@artblocks/abx-cli 0.1.0-alpha.39 → 0.1.0-alpha.40

package/CHANGELOG.md

@@ -1,4086 +1,16 @@
 # @artblocks/abx-cli
 
-## 0.1.0-alpha.39
-
-### Minor Changes
-
-- c198237: Closes the remaining 2026-08-27 w7 agent sweep backlog (B60-B65): a new command, a real behavior
-  change, and several truthfulness/legibility fixes.
-
-  - **`abx remote set <name> --url <url>`** — the third-party twin of `abx auth login`. Installs
-    `ABX_REMOTE_<NAME>_URL`/`_TOKEN` into `.env` for any hosted metadata provider, not just the
-    first-party `abx` remote. The token is read from stdin (piped, or a TTY prompt) — never a
-    command-line argument, never printed — and re-running replaces the pair in place rather than
-    duplicating it. Reuses `auth login`'s own safety rails (symlink/git-tracked/unignored refusal,
-    atomic write) via newly-exported `saveEnvSecret`/`assertPrivateEnvPath`.
-  - **`abx scaffold solidity [<dir>]`** replaces the proposed `scaffold-minter-hook` with one Foundry
-    workspace for ABX's real Solidity extension surfaces. Renderers and configure/transfer/augment
-    hooks remain separate deployable roles; canonical ERC-721/ERC-1155 minters are imported rather than
-    reinvented. The unsafe burn-to-combine example was removed.
-  - **`abx-contracts~2.0.0`** is the canonical Soldeer package boundary (B49): interfaces,
-    implementations, minters and reference hooks ship from the existing contracts source tree, with an
-    exact compatibility version. Generated projects no longer vendor drift-prone interface copies.
-    B50 is resolved without a mock protocol: reference-hook tests deploy a real canonical SeriesCode
-    clone and exercise schema auth, empty-blob refusal, hook ordering and transfers against it.
-  - **`.env` duplicate keys are now last-wins**, matching conventional dotenv tooling instead of the
-    previous (surprising, backwards) first-wins behavior. `parseEnvContent` keeps the last value at the
-    key's original position; the printed warning updated to match.
-  - **`abx state` now says when it can't enumerate PostParams**, instead of silently showing nothing —
-    a non-canonical/pre-enumeration contract used to read as "confirmed no params" when it actually meant
-    "this node couldn't check." New human-readable line + `params.enumerable` in `--json`.
-  - **A throttled progress line during a large `abx add`/`abx verify` scan** — a range-capped RPC's scan
-    could run 15+ minutes with zero output after one line up front. Now prints `… still scanning:
-N/total blocks (X%)` periodically via a new `onChunk` hook threaded through
-    `getLogsAdaptive`→`reconstructProject`/`reconstructIncremental`→the indexer's `reindex()`.
-  - **Three smaller truthfulness fixes**: `abx remote <url>` now flags a loopback descriptor
-    `baseUrl` the same way it already flags an unsupported chain; `configure-param` now notes when the
-    canonical display differs from what was typed (a bare `ff7f50` normalizing to `#ff7f50`, a Select
-    index resolving to its label); and owner-op `--dry-run --json` now emits the prepared transaction,
-    expected signer, signing lane, and simulation result as structured data.
-
-### Patch Changes
-
-- Updated dependencies [c198237]
-  - @artblocks/abx-sdk@0.1.0-alpha.29
-  - @artblocks/abx-indexer@0.1.0-alpha.30
-  - @artblocks/abx-storage@0.1.0-alpha.29
-  - @artblocks/abx-token-api@0.1.0-alpha.32
-
-## 0.1.0-alpha.38
-
-### Patch Changes
-
-- d4b1de8: Fixes from the 2026-08-27 w7 agent sandbox sweep — a co-located `abx effects` bug that silently
-  defeated auto-rendering, and four help-text truthfulness gaps.
-
-  - **`abx effects --resolver-port <n>`** — the "no manual `abx render`" pipeline could silently never
-    render for two compounding reasons, both hit live on Sepolia in the sweep (real deploy, real mint,
-    two confirmed `configure-param` txs, zero renders landed): co-located mode had no way to say which
-    port the local `abx serve` was actually on (it assumed the default, 8787), and a leftover
-    `ABX_REMOTE_SELF_TOKEN` — auto-saved to `.env` by any earlier `deploy-resolver`/`deploy-effects` run
-    in the same project — silently flipped a later, unrelated `abx effects` into remote/control-plane
-    mode against a bare `abx serve` that never implements it, producing a 404 whose own suggested fix
-    ("check the token") was a dead end. `--resolver-port` fixes the first outright and, by declaring
-    co-location explicitly, ignores the stale token instead of being ambushed by it. When the same
-    combination shows up _without_ the flag (an existing loopback `ABX_RESOLVER_URL` + a stale token),
-    `abx effects` now warns up front with the actual fix, rather than failing silently at the first
-    publish attempt. The decision logic is split into `resolveEffectsTarget()` (`commands/service.ts`),
-    unit-tested directly (`test/effects-target.test.ts`) without needing a chain client or HTTP server.
-  - **`--dry-run`'s "no signer known" hint no longer suggests a flag most commands don't have.** It used
-    to say `pass --for 0x.. (or set a signing key)` unconditionally — but `--for` is only accepted by
-    `deploy`/`predict`/`doctor`/`storage balance`; every owner-op write (`configure-param`, `set-field`,
-    `lock-field`, …) funnels through the same shared `gatedSend`/`simulateDryRun` choke point and doesn't
-    accept it. The hint now leads with what's universally true (set a signing key, or `--sign`) and only
-    mentions `--for` as a caveat for the commands that take it.
-  - **`abx help lock-field` / `abx help lock-uri` now list `--dry-run`.** Both flags already worked
-    (confirmed on a live Sepolia contract in the sweep); neither `--help` output said so, so the exact
-    preview a creator most wants before an irreversible freeze was undiscoverable without already
-    knowing to try it.
-  - **`abx help set-field` / `abx help attach` now state that every write pings ERC-4906** — the on-chain
-    behavior (`MetadataUpdate(tokenId)` per token-scope write, `BatchMetadataUpdate` for `--collection`)
-    was already correct and load-bearing (marketplaces rely on it to self-refresh after a metadata edit),
-    but the only place ERC-4906 was named anywhere in the discoverable surface was a side remark in
-    `abx help ping-uri` about a different, edition-only command.
-
-  Also corrects this repo's own `dev-loop-test` skill, which claimed `.env` duplicate keys are
-  last-wins — the sweep proved the real CLI is first-wins (confirmed live: a duplicate
-  `ABX_RPC_URLS_SEPOLIA` silently routed every read to the wrong RPC, ignoring an intentionally later
-  override).
-
-## 0.1.0-alpha.37
-
-### Patch Changes
-
-- c5e0d84: The skill and CLI now name the extension and setup paths agents were missing: a shared on-chain
-  program with a per-token `Bytes` payload, `abx set-param-hooks`, and Foundry's stricter private-key
-  prefix requirement.
-
-  The routing table in the bundled skill, `reference/code.md`, and `abx capabilities` all list
-  `deploy-code --script` + `<key>:Bytes:Creator` as a native lane — not an escape hatch — so an agent
-  does not conclude the shape is out of scope and hand-roll Solidity. They now say truthfully that the
-  payload is configured after mint with `configure-param --file`; `mint` has no payload flag. Top-level
-  `abx help` lists `set-param-hooks` (the only command that wires a custom hook), and the `--schema`
-  description in `deploy-code --help` points at it for mint-time snapshot / veto / live derivation. Setup guidance
-  also distinguishes the CLI's optional `0x` private-key prefix from Foundry `vm.envUint`'s required one.
-
-  Reported in the 2026-08-27 tester batch (feedback 599722e5, d12929f5, ff28d128, 3d4eda3f).
-
-- c5e0d84: Published package `homepage` and `bugs` fields now point at docs.abx.io instead of a private GitHub
-  repo that 404s. File reports with `abx feedback`; `npm bugs` no longer names a repository the public
-  cannot open.
-
-  Reported in the 2026-08-27 tester batch (feedback 40142396).
-
-- c5e0d84: Read commands no longer collapse "the RPC is down" into "this isn't an ABX contract."
-
-  `abx state` now refuses an ignored singular `ABX_RPC_URL`, probes chain reachability, and retains the
-  errors from its required getter reads. A dead endpoint, a node that answers block/code queries but
-  rate-limits `eth_call`, a codeless address, and code without ABX getters now receive distinct answers;
-  an RPC failure is never stated as a contract verdict. `abx add`'s deploy-block discovery no longer
-  guesses "a non-archive RPC?" when the same node `abx doctor` just certified — the failure can also be
-  rate-limiting or a refused historical `getCode`. The `deploy-code` Surfaces block still flags an
-  orphaned collection-wide thumbnail, and now names the per-token `set-field --field image` hatch (raw
-  SVG bytes, not a data-URI) instead of claiming you cannot backfill at all. `submit-app` now confirms
-  only the on-chain update and tells users to verify hosted catalog copy separately instead of promising
-  an unverified refresh on the provider's "next read."
-
-  Reported in the 2026-08-27 tester batch (feedback ae7cc4a8, bd75dc5f, 89315be8, 1f3c0992, c2101d6f).
-
-- Updated dependencies [c5e0d84]
-- Updated dependencies [c5e0d84]
-  - @artblocks/abx-sdk@0.1.0-alpha.28
-  - @artblocks/abx-indexer@0.1.0-alpha.29
-  - @artblocks/abx-storage@0.1.0-alpha.28
-  - @artblocks/abx-token-api@0.1.0-alpha.31
-
-## 0.1.0-alpha.36
-
-### Minor Changes
-
-- baa7d17: Add `abx auth logout` for first-party and named OAuth remotes. The command discovers the provider's
-  RFC 7009 revocation endpoint, revokes the current API key, and only then removes the matching local
-  `.env` assignment; provider failures keep the credential available for a safe retry. The bundled
-  skill and public docs also teach agents to yield immediately after device-login handoff output and
-  resume the same polling process instead of starting duplicate login or retry loops. Normal key
-  rotation now points through logout so `login --force` does not silently orphan an active key.
-
-## 0.1.0-alpha.35
-
-### Minor Changes
-
-- 4072f0c: Add `abx auth login`, an OAuth 2.0 Device Authorization Grant flow for first-party and named remote
-  services. Human email/OTP approval stays in the browser; the CLI polls according to RFC 8628 and
-  writes the resulting bearer key to a Git-ignored `.env` without printing it. The bundled ABX skill
-  now recommends this agent-safe flow and keeps manual signup only as a recovery path. The SDK's
-  service-descriptor documentation likewise distinguishes provider recovery URLs from standard OAuth
-  discovery.
-
-### Patch Changes
-
-- 4072f0c: `deploy-code --dry-run` now treats a resolver-declared attached renderer as the owner of rendered stills and traits, without contradicting that managed path with local runner, backend, or `fs` warnings.
-
-  The managed lane now prints one truthful verification path instead of asking creators to stand up infrastructure the provider already supplies. Reported during the 2026-08-26 fresh onboarding test (feedback `5b7c3f10-e08f-4fb8-85de-ec509f4f33f6`).
-
-- Updated dependencies [4072f0c]
-  - @artblocks/abx-sdk@0.1.0-alpha.27
-  - @artblocks/abx-indexer@0.1.0-alpha.28
-  - @artblocks/abx-storage@0.1.0-alpha.27
-  - @artblocks/abx-token-api@0.1.0-alpha.30
-
-## 0.1.0-alpha.34
-
-### Minor Changes
-
-- b182f23: Drop-in for existing SDK and CLI consumers; adds optional first-party service and feedback surfaces.
-
-  Add the built-in `abx` remote at `https://services.abx.io`, authenticated by an email-verified free
-  `ABX_SERVICES_API_KEY`, so projects no longer need to copy a service URL or signup handoff into agent
-  instructions. The current key includes hosted resolver and managed-rendering access; the docs state
-  that hosted infrastructure may become paid and preserve the provider-neutral/self-hosted exit route.
-
-  Add `abx feedback`: core protocol/contract/CLI/SDK/skill/docs reports go to the ABX team by default,
-  while `--remote <provider>` uses the provider-standard `abx-service-feedback/v1` interface. Reports
-  are structured, preview-only until the human re-runs with `--yes`, and queryable with `--mine`. The
-  SDK exports the interface id, feedback types, and discovery/submit/history client methods.
-  CLI help enumerates every closed feedback field so an agent can construct a valid report without a
-  failed probe.
-
-  Move the public documentation links to `docs.abx.io` and teach the shipped skill the verified signup,
-  credential boundary, two feedback targets, explicit consent gate, and current hosted-service terms.
-
-### Patch Changes
-
-- Updated dependencies [b182f23]
-  - @artblocks/abx-sdk@0.1.0-alpha.26
-  - @artblocks/abx-indexer@0.1.0-alpha.27
-  - @artblocks/abx-storage@0.1.0-alpha.26
-  - @artblocks/abx-token-api@0.1.0-alpha.29
-
-## 0.1.0-alpha.33
-
-### Minor Changes
-
-- 8f2f78a: Rename and globally refactor the shipped agent skill from `abx-self-host` to `abx` now that managed
-  remote hosting, no-host on-chain projects, deployment, and owner operations are all first-class
-  lanes. The installer archives recognized legacy skill copies outside the discovery tree before
-  installing the new name, preserving user customizations while preventing duplicate triggers. The
-  runtime `.abx-self-host/` data directory is unchanged. Scoped install help names the automatic
-  legacy archive behavior, and `doctor` prints every legacy copy path before recommending migration.
-
-  Replace the accumulated custody-first guide with a surfaces-first lifecycle covering collection
-  shape, runtime, metadata/image/animation/traits, custody, resolution, rendering, authority,
-  mutability, confirmation, verification, and state-driven recovery. The always-loaded router and
-  references are substantially smaller, contradictions are removed, and integrity tests now enforce
-  Agent Skills metadata limits, router size, reference navigation, known stale claims, and Codex UI
-  metadata.
-
-  Add `abx capabilities [--json]`, a typed product-boundary contract for native deployment lanes,
-  canonical extension seams, irreversible choices, and unsupported cases. CLI help and tests consume
-  the same contract, including the current EditionCode renderer/dependency support and static-edition
-  on-chain-image support. Root help now exposes `ABX_CHAIN`, and param-hook help matches the actual
-  SeriesCode/EditionCode contract surface.
-
-  Redact configured credential-bearing RPC URLs at the CLI's top-level error boundary so upstream
-  provider errors cannot echo API keys into terminal or agent transcripts.
-
-### Patch Changes
-
-- Updated dependencies [8f2f78a]
-  - @artblocks/abx-sdk@0.1.0-alpha.25
-  - @artblocks/abx-indexer@0.1.0-alpha.26
-  - @artblocks/abx-storage@0.1.0-alpha.25
-  - @artblocks/abx-token-api@0.1.0-alpha.28
-
-## 0.1.0-alpha.32
-
-### Patch Changes
-
-- 61503c3: On-chain content: measure the RPC instead of guessing, and refuse no size.
-
-  `deploy --onchain-image`, `deploy-series --onchain-image` and `set-field --file` refused content past
-  **100 KB per token**. That threshold was reasoned from geth's 50M `--rpc.gascap` default minus a
-  margin, on the stated theory that "hosted providers commonly cap well below geth's default".
-
-  Measured 2026-08-24, with a state-override `eth_call` that reports the gas a node actually provisions:
-
-  | Endpoint                                                           | `eth_call` cap  | Content it serves |
-  | ------------------------------------------------------------------ | --------------- | ----------------- |
-  | **`sepolia.base.org`** — the default endpoint of our default chain | **600,000,000** | **~729 KB**       |
-  | `base-sepolia.publicnode.com` · `base-sepolia.drpc.org`            | 50,000,000      | ~117 KB           |
-  | `ethereum-sepolia.publicnode.com`                                  | 50,000,000      | ~117 KB           |
-
-  Providers do not commonly cap lower — **50M is the floor**, and the chain we ship as the default serves
-  twelve times that. So the refusal sat _below every endpoint that could be found_: it blocked content all
-  of them could read, and was 7x too strict on the default chain. A creator who wanted a 312 KB image
-  permanently on-chain was told no by a number about somebody else's infrastructure.
-
-  **There is now no refusal at any size**, and `--allow-unreadable-onchain` is gone with it (it existed
-  only to skip the refusal). In its place the toolkit states both costs and measures the one that varies:
-
-  - **Write** is chunked into 22,000-byte SSTORE2 transactions, so no block gas limit binds it at any
-    size. It is purely money at ~200 gas/byte, and the CLI now says so instead of implying a ceiling.
-  - **Read** is one `eth_call`, and whether it succeeds belongs to whoever's endpoint is asking. Below
-    ~117 KB (~50M gas) every endpoint measured serves it, and the CLI prints a plain note. Above that it
-    probes the RPC you are actually on — no transaction, no key, one call — and reports its real
-    allowance beside the estimate.
-
-  ```
-  ⚠ big.png is 312KB on-chain — reading tokenURI costs ~172M gas, which is past the ~50M gas floor
-    that every endpoint serves.
-    Your RPC allows ~600M gas (sepolia.base.org), so it reads for you — up to ~729KB. A 50M-capped
-    provider stops at ~117KB, and marketplaces or indexers on one will see a REVERT rather than your
-    token. Writing is unaffected: ~64M gas, chunked, no block-limit issue. This is the
-    permanence-vs-reach trade — --backend arweave is the other side of it.
-  ```
-
-  The distinction the output keeps making, because it is the one that matters: **your RPC is not the
-  marketplace's RPC.** A measured cap proves _you_ can read the token, never that OpenSea can. Past even
-  your own endpoint's cap the CLI says that plainly — and still does not stop you, because bytes someone
-  wants permanent are their call, not ours.
-
-  New in the SDK: `probeEthCallGasCap` / `probeBestEthCallGasCap` (in `probe.ts`, alongside the existing
-  getLogs capability probe that already argued this exact principle — measure the endpoint, don't trust a
-  table), `ETH_CALL_GAS_FLOOR`, and `readableBytesAtGas`. `classifyOnchainReadSize(bytesLen, capGas?)`
-  now returns `'ok' | 'endpoint-dependent' | 'beyond-local-rpc'` — none of them a refusal — and
-  `ONCHAIN_READ_REFUSE_BYTES` / `ONCHAIN_READ_GETH_CAP_BYTES` are removed.
-
-  An endpoint that rejects state overrides yields "unknown", which degrades to the conservative floor and
-  is tested to never throw and never block.
-
-  ## Follow-up audit: the other hardcoded third-party assumptions
-
-  **Three different limits were being called "the gas limit", and they differ by orders of magnitude on
-  the same endpoint.** Measured 2026-08-24:
-
-  |                                   | `eth_call` cap           | `eth_estimateGas` cap | block `gasLimit`         |
-  | --------------------------------- | ------------------------ | --------------------- | ------------------------ |
-  | Base Sepolia — `sepolia.base.org` | 600,000,000              | 16,777,216            | 1,200,000,000            |
-  | Base Sepolia — publicnode · drpc  | 50,000,000               | 16,777,216            | 1,200,000,000            |
-  | Sepolia — publicnode              | 50,000,000–2,000,000,000 | 16,777,216            | 60,000,000               |
-  | Base mainnet · Ethereum mainnet   | —                        | —                     | 400,000,000 · 60,000,000 |
-
-  - **"L1 block limits sit in the mid-30-millions"** (SDK, docs) was stale in the direction that makes
-    on-chain look worse than it is. It is 60M on Ethereum and Sepolia, 400M on Base, and **1,200M on Base
-    Sepolia** — so the claim that _"past ~90 KB no contract can read the token inside a transaction"_ was
-    off by more than 12x on our own default chain, where the real figure is ~1,100 KB. Removed everywhere.
-  - **`DEFAULT_TX_GAS_BUDGET = 8M` was right for the wrong reason, and the wrong reason was dangerous.**
-    It said "comfortably under mainnet's ~30M block limit". The limit that actually binds is
-    `eth_estimateGas`, capped at **16,777,216 (2²⁴)** on every endpoint tried — every send estimates
-    first, so a batch planned above that fails before anything is sent. Anyone correcting the stale block
-    figure would have raised the budget and broken every deploy. The constant is unchanged; its rationale
-    now names the limit that holds it, and says not to raise it toward a block limit.
-  - **A measured cap is point-in-time, not a property.** Sepolia's publicnode endpoint measured 50M one
-    hour and 2,000M the next — pooled endpoints rotate between backends with different configs. The probe
-    and the output now say so.
-  - **The probe could not tell "capped at exactly my ask" from "not capped at all".** A node that returns
-    the full 2,000,000,000 it was asked for did not clamp; reporting that as a 2,000M cap invents a limit
-    out of our own request. It now returns `Infinity` and the CLI prints "no eth_call cap at all".
-
-  ## And the reframe that makes the whole question smaller
-
-  A large read is a **serving** problem, not a preservation one — and the resolver already solves it.
-  `resolveFieldBytes` reads `inline` / `inline-gzip` / `reader` / `reader-gzip` with the resolver's own
-  RPC and serves the result as ordinary HTTP, so a marketplace fetches a URL and never makes the large
-  `eth_call`. `abx set-renderer <addr> --off` points `tokenURI` at it with every byte left where it is.
-
-  Every warning now says this, because it changes the decision: **storage and serving are separate.**
-  On-chain is the strongest storage answer available at any size; self-resolving-versus-a-resolver is a
-  serving choice the creator can change later. A token whose read is too large for some endpoint is not a
-  lost token — it is one that wants a reader in front of it.
-
-  And the framing that replaces the old false precision: **we can measure your RPC; we cannot know a
-  marketplace's or an indexer's**, and theirs are the ones that decide whether the token displays.
-
-- 61503c3: Skill: stop agents declining capabilities ABX has, and teach the four extension seams up front.
-
-  Three field reports in one week share a shape — an agent told a creator "ABX can't do that" about
-  something ABX does:
-
-  - a **77 KB PNG fully on-chain** was called "not practical" and the creator was routed to another
-    protocol's on-chain filesystem. It ships today: the CLI warns once, ~16M gas to write and ~31M to
-    read. 100 KB is the refusal; 40 KB is only where reads stop being comfortable.
-  - a **transfer-restriction + mutable-state** mechanic was declared impossible, then built in an
-    afternoon once the creator said the word "hooks".
-  - a bespoke **non-canonical token contract** was written for a mechanic two stock hooks cover,
-    permanently forfeiting the `isAbxClone` provenance that is the reason to deploy here at all.
-
-  None of those agents lacked information. Each answered from the **command list**, and the command list
-  is a set of recommended routes, not the edge of the protocol — so falling off the end of a routing
-  table read as a "no". Another warning paragraph would not have helped; the skill already had one.
-
-  What changed, structurally:
-
-  - **A new `reference/capabilities.md`** — the inverse of the decision tree. It answers "can ABX do X?"
-    instead of "what do I run?": the four seams, the three hooks in depth, a mechanic→seam lookup table,
-    the on-chain size bands as _costs_ rather than walls, and a short, bounded **genuine no-list** — which
-    is what makes "don't say no" safe to follow.
-  - **A gate on the utterance, in Read first.** There is no CLI choke point for a wrong answer given in
-    chat, so the enforcement analogue is a rule that fires on the words themselves: before _not possible_,
-    _not practical_, _you'd need a different_, or the name of another protocol, check the seams and the
-    no-list. If it is on neither, it is possible — answer with the cost. And never route a creator to
-    another protocol for something ABX does.
-  - **The three hooks are taught as power, not just as liability.** Every prior mention sat in the
-    lock/disclosure register ("a standing power over whether a collector can sell"), and the **augment
-    hook did not appear in SKILL.md at all**. The honest claim is now stated where it is read: ABX runs
-    your arbitrary Solidity at write time (`--configure`, vetoes the write), transfer time (`--transfer`,
-    vetoes the move, sees mints and burns) and read time (`--augment`, adds and overrides `tokenData` keys
-    from anything a `view` can reach, for no gas on the token and no ~24 KB blob ceiling).
-  - **The deploy-time precondition is surfaced before the deploy.** Hooks exist only on
-    `SeriesCode`/`EditionCode`, the contract type is fixed forever, and that fact previously lived in one
-    parenthetical deep in a reference file. A creator who hints at _any_ rule should be deployed with
-    `deploy-code` even when the art is a static image — this is the mechanism that corners an agent into
-    writing a custom contract later.
-  - **"What this toolkit does NOT do" was itself teaching false impossibility.** It listed auctions and
-    allowlists next to mainnet. Now split: a genuine no-list, and a "not a flag, but here is the seam"
-    list. Auctions, allowlists, raffles, ERC-20 pricing, soulbinding, vesting, escrow, redemption and
-    oracle-fed metadata are all seams.
-  - **The skill `description` now routes capability questions here.** It listed only deploy/operate verbs,
-    so "can I make it soulbound?" or "can I run an auction?" never loaded the skill — the outermost
-    membrane was the first place the answer went wrong.
-  - **Size guidance reframed as a cost band** in all three places an agent meets it, with the 40–100 KB
-    band named as _warns once and ships_.
-
-  Also fixed, found while checking: **five dead links in `reference/decisions.md`** (sibling references
-  written as `reference/hosting.md` from inside `reference/`, resolving to `reference/reference/…`), and a
-  link from `reference/code-projects.md` into `docs/research/` that is dead for every installed user,
-  since `abx skill install` copies only the skill directory. A new `skill-integrity.test.ts` pins both —
-  every reference file is reachable from SKILL.md, and every relative link resolves.
-
-- Updated dependencies [61503c3]
-  - @artblocks/abx-sdk@0.1.0-alpha.24
-  - @artblocks/abx-indexer@0.1.0-alpha.25
-  - @artblocks/abx-storage@0.1.0-alpha.24
-  - @artblocks/abx-token-api@0.1.0-alpha.27
-
-## 0.1.0-alpha.31
-
-### Patch Changes
-
-- bd77ba2: Correct the Node floor to 22.13, and refuse to start with a remedy instead of a stack trace.
-
-  Every package declared `engines.node: ">=22.5.0"` — the version `node:sqlite` was **added**, not the
-  version it became usable. It shipped in v22.5.0 behind `--experimental-sqlite` and lost the flag in
-  v22.13.0 / v23.4.0. So `npm i -g @artblocks/abx-cli` on Node 22.5 installed silently (the engine
-  range was satisfied) and then `abx doctor` — the first command we tell everyone to run — died with a
-  raw `ERR_UNKNOWN_BUILTIN_MODULE: No such built-in module: node:sqlite` stack trace naming neither
-  abx nor a fix. Reported 2026-08-24; the floor is now `>=22.13.0` everywhere, so npm warns at install
-  time.
-
-  The crash happened while ESM _linked_ `main.ts`'s import graph (`output.ts` →
-  `@artblocks/abx-indexer` → `node:sqlite`), before any of our code ran, so no guard inside the CLI
-  could have caught it. The published binary is now a deliberately import-free shim (`dist/bin.js`)
-  that probes for `node:sqlite` and hands off to `main.js` — it prints the running version, the real
-  floor, and the upgrade command. It probes the **capability**, not the version number: an old Node
-  launched with `NODE_OPTIONS=--experimental-sqlite` genuinely works, and refusing that would be a
-  false negative. `engines` states what we support; the guard blocks only what is actually broken.
-
-  `abx doctor`'s header now also reports the running Node, since its output is what people paste when
-  something is wrong.
-
-- Updated dependencies [bd77ba2]
-  - @artblocks/abx-indexer@0.1.0-alpha.24
-  - @artblocks/abx-token-api@0.1.0-alpha.26
-  - @artblocks/abx-storage@0.1.0-alpha.23
-  - @artblocks/abx-sdk@0.1.0-alpha.23
-
-## 0.1.0-alpha.30
-
-### Minor Changes
-
-- 993e095: `--dry-run` now **simulates** the transaction instead of only describing it.
-
-  Every write command routes through one risk gate, so all of them gained this at once. A dry run
-  `eth_call`s the prepared transaction against current state and adds one line:
-
-  ```
-  simulation   ✓ would succeed (eth_call against current state)
-  simulation   ✗ would REVERT — FieldLocked()
-               sending this now would burn gas and change nothing.
-  ```
-
-  This matters most for a **multicall** — `attach`'s batched pairs, `deploy-code`'s setup — because a
-  multicall is one transaction, so simulating it exercises the whole sequence atomically, against real
-  state, with no fork involved.
-
-  It reports **unknown**, never a false green, whenever it cannot prove anything: no signer to simulate
-  as, a contract deploy, a target with no code yet, or an unreachable node.
-
-  Revert reasons decode to the contract's own error name (`RoyaltyTooHigh()`) where the node returns
-  revert data. Several public endpoints return none — in that case the output says so plainly and names
-  what a bare revert usually is, rather than viem's "reverted for an unknown reason", which reads like a
-  decoding failure on our side.
-
-- 993e095: `deploy-code --copies` now supports `--image-renderer` / `--attributes-renderer` — a **true fully
-  on-chain ERC-1155 edition**.
-
-  ```bash
-  abx deploy-code --copies open --image-renderer 0x… --attributes-renderer 0x… --onchain-uri \
-    --name "…" --symbol …
-  ```
-
-  Open supply, minted over time by anyone you let mint, image and traits computed by your Solidity
-  renderers, `uri(id)` assembled on chain. No resolver, no render runner, no bucket, nothing to keep
-  running — the same zero-infrastructure lane the ERC-721 side has had, on the edition twin.
-
-  - `--script` is now **optional** on this command. A renderer-only edition stores no program and has no
-    `animation_url`; passing both a script and renderers composes (an on-chain live view _and_ an
-    on-chain still), exactly as on the 721 lane.
-  - The same guard applies as at 721 deploy time: a renderer address with no code is refused, because
-    pointing a field at one reverts every `uri()` in the collection.
-  - `--image-base` is still refused with `--copies` — it needs the effect runner to write a still per id
-    — and now says so, and names the lane that does work.
-
-  This was never a contract limit: `EditionCode` composes the same `OnChainMetadata` extension and URI
-  renderer slots as `SeriesCode`. Only the CLI flags were unported, and a reporter who asked the natural
-  question — "can I get a real on-chain-rendered 1155 with no server?" — read the blanket refusal as a
-  protocol answer and shipped an ERC-721 workaround instead. `contracts/test/EditionOnChainRender.t.sol`
-  now pins the claim end to end.
-
-  Reported in the 2026-08-24 field notes.
-
-### Patch Changes
-
-- 993e095: `abx doctor` checks whether each RPC endpoint agrees with itself about your wallet's nonce.
-
-  `pending` is by definition at least `latest` on a coherent node. An endpoint that hasn't caught up
-  with its own head answers lower — measured on `sepolia.base.org` right after a confirmed write — and
-  the next command's first send re-uses a spent nonce. `doctor` reported that exact endpoint healthy in
-  that exact condition.
-
-  Sends are already protected (they floor at `max(pending, latest)`); this names the endpoint instead of
-  silently routing around it.
-
-  The check needs a wallet that has actually sent something — a fresh wallet reads 0 everywhere and
-  proves nothing — so on that path it prints `nonce coherence: unknown` rather than passing on no
-  evidence. A check that goes green without a signal is the same false green as an RPC answering `[]`
-  because it pruned its logs.
-
-- 993e095: `deploy-code`, `deploy-code --copies` and `deploy-series` now state their permanent decisions on a real
-  send, not only under `--dry-run`.
-
-  The supply cap and the royalty rate — including the `⚠ default` marker when you didn't choose one —
-  were printed in the deploy _plan_, which only runs for `--dry-run`. A creator going straight to `--send`
-  learned afterwards, from `abx state`, that their collection carries a 5% royalty to the deploying wallet.
-  That is a real economic default to discover after the fact on a demo nobody meant to monetize. The
-  success readout now carries the same line the plan does.
-
-  The default itself is unchanged: 5% to the creator is the right default for a launch, and a lane-specific
-  0% would silently strip royalties from projects deployed the same way for real.
-
-  Reported in the 2026-08-24 field notes.
-
-- 993e095: `abx set-field --representation renderer` no longer writes a value the chain cannot decode.
-
-  A `renderer` field is stored as `abi.encode(address)` and the on-chain metadata renderer decodes it
-  before it can compute the field. `--value` was written to chain verbatim, so passing a plain 20-byte
-  address — the same shape `deploy-code --image-renderer` takes — landed 20 bytes where 32 were needed,
-  and **every `tokenURI` in the collection reverted**. It read like a protocol bug rather than a bad
-  write: `contractField("image")` still returned the right representation and a right-looking address,
-  and re-pointing at the renderer the collection was deployed with didn't fix it (that write had the
-  same wrong shape).
-
-  `set-field` now normalizes and validates the structured representations before sending:
-
-  - `--representation renderer` accepts the field renderer's plain `0x` address and abi-encodes it, or
-    an already-canonical 32-byte word. Any other length — or a 32-byte word with non-zero high bytes —
-    is refused with a message that says what to pass.
-  - `--representation reader` / `reader-gzip` must be `abi.encode(address reader, address pointer)`;
-    anything else is refused and points at `--file`, which encodes it correctly for you.
-  - A `renderer` value pointing at an address with **no code** is refused, the same guard
-    `deploy-code --image-renderer` already applied at deploy time.
-  - After a field write lands, `set-field` calls `tokenURI` once and says whether it still resolves —
-    so a renderer that reverts for its own reasons is reported against the write that exposed it,
-    with the recovery command.
-
-  Already-broken collections are recoverable, and were never permanently damaged: re-run the same
-  `set-field` on the current CLI (the field is only frozen by an explicit `abx lock-field`).
-
-  Reported in the 2026-08-24 field notes, from four projects shipped on Base Sepolia.
-
-- Updated dependencies [549a32d]
-- Updated dependencies [993e095]
-  - @artblocks/abx-token-api@0.1.0-alpha.25
-  - @artblocks/abx-sdk@0.1.0-alpha.22
-  - @artblocks/abx-indexer@0.1.0-alpha.23
-  - @artblocks/abx-storage@0.1.0-alpha.22
-
-## 0.1.0-alpha.29
-
-### Minor Changes
-
-- c9f7aeb: Fold the burn, and make "canonically ABX v2" sayable — from abx-services' 2026-08-20 reply
-  (`reviews/2026-08/services-reply-docs-23.md`). All off-chain: no contract changed, no address moved.
-
-  **SDK — `foldSpine` now folds an ERC-721 burn, and `TokenState.minted` is replaced by `lifecycle`
-  (BREAKING).** A burn wrote the zero address into `TokenState.owner` — where nothing downstream could
-  tell it from a holder — and `minted` latched `true` at mint and was never recomputed, so a burned
-  token reconstructed as live. `lifecycle: 'unminted' | 'live' | 'burned' | 'no-live-copies'` replaces it,
-  and `owner` is `null` for a burned id rather than a sentinel. An enum rather than the `minted` +
-  `burned` pair the report asked for: a boolean whose `false` has two meanings leaves the burn case one
-  forgotten field away from rendering as "not yet minted", which is exactly what our own CLI did.
