@orkestrel/scaffold 0.0.64 → 0.0.65

package/dist/host/agents/skills/enterprise-bootstrap/references/utilities.md

@@ -24,7 +24,7 @@
 .bg-opacity-10, .bg-opacity-25, .bg-opacity-50, .bg-opacity-75, .bg-opacity-100
 ```
 
-Prefer `bg-body-*` and `*-subtle` over `bg-white`/`bg-light` — they track `data-bs-theme` so dark mode works without extra rules.
+Prefer `bg-body`, `bg-body-secondary`, `bg-body-tertiary`, and `bg-*-subtle` for quiet surfaces; inherit text without an added foreground class. Treat original contextual `bg-*`, including `bg-light` and `bg-dark`, as non-adaptive in stock 5.3. Take ownership and exceptions from [color-modes.md](color-modes.md).
 
 ### Borders
 
@@ -39,7 +39,11 @@ Prefer `bg-body-*` and `*-subtle` over `bg-white`/`bg-light` — they track `dat
 .rounded-0, .rounded-1, .rounded-2, .rounded-3, .rounded-4, .rounded-5
 ```
 
-For borders that must stay visible in both color modes, prefer the `border-*-subtle` classes (theme-adaptive) over raw color borders.
+Use adaptive border roles for quiet separation. Measure boundaries needed to identify a control or state; `border-*-subtle` adapts but does not automatically meet the contrast bar.
+
+- **`border-{1..5}` sets `border-width` on every side.** On a component that already has a border (`.card`, `.alert`) it thickens the whole box. For a one-side accent, zero first, restore one side, then widen — `card border-0 border-top border-4 border-primary` — utility source order (`border` → `border-{side}` → `border-width`) makes it hold, and the cleared sides have no border style so their width never paints.
+- Strengthen a rule that reads too faint with `border-2` on its soft color, not with a darker color; heavier width keeps the softness.
+- `border-{color}` is the fixed brand color in both modes; check an accent against a dark `bg-*-subtle` before shipping it.
 
 ### Colors (Text)
 
@@ -48,10 +52,13 @@ For borders that must stay visible in both color modes, prefer the `border-*-sub
 .text-body, .text-body-secondary, .text-body-tertiary, .text-body-emphasis
 .text-primary-emphasis, .text-secondary-emphasis, .text-success-emphasis, .text-danger-emphasis, .text-warning-emphasis, .text-info-emphasis, .text-light-emphasis, .text-dark-emphasis
 .text-black, .text-white, .text-black-50, .text-white-50
-.text-muted        /* DEPRECATED in 5.3 — use .text-body-secondary; removed in v6 */
+.text-muted        /* Deprecated in 5.3; use a deliberate .text-body-secondary role instead. */
+.text-reset        /* Restore inherited color; not the same as .text-body. */
 .text-opacity-25, .text-opacity-50, .text-opacity-75, .text-opacity-100
 ```
 
+Default ordinary text to inheritance. Original contextual `text-*` colors do not adapt in stock 5.3; body-role and `text-*-emphasis` colors do. `text-body-secondary` (body color at .75 alpha) clears 4.5:1 on every stock body surface in both modes; `text-body-tertiary` (.5 alpha) measures 3.0–4.1:1 and is decoration or disabled only. Neither, nor `text-white-50`, is a quiet tier on a colored fill — take the same-hue token from [color-modes.md](color-modes.md) → Text tiers. Do not add emphasis text automatically to subtle fills, and do not replace a component's native foreground without inspecting its state contract.
+
 ### Display
 
 ```css
@@ -120,6 +127,8 @@ For borders that must stay visible in both color modes, prefer the `border-*-sub
 .link-offset-1, .link-offset-2, .link-offset-3
 ```
 
+Keep normal links on Bootstrap's link rules inside prose. Where most things are links — navigation, lists, tables — use `link-body-emphasis link-underline-opacity-0 link-underline-opacity-100-hover link-offset-2`: body tone, underline on hover and focus, and the one colored-link helper that adapts to dark mode; add `fw-semibold` where the link is the row's identity. For a brand underline that completes on hover: `link-underline-primary link-underline-opacity-50 link-underline-opacity-100-hover link-offset-2`. Do not replace hover/focus rules with a text-color utility.
+
 ### Object Fit
 
 ```css
@@ -133,6 +142,8 @@ For borders that must stay visible in both color modes, prefer the `border-*-sub
 .opacity-0, .opacity-25, .opacity-50, .opacity-75, .opacity-100
 ```
 
+Opacity is not a text tier: it reads as disabled and lets the surface show through the glyphs. Do not use whole-element opacity to quiet a region containing readable text. Color-opacity utilities affect only rules that consume their variable; stock subtle backgrounds do not consume `--bs-bg-opacity`. Measure the composited result rather than assuming a tint.
+
 ### Overflow
 
