

59-02 Orphan branch triage

Inventory: docs/plans/phase-59-orphan-branch-triage.md.

The March GSD “v3.1” is Memory Export/Import, forked from v2.7.0, 20 behind current main. Same phase numbers, different work. Naïve merge is an add/add war on memory-orchestrator (878 vs 1458 lines) and memory-bench (1319 vs 2649 + judge.rs).

Keep (cherry-pick in Phase 61, not this PR): export/import streaming RPCs; Claude Code CREG/META (plugin.json + known_marketplaces.json).
Skip: OpenCode converter (fights #36).
Do not delete the gsd/ branches until those cherry-picks land.

59-03 Planning truth

• PROJECT.md Current State is v3.1.0 shipped / v3.2 executing. OpenCode removed from the adapter list. API summarizer moved out of Deferred (it shipped as feat(v3.0): wire API-based summarizer from config (supersedes #26) #27).
• ROADMAP / STATE / MILESTONES know about v3.2.
• Public backlog:

Issue	What	Phase
#39	Real LOCOMO LLM-judge run	60-02
#40	Vector and topic-graph quality fixtures	60-03
#41	Backfill BM25/vector for pre-v3.1 events	61-01
#42	install-service (launchd/systemd)	61-02
#43	Offline TOC rebuild	61-04
#44	Cross-encoder rerank (conditional)	62

README status-table rows for those gaps now cite the issues.

Plan: docs/plans/v3.2-prove-it-plan.md. Maintainer decisions recorded: cherry-pick by feature; blog now / product posts after #39; unit files not double-fork.

Test plan

• bash scripts/release-guards-test.sh (8 cases, including the v3.1.0-on-2.7.0 incident)
• bash scripts/changelog-section.sh 3.1.0 CHANGELOG.md extracts the real section
• cargo fmt --all -- --check
• CI: new Release Guard Scripts job + existing fmt/clippy/test/doc/e2e
• After merge: maintainer workflow_dispatch with a disagreeing version and dry_run: true (do not push v9.9.9)

No Rust sources changed. Full task pr-precheck was not run in this sandbox (protoc is not installed); CI is the rust gate.

Not in this PR

• Cherry-picks from the March line (Phase 61)
• Deleting gsd/ branches
• The LOCOMO run (Real LOCOMO LLM-judge run on locomo10.json (v3.2 / 60-02) #39) — needs an API key and 60-01 isolation first