fix(release): finish-release checks a sat-out Maven's real coordinate

1.0.8 is the first `v*` cut where Maven sat out (it stays 8.0.7). Gate 5 still demanded the
derived 8.0.8 in the llms summary and counted 8.0.7 as stale, so a correct mirror was refused
and the only way through was to make it lie; the tag message would also have named 8.0.8.
Gates 5 and 7 now use MAVEN_SHIPPED: the derived coordinate, or the sat-out one. Counting it
as shipped is safe unscoped because the Maven line runs seven majors ahead, so no other
registry shares its number.

The v1.0.8 tag was cut by `gh release create` (lightweight, on e3e23c9, the release
commit) after this gate refused. The fixed gates 1, 3, 4 and 5 pass against that tree with
`--sat-out maven`; the tag is left where it is rather than moved.

Tests: two gate-5 cases (a sat-out Maven's coordinate passes; a summary naming neither
coordinate is still refused). 44/44.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M1mRRB1K2WdYy82kntMQdx

Author: dmealing

scripts/finish-release.mjs

@@ -229,6 +229,9 @@ if (wrong.length > 0) {
 } else {
   ok(`payload states all four coordinates: npm ${r.npm} · PyPI ${r.pypi} · NuGet ${r.nuget} · Maven ${r.maven}`);
 }
+// The Maven coordinate this release actually ships: the derived one, unless Maven sat out,
+// in which case its previous coordinate is still the current one. Gates 5 and 7 name it.
+const MAVEN_SHIPPED = satOut.get("maven") ?? MAVEN_VERSION;
 
 // ── 4. the injector and the payload are both IN the tree being tagged ────────
 // The deploy runs the injector FROM the tag. A tag without it takes the skip branch in
@@ -289,7 +292,7 @@ for (const rel of ["docs/llms/llms.txt", "docs/llms/llms-full.txt"]) {
   }
   const missing = [
     ...(summary.includes(VERSION) ? [] : [`npm ${VERSION}`]),
-    ...(summary.includes(MAVEN_VERSION) ? [] : [`Maven ${MAVEN_VERSION}`]),
+    ...(summary.includes(MAVEN_SHIPPED) ? [] : [`Maven ${MAVEN_SHIPPED}`]),
   ];
   if (missing.length > 0) {
     die(`${rel}'s summary line does not name ${missing.join(" or ")} — refresh the mirrors ` +
@@ -320,7 +323,10 @@ for (const rel of ["docs/llms/llms.txt", "docs/llms/llms-full.txt"]) {
   // mirrors name no third-party version anywhere, so the only three-part strings in them
   // are MetaObjects' own coordinates, and a claim line may only name what shipped.
   const VER = /\b\d+\.\d+\.\d+\b/g;
-  const SHIPPED = new Set([VERSION, MAVEN_VERSION]);
+  // MAVEN_SHIPPED, not the derived coordinate: a sat-out Maven's unmoved number is what
+  // ships. Safe unscoped, unlike the per-registry excuse below: the Maven line runs seven
+  // majors ahead of the others, so no other registry can share its number.
+  const SHIPPED = new Set([VERSION, MAVEN_SHIPPED]);
   // ...plus a registry that SAT OUT, which still ships its previous coordinate: the mirror
   // saying PyPI `1.0.1` at the 1.0.2 cut is right, and refusing it left no way through but
   // making the mirror lie. The excuse is scoped to where the line ATTRIBUTES the number to
@@ -379,7 +385,7 @@ ok(`the site deploy will resolve ${tag}`);
 if (CHECK_ONLY) { ok("--check: gates passed; no tag cut"); process.exit(0); }
 
 // ── 7. cut it ────────────────────────────────────────────────────────────────
-execSync(`git tag -a ${tag} -m "metaobjects ${VERSION} / ${MAVEN_VERSION}"`, { cwd: REPO, stdio: "inherit" });
+execSync(`git tag -a ${tag} -m "metaobjects ${VERSION} / ${MAVEN_SHIPPED}"`, { cwd: REPO, stdio: "inherit" });
 execSync(`git push origin ${tag}`, { cwd: REPO, stdio: "inherit" });
 ok(`cut and pushed ${tag}`);
 console.log(`\n  Next: \`gh release create ${tag}\` with the CHANGELOG section as the body.`);

scripts/finish-release.test.ts

@@ -442,6 +442,26 @@ describe("finish-release gate 5: the llms mirrors state this release", () => {
     expect(r.out).toContain("does not name Maven 7.24.6");
   });
 
+  // Maven sat out 1.0.8 at 8.0.7. Gate 5 checked the summary for the DERIVED 8.0.8 anyway, so
+  // a correct mirror was refused, and the only way through was to make the mirror lie.
+  test("a summary naming a SAT-OUT Maven's unmoved coordinate passes", () => {
+    const r = makeRepo({
+      payload: { maven: "7.24.5" }, manifest: { maven: "7.24.5" },
+      llms: llms({ ...SHIPPED, maven: "7.24.5" }),
+    }).run(RELEASE, "--sat-out", "maven", "--check");
+    expect(r.out).toContain("the llms mirrors state this release");
+    expect(r.code).toBe(0);
+  });
+
+  test("a sat-out Maven does not excuse a summary naming neither coordinate", () => {
+    const r = makeRepo({
+      payload: { maven: "7.24.5" }, manifest: { maven: "7.24.5" },
+      llms: llms({ ...SHIPPED, maven: "7.24.4" }),
+    }).run(RELEASE, "--sat-out", "maven", "--check");
+    expect(r.code).not.toBe(0);
+    expect(r.out).toContain("does not name Maven 7.24.5");
+  });
+
   test("a mirror with no summary line at all is refused", () => {
     const r = makeRepo({ llms: "# MetaObjects\n\nno summary here\n" }).run(RELEASE, "--check");
     expect(r.code).not.toBe(0);