@profile-as-code/cli 0.3.0 → 0.3.5

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { parseArgs } from "util";
 
 // src/commands/build.ts
-import { copyFileSync, mkdirSync, rmSync, writeFileSync } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { copyFileSync, existsSync as existsSync5, mkdirSync, rmSync, writeFileSync } from "fs";
+import { dirname as dirname2, join as join6 } from "path";
 
 // ../core/dist/ledger.js
 import { createHash } from "crypto";
@@ -182,6 +182,7 @@ function textOf(v) {
   return typeof v === "string" ? v : v.en ?? "";
 }
 var PLATFORMS = PLATFORM_SLUGS;
+var LANGS = ["en", "es", "fr"];
 
 // ../core/dist/ledger.js
 var LEDGER_META = /* @__PURE__ */ new Set(["id", "origin"]);
@@ -212,6 +213,86 @@ function hashUnit(unit) {
 }
 var LEDGER_KEY_PATTERN = /^(identity|positioning|keywords)$|^(bios|headlines|skills|socialHandles|experience|projects|publications|education|press):.+$/;
 var ROW_BLOCKS = ["experience", "projects", "publications", "education", "press"];
+function reasonField(reason) {
+  return reason === void 0 ? {} : { reason };
+}
+function declaredReason(capability) {
+  if (capability === void 0 || capability.extractor === void 0)
+    return "no-extractor";
+  if (capability.rung === "walled")
+    return "walled";
+  if (capability.rung === "walled-con-api")
+    return "walled-con-api";
+  if (capability.artifactUrl === null || capability.artifactUrl === void 0) {
+    return "no-artifact-url";
+  }
+  return void 0;
+}
+function certifiedSurface(record) {
+  return record === void 0 ? { state: "attested" } : { ...record };
+}
+function certificationRollup(surfaces) {
+  const entries = Object.entries(surfaces).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  if (entries.length === 0)
+    return { state: "attested" };
+  if (entries.every(([, c]) => c.state === "verified"))
+    return { state: "verified" };
+  if (entries.every(([, c]) => c.state === "verified" || c.state === "attested")) {
+    return { state: "attested" };
+  }
+  const drift = entries.find(([, c]) => c.state === "out-of-band-drift");
+  const lead = drift ?? entries.find(([, c]) => c.state === "unverifiable");
+  return { state: lead?.[1].state ?? "unverifiable", ...reasonField(lead?.[1].reason) };
+}
+function certificationVerdict(record, live) {
+  if (live === null)
+    return { state: "unverifiable" };
+  if (live.status < 200 || live.status >= 300)
+    return { state: "unverifiable" };
+  const anchor = record.certification?.artifactHash;
+  if (anchor === void 0)
+    return { state: "unverifiable", reason: "unattributed" };
+  if (live.digest === void 0)
+    return { state: "unverifiable", reason: "unattributed" };
+  return live.digest === anchor ? { state: "verified" } : { state: "out-of-band-drift", reason: "live-mismatch" };
+}
+function attemptRecord(verdict, evidence) {
+  if (verdict.state === "verified") {
+    return {
+      state: "verified",
+      ...evidence.artifactHash !== void 0 ? { artifactHash: evidence.artifactHash } : {},
+      method: "fetch",
+      ...evidence.fetchedAt !== void 0 ? { fetchedAt: evidence.fetchedAt } : {},
+      ...evidence.liveHash !== void 0 ? { liveHash: evidence.liveHash } : {},
+      ...evidence.evidenceUrl !== void 0 ? { evidenceUrl: evidence.evidenceUrl } : {}
+    };
+  }
+  if (verdict.state === "out-of-band-drift") {
+    return {
+      state: "out-of-band-drift",
+      reason: verdict.reason ?? "live-mismatch",
+      ...evidence.artifactHash !== void 0 ? { artifactHash: evidence.artifactHash } : {},
+      ...evidence.liveHash !== void 0 ? { liveHash: evidence.liveHash } : {},
+      method: "fetch",
+      ...evidence.fetchedAt !== void 0 ? { fetchedAt: evidence.fetchedAt } : {},
+      ...evidence.evidenceUrl !== void 0 ? { evidenceUrl: evidence.evidenceUrl } : {}
+    };
+  }
+  return {
+    state: "unverifiable",
+    reason: verdict.reason ?? "network-error",
+    ...evidence.artifactHash !== void 0 ? { artifactHash: evidence.artifactHash } : {},
+    ...evidence.fetchedAt !== void 0 || evidence.evidenceUrl !== void 0 ? { method: "fetch" } : {},
+    ...evidence.fetchedAt !== void 0 ? { fetchedAt: evidence.fetchedAt } : {},
+    ...evidence.evidenceUrl !== void 0 ? { evidenceUrl: evidence.evidenceUrl } : {}
+  };
+}
+function attestedRecord(anchor) {
+  return { state: "attested", ...anchor !== void 0 ? { artifactHash: anchor } : {} };
+}
+function fetchFailureReason(status) {
+  return status === 0 ? "network-error" : `http-${status}`;
+}
 var ROW_CONFIG = {
   experience: {
     block: "experience",
@@ -289,6 +370,7 @@ function deployStatus(profile) {
   const statuses = units.map((unit) => {
     const records = ledger[unit.key] ?? {};
     const surfaces = {};
+    const certification = {};
     let stale = false;
     let deployed = 0;
     for (const [surface, record] of Object.entries(records)) {
@@ -297,11 +379,14 @@ function deployStatus(profile) {
       surfaces[surface] = inSync ? "in-sync" : "stale";
       if (!inSync)
         stale = true;
+      certification[surface] = certifiedSurface(record.certification);
     }
+    const rollup = certificationRollup(certification);
     return {
       ...unit,
       surfaces,
-      state: stale ? "stale" : deployed > 0 ? "in-sync" : "never"
+      state: stale ? "stale" : deployed > 0 ? "in-sync" : "never",
+      certification: deployed === 0 ? null : { state: rollup.state, surfaces: certification, ...reasonField(rollup.reason) }
     };
   });
   return { units: statuses, untracked: untrackedRows(profile), removed };
@@ -598,7 +683,7 @@ import { parseDocument } from "yaml";
 
 // ../core/dist/generated/schema.zod.js
 import { z } from "zod";
-var profileSchema = z.object({ "identity": z.object({ "name": z.string().min(1), "email": z.string().regex(new RegExp(`^[^@\\s"']+@[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+$`)).describe("v1.5 (additive, issue #71): contact email of the person/brand (schema.org `email` on Person/Organization). A fact like name/location \u2014 NOT a link: renderers emit it as a mailto: href in the Links section and as the JSON-LD `email` property; `sameAs` stays page-URLs-only. Lives OUTSIDE identity.links[] by design \u2014 the ^https?:// rule of $defs/url (issue #53) stays strict on every URL field, so a mailto: row in links[] fails validation (D12). RFC-5322-adjacent (issue #71 review): local part lax (no whitespace/quotes), domain hostname-shaped (labels [A-Za-z0-9-], no empty/trailing/consecutive dots \u2014 unicode domains must use punycode).").optional(), "handle": z.string().describe("v1.1: primary handle (e.g. X @cluciani_ve).").optional(), "timezone": z.string().describe("v1.1: IANA timezone (e.g. America/Guayaquil).").optional(), "orgName": z.string().min(1).describe("v1.1 (additive, brand): legal/registered org name when it differs from the display name (name = display, e.g. 'Topia Press').").optional(), "logo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "brandVoice": z.object({ "tone": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "values": z.array(z.string()).optional(), "avoid": z.array(z.string()).optional() }).strict().describe("v1.1 (additive, brand): tone matrix seed \u2014 overall tone (langMap), core values, words/tones to avoid. Per-platform voice refinement lives in the platform skill (\xA717).").optional(), "mission": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "tagline": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "established": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "location": z.string().optional(), "photo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "links": z.array(z.object({ "platform": z.string().optional(), "label": z.string().optional(), "role": z.enum(["identity", "realization", "aggregator"]).describe("v1.6 (#103): the ROLE this link plays with respect to the entity \u2014 a translation layer of this engine onto schema.org, never standard vocabulary. `identity` \u2192 schema.org:url (the page IS the entity; strong authority; the one eligible for JSON-LD @id). `realization` (DEFAULT when absent) \u2192 schema.org:sameAs (the page indirectly indicates the entity; weak authority; these \u2014 and only these \u2014 form the sameAs set). `aggregator` \u2192 schema.org:mainEntityOfPage (link-in-bio / redirector that aggregates references to the entity; medium authority; never eligible for @id). Absence keeps every pre-v1.6 workspace VALIDATING unchanged (additive, dev-methodology \xA73) \u2014 it does NOT keep the output byte-identical: v1.6 also makes github-readme emit jobTitle/worksFor, narrows sameAs to realization links (+ claimed handles), and adds the geo/entity-id gap report.").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.") }).strict()).describe("Canonical link set. Renderers and skills read URLs ONLY from here \u2014 no per-platform URL duplication (drift source). v1.6 (#103): items carry an optional `role` distinguishing the entity's own page (schema.org:url) from pages that merely indicate it (schema.org:sameAs) or aggregate references to it (schema.org:mainEntityOfPage).").optional() }).strict(), "flavor": z.enum(["person", "brand"]).describe("v1.1 (additive): workspace flavor (D15). person (default, absent = person) or brand. Brand enables the org identity variant, the socialHandles/newsletter/podcast/press/audiences blocks and Organization GEO (\xA717).").optional(), "socialHandles": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "handle": z.string().min(1), "status": z.enum(["claimed", "pending"]), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "note": z.string().optional() }).strict().describe("v1.1 (additive, brand): one row of the brand handle matrix (platform \u2192 handle + claim status). Seed source: the operator's brand-handles availability sweep (\xA717).")).describe("v1.1 (additive, brand): the brand handle matrix \u2014 one row per platform with claim status. Seeded from the operator's brand-handles availability sweep (\xA717).").optional(), "newsletter": z.object({ "platform": z.enum(["substack", "ghost"]).describe("v1.1 (additive, brand): newsletter hosts the engine models (Substack now, Ghost later)."), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "name": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "cadence": z.string().optional() }).strict().describe("v1.1 (additive, brand): the brand's newsletter surface. The name/description double as the GEO-visible text (RSS/LLM-readable).").optional(), "podcast": z.object({ "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "platform": z.enum(["spotify", "rss"]).describe("v1.1 (additive, brand): podcast distribution modeled in v1.1 (Spotify for Creators / standalone RSS).").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "rss": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "status": z.enum(["planned", "live"]).optional() }).strict().describe("v1.1 (additive, brand): the brand's podcast \u2014 show metadata + RSS (GEO-citable via RSS).").optional(), "press": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "outlet": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]), "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "date": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the work behind this mention. press keeps its domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("v1.1 (additive, brand): a media mention \u2014 outlet, headline, resolvable URL, date (verifiable claims, \xA78).")).describe("v1.1 (additive, brand): media mentions of the brand (verifiable, dated).").optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("v1.1 (additive, brand): brand audiences \u2014 reader profiles (not recruiters). Audience name \u2192 per-lang angle (same shape as positioning.audiences; brand-facing).").optional(), "positioning": z.object({ "statement": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("Audience name \u2192 per-lang angle (e.g. recruiter / client / academia).").optional(), "geo": z.object({ "semanticAssociations": z.array(z.string()).min(3).max(5).describe("3-5 anchors an LLM should associate with the person (e.g. 'f\xEDsica', 'innovaci\xF3n educativa', 'soberan\xEDa de IA'). Seeded without stuffing (\xA78).").optional(), "citationsGoal": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().optional() }).strict().optional(), "bios": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "length": z.enum(["short", "medium", "long"]), "text": z.string().min(1) }).strict()).describe("Curated bio per platform+lang+length. Generated by `pasco refine`, chosen by the user, stored here.").optional(), "headlines": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "text": z.string().min(1) }).strict()).describe("Headline per platform+lang (the 1-line under the name).").optional(), "skills": z.array(z.object({ "name": z.string().min(1), "level": z.enum(["novice", "intermediate", "advanced", "expert"]).optional(), "keywords": z.array(z.string()).optional(), "geoKeywords": z.array(z.string()).describe("Terms a generative engine should match this skill with (GEO layer, D7).").optional(), "platformWeights": z.record(z.string(), z.number().gte(0).lte(1)).describe("How much this skill matters per platform (0..1). Feeds renderer keyword placement.").optional() }).strict()).optional(), "experience": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "role": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1: string. v1.1 (additive): langMap \u2014 bilingual role titles."), "org": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'USFQ', 'Nimbus Labs'). Not a langMap: institutions are never translated (SPEC \xA711)."), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "highlights": z.union([langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), langMapKeys(z.object({ "en": z.array(z.string()) }).catchall(z.array(z.string())))]).describe("v1: langMap of strings (separator-delimited). v1.1 (additive): langMap of string arrays (bullets).").optional() }).strict().describe("start <= end is NOT expressible in JSON Schema \u2014 enforced by core.driftCheck (\xA712 note).")).optional(), "education": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "degree": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: degree title (string or bilingual langMap)."), "institution": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'Universidad Central de Venezuela'). Not a langMap: institutions are never translated (SPEC \xA711)."), "field": z.union([z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: field of study (string or bilingual langMap).").optional(), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "note": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().describe("v1.1 (additive): formal education entry.")).describe("v1.1 (additive): formal education. v1 workspaces keep education inside experience[] with role = degree.").optional(), "languages": z.array(z.object({ "code": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "level": z.enum(["native", "fluent", "advanced", "intermediate", "basic"]) }).strict()).describe("v1.1 (additive): spoken languages. v1 workspaces document them as comments in skills.yaml.").optional(), "projects": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "name": z.string().min(1), "status": z.enum(["active", "maintained", "archived", "experimental", "planning"]).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "links": z.array(z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.")).optional(), "keywords": z.array(z.string()).optional(), "evidence": z.array(z.object({ "claim": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "source": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "verified": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "credentialId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "artifactId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional() }).strict().describe("Verifiable claim with source. Anti-pattern: unverifiable claims (dropped by cite-aware systems, \xA78).")).optional() }).strict()).optional(), "publications": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "title": z.string().min(1), "venue": z.string().min(1), "year": z.number().int().gte(1900).lte(2100), "authors": z.string().describe("v1.1: author string (e.g. 'Luciani, C.' or 'Zambrano et al.').").optional(), "doi": z.string().regex(new RegExp("^10\\.\\d{4,9}/\\S+$")).optional(), "orcidId": z.string().regex(new RegExp("^\\d{4}-\\d{4}-\\d{4}-\\d{3}[\\dX]$")).optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the dataset/code behind this paper. publications keep their domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("DOI/ORCID must be resolvable \u2014 GEO citability anchor (LLMs resolve them).")).describe("Peer-reviewed / citable output. DOI/ORCID resolvable \u2192 GEO citability.").optional(), "keywords": z.object({ "seo": z.record(z.string(), z.array(z.string())).describe("Per-platform SEO keyword sets (fed by each platform skill's research).").optional(), "geo": z.object({ "associations": z.array(z.string()).optional(), "claims": z.array(z.string()).optional() }).strict().optional() }).strict().optional(), "checks": z.array(z.object({ "id": z.string().optional(), "platform": z.enum(["all", "github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Dedup contract: MUST equal ['all', ...$defs/platform.enum] \u2014 scripts/schema-check asserts it (D16)."), "rule": z.enum(["max-chars", "min-chars", "url-live", "fact-present", "geo-consistent", "lang-present", "link-in-identity", "handle-claimed", "handle-consistent"]).describe("Rule catalog (extensible). Skills' checks.yaml use the same catalog; `pasco check` runs the union. v1.1 (brand \xA717): handle-claimed (a claimed handle must resolve to a URL) and handle-consistent (handle matrix coherent across surfaces)."), "value": z.union([z.number(), z.string(), z.boolean(), z.array(z.string())]), "note": z.string().optional() }).strict()).describe("User-level declarative checks; unioned with the platform skill's checks.yaml by `pasco check`.").optional(), "active": z.record(z.string(), z.object({ "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "variantId": z.string().min(1), "chosenAt": z.string().datetime({ offset: true }) }).strict().describe("The chosen variant id \u2014 user picked it (D11); variant body lives in the workspace variants store.")).describe("Which bio/headline variant is LIVE per platform (D11: user picks, engine records).").optional(), "deployments": z.record(z.string(), z.record(z.string(), z.object({ "deployedAt": z.string().datetime({ offset: true }), "contentHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "source": z.enum(["manual", "git", "api"]) }).strict().describe("v1.3 (D18, \xA719.1): one confirmed deploy of a trackable unit on one surface. contentHash = SHA-256 of the canonical serialization (sorted keys, sans id/origin) of the unit AT deploy time \u2014 staleness is exact and release-tag-independent.")).describe("v1.3 (D18): surface \u2192 deploy record. Surface keys are the ONE platform enum (D16) \u2014 also core-checked post-Zod (gen-zod drops propertyNames).")).describe("v1.3 (D18, \xA719): per-entry deploy ledger \u2014 ledgerKey \u2192 surface \u2192 record. Keys are constrained above for JSON Schema consumers; the generated Zod drops propertyNames, so core re-checks key patterns, surface enums, duplicate ids and ambiguous composite keys post-Zod (D12 fail class). Only `pasco` mutates this block (same write rule as refine --choose, D14).").optional(), "credentials": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["certificate", "title", "award", "patent"]).describe("D17/\xA718.2: third-party attestation kind."), "title": z.string().min(1).describe("Credential name (proper noun \u2192 invariant string, \xA711)."), "issuer": z.string().min(1).describe("Third-party attester (proper noun \u2192 invariant string, \xA711)."), "credentialId": z.string().min(1).describe("Issuer-side identifier (e.g. certificate serial). Certificates carry PII \u2014 visibility governs exposure (\xA718.5).").optional(), "verifyUrl": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "issued": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "expires": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a third-party attestation. JSON-LD payoff (\xA718.9): `Person.hasCredential` \u2192 `EducationalOccupationalCredential` (public only).")).describe("v1.4 (D17, \xA718): the proof layer \u2014 third-party attestations (certificates, titles, awards, patents). Pointer-first: the workspace declares pointers, the engine never owns binaries (D14). Naming discipline (\xA718.1): never called evidence.").optional(), "artifacts": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["portfolio", "gallery", "showreel", "dataset", "document", "code"]).describe("D17/\xA718.2: work/media kind."), "title": z.string().min(1).describe("Work title (proper noun \u2192 invariant string, \xA711)."), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "locator": z.object({ "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "path": z.string().min(1).describe("In-workspace `media/\u2026` or external under PASCO_EVIDENCE_ROOT \u2014 capability matrix (\xA718.3): NEVER emitted as a public URL while the workspace is private (D14); reaches public surfaces only via renderer assets/ output (M8).").optional() }).strict().describe("Exactly one of `url` | `path` (\xA718.3 capability matrix). The oneOf expresses the XOR for JSON Schema consumers; the generated Zod cannot express required-without-property, so core re-checks the XOR post-Zod (D12 fail class, ledger precedent)."), "checksum": z.string().regex(new RegExp("^sha256:[a-f0-9]{64}$")).describe("Immutable artifacts only (\xA718.6): recorded at compile for byte-stable bundling (M8).").optional(), "license": z.string().min(1).describe("Usage rights for the work (e.g. CC-BY-4.0).").optional(), "tags": z.array(z.string()).describe("Multi-area selection (\xA718.9): renderers select by platform + lang + tags; one workspace, many areas.").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a work or media item. JSON-LD payoff (\xA718.9): surfaces as CreativeWork/ImageGallery/VideoObject/Dataset per platform (renderer-curated, D5).")).describe("v1.4 (D17, \xA718): works/media items (portfolio, gallery, showreel, dataset, document, code), pointer-first via `locator`. Naming discipline (\xA718.1): never called evidence \u2014 canonical blocks keep their domains (publications/press are NOT registry kinds, they reference registry ids).").optional() }).strict().describe("Contract source (D3) for a profile-data workspace. The core `load()` parses content/*.yaml, merges them into a single Profile and validates against THIS schema. Facts (dates, DOIs, URLs, ORCID) are language-independent and are the GEO anchor. Every text field is a langMap ({lang: value}) with EN required (D8, \xA711). Additive since v1 (semver minor): every earlier workspace still validates. v1.1: role as langMap (org stays invariant string), highlights as string[] per lang, publication.authors/url, root languages + education, identity.handle/timezone, patreon in checks; brand flavor (D15/\xA717) \u2014 `flavor`, org identity variant (orgName/logo/brandVoice/mission/tagline/established), socialHandles/newsletter/podcast/press/audiences blocks, brand platforms, handle checks. New in v1.2 (D16): platform set = Postiz parity + operator extras \u2014 43 platforms, one shared enum for both flavors, single-source dedup guard (check.platform). New in v1.3 (D18): per-entry deploy ledger \u2014 `deployments` (ledgerKey \u2192 surface \u2192 deployedAt/contentHash/source), optional stable `id`s on row blocks (experience/projects/publications/education/press), `origin: template` provenance flag. New in v1.4 (D17): evidence registry \u2014 `credentials[]` (third-party attestations: certificate/title/award/patent) and `artifacts[]` (works/media: portfolio/gallery/showreel/dataset/document/code), pointer-first (\xA718); `evidenceItem` gains `credentialId`/`artifactId` cross-refs, `publications[]`/`press[]` gain `artifactRefs`. Naming discipline (\xA718.1): the registry is never called evidence \u2014 `projects[].evidence[]` stays claims-only. New in v1.5 (issue #71): `identity.email` \u2014 the contact email as a first-class fact (schema.org `email` on Person/Organization), NOT a link \u2014 `links[]` stays http(s)-only (mailto: rejected, D12); a mailto: row in links[] broke the template and every real workspace after v1.4's scheme boundary (issue #53). New in v1.6 (issue #103): `identity.links[].role` \u2014 the link ROLE (`identity` | `realization` | `aggregator`), a translation layer onto schema.org (`url` | `sameAs` | `mainEntityOfPage`); absent role = `realization`, so every pre-v1.6 workspace stays VALIDATING unchanged (the rendered output does change \u2014 see \xA715.4). The JSON-LD `@id` is derived from the `role: identity` link and is ABSENT when no link carries it (never invented). Entity assembly moves to a single home (core/src/structured-data.ts), consumed by geoCheck and every renderer \u2014 the \xA718.9 credentialLdEntries precedent. New in v1.7 (issue #130): `kofi` \u2014 Ko-fi creator page as operator extra #10 (44 platforms), creator-monetization family; paste platform, no API deploy (D9). New in v1.8 (issue #133): `buymeacoffee`, `liberapay`, `gumroad`, `payhip` \u2014 the creator monetization platforms family (D16), operator extras #11\u2013#14 (48 platforms); the family is declared in SPEC and descriptions (docs-first), not as a hard schema field; all four are paste platforms, no API deploy (D9). New in v1.9 (issue #137): `hotmart` \u2014 the Hotmart digital-products storefront + memberships (Members Area / recurring billing) serving the Spanish/Portuguese-speaking markets, in the `creator-monetization` family as operator extra #15 (49 platforms); paste platform, no API deploy (D9) \u2014 no management API is documented for the profile body (developers.hotmart.com covers sales/products [?], fetched 2026-10-05).");
+var profileSchema = z.object({ "identity": z.object({ "name": z.string().min(1), "email": z.string().regex(new RegExp(`^[^@\\s"']+@[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+$`)).describe("v1.5 (additive, issue #71): contact email of the person/brand (schema.org `email` on Person/Organization). A fact like name/location \u2014 NOT a link: renderers emit it as a mailto: href in the Links section and as the JSON-LD `email` property; `sameAs` stays page-URLs-only. Lives OUTSIDE identity.links[] by design \u2014 the ^https?:// rule of $defs/url (issue #53) stays strict on every URL field, so a mailto: row in links[] fails validation (D12). RFC-5322-adjacent (issue #71 review): local part lax (no whitespace/quotes), domain hostname-shaped (labels [A-Za-z0-9-], no empty/trailing/consecutive dots \u2014 unicode domains must use punycode).").optional(), "handle": z.string().describe("v1.1: primary handle (e.g. X @cluciani_ve).").optional(), "timezone": z.string().describe("v1.1: IANA timezone (e.g. America/Guayaquil).").optional(), "orgName": z.string().min(1).describe("v1.1 (additive, brand): legal/registered org name when it differs from the display name (name = display, e.g. 'Topia Press').").optional(), "logo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "brandVoice": z.object({ "tone": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "values": z.array(z.string()).optional(), "avoid": z.array(z.string()).optional() }).strict().describe("v1.1 (additive, brand): tone matrix seed \u2014 overall tone (langMap), core values, words/tones to avoid. Per-platform voice refinement lives in the platform skill (\xA717).").optional(), "mission": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "tagline": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "established": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "location": z.string().optional(), "photo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "links": z.array(z.object({ "platform": z.string().optional(), "label": z.string().optional(), "role": z.enum(["identity", "realization", "aggregator"]).describe("v1.6 (#103): the ROLE this link plays with respect to the entity \u2014 a translation layer of this engine onto schema.org, never standard vocabulary. `identity` \u2192 schema.org:url (the page IS the entity; strong authority; the one eligible for JSON-LD @id). `realization` (DEFAULT when absent) \u2192 schema.org:sameAs (the page indirectly indicates the entity; weak authority; these \u2014 and only these \u2014 form the sameAs set). `aggregator` \u2192 schema.org:mainEntityOfPage (link-in-bio / redirector that aggregates references to the entity; medium authority; never eligible for @id). Absence keeps every pre-v1.6 workspace VALIDATING unchanged (additive, dev-methodology \xA73) \u2014 it does NOT keep the output byte-identical: v1.6 also makes github-readme emit jobTitle/worksFor, narrows sameAs to realization links (+ claimed handles), and adds the geo/entity-id gap report.").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.") }).strict()).describe("Canonical link set. Renderers and skills read URLs ONLY from here \u2014 no per-platform URL duplication (drift source). v1.6 (#103): items carry an optional `role` distinguishing the entity's own page (schema.org:url) from pages that merely indicate it (schema.org:sameAs) or aggregate references to it (schema.org:mainEntityOfPage).").optional() }).strict(), "flavor": z.enum(["person", "brand"]).describe("v1.1 (additive): workspace flavor (D15). person (default, absent = person) or brand. Brand enables the org identity variant, the socialHandles/newsletter/podcast/press/audiences blocks and Organization GEO (\xA717).").optional(), "socialHandles": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "handle": z.string().min(1), "status": z.enum(["claimed", "pending"]), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "note": z.string().optional() }).strict().describe("v1.1 (additive, brand): one row of the brand handle matrix (platform \u2192 handle + claim status). Seed source: the operator's brand-handles availability sweep (\xA717).")).describe("v1.1 (additive, brand): the brand handle matrix \u2014 one row per platform with claim status. Seeded from the operator's brand-handles availability sweep (\xA717).").optional(), "newsletter": z.object({ "platform": z.enum(["substack", "ghost"]).describe("v1.1 (additive, brand): newsletter hosts the engine models (Substack now, Ghost later)."), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "name": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "cadence": z.string().optional() }).strict().describe("v1.1 (additive, brand): the brand's newsletter surface. The name/description double as the GEO-visible text (RSS/LLM-readable).").optional(), "podcast": z.object({ "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "platform": z.enum(["spotify", "rss"]).describe("v1.1 (additive, brand): podcast distribution modeled in v1.1 (Spotify for Creators / standalone RSS).").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "rss": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "status": z.enum(["planned", "live"]).optional() }).strict().describe("v1.1 (additive, brand): the brand's podcast \u2014 show metadata + RSS (GEO-citable via RSS).").optional(), "press": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "outlet": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]), "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "date": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the work behind this mention. press keeps its domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("v1.1 (additive, brand): a media mention \u2014 outlet, headline, resolvable URL, date (verifiable claims, \xA78).")).describe("v1.1 (additive, brand): media mentions of the brand (verifiable, dated).").optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("v1.1 (additive, brand): brand audiences \u2014 reader profiles (not recruiters). Audience name \u2192 per-lang angle (same shape as positioning.audiences; brand-facing).").optional(), "positioning": z.object({ "statement": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("Audience name \u2192 per-lang angle (e.g. recruiter / client / academia).").optional(), "geo": z.object({ "semanticAssociations": z.array(z.string()).min(3).max(5).describe("3-5 anchors an LLM should associate with the person (e.g. 'f\xEDsica', 'innovaci\xF3n educativa', 'soberan\xEDa de IA'). Seeded without stuffing (\xA78).").optional(), "citationsGoal": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().optional() }).strict().optional(), "bios": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "length": z.enum(["short", "medium", "long"]), "text": z.string().min(1) }).strict()).describe("Curated bio per platform+lang+length. Generated by `pasco refine`, chosen by the user, stored here.").optional(), "headlines": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "text": z.string().min(1) }).strict()).describe("Headline per platform+lang (the 1-line under the name).").optional(), "skills": z.array(z.object({ "name": z.string().min(1), "level": z.enum(["novice", "intermediate", "advanced", "expert"]).optional(), "keywords": z.array(z.string()).optional(), "geoKeywords": z.array(z.string()).describe("Terms a generative engine should match this skill with (GEO layer, D7).").optional(), "platformWeights": z.record(z.string(), z.number().gte(0).lte(1)).describe("How much this skill matters per platform (0..1). Feeds renderer keyword placement.").optional() }).strict()).optional(), "experience": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "role": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1: string. v1.1 (additive): langMap \u2014 bilingual role titles."), "org": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'USFQ', 'Nimbus Labs'). Not a langMap: institutions are never translated (SPEC \xA711)."), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "highlights": z.union([langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), langMapKeys(z.object({ "en": z.array(z.string()) }).catchall(z.array(z.string())))]).describe("v1: langMap of strings (separator-delimited). v1.1 (additive): langMap of string arrays (bullets).").optional() }).strict().describe("start <= end is NOT expressible in JSON Schema \u2014 enforced by core.driftCheck (\xA712 note).")).optional(), "education": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "degree": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: degree title (string or bilingual langMap)."), "institution": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'Universidad Central de Venezuela'). Not a langMap: institutions are never translated (SPEC \xA711)."), "field": z.union([z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: field of study (string or bilingual langMap).").optional(), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "note": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().describe("v1.1 (additive): formal education entry.")).describe("v1.1 (additive): formal education. v1 workspaces keep education inside experience[] with role = degree.").optional(), "languages": z.array(z.object({ "code": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "level": z.enum(["native", "fluent", "advanced", "intermediate", "basic"]) }).strict()).describe("v1.1 (additive): spoken languages. v1 workspaces document them as comments in skills.yaml.").optional(), "projects": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "name": z.string().min(1), "status": z.enum(["active", "maintained", "archived", "experimental", "planning"]).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "links": z.array(z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.")).optional(), "keywords": z.array(z.string()).optional(), "evidence": z.array(z.object({ "claim": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "source": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "verified": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "credentialId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "artifactId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional() }).strict().describe("Verifiable claim with source. Anti-pattern: unverifiable claims (dropped by cite-aware systems, \xA78).")).optional() }).strict()).optional(), "publications": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "title": z.string().min(1), "venue": z.string().min(1), "year": z.number().int().gte(1900).lte(2100), "authors": z.string().describe("v1.1: author string (e.g. 'Luciani, C.' or 'Zambrano et al.').").optional(), "doi": z.string().regex(new RegExp("^10\\.\\d{4,9}/\\S+$")).optional(), "orcidId": z.string().regex(new RegExp("^\\d{4}-\\d{4}-\\d{4}-\\d{3}[\\dX]$")).optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the dataset/code behind this paper. publications keep their domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("DOI/ORCID must be resolvable \u2014 GEO citability anchor (LLMs resolve them).")).describe("Peer-reviewed / citable output. DOI/ORCID resolvable \u2192 GEO citability.").optional(), "keywords": z.object({ "seo": z.record(z.string(), z.array(z.string())).describe("Per-platform SEO keyword sets (fed by each platform skill's research).").optional(), "geo": z.object({ "associations": z.array(z.string()).optional(), "claims": z.array(z.string()).optional() }).strict().optional() }).strict().optional(), "checks": z.array(z.object({ "id": z.string().optional(), "platform": z.enum(["all", "github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Dedup contract: MUST equal ['all', ...$defs/platform.enum] \u2014 scripts/schema-check asserts it (D16)."), "rule": z.enum(["max-chars", "min-chars", "url-live", "fact-present", "geo-consistent", "lang-present", "link-in-identity", "handle-claimed", "handle-consistent"]).describe("Rule catalog (extensible). Skills' checks.yaml use the same catalog; `pasco check` runs the union. v1.1 (brand \xA717): handle-claimed (a claimed handle must resolve to a URL) and handle-consistent (handle matrix coherent across surfaces)."), "value": z.union([z.number(), z.string(), z.boolean(), z.array(z.string())]), "note": z.string().optional(), "surface": z.enum(["headline", "bio", "both"]).describe("Additive (#240): which text rows a char-limit rule applies to. Absent = both. A title cap can target `headline` without flagging the bio.").optional() }).strict()).describe("User-level declarative checks; unioned with the platform skill's checks.yaml by `pasco check`.").optional(), "active": z.record(z.string(), z.object({ "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "variantId": z.string().min(1), "chosenAt": z.string().datetime({ offset: true }) }).strict().describe("The chosen variant id \u2014 user picked it (D11); variant body lives in the workspace variants store.")).describe("Which bio/headline variant is LIVE per platform (D11: user picks, engine records).").optional(), "deployments": z.record(z.string(), z.record(z.string(), z.object({ "deployedAt": z.string().datetime({ offset: true }), "contentHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "source": z.enum(["manual", "git", "api"]), "certification": z.union([z.object({ "state": z.literal("verified"), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "method": z.literal("fetch"), "fetchedAt": z.string().datetime({ offset: true }), "liveHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "evidenceUrl": z.string().url().regex(new RegExp("^https?://")).min(7).optional() }).strict().describe("\xA719.5 C1: a deterministic pass fetched the live artifact, applied the surface's extractor, and the live digest EQUALS the stored anchor. The fetch evidence is required \u2014 a `verified` with no fetch behind it is not evidence."), z.object({ "state": z.literal("attested"), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")).optional() }).strict().describe("\xA719.5 C2: the human `--mark`. Certified by ASSERTION, never rendered as a bare `in-sync`. `artifactHash` is the anchor written at confirmation when the surface has an extractor; a mark on a surface without one records no anchor (the declared forward-only v1 limit, \xA719.5)."), z.object({ "state": z.literal("unverifiable"), "reason": z.string().regex(new RegExp("^(walled|walled-con-api|host-not-allowed|network-error|no-artifact-url|no-extractor|unattributed|http-[0-9]{3})$")).describe("\xA719.5: the declared reasons, the attempt reasons, and `http-<code>` for the ACTUAL status the pass observed. `http-` accepts ANY 3-digit code \u2014 an enum of just http-403/http-429 made a routine 404/500 write a ledger the next `load()` rejects (review F1). One alternation rather than `enum \u222A pattern`: the Zod generator cannot express that union (it degrades to an untyped schema, which its safety net refuses), so the alternatives are pinned by the pattern and by fixtures instead."), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")).optional(), "method": z.literal("fetch").optional(), "fetchedAt": z.string().datetime({ offset: true }).optional(), "evidenceUrl": z.string().url().regex(new RegExp("^https?://")).min(7).optional() }).strict().describe("\xA719.5: no deterministic check is possible, or one was attempted and did not complete. DECLARED reasons (walled \xB7 walled-con-api \xB7 no-extractor \xB7 no-artifact-url) are the PASS's knowledge \u2014 it states them for its own output and writes nothing, so a workspace needs no ledger row per walled platform and the file keeps only durable evidence; ATTEMPTED ones (http-<code> \xB7 network-error \xB7 unattributed \xB7 host-not-allowed) are RECORDED with the fetch evidence. `liveHash` is impossible here \u2014 a comparison would make the state lie; `artifactHash` is allowed because it is the deploy ANCHOR, not a comparison, and a failed check must not destroy it (\xA719.5: the anchor is left unchanged)."), z.object({ "state": z.literal("out-of-band-drift"), "reason": z.literal("live-mismatch"), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "liveHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "method": z.literal("fetch"), "fetchedAt": z.string().datetime({ offset: true }), "evidenceUrl": z.string().url().regex(new RegExp("^https?://")).min(7) }).strict().describe("\xA719.5: a C1 check COMPLETED and contradicts the ledger \u2014 the live digest differs from the anchor. Positive contrary evidence, never a strength of confirmation: the report must not fold it into a green state. Both digests and the fetch evidence are required so the contradiction is auditable.")]).optional() }).strict().describe("v1.3 (D18, \xA719.1): one confirmed deploy of a trackable unit on one surface. contentHash = SHA-256 of the canonical serialization (sorted keys, sans id/origin) of the unit AT deploy time \u2014 staleness is exact and release-tag-independent. v1.10 (issue #132, \xA719.5): the optional `certification` block adds the second, orthogonal dimension.")).describe("v1.3 (D18): surface \u2192 deploy record. Surface keys are the ONE platform enum (D16) \u2014 also core-checked post-Zod (gen-zod drops propertyNames).")).describe("v1.3 (D18, \xA719): per-entry deploy ledger \u2014 ledgerKey \u2192 surface \u2192 record. Keys are constrained above for JSON Schema consumers; the generated Zod drops propertyNames, so core re-checks key patterns, surface enums, duplicate ids and ambiguous composite keys post-Zod (D12 fail class). Only `pasco` mutates this block (same write rule as refine --choose, D14).").optional(), "credentials": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["certificate", "title", "award", "patent"]).describe("D17/\xA718.2: third-party attestation kind."), "title": z.string().min(1).describe("Credential name (proper noun \u2192 invariant string, \xA711)."), "issuer": z.string().min(1).describe("Third-party attester (proper noun \u2192 invariant string, \xA711)."), "credentialId": z.string().min(1).describe("Issuer-side identifier (e.g. certificate serial). Certificates carry PII \u2014 visibility governs exposure (\xA718.5).").optional(), "verifyUrl": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "issued": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "expires": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a third-party attestation. JSON-LD payoff (\xA718.9): `Person.hasCredential` \u2192 `EducationalOccupationalCredential` (public only).")).describe("v1.4 (D17, \xA718): the proof layer \u2014 third-party attestations (certificates, titles, awards, patents). Pointer-first: the workspace declares pointers, the engine never owns binaries (D14). Naming discipline (\xA718.1): never called evidence.").optional(), "artifacts": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["portfolio", "gallery", "showreel", "dataset", "document", "code"]).describe("D17/\xA718.2: work/media kind."), "title": z.string().min(1).describe("Work title (proper noun \u2192 invariant string, \xA711)."), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "locator": z.object({ "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "path": z.string().min(1).describe("In-workspace `media/\u2026` or external under PASCO_EVIDENCE_ROOT \u2014 capability matrix (\xA718.3): NEVER emitted as a public URL while the workspace is private (D14); reaches public surfaces only via renderer assets/ output (M8).").optional() }).strict().describe("Exactly one of `url` | `path` (\xA718.3 capability matrix). The oneOf expresses the XOR for JSON Schema consumers; the generated Zod cannot express required-without-property, so core re-checks the XOR post-Zod (D12 fail class, ledger precedent)."), "checksum": z.string().regex(new RegExp("^sha256:[a-f0-9]{64}$")).describe("Immutable artifacts only (\xA718.6): recorded at compile for byte-stable bundling (M8).").optional(), "license": z.string().min(1).describe("Usage rights for the work (e.g. CC-BY-4.0).").optional(), "tags": z.array(z.string()).describe("Multi-area selection (\xA718.9): renderers select by platform + lang + tags; one workspace, many areas.").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a work or media item. JSON-LD payoff (\xA718.9): surfaces as CreativeWork/ImageGallery/VideoObject/Dataset per platform (renderer-curated, D5).")).describe("v1.4 (D17, \xA718): works/media items (portfolio, gallery, showreel, dataset, document, code), pointer-first via `locator`. Naming discipline (\xA718.1): never called evidence \u2014 canonical blocks keep their domains (publications/press are NOT registry kinds, they reference registry ids).").optional() }).strict().describe("Contract source (D3) for a profile-data workspace. The core `load()` parses content/*.yaml, merges them into a single Profile and validates against THIS schema. Facts (dates, DOIs, URLs, ORCID) are language-independent and are the GEO anchor. Every text field is a langMap ({lang: value}) with EN required (D8, \xA711). Additive since v1 (semver minor): every earlier workspace still validates. v1.1: role as langMap (org stays invariant string), highlights as string[] per lang, publication.authors/url, root languages + education, identity.handle/timezone, patreon in checks; brand flavor (D15/\xA717) \u2014 `flavor`, org identity variant (orgName/logo/brandVoice/mission/tagline/established), socialHandles/newsletter/podcast/press/audiences blocks, brand platforms, handle checks. New in v1.2 (D16): platform set = Postiz parity + operator extras \u2014 43 platforms, one shared enum for both flavors, single-source dedup guard (check.platform). New in v1.3 (D18): per-entry deploy ledger \u2014 `deployments` (ledgerKey \u2192 surface \u2192 deployedAt/contentHash/source), optional stable `id`s on row blocks (experience/projects/publications/education/press), `origin: template` provenance flag. New in v1.4 (D17): evidence registry \u2014 `credentials[]` (third-party attestations: certificate/title/award/patent) and `artifacts[]` (works/media: portfolio/gallery/showreel/dataset/document/code), pointer-first (\xA718); `evidenceItem` gains `credentialId`/`artifactId` cross-refs, `publications[]`/`press[]` gain `artifactRefs`. Naming discipline (\xA718.1): the registry is never called evidence \u2014 `projects[].evidence[]` stays claims-only. New in v1.5 (issue #71): `identity.email` \u2014 the contact email as a first-class fact (schema.org `email` on Person/Organization), NOT a link \u2014 `links[]` stays http(s)-only (mailto: rejected, D12); a mailto: row in links[] broke the template and every real workspace after v1.4's scheme boundary (issue #53). New in v1.6 (issue #103): `identity.links[].role` \u2014 the link ROLE (`identity` | `realization` | `aggregator`), a translation layer onto schema.org (`url` | `sameAs` | `mainEntityOfPage`); absent role = `realization`, so every pre-v1.6 workspace stays VALIDATING unchanged (the rendered output does change \u2014 see \xA715.4). The JSON-LD `@id` is derived from the `role: identity` link and is ABSENT when no link carries it (never invented). Entity assembly moves to a single home (core/src/structured-data.ts), consumed by geoCheck and every renderer \u2014 the \xA718.9 credentialLdEntries precedent. New in v1.7 (issue #130): `kofi` \u2014 Ko-fi creator page as operator extra #10 (44 platforms), creator-monetization family; paste platform, no API deploy (D9). New in v1.8 (issue #133): `buymeacoffee`, `liberapay`, `gumroad`, `payhip` \u2014 the creator monetization platforms family (D16), operator extras #11\u2013#14 (48 platforms); the family is declared in SPEC and descriptions (docs-first), not as a hard schema field; all four are paste platforms, no API deploy (D9). New in v1.9 (issue #137): `hotmart` \u2014 the Hotmart digital-products storefront + memberships (Members Area / recurring billing) serving the Spanish/Portuguese-speaking markets, in the `creator-monetization` family as operator extra #15 (49 platforms); paste platform, no API deploy (D9) \u2014 no management API is documented for the profile body (developers.hotmart.com covers sales/products [?], fetched 2026-10-05).");
 var LANG_KEYS = ["en", "es", "fr"];
 function langMapKeys(schema) {
   return schema.superRefine((value, ctx) => {
@@ -849,6 +934,179 @@ function load(workspace) {
   return normalizeProfile(profile);
 }
 
