Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Unreleased

Added

• CI now statically analyzes its own workflow files (#928) — A new Workflow Lint workflow runs zizmor (template injection, dangerous triggers, cache poisoning, excessive permissions, persisted credentials, unpinned actions, and online checks for known-vulnerable or impostor action commits) and actionlint (syntax, expression types, shellcheck over every run: script) on every change to .github/workflows/ and weekly, failing on any finding; make lint-workflows runs the same checks locally. zizmor is installed from a hash-pinned .github/requirements/zizmor.txt and actionlint is pinned in ci-tools/go.mod, both bumped by Dependabot. Wiring it in fixed the four findings it raised on main: lychee.yml interpolated the github.event.repository.name context and a step output straight into run: scripts (now runner env vars), auto-update-branches.yml minted a GitHub App token carrying the app's whole installation grant (now scoped to contents: write and pull-requests: read), and release.yml left the checkout token in .git/config for every later step of the signing job (now persist-credentials: false). No GLX code changed.

• Research logs track competing hypotheses as leads (#660, #183) — ResearchLog gains a leads list, folding #660's proposed Research entity into the existing ResearchLog instead of adding a new entity type. Each lead records a description, candidate persons, a status (active / eliminated / confirmed, from the new standard lead-statuses.glx vocabulary), free-text evidence_for / evidence_against, optional citations and assertions refs, next_steps, and notes. Leads track research alternatives: a lead has no confidence of its own (confidence stays on the assertions that model it), and resolving a lead never changes the assertions it references. The spec gives Search and ResearchLead their own sections in research-log.md. Validation checks every ref and vocabulary value, and glx rename, three-way merge, the JSON schema, and the spec all cover the new field. glx query research_logs accepts --subject (matching the log's subject or a lead's candidate person, by ID or name) and --status, and glx summary gains a Research section listing the person's logs with objective, status, planned not_searched searches, and open leads with their recorded statuses. The complete-family example adds a brick-wall log with two leads. Archives created before this change need vocabularies/lead-statuses.glx (copy it from specification/5-standard-vocabularies/) before giving a lead a status; glx init writes it for new archives.

• glx publish now maps the archive's located places — The place index opens with a map of every place the archive records coordinates for: one marker per place, sized by how many events happened there (square-root scale, so a parish with 100 events does not swamp one with four), over a graticule of round latitude/longitude lines labelled in degrees. Selecting a marker jumps to that place's row in the table below, which keeps its existing OpenStreetMap link, and each marker's tooltip names the full hierarchical place and its event count. Like the family charts and the timeline strip this is inline SVG generated at publish time: no tile server, no map library, no network request at view time — the map works from a USB stick, under file://, and in a PDF, which a tile-backed map cannot do, and it leaks nothing about who is reading the site to a third party. The view is fitted to the places themselves rather than to a fixed world projection: the bounding box is padded by 12%, widened to at least a quarter-degree so a cluster of same-parish coordinates is not magnified into a street map, and then stretched on one axis to match the plot's shape, with longitude scaled by the cosine of the middle latitude so the projection stays undistorted at any latitude. Grid lines use the smallest of 0.05°/0.1°/0.25°/…/45° that keeps six lines per axis, labelled with the hemisphere letter and only as many decimals as the step needs (the equator and the prime meridian get neither letter). Up to 14 markers carry their place name, given in event-count order and skipped where the text would collide with a label already placed, so a dense cluster stays readable. Fewer than two located places produces no map at all, since a single point positions nothing the coordinates themselves do not. placeRow now carries the coordinates it previously only used to build the OpenStreetMap link. Third and last of the follow-ups PR #970 left open on the static viewer. Closes #91

• glx publish profiles now plot the life timeline to scale — Above the chronological list on each person page sits a proportional timeline strip: a bar spanning the person's first to last dated event, one dot per dated event positioned by year, and an axis labelled in round years. Long gaps now read as gaps — a decade with no records looks like one, where the list gave every row equal height. Like the family charts it is inline SVG generated at publish time (no JavaScript, no chart library, no network request), scales to the page width, and takes its colors from the site's theme variables. Each dot carries the full event as an SVG <title>, so hovering names the date, event, and place, and the chronological list stays exactly as it was underneath — the strip is an overview, not a replacement, and undated events continue to appear only in the list. Axis labels are chosen so they cannot collide: the step is the smallest of 1/2/5/10/20/25/50/100/…/2000 years that keeps the label count within six, the span's own endpoints are always labelled, and an interior label that would sit closer than 40 units to its neighbour is dropped rather than drawn overlapping. Years before the common era render as "44 BCE", matching the rest of the site. A person whose dated events fall in a single year (or who has none) gets no strip, since a proportional view of a single point says nothing the list does not. Timeline rows now also carry the event's parsed year, and eventYear shares the year-display helper rather than repeating the BCE formatting. Second of the three follow-ups PR #970 left open on the static viewer. (#91)

• Head-only census households: tally rows and counted-but-unnamed members — Census events gain an optional household.tally, one row per tick-mark column (sex, inclusive age_from/age_to, count, free-text status such as free white or engaged in agriculture), so a 1790–1840 style schedule is recorded as enumerated instead of in a note. A person the researcher identifies with a tick mark is attached with the new event role household_member and the new participant property named: false; a new relationship_to_head participant property records the 1880+ column. Such a person counts as found in that census, so glx analyze no longer suggests searching it for the wife and children of a head-only household and glx coverage ticks the row. Validation checks counts and bracket bounds (errors) and warns on empty rows, unknown sex, more unnamed participants than the tally holds, and a tally on a non-census event; bracket bounds are not yet checked against each census's column headings. glx census add templates accept household.tally and named: false members (who get only a low-confidence residence assertion). (#1332)

• Census page neighbors on census events — Census events gain an optional neighbors list (name and/or person reference, position such as previous_household, page, line, notes) for FAN research; a person must exist. glx census add accepts household.neighbors, and glx cluster scores a neighbor linked to a person as a census_neighbor link (2 points), in both directions. (#180)

• glx households — Reconstructs census households: for a person, every census event they appear in, members listed head first and then by age (from age_at_event), with relationship to head, unnamed tick-mark members marked, and the household tally; --place (with descendant places) and --year list every household enumerated there; --neighbors adds page neighbors; --format json for tooling. (#119)

• glx add research-log, glx add search and glx add study — Research logs and studies can now be written from the CLI instead of by hand in YAML. add research-log creates a log (--subject-person/--subject-event/--subject-relationship/--subject-place, --objective, --status, --title, --date, --researcher, --conclusions, --citation); add search --log <id> appends one search entry (--source, --repository, --collection, --query, --result, --citation, --date, --note) to an existing log, rewriting only the file that holds the log and keeping its existing formatting, and rolls a --citation up into the log's citations list; add study creates a study (--title, --type, --status, --date-range, repeatable --place/--source). Status, result and type values are checked against the archive's loaded vocabularies, so archive-defined values are accepted. (#1336)

• More glx add flags for sources, persons and events — glx add source gains --url, --publication-info, --call-number, --source-nature and --information-type (the last two validated against the source_natures and information_types vocabularies); glx add person gains a repeatable --external-id type:value (e.g. wikitree:Little-20642) for the external_ids property; glx add event gains a repeatable --property key=value for any key defined in event_properties. (#1336)

• New standard participant roles — participant-roles.glx adds event roles enumerator, attending_physician, registrar, bondsman, testator, executor, legatee, beneficiary, grantor, grantee and adjoining_owner; guardian/ward for both events and relationships; and relationship roles foster_parent/foster_child and step_parent/step_child. legatee (a will's bequest) and beneficiary (intestate heirs, insurance, trusts) are both standard. Every standard role now declares applies_to explicitly. (#526)

• land_transaction event type — A standard legal event type for deeds, land entries, patents, grants and mortgages, with a documented event_subtype list (deed, patent, grant, entry, mortgage, partition, quitclaim) in event.md. No dedicated GEDCOM tag; intended EVEN + TYPE export remains tracked separately in #1320/#1321. (#1334)

• territory place type — For organised territories and dependencies below country level that are not (or not yet) a state or province, such as Indiana Territory. GEDCOM import infers it from place names containing "Territory"/"Territories". (#1335)

• unavailable and requires_visit search results — unavailable records a source that was sought but does not survive, is restricted or is not accessible; requires_visit one that can only be searched on site or by request. glx proof now labels unavailable searches as a documented gap (with the search's notes), and not_searched/requires_visit as outstanding; its JSON output gains each search's notes. (#1340)

• glx validate warns when a participant role is used outside its applies_to — e.g. subject on a relationship or sibling on an event. It is a warning, not an error, so existing archives still validate. A role that omits applies_to or declares an empty list applies to all contexts, including in JSON schema validation; this is now documented in vocabularies.md. (#499)

• Participant roles can declare implies_presence — A new optional boolean on participant role vocabulary entries says whether a person in that role was at the event's place. glx migrations reads it; without it, built-in defaults apply (grantor, grantee, legatee, heir, beneficiary, executor and similar roles do not imply presence). Schema and spec updated; the standard vocabulary is unchanged (#1330)

• CI: the Go suite now also runs on Windows — validate-spec.yml gains a test-windows job (windows-latest, displayed as "Go tests (Windows)") running go test ./glx/... ./go-glx/... ./tools/.... Until now the Go jobs ran only on ubuntu-latest, so a Windows-only breakage reached contributors rather than CI — which is exactly how the two Unix-only test assumptions in #1272 went unnoticed, leaving the make test run CONTRIBUTING.md asks for permanently red on a Windows checkout. Deliberately a separate job rather than an os matrix on test-conformance: a matrix renames that job's check contexts to test-conformance (ubuntu-latest) and the bare test-conformance is a required context in the Main Protection ruleset, so renaming it would leave the ruleset waiting on a check that never reports and deadlock merges. The job carries the same fail-open changes.outputs.go gate as the other Go jobs, so a docs-only PR does not pay for it — Windows runners bill at 2x Linux minutes — and it allows 30 minutes against test-conformance's 20, since the same suite is appreciably slower there. Scope is narrower on purpose: no coverage profile or Codecov upload (the Linux run owns that, and a second unflagged report for the same commit would not be meaningful) and no -v; the stderr Warning: gate stays Linux-only because it tests a property of the code rather than of the platform. The test step sets shell: bash rather than taking the windows-latest default of pwsh, so a non-zero go test exit fails the step the same way it does elsewhere in the workflow. The new check is not required by the branch ruleset on introduction — adding the Go tests (Windows) context to Main Protection is a manual repository-settings change, and until it is made a Windows-only regression shows as a red check that does not block merging. (#1272)

• glx publish now draws pedigree and descendancy charts on every profile — Each person page gains a "Family charts" section with an "Ancestors" panel (the person, their parents, grandparents, and great-grandparents) and a collapsed "Descendants" panel (the person, their children, and grandchildren). Both are inline SVG generated at publish time — no JavaScript, no chart library, no network request — so they render under file://, survive a print-to-PDF, and inherit the site's light/dark theme from the same CSS custom properties as the rest of the page. Every box other than the subject's own is a link to that person's profile, so a reader can walk the tree by clicking. The walk reuses the parent/child index the site model already builds, so publishing a large archive costs one extra pass per person rather than a re-scan of every relationship. Two limits keep a page from exploding: the generation depth above, and a 60-node budget per chart that stops a prolific family from emitting a megabyte of SVG onto one profile — a chart cut short by the budget says so in its caption. Pedigree collapse (the same ancestor reached through two lines) draws the person in both branches, while a malformed self-ancestor cycle terminates instead of looping, because the cycle guard tracks the current path rather than every person already seen. A person with no recorded relatives in a direction gets no chart in that direction rather than an empty frame. This closes the first of the three follow-ups PR #970 left open on the static viewer. (#91)

• Release archives now ship an SBOM — .goreleaser.yml gains a sboms: stanza that emits one SPDX-JSON software bill of materials per release archive (glx_Linux_x86_64.tar.gz.sbom.json alongside glx_Linux_x86_64.tar.gz), generated by syft, GoReleaser's default SBOM tool. GoReleaser lists each SBOM in checksums.txt alongside the archives, so the SBOMs are covered by both the existing cosign keyless signature and the SLSA build-provenance attestation, which take that manifest as their subject. The syft invocation pins explicit args rather than inheriting GoReleaser's default, to drop --enrich all: enrichment fetches package metadata from online sources at build time, letting a third-party service feed content into an artifact signed inside the privileged release job. Note that the SBOMs are not byte-reproducible regardless — syft's SPDX output embeds a random documentNamespace UUID and a created timestamp — so the .sbom.json lines of checksums.txt differ on every build of the same tag even though the archive lines still reproduce byte-for-byte (#1049); a rebuild-and-compare audit has to compare the archive lines rather than the whole manifest, which SECURITY-POSTURE.md now states as a known limit. release.yml installs syft with a SHA-pinned anchore/sbom-action/download-syft step before the GoReleaser step, since syft is not preinstalled on ubuntu-latest; that pin does not make the step hermetic (the action fetches and executes syft's install.sh from a mutable tag ref at run time), so the posture doc records it as an explicitly accepted risk under Action pinning. Verifying an SBOM is the same flow as verifying an archive (verify checksums.txt, then sha256sum -c); see SECURITY-POSTURE.md. SBOMs first appear on releases cut from the next tag onward — v0.0.0-beta.12 and earlier publish none — and the posture document scopes its claim accordingly. Local make release-snapshot now also needs syft on PATH, and passes --skip=sign so the snapshot build no longer requires cosign or an interactive keyless OIDC prompt (--snapshot implies only --skip=announce,publish,validate). This closes the last remaining OpenSSF OSPS Baseline gap, so the self-attestation in SECURITY-POSTURE.md advances to Level 3 (mature). Closes #269

• Temporal validation: a relationship boundary recorded twice now warns — validateTemporalConsistency() gains a fifth check: a relationship that records the same boundary both as an event reference and as a date property — start_event alongside properties.started_on, or end_event alongside properties.ended_on — now produces a warning, since tooling reads the event and the two copies can drift apart. When the two years differ, the message names both (start_event event-marriage-1875 (1875) and properties.started_on (1880) record different years); when they agree it suggests moving the property's date onto the event first if the property is the more precise of the two, so nothing is lost. Reported as a warning (not an error) so archives mid-migration still validate; boundaries whose event reference is unresolvable (already an error from reference validation) or whose dates have no parseable year are skipped — an event with no usable date of its own is exactly the case where keeping the date property is still informative. The property values are read in every shape the property vocabulary allows (plain string, structured {value, …} object, temporal list). specification/4-entity-types/relationship.md now spells out when to use each form under a "When to use each" section — the previous text said the property need not match the event — with the rule added to its Validation Rules list, the canonical warnings list in specification/3-archive-organization.md, and pointers from the relationship-properties vocabulary docs. The started_on/ended_on properties are unchanged and remain supported. (#546)

• 14 new standard place types, and GEDCOM place-name inference for most of them — specification/5-standard-vocabularies/place-types.glx grows from 16 types to 30. Added as administrative: village (the rural settlement unit European parish registers are organized by — a German Dorf, Polish wieś or Scandinavian by previously had to be typed locality, which is a catch-all and loses the distinction from a hamlet or a neighborhood), hamlet (the rung below it), and reservation (land reserved for an Indigenous nation, common in Native American records). Added as geographic: estate, farm, plantation, and port. Added as institution: workhouse (UK poor law unions), poorhouse (US 19th century), asylum, prison, fort, military_base, and school. The town description no longer claims to cover villages. Archives could always define these as custom types; standardizing them keeps the keys consistent across archives and lets GEDCOM import infer them.

  inferPlaceType() in go-glx/gedcom_place.go now matches keywords for 12 of the new types from a table rather than a chain of ifs, and — the behavior change to be aware of — matches whole words instead of substrings. Substring matching had already made every place named "Estate" a state and every "United States" component a state rather than a country ("state" is a substring of both), and would have made "Farmington" a farm; all three now type correctly. Order within the table puts the more specific institution keywords first, so "Lancaster County Asylum" is an asylum rather than a county, "Devon County Lunatic Hospital" an asylum rather than a hospital, and "Union Poor Farm" a poorhouse rather than a farm. Three of the new types are deliberately not inferred from names — fort, port and hamlet — because those words name far more settlements (Fort Worth, Port Arthur, Hamlet NC) than installations, and a wrong type is worse than the position-derived default; they remain available to set by hand or with glx add place --type. The four example archives under docs/examples/ carry the updated vocabulary. (#540)

• Go SDK: relationship standing helpers — glxlib.NewRelationshipStandingIndex, StandingFromAssertions, AssertionIsHypothetical, AssertionIsDisproven, ParentChildLinks (parent → child edges with step flag and standing) and IsParentSideRole/IsChildSideRole/IsStepRole/IsParentChildRelationshipType give every command one definition of whether a relationship is accepted, hypothetical, or disproven. (#208)

Changed

• The release job always downloads and verifies GoReleaser — goreleaser/goreleaser-action is bumped to v7.3.0, which reuses a GoReleaser binary found in the runner tool cache without re-checking its checksum or cosign signature. release.yml now clears GoReleaser's tool-cache entries right before that step, so a binary planted by the earlier syft installer (an accepted risk in SECURITY-POSTURE.md) cannot build and sign a release unverified. No GLX code changed.

• spouse, parent, child, household_head and boarder now apply to events as well as relationships — GEDCOM import already writes spouse on marriage events and parent/child from ASSO ROLE, baptism entries name parents, and a census names its head and boarders, so these roles' applies_to now include event and the new applies_to warning does not fire on them. (#499)

• glx stats shows direct and evidence coverage — The single "Entity coverage (referenced by assertions)" block counted only assertion subjects, so an archive following the evidence-first model (facts asserted on events) read 0% persons and places. It is now two blocks: "Direct assertion references" (the old metric) and "Evidence coverage", where a person is covered through an asserted event or relationship they take part in or a participant assertion naming them, and a place through an asserted event held there, an assertion value naming it, or a covered place it contains. glx serve's overview uses the evidence view, matching its "Evidence coverage" heading (#713)

• Source builds identify their commit in glx --version — a binary built with plain go build or go install, which injects no version, reported only glx version dev. It now falls back to the build information Go stamps into every binary: glx version dev (ea402a5, 2026-10-01T14:46:10Z) for a checkout (-dirty appended to the hash when it had uncommitted changes), and the module version for go install ...@<tag> or @main. Release builds (GoReleaser) and make build-cli VERSION=... print what they did before. (#1337)

• README command lists and the glx init archive README caught up with the CLI — the root README's CLI Commands section now lists add, cache, evidence, merge-persons, migrations, proof, publish and serve, links each entry to its docs/cli/ page, and a test fails when a visible top-level command is missing from it or from docs/cli/index.md. The install instructions add go install ...@main for unreleased changes. The README.md that glx init writes now describes research_logs/ and studies/ and their ID prefixes, and gives the relationship prefix as relationship- (it said rel-). (#1339)

• Census suggestions are no longer guessed for archives that name no country — #1289 tied census suggestions to the country a person's places name, but kept the previous US federal schedule as a fallback for people whose place hierarchy stops short of a type: country place, so existing archives behaved as before. That fallback is now off by default: an archive that never says where someone was gets no census rows in glx coverage and no census suggestions in glx analyze or the glx ancestors research notes, rather than being assumed American. Guessing the United States from silence is the US-centric default the issue was filed about, and a wrong country's census years cost a researcher more than an absent suggestion does. Nothing changes for an archive whose places do name a country, including every archive under docs/examples/. Researchers whose archives are rooted below the country level can opt back in per run with --country "United States" (or any other country in the table) on either command; the durable fix is adding a type: country place to the hierarchy, which also tells everyone else reading the archive where those people lived. --country none remains accepted and is now a no-op. (#186)

• glx add names the entity in the singular — Every add subcommand printed its progress line by interpolating the EntityType value, which is the canonical plural — the top-level YAML key and archive directory name — straight against the new ID: Adding assertions assertion-death-1807-date. Two nouns run together with no separator parse as a list before they parse as a sentence, and this line is on the path of every entity a user creates. It now prints Adding assertion: assertion-death-1807-date, using the existing EntityType.Singular() — the same map that mints ID prefixes, so the label always matches the subcommand name and no second source of truth is introduced. Diagnostic output only: the line still goes to the Out stream (so --quiet suppresses it), and the bare ID echoed last on MachineOut — the documented contract for id=$(glx add …) shell substitution — is unchanged. glx/e2e/add_test.go is new and pins all three behaviours through the real binary. (#1276)

• glx init now makes the archive directory a Git repository — init wrote a .gitignore into a directory that was never a Git repository and never became one, so the format's Git-native story ("Initialized multi-file GENEALOGIX repository", a README headlining version control) was contradicted by the result: the one artifact hinting at version control, .gitignore, was exactly the artifact that looked already handled. glx init now scaffolds the repository itself, for both the multi-file and --single-file layouts. It is scaffolding only — no files are staged and no commit is made — so the user can set their identity, rename the branch, or edit the archive before the first commit records anything. The branch follows git's own resolution: the user's init.defaultBranch (global scope, then system scope) if set and valid, else main. Two cases deliberately do not create a repository, and the output says which world you are in either way: an archive created inside an existing repository is left to that repository, since a nested repository would hide it from the outer one, and the new --no-git flag skips the step entirely, printing Not a Git repository — run 'git init' to enable version control and collaboration in place of the repository lines. The repository is created in-process with github.com/go-git/go-git/v5 — already a dependency for the archive cache — so the CLI still has no runtime dependency on a git binary on PATH, and a failure to create it is a warning on stderr rather than an error, since the archive itself is already on disk and usable. docs/quickstart.md and docs/guides/git-workflow.md are updated to match; the git-workflow guide previously told readers to run git init themselves. Note this changes what a fresh glx init leaves on disk: scripts that assumed no .git directory, or that ran git init afterward, should pass --no-git (a second git init in the same directory is harmless, but the assumption is now wrong). Fixes #1273

• glx evidence accepts any assertable subject, not persons only — The first argument now resolves to a person, event, place, or relationship, matching the subject types glx add assertion already accepts via --subject-person/--subject-event/--subject-place/--subject-relationship. This matters because the two properties most likely to carry conflicting answers, date and place, are asserted on the event under the modelling the specification itself demonstrates — so an archive following the documented pattern previously had a glx evidence that could not be pointed at its contested facts, and the workaround was to add redundant person-level assertions purely to make the command addressable. glx evidence event-death-1807 date, glx evidence event-birth-est date, and glx evidence place-liepen name now work. Resolution tries an exact entity ID across all four subject types first and only then the person name search, so an exact ID can never be shadowed by a substring name match; a query that is the ID of entities of more than one type (only possible in a hand-edited archive, since entity IDs are unique archive-wide) is reported rather than silently resolved by map order, and an ambiguous person name still lists its candidates as before. Property values now resolve against the vocabulary belonging to the subject's own entity type — event_properties for an event, place_properties for a place, relationship_properties for a relationship — rather than always against person_properties, and place on an event subject resolves to the place's name as the event's structural place field (the same mapping glx migrate uses). The failure message changes from no person found matching "event-death-1807", which read as "that person does not exist" and is now simply wrong, to one that names what the command accepts. --format json gains subject, subject_type, and subject_name; the existing person and person_name keys are kept for person subjects so scripts written against the old shape keep working, and are omitted for every other subject type. The person-scoped roll-up the issue raises as a second idea — glx evidence <person> date gathering the date assertions from the events that person participates in — is a larger design question and is deliberately not part of this change. (#1268)

• Census suggestions are now tied to the country a person's places name — glx coverage, glx analyze and the glx ancestors research suggestions applied the US federal census schedule to every person in every archive, so a family that never left Mecklenburg-Strelitz was told to search the 1790 and 1800 US censuses. The two hard-coded year lists (usCensusYears in coverage_runner.go and usFederalCensusYears in analyze_suggestions.go, which had to be kept in step by hand) are replaced by one table in glx/census_schedules.go keyed by country, carrying each country's census years and the per-year research notes that go with them (the US 1850 "first census to list individual names", the 1880 parents'-birthplace columns, the 1890 fire). Each person's schedule is chosen by walking their events' places up the parent chain to the first place with type: country and matching that name — free text, so a set of aliases maps the spellings archives actually contain (USA, U.S., Scotland, Éire, …) onto canonical names. A person whose places span a move gets both countries' schedules, and each suggestion names its country ("1841 UK census", "1880 US census"). A person whose places name a country GLX has no schedule for gets no census suggestions at all, which is the point: suggesting nothing beats suggesting the wrong country's censuses. The table ships the United States, the United Kingdom (1841–1921, with Scotland, Wales and Northern Ireland mapped onto it), Canada (1851–1931) and Ireland (1901 and 1911 — the earlier returns were destroyed in 1922 or pulped during the First World War); adding a country is adding a claim about that country's archives, so the table is deliberately small and grows by contribution. Archives that name no country for a person — place hierarchies that stop at a state or city — keep the previous behaviour and get the US schedule, so existing archives are unaffected; the new --country flag on coverage and analyze changes that fallback (--country "United Kingdom") or switches it off (--country none), and an unrecognized value is an error that names the countries GLX knows. The glx analyze brickwall-children suggestion, whose whole premise is that the US 1880 census was the first to record parents' birthplaces, is now only made for children whose places put them in the United States. (#186)

• census add no longer names a country in the source title it generates — A template with no census.source.title produced "1790 U.S. Federal Census — …" wherever the household actually was, and census.type only had special handling for federal and state. The generated label is now built from census.type alone: federal gives "Federal Census", state gives "State Census", national gives "National Census", and a template with no type gives the unqualified "Census". Users who want the country in the title put it in census.source.title, which is unchanged. CensusData.Type was already free text; its comment now says so. An archive whose existing census sources carry the old auto-generated titles will not match the new ones, so census add creates a new source rather than reusing them — pass source_id, or set source.title to the existing title, to keep using the old one. (#186)

• A parish or population register now counts as a vital record in glx analyze — The "search vital records" suggestion fired for anyone with no vital_record source, including researchers whose evidence is a church_register — which is the birth, marriage and death record for most of Europe before civil registration — or a population_register. Both now satisfy the suggestion, and its wording says so. (#186)

• CLAUDE.md files are no longer load-bearing for any policy — A new rule in the root CLAUDE.md (and in .github/CLAUDE.md) records that agent guides are never the source of truth: policies, conventions, and decisions belong in project files (SECURITY-POSTURE.md, CONTRIBUTING.md, docs/, specification/, docs/decisions/), a CLAUDE.md may only summarize and point at them, and public documentation must never link to one. Applied in the same change to the GitHub Actions pinning convention, which now lives in full in SECURITY-POSTURE.md. (#1022)

• Documented the GitHub Actions pinning decision for first-party actions/* — Floating major tags (@vN) on actions published by the actions organization are now recorded as a settled, deliberate choice rather than a pending question. The rationale is written down with its residual risk stated rather than dismissed: a major tag is a mutable ref and a re-pointed one would run with the workflow's permissions, but the publisher is GitHub — the same organization operating the hosted runners — so the likelihood is judged low enough to trade for keeping Dependabot vulnerability alerts, which GitHub raises only for semver-tag references and never for SHA-pinned ones, and for avoiding the maintenance cost of SHA drift across every uses: site. Third-party actions — explicitly including github/*, which is not first-party for this rule — stay SHA-pinned with a trailing version comment, apart from sigstore/cosign-installer, which publishes no floating major and is pinned to an exact patch tag. actions/attest in the release workflow remains SHA-pinned, an exception scoped to signing and attestation steps rather than to every privileged job. SECURITY-POSTURE.md gains an "Action pinning" section that is now the canonical statement of the whole convention — all three pinning tiers, the signing/attestation exception, the three actions that publish no floating major tag (ossf/scorecard-action, mszostok/codeowners-validator, sigstore/cosign-installer), the weekly Dependabot refresh cadence, the accepted OpenSSF Scorecard Pinned-Dependencies ceiling (no allowlist config masks it), and the known limit that a SHA pin does not cover an action's own transitive uses: references. Documentation only; no workflow files changed. (#1022)

• Dependency Review now enforces a license policy — dependency-review.yml had license-check: true but no policy list, so no license was ever rejected. It now sets an explicit allow-licenses list (Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, CC0-1.0, BlueOak-1.0.0, PSF-2.0, 0BSD, Unlicense), so a PR introducing a dependency under any other resolved license fails the check and forces an explicit decision in review (a dependency whose license the action cannot resolve is reported but, per upstream behaviour, does not fail). allow-licenses is used rather than the deprecated deny-licenses input. The same change sets fail-on-scopes: runtime, development, without which the policy would skip npm entirely — the action filters by scope before checking, defaults to runtime, and both npm manifests here are 100% devDependencies; the matching widening of vulnerability-check adds no coverage npm-audit.yml did not already have. The list is a deliberate superset of the Go allowlist shared by license-compliance.yml and make license-check, because Dependency Review also sees the website/ and specification/ npm trees, the GitHub Actions graph, and ci-tools/go.mod — CC0-1.0, BlueOak-1.0.0, and PSF-2.0 are each present in those npm trees today. (#340)

• CI: Go jobs are path-scoped on pull requests — validate-spec.yml gains a changes job (dorny/paths-filter) that decides whether a pull request touches Go-relevant paths — **/*.go, go.mod/go.sum, ci-tools/**, **/testdata/**, docs/examples/**, specification/schema/**, the drift allowlist, the Makefile, the workflow itself, .golangci*, and the non-Go trees embedded into the binary (standard vocabularies, the JSON-LD context, glx/defaults, glx/publish, glx/web). test-conformance, validate-mod, and check-code-drift now carry a job-level if: on that output, so a docs-only PR no longer runs the full Go conformance suite. The skip is deliberately a job-level if: rather than a trigger-level paths: filter: a skipped job still reports its status-check context as success to the branch ruleset, whereas a filtered-out trigger never reports and would leave the required test-conformance context stuck on "Expected". The gate fails open — if the changes job itself errors, the Go jobs run anyway rather than skipping green. build-cli/validate-example/validate-examples (the aggregator hard-fails unless the build succeeded), validate-schemas, and check-memory-drift remain ungated, and pushes to main still run everything. (#1034)

• Toolchain bump to Go 1.27 and golangci-lint v2.13.2, with nolintlint unused-directive enforcement — go.mod and ci-tools/go.mod now declare go 1.27.0 / toolchain go1.27.1, the devcontainer image moves to go:1.27, and .golangci-lint-version pins v2.13.2. The 35 //nolint directives that no longer suppressed anything (mostly //nolint:mnd on numbers already in ignored-numbers, plus stale errcheck/nilerr/goconst/revive/gocyclo directives) were removed, and nolintlint's allow-unused is set to false so redundant suppressions are caught from now on. Contributors need Go 1.27+, and so do downstream projects importing github.com/genealogix/glx/go-glx. (#902)

• glx export no longer requires the archive as a positional argument — export was the only archive-taking command that made the archive a required positional (Use: "export <glx-archive>", cobra.ExactArgs(1)), so running it from inside an archive — glx export -f 70 -o out.ged — failed with cobra's bare accepts 1 arg(s), received 0 before any export ran. The positional is now optional and defaults to ., matching stats, serve, validate, places, and the -a/--archive flag on add; every existing invocation that named an archive keeps working unchanged, and the two spellings produce byte-identical output. --output is still required. In the same sweep, join and split keep both of their positionals — an output path has nothing sensible to default to — but their argument errors now name what is missing (glx join: missing required argument(s): <output-file>) instead of reporting only a count, via a new exactNamedArgs helper that replaces cobra.ExactArgs on both. New e2e cases in glx/e2e/export_test.go cover the default, the explicit-archive equivalence, the still-required --output, and the worded join/split errors. (#1274)

• YAML parsing moves to the maintained go.yaml.in/yaml/v3, and go.mod requires Go 1.27.2 — the archived gopkg.in/yaml.v3 is replaced by its maintained drop-in successor (same API), so the project links one YAML parser instead of two. go.mod now declares go 1.27.2 instead of go 1.27.0 with a toolchain go1.27.2 hint, so a build with GOTOOLCHAIN=local on an older Go 1.27 fails instead of quietly using the unpatched standard library. Downstream projects importing github.com/genealogix/glx/go-glx need Go 1.27.2+. Indirect dependencies are bumped to their latest tagged releases (including ProtonMail/go-crypto 1.5.2, circl 1.6.5, x/crypto 0.58.0, x/net 0.61.0). (PR #1407)

Removed

• Retired the auto-resolve-conflicts.yml workflow in favor of git's native union merge driver — The workflow re-merged conflicting PR branches on a runner and then stripped conflict markers from CHANGELOG.md with sed plus an awk header-dedup pass; since it landed in #82 it needed a string of follow-ups (#194, #341, #592, #601, #602, #657, #1054, #1107) to stay correct. .gitattributes now maps CHANGELOG.md merge=union, so git itself keeps both sides during the merge — no markers to strip, no second workflow, and no workflow_run chaining. union is a git built-in, so unlike the merge=glx driver for .glx files it needs no per-clone git config; it applies in every clone. It applies to local merges and rebases only: GitHub's server-side merges API (the "Update branch" button and auto-update-branches.yml) does not honor .gitattributes merge drivers, so a CHANGELOG-only conflict reported on GitHub is resolved by merging main locally and pushing. CONTRIBUTING.md and the root CLAUDE.md document both halves, plus the one case that still needs a human eye — union keeps both sides blindly, so merging a main that has just cut a release can land a branch entry inside the released section. auto-update-branches.yml is unchanged. Closes #888
• renovate.json — Renovate retired, Dependabot is the sole dependency updater — The repository ran two update bots on paper but only one in practice: renovate.json carried a top-level "enabled": false, so Renovate opened no PRs while Dependabot handled every bump. The config file is deleted and .reuse/dep5 no longer lists it. Note that this also removes the repository's only scheduled lockfile-maintenance mechanism (Renovate's lockFileMaintenance block, itself disabled by the top-level switch, so nothing changes in practice) — Dependabot refreshes go.sum and the npm lockfiles as a side effect of the bumps it opens, and make mod-tidy / make tidy-check cover the rest. #810, which reported the disabled lockFileMaintenance override, is obsoleted as written by this deletion and needs closing or re-scoping to the remaining gap (an unattended periodic refresh of transitive pins no bump happens to touch); it is deliberately left open here for a maintainer to decide. SECURITY.md is corrected in the same change: it described Dependabot as running "daily", where .github/dependabot.yml actually schedules weekly staggered runs (Go Monday, npm Tuesday, GitHub Actions Wednesday) with release cooldowns that security updates bypass. (#257)

