@orkestrel/scaffold 0.0.63 → 0.0.64

package/dist/host/AGENTS.md

@@ -68,7 +68,7 @@ configs/  thin target wrappers around root Vite/TypeScript configuration
 - **No nested functions.** Extract function declarations and assignments from bodies. The only exceptions are an anonymous callback passed directly as an argument and an anonymous function returned directly as a result.
 - **Functional core, imperative shell.** Export pure leaves. Keep stateful or defining orchestration as class methods. Classes compose behavior; they do not forward 1:1 to helpers.
 - **No superfluous wrappers.** A wrapper must add a boundary, invariant, composition, translation, lifecycle, or materially narrower contract. Otherwise use or rename the real symbol and update every consumer.
-- **Minimal public API.** Add or substantively expand a capability with its first real consumer; do not speculate. This is a creation gate, never a later visibility gate. Once an intentional reusable capability exists, expose its top-level source exports through the correct environment barrel regardless of which consumers currently use them, so developers receive the same supported mechanisms the package uses. Remove a symbol only when the capability itself should not exist. Prefer one minimal interface and one shared engine, allowing native backend overrides only for genuine faster paths.
+- **Minimal public API.** Add or substantively expand a capability with its first real consumer; do not speculate. This is a creation gate, never a later visibility gate. Once an intentional reusable capability exists, expose its top-level source exports through the correct environment barrel regardless of which consumers use them, so developers receive the same supported mechanisms the package uses. Remove a symbol only when the capability itself must not exist. Prefer one minimal interface and one shared engine, allowing native backend overrides only for genuine faster paths.
 - **No compatibility shims.** This is greenfield. Update every consumer in the same change.
 - **Mechanism, not product policy.** Framework code supplies reusable mechanisms and stops before application decisions.
 - **No polling architecture.** Park idle work on events and abort signals. Yield long work cooperatively.
@@ -101,7 +101,7 @@ configs/  thin target wrappers around root Vite/TypeScript configuration
 7. **Document:** update the guide, examples, and parity contract.
 8. **Verify:** audit discovery, deferrals, and package contents as applicable. Run the required gates and read their actual output before claiming success.
 
