@panaversity/ksor 0.0.58 → 0.0.59

package/templates/scaffold/.agents/skills/format-checker/check.mjs

@@ -12672,6 +12672,139 @@ function nearMissOf(baseName) {
 	return null;
 }
 /**
+* The takedown ledger's OTHER baseline: every entry any COMMITTED version of
+* `.ksor/takedowns.yaml` has ever carried.
+*
+* The committed lock is a baseline too, and a good one — it holds each entry's
+* digest, so an entry retargeted in place is caught. What it cannot do is prove
+* that an entry was never deleted, because the lock travels in the SAME change
+* as the ledger: delete the row, recompute `ledger_sha256`, empty
+* `ledger_entries`, and the two agree with each other about a denial that is
+* gone. Only history remembers.
+*
+* The baseline may be INCOMPLETE only if it SAYS so: every version history
+* holds is read, or `entries` comes back null and the caller reports that it
+* could not verify. A version silently skipped would contribute neither
+* digests nor ids while the answer still read "verified"
+* (`git-ledger.integration.test.ts`).
+*
+* This lives in the record module because THREE surfaces need the same answer —
+* `ksor build`, the emitted checker, and the site's stage (decision 19: a
+* surface that refuses must refuse on both surfaces). Plain `git log` / `git
+* show`, so nothing here needs installing.
+*/
+const LEDGER = ".ksor/takedowns.yaml";
+/**
+* `spawnSync` defaults to a 1 MB stdout buffer, and past it the child is KILLED
+* — `status` comes back null, so the query reads as a failure. A ledger with a
+* few thousand entries, or one entry carrying a long reason, clears 1 MB
+* easily, and the version was then dropped from the baseline while the caller
+* was still told history had been verified. The ceiling stays finite on
+* purpose: past it this returns null, which is a state the caller SAYS.
+*/
+const MAX_BUFFER$1 = 67108864;
+/** One git query, read-only. Null on any non-zero exit, including no git at all. */
+function git(root, args) {
+	const r = spawnSync("git", [...args], {
+		cwd: root,
+		encoding: "utf8",
+		maxBuffer: MAX_BUFFER$1
+	});
+	return r.status === 0 ? r.stdout : null;
+}
+function historicLedger(root) {
+	const inside = git(root, ["rev-parse", "--is-inside-work-tree"]);
+	if (inside === null || inside.trim() !== "true") return {
+		repository: false,
+		shallow: false,
+		entries: null,
+		unreadable: null
+	};
+	const shallow = (git(root, ["rev-parse", "--is-shallow-repository"]) ?? "").trim() === "true";
+	const born = git(root, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"HEAD"
+	]) !== null;
+	const entries = shallow ? null : born ? historicEntries(root) : [];
+	return {
+		repository: true,
+		shallow,
+		entries,
+		unreadable: entries !== null ? null : shallow ? "shallow" : "unreadable"
+	};
+}
+/**
+* Every id history has ever recorded, each with the text it carried the FIRST
+* time it was written. A version that parses contributes each entry's digest,
+* so an entry EDITED in place is caught, not only one deleted; a version that
+* no longer parses still contributes its ids, read permissively — the point
+* there is that an id once written never disappears.
+*
+* FIRST, not every: keying this by `id\tdigest` kept one baseline entry per
+* version an id ever had, so a tamper that was COMMITTED and then UNDONE left
+* two digests for one id, the restored entry matched only one of them, and
+* `ksor-ledger-amended` fired for good. The record became permanently
+* unbuildable — by a tamper that had already been put right — and the only
+* escape was rewriting git history, which is not a remedy a refusal may
+* demand (found in review, 2026-08-25).
+*
+* Taking the OLDEST is what makes the guarantee both enforceable and
+* escapable. It still refuses a committed tamper (the baseline is what the
