@mnstry/atelier 0.2.0-alpha.13 → 0.2.0-alpha.15

package/src/projection/obsidian/publication/publisher.mjs

@@ -1,3 +1,4 @@
+import { createCooperativeBudget, isSchedulingStop } from '../materialize/prepare-view.mjs'
 import fs from 'node:fs'
 import fsp from 'node:fs/promises'
 import path from 'node:path'
@@ -15,6 +16,10 @@ import { probeExchange } from './exchange.mjs'
 import { CRASH_INJECTION_TEST_SEAM } from './test-seam.mjs'
 import { createDirectAdapter } from './transport.mjs'
 
+// The caller's private-state location refusals: once the state root may lie in a declared repository, no further
+// entry is written there.
+const isLocationRefusal = (error) => /^managed-root-|^repository-inside-managed-root$/.test(String(error?.code ?? ''))
+
 // publishView: conditional publication of one prepared view into an editable
 // vault. The order is the contract's:
 //
@@ -317,11 +322,33 @@ export function planUnits({ files, priorManifest, pointer, ledger, pluginDisk =
   return units
 }
 
+// The code of a failure met while candidates were being cleaned up after a staging that did not complete, for the detail
+// of what ended it. Nothing else of the failure is kept: its message may name a path.
+const cleanupCauseOf = (failure) => (failure === null ? {} : { cleanupCause: typeof failure?.code === 'string' && failure.code !== '' ? failure.code.slice(0, 64) : 'unknown' })
+// The stop or refusal itself is handed on, so the caller can still tell it by identity: its `detail` is replaced by a
+// copy that adds `cleanupCause`, and an object shared as its detail is left as it was. A caller that throws the same
+// error object again keeps that field on it.
+function withCleanupCause(error, failure) {
+  if (failure !== null) try { error.detail = { ...(error.detail ?? {}), ...cleanupCauseOf(failure) } } catch { /* an error that cannot be extended is handed on as it is */ }
+  return error
+}
+
 // The rules the oracle tests are sensitive to. Production always uses these; the tests substitute a deliberately
 // broken one through publishViewForOracleTests to prove the oracle can fail.
 export const PUBLICATION_PRIMITIVES = Object.freeze({
   // The one operation the `direct-unheld` path writes into the vault: a file created where nothing is.
   unheldWrites: (op) => op === 'create',
+  // Whether an error that stopped staging was the caller's stop (its settings check, or a cancellation), handed on
+  // under its own code once the candidates are cleaned up, rather than reported as a staging failure.
+  callerStoppedStaging: (error) => isSchedulingStop(error),
+  // Whether a refusal raised while candidates are being staged (the vault's folder replaced or gone under the run) is
+  // handed on only once those candidates are cleaned up, as a stop is. A candidate staged before the journal is
+  // written is named by no journal, so restart recovery would never remove one left there.
+  refusedStagingCleansUp: () => true,
+  // The code the journal's last entry gives an error that ended the publication once the journal was open: a
+  // caller's stop under its own code, which is what the caller is told, and anything else as a fault of the publisher.
+  // Decided by the tag a stop carries, never by what an error looks like; a stop that carries no code has none to give.
+  journalFailureCode: (error) => (isSchedulingStop(error) && typeof error.code === 'string' && error.code !== '' ? error.code.slice(0, 200) : 'publisher-error'),
 })
 
 // Whether the `direct-unheld` path applies, after the adapter found an app it cannot coordinate with (see the head of
@@ -355,6 +382,11 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
   if (!adapter || typeof adapter.probe !== 'function') throw new TypeError('publishView needs an editor coordination adapter')
   if (expectedGeneration !== null && typeof expectedGeneration !== 'string') throw new TypeError('expectedGeneration must be a generation identity or null')
 