-Quality gates before commit, in order. The acceptance gate is the non-mutating variant; run the mutating `lint` and then `format` first only to converge, then prove with the checks. `lint --fix` rewrites code and its output is not formatter-clean, so a `format` that ran before it leaves `format:check` failing on the file `lint` just rewrote:
+Quality gates before commit, in order. The acceptance gate is the non-mutating variant; run the mutating `lint` and then `format` first only to converge, then prove with the checks. `lint --fix` rewrites code and its output is not formatter-clean, so a `format` that ran before it leaves `format:check` failing on the file `lint` rewrote:
 
 ```text
 npm run format:check → npm run lint:check → npm run check → npm run build → npm test

package/dist/host/CLAUDE.md

@@ -53,3 +53,9 @@ follows it. This file adds only what Claude Code does differently, and cannot we
   ChatGPT approval in the browser.
 - `scripts/codex.sh` only reports readiness. It never installs, authenticates, logs out, reads the
   auth cache, or performs a model call.
+- `scripts/deps.sh` runs `npm ci --ignore-scripts` on every session start and resume whose
+  `package-lock.json` digest differs from `node_modules/.orkestrel-lock.sha256`, and a resume
+  follows every turn boundary. After a tracked command changes the lockfile in this checkout,
+  write the lockfile's SHA-256 digest to that marker in the same turn, before any unit or gate runs
+  here. A marker left stale reinstalls `node_modules` under a live suite on the next resume, and the
+  suite reports a missing package that is present a moment later.

package/dist/host/agents/orchestration.md

@@ -138,7 +138,11 @@ Fall back in this order and record the substitution:
   parallelism, independent review, or substantial context justifies it.
 - Dispatch staging, packing, gate-chain invocation, and instrument authorship as units — `builder`
   for a fully specified script, `verifier` for its evidence — each with a brief and an audit like
-  any other unit. Only the commit and the push stay with the Orchestrator.
+  any other unit. The commit and the push stay with the Orchestrator.
+- A release instrument installs, commits, or runs a mutating tree-wide command, which the
+  permission floor bars every role from, so its run is the Orchestrator's tracked command, retained
+  with its log as the authoring unit's acceptance evidence. An upload loop that must run inside a
+  one-time code's life with the user at the keyboard stays with the Orchestrator whole.
 
 ## Roles
 
@@ -265,13 +269,12 @@ edits, formatter and build races, cache phantoms, and validation cross-talk.
 6. After integration, clear shared caches if needed, then have one independent `verifier` run the
    authoritative tree-wide sweep. A writer's self-report never establishes green.
 7. The Orchestrator's own sweep is a writing dispatch and queues behind the units that own those
-   files. A script that fixes one thing across every target is the easiest way to break the
-   serialization rule,
-   because it does not feel like a dispatch — nobody was named, no brief was written, and it
-   finishes in seconds. It still writes into trees a live unit owns, and a unit whose brief it
-   invalidates will repair the same drift the other way and report a state that is already false.
-   Run it before the units, or after them, or send the decision to every unit in flight per the
-   mid-campaign rule under **Dispatch anatomy**. Never beside them.
+   files. A script that fixes one thing across every target is the most direct way to break the
+   serialization rule, because it does not feel like a dispatch — nobody was named, no brief was
+   written, and it finishes in seconds. It still writes into trees a live unit owns, and a unit
+   whose brief it invalidates will repair the same drift the other way and report a state that is
+   already false. Run it before the units, or after them, or send the decision to every unit in
+   flight per the mid-campaign rule under **Dispatch anatomy**. Never beside them.
 8. A fleet pass that records a per-target status commits only the targets it recorded green. Reading
    "is the tree dirty" instead of "did this target pass" pushes a red target the moment one exists,
    and a flake makes that look like it worked. Refuse the failed row, name it, and re-run it alone
@@ -301,7 +304,7 @@ each CLI first (`codex --version`; `agent --version`, falling back to `agent.cmd
 run the bench's authentication-state check where it exposes one. Neither answer is liveness. A
 version string proves the binary is installed, and an authentication-state check reads stored
 credentials, so both pass while the account is out of quota, while the routed model is unavailable to
-it, while the server has already revoked the credential the check just read, and inside a sandbox
+it, while the server has already revoked the credential the check read, and inside a sandbox
 with the network denied. Record a bench live only on a bounded round-tripped model call that came
 back, and record what came back beside the routing decision. Probes are read-only, and the role file
 owns each bench's exact probe.
@@ -362,7 +365,7 @@ longer holds.
      plan did not consider; **unchanged**.
    - Redraw the dependency order. Strike a unit whose subject a later unit deletes. State the new
      prerequisite of a unit that acquired one.
-   - Walk the remaining units once and ask of each whether what just landed still supports it. A
+   - Walk the remaining units once and ask of each whether what landed still supports it. A
      decision taken inside a unit can remove a later unit's foundation, and the unit that took it
      cannot see that.
    - Re-baseline when a probe overturns a decision the plan rests on, not only at a phase boundary.
@@ -427,6 +430,8 @@ The harness bridge names the concrete mechanism for each of these.
   so a report living only in the Orchestrator's context stops the next lane on arrival.
 - Capture the unit's returned report to a file beside its brief under the same unit name, so a
   unit's instruction and its outcome are one pair on disk.
+- Name, inside a report that rests on a bench lane, that lane's journal path and session id, so
+  the provenance survives the journal's sweep.
 - Amend a brief on re-run rather than restating it. A mid-campaign correction produces a successor
   file recording what changed and why, and the original stays. A fix round's brief names the
   findings it carries and where each came from.
@@ -604,7 +609,8 @@ command that outlives the turn that started it. Every law here binds all of them
   byte offset rather than loading it, so an edit that shifts line numbers moves the text under that
   offset and the shell resumes mid-construct. The run dies on a syntax error in a line the script
   does not contain, which reads as a defect in the work rather than as the edit that caused it. Copy
-  the file, edit the copy, and launch the copy for the next run.
+  the file, edit the copy, and launch the copy for the next run. A successor's header names its own
+  file, its own log, and what changed from the file it supersedes.
 - On a Windows host this binds every program-carrying command, not only long ones. Heredocs,
   `node -e`, `node -p`, `&&` chaining, and any argument carrying `${...}` trip the Git Bash
   approval classifier and turn an unattended run into a manual approval prompt. Write the program
@@ -848,9 +854,9 @@ either publishes packages nobody needed to publish or leaves a consumer pinned t
 
 Every package is `0.0.x`, where a caret pins one exact release. A dependent therefore sees a new
 version only after it re-pins and republishes, so the fleet publishes in topological layer order
-derived from runtime `dependencies` alone. Layers exist for a reason a flat pass cannot fix:
-ranges that disagree install duplicate copies of the same package, and the compiler reads them as
-distinct types.
+derived from the runtime `dependencies` and `peerDependencies` edges, never from a development
+edge. Layers exist for a reason a flat pass cannot fix: ranges that disagree install duplicate
+copies of the same package, and the compiler reads them as distinct types.
 
 Read the order from the catalog table in `.claude/agents/orkestrel.md`, which `scaffold catalog`
 regenerates from the registry. Its `Layer` column is the publish round. Regenerate it before
@@ -861,7 +867,9 @@ The tooling packages sit outside that order because nothing depends on them at r
 is a development dependency of every package, including packages it depends on itself, so a runtime
 layering would report a cycle that does not exist. Each package builds against the already-published
 `scaffold`, never against an unpublished one, and a `scaffold` release therefore publishes on its own
-and propagates as files rather than as a cascade.
+and propagates as files rather than as a cascade. A package the fleet consumes as a development
+dependency takes the same shape when its consumers' gates read its unpublished tip;
+`.agents/skills/orkestrel-publish/references/wave.md` § Rule on the bump states that trigger.
 
 `scaffold` also carries a second published surface beside `dist/src`: `package.json` ships
 `dist/host`, the vendored file set every target receives through `repair`.

package/dist/host/agents/skills/enterprise-bootstrap/references/bootstrap-reference.md

@@ -203,7 +203,7 @@ $utilities: map-merge(
 @import 'bootstrap/scss/utilities/api';
 ```
 
