@panaversity/ksor 0.0.41 → 0.0.43

package/CHANGELOG.md

@@ -1,5 +1,121 @@
 # @panaversity/ksor
 
+## 0.0.43
+
+### Patch Changes
+
+- 9ecfd78: **A document page that reads at a glance, and a dev server that sees new
+  documents again.**
+
+  The governance row is two tiers. It was one line carrying 79 characters, of
+  which the approver was 32 (41%) and the three labels 19 (24%) — so a producer
+  id was the longest thing on the page and the two facts a reader actually scans
+  for, what state this is in and whether anyone has checked it, competed with it.
+  Now the chips lead with Export beside them, and provenance sits beneath in
+  muted weight. Nothing is hidden: decision 21 requires a governance act to name
+  its actor and decision 27 requires a non-human approver to be disclosed, so the
+  approver moved one line down, not one click away, and every byte of it is still
+  in the server-rendered markup an agent parses.
+
+  Export no longer lands in the middle of the row. It and the reading time each
+  carried their own `ms-auto`, and on a row narrow enough to wrap they shared a
+  line — where two auto margins SPLIT the free space rather than stacking. They
+  are one right-hand cluster now.
+
+  **And adding a document to `knowledge/` while `pnpm dev` runs shows it again.**
+  This regressed in 0.0.41: `refreshStage` walked the STAGE and skipped anything
+  the stage did not already hold, so an arrival — which has no file to walk onto
+  — was never written, and the manifest naming what publishes never learned about
+  it. Measured: `/docs/<new>/` 404 → 200, sidebar 0 → 1, `llms.txt` 0 → 1;
+  0.0.40 served it at 200, so this is a repair rather than a feature. Removals
+  still wait for a restart, deliberately — a deleted file leaves fumadocs'
+  generated imports pointing at something gone.
+
+  The comment explaining why arrivals were refused was also wrong, and is
+  corrected: fumadocs-mdx 15.3.0 DOES regenerate on a write into the
+  dot-prefixed stage. Our own function was the blocker.
+
+  Finally, the starter's `knowledge/surfaces/overview.md` was titled `Surfaces`
+  inside the Surfaces section, so its breadcrumb read `Surfaces › Surfaces`. It
+  is `Overview` now.
+
+- 9ecfd78: **Two fixes on the document page.**
+
+  The governance row put **Export** in the middle of the row with nothing under
+  it. Export and the reading time each carried their own `ms-auto`, and on a row
+  narrow enough to wrap they landed on the same line — where two auto margins
+  SPLIT the free space between them rather than stacking, so Export came to rest
+  mid-row instead of at either end. They are now one right-hand cluster and
+  travel together at every width.
+
+  And the starter's `knowledge/surfaces/overview.md` was titled `Surfaces` inside
+  a section already called Surfaces, so its breadcrumb read `Surfaces › Surfaces`
+  and the sidebar showed a Surfaces inside Surfaces. It is titled `Overview` now,
+  matching its filename, and the generated section index was regenerated with it.
+
+## 0.0.42
+
+### Patch Changes
+
+- d55097c: **Document what a deploy actually does to your lock.** `vercel.json` builds the
+  site with `pnpm build`, which runs `ksor build` first — so the host regenerates
+  every `index.md` and `build.lock.json` before building. That has two
+  consequences worth knowing, and neither was written down: you can deploy
+  without ever running `ksor build` yourself, and the `build.lock.json` in your
+  repository is not necessarily the one that shipped.
+
+  Nothing changes in behaviour. The record checker still runs on the deploy, so a
+  record that breaks the profile still fails there, and the `build_id` that did
+  ship is stamped into the deployed `llms.txt`.
+
+  `docs/deploying.md` now also shows the stricter posture for adopters who want
+  the deployed build reviewed before it ships — `buildCommand: "pnpm -C
+system/site build"`, which refuses `ksor-lock-missing` or `ksor-lock-stale`
+  until someone runs `ksor build` and commits it. That is one line in your own
+  `vercel.json`; ksor ships no flag for it.
+
+- abef414: **Fix the release-note lookup, properly this time.** The previous release added
+  `releaseNote()` so doc-truth assertions could survive a changeset being folded
+  into the changelog. It resolved a consumed note to the NEWEST changelog
+  section, which is only correct for the release that consumes it: a note
+  consumed in 0.0.41 lives in the 0.0.41 section forever, so by 0.0.42 the lookup
+  returned a different release entirely.
+
+  Two failures came out of that, and the second was worse than the bug it
+  replaced: presence assertions went red, and a fenced-block scan went VACUOUS —
+  passing because the section handed to it contained no code blocks at all.
+
+  `releaseNote()` now returns the whole changelog once a note is consumed, plus
+  whether the note is still `pending`. Assertions about the PRESENCE of prose use
+  the text (finding it anywhere in the changelog proves it shipped); assertions
+  about STRUCTURE gate on `pending`, because "every fenced block must show
+  `--approve-by`" is a rule about a note still under review, not one to apply to
+  the whole published history.
+
+  Verified in both states and mutation-tested against the released tree: removing
+  `--approve-by` or changing the tool-size figure in the changelog turns the
+  assertions red.
+
+- bfcf900: **A new record already names its DSN variable.** `instance.md`'s
+  `database.dsn_env` shipped commented out, so climbing to the served rung began
+  with an edit whose only purpose was to delete two `#` characters — and the
+  instruction to do it was repeated in four places, one of which (`.env.example`)
+  sat right beside a `KSOR_DB_URL=` line that was NOT commented. A first-time
+  reader had to notice that one file names the variable and another defines it,
+  and that only one of the two needed uncommenting.
+
+  It is filled in now. Naming an environment variable costs nothing and requires
+  no database: `pnpm dev` and `pnpm build` never read it, and the value only has
+  to exist when you run `provision`, `refresh` or `serve`. Verified on a real
+  scaffold from the published package with the block live and `KSOR_DB_URL`
+  unset — `check`, `ksor build` and a full static site build all succeed, and the
+  record publishes.
+
+  So the served rung is now: set `KSOR_DB_URL` in `.env`, then `provision`,
+  `refresh`, `serve`. The step that was pure ceremony is gone, and `ksor init`'s
+  own next-steps, the scaffold's `AGENTS.md`, `.env.example` and
+  `docs/ingesting.md` all say the same thing.
+
 ## 0.0.41
 