 ```css
@@ -160,6 +171,8 @@ For borders that must stay visible in both color modes, prefer the `border-*-sub
 .shadow-none, .shadow-sm, .shadow, .shadow-lg
 ```
 
+Three elevation steps: `shadow-sm` (`0 .125rem .25rem` at .075) for slightly raised cards and controls, `shadow` (`0 .5rem 1rem` at .15) for floating menus and a dragged item, `shadow-lg` (`0 1rem 3rem` at .175) for dialogs. Stock dropdowns, popovers, toasts, and modals all sit on `--bs-box-shadow`; lift a modal to the top step through `--bs-modal-box-shadow` ([bootstrap-reference.md](bootstrap-reference.md) → Elevation and depth). No shadow is a valid role.
+
 ### Sizing
 
 Bootstrap ships exactly these — nothing else (no `.vw-25`, `.vh-50`, `.mw-auto`, or `.min-vh-75`; add missing steps through the utilities API if a project truly needs them — see [bootstrap-reference.md](bootstrap-reference.md)):
@@ -222,14 +235,16 @@ Notes: `s`/`e` are logical start/end — they flip automatically under RTL; neve
 /* Size */
 .fs-1, .fs-2, .fs-3, .fs-4, .fs-5, .fs-6
 
-/* Truncate — needs display block/inline-block or a flex child with min-width 0 */
+/* Truncate — needs a constrained inline width and block/inline-block layout */
 .text-truncate
 ```
 
+`fs-6…1` = 1 · 1.25 · 1.5 · 1.75 · 2 · 2.5 rem (16–40 px at the default root); `display-6…1` = 2.5–5 rem. Values above 1.25 rem scale down fluidly below a 1200 px viewport under RFS; `fs-5`, `fs-6`, `.lead`, and controls do not. There is no `rem` step below 1 rem: `.small` and `<small>` are `.875em`, so use one level only — `.small` inside `.small` is 12.25 px, off every scale — and take a 14 px or 12 px role from the generated `fs-sm`/`fs-xs` ([bootstrap-reference.md](bootstrap-reference.md) → Layout and type extensions). Stock 5.3 ships no letter-spacing utility; generate `ls-tight`/`ls-wide` there for display text and `text-uppercase` labels. `fw-light`/`fw-lighter` (300) belong only at display size; `.lead` and `display-*` ship at 300 by design.
+
 The composition traps in this group:
 
 - **`fs-*` without `lh-1` grows the row.** A resized glyph or mark keeps the parent's line-height, so the line box stretches and the row sits taller than its neighbors. Pair `fs-*` with `lh-1` on anything that is a mark rather than a paragraph.
-- **`text-truncate` zeroes a flex item's automatic minimum size** (that's the `min-width: 0` it carries). Inside a flex _column_, that also removes the floor that kept a heading at its own height: a growing sibling then squeezes the title from the bottom until it clips. Floor the title with `flex-shrink-0` and let the growing sibling absorb the change.
+- **`text-truncate` is not a minimum-size utility.** It sets hidden overflow, ellipsis, and no wrapping; it does not declare `min-width: 0`. Give the truncating element a constrained width and make its flex ancestry shrink where required. In a constrained column, protect a title from height loss with `flex-shrink-0`. Take any missing inline-size utility from the project's generated scale, never an invented `.min-w-0`.
 
 ### Vertical Align
 
@@ -261,6 +276,17 @@ The composition traps in this group:
 | `5`    | $spacer \* 3 (3rem = 48px)     |
 | `auto` | auto                           |
 
+Use the installed scale as the first choice. Assign its steps to internal, group, panel, and section
+gaps; keep inter-group gaps larger than internal gaps. Compare adjacent steps before adding one.
+The displayed pixel equivalents assume the default root size; they are not fixed pixel constraints.
+
+The shipped jumps are +100 / +100 / +50 / +100 %: coarse above 16 px, with no 12 px or 32 px
+step and nothing above 48 px for section rhythm. A missing step is not permission to type `p-2.5`
+or `p-6`; those resolve to no rule and fail silently. Add a named step through
+[bootstrap-reference.md](bootstrap-reference.md) → Layout and type extensions and verify the
+generated class in the shipped build. Take type, width, and spacing decisions from
+[frontend-design.md](frontend-design.md).
+
 ## Z-index Scale (components)
 
 | Component          | Z-index |
@@ -299,14 +325,77 @@ Helpers are single-purpose classes that sit alongside utilities.
 
