@nextcommerce/campaigns-os 1.53.0 → 1.55.0

package/contracts/release-ledger.json

@@ -6197,6 +6197,780 @@
         }
       ],
       "entry_sha256": "197929e76610b701b015cac7ee37f1f8a75b18e350a8268b679b8ca51a9b7f14"
+    },
+    {
+      "id": "RL-0237",
+      "sequence": 228,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.3",
+      "changelog_sha256": "d93e2a6e96de6d7e17d3f1235ff2c9ca6984890fe1026df284c38eacdbcb5557",
+      "agent_impact": "standardize evaluates a campaign_cart_app root's bundled campaign-cart dependency against the SDK support policy by the lowest version its package.json spec allows, recorded as sdk_loader.bundled_dependency.floor_version. An exact pin (0.4.30, =0.4.30, v0.4.30) or one ^, ~ or >= range on a released version is evaluated by that version, unchanged from before. Any other spec (<0.4.39, an ||, hyphen or x-range, a tag) now gets no version_policy evaluation and raises the new warning version.sdk_dependency_floor_unknown; earlier releases evaluated the version written in the spec, so such a range could pass or fail the minimum on a version npm might not install. Prerelease pins still raise version.sdk_prerelease_pin only. resolved_version is unchanged.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/campaign-standardization-report.md",
+          "surface_entry": "docs/campaign-standardization-report.md",
+          "summary": "Describe judging a bundled dependency by its floor_version, which specs have a certain floor, and the version.sdk_dependency_floor_unknown warning for those that do not."
+        }
+      ],
+      "entry_sha256": "d98fbc7e8865f4ab5bb35bb7510a787af576ef23dfe5b50377fb2f744af8bf0b"
+    },
+    {
+      "id": "RL-0236",
+      "sequence": 229,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.4",
+      "changelog_sha256": "b1de69de9257b9151d0fb38eeb0c23f92bc8a3a405f0c0f6e6d7427b44564c75",
+      "agent_impact": "doctor built_output.sdk_markup WRONG_FIELD_NAME and the standardize checkout field contract now judge first_name and last_name (mapped from Campaign Cart SDK 0.4.39) and phone_number (from 0.4.41) against the SDK version of the page: doctor reads the page's own exact loader pin, then the campaign's _data/campaigns.json sdk_version; standardize reads the file's own exact loader pin, then the lowest exact pin the campaign root declares (exact loader pins; a bundled campaign-cart dependency's exact pin or the floor of a ^, ~ or >= range, any other range reading as unknown; or for Page Kit roots the campaign's campaigns.json sdk_version). On a version at or after the name's since-version the name passes, so pages written to the SDK 0.4.41 field names stop blocking. Below it, or when no exact released version can be read, results are unchanged: first_name and last_name block (WRONG_FIELD_NAME; checkout.unsupported_field_binding) and phone_number blocks in doctor and warns as checkout.unknown_field_binding in standardize; fname, lname and phone pass on every version. WRONG_FIELD_NAME details gain sdk_version and sdk_version_source (loader or campaigns_json) and, for these three names, since; the gate gains campaign_sdk_version. standardize checkout_fields.bindings[] gain since, sdk_version and sdk_version_source (loader, campaign or campaigns_json), and stale-alias and unknown-field evidence for these names carries since and sdk_version.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/checks.mjs",
+          "surface_entry": "doctor",
+          "summary": "The SDK markup gate passes the campaign's campaigns.json sdk_version to the field-name check as the fallback for a page with no exact loader pin, and records it as campaign_sdk_version."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "WRONG_FIELD_NAME: first_name and last_name are mapped from SDK 0.4.39 and phone_number from 0.4.41, judged against the page loader pin, then campaigns.json; unknown is judged as an earlier SDK."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/campaign-standardization-report.md",
+          "surface_entry": "docs/campaign-standardization-report.md",
+          "summary": "Describe the field contract version_gated_aliases and the sdk_version and sdk_version_source each checkout binding records. A bundled dependency counts only through an exact pin or a ^, ~ or >= floor."
