@kungfu-tech/buildchain 4.0.10-alpha.0 → 4.1.0-alpha.1

package/docs/shifu-gate-profiles.md

@@ -21,7 +21,7 @@ ai_provenance:
 Buildchain can schedule and aggregate a project-owned Shifu Gate profile without
 owning that project's gate ids, commands, dependencies, or dev/alpha/release
 policy. The reusable workflow is
-`.github/workflows/.gate-profile.yml`.
+`.github/workflows/.build-gate-profile.yml`.
 
 ## Ownership boundary
 
@@ -30,7 +30,7 @@ policy. The reusable workflow is
 | Gate schema, profile planning, execution, receipt qualification                     | Shifu                                 | `shifu gate plan`, `shifu gate run --profile`, `shifu gate receipt validate` |
 | Concrete gate catalog and profile decisions                                         | Consumer project                      | project Gate registry and detailed Gate docs                                 |
 | Runner labels and declared capabilities                                             | Consumer workflow / Buildchain preset | `runner-preset` or `platforms-json`                                          |
-| Deterministic runner matrix, immutable checkout, receipt transport, aggregate check | Buildchain                            | `.gate-profile.yml` and `shifu-gate-profile.mjs`                             |
+| Deterministic runner matrix, immutable checkout, receipt transport, aggregate check | Buildchain                            | `.build-gate-profile.yml` and `shifu-gate-profile.mjs`                             |
 | Whether a profile aggregate is required for dev, alpha, or release                  | Consumer project                      | protected-branch required-check policy and caller workflow                   |
 
