@kungfu-tech/buildchain 3.0.6-alpha.0 → 3.0.6-alpha.2

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-03T02:31:12.352Z",
-  "publishedAt": "2026-08-03T02:31:12.352Z",
+  "generatedAt": "2026-08-05T21:38:24.130Z",
+  "publishedAt": "2026-08-05T21:38:24.130Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "83280a3d21c4c75774be91ee802286b48c17fc54",
+  "sourceRevision": "931e1a448f3460a29d6b6765c1f1e3e3e26f19cc",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.0",
+    "version": "3.0.6-alpha.2",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/release-provenance.json

@@ -25,6 +25,7 @@
       "./cache-evidence": "./packages/core/cache-evidence.js",
       "./controller-evidence": "./packages/core/controller-evidence.js",
       "./diagnostics": "./packages/core/diagnostics.js",
+      "./dev-delivery-warrant": "./packages/core/dev-delivery-warrant.js",
       "./homebrew": "./packages/core/homebrew.js",
       "./issue-reporting": "./packages/core/issue-reporting.js",
       "./kfd": "./packages/core/kfd.js",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-03T02:31:12.352Z",
-  "publishedAt": "2026-08-03T02:31:12.352Z",
+  "generatedAt": "2026-08-05T21:38:24.130Z",
+  "publishedAt": "2026-08-05T21:38:24.130Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "83280a3d21c4c75774be91ee802286b48c17fc54",
+  "sourceRevision": "931e1a448f3460a29d6b6765c1f1e3e3e26f19cc",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.6-alpha.0",
+    "version": "3.0.6-alpha.2",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -53,7 +53,7 @@
       "path": "docs/MAP.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:216e69758e78866e5a22fae1c4d017aaccf1b759937fcd953934407263344c03"
+      "digest": "sha256:d76416d8cd04dcdb560b7d06fef287fa22d6b186a729cb92cd4cf71cebbac1e9"
     },
     {
       "id": "getting-started",
@@ -69,7 +69,7 @@
       "path": "docs/auditable-demo.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:7e1426d8200bd4e7a7e6684c872f47075cd37d0bddbb262ea3263eaad846b540"
+      "digest": "sha256:c49e734fdfe3b74d317e23a523e198f1194b2c7cd16cca87e8e3a3ffc7bf589f"
     },
     {
       "id": "install",
@@ -109,7 +109,7 @@
       "path": "docs/publication-authority.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:6c91ee89d1ed5c0c570806684738916876556b2f1bcbf4be4f73f30ff89e98a4"
+      "digest": "sha256:a1650158943d95b979d164ca98a73d7919fda577d648e4a4a9d04588ec698796"
     },
     {
       "id": "github-governance-authority",
@@ -125,7 +125,7 @@
       "path": "docs/release-candidate.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:fbcffddf1e2c50502186b7ba557e29f96be59a1da6d438aabd4d1f9ce32b5915"
+      "digest": "sha256:48e42e92174b1091e8ff32e876099f092ca12ce886d3382f019f0ccd907f1c9b"
     },
     {
       "id": "release-propagation",
@@ -229,7 +229,7 @@
       "path": "docs/cli-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:73d34a3b46ecfb772b806f0d79754772446fcc13d7f349b508a0c0212e97fcec"
+      "digest": "sha256:2365e125d38e43b68a4af277a91be7aca708a8bf785954ed4589dbd9a5d8db97"
     },
     {
       "id": "node-api-reference",
@@ -237,7 +237,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:ae49a589091d1ab91d29f2d6ac52cf2551a9d0b1f78350965b408f40fd219e29"
+      "digest": "sha256:e0e720eeacfa61a1ca235142858f544e18d3f7a000e300a4311e246fe738ff81"
     },
     {
       "id": "build-facts",
@@ -277,7 +277,7 @@
       "path": "docs/reusable-build-surface.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:fe06637d604101269b013163be558c1ecc842276e27f2b5abfb6eea39e98feb0"
+      "digest": "sha256:7bc04f658d7e298872756278c60143d8edf5dfb841d0b0d3ea62af8028735b54"
     },
     {
       "id": "publish-transaction",
@@ -293,7 +293,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:a38eca4d8ada75aed5cb60f2ef23ffe4ba36b1c804ea1ee7f74b3271765b7a1c"
+      "digest": "sha256:481640f398d966dca4f1f2e29a8100f0f479315ee19e65b0e259720f2b61213f"
     },
     {
       "id": "release-flow",
@@ -317,7 +317,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:bdb155e873f9c2ea5cd40bdde057d2c2f90322f0d4575de77fe1670bd040e643"
+      "digest": "sha256:793db9414d11aeb314ff2d37a52481826ca5f636d08eaf93772d37962a51484f"
     },
     {
       "id": "web-surface-deployments",