-Remove with `map-remove($utilities, "width")` or set the key to `null`. This is the sanctioned answer when the shipped scale is missing a step (e.g. a `vh-50` the design truly needs).
+Remove with `map-remove($utilities, "width")` or set the key to `null`. This is the sanctioned answer when the shipped scale is missing a step (for example, a `vh-50` the design truly needs).
 
 ## Forms in Production
 
@@ -211,7 +211,7 @@ Remove with `map-remove($utilities, "width")` or set the key to `null`. This is
 
 - **Top-aligned labels by default** — the evidence (eye-tracking form research) shows fastest completion and the cleanest single-column scan, and they survive narrow screens without reflow. Reserve left-aligned labels for dense read-back forms where vertical compression matters more than speed.
 - Visible label or `.form-floating` — never placeholder-only (disappears on input, fails accessibility).
-- **Do not say the same thing twice.** When the host already names the request — a card heading, a dialog title, a section header stating the question — the form associates with that name via `aria-labelledby` instead of repeating the prompt in its own label. Repetition reads as separate questions to a screen-reader user and as clutter to everyone else.
+- **Do not say the same thing twice.** When the host already names the request — a card heading, a dialog title, a section header stating the question — the form associates with that name through `aria-labelledby` instead of repeating the prompt in its own label. Repetition reads as separate questions to a screen-reader user and as clutter to everyone else.
 - One column beats multi-column for completion; use the form grid (`row g-3` + `col-md-*`) only for genuinely paired fields (city/state/zip).
 
 ```html
@@ -237,7 +237,7 @@ Remove with `map-remove($utilities, "width")` or set the key to `null`. This is
 - Once a field is in an error state, re-validate as the user types so they see the fix land.
 - Always re-check everything on submit. Keep the submit button **enabled** — a disabled submit hides _what is_ wrong; a validating submit shows it.
 - On failed submit of a long form, render an **error summary** at the top (focus it; link each item to its field) _and_ inline messages at each field — never summary-only, never inline-only.
-- Error style = color + icon + text, stating what is wrong and how to fix it. Wire message to field with `aria-describedby`, mark the field `aria-invalid="true"`. Never report errors via tooltip-on-hover.
+- Error style = color + icon + text, stating what is wrong and how to fix it. Wire message to field with `aria-describedby`, mark the field `aria-invalid="true"`. Never report errors through a hover tooltip.
 
 ### Bootstrap validation mechanics
 
@@ -274,7 +274,7 @@ Client-side, the documented pattern:
 </script>
 ```
 
-**Documented limitation (enterprise-critical):** Bootstrap's client-side validation styles and `valid/invalid-tooltip`s are **not exposed to assistive technologies**. For accessible flows use the server-side pattern — apply `.is-invalid` / `.is-valid` directly (no `.was-validated` parent needed), with `.invalid-feedback` linked via `aria-describedby` — or rely on native browser validation.
+**Documented limitation (enterprise-critical):** Bootstrap's client-side validation styles and `valid/invalid-tooltip`s are **not exposed to assistive technologies**. For accessible flows use the server-side pattern — apply `.is-invalid` / `.is-valid` directly (no `.was-validated` parent needed), with `.invalid-feedback` linked through `aria-describedby` — or rely on native browser validation.
 
 ```html
 <input
@@ -290,7 +290,7 @@ Client-side, the documented pattern:
 </div>
 ```
 
-Details: input groups with feedback need `.has-validation` on the group (border-radius fix). `.valid-tooltip` and `.invalid-tooltip` need a `position-relative` parent. Validation colors are mode-adaptive via `--bs-form-valid-color`, `--bs-form-valid-border-color`, `--bs-form-invalid-color`, `--bs-form-invalid-border-color`.
+Details: input groups with feedback need `.has-validation` on the group (border-radius fix). `.valid-tooltip` and `.invalid-tooltip` need a `position-relative` parent. Validation colors are mode-adaptive through `--bs-form-valid-color`, `--bs-form-valid-border-color`, `--bs-form-invalid-color`, `--bs-form-invalid-border-color`.
 