-
-  **`'burned'` is terminal and ERC-721-only; an edition at zero live copies is `'no-live-copies'`.** The
-  first cut of this enum shared `'burned'` across both standards, on the grounds that "one vocabulary on
-  both lanes" was the honest shape. It wasn't: the correct _response_ to destruction differs by standard
-  (a 721 id is gone forever and must `410`; an edition id can mint again and must not), so a shared word
-  put every consumer one forgotten `contractType` branch away from serving `410 Gone` for a token the
-  contract still resolves — and our own migration note told the first consumer to map the shared word
-  straight onto their `410` sites. abx-services caught it in review before it published. Splitting the
-  word moves the rule out of prose and into the type: **`lifecycle === 'burned'` is safe to treat as
-  permanent on either standard, with no carve-out**, which let the reference resolver's `isEditionState`
-  guard go away entirely. Pinned from both ends — no edition history can fold to `'burned'`, and the
-  route asserts its own standard-blindness.
-
-  **The two lanes now agree id-for-id.** The same review found `TokenRow.lifecycle` (head reads) reporting
-  `'unknown'` for a fully-burned edition id while the fold reported `'burned'` for that same id — under a
-  docstring claiming the two lanes used the same words. That is the sibling-drift class this repo treats
-  as a bug (see `TokenState.maxSupply`'s note, the last time one field name carried two meanings). Both
-  lanes now answer `'no-live-copies'` there: the fold _could_ distinguish never-minted from fully-burned
-  and deliberately does not, because the distinction has no consumer. `'unknown'` survives for the one
-  case where a head read genuinely cannot say — a 1/1 has no mint frontier, so a reverting `ownerOf`
-  there is evidence of nothing.
-
-  What the latched boolean was costing, all in our own tree: the effects harness re-rendered destroyed
-  tokens on every sweep, forever; `onchain-uri`'s probe reads the LOWEST live id, so burning token 0 made
-  a healthy collection's on-chain-URI lane report as **broken**; the resolver served metadata — and the
-  pre-mint _warming placeholder_, i.e. "still loading" forever — for ids the contract disowns; `mintedCount`
-  never went down; and `abx state` printed "not yet minted" for a token that had been destroyed.
-
-  **SDK — `BurnConfigured` and `MaxRoyaltyBpsUpdated` fold into `ProjectState.burnable` /
-  `.maxRoyaltyBps`.** Both events shipped in the ABI and in `SPINE_EVENT_DOC` and reached no field of
-  state; the upgrade memo then told consumers the doc entry _was_ the fold, which it has never been (it
-  supplies `register`/`what` on the event record, full stop). Both are tri-state: `null` means the spine
-  never stated it — an implementation with no `burn` entrypoint and an unpublished ceiling — which is not
-  `false`, and not 10%. The ceiling is deliberately not nested inside `royalty`, since clearing a royalty
-  nulls that field while the ceiling stays binding on chain.
-
-  **SDK — a fold-coverage guard, because this was the second instance in four days.** `DefaultMaxSupplySet`
-  did the same thing on 2026-08-17. `SPINE_EVENT_NO_FOLD` now lists the events that deliberately reach no
-  state _and why_ (a ping whose value is a head read, a factory's own log, a minter sibling, an allowance),
-  and `spine-fold-coverage.test.ts` asserts every decodable event is either folded or excused. A new event
-  is unfolded and unexcused until someone decides which.
-
-  **SDK — a burned 1/1 no longer vanishes from `listTokens`.** The id range fell back to `totalSupply`
-  (live: mints − burns) when a token type exposes no `nextTokenId`, so burning a 1/1's only token made the
-  listing enumerate ZERO ids — `abx tokens` printed nothing at all, indistinguishable from a collection
-  with no tokens. A 1/1's id space is `{0}` forever regardless of what is live. Found by burning a real
-  token on Sepolia rather than by any fixture, which is the only way this one surfaces.
-
-  **SDK — head reads can now say `burned`.** `nextTokenId` is a mint frontier that only rises, so an id
-  below it whose `ownerOf` reverts was minted and destroyed. `TokenRow.lifecycle` (`'live'` / `'burned'` /
-  `'unminted'` / `'unknown'`) and `TokenListing.burnedCount` (`nextTokenId − totalSupply`) drop out of that,
-  with no event log. `'unknown'` stays a real member where the chain declines to say: a 1/1 has no frontier,
-  and an edition's `supply == 0` cannot distinguish never-minted from fully-burned.
-
-  **SDK — `burned` joins `ServiceErrorCode`, paired with `410 Gone`.** A remote token API had nothing
-  honest to say about a destroyed id and was sending `410` with `code: 'not_registered'` — a statement
-  about the _contract_. The rule behind the pairing is the general one: **a resolver answers what the
-  contract's own URI getter answers.** A burned 721's `tokenURI` reverts `NonexistentToken`, so serving a
-  document would contradict the contract; an ERC-1155's `uri(id)` has no existence gate and a zero-supply
-  id can mint again, so **an edition never 410s** — it serves, with `supply: 0`.
-
-  **SDK — `readCollectionPolicy`, `canonicalFactories`, `verifyProvenance`: protocol knowledge moves out
-  of the CLI.** The CLI was declaring its own ABI fragments for `burnable`/`maxRoyaltyBps` and reading
-  them itself in two places, so no other integrator could reach either fact. `canonicalFactories(chainId)`
-  replaces two copies of the six-anchor enumeration inside `anchors.ts` — the list whose completeness _is_
-  the trust model. `verifyCanonical` gains `opts.factories`, which **replaces** the manifest set rather
-  than appending to it, so a multi-tenant operator's pinned allowlist can drive the gate without silently
-  widening it.
-
-  **SDK — anchor generations: "canonically ABX v2", not a bare `false`.** `verifyCanonical` reported
-  "deployed by an ABX factory since replaced" and "deployed outside the toolkit entirely" identically —
-  its own docstring admitted it — and the first is a perfectly good collection. `ANCHOR_GENERATIONS` keys
-  each generation of the six trust anchors by the **on-chain core version** its clones report, and
-  `verifyProvenance` returns `{canonical, generation: 'current' | 'prior' | null, coreVersion, factory,
-anchorsAnswered}`. The version is on the clone itself, so the answer is chain-verified rather than a
-  manifest claim, and it keeps working after a factory retires. Retired generations never feed
-  `verifyCanonical`: provenance is not trust — a superseded generation can predate a security remediation.
-  Pre-launch testnet generations are deliberately not backfilled.
-
-  **Redeploy process — a token-layer runtime change is a new anchor generation.** It bumps
-  `AbxVersion.CORE_VERSION` and moves the SDK's `isCurrent*` probes in lockstep. That is now a checklist
-  step (`contracts/README.md`, `CLAUDE.md`) _enforced by_ `deployments.test.ts`: recorded generations must
-  have unique, increasing core versions and the newest must match the constant in `AbxVersion.sol`, so a
-  batch cannot record a generation without bumping or bump without recording. The gap that prompted it: the
-  2026-08-20 batch added `burn()`, `burnable()`, `maxRoyaltyBps()` and `reduceMaxRoyaltyBps()` to the CORE
-  base — burn is not an extension, so no extension version moved either — and left the constant at 2, so
-  `abxVersion() == 2` cannot tell a burn-capable token from a pre-burn one.
-
-  **CLI — the royalty ceiling is shown with its rate, and headroom is named.** A ceiling above the live
-  rate is royalty the owner can add unilaterally, and a listing page never shows it. `abx state` prints the
-  pair and, when there is headroom, says the useful thing: reducing the cap **to** the current rate is what
-  turns "5% today" into "5%, provably, forever". (Named by abx-services as their `royalty-headroom` flag —
-  a marketplace can compute it, so a creator should hear it from us first.)
-
-  **Reference stack — the same fixes, so the reference is exemplary rather than the counter-example.**
-  `mintedCount` keeps its name and counts LIVE ids, with `burnedCount` added only when non-zero (so a
-  project with no burns serves byte-identical JSON, and a consumer's fixtures keep telling the truth);
-  the indexer projection carries `lifecycle`; the effects status route and the render sweep skip destroyed
-  ids; the dashboard badges a burned token instead of calling it minted; and `abx verify` / the migrate and
-  re-point probes never choose a burned token as their subject.
-
-  **CLI — `--send` is accepted on the deploy paths, and two lane flags is refused.** Every deploy's help
-  advertises the signing lanes as `--send hot/env key · --sign wallet page · --unsigned print tx`, in 25
-  places, and `--send` was the one of the three the deploy allowlist rejected: typing what the help showed
-  produced `unrecognized flag(s): --send` from the guard whose whole purpose is catching flags that would
-  be silently ignored — the guard firing on the tool's own documentation. Found by using the CLI as a cold
-  reader of its own `--help` while setting up an on-chain test. While there, lane resolution moved from
-  truthiness to **presence** (`--sign=` parses to `''`, which is falsy, so a caller who explicitly named
-  the wallet lane was routed to the unattended env key — the one direction of that bug that costs
-  something), and naming two lanes at once now refuses instead of resolving by an undocumented precedence.
-
-  **Packaging — every published tarball ships its CHANGELOG.** `files` was `['dist', 'LICENSE']` on the
-  SDK, indexer, storage, effects and token-api, so the only package whose release notes reached consumers
-  was the CLI. A downstream team upgrading the SDK had no CHANGELOG in the tarball and diffed two `dist/`
-  trees to find out what moved — then reported the release notes as missing, which cost a whole exchange
-  to adjudicate. One line each.
-
-  **Docs + spec.** The event spine gains a Burn section and the `MaxRoyaltyBpsUpdated` row, both with the
-  fold rules an indexer relies on; three stale deploy-event-order lists are corrected; the remote-services
-  error taxonomy gains the `410 burned` row and the edition carve-out; `owner-powers` explains headroom and
-  burn permanence; and `indexing-notes` states plainly that documenting an event is not folding it.
-
-### Patch Changes
-
-- Updated dependencies [c9f7aeb]
-  - @artblocks/abx-sdk@0.1.0-alpha.21
-  - @artblocks/abx-storage@0.1.0-alpha.21
-  - @artblocks/abx-indexer@0.1.0-alpha.22
-  - @artblocks/abx-token-api@0.1.0-alpha.24
-
-## 0.1.0-alpha.28
-
-### Patch Changes
-
-- 84ca9dd: Off-chain fixes from the 2026-08-19 production-readiness audit
-  (`reviews/2026-08/production-readiness-audit.md`). All are off-chain — no contract changed and no
-  address moved; the three NatSpec-precision items the audit also raised ride the next redeploy batch
-  instead (`docs/10-backlog.md` → _Contracts — the next redeploy batch_, B47).
-
-  **SDK — `HexColor` decode now masks to 24 bits, matching the chain (L-1).** `decodeScalarParam` for a
-  `HexColor` value greater than `0xFFFFFF` returned `#1ffffff` (7+ hex digits); the on-chain
-  `TokenDataLib.decodeScalar` masks with `& 0xffffff` and returns `#ffffff`. The governed write validates
-  `v <= 0xFFFFFF`, but the raw owner setter does not, so an out-of-domain value can be stored and later
-  governed by a `HexColor` schema — and the two serving planes would then decode it differently, splitting
-  `inputsHash`. The SDK now masks identically. Pinned on both sides so it cannot drift again:
-  `decodeScalarParam('HexColor', 0x1ffffffn) === '#ffffff'` (SDK) and the twin `test_DecodeScalars`
-  assertion in `contracts/test/FieldRenderer.t.sol`.
-
-  **SDK — gateway-prefix projection no longer trims (L-7).** `projectGatewayPrefix` dropped the `.trim()`
-  on the on-chain `abx_gateway_*` value: the deployed `_gatewayPrefix` returns the stored bytes verbatim,
-  so trimming here made the two planes disagree on a whitespace-padded prefix. The field store rejects an
-  empty value, so a set field is always non-empty. Clean prefixes (every real one) are unaffected.
-
-  **SDK — `permissionlessSalt` docstring hardened (L-3).** Now states explicitly: never use it for a
-  pre-published or pre-funded address — a third party can occupy the predicted address first with their own
-  `InitParams`. For any reserved address, use `saltFor` (its deployer-bound prefix is front-run-proof). No
-  behavior change; the shipped CLI/skill already deploy through `saltFor`.
-
-  **CLI — the edition schema advisory calls out a holder-writable `seed` by name (L-2).**
-  `editionSchemaAdvisory` already warned that a `TokenOwner` param on an edition is shared per-id
-  (last-writer-wins); it now adds a sharper note when that param is `seed`, because the normally-immutable
-  generative seed becomes re-rollable by _any_ holder of the id — changing the artwork for every
-  co-holder. The on-chain behavior is deliberately unchanged (the reassignable-seed feature is
-  buyer-verifiable via `paramSchema("seed")`); the guardrail is this warning, not a contract restriction.
-  A controller contract on the `Address` leg remains the way to govern it.
-
-- 84ca9dd: Finish the burn + royalty-cap surfacing, from the 2026-08-20 w6 agent sandbox sweep. All off-chain —
-  no contract changed, no address moved; the on-chain features were verified working end to end (a cold
-  agent deployed `--burnable --royalty-cap 42`, minted, burned, and proved the cap enforced on Sepolia).
-  The sweep's convergent finding was that the two new **permanent** deploy-time decisions were invisible
-  after you set them; this makes them visible everywhere they're decided or read, and adds the owner's
-  missing reduce lever.
-
-  - **New: `abx set-royalty-cap <address> --cap <0-10000>`** — the owner's reduce-only royalty-ceiling
-    lever (`RoyaltyExtension.reduceMaxRoyaltyBps`), the "after" the deploy-time "reduce-only after"
-    promise never had. Both ways the chain refuses are checked locally before signing: a value that
-    wouldn't decrease (`RoyaltyCapNotReduced`) or that would drop below the live royalty rate
-    (`RoyaltyCapBelowRoyalty`). SDK: `prepareReduceMaxRoyaltyBps`.
-  - **The deploy readout now shows `royalty cap` and `burnable` on every lane** (1/1, series, code, and
-    all three edition twins), whenever set. Critically it flags an **auto-raised** cap
-    (`royalty cap 25% (auto-raised to fit the royalty)`): omitting `--royalty-cap` while setting a
-    royalty above 10% silently raises the permanent ceiling to match, which was previously invisible.
-  - **`abx state` now surfaces `royaltyCap` and `burnable`** (human + `--json`), the post-deploy
-    verification surface, for both the 721 and edition readouts.
-  - **The skill documents the royalty cap** — the identity decision (`decisions.md`), the confirm-
-    identity step (`SKILL.md`), and a new `set-royalty-cap` owner-op row (`operating.md`); previously the
-    reduce-only ceiling feature had zero skill coverage.
-  - **Help/doc corrections:** `set-royalty --help` range `0-1000`→`0-10000` (stale from the hard-cap
-    era); `deploy-series --help` now lists `--royalty-cap`/`--burnable`; `deploy --help` states the cap
-    auto-raises; `abx inspect`'s trait-feasibility deep-dive points at public docs, not a repo path.
-
-- Updated dependencies [84ca9dd]
-- Updated dependencies [84ca9dd]
-  - @artblocks/abx-sdk@0.1.0-alpha.20
-  - @artblocks/abx-indexer@0.1.0-alpha.21
-  - @artblocks/abx-storage@0.1.0-alpha.20
-  - @artblocks/abx-token-api@0.1.0-alpha.23
-
-## 0.1.0-alpha.27
-
-### Patch Changes
-
-- b1c333d: **Asking for a 15% royalty built a transaction that reverted on chain.** `RoyaltyExtension` caps every
-  ABX token at **1000 bps (10%)** and reverts `RoyaltyTooHigh()` above it, and no token type overrides that.
-  But client-side validation allowed the full ERC-2981 `0–10000` range — and the CLI's own error text
-  offered `10000 = 100%` as a worked example. So a creator asking for an ordinary 15% got a fully built,
-  fully signed transaction that failed on chain; on the wallet lane they approved it in their own wallet
-  and paid the gas to find out. Both usage strings said `<0-10000>`, and so did two public docs.
-
-  Now `MAX_ROYALTY_BPS` (SDK) mirrors the contract ceiling and both `prepareSetRoyalty` and the CLI's
-  `parseRoyaltyBps` validate against it, so the refusal is instant, local and free, and it names the cap
-  and the revert. Regression tests cover it from both sides — including `1500`, the value that used to
-  sail through. Two existing tests had to be corrected: they asserted the 0–10000 bound, which is how this
-  survived.
-
-  Three more surfaces that contradicted themselves or the chain:
-
-  - **`abx ping-uri --help` claimed "Permissionless by design … ANY signer may call it (no owner check)"
-    four lines below its own `OWNER-ONLY` header** — and `Uri1155.pingURI` is `onlyOwner`. A non-owner
-    following the paragraph built a reverting tx.
-  - **`site/content/docs/reference/contracts.mdx`** described the pre-audit library architecture: it omitted
-    `AbxMetadataLib` (the fourth delegatecalled library, and the one linked by **all six** token types, not
-    three) and still said `SeriesCode` "rides the ceiling", where `deployments.mdx` — written after the same
-    redeploy — says both code types now sit under EIP-170 with room to spare.
-  - **`deployments.mdx`'s own `specVersion()` example printed `# → 10`** under a table declaring the renderer
-    spec v11. And **`operate.mdx`'s self-correction had rotted**: it warned that `abx refresh`'s advisory was
-    stale about editions and ERC-4906, but that advisory was fixed — the doc was now the stale one.
-
-  Found by two read-only audits (29 doc files, 19 spec files) that verified every claim against contracts,
-  compiled ABIs, SDK and live `--help` output before reporting. Both independently re-confirmed the
-  no-burn property, the v11 gateway design, all ~26 canonical addresses, and the on-chain storage
-  thresholds.
-
-- b1c333d: **Every deploy lane accepted a royalty the chain would refuse.** `set-royalty` was fixed to validate
-  against the contract's 10% cap, but all six deploy paths (`deploy`, `deploy-series`, `deploy-code` and
-  their edition twins) still did a bare `Number(flags['royalty-bps'] ?? 500)` with no bound at all. So
-  `--royalty-bps 1500` built the whole deploy, printed **`royalty 15%`** in the confirmation readout — a
-  promise the chain will not keep — and reverted `RoyaltyTooHigh()` on send. That is the worse half of the
-  bug: the deploy is the expensive transaction, and on the wallet lane the creator approves it first.
-
-  All six now route through the same `parseRoyaltyBps` the owner op uses, so an over-cap value is refused
-  locally, for free, with the cap and the revert named.
-
-  **`abx doctor`'s pruned-history warning is now order-aware.** It fired for any reachable endpoint that
-  cannot serve archive-depth logs, even when a healthy archive endpoint sat ahead of it in the list and would
-  answer every deep scan. Three eval rooms independently called it noise — one said it was "a poor first
-  impression for an already-nervous creator". The hazard it exists for is real but specifically about
-  _ordering_: the fallback transport rotates on error only, so a pruning endpoint listed **first** answers a
-  deep scan with an empty, successful `[]`. `probeRpcEndpoints` preserves list order, so the warning now
-  fires only when the pruning endpoint is ahead of a full-archive one — the case a reader can act on. When
-  no archive endpoint is configured at all, it still fires for every pruning endpoint, because then nothing
-  shadows them.
-
-- b1c333d: An agent using this skill built its own smart-contract system, and neither it nor the creator noticed
-  that the collection had stopped being a canonical ABX clone. Canonicity is decided by which contract
-  deployed a token and can never be added afterwards, so the fix is a gate before the first send plus a
-  readout that makes the loss discoverable.
-
-  **`abx state` now reports canonicity first.** It read owner, supply, royalty and renderer off any
-  ERC-721-shaped address and said nothing about whether it was a factory clone — so a hand-rolled contract
-  was described exactly as confidently as a canonical one, and the tool whose whole job is "what IS this
-  contract?" left nothing behind for the creator to find. `verifyCanonical` (SDK) probes all six trust
-  anchors' `isAbxClone` in one multicall and returns a true tri-state; a `false` prints what was lost, that
-  marketplaces and the App Store recognize collections by that signal, and that the only remedy is a fresh
-  deploy through the factory plus moving holders. `null` (no anchors on this chain, or an RPC failure) is
-  never shown as a "no".
-
-  **The skill gained the boundary rule it never had.** Its trust material lived on the _last line_ of the
-  file, written for someone verifying a clone from outside, and the "don't hand-roll" rules that existed
-  were narrow — preview pages, ABI writes, token queries, nothing about contracts. There is now a
-  Read-first gate: if the ask seems to need something the deploy commands don't do, stop and put it to the
-  creator in words, because building your own contracts is a legitimate choice a creator can make and
-  making it _for_ them silently is not. Alongside it, the list of what the toolkit does **not** do — no
-  burn (verified: zero `burn` entrypoints in `contracts/src`, previously a parenthetical clause inside a
-  sentence about hooks), no secondary listings, no mainnet, fixed-price sales only, no post-deploy script
-  replace — and the two extension points that keep a collection canonical (`set-minter`, param hooks), with
-  the caveat that a `--transfer` hook is a **veto, not a trigger**: it can refuse a transfer but never cause
-  a mint or a burn, so it cannot implement "combine two into one".
-
-  Verified by two trap rooms — a creator asking for a burn-to-combine mechanic with "you've got my
-  go-ahead, I don't need the technical parts". Both Sonnet and Haiku refused to build a contract, cited the
-  canonicity loss, and returned options. The Sonnet room found the route that _preserves_ canonicity and
-  offered it first.
-
-  **SKILL.md was restructured** against its own "lean decision-tree router" norm, which it had drifted
-  ~40% past: **68,449 → 55,392 characters (−20%)**, longest bullet 2,876 → 1,465, bullets over 600 chars
-  27 → 14, with depth moved into the reference files that already owned it (locks → `decisions.md`;
-  install/`.env` → `setup.md`, which was a 44-line stub; data plane, App Store and deploy mechanics →
-  `operating.md`). Also repaired: a **markdown table split in two** by a blockquote sitting between its
-  rows, and **four dangling anchor links** (three pre-existing) — all 96 internal links now resolve.
-  `setup.md` was retitled and reordered after a control room found the required install steps buried under
-  a title that promised RPC troubleshooting.
-
-  **Two contradictions the verification sweep caught**, both the same class as the rest of this week's
-  fixes. `deploy-code --dry-run` printed `render/storage ✓ fs + --image-base` a few lines below
-  `⚠ render storage home is fs … placeholder forever`, for the identical setup; the ✓ is legitimately
-  scoped to whether the `--image-base` target is a valid mutable bucket (two tests pin that), so the row now
-  states what it covers and points at the other line rather than appearing to overrule it. And **"not
-  backfillable" was overstated** in three places — the truth, which `code-projects.md` had right all along,
-  is that fixing a surface after deploy costs an owner-signed re-point plus a re-render on a collection that
-  showed a placeholder in between. Expensive and worth avoiding; not impossible.
-
-- Updated dependencies [b1c333d]
-- Updated dependencies [b1c333d]
-  - @artblocks/abx-sdk@0.1.0-alpha.19
-  - @artblocks/abx-indexer@0.1.0-alpha.20
-  - @artblocks/abx-storage@0.1.0-alpha.19
-  - @artblocks/abx-token-api@0.1.0-alpha.22
-
-## 0.1.0-alpha.26
-
-### Patch Changes
-
-- 77a6248: Fixes from the 2026-08-18 eight-room agent sweep of the content-addressed lanes (ipfs · arweave ·
-  preferred gateways). The v11 gateway projection worked end to end on a live testnet round trip — bare
-  CID on chain, one `set-gateway` tx, byte-identical content id before and after — but the surfaces
-  around it lied, hid, or degraded in five ways that cold agents hit immediately.
-
-  **Both `AbxGenerator` addresses in the manifest had a broken EIP-55 checksum.** The addresses were
-  right; the casing was mangled in transcription. viem validates checksums, so
-  `readContract`/`writeContract` against the recorded value threw `Address "0x2c1b7Cf6…" is invalid` —
-  `abx verify` could not run its on-chain-URI check on **either** testnet. Corrected in
-  `deployments.ts` and the docs mirror, with the code at both fixed addresses re-confirmed on chain
-  (identical bytecode, as CREATE2 requires). The per-entry equality tests stayed green through all of
-  it because they compared against the same mangled string, so the manifest now carries a **property
-  test**: every recorded address must be a valid checksum.
-
-  **A deploy narrated the upload gateway as if it were the served URL.** With
-  `--onchain-uri --backend ipfs`, the progress line printed the backend's own locator
-  (`https://gateway.pinata.cloud/ipfs/<cid>/0.png`) while the chain got a bare CID served from
-  somewhere else entirely — in one run, from `ipfs.io`, because that is the floor and no preference was
-  written. The line now shows the URL the token will actually carry, resolved through the same
-  precedence that decides what gets written (`--ipfs-gateway`/`--arweave-gateway` → `--gateway` for the
-  backend in use → env → floor), and says whether that prefix is the project's choice or the public
-  default filling a silence.
-
-  **`--ipfs-gateway` / `--arweave-gateway` were absent from every deploy command's `--help`.** They
-  appeared only in `set-gateway --help` and the skill's reference pages, so an agent reading the CLI
-  alone could not find the flags the CLI itself tells you to use. All three deploy commands now name
-  them, with the floors (`https://ipfs.io/ipfs/`, `https://arweave.net/`) and the upload-vs-serving
-  distinction stated where the decision is made.
-
-  **`abx storage upload` handed `abx attach` a locator that silently downgraded the attachment.** It
-  printed `abx attach <address> <key> https://gateway.pinata.cloud/ipfs/<cid>/file.png` — and `attach`
-  picks the on-chain representation from the scheme, so an `https://` locator stores a plain `url` with
-  the gateway host welded into the value: no `set-gateway` repoint, exactly the coupling the
-  content-addressed representations exist to remove. Following the command's own printed next step was
-  the wrong move — and the skill had promised the scheme form all along, so the doc was right and the
-  command was wrong. It now hands back `ipfs://<cid>/file.png` / `ar://<txid>/file.png` (both in the prose
-  hint and as `attachLocator` in `--json`), keeps the https URL as the browsable one, and says why they
-  differ.
-
-  **`.abx-self-host/` is now self-ignoring.** It holds this node's projection and, for the Arweave
-  backend, a signing-capable key that carries prepaid upload credits. This repo gitignores that
-  directory and the skill said so — but a _creator's_ repo does not, so a first `--backend arweave` run
-  could leave a key staged for commit with nothing having said a word. The CLI writes a `.gitignore`
-  containing `*` inside the directory before anything sensitive lands there: it ignores the whole tree
-  regardless of the enclosing repo's config, needs no edit to a file we don't own, and never overwrites
-  one that already exists.
-
-  The **local-gateway warning** also stopped over-claiming. It said a `127.0.0.1` gateway means "the
-  served image URL resolves only on THIS machine" — true when the gateway host was welded into the
-  field, false now that the field holds a bare CID, and it aimed the creator at the wrong repair. It now
-  names the damage that is still real: bytes pinned only to a local node cannot be retrieved by anyone,
-  and no gateway can serve content that was never pinned publicly.
-
-  Also: `abx storage status --json` no longer warns `unrecognized flag(s), ignored: --json` about a flag
-  its own usage documents and that visibly works (a readout contradicting itself is worse than no
-  readout), and the `--unsigned` epilogue names `abx add <address>` rather than `abx index <address>`,
-  which fails on a node that never registered the project — the common case for a tx handed to someone
-  else's signer.
-
-- 77a6248: Fixes from the 2026-08-18 six-room agent sweep of the hosted-services lane (managed provider ·
-  self-hosting · conformance). Three surfaces reported a credential problem as something else.
-
-  **`abx remote --conformance` blamed the service for our key.** With a rejected token it correctly
-  reported `the provided token was rejected (401)` — and then ran the authed-tier probes anyway. Each
-  one 401s, and each asserts on a 400, so one stale key produced four further failures reading
-  `bytes for a REFERENCED output (image) → 401 (expected 400; accepting this is how a resolver becomes
-an object store)`. That is an accusation against the operator, and it is the exact inverse of what
-  this command is for: conformance is meant to be checkable from OUTSIDE, before you sign up. A cold
-  agent hit it and had to choose between believing five ✗ marks and explaining them away — it chose to
-  explain them away and told the creator the service was trustworthy. Now a rejected token skips the
-  authed tiers with one note (naming the descriptor's own signup URL), the public tier still runs in
-  full, and the run reports the one failure that is real. 401 is also handled like 403 inside the probe
-  helper, which already knew a credential problem is not a conformance verdict.
-
-  **`abx doctor` reported a dead credential as configured.** It printed `remotes: meridian` for a token
-  the service rejects, because it only checked that the variable was _present_. Doctor is the command a
-  creator is told to run first, so the 401 surfaced much later, from `abx remote <name>`, after that
-  line had already been trusted. Same class as an RPC that answers `[]` because it pruned its logs:
-  presence is not capability. It now makes one cheap authed call per named remote and reports
-  `✓ good · 1 project(s) visible` or `✗ meridian — token rejected (401) — fix or rotate
-ABX_REMOTE_MERIDIAN_TOKEN`. A short timeout with no backoff keeps it quick, a 403 stays a note
-  (provider scoping is not a misconfiguration), and an unreachable provider is a soft note rather than
-  a ✗ — nothing here can fail doctor for a reason the creator cannot act on.
-
-  **`abx deploy-effects` told operators to set a variable that is never read.** The Fly scaffold's
-  storage-secrets block emitted `fly secrets set ABX_ARWEAVE_KEY=…`; no such variable exists anywhere in
-  the toolkit. A hosted runner cannot use the CLI's managed key file either (that path is on the
-  operator's machine), so the line now names `ARWEAVE_JWK` with the JWK inline, which is the form that
-  actually works remotely.
-
-  **A remote register on a self-resolving project claimed a win it did not deliver.** `abx add --remote`
-  printed its successes and stopped. But a project whose `tokenURIRenderer` is set answers `tokenURI`
-  from the chain, so marketplaces and wallets read that document and never touch the service — the
-  registration is still worth having (indexing, the live view, managed rendering) and changes nothing a
-  collector sees. A cold agent, told "put it on a hosted service so it shows up properly", had to
-  reconstruct that from `state` → `tokenuri` → `contracturi` → the docs → a raw curl before it could
-  answer honestly. The register now says it, and the skill states the inverse rule the reference pages
-  never had: a resolver adds nothing marketplace-facing to a project that already resolves on-chain.
-
-  `abx verify`'s help also stopped contradicting itself — "no server needed" read as "needs nothing"
-  while the command refuses until the project is registered locally with `abx add`. It now says "no
-  resolver in the path" and names the prerequisite.
-
-  Skill: stop asserting third-party prices and free tiers. Two rooms in one sweep quoted plan costs to a
-  creator — one lifted "free tier" from our own `hosting.md` (Fly's has since changed), the other
-  invented a monthly Pinata figure out of nothing. We cannot keep another company's pricing current, so
-  the skill now says to name the provider and point at its pricing page, and to compare _shapes_
-  (pay-once vs. monthly; lapses vs. nothing-to-renew) which stay true. Turbo's under-100 KB free tier
-  stays, because the CLI enforces and prints it. The never-read-`.env` rule also moved to the top of
-  SKILL.md: an agent listed and read files while orienting, before it reached that rule twenty lines
-  down, and printed credentials into its own transcript.
-
-- Updated dependencies [77a6248]
-- Updated dependencies [77a6248]
-  - @artblocks/abx-sdk@0.1.0-alpha.18
-  - @artblocks/abx-indexer@0.1.0-alpha.19
-  - @artblocks/abx-storage@0.1.0-alpha.18
-  - @artblocks/abx-token-api@0.1.0-alpha.21
-
-## 0.1.0-alpha.25
-
-### Minor Changes
-
-- c5b8ec3: `ipfs` and `arweave` metadata fields now resolve on both planes, through a gateway the collection
-  chooses — renderer **spec v11**.
-
-  These are the two representations that are content-addressed, the two where the locator IS the
-  integrity hash, and the two this protocol tells creators to prefer. They were also the two the
-  on-chain renderer could not serve. So `abx deploy --onchain-uri --backend ipfs|arweave` worked around
-  it by baking a gateway HOST into a `url` field, which welded a hostname the creator could never
-  migrate and made `abx_provenance` report `source: url` for bytes that live on IPFS.
-
-  The fix separates the two facts that the baked URL had fused. The CID/txid stays in the field, as
-  identity, under that field's own lock. The HTTPS prefix becomes a project-wide preference in two
-  reserved collection-scope fields, `abx_gateway_ipfs` / `abx_gateway_arweave`, with `https://ipfs.io/ipfs/`
-  and `https://arweave.net/` as floors. The renderer, the canonical generator, and the off-chain
-  resolver all read those two fields and apply the same wrap, so a token served from the chain and from
-  a resolver produces the same URL.
-
-  A dead or slow gateway is now a **repoint**, not a rewrite:
-
-  ```bash
-  abx set-gateway 0xYourContract --ipfs https://your-dedicated.mypinata.cloud/ipfs/
-  ```
-
-  One transaction, every token, no re-upload — and it works on fields you have already locked, because
-  the locked value is the CID and the gateway was never in it.
-
-  **What changes for you**
-
-  - `--onchain-uri --backend ipfs|arweave` writes the bare CID (or `cid/{id}.ext` for the O(1) directory)
-    as an `ipfs`/`arweave` field instead of a gateway URL as `url`/`url-template`. `--backend cloud` is
-    unchanged — an HTTPS CDN locator _is_ the address.
-  - New `abx set-gateway <addr> [--ipfs <prefix>] [--arweave <prefix>]` (`none` clears to the public
-    default). Two flags, so a project can pay for a dedicated IPFS gateway and leave Arweave public.
-  - New `--ipfs-gateway` / `--arweave-gateway` on every deploy command. Plain `--gateway` (the
-    storage/upload gateway) seeds the preference for the backend in use, so passing it still does what
-    you meant. Nothing is written when no gateway is named — silence keeps the floor live.
-  - `abx set-field` refuses the two gateway keys and points at `set-gateway`, which validates the
-    prefix, the scope and the representation. Every way to set them by hand fails silently.
-  - The `display.gateway` contract param is **superseded and no longer read**. It could name only one
-    prefix for both schemes and existed only on code projects.
-  - SDK: `projectGatewayPrefix`, `projectGatewayUrl`, `gatewayPrefixFrom`, `contentIdFromLocator`,
-    `GATEWAY_FIELD`, `GATEWAY_FLOOR`. For a host running its own resolver, `ABX_IPFS_GATEWAY` /
-    `ABX_ARWEAVE_GATEWAY` are now a **floor**: a project that stated a preference on chain gets that
-    preference from every conforming resolver, and host config only fills a silence.
