@artblocks/abx-sdk 0.1.0-alpha.2 → 0.1.0-alpha.21

package/CHANGELOG.md

@@ -0,0 +1,2203 @@
+# @artblocks/abx-sdk
+
+## 0.1.0-alpha.21
+
+### Minor Changes
+
+- c9f7aeb: Fold the burn, and make "canonically ABX v2" sayable — from abx-services' 2026-08-20 reply
+  (`reviews/2026-08/services-reply-docs-23.md`). All off-chain: no contract changed, no address moved.
+
+  **SDK — `foldSpine` now folds an ERC-721 burn, and `TokenState.minted` is replaced by `lifecycle`
+  (BREAKING).** A burn wrote the zero address into `TokenState.owner` — where nothing downstream could
+  tell it from a holder — and `minted` latched `true` at mint and was never recomputed, so a burned
+  token reconstructed as live. `lifecycle: 'unminted' | 'live' | 'burned' | 'no-live-copies'` replaces it,
+  and `owner` is `null` for a burned id rather than a sentinel. An enum rather than the `minted` +
+  `burned` pair the report asked for: a boolean whose `false` has two meanings leaves the burn case one
+  forgotten field away from rendering as "not yet minted", which is exactly what our own CLI did.
+
+  **`'burned'` is terminal and ERC-721-only; an edition at zero live copies is `'no-live-copies'`.** The
+  first cut of this enum shared `'burned'` across both standards, on the grounds that "one vocabulary on
+  both lanes" was the honest shape. It wasn't: the correct _response_ to destruction differs by standard
+  (a 721 id is gone forever and must `410`; an edition id can mint again and must not), so a shared word
+  put every consumer one forgotten `contractType` branch away from serving `410 Gone` for a token the
+  contract still resolves — and our own migration note told the first consumer to map the shared word
+  straight onto their `410` sites. abx-services caught it in review before it published. Splitting the
+  word moves the rule out of prose and into the type: **`lifecycle === 'burned'` is safe to treat as
+  permanent on either standard, with no carve-out**, which let the reference resolver's `isEditionState`
+  guard go away entirely. Pinned from both ends — no edition history can fold to `'burned'`, and the
+  route asserts its own standard-blindness.
+
+  **The two lanes now agree id-for-id.** The same review found `TokenRow.lifecycle` (head reads) reporting
+  `'unknown'` for a fully-burned edition id while the fold reported `'burned'` for that same id — under a
+  docstring claiming the two lanes used the same words. That is the sibling-drift class this repo treats
+  as a bug (see `TokenState.maxSupply`'s note, the last time one field name carried two meanings). Both
+  lanes now answer `'no-live-copies'` there: the fold _could_ distinguish never-minted from fully-burned
+  and deliberately does not, because the distinction has no consumer. `'unknown'` survives for the one
+  case where a head read genuinely cannot say — a 1/1 has no mint frontier, so a reverting `ownerOf`
+  there is evidence of nothing.
+
+  What the latched boolean was costing, all in our own tree: the effects harness re-rendered destroyed
+  tokens on every sweep, forever; `onchain-uri`'s probe reads the LOWEST live id, so burning token 0 made
+  a healthy collection's on-chain-URI lane report as **broken**; the resolver served metadata — and the
+  pre-mint _warming placeholder_, i.e. "still loading" forever — for ids the contract disowns; `mintedCount`
+  never went down; and `abx state` printed "not yet minted" for a token that had been destroyed.
+
+  **SDK — `BurnConfigured` and `MaxRoyaltyBpsUpdated` fold into `ProjectState.burnable` /
+  `.maxRoyaltyBps`.** Both events shipped in the ABI and in `SPINE_EVENT_DOC` and reached no field of
+  state; the upgrade memo then told consumers the doc entry _was_ the fold, which it has never been (it
+  supplies `register`/`what` on the event record, full stop). Both are tri-state: `null` means the spine
+  never stated it — an implementation with no `burn` entrypoint and an unpublished ceiling — which is not
+  `false`, and not 10%. The ceiling is deliberately not nested inside `royalty`, since clearing a royalty
+  nulls that field while the ceiling stays binding on chain.
+
+  **SDK — a fold-coverage guard, because this was the second instance in four days.** `DefaultMaxSupplySet`
+  did the same thing on 2026-08-17. `SPINE_EVENT_NO_FOLD` now lists the events that deliberately reach no
+  state _and why_ (a ping whose value is a head read, a factory's own log, a minter sibling, an allowance),
+  and `spine-fold-coverage.test.ts` asserts every decodable event is either folded or excused. A new event
+  is unfolded and unexcused until someone decides which.
+
+  **SDK — a burned 1/1 no longer vanishes from `listTokens`.** The id range fell back to `totalSupply`
+  (live: mints − burns) when a token type exposes no `nextTokenId`, so burning a 1/1's only token made the
+  listing enumerate ZERO ids — `abx tokens` printed nothing at all, indistinguishable from a collection
+  with no tokens. A 1/1's id space is `{0}` forever regardless of what is live. Found by burning a real
+  token on Sepolia rather than by any fixture, which is the only way this one surfaces.
+
+  **SDK — head reads can now say `burned`.** `nextTokenId` is a mint frontier that only rises, so an id
+  below it whose `ownerOf` reverts was minted and destroyed. `TokenRow.lifecycle` (`'live'` / `'burned'` /
+  `'unminted'` / `'unknown'`) and `TokenListing.burnedCount` (`nextTokenId − totalSupply`) drop out of that,
+  with no event log. `'unknown'` stays a real member where the chain declines to say: a 1/1 has no frontier,
+  and an edition's `supply == 0` cannot distinguish never-minted from fully-burned.
+
+  **SDK — `burned` joins `ServiceErrorCode`, paired with `410 Gone`.** A remote token API had nothing
+  honest to say about a destroyed id and was sending `410` with `code: 'not_registered'` — a statement
+  about the _contract_. The rule behind the pairing is the general one: **a resolver answers what the
+  contract's own URI getter answers.** A burned 721's `tokenURI` reverts `NonexistentToken`, so serving a
+  document would contradict the contract; an ERC-1155's `uri(id)` has no existence gate and a zero-supply
+  id can mint again, so **an edition never 410s** — it serves, with `supply: 0`.
+
+  **SDK — `readCollectionPolicy`, `canonicalFactories`, `verifyProvenance`: protocol knowledge moves out
+  of the CLI.** The CLI was declaring its own ABI fragments for `burnable`/`maxRoyaltyBps` and reading
+  them itself in two places, so no other integrator could reach either fact. `canonicalFactories(chainId)`
+  replaces two copies of the six-anchor enumeration inside `anchors.ts` — the list whose completeness _is_
+  the trust model. `verifyCanonical` gains `opts.factories`, which **replaces** the manifest set rather
+  than appending to it, so a multi-tenant operator's pinned allowlist can drive the gate without silently
+  widening it.
+
+  **SDK — anchor generations: "canonically ABX v2", not a bare `false`.** `verifyCanonical` reported
+  "deployed by an ABX factory since replaced" and "deployed outside the toolkit entirely" identically —
+  its own docstring admitted it — and the first is a perfectly good collection. `ANCHOR_GENERATIONS` keys
+  each generation of the six trust anchors by the **on-chain core version** its clones report, and
+  `verifyProvenance` returns `{canonical, generation: 'current' | 'prior' | null, coreVersion, factory,
+anchorsAnswered}`. The version is on the clone itself, so the answer is chain-verified rather than a
+  manifest claim, and it keeps working after a factory retires. Retired generations never feed
+  `verifyCanonical`: provenance is not trust — a superseded generation can predate a security remediation.
+  Pre-launch testnet generations are deliberately not backfilled.
+
+  **Redeploy process — a token-layer runtime change is a new anchor generation.** It bumps
+  `AbxVersion.CORE_VERSION` and moves the SDK's `isCurrent*` probes in lockstep. That is now a checklist
+  step (`contracts/README.md`, `CLAUDE.md`) _enforced by_ `deployments.test.ts`: recorded generations must
+  have unique, increasing core versions and the newest must match the constant in `AbxVersion.sol`, so a
+  batch cannot record a generation without bumping or bump without recording. The gap that prompted it: the
+  2026-08-20 batch added `burn()`, `burnable()`, `maxRoyaltyBps()` and `reduceMaxRoyaltyBps()` to the CORE
+  base — burn is not an extension, so no extension version moved either — and left the constant at 2, so
+  `abxVersion() == 2` cannot tell a burn-capable token from a pre-burn one.
+
+  **CLI — the royalty ceiling is shown with its rate, and headroom is named.** A ceiling above the live
+  rate is royalty the owner can add unilaterally, and a listing page never shows it. `abx state` prints the
+  pair and, when there is headroom, says the useful thing: reducing the cap **to** the current rate is what
+  turns "5% today" into "5%, provably, forever". (Named by abx-services as their `royalty-headroom` flag —
+  a marketplace can compute it, so a creator should hear it from us first.)
+
+  **Reference stack — the same fixes, so the reference is exemplary rather than the counter-example.**
+  `mintedCount` keeps its name and counts LIVE ids, with `burnedCount` added only when non-zero (so a
+  project with no burns serves byte-identical JSON, and a consumer's fixtures keep telling the truth);
+  the indexer projection carries `lifecycle`; the effects status route and the render sweep skip destroyed
+  ids; the dashboard badges a burned token instead of calling it minted; and `abx verify` / the migrate and
+  re-point probes never choose a burned token as their subject.
+
+  **CLI — `--send` is accepted on the deploy paths, and two lane flags is refused.** Every deploy's help
+  advertises the signing lanes as `--send hot/env key · --sign wallet page · --unsigned print tx`, in 25
+  places, and `--send` was the one of the three the deploy allowlist rejected: typing what the help showed
+  produced `unrecognized flag(s): --send` from the guard whose whole purpose is catching flags that would
+  be silently ignored — the guard firing on the tool's own documentation. Found by using the CLI as a cold
+  reader of its own `--help` while setting up an on-chain test. While there, lane resolution moved from
+  truthiness to **presence** (`--sign=` parses to `''`, which is falsy, so a caller who explicitly named
+  the wallet lane was routed to the unattended env key — the one direction of that bug that costs
+  something), and naming two lanes at once now refuses instead of resolving by an undocumented precedence.
+
+  **Packaging — every published tarball ships its CHANGELOG.** `files` was `['dist', 'LICENSE']` on the
+  SDK, indexer, storage, effects and token-api, so the only package whose release notes reached consumers
+  was the CLI. A downstream team upgrading the SDK had no CHANGELOG in the tarball and diffed two `dist/`
+  trees to find out what moved — then reported the release notes as missing, which cost a whole exchange
+  to adjudicate. One line each.
+
+  **Docs + spec.** The event spine gains a Burn section and the `MaxRoyaltyBpsUpdated` row, both with the
+  fold rules an indexer relies on; three stale deploy-event-order lists are corrected; the remote-services
+  error taxonomy gains the `410 burned` row and the edition carve-out; `owner-powers` explains headroom and
+  burn permanence; and `indexing-notes` states plainly that documenting an event is not folding it.
+
+## 0.1.0-alpha.20
+
+### Patch Changes
+
+- 84ca9dd: Off-chain fixes from the 2026-08-19 production-readiness audit
+  (`reviews/2026-08/production-readiness-audit.md`). All are off-chain — no contract changed and no
+  address moved; the three NatSpec-precision items the audit also raised ride the next redeploy batch
+  instead (`docs/10-backlog.md` → _Contracts — the next redeploy batch_, B47).
+
+  **SDK — `HexColor` decode now masks to 24 bits, matching the chain (L-1).** `decodeScalarParam` for a
+  `HexColor` value greater than `0xFFFFFF` returned `#1ffffff` (7+ hex digits); the on-chain
+  `TokenDataLib.decodeScalar` masks with `& 0xffffff` and returns `#ffffff`. The governed write validates
+  `v <= 0xFFFFFF`, but the raw owner setter does not, so an out-of-domain value can be stored and later
+  governed by a `HexColor` schema — and the two serving planes would then decode it differently, splitting
+  `inputsHash`. The SDK now masks identically. Pinned on both sides so it cannot drift again:
+  `decodeScalarParam('HexColor', 0x1ffffffn) === '#ffffff'` (SDK) and the twin `test_DecodeScalars`
+  assertion in `contracts/test/FieldRenderer.t.sol`.
+
+  **SDK — gateway-prefix projection no longer trims (L-7).** `projectGatewayPrefix` dropped the `.trim()`
+  on the on-chain `abx_gateway_*` value: the deployed `_gatewayPrefix` returns the stored bytes verbatim,
+  so trimming here made the two planes disagree on a whitespace-padded prefix. The field store rejects an
+  empty value, so a set field is always non-empty. Clean prefixes (every real one) are unaffected.
+
+  **SDK — `permissionlessSalt` docstring hardened (L-3).** Now states explicitly: never use it for a
+  pre-published or pre-funded address — a third party can occupy the predicted address first with their own
+  `InitParams`. For any reserved address, use `saltFor` (its deployer-bound prefix is front-run-proof). No
+  behavior change; the shipped CLI/skill already deploy through `saltFor`.
+
+  **CLI — the edition schema advisory calls out a holder-writable `seed` by name (L-2).**
+  `editionSchemaAdvisory` already warned that a `TokenOwner` param on an edition is shared per-id
+  (last-writer-wins); it now adds a sharper note when that param is `seed`, because the normally-immutable
+  generative seed becomes re-rollable by _any_ holder of the id — changing the artwork for every
+  co-holder. The on-chain behavior is deliberately unchanged (the reassignable-seed feature is
+  buyer-verifiable via `paramSchema("seed")`); the guardrail is this warning, not a contract restriction.
+  A controller contract on the `Address` leg remains the way to govern it.
+
+- 84ca9dd: Finish the burn + royalty-cap surfacing, from the 2026-08-20 w6 agent sandbox sweep. All off-chain —
+  no contract changed, no address moved; the on-chain features were verified working end to end (a cold
+  agent deployed `--burnable --royalty-cap 42`, minted, burned, and proved the cap enforced on Sepolia).
+  The sweep's convergent finding was that the two new **permanent** deploy-time decisions were invisible
+  after you set them; this makes them visible everywhere they're decided or read, and adds the owner's
+  missing reduce lever.
+
+  - **New: `abx set-royalty-cap <address> --cap <0-10000>`** — the owner's reduce-only royalty-ceiling
+    lever (`RoyaltyExtension.reduceMaxRoyaltyBps`), the "after" the deploy-time "reduce-only after"
+    promise never had. Both ways the chain refuses are checked locally before signing: a value that
+    wouldn't decrease (`RoyaltyCapNotReduced`) or that would drop below the live royalty rate
+    (`RoyaltyCapBelowRoyalty`). SDK: `prepareReduceMaxRoyaltyBps`.
+  - **The deploy readout now shows `royalty cap` and `burnable` on every lane** (1/1, series, code, and
+    all three edition twins), whenever set. Critically it flags an **auto-raised** cap
+    (`royalty cap 25% (auto-raised to fit the royalty)`): omitting `--royalty-cap` while setting a
+    royalty above 10% silently raises the permanent ceiling to match, which was previously invisible.
+  - **`abx state` now surfaces `royaltyCap` and `burnable`** (human + `--json`), the post-deploy
+    verification surface, for both the 721 and edition readouts.
+  - **The skill documents the royalty cap** — the identity decision (`decisions.md`), the confirm-
+    identity step (`SKILL.md`), and a new `set-royalty-cap` owner-op row (`operating.md`); previously the
+    reduce-only ceiling feature had zero skill coverage.
+  - **Help/doc corrections:** `set-royalty --help` range `0-1000`→`0-10000` (stale from the hard-cap
+    era); `deploy-series --help` now lists `--royalty-cap`/`--burnable`; `deploy --help` states the cap
+    auto-raises; `abx inspect`'s trait-feasibility deep-dive points at public docs, not a repo path.
+
+## 0.1.0-alpha.19
+
+### Patch Changes
+
+- b1c333d: **Asking for a 15% royalty built a transaction that reverted on chain.** `RoyaltyExtension` caps every
+  ABX token at **1000 bps (10%)** and reverts `RoyaltyTooHigh()` above it, and no token type overrides that.
+  But client-side validation allowed the full ERC-2981 `0–10000` range — and the CLI's own error text
+  offered `10000 = 100%` as a worked example. So a creator asking for an ordinary 15% got a fully built,
+  fully signed transaction that failed on chain; on the wallet lane they approved it in their own wallet
+  and paid the gas to find out. Both usage strings said `<0-10000>`, and so did two public docs.
+
+  Now `MAX_ROYALTY_BPS` (SDK) mirrors the contract ceiling and both `prepareSetRoyalty` and the CLI's
+  `parseRoyaltyBps` validate against it, so the refusal is instant, local and free, and it names the cap
+  and the revert. Regression tests cover it from both sides — including `1500`, the value that used to
+  sail through. Two existing tests had to be corrected: they asserted the 0–10000 bound, which is how this
+  survived.
+
+  Three more surfaces that contradicted themselves or the chain:
+
+  - **`abx ping-uri --help` claimed "Permissionless by design … ANY signer may call it (no owner check)"
+    four lines below its own `OWNER-ONLY` header** — and `Uri1155.pingURI` is `onlyOwner`. A non-owner
+    following the paragraph built a reverting tx.
+  - **`site/content/docs/reference/contracts.mdx`** described the pre-audit library architecture: it omitted
+    `AbxMetadataLib` (the fourth delegatecalled library, and the one linked by **all six** token types, not
+    three) and still said `SeriesCode` "rides the ceiling", where `deployments.mdx` — written after the same
+    redeploy — says both code types now sit under EIP-170 with room to spare.
+  - **`deployments.mdx`'s own `specVersion()` example printed `# → 10`** under a table declaring the renderer
+    spec v11. And **`operate.mdx`'s self-correction had rotted**: it warned that `abx refresh`'s advisory was
+    stale about editions and ERC-4906, but that advisory was fixed — the doc was now the stale one.
+
+  Found by two read-only audits (29 doc files, 19 spec files) that verified every claim against contracts,
+  compiled ABIs, SDK and live `--help` output before reporting. Both independently re-confirmed the
+  no-burn property, the v11 gateway design, all ~26 canonical addresses, and the on-chain storage
+  thresholds.
+
+- b1c333d: An agent using this skill built its own smart-contract system, and neither it nor the creator noticed
+  that the collection had stopped being a canonical ABX clone. Canonicity is decided by which contract
+  deployed a token and can never be added afterwards, so the fix is a gate before the first send plus a
+  readout that makes the loss discoverable.
+
+  **`abx state` now reports canonicity first.** It read owner, supply, royalty and renderer off any
+  ERC-721-shaped address and said nothing about whether it was a factory clone — so a hand-rolled contract
+  was described exactly as confidently as a canonical one, and the tool whose whole job is "what IS this
+  contract?" left nothing behind for the creator to find. `verifyCanonical` (SDK) probes all six trust
+  anchors' `isAbxClone` in one multicall and returns a true tri-state; a `false` prints what was lost, that
+  marketplaces and the App Store recognize collections by that signal, and that the only remedy is a fresh
+  deploy through the factory plus moving holders. `null` (no anchors on this chain, or an RPC failure) is
+  never shown as a "no".
+
+  **The skill gained the boundary rule it never had.** Its trust material lived on the _last line_ of the
+  file, written for someone verifying a clone from outside, and the "don't hand-roll" rules that existed
+  were narrow — preview pages, ABI writes, token queries, nothing about contracts. There is now a
+  Read-first gate: if the ask seems to need something the deploy commands don't do, stop and put it to the
+  creator in words, because building your own contracts is a legitimate choice a creator can make and
+  making it _for_ them silently is not. Alongside it, the list of what the toolkit does **not** do — no
+  burn (verified: zero `burn` entrypoints in `contracts/src`, previously a parenthetical clause inside a
+  sentence about hooks), no secondary listings, no mainnet, fixed-price sales only, no post-deploy script
+  replace — and the two extension points that keep a collection canonical (`set-minter`, param hooks), with
+  the caveat that a `--transfer` hook is a **veto, not a trigger**: it can refuse a transfer but never cause
+  a mint or a burn, so it cannot implement "combine two into one".
