@adia-ai/adia-ui-forge 0.8.36 → 0.8.38

package/skills/{adia-release → package-release}/scripts/bump.mjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
-// bump.mjs — bump the 11 lockstep @adia-ai/* package.json from --from to --to.
+// bump.mjs — bump every lockstep @adia-ai/* package.json from --from to --to.
+// The set is PACKAGE_ROSTER (package-paths.mjs) filtered to `lockstep !== false`,
+// never a count written here — that number went stale twice.
 //
 // Idempotent. Stops on the first mismatch (a package not at --from) so
 // you can investigate before any mutation lands.
@@ -8,11 +10,11 @@
 //   node bump.mjs --from 0.6.20 --to 0.6.21
 //   node bump.mjs --from 0.6.20 --to 0.6.21 --dry
 //
-// Part of the adia-release skill. Replaces the /tmp/vXXX-prep.mjs
+// Part of the package-release skill. Replaces the /tmp/vXXX-prep.mjs
 // improvisation pattern from the v0.6.13 → v0.6.21 cycles.
 //
 // Exits:
-//   0  — all 11 bumped successfully (or --dry succeeded)
+//   0  — every lockstep package bumped successfully (or --dry succeeded)
 //   1  — at least one package not at --from (no mutation)
 //   2  — bad args / file I/O error
 //   3  — partial mutation (shouldn't happen if --from validation passes)
@@ -39,30 +41,53 @@ const SIBLING_MANIFESTS = Object.fromEntries(
 
 // Cross-package EXACT pins bumped in the same pass — a different shape from a
 // package.json "version" field, so SIBLING_MANIFESTS' regex can't reach them.
-// The factory plugin's .mcp.json pins @adia-ai/a2ui-mcp to the exact lockstep
+// The factory plugin's .mcp.json pins @adia-ai/mcp to the exact lockstep
 // version (SKILL invariant 8 — the consumer never floats). bump.mjs left this
 // untouched through the 0.8.6 + 0.8.7 cuts, forcing a manual edit + amend each
 // time; check-lockstep's mcp-pin guard now catches a drift, this moves it.
+//
+// Each package maps to an ARRAY of pin configs — the factory README's own
+// prose echo of the same pin (`server pinned: @adia-ai/mcp@X`) is a
+// SECOND file invariant 8 covers, and check:plugin-count-claims' "factory
+// README generation-MCP pin" EQUALITY check enforces the two agree. Left out
+// of this array through the 0.8.35 + 0.8.36 cuts, it needed the same manual
+// hand-commit .mcp.json used to (gh#1198) — same file set, invariant 8's own
+// scope, so it moves alongside .mcp.json rather than getting its own key.
+//
+// `@adia-ai/mcp` is the single live name since the 0.8.37 estate-split cut
+// flipped the pin in its release commit (ADR-0048 P7). The bridge-window
+// alternation over the retired names (`a2ui-mcp`, the never-published
+// `gen-ui-mcp`) was narrowed back by the shim-deletion follow-up PR, matching
+// lockstep-checks.mjs's MCP_PIN_RE — a retired name in the pin must now fail
+// loudly instead of being bumped along.
+const A2UI_MCP_PIN = {
+  label: 'generation-MCP pin (@adia-ai/mcp)',
+  // `@adia-ai/mcp@<from>` (not a prefix of a longer version) → `@<to>`
+  // Escape EVERY regex metacharacter in `from`, not just dots: a prerelease or
+  // build-metadata version (`0.9.0-rc+1`) would otherwise inject `+` as a
+  // quantifier and silently match the wrong text. Same class as the truncating
+  // MCP_PIN_RE suffix CodeRabbit found on PR #1229.
+  pattern: (from) =>
+    new RegExp(`(@adia-ai/mcp@)${from.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\d.])`),
+  replace: (to) => `$1${to}`,
+};
 const PINNED_REFS = {
-  'packages/plugins/adia-ui-factory': {
-    file: '.mcp.json',
-    label: '@adia-ai/a2ui-mcp pin',
-    // `@adia-ai/a2ui-mcp@<from>` (not a prefix of a longer version) → `@<to>`
-    pattern: (from) => new RegExp(`(@adia-ai/a2ui-mcp@)${from.replace(/\./g, '\\.')}(?![\\d.])`),
-    replace: (to) => `$1${to}`,
-  },
+  'packages/plugins/adia-ui-factory': [
+    { ...A2UI_MCP_PIN, file: '.mcp.json' },
+    { ...A2UI_MCP_PIN, file: 'README.md', label: 'generation-MCP pin (README prose)' },
+  ],
   // web-modules' internal peers pin the EXACT lockstep version (gh#489 —
   // a caret peer never moves on a lockstep bump; adia-v2 sat on llm 0.8.19
   // under web-modules 0.8.22). Same file bumpAll already rewrote for
   // "version", so this pass re-reads it from disk before matching. The
   // check:lockstep peer-exact-mismatch guard catches a pin left behind.
-  'packages/web-modules': {
+  'packages/web-modules': [{
     file: 'package.json',
     label: '@adia-ai/* exact peer pins',
     pattern: (from) =>
       new RegExp(`("@adia-ai/[a-z0-9-]+":\\s*")${from.replace(/\./g, '\\.')}(?![\\d.])`, 'g'),
     replace: (to) => `$1${to}`,
-  },
+  }],
 };
 