package/dist/site/workflow-registry.json

@@ -176,9 +176,10 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 85,
+      "inputCount": 86,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -283,12 +284,13 @@
         "materialize",
         "materialize-base-ref",
         "media-profile",
+        "render-failure-advisory",
         "render-media",
         "renderer-image",
         "scenario-path",
         "source-ref"
       ],
-      "inputCount": 11,
+      "inputCount": 12,
       "secrets": [
         "DEMO_UPDATE_TOKEN"
       ],
@@ -299,9 +301,10 @@
         "evidence-artifact-digest",
         "evidence-artifact-name",
         "publication-pr-url",
+        "render-result",
         "source-sha"
       ],
-      "outputCount": 6,
+      "outputCount": 7,
       "surface": "declarative-auditable-demo",
       "capabilityGroup": "api-cli-reference",
       "status": "preview",
@@ -392,6 +395,7 @@
         "auto-no-gate",
         "buildchain-ref",
         "buildchain-repository",
+        "consumer-gate-command",
         "consumer-predicate-digest",
         "consumer-predicate-id",
         "consumer-qualification-required",
@@ -419,7 +423,7 @@
         "target-ref",
         "used-nonces-json"
       ],
-      "inputCount": 33,
+      "inputCount": 34,
       "secrets": [
         "KUNGFU_GOVERNANCE_AUDITOR_APP_PRIVATE_KEY"
       ],
@@ -491,6 +495,7 @@
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
+        "publication-gate-command",
         "publication-package-name",
         "publication-product",
         "publication-publisher-workflow-path",
@@ -514,6 +519,7 @@
         "release-candidate-family-evidence-required",
         "release-candidate-family-evidence-root",
         "release-candidate-family-initiative-id",
+        "release-candidate-wait-seconds",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -544,7 +550,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 95,
+      "inputCount": 97,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -1271,9 +1277,10 @@
         "shifu-cache-profile-ref",
         "untrusted-policy",
         "verify-command",
+        "verify-substage-evidence-path",
         "working-directory"
       ],
-      "inputCount": 88,
+      "inputCount": 89,
       "secrets": [
         "BUILDCHAIN_ARTIFACT_RELAY_S3_DOWNLOAD_ROLE_ARN",
         "BUILDCHAIN_ARTIFACT_RELAY_S3_ROLE_ARN",
@@ -1367,6 +1374,27 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "buildchain-dev-delivery",
+      "path": ".github/workflows/buildchain-dev-delivery.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "dev-governance",
+      "capabilityGroup": "governance-versioning",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "buildchain-patrol-daily",
       "path": ".github/workflows/buildchain-patrol-daily.yml",
@@ -1647,6 +1675,87 @@
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
       "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
     },
+    {
+      "id": "dev-delivery-warrant-cancel",
+      "path": ".github/workflows/dev-delivery-warrant-cancel.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "event-action",
+        "expected-candidate-id",
+        "expected-old-state-root",
+        "expected-pr-number",
+        "expected-source-head-sha",
+        "observed-source-head-sha",
+        "outcome",
+        "reason",
+        "target-branch",
+        "terminal-evidence-root"
+      ],
+      "inputCount": 12,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "cancellation-action",
+        "cancellation-receipt-root",
+        "final-state-root"
+      ],
+      "outputCount": 3,
+      "surface": "repository-workflow",
+      "capabilityGroup": "governance-versioning",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
+    {
+      "id": "dev-delivery-warrant-close",
+      "path": ".github/workflows/dev-delivery-warrant-close.yml",
+      "reusable": true,
+      "inputs": [
+        "buildchain-ref",
+        "buildchain-repository",
+        "current-base-sha",
+        "expected-head-sha",
+        "expected-pr-number",
+        "merge-group-head-sha",
+        "merge-group-tree-sha",
