@nextcommerce/campaigns-os 1.48.0 → 1.50.0

package/schemas/campaigns-os-qa-verdict.v0.schema.json

@@ -146,7 +146,11 @@
           "const": "campaigns-os-page-binding/v0"
         },
         "observation": {
-          "const": "static_declaration"
+          "enum": [
+            "static_declaration",
+            "sdk_request"
+          ],
+          "description": "static_declaration: the key the page's HTML and same-origin config scripts declare. sdk_request: the key the Campaign Cart SDK sent to the Campaigns API in the browser pass (qa run --browser)."
         },
         "outcome": {
           "enum": [
@@ -174,7 +178,8 @@
             "enum": [
               "meta",
               "inline",
-              "config_script"
+              "config_script",
+              "sdk_request"
             ]
           }
         },
@@ -182,7 +187,7 @@
           "const": "not_verified"
         }
       },
-      "description": "Credential-free static declaration comparison, not observed execution or Campaign App identity. No keys, hashes, fragments, source URLs or inferred resource IDs."
+      "description": "Credential-free comparison of the page's key with the expected key: the static declaration, or the key the SDK sent in the browser pass. Not Campaign App identity. No keys, hashes, fragments, source URLs or inferred resource IDs."
     },
     "pageUrlRef": {
       "type": "object",

package/skills/campaign-lifecycle-orientation/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: campaign-lifecycle-orientation
-version: 1.0.22
+version: 1.0.24
 description: Orient a reader to the Campaigns OS lifecycle artifacts a run has already emitted, without advancing any stage or changing any state.
 ---
 
-Bundle revision: 1.48.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.48.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/campaign-readback-classification/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: campaign-readback-classification
-version: 1.0.22
+version: 1.0.24
 description: Classify a selected campaign from the readback projection's v2 fields and write a read-only handoff without turning diagnosis into permission.
 ---
 
-Bundle revision: 1.48.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.48.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/campaign-run-evidence/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: campaign-run-evidence
-version: 1.0.22
+version: 1.0.24
 description: Interpret existing Campaigns OS doctor, QA and proof-depth evidence without claiming more proof than the artifacts contain.
 ---
 
-Bundle revision: 1.48.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.48.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/contribution-intake/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: contribution-intake
-version: 1.0.22
+version: 1.0.24
 description: Turn a suggestion about the agent surface into a classified, evidence-checked proposal and, only with attended approval, one issue on this repository's tracker.
 ---
 
-Bundle revision: 1.48.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.48.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-build/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-build
-version: 1.0.27
+version: 1.0.29
 description: Assemble a NEXT campaign from a doctor-cleared Build Packet, CampaignSpec/API values, prepared HTML/assets, page-kit, and starter-template contracts.
 ---
 
-Bundle revision: 1.48.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.48.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read
@@ -107,6 +107,6 @@ Build rules:
 - Run page-kit build and SDK/template lint available in the target repo.
 - Record build with `campaigns-os record build --packet <packet>` after every page-kit build (tier `C`: it overwrites `stages.assembly` and, when the output changed, resets `stages.polish` to `required` in the assembly report, and stamps the doctor output stale; `--dry-run` is tier `none`). It stamps `stages.assembly.build_fingerprint` with the fingerprint doctor computes from `_site/<slug>/` and the Design Source Package material fingerprint when the report has one. Never type or copy these fields by hand.
 - Capture the machine-readable build summary as an artifact: `npx campaign-build --json > .campaign-runtime/page-kit-build-summary.json` (requires `next-campaign-page-kit` >= 0.1.4). Doctor's `built_output.build_summary` check verifies per-page build status and Page Kit shape warnings (`NESTED_NO_PERMALINK`, `DUPLICATE_OUTPUT`, `MISSING_FRONTMATTER`, `LAYOUT_NOT_FOUND`, `NO_CAMPAIGN`) from this artifact. If the installed page-kit predates `--json`, record that in the assembly report instead of skipping silently.
-- Update the assembly report with commands, evidence, warnings, blockers, and next owner. If a brand theme was applied, record `report.theme.status`, `css_path`, `commerce_pages`, `load_order=after-next-core`, evidence, and any first repair-loop defect.
+- Update the assembly report with commands, evidence, warnings, blockers, and next owner. If a brand theme was applied, run `campaigns-os record theme --packet <p>` (tier `C`) after `record build`: it reads each built commerce page's stylesheet links and records `report.theme` (status applied, `load_order=after-next-core`, `css_path`, `commerce_pages`, evidence). It refuses, writing nothing, when a page that loads `next-core.css` does not load the brand layer after it. Don't hand-edit `report.theme`; a first repair-loop defect goes through `record polish`.
 
