@microteia/console 2.33.0 → 2.36.0

package/CONSOLE-VERSIONS.md

@@ -22,6 +22,22 @@
 - fix(command): what was broken, and what it did to whoever hit it.
 -->
 
+#### [2.36.0] — 2026-11-05
+
+- fix(environment): every command that acts on an installation (`readEnvironment`) refuses when the installation's `CONSOLE-VERSIONS.md` names a Console newer than the one running. An older Console rewrites `microteia.yaml` with only the sections it knows and replaces `CONSOLE-VERSIONS.md` and `MICROTEIA.md` with its own texts — nothing failed: a forgotten copy of Console 2.6.0, left in a folder of the installation, ran `unpack` there, the `login:` block disappeared and the Console history lost thirty versions without a word. No new field marks it, on purpose: an older Console would drop the field it does not know.
+- feat(version): `microteia --version` still answers in that case, and says which Console last updated the installation.
+
+#### [2.35.0] — 2026-11-02
+
+- feat(publish): the releases repository README links to the official documentation (https://doc.microteia.com), and `publish` rewrites it whenever it differs from the current text — after the catalog, warning instead of failing. It was written only when seeding an empty repository, so the README of an existing one stayed frozen at the text of its first `publish` and no change to it ever arrived. `publish --dry-run` says when it would be rewritten.
+- docs(pack-console): the npm README of the Console links to https://doc.microteia.com.
+
+#### [2.34.0] — 2026-11-02
+
+- fix(publish): `withEntry` promotes `channels.stable` to the HIGHER of the current and the new version. Publishing out of order — a fix on an older line, `9.180.1` after `9.191.0` — moved `latest` back, and every `unpack --version latest` received the older version. `publish` says whether the version became `latest` or only joined the list.
+- fix(pack): `pack --output <dir>` warns that `publish` reads only `distributions/kernel/<version>/`; the package written elsewhere was simply not found.
+- docs(installation): a platform setting (`SELF_SERVICE_TENANTS`, `AUDIT_ARCHIVE_BUCKET`) reaches the functions with `microteia deploy --only functions`, not `provision`, which only tracks settings declared by extensions and by the installation's `functions/`. The prerequisites and `MICROTEIA.md` §3 said `provision`, which changed nothing.
+
 #### [2.33.0] — 2026-10-28
 
 - feat(export-catalog): each screen now carries `keys` — every record key of the collection as `name`, `kind`, `fields`, `scope`, `normalize` and `sparse`, plus `ownerPluginId` when an extension declared it — and each field carries `unique: true` when it is set. The conflict `message` and the deprecated `status` stay out: they do not change which reservation a record gets. Without this, the artifact plan proposed as new, on every run, a key the office declared in the Form Design or a third-party extension installed. Always written, even empty; a snapshot taken by an older Console is read as "keys unknown", and the authoring tools say so.

package/README.md

@@ -1,8 +1,10 @@
-# Microteia Console 2.33.0
+# Microteia Console 2.36.0
 
 Installs and updates Microteia in a Firebase project you own. It has no npm dependencies of its own —
 what it needs are command-line tools that are already on the machine, listed at the bottom.
 
+📖 **Documentation: [doc.microteia.com](https://doc.microteia.com)**
+
 ## Installing it
 