+        }
+      ],
+      "entry_sha256": "b6af3f03f0bc8e03b7a24d10c65c2cc889ede6e04ce7828b4e78c2562414564b"
+    },
+    {
+      "id": "RL-0238",
+      "sequence": 230,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.5",
+      "changelog_sha256": "69caf644546b719adf09b72227b50230250b586e6043de066dfe4b79c70c22df",
+      "agent_impact": "qa run --test-order now types the test card on Campaign Cart SDK 0.4.41 checkouts. 0.4.41 mounts the card number and CVV as iframe[id^=spreedly-hosted-number] and iframe[id^=spreedly-hosted-cvv] (Spreedly Checkout SDK fields loaded by payments.29next.com/js/v1/payment.js) instead of the iFrame v1 spreedly-number-frame / spreedly-cvv-frame ids, and the runner matched only the old ids, so the typed-card step timed out before submit on 0.4.41. The runner now matches either generation. Before typing, card_fields_filled waits up to 15s until no element carries next-loading-spreedly (the SDK sets it from before the card iframes mount until the fields are ready, 0.4.38 to 0.4.41), because digits typed into a 0.4.41 field before then can be dropped, and the SDK then refuses the short number without tokenizing, so order_submitted timed out with no order. After typing, it reads both fields back and retypes, up to 3 attempts in all. The step gains evidence {generation: spreedly-hosted | spreedly-iframe-v1, number_frame_id, cvv_frame_id, ready_wait_ms, attempts}; its detail is unchanged. card_fields_filled now fails by name, with no order submitted, in three cases: when more than one number or CVV iframe matches or the two generations mix (Playwright previously raised a strict-mode violation); when next-loading-spreedly is still set after 15s, meaning the card script never finished loading; and when the fields still do not hold the typed card after 3 attempts (the error gives the digit counts and last four of the number). No verdict field or flag changes; spreedly_tokenized still reads the core.spreedly.com payment_methods request, which 0.4.41 still makes. Pages pinned to 0.4.40 or earlier run as before, plus the readiness wait and the read-back.",
+      "compatibility": "additive",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "The typed-card step names both card-field generations (Spreedly iFrame fields on SDK 0.4.40 and earlier, the Spreedly-hosted fields NEXT payments.29next.com script mounts on 0.4.41 and later), waits for next-loading-spreedly to clear before typing, and reads both fields back, retyping up to three attempts in all."
+        }
+      ],
+      "entry_sha256": "edc4fd10bfe974dd3cfd9e6a6d5f3337a483db0525f6231bf68d3e79e22ac51f"
+    },
+    {
+      "id": "RL-0240",
+      "sequence": 231,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.7",
+      "changelog_sha256": "f91240db8674ccb5f7a94f042c93b059aa4f0a138124927b391554f554cafddc",
+      "agent_impact": "doctor --built with --base-url adds a ready line saying the local built files were checked and the URL was not fetched (it only fills deploy.preview_url in the minimal Build Packet), names qa run --site <repo> --base-url <url> --family <family> --browser for the served pages, and sets derived.base_url { value, fetched: false, recorded_as: deploy.preview_url } in JSON. Do not report a doctor --built result as a check of a preview or production site.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "doctor",
+          "summary": "The doctor --built usage line says --base-url is not fetched and fills deploy.preview_url in the minimal packet."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/inspect.mjs",
+          "surface_entry": "doctor",
+          "summary": "doctor --built with --base-url reports that only local files were checked, names qa run --site for served pages, and sets derived.base_url.fetched false."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "State that doctor --built reads local files only, that --base-url is not fetched, how to check served pages, and that the minimal packet does not drive packet QA."
+        }
+      ],
+      "entry_sha256": "6382a67f50d12ae1999b352595ff6faa13fca3e122617e9ba43ce4cc8c77e659"
+    },
+    {
+      "id": "RL-0241",
+      "sequence": 232,
+      "date": "2026-10-06",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.9",
+      "changelog_sha256": "359d517828d411f329a3fe02bb421a676652ffb2662532599e435dd0cf38a5f7",
+      "agent_impact": "When the per-target lock or the progress allocation lock cannot be taken because a file, a symbolic link, or a directory with no owner record that holds other entries sits at the lock path, the refusal names what is there and says it is never removed automatically. Report it as an obstruction to move out of the way, not as a busy or ownerless lock. The holder of a lock also removes staging and released siblings whose recorded owner process no longer exists.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/design-source-package.md",
+          "surface_entry": "docs/design-source-package.md",
+          "summary": "Say that a non-lock entry at the target lock path is named and never removed, and that the holder removes lock siblings left by dead processes."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/progress-snapshots.md",
+          "surface_entry": "docs/progress-snapshots.md",
+          "summary": "Say that a file or other non-lock entry at the allocation lock path is named in the warning and never removed."
