@orkestrel/scaffold 0.0.84 → 0.0.86

package/dist/host/AGENTS.md

@@ -34,7 +34,7 @@ configs/  thin target wrappers around root Vite/TypeScript configuration
 
 - **NEVER** use `any`; accept `unknown` and narrow with guards.
 - **NEVER** use non-null assertions (`!`) or type assertions (`as`); narrow or validate.
-- **NEVER** use `@ts-nocheck`, `@ts-ignore`, `@ts-expect-error`, or a lint-disable directive; fix the cause.
+- **NEVER** use `@ts-nocheck`, `@ts-ignore`, `@ts-expect-error`, a lint-disable directive, or a formatter-ignore directive, and never exclude a source file from a gate; fix the cause.
 - **NEVER** add an npm package unless the user explicitly requests it; prefer native APIs.
 - **NEVER** remove a symbol to silence lint. Implement it or annotate `// TODO: [Feature] Brief purpose`.
 - **NEVER** write `public`, `protected`, `private`, or a parameter property; use `#` fields.

package/dist/host/agents/skills/orkestrel-publish/SKILL.md

@@ -20,12 +20,12 @@ description: Run an Orkestrel release from layer order to registry confirmation.
 
 ## Scripts
 
-| Script               | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scripts/compare.ts` | `[--package NAME] [--version V] [--tarball PATH] [--dist dist] [--json]`, run from the package root after its build: fetches the published tarball and lists the material differences from the rebuilt `dist/` (sourcemaps excluded, whitespace-only differences ignored). Exit 0 when nothing differs, 3 when something does, 2 when the tarball cannot be read, 64 on usage (no package name, no `dist/`, or `--tarball` with no path).                                                                                                                                                                                                                                                                                                                                             |
-| `scripts/pins.ts`    | `--version PRIOR [--range PRIOR_RANGE ...] [--paths src,tests] [--json]`, run from the package root: lists every line under the paths carrying the prior version literal or a prior range literal, once per line, sweeping a one-comparator range such as `^8.3.0` for its bare version in any form. Exit 0 with no hits, 3 with hits, 64 on usage (no literal, or a flag with no value).                                                                                                                                                                                                                                                                                                                                                                                             |
-| `scripts/wave.ts`    | `--visit [--target DIR] [--offline] [--from STEP] [--to STEP] [--prior VERSION] [--dry-run] [--json] [--out FILE]` runs one repository's visit in the order [wave.md](references/wave.md) § Visit a repository fixes (pin, commit, overwrite, verify, install, pins, format, gates, compare), stops at the first failing step, and prints each step's exit, the bump ruling (the rebuilt dist against the published tarball, and the final runtime dependency set against the published manifest), and a row for `.orkestrel/release.md`; `--prior` names the version a pre-ruled bump replaced so the self-pin sweep finds it; `--plan` prints the packages by layer from the catalog table. Exit 0 when every step passed, 1 when one failed, 2 when a reading failed, 64 on usage. |
-| `scripts/window.ts`  | `--whoami [--wait SECONDS]` reads or polls `npm whoami`; `--login` prints the operator's login command and polls `whoami` until it answers; `--publish DIR... --otp CODE` uploads back to back with `npm publish --ignore-scripts --otp`, journals each upload under `tmp/units/`, stops at the first refusal naming where to resume, and confirms each accepted version against the registry; `--confirm NAME@VERSION...` re-reads the registry until it serves the version. Exit 0 on success, 3 when not.                                                                                                                                                                                                                                                                          |
+| Script               | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scripts/compare.ts` | `[--package NAME] [--version V] [--tarball PATH] [--dist dist] [--json]`, run from the package root after its build: fetches the published tarball and lists the material differences from the rebuilt `dist/` (sourcemaps excluded, whitespace-only differences ignored). Exit 0 when nothing differs, 3 when something does, 2 when the tarball cannot be read, 64 on usage (no package name, no `dist/`, or `--tarball` with no path).                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `scripts/pins.ts`    | `--version PRIOR [--range PRIOR_RANGE ...] [--paths src,tests] [--json]`, run from the package root: lists every line under the paths carrying the prior version literal or a prior range literal, once per line, sweeping a one-comparator range such as `^8.3.0` for its bare version in any form. Exit 0 with no hits, 3 with hits, 64 on usage (no literal, or a flag with no value).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `scripts/wave.ts`    | `--visit [--target DIR] [--offline] [--from STEP] [--to STEP] [--prior VERSION] [--dry-run] [--json] [--out FILE]` runs one repository's visit in the order [wave.md](references/wave.md) § Visit a repository fixes (pin, commit, overwrite, verify, install, pins, format, gates, compare), stops at the first failing step, and prints each step's exit (a failed step names the `code: message` refusal or the `note` a JSON verb writes on stdout, else the last stderr lines), the bump ruling (the rebuilt dist against the published tarball, and the final runtime dependency set against the published manifest), and a row for `.orkestrel/release.md`; `--prior` names the version a pre-ruled bump replaced so the self-pin sweep finds it; `--plan` prints the packages by layer from the catalog table. Exit 0 when every step passed, 1 when one failed, 2 when a reading failed, 64 on usage. |
+| `scripts/window.ts`  | `--whoami [--wait SECONDS]` reads or polls `npm whoami`; `--login` prints the operator's login command and polls `whoami` until it answers; `--publish DIR... --otp CODE` uploads back to back with `npm publish --ignore-scripts --otp`, journals each upload under `tmp/units/`, stops at the first refusal naming where to resume, and confirms each accepted version against the registry; `--confirm NAME@VERSION...` re-reads the registry until it serves the version. Exit 0 on success, 3 when not.                                                                                                                                                                                                                                                                                                                                                                                                   |
 