Fixed

• GEDCOM 5.5.1 export no longer makes the bride's father the groom's parent — Since #1321/#1352 a 5.5.1 export writes each non-principal event participant as 1 ASSO with 2 RELA <role> under every one of the event's subjects. A RELA states the associate's relation to the INDI that carries it, so a kinship role on an event with two subjects was a false claim under one of them: the father of the bride at a marriage was written as RELA Parent of the groom, and a father entered at each of his daughters' weddings became the parent of every son-in-law. Kinship roles (parent, child, spouse, sibling, godparent, godchild, guardian, ward, and the adoptive, foster and step pairs) on an event with more than one subject now go only under the subject(s) a relationship shows the participant holds that kinship to: one whose type carries it (parent_child for parent, adoptive_parent_child for adoptive_parent, sibling for sibling, …), whose roles run in that direction (the father on the parent side, the bride on the child side), and which the archive has not disproven. With a parent_child from the father to the bride, RELA Parent sits under the bride alone; a neighbor link to the groom, a link that runs the other way or a disproven one says nothing about whose parent he is. When no relationship says which subject is meant, the ASSO goes under every subject as 2 RELA Participant with the role in 2 NOTE Event role: Parent, the shape already used for labels RELA cannot hold. A role that relates to the event rather than to a person (witness, officiant, informant) and any role on a single-subject event (a parent at a baptism) are unchanged, as is GEDCOM 7.0, which already puts the association on the event as ROLE FATH. (#1372)

• glx summary no longer lists a marriage's non-couple participants as spouses, or a spouse's death as the person's own — Spouses taken from marriage events now come only from the couple (groom, bride, spouse, husband, wife, principal, subject or no role), and only for a person who is one of the couple, so the bride's father (parent), a witness or the officiant is no longer anyone's spouse and has no spouse himself from that event. Life History's birth, death and notable-event sentences use only events that are the person's own record (glxlib.ClassifyParticipation), so a husband entered as spouse on his wife's death event no longer "died" on her date; the Vital Events block already did this. (#1362)

• The pre-commit hooks lint what CI lints — The golangci-lint job linted the working tree, so unstaged and untracked files could block a clean commit or hide a staged finding. It used HEAD as its baseline, which let git commit --amend and commits made with hooks skipped drop their findings out of the check, and it ran whatever golangci-lint was installed against the whole module. It now lints the staged snapshot of the packages the branch changes, for issues new since the merge-base with origin/main (as CI's only-new-issues does), and requires the version in .golangci-lint-version. The eslint job lacked --max-warnings 0, so warnings passed locally and failed CI. When website/node_modules was missing, npx fetched an unpinned eslint, and Windows CRLF checkouts failed linebreak-style. It now lints the staged blobs with the npm run lint flags and asks for make install-deps when dependencies are missing. npm run lint and the hook both cover every .js, .mjs, .cjs and .vue file under website/. Regression tests cover staged configuration and version pins, partially staged sources, deleted Go files and the branch baseline. The skip instructions lead with git commit --no-verify, which works in every shell. (PR #1396)

• glx migrations reports moves between neighboring places, and not a child's burial as the parent's move — Movements compared the top-level region of each place (the state, or the district), so a man born in one village who married and lived in the next village of the same district had no movement at all, and a move between two counties of one state was invisible. Each observation's place is now compared along its hierarchy below the country level, and a movement is named at the first level where the two places differ: Niederkleen → Pohl-Göns for two villages of one district, Florida → Wisconsin for two states as before. A place and a place inside it (a state and one of its towns) are not a move. --pattern stops retain the first observation of the most specific place within each stop, so an earlier district-only observation does not hide a village from searches. The bounded-residence override from #1330 uses the same comparison. A parent named on a child's death, burial, cremation or funeral stays in the timeline but is not counted, since the record places the child rather than the parent's household; a child's baptism still counts. JSON from_region/to_region now hold the differing place names. (#1370)

• glx timeline and the publish timeline say whose record an event is — An event in which the person is named but which is someone else's record was printed as a bare event type, so a father's line for his infant son's burial read Burial and a husband named on his wife's death had two Death lines. Such an event now reads the way coverage's "Appears in" list reads, with the person's role: Burial of Michell Father (parent), Death of Anna Wife (spouse), Baptism of Hans Other (godparent). With --family, a relative's birth or death comes only from the relative's own record. The label helper is exported as glxlib.AppearanceLabel. (#1363)

• glx summary takes spouses and the death sentence from the person's own records — The Spouse list took every other participant of a marriage event the person was in, so a bride's father entered as parent became the groom's spouse and the groom his. Spouses now come only from the couple roles (groom, bride, spouse, principal), and only when the person is of the couple; this also preserves spouse roles on the already-supported custom civil_union and common_law_marriage events. Life History took the first death event the person was named on in any role, so a husband named as spouse on his wife's death "died" on her date; it now uses the person's own death, as Vital Events does. Life Events rows for other people's records are labeled like the timeline. (#1362)

• The GO-2026-5932 suppression in osv-scanner.toml now expires and states the dependency graph correctly — Its reason said golang.org/x/crypto is reached only through go-git's use of hkdf; the build graph also uses ssh, ssh/agent, ssh/knownhosts, blowfish, cast5, argon2, sha3 and more (none of them openpgp), now listed with their importers. The entry gains an ignoreUntil expiry, its re-verification command now covers test imports and linux/darwin/windows build constraints (go list -deps -test), and it records that osv-scanner matches by advisory ID only, with govulncheck as the backstop. scripts/filter-govulncheck-sarif.py honours ignoreUntil the same way osv-scanner does and refuses config it does not implement (such as [[PackageOverrides]] or an entry without id) instead of silently diverging. The toml header names the filter as a consumer and notes that it covers the root go.mod only, so ci-tools/go.mod is scanned unsuppressed; SECURITY-POSTURE.md points at the toml instead of duplicating its reasoning. No GLX code changed. (PR #1393)

• glx proof --question parentage counts an assertion on the child's own participant — A parent_child relationship asserted with --participant <child>:child, the natural way to record "this baptism shows her as the child", was listed under Evidence Collected and then ignored: the conclusion read INSUFFICIENT EVIDENCE — Parents not yet identified even though the relationship names both parents. Such an assertion now supports the conclusion like one on a parent participant or an existential one; it still never supplies the answer itself, and step relationships, step roles and disproven assertions are excluded as before. (#1367)

• A baptism or christening is birth evidence for glx analyze and glx proof — Before civil registration the baptism entry is the birth record, and many registers give no birth date at all. glx analyze --check gaps no longer reports HIGH "no birth date or place" for someone with a dated or placed baptism or christening, and the coverage checklist behind glx proof and glx coverage counts the person's own evidenced baptism or christening as the "Birth record" when no birth event is evidenced (a baptism the person attended in another role, such as godparent, does not count). (#1365)

• Event evidence respects privacy and asserted roles — Publishing with --living drops assertions about fully redacted events so their citation text and media cannot reappear on a person's page. Participant assertions use the role asserted by the source, even when it differs from the event's conclusion; witness-only evidence no longer counts as the person's own record. (PR #1382)

• Evidence cited on a person's own events now counts as theirs — glx coverage, glx proof, glx analyze and glx publish read a person's sources only from assertions whose subject is the person, but a vital fact is an assertion about the event, and a parish register entry has no other shape. A person whose every date was cited from a church_register through their baptism and burial events was told to search for church records and vital records, proof listed "Church records" under Evidence Gaps beside evidence that was entirely church-register citations, and the person's published page listed none of those sources. A new AssertionPersons helper in go-glx names the people an assertion is about: its subject person, or for an event the participants whose role makes it their own record (principal, subject, bride, groom, the child of a baptism, a census household member), never witnesses, godparents or informants. Coverage's source-type rows (church, probate, land, military, the vital-record title match), proof's Evidence Gaps, analyze's vital-record suggestion, single-source check and census-years-from-sources index, and publish's per-person source and media lists all use it. collectPersonSources also stops matching an event or place whose ID happens to equal the person's. (#1211)

• glx analyze, glx duplicates and glx summary read the whole given name, not its first word — In German, Dutch and Scandinavian registers every son may be baptized Johann and every daughter Anna, with the second word the name each went by, and three commands cut the given name to its first word. The consistency check reported siblings Johann Wilhelm and Johann Conrad as "children share given name 'Johann'", the pattern meant for a child who died and was replaced by a namesake; it now compares the full given name, case-folded and with spacing normalized, so only siblings with the same whole name are flagged (two daughters both baptized Catharina still are). It also now reads the structured given field from a temporal name list, which it previously skipped. glx duplicates scored Johann Georg and Johann Christoffel Wörner at 0.81 on "given similar" and a phonetic match: Soundex dropped the space, so both given names coded as J526. Given names are now compared word by word, hyphens counting as word breaks: each word of the shorter name is paired in order with a word of the longer, the weakest pair is the score, and a name with fewer words is scaled by the share of the longer name's words it accounts for, so "Georg" against "Johann Georg" scores 0.5 rather than riding on a whole-string edit distance. The phonetic signal codes each full word separately and matches an ordered subset of the name's words; initials constrain that alignment without earning phonetic credit, so a conflicting initial cannot disappear and turn unrelated names into a hit. The glx summary life history named a family's children "Johann, Michell, Catharina, and Johann"; it now gives each child's whole given name. Child ordering in that sentence, descendants and publish is unchanged and remains open in #1364. Fixes #1366

• glx add no longer writes events or dates that glx validate rejects — glx add event now requires at least one --principal or --participant; an event written without one failed the schema's minItems and left the whole archive unloadable. Every date flag (--date on add event, source, assertion, research-log and search; --source-date and --accessed on add citation; --date-range on add study; and any --property whose value_type is date) is now parsed with the GLX date grammar, and a value it rejects (Dom. 12 Trin 1643, 1643-02-30, 1702-01-02 JULIAN) or a reversed range fails the command with the flag, the value and the grammar's reason, writing nothing. Previously these were written and surfaced only as glx validate warnings. Display code also no longer formats an ISO date the grammar rejects as a real one: 1643-02-30 prints as written instead of "February 30, 1643". (#1373)

• Research lead references and status displays — glx merge-persons keeps lead candidate references unique in their original order, and glx summary preserves archive-defined lead statuses instead of counting them as active. The lead vocabulary test has a distinct name so it compiles alongside the research creation commands merged in #1348. (#1347)

• Self-contained single-file archives now get the standard research-log vocabularies (#660) — Loading a single .glx file filled in missing standard vocabularies but skipped search_result_types and research_log_status_types, so glx validate archive.glx rejected a research log using a standard value such as status: in_progress or result: found that the same archive passed as a directory. Both are now filled in, along with the new lead_statuses.

• Published place maps fit across the date line and at geographic limits — Nearby places on opposite sides of ±180° now share a regional view, longitude grid labels stay within WGS84 values, and latitude padding preserves its span at either pole. Views that cannot fill the allocated plot retain the reference-latitude scale with padding around the frame instead of stretching the geography. (#1271)

• Published timelines keep calendar scales comparable — Mixed recorded calendars and dates that cannot be parsed reliably retain their chronological list without a shared proportional strip; homogeneous non-Gregorian strips identify their calendar. BCE/CE plotting skips civil year zero and preserves equal spacing between adjacent years. Main’s qualified lifespan formatting and shared year helper are retained. (#1266)

• GEDCOM family fallback keeps rejected parent links excluded — A surviving parent can no longer place a child into a marriage family with a parent explicitly disproven for that child. The accepted marriage remains exported, and when no eligible family exists the child gets a family containing only the surviving parent. Applies to GEDCOM 5.5.1 and 7.0. (#1380)

• glx path no longer walks disproven relationships, and marks hypothetical hops — path built its graph from every relationship, so a parent the archive marks status: disproven was a valid hop, and a low-confidence, unresearched relative link read as an established connection. It now uses the same relationship standing as summary, ancestors and publish: a disproven link is never followed; a hop along a hypothetical link is marked (?) in text output (with a count under the path) and "hypothetical": true in JSON (with a top-level hypothetical_hops); and among equally short paths the one with the fewest hypothetical hops is chosen. A new --accepted-only flag follows no hypothetical relationship at all. (#208)

• GEDCOM export no longer writes a disproven parent or marriage as a family — Family reconstruction read every parent_child and marriage relationship, so a child whose only recorded father was a rejected candidate (status: disproven) was exported with him as HUSB of the child's FAMC family. A parent-child link or a marriage the archive has disproven is now left out, using the same standing rules as the display commands, and each one dropped is named in an export warning. Hypothetical links are still exported, since GEDCOM has no way to mark them. (#208)

• glx coverage no longer ticks a record found on an estimated event — Since #1267 an event counted as a found record when any assertion about it resolved a citation, source or media, so an estimated ABT 1621 birth carried by a low/speculative assertion citing the man's marriage entry showed as [x] Birth record. An event now counts only when a firm assertion backs it: one that is neither disproven nor a hypothesis by the shared AssertionIsHypothetical rule (low confidence, or a speculative, unresearched or disputed status, unless proven). An event backed only by weak evidence stays unticked, and its row says it is recorded only as an estimate. The rule applies to the census, marriage, probate and church-record rows as well. (#1369)

• Census household membership and age ordering — glx households excludes enumerators, witnesses and other nonresident roles from residents and head selection, and glx cluster excludes those roles from census-neighbor scoring. Infant ages such as 6m and 3/12 sort below older children while preserving the recorded age text. The event specification clarifies that overlapping population and occupation tally rows cannot all be added to obtain household size. (#1351)

• Research CLI writes preserve unrelated logs and valid reference lists — glx add search checks the whole decoded file before accepting a YAML-node append, so shared anchors cannot also change another log or entity. Log discovery uses decoded YAML keys, including escaped IDs, and still rejects multiple definitions. glx add research-log --citation and glx add study --place/--source keep each referenced ID once in the order first supplied, preventing duplicate-item schema errors. (#1348)

• Archives without their own research-log vocabulary files now get the standard ones — search_result_types and research_log_status_types were the only standard vocabularies not filled in by default when an archive does not ship them, so commands that load an archive that way (glx add, glx query, ...) rejected not_found or in_progress on such archives. (#1336)

• glx publish and glx serve keep date qualifiers and ranges in one-line lifespans — The lifespan in a person page header, the "(b. YEAR)" in family lists, and the pedigree/descendancy chart boxes used only the first year of a date, so BET 1756 AND 1774 / BET 1826-05-16 AND 1830 read as a precise 1756–1826. They now keep a short form of the qualifier: ABT 1765 → c. 1765, BEF/AFT → bef./aft., EST/CAL → est./cal., BET/FROM…TO ranges → 1756/1774 (a single year when both ends share it), open FROM/TO → from 1850/to 1860. When either end is more than a bare year the two ends are joined with a spaced en dash (1756/1774 – 1826/1830) so the separator cannot be read as part of a range. glx serve's person, reference, and tree JSON gain a lifespan string the viewer now displays; the numeric birthYear/deathYear fields are unchanged. Tree node tooltips include the complete lifespan even when long date ranges are truncated in the box. (#1328)

• glx validate can show every error, and lists them in a stable order — Validate capped its error list at 10 with no way to see the rest, and the 10 it showed changed on every run because the library collected them in map-iteration order. It now takes --show-first-errors N with the same meaning as on import, split and join (default 10, 0 for all), and the truncation line names the flag. GLXFile.Validate() in go-glx now returns errors and warnings sorted by entity type, then ID, then message, so every caller (and a truncated list) sees the same order run to run; the CLI's structural diagnostics, duplicate-ID conflicts, and media-file warnings are sorted too. The error limit applies to single-file, directory-schema, and stdin validation, counting individual issues rather than file blocks. Cross-reference failures are now headed Validation failed: N error(s) instead of Error loading archive:, which is kept for archives that genuinely could not be loaded. (#1322)

• GEDCOM export files a two-parent child under the right family — A parent_child relationship naming both parents was exported as a link to its last parent only, so the child of a widow's second marriage landed in her first marriage under the wrong father, and the other parent was dropped. Export now uses every parent and every child of the relationship, matches the couple's FAM, and synthesizes a FAM for a parent set with no marriage of its own instead of reusing an unrelated one. Overlapping explicit and single-parent relationships retain shared parents through family matching and preserve known pedigree values (#1319, #1352)

• GEDCOM export keeps events whose type has no GEDCOM tag — taxation, voter_registration, and archive-defined types were dropped without a warning. They now export as EVEN with a TYPE naming the event type, with their date, place, notes and sources, under a person or a family; import reads the TYPE back into the original type (#1320)

• GEDCOM export writes witnesses, godparents and other event participants — Participants who were not the event's principal were dropped. GEDCOM 7.0 now exports them as event-level ASSO with ROLE (or OTHER with a PHRASE), honouring a role vocabulary gedcom value (#524). GEDCOM 5.5.1 uses standard person-level ASSO with RELA and event context in notes; family-event associations appear on each known spouse. These descriptive links do not reconstruct event participants on import; use 7.0 for structured association round trips. An event with no principal is written under its household participants, and unexported events are named in warnings. Import restores vocabulary roles from ROLE OTHER + PHRASE and RELA labels; other declared ROLE values are preserved rather than replaced by a coincidentally matching phrase (#1321, #1352)

• GEDCOM export no longer drops the evidence for event-subject assertions — A birth, death or marriage whose date and place are cited through assertions with subject.event exported with no SOUR subrecord at all, while a person-subject property on the same individual citing the same citation exported its SOUR correctly: buildPersonPropertyAssertionsIndex was the only index feeding the exporter's assertion evidence, and it read assertion.Subject.Person only, so assertion.Subject.Event was never consulted anywhere on the export path. The file was valid GEDCOM with every fact present and only the evidence chain missing, so nothing downstream could tell the dates had ever been sourced — silent loss on the interchange path people use to hand an archive to someone who does not run GLX. A new buildEventPropertyAssertionsIndex indexes assertions by (eventID, property), and the SOUR is emitted under the event structure itself (1 BIRT / 2 SOUR) rather than on the enclosing INDI, which is where GEDCOM 7 puts evidence for an event and what keeps a birth's citation distinct from a death's. Family events (MARR, DIV) go through the same path. Only identical exported SOUR structures are collapsed before they are written, so a date assertion and a place assertion reusing one citation emit it once; evidence attached to the event entity itself is deduplicated against the assertion evidence in the same pass. Distinct citation notes and media links survive even when the source and page match or the citation has no page, and two different pages of one source stay two references. Assertion IDs are indexed in sorted order so the subrecords an event receives are deterministic. Both GEDCOM 5.5.1 and 7.0 output are fixed; docs/examples/complete-family reproduced the bug and now carries an end-to-end regression test in glx/e2e/export_test.go. (#1269)

• GEDCOM imports deduplicate identical embedded sources — Inline SOUR citations with the same title, description, ordered notes and ordered media reuse the first synthetic source within an import, including empty-description placeholders. Census and media context is attached before matching so unrelated records do not inherit it. Distinct source records and citation details retain their identities, and source counts reflect only newly created entities. Applies to GEDCOM and GEDZIP imports; existing archives are unchanged. (#1120)

• Residence overrides require the event's whole possible date span — glx migrations excludes a conflicting event only when its complete possible span fits within a bounded residence in the same calendar. Wider uncertain dates, open-ended spans and incomparable calendars remain included; mixed year/month/day precision uses the shared civil-date bounds. Evidence coverage wording now identifies assertion reachability, including unsourced/disproven assertions and place ancestry scaffolding, rather than a sourced or proven percentage. (PR #1350)

• glx coverage counts only the person's own records — A category was satisfied by any event the person took part in, so a witness at a father-in-law's probate or a godparent at a godson's baptism ticked "Probate/will" or "Church records". Only principal/subject (or unset), bride/groom, decedent and similar roles, and household roles on a census, now count; other appearances are listed under "Appears in" (appears_in in JSON). Someone else's burial no longer infers the person's death year (#1329)

• glx migrations no longer invents moves from remote deeds and estates — Events in which the person's role does not imply presence (grantor, grantee, legatee, heir, ...) are shown but excluded from movement detection, and a dated residence covering an event's date wins over an event place in another region (#1330)

• glx validate --report no longer lists evidenced persons as having no assertions — "Entities with no assertions" used the direct-subject count, so a person named in six participant assertions was listed. It now uses the same evidence coverage as glx stats (#713)

• glx analyze no longer reports research-log citations as orphaned — The orphaned-citation check counted only assertions, so the citation of every documented negative search ("searched, not found") was flagged as clutter. Citations referenced by a research log's searches[].citation or log-level citations now count as referenced, and the orphaned-source check likewise counts searches[].source, a study's sources and a media item's source. (#1323)

• Sibling birthplace check understands the place hierarchy — A child born in North Carolina was flagged MEDIUM as an outlier against siblings born in Rowan County, North Carolina. A birthplace that encloses the siblings' majority place is now an INFO "birthplace less specific than siblings'" prompt (find a more specific record), and one inside the majority place is not reported. Different places on separate branches (two counties of one state) are still outliers. (#1324)

• A license, banns, contract or settlement now satisfies the marriage gap check — glx analyze reported "no marriage event" whenever a couple had no marriage event, even when the relationship's start_event (or a shared event) was a dated or placed marriage_license, marriage_banns, marriage_contract or marriage_settlement, often the only record that survives for an early marriage. Such a couple now gets an INFO "marriage known from a marriage license only; search for a minister's return or marriage register entry" instead of the MEDIUM gap. (#1338)

• Census suggestions skip schedules lost for a whole state or territory — The census tables now record early US federal schedules lost per state or territory (1790 Delaware, Georgia, Kentucky, New Jersey, Tennessee, Virginia; 1800 Georgia, Indiana Territory, Kentucky, Mississippi Territory, New Jersey, Tennessee, Virginia; 1810 District of Columbia, Georgia, Indiana Territory, Michigan Territory, Mississippi Territory, New Jersey, Ohio; 1820 Arkansas Territory, Missouri Territory, New Jersey), keyed on the first state or territory place up the hierarchy of the person's dated events nearest the census year. When every such place lost its schedules, glx analyze and the glx ancestors notes no longer suggest the census and glx coverage no longer counts it as missing (a census found anyway keeps its row); when only some did, or a jurisdiction has confirmed partial survival (1800 Northwest Territory / Ohio; 1810 Tennessee and Illinois Territory), the suggestion stays with a note. State censuses and other substitutes do not count as surviving federal schedules. Alabama's 1820 federal survival is unclassified, so searches stay available without a loss claim. (#1333)

• Patched documentation and schema-tooling dependencies — Updated brace-expansion to 5.0.12 and fast-uri to 3.1.8 to clear npm audit advisories. (PR #1313)

• Shared, time-aware conflict detection — analyze, proof, evidence, and merge-persons now share comparison rules for dates, place hierarchies, free text, and researcher status. Temporal histories with disjoint or touching periods no longer conflict; uncertain overlaps are possible conflicts, and undated temporal values do not create inferred conflicts. Explicit disputes remain visible even without a known date. Approximate date values agree within ±2 years, configurable with --approximation-years. Analysis includes event and relationship assertions plus duplicate birth/death events. Evidence and proof separate undated history; possible conflicts weaken proof support without making it CONFLICTED. Person merges silently accept identical values and retain non-conflicting history. Validation warns on reversed date ranges. Single-file proofs load the same standard definitions as directory archives; participant and existence disputes remain unresolved, undated Markdown claims retain their details, and mixed-calendar periods remain possible overlaps. Merges preserve disagreements already present within either person's history. The Go SDK exposes full conflict, evidence, proof, and coverage workflows with owned typed results, raw fact provenance, read-only defaults, and shared option validation; the CLI delegates to these APIs. Archive-wide analysis indexes claims once per run, and tied evidence groups use raw identity and date for deterministic ordering. Marriage coverage records and proof gaps are ordered by relationship ID, and explicit nil property overrides disable legacy and structural comparison defaults. Typed SDK histories merge as valid dated entries, and single-file merges no longer persist comparison-only vocabulary defaults. Participation evidence preserves each person, role, and date; coverage selects sources deterministically, and birth/death conflicts apply legacy participant roles only to the matching event type. Proof compares legacy vital aliases with event facts, preserves literal text and participant identity, and lists supporting media. Media-backed events count toward coverage, and fixed-property merges retain narrower date and place refinements. Proof and coverage require appropriate principal roles, synthetic vital facts cannot prove claims, and media-linked coverage returns the source that matched. Person merges respect disproven status and preserve structured fields. Legacy vital defaults apply only to person properties, and unrelated resolutions preserve established proof answers. Only claims answering a proof question strengthen its conclusion; media evidence retains raw IDs and deduplicates repeated reports. Builds on MoSattler's date-overlap contribution and boundary tests in PR #1227. (#1312, #1213, #1228, #1229, #1230, #1306)

• glx validate fails when there is nothing to validate — A mistyped path (glx validate archvie), a non-.glx file, or a directory with no GLX files used to print "0 files validated" or "No GLX files found" alongside ✅ and exit 0. A CI step that misnamed its archive therefore stayed green without checking anything. Each of these now exits non-zero: a missing target reports cannot access path before anything is loaded, and a target with no GLX files reports that nothing was validated. .yaml/.yml files were never read as archive files, and a directory holding only those now fails the same way. CI's per-example validation, and make validate-examples, had been passing docs/examples/westeros/ this way: that example is hosted in its own repository, so the directory holds only a README. Both now skip example directories without .glx files and say so, rather than "validating" them (#1205)

• glx merge, glx merge-persons, and glx migrate no longer strand your shell in a deleted directory — Run from inside the archive (the default --into . / --archive ., or glx migrate .), these commands replaced the archive directory with a freshly written copy. The shell that ran them was left sitting in the old, now-deleted directory: ls showed nothing and git failed with "Unable to read current working directory" until you cd'd back in. This is the same bug #1192 fixed for glx rename. The safe-write swap now keeps the archive directory and replaces only the entity directories, vocabularies/, and metadata.glx inside it. .git, README.md, and other non-archive files are never moved at all. If the fresh output would collide with one of those files, the swap is refused and undone before anything is deleted, rather than leaving a partial .bak behind. A write through a symlink to the archive now works on the real directory and leaves the link in place. If a write is killed partway through, the next write refuses to delete the leftover .bak and tells you how to recover it, instead of treating it as stale (#1205)

• id=$(glx add …) now captures just the ID — Every glx add subcommand printed its Adding person person-… progress line to stdout ahead of the ID. The capture the add help documents (person_id=$(glx add person …)) therefore got two lines unless you also passed --quiet. Progress now goes to stderr and stdout carries only the created ID; --quiet still silences the progress line (#1205)

• Typos in subcommands and stray arguments are errors instead of silent successes — glx add bogus, glx cache bogus, and glx census bogus printed help and exited 0. glx add person extra --given A ignored extra and created the person anyway, and glx census add ignored stray arguments the same way. All of these now exit non-zero with unknown command "…" (#1205)

• glx link records today's date as accessed, not UTC's — The citation's accessed property was stamped with the UTC calendar date, so a lookup in the US evening was recorded as accessed the next day. It now uses the local date where the command runs (#1205)

• glx census add output validates without warnings — Household members' ages were written to age_at_event as integers, while the standard vocabulary types that property as a string (it carries GEDCOM AGE values such as 3y 2m). As a result, every archive a census import touched showed one expected string value, got int warning per member. Ages are now written as strings (#1205)

• glx init --create-test-data always produces a valid archive — The generator drew relationship types at random, and two of them didn't fit the standard vocabularies. friend isn't a relationship type, and neither partner nor friend is a participant role. Depending on the draw, the freshly generated archive therefore failed glx validate. Partners are now spouse participants, and the friend type is replaced by the vocabulary's associate type and role (#1205)

• glx coverage no longer counts an uncited event as a record found — The checklist marked a vital record found when the archive held only an event of that type, with nothing citing it: hasEventType(events, EventTypeBirth) was satisfied by existence alone, and collectPersonEvents gathers events purely by participation. The effect was backwards for an evidence-first tool — a conclusion counted as a record, and the score was inflated for exactly the people whose records are missing. An archive holding a birth event that is an explicit estimate reckoned back from a death entry reported [x] Birth record (via event-birth) and counted it toward the percentage, which a caller reads programmatically as "found": true. A record now counts as found only when evidence backs it: a source about the person, as before, or an event that is the subject of an assertion resolving at least one citation or source. Events carry no citations of their own under the GLX evidence model — the assertion pointing at the event is what supports it — so that walk is the whole question, and a dangling citation or source reference does not count, since reference validation already reports it as an error. The same existence-implies-found rule governed census, marriage, probate and church records, and is corrected in all of them. An event that exists without evidence is not silently dropped: the record is reported not-found with a note naming it (event-birth is recorded, but no citation or source backs it), so a conclusion recorded without a source stays distinguishable from a record never looked for, on screen and in --json. glx proof draws its evidence gaps from this checklist and inherits the correction — a missing birth record now appears as a gap instead of being asserted present while the same report said the birth was not established. Expect scores to fall on archives whose events are uncited; the example archives in docs/examples/ do, and the drop is the inflation going away. Two adjacent nits are fixed in passing: the coverage command walked archive.Events in map order, so a person with two events of one type could report a different one run to run, and the source_ref field is no longer populated on a record that was not found, where a caller would read it as evidence. What counts is now stated in glx coverage --help. Note that the right-hand side of the check still only recognizes vital_record sources, so archives whose births are evidenced by a church_register remain under-counted; that is #186 and #1211, not this change. Closes #1267

• glx validate now checks cross-references inside a single-file archive — A .glx file handed to validate had its cross-reference and place-hierarchy checks skipped unconditionally, on the grounds that the file may be one fragment of a multi-file archive whose references resolve in its siblings. That reasoning does not hold for a self-contained single-file archive: glx join writes every entity and every vocabulary into one file, so there is nothing to defer to — and a dangling reference that is a hard error in the multi-file form passed with a green check in the joined one. validate now decides per file rather than by argument count. A file counts as a whole archive when it carries at least one entity collection together with at least one vocabulary or property-definition collection (what glx join writes, since it merges the standard vocabularies in), or when it declares every entity collection (what glx init --single-file scaffolds, empty maps and all); those get the same full pass a directory gets — structural, semantic, cross-reference, place-hierarchy and media-existence checks, with relative media URIs resolved against the file's own directory — and report through the same Validated N files. / ✅ Archive is valid. output. Anything else is still treated as a fragment and keeps the skip, so validating events/event-births.glx out of a multi-file archive does not start reporting its siblings' entities as missing. The entity and vocabulary key sets are reflected off glxlib.AllEntityTypes and GLXFile, so a new entity type or vocabulary is picked up with no parallel list to drift. The fragment path's success line is corrected in the same change: it claimed the file "passed structural and semantic validation" while the semantic pass also filters out the checks that need the rest of the archive, so it now reads "passed the checks that apply without the rest of the archive (cross-reference and place-hierarchy checks skipped)" — the neighbouring overstatement fixed in #658. (#1270)

• README no longer advertises a 0–3 quality scale, and a rejected vocabulary value now names the accepted ones — The Features list offered "structured evaluation of evidence reliability (0–3 scale)" as one of seven reasons to adopt GLX, but the only 0–3 scale in the specification is GEDCOM's QUAY, which specification/6-glossary.md is explicit is not mapped into the GLX model — it survives import only as a GEDCOM QUAY: n note on the citation for round-trip fidelity. The line was left over from the quality_ratings vocabulary removed in beta.5. What GLX actually ships is the three-level confidence_levels vocabulary (high/medium/low) plus source-natures.glx and information-types.glx for classifying the evidence itself, so the line now reads "structured confidence on every assertion, with the nature of the source and of the information recorded separately". A reader who took the old line at face value and reached for --confidence 0 also got a rejection that named neither the accepted values nor what replaced the scale, so validateVocabKey() in glx/add_runner.go now appends them: value not present in vocabulary: confidence_levels="0"; valid values: high, low, medium (see vocabularies/confidence-levels.glx). The keys are sorted and capped at 12, after which the message gives the count and defers to the file (… baptism, bar_mitzvah, birth and 27 more in vocabularies/event-types.glx), so the 39-entry event-type vocabulary does not bury the value that was refused. The file is always named, since vocabularies are archive-owned and extensible — the fix applies to every vocabulary glx add validates, not just confidence. No vocabulary, schema, or accepted-value set changed. (#1277)

• go test ./glx/... now passes on Windows — Two tests failed on a Windows checkout of main on assertions that only hold on a Unix filesystem, so the make test run CONTRIBUTING.md asks contributors to make before opening a PR always ended red there; the Go CI jobs run on ubuntu-latest, so neither was caught. First, the stale-backup refusal (ErrStaleBackupForeignFile) interpolated the offending media/files directory as an absolute native path, which reads media\files on Windows and failed the test asserting the message names media/files — the message now reports that entry as a slash-separated path relative to the backup directory it already names, which also shortens it on every platform and matches how the nested-dot-entry case has always reported its finding. Second, TestPreflightFileOps_ReportsUnexpectedStatError provoked its unexpected Lstat error by planting a regular file as a path component and relying on ENOTDIR; Windows returns ERROR_PATH_NOT_FOUND there, which Go maps to os.ErrNotExist — the "target does not exist, nothing to check" case preflightFileOps correctly treats as success — so no error was returned. The test now uses a path with an embedded NUL, which both platforms reject with EINVAL when converting it for the syscall, and asserts the error is not os.ErrNotExist so the branch under test cannot be satisfied by the accepted case. preflightFileOps itself is unchanged: its behaviour was already defensible on both platforms. Fixes #1272

• glx summary now recognizes marriages recorded only as events — findSpouses() read archive.Relationships only, so a marriage modeled as a marriage event with bride/groom participants — the shape glx add event --help gives as its own example — printed Spouse: (none) in the Family block while glx timeline displayed the same marriage on the same archive, and the auto-generated Life History narrative left the marriage out entirely. Spouses derived from marriage events are now unioned with the relationship-derived ones, carrying the event's own date and place, and deduped by person ID so an archive modeling a couple both ways lists them once. Only events that record a union count (marriage, plus civil_union and common_law_marriage for archives that extend the standard event-type vocabulary); engagement, marriage_banns, marriage_license, marriage_contract, and marriage_settlement record intent or paperwork rather than a union and are deliberately excluded. glx serve's person view shares findSpouses() and gains the same fix. This does not settle the event-centric vs relationship-centric question in #557 — it makes summary and timeline agree in the meantime. Fixes #1275

• Cleared the six OSV advisories behind the OpenSSF Scorecard Vulnerabilities alert — Scorecard's weekly run scored the check 4 on GO-2026-6179, GO-2026-6180, GO-2026-5932, GO-2026-6303, GO-2026-6354, and GO-2026-6355 (code-scanning alert 62). Five are fixed by upgrading. golang.org/x/crypto goes v0.53.0 → v0.56.0 in the root module, clearing the x/crypto/ssh source-address bypass (GO-2026-6303/CVE-2026-56854, fixed in 0.55.0) and the two deadlocked-channel DoS advisories (GO-2026-6354/CVE-2026-78662 and GO-2026-6355/CVE-2026-56855, both fixed in 0.56.0), pulling golang.org/x/net v0.56.0 → v0.57.0 and golang.org/x/sys v0.46.0 → v0.47.0 with it. golang.org/x/mod goes v0.35.0 → v0.40.0 in ci-tools/go.mod — the module that carried the two sumdb advisories, the tile-verification bypass (GO-2026-6179/CVE-2026-56865) and the unauthenticated-hash Lookup issue (GO-2026-6180/CVE-2026-56864) — bringing x/sync, x/sys, x/telemetry, and x/tools along. Both modules stay tidy (make tidy-check, make ci-tools-tidy-check). All six are dependency bumps to test and tooling paths; no GLX code changed The sixth, GO-2026-5932, has no fixed version — it marks golang.org/x/crypto/openpgp unmaintained rather than patching a defect — and does not apply: golang.org/x/crypto is reached only through github.com/go-git/go-git/v5, which uses x/crypto/hkdf and gets OpenPGP from the maintained github.com/ProtonMail/go-crypto/openpgp, so go list -deps ./... shows no x/crypto/openpgp package in the build graph and govulncheck reports it as uncalled. Scorecard's check is version-matched rather than reachability-based and reports it anyway, so a new root osv-scanner.toml ignores that one ID with the reasoning and the re-verification command recorded inline. SECURITY-POSTURE.md gains a "Vulnerability suppression" subsection stating the rule that file operates under — suppress only what upgrading cannot clear and what is provably outside the build graph — so the entry is a documented exception rather than a silent mask, matching the document’s existing stance under Action pinning, where a control’s accepted consequence and known limits are written down rather than papered over. (PR #1262) Clearing the advisories also required one license-policy addition. GitHub’s license resolver reports the bumped golang.org/x/* versions as the compound expression BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang, which failed dependency-review.yml’s allow-licenses list from #340 even though BSD-3-Clause is on it. The LicenseRef is the Go PATENTS file that ships beside the BSD-3-Clause LICENSE in every golang.org/x module — an additional patent grant covering implementations of Go, terminating only if the user sues over Go patents. It adds a right on top of the copyright license and imposes no obligation on GLX or on downstream consumers, so it is added to the allow-list with that reasoning recorded inline, in the same form as every other entry there. No obligation-bearing license was pre-approved.

