@aotter/mantle 0.1.3-alpha.2 → 0.1.3-alpha.3

package/README.md

@@ -9,14 +9,14 @@ where agents write config and the runtime carries the complexity.
 
 ## Install
 
-Cold start for a new application is the pinned skill, not a bare npm add:
+Cold start for a new application is the install skill, not a bare npm add:
 
 ```sh
-npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install
+npx skills add aotter/mantle --skill install
 ```
 
 To depend on this package in an existing project, pin the exact version
-from `package.json` (currently `0.1.3-alpha.2`):
+from `package.json` (currently `0.1.3-alpha.3`):
 
 ```bash
 npm install @aotter/mantle
@@ -197,7 +197,7 @@ internals or rebuilding Mantle's adapters.
 Cold start from GitHub or a marketplace host:
 
 ```sh
-npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install
+npx skills add aotter/mantle --skill install
 ```
 
 That skill interviews, pins this package, then uses the CLI and the
@@ -215,26 +215,28 @@ Install the Mantle Core skill bundle before authoring or maintaining a
 consumer application. The canonical command is:
 
 ```sh
-npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install
+npx skills add aotter/mantle --skill install
 ```
 
-Claude Code and Codex can install the same pinned plugin, then run that skill:
+Claude Code and Codex can install the plugin, then run that skill:
 
 ```bash
 # Claude Code
-/plugin marketplace add aotter/mantle@v0.1.3-alpha.2
+/plugin marketplace add aotter/mantle
 /plugin install mantle@mantle
 