 // Repo-level version references (path relative to REPO ROOT, not a package) —
@@ -131,13 +156,15 @@ function loadPackageJsons(repo) {
 // half-bumped tree whose re-run then failed validateAllAtFrom.)
 function loadPinnedRefs(repo) {
   const out = [];
-  for (const [pkg, cfg] of Object.entries(PINNED_REFS)) {
-    const p = path.join(repo, pkg, cfg.file);
-    if (!fs.existsSync(p)) {
-      console.error(`error: missing ${p}`);
-      process.exit(2);
+  for (const [pkg, cfgs] of Object.entries(PINNED_REFS)) {
+    for (const cfg of cfgs) {
+      const p = path.join(repo, pkg, cfg.file);
+      if (!fs.existsSync(p)) {
+        console.error(`error: missing ${p}`);
+        process.exit(2);
+      }
+      out.push({ pkg, cfg, path: p, txt: fs.readFileSync(p, 'utf8') });
     }
-    out.push({ pkg, cfg, path: p, txt: fs.readFileSync(p, 'utf8') });
   }
   for (const cfg of REPO_PINNED_REFS) {
     const p = path.join(repo, cfg.file);
@@ -206,17 +233,19 @@ function bumpAll(packages, from, to, dry) {
       if (!dry) fs.writeFileSync(sibPath, sibOut);
       console.log(`  ${dry ? '[dry] ' : ''}bumped ${p.pkg}/${sibling}: ${from} → ${to}`);
     }
-    const pin = PINNED_REFS[p.pkg];
-    if (pin) {
-      const pinPath = path.join(path.dirname(p.path), pin.file);
-      const pinTxt = fs.readFileSync(pinPath, 'utf8');
-      const pinOut = bumpPinnedRef(pinTxt, pin, from, to);
-      if (pinOut === pinTxt) {
-        console.error(`error: ${p.pkg}/${pin.file} — ${pin.label} '@${from}' not found (invariant 8 drift? set the pin to @${from} and re-run, or use \`npm run check:lockstep:fix\`)`);
-        return -1;
+    const pins = PINNED_REFS[p.pkg];
+    if (pins) {
+      for (const pin of pins) {
+        const pinPath = path.join(path.dirname(p.path), pin.file);
+        const pinTxt = fs.readFileSync(pinPath, 'utf8');
+        const pinOut = bumpPinnedRef(pinTxt, pin, from, to);
+        if (pinOut === pinTxt) {
+          console.error(`error: ${p.pkg}/${pin.file} — ${pin.label} '@${from}' not found (invariant 8 drift? set the pin to @${from} and re-run, or use \`npm run check:lockstep:fix\`)`);
+          return -1;
+        }
+        if (!dry) fs.writeFileSync(pinPath, pinOut);
+        console.log(`  ${dry ? '[dry] ' : ''}bumped ${p.pkg}/${pin.file} ${pin.label}: @${from} → @${to}`);
       }
-      if (!dry) fs.writeFileSync(pinPath, pinOut);
-      console.log(`  ${dry ? '[dry] ' : ''}bumped ${p.pkg}/${pin.file} ${pin.label}: @${from} → @${to}`);
     }
   }
   return bumped;
@@ -267,22 +296,43 @@ function selftest() {
     console.error('selftest FAIL: corrupted package.json (no version match) not caught'); process.exit(1);
   }
 
