Bind release evidence to prior parser schema

.github/workflows/release.yml

@@ -126,7 +126,6 @@ jobs:
       - name: Validate source-bound compatibility evidence
         shell: bash
         env:
-          GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ inputs.tag }}
         run: |
           set -euo pipefail
@@ -138,13 +137,29 @@ jobs:
             [[ "$sourceCandidateTag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+-rc\.[1-9][0-9]*(-hotfix\.[1-9][0-9]*)?$ ]]
             decision_range_end="$(git rev-parse "$sourceCandidateTag^{commit}")"
           fi
+          catalog_schema_path="catalog-store/src/main/kotlin/com/darkaxt/dualdex/catalog/CatalogSchema.kt"
+          expected_comparison_revision="$(
+            jq -r '
+              if .cacheDecision.type == "BUMP_REQUIRED" then .cacheDecision.previousRevision
+              elif .cacheDecision.type == "OUTPUT_INVARIANT" then .cacheDecision.revision
+              else empty
+              end
+            ' release/compatibility-evidence.json
+          )"
+          [[ -z "$expected_comparison_revision" || "$expected_comparison_revision" =~ ^[1-9][0-9]*$ ]]
           decision_range_base_tag=""
           while IFS= read -r candidate; do
-            if [[ "$candidate" != "$RELEASE_TAG" && "$candidate" != "$sourceCandidateTag" ]] &&
-              gh release view "$candidate" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
-              decision_range_base_tag="$candidate"
-              break
+            [[ "$candidate" == "$RELEASE_TAG" || "$candidate" == "$sourceCandidateTag" ]] && continue
+            if [[ -n "$expected_comparison_revision" ]]; then
+              schema_source="$(git show "$candidate:$catalog_schema_path" 2>/dev/null || true)"
+              candidate_revision="$(
+                printf '%s\n' "$schema_source" |
+                  sed -nE 's/^[[:space:]]*const val parserSchemaVersion[[:space:]]*=[[:space:]]*([0-9]+).*$/\1/p'
+              )"
+              [[ "$candidate_revision" == "$expected_comparison_revision" ]] || continue
             fi
+            decision_range_base_tag="$candidate"
+            break
           done < <(git tag --list 'v1.*' --sort=-version:refname)
           test -n "$decision_range_base_tag"
           decision_range_base="$(git rev-parse "$decision_range_base_tag^{commit}")"

docs/reports/qa-hardening/stage-07-closure.md

@@ -56,7 +56,7 @@ A post-run inventory comparison found the same 333 eligible names and one intent
 | Current release/governance gate after closure packaging | 83 Node tests passed. |
 | Fresh corpus summarization | Streaming raw-report hash, source/generator lineage, canonical multiset, terminal outcomes, and persistence/reopen checks passed. |
 
-The expensive parser and consolidated Gradle gates ran once after parser/catalog product-source stabilization. They were not repeated for downstream release packaging, acceptance-test stabilization, the later replacement of two Android API-33-only bounded reads with the shared API-30-compatible reader, repository-policy alignment with the established single-maintainer signing process, or correction of GitHub policy reads to use public nonsecret endpoints instead of an integration token lacking administration scope. Focused checkpoint/save tests, the source-contract regression, Android test compilation, app lint, the PR managed-device suite, and all 83 release-governance tests passed after those corrections. `NONPARSER_REUSE` is explicit and does not permit parser, catalog, build, wrapper, or corpus-execution changes.
+The expensive parser and consolidated Gradle gates ran once after parser/catalog product-source stabilization. They were not repeated for downstream release packaging, acceptance-test stabilization, the later replacement of two Android API-33-only bounded reads with the shared API-30-compatible reader, repository-policy alignment with the established single-maintainer signing process, correction of GitHub policy reads to use public nonsecret endpoints instead of an integration token lacking administration scope, or binding the comparison range to the cache decision's prior parser schema. Focused checkpoint/save tests, the source-contract regression, Android test compilation, app lint, the PR managed-device suite, and all 83 release-governance tests passed after those corrections. `NONPARSER_REUSE` is explicit and does not permit parser, catalog, build, wrapper, or corpus-execution changes.
 
