chore(release): 3.1.1 — build-breaking corrective, align version surfaces

[cdeust]

Summary

• 3.1.0 cannot build a graph at all (graph build crashes on its first statement: the module forwarders were deleted instead of fixed #134): emit/close/reset forwarders in graph_event_stream were deleted on the false premise of "no caller in this repository's history"; graph_build_run.py and graph_build_merge.py both call them, so every build died on its first statement with AttributeError and /api/graph/progress never left starting. Fixed by fix(server): restore graph_event_stream module forwarders, event_meta included #136.
• fix(server): report a failing end-of-stream terminator instead of swallowing it #137/the end-of-build stream terminator fails silently: close() inside except Exception: pass #135 stops the same finally-block terminator from swallowing a failure silently — the exact reason graph build crashes on its first statement: the module forwarders were deleted instead of fixed #134's AttributeError reached a published release unnoticed.
• test: kill the 136 surviving mutants in the path-guard modules #131 (mutation-test hardening) and feat(release): automate MCP Registry publish (RELEASING.md step 5) #132 (automates RELEASING.md step 5) also landed since 3.1.0, no further breaking change.
• SemVer: patch bump, 3.1.0 → 3.1.1 (bug fixes only; not a restatement of 3.1.0).

Version surfaces aligned

pyproject.toml, cortex_viz/identity.py, server.json (both version fields), .claude-plugin/plugin.json, .codex-plugin/plugin.json, gemini-extension.json, .claude-plugin/marketplace.json (both version fields), uv.lock (via uv lock), plus the two surfaces check_distribution_artifact does not cover: the README badge and docs/ROADMAP.md's "current version" line.

CHANGELOG

Promoted [Unreleased] (#132's entry) to [3.1.1] - 2026-08-10, added the #134/#135 fix descriptions, reopened an empty [Unreleased]. #131 gets no entry — it changes no shipped behavior.

Changelog-vs-tag audit

[3.1.0], [2.8.0], [2.7.1], [2.7.0] all have matching remote tags. [3.0.0]'s "cut in the tree, never tagged or published" annotation is intact and unchanged. Nothing new drifted.

Verification

• uv build then uv run python -m scripts.check_distribution_artifact → distribution identity OK: hypermnesia-mcp-viz 3.1.1
• uv run pytest -q → 1317 passed, 10 skipped
• uv run ruff check . / uv run ruff format --check . → clean

Not in this PR

RELEASING.md step 6 (bump the marketplace pin in cdeust/Cortex) needs the tagged commit sha, which does not exist until this merges and is tagged — same sequencing constraint as the 3.1.0 release (see cdeust/cortex-viz#130).

Co-Authored-By: Claude noreply@anthropic.com

[cdeust]

ZETETIC-REVIEW: APPROVE

3.1.1, and it is a genuine release rather than a restatement. 3.1.0 was tagged, pushed to PyPI, released on GitHub and published to the MCP Registry — and it cannot build a graph. Two fixes (af4c436 restoring the forwarders with emit finally carrying event_meta, dc8b81a reporting the terminator failure instead of swallowing it), one tests-only PR and one workflow PR, no breaking change. Patch is right.

The stale-clone trap was hit and handled, which is worth recording because it has caught me twice today: the local main ref was behind and needed an explicit fetch before it could be trusted, and the chronological merge order turned out to be #137 → #136 → #131 → #132 rather than PR-number order. Deriving the window from gh api compare against the remote rather than from the checkout is what made the derivation correct.

The surfaces the automated check does not cover were found by reading the script, not by hoping. check_distribution_artifact was read line by line to establish what it does not validate — the README badge and docs/ROADMAP.md's "Current version" line — which is exactly where drift hid at the last release. And the remaining 3.1.0 mentions in the README were correctly left alone: they are historical prose about the never-published 3.0.0 rename, and rewriting them to match a new number would falsify a record. Distinguishing a version claim from a version reference is the judgement that matters here.

uv build && uv run python -m scripts.check_distribution_artifact
→ distribution identity OK: hypermnesia-mcp-viz 3.1.1

Full suite 1317 passed / 10 skipped, run through --extra dev with uv run which pytest confirmed resolving into .venv/bin — the check that defeats this repo's silent fall-through to the system interpreter. ruff check and format --check clean.

Changelog-versus-tag audit clean, and the important part is what it left alone: [3.0.0] - 2026-08-04 — cut in the tree, never tagged or published is intact and still accurate. Nothing new drifted, nothing was deleted or redated.

Omitting a changelog entry for #131 is the right call and is argued rather than assumed — mutation-test hardening ships no observable behaviour change, matching this changelog's existing practice. A changelog that logs every commit stops being a record of what changed for users.

One verification worth crediting specifically: uv.lock was regenerated rather than hand-edited, and git diff --stat confirmed exactly one line changed — so no dependency drift rode along inside a machine-generated file where nobody would have looked.

All checks green at 166641e. Merging, then tagging v3.1.1, and sending the landing sha to the session that pins this plugin.