@nextcommerce/campaigns-os 1.52.0 → 1.54.0

package/contracts/release-ledger.json

@@ -5870,6 +5870,666 @@
         }
       ],
       "entry_sha256": "e9063da2788630cb0017eedc0b2e77b717b290bae0e7cb5d6bcdbbb6e6b7368e"
+    },
+    {
+      "id": "RL-0233",
+      "sequence": 225,
+      "date": "2026-10-05",
+      "kind": "release",
+      "surface_version": "1.53.0",
+      "changelog_section": "1.53.0",
+      "changelog_sha256": "b5e6bbfd3ab22a16b715fbd574128715ab5a9a70d76c1e09f8f91c1d25ce72f6",
+      "agent_impact": "Surface 1.53.0. Adds record brief, which saves Campaign Build Brief answers without re-running intake, and record spec, which binds a CampaignSpec change without discarding operator state; their --dry-run forms write nothing and append no lifecycle entry. A brief file is guided unless it sets \"brief_mode\": \"prepared\" (a campaign whose report already records a prepared brief stays prepared). An unchanged or reformatted save keeps every stage's evidence and status. A material brief or CampaignSpec change makes build, Polish and QA owed again (QA alone for a qa_policy change), keeps the last five superseded records per stage as history that is never current proof, and next, doctor, progress, readback and the Assembly Report status report the owed stage; next offers refresh_inputs (record brief or record spec) when a recorded stage was made against earlier content. Build, Polish and QA records now stamp the brief and CampaignSpec content they were made against; records without stamps read unconfirmed. Re-recording an unchanged build after an input change keeps the build owed unless the operator's --deviation-reason records that the change needs no output change; Polish stays owed until a new capture postdates the change. Intake refuses, without --force, to discard recorded waivers, warning accepts, stage history, an applied theme, or a recorded deploy target, preview URL, production URL, order-path depth or allowed-domains confirmation; --force archives the build, Polish and QA records it clears and keeps stage history. spec derive no longer rebinds report identity and its --json result no longer carries rebound; run record spec after it. Bundled skills carry revision 1.53.0+skills.1: an agent that loaded an earlier revision should start a fresh session. Install the 1.53.0 package with the documented local setup command.",
+      "compatibility": "breaking",
+      "migration": "After upgrading, next routes each in-flight campaign back to build once, because build, Polish and QA records made before 1.53.0 do not record which brief and CampaignSpec content they used: re-record build and Polish, and run QA again for a new verdict. Add \"brief_mode\": \"prepared\" to a hand-written brief file whose open questions should block. Save brief answers with record brief and CampaignSpec changes with record spec instead of re-running start, prepare-build or build, which now refuse without --force to discard recorded waivers, warning accepts, stage history, an applied theme, or a recorded deploy target, preview URL, production URL, order-path depth or allowed-domains confirmation. Run record spec after spec derive, and stop reading rebound from spec derive --json.",
+      "changes": [
+        {
+          "class": "compatibility_policy",
+          "path": "compatibility.json",
+          "surface_entry": null,
+          "summary": "Advance the declared version to 1.53.0."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/effects.v1.json",
+          "surface_entry": "contracts/effects.v1.json",
+          "summary": "Declare the record brief and record spec rows (tier C) and their --dry-run rows (tier none); correct the start, prepare-build and build notes (refused without --force when the report carries stage evidence, stage history or operator decisions) and their --force notes (completed build, Polish and QA records are archived into stage history, which is kept); state that record build writes input_change and makes Polish and QA owed when it detects a brief or CampaignSpec change; and state that record polish, record theme and record deploy are refused while an earlier stage is owed again."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Advance surface_version to 1.53.0 and record the effects contract hash."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "Describe CampaignSpec material changes for local-spec, saved-Map and gateway packets, record spec, spec derive no longer rebinding identity, and the brief and CampaignSpec dependency map."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/campaign-build-brief.md",
+          "surface_entry": "docs/campaign-build-brief.md",
+          "summary": "Replace Answering The Questions with saving answers through record brief, the brief_mode rule, which changes make which stages owed again, stage history, --deviation-reason, and the one-time re-proof of records made before 1.53.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/effects.md",
+          "surface_entry": "docs/effects.md",
+          "summary": "Describe what record brief and record spec write and refuse, their dry runs, and the intake refusal and --force archive."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/local-setup.md",
+          "surface_entry": "docs/local-setup.md",
+          "summary": "Pin the 1.53.0 package in the local setup install command."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate at surface 1.53.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/progress-snapshots.md",
+          "surface_entry": "docs/progress-snapshots.md",