 ### Autosave vs explicit save
 
@@ -498,7 +498,7 @@ Give header cells an **opaque background** (`bg-body-secondary` or a `.table-*`
 ```
 
 - **Row actions:** 1–3 high-frequency actions inline; the rest behind a per-row kebab (dropdown). Hover-only reveal fails touch and keyboard — keep at least the overflow trigger always visible and ≥24px.
-- **Selection & bulk actions:** header checkbox with indeterminate state for partial selection; per-row checkboxes with `aria-label` naming the row ("Select INV-1042"). When selection > 0, swap the toolbar's content in place for a contextual bar — "3 selected", the batch actions, and a clear-selection escape — never push the layout down (layout-shifting chrome is an anti-pattern). Announce the count via a polite live region.
+- **Selection & bulk actions:** header checkbox with indeterminate state for partial selection; per-row checkboxes with `aria-label` naming the row ("Select INV-1042"). When selection > 0, swap the toolbar's content in place for a contextual bar — "3 selected", the batch actions, and a clear-selection escape — never push the layout down (layout-shifting chrome is an anti-pattern). Announce the count through a polite live region.
 - **Pagination vs scrolling:** paginate when users need position, totals, deep links, and "go to page N" — most enterprise CRUD. Virtualize (windowed rendering) for long uniform lists where scrolling is natural. True infinite scroll is for exploratory feeds only — never where users need a footer or a findable end.
 - **Responsive, ranked:** (1) _priority columns_ — hide low-value columns per breakpoint (`d-none d-lg-table-cell`), always keeping the identifying + decision columns; (2) _horizontal scroll_ (`table-responsive`) when every column matters — remember it clips dropdowns; (3) _card-ify_ into label:value stacks below `md` for low row counts. Never card-ify a wide comparison table — comparison is the point.
 - **Table states:** loading → **skeleton rows** matching the real column count/widths (a centered spinner collapses the layout); empty → distinguish _no data yet_ (invite the first action) from _no results for these filters_ (offer "Clear filters"); error → inline retry inside the table region, header and toolbar preserved.
@@ -532,12 +532,12 @@ Design **every one** for every data surface: ideal (populated), empty, loading,
 
 ### Feedback discipline
 
-| Channel                       | Use for                                                                          | Never for                                          |
-| ----------------------------- | -------------------------------------------------------------------------------- | -------------------------------------------------- |
-| **Toast**                     | Transient confirmation of a just-completed action; auto-dismiss; `role="status"` | Errors needing action; anything the user must read |
-| **Inline alert**              | Feedback tied to a specific field/section/action; persists in context            | App-wide conditions                                |
-| **Banner** (page-level alert) | Persistent page/app conditions — outage, trial expiring, permissions             | Action confirmations                               |
-| **Modal / alertdialog**       | Blocking decisions the user must resolve now                                     | FYIs, success messages                             |
+| Channel                       | Use for                                                                                       | Never for                                          |
+| ----------------------------- | --------------------------------------------------------------------------------------------- | -------------------------------------------------- |
+| **Toast**                     | Transient confirmation of an action that finished a moment ago; auto-dismiss; `role="status"` | Errors needing action; anything the user must read |
+| **Inline alert**              | Feedback tied to a specific field/section/action; persists in context                         | App-wide conditions                                |
+| **Banner** (page-level alert) | Persistent page/app conditions — outage, trial expiring, permissions                          | Action confirmations                               |
+| **Modal / alertdialog**       | Blocking decisions the user must resolve now                                                  | FYIs, success messages                             |
 
 Blocking errors are never toasts. Keep the acting verb consistent across the flow: the "Publish" button confirms with "Published".
 
@@ -555,7 +555,7 @@ Do not type-gate a single-row delete; do not one-tap a tenant wipe. Confirm only
 
 ## RTL
 
-- Enable per page: `<html lang="ar" dir="rtl">` + the RTL stylesheet `bootstrap.rtl.min.css` (built from the same source via RTLCSS). RTL support is documented as experimental.
+- Enable per page: `<html lang="ar" dir="rtl">` + the RTL stylesheet `bootstrap.rtl.min.css` (built from the same source through RTLCSS). RTL support is documented as experimental.
 - The logical properties model is why the utilities say start/end: `ms-*`/`me-*`, `ps-*`/`pe-*`, `text-start`/`text-end`, `float-start`/`float-end`, `offcanvas-start`/`end` all flip automatically. **Never write `left`/`right` positioning or physical margins in custom CSS** — use logical properties (`margin-inline-start`, `inset-inline-end`) so your custom rules flip too.
 - Caveats: shipping LTR+RTL simultaneously costs significant extra CSS; the breadcrumb divider needs `$breadcrumb-divider-flipped`; source Sass can embed RTLCSS directives (`/* rtl: … */`) for value swaps like font stacks.
 