 The user's current instruction wins. `references/release.md` owns the credential
 and authorization law; nothing here weakens it.

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -35,8 +35,9 @@ by hand only to repair it, then resume with `--from <step>`.
      again. Keep a local MCP server registration outside the repository rather than at `.mcp.json`.
 4. Force-verify every `@orkestrel` range against a registry sweep taken after the previous layer
    published.
-5. Run the full install. The overwrite re-declares the toolchain ranges, so the lockfile the first
-   install regenerated no longer matches the manifest.
+5. Run the full install. The overwrite re-declares the toolchain ranges and declares each planned
+   dependency the manifest lacks, so the lockfile the first install regenerated no longer matches the
+   manifest.
 6. Sweep the self-pins, per § Sweep the self-pins: the re-pin moves the snapshot class.
 7. Run the mutating `format` script to converge generated writes.
 8. Run the quality gates.
@@ -107,6 +108,10 @@ Prepare a published package's layer in this order, after the visit has ruled the
    bumped manifest.
 3. **Sweep the self-pins**, per the following section: the bump moves the version class.
 4. **Run each package's own `prepublishOnly` script to green.**
+   When the host npm is below the `MINIMUM_NPM_VERSION` floor a generated workspace declares in
+   `devEngines`, prepend a local npm 11 install's `node_modules/.bin` to `PATH` for the visit and
+   this script; a distribution proof that installs a generated workspace under an older npm fails
+   `EBADDEVENGINES`.
 5. **Write the release commit and push before the window opens.** The preparation commit inside
    the visit is a different commit at a different moment.
 
@@ -152,3 +157,10 @@ Refresh the registry evidence between layers and derive each round's pins from i
 name a version the registry already serves, so a dependency shipping in the same window keeps the
 resolvable previous pin and takes its development-only re-pin after the window closes. That re-pin
 takes the self-pin sweep too, because the snapshot class moves with no bump.
+
+- After a window confirms a release, poll its tarball URL, read with
+  `npm view NAME@VERSION dist.tarball`, until it answers `200` before an install names that
+  version. The registry lists a version in the packument minutes before it serves the tarball, and
+  an install in that gap fails `E404`.
+- Run every visit and install that follows a publish with `npm_config_prefer_online=true`. A
+  cached packument answers `notarget` for a version the registry already serves.

