@orkestrel/scaffold 0.0.63 → 0.0.65

package/dist/host/agents/skills/enterprise-bootstrap/references/utilities.md

@@ -24,7 +24,7 @@
 .bg-opacity-10, .bg-opacity-25, .bg-opacity-50, .bg-opacity-75, .bg-opacity-100
 ```
 
-Prefer `bg-body-*` and `*-subtle` over `bg-white`/`bg-light` — they track `data-bs-theme` so dark mode works without extra rules.
+Prefer `bg-body`, `bg-body-secondary`, `bg-body-tertiary`, and `bg-*-subtle` for quiet surfaces; inherit text without an added foreground class. Treat original contextual `bg-*`, including `bg-light` and `bg-dark`, as non-adaptive in stock 5.3. Take ownership and exceptions from [color-modes.md](color-modes.md).
 
 ### Borders
 
@@ -39,7 +39,11 @@ Prefer `bg-body-*` and `*-subtle` over `bg-white`/`bg-light` — they track `dat
 .rounded-0, .rounded-1, .rounded-2, .rounded-3, .rounded-4, .rounded-5
 ```
 
-For borders that must stay visible in both color modes, prefer the `border-*-subtle` classes (theme-adaptive) over raw color borders.
+Use adaptive border roles for quiet separation. Measure boundaries needed to identify a control or state; `border-*-subtle` adapts but does not automatically meet the contrast bar.
+
+- **`border-{1..5}` sets `border-width` on every side.** On a component that already has a border (`.card`, `.alert`) it thickens the whole box. For a one-side accent, zero first, restore one side, then widen — `card border-0 border-top border-4 border-primary` — utility source order (`border` → `border-{side}` → `border-width`) makes it hold, and the cleared sides have no border style so their width never paints.
+- Strengthen a rule that reads too faint with `border-2` on its soft color, not with a darker color; heavier width keeps the softness.
+- `border-{color}` is the fixed brand color in both modes; check an accent against a dark `bg-*-subtle` before shipping it.
 
 ### Colors (Text)
 
@@ -48,10 +52,13 @@ For borders that must stay visible in both color modes, prefer the `border-*-sub
 .text-body, .text-body-secondary, .text-body-tertiary, .text-body-emphasis
 .text-primary-emphasis, .text-secondary-emphasis, .text-success-emphasis, .text-danger-emphasis, .text-warning-emphasis, .text-info-emphasis, .text-light-emphasis, .text-dark-emphasis
 .text-black, .text-white, .text-black-50, .text-white-50
-.text-muted        /* DEPRECATED in 5.3 — use .text-body-secondary; removed in v6 */
+.text-muted        /* Deprecated in 5.3; use a deliberate .text-body-secondary role instead. */
+.text-reset        /* Restore inherited color; not the same as .text-body. */
 .text-opacity-25, .text-opacity-50, .text-opacity-75, .text-opacity-100
 ```
 
+Default ordinary text to inheritance. Original contextual `text-*` colors do not adapt in stock 5.3; body-role and `text-*-emphasis` colors do. `text-body-secondary` (body color at .75 alpha) clears 4.5:1 on every stock body surface in both modes; `text-body-tertiary` (.5 alpha) measures 3.0–4.1:1 and is decoration or disabled only. Neither, nor `text-white-50`, is a quiet tier on a colored fill — take the same-hue token from [color-modes.md](color-modes.md) → Text tiers. Do not add emphasis text automatically to subtle fills, and do not replace a component's native foreground without inspecting its state contract.
+
 ### Display
 
 ```css
@@ -120,6 +127,8 @@ For borders that must stay visible in both color modes, prefer the `border-*-sub
 .link-offset-1, .link-offset-2, .link-offset-3
 ```
 
+Keep normal links on Bootstrap's link rules inside prose. Where most things are links — navigation, lists, tables — use `link-body-emphasis link-underline-opacity-0 link-underline-opacity-100-hover link-offset-2`: body tone, underline on hover and focus, and the one colored-link helper that adapts to dark mode; add `fw-semibold` where the link is the row's identity. For a brand underline that completes on hover: `link-underline-primary link-underline-opacity-50 link-underline-opacity-100-hover link-offset-2`. Do not replace hover/focus rules with a text-color utility.
+
 ### Object Fit
 
 ```css
@@ -133,6 +142,8 @@ For borders that must stay visible in both color modes, prefer the `border-*-sub
 .opacity-0, .opacity-25, .opacity-50, .opacity-75, .opacity-100
 ```
 
+Opacity is not a text tier: it reads as disabled and lets the surface show through the glyphs. Do not use whole-element opacity to quiet a region containing readable text. Color-opacity utilities affect only rules that consume their variable; stock subtle backgrounds do not consume `--bs-bg-opacity`. Measure the composited result rather than assuming a tint.
