@aotter/mantle 0.1.2-alpha.6 → 0.1.2

package/docs/handbook/examples/reservation.md

@@ -1,220 +1,10 @@
 ---
-description: Accept public reservation requests and expose the queue to staff, with an optional guard against past dates.
+description: Redirects to the builtin reservation example in the Examples hub.
 ---
 # Reservation requests
 
-This example accepts reservation requests from the public and lists them for staff. It is the Builder `reservation` preset, fully declarative, plus one optional lifecycle guard. Read it if you take appointments, bookings or table requests and confirm them by hand.
-
-## Problem
-
-A visitor asks for a reservation by giving a name, an email address, the requested date or slot, an optional party size and a note. Staff see the newest requests first in Admin, over the staff View REST route, or through Staff MCP, and follow up outside the system. Requests are live operational records; nothing is drafted or published. The system does not decide whether a slot is free.
-
-## Manifest
-
-```yaml
-apiVersion: cms.mantle.aotter.net/v1
-kind: Schema
-metadata:
-  name: reservations
-spec:
-  title: Reservations
-  lifecycle: operational
-  schema:
-    type: object
-    additionalProperties: false
-    required: [name, email, requestedFor]
-    properties:
-      name: { type: string, minLength: 1, maxLength: 120 }
-      email: { type: string, format: email }
-      requestedFor: { type: string, description: Requested date, time, or slot. }
-      partySize: { type: integer, minimum: 1 }
-      note: { type: string, maxLength: 1000 }
-      createdAt: { type: number, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
----
-apiVersion: cms.mantle.aotter.net/v1
-kind: View
-metadata:
-  name: reservation-queue
-spec:
-  title: Reservation queue
-  surface: staff
-  from: reservations
-  fields: [id, name, email, requestedFor, partySize, note, createdAt]
-  orderBy:
-    - { field: createdAt, direction: desc }
-  limit: 50
----
-apiVersion: cms.mantle.aotter.net/v1
-kind: Procedure
-metadata:
-  name: submit-reservation
-spec:
-  title: Submit reservation
-  input:
-    type: object
-    additionalProperties: false
-    required: [name, email, requestedFor]
-    properties:
-      name: { type: string, minLength: 1, maxLength: 120 }
-      email: { type: string, format: email }
-      requestedFor: { type: string }
-      partySize: { type: integer, minimum: 1 }
-      note: { type: string, maxLength: 1000 }
-  output: { type: object }
-  handler: { kind: builtin, op: create, schema: reservations }
----
-apiVersion: cms.mantle.aotter.net/v1
-kind: Trigger
-metadata:
-  name: submit-reservation-http
-spec:
-  source: { kind: http, method: POST, path: /api/reservations }
-  target: { procedure: submit-reservation }
----
-apiVersion: cms.mantle.aotter.net/v1
-kind: Trigger
-metadata:
-  name: submit-reservation-mcp
-spec:
-  source: { kind: mcp, surface: public }
-  target: { procedure: submit-reservation }
-```
-
-`createdAt` is stamped by the server (`x-mantle-bind: now`); a caller-supplied value is ignored. `requestedFor` is a free string on purpose: the preset does not impose a calendar model. The staff View orders by `createdAt`, so the newest request is first regardless of the requested slot.
-
-## Worker and handlers
-
-None are required. The Manifest above runs on the minimal Worker:
-
-```ts
-import { createMantleWorker } from "@aotter/mantle/cloudflare";
-import { plan } from "../.mantle/generated/mantle.js";
-
-export default createMantleWorker({ plan });
-```
-
-### Optional: reject requests for the past
-
-If `requestedFor` is expected to be an ISO date-time, a `before_create` lifecycle Trigger can reject values that already passed. Add two documents to the Manifest:
-
-```yaml
-apiVersion: cms.mantle.aotter.net/v1
-kind: Procedure
-metadata:
-  name: reject-past-reservation
-spec:
-  input:
-    type: object
-    properties:
-      requestedFor: { type: string }
-  output: { type: object }
-  handler: { kind: ref, ref: reject-past-reservation }
----
-apiVersion: cms.mantle.aotter.net/v1
-kind: Trigger
-metadata:
-  name: reservations-before-create-guard
