@divlet/core 0.0.1 → 0.0.2

package/BACKLOG.md

@@ -83,4 +83,6 @@ Complete the remaining migration under `strict` + `erasableSyntaxOnly`, preservi
 
 ## Gated
 
-- [ ] **RELEASE-1 — Publish the validated scoped five-package 0.0.1 candidate after explicit approval.** The maintainer approved `@divlet/core` plus an independently owned `@divlet/web` after npm refused unscoped `divlet`; preserve adapters → core → web without runtime/type back-edges. Use the current flat-layout archives and integrity manifest in ignored `artifacts/releases/0.0.1-flat/`, without substituting bytes. The previous `0.0.1-scoped/` (`21907c1`) and original four-archive `0.0.1/` candidates remain historical; their archives/publisher are not the current release candidate. Publication remains external and gated: obtain explicit approval for the new five-archive candidate, keep OTPs/tokens private, recheck scope rights and conflicting registry versions, publish web → core → CLI/MCP/Pi, compare integrity and verify clean registry installs including an isolated real Pi profile. Follow [npm publication](docs/publishing.md); the current draft release is independent of future format-freeze work. Do not announce publication until verified. Git release refs/push and Pages deployment still need their explicit authorization. A live checkout's legacy Pi link must only be switched to built `pi` with operator approval; do not restart owners or discard session History as a package-check shortcut.
+- [ ] **NPM-CI — Finish the first trusted CI publication.** Three pre-publication runs exposed two test preconditions (initial dock measurement and font-dependent paired-row width) and the project picker's fixed-width primary button. Those are corrected; the button regression now forces wider fonts and preserves the exact control-position assertion. All publisher jobs remained skipped. The maintainer authorized replacement of the failed `v0.0.2` tag only after refreshed no-consumed-release-state checks. Complete a correlated successful CI run, five registry-integrity/installed-host checks and GitHub Release. Preserve original failed-run evidence; npm bindings are not verified until actual OIDC publication. See [publishing](docs/publishing.md#github-actions-publishing).
+- [ ] **RELEASE-GIT — Complete GitHub release delivery only when separately authorized.** Verify origin/permissions, remote history, automation and the intended `v0.0.1` target against the published npm candidate (`ea62291`, manifest in ignored `artifacts/releases/0.0.1-flat/`). Preserve immutable published bytes and local history; do not force-rewrite main or move a consumed release tag. Pushing the prepared source/cache changes can trigger Pages, so that deployment consequence also needs explicit authorization. See [publication](docs/publishing.md).
+- [ ] **LOCAL-PI — Refresh a legacy checkout installation only with operator approval.** Use the built top-level `pi/` package, never the root or removed `packages/pi`/`adapters/pi` paths. Coordinate local dependency refresh and reload with the session owner; do not restart active owners or discard their History as an installation shortcut.

package/CHANGELOG.md

@@ -2,9 +2,15 @@
 
 Implemented product outcomes live here. Contributor constraints are in [AGENTS.md](AGENTS.md), current contracts in [docs/](docs/README.md), and remaining work in [BACKLOG.md](BACKLOG.md).
 
-## Unreleased — 0.0.1 candidate
+## 0.0.2 — candidate
 
-Preparing the approved five-package scoped candidate; publication and registry-install verification remain outstanding. A versioned archive is not a completed release.
+- Fixed Landing CI to resolve workspace sources in a fresh checkout, without depending on a previously generated web build. Browser activity checks now take their initial tab baseline after the newly visible toolbar reports its measured height, and paired typography checks use content width instead of a host-specific font-width assumption. Exact geometry assertions remain unchanged.
+- Project-picker action buttons reserve intrinsic space for all state labels, keeping controls fixed through loading/errors across host fonts and narrow layouts.
+- Added a manually dispatched `Release` GitHub Actions workflow with npm Trusted Publishing/OIDC, frozen five-package archives, serial web/core/adapter publication and registry-install verification through CLI/MCP and an isolated real Pi host. Preparation and verification have no publish token; uncertain or prior publication attempts block automatic replay. The first live CI publication is pending verification; this candidate does not freeze the native project format.
+
+## 0.0.1 — 2026-11-13
+
+Published `@divlet/web`, `@divlet/core`, `@divlet/cli`, `@divlet/mcp` and `@divlet/pi` on npm with matching versions and verified archive integrity. Clean registry installations exercise the standalone board, CLI/MCP tools and an isolated real Pi host.
 
