@nextcommerce/campaigns-os 1.59.0 → 1.60.0

package/contracts/release-ledger.json

@@ -8108,6 +8108,549 @@
         }
       ],
       "entry_sha256": "54697c8b2c8e0857687a01f4ac43942202f8e6f9a523fc1151070ac890a0133d"
+    },
+    {
+      "id": "RL-0273",
+      "sequence": 259,
+      "date": "2026-10-14",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.59.0+agent.4",
+      "changelog_sha256": "4bfd26f73f0eb599a40cb5fb338653d4fdf511f45ccd0ec291ba67d402c30086",
+      "agent_impact": "When a campaign is set up in the Campaigns App dashboard, expect one package per variant, created by saving an Offer that selects it, and a separate Offer per Buy 1/2/3 tier. The dashboard labels packages Products; pages still reference package IDs. Quickstart and the build-flow commerce section both describe this Create Campaign then Add Offer setup, and that Admin API setups still create packages before Offers.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/campaigns-os-build-flow.md",
+          "surface_entry": "docs/campaigns-os-build-flow.md",
+          "summary": "Describe how the dashboard creates packages from Offers under Commerce Ownership."
+        }
+      ],
+      "entry_sha256": "b0708e5f1d10142d56f4cbc5d346053b89073bc65cb6c69b41afff432908e103"
+    },
+    {
+      "id": "RL-0271",
+      "sequence": 260,
+      "date": "2026-10-15",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.59.0+agent.5",
+      "changelog_sha256": "64d75e58cefd497559d4fb0b30817f6d123bfc211ccb461e1c6dbf0b62eb107b",
+      "agent_impact": "On a hosted all-template preview, follow next: record deploy --base-url <preview url>, then qa run, then closeout. The hosted preview URL no longer satisfies the deploy stage on its own (since 1.59.0), and the polish skill, docs and README now say so. A forced next deploy or next qa with an unset, loopback or production-equivalent preview URL prompts for qa policy set --preview-url, matching next actions and doctor. Refresh bundled skills to 1.59.0+skills.2.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "Drop the leftover statement that the hosted all-template preview satisfies the deploy step; QA follows record deploy."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Show the current 1.59.0+skills.2 bundle identity in preflight examples."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": "skills.json",
+          "summary": "Advance the bundle to 1.59.0+skills.2 and each bundled skill by one patch."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Hand the hosted all-template preview to next: record deploy, then QA, then closeout."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.2."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.2."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.2."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.2."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.2."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.2."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.2."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.2."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": null,
+          "summary": "The deploy and QA prompts on an all-template hosted packet use the usable-preview rule next actions and doctor use; the done prompt names record deploy for both deploy targets."
+        }
+      ],
+      "entry_sha256": "2bad692257bfa5a2a5718b1861d1da60ae92c3a4cd23151d659c3867b308c839"
+    },
+    {
+      "id": "RL-0272",
+      "sequence": 261,
+      "date": "2026-10-15",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.59.0+agent.7",
+      "changelog_sha256": "766c499fdb0ce69edf48f40f611ffd532a8789665a64208908491b68e0afa70b",
+      "agent_impact": "run status --json now always reports progress.next_command as `campaigns-os next --packet <packet> --json`; it no longer names `run end` when every recorded stage status is terminal, because a stage an input change or a new build owes again still records completed. Follow next, which names `run end` as a required action once the campaign is done and a run session is active. next and doctor output is unchanged.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": null,
+          "summary": "run status names next as the next command; next returns the prepare-build recovery answer from one branch and reads the shared readiness ladder."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/inspect.mjs",
+          "surface_entry": "doctor",
+          "summary": "Doctor's status reads the shared readiness ladder; its output is unchanged."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/next-step.mjs",
