@arnilo/prism 0.11.0 → 0.12.0

package/docs/release-and-install.md

@@ -5,114 +5,117 @@
 ## What it does
 
 
-Prism's current **0.11.0** line has **12 publishable manifests**: the root `@arnilo/prism` core package plus **11 workspace packages** — **20 provider adapters** (20 provider adapter subpaths inside the `@arnilo/prism-providers` family), 4 `prism-*` family packages, and 7 capability packages. (Generated by `node scripts/package-truth.mjs` → `scripts/package-truth.json` — the manifest-derived single source for counts, provider membership, umbrella closures, and profile closures.) The last lockstep cut was 0.3.0; Decision B now publishes changed packages independently inside `^0.3.0` — the plan 039 changed-package cut moved root `@arnilo/prism` and every plan-035+ changed package to **0.3.1**, and the plan 050 changed-package cut moved root plus four changed packages to **0.3.2**; the plan 041-044 changed-package cut moves root to **0.3.3** with `@arnilo/prism-memory@0.3.2` (composite recall scoring), `@arnilo/prism-evals@0.3.1` (trace-to-dataset curation), the three session-store packages at **0.3.1** (run-ledger `promptVersion` provenance), and the initial `@arnilo/prism-prompts@0.0.1` (independent opt-in, outside `prism-all`); plan 054 consolidation then folded `@arnilo/prism-browser` and `@arnilo/prism-obscura` into the `@arnilo/prism-web-tools` family as `/browser` and `/obscura` subpaths, folded `@arnilo/prism-rag`, both compaction strategies, `@arnilo/prism-graft`, and `@arnilo/prism-wiki` into the `@arnilo/prism-memory` family as `/rag`, `/compaction/llm`, `/compaction/observational-memory`, `/graft`, and `/wiki` subpaths (deleting the `@arnilo/prism-compaction` profile), and folded all 17 `@arnilo/prism-provider-*` packages into the `@arnilo/prism-providers` family as `/<adapter>` subpaths (Azure/Bedrock/Vertex stop being special all-only manifests); independent publication continues inside `^0.3.0` ranges (which satisfy 0.3.1, 0.3.2, and 0.3.3). This page describes how they are packed, what each tarball contains, how to install them, the required non-optional **caret** `@arnilo/prism@^0.11.0` peer range, the release workflow, and the offline test budget. The measurable 1.0 readiness gates (command-per-gate) live in [`0.1.0-readiness.md`](history/./0.1.0-readiness.md).
+Prism's current **0.12.0** line has **12 publishable manifests**: the root `@arnilo/prism` core package plus **11 workspace packages** — **22 provider adapters** (22 provider adapter subpaths inside the `@arnilo/prism-providers` family), 4 `prism-*` family packages, and 7 capability packages. (Generated by `bun scripts/package-truth.mjs` → `scripts/package-truth.json` — the manifest-derived single source for counts, provider membership, umbrella closures, and profile closures.) The last lockstep cut was 0.3.0; Decision B now publishes changed packages independently inside `^0.3.0` — the plan 039 changed-package cut moved root `@arnilo/prism` and every plan-035+ changed package to **0.3.1**, and the plan 050 changed-package cut moved root plus four changed packages to **0.3.2**; the plan 041-044 changed-package cut moves root to **0.3.3** with `@arnilo/prism-memory@0.3.2` (composite recall scoring), `@arnilo/prism-evals@0.3.1` (trace-to-dataset curation), the three session-store packages at **0.3.1** (run-ledger `promptVersion` provenance), and the initial `@arnilo/prism-prompts@0.0.1` (independent opt-in, outside `prism-all`); plan 054 consolidation then folded `@arnilo/prism-browser` and `@arnilo/prism-obscura` into the `@arnilo/prism-web-tools` family as `/browser` and `/obscura` subpaths, folded `@arnilo/prism-rag`, both compaction strategies, `@arnilo/prism-graft`, and `@arnilo/prism-wiki` into the `@arnilo/prism-memory` family as `/rag`, `/compaction/llm`, `/compaction/observational-memory`, `/graft`, and `/wiki` subpaths (deleting the `@arnilo/prism-compaction` profile), and folded all 17 `@arnilo/prism-provider-*` packages into the `@arnilo/prism-providers` family as `/<adapter>` subpaths (Azure/Bedrock/Vertex stop being special all-only manifests); independent publication continues inside `^0.3.0` ranges (which satisfy 0.3.1, 0.3.2, and 0.3.3). This page describes how they are packed, what each tarball contains, how to install them, the required non-optional **caret** `@arnilo/prism@^0.12.0` peer range, the release workflow, and the offline test budget. The measurable 1.0 readiness gates (command-per-gate) live in [`0.1.0-readiness.md`](history/./0.1.0-readiness.md).
 
 Core `@arnilo/prism` ships runtime, CLI, templates, and docs. Every code package has a required `@arnilo/prism` peer inside the Decision B window — the caret current spec is `@arnilo/prism@^0.3.3` and every declared window peer satisfies it: packages republishing in the plan 050 cut carry `^0.3.2`; the plan 039 set keeps `^0.3.1`; unchanged packages keep their `^0.3.0` peer; profiles are pure manifests. The plan 050 republished set declares the required `@arnilo/prism@^0.3.2` peer; the plan 041-044 republished set keeps its existing `^0.3.0` window peer; unchanged packages keep their prior window. Installation activates no provider, listener, database, browser, credential, or tool capability.
 
-The **0.11.0 lockstep cut** moved all **twelve** manifests together. The current declared peer is `@arnilo/prism@^0.11.0` on every package, and `release.mjs` lockstep mode fails closed on any internal range that merely satisfies the cut version instead of matching it. The **0.6.0–0.10.0 lockstep cuts** each moved their then-current manifest set together (`@arnilo/prism-hooks` arrived in the 0.10.0 cut). The independent-publication history above (0.3.x, 0.4.x, 0.5.x) describes how the line grew when packages moved separately.
+The **0.12.0 lockstep cut** moved all **twelve** manifests together. The current declared peer is `@arnilo/prism@^0.12.0` on every package, and `release.mjs` lockstep mode fails closed on any internal range that merely satisfies the cut version instead of matching it. The **0.6.0–0.11.1 lockstep cuts** each moved their then-current manifest set together (`@arnilo/prism-hooks` arrived in the 0.10.0 cut). The independent-publication history above (0.3.x, 0.4.x, 0.5.x) describes how the line grew when packages moved separately.
 
 <!-- generated:package-truth:inventory begin -->
-**12 publishable manifests** — root `@arnilo/prism` plus 11 workspace packages (4 `prism-*` family packages, 7 capability packages). Generated by `node scripts/package-truth.mjs --emit-docs` — do not hand-edit.
+**12 publishable manifests** — root `@arnilo/prism` plus 11 workspace packages (4 `prism-*` family packages, 7 capability packages). Generated by `bun scripts/package-truth.mjs --emit-docs` — do not hand-edit.
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.11.0 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-channels` | 0.11.0 | family — transport-neutral messaging runtime, durable journal, pairing and one-use approvals; official /telegram (private DMs, opt-in granted groups/topics) and experimental pinned signal-cli /signal |
-| `@arnilo/prism-coding-tools` | 0.11.0 | family — /agent, /security, /openapi, /computer-use-linux, /dev, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.11.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /validation subpaths |
-| `@arnilo/prism-providers` | 0.11.0 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.11.0 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.11.0 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-hooks` | 0.11.0 | capability — Claude/Codex-compatible hooks.json adapter compiled onto middleware, guardrail, injector, and stop-hook seams |
-| `@arnilo/prism-mcp` | 0.11.0 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.11.0 | capability — memory plus /rag, /compaction/*, /fabric, /wiki subpaths |
-| `@arnilo/prism-web-tools` | 0.11.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
-| `@arnilo/prism-work` | 0.11.0 | capability — /connectors, /documents, /sheets, /diagrams, /document-reader, /sandbox, /skills, /tools subpaths |
+| `@arnilo/prism` | 0.12.0 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-channels` | 0.12.0 | family — transport-neutral messaging runtime, durable journal, pairing and one-use approvals; official /telegram (private DMs, opt-in granted groups/topics) and experimental pinned signal-cli /signal |
+| `@arnilo/prism-coding-tools` | 0.12.0 | family — /agent, /security, /openapi, /computer-use-linux, /dev, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.12.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /validation subpaths |
+| `@arnilo/prism-providers` | 0.12.0 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.12.0 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.12.0 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-hooks` | 0.12.0 | capability — Claude/Codex-compatible hooks.json adapter compiled onto middleware, guardrail, injector, and stop-hook seams |
+| `@arnilo/prism-mcp` | 0.12.0 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.12.0 | capability — memory plus /rag, /compaction/*, /fabric, /wiki subpaths |
+| `@arnilo/prism-web-tools` | 0.12.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism-work` | 0.12.0 | capability — /connectors, /documents, /sheets, /diagrams, /document-extraction, /document-reader, /sandbox, /skills, /tools subpaths |
 <!-- generated:package-truth:inventory end -->
 
 
 <!-- generated:package-truth:providers begin -->
-**20 provider adapters** — first-party adapters ship as `@arnilo/prism-providers/<adapter>` subpaths in one tarball (importing one never evaluates another):
+**22 provider adapters** — first-party adapters ship as `@arnilo/prism-providers/<adapter>` subpaths in one tarball (importing one never evaluates another):
 
 | adapter package | version |
 | --- | --- |
-| `@arnilo/prism-providers/ai-sdk` | 0.11.0 |
-| `@arnilo/prism-providers/alibaba` | 0.11.0 |
-| `@arnilo/prism-providers/anthropic` | 0.11.0 |
-| `@arnilo/prism-providers/azure` | 0.11.0 |
-| `@arnilo/prism-providers/bedrock` | 0.11.0 |
-| `@arnilo/prism-providers/clinepass` | 0.11.0 |
-| `@arnilo/prism-providers/commandcode` | 0.11.0 |
-| `@arnilo/prism-providers/deepseek` | 0.11.0 |
-| `@arnilo/prism-providers/google` | 0.11.0 |
-| `@arnilo/prism-providers/hyper` | 0.11.0 |
-| `@arnilo/prism-providers/kimi` | 0.11.0 |
-| `@arnilo/prism-providers/model-discovery` | 0.11.0 |
-| `@arnilo/prism-providers/neuralwatt` | 0.11.0 |
-| `@arnilo/prism-providers/ollama` | 0.11.0 |
-| `@arnilo/prism-providers/openai` | 0.11.0 |
-| `@arnilo/prism-providers/opencode-go` | 0.11.0 |
-| `@arnilo/prism-providers/openrouter` | 0.11.0 |
-| `@arnilo/prism-providers/vertex` | 0.11.0 |
-| `@arnilo/prism-providers/xai` | 0.11.0 |
-| `@arnilo/prism-providers/zai` | 0.11.0 |
+| `@arnilo/prism-providers/ai-sdk` | 0.12.0 |
+| `@arnilo/prism-providers/alibaba` | 0.12.0 |
+| `@arnilo/prism-providers/anthropic` | 0.12.0 |
+| `@arnilo/prism-providers/azure` | 0.12.0 |
+| `@arnilo/prism-providers/bedrock` | 0.12.0 |
+| `@arnilo/prism-providers/clinepass` | 0.12.0 |
+| `@arnilo/prism-providers/commandcode` | 0.12.0 |
+| `@arnilo/prism-providers/deepseek` | 0.12.0 |
+| `@arnilo/prism-providers/google` | 0.12.0 |
+| `@arnilo/prism-providers/hyper` | 0.12.0 |
+| `@arnilo/prism-providers/kimi` | 0.12.0 |
+| `@arnilo/prism-providers/laya` | 0.12.0 |
+| `@arnilo/prism-providers/model-discovery` | 0.12.0 |
+| `@arnilo/prism-providers/neuralwatt` | 0.12.0 |
+| `@arnilo/prism-providers/ollama` | 0.12.0 |
+| `@arnilo/prism-providers/openai` | 0.12.0 |
+| `@arnilo/prism-providers/opencode-go` | 0.12.0 |
+| `@arnilo/prism-providers/openrouter` | 0.12.0 |
+| `@arnilo/prism-providers/typesafe` | 0.12.0 |
+| `@arnilo/prism-providers/vertex` | 0.12.0 |
+| `@arnilo/prism-providers/xai` | 0.12.0 |
+| `@arnilo/prism-providers/zai` | 0.12.0 |
 <!-- generated:package-truth:providers end -->
 
