Most of these are our own bugs.

**Two things to do once, before trusting your next run.** No config edit is required, nothing was removed, the law count is unchanged at 169.

• 🐛 Fixed — a law that passes for want of subject matter
• 🐛 Fixed — a Lighthouse gate is something that runs
• 🐛 Fixed — four detection paths that could never fire
• 🐛 Fixed — the performance family agrees with itself
• 🐛 Fixed — a checklist clause defers to a law that PASSES
• 🐛 Fixed — a compliance script is what it runs, not what it is called
• 🐛 Fixed — three detectors that reported on code they had not read
• 📄 Documentation

**If you work in an Nx workspace, five laws have been lying to you — and lying in the same direction.** No config edit is required; nothing was removed; the law count is unchanged at 169. Every change below makes a law report *less*, so a law you parked because of one of these can be unparked.

• 🐛 Fixed — the test count, which was counting almost none of them
• 🐛 Fixed — Angular states its environments in the build system
• 🐛 Fixed — the performance family contradicted itself in one run
• 🐛 Fixed — a waiver the law could not reach
• 🐛 Fixed — coverage thresholds live where Jest resolves them

**No config edit is required.** Nothing was removed, the law count is unchanged, and every fix below makes a law report less, not more — except one, which is `info` and cannot fail your audit.

• 🐛 Fixed — a git path is not the repository
• 🐛 Fixed — one branch-name rule, and `chore/` decided in one place
• 🐛 Fixed — commit size measures authored change, not generated lines
• 🐛 Fixed — two heuristics that reported on code they never read
• ✨ Added — the commit laws say which scope they resolved
• ✨ Added — reproducible randomness and unpredictable randomness are not the same request

**Read this before upgrading. Three changes move numbers you may have written into your config.** None of them is a defect in your project; all three will look like one if the note is not read.

• 🐛 Fixed — four duplicate laws retired
• 🐛 Fixed — a database layer is proved by use, not by a dependency name
• 🐛 Fixed — a git tag is a ref, not a version string
• 🐛 Fixed — declared budgets count as a bundle-size policy
• 🔒 Security

Four consumer reports, every one of them a follow-up to a fix we closed while it was still incomplete. A PATCH: nothing changes for a project that was passing.

• 🐛 Fixed — one CI discovery for the whole tool, not twelve
• 🐛 Fixed — the rest of the Nx and static-host discovery
• 🐛 Fixed — a service is what a project runs, not what it installs
• 🐛 Fixed — the Markdown footer is the block after the LAST rule
• 📄 Documentation

Eleven consumer reports. **Four of them are against fixes that shipped in 7.18.0** — that is the part worth reading first, and the reason this release exists a day later.

• 🐛 Fixed — what 7.18.0 got wrong
• ✨ Added — declare where your CI lives
• 🐛 Fixed — a crash reported as a clean result
• 🐛 Fixed — merge commits failed their own hook
• 🐛 Fixed — the commit hook now enforces what the audit enforces
• 🐛 Fixed — three checks that could not read what was in front of them
• 🔒 Fixed — the results cache is keyed by audit mode

Sixteen consumer reports, closed together. The version is a **MINOR** for one reason: installing the package no longer runs a script. Everything else here only stops laws being wrong.

• 💥 Changed — the package no longer runs a postinstall script
• 🐛 Fixed — six laws only knew one project layout
• 🐛 Fixed — an audit named a count and never the artefacts
• 🐛 Fixed — laws that could not be satisfied without lying
• 🐛 Fixed — detectors that misread what was in front of them
• 🐛 Fixed — configuration that looked like it worked
• 🐛 Fixed — the version stamped into git hooks was maintained by hand
• 📄 Documentation — detectionLimits

Git Hook Compliance called **every hook of every Windows project** non-executable, and the consumer could not act on it. NTFS carries no POSIX execute bit: `fs.stat().mode` is `0o666` for every file there and `chmod` is a no-op, so `chmod +x` — the fix the law printed — changes nothing. It also judged files git never runs: husky keeps `.gitignore`, `husky.sh` and `h` in its hooks directory.