+          "surface_entry": "doctor",
+          "summary": "Export the readiness ladder that doctor and next share and drop the stage picker's unused packet parameter; output is unchanged."
+        }
+      ],
+      "entry_sha256": "6182da2e9bf076b2baceb3303518bfed33c3c8cb6ac72cddce70066a490b88c1"
+    },
+    {
+      "id": "RL-0274",
+      "sequence": 262,
+      "date": "2026-10-19",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.59.0+agent.8",
+      "changelog_sha256": "a2a97f2d4650f02eecb11398dc05f500f7aaef9a52271825b663009d5cd94ace",
+      "agent_impact": "On a target with next-campaign-page-kit 0.3.0, read doctor's built_output.build_asset_warning: each one names an .html file under assets/ that page-kit neither built nor copied, so a link or iframe to it 404s. Move the file out of assets/ if it is a page, or remove it. On 0.3.0, spec derive and doctor's built-page lookup no longer bind a page to an .html file under the campaign's top-level assets/; 0.2.x targets read as before. New folders install next-campaign-page-kit@0.3.0 from docs/local-setup.md. Refresh bundled skills to 1.59.0+skills.3.",
+      "compatibility": "additive",
+      "migration": "After the first build on page-kit 0.3.0, run record build again: the build fingerprint can change with unchanged source (0.3.0 removes stale _site/<slug>/ output and no longer copies .html under assets/), and polish, deploy and QA are owed again for the new build.",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "Say that unpruned _site/ output and an assets/ index.html built as a page are page-kit 0.2.x behaviour, and that 0.3.0 cleans _site/<slug>/ and reports ASSET_IGNORED; the stray_files gate is unchanged."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/local-setup.md",
+          "surface_entry": "docs/local-setup.md",
+          "summary": "Pin the new-folder page-kit install to next-campaign-page-kit@0.3.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Show the current 1.59.0+skills.3 bundle identity in preflight examples."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": "skills.json",
+          "summary": "Advance the bundle to 1.59.0+skills.3 and each bundled skill by one patch."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Name the build summary's assetWarnings and ASSET_IGNORED on page-kit 0.3.0, and what to do with an ignored HTML file under assets/."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.3."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.3."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.3."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.3."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.3."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.3."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.3."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.3."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/cli.mjs",
+          "surface_entry": null,
+          "summary": "spec derive skips .html under the campaign's top-level assets/ when the target's installed page-kit is 0.3.0 or later; the build prompt names assetWarnings and ASSET_IGNORED."
+        },
+        {
+          "class": "cli_surface",
+          "path": "src/doctor/checks.mjs",
+          "surface_entry": "doctor",
+          "summary": "Doctor reports each build summary assetWarnings entry for the campaign as the non-blocking built_output.build_asset_warning, and on page-kit 0.3.0 or later reads no source permalink from a file under assets/."
+        }
+      ],
+      "entry_sha256": "2127a7133126fd80e7c519f484184463d44b0f1b655350184525b19d76cf979e"
+    },
+    {
+      "id": "RL-0275",
+      "sequence": 263,
+      "date": "2026-10-19",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.59.0+agent.10",
+      "changelog_sha256": "a2cc415ae5174c3381b505e8109ce9a30f042593d7e89ac9b25ad2910a0f0092",
+      "agent_impact": "None expected: the lockfile resolves Playwright 1.64.1 and acorn 8.19.0 within the ranges package.json already declares. Browser QA and polish capture run on Playwright 1.64.1; doctor's script syntax check parses with acorn 8.19.0.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Resolve Playwright 1.64.1 and acorn 8.19.0."
+        }
+      ],
+      "entry_sha256": "b0d2fbd5618d4fc635b346ae521085a77e0ac552e67e8f94a9c5ced7049f237b"
+    },
+    {
+      "id": "RL-0276",
+      "sequence": 264,
+      "date": "2026-10-19",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.59.0+agent.11",
+      "changelog_sha256": "bbde8ee78d523076a4011ba71cd6674bbc305aa03219c1ba2dd37c6d0fc5ee78",
