[avrabe]

Refs #1622 #1136

This PR is now the whole v0.89.1 patch release. It ships #1622 (i64 loads and stores on a non-default memory) to gale. The compiler change itself is already on main as #1623 (c874396). This PR adds that change's record, the release tooling that can read a patch release, the anchor move, the version bump and the notes.

It has two commits, to be squashed under this PR's title. The title is lane-shaped (v0.89.1 PATCHVER: ...) and names RQ-89-PATCHVER, which this PR defines. The squash simulation is below.

What is in it

commit	content
PATCHVER (unchanged from the previous head, rebased onto df847a1)	One canonical release key in status_evidence_check (release_key / parse_release / fmt_release / expected_cut), imported by issue_closure_check and loop_conformance_check. Details are in the PATCHVER record and the commit message.
assembly	artifacts/release-v0.89.1/; the anchor moved to v0.89.0; the version 0.89.0 -> 0.89.1; CHANGELOG [0.89.1]; status.json; two more tooling sites that read a patch as its minor (below)

artifacts/release-v0.89.1/

• _release.yaml: comments only. release_file_statistics_scan.py --release v0.89.1 gives rc 0 with 0 digit hits and 0 word-number hits. As a potency check, a planted line gave 1 digit hit and 1 word-number hit; the plant was then removed.
• RQ-89-MEMK64: implemented, issue multi-memory phase 2: i64 load/store on a non-default memory under --native-pointer-abi (gale's supervisor domain has 12) #1622, issue-scope: closes, landed: PR v0.89.1 MEMK64 (#1622): lower the i64 load/store family on a non-default memory #1623 c874396. Its verified-by cites the memk_i64_1622 differential and the multi_memory_406 tests. The emulation floor is cited by its oracle's name only. As a potency check, planting the live floor value in this file reds floor-prose.
• RQ-89-PATCHVER: implemented, verified by its red-first tests, from PR v0.89.1 PATCHVER: the v0.89.1 patch release — i64 on a non-default memory for gale (#1622), and the release tooling reads a patch release as its own release #1624's earlier body.
• RQ-89-ARCHMODEL9: the steps-1-2 filing for v0.89.1. It has tags feature-loop, aadl and spar, issue Recurring N/A: feature-loop steps 1-2 (spar AADL -> WIT) have been skipped every release and never filed — #912's rule applied to itself #1136, status proposed, disposition: deferred. spar#445 and Recurring N/A: feature-loop steps 1-2 (spar AADL -> WIT) have been skipped every release and never filed — #912's rule applied to itself #1136 were re-read and both are OPEN.
• RQ-89-ACTIONPIN: proposed, disposition: partial, issue Dependabot 0.x-minor hold COMMENTS but does not enforce: #938 kept auto-merge enabled, and the hold label silently failed #965 (a citation only; that issue is closed). This record was not in the plan. After the rebase, df847a16 fix(dependabot): ... (#1627) is a delivery-typed subject inside the v0.89.0 window, and R10 requires every such subject to be attributed. The record names PR chore(dependabot): group version-locked families + github-actions into one PR each #1625, ci: pin all GitHub Actions to commit SHAs (not tags) #1626 and fix(dependabot): drop package-ecosystem from the actions group #1627. Its refuting command partly refutes "all actions pinned to SHAs": 223 uses: references are SHA-pinned and 72 are not. 70 of the 72 are dtolnay/rust-toolchain selected by channel or version. The other 2 are release tags that ci: pin all GitHub Actions to commit SHAs (not tags) #1626 did not rewrite: taiki-e/[email protected] and bazel-contrib/[email protected]. They are left as found.

Two more patch-blind sites (found while gating, same class as PATCHVER)

• recurring_na_filing_check.py, which ci.yml runs, truncated release: to (major, minor). With the anchor at v0.89.0, main's script on this tree refuses with rc 1: ambiguous: anchor+1 says v0.90 while the artifact tree's max says v0.89. It now uses parse_release / expected_cut / fmt_release and derives v0.89.1. Its --self-test passes, including both negative controls.
• test_issue_closure_check.py case (4) hard-coded the successor as minor+1. It was red on this tree. It now derives the successor from whether the anchor's next-patch directory exists, independently of expected_cut.