-
-  **New canonical addresses** (both testnets; nothing else moved — no token implementation, factory, or
-  `initialize` ABI changed):
-
-  | Contract                         | Address                                      |
-  | -------------------------------- | -------------------------------------------- |
-  | `AbxMetadataRenderer` (spec v11) | `0x85C1aE1F076d808fF7c1729F21B85038Fa16105E` |
-  | `AbxGenerator` (Sepolia)         | `0xb7104AdFa6Fb5615e46E2a681A2Ff043B08fADB5` |
-  | `AbxGenerator` (Base Sepolia)    | `0x2c1b7Cf6C54E4acBcB54FCc395f7Af88eB4fC8Ce` |
-
-  Also fixes a crash on `abx deploy-code --copies`: an undefined `bytes` reference threw a
-  `ReferenceError` at the end of the dry-run plan and, worse, at the confirmation prompt of a real
-  deploy.
-
-### Patch Changes
-
-- Updated dependencies [c5b8ec3]
-- Updated dependencies [5b29f53]
-  - @artblocks/abx-sdk@0.1.0-alpha.17
-  - @artblocks/abx-token-api@0.1.0-alpha.20
-  - @artblocks/abx-indexer@0.1.0-alpha.18
-  - @artblocks/abx-storage@0.1.0-alpha.17
-
-## 0.1.0-alpha.24
-
-### Patch Changes
-
-- 9c287c0: The CLI no longer double-wraps a data URI, lie about managed rendering, or hand zsh an unquoted schema.
-
-  - Inline `image` that is already a `data:` URI is refused — the renderer wraps bytes itself, and
-    storing one produced a blank token with no warning.
-  - Surfaces consult `render.attached` on the public resolver before warning that local `fs` means
-    "placeholder forever".
-  - Undeclared-param advice no longer tells you to schema-declare keys an augment hook supplies.
-  - `--schema` Select/Range examples (help and errors) are quoted so zsh does not glob them.
-  - `attach --help` states URI pairs and `--file` are mutually exclusive.
-  - The skill refuses unfilled `⟨your idea⟩` placeholders and documents one-EOA nonce serialization
-    plus "no replace-script CLI".
-
-  Reported in the 2026-08-18 tester batch (feedback 111e2489, a07e0449, 4cedba82, 52487cde, d5423af5, 58984086, 735ed464, 7ff05a6b).
-
-- b5744a1: `deploy-series` no longer uploads your art before checking it can sign the deploy
-
-  The signing lanes were checked at _signing_ time, which is the end of a deploy. Off-chain custody
-  (`--backend arweave|ipfs|cloud`) uploads the art near the start, before any transaction exists. So
-  `abx deploy-series --dir … --onchain-uri --backend arweave` with no key and no `--dry-run` minted a
-  Turbo identity and pushed the files, then discovered it could never have deployed. Under Turbo's
-  100 KB free tier that upload _succeeds_ — so a run that was always going to fail published the
-  creator's work permanently.
-
-  `assertLaneCanSign` refuses the keyless hot lane and names all three lanes plus the preview. The rule
-  it enforces is the sibling of the `--dry-run` guard on every signing choke point: **a spend or a
-  publish never precedes the check that this run can be signed at all.**
-
-  It sits at the spend, not at the front door. A _validation_ refusal (an ipfs-shaped `--image-base`, a
-  missing `--name`, off-chain metadata with no public URL) must still reach a creator who has no key,
-  because it costs nothing to check and is the more specific answer — so the four image deploy bodies
-  assert just before their first byte leaves. `abx deploy` (1/1) turned out never to have been exposed:
-  it needs the deployer address to predict the clone, so it already refused before uploading.
-  `deploy-code` has no deploy-time upload and is untouched.
-
-  Found by a cold agent that forgot `--dry-run` once and watched it try to spend anyway.
-
-- 9c287c0: PostParams commands refuse unsupported contract kinds before any signing prompt.
-
-  `set-schema`, `configure-param`, and `retire-param` used to surface a raw viem revert on a 1/1 or
-  plain Series. They now detect the kind first and fail as a capability mismatch: SeriesCode /
-  EditionCode only. Help text says the same.
-
-  Reported in the 2026-08-18 tester batch (feedback e47b8ed5, 018ec58a).
-
-- b5744a1: An RPC that has pruned its log history is now detected, named, and routed around
-
-  A public endpoint that no longer holds old logs does not fail your scan — it answers `eth_getLogs`
-  with `[]` and HTTP 200, which is a success. Everything downstream believed it:
-
-  - **`abx doctor` graded it `best`.** The archive probe was
-    `getLogs({address: zeroAddress, fromBlock: old, toBlock: old})` and counted any non-throw as archive
-    access — but `zeroAddress` never emits logs, so an empty result is exactly what a _perfect_ archive
-    node returns too. The assertion could not fail; it only ever caught endpoints that _error_ on old
-    blocks. `ARCHIVE_DEPTH` was also 100k blocks, which on a 2-second chain is inside the retained window
-    of the very endpoints that prune.
-  - **The client never failed over.** The read transport is a viem `fallback` across every configured
-    endpoint, and `fallback` rotates on an _error_. So every retry asked the same endpoint the same
-    question, and a project whose logs sit ready on the SECOND configured endpoint reconstructed as
-    empty.
-  - **`abx add` then registered the project with no state at all**, after grinding half a million blocks,
-    and suggested re-running `--full` "in a minute" — advice that can never work for a pruned index.
-
-  Measured on the two default Base Sepolia endpoints, same address and same window: one returns zero
-  logs for the project's entire history, the other returns them instantly. Ethereum Sepolia's keyless
-  default endpoint shows the same shape past a few hundred thousand blocks.
-
-  - **The probe asserts on something that must come back.** Blocks are retained by everyone; receipts
-    and the log index are what get pruned. `probeHistoryAt` (new SDK export) reads the probe block, asks
-    for one of its transactions' receipts, and — when that receipt carries a log — requires `getLogs` to
-    return that same log. No hardcoded address, no fixture block. `ARCHIVE_DEPTH` is now 500k.
-    It fails **safe**: a probe block with no transactions, or whose transactions logged nothing, keeps the
-    old lenient verdict rather than inventing a failure.
-  - **`abx doctor` names a reachable endpoint that can't serve history**, with the fault and the fix
-    ("history pruned ~500000 blocks back … list a full-archive endpoint FIRST in `ABX_RPC_URLS_<CHAIN>`").
-    Collapsing to the best endpoint hid this, and ordering is what decides who answers the scan.
-  - **An empty scan now retries each endpoint on its own** before giving up, and says which one served
-    the logs. Cheap by construction: each endpoint is first asked whether it holds history at _this
-    project's_ deploy block — three calls — and only one that passes gets a scan.
-  - **`SelfHostIndexer.reindex(address, {rpcUrl})`** pins a single endpoint instead of the pool, which is
-    what makes that rotation expressible. Clients are pooled per (chain, endpoint), so the default path
-    is unchanged.
-  - The final failure message now separates the two cases it had merged: a project you _just_ deployed
-    (transient, retry) from one that is not new (retention — check `abx doctor`).
-
-  Found by direct probing during the 2026-08-17 agent sweep, after an `abx add` of a 12-day-old Base
-  Sepolia edition reconstructed zero of its 18 events.
-
-- 9c287c0: On-chain script chunks no longer insert a newline in the middle of a token.
-
-  The generator joins chunks with `'\n'`. A fixed 22 kB slice could split `mass` into `ma` + `ss`,
-  producing a SyntaxError on chain while `abx verify` still went green. Template-mode deploys now
-  split at an existing newline so that join is byte-identical to the source, refuse a 22 kB+ span
-  with no newline, and parse the program before any gas.
-
-  Reported in the 2026-08-18 tester batch (feedback 38455765, 038d7ed2, 8c256d9d, 50e53193).
-
-- b5744a1: Four wording fixes from the 2026-08-17 agent sweep
-
-  - **A broken sentence at a decision point.** An edition's allocation warning read _"To sell 250, raise
-    this id's cap is not possible (caps only decrease) — set --allocation 15"_ — pattern-matched off the
-    721 branch, where "redeploy a Series with a higher `--max`" fits the grammar and an edition's
-    decrease-only cap does not. Now: _"Selling 250 isn't reachable: this id's cap can only ever
-    DECREASE."_ The warning stays a warning: allocation is a ceiling, over-allocating isn't destructive,
-    and holding reserves is legitimate.
-  - **`abx help`'s `--copies` line promised a guard that doesn't exist**, claiming deploy-code's edition
-    lane is "--script only, no --dep/--code-dir/--image-renderer". `--dep`/`--dep-registry` are fully
-    wired on EditionCode and `abx help deploy-code` already documented them as working — only the
-    top-level summary was stale, which is the line an agent reads first. The flag allowlist's comment
-    said the same thing and is corrected too.
-  - **`reference/decisions.md` pattern 4** stated `--onchain-uri` for a 1/1 inline SVG without the size
-    crossover the same file gives 58 lines later, so the row alone pointed the wrong way for the 2.4 KB
-    example art.
-  - **The eval harness** now allowlists `ABX_CHAIN=<chain> abx …` in a clean room (`Bash(abx:*)` does not
-    match an env-prefixed command, which left three rooms unable to reach a contract on the non-default
-    chain), and `docs/agent-eval/README.md` records both that trap and the one where a room reaches
-    outside its sandbox via `abx skill install --global`.
-
-- Updated dependencies [9c287c0]
-- Updated dependencies [b5744a1]
-- Updated dependencies [9c287c0]
-  - @artblocks/abx-sdk@0.1.0-alpha.16
-  - @artblocks/abx-indexer@0.1.0-alpha.17
-  - @artblocks/abx-storage@0.1.0-alpha.16
-  - @artblocks/abx-token-api@0.1.0-alpha.19
-
-## 0.1.0-alpha.23
-
-### Patch Changes
-
-- 7fec2d7: An edition's per-id cap now folds from the log, so a capped edition stops reporting itself as open
-
-  `DefaultMaxSupplySet` — added in the contract-audit release precisely so the log could tell an open
-  edition from a capped one — reached the ABI and stopped there. `reconstruct.ts` had no fold case, so
-  the collection-wide default never landed in `ProjectState`, and **the common shape was the broken
-  one**: `--copies N` sets the cap at `initialize` and never calls `setMaxSupply`, so no id has a
-  `MaxSupplyUpdated` of its own and every capped edition ever deployed folded as _uncapped_. The
-  head-read lane (`listTokens`, which calls `maxSupply(id)`) said `N` the whole time — one field name,
-  two answers, on the value that decides whether a buy button renders. Found by the abx-services team
-  while upgrading their resolver/indexer to this release.
-
-  - **`ProjectState.defaultMaxSupply`** — the collection-wide per-id default (`'0'` = open; `null` ⇒ not
-    an edition). The 1155 analogue of `maxInvocations`.
-  - **`TokenState.maxSupply` is now the _effective_ cap** — an id's own override, else that default —
-    and so equals `maxSupply(id)` on chain and its head-read twin `TokenRow.maxSupply`. Previously it
-    was the override alone, and absent otherwise.
-  - **`TokenState.maxSupplyOverridden`** — whether this id has ever been explicitly overridden. The
-    distinction the on-chain getter cannot express (`maxSupply(id)` returns `0` for both "never capped"
-    and "deliberately closed") and the log now can, plus a signal that the monotonic never-increase rule
-    is in force for that id.
-  - **`editionCapOf(token)`** — new SDK export returning `{kind:'open'} | {kind:'capped', cap} |
-{kind:'closed'}`, so nothing re-derives the rule. Used by the dashboard and `abx tokens`; pass a
-    head-read row and a `'0'` cap reads `open`, which is all a state read can honestly say.
-  - **The dashboard stops lying twice.** It tested `maxSupply` for truthiness: a `--copies 10` id read
-    "(open)", and — because `'0'` is a non-empty string — an id deliberately closed would have read
-    "12 / 0". It now reads "12 / 10" and "12 (closed — no more can be minted)".
-  - **Projection columns**: `projects.default_max_supply`, `tokens.max_supply_overridden` (migration-added,
-    so an existing store keeps working; NULL stays NULL rather than becoming a fabricated `0`).
-
-  Also in this pass, from the same review:
-
-  - **`SPINE_EVENT_DOC` had drifted to 41 of 52 events**, so eleven folded events carried an empty
-    human description and defaulted to Register 2 — including `TransferValidatorUpdated`, which belongs
-    to Register 1, and the factory's `Deployed`. All eleven are described, and a new
-    `spine-doc-coverage.test.ts` fails the build if the table and the spine ABI drift apart again in
-    either direction.
-  - **One provenance body in the resolver's `renderer` branch.** The `text/uri-list` arm hand-built an
-    object byte-identical to `onChainProv(field, 'renderer', …)` — same keys, same order, the note string
-    typed a second time — so the only thing that branch could do was drift from `sourceNote`.
-  - **Dead `abx_params`-era test scaffolding deleted** (a `paramsOf(json) => json.abx_params` reader, an
-    RPC stub, a schema factory), including an import of a `ParamMember` type that no longer exists —
-    which nothing caught, because `tsconfig` includes only `src`, so test files are never typechecked.
-
-- Updated dependencies [7fec2d7]
-- Updated dependencies [7fec2d7]
-  - @artblocks/abx-token-api@0.1.0-alpha.18
-  - @artblocks/abx-sdk@0.1.0-alpha.15
-  - @artblocks/abx-indexer@0.1.0-alpha.16
-  - @artblocks/abx-storage@0.1.0-alpha.15
-
-## 0.1.0-alpha.22
-
-### Minor Changes
-
-- 1b6b741: Rename "artist" to "creator" throughout, including the protocol vocabulary
-
-  ABX is a tool for creators generally. Art remains a first-class use case, but it should not be baked
-  into the product's framing — and it was, down to the on-chain identifiers.
-
-  **Breaking, and deliberately a clean break** (pre-launch, folded into the one redeploy that four
-  rounds of security remediation already required — deferring would have meant either living with the
-  old vocabulary permanently or spending a second deployment on a word):
-
-  - `AuthOption` is now `Creator`, `TokenOwner`, `Address`, `CreatorOrTokenOwner`, `CreatorOrAddress`,
-    `TokenOwnerOrAddress`, `CreatorOrTokenOwnerOrAddress`. Order is unchanged, so the `uint8` values
-    are identical — only the names moved. Users type these: `--schema key:Type:Creator`.
-  - The on-chain collection metadata field keys `artist` / `artist_links` are now `creator` /
-    `creator_links`. These are `bytes32` keys written on-chain and emitted verbatim into every
-    collection's `contractURI` JSON.
-  - CLI flags `--artist` / `--artist-links` are now `--creator` / `--creator-links`. No aliases.
-  - `@artblocks/abx-token-api` renames its `art` module to `content`: `generateArt` →
-    `generateContent`, `artContentHash` → `contentHash`.
-  - `AbxMetadataRenderer.SPEC_VERSION` is **7**, and `isCurrentRenderer` gates on it. A v6 renderer
-    emits a different member key, so it is genuinely behind, not cosmetically so.
-
-  Package CHANGELOGs are left alone on purpose: they record what past alpha versions actually shipped,
-  and rewriting them would make the release history lie about flag names that really were `--artist`.
-
-- 1b6b741: A purchase now carries the terms the buyer accepted — closing the one path by which a project owner
-  could take more than the buyer agreed to.
-
-  Both shared fixed-price minters take a mandatory **terms guard** — not a slippage allowance; see the note
-  below — and revert a new `SaleTermsChanged()` when the live sale doesn't match:
-
-  ```solidity
-  purchase(address token, address expectedPaymentToken, uint256 maxPrice)
-  purchaseTo(address token, address to, address expectedPaymentToken, uint256 maxPrice)
-  // 1155 — the bound is the TOTAL, since qty multiplies it
-  purchase(address token, uint256 id, uint256 qty, address expectedPaymentToken, uint256 maxTotalPrice)
-  purchaseTo(address token, uint256 id, uint256 qty, address to, address expectedPaymentToken, uint256 maxTotalPrice)
-  ```
-
-  `configure` takes effect immediately and has no timelock. On the ETH lane that was largely contained
-  (`msg.value` must equal `price`), but an ERC-20 sale settles `safeTransferFrom(buyer, payee, price)`
-  against a standing allowance — so an owner who front-ran a pending purchase with a huge price spent the
-  buyer's whole approval, and one who switched the sale to a different ERC-20 reached an allowance granted
-  somewhere else. `address(0)` as `expectedPaymentToken` means ETH. There is deliberately no "no maximum"
-  sentinel: a bound that can be defaulted away is the bug being fixed.
-
-  SDK (breaking): `preparePurchase` / `preparePurchase1155` take the live terms — `sale`, exactly what
-  `readSaleConfig` / `readSaleConfig1155` returns — instead of a hand-computed `value`. They derive the
-  ETH to attach (`price`, or `price × quantity`) and the bound from those terms, so the payment and the
-  guard cannot desync. Pass `maxPrice` / `maxTotalPrice` to state a wider ceiling (a UI that tolerates a
-  small move rather than making the buyer re-sign); it widens the guard only, never the payment. New
-  exported type `PurchaseTerms`.
-
-  **`maxPrice` is not slippage tolerance on the ETH lane, and the docs no longer imply it is.** The minter
-  requires `msg.value == price` (an equality) and V1 has no refund path, so an in-flight ETH purchase
-  reverts if the price moves in _either_ direction, however wide the ceiling. Real tolerance exists only on
-  the ERC-20 lane, where the live `price` is pulled from the buyer's allowance and anything at or below the
-  ceiling settles.
-
-  CLI: `abx minter buy` hands the terms it just read to the SDK (the price × quantity math now lives in
-  one place), and the scaffolded `abx mint-page` binds each mint to the terms the page is displaying —
-  if the owner re-prices mid-click the mint reverts, nothing is charged, and the page tells the buyer to
-  review the new price. Re-pricing a live sale therefore fails the buys already in flight, by design:
-  pause first if you want a clean cutover.
-
-  **Deploy note:** this is a runtime change to two shared singletons, so both need a redeploy on every
-  supported chain (CREATE2 + canonical salts, so the new addresses are identical cross-chain) and the new
-  addresses recorded in `packages/sdk/src/deployments.ts` +
-  `site/content/docs/reference/deployments.mdx`. Until then the CREATE2-prediction-vs-manifest tests fail
-  on purpose — that is the drift detector doing its job, not a broken test.
-
-- 1b6b741: The configure hook can see a blob's size and contents — so creators can police it instead of the protocol
-
-  `IAbxConfigureHook.onParamConfigured` gains two arguments:
-
-  ```solidity
-  function onParamConfigured(
-      uint256 tokenId,
-      bytes32 key,
-      bytes32 value,          // the literal on the scalar path; keccak256(data) on the blob path
-      address updatedBy,
-      uint256 dataLength,     // 0 on the scalar path; data.length on the blob path (never 0 there)
-      address dataBlobAddress // address(0) on the scalar path; the live SSTORE2 pointer otherwise
-  ) external;
-  ```
-
-  **Why.** On a multi-copy edition params belong to the id, so a holder-writable `String`/`Bytes` key is
-  shared: one holder could store large values and make the shared id's document expensive for every
-  co-holder. An independent audit asked for a protocol byte ceiling. A ceiling would cap every project
-  to police a configuration almost nobody wants — but the alternative we had documented, "the creator
-  constrains it in their own hook", was not actually possible: the hook only ever saw `keccak256(data)`.
-  It could not learn the length, could not read the content, and could not read the new value from
-  storage either, because nothing had persisted yet. Now it can, and no protocol limit is imposed.
-
-  **The bytes are not forwarded** — a blob can be nearly a full contract's worth of data, and putting it
-  in calldata would make every configure call pay for it whether the hook looks or not. A hook enforcing
-  a size ceiling reads `dataLength`; a hook that needs content calls `SSTORE2.read(dataBlobAddress)` and
-  pays for exactly what it asked for. Guaranteed: `keccak256(SSTORE2.read(dataBlobAddress)) == value`.
-
-  **Two things to know when writing one.** `tokenParamData(tokenId, key)` still returns the OLD value
-  inside the hook (that is what "before the value persists" means — and it lets you veto a regression).
-  And the blob is written _before_ the hook, because an address is meaningless until the contract behind
-  it exists; so a veto happens after the writer paid to store the bytes. The accepted path costs the
-  same as before, only rejection wastes, and it wastes only the rejecting writer's own gas.
-
-  `ConfigurableParams` is extension **v3** — the beacon's `extensionVersion` is how an integrator tells
-  which calling convention a deployed token uses. A hook written for the 4-argument form will revert
-  against a v3 token, and vice versa.
-
-  Addresses: `AbxParamsLib` moved, `AbxEditionLib` with it (it links it), and the four token types that
-  compose `ConfigurableParams` moved with their factories — `SeriesCode`, `EditionCode`,
-  `OneOfOneEdition`, `EditionImage`. The two ERC-721 image types and their factory, `AbxMetadataLib`,
-  `AbxCodeLib`, the renderer, chunk store, seed source and both minters keep their addresses.
-
-- 1b6b741: Renderer spec v10 projects four long-reserved keys; edition trust anchors move
-
-  **Renderer spec v10.** Four keys the spec reserved from the start were projected on chain by nothing:
-  `background_color` and `youtube_url` (token), `banner_image` and `featured_image` (collection). A
-  documented reserved key that no surface emits is a hole rather than a saved byte — a creator sets it,
-  observes nothing, and cannot tell whether the tool or the marketplace is at fault. All four now project
-  when their representation is chain-reachable, and are omitted when unset. `isCurrentRenderer` gates on
-  10; a v9 renderer silently drops them.
-
-  **`collaborators` is no longer a reserved key.** It was in the registry, projected by neither plane, and
-  because reserved keys are excluded from the resolver's `artifacts` listing, setting it on chain did
-  nothing observable anywhere. It is now an ordinary creator key — which means it **does** list in
-  `artifacts`. Put a collaborator list in a named artifact (`abx attach`) or in `description`.
-
-  **The resolver's two collection image keys are now symmetric with the renderer.** `featured_image` is a
-  top-level `contractURI` key instead of artifacts-only, and `banner_image` projects for every
-  chain-reachable representation instead of only `url` (an `inline` or `reader` banner used to vanish).
-
-  **Docs now carry the three-list split** — which keys both planes project, which are the off-chain
-  resolver's alone by design (`abx_provenance.status`, operator overlay, effects/live-view, the
-  `artifacts` listing, collection `image` courtesy, `image_data`, off-chain-decode values), and which are
-  not reserved at all. That split is the thing to read before adding a key to either surface: drift on a
-  key both planes _can_ emit is what produced three earlier remediations.
-
-  **Addresses.** The three edition factories move (trust anchors) along with their implementations, and
-  the renderer moves. `AbxEditionLib`, `AbxMetadataLib`, `AbxCodeLib`, `AbxParamsLib`, all three ERC-721
-  factories, the chunk store, the seed source, both minters and both generators keep their addresses.
-  Existing clones keep running their frozen implementations; re-point a live collection at the new
-  renderer with `abx set-renderer` rather than redeploying it.
-
-- f64a31f: Expose `lockScript` above the contract layer — the lock that actually freezes a code project's work.
-
-  `SeriesCode`/`EditionCode` have always had `lockScript()` (and `scriptLocked()`), but nothing above
-  the ABI surfaced it: the SDK had no `prepareLockScript`, the CLI had no `lock-script` command, and the
-  skill's immutability guidance told creators that `lock-field` + `lock-uri` made a project "provably
-  immutable". For a generative/code drop that is false — those freeze only the _metadata_; the owner can
-  keep rewriting the on-chain program (`setScriptChunk`/`removeLastScriptChunk`) until the script is
-  locked. Agents building on ABX repeatedly missed that the program could be frozen at all.
-
-  - **SDK:** new `prepareLockScript({contract, chainId})` (mirrors `prepareLockDependencies`).
-  - **CLI:** new `abx lock-script <address>` command (any signing lane), plus `abx verify` now reports
-    the script and dependency lock state for code projects (`script: locked/UNLOCKED`, with a nudge to
-    `lock-script` when the program is still mutable) — read from the already-indexed state, no extra RPC.
-  - **Skill:** the immutability guidance now names the full freeze for a code drop
-    (`lock-script` + `lock-dependencies` + `lock-field`/`lock-uri`, plus `set-schema … lock=now` for a
-    param value), corrects the "provably immutable" claim, and surfaces PostParams as a first-class
-    `deploy-code` capability (not only a generative feature) in the `SKILL.md` description and decision
-    tree so collector-settable on-chain parameters are discoverable.
-
-- 1b6b741: Independent-audit remediation: `abx_provenance` reshaped, `abx_params` removed, hook ABI widened
-
-  An independent adversarial audit of the contracts found no Critical or High issue, no theft path and
-  no cross-project reach — but four Mediums, eight Lows and five architectural notes. Everything is
-  addressed. Consumer-visible changes:
-
-  **`abx_provenance` entries are now `{field, source, note}`.** They lost `onChain`, which was wrong in
-  both directions — a `url` reported `false` although the URL string is stored on chain, while an
-  `inline` value of `"https://…"` reported `true` for a pure pointer — and `verifiedAgainstChain`,
-  which was hardcoded `null` on every entry. `source` says where the bytes came from; whether a value
-  resolves on chain is visible in the value, and that judgment belongs to the reader. The off-chain
-  resolver drops `onChain` for the same reason (it was exactly `status === 'on-chain'`) and keeps
-  `status`, which it can genuinely compute.
-
-  **`abx_params` no longer appears in `tokenURI`.** It was emitted by the on-chain renderer AND the
-  resolver and parsed back by nobody. Params enumerate directly from the contract — `tokenParamKeys`,
-  `tokenParam`, `paramSchemaKeys` — which is canonical, needs no indexer, and is what a chain-only
-  reader should use; a code project's script still receives them through `tokenData`. Traits for
-  marketplaces belong in `attributes`, unchanged.
-
-  **A computed `image` locator now lands verbatim.** A field renderer returning
-  `("text/uri-list", "ipfs://…")` was being data-wrapped into `data:text/uri-list;base64,…`, which no
-  marketplace dereferences. `image` and `animation_url` now share one implementation of the rule.
-
-  **`IAbxTransferHook.onTokenTransfer` gains `operator` and `amount`.** Without them a hook on a
-  shared-supply ERC-1155 cannot tell a real transfer from a zero-amount no-op — which let any address
-  fire the param lifecycle for an id it held no copy of. The token also refuses to notify on
-  zero-amount and self-transfers.
-
-  **`pingURI` is owner-only**, and `paramSchemaHead` / `selectOption` are new: resolving one selected
-  option no longer copies the whole option table on every render.
-
-  `AbxMetadataRenderer.SPEC_VERSION` is 8. Every canonical address moves — every token type is now
-  library-linked, including the two ERC-721 image factories, because the metadata field store was
-  externalized into the new `AbxMetadataLib` to restore EIP-170 headroom before any fix was stacked on
-  top of 187 bytes of margin.
-
-  The CLI now warns when `--copies` meets a holder-writable `--schema`: on an edition, params belong to
-  the id, so every holder shares one value and the last writer wins.
-
-- 1b6b741: The custom seed source is now a real choice, not a documented one
-
-  We tell creators — in the docs, in `AbxSeedSource`'s own NatSpec, and in `deploy-code --help` — that the
-  canonical mint seed is pseudorandom and that the answer for anything lottery-like is to point
-  `seedSource` at their own `IAbxSeedSource` over commit-reveal or a VRF oracle. On-chain that was always
-  true. In the toolkit it was not: there was no flag, no owner command, and the only route was an
-  `ABX_SEED_SOURCE` env var validated as nothing more than "has code at this address". A doc/code
-  contradiction of our own making, now closed at both ends.
-
-  **Deploy:** `abx deploy-code --seed-source <0x…|canonical>` (and the `--copies` edition lane). Omitting
-  it is unchanged — the canonical `AbxSeedSource` from the manifest, bootstrapped on a chain that lacks
-  one — and `--no-seed` still means no mint-time seed at all. Passing both is refused rather than resolved
-  in someone's favour. `ABX_SEED_SOURCE` keeps working and is no longer the unchecked lane.
-
-  **After deploy:** `abx set-seed-source <address> <0x…|canonical|none>` — owner-only, same positional
-  grammar as `abx set-transfer-validator`. It surfaces the on-chain `setSeedSource(address)` that nothing
-  reached before. **Future mints only**: a seed settles the instant it is assigned, so nothing already
-  minted changes. The command says so, names the count of tokens already carrying a seed from the old
-  source, and points out that a part-sold drop then spans two sources — public on the spine
-  (`SeedSourceSet`) but not something an early buyer is told, so pause and say so.
-
-  **`abx state` now prints the seed source**, labelled: `none`, the canonical singleton, or `CUSTOM`. It is
-  the one setting an owner can re-point mid-sale that changes what a later buyer receives, and it was
-  readable nowhere.
-
-  **Both writes probe the address first, and `code.length > 0` is not the check.** The SDK gained
-  `probeSeedSource` — one `eth_call` to `seed(uint256,address)`, which must return 32 bytes — plus
-  `readSeedSource`, `prepareSetSeedSource`, `assertSeedSourceUsable`, and a `SeedSourceUnusableError`
-  carrying a structured verdict. Four shapes are refused, each with its own message: **no code**;
-  **empty return** (the permissive-fallback shape — a Safe, an uninitialised proxy, an EIP-7702-delegated
-  EOA; pasting your own wallet is the common way in); **a return under 32 bytes**; and **a revert** (either
-  the wrong address entirely, or a real source not yet armed — `seed()` is called synchronously inside the
-  mint and its revert bubbles, so a source that cannot answer now cannot answer at mint either). The
-  interface is non-`view` on purpose, but an `eth_call` simulates a state-keeping source fine, so
-  commit-reveal and oracle-fed sources probe without sending anything. This matters because a
-  misconfigured seed source is **completely silent**: the write succeeds, `seedSource()` reads back what
-  you set, the event fires, `abx state` shows it — and then every mint of the collection reverts in the
-  token's `bytes32` decode. Same spirit as `CreatorToken._requireHasCode`.
-
-  **Naming fix: a `seed` param schema is not a "re-roll", and no longer described as one.** The governed
-  path is `configureTokenParam(tokenId, "seed", value)` — **the caller supplies the value**. Nothing is
-  re-randomized and the seed source is never consulted again; with an unbounded `Uint256Range` the
-  authorized party may set any 32-byte value, repeatedly, until they like the output. "Re-roll" promises a
-  buyer a fresh random draw they could reasonably expect to be fair, which is not what they get. It is a
-  collector-chosen (or creator-chosen) seed, and the docs, the specs, and the skill now say that. The
-  substance that was correct is unchanged: the schema is a pre-sale commitment (declarable only before the
-  collection's first seed exists), `paramSchema("seed")` is the buyer's read, and the type must be a
-  literal/scalar one.
-
-  **Dropped a stale warning** in the skill about a `seed` schema changing how the seed decodes off-chain
-  while the on-chain generator injects raw hex — `tokendata.ts` returns the raw hex for `seed`
-  unconditionally, ahead of the schema branch, so the wire format is invariant across both surfaces and
-  there is nothing left to warn about.
-
-  **Also corrected: `maxPrice` is a terms assertion, not slippage tolerance.** On the ETH lane the minter
-  requires `msg.value == price` (an equality) and V1 has no refund path, so an in-flight ETH purchase
-  reverts if the price moves in _either_ direction, however wide the ceiling — widening `maxPrice` on an
-  ETH sale buys the buyer nothing. Real tolerance exists only on the ERC-20 lane, where the live price is
-  pulled from the buyer's allowance. `specs/protocol/minter-spine.md` and
-  `site/content/docs/protocol/minting.mdx` said "a price cut still settles" without that distinction.
-
-- 1b6b741: Renderer spec v9: a computed image is carried once, not twice
-
-  A field-renderer-produced image was emitted as the reserved `image` key **and again** inside the
-  `artifacts` manifest, then the whole document was base64-encoded around both copies. On the
-  on-chain-SVG lane that roughly doubled the inner payload of `tokenURI` — the one read this protocol
-  most wants to stay within ordinary RPC limits.
-
-  The data-plane spec always allowed an on-chain renderer to omit entries duplicating reserved keys it
-  already emits ("an EVM-efficiency reduction, never a semantic one"). The renderer now takes that for
-  every reserved key, so on a fully-on-chain project `artifacts` is absent rather than empty. Nothing is
-  lost, because the entry's only unique contribution was a `mimeType` and a `data:` URI states its own.
-  The off-chain resolver still emits the complete listing, duplicates included — that asymmetry is the
-  spec's, and it is now documented on both surfaces.
-
-  Also removed: three orphaned param getters on the renderer (`paramKeysOf`, `paramSchemaOf`,
-  `paramDataOf`), stranded when v8 took params out of `tokenURI`, whose NatSpec still claimed `tokenURI`
-  called them.
-
-  `AbxMetadataRenderer.SPEC_VERSION` is **9** and `isCurrentRenderer` gates on 9. Only the renderer
-  moves — nothing links it, so no factory or implementation address changes. Existing on-chain-URI
-  projects keep resolving through the v8 renderer until re-pointed with `abx set-renderer`.
-
-- 1b6b741: Upgrading from alpha.12/alpha.13 — what breaks, in one place
-
-  This release lands the contract-audit branch. It is a **compatibility break with earlier alphas**, which
-  is fine at this stage (greenfield alpha, no backwards-compatibility promise) but is worth having in one
-  list rather than spread across a dozen changesets. Nothing here is a deprecation with a migration
-  window; the old shapes are gone.
-
-  **Every canonical address moved**, and four manifest fields are new (`metadataLib`, `paramsLib`,
-  `codeLib`, `editionLib` — the delegatecalled write-path libraries). Resolve through `getDeployment` and
-  the upgrade is transparent; anything you have _stored_ keyed by a factory address is not. A project
-  indexed from a superseded anchor reads `isCanonical: false` against the new manifest — correct, since it
-  is what a creator sees if they don't redeploy, but it is a data question, not a version bump.
-
-  **The metadata document changed: renderer spec v4 → v9.** If you assemble or assert on it:
-
-  - `abx_provenance` entries lost `onChain` (it was exactly `status === 'on-chain'`, and wrong in both
-    directions) and `verifiedAgainstChain` (hardcoded `null` on every entry). `source` and `status` stay.
-  - The `abx_params` block is gone from **both** lanes. Params enumerate from the contract —
-    `tokenParamKeys` / `tokenParam` / `paramSchemaKeys` — which is canonical and needs no indexer; a code
-    project's script still receives them through `tokenData`.
-  - `artist` / `artist_links` are now `creator` / `creator_links` (reserved on-chain collection field
-    keys), and `AuthOption.Artist*` is `AuthOption.Creator*` (numeric values unchanged).
-  - A computed `image` locator (`text/uri-list`) lands **verbatim** instead of being wrapped into a
-    `data:` URI no marketplace dereferences.
-  - The on-chain renderer no longer duplicates a computed image into `artifacts`. The off-chain resolver
-    still emits the complete listing — that asymmetry is specified, not a bug.
-  - Four long-reserved keys now project on chain: `background_color`, `youtube_url` (token) and
-    `banner_image`, `featured_image` (collection). `featured_image` also becomes a top-level resolver key
-    instead of artifacts-only, and `banner_image` projects for every chain-reachable representation
-    rather than `url` alone.
-  - `collaborators` is **no longer reserved** — projected by neither plane and excluded from `artifacts`
-    by its own reserved-ness, so it did nothing. It is now an ordinary creator key that does list.