 Buildchain treats the Shifu plan and receipt as versioned input contracts. It
@@ -103,7 +103,7 @@ per-gate evidence pointers, omissions, and issues.
 ```yaml
 jobs:
   gates:
-    uses: kungfu-systems/buildchain/.github/workflows/.gate-profile.yml@v3
+    uses: kungfu-systems/buildchain/.github/workflows/.build-gate-profile.yml@v3
     with:
       gate-profile: alpha-pr
       runner-preset: kungfu-v4-self-hosted
@@ -180,7 +180,7 @@ registry or its direct diagnostic commands.
 Unit fixtures prove deterministic matrix generation and required/advisory,
 capability, unsupported, missing, stale, failure, and definition-drift
 propagation. Because a train ref changes runtime scripts but not the outer
-reusable workflow topology, an unreleased `.gate-profile.yml` must also be
+reusable workflow topology, an unreleased `.build-gate-profile.yml` must also be
 validated through a trusted `workflow_dispatch` canary that references the
 temporary workflow ref or exact SHA. See
 [`runtime-train-validation.md`](runtime-train-validation.md).

package/docs/site-bundle-contract.md

@@ -66,7 +66,7 @@ internal paths. `cli-registry.json` similarly retains every governed command
 path, syntax, option, alias, and side-effect-free help command projected from
 the runtime registry and usage authority.
 `kfd-claims.json` is the Buildchain-owned KFD claim registry. It is generated
-from `packages/core/buildchain-kfd-claims.js` and enumerates the public release
+from `packages/core/adoption/buildchain-kfd-claims.js` and enumerates the public release
 claims plus the KFD-3 collaboration surfaces that Buildchain self-verifies
 during release promotion.
 `public-surface-audit.json` is the reverse enumeration report for those

package/docs/stable-candidate-patrol.md

@@ -125,7 +125,7 @@ permissions:
 
 jobs:
   stable:
-    uses: kungfu-systems/buildchain/.github/workflows/stable-candidate-patrol.yml@v4
+    uses: kungfu-systems/buildchain/.github/workflows/public-ops-stable-candidate-patrol.yml@v4
     with:
       release-now: ${{ inputs.release-now }}
       dry-run: false

package/docs/v4-adopter-delivery.md

@@ -1,152 +1,81 @@
 ---
 status: preview
-period: 2026-08-27
-theme: buildchain-v4-adopter-delivery
+period: 2026-09-10
+theme: buildchain-adopter-delivery
 doc_type: product-manual
 source_level: local-files
 confidence: high
 sensitivity: public
-evidence_grade: A
-review_state: self-reviewed
-last_reviewed: 2026-08-27
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-10
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-08-27
-  visible_context: Exact protected v3 adopter-delivery cut, v4 pure contract core, published npm archive bytes, public consumer policy, complete v3 capability inventory, and rooted cross-platform qualification reports.
-  invisible_context_boundary: No credentials, provider mutations, signing operations, publication operations, or release authority were used.
+  generated_at: 2026-09-10
+  visible_context: Current adopter runtime, public workflow, composite actions and local execution tests.
+  invisible_context_boundary: No hosted cross-platform execution or publication was performed for this documentation.
 ---
 
-# V4 Public Adopter Delivery
+# Public Adopter Delivery
 
-Buildchain v4 carries the v3 adopter-delivery capability through a public,
-protocol-neutral boundary. Consumers select an exact protocol driver and
-artifact profile, retain the rooted gate result, and independently recompute
-that readback. Buildchain does not interpret a protocol owned by another
-project and a passing result never grants runtime, provider, signing,
-publication, or release authority.
-
-The parity source is the read-only protected cut
-`dev/v3/v3.0@6b96bdad8d9f8ccf9275f27d9370a226a9c78465`. Work began from the
-minimal v4 absorption base
-`dev/v4/v4.0@e5611377efc03178f8687d99968cfdfa3ce2825b` and absorbed the
-verified protected-base advances through
-`dev/v4/v4.0@e0342713c7447960c13bd73377282b2e93f4853d` before delivery. These
-identities, the v3 vector-suite root, and the KFD package cut are committed in
-[`adopter-delivery-parity.json`](../architecture/adopter-delivery-parity.json)
-and exposed by the public Node API.
+The public entry is `kungfu-systems/buildchain/.github/workflows/public-build-adopter-qualification.yml`.
+Consumers call its floating `@v4` or `@v4-alpha` channel and retain matching dual
+contract locks. The workflow owns the Linux, macOS and Windows job matrix;
+`actions/adoption` owns admission, conformance and reconciliation;
+`packages/core/adoption` owns driver coordination and exact readback.
 
 ## Public contract
 
-The JSON input schema is
-[`v4-adopter-delivery-v1.schema.json`](../contracts/v4-adopter-delivery-v1.schema.json).
-An input names both selectors and the exact request identities. A selector
-whose implementation identity differs from the request fails closed. The
-public selectors are `json-assertion`, `kfd-category`, and `legacy-kfd`, with
-`git-commit` and `package` artifact profiles.
-
-Applications can also import the lower-level driver interface from
-`@kungfu-tech/buildchain/adopter-delivery-gate` and define an isolated driver.
-The v4 convenience runtime, exact source declaration, readback verification,
-N-1 lineage check, and published archive loader are exported from
-`@kungfu-tech/buildchain/v4-adopter-delivery`.
-
-## CLI
+The [input schema](../contracts/v4-adopter-delivery-v1.schema.json) requires an
+exact protocol driver and artifact profile. Built-in driver selectors are
+`json-assertion` and `kfd-category`; artifact profiles are `git-commit` and
+`package`. A selector must match the identity in the request.
 
-All four operations are offline after the declared archive bytes exist:
+Import the driver interface from `@kungfu-tech/buildchain/adopter-delivery-gate`
+and the current convenience runtime from `@kungfu-tech/buildchain/adopter-delivery`.
+The runtime evaluates declarations and independently recomputes readback. Its
+result grants no provider, signing, publication or release authority.
 
