@panaversity/ksor 0.0.57 → 0.0.59

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { n as resolveCommand, r as verbs, t as exitCodes } from "./src-dqpI-p1a.mjs";
-import { A as parseViewer, B as tallyHandlers, C as contentPoolMin, D as outlineHandler, E as keyRingFromEnv, F as recordIsUndescribed, G as z$1, H as validateViewer, I as runProbe$1, L as searchHandler, M as prewarmPool, N as providerKeyEnv$1, O as parseInstanceText$1, P as readHandler, R as servingPolicy$1, S as contentPool$1, T as instancePathOf$1, U as withPgRetry$1, V as tlsPosture, W as withProbeDeadline$1, _ as assertGovernanceServable$1, a as GovernanceGateError$1, b as checkEmbeddingSpace$1, c as McpServer$1, d as READ_ONLY, f as READ_OUTPUT, g as TextSearchConfigMismatch, h as TRUST_TIERS$1, i as FLOOR, j as pooledEndpointFor, k as parseTrustFloor, l as MissingProviderKeyError$1, m as SchemaVersionError, n as ContentStoreError$1, o as MAX_OUTLINE_LIMIT, p as SEARCH_OUTPUT, r as EmbeddingSpaceMismatch$1, t as AudienceError$1, u as OUTLINE_OUTPUT, v as assertSchemaCompatible, w as embedQueryVlit, x as composeInstructions, y as buildShippedProvider$1, z as storedTextSearchConfig } from "./gateway-api-C0vL3oOK-D24n786A.mjs";
+import { A as parseViewer, B as servingPolicy$1, C as contentPoolMin, D as outlineHandler, E as keyRingFromEnv, F as readHandler, G as withPgRetry$1, H as tallyHandlers, I as readPublished, K as withProbeDeadline$1, L as recordIsUndescribed, M as prewarmPool, N as providerKeyEnv$1, O as parseInstanceText$1, P as publishedGeneration, R as runProbe$1, S as contentPool$1, T as instancePathOf$1, U as tlsPosture, V as storedTextSearchConfig, W as validateViewer, _ as assertGovernanceServable$1, a as GovernanceGateError$1, b as checkEmbeddingSpace$1, c as McpServer$1, d as READ_ONLY, f as READ_OUTPUT, g as TextSearchConfigMismatch, h as TRUST_TIERS$1, i as FLOOR, j as pooledEndpointFor, k as parseTrustFloor, l as MissingProviderKeyError$1, m as SchemaVersionError, n as ContentStoreError$1, o as MAX_OUTLINE_LIMIT, p as SEARCH_OUTPUT, q as z$1, r as EmbeddingSpaceMismatch$1, t as AudienceError$1, u as OUTLINE_OUTPUT, v as assertSchemaCompatible, w as embedQueryVlit, x as composeInstructions, y as buildShippedProvider$1, z as searchHandler } from "./gateway-api-CEsb-e8z-Ch6oMaq2.mjs";
 import { appendFileSync, chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { InMemoryTransport, LATEST_PROTOCOL_VERSION, createMcpHandler } from "@modelcontextprotocol/server";
@@ -14,10 +14,10 @@ import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { Document, YAMLParseError, isCollection, isMap, isPair, isSeq, parseAllDocuments, parseDocument } from "yaml";
+import { execFileSync, spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
 import { readFile } from "node:fs/promises";
-import { execFileSync, spawnSync } from "node:child_process";
-//#region ../content-gateway/dist/main-BoKhKcP0.mjs
+//#region ../content-gateway/dist/main-BDFsC03h.mjs
 /**
 * The default registration — and the ORIGINAL of the file `ksor init` emits.
 *
@@ -461,10 +461,22 @@ function currentActor() {
 /**
 * A required env var is missing — thrown with the operator message. Like
 * AuthConfigError, the gateway maps this distinct type to a clean stderr line
-* + exit 2; it must never half-boot past it.
+* + exit 3 (environment); it must never half-boot past it.
+*
+* `slug` is the stable first stderr line the gateway prints when the refusal
+* names a rule (`bootErrorLines`). Optional, because most of these are one
+* sentence about one variable and the sentence IS the name; a missing provider
+* key is the one with a rule behind it, and it exited 3 with no line an agent
+* could branch on while every exit-1 refusal had one (product principle 4;
+* found live, 2026-09-02).
 */
 var RequiredEnvError = class extends Error {
 	name = "RequiredEnvError";
+	slug;
+	constructor(message, slug = null) {
+		super(message);
+		this.slug = slug;
+	}
 };
 /**
 * Host: KSOR_MCP_HOST, else 0.0.0.0 only when $PORT is set, else loopback.
@@ -527,12 +539,45 @@ function transportSecurityFromEnv(env = process.env) {
 * the code's own terms and visibly crooked in the block (review finding 63).
 */
 function bootLine(label, text) {
-	const padded = label.padEnd(10);
+	const padded = label.padEnd(12);
 	return `  ${padded === label ? `${label} ` : padded}${text}`;
 }
 function bootHeader(corpusId) {
 	return `ksor serve · ${corpusId}`;
 }
+/**
+* What this door is SERVING — or that it is serving nothing.
+*
+* The block said db, audience, trust, auth, abstain, serving and came up green
+* on a provisioned record nobody had ever ingested, which is exactly where
+* `ksor init`'s own next steps leave an adopter who skipped the publish step.
+* Every search then answered `reason: "unpublished"`, correctly, to an agent —
+* and nothing had told the operator (found live, 2026-09-02). The absence is
+* stated in capitals like the other two lines that decide trust, and the
+* remedy travels with it.
+*/
+function generationPosture(published, refresh) {
+	if (published === null) return `NONE — nothing published; run ${refresh}`;
+	const { generation, nodes, sourceCommit } = published;
+	return `${generation} · ${nodes} ${nodes === 1 ? "node" : "nodes"} · source ${sourceCommit}`;
+}
+/**
+* The publish step, in the words of the manager that spawned this process.
+*
+* `npm_config_user_agent` is the same signal `ksor init` reads to emit the
+* adopter's scaffold (#28): every manager sets it for the scripts it runs, so
+* `npm run serve` is told `npm run refresh` rather than a pnpm spelling its
+* scaffold does not carry. No manager in the loop — `ksor serve` typed
+* directly, a container entrypoint — names the VERB, which is the name every
+* runbook here uses for the individual step (AGENTS.md → Vocabulary).
+*/
+function refreshCommand(userAgent) {
+	const head = (userAgent ?? "").split("/")[0]?.trim();
+	if (head === "pnpm") return "pnpm refresh";
+	if (head === "npm") return "npm run refresh";
+	if (head === "bun") return "bun run refresh";
+	return "ksor ingest --flip";
+}
 function withoutSdkResponseModeWarning(body) {
 	const warn = console.warn;
 	console.warn = (...args) => {
@@ -1013,7 +1058,7 @@ async function compose(rawInstancePath, version) {
 			dim: instance.embeddingDim
 		});
 	} catch (error) {
-		if (error instanceof MissingProviderKeyError$1) throw new RequiredEnvError(error.message);
+		if (error instanceof MissingProviderKeyError$1) throw new RequiredEnvError(error.message, error.slug);
 		throw error;
 	}
 	console.error(bootHeader(instance.corpusId));
@@ -1026,6 +1071,8 @@ async function compose(rawInstancePath, version) {
 	const requestedViewer = parseViewer(process.env["KSOR_AUDIENCE"]);
 	let viewer = ["public"];
 	let spaceSkipReason = "not yet verified — boot checks have not passed";
+	let published = null;
+	const refreshHint = refreshCommand(process.env["npm_config_user_agent"]);
 	const bootChecks = async () => {
 		await assertSchemaCompatible(pool);
 		const stored = await storedTextSearchConfig(pool);
@@ -1034,6 +1081,8 @@ async function compose(rawInstancePath, version) {
 		const policy = await servingPolicy$1(pool, instance);
 		viewer = validateViewer(policy?.registry ?? [], requestedViewer);
 		console.error(bootLine("audience", viewer.join(",")));
+		published = await publishedGeneration(pool, instance);
+		console.error(bootLine("generation", generationPosture(published, refreshHint)));
 		const space = await checkEmbeddingSpace$1(pool, instance.tenantId, instance.embeddingModel, instance.embeddingDim);
 		if (space.storeUnreachable) throw new ContentStoreError$1(`embedding-space guard: ${space.reason ?? "unknown"}`);
 		spaceSkipReason = space.reason;
@@ -1048,6 +1097,7 @@ async function compose(rawInstancePath, version) {
 		console.error(`boot checks DEFERRED: content store unreachable${classSuffix(error)} — this instance reports NOT READY until schema AND governance both verify`);
 		console.error(`  cause: ${error instanceof Error ? error.stack ?? error.message : String(error)}`);
 		console.error(bootLine("audience", `not resolved — requested ${requestedViewer.join(",")}; this door refuses every request until the boot checks pass`));
+		console.error(bootLine("generation", "not resolved — read once the boot checks pass"));
 		let verified = false;
 		bootVerified = () => verified;
 		let inFlight = null;
@@ -1095,6 +1145,13 @@ async function compose(rawInstancePath, version) {
 		get spaceSkipReason() {
 			return spaceSkipReason;
 		},
+		get published() {
+			return published;
+		},
+		refreshHint,
+		probePublished: async (client) => {
+			published = await readPublished(client, instance);
+		},
 		requestedViewer,
 		version,
 		verifyBoot,
@@ -1279,7 +1336,7 @@ async function runHttp(composition) {
 		}
 		const entry = {
 			settledAt: null,
-			verdict: withProbeDeadline$1((verifyBoot === null ? Promise.resolve() : verifyBoot()).then(() => runProbe$1(pool, instance.tenantId, (client) => client.query("SELECT 1 FROM corpora LIMIT 1")))).then(() => ({ ok: true }), (error) => ({
+			verdict: withProbeDeadline$1((verifyBoot === null ? Promise.resolve() : verifyBoot()).then(() => runProbe$1(pool, instance.tenantId, (client) => composition.probePublished(client)))).then(() => ({ ok: true }), (error) => ({
 				ok: false,
 				error
 			}))
@@ -1325,6 +1382,7 @@ async function runHttp(composition) {
 			corpus_id: instance.corpusId,
 			store: verdict.ok ? "reachable" : notReadyReason(verdict.error),
 			boot_checks: bootVerified() ? "passed" : "NOT PASSED — every request is being refused until schema, governance, the audience list and the embedding space all verify; the reason is in this server's logs",
+			generation: bootVerified() ? generationPosture(composition.published, composition.refreshHint) : "not resolved — boot checks have not passed",
 			abstain_gate: abstainPosture(instance.abstain.vectorFloor, instance.abstain.floorDigest),
 			embedding_space: composition.spaceSkipReason === null ? `${instance.embeddingModel}/d${instance.embeddingDim} ok` : `${instance.embeddingModel}/d${instance.embeddingDim} unverified (check skipped: ${composition.spaceSkipReason})`,
 			auth: auth.mode
@@ -1533,7 +1591,7 @@ async function main$1(version = GATEWAY_VERSION) {
 	}
 }
 //#endregion
-//#region ../content/dist/check-6fB_kR4G.mjs
+//#region ../content/dist/check-Nd8zkMvH.mjs
 /**
 * One reader for the control files beside the bundle (`.ksor/*.yaml`): the
 * same parser posture as a concept's frontmatter — one document, unique keys,
@@ -3523,6 +3581,394 @@ function nearMissOf(baseName) {
 	return null;
 }
 /**
+* The takedown ledger's OTHER baseline: every entry any COMMITTED version of
+* `.ksor/takedowns.yaml` has ever carried.
