@orkestrel/scaffold 0.0.39 → 0.0.40

package/dist/host/agents/orchestration.md

@@ -688,6 +688,29 @@ and propagates as files rather than as a cascade.
   target. Scope a fleet-wide refactor to the files each target owns, and record the vendored
   exclusion in the brief rather than letting each unit rediscover it.
 
+### The release wave
+
+Close a fleet-wide "everything on latest" goal as a release wave in layer order: visit every repo
+once per round with one procedure, publish each layer in one window, and only then prepare the next.
+
+- The visit, in order: re-pin the target's `@orkestrel/scaffold` devDependency and install, so the
+  overwrite runs the current vendored host; `scaffold overwrite`; force-verify every `@orkestrel`
+  range against a registry sweep taken after the previous layer published; full install; mutating
+  `format` to converge generated writes; the five gates; the material-dist comparison against the
+  published tarball.
+- Bump on either trigger: the rebuilt dist differs materially from the published tarball, or the
+  final runtime dependency set differs from the published packument. Test the final set against the
+  packument, never "did my step move a pin" — overwrite's `declare` re-pins before any later check,
+  so the step-local reading reports nothing moved while the manifest surface did. A re-pinned
+  runtime range is published surface: without the bump a consumer installs two copies of the moved
+  dependency.
+- A dist built before the version bump is the release artifact; the bump edits no emitted byte.
+- Refresh the registry evidence between layers and derive each round's pins from it. A pin can only
+  name a version the registry already serves, so a dependency shipping in the same window keeps the
+  resolvable previous pin and takes its dev-only re-pin after the window closes.
+- Run visits in parallel slices of disjoint repos, each slice strictly serial inside itself,
+  reporting per-target. Refuse a failed target, name it, repair, and re-run it alone.
+
 ### Preparing
 
 1. **Bump from what the registry serves, not from the local manifest.** A repository's `version`
@@ -745,8 +768,16 @@ flag is what stops the gate chain running a second time inside the five minutes.
 
 ### Spending the window
 
-- The window opens when the user approves, not when the first publish starts. Chain every remaining
-  publish inside the same process as the gate package, so no human turn sits inside it.
+- The window opens when the user approves, not when the first publish starts. Open each layer with
+  one package: publish it alone, surface its approval URL the moment the journal shows it, and
+  confirm the upload from the registry before starting the rest. Then chase the remaining uploads
+  back-to-back in one process with no gap — an upload started within seconds of an approval
+  frequently rides that approval, and each one that does not mints its own URL. Relay every new URL
+  to the user the moment it appears, through a journal watcher, and never pause the chain to wait
+  for a click: a poll outlives the relay.
+- A click on a superseded URL poisons the live attempt — the current poll fails
+  `403 Forbidden - GET /-/v1/done` mid-flight. Tell the user to click only the newest URL. After
+  any such 403, confirm no publish process is live, then mint one fresh attempt.
 - Publish serially. Concurrent publishes collide on the auth handshake and fail each other.
 - **Never retry a publish that is still waiting for its authorization.** Each `npm publish` attempt
   mints a new `authId` and invalidates the previous one, so a retry loop makes the URL a moving

package/dist/src/core/index.cjs

@@ -305,7 +305,7 @@ var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
 /** The tooling versions scaffold and every generated workspace share. */
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@orkestrel/guide": "^0.0.12",
-	"@orkestrel/scaffold": "^0.0.39",
+	"@orkestrel/scaffold": "^0.0.40",
 	"@orkestrel/test": "^0.0.6",
 	"@types/node": "^26.2.0",
 	oxfmt: "^0.62.0",