 Build does not replace polish or QA. Hand off to `next-campaigns-polish` when the campaign is runnable.

package/skills/next-campaigns-os/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-os
-version: 1.0.42
+version: 1.0.44
 description: Coordinate Campaigns OS lifecycle workflows from CampaignSpec, Build Packet, starter-template contracts, stage reports, deploy evidence, and QA proof depth.
 ---
 
-Bundle revision: 1.48.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.48.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-os-setup/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-os-setup
-version: 2.0.25
+version: 2.0.27
 description: Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly installed as next-campaigns-setup; renamed 2026-08 to stop colliding with the published NextCommerceCo/skills scaffolder of that name.
 ---
 
-Bundle revision: 1.48.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.48.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills/next-campaigns-polish/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-polish
-version: 1.1.26
+version: 1.1.28
 description: Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign.
 ---
 
-Bundle revision: 1.48.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.48.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read
@@ -48,7 +48,8 @@ Use this after build has produced a runnable page-kit campaign.
 Theme gate: `campaigns-os next polish` (tier `A`, like every `next` form: additive writes under `.campaign-runtime/` plus a stage-progress POST under Run Telemetry consent; `--no-write` and `--no-remit` are each tier `B`) blocks when theme inspect found a
 generatable brand theme that is not yet applied to commerce pages. Do not work
 around the gate — apply the brand layer (`theme generate`, tier `B`; copy into
-campaign assets, load after `next-core.css`, record `report.theme`) or record an
+campaign assets, load after `next-core.css`, rebuild, `campaigns-os record build`,
+then `campaigns-os record theme --packet <p>`, tier `C`) or record an
 explicit waiver (`campaigns-os theme waive --packet <p> --reason "<why>" --waived-by "<named human>"` — tier `C`, because the waiver overwrites the assembly report and doctor output; placeholders are refused).
 
 Responsibilities:

package/skills/next-campaigns-qa/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: next-campaigns-qa
-version: 1.3.26
+version: 1.3.28
 description: Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof.
 ---
 
-Bundle revision: 1.48.0+skills.1
-Run `npx --no-install campaigns-os tooling status --skills-revision 1.48.0+skills.1`
+Bundle revision: 1.50.0+skills.1
+Run `npx --no-install campaigns-os tooling status --skills-revision 1.50.0+skills.1`
 from the campaign's Page Kit folder, where it runs the project's pinned copy and
 never installs one, at the start of each task. Start a fresh session if it
 reports `mismatch`: this text is already in your context and is never re-read