+          "summary": "Stage records carry each stage's effective status: a stage owed again by a brief or CampaignSpec change reads required, and one whose inputs cannot be confirmed reads unknown."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/readback.md",
+          "surface_entry": "docs/readback.md",
+          "summary": "The STAGES header prints the recorded and the effective report status, and a stage line whose effective status differs adds the recorded status and the reason."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate at surface 1.53.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Use the current 1.53.0+skills.1 bundle in executable examples."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Advance the package version to 1.53.0."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Advance the package version to 1.53.0."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": "skills.json",
+          "summary": "Advance the bundled skill revision to 1.53.0+skills.1 and each skill version one patch."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.1 bundle revision."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "record",
+          "summary": "Add record brief and record spec to the usage text; intake binds the brief material and refuses to discard operator state without --force; QA records stamp their inputs; next carries input_currency, offers refresh_inputs and notes an operator's unchanged-output decision in the QC handoff; spec derive no longer rebinds report identity, drops the rebound result field and names record spec."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/checks.mjs",
+          "surface_entry": "doctor",
+          "summary": "Doctor reports input currency in derived.input_currency and warns spec.material_stale, spec.binding_unknown, build_brief.material_changed, build_brief.binding_unknown, build_brief.input_unsaved, assembly.output_unchanged_after_input_change and assembly.output_unchanged_by_operator_decision; a normalized brief that is not valid JSON, or not a JSON object, is the build_brief.normalized_path error, not a crash."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/next-step.mjs",
+          "surface_entry": "next",
+          "summary": "The stage picker reads each stage's effective status, so a stage owed again by a brief or CampaignSpec change, or one whose inputs cannot be confirmed, is the stage next recommends."
+        }
+      ],
+      "entry_sha256": "85e37bd6392dcfa8415a654897eb8dbe8ab417fc9c92ec21732d2fff5a5f5f5b"
+    },
+    {
+      "id": "RL-0234",
+      "sequence": 226,
+      "date": "2026-10-05",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.1",
+      "changelog_sha256": "b865a430b924ff48016930621ba3905deb7861516d9dfdabfd797ed5aaebf6db",
+      "agent_impact": "polish capture now measures text readability on every built page at desktop and mobile widths and attaches it as stages.polish.evidence.visual_review.readability; next lists readability.contrast warnings, review and coverage results in its QC handoff, grouping each warning colour pair across pages and widths for one checkpoint accept. On a campaign whose every mapped page is template stock, polish capture measures readability, prints the page-load no_capturable_routes message as a warning, and exits 0 with status captured_with_warnings; record polish still refuses a completed Polish record there. Polish media weight and readability results read as stale when doctor reports the built output changed since record build. Readability results never block Polish or change readiness. QA's browser-primary-cta check now runs on every page with an expected_next_url, whatever its page type, and measures every visible route-matching CTA (not only the most readable one) and each piece of text inside it, unrounded, with the same measurement Polish uses, against the requirement for its own size; its evidence lists each candidate's elements[] with contrast_ratio_exact and required_ratio. A CTA observed incompletely (the SDK, stylesheets, fonts or its text not ready, a review trigger, text generated by ::before or ::after, or disabled controls) reads manual_review at severity warn, never pass, and so does a page whose inspection script errors (inspection_error, earlier a fail). So browser-primary-cta results on existing campaigns can change in either direction: pages that were skipped are now checked, a second CTA or child text can now fail, large bold text at 3:1 can now pass, and incomplete observations read manual_review instead of pass or fail. The brand theme generator compares contrast unrounded, so a declared colour in [4.495, 4.5) now adds theme.foreground.low_contrast; generated CSS and colour choices are unchanged.",
+      "compatibility": "additive",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "polish",
+          "summary": "polish capture attaches the readability record beside page_load (which now carries captured_at), and on a campaign with no mapped pages measures readability only, reports the held page-load message as a warning and exits 0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "Describe accepting a readability warning: one colour pair and size class per page and width, what orphans or lapses the accept, and that it never hides review, unexercised or excluded results."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/brand-theme-bridge.md",
+          "surface_entry": "docs/brand-theme-bridge.md",
+          "summary": "State that theme contrast uses the same unrounded measurement as Polish and QA, so a declared colour at 4.495:1 now warns, and that the generator's colour choices are unchanged."