• Two more Scorecard / govulncheck code-scanning alerts cleared — issue-templates-drift.yml installed PyYAML with a bare pip install pyyaml, which the Scorecard Pinned-Dependencies check reports as unpinned (code-scanning alert 205). It now installs from .github/requirements/issue-templates-drift.txt, which pins pyyaml==6.0.3 to its published sha256 hashes, with pip install --require-hashes --no-deps; a new Dependabot pip ecosystem entry for /.github/requirements keeps the version and hashes current, with the same cooldown as the other ecosystems. Separately, GO-2026-5932 (the unmaintained golang.org/x/crypto/openpgp, suppressed for osv-scanner by PR #1262) still surfaced through the govulncheck SARIF upload as a module-level note (code-scanning alert 247): the advisory has no fixed version, so no x/crypto bump can clear it. The Security workflow now filters that SARIF through scripts/filter-govulncheck-sarif.py, which drops a finding only when its ID is listed in osv-scanner.toml and govulncheck reports it at module level, so one reviewed list governs both scanners and a suppressed advisory that becomes imported or called is reported again. SECURITY-POSTURE.md's "Vulnerability suppression" section describes the filter. No GLX code changed. (PR #1341)

• Display commands now honor a relationship's standing: disproven links drop out, hypothetical ones are marked (?) — A relationship whose every assertion is disproven was still drawn as family by summary, ancestors, descendants, timeline, publish and serve. It now drops out of all of them; summary names rejected parents on an Excluded: line, and marks two or more surviving birth fathers (or mothers) (alternative). A relationship backed only by low-confidence or speculative/unresearched/disputed assertions (and none proven) is marked (?) in summary, the trees, and the published family lists and charts. The rule lives in one place, glxlib.StandingFromAssertions, and only existential and participant assertions count, not property ones. analyze's hypothetical-relationship check now reads status as well as confidence, so confidence: high, status: speculative counts as hypothetical. (#208)

• glx proof --question parentage sets disproven candidates apart and flags competing fathers — Parents recorded only in disproven relationships are listed under a new Alternatives Excluded heading (alternatives_excluded in JSON), not among the parents identified, and no longer feed the conclusion. Two or more surviving birth parent_child relationships naming different fathers (or different mothers) are now an unresolved conflict. Step-parents are not parentage candidates. (#1327)

• step_parent relationships are no longer shown as plain parenthood — glx summary lists a step-parent as Stepfather:/Stepmother:/Stepparent:, splits siblings into Siblings:, Half-siblings: and Step-siblings:, and its life history says "He had six children: …, and two stepdaughters, Peggy and Rachel Call." glx publish profiles gain Step-parents, Stepchildren, Half-siblings and Step-siblings groups, and its pedigree and descendancy charts draw birth-family links only. A link counts as step when its type is step_parent or a participant holds a step_parent/step_child role. (#1331)

• glx summary labels asymmetric relationships by the other person's role — The Relationships block used the relationship type as the label, so a godparent's line read Godparent: <godchild>. When the two participants hold different roles the line now names the other one's role (Godchild: Adam Little, Ward: Rachel Call); symmetric relationships keep the type label. (#1326)

• glx timeline no longer calls a guardian's ward a parent — A guardian relationship made the other person a "parent" unless the guardian held the parent role. guardian/ward roles are now recognized (as are the legacy parent/child ones), unknown role pairs are ambiguous rather than defaulting to "parent", and the entries read Death of ward/Death of guardian. Step relations read Death of stepchild/Death of stepparent. (#1325)

0.0.0-beta.12 - 2026-09-16

Added

• glx merge-driver — genealogy-aware git merge driver for GLX files — A hidden merge-driver subcommand performs a structural 3-way merge of GLX YAML when git invokes it through merge.glx.driver, so two branches editing the same .glx file no longer conflict on safe changes. It auto-resolves one-sided edits, identical edits on both sides, additive changes to an assertion's citations/sources/media/notes (unioned, with deletes honored), and diverging assertion values where one side carries a strictly higher rank in the standard confidence_levels vocabulary (the higher-confidence side wins and an "auto-resolved by the driver" record is written to stderr). Everything else — equal or custom confidence, the same scalar property changed differently on both sides, delete-vs-modify — falls back to git's text merge with a structured per-conflict summary on stderr listing both sides' values plus assertion confidence and citations. The repository's .gitattributes now maps *.glx merge=glx; users opt in per clone with two git config merge.glx.* lines documented in docs/merge-driver.md, and until they do git silently uses its default text merge, so clones that skip setup see no behavior change. Closes #293 (#906)

• Added glx evidence <person> <property> command — Lays out every assertion for one person+property side-by-side, grouped by asserted value, for weighing conflicting evidence during active (brickwall) research. Each value lists its supporting reports (citation ID and resolved source title) with confidence, the report count, and the best confidence in the group; values are ranked by report count then confidence, and a closing line names the best-supported value — or flags an inconclusive tie when the leading values match on both. Place, person, and event reference values resolve to the referenced entity's name; everything else is shown verbatim. The person argument accepts an exact ID or a name search; the property is matched exactly with a case-insensitive fallback. Supports --archive and --format text|json. Complements glx analyze (which only emits one-line conflict warnings) and glx proof (#118, summaries of resolved questions). Closes #144 (#895)

• glx duplicates — Soundex phonetic-match signal — Adds a Soundex-based phonetic-match signal (weight 0.10) to the duplicate-person scoring model, alongside a rebalance of the existing name signal from 0.30 to 0.20 so total weights remain 1.0. Catches name pairs that are phonetically identical but lexically distant — Schneider/Snider (Levenshtein distance 3), Mueller/Miller, Smyth/Smith — which the prior Levenshtein-plus-nickname-table approach scored well below the 0.60 default threshold. The new signal averages over up to two sub-comparisons (surname and given name); sub-comparisons that cannot run (empty component on either side, single-letter initial on a given name) are skipped rather than scored 0 so the signal interacts cleanly with the existing renormalization rule (#716) and preserves the existing initial-match credit (isInitialMatch). Reuses the in-tree Soundex already shipped for PhoneticPersonSearch (#262), so no new dependency. Closes #704 (#917)

• go-glx: library GEDZIP import via fs.FS (ImportGEDZIP) — GEDZIP archive import now lives in go-glx as ImportGEDZIP(bundle fs.FS, logW io.Writer) (*GLXFile, *ImportResult, error), taking any io/fs.FS filesystem abstraction rather than requiring temporary directory extraction on disk. Entry paths are validated in-memory against directory traversal (..), absolute paths, volume prefixes, backslashes, NUL bytes, and duplicate collisions under Unicode case-folding and dot-segment normalization (ErrGEDZIPInvalidEntry, ErrGEDZIPDuplicateEntry). GEDCOM file discovery defaults to root gedcom.ged, falling back to a case-insensitive single .ged/.gedcom candidate at the archive root or within a single wrapper directory, returning ErrGEDZIPMissingGedcom if no candidates exist or ErrGEDZIPMultipleGedcom if ambiguous. Media references are resolved relative to the GEDCOM file path (with percent-decoding and case-insensitive matching fallback) and populate MediaFileSource.MemberPath. The CLI (glx) imports archives directly from *zip.ReadCloser without disk extraction, streaming only referenced media files directly to their destination while enforcing entry count and decompressed size limits. (#1141)

• go-glx: exported GEDCOM 5.5.1 BLOB decoder (DecodeGEDCOMBlob) — The BLOB decoder previously lived unexported in the CLI (decodeGEDCOMBlob in glx/media_copy.go), so library consumers receiving MediaFileSource.BlobData had to reimplement the 5.5.1 decoding — including validation and the trailing-group edge cases — themselves. The function now lives in go-glx as DecodeGEDCOMBlob, together with its sentinel errors ErrGEDCOMBlobEmpty, ErrGEDCOMBlobLength, and ErrGEDCOMBlobChar (moved out of the CLI package and renamed to match), and the CLI is a caller. Pure function, no I/O. The full-group invalid-character error now wraps ErrGEDCOMBlobChar like the trailing-group path already did, so all invalid-character failures are detectable via errors.Is; both paths report the offending byte — as a quoted character and as hex, since %q alone renders any byte above 0x7F as the wrong code point — and its position before the "must be in range '.' to 'm'" hint. Decoding is also more tolerant of exporter whitespace: tabs, vertical tabs and form feeds are now stripped alongside spaces and line breaks, where previously they were rejected as invalid BLOB characters. Prerequisite for library-level GEDZIP import (#1141). (#1140)

• GEDCOM/GEDZIP import now populates media.properties.original_filename — The standard original_filename media property ("Original filename before import or renaming") was defined in the vocabulary but never populated by any import path. Relative FILE references — including media bundled in a GEDZIP archive, whose entries flow through the same conversion path — now record the source file's basename (pre-canonicalization, pre-rename) when the file is copied into media/files/. This preserves the source name in the scenario the property was defined for: a basename collision renames the stored file (photo.jpg → photo-2.jpg), which previously lost the original name entirely. URL and absolute-path references are unaffected (their URI is preserved verbatim, so nothing is renamed), BLOB-derived files get no entry (their filename is synthesized at import), and an original_filename a source already carries is never overwritten. Because a GEDCOM 7.0 FILE payload is a URI reference, a percent-encoded basename is decoded before it is recorded (CharlotteBront%C3%AB.jpg → CharlotteBrontë.jpg), while GEDCOM 5.5.1 payloads are plain paths recorded verbatim so a literal % is never mangled; a 7.0 encoding that is malformed, or that decodes to something other than a bare filename (a path separator, a control character, an invisible or bidirectional format character — the ZWNJ/ZWJ joiners used in Persian/Arabic, Indic, and emoji filenames are allowed — invalid UTF-8, ./..), keeps the raw basename. A FILE ref already pointing into media/files/ — the shape a GLX→GEDCOM export produces — is not stamped while its name is untouched, so a GLX→GEDCOM→GLX round trip cannot fabricate false provenance; if the new import itself collision-renames such a ref (merging two exports), the pre-rename basename is real information and is recorded. Re-running an import of a previously imported GEDCOM stamps the new property on every other relative-FILE media entity — additive, but visible when diffing against the earlier archive. Purely additive for round-trips: GEDCOM export emits uri verbatim and maps no tag to the property. Adds MediaPropertyOriginalFilename/MediaPropertyBlobSize constants to go-glx. (#1121)

• glx publish — static HTML site generator — Exports a GLX archive as a self-contained, browsable website for sharing with non-technical family. Generates a landing page with archive stats and an alphabetical person list, a profile page per person (vital facts, hierarchical birth/death places, a life timeline including family events, linked parents/spouses/children/siblings, supporting sources with citation locators and quotes, notes, and a media gallery), source and place indexes (places with coordinates link to OpenStreetMap), and a client-side search page. Output is a plain directory of HTML/CSS/JS — no server, database, or build tooling — that works when opened directly via file:// (the search index loads as a <script>, not fetch) or hosted anywhere (GitHub Pages, S3, Netlify). Templates and assets are embedded in the binary. Styling is responsive with a light/dark toggle and print-friendly profile pages, and all archive content is HTML-escaped. Flags: --output/-o (default ./site), --embed-media to inline images as base64, --living to redact likely-living people before publishing (reusing the --privatize-living redaction), and --title. Implements the first phase of the read-only web viewer; interactive SVG pedigree/descendancy charts, a visual timeline view, embedded maps, and theming config are tracked as follow-ups. (#91) Renamed from glx view before release to avoid ambiguity with glx serve and to name the artifact it produces; the --serve/--port preview flags were dropped in the same change, since glx serve now owns local preview (#970).

• Git Workflow Guide (docs/guides/git-workflow.md) — New user guide documenting how to actually use Git workflows for genealogy research, filling the gap behind the "Git-native" headline feature: setting up an archive repository (git init after glx init, line-ending pinning, private-by-default remotes for living-person data), the edit→glx validate→commit research cycle with a pre-commit validation hook, branch-based research (hypothesis branches carrying status: speculative assertions, merged as proven when confirmed or — deliberately — merged as disproven when refuted, so negative findings stay on the record), collaboration patterns (shared-repository for family teams, fork-and-PR maintainer model for societies, PR review as genealogical proof-standard review, CI validation), merging and conflict resolution (the git merge vs glx merge distinction, resolving textual conflicts vs recording evidential conflicts as status: disputed, post-merge glx validate/glx duplicates), history as a research log (git log --follow, git blame, milestone tags, correct-don't-erase), and scale concerns (Git LFS for media/files/, partial clone). Registered in the website nav and guides sidebar, and cross-linked from the Quickstart, Best Practices, and Hands-On CLI guides. Closes #508.

• Deterministic memory-file drift detection (make check-memory-drift) — A new offline, API-key-free Go tool under tools/memcheck checks every CLAUDE.md (and AGENTS.md if adopted) against the repository and fails when an instruction has rotted: it asserts that every referenced make target exists in the Makefile, every concrete file/directory path resolves on disk (relative to the repo root or the memory file's own directory), and every github.com/<org>/<repo> import path under the module's org matches the go.mod module line. It closes the project's own dogfooding gap (it lints docs↔schema parity in CI but not memory-file↔reality parity) and runs as a dedicated CI job in validate-spec.yml alongside check-code-drift. Path references are recognized syntactically (a slash plus a known file extension, or a multi-segment trailing-slash directory) so look-alikes such as actions/checkout, os/exec, and the claude/ branch prefix don't produce false positives; intentional exceptions live in .claude/memory-drift-allowlist.yaml. Surfaced and corrected two stale fixture paths in the root CLAUDE.md in the process. (#1053, epic #1016)

• glx serve — local browser-based read-only archive viewer — A new command that starts a small local web server and prints a URL to open in your browser, serving an interactive, dependency-free viewer for a GLX archive: a dashboard (entity counts, assertion-confidence distribution, evidence coverage), browsable/filterable person profiles (names, vitals, chronological event timeline, family links, and assertions with their resolved citation/source evidence), interactive SVG pedigree and descendancy charts, and a source/citation browser. This is Phase 1 (read-only viewer) of the visual editor proposed in #93 — the bridge from "tool for technical genealogists" to "tool for all genealogists." The UI is a self-contained static bundle embedded in the binary (Go embed.FS + vanilla JS, no build step or network access); data is served as JSON over /api/* and rendered client-side. The server binds to 127.0.0.1 by default (warning when bound to a non-loopback host), supports --host/--port (use --port 0 for any free port), reuses the archive-loading and relationship-traversal helpers shared with glx summary/stats, and loads the archive once at startup (restart to pick up external edits; live file watching is a later phase). (#93)

• glx migrations — track geographic movement patterns — New read command that traces a person's geographic movement over time by collecting every dated place observation: events the person participated in (birth, census, marriage, …), their children's birth events (a child's birthplace is evidence of the parent's residence at that date), and residence property values in all three property shapes (plain string, structured map, temporal list). Observations are sorted chronologically and each change of region is reported as a movement (e.g. Florida → Wisconsin (ABT 1832 – ABT 1852)). Regions compare at the state/region level of the place hierarchy — the topmost ancestor below the country/continent level — and pre-statehood territories match their successor states ("Florida Territory" equals "Florida"), so a birth in a territory followed by a census in the later state doesn't read as a move. --pattern "Florida,Wisconsin" searches the whole archive instead, for persons whose region sequence contains the given places in chronological order (matching region names or any name in the place hierarchy path) — knowing who else made the same migration narrows the search for a person's family. --family also prints the timelines of the person's immediate family (spouses, parents, children), and --format json emits the report on the machine-readable stream so glx --quiet migrations … --format json stays scriptable. Not to be confused with glx migrate, which upgrades archive data. (#114)

• GEDCOM import/export: FAM.NCHI (number of children) — The GEDCOM FAM.NCHI tag, previously parsed but silently dropped, is now stored as a new number_of_children relationship property (integer) on the marriage relationship and round-trips back to FAM.NCHI on export. NCHI captures the recorded child count, which can legitimately differ from the number of individually-linked children. A non-numeric payload is preserved verbatim with a warning rather than dropped; NCHI on a spouseless FAM (no relationship to attach to) now warns instead of disappearing silently. Adds the number_of_children entry to the relationship-properties standard vocabulary. (#490)

• Evidence Explained source classification (source_nature / information_type) — Sources can now record the two intrinsic Evidence Explained (Elizabeth Shown Mills, 4th ed., 2024) classification axes as standard source properties instead of free-text notes. source_nature (backed by a new source_natures standard vocabulary: original, derivative, authored) captures how the source was produced; information_type (backed by a new information_types vocabulary: primary, secondary, indeterminate) captures the informant's relationship to the event. Both are vocabulary_type-constrained, so out-of-vocabulary values surface a validation warning and archives may extend either vocabulary; the two new vocabularies are embedded in go-glx and registered through the same path as legal_statuses (embed.go, the GLXFile struct, vocabularies.go switch, the validation map, serializer init, and glx/archive_io.go merge fallback), each with a matching JSON schema wired into glx-file.schema.json. Documented with a new "Source Classification (Evidence Explained)" section on the Source entity page (noting that information quality recorded at the source level is the predominant/default value, that per-fact variation is recorded today via a custom citation_properties entry with standardization tracked in #988, and that the third evidence axis — direct/indirect/negative — remains an assertion-level concern). Closes #287.

• glx proof command — Compiles the evidence bearing on a specific research question about a person into a structured proof summary following the BCG Genealogical Proof Standard (GPS). glx proof <person> --question <parentage|birth|death|marriage|identity> gathers every assertion relevant to the question (including assertions on the person's events and relationships), resolves each assertion's citations and sources to complete, human-readable references (GPS element 2), surfaces the relevant missing records from the coverage checklist as evidence gaps (GPS element 1), flags conflicting assertions and reports whether each conflict has been resolved via the assertion status field — proven over disproven (GPS element 4), lists any logged research searches that document a reasonably exhaustive search, and ends with a conclusion: PROVEN, PROBABLE, POSSIBLE, INSUFFICIENT EVIDENCE, or CONFLICTED (GPS element 5). Output is terminal text by default, with --format json and --format markdown for tooling and research reports. (#118)

• Temporal validation: relationship start_event must precede end_event — validateTemporalConsistency() gains a fourth check: relationships that set both start_event and end_event now warn when the end event's date resolves to a year before the start event's, catching common data-entry errors like swapped marriage/divorce event references. Reported as a warning (not an error), matching the severity of the existing temporal checks (death before birth, parent younger than child, marriage before birth), because fuzzy dates and data-entry errors are common; relationships where either event reference is unset, dangling (caught separately by reference validation), or has a missing/unparseable date are skipped, and same-year boundaries (e.g. shared transfer events) do not warn. The ordering constraint is now also documented under Validation Rules in specification/4-entity-types/relationship.md, which previously only required that the references resolve. (#669)

• civil_union and common_law_marriage standard relationship types — Both are legally distinct from marriage in many jurisdictions and exist as separate categories in GEDCOM X (CivilUnion, CommonLawMarriage couple facts) and Gramps (CIVIL_UNION), but GLX archives previously had no standard way to record the distinction — researchers had to file both under marriage or partner (or define custom types). Added to relationship-types.glx (growing the standard vocabulary from 20 to 22 types) with parallel RelationshipType* constants and a new exported IsCoupleRelationshipType helper in go-glx. Every couple-relationship check in the CLI analysis tools (analyze spouse indexing, coverage marriage records and family-source detection, timeline family traversal, summary spouse listing) now goes through that helper, so the new types participate in analyses instead of being silently skipped. GEDCOM import semantics are unchanged: GEDCOM 5.5.1/7.0 have no dedicated tag for either (both are conventionally MARR with a free-text TYPE), so MARR still imports as a marriage relationship with the TYPE value preserved in the marriage_type property — each new vocabulary entry's comment documents this round-trip; mapping known TYPE values onto the new types at import time is a possible follow-up. The partner description gains a sentence delimiting it from both new types: partner stays the home for informal domestic partnership/cohabitation, while civil_union covers the legally formalized kind. Gramps' UNMARRIED is deliberately not added as a type — an unmarried couple is partner by definition. (#556, #1085, #1094)

• SECURITY.md safe-harbor clause and coordinated-disclosure embargo policy — Adds the two elements the OpenSSF OSPS Baseline Level 2 "coordinated vulnerability disclosure" control was missing. A Safe Harbor section (adapted from the disclose.io Core Terms, a widely used open-source safe-harbor framework) assures good-faith researchers we will not pursue or support legal action under anti-hacking laws such as the US CFAA for accidental, good-faith policy violations, and sets the guardrails (only test your own machine and data, minimise impact, report before disclosing) that keep research inside that harbor. A Coordinated Disclosure and Embargo section publishes the advisory when the fix ships and treats 90 days as a backstop (the outer limit beyond which an issue should not stay embargoed indefinitely; extendable by mutual agreement), names who is inside the embargo (maintainers via the private GitHub Security Advisory draft, plus the reporter), states the embargo-conduct expectations on both sides, and documents how downstream consumers are notified — a published GitHub Security Advisory with a requested CVE that lands in the GitHub Advisory Database and the Go vulnerability database, alerting go-glx/glx users through govulncheck, dependency-review, and Dependabot. SECURITY-POSTURE.md is updated in step: the Level 2 coordinated-disclosure row flips from partial to met, clearing the last Level 2 gap, so the headline self-attestation advances from Level 1 (most Level 2 met) to Level 2 (most Level 3 met), leaving #269 (SBOM) as the sole remaining gap. Closes #424.

• Binary archive cache for fast repeated loading (glx cache) — Every command that loads a multi-file archive re-parses every .glx YAML file on each run; on large archives that is tens of seconds and gigabytes of peak memory per invocation. A new opt-in binary cache persists the fully parsed archive to {archive}/.glx/cache.bin (via encoding/gob) so subsequent loads deserialize a blob instead of re-parsing YAML. New glx cache build [--force], glx cache clean, and glx cache status subcommands manage it; read commands (summary, query, timeline, analyze, stats, vitals, places, cite, cluster, coverage, diff, duplicates, evidence, path, search, report, export, and the ancestor/descendant tree) transparently use a fresh cache when one is present. The cache is disposable and best-effort: any detected problem (missing, stale, corrupt, version/struct mismatch, implausibly large, decode failure) silently falls back to the authoritative YAML parse, so a missing, stale, or unreadable cache is ignored rather than trusted. The cache file is size-capped and decoded through a bounded reader before any gob decode, since gob is not hardened against untrusted input (a hostile cache could otherwise be planted in a shared repo). Staleness is decided solely by a stat-only (path, size, mtime) fingerprint over all .glx files (no file reads); the archive's git HEAD commit and clean state are also recorded (read in-process via the pure-Go github.com/go-git/go-git/v5 library, so no git binary on PATH is required) and surfaced by glx cache status, but do not affect staleness. As with any mtime-based cache, a content edit that preserves a file's size and mtime is the one change the fingerprint cannot see; glx cache build/glx cache clean forces a refresh in that corner case. GLX_CACHE=auto additionally builds the cache on the first miss; GLX_CACHE=off bypasses it entirely. glx init now git-ignores .glx/, and write/transform commands keep parsing YAML directly so their output is never affected by the cache. Scoped to multi-file (directory) archives; single-file archives and parse-time memory reduction are out of scope. (#197)

• Release binaries now carry SLSA build-provenance attestations — The release.yml workflow runs actions/attest (pinned to the v4.1.0 commit SHA) after GoReleaser, taking GoReleaser's checksums.txt as subject-checksums so a single attestation covers every released archive. The provenance is signed keyless via the GitHub OIDC token and stored on GitHub, letting downloaders verify a binary was built by this repo's CI with gh attestation verify --owner genealogix <file>. This is on top of the existing cosign keyless signing of the checksums file (the two are complementary: cosign proves the checksums file's integrity, the attestation proves build provenance per SLSA). Required adding the attestations: write permission to the release job. actions/attest-build-provenance is only a composite wrapper around actions/attest that forwards empty predicate inputs, so calling actions/attest directly — which defaults to the SLSA provenance predicate when no predicate is supplied — is equivalent. SBOM generation is tracked separately in #269. (#256)

• NOTICE file for Apache 2.0 third-party attribution — Adds a top-level NOTICE file declaring the GENEALOGIX (GLX) copyright and attributing the third-party Go components statically linked into the distributed glx binary, grouped by direct vs. transitive dependency with each component's SPDX license, copyright holder(s), and source URL. The component list is derived from the modules actually compiled into the binary (go version -m), not the source-tree go.mod, so test-only dependencies such as github.com/stretchr/testify (which are not redistributed) are intentionally omitted. The file is also added to the GoReleaser archive files list so it ships alongside LICENSE in every release archive. (#427)

• glx migrate --rename-ssn-to-national-id — New opt-in flag on glx migrate that renames the legacy US-centric ssn person property to the internationalized national_id (the vocabulary rename in #532), so pre-rename archives can adopt the new key without hand-editing. It moves person.properties.ssn → national_id, re-points person-subject assertions, and renames an inlined person_properties.ssn definition (multi-file archives also pick up the corrected key when the standard vocabulary file is regenerated on write). A person or vocabulary already carrying national_id is never overwritten — the legacy ssn is left in place with a warning so the user can reconcile by hand. Non-person-subject assertions (an event/relationship may legitimately carry a custom ssn property) are untouched. Idempotent. GEDCOM compatibility is unaffected: both keys map to the SSN tag. (#532)

• Seven new standard source types in source-types.glx — Added family_bible (Family Bible records of births, marriages, deaths — often the only pre-civil-registration source for US colonial/antebellum research), gravestone (tombstone/headstone inscriptions, cemetery memorials), dna_test (genetic test results — autosomal, Y-DNA, mitochondrial DNA), memoir (autobiographies, diaries, personal journals), manuscript (unpublished manuscripts or typescripts), map (historical maps, atlases, survey plats), and social_media (social media posts and profiles), growing the standard vocabulary from 18 to 25 types. Source type is an open vocabulary, so archives could already add these as custom types; standardizing the common ones keeps classification consistent across archives and unlocks GEDCOM round-trip. The parallel SourceType* constants in go-glx/constants.go were extended to match, and the GEDCOM SOUR.TYPE import mapping now recognizes the aliases bible/gravestone/tombstone/headstone/dna/memoir/diary/manuscript/map/social (explicit-value mapping, no false-positive risk) plus identity mappings for the canonical keys family_bible/dna_test/social_media so all seven types survive a GLX→GEDCOM 7.0→GLX round-trip (the exporter writes Source.Type verbatim as the TYPE value; without the identity entries these three would re-import as other). Title-based inference picks up distinctive phrases (e.g. "family bible", "headstone", "dna test", "survey plat", checked before the broad "land" keyword) while deliberately avoiding the bare word "map" so place names like "Mapleton" do not misclassify. The source entity spec and the vocabularies reference were updated in step. (#563)

• Deterministic schema/code drift detection (make check-code-drift) — A new Go tool under tools/driftcheck compares the go-glx type definitions (via reflection) against the JSON Schemas in specification/schema/v1, catching structural drift — missing/extra fields, yaml-tag mismatches, omitempty-vs-required mismatches, and type-family mismatches — on every PR with no API keys. It is the deterministic counterpart to the LLM-based /check-code-drift slash command: zero false positives by design, with ambiguous/semantic cases still deferred to the LLM checker. It resolves cross-file and in-file $refs, recurses into nested types (Participant, EntityRef oneOf, Submitter, Search), handles the custom NoteList/DateString marshalers, and compares the unified VocabularyEntry against the union of every type-vocabulary schema. Known, by-design drift is suppressed by reading .claude/drift-allowlist.yaml (matching the same per-symbol identity the slash commands use). Wired into make check, runs as a dedicated validate-spec CI job, and is guarded by an in-repo regression test that fails if the committed types and schemas ever diverge. The closed-issue staleness gate noted in #797 needs issue-state lookups and remains future work. (#673)

• assertion-workflow example now demonstrates conflicting evidence — The example's README repeatedly promised conflicting-evidence support ("Doesn't capture conflicting evidence", "Documenting conflicting evidence", the "Conflicts: Hidden vs Documented" table row), but the archive.glx contained only corroborating assertions. Added a genuine conflict on Robert's birth year: a new citation-robert-birth-lore (family oral history placing his birth in 1956) backs a disproven, low-confidence assertion-robert-birth-lore that contradicts the proven birth-certificate assertion (1955-03-22) — two assertions on the same property of the same event with different values, resolved in favor of the primary source. A new "Conflicting Evidence (and Its Resolution)" README section walks through the proven/disproven/disputed status pattern, demonstrating GPS element 4 (resolution of conflicting evidence). (#575)

• .claude/drift-allowlist.yaml — Machine-readable, self-validating allowlist of known, per-symbol drift suppressions for the /check-*-drift slash commands, replacing inline "known drift" prose with an auditable file. Each entry is either permanent (by-design) or a temporary deferral that must reference a tracking issue; this is enforced by .claude/drift-allowlist.schema.json via the new make check-drift-allowlist target, wired into make check and the validate-spec CI workflow. The closed-issue staleness gate (failing when a temporary entry's tracking issue is closed) is left to the deterministic drift checkers tracked by #673 / #295. (#797)

• glx validate --stdin --entity-type — Validate a single entity snippet piped on stdin against its entity-type schema, without writing a temp file or wrapping it in archive shape. echo '<yaml>' | glx validate --stdin --entity-type person runs structural validation only (Pass 1 / JSON Schema — no cross-reference resolution) and exits 1 on a structural failure or malformed-YAML input (content was piped but is unparseable — a content failure, like a structural one), 2 on a bad invocation (unknown or missing --entity-type, stray path arguments, empty stdin — nothing piped, or combining --stdin with --report); the --entity-type allow-list is derived by reflection from glxlib.AllEntityTypes (entity singulars such as person) and the GLXFile vocabulary collection keys (event_types, place_types, confidence_levels, …), so a vocabulary entry is validated against its own schema — e.g. a place_types entry's category: administrative passes against the place-type enum instead of being rejected by the event-type one. New vocabularies added to GLXFile are picked up automatically with no parallel list to maintain. Lets the check-* drift skills validate documentation fragments directly instead of the mktemp/cat/rm temp-file dance. (#910, #1016)