+*
+* The committed lock is a baseline too, and a good one — it holds each entry's
+* digest, so an entry retargeted in place is caught. What it cannot do is prove
+* that an entry was never deleted, because the lock travels in the SAME change
+* as the ledger: delete the row, recompute `ledger_sha256`, empty
+* `ledger_entries`, and the two agree with each other about a denial that is
+* gone. Only history remembers.
+*
+* The baseline may be INCOMPLETE only if it SAYS so: every version history
+* holds is read, or `entries` comes back null and the caller reports that it
+* could not verify. A version silently skipped would contribute neither
+* digests nor ids while the answer still read "verified"
+* (`git-ledger.integration.test.ts`).
+*
+* This lives in the record module because THREE surfaces need the same answer —
+* `ksor build`, the emitted checker, and the site's stage (decision 19: a
+* surface that refuses must refuse on both surfaces). Plain `git log` / `git
+* show`, so nothing here needs installing.
+*/
+const LEDGER = ".ksor/takedowns.yaml";
+/**
+* `spawnSync` defaults to a 1 MB stdout buffer, and past it the child is KILLED
+* — `status` comes back null, so the query reads as a failure. A ledger with a
+* few thousand entries, or one entry carrying a long reason, clears 1 MB
+* easily, and the version was then dropped from the baseline while the caller
+* was still told history had been verified. The ceiling stays finite on
+* purpose: past it this returns null, which is a state the caller SAYS.
+*/
+const MAX_BUFFER$1 = 67108864;
+/** One git query, read-only. Null on any non-zero exit, including no git at all. */
+function git(root, args) {
+	const r = spawnSync("git", [...args], {
+		cwd: root,
+		encoding: "utf8",
+		maxBuffer: MAX_BUFFER$1
+	});
+	return r.status === 0 ? r.stdout : null;
+}
+function historicLedger(root) {
+	const inside = git(root, ["rev-parse", "--is-inside-work-tree"]);
+	if (inside === null || inside.trim() !== "true") return {
+		repository: false,
+		shallow: false,
+		entries: null,
+		unreadable: null
+	};
+	const shallow = (git(root, ["rev-parse", "--is-shallow-repository"]) ?? "").trim() === "true";
+	const born = git(root, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"HEAD"
+	]) !== null;
+	const entries = shallow ? null : born ? historicEntries(root) : [];
+	return {
+		repository: true,
+		shallow,
+		entries,
+		unreadable: entries !== null ? null : shallow ? "shallow" : "unreadable"
+	};
+}
+/**
+* Every id history has ever recorded, each with the text it carried the FIRST
+* time it was written. A version that parses contributes each entry's digest,
+* so an entry EDITED in place is caught, not only one deleted; a version that
+* no longer parses still contributes its ids, read permissively — the point
+* there is that an id once written never disappears.
+*
+* FIRST, not every: keying this by `id\tdigest` kept one baseline entry per
+* version an id ever had, so a tamper that was COMMITTED and then UNDONE left
+* two digests for one id, the restored entry matched only one of them, and
+* `ksor-ledger-amended` fired for good. The record became permanently
+* unbuildable — by a tamper that had already been put right — and the only
+* escape was rewriting git history, which is not a remedy a refusal may
+* demand (found in review, 2026-08-25).
+*
+* Taking the OLDEST is what makes the guarantee both enforceable and
+* escapable. It still refuses a committed tamper (the baseline is what the
+* entry said when it was written, so committing the edit does not launder
+* it), and the remedy it names — put the entry back — now actually clears
+* it. Taking the NEWEST would have done the opposite on both counts.
+*/
+function historicEntries(root) {
+	const atRoot = `${(git(root, ["rev-parse", "--show-prefix"]) ?? "").trim()}${LEDGER}`;
+	const commits = git(root, [
+		"log",
+		"--full-history",
+		"--topo-order",
+		"--format=%H",
+		"--",
+		LEDGER
+	]);
+	if (commits === null) return null;
+	const seen = /* @__PURE__ */ new Map();
+	for (const sha of commits.split("\n").filter((s) => s !== "")) {
+		const text = git(root, ["show", `${sha}:${atRoot}`]);
+		if (text === null) {
+			const listed = git(root, [
+				"ls-tree",
+				"--full-tree",
+				"--name-only",
+				sha,
+				"--",
+				atRoot
+			]);
+			if (listed !== null && listed.trim() === "") continue;
+			return null;
+		}
+		const where = sha.slice(0, 7);
+		const parsed = parseLedger(text, LEDGER);
+		if (parsed.ok) {
+			for (const entry of parsed.ledger.entries) seen.set(entry.id, {
+				id: entry.id,
+				digest: entryDigest(entry),
+				entry,
+				where
+			});
+			continue;
+		}
+		for (const m of text.matchAll(/^\s*(?:-\s+)?id:\s*["']?([^\s"']+)/gm)) {
+			const id = m[1] ?? "";
+			if (!seen.has(id)) seen.set(id, {
+				id,
+				digest: null,
+				where
+			});
+		}
+	}
+	return [...seen.values()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+}
+/**
+* KSP R23 — the first verification tooth in approval.
+*
+* A `stable` concept's `generated.at` dates its TEXT, and `ksor.approval.at`
+* ratifies the text of that date. Until now the checker compared the two
+* authored instants and nothing else (`ksor-generated-after-approval`), so
+* whether an edit actually moved `generated.at` was the author's obligation:
+* change a sentence, leave the stamp, and the approval that ratified the old
+* sentence reads as ratifying the new one, with nothing red. This module
+* compares the body in the working tree against every committed version of
+* the same path that was `stable`, and refuses `ksor-generated-stale` when a
+* body differs under a `generated.at` the tree has not ADVANCED past — equal,
+* or moved backward, which changes the stamp without advancing it. Only the
+* body: a frontmatter-only
+* edit — a `verified` entry, a re-approval — is not a change to the text the
+* stamp dates.
+*
+* What it does NOT verify, and says so: who reviewed anything. R22 and R25
+* need an identity the platform can vouch for, and `approval.checked` stays
+* `"policy"` (decision 21). This is the one rule in the record module that
+* reads git, so it sits beside `git-ledger.ts` and is run by the two
+* publishing verbs — `ksor build` and `ksor ingest` — each of which SAYS when
+* history could not be read rather than passing a check that did not run. The
+* emitted `check.mjs` does not run it: that is the format gate an agent runs
+* after every edit, and a stamp is verified where the record is published.
+*/
+/** The record's bundle, and the only pathspec the walk needs (relative to the cwd, which is the record root). */
+const BUNDLE$2 = "knowledge/";
+/**
+* Objects per `git cat-file --batch` call. One process per object was measured
+* at ~53 ms a call on the machine this was built on against ~0.6 ms an object
+* batched (2026-09-02), so a record with a few hundred committed versions is
+* the difference between a build that finishes and one that does not. Chunked
+* so the reply stays under the buffer ceiling `git-ledger.ts` explains.