+        }
+      ],
+      "entry_sha256": "82debb74a4998923dd9cfb3bea6ed486ba408860001fe79c6dc2460de026bb4a"
+    },
+    {
+      "id": "RL-0244",
+      "sequence": 233,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.53.0+agent.10",
+      "changelog_sha256": "7b0402af57d09ba68a5ca4fc1b8e9044eafa8f2b8a3d921bf26c6803958126db",
+      "agent_impact": "The vendored starter catalog and the SDK attribute index now describe Campaign Cart SDK 0.4.41. A certified family is verified against 0.4.41, so a missing SDK pin is reported against that version. built_output.sdk_markup accepts the 0.4.41 address block, data-next-i18n and phone attributes and reports sdk_attribute_index_version 0.4.41; built_output.cart_placeholders checks pages pinned to 0.4.41 instead of reporting them unexercised. Read a WRONG_FIELD_NAME finding as naming the 0.4.41 field set, which is the same as 0.4.38 plus the version-gated aliases.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "Say the vendored checkout field names are taken at SDK v0.4.41."
+        }
+      ],
+      "entry_sha256": "41994901ffbce1dbdf74e020465ba9622ed062cb310b6021265fe848ae12a559"
+    },
+    {
+      "id": "RL-0245",
+      "sequence": 234,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": "1.54.0",
+      "changelog_section": "1.54.0",
+      "changelog_sha256": "60ec528377c8a9f14165cfd7d6e09a4e7933c65cd53c6ca3fe8f74ff7acbe91d",
+      "agent_impact": "Surface 1.54.0. Ships 1.53.0+agent.1 through +agent.11, including qa run --test-order typing card fields on Campaign Cart SDK 0.4.41 and the starter catalog, SDK attribute index and support policy at 0.4.41. New subcommand sdk repin --target <static-repo> [--target-sdk <x.y.z>] [--apply] [--json] replaces the hand-run sed step when bumping the Campaign Cart SDK in a static campaign repo (no _data/campaigns.json). It rewrites only the version segment of semver-pinned (@vX.Y.Z or @X.Y.Z) loader.js and campaign-cart.css URLs below the target, the same references standardize lists under sdk_loader.references; @latest, @main, commit and prerelease refs and pins at or above the target are reported in left_alone and never rewritten. The target defaults to the SDK support policy's preferred_minimum. Preview is the default and writes nothing; --apply writes the files and the change record .campaign-runtime/sdk-repin.json (schema campaigns-os-sdk-repin/v0: files_touched, reference_count, from_versions, to_version, rewrites, left_alone), whose path and sha256 the --json result gives for a Run Record to cite. A second run reports nothing_to_change and writes nothing. A page-kit repo is refused with exit 2 (status refused_page_kit); use page-kit sync there. After --apply, run browser QA against the new pin: repin does not prove the SDK works. qa run keeps the verdict local by default when the base URL (from --base-url or the packet's deploy.preview_url) is a local address (localhost or *.localhost, any 127.x.x.x, 0.0.0.0, [::1] or an IPv4-mapped loopback), for saved-Map and local-spec runs alike; publish_decision.reason reads loopback_base_url and the output names qa publish and --post-verdict. An agent that wants a local-address verdict on the Map's QA tab passes --post-verdict or runs qa publish afterwards. Remote base URLs publish as before. record deploy now binds stages.deploy to the build it probed (source_build_fingerprint). After a record build of different output, a stamped deploy reads required and next names deploy before QA: serve the new build and run record deploy again. A byte-identical rebuild keeps the deploy current, and a deploy recorded before this change, with no stamp, is kept as recorded.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "compatibility_policy",
+          "path": "compatibility.json",
+          "surface_entry": null,
+          "summary": "Advance the declared version to 1.54.0."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/effects.v1.json",
+          "surface_entry": "contracts/effects.v1.json",
+          "summary": "Declare sdk repin (tier none) and sdk repin --apply (tier B: the rewritten files, the change record and the lifecycle journal), and add --apply to the effect-changing flags; on the eight qa run rows, name the local-address default in the verdict send's condition and record it unobserved under the 127.0.0.1 offline fixture (#486), with qa publish as the proof of that send; state that record deploy stamps the build fingerprint it probed, and that record build makes a completed deploy stamped with other output required."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Advance surface_version to 1.54.0 and record the effects contract and Assembly Report schema hashes."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "sdk",