• Deterministic drift-check CI layer (.github/workflows/drift-checks.yml) — Two new no-LLM checks complement the existing make check-code-drift (#673): spec↔schema field parity (scripts/drift-checks/spec-schema-drift.mjs) compares the field tables in specification/4-entity-types/*.md against each schema/v1/*.schema.json on both presence and required/optional, warn-only (DRIFT_STRICT=1 makes it blocking) (#309); and schema↔schema backward-compatibility (specification/schema-compat.mjs) diffs PR-changed schemas against the base branch with json-schema-diff-validator and hard-fails on backward-incompatible changes (#311). validate-schemas.mjs additionally validates every 5-standard-vocabularies/*.glx against its vocabulary schema (#839), and make check-code-drift findings now carry go-glx/types.go:NN source lines via a new I/O-free AST extractor (tools/internal/structdump), satisfying #676 item 11 (#795). Both Node checks expose an I/O-free core (compareEntity, classifySchemaChange) covered by fixture-based node:test unit tests (make test-scripts, wired into make check and the validate-spec CI job), so the hand-rolled markdown-table parser and the breaking-vs-compatible classifier are pinned rather than only exercised against the live tree. #309 remains open: its acceptance criterion is failing CI on drift, so it tracks the future flip of the warn-only parity check to DRIFT_STRICT=1 once the parser is proven. (#309, #311, #839, #795, #1016)

• glx migrate --strip-event-title-year — New opt-in flag on glx migrate that removes the stale (YEAR) suffix GEDCOM imports before #1026 appended to auto-generated event titles. Titles are stored, not regenerated, so archives imported before that fix keep the suffix indefinitely — including the buggy day-as-year form (Birth of John Smith (15)) produced by the ExtractFirstYear mis-parse tracked in #1025. The migration is gated so hand-authored titles are never modified: a trailing space-plus-(NNNN) suffix (1–4 digits) is stripped only when the remaining body is byte-for-byte identical to the title import would auto-generate for that event from its type and principal/spouse participant names (Burial, Birth of John Smith, Marriage of Robert Webb and Jane Miller) — so Family reunion (1955), Census (Webb Household), and 1860 Census — Webb Household are untouched. One accepted residual: a hand-typed title identical to the auto-shape including the year is indistinguishable from a stale auto-title and is stripped; the result equals the current canonical title and the year remains in the event's date field. Idempotent; follows the report-then-write pattern of the sibling migrate flags. (#1032)

Changed

• Specification consistency pass — Fixed three shipped examples that failed glx validate: the Source example in repository.md carried description as a top-level field instead of a property, and the custom land-grant event type in vocabularies.md (twice) used a category outside the schema enum. Aligned participant-role validation wording in event.md and relationship.md with vocabularies.md (an unknown role is an error, not a warning, which is what the validator does). Documented that structural fields (date, place, title, …) are valid assertion property targets without a vocabulary entry. Settled the fields-only structured-property shape on the bare map the exporter reads (2-core-concepts and vocabularies.md previously showed a fields: wrapper that media.md did not). Added the beta.12 relationship start/end ordering check to the archive-organization warning list; added an "Upgrading archives from earlier betas" note listing the glx migrate flags; removed the phantom Holdings entity from repository.md; filled property-table gaps (legal_status, name_as_recorded, marriage_type, media description/blob_size); reworded "entity type keys are required in every file" to admit vocabulary-only and metadata files; fixed the citation.md file-organization tree, the spec README table of contents, and the vocabulary key-format claim. Glossary: corrected the Source Type, Relationship Type, Participant, Participant Role, QUAY, Search, Archive, Calendar Prefix, Status, and Value Type entries and added GEDCOM, Archive Metadata, Principal, Vocabulary Type, and Living. (PR #1222)

• blob_size media property description clarified — The media-properties.glx description (rendered on the standard-vocabularies page) now documents the value as the length in bytes of the encoded GEDCOM 5.5.1 BLOB text as the BLOB/CONT lines joined with newlines (pre-decode; includes the line separators) — which is what the importer has always stored — instead of implying the decoded binary size. The MediaPropertyBlobSize constant comment matches. Description-only; no behavior change. (PR #1135)

• /compact-changelog command gained allowed-tools/model frontmatter — .claude/commands/compact-changelog.md was the only command in .claude/ without tool/model frontmatter, unlike its check-* siblings. It now declares a minimal allowed-tools surface (Read, Edit, Write, Grep, and the specific git invocations it runs), pins model: claude-opus-4-8 to match the siblings, sets disable-model-invocation: true so a file-mutating command is never auto-fired mid-session, and adds an argument-hint. (#854)

• gosec bumped from v2.22.4 to v2.27.1, with the pin moved to a .gosec-version single source of truth and a weekly currency check — The @v2.22.4 pin (mid-2025) had gone ~5 minor releases stale and was hardcoded in four places (security.yml, twice in ci-tools/README.md, a Makefile comment). It is deliberately invisible to Dependabot — gosec is kept out of ci-tools/go.mod because its autofix package drags in the Google Cloud SDK/gRPC/OTel tree (#480), and the github-actions ecosystem doesn't parse go install [email protected] run lines — so it had no automated bump path and rotted silently, missing analyzers added after v2.22.4 that map squarely onto GLX's untrusted-archive threat surface (G120 unbounded stream parsing, G122 filepath.Walk/WalkDir symlink TOCTOU, G707–G709 unsafe deserialization). The version now lives in a top-level .gosec-version file (mirroring the .golangci-lint-version pattern from #272): security.yml installs from it (after validating the vMAJOR.MINOR.PATCH shape), a new make gosec target runs the same pinned version locally, and ci-tools/README.md references the file instead of hardcoding versions. As the sustaining mechanism, a new gosec-pin-currency job in security.yml runs on the weekly schedule only (never on PRs, so an upstream release can't block unrelated work) and fails when .gosec-version is behind securego/gosec's latest release, turning silent rot into a red weekly run. The newly active G122 analyzer immediately flagged three real os.ReadFile-inside-WalkDir sites (glx/fileops.go, glx/validation_runner.go, tools/driftcheck/main.go); these are suppressed with per-site justified #nosec G122 annotations pointing at #1090, which tracks the proper root-scoped (os.Root) containment fix — the same symlink-escape class as #972/#775. SECURITY-POSTURE.md's static-analysis row now documents the pin/currency mechanism and the G120/G122 ↔ GEDZIP zip-slip/decompression-bomb threat-model mapping (complementary to CodeQL dataflow, #1031). Closes #1050.

• JSON schemas migrated from draft-07 to JSON Schema 2020-12 — Every *.schema.json under specification/schema/ (the meta-schema, all entity schemas, and all vocabulary schemas), plus the repo-internal .claude/drift-allowlist.schema.json and .claude/skills/check-suite/findings.schema.json, now declares "$schema": "https://json-schema.org/draft/2020-12/schema". The draft-07-isms were migrated mechanically: definitions → $defs (with all #/definitions/... $refs rewritten), and the Place schema's latitude↔longitude co-requirement moved from array-form dependencies to dependentRequired. Validation behavior is unchanged — the renames are identity-preserving, and the Go validator (santhosh-tekuri/jsonschema/v6, swapped in by #268) already speaks 2020-12 natively. The Node tooling went dialect-aware: validate-schemas.mjs and validate-drift-allowlist.mjs import ajv's 2020 class (the default ajv export is draft-07-only), the meta-schema now requires the 2020-12 dialect declaration, and tools/driftcheck reads $defs. Because json-schema-diff-validator (the schema↔schema backward-compatibility gate, #311) predates 2020-12 and would flag the keyword renames as breaking removals, schema-compat.mjs gained an exported normalizeDialect() that canonicalizes both sides to draft-07 keywords before diffing — dialect renames diff as no-ops while real structural breaks still fail the gate (unit-tested in schema-compat.test.mjs). The check-code-drift and check-schema-drift skills now state the dialect explicitly so LLM-assisted checks don't suggest draft-07 idioms, and ADR-0007 records the decision (2020-12 now; TypeSpec-as-upstream deferred, not rejected). Consumers validating archives against the published schemas need a 2020-12-capable validator; most maintained validators read both drafts. Closes #794.

• PR template corrected and given DCO / AI-disclosure reminders — .github/PULL_REQUEST_TEMPLATE.md no longer claims the title "Description must start with an uppercase letter": lint-pr-title.yml sets no subjectPattern, so casing is not CI-enforced (a lowercase subject passes today). The top comment now names lint-pr-title as the source of truth for the allowed type list and notes that on squash-merge this title is normally the commit subject. A grouped "before submitting" comment block adds two reminders the template was missing for policies that live in CONTRIBUTING.md: signing off every commit per the DCO (with the git rebase --signoff recovery one-liner) and disclosing substantial AI assistance via an Assisted-by: trailer (kept SHOULD-level, no mandatory checkbox). The CHANGELOG reminder now mentions the required issue/PR reference, the "Related issues" hint distinguishes a closing keyword from a bare #123, "What and why" points spec/data-model changes at the proposal + ADR gate, and "Testing" asks for a screenshot on website/UI changes. The template stays lean (prose/HTML-comment prompts, no rendered checklist) — deliberately not adopting PR-template forms (GitHub has none in 2026), multiple templates, a long checklist, or a bespoke drift check. Automating the DCO check itself is tracked in #1057. (#1056)

• Auto-generated event titles no longer append the year in parentheses — GEDCOM import titles drop the trailing (YEAR) suffix: Birth of John Smith (1850) becomes Birth of John Smith, and Marriage of John Smith and Jane Doe (1850) becomes Marriage of John Smith and Jane Doe. The year was redundant with the event's own date field, and was frequently wrong: it came from ExtractFirstYear, which only reliably parses dates the importer normalized to ISO, so non-ISO dates (full month names, mixed case, numeric DD/MM/YYYY) surfaced the day-of-month instead of the year (e.g. Birth of John Smith (15)). The parenthetical was an implementation choice in #99, not an acceptance criterion of the originating feature request (#86). GenerateEventTitle no longer takes a date argument. The underlying ExtractFirstYear mis-parse (which also affects temporal validation, duplicate detection, and privacy cutoffs) is tracked separately in #1025. (#1024)

• ssn person property renamed to national_id — The standard person property had a US-specific label ("Social Security Number") contradicting its generic description ("National identification number"), making GLX read as US-centric for UK/Canada/Australia researchers whose records use NI numbers, SINs, or TFNs. The property key is now national_id with label "National Identification Number" and a description listing international examples. GEDCOM compatibility is preserved — the gedcom: "SSN" mapping is unchanged, so importing a GEDCOM SSN tag now populates national_id and exporting national_id still emits SSN (GEDCOM 7's SSN tag is itself defined as US-only). Archives using the old ssn key should rename it to national_id. (#532)

• golangci-lint now enables the std-error-handling exclusion preset — golangci-lint v2 ships its built-in exclusion presets disabled by default (v1's exclude-use-default: true has no direct v2 equivalent), so without the preset errcheck flags any unchecked Close/Flush/print/Remove/Setenv return that isn't manually suppressed. The std-error-handling preset suppresses those — ignoring them is idiomatic Go (e.g. defer f.Close() on a read-only handle) — making the manual _ = f.Close() and //nolint:errcheck // CLI output workarounds the codebase had accumulated unnecessary going forward. The change is behavior-neutral on the current tree (errcheck already reported zero issues, because every such call was hand-suppressed); it only removes future friction. The other three v2 presets are intentionally left off: common-false-positives filters only gosec and is deferred to the gosec-enablement work in #374, comments is redundant with revive's already-disabled package-comments, and legacy covers only unsafe.Pointer casts the codebase does not use. (#630)

• source-properties.glx descriptions rewritten to be self-contained — The abbreviation, call_number, events_recorded, and agency property descriptions no longer reference GEDCOM tags as their definition (e.g. "(from GEDCOM ABBR tag)"); each now stands on its own for readers unfamiliar with GEDCOM. The GEDCOM origin remains captured in each property's structured gedcom: field. publication_info carried the identical "(from GEDCOM PUBL tag)" pattern and was cleaned up in the same pass for consistency (not listed in the issue, but the same defect). (#558)

• make build-cli now builds with GoReleaser's -trimpath and stripped ldflags — the target builds with -trimpath and -ldflags "-s -w -X main.version=$(VERSION)" instead of a bare go build, so local binaries report a version (glx --version), strip debug symbols (~27% smaller), and drop local filesystem paths for reproducibility. A new VERSION variable defaults to dev (matching the glx/cli_commands.go fallback) and can be overridden, e.g. make build-cli VERSION=0.1.0-local. This aligns the target on stripping, -trimpath, and version injection; GoReleaser additionally injects commit/date (added in #384), which the Makefile omits to keep local builds git-independent. (#440)

• /check-code-drift and /check-schema-drift now read the drift allowlist instead of hardcoding known-drift notes inline. Removed the stale Metadata.Notes "known drift point" note — that drift was already resolved by widening glx-file.schema.json metadata.notes to oneOf[string, array], which is exactly the go-stale-and-mislead failure mode #797 targets. (#797)

• README.md restructured to surface Install/Quick Start above the fold — Installation and Quick Start now sit immediately under the badges, so first-time visitors see "how to use it" before "why to use it" (the previous order buried Quick Start at line 143 behind a 90-line marketing section). The "Why GENEALOGIX?" comparison was shortened — the comparison table is kept, but the inline GEDCOM-vs-GLX code blocks and the three "Beyond Exchange" subsections were dropped or linked out to Core Concepts. The redundant "What is GENEALOGIX?" section was renamed "Features" (bullet list preserved). A new flat "Documentation" link list replaces the old "Quick Links" header and absorbs the doc-related entries that were buried under "Community & Support". "Community & Support" itself was compacted from eight emoji-headed subsections into a single table covering Issues, Discussions, Chat, Mailing list, Contributing, Code of Conduct, Security, and Releases. The "Getting Help" walkthrough (numbered For-Users / For-Developers steps), the "Project Status" beta-10 feature checklist, and the "Acknowledgments" prose were dropped outright rather than folded into the table. Length dropped from 335 to 201 lines (-40%). No link contracts removed except a pre-existing broken link to glx/tests (that directory does not exist; the Go tests live alongside their source as *_test.go). Closes #472.

• Pinned six third-party GitHub Actions to release commit SHAs — golangci/golangci-lint-action (lint.yml), lycheeverse/lychee-action and peter-evans/create-issue-from-file (lychee.yml), goreleaser/goreleaser-action (release.yml), DavidAnson/markdownlint-cli2-action (lint-markdown.yml), and codecov/codecov-action (validate-spec.yml) were floating on bare @vN major tags; each is now pinned to its latest release's 40-character commit SHA with a trailing # vX.Y.Z comment, matching the repo's existing SHA pins (golang/govulncheck-action, amannn/action-semantic-pull-request) and the .github/CLAUDE.md "always pin to vX.Y.Z, never @vN" policy. (codecov/codecov-action was not in #963's enumerated list but surfaced during the repo-wide sweep the issue calls for, and the OpenSSF Scorecard Pinned-Dependencies check scores it too.) Mutable tags were the attack vector in the March 2025 tj-actions/changed-files (CVE-2025-30066, ~23k repos) and reviewdog/action-setup (CVE-2025-30154) supply-chain compromises, where existing tags were rewritten to point at malicious commits; SHA pins are immutable and were untouched. The existing Dependabot github-actions entry keeps the pinned SHAs (and their version comments) current. First-party actions/* floats remain the repo's accepted convention and are out of scope. Closes #963.

• Release job no longer restores a Go build cache writable by pull_request runs (cache: false) — release.yml's Set up Go step set cache: true, restoring the same actions/setup-go Go build cache that pull_request-triggered workflows (security.yml's govulncheck/gosec, validate-spec.yml) populate. Because the release job is privileged — it holds id-token: write for cosign keyless signing — restoring a cache a lower-trust run can write is a cache-poisoning path: a poisoned entry would taint the binaries upstream of signing, so provenance and signatures wouldn't catch it (the recognized cache-poisoning class; cf. the Angular Mar-2026 / TanStack May-2026 advisories). The step now sets cache: false; the release job already does a clean go mod download, so the cache bought little on a cold tagged build. This is defense-in-depth given Actions cache scope isolation (a fork PR can't directly write the release run's cache — a poisoned entry would first have to land on main), removing the trust-boundary bridge entirely. A general rule (id-token: write must never coexist with a pull_request-reachable cache) was added to the .github/CLAUDE.md release section; wiring zizmor's cache-poisoning audit into CI (#928) would catch regressions generically. (#1051)

• Added a top-level read-only permissions: default to the auto-update-branches.yml workflow — the workflow set permissions: only at the job level, leaving the top-level GITHUB_TOKEN scope at the repository default. OpenSSF Scorecard flags this under Token-Permissions ("no topLevel permission defined"): a future job added without its own permissions: block would silently inherit the broad default. A top-level permissions: contents: read least-privilege default is now declared; the single update-branches job keeps its explicit contents: write / pull-requests: write grant, so behavior is unchanged. Matches the top-level read-only default already used by lint.yml and release.yml. (PR #979)

• Added a top-level read-only permissions: default to the auto-resolve-conflicts.yml workflow — the sibling fix to #979. This workflow (triggered by auto-update-branches.yml) likewise set permissions: only at the job level, leaving the top-level GITHUB_TOKEN scope at the repository default — the same OpenSSF Scorecard Token-Permissions finding ("no topLevel permission defined"). A top-level permissions: contents: read least-privilege default is now declared; the single resolve-conflicts job keeps its explicit contents: write / pull-requests: read grant, so behavior is unchanged. This was the last workflow in the repo missing a top-level permissions: block. (PR #1054)

• dependency-review.yml now states its toggles explicitly and hardens snapshot/scorecard handling — The workflow configured only fail-on-severity and comment-summary-in-pr, relying on actions/dependency-review-action's internal defaults for everything else. The defaults it depends on are now confirmed in code (vulnerability-check: true, license-check: true, show-openssf-scorecard: true), so the workflow is auditable in isolation and a future major-version default flip cannot silently change the repo's security posture (within v5 the "Unknown license" behavior already changed from v4 in a way that broke some adopters — upstream issue actions/dependency-review-action#1099). Two mild hardening toggles ride along: retry-on-snapshot-warnings: true (with the default 120-second timeout stated explicitly) polls the dependency-graph API until the snapshot is fully indexed — the README-documented mitigation for the Go dependency-submission timing race that can otherwise yield an incomplete diff; and warn-on-openssf-scorecard-level: 5 (up from the default 3) surfaces barely-maintained dependencies in the PR comment without noise from healthy ones (informational only — never affects fail-on-severity). SHA pinning of the action ref remains tracked in #254 and license allow/deny policy in #340. (#930)

• validate-examples CI job now validates each example in a parallel matrix instead of a sequential shell loop — The validate-spec workflow built the CLI and then looped over docs/examples/*/ with ./bin/glx validate, which ran sequentially, stopped at the first failure (default set -e), and reported every example under one opaque step. It is now three jobs: a build-cli job builds the binary once, uploads it as an artifact, and emits the example list as a dynamic matrix (discovered via find docs/examples + jq, so newly added example directories are picked up with no workflow edit — preserving the loop's auto-discovery); a validate-example matrix job downloads the binary and validates one example per leg with fail-fast: false, giving per-example pass/fail in the Actions UI and running them in parallel; and a small validate-examples aggregator job keeps that exact status-check name (required by the repo ruleset) stable regardless of how the matrix expands. The matrix value is staged through env: before use in run: per the repo's workflow-injection guidance. Closes #352.

• govulncheck is now version-pinned via a Go 1.24 tool directive — Added a dedicated ci-tools/ module (ci-tools/go.mod) whose tool directive pins govulncheck (v1.3.0), making it the single source of truth for CI and local runs. The security.yml govulncheck job drops the third-party golang/govulncheck-action (which installed govulncheck@latest — unpinned) and now runs go tool -modfile=ci-tools/go.mod govulncheck -format sarif ./..., keeping the existing Code Scanning SARIF upload. A separate module is used deliberately so the tool's transitive dependencies stay out of the root go.mod/go.sum and are never inherited by consumers importing go-glx as a library; it lives in ci-tools/ rather than tools/ because tools/ already holds the first-party tools/driftcheck package (part of the main module), and a tools/go.mod would have pulled that package into the isolated tool module. A new make vulncheck target runs the same pinned tool locally; a ci-tools-tidy-check target (and matching validate-spec CI step) keeps ci-tools/go.mod tidy, and Dependabot's gomod ecosystem now watches /ci-tools so the pin stays current. gosec stays on its existing version-pinned go install [email protected]: its autofix package pulls the Google generative-ai-go/Cloud SDK/gRPC/OpenTelemetry tree, whose (unreachable, build-time-only) advisories would otherwise make dependency-review block every PR. golangci-lint (pinned via .golangci-lint-version, see #272) and goreleaser likewise remain on their dedicated actions. (#480)

• /check-schema-drift slash command emits a machine-readable findings block plus provenance, cross-reference, and false-positive fixes — Parallels the structured-output work for the sibling check-* commands. (1) A findings-json fenced block is appended after the prose report — valid JSON with one object per drift carrying scope (entity | archive_root | vocabulary_type | vocabulary_property | meta), target, schema_path, spec_path, json_pointer, category, severity (critical | major | minor | info, rubric tracked by #838), drift_direction (spec_to_schema | schema_to_spec), and a message — so the eval harness (#796) can compute precision/recall against a deterministic fence instead of free-form markdown. (2) A Provenance header records the commit SHA, run timestamp, the schema files actually visited (to catch silently dropped files), and the make check-schemas exit status. (3) A Cross-Reference with Known Issues section layers an open-issue scan on top of the existing file-backed .claude/drift-allowlist.yaml so triaged drift is not re-surfaced. (4) The Output Format template now covers all four scopes (entity / archive root / type vocabulary / property vocabulary) with fixed headings rather than only ## [Entity Type]. (5) The "Required Fields Alignment" check now excludes the Entity ID (map key) table row — a parent-map keying constraint, not an entity property — removing a per-entity false positive. (6) A "Files to ignore" subsection excludes embed.go, READMEs, and any non-.schema.json file. (7) Field-description comparison is replaced with a two-tier structural-vs-wording rule to stop scoring paraphrase as drift. The prompt's allowed-tools frontmatter gains Bash(git rev-parse:*), Bash(date -u:*), Bash(make check-schemas:*), and Bash(gh issue list:*); .claude/settings.json gains the matching Bash(date -u:*) entry (the others were already allowed). Closes #837.

• gosec security job now uploads SARIF to Code Scanning — The gosec job in the Security workflow ran gosec -quiet ./... and emitted findings only to the Actions log, so warnings never reached the GitHub Security tab or showed as PR annotations. It now runs gosec -fmt sarif -out gosec.sarif ./... and uploads the result via github/codeql-action/upload-sarif (SHA-pinned to v4.36.1 per the repo's action-pinning policy), gaining a security-events: write permission and the same if: always() && (…head.repo.full_name == github.repository) guard as the govulncheck job in the same workflow — making the two security tools consistent and surfacing gosec findings inline on changed files and in the Security tab. The pre-existing floating upload-sarif@v4 reference in the govulncheck job was SHA-pinned to the same commit in the same pass so both references stay consistent. Closes #343.

• The five check-* drift commands migrated from slash commands to skills — .claude/commands/check-{code,schema,docs}-drift.md, check-examples.md, and check-spec.md become .claude/skills/check-*/SKILL.md (#833), sharing one output contract (.claude/skills/check-suite/findings.schema.json — a single object-wrapper findings-json shape every skill emits) and one severity rubric (.claude/skills/check-suite/severity-rubric.md, the critical | major | minor | info scale). The agreed per-skill improvements are folded in during the move: check-docs-drift drives a dynamic docs/** glob with ADRs excluded and cross-references Known Issues (#829, #800, #831; supersedes #298); check-schema-drift adopts the shared rubric and enumerates schemas dynamically (#838, #986); check-code-drift folds in the agreed #676 prompt improvements and #771's accuracy fixes; check-examples keeps and expands its Step 1 and points Step 4 at the CI cross-reference, treating westeros as an external pointer (#834, #835, #303, #836); check-spec makes the RFC 2119 check tooling-only, adds cross-cutting checks, and delegates snippet validation to glx validate with mktemp-safe cleanup (#314, #315, #847, #849). All five carry model: claude-opus-4-8 frontmatter — the originating slash commands pinned the older claude-opus-4-7, and the value is carried over and refreshed to the current recommended Opus (it had been dropped from four of the five during the move). This records intent, not an enforced runtime pin: unlike a slash command, a skill runs inline in the active conversation, so the model: key does not switch models mid-session — it documents the top-tier model these accuracy-sensitive drift checks are meant to run under, and is forward-compatible if the skills later adopt context: fork. To actually run them on Opus today, invoke them from an Opus session (see .claude/skills/check-suite/README.md). The eval harness (#796) is deliberately not part of this migration: its CI F1-gate conflicts with the "no LLM runs in CI" decision and it needs separate scoping, but its prerequisites (uniform findings-json output and the shared rubric) ship here, so it can be picked up standalone. Invocation moves from /check-* to the skills surface; documented in .claude/skills/check-suite/README.md. (#833, #1016)

Fixed

• The archive cache no longer serves entities from a stale pre-upgrade cache — The cache format version is bumped to 3. The loader's trusted file set changed when dot-prefixed entries stopped being archive content, but nothing else forced a rebuild: the filesystem fingerprint matches for the files both loaders agree on, and locally built binaries all report version "dev", so the version gate was no help. A cache written before the upgrade was served as fresh and replayed the duplicate-ID warnings this release removes, and glx query could return an entity body from a worktree copy while the same command with the cache disabled returned the real one. (PR #1222)

• The cache fingerprint covers exactly the files the loader reads — It skipped only .glx and .git, so its file set was a superset of the loader's. Editing a file inside a dot-prefixed worktree copy flipped the cache to stale and forced a full rebuild even though the loaded archive was byte-identical, and an unreadable dot-prefixed directory made the cache permanently un-buildable while the loader succeeded. (PR #1222)

• A symlinked archive path no longer freezes its cache forever — filepath.WalkDir stats its root without following it, so fingerprinting an archive through a symlink walked zero files and hashed the empty string. That hash never changed, so the cache stayed "fresh" no matter what happened to the archive: glx stats through the link kept reporting persons that had been deleted. The root is now resolved before the walk. (PR #1222)

• glx validate --report validates the archive again — The flag replaced validation rather than gating on it, so glx validate . --report exited 0 on archives that plain glx validate rejects, including duplicate entity IDs and missing required properties. A CI step written with --report was permanently green. Validation now runs first and its failure is returned. (PR #1222)

• Duplicate entity IDs resolve to the same record on every run — When two files defined the same ID, the survivor was picked by Go's randomized map iteration order, so consecutive runs of glx summary on an unchanged archive could return different data, and glx cache build froze one arbitrary winner — letting two developers' caches disagree about the same commit. Files are now merged in sorted path order. The duplicate is still reported as a conflict. (PR #1222)

• glx validate warns when a Media entity points under a dot-prefixed path — Such a file is not archive content, so the reference does not travel with the archive even when the path happens to resolve on the machine that wrote it. The existence check previously reported it as present. (PR #1222)

• .GLX files are no longer invisible — The extension test was case-sensitive while the archive's own .gdz test was not, so on a case-insensitive filesystem a file the user created as PERSON.GLX was neither loaded, counted, nor reported by any command: glx validate called the archive valid and glx stats showed no persons. (PR #1222)

• glx validate counts the files it actually loaded — The count came from a second walk with its own copy of the archive-membership rules, which had already drifted: through a symlinked root it printed "No GLX files found. Validated 0 files." followed by "Archive is valid." while the loader had validated every file. The count is now taken from the loaded file set, and the duplicate walk is gone. (PR #1222)

• Both passes of a single glx validate run agree on what the archive is — The semantic-validation pass walked with no exclusions at all, so a form such as glx validate typo.glx . reported a parse error from a file under a dot-prefixed directory that the first pass had never seen, and emitted every warning from a worktree copy twice. (PR #1222)

• Archive walks skip dot-prefixed directories — A copy of the archive inside a dot-prefixed directory, such as a git worktree checked out under a dot-prefixed directory, made every entity collide with itself: glx validate reported one duplicate-ID error per entity, and every command that loads the archive saw the same conflicts. Dot-prefixed directories and files are no longer archive content: no archive walk descends into one, no loader reads one, and a symlink at a normal path whose target resolves inside one is skipped rather than followed, so a link cannot reintroduce the duplicates. This covers editor and filesystem droppings too — ._person.glx AppleDouble sidecars and .#person.glx lock links previously failed the entire archive load. The archive root itself may still be dot-prefixed. A writer preserves dot-prefixed entries it finds rather than dropping them, so glx merge, glx merge-persons, and glx migrate no longer delete a persons/.drafts/ subtree during their safe-write swap. The rule is now normative in the specification under "Dot-Prefixed Entries". (#1212, PR #1222)

• MediaFileSource.RelativePath normalized to forward slashes; UNC paths classified as non-relative — convertMediaCommon previously stored the raw GEDCOM FILE value into MediaFileSource.RelativePath without normalizing backslashes, producing Windows-style paths (e.g., photos\alpha.jpg) that failed to match POSIX paths or archive/zip entries for library consumers. RelativePath is now slash-normalized at construction. In addition, classifyFileRef now checks for UNC network paths (\\server\share\...) so they are classified as non-relative and preserved as-is in media.URI without generating phantom MediaFileSource copy attempts. Fixes #1139.

• Date parsing consolidated into one calendar-aware parser (go-glx/glxdate); year extraction no longer reads the day of month as the year — ExtractFirstYear returned 1 for 1 JANUARY 1900 and 15 for 15 March 2020, because its month regex only knew upper-case 3-letter abbreviations and GEDCOM import stored such dates raw instead of normalizing them. Since the year feeds temporal-consistency validation, duplicate detection, privacy cutoffs, coverage/gap analysis, and the analyze commands, a wrong year silently corrupted all of them. The root cause was three disagreeing definitions of a valid date (the importer's parseExactDate, the extractor's regexes, and the validator's isValidSimpleDate). All three now funnel through a new glxdate package that is the executable form of the spec's Date Format Standard: glxdate.Parse returns an immutable Date value (Year, Month, Day, Precision, Qualifier, Calendar, IsRange/Start/End, Valid, String), and DateString gains Parse()/Year(). Recovery is limited to what is unambiguous: English month names in any case or length (1 JANUARY 1900, 15 March 2020, March 15, 1850), keyword case/punctuation (Abt 1850, Bet 1880 and 1890, ABT. 1850), spelled-out and circa keywords (about 1850, circa 1850, c. 1841, CIR 1375, before 1900, after 1900), a dash for AND after BET (BET 1675 - 1740), and a range start that borrows the end's year (BET 07 OCT AND 08 NOV 1260) now canonicalize on GEDCOM import (1900-01-01, ABT 1850, BET 1880 AND 1890, BET 1675 AND 1740, BET 1260-10-07 AND 1260-11-08), while numeric day/month forms (15/01/1900), dual years (1731/32), BCE dates, and free text are preserved verbatim and reported by glx validate — the parser never guesses day-vs-month order and never converts calendars. Two GEDCOM forms GLX had no spelling for are now part of the date format: the EST qualifier (estimated from another event's date, a sibling of ABT/CAL, not a spelling of INT) and the BCE era suffix (510 BC → 0510 BCE; Date.Year/ExtractFirstYear return it as -510 so dates order across the era boundary). Dual years (1731/32) remain preserved verbatim pending a decision on their representation. For raw-preserved Gregorian bodies the year is still recovered by preferring a 4-digit token, so already-imported archives get correct years without re-import. GEDCOM's open-start period (TO 1950) is now a GLX form. Calendars are recognized on import in both GEDCOM spellings and at any grammatical position (ABT JULIAN 1731, BET @#DJULIAN@ 1700 AND @#DJULIAN@ 1710, bare GREGORIAN 12 AUG 1401), which previously left most of the GEDCOM 7 date fixture stored raw; GEDCOM 7 export writes the calendar as a tag before each date (ABT JULIAN 1731) instead of a 5.5.1 escape. The glx query, glx cluster, glx timeline, glx serve, and glx summary date helpers now read the parsed date instead of their own regexes, so year filters, chronological sort, and narrative dates agree with glx validate (a raw 1 JANUARY 1900 sorted as year 1 and 0044 BCE sorted after 0010). Unknown calendars now use GEDCOM 7's extension convention: the prefix starts with an underscore (@#DROMAN@ imports as _ROMAN and exports back as @#DROMAN@ for 5.5.1 or as the _ROMAN tag for 7.0), which is what lets the parser tell a calendar from free text. GEDCOM 5.5.1 export writes the era as B.C. and 7.0 as BCE. Also fixed along the way: a full month name in upper case (APRIL 1688) or a free-text word (LIVING 1515, CLASS OF 1905, AFTER 1839 BEFORE 1840) was treated as an unknown calendar prefix and accepted as valid, a Hebrew or French Republican date missing its year (HEBREW 15 TSH) reported the day of month as the year, and validation accepted any string containing a keyword substring (OCTOBER 1850 passed because it contains TO) — date-format warnings now cite the specific reason. The GEDCOM encoding of dates lives in the same package (glxdate.FromGEDCOM, glxdate.Canonicalize, Date.GEDCOM), so GEDCOM export renders from the parsed date instead of re-splitting the stored string: INT dates now export with GEDCOM month spelling (INT 15 MAR 1850 (text) rather than INT 1850-03-15 (text)), a non-canonical body like 1850-3-5 is exported as stored rather than guessed into 5 MAR 1850, and preserved bodies export with keywords upper-cased and whitespace collapsed (abt. 1532 (or by '12?) → ABT 1532 (or by '12?)). The glx timeline/serve/summary sort key is five digits wide so a five-digit Hebrew or extension-calendar year sorts after 9999 rather than before it. The parser is fuzz-tested and verified against a corpus of ~7,000 real-world GEDCOM DATE values sampled by shape from ~700k lines across ~250 files; a golden file beside the corpus pins the parse, stored, and exported outcome of every line. Fixes #1025.