package/dist/host/agents/skills/orkestrel-publish/scripts/wave.ts

@@ -14,11 +14,12 @@
 // fatal), format, gates (format:check, lint:check, check, build, test), and compare (the rebuilt
 // dist against the published tarball, and the final runtime dependency set against the published
 // manifest `npm view NAME --json` serves; both readings are reported, not fatal). The summary
-// carries each step's exit and duration, the bump ruling, and a Markdown row for
-// `.orkestrel/release.md`. --dry-run prints the commands and runs nothing, so its ruling is
-// unanswered. --plan reads the marker-bounded catalog table in `.claude/agents/orkestrel.md` and
-// prints the packages by layer. Exit 0 when every step passed, 1 when a step failed, 2 when a
-// reading failed, 64 on usage.
+// carries each step's exit and duration, a failed step's refusal (the `code: message` envelope or
+// the `note` a JSON verb prints on stdout, else the last stderr lines), the bump ruling, and a
+// Markdown row for `.orkestrel/release.md`. --dry-run prints the commands and runs nothing, so its
+// ruling is unanswered. --plan reads the marker-bounded catalog table in
+// `.claude/agents/orkestrel.md` and prints the packages by layer. Exit 0 when every step passed, 1
+// when a step failed, 2 when a reading failed, 64 on usage.
 import type { SpawnSyncReturns } from 'node:child_process'
 import { spawnSync } from 'node:child_process'
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs'
@@ -158,8 +159,20 @@ function describeCommand(file: string, args: readonly string[]): string {
 	return [file === process.execPath ? 'node' : file, ...args].join(' ')
 }
 
+// A JSON verb writes its refusal envelope or its partial-run note on stdout, so the stderr tail
+// alone reads empty for exactly the failures the operator needs named.
 function describeFailure(result: SpawnSyncReturns<string>): string | undefined {
 	if (result.status === 0) return undefined
+	const value = readJsonObject(result.stdout)
+	const error = value?.error
+	if (typeof error === 'object' && error !== null && !Array.isArray(error)) {
+		const envelope = Object.fromEntries(Object.entries(error))
+		const code = readString(envelope, 'code')
+		const message = readString(envelope, 'message')
+		if (code !== undefined && message !== undefined) return `${code}: ${message}`
+	}
+	const note = readString(value, 'note')
+	if (note !== undefined) return note
 	return result.stderr
 		.trim()
 		.split(/\r\n|\n/)
@@ -341,11 +354,11 @@ function runOverwrite(
 		runner.target,
 	)
 	if (runner.offline && written !== undefined && written.status === 1) {
-		const note = readString(readJsonObject(written.stdout) ?? {}, 'note')
+		const note = readString(readJsonObject(written.stdout), 'note')
 		if (note !== undefined && note.includes(OFFLINE_REFUSAL)) {
 			replaceLastStep(runner, 0, 'offline overwrite skipped the catalog step by design')
 		} else {
-			replaceLastStep(runner, 1, note ?? describeFailure(written))
+			replaceLastStep(runner, 1, describeFailure(written))
 		}
 	}
 	if (!failed(runner)) {

package/dist/host/claude/agents/orkestrel.md

@@ -78,7 +78,7 @@ so network-controlled descriptions never enter agent instruction context.
 | `@orkestrel/reason`     | `0.0.12` | L2    | `@orkestrel/emitter` `^0.0.11`, `@orkestrel/contract` `^0.0.18`                                                                                                                                                                                                                                                             |                                                                |
 | `@orkestrel/relation`   | `0.0.14` | L3    | `@orkestrel/emitter` `^0.0.11`, `@orkestrel/contract` `^0.0.18`, `@orkestrel/database` `^0.0.16`                                                                                                                                                                                                                            |                                                                |
 | `@orkestrel/router`     | `0.0.16` | L2    | `@orkestrel/abort` `^0.0.12`, `@orkestrel/emitter` `^0.0.11`, `@orkestrel/contract` `^0.0.18`                                                                                                                                                                                                                               |                                                                |
-| `@orkestrel/scaffold`   | `0.0.83` | L3    | `@orkestrel/console` `^0.0.15`, `@orkestrel/emitter` `^0.0.11`, `@orkestrel/process` `^0.0.14`, `@orkestrel/contract` `^0.0.19`, `@orkestrel/markdown` `^0.0.17`, `@orkestrel/template` `^0.0.9`                                                                                                                            |                                                                |
+| `@orkestrel/scaffold`   | `0.0.85` | L3    | `@orkestrel/console` `^0.0.15`, `@orkestrel/emitter` `^0.0.11`, `@orkestrel/process` `^0.0.14`, `@orkestrel/contract` `^0.0.19`, `@orkestrel/markdown` `^0.0.17`, `@orkestrel/template` `^0.0.9`                                                                                                                            |                                                                |
 | `@orkestrel/sea`        | `0.0.18` | L3    | `@orkestrel/emitter` `^0.0.11`, `@orkestrel/process` `^0.0.14`, `@orkestrel/contract` `^0.0.18`                                                                                                                                                                                                                             |                                                                |
 | `@orkestrel/server`     | `0.0.22` | L3    | `@orkestrel/abort` `^0.0.12`, `@orkestrel/codec` `^0.0.5`, `@orkestrel/router` `^0.0.16`, `@orkestrel/emitter` `^0.0.11`, `@orkestrel/timeout` `^0.0.12`, `@orkestrel/contract` `^0.0.19`                                                                                                                                   |                                                                |
 | `@orkestrel/sqlite`     | `0.0.13` | L1    | `@orkestrel/contract` `^0.0.18`                                                                                                                                                                                                                                                                                             |                                                                |