+        }
+      ],
+      "entry_sha256": "b75e489a53ea7b60a3a9b3037f6f17c96b13c2960a1cbd34eb7a3cc69b54f617"
+    },
+    {
+      "id": "RL-0235",
+      "sequence": 227,
+      "date": "2026-10-05",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.2",
+      "changelog_sha256": "a7fc7d90ee83e6ad44d310d77942e00de56656259e9c754eec14cd5bd8d124d4",
+      "agent_impact": "next prints a campaign intent summary, generated from the normalized Campaign Build Brief, on every result (intent_summary in JSON, a Campaign intent section in text) and at the top of the setup, build, Polish and QA prompts. Each value carries its origin (stated, from the source, default, not stated, or source not recorded); values are quoted data, purpose and palette source inferred from page types or names read not stated, and nothing reads the summary, so it never sets prices or commerce behaviour. The four agent context files and the setup, build, Polish and QA skills tell agents to read .campaign-runtime/input/campaign-build-brief.normalized.json and the recorded assembly decisions. Bundled skills carry revision 1.53.0+skills.2: an agent that loaded an earlier revision should start a fresh session. The lifecycle skill returns the single compact brief in references/session-intake.md (Intent: is now Work:, with a new Campaign: field and Proof policy:) and saves brief answers with record brief after asking the operator; the build skill passes --deviation-reason only on the operator's explicit decision, the Polish skill records a skipped Polish only on the operator's decision, and the Polish and QA skills report readability warnings and offer repairs inside the brand palette. tooling setup refuses an installed agent context from an earlier release and names install-agent-context --target . in its refusal.",
+      "compatibility": "breaking",
+      "migration": "From each existing campaign folder: install the exact 1.53.0 package, run npx --no-install campaigns-os install-agent-context --target . (it overwrites all four files under .campaign-runtime/agent-context/; local edits there are lost), review and commit the diff, rerun npx --no-install campaigns-os tooling setup --target . --platform claude, and restart the agent session. Codex, Cursor and Copilot users run install-agent-context and reinstall skills with install-skills --platform codex (or agents).",
+      "changes": [
+        {
+          "class": "documentation",
+          "path": "agents/claude/CLAUDE.md",
+          "surface_entry": "agents/claude/CLAUDE.md",
+          "summary": "Add the generic campaign paragraph: what a NEXT campaign is, who owns creative intent and commerce behaviour, read the normalized brief and the recorded decisions before changing a campaign, treat the intent summary as orientation only, and ask the operator before saving brief answers."
+        },
+        {
+          "class": "documentation",
+          "path": "agents/codex/AGENTS.md",
+          "surface_entry": "agents/codex/AGENTS.md",
+          "summary": "Add the generic campaign paragraph: what a NEXT campaign is, who owns creative intent and commerce behaviour, read the normalized brief and the recorded decisions before changing a campaign, treat the intent summary as orientation only, and ask the operator before saving brief answers."
+        },
+        {
+          "class": "documentation",
+          "path": "agents/copilot/copilot-instructions.md",
+          "surface_entry": "agents/copilot/copilot-instructions.md",
+          "summary": "Add the generic campaign paragraph: what a NEXT campaign is, who owns creative intent and commerce behaviour, read the normalized brief and the recorded decisions before changing a campaign, treat the intent summary as orientation only, and ask the operator before saving brief answers."
