@nextcommerce/campaigns-os 1.47.0 → 1.50.0

package/skills/next-campaigns-os-setup/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-os-setup
-version: 2.0.22
+version: 2.0.27
 description: Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly installed as next-campaigns-setup; renamed 2026-08 to stop colliding with the published NextCommerceCo/skills scaffolder of that name.
 ---
 
-Bundle revision: 1.47.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-polish/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-polish
-version: 1.1.23
+version: 1.1.28
 description: Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign.
 ---
 
-Bundle revision: 1.47.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read
@@ -48,7 +48,8 @@ Use this after build has produced a runnable page-kit campaign.
 Theme gate: `campaigns-os next polish` (tier `A`, like every `next` form: additive writes under `.campaign-runtime/` plus a stage-progress POST under Run Telemetry consent; `--no-write` and `--no-remit` are each tier `B`) blocks when theme inspect found a
 generatable brand theme that is not yet applied to commerce pages. Do not work
 around the gate — apply the brand layer (`theme generate`, tier `B`; copy into
-campaign assets, load after `next-core.css`, record `report.theme`) or record an
+campaign assets, load after `next-core.css`, rebuild, `campaigns-os record build`,
+then `campaigns-os record theme --packet <p>`, tier `C`) or record an
 explicit waiver (`campaigns-os theme waive --packet <p> --reason "<why>" --waived-by "<named human>"` — tier `C`, because the waiver overwrites the assembly report and doctor output; placeholders are refused).
 
 Responsibilities:
@@ -56,7 +57,7 @@ Responsibilities:
 - Compare prepared source design against built campaign pages.
 - Scan the prepared source assets for brand marks such as `logo*.png`, `logo*.svg`, and obvious header/logo images before leaving starter-template logos in place.
 - Scan **visible** rendered text inside the family's content/commerce surfaces (the selectors enumerated in `contracts/template-brand-contract.<family>.v0.json`) for placeholder/residue copy the build should have replaced — the *literal starter defaults*: lorem-ipsum, the unmodified starter headings (`Product Name` / `Package Title` / `Your headline`), `[VERIFY …]` author notes, `TODO` markers. Match the literal starter strings, not any authored copy that merely contains those words, and skip `<script>` / `<style>` / JSON-LD / `data-*` attributes. Treat a surviving literal starter default on a content/commerce surface as a polish blocker — replace it from the prepared source / CampaignSpec; do not draft substitute copy (if the design's authored copy is genuinely missing, flag it rather than invent it). This is *copy* residue, complementary to the computed-style / asset residue gated by `next-campaigns-qa` + the brand contract — not a duplicate of it.
-- Flag template *defaults* left where they disagree with the prepared design — e.g. the same benefit icon repeated across a grid *when the design uses distinct icons*, or a guarantee badge/term that disagrees with the design — as polish defects, not just logos. Judge against the prepared source, not taste: copy or imagery the source/CampaignSpec does not supply (e.g. a placeholder testimonial name/quote/role) is residue; "looks generic" on its own is not.
+- Flag template *defaults* left where they disagree with the prepared design — e.g. the same benefit icon repeated across a grid *when the design uses distinct icons*, or a guarantee badge/term that disagrees with the design — as polish defects, not just logos. Judge against the prepared source, not taste: copy or imagery the source/CampaignSpec does not supply (e.g. a placeholder testimonial name/quote/role) is residue; "looks generic" on its own is not. Copy the source does supply, including its proof and urgency elements (reviews, "Verified Purchase" labels, recent-purchase popups, stock counters, countdowns, guarantees), is the merchant's content: keep it as designed and do not record it as an issue or an unconfirmed claim.
 - **Brand-bleed (cloned-source de-brand) pass.** When a campaign is cloned from a proven sibling, the sibling's brand defaults ride along. Inspect the built pages and assets for residual cross-brand bleed and clear it before recording: (1) a residual promo/sale banner or coupon code/copy from the source campaign (including a baked-in *fake* code); (2) a prior-campaign / sibling favicon left in place; (3) scaffold or non-design fonts the design did not specify (e.g. starter `Plus Jakarta`); (4) hardcoded non-token colors — any brand color literal that should be a token, such as next-core's `#C670FE` "Most Popular" pill. Clear each from the prepared source / CampaignSpec and brand theme (tokens, not literals); flag — do not invent — anything the design genuinely doesn't supply. Treat surviving bleed as a polish blocker. This complements the favicon/logo and copy-residue checks above; it is the cross-brand contamination angle, not a duplicate.
 - Read the assembly report decisions before polishing. Do not reintroduce source-HTML elements that build intentionally dropped because CampaignSpec/API did not support them, such as unavailable payment methods.
 - **Remove or rename a contract-listed payment-chrome asset; never edit one in place.** The assets named in `contracts/template-brand-contract.<family>.v0.json` under `default_residue.payment_chrome.assets` are keyed by QA on the *referenced basename*, not on their contents. Stripping the unsupported marks from inside a shared file such as `upsell-payment-logos.svg` leaves the reference in place, so QA reports residue for an asset that no longer carries any — and on 2026-09-06 the repair loop's remedy for that report deleted a cards-only trust strip that was correct. Delete the asset, or write a new one under a new name and repoint the reference. QA downgrades an edited-in-place asset to `manual_review` rather than a blocker, but that is a safety net for a mistake, not the supported way to do this.

package/skills/next-campaigns-qa/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-qa
-version: 1.3.23
+version: 1.3.28
 description: Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof.
 ---
 
-Bundle revision: 1.47.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.47.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills.json