+// ../core/dist/selection.js
+var SELECTION_BLOCKS = [
+  "experience",
+  "projects",
+  "publications",
+  "education",
+  "press",
+  "credentials",
+  "artifacts",
+  "skills"
+];
+var TAG_CAPABLE = /* @__PURE__ */ new Set(["artifacts"]);
+function entriesOf(profile, block) {
+  const raw = profile[block];
+  return Array.isArray(raw) ? raw : [];
+}
+function keyOf(block, entry) {
+  if (block === "skills" && typeof entry.name === "string" && entry.name !== "") {
+    return `skills:${entry.name}`;
+  }
+  if (typeof entry.id === "string" && entry.id !== "")
+    return `${block}:${entry.id}`;
+  return void 0;
+}
+function labelOf(block, entry, index) {
+  for (const field of ["id", "name", "title"]) {
+    const value = entry[field];
+    if (typeof value === "string" && value !== "")
+      return value;
+  }
+  return `${block}[${index}]`;
+}
+function tagsOf(entry) {
+  const raw = entry.tags;
+  return Array.isArray(raw) ? raw.filter((t) => typeof t === "string") : [];
+}
+var intersects = (a, b) => a.some((value) => b.has(value));
+function resolveView(policy, view) {
+  if (policy === void 0)
+    return {};
+  return policy.views?.[view] ?? policy.default ?? {};
+}
+function selectFacts(profile, view, platform, lang, policy) {
+  const rule = resolveView(policy, view);
+  const mode = rule.mode ?? "all";
+  const excludeKeys = new Set(rule.excludeKeys ?? []);
+  const excludeTags = new Set(rule.excludeTags ?? []);
+  const includeTags = new Set(rule.tags ?? []);
+  const selected = {
+    experience: 0,
+    projects: 0,
+    publications: 0,
+    education: 0,
+    press: 0,
+    credentials: 0,
+    artifacts: 0,
+    skills: 0
+  };
+  const omitted = [];
+  const kept = /* @__PURE__ */ new Map();
+  const keptRefs = [];
+  const omittedRefs = [];
+  const allKeys = /* @__PURE__ */ new Set();
+  const allTags = /* @__PURE__ */ new Set();
+  let totalEntries = 0;
+  for (const block of SELECTION_BLOCKS) {
+    const entries = entriesOf(profile, block);
+    totalEntries += entries.length;
+    const survivors = [];
+    entries.forEach((entry, index) => {
+      const key = keyOf(block, entry);
+      if (key !== void 0)
+        allKeys.add(key);
+      const tags = tagsOf(entry);
+      for (const tag of tags)
+        allTags.add(tag);
+      if (key !== void 0 && excludeKeys.has(key)) {
+        omitted.push({
+          block,
+          key,
+          label: labelOf(block, entry, index),
+          reason: "excluded-by-key"
+        });
+        omittedRefs.push({ block, entry });
+        return;
+      }
+      if (TAG_CAPABLE.has(block)) {
+        if (intersects(tags, excludeTags)) {
+          omitted.push({
+            block,
+            key: key ?? `${block}[${index}]`,
+            label: labelOf(block, entry, index),
+            reason: "excluded-by-tag"
+          });
+          omittedRefs.push({ block, entry });
+          return;
+        }
+        if (mode === "tags" && !intersects(tags, includeTags)) {
+          omitted.push({
+            block,
+            key: key ?? `${block}[${index}]`,
+            label: labelOf(block, entry, index),
+            reason: "not-tagged"
+          });
+          omittedRefs.push({ block, entry });
+          return;
+        }
+      }
+      survivors.push(entry);
+      keptRefs.push({ block, entry });
+    });
+    kept.set(block, survivors);
+    selected[block] = survivors.length;
+  }
+  const findings = [];
+  for (const key of excludeKeys) {
+    if (!allKeys.has(key)) {
+      findings.push({
+        code: "selection/unknown-key",
+        severity: "error",
+        message: `view "${view}" excludes "${key}", which addresses no entry \u2014 check the \xA719.2 key (an entry needs an "id" to be addressable)`
+      });
+    }
+  }
+  for (const tag of /* @__PURE__ */ new Set([...includeTags, ...excludeTags])) {
+    if (!allTags.has(tag)) {
+      findings.push({
+        code: "selection/unknown-tag",
+        severity: "warn",
+        message: `view "${view}" names tag "${tag}", which no ${[...TAG_CAPABLE].join("/")} entry carries`
+      });
+    }
+  }
+  if (omitted.length > 0) {
+    const shown = omitted.slice(0, 5).map((o) => `${o.key} (${o.reason})`).join(", ");
+    const more = omitted.length > 5 ? ` and ${omitted.length - 5} more` : "";
+    findings.push({
+      code: "selection/omits-facts",
+      severity: "warn",
+      message: `view "${view}" omits ${omitted.length} entr${omitted.length === 1 ? "y" : "ies"}: ${shown}${more} \u2014 subset-only by design (D22); run \`pasco status --selection ${view}\` for the full report`
+    });
+  }
+  if (totalEntries > 0 && keptRefs.length === 0) {
+    findings.push({
+      code: "selection/empty-facts",
+      severity: "warn",
+      message: `view "${view}" selects ZERO entries while the workspace has ${totalEntries} \u2014 check its mode/tags`
+    });
+  }
+  const anchors = profile.positioning?.geo?.semanticAssociations ?? [];
+  for (const anchor of anchors) {
+    const needle = anchor.toLowerCase();
+    const haystack = (refs) => refs.some((r) => JSON.stringify(r.entry).toLowerCase().includes(needle));
+    if (!haystack(keptRefs) && haystack(omittedRefs)) {
+      findings.push({
+        code: "selection/anchor-omitted",
+        severity: "warn",
+        message: `GEO anchor "${anchor}" is reinforced only by entries view "${view}" omits \u2014 it does not reach this surface`
+      });
+    }
+  }
+  const filtered = { ...profile };
+  for (const block of SELECTION_BLOCKS) {
+    if (profile[block] === void 0)
+      continue;
+    filtered[block] = kept.get(block) ?? [];
+  }
+  return {
+    profile: filtered,
+    report: { view, platform, lang, mode, selected, omitted, findings }
+  };
+}
+
 // ../core/dist/structured-data.js
 var DEFAULT_LINK_ROLE = "realization";
 function linkRole(link) {
@@ -1002,16 +1260,18 @@ function compile(profile, platform, lang = "en", policy) {
       brandAudiences[name] = text;
   }
   const platformChecks = (profile.checks ?? []).filter((c) => c.platform === "all" || c.platform === platform);
+  const selection = policy?.selection === void 0 ? void 0 : selectFacts(profile, policy.view ?? platform, platform, lang, policy.selection);
+  const facts = selection?.profile ?? profile;
   return {
     platform,
     lang,
     flavor: profile.flavor ?? "person",
     // facts — untouched
-    identity: profile.identity,
-    experience: profile.experience ?? [],
-    projects: profile.projects ?? [],
-    publications: profile.publications ?? [],
-    skills: profile.skills ?? [],
+    identity: facts.identity,
+    experience: facts.experience ?? [],
+    projects: facts.projects ?? [],
+    publications: facts.publications ?? [],
+    skills: facts.skills ?? [],
     socialHandles: profile.socialHandles ?? [],
     newsletter: profile.newsletter,
     podcast: profile.podcast,
@@ -1029,18 +1289,19 @@ function compile(profile, platform, lang = "en", policy) {
     },
     checks: platformChecks,
     // Evidence registry (v1.4/D17, §18) — facts, pass through untouched.
-    credentials: profile.credentials ?? [],
-    artifacts: profile.artifacts ?? [],
+    credentials: facts.credentials ?? [],
+    artifacts: facts.artifacts ?? [],
     ...profile.active?.[platform] ? { active: profile.active[platform] } : {},
     // v1.6 (#103): entity structured-data identity — assembled ONCE here, so no
     // renderer re-derives `@id`/`sameAs` (SPEC §15.4, the §18.9 precedent).
-    structuredData: structuredData(profile, lang),
+    structuredData: structuredData(facts, lang),
     // Issue #102: the completeness report travels WITH the slice (like
     // structuredData) so a renderer emits the number verbatim and never
     // recomputes it. `policy` is the workspace's `.pascorc` policy when the CLI
     // passes it, so the artifact and `pasco status --completeness` agree
     // (review of #205, finding 3); omitted ⇒ the shipped default.
     completeness: completeness(normalizeProfile(profile), policy),
+    ...selection === void 0 ? {} : { selection: selection.report },
     fallbacks
   };
 }
@@ -1090,10 +1351,10 @@ function identityOrcid(profile) {
   }
   return void 0;
 }
-function groupBy(items, keyOf) {
+function groupBy(items, keyOf2) {
   const groups = /* @__PURE__ */ new Map();
   items.forEach((item, index) => {
-    const key = keyOf(item);
+    const key = keyOf2(item);
     const bucket = groups.get(key) ?? [];
     bucket.push(index);
     groups.set(key, bucket);
@@ -1460,7 +1721,9 @@ function geoCheck(profile) {
         // Mirrors `ready = Boolean(name)` exactly (structured-data.ts). The old string still
         // claimed "need name + ≥1 sameAs link" — the predicate it no longer uses, i.e. the
         // same contradiction as the `ready` bug, one line away from its own fix.
-        `schema.org ${sd.entityType} JSON-LD ${sd.ready ? "ready for the web renderer" : "not ready (need a name)"}.`,
+        // #241: the @id gap is a user-facing fact, not a JSON-only field — name the missing
+        // anchor and its weight in the same line the score prints.
+        `schema.org ${sd.entityType} JSON-LD ${sd.ready ? "ready for the web renderer" : "not ready (need a name)"}.${sd.fields.id === void 0 ? ` Missing canonical @id: declare a role: identity link on a page or profile (+${Math.round((checks.find((c) => c.code === "geo/entity-id")?.weight ?? 0.05) * 100)} overall).` : ""}`,
         checks.filter((c) => c.code.startsWith("geo/sameas") || c.code.startsWith("geo/structured") || c.code === "geo/entity-id")
       ),
       readiness: sd
@@ -1597,6 +1860,18 @@ function mediaManifest(platform, lang, assets) {
   };
 }
 