package/skills.json

@@ -1,7 +1,7 @@
 {
   "name": "campaigns-os-skills",
   "description": "Skills bundled with Campaigns OS. `skills.sh` installs these into the shared agent skill directories (~/.claude/skills, ~/.codex/skills), so each one is a versioned package: bump the version whenever a package changes. `bundle_revision` identifies the bundle as a whole — `<package version>+skills.<n>`, where the prefix is this package's version and `<n>` counts the skill-text revisions published against it. It advances whenever ANY bundled skill changes, every SKILL.md states it on its first body line, and `campaigns-os tooling status --skills-revision <value>` compares the value an agent read from a skill against the bundle on disk. See docs/skills-revision.md.",
-  "bundle_revision": "1.48.0+skills.1",
+  "bundle_revision": "1.50.0+skills.1",
   "homepage": "https://github.com/NextCommerceCo/campaigns-os",
   "retired_skills": [
     {
@@ -16,7 +16,7 @@
     {
       "id": "next-campaigns-os",
       "name": "Campaigns OS Lifecycle",
-      "version": "1.0.42",
+      "version": "1.0.44",
       "path": "skills/next-campaigns-os/SKILL.md",
       "domain": "campaigns",
       "description": "Coordinate Campaigns OS lifecycle workflows from CampaignSpec, Build Packet, starter-template contracts, stage reports, deploy evidence, and QA proof depth."
@@ -24,7 +24,7 @@
     {
       "id": "next-campaigns-os-setup",
       "name": "Campaigns OS Setup",
-      "version": "2.0.25",
+      "version": "2.0.27",
       "path": "skills/next-campaigns-os-setup/SKILL.md",
       "domain": "campaigns",
       "description": "Bootstrap or prepare a target page-kit campaign repo from a doctor-cleared Campaigns OS Build Packet before full build wiring. Formerly next-campaigns-setup; renamed to release that name to the published NextCommerceCo/skills scaffolder."
@@ -32,7 +32,7 @@
     {
       "id": "next-campaigns-build",
       "name": "Campaign Build",
-      "version": "1.0.27",
+      "version": "1.0.29",
       "path": "skills/next-campaigns-build/SKILL.md",
       "domain": "campaigns",
       "description": "Assemble a NEXT campaign from a doctor-cleared Build Packet, CampaignSpec/API values, prepared HTML/assets, page-kit, and starter-template contracts."
@@ -40,7 +40,7 @@
     {
       "id": "next-campaigns-polish",
       "name": "Campaign Polish",
-      "version": "1.1.26",
+      "version": "1.1.28",
       "path": "skills/next-campaigns-polish/SKILL.md",
       "domain": "campaigns",
       "description": "Run the visual/runtime polish pass after build and before QA for a Campaigns OS campaign."
@@ -48,7 +48,7 @@
     {
       "id": "next-campaigns-qa",
       "name": "Campaign QA",
-      "version": "1.3.26",
+      "version": "1.3.28",
       "path": "skills/next-campaigns-qa/SKILL.md",
       "domain": "campaigns",
       "description": "Run spec-aware QA from a saved Map or local-spec Build Packet and tested campaign URL after build, polish, and deploy/local evidence exist, including Playwright typed-card test-order proof."
@@ -56,7 +56,7 @@
     {
       "id": "campaign-lifecycle-orientation",
       "name": "Campaign Lifecycle Orientation",
-      "version": "1.0.22",
+      "version": "1.0.24",
       "path": "skills/campaign-lifecycle-orientation/SKILL.md",
       "domain": "campaigns",
       "description": "Orient a reader to the Campaigns OS lifecycle artifacts a run has already emitted, without advancing their state: the shared vocabulary, doctor as a gate, the stage record, and the store-theme/Page Kit two-worlds trap."
@@ -64,7 +64,7 @@
     {
       "id": "campaign-run-evidence",
       "name": "Campaign Run Evidence",
-      "version": "1.0.22",
+      "version": "1.0.24",
       "path": "skills/campaign-run-evidence/SKILL.md",
       "domain": "campaigns",
       "description": "Interpret existing doctor, QA verdict and proof-depth evidence without claiming more proof than the artifacts contain, and keep funnel proof apart from merchant launch readiness."
@@ -72,7 +72,7 @@
     {
       "id": "campaign-readback-classification",
       "name": "Campaign Readback Classification",
-      "version": "1.0.22",
+      "version": "1.0.24",
       "path": "skills/campaign-readback-classification/SKILL.md",
       "domain": "campaigns",
       "description": "Classify a selected campaign from the campaigns-os-readback/v2 fields (artifacts, staleness.stale_keys, clean, doctor, divergences, skip_cascades) and write a read-only handoff without turning diagnosis into permission."
@@ -80,7 +80,7 @@
     {
       "id": "contribution-intake",
       "name": "Contribution Intake",
-      "version": "1.0.22",
+      "version": "1.0.24",
       "path": "skills/contribution-intake/SKILL.md",
       "domain": "campaigns",
       "description": "Turn a suggestion about the agent surface into a classified, evidence-checked and redacted proposal, filed on this repository tracker only with attended approval."