+* entry said when it was written, so committing the edit does not launder
+* it), and the remedy it names — put the entry back — now actually clears
+* it. Taking the NEWEST would have done the opposite on both counts.
+*/
+function historicEntries(root) {
+	const atRoot = `${(git(root, ["rev-parse", "--show-prefix"]) ?? "").trim()}${LEDGER}`;
+	const commits = git(root, [
+		"log",
+		"--full-history",
+		"--topo-order",
+		"--format=%H",
+		"--",
+		LEDGER
+	]);
+	if (commits === null) return null;
+	const seen = /* @__PURE__ */ new Map();
+	for (const sha of commits.split("\n").filter((s) => s !== "")) {
+		const text = git(root, ["show", `${sha}:${atRoot}`]);
+		if (text === null) {
+			const listed = git(root, [
+				"ls-tree",
+				"--full-tree",
+				"--name-only",
+				sha,
+				"--",
+				atRoot
+			]);
+			if (listed !== null && listed.trim() === "") continue;
+			return null;
+		}
+		const where = sha.slice(0, 7);
+		const parsed = parseLedger(text, LEDGER);
+		if (parsed.ok) {
+			for (const entry of parsed.ledger.entries) seen.set(entry.id, {
+				id: entry.id,
+				digest: entryDigest(entry),
+				entry,
+				where
+			});
+			continue;
+		}
+		for (const m of text.matchAll(/^\s*(?:-\s+)?id:\s*["']?([^\s"']+)/gm)) {
+			const id = m[1] ?? "";
+			if (!seen.has(id)) seen.set(id, {
+				id,
+				digest: null,
+				where
+			});
+		}
+	}
+	return [...seen.values()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+}
+/**
 * The widening rule: a link, a `ksor.superseded_by` pointer or a companion
 * body may reach a target whose audience contains `public` or contains every
 * identifier in the source's — then every reader of the source can read the
@@ -13537,6 +13670,11 @@ function checkAgainstPolicy(concept, policy, refusals) {
 }
 const hex64 = string().regex(/^[0-9a-f]{64}$/, "a sha256 hex digest");
 const viewerList = array(string().min(1));
+const bundleEntry = object({
+	viewer: string().min(1),
+	sha256: hex64,
+	files: number().int().nonnegative()
+}).strict();
 const lockSchema = object({
 	format: literal(1),
 	build_id: string().regex(/^sha256:[0-9a-f]{64}$/),
@@ -13584,7 +13722,8 @@ const lockSchema = object({
 	indexes: array(object({
 		path: string().min(1),
 		sha256: hex64
-	}).strict())
+	}).strict()),
+	bundles: array(bundleEntry)
 }).strict();
 function parseLock(text) {
 	let value;
@@ -13609,139 +13748,6 @@ function parseLock(text) {
 		lock: parsed.data
 	};
 }
-/**
-* The takedown ledger's OTHER baseline: every entry any COMMITTED version of
-* `.ksor/takedowns.yaml` has ever carried.
-*
-* The committed lock is a baseline too, and a good one — it holds each entry's
-* digest, so an entry retargeted in place is caught. What it cannot do is prove
-* that an entry was never deleted, because the lock travels in the SAME change
-* as the ledger: delete the row, recompute `ledger_sha256`, empty
-* `ledger_entries`, and the two agree with each other about a denial that is
-* gone. Only history remembers.
-*
-* The baseline may be INCOMPLETE only if it SAYS so: every version history
-* holds is read, or `entries` comes back null and the caller reports that it
-* could not verify. A version silently skipped would contribute neither
-* digests nor ids while the answer still read "verified"
-* (`git-ledger.integration.test.ts`).
-*
-* This lives in the record module because THREE surfaces need the same answer —
-* `ksor build`, the emitted checker, and the site's stage (decision 19: a
-* surface that refuses must refuse on both surfaces). Plain `git log` / `git
-* show`, so nothing here needs installing.
-*/
-const LEDGER = ".ksor/takedowns.yaml";
-/**
-* `spawnSync` defaults to a 1 MB stdout buffer, and past it the child is KILLED
-* — `status` comes back null, so the query reads as a failure. A ledger with a