@@ -1,7 +1,7 @@
 {
   "name": "campaigns-os-skills",
   "description": "Skills bundled with Campaigns OS. `skills.sh` installs these into the shared agent skill directories (~/.claude/skills, ~/.codex/skills), so each one is a versioned package: bump the version whenever a package changes. `bundle_revision` identifies the bundle as a whole — `<package version>+skills.<n>`, where the prefix is this package's version and `<n>` counts the skill-text revisions published against it. It advances whenever ANY bundled skill changes, every SKILL.md states it on its first body line, and `campaigns-os tooling status --skills-revision <value>` compares the value an agent read from a skill against the bundle on disk. See docs/skills-revision.md.",
-  "bundle_revision": "1.47.0+skills.1",
+  "bundle_revision": "1.50.0+skills.1",
   "homepage": "https://github.com/NextCommerceCo/campaigns-os",
   "retired_skills": [
     {
@@ -16,7 +16,7 @@
     {
       "id": "next-campaigns-os",
       "name": "Campaigns OS Lifecycle",
-      "version": "1.0.39",
+      "version": "1.0.44",
       "path": "skills/next-campaigns-os/SKILL.md",
       "domain": "campaigns",
       "description": "Coordinate Campaigns OS lifecycle workflows from CampaignSpec, Build Packet, starter-template contracts, stage reports, deploy evidence, and QA proof depth."
@@ -24,7 +24,7 @@
     {
       "id": "next-campaigns-os-setup",
       "name": "Campaigns OS Setup",
-      "version": "2.0.22",
+      "version": "2.0.27",
       "path": "skills/next-campaigns-os-setup/SKILL.md",
       "domain": "campaigns",
       "description": "Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly next-campaigns-setup; renamed to release that name to the published NextCommerceCo/skills scaffolder."
@@ -32,7 +32,7 @@
     {
       "id": "next-campaigns-build",
       "name": "Campaign Build",
-      "version": "1.0.24",
+      "version": "1.0.29",
       "path": "skills/next-campaigns-build/SKILL.md",
       "domain": "campaigns",
       "description": "Assemble a NEXT campaign from a doctor-cleared Build Packet, CampaignSpec/API values, prepared HTML/assets, page-kit, and starter-template contracts."
@@ -40,7 +40,7 @@
     {
       "id": "next-campaigns-polish",
       "name": "Campaign Polish",
-      "version": "1.1.23",
+      "version": "1.1.28",
       "path": "skills/next-campaigns-polish/SKILL.md",
       "domain": "campaigns",
       "description": "Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign."
@@ -48,7 +48,7 @@
     {
       "id": "next-campaigns-qa",
       "name": "Campaign QA",
-      "version": "1.3.23",
+      "version": "1.3.28",
       "path": "skills/next-campaigns-qa/SKILL.md",
       "domain": "campaigns",
       "description": "Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof."
@@ -56,7 +56,7 @@
     {
       "id": "campaign-lifecycle-orientation",
       "name": "Campaign Lifecycle Orientation",
-      "version": "1.0.19",
+      "version": "1.0.24",
       "path": "skills/campaign-lifecycle-orientation/SKILL.md",
       "domain": "campaigns",
       "description": "Orient a reader to the Campaigns OS lifecycle artifacts a run has already emitted, without advancing their state: the shared vocabulary, doctor as a gate, the stage record, and the store-theme/Page Kit two-worlds trap."
@@ -64,7 +64,7 @@
     {
       "id": "campaign-run-evidence",
       "name": "Campaign Run Evidence",
-      "version": "1.0.19",
+      "version": "1.0.24",
       "path": "skills/campaign-run-evidence/SKILL.md",
       "domain": "campaigns",
       "description": "Interpret existing doctor, QA verdict and proof-depth evidence without claiming more proof than the artifacts contain, and keep funnel proof apart from merchant launch readiness."
@@ -72,7 +72,7 @@
     {
       "id": "campaign-readback-classification",
       "name": "Campaign Readback Classification",
-      "version": "1.0.19",
+      "version": "1.0.24",
       "path": "skills/campaign-readback-classification/SKILL.md",
       "domain": "campaigns",
       "description": "Classify a selected campaign from the campaigns-os-readback/v2 fields (artifacts, staleness.stale_keys, clean, doctor, divergences, skip_cascades) and write a read-only handoff without turning diagnosis into permission."
@@ -80,7 +80,7 @@
     {
       "id": "contribution-intake",
       "name": "Contribution Intake",
-      "version": "1.0.19",
+      "version": "1.0.24",
       "path": "skills/contribution-intake/SKILL.md",
       "domain": "campaigns",
       "description": "Turn a suggestion about the agent surface into a classified, evidence-checked and redacted proposal, filed on this repository tracker only with attended approval."

package/src/brand-theme.mjs

@@ -25,7 +25,7 @@ export const THEME_REPORT_STATUSES = new Set(["applied", "skipped", "blocked", "
 export const THEME_CONFIDENCES = new Set(["high", "medium", "low", "none"]);
 
 const SKIP_DIRS = new Set([".git", "node_modules", "_site", "dist", "build", ".next", "coverage", "qa-output"]);
-const BRAND_LAYER_FILENAMES = new Set(["brand-theme.css", "checkout-brand.css"]);
+export const BRAND_LAYER_FILENAMES = new Set(["brand-theme.css", "checkout-brand.css"]);
 
 function isObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -574,6 +574,17 @@ function discoverThemeCandidates({ sourceRoot, pageMappings = [], manifest = nul
     candidates.push(candidateFromFile(path, role, source, referencedBy));
   }
 