+// ../paste/dist/index.js
+var LENGTH_PRIORITY = ["long", "medium", "short"];
+function pasteSource(p) {
+  for (const length of LENGTH_PRIORITY) {
+    const bio = p.bios.find((b) => b.length === length);
+    if (bio !== void 0)
+      return `${bio.text}
+`;
+  }
+  return "";
+}
+
 // src/contract.ts
 var UsageError = class extends Error {
   constructor(message) {
@@ -1633,18 +1908,6 @@ var EXIT = {
   USAGE: 2
 };
 
-// ../paste/dist/index.js
-var LENGTH_PRIORITY = ["long", "medium", "short"];
-function pasteSource(p) {
-  for (const length of LENGTH_PRIORITY) {
-    const bio = p.bios.find((b) => b.length === length);
-    if (bio !== void 0)
-      return `${bio.text}
-`;
-  }
-  return "";
-}
-
 // ../renderers/buymeacoffee/dist/index.js
 function render(p) {
   return { text: pasteSource(p) };
@@ -1658,6 +1921,235 @@ function mdText(text) {
   return text.replace(/[\\[\]]/g, "\\$&");
 }
 
+// ../artifact/dist/index.js
+var H1 = /^# /;
+var CREATED = /* @__PURE__ */ new WeakSet();
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var SURFACE_SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function assertSurface(surface) {
+  if (!SURFACE_SLUG.test(surface)) {
+    throw new Error(`not a surface slug (D16): ${JSON.stringify(surface)} \u2014 the generic projection must know whose generated footer bounds the region`);
+  }
+}
+function footerMarker(surface) {
+  return new RegExp(`^<!-- generated by profile-as-code pasco build ${escapeRegExp(surface)}(?![\\w-])`);
+}
+function normalizeTransport(text) {
+  return text.replace(/\r\n?/g, "\n").split("\n").map((line2) => line2.replace(/^\uFEFF+/, ""));
+}
+function projectArtifact(text, surface) {
+  assertSurface(surface);
+  const lines2 = normalizeTransport(text);
+  const terminus = footerMarker(surface);
+  const footer = lines2.findLastIndex((line2) => terminus.test(line2));
+  const limit = footer === -1 ? lines2.length - 1 : footer;
+  const header = lines2.findLastIndex((line2, index) => index <= limit && H1.test(line2));
+  const bounded = header !== -1;
+  const from = bounded ? header : 0;
+  const to = bounded || footer === -1 ? limit : lines2.length - 1;
+  const artifact = lines2.slice(from, to + 1);
+  let first = 0;
+  let last = artifact.length - 1;
+  while (first <= last && artifact[first]?.trim() === "")
+    first += 1;
+  while (last >= first && artifact[last]?.trim() === "")
+    last -= 1;
+  return artifact.slice(first, last + 1).join("\n");
+}
+function createArtifactExtractor(surface) {
+  assertSurface(surface);
+  const extractor = Object.defineProperty((text) => projectArtifact(text, surface), "surface", { value: surface, enumerable: true });
+  CREATED.add(extractor);
+  return extractor;
+}
+
+// ../github/dist/index.js
+var CREATED2 = /* @__PURE__ */ new WeakSet();
+function assertBinding(binding) {
+  const { surface, linkPlatforms } = binding;
+  if (surface === "" || !linkPlatforms.has(surface)) {
+    throw new Error(`incoherent GitHub surface binding: ${JSON.stringify(surface)} is not in its own linkPlatforms \u2014 a surface whose own slug cannot name it would read "no-artifact-url" for an artifact it publishes`);
+  }
+}
+var OWNER = /^[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*$/;
+var OWNER_MAX = 39;
+function ownerSlug(value) {
+  if (RESERVED_BY_PREFIX.has(value.toLowerCase()))
+    return null;
+  return value.length <= OWNER_MAX && OWNER.test(value) ? value : null;
+}
+function ownerFromHandle(handle) {
+  if (handle === void 0)
+    return null;
+  return ownerSlug(handle.startsWith("@") ? handle.slice(1) : handle);
+}
+var route = (prefix, kind, why, observed) => Object.freeze({ prefix, kind, why, observed });
+var RESERVED_ROUTES = Object.freeze([
+  // --- the route's next segment IS the account's own page ---------------------
+  route("orgs", "owner-after-prefix", "GitHub's organization landing route: the page at /orgs/<org> IS the org's own page, so the owner is the segment after the prefix (the shipped F2 fix of #212).", "bare /orgs \u2192 404 (no index page) \xB7 /orgs/vercel \u2192 200 \u2192 github.com/vercel"),
+  route("sponsors", "owner-after-prefix", "GitHub Sponsors: /sponsors/<account> is that account's sponsored profile and GitHub resolves it to the account's own page, so the owner is the segment after the prefix.", "/sponsors/<account> \u2192 200 \u2192 github.com/<account>; bare /sponsors \u2192 200 (the Sponsors landing at /open-source/sponsors)"),
+  // --- GitHub's own discovery, marketplace and marketing pages ---------------
+  route("topics", "no-owner", "GitHub Topics: /topics/<topic> is a hub aggregating many repositories, not an account's page.", "/topics/typescript \u2192 200 (a topic hub)"),
+  route("collections", "no-owner", "GitHub Collections: /collections/<slug> is a curated list of repositories, not an account.", "/collections \u2192 200 (the collections index)"),
+  route("marketplace", "no-owner", "GitHub Marketplace: /marketplace/<listing> is an App/Action listing page; a listing is not an account.", "bare /marketplace \u2192 400 (bot-gated) \xB7 /marketplace/actions/checkout \u2192 200 (an Action listing)"),
+  route("apps", "no-owner", "GitHub Apps: /apps/<slug> is an App's public page; an App is not a user or an org, so no owner artifact exists for it.", "bare /apps \u2192 400 followed (bot-gated at /marketplace) \xB7 without `-L`: 302 \u2192 github.com/marketplace, which IS the route evidence"),
+  route("trending", "no-owner", "GitHub Trending: GitHub's own leaderboard page.", "/trending \u2192 200"),
+  route("explore", "no-owner", "GitHub Explore: GitHub's own discovery hub.", "/explore \u2192 200"),
+  route("discover", "no-owner", "A GitHub discovery alias that resolves to Explore, not to an account.", "/discover \u2192 200 \u2192 github.com/explore"),
+  route("search", "no-owner", "GitHub Search: a query page over the whole site, owned by no account.", "/search \u2192 200"),
+  route("events", "no-owner", "GitHub's events/webinars index (a marketing page), not an account.", "/events \u2192 200 \u2192 github.com/resources/events"),
+  route("education", "no-owner", "GitHub Education: GitHub's own program page.", "/education \u2192 200"),
+  route("partners", "no-owner", "GitHub Partner Program: GitHub's own program page.", "/partners \u2192 200"),
+  route("customers", "no-owner", "GitHub's customer-stories page, an alias of GitHub's own marketing surface.", "/customers \u2192 200 \u2192 github.com/customer-stories"),
+  route("business", "no-owner", "GitHub's business/Enterprise marketing alias, not an account.", "/business \u2192 200 \u2192 github.com/enterprise"),
+  route("enterprise", "no-owner", "GitHub Enterprise: GitHub's own product page.", "/enterprise \u2192 200"),
+  route("enterprises", "no-owner", "GitHub Enterprise Cloud accounts live at /enterprises/<slug>: an enterprise account is not a user or org owner, and the route itself is GitHub's.", "bare /enterprises \u2192 404 signed out (the per-slug page is GitHub-gated)"),
+  route("security", "no-owner", "GitHub Security: GitHub's own security hub.", "/security \u2192 200"),
+  route("about", "no-owner", "GitHub About: GitHub's own page.", "/about \u2192 200"),
+  route("pricing", "no-owner", "GitHub Pricing: GitHub's own plans page.", "/pricing \u2192 200"),
+  route("features", "no-owner", "GitHub Features: GitHub's own product tour.", "/features \u2192 200"),
+  route("contact", "no-owner", "GitHub Support: GitHub's own contact page.", "/contact \u2192 200 \u2192 help.github.com"),
+  route("home", "no-owner", "GitHub's signed-in home page.", "/home \u2192 200"),
+  route("copilot", "no-owner", "GitHub Copilot: GitHub's own product page.", "/copilot \u2192 200"),
+  // --- the marketing, program and doc-hosted pages (review of PR #232, F1) ----
+  // Admitted by the case-variant SIGNATURE, not by guessing: GitHub serves a
+  // lowercase page whose `og:type` is not `profile`, while the all-caps spelling is
+  // a 404 — a route, because an ACCOUNT answers in every casing (`/WWW` and
+  // `/WWW`==`/www`, `/Profile`/`/PROFILE`, probed). The fresh review named 8 of
+  // these; the same sweep found 18 more, and it is what keeps the live accounts it
+  // touched (`www`, `actions`, `desktop`, `docs`, `dependabot`, `students`, …) OUT:
+  // their uppercase spelling returns a profile. `observed` records both halves of
+  // the signature for these rows; the sweep command is in the README.
+  route("open-source", "no-owner", "GitHub's open-source program landing \u2014 also where the bare `/sponsors` redirect lands, which is why `/sponsors` alone is not an owner either.", "bare /open-source \u2192 200 (object) \xB7 /OPEN-SOURCE \u2192 404"),
+  route("readme", "no-owner", "The README Project: GitHub's own editorial hub about maintainers.", "bare /readme \u2192 200 (object) \xB7 /README \u2192 404"),
+  route("team", "no-owner", "GitHub for Teams: GitHub's own marketing page.", "bare /team \u2192 200 (object) \xB7 /TEAM \u2192 404"),
+  route("solutions", "no-owner", "GitHub Solutions: GitHub's own by-industry landing page.", "bare /solutions \u2192 200 (object) \xB7 /SOLUTIONS \u2192 404"),
+  route("why-github", "no-owner", "GitHub's 'why GitHub' marketing page.", "bare /why-github \u2192 200 (object) \xB7 /WHY-GITHUB \u2192 404"),
+  route("trust-center", "no-owner", "GitHub Trust Center: GitHub's own compliance and assurance page.", "bare /trust-center \u2192 200 (object) \xB7 /TRUST-CENTER \u2192 404"),
+  route("repositories", "no-owner", "A GitHub alias that resolves to the Trending leaderboard, not a repository index an owner could be read from.", "bare /repositories \u2192 200 \u2192 /trending \xB7 /REPOSITORIES \u2192 404"),
+  route("users", "no-owner", "A GitHub alias to the signed-in home; there is no user index at the bare segment to read an owner from.", "bare /users \u2192 200 (object) \xB7 /USERS \u2192 404"),
+  route("mobile", "no-owner", "GitHub Mobile: GitHub's own product page.", "bare /mobile \u2192 200 (object) \xB7 /MOBILE \u2192 404"),
+  route("pages", "no-owner", "GitHub Pages: GitHub's own product site (pages.github.com).", "bare /pages \u2192 200 \u2192 pages.github.com \xB7 /PAGES \u2192 404"),
+  route("wiki", "no-owner", "GitHub Wikis: GitHub's own feature page.", "bare /wiki \u2192 200 (object) \xB7 /WIKI \u2192 404"),
+  route("discussions", "no-owner", "GitHub Discussions: the viewer's cross-repository discussions hub.", "bare /discussions \u2192 200 \u2192 login?return_to=/discussions \xB7 /DISCUSSIONS \u2192 404"),
+  route("site-policy", "no-owner", "GitHub's site-policy corpus, served from docs.github.com.", "bare /site-policy \u2192 200 \u2192 docs.github.com/en/site-policy \xB7 /SITE-POLICY \u2192 404"),
+  route("resources", "no-owner", "GitHub Resources: GitHub's own content hub.", "bare /resources \u2192 200 (object) \xB7 /RESOURCES \u2192 404"),
+  route("guides", "no-owner", "GitHub Guides, served from docs.github.com.", "bare /guides \u2192 200 \u2192 docs.github.com \xB7 /GUIDES \u2192 404"),
+  route("support", "no-owner", "GitHub Support, served from help.github.com.", "bare /support \u2192 200 \u2192 help.github.com \xB7 /SUPPORT \u2192 404"),
+  route("status", "no-owner", "GitHub Status: GitHub's own availability page.", "bare /status \u2192 200 \xB7 /STATUS \u2192 404"),
+  route("blog", "no-owner", "The GitHub Blog (github.blog).", "bare /blog \u2192 200 \u2192 github.blog \xB7 /BLOG \u2192 404"),
+  route("nonprofit", "no-owner", "GitHub for Nonprofits, served from socialimpact.github.com.", "bare /nonprofit \u2192 200 \u2192 socialimpact.github.com \xB7 /NONPROFIT \u2192 404"),
+  route("advisories", "no-owner", "The GitHub Advisory Database: GitHub's own security-advisories index.", "bare /advisories \u2192 200 (object) \xB7 /ADVISORIES \u2192 404"),
+  route("spark", "no-owner", "GitHub Spark: GitHub's own product page.", "bare /spark \u2192 200 (object) \xB7 /SPARK \u2192 404"),
+  route("press", "no-owner", "GitHub Press, served under /about/press.", "bare /press \u2192 200 \u2192 /about/press \xB7 /PRESS \u2192 404"),
+  route("social-impact", "no-owner", "GitHub Social Impact: GitHub's own program page.", "bare /social-impact \u2192 200 (object) \xB7 /SOCIAL-IMPACT \u2192 404"),
+  route("universe", "no-owner", "GitHub Universe: GitHub's own conference site (githubuniverse.com).", "bare /universe \u2192 200 \u2192 githubuniverse.com \xB7 /UNIVERSE \u2192 404"),
+  route("sitemap", "no-owner", "GitHub's own sitemap index.", "bare /sitemap \u2192 200 \xB7 /SITEMAP \u2192 404"),
+  route("terms", "no-owner", "GitHub's Terms of Service, served from docs.github.com.", "bare /terms \u2192 200 \u2192 docs.github.com/en/site-policy/github-terms/\u2026 \xB7 /TERMS \u2192 404"),
+  // --- account and session routes -------------------------------------------
+  route("settings", "no-owner", "Account settings are per-viewer, not a page belonging to a named account (/settings/profile is the canonical example from #227).", "/settings \u2192 200 \u2192 github.com/login?return_to=/settings"),
+  route("account", "no-owner", "GitHub's own account entry point, an alias of settings.", "/account \u2192 200 \u2192 github.com/login?return_to=/account"),
+  route("login", "no-owner", "GitHub's sign-in form.", "/login \u2192 200"),
+  route("logout", "no-owner", "GitHub's sign-out action.", "/logout \u2192 200 \u2192 github.com/"),
+  route("join", "no-owner", "GitHub's sign-up funnel.", "/join \u2192 403 \u2192 github.com/signup"),
+  route("signup", "no-owner", "GitHub's sign-up form.", "/signup \u2192 403 (bot-gated)"),
+  route("new", "no-owner", "GitHub's new-repository entry point for the viewer.", "/new \u2192 200 \u2192 github.com/login?return_to=/new"),
+  route("notifications", "no-owner", "The viewer's notification inbox, not an account's page.", "/notifications \u2192 200 \u2192 github.com/login?return_to=/notifications"),
+  route("dashboard", "no-owner", "The viewer's dashboard, not an account's page.", "/dashboard \u2192 200 \u2192 github.com/login?return_to=/dashboard"),
+  route("stars", "no-owner", "DELIBERATE, and the one row whose evidence would also support owner-after: /stars/<account> IS that account's starred list. #227 decides null and this row follows it \u2014 the conservative direction (an honest no-artifact-url, never a wrong URL). Flipping the kind is one word of data plus a corpus case.", "/stars/<account> \u2192 200 (titled with the account); bare /stars \u2192 200 \u2192 github.com/login?return_to=/stars"),
+  route("pulls", "no-owner", "The viewer's cross-repository pull-request inbox.", "/pulls \u2192 200 \u2192 github.com/login?return_to=/pulls"),
+  route("issues", "no-owner", "The viewer's cross-repository issue inbox.", "bare /issues \u2192 404 signed out (the signed-in global list)"),
+  route("codespaces", "no-owner", "The viewer's Codespaces hub.", "/codespaces \u2192 200 \u2192 github.com/login?return_to=/codespaces"),
+  route("organizations", "no-owner", "GitHub's organization management routes (/organizations/<org>/settings/\u2026); the bare segment is not an account page.", "bare /organizations \u2192 404 signed out"),
+  route("gists", "no-owner", "Gists live on a separate host; /gists is a GitHub redirect, not an account.", "/gists \u2192 200 \u2192 gist.github.com/starred")
+]);
+var RESERVED_BY_PREFIX = new Map(RESERVED_ROUTES.map((row) => [row.prefix, row]));
+function decodeSegment(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return null;
+  }
+}
+function ownerFromUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+    return null;
+  if (parsed.hostname !== "github.com" && parsed.hostname !== "www.github.com")
+    return null;
+  const segments = parsed.pathname.split("/").filter((part) => part !== "");
+  const first = segments[0];
+  if (first === void 0)
+    return null;
+  const decodedFirst = decodeSegment(first);
+  if (decodedFirst === null)
+    return null;
+  const reserved = RESERVED_BY_PREFIX.get(decodedFirst.toLowerCase());
+  if (reserved !== void 0) {
+    if (reserved.kind === "no-owner")
+      return null;
+    const ownerSegment = segments[1];
+    if (ownerSegment === void 0)
+      return null;
+    const decodedOwner = decodeSegment(ownerSegment);
+    return decodedOwner === null ? null : ownerSlug(decodedOwner);
+  }
+  return ownerSlug(decodedFirst);
+}
+function resolveGithubOwner(profile, binding) {
+  assertBinding(binding);
+  const { surface, linkPlatforms } = binding;
+  for (const link of profile.identity.links ?? []) {
+    if (link.platform !== void 0 && !linkPlatforms.has(link.platform))
+      continue;
+    const owner = ownerFromUrl(link.url);
+    if (owner !== null)
+      return owner;
+  }
+  for (const handle of profile.socialHandles ?? []) {
+    if (handle.platform !== surface || handle.status !== "claimed")
+      continue;
+    const owner = (handle.url !== void 0 ? ownerFromUrl(handle.url) : null) ?? ownerFromHandle(handle.handle);
+    if (owner !== null)
+      return owner;
+  }
+  return null;
+}
+function createGithubOwnerResolver(binding) {
+  assertBinding(binding);
+  const linkPlatforms = Object.freeze([...binding.linkPlatforms].sort());
+  const declared = {
+    surface: binding.surface,
+    linkPlatforms: new Set(linkPlatforms)
+  };
+  const resolver = Object.defineProperty((profile) => resolveGithubOwner(profile, declared), "surface", { value: binding.surface, enumerable: true });
+  Object.defineProperty(resolver, "linkPlatforms", { value: linkPlatforms, enumerable: true });
+  CREATED2.add(resolver);
+  return resolver;
+}
+
+// ../renderers/github-org/dist/artifact.js
+var fetchHosts = ["raw.githubusercontent.com"];
+var GITHUB_LINK_PLATFORMS = /* @__PURE__ */ new Set(["github", "github-org"]);
+var githubOwner = createGithubOwnerResolver({
+  surface: "github-org",
+  linkPlatforms: GITHUB_LINK_PLATFORMS
+});
+function artifactUrl(profile) {
+  const org = githubOwner(profile);
+  if (org === null)
+    return null;
+  return `https://raw.githubusercontent.com/${org}/.github/HEAD/profile/README.md`;
+}
+var extractArtifact = createArtifactExtractor("github-org");
+
 // ../renderers/github-org/dist/index.js
 var BADGE = {
   github: { color: "181717", logo: "github", label: "GitHub" },
@@ -1778,6 +2270,21 @@ function render2(p, opts = {}) {
 ` };
 }
 
+// ../renderers/github-readme/dist/artifact.js
+var fetchHosts2 = ["raw.githubusercontent.com"];
+var GITHUB_LINK_PLATFORMS2 = /* @__PURE__ */ new Set(["github", "github-readme"]);
+var githubOwner2 = createGithubOwnerResolver({
+  surface: "github-readme",
+  linkPlatforms: GITHUB_LINK_PLATFORMS2
+});
+function artifactUrl2(profile) {
+  const owner = githubOwner2(profile);
+  if (owner === null)
+    return null;
+  return `https://raw.githubusercontent.com/${owner}/${owner}/HEAD/README.md`;
+}
+var extractArtifact2 = createArtifactExtractor("github-readme");
+
 // ../renderers/github-readme/dist/index.js
 function credentialLine(c) {
   const years = c.issued !== void 0 ? `, ${c.issued.slice(0, 4)}${c.expires !== void 0 ? `\u2013${c.expires.slice(0, 4)}` : ""}` : "";
@@ -1848,6 +2355,19 @@ function projectWeight(p, skills) {
   }
   return best;
 }
+var STATUS_RANK = {
+  active: 0,
+  maintained: 1,
+  experimental: 2,
+  planning: 3,
+  archived: 4
+};
+function statusRank(status) {
+  return status === void 0 ? 5 : STATUS_RANK[status] ?? 5;
+}
+function byteOrder(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
 function render3(p, opts = {}) {
   const lang = opts.lang ?? p.lang;
   if (opts.lang !== void 0 && opts.lang !== p.lang && p.structuredData?.jsonLd !== void 0) {
@@ -1876,7 +2396,7 @@ function render3(p, opts = {}) {
     out.push("", badges.join(" "));
   if (p.statement !== void 0)
     out.push("", `**${p.statement}**`);
-  const projects = [...p.projects].sort((a, b) => projectWeight(b, p.skills) - projectWeight(a, p.skills) || a.name.localeCompare(b.name));
+  const projects = [...p.projects].sort((a, b) => statusRank(a.status) - statusRank(b.status) || projectWeight(b, p.skills) - projectWeight(a, p.skills) || byteOrder(a.name, b.name));
   if (projects.length > 0) {
     out.push("", "## Projects");
     for (const project of projects.slice(0, 6)) {
@@ -2025,10 +2545,124 @@ function line(text) {
   process.stdout.write(`${text}
 `);
 }
+function warn2(text) {
+  if (jsonMode) return;
+  process.stderr.write(`warning: ${text}
+`);
+}
+
+// src/publication.ts
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
+
+// src/limits.ts
+function limitRows(profile) {
+  return [
+    ...(profile.headlines ?? []).map((h) => ({
+      label: `headline ${h.platform}/${h.lang}`,
+      platform: h.platform,
+      surface: "headline",
+      text: h.text,
+      path: `headlines:${h.platform}:${h.lang}`
+    })),
+    ...(profile.bios ?? []).map((b) => ({
+      label: `bio ${b.platform}/${b.lang}/${b.length}`,
+      platform: b.platform,
+      surface: "bio",
+      text: b.text,
+      path: `bios:${b.platform}:${b.lang}:${b.length}`
+    }))
+  ];
+}
+function limitFindings(profile, checks, platform) {
+  const rows = limitRows(profile);
+  const findings = [];
+  for (const check of checks) {
+    if (check.rule !== "max-chars" && check.rule !== "min-chars") continue;
+    if (platform !== void 0 && check.platform !== "all" && check.platform !== platform) continue;
+    if (typeof check.value !== "number" || !Number.isFinite(check.value)) {
+      findings.push({
+        severity: "warn",
+        code: check.rule,
+        message: `check ${check.id ?? "(no id)"} has a non-numeric ${check.rule} value \u2014 skipped`,
+        path: `checks:${check.id ?? "?"}`
+      });
+      continue;
+    }
+    for (const row of rows) {
+      if (platform !== void 0 && row.platform !== platform) continue;
+      if (check.platform !== "all" && check.platform !== row.platform) continue;
+      const surface = check.surface ?? "both";
+      if (surface !== "both" && surface !== row.surface) continue;
+      const length = [...row.text].length;
+      const over = check.rule === "max-chars" && length > check.value;
+      const under = check.rule === "min-chars" && length < check.value;
+      if (!over && !under) continue;
+      findings.push({
+        severity: "warn",
+        code: check.rule,
+        message: `${row.label} has ${length} chars, ${over ? "over max" : "under min"} ${check.value}${check.note === void 0 ? "" : ` \u2014 ${check.note}`}`,
+        path: row.path
+      });
+    }
+  }
+  return findings;
+}
+
+// src/variant-store.ts
+import { readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { join as join3 } from "path";
+var SAFE_VARIANT_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function isSafeVariantId(id) {
+  return SAFE_VARIANT_ID.test(id) && !id.includes("..");
+}
+function variantBodyPath(workspace, platform, variantId) {
+  return join3(workspace, "profiles", platform, "variants", `${variantId}.md`);
+}
+function hasVariantBody(workspace, platform, variantId) {
+  if (!isSafeVariantId(variantId)) return false;
+  try {
+    const path = variantBodyPath(workspace, platform, variantId);
+    if (!statSync2(path).isFile()) return false;
+    return readFileSync3(path, "utf8").trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+function resolveVariantBody(workspace, slice) {
+  const active = slice.active;
+  if (active === void 0) return {};
+  const id = active.variantId;
+  if (!isSafeVariantId(id)) {
+    return {
+      warning: `active variant id ${JSON.stringify(id)} is not a safe path segment \u2014 deterministic fallback`
+    };
+  }
+  if (active.lang !== slice.lang) {
+    return {
+      warning: `active variant ${id} is for ${active.lang}, building ${slice.lang} \u2014 deterministic fallback`
+    };
+  }
+  const path = variantBodyPath(workspace, slice.platform, id);
+  try {
+    if (!statSync2(path).isFile()) {
+      return {
+        warning: `active variant ${id} at ${path} is not a regular file \u2014 deterministic fallback`
+      };
+    }
+    const text = readFileSync3(path, "utf8");
+    if (text.trim() === "") {
+      return { warning: `active variant ${id} is empty at ${path} \u2014 deterministic fallback` };
+    }
+    return { id, text };
+  } catch {
+    return { warning: `active variant ${id} has no body at ${path} \u2014 deterministic fallback` };
+  }
+}
 