@@ -563,13 +563,13 @@ Do not type-gate a single-row delete; do not one-tap a tenant wipe. Confirm only
 
 - Hide chrome, keep the data: `d-print-none` on nav, sidebars, toolbars, action buttons; the report/table itself stays printable.
 - `d-print-block`/`d-print-table` can resurface content hidden on screen (a print-only header with report title/date).
-- Print-check data screens users will export: collapse interactive affordances (sort carets, checkboxes) via `d-print-none`, and prefer `table-bordered` legibility over hover/stripe effects that may not print.
+- Print-check data screens users will export: collapse interactive affordances (sort carets, checkboxes) through `d-print-none`, and prefer `table-bordered` legibility over hover/stripe effects that may not print.
 
 ## Performance
 
 - **Ship one CSS system and no more.** Bootstrap plus a second framework (or a parallel bespoke layer) doubles payload and guarantees specificity fights.
-- **Compressed, the full build is cheap; incomplete builds are not.** Trimming via a Sass-subset build (import only the parts used — see [Theming](#theming--design-tokens)) is the sanctioned diet. Aggressive purge tools are the risky one: Bootstrap adds classes **at runtime** (`show`, `showing`, `fade`, `collapsing`, `modal-open`, `modal-backdrop`, `offcanvas-backdrop`, tooltip/popover generated markup) — purging without safelisting them ships UIs whose modals silently stop rendering. If you purge, safelist every JS-toggled class and test every overlay.
-- **Icons:** Bootstrap Icons is a separate package — prefer inline SVG or an SVG sprite (crisp, styleable via `currentColor`, no font flash) over the icon font; load only the icons used.
+- **Compressed, the full build is cheap; incomplete builds are not.** Trimming through a Sass-subset build (import only the parts used — see [Theming](#theming--design-tokens)) is the sanctioned diet. Aggressive purge tools are the risky one: Bootstrap adds classes **at runtime** (`show`, `showing`, `fade`, `collapsing`, `modal-open`, `modal-backdrop`, `offcanvas-backdrop`, tooltip/popover generated markup) — purging without safelisting them ships UIs whose modals silently stop rendering. If you purge, safelist every JS-toggled class and test every overlay.
+- **Icons:** Bootstrap Icons is a separate package — prefer inline SVG or an SVG sprite (crisp, styleable through `currentColor`, no font flash) over the icon font; load only the icons used.
 - **JS:** the bundle is small, but only load it where behavior exists; per-component ESM imports (`bootstrap/js/dist/modal`) trim further in bundlers.
 - **Fonts:** each display face is a payload decision; subset and `font-display: swap` characterful faces, and let the data face fall back to the system stack when the brief allows.
 

package/dist/host/agents/skills/enterprise-bootstrap/references/frontend-design.md

@@ -57,7 +57,7 @@ product's, and keep the data surfaces disciplined and conventional enough to rea
 
 ## Process: brainstorm, explore, plan, critique, build, critique again
 
-Calibrate against the looks AI-generated design currently clusters around: (1) a warm cream
+Calibrate against the looks AI-generated design clusters around: (1) a warm cream
 background (near #F4F1EA) with a high-contrast serif display and a terracotta accent; (2) a
 near-black background with a single bright acid-green or vermilion accent; (3) a broadsheet-style
 layout with hairline rules, zero border-radius, and dense newspaper-like columns. Each is
@@ -81,8 +81,8 @@ only once the plan is specific to this brief, then follow the revised plan exact
 color and type decision from it.
 
 Structure your CSS selector specificities deliberately when writing the code. Classes cancel each
-other out easily, especially a type-based selector like `.section` against an element-based selector
-like `.cta`, and the padding and margin between sections is where it happens most.
+other out, especially a type-based selector like `.section` against an element-based selector like
+`.cta`, and the padding and margin between sections is where it happens most.
 
 Do this planning and iteration in your thinking. Show the user a direction only once it satisfies
 the brief and the quality floor below.
@@ -103,9 +103,9 @@ reads it.
 
 ## Writing in design
 
-Keep a word only where it makes the design easier to understand, and therefore easier to use. Bring
-the same intentionality to copy as to spacing and color. Before writing anything, decide what the
-design needs to say, and how to say it so the person can navigate the experience.
+Keep a word only where it helps the reader understand the design, and so use it.
+Bring the same intentionality to copy as to spacing and color. Before writing anything, decide what
+the design needs to say, and how to say it so the person can navigate the experience.
 
 Write from the end user's side of the screen. Name things by what people control and recognize,
 never by how the system is built: a person manages notifications, not webhook config. Describe what

package/dist/host/agents/skills/enterprise-bootstrap/references/utilities.md

@@ -162,7 +162,7 @@ For borders that must stay visible in both color modes, prefer the `border-*-sub
 
 ### Sizing
 
-Bootstrap ships exactly these — nothing else (no `.vw-25`, `.vh-50`, `.mw-auto`, `.min-vh-75`, etc.; add missing steps via the utilities API if a project truly needs them — see [bootstrap-reference.md](bootstrap-reference.md)):
+Bootstrap ships exactly these — nothing else (no `.vw-25`, `.vh-50`, `.mw-auto`, or `.min-vh-75`; add missing steps through the utilities API if a project truly needs them — see [bootstrap-reference.md](bootstrap-reference.md)):
 