+*/
+const BATCH = 256;
+const MAX_BUFFER = 67108864;
+/**
+* Every committed version of each path, read in three git calls plus one
+* `cat-file --batch` per chunk. `--full-history`, for the reason the ledger
+* walk gives: default simplification follows a merge through the parent it is
+* TREESAME to, so a version that lived only on a branch never enters the set.
+* `-m`, because without a diff-merges option a merge commit lists NO paths at
+* all — verified against git 2.50 — and a conflict resolved by hand is a body
+* that is in neither parent; the same commit then prints once per parent, so
+* versions are keyed by (commit, path). That flag is held by the merge case in
+* `build.integration.test.ts`'s KSP R23 describe: drop `-m` here and the build
+* it expects to refuse exits 0 instead.
+*/
+function committedVersions(root, paths) {
+	const inside = git(root, ["rev-parse", "--is-inside-work-tree"]);
+	if (inside === null || inside.trim() !== "true") return {
+		repository: false,
+		born: false,
+		shallow: false,
+		versions: null
+	};
+	const shallow = (git(root, ["rev-parse", "--is-shallow-repository"]) ?? "").trim() === "true";
+	const born = git(root, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"HEAD"
+	]) !== null;
+	const versions = /* @__PURE__ */ new Map();
+	if (!born || paths.length === 0) return {
+		repository: true,
+		born,
+		shallow,
+		versions
+	};
+	const prefix = (git(root, ["rev-parse", "--show-prefix"]) ?? "").trim();
+	const log = git(root, [
+		"log",
+		"--full-history",
+		"-m",
+		"--format=%x1e%H %cI",
+		"--name-only",
+		"--",
+		BUNDLE$2
+	]);
+	if (log === null) return {
+		repository: true,
+		born,
+		shallow,
+		versions: null
+	};
+	const wanted = new Set(paths);
+	const refs = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const block of log.split("")) {
+		const [header = "", ...names] = block.split("\n");
+		const [sha = "", committedAt = ""] = header.trim().split(" ");
+		if (sha === "") continue;
+		for (const name of names) {
+			const trimmed = name.trim();
+			if (trimmed === "" || !trimmed.startsWith(prefix)) continue;
+			const rel = trimmed.slice(prefix.length);
+			if (!wanted.has(rel) || seen.has(`${sha} ${rel}`)) continue;
+			seen.add(`${sha} ${rel}`);
+			refs.push({
+				sha,
+				committedAt,
+				path: rel
+			});
+		}
+	}
+	const blobs = readBlobs(root, refs.map((r) => `${r.sha}:${prefix}${r.path}`));
+	if (blobs === null) return {
+		repository: true,
+		born,
+		shallow,
+		versions: null
+	};
+	refs.forEach((ref, i) => {
+		const text = blobs[i];
+		if (text === null || text === void 0) return;
+		const list = versions.get(ref.path) ?? [];
+		list.push({
+			sha: ref.sha,
+			committedAt: ref.committedAt,
+			text
+		});
+		versions.set(ref.path, list);
+	});
+	return {
+		repository: true,
+		born,
+		shallow,
+		versions
+	};
+}
+/**
+* `<rev>:<path>` specs → text, in order; null for a spec that names nothing,
+* and null for the WHOLE read when git failed — a version dropped in silence
+* would read as verified.
+*/
+function readBlobs(root, specs) {
+	const out = [];
+	for (let i = 0; i < specs.length; i += BATCH) {
+		const chunk = specs.slice(i, i + BATCH);
+		const r = spawnSync("git", ["cat-file", "--batch"], {
+			cwd: root,
+			input: `${chunk.join("\n")}\n`,
+			maxBuffer: MAX_BUFFER
+		});
+		if (r.status !== 0) return null;
+		const buf = r.stdout;
+		let at = 0;
+		for (let k = 0; k < chunk.length; k += 1) {
+			const nl = buf.indexOf(10, at);
+			if (nl === -1) return null;
+			const header = buf.subarray(at, nl).toString("utf8");
+			at = nl + 1;
+			if (header.endsWith(" missing")) {
+				out.push(null);
+				continue;
+			}
+			const [, type, sizeText] = header.split(" ");
+			const size = Number(sizeText);
+			if (type !== "blob" || !Number.isInteger(size) || at + size > buf.length) return null;
+			out.push(buf.subarray(at, at + size).toString("utf8"));
+			at += size + 1;
+		}
+	}
+	return out;
+}
+/** Line endings are the checkout's and a trailing blank line is nobody's edit; everything else is the text. */
+function comparable(body) {
+	return normalizeText(body).trimEnd();
+}
+/**
+* A committed version as a stable, stamped text — or null: a draft's body is
+* free, and a version the profile cannot read (no fence, broken YAML, no
+* `generated.at`) was never a stable version under the profile.
+*/
+function stableVersionOf(version, path) {
+	const split = splitFrontmatter(version.text, path);
+	if (!split.ok || split.frontmatter === null || split.frontmatter["status"] !== "stable") return null;
+	const generated = split.frontmatter["generated"];
+	if (typeof generated !== "object" || generated === null) return null;
+	const at = generated["at"];
+	if (typeof at !== "string") return null;
+	const generatedAt = parseInstant(at);
+	if (generatedAt === null) return null;
+	return {
+		sha: version.sha,
+		committedAt: version.committedAt,
+		generatedAt,
+		stamp: at,
+		body: comparable(split.body)
+	};
+}
+/**
+* The rule, pure: for every `stable` concept whose body differs from a
+* committed version that was `stable`, the tree's `generated.at` must be
+* strictly LATER than that version's. Equal is the defect this rule exists to
+* catch — edit the sentence, leave the stamp — and EARLIER is the same defect
+* with one more keystroke: backdating the stamp changes it without advancing
+* it, so the approval that ratified the old text still post-dates the new one.
+* Only strictly-later clears a version, which is exactly what the refusal's
+* own `fix` prints. All of history, not only HEAD's version — an edit
+* committed without a bump matches HEAD exactly, and it is the version BEHIND
+* it that tells (the shape CI sees). A path with no committed stable version
+* passes: stable for the first time, or renamed, since path is identity.
+* Instants are compared as instants, so two spellings of one moment are one
+* stamp.
+*/
+function checkGeneratedStale(concepts, files, versions) {
+	const refusals = [];
+	for (const concept of concepts) {
+		if (concept.status !== "stable" || concept.generatedAt === null) continue;
+		const text = files.get(concept.path);
+		if (text === void 0) continue;
+		const split = splitFrontmatter(text, concept.path);
+		if (!split.ok) continue;
+		const body = comparable(split.body);
+		for (const version of versions.get(concept.path) ?? []) {
+			const stable = stableVersionOf(version, concept.path);
+			if (stable === null || stable.generatedAt < concept.generatedAt || stable.body === body) continue;
+			const authored = concept.frontmatter["generated"]?.at;
+			const stamp = typeof authored === "string" ? authored : new Date(concept.generatedAt).toISOString();
+			const under = stable.generatedAt === concept.generatedAt ? `under the same \`generated.at\` (${stamp})` : `under \`generated.at\` ${stable.stamp}, LATER than the ${stamp} this file now carries (the stamp was moved backward, which changes it without advancing it)`;
+			refusals.push({
+				slug: "ksor-generated-stale",
+				path: concept.path,
+				why: `the body differs from the one committed at ${stable.sha.slice(0, 7)} (${stable.committedAt}), where this concept was \`stable\` ${under} — that instant dates the text, so an edit to a stable concept must advance it, or the approval that ratified the old text reads as ratifying the new one (KSP R23)`,
+				fix: "set `generated.at` to an instant after this edit, then re-approve: `ksor.approval.at` must not precede the new `generated.at` (`ksor-generated-after-approval`)"
+			});
+			break;
+		}
+	}
+	return refusals;
+}
+/** The two callers' one entry: read history for the stable concepts, judge, and say what could not be read. */
+function checkChangeControl(root, concepts, files) {
+	const history = committedVersions(root, concepts.filter((c) => c.status === "stable").map((c) => c.path));
+	return {
+		refusals: history.versions === null ? [] : checkGeneratedStale(concepts, files, history.versions),
+		notice: changeControlNotice(history)
+	};
+}
+/**
+* Honest absence in the build's own idiom — the `source: unspecified` line
+* already says the commit is unknown; this says the same of the check that
+* needs one. A check that could not run is never a check that passed.
+*/
+function changeControlNotice(history) {
+	const what = "so whether a stable concept's body changed under its `generated.at` (KSP R23) was not checked";
+	if (!history.repository) return `change-control: not checked — knowledge/ is not in a git repository (or git is not installed), ${what}`;
+	if (!history.born) return `change-control: not checked — the repository has no commits yet, ${what}`;
+	if (history.versions === null) return `change-control: not checked — git could not read the history of knowledge/ (\`git log -- knowledge/\` or \`git cat-file --batch\` failed), ${what}`;
+	if (history.shallow) return `change-control: checked against the ${[...history.versions.values()].reduce((n, list) => n + list.length, 0)} committed version(s) this shallow clone holds — a stable version beyond the shallow boundary was not read; fetch full history (\`git fetch --unshallow\`; in CI, \`fetch-depth: 0\`) to check all of it`;
+	return null;
+}
+/**
 * The audience rule, alone, with no imports and no side effects.
 *
 * CANONICAL COPY: `packages/content/src/lib/audience-rule.ts`. The scaffold's
@@ -3841,7 +4287,7 @@ function isSim(baseName) {
 * one by hand — nothing the old checker refused may become accepted silently.