+        "outcome",
+        "reason",
+        "replay-tree-sha",
+        "required-context-roots-json",
+        "target-branch",
+        "terminal-evidence-root"
+      ],
+      "inputCount": 13,
+      "secrets": [
+        "github-token"
+      ],
+      "secretCount": 1,
+      "outputs": [
+        "close-receipt-root",
+        "final-state-root",
+        "integration-proof-root"
+      ],
+      "outputCount": 3,
+      "surface": "repository-workflow",
+      "capabilityGroup": "governance-versioning",
+      "status": "active",
+      "owner": "buildchain-workflows",
+      "maturity": "active",
+      "introducedVersion": "pre-3.0.2-alpha.4",
+      "compatibilityPromise": "preserved-through-the-v3-major-line",
+      "deprecationReplacement": "",
+      "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
+      "nonDuplicationRationale": "Existing workflow identity retained for caller compatibility and repository orchestration."
+    },
     {
       "id": "dev-merge-queue-governance",
       "path": ".github/workflows/dev-merge-queue-governance.yml",
@@ -1673,34 +1782,60 @@
       "path": ".github/workflows/dev-pr-auto-merge.yml",
       "reusable": true,
       "inputs": [
+        "affected-paths-json",
         "allowed-head-prefixes",
+        "assignment-root",
         "block-labels",
         "buildchain-ref",
         "buildchain-repository",
+        "closure-root",
+        "delivery-class",
+        "delivery-priority",
+        "delivery-warrant-mode",
+        "dependency-root",
+        "diagnostic-context",
         "dry-run",
+        "expected-head-sha",
+        "expected-pr-number",
+        "initiative-root",
         "landing-mode",
         "max-merges",
         "merge-method",
+        "plan-root",
+        "project-cut-proof-json",
+        "queue-admission-context",
         "ready-label",
         "require-approval",
         "required-status-checks",
         "same-repository-only",
-        "target-branch"
-      ],
-      "inputCount": 13,
+        "shard-evidence-roots-json",
+        "source-identity-root",
+        "source-patch-root",
+        "target-branch",
+        "toolchain-root",
+        "warrant-lease-seconds"
+      ],
+      "inputCount": 32,
       "secrets": [
         "github-token"
       ],
       "secretCount": 1,
       "outputs": [
         "action-count",
+        "admission-receipt-root",
+        "admission-state",
         "enqueued-count",
         "evaluated-count",
         "final-base-sha",
         "merged-count",
-        "skipped-count"
+        "project-cut-proof-root",
+        "skipped-count",
+        "source-proof-root",
+        "warrant-receipt-root",
+        "warrant-state-commit",
+        "warrant-state-root"
       ],
-      "outputCount": 6,
+      "outputCount": 13,
       "surface": "dev-governance",
       "capabilityGroup": "governance-versioning",
       "status": "active",
@@ -2219,6 +2354,7 @@
         "publication-control-plane-audit-json",
         "publication-expected-json",
         "publication-gate-aggregate-json",
+        "publication-gate-command",
         "publication-package-name",
         "publication-product",
         "publication-publisher-workflow-path",
@@ -2242,6 +2378,7 @@
         "release-candidate-family-evidence-required",
         "release-candidate-family-evidence-root",
         "release-candidate-family-initiative-id",
+        "release-candidate-wait-seconds",
         "release-candidate-workflow-file",
         "release-candidate-workflow-name",
         "release-passport",
@@ -2272,7 +2409,7 @@
         "target-sha",
         "trusted-publishing"
       ],
-      "inputCount": 87,
+      "inputCount": 89,
       "secrets": [
         "BUILDCHAIN_ISSUE_APP_ID",
         "BUILDCHAIN_ISSUE_APP_PRIVATE_KEY",
@@ -2835,10 +2972,11 @@
         "required",
         "sample-process-tree",
         "stage",
+        "substage-evidence-path",
         "summary-path",
         "timeout-minutes"
       ],
-      "inputCount": 21,
+      "inputCount": 22,
       "capabilityGroup": "reusable-build",
       "status": "active",
       "owner": "buildchain-actions",