• 🐛 Fixed — the hook executable bit is read from the git index, not the filesystem
• 🔒 Security — dependency lockfile refreshed
• 📄 Documentation — the law card schema

In a linked worktree (`git worktree add`) `<root>/.git` is a **file** holding `gitdir: …`, and the shared config and hooks live in the main repository's git directory. Three laws joined `.git/hooks` and `.git/config` onto the project root, found nothing, and reported it as a violation:

• 🐛 Fixed — three git laws were blind to linked worktrees

`ruleofcode init` asks its questions through inquirer, which needs a real terminal to answer them. In CI, in a container, or behind a pipe there is none: readline force-closes and the process dies with an `ERR_USE_AFTER_CLOSE` stack trace and exit 7 — a setup tool crashing rather than setting anything up.

• 🐛 Fixed — `init` crashed instead of setting up when there is no terminal

First release published to npm as **`ruleofcode`**.

• 🐛 Fixed — Branch Governance failed on every detached-HEAD checkout
• 🔧 Changed — the project's own CI gate
• 📄 Added — pull request template

Branch Governance no longer counts the whole history as branch size.

• 🐛 Fixed — Branch Governance measured history depth, not branch size

Name-agnostic package recognition — RoC now recognises itself under any of its published npm names.

• 🔧 Changed — recognise RuleOfCode under any published package name

Raw-text-blindness release, and the first build prepared for public distribution.

• 🐛 Fixed — the raw-text-blind NgRx / template class of false positives
• 📦 Packaging — prepared for public distribution
• 🔧 Changed — husky hooks refreshed to v9-native output

Consumer-findings release. A downstream consumer (which runs RoC as its own gate) reported that after burning its real debt down honestly, the remainder were detector false-positives on a modern stack (esbuild / Angular 20 / e2e-first / captured transcripts) — not real debt. Four classes, all fixed: each verified against the code, proven red AND green, with regression tests. These change verdicts on modern projects; no config default changes; schemaVersion stays 2.

• 🔴 Fixed — testing laws punished writing more tests (the worst class)
• 🔴 Fixed — parsing false positives
• 🔴 Fixed — modern Angular / esbuild blindness

Angular-20 blindness release. A downstream consumer reported that laws false-warned on a correct Angular 20 app whose components have no `.component.ts` suffix (a component is now `home.ts`). Fixing it also surfaced a fix that had shipped to dead code, and the dead code itself. Each verified against the code, proven red AND green, with regression tests. These change verdicts on modern Angular projects; no config default changes; schemaVersion stays 2.

• 🔴 Fixed — "No Angular components found" on a correct Angular 20 app
• 🔴 Fixed — a lazy-loading fix that shipped to dead code, and the dead code
• 🪦 Removed — dead code, not "fixed"

Consumer-findings release. A downstream consumer adopted RoC as its own gate and reported four detector false-positives from real, correct code; all four are fixed here, each verified against the code, proven red AND green, with regression tests. These change verdicts (laws that false-warned now pass on correct setups) but do NOT change any config default. `schemaVersion` stays 2 — the one new `laws --json` field is additive.

• ✨ Added
• 🔴 Fixed — false positives on correct, modern code

Detector-correctness release. Authoring the Law-Card model in v7.12.0 surfaced a batch of laws that were quietly lying — some always green, some impossible to pass without a lie, some false-failing modern code. Each was fixed grounded in the real detector, proven red AND green, with `detectionLimits` updated in lockstep. **These change verdicts**: a project that "passed" a broken law may now see it fire (or stop firing). No config-default or schema change (`schemaVersion` stays 2).

• 🔴 Fixed — laws whose verdict contradicted their own findings
• 🔴 Fixed — three laws no Python project could pass without a lie
• 🔴 Fixed — VERSION_CONTROL correctness
• 🔴 Fixed — modern Angular was failing laws it had already satisfied
• 🐕 Dogfood

Law-model **COMPLETE** — the Law-Card fields are now authored across **all 173 laws**, so `roc laws --json` describes every law honestly: why it exists, how to pass it per stack, and what it does NOT catch. Ships with a batch of detector-correctness fixes found while authoring.

• ⚠️ Changed — `schemaVersion` 1 → 2 (the one potentially-breaking item)
• ✨ Added — the Law-Card model, now 173/173
• 🔴 Fixed — detector bugs that change verdicts (found while authoring)
• 📝 Documented — honest limits now visible on every law

Law-model v1 for a downstream consumer — new fields on `roc laws --json`, all additive (nothing breaks). Verified against a downstream consumer's contract at v7.10.0.

• 🔴 Fixed — a law was unreachable at `/laws/:slug` by construction
• ✨ Added — `detectionLimits`: what a law does NOT claim
• 🧹 Fixed — stale comments describing behaviour that no longer exists