diff --git a/CHANGELOG.md b/CHANGELOG.md
index 354fa7dc..f7551c40 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,13 @@
 
 - **`plugin/hooks/hooks.json` 顶层那个说明键改名 `description`**：Claude Code 从 2.1.267 起按白名单核该文件的顶层键（`description` / `hooks` / `modules` / `surface`；本机留存的三个二进制实测：2.1.266 无此检查，2.1.267 与 2.1.269 有；其 changelog 未记），不在名单的键每次开会话点名一次后忽略。原键 `_why_timeout` 自 2026-08-19（cd11fda）起未动，装机 1.7.2 那份与仓内逐字节同；改名只换键名，说明文字逐字保留、行数不变。三条钩子的接线从未受影响（键被忽略、钩子照常跑），子仓读该文件的三个门（`face_parity` / `facts/count` / `health_plugin`）只读 `hooks` 键。装机上的副本要等下个版本发出并 `claude plugin update` 后才换，此前告警仍在。ADR-006 具名重立：CHANGELOG 651 → 655。
 
+**无默认档位变更。** dependabot 每周批第二轮（2026-09-12；PR #11 / #12，用户裁「修两行注释后并入」与「现在并、做全套记账」）：
+
+- **PR #12 `github/codeql-action/upload-sarif` 4.37.9 → 4.38.0**：ci.yml 两处 SARIF 上传 action 的 sha `cdf488f5…` → `b96794f0…`（= v4.38.0 tag 解引用，GitHub API 核过）。dependabot 换 sha 不改行尾注释，两行仍写 v4.37.9 / 2026-09-06 / #7——`.github/` 不在度量宇宙、无门可抓——在 PR 分支补一笔注释提交后合并。
+- **PR #11 `interprocess` 2.4.3 → 2.4.4**（daemon 的命名管道 IPC 库）：上游只改文档与打包——错字、死链、`checks-and-tests.py` 不再入包（免得发行版打包器以为要 Python）；两版 Cargo.toml 的依赖段逐字节同，windows-sys 要求仍是 0.61。gui 锁文件手动同点 2.4.4（version + checksum 两行，两工作区 `cargo metadata --locked` 过）：`cargo update -p interprocess --precise 2.4.4` 会顺带把七个无关包（anstyle-query、anstyle-wincon、dirs-sys、socket2、winapi-util 等）的 windows-sys 引用从 0.61.2 改到 0.60.2 / 0.59.0——cargo 解锁被点名包的依赖子树、其余包偏好仍锁着的版本——比这次升级该动的宽，不采。NOTICE 一行随之再生。
+- **bench 七个面翻成「该有行、tag 后测量」**（README 双语、docs/BENCH.md、两首页、两 bench 页）：`cli/Cargo.lock` 是构建输入（`bench_support/joins.rs` 按内容比、只剔版本戳），锁一动即不再是 v1.7.0 那份被测程序；PR 首跑 CI 的 5 条红（三平台同）正是这四条 bench 门 + NOTICE 门。判决 / 分数算法 / schema id / wire 不变；下个发布按 BENCH.md 入列规则须量一次 bench。
+- 门：主 check 944 / dedup 55 / scan 0 fail（deadcode 0 / docdup 0 / erase 0），子仓 983 / 119 / 0，lib 373、it 399 (12 ign；`layout_tree` / `docs_diagrams` 两腿只在度量用的 worktree 里红——前者要机器本地的 `.ccm/`、后者要 `cli/target/archify` 缓存——CI 为准)，两锁 `--locked` 过；ADR-006 具名重立：CHANGELOG 655 → 662（首页自测块 944 / 尺寸轴 86 不动，无需重 bless）。
+
 ## [v1.7.2] — 2026-09-10 — GUI 根目录选择器；1.7.1 只到了 Release 与插件的五条渠道在本版补齐
 
 **无默认档位变更。** GUI 读者面（2026-09-10，用户报两条）：
diff --git a/NOTICE b/NOTICE
index 64c9f6af..8f54893d 100644
--- a/NOTICE
+++ b/NOTICE
@@ -188,7 +188,7 @@ ignore 0.4.33 — Unlicense OR MIT
 indexmap 1.9.3 — Apache-2.0 OR MIT
 indexmap 2.14.0 — Apache-2.0 OR MIT
 infer 0.19.0 — MIT
-interprocess 2.4.3 — 0BSD OR Apache-2.0
+interprocess 2.4.4 — 0BSD OR Apache-2.0
 ipnet 2.12.1 — MIT OR Apache-2.0
 is_terminal_polyfill 1.70.2 — MIT OR Apache-2.0
 itoa 1.0.18 — MIT OR Apache-2.0
diff --git a/README.md b/README.md
index 9d5a6989..76f81d3a 100644
--- a/README.md
+++ b/README.md
@@ -95,7 +95,7 @@ scanned 9 files / 19 functions — 1 warn, 1 fail -> FAIL (failed: hard_line)
 | p50 ms | 2387 | 1166 | 10293 | 495 | 1408 | 48 | 683 |
 | p95 ms | 2396 | 2873 | 10326 | 509 | 1428 | 58 | 2622 |
 