+      "agent_impact": "None for package consumers: this changes repository CI only (add-to-project and publish workflow action versions).",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "workflow",
+          "path": ".github/workflows/add-to-project.yml",
+          "surface_entry": null,
+          "summary": "Move actions/create-github-app-token to 3.3.0."
+        },
+        {
+          "class": "workflow",
+          "path": ".github/workflows/publish.yml",
+          "surface_entry": null,
+          "summary": "Move actions/upload-artifact to 7.0.2 and actions/download-artifact to 8.0.2."
+        }
+      ],
+      "entry_sha256": "dbca912d6c5145cb494f83fe7c334bec6e978bf00f6146c2a7eeb2d706f7cb96"
+    },
+    {
+      "id": "RL-0277",
+      "sequence": 265,
+      "date": "2026-10-19",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.59.0+agent.12",
+      "changelog_sha256": "2bd2f6b05e609f8348165e737efc5628af764594fb6cd34b8c0b067a1d08ce6e",
+      "agent_impact": "Refresh bundled skills to 1.59.0+skills.4. For a Campaign Cart 0.4.x to later 0.4.x bump, follow next-campaigns-sdk-bump: it finds hard-coded loader pins as well as sdk_version, scopes sdk repin to the funnel folder, runs sdk storage-check with the target tag's manifest, then doctor and preview test orders under the existing approval rule, and reports what is not proven. It stops at a 0.3.x pin or the legacy Campaigns script.",
+      "compatibility": "additive",
+      "migration": "Run install-skills to install next-campaigns-sdk-bump and the refreshed bundle, then start a fresh agent session.",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Show the current 1.59.0+skills.4 bundle identity in preflight examples."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": "skills.json",
+          "summary": "Add next-campaigns-sdk-bump 1.0.0, advance the bundle to 1.59.0+skills.4 and each other bundled skill by one patch."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-sdk-bump/SKILL.md",
+          "surface_entry": null,
+          "summary": "New skill: a 0.4.x to later 0.4.x Campaign Cart bump on a page-kit or static repo, from pins through storage check, doctor, preview test orders and hand-back."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.4."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.4."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.4."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.4."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.4."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.4."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.4."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.4."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.59.0+skills.4."
+        }
+      ],
+      "entry_sha256": "f258fb6a51dfb20ab1b4eb71dd18fdc224ce6ee553ca3653be5efa581e644655"
+    },
+    {
+      "id": "RL-0278",
+      "sequence": 266,
+      "date": "2026-10-19",
+      "kind": "release",
+      "surface_version": null,
+      "changelog_section": "1.59.0+agent.13",
+      "changelog_sha256": "0e1ce83cf5555290a681ff08d83a03a1e4210aca22b8d349a9af26022513f241",
+      "agent_impact": "After a CampaignSpec-only change, when the operator records build with --deviation-reason over the same output a completed Polish reviewed, Polish reads current again and next moves on toward QA; do not retake Polish captures for that unchanged build. QA is still owed for the changed CampaignSpec. A brief presentation change, a different build, or a build recorded without the deviation reason still owes Polish.",
+      "compatibility": "compatible",
+      "migration": "none",
+      "changes": [
+        {
+          "class": "named_surface",
+          "path": "docs/build-packet.md",
+          "surface_entry": "docs/build-packet.md",
+          "summary": "Name the exception: a deviation-recorded build of the output a completed Polish reviewed restores that Polish after a CampaignSpec-only change."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/campaign-build-brief.md",
+          "surface_entry": "docs/campaign-build-brief.md",
+          "summary": "Say that a CampaignSpec-only change kept with record build --deviation-reason keeps Polish, and that a presentation change still owes it."
+        }
+      ],
+      "entry_sha256": "8f05d402dfed44c9c94136551ea1aa97aecf3850346484a8f3f3a4d6540052f2"
+    },
+    {
+      "id": "RL-0279",
+      "sequence": 267,
+      "date": "2026-10-20",
+      "kind": "release",
+      "surface_version": "1.60.0",