-  // PINNED_REFS — the .mcp.json a2ui-mcp pin (invariant 8) moves in lockstep.
-  const pinCfg = PINNED_REFS['packages/plugins/adia-ui-factory'];
-  const pinBefore = '{"args":["-y","@adia-ai/a2ui-mcp@0.8.6"]}';
+  // PINNED_REFS — the .mcp.json @adia-ai/mcp pin (invariant 8) moves in lockstep.
+  const [pinCfg, readmePinCfg] = PINNED_REFS['packages/plugins/adia-ui-factory'];
+  const pinBefore = '{"args":["-y","@adia-ai/mcp@0.8.6","gen-ui"]}';
   const pinAfter = bumpPinnedRef(pinBefore, pinCfg, '0.8.6', '0.8.7');
-  if (!pinAfter.includes('@adia-ai/a2ui-mcp@0.8.7') || pinAfter.includes('@0.8.6')) {
-    console.error('selftest FAIL: PINNED_REFS did not bump the .mcp.json a2ui-mcp pin'); process.exit(1);
+  if (!pinAfter.includes('@adia-ai/mcp@0.8.7') || pinAfter.includes('@0.8.6')) {
+    console.error('selftest FAIL: PINNED_REFS did not bump the .mcp.json generation-MCP pin'); process.exit(1);
   }
   // Must NOT prefix-match a longer version (0.8.6 inside 0.8.60).
-  if (bumpPinnedRef('@adia-ai/a2ui-mcp@0.8.60', pinCfg, '0.8.6', '0.8.7') !== '@adia-ai/a2ui-mcp@0.8.60') {
+  if (bumpPinnedRef('@adia-ai/mcp@0.8.60', pinCfg, '0.8.6', '0.8.7') !== '@adia-ai/mcp@0.8.60') {
     console.error('selftest FAIL: PINNED_REFS pattern prefix-matched a longer version'); process.exit(1);
   }
+  // A retired bridge name must NOT be bumped along — it should fail the later
+  // check-lockstep gate loudly, not be silently kept alive by this pass.
+  if (bumpPinnedRef('@adia-ai/a2ui-mcp@0.8.6', pinCfg, '0.8.6', '0.8.7') !== '@adia-ai/a2ui-mcp@0.8.6') {
+    console.error('selftest FAIL: pin pattern matched a retired generation-MCP name'); process.exit(1);
+  }
+
+  // gh#1198 — the factory README's OWN prose echo of the same pin
+  // (`server pinned: @adia-ai/mcp@X`) must move alongside .mcp.json;
+  // check:plugin-count-claims' "factory README generation-MCP pin" EQUALITY
+  // check is what caught this drift on the v0.8.35 + v0.8.36 cuts.
+  if (readmePinCfg.file !== 'README.md') {
+    console.error('selftest FAIL: expected the second factory pin config to target README.md'); process.exit(1);
+  }
+  const readmeBefore = '`adia-gen-ui` server pinned: `@adia-ai/mcp@0.8.6` (tool SoT: `packages/gen-ui/mcp/TOOLS.md`)';
+  const readmeAfter = bumpPinnedRef(readmeBefore, readmePinCfg, '0.8.6', '0.8.7');
+  if (!readmeAfter.includes('@adia-ai/mcp@0.8.7') || readmeAfter.includes('@0.8.6')) {
+    console.error('selftest FAIL: PINNED_REFS did not bump the README generation-MCP prose pin'); process.exit(1);
+  }
+  if (bumpPinnedRef('@adia-ai/mcp@0.8.60', readmePinCfg, '0.8.6', '0.8.7') !== '@adia-ai/mcp@0.8.60') {
+    console.error('selftest FAIL: README pin pattern prefix-matched a longer version'); process.exit(1);
+  }
 
   // web-modules exact peer pins (gh#489) — all three move in one pass; a
   // longer version must not prefix-match.
-  const peerCfg = PINNED_REFS['packages/web-modules'];
-  const peersBefore = '{"peerDependencies":{"@adia-ai/web-components": "0.8.22","@adia-ai/a2ui-runtime": "0.8.22","@adia-ai/llm": "0.8.22"}}';
+  const [peerCfg] = PINNED_REFS['packages/web-modules'];
+  const peersBefore = '{"peerDependencies":{"@adia-ai/web-components": "0.8.22","@adia-ai/a2ui": "0.8.22","@adia-ai/llm": "0.8.22"}}';
   const peersAfter = bumpPinnedRef(peersBefore, peerCfg, '0.8.22', '0.8.23');
   if ((peersAfter.match(/0\.8\.23/g) || []).length !== 3 || peersAfter.includes('0.8.22')) {
     console.error('selftest FAIL: web-modules peer pins did not all move'); process.exit(1);

package/skills/{adia-release → package-release}/scripts/dispatch-publish.mjs

@@ -14,7 +14,7 @@
 //   # Dry mode:
 //   node dispatch-publish.mjs --version 0.6.22 --dry
 //
-// Part of the adia-release skill. Mechanizes the dispatch loop
+// Part of the package-release skill. Mechanizes the dispatch loop
 // + handles the npm-latest ordering rule for batch pushes.
 
 import { execFileSync } from 'node:child_process';