+        },
+        {
+          "class": "documentation",
+          "path": "agents/cursor/campaigns-os.mdc",
+          "surface_entry": "agents/cursor/campaigns-os.mdc",
+          "summary": "Add the generic campaign paragraph: what a NEXT campaign is, who owns creative intent and commerce behaviour, read the normalized brief and the recorded decisions before changing a campaign, treat the intent summary as orientation only, and ask the operator before saving brief answers."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Use the current 1.53.0+skills.2 bundle in executable examples."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": "skills.json",
+          "summary": "Advance the bundled skill revision to 1.53.0+skills.2 and each skill version one patch."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.2 bundle revision; read the normalized brief and the recorded decisions; rebuild after an input change and pass --deviation-reason to record build only on the operator's explicit decision, quoting their reason."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.2 bundle revision; read the normalized brief and the recorded decisions."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.2 bundle revision; return the compact brief defined in references/session-intake.md instead of a second copy, rename the Intent and Proof depth fields to Work and Proof policy, save brief answers with record brief after asking the operator, and declare a detour with --deviation-reason only when the operator has decided on it in the conversation, quoting their reason, including on record build after an input change."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/references/session-intake.md",
+          "surface_entry": null,
+          "summary": "The single compact brief: Intent becomes Work, a Campaign field takes the Campaign intent lines from next, Missing inputs covers only choices that affect this revision, and brief answers are saved with record brief after asking the operator."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.2 bundle revision; read the normalized brief and the recorded decisions; record a skipped Polish only on the operator's decision, quoting their reason as skip_reason; report readability warnings and offer repairs inside the brand palette, accepting one only with the operator's refs, reason and name."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.53.0+skills.2 bundle revision; read the normalized brief and the recorded decisions; report readability warnings and offer repairs inside the brand palette, accepting one only with the operator's refs, reason and name."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "next",
+          "summary": "next carries intent_summary on every result and prints a Campaign intent section under the status; the setup, build, Polish and QA prompts start with the summary and the absolute normalized brief path, and the build prompt names record brief and record spec for refreshing a changed brief or CampaignSpec."
+        }
+      ],
+      "entry_sha256": "197929e76610b701b015cac7ee37f1f8a75b18e350a8268b679b8ca51a9b7f14"
+    },
+    {
+      "id": "RL-0237",
+      "sequence": 228,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.3",
+      "changelog_sha256": "d93e2a6e96de6d7e17d3f1235ff2c9ca6984890fe1026df284c38eacdbcb5557",
+      "agent_impact": "standardize evaluates a campaign_cart_app root's bundled campaign-cart dependency against the SDK support policy by the lowest version its package.json spec allows, recorded as sdk_loader.bundled_dependency.floor_version. An exact pin (0.4.30, =0.4.30, v0.4.30) or one ^, ~ or >= range on a released version is evaluated by that version, unchanged from before. Any other spec (<0.4.39, an ||, hyphen or x-range, a tag) now gets no version_policy evaluation and raises the new warning version.sdk_dependency_floor_unknown; earlier releases evaluated the version written in the spec, so such a range could pass or fail the minimum on a version npm might not install. Prerelease pins still raise version.sdk_prerelease_pin only. resolved_version is unchanged.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/campaign-standardization-report.md",
+          "surface_entry": "docs/campaign-standardization-report.md",
+          "summary": "Describe judging a bundled dependency by its floor_version, which specs have a certain floor, and the version.sdk_dependency_floor_unknown warning for those that do not."
+        }
+      ],
+      "entry_sha256": "d98fbc7e8865f4ab5bb35bb7510a787af576ef23dfe5b50377fb2f744af8bf0b"
+    },
+    {
+      "id": "RL-0236",
+      "sequence": 229,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.4",
+      "changelog_sha256": "b1de69de9257b9151d0fb38eeb0c23f92bc8a3a405f0c0f6e6d7427b44564c75",
+      "agent_impact": "doctor built_output.sdk_markup WRONG_FIELD_NAME and the standardize checkout field contract now judge first_name and last_name (mapped from Campaign Cart SDK 0.4.39) and phone_number (from 0.4.41) against the SDK version of the page: doctor reads the page's own exact loader pin, then the campaign's _data/campaigns.json sdk_version; standardize reads the file's own exact loader pin, then the lowest exact pin the campaign root declares (exact loader pins; a bundled campaign-cart dependency's exact pin or the floor of a ^, ~ or >= range, any other range reading as unknown; or for Page Kit roots the campaign's campaigns.json sdk_version). On a version at or after the name's since-version the name passes, so pages written to the SDK 0.4.41 field names stop blocking. Below it, or when no exact released version can be read, results are unchanged: first_name and last_name block (WRONG_FIELD_NAME; checkout.unsupported_field_binding) and phone_number blocks in doctor and warns as checkout.unknown_field_binding in standardize; fname, lname and phone pass on every version. WRONG_FIELD_NAME details gain sdk_version and sdk_version_source (loader or campaigns_json) and, for these three names, since; the gate gains campaign_sdk_version. standardize checkout_fields.bindings[] gain since, sdk_version and sdk_version_source (loader, campaign or campaigns_json), and stale-alias and unknown-field evidence for these names carries since and sdk_version.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/checks.mjs",
+          "surface_entry": "doctor",
+          "summary": "The SDK markup gate passes the campaign's campaigns.json sdk_version to the field-name check as the fallback for a page with no exact loader pin, and records it as campaign_sdk_version."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "WRONG_FIELD_NAME: first_name and last_name are mapped from SDK 0.4.39 and phone_number from 0.4.41, judged against the page loader pin, then campaigns.json; unknown is judged as an earlier SDK."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/campaign-standardization-report.md",
+          "surface_entry": "docs/campaign-standardization-report.md",
+          "summary": "Describe the field contract version_gated_aliases and the sdk_version and sdk_version_source each checkout binding records. A bundled dependency counts only through an exact pin or a ^, ~ or >= floor."