package/src/brand-theme.mjs

@@ -25,7 +25,7 @@ export const THEME_REPORT_STATUSES = new Set(["applied", "skipped", "blocked", "
 export const THEME_CONFIDENCES = new Set(["high", "medium", "low", "none"]);
 
 const SKIP_DIRS = new Set([".git", "node_modules", "_site", "dist", "build", ".next", "coverage", "qa-output"]);
-const BRAND_LAYER_FILENAMES = new Set(["brand-theme.css", "checkout-brand.css"]);
+export const BRAND_LAYER_FILENAMES = new Set(["brand-theme.css", "checkout-brand.css"]);
 
 function isObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -574,6 +574,17 @@ function discoverThemeCandidates({ sourceRoot, pageMappings = [], manifest = nul
     candidates.push(candidateFromFile(path, role, source, referencedBy));
   }
 
+  // A stylesheet that pages of different roles link is the funnel's shared
+  // layer, not the first linking page's: it ranks as shared.
+  function addPageReference(path, role, referencedBy) {
+    const existing = seenFiles.has(resolve(path))
+      ? candidates.find((candidate) => candidate.source === "mapped_html_reference" && resolve(candidate.path) === resolve(path))
+      : null;
+    if (!existing) return addFile(path, role, "mapped_html_reference", referencedBy);
+    existing.referenced_by.push(...referencedBy);
+    if (existing.role !== role) existing.role = "shared";
+  }
+
   for (const conventional of [
     "assets/css/tokens.css",
     "assets/css/landing/tokens.css",
@@ -595,7 +606,7 @@ function discoverThemeCandidates({ sourceRoot, pageMappings = [], manifest = nul
     const content = readFileSync(htmlPath, "utf8");
     for (const ref of extractCssRefs(content)) {
       for (const cssPath of candidateCssPathsForRef(sourceRoot, htmlPath, ref)) {
-        addFile(cssPath, candidateRoleFromPath(ref, role), "mapped_html_reference", [{ page_id: mapping.page_id || null, path: mapping.path, ref }]);
+        addPageReference(cssPath, candidateRoleFromPath(ref, role), [{ page_id: mapping.page_id || null, path: mapping.path, ref }]);
       }
     }
   }

package/src/cli.mjs

@@ -324,6 +324,8 @@ Usage:
   campaigns-os record setup --packet <campaign-runtime.build.json> [--context <json>] [--report <json>] [--dry-run] [--json]   # record setup complete once the campaign output directory exists: Build Context scaffold.required=false and stages.setup completed, validated against their schemas before either is written
   campaigns-os record build --packet <campaign-runtime.build.json> [--context <json>] [--report <json>] [--dry-run] [--json]   # after page-kit build: stages.assembly completed with build_fingerprint = doctor's derived.build_output_fingerprint.value (and the Design Source Package material fingerprint when the report has one); stages.polish becomes required unless its evidence is bound to this exact output
   campaigns-os record polish --packet <campaign-runtime.build.json> --evidence <polish-evidence.json> [--context <json>] [--report <json>] [--dry-run] [--json]   # after polish capture: stages.polish from the file's status (completed, completed_with_warnings, blocked with blockers, or skipped with skip_reason), evidence and optional repair_loop_defect, bound to doctor's current fingerprint; a completed status is refused, writing nothing, unless the polish gate doctor evaluates would pass. --dry-run runs every check and writes nothing
+  campaigns-os record theme --packet <campaign-runtime.build.json> [--context <json>] [--report <json>] [--dry-run] [--json]   # after the brand layer is linked and build is recorded: report.theme becomes applied with load_order after-next-core, css_path, commerce_pages and per-page evidence, only when each built commerce page that loads next-core.css loads brand-theme.css (or checkout-brand.css) after it and at least one does; a page loading neither is left out as the design's own markup; refused, writing nothing, otherwise. --dry-run runs every check and writes nothing
+  campaigns-os record deploy --packet <campaign-runtime.build.json> --base-url <served url> [--context <json>] [--report <json>] [--dry-run] [--json]   # a local preview (deploy.target local-serve) after polish is recorded: GETs every built page under the loopback URL (the campaign route root), then records deploy.preview_url on the packet and stages.deploy completed with the URL in outputs; refused, writing nothing, when the URL is not loopback or not the route root, a page does not answer 2xx, the build changed since it was recorded, or the theme gate is blocked. --dry-run runs every check, the requests included, and writes nothing
   campaigns-os readback <target-repo-root> [--json] [--packet <path>] [--doctor <path>] [--context <path>] [--report <path>] [--qa-verdict <path>] [--findings <path>]   # read-only projection of one run's emitted artifacts (packet, doctor output, build context, assembly report, QA verdict, findings export): artifact states, per-artifact freshness against the checkout's HEAD reflog, doctor warning grouping, skip cascades and cross-artifact divergences. Writes nothing, starts no process, touches no network, and records no lifecycle entry; --json emits one campaigns-os-readback/v2 object (docs/readback.md). Exit 2 for a missing target root or a Build Packet set freshness cannot single out.
   campaigns-os readback --example [--json]                                # project the bundled synthetic sample; freshness is not computable for it by design
   campaigns-os validate-assembly-report --report <json> [--json]
@@ -1069,8 +1071,8 @@ async function dispatch(command, args, { recorder = NOOP_RECORDER, ambient = nul
   }
 