+
 ### Overflow
 
 ```css
@@ -160,9 +171,11 @@ For borders that must stay visible in both color modes, prefer the `border-*-sub
 .shadow-none, .shadow-sm, .shadow, .shadow-lg
 ```
 
+Three elevation steps: `shadow-sm` (`0 .125rem .25rem` at .075) for slightly raised cards and controls, `shadow` (`0 .5rem 1rem` at .15) for floating menus and a dragged item, `shadow-lg` (`0 1rem 3rem` at .175) for dialogs. Stock dropdowns, popovers, toasts, and modals all sit on `--bs-box-shadow`; lift a modal to the top step through `--bs-modal-box-shadow` ([bootstrap-reference.md](bootstrap-reference.md) → Elevation and depth). No shadow is a valid role.
+
 ### Sizing
 
-Bootstrap ships exactly these — nothing else (no `.vw-25`, `.vh-50`, `.mw-auto`, `.min-vh-75`, etc.; add missing steps via the utilities API if a project truly needs them — see [bootstrap-reference.md](bootstrap-reference.md)):
+Bootstrap ships exactly these — nothing else (no `.vw-25`, `.vh-50`, `.mw-auto`, or `.min-vh-75`; add missing steps through the utilities API if a project truly needs them — see [bootstrap-reference.md](bootstrap-reference.md)):
 
 ```css
 /* Width / height (percent of parent) */
@@ -222,14 +235,16 @@ Notes: `s`/`e` are logical start/end — they flip automatically under RTL; neve
 /* Size */
 .fs-1, .fs-2, .fs-3, .fs-4, .fs-5, .fs-6
 
-/* Truncate — needs display block/inline-block or a flex child with min-width 0 */
+/* Truncate — needs a constrained inline width and block/inline-block layout */
 .text-truncate
 ```
 
+`fs-6…1` = 1 · 1.25 · 1.5 · 1.75 · 2 · 2.5 rem (16–40 px at the default root); `display-6…1` = 2.5–5 rem. Values above 1.25 rem scale down fluidly below a 1200 px viewport under RFS; `fs-5`, `fs-6`, `.lead`, and controls do not. There is no `rem` step below 1 rem: `.small` and `<small>` are `.875em`, so use one level only — `.small` inside `.small` is 12.25 px, off every scale — and take a 14 px or 12 px role from the generated `fs-sm`/`fs-xs` ([bootstrap-reference.md](bootstrap-reference.md) → Layout and type extensions). Stock 5.3 ships no letter-spacing utility; generate `ls-tight`/`ls-wide` there for display text and `text-uppercase` labels. `fw-light`/`fw-lighter` (300) belong only at display size; `.lead` and `display-*` ship at 300 by design.
+
 The composition traps in this group:
 
 - **`fs-*` without `lh-1` grows the row.** A resized glyph or mark keeps the parent's line-height, so the line box stretches and the row sits taller than its neighbors. Pair `fs-*` with `lh-1` on anything that is a mark rather than a paragraph.
-- **`text-truncate` zeroes a flex item's automatic minimum size** (that's the `min-width: 0` it carries). Inside a flex _column_, that also removes the floor that kept a heading at its own height: a growing sibling then squeezes the title from the bottom until it clips. Floor the title with `flex-shrink-0` and let the growing sibling absorb the change.
+- **`text-truncate` is not a minimum-size utility.** It sets hidden overflow, ellipsis, and no wrapping; it does not declare `min-width: 0`. Give the truncating element a constrained width and make its flex ancestry shrink where required. In a constrained column, protect a title from height loss with `flex-shrink-0`. Take any missing inline-size utility from the project's generated scale, never an invented `.min-w-0`.
 
 ### Vertical Align
 
@@ -261,6 +276,17 @@ The composition traps in this group:
 | `5`    | $spacer \* 3 (3rem = 48px)     |
 | `auto` | auto                           |
 
+Use the installed scale as the first choice. Assign its steps to internal, group, panel, and section
+gaps; keep inter-group gaps larger than internal gaps. Compare adjacent steps before adding one.
+The displayed pixel equivalents assume the default root size; they are not fixed pixel constraints.
+
+The shipped jumps are +100 / +100 / +50 / +100 %: coarse above 16 px, with no 12 px or 32 px
+step and nothing above 48 px for section rhythm. A missing step is not permission to type `p-2.5`
+or `p-6`; those resolve to no rule and fail silently. Add a named step through
+[bootstrap-reference.md](bootstrap-reference.md) → Layout and type extensions and verify the
+generated class in the shipped build. Take type, width, and spacing decisions from
+[frontend-design.md](frontend-design.md).
+
 ## Z-index Scale (components)
 
 | Component          | Z-index |
@@ -288,25 +314,88 @@ Helpers are single-purpose classes that sit alongside utilities.
 
 - **`.visually-hidden`** — hide visually, keep for screen readers (icon-button labels, table caption text, "Danger:" prefixes).
 - **`.visually-hidden-focusable`** — hidden until focused; the skip-link class. Never combine with `.visually-hidden`.
-- **`.stretched-link`** — makes a whole `position-relative` container (e.g. a card) the click target of one inner link, without wrapping everything in `<a>`.
+- **`.stretched-link`** — makes a whole `position-relative` container (for example, a card) the click target of one inner link, without wrapping everything in `<a>`.
 - **`.ratio .ratio-16x9`** (also `1x1`, `4x3`, `21x9`, or `--bs-aspect-ratio`) — responsive embeds/iframes.
