Release 2.5.1: post-launch audit fixes

[guangmian-circle]

Imports the YAAS v2 snapshot at 2.5.1 from the upstream mirror.

The project now carries a version: VERSION holds it as plain text, CHANGELOG.md records what
landed, and the README states it near the top. This branch spans the 2.5 release and the 2.5.1 patch
release on top of it.

What is in here

2.5 — the first versioned release: the dashboard v2 manual-review surface, a quick start, the
security hardening, a README rewrite, and watermarks stored at Slack's 6-decimal precision.

2.5.1 — nine defects found by auditing that snapshot, plus one reported from live use. The ones
worth a reviewer's attention:

• Watermark claims are truncated, never rounded. checkers/result.py formatted advance_to with
  :.6f, which is round-half-even, so a claim could land ahead of the point actually proven covered
  and a message sitting exactly on the rounded microsecond was then read as already-seen forever.
  slack_dm and slack_mention were pre-rounding at the call site too, which made the emit-side fix
  a no-op for the two checkers that reach it.
• classify() no longer erases a numeric 0 watermark claim through falsiness. An erased claim
  is not a hold: the commit layer falls back to now - lag and jumps the watermark to NOW.
• The dashboard stopped rebuilding DOM it had not changed. Every 2s poll rewrote whole subtrees
  even when the payload was identical, which made the prompt box flicker and reset a long draft's
  scroll in the review interface.
• Briefings came off the poll path (~114ms and 75KB of JSON per poll on a 150-file archive) and
  gained one canonical timestamp plus a checked filename contract.
• The markdown renderer's link placeholder can no longer be forged from prose, and a $& in a
  URL or label is inserted literally rather than expanded as a substitution pattern.

One behaviour change to read before merging

A fractional value for a whole-number knob is now refused at startup instead of being floored to
0, which silently disabled the cap the operator meant to tighten. Knobs whose reader honours a
fraction (YAAS_STALE_REPLY_HOURS, YAAS_MAX_SPEND_*) still accept one. An integer configuration is
unaffected.

Tests

48 suites and 29 differential goldens pass; the mutation suite catches 12 of 12. New:
yaas-triage/tests/unit/dashboard-render.test.sh exercises the dashboard's renderer, date helpers
and write guards by behaviour, running the shipped implementations rather than asserting the file
contains certain strings. It skips where node is absent (an optional dependency) and names what it
did not cover. Every fix in 2.5.1 has an assertion verified to fail when the fix is reverted.

Published from mirror SHA 1d4d861 (tagged v2.5.1). All commits on this branch are
signature-verified by GitHub.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details

Scanned Files

[nexx88]

@guangmian-circle — Ponytail (complexity) review. Separate from the security pass (which found nothing to block). This PR is overwhelmingly bug fixes + tests + docs, and most prod changes are tight — the htmlOnce/textOnce idempotent setters and the build_briefs() extraction are net simplifications, not flagged. Two optional trims to consider before merge; please take a look and address or wave off:

1. dashboard.html — measureModeNavigation / ResizeObserver overflow machinery (yagni, ~-10 lines). ResizeObserver + requestAnimationFrame + document.fonts.ready + scrollWidth measurement to decide whether to collapse a 3-item mode nav (Control / Briefings / Audit) into a menu. For 3 fixed labels, overflow is a CSS media-query call; the JS measurement is speculative until the item count becomes dynamic. Suggest dropping it (keep the menu markup, drive compact-modes from a media query).

2. dashboard.html — duplicated menu toggle pair (shrink, ~-4 lines). closeModeMenu/toggleModeMenu and closeBriefPicker/toggleBriefPicker are two identical (menu, trigger) hidden+aria-expanded pairs. Collapse to one setMenu(menu, trigger, open) helper.

3. (soft note, not counting) truncate-to-6-decimals duplicated 3× in result.py:emit, add-watch.py:main, and tick.py:slack_ts (math.floor(v*1e6)/1e6:.6f). A shared truncate6() would dedupe, but the three copies differ (omit-key vs str(value) passthrough vs keep-_raw) and this repo deliberately duplicates small helpers across standalone CLI scripts to avoid depth-sensitive imports — so it's defensible as-is. Your call.

net: ~-14 lines possible. Both #1 and #2 are polish, not blockers.

(Also, minor robustness aside from the security pass: a briefing filename with digits that pass the _BRIEF_NAME regex but aren't a valid calendar date — e.g. month 99 — makes datetime(...) in build_briefs raise → 500 on /api/briefs. A try/except ValueError: continue tidies it.)