@dzhechkov/harness-cli 0.8.23 → 0.8.25

package/dist/cli.js

@@ -3,7 +3,8 @@
  *
  * @packageDocumentation
  */
-import { appendFileSync, chmodSync, closeSync, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { parseNpmPackInventory } from '@dzhechkov/harness-core';
+import { appendFileSync, chmodSync, closeSync, constants as fsConstants, cpSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, writeSync } from 'node:fs';
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { request as httpsRequest } from 'node:https';
@@ -19,11 +20,11 @@ import { isDeepStrictEqual } from 'node:util';
 import { JOURNAL_KINDS, formatLine, parseLine, selectWindow, appendWitnessed } from '@dzhechkov/harness-core';
 import { appendRunEvent, readRunRegistry, liveParents, liveness, probePid, settleDeadRuns, planRegistryArchive, planWorktreeCleanup, renderCleanupPlan, worktreeRemovalsToApply } from '@dzhechkov/harness-core';
 import { openRound, closeRound, listRounds, parseCodexTokens, classifyRoundExecOutcome, buildRoundExecRow, } from '@dzhechkov/harness-core';
-import { createSkill, getSkillInfo, listSkillsDetailed, formatSkillLoadFailures, formatSkillApplyFailures, resolveTargetName, formatTargetProblem, formatTargetAliasNote, TARGET_NAMES_SORTED, runDoctor, runInit, discoverSkillIds, resolveSelection, formatSelectRefusal, runIntegrationsVerify, resolvePackageSkillRoots, PACKAGE_SKILL_LAYOUTS, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, discoverVerifiablePackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, runSyncAgentsPolicy, runSyncCodexHooks, resolveCodexHome, withNamedLockSync, 
+import { createSkill, getSkillInfo, listSkillsDetailed, formatSkillLoadFailures, formatSkillApplyFailures, resolveTargetName, formatTargetProblem, formatTargetAliasNote, TARGET_NAMES_SORTED, runDoctor, runInit, discoverSkillIds, resolveSelection, formatSelectRefusal, runIntegrationsVerify, resolvePackageSkillRoots, PACKAGE_SKILL_LAYOUTS, benchmarkSkill, benchmarkSkills, scanMcp, reconcileCapabilities, RECONCILE_BANNER, buildRegistry, discoverSkillPackDirs, discoverVerifiablePackDirs, checkUpstream, compareSkills, checkAllUpstream, sweepSkillDrift, syncCanonicalSkill, checkUpgrades, discoverPackages, discoverSourcePackages, fetchAllDownloads, filterByCategory, pretrain, recommend, generatePlugin, publishPackages, runSetup, memoryBackendSourceLabel, runMigrate, searchRegistry, runSync, runVerify, runInitAgentsMd, runInitGeminiMd, runSyncAgentsPolicy, runSyncCodexHooks, resolveCodexHome, withNamedLockSync, 
 // dz workflow run (feature dz-workflow-run): the pure scheduler + the dispatch adapters.
 TRACE_RUNID_RE, WF_RUN_OWNER_HOST, preflight, runWorkflow, makeClaudePDispatcher, makeCodexExecDispatcher, NamedLockTimeoutError, NamedLockCompromisedError, POLICY_SOURCES, detectPolicyDrift, hasPolicyFence, TARGET_NAMES, buildParityMatrix, computeParity, PARITY_FEATURES, downgradeForStaleEvidence, findStaleTranscriptEvidence, TARGET_CAPABILITIES, TARGET_SHORT_LABELS, applyLegStatus, applyLegReasonMessage, resolveAgentdbPath, WORKFLOW_TEMPLATES_RETIRED_MESSAGE, parsePlan, isParseErrors, validatePlan, normalizePlan, planDigest, toTraceProjection, renderPlan, mergeRender, lint, lintExitCode, LOOP_BLOBS, parseTrace, assembleTimeline, runInvariants, deriveAttestation, stampAttestation, corroborate, NOT_WITNESSED, renderTimelineHtml, importEcc, recordPattern, recordLessonForms, normalizeLessonForms, resolveLearningBackend, storeStats, consolidateSessions, pruneNoisePatterns, lessonDeltaReport, removePatternsByIds, snapshotStore, recallHybrid, teachGuard, mirrorPatternsToVector, mirrorEntriesToVector, patternVectorEntry, readMemoryLearningConfig, promotePatterns, quarantineExpiryCandidates, pruneQuarantinePatterns, clearAgentdbQuarantine, vectorMirrorEnabled, vectorTierStatus, resolveVectorEngine, reindexVectorStore, harmonizeVectorStore, importRvfCheckpoint, renderFeatureAdrPhaseLine, statuslineData, countLearningStoreRowsReadonly, readStoreMark, writeStoreMark, resetStoreMark, checkStoreHealth, storeGuardPath, storeSnapshotPath, writeFeatureAdrState, writeFeatureAdrStateDetailed, CHECKPOINT_STAGES, estimateEta, extractStageSamples, formatEta, parseCheckpointLines, segmentRun, computeSpendReport, deriveCostLedger, planLedgerBackfill, listCostLedgerRuns, resolveLedgerRunId, AMBIGUOUS, stampCheckpointLine, LEDGER_FILL_SOURCE, renderCostLedger, verifyCostLedgerReport, writeCostLedgerJsonl, COST_LEDGER_SCOPE, spendReport, claimCheck, summarize, BUNDLED_SLOP_REGISTRY_URL, DEFAULT_SLOP_CONFIG, parseSlopRegistry, slopLint, validateSlopLintConfig, queryBookKnowledge, loadStorePatternsSync, patternRecordId, patternIdentityOf, mergeLessonMatchedForms, SWARM_BRIEF_CONTRACT, checkSwarmBrief, visibleText, loadStoreRecords, findExactLesson, recordToPattern, bundleSkills, brainHome, brainAgentdbPath, listPreReindexSnapshots, rotatePreReindexSnapshots, scanSnapshotDir, listBrain, bookKbPath, promoteProjectToBrain, updateBrainSource, queryBrain, groundPrompt, expandKu, reindexBrainVectors, buildPrimer, exportBrainSlice, importBrainSlice, registerKusToBrain, RECALL_USAGE_LOG_RELATIVE, RECALL_USAGE_LOG_MAX_BYTES, parseRecallUsageLog, buildRecallUsageReport, EVENT_CHAIN_TAIL_BYTES, EMPTY_LOG_TAIL, readTailInfo, appendChainedLines, verifyEventChainText, classifyChainDefects, CHAINED_JOURNALS, buildManifest, buildSbom, resolveTrustRoot, decideVerifyPolicy, generateSigningKeypair, appendTransition, evaluateGuard, resolveRules, auditRecord, guardExitCode, DEFAULT_RULES, parsePnpmLockImporters, scannableStubPath, 
 // guard-promotion (feature guard-promotion, scout idea #1)
-assembleCandidates, renderPromotionReport, renderPromotionAdr, normalizePromotionState, nextPromotionState, recordPromotionRunEvidence, isLessonRuleContentAnchor, isOffsetIsoTimestamp, globMatch, promotionAdrRelPath, DEFAULT_WINDOW_DAYS, DEFAULT_PERIODS, MAX_CONTENT_FETCHES, BUILTIN_COVERAGE, decideProvenance, isInsideTree, signManifest, verifyManifest, hashPackBytes, rewriteWorkspaceSpecs, listPackFiles, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, resolveScanTailTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, runRetroTailScan, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, classifyExecutionEvidence, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, harvestStageOutcomes, recommendModels, planFeed, unfedRuns, GRADE_SUCCESS_FLOOR, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, scanSkillsLayout, declaredPluginSurface, parseInitFacts, verifyRegistration, buildContentProbePrompt, classifyContentProbe, renderContentProbe, findNonRegistrableSkillDirs, assembleCompoundingReport, buildDeadwoodReport, compactCmdUsageIfNeeded, measureCmdUsageDepthDays, recordCommandInvocation, resolveCmdUsageRoot, renderDeadwoodReport, CMD_USAGE_LOG_RELATIVE, banditStats, narrowBanditReport, renderBanditHealth, 
+assembleCandidates, renderPromotionReport, renderPromotionAdr, normalizePromotionState, nextPromotionState, recordPromotionRunEvidence, isLessonRuleContentAnchor, isOffsetIsoTimestamp, globMatch, promotionAdrRelPath, DEFAULT_WINDOW_DAYS, DEFAULT_PERIODS, MAX_CONTENT_FETCHES, BUILTIN_COVERAGE, decideProvenance, isInsideTree, signManifest, verifyManifest, hashPackBytes, rewriteWorkspaceSpecs, detectSiblingDrift, planPackedInstallSmoke, judgePackedInstallSmoke, listPackFiles, listSignablePackFiles, assertKeyOutsideTree, decidePublishGate, collectPackageFacts, planReleaseGates, selectAffectedPackages, classifyGateExecutions, buildFailureIssue, buildReleaseNotes, releaseTagName, firstOutputLine, formatPublishError, MANIFEST_NAME, SBOM_NAME, buildArchitectureMap, renderMapHuman, findArchitectureDrift, renderDriftReport, scanWorkspacePackages, loadSubsystemManifest, loadProductVision, checkFeatureAgainstArchitecture, renderArchCheck, planProjectSkills, guidanceForStage, renderInjectionReport, analyzeCorpus, renderRakeReport, renderCriticSection, rakeAsLesson, rakeReward, DEFAULT_RAKE_THRESHOLDS, streamSessionEvents, findLatestTranscript, resolveScanTailTranscript, detectProcessRakes, buildRetro, renderRetro, retroLessonText, PROCESS_SIGNATURES, RETRO_DOMAIN, runRetroTailScan, scanForSetup, buildSetupPlan, scaffoldFromSpec, renderScaffoldPreview, readExistingForScaffold, assembleChallengeContext, buildChallengeBrief, planDiscriminationCheck, classifyDiscrimination, classifyExecutionEvidence, pickAdversaryModel, CHALLENGE_QUESTIONS, loadOutcomes, renderOutcomes, statsForKey, selectAutoCost, recordProvisional, finalizeOutcome, harvestStageOutcomes, recommendModels, planFeed, unfedRuns, GRADE_SUCCESS_FLOOR, COST_LADDER, splitScenarios, budgetPlan, selectWinner, proseScopeOk, renderProseDiff, readScenarioIds, DEFAULT_MAX_JUDGE_RUNS, collectDeliveryFacts, planDeliveryCheck, renderDeliveryBrief, classifyDelivery, isUsablePlaneResult, renderDeliveryReview, scanSkillsLayout, declaredPluginSurface, parseInitFacts, verifyRegistration, buildContentProbePrompt, classifyContentProbe, renderContentProbe, findNonRegistrableSkillDirs, assembleCompoundingReport, buildDeadwoodReport, compactCmdUsageIfNeeded, measureCmdUsageDepthDays, recordCommandInvocation, resolveCmdUsageRoot, renderDeadwoodReport, CMD_USAGE_LOG_RELATIVE, banditStats, narrowBanditReport, renderBanditHealth, 
 // Cold-vs-warm EPOCH RUNNER (feature epoch-replay) — orchestrates + scores, never calls a model.