 # Codex
-codex plugin marketplace add aotter/mantle --ref v0.1.3-alpha.2
+codex plugin marketplace add aotter/mantle
 codex plugin add mantle@mantle
 ```
 
 Cursor and VS Code Copilot can auto-discover the GitHub repo through
 `.cursor-plugin/plugin.json` and `.copilot-plugin/plugin.json` after the repo
 is cloned or opened. Still start from the `npx skills add` sentence (or open
-`skills/install/SKILL.md` at tag `v0.1.3-alpha.2`). Do not point a versioned consumer
-at a mutable branch.
+`skills/install/SKILL.md`). Untagged `aotter/mantle` resolves to `main`, which
+only advances at a release, so it is always the latest published version. Add
+`@vX.Y.Z` only to reproduce an older project; never point a consumer at
+`develop` or another moving branch.
 
 ## Marketplace capability installs
 

package/dist/cli/main.d.ts

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-export declare const MANTLE_OVERVIEW = "mantle \u2014 compile manifests into a RuntimePlan and typed binding\n\nOverview\n  Optional surfaces \u2014 take only what you need. Admin is opt-in. You can ship a\n  complete service with no Dev UI, no visitor frontend, and no extra packages.\n\n  Minimal \u2014 Spec + generate\n    validate + generate compile manifests into a sealed plan and typed binding.\n    Embed that binding in an existing host. No Admin, no visitor UI.\n\n  Runtime / adapter\n    Bind Runtime through an adapter (Cloudflare Worker, Bun, Vercel, or yours).\n    HTTP Views, MCP, and Auth work without Admin.\n    See docs/examples/host-minimal-worker or\n    node_modules/@aotter/mantle/docs/examples/host-minimal-worker.\n\n  Opt-in \u2014 Admin / Dev UI\n    Add @aotter/mantle-admin and @aotter/mantle-admin-ui only when humans need\n    a console. Then re-run generate, bind wrangler ASSETS, and open\n    /admin/sign-in (local email OTP via ConsoleEmailSender).\n    See docs/examples/host-local-admin-otp or\n    node_modules/@aotter/mantle/docs/examples/host-local-admin-otp.\n\n  Further (ask the subcommand for details)\n    skills          project version-matched agent instructions\n    emit-openapi    OpenAPI 3.1 from HTTP Triggers and Views\n    mantle-harness  measure indexes and live HTTP (separate binary)\n\nUsage: mantle <subcommand> [options]\n\nSubcommands:\n  generate       Compile manifests into a typed runtime binding\n  validate       Static manifest and handler-source validation\n  skills         Project version-matched Core skills\n  emit-openapi   Emit OpenAPI 3.1 from Triggers and Views\n\nDocumentation:\n  Handbook:      node_modules/@aotter/mantle/docs/handbook/ (or docs/handbook/)\n  Online:        https://mantle.tools/\n  Install skill: npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install\n";
+export declare const MANTLE_OVERVIEW = "mantle \u2014 compile manifests into a RuntimePlan and typed binding\n\nOverview\n  Optional surfaces \u2014 take only what you need. Admin is opt-in. You can ship a\n  complete service with no Dev UI, no visitor frontend, and no extra packages.\n\n  Minimal \u2014 Spec + generate\n    validate + generate compile manifests into a sealed plan and typed binding.\n    Embed that binding in an existing host. No Admin, no visitor UI.\n\n  Runtime / adapter\n    Bind Runtime through an adapter (Cloudflare Worker, Bun, Vercel, or yours).\n    HTTP Views, MCP, and Auth work without Admin.\n    See docs/examples/host-minimal-worker or\n    node_modules/@aotter/mantle/docs/examples/host-minimal-worker.\n\n  Opt-in \u2014 Admin / Dev UI\n    Add @aotter/mantle-admin and @aotter/mantle-admin-ui only when humans need\n    a console. Then re-run generate, bind wrangler ASSETS, and open\n    /admin/sign-in (local email OTP via ConsoleEmailSender).\n    See docs/examples/host-local-admin-otp or\n    node_modules/@aotter/mantle/docs/examples/host-local-admin-otp.\n\n  Further (ask the subcommand for details)\n    skills          project version-matched agent instructions\n    emit-openapi    OpenAPI 3.1 from HTTP Triggers and Views\n    mantle-harness  measure indexes and live HTTP (separate binary)\n\nUsage: mantle <subcommand> [options]\n\nSubcommands:\n  generate       Compile manifests into a typed runtime binding\n  validate       Static manifest and handler-source validation\n  skills         Project version-matched Core skills\n  emit-openapi   Emit OpenAPI 3.1 from Triggers and Views\n\nDocumentation:\n  Handbook:      node_modules/@aotter/mantle/docs/handbook/ (or docs/handbook/)\n  Online:        https://mantle.tools/\n  Install skill: npx skills add aotter/mantle --skill install\n";
 //# sourceMappingURL=main.d.ts.map

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAgCA,eAAO,MAAM,eAAe,iyDAwC3B,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAgCA,eAAO,MAAM,eAAe,kxDAwC3B,CAAC"}

package/dist/cli/main.js

@@ -64,7 +64,7 @@ Subcommands:
 Documentation:
   Handbook:      node_modules/@aotter/mantle/docs/handbook/ (or docs/handbook/)
   Online:        https://mantle.tools/
-  Install skill: npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install
+  Install skill: npx skills add aotter/mantle --skill install
 `;
 main().then((code) => {
     process.exitCode = code;

package/docs/adr/0024-manifest-native-schema-tables.md

@@ -1,6 +1,6 @@
 # ADR-0024: Materialize each Schema as a native storage table
 
-**Status:** Accepted
+**Status:** Accepted; the clauses allowing authored data to use `id`, `status` or `createdAt` are superseded by [ADR-0025](0025-reserved-native-columns-and-published-only-public-views.md) (2026-09-22)
 
 **Date:** 2026-09-18
 
@@ -58,9 +58,11 @@ identifier quoted. A Schema table uses its authored Schema name. SQLite
 preparation rejects collisions with selected infrastructure tables or views,
 including auth tables; this check belongs to the concrete deployment because
 the portable Manifest cannot know which optional infrastructure a host binds.
-Internal Mantle tables and columns use the reserved `_mantle_` prefix. The
-prefix prevents Mantle metadata from stealing ordinary authored names such as
-`id`, `status`, or `createdAt`.
+Internal Mantle tables and columns use the reserved `_mantle_` prefix, so
+Mantle metadata never collides with authored column names. *Superseded in
+part by ADR-0025:* authored data may no longer use the six native column
+names (`id`, `status`, `version`, `createdAt`, `updatedAt`, `authorId`); the
+prefix remains for every other authored name.
 
 The SQLite adapter no longer creates `entries`, generated field columns, or
 Schema projection views. There is no dual write, compatibility view, or
@@ -247,8 +249,9 @@ Reviewed after implementation against ADR-0019, the semantic storage ports,
 Builder preview persistence, and Mantle Cloud's retryable deployment state.
 The review found and corrected three boundary mistakes before acceptance:
 
-- authored data may legitimately contain `id`, `status`, or `createdAt`, so
-  physical envelope columns require the `_mantle_` prefix;
+- authored data was allowed to contain `id`, `status`, or `createdAt`, so
+  physical envelope columns require the `_mantle_` prefix (the prefix stays;
+  ADR-0025 later reserved those names for authored data as well);
 - Builder should expose draft storage risk without pretending it knows the
   deployed baseline; Cloud shows the exact immutable artifact, while CI and
   Cloud/D1 own executable DDL verification and preview stays on IndexedDB;

package/docs/adr/0025-reserved-native-columns-and-published-only-public-views.md

@@ -0,0 +1,105 @@
+# ADR-0025: Reserved native column names and published-only public Views
+
+**Status:** Accepted
+
+**Date:** 2026-09-22
+
+**Related:** [#962](https://github.com/aotter/mantle/issues/962),
+[#1007](https://github.com/aotter/mantle/issues/1007),
+[#1008](https://github.com/aotter/mantle/issues/1008),
+[#1009](https://github.com/aotter/mantle/issues/1009),
+[#1010](https://github.com/aotter/mantle/issues/1010),
+[ADR-0022](0022-caller-observed-version-occ.md),
+[ADR-0024](0024-manifest-native-schema-tables.md) (partially superseded: its clauses allowing authored `id`, `status`, `createdAt`)
+
+## Context
+
+Every entry carries six native columns outside `data`: `id`, `status`,
+`version`, `createdAt`, `updatedAt`, `authorId`. Before this decision the
+grammar treated their names inconsistently:
+
+- A Schema data property could reuse one of the names. The SQLite dialect then
+  resolved the name to the data column first; IndexedDB resolved it to the
+  native field first. The same View read different columns on different
+  storage.
+- `Schema.spec.indexes` could not reference the names at all
+  (`SCHEMA_INDEX_INVALID`), while the runtime's own indexes lead with
+  `_mantle_status`.
+- A public View over a `publishing` Schema hid drafts only when the author
+  wrote `filter: eq status published`. The handbook promised drafts are
+  unreadable until published; nothing enforced it on REST, MCP
+  `query_view_*` or WebMCP, which share one compiled plan.
+
+The #962 soak measured the consequence of the second point: the list View
+read 14,940 rows per request on a 10,991-row D1 table. Without planner
+statistics, which production SQLite-family storage never has, SQLite chose
+the runtime's `(_mantle_status, _mantle_updated_at, _mantle_id)` index for the
+status equality and sorted every published row in a temporary B-tree; the
+declared `[publishedAt]` index was never used, and the grammar refused the
+`(status, publishedAt)` index that would have served the query.
+
+Two alternatives were considered and rejected during review (#1008):
+
+- **Core derives indexes from Views.** Rejected: the manifest is a deployment
+  spec; Mantle Core is not a query optimizer, and a derived index has no
+  owner when a View is deleted.
+- **Explicit object references** such as `{ meta: status }` /
+  `{ field: publishedAt, direction: desc }`. Deferred: it adds a grammar shape
+  to solve an ambiguity that reserving the names removes, and no shipped View
+  needs mixed-direction ordering. It remains the upgrade path.
+
+A data-first resolution rule with only `status` reserved was also rejected: an
+index declared as `[[createdAt]]` would silently change meaning when a data
+property `createdAt` is added later, while the index identity (field-name
+hex) kept the old physical index.
+
+## Decision
+
+1. **The six native column names are reserved.** A Schema data property may
+   not use them; `mantle validate` fails closed with
+   `INVALID_MANIFEST_ENVELOPE` at `/spec/schema/properties/<name>`, the same
+   mechanism ADR-0022 uses for `expectedVersion`. Domain names replace them
+   (`submittedAt`, `orderStatus`, `submittedBy`).
+2. **Every storage resolves a native name to the native column, first.** With
+   shadowing rejected this is a no-op for valid manifests; it is stated so the
+   SQLite dialect, IndexedDB and the index DDL cannot drift apart again.
+3. **`Schema.spec.indexes` may reference native names**; the SQLite dialect
+   maps them to `_mantle_*` columns in `CREATE INDEX`. `uniqueIndexes` may not:
+   native columns carry no domain uniqueness. Tuples stay `string[][]`; no
+   direction, no object form.
+4. **The author declares the access path; Mantle measures it.** A public View
+   over a `publishing` Schema always carries `status = published`, so its
+   index leads with `status` (`indexes: [[status, publishedAt]]`). Core does
+   not synthesize that index. The harness and the D1 inspector (#1010) report
+   whether the declared index is used.
+5. **Public Views over `publishing` Schemas read published rows only, fail
+   closed.** The linker injects `status = published` into the compiled plan
+   whether or not the manifest writes it; an authored identical predicate is
+   redundant and kept; any other `status` comparison on such a View is
+   `VIEW_PUBLIC_STATUS_INVALID`. Staff Views, `operational` Schemas and SQL
+   Views are untouched.
+
+## Consequences
+
+- ADR-0024's statement that authored data may legitimately use `id`, `status`
+  or `createdAt` no longer holds; its `_mantle_` physical prefix is unchanged
+  and still guards every other authored name.
+
+- Breaking for manifests that declared a data property with one of the six
+  names; the official examples and tests were renamed (#1009). Storage is
+  additive: the renamed property is a new column and the old one stays until
+  an explicit migration. The 0.1.3 release entry carries the upgrade note.
+- The semantic fingerprint of any plan with a public publishing View changes
+  once (the injected predicate); `mantle generate` regenerates it.
+- Index identities of existing declarations are unchanged; native-name tuples
+  get new identities. Stale indexes left behind by redeclaration are tracked
+  separately (#1011).
+- Verified on real D1 without `ANALYZE`: the list View reads 50 rows per
+  request with `[status, publishedAt]` and 10,000 without it (#1014).
+
+## Where this lives
+
+The handbook is the single source: [`reference/schema.md`](../handbook/reference/schema.md)
+(reserved columns, index rules), [`reference/view.md`](../handbook/reference/view.md)
+(surfaces). Skills and CLI diagnostics point there; they do not restate the
+rules.

package/docs/adr/README.md

@@ -23,7 +23,8 @@ Records of *why* mantle ended up shaped this way. The numbering preserves POC AD
 | [0020](0020-builtin-handler-contracts-and-matched-upsert.md) | Static builtin handler contracts and natural-key matched upsert (`handler.match`). | Accepted + amended by 0022 |
 | [0021](0021-retire-starter-scaffolding.md) | Direct authoring; retire Starter scaffolding. | Accepted; supersedes 0018 |
 | [0022](0022-caller-observed-version-occ.md) | Caller-observed `expectedVersion` for Admin bind and builtin upsert OCC. | Accepted |
-| [0024](0024-manifest-native-schema-tables.md) | Materialize each Schema as a native storage table and deploy reviewed migration artifacts. | Accepted |
+| [0024](0024-manifest-native-schema-tables.md) | Materialize each Schema as a native storage table and deploy reviewed migration artifacts. | Accepted; authored-native-name clauses superseded by 0025 |
+| [0025](0025-reserved-native-columns-and-published-only-public-views.md) | Reserve the six native column names, let `indexes` reference them, and compile public publishing Views published-only. | Accepted |
 
 ## Reading order
 

package/docs/agent-prompts.md

@@ -1,9 +1,9 @@
 # Task-specific agent prompts
 
-Cold start from GitHub or a marketplace host is one pinned skill:
+Cold start from GitHub or a marketplace host is the install skill:
 
