[sotashimozono]

Round 3 of 3 of the review of the promotion PR #649. Bumps the version to 0.9.0-beta.30.

Fixed

• RepeatIndex grew without bound (Rust review, HIGH). An entry was removed only on a clean success. A doiget serve process therefore kept one entry for every refused ref for its whole life. Now, when a new entry lands, retain drops every entry older than REPLAY_WINDOW, the longest window of any rule. The new test entries_past_every_window_are_swept_when_a_new_one_lands covers it.
• config_fingerprint read config.toml with plain std::fs::read inside every fetch (Rust review, HIGH). The read now goes through store::blocking_section, as store reads do.
• metadata_quality::restores on remote strings (Rust review, MEDIUM). The alignment is O(n·m), allocated a new buffer per character, and had no length cap. Now:
  • it refuses strings over RESTORE_MAX_CHARS (2,000);
  • it refuses a candidate whose length the U+FFFDs cannot account for (between len and len + number of losses) before aligning;
  • it swaps two buffers instead of allocating.

Docs

• New docs/PUBLIC_API.md §1a: orchestrator, preprint, pubmed, software, user_pdf, repeat and metadata_quality are pub for the binaries' use and are not semver-locked (release-readiness review). The CHANGELOG now records the found_by: FoundBy type change.

Round 3 results

• The security and LEGAL review (hosts, redirects, rate limits, the ADS token, add file handling, remote JSON, CI) found nothing at confidence ≥ 80.
• The release-readiness review found the Promotion: next → main for 0.9.0 #649 PR body stale; it is updated after this PR merges.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!