   if (command === "record") {
-    const { recordStageCommand } = await import("./stage-record.mjs");
-    writeResult(recordStageCommand(args), args, 0);
+    const { recordCommand } = await import("./stage-record.mjs");
+    writeResult(await recordCommand(args), args, 0);
     return;
   }
 
@@ -4466,8 +4468,9 @@ function themeStarterPaletteAdvisory(themeGate, packetPath, residueState) {
       + `\`${cmd("theme")} waive --packet ${packetArg} --reason "<why the starter palette is acceptable>"\` `
       + "— which downgrades those rows to warn severity and keeps the shipped palette visible in the "
       + "verdict; or hand-author the brand layer (write brand-theme.css, list it after next-core.css in "
-      + "commerce-page frontmatter styles, rebuild, then record report.theme.status=applied with "
-      + "load_order=after-next-core), per docs/brand-theme-bridge.md. This notice waives nothing on its own.",
+      + "commerce-page frontmatter styles, rebuild, then run "
+      + `\`${cmd("record")} build --packet ${packetArg}\` and \`${cmd("record")} theme --packet ${packetArg}\`), `
+      + "per docs/brand-theme-bridge.md. This notice waives nothing on its own.",
   };
 }
 
@@ -4650,7 +4653,7 @@ export function buildNextActions({ result, packetPath, packet, themeGate, polish
   } else if (result.stage === "deploy") {
     if (packet.deploy?.target === LOCAL_SERVE_DEPLOY_TARGET) {
       const plan = localServePlan(packet);
-      push("deploy", "manual", null, `Serve the built ${plan.dir} output locally as the origin root (deploy.target is local-serve)${plan.rewrite ? ` — ${plan.rewrite}` : ""}, then record the localhost URL on deploy.preview_url and stages.deploy in the assembly report. Localhost on any port is a Development domain: SDK allowed, analytics suppressed.`);
+      push("deploy", "manual", null, `Serve the built ${plan.dir} output locally as the origin root (deploy.target is local-serve)${plan.rewrite ? ` — ${plan.rewrite}` : ""}, then run ${cmd("record")} deploy --packet ${packetPath} --base-url <served url>: it checks every built page answers and records deploy.preview_url and stages.deploy. Localhost on any port is a Development domain: SDK allowed, analytics suppressed.`);
     } else {
       push("deploy", "manual", null, `Deploy _site/ output to ${packet.deploy?.target || "the deploy target"}, then record deploy.preview_url (or production_url) on the packet and stages.deploy in the assembly report.`);
     }
@@ -4814,7 +4817,7 @@ Rules:
 - Replace demo refs; do not copy Olympus-style shipping_methods into shop-three-step.
 - For two-step package-selection flows, treat the selector page as the pre-checkout step and pass the selected cart to checkout with forcePackageId; preserve normal tracking params and strip forcePackageId from visible checkout URLs after SDK initialization.
 - After page-kit build, inspect rendered _site output before handoff: each active page should have a body, Campaign Cart runtime markers, SDK meta tags from CampaignSpec sdk_hints.meta_tags, and no stale copied funnel attribution.
-- Run page-kit build and SDK/template lint, then record build before polish: \`${cmd("record")} build --packet ${packetPath}\`. It stamps stages.assembly.build_fingerprint with the fingerprint doctor computes from the built output (derived.build_output_fingerprint.value, sha256 over the sorted path+sha256 manifest of _site/<slug>/; doctor reports built_output.fingerprint_stale whenever the output on disk stops matching the recorded value), records report.design_source_package.material_fingerprint on stages.assembly.source_package_material_fingerprint when present, and sets stages.polish to "required" (required_by="build", required_for=["qa"]). Re-run it after every rebuild; never hand-edit these fields. Build must not mark stages.polish as completed/completed_with_warnings/skipped. If you applied a brand theme, record report.theme.status, css_path, commerce_pages, load_order=after-next-core, evidence, and any repair-loop defect.