+          "summary": "Add the sdk repin subcommand and its usage line: rewrite semver-pinned Campaign Cart loader and stylesheet URLs below the target in a static repo, preview by default, --apply writes the files and the campaigns-os-sdk-repin/v0 change record, --target-sdk overrides the policy target, a page-kit repo is refused with exit 2; the record deploy usage line says the deploy stage carries the build fingerprint it probed and is required again after a record build of other output."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "docs/supported-surface.md",
+          "surface_entry": "docs/supported-surface.md",
+          "summary": "Add the sdk repin row."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/sdk-storage-compatibility.md",
+          "surface_entry": "docs/sdk-storage-compatibility.md",
+          "summary": "Document sdk repin as the pin-rewrite step after the storage check for static repos: which references it rewrites and leaves alone, the preview and --apply modes, the change record, and the page-kit refusal."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/effects.md",
+          "surface_entry": "docs/effects.md",
+          "summary": "List the sdk repin preview among the read-only invocations and --apply among the effect-changing flags."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/campaign-standardization-report.md",
+          "surface_entry": "docs/campaign-standardization-report.md",
+          "summary": "Point from sdk_loader.references to sdk repin for static repos."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "Describe the local-address default and how to publish such a verdict; the local proof steps say record deploy is bound to the build it probed and is owed again after a record build of other output."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/local-setup.md",
+          "surface_entry": "docs/local-setup.md",
+          "summary": "Pin the 1.54.0 package in the local setup install command."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Use the current 1.54.0+skills.1 bundle in executable examples."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Advance the package version to 1.54.0."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": "skills.json",
+          "summary": "Advance the bundled skill revision to 1.54.0+skills.1 and each skill version one patch."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.1 bundle revision."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate at surface 1.54.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate at surface 1.54.0."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Advance the package version to 1.54.0."
+        },
+        {
+          "class": "schema",
+          "path": "schemas/campaign-runtime-assembly-report.v0.schema.json",
+          "surface_entry": "schemas/campaign-runtime-assembly-report.v0.schema.json",
+          "summary": "Describe source_build_fingerprint on a stage, which stages.deploy now carries: the build fingerprint record deploy probed."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "The record build and record deploy rows say deploy is stamped with the build it probed and reset to required by a record build of other output; an unstamped deploy is kept."
+        }
+      ],
+      "entry_sha256": "5ab33ca302fa671ac78c3e9b752ed7b251e756b05256f97ff75acd08c58ad5ba"
+    },
+    {
+      "id": "RL-0246",
+      "sequence": 235,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.54.0+agent.2",
+      "changelog_sha256": "55155add247bb47b07b43252e374b504ac85aef51f6b3315b8b21e85c615df15",
+      "agent_impact": "None for package consumers: this changes repository CI and contributor scripts only. A contributor can run npm run check:fast before pushing, or install it as a pre-push hook with npm run hooks:install; CI runs the same gates on every pull request.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "workflow",
+          "path": ".github/workflows/ci.yml",
+          "surface_entry": null,
+          "summary": "Run the unit and browser lanes as two shards each on separate runners, and cancel a pull request's older run when a newer push arrives; pushes to main are never cancelled."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Add the contributor scripts check:fast and hooks:install; exports, bin, files and dependencies are unchanged."
