@profile-as-code/cli 0.3.7 → 0.4.0

package/dist/index.js

@@ -1,9 +1,298 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync16 } from "fs";
 import { parseArgs } from "util";
 
+// ../core/dist/registry.js
+function isPublicEntry(entry) {
+  return (entry.visibility ?? "public") === "public";
+}
+function credentialLdEntries(credentials) {
+  return credentials.filter(isPublicEntry).map((c) => ({
+    "@type": "EducationalOccupationalCredential",
+    ...c.title ? { name: c.title } : {},
+    ...c.verifyUrl !== void 0 ? { url: c.verifyUrl } : {},
+    ...c.issuer ? { awardedBy: { "@type": "Organization", name: c.issuer } } : {},
+    ...c.issued !== void 0 ? { validFrom: c.issued } : {},
+    ...c.expires !== void 0 ? { validThrough: c.expires } : {}
+  }));
+}
+function integrity(path, message) {
+  return { path, message };
+}
+function idsOf(entries) {
+  const map = /* @__PURE__ */ new Map();
+  for (const [index, entry] of (entries ?? []).entries()) {
+    if (entry.id === void 0)
+      continue;
+    map.set(entry.id, index);
+  }
+  return map;
+}
+function duplicateIssues(block, entries) {
+  const issues = [];
+  const seen = /* @__PURE__ */ new Map();
+  for (const [index, entry] of (entries ?? []).entries()) {
+    if (entry.id === void 0)
+      continue;
+    const first = seen.get(entry.id);
+    if (first !== void 0) {
+      issues.push(integrity(`${block}[${index}].id`, `duplicate registry id "${entry.id}" (first used at ${block}[${first}]) \u2014 registry ids are unique per block (load fails, D12 fail class)`));
+    } else {
+      seen.set(entry.id, index);
+    }
+  }
+  return issues;
+}
+function locatorIssues(entries) {
+  const issues = [];
+  for (const [index, entry] of (entries ?? []).entries()) {
+    const hasUrl = entry.locator?.url !== void 0;
+    const hasPath = entry.locator?.path !== void 0;
+    if (hasUrl === hasPath) {
+      issues.push(integrity(`artifacts[${index}].locator`, `locator must have exactly one of "url" | "path" (\xA718.3 capability matrix) \u2014 got ${hasUrl ? "both" : "neither"}`));
+    }
+  }
+  return issues;
+}
+function refIssues(profile) {
+  const credentialIds = idsOf(profile.credentials);
+  const artifactIds = idsOf(profile.artifacts);
+  const issues = [];
+  for (const [pIndex, project] of (profile.projects ?? []).entries()) {
+    for (const [eIndex, evidence] of (project.evidence ?? []).entries()) {
+      if (evidence.credentialId !== void 0 && !credentialIds.has(evidence.credentialId)) {
+        issues.push(integrity(`projects[${pIndex}].evidence[${eIndex}].credentialId`, `references credentials[].id "${evidence.credentialId}" which does not exist (dangling cross-ref, load fails)`));
+      }
+      if (evidence.artifactId !== void 0 && !artifactIds.has(evidence.artifactId)) {
+        issues.push(integrity(`projects[${pIndex}].evidence[${eIndex}].artifactId`, `references artifacts[].id "${evidence.artifactId}" which does not exist (dangling cross-ref, load fails)`));
+      }
+    }
+    for (const [rIndex, ref] of (project.artifactRefs ?? []).entries()) {
+      if (!artifactIds.has(ref)) {
+        issues.push(integrity(`projects[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
+      }
+    }
+  }
+  for (const [pIndex, pub] of (profile.publications ?? []).entries()) {
+    for (const [rIndex, ref] of (pub.artifactRefs ?? []).entries()) {
+      if (!artifactIds.has(ref)) {
+        issues.push(integrity(`publications[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
+      }
+    }
+  }
+  for (const [pIndex, press] of (profile.press ?? []).entries()) {
+    for (const [rIndex, ref] of (press.artifactRefs ?? []).entries()) {
+      if (!artifactIds.has(ref)) {
+        issues.push(integrity(`press[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
+      }
+    }
+  }
+  return issues;
+}
+function checkRegistryIntegrity(profile) {
+  return [
+    ...duplicateIssues("credentials", profile.credentials),
+    ...duplicateIssues("artifacts", profile.artifacts),
+    ...locatorIssues(profile.artifacts),
+    ...refIssues(profile)
+  ];
+}
+function todayIso() {
+  const now = /* @__PURE__ */ new Date();
+  const mm = String(now.getMonth() + 1).padStart(2, "0");
+  const dd = String(now.getDate()).padStart(2, "0");
+  return `${now.getFullYear()}-${mm}-${dd}`;
+}
+function registryCheck(profile, options = {}) {
+  const findings = [];
+  const credentials = profile.credentials ?? [];
+  const artifacts = profile.artifacts ?? [];
+  const today = options.today ?? todayIso();
+  for (const [index, credential] of credentials.entries()) {
+    if (credential.expires !== void 0 && credential.expires < today) {
+      findings.push({
+        code: "check/credential-expired",
+        severity: "warn",
+        message: `credential "${credential.title}" (${credential.id}) expired ${credential.expires} \u2014 renew or update the workspace`,
+        path: `credentials[${index}]`
+      });
+    }
+  }
+  const nonPublic = (id, kind, list) => {
+    if (id === void 0)
+      return void 0;
+    const entry = list.find((e) => e.id === id);
+    if (entry === void 0 || entry.visibility === void 0 || isPublicEntry(entry))
+      return void 0;
+    return { blockPath: `${kind}[${list.indexOf(entry)}]`, visibility: entry.visibility, id };
+  };
+  const flagLeak = (leak, refPath, where) => {
+    if (leak === void 0)
+      return;
+    findings.push({
+      code: "check/private-in-public-output",
+      severity: "error",
+      message: `${where} references registry entry "${leak.id}" with visibility "${leak.visibility}" \u2014 public output renders only public entries (\xA718.5); make it public or drop the reference`,
+      path: refPath
+    });
+  };
+  for (const [pIndex, project] of (profile.projects ?? []).entries()) {
+    for (const [eIndex, evidence] of (project.evidence ?? []).entries()) {
+      flagLeak(nonPublic(evidence.credentialId, "credentials", credentials), `projects[${pIndex}].evidence[${eIndex}].credentialId`, "evidence claim attests a credential");
+      flagLeak(nonPublic(evidence.artifactId, "artifacts", artifacts), `projects[${pIndex}].evidence[${eIndex}].artifactId`, "evidence claim proves an artifact");
+    }
+    for (const [rIndex, ref] of (project.artifactRefs ?? []).entries()) {
+      flagLeak(nonPublic(ref, "artifacts", artifacts), `projects[${pIndex}].artifactRefs[${rIndex}]`, "project row");
+    }
+  }
+  for (const [pIndex, pub] of (profile.publications ?? []).entries()) {
+    for (const [rIndex, ref] of (pub.artifactRefs ?? []).entries()) {
+      flagLeak(nonPublic(ref, "artifacts", artifacts), `publications[${pIndex}].artifactRefs[${rIndex}]`, "publication");
+    }
+  }
+  for (const [pIndex, press] of (profile.press ?? []).entries()) {
+    for (const [rIndex, ref] of (press.artifactRefs ?? []).entries()) {
+      flagLeak(nonPublic(ref, "artifacts", artifacts), `press[${pIndex}].artifactRefs[${rIndex}]`, "press mention");
+    }
+  }
+  return findings;
+}
+
+// ../core/dist/achievements.js
+var DEFAULT_ACHIEVEMENT_DIRECTION = "increase";
+function directionMet(value, target, direction) {
+  switch (direction) {
+    case "increase":
+      return value >= target;
+    case "decrease":
+      return value <= target;
+    case "maintain":
+      return value === target;
+  }
+}
+function achievementStatus(achievement) {
+  if (achievement.kind !== "metric")
+    return void 0;
+  const metric = achievement.metric;
+  if (metric === void 0)
+    return void 0;
+  const { value, target } = metric;
+  if (target !== void 0 && value === void 0)
+    return "planned";
+  if (value !== void 0 && target === void 0)
+    return "measured";
+  if (value === void 0 || target === void 0)
+    return void 0;
+  const direction = metric.direction ?? DEFAULT_ACHIEVEMENT_DIRECTION;
+  return directionMet(value, target, direction) ? "achieved" : "partial";
+}
+function achievementScope(achievements) {
+  const scope = {
+    total: achievements.length,
+    planned: 0,
+    measured: 0,
+    achieved: 0,
+    partial: 0
+  };
+  for (const achievement of achievements) {
+    const status = achievementStatus(achievement);
+    if (status !== void 0)
+      scope[status] += 1;
+  }
+  return scope;
+}
+var ACHIEVEMENT_REF_BLOCKS = [
+  "experience",
+  "projects",
+  "publications",
+  "education",
+  "press",
+  "credentials",
+  "artifacts"
+];
+function declaredIds(profile) {
+  const rows = {
+    experience: profile.experience,
+    projects: profile.projects,
+    publications: profile.publications,
+    education: profile.education,
+    press: profile.press,
+    credentials: profile.credentials,
+    artifacts: profile.artifacts
+  };
+  const map = /* @__PURE__ */ new Map();
+  for (const block of ACHIEVEMENT_REF_BLOCKS) {
+    const ids = /* @__PURE__ */ new Set();
+    for (const row of rows[block] ?? [])
+      if (row.id !== void 0)
+        ids.add(row.id);
+    map.set(block, ids);
+  }
+  return map;
+}
+function issue(path, message) {
+  return { path, message };
+}
+function checkAchievementIntegrity(profile) {
+  const issues = [];
+  const achievements = profile.achievements ?? [];
+  const ids = declaredIds(profile);
+  const credentials = profile.credentials ?? [];
+  const artifacts = profile.artifacts ?? [];
+  const seen = /* @__PURE__ */ new Map();
+  for (const [index, achievement] of achievements.entries()) {
+    const first = seen.get(achievement.id);
+    if (first !== void 0) {
+      issues.push(issue(`achievements[${index}].id`, `duplicate achievement id "${achievement.id}" (first used at achievements[${first}]) \u2014 achievement ids are unique per block (load fails, D12 fail class)`));
+    } else {
+      seen.set(achievement.id, index);
+    }
+    if (achievement.kind === "metric" && achievement.metric === void 0) {
+      issues.push(issue(`achievements[${index}].metric`, `kind: metric requires a "metric" block (unit is required; value/target/baseline are the numbers) \u2014 without it there is no status to derive`));
+    }
+    if (achievement.kind === "milestone" && achievement.metric !== void 0) {
+      issues.push(issue(`achievements[${index}].metric`, `kind: milestone must NOT carry a "metric" block \u2014 a point event has no progress to derive; use kind: metric, or move the numbers into the statement`));
+    }
+    for (const [refIndex, ref] of (achievement.refs ?? []).entries()) {
+      const separator = ref.indexOf(":");
+      const block = ref.slice(0, separator);
+      const id = ref.slice(separator + 1);
+      if (!ids.get(block)?.has(id)) {
+        issues.push(issue(`achievements[${index}].refs[${refIndex}]`, `references ${block}[].id "${id}" which does not exist (dangling cross-ref, load fails)`));
+      }
+    }
+    if (achievement.credentialId !== void 0) {
+      const credential = credentials.find((c) => c.id === achievement.credentialId);
+      if (credential === void 0) {
+        issues.push(issue(`achievements[${index}].credentialId`, `references credentials[].id "${achievement.credentialId}" which does not exist (dangling cross-ref, load fails)`));
+      } else if (achievement.visibility === "public" && !isPublicEntry(credential)) {
+        issues.push(issue(`achievements[${index}].credentialId`, `a public achievement attests credential "${credential.id}" with visibility "${credential.visibility}" \u2014 public output renders only public entries (\xA718.5); make it public, or make the achievement non-public`));
+      }
+    }
+    if (achievement.artifactId !== void 0) {
+      const artifact = artifacts.find((a) => a.id === achievement.artifactId);
+      if (artifact === void 0) {
+        issues.push(issue(`achievements[${index}].artifactId`, `references artifacts[].id "${achievement.artifactId}" which does not exist (dangling cross-ref, load fails)`));
+      } else if (achievement.visibility === "public" && !isPublicEntry(artifact)) {
+        issues.push(issue(`achievements[${index}].artifactId`, `a public achievement points at artifact "${artifact.id}" with visibility "${artifact.visibility}" \u2014 public output renders only public entries (\xA718.5); make it public, or make the achievement non-public`));
+      }
+    }
+    if (achievement.visibility === "public") {
+      for (const [refIndex, ref] of (achievement.refs ?? []).entries()) {
+        const separator = ref.indexOf(":");
+        const block = ref.slice(0, separator);
+        const id = ref.slice(separator + 1);
+        const target = block === "credentials" ? credentials.find((c) => c.id === id) : block === "artifacts" ? artifacts.find((a) => a.id === id) : void 0;
+        if (target !== void 0 && !isPublicEntry(target)) {
+          issues.push(issue(`achievements[${index}].refs[${refIndex}]`, `a public achievement references ${block}[].id "${id}" with visibility "${target.visibility}" \u2014 public output renders only public entries (\xA718.5)`));
+        }
+      }
+    }
+  }
+  return issues;
+}
+
 // ../core/dist/byte-order.js
 function byteOrder(a, b) {
   return a < b ? -1 : a > b ? 1 : 0;
@@ -242,10 +531,17 @@ var HANDLE_HOSTS = {
 };
 
 // ../core/dist/types.js
-function textOf(v) {
+function textOf(v, lang) {
   if (v == null)
     return "";
-  return typeof v === "string" ? v : v.en ?? "";
+  if (typeof v === "string")
+    return v;
+  if (lang !== void 0) {
+    const direct = v[lang];
+    if (direct)
+      return direct;
+  }
+  return v.en ?? "";
 }
 var PLATFORMS = PLATFORM_SLUGS;
 var LANGS = ["en", "es", "fr"];
@@ -309,7 +605,7 @@ function driftCheck(profile) {
   const issues = [];
   const identity = profile.identity;
   const identityUrls = new Set((identity.links ?? []).map((link) => normalizeUrl(link.url)));
-  const push = (issue) => issues.push(issue);
+  const push = (issue2) => issues.push(issue2);
   const links = identity.links ?? [];
   const linkGroups = groupBy(links, (link) => normalizeUrl(link.url));
   for (const [url, indices] of linkGroups) {
@@ -446,162 +742,6 @@ function driftCheck(profile) {
   return issues;
 }
 
-// ../core/dist/registry.js
-function isPublicEntry(entry) {
-  return (entry.visibility ?? "public") === "public";
-}
-function credentialLdEntries(credentials) {
-  return credentials.filter(isPublicEntry).map((c) => ({
-    "@type": "EducationalOccupationalCredential",
-    ...c.title ? { name: c.title } : {},
-    ...c.verifyUrl !== void 0 ? { url: c.verifyUrl } : {},
-    ...c.issuer ? { awardedBy: { "@type": "Organization", name: c.issuer } } : {},
-    ...c.issued !== void 0 ? { validFrom: c.issued } : {},
-    ...c.expires !== void 0 ? { validThrough: c.expires } : {}
-  }));
-}
-function integrity(path, message) {
-  return { path, message };
-}
-function idsOf(entries) {
-  const map = /* @__PURE__ */ new Map();
-  for (const [index, entry] of (entries ?? []).entries()) {
-    if (entry.id === void 0)
-      continue;
-    map.set(entry.id, index);
-  }
-  return map;
-}
-function duplicateIssues(block, entries) {
-  const issues = [];
-  const seen = /* @__PURE__ */ new Map();
-  for (const [index, entry] of (entries ?? []).entries()) {
-    if (entry.id === void 0)
-      continue;
-    const first = seen.get(entry.id);
-    if (first !== void 0) {
-      issues.push(integrity(`${block}[${index}].id`, `duplicate registry id "${entry.id}" (first used at ${block}[${first}]) \u2014 registry ids are unique per block (load fails, D12 fail class)`));
-    } else {
-      seen.set(entry.id, index);
-    }
-  }
-  return issues;
-}
-function locatorIssues(entries) {
-  const issues = [];
-  for (const [index, entry] of (entries ?? []).entries()) {
-    const hasUrl = entry.locator?.url !== void 0;
-    const hasPath = entry.locator?.path !== void 0;
-    if (hasUrl === hasPath) {
-      issues.push(integrity(`artifacts[${index}].locator`, `locator must have exactly one of "url" | "path" (\xA718.3 capability matrix) \u2014 got ${hasUrl ? "both" : "neither"}`));
-    }
-  }
-  return issues;
-}
-function refIssues(profile) {
-  const credentialIds = idsOf(profile.credentials);
-  const artifactIds = idsOf(profile.artifacts);
-  const issues = [];
-  for (const [pIndex, project] of (profile.projects ?? []).entries()) {
-    for (const [eIndex, evidence] of (project.evidence ?? []).entries()) {
-      if (evidence.credentialId !== void 0 && !credentialIds.has(evidence.credentialId)) {
-        issues.push(integrity(`projects[${pIndex}].evidence[${eIndex}].credentialId`, `references credentials[].id "${evidence.credentialId}" which does not exist (dangling cross-ref, load fails)`));
-      }
-      if (evidence.artifactId !== void 0 && !artifactIds.has(evidence.artifactId)) {
-        issues.push(integrity(`projects[${pIndex}].evidence[${eIndex}].artifactId`, `references artifacts[].id "${evidence.artifactId}" which does not exist (dangling cross-ref, load fails)`));
-      }
-    }
-    for (const [rIndex, ref] of (project.artifactRefs ?? []).entries()) {
-      if (!artifactIds.has(ref)) {
-        issues.push(integrity(`projects[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
-      }
-    }
-  }
-  for (const [pIndex, pub] of (profile.publications ?? []).entries()) {
-    for (const [rIndex, ref] of (pub.artifactRefs ?? []).entries()) {
-      if (!artifactIds.has(ref)) {
-        issues.push(integrity(`publications[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
-      }
-    }
-  }
-  for (const [pIndex, press] of (profile.press ?? []).entries()) {
-    for (const [rIndex, ref] of (press.artifactRefs ?? []).entries()) {
-      if (!artifactIds.has(ref)) {
-        issues.push(integrity(`press[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
-      }
-    }
-  }
-  return issues;
-}
-function checkRegistryIntegrity(profile) {
-  return [
-    ...duplicateIssues("credentials", profile.credentials),
-    ...duplicateIssues("artifacts", profile.artifacts),
-    ...locatorIssues(profile.artifacts),
-    ...refIssues(profile)
-  ];
-}
-function todayIso() {
-  const now = /* @__PURE__ */ new Date();
-  const mm = String(now.getMonth() + 1).padStart(2, "0");
-  const dd = String(now.getDate()).padStart(2, "0");
-  return `${now.getFullYear()}-${mm}-${dd}`;
-}
-function registryCheck(profile, options = {}) {
-  const findings = [];
-  const credentials = profile.credentials ?? [];
-  const artifacts = profile.artifacts ?? [];
-  const today = options.today ?? todayIso();
-  for (const [index, credential] of credentials.entries()) {
-    if (credential.expires !== void 0 && credential.expires < today) {
-      findings.push({
-        code: "check/credential-expired",
-        severity: "warn",
-        message: `credential "${credential.title}" (${credential.id}) expired ${credential.expires} \u2014 renew or update the workspace`,
-        path: `credentials[${index}]`
-      });
-    }
-  }
-  const nonPublic = (id, kind, list) => {
-    if (id === void 0)
-      return void 0;
-    const entry = list.find((e) => e.id === id);
-    if (entry === void 0 || entry.visibility === void 0 || isPublicEntry(entry))
-      return void 0;
-    return { blockPath: `${kind}[${list.indexOf(entry)}]`, visibility: entry.visibility, id };
-  };
-  const flagLeak = (leak, refPath, where) => {
-    if (leak === void 0)
-      return;
-    findings.push({
-      code: "check/private-in-public-output",
-      severity: "error",
-      message: `${where} references registry entry "${leak.id}" with visibility "${leak.visibility}" \u2014 public output renders only public entries (\xA718.5); make it public or drop the reference`,
-      path: refPath
-    });
-  };
-  for (const [pIndex, project] of (profile.projects ?? []).entries()) {
-    for (const [eIndex, evidence] of (project.evidence ?? []).entries()) {
-      flagLeak(nonPublic(evidence.credentialId, "credentials", credentials), `projects[${pIndex}].evidence[${eIndex}].credentialId`, "evidence claim attests a credential");
-      flagLeak(nonPublic(evidence.artifactId, "artifacts", artifacts), `projects[${pIndex}].evidence[${eIndex}].artifactId`, "evidence claim proves an artifact");
-    }
-    for (const [rIndex, ref] of (project.artifactRefs ?? []).entries()) {
-      flagLeak(nonPublic(ref, "artifacts", artifacts), `projects[${pIndex}].artifactRefs[${rIndex}]`, "project row");
-    }
-  }
-  for (const [pIndex, pub] of (profile.publications ?? []).entries()) {
-    for (const [rIndex, ref] of (pub.artifactRefs ?? []).entries()) {
-      flagLeak(nonPublic(ref, "artifacts", artifacts), `publications[${pIndex}].artifactRefs[${rIndex}]`, "publication");
-    }
-  }
-  for (const [pIndex, press] of (profile.press ?? []).entries()) {
-    for (const [rIndex, ref] of (press.artifactRefs ?? []).entries()) {
-      flagLeak(nonPublic(ref, "artifacts", artifacts), `press[${pIndex}].artifactRefs[${rIndex}]`, "press mention");
-    }
-  }
-  return findings;
-}
-
 // ../core/dist/structured-data.js
 var DEFAULT_LINK_ROLE = "realization";
 function linkRole(link) {
@@ -770,6 +910,7 @@ function structuredData(profile, lang = "en") {
 }
 