 ### Composition habits
 
-- **Spacing scale:** prefer `gap-*` on flex/grid parents over scattering `m-*` on every child — the parent owns rhythm, children stay reorderable. Use `p-3` / `p-4` for panel padding; reserve `p-5` for sparse marketing-like empty states.
-- **Body surfaces:** `bg-body`, `bg-body-secondary`, `bg-body-tertiary` track `data-bs-theme` — raw `bg-white` / `bg-light` freeze the surface in light mode.
-- **Text hierarchy:** `text-body` for content, `text-body-secondary` for meta, `text-*-emphasis` for any status a reader acts on. The plain `text-success` / `text-danger` / `text-warning` colors and `text-body-tertiary` are the decoration tier ([SKILL.md](../SKILL.md) → Surfaces, color, contrast).
-- **Opacity traps:** `text-white-50` / `text-black-50` often fail contrast — prefer `text-opacity-75` on a known solid, or `text-body-secondary`. Every one of these pairings is measured against the shipped cascade in both themes; a skin retunes the same token names.
-- **Flex floors:** a flex column gives its items an automatic minimum size, and `text-truncate` removes it. Titles and marks that must keep their height carry `flex-shrink-0`; only the growing sibling absorbs the slack.
-- **Flex toolbars:** `d-flex align-items-center gap-2 flex-wrap` (or `flex-nowrap overflow-auto` for dense bars). Equal-height siblings: `align-items-stretch` + `h-100` on cards.
-- **Responsive hide:** show the best layout per breakpoint (`d-none d-md-block` vs `d-md-none`) rather than cramming one layout everywhere. Below `sm`, hide button captions (`d-none d-sm-inline` on the label span, `aria-label` on the control so the accessible name stays) before you let the brand or page title truncate.
-- **RTL safety:** always `ms-*`/`me-*`/`ps-*`/`pe-*`, `text-start`/`text-end`, `float-start`/`float-end` — the logical model is what lets one build serve LTR and RTL.
-- **Density as a system:** when a screen offers compact/comfortable density, drive it from a token or wrapper class that swaps padding — not ad-hoc `-sm` sprinkling per element ([bootstrap-reference.md](bootstrap-reference.md) → Design tokens).
-- **Shadows:** `shadow-sm` for panels in product UI; `shadow-lg` rarely belongs in dense admin screens.
-- **Print:** mark chrome `d-print-none`; keep the data table/results printable.
+- **Spacing:** let the parent own rhythm with `gap-*`; use margins where the relationship requires
+  them. Choose panel padding from the shared scale, not a separate value per card. Keep labels,
+  controls, help, and errors closer together than neighboring groups: `.form-label` ships `.5rem`
+  below, so field groups take `mb-3` or `row g-3`. Headings ship `margin-bottom: .5rem` and no top
+  margin, so a section heading after a paragraph attaches to the wrong block — add `mt-4`/`mt-5`
+  or let a `vstack gap-4` parent own the rhythm. In a row, `hstack gap-2` inside a group and
+  `gap-4` between groups. Start a gap one step too large and step down.
+- **Hierarchy:** use `fw-normal` for reading and `fw-semibold`/`fw-bold` for emphasis; headings
+  ship at 500, barely a step above body on a system stack, so pair a smaller heading class with
+  `fw-semibold` (`<h2 class="h5 fw-semibold">`) rather than a large heading at 500. Never
+  `fw-light` on UI text. Start ordinary text and quiet status with inheritance; add
+  `text-body-secondary` as the one quiet tier. Do not make metadata tiny or translucent to quiet
+  it. Quiet a heavy icon beside a label with `text-body-secondary` on the icon, not a larger label.
+  Quiet an active nav item's competitors (inherited text, normal weight) before making the active
+  item louder.
+- **Type:** `fs-*` changes size, not semantic heading level. Choose `lh-*` by the text's role;
+  `lh-1` suits a glyph or suitable display treatment, not every paragraph. Keep prose start-aligned
+  and bound its measure independently of wider content.
+- **Baseline:** use `align-items-baseline` for mixed-size text on one row. Keep `align-items-center`
+  for controls or icon/text combinations where the boxes, rather than text baselines, need to align.
+- **Body surfaces:** `bg-body`, `bg-body-secondary`, and `bg-body-tertiary` track `data-bs-theme`.
+  Keep ordinary text inherited on those surfaces; use an explicit pair only at an owned boundary.
+  Take exceptions from [color-modes.md](color-modes.md).
+- **Opacity:** do not use `text-white-50`, `text-black-50`, or `text-opacity-*` as the default secondary
+  tier. On colored fills, inherit the tested foreground or use a scoped opaque token. Any opacity