 Initial release of divlet: a local HTML/SVG/CSS layout board for agents. The native project format remains an unfrozen schema-1 draft; this release does not activate the approved future ordered-CSS/renderer profile or promise frozen compatibility.
 

package/README.md

@@ -6,7 +6,7 @@ A local layout board for coding agents. Work with real HTML in live artboards, r
 
 [Quick start](#quick-start) · [Connect an agent](#connect-an-agent) · [Board guide](docs/board.md) · [Documentation](docs/README.md)
 
-> **0.0.1 · release candidate.** Scoped-package preparation is in progress after npm refused the unscoped name; no package is published yet. The native project format remains a pre-freeze draft; keep backups because future versions may require explicit conversion.
+> **0.0.2 · release candidate.** CI publication is being verified; 0.0.1 remains the last confirmed npm release until that completes. The native project format remains a pre-freeze draft; keep backups because future versions may require explicit conversion.
 
 ## Real pages, not pictures of pages
 
@@ -22,7 +22,7 @@ Requires **Node.js 22.19 or later**. Pi is optional.
 Open a standalone board:
 
 ```bash
-npx -y @divlet/cli@0.0.1 /absolute/path/to/workspace
+npx -y @divlet/cli@0.0.2 /absolute/path/to/workspace
 ```
 
 Or run from a source checkout:
@@ -46,7 +46,7 @@ Open the URL printed in the terminal. An empty workspace gets `project.divlet` w
 Install the Pi adapter:
 
 ```bash
-pi install npm:@divlet/pi@0.0.1
+pi install npm:@divlet/pi@0.0.2
 ```
 
 For checkout development, load the source adapter for a one-off session instead (no build needed):
@@ -84,7 +84,7 @@ Drop `--global` to install into the current project only. Skip this step under P
   "mcpServers": {
     "divlet": {
       "command": "npx",
-      "args": ["-y", "@divlet/mcp@0.0.1", "--cwd", "/absolute/path/to/workspace"]
+      "args": ["-y", "@divlet/mcp@0.0.2", "--cwd", "/absolute/path/to/workspace"]
     }
   }
 }
@@ -110,7 +110,7 @@ npx -y @divlet/mcp --cwd ./workspace
 npm install -g @divlet/cli @divlet/mcp
 ```
 
-For Pi, run `pi install npm:@divlet/pi@0.0.1`. Shared setups should pin `@divlet/cli@0.0.1`, `@divlet/mcp@0.0.1` and `npm:@divlet/pi@0.0.1`. The root package has no commands or Pi manifest; there is no wrapper layer.
+For Pi, run `pi install npm:@divlet/pi@0.0.2`. Shared setups should pin `@divlet/cli@0.0.2`, `@divlet/mcp@0.0.2` and `npm:@divlet/pi@0.0.2`. The root package has no commands or Pi manifest; there is no wrapper layer.
 
 See [npm publication](docs/publishing.md) for version pinning, package identity and release gates.
 

package/dist/skills/divlet/SKILL.md

@@ -36,7 +36,7 @@ Register it once and the tools survive the session — a project-scoped `.mcp.js
 { "mcpServers": { "divlet": { "command": "npx", "args": ["-y", "@divlet/mcp", "--cwd", "/absolute/path/to/the/workspace"] } } }
 ```
 
-Pin a version in a shared repository (`@divlet/mcp@0.0.1`) so every machine runs the same board. Diagnostics go to stderr;
+Pin a version in a shared repository (`@divlet/mcp@0.0.2`) so every machine runs the same board. Diagnostics go to stderr;
 stdout is the MCP stream. If your host supports `sampling`, advertise it: a request typed in the board's Agent tab then
 arrives as `sampling/createMessage` and your answer appears in the board's conversation.
 

package/docs/README.md

@@ -15,7 +15,7 @@ Start with the [project README](../README.md) for the product overview and a wor
 - [Project format](format.md): First-release specification candidate and current wire-format reference; schemas, defaults, components, supported web content and explicit freeze boundaries. Not yet frozen.
 - [Markdown sites](site.md): Configuration, template slots, routes, source ownership, links, live updates and current limits.
 - [Testing and validation](testing.md): Test layout, every command (unit, browser suites, PEN fidelity, release, Pi RPC), what each check does and does not prove, and the conventions the suites follow.
-- [npm publication](publishing.md): Package and command identity, release gates, five-package web-before-core-before-adapters publication order, and verification after publication.
+- [npm publication](publishing.md): Package and command identity, release gates, OIDC GitHub Actions setup, five-package web-before-core-before-adapters publication order, and verification after publication.
 