 ### Patch Changes

package/dist/cli.mjs

@@ -13324,7 +13324,7 @@ function handoff(io, name, targetWasDot, manager) {
 Next (or just tell your coding agent to take it from here):
 ` + enter + `  ${install}\n  ${run("dev").padEnd(15)} # the site, live at http://localhost:3000\n
 Then, for the agent surface (needs Postgres and a provider key):
-  ${run("provision").padEnd(15)} # once: uncomment \`database:\` in instance.md, copy\n                  #   .env.example to .env, then apply the schema
+  ${run("provision").padEnd(15)} # once: copy .env.example to .env and set KSOR_DB_URL,\n                  #   then apply the schema
   ${run("refresh").padEnd(15)} # PUBLISH the record — ingest knowledge/ into a generation\n  ${run("serve").padEnd(15)} # the MCP server, over what you just published\n
 ` + pnpmHint + "Start in knowledge/ — AGENTS.md carries the working rules.\n");
 }

package/docs/deploying.md

@@ -254,6 +254,26 @@ and reaches the site at its next build (it reads the ledger), so the act that
 withdraws a document is the same merged commit on both surfaces. Merge the
 ledger entry, rebuild, redeploy.
 
+**Your deploy runs it too, and that is deliberate.** `vercel.json` builds with
+`pnpm build`, so the host regenerates the indexes and the lock before building
+the site. The consequence is worth knowing in both directions: you can deploy
+without ever having run `ksor build` yourself — the record checker still runs
+there, so a record that breaks the profile still fails the deploy — but the
+`build.lock.json` in your repository is not necessarily the one that shipped.
+The `build_id` that DID ship is stamped into the deployed `llms.txt`.
+
+If you want the stricter property — the deployed build_id is one a human
+reviewed in a pull request — build the site alone instead:
+
+```json
+"buildCommand": "pnpm -C system/site build"
+```
+
+The site refuses `ksor-lock-missing` or `ksor-lock-stale` when the committed
+lock does not describe the tree, so a deploy then fails until someone runs
+`ksor build` and commits the result. That is your file to change; ksor does not
+choose it for you.
+
 ## Keeping people out of the site
 
