Summary

• remove the nonexistent app_url telemetry quota-bonus claim from sync, async, and historical public wording
• add a sentence-bounded, relationship-aware claim guard across authored package text and every readable installed-wheel file recorded by RECORD
• release the correction as immutable patch 1.12.7

Red / green

Red first:

• 6 new authored/wheel bonus cases failed while 49 existing storefront tests remained green
• the request-context attribution sentence Telemetry sends extra application metadata with API requests. then exposed a real matcher false positive and failed independently in both SDKs

Green on exact head 00b8c64bed61b5fcd65d4c671bbb4dd984aac4b2 (tree 387a3ef556b9ff259fd93eabab8105689a5fcc5c):

• focused storefront + release readiness: 68 passed
• full unit suite: 629 passed, 13 skipped, 63.58% coverage
• ruff: green
• mypy: 46 source files green
• pip-audit: no known vulnerabilities
• source claim validator: 63 public surfaces
• warning-free wheel + sdist build
• exact wheel validator: every readable RECORD entry
• clean wheel install, pip check, import/version/interface proof, and live keyless Brent demo smoke

Exact local candidates:

• wheel: oilpriceapi-1.12.7-py3-none-any.whl, 53 entries, SHA256 c6cc5e6e23b754f691bf442fe51516b4ccfe3a55ece061f437907be3e01d8e24
• sdist: oilpriceapi-1.12.7.tar.gz, 77 entries, SHA256 e15cdf0cc5cf839505c37595151976366a59346f746981013288ab7b3b352121
• recursive wheel and non-test sdist public/source bonus scan: green

Release

Merge through protected main, then publish v1.12.7 only through the existing reviewed PyPI OIDC workflow. Public immutable hashes/provenance, clean PyPI install, authenticated + keyless production smokes, and the scheduled synthetic remain release gates.