+  // A stylesheet that pages of different roles link is the funnel's shared
+  // layer, not the first linking page's: it ranks as shared.
+  function addPageReference(path, role, referencedBy) {
+    const existing = seenFiles.has(resolve(path))
+      ? candidates.find((candidate) => candidate.source === "mapped_html_reference" && resolve(candidate.path) === resolve(path))
+      : null;
+    if (!existing) return addFile(path, role, "mapped_html_reference", referencedBy);
+    existing.referenced_by.push(...referencedBy);
+    if (existing.role !== role) existing.role = "shared";
+  }
+
   for (const conventional of [
     "assets/css/tokens.css",
     "assets/css/landing/tokens.css",
@@ -595,7 +606,7 @@ function discoverThemeCandidates({ sourceRoot, pageMappings = [], manifest = nul
     const content = readFileSync(htmlPath, "utf8");
     for (const ref of extractCssRefs(content)) {
       for (const cssPath of candidateCssPathsForRef(sourceRoot, htmlPath, ref)) {
-        addFile(cssPath, candidateRoleFromPath(ref, role), "mapped_html_reference", [{ page_id: mapping.page_id || null, path: mapping.path, ref }]);
+        addPageReference(cssPath, candidateRoleFromPath(ref, role), [{ page_id: mapping.page_id || null, path: mapping.path, ref }]);
       }
     }
   }

package/src/cli.mjs

@@ -296,15 +296,18 @@ Usage:
   campaigns-os start (--spec <json> | --map-id <id>) --source <html-dir> --target <page-kit-dir> --template-family <family>
                      [--brief <yaml|json>] [--proxy-base <url>] [--cached-spec] [--theme-policy <inspect_only|auto|off>]
                      [--wrapper-policy <strip_document_wrappers|preserve_document_wrappers|not_required|unknown>] [--design-manifest <path>]
-                     [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>] [--no-run-session] [--force]   # --force overwrites an assembly report that carries stage evidence (destructive; prints the cleared stage keys) and regenerates a stale Design Source Package an earlier intake synthesized and nobody changed
+                     [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>]
+                     [--deploy-target <target>] [--preview-url <url>] [--production-url <url>] [--no-run-session] [--force]   # --force overwrites an assembly report that carries stage evidence (destructive; prints the cleared stage keys) and regenerates a stale Design Source Package an earlier intake synthesized and nobody changed
   campaigns-os prepare-build (--spec <json> | --map-id <id>) --source <html-dir> --target <page-kit-dir> --template-family <family>
                              [--brief <yaml|json>] [--proxy-base <url>] [--cached-spec] [--theme-policy <inspect_only|auto|off>]
                              [--wrapper-policy <strip_document_wrappers|preserve_document_wrappers|not_required|unknown>] [--design-manifest <path>]
-                             [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>] [--no-run-session] [--force]
+                             [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>]
+                             [--deploy-target <target>] [--preview-url <url>] [--production-url <url>] [--no-run-session] [--force]
   campaigns-os build (--spec <json> | --map-id <id>) --source <html-dir> --target <page-kit-dir> --template-family <family>
                      [--brief <yaml|json>] [--proxy-base <url>] [--cached-spec] [--theme-policy <inspect_only|auto|off>]
                      [--wrapper-policy <strip_document_wrappers|preserve_document_wrappers|not_required|unknown>] [--design-manifest <path>]
-                     [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>] [--no-run-session] [--force]   # intake alias for prepare-build + doctor
+                     [--allow-uncertified-template "<reason>"] [--order-path-depth <off|common|full>]
+                     [--deploy-target <target>] [--preview-url <url>] [--production-url <url>] [--no-run-session] [--force]   # intake alias for prepare-build + doctor
   campaigns-os doctor --packet <campaign-runtime.build.json> [--context <json>] [--report <json>] [--strip-paths] [--write] [--no-write] [--doctor-out <path>] [--proxy-base <url>] [--no-live-refs] [--json]   # inspection by default; --doctor-out requires --write; --no-write wins. When the packet's built _site/<route>/ exists and a public Campaigns API key resolves (packet, its local CampaignSpec, or the declared campaign-key env var), doctor makes one read-only GET of {proxy-base}/api/campaign under X-Campaign-Key to check each built page's shipping and package refs against the live campaign; --proxy-base overrides the canonical proxy (https, or a loopback host over http). --no-live-refs skips the read and records not_run with reason disabled. No key, no built page, or a failed read records derived.live_campaign_refs as not_run with its reason. Only doctor and qa run make this read; other commands that run doctor record not_read
   campaigns-os doctor --built <page-kit-target-repo> --family <family> [--slug <slug>] [--base-url <url>] [--emit-packet [path]] [--json]   # L7: doctor a built _site/ with no Build Packet
   campaigns-os bundle check --packet <campaign-runtime.build.json> [--require-qa] [--json]   # validate the canonical migration/readback JSON bundle; never substitutes markdown
@@ -321,6 +324,8 @@ Usage:
   campaigns-os record setup --packet <campaign-runtime.build.json> [--context <json>] [--report <json>] [--dry-run] [--json]   # record setup complete once the campaign output directory exists: Build Context scaffold.required=false and stages.setup completed, validated against their schemas before either is written
   campaigns-os record build --packet <campaign-runtime.build.json> [--context <json>] [--report <json>] [--dry-run] [--json]   # after page-kit build: stages.assembly completed with build_fingerprint = doctor's derived.build_output_fingerprint.value (and the Design Source Package material fingerprint when the report has one); stages.polish becomes required unless its evidence is bound to this exact output
   campaigns-os record polish --packet <campaign-runtime.build.json> --evidence <polish-evidence.json> [--context <json>] [--report <json>] [--dry-run] [--json]   # after polish capture: stages.polish from the file's status (completed, completed_with_warnings, blocked with blockers, or skipped with skip_reason), evidence and optional repair_loop_defect, bound to doctor's current fingerprint; a completed status is refused, writing nothing, unless the polish gate doctor evaluates would pass. --dry-run runs every check and writes nothing
+  campaigns-os record theme --packet <campaign-runtime.build.json> [--context <json>] [--report <json>] [--dry-run] [--json]   # after the brand layer is linked and build is recorded: report.theme becomes applied with load_order after-next-core, css_path, commerce_pages and per-page evidence, only when each built commerce page that loads next-core.css loads brand-theme.css (or checkout-brand.css) after it and at least one does; a page loading neither is left out as the design's own markup; refused, writing nothing, otherwise. --dry-run runs every check and writes nothing
+  campaigns-os record deploy --packet <campaign-runtime.build.json> --base-url <served url> [--context <json>] [--report <json>] [--dry-run] [--json]   # a local preview (deploy.target local-serve) after polish is recorded: GETs every built page under the loopback URL (the campaign route root), then records deploy.preview_url on the packet and stages.deploy completed with the URL in outputs; refused, writing nothing, when the URL is not loopback or not the route root, a page does not answer 2xx, the build changed since it was recorded, or the theme gate is blocked. --dry-run runs every check, the requests included, and writes nothing
   campaigns-os readback <target-repo-root> [--json] [--packet <path>] [--doctor <path>] [--context <path>] [--report <path>] [--qa-verdict <path>] [--findings <path>]   # read-only projection of one run's emitted artifacts (packet, doctor output, build context, assembly report, QA verdict, findings export): artifact states, per-artifact freshness against the checkout's HEAD reflog, doctor warning grouping, skip cascades and cross-artifact divergences. Writes nothing, starts no process, touches no network, and records no lifecycle entry; --json emits one campaigns-os-readback/v2 object (docs/readback.md). Exit 2 for a missing target root or a Build Packet set freshness cannot single out.
   campaigns-os readback --example [--json]                                # project the bundled synthetic sample; freshness is not computable for it by design
   campaigns-os validate-assembly-report --report <json> [--json]
@@ -1066,8 +1071,8 @@ async function dispatch(command, args, { recorder = NOOP_RECORDER, ambient = nul
   }
 