 - **`.vstack` / `.hstack gap-*`** — shorthand vertical/horizontal flex stacks for quick toolbars and side rails.
 - **`.vr`** — vertical rule divider inside an `.hstack` or flex row.
-- **`.focus-ring`** (+ `.focus-ring-primary` … per theme color) — opt-in focus ring for custom interactive elements; tune via `--bs-focus-ring-width` (.25rem), `--bs-focus-ring-opacity` (.25), `--bs-focus-ring-color`, `--bs-focus-ring-x/y/blur`. Use it instead of `outline: none` hacks so keyboard focus stays visible.
-- **`.icon-link`** (+ `.icon-link-hover`) — pairs a Bootstrap Icon SVG with a text link; icon auto-sizes to 1em; give decorative icons `aria-hidden="true"`. Hover shift via `--bs-icon-link-transform`.
+- **`.focus-ring`** (+ `.focus-ring-primary` … per theme color) — opt-in focus ring for custom interactive elements; tune through `--bs-focus-ring-width` (.25rem), `--bs-focus-ring-opacity` (.25), `--bs-focus-ring-color`, `--bs-focus-ring-x/y/blur`. Use it instead of `outline: none` hacks so keyboard focus stays visible.
+- **`.icon-link`** (+ `.icon-link-hover`) — pairs a Bootstrap Icon SVG with a text link; icon auto-sizes to 1em; give decorative icons `aria-hidden="true"`. Hover shift through `--bs-icon-link-transform`.
 
 ## Enterprise notes (utilities)
 
 ### Composition habits
 
-- **Spacing scale:** prefer `gap-*` on flex/grid parents over scattering `m-*` on every child — the parent owns rhythm, children stay reorderable. Use `p-3` / `p-4` for panel padding; reserve `p-5` for sparse marketing-like empty states.
-- **Body surfaces:** `bg-body`, `bg-body-secondary`, `bg-body-tertiary` track `data-bs-theme` — raw `bg-white` / `bg-light` freeze the surface in light mode.
-- **Text hierarchy:** `text-body` for content, `text-body-secondary` for meta, `text-*-emphasis` for any status a reader acts on. The plain `text-success` / `text-danger` / `text-warning` colors and `text-body-tertiary` are the decoration tier ([SKILL.md](../SKILL.md) → Surfaces, color, contrast).
-- **Opacity traps:** `text-white-50` / `text-black-50` often fail contrast — prefer `text-opacity-75` on a known solid, or `text-body-secondary`. Every one of these pairings is measured against the shipped cascade in both themes; a skin retunes the same token names.
-- **Flex floors:** a flex column gives its items an automatic minimum size, and `text-truncate` removes it. Titles and marks that must keep their height carry `flex-shrink-0`; only the growing sibling absorbs the slack.
-- **Flex toolbars:** `d-flex align-items-center gap-2 flex-wrap` (or `flex-nowrap overflow-auto` for dense bars). Equal-height siblings: `align-items-stretch` + `h-100` on cards.
-- **Responsive hide:** show the best layout per breakpoint (`d-none d-md-block` vs `d-md-none`) rather than cramming one layout everywhere. Below `sm`, hide button captions (`d-none d-sm-inline` on the label span, `aria-label` on the control so the accessible name stays) before you let the brand or page title truncate.
-- **RTL safety:** always `ms-*`/`me-*`/`ps-*`/`pe-*`, `text-start`/`text-end`, `float-start`/`float-end` — the logical model is what lets one build serve LTR and RTL.
-- **Density as a system:** when a screen offers compact/comfortable density, drive it from a token or wrapper class that swaps padding — not ad-hoc `-sm` sprinkling per element ([bootstrap-reference.md](bootstrap-reference.md) → Design tokens).
-- **Shadows:** `shadow-sm` for panels in product UI; `shadow-lg` rarely belongs in dense admin screens.
-- **Print:** mark chrome `d-print-none`; keep the data table/results printable.
+- **Spacing:** let the parent own rhythm with `gap-*`; use margins where the relationship requires
+  them. Choose panel padding from the shared scale, not a separate value per card. Keep labels,
+  controls, help, and errors closer together than neighboring groups: `.form-label` ships `.5rem`
+  below, so field groups take `mb-3` or `row g-3`. Headings ship `margin-bottom: .5rem` and no top
+  margin, so a section heading after a paragraph attaches to the wrong block — add `mt-4`/`mt-5`
+  or let a `vstack gap-4` parent own the rhythm. In a row, `hstack gap-2` inside a group and
+  `gap-4` between groups. Start a gap one step too large and step down.
+- **Hierarchy:** use `fw-normal` for reading and `fw-semibold`/`fw-bold` for emphasis; headings
+  ship at 500, barely a step above body on a system stack, so pair a smaller heading class with
+  `fw-semibold` (`<h2 class="h5 fw-semibold">`) rather than a large heading at 500. Never
+  `fw-light` on UI text. Start ordinary text and quiet status with inheritance; add
+  `text-body-secondary` as the one quiet tier. Do not make metadata tiny or translucent to quiet
+  it. Quiet a heavy icon beside a label with `text-body-secondary` on the icon, not a larger label.