-spec:
-  source:
-    kind: lifecycle
-    schema: reservations
-    on: [before_create]
-    errorPolicy: abort
-  target: { procedure: reject-past-reservation }
-```
-
-And one handler. `before_*` hooks receive the caller's original input; a thrown `InvokeFailure` cancels the write and its diagnostic is returned to the caller unchanged:
-
-```ts
-// src/handlers.ts
-import { InvokeFailure } from "@aotter/mantle/runtime";
-import { runtimeDiagnostic } from "@aotter/mantle/spec";
-
-export async function rejectPastReservation(
-  input: { readonly requestedFor?: string },
-): Promise<{ ok: true }> {
-  const at = input.requestedFor ? Date.parse(input.requestedFor) : Number.NaN;
-  if (Number.isFinite(at) && at < Date.now()) {
-    throw new InvokeFailure(
-      runtimeDiagnostic({
-        code: "LIFECYCLE_HOOK_REJECTED",
-        severity: "error",
-        path: "/requestedFor",
-        value: input.requestedFor,
-        expected: "a date and time that has not passed",
-        message: "Reservations cannot be requested for a past time.",
-      }),
-    );
-  }
-  return { ok: true };
-}
-```
-
-```ts
-// src/index.ts
-import { createMantleWorker } from "@aotter/mantle/cloudflare";
-import { plan, type MantleHandlers } from "../.mantle/generated/mantle.js";
-import { rejectPastReservation } from "./handlers.js";
-
-const handlers = {
-  "reject-past-reservation": rejectPastReservation,
-} satisfies MantleHandlers;
-
-export default createMantleWorker({ plan, extend: () => ({ handlers }) });
-```
-
-Unparseable strings pass through so free-form slots such as `Friday evening` still work. Tighten the input schema with `format: date-time` if only timestamps are acceptable. `LIFECYCLE_HOOK_REJECTED` maps to HTTP 409; the hook may throw any catalogued code, for example `INPUT_VALIDATION_FAILED` for 400. See [Writes: Procedures, Triggers and hooks](../concepts/procedures-and-triggers.md).
-
-## Try it
-
-```sh
-curl -sS -X POST http://localhost:8787/api/reservations \
-  -H 'content-type: application/json' \
-  -d '{"name":"Ada","email":"ada@example.test","requestedFor":"2026-10-03T19:00:00+08:00","partySize":4}'
-```
-
-```json
-{
-  "ok": true,
-  "data": {
-    "id": "res_01j...",
-    "collection": "reservations",
-    "status": "published",
-    "version": 1,
-    "data": { "name": "Ada", "email": "ada@example.test", "requestedFor": "2026-10-03T19:00:00+08:00", "partySize": 4, "createdAt": 1788879363492 },
-    "authorId": null,
-    "createdAt": 1788879363492,
-    "updatedAt": 1788879363492
-  }
-}
-```
-
-A `partySize` of `0` is HTTP 400 `INPUT_VALIDATION_FAILED`. With the optional guard installed, a `requestedFor` in the past is HTTP 409 with `diagnostic.code: "LIFECYCLE_HOOK_REJECTED"` and no row is written.
-
-Staff list the queue at `GET /admin/api/views/reservation-queue?page=1&show=50` (staff session required); `GET /admin/api/views/reservation-queue/export` returns the matching rows as CSV.
-
-MCP tools:
-
-| Surface | Tool | Origin |
-|---|---|---|
-| `/mcp` | `submit_reservation` | `submit-reservation-mcp` Trigger |
-| `/mcp/staff` | `query_view_reservation_queue` | `reservation-queue` View |
-| `/mcp/staff` | `create_record_reservations`, `update_record_reservations` | operational Schema `reservations` |
-
-Mantle Builder ships this Manifest as its Reservation preset.
-
-## What this deliberately leaves out
-
-Requests are **not confirmed automatically**. A successful `POST` means the request was recorded, nothing more. The pattern omits:
-
-- **Slot inventory.** There is no `slots` Schema and no capacity count.
-- **Double-booking prevention.** Two requests for the same time both succeed. Preventing that needs an authority that serializes reservations, as the [commerce example](./commerce-transaction.md) does for stock with a Durable Object.
-- **Calendar sync, payments, deposits.**
-- **Confirmation messages.** Add an `after_create` handler as in the [intake form](./intake-form.md) when staff want a notification.
+This example lives in the Examples hub: [`docs/examples/builtin-reservation.md`](../../examples/builtin-reservation.md).
 