 ```sh
 buildchain adopter-delivery run \
-  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \
+  --input contracts/adopter-delivery/input.json \
   --output .buildchain/adopter-delivery/readback.json
 
 buildchain adopter-delivery verify \
-  --input contracts/fixtures/v4-adopter-delivery-v1/gate-positive.json \
+  --input contracts/adopter-delivery/input.json \
   --readback .buildchain/adopter-delivery/readback.json
-
-buildchain adopter-delivery bootstrap \
-  --input contracts/fixtures/v4-adopter-delivery-v1/bootstrap-positive.json
-
-buildchain adopter-delivery archive \
-  --input contracts/fixtures/v4-adopter-delivery-v1/archive-template.json
 ```
 
-`verify` requires the complete rooted readback and recomputes it. Missing or
-substituted readback, unknown selector, unknown driver, protocol-version
-mismatch, archive-byte or package-identity mismatch, and altered bootstrap
-lineage all fail closed.
-
-## N-1 and published archives
-
-N-1 bootstrap is distinct from the candidate. The lineage wrapper requires
-the exact v3 authority commit, exact v4 absorption base, and exact public
-Buildchain archive root. The retained v3 bootstrap also requires protected and
-published N-1 authority, rejects self-authorization, binds the candidate gate
-artifact, and requires merged Warrant-shaped evidence. Protocol, profile, or
-gate changes require independently reviewed transition evidence.
-
-Published authority loading verifies compressed bytes before extraction,
-rejects unsafe paths and links, verifies extracted package identity, verifies
-KFD's semantic package root, and imports only declared public delivery modules.
-The caller must supply an independently retained authority readback root. The
-fixture binds `@kungfu-tech/buildchain@3.0.9-alpha.16` and
-`@kungfu-tech/kfd@1.0.0-alpha.65`; a package version is not treated as proof of
-the Git source cut.
-
-## Config and reusable workflow
-
-Consumer configuration is closed and repository-relative:
-
-```toml
-[adopter_delivery]
-contract = "kungfu-buildchain-v4-adopter-delivery/v1"
-input_path = "contracts/adopter-delivery/input.json"
-readback_path = ".buildchain/adopter-delivery/readback.json"
-bootstrap_path = "contracts/adopter-delivery/bootstrap.json"
-archive_path = "contracts/adopter-delivery/archives.json"
-result_path = ".buildchain/adopter-delivery/result.json"
-driver_selector = "kfd-category"
-artifact_profile_selector = "package"
-```
+Unknown selectors, mismatched protocol versions, missing readback and changed
+rooted evidence fail. The API has two operations: `run` and `verify`.
 
-The public reusable workflow is
-`kungfu-systems/buildchain/.github/workflows/public-build-adopter-qualification.yml@v4` for
-stable use and `@v4-alpha` during prerelease evaluation. It resolves the exact
-called-workflow SHA, enforces floating selector plus dual-lock consumer
-admission, and runs the same CLI on Linux, macOS, and Windows. Buildchain
-dogfoods it through the thin
-[`self-build-adopter-dogfood.yml`](../.github/workflows/self-build-adopter-dogfood.yml)
-caller, which contains no steps or local orchestration and persists only the
-floating `@v4-alpha` selector.
+## Configuration
 
-The reusable workflow downloads exact public N-1 npm archives and uses the
-committed byte roots, semantic identity, and authority readback root. It has
-only `contents: read`; no provider credential or production writer is accepted
-or synthesized.
+The closed JSON input owns `driverSelector`, `artifactProfileSelector`, `request`
+and `context`. The public workflow's `input-path` names that document; CLI
+`--input`, `--readback` and `--output` arguments locate the request and evidence.
+Build configuration contains no duplicate Adopter Delivery declaration.
 
-## Cross-platform capability qualification