 ```css
 /* Width / height (percent of parent) */
@@ -288,12 +288,12 @@ Helpers are single-purpose classes that sit alongside utilities.
 
 - **`.visually-hidden`** — hide visually, keep for screen readers (icon-button labels, table caption text, "Danger:" prefixes).
 - **`.visually-hidden-focusable`** — hidden until focused; the skip-link class. Never combine with `.visually-hidden`.
-- **`.stretched-link`** — makes a whole `position-relative` container (e.g. a card) the click target of one inner link, without wrapping everything in `<a>`.
+- **`.stretched-link`** — makes a whole `position-relative` container (for example, a card) the click target of one inner link, without wrapping everything in `<a>`.
 - **`.ratio .ratio-16x9`** (also `1x1`, `4x3`, `21x9`, or `--bs-aspect-ratio`) — responsive embeds/iframes.
 - **`.vstack` / `.hstack gap-*`** — shorthand vertical/horizontal flex stacks for quick toolbars and side rails.
 - **`.vr`** — vertical rule divider inside an `.hstack` or flex row.
-- **`.focus-ring`** (+ `.focus-ring-primary` … per theme color) — opt-in focus ring for custom interactive elements; tune via `--bs-focus-ring-width` (.25rem), `--bs-focus-ring-opacity` (.25), `--bs-focus-ring-color`, `--bs-focus-ring-x/y/blur`. Use it instead of `outline: none` hacks so keyboard focus stays visible.
-- **`.icon-link`** (+ `.icon-link-hover`) — pairs a Bootstrap Icon SVG with a text link; icon auto-sizes to 1em; give decorative icons `aria-hidden="true"`. Hover shift via `--bs-icon-link-transform`.
+- **`.focus-ring`** (+ `.focus-ring-primary` … per theme color) — opt-in focus ring for custom interactive elements; tune through `--bs-focus-ring-width` (.25rem), `--bs-focus-ring-opacity` (.25), `--bs-focus-ring-color`, `--bs-focus-ring-x/y/blur`. Use it instead of `outline: none` hacks so keyboard focus stays visible.
+- **`.icon-link`** (+ `.icon-link-hover`) — pairs a Bootstrap Icon SVG with a text link; icon auto-sizes to 1em; give decorative icons `aria-hidden="true"`. Hover shift through `--bs-icon-link-transform`.
 
 ## Enterprise notes (utilities)
 

package/dist/host/agents/skills/orkestrel-debrief/references/field-testing.md

@@ -8,10 +8,10 @@ model consumes.
 Test from the top down, and do not stop at the tier that passes:
 
 1. **Frontier** (the harness's default model) — proves the surface works at all.
-2. **Mid tier** (e.g. a codex mechanical model) — proves the surface survives a harness's
-   schema abbreviation and a model that reads less carefully.
-3. **Small harness-native** (e.g. Haiku, a codex high-volume model) — the acceptance
-   tier: these must walk the surface unaided, or the surface is not done.
+2. **Mid tier** (for example, a codex mechanical model) — proves the surface survives a
+   harness's schema abbreviation and a model that reads less carefully.
+3. **Small harness-native** (for example, Haiku or a codex high-volume model) — the
+   acceptance tier: these must walk the surface unaided, or the surface is not done.
 4. **Local floor** (a quantized 2B-class model through a real tool-calling client) — not
    an acceptance gate; a stochastic probe that exposes teaching gaps nothing else hits.
    Its residual failures must be provably consumer-floor (malformed emission, attention
@@ -29,7 +29,7 @@ Test from the top down, and do not stop at the tier that passes:
 - **Caps and journals.** Every pass runs as a tracked background command under a hard
   time cap with its transcript journaled; the journal is the evidence of record.
 
-## Capture the reasoning, not just the calls
+## Capture the reasoning, not the calls alone
 
 Where the runtime exposes thinking (local runtimes expose it directly; harness stream
 formats carry interstitial text), record it. The call log shows WHAT failed; the trace

package/dist/host/agents/skills/orkestrel-falsify/references/reconcile.md

@@ -120,7 +120,7 @@ leaves this round is the procedure.
 
 When a round certifies an instrument — a pin, an identity check, a generated sweep — the controls
 are usually drawn from whatever the instrument obviously covers, because that is where the examples
-are easiest to construct. That sampling proves discrimination _within_ the population and is
+take the least construction. That sampling proves discrimination _within_ the population and is
 routinely reported as proof the instrument works.
 