-Every value is generated from `contracts/bench/bench.json`; the test rejects hand edits to this block. The current release, v1.7.2, ships the same measured code as the newest row and gets none of its own. [Full replay notes and per-version series](docs/BENCH.md) · [Complete website dashboard](https://codeeraser.dev/bench/)
+Every value is generated from `contracts/bench/bench.json`; the test rejects hand edits to this block. The current release, v1.7.2, earns a row and does not have one yet: it is measured after the tag. [Full replay notes and per-version series](docs/BENCH.md) · [Complete website dashboard](https://codeeraser.dev/bench/)
 <!-- bench:end -->
 
 Latency rows are release-build replays on one fixed host, comparable version to version only. The precision and recall points are frozen with their evaluation ledgers ([EVAL-SET](docs/EVAL-SET.md)) and rendered on [BENCH](docs/BENCH.md); comparators (jscpd, similarity-*) are named with the exact version measured.
diff --git a/README.zh.md b/README.zh.md
index 83acf56c..3ba2f47d 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -95,7 +95,7 @@ warn invoicer/report.py:1 file-lines = 35（上限 30）[invoicer/report.py]
 | p50 ms | 2387 | 1166 | 10293 | 495 | 1408 | 48 | 683 |
 | p95 ms | 2396 | 2873 | 10326 | 509 | 1428 | 58 | 2622 |
 
-所有值均由 `contracts/bench/bench.json` 生成；本块手改会被测试拒绝。当前发布 v1.7.2 与最新一行是同一份被测代码，故没有自己的行。[完整回放说明与逐版本系列](docs/BENCH.md) · [网站完整仪表盘](https://codeeraser.dev/zh/bench/)
+所有值均由 `contracts/bench/bench.json` 生成；本块手改会被测试拒绝。当前发布 v1.7.2 该有自己的行，而它在打 tag 之后才被测量，尚未落表。[完整回放说明与逐版本系列](docs/BENCH.md) · [网站完整仪表盘](https://codeeraser.dev/zh/bench/)
 <!-- bench:end -->
 
 延迟行是 release 构建在同一台固定主机上的回放，只做版本间比较。精度与召回点随各自的评估台账冻结（[EVAL-SET](docs/EVAL-SET.md)），渲染在 [BENCH](docs/BENCH.md)；对照工具（jscpd、similarity-*）标明所测的确切版本。
diff --git a/ce-baseline.json b/ce-baseline.json
index e9e37c43..3bbf5e50 100644
--- a/ce-baseline.json
+++ b/ce-baseline.json
@@ -25413,7 +25413,7 @@
     [
       17920374367022734992,
       0,
-      655
+      662
     ],
     [
       17920675998036182998,
diff --git a/cli/Cargo.lock b/cli/Cargo.lock
index 3eb028b8..df2fa1fa 100644
--- a/cli/Cargo.lock
+++ b/cli/Cargo.lock
@@ -432,9 +432,9 @@ dependencies = [
 
 [[package]]
 name = "interprocess"
-version = "2.4.3"
+version = "2.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "798de1433ba514cc6c04c4144c2469af81396e4906195218737c776d47769572"
+checksum = "6cb02ffbf25e8ef0f4a95bff054eef75f6d1bf16919474cf2caa63b21997478a"
 dependencies = [
  "doctest-file",
  "libc",
diff --git a/docs/BENCH.md b/docs/BENCH.md
index 1b6aa1de..d8f3839a 100644
--- a/docs/BENCH.md
+++ b/docs/BENCH.md
@@ -47,7 +47,7 @@
 > table cannot gain a row the rule forbids, and a release that earns one
 > says which of the two reasons it has none yet.
 
-The current release, v1.7.2, ships the same measured code as the newest row and gets none of its own.
+The current release, v1.7.2, earns a row and does not have one yet: it is measured after the tag.
 
 ## Latency series (self repository)
 
diff --git a/gui/src-tauri/Cargo.lock b/gui/src-tauri/Cargo.lock
index 0531db5b..fbcf5f6d 100644
--- a/gui/src-tauri/Cargo.lock
+++ b/gui/src-tauri/Cargo.lock
@@ -1784,9 +1784,9 @@ dependencies = [
 