+- Run page-kit build and SDK/template lint, then record build before polish: \`${cmd("record")} build --packet ${packetPath}\`. It stamps stages.assembly.build_fingerprint with the fingerprint doctor computes from the built output (derived.build_output_fingerprint.value, sha256 over the sorted path+sha256 manifest of _site/<slug>/; doctor reports built_output.fingerprint_stale whenever the output on disk stops matching the recorded value), records report.design_source_package.material_fingerprint on stages.assembly.source_package_material_fingerprint when present, and sets stages.polish to "required" (required_by="build", required_for=["qa"]). Re-run it after every rebuild; never hand-edit these fields. Build must not mark stages.polish as completed/completed_with_warnings/skipped. If you applied a brand theme, run \`${cmd("record")} theme --packet ${packetPath}\` after record build: it reads each built commerce page's stylesheet links and records report.theme (status applied, load_order=after-next-core, css_path, commerce_pages, evidence), and refuses, writing nothing, when a page that loads next-core.css does not load the brand layer after it. Never hand-edit report.theme.
 - Capture the machine-readable build summary as an artifact: \`${PAGE_KIT_BUILD_SUMMARY_CAPTURE_COMMAND}\` (requires next-campaign-page-kit >= 0.1.4). Doctor verifies it for per-page build errors and Page Kit shape warnings (NESTED_NO_PERMALINK, DUPLICATE_OUTPUT, MISSING_FRONTMATTER, LAYOUT_NOT_FOUND). If the installed page-kit predates --json, record that in the assembly report instead of skipping silently.${localProofPromptLines(packet)}`;
 }
 
@@ -4925,9 +4928,8 @@ Read first:
 Nothing ships anywhere: the page-kit build produces _site/ output and you serve ${serveDir} on localhost (any static server, any port) for QA. Localhost on any port is a Campaigns App Development domain, so the SDK initialises there without an origin allowlist entry and Campaigns analytics events are suppressed.
 
 Once the server is up:
-1. Record the localhost URL (origin plus ${liveUrlPath}) on the packet at deploy.preview_url.
-2. Update the assembly report's stages.deploy.status to "completed" with that URL and the serve command in outputs.
-3. Run \`${cmd("next")} --packet ${packetPath}\` to advance to QA.
+1. Run \`${cmd("record")} deploy --packet ${packetPath} --base-url <localhost origin>${liveUrlPath}\`. It requests every built page under that URL, then records the URL on the packet at deploy.preview_url and stages.deploy as completed with the URL in outputs; it refuses, writing nothing, if a page does not answer.
+2. Run \`${cmd("next")} --packet ${packetPath}\` to advance to QA.
 
 If the served build cannot be reached, set stages.deploy.status to "blocked" with a clear reason in outputs so the orchestration loop surfaces it rather than skipping past.`;
   }

package/src/install-mode.mjs

@@ -282,11 +282,3 @@ export function invocationPrefixFor(root, pkg = null) {
   prefixCache.set(root, prefix);
   return prefix;
 }
-
-// Rewrites every command spelled with the canonical bare `campaigns-os <verb>`
-// into the given prefix. Internal bookkeeping (deviation tracking, gate
-// registries, tests) keeps the canonical spelling; only what is printed or
-// emitted for an operator or agent to copy is rewritten. Skill names such as
-// next-campaigns-os-setup, file names (campaigns-os.mjs), and already-prefixed
-// forms (`npx --no-install campaigns-os`, `npm run campaigns-os --`) are left
-// alone.

