1.24.0 — four defects that were only ever wrong on one platform, and how to check the claims yourself

[ArcticFox2029]

1.24.0 went out today. Four of the defects in it were only ever wrong on Windows, and one only on
Python 3.8 through 3.12 — none of them errored anywhere, and CI had been green on all five jobs for
months while two of them were live.

The shape was the same every time: a rule that held on the machine it was written on.

• A symlink escape guard compared a resolved path against an unresolved one. On POSIX getcwd() is
  canonical so both sides always agreed; Windows returns the string the process was started with.
  The guard was not weaker there. It was absent.
• The commit hook had never refreshed an agent file on Windows. Python writes CR LF, read -r keeps
  the CR, and the name that came back was not a name the tool accepts. Silent on every commit.
• The PATH instruction printed export PATH="…:$PATH" to every operating system, and the test
  asserted that bash spelling — on Windows too.
• Path.resolve() raises on a symlink loop before 3.13 and returns a path from 3.13 on, so a walk
  that caught the exception reported the same tree honestly on one interpreter and silently
  truncated on the others.

What I would rather you did than take my word for it. From a clean clone:

git clone https://github.com/ArcticFox2029/chamnan && cd chamnan
python3 tools/verify_release.py

No network, no dependencies, no key. It re-runs the whole suite and the index-claim check and
prints what happened on your machine, and it refuses to report a result if the suite's totals line
is missing — a run that dies mid-way prints no failures at all, so the absence of failures is not
the proof.

An offer, and I mean it literally. If your repository is a shape chamnan handles badly — a
language it reads poorly, a layout that makes the index useless, a monorepo where the wrong subtree
gets indexed — post the repo here and I will measure it and reply with the numbers, good or bad.
site/remeasure.py runs a public repository through the real modules in a couple of minutes, and
the rows that came back worse than the previous release are in the demo page's table with the
figures that made them worse.

The full notes are in CHANGELOG.md,
and INDEX_CITED_IN_CODE.md is attached to the release: every defect recorded in the source, linked
to the commit that fixed it and the research round that found it.