 ```sh
-npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install
+npx skills add aotter/mantle --skill install
 ```
 
 Copy one block into a coding agent after that skill is present. Paths below
@@ -20,7 +20,7 @@ manifests exist. Admin is opt-in.
 ```text
 Interview me about the service: host, who uses it, whether humans need a
 Dev UI, and whether we only embed Spec/Runtime. If the install skill is
-missing, run npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install. Read the
+missing, run npx skills add aotter/mantle --skill install. Read the
 install skill and npx --no-install mantle --help, then
 handbook/start/project-and-cli.md.
 Use examples/README.md as the examples index; copy builtin-* Manifests only

package/docs/examples/builtin-intake.md

@@ -30,7 +30,7 @@ spec:
       name: { type: string, minLength: 1, maxLength: 120 }
       email: { type: string, format: email }
       message: { type: string, minLength: 1, maxLength: 2000 }
-      createdAt: { type: number, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
+      submittedAt: { type: number, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
 ---
 apiVersion: cms.mantle.aotter.net/v1
 kind: View
@@ -40,9 +40,9 @@ spec:
   title: Recent requests
   surface: staff
   from: requests
-  fields: [id, name, email, message, createdAt]
+  fields: [id, name, email, message, submittedAt]
   orderBy:
-    - { field: createdAt, direction: desc }
+    - { field: submittedAt, direction: desc }
   limit: 50
 ---
 apiVersion: cms.mantle.aotter.net/v1
@@ -80,7 +80,7 @@ spec:
   target: { procedure: submit-request }
 ```
 
-`createdAt` is stamped by the server (`x-mantle-bind: now`); a caller-supplied value is ignored. The builtin `create` projects `input ∩ Schema.properties`.
+`submittedAt` is stamped by the server (`x-mantle-bind: now`); a caller-supplied value is ignored. It lives in `data` next to the native `createdAt` column so the timestamp travels with the record through MCP output and exports; data properties may not reuse the native column names. The builtin `create` projects `input ∩ Schema.properties`.
 
 ## Worker and handlers
 
@@ -109,7 +109,7 @@ curl -sS -X POST http://localhost:8787/api/requests \
     "collection": "requests",
     "status": "published",
     "version": 1,
-    "data": { "name": "Ada", "email": "ada@example.test", "message": "Please call me back.", "createdAt": 1788879363492 },
+    "data": { "name": "Ada", "email": "ada@example.test", "message": "Please call me back.", "submittedAt": 1788879363492 },
     "authorId": null,
     "createdAt": 1788879363492,
     "updatedAt": 1788879363492

package/docs/examples/builtin-publication.md

@@ -97,7 +97,7 @@ spec:
       title: { type: string }
       email: { type: string, format: email }
       note: { type: string }
-      createdAt: { type: integer, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
+      suggestedAt: { type: integer, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
 ---
 apiVersion: cms.mantle.aotter.net/v1
 kind: Procedure

package/docs/examples/builtin-reservation.md

@@ -31,7 +31,7 @@ spec:
       requestedFor: { type: string, description: Requested date, time, or slot. }
       partySize: { type: integer, minimum: 1 }
       note: { type: string, maxLength: 1000 }
-      createdAt: { type: number, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
+      submittedAt: { type: number, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
 ---
 apiVersion: cms.mantle.aotter.net/v1
 kind: View
@@ -41,9 +41,9 @@ spec:
   title: Reservation queue
   surface: staff
   from: reservations
-  fields: [id, name, email, requestedFor, partySize, note, createdAt]
+  fields: [id, name, email, requestedFor, partySize, note, submittedAt]
   orderBy:
-    - { field: createdAt, direction: desc }
+    - { field: submittedAt, direction: desc }
   limit: 50
 ---
 apiVersion: cms.mantle.aotter.net/v1
@@ -82,7 +82,7 @@ spec:
   target: { procedure: submit-reservation }
 ```
 
-`createdAt` is stamped by the server (`x-mantle-bind: now`); a caller-supplied value is ignored. `requestedFor` is a free string on purpose: this example does not impose a calendar model. The staff View orders by `createdAt`, so the newest request is first regardless of the requested slot.
+`submittedAt` is stamped by the server (`x-mantle-bind: now`); a caller-supplied value is ignored. `requestedFor` is a free string on purpose: this example does not impose a calendar model. The staff View orders by `submittedAt`, so the newest request is first regardless of the requested slot.
 