 ## Source
 
-- [`README.md`](../../../README.md) — reservations excerpt
-- [Procedure reference](../reference/procedure.md) — builtin `create`, lifecycle hooks
-- [`packages/mantle-runtime/src/usecase/procedure/InvokeProcedureUseCase.ts`](../../../packages/mantle-runtime/src/usecase/procedure/InvokeProcedureUseCase.ts) — `InvokeFailure`
-- [`packages/mantle-runtime/src/index.ts`](../../../packages/mantle-runtime/src/index.ts) — `InvokeFailure` export re-exported by `@aotter/mantle/runtime`
+- [`docs/examples/builtin-reservation.md`](../../examples/builtin-reservation.md)

package/docs/handbook/navigation.json

@@ -5,6 +5,8 @@
       "text": "Start here",
       "items": [
         { "text": "Quickstart: a minimal Worker", "link": "/start/quickstart-worker" },
+        { "text": "Build with ChatGPT Sites", "link": "/sites/index" },
+        { "text": "Quickstart: local Admin (opt-in)", "link": "/start/quickstart-admin" },
         { "text": "Project layout and the CLI loop", "link": "/start/project-and-cli" }
       ]
     },
@@ -20,6 +22,15 @@
         { "text": "Runtime pipeline and adapters", "link": "/concepts/runtime-and-adapters" }
       ]
     },
+    {
+      "text": "ChatGPT Sites",
+      "items": [
+        { "text": "Get started", "link": "/sites/index" },
+        { "text": "Host reference", "link": "/sites/host-reference" },
+        { "text": "Equipment checkout and external APIs", "link": "/sites/equipment-checkout" },
+        { "text": "Earlier guide URL", "link": "/cloudflare/chatgpt-sites" }
+      ]
+    },
     {
       "text": "Cloudflare",
       "items": [
@@ -27,6 +38,7 @@
         { "text": "Bindings and primitives", "link": "/cloudflare/bindings" },
         { "text": "Authentication", "link": "/cloudflare/authentication" },
         { "text": "Public web, SEO and cache", "link": "/cloudflare/public-web" },
+        { "text": "Site chrome", "link": "/cloudflare/site-chrome" },
         { "text": "Deferred hooks with Queues", "link": "/cloudflare/deferred-hooks-queues" },
         { "text": "Media uploads with R2", "link": "/cloudflare/media-r2" },
         { "text": "Deploy and operate", "link": "/cloudflare/deploy-and-operate" },
@@ -36,12 +48,15 @@
     {
       "text": "Examples",
       "items": [
-        { "text": "Intake form", "link": "/examples/intake-form" },
+        { "text": "Examples hub", "link": "/examples/hub" },
+        { "text": "Intake form (builtin)", "link": "/examples/intake-form" },
+        { "text": "Intake Turnstile and email hooks", "link": "/examples/intake-hooks" },
         { "text": "Publication", "link": "/examples/publication" },
         { "text": "Legal documents and consent", "link": "/examples/legal-documents" },
         { "text": "Reservation requests", "link": "/examples/reservation" },
         { "text": "Procurement approvals", "link": "/examples/procurement-approvals" },
-        { "text": "Commerce and settlement", "link": "/examples/commerce-transaction" },
+        { "text": "Commerce catalog (builtin)", "link": "/examples/commerce" },
+        { "text": "Commerce inventory (DO/Queue)", "link": "/examples/commerce-transaction" },
         { "text": "Guarded API access", "link": "/examples/guarded-api" }
       ]
     },

package/docs/handbook/reference/authorization.md

@@ -3,7 +3,7 @@ description: The requires grammar — closed auth predicates, guard Procedures,
 ---
 # Authorization
 