+
+  Verified by two trap rooms — a creator asking for a burn-to-combine mechanic with "you've got my
+  go-ahead, I don't need the technical parts". Both Sonnet and Haiku refused to build a contract, cited the
+  canonicity loss, and returned options. The Sonnet room found the route that _preserves_ canonicity and
+  offered it first.
+
+  **SKILL.md was restructured** against its own "lean decision-tree router" norm, which it had drifted
+  ~40% past: **68,449 → 55,392 characters (−20%)**, longest bullet 2,876 → 1,465, bullets over 600 chars
+  27 → 14, with depth moved into the reference files that already owned it (locks → `decisions.md`;
+  install/`.env` → `setup.md`, which was a 44-line stub; data plane, App Store and deploy mechanics →
+  `operating.md`). Also repaired: a **markdown table split in two** by a blockquote sitting between its
+  rows, and **four dangling anchor links** (three pre-existing) — all 96 internal links now resolve.
+  `setup.md` was retitled and reordered after a control room found the required install steps buried under
+  a title that promised RPC troubleshooting.
+
+  **Two contradictions the verification sweep caught**, both the same class as the rest of this week's
+  fixes. `deploy-code --dry-run` printed `render/storage ✓ fs + --image-base` a few lines below
+  `⚠ render storage home is fs … placeholder forever`, for the identical setup; the ✓ is legitimately
+  scoped to whether the `--image-base` target is a valid mutable bucket (two tests pin that), so the row now
+  states what it covers and points at the other line rather than appearing to overrule it. And **"not
+  backfillable" was overstated** in three places — the truth, which `code-projects.md` had right all along,
+  is that fixing a surface after deploy costs an owner-signed re-point plus a re-render on a collection that
+  showed a placeholder in between. Expensive and worth avoiding; not impossible.
+
+## 0.1.0-alpha.18
+
+### Patch Changes
+
+- 77a6248: `abx deploy --bootstrap-factory` failed on the first run against any chain that did not already have
+  a factory — and succeeded on the second.
+
+  Every ABX singleton is deployed by CREATE2 through the keyless proxy, so the transaction is a **call
+  to that proxy**, not a contract creation, and `receipt.contractAddress` is null by protocol. Two of
+  the six factory bootstraps — the two oldest, the ERC-721 image ones — still read the address off the
+  receipt, so they threw `Factory deploy produced no contract address` _after_ the factory had actually
+  landed. Re-running then found the factory on chain and skipped the bootstrap entirely, which is why
+  this read as flakiness rather than a bug. `deployRenderer`, the library legs, and every newer factory
+  already computed the address; these two now do the same (`predictFactory()` / `predictSeriesFactory()`).
+
+  The blast radius was every fresh chain: a private chain, a local anvil, a sandbox — and the mock
+  provider fixture the hosted-services eval rooms are built on, which is how this surfaced. On a real
+  testnet the factories already exist, so nothing that ships today was affected.
+
+  Pinned by a regression test that fails on the old code two ways: behaviourally (a `send` that returns
+  a receipt with no `contractAddress`, exactly like the proxy does, must still yield the deterministic
+  address) and statically (no bootstrap in `deploy.ts` may derive an address from
+  `receipt.contractAddress`, so a seventh factory cannot reintroduce it).
+
+- 77a6248: Fixes from the 2026-08-18 eight-room agent sweep of the content-addressed lanes (ipfs · arweave ·
+  preferred gateways). The v11 gateway projection worked end to end on a live testnet round trip — bare
+  CID on chain, one `set-gateway` tx, byte-identical content id before and after — but the surfaces
+  around it lied, hid, or degraded in five ways that cold agents hit immediately.
+
+  **Both `AbxGenerator` addresses in the manifest had a broken EIP-55 checksum.** The addresses were
+  right; the casing was mangled in transcription. viem validates checksums, so
+  `readContract`/`writeContract` against the recorded value threw `Address "0x2c1b7Cf6…" is invalid` —
+  `abx verify` could not run its on-chain-URI check on **either** testnet. Corrected in
+  `deployments.ts` and the docs mirror, with the code at both fixed addresses re-confirmed on chain
+  (identical bytecode, as CREATE2 requires). The per-entry equality tests stayed green through all of
+  it because they compared against the same mangled string, so the manifest now carries a **property
+  test**: every recorded address must be a valid checksum.
+
+  **A deploy narrated the upload gateway as if it were the served URL.** With
+  `--onchain-uri --backend ipfs`, the progress line printed the backend's own locator
+  (`https://gateway.pinata.cloud/ipfs/<cid>/0.png`) while the chain got a bare CID served from
+  somewhere else entirely — in one run, from `ipfs.io`, because that is the floor and no preference was
+  written. The line now shows the URL the token will actually carry, resolved through the same
+  precedence that decides what gets written (`--ipfs-gateway`/`--arweave-gateway` → `--gateway` for the
+  backend in use → env → floor), and says whether that prefix is the project's choice or the public
+  default filling a silence.
+
+  **`--ipfs-gateway` / `--arweave-gateway` were absent from every deploy command's `--help`.** They
+  appeared only in `set-gateway --help` and the skill's reference pages, so an agent reading the CLI
+  alone could not find the flags the CLI itself tells you to use. All three deploy commands now name
+  them, with the floors (`https://ipfs.io/ipfs/`, `https://arweave.net/`) and the upload-vs-serving
+  distinction stated where the decision is made.
+
+  **`abx storage upload` handed `abx attach` a locator that silently downgraded the attachment.** It
+  printed `abx attach <address> <key> https://gateway.pinata.cloud/ipfs/<cid>/file.png` — and `attach`
+  picks the on-chain representation from the scheme, so an `https://` locator stores a plain `url` with
+  the gateway host welded into the value: no `set-gateway` repoint, exactly the coupling the
+  content-addressed representations exist to remove. Following the command's own printed next step was
+  the wrong move — and the skill had promised the scheme form all along, so the doc was right and the
+  command was wrong. It now hands back `ipfs://<cid>/file.png` / `ar://<txid>/file.png` (both in the prose
+  hint and as `attachLocator` in `--json`), keeps the https URL as the browsable one, and says why they
+  differ.
+
+  **`.abx-self-host/` is now self-ignoring.** It holds this node's projection and, for the Arweave
+  backend, a signing-capable key that carries prepaid upload credits. This repo gitignores that
+  directory and the skill said so — but a _creator's_ repo does not, so a first `--backend arweave` run
+  could leave a key staged for commit with nothing having said a word. The CLI writes a `.gitignore`
+  containing `*` inside the directory before anything sensitive lands there: it ignores the whole tree
+  regardless of the enclosing repo's config, needs no edit to a file we don't own, and never overwrites
+  one that already exists.
+
+  The **local-gateway warning** also stopped over-claiming. It said a `127.0.0.1` gateway means "the
+  served image URL resolves only on THIS machine" — true when the gateway host was welded into the
+  field, false now that the field holds a bare CID, and it aimed the creator at the wrong repair. It now
+  names the damage that is still real: bytes pinned only to a local node cannot be retrieved by anyone,
+  and no gateway can serve content that was never pinned publicly.
+
+  Also: `abx storage status --json` no longer warns `unrecognized flag(s), ignored: --json` about a flag
+  its own usage documents and that visibly works (a readout contradicting itself is worse than no
+  readout), and the `--unsigned` epilogue names `abx add <address>` rather than `abx index <address>`,
+  which fails on a node that never registered the project — the common case for a tx handed to someone
+  else's signer.
+
+## 0.1.0-alpha.17
+
+### Minor Changes
+
+- c5b8ec3: `ipfs` and `arweave` metadata fields now resolve on both planes, through a gateway the collection
+  chooses — renderer **spec v11**.
+
+  These are the two representations that are content-addressed, the two where the locator IS the
+  integrity hash, and the two this protocol tells creators to prefer. They were also the two the
+  on-chain renderer could not serve. So `abx deploy --onchain-uri --backend ipfs|arweave` worked around
+  it by baking a gateway HOST into a `url` field, which welded a hostname the creator could never
+  migrate and made `abx_provenance` report `source: url` for bytes that live on IPFS.
+
+  The fix separates the two facts that the baked URL had fused. The CID/txid stays in the field, as
+  identity, under that field's own lock. The HTTPS prefix becomes a project-wide preference in two
+  reserved collection-scope fields, `abx_gateway_ipfs` / `abx_gateway_arweave`, with `https://ipfs.io/ipfs/`
+  and `https://arweave.net/` as floors. The renderer, the canonical generator, and the off-chain
+  resolver all read those two fields and apply the same wrap, so a token served from the chain and from
+  a resolver produces the same URL.
+
+  A dead or slow gateway is now a **repoint**, not a rewrite:
+
+  ```bash
+  abx set-gateway 0xYourContract --ipfs https://your-dedicated.mypinata.cloud/ipfs/
+  ```
+
+  One transaction, every token, no re-upload — and it works on fields you have already locked, because
+  the locked value is the CID and the gateway was never in it.
+
+  **What changes for you**
+
+  - `--onchain-uri --backend ipfs|arweave` writes the bare CID (or `cid/{id}.ext` for the O(1) directory)
+    as an `ipfs`/`arweave` field instead of a gateway URL as `url`/`url-template`. `--backend cloud` is
+    unchanged — an HTTPS CDN locator _is_ the address.
+  - New `abx set-gateway <addr> [--ipfs <prefix>] [--arweave <prefix>]` (`none` clears to the public
+    default). Two flags, so a project can pay for a dedicated IPFS gateway and leave Arweave public.
+  - New `--ipfs-gateway` / `--arweave-gateway` on every deploy command. Plain `--gateway` (the
+    storage/upload gateway) seeds the preference for the backend in use, so passing it still does what
+    you meant. Nothing is written when no gateway is named — silence keeps the floor live.
+  - `abx set-field` refuses the two gateway keys and points at `set-gateway`, which validates the
+    prefix, the scope and the representation. Every way to set them by hand fails silently.
+  - The `display.gateway` contract param is **superseded and no longer read**. It could name only one
+    prefix for both schemes and existed only on code projects.
+  - SDK: `projectGatewayPrefix`, `projectGatewayUrl`, `gatewayPrefixFrom`, `contentIdFromLocator`,
+    `GATEWAY_FIELD`, `GATEWAY_FLOOR`. For a host running its own resolver, `ABX_IPFS_GATEWAY` /
+    `ABX_ARWEAVE_GATEWAY` are now a **floor**: a project that stated a preference on chain gets that
+    preference from every conforming resolver, and host config only fills a silence.
+
+  **New canonical addresses** (both testnets; nothing else moved — no token implementation, factory, or
+  `initialize` ABI changed):
+
+  | Contract                         | Address                                      |
+  | -------------------------------- | -------------------------------------------- |
+  | `AbxMetadataRenderer` (spec v11) | `0x85C1aE1F076d808fF7c1729F21B85038Fa16105E` |
+  | `AbxGenerator` (Sepolia)         | `0xb7104AdFa6Fb5615e46E2a681A2Ff043B08fADB5` |
+  | `AbxGenerator` (Base Sepolia)    | `0x2c1b7Cf6C54E4acBcB54FCc395f7Af88eB4fC8Ce` |
+
+  Also fixes a crash on `abx deploy-code --copies`: an undefined `bytes` reference threw a
+  `ReferenceError` at the end of the dry-run plan and, worse, at the confirmation prompt of a real
+  deploy.
+
+- 5b29f53: Drop-in for every reconstruct caller; new exports for hosted/self-host watch loops so they stop
+  reimplementing `eth_getLogs` chunking and a second per-project fetch.
+
+  **`getLogsAdaptive` is public and accepts `Address | Address[]`.** Address-list chunking defaults to
+  1000 (ordinary RPC tier cap) via `addressBatch` — an RPC opinion, not a protocol constant; `0`
+  disables splitting. Per-tick block windows stay with the watcher (the reference one still uses 5000).
+
+  **`reconstructFromLogs(client, prior, logs, {toBlock})`** is the fold / head-read half of
+  `reconstructIncremental` given logs the caller already holds. `toBlock` is the inclusive scan head
+  those logs cover, so a capped window cannot stamp past the last block actually scanned.
+  `reconstructIncremental` is now a getLogs + that function.
+
+  **A Transfer no longer re-downloads every on-chain script chunk.** Chunk content has no log;
+  `ScriptUpdated` is the ping. `applyHeadReads` keeps the prior digest unless that ping is in `fresh`
+  (or the prior digest is missing). Same change helps the single-address path.
+
+  The reference token-api watcher now calls `getLogsAdaptive` for the registered set and hands each
+  touched project's logs to `reindex({logs, toBlock})`, so the watch tick is the only getLogs.
+
+## 0.1.0-alpha.16
+
+### Minor Changes
+
+- b5744a1: An RPC that has pruned its log history is now detected, named, and routed around
+
+  A public endpoint that no longer holds old logs does not fail your scan — it answers `eth_getLogs`
+  with `[]` and HTTP 200, which is a success. Everything downstream believed it:
+
+  - **`abx doctor` graded it `best`.** The archive probe was
+    `getLogs({address: zeroAddress, fromBlock: old, toBlock: old})` and counted any non-throw as archive
+    access — but `zeroAddress` never emits logs, so an empty result is exactly what a _perfect_ archive
+    node returns too. The assertion could not fail; it only ever caught endpoints that _error_ on old
+    blocks. `ARCHIVE_DEPTH` was also 100k blocks, which on a 2-second chain is inside the retained window
+    of the very endpoints that prune.
+  - **The client never failed over.** The read transport is a viem `fallback` across every configured
+    endpoint, and `fallback` rotates on an _error_. So every retry asked the same endpoint the same
+    question, and a project whose logs sit ready on the SECOND configured endpoint reconstructed as
+    empty.
+  - **`abx add` then registered the project with no state at all**, after grinding half a million blocks,
+    and suggested re-running `--full` "in a minute" — advice that can never work for a pruned index.
+
+  Measured on the two default Base Sepolia endpoints, same address and same window: one returns zero
+  logs for the project's entire history, the other returns them instantly. Ethereum Sepolia's keyless
+  default endpoint shows the same shape past a few hundred thousand blocks.
+
+  - **The probe asserts on something that must come back.** Blocks are retained by everyone; receipts
+    and the log index are what get pruned. `probeHistoryAt` (new SDK export) reads the probe block, asks
+    for one of its transactions' receipts, and — when that receipt carries a log — requires `getLogs` to
+    return that same log. No hardcoded address, no fixture block. `ARCHIVE_DEPTH` is now 500k.
+    It fails **safe**: a probe block with no transactions, or whose transactions logged nothing, keeps the
+    old lenient verdict rather than inventing a failure.
+  - **`abx doctor` names a reachable endpoint that can't serve history**, with the fault and the fix
+    ("history pruned ~500000 blocks back … list a full-archive endpoint FIRST in `ABX_RPC_URLS_<CHAIN>`").
+    Collapsing to the best endpoint hid this, and ordering is what decides who answers the scan.
+  - **An empty scan now retries each endpoint on its own** before giving up, and says which one served
+    the logs. Cheap by construction: each endpoint is first asked whether it holds history at _this
+    project's_ deploy block — three calls — and only one that passes gets a scan.
+  - **`SelfHostIndexer.reindex(address, {rpcUrl})`** pins a single endpoint instead of the pool, which is
+    what makes that rotation expressible. Clients are pooled per (chain, endpoint), so the default path
+    is unchanged.
+  - The final failure message now separates the two cases it had merged: a project you _just_ deployed
+    (transient, retry) from one that is not new (retention — check `abx doctor`).
+
+  Found by direct probing during the 2026-08-17 agent sweep, after an `abx add` of a 12-day-old Base
+  Sepolia edition reconstructed zero of its 18 events.
+
+### Patch Changes
+
+- 9c287c0: `abx inspect` no longer lists trait keys when there is no real `abx.traits(` call.
+
+  A string that _mentioned_ `abx.traits({foo: 1})` used to fill the Traits section while Runtime said
+  "no abx.traits call". The key extractor now runs only when the call survives in the code view
+  (comments stripped, strings blanked). Quoted keys inside a real call (`'Plant Count':`) still
+  work. Terser `window.abx&&(abx.traits({…}),abx.done())` and an accessor at the end of a large file
+  are pinned by tests.
+
+  Reported in the 2026-08-18 tester batch (feedback 0a0f8f9c, 1253c563).
+
+- 9c287c0: On-chain script chunks no longer insert a newline in the middle of a token.
+
+  The generator joins chunks with `'\n'`. A fixed 22 kB slice could split `mass` into `ma` + `ss`,
+  producing a SyntaxError on chain while `abx verify` still went green. Template-mode deploys now
+  split at an existing newline so that join is byte-identical to the source, refuse a 22 kB+ span
+  with no newline, and parse the program before any gas.
+
+  Reported in the 2026-08-18 tester batch (feedback 38455765, 038d7ed2, 8c256d9d, 50e53193).
+
+## 0.1.0-alpha.15
+
+### Minor Changes
+
+- 7fec2d7: An edition's per-id cap now folds from the log, so a capped edition stops reporting itself as open
+
+  `DefaultMaxSupplySet` — added in the contract-audit release precisely so the log could tell an open
+  edition from a capped one — reached the ABI and stopped there. `reconstruct.ts` had no fold case, so
+  the collection-wide default never landed in `ProjectState`, and **the common shape was the broken
+  one**: `--copies N` sets the cap at `initialize` and never calls `setMaxSupply`, so no id has a
+  `MaxSupplyUpdated` of its own and every capped edition ever deployed folded as _uncapped_. The
+  head-read lane (`listTokens`, which calls `maxSupply(id)`) said `N` the whole time — one field name,
+  two answers, on the value that decides whether a buy button renders. Found by the abx-services team
+  while upgrading their resolver/indexer to this release.
+
+  - **`ProjectState.defaultMaxSupply`** — the collection-wide per-id default (`'0'` = open; `null` ⇒ not
+    an edition). The 1155 analogue of `maxInvocations`.
+  - **`TokenState.maxSupply` is now the _effective_ cap** — an id's own override, else that default —
+    and so equals `maxSupply(id)` on chain and its head-read twin `TokenRow.maxSupply`. Previously it
+    was the override alone, and absent otherwise.
+  - **`TokenState.maxSupplyOverridden`** — whether this id has ever been explicitly overridden. The
+    distinction the on-chain getter cannot express (`maxSupply(id)` returns `0` for both "never capped"
+    and "deliberately closed") and the log now can, plus a signal that the monotonic never-increase rule
+    is in force for that id.
+  - **`editionCapOf(token)`** — new SDK export returning `{kind:'open'} | {kind:'capped', cap} |
+{kind:'closed'}`, so nothing re-derives the rule. Used by the dashboard and `abx tokens`; pass a
+    head-read row and a `'0'` cap reads `open`, which is all a state read can honestly say.
+  - **The dashboard stops lying twice.** It tested `maxSupply` for truthiness: a `--copies 10` id read
+    "(open)", and — because `'0'` is a non-empty string — an id deliberately closed would have read
+    "12 / 0". It now reads "12 / 10" and "12 (closed — no more can be minted)".
+  - **Projection columns**: `projects.default_max_supply`, `tokens.max_supply_overridden` (migration-added,
+    so an existing store keeps working; NULL stays NULL rather than becoming a fabricated `0`).
+
+  Also in this pass, from the same review:
+
+  - **`SPINE_EVENT_DOC` had drifted to 41 of 52 events**, so eleven folded events carried an empty
+    human description and defaulted to Register 2 — including `TransferValidatorUpdated`, which belongs
+    to Register 1, and the factory's `Deployed`. All eleven are described, and a new
+    `spine-doc-coverage.test.ts` fails the build if the table and the spine ABI drift apart again in
+    either direction.
+  - **One provenance body in the resolver's `renderer` branch.** The `text/uri-list` arm hand-built an
+    object byte-identical to `onChainProv(field, 'renderer', …)` — same keys, same order, the note string
+    typed a second time — so the only thing that branch could do was drift from `sourceNote`.
+  - **Dead `abx_params`-era test scaffolding deleted** (a `paramsOf(json) => json.abx_params` reader, an
+    RPC stub, a schema factory), including an import of a `ParamMember` type that no longer exists —
+    which nothing caught, because `tsconfig` includes only `src`, so test files are never typechecked.
