security watch: seven pins it can never read are a stated GAP, so the source streaks reset; a read timeout is retried; every failed source is printed (R-1334); R-1310's rules (another package, every GHSA a release names, a word-only line, date tags)

scripts/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 2026-11-02 — the watch: stated unreadable pins are GAP, timeouts retried, every failed source printed (R-1334); R-1310's rules
+
+- **Measured first** (`documentation/audits/security-2026-11-02/part1/DIAGNOSIS.md`): five real nights, both runners, 0 Docker Hub 429. A
+  streak is per source, so seven pins that can never be read held `registry:docker.io` and `runtime` open for a week, and a real
+  outage of either could not have mailed.
+- **`security_watch.py`:** `STATED_UNREADABLE` (pin + its one answer) and our private registry's DooPlex images are GAP with the
+  reason in the weekly mail; a read timeout is retried on every source (`Transient`, budget 30 a night), a ghcr.io 429 too, the
+  digest resolve once. Log: `FAILED-SOURCE …`, `FAILED-SOURCES n`, `RUNTIME … not-checked=… stated-unreadable=…`, `retried-timeout=`.
+- **R-1310:** `PACKAGE_NOT_OURS`; one entry per GHSA a release names; `WORD_ONLY` lines are no ADVISORY; `YY.MM.YYYYMMDD` tags ignored.
+- Tests: W15, W16, W12 changed — 100 checks; red first (`tests-red-before-fix.txt`), each rule also by a mutant (13 of 13 red).
+
 ## 2026-10-30 — `publish-site-cloudflare.sh`: the website and the installer to Cloudflare Pages (D35 / R-1228)
 
 - Stages `website/` from `origin/main` and `scripts/` from the installer tag named in `manifests/webpage.yaml`; REFUSES