 * Each rule keeps the scar that put it there.
 */
-const KNOWLEDGE$1 = "knowledge/";
+const KNOWLEDGE$1$1 = "knowledge/";
 const ASSET_EXTENSIONS = /* @__PURE__ */ new Set([
 	".png",
 	".jpg",
@@ -3869,7 +4315,7 @@ function checkHygiene(tree) {
 	const documents = tree.textPaths.filter((p) => p.endsWith(".md") && !p.endsWith("/index.md") && !p.endsWith("/log.md") && !p.endsWith("/README.md") && !COMPANION_SUFFIXES.some((s) => p.endsWith(s)));
 	if (documents.length === 0) refusals.push({
 		slug: "ksor-record-empty",
-		path: KNOWLEDGE$1,
+		path: KNOWLEDGE$1$1,
 		why: "the record has no concept — a KSoR is never empty; the site has nothing to render and the record stands behind nothing",
 		fix: "restore a document from git history, or add one: knowledge/<name>.md with the profile's frontmatter (record spec §2)"
 	});
@@ -4710,7 +5156,7 @@ async function withPgRetry(op, options = {}) {
 	throw lastError;
 }
 //#endregion
-//#region ../content/dist/commands-CO9-bQnb.mjs
+//#region ../content/dist/commands-DIKiyZBQ.mjs
 /**
 * EVAL-LOCKED constants, quarried verbatim from the oracle
 * (sor-agentfactory @ b554f91, config.py) — changing any of these is a
@@ -6308,6 +6754,15 @@ var OpenAiEmbeddingProvider = class {
 * directly, so it is not ported.)
 */
 /**
+* The stable first stderr line for a missing provider key, on BOTH planes:
+* `ksor serve` (through the gateway's `bootErrorLines`) and `ksor ingest` /
+* `ksor calibrate` (the write plane's `fail`). Exit 3 either way — the key is
+* the operator's environment — but an exit code is not a name, and this was
+* the one refusal in the first-hour path that printed its sentence with no
+* slug above it (found live, 2026-09-02).
+*/
+const PROVIDER_KEY_MISSING = "ksor-provider-key-missing";
+/**
 * A key-needing provider was built without an API key. A TYPED error (mirrors
 * EmbeddingSpaceMismatch) so a composition root classifies the missing-key case
 * by TYPE, not by string-matching this message — the exact prose-coupling scar
@@ -6315,6 +6770,7 @@ var OpenAiEmbeddingProvider = class {
 * exit-code mapping no longer breaks when it is reworded.
 */
 var MissingProviderKeyError = class extends Error {
+	slug = PROVIDER_KEY_MISSING;
 	providerName;
 	keyEnv;
 	/**
@@ -6366,12 +6822,6 @@ function entryFor(name) {
 	if (entry === void 0) throw new Error(`unknown embedding provider ${JSON.stringify(name)} — registered: ${Object.keys(PROVIDERS).sort().join(", ")}`);
 	return entry;
 }
-/** Whether the named provider's factory needs an API key. Unknown name → the
-* same loud error as building it, so a composition root can ask this FIRST
-* and still fail on a typo. */
-function providerNeedsApiKey(name) {
-	return entryFor(name).needsApiKey;
-}
 /**
 * The environment variable this provider's key comes from, or null when it
 * needs none. Unknown name → the same loud error as building it.
@@ -6880,6 +7330,31 @@ function parseQueriesFile(text) {
 	return normalizeQueries(queries);
 }
 /**
+* Where the out-of-corpus probes came from, and WHAT they are — decided once.
+*
+* These were two expressions and they disagreed. The label tested
+* `=== undefined` while the probes fell back through `?? BUILT_IN_OOC`, and the
+* CLI passes `null` when `--ooc-file` is absent (`commands.ts`) — so every
+* `ksor calibrate` without `--ooc-file` scored against the twenty BUILT-IN
+* far-domain probes and reported `ooc_source: "provided"`. `BUILT_IN_OOC_CAVEAT`
+* is gated on that field, and it is the one line that exists to stop an operator
+* pasting a floor blessed by far-domain probes — so it never printed on the path
+* that needs it most. Found reviewing PR #259, whose tutorial's own pasted
+* output is the evidence: a run with no `--ooc-file`, and no caveat above it.
+*
+* Returning both together is the fix rather than correcting one test: a source
+* label and the probes it labels cannot drift when one expression yields both.
+*/
+function resolveOoc(probes) {
+	return probes === void 0 || probes === null ? {
+		source: "built-in",
+		probes: BUILT_IN_OOC
+	} : {
+		source: "provided",
+		probes
+	};
+}
+/**
 * The scope every calibration statement binds: the widest viewer, the lowest
 * trust floor, and (through the predicate's default) lifecycle at now(). The
 * floor must be measured on the set the door serves — a draft, a not-yet-
@@ -6966,8 +7441,9 @@ async function runCalibration(pool, options) {
 		}
 		inQueries = normalizeQueries(synthesized);
 	}
-	const oocSource = options.oocProbes === void 0 ? "built-in" : "provided";
-	const ooc = normalizeQueries(options.oocProbes ?? BUILT_IN_OOC);
+	const resolved = resolveOoc(options.oocProbes);
+	const oocSource = resolved.source;
+	const ooc = normalizeQueries(resolved.probes);
 	return buildReport([...await scoreQueries(pool, scope, gucs, options.provider, inQueries, true), ...await scoreQueries(pool, scope, gucs, options.provider, ooc, false)], {
 		generation: counted.measured,
 		pinned: generation !== null,
@@ -7636,21 +8112,6 @@ async function reap(client, opts) {
 	for (;;) if (!(await client.query("DELETE FROM content_nodes n WHERE n.tenant_id = $1 AND n.generation = $2 AND NOT EXISTS (SELECT 1 FROM content_nodes ch WHERE ch.parent_id = n.node_id                  AND ch.tenant_id = n.tenant_id AND ch.generation = n.generation)", [opts.tenantId, opts.generation])).rowCount) break;
 	await client.query("UPDATE ingestion_runs SET state = 'reaped' WHERE tenant_id = $1 AND generation = $2", [opts.tenantId, opts.generation]);
 }
-async function readLedger(pool, instance, limit) {
-	return runAuditRead(pool, instance.tenantId, async (client) => {
-		return (await client.query("SELECT action, actor, generation, detail, created_at FROM retrieval_log WHERE tenant_id = $1 AND corpus_id = $2 ORDER BY created_at DESC, id DESC LIMIT $3", [
-			instance.tenantId,
-			instance.corpusId,
-			limit
-		])).rows.map((row) => ({
-			action: String(row.action),
-			actor: String(row.actor),
-			generation: row.generation === null ? null : Number(row.generation),
-			detail: row.detail ?? {},
-			createdAt: row.created_at
-		}));
-	});
-}
 async function listTakedowns(pool, instance) {
 	return runRead(pool, instance.tenantId, async (client) => {
 		return (await client.query("SELECT stable_id, scope, reason, created_at FROM takedown_denylist WHERE tenant_id = $1 AND corpus_id = $2 AND revoked_at IS NULL ORDER BY created_at, stable_id", [instance.tenantId, instance.corpusId])).rows.map((r) => ({
@@ -7685,10 +8146,10 @@ function ledgerDenials(ledger) {
 * What `--ledger` prints: every entry the file records, newest first, in the
 * shape the database trail uses — the act, who, and the detail.
 *
-* NOT the same trail as the database's: with a `database:` the flag reads §7
-* `retrieval_log` acts, which include the APPLY. Here it is the file's own
-* history, which is the only history this rung has and the one `--revoke` needs
-* ids from.
+* NOT the database's §7 trail, which also records the APPLY of each entry to
+* the door and which no verb prints. The file's own history is what the flag
+* prints on every rung — it is the record of the act (record spec §5), it is
+* where `--revoke`'s entry ids live, and it never needs a DSN.