+
+## 0.1.0-alpha.14
+
+### Minor Changes
+
+- 1b6b741: Rename "artist" to "creator" throughout, including the protocol vocabulary
+
+  ABX is a tool for creators generally. Art remains a first-class use case, but it should not be baked
+  into the product's framing — and it was, down to the on-chain identifiers.
+
+  **Breaking, and deliberately a clean break** (pre-launch, folded into the one redeploy that four
+  rounds of security remediation already required — deferring would have meant either living with the
+  old vocabulary permanently or spending a second deployment on a word):
+
+  - `AuthOption` is now `Creator`, `TokenOwner`, `Address`, `CreatorOrTokenOwner`, `CreatorOrAddress`,
+    `TokenOwnerOrAddress`, `CreatorOrTokenOwnerOrAddress`. Order is unchanged, so the `uint8` values
+    are identical — only the names moved. Users type these: `--schema key:Type:Creator`.
+  - The on-chain collection metadata field keys `artist` / `artist_links` are now `creator` /
+    `creator_links`. These are `bytes32` keys written on-chain and emitted verbatim into every
+    collection's `contractURI` JSON.
+  - CLI flags `--artist` / `--artist-links` are now `--creator` / `--creator-links`. No aliases.
+  - `@artblocks/abx-token-api` renames its `art` module to `content`: `generateArt` →
+    `generateContent`, `artContentHash` → `contentHash`.
+  - `AbxMetadataRenderer.SPEC_VERSION` is **7**, and `isCurrentRenderer` gates on it. A v6 renderer
+    emits a different member key, so it is genuinely behind, not cosmetically so.
+
+  Package CHANGELOGs are left alone on purpose: they record what past alpha versions actually shipped,
+  and rewriting them would make the release history lie about flag names that really were `--artist`.
+
+- 1b6b741: A purchase now carries the terms the buyer accepted — closing the one path by which a project owner
+  could take more than the buyer agreed to.
+
+  Both shared fixed-price minters take a mandatory **terms guard** — not a slippage allowance; see the note
+  below — and revert a new `SaleTermsChanged()` when the live sale doesn't match:
+
+  ```solidity
+  purchase(address token, address expectedPaymentToken, uint256 maxPrice)
+  purchaseTo(address token, address to, address expectedPaymentToken, uint256 maxPrice)
+  // 1155 — the bound is the TOTAL, since qty multiplies it
+  purchase(address token, uint256 id, uint256 qty, address expectedPaymentToken, uint256 maxTotalPrice)
+  purchaseTo(address token, uint256 id, uint256 qty, address to, address expectedPaymentToken, uint256 maxTotalPrice)
+  ```
+
+  `configure` takes effect immediately and has no timelock. On the ETH lane that was largely contained
+  (`msg.value` must equal `price`), but an ERC-20 sale settles `safeTransferFrom(buyer, payee, price)`
+  against a standing allowance — so an owner who front-ran a pending purchase with a huge price spent the
+  buyer's whole approval, and one who switched the sale to a different ERC-20 reached an allowance granted
+  somewhere else. `address(0)` as `expectedPaymentToken` means ETH. There is deliberately no "no maximum"
+  sentinel: a bound that can be defaulted away is the bug being fixed.
+
+  SDK (breaking): `preparePurchase` / `preparePurchase1155` take the live terms — `sale`, exactly what
+  `readSaleConfig` / `readSaleConfig1155` returns — instead of a hand-computed `value`. They derive the
+  ETH to attach (`price`, or `price × quantity`) and the bound from those terms, so the payment and the
+  guard cannot desync. Pass `maxPrice` / `maxTotalPrice` to state a wider ceiling (a UI that tolerates a
+  small move rather than making the buyer re-sign); it widens the guard only, never the payment. New
+  exported type `PurchaseTerms`.
+
+  **`maxPrice` is not slippage tolerance on the ETH lane, and the docs no longer imply it is.** The minter
+  requires `msg.value == price` (an equality) and V1 has no refund path, so an in-flight ETH purchase
+  reverts if the price moves in _either_ direction, however wide the ceiling. Real tolerance exists only on
+  the ERC-20 lane, where the live `price` is pulled from the buyer's allowance and anything at or below the
+  ceiling settles.
+
+  CLI: `abx minter buy` hands the terms it just read to the SDK (the price × quantity math now lives in
+  one place), and the scaffolded `abx mint-page` binds each mint to the terms the page is displaying —
+  if the owner re-prices mid-click the mint reverts, nothing is charged, and the page tells the buyer to
+  review the new price. Re-pricing a live sale therefore fails the buys already in flight, by design:
+  pause first if you want a clean cutover.
+
+  **Deploy note:** this is a runtime change to two shared singletons, so both need a redeploy on every
+  supported chain (CREATE2 + canonical salts, so the new addresses are identical cross-chain) and the new
+  addresses recorded in `packages/sdk/src/deployments.ts` +
+  `site/content/docs/reference/deployments.mdx`. Until then the CREATE2-prediction-vs-manifest tests fail
+  on purpose — that is the drift detector doing its job, not a broken test.
+
+- 1b6b741: The configure hook can see a blob's size and contents — so creators can police it instead of the protocol
+
+  `IAbxConfigureHook.onParamConfigured` gains two arguments:
+
+  ```solidity
+  function onParamConfigured(
+      uint256 tokenId,
+      bytes32 key,
+      bytes32 value,          // the literal on the scalar path; keccak256(data) on the blob path
+      address updatedBy,
+      uint256 dataLength,     // 0 on the scalar path; data.length on the blob path (never 0 there)
+      address dataBlobAddress // address(0) on the scalar path; the live SSTORE2 pointer otherwise
+  ) external;
+  ```
+
+  **Why.** On a multi-copy edition params belong to the id, so a holder-writable `String`/`Bytes` key is
+  shared: one holder could store large values and make the shared id's document expensive for every
+  co-holder. An independent audit asked for a protocol byte ceiling. A ceiling would cap every project
+  to police a configuration almost nobody wants — but the alternative we had documented, "the creator
+  constrains it in their own hook", was not actually possible: the hook only ever saw `keccak256(data)`.
+  It could not learn the length, could not read the content, and could not read the new value from
+  storage either, because nothing had persisted yet. Now it can, and no protocol limit is imposed.
+
+  **The bytes are not forwarded** — a blob can be nearly a full contract's worth of data, and putting it
+  in calldata would make every configure call pay for it whether the hook looks or not. A hook enforcing
+  a size ceiling reads `dataLength`; a hook that needs content calls `SSTORE2.read(dataBlobAddress)` and
+  pays for exactly what it asked for. Guaranteed: `keccak256(SSTORE2.read(dataBlobAddress)) == value`.
+
+  **Two things to know when writing one.** `tokenParamData(tokenId, key)` still returns the OLD value
+  inside the hook (that is what "before the value persists" means — and it lets you veto a regression).
+  And the blob is written _before_ the hook, because an address is meaningless until the contract behind
+  it exists; so a veto happens after the writer paid to store the bytes. The accepted path costs the
+  same as before, only rejection wastes, and it wastes only the rejecting writer's own gas.
+
+  `ConfigurableParams` is extension **v3** — the beacon's `extensionVersion` is how an integrator tells
+  which calling convention a deployed token uses. A hook written for the 4-argument form will revert
+  against a v3 token, and vice versa.
+
+  Addresses: `AbxParamsLib` moved, `AbxEditionLib` with it (it links it), and the four token types that
+  compose `ConfigurableParams` moved with their factories — `SeriesCode`, `EditionCode`,
+  `OneOfOneEdition`, `EditionImage`. The two ERC-721 image types and their factory, `AbxMetadataLib`,
+  `AbxCodeLib`, the renderer, chunk store, seed source and both minters keep their addresses.
+
+- 1b6b741: Renderer spec v10 projects four long-reserved keys; edition trust anchors move
+
+  **Renderer spec v10.** Four keys the spec reserved from the start were projected on chain by nothing:
+  `background_color` and `youtube_url` (token), `banner_image` and `featured_image` (collection). A
+  documented reserved key that no surface emits is a hole rather than a saved byte — a creator sets it,
+  observes nothing, and cannot tell whether the tool or the marketplace is at fault. All four now project
+  when their representation is chain-reachable, and are omitted when unset. `isCurrentRenderer` gates on
+  10; a v9 renderer silently drops them.
+
+  **`collaborators` is no longer a reserved key.** It was in the registry, projected by neither plane, and
+  because reserved keys are excluded from the resolver's `artifacts` listing, setting it on chain did
+  nothing observable anywhere. It is now an ordinary creator key — which means it **does** list in
+  `artifacts`. Put a collaborator list in a named artifact (`abx attach`) or in `description`.
+
+  **The resolver's two collection image keys are now symmetric with the renderer.** `featured_image` is a
+  top-level `contractURI` key instead of artifacts-only, and `banner_image` projects for every
+  chain-reachable representation instead of only `url` (an `inline` or `reader` banner used to vanish).
+
+  **Docs now carry the three-list split** — which keys both planes project, which are the off-chain
+  resolver's alone by design (`abx_provenance.status`, operator overlay, effects/live-view, the
+  `artifacts` listing, collection `image` courtesy, `image_data`, off-chain-decode values), and which are
+  not reserved at all. That split is the thing to read before adding a key to either surface: drift on a
+  key both planes _can_ emit is what produced three earlier remediations.
+
+  **Addresses.** The three edition factories move (trust anchors) along with their implementations, and
+  the renderer moves. `AbxEditionLib`, `AbxMetadataLib`, `AbxCodeLib`, `AbxParamsLib`, all three ERC-721
+  factories, the chunk store, the seed source, both minters and both generators keep their addresses.
+  Existing clones keep running their frozen implementations; re-point a live collection at the new
+  renderer with `abx set-renderer` rather than redeploying it.
+
+- f64a31f: Expose `lockScript` above the contract layer — the lock that actually freezes a code project's work.
+
+  `SeriesCode`/`EditionCode` have always had `lockScript()` (and `scriptLocked()`), but nothing above
+  the ABI surfaced it: the SDK had no `prepareLockScript`, the CLI had no `lock-script` command, and the
+  skill's immutability guidance told creators that `lock-field` + `lock-uri` made a project "provably
+  immutable". For a generative/code drop that is false — those freeze only the _metadata_; the owner can
+  keep rewriting the on-chain program (`setScriptChunk`/`removeLastScriptChunk`) until the script is
+  locked. Agents building on ABX repeatedly missed that the program could be frozen at all.
+
+  - **SDK:** new `prepareLockScript({contract, chainId})` (mirrors `prepareLockDependencies`).
+  - **CLI:** new `abx lock-script <address>` command (any signing lane), plus `abx verify` now reports
+    the script and dependency lock state for code projects (`script: locked/UNLOCKED`, with a nudge to
+    `lock-script` when the program is still mutable) — read from the already-indexed state, no extra RPC.
+  - **Skill:** the immutability guidance now names the full freeze for a code drop
+    (`lock-script` + `lock-dependencies` + `lock-field`/`lock-uri`, plus `set-schema … lock=now` for a
+    param value), corrects the "provably immutable" claim, and surfaces PostParams as a first-class
+    `deploy-code` capability (not only a generative feature) in the `SKILL.md` description and decision
+    tree so collector-settable on-chain parameters are discoverable.
+
+- 1b6b741: Independent-audit remediation: `abx_provenance` reshaped, `abx_params` removed, hook ABI widened
+
+  An independent adversarial audit of the contracts found no Critical or High issue, no theft path and
+  no cross-project reach — but four Mediums, eight Lows and five architectural notes. Everything is
+  addressed. Consumer-visible changes:
+
+  **`abx_provenance` entries are now `{field, source, note}`.** They lost `onChain`, which was wrong in
+  both directions — a `url` reported `false` although the URL string is stored on chain, while an
+  `inline` value of `"https://…"` reported `true` for a pure pointer — and `verifiedAgainstChain`,
+  which was hardcoded `null` on every entry. `source` says where the bytes came from; whether a value
+  resolves on chain is visible in the value, and that judgment belongs to the reader. The off-chain
+  resolver drops `onChain` for the same reason (it was exactly `status === 'on-chain'`) and keeps
+  `status`, which it can genuinely compute.
+
+  **`abx_params` no longer appears in `tokenURI`.** It was emitted by the on-chain renderer AND the
+  resolver and parsed back by nobody. Params enumerate directly from the contract — `tokenParamKeys`,
+  `tokenParam`, `paramSchemaKeys` — which is canonical, needs no indexer, and is what a chain-only
+  reader should use; a code project's script still receives them through `tokenData`. Traits for
+  marketplaces belong in `attributes`, unchanged.
+
+  **A computed `image` locator now lands verbatim.** A field renderer returning
+  `("text/uri-list", "ipfs://…")` was being data-wrapped into `data:text/uri-list;base64,…`, which no
+  marketplace dereferences. `image` and `animation_url` now share one implementation of the rule.
+
+  **`IAbxTransferHook.onTokenTransfer` gains `operator` and `amount`.** Without them a hook on a
+  shared-supply ERC-1155 cannot tell a real transfer from a zero-amount no-op — which let any address
+  fire the param lifecycle for an id it held no copy of. The token also refuses to notify on
+  zero-amount and self-transfers.
+
+  **`pingURI` is owner-only**, and `paramSchemaHead` / `selectOption` are new: resolving one selected
+  option no longer copies the whole option table on every render.
+
+  `AbxMetadataRenderer.SPEC_VERSION` is 8. Every canonical address moves — every token type is now
+  library-linked, including the two ERC-721 image factories, because the metadata field store was
+  externalized into the new `AbxMetadataLib` to restore EIP-170 headroom before any fix was stacked on
+  top of 187 bytes of margin.
+
+  The CLI now warns when `--copies` meets a holder-writable `--schema`: on an edition, params belong to
+  the id, so every holder shares one value and the last writer wins.
+
+- 1b6b741: The custom seed source is now a real choice, not a documented one
+
+  We tell creators — in the docs, in `AbxSeedSource`'s own NatSpec, and in `deploy-code --help` — that the
+  canonical mint seed is pseudorandom and that the answer for anything lottery-like is to point
+  `seedSource` at their own `IAbxSeedSource` over commit-reveal or a VRF oracle. On-chain that was always
+  true. In the toolkit it was not: there was no flag, no owner command, and the only route was an
+  `ABX_SEED_SOURCE` env var validated as nothing more than "has code at this address". A doc/code
+  contradiction of our own making, now closed at both ends.
+
+  **Deploy:** `abx deploy-code --seed-source <0x…|canonical>` (and the `--copies` edition lane). Omitting
+  it is unchanged — the canonical `AbxSeedSource` from the manifest, bootstrapped on a chain that lacks
+  one — and `--no-seed` still means no mint-time seed at all. Passing both is refused rather than resolved
+  in someone's favour. `ABX_SEED_SOURCE` keeps working and is no longer the unchecked lane.
+
+  **After deploy:** `abx set-seed-source <address> <0x…|canonical|none>` — owner-only, same positional
+  grammar as `abx set-transfer-validator`. It surfaces the on-chain `setSeedSource(address)` that nothing
+  reached before. **Future mints only**: a seed settles the instant it is assigned, so nothing already
+  minted changes. The command says so, names the count of tokens already carrying a seed from the old
+  source, and points out that a part-sold drop then spans two sources — public on the spine
+  (`SeedSourceSet`) but not something an early buyer is told, so pause and say so.
+
+  **`abx state` now prints the seed source**, labelled: `none`, the canonical singleton, or `CUSTOM`. It is
+  the one setting an owner can re-point mid-sale that changes what a later buyer receives, and it was
+  readable nowhere.
+
+  **Both writes probe the address first, and `code.length > 0` is not the check.** The SDK gained
+  `probeSeedSource` — one `eth_call` to `seed(uint256,address)`, which must return 32 bytes — plus
+  `readSeedSource`, `prepareSetSeedSource`, `assertSeedSourceUsable`, and a `SeedSourceUnusableError`
+  carrying a structured verdict. Four shapes are refused, each with its own message: **no code**;
+  **empty return** (the permissive-fallback shape — a Safe, an uninitialised proxy, an EIP-7702-delegated
+  EOA; pasting your own wallet is the common way in); **a return under 32 bytes**; and **a revert** (either
+  the wrong address entirely, or a real source not yet armed — `seed()` is called synchronously inside the
+  mint and its revert bubbles, so a source that cannot answer now cannot answer at mint either). The
+  interface is non-`view` on purpose, but an `eth_call` simulates a state-keeping source fine, so
+  commit-reveal and oracle-fed sources probe without sending anything. This matters because a
+  misconfigured seed source is **completely silent**: the write succeeds, `seedSource()` reads back what
+  you set, the event fires, `abx state` shows it — and then every mint of the collection reverts in the
+  token's `bytes32` decode. Same spirit as `CreatorToken._requireHasCode`.
+
+  **Naming fix: a `seed` param schema is not a "re-roll", and no longer described as one.** The governed
+  path is `configureTokenParam(tokenId, "seed", value)` — **the caller supplies the value**. Nothing is
+  re-randomized and the seed source is never consulted again; with an unbounded `Uint256Range` the
+  authorized party may set any 32-byte value, repeatedly, until they like the output. "Re-roll" promises a
+  buyer a fresh random draw they could reasonably expect to be fair, which is not what they get. It is a
+  collector-chosen (or creator-chosen) seed, and the docs, the specs, and the skill now say that. The
+  substance that was correct is unchanged: the schema is a pre-sale commitment (declarable only before the
+  collection's first seed exists), `paramSchema("seed")` is the buyer's read, and the type must be a
+  literal/scalar one.
+
+  **Dropped a stale warning** in the skill about a `seed` schema changing how the seed decodes off-chain
+  while the on-chain generator injects raw hex — `tokendata.ts` returns the raw hex for `seed`
+  unconditionally, ahead of the schema branch, so the wire format is invariant across both surfaces and
+  there is nothing left to warn about.
+
+  **Also corrected: `maxPrice` is a terms assertion, not slippage tolerance.** On the ETH lane the minter
+  requires `msg.value == price` (an equality) and V1 has no refund path, so an in-flight ETH purchase
+  reverts if the price moves in _either_ direction, however wide the ceiling — widening `maxPrice` on an
+  ETH sale buys the buyer nothing. Real tolerance exists only on the ERC-20 lane, where the live price is
+  pulled from the buyer's allowance. `specs/protocol/minter-spine.md` and
+  `site/content/docs/protocol/minting.mdx` said "a price cut still settles" without that distinction.
+
+- 1b6b741: Renderer spec v9: a computed image is carried once, not twice
+
+  A field-renderer-produced image was emitted as the reserved `image` key **and again** inside the
+  `artifacts` manifest, then the whole document was base64-encoded around both copies. On the
+  on-chain-SVG lane that roughly doubled the inner payload of `tokenURI` — the one read this protocol
+  most wants to stay within ordinary RPC limits.
+
+  The data-plane spec always allowed an on-chain renderer to omit entries duplicating reserved keys it
+  already emits ("an EVM-efficiency reduction, never a semantic one"). The renderer now takes that for
+  every reserved key, so on a fully-on-chain project `artifacts` is absent rather than empty. Nothing is
+  lost, because the entry's only unique contribution was a `mimeType` and a `data:` URI states its own.
+  The off-chain resolver still emits the complete listing, duplicates included — that asymmetry is the
+  spec's, and it is now documented on both surfaces.
+
+  Also removed: three orphaned param getters on the renderer (`paramKeysOf`, `paramSchemaOf`,
+  `paramDataOf`), stranded when v8 took params out of `tokenURI`, whose NatSpec still claimed `tokenURI`
+  called them.
+
+  `AbxMetadataRenderer.SPEC_VERSION` is **9** and `isCurrentRenderer` gates on 9. Only the renderer
+  moves — nothing links it, so no factory or implementation address changes. Existing on-chain-URI
+  projects keep resolving through the v8 renderer until re-pointed with `abx set-renderer`.
+
+- 1b6b741: Upgrading from alpha.12/alpha.13 — what breaks, in one place
+
+  This release lands the contract-audit branch. It is a **compatibility break with earlier alphas**, which
+  is fine at this stage (greenfield alpha, no backwards-compatibility promise) but is worth having in one
+  list rather than spread across a dozen changesets. Nothing here is a deprecation with a migration
+  window; the old shapes are gone.
