diff --git a/CHANGELOG.md b/CHANGELOG.md
index f7149856..27861264 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -60,6 +60,7 @@
 
 * **actions:** refuse at parse the actions fields that could never converge ([f68d78b](https://github.com/Vivswan/github-settings-as-code/commit/f68d78bf4a26e916499b1bf5d1b6472f6814679a))
 * add mode: merge with a layered settings-file ([#104](https://github.com/Vivswan/github-settings-as-code/issues/104)) ([d50e70b](https://github.com/Vivswan/github-settings-as-code/commit/d50e70bd51ddf620d023c8c9daf8f94dc269b4b3))
+* add the plan-returning section contract and migrate the workflows section ([8a65765](https://github.com/Vivswan/github-settings-as-code/commit/8a65765e276540e75aae83992b3383ea8e4002ef))
 * **branches:** refuse protection shapes the settings file alone shows wrong ([990c51a](https://github.com/Vivswan/github-settings-as-code/commit/990c51aade3720d9d952b0b0a6e2d8bbc97a0f7e))
 * **check-suite-preferences:** refuse app_ids GitHub rejects or collapses when the file is parsed ([5b3c8e9](https://github.com/Vivswan/github-settings-as-code/commit/5b3c8e9475f3a1a1cc61fc2b1d987d546197b1f9))
 * **ci:** gate kept backward-compatibility code behind COMPAT markers ([#173](https://github.com/Vivswan/github-settings-as-code/issues/173)) ([bf9f482](https://github.com/Vivswan/github-settings-as-code/commit/bf9f482a7ce55911918d81208cf7c88922e67220))
@@ -67,6 +68,7 @@
 * **cli:** github-settings-as-code and gsac commands over the library ([#152](https://github.com/Vivswan/github-settings-as-code/issues/152)) ([364a9c6](https://github.com/Vivswan/github-settings-as-code/commit/364a9c62988a60a6e6af0e434c364aed37be41bc))
 * **cli:** gsac init writes the live settings to .github/settings.yml and prints its PAT grant ([#178](https://github.com/Vivswan/github-settings-as-code/issues/178)) ([3fad2b2](https://github.com/Vivswan/github-settings-as-code/commit/3fad2b25706a3d4fc82a1012c2068053bff8c243))
 * **cli:** under GitHub Actions the CLI emits the action's workflow commands ([#223](https://github.com/Vivswan/github-settings-as-code/issues/223)) ([de75a22](https://github.com/Vivswan/github-settings-as-code/commit/de75a22ac3bff374c509523391c5be3c6cd3e006))
+* **contract:** extend the plan contract for every migrating section ([9ae375c](https://github.com/Vivswan/github-settings-as-code/commit/9ae375cc6027d9d7eac970eb808d14a588bac80f))
 * **deploy-keys:** refuse anything but a public SSH key at parse ([473aa1a](https://github.com/Vivswan/github-settings-as-code/commit/473aa1a9d103f9a0fd3294c905612fc97c261ff5))
 * derive list sections from a declarative factory, piloted on labels ([71859b5](https://github.com/Vivswan/github-settings-as-code/commit/71859b571bc4c334d4e6796b5424b27f361fb8df))
 * **discovery:** match exclude patterns with picomatch under an owned glob grammar ([836f6cb](https://github.com/Vivswan/github-settings-as-code/commit/836f6cb210af5d41be5d160a122d5d417037881f))
@@ -78,6 +80,9 @@
 * **engine:** resolve the undeclared policy once from a file-wide _undeclared and the undeclared input ([a9dcf68](https://github.com/Vivswan/github-settings-as-code/commit/a9dcf68da10889463927158e972dceb14a7390dd))
 * **engine:** run every file-only check before the first write ([1bbe9b2](https://github.com/Vivswan/github-settings-as-code/commit/1bbe9b2db19be6ec7134b926975c35709e9731fd))
 * **environments:** declared-off protection converges, and the schema refuses what GitHub never accepts ([aa43d3e](https://github.com/Vivswan/github-settings-as-code/commit/aa43d3eb3c31ec3dc4028fae4fbe1ae9e0945782))