• glx rename rewrites only the files it changes and never swaps the archive directory — On a multi-file archive, rename used to load everything, apply the rename in memory, and write a complete fresh serialization through the temp-directory swap shared with migrate and merge. That had two visible consequences. The archive directory was replaced by a new inode, so a shell sitting in the archive root (or an editor with entity files open) was left pointing at the now-deleted original — ls showed an empty directory until cd . — and every file in the archive was re-emitted in the serializer's canonical one-entity-per-file layout and formatting, so a two-event events/event-births.glx became two files, single-entity files were renamed to match their entity ID, unrelated files picked up indentation and quoting changes, and the standard vocabularies were materialized into vocabularies/. Rename now validates against the whole archive as before (old ID present, new ID free) but then treats each file as an independent fragment: files that neither define nor reference the old ID are not touched at all, files that do are rewritten in place at the same path, multi-entity files stay multi-entity, and only a single-entity file whose name is the old ID is moved to the new name (refusing if that path already exists). Each file write is atomic (temp file plus rename, so a full disk cannot leave a truncated file), and the original bytes of every touched file are held in memory and restored if any write fails, so a failed rename cannot leave the archive inconsistent; recovery state is not persisted across a crash mid-rename, which is the accepted trade against the directory swap. Before anything is written the plan is checked: the new ID must be a valid filename even when its entity lives in a multi-entity file, a symlinked .glx file is refused rather than written through (the loader follows symlinks when reading, so one could otherwise redirect a write outside the archive), a file whose bytes on disk no longer match what was loaded is refused (a concurrent edit, or a Git symlink placeholder on Windows with core.symlinks=false that the loader resolved to its target), and a file move is refused if the target already exists including on case-insensitive filesystems. --dry-run runs those same plan checks, so it fails on a rename the real write would refuse instead of reporting a success the user cannot actually get, and nothing is printed until the plan is known to be applicable, so a failed run no longer emits a success line it did not earn. A plan that targeted the same path twice is refused up front, since the second write would clobber the first and rollback could not restore the state in between. The summary line counts "change(s)" rather than "reference(s)": the number includes the entity's own map key alongside the reference fields it rewrote, and RenameResult.RefsUpdated in go-glx now documents that. On a multi-file archive a new ID that differs only by case from another entity's ID is rejected, since the two would collide on the lowercased filenames the writer derives (renaming an entity to a case variant of its own ID is still allowed and keeps the file's on-disk name; single-file archives, which derive no filenames, are unaffected). File permission bits are preserved on rewrite, move, and rollback, and on the single-file-archive form of the command, so a private entity file never becomes world-readable through a rename. The duplicate-entity-ID warnings this path prints are sanitized for the terminal like every other archive load's (#925), since it deserializes directly rather than through LoadArchiveWithOptions. A file that moves is reported as one touched file rather than two, matching what lands on disk. An archive that defines the same ID under two entity types has only the type RenameEntity selects renamed, matching the previous whole-archive behaviour. Rewritten files still take the serializer's formatting; byte-exact preservation of untouched lines within a changed file is not attempted. Adds RenameInFragment, GLXFile.HasEntity, GLXFile.EntityIDIgnoringCase, and ErrEntityAlreadyExists to go-glx. migrate and merge, which legitimately rewrite most of an archive, keep the swap. Also adds an end-to-end CLI test harness under glx/e2e/ that builds the real binary and runs it as a subprocess; rename is the first command covered, including the run-from-inside-the-archive case from the report. Fixes #1192. Fixes #1197.

• Markdown links now work on GitHub as well as the website — Docs, specification pages, the READMEs and .github/SUPPORT.md linked with website routes (/quickstart, /examples/, /development/contributing) that 404 on GitHub, and the specification omitted the .md extension, which GitHub also does not resolve; 594 links across 94 files are now relative repository paths ending in .md. The website maps those through its rewrites table with a small markdown-it hook (website/.vitepress/relative-links.js), which also repairs 16 relative links that were silently dead on the site (the README's links to CONTRIBUTING, CODE_OF_CONDUCT and SECURITY-POSTURE, the CHANGELOG's GEDCOM migration link, and the README back-link on every entity page). glx docs emits sibling links (glx_add.md) instead of /cli/glx_add, and make check-links now rejects absolute routes and extensionless targets, scans .github/SUPPORT.md, and runs on POSIX awk (it previously required gawk, so it could not run on macOS). Fixes #1196

• Archive loads no longer follow symlinks out of the archive directory (gosec G122 suppressions removed) — collectGLXFilesFromDir (every archive load), validateSingleFilePaths (glx validate <dir>), and tools/driftcheck's schema reader called os.ReadFile on paths discovered by filepath.WalkDir, so a hostile archive containing persons/p1.glx -> ~/.ssh/id_ed25519 had the target's contents read into the load (and potentially re-exported), and a path swapped for a symlink between the walk's lstat and the read (CWE-367) could redirect the read outside the walked root. All three now open the root once with os.OpenRoot and read entries through it (os.Root.ReadFile), which refuses any symlink whose target escapes the root and closes the TOCTOU window; relative symlinks that stay inside the archive are still followed, and an archive directory that is itself a symlink keeps working. One additional restriction comes with os.Root: an absolute symlink is refused even when its target resolves back inside the archive (resolving it ourselves to re-check containment would reopen the TOCTOU window), so such links must be rewritten as relative. The binary archive cache format version is bumped from 1 to 2 so a cache built by the old loader — whose stat-only fingerprint could still match an archive containing an escaping symlink — is rebuilt rather than trusted. The Windows Git-symlink-placeholder resolver in fileops.go reads its target through the same root, so a placeholder pointing outside the archive is left unresolved instead of followed. The three #nosec G122 annotations added in #1050 are gone and make gosec passes with no G122 suppressions. As a consequence the vocabularies/*.glx files in the docs/examples/ archives and the glx/testdata/ fixtures, which were symlinks into specification/5-standard-vocabularies/ and therefore escaped their archive, are now plain copies — matching what glx init scaffolds — with TestExampleVocabulariesMatchStandard failing the build if a copy drifts from the standard vocabulary. Fixes #1090.

• Media path containment no longer follows symlinks out of the archive (glx publish + GEDCOM import) — isPathWithin is a lexical check (Abs/Clean/Rel), so a symlink placed inside the archive or GEDCOM directory whose target lay outside it passed containment and the subsequent read followed the link, copying or embedding the out-of-tree file into the generated site or the imported archive. copyMediaFile (glx import) and the publish media resolver (both the streamed-copy path and the base64 embed path) now open the source through a shared openWithin/readFileWithin helper backed by os.Root, so the lexical guard is complemented by open-time containment: an escaping symlink is refused (import reports the error; publish records the item as missing media, exactly as it does for ../ traversal), while relative symlinks that resolve inside the directory still work. Absolute symlinks are refused even when they point inside the directory, as for archive loads above. Absolute-path and ../ handling is unchanged. Fixes #972.

• Archive-controlled text can no longer inject terminal control sequences into CLI output — glx analyze printed Person.Properties["name"], Place.Name, and other YAML string fields straight to the terminal, so a name containing ESC bytes could clear the screen, recolor or hide earlier findings, or embed an OSC 8 hyperlink. A new sanitizeForTerminal helper replaces terminal control characters (C0 except tab/newline, DEL, and C1 U+0080–U+009F) with their visible \x1b-style escape. Bytes that are not valid UTF-8 are escaped the same way rather than copied through, since a raw 0x9b byte in a Unix filename is a single-byte CSI to terminals that honour eight-bit controls. It is applied in printIssue for the analyzer, to the duplicate-entity-ID warnings every archive load returns (so the two dozen runners that print them, several with a bare fmt.Fprintf, are covered at the source), and at the IOStreams boundary (Printf/Println/Errorf), so every runner that writes diagnostics through IOStreams — validate, summary, search, and the rest — is covered in one place; the root command's Execute also sanitizes any error it prints, since a containment failure's message quotes the offending filename verbatim and every runner's returned error funnels through that one print; MachineOut and --format json output are untouched and remain byte-faithful. Fixes #925.

• Prerelease tags now publish as GitHub prereleases — .goreleaser.yml had no release: stanza, so GoReleaser's prerelease: false default published every -beta tag as a full release; v0.0.0-beta.1 through v0.0.0-beta.11 are all stored as non-prereleases, and /releases/latest resolves to a beta. release.prerelease: auto now flags -alpha/-beta/-rc tags automatically. Existing releases are not retroactively re-flagged (#1216), so /releases/latest will keep pointing at v0.0.0-beta.11; the documented install snippet in the Git workflow guide now downloads from a pinned tag instead, which is the reproducible form it already recommended. Consumers resolving /releases/latest themselves will (correctly) start skipping future betas. (#1007)

• Release workflow hardening — Release runs now carry a per-tag concurrency group (the tag ref is part of the group name) with cancel-in-progress: false, so a duplicate run of the same tag collapses while distinct tags still release in parallel; keying the group on the workflow instead would have dropped releases outright, because GitHub keeps only one pending run per group and cancels the older one — three tags pushed together would lose the middle tag's archives, checksums, signature, attestation and announce. cancel-in-progress stays false because killing a run between asset upload and signing would leave an unsigned release (#1008). The GoReleaser tool version is pinned to a patch-floating minor (~> v2.18) — the action SHA pin covers the action, not the tool binary it downloads, so ~> v2 could build different artifacts from the same source on a later run; the pin is invisible to Dependabot and needs a currency gate (#1215) (#1009). The Discord announce payload is built with jq --arg instead of hand-spliced \" escapes, since the -beta* trigger glob admits any non-slash character and git permits " in a ref name, so a raw tag splice could emit malformed JSON; the tag is @uri-encoded where it lands in a URL, and the github.repository context expression in run: is replaced by the runner-provided $GITHUB_REPOSITORY per the repo's env-staging rule (#1010).

• Git Workflow Guide: three copy-paste snippets that failed when run — All three blocks in docs/guides/git-workflow.md were syntactically valid but broke for a reader who actually ran them, which matters for a guide whose value is that people copy from it. (1) The CI workflow's install step downloaded the release asset as glx.tar.gz but asked sha256sum -c to verify glx_Linux_x86_64.tar.gz, which was no longer on disk — the resulting exit 1 failed the job on every run under GitHub Actions' error-on-exit default, giving anyone who copied the workflow a permanently red validation gate that looked like a rejected checksum; the asset now keeps its published name through download, verification, and extraction. (2) The merge-conflict example put a top-level names: list beside properties:, which glx validate rejects (additional properties 'names' not allowed, the Person schema being additionalProperties: false) — doubly awkward because the same guide wires glx validate into a pre-commit hook a few sections earlier, so a reader who resolved the conflict as shown then could not commit; the name now sits under properties.name with value/fields, matching the Quickstart, with the conflict markers still around occupation. (3) The Research Cycle staged entity directories by name (git add persons/ events/ …), which fails with fatal: pathspec 'persons/' did not match any files (exit 128) on a fresh clone, because glx init creates those directories empty and Git does not track empty directories — it worked on the author's machine and failed for the collaborator, the exact workflow the guide's Collaboration section encourages; now git add -A. The underlying scaffold behavior is tracked separately in #1136. Fixes #1137.

• Spurious "Code scanning configuration error" for gosec and govulncheck — The Security tab reported "Golang security checks by gosec and govulncheck are reporting errors" even though both tools' SARIF uploads succeeded with an empty error field on every recent analysis. The cause was structural, not a broken upload: GitHub treats security.yml as the Code Scanning setup for both Go tools and attributes the conclusion of the whole workflow run to every tool that setup configures — not the conclusion of the job that uploaded the SARIF. security.yml also carried two jobs that upload nothing and are expected to fail as part of normal operation (gosec Pin Currency, which fails by design whenever upstream cuts a release, and npm Audit, which fails on any new moderate advisory in the website's tree), so either one firing flagged both Go tools as broken. Both now live in their own workflows — .github/workflows/gosec-pin-currency.yml and .github/workflows/npm-audit.yml — with triggers, job names, and behavior unchanged; neither was a required status check. security.yml is now exactly the two SARIF-uploading jobs, and the invariant is documented in its header and in .github/CLAUDE.md. Fixes #1145.

• gosec pin bumped to v2.28.0 — .gosec-version was pinned at v2.27.1, so the weekly gosec Pin Currency check was failing as designed. Verified against the tree as CI sees it (GOOS=linux gosec -quiet ./..., matching the ubuntu-latest runner): the v2.28.0 analyzer set introduces no new findings. Fixes #1146.

• All standard source types now survive a GLX → GEDCOM 7.0 → GLX round-trip — The GEDCOM 7.0 exporter writes Source.Type verbatim as the TYPE value, but the importer resolved it only through the short-alias table (vital, church, tax, …), so any canonical key whose alias differs from the key itself (vital_record, church_register, population_register, tax_record, notarial_record) or that had no alias at all (immigration, directory, oral_history, correspondence) re-imported as other. mapSourceType now first checks whether the (case-normalized) TYPE value already is a canonical GLX source type and passes it through unchanged, before consulting the alias table — so every current and future standard type round-trips with no per-key alias maintenance. The per-key identity mappings added for the #563 types in #1004 are superseded by this check and removed. The #1004 round-trip test now covers the full source-type vocabulary, driven from the canonical set so future additions stay covered automatically. Fixes #1005.

• Release builds are reproducible again (main.date now commit-pinned) — .goreleaser.yml embedded the build-invocation timestamp (GoReleaser's .Date template variable) into the binary via -X main.date=..., so two builds of the same tagged commit produced different bytes — defeating the reproducibility the build's other settings (CGO_ENABLED=0, -trimpath, and the .CommitTimestamp-pinned mod_timestamp) are engineered to provide, and failing any rebuild-and-compare supply-chain audit. The ldflag now uses the .CommitDate template variable, pinning the embedded date to the commit like the archive timestamps already were. (Raw GoReleaser template syntax is avoided in this entry because this page is rendered by VitePress, where double-brace mustaches are Vue interpolation.) main.date is display-only (glx version), so the only user-visible change is that the reported date is the release commit's date rather than the moment CI ran. Fixes #1049.

• CI warning-gate in test-conformance no longer races its own log file — The "fail on Warning: stderr" gate in validate-spec.yml captured go test stderr through an async process-substitution tee (2> >(tee … >&2)); bash runs that process list asynchronously and never waits for it, so the grep could inspect the log before tee had flushed warnings written near process exit — a load-dependent false-pass on exactly the signal the gate exists to enforce. Stderr is now captured with a plain synchronous redirect (complete by the time the next command runs), surfaced with cat, and the go test exit code is propagated explicitly. The match was also broadened from line-anchored ^Warning: to (^|[[:space:]])Warning: so indented or mid-line warnings (e.g. from a test logger) are caught too; stderr is deliberately not merged into stdout, so test stdout that legitimately contains the literal string (golden output, t.Log of expected warnings) cannot trip the gate. Fixes #1033.

• website dependencies bumped to clear the npm audit CI gate — vite 7.3.2 → 7.3.5 (lockfile only) patches a high-severity advisory (GHSA-fx2h-pf6j-xcff) and a transitive launch-editor advisory (GHSA-v6wh-96g9-6wx3) that were failing the Security workflow's npm audit --audit-level=moderate job on every PR. (PR #1102)

• Both PreToolUse hooks now actually fire (dead-matcher fix) — Both hooks in .claude/settings.json used a matcher containing special characters ("Bash(git commit*)" from #655 and "Bash(gh api*)" from #912). Claude Code compiles any such matcher to a JavaScript regex and tests it against the tool name ("Bash"), not the command, so neither ever matched and both hooks were dead code. They are now consolidated under a single "matcher": "Bash" group (tool name, exact) with the command pattern moved to each handler's if field — if: "Bash(git commit:*)" and if: "Bash(gh api:*)" — which uses permission-rule syntax against the Bash subcommand, per the documented 2026 hooks schema. (#869, #1014)

  • The golangci-lint handler's inlined shell one-liner was extracted to scripts/claude-hooks/pre-commit-golangci.sh (set -euo pipefail, standalone-runnable, shellcheck-clean) so the logic is reviewable and testable, and it resolves the project root via the documented ${CLAUDE_PROJECT_DIR} rather than the undocumented ${CLAUDE_WORKING_DIRECTORY}. It stays advisory (golangci-lint's exit 1 is non-blocking for PreToolUse); promoting it to a blocking gate is tracked separately in #870. Fixes #869.
  • The gh api mutation gate (scripts/claude-hooks/gh-api-gate.{py,sh}) had been dead since it was introduced (same defect, never shipped in a release), which would have re-enabled auto-approval of destructive gh api calls (GraphQL mutations, REST writes, ref deletion) granted by the Bash(gh api graphql:*) / Bash(gh api repos/genealogix/glx:*) allow rules — the exact bypass #911/#912 set out to close. With the matcher fixed the gate fires: provably read-only calls stay prompt-free, writes prompt (ask), and writes to the git-refs endpoint are hard-blocked (deny). (Note: a read whose output is captured via command substitution — ISSUE_ID=$(gh api graphql …) — now prompts, because the static parser floors any shell-dynamic command to ask; run the bare query if you want it prompt-free.) Its invocation was harmonized to the documented ${CLAUDE_PROJECT_DIR} form, dropping the undocumented ${CLAUDE_WORKING_DIRECTORY} fallback; the fail-closed || exit 2 is preserved. A duplicate Bash(gofmt:*) allow entry was removed in the same pass. Fixes #1014.

• glx validate prints warnings on stderr — Semantic warnings (the "Found N warnings:" line and each ⚠️ item) were written to stdout alongside the validation report; they now go to stderr so stdout carries only the report and stays clean for piping. The validate tests were also corrected so their assertions match the outcomes they exercise. (#939)

• glx merge no longer reports "No new entities to merge." when the incoming archive adds only research logs or studies — TotalNew() and the per-type entity counts omitted ResearchLogs and Studies, so a merge whose only new entities were of those types was treated as a no-op. Both now count them, with a regression test. (#942)

• GEDZIP import rejects oversize entries while streaming — Entry extraction used io.LimitReader plus a post-copy size check; a sentinel-error reader now surfaces ErrGEDZIPEntryTooLarge as soon as the size budget is exceeded, entries of exactly the limit are still accepted, and a redundant absolute-path check was dropped. (#940)

• Website sitemap, robots.txt, and CLI-reference links point at genealogix.io — They referenced genealogix.dev, a domain that no longer resolves, so the sitemap served from the live site sent crawlers to dead URLs and the README "CLI reference" links 404'd. The JSON-LD namespace IRI is intentionally unchanged (it is a wire-format identifier). Fixes #1078 (#1093)

• specification transitive dev dependency fast-uri bumped to 3.1.4 (CVE-2026-13676, CVE-2026-16221) — Lockfile-only bump in specification/package-lock.json of an ajv dependency that failed to canonicalize Unicode/IDN hostnames for HTTP-family URLs, allowing host confusion (GHSA-4c8g-83qw-93j6, GHSA-v2hh-gcrm-f6hx). (#1154)

• glx validate with several paths validates them as one archive — With more than one argument the command used only the first directory as the archive and never read the others, so glx validate persons/ events/ exited 0 with a broken events/. The arguments — directories, .glx files, or a mix — are now loaded together as one archive rooted at the enclosing archive directory (their deepest common directory, or its parent when that is itself an entity directory such as events/ beside other archive directories), so cross-references between them resolve and duplicate IDs across them are caught; the archive's vocabularies/ under that root is included automatically, files that are not .glx are ignored, and references to entities outside the named paths are reported as errors. Paths that share only the filesystem root are rejected. Selected directories are walked as subtrees of that root, so a link from persons/ into a dot directory at the root is skipped exactly as a whole-archive validate skips it, and a directory argument that links out of the archive is refused. Fixes #1244

• Safe write preserves visible symlinks that point into dot-prefixed directories — The loader skips a symlink such as persons/alias.glx -> ../.worktrees/copy/persons/alias.glx, and the serializer never re-emits it, but the safe-write swap only carried dot-named entries across, so glx merge, glx merge-persons, and glx migrate deleted the link with the backup. The swap now recognizes such links from their target text, classifying every entry before any is moved so a chain that passes through a top-level entry is still recognized, and carries them over. Fixes #1245

• Safe write refuses an archive with a top-level .glx file — The loader reads a file such as archive.glx beside vocabularies/ as archive content, but the multi-file writer re-emits its entities under the entity directories and then preserved the original as a foreign file, so glx merge, glx merge-persons, and glx migrate left every entity in it duplicated on the next load. The write is now refused up front, before anything is moved, with an error naming the file. Whether such a layout should be rewritten in place or flattened is tracked in #1247. (PR #1222)

• Safe write no longer duplicates an uppercase managed directory — The loader reads PERSONS/person-1.glx, but the managed-directory check on write was case-sensitive, so PERSONS/ was preserved as foreign next to a freshly written persons/ and every entity came back twice on the next load. The check is case-insensitive now: the uppercase tree is replaced by the canonical one, moving its entities rather than duplicating them, and its MEDIA/files/ binaries are carried across like media/files/. A media/files that is itself a symlink to storage elsewhere is carried across as the link. An archive holding two case variants of media/files/ at once is refused rather than having one deleted. Fixes #1246

0.0.0-beta.11 - 2026-05-27

Added

CLI

• glx analyze sibling-birthplace-outlier consistency check — analyze --check consistency now flags children whose birth PlaceID differs from a strict majority (>50%) of their siblings'. Runs per parent over any sibling group of 3+ children with recorded birthplaces. Severity defaults to medium and is elevated to high when the outlier's parent-child relationship is hypothetical (any assertion about that relationship with confidence tentative, low, or disputed) or when the majority is reinforced by matching a parent's own birthplace while the outlier matches neither. Catches data errors, temporary relocations, and incorrect parent-child assignments that previously passed silently. Distinct from #154 (cross-source disagreement about a single person). (#158)

• glx export --format jsonld — Exports a GLX archive as a single self-contained JSON-LD document using a Schema.org-aligned @context (Person → schema:Person, Event → schema:Event, Place → schema:Place, Repository → schema:ArchiveOrganization, Source → schema:CreativeWork, Media → schema:MediaObject; Citation, Relationship, Assertion, and Participation use the glx: namespace). The canonical context lives at specification/jsonld/glx-context.jsonld and is embedded inline in every export so output is self-contained — no network access required to resolve it. Closes #291

• glx export --privatize-living — Opt-in flag that redacts living persons before writing the exported file. Works for every output format (GEDCOM 5.5.1 / 7.0 and JSON-LD). A person is treated as living when their living: true property is set, or — under the fallback heuristic — when no death, burial or cremation event is recorded for them and their most recent known birth year is less than 100 years before the current wall clock (when a person has multiple, conflicting birth events the most recent parseable year is used, so the filter errs toward redaction). Redaction replaces the person's name with Living, strips all other properties (occupation, residence, religion, sex, etc.), and drops their notes. On every event whose subject is a living person, the date / place / notes / properties are blanked. On every relationship that names any living participant, the relationship's notes / properties are cleared and the referenced start / end events are fully redacted — this covers marriages between living spouses, whose participants carry the non-subject spouse role and would otherwise leak DATE / PLAC / NOTE through the FAM record. On every other event that names a living person as a non-subject participant, per-participant Properties and Notes are scrubbed so fields like name_as_recorded do not leak. Assertions whose subject or participant is a living person are dropped. Free-text fields on Sources / Citations / Repositories / Media are out of scope and must be redacted by hand. Redaction operates on the loaded archive before either exporter runs, so the same guarantees apply to GEDCOM and JSON-LD output; event types and family structure are preserved (GEDCOM FAM, FAMS, FAMC reconstruct; JSON-LD Relationship and Participation nodes still link) so the export stays valid. Closes #288.

• GEDZIP (.gdz) import — glx import now auto-detects .gdz archives by extension and ingests them end-to-end: GEDCOM 7.0 parsing plus extraction of bundled media files into the archive's media/files/ directory. Reuses the existing GEDCOM importer and media-copy pipeline. ZIP entry paths are validated to prevent zip-slip; backslashes, NUL bytes, absolute paths, Windows volume prefixes, symlink-mode entries, and entries whose cleaned case-folded destination paths collide are all rejected. Per-archive entry count is capped at 100,000, and each archive entry's decompressed size is capped at 512 MiB to bound decompression-bomb exposure during extraction. As defense-in-depth, still avoid running glx import on untrusted archives without an external resource limit. (#41, #775)

• Added glx add command family — Create GLX entities (person, place, event, repository, source, citation, relationship, assertion) from CLI flags instead of hand-writing YAML. Each subcommand derives an entity ID from the descriptive flags (overridable with --id), validates supplied vocabulary keys against the archive's vocabularies and entity references against existing IDs, and refuses to overwrite an existing entity unless --force is supplied with --id. Derived IDs auto-suffix -2, -3, … on collision. The created entity ID is echoed on a dedicated machine-output stream (IOStreams.MachineOut) that is NOT silenced by --quiet, so id=$(glx --quiet add person --given Anna --archive .) shell substitution works for scripted workflows. Supports --dry-run for preview and --skip-validate to skip the whole-archive validation pass after writing (vocab and reference checks still run). Closes #712.

• Added --quiet / -q global flag — Suppresses non-error stdout output (success messages, warnings) on commands that have been migrated to the IOStreams abstraction (#679). Currently honored by validate, link, and the media-copy step of import. Errors continue to go to stderr. --quiet is a no-op on commands not yet migrated; remaining runners will adopt it as they're individually migrated. (#681)

• Added glx link command — Create a GLX citation, and (when needed) a FamilySearch repository and source, from a FamilySearch ARK URL. Offline URL-parse MVP of #87: no network I/O, no authentication required. The citation captures the canonical URL, today's date as the accessed date, and the ARK identifier as a structured external_ids entry whose fields.type matches the URI form produced by GEDCOM 7 EXID import (https://www.familysearch.org/ark:/61903/), keeping FS-imported GEDCOM files and glx link-generated citations format-compatible. Accepts full URLs (https://www.familysearch.org/ark:/61903/...), URLs without www, and bare ARK identifiers. Requires exactly one of --source (attach to existing) or --create-source <title> (mint a new source). Supports --text, --locator, and --dry-run. Idempotent — re-running with the same ARK is a no-op once the deterministic citation ID citation-familysearch-<slug> exists. Follow-ups for the remaining #87 scope (unauthenticated HTTP fetch, OAuth PKCE, GEDCOM X JSON extraction, person/event/relationship import) are tracked separately (#87)

• Hidden glx docs subcommand — Generates per-command Markdown reference for every (non-hidden) Cobra command into a configurable output directory (default ./docs/cli/). Used by make docs-cli and the docs-drift CI workflow. Adds github.com/spf13/cobra/doc to the dependency graph (transitive via existing cobra dependency). (#299)

• glx migrate --rename-gender-to-sex — New opt-in flag on glx migrate that renames the legacy gender person property (and related assertions and inlined vocabulary entries) to sex, completing the two-field-model split in pre-v1.0 archives (#528).

• glx migrate --confidence-disputed-to-status — New opt-in flag on glx migrate that moves the legacy confidence: disputed signal to status: disputed per the confidence-vs-status separation (#516). For each assertion with confidence: disputed: clears the confidence field, and either sets status: disputed (when status is empty), leaves the existing status alone (when set to disputed already, or — with a warning — to any other value such as proven / speculative), so the user's research state is never overwritten. Idempotent. (#516)

• glx migrate --source-description-to-property — New opt-in flag on glx migrate that moves a Source's legacy top-level description field into properties.description, completing the structural-field-to-vocabulary-property consolidation for pre-v1.0 archives (#667). An explicit properties.description is never overwritten; the flag is idempotent.

• glx migrate --media-description-to-property — New opt-in flag on glx migrate that moves a Media's legacy top-level description field into properties.description, mirroring the Source treatment from #667 for the remaining structural-vs-property inconsistency on Media (#894). An explicit properties.description is never overwritten; the flag is idempotent. (PR #933)

• glx merge --preview with cross-archive duplicate detection — Preview mode now detects potential duplicate persons across source and destination archives using 7-signal similarity scoring (name, birth/death year and place, shared relationships and events). Configurable via --threshold (default 0.6). Replaces the previous --dry-run flag, which has been removed. (#702, part of #94)

• Added IOStreams type for testable CLI output — New glx/iostreams.go introduces IOStreams{Out, ErrOut io.Writer} following kubectl's minimal pattern. validatePaths() migrated to accept *IOStreams instead of writing directly to os.Stdout/os.Stderr; all 18 validation tests use TestIOStreams() with buffer capture instead of os.Pipe() hacks. Foundation for incremental migration of remaining runners (#682, Fixes #678)

• glx search and glx query recognize ResearchLog and Study entities — Both commands' entity-type lists hardcoded the pre-beta.11 9 types and could not return matches from the two new entity types added in this release. glx search gains searchResearchLogs (covers every Search entry inside a log via searches[i].field paths) and searchStudies; glx query gains queryResearchLogs (status-aware one-line listing) and queryStudies (type/status-aware listing). The diff summarizer (go-glx/diff.go) likewise gained summarizeResearchLog and summarizeStudy so per-entity diff output is no longer a bare ID. Closes the remaining open items in #881. (PR #933)

• Added glx merge-persons <keep-id> <drop-id> command — Consolidates two person entities after glx duplicates flags them as the same individual. The keep-id is retained; the drop-id's properties, notes, and cross-references (event/relationship/assertion participants and assertion subjects) are folded into it in a single atomic operation, then the drop-id person file is removed. Replaces the previous 5–10 hand edits per merge. Multi-value list properties (including external_ids) are unioned with deep-equal deduplication; single-value conflicts default to keep's value and are reported, with --keep-newest / --keep-oldest available to resolve dated conflicts by date. Notes combine per --notes-strategy (append | prefer-keep | prefer-drop, default append). Supports --archive and --dry-run. Closes #718

Documentation

• README.md CLI Commands section — README.md now includes a "CLI Commands" section after the Quick Start that lists every glx subcommand grouped into Archive Management, Import & Export, Exploration, Data Entry, Analysis, and Shell completion, each with a one-line description and a link to the full CLI reference. Closes #466

• Developer Certificate of Origin (DCO) policy — CONTRIBUTING.md now documents the DCO 1.1 and requires contributors to sign off commits with git commit -s. Closes #409

• SECURITY-POSTURE.md self-attestation — New repo-root document attesting GLX's compliance with OpenSSF OSPS Baseline v2026.02.19 at Level 1, with most Level 2 controls also met. Tracks outstanding gaps (#269 SBOM, #424 safe-harbor/embargo, #256 SLSA provenance) and notes EU Cyber Resilience Act applicability for adopters. Surfaced on the website at /development/security-posture and linked from README.md and SECURITY.md. Closes #425

• Architecture Decision Records (ADRs) — Added docs/decisions/ directory with an ADR template, an index, and six foundational ADRs covering YAML as the archive file format, the evidence-first data model (Repository → Source → Citation → Assertion), archive-owned vocabularies, Git-native archives, flexible entity IDs, and the go-glx library's no-I/O rule. CONTRIBUTING.md now describes the ADR practice and when to write one. Closes #416

CI

• docs-drift workflow — New .github/workflows/docs-drift.yml builds the CLI, runs make docs-cli, and fails if git diff --exit-code -- docs/cli/ is non-empty. Catches PRs that change a Cobra command without regenerating its Markdown page. Triggered on changes to **.go, Makefile, or docs/cli/**. (#299)

• Scheduled lychee external-link check — New lychee.yml workflow runs weekly (Mondays 08:17 UTC) and on workflow_dispatch, validating every external URL referenced in specification/**/*.md, docs/**/*.md, and root-level *.md. Broken URLs are reported by creating or updating a single GitHub issue titled "Broken external links detected"; the workflow never blocks PRs. Internal relative links continue to be validated on every PR by scripts/check-links.sh. (#316)

• Cosign keyless signing of release checksums — .goreleaser.yml now signs checksums.txt with cosign keyless (Sigstore / OIDC) at release time, producing checksums.txt.sigstore.json alongside the manifest. Users verify with cosign verify-blob, passing --certificate-identity-regexp '^https://github\.com/genealogix/glx/\.github/workflows/release\.yml@refs/tags/' and --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' so the signature binds to this repo's release workflow — without those flags, verify-blob validates the Fulcio chain, signature, and Rekor inclusion proof but does not constrain which OIDC identity (workflow) or which OIDC issuer the cert attests to, so any valid keyless cosign signature from any GitHub Actions workflow would pass. See SECURITY-POSTURE.md for the full command. Signing the checksum file transitively covers every release artifact via its SHA-256. Complements the planned SLSA build provenance (#256) — signing proves authenticity, provenance proves how the binary was built. (#387)

Project Infrastructure

• Added public/.well-known/security.txt — RFC 9116 machine-readable security-contact file served at /.well-known/security.txt. Points security scanners and researchers to the GitHub Security Advisories report channel and SECURITY.md policy. (#271)
• Added .github/SUPPORT.md — Surfaces GitHub's "Support resources" link on the new-issue flow, directing support questions to Discussions, Discord, and the mailing list instead of the issue tracker. (#423)
• PR template changelog reminder — .github/PULL_REQUEST_TEMPLATE.md now ends with an HTML-comment reminder to update CHANGELOG.md for user-facing changes (Added/Changed/Fixed/Removed). (#363)
• PR template Review focus section — .github/PULL_REQUEST_TEMPLATE.md now includes a "Review focus" section after "Related issues", prompting PR authors to state what reviewers should pay attention to (e.g. "API design", "correctness", or "trivial change"). (#362)
• Added public/robots.txt and VitePress sitemap — VitePress now emits /sitemap.xml (hostname https://genealogix.dev), and public/robots.txt allows all crawlers and points to it. srcExclude was also added to keep vendored node_modules/**/*.md out of the build and sitemap. (#282)

