fix: accuracy pass on the public surfaces before sharing (v3.4.0.1)

[savvides]

Share-readiness audit found three things wrong on public surfaces. Fixed, each with a guard so it cannot come back.

Three evidence cards claimed better evidence than the repo holds

Card	Showed	Actually
Needs Analysis	T2–T5	all 7 references are T3
Evaluation Models	T2–T5	T3–T5
Online Course Quality Frameworks	T1–T5	T1–T4

The other eight were correct and every study count already matched (they sum to 108).

Overstating a tier is the one inaccuracy this project cannot ship, so the fix is not the three numbers. test/check-evidence-cards.py derives every count and tier span from evidence/references.md; smoke-test fails on disagreement, names the domain, and flags the overstating direction specifically. Two mutations pin it, one per failure axis (tier drift, count drift).

PRIVACY.md did not disclose two outbound calls

It said "No data is sent to external servers by idstack" and carved out only course-import fetching from Canvas.

• /idstack:course-export POSTs modules, pages, assignments and discussions to your Canvas instance (skills/course-export/SKILL.md:813 onward).
• bin/idstack-update-check runs git fetch against this repo, at most hourly.

Both now documented under Third-party services. Verified complete by enumerating every outbound host across bin/, templates/ and skills/ — the Canvas API and that git fetch are the only two.

The Windows install path could not work

README.md told Windows users to open PowerShell and run ./setup. It is an extensionless bash script and no .ps1 ships, so PowerShell cannot execute it. Now names the shell that works (WSL or Git Bash) and says why PowerShell does not.

Also

• ROADMAP.md claimed "18 mutations" against an actual 24. Count removed rather than corrected so it cannot drift a third time.
• TODOS.md described a "See it work" landing section that a redesign had already removed.
• v3.4.0.0 was merged but never tagged, so release.yml never fired. Tagged retroactively at b795d02; the release is now live.

Verification

Suite	Result
smoke-test.sh	354/354 (was 353)
integration-test.sh	48/48
test-setup.sh	17/17
test-doctor.sh	13/13
test-status.sh	22/22
test-manifest-merge.sh	23/23
test-version-classifier.sh	27/27
test-plugin-status.sh	9/9
test-preamble-python.sh	6/6
mutation-test.sh	24/24 guarded (was 22)

🤖 Generated with Claude Code