 
-Core ships `dist`, docs, templates, and `CHANGELOG.md`; code packages ship compiled output, README, license, and changelog. Family/profile packages ship manifest, README, and changelog. `@arnilo/prism-providers` is the unified provider family: all provider adapters ship as `dist/<adapter>` subpaths in one tarball (Azure/Bedrock/Vertex included), with the required `@arnilo/prism` peer as the only dependency and `@ai-sdk/provider` an optional peer of `/ai-sdk`. `@arnilo/prism-core` provides the unified runtime, sessions, governance, credentials, and enterprise persistence family package. `@arnilo/prism-channels` provides the transport-neutral messaging runtime, durable journal and pairing surface; it has only the required `@arnilo/prism` peer, while its SQLite/PostgreSQL conformance drivers are development-only. `@arnilo/prism-web-tools` provides the unified web tools family: root Brave/Exa/Firecrawl research tools plus `/browser` (Playwright-peer gated) and `/obscura` (host-binary + MCP gated) subpaths. `@arnilo/prism-memory` provides the unified memory and context family: root working/vector memory plus `/rag` (with `/rag/loaders` and `/rag/parsers`), `/compaction/llm`, `/compaction/observational-memory`, and `/wiki` subpaths, including the `prism-wiki` bin and bundled skills. `@arnilo/prism-coding-tools/dev` ships the loopback dev inspector — the `prism-dev` bin, the `prism dev` CLI composition, and the `/dev/cli` export the core CLI delegates to for `prism dev` (plan 040 Tasks 4–5); dev tooling is developer-time only and must never be the production API boundary. `@arnilo/prism-core/governance/prompts` (plan 042) is the versioned prompt registry: an explicit host opt-in with no first-party package depending on it — unlike `@arnilo/prism-memory` (a family member) and `@arnilo/prism-core/governance/evals` (used by the promotion helper as an optional peer). `@arnilo/prism-work` is the unified work family: `/connectors`, `/documents`, `/sheets`, `/diagrams`, `/document-reader`, `/sandbox`, `/skills`, and `/tools` subpaths in one tarball. Office dependencies are exact-pinned; `/document-reader` keeps `mammoth` and `pdf-parse` optional and fail-closed, while `playwright-core` remains a devDependency for gated draw.io testing. Importing `/connectors` never evaluates document dependencies.
+Core ships `dist`, docs, templates, and `CHANGELOG.md`; code packages ship compiled output, README, license, and changelog. Family/profile packages ship manifest, README, and changelog. `@arnilo/prism-providers` is the unified provider family: all provider adapters ship as `dist/<adapter>` subpaths in one tarball (Azure/Bedrock/Vertex included), with the required `@arnilo/prism` peer as the only dependency and `@ai-sdk/provider` an optional peer of `/ai-sdk`. `@arnilo/prism-core` provides the unified runtime, sessions, governance, credentials, and enterprise persistence family package. `@arnilo/prism-channels` provides the transport-neutral messaging runtime, durable journal and pairing surface; it has only the required `@arnilo/prism` peer, while its SQLite/PostgreSQL conformance drivers are development-only. `@arnilo/prism-web-tools` provides the unified web tools family: root Brave/Exa/Firecrawl research tools plus `/browser` (Playwright-peer gated) and `/obscura` (host-binary + MCP gated) subpaths. `@arnilo/prism-memory` provides the unified memory and context family: root working/vector memory plus `/rag` (with `/rag/loaders` and `/rag/parsers`), `/compaction/llm`, `/compaction/observational-memory`, and `/wiki` subpaths, including the `prism-wiki` bin and bundled skills. `@arnilo/prism-coding-tools/dev` ships the loopback dev inspector — the `prism-dev` bin, the `prism dev` CLI composition, and the `/dev/cli` export the core CLI delegates to for `prism dev` (plan 040 Tasks 4–5); dev tooling is developer-time only and must never be the production API boundary. `@arnilo/prism-core/governance/prompts` (plan 042) is the versioned prompt registry: an explicit host opt-in with no first-party package depending on it — unlike `@arnilo/prism-memory` (a family member) and `@arnilo/prism-core/governance/evals` (used by the promotion helper as an optional peer). `@arnilo/prism-work` is the unified work family: `/connectors`, `/documents`, `/sheets`, `/diagrams`, `/document-extraction`, `/document-reader`, `/sandbox`, `/skills`, and `/tools` subpaths in one tarball. Office dependencies are exact-pinned; `/document-reader` keeps `mammoth` and `pdf-parse` optional and fail-closed, `/document-extraction` keeps `@firecrawl/anydoc@0.2.4` optional and local, while `playwright-core` remains a devDependency for gated draw.io testing. Importing `/connectors` never evaluates document dependencies.
 
 ## When to use it
 
 
 Use this page when installing Prism into a host app, when adding a first-party package, when cutting a release, or when investigating why a tarball contains (or excludes) a file.
 
-Consumers install the core package for the runtime and add first-party packages for provider adapters or compaction strategies. Each first-party package requires the `@arnilo/prism` peer at its declared version; install `@arnilo/prism` alongside them or npm will report an unmet peer.
+Consumers install the core package for the runtime and add first-party packages for provider adapters or compaction strategies. Each first-party package requires the `@arnilo/prism` peer at its declared version, so install `@arnilo/prism` alongside them: `bun add` installs a first-party tarball without a missing-peer warning (probed on Bun 1.4.2, plan 125 Task 1), while npm fails closed on the same install — the peer is a contract the host satisfies explicitly, not something the installer enforces for you. Hosts keep their own supply chain: `bun install --frozen-lockfile` for reproducible installs and `bun audit --audit-level=moderate` for the dependency review.
 
 ## Inputs / request
 
 
 | Operation | Command |
 | --- | --- |
-| Install core only | `npm install @arnilo/prism` |
-| Scaffold a minimal project | `npx --package @arnilo/prism prism init my-agent [--provider openai] [--template <name>] [--list-templates] [--with-workflows] [--with-evals]` |
-| Install core runtime & persistence family | `npm install @arnilo/prism @arnilo/prism-core` |
-| Install messaging channels | `npm install @arnilo/prism @arnilo/prism-channels` |
-| Install core + all provider adapters | `npm install @arnilo/prism @arnilo/prism-providers` (import `@arnilo/prism-providers/<adapter>`) |
-| Install minimal runtime (replaces `@arnilo/prism`) | `npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-memory` |
-| Install compaction strategies only | `npm install @arnilo/prism @arnilo/prism-memory` |
-| Install memory + RAG context family | `npm install @arnilo/prism @arnilo/prism-memory` (RAG: `@arnilo/prism-memory/rag`) |
-| Install coding tools (replaces `@arnilo/prism-coding-tools`) | `npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-coding-tools @arnilo/prism-mcp @arnilo/prism-providers` |
-| Install application SDK (replaces `@arnilo/prism-core`) | `npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-mcp @arnilo/prism-providers` |
-| Install selected families (replaces `@arnilo/prism-all`) | `npm install @arnilo/prism @arnilo/prism-core @arnilo/prism-providers @arnilo/prism-coding-tools @arnilo/prism-web-tools @arnilo/prism-memory @arnilo/prism-mcp` |
-| Install core + a single provider adapter | `npm install @arnilo/prism @arnilo/prism-providers` (import `@arnilo/prism-providers/openai`) |
-| 0.0.12 AG-UI (after release) | `npm install @arnilo/prism@0.0.12 @arnilo/prism-ag-ui@0.0.12` |
-| Install bounded web research tools | `npm install @arnilo/prism @arnilo/prism-web-tools @arnilo/prism-core` |
-| Install browser automation tools (Playwright-peer gated `/browser`) | `npm install @arnilo/prism @arnilo/prism-web-tools playwright-core@1.63.0` |
-| Install Obscura browser-engine tools (host supplies the binary; `/obscura`) | `npm install @arnilo/prism @arnilo/prism-web-tools @arnilo/prism-mcp` |
-| Install RAG retrieval (memory family `/rag`) | `npm install @arnilo/prism @arnilo/prism-memory` |
-| Install the Wiki CLI and skills (memory family `/wiki`) | `npm install @arnilo/prism @arnilo/prism-memory` (`npx prism-wiki --help`) |
-| Install work connectors | `npm install @arnilo/prism @arnilo/prism-work` (import `@arnilo/prism-work/connectors`) |
-| Install document/spreadsheet/presentation engine | `npm install @arnilo/prism @arnilo/prism-work` (import `@arnilo/prism-work/documents`) |
-| Install spreadsheet and CSV data engine | `npm install @arnilo/prism @arnilo/prism-work` (import `@arnilo/prism-work/sheets`) |
-| Install draw.io embed client & diagram engine | `npm install @arnilo/prism @arnilo/prism-work` (import `@arnilo/prism-work/diagrams`) |
-| Install bounded document reader | `npm install @arnilo/prism @arnilo/prism-work` (optional `pdf-parse mammoth`; import `@arnilo/prism-work/document-reader`) |
+| Install core only | `bun add @arnilo/prism` |
+| Scaffold a minimal project | `bunx --package @arnilo/prism prism init my-agent [--provider openai] [--template <name>] [--list-templates] [--with-workflows] [--with-evals]` |
+| Install core runtime & persistence family | `bun add @arnilo/prism @arnilo/prism-core` |
+| Install messaging channels | `bun add @arnilo/prism @arnilo/prism-channels` |
+| Install core + all provider adapters | `bun add @arnilo/prism @arnilo/prism-providers` (import `@arnilo/prism-providers/<adapter>`) |
+| Install minimal runtime (replaces `@arnilo/prism`) | `bun add @arnilo/prism @arnilo/prism-core @arnilo/prism-memory` |
+| Install compaction strategies only | `bun add @arnilo/prism @arnilo/prism-memory` |
+| Install memory + RAG context family | `bun add @arnilo/prism @arnilo/prism-memory` (RAG: `@arnilo/prism-memory/rag`) |
+| Install coding tools (replaces `@arnilo/prism-coding-tools`) | `bun add @arnilo/prism @arnilo/prism-core @arnilo/prism-coding-tools @arnilo/prism-mcp @arnilo/prism-providers` |
+| Install application SDK (replaces `@arnilo/prism-core`) | `bun add @arnilo/prism @arnilo/prism-core @arnilo/prism-mcp @arnilo/prism-providers` |
+| Install selected families (replaces `@arnilo/prism-all`) | `bun add @arnilo/prism @arnilo/prism-core @arnilo/prism-providers @arnilo/prism-coding-tools @arnilo/prism-web-tools @arnilo/prism-memory @arnilo/prism-mcp` |
+| Install core + a single provider adapter | `bun add @arnilo/prism @arnilo/prism-providers` (import `@arnilo/prism-providers/openai`) |
+| 0.0.12 AG-UI (after release) | `bun add @arnilo/prism@0.0.12 @arnilo/prism-ag-ui@0.0.12` |
+| Install bounded web research tools | `bun add @arnilo/prism @arnilo/prism-web-tools @arnilo/prism-core` |
+| Install browser automation tools (Playwright-peer gated `/browser`) | `bun add @arnilo/prism @arnilo/prism-web-tools playwright-core@1.63.0` |
+| Install Obscura browser-engine tools (host supplies the binary; `/obscura`) | `bun add @arnilo/prism @arnilo/prism-web-tools @arnilo/prism-mcp` |
+| Install RAG retrieval (memory family `/rag`) | `bun add @arnilo/prism @arnilo/prism-memory` |
+| Install the Wiki CLI and skills (memory family `/wiki`) | `bun add @arnilo/prism @arnilo/prism-memory` (`bunx prism-wiki --help`) |
+| Install work connectors | `bun add @arnilo/prism @arnilo/prism-work` (import `@arnilo/prism-work/connectors`) |
+| Install document/spreadsheet/presentation engine | `bun add @arnilo/prism @arnilo/prism-work` (import `@arnilo/prism-work/documents`) |
+| Install spreadsheet and CSV data engine | `bun add @arnilo/prism @arnilo/prism-work` (import `@arnilo/prism-work/sheets`) |
+| Install draw.io embed client & diagram engine | `bun add @arnilo/prism @arnilo/prism-work` (import `@arnilo/prism-work/diagrams`) |
+| Install bounded document reader | `bun add @arnilo/prism @arnilo/prism-work` (optional `pdf-parse mammoth`; import `@arnilo/prism-work/document-reader`) |
+| Install local document extraction | `bun add @arnilo/prism @arnilo/prism-work @firecrawl/anydoc@0.2.4` (import `@arnilo/prism-work/document-extraction`) |
 | Build everything (core + workspaces) | `npm run build` |
 | Delete all build output (explicit one-shot, see build notes) | `npm run clean` |
 | Run the default (network-free) test suite | `npm test` |
-| Dry-run pack core + every package | `npm run pack:dry-run` |
-| Local mirror of the release verify gate | `npm run release:dry-run` |
+| Dry-run pack core + every package | `bun run pack:dry-run` |
+| Local mirror of the release verify gate | `bun run release:dry-run` |
 | Validate independent versions/ranges and reject registry collisions | `npm run release:check -- --allow-dirty --allow-untagged` |
 | Preview deterministic changed-package publication | `npm run release:publish -- --dry-run --allow-dirty --allow-untagged` |
 | Verify published artifacts from the registry (post-publish smoke) | `npm run post-publish:smoke` |
 | Run the same smoke against local `npm pack` tarballs (pre-publish parity) | `npm run post-publish:smoke -- --local` |
 | Resume interrupted package-tag publication | `npm run release:publish -- --resume --report release-artifacts/publish-report.json` |
 | Protected PostgreSQL enterprise suite | `PRISM_TEST_POSTGRES_URL="$DATABASE_URL" npm run test:postgres` |
-| Full SDK readiness gate (typecheck + offline tests + pack) | `npm run sdk:ready` |
+| Full SDK readiness gate (typecheck + offline tests + pack) | `bun run sdk:ready` |
 | Non-blocking unused-code sweep (report to `scripts/unused-sweep-report.txt`, always exits 0) | `npm run sweep:unused` |
 
