Commit counts not filtered by author

The commit count on the about page fell from 412 to 376, and several days lost a level with it. Within that range 39 commits by another author were excluded and 3 new ones were counted, a net drop of 36.

The excluded commits came from an aggregation step that applied no author filter: commits made by another agent in the Bingu repository were counted as the blogger's activity.

The script aggregated by commit date with no author predicate. Repository-level isolation does not hold here — the unit of aggregation is the account, and the account spans several repositories.

An allowlist of author emails was introduced; only commits from listed addresses are counted.

One boundary cannot be decided by intuition: the allowlist cannot be derived from whether an address is verified on the account. 292 of the blogger's historical commits use an address that was never verified there, so a verification check would drop them along with everything else.

The script now reports the excluded authors and their commit counts after each run. A new machine identity therefore becomes visible instead of being dropped silently.

The same class of problem had occurred once before: the range once included a third-party mirror repository, bilibili-api-collect. The blogger has 0 commits in it; the repository holds 1219 commits by 239 distinct outside authors across 523 active days.

Over its full history, including it raised the active-day count from 76 to 597 — a difference of 521 days — but the site renders only the last 52 weeks, and most of those 521 never reached the chart.

Inside the heatmap window the repository holds 11 commits on 6 dates: 4 cells emptied entirely (2025-11-06, 11-16, 2026-01-11, 01-21) and 2 lost a level (01-19, 01-22). The affected count is 6 cells, not 521.

A fork check does not catch this: fork is false on the repository, with no parent and no upstream — it was uploaded in one go on 2026-01-29.

Correctness rests on one check only: matching commit author emails against the blogger's account, which reduces the mirror's 1219 commits to zero.

The repository allowlist (fetching only the account's four repositories) bounds scope and cost, not correctness — with the mirror left in the range and only the email filter applied, every per-day count inside the window is identical to the current one.

The relationship between the two lists invites being written backwards; describing them as "one guards each failure, both required" would suggest that dropping either changes the result, which is not the case.