+  Quiet an active nav item's competitors (inherited text, normal weight) before making the active
+  item louder.
+- **Type:** `fs-*` changes size, not semantic heading level. Choose `lh-*` by the text's role;
+  `lh-1` suits a glyph or suitable display treatment, not every paragraph. Keep prose start-aligned
+  and bound its measure independently of wider content.
+- **Baseline:** use `align-items-baseline` for mixed-size text on one row. Keep `align-items-center`
+  for controls or icon/text combinations where the boxes, rather than text baselines, need to align.
+- **Body surfaces:** `bg-body`, `bg-body-secondary`, and `bg-body-tertiary` track `data-bs-theme`.
+  Keep ordinary text inherited on those surfaces; use an explicit pair only at an owned boundary.
+  Take exceptions from [color-modes.md](color-modes.md).
+- **Opacity:** do not use `text-white-50`, `text-black-50`, or `text-opacity-*` as the default secondary
+  tier. On colored fills, inherit the tested foreground or use a scoped opaque token. Any opacity
+  changes the composited contrast, including opacity on an ancestor.
+- **Width:** use `w-100` inside a content-led maximum width, not `w-50` merely to avoid a wide form.
+  Stock Bootstrap has no prose-measure, fixed-rail, or zero-inline-minimum utility. Generate needed
+  roles through [bootstrap-reference.md](bootstrap-reference.md) → Layout and type extensions.
+- **Flex floors:** allow a flexible main region to shrink without clipping its essential content.
+  Protect titles or marks that must retain height with `flex-shrink-0`. Do not add `overflow-hidden`
+  to an ancestor to conceal a layout bug; it can clip menus and focus rings.
+- **Toolbars:** start with `d-grid gap-2` or labelled `row g-2` controls; expand with `d-sm-flex
+flex-sm-wrap` or `col-md-auto` only when the container fits. Do not default to a horizontal
+  scroller for search or primary actions. Keep matching control sizes and usable hit areas. Align equal-height
+  cards only where their content benefits, not to fill empty space.
+- **Responsive content:** follow [responsive-layout.md](responsive-layout.md); unprefixed utilities define the complete narrow task. A class that resolves can still implement the wrong layout. Reflow and prioritize before truncating. Hide a button caption only when
+  its remaining icon is recognizable and its accessible name remains complete; unfamiliar or
+  consequential actions keep visible labels. Do not erase task information to save the brand's width.
+- **Links:** use persistent underlines for inline prose links. In conventional navigation, quieter
+  color and weight can carry hierarchy; retain visible hover and focus. Never rely on hover alone
+  for discovery. An action remains a button even when styled with `btn-link`.
+- **RTL:** use `ms-*`/`me-*`/`ps-*`/`pe-*`, `text-start`/`text-end`, and logical custom properties;
+  verify the matching RTL build and the content's writing direction.
+- **Density:** drive compact/comfortable variants from shared tokens or a wrapper, not scattered
+  per-element tweaks. Dense data retains readable text and ≥24px control targets.
+- **Boundaries and depth:** separate with spacing first, then a surface change, then a shadow, then
+  a line: `bg-body-tertiary` panels instead of bordered ones; `card border-0 shadow-sm` on a page
+  surface that differs from the card; `list-group-flush`, `accordion-flush`, `table-borderless`,
+  `border-0` on a `card-header`; `gap-4` instead of an `<hr>`. Remove a border where a distinct
+  background already separates. Use `border-0` or `shadow-none` only when grouping and control
+  recognition survive. Assign `shadow-sm`, `shadow`, and `shadow-lg` by layer role; do not shadow
+  every panel or replace the focus indicator with depth. A `bg-body` panel on `bg-body-tertiary`
+  reads raised and `bg-body-secondary` inside `bg-body` reads inset — depth with no shadow, in
+  both modes.
+- **Accents and decoration:** one accent border per region (see [Borders](#borders)); the shipped
+  `nav-underline` is the active-item accent. Alternate `bg-body` and `bg-body-tertiary` sections
+  before decorating; a `bg-primary-subtle` band emphasizes one panel. `bg-gradient` is a
+  white-to-transparent fade over the current fill, not a hero gradient.
+- **Overlap:** `position-relative translate-middle-y` for a card that straddles two surfaces;
+  `mt-n*` only after `$enable-negative-margins`. Ring an overlapping avatar in the body color
+  with `rounded-circle border border-3` plus the `ring-body` class from
+  [bootstrap-reference.md](bootstrap-reference.md) → Elevation and depth, never `border-white`.
+- **Images:** combine a declared frame or ratio with `object-fit-cover` only when cropping is safe;
+  take `object-fit-contain` when the whole asset matters. Guard a user upload against bleeding into
+  a same-color surface with `border border-black border-opacity-10` — translucent, so it does not
+  clash with the photo. Reduce a photo's dynamics before placing text on it: a `bg-dark
+bg-opacity-50` (or `-75`) overlay layer under `card-img-overlay`, measured at every crop. Keep a
+  small glyph near 16–24 px inside `rounded-circle bg-primary-subtle p-3` rather than scaling it up.
+  Keep useful image detail and icon optical size rather than stretching assets to fill a box.