+
+  **Every canonical address moved**, and four manifest fields are new (`metadataLib`, `paramsLib`,
+  `codeLib`, `editionLib` — the delegatecalled write-path libraries). Resolve through `getDeployment` and
+  the upgrade is transparent; anything you have _stored_ keyed by a factory address is not. A project
+  indexed from a superseded anchor reads `isCanonical: false` against the new manifest — correct, since it
+  is what a creator sees if they don't redeploy, but it is a data question, not a version bump.
+
+  **The metadata document changed: renderer spec v4 → v9.** If you assemble or assert on it:
+
+  - `abx_provenance` entries lost `onChain` (it was exactly `status === 'on-chain'`, and wrong in both
+    directions) and `verifiedAgainstChain` (hardcoded `null` on every entry). `source` and `status` stay.
+  - The `abx_params` block is gone from **both** lanes. Params enumerate from the contract —
+    `tokenParamKeys` / `tokenParam` / `paramSchemaKeys` — which is canonical and needs no indexer; a code
+    project's script still receives them through `tokenData`.
+  - `artist` / `artist_links` are now `creator` / `creator_links` (reserved on-chain collection field
+    keys), and `AuthOption.Artist*` is `AuthOption.Creator*` (numeric values unchanged).
+  - A computed `image` locator (`text/uri-list`) lands **verbatim** instead of being wrapped into a
+    `data:` URI no marketplace dereferences.
+  - The on-chain renderer no longer duplicates a computed image into `artifacts`. The off-chain resolver
+    still emits the complete listing — that asymmetry is specified, not a bug.
+  - Four long-reserved keys now project on chain: `background_color`, `youtube_url` (token) and
+    `banner_image`, `featured_image` (collection). `featured_image` also becomes a top-level resolver key
+    instead of artifacts-only, and `banner_image` projects for every chain-reachable representation
+    rather than `url` alone.
+  - `collaborators` is **no longer reserved** — projected by neither plane and excluded from `artifacts`
+    by its own reserved-ness, so it did nothing. It is now an ordinary creator key that does list.
+
+  **`tokenData` divergences fixed, so rendered output can change:** a contract-scope `seed` no longer
+  leaks into a token's `tokenData` (the on-chain generator never read one), `seed`'s wire format is always
+  raw 32-byte hex regardless of schema, and `</script` escaping is case-insensitive to match the on-chain
+  generator. Cached renders for affected code projects should be re-derived.
+
+  **Removed:** `paramKeysOf`, `paramSchemaOf`, `paramDataOf` on `AbxMetadataRenderer` — orphaned when
+  params left `tokenURI`. Read the token directly instead.
+
+  **Two hook interfaces widened** (`ConfigurableParams` is extension **v3**; a hook built for the old
+  signature reverts against a v3 token): `IAbxTransferHook.onTokenTransfer` gained `operator` + `amount`;
+  `IAbxConfigureHook.onParamConfigured` gained `dataLength` + `dataBlobAddress`.
+
+  **Additive:** `ParamHooksFrozen` folds into `ParamHooks.locked`; `paramSchemaHead` + `selectOption`
+  replace pulling a whole option table to resolve one index; `readParamHooks`; `abxJs()` / `gunzipScript()`
+  on the generator for piecewise document assembly; and the three ERC-1155 ABIs now carry
+  `MetadataUpdate` / `BatchMetadataUpdate` / `DefaultMaxSupplySet`, which were emitted but not decodable.
+
+- 1b6b741: Transfer-validator authorization has one home, and the five affected trust anchors move
+
+  `CreatorToken1155.setTransferValidator` performed no authorization at all, and the library it
+  delegates to performed none either. What protected the three edition token types was that each one
+  _overrode_ the setter to run the caller check first — one guard in three copies, sitting in front of
+  an unguarded mixin whose own comment claimed the tokens carried no override. Nothing deployed was
+  vulnerable, but a fourth edition type that simply inherited the mixin would have shipped an
+  unauthenticated `setTransferValidator`, which decides whether collectors' tokens can move at all.
+
+  The guard now runs in the mixin, the overrides are gone, and the function is no longer `virtual` —
+  so the arrangement is enforced by the compiler rather than by a comment. A dead
+  `_requireMinterOrOwner` in `ExternalMinter`, whose NatSpec wrongly advertised it as the mint-time auth
+  check (the real one also enforces `paused()`), is deleted in the same pass.
+
+  **Both changes are source-only** — the compiled runtime bodies are byte-identical before and after,
+  measured across all ten affected artifacts. Only the metadata hash differs, and since that is part of
+  the initcode, the CREATE2 addresses move. Five factories and their implementations are redeployed and
+  re-verified on Sepolia and Base Sepolia: `SeriesImageFactory`, `SeriesCodeFactory`,
+  `OneOfOneEditionFactory`, `EditionImageFactory`, `EditionCodeFactory`. Everything else — the 1/1 image
+  factory, all four libraries, the renderer, chunk store, seed source, both minters, both generators —
+  keeps its address.
+
+  Projects deployed from the superseded factories keep working, but `abx` will report their anchor as
+  an older version. Redeploy from the anchors in the refreshed manifest.
+
+### Patch Changes
+
+- 1b6b741: Externalize the code-custody READ surfaces into `AbxCodeLib` — B22 step 2, buying back the bytes the ERC-4906 audit fix spent
+
+  The audit remediation that made `OnChainMetadata`'s field writes emit ERC-4906 (closing a real finding:
+  that surface mutated `tokenURI` silently, so a correct indexer served the pre-edit document forever) cost
+  ~96 B per token, and `SeriesCode` and `EditionCode` had no room for it — both fell under the 150 B EIP-170
+  floor `contracts/test/CodeSize.t.sol` guards. That is precisely the trigger condition `docs/10-backlog.md`
+  B22 was written for, and step 2 was the prescribed answer.
+
+  The `IAbxOnChainScript` and `IAbxDependencies` view bodies now live in `AbxCodeLib`, next to the write
+  paths that were already there — `scriptChunkCount`/`scriptChunk`/`scriptLocked` and
+  `dependencyCount`/`dependencyByIndex`/`dependencyRegistry`/`dependenciesLocked`. The mixins keep the
+  functions (same signatures, same ABI, same ERC-165 ids) as **raw-calldata passthroughs** through a new
+  shared `AbxCodeDelegate` base, which forwards the call's exact calldata to the library and returns the
+  return data untouched. Storage still resolves in the token's own ERC-7201 namespaces and events still log
+  from the token — that is what `delegatecall` buys.
+
+  Raw, not typed, on purpose: B22 step 1 measured a _typed_ shell (`return AbxCodeLib.f(...)`) **growing**
+  the token by ~855 B, because decoding the library's return value and re-encoding it at the call site costs
+  more than the extracted body saves. The same mistake was made again during this remediation, on
+  `setTokenField`/`setContractField`, and reverted. The price of the raw form is that `AbxCodeLib`'s read
+  signatures are now part of every composing token's external ABI — same signature ⇒ same selector is the
+  whole mechanism — so they must track the interfaces verbatim; both the library and the mixins now say so.
+
+  EIP-170 margins, before → after:
+
+  | contract      | before | after   | floor |
+  | ------------- | ------ | ------- | ----- |
+  | `SeriesCode`  | 125    | **529** | 150   |
+  | `EditionCode` | 132    | **507** | 150   |
+
+  `AbxCodeLib` grew 3,905 → 4,961 B and still has ~19.6 KB to spare. Nothing else moved: `OnChainScript` and
+  `Dependencies` are composed **only** by `SeriesCode` and `EditionCode`, and both already linked
+  `AbxCodeLib`, so no contract gained a library dependency and the other four tokens are byte-identical.
+
+  No behavior change and no ABI change — the read signatures, return types, mutability, ERC-165 ids and the
+  `ScriptIndexOutOfRange`/`DependencyIndexOutOfRange` error selectors are all preserved (the errors stay
+  declared on the mixins so they remain in each token's ABI, and now revert from the library's
+  identically-named, identically-selectored twin). This does move the implementation bytecode, so it rides
+  the redeploy this remediation already requires: `AbxCodeLib`, both code tokens, and their factories (and
+  therefore the factory trust anchors) all get new addresses.
+
+- 1b6b741: CREATE2 for library deployments, as the standard process — and delete the false belief that said it was impossible
+
+  An audit found that two ERC-1155 token types were held library-free, and an EIP-170 size floor relaxed, on
+  the recorded belief that linking a delegatecalled library costs a factory its CREATE2-deterministic address.
+  That belief is false, and the committed broadcast artifacts always refuted it: every recorded library deploy
+  went through the keyless CREATE2 proxy, `AbxParamsLib` landed at ONE address on Sepolia and Base Sepolia
+  from deployer nonces **215 apart** (a nonce is not an input to a CREATE2 address), and both library-linked
+  factories have held chain-identical addresses across four deploy generations.
+
+  What was true was narrower and self-inflicted: `deploy.ts` deployed its libraries with `send({to: null})` —
+  a plain EOA `CREATE` — **by its own choice**, so _it_ could not predict them. `create2.ts` and both code
+  factory deploy functions then wrote that local limitation up as a property of libraries in general, and the
+  repo proceeded to contradict itself (`deployments.ts` and `reference/deployments.mdx` describe the correct
+  mechanism a few files away).
+
+  The SDK now does what the docs already claimed:
+
+  - Both bootstraps (`deploySeriesCodeFactory`, `deployEditionCodeFactory`) deploy every write-path library
+    through the keyless proxy at the canonical `AbxSalts` salts — `abx.lib.params.v1`, `abx.lib.code.v1`,
+    `abx.lib.edition.v1`, mirrored in `ABX_SALT` and pinned against `AbxSalts.sol` by a new test — and then
+    CREATE2 the linked factory at its own salt. **An SDK-bootstrapped chain and a forge-bootstrapped chain now
+    produce identical addresses** (verified: the SDK's predictions equal what
+    `DeployLibraries.s.sol --sig 'predict()'` prints).
+  - Idempotent, out of necessity rather than politeness: the proxy _reverts_ on an occupied address, so a
+    library already on-chain is linked against instead of redeployed — which is also what makes a partially
+    bootstrapped chain recoverable by re-running.
+  - New: `predictParamsLib`, `predictCodeLib`, `predictEditionLib`, `predictSeriesCodeFactory`,
+    `predictEditionCodeFactory`, plus exported `libPlaceholder` / `linkLibraries` / `LIB_FQN`. Both code
+    factories therefore gained the CREATE2 self-heal every other canonical anchor has — and need no version
+    probe for it, because code at a CREATE2 address is bytecode-bound to the build that predicted it.
+
+  **Fixes a real crash on the way past.** `deployEditionCodeFactory` could not succeed at all: it deployed
+  `abxEditionLibBytecode` raw, but `AbxEditionLib` itself delegatecalls `AbxParamsLib`, so its shipped
+  bytecode carries an unlinked `__$…$__` placeholder — not hex, so the RPC rejected it with an opaque
+  `Invalid byte sequence`. The old guard only checked the _factory's_ bytecode, never the library's. The
+  library is now linked before it is deployed, and `linkLibraries` throws with the offending placeholder named.
+
+  **The trap that IS real, now written down** (`create2.ts`, `reference/deployments.mdx`): a library's address
+  is a function of its creation bytecode, so build settings move it. Linking _after_ compilation — substituting
+  into solc's placeholder, what forge's automatic linking and the SDK both do — cannot change that bytecode.
+  Handing solc the addresses at build time (`--libraries src/…:Lib:0x…`) writes the map into
+  `settings.libraries` in every artifact's metadata, and the metadata hash is appended to the creation
+  bytecode: measured here, that moves the library's own address and the linked factory's initcode. Optimizer
+  profile does the same (the code tokens compile at 200 runs). Both failures are invisible until two chains
+  disagree, so the docs now say to compare `predict()` against the SDK's predictions rather than assume.
+
+  Docs and specs swept for the old claim: `reference/deployments.mdx` (the salts, and a "libraries go first"
+  bootstrap step naming `DeployLibraries.s.sol` and its `predict()` dry run), `reference/contracts.mdx`
+  (`AbxEditionLib` was missing from the library taxonomy entirely), `reference/sdk.mdx`,
+  `specs/self-host-toolkit/deployment.md`, and the `abx-self-host` skill's code-projects reference. No
+  addresses were invented: nothing is redeployed yet, and the two manifest-drift tests still stand as the
+  detectors waiting on it.
+
+- 1b6b741: Stop promising immutability the locks don't deliver — and name the residual owner powers in one place
+
+  **The claim that was wrong.** With the field lock, URI lock, contract-URI lock, script lock and
+  dependency lock _all_ engaged, the rendered output can still change, two ways. **Params have no lock at
+  all** — they aren't fields, so no field lock reaches them, and the renderer projects the whole enumerated
+  set into `tokenURI` as `abx_params` (a program reads the same set as `tokenData`). And a
+  **`Resolution.Registry` dependency is re-fetched from the registry contract on every read** —
+  `lockDependencies` freezes the ref and the registry pointer, not another contract's storage. `abx verify`
+  reported `chain-complete` on both sides of a registry swapping its library bytes, and the CLI was telling
+  people "a fully immutable code drop is lock-script + lock-dependencies + lock-field/lock-uri".
+
+  Every unqualified verdict is now qualified rather than deleted, because locking a pointer _is_ part of the
+  story: `lock-uri`, `lock-script` and `lock-dependencies` narration, their `--help` entries, `abx verify`'s
+  chain-complete pass (which now says the flag describes **where** bytes come from, not that they're frozen),
+  `GeneratorStatus.chainComplete`'s doc comment, the `lockScript` SDK docs, `protocol/metadata`,
+  `protocol/params`, `protocol/code-projects`, `reference/cli`, the operate guide, `specs/protocol/*`, and the
+  skill's SKILL.md · `reference/decisions.md` · `reference/code-projects.md` · `reference/operating.md`. The
+  line the toolkit now gives a creator is **"your metadata is locked"**, with the stronger claim reserved for
+  a project whose graph is on-chain `0x…` deps plus locked fields. Stated once per place the decision is made,
+  not restated everywhere.
+
+  Framed as a capability as well as a caveat: a token that _deliberately_ live-adapts to on-chain conditions
+  is a legitimate and interesting thing to build, and it's the same mechanism that makes it possible.
+
+  **New page: [What a project owner can do](https://abx.docs.artblocks.io/protocol/owner-powers/).** There was
+  nowhere a collector could read what powers the creator retains. It states both halves plainly, with the read
+  for each. What an owner **can** do: re-point or suspend an enrolled 721C/1155C transfer validator (and block
+  transfers entirely with one that reverts — though if they renounce ownership, anyone may suspend it and
+  nobody can re-arm it); change price, payee, allocation and pause on a live sale with no timelock; keep
+  receiving primary-sale proceeds after selling the project, because `primaryPayee` doesn't move on
+  `transferOwnership`; mint reserves outside the minter's allocation, since assigning a minter grants the whole
+  remaining cap rather than a slice; change royalty receiver and bps forever; re-point metadata subject to the
+  locks above; swap the seed source; reassign a token's seed _iff_ a `seed` schema was declared before the
+  collection's first seed existed; and walk away. What they provably **cannot** do: take a buyer's funds beyond
+  the terms that buyer signed for (`purchase`/`purchaseTo` require `expectedPaymentToken` and a maximum, and
+  revert `SaleTermsChanged`); exceed a supply or per-id edition cap; rewrite or clear a settled seed; reach
+  another project through any shared singleton (the renderer and chunk store hold no storage, the generator's
+  wiring is `immutable` with no setters, the seed source is a stateless view namespaced by caller, and the
+  minters key everything per token and hold no funds); or take a token out of a collector's wallet — there is no
+  owner-only transfer, burn, or clawback anywhere in the protocol.
+
+  Framing, deliberately: ABX is self-serve, the creator is a privileged role, the protocol's job is to keep
+  that role away from a collector's funds and tokens, and the residual powers are disclosed so a collector can
+  price them. Not an accusation — a creator who destroys their own collection has destroyed what they were paid
+  for. The point is that "trust me" should be optional.
+
+- 1b6b741: Gate on-chain content by what a node will READ, not by what it costs to write
+
+  The documented on-chain envelope — ≲24 KB/file, ≲256 KB/project — was a _storage-cost_ figure sold as a
+  support envelope, and the CLI's only loud warning fired on the project total. Measurement says the
+  binding constraint is somewhere else entirely: **`tokenURI` reassembles the whole document on every
+  call**, and that cost is **superlinear** — EVM memory expansion is quadratic, so the per-KB rate climbs
+  with size. Across the 10–100 KB range that decides most projects it measures **~360,000–405,000 gas per
+  KB**, rising to ~460,000/KB at 187 KB and ~510,000/KB at 256 KB. `inline` and `reader` land within ~1% of
+  each other up to 75 KB (the cost is the renderer's string building, not the storage mechanism) and
+  diverge above it (~5% at 187 KB, ~10% at 256 KB, as the chunk store's quadratic read loop takes over), so
+  `--compress fastlz` makes a field cheaper to write and not one gas cheaper to read.
+
+  Measured with `forge` (`OneOfOneImage` + `AbxMetadataRenderer`, callee execution gas for one `tokenURI`
+  call, `reader` staging at 22,000-byte chunks):
+
+  | on-chain content | `tokenURI` gas | per KB  |     | on-chain content | `tokenURI` gas | per KB  |
+  | ---------------- | -------------- | ------- | --- | ---------------- | -------------- | ------- |
+  | 3 KB             | 1,123,327      | 374,000 |     | 100 KB           | 40,254,159     | 403,000 |
+  | 10 KB            | 3,588,993      | 359,000 |     | 128 KB           | 53,559,735     | 418,000 |
+  | 23 KB            | 8,346,220      | 363,000 |     | 187 KB           | 86,021,071     | 460,000 |
+  | 40 KB            | 14,740,366     | 369,000 |     | 256 KB           | 131,269,134    | 513,000 |
+  | 50 KB            | 18,759,333     | 375,000 |     |                  |                |         |
+  | 75 KB            | 29,137,215     | 388,000 |     |                  |                |         |
+  | 90 KB            | 35,868,124     | 399,000 |     |                  |                |         |
+
+  geth's `--rpc.gascap` defaults to 50M, hosted providers commonly cap lower, and L1 block limits sit in
+  the mid-30-millions — so a project at the _documented_ ceiling could not be read by a normal node, and
+  from ~90 KB (~36M gas) up no contract can read it inside a transaction at all. Note what the 100 KB
+  refusal is: a **margin**, not the wall. 100 KB reads at ~40M, and geth's own 50M default is not
+  exhausted until ~120 KB; the refusal sits early because hosted providers cap well below geth.
+
+  The gate now sits on that axis, per token (each `tokenURI` assembles only its own content, so a
+  300-piece collection of 5 KB works is fine while one 256 KB work is not):
+
+  - **from ~40 KB — warn.** Reads need a deliberately high-gas RPC.
+  - **past ~100 KB — refuse**, with `--allow-unreadable-onchain` as the override. The refusal names the
+    three ways forward and says plainly what the override accepts: rendering needs a high-gas endpoint and
+    most marketplaces and indexers will show nothing. It fires on the **dry run** too, so a creator meets it
+    before spending gas rather than after the first staging transaction.
+
+  Live on every path that puts bytes on-chain: `deploy --onchain-image`, `deploy-series --onchain-image`,
+  both `--copies` edition twins, and `set-field --file`. New in the SDK: `classifyOnchainReadSize`,
+  `tokenUriGasEstimate` (fitted to the measurements, so it tracks the superlinearity instead of
+  multiplying by a flat rate), `TOKEN_URI_GAS_PER_KB_LOW` / `TOKEN_URI_GAS_PER_KB_HIGH` (the measured
+  10–100 KB envelope — there is deliberately no single flat `TOKEN_URI_GAS_PER_KB`, because there is no
+  single rate), `ONCHAIN_READ_WARN_BYTES`, `ONCHAIN_READ_REFUSE_BYTES`, `ONCHAIN_READ_GETH_CAP_BYTES`
+  (where geth's 50M default actually runs out, so the refusal can be described as the margin it is)
+  (`exceedsOnchainSoftLimit` stays, now documented as the _write_-cost predicate it always was). The
+  whole-collection 256 KB warning stays as well, relabelled as write cost only, since it never said
+  anything about readability.
