Merge release/2 for the 2.0.0 release

833 commits of 2.0 work: the unified processor model, entity/context/connector
intentions as grammar, instance identity (Id/self/initiate/terminate), typed
holes, correlations, numeric literals, `empty`, `forward`, multi-line `do`,
303+ named diagnostic rule ids, the `find` command, JSON as a fourth fully
reflective surface, and Scala 3.9.0.

Tagged from main per policy: a FINAL release ships from main, never from the
release branch.

Author: reid-spencer

.claude/skills/rc/SKILL.md

@@ -17,26 +17,32 @@ not provided:
 
 ## Pre-Flight Checks
 
-1. **Always ship from `main`; bring it up to date with
-   `development` first.** **We NEVER publish from
-   `development` or feature branches.** The release commits
-   normally live on `development`, so the standard process is
-   to fast-forward `main` up to `development` before tagging.
-   This is part of every release — do NOT ask the user whether
-   to do it:
+1. **Always ship a FINAL release from `main`.** Ordinary work commits
+   directly to `main`, so in the usual case there is nothing to bring
+   forward and you are already where you need to be:
    ```
    git checkout main
    git pull origin main
-   git merge --ff-only development
+   git branch --show-current
    ```
-   - If `--ff-only` fails because `main` has commits not on
-     `development` (genuine divergence), STOP and ask the user
-     how to reconcile before proceeding. A clean fast-forward
-     is the expected case.
-   - Confirm you ended up on `main`:
-     ```
-     git branch --show-current
-     ```
+   **There is no `development` branch.** It was deleted (local and
+   remote) on 2026-08-27, having been 0 commits ahead of `main`; the
+   GitFlow pre-flight this step used to prescribe — fast-forwarding
+   `main` up to `development` — was a no-op or contrary to policy for
+   every release from 1.30.0 onward, and was skipped by hand each time.
+   See `CLAUDE.md` § Branch Strategy.
+
+   **When the release IS on a branch**, which is the case for a large
+   change such as `release/2`, merge that branch into `main` and tag
+   `main`. Do not tag the branch:
+   ```
+   git checkout main && git pull origin main
+   git merge --no-ff release/2
+   ```
+   Release CANDIDATES are the documented exception and may be tagged on
+   the release branch — an RC is a prerelease on GitHub, an `@rc` formula
+   in the tap and an `rc` dist-tag on npm, so nothing resolves to it
+   unless asked for by name. See the `/rc` skill.
 
 2. Assert working tree is clean:
    ```
@@ -88,8 +94,35 @@ not provided:
 
 9. Run the full test suite and publish all modules:
    ```
-   sbt clean test publish
+   sbt "; clean; tJVM; tJS; tNative; publish"
    ```
+   **NEVER `sbt clean test publish`.** That was prescribed here until
+   2026-08-27 and it is a gate that can skip most of the suite while
+   reporting success. In sbt 2 bare `test` resolves to **`testQuick`**,
+   which skips suites it judges unaffected — and **that judgement
+   survives `clean`, because the action cache does**. It once left the
+   JS row of a GREEN run executing 109 of 567 tests, with `languageJS`,
+   `passesJS` and `testkitJS` never running at all. `tJVM`/`tJS`/`tNative`
+   exist precisely to defeat this: they are `testOnly *`, which ignores
+   incremental state. See the alias comments in `build.sbt`.
+
+   **Count what ran.** One `Suites: completed N` line per module in each
+   alias, and zero `No tests to run`. A short count means a module was
+   skipped or the `;` chain aborted at a failure — either way, look.
+
+   **For a MAJOR release, certify from a genuinely cold cache first**
+   (Reid, 2026-08-27, shipping 2.0.0). `clean` removes `target/` but NOT
+   the shared store at `~/.cache/sbt/v2` (or `~/Library/Caches/sbt/v2`),
+   so results can still be replayed:
+   ```
+   sbt -batch shutdown                       # a warm server IGNORES the -D
+   sbt --server -Dsbt.global.localcache=/tmp/sbt-verify-<ver> -batch "; clean; tJVM; tJS; tNative"
+   ```
+   The property applies only at **server boot**, so the shutdown is not
+   optional. Afterwards the throwaway directory must EXIST and have GROWN
+   (`du -sh`) — an empty one means the run was served from the shared cache
+   and certified nothing.
+
    Because the tag is on HEAD and the tree is clean,
    BuildInfo and all published artifacts will carry the
    clean `<VERSION>`. Verify in the sbt output.
@@ -164,18 +197,33 @@ not provided:
     - Commit them: `git add -u && git commit -m "Fix copyright headers"`
     - Push: `git push origin main`
     These changes are harmless formatting fixes and should be
-    committed before merging back to `development`.
+    committed straight to `main`.
 