 */
 function ledgerActs(ledger) {
 	return [...ledger.entries].map((e) => {
@@ -9097,7 +9558,7 @@ function formatRefusals(refusals) {
 	return refusals.map((r) => `${r.slug}: ${r.path}\n  why: ${r.why}\n  fix: ${r.fix}`).join("\n");
 }
 const LOCK_PATH = "build.lock.json";
-const KNOWLEDGE = "knowledge/";
+const KNOWLEDGE$1 = "knowledge/";
 const NOT_A_CONCEPT = /(^|\/)(index|log|README)\.md$|\.summary\.md$/;
 const INDEX = /(^|\/)index\.md$/;
 const INSTANCE_PATH = "instance.md";
@@ -9126,7 +9587,7 @@ function sha256OfDocument(text) {
 function conceptHashes(record) {
 	const out = /* @__PURE__ */ new Map();
 	for (const [path, text] of record.files) {
-		if (!path.startsWith(KNOWLEDGE) || !path.endsWith(".md") || NOT_A_CONCEPT.test(path)) continue;
+		if (!path.startsWith(KNOWLEDGE$1) || !path.endsWith(".md") || NOT_A_CONCEPT.test(path)) continue;
 		out.set(path.slice(10), sha256OfDocument(text));
 	}
 	return out;
@@ -9146,7 +9607,7 @@ function conceptHashes(record) {
 function companionHashes(record) {
 	const out = /* @__PURE__ */ new Map();
 	for (const [path, text] of record.files) {
-		if (!path.startsWith(KNOWLEDGE)) continue;
+		if (!path.startsWith(KNOWLEDGE$1)) continue;
 		if (attachmentKindOf(path.slice(path.lastIndexOf("/") + 1)) === null) continue;
 		out.set(path.slice(10), sha256OfDocument(text));
 	}
@@ -9163,7 +9624,7 @@ function companionHashes(record) {
 function indexHashes(record) {
 	const out = /* @__PURE__ */ new Map();
 	for (const [path, text] of record.files) {
-		if (!path.startsWith(KNOWLEDGE) || !INDEX.test(path)) continue;
+		if (!path.startsWith(KNOWLEDGE$1) || !INDEX.test(path)) continue;
 		out.set(path.slice(10), sha256OfDocument(text));
 	}
 	return out;
@@ -9179,7 +9640,7 @@ function indexHashes(record) {
 function assetHashes(record) {
 	const out = /* @__PURE__ */ new Map();
 	for (const [path, bytes] of record.assets ?? /* @__PURE__ */ new Map()) {
-		if (!path.startsWith(KNOWLEDGE)) continue;
+		if (!path.startsWith(KNOWLEDGE$1)) continue;
 		out.set(path.slice(10), createHash("sha256").update(bytes).digest("hex"));
 	}
 	return out;
@@ -9731,7 +10192,9 @@ async function buildGeneration(pool, instance, options) {
 			accepted: true
 		}]
 	});
-	if (check.refusals.length > 0 || check.policy === null) throw new RecordRefused(check.refusals);
+	const change = checkChangeControl(root, check.concepts, record.files);
+	if (check.refusals.length > 0 || change.refusals.length > 0 || check.policy === null) throw new RecordRefused([...check.refusals, ...change.refusals]);
+	if (change.notice !== null) (options.onReport ?? log)(change.notice);
 	const policy = check.policy;
 	const lock = checkLock(lockText, record);
 	if (!lock.ok) throw new RecordRefused([lock.refusal]);
@@ -10062,9 +10525,10 @@ function renderDrift(report, window) {
 * zero would drag every statistic here toward a number nobody measured, in the
 * direction that makes a floor look safer than it is.
 *
-* Scoped by CORPUS as well as tenant, for the reason `readLedger` records: a
-* tenant serving two corpora would otherwise measure one record's floor
-* against the other's traffic. Read through `runAuditRead` — the serving role
+* Scoped by CORPUS as well as tenant, because every governance write records
+* `corpus_id`: a tenant serving two corpora — the shape the second record
+* prepares for — would otherwise measure one record's floor against the
+* other's traffic. Read through `runAuditRead` — the serving role
 * has no SELECT on this table at all, deliberately, and widening that to read
 * a monitor would trade an audit guarantee for a convenience.
 */
@@ -10285,7 +10749,8 @@ Usage:
       --check reads the record's OWN logged searches instead and reports how
       the declared floor is holding against them — no provider key, no
       embedding call, no LLM. A monitor, never a gate: it says what to
-      re-measure and always exits 0.
+      re-measure, and a verdict always exits 0 — the environment exits 3, as
+      for every verb.
   ksor grant --instance PATH [--revoke]
       Authorize ingest for the instance's tenant (the row row-level security
       requires), or withdraw it. Idempotent; reports the state it established.
@@ -10324,10 +10789,11 @@ Exit codes: 0 ok · 1 refused · 3 environment
 function usageFor(command) {
 	const lines = USAGE.split("\n");
 	const isHeading = (l) => /^ {2}ksor \S/.test(l);
-	const start = lines.findIndex((l) => isHeading(l) && l.trimStart().startsWith(`ksor ${command}`));
+	const verbOf = (l) => l.trimStart().split(/\s+/)[1];
+	const start = lines.findIndex((l) => isHeading(l) && verbOf(l) === command);
 	if (start === -1) return USAGE;
 	const rest = lines.slice(start + 1);
-	const end = rest.findIndex(isHeading);
+	const end = rest.findIndex((l) => isHeading(l) && verbOf(l) !== command);
 	return `${[lines[start], ...end === -1 ? rest : rest.slice(0, end)].join("\n").replace(/\s+$/, "")}\n`;
 }
 function fail$1(code, message) {
@@ -10396,18 +10862,13 @@ function resolveDsn(instance) {
 /** The ingest composition root's provider step (oracle cli.py:58-74). */
 function composeProvider(instance) {
 	try {
-		let apiKey = null;
-		if (providerNeedsApiKey(instance.embeddingProvider)) {
-			const keyEnv = providerKeyEnv(instance.embeddingProvider) ?? "";
-			apiKey = process.env[keyEnv] || null;
-			if (apiKey === null) return fail$1(ENVIRONMENT, `${keyEnv} is required (the instance's embedding provider ${JSON.stringify(instance.embeddingProvider)} needs a key)\n  fix: export ${keyEnv}=... and rerun`);
-		}
 		return buildShippedProvider(instance.embeddingProvider, {
-			apiKey,
+			apiKey: process.env[providerKeyEnv(instance.embeddingProvider) ?? ""] || null,
 			modelId: instance.embeddingModel,
 			dim: instance.embeddingDim
 		});
 	} catch (exc) {
+		if (exc instanceof MissingProviderKeyError) return fail$1(ENVIRONMENT, `error: ${exc.slug}\n${exc.message}\n  fix: export ${exc.keyEnv ?? "the key"}=... and rerun`);
 		return refuse$2("ksor-instance-format", `instance embedding.provider: ${exc instanceof Error ? exc.message : String(exc)}`);
 	}
 }
@@ -10775,13 +11236,18 @@ function printLedger(rows) {
 		process.stdout.write(`${when}\t${r.action}\t${r.actor}\t${JSON.stringify(r.detail)}\n`);
 	}
 }
-/** One denial in force per line: what, at which scope, why. */
-function printDenials(rows) {
+/**
+* One denial in force per line: what, at which scope, why — and, when the
+* lines come from the FILE rather than the door's rows, a fourth column saying
+* so, because a ledger entry is the act and a row is its projection, and only
+* the row is what the door refuses on.
+*/
+function printDenials(rows, label = null) {
 	if (rows.length === 0) {
 		process.stdout.write("takedown: nothing is denied in this corpus\n");
 		return;
 	}
-	for (const r of rows) process.stdout.write(`${r.stableId}\t${r.scope}\t${r.reason}\n`);
+	for (const r of rows) process.stdout.write(`${r.stableId}\t${r.scope}\t${r.reason}${label === null ? "" : `\t${label}`}\n`);
 }
 async function takedownCommand(args) {
 	const { values, positionals } = parseArgs({
@@ -10856,15 +11322,24 @@ async function takedownCommand(args) {
 	const parsedLedger = parseLedger(existsSync(ledgerPath) ? readFileSync(ledgerPath, "utf8") : null, ".ksor/takedowns.yaml");
 	if (!parsedLedger.ok) return refuse$2(parsedLedger.refusals[0].slug, parsedLedger.refusals.map((r) => `${r.slug}: ${r.path}\n  why: ${r.why}\n  fix: ${r.fix}`).join("\n"));
 	if (mode.kind === "list" || mode.kind === "ledger" || mode.kind === "apply") {
+		if (mode.kind === "ledger") {
+			process.stdout.write("ledger: from .ksor/takedowns.yaml — the committed record of every governance act\n");
+			printLedger(ledgerActs(parsedLedger.ledger));
+			return 0;
+		}
 		if (instance === null) {
 			if (mode.kind === "apply") {
 				process.stdout.write("takedown: instance.md declares no database, so there is nothing to apply — the ledger IS the record and the site reads it at its next build\n");
 				return 0;
 			}
-			process.stdout.write(`${mode.kind === "ledger" ? "ledger" : "takedown"}: from .ksor/takedowns.yaml — instance.md declares no database, so the committed ledger is the whole state
+			process.stdout.write("takedown: from .ksor/takedowns.yaml — instance.md declares no database, so the committed ledger is the whole state\n");
+			printDenials(ledgerDenials(parsedLedger.ledger));
+			return 0;
+		}
+		if (mode.kind === "list" && (process.env[instance.dsnEnv] ?? "") === "") {
+			process.stdout.write(`takedown: from .ksor/takedowns.yaml — ${instance.dsnEnv} is unset, so no denylist row was read; each denial below is the ledger's word, not a row the door refuses on
 `);
-			if (mode.kind === "ledger") printLedger(ledgerActs(parsedLedger.ledger));
-			else printDenials(ledgerDenials(parsedLedger.ledger));
+			printDenials(ledgerDenials(parsedLedger.ledger), "not applied (no database)");
 			return 0;
 		}
 		const dsn = resolveDsn(instance);
@@ -10875,10 +11350,6 @@ async function takedownCommand(args) {
 			for (const line of unmergedLines(applied.unmerged)) process.stderr.write(line + "\n");
 			return 0;
 		}
-		if (mode.kind === "ledger") {
-			printLedger(await withPool(dsn, (pool) => readLedger(pool, instance, 50)));
-			return 0;
-		}
 		printDenials(await withPool(dsn, (pool) => listTakedowns(pool, instance)));
 		return 0;
 	}
@@ -11039,7 +11510,7 @@ async function runContentCli(argv) {
 	}
 }
 //#endregion
-//#region ../content/dist/record-Cxw0SUG3.mjs
+//#region ../content/dist/record-CKv4cZY8.mjs
 /**
 * May `surface` publish `doc` at instant `at`? `drafts` is the build's drafts switch,
 * which admits drafts to HUMAN surfaces only.