+  changes the composited contrast, including opacity on an ancestor.
+- **Width:** use `w-100` inside a content-led maximum width, not `w-50` merely to avoid a wide form.
+  Stock Bootstrap has no prose-measure, fixed-rail, or zero-inline-minimum utility. Generate needed
+  roles through [bootstrap-reference.md](bootstrap-reference.md) → Layout and type extensions.
+- **Flex floors:** allow a flexible main region to shrink without clipping its essential content.
+  Protect titles or marks that must retain height with `flex-shrink-0`. Do not add `overflow-hidden`
+  to an ancestor to conceal a layout bug; it can clip menus and focus rings.
+- **Toolbars:** start with `d-grid gap-2` or labelled `row g-2` controls; expand with `d-sm-flex
+flex-sm-wrap` or `col-md-auto` only when the container fits. Do not default to a horizontal
+  scroller for search or primary actions. Keep matching control sizes and usable hit areas. Align equal-height
+  cards only where their content benefits, not to fill empty space.
+- **Responsive content:** follow [responsive-layout.md](responsive-layout.md); unprefixed utilities define the complete narrow task. A class that resolves can still implement the wrong layout. Reflow and prioritize before truncating. Hide a button caption only when
+  its remaining icon is recognizable and its accessible name remains complete; unfamiliar or
+  consequential actions keep visible labels. Do not erase task information to save the brand's width.
+- **Links:** use persistent underlines for inline prose links. In conventional navigation, quieter
+  color and weight can carry hierarchy; retain visible hover and focus. Never rely on hover alone
+  for discovery. An action remains a button even when styled with `btn-link`.
+- **RTL:** use `ms-*`/`me-*`/`ps-*`/`pe-*`, `text-start`/`text-end`, and logical custom properties;
+  verify the matching RTL build and the content's writing direction.
+- **Density:** drive compact/comfortable variants from shared tokens or a wrapper, not scattered
+  per-element tweaks. Dense data retains readable text and ≥24px control targets.
+- **Boundaries and depth:** separate with spacing first, then a surface change, then a shadow, then
+  a line: `bg-body-tertiary` panels instead of bordered ones; `card border-0 shadow-sm` on a page
+  surface that differs from the card; `list-group-flush`, `accordion-flush`, `table-borderless`,
+  `border-0` on a `card-header`; `gap-4` instead of an `<hr>`. Remove a border where a distinct
+  background already separates. Use `border-0` or `shadow-none` only when grouping and control
+  recognition survive. Assign `shadow-sm`, `shadow`, and `shadow-lg` by layer role; do not shadow
+  every panel or replace the focus indicator with depth. A `bg-body` panel on `bg-body-tertiary`
+  reads raised and `bg-body-secondary` inside `bg-body` reads inset — depth with no shadow, in
+  both modes.
+- **Accents and decoration:** one accent border per region (see [Borders](#borders)); the shipped
+  `nav-underline` is the active-item accent. Alternate `bg-body` and `bg-body-tertiary` sections
+  before decorating; a `bg-primary-subtle` band emphasizes one panel. `bg-gradient` is a
+  white-to-transparent fade over the current fill, not a hero gradient.
+- **Overlap:** `position-relative translate-middle-y` for a card that straddles two surfaces;
+  `mt-n*` only after `$enable-negative-margins`. Ring an overlapping avatar in the body color
+  with `rounded-circle border border-3` plus the `ring-body` class from
+  [bootstrap-reference.md](bootstrap-reference.md) → Elevation and depth, never `border-white`.
+- **Images:** combine a declared frame or ratio with `object-fit-cover` only when cropping is safe;
+  take `object-fit-contain` when the whole asset matters. Guard a user upload against bleeding into
+  a same-color surface with `border border-black border-opacity-10` — translucent, so it does not
+  clash with the photo. Reduce a photo's dynamics before placing text on it: a `bg-dark
+bg-opacity-50` (or `-75`) overlay layer under `card-img-overlay`, measured at every crop. Keep a
+  small glyph near 16–24 px inside `rounded-circle bg-primary-subtle p-3` rather than scaling it up.
+  Keep useful image detail and icon optical size rather than stretching assets to fill a box.
+- **Lists and quotes:** `list-unstyled` with a meaningful glyph per item (`d-flex gap-2
+align-items-baseline`, glyph `aria-hidden="true"`); `.blockquote` with `.blockquote-footer`.
+- **Print:** mark chrome `d-print-none` and keep results readable; do not hide data merely because
+  its interactive controls have no print role.