package/skills/{adia-release → package-release}/scripts/gate-roster.mjs

@@ -45,11 +45,11 @@ export const GATE_ROSTER = [
   // cut. examples-md + site-a2ui are the two generators an `.examples.html`
   // edit invalidates (the v0.8.14 cut lost a CI round-trip to exactly that);
   // contrast is the AA gate that gh#427 widened from 42 to 90 pairs;
-  // token-semantics-sync keeps the adia-tokens pack's generated half honest.
+  // token-semantics-sync keeps the token-selection pack's generated half honest.
   { n: 18, cmd: 'npm run check:examples-md-fresh',             what: '.examples.md vs .examples.html' },
   { n: 19, cmd: 'npm run verify:site-a2ui',                    what: 'site-a2ui converted rows vs source fragments' },
   { n: 20, cmd: 'npm run verify:contrast',                     what: 'WCAG AA — canvas-text + text-on-fill pairs' },
-  { n: 21, cmd: 'npm run check:token-semantics-sync',          what: 'adia-tokens generated references vs token sources' },
+  { n: 21, cmd: 'npm run check:token-semantics-sync',          what: 'token-selection generated references vs token sources' },
   // Operator directive 2026-07-27: demo surfaces must be discoverable —
   // components/modules with .examples.html need a /site/components route,
   // catalog patterns need their Pattern Library sitemap entry.
@@ -73,12 +73,12 @@ export const GATE_ROSTER = [
   { n: 25, cmd: 'python3 packages/plugins/adia-ui-factory/scripts/adia-scaffold selftest', what: 'scaffold specifiers resolve in packed tarballs' },
   // gh#1137 (factory-dx-ws6-measurement SPEC, REQ-05) — FLAGGED FOR
   // CONFIRMATION: this entry was authored by the WS-6 build without a live
-  // adia-release sign-off (no operator was available mid-build to confirm
+  // package-release sign-off (no operator was available mid-build to confirm
   // the exact freshness window / regression semantics). Asserts a
   // qa/dx/sweeps/ record exists dated within this cut's window AND its
   // verdict is not a regression-RED (a plain floors<=1 baseline RED does
   // NOT block a cut — only a floor that DROPPED since the prior sweep
-  // does). CONFIRMED by adia-release on the first live cut (v0.8.35,
+  // does). CONFIRMED by package-release on the first live cut (v0.8.35,
   // 2026-08-13): semantics hold, with one correction — the previous-cut
   // comparison excludes the in-flight target version (self-reference fired
   // on the handoff re-run, since the promoted heading was already on main).
@@ -93,14 +93,25 @@ export const GATE_ROSTER = [
   // concern this is not) — hence `targetVersionArg` rather than
   // `versionArg`, a distinct flag release-pack.mjs's step3PreFlight reads.
   { n: 28, cmd: 'node scripts/release/write-eval-health.mjs', what: 'evals/health/<version>.json committed, AC-01/AC-02 run for real', targetVersionArg: true },
+  // ADR-0048 (gh#1192) estate-split latch. Between P1 (mint @adia-ai/gen-ui)
+  // and P5 (shims + roster) the tree is correct in-repo but deliberately
+  // NOT publishable: the old package dirs are `private: true` stubs the
+  // roster still points at, and a2ui-mcp depends on @adia-ai/gen-ui, which
+  // is not on npm until P7. Prose in this doc does not stop a 2am cut; this
+  // gate does. It is a tree property (private / unrostered dep edges), not a
+  // phase number, so it clears itself when P5 lands — and then stays as a
+  // permanent no-cost invariant against any future private-dep edge.
+  // Appended rather than inserted: gate numbers are cited as identities in
+  // shipped release notes, so renumbering would falsify them.
+  { n: 29, cmd: 'node scripts/release/check-estate-split-latch.mjs', what: 'no lockstep cut mid estate-split (ADR-0048)' },
 ];
 
 // -- CLI ------------------------------------------------------------------
 // Only runs when invoked directly (not when imported by release-pack.mjs).
 // realpathSync BOTH sides (CodeRabbit, PR #289): a naive string/URL compare
 // breaks under a symlinked invocation — this skill is normally reached
-// through `.claude/skills/adia-release` -> `packages/plugins/adia-ui-forge/
-// skills/adia-release`, and Node resolves `import.meta.url` through that
+// through `.claude/skills/package-release` -> `packages/plugins/adia-ui-forge/
+// skills/package-release`, and Node resolves `import.meta.url` through that
 // symlink to the real file while `process.argv[1]` keeps the as-invoked
 // path, so an unresolved compare never matches even when this IS the entry
 // point. Verified directly (see embeddings-chunks.mjs's identical guard).

package/skills/{adia-release → package-release}/scripts/insert-stub.mjs

@@ -9,9 +9,9 @@
 //     --substantive "<one-line summary>" \
 //     --xref "packages/web-modules/CHANGELOG.md#0622--2026-05-22" \
 //     --previous-version 0.6.21 \
-//     --packages llm,a2ui/compose,a2ui/mcp,a2ui/retrieval,a2ui/runtime,a2ui/validator
+//     --packages llm,a2ui-compose,a2ui-mcp,a2ui-retrieval,a2ui-runtime,a2ui-validator
 //
-// Part of the adia-release skill. Replaces the inline stub-
+// Part of the package-release skill. Replaces the inline stub-
 // insertion pattern used across v0.6.18 / v0.6.19 / v0.6.20 / v0.6.21
 // cycles.
 
@@ -82,8 +82,20 @@ function insertStub(repo, pkg, anchor, stubBlock, version, dry) {
   }
   const txt = fs.readFileSync(p, 'utf8');
   if (txt.includes(`## [${version}]`)) {
-    console.error(`  ERROR ${pkg} — already has [${version}] heading`);
-    return 'already-present';
+    // TRUE idempotency across partial runs (the gh#976 lesson, learned
+    // here on the v0.8.36 cut's r4): an earlier aborted run already
+    // inserted this stub — that's the DONE state, not an error. The
+    // BOTH-headings danger promote-unreleased guards (real [Unreleased]
+    // content that would miss the release) applies here too: a stub
+    // package whose [Unreleased] still carries content means it was
+    // wrongly classified as a stub — loud stop.
+    const un = txt.match(/^## \[Unreleased\][^\n]*\n([\s\S]*?)(?=^## \[|(?![\s\S]))/m);
+    if (un && un[1].trim().length > 0) {
+      console.error(`  ERROR ${pkg} — has [${version}] heading AND non-empty [Unreleased] content: this package is substantive, not a stub — move it to --substantive-packages`);
+      return 'already-present';
+    }
+    console.log(`  ok ${pkg} — stub already present (idempotent skip)`);
+    return 'inserted';
   }
   if (!txt.includes(anchor)) {
     console.error(`  ERROR ${pkg} — anchor '${anchor}' not found`);
@@ -132,7 +144,7 @@ function main() {
 function selftest() {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'insert-stub-selftest-'));
   try {
-    const dir = path.join(tmp, 'packages', 'llm');
+    const dir = path.join(tmp, 'packages', 'llm', 'core');
     fs.mkdirSync(dir, { recursive: true });
     const clPath = path.join(dir, 'CHANGELOG.md');
     const anchor = '## [0.1.0] — 2026-01-01';
@@ -147,10 +159,20 @@ function selftest() {
       console.error('selftest FAIL: stub must land ABOVE the previous-version anchor, not below'); process.exit(1);
     }
 
