From baa5dd6bfcf83220ffe9f9e3e0987bf9e5cc6f33 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 24 Sep 2026 00:35:29 +0000
Subject: [PATCH 1/2] chore(main): release 3.0.0

---
 .github/ISSUE_TEMPLATE/bug_report.yml  |   4 +-
 .release-please-manifest.json          |   2 +-
 CHANGELOG.md                           | 205 +++++++++++++++++++++++++
 README.md                              |   6 +-
 docs/operate/check-mode.md             |   4 +-
 docs/operate/layering.md               |   4 +-
 docs/operate/multi-repo.md             |   2 +-
 docs/operate/snapshot.md               |  10 +-
 docs/playbooks/drift-attestation.md    |   2 +-
 docs/playbooks/fleet-baseline-rings.md |   8 +-
 docs/playbooks/incident-freeze.md      |   2 +-
 docs/playbooks/preview-blast-radius.md |   4 +-
 docs/playbooks/trust-tiers.md          |   4 +-
 docs/reference/secrets-and-vaults.md   |   4 +-
 docs/start/examples.md                 |   2 +-
 docs/start/getting-started.md          |   6 +-
 docs/start/migrating-from-probot.md    |   2 +-
 docs/upgrading/README.md               |   2 +-
 package.json                           |   2 +-
 src/flows/snapshot.ts                  |   2 +-
 20 files changed, 241 insertions(+), 36 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index f673336e..7c9cd9bd 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -17,8 +17,8 @@ body:
     id: version
     attributes:
       label: Action version
-      description: The ref you pin in `uses:` (a tag like `v2`, or a commit sha). # x-release-please-major
-      placeholder: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      description: The ref you pin in `uses:` (a tag like `v3`, or a commit sha). # x-release-please-major
+      placeholder: Vivswan/github-settings-as-code@v3 # x-release-please-major
     validations:
       required: true
   - type: input
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 895bf0e3..d4f6f299 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "2.0.0"
+  ".": "3.0.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 442db8f8..aa5dc1a1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,210 @@
 # Changelog
 
+## [3.0.0](https://github.com/Vivswan/github-settings-as-code/compare/v2.0.0...v3.0.0) (2026-09-24)
+
+
+### ⚠ BREAKING CHANGES
+
+* **release:** publish next from the release-PR hook and drop the post-green verdict
+* **github:** GitHubClient.tryRequest() and tryGraphql() resolve to ClientAnswer, whose third arm is `{ failed }`, and ArtifactUploader.upload() resolves to `{ uploaded: true } | { failed }`. docs/upgrading/v2-to-v3.md section 58 names the fix.
+* **engine:** CheckOptions and ApplyOptions lose secretSource; pass it to validateSettings. A literal secret value in a section the sections input excludes now fails validation with exit 1 and zero requests.
+* **sections:** SectionModule.plan() and snapshot() resolve to Result<..., SectionFailure> instead of the plan or snapshot; docs/upgrading/v2-to-v3.md section 56 names the fix.
+* **engine:** a higher layer's null no longer deletes a lower key; it is written as the value, and a null a key does not admit fails validation naming the legal values. Drop a keyed entry with `_remove: true`, or clear a list with `_layering: replace`.
+* **library:** `SectionModule.plan()` no longer accepts a raw section value. Pass the section off a validated document: `validateSettings(doc)` (or `mergeSettings`, or `snapshotRepository`) returns `settings`, and `settings.labels` is the `ValidatedInput<"labels">` that `labels.plan()` takes.
+* **engine:** the problem codes settings-unknown-directives and settings-unknown-sections are deleted; settings-malformed-sections carries their lines in its issues. A switch on Problem.code naming either code stops compiling; drop the case.
+* **engine:** a settings file whose excluded sections carry a declaration the file-only checks refuse (duplicates, malformed lists, an unreadable deploy key) now fails before any write, naming the path; fix the declaration. A custom list module built with the library implements the `validate` hook.
+* **repository:** a repository section declaring a GET-only key (has_downloads, has_pages, custom_properties, ids, urls, counts), an unknown security_and_analysis sub-key, a commit message without its title or in an illegal squash pair, a malformed topic, or a PATCH toggle as null or a quoted boolean (has_wiki: "true", has_wiki: with no value) now fails to parse; the error names the key and the fix.
+* **branches:** a branches entry whose protection.restrictions mapping omits users or teams no longer parses; declare both lists ([] when none), or restrictions: null to lift the push restriction.
+* **rulesets:** a rulesets entry fails at parse, before any request, when its enforcement is not active, evaluate, or disabled; when a bypass actor breaks the spec's actor_id or bypass_mode rules; when ref_name carries "~" outside ~ALL or ~DEFAULT_BRANCH or a character git refuses in a ref name ("^", ":", "\", space, "..", "@{", control characters); or when a known rule type carries parameters the spec rejects. The message names the entry, key, and accepted values. An unknown rule type still passes through.
+* **deploy-keys:** a `deploy_keys[].key` that is not one line of `<algorithm> <base64> [comment]` with the algorithm one of ssh-ed25519, ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com now fails the settings-file parse (a DSA key is refused naming the date GitHub dropped DSA), and a pasted private key is refused there without the material being echoed; declare the contents of the .pub file.
+* **engine:** a higher layer's environments, branches, or workflows no longer replaces the lower list under the default layering: deep; write _layering: replace on the section's wrapper, or layering: replace on the run, to keep the old outcome.
+* **secret-scanning:** a secret_scanning_custom_patterns entry whose pattern, start_delimiter, end_delimiter, must_match, or must_not_match value fails the syntax check now fails the run at parse with exit 1, naming the field; previously it reached GitHub's bulk create.
+* **rulesets:** the parsed SettingsFile ruleset entry (the one sectionModule("rulesets").plan takes) requires target and enforcement, so a typed literal without them fails to compile. Parse the document through validateSettings, or declare both keys.
+* **branches:** a required_status_checks.checks item with a key other than context or app_id is refused; remove the key.
+* **branches:** a settings file declaring required_status_checks without strict or without contexts/checks, a required_approving_review_count outside 0-6, a scalar where those two mappings go, a GET-only protection key (name, enabled, enforcement_level, url, *_url at any depth), or an actor object where restrictions, dismissal_restrictions, or bypass_pull_request_allowances take login/slug strings now fails to parse before any request; the error names the key and the fix.
+* **check-suite-preferences:** check_suite_preferences.auto_trigger_checks[].app_id must be a positive integer and may appear once; a settings file carrying 0, a fraction, or a repeated app_id now fails at parse with a message naming the entries and the fix.
+* **setup:** a settings file declaring schedule, updated_at, a language in the GET's spelling (javascript, typescript, rust), or a string runner_label without runner_type: labeled now fails to parse with a message naming the fix.
+* **actions:** a settings file that declares selected_actions_url, artifact_and_log_retention.maximum_allowed_days, oidc_customization_sub.sub_claim_prefix, a selected_actions key outside the three documented ones, a mistyped selected_actions value (github_owned_allowed: "true", patterns_allowed: "docker/*"; main's record of unknown values accepted them), sha_pinning_required as a string ("true"; main passed it through as an undeclared key), an approval_policy outside GitHub's three, a malformed or repeated OIDC claim key, include_claim_keys beside use_default: true, or a fractional or non-positive retention or cache limit now fails to parse before any request; the error names the key and the fix.
+* **sections:** a settings file that omits a live field of a declared ruleset or environment now fails apply instead of writing over it; declare the field to keep the value, or declare it empty (`bypass_actors: []`, `reviewers: []`, `deployment_branch_policy: null`) to remove it on purpose
+* **engine:** `_layering: merge` and `layering: merge` no longer exist and fail as unknown values (the set is `replace`, `shallow`, `deep`). `mode: merge` is `mode: render`, `merged-file` is `rendered-file`, the CLI subcommand `merge` is `render`, the result word `merged` is `rendered`, and the problem codes `input-merge-only`, `input-rejected-in-merge`, `input-merged-file-missing`, `merged-file-is-layer`, and `merged-file-unwritable` carry the render spelling. Every list section now unions by its key under the default, where only labels and rulesets did.