 // ../core/dist/geo.js
+var GEO_BASIS_VERSION = "geo-heuristic-v2";
 var CONFLICT_CODES = /* @__PURE__ */ new Set([
   "drift/date-range-inverted",
   "drift/duplicate-experience",
@@ -867,22 +1008,26 @@ function definitionEntries(profile) {
 }
 function freshnessFacts(profile) {
   const facts = {};
+  const instant = (when) => ({ when, precision: "instant" });
   for (const [key, rows] of Object.entries(profile.deployments ?? {})) {
     for (const [surface, rec] of Object.entries(rows ?? {})) {
-      facts[`${key}\u2192${surface}`] = rec.deployedAt;
+      facts[`${key}\u2192${surface}`] = instant(rec.deployedAt);
     }
   }
   for (const p of profile.press ?? []) {
     if (p.date)
-      facts[`press:${(p.outlet ?? p.url ?? "?").toString().slice(0, 40)}`] = p.date;
+      facts[`press:${(p.outlet ?? p.url ?? "?").toString().slice(0, 40)}`] = instant(p.date);
   }
   for (const c of profile.credentials ?? []) {
     if (c.issued)
-      facts[`credential:${c.title}`] = c.issued;
+      facts[`credential:${c.title}`] = instant(c.issued);
   }
   if ((profile.publications ?? []).length > 0) {
     const newestYear = Math.max(...(profile.publications ?? []).map((p) => p.year));
-    facts["publications:newest-year"] = `${newestYear}-12-31`;
+    facts["publications:newest-year"] = {
+      when: `${newestYear}-12-31`,
+      precision: "year"
+    };
   }
   return facts;
 }
@@ -891,20 +1036,30 @@ function freshnessWindowStart(now = Date.now()) {
   windowStart.setUTCMonth(windowStart.getUTCMonth() - 12);
   return windowStart.getTime();
 }
+function isFutureDated(fact, now) {
+  if (fact.precision === "year") {
+    return Number(fact.when.slice(0, 4)) > new Date(now).getUTCFullYear();
+  }
+  return Date.parse(fact.when) > now;
+}
+function freshnessLabel(fact) {
+  return fact.precision === "year" ? fact.when.slice(0, 4) : fact.when;
+}
 function readFreshness(profile, now = Date.now()) {
   const windowStart = freshnessWindowStart(now);
   const reading = { future: [] };
-  for (const [key, when] of Object.entries(freshnessFacts(profile))) {
-    const t = Date.parse(when);
-    if (Number.isNaN(t))
+  for (const [key, fact] of Object.entries(freshnessFacts(profile))) {
+    const at2 = Date.parse(fact.when);
+    if (Number.isNaN(at2))
       continue;
-    if (t > now)
-      reading.future.push({ key, when });
-    else if (t >= windowStart) {
-      if (!reading.fresh || t > Date.parse(reading.fresh.when))
-        reading.fresh = { key, when };
-    } else if (!reading.stale || t > Date.parse(reading.stale.when))
-      reading.stale = { key, when };
+    const hit = { key, when: freshnessLabel(fact), at: at2 };
+    if (isFutureDated(fact, now))
+      reading.future.push(hit);
+    else if (at2 >= windowStart) {
+      if (!reading.fresh || at2 > reading.fresh.at)
+        reading.fresh = hit;
+    } else if (!reading.stale || at2 > reading.stale.at)
+      reading.stale = hit;
   }
   return reading;
 }
@@ -946,9 +1101,21 @@ function nameCollisionObservation(profile) {
   }
   return { kind: "unqualified" };
 }
+function geoSection(label, detail, subset) {
+  const applicable = subset.filter((check) => check.applicable !== false);
+  const weight = applicable.reduce((sum, check) => sum + check.weight, 0);
+  const score = weight === 0 ? 0 : Math.round(applicable.reduce((sum, check) => sum + check.score * check.weight, 0) / weight * 100);
+  return {
+    label,
+    detail,
+    checks: subset,
+    score,
+    ...weight === 0 ? { applicable: false } : {}
+  };
+}
 function geoCheck(profile, lang = "en") {
   const identity = profile.identity;
-  const conflicts = driftCheck(profile).filter((issue) => CONFLICT_CODES.has(issue.code));
+  const conflicts = driftCheck(profile).filter((issue2) => CONFLICT_CODES.has(issue2.code));
   const targets = targetedPlatforms(profile);
   const targetsWithBio = [...targets].filter((platform) => (profile.bios ?? []).some((b) => b.platform === platform)).length;
   const targetsWithHeadline = [...targets].filter((platform) => (profile.headlines ?? []).some((h) => h.platform === platform)).length;
@@ -959,6 +1126,7 @@ function geoCheck(profile, lang = "en") {
   const citablePublications = publications.filter((p) => p.doi || p.orcidId).length;
   const projects = profile.projects ?? [];
   const projectsWithEvidence = projects.filter((p) => (p.evidence ?? []).length > 0).length;
+  const hasAnyEvidence = projectsWithEvidence > 0;
   const evidenceWithVerified = projects.flatMap((p) => p.evidence ?? []).filter((e) => Boolean(e.verified)).length;
   const totalEvidence = projects.flatMap((p) => p.evidence ?? []).length;
   const freshness = readFreshness(profile);
@@ -1063,8 +1231,12 @@ function geoCheck(profile, lang = "en") {
       code: "geo/evidence-claims",
       label: "Projects carry verifiable evidence[]",
       weight: 0.08,
-      score: projects.length === 0 ? 1 : projectsWithEvidence / projects.length,
-      detail: projects.length === 0 ? "no projects" : `${projectsWithEvidence}/${projects.length} projects with evidence; ${evidenceWithVerified}/${totalEvidence} evidence claims have a verified date`
+      // §8/#399 (option C): N/A while no project declares evidence. The declared
+      // coverage signal lives in §20's completeness `evidence` item, so absence is
+      // not subtracted twice. Once evidence is declared, the ratio is scored.
+      applicable: hasAnyEvidence,
+      score: hasAnyEvidence ? projectsWithEvidence / projects.length : 1,
+      detail: !hasAnyEvidence ? "not applicable \u2014 no project declares evidence[]; evidence coverage is scored by profile completeness (SPEC \xA720)" : `${projectsWithEvidence}/${projects.length} projects with evidence; ${evidenceWithVerified}/${totalEvidence} evidence claims have a verified date`
     },
     // ── Citability v2 (v1.10, issue #289) — the five codes §8's table declares.
     // The weights below take the 0.20 freed by the ×0.8 dilution of the nine
@@ -1137,7 +1309,9 @@ function geoCheck(profile, lang = "en") {
       // absence of freshness degrades citability without changing the pass story.
       severity: "info",
       // Calendar 12-month window; future-dated facts cannot evidence freshness
-      // (fresh-pass F4: a typo'd 2099 deploy used to score 1).
+      // (fresh-pass F4: a 2099 deploy used to score 1). A year-precision datum
+      // is read at year granularity — a current-year publication is not future
+      // (#438).
       score: freshness.fresh !== void 0 ? 1 : 0,
       // The anomaly is reported whenever future-dated facts are OBSERVED (r2
       // fresh-pass F1 of #321) — fresh, failing or both — never only in the
@@ -1212,17 +1386,13 @@ function geoCheck(profile, lang = "en") {
       })()
     }
   ];
-  const totalWeight = checks.reduce((sum, check) => sum + check.weight, 0);
-  const score = Math.round(checks.reduce((sum, check) => sum + check.score * check.weight, 0) / totalWeight * 100);
-  const section2 = (label, detail, subset) => {
-    const weight = subset.reduce((sum, check) => sum + check.weight, 0);
-    const sectionScore = Math.round(subset.reduce((sum, check) => sum + check.score * check.weight, 0) / weight * 100);
-    return { label, detail, checks: subset, score: sectionScore };
-  };
+  const scored = checks.filter((check) => check.applicable !== false);
+  const totalWeight = scored.reduce((sum, check) => sum + check.weight, 0);
+  const score = Math.round(scored.reduce((sum, check) => sum + check.score * check.weight, 0) / totalWeight * 100);
   const sections = {
-    factConsistency: section2("Fact consistency", "An LLM triangulating platforms must find the same dates/roles/papers.", checks.filter((c) => c.code.startsWith("geo/conflicts") || c.code.startsWith("geo/platform-"))),
+    factConsistency: geoSection("Fact consistency", "An LLM triangulating platforms must find the same dates/roles/papers.", checks.filter((c) => c.code.startsWith("geo/conflicts") || c.code.startsWith("geo/platform-"))),
     structuredData: {
-      ...section2(
+      ...geoSection(
         "Structured-data readiness",
         // Mirrors `ready = Boolean(name)` exactly (structured-data.ts). The old string still
         // claimed "need name + ≥1 sameAs link" — the predicate it no longer uses, i.e. the
@@ -1241,10 +1411,10 @@ function geoCheck(profile, lang = "en") {
       readiness: sd
     },
     semanticAssociations: {
-      ...section2("Semantic associations", "The 3\u20135 anchors an LLM should associate with the person, reinforced across surfaces.", checks.filter((c) => c.code === "geo/semantic-anchors")),
+      ...geoSection("Semantic associations", "The 3\u20135 anchors an LLM should associate with the person, reinforced across surfaces.", checks.filter((c) => c.code === "geo/semantic-anchors")),
       anchors
     },
-    citability: section2(
+    citability: geoSection(
       "Citability",
       // The v1.10 framing (#289): citability is a DIFFERENT property from
       // consistency, and it is the one a buyer pays for — resolvable claims,
@@ -1253,7 +1423,7 @@ function geoCheck(profile, lang = "en") {
       checks.filter((c) => c.code.startsWith("geo/citable") || c.code.startsWith("geo/evidence") || c.code.startsWith("geo/canonical") || c.code.startsWith("geo/faq") || c.code.startsWith("geo/freshness") || c.code.startsWith("geo/sameas-coverage") || c.code.startsWith("geo/name-collision"))
     )
   };
-  return { score, sections, checks };
+  return { score, sections, checks, basis: GEO_BASIS_VERSION, measured: false };
 }
 
 // ../core/dist/normalize.js
@@ -1320,14 +1490,14 @@ function findTerm(folded, term) {
   const out = [];
   let from = 0;
   for (; ; ) {
-    const at = folded.text.indexOf(needle, from);
-    if (at === -1)
+    const at2 = folded.text.indexOf(needle, from);
+    if (at2 === -1)
       break;
-    const end = at + needle.length;
-    if (isWordBounded(folded.text, at, end)) {
-      out.push({ start: folded.starts[at] ?? 0, end: folded.ends[end - 1] ?? 0 });
+    const end = at2 + needle.length;
+    if (isWordBounded(folded.text, at2, end)) {
+      out.push({ start: folded.starts[at2] ?? 0, end: folded.ends[end - 1] ?? 0 });
     }
-    from = at + 1;
+    from = at2 + 1;
   }
   return out;
 }
@@ -1336,12 +1506,12 @@ function termOccursIn(folded, term, from, to) {
   if (needle === "")
     return false;
   const haystack = folded.text.slice(from, to);
-  let at = haystack.indexOf(needle);
-  while (at !== -1) {
-    const end = at + needle.length;
-    if (isWordBounded(haystack, at, end))
+  let at2 = haystack.indexOf(needle);
+  while (at2 !== -1) {
+    const end = at2 + needle.length;
+    if (isWordBounded(haystack, at2, end))
       return true;
-    at = haystack.indexOf(needle, at + 1);
+    at2 = haystack.indexOf(needle, at2 + 1);
   }
   return false;
 }
@@ -1946,7 +2116,9 @@ function checkLedgerIntegrity(profile) {
 // ../core/dist/completeness.js
 var COMPLETENESS_CATALOG = [
   { id: "presence", label: "Required blocks present", block: "profile", weight: 0.3 },
-  { id: "langCoverage", label: "Language coverage (en/es/fr)", block: "langMaps", weight: 0.15 },
+  // No language list in the catalog label: the policy names the langs it
+  // measures, so the report appends them (`Language coverage (en/es)`).
+  { id: "langCoverage", label: "Language coverage", block: "langMaps", weight: 0.15 },
   { id: "geoAnchors", label: "GEO semantic anchors", block: "positioning.geo", weight: 0.15 },
   { id: "evidence", label: "Claims carry evidence", block: "projects.evidence", weight: 0.15 },
   { id: "deployment", label: "Deployed to a surface", block: "deployments", weight: 0.25 }
@@ -2016,6 +2188,9 @@ function langMaps(profile) {
   for (const [i, a] of (profile.artifacts ?? []).entries()) {
     push(`artifacts[${i}].description`, a.description);
   }
+  for (const [i, achievement] of (profile.achievements ?? []).entries()) {
+    push(`achievements[${i}].statement`, achievement.statement);
+  }
   push("newsletter.name", profile.newsletter?.name);
   push("newsletter.description", profile.newsletter?.description);
   push("podcast.title", profile.podcast?.title);
@@ -2115,6 +2290,11 @@ function deploymentScore(profile) {
   const deployed = units.filter((u) => Object.keys(profile.deployments[u.key] ?? {}).length > 0).length;
   return { score: deployed / units.length, detail: `${deployed}/${units.length} units deployed` };
 }
+function itemLabel(entry, langs) {
+  if (entry.id !== "langCoverage" || langs.length === 0)
+    return entry.label;
+  return `${entry.label} (${langs.join("/")})`;
+}
 function completeness(profile, policy = DEFAULT_COMPLETENESS_POLICY) {
   const target = policy.target ?? DEFAULT_COMPLETENESS_POLICY.target ?? "";
   const langs = policy.langs ?? DEFAULT_COMPLETENESS_POLICY.langs ?? ["en"];
@@ -2135,7 +2315,7 @@ function completeness(profile, policy = DEFAULT_COMPLETENESS_POLICY) {
     const clamped = Math.max(0, Math.min(1, score));
     items.push({
       id: entry.id,
-      label: entry.label,
+      label: itemLabel(entry, langs),
       block: entry.block,
       score: clamped,
       weight,
@@ -2167,8 +2347,8 @@ import { parseDocument } from "yaml";
 