 replayableInstances, buildWorkOrder, buildJudgePrompts, unblindJudgments, verifyWorkOrder, isValidMargin, DIGEST_HONEST_SCOPE, scoreEpochReplay, generateMockOutcomes, renderEpochReplayResult, renderWorkOrderSummary, renderJudgePromptsSummary, WORK_ORDER_KIND, DEFAULT_MOCK_N, DEFAULT_MOCK_SEED, scoreRun, readQeGrade, scoreReceiptToAggregateRow, readScoreAggregateRows, dedupeScoreAggregateRows, buildScoreAggregateReport, renderScoreAggregateReport, recapWindow, decideHorizon, withinWindow, buildRecap, renderRecap, parseSourceManifest, tgPostHtmlIssues, tgVisibleLength, decideTgSend, TG_TEXT_LIMIT, countRecallEventsForRun, unknownFlagNotice, mirrorWriterExplanation, mirrorWriterReason, appendRecallUsage, closenessLine, anyAboveFloor, decideNameCheck, renderNameCheck, exportedNamesIn, dispatchedCommandsIn, decideSourceProvenance, renderSourceProvenance, REFUSED_HORIZONS, renderScorecard, renderCompoundingReport, readReinforcementState, readQuarantineState, registrationExitCode, renderRegistrationReport, 
 // Smart Backlog (feature smart-backlog) — goal-directed idea pipeline over the Brain vector engine.
@@ -5443,7 +5444,14 @@ async function cmdSetup(options, flags, cwd, write, writeErr) {
     write(`║  2. Preset: ${preset.padEnd(40)}║`);
     // Step 3: Run setup (hooks + memory + config)
     write(`║  3. Setting up learning environment...                ║`);
-    const memoryOpt = options.get('memory');
+    const memoryOptRaw = options.get('memory');
+    // FR-1/T3 (feature `setup-backend-from-config`): pass `--memory` through AS-IS — `agentdb`,
+    // `jsonl`, or `undefined` — never collapsed to `undefined` on anything but agentdb. The prior
+    // `memoryOpt === 'agentdb' ? 'agentdb' : undefined` made an explicit `--memory jsonl` INDISTINCT
+    // from "no flag at all", so `runSetup`'s config-aware default (FR-2's downgrade path) could never
+    // fire from the CLI. An unrecognised value (neither `agentdb` nor `jsonl`) still reads as
+    // "no flag" — the same permissive fallback as before.
+    const memoryOpt = memoryOptRaw === 'agentdb' ? 'agentdb' : memoryOptRaw === 'jsonl' ? 'jsonl' : undefined;
     // ADR-001 Decision 2 (feature setup-installs-apply-leg): bake THIS CLI's own installed
     // @dzhechkov/harness-core into the generated apply-leg hooks — the installation actually running
     // `dz setup` is the one a consumer's project can always reach, unlike a hard-coded npm prefix
@@ -5461,13 +5469,16 @@ async function cmdSetup(options, flags, cwd, write, writeErr) {
         projectRoot,
         target,
         preset,
-        memory: memoryOpt === 'agentdb' ? 'agentdb' : undefined,
+        memory: memoryOpt,
         noHooks: flags.has('no-hooks'),
         noMemory: flags.has('no-memory'),
         force: flags.has('force'),
         installDriver: flags.has('install-driver'),
         coreDistDir,
     });
+    // FR-3: name the source of the backend actually used — never left to be inferred from the flag
+    // alone, since the backend may now come from `.dz/config.json` or the jsonl default.
+    write(`dz setup: memory backend: ${setupResult.memoryBackend} (${memoryBackendSourceLabel(setupResult.memoryBackendSource)})`);
     for (const step of setupResult.steps) {
         const icon = step.status === 'done' ? '✓' : step.status === 'skipped' ? '○' : '✗';
         write(`║     ${icon} ${step.name.padEnd(25)} ${step.detail.slice(0, 20).padEnd(20)}║`);
@@ -5518,7 +5529,11 @@ async function cmdSetup(options, flags, cwd, write, writeErr) {
     // not from package presence — a skipped hook/MCP step must not let the summary claim a store
     // nothing writes to (audit code#3).
     const wiring = setupResult.steps.find((s) => s.name === 'agentdb wiring');
-    const backendLabel = memoryOpt === 'agentdb'
+    // Keyed off the RESOLVED backend (setupResult.memoryBackend), not the raw flag: FR-1 means the
+    // flag can be absent while the actual backend is still agentdb (config-sourced) — the old
+    // `memoryOpt === 'agentdb'` check would have mislabeled that run as jsonl right after fixing the
+    // underlying steps to keep it agentdb.
+    const backendLabel = setupResult.memoryBackend === 'agentdb'
         ? (wiring?.status === 'done' ? 'agentdb (.dz/agentdb.db + .dz/agentdb-mcp.db, separate stores)' : `agentdb INCOMPLETE — see setup steps`)
         : 'sessions.jsonl + patterns.jsonl';
     write(`║  Learning: ${backendLabel.padEnd(41)}║`);
@@ -6208,7 +6223,99 @@ function mirrorFailureMessage(error) {
         return error.message.trim().split(/\r?\n/, 1)[0] ?? 'mirror command failed';
     return String(error);
 }
-function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner) {
+/**
+ * Scratch root for the packed-install smoke's pack/install dirs (feature
+ * publish-sibling-drift-gate). MEASURED 2026-09-13: npm resolves a LOCAL tarball path (`npm
+ * install <path-to.tgz>`) relative to `os.tmpdir()` — not to cwd — whenever that path sits
+ * INSIDE `os.tmpdir()`, and does the same for the install dir; put pack and install dirs both
+ * under `tmpdir()` and the recorded `file:` spec loses its `tmpdir()` prefix entirely (reproducer:
+ * a fresh `npm pack <src> --pack-destination "$T/pack"` + `cd "$T/install" && npm install
+ * "$T/pack/x.tgz"` with `$T` under `/tmp` silently installs NOTHING — "changed 1 package", empty
+ * node_modules, `reify moves {}` in `--loglevel silly`; the identical commands under `/var/tmp`
+ * install correctly). A directory outside `os.tmpdir()` sidesteps the quirk entirely.
+ */
+function packedInstallScratchRoot() {
+    return existsSync('/var/tmp') ? '/var/tmp' : tmpdir();
+}
+/**
+ * FR-1 (feature release-smoke-staged-pack): stage every target's `package.json` exactly like a
+ * live publish packs it — `workspace:*` sibling specs rewritten to the exact sibling version
+ * (`rewriteWorkspaceSpecs`), `scripts.prepublishOnly` dropped — run `fn`, then ALWAYS restore the
+ * original bytes in a `finally`, whatever `fn` does or throws. A restore failure is reported
+ * through `write` (with the path), never swallowed — the "absence of a receipt is not success"
+ * rule this file follows everywhere else.
+ *
+ * `cmdPublish`'s dry-run preview and `cmdRelease`'s packed-install-smoke `pack` steps both go
+ * through this ONE helper, so the two doors that ask "what would the registry receive?" pack the
+ * exact same bytes (MEASURED 2026-09-13 16:05: `dz release` packed the live `workspace:*`
+ * package.json and its smoke install died with EUNSUPPORTEDPROTOCOL — `dz publish`'s preview
+ * already staged around this and release never got that).
+ */
+function withStagedPackageJson(targets, workspaceVersions, write, fn, label = 'dz') {
+    // Lead edits after Codex review (2026-09-13, findings 1/5/6): every write — the staged text and
+    // the restore — goes through a sibling temp file + rename, so a reader never sees a truncated
+    // package.json; a restore that FAILS is an error the caller must see (thrown after fn, or attached
+    // to fn's own error), never a warning that lets a run "succeed" on a damaged tree; and the
+    // diagnostic keeps the calling command's name (`label`).