+* generate action.yml, the inputs table, and the policy and permissions references from declarations ([d062cf1](https://github.com/Vivswan/github-settings-as-code/commit/d062cf1b6bd4f2767986477c383f2bed1a201341))
+* generate COVERAGE.md from section declarations ([51068cd](https://github.com/Vivswan/github-settings-as-code/commit/51068cdd765667b1190cb99625cd7ab6f656df7f))
+* generate the README sections table, outputs, and PAT form from section declarations ([83f3c84](https://github.com/Vivswan/github-settings-as-code/commit/83f3c84ede257c66e2d5ca0cb46f9b3ebfee20e3))
 * **github:** paginate through @octokit/plugin-paginate-rest instead of a hand-rolled Link walk ([1b3b744](https://github.com/Vivswan/github-settings-as-code/commit/1b3b74489b062dd229edfc3078c9fa717b7fecbc))
 * **interaction-limits:** refuse limits, expiries, caps, and keys GitHub rejects when the file is parsed ([1e9a806](https://github.com/Vivswan/github-settings-as-code/commit/1e9a8060ad031657261eca5904f8e0c8a1ff4d26))
 * **labels:** refuse colors and descriptions GitHub rejects when the file is parsed ([10242f4](https://github.com/Vivswan/github-settings-as-code/commit/10242f4a0ca0ccbab538d0bc2a0fb4e63fc727a9))
@@ -113,18 +118,29 @@
 ### Bug Fixes
 
 * **action:** the YAML parser never prints a settings file's source lines as warnings ([#123](https://github.com/Vivswan/github-settings-as-code/issues/123)) ([54a50a0](https://github.com/Vivswan/github-settings-as-code/commit/54a50a074dfbd6ccee945f1b476e3f9f9fc06699))
+* adopt zod 4.5's native root $ref emission and own-__proto__ rejection ([#67](https://github.com/Vivswan/github-settings-as-code/issues/67)) ([44dab3b](https://github.com/Vivswan/github-settings-as-code/commit/44dab3bccf1e5fca5546d48dda45756c1d7ae084))
+* apply review fixes to the docs and tooling sweep ([73b6b4a](https://github.com/Vivswan/github-settings-as-code/commit/73b6b4a4f2cbc2f0f3263fee3478ea0eb2b6eab8))
+* apply review fixes to the harness audit batch ([ceb9f46](https://github.com/Vivswan/github-settings-as-code/commit/ceb9f463d7e7bd24acf4bcb770eb6bee63a9219a))
+* apply review fixes to the src-side audit batch ([b9de617](https://github.com/Vivswan/github-settings-as-code/commit/b9de617bdd0e9cb2444f2b544f8c5c3ae8c754bb))
+* attest build provenance and attach the sigstore bundle to releases ([b5db672](https://github.com/Vivswan/github-settings-as-code/commit/b5db67242eabf3b2c380ba672bcd022c476ddfdf))
 * **autolinks:** keep the live is_alphanumeric on a recreate and refuse what GitHub 422s ([#263](https://github.com/Vivswan/github-settings-as-code/issues/263)) ([2011455](https://github.com/Vivswan/github-settings-as-code/commit/2011455dc6d572353d6c7a60199e1b0d1a6714c5))
 * **branches:** a denied branch probe no longer reads as a missing branch ([#149](https://github.com/Vivswan/github-settings-as-code/issues/149)) ([c1d6243](https://github.com/Vivswan/github-settings-as-code/commit/c1d62434c124cb8b49bf482884a9966b4498d43e))
 * **branches:** compare actor lists case-insensitively and read an absent review holder as empty ([#269](https://github.com/Vivswan/github-settings-as-code/issues/269)) ([46ed70f](https://github.com/Vivswan/github-settings-as-code/commit/46ed70f329ebe39b23c9d0f99fa78a3f639ae219))
 * **branches:** refuse a restrictions block without its users and teams lists at parse ([03f783e](https://github.com/Vivswan/github-settings-as-code/commit/03f783ee5d4ba0b373290ccf64c6b749d150f553))
 * **branches:** report an omitted all-empty live restrictions holder and type required_status_checks.checks items ([917025c](https://github.com/Vivswan/github-settings-as-code/commit/917025ce2c42c3a2d60b15a203457e432a16b272))