 > **Build notes (0.2.3+).** `npm run build` no longer runs `npm run clean` first. Emit-producing and dist-consuming leaves are serialized by `scripts/with-build-lock.mjs`, so concurrent builds/tests cannot expose partial `dist/`; run `npm run clean` after source deletions or branch switches for orphan cleanup. Direct `tsc` outside the wrapper remains an external-writer caveat.
 
-Run `npm run clean` explicitly after deleting source files or switching branches: a deleted `src/__tests__/*.test.ts` leaves an orphan `dist/__tests__/*.test.js` (tsc never auto-cleans). If the orphan's import chain still resolves it keeps running as a stale test — silent staleness, which is exactly what the explicit clean prevents — and if the chain is broken the next `node --test dist/__tests__/*.test.js` fails loudly (`ERR_MODULE_NOT_FOUND`), never silently swallowed. A fresh `npm run clean && npm run build` and the new `npm run build` from a clean state produce byte-identical `dist/` (tsc overwrites per-file outputs).
+Run `npm run clean` explicitly after deleting source files or switching branches: a deleted `src/__tests__/*.test.ts` leaves an orphan `dist/__tests__/*.test.js` (tsc never auto-cleans). If the orphan's import chain still resolves it keeps running as a stale test — silent staleness, which is exactly what the explicit clean prevents — and if the chain is broken the next `bun test dist/__tests__/*.test.js` fails loudly (`ERR_MODULE_NOT_FOUND`), never silently swallowed. A fresh `npm run clean && npm run build` and the new `npm run build` from a clean state produce byte-identical `dist/` (tsc overwrites per-file outputs).
 
 | Specifier | Resolves to |
 | --- | --- |
@@ -152,7 +155,7 @@ A packed tarball contains only public compiled output and release files:
 - Code packages ship `README.md`, `LICENSE`, and `CHANGELOG.md`; family/profile packages ship `README.md` and `CHANGELOG.md`.
 - The core tarball additionally ships the full `docs/` directory (the docs hub), `templates/init/`, and the `templates/` gallery (e.g. `deep-research`) used by `prism init`.
 - `dist/cli.js` and the `bin` link in core.
-- **Tarball filenames.** npm strips the `@scope/` prefix, so the core package `@arnilo/prism` produces a tarball named `arnilo-prism-0.11.0.tgz`; family packages produce `arnilo-prism-core-0.11.0.tgz`, `arnilo-prism-coding-tools-0.11.0.tgz`, `arnilo-prism-providers-0.11.0.tgz` (all 20 adapters inside), `arnilo-prism-channels-0.11.0.tgz`, `arnilo-prism-memory-0.11.0.tgz`, and `arnilo-prism-web-tools-0.11.0.tgz`; capability packages like `arnilo-prism-hooks-0.11.0.tgz`, `arnilo-prism-mcp-0.11.0.tgz`, and `arnilo-prism-work-0.11.0.tgz` carry their own package version. Independent-package tags carry their own version. The CLI bin name `prism` is unaffected by the package name (`npx prism` still works; npm allows the bin field to differ from the package name).
+- **Tarball filenames.** npm strips the `@scope/` prefix, so the core package `@arnilo/prism` produces a tarball named `arnilo-prism-0.12.0.tgz`; family packages produce `arnilo-prism-core-0.12.0.tgz`, `arnilo-prism-coding-tools-0.12.0.tgz`, `arnilo-prism-providers-0.12.0.tgz` (all 22 adapters inside), `arnilo-prism-channels-0.12.0.tgz`, `arnilo-prism-memory-0.12.0.tgz`, and `arnilo-prism-web-tools-0.12.0.tgz`; capability packages like `arnilo-prism-hooks-0.12.0.tgz`, `arnilo-prism-mcp-0.12.0.tgz`, and `arnilo-prism-work-0.12.0.tgz` carry their own package version. Independent-package tags carry their own version. The CLI bin name `prism` is unaffected by the package name (`bunx prism` still works; npm allows the bin field to differ from the package name).
 
 Excluded from every tarball by `files` negation:
 
@@ -179,7 +182,7 @@ Excluded from every tarball by `files` negation:
 }
 ```
 
-Installing the provider/compaction packages without `@arnilo/prism` present produces an unmet-peer error (the `@arnilo/prism` peer is required, not optional):
+Installing the provider/compaction packages without `@arnilo/prism` present produces an unmet-peer error under npm (recorded 0.x behavior; the `@arnilo/prism` peer is required, not optional):
 
 ```text
 npm error code ERESOLVE
@@ -209,13 +212,13 @@ const session = createAgentSession({ agent });
 Local release dry-run mirrors the GitHub Actions `verify` job and delegates to the SDK readiness gate:
 
 ```bash
-npm run release:dry-run
+bun run release:dry-run
 ```
 
 For SDK readiness, run the same one-command gate directly. It composes existing scripts only: examples/workspace typecheck, build, network-free core tests (docs/export/package/install smoke included), workspace tests, and pack dry-run.
 
 ```bash
-npm run sdk:ready
+bun run sdk:ready
 ```
 