Anchor -> v0.89.0 (status_evidence_check.py and the SYNTH-STATUS-EVIDENCE-ANCHOR-1183 mirror)

The values were read off the gate's own anchor line, after setting ANCHOR_TAG = "v0.89.0":
A2 anchor v0.89.0: 687 artifacts in the tree at the tag != pinned ANCHOR_PROGRAMME 662. The delivery count at the tag is 134, unchanged. Paired controls: delivery 133 and 135 each give rc 1, programme 686 and 688 each give rc 1, and the old 662 gives rc 1 at v0.89.0. The final line is status-evidence-anchor: v0.89.0 — 134 delivery commits (pinned 134), 687 artifacts (pinned 687), lag 0.

Version 0.89.0 -> 0.89.1

Changed: workspace Cargo.toml, every path-dep version = pin, MODULE.bazel, npm/package.json, docs/status/FEATURE_MATRIX.md, and Cargo.lock via cargo update --workspace --offline. The lock moved 19 version lines, all synth crates, and nothing else. check_version_pins.py reports all at 0.89.1. release_version_check.py gives rc 0. A built target/debug/synth --version prints synth 0.89.1. CHANGELOG [0.89.0] and every v0.89.0 anchor reference are untouched.

Execution, re-run on the 0.89.1 binary

• SYNTH=./target/debug/synth python3 scripts/repro/memk_i64_1622_differential.py printed compared: 5484, ORACLE: PASS, rc 0.
• cargo test -p synth-cli --test multi_memory_406 passed 23 of 23.
• The reach census (2704 modules, 0 newly refused, 65 newly compiling, 268/268 executed identical) was not re-run. It is cited from v0.89.1 MEMK64 (#1622): lower the i64 load/store family on a non-default memory #1623.

Gates (real exit codes, run on the head 019f047 unless noted)

gate	result
claim_check.py claims.yaml	rc 0, 76/76
status_evidence_check.py	rc 0, 0 failures. On the branch: 6 delivery-shaped commits since v0.89.0, 6 attributed (MEMK64, SWEEPMUTANT, CENSUSFLOAT, #1627, and both PATCHVER commits). Squashed: 5 of 5.
verdict_prose_check.py	rc 0
issue_closure_check.py --release v0.89.1 --since-tag v0.89.0 --allow-unclosed	rc 0: 1 authorised (#1622), 0 held open, 0 failures. #1145 and #1136 are not authorised. The 18 closures in the window are attributed to v0.89's own ritual.
test_issue_closure_check / test_status_evidence_check / test_loop_conformance_check	rc 0 / 0 / 0
recurring_na_filing_check.py and --self-test	rc 0 / 0
release_version_check.py, check_version_pins.py	rc 0 / 0
check_py_floor.py under /usr/bin/python3 3.9.6, all 311 tracked .py	rc 0, 0 findings
cargo fmt --check	rc 0
cargo clippy --workspace --all-targets -- -D warnings	rc 0 (run on 5dbb0ab2; since then only CHANGELOG.md changed)
CI sweep (python3 scripts/... lines of ci.yml)	141 python3 scripts/ lines, 13 backslash-continued ones skipped, 87 distinct commands run. 18 non-zero, and every one gives the same rc on a df847a1 checkout: 12 oracle_evidence.py ($ORACLE_EVIDENCE_JSONL unset), check_varve_shadow_pins (no /tmp/varve-verify.txt), determinism_check (no target-repro), mcdc_gate (no witness output), 3 elf_static_check (no musl/release binary), and 2 if ...; then fragments split by the sweep. mutation_survey.py ci rc 0. Afterwards pgrep -fl mutation_survey was empty, and its mutants-ci.txt output was removed.

loop_conformance_check.py v0.89.1 (rc 1, DOES-NOT-CONFORM, expected before the review):

• step 0 PASS
• step 1-2 NA-FILED (RQ-89-ARCHMODEL9)
• step 3 PASS on all five slots
• step 4 PASS
• step 5: gate PASS; "mcdc ran on commit" is NOT-DERIVED until CI runs on the pushed head
• step 6 PASS
• step 7 FAIL: no docs/reviews/v0.89.1-cold-review.md
• step 8: pins PASS and changelog PASS; PR-head-vs-merge ATTESTED; crates and npm NA-BY-MOMENT

The cold-review record comes in a later PR after this one merges. It is not fabricated here.