 ## Contributor context
 

package/docs/agents.md

@@ -68,7 +68,7 @@ npx -y @divlet/mcp --cwd /absolute/path/to/workspace
 pi install npm:@divlet/pi
 ```
 
-In an MCP configuration, use `"command": "npx"` and `"args": ["-y", "@divlet/mcp@0.0.1", "--cwd", "/absolute/path/to/workspace"]`. Shared configurations should also pin `@divlet/cli@0.0.1` and `npm:@divlet/pi@0.0.1`; see [npm publication](publishing.md). The `divlet` and `divlet-mcp` binary names belong to the CLI and MCP packages respectively. The root library has no bins, Pi manifest or `divlet/pi` export.
+In an MCP configuration, use `"command": "npx"` and `"args": ["-y", "@divlet/mcp@0.0.2", "--cwd", "/absolute/path/to/workspace"]`. Shared configurations should also pin `@divlet/cli@0.0.2` and `npm:@divlet/pi@0.0.2`; see [npm publication](publishing.md). The `divlet` and `divlet-mcp` binary names belong to the CLI and MCP packages respectively. The root library has no bins, Pi manifest or `divlet/pi` export.
 
 For other hosts, install the skill with `npx skills add llblab/divlet --skill divlet --global` (omit `--global` for one project; pick the target agents when asked), or copy/link `skills/divlet/` into the host's skills directory, and register the MCP server separately. Installing a skill alone does not register tools, and a Pi session that loads the extension must not install the skill again. The skill folder is self-contained: it links to documents by their public address, not through the package's `node_modules`. The [workflow skill](../skills/divlet/SKILL.md) explains the model, component recipes and the read → edit → verify loop.
 

package/docs/publishing.md

@@ -1,6 +1,6 @@
 # npm publication
 
-This guide owns the guarded first-publication procedure for **0.0.1** and is not permission to run it. A prepared tree or versioned changelog is not a completed registry publication. Publishing packages, pushing release refs and deploying the landing page require explicit maintainer authorization. Packaging does not freeze or cut over the native schema.
+All five **0.0.1** packages are published on npm, with frozen-archive integrity and clean registry installations verified. **0.0.2** is the candidate for the first live CI/OIDC publication; do not treat it as published until all five registry checks and the installed-host CI job pass. This guide owns publication safeguards and the first-publication procedure below; it is not permission to publish again. A prepared tree or versioned changelog is not a completed registry publication. Publishing packages, pushing release refs and deploying the landing page require explicit maintainer authorization. Packaging does not freeze or cut over the native schema.
 
 npm refused the original unscoped `divlet` name as too similar to `figlet`. The maintainer approved `@divlet/core` and a separately owned `@divlet/web`; the old four-package archives are historical candidates, not scoped substitutes. Never edit archive manifests in place or retry the rejected publisher.
 
@@ -22,21 +22,68 @@ npm refused the original unscoped `divlet` name as too similar to `figlet`. The
 
 Core's HTTP composition imports web's public asset locator; generic model/format modules do not import web. Web's portable contracts own opaque host payloads, not project validation/writes, and have no type/JSDoc back-edge to core. Browser modules use host HTTP/SSE and preview ports, not imports of the Node runtime. Backend plugins consume core contracts; client plugins use the served web module graph. See [architecture](architecture.md).
 
-The root owns `@divlet/core`, `web/` owns `@divlet/web`, and `cli/`, `mcp/` and `pi/` own the adapters, without wrappers. All five versions match. Adapters pin `@divlet/core@0.0.1`; core pins `@divlet/web@0.0.1`. Core has no bins, Pi manifest/peer requirements or `./pi` export. Its tarball excludes the web and adapter implementations. Web owns its only client copy and portable declarations. Built-in plugins remain bundled in core, not separately published.
+The root owns `@divlet/core`, `web/` owns `@divlet/web`, and `cli/`, `mcp/` and `pi/` own the adapters, without wrappers. All five versions match. The 0.0.2 candidate adapters pin `@divlet/core@0.0.2`; core pins `@divlet/web@0.0.2`. Core has no bins, Pi manifest/peer requirements or `./pi` export. Its tarball excludes the web and adapter implementations. Web owns its only client copy and portable declarations. Built-in plugins remain bundled in core, not separately published.
 
-Node.js 22.19 or later is required. Pi is not required for CLI/MCP. Shared configurations should pin adapter versions, including `npm:@divlet/pi@0.0.1`. For MCP:
+Node.js 22.19 or later is required. Pi is not required for CLI/MCP. Shared configurations should pin adapter versions, including `npm:@divlet/pi@0.0.2` after the candidate is published. For MCP:
 
