closure_drift: does your version label name exactly one version of your code?

Abstract

A read-only, zero-dependency tool that measures, over any git repository, whether a declared version label identifies exactly one state of the producing code at the points where that repository publishes. Addressing a published artefact by (input, version) is sound only if the label is injective over closures. Nothing enforces that: the label is a string a human edits. When two code states share a label, one address denotes two outputs, and the system cannot detect it, because the label is the only thing it recorded. The tool distinguishes publication regimes. At tags (the default) it measures the case of released software; at commits it measures continuously published output. Measured against four widely used open-source projects (click, requests, packaging, httpx) it reports no drift; against a system publishing a daily edition under a hand-maintained label it reports one label covering six distinct closures. The failure belongs to continuous publication, not to versioning in general. Each report stamps the commit measured and the hash of the tool that measured it, because a count over repository history is a function of repository state. Version 0.4.0: the measurement script is byte-identical to 0.3.0; this version adds a negative test fixture (label-only ledger: must be refused at tags and reported as drift at commits), the documented limitation (the detector checks addressing, not re-execution of originating code states), and new reference results over three public repositories selected under a pre-registered rule. Version 0.5.0: the measurement script is byte-identical to 0.3.0 and 0.4.0, and no reference result was re-run. What changes is what the deposit says about itself, and what it asks for. RESULTS.md is a table for measurements produced by someone other than the author, on repositories the author does not control; it is published empty, because as of this release nobody outside the author has run the tool and reported a result, and omitting the section would let a reader assume otherwise. It states what a line must carry to count — the version DOI of the deposit used, the stamp block as emitted, and the publication-point setting — and records that results contradicting the detector are wanted on the same terms as results confirming it. The report carries counts, labels and hashes and never file contents, so a private repository can be measured without anything leaving the machine. SCOPE.md states what the tool does and, explicitly, what it will not be extended to do: the (A) the record is well-formed / (B) the artefact can be re-produced boundary, restated as a commitment rather than a caveat. NOTICE records that the author has patent applications pending; it adds no condition to the licence, and commercial use carries no royalty and no payment obligation. The README now leads with the measured result and adds two sections: why an unambiguous address is a precondition of reproducibility rather than a part of it, and what this tool is not — it never rebuilds and it issues no attestation.