+* **secrets:** a settings file whose secret or variable name has a hyphen, a space, a leading digit, or a GITHUB_ prefix in any case, or whose variable value is over 49152 bytes of UTF-8, now fails to parse before any request instead of reaching GitHub. Rename the entry to ASCII letters, digits, and underscores, or shorten the value; the problem line names the entry's path.
+* **sections:** `collaborators[].permission` and `teams[].permission` refuse "read", "write", mis-cased standard permissions, empty values, and whitespace at either end; declare "pull", "push", or the lowercase form. `teams[].name` refuses anything outside `[A-Za-z0-9._-]` and a value with no letter or digit; declare the team's slug.
+* **webhooks:** a settings file whose webhook names an event GitHub does not deliver to repository webhooks, a content_type other than "json" or "form", an insecure_ssl other than "0", "1", 0, or 1, or a url that is not an absolute URL now fails to parse with exit 1 instead of failing at apply time.
+* **interaction-limits:** interaction_limits accepts only limit, expiry, pull_request_creation_cap, and pull_request_creation_bypass; limit and expiry must be GitHub's enum values and max_open_pull_requests a whole number from 1 to 1000. A settings file carrying anything else now fails at parse with a message naming the key and the rule.
+* **pages:** a pages declaration carrying url, html_url, status, custom_404, protected_domain_state, pending_domain_unverified_at, or https_certificate fails validation before any request; remove the key. pages.source.path accepts only / or /docs; any other path fails validation before any request.
+* **milestones:** `due_on` takes a calendar day `YYYY-MM-DD` (or a UTC timestamp `YYYY-MM-DDTHH:MM:SSZ`, read for its day); `due_on: null` and offset timestamps such as `2026-01-15T00:00:00+02:00` are refused with an error naming the day form. A snapshot emits a due date as `YYYY-MM-DDT12:00:00Z`.
+* **labels:** labels[].color must be six hex digits with the leading "#" optional, and labels[].description is capped at 100 characters; a settings file carrying either now fails at parse with a message naming the entry and the rule.
+* **engine:** a higher `pages: null` now means "site off". A repository that used `pages: null` over a fleet Pages block to opt out of the fleet's declaration has its live Pages site deleted on the next apply, and `interaction_limits: null` over a fleet limit clears the live limit the same way. The way to opt out of a fleet Pages block without disabling the site no longer exists.
+* **environments:** environment declarations that parsed before are refused at parse time: wait_timer outside 0..43200 or not an integer, more than six reviewers, deployment_branch_policy with both flags true or both false, prevent_self_review without reviewers, and a deployment_branch_policies type outside branch and tag; the exported DeploymentBranchPolicyConfig.type narrows to "branch" | "tag". A fractional wait_timer (2.5): write a whole number of minutes. prevent_self_review: true without reviewers: declare a reviewer, or write prevent_self_review: false. deployment_branch_policy with both flags false: write deployment_branch_policy: null. deployment_branch_policies[].type outside branch | tag (wildcard): write branch or tag.
+* **sections:** a GET or GraphQL body off GitHub's documented shape now fails the section with `returned a body outside the documented shape` naming the endpoint and field, where before it flowed into the comparison or a section's own message; a reading section without snapshot() no longer compiles; the teams and custom_properties owner probe runs ahead of their own validation.
+* **sections:** teams, workflows, the environment listing and its pins, the protected-branch listing, the GraphQL protection rules, and the protection-rule Apps now fail plan and snapshot when GitHub holds two items under one identity, naming both; before, one was picked silently. The protection-rule Apps list is read at plan for an existing environment and after the PUT for one the run creates.
+* **sections:** the teams, collaborators, and inherited interaction-limit snapshot notes read `<label>: left out of the snapshot - <reason>`; the interaction_limits.expiry and repository toggle notes use the cannot-verify template; a personal account under teams or custom_properties reads one note (docs/upgrading/v2-to-v3.md section 13).
+* **library:** the merged file is the fold in the layers' key order, so a merged file committed under v2 reorders once. A top-level null on a section nothing below declares drops without a notice (pages and interaction_limits keep it), where v2 refused the merge.
+* **flows:** `parseConfig(read, env, capabilities)` owns the `private-report: artifact` refusal (`input-artifact-unsupported`); `artifact-uploader-missing` and the flows' uploader check are gone. `executeRun` returns `RunEnd { exitCode, fatal? }` and `RunDeps` has no `describe`; `failRun(io, problem)` takes no wording hook. `validateSettingsDoc` and `validateSettings` take a `SectionSelection` where they took a `ReadonlySet<SectionKey>`. `parseSnapshotFileConfig(read, env, "settings-file")` reads the destination itself; `SettingsFileRole` gains `central-file`. The action and the command line print one wording per problem; remedies name the input and its flag and say "re-run" without "the workflow".
+* **release:** the build branch gets nothing new and is deleted once every consumer has repinned; packaged commits live under build/<position>.<sha7> tags, the ten newest kept, so a sha pinned from one lives until ten newer commits are packaged. A rerun of an older release's retag-major leaves a newer release's major in place instead of failing; the verify subcommand is gone.
+* **sections:** check mode no longer reads a secret family's sealing key (a malformed key fails the first PUT at apply); the environment secret and variable lines use the engines' wording (docs/upgrading/v2-to-v3.md sections 19-20).
+* **settings:** an unknown underscore key at the document root fails validation naming `_layering` and `_undeclared`, where v2 dropped it as a private note; move notes into YAML comments. `teams` takes the `{_undeclared, entries}` wrapper (default `keep`): every run lists the repository's teams (repository Administration read) and notes undeclared direct grants, `_undeclared: delete` revokes them, and snapshots write the wrapper form. The retry-timing knob is read from `GSAC_RETRY_BASE_MS`; `RETRY_BASE_MS` is ignored.
+* **sections:** two live items under one identity fail every list section, in plan and snapshot; the webhook snapshot placeholder is $SECRET_WEBHOOK_<id>; webhooks manage web hooks only and never write `name`; a ruleset without source_type is repository-owned, a repeated rule type a settings-file error; one wording per concept in drift lines and notes (docs/upgrading/v2-to-v3.md sections 11-15).
+* **library:** the npm library's entry exports the 118 documented names; 88 of its v2 names leave it: 83 move to the `./internal` subpath with no semver promise and 5 are renamed below. `GithubApi`, `GithubApiOptions`, `GithubClient` are `GitHubApi`, `GitHubApiOptions`, `GitHubClient`; `MissingPermissionPolicy` is `OnMissingPermission`. `checkRepository` and `applyRepository` take `(client, repo, settings, options?)`; `RepoRunReport` is `CheckReport` and `ApplyReport`; `SnapshotLibraryOptions` is `SnapshotOptions`. `validateSettings` returns `{ settings, log }` and takes `sections` as a `SectionSelection`; `mergeSettings(layers, options?)` replaces the public `foldLayers`.
+* **flows:** one redaction seal for every target kind ([#204](https://github.com/Vivswan/github-settings-as-code/issues/204))
+* **flows:** one run outcome model for every mode ([#201](https://github.com/Vivswan/github-settings-as-code/issues/201))
+* **upgrading:** two more v3 breaks. (1) A settings-file path may no longer contain a comma or a newline in any mode (they are the list separators mode: merge splits on); apply and check reject such a path with an input error naming the rule; rename the file. (2) defaults-file is no longer merged under every multi-repo target: it is applied whole to a target that has no settings file of its own (previously skipped), and a target's own file is applied as written; build layered documents with mode: merge and apply its output; run mode: check first, since with repos: "*" every discovered repository without a settings file now receives the defaults.
+* the knobbed list wrapper's policy key is `_undeclared`; a settings file still writing `undeclared` fails validation with an error naming the new key.