package/dist/host/claude/rules/architecture.md

@@ -108,8 +108,8 @@ neither reads meaning.
   data-kind file, that every centralized declaration is exported, that a class sits in its matching
   implementation or errors file, and that `constants.ts` declares only UPPER_SNAKE_CASE consts with
   no bare collection literal.
-- The sweep proves that no source, test, config, or script file carries an `eslint-disable` or
-  `oxlint-disable` directive.
+- The sweep proves that no source, test, config, script, or sheet file carries an `eslint-disable`,
+  `oxlint-disable`, or `prettier-ignore` directive.
 - The sweep proves that every `.claude/rules/*.md` file has a rule-map row in `AGENTS.md` and that
   every row resolves to a file.
 - The sweep proves the host portability rules that are path- or text-shaped over the population

package/dist/host/claude/rules/styles.md

@@ -14,14 +14,15 @@ SCSS mirrors TypeScript centralization. Concrete token prefixes are project-spec
 
 ## Centralized files
 
-| File                | Sole responsibility                                           |
-| ------------------- | ------------------------------------------------------------- |
-| `_mixins.scss`      | `@function` values and `@mixin` declaration emitters          |
-| `_tokens.scss`      | `:root` public custom-property tokens and cascade-layer order |
-| `_theme.scss`       | Token overrides under theme selectors                         |
-| `_reset.scss`       | The face's reset declarations, when that face owns a reset    |
-| `themes/index.scss` | Barrel of named theme packs, compiled into its own sheet      |
-| `index.scss`        | Sole compilation barrel                                       |
+| File                | Sole responsibility                                                                                                                                                                               |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `_mixins.scss`      | `@function` values, `@mixin` declaration emitters, and the `!default` switch an emitter reads, which `_tokens.scss` configures through `@use … with`                                              |
+| `_tokens.scss`      | `:root` public custom-property tokens and cascade-layer order                                                                                                                                     |
+| `_theme.scss`       | Token overrides under theme selectors                                                                                                                                                             |
+| `_reset.scss`       | The face's reset declarations, when that face owns a reset                                                                                                                                        |
+| `_utilities.scss`   | The utility map and its emission schedule, on a face that generates its utilities from data; that face has no `utilities/` folder, and the one emitter the schedule calls lives in `_mixins.scss` |
+| `themes/index.scss` | Barrel of named theme packs, compiled into its own sheet                                                                                                                                          |
+| `index.scss`        | Sole compilation barrel                                                                                                                                                                           |
 
 - Apply this table and the folder barrels in § Folders to every sheet face: `src/styles` and each
   `src/<name>` styles extension. `.claude/rules/workspace.md` § Environments fixes the `sheet.ts`
@@ -51,6 +52,14 @@ SCSS mirrors TypeScript centralization. Concrete token prefixes are project-spec
   declared. A face whose contract is the exact recreation of a pinned external artifact keeps
   the literals, declarations, and order the pin declares, and records tokenization and
   accessibility additions in its separate authored face.
+- Format a pinned recreation face like every other file: never a `prettier-ignore` directive and
+  never a `.prettierignore` entry for a source file. Sass re-emits every value and selector it
+  parses in its own form, so the formatter's canonicalisation of those vanishes at compile; a
+  custom-property value is the one text Sass emits verbatim, so write every custom-property
+  declaration in a literal partial as a Sass string interpolation (`--name: #{'VALUE'};`), which the
+  formatter reads as a string and Sass emits byte for byte. Keep a pinned expected output in a JSON
+  fixture, never in a CSS file the formatter would canonicalise. The face's byte proofs (link 1, the
+  per-module region cases, the sample cases) hold under `npm run format`.
 - Never repeat per-color/per-variant blocks; drive shared structure with one `@each` over a shared list.
 - If a pattern appears in at least two partials, move it to `_mixins.scss`.
 - Treat a declaration block two partials share because each records an external value as a
@@ -69,7 +78,7 @@ SCSS mirrors TypeScript centralization. Concrete token prefixes are project-spec
 ## Folders
 