+      "changelog_section": "1.60.0",
+      "changelog_sha256": "9d37d356a3ffaa2f44c66f14c643bae9dbee69bce507db6076dfa0aa92110106",
+      "agent_impact": "The 1.60.0 package publishes the ten same-surface changes since 1.59.0 (agent.4 to agent.13). Consumers gain the next-campaigns-sdk-bump skill (with the fixes from its first live bump), page-kit 0.3.0 support with asset warnings, the 3987b18 starter catalog, QA build binding and run status fixes, and Polish carry-over after a spec-only change; refresh the bundled skills to 1.60.0+skills.1.",
+      "compatibility": "additive",
+      "migration": "From the published 1.59.0, update the pinned package and run install-skills to get 1.60.0+skills.1, including next-campaigns-sdk-bump. After the first build on page-kit 0.3.0, run record build again: the build fingerprint can change with unchanged source, so Polish, deploy and QA are owed again.",
+      "changes": [
+        {
+          "class": "compatibility_policy",
+          "path": "compatibility.json",
+          "surface_entry": "compatibility.json",
+          "summary": "Name 1.60.0 as the published package version."
+        },
+        {
+          "class": "compatibility_policy",
+          "path": "contracts/supported-surface.json",
+          "surface_entry": "contracts/supported-surface.json",
+          "summary": "Advance surface_version to 1.60.0 for the package release."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/local-setup.md",
+          "surface_entry": "docs/local-setup.md",
+          "summary": "Pin the documented toolkit install to 1.60.0."
+        },
+        {
+          "class": "documentation",
+          "path": "docs/orientation-contract-reference.md",
+          "surface_entry": "docs/orientation-contract-reference.md",
+          "summary": "Regenerate the orientation reference at surface 1.60.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/runtime-readiness.md",
+          "surface_entry": "docs/runtime-readiness.md",
+          "summary": "Regenerate runtime readiness at surface 1.60.0."
+        },
+        {
+          "class": "named_surface",
+          "path": "docs/skills-revision.md",
+          "surface_entry": "docs/skills-revision.md",
+          "summary": "Show the current 1.60.0+skills.1 bundle identity in preflight examples."
+        },
+        {
+          "class": "generated_runtime",
+          "path": "package-lock.json",
+          "surface_entry": null,
+          "summary": "Advance both package version stamps to 1.60.0."
+        },
+        {
+          "class": "package_export",
+          "path": "package.json",
+          "surface_entry": null,
+          "summary": "Advance the package version to 1.60.0."
+        },
+        {
+          "class": "skill",
+          "path": "skills.json",
+          "surface_entry": "skills.json",
+          "summary": "Advance the bundle to 1.60.0+skills.1 and each bundled skill by one patch."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-lifecycle-orientation/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.60.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-readback-classification/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.60.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/campaign-run-evidence/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.60.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/contribution-intake/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.60.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-build/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.60.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os-setup/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.60.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-os/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.60.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-polish/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.60.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-qa/SKILL.md",
+          "surface_entry": null,
+          "summary": "Bump the skill one patch and stamp bundle 1.60.0+skills.1."
+        },
+        {
+          "class": "skill",
+          "path": "skills/next-campaigns-sdk-bump/SKILL.md",
+          "surface_entry": null,
+          "summary": "Apply the first live-bump feedback (#683: removed features, next:initialized guard, legacy detection, manifest range, QA portal and qa-output) and stamp bundle 1.60.0+skills.1."
+        }
+      ],
+      "entry_sha256": "25d3db88fb7e0259e9b3a4b91244cf504d0bd99bfc815ab60393b3982927564f"
     }
   ]
 }