+- **Lists and quotes:** `list-unstyled` with a meaningful glyph per item (`d-flex gap-2
+align-items-baseline`, glyph `aria-hidden="true"`); `.blockquote` with `.blockquote-footer`.
+- **Print:** mark chrome `d-print-none` and keep results readable; do not hide data merely because
+  its interactive controls have no print role.

package/dist/host/agents/skills/orkestrel-debrief/references/field-testing.md

@@ -8,10 +8,10 @@ model consumes.
 Test from the top down, and do not stop at the tier that passes:
 
 1. **Frontier** (the harness's default model) — proves the surface works at all.
-2. **Mid tier** (e.g. a codex mechanical model) — proves the surface survives a harness's
-   schema abbreviation and a model that reads less carefully.
-3. **Small harness-native** (e.g. Haiku, a codex high-volume model) — the acceptance
-   tier: these must walk the surface unaided, or the surface is not done.
+2. **Mid tier** (for example, a codex mechanical model) — proves the surface survives a
+   harness's schema abbreviation and a model that reads less carefully.
+3. **Small harness-native** (for example, Haiku or a codex high-volume model) — the
+   acceptance tier: these must walk the surface unaided, or the surface is not done.
 4. **Local floor** (a quantized 2B-class model through a real tool-calling client) — not
    an acceptance gate; a stochastic probe that exposes teaching gaps nothing else hits.
    Its residual failures must be provably consumer-floor (malformed emission, attention
@@ -29,7 +29,7 @@ Test from the top down, and do not stop at the tier that passes:
 - **Caps and journals.** Every pass runs as a tracked background command under a hard
   time cap with its transcript journaled; the journal is the evidence of record.
 
-## Capture the reasoning, not just the calls
+## Capture the reasoning, not the calls alone
 
 Where the runtime exposes thinking (local runtimes expose it directly; harness stream
 formats carry interstitial text), record it. The call log shows WHAT failed; the trace

package/dist/host/agents/skills/orkestrel-falsify/references/reconcile.md

@@ -120,7 +120,7 @@ leaves this round is the procedure.
 
 When a round certifies an instrument — a pin, an identity check, a generated sweep — the controls
 are usually drawn from whatever the instrument obviously covers, because that is where the examples
-are easiest to construct. That sampling proves discrimination _within_ the population and is
+take the least construction. That sampling proves discrimination _within_ the population and is
 routinely reported as proof the instrument works.
 
 So before running controls, write down the instrument's **membership rule** in one sentence, then

package/dist/host/agents/skills/orkestrel-publish/SKILL.md

@@ -10,8 +10,9 @@ description: Run an Orkestrel release from layer order to registry confirmation.
 Read the current files in this order:
 
 1. `AGENTS.md` and every applicable `.claude/rules/*.md` file.
-2. `.agents/orchestration.md` § Publishing the fleet and § Long-running commands. Each named
-   section binds every step here.
+2. `.agents/orchestration.md` § Publishing the fleet, § Long-running commands, § Orchestrator and
+   executor, § Writing concurrency, and § Dispatch anatomy. Each named section binds every step
+   here.
 3. The reference the moment needs: [wave.md](references/wave.md) before visiting a repository,
    ruling on a bump, or preparing a layer; [window.md](references/window.md) before running
    `npm login` or any upload.
@@ -42,21 +43,17 @@ following the skill.
    Derive each pin from that reading, never from a local manifest.
 3. **Visit each repository.** Run the visit in [wave.md](references/wave.md) in its stated order,
    in parallel slices of disjoint repositories, each slice serial inside itself.
-4. **Rule on each package's bump.** Apply the triggers in [wave.md](references/wave.md). A package
-   whose published surface did not move takes its re-pin, its gates, and a commit to `main`, and
-   does not publish.
-5. **Prepare the whole layer before authenticating.** Bump, re-pin, install, sweep the self-pins,
-   run each package's own `prepublishOnly` to green, commit, and push. Every one of those steps
-   happens outside the window.
+4. **Rule on each package's bump.** Apply the triggers in [wave.md](references/wave.md) § Rule on
+   the bump; the contract's § What a bump obliges owns the blast radius.
+5. **Prepare the whole layer before authenticating**, in the order [wave.md](references/wave.md)
+   § Prepare a layer fixes. Every one of those steps happens outside the window.
 6. **Reach the approval.** Follow [window.md](references/window.md), and launch the login chain
    only after the user signals they are at the keyboard.
 7. **Authorize and upload.** Follow [window.md](references/window.md). Take the account's one-time
-   code where it has one, because that path opens no window. Where the account answers with no
-   code, the browser authorization opens the five-minute window: open the layer with one package,
-   confirm its upload from the registry, then chase the remaining uploads back-to-back.
-8. **Close the layer from the registry, then prepare the next.** A dependent's new pin cannot
-   install until the version it names exists, so preparation and publication interleave and cannot
-   be batched ahead.
+   code where it has one; § Authorize the upload there fixes that code's life and the layer it
+   carries. Where the account answers with no code, follow § Spend the window there.
+8. **Close the layer from the registry, then prepare the next**, per [wave.md](references/wave.md)
+   § Prepare a layer.