-`requires` is the whole authorization grammar. It appears on [Procedure](./procedure.md) and [View](./view.md) and nowhere else; Schemas and Triggers carry no `requires`. This page is the field-level contract and the runtime behaviour it produces. The narrative version is [Authorization](../concepts/authorization.md), and a worked deployment is [Guarded API](../examples/guarded-api.md). Diagnostic codes named here are catalogued in [Diagnostics](./diagnostics.md).
+`requires` is the whole authorization grammar. It appears on [Procedure](./procedure.md) and [View](./view.md) and nowhere else; Schemas and Triggers carry no `requires`. This page is the field-level contract and the runtime behaviour it produces. The narrative version is [Authorization](../concepts/authorization.md), and a worked deployment is [Guarded API](../../examples/cf-primitives-guarded-api.md). Diagnostic codes named here are catalogued in [Diagnostics](./diagnostics.md).
 
 ## `requires`
 

package/docs/handbook/reference/procedure.md

@@ -128,7 +128,7 @@ handler:
 | `create` | Projects `input ∩ Schema.properties` into `data`, stamps every `x-mantle-bind` property, generates an id and writes. `status` is `draft`, or `published` on a `lifecycle: operational` Schema. `authorId` is `ctx.user?.id ?? null`. Returns the created row. | `input` is an object schema. No other required properties. |
 | `update` | Loads the row (`NOT_FOUND` if absent), merges the patch over the stored `data` so omitted fields and existing stamps survive, writes under optimistic concurrency against the caller's `expectedVersion` (observed native `entry.version` at read time, not `version+1`), bumps `version`. | `id` (strict `type: string`) and `expectedVersion` (strict `type: number`) declared under `properties` **and** listed in `required`. |
 | `upsert` with `match` | Reads the matched fields off the validated input and looks the row up by those data values. Found: the update path, using the **caller's** `expectedVersion` (never the preloaded row's version). Not found: the create path only when `expectedVersion` is omitted; a versioned write for a missing row is `NOT_FOUND` and does not recreate. | `match` equals one declared `uniqueIndexes` tuple exactly, in order. Every matched field is a Schema property, is declared in `input.properties`, and appears in `input.required`. `input` must **not** declare `id`. `expectedVersion` **must** be declared as strict `number`; it is not globally required so create can omit it. |
-| `upsert` without `match` | Legacy form. Create when the caller omits `expectedVersion` (and either omits `id` or the id is unknown). Update when a resolved `id` is present — the caller token is required and is the OCC check. A versioned write for a missing id is `NOT_FOUND`. | `expectedVersion` must be declared as strict `number`. If `id` is declared it must be strict `string`. Neither is in `required`. |
+| `upsert` without `match` | Id-based upsert. Create when the caller omits `expectedVersion` (and either omits `id` or the id is unknown). Update when a resolved `id` is present — the caller token is required and is the OCC check. A versioned write for a missing id is `NOT_FOUND`. | `expectedVersion` must be declared as strict `number`. If `id` is declared it must be strict `string`. Neither is in `required`. |
 | `delete` | Loads the row (`NOT_FOUND` if absent), runs the delete guard, then hard-deletes pinned to the row's status and version. Returns `{ removed }`. | `id` (strict `type: string`) declared and in `required`. |
 | `archive` | Loads the row, checks the lifecycle state machine (`CONFLICT` on an illegal transition), then transitions to `archived` pinned to the version just read. | `id` (strict `type: string`) declared and in `required`. The target Schema must be `lifecycle: publishing`; an operational target is rejected. |
 
@@ -241,7 +241,7 @@ Each listed operation carries `name`, `title`, `description`, `input`, `uiSchema
 
 When `input` declares `expectedVersion`, Admin treats that reserved name as magic: it captures the OCC target's current `version` at read time, submits it, and does not render an editable version field. Changing the selected target rebinds version (an organization row must not supply a membership mutation's version). A resolvable OCC target or a row-bound dialog must have that captured version before Run is enabled, including matched upsert where the field is declared but not globally required. If `expectedVersion` is in `input.required` and no target can be resolved, submit stays disabled. Collection create / no-row dialogs may omit it when it is not required. Builtin operations also expose `targetCollection` (the handler schema) so Admin can pick the mutated collection over a contextual parent.
 