   if (command === "record") {
-    const { recordStageCommand } = await import("./stage-record.mjs");
-    writeResult(recordStageCommand(args), args, 0);
+    const { recordCommand } = await import("./stage-record.mjs");
+    writeResult(await recordCommand(args), args, 0);
     return;
   }
 
@@ -4463,8 +4468,9 @@ function themeStarterPaletteAdvisory(themeGate, packetPath, residueState) {
       + `\`${cmd("theme")} waive --packet ${packetArg} --reason "<why the starter palette is acceptable>"\` `
       + "— which downgrades those rows to warn severity and keeps the shipped palette visible in the "
       + "verdict; or hand-author the brand layer (write brand-theme.css, list it after next-core.css in "
-      + "commerce-page frontmatter styles, rebuild, then record report.theme.status=applied with "
-      + "load_order=after-next-core), per docs/brand-theme-bridge.md. This notice waives nothing on its own.",
+      + "commerce-page frontmatter styles, rebuild, then run "
+      + `\`${cmd("record")} build --packet ${packetArg}\` and \`${cmd("record")} theme --packet ${packetArg}\`), `
+      + "per docs/brand-theme-bridge.md. This notice waives nothing on its own.",
   };
 }
 
@@ -4647,7 +4653,7 @@ export function buildNextActions({ result, packetPath, packet, themeGate, polish
   } else if (result.stage === "deploy") {
     if (packet.deploy?.target === LOCAL_SERVE_DEPLOY_TARGET) {
       const plan = localServePlan(packet);
-      push("deploy", "manual", null, `Serve the built ${plan.dir} output locally as the origin root (deploy.target is local-serve)${plan.rewrite ? ` — ${plan.rewrite}` : ""}, then record the localhost URL on deploy.preview_url and stages.deploy in the assembly report. Localhost on any port is a Development domain: SDK allowed, analytics suppressed.`);
+      push("deploy", "manual", null, `Serve the built ${plan.dir} output locally as the origin root (deploy.target is local-serve)${plan.rewrite ? ` — ${plan.rewrite}` : ""}, then run ${cmd("record")} deploy --packet ${packetPath} --base-url <served url>: it checks every built page answers and records deploy.preview_url and stages.deploy. Localhost on any port is a Development domain: SDK allowed, analytics suppressed.`);
     } else {
       push("deploy", "manual", null, `Deploy _site/ output to ${packet.deploy?.target || "the deploy target"}, then record deploy.preview_url (or production_url) on the packet and stages.deploy in the assembly report.`);
     }
@@ -4811,7 +4817,7 @@ Rules:
 - Replace demo refs; do not copy Olympus-style shipping_methods into shop-three-step.
 - For two-step package-selection flows, treat the selector page as the pre-checkout step and pass the selected cart to checkout with forcePackageId; preserve normal tracking params and strip forcePackageId from visible checkout URLs after SDK initialization.
 - After page-kit build, inspect rendered _site output before handoff: each active page should have a body, Campaign Cart runtime markers, SDK meta tags from CampaignSpec sdk_hints.meta_tags, and no stale copied funnel attribution.
-- Run page-kit build and SDK/template lint, then record build before polish: \`${cmd("record")} build --packet ${packetPath}\`. It stamps stages.assembly.build_fingerprint with the fingerprint doctor computes from the built output (derived.build_output_fingerprint.value, sha256 over the sorted path+sha256 manifest of _site/<slug>/; doctor reports built_output.fingerprint_stale whenever the output on disk stops matching the recorded value), records report.design_source_package.material_fingerprint on stages.assembly.source_package_material_fingerprint when present, and sets stages.polish to "required" (required_by="build", required_for=["qa"]). Re-run it after every rebuild; never hand-edit these fields. Build must not mark stages.polish as completed/completed_with_warnings/skipped. If you applied a brand theme, record report.theme.status, css_path, commerce_pages, load_order=after-next-core, evidence, and any repair-loop defect.