 Release publication derives the workspace graph from manifests. The final `v0.3.0` cut validates the 56-package lockstep graph; later `release:check` and `release:publish` default to independent changed-package validation/publication under package tags. Resume skips only registry versions whose internal dependency fingerprint matches the local manifest; conflicting versions fail closed. Each attempted package is written immediately to the JSON report, so a failed job can rerun safely. `--dry-run` performs registry availability checks and invokes `npm publish --dry-run` with explicit public access, provenance, and `latest` tag, but does not publish.
@@ -241,7 +244,7 @@ PRISM_CODING_FORGE_REPOSITORY=owner/repo \
 PRISM_CODING_FORGE_TOKEN=ghp_... \
 PRISM_CODING_PROVIDER=/abs/path/provider-adapter.mjs \
 PRISM_TEST_PTY_BACKEND=/abs/path/pty-host.mjs \
-node --test scripts/phase26-coding-journey.test.mjs
+bun test --timeout=0 scripts/phase26-coding-journey.test.mjs
 ```
 
 Every side effect carries the run suffix and is cleaned up idempotently (PR closed, branch deleted, worktree removed, containers/children/browser context closed); unknown cleanup blocks the journey. The retained report `scripts/phase26-coding-journey-report.json` is regenerated on every real run — `journey.state` pass records the surface `pass` in release evidence; blocked/partial reports record `blocked` (fail closed); `not_run`/missing records are documented protected gaps (`requiredEnv PRISM_CODING_JOURNEY`). The CI profile runs in `.github/workflows/coding-journey.yml` (scheduled + dispatch; Postgres service, host Docker, pinned Chromium, provider + forge secrets from the `coding-journey` environment) and uploads the report artifact. Leak scans cover journey stdout/stderr and the report against every credential-looking env value — the report records env names only. Frozen ceilings: journey wall 20 min (hard 40 min), cleanup 5 min (hard 15 min).
@@ -249,29 +252,29 @@ Every side effect carries the run suffix and is cleaned up idempotently (PR clos
 ## 0.1.x compatibility and support matrix
 
 
-Frozen by Phase 12 Task 0 in `scripts/phase12-freeze-manifest.json` (schema gate `node --test scripts/phase12-freeze.test.mjs`; docs agreement tripwired in the docs test suite). Any change requires a recorded freeze deviation in plan 012.
+Frozen by Phase 12 Task 0 in `scripts/phase12-freeze-manifest.json` (schema gate `bun test --timeout=0 scripts/phase12-freeze.test.mjs`; docs agreement tripwired in the docs test suite). Any change requires a recorded freeze deviation in plan 012.
 
 | Runtime | Supported | Measured in CI |
 | --- | --- | --- |
-| Node | 22, 24 (`engines.node >=22`) | `verify` runs the full `sdk:ready` gate on Node 24; `node22-compat` builds and imports every public root `exports` target on Node 22. Node 20 support was dropped in 0.6.0 (`dev-006`; Node 20 reached upstream end-of-life 2026-04-30); 0.11.0 keeps the same floor. |
+| Node (retired in 0.12.0) | 22, 24 (`engines.node >=22`, era record) | `verify` runs the full `sdk:ready` gate on Bun and imports every public root `exports` default target on Node 24; `node22-compat` builds and imports every public root `exports` target on Node 22. Every other step in both jobs is Bun (plan 124 Task 5); the two Node steps exist because this table declares the support line. Node 20 support was dropped in 0.6.0 (`dev-006`; Node 20 reached upstream end-of-life 2026-04-30); 0.11.0 keeps the same floor. |
 | PostgreSQL | 16 (`pgvector/pgvector:pg16`) | `postgres-integration` service container |
 
 ## Extension and configuration notes
 
 
-- **Required `@arnilo/prism` peer.** Every first-party code package declares a non-optional **caret** `@arnilo/prism@^0.11.0` peer (the lockstep 0.11.0 cut rewrote every internal range; the version-literal gate rejects a declared range that only satisfies the cut version) (`peerDependenciesMeta` must not mark `@arnilo/prism` optional; other peers such as `playwright-core` may be optional). **Peer-version policy (plan 030, Decision B — independent packages):** internal ranges stay inside the caret window of the cut they shipped in, so a package may patch independently while consumers remain on a compatible 0.x line. A package outside that window is refused by the release gate until the next coordinated peer bump. Inside the workspace each package also declares `"@arnilo/prism": "file:../.."` in `devDependencies` so `npm install` resolves the peer locally; that devDependency is stripped from consumer installs and is not a runtime dependency.
+- **Required `@arnilo/prism` peer.** Every first-party code package declares a non-optional **caret** `@arnilo/prism@^0.11.0` peer (the lockstep 0.11.0 cut rewrote every internal range; the version-literal gate rejects a declared range that only satisfies the cut version) (`peerDependenciesMeta` must not mark `@arnilo/prism` optional; other peers such as `playwright-core` may be optional). **Peer-version policy (plan 030, Decision B — independent packages):** internal ranges stay inside the caret window of the cut they shipped in, so a package may patch independently while consumers remain on a compatible 0.x line. A package outside that window is refused by the release gate until the next coordinated peer bump. Inside the workspace each package also declares `"@arnilo/prism": "file:../.."` in `devDependencies` so the workspace install resolves the peer locally; that devDependency is stripped from consumer installs and is not a runtime dependency.
 - **Public access.** All 56 manifests (root + 55 workspace packages: 49 code packages + 6 pure-manifest family/profile packages — the 10 `prism-*` family/profile set is the 6 pure-manifest profiles plus the 4 code packages `prism-caveman`, `prism-impeccable`, `prism-openapi-tools`, `prism-ponytail`) declare `"publishConfig": { "access": "public" }`; the publisher also passes `--access public` explicitly because scoped packages otherwise default to restricted on first publish.
 - **Shipped vs repository docs.** The npm tarball ships `docs/` pages linked from `docs/index.md` (public API, security, migration, providers, install). It excludes `docs/_evidence/` (per-phase evidence freezes, including `release-0.2.7-evidence.md`), `docs/release-*-evidence.md`, and `docs/api-page-template.md`. Those files remain in git for audit. `dist/__tests__` and `*.map` stay excluded.
 - **Map retention knob.** Source maps are emitted locally but stripped from tarballs by `!dist/**/*.map`. Removing that `files` negation ships maps in releases (larger tarballs, better consumer stack traces).
-- **Release workflow.** `.github/workflows/release.yml` has six jobs. `verify` runs network-free SDK readiness on Node 24; `node22-compat` builds/imports every public root `exports` default target on Node 22 for declared `engines.node >=22` (docs examples need Node >=22.6 native TypeScript stripping, inside the ≥22 floor); `postgres-integration` uses `pgvector/pgvector:pg16`; `supply-chain` runs high-severity audit, SPDX/license policy, and tracked-source secret scanning; and tag-only `codeql-release` runs SAST. `publish` runs on `v0.3.0` for the one lockstep cut and on `@arnilo/*@*` package tags afterward; it needs all five gates, preserves clean tagged/version/topological publication, and alone receives `NPM_TOKEN`, `id-token: write`, and `attestations: write`. Before npm publish it packs all current tarballs, generates checksums plus SPDX, scans unpacked public artifacts, creates GitHub attestations for tarballs and SBOM, then retains artifacts for 30 days. Registry state remains the resumable journal. Local `npm run release:dry-run` remains network-free SDK readiness; local PostgreSQL coverage is `PRISM_TEST_POSTGRES_URL=... npm run test:postgres`.
+- **Release workflow.** `.github/workflows/release.yml` has six jobs. `verify` runs network-free SDK readiness on Bun 1.4.2 (**Node runtime support retired in 0.12.0**; the era's two measured legs are recorded in [`history/retire-node-runtime.md`](history/retire-node-runtime.md)); `postgres-integration` uses `pgvector/pgvector:pg16`; `supply-chain` runs high-severity audit, SPDX/license policy, and tracked-source secret scanning; and tag-only `codeql-release` runs SAST. `publish` runs on `v0.3.0` for the one lockstep cut and on `@arnilo/*@*` package tags afterward; it needs all five gates, preserves clean tagged/version/topological publication, and alone receives `NPM_TOKEN`, `id-token: write`, and `attestations: write`. Before npm publish it packs all current tarballs, generates checksums plus SPDX, scans unpacked public artifacts, creates GitHub attestations for tarballs and SBOM, then retains artifacts for 30 days. Registry state remains the resumable journal. Local `bun run release:dry-run` remains network-free SDK readiness; local PostgreSQL coverage is `PRISM_TEST_POSTGRES_URL=... npm run test:postgres`.
 - **Protected integration matrix (plan 060).** Required on protected branches; pull requests do not run these jobs (no PR secrets). Connection strings are masked in logs.
 
   | Job | Workflow | Cadence | Evidence |
   | --- | --- | --- | --- |
-  | PostgreSQL sessions + enterprise | `.github/workflows/integration-postgres.yml` | push to `main`/`master` | `npm run test:postgres -w @arnilo/prism-core`; `node --test scripts/phase27-ha.test.mjs`; migration rollback/restore drill (`scripts/drill-migration-rollback.mjs`: apply → seed → downgrade 009 → compat → re-apply → checksum fail-closed, Postgres + SQLite) |
+  | PostgreSQL sessions + enterprise | `.github/workflows/integration-postgres.yml` | push to `main`/`master` | `npm run test:postgres -w @arnilo/prism-core`; `bun test --timeout=0 scripts/phase27-ha.test.mjs`; migration rollback/restore drill (`scripts/drill-migration-rollback.mjs`: apply → seed → downgrade 009 → compat → re-apply → checksum fail-closed, Postgres + SQLite) |
   | NATS events + cursor + restart | `.github/workflows/integration-nats.yml` | push to `main`/`master` | `npm run test:nats -w @arnilo/prism-core` |
   | Sandbox isolation + browser threats | `.github/workflows/sandbox-browser.yml` | push to `main`/`master` + weekly | adversarial fixtures; egress/policy legs; protected Docker matrix; native T9 (ubuntu-latest + Docker) |
-  | Office golden (packed artifacts) | `.github/workflows/integration-office.yml` | push to `main`/`master` | `node --test scripts/office-golden-packed.test.mjs` (docx/xlsx/pptx round-trips + diagrams canonicalize vs packed tarball) |
+  | Office golden (packed artifacts) | `.github/workflows/integration-office.yml` | push to `main`/`master` | `bun test --timeout=0 scripts/office-golden-packed.test.mjs` (docx/xlsx/pptx round-trips + diagrams canonicalize vs packed tarball) |
   | Live-provider canary (operator-gated) | `.github/workflows/canary-providers.yml` | nightly `0 3 * * *` + dispatch (never blocks PRs) | job summaries (per-provider status only); one issue on failure — see [provider conformance](provider-conformance.md) |
 
   **Required checks (owner action).** Branch protection is not yet configured on this repo; after the workflows land on `main`, mark these check names required on `main` (Settings → Branches → required status checks): `postgres (sessions + enterprise)`, `nats (events + cursor + restart)`, `office golden (packed artifacts)`, `protected-matrix` (sandbox/browser job id). The canary and its `report` job are deliberately not required (nightly, issue-on-failure). Verify each registered workflow with one dispatch: `gh workflow run integration-postgres.yml --ref main` (likewise `integration-nats.yml`, `integration-office.yml`); dispatch 404s until the file exists on the default branch.
@@ -279,7 +282,7 @@ Frozen by Phase 12 Task 0 in `scripts/phase12-freeze-manifest.json` (schema gate
   **Release evidence links.** At release time, link the latest green run of each workflow from the release evidence page: `https://github.com/ashiqrniloy/prism/actions/workflows/<workflow-file>`. Evidence snapshots in [0.1.0 readiness](history/0.1.0-readiness.md) and `docs/_evidence/` stay frozen at recording time; the workflow-run link is the live pointer.
 
   **Secrets inventory.** The integration jobs need no repo secrets: postgres/nats URLs are generated in-job from their service containers (`localhost`, masked via `::add-mask::`), and the office job is network-free. `sandbox-browser.yml` uses repo **variables** only (environment `sandbox-browser`): `PRISM_TEST_DOCKER_IMAGE`, `PRISM_ENABLE_PLAYWRIGHT_GATE`, `PRISM_ENABLE_OBSCURA_GATE`, `PRISM_OBSCURA_BIN`, `PRISM_ENABLE_DRAWIO_GATE`, `PRISM_TEST_DRAWIO_URL`. Only `canary-providers.yml` uses secrets — the nine provider API keys (anthropic/google/gemini/openai/opencode/openrouter/zai/kimi/neuralwatt) in the `live-canaries` environment, plus the `PRISM_CANARY_PROVIDERS` repo variable.
-- **Adding a package.** New workspace packages are picked up automatically by `npm run build --workspaces`, `npm test --workspaces`, `npm run pack:dry-run`, the packaging guard (`src/__tests__/packaging.test.ts`), and the install-smoke test (`src/__tests__/install-smoke.test.ts`) via the workspace glob; add the package to both tests' config arrays for explicit per-package assertions.
+- **Adding a package.** New workspace packages are picked up automatically by `bun run build`, `bun run test`, `bun run pack:dry-run`, the packaging guard (`src/__tests__/packaging.test.ts`), and the install-smoke test (`src/__tests__/install-smoke.test.ts`) via the workspace glob; add the package to both tests' config arrays for explicit per-package assertions.
 
 ## Security and performance notes
 
@@ -314,26 +317,26 @@ Frozen by Phase 12 Task 0 in `scripts/phase12-freeze-manifest.json` (schema gate
 - **Install smoke is offline.** The install-smoke test packs core + every package into a temp dir and installs tarballs with `--offline --no-audit --no-fund` into a fresh project. External dependencies are satisfied from the lockfile-backed npm cache prepared by `bun ci`; any attempted uncached registry fetch fails the gate.
 - **Packed-install e2e journeys (plan 012 Task 3).** `scripts/e2e-enterprise-journey.test.mjs` and `scripts/e2e-coding-journey.test.mjs` pack the first-party packages for their journey, install the exact tarballs into a fresh consumer project, and run the journey script inside that consumer — public exports only, no workspace-relative resolution (asserted per run). The **enterprise journey** composes OIDC identity → OPA policy decision (durable ledger) → agent run with durable events (memory, or real PostgreSQL when `PRISM_TEST_POSTGRES_URL` is set **and the `pg` peer is installed in that consumer**) → batched approval → OpenAPI side effect with idempotency → artifact upload + signed delivery, with policy-deny and hash-mismatch fail-closed injections. The durable leg is peer-gated and never assumed from the env alone: with `PRISM_TEST_POSTGRES_URL` ambient but `pg` unresolvable (the default, since `pg` is a peer of `@arnilo/prism-core` and the consumer installs only Prism tarballs), the fixture prints `SKIP durable postgres leg: …` and runs the memory event source instead of dying with `ERR_MODULE_NOT_FOUND`; the test reports that line as a TAP diagnostic and asserts it, so the skip can never be silent. Scope the env to the phase that needs it (`PRISM_TEST_POSTGRES_URL=… npm run test:postgres`, or `phase release:gate` in `.github/workflows/release.yml`) rather than exporting it globally. The **coding journey** composes an ACP editor session (init capability negotiation, session new + load/resume) → bounded coding tools (git-aware list/search, glob, read-before-write write, delete, move) → sandboxed process session → forge handoff with idempotent PR creation, with execution-policy and read-before-write denial paths. Each fixture asserts the installed version matches the packed manifest graph and stays within the frozen `e2eJourneyFixtureMsCeiling` (120 s in `scripts/phase12-freeze-manifest.json`).
 - **Protected restart-recovery leg (plan 012 Task 4).** `scripts/phase12-restart-recovery.test.mjs` (run by `npm run test:postgres` after the Phase 7 suite) spawns two real processes against one PostgreSQL schema: replica A runs a durable agent, suspends on a batched tool approval, appends durable events and is then SIGKILLed by the driver; replica B reconnects and resumes. Operators re-run the leg with `PRISM_TEST_POSTGRES_URL="postgresql://…" npm run test:postgres` against a disposable PostgreSQL 16 (e.g. `pgvector/pgvector:pg16`). Without the URL the gate records a named `BLOCKED GATE` failure instead of skipping. Reconnect p95 and 16-worker append contention p95 are asserted against the frozen `reconnectP95Ms` / `pointOpP95Ms` ceilings; set `PRISM_PHASE12_RECORD_EVIDENCE=1` to refresh the checked-in evidence file `scripts/phase12-restart-recovery.json`.