     npm i -g @microteia/console

package/lib/console/environment.d.ts

@@ -73,6 +73,28 @@ export interface Environment {
 export declare const ENVIRONMENT_FILE = "microteia.yaml";
 export declare const parseEnvironment: (source: string) => Environment;
 export declare const serializeEnvironment: (environment: Environment) => string;
+/**
+ * O Console que deixou esta instalação como ela está, quando ele é MAIS NOVO que o que está rodando.
+ *
+ * O sinal é o topo do `CONSOLE-VERSIONS.md` da raiz, que o `unpack` sobrepõe com o histórico do próprio
+ * binário — é, portanto, o último Console que trocou o kernel ali. Nenhum campo novo foi inventado para
+ * isso, e é deliberado: um Console antigo apagaria o campo que ele não conhece, que é o defeito inteiro.
+ *
+ * Sem o arquivo (instalação anterior a ele, ou apagado) não há o que comparar, e nada é recusado.
+ */
+export declare const newerConsoleThanThis: (root: string) => Promise<string | null>;
+/**
+ * Lê o `microteia.yaml` — e RECUSA quando um Console mais novo já passou por aqui.
+ *
+ * Um Console antigo reescreve este arquivo só com as seções que conhece, e sobrepõe o
+ * `CONSOLE-VERSIONS.md` e o `MICROTEIA.md` com os textos dele. Nada disso falha: a configuração que ele
+ * não conhece some, e o histórico volta meses, em silêncio. Foi o que aconteceu quando uma cópia
+ * esquecida do Console, numa pasta da instalação, rodou o `unpack` — o bloco `login:` desapareceu, e o
+ * histórico do Console perdeu trinta versões.
+ *
+ * A recusa fica aqui porque este é o primeiro passo de todo comando que AGE sobre a instalação, antes de
+ * qualquer escrita. O `--version` lê o arquivo por outro caminho, e continua respondendo.
+ */
 export declare const readEnvironment: (path: string) => Promise<Environment>;
 export declare const writeEnvironment: (path: string, environment: Environment) => Promise<void>;
 export declare const slug: (value: string) => string;

package/lib/console/environment.js

@@ -1,4 +1,8 @@
 import { readFile, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { compareVersions } from '../kernel/manifest.js';
+import { CLI_VERSION } from '../shared/paths.js';
+import { CONSOLE_CHANGELOG, changelogVersions } from '../vendor/changelogs.js';
 export const ENVIRONMENT_FILE = 'microteia.yaml';
 /**
  * O YAML aqui é um SUBCONJUNTO deliberado: mapas de dois níveis com valores escalares, que é a forma
@@ -140,9 +144,36 @@ login:
   # To USE an extension inside the organization, install it from the Extensions screen instead.
   extensions: ${quote(environment.login.extensions)}
 `;
+/**
+ * O Console que deixou esta instalação como ela está, quando ele é MAIS NOVO que o que está rodando.
+ *
+ * O sinal é o topo do `CONSOLE-VERSIONS.md` da raiz, que o `unpack` sobrepõe com o histórico do próprio
+ * binário — é, portanto, o último Console que trocou o kernel ali. Nenhum campo novo foi inventado para
+ * isso, e é deliberado: um Console antigo apagaria o campo que ele não conhece, que é o defeito inteiro.
+ *
+ * Sem o arquivo (instalação anterior a ele, ou apagado) não há o que comparar, e nada é recusado.
+ */
+export const newerConsoleThanThis = async (root) => {
+    const contents = await readFile(join(root, CONSOLE_CHANGELOG), 'utf8').catch(() => null);
+    const latest = contents === null ? undefined : changelogVersions(contents)[0];
+    return latest !== undefined && compareVersions(latest, CLI_VERSION) > 0 ? latest : null;
+};
+/**
+ * Lê o `microteia.yaml` — e RECUSA quando um Console mais novo já passou por aqui.
+ *
+ * Um Console antigo reescreve este arquivo só com as seções que conhece, e sobrepõe o
+ * `CONSOLE-VERSIONS.md` e o `MICROTEIA.md` com os textos dele. Nada disso falha: a configuração que ele
+ * não conhece some, e o histórico volta meses, em silêncio. Foi o que aconteceu quando uma cópia
+ * esquecida do Console, numa pasta da instalação, rodou o `unpack` — o bloco `login:` desapareceu, e o
+ * histórico do Console perdeu trinta versões.
+ *
+ * A recusa fica aqui porque este é o primeiro passo de todo comando que AGE sobre a instalação, antes de
+ * qualquer escrita. O `--version` lê o arquivo por outro caminho, e continua respondendo.
+ */
 export const readEnvironment = async (path) => {
+    let environment;
     try {
-        return parseEnvironment(await readFile(path, 'utf8'));
+        environment = parseEnvironment(await readFile(path, 'utf8'));
     }
     catch (error) {
         if (error.code === 'ENOENT') {
@@ -150,6 +181,14 @@ export const readEnvironment = async (path) => {
         }
         throw error;
     }
+    const newer = await newerConsoleThanThis(dirname(path));
+    if (newer !== null) {
+        throw new Error(`This installation was last updated by Microteia Console ${newer}, and this is ${CLI_VERSION}.\n`
+            + `An older Console rewrites ${ENVIRONMENT_FILE} without the settings it does not know, and replaces\n`
+            + `${CONSOLE_CHANGELOG} with an older history, so it stops here. Update it with "npm i -g @microteia/console",\n`
+            + 'and check that the "microteia" you ran is that one, not a copy left in a folder.');
+    }
+    return environment;
 };
 export const writeEnvironment = async (path, environment) => {
     await writeFile(path, serializeEnvironment(environment));