+        }
+      ],
+      "entry_sha256": "ea7360b560411019e58bf65a1b389cbed5ec9589b7da6f09b7cee1b08b46aed8"
+    },
+    {
+      "id": "RL-0247",
+      "sequence": 236,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.54.0+agent.4",
+      "changelog_sha256": "320b31d293424ab65875a6b05f1d1f2b79ace291914e8311e69fb52738f584b1",
+      "agent_impact": "Treat ready_with_exceptions as passing QA proof and report every exception to the operator without clearing or waiving it or changing markup just to make it pass. Keep the done closeout action. Repeat build work with record build; follow the deploy prompt for hosted deploy recording. A recorded theme waive needs --waived-by with a named human; qa run --theme-waive is one-run only. Unless the operator has already said test orders are fine for this campaign, ask once, up front, before typed-card test orders because they create real store order records, although no transaction or money movement occurs. No command, gate, flag or verdict-schema behavior changes.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "documentation",
+          "path": "CONTEXT.md",
+          "surface_entry": "CONTEXT.md",
+          "summary": "Explain that typed-card test orders create real store order records and require a once-up-front operator question."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "The done guidance names record build for repeat build work and distinguishes local-serve recording from hosted deploy instructions."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/campaigns-os-build-flow.md",
+          "surface_entry": "docs/campaigns-os-build-flow.md",
+          "summary": "Explain the real order record and once-up-front operator question before typed-card test orders."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "Explain the real store order record and the once-up-front operator question before test orders."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Publish the 1.54.0+skills.2 bundle revision."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Name the recorded theme waiver with the named-human argument and distinguish the one-run ephemeral QA form."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "next",
+          "summary": "Clarify passing QA exceptions, stage re-recording, recorded versus ephemeral theme waivers, and the test-order operator question in prompts and notices."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/next-step.mjs",
+          "surface_entry": "next",
+          "summary": "Keep the done closeout action alongside the passing-QA exception report instruction."
+        }
+      ],
+      "entry_sha256": "05712ef5b61b5e84a2937c2528612206dffde439f2929bb853bd72c015538514"
+    },
+    {
+      "id": "RL-0248",
+      "sequence": 237,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.54.0+agent.5",
+      "changelog_sha256": "b76dfa416d6d20c2ec5e9c94802e2b811ba7133bf248e9430c283f06e3882398",
+      "agent_impact": "qa run --test-order now drives a bundle-card checkout by each card's data-next-bundle-items. --select-package <pkg>:<qty> and --cart <pkg>:<qty> select the card one of whose declared items is that package at that quantity, preferring a card that declares it alone, even when no inner node repeats the package id; a kit card declaring several items is found by any of them. --cart reads the cards again before each ref. Beside --select-package, --cart never clicks another card in the chosen card's selector group (bundle or plain package cards; a card in no recognised selector container counts as in that group): a ref the chosen card carries is left alone, a ref an order bump or a card in another selector group carries is applied through that control, and any other ref is left unapplied and named in the selected_bundle detail as '--cart <ref:qty> not applied: <reason>'. Read that note as a conflict between the two flags; the order and its reconciliation are those of the card --select-package chose. The browser-order-display-parity row reconciles against the packages and quantities every selected bundle card declares, not its data-next-bundle-id, and, without --select-package, fails when an explicit --cart <ref:qty> is not in the order at that quantity, naming requested and persisted units or saying the order carries no line for the package. Read a failing row whose message says the ordered quantity differs from the request as a wrong-tier order, not a stray charge.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "Say that --select-package and --cart resolve a bundle card by any one of its data-next-bundle-items, that --cart reads the cards again before each ref, that --cart beside --select-package never clicks another card in the chosen card's selector group (a card in no recognised selector container counts as in it) and names a ref it leaves unapplied, and that display parity reconciles against every selected card's declared packages and, without --select-package, fails on an explicit --cart <ref:qty> the order did not carry at that quantity."
