fix(release): stop duplicate bumps after publish-only

[tom-sapletta-com]

Summary

• infer the synchronized current-version transition after a stale release tag
• classify committed package source only after that safe boundary
• retain conservative tag fallback for ambiguous history
• cover source committed both before and after the transition

Validation

• focused history/version suite: 27 passed
• full Python suite: 510 passed, 2 skipped
• governance: GOV-PASS (0 errors, 0 warnings)

Ticket: ticket-018
Accepted base: d252313
Exact head must be validated before merge.

[ifuri-validator-agent]

Deterministic Validator approval for exact head a96e79f86d7c3194a0a14c5bfca41777e6d4466a.

Ticket: ticket-018
Correlation ID: ticket-018-a96e79f-20260810
Model: openrouter/z-ai/glm-5.2
Reviewed diff chunks: 2
Advisory LLM verdict: APPROVE
Advisory summary: Reviewed all 2 diff chunk(s). Adds ticket-018 metadata and implements synchronized version-transition boundary detection to avoid duplicate patch bumps after publish-only releases. The new detect_version_transition_boundary function safely falls back to the tag on ambiguous history, and committed_unreleased_source_files uses it conservatively. Changes are well-scoped with documentation and logs. | The ticket metadata and test additions are consistent with the stated intent: adding regression coverage for committed source before and after a synchronized version transition. The new test file writes a VERSION file in the repo fixture and validates that source committed before the transition is treated as released, while source after is detected as unreleased. No executable implementation changes appear in this chunk (implementation files are likely in chunk 1). The intent.json scopes allowed paths and forbidden paths sensibly, and no security issues are visible.
Advisory findings: none
The LLM output above is advisory and was not used as the approval trust root.
Merge was not requested or performed.

Decision record (recomputable)

DECISION D-018-2432
TICKET ticket-018
HEAD_SHA a96e79f86d7c3194a0a14c5bfca41777e6d4466a
CORRELATION_ID ticket-018-a96e79f-20260810
ACTOR agent:ifuri-validator-agent[bot]
APPLIED_RULE P-CORE-015
INPUT author_login = "tom-sapletta-com"
INPUT observed_checks = ["test (3.13)=PASS","test (3.12)=PASS"]
INPUT required_checks = ["test (3.12)","test (3.13)"]
INPUT required_checks_source = "env/request"
INPUT reviewer_login = "ifuri-validator-agent[bot]"
VERDICT APPROVE AUTHORITY DETERMINISTIC
REJECTED REQUEST_CHANGES BECAUSE NO_UNSAFE_CHANGE_REASON_FOUND
ADVISORY llm_verdict = "APPROVE" MODEL "openrouter/z-ai/glm-5.2"
ASSERT VERDICT_AUTHORITY != "ADVISORY"