- The syntax gate skipped zapret2/scripts/lifecycle entirely, so a
broken purge script would have shipped and surfaced on-device during
an irreversible operation.
- Two custom Lua files were validated by CI as shipped but were missing
from the runtime manifest, so they could never reach a device.
- Release qualification runs the policy tests with --rerun-tasks: they
read repository files directly rather than through declared task
inputs, so a cached run could report green without checking anything.
- The committed update.json advertised an asset name no release
publishes.
- The two MD3E documents describe an app from 2.0.9 whose classes and
tests no longer exist; they now say so and point at the current
architecture document, which the docs index now links.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
6b03f5e785