feat(release): assemble notes from independent change fragments

.changes/README.md

@@ -0,0 +1,34 @@
+# Release notes
+
+Add one uniquely named Markdown file per user-visible change, for example
+`.changes/20261019-support-timeout.md`:
+
+```md
+## Changes
+
+- Explain the change in English from the user's perspective.
+```
+
+Keep each bullet on one line. Pure test/internal changes need no fragment.
+Feature branches leave `CHANGELOG.md` alone.
+
+Commit fragments first. Run `make release-notes VERSION=X.Y.Z` from the repo
+root to assemble committed fragments and any legacy Unreleased entries into a
+dated changelog section. Review and commit the generated section, the
+`.changes/releases/X.Y.Z.json` receipt and fragment deletions together, then
+create the native `vX.Y.Z` tag. This command never tags or publishes.
+
+Preparation pins HEAD. Uncommitted/newer notes do not enter that release.
+Cleanup removes only files whose content matches the included snapshot;
+modified files remain pending. Receipts prevent duplication after interrupted
+cleanup. Repeating a prepared version only retries its exact cleanup. Keep
+receipts in Git; never edit them manually. If interrupted between the receipt
+and changelog writes, retry restores the exact output when the original changelog
+is intact; inconsistent output blocks cleanup. Cleanup retains private recovery
+copies under `.changes/.recovery/`, including changes written through
+a file handle opened before cleanup. These copies never enter Git. Coordinate
+release preparation through one release operator per checkout.
+The existing tag workflow reads only the version section committed at the tag,
+so publication retries keep the same notes.
+
+`make check-release-notes` validates working fragments without consuming them.

.changes/legacy-001.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Wait for the rendered support inventory before list and detail reads, and avoid false contract drift from frontend bundle filenames.

.changes/legacy-002.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add stable CloudVPS backup status output and verify enable or disable postconditions without replaying ambiguous mutations.

.changes/legacy-003.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Silently reconcile browser and CLI-egress public IPv4 addresses with the REG.API allowlist after portal login and refresh, with redacted non-blocking failure warnings.

.changes/legacy-004.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Show the authenticated REG.RU provider login separately from the local profile alias in human, JSON, and plain auth status output.

.changes/legacy-005.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Reconcile interrupted support mutations with independent reads and wait for rendered ticket history before returning details.

.changes/legacy-006.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Enable experimental browser-backed support ticket list, detail, create, reply, and close operations with typed drift probes and one-attempt mutation reconciliation.

.changes/legacy-007.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Preserve REG.Cloud S3 service and bucket sizes as provider-supplied strings in inventory output.

.changes/legacy-008.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Keep interactive portal login alive when REG.RU navigates the staged browser during authentication.

.changes/legacy-009.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Scaffold the `regru` Go CLI with stable output, error, safety, authentication, timeout, completion, and capability-placeholder contracts.

.changes/legacy-010.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add provider-neutral multi-account profiles, strict user/project TOML boundaries, redacted account and capability commands, and lazy external credential-process helpers.

.changes/legacy-011.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add isolated browser-backed portal login, refresh, status, logout, principal binding, and typed in-browser BFF/GraphQL execution.

.changes/legacy-012.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add typed CloudVPS v1/v2 clients and VPS, action, IP/PTR, SSH-key, snapshot, backup, plan, and image commands with safe mutation waiting.

.changes/legacy-013.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add REG.RU S3 service, bucket, configuration, quota, privacy, and key-set commands with split portal/S3 adapters, in-memory credentials, drift probes, and read-after-write reconciliation.

.changes/legacy-014.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add source-discriminated REG.API and CloudVPS billing reads, invoice status and mutations, exact-decimal finance models, and fail-closed private checkout gates.

.changes/legacy-015.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add value-redacted portal invoice enrichment and a confirmed, non-shareable visible-browser checkout handoff while keeping unavailable bill-specific method enumeration gated.

.changes/legacy-016.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add a typed experimental support command boundary with deferred message input, redacted dry runs, and precise fail-closed reasons for every uncaptured private ticket capability.

.changes/legacy-017.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add install, configuration, architecture, and capability documentation plus reproducible local checks, secret-scanning CI, cross-platform builds, and changelog-backed GitHub releases.

.changes/legacy-018.md

@@ -0,0 +1,3 @@
+## Changes
+
+- Add bounded, provider-facing capability probes with partial redacted results and stable reasons for missing credentials, authentication loss, contract drift, and unavailable adapters.

.gitignore

@@ -1,2 +1,5 @@
 /bin/
 /dist/
+
+# Local fragment recovery, on the fragment filesystem for atomic rename.
+.changes/.recovery/

AGENTS.md

@@ -2,3 +2,6 @@
 
 - The `regru` CLI must follow the `$create-cli` skill when designing, implementing, reviewing, or documenting its command-line interface.
 - Treat `.agents/skills/create-cli/SKILL.md` and its references as the canonical guidance for commands, arguments, flags, help, output, errors, exit codes, prompts, safety, configuration, signals, and scriptability.
+
+- User-visible changes add one uniquely named `.changes/*.md` fragment with `## Changes` and English one-line bullets. Internal/test-only changes need none. Never edit shared pending changelog entries on feature branches.
+- Release preparation uses `make release-notes VERSION=X.Y.Z`; commit generated CHANGELOG.md, release receipts and consumed fragments before creating the native vX.Y.Z tag. See `.changes/README.md`.