+  const budget = createCooperativeBudget(options.scheduling)
+  budget.check()
+  // The caller's guard alone, not the cancellation signal: a cancelled publication still records its failure, and so
+  // does one the guard stops for another reason (a changed selection or settings). Only a location refusal suppresses it.
+  const locationStillProven = () => { try { options.scheduling?.guard?.(); return true } catch (error) { return !isLocationRefusal(error) } }
   const releases = []
   let journal = null
   try {
@@ -384,9 +416,16 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     store.checkAllocatedVault?.()
     acquire(store.vaultLockPath, () => acquireVaultLock(store), 'into this vault')
     store.checkAllocatedVault?.()
+    await budget.checkpoint('recover', true)
+    store.checkAllocatedVault?.()
     const recovered = recoverPublicationsLocked({ store, clock })
+    await budget.checkpoint('recovery-complete', true)
+    store.checkAllocatedVault?.()
     const pointer = store.readCurrent()
     if (pointer?.generationId === manifest.generationId && !pluginFilesDrifted(preparedView, store)) {
+      await options.beforeCommit?.()
+      budget.check()
+      store.checkAllocatedVault?.()
       return { state: 'committed', alreadyCommitted: true, generationId: manifest.generationId, journalId: pointer.journalId, notes: [], retainedEdits: pointer.retained ?? [], lateWriters: [], recovered }
     }
     if ((pointer?.generationId ?? null) !== expectedGeneration) refuse('generation-mismatch', 'the committed generation is not the one this publication expects', { committed: pointer?.generationId ?? null })
@@ -394,9 +433,11 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     // Path selection. An app with this vault open in several windows is refused as such: publishing through one of
     // them would leave the others uncoordinated.
     const probe = await adapter.probe({ vaultRoot: store.vaultRoot })
+    budget.check()
     store.checkAllocatedVault?.()
     const unheld = probe.state !== 'coordinated' && probe.state !== 'absent' && await unheldPathApplies({ probe, pointer, store, unheldEvidence, platform })
-    // The evidence took time to read: the folder is checked again.
+    // The evidence took time to read: the location and the folder are checked again.
+    budget.check()
     if (unheld) store.checkAllocatedVault?.()
     if (probe.state !== 'coordinated' && probe.state !== 'absent' && !unheld) refuse(probe.code === 'vault-open-in-several-windows' ? probe.code : 'editor-uncoordinated', `an Obsidian process may have this vault open and cannot be coordinated with: ${probe.reason}`)
     const mode = probe.state === 'coordinated' ? 'in-app' : unheld ? 'direct-unheld' : 'direct'
@@ -426,12 +467,16 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
       stagingDir = store.stagingDir(journalId)
       // On the `direct-unheld` path a replacement is never written, so no candidate is staged for one.
       for (const unit of units.filter((item) => item.op === 'create' || (item.op === 'replace' && (mode !== 'direct-unheld' || rules.unheldWrites(item.op))))) {
+        await budget.checkpoint('stage-candidate')
+        store.checkAllocatedVault?.()
         const existing = fs.lstatSync(path.join(store.vaultRoot, unit.path), { throwIfNoEntry: false })
         unit.preparedPath = store.preparedPath(journalId, unit.unit)
         stageCandidate(unit.preparedPath, unit.bytes, unit.mode ?? (existing?.isFile() ? existing.mode & 0o777 : 0o644), created)
         // A replacement is exchanged, and the exchange leaves the displaced bytes at this path: it is in recovery.
         unit.stagedPath = unit.op === 'replace' ? store.exchangeCandidatePath(journalId, unit.unit) : unit.preparedPath
       }
+      await budget.checkpoint('staging-complete', true)
+      store.checkAllocatedVault?.()
       syncPrivateDirectory(stagingDir)
       const manifestFile = path.join(store.journalDir(journalId), 'manifest.json')
       publishPrivateFile(manifestFile, manifestBytes)
@@ -446,28 +491,49 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
       // The journal now names every exchange candidate by path and digest. Only complete, fsynced files are moved
       // in, so a file at an exchange path is never a partial candidate.
       for (const unit of units.filter((item) => item.stagedPath && item.stagedPath !== item.preparedPath)) {
+        await budget.checkpoint('move-candidate')
+        store.checkAllocatedVault?.()
         moveToExchangePath(store, journalId, unit, moved)
       }
     } catch (error) {
-      if (error instanceof PublicationRefusal) throw error
+      const stopped = rules.callerStoppedStaging(error)
+      // A refusal raised between two candidates (the publisher's own check found the vault's folder replaced or gone)
+      // is handed on under its own code too, and like a stop only after the cleanup below.
+      const refused = error instanceof PublicationRefusal && !stopped
+      if (refused && !rules.refusedStagingCleansUp(error)) throw error
       // No payload has named any of these paths, so nothing was exchanged and they can only hold our own
       // candidates. In staging they are removed by name. In recovery a file is removed only when its bytes are
       // the candidate's; anything else stays for restart recovery, which the journal header points at it. Only
       // empty directories are removed, so a failed staging leaves nothing that looks like an unfinished unit.
+      // Each file is cleaned up on its own, so one that cannot be removed (EBUSY, EPERM, a volume gone) leaves the
+      // others removed; the first such failure is kept.
+      let cleanupFailure = null
+      const cleanUp = (operation) => { try { operation() } catch (failure) { cleanupFailure ??= failure } }
       for (const unit of moved) {
-        if (readFileDigest(unit.stagedPath) === unit.candidateDigest) fs.rmSync(unit.stagedPath, { force: true })
+        cleanUp(() => { if (readFileDigest(unit.stagedPath) === unit.candidateDigest) fs.rmSync(unit.stagedPath, { force: true }) })
         try { fs.rmdirSync(path.dirname(unit.stagedPath)) } catch { /* not empty: left for restart recovery */ }
       }
-      for (const file of created) fs.rmSync(file, { force: true })
+      for (const file of created) cleanUp(() => fs.rmSync(file, { force: true }))
       for (const directory of [stagingDir, store.unitsRoot(journalId)]) if (directory) try { fs.rmdirSync(directory) } catch { /* absent, or not empty */ }
-      refuse('staging-failed', 'the candidates could not be staged; nothing in the vault was touched', { cause: error.code ?? String(error.message) })
+      // The caller stopped the publication between two candidates: nothing failed to stage, and its reason (a
+      // setting that changed during the tick, `mixed-read`, or a cancellation) is the one reported. So is a refusal's.
+      // A cleanup that failed does not replace either: it is named in their detail as `cleanupCause`, and what it could
+      // not remove stays where it is.
+      if (stopped || refused) throw withCleanupCause(error, cleanupFailure)
+      refuse('staging-failed', 'the candidates could not be staged; nothing in the vault was touched', { cause: error.code ?? String(error.message), ...cleanupCauseOf(cleanupFailure) })
     }
+    await budget.checkpoint('journal-and-moves-complete', true)
+    store.checkAllocatedVault?.()
     crash('after-staging')
 
