docs: add the v0.3.0 delivery report

[oratis]

Summary

v0.3.0 的中文交付报告 —— docs/V0.3.0_REPORT.md。覆盖：做了什么、拒绝了什么、与计划哪里不符、发布踩了哪五个坑。

纯文档 PR。

为什么单独写一份，而不是只留 CHANGELOG

CHANGELOG 回答"变了什么"，这份回答"为什么这么定，以及哪里没做到"。三块内容是它存在的理由：

§2 三个关键设计决定 —— 评审时最值得看的部分，因为它们决定了这层机制是"真的收紧"还是"看起来收紧"：

1. 单向取严：no-match 永不获胜，所以没有契约文件时结果精确等于改造前，不是约等于。16 格合成表逐格枚举而非抽样。
2. 契约 deny 不可被 bypassPermissions 豁免 —— 本轮唯一刻意的不对称，也最值得争论。deny 是关于路径的常驻陈述，不是提示；让"跳过提示的模式"能清掉它，等于让契约最强的一句话同时最容易被关掉。
3. 契约是策略不是边界 —— Bash 明确不在静态裁决范围内。代码里做了三件事而不只是文档写一句：四处告警、只写契约保持沉默（没必要的告警只会训练用户忽略告警）、security-model.md 明确要求维护者别把它宣传成"秘密防护"。

§4 与计划不符 —— 六条偏差，其中两条是计划本身写错了（PR 0 的"静默放行"前提、四客户端一致性测试的可验证范围）。未做的三项也直接列出。

§6 发布五次失败的根因 —— v0.3.0 是本仓库有史以来第一个 tag，release.yml 从未跑过。两条单独记了教训：

• Node sidecar 哈希：修的是固定值，不是放宽校验。committed 哈希能防住 nodejs.org 被攻陷，构建时抓 SHASUMS256 防不住——前提是哈希得对。经两条独立途径确认（官方 manifest + 本地下载 24.7 MB 重算）。
• 浅克隆导致 release body 显示 "0 commits."：发布前我在本地跑过 gen-release-notes.ts 且输出正常，因为本地有完整历史。"我测过这个脚本"恰恰是抓不到这个 bug 的那种检查。

一处数字更正

测试总数按全量八个套件统计为 1177 → 1415（+238）。此前几个 PR 描述里写的 1414 少算了根 scripts 套件，报告用的是正确口径。

Test plan

• node scripts/check-docs.mjs
• pnpm format:check
• 报告内引用的 PR 号、commit、文件路径逐个核对
• 测试总数重新实跑统计确认

Documentation

• 新增 docs/V0.3.0_REPORT.md
• README.md 文档地图加入条目

Release notes label

• release-notes:internal

Related

收尾 #235–#250。详细决策记录见 docs/FLOATBOAT_ADOPTION_PLAN.md，调研见 docs/research/floatboat.md。

🤖 Generated with Claude Code

[oratis]

Review — approve, no changes

Docs only (README.md + docs/V0.3.0_REPORT.md), no code paths touched, docs:check and the link check pass.

Worth merging for §4 and §6 specifically. A report that only lists what shipped is a press release; the parts that earn this one its own file are the ones a CHANGELOG structurally cannot hold:

• §4 recording that the plan itself was wrong in two places, not just that the implementation diverged. That is the harder thing to write down and the more useful thing to have later.
• §6's shallow-clone root cause. "I ran gen-release-notes.ts locally and the output was fine, because locally I had full history" is precisely the check that could not have caught it — and naming that class of verification failure is more valuable than naming the bug. fix(release): take the release body from the CHANGELOG #255 is the follow-up.
• The sidecar hash note being explicit that the fix was a corrected constant, not a relaxed check. Those two look identical in a diff summary and are opposite in effect. Confirming it through two independent routes is the right standard.

§2's three design decisions are the right things to have argued in public, particularly contract deny not being waivable by bypassPermissions — an asymmetry worth defending in writing, since the next person to meet it will assume it is a bug.

One consequence worth noting: this documents 0.3.0 as published under @deepcode/cli, which #253 establishes was never possible. As a record of what was believed at the time that is correct and should stay; if you want, a one-line pointer to #253 would save a future reader the confusion.