package/dist/host/claude/rules/workspace.md

@@ -166,8 +166,8 @@ the `test:bench` script joins no chain, so no gate runs either mode; the project
 ignored by git; and `.claude/rules/tests.md` governs what may live there.
 
 - Define a cross-cutting project only for a proof the package actually has.
-- A live-service project is the `service` project in the preceding table, `scripts/service.sh`
-  provisions what it drives, and `.claude/rules/tests.md` governs it. Name it `service` whatever it
+- Prepare the external service before invoking the `service` project. Use `tests/setupService.ts`
+  to verify readiness, apply `.claude/rules/tests.md`, and name the project `service` whatever it
   drives.
 - In a publishing workspace, a project leaves the default run when it drives a live external
   service or is hermetic but slow — it spawns processes, packs, installs, or drives a real build.

package/dist/host/claude/settings.json

@@ -977,7 +977,7 @@
 					},
 					{
 						"type": "command",
-						"command": "\"$CLAUDE_PROJECT_DIR\"/scripts/ollama.sh",
+						"command": "if [ \"${CLAUDE_CODE_REMOTE:-}\" = \"true\" ]; then \"$CLAUDE_PROJECT_DIR\"/scripts/ollama.sh; fi",
 						"timeout": 600
 					},
 					{

package/dist/host/claude/skills/enterprise-bootstrap/SKILL.md

@@ -1,19 +1,20 @@
 ---
 name: enterprise-bootstrap
 description: >-
-  Design and build distinctive, production-grade user interfaces with Bootstrap
-  5.3 and intentional frontend craft, in any host project and on any stack. Use
-  for Bootstrap user-interface work — creating, restyling, or
+  Design and build distinctive, production-grade UI with Bootstrap 5.3 on any
+  stack. Use for any Bootstrap interface work — creating, restyling, or
   extending pages, screens, components, layouts, app shells, dashboards, admin
   panels, SaaS tools, data tables, filter bars, forms, wizards, navigation,
   modals, empty/loading/error states, dark mode, marketing surfaces — whenever
   the task touches HTML/CSS/visual design, mentions Bootstrap or its components,
-  or must look professional and avoid templated defaults. Covers aesthetics,
-  typography, color modes, design tokens, accessibility (WCAG 2.2 AA),
-  responsive layout, and enterprise app patterns. The `orkestrel-polish-surface`
-  skill owns a requested verdict, round, or campaign over a surface that already
-  renders, including a review that changes nothing. In that campaign's fix
-  units, use this skill for Bootstrap craft.
+  asks for visual hierarchy, polish, a design system, or spacing/type/color
+  scales, or must look professional rather than like stock Bootstrap. Covers
+  aesthetics, typography, color modes, design tokens, elevation, finishing
+  details, accessibility (WCAG 2.2 AA), responsive layout, and enterprise app
+  patterns. The `orkestrel-polish-surface` skill owns a requested verdict,
+  round, or campaign over a surface that already renders, including a review
+  that changes nothing; in that campaign's fix units, use this skill for
+  Bootstrap craft.
 ---
 
 # Load the canonical workflow

package/dist/host/guides/scaffold.md

@@ -33,7 +33,7 @@ print. Limits states what that leaves unproven and what covers it instead.
 npm install --save-dev @orkestrel/scaffold
 ```
 
-The executable needs Node 22.12 or later. Run it through `npx` without installing:
+The executable needs Node 22.18.0 or later. Run it through `npx` without installing:
 
 ```sh
 npx @orkestrel/scaffold --help
@@ -149,13 +149,14 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `MAX_TOTAL_ARTIFACT_BYTES`        | const | Caps the bytes retained across one whole plan or audit.                                                |
 | `MAX_TOTAL_REGISTRY_BYTES`        | const | Caps the decoded bytes accepted across one registry-reading call.                                      |
 | `MINIMUM_NODE_VERSION`            | const | Names the oldest Node version the generated toolchain supports.                                        |
+| `MINIMUM_NPM_VERSION`             | const | Names the oldest npm version the generated toolchain supports.                                         |
 | `NAME_PATTERN`                    | const | Matches the bare workspace name syntax: lowercase alphanumeric with hyphens, letter first.             |
 | `ORCHESTRATION_PATH_NAMES`        | const | Lists the exact root paths that wire an agent bench or own an orchestration directory, frozen.         |
 | `ORCHESTRATION_PATH_PREFIXES`     | const | Lists the path prefixes whose contents instruct or wire an agent, frozen.                              |
 | `ORKESTREL_RANGE_PATTERN`         | const | Matches the exact caret-pinned pre-1.0 range accepted for an `@orkestrel/*` runtime dependency.        |
 | `PRINT_WIDTH`                     | const | Caps the columns one emitted line may occupy, matching `printWidth` in `.oxfmtrc.json`.                |
 | `RELEASE_PROOF_COMMAND`           | const | Names the `prepublishOnly` row that runs the packed-package proof against a real registry.             |
-| `SERVICE_SCRIPT_PATH`             | const | Names the provisioner skeleton a workspace with declared service vendors is given once.                |
+| `SERVICE_SCRIPT_PATH`             | const | Names the inventory skeleton a workspace with declared service vendors is given once.                  |
 | `SERVICE_SETUP_PATH`              | const | Names the live-service readiness module whose presence makes a workspace `service`.                    |
 | `SERVICE_TEST_INCLUDE`            | const | Names the include the live-service project covers, which is a directory rather than one proof.         |
 | `SHOWCASE_CONFIG_PATH`            | const | Names the Vite wrapper whose presence makes a workspace `showcase`.                                    |
@@ -164,6 +165,7 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `SRC_MATRIX`                      | const | Holds the build and export settings each published `src` environment contributes, frozen.              |
 | `TAB_WIDTH`                       | const | Sets the columns one tab occupies when the formatter measures a line, matching `tabWidth`.             |
 | `VERSION_PATTERN`                 | const | Matches the exact `major.minor.patch` version syntax a blueprint declares.                             |
+| `WORKSPACE_DEV_ENGINES`           | const | Holds the `devEngines` record every generated manifest carries.                                        |
 | `WORKSPACE_OWNED_PATHS`           | const | Lists the vendored paths whose present bytes belong to each workspace, frozen.                         |
 
 #### Guards
@@ -565,9 +567,10 @@ other structural facts do not need creation flags. Add a root `tests/setup*.test
 `setup`, `tests/guides.test.ts` for `guides`, `tests/integration.test.ts` for `integration`,
 `tests/conformance.test.ts` for `conformance`, `tests/setupService.ts` for `service`,
 `tests/setupGlobal.ts` for `global`, and `configs/app/vite.showcase.config.ts` for `showcase`;
-reading verbs detect each exact-case file and register its fixed machinery. Add `scripts/service.sh`
-for `vendors`. Reading verbs preserve and protect that birth-owned script, but do not infer its
-vendor list from edited text.
+reading verbs detect each exact-case file and register its fixed machinery. An explicitly supplied
+plan with `vendors` owns and protects the birth-owned `scripts/service.sh` inventory skeleton.
+Reading verbs do not infer its vendor list from edited text and cannot preserve an arbitrary present
+script on that basis.
 