-    const context = { store, journal, journalId, channel, clock, crash, mode, rules }
+    // `check` runs the caller's guard: every wait for the app resumes through it before the next recovery, journal or
+    // vault write.
+    const context = { store, journal, journalId, channel, clock, crash, mode, rules, check: () => budget.check() }
     const results = []
     // Kept notes are compared first, several at a time; one that holds exactly its candidate bytes is unchanged.
     const unchanged = await unchangedKeepUnits(units, store)
+    // The comparison read the disk: the location is proven again before any unit's recovery, journal or vault write.
+    budget.check()
     // The direct path has no editor coordination, so it is only right while no
     // Obsidian runs. Staging takes time and an app may have started since path
     // selection: the process table is read again immediately before the first
@@ -479,14 +545,19 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     // unit refuses, a kept one included, so nothing is committed.
     let lastProbe = null
     for (const unit of units) {
+      await budget.checkpoint('publish-unit')
+      store.checkAllocatedVault?.()
       if (mode === 'direct' && (lastProbe === null || Date.now() - lastProbe > 2000)) {
         lastProbe = Date.now()
         const again = await adapter.probe({ vaultRoot: store.vaultRoot })
+        budget.check()
         if (again.state !== 'absent') context.uncoordinated = again.reason
       }
       if (mode === 'direct-unheld' && !context.uncoordinated && (lastProbe === null || Date.now() - lastProbe > 2000)) {
         lastProbe = Date.now()
-        if (!(await readsUnlisted(unheldEvidence, store))) context.uncoordinated = 'the vault list of the app no longer shows, positively, that no Obsidian lists this vault'
+        const listed = await readsUnlisted(unheldEvidence, store)
+        budget.check()
+        if (!listed) context.uncoordinated = 'the vault list of the app no longer shows, positively, that no Obsidian lists this vault'
       }
       store.checkAllocatedVault?.()
       if (unit.op === 'keep' && unchanged.has(unit.path)) {
@@ -501,6 +572,8 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
       }
     }
 