 ## Missing-feature classification
 

docs/reports/qa-hardening/stage-08-closure.md

@@ -54,7 +54,7 @@ The denominator correction does not waive an input. The audited physical invento
 | Final corpus | 333/333 eligible inputs terminal; 0 parser/catalog/compatibility/persistence errors; 278/278 selected catalogs persisted and reopened | `PASS` |
 | Downstream evidence hardening | Bounded 1.63 GB streaming summary, corrected denominator, duplicate-aware canonical contract, promotion/readiness/privacy regressions | `PASS` |
 
-The consolidated Gradle and hours-long parser gates ran once after parser/catalog product-source stabilization. They were not repeated for downstream release packaging, deterministic acceptance-test corrections, the replacement of two Android API-33-only read calls with the already-tested API-30-compatible bounded reader, repository-policy alignment with the established single-maintainer signing process, or correction of GitHub policy reads to public nonsecret endpoints. Focused checkpoint/save tests, source contracts, Android test compilation, app lint, the 7/7 PR managed-device suite, and the complete release-governance suite passed afterward. The evidence validator rejects reuse if parser/catalog sources, build logic, wrapper, or corpus-execution tooling changes.
+The consolidated Gradle and hours-long parser gates ran once after parser/catalog product-source stabilization. They were not repeated for downstream release packaging, deterministic acceptance-test corrections, the replacement of two Android API-33-only read calls with the already-tested API-30-compatible bounded reader, repository-policy alignment with the established single-maintainer signing process, correction of GitHub policy reads to public nonsecret endpoints, or binding the release comparison range to the cache decision's prior parser schema. Focused checkpoint/save tests, source contracts, Android test compilation, app lint, the 7/7 PR managed-device suite, and the complete release-governance suite passed afterward. The evidence validator rejects reuse if parser/catalog sources, build logic, wrapper, or corpus-execution tooling changes.
 
 No ad hoc emulator, ADB gesture, physical-device action, credential inspection, signing-material inspection, signing, tagging, or publication was performed for this closure.
 