package/lib/console/versions.js

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { CLI_VERSION } from '../shared/paths.js';
-import { ENVIRONMENT_FILE, parseEnvironment } from './environment.js';
+import { ENVIRONMENT_FILE, newerConsoleThanThis, parseEnvironment } from './environment.js';
 import { installPath } from './unpack.js';
 /**
  * O que `microteia --version` responde.
@@ -59,6 +59,15 @@ export const versionReport = async (directory, newer) => {
         lines.push('');
         lines.push(`${inPlace} is in place and ${deployed} is what the project runs. "microteia deploy" publishes it.`);
     }
+    /**
+     * É a pergunta que se faz quando um comando recusa por isto — e a resposta tem de estar aqui, porque
+     * o `--version` é o único que continua rodando com o Console velho.
+     */
+    const newerConsole = await newerConsoleThanThis(directory);
+    if (newerConsole !== null) {
+        lines.push('');
+        lines.push(`Console ${newerConsole} last updated this installation. This one is older and will not act on it.`);
+    }
     /**
      * E o que o canal oferece, quando há canal alcançável. Vem por último porque é a única linha que
      * depende de rede: se ela faltar, tudo acima continua sendo a resposta inteira.

package/lib/kernel/channel.d.ts

@@ -63,7 +63,8 @@ export declare const entryOf: (manifest: KernelManifest, urls: {
     manifest: string;
 }, publishedAt: string) => ChannelEntry;
 /**
- * Acrescenta a entrada e promove o canal, RECUSANDO uma versão que já está lá.
+ * Acrescenta a entrada e promove o canal à MAIOR versão entre a atual e a nova, RECUSANDO uma versão
+ * que já está lá.
  *
  * Republicar é a origem de "a mesma versão com dois conteúdos", e ela não tem conserto depois: alguém
  * conferiu um hash contra o download de ontem e a partir dali as duas instalações discordam sobre o que

package/lib/kernel/channel.js

@@ -109,7 +109,8 @@ export const entryOf = (manifest, urls, publishedAt) => {
 };
 const byVersionDescending = (left, right) => compareVersions(right.version, left.version);
 /**
- * Acrescenta a entrada e promove o canal, RECUSANDO uma versão que já está lá.
+ * Acrescenta a entrada e promove o canal à MAIOR versão entre a atual e a nova, RECUSANDO uma versão
+ * que já está lá.
  *
  * Republicar é a origem de "a mesma versão com dois conteúdos", e ela não tem conserto depois: alguém
  * conferiu um hash contra o download de ontem e a partir dali as duas instalações discordam sobre o que
@@ -120,9 +121,13 @@ export const withEntry = (index, entry) => {
         throw new Error(`${entry.version} is already published, and a released version is never rewritten.\n`
             + 'Bump the version in package.json and package it again.');
     }
+    // Publicar fora de ordem é permitido (uma correção numa linha antiga), e o canal não pode andar para
+    // trás por isso: `latest` passaria a entregar uma versão MAIS VELHA a quem atualiza.
+    const current = index.channels[STABLE_CHANNEL];
+    const stable = current !== undefined && compareVersions(current, entry.version) > 0 ? current : entry.version;
     return {
         schema: INDEX_SCHEMA,
-        channels: { ...index.channels, [STABLE_CHANNEL]: entry.version },
+        channels: { ...index.channels, [STABLE_CHANNEL]: stable },
         kernel: [entry, ...index.kernel].sort(byVersionDescending),
     };
 };