-    // Idempotency: re-inserting against an already-stubbed target must fail
-    // loudly, not create a duplicate [0.2.0] block.
+    // TRUE idempotency across partial runs (gh#976 lesson, v0.8.36 r4): a
+    // re-run against an already-stubbed target is the DONE state — ok skip,
+    // file untouched, never a duplicate block.
+    const beforeRerun = fs.readFileSync(clPath, 'utf8');
     const r2 = insertStub(tmp, 'llm', anchor, stub, '0.2.0', false);
-    if (r2 !== 'already-present') { console.error(`selftest FAIL: expected 'already-present' on re-run, got '${r2}'`); process.exit(1); }
+    if (r2 !== 'inserted') { console.error(`selftest FAIL: expected idempotent 'inserted' on re-run, got '${r2}'`); process.exit(1); }
+    if (fs.readFileSync(clPath, 'utf8') !== beforeRerun) { console.error('selftest FAIL: idempotent re-run must not modify the file'); process.exit(1); }
+    if ((fs.readFileSync(clPath, 'utf8').match(/## \[0\.2\.0\]/g) || []).length !== 1) { console.error('selftest FAIL: duplicate stub block'); process.exit(1); }
+
+    // The one loud stop left: stub heading present BUT non-empty [Unreleased]
+    // — a substantive package misclassified as a stub.
+    fs.writeFileSync(clPath, `# C\n\n## [Unreleased]\n\n### Fixed\n- real content\n\n## [0.2.0] — 2026-02-02\n\n- stub\n\n${anchor}\n\n- prior\n`);
+    const r3 = insertStub(tmp, 'llm', anchor, stub, '0.2.0', false);
+    if (r3 !== 'already-present') { console.error(`selftest FAIL: expected 'already-present' for misclassified stub, got '${r3}'`); process.exit(1); }
 
     console.log('selftest OK');
   } finally {

package/skills/{adia-release → package-release}/scripts/package-paths.mjs

@@ -2,21 +2,21 @@
 // standalone CHANGELOG helpers.
 //
 // THE PROBLEM (bit all 6 a2ui packages at the v0.7.14 cut):
-//   The 6 a2ui packages live on disk under `packages/a2ui/<x>/` but carry the
+//   The 6 a2ui packages live on disk under `packages/gen-ui/a2ui/<x>/` but carry the
 //   flat npm-name `a2ui-<x>` everywhere else in the tooling (release-pack.mjs,
 //   dispatch-publish.mjs, tag-lockstep.mjs all use the NAME form). The two
 //   standalone helpers (promote-unreleased.mjs, insert-stub.mjs) joined
 //   `packages/<arg>/CHANGELOG.md` with the raw arg, so calling them with the
 //   name form silently 404'd: `CHANGELOG.md not found at packages/a2ui-corpus/`.
-//   release-pack.mjs maps internally (`a2ui-corpus` → `packages/a2ui/corpus`),
+//   release-pack.mjs maps internally (`a2ui-corpus` → `packages/gen-ui/a2ui/corpus`),
 //   so the two forms diverged: name-form failed standalone, path-form failed
 //   when handed to the orchestrator-style callers.
 //
 // THE FIX:
 //   Accept BOTH forms. Try `packages/<arg>` first (path form, backward-compat).
 //   If that directory is absent AND the arg matches `a2ui-<x>`, fall back to
-//   `packages/a2ui/<x>`. So `a2ui-corpus` (name) and `a2ui/corpus` (path) both
-//   resolve to `packages/a2ui/corpus/`.
+//   `packages/gen-ui/a2ui/<x>`. So `a2ui-corpus` (name) and `a2ui/corpus` (path) both
+//   resolve to `packages/gen-ui/a2ui/corpus/`.
 //
 // Pure Node, stdlib only — keeps the scripts free of runtime deps.
 