@@ -11070,6 +11541,11 @@ const OKF_PIN = {
 };
 const hex64 = z.string().regex(/^[0-9a-f]{64}$/, "a sha256 hex digest");
 const viewerList = z.array(z.string().min(1));
+const bundleEntry = z.object({
+	viewer: z.string().min(1),
+	sha256: hex64,
+	files: z.number().int().nonnegative()
+}).strict();
 const lockSchema = z.object({
 	format: z.literal(1),
 	build_id: z.string().regex(/^sha256:[0-9a-f]{64}$/),
@@ -11117,7 +11593,8 @@ const lockSchema = z.object({
 	indexes: z.array(z.object({
 		path: z.string().min(1),
 		sha256: hex64
-	}).strict())
+	}).strict()),
+	bundles: z.array(bundleEntry)
 }).strict();
 function parseLock(text) {
 	let value;
@@ -11239,144 +11716,119 @@ function composeLock(input) {
 		documents,
 		companions,
 		assets,
-		indexes
+		indexes,
+		bundles: input.bundles.map((b) => ({
+			viewer: b.viewer,
+			sha256: b.sha256,
+			files: b.files
+		}))
 	};
 }
 function compare(a, b) {
 	return a < b ? -1 : a > b ? 1 : 0;
 }
-/**
-* The takedown ledger's OTHER baseline: every entry any COMMITTED version of
-* `.ksor/takedowns.yaml` has ever carried.
-*
-* The committed lock is a baseline too, and a good one — it holds each entry's
-* digest, so an entry retargeted in place is caught. What it cannot do is prove
-* that an entry was never deleted, because the lock travels in the SAME change
-* as the ledger: delete the row, recompute `ledger_sha256`, empty
-* `ledger_entries`, and the two agree with each other about a denial that is
-* gone. Only history remembers.
-*
-* The baseline may be INCOMPLETE only if it SAYS so: every version history
-* holds is read, or `entries` comes back null and the caller reports that it
-* could not verify. A version silently skipped would contribute neither
-* digests nor ids while the answer still read "verified"
-* (`git-ledger.integration.test.ts`).
-*
-* This lives in the record module because THREE surfaces need the same answer —
-* `ksor build`, the emitted checker, and the site's stage (decision 19: a
-* surface that refuses must refuse on both surfaces). Plain `git log` / `git
-* show`, so nothing here needs installing.
+//#endregion
+//#region src/build/bundles.ts
+/**
+* `ksor build --bundles` (build spec §1 step 4; KSP-001 Class E, R15): one
+* OKF bundle per canonical viewer, holding exactly what that viewer's MACHINE
+* surfaces publish. Pure — the CLI hands in the record the loader read and
+* the admission the lock decided, and writes what comes back.
+*
+* Selection is NOT re-derived here. A concept is in the bundle for viewer V
+* iff the lock admits it to V (`admittedViewersOf`: stable, effective,
+* unexpired, undenied, audience-overlapping) — the same predicate the site's
+* stage and the door's `admitted` set compose (decision 18). What this module
+* adds is what travels WITH a concept: its companions, the assets its body
+* references, and an index for every directory of the filtered tree —
+* regenerated, never the committed map, which lists every status and every
+* audience (decision 27's index clause).
+*
+* R5 for a directory someone will send somewhere: no byte of a concept the
+* viewer may not read. The AUDIENCE half is closed upstream — the checker
+* refuses a link, a supersession pointer or a companion body that reaches a
+* narrower audience (`ksor-link-widens`), and an asset positioned under a
+* narrower directory with it — so a body copied verbatim cannot name what its
+* own readers may not open. A link to a concept excluded for another reason
+* (a draft, one not yet effective, one past `stale_after`, one denied) is a
+* different case: R5 is about audience, the body stays verbatim rather than
+* being rewritten, and the link dangles — REPORTED per bundle rather than
+* silently shipped, which is what `dangling` is for.
 */
-const LEDGER = ".ksor/takedowns.yaml";
+const KNOWLEDGE = "knowledge/";
 /**
-* `spawnSync` defaults to a 1 MB stdout buffer, and past it the child is KILLED
-* — `status` comes back null, so the query reads as a failure. A ledger with a
-* few thousand entries, or one entry carrying a long reason, clears 1 MB
-* easily, and the version was then dropped from the baseline while the caller
-* was still told history had been verified. The ceiling stays finite on
-* purpose: past it this returns null, which is a state the caller SAYS.
+* The companions of every concept, keyed by the parent's id — derived from the
+* canonical attachment rule, never from a suffix list of this module's own
+* (`build.integration.test.ts` refuses a hand copy anywhere in this package).
 */
-const MAX_BUFFER = 67108864;
-/** One git query, read-only. Null on any non-zero exit, including no git at all. */
-function git(root, args) {
-	const r = spawnSync("git", [...args], {
-		cwd: root,
-		encoding: "utf8",
-		maxBuffer: MAX_BUFFER
-	});
-	return r.status === 0 ? r.stdout : null;
+function companionsByParent(files) {
+	const out = /* @__PURE__ */ new Map();
+	for (const file of files.keys()) {
+		if (!file.startsWith(KNOWLEDGE)) continue;
+		const rel = file.slice(10);
+		const base = rel.slice(rel.lastIndexOf("/") + 1);
+		if (attachmentKindOf(base) === null) continue;
+		const parent = parentDocumentOf(base);
+		if (parent === null) continue;
+		const parentId = `${rel.slice(0, rel.length - base.length)}${parent}`.replace(/\.md$/, "");
+		out.set(parentId, [...out.get(parentId) ?? [], rel]);
+	}
+	return out;
 }
-function historicLedger(root) {
-	const inside = git(root, ["rev-parse", "--is-inside-work-tree"]);
-	if (inside === null || inside.trim() !== "true") return {
-		repository: false,
-		shallow: false,
-		entries: null,
-		unreadable: null
-	};
-	const shallow = (git(root, ["rev-parse", "--is-shallow-repository"]) ?? "").trim() === "true";
-	const born = git(root, [
-		"rev-parse",
-		"--verify",
-		"--quiet",
-		"HEAD"
-	]) !== null;
-	const entries = shallow ? null : born ? historicEntries(root) : [];
-	return {
-		repository: true,
-		shallow,
-		entries,
-		unreadable: entries !== null ? null : shallow ? "shallow" : "unreadable"
-	};
+function planBundles(input) {
+	const companions = companionsByParent(input.files);
+	const conceptIds = new Set(input.concepts.map((c) => c.id));
+	const dirs = input.dirs.filter((d) => d.startsWith(KNOWLEDGE)).map((d) => d.slice(10));
+	return input.viewers.map((viewer) => {
+		const files = /* @__PURE__ */ new Map();
+		const admitted = input.concepts.filter((c) => c.admitted.includes(viewer));
+		const held = new Set(admitted.map((c) => c.id));
+		const dangling = [];
+		for (const concept of admitted) {
+			const bodies = [[`${concept.id}.md`, input.files.get(`${KNOWLEDGE}${concept.id}.md`) ?? ""], ...(companions.get(concept.id) ?? []).map((rel) => [rel, input.files.get(`${KNOWLEDGE}${rel}`) ?? ""])];
+			for (const [rel, text] of bodies) {
+				files.set(rel, Buffer.from(text, "utf8"));
+				const split = splitFrontmatter(text, rel);
+				const seen = /* @__PURE__ */ new Set();
+				for (const target of linkTargets(split.ok ? split.body : text)) {
+					const id = resolveLink(concept.id, target);
+					if (id === null || seen.has(id)) continue;
+					seen.add(id);
+					const asset = input.assets.get(`${KNOWLEDGE}${id}`);
+					if (asset !== void 0) files.set(id, asset);
+					else if (conceptIds.has(id) && !held.has(id)) dangling.push({
+						from: rel,
+						to: `${id}.md`
+					});
+				}
+			}
+		}
+		const indexes = generateIndexes({
+			title: input.title,
+			concepts: admitted.map((c) => ({
+				id: c.id,
+				title: c.title,
+				description: c.description,
+				order: c.order
+			})),
+			dirs
+		});
+		for (const [rel, text] of indexes) files.set(rel, Buffer.from(text, "utf8"));
+		return {
+			viewer,
+			files,
+			dangling
+		};
+	});
 }
 /**
-* Every id history has ever recorded, each with the text it carried the FIRST
-* time it was written. A version that parses contributes each entry's digest,
-* so an entry EDITED in place is caught, not only one deleted; a version that
-* no longer parses still contributes its ids, read permissively — the point
-* there is that an id once written never disappears.
-*
-* FIRST, not every: keying this by `id\tdigest` kept one baseline entry per
-* version an id ever had, so a tamper that was COMMITTED and then UNDONE left
-* two digests for one id, the restored entry matched only one of them, and
-* `ksor-ledger-amended` fired for good. The record became permanently
-* unbuildable — by a tamper that had already been put right — and the only
-* escape was rewriting git history, which is not a remedy a refusal may
-* demand (found in review, 2026-08-25).
-*
-* Taking the OLDEST is what makes the guarantee both enforceable and
-* escapable. It still refuses a committed tamper (the baseline is what the
-* entry said when it was written, so committing the edit does not launder
-* it), and the remedy it names — put the entry back — now actually clears
-* it. Taking the NEWEST would have done the opposite on both counts.