+    const atomicWrite = (path, text) => {
+        // Codex round 2: an EXCLUSIVE, randomized sibling temp — never a shared pid-named file
+        const tmp = `${path}.${process.pid}.${randomBytes(6).toString('hex')}.staged.tmp`;
+        writeFileSync(tmp, text, { flag: 'wx' });
+        renameSync(tmp, path);
+    };
+    const stagedOriginals = [];
+    let fnError;
+    let fnThrew = false;
+    try {
+        for (const p of targets) {
+            const pkgJsonPath = join(p.dir, 'package.json');
+            const original = readFileSync(pkgJsonPath, 'utf-8');
+            const rewritten = JSON.parse(rewriteWorkspaceSpecs(original, workspaceVersions));
+            const scripts = rewritten['scripts'];
+            if (scripts !== null && typeof scripts === 'object' && !Array.isArray(scripts))
+                delete scripts['prepublishOnly'];
+            stagedOriginals.push({ path: pkgJsonPath, text: original });
+            atomicWrite(pkgJsonPath, JSON.stringify(rewritten, null, 2) + '\n');
+        }
+        return fn();
+    }
+    catch (err) {
+        fnThrew = true;
+        fnError = err;
+        throw err;
+    }
+    finally {
+        const restoreFailures = [];
+        for (const o of stagedOriginals) {
+            try {
+                atomicWrite(o.path, o.text);
+            }
+            catch (err) {
+                const msg = `${label}: ✗ could not restore ${o.path} after staged packing: ${formatPublishError(err)} — the tree is left STAGED, restore it by hand`;
+                try {
+                    write(msg);
+                }
+                catch { /* a throwing writer must not mask the restore failure */ }
+                restoreFailures.push(msg);
+            }
+        }
+        if (restoreFailures.length > 0) {
+            // Codex round 2: one aggregate error carrying BOTH fn's own failure (if any) and the restore
+            // failures — never a bare message assignment that could itself throw out of finally.
+            const fnPart = fnThrew ? `\n(during: ${fnError instanceof Error ? fnError.message : String(fnError)})` : '';
+            // eslint-disable-next-line no-unsafe-finally -- a damaged tree must not read as success
+            throw new Error(`${restoreFailures.join('\n')}${fnPart}`);
+        }
+    }
+}
+function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner, siblingDriftFetcher, packedInstallRunner, publishExecRunner, gateAuditFsLayer, 
+/**
+ * AM-5 (feature publish-gate-audit-durable): test seam for the sibling-drift gate's `npm pack
+ * --dry-run --json` call — production leaves it unset (real `execFileSync`). Takes the package
+ * dir, returns raw stdout, or THROWS to simulate a real `npm` failure — a test can then prove the
+ * failure reaches `parseNpmPackInventory`'s caller as `unavailable`, never a real subprocess.
+ */
+npmPackRunner) {
     const json = flags.has('json');
     // Under --json stdout carries exactly one JSON document, so every human line — guard notes, refusals,
     // progress — goes to stderr instead of being dropped: a refusal that prints nothing is the silent
@@ -6216,9 +6323,9 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner) {
     const write = json ? (line) => { process.stderr.write(`${line}\n`); } : writeOutput;
     // Reject unknown flags/options so a typo (e.g. `--dry-rum`) can NEVER be
     // silently swallowed and flip the command into live-publish mode.
-    const allowedFlags = new Set(['dry-run', 'no-dry-run', 'yes', 'confirm', 'bump-only', 'help', 'require-signing', 'provenance', 'no-provenance', 'json', 'no-mirror']);
+    const allowedFlags = new Set(['dry-run', 'no-dry-run', 'yes', 'confirm', 'bump-only', 'help', 'require-signing', 'provenance', 'no-provenance', 'json', 'no-mirror', 'allow-sibling-drift', 'include-drifted']);
     const allowedOptions = new Set(['filter', 'claim-check', 'no-guard', 'sign-key', 'mirror-cmd']);
-    const allowedHelp = '  allowed: --dry-run (default), --yes/--confirm/--no-dry-run (go live), --bump-only, --filter <substr>, --claim-check <off|warn|error>, --mirror-cmd <cmd>, --no-mirror, --no-guard "<reason>" (skip the guard pre-flight; logged)';
+    const allowedHelp = '  allowed: --dry-run (default), --yes/--confirm/--no-dry-run (go live), --bump-only, --filter <substr>, --claim-check <off|warn|error>, --mirror-cmd <cmd>, --no-mirror, --no-guard "<reason>" (skip the guard pre-flight; logged), --allow-sibling-drift (override the sibling-drift gate; logged), --include-drifted (auto-extend the batch with a drifted sibling)';
     for (const flag of flags) {
         if (!allowedFlags.has(flag)) {
             write(`dz publish: unknown option --${flag}`);
@@ -6308,8 +6415,370 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner) {
     const bumpOnly = flags.has('bump-only');
     // SAFETY: dry-run is the DEFAULT. A real publish requires an EXPLICIT opt-in
     // via --yes, --confirm, or --no-dry-run. Without one, we never bump or publish.
+    // Computed HERE (moved up from below the gates, AM-5) so both gates can see it: a dry run keeps
+    // previewing packed-install with the CURRENT pre-bump tarball (nothing to compare a LIVE publish
+    // against yet), while a live run defers the real packed-install-smoke into `publishPackages`'s
+    // `packedTransport` — the one that tests the ACTUAL bytes about to ship (AM-1).
     const wantsLive = flags.has('yes') || flags.has('confirm') || flags.has('no-dry-run');
     const dryRun = !wantsLive;
+    // ── FR-1..FR-4 — sibling-drift gate, then packed-install smoke (feature
+    // publish-sibling-drift-gate, ADR-001). The sibling-drift gate runs before the signature gate
+    // and the live-publish banner (so a --include-drifted-expanded batch is checked and shown too).
+    // AM-5: on a DRY RUN both gates always print their verdict, even once sibling-drift already
+    // blocks — the whole point of a preview is full information before anything ships. On a LIVE
+    // run, sibling-drift still refuses immediately (packing/installing a doomed batch wastes real
+    // time); its own packed-install smoke is deferred into `publishPackages`'s `packedTransport`
+    // (AM-1) — the one gate that tests the tarball bytes actually handed to `npm publish`.
+    const allowSiblingDrift = flags.has('allow-sibling-drift');
+    const includeDrifted = flags.has('include-drifted');
+    const allPackages = discoverPackages(cwd);
+    const workspaceVersions = new Map(allPackages.map((p) => [p.name, p.version]));
+    const workspaceDirs = new Map(allPackages.map((p) => [p.name, p.dir]));
+    const matchesFilter = (pk) => filter === undefined || filter.length === 0 || filter.some((f) => pk.name.includes(f) || pk.dir.includes(f));
+    let targets = allPackages.filter(matchesFilter);
+    let batchNames = new Set(targets.map((p) => p.name));
+    // Production default: `npm pack <name>@<version>` into a temp dir, extracted. Tests inject a
+    // local directory (ADR-001, "fetchPublished … в тестах — локальный каталог").
+    const fetchPublished = siblingDriftFetcher ??
+        ((name, version) => {
+            try {
+                const tmp = mkdtempSync(join(tmpdir(), 'dz-sibling-drift-'));
+                execSync(`npm pack ${name}@${version} --pack-destination ${JSON.stringify(tmp)}`, {
+                    stdio: 'pipe',
+                    encoding: 'utf-8',
+                    timeout: 60_000,
+                });
+                const tarball = readdirSync(tmp).find((f) => f.endsWith('.tgz'));
+                if (tarball === undefined)
+                    return null;
+                execSync(`tar -xzf ${JSON.stringify(join(tmp, tarball))} -C ${JSON.stringify(tmp)}`, { stdio: 'pipe', timeout: 60_000 });
+                return { dir: join(tmp, 'package') };
+            }
+            catch {
+                return null;
+            }
+        });
+    // AM-4: `npm pack --dry-run --json` is a real subprocess — cache it for the lifetime of this
+    // ENTIRE run (keyed by resolved dir), NOT per package being checked (round-1 review, finding 5):
+    // the cache used to be re-created inside the per-package loop body, so two different dependents
+    // of the SAME sibling packed it twice. `npmPackRunner` (AM-5) is a test seam — production leaves
+    // it unset and runs the real subprocess; a test injects a stub that throws to prove a real `npm`
+    // failure reaches the caller as `unavailable`, without spawning anything.
+    // Lead fix after the fix-round's live dry-run (2026-09-14 01:02, MEASURED on the hub): the
+    // workspace side is now PACKED BY THE LIVE TRANSPORT — `pnpm pack` into a per-run temp dir,
+    // unpacked, and handed to core as a `packedDir` that core hashes with the SAME full walk it uses
+    // for the published tarball. `npm pack --dry-run --json` (kept behind the `npmPackRunner` test
+    // seam) never lists the LICENSE pnpm synthesises from the workspace root into a package whose own
+    // tree has none, so two siblings unchanged since publication (harness-presets, scout) read as
+    // "LICENSE only in the published copy" — a false drift the fix-round's inventory could not see.
+    // Honest limit: the seam path (tests) still parses npm's JSON; only production takes the pnpm path.