package/contracts/supported-surface.json

@@ -1,6 +1,6 @@
 {
   "_note": "The downstream contract manifest. Everything listed here is SUPPORTED SURFACE: consumers (campaigns-agent, campaign-builder, the private ops repo, page-kit campaign repos) may depend on it, and changing it is a deliberate act — hashed entries require a surface_version bump in the same change (check-supported-surface.mjs --base, mirroring the skills.json bump gate), named entries must keep existing at their path, cli_commands must keep resolving in the CLI dispatch, package_exports must stay exported, and every entry must ship in the npm pack (files[] coverage). Anything NOT listed here — src/** internals, scripts/** checkers, examples/**, prompts/**, contracts/** other than this file and the entries named[] below (the orientation contract, the release ledger, and the consumer-facing orientation fixtures) — is implementation: consumers may read it for context but must not build on it, and it can change without notice. Rationale and the compatibility promise: docs/supported-surface.md.",
-  "surface_version": "1.59.0",
+  "surface_version": "1.60.0",
   "package_exports": [
     "./commercial-journey",
     "./commercial-parity",

package/contracts/template-brand-contract.shared-commerce.v0.json

@@ -55,7 +55,7 @@
       },
       "asset_pin": {
         "repo": "NextCommerceCo/campaign-cart-starter-templates",
-        "sha": "d5ff501ab57aef160a7108341de8a952006a28a4",
+        "sha": "3987b18a356cb961b06c94b2035622bafe938316",
         "path": "src/<family>/assets/<asset>",
         "note": "asset_sha256 is the sha256 of each shipped starter asset at this commit (the commerce-surface-catalog _synced_from_sha pin; the bytes are identical across every family). A served asset whose bytes hash to the shipped value is the untouched starter asset and counts as residue even though its markup names no method; different bytes mean it was edited in place. check-template-doctrine verifies these hashes against the pinned checkout."
       },

package/docs/build-packet.md

@@ -788,9 +788,13 @@ One error per finding; each names the two files and the two values, so the
 repair is a one-line edit. Every built HTML file under `_site/<slug>/` is
 scanned, because every one is served. When doctor has the CampaignSpec, a
 finding that names a file no active spec page builds to says so and lists it
-under `stray_files`. Such a file is leftover output (page-kit does not prune
-`_site/`) or an HTML file copied into the source, such as a design export's
-`index.html` under `assets/`. The repair is to remove the source file if
+under `stray_files`. Such a file is leftover output or an HTML file copied
+into the source. On page-kit 0.2.x both happen: it does not prune `_site/`,
+and it builds and copies a design export's `index.html` under `assets/`. From
+0.3.0 page-kit removes `_site/<slug>/` before each build and neither builds
+nor copies `.html` under `assets/` (the build summary lists each one as
+`ASSET_IGNORED`), so a stray there is a source page no spec page claims or
+output written outside a build. The repair is to remove the source file if
 there is one, delete the built file, and rebuild and record the build again,
 not to retag it. Pages whose route contains a `-backup-` or `-old-`
 segment are parked copies: skipped and listed on the gate as `pages_skipped`,
@@ -1754,7 +1758,7 @@ own stages) → calls `next` again → repeat until stage="done"
 
 ### Refreshing after a CampaignSpec change
 
-When the CampaignSpec's material content changes, every build, Polish and QA record made against the earlier content stops counting as current, in local-spec, saved-Map and gateway packets alike. For a saved Map or gateway packet, Campaigns OS compares the copy intake fetched; it does not check whether that copy is the latest remote revision, and reports the remote as unconfirmed. Doctor warns `spec.material_stale`, and `next`, progress, readback, the Assembly Report's own status and the QA gate show the stages that are owed again; `next` routes to the first one. Run `campaigns-os record spec --packet <packet>` to bind the new content: it updates the build context and report identity, re-reads the brief file last saved (by intake or `record brief`), keeps waivers, warning accepts, the applied theme and deploy settings, and moves each superseded stage record into that stage's `history`, which is never used as current proof. `spec derive` no longer rebinds identity; run `record spec` after it. A change to the set, order or routes of active pages still needs intake. Re-recording an unchanged build after a spec change keeps the build owed, because the change has not reached the pages, unless the operator records a reason with `--deviation-reason`; this holds even when `record spec` was not run, and that `record build` also marks Polish and QA owed again. Polish stays owed until a new `polish capture`, and QA must produce a new verdict against the current content. Polish measurements of byte-identical output keep their values, but the Polish stage is owed again. These checks are tamper evidence, not proof: a hand-written record that copies the current values, or a packet pointed at an older copy of the spec, is not detected.
+When the CampaignSpec's material content changes, every build, Polish and QA record made against the earlier content stops counting as current, in local-spec, saved-Map and gateway packets alike. For a saved Map or gateway packet, Campaigns OS compares the copy intake fetched; it does not check whether that copy is the latest remote revision, and reports the remote as unconfirmed. Doctor warns `spec.material_stale`, and `next`, progress, readback, the Assembly Report's own status and the QA gate show the stages that are owed again; `next` routes to the first one. Run `campaigns-os record spec --packet <packet>` to bind the new content: it updates the build context and report identity, re-reads the brief file last saved (by intake or `record brief`), keeps waivers, warning accepts, the applied theme and deploy settings, and moves each superseded stage record into that stage's `history`, which is never used as current proof. `spec derive` no longer rebinds identity; run `record spec` after it. A change to the set, order or routes of active pages still needs intake. Re-recording an unchanged build after a spec change keeps the build owed, because the change has not reached the pages, unless the operator records a reason with `--deviation-reason`; this holds even when `record spec` was not run, and that `record build` also marks Polish and QA owed again. Polish stays owed until a new `polish capture`, with one exception: when `record build --deviation-reason` records the very output a completed Polish reviewed (same build fingerprint and source package) and only the CampaignSpec changed, not the brief's presentation, that `record build` restores the Polish record the change moved to history, stamped with the current inputs. It is the same review of the same pages. QA must produce a new verdict against the current content. Polish measurements of byte-identical output keep their values, but the Polish stage is owed again. These checks are tamper evidence, not proof: a hand-written record that copies the current values, or a packet pointed at an older copy of the spec, is not detected.
 