package/lib/kernel/manifest.js

@@ -131,7 +131,7 @@ export const MANUAL_PREREQUISITES = [
             + 'longer. Grant the functions\' runtime service account roles/storage.admin on THAT bucket only (it '
             + 'reads the bucket\'s retention settings and sets each day\'s retention, which the object roles '
             + 'do not cover), write AUDIT_ARCHIVE_BUCKET=<bucket> in .env.<projectId> '
-            + 'and run microteia provision. What it protects against, and what it does not: a locked bucket stops '
+            + 'and run microteia deploy --only functions (provision does not carry the platform\'s own settings). What it protects against, and what it does not: a locked bucket stops '
             + 'deletion and rewriting of what was already archived; the chain makes any change visible on '
             + 'verification. A project owner can still alter or delete an audit line in Firestore BEFORE its day '
             + 'is exported (the export runs hourly, about an hour after midnight UTC), turn the archive off (that '
@@ -147,7 +147,7 @@ export const MANUAL_PREREQUISITES = [
         detail: 'By default every new account gets an organization of its own, with that person as the owner. In an '
             + 'installation shared by several organizations — each one created on purpose — that lets anyone who '
             + 'can create an account open one. Write SELF_SERVICE_TENANTS=false in .env.<projectId> and run '
-            + 'microteia provision: from then on a new account waits to be added to an organization, and only the '
+            + 'microteia deploy --only functions: from then on a new account waits to be added to an organization, and only the '
             + 'installation administrator (SYSTEM) opens organizations, in Access management > Organizations, '
             + 'naming an owner who already has an account. The first account of the installation gets one '
             + 'anyway. Any value other than empty, true or false is read as false. Two-step verification is '

package/lib/shared/paths.d.ts

@@ -87,4 +87,4 @@ export declare const consoleRoot: string;
  * de código nunca chegou a quem instala. Este bloco fica sendo o que ele já era antes de crescer: a
  * política de semver da ferramenta, mais o registro do que motivou as versões até a `2.5.0`.
  */
-export declare const CLI_VERSION = "2.33.0";
+export declare const CLI_VERSION = "2.36.0";

package/lib/shared/paths.js

@@ -94,4 +94,4 @@ export const consoleRoot = resolve(here, '..', '..');
  * de código nunca chegou a quem instala. Este bloco fica sendo o que ele já era antes de crescer: a
  * política de semver da ferramenta, mais o registro do que motivou as versões até a `2.5.0`.
  */
-export const CLI_VERSION = '2.33.0';
+export const CLI_VERSION = '2.36.0';

package/lib/vendor/installationDocs.js

@@ -191,10 +191,15 @@ deliberately, because you asked.
 They live in \`.env.<projectId>\`, next to \`microteia.yaml\`. \`unpack\` creates the file and adds any
 setting a new version introduces, **never overwriting what you filled in**.
 