-- **Offline test budget.** The default `npm test` (no `PRISM_LIVE_PROVIDER_TESTS`) is pinned at **< 110s** with a measured local baseline of **~92s** (one chain sum ~92s on this host, including the Node branch-coverage audit at ~20s; the pre-audit baseline was ~72s in `docs/_evidence/phase115-suite-budget.md`). The gate stage's former 33 s critical path is split across `scripts/phase54-legacy-registry-{dry-run,apply,fail-closed}.test.mjs` so worker files overlap, and the workspace stage runs one `npm` process per package two at a time, each taking `scripts/with-build-lock.mjs --shared` (readers overlap; `tsc` keeps the exclusive lock). Every stage except the SQLite suites runs on `node --test`; the SQLite suites use `bun test --timeout=0` (the only file set the Bun 1.4.2 inventory measured `bun-ok` and faster than Node), while `npm run test:coverage` measures with `bun test --coverage` (plan 114 moved the instrument to Bun) and the PostgreSQL TAP leg stays on Node. Plan 057 retired the historical `phase11-freeze` … `phase34-freeze`/`phase30-release` gate files from the default suite (17 files, 247 tests) — they stay in the repo as immutable release evidence and remain audit-runnable standalone via `node --test scripts/<file>.test.mjs`, with their self-wiring assertions flipped to assert non-wiring so the retirement cannot silently regress. Their criteria are content-verified, not filesystem-verified (plan 071 Tasks 5 and 10): capture ordering compares the baselines' recorded `captured` dates instead of file mtimes, phase markers resolve against the live file plus the frozen lineage (the phase plan of record and `docs/history/`) so a living doc that is rewritten between releases cannot fail an audit gate (a marker set that is checked this way is declared in the gate's own manifest — `phase26-freeze-manifest.json` `lineageCheckedFiles` — so the fallback stays bounded to the files that need it), a path retired since the freeze resolves to its recorded archive instead of being hash-compared (`status: "retired"` + `retiredTo` in the baseline, with the Task 0 `sha256` kept as history), and a version literal is asserted as a *transition* (`!`-prefixed marker: the pre-cut literal must be gone) rather than an equality that the next release sweep would invalidate. Release/security gates (`release-gate`, `tooling-gate`, `budget-gate`, `phase23-quality-gates`, `phase8–11` conformance) stay in the run. The full CI `sdk:ready` gate runs on Node 24 because docs tests execute 38 `examples/*.ts` demos via native TypeScript stripping; `scripts/examples-execution.test.mjs` spawns the rest or records a manifest skip. `npm run sdk:ready` also runs typecheck, pack dry-run, and the coverage summary, so it is allowed to exceed the `npm test` budget while remaining network-free. `npm run test:coverage` additionally runs the combined coverage summary (`npm run coverage:summary`, measured ~66s local on 16 cores: core + each workspace suite once under `bun test --coverage`; the whole `test:coverage` stage is **~137s**, measured 136.8/137.1 s after plan 115 Task 6, up from ~128s under the Node instrument because the core suite is ~1.8× slower under Bun). The stage runs the core suite once and hands that run to the summary: `test:coverage` captures the first `bun test --coverage` run's output and exit code, and `coverage-summary.mjs` parses that capture for the core row instead of spawning a second ~35 s run (the standalone `coverage-summary` and a non-zero exit code still measure, so the row is never stale), which recovered ~35 s of the ~170s pre-task stage; only the `phase23-coverage` fail-closed gate rerun measures the suite again. The core gate and the per-package lines floors are the hard thresholds. The CI `sdk:ready` step has `timeout-minutes: 30` as a hang backstop; the separate Node 22 compatibility job has `timeout-minutes: 10`. The budget was raised from 30s after the default suite grew to include every first-party package, offline install smoke, packaging guards, docs examples, and workspace tests, from 60s to 80s after the plan 115 Task 2 trims (the critical-path gate file split three ways and the shared-lock concurrent workspace stage) landed the suite at 71.7/73.9 s, then to 110s after plan 120 Task 6 added the Node branch-coverage audit.
+- **Offline test budget.** The default `bun run test` (no `PRISM_LIVE_PROVIDER_TESTS`) is pinned at **< 240s** with a measured local baseline of **~200s** (one chain sum on this host; the quiet-band runs measured 156–200 s and the fastest run 156 s, recorded in `docs/_evidence/phase115-suite-budget.md` §20 — the retired Node-era pin measured ~92 s, which stopped describing the runner after plan 124 Task 2). Every stage runs the Bun binary: the root and gate suites are bounded at `--parallel=4` so the run-bundle 5 ms snapshot and the tool-search/redaction caps stop flaking under host load, the workspace stage runs `bun run --cwd <dir> test` two packages at a time with every leaf taking `scripts/with-build-lock.mjs --shared` (readers overlap; `tsc` keeps the exclusive lock), and the performance-budget stage runs `scripts/budget-gate.test.mjs` alone and single-process because its startup ratio measures host contention. The gate stage's former 33 s critical path stays split across `scripts/phase54-legacy-registry-{dry-run,apply,fail-closed}.test.mjs` so worker files overlap. `bun run test:coverage` measures with `bun test --coverage` (plan 114 moved the instrument to Bun) and the PostgreSQL leg runs `bun test` with `scripts/postgres-evidence.mjs` reading its reporter; only the branch-coverage audit keeps a Node instrument, because Bun 1.4.2 emits no branch data (plan 124 Task 4 re-measured every ceiling it asserts). Plan 057 retired the historical `phase11-freeze` … `phase34-freeze`/`phase30-release` gate files from the default suite (17 files, 247 tests) — they stay in the repo as immutable release evidence and remain audit-runnable standalone via `bun test --timeout=0 scripts/<file>.test.mjs`, with their self-wiring assertions flipped to assert non-wiring so the retirement cannot silently regress. Their criteria are content-verified, not filesystem-verified (plan 071 Tasks 5 and 10): capture ordering compares the baselines' recorded `captured` dates instead of file mtimes, phase markers resolve against the live file plus the frozen lineage (the phase plan of record and `docs/history/`) so a living doc that is rewritten between releases cannot fail an audit gate (a marker set that is checked this way is declared in the gate's own manifest — `phase26-freeze-manifest.json` `lineageCheckedFiles` — so the fallback stays bounded to the files that need it), a path retired since the freeze resolves to its recorded archive instead of being hash-compared (`status: "retired"` + `retiredTo` in the baseline, with the Task 0 `sha256` kept as history), and a version literal is asserted as a *transition* (`!`-prefixed marker: the pre-cut literal must be gone) rather than an equality that the next release sweep would invalidate. Release/security gates (`release-gate`, `tooling-gate`, `budget-gate`, `phase23-quality-gates`, `phase8–11` conformance) stay in the run. The full CI `sdk:ready` gate runs on Bun (plan 124 Task 5); docs tests execute 38 `examples/*.ts` demos and `scripts/examples-execution.test.mjs` spawns the rest or records a manifest skip, all on Bun's native TypeScript execution, which is why the examples stage is ~2.8x faster than the Node-era one. `bun run sdk:ready` also runs typecheck, pack dry-run, and the coverage summary, so it is allowed to exceed the `bun run test` budget while remaining network-free. `bun run test:coverage` additionally runs the combined coverage summary (`npm run coverage:summary`, measured ~66s local on 16 cores: core + each workspace suite once under `bun test --coverage`; the whole `test:coverage` stage is **~137s**, measured 136.8/137.1 s after plan 115 Task 6, up from ~128s under the Node instrument because the core suite is ~1.8× slower under Bun). The stage runs the core suite once and hands that run to the summary: `test:coverage` captures the first `bun test --coverage` run's output and exit code, and `coverage-summary.mjs` parses that capture for the core row instead of spawning a second ~35 s run (the standalone `coverage-summary` and a non-zero exit code still measure, so the row is never stale), which recovered ~35 s of the ~170s pre-task stage; only the `phase23-coverage` fail-closed gate rerun measures the suite again. The core gate and the per-package lines floors are the hard thresholds. The CI `sdk:ready` step has `timeout-minutes: 30` as a hang backstop; the separate Node 22 compatibility job has `timeout-minutes: 10`. The budget was raised from 30s after the default suite grew to include every first-party package, offline install smoke, packaging guards, docs examples, and workspace tests, from 60s to 80s after the plan 115 Task 2 trims (the critical-path gate file split three ways and the shared-lock concurrent workspace stage) landed the suite at 71.7/73.9 s, then to 110s after plan 120 Task 6 added the Node branch-coverage audit, and re-pinned to `< 240s` by plan 124 Task 6 when the whole suite moved to the Bun binary (measured baseline ~200 s; the Node-era 92 s describes a runner the suite no longer uses).
 
 ### GitHub Actions pipeline (0.0.27+)
 
 
-`.github/workflows/release.yml` is the single pipeline: **push to `main`** runs CI (`verify` = `npm run sdk:ready`, `node22-compat`, `postgres-integration`, `supply-chain`), **`v0.3.0` or `@arnilo/*@*` package tags** additionally run `codeql-release` and the `publish` job (deterministic `release:publish` in dependency order with provenance attestation). `security.yml` adds CodeQL/dependency-review/SBOM on push and PR; `live-canaries.yml` and `sandbox-browser.yml` are scheduled. All actions are SHA-pinned (2026-08-06 fix: CodeQL pins were invalid 404 refs and `workflow_dispatch` was missing — re-verified every pin against its upstream repo). Prerequisites outside the repo: Actions enabled in repository settings, and the `NPM_TOKEN` secret (with `id-token: write` for provenance). To re-cut a tag after a fix commit, delete and recreate it (`git push origin :v0.0.28 && git push origin v0.0.28`) so the tag creation event fires.
+`.github/workflows/release.yml` is the single pipeline: **push to `main`** runs CI (`verify` = `bun run sdk:ready`, `node22-compat`, `postgres-integration`, `supply-chain`), **`v0.3.0` or `@arnilo/*@*` package tags** additionally run `codeql-release` and the `publish` job (deterministic `release:publish` in dependency order with provenance attestation). `security.yml` adds CodeQL/dependency-review/SBOM on push and PR; `live-canaries.yml` and `sandbox-browser.yml` are scheduled. All actions are SHA-pinned (2026-08-06 fix: CodeQL pins were invalid 404 refs and `workflow_dispatch` was missing — re-verified every pin against its upstream repo). Prerequisites outside the repo: Actions enabled in repository settings, and the `NPM_TOKEN` secret (with `id-token: write` for provenance). To re-cut a tag after a fix commit, delete and recreate it (`git push origin :v0.0.28 && git push origin v0.0.28`) so the tag creation event fires.
 
 ## Formatting, linting, and coverage
 
 
-Prism uses one tool for formatting and linting — [Biome](https://biomejs.dev) — configured once at the repo root (`biome.json`) and inherited by every workspace. Coverage uses Bun's built-in test coverage (`bun test --coverage`); there is no third-party coverage service. `npm test` also runs a Node branch-coverage audit (`scripts/branch-coverage-audit.mjs`, `--test-coverage-include=dist/**`, floor **83.49** in `scripts/branch-coverage.test.mjs`); it does not replace the Bun gate, which still records `branches: null`.
+Prism uses one tool for formatting and linting — [Biome](https://biomejs.dev) — configured once at the repo root (`biome.json`) and inherited by every workspace. Coverage uses Bun's built-in test coverage (`bun test --coverage`); there is no third-party coverage service. `npm test` also runs a Node branch-coverage audit (`scripts/branch-coverage-audit.mjs`, `--test-coverage-include=dist/**`, floor **83.49** in `scripts/branch-coverage.test.mjs`); it does not replace the Bun gate, which still records `branches: null`. `npm test` also runs a Node branch-coverage audit (`scripts/branch-coverage-audit.mjs`, `--test-coverage-include=dist/**`, floor **83.49** in `scripts/branch-coverage.test.mjs`); it does not replace the Bun gate, which still records `branches: null`.
 
 | Command | What it does |
 | --- | --- |
-| `npm run lint` | `biome lint .` — fails on any lint error (warnings are non-fatal). |
-| `npm run format:check` | `biome format .` — fails if any file is unformatted. |
+| `bun run lint` | `biome lint .` — fails on any lint error (warnings are non-fatal). |
+| `bun run format:check` | `biome format .` — fails if any file is unformatted. |
 | `npm run format` | `biome format --write .` — normalizes formatting in place. |
-| `npm run test:coverage` | `bun test --coverage --timeout=0` over the core suite with the Bun-measured core floors **lines 91.48%**, **functions 92.21%** (measured 94.48 / 95.21 − 3pp; the branch floor is dropped because Bun 1.4.2 emits no branch data), then `scripts/coverage-summary.mjs` + the `phase23-coverage` gate. The first run's output and exit code are captured and handed to the summary (`PRISM_COVERAGE_CORE_*`), so the core row is parsed from the run the contributor already saw — one measurement per stage; the standalone entry point and any non-zero captured exit still measure for themselves. Scoping is `bunfig.toml` `coveragePathIgnorePatterns`: the root file for the core row, one package-local file per gated workspace. |
+| `bun run test:coverage` | `bun test --coverage --timeout=0` over the core suite with the Bun-measured core floors **lines 91.48%**, **functions 92.21%** (measured 94.48 / 95.21 − 3pp; the branch floor is dropped because Bun 1.4.2 emits no branch data), then `scripts/coverage-summary.mjs` + the `phase23-coverage` gate. The first run's output and exit code are captured and handed to the summary (`PRISM_COVERAGE_CORE_*`), so the core row is parsed from the run the contributor already saw — one measurement per stage; the standalone entry point and any non-zero captured exit still measure for themselves. Scoping is `bunfig.toml` `coveragePathIgnorePatterns`: the root file for the core row, one package-local file per gated workspace. |
 
-All four gates run inside `npm run sdk:ready` (after `typecheck`, before `pack:dry-run`). A few rules are disabled in `biome.json` because they are false positives for this codebase: `noControlCharactersInRegex` and `noAssignInExpressions` (security/redaction code intentionally matches control characters and uses `while ((m = re.exec(…)))` loops), `noShadowRestrictedNames`, `noThenProperty` (the workflow DSL has a legitimate `then` branch field), `noExplicitAny`, `noVoidTypeReturn`, and `useYield`. Raise coverage floors only by re-measuring: the core floors live in `scripts/coverage-thresholds.json` `core` and the per-package rows in the same file; `package.json` carries no numeric threshold.
+All four gates run inside `bun run sdk:ready` (after `typecheck`, before `pack:dry-run`). A few rules are disabled in `biome.json` because they are false positives for this codebase: `noControlCharactersInRegex` and `noAssignInExpressions` (security/redaction code intentionally matches control characters and uses `while ((m = re.exec(…)))` loops), `noShadowRestrictedNames`, `noThenProperty` (the workflow DSL has a legitimate `then` branch field), `noExplicitAny`, `noVoidTypeReturn`, and `useYield`. Raise coverage floors only by re-measuring: the core floors live in `scripts/coverage-thresholds.json` `core` and the per-package rows in the same file; `package.json` carries no numeric threshold.
 
 ### Coverage denominators and per-package thresholds
 
@@ -355,7 +358,7 @@ A new workspace package must add an evidence-based threshold entry (or a `protec
 ### Release evidence and protected skips
 
 
-`npm run release:evidence` (run automatically at the start of `npm run release:gate`, and therefore at the end of `npm run sdk:ready`) aggregates every test surface into `scripts/release-evidence.json` — the machine-auditable release skip manifest. It records env var **names only, never values** (the manifest is retained and uploaded by CI).
+`npm run release:evidence` (run automatically at the start of `bun run release:gate`, and therefore at the end of `bun run sdk:ready`) aggregates every test surface into `scripts/release-evidence.json` — the machine-auditable release skip manifest. It records env var **names only, never values** (the manifest is retained and uploaded by CI).
 
 | State | Meaning | Gate effect |
 | --- | --- | --- |
@@ -364,7 +367,7 @@ A new workspace package must add an evidence-based threshold entry (or a `protec
 | `protected` | a documented, permitted gap with a reason (+ required env where applicable) | pass, always visible |
 | `blocked` | a required release surface cannot be attested (required env absent, or evidence missing) | **fail closed** — `release.mjs gate` refuses to release |
 
-Surfaces: core `npm test` (counts and the skip total come from the latest `phase*-baseline.json` `exitGate.counts` — currently 33 protected/live skips, a frozen floor), `security:threat-suites`, every workspace suite (evidence from `scripts/coverage-summary.json` of the same run; `protectedException` packages are named with their reason), `test:postgres` durable conformance (**required**: `PRISM_TEST_POSTGRES_URL` must be set when `release:gate` runs, and gitignored `scripts/postgres-evidence.json` must be written by a successful `npm run test:postgres` at the current `git rev-parse HEAD`; a phase baseline or stale evidence is blocked. The wrapper records only `gitHead`, capture time, and TAP counts — never a DSN. The release workflow's verify job declares the env on the `release:gate` phase only, so it never leaks into env-gated docs demos / durable integration suites of `npm test`; the `postgres-integration` job runs the suite against a real server; a local release must set it too), `test:nats` real JetStream legs (protected, 0.3.0), the `PRISM_LIVE_PROVIDER_TESTS` provider legs (protected, per package), and the four live canaries from `scripts/live-canary.mjs` (provider/MCP/A2A/web; run by the scheduled `live-canaries` workflow with real credentials — recorded `protected`, never `pass`). The manifest cross-references the latest baseline's `exitGate`/`protectedEvidence` so per-phase records stay the source of truth.
+Surfaces: core `bun run test` (counts and the skip total come from the latest `phase*-baseline.json` `exitGate.counts` — currently 33 protected/live skips, a frozen floor), `security:threat-suites`, every workspace suite (evidence from `scripts/coverage-summary.json` of the same run; `protectedException` packages are named with their reason), `test:postgres` durable conformance (**required**: `PRISM_TEST_POSTGRES_URL` must be set when `release:gate` runs, and gitignored `scripts/postgres-evidence.json` must be written by a successful `bun run test:postgres` at the current `git rev-parse HEAD`; a phase baseline or stale evidence is blocked. The wrapper records only `gitHead`, capture time, and reporter counts — never a DSN. The release workflow's verify job declares the env on the `release:gate` phase only, so it never leaks into env-gated docs demos / durable integration suites of `npm test`; the `postgres-integration` job runs the suite against a real server; a local release must set it too), `test:nats` real JetStream legs (protected, 0.3.0), the `PRISM_LIVE_PROVIDER_TESTS` provider legs (protected, per package), and the four live canaries from `scripts/live-canary.mjs` (provider/MCP/A2A/web; run by the scheduled `live-canaries` workflow with real credentials — recorded `protected`, never `pass`). The manifest cross-references the latest baseline's `exitGate`/`protectedEvidence` so per-phase records stay the source of truth.
 
 Override `PRISM_RELEASE_EVIDENCE` to redirect the manifest (used by the gate regression). The manifest is gitignored and CI-retained (`release-evidence` artifact). A release cannot ship with a required env absent and unexplained — the operator sees every blocked surface in the retained manifest.
 
@@ -374,12 +377,12 @@ Protected legs fail closed through one convention (`scripts/blocked-gate.mjs`):
 BLOCKED GATE <id> requires=<names> evidence=<surface> hint=<how to unblock>
 ```
 