 ## Worker and handlers
 
@@ -113,7 +113,7 @@ curl -sS -X POST http://localhost:8787/api/reservations \
     "collection": "reservations",
     "status": "published",
     "version": 1,
-    "data": { "name": "Ada", "email": "ada@example.test", "requestedFor": "2026-10-03T19:00:00+08:00", "partySize": 4, "createdAt": 1788879363492 },
+    "data": { "name": "Ada", "email": "ada@example.test", "requestedFor": "2026-10-03T19:00:00+08:00", "partySize": 4, "submittedAt": 1788879363492 },
     "authorId": null,
     "createdAt": 1788879363492,
     "updatedAt": 1788879363492

package/docs/examples/cf-primitives-intake-hooks.md

@@ -30,7 +30,7 @@ spec:
       name: { type: string, minLength: 1, maxLength: 120 }
       email: { type: string, format: email }
       message: { type: string, minLength: 1, maxLength: 2000 }
-      createdAt: { type: number, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
+      submittedAt: { type: number, x-mcp-hint: timestamp-ms, x-mantle-bind: now }
 ---
 apiVersion: cms.mantle.aotter.net/v1
 kind: View
@@ -40,9 +40,9 @@ spec:
   title: Recent requests
   surface: staff
   from: requests
-  fields: [id, name, email, message, createdAt]
+  fields: [id, name, email, message, submittedAt]
   orderBy:
-    - { field: createdAt, direction: desc }
+    - { field: submittedAt, direction: desc }
   limit: 50
 ---
 apiVersion: cms.mantle.aotter.net/v1
@@ -264,7 +264,7 @@ curl -sS -X POST http://localhost:8787/api/requests \
     "collection": "requests",
     "status": "published",
     "version": 1,
-    "data": { "name": "Ada", "email": "ada@example.test", "message": "Please call me back.", "createdAt": 1788879363492 },
+    "data": { "name": "Ada", "email": "ada@example.test", "message": "Please call me back.", "submittedAt": 1788879363492 },
     "authorId": null,
     "createdAt": 1788879363492,
     "updatedAt": 1788879363492

package/docs/handbook/concepts/four-atoms.md

@@ -76,7 +76,7 @@ Parsing is all-or-nothing: one error in one document means no `ParsedManifestSet
 
 ## Schema — the entity
 
-A Schema declares one collection: the JSON Schema for each entry's `data`, its indexes, its Admin presentation and its [lifecycle mode](./lifecycle-and-locales.md). Entries also carry the native columns `id`, `status`, `version`, `createdAt`, `updatedAt` and `authorId` outside `data`.
+A Schema declares one collection: the JSON Schema for each entry's `data`, its indexes, its Admin presentation and its [lifecycle mode](./lifecycle-and-locales.md). Entries also carry six [native columns](../reference/schema.md#reserved-entry-columns) outside `data`.
 
 ```yaml
 apiVersion: cms.mantle.aotter.net/v1

package/docs/handbook/concepts/lifecycle-and-locales.md

@@ -9,7 +9,7 @@ Two per-Schema decisions shape how an entry behaves for its whole life: which st
 
 `spec.lifecycle` is `publishing` (the default) or `operational`. The modes mix freely inside one site.
 
-**`publishing`** is for content a person stages and then releases: posts, pages, announcements, product copy. The point of the mode is that a draft exists and is not readable by the public until someone publishes it.
+**`publishing`** is for content a person stages and then releases: posts, pages, announcements, product copy. The point of the mode is that a draft exists and is not readable by the public until someone publishes it. The runtime enforces this: a public declarative View over a publishing Schema is compiled with `status = published` even when the manifest omits the filter ([View reference](../reference/view.md#surfaces)).
 
 **`operational`** is for records written as a side effect rather than drafted: submissions, inquiries, orders, inventory snapshots, grant and audit rows. The point of the mode is that the row is real the moment it is created. Declare it on any Schema whose rows a human should inspect and correct, never stage and publish.
 

package/docs/handbook/concepts/mcp-and-agents.md

@@ -91,14 +91,14 @@ pnpm exec mantle skills --check
 
 This copies every skill the installed package marks `projection: project` — the develop skill among them — into matching `.agents/skills/mantle-*` and `.claude/skills/mantle-*` paths. Both layouts receive identical bytes; `--check` detects drift without writing. Skills that act destructively or target one platform stay out of that set and are opt-in. Manifest generation never rewrites agent instructions.
 
-For Claude Code, the same bundle is installable from the plugin marketplace at the published pin (or the exact version in `package.json`):
+The same bundle is installable from the plugin marketplace:
 
 ```sh
 # Canonical
-npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install
+npx skills add aotter/mantle --skill install
 
 # Claude Code — two separate prompts
-/plugin marketplace add aotter/mantle@v0.1.3-alpha.2
+/plugin marketplace add aotter/mantle
 /plugin install mantle@mantle
 ```
 

package/docs/handbook/concepts/views.md

@@ -97,7 +97,7 @@ a native column. Declared `indexes` and `uniqueIndexes` become B-tree indexes
 over those columns; Core-compiled projections, filters and ordering reference
 the same columns directly.
 
-Declare the **smallest ordered index justified by the measured path**, and respect SQLite's leftmost-prefix rule. An index on `[locale, publishedAt]` serves `WHERE locale = ?`, `WHERE locale = ? AND publishedAt > ?`, and `WHERE locale = ? ORDER BY publishedAt`. It does not serve `WHERE publishedAt > ?` alone. If a second hot path needs a different leading field, that is a second index — not a reason to enumerate every permutation, since each index costs storage and slows every write.
+Declare the **smallest ordered index justified by the measured path**, and respect SQLite's leftmost-prefix rule. Equality columns go first, the ordered column last. A public View over a publishing Schema always carries `status = published`, so its index leads with `status`: `[status, locale, publishedAt]` serves `WHERE status = ? AND locale = ?`, `… AND publishedAt > ?`, and `… ORDER BY publishedAt`. It does not serve `WHERE publishedAt > ?` alone, and `[publishedAt]` alone does not serve the published list — without planner statistics SQLite prefers the status equality and sorts in a temporary B-tree. If a second hot path needs a different leading field, that is a second index — not a reason to enumerate every permutation, since each index costs storage and slows every write.
 