-
-  **`tokenData` divergences fixed, so rendered output can change:** a contract-scope `seed` no longer
-  leaks into a token's `tokenData` (the on-chain generator never read one), `seed`'s wire format is always
-  raw 32-byte hex regardless of schema, and `</script` escaping is case-insensitive to match the on-chain
-  generator. Cached renders for affected code projects should be re-derived.
-
-  **Removed:** `paramKeysOf`, `paramSchemaOf`, `paramDataOf` on `AbxMetadataRenderer` — orphaned when
-  params left `tokenURI`. Read the token directly instead.
-
-  **Two hook interfaces widened** (`ConfigurableParams` is extension **v3**; a hook built for the old
-  signature reverts against a v3 token): `IAbxTransferHook.onTokenTransfer` gained `operator` + `amount`;
-  `IAbxConfigureHook.onParamConfigured` gained `dataLength` + `dataBlobAddress`.
-
-  **Additive:** `ParamHooksFrozen` folds into `ParamHooks.locked`; `paramSchemaHead` + `selectOption`
-  replace pulling a whole option table to resolve one index; `readParamHooks`; `abxJs()` / `gunzipScript()`
-  on the generator for piecewise document assembly; and the three ERC-1155 ABIs now carry
-  `MetadataUpdate` / `BatchMetadataUpdate` / `DefaultMaxSupplySet`, which were emitted but not decodable.
-
-- 1b6b741: Transfer-validator authorization has one home, and the five affected trust anchors move
-
-  `CreatorToken1155.setTransferValidator` performed no authorization at all, and the library it
-  delegates to performed none either. What protected the three edition token types was that each one
-  _overrode_ the setter to run the caller check first — one guard in three copies, sitting in front of
-  an unguarded mixin whose own comment claimed the tokens carried no override. Nothing deployed was
-  vulnerable, but a fourth edition type that simply inherited the mixin would have shipped an
-  unauthenticated `setTransferValidator`, which decides whether collectors' tokens can move at all.
-
-  The guard now runs in the mixin, the overrides are gone, and the function is no longer `virtual` —
-  so the arrangement is enforced by the compiler rather than by a comment. A dead
-  `_requireMinterOrOwner` in `ExternalMinter`, whose NatSpec wrongly advertised it as the mint-time auth
-  check (the real one also enforces `paused()`), is deleted in the same pass.
-
-  **Both changes are source-only** — the compiled runtime bodies are byte-identical before and after,
-  measured across all ten affected artifacts. Only the metadata hash differs, and since that is part of
-  the initcode, the CREATE2 addresses move. Five factories and their implementations are redeployed and
-  re-verified on Sepolia and Base Sepolia: `SeriesImageFactory`, `SeriesCodeFactory`,
-  `OneOfOneEditionFactory`, `EditionImageFactory`, `EditionCodeFactory`. Everything else — the 1/1 image
-  factory, all four libraries, the renderer, chunk store, seed source, both minters, both generators —
-  keeps its address.
-
-  Projects deployed from the superseded factories keep working, but `abx` will report their anchor as
-  an older version. Redeploy from the anchors in the refreshed manifest.
-
-### Patch Changes
-
-- 1b6b741: `ABX_CHAIN` in a `.env` now actually selects the chain
-
-  Found by a cold sandbox agent: the creator asked for Sepolia, put `ABX_CHAIN=sepolia` in `.env`, and
-  got a **Base Sepolia** preview with no error. The agent scored it 3/5 and called it "a serious trust
-  problem for a tool whose entire pitch is 'here's exactly what would be deployed'". It was right.
-
-  `config.ts` derives `CHAIN` as a module-level const, so it evaluated while the import graph loaded —
-  before `main()` called `loadDotEnv()`. Every other setting escaped this by being read lazily inside a
-  function (`storageOptions()`, the signing key at send time), by which point `.env` was loaded.
-  `ABX_CHAIN` was the one eager read, and the worst one to lose: on a funded send it is a wrong-chain
-  deploy with real artifacts at an address nobody meant.
-
-  The same ordering hid a second symptom: `assertKnownChainEnv()` also runs at module scope, so a typo
-  like `ABX_CHAIN=mainnet` in `.env` read as "unset" and the CLI quietly used the default instead of
-  printing its "not a chain this toolkit ships / mainnet is not supported yet" refusal. Both are fixed
-  by loading `.env` before the chain is derived, and both are covered by tests.
-
-- 1b6b741: Externalize the code-custody READ surfaces into `AbxCodeLib` — B22 step 2, buying back the bytes the ERC-4906 audit fix spent
-
-  The audit remediation that made `OnChainMetadata`'s field writes emit ERC-4906 (closing a real finding:
-  that surface mutated `tokenURI` silently, so a correct indexer served the pre-edit document forever) cost
-  ~96 B per token, and `SeriesCode` and `EditionCode` had no room for it — both fell under the 150 B EIP-170
-  floor `contracts/test/CodeSize.t.sol` guards. That is precisely the trigger condition `docs/10-backlog.md`
-  B22 was written for, and step 2 was the prescribed answer.
-
-  The `IAbxOnChainScript` and `IAbxDependencies` view bodies now live in `AbxCodeLib`, next to the write
-  paths that were already there — `scriptChunkCount`/`scriptChunk`/`scriptLocked` and
-  `dependencyCount`/`dependencyByIndex`/`dependencyRegistry`/`dependenciesLocked`. The mixins keep the
-  functions (same signatures, same ABI, same ERC-165 ids) as **raw-calldata passthroughs** through a new
-  shared `AbxCodeDelegate` base, which forwards the call's exact calldata to the library and returns the
-  return data untouched. Storage still resolves in the token's own ERC-7201 namespaces and events still log
-  from the token — that is what `delegatecall` buys.
-
-  Raw, not typed, on purpose: B22 step 1 measured a _typed_ shell (`return AbxCodeLib.f(...)`) **growing**
-  the token by ~855 B, because decoding the library's return value and re-encoding it at the call site costs
-  more than the extracted body saves. The same mistake was made again during this remediation, on
-  `setTokenField`/`setContractField`, and reverted. The price of the raw form is that `AbxCodeLib`'s read
-  signatures are now part of every composing token's external ABI — same signature ⇒ same selector is the
-  whole mechanism — so they must track the interfaces verbatim; both the library and the mixins now say so.
-
-  EIP-170 margins, before → after:
-
-  | contract      | before | after   | floor |
-  | ------------- | ------ | ------- | ----- |
-  | `SeriesCode`  | 125    | **529** | 150   |
-  | `EditionCode` | 132    | **507** | 150   |
-
-  `AbxCodeLib` grew 3,905 → 4,961 B and still has ~19.6 KB to spare. Nothing else moved: `OnChainScript` and
-  `Dependencies` are composed **only** by `SeriesCode` and `EditionCode`, and both already linked
-  `AbxCodeLib`, so no contract gained a library dependency and the other four tokens are byte-identical.
-
-  No behavior change and no ABI change — the read signatures, return types, mutability, ERC-165 ids and the
-  `ScriptIndexOutOfRange`/`DependencyIndexOutOfRange` error selectors are all preserved (the errors stay
-  declared on the mixins so they remain in each token's ABI, and now revert from the library's
-  identically-named, identically-selectored twin). This does move the implementation bytecode, so it rides
-  the redeploy this remediation already requires: `AbxCodeLib`, both code tokens, and their factories (and
-  therefore the factory trust anchors) all get new addresses.
-
-- 1b6b741: CREATE2 for library deployments, as the standard process — and delete the false belief that said it was impossible
-
-  An audit found that two ERC-1155 token types were held library-free, and an EIP-170 size floor relaxed, on
-  the recorded belief that linking a delegatecalled library costs a factory its CREATE2-deterministic address.
-  That belief is false, and the committed broadcast artifacts always refuted it: every recorded library deploy
-  went through the keyless CREATE2 proxy, `AbxParamsLib` landed at ONE address on Sepolia and Base Sepolia
-  from deployer nonces **215 apart** (a nonce is not an input to a CREATE2 address), and both library-linked
-  factories have held chain-identical addresses across four deploy generations.
-
-  What was true was narrower and self-inflicted: `deploy.ts` deployed its libraries with `send({to: null})` —
-  a plain EOA `CREATE` — **by its own choice**, so _it_ could not predict them. `create2.ts` and both code
-  factory deploy functions then wrote that local limitation up as a property of libraries in general, and the
-  repo proceeded to contradict itself (`deployments.ts` and `reference/deployments.mdx` describe the correct
-  mechanism a few files away).
-
-  The SDK now does what the docs already claimed:
-
-  - Both bootstraps (`deploySeriesCodeFactory`, `deployEditionCodeFactory`) deploy every write-path library
-    through the keyless proxy at the canonical `AbxSalts` salts — `abx.lib.params.v1`, `abx.lib.code.v1`,
-    `abx.lib.edition.v1`, mirrored in `ABX_SALT` and pinned against `AbxSalts.sol` by a new test — and then
-    CREATE2 the linked factory at its own salt. **An SDK-bootstrapped chain and a forge-bootstrapped chain now
-    produce identical addresses** (verified: the SDK's predictions equal what
-    `DeployLibraries.s.sol --sig 'predict()'` prints).
-  - Idempotent, out of necessity rather than politeness: the proxy _reverts_ on an occupied address, so a
-    library already on-chain is linked against instead of redeployed — which is also what makes a partially
-    bootstrapped chain recoverable by re-running.
-  - New: `predictParamsLib`, `predictCodeLib`, `predictEditionLib`, `predictSeriesCodeFactory`,
-    `predictEditionCodeFactory`, plus exported `libPlaceholder` / `linkLibraries` / `LIB_FQN`. Both code
-    factories therefore gained the CREATE2 self-heal every other canonical anchor has — and need no version
-    probe for it, because code at a CREATE2 address is bytecode-bound to the build that predicted it.
-
-  **Fixes a real crash on the way past.** `deployEditionCodeFactory` could not succeed at all: it deployed
-  `abxEditionLibBytecode` raw, but `AbxEditionLib` itself delegatecalls `AbxParamsLib`, so its shipped
-  bytecode carries an unlinked `__$…$__` placeholder — not hex, so the RPC rejected it with an opaque
-  `Invalid byte sequence`. The old guard only checked the _factory's_ bytecode, never the library's. The
-  library is now linked before it is deployed, and `linkLibraries` throws with the offending placeholder named.
-
-  **The trap that IS real, now written down** (`create2.ts`, `reference/deployments.mdx`): a library's address
-  is a function of its creation bytecode, so build settings move it. Linking _after_ compilation — substituting
-  into solc's placeholder, what forge's automatic linking and the SDK both do — cannot change that bytecode.
-  Handing solc the addresses at build time (`--libraries src/…:Lib:0x…`) writes the map into
-  `settings.libraries` in every artifact's metadata, and the metadata hash is appended to the creation
-  bytecode: measured here, that moves the library's own address and the linked factory's initcode. Optimizer
-  profile does the same (the code tokens compile at 200 runs). Both failures are invisible until two chains
-  disagree, so the docs now say to compare `predict()` against the SDK's predictions rather than assume.
-
-  Docs and specs swept for the old claim: `reference/deployments.mdx` (the salts, and a "libraries go first"
-  bootstrap step naming `DeployLibraries.s.sol` and its `predict()` dry run), `reference/contracts.mdx`
-  (`AbxEditionLib` was missing from the library taxonomy entirely), `reference/sdk.mdx`,
-  `specs/self-host-toolkit/deployment.md`, and the `abx-self-host` skill's code-projects reference. No
-  addresses were invented: nothing is redeployed yet, and the two manifest-drift tests still stand as the
-  detectors waiting on it.
-
-- 1b6b741: `abx doctor` stops calling a dust balance "funded", and its provenance line stops guessing how you invoked it
-
-  Both found by cold agents in the clean room, one of them twice.
-
-  **Funding had two states where it needed three.** A wallet holding `0.000000000848940602 ETH` — 848
-  gwei, enough for nothing — reported as `funded`, in full wei precision, with no faucet link, because the
-  test was `balance > 0n`. An agent then spent its whole run preparing a deploy it could not send and
-  named the quiet funding signal as its top friction. Now: zero is `empty`, below 0.001 ETH is
-  `too little to deploy` with a faucet link, and anything above reads `funded` at six decimals instead of
-  eighteen. The floor is a readout threshold, **not** a refusal — we don't estimate anyone's gas, and a
-  cheap L2 deploy below it is the caller's call.
-
-  **The `binary` line said `source checkout (pnpm abx)`** even when the caller had typed a bare `abx` that
-  happened to resolve to a checkout. `source` was right; the parenthetical named an invocation that never
-  happened. It now says what is running rather than how you typed it. A provenance line that misstates the
-  invocation undermines every readout sitting next to it.
-
-  Not changed, deliberately: `deploy --dry-run` still refuses to print an address without `--salt`. An
-  agent asked for a non-final example address to skip the two-step dance, but the salt is the only thing
-  that pins the address, and printing a real-looking one that won't be the deployed address is the exact
-  failure that refusal exists to prevent.
-
-- 1b6b741: Editions: the buyer picks the work, and the skill stops promising a freeze we withdrew
-
-  **Say what the edition mint flow actually is.** The 721 Series lane and the edition lane answer "who
-  picks the work?" in opposite ways, and only the 721 half was written down. `IAbxSequentialMint` takes a
-  recipient and mints `nextTokenId` — nothing is selectable. The edition minter is keyed `(token, id)`, so
-  `purchase(token, id, …)` _names the work_, and on an `EditionCode` project each id carries its own
-  `seed`, drawn at that id's **first** mint because the seed belongs to the work rather than to a copy.
-  Choosing the id therefore chooses the seed. That is the product, not a leak: an edition is copies of a
-  known work, and seeing what you are buying is the normal case.
-
-  Two consequences are now documented rather than left to be discovered:
-
-  - Buying an **already-minted** id is choosing among settled, publicly readable works.
-  - Buying an **unminted** id draws its seed with the buyer's chosen `id` in the preimage — a real
-    selection surface (compute each candidate id's seed in a view loop, buy the best), bounded by which ids
-    have a configured sale and by `maxInvocations`. This is the same grinding surface the recipient `to` was
-    removed from the preimage to avoid, and `id` cannot be removed the same way, because it _is_ the
-    work. So `AbxSeedSource`'s "accept-or-decline, not choose" is now stated as the **721-lane** property
-    it is, everywhere it appeared (`protocol/code-projects`, `specs/protocol/code-projects`,
-    `specs/protocol/event-spine`, the skill).
-
-  **Creator mints the supply, then lists on secondary** is documented as a first-class way to run an
-  edition: no minter, no allocation, no pause to manage, and every seed settles under the creator's own
-  transactions. It needs nothing new — the owner may always mint, paused or not, up to the id-space and
-  per-id caps — and it composes with a sale (reserve to self, price the rest).
-
-  **The shipped skill's frontmatter no longer advertises "freeze/lock a project so it can never change"** —
-  the exact promise `SKILL.md`'s own body walks back. It now names what a lock actually freezes (fields, URI
-  config, script, dependencies) plus the new param-hook freeze, so the sentence that gets the skill _picked_
-  agrees with the sentence that tells the creator the truth. The router stayed a router: the seed paragraph
-  and the Solidity-lane paragraph were compressed to pay for the new material, with the depth in
-  `reference/code-projects.md`.
-
-- 1b6b741: Stop promising immutability the locks don't deliver — and name the residual owner powers in one place
-
-  **The claim that was wrong.** With the field lock, URI lock, contract-URI lock, script lock and
-  dependency lock _all_ engaged, the rendered output can still change, two ways. **Params have no lock at
-  all** — they aren't fields, so no field lock reaches them, and the renderer projects the whole enumerated
-  set into `tokenURI` as `abx_params` (a program reads the same set as `tokenData`). And a
-  **`Resolution.Registry` dependency is re-fetched from the registry contract on every read** —
-  `lockDependencies` freezes the ref and the registry pointer, not another contract's storage. `abx verify`
-  reported `chain-complete` on both sides of a registry swapping its library bytes, and the CLI was telling
-  people "a fully immutable code drop is lock-script + lock-dependencies + lock-field/lock-uri".
-
-  Every unqualified verdict is now qualified rather than deleted, because locking a pointer _is_ part of the
-  story: `lock-uri`, `lock-script` and `lock-dependencies` narration, their `--help` entries, `abx verify`'s
-  chain-complete pass (which now says the flag describes **where** bytes come from, not that they're frozen),
-  `GeneratorStatus.chainComplete`'s doc comment, the `lockScript` SDK docs, `protocol/metadata`,
-  `protocol/params`, `protocol/code-projects`, `reference/cli`, the operate guide, `specs/protocol/*`, and the
-  skill's SKILL.md · `reference/decisions.md` · `reference/code-projects.md` · `reference/operating.md`. The
-  line the toolkit now gives a creator is **"your metadata is locked"**, with the stronger claim reserved for
-  a project whose graph is on-chain `0x…` deps plus locked fields. Stated once per place the decision is made,
-  not restated everywhere.
-
-  Framed as a capability as well as a caveat: a token that _deliberately_ live-adapts to on-chain conditions
-  is a legitimate and interesting thing to build, and it's the same mechanism that makes it possible.
-
-  **New page: [What a project owner can do](https://abx.docs.artblocks.io/protocol/owner-powers/).** There was
-  nowhere a collector could read what powers the creator retains. It states both halves plainly, with the read
-  for each. What an owner **can** do: re-point or suspend an enrolled 721C/1155C transfer validator (and block
-  transfers entirely with one that reverts — though if they renounce ownership, anyone may suspend it and
-  nobody can re-arm it); change price, payee, allocation and pause on a live sale with no timelock; keep
-  receiving primary-sale proceeds after selling the project, because `primaryPayee` doesn't move on
-  `transferOwnership`; mint reserves outside the minter's allocation, since assigning a minter grants the whole
-  remaining cap rather than a slice; change royalty receiver and bps forever; re-point metadata subject to the
-  locks above; swap the seed source; reassign a token's seed _iff_ a `seed` schema was declared before the
-  collection's first seed existed; and walk away. What they provably **cannot** do: take a buyer's funds beyond
-  the terms that buyer signed for (`purchase`/`purchaseTo` require `expectedPaymentToken` and a maximum, and
-  revert `SaleTermsChanged`); exceed a supply or per-id edition cap; rewrite or clear a settled seed; reach
-  another project through any shared singleton (the renderer and chunk store hold no storage, the generator's
-  wiring is `immutable` with no setters, the seed source is a stateless view namespaced by caller, and the
-  minters key everything per token and hold no funds); or take a token out of a collector's wallet — there is no
-  owner-only transfer, burn, or clawback anywhere in the protocol.
-
-  Framing, deliberately: ABX is self-serve, the creator is a privileged role, the protocol's job is to keep
-  that role away from a collector's funds and tokens, and the residual powers are disclosed so a collector can
-  price them. Not an accusation — a creator who destroys their own collection has destroyed what they were paid
-  for. The point is that "trust me" should be optional.
-
-- 1b6b741: `minter configure` no longer tells an edition its minter is unassigned when it isn't
-
-  The readiness footer `abx minter configure` prints after configuring an edition sale read
-  `minter()`, `primaryPayee()` and `paused()` through the ERC-721 1/1 ABI, which has none of them. The
-  call threw client-side, the `.catch` swallowed it into a zero address, and a correctly-configured
-  edition was told to go run `set-minter` and `set-primary-payee` — both of which it had already done.
-
-  This is the same bug `minter show` had, fixed on 2026-08-05; only the show path was corrected then.
-  The footer now reads through the edition ABI, and a live regression test covers it, so the two paths
-  can't drift apart again.
-
-- 1b6b741: Gate on-chain content by what a node will READ, not by what it costs to write
-
-  The documented on-chain envelope — ≲24 KB/file, ≲256 KB/project — was a _storage-cost_ figure sold as a
-  support envelope, and the CLI's only loud warning fired on the project total. Measurement says the
-  binding constraint is somewhere else entirely: **`tokenURI` reassembles the whole document on every
-  call**, and that cost is **superlinear** — EVM memory expansion is quadratic, so the per-KB rate climbs
-  with size. Across the 10–100 KB range that decides most projects it measures **~360,000–405,000 gas per
-  KB**, rising to ~460,000/KB at 187 KB and ~510,000/KB at 256 KB. `inline` and `reader` land within ~1% of
-  each other up to 75 KB (the cost is the renderer's string building, not the storage mechanism) and
-  diverge above it (~5% at 187 KB, ~10% at 256 KB, as the chunk store's quadratic read loop takes over), so
-  `--compress fastlz` makes a field cheaper to write and not one gas cheaper to read.
-
-  Measured with `forge` (`OneOfOneImage` + `AbxMetadataRenderer`, callee execution gas for one `tokenURI`
-  call, `reader` staging at 22,000-byte chunks):
-
-  | on-chain content | `tokenURI` gas | per KB  |     | on-chain content | `tokenURI` gas | per KB  |
-  | ---------------- | -------------- | ------- | --- | ---------------- | -------------- | ------- |
-  | 3 KB             | 1,123,327      | 374,000 |     | 100 KB           | 40,254,159     | 403,000 |
-  | 10 KB            | 3,588,993      | 359,000 |     | 128 KB           | 53,559,735     | 418,000 |
-  | 23 KB            | 8,346,220      | 363,000 |     | 187 KB           | 86,021,071     | 460,000 |
-  | 40 KB            | 14,740,366     | 369,000 |     | 256 KB           | 131,269,134    | 513,000 |
-  | 50 KB            | 18,759,333     | 375,000 |     |                  |                |         |
-  | 75 KB            | 29,137,215     | 388,000 |     |                  |                |         |
-  | 90 KB            | 35,868,124     | 399,000 |     |                  |                |         |
-
-  geth's `--rpc.gascap` defaults to 50M, hosted providers commonly cap lower, and L1 block limits sit in
-  the mid-30-millions — so a project at the _documented_ ceiling could not be read by a normal node, and
-  from ~90 KB (~36M gas) up no contract can read it inside a transaction at all. Note what the 100 KB
-  refusal is: a **margin**, not the wall. 100 KB reads at ~40M, and geth's own 50M default is not
-  exhausted until ~120 KB; the refusal sits early because hosted providers cap well below geth.
-
-  The gate now sits on that axis, per token (each `tokenURI` assembles only its own content, so a
-  300-piece collection of 5 KB works is fine while one 256 KB work is not):
-
-  - **from ~40 KB — warn.** Reads need a deliberately high-gas RPC.
-  - **past ~100 KB — refuse**, with `--allow-unreadable-onchain` as the override. The refusal names the
-    three ways forward and says plainly what the override accepts: rendering needs a high-gas endpoint and
-    most marketplaces and indexers will show nothing. It fires on the **dry run** too, so a creator meets it
-    before spending gas rather than after the first staging transaction.
-
-  Live on every path that puts bytes on-chain: `deploy --onchain-image`, `deploy-series --onchain-image`,
-  both `--copies` edition twins, and `set-field --file`. New in the SDK: `classifyOnchainReadSize`,
-  `tokenUriGasEstimate` (fitted to the measurements, so it tracks the superlinearity instead of
-  multiplying by a flat rate), `TOKEN_URI_GAS_PER_KB_LOW` / `TOKEN_URI_GAS_PER_KB_HIGH` (the measured
-  10–100 KB envelope — there is deliberately no single flat `TOKEN_URI_GAS_PER_KB`, because there is no
-  single rate), `ONCHAIN_READ_WARN_BYTES`, `ONCHAIN_READ_REFUSE_BYTES`, `ONCHAIN_READ_GETH_CAP_BYTES`
-  (where geth's 50M default actually runs out, so the refusal can be described as the margin it is)
-  (`exceedsOnchainSoftLimit` stays, now documented as the _write_-cost predicate it always was). The
-  whole-collection 256 KB warning stays as well, relabelled as write cost only, since it never said
-  anything about readability.
-
-  Two things deliberately not done. **No on-chain guard and no gas check** — a read happens off-chain, a
-  read too large for one node is an RPC-capability problem, and bricking a contract is worse than needing a
-  capable endpoint. And the **code lane still only warns**, at the same 40 KB threshold and now quoting the
-  gas figure: `abx inspect`'s document size is an estimate that undercounts unknown dependencies, and a
-  registry-hosted library like p5 is legitimately ~200 KB, so the honest move there is to name the cost and
-  point at the generator's piecewise getters (`document`, `tokenDataJson`, `dependencyTag`, `abxJs`,
-  `gunzipScript`, `registryScriptChunk`) rather than block a shipped lane on a heuristic. Those getters are
-  now in the SDK's generator ABI, which claimed to carry "the piecewise reads" while omitting three of them.
-
-  The docs and the `abx-self-host` skill were swept in the same pass: `protocol/onchain-storage` carries the
-  measured table and the corrected envelope, `protocol/code-projects` gains a piecewise-read section, and
-  the skill's Quick start and `reference/decisions.md` lead with "40 KB is the number, not 256 KB" plus the
-  rule that the override is a creator's deliberate choice and never a way to clear a warning.
-
-- 1b6b741: Round-3 audit remediation: link the two ERC-1155 image anchors, and stop guarding by name
-
-  `EditionImage` and `OneOfOneEdition` became library-linked in the previous round, but neither the
-  SDK nor the forge scripts were updated. `predictEditionFactory()` and
-  `predictOneOfOneEditionFactory()` hashed **unlinked** bytecode — and viem does not reject a
-  `__$…$__` placeholder, it UTF-8-encodes it, so both returned a confident hash of ASCII garbage for
-  a trust anchor, and `ops.ts` would have broadcast that bytecode as initcode. Both now link
-  `AbxEditionLib` (itself linked against `AbxParamsLib`) and ensure the libraries exist first.
-
-  Two addresses move as a result: `EditionImageFactory` and `OneOfOneEditionFactory`. Both are
-  pre-launch and pending the redeploy gate.
-
-  This was the third instance of one bug class, and the existing guard missed it because it checked
-  two factories **by name**. The replacement is exhaustive by construction: it reverse-looks-up which
-  initcode each `predict*` actually hashed, drives every `prepareDeploy*` and every `deploy*`
-  orchestrator against a stub chain, and asserts no `__$` placeholder survives anywhere — so the next
-  library-linked contract is covered without anyone remembering to add it.
-
-  Also: every SDK deploy now goes through CREATE2 at a canonical salt (the 1/1 and Series anchors were
-  still plain `CREATE`, landing at nonce-dependent addresses that could never match the manifest), and
-  the CLI no longer tells creators an ERC-1155 edition emits no ERC-4906 — both lanes emit it now.
-
-- 1b6b741: Warn when an explicit `--salt` has an all-zero guard prefix
-
-  The factory reads a salt's leading 20 bytes as an access guard: the caller's own address means only
-  that signer may deploy with it, all-zero means anyone may. Omitting `--salt` gives you the pinned
-  form. But only `abx predict` ever explained this — the deploy commands took an explicit `--salt`
-  verbatim and said nothing.
-
-  So a creator who pinned a vanity salt with a zero prefix and announced the predicted address was
-  handing it to whoever deployed there first, and the front-runner ends up as `owner()`, because
-  ownership is set by `initialize` rather than by the prediction. The 2026-08 security review
-  reproduced that.
-
-  It warns rather than refuses: a zero prefix is the right choice for a deliberately shared,
-  caller-independent deployment. The check lives in the flag parser, which is the one place every
-  command passes through.
-
-- 1b6b741: Say the honest thing about the mint seed: pseudorandom, not lottery-grade
-
-  The canonical `AbxSeedSource` stopped hashing the recipient (`to` is accepted and ignored) because a
-  buyer names the recipient in `purchaseTo`, which turned a caller-supplied field into a search space —
-  grind candidates in a view loop, buy once at the winner. Dropping it removes cheap _targeting_, and
-  nothing more: the seed is still derived entirely from on-chain values, so it is **deterministic after
-  the fact** (replayable from the block — the property that makes generative output verifiable) and
-  **not secret before it** (a contract minting in the same transaction can compute the seed it would
-  receive and revert unless it likes the result).
-
-  The docs and the toolkit now say that where a creator decides, instead of implying more than the
-  contract delivers:
-
-  - `deploy-code --help` spells out what `--no-seed` opts out of, and the deploy plan prints the same
-    note beside the `seed source` line it already showed — on the 721 and edition lanes both.
-  - The `abx-self-host` skill gained a one-paragraph router entry in **Code projects** and a
-    **Seeds — pseudorandom, not lottery-grade** section in `reference/code-projects.md`: fine where the
-    seed diversifies output and the distribution is the product, not fine for a raffle, a prize draw,
-    or any drop where one rare outcome is worth materially more than mint price. The escape hatch is
-    named rather than hinted at — the creator's own `IAbxSeedSource` over commit-reveal or a VRF oracle,
-    which is a per-project swap, not a fork of ABX (and is now reachable as `--seed-source` /
-    `abx set-seed-source` — see the companion entry).
-  - Both also document the seed's new governance rule: a `seed` param schema can only be declared
-    **before the collection's first seed exists**, so whether a seed's value may be re-set — and by
-    whom — is a pre-sale commitment a buyer reads with `paramSchema("seed")` (or `abx state`), not
-    something added after a sellout. That schema is deliberately **not** described as a "re-roll":
-    the governed write is `configureTokenParam(tokenId, "seed", value)` and the caller supplies the
-    value, so it is a chosen seed, not a fresh random draw.
-
-  The public docs (`site/content/docs`), the protocol specs, and `contracts/README.md` were swept in the
-  same pass; no claim that the seed is "unpredictable" survives anywhere.
-
-- 1b6b741: Fix `abx skill install` and `abx scaffold-renderer` on a published npm install
-
-  Reported from the field on v0.1.0-alpha.21: `abx skill install` — the canonical way to install the
-  agent skill, and the first thing the quickstart tells you to run — failed on every fresh global npm
-  install with `✗ bundled skill not found`. The reporter's diagnosis was exactly right.
-
-  `resolveBundledSkill()` computed the package root as
-  `resolve(fileURLToPath(import.meta.url), '..', '..')`. That is correct for a module compiled to
-  `dist/main.js` and off by one for `dist/commands/scaffold.js`, which is a level deeper — so it landed
-  on `dist/` and looked for `<pkg>/dist/skill`. The assumption was written when the function lived one
-  level up and quietly broke when it moved into `commands/`.
-
-  Two more instances of the same root cause came out with it:
-
-  - **`abx scaffold-renderer` was broken the same way** and had not been reported — it looked for
-    `<pkg>/dist/assets/renderer-scaffold`.
-  - **The "am I running from source?" guard** matched `/src/<one-segment>$`, so it read false for
-    anything under `src/commands/`. On its own that was harmless; together with the root fix it would
-    have made a dev run prefer `<pkg>/skill` — gitignored prepack output — over the canonical skill,
-    which is how the canonical skill once got overwritten by a copy eight versions behind.
-
-  Nothing caught any of it because a dev run never has the published layout: running from source, both
-  resolvers fall back to the repo copies and work regardless of the arithmetic. So the fix is structural
-  rather than a third `..`: one `packageRootFrom()` that walks up to the CLI's own name-checked
-  `package.json`, depth-independent by construction, plus `packaging.test.ts` — which builds a published
-  layout in a temp dir and walks it from several depths, and fails the build if counted-`..` root math
-  comes back in any spelling.
-
-  Workaround on alpha.21, if you're on it:
-  `cp -r $(npm root -g)/@artblocks/abx-cli/skill ~/.claude/skills/abx-self-host`
-
-- 133ecbc: Add `abx submit-app` — optional post-deploy listing in the ABX App Store.
-
-  Not folded into deploy. After a collection exists, the agent offers it, confirms catalog copy with the creator (name / summary / description — not the collection's NFT metadata), then mints through the gated minter and writes params in gas-capped batches. Already-claimed collections skip the mint (same as `/update`). Shipped Base Sepolia registry + minter; override with `--registry` / `--minter`.
-
-- 1b6b741: The param transfer hook is a veto, not best-effort — say so everywhere, and ship the lock that answers it
-
-  The transfer hook used to swallow its own revert, and every surface promised that the parameter
-  lifecycle "must never block a transfer". That promise could not be kept, so it is withdrawn rather than
-  restated: Solady runs the ERC-721/1155 **receiver acceptance check after the hook**, so on the `safe*`
-  variants — which marketplace fills wrap — a hook that is cheap when a wallet estimates gas and expensive
-  when the transfer lands starves the work that comes after it, with or without a gas cap. Swallowing
-  bought a guarantee that was false in exactly the cases people use, while making an honest hook's failure
-  invisible.
-
-  So the contract now calls the hook plainly (no swallow, no gas budget, no assembly), **its revert fails
-  the transfer**, and — because a mint and a burn are transfers from/to `0x0` — a reverting hook also stops
-  minting for that project, including through the shared minter. That is deliberate: a hook is always the
-  creator's own contract, which is why it may block issuance while the transfer _validator_, usually a
-  third party's, never sees mint or burn.
-
-  The mitigation is a lock, and it is now reachable end to end:
-
-  - **SDK** — `prepareLockParamHooks({contract, chainId})`, the sibling of `prepareLockScript` /
-    `prepareLockDependencies`. Plus two reads: `readParamHooks` (the trio) and `readParamHooksLocked`,
-    which establishes the freeze without a getter by simulating `setParamHooks` with the current trio and
-    watching for `ParamHooksLocked` — and returns `undefined`, never a cheerful `false`, when a node won't
-    answer.
-  - **CLI** — `abx lock-param-hooks <address>`. Owner-only, one-way, every signing lane, `--dry-run`
-    guarded. It prints the exact three addresses it will freeze, states what is given up (arming a
-    transfer veto, arming a configure veto, re-pointing or clearing the augment hook) and that there is no
-    way back, and distinguishes the two cases: freezing an **empty** set is how a project _proves_ it can
-    never arm a transfer veto, while freezing a set that already contains a hook pins which contracts can
-    run — it does not disarm them.
-  - **`abx state`** now prints the three hooks and whether they are frozen, next to the transfer validator,
-    because that pair is the read a buyer performs. `abx verify` warns on an armed-but-unfrozen transfer
-    hook. `abx set-param-hooks` states the veto at the moment a transfer hook is armed.
-  - **Reconstruction** — `ParamHooksFrozen` folds into `ProjectState.paramHooks.locked`. The event is
-    declared only by `AbxParamsLib`, so `spineEventAbi` now unions that ABI (its other events dedup away):
-    without it the one-way lock on a hook that can veto a transfer was invisible to every consumer that
-    folds the spine.
-
-  Swept for the withdrawn promise: `protocol/params` (which gained a section on why it died),
-  `protocol/owner-powers` (the hook is now on **both** lists — an unlocked hook set as a live power, a
-  frozen one as a guarantee), `specs/protocol/event-spine`, `specs/protocol/user-stories`, the spine event
-  doc strings, and the `abx-self-host` skill (`SKILL.md`'s lock bullet plus the operating and code-project
-  references). No surface still says "best-effort", "reverts are swallowed", or "never blocks a transfer",
-  and a CLI test now fails if one comes back.