+    const npmPackInventoryCache = new Map();
+    let packTmpDir;
+    const npmPackInventory = (dir) => {
+        const key = resolve(dir);
+        const hit = npmPackInventoryCache.get(key);
+        if (hit !== undefined)
+            return hit;
+        let out;
+        try {
+            if (npmPackRunner !== undefined) {
+                out = parseNpmPackInventory(npmPackRunner(dir));
+            }
+            else {
+                packTmpDir ??= mkdtempSync(join(tmpdir(), 'dz-drift-pack-'));
+                out = { packedDir: extractIntoTempDir(dir, mkdtempSync(join(packTmpDir, 'p-'))).dir };
+            }
+        }
+        catch (err) {
+            const how = npmPackRunner !== undefined ? 'npm pack --dry-run --json' : 'pnpm pack';
+            out = { unavailable: `${how} failed: ${err.message.split('\n')[0]}` };
+        }
+        npmPackInventoryCache.set(key, out);
+        return out;
+    };
+    const localInventorySource = npmPackRunner !== undefined ? 'npm-pack' : 'pnpm-pack';
+    // AM-3 (Codex round-1 review, finding 4, high): sibling-drift audit records are EXACTLY one per
+    // package per rule per RUN. The old code appended one JSONL record per SIBLING a package depends
+    // on (a package with two drifted deps wrote two rows under the same rule), and the `unavailable`
+    // branch without `--allow-sibling-drift` wrote NO record at all. Every sibling outcome for a
+    // package is now aggregated first (`pkParts`/`pkVerdict`/`pkOverrideUsed`) and written ONCE —
+    // `block` if any sibling blocks, else `warn` if the only issues were resolved via
+    // `--allow-sibling-drift`, else `pass` — with a detail naming every sibling and its status.
+    // `siblingDriftAudited` guarantees the single write even though `--include-drifted`'s fixed-point
+    // loop can revisit the SAME package across rounds: a package's own `dependencies` never change
+    // between rounds, so a later round can only ever re-derive a SUBSET of what the first pass
+    // already covered (its siblings that drifted got folded into the batch and are now skipped).
+    const siblingDriftAudited = new Set();
+    let driftBlocked = 0;
+    const extraBatch = new Set();
+    // AM-2: --include-drifted must reach a FIXED POINT over transitive drifted siblings — a sibling
+    // folded into the batch can itself depend on a drifted sibling outside it, and the round-1 review
+    // (finding 2) showed the single pass never re-checked an EXPANDED batch's own new edges. Capped at
+    // `allPackages.length + 1` rounds (the plan's own "цикл с потолком = число пакетов").
+    const maxRounds = allPackages.length + 1;
+    // Codex round-3 (2026-09-14): the per-run pack scratch is released in a `finally`, so an
+    // exception thrown while hashing or auditing cannot leak a `dz-drift-pack-*` dir under tmpdir.
+    try {
+        for (let round = 0; round < maxRounds; round++) {
+            let addedThisRound = false;
+            for (const pk of targets) {
+                let manifestObj;
+                try {
+                    manifestObj = JSON.parse(readFileSync(join(pk.dir, 'package.json'), 'utf-8'));
+                }
+                catch (err) {
+                    // AM-3: an unreadable/invalid package.json for a BATCH package is an input this HARD gate
+                    // cannot build — it must BLOCK, never silently degrade to "no dependencies" (which used to
+                    // read as a clean n/a). AND (finding 4) the non-override branch below used to print a
+                    // BLOCKED line with NO audit record behind it — an `unavailable` outcome is logged exactly
+                    // like every other outcome, override or not.
+                    const reason = `package.json unreadable/invalid (${err.message.split('\n')[0]})`;
+                    if (!siblingDriftAudited.has(pk.name)) {
+                        siblingDriftAudited.add(pk.name);
+                        if (allowSiblingDrift) {
+                            const wrote = appendPublishGateAudit(cwd, 'sibling-drift', 'warn', `${pk.name}: ${reason} — allowed via --allow-sibling-drift`, [{ name: pk.name, version: pk.version }], '--allow-sibling-drift', gateAuditFsLayer);
+                            if (wrote.logged) {
+                                write(`dz publish: ⚠ sibling drift check unavailable for ${pk.name} (${reason}) — allowed via --allow-sibling-drift (logged)`);
+                            }
+                            else {
+                                write(`dz publish: BLOCKED ${pk.name} — sibling drift check unavailable for ${pk.name} (${reason}), and the override could not be recorded (audit write failed: ${wrote.reason ?? 'unknown reason'}); refusing rather than proceeding unlogged`);
+                                driftBlocked++;
+                            }
+                        }
+                        else {
+                            const wrote = appendPublishGateAudit(cwd, 'sibling-drift', 'block', `${pk.name}: ${reason}`, [{ name: pk.name, version: pk.version }], undefined, gateAuditFsLayer);
+                            write(`dz publish: BLOCKED ${pk.name} — sibling drift check unavailable (${reason}); add --allow-sibling-drift to override (logged) or fix the manifest${auditSuffix(wrote)}`);
+                            driftBlocked++;
+                        }
+                    }
+                    continue;
+                }
+                const deps = manifestObj?.dependencies ?? {};
+                const peerDeps = manifestObj?.peerDependencies ?? {};
+                const optionalDeps = manifestObj?.optionalDependencies ?? {};
+                // AM-6: a package with no EXTERNAL sibling to check at all is n/a for THIS gate — recorded as
+                // a pass note ("no external siblings"), not silence (FR-6 compatibility: this branch prints
+                // nothing to stdout, matching the pre-existing behavior). "External" covers BOTH "no
+                // workspace: dependency declared" and "every workspace: dependency is inside THIS batch"
+                // (publishing fresh, nothing stale to drift from) — both used to leave this package with no
+                // audit record at all when every dep resolved to the second case.
+                const anyWorkspaceDep = [...Object.values(deps), ...Object.values(peerDeps), ...Object.values(optionalDeps)]
+                    .some((spec) => String(spec).startsWith('workspace:'));
+                const pkParts = [];
+                let pkVerdict = 'pass';
+                let pkOverrideUsed = false;
+                if (anyWorkspaceDep) {
+                    const drifts = detectSiblingDrift({
+                        localInventory: npmPackInventory,
+                        localInventorySource,
+                        dependencies: deps,
+                        peerDependencies: peerDeps,
+                        optionalDependencies: optionalDeps,
+                        workspaceVersions,
+                        workspaceDirs,
+                        batch: batchNames,
+                        fetchPublished,
+                    });
+                    for (const r of drifts) {
+                        if (r.status === 'same') {
+                            pkParts.push(`${r.name}@${r.version}: same`);
+                            write(`dz publish: ✓ sibling drift: none (${r.name}@${r.version} = workspace)`);
+                        }
+                        else if (r.status === 'unavailable') {
+                            if (allowSiblingDrift) {
+                                pkParts.push(`${r.name}@${r.version}: unavailable (${r.reason}) — allowed via --allow-sibling-drift`);
+                                if (pkVerdict !== 'block')
+                                    pkVerdict = 'warn';
+                                pkOverrideUsed = true;
+                            }
+                            else {
+                                pkParts.push(`${r.name}@${r.version}: unavailable (${r.reason})`);
+                                pkVerdict = 'block';
+                                write(`dz publish: BLOCKED ${pk.name} — sibling drift check unavailable (${r.reason}); add --allow-sibling-drift to override (logged) or check network/registry access`);
+                                driftBlocked++;
+                            }
+                        }
+                        else if (includeDrifted) {
+                            pkParts.push(`${r.name}@${r.version}: drift (${r.changedFiles.length} file(s)) — auto-included via --include-drifted`);
+                            if (!batchNames.has(r.name) && !extraBatch.has(r.name)) {
+                                extraBatch.add(r.name);
+                                addedThisRound = true;
+                                write(`dz publish: → sibling drift: ${r.name}@${r.version} differs from the workspace (${r.changedFiles.length} file(s)) — adding to the batch via --include-drifted${r.missingExports.length > 0 ? ` (missing exports: ${r.missingExports.join(', ')})` : ''}`);
+                            }
+                        }
+                        else if (allowSiblingDrift) {
+                            pkParts.push(`${r.name}@${r.version}: drift (${r.changedFiles.length} file(s)) — allowed via --allow-sibling-drift`);
+                            if (pkVerdict !== 'block')
+                                pkVerdict = 'warn';
+                            pkOverrideUsed = true;
+                        }
+                        else {
+                            pkParts.push(`${r.name}@${r.version}: drift (${r.changedFiles.length} file(s))`);
+                            pkVerdict = 'block';
+                            const suggestFilter = filterStr !== undefined ? `${filterStr},${r.name}` : `${pk.name},${r.name}`;
+                            write(`dz publish: BLOCKED ${pk.name} — sibling drift: @dzhechkov/${r.name.replace(/^@dzhechkov\//, '')}@${r.version} on the registry differs from the workspace (${r.changedFiles.length} file(s)); add ${r.name} to the batch (--filter ${suggestFilter}) or publish it first`);
+                            driftBlocked++;
+                        }
+                    }
+                }
+                // AM-3/AM-6: the single, aggregated audit write for this package — "no external siblings"
+                // when nothing was ever checked, otherwise every sibling's status joined into one detail.
+                if (!siblingDriftAudited.has(pk.name)) {
+                    siblingDriftAudited.add(pk.name);
+                    const detail = pkParts.length > 0 ? pkParts.join('; ') : 'no external siblings';
+                    // AM-6: an override reason is attached only when the FINAL verdict is 'warn' — if some
+                    // OTHER sibling still stands as a live block, the override never actually excused the run.
+                    const overrideReason = pkOverrideUsed && pkVerdict !== 'block' ? '--allow-sibling-drift' : undefined;
+                    const wrote = appendPublishGateAudit(cwd, 'sibling-drift', pkVerdict, detail, [{ name: pk.name, version: pk.version }], overrideReason, gateAuditFsLayer);
+                    if (pkOverrideUsed) {
+                        // AM-6: the override is only real once ITS audit row is durable — a write failure must
+                        // refuse the publish rather than print "(logged)" about a record that never landed.