 The door has auth ([authorization.md](./authorization.md)). The **site** is

package/docs/ingesting.md

@@ -25,7 +25,7 @@ created for you.
 | **The corpus**       | `knowledge/` at your repo root — CommonMark `.md`, one document per file, in the KSoR Profile of OKF: `type`, `title`, `description`, `status` and `ksor.audience` in frontmatter | `pnpm check` validates it and explains any violation; `ksor build` must have written a current `build.lock.json` before ingest will run |
 | **The database**     | Postgres with **pgvector** — `CREATE EXTENSION vector;`                                                                                                                           | any managed host; the DDL below needs a role that can create tables                                                                     |
 | **The provider key** | `GEMINI_API_KEY` — the default embedding provider is `gemini-embedding-001`                                                                                                       | [aistudio.google.com](https://aistudio.google.com/apikey); the free tier covers a first corpus                                          |
-| **The DSN**          | `KSOR_DB_URL`, named by `instance.md`'s `database.dsn_env`                                                                                                                        | uncomment the `database:` block in `instance.md` first                                                                                  |
+| **The DSN**          | `KSOR_DB_URL`, named by `instance.md`'s `database.dsn_env`                                                                                                                        | already named by `instance.md`'s `database:` block                                                                                      |
 
 Both variables go in `.env` beside `instance.md` — `ksor` reads it automatically,
 and `.env` is gitignored. Every command below is run **from your repository

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panaversity/ksor",
-  "version": "0.0.41",
+  "version": "0.0.43",
   "description": "Knowledge System of Record — compile governed markdown into a static site for people and an MCP server for AI agents, with citations and measured abstention.",
   "keywords": [
     "abstention",

package/templates/scaffold/AGENTS.md

@@ -60,9 +60,9 @@ pnpm check       # the format checker — run before handing off any knowledge c
 with honest abstention. It is the climbed rung — not required for `pnpm dev`.
 Stand it up in this order (each step's errors explain how to fix themselves):
 
-1. **Configure `instance.md`.** One block is required, and it is already
-   there, commented out — uncomment it. It names the environment variable
-   holding your DSN (never the DSN itself):
+1. **Check `instance.md`.** The one required block is already filled in — it
+   names the environment variable holding your DSN (never the DSN itself), and
+   there is nothing to do here unless you want a different variable name:
 
    ```yaml
    database:

package/templates/scaffold/env.example

@@ -2,8 +2,9 @@
 # A real environment variable always wins over this file, so CI and production
 # keep their own values.
 
-# The Postgres store, named by instance.md's database.dsn_env — uncomment the
-# `database:` block there first. Needs the pgvector extension:
+# The Postgres store. instance.md already names this variable in its
+# `database.dsn_env`, so setting it here is the whole of the wiring.
+# Needs the pgvector extension:
 # CREATE EXTENSION vector;
 # On a remote host prefer sslmode=verify-full, which states the TLS posture
 # explicitly instead of relying on a driver default that is due to change.

package/templates/scaffold/instance.md

@@ -6,17 +6,20 @@ description: What a Knowledge System of Record is, how a project climbs the gove
 toolchain:
   requires: ">=KSOR-STAMP-VERSION"
   scaffolded: "KSOR-STAMP-VERSION"
-# The served MCP rung needs ONE required block: the NAME of the environment
-# variable holding your Postgres DSN — never the DSN itself. Uncomment it, copy
-# .env.example to .env, then: `pnpm provision` once (schema + grant), then
-# `pnpm refresh` to PUBLISH the record, then `pnpm serve`. Serving does not
-# publish — that is deliberate, and skipping refresh serves nothing.
+# `database.dsn_env` names the environment variable holding your Postgres DSN —
+# never the DSN itself, which belongs in .env. It is filled in because naming a
+# variable costs nothing and needs no database: `pnpm dev` and `pnpm build` do
+# not read it, and the value only has to exist when you climb to the served
+# rung. To climb: copy .env.example to .env and set KSOR_DB_URL, then
+# `pnpm provision` once (schema + grant), then `pnpm refresh` to PUBLISH the
+# record, then `pnpm serve`. Serving does not publish — that is deliberate, and
+# skipping refresh serves nothing.
 # Nothing else here is required:
 # `embedding:` already defaults to Gemini at 1536 dimensions, and leaving
 # `retrieval:` out starts you with the abstention gate off and honest about it
 # (turn it on afterwards with `ksor calibrate`, once the record is serving).
-# database:
-#   dsn_env: KSOR_DB_URL
+database:
+  dsn_env: KSOR_DB_URL
 # Where agents reach this record's MCP surface, and the semver it publishes as.
 # Both go into /.well-known/mcp/server.json, the document an agent reads to
 # DISCOVER this record instead of being told the URL. Leave mcp_url out until

package/templates/scaffold/knowledge/surfaces/index.md

@@ -1,5 +1,5 @@
 # Surfaces
 
-* [Surfaces](overview.md) - One source, published through several synchronized projections.
+* [Overview](overview.md) - One source, published through several synchronized projections.
 * [The human surface](for-people.md) - Pages for reading, reviewing and sharing the record.
 * [The agent surface](for-agents.md) - MCP for retrieval with citations, and machine-readable files beside it.