 // src/workspace.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { dirname, join as join3, resolve as resolve2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { dirname, join as join4, resolve as resolve2 } from "path";
 var WORKSPACE_NAME = "profile-data";
 function sanitizeCompletenessPolicy(raw) {
   if (raw === void 0) return {};
@@ -2042,6 +2676,45 @@ function sanitizeCompletenessPolicy(raw) {
     ...items.length > 0 ? { items } : {}
   };
 }
+function sanitizeSelectionPolicy(raw) {
+  if (raw === void 0) return void 0;
+  const strings = (v) => {
+    if (!Array.isArray(v)) return void 0;
+    const kept = v.filter((x) => typeof x === "string" && x !== "");
+    return kept.length > 0 ? kept : void 0;
+  };
+  const rule = (r) => {
+    if (r === void 0) return void 0;
+    const mode = r.mode === "all" || r.mode === "tags" ? r.mode : void 0;
+    const tags = strings(r.tags);
+    const excludeTags = strings(r.excludeTags);
+    const excludeKeys = strings(r.excludeKeys);
+    const platform = typeof r.platform === "string" && r.platform !== "" ? r.platform : void 0;
+    const lang = typeof r.lang === "string" && r.lang !== "" ? r.lang : void 0;
+    if (mode === void 0 && tags === void 0 && excludeTags === void 0 && excludeKeys === void 0 && platform === void 0 && lang === void 0) {
+      return void 0;
+    }
+    return {
+      ...mode === void 0 ? {} : { mode },
+      ...tags === void 0 ? {} : { tags },
+      ...excludeTags === void 0 ? {} : { excludeTags },
+      ...excludeKeys === void 0 ? {} : { excludeKeys },
+      ...platform === void 0 ? {} : { platform },
+      ...lang === void 0 ? {} : { lang }
+    };
+  };
+  const views = {};
+  for (const [name, r] of Object.entries(raw.views ?? {})) {
+    const clean = rule(r);
+    if (clean !== void 0) views[name] = clean;
+  }
+  const def = rule(raw.default);
+  if (def === void 0 && Object.keys(views).length === 0) return void 0;
+  return {
+    ...def === void 0 ? {} : { default: def },
+    ...Object.keys(views).length > 0 ? { views } : {}
+  };
+}
 var ConfigError = class extends Error {
   constructor(message) {
     super(message);
@@ -2049,9 +2722,9 @@ var ConfigError = class extends Error {
   }
 };
 function readPascorc(dir) {
-  const pascorcPath = join3(dir, ".pascorc");
+  const pascorcPath = join4(dir, ".pascorc");
   if (!existsSync3(pascorcPath)) {
-    const legacy = join3(dir, ".pacrc");
+    const legacy = join4(dir, ".pacrc");
     if (existsSync3(legacy)) {
       throw new ConfigError(
         `legacy .pacrc found at ${legacy} \u2014 rename it to .pascorc (the bin was renamed pac \u2192 pasco; issue #38)`
@@ -2061,7 +2734,7 @@ function readPascorc(dir) {
   }
   let raw;
   try {
-    raw = readFileSync3(pascorcPath, "utf8");
+    raw = readFileSync4(pascorcPath, "utf8");
   } catch (err) {
     throw new ConfigError(`cannot read ${pascorcPath}: ${err.message}`);
   }
@@ -2093,6 +2766,155 @@ function defaultsLang(pascorc, requested) {
   return pascorc.defaults?.lang ?? "en";
 }
 
+// src/publication.ts
+function artifactPath(workspace, surface) {
+  return RENDERERS[surface] === void 0 ? join5(workspace, "profiles", `${surface}.md`) : join5(workspace, "profiles", surface, "README.md");
+}
+function builtArtifact(workspace, surface) {
+  const path = artifactPath(workspace, surface);
+  return existsSync4(path) ? readFileSync5(path, "utf8") : void 0;
+}
+function publishedSurfaces(workspace) {
+  const dir = join5(workspace, "profiles");
+  if (!existsSync4(dir)) return [];
+  const known = new Set(PLATFORMS);
+  const out = [];
+  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+    const surface = entry.isDirectory() ? existsSync4(join5(dir, entry.name, "README.md")) ? entry.name : void 0 : entry.name.endsWith(".md") ? entry.name.slice(0, -".md".length) : void 0;
+    if (surface !== void 0 && known.has(surface)) out.push(surface);
+  }
+  return out;
+}
+function createArtifactResolver(args) {
+  let assets;
+  const media = () => assets ??= collectMedia(args.profile, args.workspace).assets;
+  const policy = sanitizeCompletenessPolicy(args.completenessPolicy);
+  const selection = sanitizeSelectionPolicy(args.selectionPolicy);
+  return {
+    built: (surface) => builtArtifact(args.workspace, surface),
+    render: (surface, lang) => {
+      if (surface === "github-org" && args.profile.flavor !== "brand") return void 0;
+      const renderer = RENDERERS[surface];
+      const slice = compile(args.profile, surface, lang, {
+        ...policy,
+        ...selection === void 0 ? {} : { selection, view: surface }
+      });
+      const variant = resolveVariantBody(args.workspace, slice);
+      if (variant.text !== void 0) return variant.text;
+      return renderer === void 0 ? pasteSource(slice) : renderer(slice, media()).text;
+    }
+  };
+}
+function candidateLangs(primary) {
+  return [primary, ...LANGS.filter((lang) => lang !== primary)];
+}
+var GENERATED_COMPLETENESS = /^Profile completeness: -?\d+(?:\.\d+)?% — \d+\/\d+$/;
+function factIdentity(text) {
+  return text.split("\n").filter((line2) => !GENERATED_COMPLETENESS.test(line2)).join("\n");
+}
+function artifactTruth(resolver, surface, langs) {
+  const built = resolver.built(surface);
+  if (built === void 0) return "absent";
+  const identity = factIdentity(built);
+  for (const lang of langs) {
+    const render9 = resolver.render(surface, lang);
+    if (render9 !== void 0 && factIdentity(render9) === identity) return "matches-SSOT";
+  }
+  return "diverges";
+}
+function driftingSurfaces(reportData) {
+  const drifting = /* @__PURE__ */ new Set();
+  for (const unit of reportData.units) {
+    for (const [surface, cert] of Object.entries(unit.certification?.surfaces ?? {})) {
+      if (cert.state === "out-of-band-drift") drifting.add(surface);
+    }
+  }
+  return drifting;
+}
+function ledgerSurfaces(reportData) {
+  const out = {};
+  for (const unit of reportData.units) {
+    for (const [surface, state] of Object.entries(unit.surfaces)) {
+      const entry = out[surface] ?? { state: "in-sync", recorded: 0, stale: 0 };
+      entry.recorded += 1;
+      if (state === "stale") {
+        entry.state = "stale";
+        entry.stale += 1;
+      }
+      out[surface] = entry;
+    }
+  }
+  return out;
+}
+function isRowFinding(finding2) {
+  return finding2.path.startsWith("headlines:") || finding2.path.startsWith("bios:");
+}
+function axisFindings(findings) {
+  return findings.filter((finding2) => !isRowFinding(finding2) || finding2.code === "max-chars");
+}
+function publicationTruth(args) {
+  const resolver = createArtifactResolver({
+    workspace: args.workspace,
+    profile: args.profile,
+    completenessPolicy: args.completenessPolicy,
+    selectionPolicy: args.selectionPolicy
+  });
+  const ledger = ledgerSurfaces(args.reportData);
+  const drifting = driftingSurfaces(args.reportData);
+  const surfaces = [.../* @__PURE__ */ new Set([...Object.keys(ledger), ...publishedSurfaces(args.workspace)])].filter((s) => PLATFORMS.includes(s)).sort();
+  const langs = candidateLangs(args.lang);
+  return surfaces.map((surface) => {
+    const ledgerEntry = ledger[surface];
+    const findings = axisFindings(limitFindings(args.profile, args.checks, surface));
+    const local = artifactTruth(resolver, surface, langs);
+    const drifted = drifting.has(surface);
+    const artifact = drifted || local === "diverges" ? "diverges" : local === "absent" ? "absent" : "matches-SSOT";
+    const artifactReason = artifact === "matches-SSOT" ? void 0 : drifted ? "live-drift" : local === "absent" ? "no-artifact" : "local-mismatch";
+    return {
+      surface,
+      sync: ledgerEntry?.state ?? "never",
+      artifact,
+      ...artifactReason === void 0 ? {} : { artifactReason },
+      limits: findings.some((f) => isRowFinding(f)) ? "over(cap)" : "ok",
+      units: { recorded: ledgerEntry?.recorded ?? 0, stale: ledgerEntry?.stale ?? 0 },
+      findings
+    };
+  });
+}
+function publicationOfCaller(args, profile, reportData, defaultChecks) {
+  const checks = profile.checks.length > 0 ? profile.checks : defaultChecks;
+  return publicationTruth({
+    workspace: args.workspace,
+    profile,
+    reportData,
+    checks,
+    lang: args.lang ?? "en",
+    completenessPolicy: args.completenessPolicy,
+    selectionPolicy: args.selectionPolicy
+  }).filter((t) => args.platformArg === void 0 || t.surface === args.platformArg);
+}
+function publicationCoverageLine(publication) {
+  const total = publication.length;
+  const matching = publication.filter((t) => t.artifact === "matches-SSOT").length;
+  const over = publication.filter((t) => t.limits === "over(cap)").length;
+  const diverging = publication.filter((t) => t.artifact === "diverges").length;
+  const absent = publication.filter((t) => t.artifact === "absent").length;
+  const noun = total === 1 ? "surface" : "surfaces";
+  const verb = total === 1 ? "matches" : "match";
+  return [
+    `${matching}/${total} ${noun} ${verb} the SSOT`,
+    `${over} over cap`,
+    ...diverging > 0 ? [`${diverging} diverged`] : [],
+    ...absent > 0 ? [`${absent} absent`] : []
+  ].join(" \xB7 ");
+}
+function publicationCoverageOrNone(publication) {
+  return publication.length === 0 ? "no surface published yet" : publicationCoverageLine(publication);
+}
+function publicationLine(truth) {
+  return `${truth.surface}: ${truth.sync} \xB7 artifact: ${truth.artifact} \xB7 limits: ${truth.limits} \xB7 units: ${truth.units.recorded} recorded${truth.units.stale > 0 ? ` (${truth.units.stale} stale)` : ""}`;
+}
+
 // src/commands/build.ts
 function runBuild(args) {
   let profile;
@@ -2113,36 +2935,128 @@ function runBuild(args) {
     }
     throw err;
   }
-  const platforms = args.platformArg !== void 0 ? [parsePlatform(args.platformArg)] : [...PLATFORMS];
-  const lang = parseLang(defaultsLang(args.pascorc, args.langArg));
+  const selectionPolicy = sanitizeSelectionPolicy(args.pascorc.selection);
+  const viewName = args.viewArg;
+  let viewRule;
+  if (viewName !== void 0) {
+    viewRule = selectionPolicy?.views?.[viewName] ?? selectionPolicy?.default;
+    if (viewRule === void 0) {
+      throw new ConfigError(
+        `unknown view "${viewName}" \u2014 declare it in .pascorc "selection.views" (D22/\xA721), or build the platform positionally: pasco build <platform>`
+      );
+    }
+  }
+  const positionalPlatform = args.platformArg !== void 0 ? parsePlatform(args.platformArg) : void 0;
+  let platform = positionalPlatform;
+  if (viewRule?.platform !== void 0) {
+    const declared = viewRule.platform;
+    if (!PLATFORMS.includes(declared)) {
+      throw new ConfigError(
+        `view "${viewName}" declares unknown platform "${declared}" (allowed: ${PLATFORMS.join(", ")})`
+      );
+    }
+    const viewPlatform = declared;
+    if (positionalPlatform !== void 0 && positionalPlatform !== viewPlatform) {
+      throw new ConfigError(
+        `view "${viewName}" targets "${viewPlatform}" but the command names "${positionalPlatform}" \u2014 drop one`
+      );
+    }
+    platform = viewPlatform;
+  }
+  if (viewName !== void 0 && platform === void 0) {
+    throw new ConfigError(
+      `view "${viewName}" declares no platform \u2014 add "platform" to its rule or name one: pasco build <platform> --view ${viewName}`
+    );
+  }
+  const platforms = platform !== void 0 ? [platform] : [...PLATFORMS];
+  const lang = parseLang(defaultsLang(args.pascorc, args.langArg ?? viewRule?.lang));
   const completenessPolicy = sanitizeCompletenessPolicy(args.pascorc.completeness);
+  const selection = selectionPolicy;
   const slices = platforms.map(
-    (p) => compile(profile, p, lang, completenessPolicy)
+    (p) => compile(profile, p, lang, {
+      ...completenessPolicy,
+      ...selection === void 0 ? {} : { selection, view: viewName ?? p }
+    })
   );
+  const selFindings = slices.flatMap(
+    (s) => (s.selection?.findings ?? []).map((f) => ({ platform: s.platform, ...f }))
+  );
+  const selErrors = selFindings.filter((f) => f.severity === "error");
+  if (selErrors.length > 0) {
+    return report("build", false, EXIT.FAIL, {
+      error: {
+        kind: "selection",
+        message: `${selErrors.length} selection error(s) \u2014 ${selErrors[0]?.message}`
+      },
+      data: { selection: selFindings }
+    });
+  }
   const bundle = collectMedia(profile, args.workspace);
   const written = [];
   const skipped = [];
+  const warnings = [];
+  const renderedVariants = /* @__PURE__ */ new Map();
   for (const s of slices) {
-    const renderer = RENDERERS[s.platform];
-    if (renderer === void 0) continue;
     if (s.platform === "github-org" && profile.flavor !== "brand") continue;
+    const variant = resolveVariantBody(args.workspace, s);
+    if (variant.warning !== void 0) {
+      warnings.push({ platform: s.platform, reason: variant.warning });
+    }
+    if (variant.text !== void 0 && variant.id !== void 0) {
+      const renderer2 = RENDERERS[s.platform];
+      const path2 = artifactPath(args.workspace, s.platform);
+      if (renderer2 !== void 0) {
+        rmSync(join6(args.workspace, "profiles", `${s.platform}.md`), { force: true });
+        rmSync(join6(args.workspace, "profiles", s.platform, "assets"), {
+          recursive: true,
+          force: true
+        });
+      }
+      mkdirSync(dirname2(path2), { recursive: true });
+      writeFileSync(path2, variant.text);
+      renderedVariants.set(s.platform, variant.id);
+      written.push({ platform: s.platform, path: path2, variant: variant.id });
+      continue;
+    }
+    const renderer = RENDERERS[s.platform];
+    if (renderer === void 0) {
+      const path2 = artifactPath(args.workspace, s.platform);
+      const text = pasteSource(s);
+      if (text === "") {
+        skipped.push({
+          platform: s.platform,
+          reason: "empty paste source \u2014 no bio row for this platform+lang; platform output removed"
+        });
+        rmSync(path2, { force: true });
+        continue;
+      }
+      mkdirSync(dirname2(path2), { recursive: true });
+      writeFileSync(path2, text);
+      written.push({ platform: s.platform, path: path2 });
+      continue;
+    }
+    rmSync(join6(args.workspace, "profiles", `${s.platform}.md`), { force: true });
     const result = renderer(s, bundle.assets);
-    const dir = join4(args.workspace, "profiles", s.platform);
+    const path = artifactPath(args.workspace, s.platform);
+    const dir = dirname2(path);
     if (result.text === "") {
       skipped.push({
         platform: s.platform,
         reason: "empty render \u2014 no bios row for this platform+lang; platform output removed"
       });
-      rmSync(dir, { recursive: true, force: true });
+      const variantsDir = join6(dir, "variants");
+      const keepVariants = existsSync5(variantsDir);
+      rmSync(join6(dir, "README.md"), { force: true });
+      rmSync(join6(dir, "assets"), { recursive: true, force: true });
+      if (!keepVariants) rmSync(dir, { recursive: true, force: true });
       continue;
     }
     mkdirSync(dir, { recursive: true });
-    const path = join4(dir, "README.md");
     writeFileSync(path, result.text);
     let bundled = 0;
     const referenced = result.assets ?? [];
     if (referenced.length > 0) {
-      const assetsDir = join4(dir, "assets");
+      const assetsDir = join6(dir, "assets");
       rmSync(assetsDir, { recursive: true, force: true });
       const byTarget = new Map(bundle.assets.map((a) => [a.target, a]));
       const copied = referenced.map((target) => {
@@ -2152,13 +3066,13 @@ function runBuild(args) {
             `renderer "${s.platform}" declared asset "${target}" without a bundle entry \u2014 renderers may only reference collectMedia() targets (M8 contract)`
           );
         }
-        const dest = join4(assetsDir, ...asset.target.split("/").slice(1));
+        const dest = join6(assetsDir, ...asset.target.split("/").slice(1));
         mkdirSync(dirname2(dest), { recursive: true });
         copyFileSync(asset.source, dest);
         return asset;
       });
       writeFileSync(
-        join4(assetsDir, "manifest.json"),
+        join6(assetsDir, "manifest.json"),
         `${JSON.stringify(mediaManifest(s.platform, s.lang, copied), null, 2)}
 `
       );
@@ -2184,7 +3098,9 @@ function runBuild(args) {
         })),
         written,
         skipped,
-        media: bundle.findings
+        warnings,
+        media: bundle.findings,
+        selection: selFindings
       }
     });
   }
@@ -2194,7 +3110,9 @@ function runBuild(args) {
 [${s.platform}]`);
     if (s.statement !== void 0) line(`  statement: ${s.statement}`);
     if (s.active !== void 0)
-      line(`  active: ${s.active.variantId} (chosen ${s.active.chosenAt})`);
+      line(
+        `  active: ${s.active.variantId} (chosen ${s.active.chosenAt})${renderedVariants.get(s.platform) !== void 0 ? " \u2014 rendered" : " \u2014 deterministic fallback"}`
+      );
     for (const b of s.bios) line(`  bio (${b.length}): ${b.text}`);
     for (const h of s.headlines) line(`  headline: ${h.text}`);
     if (s.bios.length === 0 && s.headlines.length === 0)
@@ -2204,21 +3122,64 @@ function runBuild(args) {
   if (written.length > 0) {
     section("deploy artifacts written");
     for (const w of written)
-      line(`  ${w.path}${w.assets !== void 0 ? ` (+${w.assets} asset(s) in assets/)` : ""}`);
+      line(
+        `  ${w.path}${w.assets !== void 0 ? ` (+${w.assets} asset(s) in assets/)` : ""}${w.variant !== void 0 ? ` (variant ${w.variant})` : ""}`
+      );
   }
   if (skipped.length > 0) {
     section(`empty renders removed (${skipped.length}) \u2014 pure profiles/ (\xA715.1)`);
     for (const k of skipped) line(`  [${k.platform}] ${k.reason}`);
   }
+  if (warnings.length > 0) {
+    section(`variant warnings (${warnings.length})`);
+    for (const w of warnings) line(`  [${w.platform}] ${w.reason}`);
+  }
   if (bundle.findings.length > 0) {
     section(`media pipeline (M8/\xA718.6): ${bundle.findings.length} finding(s)`);
     for (const f of bundle.findings) line(`  ${f.severity}: [${f.code}] ${f.message} (${f.path})`);
   }
+  if (selFindings.length > 0) {
+    section(`fact selection (D22/\xA721): ${selFindings.length} finding(s)`);
+    for (const f of selFindings) line(`  ${f.severity}: [${f.code}] [${f.platform}] ${f.message}`);
+  }
   return EXIT.OK;
 }
 