+        }
+      ],
+      "entry_sha256": "dbb47405a3d96886de22e8ad85dcf9a703da0ef122eccb33b6c64ecb66ea4b38"
+    },
+    {
+      "id": "RL-0249",
+      "sequence": 238,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.54.0+agent.6",
+      "changelog_sha256": "e49fec365f247824e1af1863ce8124a8ec62dbda64c8c94c68fc7734b83833f0",
+      "agent_impact": "Doctor blocks receipt order lines hidden by cart state, including when the CampaignSpec alone identifies the receipt page. When the Build Packet or CampaignSpec supplies the campaign API key directly, or Build Packet campaign.api_key_source names an environment variable, doctor compares it with built keys even when all pages agree. Correct these findings before test orders.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/checks.mjs",
+          "surface_entry": "doctor",
+          "summary": "Block receipt order items hidden by cart-state visibility and compare built API keys with the packet, spec, or environment key declared by the packet."
+        }
+      ],
+      "entry_sha256": "b56a454c0160f664fd473cbc834146630c207885c2cbf5c2c8e37d294208da4e"
+    },
+    {
+      "id": "RL-0250",
+      "sequence": 239,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.54.0+agent.7",
+      "changelog_sha256": "8c43339dac5e7fc33ad1bdff344c5db50b2e7b7f8a5d7b631f309676d70e79ce",
+      "agent_impact": "qa run takes --currency <code> to run QA in one currency of a multi-currency campaign: the run adds ?currency=<CODE> to each funnel entry URL it fetches and loads and to the first page load of each test-order path, keeping the existing query; later loads in that tab and a receipt reload carry none, because Campaign Cart keeps the currency for the tab's session. The code must be three letters and is upper-cased; anything else, an empty value included, is refused before any request. The flag takes one code per run (given twice, the last is used): run qa run once per currency. qa parity --currency, and --currency with --legacy-api-test-order, are refused. Read the run currency from evidence.currency on the entry page http:<page_id> assertion of the full verdict; the stored verdict removes URL queries. An entry URL that does not parse carries evidence.currency_not_applied with the reason instead. A run without the flag is unchanged.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "qa",
+          "summary": "The qa run usage line lists --currency <code>; keep the existing QA recommendation command set while next routes owed Polish and QA stages; show an open adapter-decision template in the build prompt and document the single-list behavior, local proof environment, and build fingerprint source in help."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "Describe qa run --currency: one code per run, ?currency=<CODE> on the entry URL and on each test-order path's first load with the existing query kept, the three-letter refusal, the qa parity and legacy-order refusals, and evidence.currency (or evidence.currency_not_applied) on the entry page http row."
+        }
+      ],
+      "entry_sha256": "ca7d3c91091fd6c5c857820ffe3ea6b9a62a9f428c0eab26cbf0b1df098fc942"
+    },
+    {
+      "id": "RL-0251",
+      "sequence": 240,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.54.0+agent.8",
+      "changelog_sha256": "57049338b1514529ff826c0477082d1f9e31de77f0a1308473ab0d7cafb8c01b",
+      "agent_impact": "Next asks for Polish when a local preview theme waiver or changed build leaves it owed, and asks for QA again when the last recorded QA build differs from the current output. A packet preview URL does not replace record deploy. Help invocations never journal, and later start is valid re-intake. Follow next before recording downstream work.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/next-step.mjs",
+          "surface_entry": "next",
+          "summary": "Pick Polish after a local theme waiver or rebuild, and re-owe QA for a different build while still requiring recorded deploy."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "Explain the deploy record and QA order after a changed build; list recordable values, explain wrapper_policy intake and read precedence, and document one-list behavior and the report-only write."
+        }
+      ],
+      "entry_sha256": "7ffb028e273e591d224628ceea618df57233286a273e7813ec3a1fb0e47479c4"
+    },
+    {
+      "id": "RL-0252",
+      "sequence": 241,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.54.0+agent.9",
+      "changelog_sha256": "14a10e9c78458f100c075cff330d5a72364dcd5b00c720a3bf5809843269f542",
+      "agent_impact": "After a page-kit build, record the true scalar adapter choices in one record build --adapter-decision list; a repeated flag keeps only the last list. wrapper_policy remains an intake choice. Doctor reads the effective report, context, then packet conversion status for leftover wrappers and its adapter warnings name the recording command. The Build Packet and Build Context are not written by record build.",
+      "compatibility": "additive",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/checks.mjs",
+          "surface_entry": "doctor",
+          "summary": "Check leftover source document wrappers against the effective report, context, then packet conversion status."