 - Give each folder an `_index.scss` barrel that loads its partials with `@use`; keep the barrel when the folder is empty.
-- Put a rule that styles one element in `elements/`, a class skin that applies with no script running in `components/`, and a class that sets one property in `utilities/`.
+- Put a rule that styles one element in `elements/`, a class skin that applies with no script running in `components/`, and a class that sets one property in `utilities/`. A face that generates its utilities from a map keeps that map and its emission schedule in `_utilities.scss` instead of a `utilities/` folder; never keep both, because `@use 'utilities'` resolves to either.
 - Add another folder only for a job `elements/`, `components/`, and `utilities/` do not hold, and give it its own barrel and its own layer.
 
 ## Proofs

package/dist/host/claude/rules/workspace.md

@@ -287,7 +287,7 @@ Build/check config alignment:
 
 - In a publishing workspace, `prepublishOnly` runs `build:showcase` and every
   `build:showcase:<framework>` script after `npm run build`.
-- List `showcase/` in `.prettierignore`, so formatting never rewrites a committed page.
+- List `showcase/` and `*.min.*` in `.prettierignore`, so formatting never rewrites a committed page or a minified generated record. Give the `.min` suffix only to a record an instrument writes from an installed package in compact form (a JSON inventory over 1 MB, for example), never to authored source, and read such a record through a guarded reader. Never list a source file there; `.claude/rules/styles.md` § Prohibitions states how a pinned recreation stays formatter-stable.
 
 ## Tooling
 

package/dist/host/dotfiles/prettierignore

@@ -15,3 +15,6 @@ tests/mirrors/
 
 # The vendored host inventory: `npm run build` regenerates it (`stageInventory`), so its bytes are the generator's, not the formatter's.
 host.json
+
+# A minified generated record (`*.min.*`, such as a compact JSON inventory an instrument writes from an installed package) keeps its compact bytes: nothing in it is authored, and a formatted copy would be a second artifact of the same bytes. Authored source never takes the suffix.
+*.min.*

package/dist/host/guides/scaffold.md

@@ -306,6 +306,7 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `blueprintToTestArtifacts`          | function | Compiles every artifact in the `tests` group that is not vendored from the host.                         |
 | `blueprintToWritableScripts`        | function | Projects a blueprint into the manifest scripts a region write may replace.                               |
 | `dependenciesToQuestions`           | function | Measures one declared package list against the name and range syntax it accepts.                         |
+| `insertManifestDependencies`        | function | Inserts dependencies a package manifest does not declare into the section each one names.                |
 | `overridesToQuestions`              | function | Measures a blueprint's overrides against the artifacts drafted for it.                                   |
 | `pathToCondition`                   | function | Builds one `exports` condition block for a built environment.                                            |
 | `planToFindings`                    | function | Compares a plan against a target's current content.                                                      |
@@ -539,7 +540,7 @@ option grants a write.
 | `audit`     | Nothing                                                                                    |
 | `repair`    | Each planned path the target is missing or has let drift, and the range and script regions |
 | `catalog`   | The package table, the guide mirrors, and the range region                                 |
-| `overwrite` | Everything `repair` and `catalog` write, plus deletions                                    |
+| `overwrite` | Everything `repair` and `catalog` write, deletions, and missing planned dependencies       |
 
 ### Baselines
 
@@ -589,7 +590,7 @@ scaffold <verb> [options]
   scaffold catalog [--all] [--from <path>] [--target <path>] [--json]
       regenerate the package table and refresh the guide mirrors
   scaffold overwrite [--groups <list>] [--dirty] [--offline] [--from <path>] [--target <path>] [--json]
-      do everything repair and catalog do, then delete what the plan does not own and re-declare the dependency ranges
+      do everything repair and catalog do, then delete what the plan does not own, re-declare the dependency ranges, and declare each planned dependency the manifest lacks
 