+// src/default-checks.ts
+import { parse } from "yaml";
+var DEFAULT_CHECKS_YAML = `# checks.yaml \u2014 conservative offline char caps (#240).
+# Every row carries its source, date and provenance tier in note; [?] means the
+# number is curated/third-party, not the platform's own documented limit.
+# The rule engine is offline: pasco check warns, it never fails (D12).
+- id: github-readme-headline-max
+  platform: github-readme
+  rule: max-chars
+  value: 280
+  surface: headline
+  note: "[?] editorial soft cap (skills/github-readme, SOTA-2026 \xA71, fetched 2026-10-05) \u2014 the README one-liner is read in ~30s."
+- id: kofi-bio-max
+  platform: kofi
+  rule: max-chars
+  value: 500
+  surface: bio
+  note: "[?] curated soft cap; Ko-fi documents no About limit (skills/kofi, SOTA-2026 \xA71, fetched 2026-10-05)."
+- id: hotmart-bio-max
+  platform: hotmart
+  rule: max-chars
+  value: 500
+  surface: bio
+  note: "[?] curated soft cap; Hotmart documents no profile-body limit (skills/hotmart, SOTA-2026 \xA76, fetched 2026-10-05)."
+- id: upwork-title-max
+  platform: upwork
+  rule: max-chars
+  value: 50
+  surface: headline
+  note: "[?] third-party guidance (snipework, 2026-03-08, https://snipework.com/blog/upwork-character-limits-2026) \u2014 confirm against Upwork's own docs before relying."
+`;
+var DEFAULT_CHECKS = parse(DEFAULT_CHECKS_YAML);
+
 // src/commands/check.ts
-var CHECK_OWNER = "M6: handle-matrix rules (brand, offline) executed; M7 (D17/\xA718.8): registry checks (credential-expiry, no-private-in-public-output) executed; M8 (\xA718.6): media-transport rules executed; remaining catalog ships with M3/M4 (SPEC \xA77)";
+var CHECK_OWNER = "M6: handle-matrix rules (brand, offline) executed; M7 (D17/\xA718.8): registry checks (credential-expiry, no-private-in-public-output) executed; M8 (\xA718.6): media-transport rules executed; limits: max-chars/min-chars over existing rows executed (offline); remaining catalog ships with M3/M4 (SPEC \xA77)";
 var HANDLE_CODES = /* @__PURE__ */ new Set([
   "drift/duplicate-handle",
   "drift/handle-claimed-not-linked",
@@ -2244,7 +3205,8 @@ function runCheck(args) {
     }
     throw err;
   }
-  const checks = profile.checks.filter(
+  const baseChecks = profile.checks.length > 0 ? profile.checks : DEFAULT_CHECKS;
+  const checks = baseChecks.filter(
     (c) => platform === void 0 || c.platform === "all" || c.platform === platform
   );
   const handleIssues = profile.flavor === "brand" ? driftCheck(profile).filter((i) => HANDLE_CODES.has(i.code)) : [];
@@ -2257,6 +3219,7 @@ function runCheck(args) {
   }));
   const registry = registryCheck(profile);
   const media = collectMedia(profile, args.workspace).findings;
+  const limits = limitFindings(profile, checks, platform);
   const failErrors = [...registry, ...media].filter((f) => f.severity === "error");
   if (isJsonMode()) {
     return report("check", failErrors.length === 0, failErrors.length === 0 ? EXIT.OK : EXIT.FAIL, {
@@ -2267,12 +3230,18 @@ function runCheck(args) {
         // Per-rule, machine-readable: handle rules exist for brand only (D15/§17),
         // registry rules run for every flavor (D17/§18.8). A single boolean would
         // overload two different facts.
-        implemented: { handleMatrix: profile.flavor === "brand", registry: true, media: true },
+        implemented: {
+          handleMatrix: profile.flavor === "brand",
+          registry: true,
+          media: true,
+          limits: true
+        },
         checks,
         handleMatrix,
         handleIssues,
         registry,
         media,
+        limits,
         ownedBy: CHECK_OWNER
       }
     });
@@ -2299,6 +3268,15 @@ function runCheck(args) {
   if (media.length === 0) {
     line("  media transport: OK (no findings)");
   }
+  section(
+    `text limits (max-chars/min-chars, offline)${platform !== void 0 ? ` for ${platform}` : ""}: ${limits.length} finding(s)`
+  );
+  for (const finding2 of limits) {
+    line(`  warn: [${finding2.code}] ${finding2.message} (${finding2.path})`);
+  }
+  if (limits.length === 0) {
+    line("  text limits: OK (no findings)");
+  }
   if (profile.flavor === "brand") {
     section("handle matrix (brand, \xA717)");
     if (profile.socialHandles.length === 0) {
@@ -2329,12 +3307,13 @@ function runCheck(args) {
   );
   for (const c of checks) {
     const note = c.note !== void 0 ? ` note="${c.note}"` : "";
+    const executed = c.rule === "max-chars" || c.rule === "min-chars";
     line(
-      `  [${c.id ?? "?"}] platform=${c.platform} rule=${c.rule} value=${JSON.stringify(c.value)}${note}`
+      `  [${c.id ?? "?"}] platform=${c.platform} rule=${c.rule} value=${JSON.stringify(c.value)}${note} \u2014 ${executed ? "executed" : "not executed"}`
     );
   }
   line(
-    "  not executed \u2014 rule execution ships with the skills checks.yaml union (M3) and pasco check (M4)"
+    "  max-chars/min-chars executed above; the remaining rules ship with the skills checks.yaml union (M3) and pasco check (M4)"
   );
   line(`  owner: ${CHECK_OWNER}`);
   return failErrors.length === 0 ? EXIT.OK : EXIT.FAIL;
@@ -2403,8 +3382,8 @@ function runDiff(args) {
   }
   const headSha = head.out.trim();
   const commits = lines(git(root, ["log", "--format=%H%x1f%s", `${base}..HEAD`])).map((entry) => {
-    const sep = entry.indexOf("");
-    return sep === -1 ? { hash: entry, subject: "" } : { hash: entry.slice(0, sep), subject: entry.slice(sep + 1) };
+    const sep2 = entry.indexOf("");
+    return sep2 === -1 ? { hash: entry, subject: "" } : { hash: entry.slice(0, sep2), subject: entry.slice(sep2 + 1) };
   });
   const rootReal = realpathSync2(root);
   const wsReal = realpathSync2(args.workspace);
@@ -2459,8 +3438,8 @@ function runDiff(args) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join5, resolve as resolve3 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join7, resolve as resolve3 } from "path";
 var FLAVOR_BRAND_TEMPLATE = `# ${WORKSPACE_NAME} brand workspace \u2014 content/ flavor (D15/\xA717)
 # The file value IS the root value: a bare scalar (file name = root property).
 brand
@@ -2550,8 +3529,14 @@ private by default and never leaves your control (D14: integration by configured
 
 ## Files
 
-- \`content/*.yaml\` \u2014 the profile (file name = root property, see schema/README.md)
-- \`profiles/\` \u2014 generated outputs (created by renderers; committed: they ARE the deploy artifacts)
+Three top-level directories, three grains \u2014 nothing nests one inside another:
+\`content/\` is identity, \`profiles/\` is generated output (its \`variants/\` subdir is input),
+\`posts/\` is the stream.
+
+- \`content/*.yaml\` \u2014 identity facts, the SSOT (file name = root property, see schema/README.md)
+- \`profiles/\` \u2014 generated outputs (created by pasco build; committed: they ARE the deploy artifacts)
+- \`profiles/<platform>/variants/\` \u2014 chosen variant bodies (INPUT, #238; preserved by build)
+- \`posts/\` \u2014 the stream, created by \`pasco post\` (#264): seeds + per-channel projections; never identity facts
 - \`.pascorc\` \u2014 workspace config (defaults)
 
 ## Workflow
@@ -2573,8 +3558,14 @@ checks drift and renders brand surfaces. Private by default (D14: configured pat
 
 ## Files
 
-- \`content/*.yaml\` \u2014 the brand profile (file name = root property, see schema/README.md)
-- \`profiles/\` \u2014 generated outputs (github-org README is the first deploy artifact)
+Three top-level directories, three grains \u2014 nothing nests one inside another:
+\`content/\` is identity, \`profiles/\` is generated output (its \`variants/\` subdir is input),
+\`posts/\` is the stream.
+
+- \`content/*.yaml\` \u2014 the brand profile, identity facts (file name = root property, see schema/README.md)
+- \`profiles/\` \u2014 generated outputs (github-org README is the first deploy artifact; pasco build also writes manual-paste files)
+- \`profiles/<platform>/variants/\` \u2014 chosen variant bodies (INPUT, #238; preserved by build)
+- \`posts/\` \u2014 the stream, created by \`pasco post\` (#264): seeds + per-channel projections; never identity facts
 - \`.pascorc\` \u2014 workspace config (defaults)
 
 ## Workflow
@@ -2604,21 +3595,21 @@ var BRAND_FILES = {
 };
 function runInit(args) {
   const dir = resolve3(args.cwd, args.dir ?? ".");
-  const contentDir = join5(dir, "content");
+  const contentDir = join7(dir, "content");
   const brand = args.flavor === "brand";
-  if (existsSync4(contentDir)) {
+  if (existsSync6(contentDir)) {
     return report("init", false, EXIT.FAIL, {
       error: { kind: "exists", message: `refusing to scaffold: ${contentDir} already exists` }
     });
   }
-  const files = brand ? BRAND_FILES : { "identity.yaml": IDENTITY_TEMPLATE };
+  const files = brand ? { ...BRAND_FILES, "checks.yaml": DEFAULT_CHECKS_YAML } : { "identity.yaml": IDENTITY_TEMPLATE, "checks.yaml": DEFAULT_CHECKS_YAML };
   const targets = [
-    ...Object.entries(files).map(([name, content]) => ({ path: join5(contentDir, name), content })),
-    { path: join5(dir, "README.md"), content: brand ? BRAND_README_TEMPLATE : README_TEMPLATE },
-    { path: join5(dir, ".pascorc"), content: PASCORC_TEMPLATE }
+    ...Object.entries(files).map(([name, content]) => ({ path: join7(contentDir, name), content })),
+    { path: join7(dir, "README.md"), content: brand ? BRAND_README_TEMPLATE : README_TEMPLATE },
+    { path: join7(dir, ".pascorc"), content: PASCORC_TEMPLATE }
   ];
   for (const t of targets) {
-    if (existsSync4(t.path)) {
+    if (existsSync6(t.path)) {
       return report("init", false, EXIT.FAIL, {
         error: { kind: "exists", message: `refusing to overwrite existing file: ${t.path}` }
       });
@@ -2640,26 +3631,228 @@ function runInit(args) {
   });
 }
 
