@@ -9,6 +9,6 @@
 ## Checklist
 
 - [ ] `make test` and `make build` pass
-- [ ] **CHANGELOG:** an entry under `## [Unreleased]` in `CHANGELOG.md` if this changes the shipped binary — or the `no-changelog` label if nothing user-visible changed ([CONTRIBUTING](https://github.com/awslabs/ferret-scan/blob/main/CONTRIBUTING.md#changelog-entries)). The `CHANGELOG` check reports on this.
+- [ ] **CHANGELOG:** a fragment `changelog.d/NNNN-slug.md` ([format](https://github.com/awslabs/ferret-scan/blob/main/changelog.d/README.md)) if this changes what a release ships — or the `no-changelog` label if nothing user-visible changed ([CONTRIBUTING](https://github.com/awslabs/ferret-scan/blob/main/CONTRIBUTING.md#changelog-entries)). Do not edit `## [Unreleased]` in `CHANGELOG.md`. The `CHANGELOG` check reports on this.
 - [ ] Golden corpus regenerated and the diff explained, if detection, scoring, output or redaction changed
 - [ ] `Closes #N` for any issue this resolves
@@ -1,31 +1,32 @@
 name: CHANGELOG
 
-# Fails a pull request that changes what a release ships without an entry under [Unreleased]. The
-# rules and the evidence for them live in internal/tools/changelogcheck/check.go; this file only
-# feeds it the PR.
+# Fails a pull request that changes what a release ships without adding a release-note fragment
+# under changelog.d/, and any pull request that adds an entry under [Unreleased] in CHANGELOG.md or
+# a fragment the release could not render. The rules and the evidence for them live in
+# internal/tools/changelogcheck/check.go, the fragment format in internal/tools/changelogfrag; this
+# file only feeds the check the PR.
 #
-# WHY AT PR TIME. The release-time promotion (changelog-promote.yml) can only stamp what is already
-# written, and v2.5.3 shipped four binary-changing PRs with nothing written: promotion found
-# [Unreleased] empty and correctly did nothing. The author of the PR is the one person who knows
-# what changed, and this is the last moment they are looking.
+# WHY AT PR TIME. The release-time promotion (changelog-promote.yml) can only render what is already
+# written, and v2.5.3 shipped four binary-changing PRs with nothing written: promotion found nothing
+# and correctly did nothing. The author of the PR is the one person who knows what changed, and this
+# is the last moment they are looking.
+#
+# WHY FRAGMENTS (#821). Entries used to go under [Unreleased] in CHANGELOG.md, at the same few lines
+# for every PR, so any two PRs open at once conflicted when the second merged. A new file per PR
+# cannot conflict with another PR's new file.
 #
 # WHY THE MERGE RESULT. actions/checkout on a pull_request event checks out refs/pull/N/merge, so
-# HEAD^1 is the base tip and HEAD is what main will contain after the merge — the view that catches
-# an entry placed beside a subsection heading in an old release.
+# HEAD^1 is the base tip and HEAD is what main will contain after the merge.
 #
-# WHY ALSO AFTER THE MERGE. A pull_request result is computed once, against the main of that moment,
-# and nothing re-runs it when main moves. So a PR whose check passed before a release was promoted
-# can still merge its entry into the section that release just promoted — a clean three-way merge,
-# measured. The `after-merge` job closes that: on the push to main it compares where the PR's own
-# branch put the entry with where the merge put it, and fails on the main commit, which notifies the
-# person who merged it.
+# NO AFTER-MERGE JOB. Until #821 a second job ran on every push to main and failed when a release
+# promoted while a PR was open had carried the PR's entry, by a clean three-way merge, into the
+# section that release had just promoted. A fragment is a file of its own that no release moves, so
+# that failure no longer has a mechanism; the job and the push trigger it needed are gone.
 on:
   pull_request:
     # edited: the title (a `type!:` breaking marker) and the base branch are inputs.
     # labeled/unlabeled: `no-changelog`.
     types: [opened, edited, synchronize, reopened, labeled, unlabeled]
-  push:
-    branches: [main]
 
 permissions:
   contents: read
@@ -54,45 +55,3 @@ jobs:
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           PR_LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
         run: go run ./internal/tools/changelogcheck
-
-  after-merge:
-    if: github.event_name == 'push'
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      pull-requests: read # to find the PR this push merged
-    steps:
-      - name: Checkout main with history
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # The PR's merge-base with the old main can be arbitrarily far back.