 * **branches:** seal GraphQL node-id lookups at execution so check mode never issues them ([#75](https://github.com/Vivswan/github-settings-as-code/issues/75)) ([feaf279](https://github.com/Vivswan/github-settings-as-code/commit/feaf279a69df4c125f33827ed5b300c18b657a4e)), closes [#73](https://github.com/Vivswan/github-settings-as-code/issues/73)
+* centralize the token-leak sweep in the runner ([7dcc225](https://github.com/Vivswan/github-settings-as-code/commit/7dcc2256e80f56248284b77b7ef1c17decd3c5c2))
 * **ci:** name the fuzz-issue inputs the action no longer defaults ([#186](https://github.com/Vivswan/github-settings-as-code/issues/186)) ([fded5f5](https://github.com/Vivswan/github-settings-as-code/commit/fded5f527679e8028a8eeb5dd77af39aa51c012d))
+* classify rate limits structurally on every path ([65f97a2](https://github.com/Vivswan/github-settings-as-code/commit/65f97a2a86e85d60492889a85f28273996d48fd7))
 * **cli:** each command's help names only the flags it accepts ([#182](https://github.com/Vivswan/github-settings-as-code/issues/182)) ([51a75e7](https://github.com/Vivswan/github-settings-as-code/commit/51a75e79d4df92282b4339f3571ec7f7107a3ac4))
 * **contract:** classify definitive 404 rejections ahead of the permission branch ([#164](https://github.com/Vivswan/github-settings-as-code/issues/164)) ([8be6b7d](https://github.com/Vivswan/github-settings-as-code/commit/8be6b7d901e840e3088066699723e83e9f5ea8ec))
 * **contract:** the plainData refusal names what JSON does with each bad item; the grant comment points at the generated docs; the validate truncation arms get their relation ([#231](https://github.com/Vivswan/github-settings-as-code/issues/231)) ([0118807](https://github.com/Vivswan/github-settings-as-code/commit/0118807afdb1fcef33d0b5b5d3b73d861c1a917e))
+* correct mock identity minting and the pages resurrect bug ([9152a91](https://github.com/Vivswan/github-settings-as-code/commit/9152a91b6f1ef2dd8b5ef94223abb9d5dc72a663))
+* cover every faultable section in the fuzz fault battery ([e41aa99](https://github.com/Vivswan/github-settings-as-code/commit/e41aa9916c9673941b40365347c77692352a16e1))
 * **deps:** bump zod to 4.6.7, past CVE-2023-54404 that the fleet's trivy step fails on ([c93494d](https://github.com/Vivswan/github-settings-as-code/commit/c93494dc063497b2097ea1efd76d06bbf95b7ad0))
+* derive owner-kind sensitivity from the section declaration ([0181f01](https://github.com/Vivswan/github-settings-as-code/commit/0181f01a752eb9675f48663d21e9ce70ef497b31))
 * **dev:** a fresh checkout runs bun run check green; the trimmed OpenAPI file regenerates when absent ([#219](https://github.com/Vivswan/github-settings-as-code/issues/219)) ([7468741](https://github.com/Vivswan/github-settings-as-code/commit/746874159452dcece59b25187070b534643a9ac8))
+* discover schema-corpus scenarios across all scenario roots ([d34d031](https://github.com/Vivswan/github-settings-as-code/commit/d34d0316af107fccf5c910352eae608dff39e91c))
 * **discovery:** refuse "." and ".." as a repository owner or name ([#493](https://github.com/Vivswan/github-settings-as-code/issues/493)) ([693881d](https://github.com/Vivswan/github-settings-as-code/commit/693881daf1a4cbfd8af617824035a64e81fdc2ff))
 * **e2e:** oracle never predicts a preflight abort for teams on a personal account ([#114](https://github.com/Vivswan/github-settings-as-code/issues/114)) ([152c7d9](https://github.com/Vivswan/github-settings-as-code/commit/152c7d98e9de002a9ffad32e06ed6a1bfaa17733))