+    await budget.checkpoint('publication-complete', true)
+    store.checkAllocatedVault?.()
     const blocking = results.filter((result) => result.blocking)
     const retainedEdits = results.filter((result) => result.retained).map((result) => result.retained)
     // Notes kept earlier stay surfaced until they leave the vault or come back into a view.
@@ -512,11 +585,22 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
 
     // Quiet period, then look at the displaced files again.
     if (quietPeriodMs > 0 && results.some((result) => result.recoveryRef)) await sleep(quietPeriodMs)
+    budget.check()
     const lateWriters = recheckDisplacedFiles({ store, journalIds: [journalId], clock })
     for (const finding of lateWriters.filter((item) => item.code === 'late-writer-captured')) {
       journal.append({ step: 'verify', outcome: 'conflict', state: 'verifying', notePath: finding.notePath, beforeDigest: finding.digestAtMove, afterDigest: finding.observedDigest, recoveryRef: finding.displacedRef,
         detail: { unit: finding.unit, code: 'late-writer-captured', objectRef: finding.objectRef } })
     }
+    await budget.checkpoint('verify-before-commit', true)
+    // The resident engine revalidates the selected source pins here, while
+    // publication still owns its locks. Its check may yield; no durability
+    // unit or committed pointer is half-written across that wait. It comes
+    // before the entry that says the publication settled: restart recovery
+    // commits a journal that holds that entry, so a refusal after it would be
+    // committed by the next publication of this view.
+    await options.beforeCommit?.()
+    budget.check()
+    store.checkAllocatedVault?.()
     journal.append({ step: 'verify', outcome: 'ok', state: 'verifying', detail: { settled: true, retained: retainedEdits } })
     crash('before-manifest-commit')
     store.checkAllocatedVault?.()
@@ -528,7 +612,9 @@ export async function publishViewForOracleTests(options = {}, primitives = PUBLI
     return { ...base, state: 'committed', lateWriters }
   } catch (error) {
     if (!(error instanceof PublicationRefusal)) {
-      if (journal) try { journal.append({ step: 'verify', outcome: 'failed', state: 'failed', detail: { code: 'publisher-error', message: String(error.code ?? error.message).slice(0, 200) } }) } catch { /* the journal itself cannot be written */ }
+      // A private-state location refusal records nothing more there, a failure entry included, and neither does a
+      // failure that leaves the location unproven now (a rejected wait for the app). Locks are still released.
+      if (journal && !isLocationRefusal(error) && locationStillProven()) try { journal.append({ step: 'verify', outcome: 'failed', state: 'failed', detail: { code: rules.journalFailureCode(error), message: String(error.code ?? error.message).slice(0, 200) } }) } catch { /* the journal itself cannot be written */ }
       throw error
     }
     return { state: 'refused', refusal: { code: error.code, message: error.message, detail: error.detail }, notes: [], retainedEdits: [], lateWriters: [] }
@@ -705,6 +791,7 @@ async function publishOneUnit(unit, context) {
   }
   const baseObject = observe(current)
   const inspected = await context.channel.inspect({ vaultRoot: store.vaultRoot, path: unit.path })
+  context.check?.()
   if (inspected.status !== 'inspected') {
     capture('failed', inspected.status, { beforeDigest: currentDigest })
     if (plan.stagedPath) retire(plan, context)
@@ -723,6 +810,7 @@ async function publishOneUnit(unit, context) {
     ? { op: 'publish', mode: 'remove', vaultRoot: store.vaultRoot, path: unit.path, operationId, baseSha256: hex(plan.baseDigest), recoveryPath: displaced }
     : { op: 'publish', mode: 'replace', vaultRoot: store.vaultRoot, path: unit.path, operationId, baseSha256: hex(plan.baseDigest), candidateSha256: hex(plan.candidateDigest), stagedPath: plan.stagedPath, recoveryPath: displaced })
   context.crash('after-publish')
+  context.check?.()
 