 `distribution` is not on that list. Publishing at least one `src` environment is its whole
 condition, and scaffold writes `tests/distribution.test.ts` itself rather than waiting for you to.
@@ -586,10 +589,10 @@ and `configs/app/vite.showcase.config.ts` selects `showcase`. A containing direc
 the fact by itself. `tests/distribution.test.ts` selects nothing: the published `src` axis the
 target ships already decides the `distribution` project, and the file is planned from that.
 
-`vendors` is not reconstructed. Its only artifact, `scripts/service.sh`, is birth-owned, so edited
-script text is not a trustworthy declaration of a vendor list. A present script remains in the
-target and remains protected from deletion through the owned scripts inventory, but a reading verb
-does not infer vendors from it.
+`vendors` is not reconstructed. Its artifact, `scripts/service.sh`, is a birth-owned inventory
+skeleton rather than a working installer, so edited script text is not a trustworthy declaration of
+a vendor list. A target-reading verb derives no vendor list from a present script. Only an
+explicitly supplied plan with `vendors` owns that birth artifact.
 
 That is why the live-service project follows `service` rather than `vendors`. A reading verb has to
 plan the project before it can say anything about a target that runs one, and a vendor list it
@@ -774,7 +777,7 @@ const blueprint = createBlueprint('router', {
 })
 
 blueprint.version // '0.0.1'
-blueprint.engines // '>=22.12.0'
+blueprint.engines // '>=22.18.0'
 ```
 
 `src` selects published library environments and `app` selects private application environments.
@@ -846,12 +849,13 @@ is the one proof scaffold generates from the workspace's own shape.
 
 `service` says the workspace runs a live-service Vitest project over `tests/service`, and it alone
 registers that project, its `test:service` script, and the `tests/setupService.ts` readiness module
-the project names. A publishing workspace invokes it from `prepublishOnly`; a `private: true`
-workspace invokes it from `test`, which is the only gate it has. Its longer timeouts and disabled
-file parallelism are the same in both. `vendors` names each external service the workspace drives
-and emits `scripts/service.sh`, the provisioner that starts them. Neither is derivable from the
-other: a workspace may declare vendors before it writes a suite, and a suite may drive a service the
-skeleton does not start.
+the project names. The caller prepares the external service before it invokes the project, and the
+setup module verifies readiness. A publishing workspace invokes the project from `prepublishOnly`;
+a `private: true` workspace invokes it from `test`, which is the only gate it has. Its longer
+timeouts and disabled file parallelism are the same in each workspace form. `vendors` names each external service the
+workspace drives and emits `scripts/service.sh`, an inventory skeleton that starts nothing. The
+vendor inventory and live-service setup are independent: a workspace may declare vendors before it
+writes a suite, and a suite may drive a service the skeleton does not start.
 
 `integration` projects a cross-environment composition proof for any workspace, independently of
 whether it has a published `src`. Its generated seed imports every selected `src` and `app`
@@ -901,7 +905,7 @@ one that answers it. So `new` refuses on any question, blocking or not, before i
 `audit` and `repair` carry the same questions through, because a target that already has that shape
 still has to be described and restored.
 
-A library caller creating a fresh workspace applies `new`'s rule itself:
+A library caller creating a fresh workspace itself applies the rule the `new` command follows:
 
 ```ts
 import { Compiler, createBlueprint } from '@orkestrel/scaffold'
@@ -1059,8 +1063,9 @@ after a write it prints `next: npm run format`.
 
 Scaffold owns the `scripts` directory. An audit for the orchestration group reports every unplanned
 member as foreign. `overwrite` deletes an unplanned tracked member only when the tree is clean, its
-observed bytes still match, and the path is not protected. A planned birth-owned
-`scripts/service.sh` survives that deletion pass.
+observed bytes still match, and the path is not protected. An unplanned tracked
+`scripts/service.sh` is retired on that basis. An explicitly planned birth-owned script survives
+that deletion pass.
 
 `tests/distribution.test.ts` is the one proof scaffold generates, and the one test artifact it
 claims by presence. Generation is the line, not writing: scaffold writes the vendored
@@ -1252,11 +1257,30 @@ licence, the harness permission file, the scaffold-owned `scripts` directory, th
 shared policy register, the shared policy proof, the shared policy plugin, the shared configuration
 leaf and its proof, the byte-identical root dotfiles, and the guide mirrors a generated workspace
 starts from. It is a candidate list rather than a plan, because a workspace never mirrors its own
-guide. The session-start hooks inside `scripts` split by job:
-the bench probe reports whether a bench CLI resolves, and the dependency hook installs the
-lockfile's closure in a remote session. What wires a bench stays in the canon, and a session reads
+guide. The session-start hooks inside `scripts` split by job. The bench probe reports whether a
+bench CLI resolves, and the dependency hook installs the lockfile's closure in a remote session.
+The Ollama hook invokes `scripts/ollama.sh` only when `CLAUDE_CODE_REMOTE=true`; direct invocation
+remains available for live-service setup. What wires a bench stays in the canon, and a session reads
 it at its primary root.
 