+
+### Features
+
+* **actions:** refuse at parse the actions fields that could never converge ([f68d78b](https://github.com/Vivswan/github-settings-as-code/commit/f68d78bf4a26e916499b1bf5d1b6472f6814679a))
+* add mode: merge with a layered settings-file ([#104](https://github.com/Vivswan/github-settings-as-code/issues/104)) ([d50e70b](https://github.com/Vivswan/github-settings-as-code/commit/d50e70bd51ddf620d023c8c9daf8f94dc269b4b3))
+* add the plan-returning section contract and migrate the workflows section ([8a65765](https://github.com/Vivswan/github-settings-as-code/commit/8a65765e276540e75aae83992b3383ea8e4002ef))
+* **branches:** refuse protection shapes the settings file alone shows wrong ([990c51a](https://github.com/Vivswan/github-settings-as-code/commit/990c51aade3720d9d952b0b0a6e2d8bbc97a0f7e))
+* **check-suite-preferences:** refuse app_ids GitHub rejects or collapses when the file is parsed ([5b3c8e9](https://github.com/Vivswan/github-settings-as-code/commit/5b3c8e9475f3a1a1cc61fc2b1d987d546197b1f9))
+* **ci:** gate kept backward-compatibility code behind COMPAT markers ([#173](https://github.com/Vivswan/github-settings-as-code/issues/173)) ([bf9f482](https://github.com/Vivswan/github-settings-as-code/commit/bf9f482a7ce55911918d81208cf7c88922e67220))
+* **ci:** never-throw gate with a shrinking ratchet in lint:arch ([8fcc505](https://github.com/Vivswan/github-settings-as-code/commit/8fcc5055cfaed5a67bfd630bd4e7a5ef8b1a05a4))
+* **cli:** github-settings-as-code and gsac commands over the library ([#152](https://github.com/Vivswan/github-settings-as-code/issues/152)) ([364a9c6](https://github.com/Vivswan/github-settings-as-code/commit/364a9c62988a60a6e6af0e434c364aed37be41bc))
+* **cli:** gsac init writes the live settings to .github/settings.yml and prints its PAT grant ([#178](https://github.com/Vivswan/github-settings-as-code/issues/178)) ([3fad2b2](https://github.com/Vivswan/github-settings-as-code/commit/3fad2b25706a3d4fc82a1012c2068053bff8c243))
+* **cli:** under GitHub Actions the CLI emits the action's workflow commands ([#223](https://github.com/Vivswan/github-settings-as-code/issues/223)) ([de75a22](https://github.com/Vivswan/github-settings-as-code/commit/de75a22ac3bff374c509523391c5be3c6cd3e006))
+* **contract:** extend the plan contract for every migrating section ([9ae375c](https://github.com/Vivswan/github-settings-as-code/commit/9ae375cc6027d9d7eac970eb808d14a588bac80f))
+* **deploy-keys:** refuse anything but a public SSH key at parse ([473aa1a](https://github.com/Vivswan/github-settings-as-code/commit/473aa1a9d103f9a0fd3294c905612fc97c261ff5))
+* derive list sections from a declarative factory, piloted on labels ([71859b5](https://github.com/Vivswan/github-settings-as-code/commit/71859b571bc4c334d4e6796b5424b27f361fb8df))
+* **engine:** a higher layer's null wins and means empty on GitHub, and _remove drops a keyed entry ([2ae92c5](https://github.com/Vivswan/github-settings-as-code/commit/2ae92c5f802ebed687ab4c149375fd7d908c15d7))
+* **engine:** a higher-layer null keeps its value on pages and interaction_limits ([6154cc5](https://github.com/Vivswan/github-settings-as-code/commit/6154cc5e03cfbdd58f4d378edc5c0a1ab88cdc8d))
+* **engine:** layer environments, branches, and workflows by key through a {_layering, entries} wrapper ([9e52313](https://github.com/Vivswan/github-settings-as-code/commit/9e5231388207222cc72a095bc53a0ae43f044fb7))
+* **engine:** layer every list section by key with replace, shallow, and deep ([8133147](https://github.com/Vivswan/github-settings-as-code/commit/81331479f4a2a5c597c1569ac525bc6ba66beecd))
+* **engine:** report every parse error of a section in one run ([db7ebec](https://github.com/Vivswan/github-settings-as-code/commit/db7ebec9e5ce45e49c271d6656e4b3fe8df0622f))
+* **engine:** resolve the undeclared policy once from a file-wide _undeclared and the undeclared input ([a9dcf68](https://github.com/Vivswan/github-settings-as-code/commit/a9dcf68da10889463927158e972dceb14a7390dd))
+* **engine:** run every file-only check before the first write ([1bbe9b2](https://github.com/Vivswan/github-settings-as-code/commit/1bbe9b2db19be6ec7134b926975c35709e9731fd))
+* **environments:** declared-off protection converges, and the schema refuses what GitHub never accepts ([aa43d3e](https://github.com/Vivswan/github-settings-as-code/commit/aa43d3eb3c31ec3dc4028fae4fbe1ae9e0945782))
+* generate action.yml, the inputs table, and the policy and permissions references from declarations ([d062cf1](https://github.com/Vivswan/github-settings-as-code/commit/d062cf1b6bd4f2767986477c383f2bed1a201341))
+* generate COVERAGE.md from section declarations ([51068cd](https://github.com/Vivswan/github-settings-as-code/commit/51068cdd765667b1190cb99625cd7ab6f656df7f))
+* generate the README sections table, outputs, and PAT form from section declarations ([83f3c84](https://github.com/Vivswan/github-settings-as-code/commit/83f3c84ede257c66e2d5ca0cb46f9b3ebfee20e3))
+* **interaction-limits:** refuse limits, expiries, caps, and keys GitHub rejects when the file is parsed ([1e9a806](https://github.com/Vivswan/github-settings-as-code/commit/1e9a8060ad031657261eca5904f8e0c8a1ff4d26))
+* **labels:** refuse colors and descriptions GitHub rejects when the file is parsed ([10242f4](https://github.com/Vivswan/github-settings-as-code/commit/10242f4a0ca0ccbab538d0bc2a0fb4e63fc727a9))
+* **library:** export the section contexts so a consumer can call a section module directly ([#191](https://github.com/Vivswan/github-settings-as-code/issues/191)) ([ed6143a](https://github.com/Vivswan/github-settings-as-code/commit/ed6143ab0772866a4eb6d74526b759a294759d92))
+* **library:** package @vivswan/github-settings-as-code ([#142](https://github.com/Vivswan/github-settings-as-code/issues/142)) ([cbeb56f](https://github.com/Vivswan/github-settings-as-code/commit/cbeb56f7406e201a1363d3b8023f509fe00aa1c9))
+* **library:** plan() takes only the input validation minted ([ce31e10](https://github.com/Vivswan/github-settings-as-code/commit/ce31e1025125f1bd42a1885d6942d0ceb9439ce1))
+* **pages:** refuse the site fields only the GET reports and a source path Pages cannot publish from ([3f17468](https://github.com/Vivswan/github-settings-as-code/commit/3f17468f150e29d56d82e58a0b6b5ae5c5bffff3))
+* publish packaged commits on a build branch, with latest and the version tags on it ([#122](https://github.com/Vivswan/github-settings-as-code/issues/122)) ([db45c7d](https://github.com/Vivswan/github-settings-as-code/commit/db45c7d9f297b68a10a39c8f24a4d65a5fffe99b))
+* **release:** carry the library build on the packaged branch and publish to npm ([#150](https://github.com/Vivswan/github-settings-as-code/issues/150)) ([8eb5897](https://github.com/Vivswan/github-settings-as-code/commit/8eb589726fd142f811b74717229ae1925a68a525))
+* **release:** publish next from the release-PR hook and drop the post-green verdict ([006e276](https://github.com/Vivswan/github-settings-as-code/commit/006e276774996e4b38ac951af953ecd10eaee993))
+* **render:** the snapshot and the merged file render one canonical order, and the snapshot carries no timestamp ([#237](https://github.com/Vivswan/github-settings-as-code/issues/237)) ([9d16e15](https://github.com/Vivswan/github-settings-as-code/commit/9d16e15352064f52c8f38c3aa93aa6cec9d23e52))
+* **report:** a delivered report issue is announced in the log ([#235](https://github.com/Vivswan/github-settings-as-code/issues/235)) ([7e85572](https://github.com/Vivswan/github-settings-as-code/commit/7e8557291ea08607924bb7fdc5e7f2f665703af4))