package/src/invocation.mjs

@@ -65,7 +65,7 @@ const COMMANDS = frozen({
   theme: { subcommands: ["generate", "inspect", "waive"] },
   checkpoint: { subcommands: ["waive"] },
   polish: { subcommands: ["capture"] },
-  record: { subcommands: ["build", "polish", "setup"] },
+  record: { subcommands: ["build", "deploy", "polish", "setup", "theme"] },
   "validate-assembly-report": {},
   "install-agent-context": { dryRun: true },
   "install-skills": { dryRun: true },
@@ -92,8 +92,10 @@ const SUBCOMMAND_OVERRIDES = frozen({
   "spec derive": { dryRun: true },
   "qa publish": { dryRun: true },
   "record build": { dryRun: true },
+  "record deploy": { dryRun: true },
   "record polish": { dryRun: true },
   "record setup": { dryRun: true },
+  "record theme": { dryRun: true },
   "qa run": { autoEnd: true },
   "run start": { sweepRoot: "session" },
   "run end": { sweepRoot: "session", dryRun: true },

package/src/qa-binding-evidence.mjs

@@ -188,6 +188,27 @@ export async function observeBinding({ source, page, expected, scriptLoader, par
   return result(values[0] === expected.value ? 'match' : 'mismatch', 'credential_comparison');
 }
 
+// The Campaign Cart SDK sends the page's raw key, with no scheme, as
+// `Authorization` on every Campaigns API call, so the browser pass can see the
+// key a page actually uses, whatever its scripts look like. The value is
+// compared as sent: if the SDK ever adds a scheme, every page reads mismatch
+// rather than passing. The API host is matched by its shape,
+// campaigns.apps.<name>.com, without naming it.
+const SDK_API_HOST = /^campaigns\.apps\.[a-z0-9-]+\.com$/;
+export function isSdkApiRequest(url) {
+  try { const parsed = new URL(url); return parsed.protocol === 'https:' && SDK_API_HOST.test(parsed.hostname) && parsed.pathname.startsWith('/api/'); } catch { return false; }
+}
+
+// The keys a page sent are compared here and dropped; only the outcome is
+// kept. With nothing sent, or no single expected key, the static read stands
+// (null).
+export function sentBinding(sentKeys, expected) {
+  if (!sentKeys.length || expected?.conflict || !expected?.value) return null;
+  return { schema_version: BINDING_SCHEMA, observation: 'sdk_request',
+    outcome: sentKeys.every(value => value === expected.value) ? 'match' : 'mismatch',
+    reason: 'credential_comparison', source_kinds: ['sdk_request'], identity: 'not_verified' };
+}
+
 export function bindingAssertion(page, evidence) {
   // No source URLs, values, hashes, masked fragments, or inferred App IDs.
   return { id: `page-binding:${page.page_id}`, family: 'api-metadata', page: page.page_id,

package/src/qa-browser.mjs

@@ -45,6 +45,7 @@ import {
 import { ORDER_BUMP_PROBE_INPUT, orderBumpEvidenceScript } from "./qa-order-bump.mjs";
 import { assessPurchaseDataLayer, expectedOrderReferences, purchaseDataLayerAssertion, purchaseDataLayerProbe } from "./qa-purchase-data-layer.mjs";
 import { isBumpRow } from "./commercial-journey.mjs";
+import { bindingAssertion, isSdkApiRequest, sentBinding } from "./qa-binding-evidence.mjs";
 import {
   RESIDUE_PAGE_TYPES,
   demoAssetConfig,
@@ -962,6 +963,14 @@ async function runPageBrowserChecks(context, page, args, options = {}) {
       failure: request.failure()?.errorText || "request failed",
     });
   });
+  // The key each SDK request carried. It stays in this function: sentBinding
+  // keeps only whether it matched.
+  const sentKeys = [];
+  const keyReads = [];
+  browserPage.on("request", (request) => {
+    if (!isSdkApiRequest(request.url())) return;
+    keyReads.push(request.headerValue("authorization").then((value) => { if (value !== null) sentKeys.push(value); }, () => {}));
+  });
 
