CodeRabbit #576: the 45 minor/trivial findings not taken in that PR

[SUaDtL]

The 24 Major findings from CodeRabbit's review of #576 were fixed in that PR (plus the two follow-ups #577 and this one). These are the deferred remainder: 35 minor + 10 trivial. All real, none load-bearing; batched so #576 stayed reviewable.

Full thread: #576

Stale prose and governance records

• _protectedstatelib.py: the "registry ships EMPTY" claim is stale in six places now that three consumers are enrolled.
• _bashguardlib.py: the same stale empty-registry comment (both vendored copies).
• specs/release-portable-fixture.md: header still says awaiting approval; the Phase 1 gate cleared.
• plans/portable-release-and-protected-state.md: prose blocks sit between table rows without a blank line, so markdown parses them as one-cell rows; and the coverage proof disagrees with the ledger on A-6.7/T-77 and A-6.8/T-79.
• reports/agent-lane-proof.json: the stopping-rule narrative says eight exercises, the campaign ran 13; verification.as_of still names run 8 / commit 5192ef7.
• security-controls.md:513: #175 at line start trips markdownlint MD018.
• Root CHANGELOG.md: one statement needs correcting; README version badge lags package.json.
• debug/SKILL.md: missing relative pronoun.

Docstring and API surface

• _releaselib.py: Public API list omits four exported functions; provenance_trigger_paths docstring omits generated_manifest; --targets-file doc is wrong for two subcommands; a blank rebuild: is reported as a declared command; a pair with an empty name returns "", outside the documented label set.
• _releaselib.py: add ValueTooLongError to the declared-exceptions list; add a timeout to the git probe.
• .github/scripts/_releaselib.py: select_release_target_by_name is either public API or should not be re-exported.

Robustness

• check_skill_proof_fresh.py: validate the document type before .get() — valid JSON of [] or null raises AttributeError.
• payload_version_gate.py: two payloads with the same basename overwrite each other silently; catch ReleaseTargetsError around tag_prefixes().
• _releaselib.py: any OSError maps to AbsentBlockError, so a permissions failure can trigger the back-fill lane — same "unreadable is not absent" class as the taskwrite fix in feat(release): a portable release fixture and the protected-state machinery it needs (#563, #564) #576.
• _protectedstatelib.py: canonicalize the path before deriving the marker name.
• releasehash.py: exit code 2 means three different things.
• init-codearbiter.py: use the full DONE_TASKS template when done-tasks.md is absent (an existing repo's first archive currently seeds from the bare heading, which differs from the reviewed scaffold).

Tests

• test_ux_conversion.py:177: a missing standup file makes the obligation group pass with zero checks (if not path.exists(): continue).
• test_consumer_smoke.py: migrate shutil.rmtree(onerror=) to onexc (removed in Python 3.14, which is what this repo runs); the v2.8.13 tag requirement has no preflight.
• test_release_trace.py: pin the pre-change commit with the full 40-char SHA rather than an abbreviation.
• test_taskwriter.py: assert the --desc flag through the CLI, not by grepping source text.
• test_pre_edit.py: add the stale-marker case against the production registry.

Workflow and docs

• release.yml: a preceding comment now contradicts the new call; no test covers the accepting arm's target list.
• context-creation (pi): the drafted block omits latest-eligible, disagreeing with the back-fill detector.
• Site: list /ca:standup as an archive writer; drop the hardcoded bare-command behavior from the release guide.