fix: close figure diagnostics and render contract gaps

CHANGELOG.md

@@ -15,6 +15,11 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html) and
   changed-file `uv run ruff check ...`, and `uv run python figops_mcp_server.py --smoke`.
 - Maintainers tag releases after merge; implementers open PRs but do not merge or tag.
 
+## [0.20.2] - 2026-07-29
+
+Post-0.20.1 release-candidate metadata entry. This records the next patch
+candidate only; merge, tag, and package publication remain maintainer actions.
+
 ## [0.20.1] - 2026-07-25
 
 Post-0.20.0 release-candidate metadata entry. This records the next patch

docs/internal/protocols/05_mcp_tool_playbook.md

@@ -109,6 +109,20 @@ fixed and change only style/output controls.
 - `manual_review_needed=false` is not human or venue approval.
 - Preview resources are lazy, manifest-bound, MIME-checked, and size-bounded.
 
+### Audit policy names and unavailable geometry
+
+`figops.audit_artifact` accepts the stable public policy-pack name
+`publication-readiness-v1`. The adapter projects that public name to the
+internal `publication-readiness-v2` policy projection before evaluating the
+evidence. `publication-readiness-v2` is intentionally not a public enum value;
+callers must continue sending `publication-readiness-v1`.
+
+For required geometry, `not_applicable` means that the required observation is
+unavailable or cannot be measured. It is not a passing result: the measurement
+must include a non-empty `reason`, and the resulting policy projection remains
+`needs_review` until the required evidence is available. Optional unavailable
+geometry may remain informational under the selected policy.
+
 When writes are disabled, `figops.inspect_data`, `figops.audit_artifact`, and
 manifest/preview reads remain available. Render, scaffold, normalize, and batch
 write handlers are omitted from discovery and fail closed without side effects

docs/packaging/public-release-status.md

@@ -2,14 +2,14 @@
 
 - Inventory valid: yes
 - Package distribution allowed: yes
-- Repository technically eligible for public release: yes
+- Repository technically eligible for public release: no
 - Repository publication authorized: yes
-- Repository release allowed: yes
+- Repository release allowed: no
 - Authorization evidence references: 1
-- Technical release gate: ok
-- Technical blockers: 0
+- Technical release gate: blocked
+- Technical blockers: 1
 - Auto-fixable technical blockers: 0
-- Confirmation-required technical blockers: 0
+- Confirmation-required technical blockers: 1
 
 Repository publication authorization is recorded in the authoritative inventory approval fields with validated HTTPS evidence references. The technical gate remains independent evidence; a release is allowed only when both authorization and technical eligibility are yes.
 
@@ -19,3 +19,4 @@ Decision record: [public-release-decision-record.md](./public-release-decision-r
 
 | Family | Count | Status | Confirmation | Action |
 | --- | ---: | --- | --- | --- |
+| private_marker | 1 | requires_decision | yes | Sanitize or relocate files that contain real project identifiers or private style names. |