fix(tools,docs,www): alpha.12 prepare gate repairs — evidence-aware in-flight anchor rule, active-target sync, round-6 roadmap theme, fresh README bump staging

Author: DevBot

docs/current/VERSION_PLAN.md

@@ -3,7 +3,7 @@
 > Current source package line: `v0.42.0-alpha.12`\
 > Current npm registry line: `v0.42.0-alpha.12` (published 2026-08-01, dist-tag `alpha`)\
 > Next alpha train: `v0.42.0-alpha.12` (round-6 audit remediation — in flight; next is TP-6)\
-> Active release target: `v0.42.0-alpha.11`\
+> Active release target: `v0.42.0-alpha.12`\
 > Planning release target: `v0.42.0` (WC light fullstack / Application Loop)\
 > Next release line: `v0.43.0` (Universal WC SSR)\
 > Current maturity stage: stable (0.41.x line); 0.42.0 planned under ADR-0120

tools/autoflow/release.ts

@@ -396,6 +396,7 @@ export function createReleasePlan(
         'tools/project-constants.ts',
         'README.md',
         'README.zh.md',
+        'examples/open-element-in-fresh/README.md',
         'docs/current/VERSION_PLAN.md',
         'docs/governance/PROJECT_WORKFLOW.md',
         'docs/roadmap/ROADMAP.md',

tools/check-version-anchors.test.ts

@@ -159,13 +159,34 @@ Deno.test('in-flight claims: published line bound to in-flight wording fails (#8
   ];
   for (const prose of cases) {
     const files = goodFiles();
+    // Completed publish evidence makes the current line count as published.
+    files[`docs/release/autoflow3/${PACKAGE_VERSION_TAG}.json`] = '{"status": "completed"}';
     files['docs/roadmap/ROADMAP.md'] += `\n${prose}\n`;
     const failures = findInflightVersionClaimFailures(readerFrom(files));
     assert(failures.length >= 1, `expected a failure for: ${prose}`);
     assert(failures.every((f) => f.startsWith('docs/roadmap/ROADMAP.md:')));
   }
 });
 
+Deno.test('in-flight claims: superseded line bound to in-flight wording always fails', () => {
+  const files = goodFiles();
+  files['docs/roadmap/ROADMAP.md'] +=
+    `\n${PREVIOUS_PACKAGE_VERSION} is the in-flight source line.\n`;
+  const failures = findInflightVersionClaimFailures(readerFrom(files));
+  assertEquals(failures.length, 1);
+});
+
+Deno.test('in-flight claims: prepare window — current line without publish evidence is exempt', () => {
+  // After the version bump but before CI publishes, the current line IS the
+  // in-flight train; flagging it would block the release flow itself.
+  const files = goodFiles();
+  files['docs/current/VERSION_PLAN.md'] +=
+    `\nNext alpha train: \`${PACKAGE_VERSION_TAG}\` (round-6 audit remediation — in flight; next is TP-6)`;
+  files['docs/governance/PROJECT_WORKFLOW.md'] +=
+    `\nnext train \`${PACKAGE_VERSION_TAG}\` (round-6 audit remediation)`;
+  assertEquals(findInflightVersionClaimFailures(readerFrom(files)), []);
+});
+
 Deno.test('in-flight claims: naming the NEXT train beside the published line is legal', () => {
   const files = goodFiles();
   // The healthy steady state: current line published, next version in flight.

tools/check-version-anchors.ts

@@ -231,17 +231,31 @@ export function findStaleAnchorFailures(read: (path: string) => string): string[
 }
 
 /**
- * Half-update guard (#813): the published package line must not be described
+ * Half-update guard (#813): a published package line must not be described
  * as in-flight or as the active/next train. The binding must be tight — the
- * current version as the subject or object of the in-flight/train phrase, or
+ * version as the subject or object of the in-flight/train phrase, or
  * immediately trailed by a parenthetical carrying in-flight wording — so a
  * paragraph that marks the current line published while naming the NEXT
  * train stays legal. Runs over the governed docs (the versionAnchors paths).
+ *
+ * Which lines count as "published": a superseded line (PREVIOUS_PACKAGE_VERSION)
+ * always does. The CURRENT line only counts once its release evidence records
+ * a completed publish — before that (the release-prepare window, where the
+ * bump has landed but CI has not published yet) the current line legitimately
+ * IS the in-flight train, and flagging it would block the release flow itself.
  */
 export function findInflightVersionClaimFailures(read: (path: string) => string): string[] {
-  const version = escapeRegExp(PACKAGE_VERSION);
-  const alpha = PACKAGE_VERSION.match(/-alpha\.(\d+)$/u)?.[1];
-  const ver = alpha ? `(?:v?${version}|\\balpha\\.${alpha}\\b)` : `v?${version}`;
+  const publishedVersions = [PREVIOUS_PACKAGE_VERSION];
+  if (hasCompletedReleaseEvidence(read, PACKAGE_VERSION_TAG)) {
+    publishedVersions.push(PACKAGE_VERSION);
+  }
+  const parts: string[] = [];
+  for (const version of publishedVersions) {
+    const alpha = version.match(/-alpha\.(\d+)$/u)?.[1];
+    parts.push(`v?${escapeRegExp(version)}`);
+    if (alpha) parts.push(`\\balpha\\.${alpha}\\b`);
+  }
+  const ver = `(?:${parts.join('|')})`;
   const bindings = [
     new RegExp(`${ver}[^.\\n]{0,30}?is the in[- ]flight`, 'i'),
     new RegExp(`in[- ]flight[^.\\n]{0,30}?line is ${ver}`, 'i'),
@@ -269,6 +283,19 @@ export function findInflightVersionClaimFailures(read: (path: string) => string)
   return failures;
 }
 
+/**
+ * Offline proxy for "this line is already on the registry": the autoflow3
+ * evidence record for the tag exists and reached `completed`. A missing or
+ * incomplete record means the version is still in the prepare window.
+ */
+function hasCompletedReleaseEvidence(read: (path: string) => string, tag: string): boolean {
+  try {
+    return read(`docs/release/autoflow3/${tag}.json`).includes('"status": "completed"');
+  } catch {
+    return false;
+  }
+}
+
 function main(): void {
   const texts = new Map<string, string>();
   const read = (path: string): string => {

www/app/routes/roadmap.tsx

@@ -333,9 +333,9 @@ type TimelineEntry = {
 const entries: TimelineEntry[] = [
   {
     version: 'v0.42.0-alpha.12',
-    theme: 'round-5 audit remediation',
+    theme: 'round-6 audit remediation',
     copy:
-      'The fifth full-spectrum audit closes 56 issues (#753–#808): JSX ref callbacks are honored, Array/Object props JSON-sync across SSR and CSR, island config scanning goes fail-closed, head-injection URL validation strips tab/newline bypasses, desktop examples bind loopback, and the site-ui lab components actually render.',
+      'The sixth full-spectrum audit closes 43 issues (#810–#852): a guard-vetoed post-action redirect no longer wipes page data, the CSRF same-origin floor gains real deny/allow e2e proof, malformed URLs are a defined 400, ISR and CSRF claims match shipped behavior, tautological gates are replaced with real ones, and 23 dead icons plus the dead token palette are gone.',
     state: 'stable',
     stamp: 'CURRENT',
   },