-`node scripts/blocked-gate.mjs` audits the same registry — which protected legs cannot run with the current environment, which of them a release profile owns (their evidence surface decides the gate), and which are documented gaps that never block. `scripts/blocked-gate.test.mjs` (in-chain) asserts the registry, the record shape, and the fail-closed exits; `scripts/phase27-freeze-manifest.json` freezes the record template.
+`bun scripts/blocked-gate.mjs` audits the same registry — which protected legs cannot run with the current environment, which of them a release profile owns (their evidence surface decides the gate), and which are documented gaps that never block. `scripts/blocked-gate.test.mjs` (in-chain) asserts the registry, the record shape, and the fail-closed exits; `scripts/phase27-freeze-manifest.json` freezes the record template.
 
 ### Quality-gate reports and the Biome baseline
 
 
-`npm run lint` runs Biome 2.x with the canonical config (`linter.rules.preset: "recommended"` — the deprecated `recommended: true` key is gone; `npx biome migrate --write` performs the rewrite) and writes a machine-readable SARIF report to `scripts/lint-report.sarif` in the same run (stable `--reporter=sarif`; the experimental `--reporter=json` schema is not used). The repo target is **zero** lint diagnostics; every remaining intentional diagnostic carries a justified `biome-ignore lint/<rule>: reason` comment (shell-interpolated strings, verbatim upstream fixtures, and literal grep targets in tests). Unused-code diagnostics are auto-fixed by `biome lint --write --unsafe .`; public-but-unused exports are never removed by Biome — they route to the unused-code sweep.
+`bun run lint` runs Biome 2.x with the canonical config (`linter.rules.preset: "recommended"` — the deprecated `recommended: true` key is gone; `bunx biome migrate --write` performs the rewrite) and writes a machine-readable SARIF report to `scripts/lint-report.sarif` in the same run (stable `--reporter=sarif`; the experimental `--reporter=json` schema is not used). The repo target is **zero** lint diagnostics; every remaining intentional diagnostic carries a justified `biome-ignore lint/<rule>: reason` comment (shell-interpolated strings, verbatim upstream fixtures, and literal grep targets in tests). Unused-code diagnostics are auto-fixed by `biome lint --write --unsafe .`; public-but-unused exports are never removed by Biome — they route to the unused-code sweep.
 
 `npm run sweep:unused` (also part of `npm test`) runs the tsc `--noUnusedLocals/--noUnusedParameters` sweep across the core and every workspace tsconfig and writes both `scripts/unused-sweep-report.txt` (human) and `scripts/unused-report.json` (`--json`, machine-readable: per-tsconfig counts + the dead-export scan). It stays non-blocking by design. Both reports are gitignored and CI-retained (`quality-gate-reports` artifact, 30 days).
 
@@ -388,7 +391,7 @@ Timing assertions in tests follow a deterministic-barrier policy: racy wall-cloc
 ## Build serialization
 
 
-`dist/` is compiled by `tsc` in many small writes, so a concurrent build and test in the same working tree could race — a test importing `@arnilo/prism` mid-emit could observe a partially-written module (reproduced during the 0.2.3 review). Emit-producing leaves (`tsc` builds) and dist-consuming test leaves (`node --test dist/__tests__/*.test.js`) are therefore serialized through a dependency-free lock: `node scripts/with-build-lock.mjs <command>` acquires an `O_EXCL` lockfile at `node_modules/.prism-build.lock` (contents: holder `pid` + timestamp, no secrets), waits with a 100ms backoff, and fails closed — never proceeding without the lock. A stale lock whose holder PID is dead is reclaimed; a live lock is never stolen. Acquisition is leaf-only (never the `npm test`/`sdk:ready` orchestrators), so nested `npm run build` children cannot deadlock.
+`dist/` is compiled by `tsc` in many small writes, so a concurrent build and test in the same working tree could race — a test importing `@arnilo/prism` mid-emit could observe a partially-written module (reproduced during the 0.2.3 review). Emit-producing leaves (`tsc` builds) and dist-consuming test leaves (`bun test dist/__tests__/*.test.js`) are therefore serialized through a dependency-free lock: `node scripts/with-build-lock.mjs <command>` acquires an `O_EXCL` lockfile at `node_modules/.prism-build.lock` (contents: holder `pid` + timestamp, no secrets), waits with a 100ms backoff, and fails closed — never proceeding without the lock. A stale lock whose holder PID is dead is reclaimed; a live lock is never stolen. Acquisition is leaf-only (never the `npm test`/`sdk:ready` orchestrators), so nested `npm run build` children cannot deadlock.
 
 | Fact | Value |
 | --- | --- |
@@ -396,7 +399,7 @@ Timing assertions in tests follow a deterministic-barrier policy: racy wall-cloc
 | Timeout | 120s default; override with `PRISM_BUILD_LOCK_TIMEOUT_MS` |
 | Retry | 100ms backoff; stale-PID reclaim via `process.kill(pid, 0)` |
 | Fail-closed | acquisition error or timeout exits non-zero, nothing runs |
-| Wrapped | `build:core`, every workspace `build`, the `node --test` runs in `test`/workspace tests, the `bun test --coverage` run in `test:coverage`, `coverage-summary.mjs`, the script-gate `node --test` run (the `phase*-conformance`/`phase*-security` gates import `@arnilo/prism` from `dist`) |
+| Wrapped | `build:core`, every workspace `build`, the `bun test` runs in `test`/workspace tests, the `bun test --coverage` run in `test:coverage`, `coverage-summary.mjs`, the script-gate `bun test` run (the `phase*-conformance`/`phase*-security` gates import `@arnilo/prism` from `dist`) |
 | Not wrapped | `npm run clean` (standalone), `tsc -p examples --noEmit` and workspace `typecheck` (read `dist` `.d.ts`; within any single script the build completes before reads, so only a concurrent external emitter can cause a spurious typecheck error), `scripts/phase23-build-race.test.mjs` (the lock's own regression — it runs unwrapped so its children acquire the real lock) |
 
 Directly invoking `tsc` instead of `npm run build` bypasses the lock — use the npm scripts when another build/test could be running in the same tree (CI runs them sequentially).
@@ -404,20 +407,19 @@ Directly invoking `tsc` instead of `npm run build` bypasses the lock — use the
 ## Dependency major-upgrade isolation
 
 
-Major dependency upgrades are **isolated, compatibility-tested changes — never bundled into a feature release.** A major bump (TypeScript, `@types/node`, `diff`, or any third-party runtime dependency and its successors) ships as its own commit/PR that runs `npm run sdk:ready` plus packed-install evidence, and is reviewed separately from feature work. Release commits contain no unreviewed major bumps.
+Major dependency upgrades are **isolated, compatibility-tested changes — never bundled into a feature release.** A major bump (TypeScript, `@types/node`, `diff`, or any third-party runtime dependency and its successors) ships as its own commit/PR that runs `bun run sdk:ready` plus packed-install evidence, and is reviewed separately from feature work. Release commits contain no unreviewed major bumps.
 