-// src/commands/refine.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3, join as join6 } from "path";
-import { fileURLToPath } from "url";
+// src/commands/post.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync7, statSync as statSync5, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join10 } from "path";
+import { parseDocument as parseDocument3 } from "yaml";
+
+// src/post-store.ts
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
 import { parseDocument as parseDocument2, stringify } from "yaml";
-var REFINE_OWNER = "M3 SOTA research per platform \u2192 skills v1 + the full refine flow (SPEC \xA712/\xA716 M3); model-agnostic (D10/D11/D13)";
-function platformSkillPath(platform) {
+var SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function isSafeSeedId(id) {
+  return SAFE_ID.test(id) && !id.includes("..");
+}
+function postsDir(workspace) {
+  return join8(workspace, "posts");
+}
+function seedDir(workspace, id) {
+  if (!isSafeSeedId(id)) throw new Error(`unsafe seed id ${JSON.stringify(id)}`);
+  return join8(postsDir(workspace), id);
+}
+function seedPath(workspace, id) {
+  return join8(seedDir(workspace, id), "seed.md");
+}
+function ledgerPath(workspace, id) {
+  return join8(seedDir(workspace, id), "post.yaml");
+}
+function variantPath(workspace, id, channel, variant) {
+  if (!SAFE_ID.test(variant) || variant.includes("..")) {
+    throw new Error(`unsafe variant id ${JSON.stringify(variant)}`);
+  }
+  return join8(seedDir(workspace, id), channel, `${variant}.md`);
+}
+function hashText(text) {
+  return createHash3("sha256").update(text).digest("hex");
+}
+function defaultLedger(id, source) {
+  return {
+    id,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source,
+    seed: "seed.md",
+    status: "draft",
+    channels: {}
+  };
+}
+function readLedger(workspace, id) {
+  const path = ledgerPath(workspace, id);
+  if (!existsSync7(path)) throw new Error(`no post ledger at ${path}`);
+  const doc = parseDocument2(readFileSync6(path, "utf8"));
+  if (doc.errors.length > 0) {
+    throw new Error(`${path}: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`);
+  }
+  const raw = doc.toJS({ maxAliasCount: 100 });
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`${path} must contain a mapping`);
+  }
+  const obj = raw;
+  const channelsRaw = obj.channels;
+  const channels = channelsRaw !== null && typeof channelsRaw === "object" && !Array.isArray(channelsRaw) ? channelsRaw : {};
+  return {
+    id: typeof obj.id === "string" ? obj.id : id,
+    createdAt: typeof obj.createdAt === "string" ? obj.createdAt : (/* @__PURE__ */ new Date()).toISOString(),
+    source: obj.source === "imported" ? "imported" : "authored",
+    seed: typeof obj.seed === "string" ? obj.seed : "seed.md",
+    status: obj.status === "published" || obj.status === "archived" ? obj.status : "draft",
+    channels
+  };
+}
+function writeLedger(workspace, ledger) {
+  const dir = seedDir(workspace, ledger.id);
+  mkdirSync3(dir, { recursive: true });
+  writeFileSync3(ledgerPath(workspace, ledger.id), stringify(ledger));
+}
+function seedText(workspace, id) {
+  const path = seedPath(workspace, id);
+  if (!existsSync7(path)) throw new Error(`no seed at ${path}`);
+  return readFileSync6(path, "utf8");
+}
+function createSeed(workspace, id, text, source = "authored") {
+  if (!isSafeSeedId(id)) throw new Error(`unsafe seed id ${JSON.stringify(id)}`);
+  const dir = seedDir(workspace, id);
+  mkdirSync3(dir, { recursive: true });
+  const seed = seedPath(workspace, id);
+  if (!existsSync7(seed)) writeFileSync3(seed, text);
+  const ledgerFile = ledgerPath(workspace, id);
+  if (existsSync7(ledgerFile)) return readLedger(workspace, id);
+  const ledger = defaultLedger(id, source);
+  writeLedger(workspace, ledger);
+  return ledger;
+}
+function listSeedIds(workspace) {
+  const dir = postsDir(workspace);
+  if (!existsSync7(dir)) return [];
+  return readdirSync3(dir).filter((name) => {
+    try {
+      return statSync3(join8(dir, name)).isDirectory() && isSafeSeedId(name);
+    } catch {
+      return false;
+    }
+  }).sort();
+}
+function chooseVariant(workspace, id, channel, variant, publishedText) {
+  const path = variantPath(workspace, id, channel, variant);
+  if (!existsSync7(path)) throw new Error(`no variant body at ${path}`);
+  const text = readFileSync6(path, "utf8");
+  if (text.trim() === "") throw new Error(`variant body is empty at ${path}`);
+  const ledger = readLedger(workspace, id);
+  const templateHash = hashText(text);
+  const contentHash = hashText(publishedText ?? text);
+  const chosenAt = (/* @__PURE__ */ new Date()).toISOString();
+  ledger.channels[channel] = {
+    ...ledger.channels[channel] ?? {},
+    chosen: variant,
+    chosenAt,
+    contentHash,
+    templateHash,
+    sync: "local-only",
+    certification: "unverifiable"
+  };
+  ledger.status = "draft";
+  writeLedger(workspace, ledger);
+  return { ledger, path, contentHash, templateHash };
+}
+function chosenVariant(workspace, ledger, channel) {
+  const chosen = ledger.channels[channel]?.chosen;
+  if (chosen === void 0) return void 0;
+  const path = variantPath(workspace, ledger.id, channel, chosen);
+  if (!existsSync7(path)) return void 0;
+  const text = readFileSync6(path, "utf8");
+  return { variant: chosen, text, path };
+}
+
+// src/skill-path.ts
+import { existsSync as existsSync8, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { dirname as dirname3, join as join9 } from "path";
+import { fileURLToPath } from "url";
+function skillsDir() {
+  const override = process.env.PASCO_SKILLS_DIR;
+  if (override !== void 0 && override !== "" && isDirectory(override)) return override;
   const here = dirname3(fileURLToPath(import.meta.url));
-  const candidates = [
-    join6(here, "..", "..", "..", "..", "skills", platform, "SKILL.md")
-    // repo dev
-  ];
-  return candidates.find((p) => existsSync5(p));
+  const pkgDir = join9(here, "..");
+  const shipped = join9(pkgDir, "skills");
+  if (isDirectory(shipped)) return shipped;
+  const repoRoot = join9(pkgDir, "..", "..");
+  if (existsSync8(join9(repoRoot, "pnpm-workspace.yaml")) && isDirectory(join9(repoRoot, "skills"))) {
+    return join9(repoRoot, "skills");
+  }
+  return void 0;
+}
+function isDirectory(path) {
+  return existsSync8(path) && statSync4(path).isDirectory();
+}
+function listChannels(root) {
+  return readdirSync4(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+}
+function listSkills(root, file = "SKILL.md") {
+  return listChannels(root).filter((channel) => existsSync8(join9(root, channel, file)));
+}
+function skillFile(channel, file) {
+  const root = skillsDir();
+  if (root === void 0) return void 0;
+  const path = join9(root, channel, file);
+  return existsSync8(path) ? path : void 0;
+}
+var NOT_SHIPPED_MESSAGE = "skills not shipped with this package \u2014 this build carries no skills/; report it at https://github.com/ChristianLuciani/profile-as-code/issues";
+function lookupSkill(channel, file = "SKILL.md") {
+  const root = skillsDir();
+  if (root === void 0) return { state: "not-shipped" };
+  const path = join9(root, channel, file);
+  if (existsSync8(path)) return { state: "found", path, root };
+  return { state: "no-skill", channel, root, shipped: listSkills(root, file) };
+}
+function skillLine(lookup) {
+  if (lookup.state === "found") return lookup.path;
+  if (lookup.state === "not-shipped") return NOT_SHIPPED_MESSAGE;
+  const shipped = lookup.shipped.length > 0 ? `this package ships: ${lookup.shipped.join(", ")}` : "this package ships no platform skills";
+  return `no skill for ${lookup.channel} yet \u2014 ${shipped}; fall back to the deterministic renderer output (the platform's limits are not encoded yet)`;
+}
+
+// src/commands/post.ts
+function postSkillPath(channel) {
+  return skillFile(channel, "post.md");
+}
+function postingPath(channel) {
+  return skillFile(channel, "posting.yaml");
+}
+function readPosting(channel) {
+  const path = postingPath(channel);
+  if (path === void 0) {
+    throw new UsageError(
+      skillsDir() === void 0 ? NOT_SHIPPED_MESSAGE : `no post skill for "${channel}" \u2014 expected skills/${channel}/posting.yaml + post.md`
+    );
+  }
+  const doc = parseDocument3(readFileSync7(path, "utf8"));
+  if (doc.errors.length > 0) {
+    throw new UsageError(`${path}: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`);
+  }
+  const raw = doc.toJS({ maxAliasCount: 100 });
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new UsageError(`${path} must contain a mapping`);
+  }
+  const rules = raw;
+  if (rules.platform !== void 0 && rules.platform !== channel) {
+    throw new UsageError(
+      `${path}: platform "${rules.platform}" does not match channel "${channel}"`
+    );
+  }
+  const type = rules.settings?.__type;
+  if (type !== void 0 && String(type) !== channel) {
+    throw new UsageError(
+      `${path}: settings.__type "${String(type)}" does not match channel "${channel}"`
+    );
+  }
+  return rules;
 }
 function loadProfile(workspace) {
   try {
     return load(workspace);
   } catch (err) {
     if (err instanceof SchemaValidationError) {
-      return report("refine", false, EXIT.FAIL, {
+      return report("post", false, EXIT.FAIL, {
         error: {
           kind: "schema",
           message: `schema validation failed (D12 fail-on-schema) \u2014 ${err.issues.length} violation(s)`,
@@ -2668,156 +3861,1175 @@ function loadProfile(workspace) {
       });
     }
     if (err instanceof LoadError) {
-      return report("refine", false, EXIT.FAIL, { error: { kind: "load", message: err.message } });
+      return report("post", false, EXIT.FAIL, { error: { kind: "load", message: err.message } });
     }
     throw err;
   }
 }
-function recordVariant(workspace, platform, lang, variantId) {
-  const activePath = join6(workspace, "content", "active.yaml");
-  let active = {};
-  if (existsSync5(activePath)) {
-    const doc = parseDocument2(readFileSync4(activePath, "utf8"));
-    if (doc.errors.length > 0) {
-      throw new Error(
-        `content/active.yaml: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`
-      );
-    }
-    const node = doc.toJS({ maxAliasCount: 100 });
-    if (node !== null && node !== void 0) {
-      if (typeof node !== "object" || Array.isArray(node)) {
-        throw new Error("content/active.yaml must contain a mapping (platform \u2192 variant entry)");
+function splitChannels(value) {
+  if (value === void 0 || value.trim() === "") {
+    throw new UsageError("--channel is required (comma-separated, e.g. linkedin,x)");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of value.split(",")) {
+    const name = raw.trim();
+    if (name === "" || seen.has(name)) continue;
+    seen.add(name);
+    out.push(parsePlatform(name));
+  }
+  if (out.length === 0) throw new UsageError("--channel is required (comma-separated)");
+  return out;
+}
+function resolveFact(profile, pointer) {
+  const segments = pointer.split(".");
+  let current = profile;
+  for (const segment of segments) {
+    const match = /^([A-Za-z0-9_]+)(?:\[([^\]]+)\])?$/.exec(segment);
+    if (match === null) return void 0;
+    const key = match[1] ?? "";
+    const selector = match[2];
+    if (current === null || typeof current !== "object") return void 0;
+    current = current[key];
+    if (selector !== void 0) {
+      if (Array.isArray(current)) {
+        const index = Number(selector);
+        current = Number.isInteger(index) ? current[index] : current.find(
+          (item) => item !== null && typeof item === "object" && item.id === selector
+        );
+      } else if (current !== null && typeof current === "object") {
+        current = current[selector];
+      } else {
+        return void 0;
       }
-      active = node;
     }
   }
-  const chosenAt = (/* @__PURE__ */ new Date()).toISOString();
-  active[platform] = { lang, variantId, chosenAt };
-  writeFileSync3(activePath, stringify(active));
-  return { chosenAt };
+  if (typeof current === "string") return current;
+  if (typeof current === "number" || typeof current === "boolean") return String(current);
+  return void 0;
 }
-function runRefine(args) {
-  if (args.platformArg === void 0) {
-    throw new UsageError(
-      "usage: pasco refine <platform> [--lang <l>] [--variants N] [--choose <variantId>]"
-    );
+function renderFacts(text, profile) {
+  const dangling = [];
+  const rendered = text.replace(/\{\{fact:([^}]+)\}\}/g, (_whole, pointer) => {
+    const value = resolveFact(profile, pointer.trim());
+    if (value === void 0) {
+      dangling.push(pointer.trim());
+      return `{{fact:${pointer}}}`;
+    }
+    return value;
+  });
+  return { text: rendered, dangling };
+}
+function allowedUrls(profile) {
+  const urls = /* @__PURE__ */ new Set();
+  const add = (value) => {
+    if (value !== void 0 && value !== "") urls.add(value);
+  };
+  for (const link of profile.identity.links ?? []) add(link.url);
+  for (const project of profile.projects) for (const url of project.links ?? []) add(url);
+  for (const publication of profile.publications) add(publication.url);
+  for (const press of profile.press ?? []) add(press.url);
+  for (const credential of profile.credentials ?? []) add(credential.verifyUrl);
+  for (const artifact of profile.artifacts ?? []) add(artifact.locator?.url);
+  return urls;
+}
+function factLines(profile) {
+  const lines2 = [];
+  lines2.push(`identity.name = ${profile.identity.name}`);
+  if (profile.identity.location !== void 0) {
+    lines2.push(`identity.location = ${profile.identity.location}`);
+  }
+  (profile.identity.links ?? []).forEach((link, index) => {
+    lines2.push(`identity.links[${index}].url = ${link.url}`);
+  });
+  profile.projects.forEach((project, index) => {
+    const selector = project.id ?? String(index);
+    lines2.push(`projects[${selector}].name = ${project.name}`);
+    if (project.status !== void 0) {
+      lines2.push(`projects[${selector}].status = ${project.status}`);
+    }
+    (project.links ?? []).forEach((url, linkIndex) => {
+      lines2.push(`projects[${selector}].links[${linkIndex}] = ${url}`);
+    });
+  });
+  profile.experience.forEach((item, index) => {
+    const selector = item.id ?? String(index);
+    lines2.push(`experience[${selector}].role = ${item.role}`);
+    lines2.push(`experience[${selector}].org = ${item.org}`);
+    lines2.push(`experience[${selector}].start = ${item.start}`);
+    if (item.end !== void 0) lines2.push(`experience[${selector}].end = ${item.end}`);
+  });
+  profile.publications.forEach((publication, index) => {
+    const selector = publication.id ?? String(index);
+    lines2.push(`publications[${selector}].title = ${publication.title}`);
+    if (publication.doi !== void 0) {
+      lines2.push(`publications[${selector}].doi = ${publication.doi}`);
+    }
+    if (publication.url !== void 0) {
+      lines2.push(`publications[${selector}].url = ${publication.url}`);
+    }
+  });
+  (profile.press ?? []).forEach((item, index) => {
+    if (item.url !== void 0) lines2.push(`press[${index}].url = ${item.url}`);
+  });
+  for (const credential of profile.credentials ?? []) {
+    if (credential.id === void 0) continue;
+    lines2.push(`credentials[${credential.id}].title = ${credential.title}`);
+    if (credential.verifyUrl !== void 0) {
+      lines2.push(`credentials[${credential.id}].verifyUrl = ${credential.verifyUrl}`);
+    }
   }
-  const platform = parsePlatform(args.platformArg);
-  const lang = parseLang(defaultsLang(args.pascorc, args.langArg));
-  const variants = parseVariants(args.variantsArg, args.pascorc.defaults?.variants ?? 3);
-  const loaded = loadProfile(args.workspace);
-  if (typeof loaded === "number") return loaded;
-  const profile = loaded;
-  if (args.choose !== void 0) {
-    let chosenAt;
-    try {
-      chosenAt = recordVariant(args.workspace, platform, lang, args.choose).chosenAt;
-    } catch (err) {
-      return report("refine", false, EXIT.FAIL, {
-        error: { kind: "load", message: err.message }
+  for (const artifact of profile.artifacts ?? []) {
+    if (artifact.id === void 0) continue;
+    lines2.push(`artifacts[${artifact.id}].title = ${artifact.title}`);
+    if (artifact.locator?.url !== void 0) {
+      lines2.push(`artifacts[${artifact.id}].locator.url = ${artifact.locator.url}`);
+    }
+  }
+  return lines2;
+}
+function urlCandidates(text) {
+  const out = /* @__PURE__ */ new Set();
+  const pattern = /\b(?:https?:\/\/|www\.)[^\s)\]]+|\b[a-z0-9-]+(?:\.[a-z0-9-]+)+\/[^\s)\]]*/gi;
+  for (const match of text.matchAll(pattern)) {
+    let raw = (match[0] ?? "").replace(/[.,;:!?]+$/, "");
+    if (raw === "") continue;
+    if (!/^https?:\/\//i.test(raw)) raw = `https://${raw}`;
+    out.add(raw.replace(/^https?:\/\//i, (scheme) => scheme.toLowerCase()));
+  }
+  return [...out];
+}
+function checkText(text, rules, profile) {
+  const findings = [];
+  const content = text.trim();
+  const max = rules.limits?.maxChars;
+  const min = rules.limits?.minChars;
+  if (max !== void 0 && content.length > max) {
+    findings.push({
+      code: "max-chars",
+      severity: "error",
+      message: `post is ${content.length} chars; ${rules.platform ?? "channel"} allows ${max}`
+    });
+  }
+  if (min !== void 0 && content.length < min) {
+    findings.push({
+      code: "min-chars",
+      severity: "error",
+      message: `post is ${content.length} chars; ${rules.platform ?? "channel"} requires at least ${min}`
+    });
+  }
+  const allowed = allowedUrls(profile);
+  for (const url of urlCandidates(content)) {
+    if (!allowed.has(url)) {
+      findings.push({
+        code: "url-not-in-ssot",
+        severity: "error",
+        message: `${url} is not in the profile URL SSOT (identity.links / projects / publications / credentials / artifacts)`
       });
     }
-    if (isJsonMode()) {
-      return report("refine", true, EXIT.OK, {
-        data: {
-          mode: "recorded",
-          platform,
-          lang,
-          variantId: args.choose,
-          chosenAt,
-          workspace: args.workspace
-        }
+  }
+  const maxTags = rules.hashtags?.max;
+  if (maxTags !== void 0) {
+    const tags = content.match(/(^|\s)#[A-Za-z0-9_]+/g) ?? [];
+    if (tags.length > maxTags) {
+      findings.push({
+        code: "hashtags",
+        severity: "warn",
+        message: `${tags.length} hashtags; the ${rules.platform ?? "channel"} skill recommends at most ${maxTags}`
       });
     }
-    line(
-      `recorded active[${platform}] = { lang: ${lang}, variantId: ${args.choose}, chosenAt: ${chosenAt} } (content/active.yaml)`
-    );
-    return EXIT.OK;
   }
-  const slice = compile(profile, platform, lang);
-  const identity = slice.identity;
-  const links = (identity.links ?? []).map((l) => `${l.platform ?? "?"}:${l.url}`).join(", ");
-  const experience = slice.experience.map((e) => `${e.role} @ ${e.org} (${e.start}\u2013${e.end ?? "present"})`).join(" | ");
-  const projects = slice.projects.map((p) => p.name).join(", ");
-  const publications = slice.publications.map((p) => p.title).join(" | ");
-  const anchors = slice.keywords.geo.associations?.join(", ") ?? "";
-  const skillPath = platformSkillPath(platform);
-  const template = [
-    `# pasco refine \u2014 agent task (agent-driven: D10/D11/D13; no LLM call, no hub)`,
-    `Write ${variants} variant(s) of the ${platform} profile in ${lang} \u2014 in PROSE, per the platform skill.`,
+  for (const rawLine of content.split("\n")) {
+    const lineText = rawLine.trim();
+    if (lineText === "" || lineText.includes("{{fact:") || lineText.includes("evidence:")) continue;
+    if (/\d/.test(lineText) && /[%$]|\b\d{2,}\b/.test(lineText)) {
+      findings.push({
+        code: "unsourced-claim",
+        severity: "warn",
+        message: `numeric claim without a {{fact:...}} or evidence: marker \u2014 "${lineText.slice(0, 80)}"`
+      });
+    }
+  }
+  return findings;
+}
+function buildTask(args) {
+  const { seedId, channel, seed, profile, rules, skill, variants, lang } = args;
+  const facts = factLines(profile).join("\n  ");
+  const structure = (rules.structure ?? []).join(" \u2192 ") || "\u2014";
+  const sources = (rules.sources ?? []).map((source) => `${source.url ?? "\u2014"} (${source.date ?? "\u2014"})`).join("; ");
+  return [
+    `# pasco post task \u2014 ${seedId} / ${channel}`,
     ``,
-    `Platform: ${platform}`,
-    `Language: ${lang}`,
-    `Skill (communicative strategy \u2014 READ IT FIRST): ${skillPath ?? "(not installed \u2014 fall back to the deterministic renderer output)"}`,
-    `Research (dated sources): ${skillPath === void 0 ? "\u2014" : skillPath.replace(/SKILL\.md$/, "research/SOTA-2026.md")}`,
-    `Variant id convention: ${platform.replace(/[^a-z]/g, "")}-${lang}-<n> (e.g. gh-en-1, gh-en-2, gh-en-3).`,
+    `Write ${variants} variant(s) of a ${channel} POST in ${lang}. You are the agent:`,
+    `the CLI never calls an LLM. Read the skill FIRST:`,
+    `  ${skill ?? `(missing skills/${channel}/post.md)`}`,
     ``,
-    `Facts (language-independent \u2014 MUST stay byte-identical across variants and platforms):`,
-    `  name: ${identity.name}`,
-    `  location: ${identity.location ?? "\u2014"}`,
-    `  links: ${links || "\u2014"}`,
-    `  experience: ${experience || "\u2014"}`,
-    `  projects: ${projects || "\u2014"}`,
-    `  publications: ${publications || "\u2014"}`,
+    `Seed (canonical \u2014 do not rewrite its meaning):`,
+    seed.trim(),
     ``,
-    `Existing ${platform} texts (base to vary):`,
-    `  bios: ${slice.bios.map((b) => `[${b.length}] ${b.text}`).join(" | ") || "\u2014"}`,
-    `  headlines: ${slice.headlines.map((h) => h.text).join(" | ") || "\u2014"}`,
-    `  active variant: ${slice.active?.variantId ?? "\u2014"}`,
+    `Facts (byte-identical; cite with {{fact:<pointer>}}):`,
+    `  ${facts}`,
     ``,
-    `GEO anchors to reinforce (semantic associations): ${anchors || "\u2014"}`,
+    `Channel rules (from skills/${channel}/posting.yaml):`,
+    `  maxChars: ${rules.limits?.maxChars ?? "\u2014"}`,
+    `  settings: ${JSON.stringify(rules.settings ?? {})}`,
+    `  links: ${rules.links?.policy ?? "identity-ssot-only"}`,
+    `  hashtags (max): ${rules.hashtags?.max ?? "\u2014"}`,
+    `  structure: ${structure}`,
+    `  sources: ${sources || "\u2014"}`,
     ``,
-    `Constraints:`,
-    `  - Facts never change (D4) \u2014 only storytelling/angles vary.`,
-    `  - Every text langMap must include 'en' (contract requirement) and the requested lang.`,
-    `  - Never invent URLs, DOIs or numbers \u2014 evidence claims stay untouched.`,
-    `  - Platform-specific limits come from the platform skill (SPEC \xA716) + checks.yaml.`,
+    `Output: save each variant as ONE text block at`,
+    `  posts/${seedId}/${channel}/${channel}-<n>.md`,
+    `Then record the choice:`,
+    `  pasco post choose ${seedId} --channel ${channel} --variant ${channel}-<n>`,
     ``,
-    `Workflow: read the skill \u2192 produce the ${variants} variant(s) \u2192 the user picks one \u2192 record it:`,
-    `  pasco refine ${platform} --lang ${lang} --choose <variantId>`,
+    `Constraints:`,
+    `  - Facts never change (D4). Quote them as {{fact:<pointer>}}; do not paraphrase a number, date or URL.`,
+    `  - Links only from identity.links / projects[].links / publications[].url /`,
+    `    credentials[].verifyUrl / artifacts[].locator.url \u2014 the SSOT is the only URL source.`,
+    `  - Never invent URLs, DOIs or numbers.`,
+    `  - Keep the channel's native shape; the skill is the strategy, not the template.`,
     ``
   ].join("\n");
+}
+function readPostizConfig(workspace) {
+  const path = join10(workspace, "postiz.yaml");
+  if (!existsSync9(path)) return {};
+  const doc = parseDocument3(readFileSync7(path, "utf8"));
+  if (doc.errors.length > 0) {
+    throw new UsageError(`${path}: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`);
+  }
+  const raw = doc.toJS({ maxAliasCount: 100 });
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const channels = raw.channels;
+  if (channels === null || typeof channels !== "object" || Array.isArray(channels)) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(channels)) {
+    if (typeof value === "string" && value !== "") out[key] = value;
+  }
+  return out;
+}
+function buildPostizPayload(args) {
+  const integrationIds = readPostizConfig(args.workspace);
+  const posts = [];
+  for (const [channel, state] of Object.entries(args.ledger.channels)) {
+    if (state.chosen === void 0) continue;
+    const chosen = chosenVariant(args.workspace, args.ledger, channel);
+    if (chosen === void 0) {
+      throw new Error(
+        `channel ${channel}: chosen variant "${state.chosen}" has no body at ${variantPath(
+          args.workspace,
+          args.ledger.id,
+          channel,
+          state.chosen
+        )}`
+      );
+    }
+    const rendered = renderFacts(chosen.text, args.profile);
+    if (rendered.dangling.length > 0) {
+      throw new Error(`channel ${channel}: dangling fact ref(s): ${rendered.dangling.join(", ")}`);
+    }
+    const rules = readPosting(channel);
+    const settings = {
+      ...rules.settings ?? {},
+      __type: rules.settings?.__type ?? channel
+    };
+    posts.push({
+      integration: { id: integrationIds[channel] ?? "REPLACE_ME" },
+      value: [{ content: rendered.text.trim(), image: [] }],
+      settings
+    });
+  }
+  return {
+    type: args.type,
+    date: args.date,
+    shortLink: false,
+    tags: [],
+    posts
+  };
+}
+function requireSeed(args) {
+  if (args.seedArg === void 0 || args.seedArg === "") {
+    throw new UsageError("a <seed-id> is required");
+  }
+  if (!isSafeSeedId(args.seedArg)) {
+    throw new UsageError(
+      "seed id must be a safe path segment (letters, digits, dot, underscore, dash)"
+    );
+  }
+  return args.seedArg;
+}
+function handleSeed(args) {
+  const seedId = requireSeed(args);
+  if (args.textArg === void 0) {
+    throw new UsageError("usage: pasco post seed <seed-id> --text <file>");
+  }
+  if (!existsSync9(args.textArg)) {
+    throw new UsageError(`seed file not found: ${args.textArg}`);
+  }
+  const text = readFileSync7(args.textArg, "utf8");
+  if (text.trim() === "") throw new UsageError("seed text is empty");
+  if (existsSync9(seedPath(args.workspace, seedId))) {
+    throw new UsageError(
+      `seed ${seedId} already exists at ${seedPath(args.workspace, seedId)}; edit it directly`
+    );
+  }
+  const ledger = createSeed(args.workspace, seedId, text);
   if (isJsonMode()) {
-    return report("refine", true, EXIT.OK, {
-      data: { mode: "template", platform, lang, variants, template, ownedBy: REFINE_OWNER }
+    return report("post", true, EXIT.OK, {
+      data: { mode: "seed", seedId, seedPath: seedPath(args.workspace, seedId), ledger }
     });
   }
-  process.stdout.write(template);
+  line(`seeded ${seedId} at ${seedPath(args.workspace, seedId)}`);
   return EXIT.OK;
 }
-
-// src/commands/skills-install.ts
-var SKILLS_OWNER = "M3 SOTA research per platform \u2192 skills v1 authored in skills-studio, projected via AGOS bin/project.sh";
-var AGENTS = ["pi", "claude", "aionui", "opencode"];
-function runSkillsInstall(args) {
-  if (args.agent === void 0) {
-    throw new UsageError(`usage: pasco skills:install <agent> (${AGENTS.join(" | ")})`);
+function handleTask(args) {
+  const seedId = requireSeed(args);
+  const channels = splitChannels(args.channelArg);
+  const variants = parseVariants(args.variantsArg, args.pascorc.defaults?.variants ?? 3);
+  const lang = parseLang(defaultsLang(args.pascorc));
+  const seed = seedText(args.workspace, seedId);
+  const loaded = loadProfile(args.workspace);
+  if (typeof loaded === "number") return loaded;
+  const profile = loaded;
+  if (!existsSync9(ledgerPath(args.workspace, seedId))) {
+    createSeed(args.workspace, seedId, seed);
+  }
+  const results = [];
+  for (const channel of channels) {
+    const rules = readPosting(channel);
+    const skill = postSkillPath(channel);
+    const task = buildTask({
+      seedId,
+      channel,
+      seed,
+      profile,
+      rules,
+      skill,
+      variants,
+      lang
+    });
+    const taskPath = join10(seedDir(args.workspace, seedId), channel, "task.md");
+    mkdirSync4(dirname4(taskPath), { recursive: true });
+    writeFileSync4(taskPath, task);
+    results.push({ channel, taskPath, skill, maxChars: rules.limits?.maxChars });
+    line(`task: ${taskPath}`);
+    line(`  skill: ${skill ?? "(missing)"}`);
+    line(`  maxChars: ${rules.limits?.maxChars ?? "\u2014"}`);
+  }
+  if (isJsonMode()) {
+    return report("post", true, EXIT.OK, {
+      data: { mode: "task", seedId, lang, variants, channels: results }
+    });
+  }
+  return EXIT.OK;
+}
+function handleChoose(args) {
+  const seedId = requireSeed(args);
+  const channel = parsePlatform(args.channelArg ?? "");
+  if (args.variantArg === void 0 || args.variantArg === "") {
+    throw new UsageError("--variant is required");
+  }
+  readPosting(channel);
+  if (args.textArg !== void 0) {
+    if (!existsSync9(args.textArg)) throw new UsageError(`variant file not found: ${args.textArg}`);
+    const target = variantPath(args.workspace, seedId, channel, args.variantArg);
+    mkdirSync4(dirname4(target), { recursive: true });
+    writeFileSync4(target, readFileSync7(args.textArg, "utf8"));
+  }
+  const loaded = loadProfile(args.workspace);
+  if (typeof loaded === "number") return loaded;
+  const variantFile = variantPath(args.workspace, seedId, channel, args.variantArg);
+  if (!existsSync9(variantFile)) {
+    throw new UsageError(`no variant body at ${variantFile}`);
   }
-  if (!AGENTS.includes(args.agent)) {
-    throw new UsageError(`unknown agent "${args.agent}" (allowed: ${AGENTS.join(", ")})`);
+  const rendered = renderFacts(readFileSync7(variantFile, "utf8"), loaded);
+  if (rendered.dangling.length > 0) {
+    throw new UsageError(`dangling fact ref(s): ${rendered.dangling.join(", ")}`);
   }
-  const projection = `cd <skills-studio> && bin/project.sh ${args.agent}`;
+  const result = chooseVariant(args.workspace, seedId, channel, args.variantArg, rendered.text);
   if (isJsonMode()) {
-    return report("skills:install", true, EXIT.OK, {
-      data: { agent: args.agent, implemented: false, projection, ownedBy: SKILLS_OWNER }
+    return report("post", true, EXIT.OK, {
+      data: {
+        mode: "choose",
+        seedId,
+        channel,
+        variant: args.variantArg,
+        contentHash: result.contentHash,
+        path: result.path
+      }
     });
   }
   line(
-    "pasco skills:install: partial \u2014 prints the projection command; projecting is the skills-studio job (AGOS), not the CLI"
-  );
-  line(`  run: ${projection}`);
-  line(
-    "  profile-as-code platform skills (per-platform living knowledge, D5/D6) land with M3 research."
+    `chose ${seedId}/${channel} = ${args.variantArg} (sha256 ${result.contentHash.slice(0, 12)}\u2026)`
   );
   return EXIT.OK;
 }
-
-// src/commands/status.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join7 } from "path";
-import { parseDocument as parseDocument3, stringify as stringify2 } from "yaml";
-var CHECKLIST_HEADER = `# CHECKLIST \u2014 deploy status
-
+function handleCheck(args) {
+  const seedId = requireSeed(args);
+  const loaded = loadProfile(args.workspace);
+  if (typeof loaded === "number") return loaded;
+  const profile = loaded;
+  const ledger = readLedger(args.workspace, seedId);
+  const findingsByChannel = [];
+  let errors = 0;
+  let warnings = 0;
+  for (const channel of Object.keys(ledger.channels)) {
+    const state = ledger.channels[channel];
+    if (state?.chosen === void 0) continue;
+    const chosen = chosenVariant(args.workspace, ledger, channel);
+    if (chosen === void 0) {
+      errors += 1;
+      findingsByChannel.push({
+        channel,
+        findings: [
+          {
+            code: "missing-body",
+            severity: "error",
+            message: `chosen variant "${state.chosen}" has no body at ${variantPath(
+              args.workspace,
+              ledger.id,
+              channel,
+              state.chosen
+            )}`
+          }
+        ]
+      });
+      continue;
+    }
+    const rendered = renderFacts(chosen.text, profile);
+    const findings = rendered.dangling.map((pointer) => ({
+      code: "dangling-ref",
+      severity: "error",
+      message: `{{fact:${pointer}}} does not resolve in the profile`
+    }));
+    let rules;
+    try {
+      rules = readPosting(channel);
+    } catch (err) {
+      findings.push({
+        code: "unsupported-channel",
+        severity: "error",
+        message: err.message
+      });
+    }
+    if (rules !== void 0) findings.push(...checkText(rendered.text, rules, profile));
+    for (const finding2 of findings) {
+      if (finding2.severity === "error") errors += 1;
+      else warnings += 1;
+    }
+    findingsByChannel.push({ channel, findings });
+  }
+  if (findingsByChannel.length === 0) {
+    return report("post", false, EXIT.FAIL, {
+      error: { kind: "empty", message: `${seedId} has no chosen variant` }
+    });
+  }
+  if (isJsonMode()) {
+    return report("post", errors === 0, errors === 0 ? EXIT.OK : EXIT.FAIL, {
+      data: { mode: "check", seedId, errors, warnings, channels: findingsByChannel }
+    });
+  }
+  section(`post check \u2014 ${seedId}`);
+  for (const entry of findingsByChannel) {
+    line(`${entry.channel}:`);
+    if (entry.findings.length === 0) line("  ok");
+    for (const finding2 of entry.findings) {
+      const prefix = finding2.severity === "error" ? "  error" : "  warn";
+      line(`${prefix} [${finding2.code}] ${finding2.message}`);
+    }
+  }
+  line(`
+${errors} error(s), ${warnings} warning(s)`);
+  return errors === 0 ? EXIT.OK : EXIT.FAIL;
+}
+function handleExport(args) {
+  const seedId = requireSeed(args);
+  const target = args.targetArg ?? "postiz";
+  if (target !== "postiz") {
+    throw new UsageError(`unsupported target "${target}" (only "postiz" today)`);
+  }
+  const type = args.typeArg ?? "draft";
+  if (!["draft", "schedule", "now"].includes(type)) {
+    throw new UsageError(`--type must be draft|schedule|now (got "${type}")`);
+  }
+  const date = args.dateArg ?? (/* @__PURE__ */ new Date()).toISOString();
+  if (Number.isNaN(Date.parse(date))) {
+    throw new UsageError(`--date must be an ISO date (got "${date}")`);
+  }
+  if (type === "schedule" && args.dateArg === void 0) {
+    throw new UsageError("--type schedule requires --date");
+  }
+  const loaded = loadProfile(args.workspace);
+  if (typeof loaded === "number") return loaded;
+  const profile = loaded;
+  const ledger = readLedger(args.workspace, seedId);
+  const payload = buildPostizPayload({
+    workspace: args.workspace,
+    ledger,
+    profile,
+    type,
+    date
+  });
+  if (payload.posts.length === 0) {
+    return report("post", false, EXIT.FAIL, {
+      error: { kind: "empty", message: `${seedId} has no chosen variant to export` }
+    });
+  }
+  const out = args.outArg ?? join10(seedDir(args.workspace, seedId), "postiz.json");
+  mkdirSync4(dirname4(out), { recursive: true });
+  writeFileSync4(out, `${JSON.stringify(payload, null, 2)}
+`);
+  if (isJsonMode()) {
+    return report("post", true, EXIT.OK, { data: { mode: "export", seedId, out, payload } });
+  }
+  line(`wrote ${out}`);
+  line(
+    `  ${payload.posts.length} channel(s); integration IDs: ${payload.posts.map((post) => post.integration.id).join(", ")}`
+  );
+  if (payload.posts.some((post) => post.integration.id === "REPLACE_ME")) {
+    warn2(
+      "some integration IDs are REPLACE_ME \u2014 add postiz.yaml (channels: {linkedin: <id>, x: <id>})"
+    );
+  }
+  line(
+    `  POST it: curl -X POST "$POSTIZ_API_URL/posts" -H "Authorization: $POSTIZ_API_KEY" -H "Content-Type: application/json" -d @${out}`
+  );
+  return EXIT.OK;
+}
+function slugify(value) {
+  return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+}
+function handleImport(args) {
+  if (args.seedArg === void 0) {
+    throw new UsageError("usage: pasco post import <dir> --channel <channel>");
+  }
+  const sourceDir = args.seedArg;
+  if (!existsSync9(sourceDir) || !statSync5(sourceDir).isDirectory()) {
+    throw new UsageError(`import dir not found: ${sourceDir}`);
+  }
+  const channel = parsePlatform(args.channelArg ?? "");
+  readPosting(channel);
+  const files = readdirSync5(sourceDir).filter((name) => name.endsWith(".md")).sort();
+  if (files.length === 0) throw new UsageError(`no .md files in ${sourceDir}`);
+  const started = Date.now();
+  const imported = [];
+  for (const file of files) {
+    const text = readFileSync7(join10(sourceDir, file), "utf8");
+    if (text.trim() === "") continue;
+    const base = slugify(file.replace(/\.md$/, "")) || "post";
+    let id = `imported-${base}`;
+    let n = 2;
+    while (existsSync9(seedDir(args.workspace, id))) id = `imported-${base}-${n++}`;
+    createSeed(args.workspace, id, text, "imported");
+    const target = variantPath(args.workspace, id, channel, "imported");
+    mkdirSync4(dirname4(target), { recursive: true });
+    writeFileSync4(target, text);
+    const ledger = readLedger(args.workspace, id);
+    ledger.channels[channel] = {
+      chosen: "imported",
+      chosenAt: (/* @__PURE__ */ new Date()).toISOString(),
+      contentHash: hashText(text),
+      publishedAt: null,
+      url: null,
+      sync: "published",
+      certification: "unverifiable"
+    };
+    ledger.status = "published";
+    writeLedger(args.workspace, ledger);
+    imported.push(id);
+  }
+  const elapsed = Date.now() - started;
+  if (isJsonMode()) {
+    return report("post", true, EXIT.OK, {