+* The digest `build.lock.json` records for a bundle: sha256 over the JSON of
+* its sorted `[path, sha256(bytes)]` pairs. Stated this plainly so a recipient
+* holding only the directory can recompute it and match it to a publication.
 */
-function historicEntries(root) {
-	const atRoot = `${(git(root, ["rev-parse", "--show-prefix"]) ?? "").trim()}${LEDGER}`;
-	const commits = git(root, [
-		"log",
-		"--full-history",
-		"--topo-order",
-		"--format=%H",
-		"--",
-		LEDGER
-	]);
-	if (commits === null) return null;
-	const seen = /* @__PURE__ */ new Map();
-	for (const sha of commits.split("\n").filter((s) => s !== "")) {
-		const text = git(root, ["show", `${sha}:${atRoot}`]);
-		if (text === null) {
-			const listed = git(root, [
-				"ls-tree",
-				"--full-tree",
-				"--name-only",
-				sha,
-				"--",
-				atRoot
-			]);
-			if (listed !== null && listed.trim() === "") continue;
-			return null;
-		}
-		const where = sha.slice(0, 7);
-		const parsed = parseLedger(text, LEDGER);
-		if (parsed.ok) {
-			for (const entry of parsed.ledger.entries) seen.set(entry.id, {
-				id: entry.id,
-				digest: entryDigest(entry),
-				entry,
-				where
-			});
-			continue;
-		}
-		for (const m of text.matchAll(/^\s*(?:-\s+)?id:\s*["']?([^\s"']+)/gm)) {
-			const id = m[1] ?? "";
-			if (!seen.has(id)) seen.set(id, {
-				id,
-				digest: null,
-				where
-			});
-		}
-	}
-	return [...seen.values()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+function bundleDigest(files) {
+	const pairs = [...files].map(([rel, bytes]) => [rel, sha256Hex(bytes)]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+	return sha256Hex(JSON.stringify(pairs));
 }
 //#endregion
 //#region src/build/git.ts
@@ -11504,7 +11956,7 @@ const iso = (ms) => new Date(ms).toISOString();
 * and `build.lock.json`. Database-free, network-free. A refusal leaves the
 * tree exactly as it found it, with the slug on the first stderr line.
 */
-const BUILD_USAGE = `Usage: ksor build [--instance <path>] [--as-of <instant>] [--strict] [--allow-unverifiable-ledger]
+const BUILD_USAGE = `Usage: ksor build [--instance <path>] [--as-of <instant>] [--strict] [--allow-unverifiable-ledger] [--bundles]
 
 Generates every knowledge/**/index.md in memory, runs the record checker, and
 on green writes the indexes whose bytes changed plus build.lock.json — the
@@ -11519,8 +11971,35 @@ toolchain. A refusal (exit 1, slug first on stderr) writes nothing.
   --allow-unverifiable-ledger
                       build on a shallow clone, where the ledger's history
                       cannot be checked for deleted entries
-  --bundles           designed, not implemented (exit 2)
+  --bundles           also write one OKF bundle per viewer under
+                      .ksor/out/bundles/<viewer>/ — public, and [public, X]
+                      for each registered audience X — holding only what that
+                      viewer's machine surfaces publish, with its indexes
+                      regenerated for that tree; any OKF consumer reads it
+                      with no ksor in the loop. The lock beside them names
+                      the build. The directory is replaced on every run.
 `;
+/** What `--bundles` writes, record-relative. Gitignored by the scaffold's `.ksor/*` rule. */
+const BUNDLES_DIR = ".ksor/out/bundles";
+const LOCK_NAME = "build.lock.json";
+/**
+* An audience identifier that can be a directory name. The policy admits any
+* non-empty string as a registry key, and every other surface uses one only as
+* a token — `--bundles` is the first to use it as a PATH, so `../x` written as
+* given would land outside the output directory. The first character must be a
+* letter or a digit, which is what stops `.`, `..`, a dotfile and a name a
+* shell reads as a flag; `-`, `_` and `.` are fine after it.
+*
+* The LAST character may not be a `.`. Win32 path normalization strips a
+* trailing dot from a path segment, so `internal.` and `internal` are two
+* viewers in the policy and ONE directory on Windows — the case rule's merge
+* exactly, and the case fold cannot see it. Refused on every platform, for the
+* reason that rule gives: a record must not build here and leak there. A `.`
+* INSIDE the name (`v1.2`) is untouched; nothing normalizes it away.
+*/
+const PATH_SEGMENT = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9_-])?$/;
+/** {@link PATH_SEGMENT} in words, in ONE place, so the refusal and the docs cannot drift from the regex. */
+const PATH_SEGMENT_PROSE = "a letter or a digit first, then letters, digits, `-`, `_` and `.`, and never a `.` last";
 function parseArgs$2(args) {
 	let instance = null;
 	let asOf = null;
@@ -11577,6 +12056,40 @@ function refuse$1(io, slug, why, fix) {
 	io.err(`error: ${slug}\n${why}\n  fix: ${fix}\n`);
 	return exitCodes.refused;
 }
+/**
+* What every canonical viewer name has to be for `.ksor/out/bundles/<name>/`
+* to hold what the lock says it holds.
+*
+* Run on EVERY build, not only under `--bundles`, because `bundles[]` is in
+* the lock on every build: a plain build that let `../escape` through would
+* commit a digest for a directory the tool refuses to write — provenance for
+* something that cannot exist (invariant: provenance is load-bearing). The
+* alternative considered was omitting unbuildable viewers from `bundles[]`;
+* it keeps the lock honest too, but leaves the record broken and the owner
+* unwarned until their first exchange, which is the weaker guarantee. Here
+* the owner learns at the build they already run.
+*/
+function viewerRefusal(viewers) {
+	const list = (ids) => ids.map((v) => JSON.stringify(v)).join(", ");
+	const unsafe = viewers.filter((v) => !PATH_SEGMENT.test(v) || v.toLowerCase() === LOCK_NAME);
+	if (unsafe.length > 0) return {
+		slug: "ksor-audience-identifier-invalid",
+		why: `the audience identifier${unsafe.length === 1 ? "" : "s"} ${list(unsafe)} cannot name a bundle directory: --bundles writes each viewer's bundle to ${BUNDLES_DIR}/<identifier>/ beside a copy of ${LOCK_NAME}, so an identifier that is not a plain path segment would land somewhere else, one ending in \`.\` names a DIFFERENT directory on Windows (which strips a trailing dot from a path segment, merging it into the name without one), and one named ${LOCK_NAME} would collide with the lock. build.lock.json records that bundle's digest on EVERY build, flag or not, so this is refused here rather than only under --bundles`,
+		fix: `name audiences in plain words (${PATH_SEGMENT_PROSE}) in .ksor/governance.yaml and in every \`ksor.audience\` list, then rebuild`
+	};
+	const byFold = /* @__PURE__ */ new Map();
+	for (const v of viewers) {
+		const fold = v.toLowerCase();
+		byFold.set(fold, [...byFold.get(fold) ?? [], v]);
+	}
+	const collided = [...byFold.values()].filter((group) => group.length > 1);
+	if (collided.length > 0) return {
+		slug: "ksor-audience-identifier-collides",
+		why: `${collided.map((g) => list(g)).join("; ")} differ only in case, so each set is several viewers naming ONE directory: --bundles writes ${BUNDLES_DIR}/<identifier>/ per viewer, and on a case-insensitive filesystem (macOS and Windows, by default) the later bundle merges into the earlier one — leaving a directory that holds concepts the viewer named on it may not read, and a digest in build.lock.json that no longer describes it. build.lock.json records each of those digests on EVERY build, flag or not, so this is refused here rather than only under --bundles`,
+		fix: `give each audience in .ksor/governance.yaml a name that differs by more than case — \`public\` is reserved, casefolded too — and update every \`ksor.audience\` list that named the one you dropped, then rebuild`
+	};
+	return null;
+}
 function runBuild(args, cwd, io, options) {
 	if (args.includes("--help") || args.includes("-h")) {
 		io.out(BUILD_USAGE);
@@ -11587,10 +12100,6 @@ function runBuild(args, cwd, io, options) {
 		io.err(`error: bad-args\n${parsed}\n${BUILD_USAGE}`);
 		return exitCodes.refused;
 	}
-	if (parsed.bundles) {
-		io.out(`ksor build --bundles: designed but not implemented in ${options.version}.\n`);
-		return exitCodes.notImplemented;
-	}
 	const start = parsed.instance === null ? cwd : existsSync(parsed.instance) && statSync(parsed.instance).isFile() ? path.dirname(path.resolve(cwd, parsed.instance)) : path.resolve(cwd, parsed.instance);
 	const root = resolveInstanceDir(start);
 	if (root === null) return refuse$1(io, "ksor-instance-missing", `no instance.md at or above ${start} — the record root is the directory holding it`, "run from inside the record, or pass --instance <path>");
@@ -11619,10 +12128,12 @@ function runBuild(args, cwd, io, options) {
 		mode: "build",
 		ledgerBaselines: baselines
 	});
-	if (result.refusals.length > 0) {
