[finding] plugins/uberdev/skills/merge-pipeline/lib/release-anchor.sh — 2 findings #800

RELEASE_ANCHOR_PLACEHOLDER_RE is matched against the whole removed-line set, not scoped to the section the release commit opens. A release commit may therefore delete any italic bullet from any previously shipped release's notes and still return tolerated. The constant's own header states the intent is a release-note placeholder and that a release commit has no business deleting a shipped release's notes, so the implementation does not enforce the scope it claims. Impact is bounded only because nothing in the repo reads CHANGELOG.md back - bump-version.sh and goal-state.sh write it and no shipped code parses it.

The check tests every removed CHANGELOG line against the placeholder and unreleased regexes, and a blank removed line matches neither. When a release commit removes a pending-notes stub together with an adjacent blank line - what 5a produces whenever a prior release left its stub unreplaced, the case the new header comment explicitly wants to tolerate - git pairs them into one hunk, chg_removed becomes a newline followed by the stub, the empty first line fails the grep, and the probe returns changelog_deletions. TRUST_HEAD then stays on the trailer-less release commit and PATH_2 (b) fails trust_trail_trailer_missing, which is the unresolvable premerge trail this rewrite was made to fix. The mirror image is also live: when the removals are only blank lines, command substitution strips them to the empty string, the -n guard skips the check entirely, and the deletion is silently tolerated. Both reproduced on a throwaway repo.