 // ../core/dist/generated/schema.zod.js
 import { z } from "zod";
-var profileSchema = z.object({ "identity": z.object({ "name": z.string().min(1), "email": z.string().regex(new RegExp(`^[^@\\s"']+@[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+$`)).describe("v1.5 (additive, issue #71): contact email of the person/brand (schema.org `email` on Person/Organization). A fact like name/location \u2014 NOT a link: renderers emit it as a mailto: href in the Links section and as the JSON-LD `email` property; `sameAs` stays page-URLs-only. Lives OUTSIDE identity.links[] by design \u2014 the ^https?:// rule of $defs/url (issue #53) stays strict on every URL field, so a mailto: row in links[] fails validation (D12). RFC-5322-adjacent (issue #71 review): local part lax (no whitespace/quotes), domain hostname-shaped (labels [A-Za-z0-9-], no empty/trailing/consecutive dots \u2014 unicode domains must use punycode).").optional(), "definition": langMapKeys(z.object({ "en": z.string().min(1).max(160) }).catchall(z.string().min(1).max(160))).describe("v1.10 (issue #288): the canonical definition per language \u2014 one sentence of the form 'X is a \u2026' an answer engine can quote verbatim. \u2264 160 chars per value (what an answer engine quotes); MUST contain the entity name \u2014 JSON Schema cannot express it: the check is `geo/canonical-definition` in geoCheck v2 (#289). EN required (langMap rule, D8/\xA711); the propertyNames restriction shares the langMap precedent (issue #86, F3 \u2014 gen-zod reconstructs it).").optional(), "handle": z.string().describe("v1.1: primary handle (e.g. X @cluciani_ve).").optional(), "timezone": z.string().describe("v1.1: IANA timezone (e.g. America/Guayaquil).").optional(), "orgName": z.string().min(1).describe("v1.1 (additive, brand): legal/registered org name when it differs from the display name (name = display, e.g. 'Topia Press').").optional(), "logo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "brandVoice": z.object({ "tone": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "values": z.array(z.string()).optional(), "avoid": z.array(z.string()).optional() }).strict().describe("v1.1 (additive, brand): tone matrix seed \u2014 overall tone (langMap), core values, words/tones to avoid. Per-platform voice refinement lives in the platform skill (\xA717).").optional(), "mission": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "tagline": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "established": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "location": z.string().optional(), "nationality": z.string().regex(new RegExp("^[A-Z]{2}$")).describe("v1.13 (issue #334): ISO 3166-1 alpha-2 nationality code (uppercase, e.g. `VE`), a fact distinct from `location` (residence). Maps to schema.org `Person.nationality` as a `Country` node with `identifier` on the JSON-LD. Person-only by the standard's model: a `flavor: brand` workspace may declare it (identity is shared) but the Organization branch emits no `nationality` node \u2014 the value is not silently rewritten into a brand fact. The pattern asserts ISO 3166-1 alpha-2 FORM only \u2014 `ve`, `Venezuela` and `VEN` fail loudly (ECMA-262 pattern, no flags; D12 fail class); membership in the published code list is not enforced. Optional: outside the structured-data `ready` gate and completeness ratio, so absence changes nothing.").optional(), "photo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "links": z.array(z.object({ "platform": z.string().optional(), "label": z.string().optional(), "role": z.enum(["identity", "realization", "aggregator"]).describe("v1.6 (#103): the ROLE this link plays with respect to the entity \u2014 a translation layer of this engine onto schema.org, never standard vocabulary. `identity` \u2192 schema.org:url (the page IS the entity; strong authority; the one eligible for JSON-LD @id). `realization` (DEFAULT when absent) \u2192 schema.org:sameAs (the page indirectly indicates the entity; weak authority; these \u2014 and only these \u2014 form the sameAs set). `aggregator` \u2192 schema.org:mainEntityOfPage (link-in-bio / redirector that aggregates references to the entity; medium authority; never eligible for @id). Absence keeps every pre-v1.6 workspace VALIDATING unchanged (additive) \u2014 it does NOT keep the output byte-identical: v1.6 also makes github-readme emit jobTitle/worksFor, narrows sameAs to realization links (+ claimed handles), and adds the geo/entity-id gap report.").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.") }).strict()).describe("Canonical link set. Renderers and skills read URLs ONLY from here \u2014 no per-platform URL duplication (drift source). v1.6 (#103): items carry an optional `role` distinguishing the entity's own page (schema.org:url) from pages that merely indicate it (schema.org:sameAs) or aggregate references to it (schema.org:mainEntityOfPage).").optional() }).strict(), "flavor": z.enum(["person", "brand"]).describe("v1.1 (additive): workspace flavor (D15). person (default, absent = person) or brand. Brand enables the org identity variant, the socialHandles/newsletter/podcast/press/audiences blocks and Organization GEO (\xA717).").optional(), "socialHandles": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "handle": z.string().min(1), "status": z.enum(["claimed", "pending"]), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "note": z.string().optional() }).strict().describe("v1.1 (additive, brand): one row of the brand handle matrix (platform \u2192 handle + claim status). Seed source: the operator's brand-handles availability sweep (\xA717).")).describe("v1.1 (additive, brand): the brand handle matrix \u2014 one row per platform with claim status. Seeded from the operator's brand-handles availability sweep (\xA717).").optional(), "newsletter": z.object({ "platform": z.enum(["substack", "ghost"]).describe("v1.1 (additive, brand): newsletter hosts the engine models (Substack now, Ghost later)."), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "name": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "cadence": z.string().optional() }).strict().describe("v1.1 (additive, brand): the brand's newsletter surface. The name/description double as the GEO-visible text (RSS/LLM-readable).").optional(), "podcast": z.object({ "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "platform": z.enum(["spotify", "rss"]).describe("v1.1 (additive, brand): podcast distribution modeled in v1.1 (Spotify for Creators / standalone RSS).").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "rss": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "status": z.enum(["planned", "live"]).optional() }).strict().describe("v1.1 (additive, brand): the brand's podcast \u2014 show metadata + RSS (GEO-citable via RSS).").optional(), "press": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "outlet": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]), "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "date": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the work behind this mention. press keeps its domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("v1.1 (additive, brand): a media mention \u2014 outlet, headline, resolvable URL, date (verifiable claims, \xA78).")).describe("v1.1 (additive, brand): media mentions of the brand (verifiable, dated).").optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("v1.1 (additive, brand): brand audiences \u2014 reader profiles (not recruiters). Audience name \u2192 per-lang angle (same shape as positioning.audiences; brand-facing).").optional(), "positioning": z.object({ "statement": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("Audience name \u2192 per-lang angle (e.g. recruiter / client / academia).").optional(), "geo": z.object({ "semanticAssociations": z.array(z.string()).min(3).max(5).describe("3-5 anchors an LLM should associate with the person (e.g. 'f\xEDsica', 'innovaci\xF3n educativa', 'soberan\xEDa de IA'). Seeded without stuffing (\xA78).").optional(), "citationsGoal": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().optional() }).strict().optional(), "bios": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "length": z.enum(["short", "medium", "long"]), "text": z.string().min(1) }).strict()).describe("Curated bio per platform+lang+length. Generated by `pasco refine`, chosen by the user, stored here.").optional(), "headlines": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "text": z.string().min(1) }).strict()).describe("Headline per platform+lang (the 1-line under the name).").optional(), "skills": z.array(z.object({ "name": z.string().min(1), "level": z.enum(["novice", "intermediate", "advanced", "expert"]).optional(), "keywords": z.array(z.string()).optional(), "geoKeywords": z.array(z.string()).describe("Terms a generative engine should match this skill with (GEO layer, D7).").optional(), "platformWeights": z.record(z.string(), z.number().gte(0).lte(1)).describe("How much this skill matters per platform (0..1). Feeds renderer keyword placement.").optional() }).strict()).optional(), "experience": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "role": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1: string. v1.1 (additive): langMap \u2014 bilingual role titles."), "org": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'USFQ', 'Nimbus Labs'). Not a langMap: institutions are never translated (SPEC \xA711)."), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "highlights": z.union([langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), langMapKeys(z.object({ "en": z.array(z.string()) }).catchall(z.array(z.string())))]).describe("v1: langMap of strings (separator-delimited). v1.1 (additive): langMap of string arrays (bullets).").optional() }).strict().describe("start <= end is NOT expressible in JSON Schema \u2014 enforced by core.driftCheck (\xA712 note).")).optional(), "education": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "degree": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: degree title (string or bilingual langMap)."), "institution": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'Universidad Central de Venezuela'). Not a langMap: institutions are never translated (SPEC \xA711)."), "field": z.union([z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: field of study (string or bilingual langMap).").optional(), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "note": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().describe("v1.1 (additive): formal education entry.")).describe("v1.1 (additive): formal education. v1 workspaces keep education inside experience[] with role = degree.").optional(), "languages": z.array(z.object({ "code": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "level": z.enum(["native", "fluent", "advanced", "intermediate", "basic"]) }).strict()).describe("v1.1 (additive): spoken languages. v1 workspaces document them as comments in skills.yaml.").optional(), "projects": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "name": z.string().min(1), "status": z.enum(["active", "maintained", "archived", "experimental", "planning"]).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "links": z.array(z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.")).optional(), "keywords": z.array(z.string()).optional(), "evidence": z.array(z.object({ "claim": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "source": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "verified": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "credentialId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "artifactId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional() }).strict().describe("Verifiable claim with source. Anti-pattern: unverifiable claims (dropped by cite-aware systems, \xA78).")).optional(), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.12 (D17/\xA718.1, issue #333): references `artifacts[].id` \u2014 the work behind this row. projects keep their domain (no duplication); target resolved by core (load fails on a dangling ref). Published-vs-in-development is DERIVED from the targets (`visibility` + `locator.url`), never stored (\xA720.1).").optional() }).strict()).optional(), "publications": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "title": z.string().min(1), "venue": z.string().min(1), "year": z.number().int().gte(1900).lte(2100), "kind": z.enum(["journal-article", "preprint", "conference-abstract"]).describe("v1.14 (issue #349): the output's structured classification \u2014 journal-article (peer-reviewed, arbitrated), preprint (not yet peer-reviewed), conference-abstract (extended abstract, typically not full peer review). Closed enum, additive and extensible in a future minor. `peerReviewed` is DERIVED from `kind == journal-article` and never stored \u2014 the same derive-never-store discipline as published-vs-in-development (\xA720.1): a boolean exception needs a documented decision first. Optional: a row without `kind` validates and renders byte-identically to a pre-v1.14 workspace, so existing workspaces stay valid. Consumers that need counts MUST require the field explicitly instead of inferring it from `venue` \u2014 venue stays a free string, and a new venue must never fail a check.").optional(), "authors": z.string().describe("v1.1: author string (e.g. 'Luciani, C.' or 'Zambrano et al.').").optional(), "doi": z.string().regex(new RegExp("^10\\.\\d{4,9}/\\S+$")).optional(), "orcidId": z.string().regex(new RegExp("^\\d{4}-\\d{4}-\\d{4}-\\d{3}[\\dX]$")).optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the dataset/code behind this paper. publications keep their domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("DOI/ORCID must be resolvable \u2014 GEO citability anchor (LLMs resolve them).")).describe("Citable research output \u2014 a peer-reviewed article, a preprint or a conference abstract, classified by the optional `kind` (v1.14); `peerReviewed` is derived from `kind == journal-article`, never stored. DOI/ORCID resolvable \u2192 GEO citability.").optional(), "keywords": z.object({ "seo": z.record(z.string(), z.array(z.string())).describe("Per-platform SEO keyword sets (fed by each platform skill's research).").optional(), "geo": z.object({ "associations": z.array(z.string()).optional(), "claims": z.array(z.string()).optional() }).strict().optional() }).strict().optional(), "checks": z.array(z.object({ "id": z.string().optional(), "platform": z.enum(["all", "github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Dedup contract: MUST equal ['all', ...$defs/platform.enum] \u2014 scripts/schema-check asserts it (D16)."), "rule": z.enum(["max-chars", "min-chars", "url-live", "fact-present", "geo-consistent", "lang-present", "link-in-identity", "handle-claimed", "handle-consistent"]).describe("Rule catalog (extensible). Skills' checks.yaml use the same catalog; `pasco check` runs the union. v1.1 (brand \xA717): handle-claimed (a claimed handle must resolve to a URL) and handle-consistent (handle matrix coherent across surfaces)."), "value": z.union([z.number(), z.string(), z.boolean(), z.array(z.string())]), "note": z.string().optional(), "surface": z.enum(["headline", "bio", "both"]).describe("Additive (#240): which text rows a char-limit rule applies to. Absent = both. A title cap can target `headline` without flagging the bio.").optional() }).strict()).describe("User-level declarative checks; unioned with the platform skill's checks.yaml by `pasco check`.").optional(), "active": z.record(z.string(), z.object({ "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "variantId": z.string().min(1), "chosenAt": z.string().datetime({ offset: true }) }).strict().describe("The chosen variant id \u2014 user picked it (D11); variant body lives in the workspace variants store.")).describe("Which bio/headline variant is LIVE per platform (D11: user picks, engine records).").optional(), "deployments": z.record(z.string(), z.record(z.string(), z.object({ "deployedAt": z.string().datetime({ offset: true }), "contentHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "source": z.enum(["manual", "git", "api"]), "certification": z.union([z.object({ "state": z.literal("verified"), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "method": z.literal("fetch"), "fetchedAt": z.string().datetime({ offset: true }), "liveHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "evidenceUrl": z.string().url().regex(new RegExp("^https?://")).min(7).optional() }).strict().describe("\xA719.5 C1: a deterministic pass fetched the live artifact, applied the surface's extractor, and the live digest EQUALS the stored anchor. The fetch evidence is required \u2014 a `verified` with no fetch behind it is not evidence."), z.object({ "state": z.literal("attested"), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")).optional() }).strict().describe("\xA719.5 C2: the human `--mark`. Certified by ASSERTION, never rendered as a bare `in-sync`. `artifactHash` is the anchor written at confirmation when the surface has an extractor; a mark on a surface without one records no anchor (the declared forward-only v1 limit, \xA719.5)."), z.object({ "state": z.literal("unverifiable"), "reason": z.string().regex(new RegExp("^(walled|walled-con-api|host-not-allowed|network-error|no-artifact-url|no-extractor|unattributed|http-[0-9]{3})$")).describe("\xA719.5: the declared reasons, the attempt reasons, and `http-<code>` for the ACTUAL status the pass observed. `http-` accepts ANY 3-digit code \u2014 an enum of just http-403/http-429 made a routine 404/500 write a ledger the next `load()` rejects (review F1). One alternation rather than `enum \u222A pattern`: the Zod generator cannot express that union (it degrades to an untyped schema, which its safety net refuses), so the alternatives are pinned by the pattern and by fixtures instead."), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")).optional(), "method": z.literal("fetch").optional(), "fetchedAt": z.string().datetime({ offset: true }).optional(), "evidenceUrl": z.string().url().regex(new RegExp("^https?://")).min(7).optional() }).strict().describe("\xA719.5: no deterministic check is possible, or one was attempted and did not complete. DECLARED reasons (walled \xB7 walled-con-api \xB7 no-extractor \xB7 no-artifact-url) are the PASS's knowledge \u2014 it states them for its own output and writes nothing, so a workspace needs no ledger row per walled platform and the file keeps only durable evidence; ATTEMPTED ones (http-<code> \xB7 network-error \xB7 unattributed \xB7 host-not-allowed) are RECORDED with the fetch evidence. `liveHash` is impossible here \u2014 a comparison would make the state lie; `artifactHash` is allowed because it is the deploy ANCHOR, not a comparison, and a failed check must not destroy it (\xA719.5: the anchor is left unchanged)."), z.object({ "state": z.literal("out-of-band-drift"), "reason": z.literal("live-mismatch"), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "liveHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "method": z.literal("fetch"), "fetchedAt": z.string().datetime({ offset: true }), "evidenceUrl": z.string().url().regex(new RegExp("^https?://")).min(7) }).strict().describe("\xA719.5: a C1 check COMPLETED and contradicts the ledger \u2014 the live digest differs from the anchor. Positive contrary evidence, never a strength of confirmation: the report must not fold it into a green state. Both digests and the fetch evidence are required so the contradiction is auditable.")]).optional() }).strict().describe("v1.3 (D18, \xA719.1): one confirmed deploy of a trackable unit on one surface. contentHash = SHA-256 of the canonical serialization (sorted keys, sans id/origin) of the unit AT deploy time \u2014 staleness is exact and release-tag-independent. v1.10 (issue #132, \xA719.5): the optional `certification` block adds the second, orthogonal dimension.")).describe("v1.3 (D18): surface \u2192 deploy record. Surface keys are the ONE platform enum (D16) \u2014 also core-checked post-Zod (gen-zod drops propertyNames).")).describe("v1.3 (D18, \xA719): per-entry deploy ledger \u2014 ledgerKey \u2192 surface \u2192 record. Keys are constrained above for JSON Schema consumers; the generated Zod drops propertyNames, so core re-checks key patterns, surface enums, duplicate ids and ambiguous composite keys post-Zod (D12 fail class). Only `pasco` mutates this block (same write rule as refine --choose, D14).").optional(), "credentials": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["certificate", "title", "award", "patent"]).describe("D17/\xA718.2: third-party attestation kind."), "title": z.string().min(1).describe("Credential name (proper noun \u2192 invariant string, \xA711)."), "issuer": z.string().min(1).describe("Third-party attester (proper noun \u2192 invariant string, \xA711)."), "credentialId": z.string().min(1).describe("Issuer-side identifier (e.g. certificate serial). Certificates carry PII \u2014 visibility governs exposure (\xA718.5).").optional(), "verifyUrl": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "issued": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "expires": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a third-party attestation. JSON-LD payoff (\xA718.9): `Person.hasCredential` \u2192 `EducationalOccupationalCredential` (public only).")).describe("v1.4 (D17, \xA718): the proof layer \u2014 third-party attestations (certificates, titles, awards, patents). Pointer-first: the workspace declares pointers, the engine never owns binaries (D14). Naming discipline (\xA718.1): never called evidence.").optional(), "artifacts": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["portfolio", "gallery", "showreel", "dataset", "document", "code"]).describe("D17/\xA718.2: work/media kind."), "title": z.string().min(1).describe("Work title (proper noun \u2192 invariant string, \xA711)."), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "locator": z.object({ "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "path": z.string().min(1).describe("In-workspace `media/\u2026` or external under PASCO_EVIDENCE_ROOT \u2014 capability matrix (\xA718.3): NEVER emitted as a public URL while the workspace is private (D14); reaches public surfaces only via renderer assets/ output (M8).").optional() }).strict().describe("Exactly one of `url` | `path` (\xA718.3 capability matrix). The oneOf expresses the XOR for JSON Schema consumers; the generated Zod cannot express required-without-property, so core re-checks the XOR post-Zod (D12 fail class, ledger precedent)."), "checksum": z.string().regex(new RegExp("^sha256:[a-f0-9]{64}$")).describe("Immutable artifacts only (\xA718.6): recorded at compile for byte-stable bundling (M8).").optional(), "license": z.string().min(1).describe("Usage rights for the work (e.g. CC-BY-4.0).").optional(), "tags": z.array(z.string()).describe("Multi-area selection (\xA718.9): renderers select by platform + lang + tags; one workspace, many areas.").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a work or media item. JSON-LD payoff (\xA718.9): surfaces as CreativeWork/ImageGallery/VideoObject/Dataset per platform (renderer-curated, D5).")).describe("v1.4 (D17, \xA718): works/media items (portfolio, gallery, showreel, dataset, document, code), pointer-first via `locator`. Naming discipline (\xA718.1): never called evidence \u2014 canonical blocks keep their domains (publications/press/projects are NOT registry kinds, they reference registry ids).").optional(), "faq": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "q": langMapKeys(z.object({ "en": z.string().min(1).max(90) }).catchall(z.string().min(1).max(90))).describe("v1.10 (#288): the question, \u2264 90 chars per value. Unique per workspace \u2014 JSON Schema cannot express it: it is a geoCheck v2 rule (#289, `geo/faq-coverage`); duplicates collapse into one answer surface."), "a": langMapKeys(z.object({ "en": z.string().min(1).max(320) }).catchall(z.string().min(1).max(320))).describe("v1.10 (#288): the answer, \u2264 320 chars per value \u2014 beyond that it is prose, not an answer. The owner's assertion (D11/D14), never invented copy."), "source": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional() }).strict().describe("v1.10 (issue #288): ONE citable Q&A pair \u2014 the fact pair the `FAQPage` JSON-LD node projects (#316); the answer is the owner's assertion, rendered deterministically (same curation rule as `bios[]`).")).min(3).max(20).describe("v1.10 (issue #288): the citable answer surface \u2014 the questions THIS entity answers, as fact pairs (never generated copy, D11/D14). 3\u201320 entries: below 3 there is no surface; above 20 it is a page, not a profile. The `structuredData()` projection (a `FAQPage` node ONLY when present, never an empty FAQPage) ships in #316; the citability rules beyond JSON Schema are geoCheck v2 (#289).").optional(), "releases": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9-]*$")).describe("Stable release id (`v0-3-0`, `2026-10-launch`). The CLI addresses a release by it; it never changes."), "version": z.string().regex(new RegExp("^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$")).describe("The published semver version this event describes (the tag's version, not the schema version)."), "date": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "summary": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "changedUnits": z.array(z.string()).describe("The \xA719.2 ledger keys this release changed (`identity`, `projects:foo`, \u2026). The fan-out compares each declared surface against these units' ledger records.").optional(), "surfaces": z.array(z.string().min(1)).min(1).describe("The presence surfaces this release must reach, as platforms/registry.yaml slugs of any `kind` (profile \xB7 repo-meta \xB7 distribution). Order here is declaration order; `pasco release plan` sorts by kind (repo-meta \u2192 profile \u2192 distribution), then slug.") }).strict().describe("v1.15 (D23, #262): one release event. `changedUnits[]` + `surfaces[]` are the fan-out; the state per surface is DERIVED from the \xA719 ledger, never stored here.")).describe("v1.15 (D23, #262): the release event and its fan-out. A release is the unit that has surfaces and a changed set; `pasco release plan` derives the ordered fan-out from it, reusing the \xA719 ledger semantics (in-sync/stale/never) instead of a second state model. Optional and additive: a workspace without releases[] validates and every earlier command reads exactly as before.").optional() }).strict().describe("Contract source (D3) for a profile-data workspace. The core `load()` parses content/*.yaml, merges them into a single Profile and validates against THIS schema. Facts (dates, DOIs, URLs, ORCID) are language-independent and are the GEO anchor. Every text field is a langMap ({lang: value}) with EN required (D8, \xA711). Additive since v1 (semver minor): every earlier workspace still validates. v1.1: role as langMap (org stays invariant string), highlights as string[] per lang, publication.authors/url, root languages + education, identity.handle/timezone, patreon in checks; brand flavor (D15/\xA717) \u2014 `flavor`, org identity variant (orgName/logo/brandVoice/mission/tagline/established), socialHandles/newsletter/podcast/press/audiences blocks, brand platforms, handle checks. New in v1.2 (D16): platform set = Postiz parity + operator extras \u2014 43 platforms, one shared enum for both flavors, single-source dedup guard (check.platform). New in v1.3 (D18): per-entry deploy ledger \u2014 `deployments` (ledgerKey \u2192 surface \u2192 deployedAt/contentHash/source), optional stable `id`s on row blocks (experience/projects/publications/education/press), `origin: template` provenance flag. New in v1.4 (D17): evidence registry \u2014 `credentials[]` (third-party attestations: certificate/title/award/patent) and `artifacts[]` (works/media: portfolio/gallery/showreel/dataset/document/code), pointer-first (\xA718); `evidenceItem` gains `credentialId`/`artifactId` cross-refs, `publications[]`/`press[]` gain `artifactRefs`. Naming discipline (\xA718.1): the registry is never called evidence \u2014 `projects[].evidence[]` stays claims-only. New in v1.5 (issue #71): `identity.email` \u2014 the contact email as a first-class fact (schema.org `email` on Person/Organization), NOT a link \u2014 `links[]` stays http(s)-only (mailto: rejected, D12); a mailto: row in links[] broke the template and every real workspace after v1.4's scheme boundary (issue #53). New in v1.6 (issue #103): `identity.links[].role` \u2014 the link ROLE (`identity` | `realization` | `aggregator`), a translation layer onto schema.org (`url` | `sameAs` | `mainEntityOfPage`); absent role = `realization`, so every pre-v1.6 workspace stays VALIDATING unchanged (the rendered output does change \u2014 see \xA715.4). The JSON-LD `@id` is derived from the `role: identity` link and is ABSENT when no link carries it (never invented). Entity assembly moves to a single home (core/src/structured-data.ts), consumed by geoCheck and every renderer \u2014 the \xA718.9 credentialLdEntries precedent. New in v1.7 (issue #130): `kofi` \u2014 Ko-fi creator page as operator extra #10 (44 platforms), creator-monetization family; paste platform, no API deploy (D9). New in v1.8 (issue #133): `buymeacoffee`, `liberapay`, `gumroad`, `payhip` \u2014 the creator monetization platforms family (D16), operator extras #11\u2013#14 (48 platforms); the family is declared in SPEC and descriptions (docs-first), not as a hard schema field; all four are paste platforms, no API deploy (D9). New in v1.9 (issue #137): `hotmart` \u2014 the Hotmart digital-products storefront + memberships (Members Area / recurring billing) serving the Spanish/Portuguese-speaking markets, in the `creator-monetization` family as operator extra #15 (49 platforms); paste platform, no API deploy (D9) \u2014 no management API is documented for the profile body (developers.hotmart.com covers sales/products [?], fetched 2026-10-05). New in v1.10 (issue #288): the answer-engine surface \u2014 `identity.definition` (the canonical per-language definition: \u2264160 chars per value, must contain the entity name \u2014 the length cap is schema-enforced, the name check is a geoCheck rule, #289) and root `faq[]` (3\u201320 citable Q&A pairs: `q` \u226490 per value and unique per workspace, `a` \u2264320, optional `$defs/url` `source`; below 3 there is no surface, above 20 it is a page, not a profile). The `structuredData()` projection of these fields (Person `description` + a separate `FAQPage` JSON-LD node, only when the fields exist) ships in #316. The same minor completes the version label of the \xA719.5 certification additions (issue #132 \u2014 shipped in `d172dffc` under the v1.9 URI). New in v1.12 (issue #333): `projects[]` gains `artifactRefs` \u2014 the third reference site (publications and press were the first two) \u2014 so a project names the work behind it, and published-vs-in-development is DERIVED from those artifacts (`visibility: public` AND `locator.url`), never stored (\xA720.1's derived-never-stored rule). New in v1.13 (issue #334): `identity.nationality` \u2014 the ISO 3166-1 alpha-2 nationality code as a citable fact (uppercase, e.g. `VE`); schema.org `Person.nationality` \u2192 `Country` with `identifier` on the JSON-LD. Single-valued in v1.13 (dual nationality would need an array \u2014 a future additive change). Optional and additive: a workspace that omits it validates and scores as before (it is outside the structured-data `ready` gate and completeness ratio). New in v1.14 (issue #349): `publication.kind` \u2014 the closed output classification (`journal-article` | `preprint` | `conference-abstract`) that replaces per-consumer venue-string heuristics; `peerReviewed` is DERIVED from `kind == journal-article`, never stored. Optional and additive: a row without `kind` validates and renders exactly as before. New in v1.15 (D23, #262): `releases[]` \u2014 the release EVENT and its fan-out. Each row names the version, the date, an optional summary, the ledger units it changed (`changedUnits`, \xA719.2 keys) and the presence surfaces it must reach (`surfaces`, registry slugs of any `kind`). Additive: a workspace without `releases[]` validates unchanged and every pre-v1.15 command reads exactly the same profile.");
-var PROFILE_SCHEMA_VERSION = "1.15";
+var profileSchema = z.object({ "identity": z.object({ "name": z.string().min(1), "email": z.string().regex(new RegExp(`^[^@\\s"']+@[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+$`)).describe("v1.5 (additive, issue #71): contact email of the person/brand (schema.org `email` on Person/Organization). A fact like name/location \u2014 NOT a link: renderers emit it as a mailto: href in the Links section and as the JSON-LD `email` property; `sameAs` stays page-URLs-only. Lives OUTSIDE identity.links[] by design \u2014 the ^https?:// rule of $defs/url (issue #53) stays strict on every URL field, so a mailto: row in links[] fails validation (D12). RFC-5322-adjacent (issue #71 review): local part lax (no whitespace/quotes), domain hostname-shaped (labels [A-Za-z0-9-], no empty/trailing/consecutive dots \u2014 unicode domains must use punycode).").optional(), "definition": langMapKeys(z.object({ "en": z.string().min(1).max(160) }).catchall(z.string().min(1).max(160))).describe("v1.10 (issue #288): the canonical definition per language \u2014 one sentence of the form 'X is a \u2026' an answer engine can quote verbatim. \u2264 160 chars per value (what an answer engine quotes); MUST contain the entity name \u2014 JSON Schema cannot express it: the check is `geo/canonical-definition` in geoCheck v2 (#289). EN required (langMap rule, D8/\xA711); the propertyNames restriction shares the langMap precedent (issue #86, F3 \u2014 gen-zod reconstructs it).").optional(), "handle": z.string().describe("v1.1: primary handle (e.g. X @cluciani_ve).").optional(), "timezone": z.string().describe("v1.1: IANA timezone (e.g. America/Guayaquil).").optional(), "orgName": z.string().min(1).describe("v1.1 (additive, brand): legal/registered org name when it differs from the display name (name = display, e.g. 'Topia Press').").optional(), "logo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "brandVoice": z.object({ "tone": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "values": z.array(z.string()).optional(), "avoid": z.array(z.string()).optional() }).strict().describe("v1.1 (additive, brand): tone matrix seed \u2014 overall tone (langMap), core values, words/tones to avoid. Per-platform voice refinement lives in the platform skill (\xA717).").optional(), "mission": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "tagline": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "established": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "location": z.string().optional(), "nationality": z.string().regex(new RegExp("^[A-Z]{2}$")).describe("v1.13 (issue #334): ISO 3166-1 alpha-2 nationality code (uppercase, e.g. `VE`), a fact distinct from `location` (residence). Maps to schema.org `Person.nationality` as a `Country` node with `identifier` on the JSON-LD. Person-only by the standard's model: a `flavor: brand` workspace may declare it (identity is shared) but the Organization branch emits no `nationality` node \u2014 the value is not silently rewritten into a brand fact. The pattern asserts ISO 3166-1 alpha-2 FORM only \u2014 `ve`, `Venezuela` and `VEN` fail loudly (ECMA-262 pattern, no flags; D12 fail class); membership in the published code list is not enforced. Optional: outside the structured-data `ready` gate and completeness ratio, so absence changes nothing.").optional(), "photo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "links": z.array(z.object({ "platform": z.string().optional(), "label": z.string().optional(), "role": z.enum(["identity", "realization", "aggregator"]).describe("v1.6 (#103): the ROLE this link plays with respect to the entity \u2014 a translation layer of this engine onto schema.org, never standard vocabulary. `identity` \u2192 schema.org:url (the page IS the entity; strong authority; the one eligible for JSON-LD @id). `realization` (DEFAULT when absent) \u2192 schema.org:sameAs (the page indirectly indicates the entity; weak authority; these \u2014 and only these \u2014 form the sameAs set). `aggregator` \u2192 schema.org:mainEntityOfPage (link-in-bio / redirector that aggregates references to the entity; medium authority; never eligible for @id). Absence keeps every pre-v1.6 workspace VALIDATING unchanged (additive) \u2014 it does NOT keep the output byte-identical: v1.6 also makes github-readme emit jobTitle/worksFor, narrows sameAs to realization links (+ claimed handles), and adds the geo/entity-id gap report.").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.") }).strict()).describe("Canonical link set. Renderers and skills read URLs ONLY from here \u2014 no per-platform URL duplication (drift source). v1.6 (#103): items carry an optional `role` distinguishing the entity's own page (schema.org:url) from pages that merely indicate it (schema.org:sameAs) or aggregate references to it (schema.org:mainEntityOfPage).").optional() }).strict(), "flavor": z.enum(["person", "brand"]).describe("v1.1 (additive): workspace flavor (D15). person (default, absent = person) or brand. Brand enables the org identity variant, the socialHandles/newsletter/podcast/press/audiences blocks and Organization GEO (\xA717).").optional(), "socialHandles": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "handle": z.string().min(1), "status": z.enum(["claimed", "pending"]), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "note": z.string().optional() }).strict().describe("v1.1 (additive, brand): one row of the brand handle matrix (platform \u2192 handle + claim status). Seed source: the operator's brand-handles availability sweep (\xA717).")).describe("v1.1 (additive, brand): the brand handle matrix \u2014 one row per platform with claim status. Seeded from the operator's brand-handles availability sweep (\xA717).").optional(), "newsletter": z.object({ "platform": z.enum(["substack", "ghost"]).describe("v1.1 (additive, brand): newsletter hosts the engine models (Substack now, Ghost later)."), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "name": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "cadence": z.string().optional() }).strict().describe("v1.1 (additive, brand): the brand's newsletter surface. The name/description double as the GEO-visible text (RSS/LLM-readable).").optional(), "podcast": z.object({ "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "platform": z.enum(["spotify", "rss"]).describe("v1.1 (additive, brand): podcast distribution modeled in v1.1 (Spotify for Creators / standalone RSS).").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "rss": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "status": z.enum(["planned", "live"]).optional() }).strict().describe("v1.1 (additive, brand): the brand's podcast \u2014 show metadata + RSS (GEO-citable via RSS).").optional(), "press": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "outlet": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]), "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "date": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the work behind this mention. press keeps its domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("v1.1 (additive, brand): a media mention \u2014 outlet, headline, resolvable URL, date (verifiable claims, \xA78).")).describe("v1.1 (additive, brand): media mentions of the brand (verifiable, dated).").optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("v1.1 (additive, brand): brand audiences \u2014 reader profiles (not recruiters). Audience name \u2192 per-lang angle (same shape as positioning.audiences; brand-facing).").optional(), "positioning": z.object({ "statement": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("Audience name \u2192 per-lang angle (e.g. recruiter / client / academia).").optional(), "geo": z.object({ "semanticAssociations": z.array(z.string()).min(3).max(5).describe("3-5 anchors an LLM should associate with the person (e.g. 'f\xEDsica', 'innovaci\xF3n educativa', 'soberan\xEDa de IA'). Seeded without stuffing (\xA78).").optional(), "citationsGoal": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().optional() }).strict().optional(), "bios": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "length": z.enum(["short", "medium", "long"]), "text": z.string().min(1) }).strict()).describe("Curated bio per platform+lang+length. Generated by `pasco refine`, chosen by the user, stored here.").optional(), "headlines": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "text": z.string().min(1) }).strict()).describe("Headline per platform+lang (the 1-line under the name).").optional(), "skills": z.array(z.object({ "name": z.string().min(1), "level": z.enum(["novice", "intermediate", "advanced", "expert"]).optional(), "keywords": z.array(z.string()).optional(), "geoKeywords": z.array(z.string()).describe("Terms a generative engine should match this skill with (GEO layer, D7).").optional(), "platformWeights": z.record(z.string(), z.number().gte(0).lte(1)).describe("How much this skill matters per platform (0..1). Feeds renderer keyword placement.").optional() }).strict()).optional(), "experience": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "role": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1: string. v1.1 (additive): langMap \u2014 bilingual role titles."), "org": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'USFQ', 'Nimbus Labs'). Not a langMap: institutions are never translated (SPEC \xA711)."), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "highlights": z.union([langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), langMapKeys(z.object({ "en": z.array(z.string()) }).catchall(z.array(z.string())))]).describe("v1: langMap of strings (separator-delimited). v1.1 (additive): langMap of string arrays (bullets).").optional() }).strict().describe("start <= end is NOT expressible in JSON Schema \u2014 enforced by core.driftCheck (\xA712 note).")).optional(), "education": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "degree": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: degree title (string or bilingual langMap)."), "institution": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'Universidad Central de Venezuela'). Not a langMap: institutions are never translated (SPEC \xA711)."), "field": z.union([z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: field of study (string or bilingual langMap).").optional(), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "note": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().describe("v1.1 (additive): formal education entry.")).describe("v1.1 (additive): formal education. v1 workspaces keep education inside experience[] with role = degree.").optional(), "languages": z.array(z.object({ "code": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "level": z.enum(["native", "fluent", "advanced", "intermediate", "basic"]) }).strict()).describe("v1.1 (additive): spoken languages. v1 workspaces document them as comments in skills.yaml.").optional(), "projects": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "name": z.string().min(1), "status": z.enum(["active", "maintained", "archived", "experimental", "planning"]).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "links": z.array(z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.")).optional(), "keywords": z.array(z.string()).optional(), "evidence": z.array(z.object({ "claim": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "source": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "verified": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "credentialId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.").optional(), "artifactId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.").optional() }).strict().describe("Verifiable claim with source. Anti-pattern: unverifiable claims (dropped by cite-aware systems, \xA78).")).optional(), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.12 (D17/\xA718.1, issue #333): references `artifacts[].id` \u2014 the work behind this row. projects keep their domain (no duplication); target resolved by core (load fails on a dangling ref). Published-vs-in-development is DERIVED from the targets (`visibility` + `locator.url`), never stored (\xA720.1).").optional() }).strict()).optional(), "publications": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "title": z.string().min(1), "venue": z.string().min(1), "year": z.number().int().gte(1900).lte(2100), "kind": z.enum(["journal-article", "preprint", "conference-abstract"]).describe("v1.14 (issue #349): the output's structured classification \u2014 journal-article (peer-reviewed, arbitrated), preprint (not yet peer-reviewed), conference-abstract (extended abstract, typically not full peer review). Closed enum, additive and extensible in a future minor. `peerReviewed` is DERIVED from `kind == journal-article` and never stored \u2014 the same derive-never-store discipline as published-vs-in-development (\xA720.1): a boolean exception needs a documented decision first. Optional: a row without `kind` validates and renders byte-identically to a pre-v1.14 workspace, so existing workspaces stay valid. Consumers that need counts MUST require the field explicitly instead of inferring it from `venue` \u2014 venue stays a free string, and a new venue must never fail a check.").optional(), "authors": z.string().describe("v1.1: author string (e.g. 'Luciani, C.' or 'Zambrano et al.').").optional(), "doi": z.string().regex(new RegExp("^10\\.\\d{4,9}/\\S+$")).optional(), "orcidId": z.string().regex(new RegExp("^\\d{4}-\\d{4}-\\d{4}-\\d{3}[\\dX]$")).optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the dataset/code behind this paper. publications keep their domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("DOI/ORCID must be resolvable \u2014 GEO citability anchor (LLMs resolve them).")).describe("Citable research output \u2014 a peer-reviewed article, a preprint or a conference abstract, classified by the optional `kind` (v1.14); `peerReviewed` is derived from `kind == journal-article`, never stored. DOI/ORCID resolvable \u2192 GEO citability.").optional(), "keywords": z.object({ "seo": z.record(z.string(), z.array(z.string())).describe("Per-platform SEO keyword sets (fed by each platform skill's research).").optional(), "geo": z.object({ "associations": z.array(z.string()).optional(), "claims": z.array(z.string()).optional() }).strict().optional() }).strict().optional(), "checks": z.array(z.object({ "id": z.string().optional(), "platform": z.enum(["all", "github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Dedup contract: MUST equal ['all', ...$defs/platform.enum] \u2014 scripts/schema-check asserts it (D16)."), "rule": z.enum(["max-chars", "min-chars", "url-live", "fact-present", "geo-consistent", "lang-present", "link-in-identity", "handle-claimed", "handle-consistent"]).describe("Rule catalog (extensible). Skills' checks.yaml use the same catalog; the union decides which premises run (`fact-present`), while char caps come from the workspace catalog when it declares checks (whole catalog, never merged row by row) or the caps shipped with pasco \u2014 no skill `max-chars` row reaches the limit executor (SPEC \xA77). v1.1 (brand \xA717): handle-claimed (a claimed handle must resolve to a URL) and handle-consistent (handle matrix coherent across surfaces)."), "value": z.union([z.number(), z.string(), z.boolean(), z.array(z.string())]), "note": z.string().optional(), "surface": z.enum(["headline", "bio", "both"]).describe("Additive (#240): which text rows a char-limit rule applies to. Absent = both. A title cap can target `headline` without flagging the bio.").optional() }).strict()).describe("User-level declarative checks. The union with the platform skill's checks.yaml decides which premises run (`fact-present`); when this catalog declares checks it is the whole cap catalog (never merged row by row with the package defaults), and no skill `max-chars` row reaches the limit executor (SPEC \xA77).").optional(), "active": z.record(z.string(), z.object({ "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "variantId": z.string().min(1), "chosenAt": z.string().datetime({ offset: true }) }).strict().describe("The chosen variant id \u2014 user picked it (D11); variant body lives in the workspace variants store.")).describe("Which bio/headline variant is LIVE per platform (D11: user picks, engine records).").optional(), "deployments": z.record(z.string(), z.record(z.string(), z.object({ "deployedAt": z.string().datetime({ offset: true }), "contentHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "source": z.enum(["manual", "git", "api"]), "certification": z.union([z.object({ "state": z.literal("verified"), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "method": z.literal("fetch"), "fetchedAt": z.string().datetime({ offset: true }), "liveHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "evidenceUrl": z.string().url().regex(new RegExp("^https?://")).min(7).optional() }).strict().describe("\xA719.5 C1: a deterministic pass fetched the live artifact, applied the surface's extractor, and the live digest EQUALS the stored anchor. The fetch evidence is required \u2014 a `verified` with no fetch behind it is not evidence."), z.object({ "state": z.literal("attested"), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")).optional() }).strict().describe("\xA719.5 C2: the human `--mark`. Certified by ASSERTION, never rendered as a bare `in-sync`. `artifactHash` is the anchor written at confirmation when the surface has an extractor; a mark on a surface without one records no anchor (the declared forward-only v1 limit, \xA719.5)."), z.object({ "state": z.literal("unverifiable"), "reason": z.string().regex(new RegExp("^(walled|walled-con-api|host-not-allowed|network-error|no-artifact-url|no-extractor|unattributed|http-[0-9]{3})$")).describe("\xA719.5: the declared reasons, the attempt reasons, and `http-<code>` for the ACTUAL status the pass observed. `http-` accepts ANY 3-digit code \u2014 an enum of just http-403/http-429 made a routine 404/500 write a ledger the next `load()` rejects (review F1). One alternation rather than `enum \u222A pattern`: the Zod generator cannot express that union (it degrades to an untyped schema, which its safety net refuses), so the alternatives are pinned by the pattern and by fixtures instead."), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")).optional(), "method": z.literal("fetch").optional(), "fetchedAt": z.string().datetime({ offset: true }).optional(), "evidenceUrl": z.string().url().regex(new RegExp("^https?://")).min(7).optional() }).strict().describe("\xA719.5: no deterministic check is possible, or one was attempted and did not complete. DECLARED reasons (walled \xB7 walled-con-api \xB7 no-extractor \xB7 no-artifact-url) are the PASS's knowledge \u2014 it states them for its own output and writes nothing, so a workspace needs no ledger row per walled platform and the file keeps only durable evidence; ATTEMPTED ones (http-<code> \xB7 network-error \xB7 unattributed \xB7 host-not-allowed) are RECORDED with the fetch evidence. `liveHash` is impossible here \u2014 a comparison would make the state lie; `artifactHash` is allowed because it is the deploy ANCHOR, not a comparison, and a failed check must not destroy it (\xA719.5: the anchor is left unchanged)."), z.object({ "state": z.literal("out-of-band-drift"), "reason": z.literal("live-mismatch"), "artifactHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "liveHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "method": z.literal("fetch"), "fetchedAt": z.string().datetime({ offset: true }), "evidenceUrl": z.string().url().regex(new RegExp("^https?://")).min(7) }).strict().describe("\xA719.5: a C1 check COMPLETED and contradicts the ledger \u2014 the live digest differs from the anchor. Positive contrary evidence, never a strength of confirmation: the report must not fold it into a green state. Both digests and the fetch evidence are required so the contradiction is auditable.")]).optional() }).strict().describe("v1.3 (D18, \xA719.1): one confirmed deploy of a trackable unit on one surface. contentHash = SHA-256 of the canonical serialization (sorted keys, sans id/origin) of the unit AT deploy time \u2014 staleness is exact and release-tag-independent. v1.10 (issue #132, \xA719.5): the optional `certification` block adds the second, orthogonal dimension.")).describe("v1.3 (D18): surface \u2192 deploy record. Surface keys are the ONE platform enum (D16) \u2014 also core-checked post-Zod (gen-zod drops propertyNames).")).describe("v1.3 (D18, \xA719): per-entry deploy ledger \u2014 ledgerKey \u2192 surface \u2192 record. Keys are constrained above for JSON Schema consumers; the generated Zod drops propertyNames, so core re-checks key patterns, surface enums, duplicate ids and ambiguous composite keys post-Zod (D12 fail class). Only `pasco` mutates this block (same write rule as refine --choose, D14).").optional(), "credentials": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["certificate", "title", "award", "patent"]).describe("D17/\xA718.2: third-party attestation kind."), "title": z.string().min(1).describe("Credential name (proper noun \u2192 invariant string, \xA711)."), "issuer": z.string().min(1).describe("Third-party attester (proper noun \u2192 invariant string, \xA711)."), "credentialId": z.string().min(1).describe("Issuer-side identifier (e.g. certificate serial). Certificates carry PII \u2014 visibility governs exposure (\xA718.5).").optional(), "verifyUrl": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "issued": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "expires": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a third-party attestation. JSON-LD payoff (\xA718.9): `Person.hasCredential` \u2192 `EducationalOccupationalCredential` (public only).")).describe("v1.4 (D17, \xA718): the proof layer \u2014 third-party attestations (certificates, titles, awards, patents). Pointer-first: the workspace declares pointers, the engine never owns binaries (D14). Naming discipline (\xA718.1): never called evidence.").optional(), "artifacts": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["portfolio", "gallery", "showreel", "dataset", "document", "code"]).describe("D17/\xA718.2: work/media kind."), "title": z.string().min(1).describe("Work title (proper noun \u2192 invariant string, \xA711)."), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "locator": z.object({ "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "path": z.string().min(1).describe("In-workspace `media/\u2026` or external under PASCO_EVIDENCE_ROOT \u2014 capability matrix (\xA718.3): NEVER emitted as a public URL while the workspace is private (D14); reaches public surfaces only via renderer assets/ output (M8).").optional() }).strict().describe("Exactly one of `url` | `path` (\xA718.3 capability matrix). The oneOf expresses the XOR for JSON Schema consumers; the generated Zod cannot express required-without-property, so core re-checks the XOR post-Zod (D12 fail class, ledger precedent)."), "checksum": z.string().regex(new RegExp("^sha256:[a-f0-9]{64}$")).describe("Immutable artifacts only (\xA718.6): recorded at compile for byte-stable bundling (M8).").optional(), "license": z.string().min(1).describe("Usage rights for the work (e.g. CC-BY-4.0).").optional(), "tags": z.array(z.string()).describe("Multi-area selection (\xA718.9): renderers select by platform + lang + tags; one workspace, many areas.").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a work or media item. JSON-LD payoff (\xA718.9): surfaces as CreativeWork/ImageGallery/VideoObject/Dataset per platform (renderer-curated, D5).")).describe("v1.4 (D17, \xA718): works/media items (portfolio, gallery, showreel, dataset, document, code), pointer-first via `locator`. Naming discipline (\xA718.1): never called evidence \u2014 canonical blocks keep their domains (publications/press/projects are NOT registry kinds, they reference registry ids).").optional(), "faq": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked."), "q": langMapKeys(z.object({ "en": z.string().min(1).max(90) }).catchall(z.string().min(1).max(90))).describe("v1.10 (#288): the question, \u2264 90 chars per value. Unique per workspace \u2014 JSON Schema cannot express it: it is a geoCheck v2 rule (#289, `geo/faq-coverage`); duplicates collapse into one answer surface."), "a": langMapKeys(z.object({ "en": z.string().min(1).max(320) }).catchall(z.string().min(1).max(320))).describe("v1.10 (#288): the answer, \u2264 320 chars per value \u2014 beyond that it is prose, not an answer. The owner's assertion (D11/D14), never invented copy."), "source": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional() }).strict().describe("v1.10 (issue #288): ONE citable Q&A pair \u2014 the fact pair the `FAQPage` JSON-LD node projects (#316); the answer is the owner's assertion, rendered deterministically (same curation rule as `bios[]`).")).min(3).max(20).describe("v1.10 (issue #288): the citable answer surface \u2014 the questions THIS entity answers, as fact pairs (never generated copy, D11/D14). 3\u201320 entries: below 3 there is no surface; above 20 it is a page, not a profile. The `structuredData()` projection (a `FAQPage` node ONLY when present, never an empty FAQPage) ships in #316; the citability rules beyond JSON Schema are geoCheck v2 (#289).").optional(), "releases": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9-]*$")).describe("Stable release id (`v0-3-0`, `2026-10-launch`). The CLI addresses a release by it; it never changes."), "version": z.string().regex(new RegExp("^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$")).describe("The published semver version this event describes (the tag's version, not the schema version)."), "date": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "summary": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "changedUnits": z.array(z.string()).describe("The \xA719.2 ledger keys this release changed (`identity`, `projects:foo`, \u2026). The fan-out compares each declared surface against these units' ledger records.").optional(), "surfaces": z.array(z.string().min(1)).min(1).describe("The presence surfaces this release must reach, as platforms/registry.yaml slugs of any `kind` (profile \xB7 repo-meta \xB7 distribution). Order here is declaration order; `pasco release plan` sorts by kind (repo-meta \u2192 profile \u2192 distribution), then slug.") }).strict().describe("v1.15 (D23, #262): one release event. `changedUnits[]` + `surfaces[]` are the fan-out; the state per surface is DERIVED from the \xA719 ledger, never stored here.")).describe("v1.15 (D23, #262): the release event and its fan-out. A release is the unit that has surfaces and a changed set; `pasco release plan` derives the ordered fan-out from it, reusing the \xA719 ledger semantics (in-sync/stale/never) instead of a second state model. Optional and additive: a workspace without releases[] validates and every earlier command reads exactly as before.").optional(), "achievements": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked."), "statement": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "kind": z.enum(["metric", "milestone"]).describe("`metric` requires `metric`; `milestone` requires it ABSENT. An award belongs in `credentials[]` \u2014 the achievement references it."), "metric": z.object({ "value": z.number().describe("The measured number. Absent with `target` present = a PLANNED goal (status derived, never stored).").optional(), "target": z.number().describe("The goal number. Absent with `value` present = a measurement with no goal (status `measured`).").optional(), "baseline": z.number().describe("Where the result started, when it is a delta (`72 \u2192 4`). Context only: status compares `value` against `target`, never against the baseline.").optional(), "unit": z.string().min(1).describe("What the numbers count (`tutors`, `hours`, `%`). Required: a number with no unit is not a metric."), "direction": z.enum(["increase", "decrease", "maintain"]).describe("Which way is better. Absent = `increase` (the declared default in core `achievementStatus()`; never inferred from the baseline).").optional() }).strict().describe("v1.16 (D24, #446): the numeric shape of a `metric` achievement. Structured \u2014 never a free-text string \u2014 so the status can be derived and the CLI can render `72 h \u2192 4 h` without parsing prose.").optional(), "refs": z.array(z.string().regex(new RegExp("^(experience|projects|publications|education|press|credentials|artifacts):[a-z0-9][a-z0-9._:-]*$"))).refine((arr) => arr.every((item, i) => arr.indexOf(item) == i), "All items must be unique!").describe("The units this result belongs to, as `block:id` strings. The refs are resolved by core (a dangling ref fails `load`, same class as `artifactRefs`), and they are what the CLI groups the log by.").optional(), "source": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "artifactId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.").optional(), "credentialId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block for the ledger row blocks (`experience`, `projects`, `publications`, `education`, `press`): core-checked, fails validation; JSON Schema cannot express uniqueness. `faq[]` is root and not ledger-tracked, so its ids are enforced where they are addressed \u2014 `pasco edit` refuses an ambiguous id \u2014 not by the schema. Optional: rows without id are listed by `pasco status` as untracked.").optional(), "basis": z.enum(["measured", "estimated", "reported", "attested"]).describe("HOW the result is known \u2014 the honesty field, not a gate (capture first, prove later): `measured` instrumented/documented \xB7 `estimated` derived from partial data \xB7 `reported` the person's own account (a first-class value: honest, not blocked) \xB7 `attested` a third party confirms."), "date": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).") }).strict().describe("v1.16 (D24, #446): one row of the career impact log \u2014 a result, the units it belongs to, and how it is known. The status is DERIVED by core `achievementStatus()`, never stored here.")).describe("v1.16 (D24, #446): the career impact log \u2014 what CHANGED, as opposed to `experience[].highlights` (what was done) and `projects[].evidence[]` (what can be proven). One ROOT log, never per-row `outcomes[]`: `refs[]` points at the units a result belongs to, so one result is not duplicated across rows. `target` without `value` is a planned goal and the status is DERIVED (planned | measured | achieved | partial), never stored. Optional and additive: a workspace without achievements[] validates and renders byte-identically. No `minItems`: `load()` normalizes an undeclared log to `[]` and `pasco export profile` emits it (the loaded-shape rule every list root follows), so an empty array must stay schema-valid: the engine's own export payload materializes it, and `minItems: 1` would reject it.").optional() }).strict().describe("Contract source (D3) for a profile-data workspace. The core `load()` parses content/*.yaml, merges them into a single Profile and validates against THIS schema. Facts (dates, DOIs, URLs, ORCID) are language-independent and are the GEO anchor. Every text field is a langMap ({lang: value}) with EN required (D8, \xA711). Additive since v1 (semver minor): every earlier workspace still validates. v1.1: role as langMap (org stays invariant string), highlights as string[] per lang, publication.authors/url, root languages + education, identity.handle/timezone, patreon in checks; brand flavor (D15/\xA717) \u2014 `flavor`, org identity variant (orgName/logo/brandVoice/mission/tagline/established), socialHandles/newsletter/podcast/press/audiences blocks, brand platforms, handle checks. New in v1.2 (D16): platform set = Postiz parity + operator extras \u2014 43 platforms, one shared enum for both flavors, single-source dedup guard (check.platform). New in v1.3 (D18): per-entry deploy ledger \u2014 `deployments` (ledgerKey \u2192 surface \u2192 deployedAt/contentHash/source), optional stable `id`s on row blocks (experience/projects/publications/education/press), `origin: template` provenance flag. New in v1.4 (D17): evidence registry \u2014 `credentials[]` (third-party attestations: certificate/title/award/patent) and `artifacts[]` (works/media: portfolio/gallery/showreel/dataset/document/code), pointer-first (\xA718); `evidenceItem` gains `credentialId`/`artifactId` cross-refs, `publications[]`/`press[]` gain `artifactRefs`. Naming discipline (\xA718.1): the registry is never called evidence \u2014 `projects[].evidence[]` stays claims-only. New in v1.5 (issue #71): `identity.email` \u2014 the contact email as a first-class fact (schema.org `email` on Person/Organization), NOT a link \u2014 `links[]` stays http(s)-only (mailto: rejected, D12); a mailto: row in links[] broke the template and every real workspace after v1.4's scheme boundary (issue #53). New in v1.6 (issue #103): `identity.links[].role` \u2014 the link ROLE (`identity` | `realization` | `aggregator`), a translation layer onto schema.org (`url` | `sameAs` | `mainEntityOfPage`); absent role = `realization`, so every pre-v1.6 workspace stays VALIDATING unchanged (the rendered output does change \u2014 see \xA715.4). The JSON-LD `@id` is derived from the `role: identity` link and is ABSENT when no link carries it (never invented). Entity assembly moves to a single home (core/src/structured-data.ts), consumed by geoCheck and every renderer \u2014 the \xA718.9 credentialLdEntries precedent. New in v1.7 (issue #130): `kofi` \u2014 Ko-fi creator page as operator extra #10 (44 platforms), creator-monetization family; paste platform, no API deploy (D9). New in v1.8 (issue #133): `buymeacoffee`, `liberapay`, `gumroad`, `payhip` \u2014 the creator monetization platforms family (D16), operator extras #11\u2013#14 (48 platforms); the family is declared in SPEC and descriptions (docs-first), not as a hard schema field; all four are paste platforms, no API deploy (D9). New in v1.9 (issue #137): `hotmart` \u2014 the Hotmart digital-products storefront + memberships (Members Area / recurring billing) serving the Spanish/Portuguese-speaking markets, in the `creator-monetization` family as operator extra #15 (49 platforms); paste platform, no API deploy (D9) \u2014 no management API is documented for the profile body (developers.hotmart.com covers sales/products [?], fetched 2026-10-05). New in v1.10 (issue #288): the answer-engine surface \u2014 `identity.definition` (the canonical per-language definition: \u2264160 chars per value, must contain the entity name \u2014 the length cap is schema-enforced, the name check is a geoCheck rule, #289) and root `faq[]` (3\u201320 citable Q&A pairs: `q` \u226490 per value and unique per workspace, `a` \u2264320, optional `$defs/url` `source`; below 3 there is no surface, above 20 it is a page, not a profile). The `structuredData()` projection of these fields (Person `description` + a separate `FAQPage` JSON-LD node, only when the fields exist) ships in #316. The same minor completes the version label of the \xA719.5 certification additions (issue #132 \u2014 shipped in `d172dffc` under the v1.9 URI). New in v1.12 (issue #333): `projects[]` gains `artifactRefs` \u2014 the third reference site (publications and press were the first two) \u2014 so a project names the work behind it, and published-vs-in-development is DERIVED from those artifacts (`visibility: public` AND `locator.url`), never stored (\xA720.1's derived-never-stored rule). New in v1.13 (issue #334): `identity.nationality` \u2014 the ISO 3166-1 alpha-2 nationality code as a citable fact (uppercase, e.g. `VE`); schema.org `Person.nationality` \u2192 `Country` with `identifier` on the JSON-LD. Single-valued in v1.13 (dual nationality would need an array \u2014 a future additive change). Optional and additive: a workspace that omits it validates and scores as before (it is outside the structured-data `ready` gate and completeness ratio). New in v1.14 (issue #349): `publication.kind` \u2014 the closed output classification (`journal-article` | `preprint` | `conference-abstract`) that replaces per-consumer venue-string heuristics; `peerReviewed` is DERIVED from `kind == journal-article`, never stored. Optional and additive: a row without `kind` validates and renders exactly as before. New in v1.15 (D23, #262): `releases[]` \u2014 the release EVENT and its fan-out. Each row names the version, the date, an optional summary, the ledger units it changed (`changedUnits`, \xA719.2 keys) and the presence surfaces it must reach (`surfaces`, registry slugs of any `kind`). Additive: a workspace without `releases[]` validates unchanged and every pre-v1.15 command reads exactly the same profile. New in v1.16 (D24, #446): `achievements[]` \u2014 the career impact log. Each row states a RESULT (`statement`), classifies it (`kind`: `metric` | `milestone`), attaches the numeric shape (`metric`: value/target/baseline/unit/direction), points at the units it belongs to (`refs`, `block:id`) and declares HOW the result is known (`basis`: measured | estimated | reported | attested) plus a required `visibility`. `target` without `value` is a PLANNED goal and the status is DERIVED at read time (`planned` | `measured` | `achieved` | `partial`), never stored. Optional and additive: a workspace without `achievements[]` validates and renders byte-identically.");
+var PROFILE_SCHEMA_VERSION = "1.16";
 var LANG_KEYS = ["en", "es", "fr"];
 function langMapKeys(schema) {
   return schema.superRefine((value, ctx) => {
@@ -2205,9 +2385,9 @@ var SchemaValidationError = class extends LoadError {
 function validateProfile(value) {
   const result = profileSchema.safeParse(value);
   if (!result.success) {
-    const issues = result.error.issues.map((issue) => ({
-      path: issue.path.length ? issue.path.join(".") : "<root>",
-      message: issue.message
+    const issues = result.error.issues.map((issue2) => ({
+      path: issue2.path.length ? issue2.path.join(".") : "<root>",
+      message: issue2.message
     }));
     throw new SchemaValidationError(issues);
   }
@@ -2239,7 +2419,10 @@ function normalizeProfile(profile) {
     faq: profile.faq ?? [],
     // v1.15 (D23): the release events a workspace declares. Optional and additive
     // — an old workspace without it reads the same, now with an empty list.
-    releases: profile.releases ?? []
+    releases: profile.releases ?? [],
+    // v1.16 (D24, #446): the career impact log. Same rule — the loaded shape never
+    // depends on whether the workspace declares results.
+    achievements: profile.achievements ?? []
   };
 }
 function readContentFiles(workspace) {
@@ -2277,6 +2460,10 @@ function load(workspace) {
   if (registryIssues.length > 0) {
     throw new SchemaValidationError(registryIssues);
   }
+  const achievementIssues = checkAchievementIntegrity(profile);
+  if (achievementIssues.length > 0) {
+    throw new SchemaValidationError(achievementIssues);
+  }
   return normalizeProfile(profile);
 }
 