 The CampaignSpec's material content is the whole spec except `spec_identity`,
 `slug`, `map_id` and `saved_at`; a page `label` edit is material. A spec
@@ -1813,13 +1817,11 @@ On a hosted target, record an unset hosted preview URL with
 `campaigns-os qa policy set --packet <p> --preview-url <url>`, then record the
 deploy with `campaigns-os record deploy --packet <p> --base-url <preview url>`. The hosted preview must be a non-loopback
 HTTP(S) URL whose origin or QA-resolved campaign route path differs from `deploy.production_url`;
-query and fragment text does not make the production page a preview. With
-`deploy.preview_url` recorded, run `campaigns-os next qa --packet <p>` and
-`campaigns-os qa run --packet <p> --base-url <preview-url> --browser
---test-order common`. The recorded hosted preview satisfies the deploy step
-for this all-template shape. After QA records a verdict for the current build,
-`campaigns-os next --packet <p>` reaches closeout without a hosted deploy
-record. QA against the packet's production URL retains the strict gate.
+query and fragment text does not make the production page a preview. With the
+deploy recorded, run `campaigns-os qa run --packet <p> --base-url <preview-url>
+--browser --test-order common`; after QA records a verdict for the current
+build, `campaigns-os next --packet <p>` reaches closeout. QA against the
+packet's production URL retains the strict gate.
 
 Each command reads the same packet, Build Context and Assembly Report `next`
 reads (`--context` / `--report` override them the same way), validates what it
@@ -1882,7 +1884,7 @@ Result shape (with `--json`):
 Terminal states:
 
 - **`stage: "doctor-blocked"`** — doctor returned errors. Resolve the blockers and re-run `campaigns-os doctor` to confirm before calling `next` again.
-- **`stage: "done"`** — every stage is terminal. Pipeline is complete. To repeat build work, do the work and use `record build`; it makes downstream stages owed as needed. Use `record setup` or `record polish` after repeating those stages, and `qa run` for QA. `record deploy` records the served deploy, a loopback URL for a local-serve target or an https URL for a hosted one. Then call `next` again.
+- **`stage: "done"`** — every stage is terminal. Pipeline is complete. To repeat build work, do the work and use `record build`; it makes downstream stages owed as needed. Use `record setup` or `record polish` after repeating those stages. `record deploy` records the served deploy, a loopback URL for a local-serve target or an https URL for a hosted one. Use `qa run` for QA. Then call `next` again.
 - **`stage_blocked: true`** — the picker returned a stage whose recorded status is `blocked`. Don't run the prompt as-is; clear the blocker first.
 