-After changing a value, run \`microteia provision\`. The value is stamped into each Cloud Function at
-*its* deploy, so a function already running keeps the previous one until it is deployed again; provision
-notices the change (by a salted digest in \`microteia.yaml\`) and requeues exactly the functions that
-carry that setting.
+The value is stamped into each Cloud Function at *its* deploy, so a function already running keeps the
+previous one until it is deployed again. Which command deploys it again depends on who declares the
+setting:
+
+- **A setting of an extension, or of your own \`functions/\`** — run \`microteia provision\`. It notices the
+  change (by a salted digest in \`microteia.yaml\`) and requeues exactly the functions that carry it.
+- **A setting of the platform itself** (\`SELF_SERVICE_TENANTS\`, \`AUDIT_ARCHIVE_BUCKET\`, …) — run
+  \`microteia deploy --only functions\`. \`provision\` does not track them; the deploy compares each
+  function's stamp, which includes its environment, and redeploys the ones whose value changed.
 
 An empty line means "not configured". A feature that needs it stays off rather than failing halfway.
 

package/lib/vendor/pack.js

@@ -3,7 +3,7 @@ import { basename, join, relative } from 'node:path';
 import { flagValue, hasFlag } from '../shared/args.js';
 import { repoRoot } from '../shared/paths.js';
 import { run } from '../shared/run.js';
-import { blank, bullets, heading, info, step, success } from '../shared/ui.js';
+import { blank, bullets, heading, info, step, success, warn } from '../shared/ui.js';
 import { DEFAULT_FUNCTIONS_REGION, KERNEL_COMPONENTS, KERNEL_DISTRIBUTION_ID, MANUAL_PREREQUISITES, MINIMUM_CLI_VERSION, REQUIRED_NODE_VERSION, callableFunctionNames, declaredParametersIn, exportedFunctionNames, parseKernelVersion, parsePreLoginPoints, } from '../kernel/manifest.js';
 import { digestOfFile } from '../shared/digest.js';
 import { kernelTarballName } from '../kernel/channel.js';
@@ -140,7 +140,8 @@ export const pack = async (args) => {
     }
     const baselineFunctions = baselineFunctionsOf(functionNames, claims);
     const baselineIndexes = baselineIndexesOf(rootIndexes.indexes, claims);
-    const outputDir = flagValue(args, 'output') ?? join(root, 'distributions', 'kernel', version);
+    const defaultOutputDir = join(root, 'distributions', 'kernel', version);
+    const outputDir = flagValue(args, 'output') ?? defaultOutputDir;
     const stageDir = join(outputDir, 'package');
     const tarball = join(outputDir, kernelTarballName(version));
     heading(`Packaging Microteia kernel ${version} (contract ${kernelVersion})`);
@@ -264,6 +265,13 @@ export const pack = async (args) => {
         `size: ${(digest.bytes / 1_000_000).toFixed(1)} MB, sha256 ${digest.sha256.slice(0, 12)}…`,
     ]);
     blank();
+    if (outputDir !== defaultOutputDir) {
+        // O `publish` lê só `distributions/kernel/<versão>/`: o pacote escrito em outro lugar não é achado,
+        // e sem este aviso a recusa dele parecia um pacote que nunca foi feito.
+        warn(`--output wrote it outside ${relative(root, defaultOutputDir)}/, and "microteia publish" reads only there.`);
+        info('  Copy the folder there to publish it, or install the file directly (below).');
+        blank();
+    }
     info('Publish it with:');
     bullets(['microteia publish --dry-run   (says what would go up)', 'microteia publish']);
     blank();

package/lib/vendor/packageTemplates.js

@@ -178,6 +178,8 @@ export const consoleReadme = (version) => `# Microteia Console ${version}
 Installs and updates Microteia in a Firebase project you own. It has no npm dependencies of its own —
 what it needs are command-line tools that are already on the machine, listed at the bottom.
 