+* **repository:** refuse GET-only keys, illegal commit-message pairs, bad topics, and unknown security sub-keys at parse ([82429e1](https://github.com/Vivswan/github-settings-as-code/commit/82429e118ffc9568d8d38f495e4edcfd7bca214d))
+* **rulesets:** refuse what the file alone shows wrong about a ruleset when it is parsed ([50959dd](https://github.com/Vivswan/github-settings-as-code/commit/50959ddca147cfbee9f72e953f4a06ec22393437))
+* **secret-scanning:** refuse patterns that cannot compile when the file is parsed ([3c81fa2](https://github.com/Vivswan/github-settings-as-code/commit/3c81fa241e34e3f6fc65a04c2a530ceb08b21dba))
+* **secrets:** refuse secret and variable names GitHub rejects when the file is parsed ([6f93110](https://github.com/Vivswan/github-settings-as-code/commit/6f93110b4b1985c6472d6f6cbb87c0df879577ef))
+* **sections:** refuse permissions and team names GitHub rejects when the file is parsed ([830d0a8](https://github.com/Vivswan/github-settings-as-code/commit/830d0a87534276f5aa8558aaf4430faf696fbf1b))
+* **setup:** refuse known-wrong setup keys at parse and note unechoed keys ([562d6f0](https://github.com/Vivswan/github-settings-as-code/commit/562d6f08357a4029eaf503fcac6dad54b0214a53))
+* **snapshot:** branches and environments read back ([#147](https://github.com/Vivswan/github-settings-as-code/issues/147)) ([5f03322](https://github.com/Vivswan/github-settings-as-code/commit/5f03322b08e2da054445692f48d7650364fb675b))
+* **snapshot:** collaborators and teams read back ([#148](https://github.com/Vivswan/github-settings-as-code/issues/148)) ([3b4f753](https://github.com/Vivswan/github-settings-as-code/commit/3b4f75392db21a7eb1a87532decf2bd0c34cd1f9))
+* **snapshot:** mode snapshot writes live settings to a file or a per-repo directory ([#146](https://github.com/Vivswan/github-settings-as-code/issues/146)) ([9233a14](https://github.com/Vivswan/github-settings-as-code/commit/9233a14949815e14c50936fa697200fc46938f00))
+* **snapshot:** read back the GraphQL-only branch rules and environment pins ([#185](https://github.com/Vivswan/github-settings-as-code/issues/185)) ([63435fc](https://github.com/Vivswan/github-settings-as-code/commit/63435fcaa35ef601d3719282385a0a6f39927387))
+* **snapshot:** repository, actions, and rulesets read back ([#143](https://github.com/Vivswan/github-settings-as-code/issues/143)) ([3d256b8](https://github.com/Vivswan/github-settings-as-code/commit/3d256b83c1231c5f5897c1dd35d735080a169951))
+* **snapshot:** section snapshot contract, engine, round-trip harness, and the first sections ([#140](https://github.com/Vivswan/github-settings-as-code/issues/140)) ([f721bb1](https://github.com/Vivswan/github-settings-as-code/commit/f721bb19f35e6dfdda1159eed4c975b4a125425f))
+* **webhooks:** derive the repository event vocabulary from GitHub's webhooks OpenAPI description ([a3ca9c8](https://github.com/Vivswan/github-settings-as-code/commit/a3ca9c8d324bed75fbc0ea755c4e7ea4e6d79bee))
+* **webhooks:** refuse events, content types, insecure_ssl spellings, and urls GitHub would 422 ([4414231](https://github.com/Vivswan/github-settings-as-code/commit/44142310f431464e0dc05e1679f1d1a0afebaf18))
+
+
+### Bug Fixes
+
+* **action:** the YAML parser never prints a settings file's source lines as warnings ([#123](https://github.com/Vivswan/github-settings-as-code/issues/123)) ([54a50a0](https://github.com/Vivswan/github-settings-as-code/commit/54a50a074dfbd6ccee945f1b476e3f9f9fc06699))
+* adopt zod 4.5's native root $ref emission and own-__proto__ rejection ([#67](https://github.com/Vivswan/github-settings-as-code/issues/67)) ([44dab3b](https://github.com/Vivswan/github-settings-as-code/commit/44dab3bccf1e5fca5546d48dda45756c1d7ae084))
+* apply review fixes to the docs and tooling sweep ([73b6b4a](https://github.com/Vivswan/github-settings-as-code/commit/73b6b4a4f2cbc2f0f3263fee3478ea0eb2b6eab8))
+* apply review fixes to the harness audit batch ([ceb9f46](https://github.com/Vivswan/github-settings-as-code/commit/ceb9f463d7e7bd24acf4bcb770eb6bee63a9219a))
+* apply review fixes to the src-side audit batch ([b9de617](https://github.com/Vivswan/github-settings-as-code/commit/b9de617bdd0e9cb2444f2b544f8c5c3ae8c754bb))
+* attest build provenance and attach the sigstore bundle to releases ([b5db672](https://github.com/Vivswan/github-settings-as-code/commit/b5db67242eabf3b2c380ba672bcd022c476ddfdf))
+* **autolinks:** keep the live is_alphanumeric on a recreate and refuse what GitHub 422s ([#263](https://github.com/Vivswan/github-settings-as-code/issues/263)) ([2011455](https://github.com/Vivswan/github-settings-as-code/commit/2011455dc6d572353d6c7a60199e1b0d1a6714c5))
+* **branches:** a denied branch probe no longer reads as a missing branch ([#149](https://github.com/Vivswan/github-settings-as-code/issues/149)) ([c1d6243](https://github.com/Vivswan/github-settings-as-code/commit/c1d62434c124cb8b49bf482884a9966b4498d43e))
+* **branches:** compare actor lists case-insensitively and read an absent review holder as empty ([#269](https://github.com/Vivswan/github-settings-as-code/issues/269)) ([46ed70f](https://github.com/Vivswan/github-settings-as-code/commit/46ed70f329ebe39b23c9d0f99fa78a3f639ae219))
+* **branches:** refuse a restrictions block without its users and teams lists at parse ([03f783e](https://github.com/Vivswan/github-settings-as-code/commit/03f783ee5d4ba0b373290ccf64c6b749d150f553))
+* **branches:** report an omitted all-empty live restrictions holder and type required_status_checks.checks items ([917025c](https://github.com/Vivswan/github-settings-as-code/commit/917025ce2c42c3a2d60b15a203457e432a16b272))
+* **branches:** seal GraphQL node-id lookups at execution so check mode never issues them ([#75](https://github.com/Vivswan/github-settings-as-code/issues/75)) ([feaf279](https://github.com/Vivswan/github-settings-as-code/commit/feaf279a69df4c125f33827ed5b300c18b657a4e)), closes [#73](https://github.com/Vivswan/github-settings-as-code/issues/73)
+* centralize the token-leak sweep in the runner ([7dcc225](https://github.com/Vivswan/github-settings-as-code/commit/7dcc2256e80f56248284b77b7ef1c17decd3c5c2))
+* **ci:** name the fuzz-issue inputs the action no longer defaults ([#186](https://github.com/Vivswan/github-settings-as-code/issues/186)) ([fded5f5](https://github.com/Vivswan/github-settings-as-code/commit/fded5f527679e8028a8eeb5dd77af39aa51c012d))
+* classify rate limits structurally on every path ([65f97a2](https://github.com/Vivswan/github-settings-as-code/commit/65f97a2a86e85d60492889a85f28273996d48fd7))
+* **cli:** each command's help names only the flags it accepts ([#182](https://github.com/Vivswan/github-settings-as-code/issues/182)) ([51a75e7](https://github.com/Vivswan/github-settings-as-code/commit/51a75e79d4df92282b4339f3571ec7f7107a3ac4))
+* **contract:** classify definitive 404 rejections ahead of the permission branch ([#164](https://github.com/Vivswan/github-settings-as-code/issues/164)) ([8be6b7d](https://github.com/Vivswan/github-settings-as-code/commit/8be6b7d901e840e3088066699723e83e9f5ea8ec))
+* **contract:** the plainData refusal names what JSON does with each bad item; the grant comment points at the generated docs; the validate truncation arms get their relation ([#231](https://github.com/Vivswan/github-settings-as-code/issues/231)) ([0118807](https://github.com/Vivswan/github-settings-as-code/commit/0118807afdb1fcef33d0b5b5d3b73d861c1a917e))