 ```sh
 pnpm exec mantle-harness indexes --require-public --format text
@@ -139,7 +139,7 @@ spec:
   limit: 50
 ```
 
-The source Schema declares `indexes: [[locale, publishedAt]]`. The `gte publishedAt 0` clause is what keeps the ordered column inside the indexed range rather than forcing a sort. Omitting `locale` returns 400.
+The source Schema declares `indexes: [[status, locale, publishedAt]]`; the `status` predicate is present whether or not the View writes it. The `gte publishedAt 0` clause is what keeps the ordered column inside the indexed range rather than forcing a sort. Omitting `locale` returns 400.
 
 ## Example: a staff SQL report
 

package/docs/handbook/reference/diagnostics.md

@@ -50,7 +50,7 @@ Raised by the parser, the graph validator and the code generator. `mantle valida
 
 | Code | Meaning | HTTP |
 |---|---|---|
-| `INVALID_MANIFEST_ENVELOPE` | Wrong `apiVersion`, unknown key at a known level, wrong value shape, a YAML syntax or alias-limit failure, or a Schema data property named `expectedVersion` (reserved Procedure OCC token; ADR-0022). | — |
+| `INVALID_MANIFEST_ENVELOPE` | Wrong `apiVersion`, unknown key at a known level, wrong value shape, a YAML syntax or alias-limit failure, a Schema data property named `expectedVersion` (reserved Procedure OCC token; ADR-0022), or a Schema data property named after a native entry column (`id`, `status`, `version`, `createdAt`, `updatedAt`, `authorId`). | — |
 | `DUPLICATE_NAME` | Two documents of the same kind declare the same `metadata.name`. | — |
 | `VIEW_FROM_UNKNOWN_SCHEMA` | `spec.from` names no declared Schema. | — |
 | `VIEW_FIELD_NOT_IN_SCHEMA` | A `fields` entry or `orderBy[i].field` is neither a Schema property nor a reserved entry column. | — |
@@ -64,6 +64,7 @@ Raised by the parser, the graph validator and the code generator. `mantle valida
 | `VIEW_FILTER_CTX_USER_REF_REQUIRES_INDEX` | The bound field is not the leftmost field of a declared index. | — |
 | `VIEW_ORDERBY_INVALID` | An `orderBy` entry has the wrong shape or an unknown `direction`. | — |
 | `VIEW_UI_INVALID` | A View `uiSchema` key is unknown, used on a public View, or names an unknown output field. | — |
+| `VIEW_PUBLIC_STATUS_INVALID` | A public View over a `publishing` Schema compares `status` to anything but `published`. The runtime always reads published rows only on that surface, so the filter can only contradict it. | — |
 | `REQUIRED_FIELD_UNKNOWN` | A `required` entry of `spec.schema` is not declared under `properties`. | — |
 | `INVALID_PATTERN` | A `pattern` does not compile as a JavaScript regular expression. | — |
 | `JSON_SCHEMA_UNSUPPORTED` | A JSON Schema keyword outside the accepted subset. | — |

package/docs/handbook/reference/manifest.md

@@ -108,7 +108,7 @@ Names containing `-` must be double-quoted when used as tables in a `sql` View (
 
 | Namespace | Reserved | Effect |
 |---|---|---|
-| Entry columns | `id`, `status`, `version`, `createdAt`, `updatedAt`, `authorId` | Native on every Schema. Cannot appear in `indexes` or `uniqueIndexes` (`SCHEMA_INDEX_INVALID`). Valid in View `fields`, `filter`, `orderBy` and `uiSchema.list`. Avoid declaring data properties with these names; SQL Views project the native column, not the data field. |
+| Entry columns | `id`, `status`, `version`, `createdAt`, `updatedAt`, `authorId` | Native on every Schema; a data property may not reuse the name (`INVALID_MANIFEST_ENVELOPE`). Where they may appear in Views and indexes: [Schema reference](./schema.md#reserved-entry-columns) (ADR-0025). |
 | Data field | `locale` | A non-localized Schema that declares `properties.locale` is rejected; use a domain name such as `orderLocale`. On a localized Schema the runtime requires `data.locale` on writes. |
 | Data field | `expectedVersion` | Reserved Procedure OCC wire name. A Schema that declares `spec.schema.properties.expectedVersion` is `INVALID_MANIFEST_ENVELOPE` (ADR-0022). New reserved names need an ADR. |
 | View params | `page`, `show`, `cursor` | Owned by the runtime for pagination. Declaring them under `params.properties` is `VIEW_PARAMS_RESERVED_NAME`. |

package/docs/handbook/reference/schema.md

@@ -14,7 +14,7 @@ A Schema declares one collection: the JSON Schema for each entry's `data`, its i
 | `schema` | JSON Schema 2020-12 | yes | — | Must be an object. Walked by the [subset validator](#json-schema-subset). |
 | `uiSchema` | object | no | — | Accepts `fields`, `list`, and `nav`. Violations are `SCHEMA_UI_INVALID`. |
 | `uniqueIndexes` | `string[][]` | no | `[]` | Ordered tuples of top-level scalar fields. See [Indexes](#indexes). |
-| `indexes` | `string[][]` | no | `[]` | Ordered non-unique tuples. Must not repeat a `uniqueIndexes` tuple. |
+| `indexes` | `string[][]` | no | `[]` | Ordered non-unique tuples of data fields and native entry columns. Must not repeat a `uniqueIndexes` tuple. |
 | `searchableFields` | `string[]` | no | `[]` | Top-level string fields for Admin and Staff MCP substring search. |
 | `localized` | boolean | no | `false` | When `false`, a `locale` property is rejected. Must be a boolean. |
 | `translates` | `{ parent, on }` | no | — | Marks a translation child. Requires `localized: true`. |
@@ -22,7 +22,7 @@ A Schema declares one collection: the JSON Schema for each entry's `data`, its i
 
 ### Reserved entry columns
 
-Every entry carries `id`, `status`, `version`, `createdAt`, `updatedAt` and `authorId` as native columns outside `data`. They cannot be indexed (`SCHEMA_INDEX_INVALID`) but are valid in View `fields`, `filter`, `orderBy` and `uiSchema.list`. `locale` is a reserved data field: only a localized Schema may declare it, and the runtime requires it on writes to a localized Schema. Do not name data properties after the native columns; SQL Views project the native column. Do not declare `expectedVersion` under `spec.schema.properties` — that name is the reserved Procedure OCC token; validate fails closed with `INVALID_MANIFEST_ENVELOPE` (ADR-0022). New reserved Procedure input names need an ADR.
+Every entry carries `id`, `status`, `version`, `createdAt`, `updatedAt` and `authorId` as native columns outside `data`. They are valid in View `fields`, `filter`, `orderBy` and `uiSchema.list`, and `indexes` may include them (`uniqueIndexes` may not). A data property may not reuse one of these names: validate fails closed with `INVALID_MANIFEST_ENVELOPE` at `/spec/schema/properties/<name>`, because SQLite-family and IndexedDB storage would otherwise resolve the name differently and an index declared today could change meaning when a same-named property is added later. Use a domain name instead (`submittedAt`, `orderStatus`, `submittedBy`); the native column is still there and still readable (ADR-0025). `locale` is a reserved data field: only a localized Schema may declare it, and the runtime requires it on writes to a localized Schema. SQL Views project the native column. Do not declare `expectedVersion` under `spec.schema.properties` — that name is the reserved Procedure OCC token; validate fails closed with `INVALID_MANIFEST_ENVELOPE` (ADR-0022). New reserved Procedure input names need an ADR.
 
 ## Example
 
@@ -191,13 +191,21 @@ Keep implementation-detail children fold-only. Use `nav.standalone: true` when s
 | When any index is declared, `metadata.name` matches `/^[A-Za-z][A-Za-z0-9_.-]*$/`. | `SCHEMA_INDEX_INVALID` at `/metadata/name` |
 | Each tuple is a non-empty array of strings. | `INVALID_MANIFEST_ENVELOPE` (shape) or `SCHEMA_INDEX_INVALID` (empty) |
 | No field repeats within a tuple; field names match the same safe pattern. | `SCHEMA_INDEX_INVALID` |
-| Fields are not reserved entry columns. | `SCHEMA_INDEX_INVALID` |
-| Fields are exact top-level keys of `properties`. | `UNIQUE_INDEX_FIELD_UNKNOWN` or `SCHEMA_INDEX_FIELD_UNKNOWN` |
+| `uniqueIndexes` fields are data properties. `indexes` fields may also be the native columns `id`, `status`, `version`, `createdAt`, `updatedAt`, `authorId`, which map to their `_mantle_*` columns. | `SCHEMA_INDEX_INVALID` |
+| Data fields are exact top-level keys of `properties`. | `UNIQUE_INDEX_FIELD_UNKNOWN` or `SCHEMA_INDEX_FIELD_UNKNOWN` |
 | Fields are indexable scalars: exactly one non-null type, optionally nullable. `string` maps to TEXT, `integer` and `boolean` to INTEGER, `number` to REAL. | `SCHEMA_INDEX_INVALID` |
 | No tuple repeats within a list; `indexes` does not repeat a `uniqueIndexes` tuple. | `SCHEMA_INDEX_INVALID` |
 
 On SQLite storage each Schema is a native table and every tuple becomes an
 index over its native field columns; queries benefit from a leftmost prefix.
+
+A public View over a `publishing` Schema is compiled with `status = published`
+whether or not the manifest writes it ([View surfaces](./view.md#surfaces)), so
+its hot path always starts with an equality on `status`. Lead the index with
+it, then the ordered field: `indexes: [[status, publishedAt]]`. A bare
+`[[publishedAt]]` does not serve that query on production SQLite (no planner
+statistics), which sorts every published row in a temporary B-tree instead
+(#962). Declare the index the query needs; Mantle does not derive one (ADR-0025).
 Unique indexes are also checked before every write; a conflicting row is
 `CONFLICT`. After the first deployment, adding, removing, reordering, or changing
 any `uniqueIndexes` tuple is destructive and requires rebuilding the instance

package/docs/handbook/reference/view.md

@@ -206,6 +206,8 @@ Admin applies search and filters before pagination, rejecting a search term or f
 | `public` | `GET /api/views/<name>`, plus a catalog at `GET /api/views` | `query_view_<segment>` on `/mcp` | Also mounted at `GET /admin/api/views/<name>` and `/export` behind the staff gate |
 | `staff` | `GET /admin/api/views/<name>` and `/admin/api/views/<name>/export` — not mounted publicly | `query_view_<segment>` on `/mcp/staff` | Report sidebar |
 
+A `public` declarative View over a `publishing` Schema reads **published rows only**, on every transport. The runtime adds `status = published` to the compiled query whether or not the filter spells it out; writing it is allowed and redundant, and comparing `status` to any other value is rejected at validate time (`VIEW_PUBLIC_STATUS_INVALID`). Staff Views see every status. `operational` Schemas create rows as `published`, so nothing is added. SQL Views (`spec.sql`) are the author's own statement and receive no injected predicate. Decision record: ADR-0025.
+
 `<segment>` is `metadata.name` lower-cased with `-` replaced by `_`. Two Views that mangle to the same segment collide with `MCP_TOOL_NAME_COLLISION`. Admin also serves the manifest listing `GET /admin/api/views-manifest`. Surface choice is visibility, not authorization: `requires` still gates every call on both transports. See [Surfaces](./surface.md) and [MCP and agents](../concepts/mcp-and-agents.md).
 
 The MCP `inputSchema` is `params.properties` plus `page` and `show` as optional numbers, carrying `params.required` through unchanged; the tool is annotated `readOnlyHint: true`.

package/docs/handbook/start/project-and-cli.md

@@ -5,10 +5,10 @@ description: The files you own in a Mantle project, every mantle and mantle-harn
 
 This page describes a directly authored Mantle project: which files are yours, what the installed CLI does to them, and the loop you run before every commit. Surfaces are optional — take only what you need. [The minimal Worker](./quickstart-worker.md) is Spec + adapter without Admin. [Local Admin](./quickstart-admin.md) is the opt-in Dev UI path when humans need a console.
 
-Cold start from GitHub or a marketplace host is the pinned install skill, not this page:
+Cold start from GitHub or a marketplace host is the install skill, not this page:
 