 * **e2e:** path param accessors read own keys only ([#158](https://github.com/Vivswan/github-settings-as-code/issues/158)) ([89c8ee8](https://github.com/Vivswan/github-settings-as-code/commit/89c8ee811d661baab9a4610ae7fc1f777276bd18))
@@ -139,14 +155,20 @@
 * **github:** pace every throttling group by the client's own scheduler ([#165](https://github.com/Vivswan/github-settings-as-code/issues/165)) ([d70d315](https://github.com/Vivswan/github-settings-as-code/commit/d70d31578167c1004c3820d5d184d4c7f4ae74c8))
 * **github:** refuse a cyclic payload at its field instead of exhausting the stack ([#171](https://github.com/Vivswan/github-settings-as-code/issues/171)) ([9dc8e42](https://github.com/Vivswan/github-settings-as-code/commit/9dc8e429514aebfccc9519aecfaa2cbc4223e954))
 * hand sections the parsed settings document instead of the raw one ([1ddc2f3](https://github.com/Vivswan/github-settings-as-code/commit/1ddc2f3ed9cf567e5bd5bb67d658d6ae28f3902a))
+* harden release boundary checks and decouple the schema id from the release manifest ([f5c4c59](https://github.com/Vivswan/github-settings-as-code/commit/f5c4c59896053ed9ef5eecd44e550887dfe33959))
+* harden the CI tooling ([6fb2603](https://github.com/Vivswan/github-settings-as-code/commit/6fb2603a57cfa6ed2d6fc98041fbb60dd2d18f7a))
 * **inputs:** refuse a bad repos list and misplaced filters when the inputs are parsed ([#552](https://github.com/Vivswan/github-settings-as-code/issues/552)) ([8c2ac7e](https://github.com/Vivswan/github-settings-as-code/commit/8c2ac7efff862c20dcb500bb2dc233398e7b83c3))
 * **io:** collectingIo masks captured text with the shared redactor ([#163](https://github.com/Vivswan/github-settings-as-code/issues/163)) ([a0faf1c](https://github.com/Vivswan/github-settings-as-code/commit/a0faf1cd2f4a427973478a33385572296767072a))
+* keep spec-pinned gaps out of automatic graduation ([ae278c9](https://github.com/Vivswan/github-settings-as-code/commit/ae278c9f3770a8580727db917124a0cea32e164b))
 * **layers:** a validation issue after a _remove entry names the entry by its index in the file ([5b4b750](https://github.com/Vivswan/github-settings-as-code/commit/5b4b7508caf7beb34d1a5b3c8c6e77404e54b7b7))
 * **library:** gate findings on the packaging PR ([#156](https://github.com/Vivswan/github-settings-as-code/issues/156)) ([e4e8b4c](https://github.com/Vivswan/github-settings-as-code/commit/e4e8b4c1f7717100a5a96348fe0e2174ae6d5e0e))
 * **library:** mergeSettings renders the fold the action writes; a null over nothing drops ([e725c08](https://github.com/Vivswan/github-settings-as-code/commit/e725c08621d92414afd124a1523fa8cf4f05750b))
 * **milestones:** compare due_on by day so it converges ([c02395c](https://github.com/Vivswan/github-settings-as-code/commit/c02395cc90913e140364f8e31de5c7eae2c1bef7))
 * **nightly:** file the curated e2e issue through the fleet action ([#160](https://github.com/Vivswan/github-settings-as-code/issues/160)) ([8ef9747](https://github.com/Vivswan/github-settings-as-code/commit/8ef974791d61264e69dcae81be481a645fb5a420))
 * **nightly:** replay a fuzz artifact with the command its run wrote ([#157](https://github.com/Vivswan/github-settings-as-code/issues/157)) ([339e002](https://github.com/Vivswan/github-settings-as-code/commit/339e002d13cdcf4054d185bf44661695ccf7877e))
+* parse live bodies through parseLive in the seven asserting sections ([56ca3e4](https://github.com/Vivswan/github-settings-as-code/commit/56ca3e41dc90981580c4d45057594ad8f4b74369))
+* pass zod's schema layout through instead of guarding it ([#68](https://github.com/Vivswan/github-settings-as-code/issues/68)) ([64aad27](https://github.com/Vivswan/github-settings-as-code/commit/64aad276b2182d4a39175d15fe5e4e7b530345d0))