 ```json
 {
   "mcpServers": {
     "divlet": {
       "command": "npx",
-      "args": ["-y", "@divlet/mcp@0.0.1", "--cwd", "/absolute/path/to/workspace"]
+      "args": ["-y", "@divlet/mcp@0.0.2", "--cwd", "/absolute/path/to/workspace"]
     }
   }
 }
 ```
 
+## Subsequent releases
+
+Keep all five versions aligned and update every exact internal dependency pin plus the lockfile. Validate and freeze a new candidate, then publish the new version in web → core → adapters order under the same integrity/install/auth safeguards. Published `0.0.1` bytes are immutable; fixes require a new version, never an overwrite or unpublish/retry. Git release refs and Pages remain separately authorized delivery surfaces. The first-publication sequence below is retained for its guards and recovery rules, not as a command to rerun the initial release.
+
+## GitHub Actions publishing
+
+The [Release workflow](https://github.com/llblab/divlet/blob/main/.github/workflows/release.yml) uses **npm Trusted Publishing (OIDC)**, not a stored `NPM_TOKEN`. It is manually dispatched from `main` with an existing stable `release_tag`, for example `v0.0.2`. Ordinary pushes, tag pushes and GitHub Release creation do not publish npm packages. Prereleases are not supported by this workflow.
+
+### One-time maintainer setup
+
+1. Push the reviewed workflow and its scripts to `main` only when Git/Pages delivery is authorized. The workflow must exist on the default branch before dispatch. No setup command in this guide creates tags, pushes or publishes automatically.
+2. In GitHub Settings → Environments, create **`npm`** and restrict deployment branches to `main`. Add required reviewers if an approval gate is wanted; a solo maintainer must not enable a self-review prohibition that prevents any approval.
+3. For **each** of `@divlet/web`, `@divlet/core`, `@divlet/cli`, `@divlet/mcp` and `@divlet/pi`, open npm package Settings → Trusted Publisher and add GitHub Actions with these exact, case-sensitive values:
+   | Field | Value |
+   | --- | --- |
+   | Organization or user | `llblab` |
+   | Repository | `divlet` |
+   | Workflow filename | `release.yml` (filename only) |
+   | Environment name | `npm` |
+   | Allowed action | Direct **`npm publish`** |
+   Stage-only permission is not sufficient for this workflow; dist-tag management permission is not needed. Do not add an npm write token to Actions secrets. According to the [npm trusted-publisher guide](https://docs.npmjs.com/trusted-publishers/), a new connection must complete its first successful publish within **two days** or expire: create these bindings near the next intended release, not by republishing `0.0.1` to test them. npm does not validate the connection when it is saved.
+4. After the first successful OIDC release, optionally restrict npm Publishing access to require 2FA and disallow traditional tokens. Make that account change deliberately; this repository does not change account settings or revoke tokens for you.
+
+### Run a release
+
+Align the five manifests, exact pins, lockfile and candidate notes, then create the new stable tag on the intended `main` commit under separate Git authorization. The tag must resolve to **the same SHA as the dispatched `main` revision**. This prevents automatic npm provenance from naming a different source commit than the one used to build the archives. If `main` has advanced past an old tag, this workflow refuses it rather than falsifying provenance or moving a tag.
+
+Select Actions → **Release** → Run workflow, branch `main`, and supply the tag. The equivalent explicit publication action is:
+
+```bash
+gh workflow run release.yml --ref main -f release_tag=v0.0.2
+```
+
+The workflow has three boundaries:
+
+- **Validate and freeze:** Node 22.19.0, clean locked dependencies without install hooks or restored Actions caches, source units/types, the full browser battery, then one build and five hook-free packs. Test the exact frozen archives through the installed CLI/MCP and required isolated Pi 1.5.2 host before uploading the candidate artifact. No OIDC permission is available here.
+- **Publish npm:** A separate hosted runner, the `npm` environment, read-only GitHub history access and `id-token: write`. npm 11.19.0 performs OIDC/provenance with upload transport retries explicitly disabled (`--fetch-retries=0`); a retryable network response cannot silently replay the package PUT. No checkout dependencies, product builds or package lifecycle scripts run in this job. The script rechecks tag/commit, package order and archive SHA-512, checks all five registry names, then publishes web → core → adapters and waits for each exact version/integrity. The whole workflow is serialized without cancelling a running publication.
+- **Verify registry installation:** A fresh non-OIDC job installs by public registry names, checks archive and installed-lock integrity against the frozen manifest, serves the actual board/client/plugin routes, exercises MCP's seven tools and runs the real isolated Pi/font/history cases. It does not reload any active user session or install Pi globally.