-* few thousand entries, or one entry carrying a long reason, clears 1 MB
-* easily, and the version was then dropped from the baseline while the caller
-* was still told history had been verified. The ceiling stays finite on
-* purpose: past it this returns null, which is a state the caller SAYS.
-*/
-const MAX_BUFFER = 67108864;
-/** One git query, read-only. Null on any non-zero exit, including no git at all. */
-function git(root, args) {
-	const r = spawnSync("git", [...args], {
-		cwd: root,
-		encoding: "utf8",
-		maxBuffer: MAX_BUFFER
-	});
-	return r.status === 0 ? r.stdout : null;
-}
-function historicLedger(root) {
-	const inside = git(root, ["rev-parse", "--is-inside-work-tree"]);
-	if (inside === null || inside.trim() !== "true") return {
-		repository: false,
-		shallow: false,
-		entries: null,
-		unreadable: null
-	};
-	const shallow = (git(root, ["rev-parse", "--is-shallow-repository"]) ?? "").trim() === "true";
-	const born = git(root, [
-		"rev-parse",
-		"--verify",
-		"--quiet",
-		"HEAD"
-	]) !== null;
-	const entries = shallow ? null : born ? historicEntries(root) : [];
-	return {
-		repository: true,
-		shallow,
-		entries,
-		unreadable: entries !== null ? null : shallow ? "shallow" : "unreadable"
-	};
-}
-/**
-* Every id history has ever recorded, each with the text it carried the FIRST
-* time it was written. A version that parses contributes each entry's digest,
-* so an entry EDITED in place is caught, not only one deleted; a version that
-* no longer parses still contributes its ids, read permissively — the point
-* there is that an id once written never disappears.
-*
-* FIRST, not every: keying this by `id\tdigest` kept one baseline entry per
-* version an id ever had, so a tamper that was COMMITTED and then UNDONE left
-* two digests for one id, the restored entry matched only one of them, and
-* `ksor-ledger-amended` fired for good. The record became permanently
-* unbuildable — by a tamper that had already been put right — and the only
-* escape was rewriting git history, which is not a remedy a refusal may
-* demand (found in review, 2026-08-25).
-*
-* Taking the OLDEST is what makes the guarantee both enforceable and
-* escapable. It still refuses a committed tamper (the baseline is what the
-* entry said when it was written, so committing the edit does not launder
-* it), and the remedy it names — put the entry back — now actually clears
-* it. Taking the NEWEST would have done the opposite on both counts.
-*/
-function historicEntries(root) {
-	const atRoot = `${(git(root, ["rev-parse", "--show-prefix"]) ?? "").trim()}${LEDGER}`;
-	const commits = git(root, [
-		"log",
-		"--full-history",
-		"--topo-order",
-		"--format=%H",
-		"--",
-		LEDGER
-	]);
-	if (commits === null) return null;
-	const seen = /* @__PURE__ */ new Map();
-	for (const sha of commits.split("\n").filter((s) => s !== "")) {
-		const text = git(root, ["show", `${sha}:${atRoot}`]);
-		if (text === null) {
-			const listed = git(root, [
-				"ls-tree",
-				"--full-tree",
-				"--name-only",
-				sha,
-				"--",
-				atRoot
-			]);
-			if (listed !== null && listed.trim() === "") continue;
-			return null;
-		}
-		const where = sha.slice(0, 7);
-		const parsed = parseLedger(text, LEDGER);
-		if (parsed.ok) {
-			for (const entry of parsed.ledger.entries) seen.set(entry.id, {
-				id: entry.id,
-				digest: entryDigest(entry),
-				entry,
-				where
-			});
-			continue;
-		}
-		for (const m of text.matchAll(/^\s*(?:-\s+)?id:\s*["']?([^\s"']+)/gm)) {
-			const id = m[1] ?? "";
-			if (!seen.has(id)) seen.set(id, {
-				id,
-				digest: null,
-				where
-			});
-		}
-	}
-	return [...seen.values()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
-}
 /** The inputs a projection reads; nothing else moves `source_commit` (the lock itself included). */
 const INPUTS = [
 	"knowledge",