 **Current third-party upgrade surface** (internal `@arnilo/prism-*` ranges are version-managed by the release tooling, not dependency upgrades; the core `@arnilo/prism` package has **zero** runtime dependencies, asserted by `core-boundaries.test.ts`):
 
-Development type packages track the **declared** engines floor, not the machine that builds them: `@types/node` stays on the oldest supported Node line (`^22.20.0` while `engines.node` is `>=22`), so an API that the floor cannot provide fails the build instead of compiling clean against a newer type surface. Raising the floor is a support-matrix change (freeze manifest + CI legs + `docs/migration.md`), never a side effect of bumping the types package.
+Development type packages track the **declared** engines floor: `@types/node` stays on the 0.x Node floor (`^22.20.0`, the `engines.node >=22` every published 0.11.x tarball declares — the live manifests declare `engines.bun` and Node runtime support retired in 0.12.0, but the registry line a Node host can still install targets Node), so an API that floor cannot provide fails the build instead of compiling clean against a newer type surface. Moving it is a support-matrix change (freeze manifest + `docs/migration.md`), never a side effect of bumping the types package.
 
 | Dependency | Range | Resolved (lockfile) | Used by |
 | --- | --- | --- | --- |
 | `typescript` (dev) | `^7.0.2` | 7.0.2 | root build |
-| `@types/node` (dev) | `^22.20.0` | 22.20.2 | root build (pinned to the `engines.node` floor) |
+| `@types/node` (dev) | `^22.20.0` | 22.20.2 | root build (pinned to the retired 0.x `engines.node` floor; the live manifests declare `engines.bun`) |
 | `@biomejs/biome` (dev) | `^2.5.13` | 2.5.13 | lint/format |
 | `diff` | `^9.0.0` | 9.0.0 | `@arnilo/prism-coding-tools/agent` |
 | `pg` | `^8.23.0` | 8.23.0 | `@arnilo/prism-memory`, `@arnilo/prism-core/sessions/postgres` |
-| `better-sqlite3` | `^13.0.3` | 13.0.3 | `@arnilo/prism-core/sessions/sqlite` |
 | `ajv` | `^8.17.1` | 8.20.0 | `@arnilo/prism-core/validation/json-schema` |
 | `zod` | `^4.6.2` | 4.6.2 | `@arnilo/prism-mcp` |
 | `@napi-rs/keyring` | `^1.3.0` | 1.3.0 | `@arnilo/prism-core/credentials/node` |
@@ -430,41 +432,45 @@ Development type packages track the **declared** engines floor, not the machine
 
 | Leg | Node | Result |
 | --- | --- | --- |
-| Full SDK readiness (`npm run sdk:ready`: typecheck, lint, format, test, coverage, pack, release:gate) | 24.18.0 (current) | ✅ green — 1312/1312 tests, lint 0 errors, format clean, coverage 64/72/79 vs 60/70/75 thresholds. |
+| Full SDK readiness (`bun run sdk:ready`: typecheck, lint, format, test, coverage, pack, release:gate) | 24.18.0 (current) | ✅ green — 1312/1312 tests, lint 0 errors, format clean, coverage 64/72/79 vs 60/70/75 thresholds. |
 | Build toolchain (`tsc` 7.0.2, `biome` 2.5.13) | 20.20.2 (LTS iron) | ✅ both run under Node 20. |
 | Public surface import smoke (all 21 root `exports` default targets) | 20.20.2 | ✅ all import cleanly. |
 | Full core test suite | 20.20.2 | 1311/1312 — the single failure is `examples_demos_run_to_completion_and_emit_no_secret`, which executes `examples/*.ts` via Node's native TypeScript stripping (Node 22.6+). This is a test-harness capability, not an SDK runtime incompatibility, and is exactly why CI scopes Node 20 to build + import smoke. |
 
-**CI enforcement** (`.github/workflows/release.yml`): the `verify` job runs `npm run sdk:ready` on Node 24; `node22-compat` runs `bun ci`, `npm run build`, and the public-import smoke on Node 22; `supply-chain` runs `bun audit --audit-level=moderate`, SPDX/license checks, SBOM, and source-secret scans; `publish` `needs:` all of `verify`, `node22-compat`, `postgres-integration`, `codeql-release`, and `supply-chain`, so nothing publishes unless every leg — including the audit/SBOM gates — passes.
+**CI enforcement** (`.github/workflows/release.yml`): the `verify` job runs `bun run sdk:ready` on Node 24; `node22-compat` runs `bun ci`, `npm run build`, and the public-import smoke on Node 22; `supply-chain` runs `bun audit --audit-level=moderate`, SPDX/license checks, SBOM, and source-secret scans; `publish` `needs:` all of `verify`, `node22-compat`, `postgres-integration`, `codeql-release`, and `supply-chain`, so nothing publishes unless every leg — including the audit/SBOM gates — passes.
 
-**Process for a major-upgrade PR:** (1) bump exactly one dependency major in its own branch; (2) `npm run sdk:ready` green; (3) packed-install evidence (`npm run pack:dry-run`, or a scratch `npm install <tarball>` import smoke for native deps like `better-sqlite3`); (4) review lockfile churn line-by-line; (5) the `supply-chain` job supplies audit/SBOM; (6) confirm no build-time regression beyond measured noise on the matrix above; (7) merge separately from any feature work.
+**Process for a major-upgrade PR:** (1) bump exactly one dependency major in its own branch; (2) `bun run sdk:ready` green; (3) packed-install evidence (`bun run pack:dry-run`, or a scratch `bun add <tarball>` import smoke for native or WASM dependencies); (4) review lockfile churn line-by-line; (5) the `supply-chain` job supplies audit/SBOM; (6) confirm no build-time regression beyond measured noise on the matrix above; (7) merge separately from any feature work.
 
 ## Release checklist
 
 
-Every release gate maps to an exact enforcement test or command, so the checklist is executable rather than manual. Run `npm run sdk:ready` for the full local SDK readiness gate: `npm run typecheck`, `npm run lint`, `npm run format:check`, network-free `npm test`, `npm run test:coverage`, `npm run pack:dry-run`, and `npm run release:gate`. `npm run release:dry-run` is an alias for the same gate. The GitHub Actions `verify` job runs `bun ci` and `npm run sdk:ready` on Node 24; `node22-compat` runs `bun ci`, `npm run build`, and public export imports on Node 22; `postgres-integration` runs the opt-in PostgreSQL adapter suite against a CI Postgres service. Contributor installs use Bun: the committed lockfile is `bun.lock` (JSONC-shaped, read by `scripts/bun-lock.mjs`), `bun ci` is the frozen CI install, and `package-lock.json` is retired; `npm pack` and `npm publish` remain the publish path.
+Every release gate maps to an exact enforcement test or command, so the checklist is executable rather than manual. Run `bun run sdk:ready` for the full local SDK readiness gate: `bun run typecheck`, `bun run lint`, `bun run format:check`, network-free `npm test`, `bun run test:coverage`, `bun run pack:dry-run`, and `bun run release:gate`. `bun run release:dry-run` is an alias for the same gate. The GitHub Actions `verify` job runs `bun ci` and `bun run sdk:ready` on Node 24; `node22-compat` runs `bun ci`, `npm run build`, and public export imports on Node 22; `postgres-integration` runs the opt-in PostgreSQL adapter suite against a CI Postgres service. Contributor installs use Bun: the committed lockfile is `bun.lock` (JSONC-shaped, read by `scripts/bun-lock.mjs`), `bun ci` is the frozen CI install, and `package-lock.json` is retired; `npm pack` and `npm publish` remain the publish path on the release host, which ships its own Node. **Node is not on the contributor path** (plan 124): every local and CI step is the Bun binary, and the only Node steps left in CI are the two declared support legs in this table. Whether *consumers* of the published packages still need Node is the runtime contract plan 125 owns — this page keeps the current `engines.node >=22` declaration until that plan lands.
 
