docs(changelog): add consolidated v3.8.50 stats, top-25 ranking and a .mailmap

Two things, and the second is the reason the first is trustworthy.

.mailmap: between 2026-08-13 and 2026-08-26 this checkout carried a
`git config --local` pairing one contributor's name (Xiangzhe / @xz-dev) with
ANOTHER contributor's email (@backryun). 237 commits made here were therefore
signed with @backryun's address. The timezone split is unambiguous: @backryun's
own work commits from +0900 throughout the window and never stopped, while all
237 came from -0300, this machine. No repository file sets that address, so it
was a local config mix-up, not anything in the codebase. The local override is
now removed; the global identity was correct all along.

History is NOT rewritten: those commits live on release/v3.8.50 and
release/v3.8.51, which open PRs and other sessions build on, and the v3.8.50 tag
was cut from that line. .mailmap repairs the record for log/shortlog/blame — the
git-native answer for exactly this — without a force-push. main is unaffected:
releases squash-merge, so it carries none of the 237.

Stats: counts measured, not estimated — 1,714 commits and 248 people over
ed2db6cb19..v3.8.50, 1,666 distinct PR refs, and the 1,182 changelog entries
broken down by type. The top-25 ranking uses the consolidated identities, so
@backryun keeps their 88 real cycle commits and the misattributed 68 return to
the maintainer.

.github/workflows/docker-publish.yml

@@ -185,13 +185,6 @@ jobs:
 
       - name: Build and push BUN base platform image by digest
         id: build-bun-base
-        # Bun is a best-effort compatibility target, not a supported runtime
-        # (AGENTS.md -> Environment). Its `bun run build` has been OOM-killing on
-        # both arches; letting that sink the whole publish means the SUPPORTED
-        # runner-base / runner-web images never reach the registry either. The
-        # image is still built and pushed whenever it succeeds — only its power to
-        # block the release is removed.
-        continue-on-error: true
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
@@ -210,13 +203,6 @@ jobs:
 
       - name: Build and push BUN web platform image by digest
         id: build-bun-web
-        # Bun is a best-effort compatibility target, not a supported runtime
-        # (AGENTS.md -> Environment). Its `bun run build` has been OOM-killing on
-        # both arches; letting that sink the whole publish means the SUPPORTED
-        # runner-base / runner-web images never reach the registry either. The
-        # image is still built and pushed whenever it succeeds — only its power to
-        # block the release is removed.
-        continue-on-error: true
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
@@ -244,15 +230,8 @@ jobs:
           mkdir -p /tmp/digests/base /tmp/digests/web /tmp/digests/bun-base /tmp/digests/bun-web
           touch "/tmp/digests/base/${DIGEST_BASE#sha256:}"
           touch "/tmp/digests/web/${DIGEST_WEB#sha256:}"
-          # Empty when the (non-blocking) bun build produced no image. `if` blocks,
-          # not `[ -n ] && touch`: under `set -e` a failing AND-list aborts the step,
-          # which is precisely the case being handled here.
-          if [ -n "$DIGEST_BUN_BASE" ]; then
-            touch "/tmp/digests/bun-base/${DIGEST_BUN_BASE#sha256:}"
-          fi
-          if [ -n "$DIGEST_BUN_WEB" ]; then
-            touch "/tmp/digests/bun-web/${DIGEST_BUN_WEB#sha256:}"
-          fi
+          touch "/tmp/digests/bun-base/${DIGEST_BUN_BASE#sha256:}"
+          touch "/tmp/digests/bun-web/${DIGEST_BUN_WEB#sha256:}"
 
       - name: Upload base digests
         uses: actions/upload-artifact@v7
@@ -275,11 +254,7 @@ jobs:
         with:
           name: digests-bun-base-${{ matrix.arch }}
           path: /tmp/digests/bun-base/*
-          # `ignore`, not `error`: the bun build is non-blocking, so an absent
-          # digest is the expected outcome of a failed/skipped bun image — the
-          # manifest step already treats these tags as optional. Leaving `error`
-          # here just relocates the blocker from the manifest to the upload.
-          if-no-files-found: ignore
+          if-no-files-found: error
           retention-days: 1
 