package/docs/MAP.md

@@ -111,6 +111,7 @@ replace them.
 | Why does Buildchain use branch-driven release governance? | [`release-governance.md`](release-governance.md) | why | stable |
 | How do protected dev branches and scheduled ready-PR merging work? | [`release-governance.md`](release-governance.md#protected-dev-branches) | use | stable |
 | How do slow required checks land reliably on a busy dev channel? | [`release-governance.md`](release-governance.md#protected-dev-branches) + [`cli.md`](cli.md#commands) | use | preview |
+| How does the durable fair Dev Delivery Warrant Queue prevent slow-candidate starvation?                                                       | [`dev-delivery-warrant.md`](dev-delivery-warrant.md)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | use/verify | preview |
 | How do I coalesce rapid Dev changes, preserve release runner priority, and retry only transient failed jobs? | [`dev-qualification-patrol.md`](dev-qualification-patrol.md) | use/verify | preview |
 | How do I run daily, weekly, or monthly repository patrols? | [`release-governance.md`](release-governance.md#buildchain-patrol) | use | stable |
 | How does Buildchain decide patch, minor, and major release lines? | [`versioning.md`](versioning.md) | why | stable |
@@ -152,6 +153,7 @@ replace them.
 | How do I automatically qualify alpha candidates and publish the newest non-revoked qualified candidate at a fixed window? | [`stable-candidate-patrol.md`](stable-candidate-patrol.md) | use | preview |
 | How do I deploy a site/app preview, staging, or production surface? | [`web-surface-deployments.md`](web-surface-deployments.md) | use | stable |
 | How do I publish observed infrastructure contracts for downstream consumers? | [`infra-contract.md`](infra-contract.md) | use | preview |
+| How do I operate a repeatable, disabled-by-default, budget-fail-closed AWS Windows JIT campaign? | [`aws-us-elastic-runner-burst-plane.md`](aws-us-elastic-runner-burst-plane.md#phase-2-operator-workflow) | use/verify | preview |
 | How do I use the active actions directly? | [`../actions/validate-config/README.md`](../actions/validate-config/README.md), [`../actions/run-lifecycle/README.md`](../actions/run-lifecycle/README.md), [`../actions/promote-buildchain-ref/README.md`](../actions/promote-buildchain-ref/README.md), [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md), [`../actions/github-artifact-attestation/README.md`](../actions/github-artifact-attestation/README.md), [`../actions/macos-credential-island/README.md`](../actions/macos-credential-island/README.md); `dist/site/workflow-registry.json#actions` is authoritative for the six-entry inventory. | use | stable |
 | How can a consumer workflow report a Buildchain-owned failure back to Buildchain? | [`consumer-issue-reporting.md`](consumer-issue-reporting.md) + [`../actions/report-buildchain-issue/README.md`](../actions/report-buildchain-issue/README.md) | use | stable |
 | What do the fixture repositories demonstrate? | [`../fixtures/libnode-shaped/README.md`](../fixtures/libnode-shaped/README.md), [`../fixtures/publish-transaction-shaped/README.md`](../fixtures/publish-transaction-shaped/README.md), [`../fixtures/web-surface-shaped/README.md`](../fixtures/web-surface-shaped/README.md), [`../fixtures/publication-artifact-shaped/README.md`](../fixtures/publication-artifact-shaped/README.md) | verify | stable |