 ```sh
-npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install
+npx skills add aotter/mantle --skill install
 ```
 
 ## You own the project
@@ -98,20 +98,19 @@ Run the harness after any change to a Schema index, View filter or ordering, or
 
 `mantle skills` projects the skills the installed package marks `projection: project`. At this version those are `develop`, `plugin`, `theme` and `update`; `install`, `media-gc` and `provision` stay opt-in because they create projects, delete remote objects or handle production secrets. Both tool layouts receive identical bytes. Generation never rewrites these files.
 
-Install the version-matched plugin bundle in the agent host. Cold start uses
-the published pin; an already-installed project uses the exact version from
-`package.json` (currently `0.1.3-alpha.2`):
+Install the plugin bundle in the agent host. Cold start uses
+the install skill; an already-installed project pins packages from `package.json`:
 
 ```sh
 # Canonical
-npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install
+npx skills add aotter/mantle --skill install
 
 # Claude Code — two separate prompts
-/plugin marketplace add aotter/mantle@v0.1.3-alpha.2
+/plugin marketplace add aotter/mantle
 /plugin install mantle@mantle
 
 # Codex
-codex plugin marketplace add aotter/mantle --ref v0.1.3-alpha.2
+codex plugin marketplace add aotter/mantle
 codex plugin add mantle@mantle
 ```
 

package/docs/release-process.md

@@ -15,9 +15,11 @@ No task implicitly authorizes publication; no manual package/tag writer exists.
 |---|---|---|
 | Reviewed source; unused version | Core source/packed-consumer gates, then immutable Core tag | Exact canonical merged PR SHA and version required |
 | Tag exists; registry candidates partial | Existing npm/GPR publication steps | Verify existing artifact identity; publish missing versions only |
+| Tag exists and all eleven npmjs packages already exist | Metadata verify, then channel promote and the GitHub release | Skip pack and immutable tarball compare. The controller tip must not rebuild published artifact identity. npm integrity metadata still has to be `sha512`. The public-registry Worker gate stays skipped |
+| Tag exists on an ancestor of the dispatched tip; tip package versions still match | Resolve binds release identity to the tag SHA; later steps stay the existing writers | Controller-only recovery. Do not retag. The canonical merged-PR check uses the tag SHA. Fail when the tip version differs or the tag commit is not an ancestor |
 | Registry candidates verified | Public-registry reference consumer gate | No mutation; failure leaves public channels and `mantle-release` unchanged |
-| Consumer passes | That registry's promote step: monotonic channel add, then `dist-tag rm` of `mantle-release` only | Same version is a no-op; older runs cannot move a channel backward. Removal runs only after that package's promote loop, and only when `mantle-release` points at this version. A missing tag is a no-op. A tag pointing at another version is left for that version's promote step. `alpha` / `beta` / `rc` / `latest` are never removed |
-| Channels promoted or preserved, and the temp tag cleared or left | GitHub release step | Existing release identity or fail |
+| Consumer passes | That registry's promote step: monotonic channel add for every package | Same version is a no-op; older runs cannot move a channel backward. Public channels are only `alpha`, `beta`, `rc`, and `latest`. `mantle-release` is never removed |
+| Channels promoted or preserved | GitHub release step | Existing release identity or fail. Leftover `mantle-release` pointing at the last published candidate is expected |
 
 The public-registry gate uses a disposable copy of the directly authored
 `docs/examples/host-minimal-worker` reference, installs the exact candidate, then
@@ -39,41 +41,25 @@ foundational blocker returns to the state table and the user for a scope
 decision instead of starting another local redesign loop.
 
 Invariants: immutable versions/tags retain their identity; registry integrity
-and the published-consumer gate precede public channel promotion and any
-removal of `mantle-release` by the release controller; retries cannot move
-channels backward. No downstream mutation, unpublish or rollback is
-introduced. The runnable release-order check guards these transitions.
+and the published-consumer gate precede public channel promotion; retries
+cannot move channels backward. No downstream mutation, unpublish, dist-tag
+removal, or rollback is introduced. The runnable release-order check guards
+these transitions.
 
 Mutation boundaries during a release: `Publish to npmjs` and `Mirror to
-GitHub Packages` may attach `mantle-release` while publishing a version.
-`Promote npmjs channel tags` is the only release step that moves npmjs
-channels or removes that tag for the version being released. `Promote
-GitHub Packages channel tags` is the only release step that does the same
-for GitHub Packages. Recovery of a partial release reruns that same
-controller and version. It does not call the cleanup workflow.
-
-The cleanup workflow is a separate writer for one case the controller
-cannot cover: a release commit that predates temp-tag removal still leaves
-`mantle-release` behind, and a personal npm token that is `read-write` on
-`npm access` can still receive 403 on dist-tag DELETE.
-`.github/workflows/remove-mantle-release-dist-tag.yml` uses the Actions
-`NPM_TOKEN` and `GITHUB_TOKEN`. It is not a release controller and not a
-recovery path.
-
-| State | Sole next writer | Retry / invariant |
-|---|---|---|
-| Leftover `mantle-release` after `alpha`, `beta`, `rc`, or `latest` already points at that version | `remove-mantle-release-dist-tag`, only when `confirm` is `remove-mantle-release` | Missing tag is a no-op. Only `mantle-release` is removed. Before and after dist-tags are printed and compared; every other tag is unchanged |
-| `mantle-release` points at a version no consumer channel has | No deletion | The job fails and leaves the tag. Channel moves stay on the release promote step |
-| Confirm string is anything else | No registry call | The job fails before reading or editing tags |
-
-It shares the `release-controller` concurrency group with
-`cancel-in-progress: false`, so it waits out an in-progress release instead
-of deleting `mantle-release` between publish and channel promotion. After
-this file is on `develop`:
-
-```sh
-gh workflow run remove-mantle-release-dist-tag --ref develop -f confirm=remove-mantle-release
-```
+GitHub Packages` attach the internal candidate dist-tag `mantle-release`
+while publishing a version. `Promote npmjs channel tags` is the only
+release step that moves npmjs public channels. `Promote GitHub Packages
+channel tags` is the only release step that moves GitHub Packages public
+channels. Neither step removes `mantle-release`. Recovery of a partial
+release reruns that same controller and version.
+
+`mantle-release` is not a public channel. It stays forever as an internal
+candidate tag pointing at the last published candidate. Official channels
+are only `alpha`, `beta`, `rc`, and `latest`. Consumers must not install
+`mantle-release`. Deleting it after promotion is not part of the release:
+dist-tag DELETE only added failure and re-run state, and Actions
+`NPM_TOKEN` 403s on that DELETE.
 
 ## Branches and channels
 
@@ -85,8 +71,10 @@ gh workflow run remove-mantle-release-dist-tag --ref develop -f confirm=remove-m
 | `X.Y.Z` | `main` | `latest` | release |
 
 - The controller derives the source branch from the version: `-alpha` means