+* correct mock identity minting and the pages resurrect bug ([9152a91](https://github.com/Vivswan/github-settings-as-code/commit/9152a91b6f1ef2dd8b5ef94223abb9d5dc72a663))
+* cover every faultable section in the fuzz fault battery ([e41aa99](https://github.com/Vivswan/github-settings-as-code/commit/e41aa9916c9673941b40365347c77692352a16e1))
+* derive owner-kind sensitivity from the section declaration ([0181f01](https://github.com/Vivswan/github-settings-as-code/commit/0181f01a752eb9675f48663d21e9ce70ef497b31))
+* **dev:** a fresh checkout runs bun run check green; the trimmed OpenAPI file regenerates when absent ([#219](https://github.com/Vivswan/github-settings-as-code/issues/219)) ([7468741](https://github.com/Vivswan/github-settings-as-code/commit/746874159452dcece59b25187070b534643a9ac8))
+* discover schema-corpus scenarios across all scenario roots ([d34d031](https://github.com/Vivswan/github-settings-as-code/commit/d34d0316af107fccf5c910352eae608dff39e91c))
+* **e2e:** oracle never predicts a preflight abort for teams on a personal account ([#114](https://github.com/Vivswan/github-settings-as-code/issues/114)) ([152c7d9](https://github.com/Vivswan/github-settings-as-code/commit/152c7d98e9de002a9ffad32e06ed6a1bfaa17733))
+* **e2e:** path param accessors read own keys only ([#158](https://github.com/Vivswan/github-settings-as-code/issues/158)) ([89c8ee8](https://github.com/Vivswan/github-settings-as-code/commit/89c8ee811d661baab9a4610ae7fc1f777276bd18))
+* **engine:** judge secret references at validation, in excluded sections too ([bc0d7f6](https://github.com/Vivswan/github-settings-as-code/commit/bc0d7f6168ce7c850e23e9ba02ed762383f24383))
+* **engine:** the validated brand has one mint; the marker injection re-validates ([df18966](https://github.com/Vivswan/github-settings-as-code/commit/df18966034faa435d5724ebcbbe40ab5cb5f1a18))
+* **engine:** withhold a secret-carrying request's failure for any client ([#175](https://github.com/Vivswan/github-settings-as-code/issues/175)) ([14a5c72](https://github.com/Vivswan/github-settings-as-code/commit/14a5c72fe150a97d947d00a54b97467c2e5ab025))
+* every count in a user-facing message takes the singular or the plural, never "(s)" ([#236](https://github.com/Vivswan/github-settings-as-code/issues/236)) ([5523d38](https://github.com/Vivswan/github-settings-as-code/commit/5523d38f714a27b293379596f8309a5e73305cd5))
+* **flows:** the fleet summary says one repository; a duplicate private target is deduped under its redacted name ([#233](https://github.com/Vivswan/github-settings-as-code/issues/233)) ([d23fea1](https://github.com/Vivswan/github-settings-as-code/commit/d23fea17fb7ce70988ee530a02f3f82a404a6c8f))
+* **github:** keep the throttling plugin on under the test knob via an injected scheduler ([#161](https://github.com/Vivswan/github-settings-as-code/issues/161)) ([dbdcd7b](https://github.com/Vivswan/github-settings-as-code/commit/dbdcd7b265619c13d4d6f900f65eba716280dac5))
+* **github:** pace every throttling group by the client's own scheduler ([#165](https://github.com/Vivswan/github-settings-as-code/issues/165)) ([d70d315](https://github.com/Vivswan/github-settings-as-code/commit/d70d31578167c1004c3820d5d184d4c7f4ae74c8))
+* **github:** refuse a cyclic payload at its field instead of exhausting the stack ([#171](https://github.com/Vivswan/github-settings-as-code/issues/171)) ([9dc8e42](https://github.com/Vivswan/github-settings-as-code/commit/9dc8e429514aebfccc9519aecfaa2cbc4223e954))
+* hand sections the parsed settings document instead of the raw one ([1ddc2f3](https://github.com/Vivswan/github-settings-as-code/commit/1ddc2f3ed9cf567e5bd5bb67d658d6ae28f3902a))
+* harden release boundary checks and decouple the schema id from the release manifest ([f5c4c59](https://github.com/Vivswan/github-settings-as-code/commit/f5c4c59896053ed9ef5eecd44e550887dfe33959))
+* harden the CI tooling ([6fb2603](https://github.com/Vivswan/github-settings-as-code/commit/6fb2603a57cfa6ed2d6fc98041fbb60dd2d18f7a))
+* **io:** collectingIo masks captured text with the shared redactor ([#163](https://github.com/Vivswan/github-settings-as-code/issues/163)) ([a0faf1c](https://github.com/Vivswan/github-settings-as-code/commit/a0faf1cd2f4a427973478a33385572296767072a))
+* keep spec-pinned gaps out of automatic graduation ([ae278c9](https://github.com/Vivswan/github-settings-as-code/commit/ae278c9f3770a8580727db917124a0cea32e164b))
+* **layers:** a validation issue after a _remove entry names the entry by its index in the file ([5b4b750](https://github.com/Vivswan/github-settings-as-code/commit/5b4b7508caf7beb34d1a5b3c8c6e77404e54b7b7))
+* **library:** gate findings on the packaging PR ([#156](https://github.com/Vivswan/github-settings-as-code/issues/156)) ([e4e8b4c](https://github.com/Vivswan/github-settings-as-code/commit/e4e8b4c1f7717100a5a96348fe0e2174ae6d5e0e))
+* **library:** mergeSettings renders the fold the action writes; a null over nothing drops ([e725c08](https://github.com/Vivswan/github-settings-as-code/commit/e725c08621d92414afd124a1523fa8cf4f05750b))
+* **milestones:** compare due_on by day so it converges ([c02395c](https://github.com/Vivswan/github-settings-as-code/commit/c02395cc90913e140364f8e31de5c7eae2c1bef7))
+* **nightly:** file the curated e2e issue through the fleet action ([#160](https://github.com/Vivswan/github-settings-as-code/issues/160)) ([8ef9747](https://github.com/Vivswan/github-settings-as-code/commit/8ef974791d61264e69dcae81be481a645fb5a420))
+* **nightly:** replay a fuzz artifact with the command its run wrote ([#157](https://github.com/Vivswan/github-settings-as-code/issues/157)) ([339e002](https://github.com/Vivswan/github-settings-as-code/commit/339e002d13cdcf4054d185bf44661695ccf7877e))
+* parse live bodies through parseLive in the seven asserting sections ([56ca3e4](https://github.com/Vivswan/github-settings-as-code/commit/56ca3e41dc90981580c4d45057594ad8f4b74369))
+* pass zod's schema layout through instead of guarding it ([#68](https://github.com/Vivswan/github-settings-as-code/issues/68)) ([64aad27](https://github.com/Vivswan/github-settings-as-code/commit/64aad276b2182d4a39175d15fe5e4e7b530345d0))
+* reject required-sections entries excluded by the sections allowlist ([c1fc169](https://github.com/Vivswan/github-settings-as-code/commit/c1fc1699adc8027919464bea8eceb65b53fc81f2))
+* **release:** follow the attestation bundle rename in the repo-owned asset check and SECURITY.md ([#76](https://github.com/Vivswan/github-settings-as-code/issues/76)) ([3704176](https://github.com/Vivswan/github-settings-as-code/commit/3704176cc0709d1c19a70765c925f033f4266ccd))
+* **release:** keep next from moving back on a publish the registry has not yet shown ([#190](https://github.com/Vivswan/github-settings-as-code/issues/190)) ([c247bab](https://github.com/Vivswan/github-settings-as-code/commit/c247babde06fc16d8b1a0fb3e0ee4d3de44439cd))
+* **release:** order pre-release versions by main's commit count, not the run number ([#197](https://github.com/Vivswan/github-settings-as-code/issues/197)) ([131780e](https://github.com/Vivswan/github-settings-as-code/commit/131780e1d385820500eda378f81c79da2335d72e))
+* **release:** read the major line in one advertisement and publish latest from the whole chain ([#172](https://github.com/Vivswan/github-settings-as-code/issues/172)) ([1312f3f](https://github.com/Vivswan/github-settings-as-code/commit/1312f3f04db9bde25256229f5409033c08958560))
