PythonWoods · PythonWoods-Dev · Jul 28, 2026 · Jul 27, 2026 · Jul 27, 2026 · Jul 27, 2026
diff --git a/.bumpversion.toml b/.bumpversion.toml
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [tool.bumpversion]
-current_version = "0.26.0"
+current_version = "0.26.1"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)((?P<pre_l>a|b|rc)(?P<pre_n>\\d+))?"
 serialize = [
     "{major}.{minor}.{patch}{pre_l}{pre_n}",

diff --git a/.draft/OrchestrationPrompts/Roadmaps/0. Priority Table.md b/.draft/OrchestrationPrompts/Roadmaps/0. Priority Table.md
diff --git a/.draft/launch_trilogy_v24_v25_v26.jpg b/.draft/launch_trilogy_v24_v25_v26.jpg
diff --git a/.draft/launch_v0240.jpg b/.draft/launch_v0240.jpg
diff --git a/.draft/launch_v0250.jpg b/.draft/launch_v0250.jpg
diff --git a/.draft/launch_v0260.jpg b/.draft/launch_v0260.jpg
diff --git a/.github/ISSUE_TEMPLATE/security_vulnerability.yml b/.github/ISSUE_TEMPLATE/security_vulnerability.yml
@@ -29,7 +29,7 @@ body:
     attributes:
       label: Zenzic version
       description: Output of `zenzic --version`
-      placeholder: "0.26.0"
+      placeholder: "0.26.1"
     validations:
       required: true
 

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
         uses: taiki-e/install-action@ea85faa6acd705ad6d40586db99f1a70b09c2929 # just
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
 

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -42,12 +42,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v3
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v3
+        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v3
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
diff --git a/.github/workflows/release-docs.yml b/.github/workflows/release-docs.yml
@@ -29,7 +29,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
 

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 0
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
 

diff --git a/.pre-commit-hooks.yaml b/.pre-commit-hooks.yaml
@@ -7,7 +7,7 @@
 #
 #   repos:
 #     - repo: https://github.com/PythonWoods/zenzic
-#       rev: v0.26.0
+#       rev: v0.26.1
 #       hooks:
 #         - id: zenzic-verify    # quality gate — corrisponde a `just verify` lato zenzic
 #         - id: zenzic-guard     # fast staged-file credential scan

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,110 +11,38 @@ Versions follow [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-## [0.26.0] - 2026-07-26
-
-### Added
-
-- **CLI `--json` Shorthand Alias (`ECOSYSTEM-FEAT-002`)**: Added `--json` flag to `zenzic score` as an ergonomic shorthand for `--format json`. Emits a single deterministic `ScoreReport` JSON object on `stdout` without rich terminal formatting, designed for programmatic consumers and editor integrations.
-
-### Documentation
-
-- **CLI Reference Mirror Law Realignment (`ADR-020`)**: Updated `docs/reference/cli.md` with `--json` flag specifications, complete `zenzic score` flag table, and JSON Output Schema documentation.
-- **Roadmap Realignment (`ROADMAP-ALIGN-004`)**: Realigned `ROADMAP.md` to establish `[v0.26]` as *DQS Workspace UI*, shifting subsequent platform milestones (`v0.27`–`v0.30`).
-
-## [0.25.4] - 2026-07-26
-
-### Fixed
-
-- **LSP DQS Determinism & Severity Parity (`LSP-FIX-014`)**: Deprecated misleading DQS Status Bar notification emission in `server.py` to preserve the Determinism invariant between incremental LSP mode (which observes topological findings only) and CLI batch mode. Filtered `INFO`-level findings (e.g. Z106) at the transport boundary in `incremental.py` to prevent PROBLEMS panel pollution.
-
-## [0.25.3] - 2026-07-26
-
-### Added
-
-- **AST Reference Link Definition Extraction (`CORE-FIX-001`)**: Upgraded `PolyglotExtractor` to natively extract Markdown Reference Link Definitions (`[label]: dest`) with CommonMark §4.7 first-definition-wins semantics and full code fence masking (`_mask_fences`), eliminating false-positive `Z405` (Unused Asset) findings.
-- **Zensical Framework Feature Parity (`ADAPTER-002`/`ADAPTER-003`)**: Upgraded `ZensicalAdapter` with preserved static asset URL mapping, route classification for root/directory index pages (`index.md`) and dynamic blog routes (`<blog_dir>/posts/`), and theme asset metadata extraction (`favicon`, `logo`, `extra_css`, `extra_javascript`).
-
-## [0.25.2] - 2026-07-26
-
-### Fixed
-
-- **Path Traversal Security Parity (`LSP-FIX-012`)**: Hardened `Z202`/`Z203` path traversal evaluation in `IncrementalAnalysisEngine._run_urp_checks()` by replacing absolute OS filesystem depth checks (`len(path.parents)`) with `docs_root`-boundary escape detection (`os.path.normpath` + `is_relative_to(resolved_docs_root)`). This guarantees 100% security parity between CLI and LSP mode.
-
-## [0.25.1] - 2026-07-26
-
-### Added
-
-- **Adapter-Level `material/blog` Plugin Recognition (`LSP-FIX-011`)**: Extended `MkDocsAdapter` to automatically detect the `material/blog` plugin and classify all posts under `<blog_dir>/posts/` as `REACHABLE` routes in the Virtual Site Map (VSM).
-- **Directory Nav Path Resolution (`LSP-FIX-011`)**: Updated `MkDocsAdapter.get_nav_paths()` to expand trailing-slash directory entries (e.g. `blog/`) to their implicit `index.md` target (`blog/index.md`), eliminating false-positive `Z402` (Unlisted Page) findings for plugin index pages.
-
-### Fixed
-
-- **Inline HTML Suppression LSP Parity (`LSP-FIX-011`)**: Updated `IncrementalAnalysisEngine._run_urp_checks()` to pass the active `SuppressionTracker` when evaluating Polyglot Extractor nodes. Suppressed HTML elements (`data-zenzic-ignore`) are now correctly marked as consumed, eliminating spurious `Z603` (Dead Suppression) warnings in editor sessions.
-
-## [0.25.0] - 2026-07-25
+## [0.26.1] - 2026-07-27
 