-Worked end-to-end examples live in [Commerce transaction](../examples/commerce-transaction.md) and [Procurement approvals](../examples/procurement-approvals.md).
+Worked end-to-end examples live in [Commerce inventory](../../examples/cf-primitives-commerce-inventory.md), [Commerce catalog](../../examples/builtin-commerce.md), and [Procurement approvals](../../examples/builtin-procurement.md).
 
 ## Source
 

package/docs/handbook/reference/schema.md

@@ -119,7 +119,7 @@ Other standard keywords are not rejected by the parser, but only the recognized
 | Every `required` entry of `spec.schema` must be declared under `properties`. | `REQUIRED_FIELD_UNKNOWN` |
 | `properties` and `$defs` must be objects; `oneOf` a non-empty array; `additionalProperties` a boolean or a schema. | `INVALID_MANIFEST_ENVELOPE` |
 
-Two compatibility normalizations run at the boundary: `nullable: true` becomes a `type` array that includes `"null"`, and `format: url` becomes `format: uri`. `additionalProperties` keeps standard semantics: omitted or `true` preserves extra keys, `false` rejects them, a schema validates them.
+Two accepted spellings are normalized at the boundary: `nullable: true` becomes a `type` array that includes `"null"`, and `format: url` becomes `format: uri`. `additionalProperties` keeps standard semantics: omitted or `true` preserves extra keys, `false` rejects them, a schema validates them.
 
 ### `x-mantle-bind`
 
@@ -180,11 +180,11 @@ uiSchema:
 
 Every violation is `SCHEMA_UI_INVALID`. Without `primaryField` and `columns`, Admin lists an operational collection with platform metadata only. `nav` is operational Admin navigation only — it does not change runtime, MCP, or publishing validation. Parent autocomplete coexists with `list.filterField` enum tabs as a separate control.
 
-Keep implementation-detail children fold-only. Use `nav.standalone: true` when staff also need a cross-parent list; see the [inventory example](../examples/commerce-transaction.md).
+Keep implementation-detail children fold-only. Use `nav.standalone: true` when staff also need a cross-parent list; see the [inventory example](../../examples/cf-primitives-commerce-inventory.md).
 
 ## Indexes
 
-`uniqueIndexes` and `indexes` are arrays of ordered field tuples. Shape errors are `INVALID_MANIFEST_ENVELOPE`; semantic errors are `SCHEMA_INDEX_INVALID` unless noted. Bare strings and the retired `indexedFields` key are rejected; each index is an array of field names, even when it has one field.
+`uniqueIndexes` and `indexes` are arrays of ordered field tuples. Shape errors are `INVALID_MANIFEST_ENVELOPE`; semantic errors are `SCHEMA_INDEX_INVALID` unless noted. Each index is an array of field names, even when it has one field; a bare string is rejected.
 
 | Rule | Diagnostic |
 |---|---|

package/docs/handbook/reference/site-config.md

@@ -3,7 +3,7 @@ description: siteDefaults reference — locales, brand, icons, media purposes, t
 ---
 # Site config
 
-Site config is a sibling of the Manifest grammar, not part of it. The four atoms describe content; `siteDefaults` describes the deployment: the locales the site publishes in, its brand and title, its canonical origin, its icons, its analytics ids and its media taxonomy. The deployment declares it as a TypeScript object and passes it to the adapter; the runtime seeds it into the `site_config` table and every render, MCP catalog build and Admin page reads it back from there.
+Site config is a sibling of the Manifest grammar, not part of it. The four atoms describe content; `siteDefaults` describes the deployment: the locales the site publishes in, its brand and title, its canonical origin, its icons and its media taxonomy. Tracking pixels, search-engine verification tokens and similar chrome are host-owned — consumers ship SSR documents, SPAs, Workers plus assets, Pages and custom wrappers, so Core does not rewrite `</head>` after the fact. See [Why Core does not inject](../cloudflare/site-chrome.md#why-core-does-not-inject). The deployment declares `siteDefaults` as a TypeScript object and passes it to the adapter; the runtime seeds it into the `site_config` table and every render, MCP catalog build and Admin page reads it back from there.
 