@@ -2707,14 +2894,15 @@ function kindOf(surface) {
 }
 function surfaceState(profile, release, surface, unitHashes) {
   const missingUnits = [];
+  const unknownUnits = [];
   const changed = release.changedUnits ?? [];
   if (changed.length === 0)
-    return { state: "never", missingUnits };
+    return { state: "never", missingUnits, unknownUnits };
   let stale = false;
   for (const key of changed) {
     const hash = unitHashes.get(key);
     if (hash === void 0) {
-      missingUnits.push(key);
+      unknownUnits.push(key);
       continue;
     }
     const record = profile.deployments[key]?.[surface];
@@ -2725,9 +2913,10 @@ function surfaceState(profile, release, surface, unitHashes) {
     if (record.contentHash !== hash)
       stale = true;
   }
-  if (missingUnits.length > 0)
-    return { state: "never", missingUnits };
-  return { state: stale ? "stale" : "in-sync", missingUnits };
+  if (missingUnits.length > 0 || unknownUnits.length > 0) {
+    return { state: "never", missingUnits, unknownUnits };
+  }
+  return { state: stale ? "stale" : "in-sync", missingUnits, unknownUnits };
 }
 function unitHashMap(profile) {
   const map = /* @__PURE__ */ new Map();
@@ -2780,7 +2969,7 @@ function releasePlan(profile, id) {
       kind,
       ...surfaceState(profile, release, surface, unitHashes)
     };
-  }).sort(compareSurfaces);
+  }).sort(compareSurfaces).map((row, index) => ({ order: index + 1, ...row }));
   const summary = release.summary?.en ?? release.id;
   const kinds = [];
   for (const row of surfaces)
@@ -2835,9 +3024,200 @@ function presenceBoard(profile) {
   };
 }
 