+
+  Two things deliberately not done. **No on-chain guard and no gas check** — a read happens off-chain, a
+  read too large for one node is an RPC-capability problem, and bricking a contract is worse than needing a
+  capable endpoint. And the **code lane still only warns**, at the same 40 KB threshold and now quoting the
+  gas figure: `abx inspect`'s document size is an estimate that undercounts unknown dependencies, and a
+  registry-hosted library like p5 is legitimately ~200 KB, so the honest move there is to name the cost and
+  point at the generator's piecewise getters (`document`, `tokenDataJson`, `dependencyTag`, `abxJs`,
+  `gunzipScript`, `registryScriptChunk`) rather than block a shipped lane on a heuristic. Those getters are
+  now in the SDK's generator ABI, which claimed to carry "the piecewise reads" while omitting three of them.
+
+  The docs and the `abx-self-host` skill were swept in the same pass: `protocol/onchain-storage` carries the
+  measured table and the corrected envelope, `protocol/code-projects` gains a piecewise-read section, and
+  the skill's Quick start and `reference/decisions.md` lead with "40 KB is the number, not 256 KB" plus the
+  rule that the override is a creator's deliberate choice and never a way to clear a warning.
+
+- 1b6b741: Round-3 audit remediation: link the two ERC-1155 image anchors, and stop guarding by name
+
+  `EditionImage` and `OneOfOneEdition` became library-linked in the previous round, but neither the
+  SDK nor the forge scripts were updated. `predictEditionFactory()` and
+  `predictOneOfOneEditionFactory()` hashed **unlinked** bytecode — and viem does not reject a
+  `__$…$__` placeholder, it UTF-8-encodes it, so both returned a confident hash of ASCII garbage for
+  a trust anchor, and `ops.ts` would have broadcast that bytecode as initcode. Both now link
+  `AbxEditionLib` (itself linked against `AbxParamsLib`) and ensure the libraries exist first.
+
+  Two addresses move as a result: `EditionImageFactory` and `OneOfOneEditionFactory`. Both are
+  pre-launch and pending the redeploy gate.
+
+  This was the third instance of one bug class, and the existing guard missed it because it checked
+  two factories **by name**. The replacement is exhaustive by construction: it reverse-looks-up which
+  initcode each `predict*` actually hashed, drives every `prepareDeploy*` and every `deploy*`
+  orchestrator against a stub chain, and asserts no `__$` placeholder survives anywhere — so the next
+  library-linked contract is covered without anyone remembering to add it.
+
+  Also: every SDK deploy now goes through CREATE2 at a canonical salt (the 1/1 and Series anchors were
+  still plain `CREATE`, landing at nonce-dependent addresses that could never match the manifest), and
+  the CLI no longer tells creators an ERC-1155 edition emits no ERC-4906 — both lanes emit it now.
+
+- 1b6b741: The param transfer hook is a veto, not best-effort — say so everywhere, and ship the lock that answers it
+
+  The transfer hook used to swallow its own revert, and every surface promised that the parameter
+  lifecycle "must never block a transfer". That promise could not be kept, so it is withdrawn rather than
+  restated: Solady runs the ERC-721/1155 **receiver acceptance check after the hook**, so on the `safe*`
+  variants — which marketplace fills wrap — a hook that is cheap when a wallet estimates gas and expensive
+  when the transfer lands starves the work that comes after it, with or without a gas cap. Swallowing
+  bought a guarantee that was false in exactly the cases people use, while making an honest hook's failure
+  invisible.
+
+  So the contract now calls the hook plainly (no swallow, no gas budget, no assembly), **its revert fails
+  the transfer**, and — because a mint and a burn are transfers from/to `0x0` — a reverting hook also stops
+  minting for that project, including through the shared minter. That is deliberate: a hook is always the
+  creator's own contract, which is why it may block issuance while the transfer _validator_, usually a
+  third party's, never sees mint or burn.
+
+  The mitigation is a lock, and it is now reachable end to end:
+
+  - **SDK** — `prepareLockParamHooks({contract, chainId})`, the sibling of `prepareLockScript` /
+    `prepareLockDependencies`. Plus two reads: `readParamHooks` (the trio) and `readParamHooksLocked`,
+    which establishes the freeze without a getter by simulating `setParamHooks` with the current trio and
+    watching for `ParamHooksLocked` — and returns `undefined`, never a cheerful `false`, when a node won't
+    answer.
+  - **CLI** — `abx lock-param-hooks <address>`. Owner-only, one-way, every signing lane, `--dry-run`
+    guarded. It prints the exact three addresses it will freeze, states what is given up (arming a
+    transfer veto, arming a configure veto, re-pointing or clearing the augment hook) and that there is no
+    way back, and distinguishes the two cases: freezing an **empty** set is how a project _proves_ it can
+    never arm a transfer veto, while freezing a set that already contains a hook pins which contracts can
+    run — it does not disarm them.
+  - **`abx state`** now prints the three hooks and whether they are frozen, next to the transfer validator,
+    because that pair is the read a buyer performs. `abx verify` warns on an armed-but-unfrozen transfer
+    hook. `abx set-param-hooks` states the veto at the moment a transfer hook is armed.
+  - **Reconstruction** — `ParamHooksFrozen` folds into `ProjectState.paramHooks.locked`. The event is
+    declared only by `AbxParamsLib`, so `spineEventAbi` now unions that ABI (its other events dedup away):
+    without it the one-way lock on a hook that can veto a transfer was invisible to every consumer that
+    folds the spine.
+
+  Swept for the withdrawn promise: `protocol/params` (which gained a section on why it died),
+  `protocol/owner-powers` (the hook is now on **both** lists — an unlocked hook set as a live power, a
+  frozen one as a guarantee), `specs/protocol/event-spine`, `specs/protocol/user-stories`, the spine event
+  doc strings, and the `abx-self-host` skill (`SKILL.md`'s lock bullet plus the operating and code-project
+  references). No surface still says "best-effort", "reverts are swallowed", or "never blocks a transfer",
+  and a CLI test now fails if one comes back.
+
+- 1b6b741: Transfer validator: preflight what the chain actually refuses, and stop calling `setTransferValidator` owner-only
+
+  Two corrections, both in the direction that was costing someone something.
+
+  **The preflight was a bare `getCode`, and the chain's check is not.** `validateTransfer` returns nothing,
+  so there is no ABI decode to fail — which means any address whose fallback succeeds for an unknown
+  selector passes a has-code check and then waves **every** transfer through, while ERC-165,
+  `getTransferValidator()` and the extension beacon all report enforcement as ON. A Safe does exactly this
+  (`FallbackManager.fallback()` returns empty when no handler is set), as do an uninitialised proxy and a
+  7702-delegated EOA, and a creator pasting their own Safe is the likely real case. The contract's guard was
+  rewritten to probe with a selector no validator implements and require it to **fail**; the toolkit now
+  asks the same question, with the same selector, through the new SDK `probeTransferValidator` (verdicts:
+  `ok` · `no-code` · `permissive-fallback` · `unreachable`). Both call sites use it — `abx
+set-transfer-validator` and `deploy --721c` — so a creator gets a refusal that names what is actually
+  wrong instead of passing the CLI and reverting on chain against an error whose documented meaning ("no
+  code on this chain") was false for their address.
+
+  **`setTransferValidator` is owner-only only while there is an owner.** Once `owner() == address(0)`
+  **anyone** may suspend enforcement by passing `address(0)`, and nobody may ever arm a validator again —
+  the dead-man release for a validator that reverts every transfer on a collection with nobody left to
+  re-point it, which would otherwise strand every collector's token permanently. Four surfaces still said
+  owner-only, and the SDK's was wrong in the direction that matters: an integrator reading it would refuse
+  to build the suspension a stranded holder needs. Corrected in `creator-token.ts` (module header plus
+  `prepareSetTransferValidator`), `protocol/royalty-enforcement`, `protocol/interfaces`, and
+  `specs/protocol/interfaces`, each stating the asymmetry: an ownerless collection can only ever be moved
+  _toward_ transferability, so this hands a stranger no power over a live project.
+
+## 0.1.0-alpha.13
+
+### Patch Changes
+
+- 528c6c6: ERC-1155 editions: the trust-anchor and on-chain-URI checks told the truth about 721s only, and four
+  membrane gaps around them (2026-08-05 wave-4 agent sweep — 12 cold agents, one funded end-to-end run
+  on Base Sepolia).
+
+  The 1155 contracts themselves were fine: a funded run took an edition from deploy through
+  `tokenuri` → mint more copies → transfer one copy → lower the per-id cap, verifying every step
+  against the chain. What shipped wrong was everything that _describes_ an edition.
+
+  - **`abx verify` reported EVERY canonical edition as `canonical: NO`.** `detectCanonicalFactory`
+    probed only the three 721 anchors and, on no match, fell back to the 721 1/1 factory — whose
+    `isAbxClone` answers **false**, not "unknown". So the one signal platforms allowlist against was
+    confidently inverted for the entire edition line (the function's own docstring promised
+    "canonicity just shows unverified, never wrong"). All six anchors are now probed. **Editions
+    registered before this fix keep the wrong factory in the local projection** — `abx forget <addr>`
+    then `abx add <addr>` re-detects it.
+  - **`abx verify`'s on-chain-URI probe called the ERC-721 `tokenURI` selector on editions**, which
+    exposes `uri(id)`. It reverted for every edition, so verify could never confirm that a
+    fully-on-chain edition resolves — and it printed the raw multi-line viem dump (Contract Call /
+    args / Docs / Version) into a creator-facing readout. The probe now switches on `contractType`
+    (matching `reconstruct.ts`, which already did), reports which accessor it read so an edition is
+    never described in 721 terms, and readout errors are trimmed to their first line.
+  - **An address with no contract was reported as a specific type: `OneOfOneImage`.**
+    `detectTokenKind`'s three probes are each `try/catch → false`, so nothing-deployed and
+    no-extensions-composed were indistinguishable and the ladder fell through to its `1of1` default.
+    `abx set-max-supply` and `abx minter buy` then told edition owners _"…is a OneOfOneImage (721) —
+    drop your edition flags"_ for a mistyped address or, far more often, the wrong `ABX_CHAIN` (the
+    default is base-sepolia, so any Sepolia contract hit this immediately) — advice that removes the
+    _correct_ flags. The existence check now lives inside `detectTokenKind`, so all 13 call sites
+    inherit it; it fails **open** on an unreadable `getCode`, so an RPC blip never becomes a
+    "no contract" claim.
+  - **`abx transfer --token-id <n>` silently transferred id 0.** `transfer` spells the id `--token`
+    while every sibling command (`mint`, `set-max-supply`, `minter …`) spells it `--token-id`, and an
+    unrecognized flag was simply ignored — so an agent that learned the name from `mint` moved the
+    **wrong artwork** with no warning. `--token-id` is now an accepted alias; disagreeing values are
+    refused rather than silently preferring one.
+  - **The edition deploy previews dropped lines their 721 twins print.** All three edition lanes
+    omitted `approvals N wallet approval(s)` from the dry-run readout — which the skill promises "every
+    preview" prints and tells the agent to state up front, so on an edition the agent had nothing to
+    tell the creator about how many wallet prompts were coming (`deploy-code --copies` had it only in
+    the `--confirm` sentence, which is off by default). `deploy --copies` and `deploy-series --copies`
+    also omitted the "resolves ON-CHAIN via the renderer — no resolver, no server" line, which is
+    precisely the guarantee an edition creator is asking about, and `deploy-series --copies` never
+    showed `paused`. All six lanes now print the approval count; the 1155 paths say `uri()`.
+  - **Owner-op writes now surface a stray flag instead of swallowing it.** `mint`, `transfer`,
+    `set-max-supply`, and `minter configure|show|buy` warn on an unrecognized flag (warn, not refuse —
+    per `unknownFlags`' contract, a false warning must never break a script). These are the commands
+    where the 1155 semantics live in _optional_ flags that default rather than fail: a typo'd
+    `--amount 50` minted 1 copy and a typo'd `--quantity 5` bought 1 and paid 1×, both in total
+    silence. The broader gap — ~35 commands with no unknown-flag notice at all — is filed as B30.
+
+  A second verification sweep (six more cold agents, one funded) confirmed each fix above from a fresh
+  start and turned up four more, all fixed here:
+
+  - **A supply cap could be raised in `--dry-run` and only revert on send.** Both twins —
+    `set-max-invocations` (721) and `set-max-supply` (1155) — printed the new cap as fact for a value
+    the chain forbids, then reverted for real. A clean dry run is read as permission to send. Both now
+    read the current cap first and refuse up front; the 1155 side also refuses a cap **below** live
+    supply (the second way it reverted). Both guards fail **open** on an unreadable getter, since the
+    chain enforces the invariant anyway. (The 721 guard needed the Series ABI — reading `maxInvocations`
+    through the 1/1 ABI that `read()` uses throws, which would have made the guard silently never fire.)
+  - **`abx refresh` told edition owners ERC-4906 had already pinged marketplaces.** An ERC-1155 edition
+    emits no ERC-4906 at all — that is precisely why `ping-uri` exists — so the one sentence a creator
+    reads after editing metadata said "already handled" when nothing had been, and `ping-uri --help`
+    said the opposite. Two commands contradicting each other on the new lane. `refresh` is now
+    kind-aware and names `ping-uri` for editions.
+  - **`abx verify` ended in two ⚠ on a perfectly healthy fully-on-chain image drop** — "generator
+    reports NO code" and "no animation_url" — because the code-project lane runs whenever a tokenURI
+    renderer is set, which is true for every on-chain project, image or code. A static image has no
+    program and no `animation_url` by design. Three separate agents named this as the worst thing about
+    `verify`, and one said plainly it would make a creator distrust future real warnings. The code-lane
+    checks are now scoped to the code twins; a static drop gets one informational line instead. (This
+    was pre-existing on the 721 path too, not an editions regression.)
+  - **`EditionImage`'s SVG-only refusal was a thinner copy of its 721 twin's** — the Series version names
+    three routes (`--onchain-image`, `--backend ipfs|arweave`, or host off-chain); the edition version
+    said only "drop `--onchain-uri`". A cold agent asked for "3 artworks × 25 copies each" read that,
+    concluded there was no no-server option for one contract, and **fanned the collection out into three
+    separate single-artwork contracts**. The refusal now states the real options for the lane and says
+    explicitly that the off-chain-image-URL-in-on-chain-JSON route exists only per-artwork via
+    `abx deploy --copies` — one contract per artwork, not one collection. The underlying capability gap
+    is recorded in B28.
+
+  One knock-on from the first fix: the `false` branch of the canonical readout said _"not a clone of the
+  **configured** factory"_ (singular), which now understates the check and misdirects the reader — six
+  anchors are probed, so a `false` means no trust anchor the CLI knows deployed this contract, and the
+  usual real cause is a **superseded** factory or a hand-deployed contract, not a misconfiguration. It
+  now says so, and points at `abx doctor` for the current anchors.
+
+  Also: `deploy --help` no longer calls the edition sale stack (`--minter`/`--primary-payee`/
+  `--unpaused`) "required" — it is optional, and an agent handed a creator hardcoded addresses as
+  mandatory because of it; `set-field --help` now lists all eleven `--representation` values (it showed
+  seven, omitting `url-template`, `renderer`, `sha256`, `inline-gzip`); and `abx doctor`'s label column
+  widened so `edition factory` no longer runs into its address.
+
+  The skill-drift ✗ now names **which** copy is stale and prescribes the command that actually clears
+  it — `abx skill install` writes the project-local copy only, so a stale **global** copy produced a ✗
+  whose own remedy could not fix it. Six agents hit it in one sweep; several re-ran the install
+  repeatedly and one left its sandbox to read `~/.claude/skills` to work out what the tool meant.
+
+## 0.1.0-alpha.12
+
+### Minor Changes
+
+- afa9dd4: ERC-1155 editions ship with full parity: a Series is many unique tokens (721); an **Edition** is
+  many copies of a token (1155). The creator's word is **copies** — `abx deploy img.png --copies 100`
+  (a single-artwork edition, `open` = uncapped), `abx deploy-series ./art --copies 50` (each image an
+  edition), `abx deploy-code sketch.js --copies 25` (code editions). Without `--copies`, the 721
+  lanes are unchanged.
+
+  Three new canonical contracts twin the 721 lineup — `OneOfOneEdition`, `EditionImage`,
+  `EditionCode` — plus `AbxFixedPriceMinter1155`, a per-id fixed-price sale singleton
+  (`minter configure/buy --token-id [--quantity]`). New owner ops: `mint --token-id --amount`,
+  `transfer --amount`, `set-max-supply` (per-id cap, only ever decreases), `ping-uri` (re-emit the
+  native `URI` event after a re-point). ERC-1155C creator-token enforcement is the same `--721c`
+  opt-in (same validator registry and ERC-165 ids as 721C). Editions announce one new extension
+  (`abx.extension.edition-supply`, per-id supply/cap); everything else — metadata fields, params,
+  royalties, renderer, storage, effects — is the same protocol surface on both standards.
+
+  **Integrator surface (audience line):** additive only. `ProjectState.contractType` gains
+  `'1of1-edition' | 'edition' | 'edition-code'`; `TokenState` gains `supply`/`maxSupply`/`holders`
+  (editions only; `minted` means supply > 0 there); the spine ABI now decodes
+  `TransferSingle`/`TransferBatch`/`URI`/`MaxSupplyUpdated`; `ChainDeployment` gains the four
+  edition anchors (recorded for Sepolia + Base Sepolia, CREATE2-identical); token-api summaries gain
+  an optional `copies` field. No existing export, route, column, or event shape changed.
+
+- 8c254d5: The self-host projection no longer stores or pre-fetches composed URI documents, and the event log
+  is append-only (from the abx-services 2026-08-05 projection memo, `docs/11`).
+
+  - **`contractURI`/`tokenURI` are live reads, never projected.** `reconstructProject`/
+    `reconstructIncremental` gain `readUriDocuments` (default **false**) — with it off, the whole
+    `contractURI`/`tokenURI` head-read batch is skipped entirely, not fetched-and-discarded. These
+    fields have no settled value (a renderer can change the composed document with no log at all) and,
+    on the on-chain lane, can run hundreds of KB per token — a real 32-token project measured 13.4 MB
+    serialized, 99.8% of it `tokenURI`. A stale-but-rendering `data:` URI is worse than a missing one,
+    because nothing about it looks wrong. `abx demo` is the one caller that passes `readUriDocuments:
+true`, for its read-back teaching step; `abx deploy`/`deploy-series`/`deploy-code` don't, and
+    `abx verify`/`tokenuri`/`contracturi` were already doing independent live reads. **For
+    integrators:** `ProjectState.contractURI` / `TokenState.tokenURI` are now `null` unless you opt in
+    — including in a self-host node's `/api/project/:addr` responses (shape unchanged, values now
+    null). Nothing that composes served metadata reads either field (the settled `fields`/
+    `collectionFields` do); the settled scalars — `tokenURIRenderer`/`tokenURILocked`/
+    `contractURIRenderer`/`contractURILocked` — are unaffected and still projected.
+  - **The events table is append-only.** `seq` is now chain-derived (`(blockNumber << 32) |
+logIndex`, BigInt-safe) instead of the array index at write time, so it's stable across re-folds —
+    a re-index appends via `ON CONFLICT DO NOTHING` instead of deleting and reinserting the whole
+    history on every delta. `putProject` upserts the project and token rows in place (a token whose id
+    vanishes from state is still removed) rather than delete-and-reinsert. `deregister` still deletes
+    a forgotten project's events in full; a routine re-fold does not. **A full replay (`abx index
+--full`) purges the project's event log before rebuilding it** — append-only must not let a
+    reorg-replaced event survive as a stale row, so the documented repair path stays a real repair.
+    Existing stores migrate their positional `seq` values to the chain-derived form once, automatically
+    (`PRAGMA user_version`-gated, transactional).
+  - **Self-healing eventCount guard.** An incremental fold that would reduce `eventCount` below what's
+    already stored is discarded rather than written, with one automatic full-reconstruct fallback (the
+    memo's own war story: a bad fold once silently zeroed a live projection with nothing to catch it).