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: '.go-version'
-
-      - name: Find the pull request this push merged
-        id: pr
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          SHA: ${{ github.sha }}
-        run: |
-          number=$(gh api "repos/${REPO}/commits/${SHA}/pulls" --jq '[.[] | select(.merged_at != null)][0].number // empty')
-          echo "number=${number}" >> "$GITHUB_OUTPUT"
-          if [ -z "${number}" ]; then
-            echo "No merged pull request for ${SHA} (a direct push); nothing to compare."
-          fi
-
-      - name: Compare the branch's placement with the merge's
-        if: steps.pr.outputs.number != ''
-        env:
-          NUMBER: ${{ steps.pr.outputs.number }}
-          BEFORE: ${{ github.event.before }}
-          AFTER: ${{ github.sha }}
-        run: |
-          git fetch --no-tags --quiet origin "refs/pull/${NUMBER}/head"
-          go run ./internal/tools/changelogcheck -base "${BEFORE}" -head "${AFTER}" -pr-head "$(git rev-parse FETCH_HEAD)"
@@ -3,9 +3,13 @@ name: Promote CHANGELOG on release
 # #647: `## [Unreleased]` had swallowed 27 releases because nothing cut it at release time -- and
 # the one tool that ever tried (git-chglog, removed in #646) REGENERATED the file from commit
 # subjects, destroying the hand-written prose. This workflow does the additive alternative: when a
-# release tag is pushed, rename [Unreleased] to that tag and insert a fresh empty [Unreleased]
-# above it. scripts/promote-changelog.sh owns the surgery and its guarantees (byte-preservation,
-# idempotence on a re-run, no-op on an empty section, hard failure on a missing anchor).
+# release tag is pushed, render the release notes collected for it -- one fragment file per pull
+# request under changelog.d/ (#821), plus any old-style bullets still under [Unreleased] -- into a
+# dated section right below the [Unreleased] heading, and remove the rendered fragments in the same
+# commit. scripts/promote-changelog.sh owns the surgery and its guarantees (byte-preservation of
+# every bullet line, idempotence on a re-run, no-op when nothing was collected, hard failure on a
+# missing anchor or a malformed fragment); the rendering is internal/tools/changelogrender, hence
+# the Go toolchain below.
 #
 # TRIGGER: the TAG PUSH, not `release: published` -- and that is load-bearing, not a style choice.
 # goreleaser publishes the release with the workflow-provided GITHUB_TOKEN, and events performed
@@ -49,6 +53,12 @@ jobs:
           # meantime, and rebasing from a shallow clone fails with "unshallow" errors.
           fetch-depth: 0
 
+      # The renderer is Go; same pinned action and version source as changelog-check.yml.
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: '.go-version'
+
       - name: Promote [Unreleased] to the released tag
         env:
           TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
@@ -91,7 +101,8 @@ jobs:
           fi
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add CHANGELOG.md
+          # changelog.d: the script already `git rm`ed the rendered fragments; README.md stays.
+          git add -- CHANGELOG.md changelog.d
           git commit -m "chore(changelog): promote [Unreleased] to ${TAG} [skip ci]"
           # goreleaser[bot] pushes the brew formula to main in the same minute; retry over it.
           for attempt in 1 2 3 4 5; do
 
@@ -14,111 +14,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### 🐛 Bug Fixes
-
-- **secrets (line pre-check):** a `"url"`, `"checksum"` or version/boolean member anywhere on a line no
-  longer switches off token and keyword detection for that line
-  ([#765](https://github.com/awslabs/ferret-scan/issues/765)). `containsSecretIndicators`, the pre-check
-  in front of the keyword pass, ran three whole-line substring checks before its provider-literal
-  admits, and a hit dropped the line: one `"url": "https://github.com/…"` member, a
-  `"bucket": "shared-assets"` beside a `"checksum"` key (`shared` holds `sha`) or a trailing
-  `"verbose": true` hid an AKIA key ID, a `ghp_`/`glpat-`/`xoxb-` token, a JWT or a keyword-assigned
-  password anywhere else on it. Nothing reached the redactor, so no redacted copy was written,
-  `--pre-commit-mode` exited 0 and the `--stdin --enable-redaction` gateway passed the token through.