 ### Added
 
-- **Adapter-Driven Config Hot-Reloading (`LSP-FIX-009`)**: Added `@property watched_config_files` to `BaseAdapter` contract. The LSP server now dynamically watches framework configuration files (e.g. `mkdocs.yml`, `zensical.toml`) and hot-reloads the Virtual Site Map (VSM) on changes without requiring an LSP server restart.
-- **Consolidated Developer & User Troubleshooting (`DOCS-IA-004`)**: Created dedicated Diátaxis-compliant troubleshooting guides in `docs/how-to/troubleshooting.md` and `docs/developers/how-to/troubleshooting.md`.
-
-### Fixed
-
-- **Centralized Core Governance (`LSP-FIX-009`)**: Extracted `directory_policies` and `per_file_ignores` filtering into `zenzic.core.governance` and integrated them directly into `IncrementalAnalysisEngine._analyze_file`, achieving 100% diagnostic determinism between CLI and VS Code.
-
-## [0.24.5] - 2026-07-25
+- **Adapter API Contract (`CORE-FIX-005`)**: Added the `use_directory_urls` property to the `BaseAdapter` contract. This allows adapters to explicitly declare their URL routing mode, eradicating encapsulation violations in the incremental engine.
 
 ### Fixed
+- **URP Unification (`CORE-REFACTOR-003`)**: Eradicated the legacy CLI link validation pipeline (`validate_links_async`). Both CLI and LSP now evaluate broken internal links exclusively via `VSMBrokenLinkRule.check_vsm` and `PolyglotExtractor`, achieving 100% true validation parity.
+- **Asset Indexing Parity (`CORE-REFACTOR-006`)**: Upgraded the Virtual Site Map (VSM) builder to explicitly index non-Markdown static assets (e.g., `.png`, `.webp`, `.html`). This eradicates hardcoded directory workarounds and eliminates false-positive `Z101` and `Z104` findings for static assets across all adapters.
+- **JSON Purity (`CLI-FIX-001`)**: Enforced absolute JSON purity when the `--json` flag is active by routing `fail_under` and `suppression_cap` failure messages to `stderr`. This prevents `JSON.parse()` failures in programmatic consumers.
+- **MkDocs Asset URLs (`CORE-FIX-002`)**: Eradicated false-positive `Z101` findings for static assets in MkDocs repositories by preventing the `MkDocsAdapter` from appending trailing slashes to non-Markdown files during VSM route generation.
 