 ## `siteDefaults`
 
@@ -15,8 +15,6 @@ Site config is a sibling of the Manifest grammar, not part of it. The four atoms
 | `description` | string | no | Default `<meta name="description">` and `og:description` for entries with none. |
 | `origin` | string | no | Canonical absolute origin, no trailing slash, for example `https://example.com`. Used to build absolute URLs in `/llms.txt`, the `.md` mirrors and `/sitemap.xml`. An empty origin yields relative URLs. |
 | `icons` | `SiteIcon[]` | no | One site identity reused by browser favicons, Admin chrome and MCP `serverInfo.icons`. Declaring an empty array is an error. |
-| `ga4MeasurementId` | string | no | GA4 Measurement ID such as `G-XXXXXXXXXX`. When present the runtime injects the standard gtag snippet into rendered public HTML. |
-| `facebookPixelId` | string | no | Meta Pixel ID. When present the runtime injects the standard Pixel base snippet. |
 | `media.purposes` | `MediaPurposePolicy[]` | no | The upload taxonomy. Omitting the key, or declaring an empty array, keeps first-party media uploads disabled. |
 
 Nothing in this object is validated for length or content beyond the rules above: `brand`, `title`, `description` and `origin` are free strings.
@@ -42,11 +40,10 @@ interface SiteIcon {
 When the deployment declares no icons, the runtime stores `DEFAULT_SITE_ICONS`:
 
 ```ts
-const DEFAULT_SITE_ICONS = [{
-  src: "/_mantle/admin/favicon.svg",
-  mimeType: "image/svg+xml",
-  sizes: ["any"],
-}];
+const DEFAULT_SITE_ICONS = [
+  { src: "/_mantle/admin/favicon.png", mimeType: "image/png", sizes: ["64x64"] },
+  { src: "/_mantle/admin/favicon.svg", mimeType: "image/svg+xml", sizes: ["any"] },
+];
 ```
 
 Multiple renditions are allowed. Keep SVG as the source and add a PNG rendition when a target MCP client needs a baseline raster format. `GET /favicon.ico` resolves against this list; see [Surface](./surface.md).
@@ -84,8 +81,6 @@ Slot position does not determine variant role. Per asset the uploading agent pic
 | `locales` | `readonly string[]` | `[]` |
 | `canonicalLocale` | `string \| null` | `locales[0]` or `null` when the list is empty |
 | `icons` | `readonly SiteIcon[]` | `DEFAULT_SITE_ICONS` |
-| `ga4MeasurementId` | `string \| undefined` | `undefined` (an empty stored value also reads as `undefined`) |
-| `facebookPixelId` | `string \| undefined` | `undefined` |
 | `media.purposes` | `readonly MediaPurposePolicy[]` | `[]` |
 
 `canonicalLocale` is computed, never stored. Templates emit `<html lang>` only when it is non-null; silent omission is the correct behaviour for a zero-locale site, not a fabricated default.
@@ -99,8 +94,6 @@ The table is a flat key/value store. Keys fall into two ownership classes, and t
 | `brand` | UI-editable, seed-once | `INSERT … ON CONFLICT DO NOTHING` | The database, once the row exists |
 | `title` | UI-editable, seed-once | `INSERT … ON CONFLICT DO NOTHING` | The database, once the row exists |
 | `description` | UI-editable, seed-once | `INSERT … ON CONFLICT DO NOTHING` | The database, once the row exists |
-| `ga4MeasurementId` | UI-editable, seed-once | `INSERT … ON CONFLICT DO NOTHING` | The database, once the row exists |
-| `facebookPixelId` | UI-editable, seed-once | `INSERT … ON CONFLICT DO NOTHING` | The database, once the row exists |
 | `origin` | Code-canonical, boot-synced | Upsert when the stored value differs | The declaration |
 | `faviconUrl` | Code-canonical, boot-synced | Upsert when the stored value differs; holds the `icons` array as JSON | The declaration |
 | `locales` | Code-canonical, boot-synced | Upsert when the stored value differs; holds the declared list as a comma-separated string | The declaration |
@@ -110,9 +103,6 @@ Blank values are skipped in both classes: an absent, empty or empty-array field
 
 The seed-once keys have an Admin edit path at `PATCH /admin/api/site-settings` (owner only); the boot-synced keys do not, which is why the declaration wins on every boot. A custom-domain change therefore becomes canonical by editing the code and redeploying, with no manual database edit.
 