-14. Switch back to `development` and merge the tag forward:
+14. **Delete the release branch, if the release came from one.**
+    There is no merge-back step: `main` IS the working branch, so
+    there is nowhere to merge the tag forward TO. This step used to
+    say `git checkout development && git merge main`, which since
+    1.30.0 has been either a no-op or contrary to policy.
     ```
-    git checkout development
-    git merge main
-    git push
+    git branch -d <release-branch>
+    git push origin --delete <release-branch>
     ```
 
 15. Report a summary: tag, commit SHA, release URL, and any
     CI workflows triggered.
 
+16. **Drop upgrade tasks in dependent projects.** Invoke
+    `/ossuminc-skills:bump-consumers` with library `riddl` and the
+    version just released. That skill owns the consumer list
+    (`skills/bump-consumers/consumers.md`) and the task-file format —
+    do **not** maintain a repo list here. riddl has more consumers
+    than any other library (Scala via `project/Dependencies.scala`;
+    npm via `@ossuminc/riddl-lib` in `package.json`), so let the skill
+    apply its usual restraint: it asks before writing and proposes
+    skipping patch releases rather than filing a task in every
+    consumer for a bugfix. Requires the `ossuminc-skills` plugin
+    installed (`claude plugin list | grep ossuminc-skills`).
+
 ## If Something Fails
 
 - If tests fail in step 9: delete the local tag

.claude/skills/ship/SKILL.md

@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set Up JDK 25
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: '25'
           distribution: temurin
@@ -31,12 +31,12 @@ jobs:
         uses: sbt/setup-sbt@7e33f738678e47369c83dcb4b1d9c65d66eb3cdd # v1
 
       - name: Coursier Caching
-        uses: coursier/cache-action@2addd381bd2c931f42d4b734b9d0c9b73aac16fb # v6
+        uses: coursier/cache-action@v7
 
       - name: Configure sbt GitHub Packages credentials
         run: |
-          mkdir -p ~/.sbt/1.0
-          cat > ~/.sbt/1.0/github.sbt << 'EOF'
+          mkdir -p ~/.sbt/2
+          cat > ~/.sbt/2/github.sbt << 'EOF'
           credentials += Credentials(
             "GitHub Package Registry",
             "maven.pkg.github.com",
@@ -47,18 +47,12 @@ jobs:
 
       - name: Coverage For JVM projects only
         run: |
-          sbt clean coverage \
-            utils/Test/compile language/Test/compile passes/Test/compile \
-            commands/Test/compile riddlc/Test/compile \
-            utils/test language/test passes/test commands/test riddlc/test \
-            coverageAggregate coveralls
+          sbt "; clean; coverage; utils/Test/compile; language/Test/compile; passes/Test/compile; commands/Test/compile; riddlc/Test/compile; utils/test; language/test; passes/test; commands/test; riddlc/test; coverageAggregate"
 
       - name: Coverage Results Collection
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: code-coverage-report
           retention-days: 30
           path: |
-            **/jvm/target/scala-3.8.3/scoverage-report/scoverage.xml
-            **/target/scala-3.8.3/scoverage-report/scoverage.xml
-            target/scala-3.8.3/scoverage-report/scoverage.xml
+            target/out/jvm/scala-3.9.0/**/scoverage-report/scoverage.xml

.github/workflows/coverage.yml

@@ -37,16 +37,16 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup Pages
-        uses: actions/configure-pages@v4
+        uses: actions/configure-pages@v6
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: ./doc/redirect-site
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/hugo.yml

@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up JDK 25
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           java-version: '25'
           distribution: temurin
@@ -39,12 +39,12 @@ jobs:
         uses: sbt/setup-sbt@v1
 
       - name: Coursier Caching
-        uses: coursier/cache-action@v6
+        uses: coursier/cache-action@v7
 
       - name: Configure sbt GitHub Packages credentials
         run: |
-          mkdir -p ~/.sbt/1.0
-          cat > ~/.sbt/1.0/github.sbt << 'EOF'
+          mkdir -p ~/.sbt/2
+          cat > ~/.sbt/2/github.sbt << 'EOF'
           credentials += Credentials(
             "GitHub Package Registry",
             "maven.pkg.github.com",
@@ -54,7 +54,7 @@ jobs:
           EOF
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '22'
 

.github/workflows/npm-publish.yml

@@ -31,12 +31,14 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
     - name: Checkout Code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ github.event.release.tag_name || github.event.inputs.tag }}
+        fetch-depth: 0
+        fetch-tags: true
 
     - name: Set Up JDK 25
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5
       with:
         java-version: '25'
         distribution: temurin
@@ -46,12 +48,12 @@ jobs:
       uses: sbt/setup-sbt@7e33f738678e47369c83dcb4b1d9c65d66eb3cdd # v1
 
     - name: Coursier Caching
-      uses: coursier/cache-action@2addd381bd2c931f42d4b734b9d0c9b73aac16fb # v6
+      uses: coursier/cache-action@v7
 
     - name: Configure sbt GitHub Packages credentials
       run: |
-        mkdir -p ~/.sbt/1.0
-        cat > ~/.sbt/1.0/github.sbt << 'CREDSEOF'
+        mkdir -p ~/.sbt/2
+        cat > ~/.sbt/2/github.sbt << 'CREDSEOF'
         credentials += Credentials(
           "GitHub Package Registry",
           "maven.pkg.github.com",
@@ -77,7 +79,7 @@ jobs:
     - name: Package Native Binary
       run: |
         mkdir -p staging/bin
-        cp riddlc/native/target/scala-3.8.3/riddlc staging/bin/riddlc
+        cp target/out/native0.5/scala-3.9.0/riddlc/riddlc staging/bin/riddlc
         cd staging && zip -r ../${{ matrix.artifact }}.zip bin/
 