       - name: Upload bun-web digests
@@ -287,11 +262,7 @@ jobs:
         with:
           name: digests-bun-web-${{ matrix.arch }}
           path: /tmp/digests/bun-web/*
-          # `ignore`, not `error`: the bun build is non-blocking, so an absent
-          # digest is the expected outcome of a failed/skipped bun image — the
-          # manifest step already treats these tags as optional. Leaving `error`
-          # here just relocates the blocker from the manifest to the upload.
-          if-no-files-found: ignore
+          if-no-files-found: error
           retention-days: 1
 
   merge:
@@ -349,9 +320,6 @@ jobs:
           merge-multiple: true
 
       - name: Download bun-base digests
-        # Non-blocking: the bun image is best-effort, so its artifact may not
-        # exist at all. The manifest step treats these tags as optional.
-        continue-on-error: true
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: digests-bun-base-*
@@ -359,9 +327,6 @@ jobs:
           merge-multiple: true
 
       - name: Download bun-web digests
-        # Non-blocking: the bun image is best-effort, so its artifact may not
-        # exist at all. The manifest step treats these tags as optional.
-        continue-on-error: true
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: digests-bun-web-*
@@ -373,7 +338,7 @@ jobs:
           set -euo pipefail
 
           create_manifest() {
-            local image="$1" suffix="$2" dir="$3" optional="${4:-}"
+            local image="$1" suffix="$2" dir="$3"
             local tags=(-t "${image}:${VERSION}${suffix}")
             if [ "$PROMOTE_LATEST" = "true" ]; then
               tags+=(-t "${image}:latest${suffix}")
@@ -383,10 +348,6 @@ jobs:
               refs+=("${image}@sha256:$(basename "$digest_file")")
             done < <(find "$dir" -type f | sort)
             if [ "${#refs[@]}" -eq 0 ]; then
-              if [ -n "$optional" ]; then
-                echo "::warning::No image digests in $dir — skipping optional tag ${image}:${VERSION}${suffix}" >&2
-                return 0
-              fi
               echo "No image digests in $dir" >&2
               exit 1
             fi
@@ -395,15 +356,15 @@ jobs:
 
           create_manifest "${IMAGE_NAME}" "" /tmp/digests/base
           create_manifest "${IMAGE_NAME}" "-web" /tmp/digests/web
-          create_manifest "${IMAGE_NAME}" "-bun" /tmp/digests/bun-base optional
-          create_manifest "${IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web optional
+          create_manifest "${IMAGE_NAME}" "-bun" /tmp/digests/bun-base
+          create_manifest "${IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web
 
       - name: Create GHCR manifest
         run: |
           set -euo pipefail
 
           create_manifest() {
-            local image="$1" suffix="$2" dir="$3" optional="${4:-}"
+            local image="$1" suffix="$2" dir="$3"
             local tags=(-t "${image}:${VERSION}${suffix}")
             if [ "$PROMOTE_LATEST" = "true" ]; then
               tags+=(-t "${image}:latest${suffix}")
@@ -413,10 +374,6 @@ jobs:
               refs+=("${image}@sha256:$(basename "$digest_file")")
             done < <(find "$dir" -type f | sort)
             if [ "${#refs[@]}" -eq 0 ]; then
-              if [ -n "$optional" ]; then
-                echo "::warning::No image digests in $dir — skipping optional tag ${image}:${VERSION}${suffix}" >&2
-                return 0
-              fi
               echo "No image digests in $dir" >&2
               exit 1
             fi
@@ -425,8 +382,8 @@ jobs:
 
           create_manifest "${GHCR_IMAGE_NAME}" "" /tmp/digests/base
           create_manifest "${GHCR_IMAGE_NAME}" "-web" /tmp/digests/web
-          create_manifest "${GHCR_IMAGE_NAME}" "-bun" /tmp/digests/bun-base optional
-          create_manifest "${GHCR_IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web optional
+          create_manifest "${GHCR_IMAGE_NAME}" "-bun" /tmp/digests/bun-base
+          create_manifest "${GHCR_IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web
 