-  Measured on v2.5.5 with the issue's nine trigger files and their one-word controls: seven reported
-  nothing where the control reported every value, one (`"url"` beside a 40-character password) lost
-  its AKIA key ID on every draw and the password on 10 of 31, and one reported only the token that
-  #766's URI source finds outside the pre-check; 99 of 143 cells of 13 secret shapes × 11 trigger
-  contexts reported nothing; `glpat-`, `xoxb-`, AKIA, JWT and 12–20-character passwords were found 0
-  of 40 times after a `"url"` or `"integrity"` member and 40 of 40 after `"name"`. Now the
-  provider-literal admits (JWT, every provider prefix, PEM markers) run first, and the three checks
-  are replaced by one veto that skips a line only when it is wholly one benign manifest member — a
-  version under 20 bytes, a boolean, an SRI digest or a URL with no user info, query or `=` — with no
-  keyword stem anywhere on it, and was skipped before. Every trigger now reports what its control
-  reports (31 of 31 seeded draws), all 143 cells and every matrix cell (40 of 40) detect the value,
-  the lockfile decoy stays silent, both redacted copies hold no value, both pre-commit runs exit 1
-  and the gateway emits no token. **New findings only:** on the matrices,
-  the reproduction, 39 public npm lockfiles and 3,691 public files that hit one of the old checks, no
-  existing finding changes type, text, line or confidence, and main's suppression rules still suppress
-  every one of them; on a line whose token in URL user info is also a provider literal, the finding's
-  `detection_method` now reads `keyword_pattern` instead of `uri_userinfo`. One shape, absent from all
-  of those sets, does change an existing finding: a password in the user info of a `"url"`,
-  `"resolved"` or `"homepage"` URL on a registry or forge host whose user name ends in a keyword stem
-  (`https://deploy-token:<pw>@registry…`) is now reported, as on every other line, as the keyword
-  pass's wider `<pw>@host/path` span, so a rule written against the narrower finding must be
-  regenerated. The veto still skips 99.1% of the lockfile lines the old checks skipped; SECRETS CPU on
-  those lockfiles is 3–6% above v2.5.5 (deleting the checks outright measured 2.7x).
-- **redaction (overlapping findings):** two findings on one line whose values share bytes are now one
-  write over their union, in every writer, so no part of either survives and which one is written no
-  longer depends on input order ([#773](https://github.com/awslabs/ferret-scan/issues/773)). Each writer
-  applied findings one at a time, locating each by its text in content an earlier write had already
-  changed, so the second of two crossing values was skipped: `Residence: 77 August Lane, Boise ID 83702`
-  (an address and two names) came out as `Residence: 77 August *********** ID 83702` from `.txt`,
-  `--stdin`, `pkg/scan` and `pkg/redact`, as `**************, Boise ID 83702` from `.docx`, and as
-  `77 ***********, Boise ID 83702` from legacy `.doc`/`.xls`/`.ppt`, which had no overlap pass at all and
-  leaked containment too (`Located at 100 ****************** Blvd`) -- each at exit 0, with an audit log
-  reporting `failed_redactions: 0`. For the same bytes reported twice (`PASSPORT` and `SSN` on one
-  9-digit number) the writer's sort tied and `sort.Slice` broke the tie by algorithm, which changes at 13
-  elements: `Passport number: 512010001` kept its last four digits (`*****0001`) or not depending on how
-  many unrelated findings the file held. A group now renders by one rule: a contained finding collapses
-  into the widest, as before, except that no original letter or digit inside a contained SECRETS finding
-  is copied; the same bytes take the highest-confidence finding's label and keep a character only if
-  every finding on them would; crossing findings are masked whole under `format_preserving` and take the
-  highest-confidence placeholder under `simple`. Measured over the repository's 1,717 tracked files
-  (11,451 findings): of 87 same-span pairs whose types disagree on the last four digits, 32 kept them and
-  now 0 do; of 22 crossing pairs, 21 left part of a value in cleartext and now 0 do. Findings,
-  recall/precision and suppression hashes are unchanged. A group that cannot be located refuses the file
-  instead of writing part of it, and the audit log records one entry per group with every member's type
-  in `member_types`. The `secrets_uri_userinfo_email_overlap` snapshot now masks the password's first
-  character, which the email's mask used to keep.