+      data: { mode: "import", channel, imported, elapsedMs: elapsed }
+    });
+  }
+  line(`imported ${imported.length} post(s) as ${channel} seeds in ${elapsed} ms`);
+  for (const id of imported) line(`  ${id}`);
+  return EXIT.OK;
+}
+function handleList(args) {
+  const ids = listSeedIds(args.workspace);
+  const rows = ids.map((id) => {
+    try {
+      const ledger = readLedger(args.workspace, id);
+      const channels = Object.entries(ledger.channels).map(([channel, state]) => `${channel}:${state.chosen ?? "\u2014"}`).join(" ");
+      return { id, source: ledger.source, status: ledger.status, channels };
+    } catch {
+      return { id, source: "?", status: "?", channels: "?" };
+    }
+  });
+  if (isJsonMode()) {
+    return report("post", true, EXIT.OK, { data: { mode: "list", posts: rows } });
+  }
+  if (rows.length === 0) {
+    line(`no posts under ${postsDir(args.workspace)}`);
+    return EXIT.OK;
+  }
+  for (const row of rows) {
+    line(`${row.id}  [${row.source}/${row.status}]  ${row.channels}`);
+  }
+  return EXIT.OK;
+}
+function runPost(args) {
+  switch (args.subcommand) {
+    case "seed":
+      return handleSeed(args);
+    case "task":
+      return handleTask(args);
+    case "choose":
+      return handleChoose(args);
+    case "check":
+      return handleCheck(args);
+    case "export":
+      return handleExport(args);
+    case "import":
+      return handleImport(args);
+    case "list":
+      return handleList(args);
+    default:
+      throw new UsageError(
+        "usage: pasco post <seed|task|choose|check|export|import|list> \u2026 (run pasco post --help)"
+      );
+  }
+}
+
+// src/commands/refine.ts
+import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { join as join11 } from "path";
+import { parseDocument as parseDocument4, stringify as stringify2 } from "yaml";
+var REFINE_OWNER = "M3 SOTA research per platform \u2192 skills v1 + the full refine flow (SPEC \xA712/\xA716 M3); model-agnostic (D10/D11/D13)";
+function loadProfile2(workspace) {
+  try {
+    return load(workspace);
+  } catch (err) {
+    if (err instanceof SchemaValidationError) {
+      return report("refine", false, EXIT.FAIL, {
+        error: {
+          kind: "schema",
+          message: `schema validation failed (D12 fail-on-schema) \u2014 ${err.issues.length} violation(s)`,
+          violations: [...err.issues]
+        }
+      });
+    }
+    if (err instanceof LoadError) {
+      return report("refine", false, EXIT.FAIL, { error: { kind: "load", message: err.message } });
+    }
+    throw err;
+  }
+}
+function recordVariant(workspace, platform, lang, variantId) {
+  const activePath = join11(workspace, "content", "active.yaml");
+  let active = {};
+  if (existsSync10(activePath)) {
+    const doc = parseDocument4(readFileSync8(activePath, "utf8"));
+    if (doc.errors.length > 0) {
+      throw new Error(
+        `content/active.yaml: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`
+      );
+    }
+    const node = doc.toJS({ maxAliasCount: 100 });
+    if (node !== null && node !== void 0) {
+      if (typeof node !== "object" || Array.isArray(node)) {
+        throw new Error("content/active.yaml must contain a mapping (platform \u2192 variant entry)");
+      }
+      active = node;
+    }
+  }
+  const chosenAt = (/* @__PURE__ */ new Date()).toISOString();
+  active[platform] = { lang, variantId, chosenAt };
+  writeFileSync5(activePath, stringify2(active));
+  return { chosenAt };
+}
+function runRefine(args) {
+  if (args.platformArg === void 0) {
+    throw new UsageError(
+      "usage: pasco refine <platform> [--lang <l>] [--variants N] [--choose <variantId>]"
+    );
+  }
+  const platform = parsePlatform(args.platformArg);
+  const lang = parseLang(defaultsLang(args.pascorc, args.langArg));
+  const variants = parseVariants(args.variantsArg, args.pascorc.defaults?.variants ?? 3);
+  if (args.choose !== void 0 && !isSafeVariantId(args.choose)) {
+    throw new UsageError(
+      "--choose <variantId> must be a safe id (letters, digits, dot, underscore, dash; no slash or '..')"
+    );
+  }
+  const loaded = loadProfile2(args.workspace);
+  if (typeof loaded === "number") return loaded;
+  const profile = loaded;
+  if (args.choose !== void 0) {
+    let chosenAt;
+    try {
+      chosenAt = recordVariant(args.workspace, platform, lang, args.choose).chosenAt;
+    } catch (err) {
+      return report("refine", false, EXIT.FAIL, {
+        error: { kind: "load", message: err.message }
+      });
+    }
+    const variantFile = variantBodyPath(args.workspace, platform, args.choose);
+    const hasBody = hasVariantBody(args.workspace, platform, args.choose);
+    if (isJsonMode()) {
+      return report("refine", true, EXIT.OK, {
+        data: {
+          mode: "recorded",
+          platform,
+          lang,
+          variantId: args.choose,
+          chosenAt,
+          workspace: args.workspace,
+          variantFile,
+          hasBody
+        }
+      });
+    }
+    line(
+      `recorded active[${platform}] = { lang: ${lang}, variantId: ${args.choose}, chosenAt: ${chosenAt} } (content/active.yaml)`
+    );
+    if (!hasBody) {
+      line(
+        `  warning: no variant body at ${variantFile} \u2014 pasco build will render the deterministic text until it exists`
+      );
+    }
+    return EXIT.OK;
+  }
+  const slice = compile(profile, platform, lang);
+  const identity = slice.identity;
+  const links = (identity.links ?? []).map((l) => `${l.platform ?? "?"}:${l.url}`).join(", ");
+  const experience = slice.experience.map((e) => `${e.role} @ ${e.org} (${e.start}\u2013${e.end ?? "present"})`).join(" | ");
+  const projects = slice.projects.map((p) => p.name).join(", ");
+  const publications = slice.publications.map((p) => p.title).join(" | ");
+  const anchors = slice.keywords.geo.associations?.join(", ") ?? "";
+  const skill = lookupSkill(platform, "SKILL.md");
+  const skillPath = skill.state === "found" ? skill.path : void 0;
+  const researchCandidate = skillPath === void 0 ? void 0 : skillPath.replace(/SKILL\.md$/, "research/SOTA-2026.md");
+  const researchPath = researchCandidate !== void 0 && existsSync10(researchCandidate) ? researchCandidate : "\u2014";
+  const template = [
+    `# pasco refine \u2014 agent task (agent-driven: D10/D11/D13; no LLM call, no hub)`,
+    `Write ${variants} variant(s) of the ${platform} profile in ${lang} \u2014 in PROSE, per the platform skill.`,
+    ``,
+    `Platform: ${platform}`,
+    `Language: ${lang}`,
+    `Skill (communicative strategy \u2014 READ IT FIRST): ${skillLine(skill)}`,
+    `Research (dated sources): ${researchPath}`,
+    `Variant id convention: ${platform.replace(/[^a-z]/g, "")}-${lang}-<n> (e.g. gh-en-1, gh-en-2, gh-en-3).`,
+    ``,
+    `Facts (language-independent \u2014 MUST stay byte-identical across variants and platforms):`,
+    `  name: ${identity.name}`,
+    `  location: ${identity.location ?? "\u2014"}`,
+    `  links: ${links || "\u2014"}`,
+    `  experience: ${experience || "\u2014"}`,
+    `  projects: ${projects || "\u2014"}`,
+    `  publications: ${publications || "\u2014"}`,
+    ``,
+    `Existing ${platform} texts (base to vary):`,
+    `  bios: ${slice.bios.map((b) => `[${b.length}] ${b.text}`).join(" | ") || "\u2014"}`,
+    `  headlines: ${slice.headlines.map((h) => h.text).join(" | ") || "\u2014"}`,
+    `  active variant: ${slice.active?.variantId ?? "\u2014"}`,
+    ``,
+    `GEO anchors to reinforce (semantic associations): ${anchors || "\u2014"}`,
+    ``,
+    `Constraints:`,
+    `  - Facts never change (D4) \u2014 only storytelling/angles vary.`,
+    `  - Every text langMap must include 'en' (contract requirement) and the requested lang.`,
+    `  - Never invent URLs, DOIs or numbers \u2014 evidence claims stay untouched.`,
+    `  - Platform-specific limits come from the platform skill (SPEC \xA716) + checks.yaml.`,
+    ``,
+    `Workflow: read the skill \u2192 produce the ${variants} variant(s) \u2192 the user picks one \u2192 save its body to`,
+    `  profiles/${platform}/variants/<variantId>.md (one text block), then record it:`,
+    `  pasco refine ${platform} --lang ${lang} --choose <variantId>`,
+    ``
+  ].join("\n");
+  if (isJsonMode()) {
+    return report("refine", true, EXIT.OK, {
+      data: { mode: "template", platform, lang, variants, template, skill, ownedBy: REFINE_OWNER }
+    });
+  }
+  process.stdout.write(template);
+  return EXIT.OK;
+}
+
+// src/commands/skills-export.ts
+import { cpSync, existsSync as existsSync11, mkdirSync as mkdirSync5, readdirSync as readdirSync6, statSync as statSync6 } from "fs";
+import { join as join12, resolve as resolve4, sep } from "path";
+function countFiles(dir) {
+  let total = 0;
+  for (const entry of readdirSync6(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) total += countFiles(join12(dir, entry.name));
+    else total += 1;
+  }
+  return total;
+}
+function runSkillsExport(args) {
+  if (!args.list && args.dir === void 0) {
+    throw new UsageError("usage: pasco skills:export <dir> [--force] | pasco skills:export --list");
+  }
+  if (args.list && args.dir !== void 0) {
+    throw new UsageError("--list takes no destination \u2014 run them separately");
+  }
+  const root = skillsDir();
+  if (root === void 0) {
+    return report("skills:export", false, EXIT.FAIL, {
+      error: { kind: "skills", message: NOT_SHIPPED_MESSAGE }
+    });
+  }
+  const platforms = listChannels(root);
+  const strategySkills = listSkills(root);
+  if (args.list) {
+    if (isJsonMode()) {
+      return report("skills:export", true, EXIT.OK, {
+        data: { root, platforms, strategySkills }
+      });
+    }
+    line(
+      `pasco skills:export: ${platforms.length} skill channels shipped with this package (${strategySkills.length} with SKILL.md)`
+    );
+    line(`  ${root}`);
+    for (const platform of platforms) {
+      line(`  - ${platform}${strategySkills.includes(platform) ? "" : " (post-only)"}`);
+    }
+    line("  run: pasco skills:export <dir>   # copy them into a directory you name");
+    return EXIT.OK;
+  }
+  const destination = resolve4(args.dir);
+  if (destination === resolve4(root) || destination.startsWith(`${resolve4(root)}${sep}`)) {
+    return report("skills:export", false, EXIT.FAIL, {
+      error: {
+        kind: "destination",
+        message: "the destination cannot be inside the shipped skills tree"
+      }
+    });
+  }
+  if (existsSync11(destination) && !statSync6(destination).isDirectory()) {
+    return report("skills:export", false, EXIT.FAIL, {
+      error: { kind: "destination", message: `${destination} exists and is not a directory` }
+    });
+  }
+  if (existsSync11(destination) && readdirSync6(destination).length > 0 && !args.force) {
+    return report("skills:export", false, EXIT.FAIL, {
+      error: {
+        kind: "destination",
+        message: `${destination} is not empty \u2014 pass --force to overlay the shipped skills`
+      }
+    });
+  }
+  mkdirSync5(destination, { recursive: true });
+  cpSync(root, destination, {
+    recursive: true,
+    force: true,
+    filter: (source) => !source.endsWith(".DS_Store")
+  });
+  const files = countFiles(root);
+  if (isJsonMode()) {
+    return report("skills:export", true, EXIT.OK, {
+      data: { root, destination, platforms, strategySkills, files }
+    });
+  }
+  line(
+    `pasco skills:export: copied ${platforms.length} skill channels (${files} files) to ${destination}`
+  );
+  return EXIT.OK;
+}
+
+// src/commands/status.ts
+import { writeFileSync as writeFileSync7 } from "fs";
+import { join as join14 } from "path";
+
+// src/report-shape.ts
+function summaryOf(data) {
+  return {
+    total: data.units.length,
+    inSync: data.units.filter((u) => u.state === "in-sync").length,
+    stale: data.units.filter((u) => u.state === "stale").length,
+    never: data.units.filter((u) => u.state === "never").length
+  };
+}
+function reportDataOf(data, args, publication) {
+  return {
+    workspace: args.workspace,
+    platform: args.platformArg ?? null,
+    ...summaryOf(data),
+    ...publication === void 0 ? {} : { publication },
+    units: data.units,
+    untracked: data.untracked,
+    removed: data.removed
+  };
+}
+function certificationMap(profile) {
+  const map = {};
+  for (const unit of deployStatus(profile).units) map[unit.key] = unit.certification;
+  return map;
+}
+function filterReport(reportData, platform) {
+  if (platform === void 0) return reportData;
+  return {
+    ...reportData,
+    units: reportData.units.map((u) => {
+      const onSurface = u.surfaces[platform];
+      const state = onSurface === "in-sync" || onSurface === "stale" ? onSurface : "never";
+      const surfaceCert = u.certification?.surfaces[platform];
+      if (surfaceCert === void 0) return { ...u, surfaces: {}, state, certification: null };
+      const certification = {
+        state: surfaceCert.state,
+        surfaces: { [platform]: surfaceCert },
+        ...surfaceCert.reason !== void 0 ? { reason: surfaceCert.reason } : {}
+      };
+      return {
+        ...u,
+        surfaces: onSurface === void 0 ? {} : { [platform]: onSurface },
+        state,
+        certification
+      };
+    })
+  };
+}
+
+// src/verify.ts
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync12, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
+import { parseDocument as parseDocument5, stringify as stringify3 } from "yaml";
+
+// src/capabilities.ts
+function capabilitiesOf(profile) {
+  return {
+    "github-readme": {
+      extractor: extractArtifact2,
+      fetchHosts: fetchHosts2,
+      artifactUrl: artifactUrl2(profile)
+    },
+    ...profile.flavor === "brand" ? {
+      "github-org": {
+        extractor: extractArtifact,
+        fetchHosts,
+        artifactUrl: artifactUrl(profile)
+      }
+    } : {}
+  };
+}
+
+// src/verify.ts
+var depsOf = (args, profile) => ({
+  capabilities: args.deps?.capabilities ?? capabilitiesOf(profile),
+  fetchText: args.deps?.fetchText ?? (async () => ({ status: 0 }))
+});
+function ledgerPathOf(workspace) {
+  return join13(workspace, "content", "deployments.yaml");
+}
+function readLedger2(args, kind) {
+  const ledgerPath2 = ledgerPathOf(args.workspace);
+  let ledger = {};
+  if (existsSync12(ledgerPath2)) {
+    const doc = parseDocument5(readFileSync9(ledgerPath2, "utf8"));
+    if (doc.errors.length > 0) {
+      return {
+        fail: report("status", false, EXIT.FAIL, {
+          error: {
+            kind,
+            message: `content/deployments.yaml: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`
+          }
+        })
+      };
+    }
+    const node = doc.toJS({ maxAliasCount: 100 });
+    if (node !== null && typeof node === "object")
+      ledger = node;
+  }
+  return { ledger };
+}
+function persistLedger(args, ledger) {
+  writeFileSync6(ledgerPathOf(args.workspace), stringify3(ledger), "utf8");
+}
+function digestOf(artifact) {
+  return createHash4("sha256").update(artifact, "utf8").digest("hex");
+}
+async function verifyStatus(args, profile) {
+  const deps = depsOf(args, profile);
+  if (args.platformArg !== void 0 && !PLATFORMS.includes(args.platformArg)) {
+    return report("status", false, EXIT.USAGE, {
+      error: {
+        kind: "usage",
+        message: `surface "${args.platformArg}" is not in the platform set (D16)`
+      }
+    });
+  }
+  const ledger = profile.deployments;
+  const subjects = [];
+  for (const unit of trackableUnits(profile)) {
+    const surfacesOfUnit = ledger[unit.key];
+    if (surfacesOfUnit === void 0) continue;
+    for (const surface of Object.keys(surfacesOfUnit).sort()) {
+      if (args.platformArg !== void 0 && surface !== args.platformArg) continue;
+      subjects.push({
+        key: unit.key,
+        surface,
+        existing: surfacesOfUnit[surface]
+      });
+    }
+  }
+  const verdicts = [];
+  let requests = 0;
+  for (const subject of subjects) {
+    const verdict = await verifySurface(
+      subject.surface,
+      subject.existing,
+      deps.capabilities[subject.surface],
+      deps.fetchText
+    );
+    if (verdict.fetched) requests += 1;
+    if (verdict.write) {
+      const surfacesOfUnit = ledger[subject.key];
+      if (surfacesOfUnit !== void 0) {
+        surfacesOfUnit[subject.surface] = {
+          ...subject.existing,
+          certification: verdict.certification
+        };
+      }
+    }
+    verdicts.push({ key: subject.key, verdict });
+  }
+  if (verdicts.some((v) => v.verdict.write)) persistLedger(args, ledger);
+  return finishVerify(args, profile, verdicts, requests);
+}
+function finishVerify(args, profile, verdicts, requests) {
+  const filtered = filterReport(deployStatus(profile), args.platformArg);
+  const derived = /* @__PURE__ */ new Map();
+  for (const { key, verdict } of verdicts) {
+    if (verdict.write) continue;
+    const surfaces = derived.get(key) ?? /* @__PURE__ */ new Map();
+    surfaces.set(verdict.surface, verdict.certification);
+    derived.set(key, surfaces);
+  }
+  const withDerived = {
+    ...filtered,
+    units: filtered.units.map((unit) => {
+      const overlay = derived.get(unit.key);
+      if (overlay === void 0) return unit;
+      const surfaces = {
+        ...unit.certification?.surfaces ?? {},
+        ...Object.fromEntries(overlay)
+      };
+      const rollup = certificationRollup(surfaces);
+      return {
+        ...unit,
+        certification: {
+          state: rollup.state,
+          surfaces,
+          ...rollup.reason !== void 0 ? { reason: rollup.reason } : {}
+        }
+      };
+    })
+  };
+  const publication = publicationOfCaller(args, profile, withDerived, DEFAULT_CHECKS);
+  if (isJsonMode()) {
+    return report("status", true, EXIT.OK, {
+      data: reportDataOf(withDerived, args, publication)
+    });
+  }
+  section(
+    `verified \u2014 ${requests} fetch(es) for ${verdicts.length} record(s)${args.platformArg !== void 0 ? ` (surface: ${args.platformArg})` : ""}`
+  );
+  for (const { key, verdict } of verdicts) {
+    line(`  ${key} \u2192 ${verdict.surface}: ${certToken(verdict.certification)}`);
+  }
+  if (publication.length > 0) {
+    section("publication truth \u2014 derived, never stored (SPEC \xA720.1)");
+    for (const truth of publication) {
+      line(`  ${publicationLine(truth)}`);
+      for (const finding2 of truth.findings) {
+        line(`    warn: [${finding2.code}] ${finding2.message} (${finding2.path})`);
+      }
+    }
+    line(`  coverage: ${publicationCoverageLine(publication)}`);
+  }
+  if (verdicts.length === 0) {
+    line("  nothing to verify \u2014 no ledger record on the requested surface(s)");
+  }
+  line(
+    "  certification compares the LIVE digest against the stored anchor; a record with no anchor is unverifiable: unattributed"
+  );
+  line(
+    "  the ledger file was written \u2014 committing content/deployments.yaml is the operator's (D2)"
+  );
+  return EXIT.OK;
+}
+async function verifySurface(surface, existing, capability, fetchText) {
+  const stored = existing.certification;
+  const declared = declaredReason(capability);
+  if (declared !== void 0) {
+    return {
+      surface,
+      certification: { state: "unverifiable", reason: declared },
+      fetched: false,
+      write: false
+    };
+  }
+  const extractor = capability?.extractor;
+  const url = capability?.artifactUrl;
+  let host = "";
+  try {
+    host = new URL(url).host;
+  } catch {
+    return {
+      surface,
+      certification: { state: "unverifiable", reason: "no-artifact-url" },
+      fetched: false,
+      write: false
+    };
+  }
+  if (!(capability?.fetchHosts ?? []).includes(host)) {
+    return {
+      surface,
+      certification: { state: "unverifiable", reason: "host-not-allowed" },
+      fetched: false,
+      write: false
+    };
+  }
+  const fetchedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const response = await fetchText(url);
+  const evidence = {
+    ...stored?.artifactHash !== void 0 ? { artifactHash: stored.artifactHash } : {},
+    fetchedAt,
+    evidenceUrl: url
+  };
+  if (response.status < 200 || response.status >= 300) {
+    return {
+      surface,
+      certification: attemptRecord(
+        { state: "unverifiable", reason: fetchFailureReason(response.status) },
+        evidence
+      ),
+      fetched: true,
+      write: true
+    };
+  }
+  let digest;
+  if (response.text !== void 0) {
+    try {
+      digest = digestOf(extractor(response.text));
+    } catch {
+      digest = void 0;
+    }
+  }
+  const verdict = certificationVerdict(
+    { certification: stored },
+    { status: response.status, ...digest !== void 0 ? { digest } : {} }
+  );
+  return {
+    surface,
+    certification: attemptRecord(verdict, {
+      ...evidence,
+      ...digest !== void 0 ? { liveHash: digest } : {}
+    }),
+    fetched: true,
+    write: true
+  };
+}
+
+// src/commands/status.ts
+var CHECKLIST_HEADER = `# CHECKLIST \u2014 deploy status
+
 <!-- AUTO-GENERATED by \`pasco status --write-checklist\` (D18, SPEC \xA719) \u2014 do not edit by hand.
      Regenerate after every deploy confirm: pasco status --mark <ledgerKey> <surface>.
      Source of truth: content/deployments.yaml (only \`pasco\` mutates it). -->`;
@@ -2839,6 +5051,26 @@ function loadOrReport(args) {
     throw err;
   }
 }
+function artifactAnchor(args, profile, surface, capability) {
+  const declared = declaredReason(capability);
+  if (declared !== void 0) return { reason: declared };
+  const extractor = capability?.extractor;
+  if (extractor === void 0) return { reason: "no-extractor" };
+  try {
+    const resolver = createArtifactResolver({
+      workspace: args.workspace,
+      profile,
+      completenessPolicy: args.completenessPolicy,
+      selectionPolicy: args.selectionPolicy
+    });
+    const artifact = resolver.built(surface) ?? resolver.render(surface, args.lang ?? "en");
+    if (artifact === void 0) return { reason: "no-renderer" };
+    if (artifact === "") return { reason: "empty-render" };
+    return { anchor: digestOf(extractor(artifact)) };
+  } catch (err) {
+    return { reason: `render-failed (${err instanceof Error ? err.message : String(err)})` };
+  }
+}
 function markDeployed(args, profile) {
   const key = args.markKey;
   const surface = args.platformArg;
@@ -2879,39 +5111,52 @@ function markDeployed(args, profile) {
     }
     deployedAt = at.toISOString();
   }
-  const ledgerPath = join7(args.workspace, "content", "deployments.yaml");
-  let ledger = {};
-  if (existsSync6(ledgerPath)) {
-    const doc = parseDocument3(readFileSync5(ledgerPath, "utf8"));
-    if (doc.errors.length > 0) {
-      return report("status", false, EXIT.FAIL, {
-        error: {
-          kind: "mark",
-          message: `content/deployments.yaml: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`
-        }
-      });
-    }
-    const node = doc.toJS({ maxAliasCount: 100 });
-    if (node !== null && typeof node === "object")
-      ledger = node;
-  }
-  const record = { deployedAt, contentHash: unit.hash, source: "manual" };
+  const read = readLedger2(args, "mark");
+  if ("fail" in read) return read.fail;
+  const { ledger } = read;
+  const capability = depsOf(args, profile).capabilities[surface];
+  const { anchor, reason: anchorReason } = artifactAnchor(args, profile, surface, capability);
+  const certification = attestedRecord(anchor);
+  const record = { deployedAt, contentHash: unit.hash, source: "manual", certification };
   ledger[key] = { ...ledger[key] ?? {}, [surface]: record };
-  writeFileSync4(ledgerPath, stringify2(ledger), "utf8");
+  persistLedger(args, ledger);
   if (isJsonMode()) {
     return report("status", true, EXIT.OK, {
-      data: { mode: "marked", key, surface, ...record, workspace: args.workspace }
+      data: {
+        mode: "marked",
+        key,
+        surface,
+        ...record,
+        ...anchorReason !== void 0 ? { anchorReason } : {},
+        workspace: args.workspace
+      }
     });
   }
   section("marked");
   line(`  ${key} \u2192 ${surface}: deployedAt ${deployedAt} \xB7 contentHash ${unit.hash.slice(0, 12)}\u2026`);
+  line(
+    certification.artifactHash !== void 0 ? `  certification: attested (anchor ${certification.artifactHash.slice(0, 12)}\u2026 \u2014 --verify can judge this record)` : `  certification: attested (no anchor \u2014 ${anchorReason}; --verify will observe this record but cannot judge it)`
+  );
   line(
     "  confirm the paste is live on the surface before running this (the ledger records the claim)"
   );
   return EXIT.OK;
 }
-function checklistBody(reportData, completion) {
-  const fmt = (surfaces) => Object.entries(surfaces).sort().map(([s, state]) => `${s} (${state})`).join(", ");
+function certToken(certification) {
+  return certification.reason === void 0 ? certification.state : `${certification.state}: ${certification.reason}`;
+}
+function certOf(certification, surface) {
+  const surfaceCert = certification?.surfaces[surface];
+  return surfaceCert === void 0 ? "\u2014" : certToken(surfaceCert);
+}
+function formatSurfacePairs(surfaces, certification) {
+  const keys = Object.keys(surfaces).sort();
+  if (keys.length === 0) return "\u2014";
+  return keys.map((surface) => `${surface} (${surfaces[surface]}/${certOf(certification, surface)})`).join(", ");
+}
+function checklistBody(reportData, completion, profile, publication) {
+  const certification = certificationMap(profile);
+  const fmt = (u) => formatSurfacePairs(u.surfaces, certification[u.key] ?? null);
   const stale = reportData.units.filter((u) => u.state === "stale");
   const inSync = reportData.units.filter((u) => u.state === "in-sync");
   const never = reportData.units.filter((u) => u.state === "never");
@@ -2921,17 +5166,20 @@ function checklistBody(reportData, completion) {
     // Issue #102: the completeness number rides the SAME generated view — it is
     // derived state (never stored) and the checklist is where the user looks.
     `Profile completeness: ${completenessLine(completion)}`,
+    // #242: the derived publication truth rides the SAME generated view — it is
+    // coverage of publication, never a new score (SPEC §20).
+    `Publication truth: ${publicationCoverageOrNone(publication)}`,
     ""
   ];
   lines2.push("## Pending \u2014 stale (SSOT changed after the last deploy)");
   if (stale.length === 0) lines2.push("_None._");
-  for (const u of stale) lines2.push(`- [ ] \`${u.key}\` (${u.label}) \u2014 ${fmt(u.surfaces)}`);
+  for (const u of stale) lines2.push(`- [ ] \`${u.key}\` (${u.label}) \u2014 ${fmt(u)}`);
   lines2.push("", "## Never deployed");
   if (never.length === 0) lines2.push("_None._");
   for (const u of never) lines2.push(`- [ ] \`${u.key}\` (${u.label})`);
   lines2.push("", "## In sync");
   if (inSync.length === 0) lines2.push("_None._");
-  for (const u of inSync) lines2.push(`- [x] \`${u.key}\` (${u.label}) \u2014 ${fmt(u.surfaces)}`);
+  for (const u of inSync) lines2.push(`- [x] \`${u.key}\` (${u.label}) \u2014 ${fmt(u)}`);
   lines2.push("", "## Untracked (add an `id` to track)");
   if (reportData.untracked.length === 0) lines2.push("_None._");
   for (const u of reportData.untracked) lines2.push(`- ${u.block} \u2014 ${u.label}`);
@@ -2943,11 +5191,40 @@ function checklistBody(reportData, completion) {
   lines2.push("");
   return lines2.join("\n");
 }
+function certificationLineOf(reportData) {
+  const withRecord = reportData.units.filter((u) => u.certification !== null);
+  const certified = withRecord.filter(
+    (u) => u.certification?.state === "verified" || u.certification?.state === "attested"
+  );
+  return `${certified.length}/${withRecord.length} recorded unit(s) certified`;
+}
 function completenessOf(args, profile) {
   return completeness(profile, sanitizeCompletenessPolicy(args.completenessPolicy));
 }
-function runCompleteness(args, profile) {
+function publicationOf(args, profile, reportData) {
+  return publicationOfCaller(args, profile, reportData, DEFAULT_CHECKS);
+}
+function publicationAllOf(args, profile, reportData) {
+  return publicationOfCaller(
+    { ...args, platformArg: void 0 },
+    profile,
+    reportData,
+    DEFAULT_CHECKS
+  );
+}
+function artifactDetail(reason) {
+  switch (reason) {
+    case "local-mismatch":
+      return "the artifact on disk differs from the SSOT render \u2014 run pasco build";
+    case "live-drift":
+      return "\xA719.5 recorded out-of-band drift: the live surface no longer matches what was deployed \u2014 re-publish, then re-confirm";
+    case "no-artifact":
+      return "no artifact on disk for this surface \u2014 run pasco build";
+  }
+}
+function runCompleteness(args, profile, reportData) {
   const result = completenessOf(args, profile);
+  const publication = publicationAllOf(args, profile, reportData);
   if (isJsonMode()) {
     return report("status", true, EXIT.OK, {
       data: {
@@ -2957,7 +5234,8 @@ function runCompleteness(args, profile) {
         satisfied: result.satisfied,
         total: result.total,
         target: result.target,
-        items: result.items
+        items: result.items,
+        publication
       }
     });
   }
@@ -2965,10 +5243,42 @@ function runCompleteness(args, profile) {
   for (const item of result.items) {
     line(`  ${item.satisfied ? "[x]" : "[ ]"} ${item.label} \u2014 ${item.detail}`);
   }
+  line(`  publication coverage \u2014 ${publicationCoverageOrNone(publication)}`);
   line("  \u2192 pasco status --write-checklist folds the number into CHECKLIST.md");
   return EXIT.OK;
 }
-function runStatus(args) {
+function runSelection(args, profile) {
+  const policy = sanitizeSelectionPolicy(args.selectionPolicy);
+  const viewName = args.viewArg ?? args.platformArg;
+  const rule = viewName === void 0 ? void 0 : policy?.views?.[viewName] ?? policy?.default;
+  const platform = args.platformArg !== void 0 ? parsePlatform(args.platformArg) : rule?.platform !== void 0 ? parsePlatform(rule.platform) : void 0;
+  const platforms = platform !== void 0 ? [platform] : [...PLATFORMS];
+  const lang = args.lang ?? "en";
+  const reports = platforms.map(
+    (p) => selectFacts(profile, viewName ?? p, p, lang, policy).report
+  );
+  const withOmissions = reports.filter((r) => r.omitted.length > 0);
+  if (isJsonMode()) {
+    return report("status", true, EXIT.OK, {
+      data: { mode: "selection", workspace: args.workspace, view: viewName ?? null, reports }
+    });
+  }
+  section(
+    `fact selection (D22/\xA721) \u2014 ${viewName ?? "implicit platform view"}${withOmissions.length === 0 ? " \xB7 nothing omitted" : ""}`
+  );
+  for (const r of reports) {
+    const emitted = Object.entries(r.selected).filter(([, n]) => n > 0).map(([block, n]) => `${block} ${n}`).join(" \xB7 ");
+    line(
+      `
+[${r.platform}]${r.mode === "tags" ? " (mode: tags)" : ""} \u2014 ${emitted || "no entries"}`
+    );
+    for (const o of r.omitted) line(`  omitted ${o.block}:${o.label} \u2014 ${o.reason}`);
+    for (const f of r.findings) line(`  ${f.severity}: [${f.code}] ${f.message}`);
+  }
+  if (withOmissions.length === 0) line("  subset-only by design (D22): nothing was removed");
+  return EXIT.OK;
+}
+async function runStatus(args) {
   if (args.markKey !== void 0 && args.writeChecklist === true) {
     return report("status", false, EXIT.USAGE, {
       error: {
@@ -2977,6 +5287,30 @@ function runStatus(args) {
       }
     });
   }
+  if (args.verify === true && args.markKey !== void 0) {
+    return report("status", false, EXIT.USAGE, {
+      error: {
+        kind: "usage",
+        message: "usage: --verify and --mark are both ledger write paths \u2014 run them separately (--mark confirms a paste; --verify checks a live surface)"
+      }
+    });
+  }
+  if (args.verify === true && args.writeChecklist === true) {
+    return report("status", false, EXIT.USAGE, {
+      error: {
+        kind: "usage",
+        message: "usage: --verify writes the ledger and --write-checklist writes CHECKLIST.md \u2014 run them separately (regenerate the checklist after verifying)"
+      }
+    });
+  }
+  if (args.verify === true && args.completeness === true) {
+    return report("status", false, EXIT.USAGE, {
+      error: {
+        kind: "usage",
+        message: "usage: --verify is a live check and --completeness is a read-only report \u2014 run them separately"
+      }
+    });
+  }
   if (args.completeness === true && args.markKey !== void 0) {
     return report("status", false, EXIT.USAGE, {
       error: {
@@ -2985,6 +5319,14 @@ function runStatus(args) {
       }
     });
   }
+  if (args.selection === true && (args.markKey !== void 0 || args.verify === true || args.writeChecklist === true)) {
+    return report("status", false, EXIT.USAGE, {
+      error: {
+        kind: "usage",
+        message: "usage: --selection is a read-only report \u2014 run it separately from the ledger write paths (--mark / --verify / --write-checklist)"
+      }
+    });
+  }
   if (args.completeness === true && args.writeChecklist === true) {
     return report("status", false, EXIT.USAGE, {
       error: {
@@ -2997,13 +5339,17 @@ function runStatus(args) {
   if ("fail" in loaded) return loaded.fail;
   const profile = loaded.profile;
   if (args.markKey !== void 0) return markDeployed(args, profile);
+  if (args.verify === true) return await verifyStatus(args, profile);
   const reportData = deployStatus(profile);
   const completion = completenessOf(args, profile);
-  if (args.completeness === true) return runCompleteness(args, profile);
+  if (args.completeness === true) return runCompleteness(args, profile, reportData);
+  if (args.selection === true) return runSelection(args, profile);
+  const publicationAll = publicationAllOf(args, profile, reportData);
+  const publication = publicationOf(args, profile, reportData);
   if (args.writeChecklist === true) {
-    writeFileSync4(
-      join7(args.workspace, "CHECKLIST.md"),
-      checklistBody(reportData, completion),
+    writeFileSync7(
+      join14(args.workspace, "CHECKLIST.md"),
+      checklistBody(reportData, completion, profile, publicationAll),
       "utf8"
     );
     if (isJsonMode()) {
@@ -3016,33 +5362,17 @@ function runStatus(args) {
             percent: completion.percent,
             satisfied: completion.satisfied,
             total: completion.total
-          }
+          },
+          publication: publicationAll
         }
       });
     }
     line("CHECKLIST.md regenerated from content/deployments.yaml (AUTO-GENERATED view)");
     line(`  Profile completeness: ${completenessLine(completion)}`);
+    line(`  Certification: ${certificationLineOf(reportData)}`);
   }
-  const filtered = args.platformArg !== void 0 ? {
-    ...reportData,
-    units: reportData.units.map((u) => {
-      const onSurface = u.surfaces[args.platformArg];
-      const state = onSurface === "in-sync" || onSurface === "stale" ? onSurface : "never";
-      return {
-        ...u,
-        surfaces: onSurface === void 0 ? {} : { [args.platformArg]: onSurface },
-        state
-      };
-    })
-  } : reportData;
-  const data = {
-    workspace: args.workspace,
-    platform: args.platformArg ?? null,
-    ...summaryOf(filtered),
-    units: filtered.units,
-    untracked: filtered.untracked,
-    removed: filtered.removed
-  };
+  const filtered = filterReport(reportData, args.platformArg);
+  const data = reportDataOf(filtered, args, publication);
   if (isJsonMode()) return report("status", true, EXIT.OK, { data });
   const s = summaryOf(filtered);
   section(
@@ -3053,7 +5383,7 @@ function runStatus(args) {
     return rank[a.state] - rank[b.state] || a.key.localeCompare(b.key);
   });
   for (const u of ordered) {
-    const surfaces = Object.keys(u.surfaces).length === 0 ? "\u2014" : Object.entries(u.surfaces).sort().map(([sf, st]) => `${sf} (${st})`).join(", ");
+    const surfaces = formatSurfacePairs(u.surfaces, u.certification);
     const origin = u.origin === "template" ? " [template]" : "";
     line(`  ${u.state.padEnd(8)} ${u.key.padEnd(36)} ${surfaces}${origin}`);
   }
@@ -3066,18 +5396,30 @@ function runStatus(args) {
     for (const r of filtered.removed) line(`    ${r.key} \u2014 was on: ${r.surfaces.join(", ")}`);
   }
   line(
-    "  \u2192 pasco status --mark <ledgerKey> <surface> confirms a paste; --write-checklist regenerates CHECKLIST.md"
+    `  certification: ${certificationLineOf(filtered)} (surfaces carry staleness/certification)`
+  );
+  if (publication.length === 0) {
+    line(
+      publicationAll.length === 0 ? "  no surface published yet \u2014 run pasco build, or confirm a paste with --mark" : `  no surface published on ${args.platformArg} \u2014 ${publicationAll.length} surface(s) elsewhere; drop the platform filter to see them`
+    );
+  } else {
+    section("publication truth \u2014 derived, never stored (SPEC \xA720.1)");
+    for (const truth of publication) {
+      line(`  ${publicationLine(truth)}`);
+      if (truth.artifactReason !== void 0) {
+        line(`    artifact: ${artifactDetail(truth.artifactReason)}`);
+      }
+      for (const finding2 of truth.findings) {
+        line(`    warn: [${finding2.code}] ${finding2.message} (${finding2.path})`);
+      }
+    }
+    line(`  coverage: ${publicationCoverageLine(publication)}`);
+  }
+  line(
+    "  \u2192 pasco status --mark <ledgerKey> <surface> confirms a paste; --verify [platform] runs the opt-in C1 live check; --write-checklist regenerates CHECKLIST.md"
   );
   return EXIT.OK;
 }
-function summaryOf(data) {
-  return {
-    total: data.units.length,
-    inSync: data.units.filter((u) => u.state === "in-sync").length,
-    stale: data.units.filter((u) => u.state === "stale").length,
-    never: data.units.filter((u) => u.state === "never").length
-  };
-}
 