       - name: Inspect image
         if: needs.prepare.outputs.version != 'main'

.github/workflows/npm-publish.yml

@@ -226,28 +226,6 @@ jobs:
           JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
         run: npm run build:cli
 
-      # `build:cli` assembles dist/ but does NOT write dist/BUILD_SHA — only
-      # `build:release` does, by calling write-build-sha.mjs. The #10427 provenance
-      # guard inside check:pack-artifact rejects an artifact with no SHA (and rejects
-      # it even under OMNIROUTE_ALLOW_CANARY_BUILD=1: what cannot be identified cannot
-      # be vouched for). Without this step the build+validate pair in this job is
-      # structurally incompatible and fails 100% of the time — the same gap that was
-      # fixed in ci.yml's Package Artifact job.
-      - name: Stamp dist/BUILD_SHA for the provenance guard (#10427)
-        if: steps.resolve.outputs.skip != 'true'
-        env:
-          OMNIROUTE_BUILD_SHA: ${{ github.sha }}
-        run: |
-          export OMNIROUTE_BUILD_SHA="${OMNIROUTE_BUILD_SHA:0:7}"
-          node scripts/build/write-build-sha.mjs
-
-      # The guard checks ancestry against origin/main by default, which is correct
-      # here (a release tag is cut from main), but the ref has to exist locally for
-      # `git merge-base` to resolve it.
-      - name: Fetch main for the provenance probe
-        if: steps.resolve.outputs.skip != 'true'
-        run: git fetch --no-tags --depth=50 origin +refs/heads/main:refs/remotes/origin/main
-
       - name: Validate npm package artifact
         if: steps.resolve.outputs.skip != 'true'
         run: npm run check:pack-artifact
@@ -287,12 +265,7 @@ jobs:
       # a staged package that is never approved simply expires, with no `npm deprecate` needed.
       - name: Prove clean-install AND upgrade-over-previous both boot
         if: steps.resolve.outputs.skip != 'true'
-        # 60, not 30. This gate was added in #8953 and the 2026-08-27 v3.8.50 publish
-        # was the FIRST run to ever reach it — every earlier attempt died upstream, so
-        # its budget had never been measured against a real run. It then blew the limit
-        # on its debut: `npm pack` alone took 24m37s, leaving 5 minutes for two installs
-        # and two boots. 30 was a guess; 60 is sized to the one measurement we have.
-        timeout-minutes: 60
+        timeout-minutes: 30
         run: npm run check:install-upgrade
 
       # WS1.3 (D2, v3.8.49 plan): STAGED publishing by default — `npm stage publish`

scripts/check/check-install-upgrade.mjs

@@ -223,11 +223,6 @@ async function main() {
   const warnings = [];
 
   try {
-    // Timed, because this turned out to be the expensive part: on the 2026-08-27
-    // v3.8.50 publish `npm pack` alone took 24m37s, leaving 5 of the step's 30-minute
-    // budget for two installs and two boots. Without a duration here the log showed
-    // only "packing…" then a timeout, which reads like a hang and is not.
-    const packStarted = Date.now();
     log(`packing v${version}…`);
     const packOut = execFileSync("npm", ["pack", "--json", "--pack-destination", tmp], {
       cwd: ROOT,
@@ -235,8 +230,6 @@ async function main() {
       maxBuffer: 128 * 1024 * 1024,
     });
     const tarball = path.join(tmp, pickTarball(packOut));
-    const packMb = (fs.statSync(tarball).size / 1024 / 1024).toFixed(1);
-    log(`packed in ${Math.round((Date.now() - packStarted) / 1000)}s (${packMb} MB)`);
 
     // ---- Phase A: clean install -------------------------------------------------
     log("PHASE A — clean install of the packed tarball");