+                        if (wrote.logged) {
+                            write(`dz publish: ⚠ sibling drift override recorded for ${pk.name} — allowed via --allow-sibling-drift (logged)`);
+                        }
+                        else {
+                            write(`dz publish: BLOCKED ${pk.name} — the --allow-sibling-drift override could not be recorded (audit write failed: ${wrote.reason ?? 'unknown reason'}); refusing rather than proceeding unlogged`);
+                            driftBlocked++;
+                        }
+                    }
+                    else if (pkParts.length > 0) {
+                        write(`dz publish: ℹ sibling drift audit for ${pk.name}${auditSuffix(wrote)}`);
+                    }
+                    else if (!wrote.logged) {
+                        // Codex round-2 (2026-09-14), AM-6 residual: the "no external siblings" pass note stays
+                        // silent on stdout ONLY while its record actually landed — a failed audit write is said.
+                        write(`dz publish: ℹ sibling drift audit for ${pk.name} (no external siblings)${auditSuffix(wrote)}`);
+                    }
+                }
+            }
+            if (driftBlocked > 0)
+                break; // nothing to expand into a run that already refuses
+            if (!includeDrifted || !addedThisRound)
+                break; // no auto-expand requested, or fixed point reached
+            // FR-4: --include-drifted folds the drifted sibling(s) into the batch — they bump patch like
+            // any other package in `publishPackages`' own (unchanged) bump logic. Re-loop: the newly
+            // folded-in sibling(s) may themselves depend on a drifted sibling outside the (now bigger) batch.
+            filter = filter === undefined ? [...batchNames, ...extraBatch] : [...filter, ...extraBatch];
+            targets = allPackages.filter(matchesFilter);
+            batchNames = new Set(targets.map((p) => p.name));
+        }
+    }
+    finally {
+        if (packTmpDir !== undefined)
+            rmSync(packTmpDir, { recursive: true, force: true });
+    }
+    const siblingDriftFailed = driftBlocked > 0;
+    if (siblingDriftFailed && !dryRun) {
+        write(`dz publish: refusing to publish (${driftBlocked} sibling-drift violation(s))`);
+        return 1;
+    }
+    // FR-3 — packed-install smoke: pack the WHOLE (possibly --include-drifted-expanded) batch,
+    // install every tarball together in a CLEAN dir (out-of-batch siblings resolve from the
+    // registry, exactly like a fresh user's install), then boot every bin with --version.
+    // "n/a" (FR-6) when nothing in the batch has a bin. AM-8: a bin is collected here whether or not
+    // its target file exists YET — a manifest that declares one but ships nothing must BLOCK after a
+    // real install, never silently vanish from the plan (which used to read as n/a, or even skip the
+    // whole gate when it was the batch's only bin).
+    const bins = [];
+    for (const pk of targets) {
+        let manifest = {};
+        try {
+            manifest = JSON.parse(readFileSync(join(pk.dir, 'package.json'), 'utf-8'));
+        }
+        catch { /* no bin info available */ }
+        if (typeof manifest.bin === 'string') {
+            bins.push({ pkg: pk.name, binName: pk.name.split('/').pop() ?? pk.name, relPath: manifest.bin.replace(/^\.\//, '') });
+        }
+        else if (manifest.bin !== undefined && manifest.bin !== null && typeof manifest.bin === 'object') {
+            for (const [name, relRaw] of Object.entries(manifest.bin)) {
+                bins.push({ pkg: pk.name, binName: name, relPath: String(relRaw).replace(/^\.\//, '') });
+            }
+        }
+    }
+    // AM-1/AM-5: the packed-install-smoke PREVIEW below runs on a DRY RUN only, against whatever is
+    // CURRENTLY on disk (pre-bump) — it cannot be the "same bytes that ship" gate AM-1 requires,
+    // because a dry run never bumps/builds/packs anything real to compare against. On a LIVE run the
+    // real gate is `packedTransport` (wired at the `publishPackages` call below), which packs ONCE
+    // post-bump and smokes exactly those tarballs — this preview is skipped entirely then, so its
+    // digest is never confused with the one that actually ships.
+    let packedInstallSmokePreviewFailed = false;
+    if (dryRun) {
+        if (bins.length === 0) {
+            const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'n/a — nothing in the batch declares a bin', targets.map((p) => ({ name: p.name, version: p.version })), undefined, gateAuditFsLayer);
+            write(`dz publish: ○ packed install smoke: n/a (nothing in the batch declares a bin)${auditSuffix(wrote)}`);
+        }
+        else {
+            const scratchRoot = packedInstallScratchRoot();
+            const packDir = mkdtempSync(join(scratchRoot, 'dz-publish-pack-'));
+            const installDir = mkdtempSync(join(scratchRoot, 'dz-publish-install-'));
+            const runSmoke = packedInstallRunner ??
+                ((cmd, o) => {
+                    try {
+                        const stdout = execSync(cmd, { cwd: o.cwd, stdio: 'pipe', encoding: 'utf-8', timeout: o.timeoutMs });
+                        return { exitCode: 0, stdout: stdout == null ? '' : String(stdout), stderr: '' };
+                    }
+                    catch (err) {
+                        const e = err;
+                        const timedOut = (e.status === null || e.status === undefined) && (e.signal != null || e.killed === true);
+                        return {
+                            exitCode: typeof e.status === 'number' ? e.status : 1,
+                            stdout: e.stdout == null ? '' : String(e.stdout),
+                            stderr: e.stderr == null || String(e.stderr).trim() === '' ? formatPublishError(e) : String(e.stderr),
+                            timedOut,
+                        };
+                    }
+                });
+            const smokePlan = planPackedInstallSmoke({
+                packages: targets.map((p) => ({ name: p.name, dir: p.dir, version: p.version })),
+                bins,
+                packDir,
+                installDir,
+            });
+            const smokeExecutions = [];
+            // Lead edit after the live dry-run (13.09 12:05): the preview packed the WORKING directory with
+            // `workspace:^` specs still inside, so `npm install <tgz>` died with EUNSUPPORTEDPROTOCOL — the
+            // preview must stage package.json exactly as the live packedTransport does (sibling pins via
+            // rewriteWorkspaceSpecs, prepublishOnly dropped) and restore the originals afterwards. Shared
+            // with `dz release` via `withStagedPackageJson` (feature release-smoke-staged-pack).
+            try {
+                withStagedPackageJson(targets, workspaceVersions, write, () => {
+                    for (const step of smokePlan.steps) {
+                        const r = runSmoke(step.cmd, { cwd: step.cwd, timeoutMs: step.timeoutMs });
+                        smokeExecutions.push({ stepId: step.id, exitCode: r.exitCode, stdout: r.stdout, stderr: r.stderr, ...(r.timedOut !== undefined ? { timedOut: r.timedOut } : {}) });
+                    }
+                }, 'dz publish');
+            }
+            catch (err) {
+                // a restore failure is a preview failure (Codex finding 1): never a green preview on a staged tree
+                smokeExecutions.push({ stepId: 'staged-restore', exitCode: 1, stdout: '', stderr: formatPublishError(err) });
+            }
+            const smokeVerdict = judgePackedInstallSmoke(smokePlan, smokeExecutions);
+            try {
+                rmSync(packDir, { recursive: true, force: true });
+            }
+            catch { /* best-effort cleanup */ }
+            try {
+                rmSync(installDir, { recursive: true, force: true });
+            }
+            catch { /* best-effort cleanup */ }
+            if (smokeVerdict.ok) {
+                const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'preview: pack/install/--version all clean', targets.map((p) => ({ name: p.name, version: p.version })), undefined, gateAuditFsLayer);
+                write(`dz publish: ✓ packed install smoke (preview)${auditSuffix(wrote)}`);
+            }
+            else {
+                const detail = smokeVerdict.failureDetail ?? smokeVerdict.bins.find((b) => !b.ok)?.detail ?? '(no detail)';
+                const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'block', detail, targets.map((p) => ({ name: p.name, version: p.version })), undefined, gateAuditFsLayer);
+                write(`dz publish: BLOCKED — packed install smoke failed (preview): ${detail}${auditSuffix(wrote)}`);
+                for (const b of smokeVerdict.bins.filter((b) => !b.ok))
+                    write(`  ✗ ${b.pkg} (${b.binName}): ${b.detail ?? '(no detail)'}`);
+                packedInstallSmokePreviewFailed = true;
+            }
+        }
+    }
+    if (siblingDriftFailed || packedInstallSmokePreviewFailed) {
+        write(`dz publish: refusing to publish (${driftBlocked} sibling-drift violation(s)${packedInstallSmokePreviewFailed ? ', packed install smoke failed' : ''})`);
+        return 1;
+    }
     if (!dryRun) {
         // Loud confirmation banner listing exactly what is about to be published.
         const targets = discoverPackages(cwd).filter((p) => filter === undefined || filter.length === 0
@@ -6356,23 +6825,37 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner) {
                 // `pnpm publish` and skipped re-signing (ADR-001, features/publish-gate-verifies-the-tarball).
                 let cleanupGate = null;
                 try {
-                    const signed = JSON.parse(readFileSync(manifestPath, 'utf8'));
-                    let extracted;
-                    try {
-                        extracted = extractPublishTarball(pk.dir);
-                        cleanupGate = extracted.cleanup;
-                    }
-                    catch (err) {
-                        // Cross-family review (codex `gpt-5.6-sol`, 2026-08-22): falling back to the working
-                        // TREE here fails the gate OPEN. The gate's whole claim is "what ships matches the
-                        // signature"; with no artifact, nothing was compared, and reporting a pass would be a
-                        // claim about an object that was never built. Say why, and block.