 // src/commands/validate.ts
 function runValidate(args) {
@@ -3101,7 +5443,14 @@ function runValidate(args) {
     }
     throw err;
   }
-  const drift = driftCheck(profile);
+  const drift = driftCheck(profile).filter((issue) => {
+    if (issue.code !== "drift/active-variant-missing") return true;
+    const platform = issue.surfaces?.[0];
+    if (platform === void 0) return true;
+    const active = profile.active?.[platform];
+    if (active === void 0) return true;
+    return !hasVariantBody(args.workspace, platform, active.variantId);
+  });
   const geo = geoCheck(profile);
   if (isJsonMode()) {
     return report("validate", true, EXIT.OK, {
@@ -3129,10 +5478,29 @@ function runValidate(args) {
   return EXIT.OK;
 }
 
+// src/fetch-http.ts
+var httpFetchText = async (url) => {
+  try {
+    const response = await fetch(url, {
+      // F7: following a redirect would let the FINAL hop leave the declared
+      // allowlist the caller validated BEFORE this request — `raw.githubusercontent`
+      // serving a redirect is also a signal something is off. A 3xx then lands in
+      // the pass's honest `http-<code>` bucket like any other non-2xx.
+      redirect: "error",
+      headers: {
+        "user-agent": "pasco-verify (+https://github.com/ChristianLuciani/profile-as-code)"
+      }
+    });
+    return { status: response.status, text: await response.text() };
+  } catch {
+    return { status: 0 };
+  }
+};
+
 // src/index.ts
 var VERSION = (() => {
   try {
-    const pkg = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
+    const pkg = JSON.parse(readFileSync10(new URL("../package.json", import.meta.url), "utf8"));
     return pkg.version;
   } catch {
     return "0.0.0";
@@ -3150,11 +5518,16 @@ Commands:
                                 full variant flow M3)
   check [platform]              Executes offline rules: brand handle matrix (M6/\xA717,
                                 brand flavor), registry checks (M7/\xA718.8) and
-                                media-transport rules (M8/\xA718.6); content/checks.yaml
-                                rows are listed as not executed (M3/M4)
-  status [platform] [--mark \u2026]   Per-entry deploy report \u2014 origin \xB7 surfaces \xB7 in-sync/stale/never (D18)
-  skills:install <agent>        Prints the skills-studio projection command (AGOS);
-                                projecting stays the studio's job, not the CLI's
+                                media-transport rules (M8/\xA718.6) and max-chars/min-chars
+                                over headlines/bios (offline, #240); remaining rows M3/M4
+  post <subcommand>             MVP (week-1 experiment): seed \u2192 task bundle \u2192 choose \u2192
+                                check \u2192 optional Postiz draft payload. No LLM call.
+                                Subcommands: seed \xB7 task \xB7 choose \xB7 check \xB7 export \xB7 import \xB7 list
+  status [platform] [--verify]   Per-entry deploy report \u2014 origin \xB7 surfaces \xB7 in-sync/stale/never
+                                 + certification (D18/\xA719.5); --verify runs the opt-in C1
+                                 live check (the engine's ONE network path, \xA719.5)
+  skills:export <dir>           Copy the skill channels this package ships into <dir>
+          [--force] [--list]     (--force overlays; --list shows them); no harness paths
 
 Common flags (after the command):
   --workspace <path>  Workspace path (resolution: --workspace > .pascorc > cwd, D14)
@@ -3199,9 +5572,13 @@ README.md, .pascorc. Minimal but pasco validate-clean. Refuses to overwrite.
   validate: `pasco validate [--json] [--workspace <path>]
 Load + validate the workspace (D12): schema violations FAIL (exit 1); drift and
 GEO are warnings (exit 0). See schema/README.md "Validation semantics".`,
-  build: `pasco build [platform] [--lang <l>] [--json] [--workspace <path>]
+  build: `pasco build [platform] [--view <name>] [--lang <l>] [--json] [--workspace <path>]
 Deterministic base texts per platform+lang (compile() slices). No platform =
-all platforms. lang defaults to .pascorc defaults.lang or 'en'.`,
+all platforms. lang defaults to .pascorc defaults.lang or 'en'.
+--view resolves a declared view (D22/\xA721): its rule may carry the platform, the
+lang and the fact selection, so the surface shows a SUBSET of the SSOT. Every
+omission is reported as a warning; an addressed key that resolves to nothing is
+an error. No selection policy = byte-identical output.`,
   diff: `pasco diff [--json] [--workspace <path>]
 Git-based: what changed since the last tag matching release-* (.pascorc
 diff.tagPattern) \u2014 commits + changed content files \u2192 CHANGELOG hint.`,
@@ -3212,27 +5589,67 @@ content/active.yaml. No LLM call, no hub. Full variant flow: M3.`,
   check: `pasco check [platform] [--json] [--workspace <path>]
 Executes the offline rules that exist today: the brand handle matrix (brand
 flavor, D15/\xA717), registry checks (M7/\xA718.8) and media-transport rules
-(M8/\xA718.6). Rows declared in content/checks.yaml (schema-validated catalog)
-are listed and reported as not executed \u2014 rule execution for those ships with
-the skills checks.yaml union (M3) and the full pasco check (M4). Prints its
-owner line (src/commands/check.ts).`,
-  "skills:install": `pasco skills:install <agent>
-Prints the skills-studio projection command for <agent> (pi|claude|aionui|opencode).
-Projection is the skills-studio job (AGOS), not the CLI's.`,
-  status: `pasco status [platform] [--mark <ledgerKey> <surface>] [--at <iso8601>] [--write-checklist] [--completeness] [--json] [--workspace <path>]
+(M8/\xA718.6), plus max-chars/min-chars over the headline/bio rows that exist
+(offline, #240; optional surface selector). Remaining rows in
+content/checks.yaml ship with the skills checks.yaml union (M3) and the full
+pasco check (M4). Prints its owner line (src/commands/check.ts).`,
+  "skills:export": `pasco skills:export <dir> [--force] [--json]
+pasco skills:export --list [--json]
+Copies the skill channels this package ships (SPEC \xA716) into a directory you
+name. --list shows them; an existing non-empty directory needs --force (files are
+overlaid, nothing is deleted). No harness-specific destination is invented.`,
+  post: `pasco post <seed|task|choose|check|export|import|list> [...] [--json] [--workspace <path>]
+MVP (week-1 experiment): a post is a PROJECTION of a seed, not an identity fact.
+  seed <id> --text <file>          create posts/<id>/seed.md + post.yaml
+  task <id> --channel <c1,c2> [--variants N]
+                                   emit posts/<id>/<channel>/task.md (agent task:
+                                   seed + facts + skill + channel rules); no LLM call
+  choose <id> --channel <c> --variant <v> [--text <file>]
+                                   record the chosen variant in post.yaml
+  check <id>                       max-chars, URLs only from the SSOT, {{fact:...}}
+                                   refs resolve; unsourced numeric claims warn
+  export <id> [--target postiz] [--out <file>] [--type draft|schedule|now] [--date <iso>]
+                                   build a Postiz POST /posts payload (integration
+                                   IDs from postiz.yaml; REPLACE_ME when missing)
+  import <dir> --channel <c>       import historical .md posts as seeds
+  list                             list seeds and their chosen variants`,
+  status: `pasco status [platform] [--mark <ledgerKey> <surface>] [--at <iso8601>] [--verify] [--write-checklist] [--completeness] [--json] [--workspace <path>]
 Per-entry deploy-status report (D18, \xA719): ledger key \xB7 origin (template/user) \xB7
-surfaces published \xB7 sync state (in-sync / stale / never) \u2014 plus untracked rows
-(add an id to track) and removed keys (ledger keeps the audit trail).
+surfaces published \xB7 sync state (in-sync / stale / never) \xB7 certification
+(verified / attested / unverifiable / out-of-band-drift, \xA719.5) \u2014 plus untracked
+rows (add an id to track) and removed keys (ledger keeps the audit trail).
+It ends with the DERIVED publication truth per surface (SPEC \xA720.1, #242):
+  <surface>: <sync> \xB7 artifact: <matches-SSOT|diverges|absent> \xB7 limits: <ok|over(cap)>
+\u2014 the artifact on disk vs what the SSOT renders TODAY (offline; offline cap
+warnings carry their source). Derived, never stored: nothing here writes.
   --mark <ledgerKey> <surface>  confirm a manual paste: records deployedAt + the
         CURRENT contentHash in content/deployments.yaml (only pasco writes it,
-        D14). --at overrides the timestamp.
+        D14) plus certification.state attested \u2014 and the artifactHash ANCHOR when
+        the surface can produce one. --at overrides the timestamp. The anchor is
+        the digest of profiles/<surface>/README.md (what \`pasco build\` wrote, so
+        \`--lang\` is honoured); with no build artifact on disk it renders at
+        .pascorc defaults.lang instead.
+  --verify [platform]           \xA719.5 C1: the opt-in live check \u2014 the engine's ONE
+        network-touching path. Resolves each recorded surface's artifact URL from
+        the URL SSOT, validates its host against the surface's declared allowlist
+        BEFORE any request, fetches sequentially without retries (one request per
+        surface), and updates certification in place. v1: GitHub raw only; an
+        unavailable check is unverifiable WITH the honest reason, never an error.
+        A record with no anchor reads unverifiable: unattributed (anchors are
+        forward-only in v1 \u2014 re-confirm with --mark to record one).
   --write-checklist             regenerate CHECKLIST.md from the ledger + the
-        completeness line (AUTO-GENERATED view \u2014 do not edit by hand).
+        completeness line (AUTO-GENERATED view \u2014 do not edit by hand). Each
+        surface carries its certification token.
   --completeness                profile-completeness checklist + percentage
         (issue #102). Policy (target/weights/langs) from .pascorc "completeness";
-        the percentage is DERIVED \u2014 only the policy is ever stored.`
+        the percentage is DERIVED \u2014 only the policy is ever stored. Carries the
+        publication-coverage line (SPEC \xA720.1): coverage, never a new score.
+  --selection [--view <name>]   the resolved VIEW (D22/\xA721): what the surface
+        emits, every entry it omits and WHY. Read-only. Policy from .pascorc
+        "selection". Subset-only by design \u2014 the report exists so an omission is
+        never silent.`
 };
-function runMain() {
+async function runMain() {
   const argv = process.argv.slice(2);
   if (argv.length === 0) {
     process.stderr.write(`${GLOBAL_HELP}
@@ -3284,20 +5701,24 @@ function runMain() {
       return runValidate({ workspace });
     }
     case "build": {
-      const { flags, positionals } = parseCommandFlags(rest, { lang: { type: "string" } });
+      const { flags, positionals } = parseCommandFlags(rest, {
+        lang: { type: "string" },
+        view: { type: "string" }
+      });
       if (flags.help === true) {
         process.stdout.write(`${COMMAND_HELP.build}
 `);
         return EXIT.OK;
       }
       if (positionals.length > 1)
-        throw new UsageError("usage: pasco build [platform] [--lang <l>] [--json]");
+        throw new UsageError("usage: pasco build [platform] [--view <name>] [--lang <l>] [--json]");
       setJsonMode(flags.json === true);
       const workspace = resolveWorkspace(process.cwd(), flags.workspace);
       const pascorc = readWorkspacePascorc(workspace);
       return runBuild({
         workspace,
         platformArg: positionals[0],
+        viewArg: flags.view,
         langArg: flags.lang,
         pascorc
       });
@@ -3356,12 +5777,54 @@ function runMain() {
       const workspace = resolveWorkspace(process.cwd(), flags.workspace);
       return runCheck({ workspace, platformArg: positionals[0] });
     }
+    case "post": {
+      const { flags, positionals } = parseCommandFlags(rest, {
+        channel: { type: "string" },
+        variants: { type: "string" },
+        variant: { type: "string" },
+        text: { type: "string" },
+        target: { type: "string" },
+        out: { type: "string" },
+        type: { type: "string" },
+        date: { type: "string" }
+      });
+      if (flags.help === true) {
+        process.stdout.write(`${COMMAND_HELP.post}
+`);
+        return EXIT.OK;
+      }
+      if (positionals.length < 1 || positionals.length > 2) {
+        throw new UsageError(
+          "usage: pasco post <seed|task|choose|check|export|import|list> [<seed-id|dir>] [flags]"
+        );
+      }
+      setJsonMode(flags.json === true);
+      const workspace = resolveWorkspace(process.cwd(), flags.workspace);
+      const pascorc = readWorkspacePascorc(workspace);
+      return runPost({
+        workspace,
+        subcommand: positionals[0],
+        ...positionals[1] !== void 0 ? { seedArg: positionals[1] } : {},
+        channelArg: flags.channel,
+        variantsArg: flags.variants,
+        variantArg: flags.variant,
+        textArg: flags.text,
+        targetArg: flags.target,
+        outArg: flags.out,
+        typeArg: flags.type,
+        dateArg: flags.date,
+        pascorc
+      });
+    }
     case "status": {
       const { flags, positionals } = parseCommandFlags(rest, {
         mark: { type: "string" },
         at: { type: "string" },
         "write-checklist": { type: "boolean" },
-        completeness: { type: "boolean" }
+        completeness: { type: "boolean" },
+        selection: { type: "boolean" },
+        view: { type: "string" },
+        verify: { type: "boolean" }
       });
       if (flags.help === true) {
         process.stdout.write(`${COMMAND_HELP.status}
@@ -3376,28 +5839,67 @@ function runMain() {
           "usage: pasco status [platform] [--write-checklist | --completeness] [--json]"
         );
       }
+      if (flags.verify === true && flags.mark !== void 0) {
+        throw new UsageError(
+          "usage: --verify and --mark are both ledger write paths \u2014 run them separately"
+        );
+      }
+      if (flags.verify === true && flags["write-checklist"] === true) {
+        throw new UsageError(
+          "usage: --verify writes the ledger and --write-checklist writes CHECKLIST.md \u2014 run them separately"
+        );
+      }
+      if (flags.verify === true && flags.completeness === true) {
+        throw new UsageError(
+          "usage: --verify is a live check and --completeness is a read-only report \u2014 run them separately"
+        );
+      }
       setJsonMode(flags.json === true);
       const workspace = resolveWorkspace(process.cwd(), flags.workspace);
-      return runStatus({
+      const pascorc = readWorkspacePascorc(workspace);
+      return await runStatus({
         workspace,
         platformArg: positionals[0],
         markKey: flags.mark,
         markAt: flags.at,
         writeChecklist: flags["write-checklist"],
         completeness: flags.completeness,
-        completenessPolicy: readWorkspacePascorc(workspace).completeness
+        selection: flags.selection,
+        viewArg: flags.view,
+        verify: flags.verify,
+        completenessPolicy: pascorc.completeness,
+        selectionPolicy: pascorc.selection,
+        // §19.5: the `--mark` anchor renders at the same lang `pasco build` wrote,
+        // so the digest is of the pasted artifact, not an approximation.
+        lang: defaultsLang(pascorc),
+        // §19.5: the HTTP driver is the production dep; the surface capabilities
+        // are resolved PER WORKSPACE from the loaded profile (`verify.ts`), not
+        // passed here — `artifactUrl` reads this workspace's URL SSOT. Tests
+        // inject both through `deps`.
+        deps: { fetchText: httpFetchText }
       });
     }
-    case "skills:install": {
-      const { flags, positionals } = parseCommandFlags(rest);
+    case "skills:export": {
+      const { flags, positionals } = parseCommandFlags(rest, {
+        list: { type: "boolean" },
+        force: { type: "boolean" }
+      });
       if (flags.help === true) {
-        process.stdout.write(`${COMMAND_HELP["skills:install"]}
+        process.stdout.write(`${COMMAND_HELP["skills:export"]}
 `);
         return EXIT.OK;
       }
-      if (positionals.length > 1) throw new UsageError("usage: pasco skills:install <agent>");
+      if (positionals.length > 1) {
+        throw new UsageError(
+          "usage: pasco skills:export <dir> [--force] | pasco skills:export --list"
+        );
+      }
       setJsonMode(flags.json === true);
-      return runSkillsInstall({ agent: positionals[0] });
+      return runSkillsExport({
+        dir: positionals[0],
+        list: flags.list === true,
+        force: flags.force === true
+      });
     }
     default:
       throw new UsageError(
@@ -3407,7 +5909,7 @@ function runMain() {
 }
 var exitCode;
 try {
-  exitCode = runMain();
+  exitCode = await runMain();
 } catch (err) {
   if (err instanceof UsageError) {
     process.stderr.write(`usage: ${err.message}