-> **Warning**
-> `mediaPurposes` is JSON. Rows written by pre-`#272` deployments used a CSV form and do not round-trip. Re-run the seed, or delete the row, after upgrading.
-
 ## Validated at boot
 
 Storage preparation calls `assertSiteDefaultsCanonical(siteDefaults)` synchronously, before the runtime accepts traffic. It throws — it does not return diagnostics — so a typo rejects the deployment rather than corrupting the seed.
@@ -196,7 +186,6 @@ export default createMantleWorker({
       { src: "/site-icon.svg", mimeType: "image/svg+xml", sizes: ["any"] },
       { src: "/site-icon.png", mimeType: "image/png", sizes: ["64x64"] },
     ],
-    ga4MeasurementId: "G-XXXXXXXXXX",
     media: {
       purposes: [
         {

package/docs/handbook/reference/surface.md

@@ -176,13 +176,11 @@ The umbrella installs Spec and Runtime only. Web, Admin, Admin UI, Bun, Vercel a
 
 ## Versions
 
-This handbook was added on the development branch after `v0.1.0-alpha.17`. It describes that development snapshot and will ship with a future release; it is not included in the published `0.1.0-alpha.17` package. For a registry installation, use the documentation at the matching release tag. For a source-built package, record the source commit as well as the package version: a development checkout can still carry the previous release version.
+This handbook describes the snapshot in this source tree. Pin every `@aotter/mantle*` package to one exact version and keep them together. For a registry installation, use the documentation at the matching release tag. For a source-built package, record the source commit as well as the package version.
 
-The documentation site pins its handbook commit in `docs/handbook.json` and records its vendored SDK source in `vendor/mantle/SOURCE.txt`. Those commits may differ when the intervening changes are behavior-neutral; the site verifies that condition during the build. The site's source-built tarballs are not the npm `alpha.17` artifacts.
+The documentation site pins its handbook commit in `docs/handbook.json` and records its vendored SDK source in `vendor/mantle/SOURCE.txt`. Those commits may differ when the intervening changes are behavior-neutral; the site verifies that condition during the build.
 
-`0.1.0-alpha.17` is immutable and no stable `0.1.0` is planned; the first stable target is `0.1.2`. That line removes the scaffolding path — the `mantle create` command, the bundle-oriented `mantle update` command, and the `@aotter/mantle/provision` subpath — with no aliases and no replacement scaffold command. `generate`, `skills`, `validate` and `emit-openapi` remain, and generation and runtime Web rendering keep their existing responsibilities. New projects are authored directly: write the manifests, run `generate`, wire the Worker. The reasoning is [ADR-0021](../../../docs/adr/0021-retire-starter-scaffolding.md).
-
-Prerelease packages take their exact version from their own `package.json`, which is the authority; APIs may change between prereleases until `0.1.2`.
+Projects are authored directly: write the manifests, run `generate`, `skills`, `validate` and `emit-openapi`, and wire the Worker. There is no project generator. Prerelease packages take their exact version from their own `package.json`; APIs may change between prereleases until a stable line ships.
 
 ## Source
 
@@ -203,5 +201,3 @@ Prerelease packages take their exact version from their own `package.json`, whic
 - [`packages/adapters/cloudflare/src/mount/mountPublicRoutes.ts`](../../../packages/adapters/cloudflare/src/mount/mountPublicRoutes.ts)
 - [`packages/adapters/cloudflare/src/mount/mountMcp.ts`](../../../packages/adapters/cloudflare/src/mount/mountMcp.ts)
 - [`packages/adapters/cloudflare/src/oauth/cachePolicy.ts`](../../../packages/adapters/cloudflare/src/oauth/cachePolicy.ts)
-- [`docs/adr/0021-retire-starter-scaffolding.md`](../../../docs/adr/0021-retire-starter-scaffolding.md)
-- [`docs/migration-0.1.2.md`](../../../docs/migration-0.1.2.md)