 options
   --src <list>                   the published library environments to build: core, browser, server
@@ -802,9 +803,20 @@ live in either section, and how current a declared range is belongs to the regis
 Dependency floors describes rather than to this question. A present section that is not an object
 produces a question instead of a crash. This question belongs to `configs` and `tests`. `audit`
 reports it only when its selection includes either group, without changing its exit semantics.
-`repair` and `overwrite` refuse before writing a selected `configs` or `tests` group. A selection
-that excludes those groups proceeds, and no verb adds the declaration for you: `package.json` is
-birth-owned, and the range and script regions are the only parts of it a verb rewrites.
+`repair` refuses before writing a selected `configs` or `tests` group, and a selection that
+excludes those groups proceeds: `package.json` is birth-owned, and `repair` rewrites only its range
+and script regions. `overwrite` declares each missing package instead, in the `devDependencies` map
+the plan assigns it, at its planned range, before the first declared key that sorts after it. A
+manifest with no `devDependencies` map gets one: `overwrite` creates it as one top-level key after
+`dependencies`, or last in the manifest object when `dependencies` is absent too, in the indentation
+of the manifest's first key. The declaration lands with the repair, before the catalog step, so a
+partial run keeps it. The JSON result names each declaration in `additions`, and the human report
+prints one `Declared "<name>": "<range>" in devDependencies. Run npm install to install it.` line
+per declaration, because the lockfile does not carry the package until the next install. A
+`devDependencies` value that is not an object, or an entry in that map whose value is not a version
+string, leaves `overwrite` no map to declare in. `overwrite` refuses that manifest before any write,
+whatever `--groups` selects, and names the section or each malformed entry. A malformed section
+refuses `repair` as well.
 
 `audit` reports a further non-blocking question, on the `setup` field.
 
@@ -844,6 +856,17 @@ write: a writing verb reports it in the terminal audit it prints, because refusi
 gap no write can close would block every write. Run across a fleet, the question is the list of
 packages carrying a filled, exporting setup module that no proof covers.
 
+`audit` reports a non-blocking question on the `tests` field for each planned sheet test the target
+holds that imports by a root-relative specifier. A sheet test is birth-owned, so a target born
+before the template imported the built sheet by a relative path keeps the
+`'/dist/src/<name>/index.css?raw'` import, and the content-owned `.oxlintrc.json` refuses it under
+`--deny-warnings` through `import/no-absolute-path`. The message names the file and each
+root-relative specifier beside the relative one to write: one `../` per directory between the file
+and the workspace root, so `tests/src/styles/index.test.ts` writes
+`'../../../dist/src/styles/index.css?raw'`. Scaffold never rewrites the file. The question belongs to
+the `tests` group, and `repair` and `overwrite` report it in their terminal audit without
+refusing a write.
+
 `audit` reads the instruction canon as findings rather than as a question. Each `CANON_PATHS` member
 the target holds enters the comparison, by file where the member is a directory, and a path the plan
 does not claim there reports `foreign`. Ownership and drift states that population, and Vendored data
@@ -886,12 +909,14 @@ standard error, so a piped value is never polluted.
 | `audit`     | `Audit` — `findings` and `questions` — plus `releases` and `provenance`; findings carry `ownership`                                                           |
 | `repair`    | `MaterializeResult` plus `audit`, the terminal audit taken after the write, `releases`, and `provenance`                                                      |
 | `catalog`   | `MaterializeResult` plus `mirrors`, `provenance`, optional `membership` with `entries`, `dropped`, and `releases`, and an explanatory `note` on a partial run |
-| `overwrite` | The `catalog` value plus `audit` and top-level `releases` from its version read; `note` explains a partial run                                                |
+| `overwrite` | The `catalog` value plus `audit`, top-level `releases` from its version read, and `additions`; `note` explains a partial run                                  |
 
 The `membership` entity is present only when the catalog read completes. Its `entries` holds the
 package table, `dropped` names packages the preceding table carried that the registry no longer
 lists, and `releases` measures declared fleet ranges against the catalog read. The `overwrite`
-result also retains top-level `releases` from its separate version read, including foreign tools.
+result also retains top-level `releases` from its separate version read, including foreign tools,
+and `additions`, the `DependencyPinSet` of planned dependencies it declared, empty when the
+manifest lacked none.
 An absent `membership` identifies an incomplete catalog read; `note` explains the cause.
 