Squash simulation (the merge_ritual.sh CHECK4 shape)

In a scratch clone at origin/main df847a1, git merge --squash of this branch at 019f047, then a commit with subject <this PR title> (#1624):

• The tree is identical to the branch head.
• status_evidence_check.py gives rc 0, status-evidence-window: 5 delivery-shaped commits since v0.89.0 — 5 attributed. On the unsquashed branch the window shows 6, because both commits are lane-shaped.
• Control: the same squash under v0.89.1 ASSEMBLY: control (#1624) gives rc 1, with R10-lane ... names artifact RQ-89-ASSEMBLY, which no release file defines.

SWEEPMUTANT (#1612) and CENSUSFLOAT (#1610)

Both landed after the v0.89.0 tag with v0.89 ... subjects. Their records are in artifacts/release-v0.89/, and they are attributed in the window.

They change no file under crates/: git diff --stat v0.89.0 origin/main -- crates/ lists only #1623's files. So they do not change the 0.89.1 binary. The notes list them as tooling changes.

Their records are not relabelled. One gap for the coordinator: #1611 is authorised by a v0.89 record delivered after v0.89.0 was tagged, so no audited release's closure set covers it. #1609 is outlives.

Rivet validation (required context), run the CI way

externals: was stripped and rivet validate run on the squash tree and on df847a1:

• Both give rc 1 with the same 40 cross-repo errors, and 0 errors that are ours under the CI filter.
• Warnings rise from 1181 to 1192. All 11 new ones are on the four new records, in the same classes every sibling record carries: no incoming verifies link, req-type: process, and the trailer-id shape.

Byte-identity of the two new script edits on a two-part tree

On a df847a1 checkout, main's scripts were compared with the PATCHVER scripts plus this PR's recurring_na_filing_check.py, anchored v0.88.0:

• recurring_na_filing_check.py output is cmp-IDENTICAL, both the normal run and --self-test.
• test_issue_closure_check.py case (4) passes on both.

Choices for the coordinator

• The RQ-89-ACTIONPIN citation. #965 is a closed, tangential citation, used because R5 requires fields.issue and no issue tracks chore(dependabot): group version-locked families + github-actions into one PR each #1625, ci: pin all GitHub Actions to commit SHAs (not tags) #1626 or fix(dependabot): drop package-ecosystem from the actions group #1627. The record is proposed + partial, so Dependabot 0.x-minor hold COMMENTS but does not enforce: #938 kept auto-merge enabled, and the hold label silently failed #965 is not in the authorised set.
• Pin the squash subject when merging. Use <this PR title> (#1624) explicitly. Do not leave GitHub to pick the subject.

Still missing before the tag

• docs/reviews/v0.89.1-cold-review.md, which is loop step 7.
• MC/DC on the pushed head, which is loop step 5.
• The step-8 PR-head-vs-merge diff, recorded in the review.

Dependabot config fix, folded in (2026-11-05)

Every commit since #1625 carried a failing .github/dependabot.yml check (Dependabot rejects a top-level groups:). That check is not required, but merge_ritual CHECK3 and the tag guards refuse any non-advisory failure, and the standalone fix (#1628) could not pass Claim Check before this PR's RQ-89-ACTIONPIN record existed. So the fix is the third commit here: each group is defined under the updates entry it belongs to (github-actions-all "*" under github-actions; wasm-tools-family + wast, and wasmtime, under cargo). Dependabot's own check parsed it green on #1628's head ebfb58a6. CHANGELOG [0.89.1] gains a sentence for it. Refs #1628

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!