package/templates/scaffold/.claude/skills/format-checker/check.mjs

@@ -12672,6 +12672,139 @@ function nearMissOf(baseName) {
 	return null;
 }
 /**
+* The takedown ledger's OTHER baseline: every entry any COMMITTED version of
+* `.ksor/takedowns.yaml` has ever carried.
+*
+* The committed lock is a baseline too, and a good one — it holds each entry's
+* digest, so an entry retargeted in place is caught. What it cannot do is prove
+* that an entry was never deleted, because the lock travels in the SAME change
+* as the ledger: delete the row, recompute `ledger_sha256`, empty
+* `ledger_entries`, and the two agree with each other about a denial that is
+* gone. Only history remembers.
+*
+* The baseline may be INCOMPLETE only if it SAYS so: every version history
+* holds is read, or `entries` comes back null and the caller reports that it
+* could not verify. A version silently skipped would contribute neither
+* digests nor ids while the answer still read "verified"
+* (`git-ledger.integration.test.ts`).
+*
+* This lives in the record module because THREE surfaces need the same answer —
+* `ksor build`, the emitted checker, and the site's stage (decision 19: a
+* surface that refuses must refuse on both surfaces). Plain `git log` / `git
+* show`, so nothing here needs installing.
+*/
+const LEDGER = ".ksor/takedowns.yaml";
+/**
+* `spawnSync` defaults to a 1 MB stdout buffer, and past it the child is KILLED
+* — `status` comes back null, so the query reads as a failure. A ledger with a
+* few thousand entries, or one entry carrying a long reason, clears 1 MB
+* easily, and the version was then dropped from the baseline while the caller
+* was still told history had been verified. The ceiling stays finite on
+* purpose: past it this returns null, which is a state the caller SAYS.
+*/
+const MAX_BUFFER$1 = 67108864;
+/** One git query, read-only. Null on any non-zero exit, including no git at all. */
+function git(root, args) {
+	const r = spawnSync("git", [...args], {
+		cwd: root,
+		encoding: "utf8",
+		maxBuffer: MAX_BUFFER$1
+	});
+	return r.status === 0 ? r.stdout : null;
+}
+function historicLedger(root) {
+	const inside = git(root, ["rev-parse", "--is-inside-work-tree"]);
+	if (inside === null || inside.trim() !== "true") return {
+		repository: false,
+		shallow: false,
+		entries: null,
+		unreadable: null
+	};
+	const shallow = (git(root, ["rev-parse", "--is-shallow-repository"]) ?? "").trim() === "true";
+	const born = git(root, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"HEAD"
+	]) !== null;
+	const entries = shallow ? null : born ? historicEntries(root) : [];
+	return {
+		repository: true,
+		shallow,
+		entries,
+		unreadable: entries !== null ? null : shallow ? "shallow" : "unreadable"
+	};
+}
+/**
+* Every id history has ever recorded, each with the text it carried the FIRST
+* time it was written. A version that parses contributes each entry's digest,
+* so an entry EDITED in place is caught, not only one deleted; a version that
+* no longer parses still contributes its ids, read permissively — the point
+* there is that an id once written never disappears.
+*
+* FIRST, not every: keying this by `id\tdigest` kept one baseline entry per
+* version an id ever had, so a tamper that was COMMITTED and then UNDONE left
+* two digests for one id, the restored entry matched only one of them, and
+* `ksor-ledger-amended` fired for good. The record became permanently
+* unbuildable — by a tamper that had already been put right — and the only
+* escape was rewriting git history, which is not a remedy a refusal may
+* demand (found in review, 2026-08-25).
+*
+* Taking the OLDEST is what makes the guarantee both enforceable and
+* escapable. It still refuses a committed tamper (the baseline is what the