 [[package]]
 name = "interprocess"
-version = "2.4.3"
+version = "2.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "798de1433ba514cc6c04c4144c2469af81396e4906195218737c776d47769572"
+checksum = "6cb02ffbf25e8ef0f4a95bff054eef75f6d1bf16919474cf2caa63b21997478a"
 dependencies = [
  "doctest-file",
  "libc",
diff --git a/site/bench/index.html b/site/bench/index.html
index 84ba6317..0f501cdb 100644
--- a/site/bench/index.html
+++ b/site/bench/index.html
@@ -182,7 +182,7 @@ <h2>Latency by version · v1.7.0</h2>
 <tr><td><code>1.7.0</code></td><td><code>hook_probe</code></td><td>48</td><td>58</td><td>30</td><td><code>windows/x86_64/16cpu</code></td><td>2026-09-06</td></tr>
 <tr><td><code>1.7.0</code></td><td><code>scan</code></td><td>683</td><td>2622</td><td>5</td><td><code>windows/x86_64/16cpu</code></td><td>2026-09-06</td></tr>
 </tbody></table></div></div>
-<p class="cap">The current release, v1.7.2, ships the same measured code as the newest row and gets none of its own.</p>
+<p class="cap">The current release, v1.7.2, earns a row and does not have one yet: it is measured after the tag.</p>
 <h2>Frozen evaluation points</h2>
 <div class="term data-table"><div class="tablewrap"><table><thead><tr><th>metric</th><th>value</th><th>source</th></tr></thead><tbody>
 <tr><td><code>docdup_d3_precision</code></td><td>17/17 scoped (100%)</td><td><code>docs/EVAL-SET-M5-3.md:88-95 + contracts/eval/docdup-precision-*-v1.json</code></td></tr>
diff --git a/site/index.html b/site/index.html
index da55bcd9..211aedf1 100644
--- a/site/index.html
+++ b/site/index.html
@@ -141,7 +141,7 @@ <h2>Measured · v1.7.0</h2>
 <div class="install metric"><span class="k">guard false positives (630 arbitrated events)</span><code>0.00 per 500 edits</code></div>
 <div class="install metric"><span class="k">docdup precision (frozen golden set)</span><code>17/17 scoped (100%)</code></div>
 </div>
-<p class="cap">Every number is produced by replay (cli/tests/it/bench.rs and bench_backfill.rs) from one source, contracts/bench/bench.json — never hand-filled. The current release, v1.7.2, ships the same measured code as the newest row and gets none of its own.</p>
+<p class="cap">Every number is produced by replay (cli/tests/it/bench.rs and bench_backfill.rs) from one source, contracts/bench/bench.json — never hand-filled. The current release, v1.7.2, earns a row and does not have one yet: it is measured after the tag.</p>
 <!-- bench:end -->
 <p><a href="/bench/">Complete evaluation dashboard →</a></p>
 
diff --git a/site/zh/bench/index.html b/site/zh/bench/index.html
index 8d9c0de9..5ebe83dd 100644
--- a/site/zh/bench/index.html
+++ b/site/zh/bench/index.html
@@ -181,7 +181,7 @@ <h2>逐版本延迟 · v1.7.0</h2>
 <tr><td><code>1.7.0</code></td><td><code>hook_probe</code></td><td>48</td><td>58</td><td>30</td><td><code>windows/x86_64/16cpu</code></td><td>2026-09-06</td></tr>
 <tr><td><code>1.7.0</code></td><td><code>scan</code></td><td>683</td><td>2622</td><td>5</td><td><code>windows/x86_64/16cpu</code></td><td>2026-09-06</td></tr>
 </tbody></table></div></div>
-<p class="cap">当前发布 v1.7.2 与最新一行是同一份被测代码，故没有自己的行。</p>
+<p class="cap">当前发布 v1.7.2 该有自己的行，而它在打 tag 之后才被测量，尚未落表。</p>
 <h2>冻结评估点</h2>
 <div class="term data-table"><div class="tablewrap"><table><thead><tr><th>指标</th><th>值</th><th>来源</th></tr></thead><tbody>
 <tr><td><code>docdup_d3_precision</code></td><td>范围内 17/17（100%）</td><td><code>docs/EVAL-SET-M5-3.md:88-95 + contracts/eval/docdup-precision-*-v1.json</code></td></tr>
diff --git a/site/zh/index.html b/site/zh/index.html
index c665ca38..64fb5dcf 100644
--- a/site/zh/index.html
+++ b/site/zh/index.html
@@ -140,7 +140,7 @@ <h2>实测 · v1.7.0</h2>
 <div class="install metric"><span class="k">守卫误报（人裁 630 事件）</span><code>每 500 次编辑 0.00 次误报</code></div>
 <div class="install metric"><span class="k">docdup 判准（冻结黄金集）</span><code>范围内 17/17（100%）</code></div>
 </div>
-<p class="cap">每个数字由回放产生（cli/tests/it/bench.rs 与 bench_backfill.rs），单源 contracts/bench/bench.json——绝不手填。当前发布 v1.7.2 与最新一行是同一份被测代码，故没有自己的行。</p>
+<p class="cap">每个数字由回放产生（cli/tests/it/bench.rs 与 bench_backfill.rs），单源 contracts/bench/bench.json——绝不手填。当前发布 v1.7.2 该有自己的行，而它在打 tag 之后才被测量，尚未落表。</p>
 <!-- bench:end -->
 <p><a href="/zh/bench/">完整评估仪表盘 →</a></p>