+// src/exit.ts
+var EXIT = {
+  OK: 0,
+  FAIL: 1,
+  USAGE: 2
+};
+
+// src/output.ts
+var jsonMode = false;
+function humanCommand(command) {
+  return `pasco ${command}`;
+}
+function setJsonMode(enabled) {
+  jsonMode = enabled;
+}
+function isJsonMode() {
+  return jsonMode;
+}
+function report(command, ok, exitCode2, payload) {
+  if (jsonMode) {
+    const envelope = {
+      command,
+      ok,
+      exitCode: exitCode2,
+      ...payload.data !== void 0 ? { data: payload.data } : {},
+      ...payload.error !== void 0 ? { error: payload.error } : {}
+    };
+    process.stdout.write(`${JSON.stringify(envelope, null, 2)}
+`);
+    return exitCode2;
+  }
+  if (payload.error !== void 0 && !ok) {
+    process.stderr.write(`${humanCommand(command)}: ${payload.error.message}
+`);
+    for (const v of payload.error.violations ?? []) {
+      process.stderr.write(`  ${v.path || "<root>"}: ${v.message}
+`);
+    }
+    if (payload.error.hint !== void 0) process.stderr.write(`${payload.error.hint}
+`);
+  }
+  return exitCode2;
+}
+function section(title) {
+  if (jsonMode) return;
+  process.stdout.write(`
+${title}
+`);
+}
+function line(text) {
+  if (jsonMode) return;
+  process.stdout.write(`${text}
+`);
+}
+function warn2(text) {
+  if (jsonMode) return;
+  process.stderr.write(`warning: ${text}
+`);
+}
+
+// src/commands/achievements.ts
+var ACHIEVEMENTS_SCHEMA_VERSION = "1";
+function formatMetric(metric) {
+  const unit = metric.unit;
+  const suffix = metric.target !== void 0 && metric.value !== void 0 ? ` (target ${metric.target} ${unit})` : "";
+  const direction = metric.direction !== void 0 && metric.direction !== "increase" ? ` \xB7 ${metric.direction}` : "";
+  if (metric.baseline !== void 0 && metric.value !== void 0) {
+    return `${metric.baseline} ${unit} \u2192 ${metric.value} ${unit}${suffix}${direction}`;
+  }
+  if (metric.value !== void 0) return `${metric.value} ${unit}${suffix}${direction}`;
+  if (metric.target !== void 0) return `target ${metric.target} ${unit}${direction}`;
+  return `\u2014 ${unit}${direction}`;
+}
+function achievementPointer(achievement) {
+  if (achievement.source !== void 0) return achievement.source;
+  if (achievement.artifactId !== void 0) return `artifacts:${achievement.artifactId}`;
+  if (achievement.credentialId !== void 0) return `credentials:${achievement.credentialId}`;
+  return "(no pointer)";
+}
+function rowLine(achievement) {
+  const status = achievementStatus(achievement);
+  const label = status ?? achievement.kind;
+  const metric = achievement.kind === "metric" && achievement.metric !== void 0 ? ` \u2014 ${formatMetric(achievement.metric)}` : "";
+  return `[${label}] ${textOf(achievement.statement)}${metric} \xB7 basis: ${achievement.basis} \xB7 ${achievementPointer(achievement)}`;
+}
+function groupByRef(achievements) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const achievement of achievements) {
+    const key = achievement.refs?.[0] ?? "Unattached";
+    const bucket = groups.get(key);
+    if (bucket === void 0) groups.set(key, [achievement]);
+    else bucket.push(achievement);
+  }
+  return new Map(
+    [...groups.entries()].sort(
+      ([a], [b]) => a === "Unattached" ? 1 : b === "Unattached" ? -1 : a < b ? -1 : a > b ? 1 : 0
+    )
+  );
+}
+function loadOrReport(command, workspace) {
+  try {
+    return { profile: load(workspace) };
+  } catch (err) {
+    if (err instanceof SchemaValidationError || err instanceof LoadError) {
+      return {
+        fail: report(command, false, EXIT.FAIL, {
+          error: {
+            kind: "load",
+            message: err.message,
+            ...err instanceof SchemaValidationError ? { violations: [...err.issues] } : {}
+          }
+        })
+      };
+    }
+    throw err;
+  }
+}
+function targetRows(profile) {
+  return profile.achievements.filter((a) => achievementStatus(a) === "planned");
+}
+function achievementsPayload(achievements) {
+  return {
+    schemaVersion: ACHIEVEMENTS_SCHEMA_VERSION,
+    // `scope` counts the rows THIS view returned: an empty scope must read as
+    // "nothing declared/measured here", never as a fabricated zero (§7.1 shape).
+    scope: achievementScope(achievements),
+    achievements: achievements.map((a) => ({ ...a, status: achievementStatus(a) ?? null }))
+  };
+}
+function runAchievements(args) {
+  const loaded = loadOrReport("achievements", args.workspace);
+  if ("fail" in loaded) return loaded.fail;
+  const rows = args.targets === true ? targetRows(loaded.profile) : loaded.profile.achievements;
+  if (isJsonMode()) {
+    return report("achievements", true, EXIT.OK, { data: achievementsPayload(rows) });
+  }
+  if (rows.length === 0) {
+    section(
+      args.targets === true ? "Achievements \u2014 no planned targets" : "Achievements \u2014 the log is empty"
+    );
+    line(
+      args.targets === true ? "No row declares a `target` without a `value` yet \u2014 the goal view is empty." : "Add content/achievements.yaml: one row per result, with `basis` and `visibility` (D24)."
+    );
+    return EXIT.OK;
+  }
+  const scope = achievementScope(rows);
+  section(
+    args.targets === true ? `Achievements \u2014 ${scope.total} planned target(s)` : `Achievements \u2014 ${scope.total} row(s) \xB7 planned ${scope.planned} \xB7 measured ${scope.measured} \xB7 achieved ${scope.achieved} \xB7 partial ${scope.partial}`
+  );
+  for (const [group, groupRows] of groupByRef(rows)) {
+    line("");
+    line(group === "Unattached" ? "Unattached" : group);
+    for (const achievement of groupRows) {
+      const refs = achievement.refs ?? [];
+      const extra = refs.length > 1 ? ` [also: ${refs.slice(1).join(", ")}]` : "";
+      line(`  ${rowLine(achievement)}${extra}`);
+    }
+  }
+  line("");
+  line(
+    "Status is DERIVED from the numbers (planned \xB7 measured \xB7 achieved \xB7 partial) \u2014 never stored."
+  );
+  return EXIT.OK;
+}
+
 // src/claims.ts
+var NUMBER = String.raw`\d{1,18}(?:[.,]\d{1,18}){0,5}`;
+var CURRENCY_OR_PERCENT = new RegExp(
+  String.raw`(?:[$€£¥₹￥₽]|％)\s?${NUMBER}|${NUMBER}\s?(?:%|％)`,
+  "u"
+);
+var PLUS_OR_MAGNITUDE = new RegExp(String.raw`${NUMBER}\s?(?:\+|(?:bn|tn|[kmb])(?!\p{L}))`, "iu");
+var NUMBER_THEN_WORD = new RegExp(String.raw`(?<![\w.])(${NUMBER})(\s?)(\p{L}+)`, "gu");
+var MONTH_OR_PREPOSITION_BEFORE = /\b(?:(?:jan|feb|mar|apr|may|jun|jul|aug|sep|sept|oct|nov|dec)[a-z]*\s+(?:\d{1,2},?\s*)?|(?:in|on|since|by|until|during|from)\s+)$/i;
+function isCalendarYear(token) {
+  if (!/^\d{4}$/.test(token)) return false;
+  const year = Number(token);
+  return year >= 1900 && year <= 2099;
+}
 function isQuantitativeClaim(text) {
-  return /\d/.test(text) && /[%$]|\b\d{2,}\b/.test(text);
+  if (!/\d/.test(text)) return false;
+  if (CURRENCY_OR_PERCENT.test(text)) return true;
+  if (PLUS_OR_MAGNITUDE.test(text)) return true;
+  for (const match of text.matchAll(NUMBER_THEN_WORD)) {
+    const token = match[1] ?? "";
+    const separator = match[2] ?? "";
+    if (separator === "" && token.length === 1) continue;
+    if (isCalendarYear(token)) {
+      const before = text.slice(0, match.index);
+      if (MONTH_OR_PREPOSITION_BEFORE.test(before)) continue;
+    }
+    return true;
+  }
+  return false;
 }
 
 // src/variant-store.ts
@@ -2893,9 +3273,9 @@ function resolveVariantBody(workspace, slice) {
 
 // src/drift-reconcile.ts
 function reconciledDrift(workspace, profile) {
-  return driftCheck(profile).filter((issue) => {
-    if (issue.code !== "drift/active-variant-missing") return true;
-    const platform = issue.surfaces?.[0];
+  return driftCheck(profile).filter((issue2) => {
+    if (issue2.code !== "drift/active-variant-missing") return true;
+    const platform = issue2.surfaces?.[0];
     if (platform === void 0) return true;
     const active = profile.active?.[platform];
     if (active === void 0) return true;
@@ -2903,13 +3283,6 @@ function reconciledDrift(workspace, profile) {
   });
 }
 
-// src/exit.ts
-var EXIT = {
-  OK: 0,
-  FAIL: 1,
-  USAGE: 2
-};
-
 // src/fact-present.ts
 import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
 import { relative as relative2 } from "path";
@@ -2974,6 +3347,17 @@ function pasteSource(p) {
   return "";
 }
 