-  `develop`, anything else means `main`. It refuses a commit that is not that
-  branch's tip or not the merge commit of exactly one PR into that branch.
+  `develop`, anything else means `main`. An untagged dispatch must be that
+  branch's tip and the merge commit of exactly one PR into that branch.
+  When the version tag already exists on an ancestor of the tip, Resolve
+  recovers from that tag SHA; see Recovery.
   `scripts/release-tag-order.mjs` rejects any other prerelease identifier.
 - `develop` is where every change integrates first, so it is the base for all
   work despite `main` being the repository's default branch on GitHub. `main`
@@ -95,10 +83,13 @@ gh workflow run remove-mantle-release-dist-tag --ref develop -f confirm=remove-m
   approval, resolved threads and a current-base `Typecheck + tests` check.
 - Stable is the only release that moves `latest`. A prerelease channel keeps
   its last version when a later stable publishes.
-- Publish uses `--tag mantle-release`, so publication does not move
-  `alpha`, `beta`, `rc`, or `latest`. After the public-registry consumer
-  gate, each registry's promote step moves the real channel and then removes
-  `mantle-release` when that tag points at this version.
+- Publish uses `--tag mantle-release`. `mantle-release` is an internal
+  candidate dist-tag, not a public channel. Consumers must not install it.
+  Official channels are only `alpha`, `beta`, `rc`, and `latest`.
+  Publication does not move those channels. After the public-registry
+  consumer gate, each registry's promote step moves every package's real
+  channel and leaves `mantle-release` pointing at the last published
+  candidate.
 
 ## Prepare and run
 
@@ -118,6 +109,14 @@ gh workflow run remove-mantle-release-dist-tag --ref develop -f confirm=remove-m
    git grep -n "$OLD" -- ':!pnpm-lock.yaml' ':!**/package-lock.json'
    ```
 
+   Leave the consumer cold-start entry **untagged**: `npx skills add
+   aotter/mantle --skill install`, `/plugin marketplace add aotter/mantle`,
+   `codex plugin marketplace add aotter/mantle` and the plugin-manifest
+   descriptions carry no `@v…` / `--ref`. Untagged resolves to `main`, which
+   only moves at a release, so it is always the latest published version
+   (#995, #998). Only "installed version" statements such as
+   `(currently \`X.Y.Z\`)` are bumped.
+
 3. Review API compatibility and migration instructions for actual consumers.
    Frozen legacy consumers stay on their pinned version; do not make them
    follow new Core.
@@ -212,8 +211,9 @@ registries. Existing artifacts on retry must have matching integrity.
 
 Completion requires the Core tag SHA, all eleven npmjs/GPR packages, exact
 integrity, no workspace dependencies, a passing public-registry Worker gate,
-correct channel tags, no `mantle-release` tag left on this version, and the
-GitHub release. Retain run links and gate evidence.
+correct channel tags, and the GitHub release. Leftover `mantle-release`
+pointing at the last published candidate is expected. Retain run links and
+gate evidence.
 This does not prove stable production soak or upgrade safety; the version's
 release-gate issue owns those acceptance requirements. An agent acceptance run
 uses only the version-matched authoring instructions, not an SDK checkout or
@@ -225,6 +225,19 @@ Rerun the same controller commit/version for a transient or verified partial
 transition. Existing tags/artifacts must match; newer channels stay put. Fail
 on identity disagreement instead of guessing. A wrong public artifact needs
 a new version; never force-retag, overwrite or reuse a published version.
+
+After a controller-only fix lands on the tip, re-dispatch the same version
+from the source branch. Resolve recovers using the existing tag SHA when
+that commit is an ancestor of the tip and package versions on the tip still
+match. The tag owns the release SHA; the tip only carries controller fixes.
+Tagged recovery skips the Core source check because that tree was already
+released from the immutable tag. When `tag_exists` and all eleven npmjs
+packages already exist at that version, that same existence check skips
+packing, immutable tarball comparison, and the public-registry Worker gate.
+The controller tip must not rebuild an artifact whose identity is already
+published. Verify npm metadata still runs. The Worker gate stays skipped
+because the first run already passed it before promotion.
+
 Unpublish is reserved for actual secret/private-file exposure, never routine
 fixes. Infrastructure renames require their explicit config diff and live
 smoke; CI alone cannot prove provider identity.

package/docs/spec-only-host-adoption.md

@@ -6,7 +6,7 @@ Runtime. This Spec-only path is allowed by
 [ADR-0019](adr/0019-sealed-manifest-runtime-pipeline.md), not a new adapter,
 manifest grammar, or fork of Core.
 
-This recipe targets `0.1.3-alpha.2`. Pin the package, record the tested version, and
+This recipe targets `0.1.3-alpha.3`. Pin the package, record the tested version, and
 rerun compatibility checks when upgrading.
 
 ## What stays with the host

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aotter/mantle",
-  "version": "0.1.3-alpha.2",
+  "version": "0.1.3-alpha.3",
   "description": "Embeddable Mantle Core umbrella with Spec and Runtime; Web, Admin, Auth, Bun, Vercel, Cloudflare, and Admin UI are optional peer packages.",
   "license": "Apache-2.0",
   "homepage": "https://mantle.tools/",
@@ -83,8 +83,8 @@
     "README.md"
   ],
   "dependencies": {
-    "@aotter/mantle-runtime": "0.1.3-alpha.2",
-    "@aotter/mantle-spec": "0.1.3-alpha.2"
+    "@aotter/mantle-runtime": "0.1.3-alpha.3",
+    "@aotter/mantle-spec": "0.1.3-alpha.3"
   },
   "peerDependencies": {
     "aws4fetch": "^1.0.20",
@@ -92,13 +92,13 @@
     "hono": "^4.12.0",
     "@libsql/client": "^0.17.4",
     "zod": "^4.5.0",
-    "@aotter/mantle-auth": "0.1.3-alpha.2",
-    "@aotter/mantle-admin": "0.1.3-alpha.2",
-    "@aotter/mantle-cloudflare": "0.1.3-alpha.2",
-    "@aotter/mantle-admin-ui": "0.1.3-alpha.2",
-    "@aotter/mantle-bun": "0.1.3-alpha.2",
-    "@aotter/mantle-web": "0.1.3-alpha.2",
-    "@aotter/mantle-vercel": "0.1.3-alpha.2"
+    "@aotter/mantle-admin": "0.1.3-alpha.3",
+    "@aotter/mantle-bun": "0.1.3-alpha.3",
+    "@aotter/mantle-admin-ui": "0.1.3-alpha.3",
+    "@aotter/mantle-cloudflare": "0.1.3-alpha.3",
+    "@aotter/mantle-auth": "0.1.3-alpha.3",
+    "@aotter/mantle-web": "0.1.3-alpha.3",
+    "@aotter/mantle-vercel": "0.1.3-alpha.3"
   },
   "peerDependenciesMeta": {
     "@aotter/mantle-admin": {
@@ -144,13 +144,13 @@
     "typescript": "^6.0.3",
     "vitest": "^4.1.11",
     "zod": "^4.5.4",
-    "@aotter/mantle-admin": "0.1.3-alpha.2",
-    "@aotter/mantle-auth": "0.1.3-alpha.2",
-    "@aotter/mantle-bun": "0.1.3-alpha.2",
-    "@aotter/mantle-admin-ui": "0.1.3-alpha.2",
-    "@aotter/mantle-web": "0.1.3-alpha.2",
-    "@aotter/mantle-cloudflare": "0.1.3-alpha.2",
-    "@aotter/mantle-vercel": "0.1.3-alpha.2"
+    "@aotter/mantle-admin": "0.1.3-alpha.3",
+    "@aotter/mantle-auth": "0.1.3-alpha.3",
+    "@aotter/mantle-admin-ui": "0.1.3-alpha.3",
+    "@aotter/mantle-bun": "0.1.3-alpha.3",
+    "@aotter/mantle-cloudflare": "0.1.3-alpha.3",
+    "@aotter/mantle-vercel": "0.1.3-alpha.3",
+    "@aotter/mantle-web": "0.1.3-alpha.3"
   },
   "engines": {
     "node": ">=22"

package/skills/README.md

@@ -58,26 +58,25 @@ contracts.
 
 ## Source-repository marketplace install
 
-Cold start is the pinned install skill. Other marketplace hosts are pointers
-to the same pin:
+Cold start is the install skill. Other marketplace hosts are pointers
+to the same entry:
 