 So before running controls, write down the instrument's **membership rule** in one sentence, then

package/dist/host/agents/skills/orkestrel-publish/SKILL.md

@@ -10,8 +10,9 @@ description: Run an Orkestrel release from layer order to registry confirmation.
 Read the current files in this order:
 
 1. `AGENTS.md` and every applicable `.claude/rules/*.md` file.
-2. `.agents/orchestration.md` § Publishing the fleet and § Long-running commands. Each named
-   section binds every step here.
+2. `.agents/orchestration.md` § Publishing the fleet, § Long-running commands, § Orchestrator and
+   executor, § Writing concurrency, and § Dispatch anatomy. Each named section binds every step
+   here.
 3. The reference the moment needs: [wave.md](references/wave.md) before visiting a repository,
    ruling on a bump, or preparing a layer; [window.md](references/window.md) before running
    `npm login` or any upload.
@@ -42,21 +43,17 @@ following the skill.
    Derive each pin from that reading, never from a local manifest.
 3. **Visit each repository.** Run the visit in [wave.md](references/wave.md) in its stated order,
    in parallel slices of disjoint repositories, each slice serial inside itself.
-4. **Rule on each package's bump.** Apply the triggers in [wave.md](references/wave.md). A package
-   whose published surface did not move takes its re-pin, its gates, and a commit to `main`, and
-   does not publish.
-5. **Prepare the whole layer before authenticating.** Bump, re-pin, install, sweep the self-pins,
-   run each package's own `prepublishOnly` to green, commit, and push. Every one of those steps
-   happens outside the window.
+4. **Rule on each package's bump.** Apply the triggers in [wave.md](references/wave.md) § Rule on
+   the bump; the contract's § What a bump obliges owns the blast radius.
+5. **Prepare the whole layer before authenticating**, in the order [wave.md](references/wave.md)
+   § Prepare a layer fixes. Every one of those steps happens outside the window.
 6. **Reach the approval.** Follow [window.md](references/window.md), and launch the login chain
    only after the user signals they are at the keyboard.
 7. **Authorize and upload.** Follow [window.md](references/window.md). Take the account's one-time
-   code where it has one, because that path opens no window. Where the account answers with no
-   code, the browser authorization opens the five-minute window: open the layer with one package,
-   confirm its upload from the registry, then chase the remaining uploads back-to-back.
-8. **Close the layer from the registry, then prepare the next.** A dependent's new pin cannot
-   install until the version it names exists, so preparation and publication interleave and cannot
-   be batched ahead.
+   code where it has one; § Authorize the upload there fixes that code's life and the layer it
+   carries. Where the account answers with no code, follow § Spend the window there.
+8. **Close the layer from the registry, then prepare the next**, per [wave.md](references/wave.md)
+   § Prepare a layer.
 
 Run that sequence for every layer, from the registry reading to the registry close. Refresh the
 registry evidence between layers rather than carrying the previous round's reading forward.
@@ -71,7 +68,10 @@ Completion requires:
   that section requires;
 - every tarball swap is restored per § Fixing a dependency before it publishes, and no target
   repository is left holding an uncommitted bump or an unpushed commit;
-- every gate that proved a package ran outside the window and against the artifact that shipped.
+- every gate that proved a package ran outside the window and against the artifact that shipped;
+- every gate red at a package's baseline for a cause `ROADMAP.md` already carries is recorded as a
+  standing reading beside the package's row with its carrier, and the release report names it. A
+  standing reading is not a gate the release ran.
 
 Report the layers in publish order, each package with its registry-confirmed version, the bump
 rulings and their evidence, the approvals the user granted, and anything still unpublished. End

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -10,9 +10,11 @@ prepare the next.
 Run the visit in this order. A step that reads generated or installed state is invalid before the
 step that writes it.
 
-1. Re-pin the target's `@orkestrel/scaffold` devDependency and install, so the overwrite runs the
-   current vendored host.
-2. Run `scaffold overwrite`. One run repairs the `AGENTS.md` and `CLAUDE.md` pointers and deletes
+1. Re-pin every `@orkestrel` range to the registry caret (peer ranges included) and install, so
+   the overwrite runs the current vendored host.
+2. Commit the manifest and the lockfile as the preparation commit. `scaffold overwrite` refuses a
+   tree carrying uncommitted changes, and the install left both dirty.
+3. Run `scaffold overwrite`. One run repairs the `AGENTS.md` and `CLAUDE.md` pointers and deletes
    every tracked copy the target still holds at an instruction-canon path. Prove the sweep with a
    second `scaffold audit` that exits `0`.
    - Where the target's `.claude/agents/orkestrel.md` carries a body outside the marker-bounded
@@ -30,12 +32,16 @@ step that writes it.
      rather than waiving past it.
    - A copy the target git-ignores stays a `foreign` finding, so that target never reaches exit `0`
      again. Keep a local MCP server registration outside the repository rather than at `.mcp.json`.
-3. Force-verify every `@orkestrel` range against a registry sweep taken after the previous layer
+4. Force-verify every `@orkestrel` range against a registry sweep taken after the previous layer
    published.
-4. Run the full install.
-5. Run the mutating `format` script to converge generated writes.
-6. Run the quality gates.
-7. Compare the rebuilt `dist/` against the published tarball for material content.
+5. Run the full install. The overwrite re-declares the toolchain ranges, so the lockfile the first
+   install regenerated no longer matches the manifest.
+6. Sweep the self-pins, per § Sweep the self-pins: the re-pin moves the snapshot class.
+7. Run the mutating `format` script to converge generated writes.
+8. Run the quality gates.
+9. Fetch the published tarball, then compare the rebuilt `dist/` against it for material content.
+   An absent baseline is an unanswered comparison, never a moved dist: fetch and re-run rather than
+   ruling a bump owed.
 