+- Run page-kit build and SDK/template lint, then record build before polish: \`${cmd("record")} build --packet ${packetPath}\`. It stamps stages.assembly.build_fingerprint with the fingerprint doctor computes from the built output (derived.build_output_fingerprint.value, sha256 over the sorted path+sha256 manifest of _site/<slug>/; doctor reports built_output.fingerprint_stale whenever the output on disk stops matching the recorded value), records report.design_source_package.material_fingerprint on stages.assembly.source_package_material_fingerprint when present, and sets stages.polish to "required" (required_by="build", required_for=["qa"]). Re-run it after every rebuild; never hand-edit these fields. Build must not mark stages.polish as completed/completed_with_warnings/skipped. If you applied a brand theme, run \`${cmd("record")} theme --packet ${packetPath}\` after record build: it reads each built commerce page's stylesheet links and records report.theme (status applied, load_order=after-next-core, css_path, commerce_pages, evidence), and refuses, writing nothing, when a page that loads next-core.css does not load the brand layer after it. Never hand-edit report.theme.
 - Capture the machine-readable build summary as an artifact: \`${PAGE_KIT_BUILD_SUMMARY_CAPTURE_COMMAND}\` (requires next-campaign-page-kit >= 0.1.4). Doctor verifies it for per-page build errors and Page Kit shape warnings (NESTED_NO_PERMALINK, DUPLICATE_OUTPUT, MISSING_FRONTMATTER, LAYOUT_NOT_FOUND). If the installed page-kit predates --json, record that in the assembly report instead of skipping silently.${localProofPromptLines(packet)}`;
 }
 
@@ -4922,9 +4928,8 @@ Read first:
 Nothing ships anywhere: the page-kit build produces _site/ output and you serve ${serveDir} on localhost (any static server, any port) for QA. Localhost on any port is a Campaigns App Development domain, so the SDK initialises there without an origin allowlist entry and Campaigns analytics events are suppressed.
 
 Once the server is up:
-1. Record the localhost URL (origin plus ${liveUrlPath}) on the packet at deploy.preview_url.
-2. Update the assembly report's stages.deploy.status to "completed" with that URL and the serve command in outputs.
-3. Run \`${cmd("next")} --packet ${packetPath}\` to advance to QA.
+1. Run \`${cmd("record")} deploy --packet ${packetPath} --base-url <localhost origin>${liveUrlPath}\`. It requests every built page under that URL, then records the URL on the packet at deploy.preview_url and stages.deploy as completed with the URL in outputs; it refuses, writing nothing, if a page does not answer.
+2. Run \`${cmd("next")} --packet ${packetPath}\` to advance to QA.
 
 If the served build cannot be reached, set stages.deploy.status to "blocked" with a clear reason in outputs so the orchestration loop surfaces it rather than skipping past.`;
   }

package/src/content-residue.mjs

@@ -1,23 +1,22 @@
 // Rendered-output content-residue scan + proof-attestation gate.
 //
 // Scans BUILT campaign output (_site HTML), not frontmatter: layout- or
-// script-rendered proof/urgency chrome only exists after the build, which is
-// why frontmatter-level checks missed the hardcoded rating/countdown chrome.
+// script-rendered chrome only exists after the build, which is why
+// frontmatter-level checks missed the hardcoded starter countdown chrome.
 //
-// Pattern provenance: the generic anti-pattern classes distilled from the
-// 2026-07 winning-campaign content audit (invented counts, fabricated
-// verified-buyer chrome, fictional bylines, borrowed authority, science
-// theater, scarcity theater, fake comparisons, unlinked press marquees).
-// Only GENERIC patterns and the public starter-template demo strings live
-// here; merchant-specific residue fingerprints are deliberately not carried
-// in this public package.
+// What it looks for is template residue, never the merchant's own copy: the
+// public starter-template demo strings, bracket-style demo stubs, and the
+// literal needs-merchant-input marker. Proof and urgency content the merchant
+// supplies (reviews, ratings, "Verified Purchase" labels, stock counters,
+// countdowns) is the merchant's responsibility and is not scanned. No
+// merchant-specific fingerprints are carried in this public package.
 //
-// Posture (fail closed, two tiers):
-// - hard: the literal needs-merchant-input marker, and urgency chrome
-//   rendered without verified offer urgency — blockers (collect-inputs).
-// - review: anti-pattern hits and demo/placeholder residue — warnings that
-//   feed the review/attestation queue; a hit means "remove or demand
-//   brief/source evidence", never "make it more plausible".
+// Posture (two tiers):
+// - hard: the literal needs-merchant-input marker, and starter countdown
+//   chrome on a brief-backed build whose brief does not verify the offer
+//   urgency — blockers (collect-inputs).
+// - review: demo/placeholder residue — warnings; a hit means an unreplaced
+//   demo slot or a stale template.
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
 
@@ -55,63 +54,6 @@ export const DEMO_RESIDUE_TERMS = Object.freeze([
   "Sell-Out Risk: High",
 ]);
 