+📖 **Documentation: [doc.microteia.com](https://doc.microteia.com)**
+
 ## Installing it
 
     npm i -g ${CONSOLE_PACKAGE_NAME}

package/lib/vendor/publish.js

@@ -6,7 +6,7 @@ import { CLI_VERSION, repoRoot } from '../shared/paths.js';
 import { capture, captureOrThrow, run } from '../shared/run.js';
 import { blank, bullets, heading, info, pending, step, success, warn } from '../shared/ui.js';
 import { digestMismatch, digestOfFile } from '../shared/digest.js';
-import { emptyIndex, entryOf, kernelTarballName, parseIndex, publishedBefore, serializeIndex, withEntry, } from '../kernel/channel.js';
+import { emptyIndex, entryOf, kernelTarballName, parseIndex, publishedBefore, serializeIndex, withEntry, STABLE_CHANNEL, } from '../kernel/channel.js';
 import { CONSOLE_CHANGELOG, KERNEL_CHANGELOG, changelogEntries, readChangelog } from './changelogs.js';
 import { CONSOLE_PACKAGE_NAME } from './packageTemplates.js';
 import { assertInsideRepository } from './repository.js';
@@ -72,16 +72,21 @@ const readPublishedIndex = async (repo) => {
     const text = Buffer.from(contents.content, 'base64').toString('utf8');
     return { index: parseIndex(text, `${repo}/${INDEX_PATH}`), sha: contents.sha, empty: false };
 };
+/** O caminho do README DENTRO do repositório de releases. */
+const README_PATH = 'README.md';
 /**
  * O que fica na raiz do repositório de releases, para quem chegar nele sem contexto.
  *
- * Ele é escrito UMA vez, ao semear — não é sobreposto depois. O que promete estar atual é o catálogo,
- * e é ele que a cada publicação é reescrito.
+ * É documento GERADO, e nenhuma pessoa escreve naquele repositório: por isso é sobreposto sempre que
+ * diverge deste texto. Escrito só ao semear, ele congelava no texto do primeiro `publish` — o link da
+ * documentação oficial nunca chegaria ao repositório que já existia.
  */
 const releasesReadme = () => `# Microteia — releases
 
 Distribution artifacts for the Microteia platform. **No source lives here**: what travels is compiled.
 