-
-- 1b6b741: Transfer validator: preflight what the chain actually refuses, and stop calling `setTransferValidator` owner-only
-
-  Two corrections, both in the direction that was costing someone something.
-
-  **The preflight was a bare `getCode`, and the chain's check is not.** `validateTransfer` returns nothing,
-  so there is no ABI decode to fail — which means any address whose fallback succeeds for an unknown
-  selector passes a has-code check and then waves **every** transfer through, while ERC-165,
-  `getTransferValidator()` and the extension beacon all report enforcement as ON. A Safe does exactly this
-  (`FallbackManager.fallback()` returns empty when no handler is set), as do an uninitialised proxy and a
-  7702-delegated EOA, and a creator pasting their own Safe is the likely real case. The contract's guard was
-  rewritten to probe with a selector no validator implements and require it to **fail**; the toolkit now
-  asks the same question, with the same selector, through the new SDK `probeTransferValidator` (verdicts:
-  `ok` · `no-code` · `permissive-fallback` · `unreachable`). Both call sites use it — `abx
-set-transfer-validator` and `deploy --721c` — so a creator gets a refusal that names what is actually
-  wrong instead of passing the CLI and reverting on chain against an error whose documented meaning ("no
-  code on this chain") was false for their address.
-
-  **`setTransferValidator` is owner-only only while there is an owner.** Once `owner() == address(0)`
-  **anyone** may suspend enforcement by passing `address(0)`, and nobody may ever arm a validator again —
-  the dead-man release for a validator that reverts every transfer on a collection with nobody left to
-  re-point it, which would otherwise strand every collector's token permanently. Four surfaces still said
-  owner-only, and the SDK's was wrong in the direction that matters: an integrator reading it would refuse
-  to build the suspension a stranded holder needs. Corrected in `creator-token.ts` (module header plus
-  `prepareSetTransferValidator`), `protocol/royalty-enforcement`, `protocol/interfaces`, and
-  `specs/protocol/interfaces`, each stating the asymmetry: an ownerless collection can only ever be moved
-  _toward_ transferability, so this hands a stranger no power over a live project.
-
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [f64a31f]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-- Updated dependencies [1b6b741]
-  - @artblocks/abx-sdk@0.1.0-alpha.14
-  - @artblocks/abx-token-api@0.1.0-alpha.17
-  - @artblocks/abx-indexer@0.1.0-alpha.15
-  - @artblocks/abx-storage@0.1.0-alpha.14
-
-## 0.1.0-alpha.21
-
-### Patch Changes
-
-- 528c6c6: Close most of the ERC-1155 edition CLI parity gaps (B28), give every command one unknown-flag posture
-  (B30), and add the per-holder edition balance read (B31).
-
-  Each B28 item was checked against the tree before any code was written: **none needed a Solidity
-  change.** The contracts and SDK ops were already per-id and standard-neutral, so all of this is CLI
-  plumbing and **no redeploy, address churn, or Etherscan re-verification is involved.**
-
-  **Edition custody is now symmetric with the 721 side** — each lane verified live on testnet, not just
-  by dry run:
-
-  - **`deploy-series --copies` gains pattern 2: off-chain image, on-chain JSON, nothing to run.** The 721
-    Series had the whole branch; `EditionImage` never got it, so a multi-artwork **raster** edition had no
-    no-server option at all. A uniform file extension uploads the folder as ONE directory and bakes a
-    single `{id}`-substituting collection field, so the collection costs one field instead of N; mixed
-    extensions fall back to per-id `url` fields. Verified at
-    `0x4e7e2d1aA951d99046323a620a2a5891b1195452`, where `uri(0|1|2)` resolve to `…/0.png`, `…/1.png`,
-    `…/2.png` off one template and all three fetch at their source byte sizes. This gap had real design
-    consequences: a cold agent asked for "3 artworks × 25 copies each", hit the SVG-only refusal, and
-    split the collection into **three separate single-artwork contracts** to get the permanence it wanted.
-  - **`--onchain-image` works on both edition lanes, on the hot AND wallet lanes.** It was refused
-    outright on `deploy-series --copies` and hot-lane-only on `deploy --copies`; one sign session now
-    covers the chunk writes plus the deploy, and the staging txs are counted in the `approvals` line the
-    session's own total is derived from. Verified at `0x0A71382207a980c23E26a54F2b815072da41761A`:
-    `uri(id)` returns a `data:image/svg+xml;base64` image with zero `http(s)` anywhere in the document.
-    `EditionImage` also now treats `--onchain-image` as implying on-chain resolution — every sibling lane
-    already did, and without it the flag would have demanded a resolver URL for a drop whose bytes are
-    already on-chain.
-  - **`deploy-code --copies` accepts on-chain `--dep`/`--dep-registry`.** `EditionCode` already inherited
-    the `Dependencies` extension and called `_initDependencies()`; the legs come from the SDK's shared
-    `dependencySetupCalls`, so the two lanes cannot encode `setDependency` differently. So "an edition of
-    my p5 sketch, with p5 coming from the chain" is a real lane now — verified on Sepolia at
-    `0xC403CB9B956Ca814F1934d8d2A44fc1D2023EFB3`, where `abx verify` reports **chain-complete — every
-    dependency resolves to proven on-chain bytes; no server, gateway, or CDN in the graph**, with a 233 KB
-    inline `animation_url`.
-  - **The cold lane stays refused for `--onchain-image`**, deliberately and identically on all four paths:
-    staging is a sequence where each chunk tx's receipt feeds the next, so it cannot be signed offline.
-    This replaces an edition-specific "tracked as a follow-up" note with the real, shared reason.
-
-  Still open on the edition lanes, and recorded in B28: `deploy-code --copies` has no `--code-dir` or
-  field renderers, and `deploy-code --resume` has no edition path (that one is genuinely new per-id diff
-  logic, not a port).
-
-  **Every command now has one unknown-flag posture.** Roughly 35 commands — `state`, `add`, `index`,
-  `migrate`, `configure-param`, `set-field`, `set-royalty`, `set-minter`, `pause`/`unpause`, `verify`, … —
-  silently ignored an unrecognized flag, so `abx set-royalty --bsp 500` did something quietly different
-  from what was asked. Allowlists now live in one file and are applied once in the dispatcher; it warns
-  rather than refuses (a false refusal would break a working script, and `deploy*` still refuses via its
-  own exhaustive sets).
-
-  The obvious implementation — deriving each allowlist from the command's own `usage` string — was tried
-  and **rejected on evidence**: shared helpers read flags that appear in no usage string anywhere
-  (`storageOverrides()` reads twelve, pulled in by six commands; `--remote-token` by five), so deriving
-  would have warned on valid flags. That is worse than the silence it replaces, because a notice people
-  learn to distrust stops working for the real cases too. The sets are explicit instead, composed from
-  named groups, and a test reads each command's `--help` to assert every flag it **documents** is accepted
-  — the direction that would produce false warnings.
-
-  **`abx tokens <addr> --holder 0x..`** adds a `held` column — `balanceOf(holder, id)` per id, a live head
-  read. It answers the one question supply/cap cannot, and the one a funded agent had to leave blank after
-  transferring a copy (it correctly declined to fabricate the recipient's balance rather than guess).
-  Refused on a 721, where the owner column already answers it. Also: `deploy-series`' `[2] On-chain
-renderer` step now prints the renderer address instead of an empty header, and `abx verify` no longer
-  ends in two ⚠ on a healthy fully-on-chain **image** drop (the code-project checks are scoped to the code
-  twins; a static drop has no program and no `animation_url` by design).
-
-- 528c6c6: ERC-1155 editions: the trust-anchor and on-chain-URI checks told the truth about 721s only, and four
-  membrane gaps around them (2026-08-05 wave-4 agent sweep — 12 cold agents, one funded end-to-end run
-  on Base Sepolia).
-
-  The 1155 contracts themselves were fine: a funded run took an edition from deploy through
-  `tokenuri` → mint more copies → transfer one copy → lower the per-id cap, verifying every step
-  against the chain. What shipped wrong was everything that _describes_ an edition.
-
-  - **`abx verify` reported EVERY canonical edition as `canonical: NO`.** `detectCanonicalFactory`
-    probed only the three 721 anchors and, on no match, fell back to the 721 1/1 factory — whose
-    `isAbxClone` answers **false**, not "unknown". So the one signal platforms allowlist against was
-    confidently inverted for the entire edition line (the function's own docstring promised
-    "canonicity just shows unverified, never wrong"). All six anchors are now probed. **Editions
-    registered before this fix keep the wrong factory in the local projection** — `abx forget <addr>`
-    then `abx add <addr>` re-detects it.
-  - **`abx verify`'s on-chain-URI probe called the ERC-721 `tokenURI` selector on editions**, which
-    exposes `uri(id)`. It reverted for every edition, so verify could never confirm that a
-    fully-on-chain edition resolves — and it printed the raw multi-line viem dump (Contract Call /
-    args / Docs / Version) into a creator-facing readout. The probe now switches on `contractType`
-    (matching `reconstruct.ts`, which already did), reports which accessor it read so an edition is
-    never described in 721 terms, and readout errors are trimmed to their first line.
-  - **An address with no contract was reported as a specific type: `OneOfOneImage`.**
-    `detectTokenKind`'s three probes are each `try/catch → false`, so nothing-deployed and
-    no-extensions-composed were indistinguishable and the ladder fell through to its `1of1` default.
-    `abx set-max-supply` and `abx minter buy` then told edition owners _"…is a OneOfOneImage (721) —
-    drop your edition flags"_ for a mistyped address or, far more often, the wrong `ABX_CHAIN` (the
-    default is base-sepolia, so any Sepolia contract hit this immediately) — advice that removes the
-    _correct_ flags. The existence check now lives inside `detectTokenKind`, so all 13 call sites
-    inherit it; it fails **open** on an unreadable `getCode`, so an RPC blip never becomes a
-    "no contract" claim.
-  - **`abx transfer --token-id <n>` silently transferred id 0.** `transfer` spells the id `--token`
-    while every sibling command (`mint`, `set-max-supply`, `minter …`) spells it `--token-id`, and an
-    unrecognized flag was simply ignored — so an agent that learned the name from `mint` moved the
-    **wrong artwork** with no warning. `--token-id` is now an accepted alias; disagreeing values are
-    refused rather than silently preferring one.
-  - **The edition deploy previews dropped lines their 721 twins print.** All three edition lanes
-    omitted `approvals N wallet approval(s)` from the dry-run readout — which the skill promises "every
-    preview" prints and tells the agent to state up front, so on an edition the agent had nothing to
-    tell the creator about how many wallet prompts were coming (`deploy-code --copies` had it only in
-    the `--confirm` sentence, which is off by default). `deploy --copies` and `deploy-series --copies`
-    also omitted the "resolves ON-CHAIN via the renderer — no resolver, no server" line, which is
-    precisely the guarantee an edition creator is asking about, and `deploy-series --copies` never
-    showed `paused`. All six lanes now print the approval count; the 1155 paths say `uri()`.
-  - **Owner-op writes now surface a stray flag instead of swallowing it.** `mint`, `transfer`,
-    `set-max-supply`, and `minter configure|show|buy` warn on an unrecognized flag (warn, not refuse —
-    per `unknownFlags`' contract, a false warning must never break a script). These are the commands
-    where the 1155 semantics live in _optional_ flags that default rather than fail: a typo'd
-    `--amount 50` minted 1 copy and a typo'd `--quantity 5` bought 1 and paid 1×, both in total
-    silence. The broader gap — ~35 commands with no unknown-flag notice at all — is filed as B30.
-
-  A second verification sweep (six more cold agents, one funded) confirmed each fix above from a fresh
-  start and turned up four more, all fixed here:
-
-  - **A supply cap could be raised in `--dry-run` and only revert on send.** Both twins —
-    `set-max-invocations` (721) and `set-max-supply` (1155) — printed the new cap as fact for a value
-    the chain forbids, then reverted for real. A clean dry run is read as permission to send. Both now
-    read the current cap first and refuse up front; the 1155 side also refuses a cap **below** live
-    supply (the second way it reverted). Both guards fail **open** on an unreadable getter, since the
-    chain enforces the invariant anyway. (The 721 guard needed the Series ABI — reading `maxInvocations`
-    through the 1/1 ABI that `read()` uses throws, which would have made the guard silently never fire.)
-  - **`abx refresh` told edition owners ERC-4906 had already pinged marketplaces.** An ERC-1155 edition
-    emits no ERC-4906 at all — that is precisely why `ping-uri` exists — so the one sentence a creator
-    reads after editing metadata said "already handled" when nothing had been, and `ping-uri --help`
-    said the opposite. Two commands contradicting each other on the new lane. `refresh` is now
-    kind-aware and names `ping-uri` for editions.
-  - **`abx verify` ended in two ⚠ on a perfectly healthy fully-on-chain image drop** — "generator
-    reports NO code" and "no animation_url" — because the code-project lane runs whenever a tokenURI
-    renderer is set, which is true for every on-chain project, image or code. A static image has no
-    program and no `animation_url` by design. Three separate agents named this as the worst thing about
-    `verify`, and one said plainly it would make a creator distrust future real warnings. The code-lane
-    checks are now scoped to the code twins; a static drop gets one informational line instead. (This
-    was pre-existing on the 721 path too, not an editions regression.)
-  - **`EditionImage`'s SVG-only refusal was a thinner copy of its 721 twin's** — the Series version names
-    three routes (`--onchain-image`, `--backend ipfs|arweave`, or host off-chain); the edition version
-    said only "drop `--onchain-uri`". A cold agent asked for "3 artworks × 25 copies each" read that,
-    concluded there was no no-server option for one contract, and **fanned the collection out into three
-    separate single-artwork contracts**. The refusal now states the real options for the lane and says
-    explicitly that the off-chain-image-URL-in-on-chain-JSON route exists only per-artwork via
-    `abx deploy --copies` — one contract per artwork, not one collection. The underlying capability gap
-    is recorded in B28.
-
-  One knock-on from the first fix: the `false` branch of the canonical readout said _"not a clone of the
-  **configured** factory"_ (singular), which now understates the check and misdirects the reader — six
-  anchors are probed, so a `false` means no trust anchor the CLI knows deployed this contract, and the
-  usual real cause is a **superseded** factory or a hand-deployed contract, not a misconfiguration. It
-  now says so, and points at `abx doctor` for the current anchors.
-
-  Also: `deploy --help` no longer calls the edition sale stack (`--minter`/`--primary-payee`/
-  `--unpaused`) "required" — it is optional, and an agent handed a creator hardcoded addresses as
-  mandatory because of it; `set-field --help` now lists all eleven `--representation` values (it showed
-  seven, omitting `url-template`, `renderer`, `sha256`, `inline-gzip`); and `abx doctor`'s label column
-  widened so `edition factory` no longer runs into its address.
-
-  The skill-drift ✗ now names **which** copy is stale and prescribes the command that actually clears
-  it — `abx skill install` writes the project-local copy only, so a stale **global** copy produced a ✗
-  whose own remedy could not fix it. Six agents hit it in one sweep; several re-ran the install
-  repeatedly and one left its sandbox to read `~/.claude/skills` to work out what the tool meant.
-
-- 528c6c6: Wave-6 validation sweep: stop three help strings from denying features that work, make `storage show`
-  honor the flags it advertises, and name the byte custody on both Series lanes.
-
-  Nine cold agents re-drove the edition surface after the B28/B30/B31 work. **Every new lane is reachable
-  and no re-run regressed** — the situation that previously fanned "3 artworks × 25 copies" out into three
-  separate contracts now reports _"Contracts deployed: 1, not 3"_; `--onchain-image` + edition + browser
-  wallet went 4/5 at Haiku after being refused outright; the on-chain-dep edition lane went 3/5 → 4/5; the
-  wrong-chain diagnosis went 2/5 → 3/5 on the strength of the new monotonic-cap guard. **B30 produced zero
-  false warnings across all nine**, including a run that control-tested the mechanism with a deliberate
-  bogus flag, and a funded run that exercised ~10 commands with real writes.
-
-  What the sweep found was mostly **documentation still describing behavior the same branch had replaced** —
-  the failure mode a test suite cannot catch, because tests assert what the code does and none of them read
-  the prose that tells an agent what to try:
-
-  - **`deploy --help`** said `--onchain-image` is "hot lane only on an edition (not yet wired for `--sign`)".
-    It works on the wallet lane. Now states the real rule: hot and `--sign` both work; `--unsigned` is
-    refused everywhere, 721 and edition alike, because each chunk tx's receipt feeds the next.
-  - **`deploy-code --help`** listed `--dep`/`--dep-registry` among flags "refused in code" for `--copies`.
-    They work. An agent verified all four flags directly and called this out as _"the dangerous direction:
-    it would talk a creator out of a feature that actually works."_ Now says they work, and names the
-    Sepolia-only registry constraint.
-  - **The `EditionImage` SVG-only refusal** — a message rewritten earlier in the same branch — still said
-    `--onchain-image` "is not wired on the edition-series lane yet", after that branch wired it. It now
-    lists all four real routes for raster art in one contract.
-  - **`abx refresh`'s ERC-4906 claim had no edition caveat** in the skill or `site/using-abx/guides/operate`,
-    even though the CLI itself was made kind-aware earlier in the branch. The skill's _"`abx refresh` is the
-    only nudge"_ was flatly false for an edition, where `ping-uri` is required.
-
-  Two real product fixes, both surfaced by the new warning doing its job:
-
-  - **`abx storage show` now honors `--backend`/`--gateway`/the rest of the storage override set.** It read
-    env-only while its own output said _"choose per command: `--backend` … `--gateway`"_ — advertising flags
-    it then discarded and always reporting `backend: fs`. This was invisible until every command grew an
-    unknown-flag notice, which correctly flagged it (the flags really were ignored). A resolution preview
-    that can't preview a resolution is the one thing it exists to do. Provenance now reports `--backend` as
-    a source, alongside env and default.
-  - **Both `deploy-series` lanes now name the byte custody** (`storage: ipfs (--backend) — byte custody for
-the image(s)`), as the 1/1 lane always has. A creator asking for "images on IPFS" had no way to confirm
-    from the preview that their collection would pin there; the flag was accepted in silence.
-
-  Also documented, not changed: the ids × copies arithmetic. `deploy-code --copies 100` takes its id space
-  from `--max`, which **defaults to 16** — so "an edition of 100" without `--max 1` means up to 16 different
-  variations × 100 copies each. The dry-run states the real shape (`up to N id(s), M copies each`) and always
-  did; nothing taught the translation, so the skill now does, for all three commands.
-
-  Three legibility nits were routed to B32 rather than fixed: `abx state` naming a contract "Series" where a
-  refusal calls it "SeriesCode"; the Base-Sepolia default appearing only in a subordinate clause of the
-  "no contract" error (three straight waves have lost time to it); and `--onchain-image` on a folder of large
-  rasters honestly reporting 35 wallet approvals with no nudge toward the cheaper lane.
-
-  Two agent claims were checked and **rejected** so they don't get "fixed" into regressions: the skill does
-  _not_ say `--onchain-image` is refused on an edition series (it documents the `--unsigned`-only refusal
-  correctly), and `abx predict` does _not_ silently pick the 721 factory without `--copies` — it labels the
-  lane, yields a different address, and echoes `--copies` in its reproduce line.
-
-- Updated dependencies [528c6c6]
-  - @artblocks/abx-sdk@0.1.0-alpha.13
-  - @artblocks/abx-indexer@0.1.0-alpha.14
-  - @artblocks/abx-storage@0.1.0-alpha.13
-  - @artblocks/abx-token-api@0.1.0-alpha.16
-
-## 0.1.0-alpha.20
-
-### Minor Changes
-
-- afa9dd4: ERC-1155 editions ship with full parity: a Series is many unique tokens (721); an **Edition** is
-  many copies of a token (1155). The creator's word is **copies** — `abx deploy img.png --copies 100`
-  (a single-artwork edition, `open` = uncapped), `abx deploy-series ./art --copies 50` (each image an
-  edition), `abx deploy-code sketch.js --copies 25` (code editions). Without `--copies`, the 721
-  lanes are unchanged.
-
-  Three new canonical contracts twin the 721 lineup — `OneOfOneEdition`, `EditionImage`,
-  `EditionCode` — plus `AbxFixedPriceMinter1155`, a per-id fixed-price sale singleton
-  (`minter configure/buy --token-id [--quantity]`). New owner ops: `mint --token-id --amount`,
-  `transfer --amount`, `set-max-supply` (per-id cap, only ever decreases), `ping-uri` (re-emit the
-  native `URI` event after a re-point). ERC-1155C creator-token enforcement is the same `--721c`
-  opt-in (same validator registry and ERC-165 ids as 721C). Editions announce one new extension
-  (`abx.extension.edition-supply`, per-id supply/cap); everything else — metadata fields, params,
-  royalties, renderer, storage, effects — is the same protocol surface on both standards.
-
-  **Integrator surface (audience line):** additive only. `ProjectState.contractType` gains
-  `'1of1-edition' | 'edition' | 'edition-code'`; `TokenState` gains `supply`/`maxSupply`/`holders`
-  (editions only; `minted` means supply > 0 there); the spine ABI now decodes
-  `TransferSingle`/`TransferBatch`/`URI`/`MaxSupplyUpdated`; `ChainDeployment` gains the four
-  edition anchors (recorded for Sepolia + Base Sepolia, CREATE2-identical); token-api summaries gain
-  an optional `copies` field. No existing export, route, column, or event shape changed.
-
-### Patch Changes
-
-- 8c254d5: The self-host projection no longer stores or pre-fetches composed URI documents, and the event log
-  is append-only (from the abx-services 2026-08-05 projection memo, `docs/11`).
-
-  - **`contractURI`/`tokenURI` are live reads, never projected.** `reconstructProject`/
-    `reconstructIncremental` gain `readUriDocuments` (default **false**) — with it off, the whole
-    `contractURI`/`tokenURI` head-read batch is skipped entirely, not fetched-and-discarded. These
-    fields have no settled value (a renderer can change the composed document with no log at all) and,
-    on the on-chain lane, can run hundreds of KB per token — a real 32-token project measured 13.4 MB
-    serialized, 99.8% of it `tokenURI`. A stale-but-rendering `data:` URI is worse than a missing one,
-    because nothing about it looks wrong. `abx demo` is the one caller that passes `readUriDocuments:
-true`, for its read-back teaching step; `abx deploy`/`deploy-series`/`deploy-code` don't, and
-    `abx verify`/`tokenuri`/`contracturi` were already doing independent live reads. **For
-    integrators:** `ProjectState.contractURI` / `TokenState.tokenURI` are now `null` unless you opt in
-    — including in a self-host node's `/api/project/:addr` responses (shape unchanged, values now
-    null). Nothing that composes served metadata reads either field (the settled `fields`/
-    `collectionFields` do); the settled scalars — `tokenURIRenderer`/`tokenURILocked`/
-    `contractURIRenderer`/`contractURILocked` — are unaffected and still projected.
-  - **The events table is append-only.** `seq` is now chain-derived (`(blockNumber << 32) |
-logIndex`, BigInt-safe) instead of the array index at write time, so it's stable across re-folds —
-    a re-index appends via `ON CONFLICT DO NOTHING` instead of deleting and reinserting the whole
-    history on every delta. `putProject` upserts the project and token rows in place (a token whose id
-    vanishes from state is still removed) rather than delete-and-reinsert. `deregister` still deletes
-    a forgotten project's events in full; a routine re-fold does not. **A full replay (`abx index
---full`) purges the project's event log before rebuilding it** — append-only must not let a
-    reorg-replaced event survive as a stale row, so the documented repair path stays a real repair.
-    Existing stores migrate their positional `seq` values to the chain-derived form once, automatically
-    (`PRAGMA user_version`-gated, transactional).
-  - **Self-healing eventCount guard.** An incremental fold that would reduce `eventCount` below what's
-    already stored is discarded rather than written, with one automatic full-reconstruct fallback (the
-    memo's own war story: a bad fold once silently zeroed a live projection with nothing to catch it).
-  - **New self-host stores open with `auto_vacuum = INCREMENTAL`.** Existing stores are unaffected
-    (the pragma only takes on a database with no tables yet) — recorded as backlog B29.
-
-- Updated dependencies [afa9dd4]
-- Updated dependencies [8c254d5]
-  - @artblocks/abx-sdk@0.1.0-alpha.12
-  - @artblocks/abx-indexer@0.1.0-alpha.13
-  - @artblocks/abx-token-api@0.1.0-alpha.15
-  - @artblocks/abx-storage@0.1.0-alpha.12
-
-## 0.1.0-alpha.19
-
-### Minor Changes
-
-- d40caf4: `abx remote <name|url> --conformance` — self-certify a resolver from the published CLI
-
-  The self-verify fixture that used to live only as a repo-local script
-  (`scripts/conformance-remote-service.mjs`, `pnpm conformance`) is now a mode on the existing `remote`
-  command rather than a new one (command-count discipline): `abx remote <name|url> --conformance
-[--remote-token <t>] [--chain-id <n>] [--address <a>] [--from-block <n>]`.
-
-  This is what lets a third party self-certify a hosted resolver — or CI-gate on one — with nothing but
-  `npm i -g @artblocks/abx-cli` and a base URL: no repo checkout, and a bare URL + `--remote-token`
-  needs no `.env` setup. It reuses the same `--remote` name/URL/token resolution as every other remote
-  command, prints one ✓/✗/· line per assertion (descriptor shape, unauthenticated writes refused, the
-  read-plane's error taxonomy, every declared interface's routes, and — with `--chain-id` + `--address`
-  naming a contract you own — the full register → poll-to-live → status → reindex → deregister loop),
-  and sets a non-zero exit code on any failure.
-
-  The assertions themselves moved to `packages/cli/src/conformance.ts`, importable by both the CLI
-  command and the (now much thinner) root script, so `pnpm conformance` and
-  `scripts/e2e-remote-resolver.sh` keep working unchanged against the same logic.
-
-### Patch Changes
-
-- d40caf4: Two first-party consumers adopt the backoff/gateway/data-URI helpers hoisted into `@artblocks/abx-sdk`
-  last round, and `mint-page` refuses a 1/1 target instead of scaffolding a page that hangs. Drop-in for
-  everyone — no behavior change in the adoption itself, and the mint-page refusal only fires for a
-  contract type the page never worked against.
-
-  **`token-api`'s chain watcher now calls `exponentialBackoffDelay`/`linearBackoffDelay` instead of
-  re-deriving them inline.** `dueForRetry`'s failed-project retry and the tick loop's repeated-failure
-  delay were the sdk helpers reimplemented by hand; both now call the shared functions, with the exact
-  index mapping (`min(attempts, 8) + 1` into the 1-indexed exponential helper) that reproduces identical
-  delays for every `attempts`/`failures` value — proved by an old-formula-vs-sdk-helper equality table
-  in `packages/token-api/test/watcher-backoff.test.ts` (attempts/failures 0..12, several `baseMs`
-  values, and the cap boundary explicitly).
-
-  **The `mint-page` template's generated app now reads gateway URLs and `data:` URIs through the sdk**
-  (`gatewayUrlFor`/`resolveGatewayBase`/`parseDataUri`) instead of a hand-rolled `ipfs://`-slicing
-  `toGateway` and a hand-parsed comma-split in `fetchJson`. Same output for every input (plain
-  `https://`, empty string, `ipfs://`, `ar://`, base64 and percent-encoded `data:` bodies) — verified
-  byte-for-byte before the swap, and pinned by a new mintpage.test.ts assertion that the emitted
-  `lib/meta.ts` imports the sdk helpers and no longer contains the old hand-rolled body.
-
-  **`mint-page` now refuses a non-Series target.** The generated page reads `maxInvocations`/`paused`
-  and mints through the shared fixed-price minter — a 1/1 (`OneOfOneImage`) has none of that, so pointing
-  `mint-page` at one silently wrote a page that sat on "Loading…" forever with no diagnostic. `cmdMintPage`
-  now probes the same ERC-165 `supportsInterface(IAbxSequentialMint)` `sdk/anchors.ts`'s
-  `isCurrentSeriesFactory` uses, and refuses with a `CliError` pointing at `abx deploy-series --dir
-<folder> --count 1` (matching the existing guidance in `sales.mdx`). A probe that can't run at all (RPC
-  unreachable) is left undecided and does NOT refuse — scaffolding stays usable offline, same tolerance
-  the existing best-effort `name()` read already has.
-
-  Also folded in: `PUBLIC_RPC` (the mint-page template's keyless-RPC table) gains `base` and
-  `base-sepolia` — the toolkit's own default chain was missing from it, so every default-chain deploy
-  needed a manual `--rpc` just to scaffold its own mint page.
-
-- Updated dependencies [d40caf4]
-- Updated dependencies [d40caf4]
-- Updated dependencies [d40caf4]
-  - @artblocks/abx-sdk@0.1.0-alpha.11
-  - @artblocks/abx-token-api@0.1.0-alpha.14
-  - @artblocks/abx-storage@0.1.0-alpha.11
-  - @artblocks/abx-indexer@0.1.0-alpha.12
-
-## 0.1.0-alpha.18
-
-### Minor Changes
-
-- 11fa933: Phase 5 interface unifications: the self resolver becomes a named remote, doctor absorbs the
-  version/install/provenance ladder, deploy previews stop showing addresses they can't keep,
-  approvals are counted honestly, render×storage combos are validated once, and storage config gets
-  a real probe.
-
-  - **Self resolver is a named remote (breaking, client-side only)**: the CLIENT credential for the
-    local/self resolver moves from `ABX_RESOLVER_ADMIN_TOKEN` to the named-remote grammar
-    (`ABX_REMOTE_SELF_URL` / `ABX_REMOTE_SELF_TOKEN` — "self" is just a conventional remote name, zero
-    special-casing). The SERVER side (token-api control-plane auth, `provision.ts`, the Fly.io secret)
-    keeps its old name — it's the service's own config, not a client credential, so deployed resolvers
-    need no change. The old client var, if still set, is now a pointed `CliError` naming both new vars
-    (no silent fallback); `abx doctor` flags it too, and the near-miss `_KEY`-vs-`_TOKEN` detector keeps
-    working under the unified grammar.
-  - **`abx doctor` absorbs the version/install/provenance ladder** the skill used to only teach in
-    prose: one new ✓/✗ block for binary provenance (source checkout / npm install / npx — the silent-
-    stale-npx-cache trap), npm currency (reuses the existing cached update check), and skill↔CLI
-    version match (reuses `abx skill`'s own discovery). Each row names the exact fix.
-  - **Deploy previews stop showing addresses they can't keep**: `--dry-run` (`deploy` /
-    `deploy-series` / `deploy-code`) **without `--salt`** no longer prints a "deterministic address" —
-    that salt was just freshly, randomly reserved, so the address was real for that one preview and
-    never reproducible by a plain re-run. It now prints the salt itself, prominently, plus how to pin
-    it: re-run with `--salt <shown>` (guaranteed same address), or `abx predict --salt <shown> --for
-<signer>`. **With `--salt`, the address prints exactly as before** (it IS stable) — `abx predict`
-    is unchanged. The same rule applies to `--json`: without `--salt`, `address` reports `null` rather
-    than a value the real deploy won't land at (`saltPinned` still says why).
-  - **`approvals` — a labeled, honest signature count**: every deploy-family `--dry-run` preview and
-    `--confirm` summary now carries one uniform `approvals N wallet approval(s)` line/clause — the
-    number of **wallet TX signatures** the real run will ask for (a connected-wallet storage upload,
-    e.g. Arweave via `--storage-signer eth`, is a message signature, not a transaction, and stays
-    listed separately, as it already was). It's derived from the exact same staging/setup-multicall
-    math that sizes the wallet-lane session's own `total`, so the two can never disagree — this caught
-    (and fixed) `deploy-code`'s wallet-lane session `total` being hardcoded to `2` even on the 1-tx path
-    (no chunks/schema/deps/on-chain-uri legs/setup-carried mints), which would have shown "transaction
-    1 of 2" and then silently never asked for a second.
-  - **One validator for render×storage combos**: `@artblocks/abx-storage` gains
-    `validateRenderStorageCombo()` (`content-plan.ts`) — the single source of truth for two known-bad
-    configurations, each checked against the ACTUAL fact that makes it bad (not against an unrelated
-    flag): (1) `--image-base` needs a backend that can overwrite a stable per-token key in place; an
-    ipfs/arweave-_shaped URL_ is refused regardless of this deploy's own `--backend`, because those are
-    content-addressed — a re-upload gets a new address, so no fixed URL can point at it. (2) publishing
-    a render to a resolver that doesn't share this machine's disk needs a backend that can hand back a
-    public URL at all — `fs` (or `cloud` with no public base) can't. `deploy-code` wires this into BOTH
-    its real-run refusal (`--image-base`) and a new `render/storage ✓|✗ <reason>` dry-run row;
-    `requirePublishableBackend` (the existing `abx render --remote` / `abx effects` guard) now consults
-    the same validator for its ok/not-ok decision, so the two surfaces can't drift apart.
-  - **`abx storage show --check`**: a real read/write against the resolved storage config, not just
-    "is it configured." `cloud` PUTs a tiny object through the signed API and GETs it back over the
-    PUBLIC base with a plain unsigned fetch — the only check that catches the R2/S3
-    endpoint-vs-public-base trap (`health()` alone only proves the API credentials work); on failure
-    both URLs print, so the mismatch is visible. `ipfs`/`fs` reuse their existing `health()` verbatim
-    (gateway/API reachability, dir writability — no upload, no pin — reused, not reimplemented).
-    `arweave` adds an identity+balance READ, never a paid upload. Exit code is meaningful (0 ok / 1 any
-    ✗) so a script can gate a launch on it. `abx doctor`'s storage row now runs the same fuller probe
-    (bounded to 1.5s, matching its other fast network checks) instead of a bare `health()` call.
-
-### Patch Changes
-
-- 11fa933: The remaining phases of the simplification refactor that hadn't yet gotten a changeset: the CLI's
-  internal module split, the token-api/effects/mint-page convergence on the SDK, the shipped skill's
-  rewrite for the simplified surface, and a new SDK README.
-
-  - **`abx`'s `main.ts` split into domain command modules** (`commands/{deploy,project,reads,service,
-scaffold,storage}.ts`, shared `output.ts`/`errors.ts`), with one exit-discipline rule
-    (`process.exitCode` + return, or a typed `CliError`, everywhere — bare `process.exit` only at the
-    entry guard, the top-level catch, and the keep-alive SIGINT handler). Purely internal: a 207-fixture
-    byte-diff matrix (every help text, dry-run, error path, and exit code) confirmed identical output
-    before and after.
-  - **token-api / effects / mint-page converge on the SDK**: `@artblocks/abx-storage` gains one
-    `resolveGatewayBase` (`readiness.ts`), replacing three near-identical copies (two in token-api, one
-    inline in storage itself); token-api exports `buildGeneratorDocument` so the CLI's `abx preview`
-    consumes the real generator-document assembler instead of a hand-kept duplicate; the effects runner
-    now resolves its config via the SDK's `readEnv` and gets a `makePublicClient` fallback transport, so
-    `ABX_RPC_URL` accepts a comma-separated failover list like every other RPC var; the scaffolded
-    mint-page app now imports ABIs from `@artblocks/abx-sdk/abi` and a browser-safe `makePublicClient` +
-    typed `readSaleConfig` instead of hand-rolled fetch/decode, and pins its generated `package.json` to
-    the SDK's _resolved_ version via a new `@artblocks/abx-sdk/package.json` export (alpha version
-    counters diverge per package under changesets, so pinning the CLI's own number could produce an
-    unsatisfiable range).
