fix(release): the workflow that published v0.1.0 still said nothing had been released

release.yml opened with "NOT YET USED: no version of ExitDrill has been tagged
or released. This workflow is prepared ahead of the first tag". It ran three
times on 2026-09-07 and published v0.1.0 on the third.

The claim scan reads .yml and had that file in hand; no vocabulary entry
matched. The wording is now an entry, so the next one is caught rather than
read past.

The header records what the first real run found instead: both earlier
dispatches failed in the publish job with `failed to run git: fatal: not a git
repository`, because that job never checks out code and gh had no remote to
infer a repository from.

Author: ChelseaKR

.github/workflows/release.yml

@@ -2,10 +2,12 @@ name: release
 
 # Trusted-main, signed-tag, split-authority release, dispatch only.
 #
-# NOT YET USED: no version of ExitDrill has been tagged or released. This
-# workflow is prepared ahead of the first tag so cutting v0.1.0 does not also
-# require writing a release pipeline under time pressure. It runs only when a
-# maintainer dispatches it with an existing signed annotated tag. The shared
+# First used on 2026-09-07, when it published v0.1.0 on its third dispatch: the
+# first two failed in the publish job, which never checks out code and so had no
+# git remote for `gh` to infer a repository from. Machinery that has never run
+# is not machinery that works, and this is the record of what running it found.
+# It runs only when a maintainer dispatches it with an existing signed annotated
+# tag. The shared
 # authorization workflow checks out trusted main, requires stable SemVer,
 # verifies the annotated tag object and its SSH signature against
 # .github/allowed_signers, and requires the tagged commit to be an ancestor of

CHANGELOG.md

@@ -29,6 +29,17 @@ All notable changes will be documented here.
   `docs/RELEASE.md` now says the asset exists, how to use it, that it is
   transport tamper-evidence rather than a signature, and that `v0.1.0`'s copy
   carries the build-directory prefix. Nothing rewrites the published asset.
+- **A fifth false sentence, in the header of the workflow that released
+  v0.1.0.** `release.yml` opened with "NOT YET USED: no version of ExitDrill
+  has been tagged or released. This workflow is prepared ahead of the first tag
+  so cutting v0.1.0 does not also require writing a release pipeline under time
+  pressure." It ran three times on 2026-09-07 and published `v0.1.0` on the
+  third. The scan reads `.yml` and had that file in hand; no vocabulary entry
+  matched, which is the denylist limit named in the entry below, found again
+  one file over. The wording is now an entry, and the header records what the
+  first real run found: both earlier dispatches failed in the publish job with
+  `failed to run git: fatal: not a git repository`, because that job never
+  checks out code and `gh` had no remote to infer a repository from.
 - **The scan added last night read four false sentences and reported clean.**
   `test_no_document_says_this_repository_is_untagged_once_it_is` applies the
   README rule to every tracked file, which is the right generalisation and was

tests/test_release_versions.py

@@ -264,6 +264,7 @@ def test_the_citation_dates_no_release_that_was_never_cut() -> None:
     "has held only `## [Unreleased]`",
     "asserts nothing about the changelog",
     "has not cut its first release",
+    "no version of ExitDrill has been tagged or released",
 )
 
 #: Suffixes worth reading. A binary, a lockfile or a captured fixture does not