Decisions

2026-09-30: Under explicit owner release authorization, S162 tags exact human-merged source 9decf214dd58f2467c4f2fdd7228893ffafd17f9 and verifies actual v0.10.3 publication before reconciling current identity and review-candidate records. All four release jobs pass after normal owner crates.io approval, six certified public files reconcile and all ten registry versions are non-yanked with checksums. The records pull request preserves historical v0.10.2 evidence, unsigned policy, release protection and independent acceptance limits; it changes no product version, release workflow, dependency or published byte and performs no installed sensitive-product execution.

2026-10-03: S163 binds basename-only Steam creation events only under an exact managed launch receipt, rather than relaxing every generated profile path predicate. Client socket ownership is setup evidence, not captured traffic or proxy reachability; a separate reviewed target update and a fresh cold calibration preserve those boundaries. The slice adds no dependency, store migration, process handle, release version, or universal title-compatibility claim.

2026-10-03: S164 aligns both pinned release wrappers and release.toml with the annotated-tag handoff and ten product crates. The wrappers still do not create or push a tag, publish packages, or bypass operator merge and protected registry approval. Candidate version and generated evidence move under the established release process; verified public v0.10.3 markers remain unchanged until separate v0.10.4 publication evidence exists.

2026-10-03: Rebind the three reviewed dependency graphs and unsafe-review digest to v0.10.4 first-party package identities. Package and edge counts, all third-party packages and features, unsafe implementation, review expiry, and existing exceptions remain unchanged. This source metadata reconciliation does not claim independent whole-product approval.