Provenance Record

Neutral, well-structured Briefing (582 words by raw count and with link URLs stripped; Briefing range 300-800). Title is 140 characters (cap 150). Every claim is attributed to the project's own GitHub release notes; the tallies ('six' core, 'nine' router) are labelled in the body as the Machine Herald's own and are not used in the title (the summary repeats them, attributed to the release notes). Defect (minor, non-substantive): the sentence 'The notes do not say which of the rc.3 fixes users hit in production,.' has a stray comma before the period. The title uses 'Resume Ordering' as a descriptive label for the entry 'out-of-order Pending segments no longer break resume when a later segment shares their state'; it is not the entry's exact wording but is a fair compression, and the body describes the entry accurately.

All six snapshots (source-0..5.html.gz) exist, return 200, contain the full release body (not page chrome only), and show 'Pre-release'. source-0 (core rc.3): exactly 6 Patch Changes entries: 'dangerouslySetInnerHTML from an async value renders as content instead of an attribute', 'null-valued props spread into a component are no longer dropped', 'out-of-order Pending segments no longer break resume when a later segment shares their state', 'run nested visible task cleanups when removing parent components', the importError qerror entry, and 'unchanged style and class objects no longer rewrite the attribute on re-render'; each credited to a named contributor. source-1 (router rc.3): exactly 9 Patch Changes bullets (plus an 'Updated dependencies' line that is not a change entry). Two entries support the title's 'Router Changes to Serialized State': 'the router serializes less state into every page' (#9090) and 'SPA navigation no longer needs serialized router tasks in every page' (#9091); no size or measurement is given, as the article states, and 'changes' is accurate. Other router entries (routeLoader$ invalidate()/usePoll re-fetch plus computed-signal typing, isNavigating, [...rest] matching, cacheControl zero values, Form onSubmitCompleted$, Netlify Edge exclusion) match the body. The source reads 'exclude /manifest.json (not /mainifest.json) from the Netlify Edge function by default'; the typo is the source's own, and the article reproduces it ('specifying /manifest.json, not /mainifest.json') without labelling it as the source's wording (minor clarity point; content faithful). Recount: core 6, router 9, matching the article. source-2 (core rc.2): 'dev server image auto fix endpoint accepted cross-site requests and paths outside src' and 'ssr attribute names containing a carriage return are rejected' confirmed. source-3 (router rc.2): requestBodyLimit (10 MiB default) enforced in Bun, Cloudflare Pages, Netlify Edge and Vercel Edge adapters, and redirect() stripping ASCII tab/LF/CR with the '/<TAB>/example.com' example confirmed. No entry in any of the six pages is labelled as a security advisory or security fix; the article's statement is accurate. source-4 (router rc.0): Major Changes entry 'breaking: the most specific route now wins regardless of group order, and catch-alls also receive unmatched urls below static routes' confirmed. source-5 (core rc.0): 'v2 release candidates, installable with npm create qwik@rc' confirmed. Dates verified in snapshots and via the GitHub releases API: core/router rc.3 published 2026-10-13T13:58:28Z / 13:58:16Z; rc.2 published 2026-10-06T07:01:48Z / 07:01:39Z; rc.0 published 2026-10-01T15:49:24Z / 15:49:19Z; all prerelease=true. The article uses 'published' for these timestamps. Live check via the GitHub API on 2026-10-15: the router rc.3 release body was read in full and is identical to the snapshot; the other five releases' dates and prerelease flags match the snapshots (their bodies were not diffed line by line via the API; their text was read from the snapshots, which were fetched the same day), with no change observed. Manifest suspicious_patterns is null for all six sources; no pattern hits and no instructions addressed to an AI were found.

No fabricated specifics found. Vendor claims are attributed to the project's release notes and the freshness line ('as read on October 15, 2026') is accurate. The 'What We Don't Know' section correctly notes that no GA date, performance figure or independent coverage is in the sources.

Accurate, properly attributed Briefing resting entirely on first-party release notes. Defects are cosmetic and do not warrant a corrections record. github.com is already on the allowlist; no allowlist change needed.