-- **Exclusion Path Normalization (`LSP-FIX-008`)**: Hardened the `LayeredExclusionManager` to correctly normalize absolute URIs from the LSP server into repo-relative paths before evaluating `.gitignore` and `.zenzic.toml` exclusion rules. This eradicates false-positive diagnostics on user-excluded directories (e.g., `docs/tutorials/examples`) when opened in VS Code.
-
-## [0.24.4] - 2026-07-24
-
-### Fixed
-
-- **LSP User Exclusion Enforcement (`LSP-FIX-007`)**: Strictly enforced `LayeredExclusionManager` filtering across full workspace sync and incremental file events in the LSP server and `IncrementalAnalysisEngine`, eliminating false-positive diagnostics on user-excluded directories (e.g. `excluded_dirs`).
-
-## [0.24.3] - 2026-07-24
-
-### Fixed
-
-- **Windows Path Parity (CLI & Core)**: Fixed test suite regressions on Windows by ensuring strictly POSIX path comparisons (`.as_posix()`) in CLI JSON report rendering (`_shared.py`) and topological graph traversal (`cycle_registry`).
-- **LSP `docs_root` Fallback**: Centralized `docs_root` resolution in the LSP server to safely fall back to the repository root when the configured `docs/` directory is missing, fixing a silent failure (DQS 100/100) on Zero-Config repositories.
-- **Zero-Config System Guardrails**: Elevated common build directories (`out`, `.vscode-test`) to Layer 1 `SYSTEM_EXCLUDED_DIRS` to ensure safety across VS Code extension codebases regardless of `.gitignore` state.
-- **LSP Memory Leak**: Implemented missing `didClose` handler to explicitly purge documents from `VirtualBufferOverlay`, avoiding unbounded memory growth during long-lived VS Code sessions.
-- **LSP Windows URI Parity**: Replaced naive string slicing with robust `urllib.request.url2pathname` for cross-platform deterministic parsing of `file://` URIs, preventing drive-letter corruption on Windows.
-
-## [0.24.2] - 2026-07-24
-
-### Fixed
-
-- **LSP Layered Exclusion & Asset Resolution (`LSP-FIX-002`)**: Enforced `LayeredExclusionManager` filtering in `LanguageServer._is_within_domain()` and `_build_vsm_sync()` so configured `excluded_dirs` are respected in editor sessions. Registered static HTML and media assets in VSM during initialization to eliminate false-positive `Z101` broken link errors on asset references.
-- **LSP Workspace Initialization Sync (`LSP-FIX-003`)**: Added initial workspace analysis and `zenzic/dqsUpdate` JSON-RPC broadcast upon receiving the `initialized` notification, ensuring editor DQS widgets reflect repository quality state prior to explicit `textDocument/didOpen` events.
-
-## [0.24.1] - 2026-07-24
-
-### Fixed
-
-- **URI Normalization & Link Resolution (`LSP-FIX-001`)**: Resolved false-positive `Z101` findings in LSP mode by extending `VSMBrokenLinkRule._to_canonical_url` to resolve all relative links (without `".."` requirement) relative to `source_dir`, and adding `urllib.parse.unquote()` percent-decoding to `file://` URIs.
-
-### Added
+### Documentation
 
-- **Release Announcement Blog Post (`DOCS-BLOG-001`)**: Added official Zenzic v0.24.0 (*Interactive Intelligence*) release announcement blog post.
+- **Blog Hero Image Standardization**: Added named hero assets for existing release posts, converted launch media from JPEG to WebP, and normalized hero-image alt text to a title-aligned editorial pattern across the blog.
+- **Editor Trilogy Article**: Added `docs/blog/posts/2026-07-27-editor-trilogy-v0240-v0260.md`, a Hostile Precision architectural synthesis of the v0.24.0 → v0.26.0 editor sequence, using the previously policy-exempt trilogy hero asset as an in-site referenced image.
 
-## [0.24.0] - 2026-07-24
+## [0.26.0] - 2026-07-26
 
 ### Added
 
-- **LSP Code Actions Support (`LSP-FEAT-001-CODE-ACTIONS`)**: Enabled `codeActionProvider` in ZLS server capabilities and implemented `textDocument/codeAction` to expose in-memory Quick Fixes for fixable Z-Codes (e.g. `Z121`, `Z603`).
-- **LSP DQS Real-Time Notification (`LSP-FEAT-002-DQS-UI`)**: Added custom `zenzic/dqsUpdate` JSON-RPC notification channel to stream global DQS scores and penalties to editor clients.
+- **CLI `--json` Shorthand Alias (`ECOSYSTEM-FEAT-002`)**: Added `--json` flag to `zenzic score` as an ergonomic shorthand for `--format json`. Emits a single deterministic `ScoreReport` JSON object on `stdout` without rich terminal formatting, designed for programmatic consumers and editor integrations.
 
-### Changed
+### Documentation
 
-- **Governance Alignment (`GOVERNANCE-001-DUAL-TIER-ALIGNMENT`)**: Synchronized internal prompt table (`0. Priority Table.md`) with public `ROADMAP.md` and added state tracking.
+- **CLI Reference Mirror Law Realignment (`ADR-020`)**: Updated `docs/reference/cli.md` with `--json` flag specifications, complete `zenzic score` flag table, and JSON Output Schema documentation.
+- **Roadmap Realignment (`ROADMAP-ALIGN-004`)**: Realigned `ROADMAP.md` to establish `[v0.26]` as *DQS Workspace UI*, shifting subsequent platform milestones (`v0.27`–`v0.30`).
 
 ## Historical Releases
 
+- v0.25.x archive: [changelogs/v0.25.x.md](./changelogs/v0.25.x.md)
+- v0.24.x archive: [changelogs/v0.24.x.md](./changelogs/v0.24.x.md)
 - v0.23.x archive: [changelogs/v0.23.x.md](./changelogs/v0.23.x.md)
 - v0.22.x archive: [changelogs/v0.22.x.md](./changelogs/v0.22.x.md)
 - v0.21.x archive: [changelogs/v0.21.x.md](./changelogs/v0.21.x.md)

diff --git a/CITATION.cff b/CITATION.cff
@@ -15,8 +15,8 @@ abstract: >-
   performs deterministic static analysis using a two-pass reference
   pipeline and a RE2-backed credential scanner, with zero subprocess
   calls and full SARIF 2.1.0 support for CI/CD integration.
-version: 0.26.0
-date-released: 2026-07-26
+version: 0.26.1
+date-released: 2026-07-27
 url: "https://zenzic.dev"
 repository-code: "https://github.com/PythonWoods/zenzic"
 repository-artifact: "https://pypi.org/project/zenzic/"