   if (reply.status === 'published' || reply.status === 'published-external-captured' || reply.status === 'removed' || reply.status === 'removed-external-captured') {
     syncPrivateDirectory(path.dirname(displaced))

package/src/projection/project.mjs

@@ -3,6 +3,8 @@ import { isDeepStrictEqual } from 'node:util'
 import path from 'node:path'
 import { commandProject, readJson, writeJson } from '../project/config.mjs'
 import { summarizeReadinessJourney } from '../readiness-protocols/runtime.mjs'
+import { bundledReadinessEnabled } from '../readiness-protocols/bundled-selection.mjs'
+import { atelierControlStyles } from '../ui/control-system.mjs'
 
 const esc = (value) => String(value ?? '').replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;')
 
@@ -44,16 +46,17 @@ function resolveDistributionBranding(project) {
 }
 
 export function buildProjectProjection(project) {
+  const includeBundled = bundledReadinessEnabled(project)
   const graph = readJson(project.graphPath)
   const branding = resolveDistributionBranding(project)
-  const readinessJourney = summarizeReadinessJourney(project)
+  const readinessJourney = includeBundled ? summarizeReadinessJourney(project) : null
   const output = path.join(project.outputRoot, 'index.html')
-  const dimensionCards = readinessJourney.dimensions.map((item) => `<article class="readiness-card" data-protocol="${esc(item.protocolId)}">
+  const dimensionCards = (readinessJourney?.dimensions ?? []).map((item) => `<article class="readiness-card" data-protocol="${esc(item.protocolId)}">
     <p class="eyebrow">${esc(item.label)}</p>
     <h3>${esc(item.title)}</h3>
     <p><strong>${esc(item.status)}</strong> · ${esc(item.score)} / 100 answers complete</p>
     <p>${esc(item.blockers[0] || 'review-ready')}</p>
-    <button type="button" data-copy="${esc(item.agentPrompt)}">Copy protocol prompt</button>
+    <button type="button" class="system-control" data-variant="secondary" data-size="compact" data-copy="${esc(item.agentPrompt)}">Copy protocol prompt</button>
   </article>`).join('\n')
   const cards = graph.nodes.map((node) => `<article class="card" data-node="${esc(node.id)}">
     <p class="eyebrow">${esc(node.repo)} · ${esc(node.type)} · ${esc(node.audience)}</p>
@@ -80,16 +83,16 @@ h1{font-size:clamp(2rem,4vw,4rem);margin:.2em 0}
 .readiness-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px;margin-top:16px}
 .readiness-card{border:1px solid #342b26;border-radius:8px;padding:14px;background:#171312}
 .readiness-card h3{font-size:1.05rem;margin:.2rem 0}
-.readiness-card button{min-height:44px;border:1px solid #755f43;border-radius:6px;background:#241d18;color:var(--atelier-text);padding:8px 10px;cursor:pointer}
 .eyebrow{color:var(--atelier-eyebrow);text-transform:uppercase;letter-spacing:.08em;font-size:.8rem}
 a{color:var(--atelier-accent)}
+${atelierControlStyles}
 ${branding.themeCss}</style>
 </head>
 <body><main>
 <p class="eyebrow">${esc(branding.name)} · ${esc(branding.eyebrow)}</p>
 <h1>${esc(project.config.name || 'Project Workspace')}</h1>
 <p>${graph.counts.nodes} graph nodes · ${graph.counts.edges} graph edges · ${graph.counts.diagnostics} diagnostics</p>
-<section class="readiness" aria-labelledby="tenant-readiness-title">
+${readinessJourney ? `<section class="readiness" aria-labelledby="tenant-readiness-title">
   <div class="readiness-head">
     <div>
       <p class="eyebrow">MNSTRY Tenant Readiness</p>
@@ -100,7 +103,7 @@ ${branding.themeCss}</style>
     <div class="readiness-score">${esc(readinessJourney.score)}%</div>
   </div>
   <div class="readiness-grid">${dimensionCards}</div>
-</section>
+</section>` : ''}
 <section class="grid">${cards}</section>
 <script>
 document.addEventListener('click', async (event) => {
@@ -125,16 +128,18 @@ export function buildProjectManifest(project, projection) {
     generatedAt: 'deterministic',
     graphPath: path.relative(project.outputRoot, project.graphPath).split(path.sep).join('/'),
     entry: 'index.html',
-    tenantReadiness: {
-      score: projection.readinessJourney.score,
-      ready: projection.readinessJourney.ready,
-      dimensions: projection.readinessJourney.dimensions.map((item) => ({
-        key: item.key,
-        protocolId: item.protocolId,
-        status: item.status,
-        score: item.score,
-      })),
-    },
+    ...(projection.readinessJourney ? {
+      tenantReadiness: {
+        score: projection.readinessJourney.score,
+        ready: projection.readinessJourney.ready,
+        dimensions: projection.readinessJourney.dimensions.map((item) => ({
+          key: item.key,
+          protocolId: item.protocolId,
+          status: item.status,
+          score: item.score,
+        })),
+      },
+    } : {}),
     nodes: projection.graph.nodes.map((node) => ({ id: node.id, title: node.title, audience: node.audience, path: node.path })),
   }
 }