+
+### Failure and recovery
+
+Keep the `npm-candidate-<run-id>` archive set and `npm-outcome-<run-id>-<attempt>` receipt. They have 90-day artifact retention; download the evidence if longer retention is required. The publisher records `attempt_started` before invoking npm, `npm_accepted` after success and `registry_verified` only after exact-byte visibility. Registry absence after an attempt means wait/read or stop, never another upload.
+
+Publication jobs **cannot be rerun automatically**: attempts after the first are refused, and a fresh dispatch checks prior runs of this workflow for the same tag, including all job attempts. A previously started publisher requires explicit operator recovery even if no registry version is visible. Do not delete run history or edit the run title to bypass that guard. Runs whose publisher was skipped because validation failed do not count as upload attempts; use a fresh dispatch after fixing validation while preserving the tag/source constraint. A failed registry verification after all uploads is not permission to publish again; rerun only the read-only verification job.
+
+For partial or uncertain outcomes, inspect the original logs, frozen bytes, receipt and fresh registry metadata before choosing an explicit manual recovery or a new aligned version. Do not rebuild a failed release's archives, overwrite accepted versions, infer token rights from `npm whoami`, or run manual and CI publishing concurrently. A local/mock pass proves guard behavior, not a successful live OIDC exchange; activation and the first real CI release remain external checks.
+
 ## Readiness gates
 
 - Freeze one coherent candidate after intended changes settle. Preserve unrelated work; root `dist/`, `web/dist/` and adapter `dist/` are generated publication output, not source development prerequisites.
@@ -45,7 +92,7 @@ Node.js 22.19 or later is required. Pi is not required for CLI/MCP. Shared confi
 - Inspect five tarballs: root, `web`, and each adapter. Check public exports/declarations, native client closure, sole file ownership, bins, manifests, licenses, excluded tests/caches and packaged documentation links. Root documentation links to separately packaged READMEs use absolute GitHub URLs. Repeat builds must not nest outputs or alter bytes.
 - Local release checks install both local web/core tarballs, then adapters, into an empty consumer. They must not fetch unpublished product packages, link checkout code or rescue missing client files from a sibling directory. These checks are not registry-install evidence.
 - Recheck each exact name/version immediately before publication. `E404` is neither reservation nor entitlement; name-similarity policy may appear only during PUT. An unexpected existing version requires an ownership/integrity decision, not an overwrite or automatic retry.
-- Confirm maintainer identity, `@divlet` organization rights, permission to publish all five packages publicly and current npm 2FA requirements. Never store credentials in the repository or request OTPs/tokens in chat. No automatic publication is authorized by this guide.
+- For local publishing, confirm maintainer identity, `@divlet` organization rights, permission to publish all five packages publicly and current npm 2FA requirements. CI instead requires the exact trusted-publisher/environment bindings above; `npm whoami` is not an OIDC permission check. Never store credentials in the repository or request OTPs/tokens in chat. This guide itself authorizes no publication.
 - GitHub origin/homepage configuration proves neither push permission nor an authorized Pages deployment.
 
 ## First-publication sequence
@@ -60,6 +107,8 @@ Only after explicit authorization, using the built, frozen and validated candida
 6. Verify clean registry installations outside the checkout: CLI/MCP help plus an actual board and MCP tool call, and a real isolated Pi profile with `/divlet`, seven tools and the shared skill. No duplicate local adapter, global extension changes or active-session reload is permitted as a shortcut.
 7. Only after registry checks pass, reconcile [BACKLOG.md](../BACKLOG.md), [CHANGELOG.md](../CHANGELOG.md) and release usage with the actual outcome. Create `v0.0.1`/push only if separately authorized. Never describe an attempted or failed publication as successful.
 
+After an upload is attempted, a public `404` is not proof that it is safe to upload again. Persist an attempt checkpoint before invoking npm and record acceptance before waiting for registry visibility. Verify the exact version and frozen integrity, not merely the latest tag; first-publication visibility can take minutes. Retry only reads within a bounded wait. On timeout or an uncertain command outcome, retain the checkpoint and stop; never turn a negative visibility check into another upload. The operator handoff may resume a verified version without republishing it. A failed npm browser-auth callback is distinct from a package lookup failure: inspect its stage and fresh registry state before admitting one explicit package-targeted authentication retry. Preserve the failed attempt in history; a retry flag must not bypass an unreviewed upload outcome or change a published archive.