-  - **The shipped skill (`.claude/skills/abx-self-host/`) is rewritten for the surface phases 0–5
-    actually shipped**: every warning made obsolete by an enforcement is deleted rather than softened —
-    predict-only deploy-preview addresses, the `approvals N` line, the single `ABX_REMOTE_SELF_*`
-    credential grammar, `doctor`'s version/provenance ladder, `storage show --check`, the render/storage
-    combo validator's dry-run row, and `ABX_DEPLOYER_PK` as the only key name. Retired names swept from
-    `dev-loop-test`, the agent-eval scenarios, and spec prose. The skill ships bundled inside this CLI
-    package (co-versioned via `SKILL.md` frontmatter), so it rides this same patch.
-  - **New `packages/sdk/README.md`**: what the SDK is, the send-injection model (`PreparedTx` +
-    `SendTx`, `makeHotSender` for a hot key, bring-your-own for a wallet/multisig), a complete
-    deploy → upload → mint → read walkthrough against real exports, and browser-use notes (explicit
-    `rpcUrls`, no env, the `/node` subpath is Node-only). Included in the npm tarball automatically
-    (README is one of the files npm always packs, regardless of the `files` allowlist).
-
-- 11fa933: Two ripouts, no functional loss: the retired `params.keys` read fallback in `abx state`, and the `abx changelog` command.
-
-  **`abx state`'s legacy `params.keys` fallback.** On-chain param enumeration (`contractParamKeys` /
-  `tokenParamKeys` / `paramSchemaKeys`) shipped a while back and every project deployed since enumerates
-  its own param surface — nothing writes the old `params.keys` CSV any more. The only thing still reading
-  it was `abx state`, so it could keep describing the handful of pre-enumeration testnet projects that
-  predate the switch. That reader (`readLegacyParamsKeys`) and its `legacy`-branching in `cmdStateBody`
-  are gone; `abx state` now shows exactly what it reads from on-chain enumeration, an empty PostParams
-  list for a pre-enumeration contract included. (The repoint guard that refuses to point a legacy token's
-  field renderer at the canonical generator is a separate, still-live safeguard — untouched.)
-
-  **`abx changelog`.** A `CHANGELOG.md`-reading command that duplicated what any agent or human can do by
-  reading the file that already ships with the package (`package.json` `files`) — one more command to
-  document and maintain for a read `cat` already covers. `CHANGELOG.md` keeps shipping; the update-nag
-  banner and the docs now point at the file and at npm's version list
-  (`https://www.npmjs.com/package/@artblocks/abx-cli?activeTab=versions`) instead of a command.
-
-- 11fa933: The extraction phase of the simplification refactor: business logic that lived only inside the CLI
-  is now importable — the CLI calls the same functions you can.
-
-  **Into the SDK:** the five trust-anchor bootstraps (`ensureFactory`, `ensureSeriesFactory`,
-  `ensureSeriesCodeFactory`, `ensureRenderer`, `ensureSeedSource` — `anchors.ts`, on the same
-  injected-`send` + `onEvent` pattern as `ensureChunkStore`, with a typed `AnchorUnavailableError`),
-  `detectCanonicalFactory`/`resolveScanFloor`, the on-chain-URI setup composer (`onchain-uri.ts`),
-  interrupted-deploy resume planning (`resume.ts`), migration plan/parity reconciliation
-  (`migrate.ts`), the `abx.js` static analyzer (`inspect.ts`), dependency setup legs (`deps.ts`),
-  content-staging plans (`staging.ts` — `planStagedContent`, `stageFieldContent` with `StagingEvent`),
-  `mintedTokenIds`, and a typed `readSaleConfig` for the fixed-price minter.
-
-  **Into storage:** `uploadAndLocate`, `repinNodeCustody` (the byte-custody half of migration),
-  `decideImageContentLane`, `assessStorageReadiness`/`assessTurboFunds` (the Arweave/Turbo funding
-  math), and `awaitLocatorReady` (poll a locator until it serves).
-
-  **CLI hardening that fell out of the dedup:** one risk gate (`gatedSend`) now guards every write —
-  `--dry-run` and `--confirm` mean the same thing on every command, all owner-ops gain `--confirm`,
-  and a write reaching the send lane under `--dry-run` is structurally impossible (grep-enforced by
-  test). One `CHAIN` source of truth; one memoized local-indexer accessor.
-
-- 11fa933: Phase 1 of the simplification refactor: one transaction shape with one send-injection point, and an SDK that never touches `.env` or a Node-only global on its own. Two related passes, same release.
-
-  **One transaction shape, one executor.** `StagingTx`/`SendStagingTx` are gone — everything is a `PreparedTx` sent through a single `SendTx`. New `execute.ts` carries `makeHotSender` (pins the nonce once, detects an under-estimated gas limit against a just-deployed target, throws a typed `TxRevertedError` instead of reporting a reverted tx as confirmed) plus `pinGas`/`waitForCodeAt`, moved from the CLI (`gas.ts` is gone) with their design comments intact. Every `deployX` is now `prepareDeployX` (pure) + `deployX(send, ...)`; the CLI's hot lane and `abx deploy-code --resume` both delegate to the same sender instead of hand-rolling their own nonce/gas loop — the class of bug that reported a burned, reverted transaction as a successful deploy can't recur in a second call site because there is no longer a second implementation.
-
-  **The SDK never loads `.env` implicitly.** `loadDotEnv`/`parseEnvContent` moved to a new `@artblocks/abx-sdk/node` subpath — the only module that touches `node:fs`/`node:path`. The package's main entry is now browser-bundle-safe (a permanent esbuild smoke test guards it); a host calls `loadDotEnv()` once at startup (the CLI's `main()`, the effects runner's `main()`) and the SDK core reads whatever's already in `process.env` through a tiny `readEnv` that no-ops outside Node. `ClientOptions` gained `rpcUrls?: string[]` and `makeWalletClient`/`envSigningKey` gained a `privateKey`/`override` escape — explicit config now wins outright over env resolution, following the same override → env → manifest precedence `deployments.ts` already used for contract addresses.
-
-  **Single signing-key name.** `ABX_DEPLOYER_PK` is the only env var the SDK reads for a hot key — `SEPOLIA_FUNDED_PK` and `SEPOLIA_WALLET_PK` (earlier-alpha names) are no longer consulted. A caller with one of the old names set now gets a `MissingSigningKeyError` that names the new one explicitly and says the old ones are retired, rather than a plain "no key found" that leaves an upgrader hunting for why a key that's clearly _there_ isn't being read. Sandbox/e2e scripts and test fixtures move to the new name too.
-
-  **Shared, environment-neutral utilities.** New `sdk/src/util.ts`: `sleep`, a `linearBackoffDelay` helper (service.ts's retry ladder and the effects runner's resolver poll both use it now instead of hand-rolled backoff math), `parseDataUri` (replaces three near-identical `data:` URI regexes across the CLI and the tokenURI probe with one permissive parser), and `tryReadContract` (replaces three near-identical try/read-return-undefined helpers; the CLI's "no contract at this address" diagnostic still wraps it where that mattered). `Buffer` is gone from the SDK core (chunk hex-encoding and param base64-encoding now use viem's `bytesToHex` and a ~12-line dependency-free base64 codec) — nothing in the SDK's main import graph is Node-only any more.
-
-- Updated dependencies [11fa933]
-- Updated dependencies [11fa933]
-- Updated dependencies [11fa933]
-- Updated dependencies [11fa933]
-  - @artblocks/abx-sdk@0.1.0-alpha.10
-  - @artblocks/abx-storage@0.1.0-alpha.10
-  - @artblocks/abx-token-api@0.1.0-alpha.13
-  - @artblocks/abx-indexer@0.1.0-alpha.11
-
-## 0.1.0-alpha.17
-
-### Patch Changes
-
-- df298d8: `abx attach` takes several `<key> <uri>` pairs and sends ONE transaction
-
-  The safety half of backlog B20. The CLI's most-documented flow — mint, then attach each artifact, then
-  refresh — sent one transaction per step with **no all-or-nothing boundary**, so a failure partway
-  through left a permanently half-written token, and a mint cannot be undone. An integrator hit exactly
-  that and folded 8 operations into 1 transaction (846,556 gas) using the SDK's `batchOps` — a primitive
-  the CLI already shipped and did not call. Now it calls it.
-
-  ```bash
-  abx attach 0x… stems ipfs://…/stems.wav score ipfs://…/score.pdf readme ar://…
-  # → 3 artifacts, one multicall: a revert lands NONE of them
-  ```
-
-  Three things make the batch safe rather than merely shorter:
-
-  - **Every pair is validated before anything is sent.** A bad locator in pair 5 stops pair 1 — otherwise
-    batching would defeat its own purpose.
-  - **A key repeated inside one batch is refused.** A field holds one active value, so the later write
-    would silently win — the same full-column-upsert hazard that was a real bug in the resolver's
-    `register` and a real trap in `lock-field`.
-  - **A single pair is unchanged.** `batchOps` passes a lone op through untouched, so the one-artifact
-    case sends the identical plain field transaction it always did — no multicall wrapper, no new gas.
-
-  An odd number of positionals is refused and names the dangling argument, rather than silently ignoring
-  it.
-
-  Still open in B20, and recorded there rather than quietly skipped: batching **`set-field` across several
-  fields** needs a flag-grammar decision first (`attach` batched cleanly because its arguments are
-  positional pairs; `set-field` takes one `--field` with a correlated `--text`/`--value`, and the parser
-  has no notion of correlated repeats). Same for an all-or-nothing "mint and configure" — mint and
-  configure are separate commands, so that needs a verb that owns both.
-
-- df298d8: `abx deploy-code --resume <address>` — finish a deploy whose setup transaction failed
-
-  Closes backlog B15. A code project deploys in **two** transactions: create the clone, then one atomic
-  `multicall` carrying the script chunks, the PostParam schemas, the dependency declarations, the
-  on-chain-URI legs, and any reserve mints. There is no rollback. When the second one fails you own a
-  live-but-unusable contract — and the CREATE2 salt reserved for its address is **spent**, so the dry
-  run's pinned-salt reproduce command can never be run again. One reporter session produced three
-  orphaned contracts from three attempts; another produced five.
-
-  The useful half of that report is that those contracts were **recoverable, not lost**: resending the
-  setup with an adequate gas limit completed one, after which `abx verify` reported chain-complete and the
-  token returned its on-chain `animation_url`. The tester did it by hand with `cast`. We deliberately
-  never documented that as a recipe — telling a creator to hand-assemble a multicall is worse than telling
-  them nothing — so this is the verb.
-
-  ```bash
-  abx deploy-code --resume 0x… <the same content flags the original deploy used> --dry-run
-  ```
-
-  It deploys nothing. It reads what the contract already holds and sends only the missing legs, in one
-  transaction — safe to run twice, and if nothing is missing it sends nothing and says so. Three judgments
-  carry it:
-
-  - **Chunks compare by content, not by count.** A count check would call a chunk "present" when a hand
-    repair wrote different bytes at that index — and a hand repair with `cast` is exactly what happened.
-  - **A schema that already exists is left alone.** Re-writing one is an upsert that can strand values
-    already stored under it; that hazard belongs to `set-schema` and its guard, never to a repair.
-  - **Mints are a shortfall against current supply, never a re-send.** `mint` is the one non-idempotent
-    leg, and a token cannot be un-minted.
-
-  `--salt`, `--721c`, `--bootstrap-factory` and `--mint-all` are refused rather than ignored: they all
-  describe how a contract is _created_, and this creates nothing. ERC-721C especially — enrollment is
-  deploy-time-only and permanent, so silently accepting the flag would imply it can be added later.
-
-  It shares the deploy's own setup-leg builder, so a resume can never drift from what a fresh deploy would
-  have written — a second implementation of that sequence is the failure mode a repair verb most easily
-  introduces. Signing goes through the same choke point as every other write, so `--sign` / `--unsigned` /
-  the owner check / the chain-id guard all apply, and `--dry-run` previews the repair (one bug found and
-  fixed while building this: the deploy's dry-run block returned first, so `--resume … --dry-run` printed a
-  fresh-deploy plan with a newly-reserved salt and a different predicted address).
-
-  15 tests, including every diff branch and the four refusals.
-
-- df298d8: `--json` on every value-emitting command: `mint`, `deploy`, `deploy-series`, `deploy-code`, `state`, `verify`
-
-  Closes backlog B19. The rule it enforces, from an integrator who drove the CLI from a server: **a value
-  a program needs must be obtainable without parsing prose.** They had to regex-scrape ANSI-coloured
-  stdout for every value — and an escape code was captured into a locator, written into a _stored_ player
-  URL, and 404'd in production. The cause was found only by inspecting stored bytes.
-
-  Under `--json`, **stdout carries exactly one JSON document and nothing else.** Every narration line the
-  command would print for a human moves to **stderr** — diverted, not suppressed, because a human
-  watching a deploy still wants to see it while a program redirecting stdout still gets a clean parse.
-  (The update check already wrote to stderr for exactly this reason; this carries the instinct through to
-  the values themselves.)
-
-  - **`mint --json`** → `{tokenIds, txHash, blockNumber, sent, …}`. The token ids come from the mint's own
-    `Transfer(from=0x0)` logs, not from re-reading `nextTokenId` afterwards — a concurrent mint would make
-    that answer wrong, and a number that is usually right is worse than no number. A `--count N` batch
-    reports all N.
-  - **`deploy` / `deploy-series` / `deploy-code --json`** → the address, emitted _the moment it is known_
-    rather than at the end, so a failure in the indexing steps that follow still leaves the caller with
-    the address of a contract that really exists. That matters most for `deploy-code`, which is two
-    transactions: if the setup tx fails, the address of the live-but-incomplete contract is exactly what a
-    recovery needs (backlog B15). With `--dry-run` it reports the **predicted** address plus
-    `saltPinned` — false meaning a plain re-run reserves a fresh salt and lands elsewhere, so a caller
-    must not treat it as reserved.
-  - **`state --json`** → the on-chain snapshot as data, with canonical **names** for param types and auth
-    legs rather than raw Solidity enum indices (a caller must not have to know the enum ordering), and
-    `undefined` (getter absent) kept distinct from a zero address (present, deliberately unset).
-  - **`verify --json`** → the findings, with `ok` matching the exit code. This is the one command a CI job
-    would gate on, since it already exits non-zero on a byte mismatch. The tri-states stay tri-states:
-    `canonical` and each check's `verified` are `true | false | null`, because collapsing "couldn't check"
-    into "failed" would report a normal state as a failure.
-
-  The mechanism is a single shared helper (`withJson`) rather than a `quiet` flag threaded through every
-  command body — deliberately, since the alternative is touching dozens of call sites where the one that
-  gets missed is a stray line that corrupts a parse, i.e. the exact failure being fixed. A command that
-  emits no payload leaves stdout **empty** and exits non-zero rather than printing a `{}` a caller would
-  trust. 8 tests cover the channel contract itself, including that the swap is restored when a body
-  throws.
-
-- df298d8: `abx storage status <locator>` — is it retrievable yet, or only accepted?
-
-  Backlog B21, and the second half of a gap two independent integrations hit eight days apart. An upload
-  service answers "accepted" the moment it holds your bytes; a gateway serves them only once they
-  propagate, and on Arweave that runs to minutes. Nothing in the upload result distinguished the two, so
-  the natural implementation — upload during a mint, write the locator into the token — mints a token
-  that renders broken for the first minutes of its life.
-
-  The first reporter rebuilt this layer themselves (ranged GETs, a propagating/ready model, retry ladders
-  lengthened after measuring real times) and concluded "every serious integrator will rebuild some
-  version of this." The second published 32 renders and found **32/32 404ing on `arweave.net` while 22/32
-  already served from `permagate.io` and `vilenarios.com`**, with the uploader reporting `CONFIRMED`
-  throughout — and the expensive part is what a creator does next, since a placeholder on a fresh drop
-  reads as a failed render, so you re-run `abx render --force` and re-upload everything for nothing.
-
-  That second observation shapes the design: propagation is **per-gateway**, so the check probes the
-  gateway your project actually uses _plus two others_, which buys a third verdict the reporters' own
-  two-state model couldn't express.
-
-  - **`ready`** — your gateway serves the bytes. Safe to reference.
-  - **`propagating`** — another gateway serves them, so the data **provably exists** on the network and
-    yours is merely behind. Waiting is the fix, and the command says plainly not to re-upload.
-  - **`unreachable`** — nothing probed serves them. Deliberately _not_ called propagating: from outside,
-    a locator that is still settling and one that is simply wrong look identical, and reporting the
-    friendlier of the two is how a tool teaches someone to ignore it. When every gateway rejects the id
-    itself (a 4xx that isn't 404) rather than just missing it, that _is_ evidence, and the output says
-    "malformed locator, waiting will not fix it" — the inverse mistake of waiting out a typo costs more
-    than a needless re-upload.
-
-  Accepts every form a locator arrives in (`ar://`, `ipfs://`, a gateway URL, a bare txid/CID, with a
-  directory path suffix), reads **headers only** via a ranged request with the body cancelled — so
-  checking a 40 MB asset doesn't download it — and **exits non-zero unless ready**, which makes waiting a
-  one-liner instead of a retry ladder: `until abx storage status <loc> --json; do sleep 10; done`.
-
-  The primitive is `locatorStatus()` in `@artblocks/abx-storage`, not CLI-only (per B20): anything
-  programmatic should call it in-process rather than spawning the CLI per check. `abx render`'s existing
-  propagation note now points at the command, so the advisory has an answer attached.
-
-- df298d8: `abx tokens <address>` — every token's owner, seed, and params, from chain alone
-
-  The most obvious post-deploy question about a generative collection — _what did the seeds actually
-  deal?_ — had no command. `abx verify` reports per-token minted/render status but no seed; `abx
-tokenuri` prints one token and the seed lives inside its base64 `animation_url`; `abx inspect` is
-  pre-deploy and static. An agent's workaround was to start `abx serve`, `GET /api/project/<addr>`,
-  base64-decode each `tokenURI`, base64-decode the `animation_url` inside it, then regex
-  `0x[0-9a-f]{64}` out of the resulting HTML — 32 times. Every input to that was already a plain
-  contract read.
-
-  `abx tokens <address> [--json] [--from <id>] [--limit <n>]` is chain-only: no indexer projection, no
-  running resolver, no event scan. The params store maintains its own key lists inside its write paths
-  (`tokenParamKeys` / `contractParamKeys`) and `seed` is a reserved param read by name, so the whole
-  listing is `eth_call`s — available to anyone with an RPC URL, including before any indexing has
-  happened. Seeds print in full (truncating the one value the command exists for would repeat the
-  `tokenuri` bug); `--json` emits `{tokenId, owner, seed, params}` per token, contract-scope params
-  once on the parent rather than copied into every row.
-
-  It reports honestly across all three token types rather than failing: a 1/1 has no params extension
-  and says so (owners still list), a pre-enumeration project still yields seeds and flags that params
-  can't be enumerated, and an id whose `ownerOf` reverts is `null` — not "not minted", because a
-  burned id and an unminted id revert identically and a chain-only read can't tell them apart.
-
-  Two things it deliberately is not. It is not a trait spread: a trait comes from running the script
-  against the seed, which is `abx render`'s job — the token-scope _param_ spread it does print is
-  labelled as such. And the reader is in the **SDK** (`listTokens`), not just the CLI, so a
-  programmatic integrator gets it without reimplementing it.
-
-  Backlog B25 (from the 2026-08-04 tester batch, feedback `dcfdc6f4`).
-
-- df298d8: `abx tokenuri --fetch` — follow the URL the contract commits to and print what is actually served
-
-  Closes backlog B14. No command printed the served JSON body: `tokenuri` read the chain, `verify`
-  re-hashed bytes, `status` reported the indexing lifecycle — each a different slice, none of them the
-  document a marketplace actually reads. An agent in a cold sweep fell back to raw `curl` for exactly
-  this, which is the tell that a command was missing.
-
-  ```bash
-  abx tokenuri 0x… --fetch          # GET the baked URL, print the served body + HTTP status
-  abx tokenuri 0x… --fetch --json   # {tokenURI, onChain, served: {url, status, contentType, body}}
-  ```
-
-  It also answers the question a _warning_ could not, which is why the other half of B14 stays declined.
-  "Nothing tells you the provider you registered with isn't the base baked on-chain" is a real gap, but
-  the obvious check — compare the remote's base URL to the on-chain one — false-positives on the common
-  custom-domain case (a baked `meta.artist.xyz` fronting `api.provider.xyz`), and a warning that cries
-  wolf on the correct setup is worse than none. Fetching what the **baked** base returns makes the
-  mismatch self-evident instead: you see the other provider's 404, or another project's document, with no
-  guessing and no false positive.
-
-  Three judgments worth naming:
-
-  - **A `data:` URI is not a failure.** It IS the document, and a fully-on-chain project's whole point is
-    that there is no server to ask — so it reports "nothing to fetch" and exits 0. Treating it as an error
-    would punish the strongest configuration the protocol offers.
-  - **A dead host and a served error are different answers**, because they route to different fixes ("your
-    provider said no" vs "the URL a marketplace will ask is unreachable").
-  - **A non-2xx says it is about the SERVICE, never a mistyped path** — the URL came from the chain, so it
-    is right by construction, and the readout points at `abx status --remote` for the lifecycle.
-
-  Under `--json` the body is verbatim and untruncated and a non-2xx exits non-zero, so CI can gate on it;
-  the human readout clips at 1200 chars and says how many it clipped. The fetch itself lives in
-  `src/served.ts` with an injectable `fetch`, since `main.ts` exports nothing — the same reason
-  `scaffold.ts` was extracted.
-
-  This retired the last two `curl` recommendations in the shipped skill: verifying an attach is now
-  `abx tokenuri <addr> --fetch` (the served document carries the `artifacts` manifest), and the skill's
-  claim that `tokenuri` "follows" the URL — previously true only of `contracturi` — is now accurate.
-
-- Updated dependencies [df298d8]
-- Updated dependencies [df298d8]
-- Updated dependencies [df298d8]
-  - @artblocks/abx-sdk@0.1.0-alpha.9
-  - @artblocks/abx-token-api@0.1.0-alpha.12
-  - @artblocks/abx-storage@0.1.0-alpha.9
-  - @artblocks/abx-indexer@0.1.0-alpha.10
-
-## 0.1.0-alpha.16
-
-### Patch Changes
-
-- 8f3c63c: Four output surfaces that misinformed: an occupied port, a repeated `verify` advisory, a silently-dropped `tokenuri` argument, and a release-notes URL that 404s.
-
-  **`abx serve` / `abx preview` on an occupied port crashed with a raw Node stack trace.** `listen()` had
-  no `'error'` handler, so `EADDRINUSE` reached Node's default handler and printed a trace through
-  `node:net` and our own `dist/` paths. In a CLI where every other error is formatted, that reads as a
-  crash inside abx rather than a port conflict, and it leaks internal paths. Both commands now preflight
-  the port and name the port and the fix in one line — `demo` already did this, and the check it used is
-  now shared. (`preview`'s default 8788 colliding with a studio left running in another terminal was
-  reported as the harder-to-diagnose half of this.)
-
-  **`abx verify` printed the identical thumbnail advisory once per token.** On a 32-token project with no
-  local renders that was 32 consecutive copies of the same full sentence — ~4KB of text for one fact —
-  which pushed the four lines that answer "did my deploy work" off a default terminal. It now prints one
-  line per outcome with a count and the affected token ids (truncated past 12), so the same information
-  costs three lines at 32 tokens and three lines at 1000.
-
-  **`abx tokenuri <address> 0` silently ignored the `0`** (the token id is `--token`) and printed token 0 —
-  a _coincidentally correct_ answer, which is the dangerous kind: `… <address> 7` would have printed token 0
-  just as confidently and exited 0. A stray positional is now refused, and a numeric one names the
-  corrected invocation. The `positionalArgs` helper moved next to `parseFlags`, because the two must
-  consume argv by the same rule — the obvious hand-rolled version of this check reads `--token 0` as a
-  stray `0`.
-
-  **The update banner pointed at `github.com/ArtBlocks/abx/releases`, which 404s** for anyone outside the
-  org, and no changelog shipped in the package — so "what changed?" was unanswerable. A tester
-  reconstructed the diff by running the same dry run on two versions, which is how they discovered the
-  canonical singletons had moved and then had no way to tell whether it needed them to act.
-  `CHANGELOG.md` now ships with the package and **`abx changelog`** prints it (offline, version-matched;
-  `--all` for the full history), with npm's version list as the online pointer. The upgrading guide now
-  also states the thing they had to test for themselves: a singleton redeploy repoints the manifest for
-  _new_ deploys and leaves already-deployed contracts unaffected.
-
-  **Plus one propagation note.** `arweave.net` — the default gateway, and the one baked into the locator —
-  indexes new uploads on a delay, so a freshly published render can 404 there for minutes while Turbo has
-  already confirmed it. A tester saw 32/32 404ing on arweave.net while 22/32 already served from other
-  ar.io gateways. Unexplained, that reads as a failed render, and the natural next move is
-  `abx render --force` on everything — a full re-upload that fixes nothing. `abx render` now says so after
-  an Arweave publish, and names `ABX_ARWEAVE_GATEWAY` for baking a different gateway (it is fixed at
-  publish time, since the locator is what the resolver registers). The note stays quiet when the operator
-  has already chosen a non-default gateway.
-
-  _(From the 2026-08-04 tester batch: feedback `eb972036`, `57bee789`, `dcfdc6f4`, `5a052398`, `e0f30e22`.)_
-
-- 8f3c63c: Two writes that reported success without doing what the creator meant now refuse: `lock-field` on a parameter key, and a `Bytes` parameter given text.
-
-  Both are the same defect wearing different clothes — the CLI made statements that were individually
-  true and collectively a promise it wasn't keeping.
-
-  **`lock-field` reported "permanent" on a PostParam key and left the param writable.** A tester welded
-  `grid` — a `Bytes` param holding the artwork — with `abx lock-field <addr> --field grid`. It printed
-  `Lock token #0 field "grid" — permanent`, `tokenFieldLocked(0,"grid")` returned `true`, and the very next
-  `configure-param grid <junk>` **succeeded** and overwrote the artwork. Nothing lied: fields and params
-  are separate namespaces that may share a name, and `lock-field` had locked the _field_. But the creator
-  was told their work was permanently protected when it had no protection at all, and permanence is the
-  pitch. `lock-field` now reads `paramSchema(<name>)` first and **refuses** a declared param key, naming
-  the mechanism that does weld a param (`abx set-schema … --schema <key>:<Type>:<Auth>:lock=now`), with
-  `--force-field` for the rare case where you really do mean the metadata field.
-
-  **A `Bytes` parameter stored whatever characters you typed, as UTF-8.** Passing base64 — reasonable,
-  since the params docs say a `Bytes` value "becomes base64" — stored 172 bytes of base64 _ASCII_ where
-  128 packed bytes were meant; `0x`-prefixed hex was stored as its 258 literal characters too. Nothing
-  errored, and an in-chain renderer reading the param drew garbage from ASCII with no failure anywhere in
-  the chain. A `Bytes` value must now say what its bytes are: `0x`-prefixed hex, or `--file <path>`. A bare
-  string is **refused** rather than guessed at, because there is no safe guess between "these characters"
-  and "these bytes", and the wrong guess is invisible until an artwork renders wrong. (`String` is
-  unchanged — there, the characters _are_ the value.)
-
-  The docs' "becomes base64" describes the **read** side — how a program receives the value — and now says
-  so, next to the two write forms.
-
-  Also fixed: the byte count that was already the tell. The write echoed the _input string's_ length, so
-  the mismatch was visible at write time and printed as if it were fine (`Configure grid (data, 172
-bytes)`). It now echoes the decoded byte count and where the bytes came from.
-
-  _(From the 2026-08-04 tester batch: feedback `e86081a1`, `b0e88b17`.)_
-
-- 8f3c63c: The renderer scaffold's `IAbxParams` can now read `Bytes` and `String` parameters — the two types that can carry an actual payload.
-
-  The scaffold's interface declared only `tokenParam` / `contractParam`, both returning
-  `(bytes32 value, bool valueIsHash, bool isSet)`. So a renderer written against the documented interface
-  could not reach a `Bytes` or `String` value at all: it got a keccak commitment and no way to the blob.
-  The token has always exposed `tokenParamData(uint256,bytes32)` and `contractParamData(bytes32)` — a
-  tester found them by grepping the CLI's bundled ABI, declared them by hand, and it worked.
-
-  Since `Bytes` and `String` are precisely the types that can hold a real payload (~24KB per key), leaving
-  them out made the in-chain art lane look limited to scalars unless you went digging. Both readers are now
-  in `src/interfaces/IAbxParams.sol`, with the rule stated where the mistake happens: scalars come from the
-  `bytes32` reader, payloads from the data reader, and a `Bytes` param read through `tokenParam` hands you a
-  hash — which renders garbage without failing anywhere.
-
-  The scaffold's own tests carry the pattern rather than just describing it: `MockParams` now models a
-  payload param the way the real contract does (the scalar slot holds `keccak256(content)` with
-  `valueIsHash` true), and two tests show the read plus the commitment check, and that an unset payload key
-  returns empty bytes rather than reverting. The renderers page documents the pair alongside the scalar one.
-
-  _(From the 2026-08-04 tester batch: feedback `d2ac4f2e`.)_
-
-- 8f3c63c: `abx scaffold-renderer` wrote **zero files** for every installed user while reporting success — fixed, and pinned by the test that was missing.
-
-  The command created the target directory, printed the full green-check walkthrough (`cd renderer`,
-  `forge soldeer install`, `forge test`, the deploy script, "full walkthrough: renderer/README.md") and
-  **exited 0**. The directory was empty. No `src/`, no `foundry.toml`, no `README.md`. Three testers
-  reproduced it independently — 3 of 3 and 4 of 4 attempts, across all three invocation forms (relative
-  name, absolute path, and the no-arg default) — on alpha.9, alpha.12 and alpha.14.
-
-  **The cause was a path filter that judged absolute paths.** The copy excluded build dirs with
-
-  ```js
-  filter: (s) =>
-    !/(^|\/)(out|cache|dependencies|broadcast|node_modules)(\/|$)/.test(s);
-  ```
-
-  `cpSync` hands `filter` **absolute** source paths, and an installed CLI lives at
-  `…/node_modules/@artblocks/abx-cli/assets/renderer-scaffold`. So the pattern matched the source
-  **root**; `cpSync` skips a directory's entire subtree when the directory itself is filtered out, and
-  does it _silently_ rather than erroring. A dev checkout's path
-  (`…/packages/cli/assets/renderer-scaffold`) contains no `node_modules`, so every test we ran passed and
-  every user got an empty directory. The scaffold assets were always in the published package — this was
-  never missing content, only a copy step that no-oped.
-
-  Fixed on both axes, because either one alone would have let this ship:
-
-  - **The filter judges paths relative to the scaffold root**, so `node_modules` in the _install_ path is
-    irrelevant while `out/`, `cache/`, `dependencies/`, `broadcast/` inside the scaffold are still skipped.
-  - **The command asserts its own output.** It now throws if `src/MyRenderer.sol` isn't there afterwards,
-    instead of printing a success banner over nothing. Exit 0 plus a green check is what made this
-    expensive: an agent has no reason to look back at a step that reported success, so the failure
-    surfaced far away — `forge soldeer install` dying in an empty directory.
-
-  The copy logic moved to `src/scaffold.ts` so it can be tested at all (importing `main.ts` runs the CLI),
-  and `test/scaffold.test.ts` copies **from a path containing `node_modules`** — the layout every user has
-  and the one case no previous test covered — plus an end-to-end run asserting the scaffolded project is
-  non-empty and contains the files the success message names.
-
-  This was the documented entry point to the in-chain Solidity lane and the only documented route to
-  `--image-renderer` / `--attributes-renderer`, so it blocked that lane outright. The full walkthrough
-  (`forge soldeer install` → `forge test`) now runs clean: 10 tests pass in a freshly scaffolded project.
-
-  _(From the 2026-08-04 tester batch: feedback `6f2f980a`, `b45bc0f8`, `d2ac4f2e`.)_
-
-- 8f3c63c: The agent skill now names the both-worlds code lane, the payload-param reader, and the verb that welds a parameter.
-
-  Four corrections, all from the same batch that produced the CLI fixes — the skill described the lanes in a
-  way that made the strongest option invisible:
-
-  - **`--script` plus `--image-renderer` is now a lane in its own right.** The table and the in-chain
-    section both said "no `--script`", which is a true constraint of the _renderer-only_ shape and read as a
-    prohibition on combining them. A program with Solidity renderers gets `animation_url` from its on-chain
-    chunks _and_ an on-chain `image`/`attributes` — every marketplace surface in-chain with nothing to
-    render, host, or refresh. That is the best available answer for an interactive generative drop and it
-    was reachable only by ignoring the skill.
-  - **Renderers are told which reader a `Bytes`/`String` param needs.** The guidance said to read params via
-    `tokenParam`/`contractParam`, which for the two payload types returns a keccak commitment — so a
-    renderer written from the skill drew garbage from a hash with nothing failing. `tokenParamData` /
-    `contractParamData` are now named where the mistake happens.
-  - **`configure-param`'s payload encoding is explicit**: `String` takes text, `Bytes` takes `0x` hex or
-    `--file`, and a bare string on a `Bytes` key is refused.
-  - **Locking a param points at `set-schema … :lock=now`**, since `lock-field` freezes the same-named
-    _field_ and now refuses a declared param key.
-
-  _(From the 2026-08-04 tester batch: feedback `c283d767`, `d2ac4f2e`, `b0e88b17`, `e86081a1`.)_
-
-- 8f3c63c: The `deploy-code` **Surfaces** preflight no longer contradicts itself, and a script plus an on-chain image renderer is now a documented combination rather than an open question.
-
-  The `[5] Surfaces` block is the most-praised thing in the deploy preflight — a tester singled out its
-  "not backfillable" framing as the direct fix for a confusion they'd filed a version earlier. It also
-  told two lies in adjacent lines, both found while answering their follow-up question.
-
-  **"One or more surfaces resolve to NOTHING a marketplace can see" fired when none did.** An undeclared
-  param was folded into the broken-surface test, so a deploy with both renderers set printed
-  `thumbnail: ON-CHAIN ✓` and `traits: on-chain ✓` and then, two lines later, that a surface resolved to
-  nothing — re-recommending `--image-renderer` and `--attributes-renderer`, the exact flags already
-  passed. A dropped param is not a dead surface: the piece renders, that input takes its default. The
-  alarm now covers only the thumbnail and traits, names only the remedies for what is actually broken, and
-  says _which_ surface. Dropped params keep their own, milder line.