+* entry said when it was written, so committing the edit does not launder
+* it), and the remedy it names — put the entry back — now actually clears
+* it. Taking the NEWEST would have done the opposite on both counts.
+*/
+function historicEntries(root) {
+	const atRoot = `${(git(root, ["rev-parse", "--show-prefix"]) ?? "").trim()}${LEDGER}`;
+	const commits = git(root, [
+		"log",
+		"--full-history",
+		"--topo-order",
+		"--format=%H",
+		"--",
+		LEDGER
+	]);
+	if (commits === null) return null;
+	const seen = /* @__PURE__ */ new Map();
+	for (const sha of commits.split("\n").filter((s) => s !== "")) {
+		const text = git(root, ["show", `${sha}:${atRoot}`]);
+		if (text === null) {
+			const listed = git(root, [
+				"ls-tree",
+				"--full-tree",
+				"--name-only",
+				sha,
+				"--",
+				atRoot
+			]);
+			if (listed !== null && listed.trim() === "") continue;
+			return null;
+		}
+		const where = sha.slice(0, 7);
+		const parsed = parseLedger(text, LEDGER);
+		if (parsed.ok) {
+			for (const entry of parsed.ledger.entries) seen.set(entry.id, {
+				id: entry.id,
+				digest: entryDigest(entry),
+				entry,
+				where
+			});
+			continue;
+		}
+		for (const m of text.matchAll(/^\s*(?:-\s+)?id:\s*["']?([^\s"']+)/gm)) {
+			const id = m[1] ?? "";
+			if (!seen.has(id)) seen.set(id, {
+				id,
+				digest: null,
+				where
+			});
+		}
+	}
+	return [...seen.values()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+}
+/**
 * The widening rule: a link, a `ksor.superseded_by` pointer or a companion
 * body may reach a target whose audience contains `public` or contains every
 * identifier in the source's — then every reader of the source can read the
@@ -13537,6 +13670,11 @@ function checkAgainstPolicy(concept, policy, refusals) {
 }
 const hex64 = string().regex(/^[0-9a-f]{64}$/, "a sha256 hex digest");
 const viewerList = array(string().min(1));
+const bundleEntry = object({
+	viewer: string().min(1),
+	sha256: hex64,
+	files: number().int().nonnegative()
+}).strict();
 const lockSchema = object({
 	format: literal(1),
 	build_id: string().regex(/^sha256:[0-9a-f]{64}$/),
@@ -13584,7 +13722,8 @@ const lockSchema = object({
 	indexes: array(object({
 		path: string().min(1),
 		sha256: hex64
-	}).strict())
+	}).strict()),
+	bundles: array(bundleEntry)
 }).strict();
 function parseLock(text) {
 	let value;
@@ -13609,139 +13748,6 @@ function parseLock(text) {
 		lock: parsed.data
 	};
 }
-/**
-* The takedown ledger's OTHER baseline: every entry any COMMITTED version of
-* `.ksor/takedowns.yaml` has ever carried.
-*
-* The committed lock is a baseline too, and a good one — it holds each entry's
-* digest, so an entry retargeted in place is caught. What it cannot do is prove
-* that an entry was never deleted, because the lock travels in the SAME change
-* as the ledger: delete the row, recompute `ledger_sha256`, empty
-* `ledger_entries`, and the two agree with each other about a denial that is
-* gone. Only history remembers.
-*
-* The baseline may be INCOMPLETE only if it SAYS so: every version history
-* holds is read, or `entries` comes back null and the caller reports that it
-* could not verify. A version silently skipped would contribute neither
-* digests nor ids while the answer still read "verified"
-* (`git-ledger.integration.test.ts`).
-*
-* This lives in the record module because THREE surfaces need the same answer —
-* `ksor build`, the emitted checker, and the site's stage (decision 19: a
-* surface that refuses must refuse on both surfaces). Plain `git log` / `git
-* show`, so nothing here needs installing.
-*/
-const LEDGER = ".ksor/takedowns.yaml";
-/**
-* `spawnSync` defaults to a 1 MB stdout buffer, and past it the child is KILLED
-* — `status` comes back null, so the query reads as a failure. A ledger with a
-* few thousand entries, or one entry carrying a long reason, clears 1 MB