release/RELEASE_NOTES_1.1.0-rc.78-hotfix.2.md

@@ -0,0 +1,52 @@
+# DualDex 1.1.0-rc.78-hotfix.2
+
+RC78 hotfix 2 is the release candidate for the completed project-wide QA hardening program. It closes the remaining Android setup, parser/catalog, runtime authority, companion transport, privacy, and release-governance gaps, then binds them to the final source-bound compatibility corpus. The hotfix qualifier preserves the immutable failed RC78 tags while binding cache validation to the correct prior parser-schema baseline.
+
+## Android setup and recovery
+
+- Recover cleanly when a guide cannot be loaded instead of crashing the app or leaving the guide surface in a stale state.
+- Reconcile direct-storage and folder-picker access without discarding the last valid index during a failed rescan.
+- Quarantine revoked folder grants, route package-specific settings safely, and explain protected `Android/data` and `Android/obb` limitations accurately.
+- Deliver overlay picker results exactly once across cold starts, new intents, retries, and activity recreation.
+- Keep Area Guide projection failures local to that optional module.
+
+## Parser and catalog resilience
+
+- Bound complete-ROM probes, archive extraction, catalog payloads, concurrent corpus work, and detached Gen I species discovery.
+- Add cancellation checks to long parser passes and replenish ordered corpus work after any completion so one slow input cannot stall unrelated inputs.
+- Verify catalog identity and canonical content digests before activation, quarantine invalid snapshots, and fail closed on malformed optional data.
+- Invalidate pre-hardening parser catalogs through schema revision 46 and retain seeded rebuild coverage.
+
+## Runtime authority and companion safety
+
+- Require verified ROM identity and monotonic session epochs before live memory or SaveRAM state can become authoritative.
+- Fence queued mapper, socket, command, delayed-reply, and checkpoint work against stale sessions.
+- Recover RetroArch configuration and command sockets transactionally while bounding memory reads, UDP drains, and retained snapshots.
+- Bound Android and desktop companion transport, fence navigation/state/media responses, preserve structured retries, and isolate optional feature failures.
+- Remove private paths, reversible player-state fingerprints, raw failures, stacks, workspace identifiers, and device identifiers from normal diagnostics and public evidence.
+
+## Source-bound QA closure
+
+- Audit 334 supported-extension files while evaluating all 333 scanner-eligible mainline and hack inputs; one known spin-off remains intentionally excluded by scanner policy.
+- Reach terminal parser outcomes for 333/333 inputs: 278 selected, 2 ambiguous, 53 without a family match, and 0 parser errors.
+- Record 20 complete, 302 partial, and 11 unresolved data-compatibility outcomes with 0 compatibility errors.
+- Materialize, persist, close, reopen, and decode all 278 selected catalogs with 0 catalog or persistence errors.
+- Close QA Stages 7 and 8 with zero blockers and zero referrals.
+
+## Measured validation
+
+- Post-remediation Kotlin and Android gate: 65 tasks passed in 40m36s across parser, catalog, CLI, runtime, companion, and app unit suites.
+- Companion web gate: 32 Vitest files and 268 tests passed; the TypeScript/Vite production build passed.
+- Portable Chromium acceptance: 3/3 Playwright tests passed.
+- Release and governance gate: 83/83 Node tests passed.
+- Public QA evidence: 7/7 assets passed structural privacy validation.
+- PR Android acceptance: 7/7 managed-device tests passed; min-SDK-30 app lint and focused bounded-read tests passed after the final compatibility correction.
+- Public nonsecret repository-policy reads were verified against the live tag and environment configuration without querying signing material.
+- Cache validation selects the latest prior tag whose parser schema matches the explicit cache decision, so failed immutable delivery tags cannot replace the evidence baseline.
+- Protected release managed-device acceptance, signing, and Thor validation remain mandatory before candidate promotion.
+
+## Delivery
+
+- This candidate uses Android version code `1010080`.
+- The candidate is built and signed only through the protected GitHub Actions environment; production signing material is never exposed to the repository or local workspace.
+- DualDex remains read-only and sends no game commands or emulator-memory writes.

release/compatibility-evidence.json

@@ -12,7 +12,7 @@
   },
   "scopeDecision": {
     "type": "NONPARSER_REUSE",
-    "attestation": "Fresh raw parser evidence was generated at the named source commit; downstream release packaging, acceptance tests, API-30-compatible Android bounded reads, repository-policy alignment, and public nonsecret GitHub policy access changed afterward without changing parser, catalog, build, wrapper, or corpus-execution source."
+    "attestation": "Fresh raw parser evidence was generated at the named source commit; downstream release packaging, acceptance tests, API-30-compatible Android bounded reads, repository-policy alignment, public nonsecret GitHub policy access, and schema-bound comparison selection changed afterward without changing parser, catalog, build, wrapper, or corpus-execution source."
   },
   "cacheDecision": {
     "type": "BUMP_REQUIRED",

tools/release/release-workflow.test.mjs

@@ -466,7 +466,8 @@ test("stable validation reuses the candidate comparison range and RCs skip final
   assert.match(evidenceStep, /decision_range_end/);
   assert.match(evidenceStep, /--comparison-ref "\$decision_range_base"/);
   assert.match(evidenceStep, /git diff --name-only "\$decision_range_base\.\.\$decision_range_end"/);
-  assert.match(evidenceStep, /gh release view "\$candidate"/);
+  assert.match(evidenceStep, /expected_comparison_revision/);
+  assert.match(evidenceStep, /git show "\$candidate:\$catalog_schema_path"/);
   assert.match(metadataStep, /if \[\[ "\$RELEASE_TAG" != \*-rc\.\* \]\]; then/);
   assert.match(metadataStep, /test -s release\/v1-final-authorization\.json/);
 });