+  - **New self-host stores open with `auto_vacuum = INCREMENTAL`.** Existing stores are unaffected
+    (the pragma only takes on a database with no tables yet) — recorded as backlog B29.
+
+## 0.1.0-alpha.11
+
+### Minor Changes
+
+- d40caf4: Requested by an integrator (abx-services) — the conformance surface now lives in the neutral
+  layer. Five pieces that only token-api or storage exposed before, and that any third-party
+  resolver needs to reproduce the reference behavior byte-for-byte, move into `@artblocks/abx-sdk`:
+
+  - **The generator-document family** (`ABX_JS`, `escapeInlineScript`/`escapeInlineJson`,
+    `buildGeneratorDocument`, `injectTokenDataIntoHtml` — new `src/generator-document.ts`): pure
+    string operations with no resolver-specific behavior, so the SDK, `abx preview`, and any
+    third-party provider now share one definition instead of the CLI importing token-api just for
+    this.
+  - **The registry-dependency family** (`DEPENDENCY_REGISTRY_ABI`, `activeRegistry`,
+    `resolveRegistryDep`, `registryDepUrl`, `dependencyScriptTags`, `URL_BUDGET_BYTES`), merged into
+    the SDK's existing `deps.ts` alongside its registry-pointer logic. `node:zlib` can't come along
+    — SDK core has to stay reachable from a browser bundle — so decompression is now an INJECTED
+    `inflate?: (bytes: Uint8Array) => Uint8Array` threaded through `resolveRegistryDep`/
+    `dependencyScriptTags`; omitting it when a resolved dep actually needs decompressing throws a
+    new typed `InflateRequiredError` naming the fix, rather than crashing opaquely or silently
+    degrading. `@artblocks/abx-sdk/node` gains `nodeInflate` (a one-line `gunzipSync` wrapper) so a
+    Node host wires it in one line; a browser host passes a `DecompressionStream`-based
+    implementation instead. (Merge note: the prior `dependencyRegistryReadAbi` and token-api's
+    `DEPENDENCY_REGISTRY_ABI` declared the identical `getDependencyDetails` entry twice — deduped
+    into one array that also carries `getDependencyScript`.)
+  - **`contentTypeFromPath`** (new `src/mime.ts`): the MIME extension-map lookup, verbatim.
+  - **Gateway resolution, split pure/env** (new `src/gateways.ts`): `resolveGatewayBase` is now PURE
+    (no env read — takes resolved `{ipfs?, arweave?}` overrides) and `gatewayUrlFor` moves alongside
+    it; `gatewayConfigFromEnv()` is the one place that reads `ABX_IPFS_GATEWAY`/
+    `ABX_ARWEAVE_GATEWAY`, kept separate so a host with its own gateway config never has to touch
+    `process.env` through this module at all.
+  - **`exponentialBackoffDelay(attempt, baseMs, capMs)`** (`util.ts`): `min(baseMs * 2^(attempt-1),
+capMs)`, 1-indexed like the existing `linearBackoffDelay`. Prefer it for a sustained rate limit
+    or an overloaded upstream; `linearBackoffDelay` stays right for a one-off transient failure.
+    `service.ts`'s own retry ladder is unchanged (still linear — its rationale comment stands).
+
+  Token-api and storage keep every existing export working, re-exported from the SDK where the
+  implementation moved — no removals, and token-api's own `nodeInflate`-pre-wired wrappers mean its
+  internal call sites (`code.ts`'s document assembly, `deps.ts`'s `depStatusReport`) needed no
+  signature changes at all. The browser-bundle test (`packages/sdk/test/browser-bundle.test.ts`)
+  stays green with all of this now exported from the core index — proof that the injected-`inflate`
+  design actually keeps `node:zlib` out of the bundle.
+
+### Patch Changes
+
+- d40caf4: Drop-in for every consumer of `reconstructProject` / `applyHeadReads`; no signature changed.
+
+  **Fix `multicallChunked`'s per-leg retry so it actually recovers on a chain with no multicall3
+  deployment, not just on an over-budget aggregate.** When the aggregate `client.multicall` throws,
+  the retry re-asked each leg one at a time — but through the _same_ `client.multicall` call. That
+  recovers a batch that failed for being too big (retrying smaller aggregates works fine), but not one
+  that failed because this chain has no multicall3 contract at all: every multicall, at any width,
+  fails identically, so the retry reproduced the exact same failure and the caller got all-null,
+  indistinguishable from "the contract answered nothing." `reconstructProject`'s head-read
+  (`applyHeadReads`) runs every identity field — `name`, `symbol`, `owner`, the URI-lane renderer/lock
+  flags, `contractURI`, every `tokenURI` — through this helper, so on any chain lacking multicall3 a
+  reconstruct silently blanked those fields instead of reading them.
+
+  The per-leg fallback now goes through `client.readContract` instead, which has no multicall3
+  dependency, and is also used for a chunk that lands at width 1 on its own (e.g. the last chunk of an
+  odd-length list) — previously that lone leg never retried at all. `readContract` throws on revert
+  where multicall's `allowFailure` returns a `status: 'failure'` result instead; the fallback catches
+  that per leg and maps it back to `null`, so a genuine revert still reads as "no answer," matching the
+  aggregate's own contract. The over-budget recovery path is unchanged in outcome, only in which call
+  answers the retry.
+
+## 0.1.0-alpha.10
+
+### Minor Changes
+
+- 11fa933: The extraction phase of the simplification refactor: business logic that lived only inside the CLI
+  is now importable — the CLI calls the same functions you can.
+
+  **Into the SDK:** the five trust-anchor bootstraps (`ensureFactory`, `ensureSeriesFactory`,
+  `ensureSeriesCodeFactory`, `ensureRenderer`, `ensureSeedSource` — `anchors.ts`, on the same
+  injected-`send` + `onEvent` pattern as `ensureChunkStore`, with a typed `AnchorUnavailableError`),
+  `detectCanonicalFactory`/`resolveScanFloor`, the on-chain-URI setup composer (`onchain-uri.ts`),
+  interrupted-deploy resume planning (`resume.ts`), migration plan/parity reconciliation
+  (`migrate.ts`), the `abx.js` static analyzer (`inspect.ts`), dependency setup legs (`deps.ts`),
+  content-staging plans (`staging.ts` — `planStagedContent`, `stageFieldContent` with `StagingEvent`),
+  `mintedTokenIds`, and a typed `readSaleConfig` for the fixed-price minter.
+
+  **Into storage:** `uploadAndLocate`, `repinNodeCustody` (the byte-custody half of migration),
+  `decideImageContentLane`, `assessStorageReadiness`/`assessTurboFunds` (the Arweave/Turbo funding
+  math), and `awaitLocatorReady` (poll a locator until it serves).
+
+  **CLI hardening that fell out of the dedup:** one risk gate (`gatedSend`) now guards every write —
+  `--dry-run` and `--confirm` mean the same thing on every command, all owner-ops gain `--confirm`,
+  and a write reaching the send lane under `--dry-run` is structurally impossible (grep-enforced by
+  test). One `CHAIN` source of truth; one memoized local-indexer accessor.
+
+- 11fa933: Phase 1 of the simplification refactor: one transaction shape with one send-injection point, and an SDK that never touches `.env` or a Node-only global on its own. Two related passes, same release.
+
+  **One transaction shape, one executor.** `StagingTx`/`SendStagingTx` are gone — everything is a `PreparedTx` sent through a single `SendTx`. New `execute.ts` carries `makeHotSender` (pins the nonce once, detects an under-estimated gas limit against a just-deployed target, throws a typed `TxRevertedError` instead of reporting a reverted tx as confirmed) plus `pinGas`/`waitForCodeAt`, moved from the CLI (`gas.ts` is gone) with their design comments intact. Every `deployX` is now `prepareDeployX` (pure) + `deployX(send, ...)`; the CLI's hot lane and `abx deploy-code --resume` both delegate to the same sender instead of hand-rolling their own nonce/gas loop — the class of bug that reported a burned, reverted transaction as a successful deploy can't recur in a second call site because there is no longer a second implementation.
+
+  **The SDK never loads `.env` implicitly.** `loadDotEnv`/`parseEnvContent` moved to a new `@artblocks/abx-sdk/node` subpath — the only module that touches `node:fs`/`node:path`. The package's main entry is now browser-bundle-safe (a permanent esbuild smoke test guards it); a host calls `loadDotEnv()` once at startup (the CLI's `main()`, the effects runner's `main()`) and the SDK core reads whatever's already in `process.env` through a tiny `readEnv` that no-ops outside Node. `ClientOptions` gained `rpcUrls?: string[]` and `makeWalletClient`/`envSigningKey` gained a `privateKey`/`override` escape — explicit config now wins outright over env resolution, following the same override → env → manifest precedence `deployments.ts` already used for contract addresses.
+
+  **Single signing-key name.** `ABX_DEPLOYER_PK` is the only env var the SDK reads for a hot key — `SEPOLIA_FUNDED_PK` and `SEPOLIA_WALLET_PK` (earlier-alpha names) are no longer consulted. A caller with one of the old names set now gets a `MissingSigningKeyError` that names the new one explicitly and says the old ones are retired, rather than a plain "no key found" that leaves an upgrader hunting for why a key that's clearly _there_ isn't being read. Sandbox/e2e scripts and test fixtures move to the new name too.
+
+  **Shared, environment-neutral utilities.** New `sdk/src/util.ts`: `sleep`, a `linearBackoffDelay` helper (service.ts's retry ladder and the effects runner's resolver poll both use it now instead of hand-rolled backoff math), `parseDataUri` (replaces three near-identical `data:` URI regexes across the CLI and the tokenURI probe with one permissive parser), and `tryReadContract` (replaces three near-identical try/read-return-undefined helpers; the CLI's "no contract at this address" diagnostic still wraps it where that mattered). `Buffer` is gone from the SDK core (chunk hex-encoding and param base64-encoding now use viem's `bytesToHex` and a ~12-line dependency-free base64 codec) — nothing in the SDK's main import graph is Node-only any more.
+
+### Patch Changes
+
+- 11fa933: The remaining phases of the simplification refactor that hadn't yet gotten a changeset: the CLI's
+  internal module split, the token-api/effects/mint-page convergence on the SDK, the shipped skill's
+  rewrite for the simplified surface, and a new SDK README.
+
+  - **`abx`'s `main.ts` split into domain command modules** (`commands/{deploy,project,reads,service,
+scaffold,storage}.ts`, shared `output.ts`/`errors.ts`), with one exit-discipline rule
+    (`process.exitCode` + return, or a typed `CliError`, everywhere — bare `process.exit` only at the
+    entry guard, the top-level catch, and the keep-alive SIGINT handler). Purely internal: a 207-fixture
+    byte-diff matrix (every help text, dry-run, error path, and exit code) confirmed identical output
+    before and after.
+  - **token-api / effects / mint-page converge on the SDK**: `@artblocks/abx-storage` gains one
+    `resolveGatewayBase` (`readiness.ts`), replacing three near-identical copies (two in token-api, one
+    inline in storage itself); token-api exports `buildGeneratorDocument` so the CLI's `abx preview`
+    consumes the real generator-document assembler instead of a hand-kept duplicate; the effects runner
+    now resolves its config via the SDK's `readEnv` and gets a `makePublicClient` fallback transport, so
+    `ABX_RPC_URL` accepts a comma-separated failover list like every other RPC var; the scaffolded
+    mint-page app now imports ABIs from `@artblocks/abx-sdk/abi` and a browser-safe `makePublicClient` +
+    typed `readSaleConfig` instead of hand-rolled fetch/decode, and pins its generated `package.json` to
+    the SDK's _resolved_ version via a new `@artblocks/abx-sdk/package.json` export (alpha version
+    counters diverge per package under changesets, so pinning the CLI's own number could produce an
+    unsatisfiable range).
+  - **The shipped skill (`.claude/skills/abx-self-host/`) is rewritten for the surface phases 0–5
+    actually shipped**: every warning made obsolete by an enforcement is deleted rather than softened —
+    predict-only deploy-preview addresses, the `approvals N` line, the single `ABX_REMOTE_SELF_*`
+    credential grammar, `doctor`'s version/provenance ladder, `storage show --check`, the render/storage
+    combo validator's dry-run row, and `ABX_DEPLOYER_PK` as the only key name. Retired names swept from
+    `dev-loop-test`, the agent-eval scenarios, and spec prose. The skill ships bundled inside this CLI
+    package (co-versioned via `SKILL.md` frontmatter), so it rides this same patch.
+  - **New `packages/sdk/README.md`**: what the SDK is, the send-injection model (`PreparedTx` +
+    `SendTx`, `makeHotSender` for a hot key, bring-your-own for a wallet/multisig), a complete
+    deploy → upload → mint → read walkthrough against real exports, and browser-use notes (explicit
+    `rpcUrls`, no env, the `/node` subpath is Node-only). Included in the npm tarball automatically
+    (README is one of the files npm always packs, regardless of the `files` allowlist).
+
+## 0.1.0-alpha.9
+
+### Patch Changes
+
+- df298d8: Fix three ways the reference resolver misreported on-chain state — and the head-read bug underneath one of them
+
+  From an engineering audit by the abx-services team (2026-08-04), who run the same protocol on a
+  hosted node against real testers and so reach long-tail states a single-node run rarely does. All
+  three findings reproduced. Verifying the second one turned up a fourth defect that was its actual
+  cause, and that one is the most consequential of the set.
+
+  **1 · A renderer-computed TEXT field was dropped entirely.** `resolveImage` had an `R.renderer`
+  branch; `resolveText` did not. So a `renderer`-represented `description`, `external_url`,
+  `animation_url`, `background_color`, `youtube_url`, or `name` matched no branch and resolved **as if
+  unset** — silently replaced by the operator's off-chain value with provenance reporting `off-chain`,
+  or omitted from the metadata altogether. A creator who committed a computed field on-chain got the
+  operator's version served instead, and nothing errored anywhere.
+
+  `resolveText` now mirrors `AbxMetadataRenderer._appendText`'s `R_RENDERER` arm exactly, because the
+  two must agree: with `tokenURIRenderer` set the chain assembles this JSON and the resolver merely
+  re-serves it, so any difference is a resolver contradicting the token's own `tokenURI`. That means
+  the **declared** contentType is used verbatim (`renderer` is the one representation that types itself
+  on-chain) rather than an assumed `text/html`, and a `text/uri-list` result (RFC 2483 — the canonical
+  generator's directory branch) lands as the locator it is, never data-wrapped. This is a deliberate
+  divergence from the shape the audit recommended (pointing at the node's own `/data/{field}` route):
+  parity with the on-chain renderer is the stronger constraint here. A field renderer that reverts now
+  degrades that one field — with provenance saying the on-chain attempt failed, not a clean
+  `off-chain` — instead of being indistinguishable from an unset field.
+
+  **2 · The `name` fallback asserted an ERC-721 `name()` read it had not performed.** When
+  `state.name` is null the served value is the raw contract address, and the note still said
+  `on-chain (ERC-721 name() + #id)`. A hosted node served `"name": "0xb844…c35e56 #0"` beside that note
+  while the contract's `name()` was `"ABXdoku"`. The wrong name is cosmetic; provenance is the surface
+  you would point an artist at to audit their own metadata, so a false positive there costs more. The
+  note is now conditional, and deliberately does not adjudicate _why_ the value was empty — the
+  projection cannot tell an unnamed contract from a failed read, and guessing is how the original note
+  came to lie.
+
+  **3 · The live view answered "not a code project" for a code project that was merely mid-index.**
+  `/a/` collapsed every `resolveLiveView` null into one confident verdict about the **contract**, when
+  at least one is a statement about the **index**: `chunkCount` is a head read, so a template-mode
+  project whose chunks have not been folded in yet reads as zero. A tester got
+  `live · caught up · 127 events · 32 tokens` from the node and this 404, concluded the resolver did
+  not recognise the SeriesCode factory, and a `--full` re-index did not clear it — the confident
+  wording sent them looking in the wrong place. The route now consults `contractType` (folded from the
+  deployed extensions, so it knows before any code lands) and answers **503 + Retry-After** for "not
+  yet" versus 404 for "not ever". Both verdicts are answered before the chain client is touched, since
+  neither needs an RPC. The three-way decision is extracted as `liveViewAvailability(state)` so it has
+  a test seam at all.
+
+  **4 · The head-read multicall failed _whole_ on the flagship lane, and took identity, trust, and the
+  URI lane with it.** This was not in the audit — it is why finding 2 fires, found by reproducing it
+  instead of accepting "an RPC hiccup". `applyHeadReads` batched `name`, `symbol`, `owner`,
+  `contractURI`, `isAbxClone`, `implementation`, the four URI-config getters, and **one `tokenURI` per
+  token** into a single multicall. A multicall is one `eth_call`: on a fully-on-chain project
+  `tokenURI(id)` assembles the entire metadata document on-chain, so a handful of those legs exceeds a
+  public node's budget and _every_ leg in the aggregate reports failure — including legs that answer
+  fine alone.
+
+  Measured on Base Sepolia `0xB844F4D2137a8Ce785Cbc80D281A36DBD1c35E56` (32 tokens, chain-complete):
+  1 tokenURI leg → 5/5 succeeded; **4 legs → 0/8 succeeded**, while `name()` on its own returned
+  `"ABXdoku"`. Every resolver indexing that collection therefore believed it had no name, no symbol,
+  no `contractURI`, no canonical proof — and **no `tokenURIRenderer`, i.e. that it was not in the
+  on-chain-URI lane at all.** Deterministic for any sizable on-chain collection, not a hiccup.
+
+  Reads are now split by cost class: the cheap fixed-size ones that decide a project's identity and
+  lane go in a batch of their own and can never be collateral damage, while the unbounded ones
+  (`contractURI`, per-token `tokenURI`, script chunks) read in small chunks through a helper that
+  re-asks a failed chunk one leg at a time before believing it. After the fix, that same contract
+  reconstructs with its name, symbol, both URI renderers, and all 32 token URIs intact.
+
+  12 regression tests across the four, including the null-name case both surfaces missed because every
+  parity fixture on both sides hardcoded a non-null name.
+
+- df298d8: `abx tokens <address>` — every token's owner, seed, and params, from chain alone
+
+  The most obvious post-deploy question about a generative collection — _what did the seeds actually
+  deal?_ — had no command. `abx verify` reports per-token minted/render status but no seed; `abx
+tokenuri` prints one token and the seed lives inside its base64 `animation_url`; `abx inspect` is
+  pre-deploy and static. An agent's workaround was to start `abx serve`, `GET /api/project/<addr>`,
+  base64-decode each `tokenURI`, base64-decode the `animation_url` inside it, then regex
+  `0x[0-9a-f]{64}` out of the resulting HTML — 32 times. Every input to that was already a plain
+  contract read.
+
+  `abx tokens <address> [--json] [--from <id>] [--limit <n>]` is chain-only: no indexer projection, no
+  running resolver, no event scan. The params store maintains its own key lists inside its write paths
+  (`tokenParamKeys` / `contractParamKeys`) and `seed` is a reserved param read by name, so the whole
+  listing is `eth_call`s — available to anyone with an RPC URL, including before any indexing has
+  happened. Seeds print in full (truncating the one value the command exists for would repeat the
+  `tokenuri` bug); `--json` emits `{tokenId, owner, seed, params}` per token, contract-scope params
+  once on the parent rather than copied into every row.
+
+  It reports honestly across all three token types rather than failing: a 1/1 has no params extension
+  and says so (owners still list), a pre-enumeration project still yields seeds and flags that params
+  can't be enumerated, and an id whose `ownerOf` reverts is `null` — not "not minted", because a
+  burned id and an unminted id revert identically and a chain-only read can't tell them apart.
+
+  Two things it deliberately is not. It is not a trait spread: a trait comes from running the script
+  against the seed, which is `abx render`'s job — the token-scope _param_ spread it does print is
+  labelled as such. And the reader is in the **SDK** (`listTokens`), not just the CLI, so a
+  programmatic integrator gets it without reimplementing it.
+
+  Backlog B25 (from the 2026-08-04 tester batch, feedback `dcfdc6f4`).
+
+## 0.1.0-alpha.8
+
+### Minor Changes
+
+- e325b46: Opt-in ERC-721C support across the toolkit — plain ERC-721 stays the transparent default.