 The legacy form `campaigns-os next <stage>` (e.g. `next build`) still works and is the way to force a specific stage when you want to override the picker.

package/docs/campaign-build-brief.md

@@ -64,7 +64,7 @@ A brief is prepared, where every open question blocks, only when the file sets `
 
 Saving a brief whose content is unchanged keeps all stage evidence and statuses. Reformatting, reordering keys, writing a default value explicitly, or changing only `_meta` also keeps all stage evidence and statuses; the save may rewrite the brief files. When the presentation sections change (`campaign_intent`, `design_authority`, `brand`, `media`, `offer_presentation`, `promo_urgency`, `commerce_surfaces`, `canonical_display`, `template_residue_policy`, or any section you add), build, Polish and QA are owed again. When only `qa_policy` changes, QA alone is owed again. Setup and deploy records are kept. Each affected stage records when its inputs changed. Each replaced record is kept under the stage's `history`; the last five superseded records per stage are kept, and older ones are dropped. History is display only and is never used as current proof.
 
-Recording build again over output that has not changed since the brief or CampaignSpec changed does not make the build current: `next` keeps asking for a build, because the change has not reached the pages. If the operator decides the change needs no change to the built pages, record build with `--deviation-reason "<the operator's reason>"`; the build is then recorded with a warning, and the reason is shown in `next` and the QC handoff. `--deviation-reason` is a general flag any caller can pass: Campaigns OS records the reason, but cannot tell whether the operator chose it. A CampaignSpec change that was never saved with `record spec` is recorded by the next `record build`, `record polish` or QA run, with the same effect; `record build` then also marks Polish and QA owed again. An edit to the brief file is not read until it is saved with `record brief`: until then the build reads the saved brief, and doctor warns `build_brief.input_unsaved`. The same applies after `prepare-build --force`, which now keeps stage history, archives the build, Polish and QA records it clears, and keeps the record that the inputs changed. Recording Polish again does not make it current until a new `polish capture` runs after the change. Recording Polish as skipped, with a skip reason, while it is owed is the operator's decision to skip it: the input change no longer makes Polish owed. The Polish gate still passes only a completed Polish, so `next` stays at Polish until one is recorded (see `docs/polish-evidence.md`).
+Recording build again over output that has not changed since the brief or CampaignSpec changed does not make the build current: `next` keeps asking for a build, because the change has not reached the pages. If the operator decides the change needs no change to the built pages, record build with `--deviation-reason "<the operator's reason>"`; the build is then recorded with a warning, and the reason is shown in `next` and the QC handoff. `--deviation-reason` is a general flag any caller can pass: Campaigns OS records the reason, but cannot tell whether the operator chose it. A CampaignSpec change that was never saved with `record spec` is recorded by the next `record build`, `record polish` or QA run, with the same effect; `record build` then also marks Polish and QA owed again. An edit to the brief file is not read until it is saved with `record brief`: until then the build reads the saved brief, and doctor warns `build_brief.input_unsaved`. The same applies after `prepare-build --force`, which now keeps stage history, archives the build, Polish and QA records it clears, and keeps the record that the inputs changed. Recording Polish again does not make it current until a new `polish capture` runs after the change. The exception is a CampaignSpec-only change recorded with `record build --deviation-reason` over the exact output a completed Polish reviewed: that `record build` restores the Polish record, since it reviewed the same pages. A brief presentation change still owes a new Polish. Recording Polish as skipped, with a skip reason, while it is owed is the operator's decision to skip it: the input change no longer makes Polish owed. The Polish gate still passes only a completed Polish, so `next` stays at Polish until one is recorded (see `docs/polish-evidence.md`).
 
 A build, Polish or QA record that does not say which brief and CampaignSpec content it was made against counts as unconfirmed, not current. Records made by earlier releases are unconfirmed, so after upgrading, `next` routes back to build once; record build and Polish again and run QA again. These checks are tamper evidence, not proof: a record written by hand that copies the current values or removes the record of an input change, or a packet pointed at an older copy of the spec or brief, is not detected.