package/docs/auditable-demo.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-08-02
+last_reviewed: 2026-08-05
 ai_provenance:
   model_family: GPT-5
   product: Codex
@@ -52,6 +52,39 @@ the default. Both classes retain 4 MiB per step, a clean Home/XDG environment,
 no inherited credentials, and a network-disabled read-only container with
 bounded tmpfs.
 
+Consumers may optionally add a
+`buildchain.declarative-demo-presentation/v1` presentation. This contract
+binds one consumer-owned proof label, question, summary, and optional
+transition to every demo in declared order. Buildchain verifies that each
+question is the same title used by capture and media; it does not invent or
+reinterpret the product argument.
+
+The presentation also chooses one of two README materialization modes. The
+default, when no presentation is declared, remains the original full generated
+block with commands, renditions, evidence, and claim boundary. `media-only`
+updates only the image inside each existing README marker so consumer-authored
+narrative and transitions survive regeneration. The generated technical
+details move to a separately declared Markdown specification, where stable
+per-demo markers preserve proof order and idempotent updates. The publication
+pull request stages that specification together with the README and
+content-addressed evidence. No presentation field grants publication or Work
+authority.
+
+The optional top-level `compositionMode` is an explicit visual contract.
+Omitting it preserves `presentation-framed`; declaring `terminal-fill` makes
+the bounded PTY replay the complete pixel surface without renderer-owned
+window chrome. Buildchain carries that choice into both native scenes. It does
+not infer full-frame intent from output resolution.
+
+The optional `buildchain.declarative-demo-playback/v1` contract separates
+observed command latency from presentation timing. Its
+`deterministic-readable` mode preserves the captured terminal event payloads
+and their order, records the observed final-event time as non-authoritative
+evidence, and maps event ordinals onto the declared `activeDurationMs` before a
+bounded `finalHoldMs`. Both native renditions therefore replay at the same
+readable pace even when an identical command runs faster or slower. Omitting
+the contract preserves the original PTY timestamp behavior.
+
 The uploaded metadata must bind the executable SHA-256, declare an empty
 runtime dependency set, and provide a bounded `executableFiles` array of exact
 artifact-relative paths and SHA-256 digests. GitHub Artifact transport does not
@@ -97,6 +130,7 @@ jobs:
       scenario-path: .buildchain/auditable-demo.json
       renderer-image: ghcr.io/kungfu-systems/build-images/demo-renderer@sha256:RENDERER_DIGEST
       render-media: true
+      render-failure-advisory: false
       media-profile: responsive-web-delivery-v1
       materialize: true
       materialize-base-ref: dev/v1/v1.0
@@ -193,6 +227,10 @@ The Gate:
   bounded tmpfs;
 - verifies the renderer manifest, media probe, exact input roots, exact output
   member set, and complete checksums;
+- independently verifies the requested composition mode, browser-observed
+  content viewport, PTY rows and columns, and deterministic cell geometry for
+  every frame set; `terminal-fill` is rejected unless the viewport and cell
+  grid resolve to the complete declared frame;
 - uploads a content-addressed qualified bundle plus an independent GitHub
   Artifact id, URL, archive digest, and expiry-bearing source coordinate.
 
@@ -202,9 +240,9 @@ passed gate receipt, and checksums covering every member exactly once.
 
 ## Selective Render
 
-`render-media: true` enables the second job. It downloads the just-uploaded Gate
-bundle by its content-addressed name, recomputes the Gate member root, verifies
-the exact source SHA and renderer digest, and only then renders the complete
+`render-media: true` enables the full-media step only after every declared demo
+has passed the required Gate. It recomputes each Gate member root, verifies the
+exact source SHA and renderer digest, and only then renders the complete
 qualified scene.
 