+📖 **Documentation: [doc.microteia.com](https://doc.microteia.com)**
+
 - \`kernel/index.json\` — the catalog the Microteia Console reads. It lists every published version with
   its size and sha256, and the absolute URLs of the files that carry it.
 - Each version is a release tagged \`kernel-<version>\`, carrying the package and its manifest.
@@ -94,6 +99,17 @@ Nobody downloads from here by hand:
 The Console reads the catalog, verifies what it downloads against the sha256 above, and only then puts
 it in place.
 `;
+const writeReadme = async (repo, sha, message) => {
+    const content = Buffer.from(releasesReadme(), 'utf8').toString('base64');
+    const args = [
+        'api', '--method', 'PUT', `repos/${repo}/contents/${README_PATH}`,
+        '-f', `message=${message}`,
+        '-f', `content=${content}`,
+    ];
+    if (sha !== null)
+        args.push('-f', `sha=${sha}`);
+    await captureOrThrow('gh', args);
+};
 /**
  * Dá ao repositório o primeiro commit, porque sem ele não existe release.
  *
@@ -104,14 +120,20 @@ it in place.
  */
 const seedRepository = async (repo) => {
     pending(`${repo} has no commits yet — writing its README first`);
-    const content = Buffer.from(releasesReadme(), 'utf8').toString('base64');
-    await captureOrThrow('gh', [
-        'api', '--method', 'PUT', `repos/${repo}/contents/README.md`,
-        '-f', 'message=the releases repository',
-        '-f', `content=${content}`,
-    ]);
+    await writeReadme(repo, null, 'the releases repository');
     success(`seeded ${repo}`);
 };
+const staleReadme = async (repo) => {
+    const result = await capture('gh', ['api', `repos/${repo}/contents/${README_PATH}`]);
+    if (result.code !== 0) {
+        if (`${result.stderr}${result.stdout}`.includes('HTTP 404'))
+            return { sha: null };
+        throw new Error(`Could not read ${README_PATH} from ${repo}.\n${result.stderr.trim() || result.stdout.trim()}`);
+    }
+    const contents = JSON.parse(result.stdout);
+    const text = Buffer.from(contents.content, 'base64').toString('utf8');
+    return text === releasesReadme() ? null : { sha: contents.sha };
+};
 const writePublishedIndex = async (repo, index, sha, version) => {
     const content = Buffer.from(serializeIndex(index), 'utf8').toString('base64');
     const args = [
@@ -178,6 +200,7 @@ const publishKernel = async (root, version, repo, dryRun) => {
     const directory = join(root, 'distributions', 'kernel', version);
     const manifestPath = join(directory, 'manifest.json');
     const published = await readPublishedIndex(repo);
+    const readme = published.empty ? null : await staleReadme(repo);
     /**
      * O corpo do release cobre o INTERVALO, e não só a versão que está saindo. Um pacote leva tudo o que
      * veio antes dele; um release que só cita a própria entrada esconde as versões que foram empacotadas e
@@ -190,13 +213,19 @@ const publishKernel = async (root, version, repo, dryRun) => {
         manifest: assetUrl(repo, version, 'manifest.json'),
     }, new Date().toISOString()));
     success(`kernel ${version} verified: ${manifest.tarball?.bytes} bytes, sha256 ${manifest.tarball?.sha256.slice(0, 12)}…`);
-    info(`  tag ${tagOf(version)} in ${repo}, and ${INDEX_PATH} promoting it to "latest"`);
+    const promotes = next.channels[STABLE_CHANNEL] === version;
+    info(promotes
+        ? `  tag ${tagOf(version)} in ${repo}, and ${INDEX_PATH} promoting it to "latest"`
+        : `  tag ${tagOf(version)} in ${repo}, and ${INDEX_PATH} listing it — "latest" stays at `
+            + `${next.channels[STABLE_CHANNEL]}, which is newer`);
     info(notes.versions.length === 1
         ? `  release notes: the ${version} entry of ${KERNEL_CHANGELOG}`
         : `  release notes: ${notes.versions.join(', ')} — every entry since ${since ?? 'the first one'}`);
     if (dryRun) {
         if (published.empty)
             info(`  ${repo} has no commits, so it would be seeded with a README first`);
+        if (readme !== null)
+            info(`  ${README_PATH} in ${repo} differs from the current text, so it would be rewritten`);
         info(`  the catalog would go from ${published.index.kernel.length} to ${next.kernel.length} version(s)`);
         return;
     }
@@ -231,7 +260,19 @@ const publishKernel = async (root, version, repo, dryRun) => {
         success(`assets published for ${version}`);
         // O catálogo por último, sempre. Ver a nota de ordem no topo deste módulo.
         await writePublishedIndex(repo, next, published.sha, version);
-        success(`${INDEX_PATH} updated — "microteia unpack --version latest" now takes ${version}`);
+        success(promotes
+            ? `${INDEX_PATH} updated — "microteia unpack --version latest" now takes ${version}`
+            : `${INDEX_PATH} updated — "microteia unpack --version ${version}" takes it; "latest" stays at `
+                + `${next.channels[STABLE_CHANNEL]}`);
+        /**
+         * Depois do catálogo, e sem derrubar a publicação: o README não é o que alguém instala, e uma
+         * falha nele não pode desfazer — nem fazer parecer desfeito — um release que já está no ar.
+         */
+        if (readme !== null) {
+            await writeReadme(repo, readme.sha, `README for kernel ${version}`)
+                .then(() => success(`${README_PATH} in ${repo} rewritten`))
+                .catch((error) => warn(`${README_PATH} in ${repo} could not be rewritten: ${error instanceof Error ? error.message : String(error)}`));
+        }
     }
     finally {
         await rm(notesRoot, { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microteia/console",
-  "version": "2.33.0",
+  "version": "2.36.0",
   "description": "Install and update Microteia in a Firebase project you own.",
   "license": "UNLICENSED",
   "type": "module",