 Restore any unpublished tarball the target is holding before the quality gates run, per
 `.agents/orchestration.md` § Fixing a dependency before it publishes. A distribution proof run
@@ -69,7 +75,15 @@ final runtime dependency set differs from the published packument.
   per package rather than assuming it: a package that imports its own `package.json` version into
   published code emits that version, so its pre-bump dist is stale the moment the version moves.
   Rebuild after the bump there and pack from the rebuilt tree. The `npm publish --ignore-scripts`
-  command skips `prepack`, so that rebuild is the operator's step rather than the publish's.
+  command skips `prepack`, so that rebuild is the operator's step rather than the publish's. The
+  same holds for a package that writes its declared ranges into published output: its `dist/`
+  moves on a development re-pin, and `.agents/orchestration.md` § What a bump obliges rules that
+  re-pin a release.
+
+One trigger orders rather than bumps. A package the fleet consumes as a development dependency,
+whose consumers' gates read its unpublished tip, publishes on its own account ahead of the layer
+order and again at its own slot after its runtime ranges move: each consumer's visit installs the
+registry copy over any staged tip, so every consumer stays red until that tip is on the registry.
 
 ## Prepare a layer
 
@@ -77,16 +91,22 @@ An unpublished package's first version is `0.0.1`. Do not bump it before that fi
 registry has nothing to serve, so there is no version to move away from, and bumping produces a
 package whose history starts at a number nothing explains.
 
-Prepare a published package's layer in this order:
+Prepare a published package's layer in this order, after the visit has ruled the package's bump:
 
 1. **Bump from what the registry serves, not from the local manifest.** A repository's `version`
    field can sit a release behind what was published from another checkout, and bumping that
    produces a version the registry already holds, which fails on upload after the whole gate chain
    has run. Read the registry first.
-2. **Re-pin every `@orkestrel` range to what the registry serves, and install.**
-3. **Sweep the self-pins**, per the following section.
+2. **Re-pin every `@orkestrel` range to what the registry serves, and install.** The visit's
+   preparation commit already precedes the overwrite; this install regenerates the lockfile for the
+   bumped manifest.
+3. **Sweep the self-pins**, per the following section: the bump moves the version class.
 4. **Run each package's own `prepublishOnly` script to green.**
-5. **Commit and push before the window opens.**
+5. **Write the release commit and push before the window opens.** The preparation commit inside
+   the visit is a different commit at a different moment.
+
+Where an inventory taken before the round already ruled every dist moved, the bump rides the
+visit's first step and these steps fold into the visit, whose comparison then confirms the ruling.
 
 Prepare the next layer only after this one is on the registry. A dependent's new pin cannot
 install until the version it names exists, so preparation and publication interleave and cannot be
@@ -99,12 +119,17 @@ the flag is what stops the gate chain running a second time inside the five minu
 ## Sweep the self-pins
 
 A package's own version appears in its source and its tests as a literal, and a bump falsifies
-every one of them. Run this sweep after the re-pin install, not after the manifest edit.
+every one of them. A snapshot of generated output carries the ranges the package writes rather than
+its own version, and any re-pin, a development one included, falsifies it. Run this sweep after the
+re-pin install, not after the manifest edit.
 
-- `grep` the prior version literal across `tests/` and `src/` in the publishing package, and rule
-  on every hit. A canned packument in a fixture and a looked-up version in a CLI suite carry the
+- Search `tests/` and `src/` in the publishing package for the prior version literal, and rule on
+  every hit. A canned packument in a fixture and a looked-up version in a CLI suite carry the
   version with no tripwire comment beside them, so they surface as a red gate after the bump
   rather than as a planned edit before it.
+- Search `tests/` for the prior range of every re-pinned dependency, and move each snapshot the
+  search hits with the re-pin. A generated-manifest fixture never carries the package's own prior
+  version, so the version sweep cannot reach it.
 - Move a documented tripwire — a golden digest over generated output — in the same change as the
   version bump. That is what the tripwire is for.
 - Re-take a generated artifact's digest after the install, because the generated bytes can derive
@@ -120,4 +145,5 @@ every one of them. Run this sweep after the re-pin install, not after the manife
 
 Refresh the registry evidence between layers and derive each round's pins from it. A pin can only
 name a version the registry already serves, so a dependency shipping in the same window keeps the
-resolvable previous pin and takes its development-only re-pin after the window closes.
+resolvable previous pin and takes its development-only re-pin after the window closes. That re-pin
+takes the self-pin sweep too, because the snapshot class moves with no bump.