+* **release:** refuse a build tip whose Source trailer is not a full sha and fix the post-green coalescing note ([#176](https://github.com/Vivswan/github-settings-as-code/issues/176)) ([ee6c725](https://github.com/Vivswan/github-settings-as-code/commit/ee6c725a9b12beeddfe936dd29f51a25fc89a1f5))
+* **report:** match report issues by their own body, open over closed, newest first ([#170](https://github.com/Vivswan/github-settings-as-code/issues/170)) ([8d5c1a8](https://github.com/Vivswan/github-settings-as-code/commit/8d5c1a88340e4227f7894e11f9059023c10031e3))
+* **report:** paginate the report-issue lookups and scan by title, not creator ([#159](https://github.com/Vivswan/github-settings-as-code/issues/159)) ([631e1da](https://github.com/Vivswan/github-settings-as-code/commit/631e1da622e16f75c8c95caf3a2f7b8614c6d4a0))
+* **rulesets:** bypass_actors hidden from a non-admin token is not drift ([#137](https://github.com/Vivswan/github-settings-as-code/issues/137)) ([b8df084](https://github.com/Vivswan/github-settings-as-code/commit/b8df084cb0af6bc15e6d7cf9afe68a6e3f68226e))
+* **scripts:** the permission count in the generated docs takes the helper; the npm-confirm line is pinned with an injectable pause ([#239](https://github.com/Vivswan/github-settings-as-code/issues/239)) ([e6897d8](https://github.com/Vivswan/github-settings-as-code/commit/e6897d81d3306fe4447c9e5b0c003bff2c3e8d0d))
+* **sections:** every shape rule reports beside a raw sibling instead of ending on it ([e1c62bd](https://github.com/Vivswan/github-settings-as-code/commit/e1c62bd5d9d394c2a2ec02509f630ef03e9f56ec))
+* **sections:** make the impossible literal-with-routed-keys branch entry unrepresentable and declare the sealing-key read's phase ([#195](https://github.com/Vivswan/github-settings-as-code/issues/195)) ([95d081d](https://github.com/Vivswan/github-settings-as-code/commit/95d081d8d20d16661ef3caf0475e801b4d9ce5a5))
+* **sections:** note unknown keys on the protection PUT and the routed actions mappings at check time ([56a0809](https://github.com/Vivswan/github-settings-as-code/commit/56a08096254a97287541de1203f70fbb048bed98))
+* **sections:** note unknown pages keys at check time and accept Hyperscan start verbs ([899455f](https://github.com/Vivswan/github-settings-as-code/commit/899455f4df273710f600365afd4beee19c4dd55d))
+* **sections:** report live values the full-payload write would drop, and refuse to apply over them ([62b27c0](https://github.com/Vivswan/github-settings-as-code/commit/62b27c01fb18e4c9997b2732a265cd852bf68445))
+* **sections:** require the deploy key read_only flag, carry the label brands through the list section, deep-freeze the registries ([#187](https://github.com/Vivswan/github-settings-as-code/issues/187)) ([15ef0c9](https://github.com/Vivswan/github-settings-as-code/commit/15ef0c95905d21b541a19bfcc058fc4d6b88229a))
+* **sections:** undeclared deletes before creates, a lens wire hook for the request body, one boundedString cap helper ([9675999](https://github.com/Vivswan/github-settings-as-code/commit/967599942af3d3a9fe25b6ffcddebc39ac3eb777))
+* **settings:** resolve YAML merge keys in the settings reader ([#262](https://github.com/Vivswan/github-settings-as-code/issues/262)) ([8977aea](https://github.com/Vivswan/github-settings-as-code/commit/8977aea70ec26d80f1e355f3cd9a85bf12963ba2))
+* **settings:** unknown underscore keys fail everywhere; teams gets the _undeclared knob; GSAC_RETRY_BASE_MS ([05e6d41](https://github.com/Vivswan/github-settings-as-code/commit/05e6d410541988f63d92f74d5e00e47947bffe66))
+* single-tag releases - version tags live only on packaged commits ([08d5585](https://github.com/Vivswan/github-settings-as-code/commit/08d5585b974e529898cf2121bfea220317c914c8))
+* size the harness kill cap for the directed fuzz battery ([8543af8](https://github.com/Vivswan/github-settings-as-code/commit/8543af85d8178f736598e6565839df1c57b8334c))
+* **snapshot:** a denied sub-read fails the section under on-missing-permission: fail ([#184](https://github.com/Vivswan/github-settings-as-code/issues/184)) ([04d8d35](https://github.com/Vivswan/github-settings-as-code/commit/04d8d356942f4435cd2962381bbb348f7daf989c))
+* **snapshot:** refuse a destination the filesystem carries onto an authored file ([#179](https://github.com/Vivswan/github-settings-as-code/issues/179)) ([5b24963](https://github.com/Vivswan/github-settings-as-code/commit/5b249639e7e11c073197eae3fa8af6ecc1848539))
+* strengthen the remaining per-section representations ([3fc0f85](https://github.com/Vivswan/github-settings-as-code/commit/3fc0f853f914d032e0bf5f746aee48357d062a03))
+* **test:** match private-report heading markers without an HTML-comment regex ([#106](https://github.com/Vivswan/github-settings-as-code/issues/106)) ([33ff405](https://github.com/Vivswan/github-settings-as-code/commit/33ff40576b478606dce525da0ee0aa5bd64fd290))
+
+
+### Documentation
+
+* **upgrading:** link the v3 breaks to their guides ([8541b3d](https://github.com/Vivswan/github-settings-as-code/commit/8541b3d1c40c6e31a5f682d5c034495a76adbba2))
+
+
+### Miscellaneous Chores
+
+* drop the release-as pin and the machinery that retired it ([a2cc999](https://github.com/Vivswan/github-settings-as-code/commit/a2cc999d1936b9e72e7762778f3ac2ba58091ecc))
+
+
+### Code Refactoring
+
+* **flows:** one owner per refusal, read, and write; one wording for both faces ([bd9b6dd](https://github.com/Vivswan/github-settings-as-code/commit/bd9b6dd3f92e9280a436279f6eccbfad541977ac))
+* **flows:** one redaction seal for every target kind ([#204](https://github.com/Vivswan/github-settings-as-code/issues/204)) ([f1f938e](https://github.com/Vivswan/github-settings-as-code/commit/f1f938e48147d6dcf5c4255486a32c9b86a811ba))
+* **flows:** one run outcome model for every mode ([#201](https://github.com/Vivswan/github-settings-as-code/issues/201)) ([033a9c6](https://github.com/Vivswan/github-settings-as-code/commit/033a9c6ea5ce54993a9b0fbc22a0f4b4b4868606))
+* **github:** the client answers instead of throwing, and the ratchet reaches zero ([d52d4bb](https://github.com/Vivswan/github-settings-as-code/commit/d52d4bbe5dc3daccc5e91637c1e0653ceffc3a05))
+* **library:** a documented public entry and an internal one; one naming family per layer ([d92b738](https://github.com/Vivswan/github-settings-as-code/commit/d92b738c9c32564e14d1e85ae3f48249454e8380))
+* **release:** one immutable packaged commit per main sha; latest and vN move only forward; the build chain retires ([eac7de6](https://github.com/Vivswan/github-settings-as-code/commit/eac7de6a6d2bbe94562da4d514cc679654bed9cc))
+* **rulesets:** fill target and enforcement at parse so an entry may omit them ([0adf417](https://github.com/Vivswan/github-settings-as-code/commit/0adf417ec136d79c2220a0de8ea49b5351fb3374))
+* **sections:** environments plan through the secrets and variables engines; the sealing key is read at apply ([5dfc10a](https://github.com/Vivswan/github-settings-as-code/commit/5dfc10a39fbef174914c7e7df3322f67b1ecf06a))
+* **sections:** milestones, webhooks, and rulesets join listSection; duplicate live items fail loudly everywhere ([2cb5c8a](https://github.com/Vivswan/github-settings-as-code/commit/2cb5c8acd665c096cc01a689f6d8cbaabb85ba7a))
+* **sections:** one duplicate-live guard and identity rendering over every live list ([f7c72ff](https://github.com/Vivswan/github-settings-as-code/commit/f7c72ffac8d47497036149841a338c8d4e88badc))