-		io.err(`error: ${result.refusals[0]?.slug ?? "ksor-refused"}\n`);
-		io.err(`ksor build: ${result.refusals.length} problem(s) — nothing written:\n\n`);
-		for (const r of result.refusals) io.err(`  ${formatRefusal(r)}\n\n`);
+	const change = checkChangeControl(root, result.concepts, record.files);
+	const refusals = sortRefusals([...result.refusals, ...change.refusals]);
+	if (refusals.length > 0) {
+		io.err(`error: ${refusals[0]?.slug ?? "ksor-refused"}\n`);
+		io.err(`ksor build: ${refusals.length} problem(s) — nothing written:\n\n`);
+		for (const r of refusals) io.err(`  ${formatRefusal(r)}\n\n`);
 		return exitCodes.refused;
 	}
 	const pendingIndexes = [...result.indexes].filter(([rel, text]) => record.files.get(rel) !== text).map(([rel]) => rel);
@@ -11631,18 +12142,38 @@ function runBuild(args, cwd, io, options) {
 	const ledgerText = record.files.get(".ksor/takedowns.yaml") ?? null;
 	const ledger = parseLedger(ledgerText, ".ksor/takedowns.yaml");
 	const denials = ledger.ok ? inForce(ledger.ledger) : [];
+	const asOf = parsed.asOf ?? Date.now();
+	const audiences = result.policy?.audiences ?? [];
+	const viewers = canonicalViewers(audiences);
+	const bad = viewerRefusal(Object.keys(viewers));
+	if (bad !== null) return refuse$1(io, bad.slug, bad.why, bad.fix);
+	const instance = parseInstanceDocument(record.files.get("instance.md") ?? "");
+	const bundles = planBundles({
+		title: instance.ok ? instance.instance.title : "Index",
+		viewers: Object.keys(viewers),
+		concepts: result.concepts.map((c) => ({
+			id: c.id,
+			title: c.title,
+			description: c.description,
+			order: c.order,
+			admitted: admittedViewersOf(c, viewers, asOf, denials)
+		})),
+		files: record.files,
+		assets: record.assets,
+		dirs: record.dirs
+	});
 	const lock = composeLock({
 		ksorVersion: options.version,
 		sourceCommit: facts.sourceCommit,
 		dirty: facts.dirty || pendingIndexes.length > 0 || staleIndexes.length > 0,
-		asOf: parsed.asOf ?? Date.now(),
+		asOf,
 		drafts: options.drafts,
 		instanceText: record.files.get("instance.md") ?? "",
 		policyText: record.files.get(".ksor/governance.yaml") ?? "",
 		peopleText: record.files.get(".ksor/people.yaml") ?? null,
 		ledgerText,
 		ledgerEntries: result.ledgerEntries,
-		audiences: result.policy?.audiences ?? [],
+		audiences,
 		concepts: result.concepts.map((c) => ({
 			id: c.id,
 			status: c.status,
@@ -11663,11 +12194,18 @@ function runBuild(args, cwd, io, options) {
 			path: rel.slice(10),
 			text
 		})),
-		denials
+		denials,
+		bundles: bundles.map((b) => ({
+			viewer: b.viewer,
+			sha256: bundleDigest(b.files),
+			files: b.files.size
+		}))
 	});
+	const lockText = `${JSON.stringify(lock, null, 2)}\n`;
 	for (const rel of pendingIndexes) writeFileSync(path.join(root, rel), result.indexes.get(rel));
 	for (const rel of staleIndexes) unlinkSync(path.join(root, rel));
-	writeFileSync(lockPath, `${JSON.stringify(lock, null, 2)}\n`);
+	if (parsed.bundles) writeBundles(root, bundles, lockText);
+	writeFileSync(lockPath, lockText);
 	const admitted = lock.documents.filter((d) => d.admitted.length > 0).length;
 	const notice = lifecycleNotice(result.concepts.map((c) => ({
 		path: c.path.slice(10),
@@ -11678,9 +12216,42 @@ function runBuild(args, cwd, io, options) {
 	io.out(`ksor build: ${lock.documents.length} document(s), ${admitted} admitted to a machine surface at ${lock.as_of}\n${provenanceLine({
 		...facts,
 		dirty: lock.dirty
-	}, root)}\n` + notice + `${pendingIndexes.map((w) => `  wrote ${w}\n`).join("")}${staleIndexes.map((r) => `  removed ${r} (its directory earns no index)\n`).join("")}  wrote build.lock.json — build_id ${lock.build_id}\n`);
+	}, root)}\n` + (change.notice === null ? "" : `  ${change.notice}\n`) + notice + `${pendingIndexes.map((w) => `  wrote ${w}\n`).join("")}${staleIndexes.map((r) => `  removed ${r} (its directory earns no index)\n`).join("")}` + (parsed.bundles ? bundlesReport(bundles, viewers) : "") + `  wrote build.lock.json — build_id ${lock.build_id}\n`);
 	return 0;
 }
+/**
+* Replace `.ksor/out/bundles/` with exactly this build's bundles. Replaced,
+* not merged: a bundle an earlier build wrote for an audience the policy no
+* longer registers, or a file a document no longer admits, would otherwise sit
+* beside the fresh ones under the same directory — the sims leak of 2026-08-25
+* (`pruneSims`) in a directory that exists to be sent somewhere. The lock goes
+* beside them the way it sits beside `knowledge/` (KSP-001 4.1.2), so the
+* output travels with the provenance that names it.
+*/
+function writeBundles(root, bundles, lockText) {
+	const out = path.join(root, BUNDLES_DIR);
+	rmSync(out, {
+		recursive: true,
+		force: true
+	});
+	for (const bundle of bundles) for (const [rel, bytes] of bundle.files) {
+		const to = path.join(out, bundle.viewer, rel);
+		mkdirSync(path.dirname(to), { recursive: true });
+		writeFileSync(to, bytes);
+	}
+	writeFileSync(path.join(out, LOCK_NAME), lockText);
+}
+/** One line per bundle written, and a line per link it carries to a concept it excludes. */
+function bundlesReport(bundles, viewers) {
+	let text = "";
+	for (const bundle of bundles) {
+		const list = (viewers[bundle.viewer] ?? [bundle.viewer]).join(", ");
+		text += `  wrote ${BUNDLES_DIR}/${bundle.viewer}/ — the OKF bundle for viewer [${list}], ${bundle.files.size} file(s)\n`;
+		for (const link of bundle.dangling) text += `    ${link.from} links to ${link.to}, which this bundle excludes — the link dangles for its reader\n`;
+	}
+	text += `  wrote ${BUNDLES_DIR}/build.lock.json — a copy, so the bundles travel with the build that made them\n`;
+	return text;
+}
 //#endregion
 //#region src/init/manager.ts
 /**
@@ -12121,8 +12692,7 @@ function unifiedDiff(change) {
 	const before = lines(change.before);
 	const after = lines(change.after);
 	const header = `--- ${change.before === null ? "/dev/null" : `a/${change.path}`}\n+++ ${change.after === null ? "/dev/null" : `b/${change.path}`}\n`;
-	if (change.generated === true) return header + `@@ generated @@ replaced wholesale: ${before.length} line(s) become ${after.length}. This file is built from ksor's own rules and is never hand-edited.
-`;
+	if (change.generated === true) return header + (change.after === null ? `@@ generated @@ deleted: ${before.length} line(s). ` : `@@ generated @@ replaced wholesale: ${before.length} line(s) become ${after.length}. `) + "This file is built from ksor's own rules and is never hand-edited.\n";
 	return header + hunks(before, after);
 }
 /** Every change as one text, in path order, with a heading a reader can scan. */
@@ -13142,6 +13712,8 @@ no instance.md at or above ${start} — the record root is the directory holding
 	changes.push(...checkerChanges(root, options.templatesDir));
 	const manifest = manifestChange(root);
 	if (manifest !== null) changes.push(manifest);
+	const staleLock = staleLockChange(root);
+	if (staleLock !== null) changes.push(staleLock);
 	if (parsed.writeSite) changes.push(...siteChanges(root, options.templatesDir, {
 		name: identity.ok ? identity.name : path.basename(root),
 		version: options.version
@@ -13392,6 +13964,34 @@ function checkerChanges(root, templatesDir) {
 	return out;
 }
 /**
+* A committed `build.lock.json` this ksor cannot read. The lock gains keys as
+* the record's surfaces grow, and `ksor build` REFUSES one that is missing any
+* of them rather than regenerating it — a lock nothing can read is a takedown
+* baseline that quietly holds nothing (record spec §4), which is the state
+* `ksor-lock-invalid` exists to stop. So the refusal is right and the upgrade
+* still has to get past it: `pnpm build` is `ksor build && <site build>`, the
+* deploy command under decision 29, so an adopter who took a new ksor would
+* find their build and their deploy red on a file only a human could delete.
+*
+* Decision 28 permits removing a shape only when the removal is paired with a
+* MIGRATION, and this is the pairing: migrate offers exactly the deletion the
+* refusal asks for, so `docs/upgrading.md`'s four steps carry it. Deleted and
+* never rewritten — only a build can compute a lock, and inventing one here
+* would forge the provenance the file exists to hold.
+*/
+function staleLockChange(root) {
+	const abs = path.join(root, "build.lock.json");
+	if (!existsSync(abs)) return null;
+	const before = readFileSync(abs, "utf8");
+	if (parseLock(before).ok) return null;
+	return {
+		path: "build.lock.json",
+		before,
+		after: null,
+		generated: true
+	};
+}
+/**
 * The root scripts this release breaks. `export-denylist` ran
 * `ksor takedown --export`, a flag the committed ledger retired, and the
 * scaffold's own `build` calls it first — so the adopter's build died on