package/templates/scaffold/knowledge/surfaces/overview.md

@@ -1,6 +1,6 @@
 ---
 type: Document
-title: Surfaces
+title: Overview
 description: One source, published through several synchronized projections.
 status: stable
 order: 4

package/templates/scaffold/system/site/components/governance.tsx

@@ -216,104 +216,132 @@ export function GovernanceMeta({
   // tier, `unverified` included, and that is the whole point of printing it.
   // The early return this replaced would have hidden the tier on exactly the
   // documents whose tier is the only governance fact they have.
+  /**
+   * TWO TIERS, because the row's length was never its vocabulary.
+   *
+   * Measured on the starter's own document: 79 characters, of which the
+   * APPROVER is 32 (41%) and the three labels 19 (24%). One producer id was
+   * longer than both governance chips together, so the two facts a reader
+   * scans for — what state is this in, and has anyone checked it — competed
+   * with a string that means nothing to them, and Export was pushed onto a
+   * line of its own.
+   *
+   * So the chips lead and the provenance follows beneath them. Nothing is
+   * hidden: decision 21 says a governance act NAMES its actor and decision
+   * 27's starter revision requires a non-human approver to be DISCLOSED, so
+   * demoting `ksor.approval` to a hover would trade a governance guarantee
+   * for a tidier row (critical rule 1). It is one line lower, not one click
+   * away, and every byte of it is still in the server-rendered markup an
+   * agent parses.
+   */
   return (
-    <dl className="mb-7 flex flex-wrap items-baseline gap-x-8 gap-y-2.5 border-b border-fd-border pb-4">
-      {state === null && alsoBadge === null ? null : (
-        <Fact label="Status">
-          <span className="flex flex-wrap items-baseline gap-1.5">
-            {state === null ? null : <Chip text={state} tone={statusTone(status)} />}
-            {alsoBadge === null ? null : (
-              <BadgeChip badge={alsoBadge} effectiveFrom={effectiveFrom} />
-            )}
-          </span>
-        </Fact>
-      )}
-      {/* The tier OKF's own vocabulary names, on every document including the
+    <div className="mb-7 border-b border-fd-border pb-4">
+      <dl className="flex flex-wrap items-baseline gap-x-8 gap-y-2.5">
+        {state === null && alsoBadge === null ? null : (
+          <Fact label="Status">
+            <span className="flex flex-wrap items-baseline gap-1.5">
+              {state === null ? null : <Chip text={state} tone={statusTone(status)} />}
+              {alsoBadge === null ? null : (
+                <BadgeChip badge={alsoBadge} effectiveFrom={effectiveFrom} />
+              )}
+            </span>
+          </Fact>
+        )}
+        {/* The tier OKF's own vocabulary names, on every document including the
           unverified ones — that is the honest state of a stable, approved
           concept nobody has reviewed, and hiding it would leave a reader unable
           to tell "checked" from "never mentioned" (research/okf-native.md
           §1.1). Never a colour: a tier is a fact about review, not a warning. */}
-      <Fact label="Trust">
-        <span className="flex flex-wrap items-baseline gap-1.5">
-          <Chip text={trust.tier} />
-          {trust.by === null ? null : (
-            <span className="font-normal text-fd-muted-foreground">
-              {trust.by}
-              {trust.at === null ? null : <> · {day(trust.at)}</>}
-            </span>
-          )}
-        </span>
-      </Fact>
-      {owner === null ? null : <Fact label="Owner">{owner}</Fact>}
-      {/* Who let this into the record. `ksor.approval` is what makes a `stable`
+        <Fact label="Trust">
+          <span className="flex flex-wrap items-baseline gap-1.5">
+            <Chip text={trust.tier} />
+            {trust.by === null ? null : (
+              <span className="font-normal text-fd-muted-foreground">
+                {trust.by}
+                {trust.at === null ? null : <> · {day(trust.at)}</>}
+              </span>
+            )}
+          </span>
+        </Fact>
+        {/* Actions ride tier ONE: a reader who wants the bytes wants them
+          immediately, and this is the row with room. */}
+        {markdownUrl === undefined && minutes === undefined ? null : (
+          <div className="ms-auto flex items-center gap-x-6">
+            {markdownUrl === undefined ? null : <DocumentActions href={markdownUrl} />}
+            {minutes === undefined ? null : (
+              <div className="flex items-center gap-2 text-sm text-fd-muted-foreground">
+                <Clock aria-hidden className="size-3.5 shrink-0" />
+                <span>{minutes} min read</span>
+              </div>
+            )}
+          </div>
+        )}
+      </dl>
+      {/* Tier two RECEDES. It is provenance — who let this in, when it takes
+          effect, what it replaced — and it is read when a reader goes looking,
+          not scanned. At full `--foreground` weight it competed with the two
+          chips above it for the same attention, which is what made a producer
+          id the loudest thing on the page.
+
+          Links keep full strength: `Replaces` points at the document this one