+
 npm publication is **not atomic across five names**. If a later package fails, report the partial state and resume only missing publications after refreshing registry evidence. Never republish/unpublish successful packages to simulate atomicity; defective immutable bytes require a new aligned version and dependency pins.
 
 The static landing is a separate delivery surface. Its workflow verifies the prepared native example cache and publishes only when its public-file fingerprint changes. npm publication neither enables Pages nor authorizes deployment.

package/docs/testing.md

@@ -81,6 +81,12 @@ The renderer requirement seam has a separate focused gate: `node scripts/source.
 
 `node scripts/source.mjs --test core/tests/html-import.test.js core/tests/import.test.js` checks core-owned HTML admission without an HTML plugin registration, with no style engine, and through explicit `.html`/`.htm` opening, folder-page ingestion and re-import. It covers reported sanitization losses, preserved sources, existing destinations, listing policy, link refusal and unsupported input. It does not establish managed-cache reverse editing; generated-page hand edits remain diagnosed rather than imported.
 
+## CI release checks
+
+`node scripts/source.mjs --test core/tests/npm-release.test.js` tests the Release workflow's OIDC/ref boundary, aligned manifests/lock pins, immutable archive identities, prior-attempt guard and serial publication checkpoints with injected effects. Its fixture packs real local archives without running lifecycle hooks; it never publishes or changes credentials. The mocked accepted-upload/404, mismatched-byte and command/read-failure cases prove refusal behavior, not live npm authorization. A loopback-only mock registry also drives the real npm CLI with the publisher's retry flags: an HTTP 502 must produce exactly one package PUT. The fixture uses an owned dummy token and disables provenance only for that local transport test; no public registry publication occurs.
+
+The existing `core/tests/release/install-smoke.mjs` also accepts `DIVLET_RELEASE_MANIFEST=/absolute/path/manifest.json` to consume and check exact frozen archives instead of rebuilding them. Add `--registry --pi` to fetch packs and install by published names while comparing both pack and installed-lock integrity to that manifest. Without these options the ordinary local-tarball checks remain unchanged. Registry mode requires a manifest and an available real Pi CLI when `--pi` is requested. See [publication](publishing.md#github-actions-publishing) for the three CI jobs and activation gates.
+
 ## Conventions
 
 - Assert actual state (project file, model, accepted version), not only that a request returned.
@@ -98,8 +104,8 @@ The renderer requirement seam has a separate focused gate: `node scripts/source.
 - Tooltip copy: `node web/tests/toolbars.mjs` checks full text, wrapping and no horizontal/vertical clipping for long prose and unbroken references at the viewport edges and centre, at desktop/phone/200%. Keyboard-triggered diagnostic headings also wrap rather than ellipsize. These checks do not remove the existing height budget for diagnostic code excerpts.
 - Narrow sidebar chrome: `npm run test:chrome` drags the real edge to 240px, checks complete tab labels and separate icons/counts (including four-digit diagnostics), and compares open/folded label positions. Board/frame/node context headers must contain their text and stay clear of the prompt. `npm run test:fluid` repeats tab containment, context separation and logical-pixel density classification at phone/200%; `toolbars.mjs` retains keyboard, contrast and touch checks.
 - Agent conversation: `npm run test:chat` checks a bottom-aligned short stack without overflow, chronological/reachable history after overflow, following new messages versus preserving an older reading position, returning to the bottom or sending a new request, fixed composer geometry, composer/activity resizing, folded-pane arrivals and explicit message focus at desktop, phone and phone/200%. It rejects interpreting a queued scroll from an old layout as a reader leaving the bottom. Footer geometry also keeps Send/Queue bottom-right without overlapping controls in selector, key-hint, enabled, disabled and disconnected states, including actual 240px edge resizing.