-- **redaction, pkg/scan, pkg/redact (cut-short coverage):** a redaction that could not examine all of
-  its input now fails on every sink the way `--file` always has, and a fired validator budget keeps
-  what it found instead of discarding it and re-running the file
-  ([#770](https://github.com/awslabs/ferret-scan/issues/770)). Measured on v2.5.5: `--stdin
-  --enable-redaction` exited 0 under `--fail-on-incomplete` on a cut-short scan (a 1ns budget, a log
-  over the 5 MiB `CLOUD_RESOURCES` cap, `SSN=300ms` on 20,000 records), and in pre-commit mode `--stdin`
-  printed 0 bytes of disclosure; `Engine.Redact` returned `err == nil` with the input unredacted for a
-  pre-cancelled context, for 1, 100 and 200 ms deadlines (0 of 6,000 findings) and for a 5.8 MB
-  `CLOUD_RESOURCES` request; `RedactFile` copied an unparseable `.pdf` byte-identical to the output
-  path, and a log over the cap with 5,518 of 5,518 ARN lines in clear, at `err == nil`; `ScanText` and
-  `ScanFile` ignored their context (30,000 of 30,000 findings under a pre-cancelled one). Now
-  `--stdin` exits 3 under the flag on both of its paths and prints a one-line notice in pre-commit
-  mode; `Engine.Redact` returns an error wrapping the new `redact.ErrIncomplete` and the cause, with
-  the partial `Result` alongside (`Incomplete`, `IncompleteReason`, both also on `AuditRecord`);
-  `RedactFile` and the new `RedactFileContext` return an error wrapping the new `scan.ErrIncomplete`
-  with `RedactFileResult.Coverage` set (a pointer, so the struct stays comparable) and write no
-  passthrough copy; `ScanText` and `ScanFile` return `(nil, ctx.Err())` for a context done at entry
-  and the partial result with an error wrapping `ctx.Err()` when it fires mid-scan, and `ScanText`
-  fills `NotExamined`; the web UI's `/scan` runs under the request's context. A fired budget is no
-  longer retried as a transient fault (each re-ran every check on the file twice more: `SSN,EMAIL`
-  with `SSN=1s` on records.txt cost 7.36–7.44 s CPU, now 3.22–3.29 s); the partial findings are kept
-  (`SSN=1s`: 0 → 8,704–9,216 of 20,000 SSNs), scored and annotated exactly as a complete run scores
-  them (each identical to its unbudgeted twin, metadata included); and a partial that arrives within
-  100 ms of a caller's cancellation is collected (`Engine.Redact` on 2,000 records at a 100 ms
-  deadline: 0 → 4,768 of 6,000 findings). Behaviour changes to know: library callers get an error
-  where they got `(cleartext, nil)`; `examples/lambda-redact` answers `redaction incomplete` for a
-  request over 5 MiB with `CLOUD_RESOURCES` enabled; budgeted runs report more findings and
-  `--generate-suppressions` writes more rules; the `--stdin` warning's reason reads `coverage cut
-  short: …`. Runs whose budget never fires are unchanged (golden corpus 0 files changed, `make score`
-  identical).
-
-### 🔒 Security
-
-- **build (go 1.27.3):** move every Go pin to **1.27.3**, which carries the fix for the one open Go
-  1.27.2 standard-library advisory, GO-2026-6809 / CVE-2026-111943 in `crypto/x509`: `Verify` now
-  refuses a set of intermediate certificates that are no longer trusted, for the platforms whose
-  system trust store is not updated without further action. The two open code-scanning alerts on
-  `main` — #3842 (Trivy, HIGH) and #3843 (Grype) — are readings of the `ghcr.io/awslabs/ferret-scan:main`
-  image built at v2.5.5, where the binary's embedded `stdlib` is go1.27.2, and the fixed versions
-  both scanners name are 1.26.10 and 1.27.3. `.go-version` is the single source: `release.yml`,
-  `pypi-publish.yml` and `go-test.yml` install it, and `scripts/go-version.sh all` propagated it to
-  `go.mod` (unchanged at `go 1.27`), `.gitlab-ci.yml` and the Dockerfile builder, whose
-  `golang:1.27.3-alpine` digest `sha256:b8c9b82a…` was checked against `public.ecr.aws` before
-  adoption: every platform in the index, including linux/amd64 and linux/arm64, carries
-  `GOLANG_VERSION=1.27.3` (built 2026-10-20 to 2026-10-22). `make check-go-version` is green on the
-  branch. The `:main` image and its two alerts refresh on the merge to `main`; the published release
-  artifacts — the v2.5.5 binaries, Homebrew formula, PyPI wheel and `:latest` container — stay on
-  1.27.2 until the next tag is cut from this pin.
+Entries for the next release live as one file per pull request in [`changelog.d/`](changelog.d/)
+and become a dated section below this heading when the release tag is pushed;
+`make changelog-preview` shows that section now. Nothing else goes under this heading.
 
 ## [v2.5.5] - 2026-10-22