-// Generic anti-pattern classes (review tier). Each id is stable so the
-// attestation/review UX can key on it.
-export const CONTENT_ANTI_PATTERNS = Object.freeze([
-  {
-    id: "invented_counts",
-    antiPattern: 1,
-    rule: "Counts/ratings/percent-recommend claims require a real, brief-sourced basis.",
-    // Count branch requires a proof-scaled number (comma groups, 4+ digits, or
-    // a trailing +) so ordinary commerce quantities ("Choose 3 pairs and
-    // save") never enter the review queue; "pairs"/"sold" dropped as nouns
-    // for the same reason. Small invented counts are a knowingly accepted gap.
-    regex: /\b(?:\d{1,3}(?:,\d{3})+|\d{4,}|\d+\+)\s+(?:reviews?|ratings?|customers?|users?|famil(?:y|ies)|wearers?|people)\b|\b(?:4\.[5-9]|5\.0)\s*(?:\/\s*5|stars?)|\b(?:9[0-9]|100)%\b[^<]{0,60}\b(?:recommend|reported|said|would)\b/i,
-  },
-  {
-    id: "verified_buyer_chrome",
-    antiPattern: 2,
-    rule: "'Verified' labels must resolve to a real approved review source.",
-    regex: /Verified\s+(?:Buyer|Customer|Purchase)|What\s+(?:Our\s+)?Customers\s+(?:Think|Say)|Real\s+(?:People|Customers)[^<]{0,20}Real\s+(?:Results|Relief)|5[- ]Star\s+Review/i,
-  },
-  {
-    id: "byline_persona",
-    antiPattern: 3,
-    rule: "Advertorial identities must be real, brief-supplied, and authorized.",
-    regex: /Mom\s+of\s+Two|Consumer\s+Report|Review\s+Team|Wellness\s+Educator|Licensed\s+(?:Physiotherapist|Professional)/i,
-  },
-  {
-    id: "borrowed_authority",
-    antiPattern: 4,
-    rule: "Expert/clinician/institution references require name, credential, permission, and source.",
-    regex: /\bDr\.\s+[A-Z]|\bM\.?D\.?\b|doctor[- ]recommended|clinically\s+(?:recognized|recommended)|expert\s+(?:says|recommends)/i,
-  },
-  {
-    id: "press_marquee",
-    antiPattern: 8,
-    rule: "Press mentions require a brief-supplied working URL for the exact merchant and product.",
-    regex: /As\s+Seen\s+(?:On|In)|Featured\s+(?:On|In)/i,
-  },
-  {
-    id: "science_theater",
-    antiPattern: 9,
-    rule: "Study/clinical/certification claims require citation metadata and approved wording.",
-    regex: /peer[- ]reviewed|science[- ]backed|backed\s+by\s+science|stud(?:y|ies)\s+(?:show|prove|confirm)|researchers\s+found|clinically\s+(?:proven|shown|tested)|NASA[- ]developed/i,
-  },
-  {
-    id: "scarcity_theater",
-    antiPattern: 10,
-    rule: "Urgency renders only from a real, approved promotion window or live inventory source.",
-    regex: /ENDS\s+AT\s+MIDNIGHT|Offer\s+Expires|Deal\s+Ending|Only\s+\d+\s+(?:Units\s+)?Left|Stock\s+(?:Levels?\s+)?Low|\d+%\s+Sold|Sell[- ]?Out\s+Risk|supplies\s+are\s+limited/i,
-  },
-  {
-    id: "fake_comparison",
-    antiPattern: 11,
-    rule: "Tested-N/showdown framing requires a brief-supplied comparison matrix and test record.",
-    regex: /(?:we\s+)?tested\s+\d+\s+(?:contenders|products|devices|gloves|combinations|brands)|only\s+one\s+(?:survived|worked|stood)|Competitor\s+[12]\b/i,
-  },
-]);
-
 const ENTITIES = new Map([
   ["&amp;", "&"], ["&lt;", "<"], ["&gt;", ">"], ["&quot;", '"'],
   ["&#39;", "'"], ["&apos;", "'"], ["&nbsp;", " "], ["&#8217;", "’"], ["&#8212;", "—"],
@@ -168,13 +110,12 @@ function excerptAt(html, index, span = 80) {
 }
 
 // Pure scan of one rendered HTML document. Returns { hard: [], review: [] };
-// each finding: { id, tier, rule?, excerpt }. Hard checks run on the markup
-// view (attributes count, comments/scripts do not); review checks run on the
-// visible-text view for precision, except exact-string demo terms and bracket
-// stubs which run on markup so attribute residue is still caught.
+// each finding: { id, tier, rule?, excerpt }. The hard checks and the demo
+// terms run on the markup view (attributes count, comments and script/style
+// bodies do not), so attribute residue is still caught; bracket stubs run on
+// the same view with tags stripped, so CSS attribute selectors never match.
 export function scanRenderedHtml(html, { urgencyVerified = false } = {}) {
   const markup = markupView(typeof html === "string" ? html : "");
-  const text = visibleText(typeof html === "string" ? html : "");
   const hard = [];
   const review = [];
 
@@ -205,19 +146,6 @@ export function scanRenderedHtml(html, { urgencyVerified = false } = {}) {
     }
   }
 