+          superseded, and that is an action rather than a fact. */}
+      <dl className="mt-2.5 flex flex-wrap items-baseline gap-x-8 gap-y-2.5 empty:mt-0 [&_a]:text-fd-foreground [&_dd]:font-normal [&_dd]:text-fd-muted-foreground">
+        {owner === null ? null : <Fact label="Owner">{owner}</Fact>}
+        {/* Who let this into the record. `ksor.approval` is what makes a `stable`
           document stable at all (record spec §2.2), so a page that showed the
           word and not the signature would be publishing the claim without its
           author. */}
-      {approval === null ? null : (
-        <Fact label="Approved">
-          <>
-            {approval.by} · {day(approval.at)}
-          </>
-        </Fact>
-      )}
-      {/* found live 2026-08-25: a deprecated page named its successor and said
+        {approval === null ? null : (
+          <Fact label="Approved">
+            <>
+              {approval.by} · {day(approval.at)}
+            </>
+          </Fact>
+        )}
+        {/* found live 2026-08-25: a deprecated page named its successor and said
           nothing about WHO withdrew it, though `ksor.deprecated` is required on
           every deprecated concept (record spec §2.2) and readGovernance already
           refuses a document that omits it. Withdrawal is the most consequential
           act in a document's life; publishing it unattributed is exactly the
           gap the approver fact above closes at the other end. */}
-      {deprecated === null ? null : (
-        <Fact label="Withdrawn">
-          <>
-            {deprecated.by} · {day(deprecated.at)}
-          </>
-        </Fact>
-      )}
-      {replaces.length === 0 ? null : (
-        // The other half of a supersession. The withdrawn document names its
-        // successor above the title; this is the successor naming what it
-        // replaced, so the history the record kept is reachable from the
-        // current document instead of only from the retired one.
-        <Fact label="Replaces">
-          <>
-            {replaces.map((entry, index) => (
-              <span key={entry.href ?? `${index}-${entry.label}`}>
-                {index === 0 ? null : ", "}
-                {entry.href === null ? (
-                  entry.label
-                ) : (
-                  <Link
-                    href={entry.href}
-                    className="underline underline-offset-4 transition-colors hover:text-fd-primary focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-fd-ring"
-                  >
-                    {entry.label}
-                  </Link>
-                )}
-              </span>
-            ))}
-          </>
-        </Fact>
-      )}
-      {effectiveFrom === null || !showEffective ? null : (
-        <Fact label="Effective from">{day(effectiveFrom)}</Fact>
-      )}
-      {staleAfter === null ? null : <Fact label="Review by">{day(staleAfter)}</Fact>}
-      {markdownUrl === undefined ? null : (
-        // On the governance row, not as a footnote below the sources: it is
-        // how a reader hands this document to an agent (research/site-design.md
-        // F2). Right-aligned: a column of things you DO, against a row of
-        // things the record DECLARES (owner, 2026-08-22).
-        <span className="ms-auto">
-          <DocumentActions href={markdownUrl} />
-        </span>
-      )}
-      {minutes === undefined ? null : (
-        <div className="ms-auto flex items-center gap-2 text-sm text-fd-muted-foreground">
-          <Clock aria-hidden className="size-3.5 shrink-0" />
-          <span>{minutes} min read</span>
-        </div>
-      )}
-    </dl>
+        {deprecated === null ? null : (
+          <Fact label="Withdrawn">
+            <>
+              {deprecated.by} · {day(deprecated.at)}
+            </>
+          </Fact>
+        )}
+        {replaces.length === 0 ? null : (
+          // The other half of a supersession. The withdrawn document names its
+          // successor above the title; this is the successor naming what it
+          // replaced, so the history the record kept is reachable from the
+          // current document instead of only from the retired one.
+          <Fact label="Replaces">
+            <>
+              {replaces.map((entry, index) => (
+                <span key={entry.href ?? `${index}-${entry.label}`}>
+                  {index === 0 ? null : ", "}
+                  {entry.href === null ? (
+                    entry.label
+                  ) : (
+                    <Link
+                      href={entry.href}
+                      className="underline underline-offset-4 transition-colors hover:text-fd-primary focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-fd-ring"
+                    >
+                      {entry.label}
+                    </Link>
+                  )}
+                </span>
+              ))}
+            </>
+          </Fact>
+        )}
+        {effectiveFrom === null || !showEffective ? null : (
+          <Fact label="Effective from">{day(effectiveFrom)}</Fact>
+        )}
+        {staleAfter === null ? null : <Fact label="Review by">{day(staleAfter)}</Fact>}
+      </dl>
+    </div>
   );
 }
 