+// src/check-catalog.ts
+function capCatalog(profile, defaults) {
+  return profile.checks.length > 0 ? profile.checks : defaults;
+}
+function catalogSource(profile) {
+  return profile.checks.length > 0 ? "workspace" : "defaults";
+}
+function catalogLabel(source) {
+  return source === "workspace" ? "workspace checks (declared in content/, schema-validated catalog)" : "workspace checks: none declared \u2014 the conservative caps shipped with pasco apply (#240)";
+}
+
 // ../renderers/buymeacoffee/dist/index.js
 function render(p) {
   return { text: pasteSource(p) };
@@ -3174,7 +3558,6 @@ var extractArtifact = createArtifactExtractor("github-org");
 
 // ../renderers/github-org/dist/index.js
 var BADGE = {
-  github: { color: "181717", logo: "github", label: "GitHub" },
   "github-org": { color: "181717", logo: "github", label: "GitHub" },
   x: { color: "000000", logo: "X", label: "X" },
   bluesky: { color: "0285FF", logo: "bluesky", label: "Bluesky" },
@@ -3185,8 +3568,7 @@ var BADGE = {
   spotify: { color: "1DB954", logo: "spotify", label: "Spotify" },
   reddit: { color: "FF4500", logo: "reddit", label: "Reddit" },
   mastodon: { color: "6364FF", logo: "mastodon", label: "Mastodon" },
-  soundcloud: { color: "FF3300", logo: "soundcloud", label: "SoundCloud" },
-  website: { color: "111111", logo: "internetarchive", label: "Website" }
+  soundcloud: { color: "FF3300", logo: "soundcloud", label: "SoundCloud" }
 };
 function hostnamePath(url) {
   try {
@@ -3523,6 +3905,24 @@ var RENDERERS = {
 };
 
 // src/limits.ts
+var CONTRACT_CAPS = {
+  definition: {
+    cap: 160,
+    source: "[OFICIAL] the v1.10 contract itself (schema maxLength for identity.definition, #288, 2026-10-24) \u2014 over the cap the schema refuses the write (D12)"
+  },
+  "faq.q": {
+    cap: 90,
+    source: "[OFICIAL] the v1.10 contract itself (schema maxLength for faq[].q, #288, 2026-10-24) \u2014 over the cap the schema refuses the write (D12)"
+  },
+  "faq.a": {
+    cap: 320,
+    source: "[OFICIAL] the v1.10 contract itself (schema maxLength for faq[].a, #288, 2026-10-24) \u2014 over the cap the schema refuses the write (D12)"
+  }
+};
+function contractLimit(field) {
+  const row = CONTRACT_CAPS[field];
+  return { cap: row.cap, source: row.source, tier: "OFICIAL" };
+}
 function limitRows(profile) {
   return [
     ...(profile.headlines ?? []).map((h) => ({
@@ -3838,7 +4238,7 @@ function publicationTruth(args) {
   });
 }
 function publicationOfCaller(args, profile, reportData, defaultChecks) {
-  const checks = profile.checks.length > 0 ? profile.checks : defaultChecks;
+  const checks = capCatalog(profile, defaultChecks);
   return publicationTruth({
     workspace: args.workspace,
     profile,
@@ -4120,54 +4520,6 @@ function factPresentFindings(args) {
   return { catalog: catalogState(), declared, checked, notRun, findings };
 }
 
-// src/output.ts
-var jsonMode = false;
-function setJsonMode(enabled) {
-  jsonMode = enabled;
-}
-function isJsonMode() {
-  return jsonMode;
-}
-function report(command, ok, exitCode2, payload) {
-  if (jsonMode) {
-    const envelope = {
-      command,
-      ok,
-      exitCode: exitCode2,
-      ...payload.data !== void 0 ? { data: payload.data } : {},
-      ...payload.error !== void 0 ? { error: payload.error } : {}
-    };
-    process.stdout.write(`${JSON.stringify(envelope, null, 2)}
-`);
-    return exitCode2;
-  }
-  if (payload.error !== void 0 && !ok) {
-    process.stderr.write(`${command}: ${payload.error.message}
-`);
-    for (const v of payload.error.violations ?? []) {
-      process.stderr.write(`  ${v.path || "<root>"}: ${v.message}
-`);
-    }
-  }
-  return exitCode2;
-}
-function section(title) {
-  if (jsonMode) return;
-  process.stdout.write(`
-${title}
-`);
-}
-function line(text) {
-  if (jsonMode) return;
-  process.stdout.write(`${text}
-`);
-}
-function warn2(text) {
-  if (jsonMode) return;
-  process.stderr.write(`warning: ${text}
-`);
-}
-
 // src/commands/audit.ts
 var AUDIT_SCHEMA_VERSION = "1";
 var AUDIT_SEVERITY = {
@@ -4248,6 +4600,20 @@ function ssotFindings(profile, pascorc) {
       );
     }
   }
+  for (const [index, achievement] of (profile.achievements ?? []).entries()) {
+    if (achievement.visibility !== "public") continue;
+    if (achievement.basis !== "measured" && achievement.basis !== "attested") continue;
+    if (achievement.source !== void 0 || achievement.artifactId !== void 0 || achievement.credentialId !== void 0) {
+      continue;
+    }
+    findings.push(
+      finding2(
+        "unsourced-claim",
+        `achievements[${index}]`,
+        `the ${achievement.basis} claim carries no pointer (\`source\`, \`artifactId\` or \`credentialId\`) \u2014 a claim with no evidence behind it`
+      )
+    );
+  }
   const faqDeficient = geoCheck(profile).checks.some(
     (check) => check.code === "geo/faq-coverage" && check.score === 0
   );
@@ -4297,10 +4663,10 @@ function runAudit(args) {
     }
     throw err;
   }
-  const drift = reconciledDrift(args.workspace, profile).flatMap((issue) => {
-    const mapped = Object.hasOwn(DRIFT_CLASS, issue.code) ? DRIFT_CLASS[issue.code] : "contradiction";
+  const drift = reconciledDrift(args.workspace, profile).flatMap((issue2) => {
+    const mapped = Object.hasOwn(DRIFT_CLASS, issue2.code) ? DRIFT_CLASS[issue2.code] : "contradiction";
     if (mapped === null || mapped === void 0) return [];
-    return [finding2(mapped, factRef(profile, issue.path), `${issue.code} \u2014 ${issue.message}`)];
+    return [finding2(mapped, factRef(profile, issue2.path), `${issue2.code} \u2014 ${issue2.message}`)];
   });
   const facts = factPresentFindings({
     workspace: args.workspace,
@@ -4328,14 +4694,25 @@ function runAudit(args) {
     return report("audit", failures === 0, exitCode2, { data: reportData });
   }
   section("audit \u2014 findings only (no score, no prioritisation)");
-  const compared = scope.checked.length === 0 ? "no surface measured" : `${scope.checked.length} surface(s) compared (${scope.checked.join(", ")})`;
+  const compared = scope.checked.length === 0 ? "0 surfaces measured" : `${scope.checked.length} surface(s) compared (${scope.checked.join(", ")})`;
   const missing = scope.notRun.length === 0 ? "" : ` \xB7 not run: ${scope.notRun.join(", ")}`;
   const declared = scope.catalog === "not-shipped" ? " \xB7 skills tree NOT SHIPPED with this package (the catalog cannot declare the premise)" : scope.declared.length === 0 ? " \xB7 premise not declared by any catalog" : "";
   line(`  scope: ${compared}${missing}${declared}`);
   if (scope.checked.length === 0) {
-    line(
-      "  an empty scope is not a clean audit \u2014 no artifact to compare (run pasco build), or no catalog declares fact-present"
-    );
+    if (scope.catalog === "not-shipped") {
+      line(
+        "  an empty scope is not a clean audit \u2014 the built-in check catalog is not shipped with this package, so no rule could declare what to compare"
+      );
+    } else if (scope.declared.length === 0) {
+      line(
+        "  an empty scope is not a clean audit \u2014 no check catalog declares the surface-facts rule for this workspace's surfaces (add a content/checks.yaml row to declare it)"
+      );
+    } else {
+      const surfaces = scope.notRun.length > 0 ? ` for ${scope.notRun.join(", ")}` : "";
+      line(
+        `  an empty scope is not a clean audit \u2014 no built artifact to compare${surfaces} (run pasco build; a flavor with no renderer cannot be compared)`
+      );
+    }
   }
   if (findings.length === 0) {
     line("  no findings");
@@ -4413,8 +4790,11 @@ function parseFlavor(value) {
   if (FLAVORS.includes(value)) return value;
   throw new UsageError(`unknown flavor "${value}" (allowed: ${FLAVORS.join(", ")})`);
 }
+var DEFAULT_VARIANTS = 3;
 function parseVariants(value, fallback) {
-  if (value === void 0) return fallback;
+  if (value === void 0) {
+    return Number.isInteger(fallback) && fallback >= 1 ? fallback : DEFAULT_VARIANTS;
+  }
   const n = Number(value);
   if (!Number.isInteger(n) || n < 1)
     throw new UsageError(`--variants must be a positive integer (got "${value}")`);
@@ -4427,14 +4807,51 @@ function headlineAddress(platform, lang) {
 function bioAddress(platform, lang, length) {
   return `bios[platform=${platform},lang=${lang},length=${length}].text`;
 }
+function definitionAddress(lang) {
+  return `identity.definition.${lang}`;
+}
+function faqAddress(id, field, lang) {
+  if (field === "source") return `faq[id=${id}].source`;
+  return `faq[id=${id},lang=${lang}].${field}`;
+}
+var ENTRY_ID = /^[a-z0-9][a-z0-9._:-]*$/;
+function parseEntryId(block, value) {
+  if (!ENTRY_ID.test(value)) {
+    throw new UsageError(
+      `${block}: id ${JSON.stringify(value)} is not a valid entry id (the schema's $defs/entryId: ^[a-z0-9][a-z0-9._:-]*$) \u2014 valid addresses:
+${editAddressTable()}`
+    );
+  }
+  return value;
+}
 function linkAddress(platform, label) {
   return label === void 0 ? `identity.links[platform=${platform}].url` : `identity.links[platform=${platform},label=${label}].url`;
 }
+function statementAddress(lang) {
+  return `positioning.statement.${lang}`;
+}
+var EDIT_LIST_BLOCKS = [
+  "positioning",
+  "headlines",
+  "bios",
+  "identity.definition",
+  "identity.links",
+  "faq"
+];
+function parseEditListBlock(value) {
+  if (EDIT_LIST_BLOCKS.includes(value)) return value;
+  throw new UsageError(
+    `unknown block "${value}" \u2014 --list scopes to one of: ${EDIT_LIST_BLOCKS.join(" | ")}`
+  );
+}
 function editAddressTable() {
   return [
     `  positioning.statement.<lang>                       lang: ${LANGS2.join("|")}`,
     `  headlines[platform=<p>,lang=<l>].text              platform: <schema platform id, \xA76> \xB7 lang: ${LANGS2.join("|")}`,
     `  bios[platform=<p>,lang=<l>,length=<len>].text      length: ${BIO_LENGTHS.join("|")}`,
+    `  identity.definition.<lang>                         lang: ${LANGS2.join("|")} (the canonical per-language sentence)`,
+    `  faq[id=<slug>,lang=<l>].q | .a                     lang: ${LANGS2.join("|")} (q/a are langMaps, so lang is required)`,
+    `  faq[id=<slug>].source                              the optional http(s) pointer backing the answer`,
     `  identity.links[platform=<p>,label=<l>].url         (read-only; label optional \u2014 disambiguates two links on one platform)`
   ].join("\n");
 }
@@ -4497,7 +4914,30 @@ ${editAddressTable()}`);
   const statement = /^positioning\.statement\.([A-Za-z0-9_-]+)$/.exec(text);
   if (statement !== null) {
     const lang = parseLang(statement[1]);
-    return { kind: "statement", lang, address: `positioning.statement.${lang}` };
+    return { kind: "statement", lang, address: statementAddress(lang) };
+  }
+  const definition = /^identity\.definition\.([A-Za-z0-9_-]+)$/.exec(text);
+  if (definition !== null) {
+    const lang = parseLang(definition[1]);
+    return { kind: "definition", lang, address: definitionAddress(lang) };
+  }
+  const faq = /^faq\[([^\]]*)\]\.([A-Za-z]+)$/.exec(text);
+  if (faq !== null) {
+    const field = faq[2];
+    if (field !== "q" && field !== "a" && field !== "source") {
+      throw new UsageError(
+        `faq[..].${field} is not addressable \u2014 the fields are faq[id=<slug>,lang=<l>].q | .a and faq[id=<slug>].source`
+      );
+    }
+    if (field === "source") {
+      const s2 = parseSelectors("faq", faq[1], ["id"]);
+      const id2 = parseEntryId("faq", s2.id);
+      return { kind: "faq", id: id2, field, address: faqAddress(id2, "source") };
+    }
+    const s = parseSelectors("faq", faq[1], ["id", "lang"]);
+    const id = parseEntryId("faq", s.id);
+    const lang = parseLang(s.lang);
+    return { kind: "faq", id, field, lang, address: faqAddress(id, field, lang) };
   }
   const addressed = /^(headlines|bios|identity\.links)\[([^\]]*)\]\.([A-Za-z]+)$/.exec(text);
   if (addressed !== null) {
@@ -4740,8 +5180,12 @@ function runBuild(args) {
       );
     for (const b of s.bios) line(`  bio (${b.length}): ${b.text}`);
     for (const h of s.headlines) line(`  headline: ${h.text}`);
-    if (s.bios.length === 0 && s.headlines.length === 0)
-      line("  (no texts for this platform+lang)");
+    if (s.bios.length === 0 && s.headlines.length === 0) {
+      const wroteArtifact = written.some((w) => w.platform === s.platform);
+      line(
+        wroteArtifact ? "  (0 base texts \u2014 bios/headlines \u2014 for this platform+lang; the artifact is still written from the declared facts)" : "  (0 base texts \u2014 bios/headlines \u2014 and no artifact for this platform+lang)"
+      );
+    }
     if (s.fallbacks.length > 0) line(`  (${s.fallbacks.length} text(s) fell back to en)`);
   }
   if (written.length > 0) {
@@ -4812,7 +5256,7 @@ var HANDLE_CODES = /* @__PURE__ */ new Set([
 ]);
 function buildCheckReport(args) {
   const { workspace, profile, platform } = args;
-  const baseChecks = profile.checks.length > 0 ? profile.checks : DEFAULT_CHECKS;
+  const baseChecks = capCatalog(profile, DEFAULT_CHECKS);
   const checks = baseChecks.filter(
     (c) => platform === void 0 || c.platform === "all" || c.platform === platform
   );
@@ -4905,7 +5349,7 @@ function runCheck(args) {
     });
   }
   section(
-    `evidence registry (D17/\xA718.8)${platform !== void 0 ? ` for ${platform}` : ""}: ${registry.length} finding(s)`
+    `evidence registry${platform !== void 0 ? ` for ${platform}` : ""}: ${registry.length} finding(s)`
   );
   for (const finding3 of registry) {
     line(`  ${finding3.severity}: [${finding3.code}] ${finding3.message} (${finding3.path})`);
@@ -4914,11 +5358,11 @@ function runCheck(args) {
     line("  credential-expiry / no-private-in-public-output: OK");
   } else if (registry.filter((f) => f.severity === "error").length > 0) {
     line(
-      `  ${registry.filter((f) => f.severity === "error").length} leak error(s) \u2014 FAIL (\xA718.5: public output renders only public entries)`
+      `  ${registry.filter((f) => f.severity === "error").length} leak error(s) \u2014 FAIL (public output renders only public entries)`
     );
   }
   section(
-    `media pipeline (M8/\xA718.6)${platform !== void 0 ? ` for ${platform}` : ""}: ${media.length} finding(s)`
+    `media transport${platform !== void 0 ? ` for ${platform}` : ""}: ${media.length} finding(s)`
   );
   for (const finding3 of media) {
     line(`  ${finding3.severity}: [${finding3.code}] ${finding3.message} (${finding3.path})`);
@@ -4936,7 +5380,7 @@ function runCheck(args) {
     line("  text limits: OK (no findings)");
   }
   section(
-    `fact-present (surface facts vs the SSOT render, #283): ${facts.findings.length} finding(s)`
+    `surface facts vs the rendered profile${platform !== void 0 ? ` for ${platform}` : ""}: ${facts.findings.length} finding(s)`
   );
   for (const finding3 of facts.findings) {
     line(`  warn: [${finding3.code}] ${finding3.message} (${finding3.path})`);
@@ -4961,7 +5405,7 @@ function runCheck(args) {
     );
   }
   if (profile.flavor === "brand") {
-    section("handle matrix (brand, \xA717)");
+    section("handle matrix (brand)");
     if (profile.socialHandles.length === 0) {
       line("  (no socialHandles rows)");
     } else {
@@ -4974,8 +5418,8 @@ function runCheck(args) {
     if (handleIssues.length === 0) {
       line("  handle-claimed / handle-consistent: OK (no offline violations)");
     } else {
-      for (const issue of handleIssues) {
-        line(`  warn: [${issue.code}] ${issue.message} (${issue.path})`);
+      for (const issue2 of handleIssues) {
+        line(`  warn: [${issue2.code}] ${issue2.message} (${issue2.path})`);
       }
       line(
         `  ${handleIssues.length} handle warning(s) \u2014 fix before deploy (live check: github-org skill url-live)`
@@ -4983,10 +5427,10 @@ function runCheck(args) {
     }
   }
   line(
-    "pasco check: rule engine for the remaining catalog ships M3/M4 (registry + handle rules already executed above)"
+    "pasco check: the offline rules above ran \u2014 evidence registry, media transport, text limits, surface facts, and (for brand) the handle matrix."
   );
   section(
-    `user checks (content/checks.yaml, schema-validated catalog)${platform !== void 0 ? ` for ${platform}` : ""}: ${checks.length}`
+    `${catalogLabel(catalogSource(profile))}${platform !== void 0 ? ` for ${platform}` : ""}: ${checks.length}`
   );
   for (const c of checks) {
     const note = c.note !== void 0 ? ` note="${c.note}"` : "";
@@ -4996,9 +5440,8 @@ function runCheck(args) {
     );
   }
   line(
-    "  max-chars/min-chars executed above; the remaining rules ship with the skills checks.yaml union (M3) and pasco check (M4)"
+    "  checks whose rule is max-chars or min-chars ran above; the other rule names are listed for the record and do not run in this release."
   );
-  line(`  owner: ${CHECK_OWNER}`);
   return report_.ok ? EXIT.OK : EXIT.FAIL;
 }
 