 | Gate | Enforcement |
 | --- | --- |
 | Docs coverage for persistence/runtime/migration surfaces | `docs.test.ts` enrolls every API page in `apiPages` (heading + index-link + bare-specifier + secret-scan checks); dedicated section assertions pin `database-persistence.md`, `runs-and-usage.md`, `session-stores-and-branching.md`, `migration.md`, `agent-definitions.md`, `performance.md`, and the Phase 41 `external_app_example_*` / `phase41_external_app_surfaces_*` gates. |
-| Package exports/subpaths resolve to built output | `public-export-contract.test.ts` asserts every `exports`/`main`/`types`/`bin` target resolves to a built file under `dist/` with a sibling `.d.ts` (`dist/index.js` + `dist/index.d.ts` for a root package), and no target escapes `dist/` (no `src/` or `examples/` leak). CI `node22-compat` also imports every public root `exports` default target on Node 22. |
+| Package exports/subpaths resolve to built output | `public-export-contract.test.ts` asserts every `exports`/`main`/`types`/`bin` target resolves to a built file under `dist/` with a sibling `.d.ts` (`dist/index.js` + `dist/index.d.ts` for a root package), and no target escapes `dist/` (no `src/` or `examples/` leak). The packed-consumer sweep imports every public subpath of every package on Bun (`scripts/packaging-current.test.mjs`, plan 125 Task 2) — the Bun successor to the retired Node import smoke. |
 | Public-API drift | `public-export-contract.test.ts` `phase39_public_protocol_exports_and_types_do_not_drift` pins the runtime protocol (`providerToolCallDelta`, `ToolCallDeltaContent`), the `/testing/provider-conformance` subpath shape, and the observational-memory runtime `.d.ts` surface. |
 | Root SDK export surface freeze | `public-export-contract.test.ts` `root export surface is frozen` snapshots every value and type export of `src/index.ts` (107 value + 69 type) so any add/remove is a deliberate test update; `every frozen value export resolves at runtime` rebuilds `dist/index.js` and asserts each value export is present (catches build drift), and `every frozen type export appears in the built type declarations` asserts each type export is in `dist/index.d.ts`. |
-| Examples compile and are listed; runnable demos execute | `npm run typecheck` runs `tsc -p examples --noEmit`; `docs.test.ts` checks every `examples/*.ts` file is listed in `examples/README.md`, then runs demos offline and scans output for secrets. |
+| Examples compile and are listed; runnable demos execute | `bun run typecheck` runs `tsc -p examples --noEmit`; `docs.test.ts` checks every `examples/*.ts` file is listed in `examples/README.md`, then runs demos offline and scans output for secrets. |
 | Examples run to completion with no secret leakage | `docs.test.ts` `examples_demos_run_to_completion_and_emit_no_secret` runs each demo (Node strips TypeScript types natively) with exit-0 and real-secret scans; `external_app_example_*` pins the DB-backed adapter reference exercising the `RunLedger`, branch-handle checkout, fork, and prior-run resume. |
-| Tarball excludes built tests, source maps, and source | `packaging.test.ts` rejects `dist/__tests__/`, `*.map`, `src/`, `plans/`, and internal files; confirms every package ships README/changelog (and code packages ship LICENSE), core ships docs + CLI, and every export target exists. Profile manifests (`prism-base`/`prism-code`/`prism-sdk`/`prism-all`) are retired; hosts install explicit family packages. `@arnilo/prism-work` ships isolated `/connectors`, `/documents`, `/sheets`, `/diagrams`, and `/document-reader` subpaths. |
+| Tarball excludes built tests, source maps, and source | `packaging.test.ts` rejects `dist/__tests__/`, `*.map`, `src/`, `plans/`, and internal files; confirms every package ships README/changelog (and code packages ship LICENSE), core ships docs + CLI, and every export target exists. Profile manifests (`prism-base`/`prism-code`/`prism-sdk`/`prism-all`) are retired; hosts install explicit family packages. `@arnilo/prism-work` ships isolated `/connectors`, `/documents`, `/sheets`, `/diagrams`, `/document-extraction`, and `/document-reader` subpaths. |
 | NeuralWatt package/docs/examples release gate | `packaging.test.ts` pins `@arnilo/prism-providers/neuralwatt` package exports/type declarations and `@arnilo/prism-providers` family membership; `docs.test.ts` asserts `docs/index.md` links `providers/neuralwatt.md` and `provider-caching.md`, and that `examples/cache-aware-prompt-assembly.ts` plus `examples/neuralwatt-agent-run.ts` exist and are listed. |
 | Enterprise PostgreSQL package/docs/example gate | Packaging/install/public-contract tests include `@arnilo/prism-core/enterprise/postgres`; `docs.test.ts` pins its API page, four-store migration/ownership/unknown-outcome/async-router guidance, and `examples/enterprise-postgres-state.ts`; `npm run test:postgres` exercises migration, restart, contention, and cleanup with an explicit database URL. |
 | Version graph and resumable publication | `release.test.ts` covers exact package/lock/range validation, topological order, registry collisions, dry-run, interrupted reports/resume, clean tagged git state, provenance/public/tag arguments, and token-safe errors. `release:check` and `release:publish` derive the workspace graph without a manual package list. |
 | Freeze-test current-side package presence | `workspacePackageCounts()` (`scripts/package-truth.mjs`) counts every `packages/*` directory with a manifest. A new workspace package is counted, and the frozen expected side fails until one regen. |
+| Freeze-test current-side package presence | `workspacePackageCounts()` (`scripts/package-truth.mjs`) counts every `packages/*` directory with a manifest. A new workspace package is counted, and the frozen expected side fails until one regen. |
 | Release version claims have one source | `currentVersion()` (`scripts/package-truth.mjs`) reads the root manifest, and `scripts/version-literal-gate.test.mjs` fails when any surface that claims the release version disagrees with it: all 12 manifests, every internal `@arnilo/*` caret range, `bun.lock`, the `src/index.ts` version constant, the `docs/index.md` current-line banner, the `release.yml` tag list, and the generated `scripts/package-truth.json`. Each stale surface is named in one pre-flight (with a positive control for a half-finished cut), and the release-line suites (`packaging.test.ts`, `docs.test.ts`, `release.test.ts`, `phase24-truth`, `phase34-freeze`) derive their expectations from the manifest instead of pinning the cut. |
 | Pre-publish compatibility gates | `release:gate` (in `sdk:ready`) fails on removed/changed `.d.ts` exports vs `scripts/compat-baseline/` (unless `--allow-break` + migration note), version-range/lockfile drift, and tarball deny-list violations (`plans/`, `code-reviews/`, `docs/review-coverage-*`, `*.map`, `__tests__/`); unit-tested in `scripts/release-gate.test.mjs`. |
 | Legacy registry markers (plan 054 Task 7) | `scripts/phase54-legacy-registry.mjs --dry-run` verifies every retired name's final published version exists and `latest` is unchanged, and that each deprecation URL anchor exists in `docs/migrate-to-0.4.md`, without mutating the registry; `--apply --confirm` pre-flights all 54 entries and fails closed (zero mutations) on any mismatch, then idempotently adds the `legacy` dist-tag and `<0.4.0` deprecation warning (already-correct entries skipped; per-entry status in `release-artifacts/legacy-registry-plan.json` for safe resume). `packaging.test.ts` asserts the generated plan covers all 54 retired names with uniform messages and valid guide anchors; the offline fixture suite `scripts/phase54-legacy-registry-{dry-run,apply,fail-closed}.test.mjs` proves the dry-run/apply/resume behavior without network or tokens. |
-| Formatting, linting, and coverage thresholds | `npm run lint` and `npm run format:check` run Biome (single root `biome.json`, workspaces inherit) and fail on any lint error or unformatted file; `npm run test:coverage` uses Bun's built-in `bun test --coverage` with Bun-measured floors (core lines 91.48 / functions 92.21; per-package lines rows in `scripts/coverage-thresholds.json`; no branch floor — Bun 1.4.2 emits no branch data) and no third-party service. All three run inside `sdk:ready`. |
+| Release-host registry toolchain | `npm pack`/`npm publish`/`npm sbom` stay on the release host: runner images ship Node, `bun pack` does not exist, and `bun publish` has no `--provenance` on 1.4.2 (plan 125 Task 5). Everything else — install, build, test, audit (`bun audit`), coverage, pack dry-run — is Bun; contributors never invoke npm. |
+| Release-host registry toolchain | `npm pack`/`npm publish`/`npm sbom` stay on the release host: runner images ship Node, `bun pack` does not exist, and `bun publish` has no `--provenance` on 1.4.2 (plan 125 Task 5). Everything else — install, build, test, audit (`bun audit`), coverage, pack dry-run — is Bun; contributors never invoke npm. |
+| Release-host registry toolchain | `npm pack`/`npm publish`/`npm sbom` stay on the release host: runner images ship Node, `bun pack` does not exist, and `bun publish` has no `--provenance` on 1.4.2 (plan 125 Task 5). Everything else — install, build, test, audit (`bun audit`), coverage, pack dry-run — is Bun; contributors never invoke npm. |
+| Formatting, linting, and coverage thresholds | `bun run lint` and `bun run format:check` run Biome (single root `biome.json`, workspaces inherit) and fail on any lint error or unformatted file; `bun run test:coverage` uses Bun's built-in `bun test --coverage` with Bun-measured floors (core lines 91.48 / functions 92.21; per-package lines rows in `scripts/coverage-thresholds.json`; no branch floor — Bun 1.4.2 emits no branch data) and no third-party service. All three run inside `sdk:ready`. |
 | Supply-chain and live-canary policy | `supply-chain-security.test.ts` verifies SPDX allow/deny behavior, bounded source/artifact secret detection, credential-free canary reports, timeout/redacted failures, immutable action revisions, no `pull_request_target`, protected live environment, attestation paths, and publish dependency on `supply-chain`; CI adds CodeQL and PR dependency review. |
-| Release secret scan covers the tracked release set | `scripts/phase27-release.test.mjs` enumerates `git ls-files` (plus built `packages/prism-core/dist` when present) and passes that explicit list to the unchanged `scanSecrets` — the same tracked set CI scans (`git ls-files -z \| xargs -0 node scripts/scan-secrets.mjs` in `release.yml`/`security.yml`), so no untracked or gitignored working-tree file can fail the gate or mask a tracked finding; a bare `node scripts/scan-secrets.mjs <path>` still walks everything for pre-commit use except the two local-only credential names `.gitignore` already excludes (`scripts/live.env`, `*.local.env`), and the gate reports the mode, file count, and untracked-but-unignored findings as a note without failing on them. |
+| Release secret scan covers the tracked release set | `scripts/phase27-release.test.mjs` enumerates `git ls-files` (plus built `packages/prism-core/dist` when present) and passes that explicit list to the unchanged `scanSecrets` — the same tracked set CI scans (`git ls-files -z \| xargs -0 bun scripts/scan-secrets.mjs` in `release.yml`/`security.yml`), so no untracked or gitignored working-tree file can fail the gate or mask a tracked finding; a bare `bun scripts/scan-secrets.mjs <path>` still walks everything for pre-commit use except the two local-only credential names `.gitignore` already excludes (`scripts/live.env`, `*.local.env`), and the gate reports the mode, file count, and untracked-but-unignored findings as a note without failing on them. |
 | Workflow and script references resolve | `scripts/workflow-liveness.test.mjs` resolves every `-w <pkg>` / `--workspace <pkg>` target in `.github/workflows/*.yml` against the live workspace inventory and every named npm script against that package's manifest (root scripts included for a bare `npm run x`), resolves every `@arnilo/*` specifier in `scripts/**/*.mjs` against the live package and its `exports` subpaths, and rejects any `uses:` reference that is not a full 40-hex commit SHA — the drift class that left `sandbox-browser.yml` building four retired packages, `scripts/fixtures/phase26-coding-journey.mjs` packing `packages/coding-agent`/`-security` and `scripts/benchmark-scenarios/phase11-auth.mjs` importing `@arnilo/prism-openapi-tools`/`-server` after plan 054 folded them, with a positive control for each. |
-| Network-free + offline test budget | `network-free-guard.test.ts` keeps the default suite network-free; budget pinned `< 110s` (measured baseline above). Install-smoke is offline (`--offline --no-audit --no-fund`, zero registry fetches). |
+| Network-free + offline test budget | `network-free-guard.test.ts` keeps the default suite network-free; budget pinned `< 240s` (measured baseline above). Install-smoke is offline (`--offline --no-audit --no-fund`, zero registry fetches). |
 | Core security invariants reaffirmed | Runtime/docs tests hold the trust boundary: **no built-in app tools** (hosts register tools; the core ships only the mock provider and contract helpers), **no hidden provider/credential globals** (providers/credentials are host-owned `AgentConfig` fields, resolved via explicit `providerSource`/`CredentialResolver`), **no auto package discovery** (provider/tool/skill packages are opt-in and individually installed; contribution discovery is realpath-contained and emits inert envelopes the host registers), and **no secret persistence in core** (redaction applies before any `RunLedger`/`SessionStore` append; the ledger gate asserts each message event is written exactly once and redacted). |
 
 A change that adds a public persistence/runtime surface, a new package, or a new example must extend the matching row's enforcement (add the page to `apiPages`, the package to the `packages` array, or the example to the demos list) so the checklist stays self-maintaining.
@@ -476,13 +482,13 @@ A change that adds a public persistence/runtime surface, a new package, or a new
 
 | Action | Command |
 | --- | --- |
-| List packages changed since a baseline tag | `node scripts/release.mjs changed [--baseline <tag>]` |
-| Bump one package (patch/minor/major) | `node scripts/release.mjs bump --package @arnilo/<name> --type patch` |
-| Validate current/mixed versions | `node scripts/release.mjs check --allow-dirty --allow-untagged` |
-| Validate the final lockstep cut | `node scripts/release.mjs check --lockstep --version 0.3.0 --allow-dirty --allow-untagged` |
-| Dry-run independent publish | `node scripts/release.mjs publish --dry-run --allow-dirty --allow-untagged` |
-| Resume interrupted package-tag publish | `node scripts/release.mjs publish --resume --report release-artifacts/publish-report.json` |
-| Convert the final cut to caret ranges | `node scripts/release.mjs bump --ranges caret --from 0.3.0 --to 0.3.0` |
+| List packages changed since a baseline tag | `bun scripts/release.mjs changed [--baseline <tag>]` |
+| Bump one package (patch/minor/major) | `bun scripts/release.mjs bump --package @arnilo/<name> --type patch` |
+| Validate current/mixed versions | `bun scripts/release.mjs check --allow-dirty --allow-untagged` |
+| Validate the final lockstep cut | `bun scripts/release.mjs check --lockstep --version 0.3.0 --allow-dirty --allow-untagged` |
+| Dry-run independent publish | `bun scripts/release.mjs publish --dry-run --allow-dirty --allow-untagged` |
+| Resume interrupted package-tag publish | `bun scripts/release.mjs publish --resume --report release-artifacts/publish-report.json` |
+| Convert the final cut to caret ranges | `bun scripts/release.mjs bump --ranges caret --from 0.3.0 --to 0.3.0` |
 
 **Independent validate rules** (`validateReleaseIndependent`):
 
@@ -498,10 +504,10 @@ No Changesets. No new runtime dependency. The 0.x caret window (`^0.3.0` = `>=0.
 ## Pre-publish compatibility gates (`release:gate`)
 
 
-`npm run release:gate` (also run inside `npm run sdk:ready`) is the offline gate that must pass before `release:check`/`release:publish`. It runs three stages over the exact version graph; independent mode reads local git history for changed-package validation but never contacts the registry:
+`bun run release:gate` (also run inside `bun run sdk:ready`) is the offline gate that must pass before `release:check`/`release:publish`. It runs three stages over the exact version graph; independent mode reads local git history for changed-package validation but never contacts the registry:
 
 - **ranges**: reuses `validateReleaseIndependent` by default, or `validateRelease` for explicit `--lockstep --version 0.3.0`; both verify internal ranges and lockfile entries.
-- **compat**: diffs every package's packed `.d.ts` surface (exported names + normalized declaration signatures, `export *` resolved within the package) against `scripts/compat-baseline/<pkg>.txt`. Removed or changed exports fail unless `--allow-break` is passed **and** `docs/migration.md` mentions the target version. Manifest-only profiles (no `main`/`types`/`exports`) are skipped. Regenerate baselines after a deliberate reviewed change with `node scripts/release.mjs gate --update-baseline`.
+- **compat**: diffs every package's packed `.d.ts` surface (exported names + normalized declaration signatures, `export *` resolved within the package) against `scripts/compat-baseline/<pkg>.txt`. Removed or changed exports fail unless `--allow-break` is passed **and** `docs/migration.md` mentions the target version. Manifest-only profiles (no `main`/`types`/`exports`) are skipped. Regenerate baselines after a deliberate reviewed change with `bun scripts/release.mjs gate --update-baseline`.
 - **tarball**: `npm pack --dry-run --json` file lists must not match the deny list (`code-reviews/`, `bug-reports/`, `plans/`, `scripts/benchmark-*`, `docs/review-coverage-*`, `__tests__/`, `*.map`). Root `files` excludes `docs/review-coverage-*` historical reviews.
 
 Gate behavior is unit-tested in `scripts/release-gate.test.mjs`. Signature diff is name + normalized first-declaration-line level; full structural `.d.ts` diffing (api-extractor or equivalent) is the recorded upgrade path if line-level proves insufficient.