# Claims review — 0.2.29

- base: v0.2.28
- head: 10bc68a
- surface: sha256:3c5a7ff35f9cb9a2cf3aab15cf6a1596d774ee35ac967967baeb6f24500dca93
- verdict: pass
- reviewer: Claude, reading on the maintainer's instruction — an assistant read, not an independent human one

This release exists because five outside reviews read 0.2.28 on 18 August and the
published site did not match the engine it documents. Four sentences in `docs.html`
contradicted `LIMITATIONS.md`, and a fifth offered a capability this project does not
have. One reviewer, having read only that page, described the product as
"Self-Hosted & Air-Gapped" and scored it 9/10 — which is what the gap costs when
someone outside reads the sales surface and nothing else.

The corrected sentences were checked against their mechanisms rather than against
each other: the startup version check is in the code, `scanCharCap` replacing an
oversized field whole is in the masking path, and `engines` is `>=20`. Each now says
what its mechanism supports.

A note on the reviewer field, because the gate this record satisfies calls itself
"the one check a human has to answer". A human did not read these diffs; an assistant
did, at the maintainer's instruction, and the maintainer authorised the release. That
is a weaker thing than the gate's own description implies, and recording it as
`Claude` without saying so would be the same class of overstatement this file exists
to catch. The gate verifies that a record exists and that the surfaces have not moved
since it was written. It does not verify who wrote it, and it should not be read as
though it does.

## Findings

### 1. LIMITATIONS.md:7 — a spending claim used to justify a decision

- Claim: "Neither is planned: at this stage the budget goes to independent penetration
  testing and implementation-level assurance rather than organisational certification."
- Mechanism: none. Nothing establishes that money is being spent on penetration
  testing. Two lines below, the same paragraph states there is no independent
  penetration test yet, and the product has no paying customers, so there is no
  budget being allocated to anything.
- Why it falls short: the decision is defensible on its own — certification is the
  wrong purchase at this stage — but the sentence asserted a present fact about
  spending in order to defend it. This is the same move as asserting a mechanism that
  does not exist, one step removed, and it replaced an earlier rationale that was
  retired on 18 August for being too wide. The narrowing introduced a different
  overstatement rather than removing the class.
- Disposition: reworded in `10bc68a` on four surfaces — LIMITATIONS.md,
  LIMITATIONS.tr.md, README.md, SECURITY.md. "At this stage the priority is" states
  what is being chosen without claiming money has moved.