+Paths must stay inside the consumer repository. Workflow inputs name `consumer`
+and `input-path`. External qualification additionally requires the complete
+`consumer-repository`, exact `consumer-ref` and `invocation-source-path` tuple.
+The admission node verifies the checked-out source and defining runtime before
+executing policy. Conformance jobs use the admitted source SHA.
 
-The reusable workflow also produces a rooted report on `linux-x64`,
-`macos-arm64`, and `windows-x64`. Each report binds `job.workflow_sha`, the
-consumer source SHA, and the complete 4,648-row v3-to-v4 inventory. Source-only
-capabilities retain their raw category counts with an `exact-source-route`
-applicability; they are not mislabeled as operating-system executions.
+## Qualification evidence
 
-The executable boundary is exercised rather than inferred: a public run must
-pass, a substituted readback must fail, retry must reproduce the original root,
-terminal verification and N-1 bootstrap must pass, and the independent
-`ledger-specification-driver` clean-room test must pass without a KFD package.
-The workflow then reconciles one exact report from each platform. Final family
-qualification combines the Buildchain self-dogfood and `agent-hub-demo`
-matrices through the exported
-`@kungfu-tech/buildchain/cross-platform-adopter-qualification` aggregator.
-The report and aggregate explicitly grant no production, provider, release, or
-stable-publication authority.
+Each platform runs the current public CLI, rejects a tampered readback, retries
+and verifies the final readback. It also runs the independent
+`ledger-specification-driver` clean-room test. A report binds the exact runtime
+commit, consumer commit and input root to these executed scenarios.
 
-## Offline vectors
+Reconciliation requires exactly one report per declared platform. All reports
+use the same runtime; each consumer must use the same source and input across
+platforms. Missing, duplicate, inconsistent or modified reports fail.
+Qualification has no production, provider or release authority.
 
-[`offline-vectors.json`](../contracts/fixtures/v4-adopter-delivery-v1/offline-vectors.json)
-indexes positive driver, N-1, and archive cases plus negative selector, driver,
-archive identity, bootstrap lineage, protocol version, and tampered readback
-cases. Tests synthesize archives locally so extraction and identity failures do
-not depend on the network.
+Buildchain's [thin dogfood caller](../.github/workflows/self-build-adopter-dogfood.yml)
+uses the same public entry. Historical parity research remains historical
+evidence; current qualification does not download old Buildchain packages or
+require an old release's bootstrap lineage.

package/docs/v4-canonical-contracts.md

@@ -41,7 +41,7 @@ Event, receipt, and typed-fault objects use closed versioned shapes in [`contrac
 
 ## Implementations and proof
 
-- JavaScript: [`packages/core/canonical-contracts.js`](../packages/core/canonical-contracts.js)
+- JavaScript: [`packages/core/contracts/canonical-contracts.js`](../packages/core/contracts/canonical-contracts.js)
 - Rust: [`crates/buildchain-domain-contracts`](../crates/buildchain-domain-contracts)
 - Shared golden and adversarial cases: [`architecture/canonical-contract-fixtures.json`](../architecture/canonical-contract-fixtures.json)
 
@@ -55,7 +55,7 @@ The check validates both implementations, compares exact UTF-8 bytes and SHA-256
 
 ## Shared Delivery Warrant fixture runner
 
-The versioned trace contract in [`contracts/v4-delivery-warrant-trace-v1.schema.json`](../contracts/v4-delivery-warrant-trace-v1.schema.json) is the language-neutral boundary for retained Delivery Warrant fixtures. The JavaScript runner in [`packages/core/delivery-warrant-fixture-runner.js`](../packages/core/delivery-warrant-fixture-runner.js) and the Rust runner in [`crates/buildchain-domain-contracts`](../crates/buildchain-domain-contracts) consume the same UTF-8 fixture bytes and emit the same deterministic semantic projection.