-  for (const pattern of CONTENT_ANTI_PATTERNS) {
-    if (pattern.id === "scarcity_theater" && urgencyVerified) continue;
-    const match = pattern.regex.exec(text);
-    if (match) {
-      review.push({
-        id: pattern.id,
-        tier: "review",
-        antiPattern: pattern.antiPattern,
-        rule: pattern.rule,
-        excerpt: excerptAt(text, match.index),
-      });
-    }
-  }
   return { hard, review };
 }
 

package/src/doctor/checks.mjs

@@ -363,7 +363,7 @@ const SPEC_DOCTOR_CHECKS = createDoctorCheckRegistry([
   {
     id: PAGE_KIT_SDK_VERSION_SCOPE,
     phase: "target",
-    run: ({ spec, errors, warnings, ready, derived, buildState }) => validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState),
+    run: ({ spec, packet, errors, warnings, ready, derived, buildState }) => validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState, packet),
   },
   {
     id: PAGE_KIT_STORE_PROFILE_SCOPE,
@@ -1159,17 +1159,22 @@ function validateLocalProof(packet, report, errors, warnings, ready) {
   addIssue(errors, LOCAL_PROOF_PARITY_SCOPE, `Production parity FAILED${difference ? ` — first non-gated difference: ${singleLineField(String(difference.kind))} at ${singleLineField(String(difference.route))}${difference.line ? ` line ${difference.line}` : ""}: ${singleLineField(String(difference.detail || ""))}` : `: ${singleLineField(String(parity.summary || ""))}`}. Rebuild in development, re-prove, and run ${parityCommand} again. ${LOCAL_PROOF_NEVER_EDIT_RULE}`, difference ? { first_difference: difference } : undefined);
 }
 
-function validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState) {
+function validateTargetSdkVersion(spec, errors, warnings, ready, derived, buildState, packet = null) {
   const report = buildState?.report || null;
   const required = stageIsTerminal(report?.stages?.setup?.status)
     || stageIsTerminal(report?.stages?.assembly?.status)
     || derived.scaffold_required !== true;
+  const family = packet?.assembly?.template_family;
+  const verified = isNonEmptyString(family) && isCertifiedTemplateFamily(family)
+    ? assessTemplateFreshness({ family, catalog: resolveCommerceCatalog(), sdkSupportPolicy: defaultSdkSupportPolicy() }).verified_sdk_version
+    : null;
   const gate = evaluatePageKitSdkVersion({
     spec,
     specStatus: buildState?.specStatus || "ok",
     targetLoad: buildState?.pageKitCampaignConfig,
     waivers: report?.waivers,
     required,
+    familyVerification: verified ? { family, sdk_version: verified } : null,
   });
   derived.checkpoint_gates.push(gate);
 
@@ -3199,7 +3204,7 @@ function validateSourceCoverage(packet, packetPath, spec, errors, warnings, read
             addIssue(
               warnings,
               "source_html.pages.source_hash",
-              `Source page "${page.page_id}" hash mismatch — file at ${page.path} has changed since the manifest was written (manifest sha256=${expectedHash.slice(0, 12)}…, on-disk sha256=${actualHash.slice(0, 12)}…). Re-run the producer to refresh the manifest, or accept the local edits.`,
+              `Source page "${page.page_id}" hash mismatch — file at ${page.path} has changed since intake recorded it in the Build Packet (recorded sha256=${expectedHash.slice(0, 12)}…, on-disk sha256=${actualHash.slice(0, 12)}…). This warning does not block. Re-running start or prepare-build with --force records the current file and clears recorded stage evidence; editing the source-html manifest alone does not change the hash the packet holds.`,
             );
           }
         }
@@ -4018,11 +4023,11 @@ function collectPlaceholderTextResidueMatches(root, terms) {
 }
 
 // Rendered-output content-residue scan (assembly-surfaces prototype): scans
-// BUILT pages for the needs-merchant-input marker and urgency chrome rendered
-// without verified offer urgency (blockers), plus demo/placeholder residue and
-// generic content anti-pattern hits (warnings feeding the review/attestation
-// queue). Scans _site output, not frontmatter — layout/script-rendered chrome
-// only exists after the build.
+// BUILT pages for the needs-merchant-input marker and, on a brief-backed
+// build, starter countdown chrome the brief does not verify (blockers), plus
+// template demo/placeholder residue (warnings). The merchant's own proof and
+// urgency copy is not scanned. Scans _site output, not frontmatter —
+// layout/script-rendered chrome only exists after the build.
 export function validateBuiltContentResidue(packet, errors, warnings, ready, derived, buildState = {}) {
   if (!isStageComplete(buildState.report, "assembly")) return;
   // Scan the RENDERED _site output, not the campaign source dir: the Liquid
@@ -4035,7 +4040,7 @@ export function validateBuiltContentResidue(packet, errors, warnings, ready, der
   const urgencyVerified = briefUrgencyVerified(brief?.payload);
   const findings = scanBuiltOutputContentResidue(siteRoot, { urgencyVerified });
   if (!findings.length) {
-    ready.push("Built output carries no needs-input markers, unverified urgency chrome, or content-residue hits");
+    ready.push("Built output carries no needs-input markers, unverified urgency chrome, or template demo residue");
     return;
   }
   // One issue per finding id, carrying the FULL file inventory: the id keeps
@@ -4068,9 +4073,8 @@ export function validateBuiltContentResidue(packet, errors, warnings, ready, der
       );
     } else if (id === "unverified_urgency_countdown") {
       // The scanner emits this only when the brief does not verify urgency
-      // (urgencyVerified=false). Severity keys on the path: with a readable
-      // brief payload (AI-assembled) it blocks; a designed-source campaign
-      // with no brief payload may carry an intentional countdown — warning.
+      // (urgencyVerified=false). Only a readable brief payload (AI-assembled)
+      // makes it a finding.
       if (briefReadable) {
         addIssue(
           errors,
@@ -4078,30 +4082,18 @@ export function validateBuiltContentResidue(packet, errors, warnings, ready, der
           `Built output renders countdown chrome without verified offer urgency (${where}). Set offer.urgency.verified in ${BRIEF_PAYLOAD_REL_PATH} from a real promotion window, or blank the urgency slots.`,
         );
       } else if (brief?.error) {
-        // Unreadable brief payload: the run is already blocked by
-        // proof_attestation.unreadable with the right remediation (repair the
-        // brief). Urgency is re-evaluated on the next doctor run once the
-        // brief parses — "confirm the urgency is real" copy here would point
-        // the operator at the wrong fix.
-      } else {
-        addIssue(
-          warnings,
-          "content_residue.urgency_unattested",
-          `Built output renders countdown chrome and no brief payload attests the promotion window (${where}). Confirm the urgency is real (a genuine offer window or live inventory) before launch.`,
-        );
+        // Deliberately nothing: an unreadable brief payload already blocks
+        // through proof_attestation.unreadable (validateProofAttestation),
+        // and urgency is re-evaluated once the brief parses.
       }
+      // No brief payload at all: the countdown is the merchant's content and
+      // is not ours to question.
     } else if (id === "demo_residue_term" || id === "bracket_placeholder_stub") {
       addIssue(
         warnings,
         "content_residue.demo_residue",
         `Built output carries template demo/placeholder residue (${where}; e.g. "${finding.excerpt}"). Fill or blank the slot — demo values must never ship.`,
       );
-    } else {
-      addIssue(
-        warnings,
-        "content_residue.anti_pattern",
-        `Built output matches content anti-pattern "${id}" (${where}; e.g. "${finding.excerpt}"). ${finding.rule || "Remove it or route it through brief-sourced proof."} This is a review warning and nothing downstream blocks on it: the claim is the operator's and the client's responsibility — remove or evidence it, never make it more plausible.`,
-      );
     }
   }
 }