+`scripts/ollama.sh` defaults to `http://127.0.0.1:11434` and `qwen3.5:2b-q4_K_M`. It requires Node
+for native URL and JSON handling and curl for the HTTP protocol. The script accepts an HTTP or HTTPS
+origin without credentials, path, query, or fragment. It reuses any reachable daemon without
+requiring a local Ollama executable. It inspects the selected model through `/api/show`, pulls only
+after a `404` absence response, and warms the model through a completed non-streaming `/api/chat`
+request with a 30-minute keep-alive. Version readiness, pull completion, and warm completion each
+require a `2xx` HTTP status; redirects and error statuses fail even when their bodies report
+completion.
+
+When an HTTP loopback endpoint is unreachable, the script may start an installed Ollama executable
+in an owned POSIX process group. A failure sends that owned group `TERM`, then sends `KILL` if it
+does not stop within 5 seconds; a reused daemon remains untouched. Direct reuse works from Git Bash on Windows, but local startup there fails because Bash
+cannot safely terminate the Windows process tree. Automatic installation is limited to Linux cloud
+or CI automation. The official installer download follows only HTTPS redirects, must be nonempty,
+and runs within the remaining setup deadline. The installer may require root or `sudo`, and its own
+platform prerequisites remain authoritative. The full setup deadline is 590 seconds, including a
+60-second local startup allowance, within the hook's 600-second timeout.
+
 `CANON_PATHS` is the instruction canon, staged for reading instead: the `AGENTS.md` coding contract,
 the `CLAUDE.md` harness bridge, the `.agents/orchestration.md` agent-operation contract, the rules
 under `.claude/rules/` and `.cursor/rules/`, the skills under `.agents/skills/` and `.claude/skills/`,
@@ -1424,6 +1448,23 @@ except the manifest.
 - One host artifact per vendored path the workspace selects. A vendored directory is one planned
   path that expands into the files the data root stores beneath it.
 
+Every generated manifest declares the toolchain it is gated on. The `engines.node` field carries
+the blueprint's `engines` value, which defaults to the `>=22.18.0` range. The
+`devEngines.packageManager` record names npm at the `>=11.6.0` range with its `onFail` key set to
+the `error` value, and no blueprint field varies that record. An npm at 10.9.0 or later reads that
+record. Such an npm earlier than 11.6.0 refuses the `npm install` command in a generated workspace
+with the `EBADDEVENGINES` code, before resolving the dependency graph.
+npm 10.9.7 refuses an `npm run` command in such a workspace with the same code. The releases
+measured earlier than 10.9.0, npm 10.5.0 and npm 10.8.3, ignore the record and fail inside
+dependency resolution instead. Every Node release at 22.18.0 or later bundles an npm at 10.9.0 or
+later. A generated workspace on Node 22.18.0 or later therefore meets an npm that ignores the record
+only under an npm other than the bundled one. Run a generated workspace on npm 11.6.0 or later:
+every release from 10.9.0 up to 11.6.0 refuses it, and 11.6.0 installs it. Read the ambient
+version with the `npm --version` command. Raise it with the `npm install --global npm@11.6.0`
+command before the first install; that command installs an npm that reports
+11.6.0. The npm readings come from a Linux host on Node 22.22.2, on 2026-09-13, and the bundled
+versions come from the Node release index read that day.
+
 A workspace publishing a `src` environment rolls each published face's declarations up from that
 face's own Vite config. The seeded config calls `declarationRollup` from the vendored
 `configs/helpers.ts`, which runs the workspace's own compiler as a command —