package/templates/scaffold/system/site/lib/stage-knowledge.ts

@@ -670,30 +670,51 @@ function fillStage(recordDir: string, stageDir: string, development: boolean): v
 }
 
 /**
- * Dev only: carry edits into the files the stage already holds, so
- * `pnpm dev` shows the record as the owner is writing it rather than as it
- * stood when the server started — the regenerated indexes included, so a
- * retitled document is retitled in its folder's listing too.
+ * Dev only: carry edits AND ARRIVALS into the stage, so `pnpm dev` shows the
+ * record as the owner is writing it rather than as it stood when the server
+ * started — the regenerated indexes included, so a retitled document is
+ * retitled in its folder's listing too.
  *
- * Edits only — never adds, never removals. fumadocs' own watcher cannot see
- * a dot-prefixed collection directory (measured 2026-08-18: adding a file to
- * the stage regenerated nothing, and removing one left the generated imports
- * pointing at a file that was gone), so a document that ARRIVES or changes
- * audience needs the restart `pnpm dev` already needs for instance.md. Leaving
- * that to a restart keeps dev honest in the direction that matters: the
- * published build is always staged from scratch.
+ * Adds and edits — never removals. The 2026-08-18 measurement this refused
+ * adds on ("fumadocs' own watcher cannot see a dot-prefixed collection
+ * directory") no longer holds: on fumadocs-mdx 15.3.0 a file written into
+ * `.staged-knowledge` DOES regenerate the collection, twice-observed as
+ * `[MDX] generated files` in the dev log. What actually kept a new document
+ * off every surface was this function, which walked the STAGE and skipped
+ * anything the stage did not already hold — so a plan entry with no file on
+ * disk was never written, and the manifest that names what publishes never
+ * learned about it either.
+ *
+ * Measured before and after, adding a document while `pnpm dev` ran:
+ * `/docs/<new>/` 404 -> 200, sidebar 0 -> 1, `llms.txt` 0 -> 1. It worked
+ * this way before the stage existed (0.0.40 serves an added document at 200),
+ * so this is a regression repaired rather than a feature.
+ *
+ * REMOVALS still wait for the restart `pnpm dev` already needs for
+ * instance.md: the same measurement found a deleted file leaves fumadocs'
+ * generated imports pointing at something gone, which takes the dev server
+ * down rather than showing a stale page. An arrival has no such failure mode
+ * — nothing points at a file that has only just appeared.
  */
 function refreshStage(recordDir: string, stageDir: string): void {
   // Under the lock like every other write here: a save landing while another
   // evaluation is refilling the stage is the same race from the other side.
   withStageLock(stageDir, () => {
     const plan = planStage(recordDir, true);
-    const permitted = new Map(plan.entries.map((e) => [path.join(stageDir, e.rel), e] as const));
-    for (const staged of walkFiles(stageDir)) {
-      const entry = permitted.get(staged);
-      if (entry === undefined) continue;
+    // Drive from the PLAN, not from the stage. Walking the stage could only
+    // ever find what was already there, which is exactly why an arrival was
+    // invisible: it has no file to walk onto.
+    for (const entry of plan.entries) {
+      const staged = path.join(stageDir, entry.rel);
       const bytes = entry.bytes();
-      if (bytes.equals(readFileSync(staged))) continue;
+      let current: Buffer | null = null;
+      try {
+        current = readFileSync(staged);
+      } catch {
+        // Not staged yet — an arrival. Written below.
+      }
+      if (current !== null && current.equals(bytes)) continue;
+      mkdirSync(path.dirname(staged), { recursive: true });
       writeFileSync(staged, bytes);
     }
     writeManifest(stageDir, plan.manifest);