CHANGELOG.md

@@ -1,22 +1,3 @@
 # Changelog
 
 ## Unreleased
-
-- Wait for the rendered support inventory before list and detail reads, and avoid false contract drift from frontend bundle filenames.
-- Add stable CloudVPS backup status output and verify enable or disable postconditions without replaying ambiguous mutations.
-- Silently reconcile browser and CLI-egress public IPv4 addresses with the REG.API allowlist after portal login and refresh, with redacted non-blocking failure warnings.
-- Show the authenticated REG.RU provider login separately from the local profile alias in human, JSON, and plain auth status output.
-- Reconcile interrupted support mutations with independent reads and wait for rendered ticket history before returning details.
-- Enable experimental browser-backed support ticket list, detail, create, reply, and close operations with typed drift probes and one-attempt mutation reconciliation.
-- Preserve REG.Cloud S3 service and bucket sizes as provider-supplied strings in inventory output.
-- Keep interactive portal login alive when REG.RU navigates the staged browser during authentication.
-- Scaffold the `regru` Go CLI with stable output, error, safety, authentication, timeout, completion, and capability-placeholder contracts.
-- Add provider-neutral multi-account profiles, strict user/project TOML boundaries, redacted account and capability commands, and lazy external credential-process helpers.
-- Add isolated browser-backed portal login, refresh, status, logout, principal binding, and typed in-browser BFF/GraphQL execution.
-- Add typed CloudVPS v1/v2 clients and VPS, action, IP/PTR, SSH-key, snapshot, backup, plan, and image commands with safe mutation waiting.
-- Add REG.RU S3 service, bucket, configuration, quota, privacy, and key-set commands with split portal/S3 adapters, in-memory credentials, drift probes, and read-after-write reconciliation.
-- Add source-discriminated REG.API and CloudVPS billing reads, invoice status and mutations, exact-decimal finance models, and fail-closed private checkout gates.
-- Add value-redacted portal invoice enrichment and a confirmed, non-shareable visible-browser checkout handoff while keeping unavailable bill-specific method enumeration gated.
-- Add a typed experimental support command boundary with deferred message input, redacted dry runs, and precise fail-closed reasons for every uncaptured private ticket capability.
-- Add install, configuration, architecture, and capability documentation plus reproducible local checks, secret-scanning CI, cross-platform builds, and changelog-backed GitHub releases.
-- Add bounded, provider-facing capability probes with partial redacted results and stable reasons for missing credentials, authentication loss, contract drift, and unavailable adapters.

Makefile

@@ -7,7 +7,7 @@ COMMIT ?= $(shell git rev-parse --short=12 HEAD 2>/dev/null || printf '%s' none)
 BUILD_DATE ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
 LDFLAGS := -s -w -X github.com/adinvadim/reg-ru-cli/internal/version.Version=$(VERSION) -X github.com/adinvadim/reg-ru-cli/internal/version.Commit=$(COMMIT) -X github.com/adinvadim/reg-ru-cli/internal/version.Date=$(BUILD_DATE)
 
-.PHONY: build check dist fmt test test-race vet
+.PHONY: build check dist fmt test test-race vet release-notes check-release-notes
 
 build:
 	mkdir -p bin
@@ -30,7 +30,7 @@ test:
 test-race:
 	$(GO) test -race ./...
 
-check: fmt vet test test-race
+check: fmt vet test test-race check-release-notes
 
 dist:
 	mkdir -p dist
@@ -48,3 +48,9 @@ dist:
 	else \
 		shasum -a 256 regru_$(VERSION)_* > checksums.txt; \
 	fi
+
+check-release-notes:
+	$(GO) run ./scripts/prepare-release --check
+
+release-notes:
+	$(GO) run ./scripts/prepare-release "$(VERSION)"

README.md

@@ -164,9 +164,15 @@ bash|zsh|fish|powershell`.
 
 ## Development and releases
 
-`make check` runs formatting verification, vetting, unit tests, and the race
-detector. CI additionally scans the repository for secrets and cross-compiles
+`make check` runs formatting verification, vetting, unit tests, the race
+detector, and read-only release-fragment validation. CI additionally scans the repository for secrets and cross-compiles
 every release target. Release tags matching `v*` must have a corresponding
 `## X.Y.Z - YYYY-MM-DD` section in `CHANGELOG.md`; the release workflow uses
 that section verbatim as the GitHub release notes and uploads the binaries and
 checksums.
+
+User-visible changes add independent [release fragments](.changes/README.md).
+Before tagging, commit the fragments, run `make release-notes VERSION=X.Y.Z`,
+review and commit the generated changelog, receipt, and fragment deletions,
+then create the existing `vX.Y.Z` release tag. The tag workflow still extracts
+its frozen version section; preparation does not publish or tag anything.