fix(rules): stamp since with the release a rule ships in

Makefile

@@ -13,7 +13,7 @@ ZENSICAL := uvx --with pyyaml==6.0.2 zensical@$(ZENSICAL_VERSION)
 # developed against. Pinned so a validator release cannot change what CI means without a
 # commit here. --meta . points it at THIS working tree rather than a released tag, so a
 # rule added in a branch is enforced by the run that introduces it.
-OOLD_VERSION ?= 0.18.1
+OOLD_VERSION ?= 1.0.1
 OOLD := uv run --with "oold[validation]==$(OOLD_VERSION)" oold
 
 .PHONY: validate

docs/contributing.md

@@ -46,6 +46,20 @@ The baseline hashes each rule's text, so a silent change of meaning under a stab
 
 `MAY` is deliberately outside the recognised levels: the catalogue tracks obligations, and a permission is not one. Record permissions as prose.
 
+## Cutting a release
+
+A rule is authored before the release that carries it exists, so `extract_rules.py` records `since: unreleased`. Resolve it as part of tagging, never by hand:
+
+```bash
+uv run scripts/promote_since.py 1.0.0-rc.4   # unreleased -> the version being cut
+make spec                                     # docs/rules.md picks up the resolved value
+git commit && git tag v1.0.0-rc.4
+```
+
+Only `unreleased` entries change. Every other `since` records a release that has already shipped, and rewriting one turns the field into "whenever the generator last ran".
+
+`OOLD_VERSION` in the `Makefile` pins the validator `make validate` runs. Bump it when a release of the reference implementation adds a check the specification now requires, or CI gates a release with a validator that predates its own rules.
+
 ## Compliance fixtures
 
 `examples/compliance/` holds cases with a declared outcome, checked against the meta-schema. A rule with no fixture is a rule no implementation is held to, so prefer adding a case over adding a rule alone. `coverage.rules` reports which machine-checkable rules have no check behind them; treat that list as the backlog.