Specification

• ResearchLog entity type — New entity for tracking research investigations, including searches that found nothing (negative evidence). Each log carries an optional subject (Person/Event/Relationship/Place EntityRef), objective, status, and an embedded list of Search entries (one per query) that reference the repository/source searched, the result (found/not_found/inconclusive/partial/not_searched), and the citation produced when something was located. Two new standard vocabularies — search_result_types and research_log_status_types — back the validated string fields. ResearchLog.Date and Search.Date participate in the same date-format validation as Event/Source/Media/Assertion dates. The shape supports the Genealogical Proof Standard requirement for a "reasonably exhaustive search" by promoting "searched X, target absent" from freeform notes to a queryable structure. No GEDCOM mapping (research process is researcher-state, not source data). CLI commands (glx log add/list/report) are tracked separately. Closes #224, supersedes #89.
• living person property — New standard person property (value_type: boolean, no GEDCOM mapping) used as an explicit privacy opt-in marker. When set to true, every export privacy filter (currently glx export --privatize-living) must treat the person as living; when false, the filter must treat the person as not living and skip the date-based heuristic. Closes #288.
• possibly_same_person relationship type — New standard relationship type for linking two person records that may refer to the same individual but cannot yet be confirmed; pair with an Assertion subject-referencing the relationship to record confidence and supporting citations. No direct GEDCOM mapping. Closes #227.
• Study entity type for research-project scope — New first-class entity that formally declares the scope of a research project within an archive: One Place Studies, One Name Studies, family reconstructions, descendancy/ancestry studies, and brick-wall investigations. Fields: title, type (validated against new study_types vocabulary), status (validated against new study_statuses vocabulary), date_range (GLX date string, e.g., FROM 1610 TO 1875), places (Place refs), sources (Source refs), properties (vocabulary-extensible), and notes. Replaces the prior workaround of recording scope informally in Place notes, making study scope machine-readable so tooling can report coverage and progress. GLX-native; no GEDCOM equivalent. Closes #226.
• associate and boarder relationship types; associate, household_head, boarder participant roles — Standard FAN (Friends, Associates, Neighbors) research types: associate for durable social connections (friends, colleagues, repeat witnesses, migration companions) and boarder for non-family household members in an asymmetric head-of-household + dependent relationship (boarder, lodger, ward, servant). Distinct from housemate (symmetric cohabitation) and apprenticeship (trade-training). Three new relationship-only participant roles complete the model. Existing neighbor and employment types already covered two of the four scenarios from #171; this fills the remaining gaps. Enables FAN-traversal use cases including glx cluster (#111), glx migrations (#114), and analyze FAN detection (#159). Closes #171.
• external_ids property added to place_properties — Standard property for cross-system place identifiers (GeoNames, Wikidata, OpenStreetMap, etc.), mirroring the existing external_ids pattern on person, source, citation, and repository properties. Multi-value with a type field for the issuing authority. Maps to GEDCOM 7.0 PLAC.EXID. Closes #536
• name_as_recorded property added to event_properties and relationship_properties — Standard structured property for the participant's name exactly as written in the source backing the event or relationship. Captures source-specific renderings (Latin-genitive forms in 18th-century parish registers, abbreviations, transcription quirks) on event.participants[].properties and relationship.participants[].properties rather than as a temporal variant on the Person entity. Mirrors the field shape of person_properties.name (prefix, given, surname_prefix, surname, suffix). Closes #714
• repository-types.glx GEDCOM mappings added — Added gedcom: fields to nine of the ten standard repository types (archive, library, church, database → online, museum, registry, historical_society → society, university, government_agency → government); other is intentionally left unmapped as the fallback target for unrecognized values. The hardcoded gedcomRepositoryTypeMapping map in go-glx/constants.go has been removed and the mapping is now read from the vocabulary at import time, bringing repository-types in line with how every other vocabulary handles GEDCOM tags. Closes #555.
• Enslavement relationship metadata model enriched — The enslavement relationship type's description in relationship-types.glx now documents the per-enslaver temporal-bounds pattern and inherited-enslavement modeling (children of enslaved mothers). Two new participant roles (enslaver, enslaved_person) are added to participant-roles.glx and exposed as Go constants in go-glx/constants.go. A new legal_status relationship property (vocabulary_type: legal_statuses) is backed by a new legal_statuses standard vocabulary (chattel, indentured, debt_bondage, apprenticeship) — file specification/5-standard-vocabularies/legal-statuses.glx plus matching JSON schema, embedded in go-glx alongside the other standard vocabularies and validated through the existing vocabulary_type validation path. specification/4-entity-types/relationship.md gains an "Enslavement Relationship" usage section covering the simple, multiple-enslavers-over-a-lifetime, and inherited-enslavement patterns, with further-reading links to Enslaved.org and Beyond Kin. Closes #547.
• unresearched assertion status value — Added unresearched to the documented common values for the assertion status field, distinguishing claims that have not yet been investigated from speculative claims that have weak evidence. Status remains free-text by design; this only extends the documented examples and adds a worked usage in the assertion-workflow example archive. Closes #649.
• confidence-levels.glx rank field — Optional integer field on confidence-level vocabulary entries that establishes upgrade/downgrade ordering. The four standard levels now carry rank: 0-3 (low=0, disputed=1, medium=2, high=3), matching the previously-hardcoded confidenceRank map in go-glx/diff.go. Archives that extend the vocabulary with custom levels (e.g. very_high, tentative) can now participate in glx diff confidence-upgrade detection by supplying a rank value; previously these custom levels were silently ignored by the upgrade/downgrade counters. The hardcoded ordering remains as a fallback for archives loaded without their vocabulary (e.g. fixtures that construct *GLXFile directly), so behavior is unchanged for the standard levels. Closes #517.

Tooling

• make fix and make fix-diff targets for Go 1.26 modernizers — make fix runs golangci-lint run --fix across the repository to apply modernizer auto-fixes; make fix-diff previews the changes without writing. Lets contributors adopt new modernizer rules in one batch instead of hand-editing each call site. (#789, Closes #442)

• Pre-commit hooks via lefthook — lefthook.yml defines pre-commit jobs that, when Go files are staged, run golangci-lint (flagging only issues introduced since HEAD) and, when JS/Vue files under website/.vitepress/ are staged, run eslint on those staged files. Install with make install-hooks. Catches lint issues locally before they reach CI; skip a single commit with LEFTHOOK=0 git commit .... (#280)

Tests

• Round-trip validation tests for example archives — go-glx/example_archives_roundtrip_test.go walks every archive under docs/examples/ (single-file or multi-file), runs it through deserialize → re-serialize, validates each entity in the re-emitted output against its per-entity JSON schema (person.schema.json, event.schema.json, etc.), and asserts that the parsed-input YAML map equals the parsed-output map. The map-level comparison catches omitempty drops that struct equality cannot detect. (#296)
• Regression tests pinning value_type enforcement on temporal properties — go-glx/validation_temporal_test.go now covers all three temporal-value shapes (simple value, single {value, date} object, list of objects) for properties declaring value_type: integer, asserting a warning is emitted when the value's runtime type doesn't match. Locks in behavior already implemented in validateTemporalItem. Closes #668.
• Regression tests for glx search repository address fields — glx/search_runner_test.go now populates the shared search fixture with a Repository entity and asserts that searchArchive matches against state, postal_code, and country. Locks in behavior already implemented in searchRepositories (glx/search_runner.go). Closes #619.

Changed

• devcontainer: move provisioning into the prebuild-cached lifecycle phases — go mod download and both npm ci runs (specification/, website/) moved from postCreateCommand to updateContentCommand, and the golangci-lint install moved to onCreateCommand; postCreateCommand removed (no user-scoped steps). postCreateCommand is not executed during a Codespaces prebuild, so the previous placement re-ran every dependency download on each codespace creation. The new mapping bakes the tool install into the prebuild and refreshes the content-derived deps when go.sum/package-lock.json change. With prebuilds disabled the same steps still run during container creation, just in earlier lifecycle phases, so the provisioned environment is functionally unchanged. (#883)

• glx analyze consolidates parent-child census suggestions — When both a parent and a minor child (under 18 at the census year) are missing the same US federal census, the parent's suggestion now lists the children covered (— would also cover: <Child Name> (~<age>), ...) and the children's independent suggestions for that year are suppressed. A single search of the parent's record covers everyone in the household, so consolidating the suggestion makes the research direction clearer. Children remain independently suggested when the parent already has a census event for that year. Closes #161.

• basic-family example renamed to use descriptive person IDs — Replaced role-based IDs (person-mother, person-father, person-bob) with name-based IDs (person-mary-thompson, person-robert-thompson, person-alice-thompson, person-robert-thompson-jr) to match the project's example-best-practice guidance and the convention already used in complete-family/. Also corrected the son's name to "Robert Thompson Jr." with a structured suffix: "Jr." field, matching the README's "Robert Jr." description. Person filenames were renamed in lockstep with their IDs, and rel-parent-bob.glx/rel-parent-bob were renamed to rel-parent-robert-jr.glx/rel-parent-robert-jr to drop the lingering nickname. Closes #577.

• CLI reference is now auto-generated — Replaced the ~1,200-line manually-maintained "Commands" section in glx/README.md with a short pointer paragraph linking to the auto-generated pages under docs/cli/. The VitePress /cli route now serves a hand-written docs/cli/index.md overview instead of the README; per-command pages live at /cli/glx_init, /cli/glx_validate, etc. (file-per-command, replacing the previous single-page anchor links like /cli#glx-init). The website sidebar in website/.vitepress/config.js was rewritten accordingly and now also covers the previously-unlisted duplicates, coverage, diff, rename, and completion commands. (#299)

• BREAKING: Removed disputed from the standard confidence_levels vocabulary — disputed was conflating two distinct axes: confidence reflects evidence quality (high / medium / low), while disputed describes a conclusion state (sources conflict, resolution unclear). Disputed is now documented on the assertion status field alongside proven, speculative, and disproven. The standard vocabulary is now 3 entries (high / medium / low); archives may still extend the vocabulary with custom levels, including disputed if they prefer that wire-format. Wire-format breaking: archives that retain confidence: disputed against the standard vocabulary will produce an out-of-vocabulary warning. The numeric ranking in go-glx's confidenceRank (used to detect upgrades/downgrades in glx diff) and the per-level display order in glx report and glx stats are low=0, medium=2, high=3 (rank 1 left open for custom levels such as tentative); pre-existing disputed values fall through to the "unknown level" branches and no longer count as confidence transitions. Archives predating this change can be migrated via glx migrate --confidence-disputed-to-status. Closes #516.

• BREAKING: Split gender property into sex (recorded) and gender (identity) — The existing gender property conflated "recorded sex" (GEDCOM SEX) with "self-identified gender identity". Introduced a new sex_types vocabulary (male, female, unknown, not_recorded, other) bound to a new sex person property that maps to GEDCOM SEX. The gender_types vocabulary now covers identity values (male, female, nonbinary, other) bound to the repurposed gender property (no direct GEDCOM mapping — GEDCOM 7.0 defers identity to FACT). GEDCOM import/export, HUSB/WIFE assignment, census parsing, and CLI readers (vitals, summary) all updated to prefer sex with legacy gender fallback. Archives predating this split can be migrated via glx migrate --rename-gender-to-sex. Wire-format breaking: archives using gender: "unknown" produce an out-of-vocabulary warning post-split (unknown now lives only in sex_types). Resolves #528. Closes #518. Closes #534.

• BREAKING: Demoted Source description from a top-level structural field to the properties.description vocabulary property — resolving the cross-entity structural-vs-property inconsistency, since Relationship, Event, and Place already model description as a property. description is removed from the top level of source.schema.json and added to the source-properties.glx standard vocabulary; the Go Source.Description struct field is removed, and GEDCOM SOUR.TEXT/SOUR.NOTE import/export now round-trips through properties.description. A backward-compatibility loader folds any legacy top-level description: into properties.description on read (an explicit properties.description always wins), so existing archives are never silently truncated; glx validate still flags the old top-level form against the schema. Wire-format breaking: archives with a top-level source description: can be migrated via glx migrate --source-description-to-property. In JSON-LD export, Source description now serializes under the glx: namespace (consistent with the other property-based entities) rather than schema:description. Closes #667.

• BREAKING: Demoted Media description from a top-level structural field to the properties.description vocabulary property — finishing the cross-entity consolidation #667 began for Source. Media was the last entity still modelling description as a structural field; it now joins Source, Relationship, Event, and Place in modelling description as a vocabulary property. description is removed from the top level of media.schema.json and added to the media-properties.glx standard vocabulary; the Go Media.Description struct field is removed. A backward-compatibility loader folds any legacy top-level description: into properties.description on read (an explicit properties.description always wins), so existing archives are never silently truncated; glx validate still flags the old top-level form against the schema. Wire-format breaking: archives with a top-level media description: can be migrated via glx migrate --media-description-to-property. In JSON-LD export, Media description now serializes under the glx: namespace (consistent with the other property-based entities) rather than schema:description. Also corrected the Media GEDCOM mapping documentation: OBJE.NOTE has always routed to the notes field on import (not description), and the media.md mapping table is now consistent with the importer. Closes #894. (PR #933)

• participant-roles.glx clarified principal and subject as synonyms — The previous wording described subject as "preferred over 'principal'", which was misleading about the intended contract. The two role descriptions now state that principal is the canonical term and subject is an accepted synonym. glx init and GEDCOM import emit principal; some paths (e.g., census import's empty-role default) emit subject. Tooling treats both as equivalent and no data migration is required. Fixes #523.

• person-properties.glx GEDCOM mappings completed — Added gedcom: tags to name (NAME), sex (SEX), and residence (RESI); documented gender, ethnicity, race, and primary_name as having no direct GEDCOM equivalent via inline comments. Closes #533.

• relationship-types.glx GEDCOM mapping coverage documented — Documented step_parent, godparent, partner, guardian, neighbor, coworker, housemate, apprenticeship, employment, enslavement, and relative as having no direct GEDCOM equivalent via inline comments, with rationale for step_parent (PEDI sealed is mapped to generic parent_child per specification/4-entity-types/relationship.md and go-glx/gedcom_converter.go), godparent (GEDCOM 7.0 ASSO ROLE GODP is consumed as a baptism event participant role, not a standalone relationship), and partner (MARR TYPE is collapsed into the marriage relationship plus a marriage_type event property by the importer). Closes #544.

• SECURITY.md Security Measures section reorganized into three subsections covering all five active controls — Vulnerability Scanning, Dependency Management, and Code Scanning replace the previous brief flat list (govulncheck, gosec, weekly-scan note). Newly documented: npm audit, Dependabot, and dependency-review-action. Closes #475

• source-properties.glx clarified url vs citation url — The previous description didn't distinguish the source-level URL (collection or database landing page) from the per-record citation URL, leaving readers looking for "where to put a permalink to a specific record" with no signal. The description now names the source-level intent and redirects record-specific URLs to the citation url property. Closes #560.

• Devcontainer and CI use .golangci-lint-version as the single source of truth for the linter version — The new top-level .golangci-lint-version file (currently v2.12.2) is consumed by .github/workflows/lint.yml (via golangci-lint-action's version-file: input) and by the devcontainer's go-tools onCreateCommand (via tr -d '[:space:]' < .golangci-lint-version, validated against ^v[0-9]+\.[0-9]+\.[0-9]+$ before URL interpolation as defense-in-depth, with a trap to clean up the install-script temp file on every exit path). Stops the silent CI/devcontainer drift that previously had the workflow floating v2.11 while the container was frozen at v2.11.4. The lint workflow's paths: filter now also includes .golangci-lint-version and .github/workflows/lint.yml itself, so version bumps and workflow edits get exercised by CI on the PR that introduces them. The devcontainer also now calls make install-hooks at create time, so fresh Codespaces have lefthook pre-commit hooks installed without contributor intervention; the Makefile install-hooks target now pins lefthook via LEFTHOOK_VERSION ?= v2.1.8 (overridable) instead of @latest, keeping container creations reproducible. VS Code customizations gain dbaeumer.vscode-eslint, eslint.workingDirectories: ["website"], editor.formatOnSave: true, and per-language editor.defaultFormatter settings so in-editor feedback matches make lint and CI. CONTRIBUTING.md's "all other tooling pre-configured" sentence is narrowed: goreleaser is release/maintainer-only and intentionally not bundled. .gitattributes pins LF line endings on the new file so a Windows checkout with core.autocrlf=true can't sneak a \r into the install URL. Closes #272.

• Place schema enforces latitude ↔ longitude co-dependency — A Place may carry both coordinates or neither, but setting one without the other is meaningless (a point requires two axes). The schema now expresses this with a draft-07 dependencies clause, so glx validate and make check-schemas reject half-set coordinate pairs. Archives with both or neither are unaffected; the *float64 Place struct representation is unchanged. Closes #509.

go-glx

• Unified 9 vocabulary structs into a single VocabularyEntry type — EventType, ParticipantRole, ConfidenceLevel, RelationshipType, PlaceType, SourceType, RepositoryType, MediaType, and GenderType have been replaced by one VocabularyEntry struct carrying the union of their optional fields (GEDCOM, Category, MimeType, AppliesTo). The YAML wire format (.glx files on disk) is unchanged; consumers of *EventType etc. must switch to *VocabularyEntry. Closes #504

• Unified slug generation under an options-based Slugify API in go-glx — Added glxlib.Slugify(s, opts...) with WithSlugPrefix, WithSlugSuffix, WithSlugMaxLength, and WithSlugFallback, plus the ergonomic wrapper glxlib.EntityID(prefix, text). Replaces the two duplicate slug helpers in main (go-glx/census.go::slugifyString and glx/link_runner.go::slugifyForID) and the two parallel truncation paths (truncateID / truncateIDWithSuffix in go-glx/census.go, trimToMaxLen in glx/link_runner.go). Also exports EntityIDPrefix{Person,Relationship,Event,Place,Source,Citation,Repository,Assertion,Media} and the canonical MinEntityIDLength/MaxEntityIDLength constants from go-glx; the duplicates that lived in glx/validator.go and the entity-prefix string literals scattered across glx/add_runner.go, glx/link_runner.go, glx/migrate_runner.go, go-glx/datagen.go, and go-glx/gedcom_utils.go now resolve through these. Closes #720

Dependencies

• Replaced JSON Schema validator library — Migrated glx/validator.go (Pass 1 structural validation) and go-glx/example_archives_roundtrip_test.go from the unmaintained github.com/xeipuuv/gojsonschema v1.2.0 (last release 2020) to the actively-maintained github.com/santhosh-tekuri/jsonschema/v6 v6.0.2. Behavior preserved: same compile-once schema cache, same []string issue list. Drops the stale xeipuuv/gojsonpointer and xeipuuv/gojsonreference indirect dependencies (both pinned to 2018/2019 pseudo-versions). Error messages from invalid GLX files are reworded by the new library; no external code parses these strings. Closes #675; supersedes #268.

Developer Experience

• Tightened markdownlint MD033 from disabled to strict + per-file allow-list — .markdownlint-cli2.jsonc now leaves MD033 (no-inline-html) at its strict default. The only page in the linted scope (specification/**/*.md, docs/**/*.md, root *.md) that needs raw HTML — specification/5-standard-vocabularies/README.md, which embeds <script setup> and <YamlFile /> — declares its own allow-list inline via a markdownlint-configure-file directive. (website/standard-vocabularies.md uses the same constructs but is outside the lint globs.) Stray inline HTML anywhere else (e.g., an accidental <div>, <iframe>, or even a <script> outside that one page) is once again caught by lint. Closes #740

• Concurrency groups added to PR-triggered workflows — validate-spec.yml, check-links.yml, security.yml, dependency-review.yml, and lint-pr-title.yml now declare workflow-level concurrency groups with cancel-in-progress: true, so pushing multiple commits to a PR branch in quick succession cancels stale runs and reduces wasted CI minutes. auto-resolve-conflicts.yml, auto-update-branches.yml, and lint.yml already had appropriate concurrency configs and are unchanged. Closes #346

• gocritic now runs performance tag checks — .golangci.yml adds enabled-tags: [performance] to the gocritic settings, surfacing hugeParam (parameters >80 bytes passed by value), rangeValCopy (large value copies in range loops), appendCombine (sequential append chains), equalFold (strings.ToUpper(x) == "Y" → strings.EqualFold), and stringXbytes (string(b1) != string(b2) → bytes.Equal). Existing call paths flagged in glx/{analyze,link,migrate,query,report,vitals}_runner.go and go-glx/{census,datagen,gedcom_encoding,gedcom_individual,gedcom_name}.go were updated to take pointers, combine appends, or use the byte-equality helper. The go-glx.PersonName.FormatFullName value receiver is preserved (and the line marked //nolint:gocritic) to keep getName().FormatFullName() callers compiling. Note: the issue (#379) literally proposed [diagnostic, style, performance], but on golangci-lint v2.11 only the performance tag is genuinely new — diagnostic is the upstream default and style would have been a separate scope (53 additional findings). Closes #379. Supersedes the gocritic portion of #361.

• nolintlint enforces //nolint directive discipline — .golangci.yml enables the nolintlint linter with require-explanation: true and require-specific: true, so every //nolint directive must name the specific linter(s) it suppresses and carry an explanatory comment. Annotated the 12 previously-bare complexity suppressions (gocyclo/gocognit on the GEDCOM conversion functions plus validatePaths) — narrowing one of them (detectGEDCOMVersion) to gocognit only, since gocyclo does not fire there — and removed two directives that suppressed nothing: a dead //nolint:gocyclo on loadVocabulary, and a //nolint:errcheck in archive_io_test.go whose statement was refactored to t.Chdir (errcheck is path-excluded for _test.go). allow-unused: true is set for now: nolintlint's unused-directive check additionally surfaced 15 pre-existing redundant //nolint:mnd directives, tracked for cleanup in #902. Closes #375. Supersedes the nolintlint portion of #361.

• /check-docs-drift slash command invokes the real validator on extracted YAML snippets — Step 2 ("Example Code Blocks in Documentation") of .claude/commands/check-docs-drift.md previously asked the LLM to mentally simulate JSON-schema validation of YAML examples embedded in docs. It now runs mktemp -d /tmp/glx-drift-XXXXXX, captures the printed path, uses the Write tool to save the snippet to <TMPDIR>/snippet.glx (avoiding all shell-quoting concerns around YAML bodies containing $, backticks, or quotes), runs ./bin/glx validate on the file, and cleans up the scratch directory per-snippet via rm -rf <TMPDIR> (literal path, so the command unambiguously matches the allow-list entry and concurrent runs of the slash command don't race on a shared cleanup glob). The prompt's allowed-tools frontmatter gains the Write tool plus Bash(mktemp -d /tmp/glx-drift-*:*), Bash(./bin/glx validate:*), and Bash(rm -rf /tmp/glx-drift-*:*) (all narrowly scoped); .claude/settings.json permissions.allow gains the matching mktemp and rm entries. Validator exit code is reported as a single deterministic verdict (exit 0 → passed structural + semantic validation; any non-zero → CRITICAL, with the validator's stderr surfaced verbatim for human-review triage) — the prompt deliberately does NOT ask the LLM to second-guess the validator by inspecting top-level YAML keys, since that would re-introduce the exact LLM-simulation anti-pattern this change removes. #910 tracks --stdin --entity-type flags so fragment-shape doc snippets (which currently trip (root): additional properties errors even when correct) can be validated directly. Closes #832.

Removed

• Removed glx merge --dry-run — The --dry-run flag on glx merge (added in beta.10, #264) has been removed in favor of --preview, which supersedes it with richer output including cross-archive duplicate detection. (#702)

• BREAKING: Removed unused random filename helpers from go-glx — GenerateRandomID, GenerateEntityFilename, GenerateUniqueFilename, and the ErrUniqueFilenameFailed sentinel are deleted. They were superseded by EntityIDToFilename (#699) and had no remaining callers in go-glx; the glx migrate deprecated-property path that used GenerateRandomID for synthetic event-<8hex> IDs now does so via a small private helper in glx/migrate_runner.go. External consumers of github.com/genealogix/glx/go-glx that imported any of the four removed symbols will need to migrate to EntityIDToFilename (for filename derivation) or vendor the deleted helpers. Closes #697

Fixed

• Entity-ID slugs now NFC-normalize input before the German digraph layer — go-glx/id_slug.go::slugifyOnce ran germanSlugReplacer.Replace(s) directly on the input, which keys on the precomposed German umlauts (ü = U+00FC, …). Decomposed input — a base letter followed by U+0308 COMBINING DIAERESIS, as produced by some macOS/HFS+ filesystem sources and a few clipboard paths — does not match those keys, so the umlaut slipped past the digraph layer and was then reduced to a bare vowel by the subsequent NFKD + combining-mark strip (München → munchen instead of muenchen). The pipeline now composes to NFC first, so digraph expansion is robust to input normalization form. Closes #896

• Non-ASCII characters in entity-ID slugs now transliterate to ASCII instead of being stripped — Any code path that derives an entity ID from free text (glx link --create-source, glx add {person,place,event,...}, census import) previously ran a [^a-z0-9]+ regex after lowercasing, which collapsed every non-ASCII character to a hyphen. glx link --create-source "Deutschland, ausgewählte evangelische Kirchenbücher 1500-1971" minted source-deutschland-ausgew-hlte-evangelische-kirchenb-cher-1500-1 — the ä/ü became lone hyphens, leaving partial gibberish. The slugifier now applies a two-layer transliteration before the regex: a small replacer for German digraphs (ä→ae, ö→oe, ü→ue, ß→ss, plus uppercase forms) followed by NFKD decomposition with combining-mark stripping (covers Mn/Mc/Me categories, so é→e, ñ→n, å→a, and compatibility characters that decompose to ASCII such as the ligature fi→fi). The same input now mints source-deutschland-ausgewaehlte-evangelische-kirchenbuecher-1500 — the full transliterated body would be deutschland-ausgewaehlte-evangelische-kirchenbuecher-1500-1971 (62 chars), but after the 7-char source- prefix the 64-char entity-ID cap trims -1971 from the tail, leaving a 57-char body. Net: the surviving slug body is readable, deterministic, and matches German orthographic convention, even when the prefix budget forces some truncation. Non-Latin scripts (CJK, Arabic, etc.) still fall through the regex strip to unknown (or to a deterministic hash fallback at the call site) — fixing that is out of scope. Closes #720

• RenameEntity now traverses ResearchLog cross-references — go-glx/rename.go::findEntityType, moveMapKey, and updateAllRefs all skipped the ResearchLogs map, so renaming a research log was rejected as "not found" and renaming a referenced Person/Event/Relationship/Place/Repository/Source/Citation left stale IDs inside ResearchLog.Subject (a *EntityRef — guarded for nil), each embedded Search's RepositoryID / SourceID / CitationID, and the log-level Citations slice. Rename now handles all of these. Raised by Copilot review on PR #818.

• glx diff now reports ResearchLog additions, modifications, and removals — go-glx/diff.go::DiffArchives and entityTypeOrder, and glx/diff_runner.go::sortedEntityTypes, all omitted EntityTypeResearchLogs, so changes to research logs were invisible in CLI and library diffs. All three lists now include research_logs (sorted after media to match the GLXFile field order). Raised by Copilot review on PR #818.

• JSON Schema vocabulary refs now point to the inner type definition — Every vocabulary property in specification/schema/v1/glx-file.schema.json (event_types, relationship_types, place_types, repository_types, participant_roles, media_types, confidence_levels, source_types, sex_types, gender_types, legal_statuses, study_types, study_statuses, search_result_types, research_log_status_types, all *_properties — 23 entries in total) previously $ref-ed the entire vocabulary schema file, which requires a wrapper key (e.g. { "event_types": { ... } }). Under standard JSON Schema semantics this means each entry's value (e.g. { label: "Birth", category: "lifecycle" }) would fail to validate. The Go validator papered over this with a resolveVocabularyRef heuristic that walked into the wrapper to extract the inner entry schema, but tools that follow the spec literally produced spurious errors. Each ref now points at the named definitions/<Name>TypeDefinition (or definitions/PropertyDefinition for property vocabularies) inside the wrapper schema, matching standard JSON Schema semantics. glx/validator.go::resolveFileRef now honors a #/… JSON Pointer fragment on a file ref so the Go validator follows the same path. Raised by Copilot review on PR #818.

• Multi-file serializer emits forward-slash archive paths on every platform — serializeEntitiesWrapped and the vocabulary writer in go-glx/serializer.go previously used filepath.Join to build map keys for the multi-file output (e.g., persons/person-001.glx). On Windows this produced backslash-separated keys (persons\person-001.glx), breaking lookups in tests and consumers that expect archive-style relative paths. The serializer now uses path.Join (always /) and the deserializer correspondingly uses path.Ext for extension detection. Closes #817

• glx summary resolves the residence person-property to its place name — Under "Life Events", a residence value (a place reference per reference_type: places in person-properties) printed as the raw entity ID (e.g. place-pohlgoens), while place references on vital events resolved to the place name (e.g. Pohl-Göns) in the same output. printLifeEventsSection now resolves any person-property declared reference_type: places through resolvePlaceName — covering plain-string, single-{value, date}, and temporal-list shapes (the (date) annotation is preserved) — and falls back to the raw ID when the referenced place is missing. Detection is vocabulary-driven, so a non-place property whose value happens to match a place ID is still shown verbatim. Single-file archives, which (unlike directory archives) do not merge standard vocabularies on load, now do so in the summary load path, so residence resolves regardless of archive form. Closes #897

• glx merge now carries source media binaries into the destination, and the safe-write swap no longer destroys the destination's existing media binaries — Two bugs in one for multi-file archives. (1) mergeArchives previously merged only YAML entities and never touched media/files/*, so source binaries were silently left behind and every Media URI imported from the source pointed at a missing file. (2) safeWriteMultiFileArchive (used by glx merge, glx migrate, glx rename, and glx merge-persons) wrote a fresh tmpDir, swapped it into place, and then deleted the backup — and because media/ is in archiveManagedTopLevel the restoreForeignEntries step did NOT carry the original media/files/* binaries across, leaving every Media URI in the destination dangling regardless of merge. The merge runner now plans source binary copies against the destination's existing media/files/ before the entity merge, deduplicating by content (skip when source and destination files have identical SHA-256) and renaming on name collisions (photo.jpg → photo-2.jpg, matching the GEDCOM importer's convention) with corresponding URI rewrites on the merged Media entities. Source binaries are copied after the safe-write completes; planned copies whose Media entity didn't survive the merge (ID conflict — destination's version kept) are skipped rather than left orphaned. safeWriteMultiFileArchive now moves <backup>/media/files/ into the freshly-written destination as part of the swap, and removeStaleBackup refuses to delete a .bak that still contains unrecovered media binaries (media/files/*) — the same recovery posture already in place for foreign top-level files. Single-file destinations cannot hold binaries, so source binaries are not copied in that case and the runner emits a stderr warning so the user knows the merged Media URIs will dangle. Closes #593

• glx duplicates renormalizes scoring across the dimensions that actually have data — The 7-signal scoring model in go-glx/duplicates.go previously summed weight * score over all dimensions with a fixed denominator of 1.0, so a name-only exact-match pair (e.g. parents identified on a child's birth record but otherwise unresearched) capped at the name weight (0.30) and silently fell below the 0.60 default threshold even when the names matched perfectly. The scoring functions now report a HasData flag in addition to score/detail, and scorePair renormalizes by dividing the weighted sum by the sum of weights of only the dimensions that carry comparable data on both sides. A dimension that compared and disagreed (e.g. birth years differ by >2, places differ, peers exist but don't overlap) keeps HasData: true and remains in the denominator, so real disagreement is still penalized. Fully-documented pairs are byte-identical to the old algorithm (effective weight 1.0 → division by 1.0); name-only / partial-data pairs now score on the fraction of available evidence they share, surfacing the 18th-c. German parish-register and similar brick-wall pairs that motivated this issue. DuplicateSignal gains a has_data JSON field (additive, existing consumers unaffected). Closes #716

• glx init --create-test-data N now produces a valid archive — GenerateTestData::generateEvidenceChain minted an Assertion with Property: "birth" set but no Value, violating the schema rule that value is required when property is present. Every freshly-initialized test archive failed glx validate with missing property 'value' on every generated assertion — the most common smoke test a new user runs against the CLI. The generator now emits an existential assertion (no property, no value) attesting that the birth event occurred, which matches the semantics of "this event happened, here's the source" and validates cleanly. Closes #935. (PR #933)

• glx search extracts values from temporal-list ([]any) properties — searchProps now enumerates property values via a new propertyScalars helper (sibling to the existing propertyScalar), so list-shaped property values like occupation: [{value: farmer, date: 1850}, ...] and any other canonical GLX temporal-list shape are searchable. Previously only plain strings and single-map ({value, date}) shapes matched; temporal lists were silently dropped, so glx search blacksmith against an archive that recorded occupation as a list returned nothing. The fmt.Sprint-on-map non-determinism that originally motivated the issue was already fixed in PR #252; this change closes the remaining shape-coverage gap and unifies property-value extraction with the rest of the package. Closes #618

• complete-family example: redundant sources on assertions — docs/examples/complete-family/assertions/assertion-john-birth.glx, assertion-john-birthplace.glx, and assertion-marriage.glx each carried both a citations: list and a sources: list pointing at the same sources reachable through those citations. Per specification/4-entity-types/assertion.md, citations is the preferred evidence path when citations carry sub-location details (locator, text_from_source), which all three citations here do. Removed the redundant sources field on each assertion; the evidence chain Repository → Source → Citation → Assertion remains intact through the citations. Closes #579

• glx duplicates now suppresses generationally-implausible pairs — When candidate person A is documented as role=parent in some year P and candidate person B has a known birth year Y outside the plausible parenthood window [P-100, P-15] (i.e., B was born within 15 years before P, after P, or more than 100 years before P), the pair is now scored as 0 (impossible to be the same person) instead of being scored solely on name + place similarity. Previously a putative father with no birth data and his newborn son could score identically to the genuine same-generation candidate; the suppressed pair now drops below any reasonable threshold and is annotated with an Age plausibility signal in the breakdown explaining which years were incompatible. Closes #717