 The following JSON excerpt shows the membership evidence in a completed catalog result:

package/dist/host/manifest.json

@@ -4,7 +4,7 @@
 			"storage": "AGENTS.md",
 			"destination": "AGENTS.md",
 			"executable": false,
-			"digest": "54707c4e20210dc0a925274d76bb6b9a5d65d4b9b8d8535252dbd53a1a72fd38"
+			"digest": "357cfbe336a026543ec68f3eb999f1094c3139d33331b0ba5f153352cef75fde"
 		},
 		{
 			"storage": "LICENSE",
@@ -352,7 +352,7 @@
 			"storage": "agents/skills/orkestrel-publish/SKILL.md",
 			"destination": ".agents/skills/orkestrel-publish/SKILL.md",
 			"executable": false,
-			"digest": "b79e81c49a5b89f8418fc751eaf6d02c68c5dd9f26a4a0678f9025b1915ebda2"
+			"digest": "f4bcc24e910bbd40de268ba6a9d4ba57b3e5f9ce69075dea395479a45ec0f9d4"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/agents/openai.yaml",
@@ -370,7 +370,7 @@
 			"storage": "agents/skills/orkestrel-publish/references/wave.md",
 			"destination": ".agents/skills/orkestrel-publish/references/wave.md",
 			"executable": false,
-			"digest": "d86fc6b60f12eb09a54442cc6c6e6c3e9b901b310af0bdb19b7d3084b010b059"
+			"digest": "2d5479e0d3ed0529015f5f1f21345fb389f8119333b6c5530d2320be432fe1e1"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/references/window.md",
@@ -394,7 +394,7 @@
 			"storage": "agents/skills/orkestrel-publish/scripts/wave.ts",
 			"destination": ".agents/skills/orkestrel-publish/scripts/wave.ts",
 			"executable": false,
-			"digest": "53a85584203346325df82b2b2b20a77a86b64dbbf017afc1fdfc58d782e4f85c"
+			"digest": "e7a492aee9f3c63fcb22e3ab6a90f7a1a292a408d1824d75e3de26ea07a3f3e9"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/scripts/window.ts",
@@ -496,7 +496,7 @@
 			"storage": "claude/agents/orkestrel.md",
 			"destination": ".claude/agents/orkestrel.md",
 			"executable": false,
-			"digest": "4b3dd60e59e6c0737d526083d70bcea0b010efbeaaf068f391ab1b76cac99280"
+			"digest": "6b3af62e323ff6725680f6a13c3505904154e1d2c0afcb8ba7151a00ff5875c2"
 		},
 		{
 			"storage": "claude/agents/planner.md",
@@ -538,7 +538,7 @@
 			"storage": "claude/rules/architecture.md",
 			"destination": ".claude/rules/architecture.md",
 			"executable": false,
-			"digest": "c3695c2deb808b04e55dbea6b06e66af65b46794d08cc7be67f5661e634c4ad0"
+			"digest": "e30f034c8de38ce7c86506dfaa51844201d745181caed45ef427d0325e80afd3"
 		},
 		{
 			"storage": "claude/rules/browser.md",
@@ -580,7 +580,7 @@
 			"storage": "claude/rules/styles.md",
 			"destination": ".claude/rules/styles.md",
 			"executable": false,
-			"digest": "f0f07cba616023b0c1d8f0a4cb23bd70129af1f4d818f41bfc82ff3f5c0f8e84"
+			"digest": "869f88c392b4795e47af881d668f4dc591e0c419229a843eb4105e38dfb6f831"
 		},
 		{
 			"storage": "claude/rules/tests.md",
@@ -598,7 +598,7 @@
 			"storage": "claude/rules/workspace.md",
 			"destination": ".claude/rules/workspace.md",
 			"executable": false,
-			"digest": "a3c0e392dfe6c1aceac54a00cd4f735600c0ddd49bc2d997b9a977015c81a89e"
+			"digest": "3c9e269acd88935ee6c4f34dd07784f09f45bb6bfd1e27c6a183da3420da4fcc"
 		},
 		{
 			"storage": "claude/rules/writing.md",
@@ -832,7 +832,7 @@
 			"storage": "dotfiles/prettierignore",
 			"destination": ".prettierignore",
 			"executable": false,
-			"digest": "fa3c916de6f5d2a4c07ee65281da26d21aca8db9974ec6199536fc7c36070e52"
+			"digest": "abd137ce9568994c74d4473765a70ba04554548b840e4a3275ab749e397ab69b"
 		},
 		{
 			"storage": "guides/README.md",
@@ -1042,7 +1042,7 @@
 			"storage": "guides/scaffold.md",
 			"destination": "guides/scaffold.md",
 			"executable": false,
-			"digest": "116e87dd3c9b5c23451bb53a2365f7df8982e6782f60a3466070c8058c099700"
+			"digest": "9d6ea9f86610e3237d6ddbe120aabdec137f022092fc5311ca18e87d4b4e6212"
 		},
 		{
 			"storage": "guides/sea.md",
@@ -1180,7 +1180,7 @@
 			"storage": "tests/setupPolicy.ts",
 			"destination": "tests/setupPolicy.ts",
 			"executable": false,
-			"digest": "a6155fc5a2653d847014c4e7ec3fcf936bcbd7ab02e05827e6cf1f71beedcced"
+			"digest": "2571274f92e75e6caffa86b2703ef9a38828db4ec8f51a7b38510f8bc48c6aee"
 		}
 	],
 	"roots": [
@@ -2144,5 +2144,5 @@
 			]
 		}
 	],
-	"digest": "410ca4bbfc4639a33cea13a791dffd130f507b8efb3aa2d54b84f5143babab4b"
+	"digest": "ccbd92a2462e0a17fb972b7582bf05e6deec0c1f11cf4d2d17e6ebec5cc431bf"
 }