+* **sections:** one helper per repeated concept; the snapshot notes teams and collaborators leave out use the shared template ([aa1f86f](https://github.com/Vivswan/github-settings-as-code/commit/aa1f86fb74163c35ccde81634a025106b066e7d0))
+* **sections:** section plans return Results instead of throwing ([7ede2bc](https://github.com/Vivswan/github-settings-as-code/commit/7ede2bc73281cf4d4204abeeac78afde2e4ca983))
+* **sections:** the read port parses every live body, and the registry owns the owner probe ([cb772c5](https://github.com/Vivswan/github-settings-as-code/commit/cb772c57cb9890d18577db528ca48887d5714697))
+
 ## [2.0.0](https://github.com/Vivswan/github-settings-as-code/compare/v1.0.1...v2.0.0) (2026-08-11)
 
 
diff --git a/README.md b/README.md
index 7e366a2a..9e644dbd 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ Apply declarative repository settings from `.github/settings.yml`: a loud, state
 2. Add `.github/settings.yml` (or start from a [snapshot](docs/operate/snapshot.md) of the live settings). The first line gives editor autocomplete and hover docs:
 
    ```yaml
-   # yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json # x-release-please-major
+   # yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v3/lib/settings.schema.json # x-release-please-major
 
    repository:
      description: My project
@@ -44,7 +44,7 @@ Apply declarative repository settings from `.github/settings.yml`: a loud, state
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v7
-         - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+         - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
            with:
              token: ${{ secrets.ADMIN_TOKEN }}
              mode: check
@@ -54,7 +54,7 @@ Apply declarative repository settings from `.github/settings.yml`: a loud, state
 
 | Pin | Points at | Use it for |
 |---|---|---|
-| `@v2` <!-- x-release-please-major --> | The newest release in the major line, so fixes arrive without changing your pin | Production |
+| `@v3` <!-- x-release-please-major --> | The newest release in the major line, so fixes arrive without changing your pin | Production |
 | `@vX.Y.Z` or a commit SHA | One release, frozen by a ruleset | Byte-stable behavior |
 | `@latest` | The newest green `main` commit, packaged; breaking changes arrive here unannounced, ahead of any release | Trying unreleased fixes |
 
diff --git a/docs/operate/check-mode.md b/docs/operate/check-mode.md
index 8c751341..4bddca5f 100644
--- a/docs/operate/check-mode.md
+++ b/docs/operate/check-mode.md
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: check
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: check
diff --git a/docs/operate/layering.md b/docs/operate/layering.md
index 4ccf9f10..23167441 100644
--- a/docs/operate/layering.md
+++ b/docs/operate/layering.md
@@ -347,7 +347,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
@@ -355,7 +355,7 @@ jobs:
             .github/settings/team.yml
             .github/settings/repo.yml
           rendered-file: .github/settings/rendered.yml
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           settings-file: .github/settings/rendered.yml
diff --git a/docs/operate/multi-repo.md b/docs/operate/multi-repo.md
index 9ff55a37..08315f3b 100644
--- a/docs/operate/multi-repo.md
+++ b/docs/operate/multi-repo.md
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_TOKEN }}
           repos-dir: .github/repos
diff --git a/docs/operate/snapshot.md b/docs/operate/snapshot.md
index dc09b02b..5e06da1b 100644
--- a/docs/operate/snapshot.md
+++ b/docs/operate/snapshot.md
@@ -25,7 +25,7 @@ jobs:
   snapshot:
     runs-on: ubuntu-latest
     steps:
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: snapshot
@@ -41,7 +41,7 @@ The token needs the same read grants a check run needs for the sections you want
 ## What the file looks like
 
 ```yaml settings
-# yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json # x-release-please-major
+# yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v3/lib/settings.schema.json # x-release-please-major
 # actions_secrets[DEPLOY_TOKEN]: value of DEPLOY_TOKEN is not readable; export it into the environment as SECRET_ACTIONS_DEPLOY_TOKEN before apply
 # check_suite_preferences: GitHub exposes no read endpoint for this section, so there is nothing to snapshot; apply re-asserts the declared value on every run
 # milestones: nothing exists on the repository, so the section is omitted
@@ -94,12 +94,12 @@ jobs:
   backup:
     runs-on: ubuntu-latest
     steps:
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: snapshot
           snapshot-file: backup/settings.yml
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         env:
           SECRET_ACTIONS_DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
         with:
@@ -161,7 +161,7 @@ jobs:
   snapshot:
     runs-on: ubuntu-latest
     steps:
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_TOKEN }}
           mode: snapshot
diff --git a/docs/playbooks/drift-attestation.md b/docs/playbooks/drift-attestation.md
index 97e1e23d..f2b3ea5f 100644
--- a/docs/playbooks/drift-attestation.md
+++ b/docs/playbooks/drift-attestation.md
@@ -23,7 +23,7 @@ jobs:
     steps:
       - id: check
         continue-on-error: true
-        uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+        uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_READ_TOKEN }}
           mode: check
diff --git a/docs/playbooks/fleet-baseline-rings.md b/docs/playbooks/fleet-baseline-rings.md
index 84e26e8e..85813c3d 100644
--- a/docs/playbooks/fleet-baseline-rings.md
+++ b/docs/playbooks/fleet-baseline-rings.md
@@ -131,7 +131,7 @@ jobs:
         include: ${{ fromJSON(needs.plan.outputs.curated) }}
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
@@ -139,7 +139,7 @@ jobs:
             .github/settings/rings/${{ matrix.ring }}.yml
             .github/repos/${{ matrix.ring }}/${{ matrix.repo }}.yml
           rendered-file: merged/${{ matrix.repo }}.yml
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_TOKEN }}
           repository: acme/${{ matrix.repo }}
@@ -154,14 +154,14 @@ jobs:
         ring: [settings-ring-0, settings-ring-1]
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
             .github/settings/baseline.yml
             .github/settings/rings/${{ matrix.ring }}.yml
           rendered-file: merged/${{ matrix.ring }}.yml
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_TOKEN }}
           repos: "*"
diff --git a/docs/playbooks/incident-freeze.md b/docs/playbooks/incident-freeze.md
index 3dfc1b1d..a1be58b0 100644
--- a/docs/playbooks/incident-freeze.md
+++ b/docs/playbooks/incident-freeze.md
@@ -57,7 +57,7 @@ jobs:
     environment: incident-response
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.INCIDENT_TOKEN }}
           settings-file: .github/profiles/${{ inputs.profile }}.yml
diff --git a/docs/playbooks/preview-blast-radius.md b/docs/playbooks/preview-blast-radius.md
index 6d1a897a..c990af77 100644
--- a/docs/playbooks/preview-blast-radius.md
+++ b/docs/playbooks/preview-blast-radius.md
@@ -37,7 +37,7 @@ jobs:
         repo: ${{ fromJSON(needs.plan.outputs.repos) }}
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
@@ -61,7 +61,7 @@ jobs:
           path: merged
       - id: plan
         continue-on-error: true
-        uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+        uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_READ_TOKEN }}