• assertion-workflow example uses flat jurisdiction strings instead of place hierarchy — docs/examples/assertion-workflow/archive.glx defined place-boston, place-new-york, and place-cambridge with a jurisdiction: "Massachusetts, United States" property string instead of the parent: chain documented in specification/4-entity-types/place.md. The example now adds place-united-states, place-massachusetts, and place-new-york-state and links the cities via parent:, matching the canonical pattern in complete-family. Closes #574

• complete-family marriage-date assertion targeted relationship instead of event — docs/examples/complete-family/assertions/assertion-marriage.glx asserted started_on on the marriage relationship, duplicating the date already carried by the marriage Event entity (event-marriage-1875) and contradicting the canonical events-first pattern PR #360 established for birth/death dates. The assertion now targets event: event-marriage-1875 with property: date, so the example teaches the canonical pattern. Closes #580

• assertion-workflow README evidence chain diagram contradicted its own worked example — docs/examples/assertion-workflow/README.md showed the chain ending at Property, but the worked example beneath it (and the YAML earlier in the file) already targets an Event for birth-date evidence per the events-first pattern PR #360 established. The diagram now branches at the Assertion node to show both endpoints — a property (e.g. name, occupation) or an Event (e.g. date, place) — matching the assertion subject model. Closes #571

• personSex / displayableGenderIdentity / pronounFor handle temporal shapes — sex and gender are both declared temporal: true in person-properties, so archives may store them as {value, date} maps or [{value, date}, ...] lists. Previously the CLI ran these through propertyString, which fmt.Sprint-ed non-string values and produced useless display strings like map[date:1850 value:male] — also breaking the legacy-gender fallback, the identity-vs-duplicate predicate, and pronoun selection (every temporal value silently fell through to they/their). A new propertyScalar helper extracts the canonical scalar from string / single-map / list shapes. (PR #742)

• glx migrate --rename-gender-to-sex no longer skips on empty sex — isPostSplitArchive previously treated the mere presence of the sex key as a post-split signal, so archives with sex: "", sex: {}, or sex: [] incorrectly skipped the migration while their real data still lived in gender. The check now requires a meaningful scalar value. (PR #742)

• glx migrate --rename-gender-to-sex detects custom identity values — The post-split guard previously only flagged the canonical gender: nonbinary marker. An archive already using post-split semantics with a custom identity value (e.g. gender: two-spirit or any non-legacy-sex vocabulary key) and no sex set would have its identity values silently migrated into sex. The guard now skips migration for any non-legacy-sex value in either person properties or person-subject assertions. (PR #742)

• glx migrate --rename-gender-to-sex preserves all vocabulary fields — Moving inlined pre-split gender_types entries into sex_types previously copied only Label, Description, and GEDCOM, silently dropping Category, AppliesTo, and MimeType from custom user entries. The migration now clones the full VocabularyEntry (with a deep copy of AppliesTo). (PR #742)

Specification Tooling

• Removed unused js-yaml runtime dependency from specification/package.json. It was never imported by the validation tooling or any script under specification/. (PR #742)

GEDCOM Import

• Non-geographic PLAC values flagged and skipped — GEDCOMs exported by legacy genealogy software routinely stuff non-place strings into the PLAC tag — placeholders (Unknown, ?, N/A, Private), status markers (Unmarried, Deceased, Stillborn), and event-circumstance prose (Died in childbirth, Killed in action). The importer previously accepted any non-empty string and minted a first-class Place entity for it, which then misclassified through inferPlaceType (e.g. "Unknown" became a city) and polluted the place graph. A new nonGeographicPLACReason check rejects a tight set of sentinel values plus circumstance-phrase patterns (only when the value collapses to a single non-empty comma-separated component, to avoid false-positives on real hierarchies like "Unknown County, Texas") and emits an ImportWarning tagged PLAC explaining what was ignored. The event keeps its other subrecords (date, citations, notes) — only the place is dropped. Closes #493

• Empty SEX tag maps to not_recorded — A present-but-empty GEDCOM SEX tag (e.g. 1 SEX with no value) now maps to sex: not_recorded rather than sex: unknown. unknown is reserved for SEX U (source consulted but sex could not be determined); an empty tag represents absent-from-source data per GEDCOM 5.5.5. (#528)

• Preserve GEDCOM 7.0 extension tags during round-trip — Vendor-specific extension subrecords (underscore-prefixed tags like _FSFTID, _GENEALOGY_SITE, _PROFILE) inside INDI and FAM records were previously recognized but dropped on import, silently losing data on every round-trip. They are now preserved on the relevant entity under properties.gedcom_extensions as a list of {tag, value, subrecords} records (recursive shape preserves duplicate child tags and nesting), and re-emitted on GEDCOM export. Top-level 0 _CUSTOM records and SCHMA URI registry preservation remain follow-ups. (#289)

• GEDCOM export handles temporal sex/gender — exportPerson (SEX emission) and getPersonSex (HUSB/WIFE inference) previously read sex/gender via getStringProperty, which only accepts plain strings. A temporal archive (sex: {value: male, date: 1850} or sex: [{value, date}, ...]) would silently get SEX omitted from its INDI record and fall back to first/second order for HUSB/WIFE. New getScalarProperty helper extracts the scalar from all three shapes and is used at the sex/gender call sites; non-temporal fields (citation locator, source publication info, etc.) continue to use getStringProperty so their type check still catches data errors. (PR #742)

• Multi-file serializer generates deterministic filenames — Entity filenames are now derived from entity IDs (strings.ToLower(entityID) + ".glx") instead of random 8-char hex. Previously, every write generated new random filenames, causing massive git diffs even when no data changed. Case-insensitive collisions (e.g., Person-A and person-a) are detected and reported as errors. Fixes #694

• GEDCOM export emits events whose principal participant uses role: subject — buildPersonEventsIndex filtered on participant.Role == ParticipantRolePrincipal, silently dropping events from the per-person event index whenever the participant used the documented synonym subject (or left the role unset). The filter now uses the existing isSubjectRole helper, which accepts principal, subject, and "" consistently with FindPersonEvent, the census import default, and vitals_runner. Fixes #523.

• glx migrate, glx rename, and glx merge no longer delete non-archive files — The crash-safe write path (safeWriteMultiFileArchive, added in #598) swapped a fresh archive directory into place and then unconditionally removed the original via .bak, wiping any top-level entry the serializer didn't produce — including .git/, README.md, CLAUDE.md, .claude/, and arbitrary user content. Since GLX archives are designed to live inside git repositories, every invocation against a real archive silently destroyed git history and project docs. The swap now preserves every top-level entry that isn't in the managed set (metadata.glx, vocabularies/, persons/, events/, relationships/, places/, sources/, citations/, repositories/, media/, assertions/). Test coverage added for foreign-file preservation. Fixes #692

• research_logs/ and studies/ recognized by safe-write swap and glx init scaffolding — The CLI side hadn't been updated when the ResearchLog (#224) and Study (#226) entity types were added: archiveManagedTopLevel in glx/archive_io.go and the directory list in glx/init_runner.go only enumerated the older 9 entity types. As a result, running glx migrate, glx rename, or glx merge against an archive containing research_logs/ or studies/ would treat those directories as foreign during the safe-write swap (and the single-file glx init template omitted both keys). Introduced a single source of truth — glxlib.AllEntityTypes in go-glx/constants.go — and refactored the safe-write managed set, both glx init scaffolding paths, and three test fixtures to derive from it so a new entity type updates every consumer in one place. glx init --create-test-data N now also mints one Study (umbrella scope) and one ResearchLog (paired with the first generated citation) so the generated archive exercises all 11 entity types. (PR #933)

• Pin ossf/scorecard-action to v2.4.3 — The action does not publish a floating v2 major-version tag, so the workflow failed at the "Prepare all required actions" step on every run since it was introduced in #753. v2.4.3 is the latest published tag; unlike the other actions in the file (@v6, @v7, @v4), scorecard-action requires a minor.patch pin until upstream ships a floating major. (#779)

• glx vitals limited to core vital records only — Removed non-vital events (census, marriage, residence, etc.) from glx vitals output. Vitals now shows exactly Name, Sex, Birth, Christening, Death, Burial; other life events remain available via glx summary and glx timeline (#685, Fixes #644)

• Witness events excluded from vital records display — glx vitals and glx summary vital sections now show vital events (birth, christening, death, burial) only where the person is a principal/subject participant. Witnessing a christening (or other vital event) no longer appears as the person's own vital. Non-vital "Life Events" in glx summary continue to show all participant roles (#686, Fixes #647)

• go.mod / go.sum pinned to LF line endings — Added eol=lf for go.mod and go.sum in .gitattributes. Go tools always write LF (see golang/go#31870); without this rule, Windows users got CRLF on checkout, which caused go mod tidy -diff false positives in CI (#684, Fixes #638)

• /check-code-drift slash command covers all type categories — Expanded the drift-detection checklist to cover Metadata, Submitter, EntityRef, NoteList, all 9 vocabulary structs, and FieldDefinition. Added type-mapping entries for NoteList (oneOf), DateString (alias), *Submitter (pointer). New "Vocabulary Struct Types" section enumerates the 9 vocab types and their schemas. Documentation only (#689, Fixes #674)

• VitePress vocabularies data loader includes legal-statuses — The new Legal Statuses vocabulary section in 5-standard-vocabularies/README.md referenced vocabularies['legal-statuses'], but website/.vitepress/data/vocabularies.data.js was not updated when the vocabulary file was added, so the <YamlFile> block would render undefined on the published site. Loader now reads legal-statuses.glx alongside the other 21 vocabularies. (PR #933)

• Metadata.notes schema now accepts string or string array — glx-file.schema.json previously restricted top-level metadata.notes to a bare string, while the Go Metadata.Notes field is a NoteList that accepts both forms (matching every other entity's notes field). Multi-note metadata round-tripped through Go but failed schema validation. The schema now mirrors the other entities (oneOf: [string, array]). No archive data changes required. (PR #933)

• complete-family example now demonstrates all 11 entity types — Added studies/study-smith-yorkshire.glx (family reconstruction scope) and research_logs/research-log-john-smith-birth.glx (an investigation with two Search entries that produced the existing birth citations). The archive's vocabularies/ directory gains the four new standard vocabularies (study-types, study-statuses, search-result-types, research-log-status-types) so the additions validate against archive-owned vocab. Closes a gap noted by /check-examples where Study and ResearchLog had no example coverage. (PR #933)

• complete-family example filenames now match entity IDs — Renamed 11 single-entity files (person-jane-smith.glx → person-jane-smith-1876.glx, source-census.glx → source-census-1851.glx, etc.) so the archive matches the deterministic EntityIDToFilename convention introduced in #694. Previously, round-tripping the archive through glx's multi-file serializer would rename these files on every write. (PR #933)

• GEDCOM STATE tag accepted in repository ADDR import — The repository address parser previously only recognized STAE, so any GEDCOM produced with the STATE variant lost its state/province value on import. Both spellings are now accepted; export continues to emit the spec-canonical STAE. (#821)

• GEDCOM 7 NO tag now creates a disproven assertion instead of a no_* person property — The importer previously rendered 1 NO BIRT and similar negative assertions as fabricated person properties like no_birth: true, which polluted the property vocabulary and lost the negative-assertion semantics. The importer now creates an Event of the corresponding type and a paired Assertion with status: disproven (plus citations and the GEDCOM DATE/PHRASE when present), matching the GEDCOM 7 spec for the NO structure. (#688, Fixes #659)

• glx migrate / rename / merge retry os.Rename on Windows for transient AV/indexer locks — The crash-safe write path (safeWriteMultiFileArchive, #598) failed intermittently on Windows when antivirus or the search indexer briefly held a handle on the freshly-written tmpdir during the swap. Rename now retries on ERROR_ACCESS_DENIED / ERROR_SHARING_VIOLATION with exponential backoff (1 ms initial, doubled with jitter and capped at 500 ms per sleep, 2 s total window) before surfacing the error. (#701, Fixes #698, #700)

• glx validate <file.glx> now runs semantic validation on single files — The single-file code path previously ran only JSON-schema (Pass 1) validation, silently skipping deprecated-property warnings, date-format checks, vocabulary-membership checks, and cross-entity reference integrity. glx validate file.glx now runs the full validator (Pass 1 + Pass 2), matching the directory-archive code path. (#687, Fixes #658)

• copyMediaFiles output routed through IOStreams; trailing single BLOB char rejected — The GEDCOM import media-copy step wrote progress messages directly to os.Stdout, bypassing --quiet and the IOStreams abstraction (#679). Output now flows through IOStreams.Out. As part of the same audit, the BLOB decoder gained an ErrInvalidBlobChar sentinel and now rejects a trailing single Base64 character (which has no valid 6-bit decoding) instead of silently emitting a partial byte. (#695)

0.0.0-beta.10 - 2026-04-11

Added

CLI

• Added glx search command — Full-text search across all entity types (persons, events, places, sources, citations, repositories, assertions, relationships, media). Case-insensitive by default with --case-sensitive flag, --type filter, and results grouped by entity type (#252)
• Added glx merge command — Combine two GLX archives by merging all content from a source into a destination. Identical vocabulary entries are silently skipped; true conflicts are reported. Supports both single-file and multi-file archives, with --dry-run for preview (#264, #609)
• Added glx migrate command — Converts deprecated person properties (born_on, born_at, died_on, died_at, buried_on, buried_at) to birth/death/burial Event entities. Creates new events when none exist, merges date/place into existing events when they do, converts property assertions to event assertions, and removes the deprecated properties (#360, Fixes #645)
• Added --phonetic flag to glx query persons --name — Soundex phonetic matching finds names that sound alike regardless of spelling (Miller/Myller/Mueller, Smith/Smyth). Supports multi-word queries matching any word against any name word (#262)
• Crash-safe writes for migrate and rename commands — Multi-file archive writes now use a temp directory + atomic swap, preventing archive corruption on interrupted writes (e.g., power loss, disk full). Closes #597

Date Handling

• Non-Gregorian calendar support — GEDCOM calendar escape sequences (@#DJULIAN@, @#DHEBREW@, @#DFRENCH R@) are now preserved as calendar prefixes on DateString values (e.g., JULIAN 1731-03-15). Previously, calendar designations were silently discarded. Gregorian remains the default (no prefix). Includes full roundtrip support on GEDCOM export (#564)

GEDCOM Import

• Place-less RESI records preserved — GEDCOM RESI records without a PLAC sub-record (e.g., bare RESI Y or RESI with only DATE/TYPE) are now imported as residence Event entities instead of being silently dropped. RESI records with a PLAC continue to import as temporal person properties. Fixes #488
• ASSO subrecords imported as event participants — Witnesses, officiants, godparents, and other associated persons from GEDCOM ASSO/RELA records are now imported as event participants with correct roles. Supports both individual and family events. Unknown roles preserved in participant notes (#589)
• Separate NOTE records preserved through roundtrip — Notes changed from a single concatenated string to a list (NoteList). Import appends separate notes instead of concatenating; export emits each as a separate GEDCOM NOTE record, preserving original note boundaries. Backwards-compatible with existing archives (#584)

Changelog

• Use [Unreleased] header — Changed changelog to use [Unreleased] instead of pre-committed version number, per Keep a Changelog specification. Fixes #388

Changed

• glx coverage JSON output keys renamed — born_on/born_at/died_on/died_at renamed to birth_date/birth_place/death_date/death_place to match event-based data model. This is a breaking change for scripts parsing the JSON output (#568)

Fixed

• Unrecognized SEX values preserved — Non-standard or extension GEDCOM SEX values (e.g., custom values, or values such as N whose meaning varies between GEDCOM 5.5.5 Not Recorded and 7.0 Nonbinary) are now lowercased and preserved as-is instead of being silently mapped to unknown. Validation will warn about out-of-vocabulary values (#588)
• Correct year extraction from Hebrew and French Republican dates — ExtractFirstYear now uses calendar-aware extraction, finding the last digit sequence for HEBREW and FRENCH_R dates where the year appears last. Previously, HEBREW 15 TSH 5765 would extract 15 (the day) instead of 5765. Also handles range dates (BET...AND, FROM...TO) correctly (#590)

Import

• GEDCOM OBJE without FILE now preserves metadata — Previously, OBJE records with no FILE reference were silently dropped during import. Now the media entity is created with an empty URI, preserving all metadata (TITL, NOTE, FORM). Validation catches the missing URI downstream. (#492)

Developer Experience

• devcontainer: remove abandoned ajv-cli and install actual npm deps — Replaced the unused global ajv-cli install with parallel postCreateCommand that runs go mod download, pins golangci-lint v2.11.4, and installs specification/ and website/ npm dependencies. Removed unused Docker extension, added YAML and markdownlint extensions, added forwardPorts for VitePress dev server (#326, #327)

CI

• auto-resolve-conflicts: deduplicate changelog section headers after conflict resolution — The sed-based "keep both sides" merge produced duplicate ###/#### headers when both sides added entries to the same section. Added an awk deduplication pass that merges entries under a single header (#331)
• auto-resolve and auto-update workflows can no longer race — Both workflows now share a branch-maintenance concurrency group. Auto-resolve triggers on workflow_run after auto-update succeeds instead of independently on push to main. Auto-update cron reduced from every 30min to daily; auto-resolve cron removed (runs only after auto-update) (#332)
• release workflow no longer fails when Discord webhook is unconfigured — Guard the Discord announcement step with an empty-check on the webhook secret so missing secrets skip the step instead of failing the release job. Also switch to curl -sf for proper HTTP error handling (#342)
• CODEOWNERS: activate rules with real usernames and fix stale paths — All rules were commented out and several paths were stale (/schema/, /test-suite/, /examples/). Activated with individual usernames, updated paths to match current directory structure (#330)
• Release workflow: exclude GEDCOM test fixtures from line-ending normalization — GoReleaser was failing with "git is in a dirty state" because * text=auto wanted to renormalize GEDCOM test fixtures that had been deliberately excluded from repo-wide LF normalization in #656 without a matching -text attribute. Added glx/testdata/gedcom/**/*.ged -text in .gitattributes so all GEDCOM fixtures are preserved byte-for-byte. testdata/gedcom README.md docs (not fixtures) renormalized to LF

Specification

• Relationship GEDCOM mapping table column header — The "GLX Field" column actually listed relationship type values; renamed to "GLX Relationship Type" for accuracy (PR #670)
• Calendar Prefix glossary placement — Moved "Calendar Prefix" entry from the ## D section to the ## C section where it belongs alphabetically (PR #670)
• Date keywords list: clarify AND — AND is a connector inside BET YYYY AND YYYY, not a standalone keyword; updated validation description to reflect this (PR #670)
• Assertion key-properties mention evidence alternatives — Entity Types index now lists citations/sources/media for Assertion key properties instead of citations alone (PR #670)
• Assertion required-field table: evidence requirement row — Simplified the "at least one of citations, sources, or media" row and added a link to the Evidence Requirement section (PR #670)
• specification/CLAUDE.md entity-type guide — "Adding a New Entity Type" steps now include specific file paths (types.go, vocabulary file, JSON schema, entity spec, README card, glossary, CHANGELOG) (PR #670)
• Vocabulary field-definition table: document value_type — Added value_type row to the "Field Definition Structure" table in vocabularies.md since it's used by standard vocabularies (crop.fields, external_ids.fields) (PR #670)
• Removed unused category: "occupation" from event-type examples — The category field was shown in four custom-event-type examples but no standard vocabulary defines or uses occupation as a category. Removed from 2-core-concepts.md, 4-entity-types/vocabularies.md, 5-standard-vocabularies/README.md, and website/standard-vocabularies.md (PR #670)
• Added glossary entries for Participant Assertion, Per-Participant Properties, and Temporal Existential Assertion — These concepts were used in entity specs but missing from the glossary (PR #670)

Schema

• notes field accepts string or array across all 9 entity schemas — The spec was updated in this release to document notes: string | string[] (matching the Go NoteList type), but the schemas still enforced type: "string", causing validation failures on any archive using array-form notes. Fixed in assertion.schema.json, citation.schema.json, event.schema.json, media.schema.json, person.schema.json, place.schema.json, relationship.schema.json, repository.schema.json, and source.schema.json (12 occurrences total, including participant sub-objects in assertion/event/relationship)
• FieldDefinition supports value_type in all 8 property-vocabulary schemas — The spec documents value_type as a valid key on structured field components (used by media-properties.glx crop sub-fields with value_type: integer), but the schemas only documented label and description. Added value_type: string with the standard enum (string | date | integer | boolean) to citation-properties, event-properties, media-properties, person-properties, place-properties, relationship-properties, repository-properties, and source-properties schemas
• participant-roles.schema.json documents applies_to and gedcom — The standard participant-roles.glx uses applies_to: [event | relationship] on most roles (15+ entries), but the schema did not document the field. Added both applies_to (array of enum strings with uniqueItems) and gedcom (string) to ParticipantRoleDefinition. Related to #499
• Added gedcom field to 5 vocabulary schemas — confidence-levels.schema.json (→ QUAY, #515), media-types.schema.json (→ MEDI), participant-roles.schema.json (→ ASSO.RELA, #524), repository-types.schema.json (#555), and source-types.schema.json (#561) now document the optional gedcom key that the other 11 vocabulary schemas already support, closing the schema support gap for in-flight work on these mappings

Go Types

• Vocabulary structs gain GEDCOM field — ConfidenceLevel, ParticipantRole, SourceType, RepositoryType, and MediaType structs in go-glx/types.go now carry GEDCOM string yaml:"gedcom,omitempty" matching the schema additions. Previously, a .glx file using gedcom: on one of these vocabularies would have the value silently dropped on round-trip. PlaceType was evaluated but not updated — there is no natural GEDCOM mapping for place types and no open issue tracking one
• FieldDefinition gains ValueType field — Added ValueType string yaml:"value_type,omitempty" to FieldDefinition so structured-property field components (used by media-properties.glx crop sub-fields) round-trip correctly through the Go types

Removed

Person Properties

• BREAKING: Removed born_on, born_at, died_on, died_at person properties. Birth and death information now lives exclusively on Event entities of type birth/death. Use glx migrate to convert existing archives (#360)

---

0.0.0-beta.9 - 2026-03-29

Added

Supply Chain Security

• Dependency review on PRs — dependency-review-action blocks PRs that introduce dependencies with moderate+ vulnerabilities
• Renovate lockfile maintenance — weekly lockfile refresh keeps transitive dependencies at latest allowed versions
• govulncheck SARIF integration — vulnerability results now upload to GitHub Code Scanning for richer triage
• npm audit in CI — website dependencies are audited for known vulnerabilities on every push and PR

CLI

• Added glx path command - Find the shortest relationship path between two people using breadth-first search. Traverses all relationship types (parent-child, marriage, sibling, godparent, etc.). Supports --max-hops to limit search depth and --json for machine-readable output
• Added glx cluster command - FAN (Friends, Associates, Neighbors) club analysis for brickwall research. Cross-references census households, shared events, and place overlap to identify associates of a target person. Ranks associates by connection strength with compound scoring. Supports --place, --before, --after filters and --json output
• Added glx census add command - Bulk census import helper that generates GLX entities from a structured YAML template. Reads census year, location, household members, and citation details to produce person records, a census event with participants, source/citation entities, and evidence-based assertions. Supports matching members to existing archive persons by ID or name, --dry-run preview, and FAN notes
• Added conflicts analysis category to glx analyze - Detects assertions with conflicting values for the same person/property combination (e.g., multiple conflicting birthplaces). Reports the number of distinct values and their confidence levels. Use --check conflicts to run independently. Fixes #156
• Analyze flags duplicate given names among siblings - glx analyze now detects when a parent's children share the same given name, which may indicate incorrect family reconstruction, a "replacement child" pattern, or a middle-name situation. Skips the pattern when earlier child died before the later was born. Fixes #164
• Added --subject filter to glx query assertions - Filter assertions by subject entity ID or person name substring. Matches any subject type by exact ID; for person subjects, also matches by case-insensitive name search. Fixes #150
• Added --birthplace filter to glx query persons - Filter persons by birthplace using place ID or name substring (case-insensitive). Matches against both born_at value and resolved place name. Fixes #141
• Analyze flags uncited claims in notes - glx analyze evidence checks now detect assertion notes that reference sources (e.g., "per county history," "census shows") without a corresponding citation. Fixes #162

Changed

• Life History narrative mentions children - glx summary now includes children in the biographical narrative, listed by given name in birth order (e.g., "She had three children: Harriett, Elijah, and Mary."). Fixes #153

Fixed

• Validate catches dangling property references - glx validate now detects when property values like born_at, died_at, or residence reference non-existent entities. Previously, standard vocabularies were not loaded during validation, so property reference checks were silently skipped. Fixes #147
• Consistent date display across timeline and summary - ISO dates like 1860-07-17 now render as July 17, 1860 in timeline tabular output, summary vital events, and life events. Previously, dates appeared in whichever format they were stored (GEDCOM or ISO), creating inconsistent mixed output. Fixes #139
• Stats lists duplicate entity IDs - glx stats now lists the specific duplicate IDs in its warning, consistent with glx analyze. Fixes #177
• Validate and archive loading skip non-.glx files - glx validate and archive loading now only process files with the .glx extension. Previously, .yaml and .yml files in the archive directory were also parsed, causing spurious validation errors on non-GLX files like .wikitree.yml. Fixes #178
• Windows compatibility for symlinked vocabulary files - Archive loading now resolves Git symlink placeholders on Windows, where symlinks are stored as text files containing the target path. Previously, ~35 tests failed on Windows because example archives contain symlinked vocabulary files. Fixes #206
• Analyze flags missing marriage events per spouse - glx analyze now checks each spouse relationship independently instead of checking for any marriage event. Persons with multiple spouses where one has an event and another doesn't are now correctly flagged with the specific spouse name. Fixes #166
• Places command detects person property references - glx places no longer reports places as "Unreferenced" when they are used in person properties (born_at, died_at, buried_at, residence). Also checks assertion values for place-reference properties. Handles string, structured map, and temporal list property shapes. Fixes #145
• Analyze checks citations for census coverage - glx analyze now checks assertions' citations and sources (not just census event entities) when determining whether a census year is covered. Previously, census records documented only via citations were still suggested as missing, contradicting glx coverage output. Fixes #140
• BEF date prefix respected in census suggestions - glx analyze and glx coverage now treat BEF <year> death dates as exclusive upper bounds. A person with died_on: "BEF 1870" no longer gets 1870 census suggestions. Fixes #165
• Summary shows marriages in chronological order - glx summary now sorts spouses by full marriage date (earliest first, using the same date sort key as glx timeline) instead of relationship ID order. Correctly orders marriages within the same year. Undated marriages sort after dated ones. The Life History narrative also reflects the correct order. Fixes #136
• Life History narrative formats ISO dates as readable text - Dates like 1863-06-18 now render as "on June 18, 1863" instead of "in 1863-06-18". Handles full dates, year-month, and prefixed dates (ABT, BEF, AFT)
• Census suggestions capped at plausible lifespan - glx analyze and glx coverage no longer suggest census years beyond birth_year + 100 when no death date is known. Previously, a person born ~1832 would get suggestions for 1940 and 1950 censuses. Fixes #130
• Burial events infer death for census suggestions - When died_on is not set but a burial event exists, the burial date is used as the death upper bound for census suggestions. Prevents suggesting post-death censuses for persons with burial records but no explicit death date. Fixes #134
• 1890 census annotated as mostly destroyed - glx coverage and glx analyze now note that the 1890 US Census was mostly destroyed in a 1921 fire, so researchers don't waste time searching for non-existent records. Fixes #131
• Timeline includes person's own birth and death - glx timeline now synthesizes birth/death entries from born_on/died_on person properties when no corresponding event entity exists. Previously these were omitted, making the person's own vital events the only events missing from their timeline. Fixes #142

---

0.0.0-beta.8 - 2026-03-15

Added

CLI

• Added glx analyze command - Automated research gap analysis engine that cross-references all entities in a GLX archive to surface evidence gaps (missing dates, no parents, no events), evidence quality issues (unsupported assertions, single-source persons, orphaned citations/sources), chronological inconsistencies (death before birth, parent younger than child, implausible lifespan), and research suggestions (census years to search, vital records to locate). Supports --check to run a single category, --format json for machine-readable output, and person filtering by ID or name
• Added glx diff command - Compare two GLX archive states with genealogy-aware diffing. Shows added, modified, and removed entities with field-level detail, confidence upgrade/downgrade tracking, and new evidence metrics. Supports summary, verbose, short, and JSON output modes. Use --person to filter changes for a specific person
• Added glx coverage command - Show source coverage matrix for a person, listing expected records (US census, vital, probate, land, military, church) and which are present vs missing. Flags high-priority gaps like the 1880 census. Supports --json output
• Added glx duplicates command - Detect potential duplicate person records using a weighted scoring model (name similarity with Levenshtein distance and nickname matching, birth/death year proximity, place match, shared relationships and events). Supports person-specific filtering and JSON output. Automatically skips persons already linked by relationships

Library

• Exported ExtractFirstYear and ExtractPropertyYear - Year-extraction utilities are now public API for use by CLI commands and external consumers

Validation

• Moved temporal consistency checks to glx analyze - Death before birth, parent younger than child, and marriage before birth checks are now part of the analyze command's consistency category instead of the validator, keeping glx validate focused on structural and referential integrity

Standard Vocabularies

• Added vocabulary_type to property definitions - Properties can now reference a controlled vocabulary (e.g., vocabulary_type: gender_types) instead of a free-form value_type. Validation warns on out-of-vocabulary values. Mutually exclusive with value_type and reference_type
• Added gender_types vocabulary - First vocabulary-constrained property type. Standard entries: male, female, unknown, other — with GEDCOM SEX mappings. GEDCOM export now looks up gender→SEX via the vocabulary before falling back to hardcoded mappings
• Added marriage_type event property - Classification of marriage (civil, religious, common-law). Was used in GEDCOM import/export but missing from standard vocabulary
• Added primary_name person property - Simple display name fallback when structured name property is not available. Was used in event titles and data generation but missing from standard vocabulary
• Added blob_size media property - Size in bytes of inline binary data from GEDCOM 5.5.1 BLOB records. Was used in GEDCOM media import but missing from standard vocabulary

Changed

• GEDCOM encoding conversion now streams for charmap encodings - CP1252/ISO-8859-1 decoding uses transform.NewReader instead of reading the entire file into memory. Only ANSEL (which requires combining-mark reordering) buffers the full file. UTF-8 files pass through with near-zero overhead
• ANSEL converter handles multiple combining diacriticals - Consecutive combining marks preceding a base letter are now all buffered and emitted after the base letter in Unicode order, instead of only handling a single combining mark

Fixed

• GEDCOM import now converts non-UTF-8 encodings - Files with CHAR ANSI (Windows-1252), CHAR cp1252, CHAR ANSEL, or CHAR ISO-8859-1 are now automatically converted to UTF-8 during import. Previously, non-ASCII characters (German umlauts, accented letters, copyright symbols) were stored as raw bytes, producing !!binary YAML tags, garbled event titles, and {"type":"Buffer"} place names in the web UI
• GEDCOM date import mangled when day-of-month matches level number - Dates like 2 AUG 1944 (day 2) were imported as 2 DATE 2 AUG 1944 because the parser's value extraction matched the level number instead of the actual value. Fixed by walking past tokens positionally instead of using string search
• Date year extraction now handles 1–3 digit years - Year extraction previously hardcoded a 4-digit assumption (\d{4}), silently ignoring dates like 800, 476, or ABT 476. All four extraction sites (query filtering, timeline sorting, temporal validation, event titles) now support 1–4 digit years. Day-of-month values (e.g., 15 in 15 MAR 1850) are correctly disambiguated. Timeline sort keys are zero-padded to 4 digits for proper chronological ordering. Fixes #108

---

0.0.0-beta.7 - 2026-03-10

Added

CLI

• Added glx export command - Export GLX archives to GEDCOM 5.5.1 or 7.0 format. Supports both single-file and multi-file archives as input. Reconstructs GEDCOM FAM records from GLX relationships, converts dates/places/names back to GEDCOM format, and preserves sources, repositories, media, citations, and notes. Use --format 70 for GEDCOM 7.0 output
• Added glx timeline command - Display chronological events for a person, including direct events and family events (spouse/child births, parent deaths) via relationship traversal. Supports --no-family flag to exclude family events; undated events shown in a separate section
• Added glx summary command - Comprehensive person profile showing identity, vital events, life events, family (spouses, parents, siblings), other relationships, and an auto-generated life history narrative
• Added glx ancestors and glx descendants commands - Display ancestor/descendant trees using box-drawing characters. Traverses parent-child relationships with --generations flag to limit depth. Handles biological, adoptive, foster, and step-parent types with cycle detection
• Added glx vitals command - Display vital records (name, sex, birth, christening, death, burial) for a person by ID or name search, plus any other life events they participated in
• Added glx cite command - Generate formatted citation text from structured fields (source title, type, repository, URL, accessed date, locator), eliminating repetitive manual citation_text writing
• Added --source and --citation filters to glx query assertions - Filter assertions by source or citation ID to find all claims derived from a specific source
• Improved glx query persons --name to search all name variants - Now matches across birth names, married names, maiden names, and as-recorded variants (temporal name lists), not just the primary name. Results show alternate names with "aka:" suffix

Event Entity

• Added optional title field - Human-readable label for events (e.g., "1860 Census — Webb Household"). Auto-generated on GEDCOM import (e.g., "Birth of Robert Webb (1815)", "Marriage of John Smith and Jane Doe (1850)")

GEDCOM Import

• Non-standard date preservation - BCE dates, Julian/Hebrew/French Republican calendar dates, and dual-year dates are preserved as raw strings instead of being dropped
• TITL with DATE/PLAC sub-records - Title properties with dates and places are stored as temporal list items and roundtrip correctly
• Empty OCCU with PLAC fallback - OCCU records with empty values but PLAC sub-records now extract the place text as the occupation value
• HEAD-level NOTE preservation - Notes on GEDCOM HEAD records are now imported and exported
• Family-level RESI import - RESI records under FAM are now distributed to both spouses as residence properties
• Family-level NOTE import/export - NOTE records on FAM are now stored on the relationship's Notes field and roundtrip correctly

GEDCOM Export

• Inline SOUR citations on individual events - Birth, death, burial, and other individual events now preserve SOUR citations during export
• Single-spouse family marriages - FAM records with only HUSB or WIFE now export marriage relationships and events instead of being silently dropped
• Multiple MARR events per family - Families with multiple MARR records now preserve all marriage events
• Marriage TYPE export - Marriage marriage_type property now exported as TYPE sub-record on MARR
• Family event TYPE/properties export - Family events (EVEN, ENGA, etc.) now export event_subtype and other event properties (TYPE, CAUS, AGE) that were previously lost
• HEAD metadata roundtrip - LANG, FILE, COPR sub-records from the original GEDCOM HEAD are now preserved through import/export
• Single-value RESI export - RESI stored as scalar (not list) now exports correctly instead of being silently dropped
• Multi-family children placed in all matching families - Children belonging to multiple FAM records (e.g., birth family + step-family) are now placed in all matching families instead of only the first match

Validation

• Added temporal consistency checks - Validator now warns on: death year before birth year, parent born after child, marriage event before participant's birth. Reported as warnings since dates are often estimates

Documentation

• Added Westeros example archive - Large-scale example featuring 790+ characters from A Song of Ice and Fire with full evidence chains, 200+ custom vocabulary types, and temporal properties. Hosted at github.com/genealogix/glx-archive-westeros
• Added Hands-On CLI Guide - Step-by-step walkthrough of every glx command using the Westeros demo archive, with real output examples

Fixed

• SOUR citation duplication on multi-value properties - Assertion-based SOUR references now filter by matching value, preventing N×N duplication when a person has multiple values for TITL, OCCU, etc.