 
 Run that sequence for every layer, from the registry reading to the registry close. Refresh the
 registry evidence between layers rather than carrying the previous round's reading forward.
@@ -71,7 +68,10 @@ Completion requires:
   that section requires;
 - every tarball swap is restored per § Fixing a dependency before it publishes, and no target
   repository is left holding an uncommitted bump or an unpushed commit;
-- every gate that proved a package ran outside the window and against the artifact that shipped.
+- every gate that proved a package ran outside the window and against the artifact that shipped;
+- every gate red at a package's baseline for a cause `ROADMAP.md` already carries is recorded as a
+  standing reading beside the package's row with its carrier, and the release report names it. A
+  standing reading is not a gate the release ran.
 
 Report the layers in publish order, each package with its registry-confirmed version, the bump
 rulings and their evidence, the approvals the user granted, and anything still unpublished. End

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -10,9 +10,11 @@ prepare the next.
 Run the visit in this order. A step that reads generated or installed state is invalid before the
 step that writes it.
 
-1. Re-pin the target's `@orkestrel/scaffold` devDependency and install, so the overwrite runs the
-   current vendored host.
-2. Run `scaffold overwrite`. One run repairs the `AGENTS.md` and `CLAUDE.md` pointers and deletes
+1. Re-pin every `@orkestrel` range to the registry caret (peer ranges included) and install, so
+   the overwrite runs the current vendored host.
+2. Commit the manifest and the lockfile as the preparation commit. `scaffold overwrite` refuses a
+   tree carrying uncommitted changes, and the install left both dirty.
+3. Run `scaffold overwrite`. One run repairs the `AGENTS.md` and `CLAUDE.md` pointers and deletes
    every tracked copy the target still holds at an instruction-canon path. Prove the sweep with a
    second `scaffold audit` that exits `0`.
    - Where the target's `.claude/agents/orkestrel.md` carries a body outside the marker-bounded
@@ -30,12 +32,16 @@ step that writes it.
      rather than waiving past it.
    - A copy the target git-ignores stays a `foreign` finding, so that target never reaches exit `0`
      again. Keep a local MCP server registration outside the repository rather than at `.mcp.json`.
-3. Force-verify every `@orkestrel` range against a registry sweep taken after the previous layer
+4. Force-verify every `@orkestrel` range against a registry sweep taken after the previous layer
    published.
-4. Run the full install.
-5. Run the mutating `format` script to converge generated writes.
-6. Run the quality gates.
-7. Compare the rebuilt `dist/` against the published tarball for material content.
+5. Run the full install. The overwrite re-declares the toolchain ranges, so the lockfile the first
+   install regenerated no longer matches the manifest.
+6. Sweep the self-pins, per § Sweep the self-pins: the re-pin moves the snapshot class.
+7. Run the mutating `format` script to converge generated writes.
+8. Run the quality gates.
+9. Fetch the published tarball, then compare the rebuilt `dist/` against it for material content.
+   An absent baseline is an unanswered comparison, never a moved dist: fetch and re-run rather than
+   ruling a bump owed.
 
 Restore any unpublished tarball the target is holding before the quality gates run, per
 `.agents/orchestration.md` § Fixing a dependency before it publishes. A distribution proof run
@@ -69,7 +75,15 @@ final runtime dependency set differs from the published packument.
   per package rather than assuming it: a package that imports its own `package.json` version into
   published code emits that version, so its pre-bump dist is stale the moment the version moves.
   Rebuild after the bump there and pack from the rebuilt tree. The `npm publish --ignore-scripts`
-  command skips `prepack`, so that rebuild is the operator's step rather than the publish's.
+  command skips `prepack`, so that rebuild is the operator's step rather than the publish's. The
+  same holds for a package that writes its declared ranges into published output: its `dist/`
+  moves on a development re-pin, and `.agents/orchestration.md` § What a bump obliges rules that
+  re-pin a release.
+
+One trigger orders rather than bumps. A package the fleet consumes as a development dependency,
+whose consumers' gates read its unpublished tip, publishes on its own account ahead of the layer
+order and again at its own slot after its runtime ranges move: each consumer's visit installs the
+registry copy over any staged tip, so every consumer stays red until that tip is on the registry.
 
 ## Prepare a layer
 
@@ -77,16 +91,22 @@ An unpublished package's first version is `0.0.1`. Do not bump it before that fi
 registry has nothing to serve, so there is no version to move away from, and bumping produces a
 package whose history starts at a number nothing explains.
 
-Prepare a published package's layer in this order:
+Prepare a published package's layer in this order, after the visit has ruled the package's bump:
 
 1. **Bump from what the registry serves, not from the local manifest.** A repository's `version`
    field can sit a release behind what was published from another checkout, and bumping that
    produces a version the registry already holds, which fails on upload after the whole gate chain
    has run. Read the registry first.
-2. **Re-pin every `@orkestrel` range to what the registry serves, and install.**
-3. **Sweep the self-pins**, per the following section.
+2. **Re-pin every `@orkestrel` range to what the registry serves, and install.** The visit's
+   preparation commit already precedes the overwrite; this install regenerates the lockfile for the
+   bumped manifest.