+
+  SDK: `OneOfOneInitParams`/`SeriesInitParams` (and `SeriesCodeInitParams` by inheritance) gain
+  `transferValidator` immediately after `royaltyBps` — `zeroAddress` = plain ERC-721 forever (the
+  default), non-zero = permanent 721C enrollment with that validator. A new `creator-token` module
+  ships the per-chain `RECOMMENDED_TRANSFER_VALIDATOR` (OpenSea's
+  StrictAuthorizedTransferSecurityRegistry, verified live on Sepolia + Base Sepolia), the two
+  creator-token ERC-165 ids + the ABX extension id, `readCreatorTokenStatus()` (`{enrolled,
+validator}`), and a `prepareSetTransferValidator()` write wrapper.
+
+  CLI: the deploy commands take `--721c [recommended|0x…]` — absent means zero behavior/output
+  change; `recommended` resolves the per-chain constant (refused, naming the chains that have one,
+  where none is known); an explicit address is EIP-55-validated and pre-checked for code before any
+  gas. Enrolling prints one plain statement of what enforcement means. A new owner op
+  `abx set-transfer-validator <address> <0x…|none|recommended>` re-points or suspends an ENROLLED
+  collection's validator (guards `--dry-run`; refuses plain ERC-721s up front — enrollment is a
+  deploy-time decision). `abx state` shows the validator for enrolled collections only.
+
+## 0.1.0-alpha.7
+
+### Minor Changes
+
+- 1b50f9d: Fixes from an integrator batch: a machine-readable `tokenuri`, one Arweave identity across CLI and SDK, a correct OpenSea refresh, and attach telling the truth.
+
+  **`abx tokenuri --json`.** The command abbreviated long values (`… (382 chars)`) with no way to turn it
+  off, so for a token whose whole point is on-chain content it returned something that _looked_ like the
+  metadata and wasn't. An integrator scraped it, stored a `data:` URI cut to 96 characters, and only
+  found out in production; they abandoned the CLI as a read path and reimplemented `eth_call`. `--json`
+  now emits the verbatim decoded document — no banner, no ANSI, no truncation — so
+  `abx tokenuri <addr> --json | jq` is a supported read path. The human view still abbreviates, and now
+  says `[--json for the full value]`.
+
+  **One Arweave identity, resolved in one place.** `arweaveConfigFromEnv()` read `ARWEAVE_JWK` and
+  nothing else, while the CLI mints and manages `.abx-self-host/arweave-key.json`. Porting a working CLI
+  flow to the SDK — same machine, minutes later — failed every upload with "Arweave via Turbo needs an
+  identity", a message that says storage was never configured when the truth was that two layers
+  disagreed about where the identity lives. `@artblocks/abx-storage` now exports `resolveArweaveJwk()`
+  (env → managed key file) and the CLI delegates to it. Its diagnostics come with it: an empty key file
+  now reports the **path** and the remedy instead of `Unexpected end of JSON input`, and a corrupt one
+  says the same.
+
+  **`abx refresh` on the default chain.** The OpenSea slug map held only `sepolia` and `mainnet`, so
+  `base-sepolia` — the CLI's own default — fell through to the raw key: the refresh POST went to a slug
+  OpenSea doesn't know, and the printed link pointed at **mainnet** `opensea.io` for a testnet token.
+  Slugs are now correct (`base_sepolia`), `testnet` comes from the chain registry rather than a second
+  hand-maintained set, and a chain with no known slug produces **no link** instead of a wrong one. Same
+  shape as the hardcoded explorer table that once sent every Base Sepolia link to Etherscan.
+
+  **`abx attach` names its dependency.** Attaching artifacts to a project that resolves on-chain now
+  warns, before the send, that they will **not** appear in `tokenURI` — the on-chain renderer carries
+  reserved fields only, and the artifacts manifest comes from a resolver. A team attached five audio
+  stems to a fully-on-chain token and found them "paid for, stored on-chain, and invisible"; the note
+  that existed was one dim line that read as a footnote rather than as a missing service.
+
+  **`ensureChunkStore` moved to the SDK.** The bootstrap every on-chain-content path needs existed only
+  inside the CLI, so an SDK integrator got `resolveChunkStore()` (may return undefined) plus a separate
+  `storeSupportsWriteContent()` they had to remember — forget it and an incapable store fails _deep
+  inside a mint, after transactions have landed_. One team hand-rolled the guard for exactly that reason.
+  `ensureChunkStore(publicClient, send, {chainId, override, onEvent})` is now exported; the SDK reports
+  progress through `onEvent` instead of printing, and the CLI keeps its narration.
+
+  **`abx storage upload --json`.** The locator as data. They scraped this line, captured its ANSI colour
+  codes along with the URL, wrote the result into a _stored_ player URL, and found out when it 404'd in
+  production. In `--json` mode stdout carries the JSON and nothing else; progress moves to stderr.
+
+  **`--backend ipfs` no longer hides a missing credential.** Without `PINATA_JWT` the backend resolves to
+  **kubo against a local node**, so a dry run looked fine and the real upload failed for anyone not running
+  one. The preview now says so. Related correction: the skill claimed "a backend missing its secret falls
+  back to `fs`" — it does not. `cloud` refuses up front naming the missing values, and `ipfs` goes to the
+  local node; nothing silently degrades to local disk. Both sides now say the same thing.
+
+  Reported in the 2026-08-03 MXRR integration batch (feedback 869f27b1, a256217f, 119d7e8e, 975c363e,
+  e38216db, e267078b).
+
+- 1b50f9d: On-chain param enumeration: a project's parameters are now readable from the chain that holds them, and the `params.keys` convention is retired.
+
+  The params store was unenumerable by design, so anything that wanted to know _which_ parameters a
+  project has had to be told. The answer was a convention: a `params.keys` contract param holding a
+  comma-separated list, composed by `deploy-code` from the `--schema` flags and hand-maintained
+  thereafter. It worked, and it had the defect every hand-maintained index has — a key configured but
+  not listed was **silently omitted from every render**. The schema existed, a collector could set it,
+  the art never saw the value, and nothing anywhere reported a problem. The CLI grew a nudge, then a
+  same-transaction companion write, and both were treatments for a design that should not have needed
+  them.
+
+  **The token now maintains its own key lists.** `SeriesCode` gains `tokenParamKeys(tokenId)`,
+  `contractParamKeys()`, and `paramSchemaKeys()` (plus `…Paged` variants for surfaces past an RPC's
+  return cap). The lists are updated inside the write paths themselves, so `key ∈ list ⟺ the param is
+set` holds for every writer — raw owner writes, governed `configure-param` writes, hook-driven writes,
+  all of them. No caller can forget, because no caller is involved. (`seed` is deliberately never listed:
+  every consumer reads it as a tokenData coordinate, and indexing it would charge every seeded mint for
+  nothing.) `paramSchemaKeys()` closes the other half — a chain-only frontend can now build a configure
+  UI, including for keys declared but never yet written, which nothing off-chain could previously
+  discover.
+
+  **The canonical `AbxGenerator` reads that surface instead of the CSV.** It no longer looks at
+  `params.keys` at all, and a `params.keys` value set on a new project is simply an ordinary parameter —
+  enumerated and emitted like any other, by both the generator and the SDK. A latent parity bug dies with
+  the convention: the generator's no-CSV path emitted tokenData in insertion order while the canonical
+  serializer sorts, so the two byte-forms could disagree; there is now one form.
+
+  **`AbxMetadataRenderer` is spec v4.** `tokenURI` gains a computed `abx_params` object — every set
+  parameter, contract and token scope merged, token wins, sorted, decoded by the same rules the generator
+  and the SDK use. A data-backed value over 2048 bytes is emitted as `{"keccak256":"0x…"}` — its on-chain
+  commitment — rather than inline, so a large `Bytes` parameter cannot bloat `tokenURI` past a single
+  `eth_call`; every key still appears, and an oversized one degrades self-describingly. Parameters are
+  _not_ folded into `attributes`: that stays the creator's surface. Also in v4: an `animation_url` carried
+  by the `inline` or `reader` representation is now wrapped as `data:text/html;base64,…`, exactly as
+  `image` already was — the asymmetry was an oversight, and it meant a fully on-chain animation was
+  handed to wallets as bare text.
+
+  Both changes are additive on the read side: pointed at a token that predates enumeration, a v4 renderer
+  simply emits no params block. **Repointing the metadata renderer is safe anywhere.** Repointing the
+  _generator_ is not, and `abx set-field` now refuses it: a legacy implementation plus the current
+  generator means every parameter silently vanishes behind a `tokenURI` that still looks healthy, so the
+  CLI stops you rather than warning you, and names both ways out (stay on the project's existing
+  generator, or redeploy).
+
+  Everywhere else in the toolkit, the convention is simply gone:
+
+  - `deploy-code --onchain-uri` sets up in **three** legs, not four (animation field → generator, plus
+    the two URI renderers). There is no key list to compose, report, or keep in sync, and the help text
+    no longer teaches one.
+  - `abx set-schema` is a single op again — no companion write, no multicall. This **supersedes**
+    alpha.13, which shipped `set-schema` writing `params.keys` in the same transaction to stop a governed
+    key going unlisted: the contract now maintains its own key list, so there is nothing to keep in step
+    and the drift that fix guarded against is gone rather than mitigated. Same for that release's note
+    that "there is no on-chain enumeration of schema keys" — `paramSchemaKeys()` is exactly that.
+  - `abx state` reads the governed surface from `paramSchemaKeys()` and the collection-scope values from
+    `contractParamKeys()`. A project deployed before enumeration falls back to reading its old
+    `params.keys` list, read-only, so live testnet drops still describe themselves.
+  - `abx verify` notes when a project's enumerated surface exceeds ~64 keys — the documented design
+    envelope. The write side is unbounded; the read side is what grows, since `tokenURI` and `tokenData`
+    assemble every parameter per call.
+  - `abx configure-param <addr> - params.keys <csv>` no longer has a special path. Writing that key is
+    now an ordinary schema-less contract param, and it shows up in tokenData as one — honest, and
+    documented.
+  - `abx_params` joins `artifacts` and `abx_provenance` as a computed key `set-field` and `attach` refuse.
+
+  The SDK needed no semantic change: `buildTokenData` has always been event-derived (coordinates + seed +
+  every set param, both scopes, token wins, augment entries), and the contract enumeration implements
+  exactly that rule. Its `deployments` manifest carries the new addresses.
+
+## 0.1.0-alpha.6
+
+### Minor Changes
+
+- 1158420: Expose the PostParam schema lifecycle: `abx set-schema`, `abx retire-param`, Address legs, and `lock=`.
+
+  Three capabilities the contracts have always had, that the toolkit could not reach — so they read to
+  creators as protocol limitations. All three were reported in the 2026-08-03 tester batch.
+
+  **A project's param surface was never frozen at deploy.** `setParamSchema` is owner-gated with no
+  deploy-time restriction and no `exists` check, so it is an upsert usable for the life of a project.
+  There was just no command for it, and the CLI said so out loud ("Adding a param to an already-deployed
+  contract isn't a CLI command yet"), which pushed designers toward guessing their full param surface up
+  front or redeploying — losing the address, the mints, and the collectors. `abx set-schema <addr>
+--schema key:Type:Auth` attaches or replaces one key.
+
+  Because it is a **full-row upsert on a contract that never re-validates stored values**, the command
+  carries a guard rather than a warning: it prints before/after, and _refuses_ a change that could strand
+  values already written under the key — a narrowed bound, a dropped `Select` option, a changed type —
+  unless you pass `--force`. It also flags an existing `lock=` you are about to drop by not restating it.
+
+  **A parameter can be retired.** There is no delete in the contract (`exists` is only ever set true), but
+  a `lockAfter` in the past makes every later write revert `ParamLockExpired`, permanently. `abx
+retire-param <addr> <key>` does exactly that, reading the current schema and changing _only_ the lock so
+  type/auth/bounds/options carry forward untouched. It does not remove the key and does not erase a stored
+  value — a value written under a `TokenOwner`/`Address` leg came from a collector, and the artist
+  deliberately cannot delete it.
+
+  **An `Address` auth leg is now expressible.** `--schema` previously rejected every Address-bearing leg
+  with "set that schema post-deploy via the contract" — advice pointing at a command that did not exist.
+  The auth token now names its holder inline (`board:Bytes:Address(0xabc…)`), and the error for a bare
+  `Address` says what the leg is for: a **contract** may hold it, which is how open and multi-party
+  participation is built today. `authAddress` and `lockAfter` were also hardcoded to zero at the
+  deploy-time call site, so neither was reachable there either; both now flow through `--schema`.
+
+  `--schema` gains an optional 4th field, `lock=<when>` (ISO date, unix seconds, or `now`), sharing the
+  Timestamp grammar the bounds already use. A 4th field that is not `lock=` now reports the spec-shape
+  error instead of a mangled "malformed type", which is what a `:` inside a `Select` label used to produce.
+
+  New in the SDK: `prepareSetParamSchema`, `prepareRetireParam`, `readParamSchema`, `OnChainParamSchema`.
+
+  (feedback 4a0c213a, 5d530681, 381bdcbe)
+
+  > [Superseded 2026-08-03: params now enumerate **on-chain** (renderer spec v4, `abx_params`) and
+  >
+  > > `params.keys` is retired — the contract maintains its own key list, so nothing off-chain has to keep
+  > > it in step and `abx state` reads the chain directly. See the on-chain param enumeration entry.]
+
+  `set-schema` also keeps **`params.keys` in step, in the same transaction**. On the on-chain URI lane
+  the canonical generator builds tokenData from that CSV, so a key that is governed but not listed is
+  silently omitted from every render — the schema exists, a collector can set it, and the art never sees
+  the value. `deploy-code` composes the list from `--schema` for exactly this reason; without the
+  companion write, a schema added later would have quietly half-worked. Projects not on that lane (where
+  `params.keys` is unset) get no extra write.
+
+  > [Superseded 2026-08-03: params now enumerate **on-chain** (renderer spec v4, `abx_params`) and
+  >
+  > > `params.keys` is retired — the contract maintains its own key list, so nothing off-chain has to keep
+  > > it in step and `abx state` reads the chain directly. See the on-chain param enumeration entry.]
+
+  And `abx state` now prints the governed PostParam surface — each key's type, auth, bounds/options, an
+  upcoming lock date, and a `retired` marker for one whose lock has passed. There is no on-chain
+  enumeration of schema keys, so it reads the project's own `params.keys` list, which is also what the
+  generator reads; anything missing from it is invisible to renders anyway. It also names keys listed
+  there with no schema. This is what makes `set-schema`'s upsert safe to use: you can see a key's current
+  shape before overwriting it.
+
+### Patch Changes
+
+- 1158420: Fix `deploy-code` reverting `DeploymentFailed()` — the setup transaction was sent with a gas limit estimated against a contract that did not exist yet.
+
+  Every `deploy-code` attempt in a reporter's Base Sepolia session reverted with Solady's
+  `DeploymentFailed()` (`0x30116425`), in both the on-chain and hosted-resolver lanes, with a minimal
+  case of storing a single 3,563-byte script chunk. It was not a defect in the chunk path: the two
+  transactions simply **ran out of gas**.
+
+  ```
+  0xcad74d07…  gasLimit 201,616   gasUsed 198,870  (98.6%)
+  0xf4350724…  gasLimit 169,301   gasUsed 166,810  (98.5%)
+  ```
+
+  A code project deploys in two transactions: create the clone, then one setup `multicall`. The second
+  targets the contract the first just created — and `eth_estimateGas` for that call, taken while the
+  answering node has not yet seen the deploy block, returns the **calldata cost alone**. Replaying both
+  payloads against a codeless address reproduces the sent limits _to the gas_ (201,616 and 169,301);
+  against the real contract the same calls need 941,331. A setup multicall's cost is dominated by
+  CREATE code deposit (~200 gas per stored byte), so the underfunded CREATE inside `SSTORE2.write`
+  returned 0 and reverted. The 1/1 lane was unaffected because its setup fits inside a calldata-sized
+  budget.
+
+  This is the same read-after-write lag the deploy loop already pins the **nonce** against, one field
+  over. The fix has two halves, and deliberately does not include a third:
+
+  - **Every leg after the first waits for the target's code to be visible** to the client doing the
+    estimating, so a lagging node cannot produce a meaningless estimate in the first place. This is the
+    actual repair.
+  - **An impossible estimate is detected and refused, not replaced.** `PreparedTx` gained an optional
+    `gasFloor` carrying only the _provable_ part of a payload's cost — EVM code deposit at exactly 200
+    gas per stored byte. An estimate below that is not "low", it is proof the node is on stale state, so
+    the sender retries and then errors out with what it saw.
+  - **What we did NOT do: substitute a computed gas limit.** Only the deposit is derivable; the same
+    setup multicall also carries schema writes, dependency legs, URI legs and mints whose cost cannot be
+    known without simulating them. A "probably enough" constant is tuned to whoever's example was in
+    front of its author — it would have covered the reported single-chunk case and then under-funded a
+    three-schema deploy by ~200k, reproducing the identical `DeploymentFailed()` with a fresh mystery
+    attached. Refusing to send is strictly better than sending a transaction we can prove is
+    under-funded, which would burn the gas and orphan the contract.
+
+  All three signing lanes carry this, not just the hot one: the env-key lane pins the limit before
+  `sendTransaction`, the wallet lane waits for code and hands the browser an explicit `gas` (a wallet
+  estimates against its own RPC, which we don't control and which lags the same way), and the cold lane
+  prints `gasMustExceed` — labelled a floor, not a limit — plus a note telling an external signer to
+  re-estimate rather than send if their own number comes back below it. The rule lives in one place
+  (`packages/cli/src/gas.ts`) so the lanes cannot drift apart on it.
+
+  Reported in the 2026-08-03 tester batch (feedback 156ea0fb, 172111ae), root-caused from the full
+  transaction hashes supplied in the follow-up addendum.
+
+- 1158420: Fixes from a parallel cold-agent sweep: a chain typo no longer crashes every command, and `inspect` stops over-promising on hand-written PRNGs.
+
+  **An unknown `ABX_CHAIN` printed a raw Node stack trace — from every command.** Chain-derived values
+  were resolved at module scope, in `token-api` (which the CLI imports) and in the CLI itself, so the
+  throw happened during module evaluation, before `main()` existed to catch it. `ABX_CHAIN=mainnet abx
+doctor` dumped an internal source path and exited 1 — including from the one command whose job is to
+  tell you what is wrong with your environment. Those resolutions are lazy now, and the CLI validates
+  the variable up front with an answer rather than a crash: unknown values list the shipped chains, and
+  a mainnet-shaped value says plainly that ABX is testnet-only today.
+
+  **`abx inspect` reported "(no PRNG)" for a hand-written seeded generator — with the _stronger_
+  reproducibility verdict attached.** The `seeded` check only recognized p5's `randomSeed(`, so a
+  vanilla LCG or xorshift matched no branch and fell through to "traits look derived from the
+  seed/params directly". That is the common case, not an edge one — the skill's own canonical
+  dependency-free example hand-rolls an LCG, and all three sketches written by agents in the sweep hit
+  it. A hand-rolled generator now gets the `careful` verdict and is told the truth: deterministic and
+  reproducible on-chain, but only by porting that exact generator and call order into Solidity.
+
+  Also: `--yes` is now documented in `deploy-code --help` (its own placeholder-identity refusal already
+  told you to pass it), and the `--onchain-uri` raster warning now names the two routes that actually
+  deliver a no-server image instead of only one.
+
+  Found by the 2026-08-03 parallel sweep (8 cold Sonnet/Haiku agents, isolated sandboxes).
+
+## 0.1.0-alpha.5
+
+### Minor Changes
+
+- feba8c2: A resolver is no longer an object store: effect outputs split into **bound** and **referenced**
+  (`specs/protocol/effects.md → Bound vs referenced`), and the artifact registry enforces the split.
+
+  An output is **bound** iff a binding stitches its _content_ into the metadata JSON (today exactly
+  `render/traits` → `attributes`); everything else is **referenced** — the projection carries its URL,
+  or it only appears in the `artifacts` manifest. That one distinction decides who holds the bytes, and
+  it is now the wire rule rather than a runner constant.