-                        write(`dz publish: could not pack ${pk.name} (${err.message.split('\n')[0]}) — the artifact was never built, so its signature was not checked`);
+                    const parsedManifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+                    // FR-4 (feature publish-gate-audit-durable): a manifest that PARSES but is not a plain
+                    // object — `null`, an array, a bare string — is UNAVAILABLE, never "no signature". Those
+                    // are different failures with different fixes: "no signature" means run `dz sign`; a
+                    // malformed manifest means the file itself is corrupt/wrong-shaped and re-signing alone
+                    // would silently paper over that. Mirrors `readManifest`'s shape guard in
+                    // publish-sibling-drift.ts (null/array/non-object ⇒ cannot be used, say so).
+                    if (parsedManifest === null || typeof parsedManifest !== 'object' || Array.isArray(parsedManifest)) {
+                        const gotShape = parsedManifest === null ? 'null' : Array.isArray(parsedManifest) ? 'an array' : typeof parsedManifest;
+                        write(`dz publish: ${pk.name}'s ${MANIFEST_NAME} is not a JSON object (got ${gotShape}) — its signature is unavailable, not merely absent`);
                         artifactUnavailable = true;
                     }
-                    verifyOk =
-                        extracted !== undefined &&
-                            verifyManifest(extracted.dir, signed, readFileSync(trustRoot, 'utf8')).ok;
+                    else {
+                        const signed = parsedManifest;
+                        let extracted;
+                        try {
+                            extracted = extractPublishTarball(pk.dir);
+                            cleanupGate = extracted.cleanup;
+                        }
+                        catch (err) {
+                            // Cross-family review (codex `gpt-5.6-sol`, 2026-08-22): falling back to the working
+                            // TREE here fails the gate OPEN. The gate's whole claim is "what ships matches the
+                            // signature"; with no artifact, nothing was compared, and reporting a pass would be a
+                            // claim about an object that was never built. Say why, and block.
+                            write(`dz publish: could not pack ${pk.name} (${err.message.split('\n')[0]}) — the artifact was never built, so its signature was not checked`);
+                            artifactUnavailable = true;
+                        }
+                        verifyOk =
+                            extracted !== undefined &&
+                                verifyManifest(extracted.dir, signed, readFileSync(trustRoot, 'utf8')).ok;
+                    }
                 }
                 catch {
                     verifyOk = false;
@@ -6400,12 +6883,83 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner) {
     // longer exist. Default to the same path `dz sign --init` writes, so the ordinary operator needs no
     // new flag; `--sign-key` overrides it.
     const signKey = (options.get('sign-key') ?? join(homedir(), '.dz', 'keys', 'dz.key')).trim();
+    // AM-1: the packedTransport smoke closure and the actual `npm publish <tgz>` inside
+    // `publishPackages` both read from THIS SAME directory — created once, cleaned up once, after
+    // publishPackages returns (it needs the tarballs on disk through its own publish step).
+    const packedTransportPackDestDir = mkdtempSync(join(packedInstallScratchRoot(), 'dz-publish-packed-'));
     const publishReport = publishPackages(cwd, {
         provenance,
         dryRun,
         filter,
         bumpOnly,
         claimGate: claimCheckOpt,
+        exec: publishExecRunner,
+        packedTransport: {
+            packDestDir: packedTransportPackDestDir,
+            // AM-1: judged ONCE, over every package's packed artifact — nothing in the batch publishes
+            // until this returns ok:true. `bins` (AM-8-fixed: declared bins are collected whether or not
+            // their target file exists yet) was already computed above from the same `targets` this
+            // batch resolves to.
+            smoke: (artifacts) => {
+                for (const a of artifacts)
+                    write(`dz publish: tarball ${a.name}@${a.newVersion} sha256:${a.sha256}`);
+                const auditPackages = artifacts.map((a) => ({ name: a.name, version: a.newVersion, tarballSha256: a.sha256 }));
+                if (bins.length === 0) {
+                    const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'n/a — nothing in the batch declares a bin', auditPackages, undefined, gateAuditFsLayer);
+                    write(`dz publish: ○ packed install smoke: n/a (nothing in the batch declares a bin)${auditSuffix(wrote)}`);
+                    return { ok: true };
+                }
+                const scratchRoot = packedInstallScratchRoot();
+                const installDir = mkdtempSync(join(scratchRoot, 'dz-publish-install-'));
+                const runSmoke = packedInstallRunner ??
+                    ((cmd, o) => {
+                        try {
+                            const stdout = execSync(cmd, { cwd: o.cwd, stdio: 'pipe', encoding: 'utf-8', timeout: o.timeoutMs });
+                            return { exitCode: 0, stdout: stdout == null ? '' : String(stdout), stderr: '' };
+                        }
+                        catch (err) {
+                            const e = err;
+                            const timedOut = (e.status === null || e.status === undefined) && (e.signal != null || e.killed === true);
+                            return {
+                                exitCode: typeof e.status === 'number' ? e.status : 1,
+                                stdout: e.stdout == null ? '' : String(e.stdout),
+                                stderr: e.stderr == null || String(e.stderr).trim() === '' ? formatPublishError(e) : String(e.stderr),
+                                timedOut,
+                            };
+                        }
+                    });
+                const smokePlan = planPackedInstallSmoke({
+                    // skipPack (AM-1): these tarballs are ALREADY packed (by publishPackages, above) — a
+                    // second, different pack here would smoke bytes other than the ones about to publish.
+                    packages: artifacts.map((a) => ({ name: a.name, dir: '(packed already — see skipPack)', version: a.newVersion })),
+                    bins,
+                    packDir: packedTransportPackDestDir,
+                    installDir,
+                    skipPack: true,
+                });
+                const smokeExecutions = [];
+                for (const step of smokePlan.steps) {
+                    const r = runSmoke(step.cmd, { cwd: step.cwd, timeoutMs: step.timeoutMs });
+                    smokeExecutions.push({ stepId: step.id, exitCode: r.exitCode, stdout: r.stdout, stderr: r.stderr, ...(r.timedOut !== undefined ? { timedOut: r.timedOut } : {}) });
+                }
+                const verdict = judgePackedInstallSmoke(smokePlan, smokeExecutions);
+                try {
+                    rmSync(installDir, { recursive: true, force: true });
+                }
+                catch { /* best-effort cleanup */ }
+                if (verdict.ok) {
+                    const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'pass', 'pack/install/--version all clean (live, packedTransport)', auditPackages, undefined, gateAuditFsLayer);
+                    write(`dz publish: ✓ packed install smoke${auditSuffix(wrote)}`);
+                    return { ok: true };
+                }
+                const detail = verdict.failureDetail ?? verdict.bins.find((b) => !b.ok)?.detail ?? '(no detail)';
+                const wrote = appendPublishGateAudit(cwd, 'packed-install-smoke', 'block', detail, auditPackages, undefined, gateAuditFsLayer);
+                write(`dz publish: BLOCKED — packed install smoke failed: ${detail}${auditSuffix(wrote)}`);
+                for (const b of verdict.bins.filter((b) => !b.ok))
+                    write(`  ✗ ${b.pkg} (${b.binName}): ${b.detail ?? '(no detail)'}`);
+                return { ok: false, reason: detail };
+            },
+        },
         signKey: signKey === '' ? undefined : resolve(cwd, signKey),
         verifyAfterSign: (packDir) => {
             // Verify the OUTCOME against the trust root a CONSUMER would use — an existing key may be the
@@ -6482,6 +7036,10 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner) {
             }
         },
     });
+    try {
+        rmSync(packedTransportPackDestDir, { recursive: true, force: true });
+    }
+    catch { /* best-effort cleanup */ }
     const configMirror = mirrorCommandFromConfig(cwd);
     const configuredCommand = (options.get('mirror-cmd') ?? configMirror.command ?? '').trim();
     const publishedVersions = publishReport.packages
@@ -6570,6 +7128,10 @@ function cmdPublish(options, flags, cwd, writeOutput, mirrorRunner) {
             ? ` (confirmed by registry after ${pkg.registryProbes} probes)`
             : '';
         write(`  ${icon} ${pkg.name.padEnd(35)} ${pkg.oldVersion} → ${pkg.newVersion}  ${pkg.status}${receipt}${detail}`);
+        // AM-1: the digest of the EXACT tarball bytes that were smoke-tested AND published — present
+        // only for a packedTransport publish, so "the smoke tested what shipped" is checkable here too.
+        if (pkg.status === 'published' && pkg.sha256 !== undefined)
+            write(`      sha256:${pkg.sha256}`);
         if (pkg.status === 'error' && pkg.error) {
             for (const line of pkg.error.split('\n'))
                 write(`      ${line}`);
@@ -6916,13 +7478,36 @@ function cmdRelease(options, flags, cwd, write, runner) {
             say(`dz release --affected: ${selected.length}/${factsList.length} package(s) selected from ${changed.length} changed file(s)${selected.length === factsList.length ? ' (no narrowing — full set)' : ''}`);
         factsList = selected;
     }
+    // FR-6 (feature publish-sibling-drift-gate): real tmp dirs for the packed-install smoke — only
+    // when something in the set actually has a bin to boot (packing bin-less siblings proves
+    // nothing this gate exists to catch). Planning stays pure (planReleaseGates never mkdtemps
+    // itself); these are cleaned up on every exit path below, dry-run included.
