Toolkit 0.8.4: correct GitLab summary and qualify OCR 1.10.1

[xeonvs]

Target and delivery state

Toolkit 0.8.4 with OCR 1.10.1.

Stable delivery is active. This PR remains Draft only while exact-head hosted checks run; after they pass with zero unresolved threads it will move to Ready and through the protected squash-merge policy. Issues #145/#146 and milestone v0.8.4 remain open until stable external reconciliation.

• Exact head: 54521ceb370a91cd5b5d5cf95eb7565cd8da78b0
• Exact tree: 619869ca79d687fab3feb5c374096b5b35d39230
• Linux AMD64 OCR SHA-256: 8b806c221d409727a21611b4a7952d8e15edadbbc25f5affccaeb8f677e4055c
• Darwin ARM64 OCR SHA-256: 8fc24bd825c9d918b894be05c0cf27fac8d30bc549257c812d87337167c7563c
• Upstream sha256sum.txt SHA-256: ec72bda51f1227f412ee00602d952868efc57d847cce0ae1586fb97069d4139d

Added

• Canonical OCR 1.10.1 compatibility evidence and exact manifest/preflight/example pins ([OCR compatibility] Qualify v1.10.1 #146).
• Receipt-bound numeric ocr.toolkit-advisory/v1 projection for an OCR core background recommendation, rendered only under Technical details, including failed-result summaries ([Bug]: Separate OCR advisory, review coverage, and publication filtering in GitLab summary #145).
• Rules release note for OCR 1.10.1 .m allowlisting and content-selected MATLAB/Objective-C built-in rules ([OCR compatibility] Qualify v1.10.1 #146).

Fixed

• Complete OCR coverage followed by publication filtering renders Review complete with publication filtering, retains only exhaustively validated original coverage/outcome combinations, and does not invent partial coverage or pathless failed items ([Bug]: Separate OCR advisory, review coverage, and publication filtering in GitLab summary #145).
• The accepted OCR core advisory no longer enters OCR warnings, publication-DLP counts, coverage normalization, or approval inputs ([Bug]: Separate OCR advisory, review coverage, and publication filtering in GitLab summary #145).
• Receipt-v5 publication state rejects impossible original outcome/count combinations while preserving separately valid run-level failed outcomes ([Bug]: Separate OCR advisory, review coverage, and publication filtering in GitLab summary #145).
• One published finding no longer receives a duplicate Recommended focus-area snippet; deterministic ranking remains for two or more findings ([Bug]: Separate OCR advisory, review coverage, and publication filtering in GitLab summary #145).

Changed

• The qualified OCR target moves directly from 1.10.0 to 1.10.1; no intermediate OCR version is required.
• Horizontal tab is admitted only in existing_code and suggestion_code; the unchanged value still crosses secret, PII, exact forbidden-value, laundering, budget, and unsupported-control checks.
• Tool-call and token technical lines remain independent and publish only admitted non-zero numeric activity under passed, private-sanitized, and publication-filtered states.

Unchanged

• Receipt v5, publication-DLP signal v2, OCR result/manifest schemas, telemetry, fingerprints, lifecycle ownership, and automatic-approval contracts are unchanged.
• Publication filtering remains warning-bearing and automatic-approval-ineligible; real failed, partial, waived, and token-budget coverage retains stronger status precedence.
• OCR 1.10.1 keeps the qualified inherited completion cap, default medium effort, and behaviorally qualified max-tools semantics. The toolkit completion-cap default remains unset; no provider-specific 4096 default is introduced.
• Upstream GitHub Action, delegate skill, npm launcher, provider preset, and repository-local providers.go rule are not consumed by the toolkit.

Final OCR review

• The single authorized local OCR 1.10.1 review covered the exact origin/main..02c2f9d8f76d736ba83deed7700bed9374c4e38d range with concurrency 2, context mode off, and no provider-specific completion cap.
• Manifest terminal state was complete: selected/completed 10/10, failed/reused/waived 0/0/0, empty stderr, and 102 tool calls.
• All three candidates were confirmed and corrected: exhaustive receipt outcome validation, unchanged-value HTAB DLP checks, and advisory propagation into failed-result Technical details.
• Retained local OCR/private-DLP artifacts were not published and were deleted after verification.

Validation

• Hosted OCR compatibility run 32955196785 passed result, completion-cap, medium-effort, and max-tools probes.
• Local no-LLM checks passed for OCR 1.10.1 version/help, production contract gateway, accepted/rejected background previews, and MATLAB/Objective-C rule resolution in an isolated temporary HOME.
• scripts/quality.sh check passed Ruff format/lint, strict MyPy, Bandit, 1290 tests plus 337 subtests, and 86.46% branch coverage.
• Coverage risk groups passed at 85% (result/preflight), 82% (posting/GitLab transaction), 86% (review/context/DLP/approval), and 87% (MCP/provider/policy/result).
• Focused post-OCR suites passed 343 tests plus 217 subtests and 66 shared-DLP tests plus 8 subtests.
• uv lock --check, OCR support-manifest validation, Towncrier 0.8.4 draft, Gitleaks 8.24.3, dependency audit, and git diff --check passed.
• Two independent local 0.8.4 wheel/sdist builds were byte-identical; Twine and private-path archive inspection passed.
• Clean wheel and sdist installs plus ocr-ci --help passed on Python 3.12, 3.13, and 3.14.

Next gate

Require every hosted check on exact head 54521ceb370a91cd5b5d5cf95eb7565cd8da78b0, signed commits, mergeability, and zero unresolved review threads. Then mark Ready and squash-merge this feature PR before preparing the separate exact-title Release v0.8.4 PR.