   // Measurements describe the existing sequence; readiness never shortens it.
   const observationStarted = performance.now();
@@ -1017,6 +1026,9 @@ async function runPageBrowserChecks(context, page, args, options = {}) {
       assertions.push(runtimeIssueAssertion(page, "browser-console-errors", actionableConsoleErrors));
     }
     observation.failed_requests_sampled_after_ms = elapsedMilliseconds(observationStarted);
+    await Promise.all(keyReads);
+    const sent = sentBinding(sentKeys, options.bindingExpected);
+    if (sent) assertions.push(bindingAssertion(page, sent));
     if (failedRequests.length) {
       assertions.push(assertion({
         id: `browser-request-failures:${page.page_id}`,
@@ -5485,6 +5497,22 @@ function reconcileOrderAgainstDisplay({ lines = [], display = null, events = nul
   const displayed = new Set(resolved.displayed_package_ids);
   const summaryIds = new Set(resolved.summary_package_ids);
   const matchedSummaryIds = new Set();
+  // A checkout order bump persists with is_upsell: true (the platform's
+  // reporting tag), yet the checkout summary displays it. Such a line charges
+  // a displayed row; an is_upsell line the summary does not show is a
+  // post-purchase upsell, out of scope here, never a stray charge.
+  let bumpLineCount = 0;
+  for (const line of (lines || []).filter((entry) => entry?.is_upsell)) {
+    const resolution = events ? campaignPackageResolutionForLine(events, line, {
+      selected_packages,
+      preferred_refs: resolved.summary_package_ids,
+    }) : null;
+    const ref = resolution?.pkg?.ref_id == null ? null : String(resolution.pkg.ref_id);
+    if (ref && summaryIds.has(ref)) {
+      matchedSummaryIds.add(ref);
+      bumpLineCount += 1;
+    }
+  }
   const extra = [];
   const unresolved = [];
   const matchedQuantities = [];
@@ -5532,6 +5560,7 @@ function reconcileOrderAgainstDisplay({ lines = [], display = null, events = nul
     displayed_package_ids: [...displayed],
     summary_package_ids: [...summaryIds],
     non_upsell_line_count: nonUpsellLines.length,
+    ...(bumpLineCount ? { order_bump_line_count: bumpLineCount } : {}),
     extra,
     missing,
     matched_quantities: matchedQuantities,
@@ -5601,7 +5630,7 @@ function orderDisplayParityAssertion(page, planIdentifier, order) {
     return assertion({
       ...base,
       status: STATUS.PASS,
-      actual: `${reconciliation.non_upsell_line_count} non-upsell line(s) reconciled against ${reconciliation.summary_package_ids.length} displayed package(s)`,
+      actual: `${reconciliation.non_upsell_line_count} non-upsell line(s)${reconciliation.order_bump_line_count ? ` and ${reconciliation.order_bump_line_count} order bump line(s)` : ""} reconciled against ${reconciliation.summary_package_ids.length} displayed package(s)`,
       evidence: reconciliation,
     });
   }

package/src/qa-node.mjs

@@ -2329,7 +2329,7 @@ async function runResolvedQa(args, resolved, { runSessionActive = false, liveCam
     });
   assertions.push(...liveCampaignRefAssertions({ pages: [...livePages.values()], spec: liveSpec, liveCampaign: liveRead }));
   if (args.browser === true) {
-    assertions.push(...await runBrowserChecks(resolved.topologies, args, {
+    const browserAssertions = await runBrowserChecks(resolved.topologies, args, {
       brandContract: resolved.brandContract,
       // With no generatable brand theme on the local preview, the starter
       // template is the design: its residue is a warning (local-preview-policy.mjs).
@@ -2337,7 +2337,15 @@ async function runResolvedQa(args, resolved, { runSessionActive = false, liveCam
         ? SEVERITY.WARN
         : residueSeverityForThemeGate(gate.status),
       supportedPaymentMethods: supportedPaymentMethodsFromSpec(resolved.spec),
-    }));
+      bindingExpected,
+    });
+    // A page-binding row from the browser is the key the SDK actually sent;
+    // it takes the place of that page's static read.
+    for (const observed of browserAssertions) {
+      const at = observed.id.startsWith("page-binding:") ? assertions.findIndex((entry) => entry.id === observed.id) : -1;
+      if (at >= 0) assertions[at] = observed;
+      else assertions.push(observed);
+    }
   }
 
   const testOrders = await runAnalyticsOrderSequence({ args, resolved, runId, assertions });