+The versioned trace contract in [`contracts/v4-delivery-warrant-trace-v1.schema.json`](../contracts/v4-delivery-warrant-trace-v1.schema.json) is the language-neutral boundary for retained Delivery Warrant fixtures. The JavaScript runner in [`packages/core/dev-delivery/delivery-warrant-fixture-runner.js`](../packages/core/dev-delivery/delivery-warrant-fixture-runner.js) and the Rust runner in [`crates/buildchain-domain-contracts`](../crates/buildchain-domain-contracts) consume the same UTF-8 fixture bytes and emit the same deterministic semantic projection.
 
 Each trace is closed and ordered. It binds the exact prior root, event, action or typed fault, canonical successor bytes and root, generation, fencing counter, ordered declarative effects, provider-neutral observations, and rooted receipt. The runner verifies the full root chain before returning a projection. Malformed JSON, missing or unknown fields, reordered sequences, stale roots, and unsupported contract versions fail closed.
 
@@ -68,7 +68,7 @@ The runner is not a state-machine implementation and does not sample time, execu
 
 ## TypeScript shadow adapter
 
-The adapter in [`packages/core/delivery-warrant-shadow-adapter.js`](../packages/core/delivery-warrant-shadow-adapter.js) runs the existing TypeScript v3 fixture projection first and preserves that exact result as the only authoritative output. When explicitly enabled, it sends the same canonical input bytes to the replaceable Rust host command, requires the effect-disabled host capability, and captures the returned semantic projection only as a non-authoritative observation. Rust never receives effect authority, and success, failure, timeout, cancellation, malformed output, or an unsupported host cannot change the v3 result.
+The adapter in [`packages/core/dev-delivery/delivery-warrant-shadow-adapter.js`](../packages/core/dev-delivery/delivery-warrant-shadow-adapter.js) runs the existing TypeScript v3 fixture projection first and preserves that exact result as the only authoritative output. When explicitly enabled, it sends the same canonical input bytes to the replaceable Rust host command, requires the effect-disabled host capability, and captures the returned semantic projection only as a non-authoritative observation. Rust never receives effect authority, and success, failure, timeout, cancellation, malformed output, or an unsupported host cannot change the v3 result.
 
 Shadow retention accepts only checked-in fixtures or captured replays explicitly marked public-safe. Each returned observation binds the input root, exact TypeScript and Rust source revisions, validator version, capture time, fixed retention deadline, both projections, and sanitized diagnostics. It contains no comparison verdict or cutover signal. The adapter is disabled unless the caller opts in or sets `BUILDCHAIN_V4_WARRANT_SHADOW=enabled`; even then, invalid source bindings or an unsafe retention class skip Rust invocation.
 

package/docs/v4-compatibility-facts.md

@@ -27,7 +27,7 @@ verified path receipt.
 ## Authority chain
 
 The package source is
-`packages/core/buildchain-compatibility-facts.json`, retained from v3 exact head
+`packages/core/governance/buildchain-compatibility-facts.json`, retained from v3 exact head
 `6b96bdad8d9f8ccf9275f27d9370a226a9c78465`. Each declaration becomes a KFR2
 predicate and relation, then enters an append-only temporal bundle. The
 registry identity binds all Fact, proof, Cut, supersession, revocation, and

package/docs/v4-declarative-release-tail-migration.md