package/src/readiness/readiness.mjs

@@ -1,6 +1,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { bundledReadinessProtocols } from '../readiness-protocols/bundled-pack.mjs'
+import { bundledReadinessEnabled, requireBundledReadiness, requireSelectedReadinessProtocol } from '../readiness-protocols/bundled-selection.mjs'
 import { createProtocolRegistry, loadExtensionPacks } from '../extension-packs/loader.mjs'
 import {
   buildReadinessExportDryRun,
@@ -131,6 +132,7 @@ function configRelative(project, file) {
 }
 
 function buildProjectReadiness({ project, graph = null } = {}) {
+  const includeBundled = bundledReadinessEnabled(project)
   const loadedGraph = graph || (fs.existsSync(project.graphPath) ? readJson(project.graphPath) : null)
   const projectionEntry = path.join(project.outputRoot, 'index.html')
   const manifest = path.join(project.outputRoot, 'atelier.manifest.json')
@@ -167,7 +169,7 @@ function buildProjectReadiness({ project, graph = null } = {}) {
       enabled: false,
       authority: 'claim-only',
     },
-    tenantReadiness: summarizeReadinessJourney(project),
+    ...(includeBundled ? { tenantReadiness: summarizeReadinessJourney(project) } : {}),
   }
 }
 