@@ -55,6 +55,12 @@ import path from 'node:path';
 // trip-wire (check-release.mjs's per-tag `checkTag` lookup) reads the FULL
 // roster unfiltered — every pushed tag, lockstep or not, still needs its
 // package.json/CHANGELOG validated, so it must recognize a class-B tag too.
+//
+// `shim: true` (ADR-0048 P5) marked the six retired a2ui-* names for their
+// single 0.8.37 bridge cut; the P7 follow-up PR deleted those rows together
+// with packages/shims/. No row carries the flag anymore, and none may — a
+// future one-cut bridge re-introduces the marker with its own retirement PR.
+//
 // Every lockstep-scoped consumer must filter `p.lockstep !== false` itself
 // (this module intentionally does NOT pre-filter PACKAGE_NAMES/PACKAGE_DIRS —
 // they stay full-roster projections so a consumer's own filter is visible at
@@ -62,15 +68,33 @@ import path from 'node:path';
 export const PACKAGE_ROSTER = [
   { name: 'web-components',  dir: 'packages/web-components',           lockstep: true },
   { name: 'web-modules',     dir: 'packages/web-modules',               lockstep: true },
-  { name: 'llm',             dir: 'packages/llm',                       lockstep: true },
-  { name: 'agent',           dir: 'packages/agent',                     lockstep: true },
-  { name: 'persona',         dir: 'packages/persona',                   lockstep: true },
-  { name: 'a2ui-runtime',    dir: 'packages/a2ui/runtime',              lockstep: true },
-  { name: 'a2ui-compose',    dir: 'packages/a2ui/compose',              lockstep: true },
-  { name: 'a2ui-corpus',     dir: 'packages/a2ui/corpus',               lockstep: true },
-  { name: 'a2ui-mcp',        dir: 'packages/a2ui/mcp',                  lockstep: true },
-  { name: 'a2ui-retrieval',  dir: 'packages/a2ui/retrieval',            lockstep: true },
-  { name: 'a2ui-validator',  dir: 'packages/a2ui/validator',            lockstep: true },
+  { name: 'llm',             dir: 'packages/llm/core',                       lockstep: true },
+  { name: 'agent',           dir: 'packages/llm/agent',                     lockstep: true },
+  { name: 'persona',         dir: 'packages/llm/persona',                   lockstep: true },
+  // ── ADR-0048 P5 — the estate split's published names ────────────────────
+  //
+  // The successors of the six old a2ui-* names. `a2ui`/`gen-ui` join here,
+  // which is what turns gate 29 (check-estate-split-latch) green: every
+  // workspace dependency edge — web-components → a2ui, mcp/gen-ui → gen-ui,
+  // the shims → their successors — now points at a name some cut actually
+  // publishes.
+  //
+  // `mcp` (gh#1240, operator ruling 2026-08-14, roster 17 → 16): folds what
+  // were TWO planned rows — `gen-ui-mcp` (P2 rename target) and
+  // `a2ui-protocol-mcp` (minted fresh at P4) — into ONE published name,
+  // `@adia-ai/mcp`, at `packages/gen-ui/mcp/`. Neither predecessor name ever
+  // published a 0.8.x, so this fold has no npm deprecation cycle to run —
+  // unlike the SIX old a2ui-* names, which really did publish and got one
+  // (shim rows retired below). The two-SERVER decision (ADR-0048 §3) is
+  // unchanged; only the npm-distribution row count dropped by one.
+  { name: 'a2ui',              dir: 'packages/gen-ui/a2ui',                    lockstep: true },
+  { name: 'gen-ui',            dir: 'packages/gen-ui/engine',                  lockstep: true },
+  { name: 'mcp',               dir: 'packages/gen-ui/mcp',                     lockstep: true },
+  // The six retired a2ui-* names (a2ui-runtime/-compose/-corpus/-mcp/
+  // -retrieval/-validator) rode EXACTLY the 0.8.37 cut here as `shim: true`
+  // rows under packages/shims/, then the P7 follow-up PR deleted them
+  // (cut-procedure.md §0.8.38 precondition 1). Their npm names are
+  // deprecated pointers; nothing may re-add them.
   // Plugins joined the lockstep 2026-07-15 (check-lockstep.mjs POLICY note);
   // each carries a .claude-plugin/plugin.json that bumps with package.json.
   { name: 'adia-ui-factory', dir: 'packages/plugins/adia-ui-factory',   lockstep: true, plugin: true },
@@ -97,12 +121,17 @@ export const PACKAGE_DIRS = PACKAGE_ROSTER.map((p) => p.dir);
 // require the directory to exist (so callers can render a legible not-found
 // error against the resolved path).
 export function resolvePackageDir(repo, pkg) {
+  // Roster name-form first (ADR-0049): `llm` must resolve to the roster's
+  // `packages/llm/core`, never to the bare `packages/llm/` FAMILY GROUPING
+  // dir that now exists on disk (no package.json, no CHANGELOG) — an
+  // existsSync-first probe would hit the grouping dir and silently target
+  // a non-package. Same for `gen-ui` → `packages/gen-ui/engine`.
+  const row = PACKAGE_ROSTER.find((p) => p.name === pkg);
+  if (row) return path.relative('packages', row.dir);
   if (fs.existsSync(path.join(repo, 'packages', pkg))) return pkg;
-  const m = /^a2ui-(.+)$/.exec(pkg);
-  if (m) {
-    const nested = path.join('a2ui', m[1]);
-    if (fs.existsSync(path.join(repo, 'packages', nested))) return nested;
-  }
+  // (The historical a2ui-* fallbacks — packages/shims/<old-name> and the
+  // pre-split packages/gen-ui/a2ui/<x> nesting — died with the shim-deletion
+  // follow-up PR after the 0.8.37 cut; a2ui-gen-ui-split.md ruled both dead.)
   // Plugins live under packages/plugins/<name> but carry the flat name form
   // (adia-ui-forge) in the release tooling — same name-vs-path split as a2ui.
   if (/^adia-ui-/.test(pkg)) {

package/skills/{adia-release → package-release}/scripts/pr-bridge.mjs

@@ -37,7 +37,7 @@
 //
 // Exit: 0 merged + main re-baselined · 1 stopped (evidence printed) · 2 bad args.
 //
-// Part of the adia-release skill. Registered in CI's "Plugin bin selftests".
+// Part of the package-release skill. Registered in CI's "Plugin bin selftests".
 