@@ -1,43 +1,38 @@
 ---
 status: active
 period: ongoing
-theme: buildchain-v4-declarative-release-tail
-doc_type: migration-guide
+theme: buildchain-layered-architecture
+doc_type: implementation-guide
 source_level: local-files
 confidence: high
 sensitivity: public
-evidence_grade: A
-review_state: self-reviewed
-last_reviewed: 2026-08-26
+evidence_grade: B
+review_state: unreviewed
+last_reviewed: 2026-09-10
 ai_provenance:
-  model_family: GPT-5
+  model_family: GPT-6
   product: Codex
-  generated_at: 2026-08-26
-  invisible_context: unavailable
+  generated_at: 2026-09-10
+  visible_context: Buildchain 4.1 source, architecture registries and local validation.
+  invisible_context_boundary: No unpublished release or external consumer qualification is claimed.
 ---
 
-# Migrate a release-candidate promotion to the v4 Provider Plane
+# Adopt the current release promotion API
 
-Persist the public workflow call at the floating major ref and keep the matching contract lock in the consumer repository:
+Call `public-release-promote.yml` with the closed `request-json` contract after
+the selected floating channel publishes this API. Keep both channel contract
+locks in the consumer repository. See [Promotion request](release-promotion-request.md)
+for the complete request and examples.
 
-```yaml
-jobs:
-  promote:
-    uses: kungfu-systems/buildchain/.github/workflows/release-candidate-promote.yml@v4
-    with:
-      buildchain-contract-lock-path: .buildchain/contract-lock.json
-      declarative-release-tail: true
-```
+The declaration-driven provider plane is the sole publisher. There is no mode
+switch, command-hook adapter or retained v3 execution path. Candidate identity,
+sealed artifact manifests, qualification and provider receipt roots determine
+execution and recovery.
 
-The Build/Verify workflow now uploads these candidate-owned inputs together:
+On interruption, resume the same candidate and transaction state. The workflow
+verifies the source, artifact and policy roots, then continues the incomplete
+operations. Completed publication recovery reads the existing evidence and
+preserves immutable product bytes.
 
-- `release-candidate-passport.json`
-- `release-candidate-stage-capsules.json`
-- `release-candidate-publication-qualification.json`
-- the typed payload and manifest artifacts bound by those documents
-
-Remove all v4 values for `publish-command`, `publication-gate-command`, `publication-consumer-qualification-command`, `publication-commit-command`, `release-activation-command`, `release-passport-evidence-command`, KFD/invariant command inputs, and every other `command`, `cmd`, `script`, `shell`, or `run` field. v4 admission rejects them before publication planning. Do not replace them with a wrapper script or a standalone workflow; declare provider evidence and let the reusable workflow execute the fixed Provider Plane.
-
-On interruption, rerun with the same candidate and transaction state. Buildchain verifies the candidate/source/artifact/policy roots and continues from the first missing standardized receipt. Never delete the state file to make a failed capability replay from the beginning.
-
-v3 workflow calls retain their existing command-compatible behavior. Migrating a v3 consumer is an explicit contract change, not an automatic reinterpretation.
+The 4.1 development merge is not an alpha publication. Consumer adoption waits
+for the corresponding published channel contract and refreshed locks.

package/docs/v4-publication-rehearsal.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: self-reviewed
-last_reviewed: 2026-08-16
+last_reviewed: 2026-09-11
 ai_provenance:
   model_family: GPT-5
   product: Codex
@@ -105,15 +105,15 @@ effect_default = "disabled"
 ```
 