@@ -5159,11 +5602,11 @@ function runCiteCheck(args) {
   const parsed = parseAnswers(source.text);
   if (parsed.issue !== void 0) {
     const { line: badLine, field, message } = parsed.issue;
-    const at = field === void 0 ? `line ${badLine}` : `line ${badLine} (${field})`;
+    const at2 = field === void 0 ? `line ${badLine}` : `line ${badLine} (${field})`;
     return report("cite-check", false, EXIT.USAGE, {
       error: {
         kind: "input",
-        message: `malformed NDJSON at ${at} \u2014 ${message}`,
+        message: `malformed NDJSON at ${at2} \u2014 ${message}`,
         violations: [{ path: `line ${badLine}`, message }]
       }
     });
@@ -5355,6 +5798,18 @@ function asDate(value) {
 function slug(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
+function digest(value) {
+  let hash = 2166136261;
+  for (const byte of Buffer.from(value, "utf8")) {
+    hash = Math.imul(hash ^ byte, 16777619) >>> 0;
+  }
+  return hash.toString(36);
+}
+function experienceId(surface, org) {
+  const raw = `${surface}-${org}`.normalize("NFC").toLowerCase().replace(/\s+/gu, " ");
+  const base = slug(raw);
+  return /^[\x20-\x7e]*$/u.test(raw) ? base : `${base}-${digest(raw)}`;
+}
 function httpUrl(value) {
   try {
     const url = new URL(value);
@@ -5417,7 +5872,7 @@ function provisionalProfile(observations) {
     if (role === void 0) continue;
     for (const row of worksForRows(node)) {
       if (row.start === void 0) continue;
-      const id = slug(`${observation.surface}-${row.org}`);
+      const id = experienceId(observation.surface, row.org);
       if (id === "" || experience.some((item) => item.id === id)) continue;
       experience.push({
         id,
@@ -5431,7 +5886,7 @@ function provisionalProfile(observations) {
   }
   if (name === void 0) {
     throw new DiscoveryError(
-      "no surface declared an entity name (schema.org JSON-LD `Person`/`Organization`) \u2014 a provisional profile needs at least `identity.name`; nothing was invented"
+      "no surface declared an entity name: discovery reads only schema.org `Person`/`Organization` JSON-LD, which a GitHub profile (and a product/page node such as `SoftwareApplication`) does not carry \u2014 point it at a personal site or page that declares a `Person` or `Organization` node; a provisional profile needs at least `identity.name`, and nothing was invented"
     );
   }
   if (nameSource !== void 0) record("identity.name", nameSource);
@@ -5451,6 +5906,117 @@ function provisionalProfile(observations) {
     absent: [...absent].sort()
   };
 }
+var NAVIGATION_SEGMENTS = /* @__PURE__ */ new Set([
+  "about",
+  "articles",
+  "blog",
+  "careers",
+  "categories",
+  "category",
+  "contact",
+  "cv",
+  "docs",
+  "download",
+  "downloads",
+  "events",
+  "faq",
+  "feed",
+  "help",
+  "home",
+  "index",
+  "jobs",
+  "login",
+  "me",
+  "news",
+  "page",
+  "pages",
+  "portfolio",
+  "posts",
+  "pricing",
+  "privacy",
+  "profile",
+  "projects",
+  "resume",
+  "rss",
+  "search",
+  "series",
+  "signup",
+  "site",
+  "sitemap",
+  "subscribe",
+  "support",
+  "t",
+  "tag",
+  "tags",
+  "team",
+  "terms",
+  "topic",
+  "topics",
+  "work",
+  "writing"
+]);
+var NAME_PARTICLES = /* @__PURE__ */ new Set([
+  "bin",
+  "das",
+  "del",
+  "den",
+  "der",
+  "des",
+  "dos",
+  "ibn",
+  "las",
+  "los",
+  "ter",
+  "van",
+  "von"
+]);
+function subjectTokens(provisional, observations) {
+  const name = provisional.profile.identity.name.trim();
+  const tokens = /* @__PURE__ */ new Set([name]);
+  for (const word of name.split(/\s+/).filter((item) => item !== "")) {
+    if (word === word.toLowerCase() && (word.length < 3 || NAME_PARTICLES.has(word))) {
+      continue;
+    }
+    tokens.add(word);
+  }
+  for (const url of observations.map((item) => item.url)) {
+    let segment;
+    try {
+      segment = new URL(url).pathname.split("/").filter((item) => item !== "").pop();
+    } catch {
+      continue;
+    }
+    if (segment === void 0 || /^\d+$/u.test(segment)) continue;
+    let decoded;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+      continue;
+    }
+    if (NAVIGATION_SEGMENTS.has(decoded.toLowerCase())) continue;
+    tokens.add(decoded);
+    if (decoded === decoded.toLowerCase() && decoded.length > 1) {
+      tokens.add(decoded.charAt(0).toUpperCase() + decoded.slice(1));
+    }
+  }
+  return [...tokens];
+}
+var TOKEN_START = "(?<![\\p{L}\\p{N}_])";
+var TOKEN_END = "(?![\\p{L}\\p{N}_])";
+var FIRST_PERSON_PRONOUN = new RegExp(`${TOKEN_START}I${TOKEN_END}`, "u");
+var FIRST_PERSON_CONTRACTION = new RegExp(`${TOKEN_START}[Ii]['\u2019](?:m|ve|d|ll)${TOKEN_END}`, "u");
+var FIRST_PERSON_POSSESSIVE = new RegExp(`${TOKEN_START}(?:my|me|mine|myself)${TOKEN_END}`, "iu");
+function isFirstPerson(text) {
+  return FIRST_PERSON_PRONOUN.test(text) || FIRST_PERSON_CONTRACTION.test(text) || FIRST_PERSON_POSSESSIVE.test(text);
+}
+function isAboutEntity(text, tokens) {
+  if (isFirstPerson(text)) return true;
+  return tokens.some((token) => {
+    const escaped = token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const flags = token.length <= 4 ? "u" : "iu";
+    return new RegExp(`${TOKEN_START}${escaped}${TOKEN_END}`, flags).test(text);
+  });
+}
 function experienceKey(row) {
   const role = typeof row.role === "string" ? row.role : row.role.en;
   return `${role}/${row.org}`.toLowerCase();
@@ -5464,6 +6030,10 @@ function conflictRows(profile, path) {
   const key = experienceKey(row);
   return profile.experience.filter((item) => experienceKey(item) === key);
 }
+function declaredName(observation) {
+  const node = flattenJsonLd(observation.jsonLd)[0];
+  return node === void 0 ? void 0 : asString(node.name);
+}
 function discoveryFindings(provisional, observations, unresolved = []) {
   const { profile, provenance } = provisional;
   const findings = [];
@@ -5471,13 +6041,30 @@ function discoveryFindings(provisional, observations, unresolved = []) {
     const record = provenance[ref];
     return record === void 0 ? ref : `${record.surface} (${record.url})`;
   };
-  for (const issue of driftCheck(profile)) {
-    const mapped = Object.hasOwn(DRIFT_CLASS, issue.code) ? DRIFT_CLASS[issue.code] : "contradiction";
+  for (const issue2 of driftCheck(profile)) {
+    const mapped = Object.hasOwn(DRIFT_CLASS, issue2.code) ? DRIFT_CLASS[issue2.code] : "contradiction";
     if (mapped === null || mapped === void 0) continue;
-    const ref = factRef(profile, issue.path);
-    const cited = issue.code === "drift/duplicate-experience" ? conflictRows(profile, issue.path).map((row) => provenanceOf(`experience[${row.id}]`)).join(" \xB7 ") : provenanceOf(ref);
+    const ref = factRef(profile, issue2.path);
+    const cited = issue2.code === "drift/duplicate-experience" ? conflictRows(profile, issue2.path).map((row) => provenanceOf(`experience[${row.id}]`)).join(" \xB7 ") : provenanceOf(ref);
     const suffix = cited === ref || cited === "" ? "" : ` \u2014 asserted by ${cited}`;
-    findings.push(finding2(mapped, ref, `${issue.code} \u2014 ${issue.message}${suffix}`));
+    findings.push(finding2(mapped, ref, `${issue2.code} \u2014 ${issue2.message}${suffix}`));
+  }
+  const declared = observations.flatMap((observation) => {
+    const name = declaredName(observation);
+    return name === void 0 ? [] : [{ name, observation }];
+  });
+  const normalizedNames = new Set(
+    declared.map((item) => item.name.normalize("NFC").toLowerCase().replace(/\s+/gu, " "))
+  );
+  if (normalizedNames.size > 1) {
+    const where = new Set(declared.map((item) => item.observation.surface)).size > 1 ? "across surfaces" : "on one surface";
+    findings.push(
+      finding2(
+        "contradiction",
+        "identity.name",
+        `identity.name is declared differently ${where}: ${declared.map(({ name, observation }) => `"${name}" \u2014 ${observation.surface} (${observation.url})`).join(" \xB7 ")}`
+      )
+    );
   }
   for (const link of unresolved) {
     findings.push(
@@ -5488,11 +6075,17 @@ function discoveryFindings(provisional, observations, unresolved = []) {
       )
     );
   }
+  const subjects = subjectTokens(provisional, observations);
+  const seenSentences = /* @__PURE__ */ new Set();
   for (const observation of observations) {
     for (const [index, sentence] of observation.text.split(/(?<=[.!?])\s+|\n/).entries()) {
       const text = sentence.trim();
       if (!isQuantitativeClaim(text)) continue;
       if (/source:|evidence:|https?:\/\//i.test(text)) continue;
+      if (!isAboutEntity(text, subjects)) continue;
+      const key = text.toLowerCase();
+      if (seenSentences.has(key)) continue;
+      seenSentences.add(key);
       findings.push(
         finding2(
           "unsourced-claim",
@@ -5524,8 +6117,195 @@ var httpFetchText = async (url) => {
   }
 };
 
+// src/observations.ts
+import { readFileSync as readFileSync9 } from "fs";
+import { parse as parse3 } from "yaml";
+var OBSERVATION_FIELDS = ["name", "link", "experience"];
+var ROW_KEYS = ["surface", "field", "value", "url", "retrieved_at"];
+var EXPERIENCE_KEYS = ["role", "org", "start", "end"];
+var HTTP_URL = /^https?:\/\//u;
+var DATE = /^\d{4}(?:-\d{2}(?:-\d{2})?)?$/u;
+var RETRIEVED_AT = /^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2}))?$/u;
+function at(index, reason) {
+  return new DiscoveryError(`observations: row ${index + 1}: ${reason}`);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function nonEmptyString(value, index, key) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw at(index, `\`${key}\` must be a non-empty string`);
+  }
+  return value.trim();
+}
+function daysInMonth(year, month) {
+  return new Date(Date.UTC(year, month, 0)).getUTCDate();
+}
+function calendarDate(text) {
+  const match = /^(\d{4})(?:-(\d{2}))?(?:-(\d{2}))?$/u.exec(text);
+  if (match === null) return false;
+  const year = Number(match[1]);
+  const month = match[2] === void 0 ? void 0 : Number(match[2]);
+  const day = match[3] === void 0 ? void 0 : Number(match[3]);
+  if (month !== void 0 && (month < 1 || month > 12)) return false;
+  if (day !== void 0 && (day < 1 || day > daysInMonth(year, month))) return false;
+  return true;
+}
+function dateValue(value, index, key) {
+  const text = typeof value === "number" && Number.isInteger(value) ? String(value) : value;
+  if (typeof text !== "string" || !DATE.test(text.trim()) || !calendarDate(text.trim())) {
+    throw at(index, `\`${key}\` must be a real date: YYYY, YYYY-MM or YYYY-MM-DD`);
+  }
+  return text.trim();
+}
+function endValue(value, index, key) {
+  if (typeof value === "string" && value.trim().toLowerCase() === "present") return "present";
+  return dateValue(value, index, key);
+}
+function httpUrl2(value, index, key) {
+  const text = nonEmptyString(value, index, key);
+  if (!HTTP_URL.test(text)) throw at(index, `\`${key}\` must be an absolute http(s) URL`);
+  try {
+    new URL(text);
+  } catch {
+    throw at(index, `\`${key}\` is not a parseable URL: ${text}`);
+  }
+  return text;
+}
+function retrievedAt(value, index) {
+  if (typeof value !== "string" || !RETRIEVED_AT.test(value.trim())) {
+    throw at(
+      index,
+      "`retrieved_at` must be YYYY-MM-DD or an ISO 8601 date-time with an explicit zone (quote it in YAML)"
+    );
+  }
+  const text = value.trim();
+  if (!calendarDate(text.slice(0, 10))) {
+    throw at(index, `\`retrieved_at\` is not a real calendar date: ${text}`);
+  }
+  if (text.length === 10) return `${text}T00:00:00.000Z`;
+  if (Number.isNaN(Date.parse(text)))
+    throw at(index, `\`retrieved_at\` is not a valid date-time: ${text}`);
+  return text;
+}
+var keysOf = (record) => Object.keys(record).sort();
+function sameKeys(record, allowed) {
+  return keysOf(record).join(",") === [...allowed].sort().join(",");
+}
+function nodeFor(field, value, index) {
+  if (field === "name") return { "@type": "Person", name: nonEmptyString(value, index, "value") };
+  if (field === "link") return { "@type": "Person", sameAs: [httpUrl2(value, index, "value")] };
+  if (!isRecord2(value)) {
+    throw at(index, "`value` for field `experience` must be a map with role, org and start");
+  }
+  const unknown = keysOf(value).filter(
+    (key) => !EXPERIENCE_KEYS.includes(key)
+  );
+  if (unknown.length > 0) {
+    throw at(
+      index,
+      `unknown experience key(s): ${unknown.join(", ")} (allowed: ${EXPERIENCE_KEYS.join(", ")})`
+    );
+  }
+  const missing = EXPERIENCE_KEYS.filter((key) => key !== "end" && !Object.hasOwn(value, key));
+  if (missing.length > 0) {
+    throw at(
+      index,
+      `\`value\` for field \`experience\` requires role, org and start (missing: ${missing.join(", ")})`
+    );
+  }
+  const end = value.end === void 0 ? void 0 : endValue(value.end, index, "value.end");
+  return {
+    "@type": "Person",
+    jobTitle: nonEmptyString(value.role, index, "value.role"),
+    worksFor: {
+      "@type": "Organization",
+      name: nonEmptyString(value.org, index, "value.org"),
+      startDate: dateValue(value.start, index, "value.start"),
+      ...end !== void 0 && end !== "present" ? { endDate: end } : {}
+    }
+  };
+}
+function rowFrom(raw, index) {
+  if (!isRecord2(raw)) throw at(index, "each row must be a map (- surface: \u2026, field: \u2026, value: \u2026)");
+  if (!sameKeys(raw, ROW_KEYS)) {
+    const unknown = keysOf(raw).filter((key) => !ROW_KEYS.includes(key));
+    const missing = ROW_KEYS.filter((key) => !Object.hasOwn(raw, key));
+    throw at(
+      index,
+      unknown.length > 0 ? `unknown key(s): ${unknown.join(", ")} (allowed: ${ROW_KEYS.join(", ")})` : `missing key(s): ${missing.join(", ")} (required: ${ROW_KEYS.join(", ")})`
+    );
+  }
+  const surface = nonEmptyString(raw.surface, index, "surface");
+  const field = raw.field;
+  if (typeof field !== "string" || !OBSERVATION_FIELDS.includes(field)) {
+    throw at(
+      index,
+      `\`field\` must be one of ${OBSERVATION_FIELDS.join(", ")} (got ${JSON.stringify(raw.field)})`
+    );
+  }
+  const url = httpUrl2(raw.url, index, "url");
+  const retrieved = retrievedAt(raw.retrieved_at, index);
+  return {
+    surface,
+    url,
+    retrieved,
+    jsonLd: [nodeFor(field, raw.value, index)],
+    text: "",
+    links: []
+  };
+}
+function parseObservations(text) {
+  let document;
+  try {
+    document = parse3(text);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new DiscoveryError(`observations: not valid YAML \u2014 ${message}`);
+  }
+  if (document === null || document === void 0) {
+    throw new DiscoveryError("observations: the file is empty \u2014 expected a YAML sequence of rows");
+  }
+  if (!Array.isArray(document)) {
+    throw new DiscoveryError(
+      "observations: the file must be a YAML sequence of rows (- surface: \u2026, field: \u2026, value: \u2026)"
+    );
+  }
+  if (document.length === 0) {
+    throw new DiscoveryError("observations: the sequence declares no rows");
+  }
+  const observations = document.map((row, index) => rowFrom(row, index));
+  const employment = /* @__PURE__ */ new Map();
+  for (const [index, observation] of observations.entries()) {
+    const node = observation.jsonLd[0];
+    const worksFor = node?.worksFor;
+    if (worksFor === void 0) continue;
+    const org = String(worksFor.name);
+    const key = experienceId(observation.surface, org);
+    const first = employment.get(key);
+    if (first !== void 0) {
+      throw at(
+        index,
+        `experience for ${observation.surface} / ${org} is already declared by row ${first.index + 1} (${first.org}) \u2014 the provisional profile holds ONE employment row per surface and org, so a second role at the same org cannot be represented; keep one row per (surface, org)`
+      );
+    }
+    employment.set(key, { index, org });
+  }
+  return observations;
+}
+function loadObservations(path) {
+  let text;
+  try {
+    text = readFileSync9(path, "utf8");
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new DiscoveryError(`observations: cannot read ${path} \u2014 ${message}`);
+  }
+  return parseObservations(text);
+}
+
 // src/commands/discover.ts
-var DISCOVER_SCHEMA_VERSION = "1";
+var DISCOVER_SCHEMA_VERSION = "2";
 function hostOf3(url) {
   try {
     return new URL(url).hostname.toLowerCase().replace(/^www\./, "");
@@ -5533,7 +6313,7 @@ function hostOf3(url) {
     return void 0;
   }
 }
-function httpUrl2(raw, base) {
+function httpUrl3(raw, base) {
   try {
     const url = new URL(raw, base);
     return url.protocol === "http:" || url.protocol === "https:" ? url.toString() : void 0;
@@ -5558,9 +6338,13 @@ function jsonLdOf(html) {
   return nodes;
 }
 function textOf2(html) {
-  return decodeEntities(
-    html.replace(/<script\b[\s\S]*?<\/script>/gi, " ").replace(/<style\b[\s\S]*?<\/style>/gi, " ").replace(/<[^>]+>/g, " ")
-  ).replace(/\s+/g, " ").trim();
+  const collapsed = html.replace(/<script\b[\s\S]*?<\/script>/gi, " ").replace(/<style\b[\s\S]*?<\/style>/gi, " ").replace(/\s+/g, " ");
+  const withBreaks = collapsed.replace(
+    /<\/(?:p|div|li|h[1-6]|title|header|footer|section|article|tr|td|th|main|nav)\s*>/gi,
+    "\n"
+  ).replace(/<br\s*\/?>/gi, "\n").replace(/<[^>]+>/g, " ");
+  const lines2 = decodeEntities(withBreaks).split("\n").map((line2) => line2.replace(/\s+/g, " ").trim()).filter((line2) => line2 !== "");
+  return lines2.join("\n");
 }
 function linksOf(html, base) {
   const links = [];
@@ -5569,7 +6353,7 @@ function linksOf(html, base) {
   for (const match of html.matchAll(pattern)) {
     const raw = match[1];
     if (raw === void 0) continue;
-    const resolved = httpUrl2(decodeEntities(raw), base);
+    const resolved = httpUrl3(decodeEntities(raw), base);
     if (resolved === void 0 || seen.has(resolved)) continue;
     seen.add(resolved);
     links.push(resolved);
@@ -5594,10 +6378,23 @@ async function discover(options) {
     )
   );
   const surfaces = [];
-  const observations = [];
+  const manual = options.manualObservations ?? [];
+  const observations = [...manual];
+  const seenManual = /* @__PURE__ */ new Set();
+  for (const observation of manual) {
+    const key = `${observation.surface}\0${observation.url}`;
+    if (seenManual.has(key)) continue;
+    seenManual.add(key);
+    surfaces.push({
+      url: observation.url,
+      surface: observation.surface,
+      status: null,
+      via: "manual"
+    });
+  }
   const unchecked = [];
   for (const raw of options.urls) {
-    const url = httpUrl2(raw);
+    const url = httpUrl3(raw);
     const host = url === void 0 ? void 0 : hostOf3(url);
     const surface = host ?? raw;
     if (url === void 0 || host === void 0) {
@@ -5618,7 +6415,7 @@ async function discover(options) {
       continue;
     }
     const html = response.text ?? "";
-    surfaces.push({ url, surface, status: response.status });
+    surfaces.push({ url, surface, status: response.status, via: "fetch" });
     observations.push({
       surface,
       url,
@@ -5650,6 +6447,11 @@ async function discover(options) {
       });
     }
   }
+  if (manual.length > 0 && !observations.some((item) => declaredName(item) !== void 0)) {
+    throw new DiscoveryError(
+      "observations: no row declares `name` (field: name) and no machine-read surface declared one either \u2014 a provisional profile needs identity.name, and nothing is invented; add a row with field: name"
+    );
+  }
   const provisional = provisionalProfile(observations);
   return {
     schemaVersion: DISCOVER_SCHEMA_VERSION,
@@ -5663,7 +6465,14 @@ async function discover(options) {
 async function runDiscover(args) {
   let result;
   try {
-    result = await discover(args);
+    const manualObservations = args.observationsPath === void 0 ? void 0 : loadObservations(args.observationsPath);
+    result = await discover({
+      urls: args.urls,
+      ...args.allowHosts !== void 0 ? { allowHosts: args.allowHosts } : {},
+      ...args.retrieved !== void 0 ? { retrieved: args.retrieved } : {},
+      ...args.fetchText !== void 0 ? { fetchText: args.fetchText } : {},
+      ...manualObservations !== void 0 ? { manualObservations } : {}
+    });
   } catch (err) {
     if (err instanceof DiscoveryError) {
       return report("discover", false, EXIT.FAIL, {
@@ -5678,7 +6487,11 @@ async function runDiscover(args) {
     return report("discover", failures === 0, exitCode2, { data: result });
   }
   section("discover \u2014 a provisional profile (nothing written, every fact unattested)");
-  for (const surface of result.surfaces) line(`  read ${surface.surface} \u2014 ${surface.url}`);
+  for (const surface of result.surfaces) {
+    line(
+      surface.via === "manual" ? `  observed ${surface.surface} \u2014 ${surface.url} (manual, no request)` : `  read ${surface.surface} \u2014 ${surface.url}`
+    );
+  }
   for (const item of result.unchecked) line(`  NOT read ${item.surface} \u2014 ${item.reason}`);
   line(`  facts: ${Object.keys(result.provisional.provenance).length} with provenance`);
   line(`  absent (not discovered, never defaulted): ${result.provisional.absent.join(", ")}`);
@@ -5717,6 +6530,12 @@ function compareEngineVersions(a, b) {
   if (left === null || right === null) return null;
   return left.major - right.major || left.minor - right.minor || left.patch - right.patch;
 }
+function engineFloorFor(installed) {
+  const trimmed = installed.trim();
+  const version = parseInstalledVersion(trimmed);
+  if (version === null || /-/.test(trimmed)) return null;
+  return `${version.major}.${version.minor}.${version.patch}`;
+}
 var ENGINE_SYNTAX = 'MAJOR.MINOR.PATCH (e.g. "0.4.0")';
 function evaluateEngineRequirement(pascorc, installed) {
   const declared = pascorc.engine;
@@ -5801,9 +6620,11 @@ function loadWorkspace(workspace) {
 }
 function requirementOf(sources, engineVersion) {
   const requirement = evaluateEngineRequirements(sources, engineVersion);
+  const state = requirement.problem !== void 0 ? "INVALID" : requirement.declared === null ? "absent" : requirement.met ? "met" : "NOT MET";
   return {
     declared: requirement.declared,
     met: requirement.met,
+    state,
     ...requirement.problem === void 0 ? {} : { problem: requirement.problem },
     ...requirement.source === void 0 ? {} : { source: requirement.source }
   };
@@ -5813,14 +6634,19 @@ function describe(reportData) {
   const requirement = reportData.requirement;
   const from = requirement.source === void 0 ? "" : `, declared in ${requirement.source}`;
   let requirementText;
-  if (requirement.problem !== void 0) {
-    requirementText = `engine requirement INVALID: ${requirement.problem}${from}`;
-  } else if (requirement.declared === null) {
-    requirementText = "no engine requirement";
-  } else if (requirement.met) {
-    requirementText = `requires engine >= ${requirement.declared} (met${from})`;
-  } else {
-    requirementText = `requires engine >= ${requirement.declared} (NOT MET \u2014 upgrade: ${ENGINE_UPGRADE_COMMAND}${from})`;
+  switch (requirement.state) {
+    case "INVALID":
+      requirementText = `engine requirement INVALID: ${requirement.problem ?? "malformed declaration"}${from}`;
+      break;
+    case "absent":
+      requirementText = "engine requirement absent \u2014 no .pascorc declares one";
+      break;
+    case "met":
+      requirementText = `requires engine >= ${requirement.declared} (met${from})`;
+      break;
+    case "NOT MET":
+      requirementText = `requires engine >= ${requirement.declared} (NOT MET \u2014 upgrade: ${ENGINE_UPGRADE_COMMAND}${from})`;
+      break;
   }
   return `engine ${reportData.engine.version} \xB7 schema v${reportData.schema.version} \xB7 workspace ${reportData.workspace.path} (${workspaceState}) \xB7 ${requirementText}`;
 }
@@ -5845,9 +6671,60 @@ function runDoctor(args) {
   return healthy ? EXIT.OK : EXIT.FAIL;
 }
 