+
+  - **`POST /v1/effect-artifacts` derives the mode from the binding, and refuses both mismatches.**
+    Bytes for a referenced output → `400` (the resolver redirects either way, so the bytes buy no
+    capability and cost it storage, retention and egress). A locator for a bound output → `400` (its
+    content is assembled into `tokenURI`; a pointer there used to be recorded and then silently never
+    stitch — a wrong answer served confidently). Bound content is capped at **64 KB**, and a locator
+    that only the producer could resolve (loopback/private host, presigned expiring URL) is rejected.
+    The resolver never fetches a locator while handling the write, and serves registered locators by
+    `302` — never by proxying.
+  - **Bound content moved out of byte custody** into the artifact row (`effect_artifacts.bytes`). Two
+    distinct rules, deliberately not one: a node **MUST** serve and stitch bound content only at the
+    token's current settled `inputsHash`, and it **MAY** drop superseded content whenever it likes
+    (nothing may read it, and it is re-creatable). The reference drops eagerly, on each bound
+    registration, so it holds at most `64 KB × minted × bound outputs` — but retention is a service
+    policy, not an obligation. Either way "conforming means holding a bounded amount of JSON in the
+    database you already run" is now literally true: a resolver in the publish topology needs no object
+    storage at all.
+  - **`abx-effects-publish/v1` is gone** (not deprecated): the two routes ride `abx-control-plane/v1`.
+    Once referenced output is locator-only, accepting a registration is a database insert, so the
+    capability flag described a distinction that no longer exists. A service that won't take a caller's
+    artifacts refuses on the credential (`403`) — interfaces describe wire grammar, tokens describe
+    permission. The interface ids are also explicitly **all-or-nothing**, and the conformance fixture
+    now checks that every route a declared interface names actually answers.
+  - **The runner declares bound outputs** (`EffectOutputDecl.bound`), refuses to start when it has a
+    publish token but a backend that can't name a locator, preflights the descriptor + credential
+    before spending a render, and **latches** on a permanent (4xx) publish failure instead of
+    re-rendering every sweep forever. Skips now re-register rows, so a transient publish failure heals
+    without a re-render.
+  - **The CLI refuses the impossible combination up front**: `abx render --remote`, `abx effects`
+    against a remote resolver, and `abx deploy-effects` all require a backend that can name a reachable
+    URL — `cloud` (S3/R2 + public base), `ipfs`, or `arweave`, named as **peers**. Derived output is
+    re-creatable, so the protocol has no preference among schemes: a chosen `https://` gateway or
+    bucket URL is exactly as legitimate as `ipfs://`/`ar://`, and reachability — not durability — is
+    the requirement. Rendering **co-located** with the resolver remains fully supported on any backend,
+    including `fs`.
+
+  Breaking for producers that relied on pushing media bytes to a resolver: publish a locator instead,
+  or co-locate. Breaking for clients that read `abx-effects-publish/v1` from a descriptor.
+
+## 0.1.0-alpha.4
+
+### Minor Changes
+
+- 67b686b: `abx contracturi`, and the read plane stops answering a bare 404 to three different problems.
+
+  Both halves come from one real failure: an agent driving a hosted resolver wanted collection
+  metadata, pattern-matched off `/t/{chainId}/{address}/{id}`, dropped the token id, got a bare `404`,
+  and reported the service as broken. The documented route (`/c/{chainId}/{address}`) was right there —
+  but there was also no command to just _ask_, and the 404 gave it nothing to correct.
+
+  - **New `abx contracturi <address>`** — the collection-level counterpart of `tokenuri`. Reads
+    `contractURI()` (ERC-7572) from the contract, **follows it**, and decodes: a `data:` URI inline
+    (the on-chain lane), an `https://` URL by fetching it (the off-chain lane). A contract commits its
+    own metadata base on-chain (`contractURIBase`), so the chain — not a doc, not a service
+    descriptor — is the authoritative answer to where a project's metadata lives. Nobody needs to
+    hand-build a resolver URL. When the fetch fails, the message says so plainly: the URL came from
+    the chain, so a bad status is about the _service_ (unregistered project · wrong chain · down),
+    never a mistyped path.
+  - **Read-plane responses now carry a machine `code`**, so the three causes of "no metadata came
+    back" are distinguishable — they were one indistinguishable `{"error": "…"}` `404`:
+    - `400 invalid_request` — a real route, wrong shape. Names the correct template, and carries
+      `didYouMean` when the fix is obvious (a `/t/…` missing its token id → `/c/{chainId}/{address}`).
+    - `404 unknown_route` — this node serves nothing at that path; the body lists what it does serve.
+    - `404 not_registered` — the path and chain were fine; this node doesn't index that contract.
+    - `400 unsupported_chain` — wrong chain, plus the `chains` this node does serve. Was a bare `404`;
+      now matches what the control plane already answered for the same condition.
+  - `ServiceErrorCode` gains `unknown_route`. The spec's Errors section now covers the read plane too,
+    with a **MUST** on distinguishing the three misses — and an explicit **MUST NOT** on treating
+    route templates as per-node discoverable configuration. The route grammar is fixed by the
+    `abx-token-api/v1` interface; these responses are diagnostics, not a discovery mechanism.
+  - **The conformance fixture checks all of it** (`pnpm conformance <base-url>`), so any provider can
+    self-verify in one command. Also fixed: the documented `pnpm conformance -- <base-url>` form
+    parsed `--` as a flag and swallowed the base URL, printing usage instead of running.
+
+## 0.1.0-alpha.3
+
+### Minor Changes
+
+- a72723d: A standard indexing lifecycle, and registration that no longer blocks on a slow chain RPC
+  (specs/self-host-toolkit/remote-services.md → The indexing lifecycle).
+
+  - **Fixed: a slow register triggered a retry storm.** The SDK's per-attempt timeout (30s) plus its
+    retry ladder meant a cold reconstruct that outran one request was **re-POSTed up to four times**,
+    each starting another full replay against the RPC that was already too slow to answer — and the
+    caller then saw "nothing responded" even though the registration was durable and indexing was
+    underway. A timed-out register now asks whether it landed (a status read) instead of re-POSTing, and
+    the resolver coalesces concurrent catch-ups for one project into a single run.
+  - **`POST /v1/projects` answers in two conformant shapes, discriminated by HTTP status:** `200` with
+    the completed summary, or `202` + `{accepted, project: {status}}` when catch-up is deferred. The
+    registration is normatively **durable before catch-up** and visible on the list immediately, so a
+    flaky RPC makes for a slower backfill rather than a lost add. No `?wait=`/`Prefer:` negotiation — the
+    status code is the discriminator, and clients handle both. The reference resolver answers _by
+    deadline_ (`ABX_REGISTER_DEADLINE_MS`, default 8s): the common case (a fresh deploy) stays
+    synchronous with real counts; only the pathological case defers.
+  - **Closed lifecycle enum + error classes, on the status and list routes:**
+    `queued | backfilling | live | stale | failed`, plus credential-free
+    `error.class ∈ {rpc_unavailable, rpc_rate_limited, not_abx_contract, internal}` (fixed per-class
+    messages, never a scrubbed upstream string). Status gains top-level `headBlock` (so lag / % complete
+    is computable without knowing a service has a watcher) and `attempts`; the list carries `status` +
+    the error class, so a client renders "3 live, 1 backfilling, 1 failed (rpc_rate_limited)" in one
+    request. SDK: `IndexStatus`, `IndexErrorClass`, `isAccepted()`, `indexProgress()`,
+    `classifyIndexError()`, and `AbxServiceClient.awaitIndexed()` — one wait loop for the CLI, the
+    effects runner, and any hosted agent.
+  - **The same five words on your own node.** `abx status [address] [--remote [name|url]] [--watch]`:
+    bare is the node summary (now with each project's state), an address gives lifecycle + scan floor +
+    blocks-indexed-vs-head + cause, and `--remote` asks a service. (`status` = who is serving it and how
+    fresh; `state` = what the chain says. Both `--help` texts now say so.)
+  - **New observability the self-hosted node never had:** the chain watcher marks projects `stale` when
+    it falls far behind head or its ticks keep failing (previously visible only in the node's log),
+    re-queues a backfill interrupted by a restart (previously left registered-but-empty until a manual
+    `abx index`), and retries a `failed` catch-up on exponential backoff instead of hammering a
+    rate-limited RPC every tick. Lifecycle rows live in their own table: they survive a projection wipe
+    and are never clobbered by a re-add.
+  - **CLI:** `abx add|index --remote` prints `registered — backfilling…`, polls to `live`, then prints
+    the same summary a synchronous service would have given; `--no-wait` returns at the 202 and names
+    the command to check later. A post-op nudge (`ownerops`) never blocks on someone else's backfill.
+    A caught-up project with **0 events** now warns instead of printing ✓ (a real ABX clone always emits
+    a spine, so zero means wrong chain/floor or an RPC that didn't serve the logs).
+  - **Conformance fixture** accepts either register shape, asserts durable-before-catch-up, lifecycle
+    membership, `headBlock`, that a deferred catch-up actually reaches `live`, and that no error message
+    carries a URL.
+  - Fixed `scripts/mock-remote-service.mts`, which imported the token API by a path that resolved
+    against `scripts/` and could silently fall back to a _published_ build outside the repo — the
+    fixture was testing the last release instead of the working tree. The fixture also re-points
+    scenarios by their fixture header now, so a new one can't keep a dead contract address.
+
+  Found by a cold-agent sweep over the above (10 parallel clean rooms, haiku + sonnet) and fixed here:
+
+  - **`abx status --remote <name>` with no address** parsed the flag itself as the address and sent it
+    as a URL path segment.
+  - **A register whose catch-up already failed** was announced as "registered — failed (…is catching
+    up…)", and with `--no-wait` it exited 0 and then claimed the provider "now serves" the project. A
+    known failure is now an error in both lanes — there is nothing left to wait for.
+  - **A `failed` status said what broke but not whose problem it was.** Both the failure error and
+    `abx status` now carry a per-class action line ("the SERVICE can't reach its chain RPC — not your
+    key, address, or chain…"), plus a `follow` line naming `--watch`, so a red word isn't a dead end.
+  - **A `live` project showed a misleading completion percentage.** `toBlock` only advances when a
+    project has _events_, so a fully current project on a busy chain read as `2/202 (0%)`.
+    `indexProgress()` now returns a ratio only while `backfilling`; `live` reads "caught up", `stale`
+    reads "not tracking head right now".
+  - **`--remote-token` was misattributed on a 401** — the error blamed `ABX_REMOTE_<NAME>_TOKEN` even
+    when the caller passed an override, making the override look ignored at exactly the moment someone
+    is testing a replacement key.
+  - **`not_registered` on a read** (status/reindex) now names the register command instead of echoing a
+    404, and a 5xx carrying a failure `class` becomes a wait-vs-broken error.
+  - **`abx verify`'s summary** read `✓ 0/1 up to date` for a project with no off-chain renders at all —
+    "zero of one succeeded" to two independent reviewers. It now says "nothing to render for this
+    project", and otherwise leads with polarity ("N of M token(s) current").
+  - **`abx doctor` now reports named remotes** and flags a credential stored under a name the CLI does
+    not read (`ABX_REMOTE_<NAME>_KEY`). That fault presents as "it acts like I never gave it a key" and
+    previously only surfaced from `abx remote <name>` — which a creator reaches _after_ doctor.
+  - **Skill: the `npx --no-install abx version` probe was documented as failing cleanly.** It doesn't —
+    npm will run any `abx` binary already in the npx cache, which in a real sweep reported a months-old
+    build as the project's CLI (and if a plain `npx abx` ever ran on that machine, the bare name is a
+    squatted package). The skill now probes `./node_modules/.bin/abx` directly.
+  - Also documented: how a multi-word provider name folds into `ABX_REMOTE_<NAME>_*`, and what
+    `watching: no` means on a status readout.
+
+  A second sweep round over those fixes caught three more, including one the first round's fix created:
+
+  - **`abx verify --remote` never checked byte integrity at all** — both of its lanes only ask "is there
+    a current render / is this a placeholder", and a green ✓ from that was standing in for "the served
+    bytes match the on-chain commitment". A reviewer hit the worst version of this: `--remote` (the form
+    the skill tells you to use for a hosted project) reported ✓ on a token whose bytes genuinely did NOT
+    hash-match, while bare `abx verify` on the same project reported `✗ keccak256 MISMATCH`. It now calls
+    the service's own purpose-built `GET /api/project/:addr/verify` (which holds both the bytes and the
+    chain) and reports that verdict separately from the render summary — and when it _can't_ run that
+    check (no credential, older node) it says "byte integrity NOT checked" instead of leaving a ✓ to
+    imply it passed. The remedy names both real causes (an unbridged durable locator vs. bytes that only
+    exist on the creator's machine, which a hosted resolver can never serve).
+  - **`abx verify` exited 0 while printing a byte MISMATCH**, in both lanes — nothing could gate on it.
+    An integrity mismatch now fails the command; a missing render or placeholder is a normal state and
+    still exits 0.
+  - **`abx add --dry-run` silently ignored the flag and performed the registration**, local or remote.
+    It now refuses and names the read-only commands (`abx state`, `abx status`) instead. Silently doing
+    the thing when the caller asked to preview is the one outcome that must never happen.
+  - **`PRAGMA busy_timeout` was set third in the store schema**, after the WAL switch it needs to
+    protect — so two processes opening the same store at once (parallel CLI runs, or a co-located
+    effects runner starting alongside the resolver) could fail outright with `database is locked`
+    instead of waiting the moment out. It is now the first statement.
+
+  A third round, re-running the scenario that found the verify bug (it now catches it) turned up:
+
+  - **`abx add --remote` ended on "it now serves <url>"** — true about indexing, silent about whether
+    the bytes are right, and two reviewers stopped there and reported a blank page as fixed. It now names
+    the byte check (`abx verify <addr> --remote <name>`) in the same breath.
+  - **`canonical:` collapsed a tri-state.** `isCanonical` is `true | false | null`, and both readouts
+    printed "unverified" for the last two — so "the chain says this is NOT a clone of the configured
+    factory" (a trust finding) looked identical to "the check never ran" (no factory on this chain, normal
+    on a dev chain). Two reviewers read the collapsed word as a second failure sitting next to a real one.
+  - **`abx verify --remote` gave a bare `fetch failed`** for an endpoint that was down, where
+    `abx status --remote` names the host and asks whether it's running. Two commands, one condition, two
+    error qualities — now consistent.
+  - `abx status <addr>` printed the address twice when the project has no name.
+  - Skill: registering with a provider on **their** hostname vs. a domain you control decides whether
+    leaving later costs a transaction — now stated in the managed-provider section, before you bake it.
+
+## 0.1.0-alpha.2
+
+### Minor Changes
+
+- 3745bd3: Remote services are first-class: a provider-neutral control plane, named remotes, and a service
+  descriptor (specs/self-host-toolkit/remote-services.md).
+
+  - **Control plane moves to `/v1`** (hard cutover; `/admin/*` is gone — redeploy self-hosted nodes):
+    `POST/GET /v1/projects`, `DELETE|reindex|status /v1/projects/{chainId}/{address}`,
+    `POST /v1/effect-artifacts|effect-status`. `chainId` is explicit and validated everywhere; every
+    error carries a machine `code` (`unauthorized` 401 · `forbidden` 403 · `unsupported_chain` ·
+    `not_registered` · `disabled`) replacing the old prose-sniffed 404. One bearer guard replaces the
+    four inline copies; OPTIONS preflight now answers so browser clients can send `Authorization`.
+  - **`GET /.well-known/abx-service`** — the public service descriptor: `interfaces` (present iff
+    actually enabled), `chains`, `auth` (with optional provider-set `signupUrl`/`docsUrl` via
+    `ABX_SERVICE_*` env), and `render.attached` (managed rendering, probed from the runner's
+    `/health`) — so an agent can match a project to a provider before registering.
+  - **Named remotes in the CLI**: `--remote <name>` reads `ABX_REMOTE_<NAME>_URL`/`_TOKEN`
+    (a managed provider's per-account key — never falls back to `ABX_RESOLVER_ADMIN_TOKEN`);
+    `--remote <url> [--remote-token <t>]` for ad-hoc targets; bare `--remote` stays the self-host
+    default. New `abx remote [name|url]` inspects a service's descriptor and the projects a token
+    sees. `migrate --from/--to` accept names; only the destination needs a credential.
+  - **The SDK gains its first HTTP surface**: `AbxServiceClient` (endpoint + injected bearer, retry
+    on 5xx/network, immediate typed `AbxServiceError` on 4xx) — shared by the CLI and the effects
+    runner's publish lane. `envSuffix()` is the shared env-name normalization.
+  - **Conformance fixture**: `pnpm conformance -- <base-url> [--token …]` self-verifies any
+    implementation; the e2e suite runs it against the reference container.
+
+### Patch Changes
+
+- 3745bd3: Membrane fixes found by a 20-run cold-agent regression sweep (sonnet + haiku, black-box clean rooms).
+
+  - **A 500 no longer leaks the node's own credentials.** An upstream RPC failure surfaced viem's
+    message, which embeds the endpoint URL — and a keyed RPC URL _is_ a credential, so on a
+    multi-tenant provider any tenant who could provoke a 500 got the operator's RPC key. The cause now
+    goes to the node's log; the wire gets a generic message, an `internal_error` code, and a
+    credential-free hint about the failure class. Normative in the remote-services spec.
+  - **The service client no longer discards a 5xx body.** The service's own words survive the retry
+    ladder, and an exhausted ladder says "failed — last response …" rather than mislabelling a
+    server that answered as "unreachable". The descriptor probe drops to 2 attempts, so a typo'd
+    provider URL fails in ~1s instead of grinding 5s, with distinct "nothing responded" vs
+    "answered, but serves no descriptor" messages.
+  - **Conflicting duplicate `.env` keys are reported.** First-wins is unchanged, but a stale second
+    `ABX_RPC_URLS_<CHAIN>` line silently pointed the CLI at another network while every check read
+    green — the symptom surfaced far away as "no contract at that address". Only genuinely
+    _conflicting_ duplicates warn (identical repeats stay quiet).
+  - **"No contract at …" errors now name the endpoint they asked** (redacted), because a chain key
+    can't distinguish two RPCs that both claim it.
+  - **A misnamed remote credential is called out.** `ABX_REMOTE_<NAME>_KEY` (or `_API_KEY`, `_SECRET`)
+    is not read, so it previously reported as "no token" while the value sat in `.env`; both
+    `abx remote` and the register path now name the near-miss and the correct `_TOKEN` name.
+  - **`--dry-run` explains a missing trust anchor instead of crashing.** On a chain where the
+    configured factory has no code, `deploy`/`deploy-series` previews died inside
+    `predictDeterministicAddress` with a raw `returned no data ("0x")`; they now report it the way
+    `abx predict` and a real deploy already did, and name the two ways forward. The keyless
+    `--for` requirement also fails fast instead of after several steps of output.
+  - **The placeholder-identity guard is one shared predicate** across all three deploy commands
+    (it was copy-pasted, and one copy's comment claimed coverage it didn't have), pinned by a new
+    regression test: a real send refuses tool defaults, a preview only warns.
+  - **The served dashboard's empty state no longer prints `pnpm abx demo`** — a contributor-only
+    invocation on a page a published user sees.
+
+## 0.1.0-alpha.1
+
+### Patch Changes
+
+- 4074766: Fix the dashboard's block-explorer links, which were hardcoded to `https://sepolia.etherscan.io`. Every
+  link on the page — contract, owner, implementation, each event's tx — pointed at Ethereum Sepolia no
+  matter which chain was being served, so a dashboard for a normal `abx demo` (Base Sepolia by default)
+  sent you to an explorer where the contract does not exist. The SDK now derives the explorer from viem's
+  own chain metadata (`explorerUrl`/`chainById`), so adding a chain brings its explorer along and no
+  hand-maintained table can drift. The CLI's separate copy of that table is collapsed into the same
+  helper; `signer.ts` was already doing it correctly.
+
+  Drop the demo's opening "trust anchor" step. It asserted that only the canonical factory can make a
+  token that _is_ an ABX token, which is false — anything following the protocol's event spine is an ABX
+  token, and the factory is one route to that, not the definition. The same overclaim in the index step
+  ("verified real") now reports the fact instead: made by the canonical factory, or not. The demo opens
+  on the renderer step, and resolving the factory no longer prints a line of its own there.