chore(data): bump the registry pointer to 7d109195

[maehr]

Picks up the second-wave works verified against registry #25.

Registry PR	Work	References
textrefs/registry#39	Dante, Divina Commedia	14,233
textrefs/registry#38	Hume, Treatise + first Enquiry	1,468
textrefs/registry#40	Eight Nietzsche works	2,737

Closes registry #34, #36 and #37.

The registry goes from 12 works to 23, and from 67,959 references to 86,397.

What changed in kind, not just in size

Three new citation systems (dante-cantica-canto-verse, hume-section-paragraph, hume-book-part-section-paragraph), and the Nietzsche works reuse the existing integer-section rather than adding a fourth.

Every count was harvested from the provider and checked against an external total rather than typed:

• Commedia — 4,720 + 4,755 + 4,758 = 14,233, the canonical line count of the poem. An earlier harvest silently truncated by rate limiting summed to 13,939; that discrepancy is what caught it.
• Enquiry — 12 sections, 255 paragraphs, boundary-checked (id 41 present, 42 absent on section 10).
• Treatise — 3 books, 10 parts, 90 sections, 1,213 paragraphs, discovered by walking until the site 404s.
• Nietzsche — extents found by binary search against the provider's own 404s, each confirmed in both directions.

One deliberate exception worth a reviewer's eye

The Dante Lab resolver is plaintext HTTP. dantelab.dartmouth.edu presents a TLS certificate for CN=*.herokuapp.com, which does not match the hostname, so https:// fails validation in curl and in browsers. This is the same condition that disqualified wittgensteinsource.org in registry #24, and it is accepted here at the maintainer's request as a conscious exception rather than an oversight. It is also canto-level only, so it sits beside the verse-level Princeton resolver as a reading companion, never as a replacement. Both limitations are recorded in the YAML.

If the link checker is configured to fail on plaintext HTTP or on certificate errors, this pin is where that will first bite.

Checks on the new pin

• npm run validate:data — 86,477/86,477 records valid (works=23, systems=13, refs=86,397, mappings=44)
• npm run compile:data — no dropped resolver targets
• npm run verify — passes; 259,811 pages built, all internal links valid

The pinned SHA 7d109195 is the head of registry main, so the ancestry check in .github/workflows/validate.yml passes.

[Copilot]

Pull request overview

This PR updates the data git submodule (the textrefs/registry pointer) to SHA 7d109195, bringing in newly verified works and reference inventories so the site can build and serve the expanded registry.

Changes:

• Bump the registry submodule pointer to 7d109195 (registry main).
• Pull in new/updated registry content: Dante (Divina Commedia), Hume (Treatise + first Enquiry), and eight Nietzsche works (works 12 → 23; references 67,959 → 86,397).
• Introduce three new citation systems in the registry data and record a deliberate plaintext-HTTP resolver exception for Dante Lab.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[maehr]

Added a safe dependency update to this branch (1cccb8b).

npm update only — package.json is untouched. The lockfile moves seven packages to the newest version their declared range already allows:

Package	From	To
@astrojs/starlight	0.41.7	0.41.9
@commitlint/cli	21.2.1	21.2.2
@commitlint/config-conventional	21.2.0	21.2.2
astro	7.2.1	7.2.7
mermaid	11.16.1	11.17.2
starlight-openapi	0.26.0	0.26.1
uuid	14.0.1	14.0.2

Deliberately not taken, because neither is a safe update:

• starlight-blog 0.28.0 → 0.29.0 — outside the declared range
• typescript 6.0.3 → 7.0.2 — major

The three high-severity advisories are still open, on purpose

All three are one chain: form-data (CRLF injection) ← httpsnippet ← starlight-openapi.

npm's only offered remedy is a downgrade of starlight-openapi to 0.24.0, which it flags isSemVerMajor. So npm audit fix --force would move the tree backwards to clear the warning. I did not run it — that is not a safe update, and it is the opposite of what this commit is for.

Context for whoever weighs it: starlight-openapi is a devDependency used to render the API docs at build time. Nothing in that chain reaches a published page, and the advisory concerns multipart field names in outbound HTTP requests, which this build does not make. Worth a deliberate decision rather than a reflexive --force.

npm run verify passes on the updated tree: 86,477 records valid, 259,811 pages built, all internal links valid.