package/dist/host/tests/setupPolicy.ts

@@ -281,10 +281,13 @@ export const POLICY_TEST_GLOB = 'tests/{app,src}/**/*.test.ts'
 // Compose suppression tokens so the instrument does not report its own definitions or controls.
 export const POLICY_SUPPRESSION_DIRECTIVE = ['oxlint', '-disable'].join('')
 
-/** Matches the source, test, config, and script files inspected for lint suppression directives. */
+/** Names the formatter directive the text sweep refuses, composed so the instrument does not report itself. */
+export const POLICY_FORMATTER_DIRECTIVE = ['prettier', '-ignore'].join('')
+
+/** Matches the source, test, config, script, and sheet files inspected for lint and formatter suppression directives. */
 export const POLICY_SUPPRESSION_GLOB: readonly string[] = Object.freeze([
-	'{src,app,tests,configs,scripts}/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}',
-	'*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}',
+	'{src,app,tests,configs,scripts}/**/*.{cjs,css,cts,js,jsx,mjs,mts,scss,ts,tsx,vue}',
+	'*.{cjs,css,cts,js,jsx,mjs,mts,scss,ts,tsx,vue}',
 ])
 
 /** Lists the rules whose workspace-wide lint wiring must not be weakened by configuration. */
@@ -305,9 +308,11 @@ export const POLICY_WIRING_ROOTS: readonly string[] = Object.freeze([
 	'configs',
 ])
 
-/** Matches either lint suppression token the text sweep refuses. */
+/** Matches either lint suppression token or the formatter directive the text sweep refuses. */
 export const POLICY_SUPPRESSION_PATTERN = new RegExp(
-	[['eslint', '-disable'].join(''), POLICY_SUPPRESSION_DIRECTIVE].join('|'),
+	[['eslint', '-disable'].join(''), POLICY_SUPPRESSION_DIRECTIVE, POLICY_FORMATTER_DIRECTIVE].join(
+		'|',
+	),
 	'u',
 )
 
@@ -577,7 +582,7 @@ export function inspectPolicySetup(root: string): readonly PolicyViolation[] {
 }
 
 /**
- * Inspects code-shaped workspace files for lint suppression directives.
+ * Inspects code-shaped and sheet workspace files for lint and formatter suppression directives.
  *
  * @param root - The workspace root to inspect.
  * @returns Every suppression occurrence in path and line order.
@@ -594,7 +599,7 @@ export function inspectPolicySuppressions(root: string): readonly PolicyViolatio
 					createPolicyViolation(
 						'suppression',
 						path,
-						'file carries a lint suppression directive',
+						'file carries a lint or formatter suppression directive',
 						index + 1,
 					),
 				)
@@ -2687,6 +2692,17 @@ export const POLICY_CONTROLS: readonly PolicyControl[] = Object.freeze([
 			},
 		],
 	},
+	{
+		label: 'rejects a formatter directive in a sheet partial',
+		membership: 'sheet files in the suppression population',
+		rule: 'suppression',
+		files: [
+			{
+				path: 'src/styles/_control.scss',
+				content: `// ${POLICY_FORMATTER_DIRECTIVE}\n.control {\n\tcolor: red;\n}\n`,
+			},
+		],
+	},
 	{
 		label: 'rejects an unmirrored module test',
 		membership: 'module tests below tests/src or tests/app except integration.test.ts',