     - name: Upload to Release
@@ -88,7 +90,7 @@ jobs:
         gh release upload "$TAG" "${{ matrix.artifact }}.zip" --clobber
 
     - name: Upload Build Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: ${{ matrix.artifact }}
         retention-days: 30
@@ -105,12 +107,14 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
     - name: Checkout Code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         ref: ${{ github.event.release.tag_name || github.event.inputs.tag }}
+        fetch-depth: 0
+        fetch-tags: true
 
     - name: Set Up JDK 25
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@v5
       with:
         java-version: '25'
         distribution: temurin
@@ -120,12 +124,12 @@ jobs:
       uses: sbt/setup-sbt@7e33f738678e47369c83dcb4b1d9c65d66eb3cdd # v1
 
     - name: Coursier Caching
-      uses: coursier/cache-action@2addd381bd2c931f42d4b734b9d0c9b73aac16fb # v6
+      uses: coursier/cache-action@v7
 
     - name: Configure sbt GitHub Packages credentials
       run: |
-        mkdir -p ~/.sbt/1.0
-        cat > ~/.sbt/1.0/github.sbt << 'CREDSEOF'
+        mkdir -p ~/.sbt/2
+        cat > ~/.sbt/2/github.sbt << 'CREDSEOF'
         credentials += Credentials(
           "GitHub Package Registry",
           "maven.pkg.github.com",
@@ -137,7 +141,7 @@ jobs:
     - name: Build and Stage JVM Version
       run: |
         sbt riddlc/stage
-        cd riddlc/jvm/target/universal/stage && zip -r ../../../../../riddlc.zip bin/ lib/
+        cd target/out/jvm/scala-3.9.0/riddlc/universal/stage && zip -r "$GITHUB_WORKSPACE/riddlc.zip" bin/ lib/
 
     - name: Upload to Release
       env:
@@ -147,7 +151,7 @@ jobs:
         gh release upload "$TAG" riddlc.zip --clobber
 
     - name: Upload Build Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: riddlc-jvm
         retention-days: 30
@@ -160,7 +164,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Download all artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v6
       with:
         path: artifacts
 
@@ -171,21 +175,44 @@ jobs:
         echo "linux_x86=$(shasum -a 256 artifacts/riddlc-linux-x86_64/riddlc-linux-x86_64.zip | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
         echo "jvm=$(shasum -a 256 artifacts/riddlc-jvm/riddlc.zip | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
 
+    # A release candidate updates a SEPARATE formula. `gh release create --prerelease`
+    # still fires this same `release: [created]` workflow, so without routing on
+    # `prerelease` an RC would overwrite the stable formula and `brew install riddlc`
+    # would serve a release candidate. Homebrew has no prerelease flag and its `devel`
+    # block is deprecated; a versioned formula the user opts into by NAME is the
+    # supported pattern, and the name is the "experimental" marking.
     - name: Dispatch formula update to homebrew-tap
       env:
         GH_TOKEN: ${{ secrets.HOMEBREW_TAP_SECRET }}
       run: |
         TAG="${{ github.event.release.tag_name || github.event.inputs.tag }}"
+        if [ "${{ github.event.release.prerelease }}" = "true" ]; then
+          FORMULA="riddlc-rc"
+        else
+          FORMULA="riddlc"
+        fi
+        echo "Dispatching formula update for ${FORMULA} at ${TAG}"
         gh api repos/ossuminc/homebrew-tap/dispatches \
           --method POST \
           -f event_type=update-formula \
+          -f "client_payload[formula]=${FORMULA}" \
           -f "client_payload[version]=${TAG}" \
           -f "client_payload[sha_macos_arm64]=${{ steps.hashes.outputs.macos_arm64 }}" \
           -f "client_payload[sha_linux_x86]=${{ steps.hashes.outputs.linux_x86 }}" \
           -f "client_payload[sha_jvm]=${{ steps.hashes.outputs.jvm }}"
 
-  # Notify ossum.ai to create a blog post from release notes
+  # Notify ossum.ai to create a blog post from release notes.
+  #
+  # FULL RELEASES ONLY. Every other channel makes a release candidate opt-in by
+  # name -- a prerelease on GitHub, an `rc` npm dist-tag, a separate `riddlc-rc`
+  # formula -- but a blog post announces itself to everyone. 2.0.0-rc.1 shipped a
+  # live post on ossum.ai because this job, unlike `update-homebrew` below, had no
+  # prerelease guard.
+  #
+  # `workflow_dispatch` leaves `release.prerelease` empty, so a manual run still
+  # posts; that is deliberate, since dispatching by hand is an explicit act.
   notify-blog:
+    if: github.event.release.prerelease != true
     needs: [native-build, jvm-build]
     timeout-minutes: 10
     runs-on: ubuntu-latest