22c2db4a96
Two problems, one cause. Before62131e7the promotion step renamed the Unreleased heading instead of consuming it, appending "(carried forward)" on every build - one heading had accumulated the suffix seven times. Notes were left stranded under 103 such headings while the version sections the release workflow extracts held only their build line, so a release would have published nothing.62131e7fixed the mechanism but never repaired the backlog, and Unreleased was empty besides. Consolidated the stranded notes under Unreleased and collapsed duplicate version sections: 1441 lines to 570, with every one of the 144 bullets and 16 sub-headings still present, checked by diffing the sets before and after. Described the seeding work of the last several commits, which was undocumented: the enrollment protocols and where they are configured, the dynamic SCEP challenge, auto-renew by default, and the four defects the first live run exposed. Verified the mechanism end to end - a build promotes the notes into its version section, leaving Unreleased empty, and the workflow's extraction returns 245 lines rather than a bare build line. 340 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>