fix: close the mechanical audit issues

[TMHSDigital]

Seven commits, one per audit item. Documentation, site-generator, and workflow changes only — no example or showcase script, assertion, exit code, or falsifier was touched, and LICENSE, VERSION, CHANGELOG.md, release.yml, pages.yml path filters, and the smoke matrix/cron are untouched.

Lands under the main-integrity ruleset added in #194.

Commit	Item	Closes
fb333e0	SECURITY.md claimed 0.2.x at v0.78.18	#186
7c4ad68	Gallery called 26 showcase pieces examples	#187
f8a3e5e	label-sync.yml ignored examples/ and showcase/	#188
5a57d9d	Render requirement vs. the eight check-only examples	#146
a9c2fc7	README promised MCP consumption that does not exist	—
112586b	Quick start never said where to get Blender	—
9be9113	Falsifier, the central convention, absent from README	—

#186 — security support table

Named 0.2.x while the repo is at 0.78.18, so it claimed support for releases eleven minors behind and none that exist. Replaced with the policy the project can keep: latest release only, no backports, no maintenance branches, plus the one-line reason (this is content, not a runtime). The supported row points at VERSION rather than naming a number, so it cannot drift again.

#187 — the gallery noun

The grid concatenates 51 examples and 26 showcase pieces, then labelled all 77 with the example noun. Found and fixed, all of it verified in the generated HTML rather than the source JSON:

• count chip read 77 examples → now 51 examples, 26 showcase pieces, in both the static span and the live-updating JS
• every showcase card carried aria-label="<name> example detail page" and a View example link → now per-card, derived from the showcase tag via a new kind_noun() helper
• showcase detail pages titled themselves <name> — Examples and credited Rendered headless by the example itself → now — Showcase — and the showcase piece itself
• gallery title Examples Gallery → Examples and Showcase; back label follows
• landing page offered Browse all 51 examples in the gallery for a page holding 77 cards → now names both counts
• search placeholder, chip toolbar aria-label, and empty-state copy no longer say "examples" for a grid holding both
• generator summary now prints 77 detail pages (51 examples, 26 showcase pieces)

Verification on the regenerated output, per the CLAUDE.md gate:

$ grep -o 'aria-label="[a-z0-9-]* \(example\|showcase piece\) detail page"' docs/gallery/index.html | ... | uniq -c
     51 example
     26 showcase piece
$ grep -o '<title>[^<]*</title>' docs/gallery/anvil/index.html
<title>anvil — Showcase — Blender Developer Tools</title>
$ grep -o '<title>[^<]*</title>' docs/gallery/bmesh-gear/index.html
<title>bmesh-gear — Examples — Blender Developer Tools</title>
$ grep -rl "Examples Gallery" docs/gallery/          # no matches

Dotted-path alt text re-checked against the PR #68 regression: bmesh.ops.create_grid(...) still renders intact in card alts.

#188 — label-sync

Added examples/ and showcase/ branches in the same shape as the existing ones. Both labels created on the repository (examples green, showcase purple); every label the workflow can now apply — skills, rules, snippets, templates, examples, showcase, documentation, ci — was confirmed to exist, so the gh label create --force fallback stays a fallback instead of quietly inventing grey labels.

#146 — check-only examples

docs/new-example-prompt.md required a render from every example with no exception; CLAUDE.md went further and said "their renders ship in the site gallery" of all 59. Eight examples ship none.

Both now state the exception keyed to a criterion, not a list, so it stays true as the set changes: an example is check-only when its witness is a data or state fact that no scene redesign can make visible — a datablock name, an RNA attribute's presence, a post-exit sidecar, a topology count, export metadata — so the render would be identical whether the API held or broke. The existing "redesign the scene until failure would be visible" line is the test to attempt first. The exception is for contracts that are invisible, not renders that are hard.

Verified on disk rather than taken from the issue — exactly eight examples have no gallery.json entry:

examples dirs: 59   gallery entries: 51
coincident-vert-weld       catalog=Y  --output=N  flags=['--no-duplicate', '--weld']
eval-mesh-datablock-name   catalog=Y  --output=N  flags=['--assume-distinct-names']
exit-pre-sidecar           catalog=Y  --output=N  flags=['--atexit-instead', '--force-run', ...]
gn-bundle-roundtrip        catalog=Y  --output=N  flags=['--bypass', '--force-run', ...]
mesh-automasking-settings  catalog=Y  --output=N  flags=['--assume-brush-attrs']
ngon-triangulate           catalog=Y  --output=N  flags=['--no-dissolve', '--skip-triangulate']
unapplied-scale-gltf       catalog=Y  --output=N  flags=['--bake', '--identity']
vse-linear-modifiers       catalog=Y  --output=N  flags=['--assume-present']

All eight hold a tests/smoke/catalog.json row, none takes --output, each carries at least one falsifier. Smoke coverage is unaffected.

The MCP claim

The overview said the content is consumed by "any MCP-capable client". There is no MCP server here and never has been. Replaced with the real mechanism: Cursor applies rules/*.mdc by scope glob and takes skills by name; Claude Code reads skills/ and rules/ from the workspace or a referenced checkout.

mcp-tools.json is not removed-feature residue — git log --all -- mcp-tools.json is empty, so it has never existed here. It is fleet-template scaffolding: scripts/site/build_site.py:274 reads it optionally and returns [] when absent. The pages.yml path-filter reference is inert (a filter on a file that cannot change never matches) and is filed as #195 rather than edited here, since pages.yml path filters were out of scope.

Falsifiers in the README

Added a section above Showcase: what a falsifier is, that it changes input so a real assertion fails rather than skipping the check, that all 59 examples carry one, and the concrete bmesh-gear --no-extrude case (breaks the closed-form topology match, exits 3). Names --api, --check-pixels, and --output as the flags commonly mistaken for falsifiers, and links to CONTRIBUTING.md#exit-codes.

Where to get Blender

One bullet above the run command: the LTS download link, which of 5.2 and 4.5 is primary, and the macOS app-bundle path for when blender is not on PATH.

Evidence status

Everything above is established by inspection and by running the generator locally. No Blender run was required — no example script changed. The generated gallery was rebuilt with python scripts/build_gallery.py and read character by character as the CLAUDE.md gate requires. Smoke on this PR proves the 59 examples still pass unchanged.

Closes #186
Closes #187
Closes #188
Closes #146
Refs #195

🤖 Generated with Claude Code