-- Agent activity: `node scripts/source.mjs web/tests/agent-status.mjs` independently checks the folded spinner/timer/Stop footer alignment, full-width description, scrolling and original-node restoration at 390/820/1500px and 100/150/200%, with a working keyboard Stop. `node web/tests/features.mjs` checks the five-column/three-row grid, original-node identity across Agent/folded docking, a single Stop, busy starting while folded, keyboard stopping from either home, unchanged tab geometry and no idle shell. `node web/tests/fluid.mjs` checks remembered 240/480px desktop widths and phone/200% sheet widths, card/tab alignment, viewport bounds, actual Stop hit testing and inspector clearance. Long unbroken activity must scroll inside the bounded floating text area, not cover Stop/tabs; expanded browsing hides the footer and returning restores it. The in-pane grid retains readable live elapsed time and bottom-right Stop.
-- Inspector ergonomics: `node web/tests/toolbars.mjs && node web/tests/fluid.mjs` checks one vertical flow with no duplicate section tabs, stale order-preference isolation, remembered native disclosures, Space/Enter activation without stealing canvas pan, and reachable/unclipped content at desktop, tablet, phone and 200% interface size. It retains toolbar resizing/overflow, focus-ring, contrast and touch-target checks. The toolbar selector witness uses real 280px resizing, the paired typography row at 320px, and phone/200% to check vertically centred labels/carets and whole single-line values. The layout-wrap suite also composes real Display/Position controls in the reported 246px row and verifies that they stack while their Default values remain whole; wider rows keep both fields side by side. The fluid suite also measures actual/default numeric text against usable input width in element/artboard views, not just wrapper overflow; `node web/tests/layout-wrap.mjs` adds positioned/Effects/typography fields and paired-control coverage across 170–320px containers at 390/768/1280px viewports. It keeps text alignment in Appearance and item alignment in Layout, with attached captions and independent keyboard edits. The appearance suite also verifies the moved control's single home, actual computed text alignment and one-step Undo. `node web/tests/spacing.mjs` additionally checks the four named position/margin/border/padding bands, eight independent spacing editors, canvas hover/focus, one undoable offset editor, signed measured margins, asymmetric borders, fractional content dimensions under both box-sizing modes and transforms, hidden/visible recovery and honest mixed states. Desktop/phone/200% geometry rejects colliding captions/values and horizontal overflow; canvas text metrics check complete authored and computed-only signed/fractional values, with extra band rows rather than clipping. Short-value screenshots retain the compact reference shape; long values may require inspector scrolling. `node web/tests/appearance.mjs` uses the actual resize handle to reach the 280px minimum, checks adjacent radius/border fields and Tab order, border/radius edit isolation, whole single-line weight options and readable two-column artboard bounds. The fluid suite also checks the radius/border pair at 200% phone UI size. `appearance.mjs` additionally drags real Effects labels: Z-index from implicit/explicit auto, signed integer steps, Shift acceleration, keyboard stepping, unchanged click/cancellation/capture-loss state, undo, mixed selection and 200%; opacity/blur keep their numeric defaults. The measured X/Y/W/H block must be the final section after Metadata, survive reload and remain reachable at desktop/tablet/phone/200% widths (`toolbars.mjs`). This is not a complete per-section design audit.
+- Agent activity: `node scripts/source.mjs web/tests/agent-status.mjs` independently checks the folded spinner/timer/Stop footer alignment, full-width description, scrolling and original-node restoration at 390/820/1500px and 100/150/200%, with a working keyboard Stop. Its initial tab baseline waits for the newly visible dock's measured height, so sidebar-close layout is not mistaken for movement caused by an activity update; the before/after activity rectangle comparison remains exact. `node web/tests/features.mjs` checks the five-column/three-row grid, original-node identity across Agent/folded docking, a single Stop, busy starting while folded, keyboard stopping from either home, unchanged tab geometry and no idle shell. `node web/tests/fluid.mjs` checks remembered 240/480px desktop widths and phone/200% sheet widths, card/tab alignment, viewport bounds, actual Stop hit testing and inspector clearance. Long unbroken activity must scroll inside the bounded floating text area, not cover Stop/tabs; expanded browsing hides the footer and returning restores it. The in-pane grid retains readable live elapsed time and bottom-right Stop.