+        }
+      ],
+      "entry_sha256": "b6af3f03f0bc8e03b7a24d10c65c2cc889ede6e04ce7828b4e78c2562414564b"
+    },
+    {
+      "id": "RL-0238",
+      "sequence": 230,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.5",
+      "changelog_sha256": "69caf644546b719adf09b72227b50230250b586e6043de066dfe4b79c70c22df",
+      "agent_impact": "qa run --test-order now types the test card on Campaign Cart SDK 0.4.41 checkouts. 0.4.41 mounts the card number and CVV as iframe[id^=spreedly-hosted-number] and iframe[id^=spreedly-hosted-cvv] (Spreedly Checkout SDK fields loaded by payments.29next.com/js/v1/payment.js) instead of the iFrame v1 spreedly-number-frame / spreedly-cvv-frame ids, and the runner matched only the old ids, so the typed-card step timed out before submit on 0.4.41. The runner now matches either generation. Before typing, card_fields_filled waits up to 15s until no element carries next-loading-spreedly (the SDK sets it from before the card iframes mount until the fields are ready, 0.4.38 to 0.4.41), because digits typed into a 0.4.41 field before then can be dropped, and the SDK then refuses the short number without tokenizing, so order_submitted timed out with no order. After typing, it reads both fields back and retypes, up to 3 attempts in all. The step gains evidence {generation: spreedly-hosted | spreedly-iframe-v1, number_frame_id, cvv_frame_id, ready_wait_ms, attempts}; its detail is unchanged. card_fields_filled now fails by name, with no order submitted, in three cases: when more than one number or CVV iframe matches or the two generations mix (Playwright previously raised a strict-mode violation); when next-loading-spreedly is still set after 15s, meaning the card script never finished loading; and when the fields still do not hold the typed card after 3 attempts (the error gives the digit counts and last four of the number). No verdict field or flag changes; spreedly_tokenized still reads the core.spreedly.com payment_methods request, which 0.4.41 still makes. Pages pinned to 0.4.40 or earlier run as before, plus the readiness wait and the read-back.",
+      "compatibility": "additive",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "The typed-card step names both card-field generations (Spreedly iFrame fields on SDK 0.4.40 and earlier, the Spreedly-hosted fields NEXT payments.29next.com script mounts on 0.4.41 and later), waits for next-loading-spreedly to clear before typing, and reads both fields back, retyping up to three attempts in all."
+        }
+      ],
+      "entry_sha256": "edc4fd10bfe974dd3cfd9e6a6d5f3337a483db0525f6231bf68d3e79e22ac51f"
+    },
+    {
+      "id": "RL-0240",
+      "sequence": 231,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.7",
+      "changelog_sha256": "f91240db8674ccb5f7a94f042c93b059aa4f0a138124927b391554f554cafddc",
+      "agent_impact": "doctor --built with --base-url adds a ready line saying the local built files were checked and the URL was not fetched (it only fills deploy.preview_url in the minimal Build Packet), names qa run --site <repo> --base-url <url> --family <family> --browser for the served pages, and sets derived.base_url { value, fetched: false, recorded_as: deploy.preview_url } in JSON. Do not report a doctor --built result as a check of a preview or production site.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "doctor",
+          "summary": "The doctor --built usage line says --base-url is not fetched and fills deploy.preview_url in the minimal packet."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/inspect.mjs",
+          "surface_entry": "doctor",
+          "summary": "doctor --built with --base-url reports that only local files were checked, names qa run --site for served pages, and sets derived.base_url.fetched false."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "State that doctor --built reads local files only, that --base-url is not fetched, how to check served pages, and that the minimal packet does not drive packet QA."