 The media bundle contains MP4, WebM, GIF, poster, probe, renderer manifest,
@@ -213,10 +251,19 @@ distribution checksums. A web-delivery profile also retains
 `media-inspection.json`, whose content root is bound into the receipt.
 `render-media: false` does not weaken or skip the Gate.
 
+`render-failure-advisory: true` makes only the full-media step advisory. A
+render failure remains visible as a failed step and workflow warning, while the
+required Gate keeps its normal failure semantics. Failed or partial media can
+never open a materialization PR. Use this for an Alpha lane whose binary
+publication must not depend on animation capacity; keep the default `false`
+for explicit media refreshes and other workflows that require complete media.
+
 When the Gate bundle contains a qualified terminal capture, the render job
 passes it read-only to the immutable renderer. The renderer manifest binds the
 capture root and terminal-state-machine version, but raw capture bytes remain
 in the Gate bundle rather than being copied into the public media bundle.
+Missing, malformed, out-of-bounds, non-full-frame, rendition-mismatched, or
+internally drifted composition evidence fails before media finalization.
 
 ## Media Qualification Profiles
 
@@ -225,13 +272,13 @@ The single machine-readable source is
 profile through `media-profile`; they cannot pass ffmpeg commands, codec flags,
 shell fragments, arbitrary profile paths, or transcoding instructions.
 
-| Profile | Meaning |
-| --- | --- |
-| `archive-v1` | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim. |
-| `web-delivery-v1` | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster. |
-| `responsive-web-delivery-v1` | Extends `web-delivery-v1` with exact 1280x720 H.264 MP4 and VP9 WebM responsive sources plus a 1280x720 README GIF while keeping the primary MP4/WebM and evidence poster at the source scene dimensions. Every declared downscale must preserve the scene aspect ratio and may never upscale. |
-| `responsive-long-form-web-delivery-v1` | Extends the responsive profile for explicitly admitted long-form scenes. Its measured-baseline multipliers raise only the GIF ceiling to 8 MiB and the four video ceilings to 4 MiB; all codec, native-resolution, no-audio, duration, and authority checks remain unchanged. |
-| `site-hero-v1` | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it. |
+| Profile                                | Meaning                                                                                                                                                                                                                                                                                        |
+| -------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `archive-v1`                           | Default compatibility contract. Retains the exact renderer outputs and classifies GIF as README compatibility evidence without making a browser-delivery claim.                                                                                                                                |
+| `web-delivery-v1`                      | Independently qualifies H.264 MP4 and VP9 WebM playback sources, forbids audio, requires exact scene dimensions and bounded duration/frame-rate drift, checks per-rendition byte ceilings, and proves MP4 `moov` precedes `mdat`. PNG remains the lossless evidence poster.                    |
+| `responsive-web-delivery-v1`           | Extends `web-delivery-v1` with exact 1280x720 H.264 MP4 and VP9 WebM responsive sources plus a 1280x720 README GIF while keeping the primary MP4/WebM and evidence poster at the source scene dimensions. Every declared downscale must preserve the scene aspect ratio and may never upscale. |
+| `responsive-long-form-web-delivery-v1` | Extends the responsive profile for explicitly admitted long-form scenes. Its measured-baseline multipliers raise only the GIF ceiling to 8 MiB and the four video ceilings to 4 MiB; all codec, native-resolution, no-audio, duration, and authority checks remain unchanged.                  |
+| `site-hero-v1`                         | Extends `web-delivery-v1` and additionally requires a qualified WebP browser poster. The current Build Images v1 renderer does not emit that member, so selecting this profile fails closed until the producer adds it.                                                                        |
 
 For web-delivery profiles, Buildchain runs its own fixed `ffprobe` invocation
 inside the same immutable, network-disabled renderer image. That command is