package/src/doctor/inspect.mjs

@@ -1,5 +1,6 @@
 // Doctor entry points: the doctor command, packet inspection and built-output inspection.
 import { resolveCampaignIdentity } from "../spec-source-identity.mjs";
+import { applyLocalPreviewToCheckpoint, applyLocalPreviewToPolishGate, carriedForwardMessage, CARRIED_FORWARD } from "../local-preview-policy.mjs";
 import { withHtmlScanSnapshot } from "../html-scan.mjs";
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
@@ -506,16 +507,23 @@ function inspectDoctorPacket(packetPath, { contextPath = undefined, reportPath =
   }
   runPricingCssHideCheck({ packet, derived, warnings, ready, report });
 
-  const polishCheckpointGate = evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report });
+  // The local preview policy (local-preview-policy.mjs) carries missing
+  // polish and page-load evidence forward as warnings on a local-serve packet.
+  const polishCheckpointGate = applyLocalPreviewToCheckpoint(
+    evaluateRecordedHiddenEagerMediaCheckpoint({ packet, report }),
+    { packet, report },
+  );
   derived.polish_checkpoint_gate = polishCheckpointGate;
-  const polishGate = evaluatePolishGate({
+  const polishGate = applyLocalPreviewToPolishGate(evaluatePolishGate({
     report,
     hiddenEagerMediaGate: polishCheckpointGate,
     currentOutputFingerprint: derived.build_output_fingerprint?.value || null,
-  });
+  }), { packet, checkpointGate: polishCheckpointGate });
   derived.polish_gate = polishGate;
   if (polishGate.status === "blocked" && !polishGate.owned_checkpoint_only) {
     pushGateIssue({ errors, warnings }, gateIssue("polish_gate", polishGate));
+  } else if (polishGate.status === CARRIED_FORWARD && !polishGate.owned_checkpoint_only) {
+    addIssue(warnings, polishGate.code, carriedForwardMessage(polishGate), { polish_gate: polishGate });
   } else if (polishGate.status === "waived" && !polishGate.owned_checkpoint_only) {
     ready.push(`Polish gate passed under waiver: ${polishGate.waiver?.reason || "(no reason recorded)"}`);
   } else if (polishGate.status === "pass") {
@@ -524,6 +532,8 @@ function inspectDoctorPacket(packetPath, { contextPath = undefined, reportPath =
 
   if (polishCheckpointGate.status === "blocked") {
     pushGateIssue({ errors, warnings }, gateIssue("polish_checkpoint_gate", polishCheckpointGate));
+  } else if (polishCheckpointGate.status === CARRIED_FORWARD) {
+    addIssue(warnings, polishCheckpointGate.code, carriedForwardMessage(polishCheckpointGate), { polish_checkpoint_gate: polishCheckpointGate });
   } else if (polishCheckpointGate.status === "waived") {
     addIssue(
       warnings,

package/src/doctor/next-step.mjs

@@ -1,5 +1,6 @@
 // The next step doctor recommends, and the gate issues `next` reads from doctor.
 import { campaignIdentitiesMatch } from "../spec-source-identity.mjs";
+import { CARRIED_FORWARD } from "../local-preview-policy.mjs";
 import { resolve } from "node:path";
 import { orderPathDepthDriftText } from "../proof-policy.mjs";
 import { anyAssemblyReportStageBlocked } from "../stage-ledger.mjs";
@@ -462,6 +463,9 @@ function pickNextStage(report, { errors = [], derived = null }, prepareBuildGate
   }
 
   for (const cliStage of NEXT_STAGE_ORDER) {
+    // On the local preview, missing polish is carried forward as a warning
+    // (local-preview-policy.mjs): the ladder moves on to deploy and QA.
+    if (cliStage === "polish" && polishGate.status === CARRIED_FORWARD) continue;
     const reportKey = reportKeyForCliStage(cliStage);
     const stage = report.stages[reportKey];
     if (!stage) {