---

0.0.0-beta.6 - 2026-03-08

Added

CLI

• Added glx places command - Analyze places for ambiguity and completeness: flags duplicate names, missing coordinates, missing types, hierarchy gaps, and unreferenced places with canonical hierarchy paths
• Added glx query command - Filter and list entities from a GLX archive with type-specific flags: --name, --born-before, --born-after for persons; --type, --before, --after for events; --confidence, --status for assertions
• Added glx stats command - Summary dashboard showing entity counts, assertion confidence distribution, and entity coverage for quick feedback on archive health

Build & Release

• Added make release-snapshot target - Build cross-platform binaries locally without publishing, using GoReleaser snapshot mode
• Updated release workflow to latest action versions - actions/checkout@v4 (with fetch-depth: 0 for proper changelog), actions/setup-go@v5, goreleaser/goreleaser-action@v6

Person Entity

• Added name variation tracking - Expanded the name.fields.type classification field with standard values for alternate spellings, abbreviations, and as-recorded forms (aka, maiden, anglicized, professional, as_recorded). Added documentation and examples for representing name variations like "R. Webb" vs. "Robert Webb"

Standard Vocabularies

• Added original_place_name citation property - Records the verbatim place name from a source before normalization to a place entity (e.g., "The Town Of Oakdale" vs the normalized place reference)
• Added relationship types - neighbor, coworker, housemate for census/social records; apprenticeship, employment, enslavement, relative for occupational and generic kinship relationships
• Added event types - legal_separation, taxation, voter_registration for legal/administrative events; military_service, stillborn, affiliation for service periods, stillbirths, and memberships
• Added source types population_register, tax_record, notarial_record - Common European and colonial record types
• Expanded military source type description - Now includes draft registrations and muster rolls

Participant Object

• Added properties to participants - Participants across events, relationships, and assertions can now carry per-participant properties like age_at_event, enabling shared events (census, passenger lists) to record individual data without creating separate events per person
• Participant properties validated against parent entity vocabulary - Event participant properties validated against event_properties, relationship participant properties against relationship_properties, assertion participant properties against event_properties

Assertion Entity

• Added existential assertions - Assertions no longer require property or participant; an assertion with only subject and evidence asserts the entity's existence, optionally at a specific date (#26)

GEDCOM Import

• Import HEAD metadata - GEDCOM HEAD record fields (export date, source file, copyright, language, source system/version/corporation, GEDCOM version, character set, notes) are now stored in a metadata section on the GLX archive instead of being discarded after logging
• Import SUBM metadata - GEDCOM SUBM submitter information (name, address, phone, email, website) is now stored in metadata.submitter on the GLX archive

Data Model

• Added Metadata type - New top-level metadata field on GLX archives for storing import provenance information
• Added Submitter type - Nested within metadata to hold submitter contact details

Changed

Specification

• Removed hard-coded vocabulary counts - Replaced "N standardized type codes" with descriptive text to prevent stale counts as vocabularies grow
• Improved custom type example - Custom event type example now shows defining custom participant roles (apprentice, master) alongside the custom event type
• Clarified subject participant role - Documented as preferred over principal

Fixed

• Fixed confidence levels example format - Core concepts example now uses the correct label/description structure instead of simple key-value strings
• Fixed citation GEDCOM mapping - Corrected invalid SOUR.CITN.EXID tag to SOUR.EXID
• Fixed core-concepts.md formatting - Property Vocabularies heading was merging with preceding table
• Fixed glossary Secondary Evidence example - Replaced "census records" (primary evidence) with "published indexes, compiled genealogies"

---

0.0.0-beta.5 - 2026-03-06

Added

Standard Vocabularies

• Added url and accessed properties for digital sources - Sources can now record a url property, and citations can record an accessed date for when an online source was last verified (#21)
• Added race person property - Temporal string property for recording racial classifications as they appear in historical documents such as census records (#24)
• Added url and external_ids citation properties - Citations can now record a direct URL to cited material and external identifiers (e.g., FamilySearch ARK) for record-level specificity (#23)
• Added type field to external_ids property - All external_ids properties (person, source, citation, repository) now support a structured fields.type to record the issuing authority (e.g., FamilySearch URI from GEDCOM EXID.TYPE) (#32)
• Added type field to name property - Name property now supports a fields.type to classify name usage (e.g., birth, married, alias) (#25)

Assertion Entity

• Added status field to assertion entity — Assertions can now record a research status (e.g., proven, disproven, speculative) independently of confidence, allowing researchers to distinguish between certainty and verification state (#27)

GEDCOM Import

• Import NAME.TYPE subfield - GEDCOM NAME.TYPE values (BIRTH, MARRIED, AKA, etc.) are now lowercased and stored in the name property's type field (#25)
• Import EXID on citations - GEDCOM 7.0 EXID tags on source citations are now imported as external_ids citation properties (#32)
• Structured EXID import - GEDCOM EXID.TYPE is now stored in fields.type instead of being concatenated into the ID string; applies to all entity types (#32)

Fixed

• Multiple GEDCOM NAME records no longer silently dropped (#29) - When a person has multiple NAME records (birth name, married name, etc.), all names are now stored as a temporal list instead of only keeping the last one
• FAM event processing no longer depends on HUSB/WIFE tag order (#15) - Family events (CENS, ENGA, MARB, etc.) are now collected in a first pass and processed after spouse IDs are extracted, so GEDCOM tag order no longer matters
• Census NOTE no longer discarded when SOUR exists (#30) - NOTE text on CENS records is now appended to existing citation notes when SOUR sub-records are present, instead of being silently lost
• Marriage/divorce events use start_event/end_event instead of properties - GEDCOM MARR and DIV events are now correctly linked to relationships via the top-level start_event and end_event fields, eliminating non-vocabulary marriage_event/divorce_event property warnings
• Append residence on PLAC-without-DATE instead of overwriting - When residence came from a GEDCOM RESI tag or census-derived CENS data with a PLAC but no DATE, the residence property was overwritten instead of appended (#22)

---

0.0.0-beta.4 - 2026-03-04

Added

Standard Vocabularies

• Added township place type - Township is a common administrative division in U.S. census and land records, distinct from town (a geographic settlement vs. a civil subdivision of a county) (#16)

Fixed

Validation

• Suggest correct vocabulary key on hyphen/underscore mismatch - When a reference fails validation due to a hyphen/underscore swap (e.g., birth_date vs birth-date), the error message now suggests the correct key (#19)

CLI

• Show directory contents in glx init non-empty error - When glx init fails because the target directory is not empty, the error message now lists up to 5 files found (e.g., .DS_Store, .git), helping users diagnose unexpected blockers like hidden files or sync artifacts (#18)
• Remove self-referencing replace directive that blocks go install - The go.mod contained a no-op self-referencing replace directive that prevented go install github.com/genealogix/glx/glx@latest from working (#17)

GEDCOM Import

• Deduplicate evidence references - When a GEDCOM record references the same source multiple times, extractEvidence() and extractEventDetails() now skip IDs already seen, preventing duplicate entries that violate unique constraints in downstream consumers (#13)

Documentation & Website

• Fix dead links and website issues - Rewrote 83 dead links across the site to point to GitHub URLs and VitePress paths, added solid background to navbar on home page, and fixed module path resolution (#10)
• Fix Go Report Card link - Corrected badge link in CLI README to point to the repository root (#11)

0.0.0-beta.3 - 2026-02-10

Added

Census Event Type

• Added census event type to standard vocabulary - Census enumeration events (CENS GEDCOM tag) now included in event-types.glx

Schema Embeds

• CitationPropertiesSchema and SourcePropertiesSchema embed variables - Completes the pattern established by all other vocabulary schema embeds in embed.go

GEDCOM Import: Eliminate Meaningless Citations

• Bare source references no longer create empty citation entities - When a GEDCOM SOUR tag references a source without any citation-level detail (no PAGE, DATA, TEXT, QUAY, NOTE, or OBJE subrecords), the assertion or event now references the source directly via the sources field instead of creating a citation that only contains a source reference
• Added PropertySources constant for event/relationship properties

Changed

Assertion Entity Improvements

Renamed claim to property

• Renamed claim field to property - The field name now matches the vocabulary terminology (property vocabularies)
• Updated JSON schema, Go types (Assertion.Claim → Assertion.Property), all specification examples, example archives, test data, and terminology throughout docs
• Renamed test directories: assertion-unknown-claim → assertion-unknown-property, assertion-participant-and-claim → assertion-participant-and-property, invalid-assertion-claims → invalid-assertion-properties

Typed Subject Reference

• Changed subject from string to typed reference object - Prevents entity ID collisions in large archives
• Must specify exactly one of: person, event, relationship, or place
• Before: subject: person-john-smith → After: subject: { person: person-john-smith }
• Added EntityRef Go type with Type() and ID() helper methods
• Updated validation to ensure exactly one field is set and referenced entity exists

Media as Assertion Evidence

• Added media as a third evidence option for assertions - Assertions can now reference media entities directly as evidence, alongside citations and sources
• Useful for direct visual evidence like gravestone photos, handwritten documents, or family photographs
• JSON schema anyOf evidence constraint updated to include media

Temporal date Field

• Added date field to assertions - Assertions can now specify a date or date range indicating when the asserted property value applies, enabling precise temporal targeting for properties like occupation, residence, and religion that change over time
• Added Date field to Assertion Go struct and date property to assertion JSON schema
• Assertion value field is now required when property is present

Vocabulary Consolidation

Adoption Modeling

• Removed redundant adoption relationship type - Use adoptive-parent-child relationship type instead
• Clarified adoption semantics: adoption event type records the legal proceeding; adoptive-parent-child relationship type models the ongoing bond
• Removed RelationshipTypeAdoption constant from Go code

Godparent Modeling

• Clarified godparent dual usage - Participant role godparent for event participation (baptism sponsor); relationship type godparent for the ongoing bond
• Added godchild participant role for use in godparent relationships

Type System

Unified Participant Type

• Unified participant types - Consolidated EventParticipant, RelationshipParticipant, and AssertionParticipant into single Participant struct
  • All three had identical structure: person, role, notes fields
  • Event.Participants, Relationship.Participants, and Assertion.Participant now all use the unified type

Property Vocabularies

Media Properties

• New media-properties.glx vocabulary - Standard properties for media entities:
  • subjects - People depicted or referenced in the media (multi-value)
  • width, height - Dimensions in pixels for images/video
  • duration - Duration in seconds for audio/video
  • file_size - File size in bytes
  • crop - Crop coordinates as integers (top, left, width, height)
  • medium - Physical medium type (photograph, document, film)
  • original_filename - Original filename before import
  • photographer - Person who created the media
  • location - Place where the media was created
• Added Properties field to Media struct and MediaProperties to GLXFile

Repository Properties

• New repository-properties.glx vocabulary - Standard properties for repository entities:
  • phones - Phone numbers for the repository (multi-value)
  • emails - Email addresses for the repository (multi-value)
  • fax - Fax number
  • access_hours - Hours of operation or access availability
  • access_restrictions - Any restrictions on access (appointment required, subscription, etc.)
  • holding_types - Types of materials held as YAML arrays (multi-value)
  • external_ids - External identifiers from other systems like FamilySearch, WikiTree (multi-value)
• Added RepositoryProperties to GLXFile
• Moved contact fields (phone, email) from direct entity fields to properties

Citation Properties

• New citation-properties.glx vocabulary - Standard properties for citation entities:
  • locator - Location within source (consolidates former page and locator direct fields; GEDCOM PAGE)
  • text_from_source - Transcription or excerpt of relevant text (moved from direct entity field)
  • source_date - Date when the source recorded the information (from GEDCOM DATA.DATE)
• Added Properties field to Citation struct, CitationProperties to GLXFile, and vocabulary specification section

Source Properties

• New source-properties.glx vocabulary - Standard properties for source entities:
  • abbreviation - Short reference name (from GEDCOM ABBR)
  • call_number - Repository catalog number (from GEDCOM CALN)
  • events_recorded - Types of events documented by this source (multi-value, from GEDCOM EVEN)
  • agency - Responsible agency (from GEDCOM AGNC)
  • coverage - Geographic/temporal scope of source content
  • external_ids - External system identifiers (multi-value)
• Added Properties field to Source struct, SourceProperties to GLXFile, and source-properties.schema.json

Multi-Value Property Support

• Added multi_value field to PropertyDefinition - Properties can now be marked as supporting multiple values
• Validation correctly handles array values for multi-value properties

GEDCOM Import

Media/OBJE Import

• Implemented inline OBJE handling for all record types - Media references and embedded OBJE records on individuals, events, sources, families, submitters, census records, and person property tags are now imported (previously only marriage events and top-level OBJE were handled)
• Added handleOBJE shared helper for XRef references, GEDCOM 7.0 @VOID@ pointers, and embedded OBJE
• Added BLOB data handling, URL-type multimedia import, and OBJE processing in extractEventDetails
• Torture test media import improved from 2 to 32 entities (100% coverage)

Media File Import

• Media files are now copied into the archive during GEDCOM import - Relative FILE paths copied to media/files/; BLOB data decoded and written to files
• Media URIs rewritten to archive-relative paths; URL and absolute path references left as-is
• Filename deduplication with counter suffixes; missing source files produce warnings, not errors

Census (CENS) Support

• Implemented CENS tag handling for individual and family records - Census records treated as evidence sources, not events
• Each CENS creates a Source (type: census) and Citation; extracts PLAC for temporal residence property
• Family-level CENS applies census data to both husband and wife
• Added createPropertyAssertionWithCitations() helper

Vocabulary-Driven Tag Resolution

• Added gedcom field to PropertyDefinition struct - Property vocabulary entries can now declare their corresponding GEDCOM tag
• Added GEDCOM tag mappings to all 6 property vocabularies (person, event, citation, source, repository, media)
• Added external_ids to person-properties.glx and event detail properties (age_at_event, cause, event_subtype) to event-properties.glx
• Added GEDCOMIndex reverse lookup infrastructure; replaced hardcoded mappings with vocabulary-driven lookups
• Added gedcom field and fields/FieldDefinition to all 8 property vocabulary JSON schemas
• Updated vocabulary specification documentation with gedcom field and GEDCOM column

Evidence and Citation Handling

• Assertions require citations - Assertions are now only created when SOUR tags are present
• Embedded citation support - SOURCE_CITATION without pointer creates synthetic Source entity
• Properties-based storage - Source, media, and citation tags now stored in vocabulary-defined properties instead of notes
• Citation linkage on media - SOUR on OBJE now properly links via citation.Media

Validation

• Place hierarchy cycle detection - Validates that place parent references don't form cycles (e.g., A -> B -> C -> A). Reports exactly one error per cycle with the full cycle path in the error message.

Place Entity

• Moved jurisdiction, place_format, and alternative_names to properties - Now stored as vocabulary-defined properties instead of dedicated entity fields. alternative_names simplified from AlternativeName/DateRange types to a temporal, multi-value string property.

Relationship Entity

• Consolidated description into properties.description - Removed as a top-level field

Source Entity

• Consolidated creator field into authors - Removed creator from spec, schema, and Go types

Library Package Restructuring

• Moved core library from glx/lib/ to go-glx/ - The library is now at the repository root for clean external imports
• Renamed package from lib to glx - External consumers import as glxlib "github.com/genealogix/glx/go-glx" and use glxlib.GLXFile, glxlib.NewSerializer(), etc.
• Updated all CLI files to use new import path and glxlib. qualifier

CLI

• Changed glx import default format - Now defaults to multi-file (-f multi) instead of single-file

JSON Schema URLs

• Standardized schema $id URLs - All JSON schemas now use consistent GitHub raw content URLs; removed references to schema.genealogix.io and genealogix.org domains

Documentation

• Rewrote Migration from GEDCOM guide - Expanded from a skeleton to a comprehensive guide covering all supported GEDCOM tags, CLI flags, field mapping tables, common challenges, troubleshooting, and GEDCOM 5.5.1 vs 7.0 differences
• Clarified vocabulary file location is flexible - Spec, quickstart, and vocabulary docs now emphasize that vocabulary files can live anywhere in the archive, not only in vocabularies/
• Streamlined Introduction - Simplified 1-introduction.md from 120 to 63 lines
• Restructured Core Concepts - Reorganized 2-core-concepts.md to emphasize flexibility; new section order: Archive-Owned Vocabularies → Entity Relationships → Data Types → Properties → Assertions → Evidence Chain → Collaboration
• Merged Data Types into Core Concepts - Integrated 6-data-types.md as section 3; deleted standalone file
• Added Glossary to specification - Moved from docs/guides/glossary.md to specification/6-glossary.md with "Property" and "Temporal Property" definitions
• Updated table of contents and fixed broken links after restructuring
• Removed .md extensions from ~40 internal links for VitePress compatibility
• Standardized GEDCOM mapping table headers across all 8 entity type files
• Added Properties sections to place.md and relationship.md
• Standardized entity file structure across all entity type docs
• Added Schema Reference sections to event, relationship, place, citation, and repository entity docs
• Added naming convention note (hyphens for file/entry names, underscores for YAML section keys) to core concepts
• Moved "Change Tracking with Git" section before "Next Steps" in core-concepts
• Removed 59 file path comments from YAML code blocks
• Standardized validation rules to reference vocabularies with links
• Added participants to all event examples that were missing the required field
• Enhanced VitePress sidebar - Core Concepts promoted to its own collapsible sidebar section with 8 direct anchor links
• Updated quickstart.md - Examples updated to reflect schema changes
• Updated best-practices.md - Assertion examples updated to use typed subject reference and property field

Fixed

Specification

• Fixed Place hierarchy example that used duplicate YAML top-level keys
• Fixed examples using incorrect field names throughout specification (description → notes, value → notes, file: → uri:, death_year → died_on, married_on → born_on, residence_dates → residence, registration_district → district)
• Fixed assertion example using invalid date format (circa 1825 → ABT 1825)
• Removed undocumented birth_surname from person name example
• Fixed broken anchor link in repository.md (#repository-properties → #repository-properties-vocabulary)
• Standardized all event examples to use subject role consistently (replaced remaining principal usages)
• Fixed Event date field type from string/object to string (object form was never documented)
• Fixed Event See Also to say Person "participates in events" instead of "contains event references"
• Fixed broken relative links in 1-introduction.md and specification/README.md
• Fixed residence reference type example in 2-core-concepts.md to use temporal format
• Added minimum participant count (at least 2) to relationship fields table
• Removed stale Created At and Created By glossary entries
• Fixed glossary Event and Event Type definitions that incorrectly included occupation and residence
• Fixed labels: "Event/Fact" → "Event", "living status" → "birth/death dates"
• Replaced living: true boolean example with non-misleading property names
• Replaced "occupation" with "immigration" as event type example in 3 locations
• Fixed Event key properties ("description" → "notes") and Media key properties ("file path" → "URI") in entity-types README
• Fixed place types count from 14 to 15; added missing locality to place-types.glx standard vocabulary
• Fixed vocabulary directory structure example in core-concepts
• Repository deduplication - Repositories with the same name and location are now deduplicated during import
• Dependency-ordered record processing - Records now grouped by type and processed in dependency order
• Repository-to-source linking - Sources now correctly link to their repository even when REPO records appear after SOUR records in the file
• NOTE reference resolution - Shared NOTE records now resolved to actual text content during import
• CONT/CONC text continuation - Long text fields spanning multiple lines now properly combined
• CR line ending support - GEDCOM files using CR-only line endings (old Mac Classic format) now import correctly

Code Quality & Robustness

• unmarshalVocab now returns error on missing YAML key - Previously silently returned nil when the expected top-level key was absent, causing downstream validation to think no vocabulary entries exist
• appendMediaID safe type assertion - Now handles []any (from YAML deserialization) instead of panicking on a bare type assertion to []string
• extensionFromMimeType deterministic output - MIME types with multiple extensions (.jpg/.jpeg, .tif/.tiff) now return a consistent preferred extension instead of random map iteration order
• Directory emptiness check error handling - isDirectoryEmpty now only treats io.EOF as "empty", not all errors (permissions, I/O failures now properly reported)
• Media file copy error handling - copyMediaFile now checks os.IsNotExist before fallback to URL-decoded paths, preserving original errors for permissions/disk issues
• BLOB character validation - decodeGEDCOMBlob now validates characters are in valid GEDCOM BLOB range ('.' to 'm') before decoding, preventing silent corruption
• EXID ID validation - GEDCOM external ID extraction now validates id field exists before use, skipping entries without usable IDs
• Event Properties initialization - extractEventDetails now ensures event.Properties map is initialized before writing, preventing panics
• Archive validation wiring - LoadArchiveWithOptions now correctly passes schemaValidate flag to serializer for referential integrity validation
• Property vocabulary documentation - Fixed value_type and reference_type field requirements (marked "No*" instead of "Yes*" to match "exactly one required" constraint)
• Test assertion completeness - TestRunValidate_MediaFileMissing now captures stdout and verifies warning is actually produced
• glx validate single file behavior - Validating a single file now only validates that file's structure instead of loading the entire current directory. Cross-reference validation is skipped for single files with a warning message. Directory validation still performs full cross-reference checks.

Removed

• Removed glx check-schemas CLI command - Moved to make check-schemas Makefile target; this is a repo-internal dev tool, not a user-facing command

Citation Entity

• Removed data_date, page, locator, and text_from_source direct fields — consolidated into properties
• Removed citation, coverage, and creator direct fields (creator consolidated into authors)

Event Entity

• Removed description field (use properties.description) and tags field

0.0.0-beta.2 - 2025-11-25

Added

GEDCOM Import (lib)

• GEDCOM 5.5.1 support - Import standard GEDCOM 5.5.1 files
• GEDCOM 7.0 support - Import GEDCOM 7.0 with new features
• GEDCOM 5.5.5 support - Import GEDCOM 5.5.5 specification samples
• Two-pass conversion - Entities first, then families for proper relationship handling
• Evidence chain mapping - GEDCOM SOUR tags → GLX Citations → GLX Assertions
• Place hierarchy building - Parse place strings into hierarchical Place entities
• Geographic coordinates - Extract MAP/LATI/LONG coordinates from GEDCOM
• Shared notes - Support for both GEDCOM 7.0 SNOTE and GEDCOM 5.5.1 NOTE records
• External IDs - Import GEDCOM 7.0 EXID tags (wikitree, familysearch, etc.)
• Comprehensive test coverage - 33 GEDCOM test files (5.5.1, 5.5.5, 7.0) successfully imported
• Large file support - Tested with files containing thousands of persons and events
• Edge case handling - Empty families, self-marriages, same-sex marriages, unknown genders
• Character encoding support - ASCII, UTF-8, Windows CP1252 (CRLF and LF)

GLX Serializer (lib)

• Single-file serialization - Convert GLX archives to single YAML files
• Multi-file serialization - Entity-per-file structure with random IDs
• Archive loading - Load both single-file and multi-file GLX archives
• Vocabulary embedding - Embed standard vocabularies using go:embed
• Vocabulary loading from directory - Load vocabularies from multi-file archives
• ID generation - Random 8-character hex IDs for entity filenames
• EntityWithID wrapper - Preserve entity IDs in multi-file format using _id field
• Collision detection - Retry logic for filename generation
• Configurable validation - Optional validation before serialization
• 12 standard vocabularies embedded in binary
• Round-trip preservation - Single→Multi→Single conversions preserve all data

CLI Commands (glx)

• glx import - Import GEDCOM files to GLX format
  • Single-file and multi-file output formats
  • Optional vocabulary inclusion (default: true)
  • Optional validation (default: true)
  • Verbose mode with import statistics
  • Supports both GEDCOM 5.5.1 and 7.0
• glx split - Convert single-file GLX to multi-file format
  • Splits archive into entity-per-file structure
  • Includes standard vocabularies
  • Preserves entity IDs
• glx join - Convert multi-file GLX to single-file format
  • Combines multi-file archive into single YAML
  • Restores entity IDs from _id fields

Schema Enhancements

• Properties field added to 5 entity types for extensibility:
  • Source - Store GEDCOM ABBR, EXID, custom tags
  • Citation - Store event type cited, role, entry date
  • Repository - Store FAX, additional contacts, EXID
  • Media - Store crop coordinates, alternative titles, EXID
  • Assertion - Store assertion metadata
• Backward compatible - Properties fields are optional with omitempty

Project Organization

• .claude/plans/ directory for all planning documents
• CLAUDE.md project context guide for AI assistants
• Plans README documenting all planning files and current status
• Moved all planning docs from docs/ to .claude/plans/

Vocabularies & Standards

• Developer documentation - GEDCOM import docs in glx/lib/doc.go
• User documentation - Updated Migration from GEDCOM Guide
  • Automated import instructions
  • Testing and validation procedures
  • Import result expectations

Fixed

GEDCOM Import

• Malformed line recovery - Parser now handles MyHeritage export bug
  • Recovers from NOTE fields with missing CONT/CONC prefixes
  • Gracefully imports files with HTML-formatted notes
  • Test case: queen.ged (4,683 persons, line 15903 missing CONT prefix)
• Family event handling - Added missing ANUL, DIVF, EVEN to case statement
• Place type references - Fixed gedcom_place.go to use "state" instead of "state_province"

Vocabularies

• Event types vocabulary - Fixed probate description ("Probate of estate" not "of will")
• Place types vocabulary - Removed duplicate state_province alias (use "state" instead)
• Schema categories - Updated allowed categories in vocabulary schemas
  • Event types: Added "legal", "migration"; changed "custom" → "other"
  • Place types: Added "institution"; changed "custom" → "other"
• Source types vocabulary - Added to embedded vocabularies (was missing)

Code Quality

• Clean architecture - Removed file I/O from library layer
  • Moved importGEDCOMFromFile to test helpers (gedcom_test_helpers.go)
  • CLI handles file operations, lib works with io.Reader
  • Better separation of concerns
• File organization - Renamed gedcom_7_0.go → gedcom_shared.go (more accurate)

Testing & CI

• Multi-file vocabulary loading - Fixed LoadMultiFile to properly load vocabularies from directory
• Vocabulary preservation - Vocabularies now correctly preserved in round-trip conversions
• CI test coverage - Updated GitHub Actions to explicitly run all tests
  • Large file tests (habsburg.ged: 34,020 persons)
  • Added 15-minute timeout for comprehensive test runs
  • No tests skipped in CI (no -short flag)
• Test documentation - Fixed queen.ged README with correct software attribution
• GEDCOM TITL handling - Now uses proper PersonPropertyTitle constant instead of hardcoded string
• GEDCOM name fields - Only populate name.fields from explicit GEDCOM substructure tags (GIVN, SURN, etc.), not inferred from parsing the name string
• Test data consistency - All testdata files updated to use unified name format

Removed

Attribute Event Types

• Removed attribute-type events from schema - Events are now strictly discrete occurrences with participants
  • Removed from event.schema.json enum: residence, occupation, title, nationality, religion, education
  • Removed census from event-types.glx vocabulary
  • These attributes are now represented as temporal properties on Person entities
• Removed CENS (Census) event handling - Census records are skipped during GEDCOM import (TODO: re-implement as citations supporting property assertions)
• Converted RESI (Residence) to temporal property - GEDCOM RESI tags now create temporal residence properties on Person entities instead of events

Quality Ratings Support

• Removed quality_ratings vocabulary - The GEDCOM 0-3 Quality Assessment scale was removed from the GLX specification
  • Deleted quality-ratings.glx vocabulary file
  • Deleted quality-ratings.schema.json schema file
  • Removed quality field from Citation entity
  • Removed QualityRating type from Go code
• Removed auto-generated assertion confidence - GEDCOM imports no longer auto-populate assertion confidence levels
  • Confidence levels should reflect researcher judgment, not be inferred from QUAY values
  • GEDCOM QUAY tags are now preserved in citation notes (e.g., GEDCOM QUAY: 2)

Assertion Entity Fields

• Removed evidence_type field - Evidence quality classification belongs on citations, not assertions
• Removed type field - Redundant with claim field and tags for categorization
• Removed research_notes field - Consolidated into single notes field

Provenance Fields (All Entities)

• Removed modified_at, modified_by, created_at, created_by fields - Redundant with git history; use git log and git blame instead

Changed

Person Properties Schema

• Unified name property - Replaced fragmented name properties with single unified property
  • Old: Separate given_name, family_name properties
  • New: Single name property with value and optional fields breakdown
  • Format: name: { value: "John Smith", fields: { given: "John", surname: "Smith" } }
  • Supports temporal lists for name changes over time
  • Fields include: prefix, given, nickname, surname_prefix, surname, suffix
• Added title property - Nobility or honorific titles (temporal, like occupation)
  • Properly handles GEDCOM TITL tag imports
  • Added PersonPropertyTitle constant

Vocabulary Updates

• person_properties vocabulary - Updated to reflect unified name structure
  • name property now includes fields sub-schema for structured breakdown
  • Added title property definition

Other

• Documentation structure - Separated user docs (docs/) from planning docs (.claude/plans/)

Technical Details

GEDCOM Import Coverage:

• 100% critical features implemented
• 94% high-priority features implemented
• PRODUCTION-READY status
• Comprehensive gap analysis completed

Serializer Features:

• Uses crypto/rand for ID generation
• 32 bits of randomness per ID (4.3 billion possible values)
• Collision probability: ~1 in 400,000 with 10,000 entities
• EntityWithID wrapper pattern for multi-file format
• All 12 standard vocabularies embedded with go:embed

Testing:

• All existing tests passing
• 48 new test cases for serializer
• 33 GEDCOM files tested for import (100% coverage of test files)
• Full round-trip serialization/deserialization tests
• Vocabulary preservation tests for both single-file and multi-file formats
• Comprehensive unit and integration tests
• Large file stress tests (3000+ persons, 4000+ events)

0.0.0-beta.1 - 2025-11-18

Fixed

• Fixed GitHub release workflow to build on beta tags (v*.*.*-beta* pattern)
• Fixed VitePress build by adding shiki dependency to website/package.json

Changed

• Removed roadmap section from README (no longer maintaining public roadmap)

Removed

• Removed archive folder containing old planning documents

0.0.0-beta.0 - 2025-11-14

Added

Specification & Standards

• Complete GENEALOGIX specification defining modern, evidence-first genealogy data standard
• 9 core entity types with full JSON Schema definitions:
  • Person (individuals with biographical properties)
  • Relationship (family connections with types and dates)
  • Event (life events with sources and locations)
  • Assertion (evidence-backed claims with quality assessment)
  • Citation (evidence references with source quotations)
  • Source (primary/secondary evidence documentation)
  • Repository (physical storage information)
  • Place (geographic locations with coordinate data)
  • Participant (individuals involved in events)
• Repository-owned controlled vocabularies for extensibility
• Git-native architecture for version control and collaboration
• YAML-based human-readable format with schema validation

CLI Tool (glx)

• glx init: Initialize new GLX repositories with optional single-file mode
• glx validate: Comprehensive validation with:
  • Schema compliance checking against JSON Schemas
  • Cross-reference integrity verification across all files
  • Vocabulary constraint validation
  • Detailed error reporting with file/line locations
• glx check-schemas: Utility for verifying schema metadata and structure
• Support for both directory-based and single-file archives
• Cross-file entity resolution and validation

Documentation & Examples

• Comprehensive specification documentation (6 core documents)
• Complete examples demonstrating various use cases:
  • Minimal single-file archive
  • Basic family structure with multiple generations
  • Complete family with all entity types
  • Participant assertions workflow
  • Temporal properties and date ranges
• Development guides covering:
  • Architecture and design decisions
  • Schema development practices
  • Testing framework and test suite structure
  • Local development environment setup
• User guides including:
  • Quick-start guide for new users
  • Best practices and recommendations
  • Common pitfalls and troubleshooting
  • Manual migration guide for converting from GEDCOM format
  • Glossary of key terms and concepts

Testing & Quality Assurance

• Comprehensive test suite with:
  • Valid example fixtures demonstrating correct usage
  • Invalid example fixtures testing error handling
  • Cross-reference validation tests
  • Vocabulary constraint tests
  • Schema compliance validation tests
• Automated CI/CD pipeline using GitHub Actions
• Full code coverage reporting

Project Infrastructure

• Apache 2.0 open-source license
• Community guidelines and code of conduct
• Contributing guidelines for developers
• GitHub issue and discussion templates
• Development container configuration for consistent environments
• Pre-configured VitePress documentation site