Document v2.1.234; re-measure v2.1.170+ against the declared env registry

[lroolle]

Adds v2.1.234 (994 vars, +77/-8 vs v2.1.218) and corrects the extraction method for every release from v2.1.170 on.

Why the correction

Builds since ~v2.1.170 do not read process.env.X at each call site. They declare the whole set once, typed, and install it as a proxy object:

var NS={}; yt(NS,{CLAUDE_CODE_FOO:()=>gFoo, ...});   // declaration
gFoo = Ve.bool()                                     // type
V = LTs({...NS, ...}, proto)                         // call sites read V.FOO

V and Ve are minifier-assigned names that change between builds. A process.env.-only grep therefore undercounted a modern build by hundreds of names and — worse — reported a variable as removed when a build merely moved it behind the proxy.

The previously published v2.1.197 → v2.1.218 diff claimed 126 removals. Re-measured against the registry it is 20. Sampled entries from that list (CLAUDE_CODE_ENABLE_TASKS, OTEL_METRICS_EXPORTER, ANTHROPIC_BETAS) are all present in v2.1.218's registry.

Corrected diffs

Transition	Added	Removed
v2.1.139 → v2.1.170	163 (was 55)	1 (was 45)
v2.1.170 → v2.1.197	68 (was 22)	9 (was 7)
v2.1.197 → v2.1.218	94 (was 9)	20 (was 126)
v2.1.218 → v2.1.234	77	8

The +163 at v2.1.170 is a build-structure boundary, not a code change of that size: it is the first release with a registry, so the first whose full config surface is visible at all. Labelled as such in the summaries.

New extractors

• scripts/extract-registry.py — reads the declared registry with parser types (str / bool / triBool / int / enum, plus enum options and int defaults). Detects the schema helper by frequency instead of hardcoding a minified name, so it survives rebuilds. Refuses to report a registry for pre-v2.1.170 builds that have none (threshold guard) rather than emitting noise.
• scripts/extract-direct-reads.py — literal process.env reads, with Bun's string-concatenation artifacts (BUN_ENVprocess, NODE_ENVContent) resolved by two rules derived from the data, not a fix-up table. Anything still ambiguous goes to concat_artifacts.txt and is excluded rather than guessed at.

extract-binary.sh runs both, unions them into all_vars.txt, and now applies the FLAGGED.md codename hold itself — so validate-extraction.sh gate (c) passes by construction instead of by hand.

New artifact per version

File	Contents
registry.tsv	name, parser type, parser arg — the typed config surface
registry.txt	names only
direct_reads.txt	literal process.env.<NAME> reads
all_vars.txt	union of the two (unchanged meaning: the published inventory)
concat_artifacts.txt	unresolved strings(1) boundary accidents, excluded

v2.1.234 highlights

• SELF_HOSTED_RUNNER_* — 24 new variables: lifecycle/drain timers, isolation and trust (LOCK_TO_ACCOUNT, TRUST_WORKSPACE, CONFINE_REPO_SETTINGS), pool and environment secrets, hooks, health port.
• Artifacts — 10 new variables covering asset hosting, a local DB, and a comment-responder loop.
• Cross-session messaging (harbor_kite) — CLAUDE_CODE_HARBOR_KITE, _HARBOR_KITE_CLOUD, _MESSAGING_SOCKET, _MESSAGING_TOKEN.
• Five new DISABLE_* switches, and the three per-signal OTLP header overrides are back.

Verification

• All six versions regenerated from one code path.
• validate-extraction.sh passes for all six.
• Re-running the pipeline reproduces extractions/v2.1.234/ byte-identically.
• Release artifacts are not committed; _held/ remains gitignored.

🤖 Generated with Claude Code

[lroolle]

Review note: how to read a 12k-line diff

+12,347 across 43 files, but the human-authored surface is ~700 lines:

Surface	Lines	How to read it
scripts/extract-registry.py, extract-direct-reads.py, extract-binary.sh	310	read closely — this is the method change
SUMMARY.md x6, README.md, FLAGGED.md	373	read
extractions/v2.1.234/new_vs_2.1.218.txt + removed_vs_*.txt	85	this is the actual result — 77 added, 8 removed
Everything else (all_vars.txt, registry.tsv, direct_reads.txt x6 versions)	~11,900	regenerate, don't read

Reproduce any version:

scripts/extract-binary.sh <binary> v2.1.234
scripts/compare-release.sh v2.1.218 v2.1.234
scripts/validate-extraction.sh v2.1.234

v2.1.234 reproduces byte-identically on a re-run; all six versions pass validate-extraction.sh.

The judgement call worth a reviewer's attention

This PR rewrites already-published artifacts for v2.1.170, v2.1.197 and v2.1.218. That is history being amended, so it should be a deliberate call rather than a side effect.

The case for doing it: the published v2.1.197→v2.1.218 diff claimed 126 removals that never happened. Leaving a known-wrong number in place, in a repo whose whole premise is "verifiable rather than asserted", is worse than amending it. Each affected SUMMARY.md carries a Re-measured (method correction) note, and v2.1.234/SUMMARY.md puts old and new numbers side by side.

The case against: a reader who cited the old counts now finds different ones with no tag to pin against.

If you'd rather preserve the published record verbatim, the alternative is to leave v2.1.170–218 untouched and only apply the new method from v2.1.234 forward — at the cost of a version-over-version diff that isn't apples-to-apples. I went with correctness; say the word and I'll split it.