+    const packedInstallEligible = factsList.some((f) => f.bins.some((b) => b.exists));
+    const releaseScratchRoot = packedInstallScratchRoot();
+    const packedInstallDirs = packedInstallEligible
+        ? { packDir: mkdtempSync(join(releaseScratchRoot, 'dz-release-pack-')), installDir: mkdtempSync(join(releaseScratchRoot, 'dz-release-install-')) }
+        : undefined;
+    const cleanupPackedInstallDirs = () => {
+        if (packedInstallDirs === undefined)
+            return;
+        try {
+            rmSync(packedInstallDirs.packDir, { recursive: true, force: true });
+        }
+        catch { /* best-effort cleanup */ }
+        try {
+            rmSync(packedInstallDirs.installDir, { recursive: true, force: true });
+        }
+        catch { /* best-effort cleanup */ }
+    };
     const plan = planReleaseGates(factsList, {
         monorepoRoot: cwd,
         pnpmLockPresent: existsSync(join(cwd, 'pnpm-lock.yaml')),
         includeDevDeps: flags.has('audit-dev'),
+        packedInstall: packedInstallDirs,
     });
     // --dry-run: print the full plan, execute NOTHING (deterministic, byte-testable preview).
     if (flags.has('dry-run')) {
+        cleanupPackedInstallDirs();
         if (json) {
             write(JSON.stringify({ dryRun: true, packages: plan.packages, steps: plan.steps, skips: plan.skips, warnings }, null, 2));
             return 0;
@@ -6949,7 +7534,20 @@ function cmdRelease(options, flags, cwd, write, runner) {
     let smokeTmp;
     const execSteps = plan.steps.filter((s) => s.kind !== 'synthetic-fail');
     say(`\ndz release — executing ${execSteps.length} gate step(s) across ${plan.packages.length} package(s)…`);
-    for (const step of execSteps) {
+    // FR-1/FR-2 (feature release-smoke-staged-pack): the packed-install smoke's `pack` steps must
+    // pack the SAME staged bytes `dz publish`'s preview does — sibling `workspace:*` deps rewritten
+    // to the exact sibling version, `prepublishOnly` dropped — or `npm install` on the resulting
+    // tarballs dies with EUNSUPPORTEDPROTOCOL (MEASURED 2026-09-13 16:05). `workspaceVersions` is
+    // built like publish's (from the FULL workspace, not just this release's filtered batch — an
+    // out-of-batch sibling still needs its real version). Only the `pack` sub-steps are staged; the
+    // `install`/`bin-exists`/`bin-version` steps already run against the packed tarballs and need no
+    // staging.
+    const allPackages = discoverPackages(cwd);
+    const workspaceVersions = new Map(allPackages.map((p) => [p.name, p.version]));
+    const packStepIds = new Set((plan.packedInstallPlan?.steps ?? [])
+        .filter((s) => s.kind === 'pack')
+        .map((s) => `smoke:packed-install:${s.id}`));
+    const runGateStep = (step) => {
         let stepCwd = step.cwd;
         if (step.tempCwd === true) {
             // AM-4: boot bins in a throwaway cwd so an installer-style bin cannot mutate the workspace.
@@ -6967,6 +7565,37 @@ function cmdRelease(options, flags, cwd, write, runner) {
             durationMs: Date.now() - started,
             timedOut: r.timedOut,
         });
+    };
+    // Plan/execution order is load-bearing (see the plan/execution skew guard test) — steps run in
+    // exactly the order `plan.steps` lists them, one loop, no reordering. Only the `pack` steps are
+    // wrapped in the staged window, individually, so where they fall in that order never changes.
+    let announcedStagedPack = false;
+    for (const step of execSteps) {
+        if (packStepIds.has(step.id)) {
+            if (!announcedStagedPack) {
+                say('dz release: smoke: packed tarballs staged like the live publish (workspace:* → exact sibling versions)');
+                announcedStagedPack = true;
+            }
+            // Codex finding 2: stage ONLY the package this pack step packs — sibling pins come from
+            // workspaceVersions, and `npm pack` reads the packed package's manifest alone.
+            const packed = factsList.filter((f) => f.name === step.pkg);
+            try {
+                withStagedPackageJson(packed, workspaceVersions, write, () => runGateStep(step), 'dz release');
+            }
+            catch (err) {
+                // a staging/restore failure is a FAILED step with the reason, never a silent skip — and ONE
+                // record per step: a run already recorded by runGateStep is replaced, not duplicated (Codex r2)
+                const failed = { stepId: step.id, exitCode: 1, stdout: '', stderr: formatPublishError(err), durationMs: 0, timedOut: false };
+                const at = executions.findIndex((e) => e.stepId === step.id);
+                if (at >= 0)
+                    executions[at] = failed;
+                else
+                    executions.push(failed);
+            }
+        }
+        else {
+            runGateStep(step);
+        }
     }
     if (smokeTmp !== undefined) {
         try {
@@ -6974,14 +7603,31 @@ function cmdRelease(options, flags, cwd, write, runner) {
         }
         catch { /* best-effort cleanup */ }
     }
+    cleanupPackedInstallDirs();
     const verdict = classifyGateExecutions(plan, executions);
     // Report: per-gate ✓/✗/○ with package granularity + timestamp (NFR-5). Skips are named,
     // never folded into pass wording (AM-2: "N passed, M skipped", not "all tests passed").
     for (const g of verdict.gates) {
         const icon = g.status === 'pass' ? '✓' : g.status === 'fail' ? '✗' : '○';
         say(`  ${icon} ${g.gate.padEnd(7)} ${g.status.toUpperCase().padEnd(4)}  ${g.passed} passed, ${g.failures.length} failed, ${g.skips.length} skipped`);
-        for (const f of g.failures)
+        for (const f of g.failures) {
             say(`      [${f.class}] ${f.pkg !== undefined ? `${f.pkg}: ` : ''}${f.reason}`);
+            // FR-2 / AM-4 / AM-6 (feature release-gate-output-tail): print each non-empty stream's
+            // tail under the failure line, labelled `stdout:`/`stderr:` at the failure's own 6-space
+            // indent, with its content lines at an 8-space CONTINUATION indent so a reader can tell a
+            // tail line from a new failure/skip bullet at a glance; --json carries the same `tails`
+            // object as-is (present, possibly with empty strings, on every executed failure).
+            if (f.tails !== undefined) {
+                for (const stream of ['stdout', 'stderr']) {
+                    const t = f.tails[stream];
+                    if (t.length === 0)
+                        continue;
+                    say(`      ${stream}:`);
+                    for (const tailLine of t.split('\n'))
+                        say(`        ${tailLine}`);
+                }
+            }
+        }
         for (const sk of g.skips)
             say(`      [${sk.class}] ${sk.pkg}: ${sk.reason}`);
     }
@@ -9806,6 +10452,156 @@ function runGuardEvaluation(root, op, text, overrideReason, publishFilter) {
     catch { /* audit is best-effort, never blocks the verdict */ }
     return result;
 }
+/**
+ * AM-2: loop `writeSync` until every byte of `data` has been accepted, checking the RETURNED
+ * length on every call (Codex round-1 review, finding 1: the old code called `writeSync` once and
+ * ignored the return value — a short write followed by `fsyncSync` durably persists a TRUNCATED,
+ * unparseable JSON line into an append-only log every future read walks). A call that reports zero
+ * or negative progress can never complete the buffer and would spin forever — that is treated as a
+ * failure, not a retry target.
+ */
+function writeAllSync(fsLayer, fd, data) {
+    let remaining = data;
+    while (remaining.length > 0) {
+        const n = fsLayer.writeSync(fd, remaining);
+        if (typeof n !== 'number' || !Number.isFinite(n) || n <= 0) {
+            throw new Error(`writeSync made no progress (returned ${n}) with ${remaining.length} byte(s) still pending`);
+        }
+        // Codex round-2 (2026-09-14) finding 3: a layer claiming MORE bytes than it was given is lying
+        // about the record, and must not reach "logged: true" through a subarray that just goes empty.
+        if (n > remaining.length) {
+            throw new Error(`writeSync claimed ${n} byte(s) written but only ${remaining.length} were supplied`);
+        }
+        remaining = remaining.subarray(n);
+    }
+}
+const REAL_PUBLISH_GATE_AUDIT_FS = { existsSync, mkdirSync, openSync, writeSync, fsyncSync, closeSync };
+/**
+ * Feature `publish-sibling-drift-gate` (FR-5/AM-6), durability + per-package identity added by
+ * feature `publish-gate-audit-durable` (FR-1/FR-2): both the sibling-drift and packed-install-smoke
+ * gates write to the SAME append-only, hash-chained `.dz/guard-audit.jsonl` the declarative
+ * `dz guard` rules use — visibility for `dz guard promote`/`dz compounding` never depends on
+ * which mechanism produced the finding. `pass` records go through as an informational `note`
+ * (never a violation, so they can never flip the row's own verdict) so a clean check is ALSO on
+ * the record, not just a block or an override (AM-6: "аудит без записи = не аудит").
+ *
+ * FR-1: one JSONL record PER PACKAGE in `packages`, each naming the package, its version, and the
+ * tarball's sha256 (or the explicit `sha256:n/a` before a tarball exists — a dry-run preview). FR-2:
+ * the write is `openSync('a') → writeSync → fsyncSync(fd) → closeSync`, plus an `fsyncSync` of the
+ * `.dz` directory itself the one time this call CREATES it (a file's own fsync durably persists its
+ * bytes; the directory entry that makes the file findable after a crash needs its own fsync — the
+ * same lesson `integration-apply.ts`'s `fsyncDirectory` already encodes).
+ *
+ * Returns `{ logged, reason? }` — never a bare boolean, so a caller can print WHY a write failed,
+ * not just that it did. Most callers are best-effort (a write failure never blocks a verdict already
+ * decided) — the one exception is an `--allow-sibling-drift` OVERRIDE, whose caller MUST check
+ * `logged`: an override is not real without a durable row behind it (AM-6's load-bearing property —
+ * see `auditedOverride` in `cmdPublish`).