 ```sh
-npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install
+npx skills add aotter/mantle --skill install
 ```
 
 ```bash
 # Claude Code — two separate prompts
-/plugin marketplace add aotter/mantle@v0.1.3-alpha.2
+/plugin marketplace add aotter/mantle
 /plugin install mantle@mantle
 
 # Codex
-codex plugin marketplace add aotter/mantle --ref v0.1.3-alpha.2
+codex plugin marketplace add aotter/mantle
 codex plugin add mantle@mantle
 ```
 
-Then follow the install skill to the CLI and handbook. Do not use an untagged
-`aotter/mantle` marketplace add as the official entry. After packages are
-pinned, `mantle skills` projects the installed package's own skills into the
+Then follow the install skill to the CLI and handbook. After packages are
+installed, `mantle skills` projects the installed package's own skills into the
 project, and `mantle skills --check` fails on drift.
 
 Cursor and GitHub Copilot read their manifests from the repository directly.
@@ -97,7 +96,7 @@ package. Two audiences, two artifacts.
 
 ## Discoverability
 
-The skills target ADR-0007's "AI as primary author" thesis: agents reach these files by URL when the user invokes them by intent ("install mantle", "develop my Mantle site", "deploy"). Official cold start is `npx skills add aotter/mantle@v0.1.3-alpha.2 --skill install`. Point the agent at tag `v0.1.3-alpha.2` or pass the version-matched markdown content directly.
+The skills target ADR-0007's "AI as primary author" thesis: agents reach these files by URL when the user invokes them by intent ("install mantle", "develop my Mantle site", "deploy"). Official cold start is `npx skills add aotter/mantle --skill install`. Point the agent at the repository or pass the version-matched markdown content directly.
 
 ## Conventions
 

package/skills/develop/SKILL.md

@@ -166,7 +166,9 @@ pnpm exec mantle-harness indexes --require-public --format text
 The check uses crowded real SQLite and the shipped compiler. It complements
 `pnpm validate`; it does not replace correctness validation. Declare the
 smallest ordered index justified by the measured path and respect SQLite's
-leftmost-prefix rule. Do not change user-visible filter or ordering semantics
+leftmost-prefix rule; which columns an index may name and how a public View's
+status predicate shapes it is in the handbook (`reference/schema.md#indexes`).
+Do not change user-visible filter or ordering semantics
 just to make the gate pass. Do not add every permutation or cache every read.
 
 For relevant Cloudflare serving changes, start the project and sample the