+3. **Sweep the self-pins**, per the following section: the bump moves the version class.
 4. **Run each package's own `prepublishOnly` script to green.**
-5. **Commit and push before the window opens.**
+5. **Write the release commit and push before the window opens.** The preparation commit inside
+   the visit is a different commit at a different moment.
+
+Where an inventory taken before the round already ruled every dist moved, the bump rides the
+visit's first step and these steps fold into the visit, whose comparison then confirms the ruling.
 
 Prepare the next layer only after this one is on the registry. A dependent's new pin cannot
 install until the version it names exists, so preparation and publication interleave and cannot be
@@ -99,12 +119,17 @@ the flag is what stops the gate chain running a second time inside the five minu
 ## Sweep the self-pins
 
 A package's own version appears in its source and its tests as a literal, and a bump falsifies
-every one of them. Run this sweep after the re-pin install, not after the manifest edit.
+every one of them. A snapshot of generated output carries the ranges the package writes rather than
+its own version, and any re-pin, a development one included, falsifies it. Run this sweep after the
+re-pin install, not after the manifest edit.
 
-- `grep` the prior version literal across `tests/` and `src/` in the publishing package, and rule
-  on every hit. A canned packument in a fixture and a looked-up version in a CLI suite carry the
+- Search `tests/` and `src/` in the publishing package for the prior version literal, and rule on
+  every hit. A canned packument in a fixture and a looked-up version in a CLI suite carry the
   version with no tripwire comment beside them, so they surface as a red gate after the bump
   rather than as a planned edit before it.
+- Search `tests/` for the prior range of every re-pinned dependency, and move each snapshot the
+  search hits with the re-pin. A generated-manifest fixture never carries the package's own prior
+  version, so the version sweep cannot reach it.
 - Move a documented tripwire — a golden digest over generated output — in the same change as the
   version bump. That is what the tripwire is for.
 - Re-take a generated artifact's digest after the install, because the generated bytes can derive
@@ -120,4 +145,5 @@ every one of them. Run this sweep after the re-pin install, not after the manife
 
 Refresh the registry evidence between layers and derive each round's pins from it. A pin can only
 name a version the registry already serves, so a dependency shipping in the same window keeps the
-resolvable previous pin and takes its development-only re-pin after the window closes.
+resolvable previous pin and takes its development-only re-pin after the window closes. That re-pin
+takes the self-pin sweep too, because the snapshot class moves with no bump.

package/dist/host/agents/skills/orkestrel-publish/references/window.md

@@ -1,10 +1,10 @@
 # The approval and the upload window
 
 A release needs the user at the keyboard to authenticate the session, and again to authorize each
-upload. An approval URL dies unclicked in under a minute, so mint one only in a
-moment the user can click, and relay it byte for byte. Where the account answers with a one-time
-code, take that code for the upload — it needs no browser authorization and opens no window to
-lose. Where the account has no code, the browser authorization opens a five-minute window, and the
+upload. An approval URL dies unclicked in under a minute, so mint one only in a moment the user can
+click, and relay it byte for byte. Where the account answers with a one-time code, take that code
+for the upload — it needs no browser authorization, and § Authorize the upload states the code's own
+life. Where the account has no code, the browser authorization opens a five-minute window, and the
 rest of the layer either fits inside it or takes another approval.
 
 ## Arm the terminal
@@ -25,8 +25,11 @@ rest of the layer either fits inside it or takes another approval.
   zero.
 - Re-probe `whoami` immediately before the first upload. A stored credential expires mid-session
   and an overnight gap expires it, so a session-start answer does not hold.
-- Read a login log that shows the spinner and then a legacy `Username:` prompt as an expired
-  attempt rather than as a prompt to answer. Kill it by process id and mint a fresh flow.
+- Read a login log that shows the spinner and then a legacy `Username:` prompt as a dead attempt
+  rather than as a prompt to answer: expired, or refused on its first poll per § Read a `403` on the
+  poll. Kill it by the process id recorded at its launch, per `.agents/orchestration.md` § Confirm
+  dead before relaunching. Every publish here runs under the same `script -qfc` form, so a pattern
+  over the process list reaches a live upload as readily as the dead login.
 - On a Windows host, Git Bash ships no `script` binary, so the upload step is operator-driven:
   prepare the layer, prove the gates, surface the exact `npm publish` command, and the operator
   runs it in a real terminal. Everything before and after the upload — bumps, re-pins, gates,
@@ -49,13 +52,17 @@ rest of the layer either fits inside it or takes another approval.
   against `registry.npmjs.org` with `npm` 10.9.7 and `node` 22.22.2: npm polls `GET /-/v1/done`
   every few seconds and takes `202` while the session waits, and the registry answers `403` at
   about 45 seconds. Whether the registry fixes that abandon by elapsed time or by poll count is
-  unmeasured, so plan against the duration.
+  unmeasured, so plan against the duration. A `403` within seconds of the mint is not that abandon;
+  § Read a `403` on the poll names it.
 - Recognise the abandon on each side. The `npm login` command reads the `403` as web login being
   unsupported and drops to its legacy `Username:` prompt. The `npm publish` command exits `E403`
   naming `GET /-/v1/done?authId=`.