+ */
+function appendPublishGateAudit(root, rule, verdict, detail, packages, overrideReason, fsLayer = REAL_PUBLISH_GATE_AUDIT_FS) {
+    if (packages.length === 0)
+        return { logged: true }; // nothing to record about — not a failure
+    const dzDir = join(root, '.dz');
+    const auditPath = join(dzDir, 'guard-audit.jsonl');
+    const dzDirExisted = fsLayer.existsSync(dzDir);
+    // AM-2: tracked BEFORE the write — this is what decides whether the append call below is about
+    // to CREATE the file (needing a `.dz` directory-entry fsync afterwards) or extend an existing one
+    // (whose directory entry is already durable from a previous append).
+    const auditFileExisted = fsLayer.existsSync(auditPath);
+    try {
+        fsLayer.mkdirSync(dzDir, { recursive: true });
+    }
+    catch (err) {
+        return { logged: false, reason: `could not create ${dzDir}: ${err.message.split('\n')[0]}` };
+    }
+    const records = packages.map((pkg) => {
+        const sha = pkg.tarballSha256 !== undefined && pkg.tarballSha256 !== '' ? pkg.tarballSha256 : 'n/a';
+        const label = `${rule}: ${pkg.name}@${pkg.version} sha256:${sha} — ${detail}`;
+        return auditRecord(verdict === 'pass'
+            ? { op: 'publish', verdict, violations: [], checked: [rule], notEstablished: [], notes: [label] }
+            : { op: 'publish', verdict, violations: [{ rule, severity: 'hard', detail: label }], checked: [rule], notEstablished: [] }, new Date().toISOString(), overrideReason !== undefined ? { reason: overrideReason } : undefined);
+    });
+    let bytes;
+    try {
+        bytes = appendChainedLines(records, readLogTail(auditPath));
+    }
+    catch (err) {
+        return { logged: false, reason: `could not build the chained record: ${err.message.split('\n')[0]}` };
+    }
+    if (bytes === '')
+        return { logged: true };
+    const buf = Buffer.from(bytes, 'utf-8');
+    let fd;
+    try {
+        fd = fsLayer.openSync(auditPath, fsConstants.O_APPEND | fsConstants.O_CREAT | fsConstants.O_WRONLY);
+        writeAllSync(fsLayer, fd, buf); // AM-2: loops on a short write, throws on no progress
+        fsLayer.fsyncSync(fd);
+        fsLayer.closeSync(fd);
+        fd = undefined;
+    }
+    catch (err) {
+        return { logged: false, reason: err.message.split('\n')[0] ?? String(err) };
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fsLayer.closeSync(fd);
+            }
+            catch { /* best-effort */ }
+        }
+    }
+    // AM-2 (Codex round-1 review, finding 1, high): a directory-entry fsync is REQUIRED, not
+    // best-effort, whenever THIS call is the reason the entry needed persisting — swallowing its
+    // failure used to let `logged: true` go out about a record whose directory entry can vanish on a
+    // crash before the next fsck. Two DIFFERENT entries can need persisting, tracked independently:
+    if (!auditFileExisted) {
+        // The audit FILE was just created by the open() above — `.dz` (its containing directory) needs
+        // its own fsync so the new directory entry survives a crash; the file's own fsync (above) only
+        // guarantees the file's DATA, not that anything can find it afterwards.
+        let dfd;
+        try {
+            dfd = fsLayer.openSync(dzDir, fsConstants.O_RDONLY);
+            fsLayer.fsyncSync(dfd);
+        }
+        catch (err) {
+            return { logged: false, reason: `could not fsync ${dzDir} after creating ${auditPath}: ${err.message.split('\n')[0]}` };
+        }
+        finally {
+            if (dfd !== undefined) {
+                try {
+                    fsLayer.closeSync(dfd);
+                }
+                catch { /* best-effort, does not affect the verdict already returned */ }
+            }
+        }
+    }
+    if (!dzDirExisted) {
+        // `.dz` ITSELF was just created by `mkdirSync` above — its PARENT (`root`) needs its own fsync
+        // so `.dz`'s OWN directory entry survives a crash (the fsync of `.dz` just above only durably
+        // persists entries INSIDE `.dz`, not the fact that `.dz` exists at all).
+        let pfd;
+        try {
+            pfd = fsLayer.openSync(root, fsConstants.O_RDONLY);
+            fsLayer.fsyncSync(pfd);
+        }
+        catch (err) {
+            return { logged: false, reason: `could not fsync ${root} after creating ${dzDir}: ${err.message.split('\n')[0]}` };
+        }
+        finally {
+            if (pfd !== undefined) {
+                try {
+                    fsLayer.closeSync(pfd);
+                }
+                catch { /* best-effort, does not affect the verdict already returned */ }
+            }
+        }
+    }
+    return { logged: true };
+}
+/** FR-2: the printed suffix a caller appends to its own verdict line — never silent about logging. */
+function auditSuffix(wrote) {
+    return wrote.logged ? ' (logged)' : ` (audit NOT logged: ${wrote.reason ?? 'unknown reason'})`;
+}
 function renderGuardObservation(observation) {
     const tag = observation.status === 'unknown' ? 'note' : 'observe';
     return `  [${tag}] ${observation.rule} ${observation.scope}: ${observation.detail} [${observation.status}]`;
@@ -16445,7 +17241,16 @@ async function cmdQeBridge(options, flags, cwd, write) {
         catch (error) {
             return failRun('audit-write-failed', `the review was PARSED (grade ${signoff.grade}) but its raw stdout could not be retained: ${String(error)} — an unauditable success is not a success, so the run FAILS rather than shipping a verdict nobody can re-derive`, probed, { stdout: review.stdout, stderr: review.stderr });
         }
-        const recordText = (reportWritten) => `${JSON.stringify(buildBridgeSignoffRecord(signoff, {
+        // writeSequence (qe-bridge-signoff-order): diagnostic sequencing metadata — a self-reported
+        // process-local trace with monotonic stamps taken at each named event (start of the first record
+        // write; after the report landed; just before the atomic update). It replaces a wall-clock
+        // mtime comparison that was a race (the record is rewritten AFTER the report by design). It does
+        // NOT prove write order or crash safety: those are proven by the failpoint test (R4-1) and the
+        // report-failure test. Lead edit after Codex review 2026-09-13: honest step names.
+        const seq = [
+            { step: 'signoff-write-started', monotonicNs: String(process.hrtime.bigint()) },
+        ];
+        const recordText = (reportWritten, writeSequence) => `${JSON.stringify(buildBridgeSignoffRecord(signoff, {
             runId,
             claudeBin: resolvedBin,
             binOverride,
@@ -16454,11 +17259,12 @@ async function cmdQeBridge(options, flags, cwd, write) {
             rawStdoutFile,
             promptSha256,
             ...(parsed.channels === undefined ? {} : { channels: parsed.channels }),
+            writeSequence,
         }), null, 2)}\n`;
         let signoffPath;
         try {
             signoffPath = uniquePath(join(stateDir, `signoff-${runId}`), '.json');
-            writeNewFileOrThrow(signoffPath, recordText(false));
+            writeNewFileOrThrow(signoffPath, recordText(false, seq));
         }
         catch (error) {
             return failRun('audit-write-failed', `the review was PARSED (grade ${signoff.grade}) but the signoff record could not be written: ${String(error)} — the verdict exists and cannot be persisted, so the run FAILS rather than reporting an unrecorded success`, probed, { stdout: review.stdout, stderr: review.stderr });
@@ -16471,6 +17277,10 @@ async function cmdQeBridge(options, flags, cwd, write) {
             reportError = error;
         }
         if (reportError === null) {
+            // the report is on disk: the sequence gains a step BEFORE the `reportWritten:true` record
+            // write, not after — an observer reading the eventual writeSequence must see the report step
+            // land before the record-update step that persists it.
+            seq.push({ step: 'report-written', monotonicNs: String(process.hrtime.bigint()) });
             // the ONLY moment `reportWritten:true` may appear: after the report is on disk
             try {
                 // ATOMIC (R4-1): write a sibling temp file, then rename() over the original. On the same
@@ -16479,7 +17289,8 @@ async function cmdQeBridge(options, flags, cwd, write) {
                 // which made the "a crash leaves a record that is true or pessimistic" claim untrue in the
                 // one case it was about.
                 const tmpPath = `${signoffPath}.tmp.${process.pid}`;
-                writeNewFileOrThrow(tmpPath, recordText(true));
+                seq.push({ step: 'record-update-prepared', monotonicNs: String(process.hrtime.bigint()) });
+                writeNewFileOrThrow(tmpPath, recordText(true, seq));
                 if (process.env[QE_BRIDGE_FAILPOINT_ENV] === 'hang-before-rename') {
                     // test-only: stop dead INSIDE the window, so a SIGKILL can prove the property
                     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 600_000);
@@ -19311,7 +20122,7 @@ export async function runCli(argv, io = {}) {
             case 'auto-canonicalize':
                 return await cmdAutoCanonicalize(options, cwd, write);
             case 'publish':
-                return cmdPublish(options, flags, cwd, write, io.publishMirrorRunner);
+                return cmdPublish(options, flags, cwd, write, io.publishMirrorRunner, io.publishSiblingDriftFetcher, io.publishPackedInstallRunner, io.publishExecRunner, io.publishGateAuditFsLayer, io.publishNpmPackRunner);
             case 'release':
                 return cmdRelease(options, flags, cwd, write, io.releaseRunner);
             case 'parity':