 import { execSync, execFileSync } from 'node:child_process';
 import fs from 'node:fs';

package/skills/{adia-release → package-release}/scripts/promote-unreleased.mjs

@@ -14,7 +14,7 @@
 //   node promote-unreleased.mjs --version 0.6.22 --date 2026-05-22 \
 //     --packages web-components,web-modules --dry
 //
-// Part of the adia-release skill. Replaces the inline heading-swap
+// Part of the package-release skill. Replaces the inline heading-swap
 // pattern used across v0.6.18 / v0.6.19 / v0.6.20 / v0.6.21 cycles.
 //
 // Exits:

package/skills/{adia-release → package-release}/scripts/release-pack.mjs

@@ -55,7 +55,7 @@
 //   --skip-gates         : (DEBUG ONLY) skip pre-flight (don't ship anything!)
 //   --skip-site          : skip the EXE deploy step (rare; for offline cycles)
 //
-// Part of the adia-release skill. Mechanizes the cut procedure from
+// Part of the package-release skill. Mechanizes the cut procedure from
 // references/cut-procedure.md. Every confirmation boundary prints its evidence
 // block BEFORE the prompt (H5) — never a bare y/N — whether it waits for input
 // (manual flags) or auto-confirms (--go).
@@ -222,8 +222,8 @@ function help() {
     --gh-notes-file /tmp/release-v$X.Y.Z.md \\
     --substantive "<one-line>" \\
     --xref "packages/web-modules/CHANGELOG.md#0$X$Y$Z--YYYY-MM-DD" \\
-    --substantive-packages web-components,web-modules,a2ui/corpus \\
-    --stub-packages llm,a2ui/compose,a2ui/mcp,a2ui/retrieval,a2ui/runtime,a2ui/validator
+    --substantive-packages web-components,web-modules,gen-ui \\
+    --stub-packages llm,agent,persona,a2ui,mcp,adia-ui-factory,adia-ui-forge
 
 Flags: --go   (single-authorization: the operator's cut-start go covers the
                whole cycle — auto-confirms ALL checkpoints; stops only on
@@ -691,11 +691,22 @@ function step5Commit(args) {
     'packages/genui/adia-catalog/base.json',
     'packages/genui/adia-catalog/adia-pack.json',
     'packages/genui/adia-catalog/catalog-data.js',
+    // gh#1197: gate 28 (write-eval-health.mjs, Step 3) writes this
+    // COMMITTED per-cut health record — WS-4 REQ-06's contract — but it
+    // never rode the release commit: v0.8.35's and v0.8.36's records both
+    // sat untracked until a session close-out swept them by hand (PR
+    // #1196). Named after args.version (gate 28 is a targetVersionArg gate,
+    // so it always writes at the CUT version, never previous — see Step 3's
+    // targetVersionArg comment above). Under --skip-gates the record was
+    // never written (Step 3 returned early), so staging it would make the
+    // whole `git add` fail on a missing pathspec (PR #1204 review).
+    ...(args.skipGates ? [] : [`evals/health/${args.version}.json`]),
     ...LOCKSTEP_ROSTER.flatMap(({ name, dir, plugin }) => {
       // Roster-driven (H3): each package stages its manifest + CHANGELOG;
       // plugins also stage .claude-plugin/plugin.json (the /plugin-update
-      // cache key, moved by bump.mjs); factory additionally pins a2ui-mcp in
-      // .mcp.json (SKILL invariant 8 — bump.mjs moves the pin too).
+      // cache key, moved by bump.mjs); factory additionally pins the
+      // generation MCP (@adia-ai/mcp) in .mcp.json (SKILL invariant 8 —
+      // bump.mjs moves the pin too).
       const files = [`${dir}/package.json`, `${dir}/CHANGELOG.md`];
       if (plugin) files.push(`${dir}/.claude-plugin/plugin.json`);
       if (name === 'adia-ui-factory') files.push(`${dir}/.mcp.json`);
@@ -1009,13 +1020,13 @@ async function main() {
   const args = parseArgs(process.argv.slice(2));
   // Fail-fast guard: refuse to git/npm/gh/curl against a non-monorepo directory.
   assertMonorepoRoot(REPO);
-  console.log(`adia-release release-pack — v${args.version} (${args.mode})${args.dry ? ' [DRY]' : ''}`);
+  console.log(`package-release release-pack — v${args.version} (${args.mode})${args.dry ? ' [DRY]' : ''}`);
   // Stale-plugin-cache self-check (v0.8.32 cut, first failure): the INSTALLED
   // plugin cache only refreshes on a version bump, so running this script from
   // the cache mid-cycle can execute a version that predates its own guards
   // (SKILL.md §Plugin cache). If the repo carries its own copy and the bytes
   // differ, warn loudly — the repo copy is almost always the newer one.
-  const repoCopy = path.join(REPO, 'packages/plugins/adia-ui-forge/skills/adia-release/scripts/release-pack.mjs');
+  const repoCopy = path.join(REPO, 'packages/plugins/adia-ui-forge/skills/package-release/scripts/release-pack.mjs');
   const selfPath = new URL(import.meta.url).pathname;
   if (fs.existsSync(repoCopy) && path.resolve(selfPath) !== path.resolve(repoCopy)) {
     const self = fs.readFileSync(selfPath, 'utf8');
@@ -1115,6 +1126,10 @@ function selftest() {
       'STOPPING per invariant 3',
       // gh#358 — the release branch must actually be created, not just documented.
       'git checkout -b release/v9.9.9',
+      // gh#1197 — Step 5's staging pathspec must carry gate 28's committed
+      // health record, or it rides untracked past the release commit
+      // (v0.8.35/v0.8.36 both did, PR #1196 swept them by hand).
+      'evals/health/9.9.9.json',
     ];
     for (const marker of need) {
       if (!out.includes(marker)) {
@@ -1153,7 +1168,13 @@ function selftest() {
       guardFailed = true;
       guardOut = (e.stdout || '') + (e.stderr || '');
     }
-    if (!guardFailed || !guardOut.includes('ride-along') || !guardOut.includes('a2ui-validator')) {
+    // The expected ride-alongs are DERIVED from the roster (everything but
+    // the one --substantive-packages entry above), never transcribed — a
+    // hard-coded name here went stale when the shim-deletion follow-up PR
+    // shrank the roster 16 → 10 (the same never-transcribe rule the cut
+    // docs enforce on every other roster projection).
+    const expectedRideAlongs = PACKAGES.filter((p) => p !== 'web-components');
+    if (!guardFailed || !guardOut.includes('ride-along') || !expectedRideAlongs.every((p) => guardOut.includes(p))) {
       console.error('selftest FAIL: from-scratch without --stub-packages must hard-reject at parse time, naming the ride-alongs');
       process.exit(1);
     }