           mode: check
diff --git a/docs/playbooks/trust-tiers.md b/docs/playbooks/trust-tiers.md
index 9040b6c3..bba47441 100644
--- a/docs/playbooks/trust-tiers.md
+++ b/docs/playbooks/trust-tiers.md
@@ -43,7 +43,7 @@ jobs:
         repo: ${{ fromJSON(needs.plan.outputs.repos) }}
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           mode: render
           settings-file: |
@@ -65,7 +65,7 @@ jobs:
           pattern: merged-*
           merge-multiple: true
           path: merged
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.FLEET_WRITE_TOKEN }}
           repos-dir: merged
diff --git a/docs/reference/secrets-and-vaults.md b/docs/reference/secrets-and-vaults.md
index e44bc314..5eaed143 100644
--- a/docs/reference/secrets-and-vaults.md
+++ b/docs/reference/secrets-and-vaults.md
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
         env:
@@ -77,7 +77,7 @@ jobs:
           role: settings-as-code
           secrets: |
             secret/data/ci webhook_secret | WEBHOOK_SECRET
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
 ```
diff --git a/docs/start/examples.md b/docs/start/examples.md
index 970587d2..ddbf910f 100644
--- a/docs/start/examples.md
+++ b/docs/start/examples.md
@@ -296,7 +296,7 @@ A `mode: render` fold keeps all three meanings: a higher `pages: null` or `inter
 
 A multi-repo `defaults-file` never merges into a target's file, so a `null` there keeps the meanings above.
 
-A few individual fields accept `null` as a value of their own too, such as `pages.cname` to remove a custom domain; the [published schema](https://github.com/Vivswan/github-settings-as-code/blob/v2/lib/settings.schema.json) <!-- x-release-please-major --> marks those.
+A few individual fields accept `null` as a value of their own too, such as `pages.cname` to remove a custom domain; the [published schema](https://github.com/Vivswan/github-settings-as-code/blob/v3/lib/settings.schema.json) <!-- x-release-please-major --> marks those.
 
 ## Notes in the file
 
diff --git a/docs/start/getting-started.md b/docs/start/getting-started.md
index f8ae208e..0bfddb16 100644
--- a/docs/start/getting-started.md
+++ b/docs/start/getting-started.md
@@ -21,7 +21,7 @@ Save the token as a repository secret. The examples below call it `ADMIN_TOKEN`.
 Settings live in `.github/settings.yml` by default (the `settings-file` input moves it). A comment at the top wires editor autocomplete and hover documentation to the published JSON Schema. A small first file:
 
 ```yaml settings
-# yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json # x-release-please-major
+# yaml-language-server: $schema=https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v3/lib/settings.schema.json # x-release-please-major
 
 repository:
   description: Payments service
@@ -59,7 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: check
@@ -67,7 +67,7 @@ jobs:
 
 Each trigger earns its place. The push trigger runs the action on every reviewed change to the settings file: a check while `mode: check` is set, an apply once step 5 removes it. `workflow_dispatch` lets you run the action by hand from the Actions tab, which is how the first run happens. The schedule catches drift: in check mode a weekly run turns red when the live settings diverge from the file, and after the switch to apply it re-asserts the declared keys and reverts anything changed through the UI in the meantime (apply is convergent, see [Semantics](../reference/semantics.md)).
 
-The `@v2` pin <!-- x-release-please-major --> is the moving major tag, stable within its line; `@latest` is a moving tag on the packaged commit of the newest `main` commit (`main` itself is source-only), where breaking changes arrive unannounced, so keep production on the major pin.
+The `@v3` pin <!-- x-release-please-major --> is the moving major tag, stable within its line; `@latest` is a moving tag on the packaged commit of the newest `main` commit (`main` itself is source-only), where breaking changes arrive unannounced, so keep production on the major pin.
 
 ## 4. Run check mode first
 
diff --git a/docs/start/migrating-from-probot.md b/docs/start/migrating-from-probot.md
index 5e50714e..7c8e81bf 100644
--- a/docs/start/migrating-from-probot.md
+++ b/docs/start/migrating-from-probot.md
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Vivswan/github-settings-as-code@v2 # x-release-please-major
+      - uses: Vivswan/github-settings-as-code@v3 # x-release-please-major
         with:
           token: ${{ secrets.ADMIN_TOKEN }}
           mode: check
diff --git a/docs/upgrading/README.md b/docs/upgrading/README.md
index 93cac1f1..dd6ba117 100644
--- a/docs/upgrading/README.md
+++ b/docs/upgrading/README.md
@@ -10,7 +10,7 @@ One page per major version. A major is the only release that can change what an
 
 | Pin | Moves when | Use it for |
 |---|---|---|
-| `@v2` (the moving major) <!-- x-release-please-major --> | Every release in that major line | Fixes arrive without touching your pin; the line never breaks a working file |
+| `@v3` (the moving major) <!-- x-release-please-major --> | Every release in that major line | Fixes arrive without touching your pin; the line never breaks a working file |
 | `@vX.Y.Z` | Never | Byte-stable behavior; upgrade deliberately |
 | A commit SHA | Never | The same, for repositories that pin actions by digest |
 
diff --git a/package.json b/package.json
index f113860b..e59e6a90 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@vivswan/github-settings-as-code",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "GitHub Action applying declarative repository settings: rulesets, labels, branch protection, and more.",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
diff --git a/src/flows/snapshot.ts b/src/flows/snapshot.ts
index 93e5b814..83972d19 100644
--- a/src/flows/snapshot.ts
+++ b/src/flows/snapshot.ts
@@ -44,7 +44,7 @@ import { snapshotTakenLine, writeSnapshotDirSummary, writeSummary } from "./summ
  * this file); test/docs/readme.test.ts pins it to the README's hint.
  */
 export const SNAPSHOT_SCHEMA_URL =
-  "https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json"; // x-release-please-major
+  "https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v3/lib/settings.schema.json"; // x-release-please-major
 
 interface SnapshotConfigBase {
   onMissingPermission: "fail" | "warn";

From ecb5c8fd4dff693f8f3ce59c64ce972eac31b730 Mon Sep 17 00:00:00 2001
From: settings-as-code-release
 <settings-as-code-release@users.noreply.github.com>
Date: Thu, 24 Sep 2026 00:35:40 +0000
Subject: [PATCH 2/2] chore: anchor release-please to this release cycle's base

last-release-sha records the merge parent so the squash merge itself lands the next cycle's boundary on main: version tags live on packaged commits that are not on main, so release-please cannot find the boundary by tag.
---
 release-please-config.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/release-please-config.json b/release-please-config.json
index 05c57ba9..be0169d3 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -3,7 +3,7 @@
   "bump-minor-pre-major": true,
   "bump-patch-for-minor-pre-major": true,
   "include-component-in-tag": false,
-  "last-release-sha": "046adf3b24454f26f569850630809bcf481f8b84",
+  "last-release-sha": "1a25adbc40c5dc2d82ca1684cb5062917c953c23",
   "packages": {
     ".": {
       "release-type": "simple",