 The public reusable
-[`release-tail.yml`](../.github/workflows/release-tail.yml) accepts the same
+[`public-release-tail.yml`](../.github/workflows/public-release-tail.yml) accepts the same
 capsule, candidate root, mode, state and evidence paths. Before publication,
-Buildchain dogfoods that public surface through a thin same-commit local reusable
-call with the exact PR-head or dispatch SHA as its runtime. The reusable is
+Buildchain dogfoods that public surface through the same floating `@v4` entry
+as external consumers. The shared entry selects the runtime from the transient
+parameter, consumer lock, or entry default, and prepares it in each job. The reusable is
 permission-neutral and the self-dogfood caller stays `contents: read`, passes
 `execute: false`, and therefore cannot inherit or synthesize production write
 authority. Effectful production callers must explicitly declare their own
-provider permission. Durable external consumers remain on the floating
-`@v4-alpha` contract. Provider mode additionally requires the exact authority
+provider permission. Durable external consumers use `@v4` or `@v4-alpha`. Provider mode additionally requires the exact authority
 path. Provider bindings come from the capsule; an optional external bindings
 input is accepted only when its canonical exact root and payload equal the
 capsule binding. Ordinary calls default to `simulate`.

package/docs/v4-rust-wasm-production-authority.md

@@ -26,9 +26,9 @@ workflow 输入输出等副作用边界。权威契约见
 
 ## 分发与调用
 
-`packages/core/buildchain-domain.wasm` 与 JavaScript 一起提交和发布。三个生产 Action
+`packages/core/runtime/buildchain-domain.wasm` 与 JavaScript 一起提交和发布。三个生产 Action
 在构建时把完全相同的字节复制到各自 `dist/`；运行时不进入调用方仓库寻找 Rust
-源码，也不要求安装 Rust。`packages/core/domain-wasm.js` 从自身相邻路径同步读取
+源码，也不要求安装 Rust。`packages/core/runtime/domain-wasm.js` 从自身相邻路径同步读取
 artifact，先核验生成元数据中的 SHA-256，再实例化 WebAssembly 并通过封闭 JSON/bytes
 ABI 调用领域操作。
 

package/docs/v4-stage-capsule.md

@@ -8,7 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-08-10
+last_reviewed: 2026-09-11
 ai_provenance:
   model_family: GPT-5
   product: Codex
@@ -122,7 +122,7 @@ access and produce the same ordered decisions and `planRoot`.
 
 An eligible completed dependency becomes an exact-root restore; a missing or
 invalid target becomes a rebuild, and only that target's dependency closure is
-scheduled. Source, platform, toolchain, runtime, policy, declared-input,
+scheduled. Source, platform, toolchain, policy, declared-input,
 transformation, output-manifest, and retention changes carry rooted causal
 invalidation fields. Cross-platform reuse, corrupt or partial content, root
 mismatch, and insufficient qualification reject reuse fail closed.
@@ -139,13 +139,11 @@ Buildchain-owned public reusable workflow,
 `.github/workflows/public-build-stage-capsule-canary.yml`. Buildchain's caller is the thin
 `.github/workflows/self-build-public-consumer-dogfood.yml`; it has no steps, copied
 orchestration, local action, direct qualification invocation, or private
-consumer profile. Candidate recursion is resolved only by publishing the exact
-candidate at `train/v4/v4.0/<capability>` and calling that fully qualified
-public ref. After successful qualification and protected merge, the caller can
-be pinned to the exact protected commit. An internal exception is never a
-permitted recursion mechanism.
+consumer profile. The persisted caller uses `@v4`. Candidate validation passes
+`train/v4/v4.1/<capability>` as the transient `runtime-ref` input, through the
+same central selection and preparation entry as external consumers.
 
-The called workflow checks out that same commit as its runtime, reads the consumer's
+The called workflow prepares the selected runtime and reads the consumer's
 tracked `.buildchain/buildchain.toml`, and executes only `install`, `build`,
 and `verify` on GitHub-hosted Linux x64, macOS arm64, and Windows x64 runners.
 Each stage binds its declared command, dependency edge, exact consumer source,
@@ -157,8 +155,9 @@ paths; it does not copy the campaign orchestration.
 The external seed retains `install` and `build` before an intentional late
 `verify` failure. A clean process reads the retained store, restores only the
 exact `build` root, rebuilds `verify`, and compares the result with the fresh
-three-stage aggregate. Runtime-ref, source, command/profile, manifest, summary,
-output, platform, and Capsule-root drift all stop with typed diagnostics.
+three-stage aggregate. A repaired runtime may continue the campaign. Source,
+command/profile, manifest, summary, output, platform and Capsule integrity drift
+still stop with typed diagnostics; runtime provenance does not invalidate reuse.
 
 Qualification compares the declared artifact-manifest and aggregate content
 roots from a fresh full build with the roots assembled from retained and rebuilt
@@ -182,7 +181,7 @@ authorized by this qualification.
 Focused local rehearsal:
 
 ```sh
-node scripts/stage-capsule-qualification.mjs campaign \
+node packages/core/build/commands/stage-capsule-qualification.mjs campaign \
   --work-root /tmp/buildchain-v4-stage-qualification \
   --platform linux-x64 \
   --consumer buildchain \