Datary 0.2.0: corrective audit release

[devkyato]

What changed

I treated the critique as a release blocker and followed Datary's evidence path from raw input through parsing, analysis, integrity checks, reports, package builds, and the release artefacts.

Oh! The most important correction is mathematical: order-dependent metrics now preserve observation order. The session trust boundary rejects symlinks before resolution, malformed evidence is hashed, overwrite publication is recoverable, and recording/inspection analysis is disk-backed instead of accumulating every record in memory.

The ingestion, quality, comparison, plotting, replay, reporting, generator, privacy, packaging, and CI boundaries received the same corrective pass. The README and 0.2.0 notes explain both how the project works and what this alpha still does not claim.

Verification

• 87 tests pass; one Windows symlink test skips when the OS denies symlink creation
• 79.75% measured coverage with a 75% enforced floor
• Ruff check and format check pass
• strict Mypy passes across 38 source files
• deterministic hostile-input corpus passes
• 50,000 generated records stay under a 32 MiB Python-heap ceiling
• wheel and sdist reproduce byte-for-byte under a fixed build epoch
• clean wheel install and full README demonstration pass
• PNG/SVG plotting is explicitly verified on Matplotlib's headless Agg backend
• repository cover matches the supplied image byte-for-byte

Release status

This is intentionally an alpha prerelease. Checksums detect accidental corruption; they do not authenticate authorship. Unit conversion, explicit comparison resampling, signed sessions, and very-large-plot downsampling remain documented limitations.