+        }
+      ],
+      "entry_sha256": "6382a67f50d12ae1999b352595ff6faa13fca3e122617e9ba43ce4cc8c77e659"
+    },
+    {
+      "id": "RL-0241",
+      "sequence": 232,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.9",
+      "changelog_sha256": "359d517828d411f329a3fe02bb421a676652ffb2662532599e435dd0cf38a5f7",
+      "agent_impact": "When the per-target lock or the progress allocation lock cannot be taken because a file, a symbolic link, or a directory with no owner record that holds other entries sits at the lock path, the refusal names what is there and says it is never removed automatically. Report it as an obstruction to move out of the way, not as a busy or ownerless lock. The holder of a lock also removes staging and released siblings whose recorded owner process no longer exists.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/design-source-package.md",
+          "surface_entry": "docs/design-source-package.md",
+          "summary": "Say that a non-lock entry at the target lock path is named and never removed, and that the holder removes lock siblings left by dead processes."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/progress-snapshots.md",
+          "surface_entry": "docs/progress-snapshots.md",
+          "summary": "Say that a file or other non-lock entry at the allocation lock path is named in the warning and never removed."
+        }
+      ],
+      "entry_sha256": "82debb74a4998923dd9cfb3bea6ed486ba408860001fe79c6dc2460de026bb4a"
+    },
+    {
+      "id": "RL-0244",
+      "sequence": 233,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.10",
+      "changelog_sha256": "7b0402af57d09ba68a5ca4fc1b8e9044eafa8f2b8a3d921bf26c6803958126db",
+      "agent_impact": "The vendored starter catalog and the SDK attribute index now describe Campaign Cart SDK 0.4.41. A certified family is verified against 0.4.41, so a missing SDK pin is reported against that version. built_output.sdk_markup accepts the 0.4.41 address block, data-next-i18n and phone attributes and reports sdk_attribute_index_version 0.4.41; built_output.cart_placeholders checks pages pinned to 0.4.41 instead of reporting them unexercised. Read a WRONG_FIELD_NAME finding as naming the 0.4.41 field set, which is the same as 0.4.38 plus the version-gated aliases.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "Say the vendored checkout field names are taken at SDK v0.4.41."
+        }
+      ],
+      "entry_sha256": "41994901ffbce1dbdf74e020465ba9622ed062cb310b6021265fe848ae12a559"
+    },
+    {
+      "id": "RL-0245",
+      "sequence": 234,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": "1.54.0",
+      "changelog_section": "1.54.0",
+      "changelog_sha256": "60ec528377c8a9f14165cfd7d6e09a4e7933c65cd53c6ca3fe8f74ff7acbe91d",
+      "agent_impact": "Surface 1.54.0. Ships 1.53.0+agent.1 through +agent.11, including qa run --test-order typing card fields on Campaign Cart SDK 0.4.41 and the starter catalog, SDK attribute index and support policy at 0.4.41. New subcommand sdk repin --target <static-repo> [--target-sdk <x.y.z>] [--apply] [--json] replaces the hand-run sed step when bumping the Campaign Cart SDK in a static campaign repo (no _data/campaigns.json). It rewrites only the version segment of semver-pinned (@vX.Y.Z or @X.Y.Z) loader.js and campaign-cart.css URLs below the target, the same references standardize lists under sdk_loader.references; @latest, @main, commit and prerelease refs and pins at or above the target are reported in left_alone and never rewritten. The target defaults to the SDK support policy's preferred_minimum. Preview is the default and writes nothing; --apply writes the files and the change record .campaign-runtime/sdk-repin.json (schema campaigns-os-sdk-repin/v0: files_touched, reference_count, from_versions, to_version, rewrites, left_alone), whose path and sha256 the --json result gives for a Run Record to cite. A second run reports nothing_to_change and writes nothing. A page-kit repo is refused with exit 2 (status refused_page_kit); use page-kit sync there. After --apply, run browser QA against the new pin: repin does not prove the SDK works. qa run keeps the verdict local by default when the base URL (from --base-url or the packet's deploy.preview_url) is a local address (localhost or *.localhost, any 127.x.x.x, 0.0.0.0, [::1] or an IPv4-mapped loopback), for saved-Map and local-spec runs alike; publish_decision.reason reads loopback_base_url and the output names qa publish and --post-verdict. An agent that wants a local-address verdict on the Map's QA tab passes --post-verdict or runs qa publish afterwards. Remote base URLs publish as before. record deploy now binds stages.deploy to the build it probed (source_build_fingerprint). After a record build of different output, a stamped deploy reads required and next names deploy before QA: serve the new build and run record deploy again. A byte-identical rebuild keeps the deploy current, and a deploy recorded before this change, with no stamp, is kept as recorded.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "compatibility_policy",