-* easily, and the version was then dropped from the baseline while the caller
-* was still told history had been verified. The ceiling stays finite on
-* purpose: past it this returns null, which is a state the caller SAYS.
-*/
-const MAX_BUFFER = 67108864;
-/** One git query, read-only. Null on any non-zero exit, including no git at all. */
-function git(root, args) {
-	const r = spawnSync("git", [...args], {
-		cwd: root,
-		encoding: "utf8",
-		maxBuffer: MAX_BUFFER
-	});
-	return r.status === 0 ? r.stdout : null;
-}
-function historicLedger(root) {
-	const inside = git(root, ["rev-parse", "--is-inside-work-tree"]);
-	if (inside === null || inside.trim() !== "true") return {
-		repository: false,
-		shallow: false,
-		entries: null,
-		unreadable: null
-	};
-	const shallow = (git(root, ["rev-parse", "--is-shallow-repository"]) ?? "").trim() === "true";
-	const born = git(root, [
-		"rev-parse",
-		"--verify",
-		"--quiet",
-		"HEAD"
-	]) !== null;
-	const entries = shallow ? null : born ? historicEntries(root) : [];
-	return {
-		repository: true,
-		shallow,
-		entries,
-		unreadable: entries !== null ? null : shallow ? "shallow" : "unreadable"
-	};
-}
-/**
-* Every id history has ever recorded, each with the text it carried the FIRST
-* time it was written. A version that parses contributes each entry's digest,
-* so an entry EDITED in place is caught, not only one deleted; a version that
-* no longer parses still contributes its ids, read permissively — the point
-* there is that an id once written never disappears.
-*
-* FIRST, not every: keying this by `id\tdigest` kept one baseline entry per
-* version an id ever had, so a tamper that was COMMITTED and then UNDONE left
-* two digests for one id, the restored entry matched only one of them, and
-* `ksor-ledger-amended` fired for good. The record became permanently
-* unbuildable — by a tamper that had already been put right — and the only
-* escape was rewriting git history, which is not a remedy a refusal may
-* demand (found in review, 2026-08-25).
-*
-* Taking the OLDEST is what makes the guarantee both enforceable and
-* escapable. It still refuses a committed tamper (the baseline is what the
-* entry said when it was written, so committing the edit does not launder
-* it), and the remedy it names — put the entry back — now actually clears
-* it. Taking the NEWEST would have done the opposite on both counts.
-*/
-function historicEntries(root) {
-	const atRoot = `${(git(root, ["rev-parse", "--show-prefix"]) ?? "").trim()}${LEDGER}`;
-	const commits = git(root, [
-		"log",
-		"--full-history",
-		"--topo-order",
-		"--format=%H",
-		"--",
-		LEDGER
-	]);
-	if (commits === null) return null;
-	const seen = /* @__PURE__ */ new Map();
-	for (const sha of commits.split("\n").filter((s) => s !== "")) {
-		const text = git(root, ["show", `${sha}:${atRoot}`]);
-		if (text === null) {
-			const listed = git(root, [
-				"ls-tree",
-				"--full-tree",
-				"--name-only",
-				sha,
-				"--",
-				atRoot
-			]);
-			if (listed !== null && listed.trim() === "") continue;
-			return null;
-		}
-		const where = sha.slice(0, 7);
-		const parsed = parseLedger(text, LEDGER);
-		if (parsed.ok) {
-			for (const entry of parsed.ledger.entries) seen.set(entry.id, {
-				id: entry.id,
-				digest: entryDigest(entry),
-				entry,
-				where
-			});
-			continue;
-		}
-		for (const m of text.matchAll(/^\s*(?:-\s+)?id:\s*["']?([^\s"']+)/gm)) {
-			const id = m[1] ?? "";
-			if (!seen.has(id)) seen.set(id, {
-				id,
-				digest: null,
-				where
-			});
-		}
-	}
-	return [...seen.values()].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
-}
 /** The inputs a projection reads; nothing else moves `source_commit` (the lock itself included). */
 const INPUTS = [
 	"knowledge",

