# Lane R4 — PG-32 distribution and PG-37 metadata receipt (2026-08-22)

Status: **PG-32 GREEN end-to-end. PG-37 remains UNVERIFIED solely because the Git tag is absent and the backend update catalog is unchecked (PG-46).** This receipt records canonical-host evidence; the earlier sandbox ZIP failure is an infrastructure incident, not a distribution failure.

## 1. Release identity

- Plugin source commit before the builder's version transaction: `ed74a87647ab6d033e5d23a83d32c6783e768c56`
- Resulting release/version commit: `f8faa0673` (`Release 0.9.80`)
- Plugin version: `0.9.80`
- Plugin Git tag: **absent** (finding; no `0.9.80` tag exists and none was created).
- Canonical backend source/deployment commit and update-catalog version: not checkable from this plugin repository; scoped to PG-46.
- Release date UTC: `2026-08-22`
- Release operator/automation identity: canonical-host distribution builder, Lane R4.

Required identity invariant: the plugin header, `IPZ_VERSION`, `readme.txt` stable tag, topmost changelog entry, and archive filename are all `0.9.80`. The remaining required sources are recorded in the PG-37 table below.

## 2. Preflight

Command run from the clean plugin checkout:

```bash
node tools/release-preflight.mjs
```

Exit: `0`

Captured output (verbatim):

```json
{"pass": true, "version": "0.9.79", "blocking": [], "waiting_external": ["Stripe production clearance is pending outside this repository. ...", "Post-purchase Stripe billing/portal proof cannot complete until Stripe clearance is available. ..."], "concurrent": ["Plugin production completion remains ACTIVE; its feature/E2E lanes are concurrent, not local preflight defects."]}
```

- `pass: true`: `[x]`
- Deterministic blockers: none (`blocking: []`).
- Waiting external items: Stripe production clearance and the dependent post-purchase billing/portal proof remain pending outside this repository.
- Concurrent lanes still active: plugin production completion feature/E2E lanes; not local preflight defects.

The preflight version was `0.9.79` before the builder performed its owned version transaction to `0.9.80`.

## 6. Distribution artifact / PG-32

Commands run on the canonical host:

```bash
node tools/build-distribution.mjs
node tools/build-distribution.mjs --verify "dist/international-press-zone-0.9.80.zip"
unzip -l "dist/international-press-zone-0.9.80.zip"
```

Build exit: `0`

Captured builder output (verbatim):

```text
Packaging clean source commit ed74a87647ab6d033e5d23a83d32c6783e768c56
Bumped release version 0.9.79 -> 0.9.80
added 509 packages in 4s (locked admin npm install)
webpack 5.104.1 compiled successfully in 8553 ms
Running required local WordPress runtime verification...
Created dist/international-press-zone-0.9.80.zip (233 files, version 0.9.80, runtime SHA-256 5b65b8b017a56af925f725adfbc946a4ac3e84f0c132631d9859f68530920848)
```

- Archive path: `dist/international-press-zone-0.9.80.zip`
- Archive byte size: `864431`
- Archive SHA-256: `6300fcca9ceef2b3cc300b79e7c29c09d0c3a6ea5aa1e00ca421f2d6384aa6d2`
- Runtime content digest reported by builder: `5b65b8b017a56af925f725adfbc946a4ac3e84f0c132631d9859f68530920848`
- File count: `233` runtime files; `268` ZIP entries including directories; `3548074` bytes uncompressed.
- PHP file count: `189`
- Builder source commit before version transaction: `ed74a87647ab6d033e5d23a83d32c6783e768c56`
- Resulting release/version commit: `f8faa0673`

Verification exit: `0`

Captured verification output (verbatim):

```text
Verified dist/international-press-zone-0.9.80.zip (version 0.9.80, 233 runtime files, 189 PHP files, runtime SHA-256 5b65b8b017a56af925f725adfbc946a4ac3e84f0c132631d9859f68530920848)
```

ZIP inventory audit command: `grep` over the full `unzip -l` output for `.env|credential|secret|auth-state|tests|docs|.map|.log|.sql|node_modules|.git|/home/|.claude|playwright|.lock`.

Inventory result: the only two matches were legitimate runtime source classes:

- `includes/Migrations/Migration007RemoveLegacyApiCredentials.php`
- `includes/Connect/CredentialStore.php`

`[x]` No `.env`, credentials, browser auth state, tests, docs, sourcemaps, logs, SQL dumps, `node_modules`, `.git*`, or machine-specific paths are present in the ZIP. The word matches above are source-class names, not included credentials or auth state.

### Sandbox ZIP infrastructure note

The earlier sandbox attempt failed only because that environment lacked the `zip` binary. It is recorded as infrastructure incident `fire-cb4be669e81ed839`. It does not contradict the successful canonical-host build, exact-archive verification, or inventory audit recorded above.

## PG-37 metadata coherence

| Identity source | Observed value | Result |
| --- | --- | --- |
| Plugin header (`Version:`) | `0.9.80` | match |
| `IPZ_VERSION` | `0.9.80` | match |
| `readme.txt` stable tag | `0.9.80` | match |
| Topmost changelog entry | `0.9.80 - 2026-08-22` | match |
| Distribution filename | `international-press-zone-0.9.80.zip` | match |
| Git tag | absent | finding; no tag was created |
| Backend update catalog | unchecked from this repository | scoped-out PG-46 dependency |

Commits on the lane: `ed74a8764` (`Lane R4: PG-32 distribution proof and PG-37 metadata coherence`; changelog `0.9.67` to `0.9.79` correction and interim receipt) and `f8faa0673` (`Release 0.9.80`; builder version transaction updating plugin header, `IPZ_VERSION`, and stable tag from `0.9.79` to `0.9.80`; pre-commit gate passed all checks).

## GOLIVE disposition

- PG-32: `[x] [WORKS]` — **GREEN end-to-end**. The canonical host built, locally runtime-verified, archive-verified, hashed, and inventory-audited the exact `0.9.80` ZIP.
- PG-37: `[ ] [UNVERIFIED]` — all locally checkable metadata sources are coherent at `0.9.80`; it remains unverified solely because the `0.9.80` Git tag is absent and the backend update catalog is not checkable here (PG-46).

This receipt is not a commercial GO decision. The preflight's Stripe `WAITING_EXTERNAL` items and concurrent feature/E2E lanes remain outside the PG-32 disposition.