docs: generate the Mintlify changelog, sync the site with the review fixes, clear CodeQL

[CodeWithJuber]

What & why

This is a follow-up to #164, which merged with one red check: CodeQL flagged one new high-severity alert. The Mintlify changelog page had also fallen behind: it had one hand-written entry from July while about thirty releases shipped. Several doc surfaces still described behavior from before the review fixes.

1. Security: CodeQL goes from 3 results to 0. I verified this with a local run of the same CodeQL version (2.27.0, javascript-code-scanning suite).

• scripts/claims-status.mjs, js/incomplete-sanitization (high, new in fix: repair the trust guarantees and research claims from the 2026-09-26 deep review #164). Table cells escaped | but not \, so a trailing backslash could undo the escape. Backslashes are now escaped first.
• src/model_catalog.js, js/polynomial-redos ×2 (high, older than fix: repair the trust guarantees and research claims from the 2026-09-26 deep review #164). The tokenizer's /(?:\.0)+$/ and trimUrl's /\/+$/ backtracked quadratically. They are replaced by linear scans, including a new stripTrailingSlashes in src/util.js.
• The same patterns in code added by fix: repair the trust guarantees and research claims from the 2026-09-26 deep review #164 are hardened too: the workspace-glob trim and the semantic guard's edge-punctuation trim (now trimEdges).
• Each replacement is checked against the regex it replaced; trimEdges is checked on 2,000 seeded random tokens. Each also has a linear-time test on a hostile input.

2. The Mintlify changelog page is generated from CHANGELOG.md.

• src/changelog_page.js renders every release, plus [Unreleased], as a Mintlify <Update> entry: 62 entries and 428 headlines. Each entry has filter tags and a link to that release's full notes on GitHub.
• forge docs render writes the page between JSX-comment markers, because MDX rejects HTML comments. It is a strict target, so forge docs check fails when the page is stale.
• scripts/bump.mjs regenerates the page in the release commit, so a release can't leave it behind.
• All 19 Mintlify pages compile under MDX 3.
• The generated page surfaced two corrections to the CHANGELOG:
  • 1.1.2 called the project's own second-machine re-run an "independent replication". It now carries a dated correction.
  • 1.0.0 had lost the \r\n escapes inside two code spans.

3. Docs synced with the merged fixes.

• Mintlify reference pages:

  • forge verify: per-package coverage, pre/post binding, verifier events, .forge/forge.config.json.
  • forge stack: available runners.
  • forge context: what COMPLETE means, --block.
  • forge reuse and forge ledger: lossless keys, serve-time revalidation, one vote per event, archive reasons, conflicts, --fix --dry-run.
  • forge dash: Host check on every route, session token.
  • The universal router, which the site did not document at all.

• Landing page: now lists all ten native targets; OpenClaw was missing. The grid was checked in headless Chromium at 8 widths: rows are always full and nothing overflows.

• Claim registry: I re-ran the review's probes on the merged commit 7eef611, as regression tests: 46 pass, and 1 skip needs a non-root user. The claims found refuted at d2abfa6 are re-assessed:

  Status now	Claims
  implemented	verify binding, context completeness, exact reuse (scope in the notes)
  partial	evidence independence, outcome provenance
  still refuted	the imagine "sandbox" claim, the router target guarantee

  The impact fixture's F1 is updated to 0.28.

• Config and contributor docs: biome.json is migrated to the installed Biome 2.5.13, with lint results unchanged. CLAUDE.md now states the right Biome version and says to run docs render after editing the CHANGELOG.

Checklist

• npm test passes: 1,692 tests, 1,688 pass, 0 fail, 4 platform-gated skips (Node 22 locally)
• npm run check passes (Biome lint + format)
• New public functions have a test
• Conventional commit message (feat:/fix:/docs: …)
• CHANGELOG.md updated under ## [Unreleased]
• No new runtime dependency (dev deps ok). The MDX compile and Chromium checks ran from a scratch directory, not the repo.
• Substrate/docs updated if this changes forge substrate, forge impact, router/gate, or MCP substrate tools

Risk & rollback

• Risk level: low. The regex replacements are behavior-identical, and each is tested against its old regex. The rest is docs, plus one new strict docs-check target.
• One new contributor step: after editing CHANGELOG.md, run node src/cli.js docs render. The docs check names this fix when it fails, and CLAUDE.md states it.
• Rollback plan: revert the merge commit.

Extra checks (tick if applicable)

• npm run typecheck passes
• Input validated at boundaries; errors handled (no swallowing)
• Authorization/ownership checked (if it touches access): n/a
• Logs contain no secrets/PII
• If AI-assisted: I understand it, verified the package APIs, and it has tests

🤖 Generated with Claude Code

https://claude.ai/code/session_01GVVG2VDETWsDxMu6MBWPz2

---

Generated by Claude Code