+* reject required-sections entries excluded by the sections allowlist ([c1fc169](https://github.com/Vivswan/github-settings-as-code/commit/c1fc1699adc8027919464bea8eceb65b53fc81f2))
 * **release:** follow the attestation bundle rename in the repo-owned asset check and SECURITY.md ([#76](https://github.com/Vivswan/github-settings-as-code/issues/76)) ([3704176](https://github.com/Vivswan/github-settings-as-code/commit/3704176cc0709d1c19a70765c925f033f4266ccd))
 * **release:** keep next from moving back on a publish the registry has not yet shown ([#190](https://github.com/Vivswan/github-settings-as-code/issues/190)) ([c247bab](https://github.com/Vivswan/github-settings-as-code/commit/c247babde06fc16d8b1a0fb3e0ee4d3de44439cd))
 * **release:** order pre-release versions by main's commit count, not the run number ([#197](https://github.com/Vivswan/github-settings-as-code/issues/197)) ([131780e](https://github.com/Vivswan/github-settings-as-code/commit/131780e1d385820500eda378f81c79da2335d72e))
@@ -171,8 +193,11 @@
 * **settings:** refuse a settings file whose YAML aliases form a cycle ([#522](https://github.com/Vivswan/github-settings-as-code/issues/522)) ([44a3f29](https://github.com/Vivswan/github-settings-as-code/commit/44a3f29eb8b7616b6d1ebde6d0e9a86b8cf7d14c))
 * **settings:** resolve YAML merge keys in the settings reader ([#262](https://github.com/Vivswan/github-settings-as-code/issues/262)) ([8977aea](https://github.com/Vivswan/github-settings-as-code/commit/8977aea70ec26d80f1e355f3cd9a85bf12963ba2))
 * **settings:** unknown underscore keys fail everywhere; teams gets the _undeclared knob; GSAC_RETRY_BASE_MS ([05e6d41](https://github.com/Vivswan/github-settings-as-code/commit/05e6d410541988f63d92f74d5e00e47947bffe66))
+* single-tag releases - version tags live only on packaged commits ([08d5585](https://github.com/Vivswan/github-settings-as-code/commit/08d5585b974e529898cf2121bfea220317c914c8))
+* size the harness kill cap for the directed fuzz battery ([8543af8](https://github.com/Vivswan/github-settings-as-code/commit/8543af85d8178f736598e6565839df1c57b8334c))
 * **snapshot:** a denied sub-read fails the section under on-missing-permission: fail ([#184](https://github.com/Vivswan/github-settings-as-code/issues/184)) ([04d8d35](https://github.com/Vivswan/github-settings-as-code/commit/04d8d356942f4435cd2962381bbb348f7daf989c))
 * **snapshot:** refuse a destination the filesystem carries onto an authored file ([#179](https://github.com/Vivswan/github-settings-as-code/issues/179)) ([5b24963](https://github.com/Vivswan/github-settings-as-code/commit/5b249639e7e11c073197eae3fa8af6ecc1848539))
+* strengthen the remaining per-section representations ([3fc0f85](https://github.com/Vivswan/github-settings-as-code/commit/3fc0f853f914d032e0bf5f746aee48357d062a03))
 * **test:** match private-report heading markers without an HTML-comment regex ([#106](https://github.com/Vivswan/github-settings-as-code/issues/106)) ([33ff405](https://github.com/Vivswan/github-settings-as-code/commit/33ff40576b478606dce525da0ee0aa5bd64fd290))
 
 
diff --git a/release-please-config.json b/release-please-config.json
index aea5eca6..2cf909a0 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -2,6 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "bump-minor-pre-major": true,
   "bump-patch-for-minor-pre-major": true,
+  "commit-search-depth": 5000,
   "include-component-in-tag": false,
   "last-release-sha": "6dbc9a96a69818e569f8372acac82bb152a7c389",
   "packages": {