 - Never keep a link alive by re-minting on a loop. Each mint invalidates the URL before it, so a
   supervisor that re-mints on expiry makes the link a moving target and every relayed URL is dead
-  on arrival. Mint once per human moment, and mint again only when the user asks.
+  on arrival. Mint once per human moment, and mint again only when the user asks. That ban covers
+  a URL already relayed. While no URL has been relayed, mint attempts until one survives its own
+  first poll, relay that one alone, and kill the rest by process id; § Read a `403` on the poll
+  names the first-poll refusal this answers.
 - Name the login approval and the upload authorization to the user before either arrives, or the
   authorization link reads as the login having failed.
 - Surface each approval URL the moment it appears in the log, and take the **last** one in log
@@ -75,17 +82,23 @@ rest of the layer either fits inside it or takes another approval.
 
 - Take the account's one-time code where the account has one. The
   `npm publish --ignore-scripts --otp=<code>` command uploads with no browser authorization and no
-  poll, so it carries neither a window nor a race. In the `@orkestrel/scaffold` 0.0.56 run on
-  2026-08-27 the browser authorization failed on the 45-second abandon and the one-time code
-  uploaded the package with no retry.
-- Ask for the code at the moment of the upload, and run the upload inside that code's own life. A
-  code read minutes earlier is already spent.
+  poll. The code has its own life: measured on 2026-09-04 against `registry.npmjs.org`, one code
+  carried every upload of a layer started within about a minute of its first use, console at
+  20:25:02 through router at 20:25:58, and the upload started at 20:25:58 was refused `EOTP` at
+  20:26:00; a code read before its layer was ready was refused at its first upload.
+- Prepare the whole layer, then ask for one code at the moment the layer's first upload starts, and
+  chase the layer's uploads back-to-back inside that code's life with no gate between them. A code
+  read minutes earlier is already spent.
+- Read `EOTP` on this path as the code's life ending, never as the contention § Spend the window
+  describes for the browser path: the chain stops at the refused package, and the layer resumes
+  from that package on a fresh code. Never retry the refused upload on the same code.
 - Ask for the code and nothing else. Never ask for a password, an access token, or an auth file.
   `.agents/orchestration.md` § Publishing the fleet owns that law.
 - Arm a one-time-code upload the way § Arm the terminal arms every other publish.
 - Fall back to the browser authorization where the account answers with no code. That path mints
   the `auth/cli/<id>` URL, needs the click inside the session's life, and opens the five-minute
-  window.
+  window. In the `@orkestrel/scaffold` 0.0.56 run on 2026-08-27 that authorization failed on the
+  45-second abandon and the one-time code uploaded the package with no retry.
 - Tell the user that approving an `auth/cli/<id>` URL opens a five-minute window covering the rest
   of the layer.
 
@@ -95,7 +108,8 @@ rest of the layer either fits inside it or takes another approval.
   window, so none of it binds that path.
 - The window opens when the user approves, not when the first publish starts.
 - Open each layer with one package: publish it alone, surface its approval URL the moment the
-  journal shows it, and confirm the upload from the registry before starting the rest.
+  journal shows it, and read its acceptance line in the journal before starting the rest; the
+  registry read confirms it.
 - Then chase the remaining uploads back-to-back in one process with no gap. An upload started
   within seconds of an approval frequently rides that approval, and each one that does not mints
   its own URL.
@@ -127,14 +141,25 @@ the same status. Rule from the evidence, never from which cause reads likelier.
   opened, and the registry closed the session.
 - The user clicked a superseded URL and poisoned the live attempt. The poll fails mid-flight while
   the user is looking at a page that reports success.
+- The registry refused the attempt's first poll, seconds after the mint and before anyone could
+  click, because the poll left from an egress address other than the one that minted the session.
+  npm reads that `403` as web login unsupported and drops to the legacy `Username:` prompt within
+  seconds rather than at 45. Recover by minting attempts on a kept-alive connection until one
+  survives its first poll and relaying that one alone, per § Reach the approval.
 - Tell those causes apart from the log and the user, never from the status alone. A single minted
   URL that nobody opened in time is the abandon. A log carrying a URL the running attempt
-  superseded, with the user reporting a click, is the poisoned attempt.
+  superseded, with the user reporting a click, is the poisoned attempt. A drop within seconds of
+  the mint, before any relay, is the egress refusal.
 - Recover the same way whichever it was: read the registry for the version, confirm no publish
   process is live, then mint exactly one fresh attempt with the user at the keyboard.
 
 ## Read the verdict from the registry
 
+- Read `+ @orkestrel/<name>@<version>` in the upload's own journal as the accepted verdict, and
+  advance the chain on it. The registry's read lags its processing by minutes, which the
+  `Your package is being processed and may take a few minutes to become available.` notice beside
+  that line announces, so a chain keyed on the registry stops on an accepted upload. Read the
+  registry to confirm and to record the layer's close, never to gate the next upload.
 - Read the result from the registry, not from an exit code. A piped `npm publish` reports the exit
   status of the pipeline, and a CDN read straight after a publish can still serve the previous
   version.