+          "path": "compatibility.json",
+          "surface_entry": null,
+          "summary": "Advance the declared version to 1.54.0."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/effects.v1.json",
+          "surface_entry": "contracts/effects.v1.json",
+          "summary": "Declare sdk repin (tier none) and sdk repin --apply (tier B: the rewritten files, the change record and the lifecycle journal), and add --apply to the effect-changing flags; on the eight qa run rows, name the local-address default in the verdict send's condition and record it unobserved under the 127.0.0.1 offline fixture (#486), with qa publish as the proof of that send; state that record deploy stamps the build fingerprint it probed, and that record build makes a completed deploy stamped with other output required."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Advance surface_version to 1.54.0 and record the effects contract and Assembly Report schema hashes."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "sdk",
+          "summary": "Add the sdk repin subcommand and its usage line: rewrite semver-pinned Campaign Cart loader and stylesheet URLs below the target in a static repo, preview by default, --apply writes the files and the campaigns-os-sdk-repin/v0 change record, --target-sdk overrides the policy target, a page-kit repo is refused with exit 2; the record deploy usage line says the deploy stage carries the build fingerprint it probed and is required again after a record build of other output."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "docs/supported-surface.md",
+          "surface_entry": "docs/supported-surface.md",
+          "summary": "Add the sdk repin row."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/sdk-storage-compatibility.md",
+          "surface_entry": "docs/sdk-storage-compatibility.md",
+          "summary": "Document sdk repin as the pin-rewrite step after the storage check for static repos: which references it rewrites and leaves alone, the preview and --apply modes, the change record, and the page-kit refusal."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/effects.md",
+          "surface_entry": "docs/effects.md",
+          "summary": "List the sdk repin preview among the read-only invocations and --apply among the effect-changing flags."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/campaign-standardization-report.md",
+          "surface_entry": "docs/campaign-standardization-report.md",
+          "summary": "Point from sdk_loader.references to sdk repin for static repos."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "Describe the local-address default and how to publish such a verdict; the local proof steps say record deploy is bound to the build it probed and is owed again after a record build of other output."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/local-setup.md",
+          "surface_entry": "docs/local-setup.md",
+          "summary": "Pin the 1.54.0 package in the local setup install command."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Use the current 1.54.0+skills.1 bundle in executable examples."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Advance the package version to 1.54.0."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": "skills.json",
+          "summary": "Advance the bundled skill revision to 1.54.0+skills.1 and each skill version one patch."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate at surface 1.54.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate at surface 1.54.0."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Advance the package version to 1.54.0."
+        },
+        {
+          "class": "schema",
+          "path": "schemas/campaign-runtime-assembly-report.v0.schema.json",
+          "surface_entry": "schemas/campaign-runtime-assembly-report.v0.schema.json",
+          "summary": "Describe source_build_fingerprint on a stage, which stages.deploy now carries: the build fingerprint record deploy probed."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "The record build and record deploy rows say deploy is stamped with the build it probed and reset to required by a record build of other output; an unstamped deploy is kept."
+        }
+      ],
+      "entry_sha256": "5ab33ca302fa671ac78c3e9b752ed7b251e756b05256f97ff75acd08c58ad5ba"
     }
   ]
 }