package/dist/host/manifest.json

@@ -28,7 +28,7 @@
 			"storage": "agents/skills/enterprise-bootstrap/SKILL.md",
 			"destination": ".agents/skills/enterprise-bootstrap/SKILL.md",
 			"executable": false,
-			"digest": "6ed9e288539cbe7a7fbd25b13cf759ecedd72101189e0317fbabf82d1aa1aef4"
+			"digest": "f58af98acfa62de842476c17e71c1a98aad250cb4336a160019320a5dd6dacad"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/agents/openai.yaml",
@@ -40,37 +40,49 @@
 			"storage": "agents/skills/enterprise-bootstrap/references/bootstrap-reference.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/bootstrap-reference.md",
 			"executable": false,
-			"digest": "98379b5905cba4cc3725df7ddd8fd9ec19dce75ff89e68499b20ac27c53478c7"
+			"digest": "07ab83158aeeaabd965c285de6a30cbe28241e808bcad848fd6c7197fa6b9d12"
+		},
+		{
+			"storage": "agents/skills/enterprise-bootstrap/references/color-modes.md",
+			"destination": ".agents/skills/enterprise-bootstrap/references/color-modes.md",
+			"executable": false,
+			"digest": "c089bd32922e1d6ec74b55afc7cac184f6f8c58a75653647c26ddc814682bcdb"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/components.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/components.md",
 			"executable": false,
-			"digest": "252de08e786aa41834f13df4d115e33b3c56d897ccea00b95ed4912da62fbd89"
+			"digest": "f4c9b5f2f8e7482aac2aebb0c3a837095c3ff9e8a309db1ee256673a7fdf2553"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/frontend-design.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/frontend-design.md",
 			"executable": false,
-			"digest": "8ce1985267316610f4b68582cc993fa2d3f3a504e3e7f2c35e9d9d0e982891a1"
+			"digest": "90e5242046776118b18f0489e5cbc82ac498935dc8c29ec2644b53327d89955c"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/inputs.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/inputs.md",
 			"executable": false,
-			"digest": "17fb8a977d34a0ef25f5155ac6459e805cc4f691d819995eb85838dca6c8fa46"
+			"digest": "7e536b0651a3347019b140d1fac29e00dba38234ae37a93e3c34281086da0cdf"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/inspection.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/inspection.md",
 			"executable": false,
-			"digest": "48b202e331c17a26f8262b30095898e6d147906847a74d3779907c0aad4de43b"
+			"digest": "152548af42ef9322cfb398b9a6d64352f39c912c31ee324016c13959e4cfa34b"
+		},
+		{
+			"storage": "agents/skills/enterprise-bootstrap/references/responsive-layout.md",
+			"destination": ".agents/skills/enterprise-bootstrap/references/responsive-layout.md",
+			"executable": false,
+			"digest": "a933fdf530d4001cc9a75d24b103d111efc428d146d2c8cf9ea934891ca21019"
 		},
 		{
 			"storage": "agents/skills/enterprise-bootstrap/references/utilities.md",
 			"destination": ".agents/skills/enterprise-bootstrap/references/utilities.md",
 			"executable": false,
-			"digest": "0601721056882a7d45bfaa9ca0a03aa39e1259876f16546d4bf19b4b9496e023"
+			"digest": "5176a2b292cab40a1b954134042c27c4a19077a999c9f13f9bc16d8dd007063b"
 		},
 		{
 			"storage": "agents/skills/orkestrel-align-packages/SKILL.md",
@@ -448,7 +460,7 @@
 			"storage": "claude/rules/workspace.md",
 			"destination": ".claude/rules/workspace.md",
 			"executable": false,
-			"digest": "5e69fa5bb2b439c640d1d73204418309d310a9de5a28212b8756de09f4af5d2d"
+			"digest": "5fbf4f0e9803ef1e4cbaa12a2cfb896cec1188f9c2fc3e020b93923319c91b2f"
 		},
 		{
 			"storage": "claude/rules/writing.md",
@@ -460,13 +472,13 @@
 			"storage": "claude/settings.json",
 			"destination": ".claude/settings.json",
 			"executable": false,
-			"digest": "c5c379bf5001754d11b94e692f7624e0a59c7e4b2b2072569b115c3723c24ee7"
+			"digest": "52c5aafe0f3a891a909a5ce26ad761abb38f2ab931f084f5ca147abb7680c419"
 		},
 		{
 			"storage": "claude/skills/enterprise-bootstrap/SKILL.md",
 			"destination": ".claude/skills/enterprise-bootstrap/SKILL.md",
 			"executable": false,
-			"digest": "1e2c83abb2a7c6a2e41dc210202d25124f6a30cfdc1bbd44d6b9c59dded6d93f"
+			"digest": "0973f97ccd042e53d33f72396fe1924b1de98f2a2c27338615279bb1d569e000"
 		},
 		{
 			"storage": "claude/skills/orkestrel-align-packages/SKILL.md",
@@ -682,7 +694,7 @@
 			"storage": "guides/scaffold.md",
 			"destination": "guides/scaffold.md",
 			"executable": false,
-			"digest": "660f6f9443c16252ad92afb0c78802908c5d2ded69a461a8e83bb12c71ea43db"
+			"digest": "3f26b6d6649a7fb5882c02d674c5c10386706e87a5305b863a0d2028a2bf5043"
 		},
 		{
 			"storage": "scripts/codex.sh",
@@ -706,7 +718,7 @@
 			"storage": "scripts/ollama.sh",
 			"destination": "scripts/ollama.sh",
 			"executable": true,
-			"digest": "666979b75f02c7f550c3acc74a02b67594407b887e6a8b90f0ba38a0d79bec07"
+			"digest": "be5cb42991792190d7f61c7b8eef568eaf207db67cce5d2ccc223af814f2d6fa"
 		},
 		{
 			"storage": "tests/config.test.ts",
@@ -773,5 +785,5 @@
 		".cursor/rules",
 		"scripts"
 	],
-	"digest": "0327bc72ce35efe56b959fea41d06a8334b9c9fd318b6ea005efd46b8ef0fd46"
+	"digest": "06692c3a078815c3d4e0ed00c4280ce381119a1c1005334b1372c137e758dc18"
 }