+        }
+      ],
+      "entry_sha256": "2604e105b3c308004f617b3fd839acc01f32e75dbe4ebf28324f23569aebc5db"
+    },
+    {
+      "id": "RL-0253",
+      "sequence": 242,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.54.0+agent.10",
+      "changelog_sha256": "c693a2482b40ae5bc570dc591927fc60c2193d339a2c36df8489c885d0028fdd",
+      "agent_impact": "Theme inspection excludes decorative selector subjects from primary and CTA selection while keeping the primary and CTA matching used on main. An accent-only CTA fallback asks the operator to confirm its colour.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/brand-theme-bridge.md",
+          "surface_entry": "docs/brand-theme-bridge.md",
+          "summary": "Explain decorative subject exclusions, main-compatible primary and CTA matching, and the accent-only fallback warning."
+        }
+      ],
+      "entry_sha256": "446b7cc41c5af2352fecedebc543e9bb38a31b025afe2b60848d912e615f902b"
+    },
+    {
+      "id": "RL-0254",
+      "sequence": 243,
+      "date": "2026-10-07",
+      "kind": "release",
+      "surface_version": "1.55.0",
+      "changelog_section": "1.55.0",
+      "changelog_sha256": "cfd5709d45e917e8e4ee92e42b8ceb09d560c9fbf023ca4c6552a55874877e7b",
+      "agent_impact": "Run Records carry QA publish reason, closing path, QA verdict/build binding, prompt wait, bounded doctor/QA codes, and separate needs-input/failure invocation counts. Legacy journal entries keep wait unknown. Agent usage input is gone. Re-emitting a record with agent_usage replaces it with a fresh record without carrying its prior remit state; qa publish posts but cannot stamp that older record as published.",
+      "compatibility": "breaking",
+      "migration": "Stop passing agent usage flags. Re-emitting a legacy agent_usage record replaces it and drops its prior remit state; qa publish posts but cannot stamp it.",
+      "changes": [
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Advance surface_version to 1.55.0 and record the Run Record schema hash, including lifecycle telemetry fields."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/effects.md",
+          "surface_entry": "docs/effects.md",
+          "summary": "Remove the obsolete agent usage flag validation description."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/qa-and-test-orders.md",
+          "surface_entry": "docs/qa-and-test-orders.md",
+          "summary": "Name the nullable QA publish decision reason in the Run Record."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "docs/supported-surface.md",
+          "surface_entry": "docs/supported-surface.md",
+          "summary": "Mark 1.55.0 breaking: add publish, closeout, QA observation, lifecycle stage wait and finding-code, and run-level exit-count fields; remove agent_usage."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/workflow-findings-sidecar.md",
+          "surface_entry": "docs/workflow-findings-sidecar.md",
+          "summary": "Document the publish reason, closing path, QA verdict/build binding, prompt wait, code sources, and exit buckets."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Advance the package version to 1.55.0."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Advance the package version to 1.55.0 with exports unchanged."
+        },
+        {
+          "class": "schema",
+          "path": "schemas/campaigns-os-run-record.v0.schema.json",
+          "surface_entry": "schemas/campaigns-os-run-record.v0.schema.json",
+          "summary": "Add optional QA publish, closeout, and currency fields plus lifecycle wait, finding codes, and exit buckets; remove agent_usage."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": "run-record",
+          "summary": "Pass each closer through internal options, route prompt wait and finding codes to lifecycle capture, and remove agent usage flags."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate at surface 1.55.0."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate at surface 1.55.0."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "compatibility.json",
+          "surface_entry": null,
+          "summary": "Advance the declared version to 1.55.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/local-setup.md",
+          "surface_entry": "docs/local-setup.md",
+          "summary": "Pin the 1.55.0 package in the local setup install command."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": null,
+          "summary": "Advance bundle_revision to 1.55.0+skills.1 and the patch version of each restamped skill."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Restamp to skills bundle 1.55.0+skills.1."
+        }
+      ],
+      "entry_sha256": "cdd823b095d9a05eb39d751c20396d25303dcc00dc1a2c12baeb15ac580e6819"
     }
   ]
 }