@@ -201,10 +203,11 @@ export function stableReadinessForCheck(value) {
 
 // Loads declared extension packs (fail closed: any pack error throws before a
 // protocol becomes resolvable) and composes the explicit registry. Projects
-// with no declared packs get a bundled-only registry.
+// without an explicit selection retain the bundled default.
 function projectRegistry(project) {
+  const includeBundled = bundledReadinessEnabled(project)
   const { packs } = loadExtensionPacks(project)
-  return createProtocolRegistry({ packs })
+  return createProtocolRegistry({ packs, includeBundled })
 }
 
 export function runReadinessCommand(argv = process.argv.slice(2)) {
@@ -219,15 +222,16 @@ export function runReadinessCommand(argv = process.argv.slice(2)) {
     const envConfig = process.env[PROJECT_CONFIG_ENV]
     const projectAware = projectConfigArg(argv) !== null
       || (typeof envConfig === 'string' && envConfig.trim() !== '')
-    const entries = bundledReadinessProtocols.map((protocol) => ({ protocol, source: null }))
+    let includeBundled = true
+    let entries = bundledReadinessProtocols.map((protocol) => ({ protocol, source: null }))
     if (projectAware) {
       const project = commandProject({ argv })
       const registry = projectRegistry(project)
-      for (const pack of registry.packs) {
-        for (const record of pack.protocols ?? []) {
-          entries.push({ protocol: record.protocol, source: pack.id })
-        }
-      }
+      includeBundled = bundledReadinessEnabled(project)
+      entries = registry.listProtocols().map((protocol) => ({
+        protocol,
+        source: registry.packs.find((pack) => pack.protocols?.some((record) => record.id === protocol.id))?.id ?? null,
+      }))
     }
     if (detail) {
       console.log(`${JSON.stringify({
@@ -235,7 +239,7 @@ export function runReadinessCommand(argv = process.argv.slice(2)) {
         protocols: entries.map(({ protocol, source }) => (source ? { ...protocol, source } : protocol)),
       }, null, 2)}\n`)
     } else {
-      console.log('MNSTRY readiness protocols')
+      console.log(includeBundled ? 'MNSTRY readiness protocols' : 'Atelier readiness protocols')
       for (const { protocol, source } of entries) {
         console.log(`- ${protocol.id}: ${protocol.title}${source ? ` (source: ${source})` : ''}`)
       }
@@ -245,6 +249,7 @@ export function runReadinessCommand(argv = process.argv.slice(2)) {
 
   if (subcommand === 'journey') {
     const project = commandProject({ argv })
+    requireBundledReadiness(project)
     const journey = summarizeReadinessJourney(project, { registry: projectRegistry(project) })
     console.log(`${JSON.stringify(journey, null, 2)}\n`)
     return
@@ -254,12 +259,14 @@ export function runReadinessCommand(argv = process.argv.slice(2)) {
     const project = commandProject({ argv })
     const protocolId = parsed._[1]
     if (!protocolId) throw new Error('readiness run requires a protocol id')
+    const registry = projectRegistry(project)
+    requireSelectedReadinessProtocol(project, registry, protocolId)
     const answers = parsed.answers ? readJson(path.resolve(process.cwd(), parsed.answers)) : {}
     const result = runProtocol(project, protocolId, {
       answers,
       write: parsed.write !== false,
       createProposal: parsed.proposal !== false && parsed['no-proposal'] !== true,
-      registry: projectRegistry(project),
+      registry,
     })
     console.log(`${JSON.stringify({
       ok: result.run.blockers.length === 0,
@@ -279,6 +286,7 @@ export function runReadinessCommand(argv = process.argv.slice(2)) {
 
   if (subcommand === 'packet') {
     const project = commandProject({ argv })
+    requireBundledReadiness(project)
     const packet = buildTenantPacket(project, { registry: projectRegistry(project) })
     const file = writeTenantPacket(project, packet)
     console.log(`${JSON.stringify({
@@ -292,6 +300,7 @@ export function runReadinessCommand(argv = process.argv.slice(2)) {
   if (subcommand === 'export') {
     if (!argv.includes('--dry-run')) throw new Error('readiness export only supports --dry-run')
     const project = commandProject({ argv })
+    requireBundledReadiness(project)
     const report = buildReadinessExportDryRun(project, { registry: projectRegistry(project) })
     console.log(`${JSON.stringify(report, null, 2)}\n`)
     if (!report.accepted) process.exitCode = 1