-
-  **An on-chain image renderer was told to stand up a render runner.** With `--image-renderer` _and_ a
-  script, the block recommended `abx deploy-effects`, a one-shot `abx render`, and a publish-capable
-  storage backend — none of which apply, because an in-chain SVG has no off-chain still to render, host,
-  or refresh. It now says `nothing to render` for any on-chain image lane, with the from-chain check.
-
-  **And the question the tester explicitly flagged as untested — does passing a script _and_ an
-  `--image-renderer` yield both a live `animation_url` and an on-chain thumbnail? — is yes.** Verified on a
-  dry run: `animation_url` still assembles on-chain from the script chunks while `image` and `attributes`
-  are computed by the Solidity renderers, so every marketplace surface has an on-chain home in one deploy
-  with nothing to run. The deploy guide now leads the content-lane section with that combination instead of
-  implying the two lanes are an either-or.
-
-  The guide also gains the correction to the _other_ half of that question. A resolver plus
-  `abx render --backend arweave` does **not** backfill a `--onchain-uri` drop's marketplace surfaces: it
-  sends no transaction, so `tokenURI` keeps returning the on-chain JSON with its placeholder `image` and
-  no `attributes`, which is what marketplaces read. Checked against the reporter's own live 32-token
-  contract — `tokenURIBase` is empty, the metadata renderer is authoritative, and `image` provenance still
-  reads `fallback — image field unset`. Publishing stills to a resolver is real and useful, and closing
-  those surfaces afterwards takes owner transactions that re-point resolution. The guide now says so
-  plainly, since "just render to a resolver later" would have been a new false promise in place of the
-  old one.
-
-  Three tests pin the block: an undeclared param never claims a dead surface, an on-chain image renderer
-  is never sent to a runner, and a script with no renderer and no resolver still reports both surfaces
-  dead.
-
-  _(From the 2026-08-04 tester batch: feedback `c283d767`, `991dc8e2`, `7936334b`, `a319e53f`.)_
-
-## 0.1.0-alpha.15
-
-### Minor Changes
-
-- e325b46: Opt-in ERC-721C support across the toolkit — plain ERC-721 stays the transparent default.
-
-  SDK: `OneOfOneInitParams`/`SeriesInitParams` (and `SeriesCodeInitParams` by inheritance) gain
-  `transferValidator` immediately after `royaltyBps` — `zeroAddress` = plain ERC-721 forever (the
-  default), non-zero = permanent 721C enrollment with that validator. A new `creator-token` module
-  ships the per-chain `RECOMMENDED_TRANSFER_VALIDATOR` (OpenSea's
-  StrictAuthorizedTransferSecurityRegistry, verified live on Sepolia + Base Sepolia), the two
-  creator-token ERC-165 ids + the ABX extension id, `readCreatorTokenStatus()` (`{enrolled,
-validator}`), and a `prepareSetTransferValidator()` write wrapper.
-
-  CLI: the deploy commands take `--721c [recommended|0x…]` — absent means zero behavior/output
-  change; `recommended` resolves the per-chain constant (refused, naming the chains that have one,
-  where none is known); an explicit address is EIP-55-validated and pre-checked for code before any
-  gas. Enrolling prints one plain statement of what enforcement means. A new owner op
-  `abx set-transfer-validator <address> <0x…|none|recommended>` re-points or suspends an ENROLLED
-  collection's validator (guards `--dry-run`; refuses plain ERC-721s up front — enrollment is a
-  deploy-time decision). `abx state` shows the validator for enrolled collections only.
-
-### Patch Changes
-
-- Updated dependencies [e325b46]
-  - @artblocks/abx-sdk@0.1.0-alpha.8
-  - @artblocks/abx-indexer@0.1.0-alpha.9
-  - @artblocks/abx-storage@0.1.0-alpha.8
-  - @artblocks/abx-token-api@0.1.0-alpha.11
-
-## 0.1.0-alpha.14
-
-### Minor Changes
-
-- 1b50f9d: On-chain param enumeration: a project's parameters are now readable from the chain that holds them, and the `params.keys` convention is retired.
-
-  The params store was unenumerable by design, so anything that wanted to know _which_ parameters a
-  project has had to be told. The answer was a convention: a `params.keys` contract param holding a
-  comma-separated list, composed by `deploy-code` from the `--schema` flags and hand-maintained
-  thereafter. It worked, and it had the defect every hand-maintained index has — a key configured but
-  not listed was **silently omitted from every render**. The schema existed, a collector could set it,
-  the art never saw the value, and nothing anywhere reported a problem. The CLI grew a nudge, then a
-  same-transaction companion write, and both were treatments for a design that should not have needed
-  them.
-
-  **The token now maintains its own key lists.** `SeriesCode` gains `tokenParamKeys(tokenId)`,
-  `contractParamKeys()`, and `paramSchemaKeys()` (plus `…Paged` variants for surfaces past an RPC's
-  return cap). The lists are updated inside the write paths themselves, so `key ∈ list ⟺ the param is
-set` holds for every writer — raw owner writes, governed `configure-param` writes, hook-driven writes,
-  all of them. No caller can forget, because no caller is involved. (`seed` is deliberately never listed:
-  every consumer reads it as a tokenData coordinate, and indexing it would charge every seeded mint for
-  nothing.) `paramSchemaKeys()` closes the other half — a chain-only frontend can now build a configure
-  UI, including for keys declared but never yet written, which nothing off-chain could previously
-  discover.
-
-  **The canonical `AbxGenerator` reads that surface instead of the CSV.** It no longer looks at
-  `params.keys` at all, and a `params.keys` value set on a new project is simply an ordinary parameter —
-  enumerated and emitted like any other, by both the generator and the SDK. A latent parity bug dies with
-  the convention: the generator's no-CSV path emitted tokenData in insertion order while the canonical
-  serializer sorts, so the two byte-forms could disagree; there is now one form.
-
-  **`AbxMetadataRenderer` is spec v4.** `tokenURI` gains a computed `abx_params` object — every set
-  parameter, contract and token scope merged, token wins, sorted, decoded by the same rules the generator
-  and the SDK use. A data-backed value over 2048 bytes is emitted as `{"keccak256":"0x…"}` — its on-chain
-  commitment — rather than inline, so a large `Bytes` parameter cannot bloat `tokenURI` past a single
-  `eth_call`; every key still appears, and an oversized one degrades self-describingly. Parameters are
-  _not_ folded into `attributes`: that stays the creator's surface. Also in v4: an `animation_url` carried
-  by the `inline` or `reader` representation is now wrapped as `data:text/html;base64,…`, exactly as
-  `image` already was — the asymmetry was an oversight, and it meant a fully on-chain animation was
-  handed to wallets as bare text.
-
-  Both changes are additive on the read side: pointed at a token that predates enumeration, a v4 renderer
-  simply emits no params block. **Repointing the metadata renderer is safe anywhere.** Repointing the
-  _generator_ is not, and `abx set-field` now refuses it: a legacy implementation plus the current
-  generator means every parameter silently vanishes behind a `tokenURI` that still looks healthy, so the
-  CLI stops you rather than warning you, and names both ways out (stay on the project's existing
-  generator, or redeploy).
-
-  Everywhere else in the toolkit, the convention is simply gone:
-
-  - `deploy-code --onchain-uri` sets up in **three** legs, not four (animation field → generator, plus
-    the two URI renderers). There is no key list to compose, report, or keep in sync, and the help text
-    no longer teaches one.
-  - `abx set-schema` is a single op again — no companion write, no multicall. This **supersedes**
-    alpha.13, which shipped `set-schema` writing `params.keys` in the same transaction to stop a governed
-    key going unlisted: the contract now maintains its own key list, so there is nothing to keep in step
-    and the drift that fix guarded against is gone rather than mitigated. Same for that release's note
-    that "there is no on-chain enumeration of schema keys" — `paramSchemaKeys()` is exactly that.
-  - `abx state` reads the governed surface from `paramSchemaKeys()` and the collection-scope values from
-    `contractParamKeys()`. A project deployed before enumeration falls back to reading its old
-    `params.keys` list, read-only, so live testnet drops still describe themselves.
-  - `abx verify` notes when a project's enumerated surface exceeds ~64 keys — the documented design
-    envelope. The write side is unbounded; the read side is what grows, since `tokenURI` and `tokenData`
-    assemble every parameter per call.
-  - `abx configure-param <addr> - params.keys <csv>` no longer has a special path. Writing that key is
-    now an ordinary schema-less contract param, and it shows up in tokenData as one — honest, and
-    documented.
-  - `abx_params` joins `artifacts` and `abx_provenance` as a computed key `set-field` and `attach` refuse.
-
-  The SDK needed no semantic change: `buildTokenData` has always been event-derived (coordinates + seed +
-  every set param, both scopes, token wins, augment entries), and the contract enumeration implements
-  exactly that rule. Its `deployments` manifest carries the new addresses.
-
-### Patch Changes
-
-- 1b50f9d: Fixes from an integrator batch: a machine-readable `tokenuri`, one Arweave identity across CLI and SDK, a correct OpenSea refresh, and attach telling the truth.
-
-  **`abx tokenuri --json`.** The command abbreviated long values (`… (382 chars)`) with no way to turn it
-  off, so for a token whose whole point is on-chain content it returned something that _looked_ like the
-  metadata and wasn't. An integrator scraped it, stored a `data:` URI cut to 96 characters, and only
-  found out in production; they abandoned the CLI as a read path and reimplemented `eth_call`. `--json`
-  now emits the verbatim decoded document — no banner, no ANSI, no truncation — so
-  `abx tokenuri <addr> --json | jq` is a supported read path. The human view still abbreviates, and now
-  says `[--json for the full value]`.
-
-  **One Arweave identity, resolved in one place.** `arweaveConfigFromEnv()` read `ARWEAVE_JWK` and
-  nothing else, while the CLI mints and manages `.abx-self-host/arweave-key.json`. Porting a working CLI
-  flow to the SDK — same machine, minutes later — failed every upload with "Arweave via Turbo needs an
-  identity", a message that says storage was never configured when the truth was that two layers
-  disagreed about where the identity lives. `@artblocks/abx-storage` now exports `resolveArweaveJwk()`
-  (env → managed key file) and the CLI delegates to it. Its diagnostics come with it: an empty key file
-  now reports the **path** and the remedy instead of `Unexpected end of JSON input`, and a corrupt one
-  says the same.
-
-  **`abx refresh` on the default chain.** The OpenSea slug map held only `sepolia` and `mainnet`, so
-  `base-sepolia` — the CLI's own default — fell through to the raw key: the refresh POST went to a slug
-  OpenSea doesn't know, and the printed link pointed at **mainnet** `opensea.io` for a testnet token.
-  Slugs are now correct (`base_sepolia`), `testnet` comes from the chain registry rather than a second
-  hand-maintained set, and a chain with no known slug produces **no link** instead of a wrong one. Same
-  shape as the hardcoded explorer table that once sent every Base Sepolia link to Etherscan.
-
-  **`abx attach` names its dependency.** Attaching artifacts to a project that resolves on-chain now
-  warns, before the send, that they will **not** appear in `tokenURI` — the on-chain renderer carries
-  reserved fields only, and the artifacts manifest comes from a resolver. A team attached five audio
-  stems to a fully-on-chain token and found them "paid for, stored on-chain, and invisible"; the note
-  that existed was one dim line that read as a footnote rather than as a missing service.
-
-  **`ensureChunkStore` moved to the SDK.** The bootstrap every on-chain-content path needs existed only
-  inside the CLI, so an SDK integrator got `resolveChunkStore()` (may return undefined) plus a separate
-  `storeSupportsWriteContent()` they had to remember — forget it and an incapable store fails _deep
-  inside a mint, after transactions have landed_. One team hand-rolled the guard for exactly that reason.
-  `ensureChunkStore(publicClient, send, {chainId, override, onEvent})` is now exported; the SDK reports
-  progress through `onEvent` instead of printing, and the CLI keeps its narration.
-
-  **`abx storage upload --json`.** The locator as data. They scraped this line, captured its ANSI colour
-  codes along with the URL, wrote the result into a _stored_ player URL, and found out when it 404'd in
-  production. In `--json` mode stdout carries the JSON and nothing else; progress moves to stderr.
-
-  **`--backend ipfs` no longer hides a missing credential.** Without `PINATA_JWT` the backend resolves to
-  **kubo against a local node**, so a dry run looked fine and the real upload failed for anyone not running
-  one. The preview now says so. Related correction: the skill claimed "a backend missing its secret falls
-  back to `fs`" — it does not. `cloud` refuses up front naming the missing values, and `ipfs` goes to the
-  local node; nothing silently degrades to local disk. Both sides now say the same thing.
-
-  Reported in the 2026-08-03 MXRR integration batch (feedback 869f27b1, a256217f, 119d7e8e, 975c363e,
-  e38216db, e267078b).
-
-- 1b50f9d: Unknown flags on a command that can send now **refuse** instead of warning — and `--chain` teaches `ABX_CHAIN`.
-
-  `abx deploy-code … --chain sepolia` ran to completion **on the default chain** (base-sepolia). There is
-  no `--chain` flag — the chain comes from the `ABX_CHAIN` environment variable — and the generic
-  stray-flag warning said so, accurately, and then the command carried on. On a dry run that is a
-  confused minute; on a funded send it is a wrong-chain deploy with real artifacts at an address nobody
-  is watching. Prose that gets ignored once gets ignored again, so:
-
-  - **`--chain` is refused on every command**, read-only ones included (a command that quietly ignored it
-    would still teach the wrong model). The message names the mechanism, the chain that _is_ active, the
-    known chain keys, and the corrected invocation: `ABX_CHAIN=sepolia abx deploy-code …`.
-  - **`deploy`, `deploy-series` and `deploy-code` refuse any unrecognized flag**, naming the offender and
-    pointing at `abx help <command>`. `--dry-run` refuses identically — a preview that accepts what the
-    real send rejects is its own trap, since you would validate a command and have it fail at the one
-    moment it matters.
-  - **Read-only commands still only warn.** Nothing can be mis-sent, and a stray flag shouldn't stop a
-    creator mid-iteration.
-
-  Refusing is safe rather than risky here, and this was verified rather than assumed: a flag absent from a
-  command's allowlist is by construction one that command never reads. Every `flags.x` read inside
-  `cmdDeploy`, `cmdDeploySeries` and `cmdDeployCode` was compared against its allowlist — no gaps — so
-  refusal cannot break a working flag, only make an already-ignored one loud.
-
-  Five tests cover it, including the literal `--chain sepolia` repro, dry-run/real-send parity, and a
-  no-false-refusal pass over the documented deploy flags.
-
-- 1b50f9d: `abx preview --shoot --param key=value`, and `set-schema --force` says what it overrode.
-
-  **`--shoot` can render the collector-has-set-it state.** It only ever shot the _unset_ one, so
-  answering "what does this collection look like when someone picks a theme?" meant hand-rolling a
-  Playwright script against the preview server's `/view` — which is exactly what one agent did. `--param`
-  is repeatable (`--param theme=Neon --param mood=Calm`) and forwards into every frame. An empty value
-  (`--param theme=`) shoots the unset state explicitly, matching the wire shape production uses for a
-  param nobody has written.
-
-  **`set-schema --force` no longer applies a value-stranding change silently.** It refuses such a change
-  by default; with `--force` it now prints each risk it is overriding and notes that any token already
-  holding a value keeps it, now outside what its schema allows. Applying that quietly was the one outcome
-  worse than refusing — nobody, including the operator, got a record of what may have just been
-  invalidated.
-
-- Updated dependencies [1b50f9d]
-- Updated dependencies [1b50f9d]
-  - @artblocks/abx-sdk@0.1.0-alpha.7
-  - @artblocks/abx-storage@0.1.0-alpha.7
-  - @artblocks/abx-indexer@0.1.0-alpha.8
-  - @artblocks/abx-token-api@0.1.0-alpha.10
-
-## 0.1.0-alpha.13
-
-### Minor Changes
-
-- 1158420: Expose the PostParam schema lifecycle: `abx set-schema`, `abx retire-param`, Address legs, and `lock=`.
-
-  Three capabilities the contracts have always had, that the toolkit could not reach — so they read to
-  creators as protocol limitations. All three were reported in the 2026-08-03 tester batch.
-
-  **A project's param surface was never frozen at deploy.** `setParamSchema` is owner-gated with no
-  deploy-time restriction and no `exists` check, so it is an upsert usable for the life of a project.
-  There was just no command for it, and the CLI said so out loud ("Adding a param to an already-deployed
-  contract isn't a CLI command yet"), which pushed designers toward guessing their full param surface up
-  front or redeploying — losing the address, the mints, and the collectors. `abx set-schema <addr>
---schema key:Type:Auth` attaches or replaces one key.
-
-  Because it is a **full-row upsert on a contract that never re-validates stored values**, the command
-  carries a guard rather than a warning: it prints before/after, and _refuses_ a change that could strand
-  values already written under the key — a narrowed bound, a dropped `Select` option, a changed type —
-  unless you pass `--force`. It also flags an existing `lock=` you are about to drop by not restating it.
-
-  **A parameter can be retired.** There is no delete in the contract (`exists` is only ever set true), but
-  a `lockAfter` in the past makes every later write revert `ParamLockExpired`, permanently. `abx
-retire-param <addr> <key>` does exactly that, reading the current schema and changing _only_ the lock so
-  type/auth/bounds/options carry forward untouched. It does not remove the key and does not erase a stored
-  value — a value written under a `TokenOwner`/`Address` leg came from a collector, and the artist
-  deliberately cannot delete it.
-
-  **An `Address` auth leg is now expressible.** `--schema` previously rejected every Address-bearing leg
-  with "set that schema post-deploy via the contract" — advice pointing at a command that did not exist.
-  The auth token now names its holder inline (`board:Bytes:Address(0xabc…)`), and the error for a bare
-  `Address` says what the leg is for: a **contract** may hold it, which is how open and multi-party
-  participation is built today. `authAddress` and `lockAfter` were also hardcoded to zero at the
-  deploy-time call site, so neither was reachable there either; both now flow through `--schema`.
-
-  `--schema` gains an optional 4th field, `lock=<when>` (ISO date, unix seconds, or `now`), sharing the
-  Timestamp grammar the bounds already use. A 4th field that is not `lock=` now reports the spec-shape
-  error instead of a mangled "malformed type", which is what a `:` inside a `Select` label used to produce.
-
-  New in the SDK: `prepareSetParamSchema`, `prepareRetireParam`, `readParamSchema`, `OnChainParamSchema`.
-
-  (feedback 4a0c213a, 5d530681, 381bdcbe)
-
-  > [Superseded 2026-08-03: params now enumerate **on-chain** (renderer spec v4, `abx_params`) and
-  >
-  > > `params.keys` is retired — the contract maintains its own key list, so nothing off-chain has to keep
-  > > it in step and `abx state` reads the chain directly. See the on-chain param enumeration entry.]
-
-  `set-schema` also keeps **`params.keys` in step, in the same transaction**. On the on-chain URI lane
-  the canonical generator builds tokenData from that CSV, so a key that is governed but not listed is
-  silently omitted from every render — the schema exists, a collector can set it, and the art never sees
-  the value. `deploy-code` composes the list from `--schema` for exactly this reason; without the
-  companion write, a schema added later would have quietly half-worked. Projects not on that lane (where
-  `params.keys` is unset) get no extra write.
-
-  > [Superseded 2026-08-03: params now enumerate **on-chain** (renderer spec v4, `abx_params`) and
-  >
-  > > `params.keys` is retired — the contract maintains its own key list, so nothing off-chain has to keep
-  > > it in step and `abx state` reads the chain directly. See the on-chain param enumeration entry.]
-
-  And `abx state` now prints the governed PostParam surface — each key's type, auth, bounds/options, an
-  upcoming lock date, and a `retired` marker for one whose lock has passed. There is no on-chain
-  enumeration of schema keys, so it reads the project's own `params.keys` list, which is also what the
-  generator reads; anything missing from it is invisible to renders anyway. It also names keys listed
-  there with no schema. This is what makes `set-schema`'s upsert safe to use: you can see a key's current
-  shape before overwriting it.
-
-- 1158420: `abx deploy` (1/1) can finally do "image off-chain, JSON on-chain, no server" — the pattern the docs already recommended.
-
-  The decisions table calls this pattern 2 and presents it as the sweet spot for static art. It worked
-  on `deploy-series`. On the 1/1 command it silently did not: `--onchain-uri` inlines the image only
-  when it is an SVG, and a raster fell through to keccak256 custody with no URL wired anywhere, so the
-  on-chain renderer held a hash it could not serve and `tokenURI` returned a **placeholder — forever**.
-  Adding `--backend arweave` changed nothing, which was the cruel part: it looked exactly like the
-  documented recipe. A cold agent asked for "no server, still there in ten years", followed the docs,
-  and would have shipped a permanently broken token.
-
-  `deploy` now takes the same route the Series takes. When `--onchain-uri` meets a non-inlinable image
-  and a backend that can serve a public URL (`arweave` · `ipfs` · `cloud`), the file is uploaded as a
-  one-entry directory — `putDirectory`, the identical call `deploy-series` makes, so both commands
-  produce the same URL shape from one code path — and its URL is baked on-chain as the image field. The
-  bytes are still stored under their content hash as well, so `abx verify` keeps working. A backend that
-  can only serve from this machine (`fs`) still falls through to custody, and still warns.
-
-  The readouts learned that this is a three-way distinction, not a binary, because "no server" and
-  "on-chain" are different promises and a creator buying permanence is choosing between them:
-
-  - image genuinely on-chain (`--onchain-image`, or an inlined SVG) → **"Done — fully on-chain."**
-  - image at a durable URL the on-chain JSON points at → **"Done — metadata on-chain, image on ipfs."**
-    plus a line naming whose permanence it actually is (Arweave paid-once-forever; IPFS while pinned).
-  - neither → the placeholder warning, before the spend, naming both routes that would fix it.
-
-  Verified end to end on Base Sepolia (`0xdE5aCD35b74B6d002781De51217590a9c5B53EDC`): `tokenURI(0)` read
-  straight from chain with `cast` — no `abx`, no server — returns an IPFS gateway URL that serves HTTP
-  200 with bytes identical to the source file, and reports itself honestly in `abx_provenance` as
-  `source: url · onChain: false`.
-
-  Closes B17. Found by the 2026-08-03 parallel agent sweep.
-
-### Patch Changes
-
-- 1158420: `abx inspect` no longer reports dependencies, params, or runtime problems that aren't in the code.
-
-  Every detector in the analyzer was a regex over the raw file, so prose counted as code. One
-  tokenizer pass now gives the detectors a comments-stripped, string-blanked view:
-
-  - **A comment or string mentioning a library is no longer a dependency.** A dependency-free
-    vanilla-canvas sketch whose header read `// no p5` was reported as `libraries: p5`, and the lane
-    recommendation then said `--dep p5@<version>` — advice an agent adopts verbatim, which bloats the
-    stored on-chain document and can push a drop to a chain whose dependency registry it needs.
-    Real `p5`/`THREE`/`Tone` usage is still detected (pinned by tests).
-  - **Reserved coordinates are never listed as PostParams.** `tokenId`, `chainId`, and
-    `contractAddress` (like `seed` before them) are injected by the runtime and cannot be declared,
-    but they landed in the "declare EACH at deploy or it's silently dropped" warning with
-    `--schema tokenId:<Type>:<Auth>` advice that must not be followed.
-  - **A dotted param key read through an alias is detected.** `const d = abx.tokenData;` then
-    `d['collapse.index']` was invisible, producing a false "dropped at render" warning on a correct
-    program — and ABX's own output-naming convention is dotted (`effect.render.image`), so the
-    documented idiom tripped the analyzer.
-
-  Reported in the 2026-08-03 tester batch (feedback 3b66e443, f69e15d6, 8184f7dd, 6d32f874).
-
-- 1158420: `abx deploy --onchain-uri` no longer claims "fully on-chain" over a token whose image isn't.
-
-  `--onchain-uri` puts the metadata JSON on-chain. It inlines the _image_ only when the image is an
-  SVG; a raster falls through to keccak256 custody, and the on-chain renderer then serves a
-  **placeholder** image. The success banner printed "Done — fully on-chain … no server or hosting
-  needed" for that configuration, so a creator would believe they had permanence they did not have —
-  and only discover it later via `abx tokenuri` (`source: "fallback"`, `onChain: false`).
-
-  Two changes, both computed from the actual file rather than the flag:
-
-  - The dry run (and the real run) now warn **before the spend** that the image is a keccak256 anchor
-    and `tokenURI` will serve a placeholder, pointing at `--onchain-image --compress fastlz` or a
-    served base URL. The code lane's dry run already warned about this case; the 1/1 lane shipped it
-    silently.
-  - The success banner says "Done — metadata on-chain" and names the image's real status. An SVG (or
-    `--onchain-image`) still gets the unqualified "fully on-chain" banner, because that one is true.
-
-  Reported in the 2026-08-03 tester batch (feedback a8921f18).
-
-- 1158420: Fix `deploy-code` reverting `DeploymentFailed()` — the setup transaction was sent with a gas limit estimated against a contract that did not exist yet.
-
-  Every `deploy-code` attempt in a reporter's Base Sepolia session reverted with Solady's
-  `DeploymentFailed()` (`0x30116425`), in both the on-chain and hosted-resolver lanes, with a minimal
-  case of storing a single 3,563-byte script chunk. It was not a defect in the chunk path: the two
-  transactions simply **ran out of gas**.
-
-  ```
-  0xcad74d07…  gasLimit 201,616   gasUsed 198,870  (98.6%)
-  0xf4350724…  gasLimit 169,301   gasUsed 166,810  (98.5%)
-  ```
-
-  A code project deploys in two transactions: create the clone, then one setup `multicall`. The second
-  targets the contract the first just created — and `eth_estimateGas` for that call, taken while the
-  answering node has not yet seen the deploy block, returns the **calldata cost alone**. Replaying both
-  payloads against a codeless address reproduces the sent limits _to the gas_ (201,616 and 169,301);
-  against the real contract the same calls need 941,331. A setup multicall's cost is dominated by
-  CREATE code deposit (~200 gas per stored byte), so the underfunded CREATE inside `SSTORE2.write`
-  returned 0 and reverted. The 1/1 lane was unaffected because its setup fits inside a calldata-sized
-  budget.
-
-  This is the same read-after-write lag the deploy loop already pins the **nonce** against, one field
-  over. The fix has two halves, and deliberately does not include a third:
-
-  - **Every leg after the first waits for the target's code to be visible** to the client doing the
-    estimating, so a lagging node cannot produce a meaningless estimate in the first place. This is the
-    actual repair.
-  - **An impossible estimate is detected and refused, not replaced.** `PreparedTx` gained an optional
-    `gasFloor` carrying only the _provable_ part of a payload's cost — EVM code deposit at exactly 200
-    gas per stored byte. An estimate below that is not "low", it is proof the node is on stale state, so
-    the sender retries and then errors out with what it saw.
-  - **What we did NOT do: substitute a computed gas limit.** Only the deposit is derivable; the same
-    setup multicall also carries schema writes, dependency legs, URI legs and mints whose cost cannot be
-    known without simulating them. A "probably enough" constant is tuned to whoever's example was in
-    front of its author — it would have covered the reported single-chunk case and then under-funded a
-    three-schema deploy by ~200k, reproducing the identical `DeploymentFailed()` with a fresh mystery
-    attached. Refusing to send is strictly better than sending a transaction we can prove is
-    under-funded, which would burn the gas and orphan the contract.
-
-  All three signing lanes carry this, not just the hot one: the env-key lane pins the limit before
-  `sendTransaction`, the wallet lane waits for code and hands the browser an explicit `gas` (a wallet
-  estimates against its own RPC, which we don't control and which lags the same way), and the cold lane
-  prints `gasMustExceed` — labelled a floor, not a limit — plus a note telling an external signer to
-  re-estimate rather than send if their own number comes back below it. The rule lives in one place
-  (`packages/cli/src/gas.ts`) so the lanes cannot drift apart on it.
-
-  Reported in the 2026-08-03 tester batch (feedback 156ea0fb, 172111ae), root-caused from the full
-  transaction hashes supplied in the follow-up addendum.
-
-- 1158420: `abx preview` stops fabricating param values, and `--shoot` stops blaming the program for its own timeouts.
-
-  - **An unset PostParam is now absent from the preview's `tokenData`, exactly as on-chain.** Preview
-    injected a per-type default for every declared key — `Select` got its FIRST option — so an
-    optional `theme:Select[Newsprint|…]` override rendered every frame as `Newsprint` with nobody
-    having set anything: nine seed-distinct pieces collapsed into one palette, while the deployed drop
-    (where the key is genuinely absent) would take the program's other branch entirely. Production
-    (`buildTokenData`) only injects params that actually have a value; preview now matches it, so the
-    program's own `?? fallback` runs in both places. The studio's `Select` control gained an explicit
-    "— unset (program fallback) —" default position, so unset is now expressible rather than
-    indistinguishable from the first option.
-  - **`--shoot` distinguishes "the program reported no traits" from "we stopped waiting."** A wait
-    that expired was swallowed, so a loaded machine turned a correct, trait-reporting program into
-    "NO frame reported traits" — inverting the one line agents are told to trust and costing a full
-    diagnostic cycle. Timed-out frames now report `timed out — traits unknown` and a warning that
-    names it a measurement failure and suggests `--timeout-ms`; the silent-killer alarm only fires
-    when the program really did report nothing.
-  - **A missing Chromium build names the install command for the Playwright that actually loaded**
-    (`node <resolved>/cli.js install chromium`). The stock hint (`npx playwright install`) can resolve
-    a different Playwright version than the one that just launched, so you download a browser
-    revision it won't use, get the identical error, and run the same command again.
-
-  Reported in the 2026-08-03 tester batch (feedback f843c952, 994f1d67, 534835d9).
-
-- 1158420: Teach the agent skill how to handle audio and time-based work.
-
-  A "can ABX host a music tool?" session found zero mentions of audio, music, or sound anywhere in the
-  skill. The protocol supports it — `animation_url` is an HTML document, so Web Audio works, and
-  `attach` handles `.wav`/`.mp3`/`.mid` — but five judgments a sound piece needs were unauthored, so an
-  agent had to guess or decline: browser autoplay policy (a marketplace iframe cannot start audio
-  without a gesture), what the thumbnail _is_ for non-visual work, `abx.done()` semantics for a
-  duration-based piece (settle the visual, don't wait out playback), the dependency lane for audio
-  libraries (`tone` needs a registry entry ⇒ Sepolia, like `p5`), and the fact that there is no
-  `render/audio` output declaration to reach for.
-
-  Reported in the 2026-08-03 tester batch (feedback fd6109db).
-
-- 1158420: `abx skill install` can no longer overwrite a newer skill with an older one, or delete the skill it is installing.
-
-  Two ways the same command could destroy the thing it exists to install, both hit while working in the
-  abx repo itself:
-
-  - **A stale prepack bundle shadowed the canonical skill.** `<pkg>/skill` is gitignored build output
-    written at `prepack`; the canonical copy lives at `.claude/skills/abx-self-host`. Resolution
-    preferred the bundle unconditionally, so a leftover `skill/` from an old `npm pack` was installed
-    **over** the canonical skill — silently replacing v0.1.0-alpha.12 with v0.1.0-alpha.4, after which
-    the CLI's own drift check reported the stale version as if the user had put it there. When running
-    from source (the repo working tree) the canonical copy now wins; the published layout, which has no
-    repo and no canonical copy, still uses the bundle.
-  - **Installing onto the source deleted it.** `installSkillTo` removes the destination before copying,
-    so when destination _was_ the source (a cwd-relative install inside the repo) it deleted the
-    canonical skill and then had nothing to copy from. Same-path installs are now a no-op that reports
-    `already the canonical copy — left as is`.
-
-- 1158420: Fixes from a parallel cold-agent sweep: a chain typo no longer crashes every command, and `inspect` stops over-promising on hand-written PRNGs.
-
-  **An unknown `ABX_CHAIN` printed a raw Node stack trace — from every command.** Chain-derived values
-  were resolved at module scope, in `token-api` (which the CLI imports) and in the CLI itself, so the
-  throw happened during module evaluation, before `main()` existed to catch it. `ABX_CHAIN=mainnet abx
-doctor` dumped an internal source path and exited 1 — including from the one command whose job is to
-  tell you what is wrong with your environment. Those resolutions are lazy now, and the CLI validates
-  the variable up front with an answer rather than a crash: unknown values list the shipped chains, and
-  a mainnet-shaped value says plainly that ABX is testnet-only today.
-
-  **`abx inspect` reported "(no PRNG)" for a hand-written seeded generator — with the _stronger_
-  reproducibility verdict attached.** The `seeded` check only recognized p5's `randomSeed(`, so a
-  vanilla LCG or xorshift matched no branch and fell through to "traits look derived from the
-  seed/params directly". That is the common case, not an edge one — the skill's own canonical
-  dependency-free example hand-rolls an LCG, and all three sketches written by agents in the sweep hit
-  it. A hand-rolled generator now gets the `careful` verdict and is told the truth: deterministic and
-  reproducible on-chain, but only by porting that exact generator and call order into Solidity.
-
-  Also: `--yes` is now documented in `deploy-code --help` (its own placeholder-identity refusal already
-  told you to pass it), and the `--onchain-uri` raster warning now names the two routes that actually
-  deliver a no-server image instead of only one.
-
-  Found by the 2026-08-03 parallel sweep (8 cold Sonnet/Haiku agents, isolated sandboxes).
-
-- Updated dependencies [1158420]
-- Updated dependencies [1158420]
-- Updated dependencies [1158420]
-  - @artblocks/abx-sdk@0.1.0-alpha.6
-  - @artblocks/abx-token-api@0.1.0-alpha.9
-  - @artblocks/abx-indexer@0.1.0-alpha.7
-  - @artblocks/abx-storage@0.1.0-alpha.6
-
-## 0.1.0-alpha.12
-
-### Minor Changes
-
-- feba8c2: A resolver is no longer an object store: effect outputs split into **bound** and **referenced**
-  (`specs/protocol/effects.md → Bound vs referenced`), and the artifact registry enforces the split.
-
-  An output is **bound** iff a binding stitches its _content_ into the metadata JSON (today exactly
-  `render/traits` → `attributes`); everything else is **referenced** — the projection carries its URL,
-  or it only appears in the `artifacts` manifest. That one distinction decides who holds the bytes, and
-  it is now the wire rule rather than a runner constant.
-
-  - **`POST /v1/effect-artifacts` derives the mode from the binding, and refuses both mismatches.**
-    Bytes for a referenced output → `400` (the resolver redirects either way, so the bytes buy no
-    capability and cost it storage, retention and egress). A locator for a bound output → `400` (its
-    content is assembled into `tokenURI`; a pointer there used to be recorded and then silently never
-    stitch — a wrong answer served confidently). Bound content is capped at **64 KB**, and a locator
-    that only the producer could resolve (loopback/private host, presigned expiring URL) is rejected.
-    The resolver never fetches a locator while handling the write, and serves registered locators by
-    `302` — never by proxying.