+- Inspector ergonomics: `node web/tests/toolbars.mjs && node web/tests/fluid.mjs` checks one vertical flow with no duplicate section tabs, stale order-preference isolation, remembered native disclosures, Space/Enter activation without stealing canvas pan, and reachable/unclipped content at desktop, tablet, phone and 200% interface size. It retains toolbar resizing/overflow, focus-ring, contrast and touch-target checks. The toolbar selector witness uses real 280px resizing, the paired typography row at its measured content width (at least 320px), and phone/200% to check vertically centred labels/carets and whole single-line values. The layout-wrap suite also composes real Display/Position controls in the reported 246px row and verifies that they stack while their Default values remain whole; wider rows keep both fields side by side. The fluid suite also measures actual/default numeric text against usable input width in element/artboard views, not just wrapper overflow; `node web/tests/layout-wrap.mjs` adds positioned/Effects/typography fields and paired-control coverage across 170–320px containers at 390/768/1280px viewports. It keeps text alignment in Appearance and item alignment in Layout, with attached captions and independent keyboard edits. The appearance suite also verifies the moved control's single home, actual computed text alignment and one-step Undo. `node web/tests/spacing.mjs` additionally checks the four named position/margin/border/padding bands, eight independent spacing editors, canvas hover/focus, one undoable offset editor, signed measured margins, asymmetric borders, fractional content dimensions under both box-sizing modes and transforms, hidden/visible recovery and honest mixed states. Desktop/phone/200% geometry rejects colliding captions/values and horizontal overflow; canvas text metrics check complete authored and computed-only signed/fractional values, with extra band rows rather than clipping. Short-value screenshots retain the compact reference shape; long values may require inspector scrolling. `node web/tests/appearance.mjs` uses the actual resize handle to reach the 280px minimum, checks adjacent radius/border fields and Tab order, border/radius edit isolation, whole single-line weight options and readable two-column artboard bounds. The fluid suite also checks the radius/border pair at 200% phone UI size. `appearance.mjs` additionally drags real Effects labels: Z-index from implicit/explicit auto, signed integer steps, Shift acceleration, keyboard stepping, unchanged click/cancellation/capture-loss state, undo, mixed selection and 200%; opacity/blur keep their numeric defaults. The measured X/Y/W/H block must be the final section after Metadata, survive reload and remain reachable at desktop/tablet/phone/200% widths (`toolbars.mjs`). This is not a complete per-section design audit.
 - Layout contracts are tested with geometry at 390 px, 390 px at 200% interface size and 820 px (`web/tests/fluid.mjs` holds the 200% case; `chrome.mjs` holds the wide and phone layouts without it); errors and statuses must not move controls (`launcher-errors.mjs`, `projects.mjs`).
 - Importer plugins keep their tests beside them; a plugin's tests must pass without any other plugin installed.
 - Screenshots go to the ignored `artifacts/` directory.

package/examples/landing/landing.divlet

@@ -1834,7 +1834,7 @@
         "text-188": {
           "id": "text-188",
           "type": "text",
-          "content": ", supplies the runtime and plugins, with browser assets in @divlet/web and CLI/MCP/Pi adapters. Requires Node.js 22.19 or later.\n      Version 0.0.1 is an early release; the native project format remains a pre-freeze draft.",
+          "content": ", supplies the runtime and plugins, with browser assets in @divlet/web and CLI/MCP/Pi adapters. Requires Node.js 22.19 or later.\n      Version 0.0.2 is an early release candidate; the native project format remains a pre-freeze draft.",
           "metadata": {}
         },
         "text-189": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@divlet/core",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "A browser layout board for agents: one project file, live frames, reusable components; the same tools through Pi and MCP",
   "type": "module",
   "license": "MIT",
@@ -132,7 +132,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@divlet/web": "0.0.1",
+    "@divlet/web": "0.0.2",
     "@tailwindcss/node": "^4.1.0",
     "@xmldom/xmldom": "0.9.12",
     "lucide-static": "1.67.0",

package/skills/divlet/SKILL.md

@@ -36,7 +36,7 @@ Register it once and the tools survive the session — a project-scoped `.mcp.js
 { "mcpServers": { "divlet": { "command": "npx", "args": ["-y", "@divlet/mcp", "--cwd", "/absolute/path/to/the/workspace"] } } }
 ```
 
-Pin a version in a shared repository (`@divlet/mcp@0.0.1`) so every machine runs the same board. Diagnostics go to stderr;
+Pin a version in a shared repository (`@divlet/mcp@0.0.2`) so every machine runs the same board. Diagnostics go to stderr;
 stdout is the MCP stream. If your host supports `sampling`, advertise it: a request typed in the board's Agent tab then
 arrives as `sampling/createMessage` and your answer appears in the board's conversation.