package/templates/scaffold/AGENTS.md

@@ -497,9 +497,14 @@ runs over every entry in the ledger at `pnpm check`, `ksor build` and ingest, so
 a line appended by hand in a pull request is refused exactly as the verb would
 refuse it. The read-only modes
 (`--list`, `--ledger`) need no actor — nobody is performing an act by looking.
-They do not need a database either: on a record that declares none they read
-the committed `.ksor/takedowns.yaml`, which is the whole record of the act
-anyway.
+They do not need a database either: `--ledger` always reads the committed
+`.ksor/takedowns.yaml`, which is the record of every act, and `--list` reads
+the door's denylist rows when `KSOR_DB_URL` is set and otherwise the ledger's
+denials, each labelled `not applied (no database)` because no row exists for
+a door to refuse on. A denial itself, on this record with `KSOR_DB_URL` unset,
+is refused by name (`ksor-takedown-dsn-missing`) unless `--file-only` records
+the entry alone — `--apply` writes its row later, where the database is
+reachable.
 
 **The MCP door stops serving it immediately. The SITE stops at its next
 build** — the site reads the committed ledger (`.ksor/takedowns.yaml`), not
@@ -516,7 +521,11 @@ ROOT, never `system/site/`), and every other host just serves the folder.
 record checked, `build.lock.json` written (commit it: it is the provenance
 every machine artefact stamps) — and a refusal stops the build before a byte
 is written. `ksor build --strict` additionally refuses an uncommitted input
-(`ksor-build-dirty`), which is the posture for a release.
+(`ksor-build-dirty`), which is the posture for a release. `ksor build
+--bundles` also writes one OKF bundle per viewer under
+`.ksor/out/bundles/<viewer>/` (gitignored) — only what that viewer's machine
+surfaces publish, readable by any OKF consumer with no ksor in the loop — for
+handing the record to another system.
 `KSOR_BASE_PATH=/repo pnpm build` targets sub-path hosting. With audiences
 registered in `.ksor/governance.yaml`, plain `pnpm build` is the `public`
 viewer; `KSOR_AUDIENCE=public,<audience> pnpm build` — a comma list, always
@@ -607,7 +616,14 @@ CI — and a first deploy without it serves an empty record. Full walkthrough:
   audiences registered in `.ksor/governance.yaml`; never omitted, never
   inferred). A `stable` document carries `generated: { by, at }` and
   `ksor.approval: { by, at }` by an actor the policy authorises, with
-  `generated.at` no later than the approval; a `deprecated` one carries
+  `generated.at` no later than the approval — and `generated.at` dates the
+  TEXT: edit a stable document's body and `ksor build` and `ksor ingest`
+  compare it against every committed version that was stable, and refuse
+  `ksor-generated-stale` until you move the stamp PAST the edit and re-approve
+  — leaving the stamp alone and backdating it are refused alike, because
+  neither advances it (a frontmatter-only edit, such as adding a `verified`
+  entry, is not a body change; `pnpm check` reads no document history, so it passes an
+  edit the build will refuse); a `deprecated` one carries
   `ksor.deprecated: { by, at }` and usually `ksor.superseded_by: <id>`
   (a stable document every reader of this one may read). Optional: `order`
   (reading position), `sources` (`{ id, resource, title }`, cited in the body

package/templates/scaffold/README.md

@@ -259,7 +259,9 @@ Never copy a floor from another corpus.
 It also prints its own caveat, and it is worth reading: the probes it writes are
 derived from your passages, so they share vocabulary a real question will not.
 The floor it reports is an upper bound on separation until you check it against
-questions the corpus did not write (`--queries-file`).
+questions a person wrote: in-corpus ones with `--queries-file`, and — because
+the built-in out-of-corpus probes are all far-domain — questions just outside
+your scope with `--ooc-file`.
 
 A rerun on an unchanged record costs nothing: no new generation, no embedding,
 no rows. Edit a document and the next run picks up exactly that change.
@@ -724,6 +726,7 @@ map rather than a substitute.
 | the home page and `/llms.txt` are empty                              | every document is still a draft — correct, not broken                                                      | approve one and rebuild                                                                |
 | `ksor-record-empty`                                                  | every document was deleted — a record is never empty, so nothing was written                               | add one document of your own (or restore one from git) before deleting the last starter |
 | `ksor-approver-unauthorised`                                         | a document is approved by an actor `.ksor/governance.yaml` no longer names — usually `human:you` after the interview | re-attribute the approval to your handle, or restore the actor to `approval_authorities` |
+| `ksor-generated-stale` at `pnpm build` or `pnpm refresh`             | a `stable` document's body changed since a commit where it was stable, and `generated.at` was not advanced past that commit's (left alone, or moved backward) — the stamp dates the text, and `pnpm check` reads no document history, so it passed | set `generated.at` to an instant after the edit and re-approve (`ksor.approval.at` may not precede it) |
 | a new document never appears on the built site                       | drafts reach no built surface at all                                                                       | publish it — `status: stable` plus both governance keys                                |
 | an expired document still shows on the site but not through the door | the static build evaluated `stale_after` at build time                                                     | rebuild and redeploy; schedule a rebuild if you use it                                 |
 | Vercel: `no services are declared`                                   | Root Directory was auto-filled with `system/site`                                                          | set it to `./`                                                                         |

package/templates/scaffold/env.example

@@ -66,6 +66,9 @@ KSOR_AUTH=disabled-local
 # NEXT_PUBLIC_KSOR_SSO_URL=https://your-sso.example.com
 # NEXT_PUBLIC_KSOR_OAUTH_CLIENT_ID=
 # NEXT_PUBLIC_KSOR_OAUTH_REDIRECT_URI=https://your-site.example.com/auth/callback
+#
+# Next.js telemetry is already off: the site's build and dev scripts run next
+# through system/site/next-no-telemetry.mjs, which sets NEXT_TELEMETRY_DISABLED=1.
 
 # ── Production knobs ────────────────────────────────────────────────────────
 # Unset is fine for a local run; each one matters once this serves for real.