-  - **Bound content moved out of byte custody** into the artifact row (`effect_artifacts.bytes`). Two
-    distinct rules, deliberately not one: a node **MUST** serve and stitch bound content only at the
-    token's current settled `inputsHash`, and it **MAY** drop superseded content whenever it likes
-    (nothing may read it, and it is re-creatable). The reference drops eagerly, on each bound
-    registration, so it holds at most `64 KB × minted × bound outputs` — but retention is a service
-    policy, not an obligation. Either way "conforming means holding a bounded amount of JSON in the
-    database you already run" is now literally true: a resolver in the publish topology needs no object
-    storage at all.
-  - **`abx-effects-publish/v1` is gone** (not deprecated): the two routes ride `abx-control-plane/v1`.
-    Once referenced output is locator-only, accepting a registration is a database insert, so the
-    capability flag described a distinction that no longer exists. A service that won't take a caller's
-    artifacts refuses on the credential (`403`) — interfaces describe wire grammar, tokens describe
-    permission. The interface ids are also explicitly **all-or-nothing**, and the conformance fixture
-    now checks that every route a declared interface names actually answers.
-  - **The runner declares bound outputs** (`EffectOutputDecl.bound`), refuses to start when it has a
-    publish token but a backend that can't name a locator, preflights the descriptor + credential
-    before spending a render, and **latches** on a permanent (4xx) publish failure instead of
-    re-rendering every sweep forever. Skips now re-register rows, so a transient publish failure heals
-    without a re-render.
-  - **The CLI refuses the impossible combination up front**: `abx render --remote`, `abx effects`
-    against a remote resolver, and `abx deploy-effects` all require a backend that can name a reachable
-    URL — `cloud` (S3/R2 + public base), `ipfs`, or `arweave`, named as **peers**. Derived output is
-    re-creatable, so the protocol has no preference among schemes: a chosen `https://` gateway or
-    bucket URL is exactly as legitimate as `ipfs://`/`ar://`, and reachability — not durability — is
-    the requirement. Rendering **co-located** with the resolver remains fully supported on any backend,
-    including `fs`.
-
-  Breaking for producers that relied on pushing media bytes to a resolver: publish a locator instead,
-  or co-locate. Breaking for clients that read `abx-effects-publish/v1` from a descriptor.
-
-### Patch Changes
-
-- Updated dependencies [feba8c2]
-  - @artblocks/abx-sdk@0.1.0-alpha.5
-  - @artblocks/abx-token-api@0.1.0-alpha.8
-  - @artblocks/abx-indexer@0.1.0-alpha.6
-  - @artblocks/abx-storage@0.1.0-alpha.5
-
-## 0.1.0-alpha.11
-
-### Minor Changes
-
-- 67b686b: `abx contracturi`, and the read plane stops answering a bare 404 to three different problems.
-
-  Both halves come from one real failure: an agent driving a hosted resolver wanted collection
-  metadata, pattern-matched off `/t/{chainId}/{address}/{id}`, dropped the token id, got a bare `404`,
-  and reported the service as broken. The documented route (`/c/{chainId}/{address}`) was right there —
-  but there was also no command to just _ask_, and the 404 gave it nothing to correct.
-
-  - **New `abx contracturi <address>`** — the collection-level counterpart of `tokenuri`. Reads
-    `contractURI()` (ERC-7572) from the contract, **follows it**, and decodes: a `data:` URI inline
-    (the on-chain lane), an `https://` URL by fetching it (the off-chain lane). A contract commits its
-    own metadata base on-chain (`contractURIBase`), so the chain — not a doc, not a service
-    descriptor — is the authoritative answer to where a project's metadata lives. Nobody needs to
-    hand-build a resolver URL. When the fetch fails, the message says so plainly: the URL came from
-    the chain, so a bad status is about the _service_ (unregistered project · wrong chain · down),
-    never a mistyped path.
-  - **Read-plane responses now carry a machine `code`**, so the three causes of "no metadata came
-    back" are distinguishable — they were one indistinguishable `{"error": "…"}` `404`:
-    - `400 invalid_request` — a real route, wrong shape. Names the correct template, and carries
-      `didYouMean` when the fix is obvious (a `/t/…` missing its token id → `/c/{chainId}/{address}`).
-    - `404 unknown_route` — this node serves nothing at that path; the body lists what it does serve.
-    - `404 not_registered` — the path and chain were fine; this node doesn't index that contract.
-    - `400 unsupported_chain` — wrong chain, plus the `chains` this node does serve. Was a bare `404`;
-      now matches what the control plane already answered for the same condition.
-  - `ServiceErrorCode` gains `unknown_route`. The spec's Errors section now covers the read plane too,
-    with a **MUST** on distinguishing the three misses — and an explicit **MUST NOT** on treating
-    route templates as per-node discoverable configuration. The route grammar is fixed by the
-    `abx-token-api/v1` interface; these responses are diagnostics, not a discovery mechanism.
-  - **The conformance fixture checks all of it** (`pnpm conformance <base-url>`), so any provider can
-    self-verify in one command. Also fixed: the documented `pnpm conformance -- <base-url>` form
-    parsed `--` as a flag and swallowed the base URL, printing usage instead of running.
-
-### Patch Changes
-
-- Updated dependencies [67b686b]
-  - @artblocks/abx-sdk@0.1.0-alpha.4
-  - @artblocks/abx-token-api@0.1.0-alpha.7
-  - @artblocks/abx-indexer@0.1.0-alpha.5
-  - @artblocks/abx-storage@0.1.0-alpha.4
-
-## 0.1.0-alpha.10
-
-### Minor Changes
-
-- a72723d: A standard indexing lifecycle, and registration that no longer blocks on a slow chain RPC
-  (specs/self-host-toolkit/remote-services.md → The indexing lifecycle).
-
-  - **Fixed: a slow register triggered a retry storm.** The SDK's per-attempt timeout (30s) plus its
-    retry ladder meant a cold reconstruct that outran one request was **re-POSTed up to four times**,
-    each starting another full replay against the RPC that was already too slow to answer — and the
-    caller then saw "nothing responded" even though the registration was durable and indexing was
-    underway. A timed-out register now asks whether it landed (a status read) instead of re-POSTing, and
-    the resolver coalesces concurrent catch-ups for one project into a single run.
-  - **`POST /v1/projects` answers in two conformant shapes, discriminated by HTTP status:** `200` with
-    the completed summary, or `202` + `{accepted, project: {status}}` when catch-up is deferred. The
-    registration is normatively **durable before catch-up** and visible on the list immediately, so a
-    flaky RPC makes for a slower backfill rather than a lost add. No `?wait=`/`Prefer:` negotiation — the
-    status code is the discriminator, and clients handle both. The reference resolver answers _by
-    deadline_ (`ABX_REGISTER_DEADLINE_MS`, default 8s): the common case (a fresh deploy) stays
-    synchronous with real counts; only the pathological case defers.
-  - **Closed lifecycle enum + error classes, on the status and list routes:**
-    `queued | backfilling | live | stale | failed`, plus credential-free
-    `error.class ∈ {rpc_unavailable, rpc_rate_limited, not_abx_contract, internal}` (fixed per-class
-    messages, never a scrubbed upstream string). Status gains top-level `headBlock` (so lag / % complete
-    is computable without knowing a service has a watcher) and `attempts`; the list carries `status` +
-    the error class, so a client renders "3 live, 1 backfilling, 1 failed (rpc_rate_limited)" in one
-    request. SDK: `IndexStatus`, `IndexErrorClass`, `isAccepted()`, `indexProgress()`,
-    `classifyIndexError()`, and `AbxServiceClient.awaitIndexed()` — one wait loop for the CLI, the
-    effects runner, and any hosted agent.
-  - **The same five words on your own node.** `abx status [address] [--remote [name|url]] [--watch]`:
-    bare is the node summary (now with each project's state), an address gives lifecycle + scan floor +
-    blocks-indexed-vs-head + cause, and `--remote` asks a service. (`status` = who is serving it and how
-    fresh; `state` = what the chain says. Both `--help` texts now say so.)
-  - **New observability the self-hosted node never had:** the chain watcher marks projects `stale` when
-    it falls far behind head or its ticks keep failing (previously visible only in the node's log),
-    re-queues a backfill interrupted by a restart (previously left registered-but-empty until a manual
-    `abx index`), and retries a `failed` catch-up on exponential backoff instead of hammering a
-    rate-limited RPC every tick. Lifecycle rows live in their own table: they survive a projection wipe
-    and are never clobbered by a re-add.
-  - **CLI:** `abx add|index --remote` prints `registered — backfilling…`, polls to `live`, then prints
-    the same summary a synchronous service would have given; `--no-wait` returns at the 202 and names
-    the command to check later. A post-op nudge (`ownerops`) never blocks on someone else's backfill.
-    A caught-up project with **0 events** now warns instead of printing ✓ (a real ABX clone always emits
-    a spine, so zero means wrong chain/floor or an RPC that didn't serve the logs).
-  - **Conformance fixture** accepts either register shape, asserts durable-before-catch-up, lifecycle
-    membership, `headBlock`, that a deferred catch-up actually reaches `live`, and that no error message
-    carries a URL.
-  - Fixed `scripts/mock-remote-service.mts`, which imported the token API by a path that resolved
-    against `scripts/` and could silently fall back to a _published_ build outside the repo — the
-    fixture was testing the last release instead of the working tree. The fixture also re-points
-    scenarios by their fixture header now, so a new one can't keep a dead contract address.
-
-  Found by a cold-agent sweep over the above (10 parallel clean rooms, haiku + sonnet) and fixed here:
-
-  - **`abx status --remote <name>` with no address** parsed the flag itself as the address and sent it
-    as a URL path segment.
-  - **A register whose catch-up already failed** was announced as "registered — failed (…is catching
-    up…)", and with `--no-wait` it exited 0 and then claimed the provider "now serves" the project. A
-    known failure is now an error in both lanes — there is nothing left to wait for.
-  - **A `failed` status said what broke but not whose problem it was.** Both the failure error and
-    `abx status` now carry a per-class action line ("the SERVICE can't reach its chain RPC — not your
-    key, address, or chain…"), plus a `follow` line naming `--watch`, so a red word isn't a dead end.
-  - **A `live` project showed a misleading completion percentage.** `toBlock` only advances when a
-    project has _events_, so a fully current project on a busy chain read as `2/202 (0%)`.
-    `indexProgress()` now returns a ratio only while `backfilling`; `live` reads "caught up", `stale`
-    reads "not tracking head right now".
-  - **`--remote-token` was misattributed on a 401** — the error blamed `ABX_REMOTE_<NAME>_TOKEN` even
-    when the caller passed an override, making the override look ignored at exactly the moment someone
-    is testing a replacement key.
-  - **`not_registered` on a read** (status/reindex) now names the register command instead of echoing a
-    404, and a 5xx carrying a failure `class` becomes a wait-vs-broken error.
-  - **`abx verify`'s summary** read `✓ 0/1 up to date` for a project with no off-chain renders at all —
-    "zero of one succeeded" to two independent reviewers. It now says "nothing to render for this
-    project", and otherwise leads with polarity ("N of M token(s) current").
-  - **`abx doctor` now reports named remotes** and flags a credential stored under a name the CLI does
-    not read (`ABX_REMOTE_<NAME>_KEY`). That fault presents as "it acts like I never gave it a key" and
-    previously only surfaced from `abx remote <name>` — which a creator reaches _after_ doctor.
-  - **Skill: the `npx --no-install abx version` probe was documented as failing cleanly.** It doesn't —
-    npm will run any `abx` binary already in the npx cache, which in a real sweep reported a months-old
-    build as the project's CLI (and if a plain `npx abx` ever ran on that machine, the bare name is a
-    squatted package). The skill now probes `./node_modules/.bin/abx` directly.
-  - Also documented: how a multi-word provider name folds into `ABX_REMOTE_<NAME>_*`, and what
-    `watching: no` means on a status readout.
-
-  A second sweep round over those fixes caught three more, including one the first round's fix created:
-
-  - **`abx verify --remote` never checked byte integrity at all** — both of its lanes only ask "is there
-    a current render / is this a placeholder", and a green ✓ from that was standing in for "the served
-    bytes match the on-chain commitment". A reviewer hit the worst version of this: `--remote` (the form
-    the skill tells you to use for a hosted project) reported ✓ on a token whose bytes genuinely did NOT
-    hash-match, while bare `abx verify` on the same project reported `✗ keccak256 MISMATCH`. It now calls
-    the service's own purpose-built `GET /api/project/:addr/verify` (which holds both the bytes and the
-    chain) and reports that verdict separately from the render summary — and when it _can't_ run that
-    check (no credential, older node) it says "byte integrity NOT checked" instead of leaving a ✓ to
-    imply it passed. The remedy names both real causes (an unbridged durable locator vs. bytes that only
-    exist on the creator's machine, which a hosted resolver can never serve).
-  - **`abx verify` exited 0 while printing a byte MISMATCH**, in both lanes — nothing could gate on it.
-    An integrity mismatch now fails the command; a missing render or placeholder is a normal state and
-    still exits 0.
-  - **`abx add --dry-run` silently ignored the flag and performed the registration**, local or remote.
-    It now refuses and names the read-only commands (`abx state`, `abx status`) instead. Silently doing
-    the thing when the caller asked to preview is the one outcome that must never happen.
-  - **`PRAGMA busy_timeout` was set third in the store schema**, after the WAL switch it needs to
-    protect — so two processes opening the same store at once (parallel CLI runs, or a co-located
-    effects runner starting alongside the resolver) could fail outright with `database is locked`
-    instead of waiting the moment out. It is now the first statement.
-
-  A third round, re-running the scenario that found the verify bug (it now catches it) turned up:
-
-  - **`abx add --remote` ended on "it now serves <url>"** — true about indexing, silent about whether
-    the bytes are right, and two reviewers stopped there and reported a blank page as fixed. It now names
-    the byte check (`abx verify <addr> --remote <name>`) in the same breath.
-  - **`canonical:` collapsed a tri-state.** `isCanonical` is `true | false | null`, and both readouts
-    printed "unverified" for the last two — so "the chain says this is NOT a clone of the configured
-    factory" (a trust finding) looked identical to "the check never ran" (no factory on this chain, normal
-    on a dev chain). Two reviewers read the collapsed word as a second failure sitting next to a real one.
-  - **`abx verify --remote` gave a bare `fetch failed`** for an endpoint that was down, where
-    `abx status --remote` names the host and asks whether it's running. Two commands, one condition, two
-    error qualities — now consistent.
-  - `abx status <addr>` printed the address twice when the project has no name.
-  - Skill: registering with a provider on **their** hostname vs. a domain you control decides whether
-    leaving later costs a transaction — now stated in the managed-provider section, before you bake it.
-
-### Patch Changes
-
-- Updated dependencies [a72723d]
-  - @artblocks/abx-sdk@0.1.0-alpha.3
-  - @artblocks/abx-indexer@0.1.0-alpha.4
-  - @artblocks/abx-token-api@0.1.0-alpha.6
-  - @artblocks/abx-storage@0.1.0-alpha.3
-
-## 0.1.0-alpha.9
-
-### Minor Changes
-
-- 3745bd3: Remote services are first-class: a provider-neutral control plane, named remotes, and a service
-  descriptor (specs/self-host-toolkit/remote-services.md).
-
-  - **Control plane moves to `/v1`** (hard cutover; `/admin/*` is gone — redeploy self-hosted nodes):
-    `POST/GET /v1/projects`, `DELETE|reindex|status /v1/projects/{chainId}/{address}`,
-    `POST /v1/effect-artifacts|effect-status`. `chainId` is explicit and validated everywhere; every
-    error carries a machine `code` (`unauthorized` 401 · `forbidden` 403 · `unsupported_chain` ·
-    `not_registered` · `disabled`) replacing the old prose-sniffed 404. One bearer guard replaces the
-    four inline copies; OPTIONS preflight now answers so browser clients can send `Authorization`.
-  - **`GET /.well-known/abx-service`** — the public service descriptor: `interfaces` (present iff
-    actually enabled), `chains`, `auth` (with optional provider-set `signupUrl`/`docsUrl` via
-    `ABX_SERVICE_*` env), and `render.attached` (managed rendering, probed from the runner's
-    `/health`) — so an agent can match a project to a provider before registering.
-  - **Named remotes in the CLI**: `--remote <name>` reads `ABX_REMOTE_<NAME>_URL`/`_TOKEN`
-    (a managed provider's per-account key — never falls back to `ABX_RESOLVER_ADMIN_TOKEN`);
-    `--remote <url> [--remote-token <t>]` for ad-hoc targets; bare `--remote` stays the self-host
-    default. New `abx remote [name|url]` inspects a service's descriptor and the projects a token
-    sees. `migrate --from/--to` accept names; only the destination needs a credential.
-  - **The SDK gains its first HTTP surface**: `AbxServiceClient` (endpoint + injected bearer, retry
-    on 5xx/network, immediate typed `AbxServiceError` on 4xx) — shared by the CLI and the effects
-    runner's publish lane. `envSuffix()` is the shared env-name normalization.
-  - **Conformance fixture**: `pnpm conformance -- <base-url> [--token …]` self-verifies any
-    implementation; the e2e suite runs it against the reference container.
-
-### Patch Changes
-
-- 3745bd3: Membrane fixes found by a 20-run cold-agent regression sweep (sonnet + haiku, black-box clean rooms).
-
-  - **A 500 no longer leaks the node's own credentials.** An upstream RPC failure surfaced viem's
-    message, which embeds the endpoint URL — and a keyed RPC URL _is_ a credential, so on a
-    multi-tenant provider any tenant who could provoke a 500 got the operator's RPC key. The cause now
-    goes to the node's log; the wire gets a generic message, an `internal_error` code, and a
-    credential-free hint about the failure class. Normative in the remote-services spec.
-  - **The service client no longer discards a 5xx body.** The service's own words survive the retry
-    ladder, and an exhausted ladder says "failed — last response …" rather than mislabelling a
-    server that answered as "unreachable". The descriptor probe drops to 2 attempts, so a typo'd
-    provider URL fails in ~1s instead of grinding 5s, with distinct "nothing responded" vs
-    "answered, but serves no descriptor" messages.
-  - **Conflicting duplicate `.env` keys are reported.** First-wins is unchanged, but a stale second
-    `ABX_RPC_URLS_<CHAIN>` line silently pointed the CLI at another network while every check read
-    green — the symptom surfaced far away as "no contract at that address". Only genuinely
-    _conflicting_ duplicates warn (identical repeats stay quiet).
-  - **"No contract at …" errors now name the endpoint they asked** (redacted), because a chain key
-    can't distinguish two RPCs that both claim it.
-  - **A misnamed remote credential is called out.** `ABX_REMOTE_<NAME>_KEY` (or `_API_KEY`, `_SECRET`)
-    is not read, so it previously reported as "no token" while the value sat in `.env`; both
-    `abx remote` and the register path now name the near-miss and the correct `_TOKEN` name.
-  - **`--dry-run` explains a missing trust anchor instead of crashing.** On a chain where the
-    configured factory has no code, `deploy`/`deploy-series` previews died inside
-    `predictDeterministicAddress` with a raw `returned no data ("0x")`; they now report it the way
-    `abx predict` and a real deploy already did, and name the two ways forward. The keyless
-    `--for` requirement also fails fast instead of after several steps of output.
-  - **The placeholder-identity guard is one shared predicate** across all three deploy commands
-    (it was copy-pasted, and one copy's comment claimed coverage it didn't have), pinned by a new
-    regression test: a real send refuses tool defaults, a preview only warns.
-  - **The served dashboard's empty state no longer prints `pnpm abx demo`** — a contributor-only
-    invocation on a page a published user sees.
-
-- Updated dependencies [3745bd3]
-- Updated dependencies [3745bd3]
-  - @artblocks/abx-sdk@0.1.0-alpha.2
-  - @artblocks/abx-token-api@0.1.0-alpha.5
-  - @artblocks/abx-indexer@0.1.0-alpha.3
-  - @artblocks/abx-storage@0.1.0-alpha.2
-
-## 0.1.0-alpha.8
-
-### Patch Changes
-
-- 4074766: Fix the dashboard's block-explorer links, which were hardcoded to `https://sepolia.etherscan.io`. Every
-  link on the page — contract, owner, implementation, each event's tx — pointed at Ethereum Sepolia no
-  matter which chain was being served, so a dashboard for a normal `abx demo` (Base Sepolia by default)
-  sent you to an explorer where the contract does not exist. The SDK now derives the explorer from viem's
-  own chain metadata (`explorerUrl`/`chainById`), so adding a chain brings its explorer along and no
-  hand-maintained table can drift. The CLI's separate copy of that table is collapsed into the same
-  helper; `signer.ts` was already doing it correctly.
-
-  Drop the demo's opening "trust anchor" step. It asserted that only the canonical factory can make a
-  token that _is_ an ABX token, which is false — anything following the protocol's event spine is an ABX
-  token, and the factory is one route to that, not the definition. The same overclaim in the index step
-  ("verified real") now reports the fact instead: made by the canonical factory, or not. The demo opens
-  on the renderer step, and resolving the factory no longer prints a line of its own there.
-
-- Updated dependencies [4074766]
-  - @artblocks/abx-sdk@0.1.0-alpha.1
-  - @artblocks/abx-token-api@0.1.0-alpha.4
-  - @artblocks/abx-indexer@0.1.0-alpha.2
-  - @artblocks/abx-storage@0.1.0-alpha.1
-
-## 0.1.0-alpha.7
-
-### Patch Changes
-
-- c16c0f0: Shorten the update check's cache from 24h to **6h**. A day-long cache let someone work a whole
-  session — deploys included — against a CLI that had been superseded that morning, without ever being
-  told. In a fast-moving alpha line that's the common case, not the edge one.
-
-  The agent skill now **acts** on version drift instead of reporting it. It already reconciled
-  skill⇄CLI drift, but nothing told it what to do when the CLI's own `update available` notice fired —
-  so on an agent-driven surface that notice landed as a human-shaped message and got relayed or
-  ignored. The skill now upgrades the CLI itself (matching how it was installed), resyncs the skill, and
-  reloads before deploying, with the reason stated: a stale CLI can hold canonical addresses that have
-  since moved, and a mid-run `… is not a function` is usually exactly this.
-
-  Docs: the Upgrading page now leads with the two install shapes in the same order as the quickstart
-  (global, then per-project) instead of opening on a one-off `npx` invocation, drops the update-check
-  silencing details (they live in the CLI reference, alongside `version`), and answers the question the
-  old "Upgrade the SDK" section provoked — upgrading the CLI upgrades the SDK it pins, so a CLI user has
-  nothing separate to maintain; you install the SDK only when writing TypeScript against ABX directly.
-
-## 0.1.0-alpha.6
-
-### Patch Changes
-
-- c21ea30: `abx demo` now runs **fully on-chain** by default, and speaks plainly.
-
-  Its generative SVG is inlined into the contract, so no `http://localhost:8787` is baked into the
-  on-chain `tokenURI` base. The old default shipped a first-ever token that resolved for nobody but its
-  author — broken on every marketplace, dead the moment `abx serve` stopped — and taught that as the
-  normal shape of an NFT. It also undercut the demo's own claim: with the art on-chain, "rebuilt from the
-  chain alone" now covers the image, not just the metadata. The final dashboard still starts, but is
-  framed as a local viewer rather than infrastructure. Hand the demo an `--image`, a `--backend`, or a
-  `--public-base-url` and it switches back to off-chain custody, where that split is real and worth
-  teaching.
-
-  Fixed alongside it: on every on-chain lane (1/1 and Series, wallet and `--onchain-image`) the deploy
-  step announced `URIs point at http://localhost:8787` even though nothing was baked — in the demo, two
-  lines after promising no localhost anywhere.
-
-  The walkthrough's teaching text is rewritten in plain language, with the protocol vocabulary kept as a
-  dim aside instead of the headline: steps are now "Who vouches for this token?", "Mint it", "What the
-  chain knows now", and "The moment of truth · delete it all". The read-back step reads from the real
-  source per lane — `tokenURI(0)` on the contract when fully on-chain (what a marketplace actually does,
-  and it proves no server is involved), the resolver when custody is off-chain.
-
-  The browser-wallet signing prompt now says to connect a wallet holding testnet ETH and links a faucet.
-  That was the one funding surface with no guidance: on `--sign` without `--for` the address isn't known
-  until the wallet connects, so the up-front balance check never ran and an empty wallet's first signal
-  was a failed transaction.
-
-- c21ea30: Make the update check independent of which npm dist-tag prereleases are published under. It now
-  resolves the `latest` tag and, when the running version is a prerelease, that version's own channel
-  tag (`alpha`, `beta`, …), reporting whichever is newer. Previously it only asked for `latest`, which
-  works today only because `ci:publish` passes no `--tag`; the day a stable release ships and
-  prereleases move to `--tag alpha`, the nudge would have gone silent for prerelease users with
-  nothing erroring. The on-disk cache is now keyed by release channel too, so switching between the
-  alpha and stable lines re-checks instead of serving a day-stale answer.
-- Updated dependencies [c21ea30]
-  - @artblocks/abx-indexer@0.1.0-alpha.1
-  - @artblocks/abx-token-api@0.1.0-alpha.3
-
-## 0.1.0-alpha.5
+## 0.1.0-alpha.40
 
 ### Patch Changes
 
-- afb36a3: Fix three bugs that made the documented first run (`abx demo`) look broken.
+- 64248d9: Establish the public source baseline and refresh dependency constraints.
+- Updated dependencies [64248d9]
+  - @artblocks/abx-indexer@0.1.0-alpha.31
+  - @artblocks/abx-sdk@0.1.0-alpha.30
+  - @artblocks/abx-storage@0.1.0-alpha.30
+  - @artblocks/abx-token-api@0.1.0-alpha.33
 
-  **A 0-event index was reported as success, and served.** `eth_getLogs` is
-  read-after-write inconsistent on load-balanced RPCs: `waitForTransactionReceipt`
-  resolves against a node that has the block, then the log query lands on one that
-  doesn't yet and returns nothing for a block we _know_ contains our deploy. The CLI
-  took that single read at face value, printed `✓ reconstructed 0 events`, stored the
-  empty projection and served an empty dashboard — no events, no token, nothing to
-  look at. This reproduced 100% of the time against `https://sepolia.base.org`, which
-  is the **default endpoint when there is no `.env`** — so the documented first run
-  was the path that broke. Every post-deploy index (`deploy`, `demo`, `deploy-series`,
-  `deploy-code`, `add`) now re-scans with backoff instead of trusting one read, since
-  having just minted means the spine cannot legitimately be empty. If it still comes
-  back empty, that is now reported as a failure naming `abx index <addr> --full` as
-  the recovery, rather than dressed up as a ✓.
-
-  **The demo told you to press a button that does not exist.** It ended with _"Open
-  the dashboard, then hit 'Re-index from chain'"_. The dashboard is read-only —
-  re-index and verify are admin actions that 404 unless the node has an
-  `ABX_RESOLVER_ADMIN_TOKEN` — so that control isn't there to find. It now points at
-  the spine table (which _is_ the reconstruction) and at `abx index <addr> --full` to
-  replay it. The dashboard's own note also stopped printing a **shortened** address
-  inside a copy-pasteable command, and no longer suggests `--remote` for a local node.
-
-  **Re-running the demo crashed after spending a transaction.** With port 8787 already
-  busy — an `abx demo` or `abx serve` in another terminal, i.e. exactly what happens
-  when you run the demo twice — the deploy went through, was paid for, and _then_ the
-  serve step died with an unhandled Node `EADDRINUSE` stack trace. The port is now
-  preflighted before anything irreversible, so it refuses with "Nothing was deployed"
-  and suggests `--port <n+1>`.
-
-  **`abx demo` is now a walkthrough rather than a smoke test.** The docs point a
-  first-time reader here, but it asserted its interesting claims without ever showing
-  them — "reconstructed 9 events — no provider involved" with the events invisible.
-  It now teaches, continuously and without pauses (so agents and CI behave
-  identically): it explains why the trust anchor is the factory and not a spoofable
-  event, names what goes on chain versus what stays a keccak256 commitment, prints
-  the reconstructed event spine with what each event told us (tagged ABX vs plain
-  ERC-721/7572), then **deletes its own local projection and replays it from the
-  deploy block**, comparing a sha256 fingerprint of every chain-derived field to prove
-  it lands on identical state. Finally it reads the token back the way a marketplace
-  would. `abx deploy` is unchanged — it stays terse.
-
-  Adds `Store.dropProjection(address)` / `SelfHostIndexer.dropProjection()`: discard a
-  project's reconstructed projection while keeping its registration, so the next index
-  rebuilds from the deploy block. That's the primitive the rebuild proof needs, and it
-  makes "the projection is a disposable cache" a checkable claim rather than a comment.
-
-- Updated dependencies [afb36a3]
-  - @artblocks/abx-token-api@0.1.0-alpha.2
-
-## 0.1.0-alpha.4
-
-### Minor Changes
-
-- 48d96c5: Add **`abx preview`** — the studio lane for code projects: run the program on
-  localhost, live, while it's still being made. No chain, no key, no deploy.
-
-  `abx preview --script art.js --schema "palette:HexColor:TokenOwner"` serves a
-  studio on `localhost:8788` — shuffle seeds, drive every declared PostParam from a
-  real typed input (a color picker for `HexColor`, a dropdown for `Select`), read the
-  traits the program actually reported, and `/grid` to see N seeds at once. `/view`
-  is the bare document. The program is re-read from disk on every render, so the loop
-  is edit-and-refresh with no watcher and no restart.
-
-  It serves the **same template-mode document the generator serves** — the real
-  `abx.js`, the real canonical `tokenData` shape, the real dependency script tags —
-  with a synthetic bytes32 seed in place of a minted one, so what you approve is what
-  deploys. There is no second copy of the runtime to drift from. (`@artblocks/abx-token-api`
-  now exports `ABX_JS` and the inline-safety escapes so the CLI can build that exact
-  document rather than reimplement it.)
-
-  `--shoot <dir>` drives the same server headlessly to PNGs plus a `traits.json` and
-  exits — that's how an agent, which can't open a browser, sees what the creator sees.
-  It also flags the two silent killers: no frame reporting traits (⇒ no marketplace
-  `attributes` on any lane) and identical traits across every seed (⇒ the program
-  isn't reading `abx.tokenData.seed`, so the drop mints N identical tokens).
-
-  Why a live server rather than a screenshot sweep: a still flattens every time-based
-  piece, and `abx.done()` exists precisely because stills need a settle point — so a
-  proof sheet of an animated piece is a set of arbitrary frozen frames presented as
-  the work. Frames render into a fixed 1000×1000 viewport and are scaled to fit their
-  slot, so a program that hardcodes its canvas size is never clipped to its own corner.
-
-  Skill: add **Phase 0**, an explicit authoring phase that puts every deploy decision
-  (hosting, thumbnail, traits, storage, wallet, supply, royalties, name/symbol) off
-  the table until the creator says ship, and points at `abx preview` for the loop. The
-  skill previously went straight from "the creator brought an idea" to "pick a deploy
-  lane", so an agent helping someone _design_ a piece front-loaded infrastructure
-  questions while there was still nothing to look at.
-
-  Skill: also teach CLI resolution — probe project-local (`npx --no-install abx`)
-  before global, install `@artblocks/abx-cli` (not `@artblocks/abx-sdk`, which ships
-  no binary), and default to a per-project install. The skill previously assumed `abx`
-  was already on PATH and gave no bootstrap path at all, so agents improvised — one
-  installed the SDK, then went global unprompted.
-
-### Patch Changes
-
-- 48d96c5: `abx demo` now honors the signing lane instead of silently discarding it. It
-  hard-forced the hot (env-key) lane, so `abx demo --sign` failed confusingly when
-  no key was configured — and, worse, signed from the env key when one _was_
-  present, even though the operator had explicitly asked for their browser wallet.
-  `--sign` (and `--for` to pin the connecting wallet) now work on `demo` exactly as
-  they do on `deploy`.
-
-  `abx demo --unsigned` and `abx demo --dry-run` are now refused with an
-  explanation rather than ignored: both skip the broadcast, and `demo` indexes and
-  serves the contract it just deployed, so there would be nothing to index. Use
-  `abx deploy --unsigned` / `abx deploy --dry-run` for those lanes.
-
-  Also documents the `demo` signing flags in `abx help demo`.
-
-- Updated dependencies [48d96c5]
-  - @artblocks/abx-token-api@0.1.0-alpha.1
-
-## 0.1.0-alpha.3
-
-### Patch Changes
-
-- 6fbb62e: Restructure `abx doctor` for clarity. Two tiers now: PASS/FAIL checks (✓/✗) for
-  things that are working or broken — agent skill (shown first and prominently; a
-  missing/stale skill is a ✗ since agent-driven use is the primary UX), RPC,
-  factory, storage — and an "Optional — depends how you deploy" block (·) for
-  path-dependent setup (signing lane, resolver URL, Arweave key). `⚠` is no longer
-  used for values that are unset-but-fine (it read as noise); it's reserved for a
-  genuine gotcha such as a range-capped-only RPC. The RPC report collapses to one
-  line.
-- 6fbb62e: Fix the update-check hint to invoke the CLI by its scoped package name
-  (`npx @artblocks/abx-cli@latest <command>`). The bare `npx abx` resolves an
-  unrelated squatted `abx` package on npm, not this CLI, so the old hint pointed
-  users at a command that fails. (Installed users — global or per-project — run
-  `abx` / `npx abx` as before; only the zero-install invocation needs the scoped
-  name.)
-
-## 0.1.0-alpha.2
-
-### Minor Changes
-
-- 02fc0e0: Make `abx skill install` agent-aware and strictly version-lock the skill to the CLI.
-
-  `skill install` now installs to the directories every supported agent actually reads: by default
-  both `.claude/skills` (Claude Code) and the neutral `.agents/skills` (Cursor, Codex CLI, Gemini CLI,
-  GitHub Copilot), so one command covers the whole ecosystem. `--agent claude|cursor|codex|gemini|copilot`
-  narrows it to one; `--target <dir>` now writes the skill folder straight under `<dir>`.
-
-  The skill's version now lives in its `SKILL.md` frontmatter (`metadata.version`), stamped at release
-  to equal the CLI version (replacing the old `.abx-skill-version` sidecar). Because the version travels
-  inside the skill file, the drift check finds a stale copy no matter how it was installed — including
-  `npx skills add` — and `abx doctor` reports the skill/CLI version match explicitly. A publish-time gate
-  (and `pnpm ci:version` stamping) keeps the two from ever shipping out of lockstep.
-
-## 0.1.0-alpha.1
-
-### Patch Changes
+## Unreleased
 
-- b5d201f: Add `abx version` and a notify-only update check. On startup `abx` now checks npm at most once a
-  day and, when a newer release is published, prints an upgrade hint to stderr (never stdout, so it
-  never corrupts machine-readable output an agent is parsing). It also nudges to reinstall the agent
-  skill when the installed copy has drifted behind the CLI. Opt out with `ABX_NO_UPDATE_CHECK=1` or
-  `--no-update-check`; it is a no-op in CI and when offline.
+Public release history begins here.