package/skills/{adia-release → package-release}/scripts/tag-lockstep.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // tag-lockstep.mjs — create the lockstep tag set (umbrella vX.Y.Z + one
 // per-package <pkg>-vX.Y.Z per roster entry — package-paths.mjs is the
-// live census; 14 tags as of gh#607) at HEAD or at a specified SHA.
+// live census; 11 tags as of gh#1282) at HEAD or at a specified SHA.
 //
 // Usage:
 //   node tag-lockstep.mjs --version 0.6.22
@@ -9,7 +9,7 @@
 //   node tag-lockstep.mjs --version 0.6.22 --delete     # delete existing tags
 //   node tag-lockstep.mjs --version 0.6.22 --dry        # print commands without running
 //
-// Part of the adia-release skill. Mechanizes the tag loop used
+// Part of the package-release skill. Mechanizes the tag loop used
 // every cycle.
 
 import { execSync } from 'node:child_process';

package/skills/{adia-author → primitive-authoring}/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: adia-author
+name: primitive-authoring
 description: >-
   Author or modify AdiaUI framework source inside the monorepo — primitives
   (packages/web-components), shells/composites (packages/web-modules), yaml
@@ -10,19 +10,19 @@ description: >-
   module, audit a component's four-axis contract/token usage/lifecycle
   (connected/disconnected symmetry) for drift, or author/write a demo or
   examples.html for a component or composite. NOT for composing app screens
-  from primitives (adia-compose), A2UI pipeline internals (adia-a2ui),
-  @adia-ai/llm adapter/streaming/bridge internals (adia-llm-internals), or
-  site/pages docs pages (adia-site-docs).
+  from primitives (screen-composition), A2UI pipeline internals (a2ui-maintenance),
+  @adia-ai/llm adapter/streaming/bridge internals (llm-client-maintenance), or
+  site/pages docs pages (site-docs-authoring).
 disable-model-invocation: false
 user-invocable: true
 ---
 
-# adia-author
+# primitive-authoring
 
 Guard rails for code that lands INSIDE the adia-ui monorepo: primitives
 (`packages/web-components/`), shells and composites (`packages/web-modules/`),
 their `<name>.yaml` SoTs, and composite demos. `@adia-ai/llm` internals
-(adapters, streaming, the bridge) are `adia-llm-internals`'s charter, not
+(adapters, streaming, the bridge) are `llm-client-maintenance`'s charter, not
 this skill's — route there.
 Light-DOM is load-bearing: `slot=` attributes are decorative metadata,
 positioning is CSS by tag + ancestor + DOM order — never `::slotted()`,
@@ -41,7 +41,7 @@ wins any tie with this skill. Monorepo source read while authoring (yaml, CSS,
 | Contract / token / lifecycle drift audit on an existing component | [token-contract.md](references/token-contract.md) + [anti-patterns.md](references/anti-patterns.md) |
 | Demo for a composite/module — any `packages/web-modules/**/*.{examples,contents}.html` | [composite-demo-protocol.md](references/composite-demo-protocol.md) — NOT the primitive or promotion paths; they lack the canonical-survey discipline |
 | Convention question ("is this idiomatic?") | [code-style.md](references/code-style.md) — cite the rule, don't expand it inline |
-| Trait detail page (`site/pages/traits/<name>/`) | [trait-pages.md](references/trait-pages.md) — the ADR-0019 required-section template (traits are this skill's charter; adia-site-docs does not own `traits/`) |
+| Trait detail page (`site/pages/traits/<name>/`) | [trait-pages.md](references/trait-pages.md) — the ADR-0019 required-section template (traits are this skill's charter; site-docs-authoring does not own `traits/`) |
 
 Full retrieval map — one line per reference file, grouped by axis:
 [references/INDEX.md](references/INDEX.md). Depth references (api-contract,