-// src/commands/edit.ts
-import { readdirSync as readdirSync4 } from "fs";
-import { join as join10 } from "path";
+// src/edit-seed.ts
+var SEEDABLE_ROOTS = ["faq"];
+var SEED_FAQ_ENTRIES = [
+  {
+    id: "question-1",
+    q: "<the first question this entity answers>",
+    a: "<the answer \u2014 a fact the owner can defend, not marketing copy>"
+  },
+  {
+    id: "question-2",
+    q: "<the second question this entity answers>",
+    a: "<the answer \u2014 a fact the owner can defend, not marketing copy>"
+  },
+  {
+    id: "question-3",
+    q: "<the third question this entity answers>",
+    a: "<the answer \u2014 a fact the owner can defend, not marketing copy>"
+  }
+];
+var FAQ_SEED_HEADER = `# faq[] \u2014 the answer-engine surface (contract v1.10, #288): 3\u201320 citable
+# Q&A pairs. Replace every <placeholder>: the answer is the owner's own
+# assertion, never invented copy; \`en\` is required on q and a; a quantitative
+# answer should carry a \`source\`.`;
+function seedTemplate(root) {
+  if (root === "faq") {
+    const rows = SEED_FAQ_ENTRIES.map(
+      (entry) => `- id: ${entry.id}
+  q:
+    en: ${entry.q}
+  a:
+    en: ${entry.a}`
+    );
+    return `${FAQ_SEED_HEADER}
+${rows.join("\n")}
+`;
+  }
+  throw new UsageError(`no seed template for "${root}"`);
+}
+function parseCreateRoot(raw) {
+  const text = raw.trim();
+  const match = /^(?:content\/)?([A-Za-z][A-Za-z0-9]*)(?:\.ya?ml)?$/i.exec(text);
+  const root = match?.[1];
+  if (root === void 0) {
+    throw new UsageError(
+      `--create takes a root name or its content file (faq \xB7 content/faq.yaml) \u2014 got ${JSON.stringify(raw)}`
+    );
+  }
+  if (!SEEDABLE_ROOTS.includes(root)) {
+    throw new UsageError(
+      `--create has no seed template for "${root}" \u2014 seedable roots: ${SEEDABLE_ROOTS.join(", ")}`
+    );
+  }
+  return root;
+}
 
 // src/edit-write.ts
 import { randomUUID } from "crypto";
@@ -5859,7 +6736,8 @@ import {
   cpSync,
   mkdtempSync,
   openSync,
-  readFileSync as readFileSync9,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync10,
   realpathSync as realpathSync3,
   renameSync,
   rmSync as rmSync2,
@@ -5869,6 +6747,16 @@ import {
 import { tmpdir } from "os";
 import { dirname as dirname4, join as join9 } from "path";
 import { isAlias, isMap, isScalar, isSeq, parseDocument as parseDocument2, stringify } from "yaml";
+function owningFile(workspace, root) {
+  let entries;
+  try {
+    entries = readdirSync4(join9(workspace, "content"));
+  } catch {
+    return void 0;
+  }
+  const match = entries.filter((name) => new RegExp(`^${root}\\.ya?ml$`, "i").test(name)).sort()[0];
+  return match === void 0 ? void 0 : `content/${match}`;
+}
 var LOCK_NAME = ".pasco-edit.lock";
 var LOCK_STALE_MS = 3e4;
 function sleep(ms) {
@@ -5968,7 +6856,7 @@ function assertSpliceable(node, original, file, path) {
   }
 }
 function inspect(args, filePath) {
-  const original = readFileSync9(filePath, "utf8");
+  const original = readFileSync10(filePath, "utf8");
   const document = parseDocument2(original);
   if (document.errors.length > 0) {
     throw new LoadError(
@@ -6054,7 +6942,7 @@ function writeEditLocked(args, deps) {
   }
   let current;
   try {
-    current = readFileSync9(filePath, "utf8");
+    current = readFileSync10(filePath, "utf8");
   } catch (err) {
     throw new StaleEditError(
       `${args.target.file}: the file disappeared while the edit was being validated \u2014 nothing was written; re-run (${err.code ?? "error"})`
@@ -6094,38 +6982,102 @@ function writeEditLocked(args, deps) {
   }
   return { file: args.target.file, before, noop: false };
 }
+function previewCreate(args, deps = {}) {
+  const existing = owningFile(args.workspace, args.root);
+  if (existing !== void 0) {
+    throw new WriteRefusedError(
+      `${existing} already exists \u2014 --create seeds a root the workspace does not declare yet and never overwrites one (nothing was written); edit it with \`pasco edit\` or an editor`
+    );
+  }
+  validateSeed(args, deps);
+  return { file: `content/${args.root}.yaml` };
+}
+function createRoot(args, deps = {}) {
+  return withWriteLock(args.workspace, deps.lockWaitMs ?? 2e3, () => {
+    const { file } = previewCreate(args, deps);
+    const filePath = join9(args.workspace, file);
+    if (owningFile(args.workspace, args.root) !== void 0) {
+      throw new WriteRefusedError(
+        `${file} appeared while the seed was being validated \u2014 nothing was written; re-run`
+      );
+    }
+    try {
+      writeFileSync2(filePath, args.text, { mode: 420, flag: "wx" });
+    } catch (err) {
+      if (err instanceof WriteRefusedError) throw err;
+      const code = err.code ?? "error";
+      if (code === "EEXIST") {
+        throw new WriteRefusedError(
+          `${file} appeared before the seed could be written \u2014 nothing was written; re-run`
+        );
+      }
+      throw new LoadError(`${file}: could not write the seed (${code}) \u2014 nothing was written`);
+    }
+    return { file, created: true };
+  });
+}
+function validateSeed(args, deps) {
+  const validate = deps.validate ?? ((workspace) => void load(workspace));
+  const tempWorkspace = mkdtempSync(join9(tmpdir(), "pasco-edit-create-"));
+  try {
+    cpSync(join9(args.workspace, "content"), join9(tempWorkspace, "content"), { recursive: true });
+    writeFileSync2(join9(tempWorkspace, "content", `${args.root}.yaml`), args.text, { mode: 384 });
+    validate(tempWorkspace);
+  } catch (err) {
+    if (err instanceof LoadError) throw err;
+    const code = err.code ?? "error";
+    throw new LoadError(
+      `content/${args.root}.yaml: the seed could not be validated (${code}) \u2014 nothing was written`
+    );
+  } finally {
+    rmSync2(tempWorkspace, { recursive: true, force: true });
+  }
+}
 
 // src/commands/edit.ts
 var SELECTOR_UNSAFE = /[,\]=]|"/;
 function rowLinkAddress(row) {
-  const platform = row.platform ?? "<no platform>";
-  const addressable = row.label !== void 0 && !SELECTOR_UNSAFE.test(row.label);
-  return linkAddress(platform, addressable ? row.label : void 0);
+  if (row.platform === void 0) return "<no platform \u2014 not addressable>";
+  if (!selectorExpressible(row.platform)) {
+    return `<not addressable: platform ${JSON.stringify(row.platform)} cannot be expressed>`;
+  }
+  const label = row.label !== void 0 && selectorExpressible(row.label) ? row.label : void 0;
+  return linkAddress(row.platform, label);
 }
 function linkNote(row) {
   const parts = [];
   if (row.platform === void 0) parts.push("no platform \u2014 not addressable");
-  else if (SELECTOR_UNSAFE.test(row.platform)) {
+  else if (!selectorExpressible(row.platform)) {
     parts.push(
-      `platform ${JSON.stringify(row.platform)} contains a character the address grammar cannot express`
+      `platform ${JSON.stringify(row.platform)} cannot be expressed as a selector (empty, padded, control character or \`, ] = "\`)`
     );
   }
-  if (row.label !== void 0 && SELECTOR_UNSAFE.test(row.label)) {
+  if (row.label !== void 0 && !selectorExpressible(row.label)) {
     parts.push(
-      `label ${JSON.stringify(row.label)} contains a character the address grammar cannot express`
+      `label ${JSON.stringify(row.label)} cannot be expressed as a selector (empty, padded, control character or \`, ] = "\`)`
     );
   }
   return parts.length === 0 ? void 0 : parts.join(" \xB7 ");
 }
-function owningFile(workspace, root) {
-  let entries;
-  try {
-    entries = readdirSync4(join10(workspace, "content"));
-  } catch {
-    return void 0;
-  }
-  const match = entries.filter((name) => new RegExp(`^${root}\\.ya?ml$`, "i").test(name)).sort()[0];
-  return match === void 0 ? void 0 : `content/${match}`;
+function headlineHits(profile, platform, lang) {
+  return profile.headlines.map((row, index) => ({ row, index })).filter(({ row }) => row.platform === platform && row.lang === lang);
+}
+function bioHits(profile, platform, lang, length) {
+  return profile.bios.map((row, index) => ({ row, index })).filter(({ row }) => row.platform === platform && row.lang === lang && row.length === length);
+}
+function linkHits(links, platform, label) {
+  return (links ?? []).map((row, index) => ({ row, index })).filter(
+    ({ row }) => row.platform === platform && (label === void 0 || (row.label ?? "") === label)
+  );
+}
+function faqHits(rows, id) {
+  return rows.map((row, index) => ({ row, index })).filter(({ row }) => row.id === id);
+}
+function faqValue(row, field, lang) {
+  if (field === "source")
+    return row.source === void 0 || row.source === "" ? void 0 : row.source;
+  const value = row[field]?.[lang];
+  return typeof value === "string" && value !== "" ? value : void 0;
 }
 function resolveEditTarget(profile, address, workspace) {
   if (address.kind === "statement") {
@@ -6134,7 +7086,7 @@ function resolveEditTarget(profile, address, workspace) {
     const present = typeof value === "string" && value !== "";
     const available = LANGS2.filter(
       (lang) => typeof statement[lang] === "string" && statement[lang] !== ""
-    ).map((lang) => `positioning.statement.${lang}`);
+    ).map((lang) => statementAddress(lang));
     const file = owningFile(workspace, "positioning");
     return {
       address,
@@ -6152,7 +7104,7 @@ function resolveEditTarget(profile, address, workspace) {
     };
   }
   if (address.kind === "headline") {
-    const hits2 = profile.headlines.map((row, index) => ({ row, index })).filter(({ row }) => row.platform === address.platform && row.lang === address.lang);
+    const hits2 = headlineHits(profile, address.platform, address.lang);
     const file = owningFile(workspace, "headlines");
     return {
       address,
@@ -6175,9 +7127,7 @@ function resolveEditTarget(profile, address, workspace) {
     };
   }
   if (address.kind === "bio") {
-    const hits2 = profile.bios.map((row, index) => ({ row, index })).filter(
-      ({ row }) => row.platform === address.platform && row.lang === address.lang && row.length === address.length
-    );
+    const hits2 = bioHits(profile, address.platform, address.lang, address.length);
     const file = owningFile(workspace, "bios");
     return {
       address,
@@ -6199,10 +7149,76 @@ function resolveEditTarget(profile, address, workspace) {
       ]
     };
   }
+  if (address.kind === "definition") {
+    const definition = profile.identity.definition ?? {};
+    const value = definition[address.lang];
+    const present = typeof value === "string" && value !== "";
+    const available = LANGS2.filter(
+      (lang) => typeof definition[lang] === "string" && definition[lang] !== ""
+    ).map((lang) => definitionAddress(lang));
+    const file = owningFile(workspace, "identity");
+    return {
+      address,
+      ...present && file !== void 0 ? {
+        locate: {
+          file,
+          path: ["definition", address.lang],
+          profilePath: ["identity", "definition", address.lang]
+        }
+      } : {},
+      ...present ? { current: value } : {},
+      matches: present ? 1 : 0,
+      rows: present ? [{ address: address.address, value }] : [],
+      available
+    };
+  }
+  if (address.kind === "faq") {
+    const rows = profile.faq ?? [];
+    const hits2 = faqHits(rows, address.id);
+    const file = owningFile(workspace, "faq");
+    const first = hits2[0];
+    const value = hits2.length === 1 && first !== void 0 ? faqValue(first.row, address.field, address.lang) : void 0;
+    const matches = hits2.length > 1 ? hits2.length : value === void 0 ? 0 : 1;
+    const available = [
+      ...new Set(
+        rows.flatMap((row) => {
+          const out = [];
+          for (const lang of LANGS2) {
+            if (faqValue(row, "q", lang) !== void 0) {
+              out.push(faqAddress(row.id, "q", lang));
+            }
+            if (faqValue(row, "a", lang) !== void 0) {
+              out.push(faqAddress(row.id, "a", lang));
+            }
+          }
+          if (faqValue(row, "source", void 0) !== void 0) {
+            out.push(faqAddress(row.id, "source"));
+          }
+          return out;
+        })
+      )
+    ];
+    const locateIndex = first?.index;
+    return {
+      address,
+      ...matches === 1 && file !== void 0 && locateIndex !== void 0 ? {
+        locate: {
+          file,
+          path: address.field === "source" ? [locateIndex, "source"] : [locateIndex, address.field, address.lang],
+          profilePath: address.field === "source" ? ["faq", locateIndex, "source"] : ["faq", locateIndex, address.field, address.lang]
+        }
+      } : {},
+      ...matches === 1 ? { current: value } : {},
+      matches,
+      rows: hits2.length > 1 ? hits2.map(({ row }) => ({
+        address: faqAddress(row.id, address.field, address.lang),
+        value: faqValue(row, address.field, address.lang) ?? ""
+      })) : matches === 1 ? [{ address: address.address, value }] : [],
+      available
+    };
+  }
   const links = profile.identity.links ?? [];
-  const hits = links.map((row, index) => ({ row, index })).filter(
-    ({ row }) => row.platform === address.platform && (address.label === void 0 || (row.label ?? "") === address.label)
-  );
+  const hits = linkHits(links, address.platform, address.label);
   return {
     address,
     // Read-only address: no write handle is emitted (S2 must not grow a second
@@ -6221,6 +7237,119 @@ function resolveEditTarget(profile, address, workspace) {
     ]
   };
 }
+function hasControlChar(value) {
+  for (const char of value) {
+    const code = char.codePointAt(0);
+    if (code < 32 || code >= 127 && code <= 159) return true;
+    if (code === 8232 || code === 8233) return true;
+  }
+  return false;
+}
+function selectorExpressible(value) {
+  return value !== "" && value === value.trim() && !hasControlChar(value) && !SELECTOR_UNSAFE.test(value);
+}
+function listEditAddresses(profile, block) {
+  const addresses = [];
+  const warnings = [];
+  const seen = /* @__PURE__ */ new Set();
+  const scoped = (candidate) => block === void 0 || block === candidate;
+  const warnOnce = (message) => {
+    if (!warnings.includes(message)) warnings.push(message);
+  };
+  const add = (address, kind, matches, readOnly = false) => {
+    if (seen.has(address)) return;
+    seen.add(address);
+    if (matches !== 1) {
+      warnOnce(
+        `${address} resolves to ${matches} rows \u2014 several rows share it and edit refuses to choose; not listed`
+      );
+      return;
+    }
+    addresses.push({ address, kind, readOnly });
+  };
+  if (scoped("positioning")) {
+    const statement = profile.positioning?.statement ?? {};
+    for (const lang of LANGS2) {
+      if (typeof statement[lang] === "string" && statement[lang] !== "") {
+        add(statementAddress(lang), "statement", 1);
+      }
+    }
+  }
+  if (scoped("headlines")) {
+    const counts = /* @__PURE__ */ new Map();
+    for (const row of profile.headlines) {
+      const address = headlineAddress(row.platform, row.lang);
+      counts.set(address, (counts.get(address) ?? 0) + 1);
+    }
+    for (const row of profile.headlines) {
+      const address = headlineAddress(row.platform, row.lang);
+      add(address, "headline", counts.get(address) ?? 0);
+    }
+  }
+  if (scoped("bios")) {
+    const counts = /* @__PURE__ */ new Map();
+    for (const row of profile.bios) {
+      const address = bioAddress(row.platform, row.lang, row.length);
+      counts.set(address, (counts.get(address) ?? 0) + 1);
+    }
+    for (const row of profile.bios) {
+      const address = bioAddress(row.platform, row.lang, row.length);
+      add(address, "bio", counts.get(address) ?? 0);
+    }
+  }
+  if (scoped("identity.definition")) {
+    const definition = profile.identity.definition ?? {};
+    for (const lang of LANGS2) {
+      if (typeof definition[lang] === "string" && definition[lang] !== "") {
+        add(definitionAddress(lang), "definition", 1);
+      }
+    }
+  }
+  if (scoped("identity.links")) {
+    const links = profile.identity.links ?? [];
+    links.forEach((row, index) => {
+      const where = `identity.links[${index}]`;
+      if (row.platform === void 0) {
+        warnOnce(`${where} has no platform \u2014 not addressable, not listed`);
+        return;
+      }
+      if (!selectorExpressible(row.platform)) {
+        warnOnce(
+          `${where}: platform ${JSON.stringify(row.platform)} cannot be expressed as a selector (empty, padded, control character, or carrying a comma, bracket, equals sign or quote) \u2014 not listed`
+        );
+        return;
+      }
+      const label = row.label !== void 0 && selectorExpressible(row.label) ? row.label : void 0;
+      const matches = linkHits(links, row.platform, label).length;
+      add(linkAddress(row.platform, label), "link", matches, true);
+      if (row.label !== void 0 && label === void 0 && matches === 1) {
+        warnOnce(
+          `${where}: label ${JSON.stringify(row.label)} cannot be expressed as a selector (empty, padded, or carrying a comma, bracket, equals sign, quote or control character) \u2014 listed by its platform only`
+        );
+      }
+    });
+  }
+  if (scoped("faq")) {
+    const rows = profile.faq ?? [];
+    const counts = /* @__PURE__ */ new Map();
+    for (const row of rows) counts.set(row.id, (counts.get(row.id) ?? 0) + 1);
+    for (const row of rows) {
+      const matches = counts.get(row.id) ?? 0;
+      for (const lang of LANGS2) {
+        if (faqValue(row, "q", lang) !== void 0) {
+          add(faqAddress(row.id, "q", lang), "faq", matches);
+        }
+        if (faqValue(row, "a", lang) !== void 0) {
+          add(faqAddress(row.id, "a", lang), "faq", matches);
+        }
+      }
+      if (faqValue(row, "source", void 0) !== void 0) {
+        add(faqAddress(row.id, "source"), "faq", matches);
+      }
+    }
+  }
+  return { addresses, warnings };
+}
 function applyEdit(profile, target, value) {
   const copy = structuredClone(profile);
   const path = target.locate.profilePath;
@@ -6270,11 +7399,30 @@ function explainMiss(artifact, address, platform) {
     }
     return `the ${platform} renderer does not emit this headline`;
   }
+  if (address.kind === "definition") {
+    return `the ${platform} artifact embeds no entity JSON-LD \u2014 only a renderer that emits it publishes identity.definition`;
+  }
   return "no rendered artifact carries this statement \u2014 only renderers that emit it can publish it";
 }
+function jsonText(value) {
+  return value === void 0 ? "" : JSON.stringify(value, null, 2).replace(/</g, "\\u003c");
+}
 function publishedByEdit(before, after, address, workspace, pascorc) {
+  if (address.kind === "faq") {
+    const lang = address.lang ?? "en";
+    const oldNode = jsonText(structuredData(before, lang).faqJsonLd);
+    const newNode = jsonText(structuredData(after, lang).faqJsonLd);
+    const region = changedRegion(oldNode, newNode);
+    if (region !== void 0) {
+      return { changes: [{ platform: "entity", ...region }] };
+    }
+    return {
+      changes: [],
+      reason: "faq[] reaches the FAQPage node of `pasco entity --jsonld` (#360), and this edit does not change that node's bytes"
+    };
+  }
   const media = collectMedia(before, workspace);
-  const platforms = address.kind === "statement" ? [...PLATFORMS] : [address.platform];
+  const platforms = address.kind === "statement" || address.kind === "definition" ? [...PLATFORMS] : [address.platform];
   const beforeSlices = /* @__PURE__ */ new Map();
   for (const platform of PLATFORMS) {
     beforeSlices.set(platform, compileSlice(before, platform, address.lang, pascorc));
@@ -6315,6 +7463,8 @@ function failLoad(err) {
 }
 function ledgerKeyOf(address) {
   if (address.kind === "statement") return "positioning";
+  if (address.kind === "definition") return "identity";
+  if (address.kind === "faq") return void 0;
   if (address.kind === "bio") {
     return `bios:${address.platform}:${address.lang}:${address.length}`;
   }
@@ -6322,15 +7472,31 @@ function ledgerKeyOf(address) {
 }
 function ledgerImpact(profile, address) {
   const key = ledgerKeyOf(address);
+  if (key === void 0) return void 0;
   const unit = deployStatus(profile).units.find((candidate) => candidate.key === key);
   return { key, state: unit?.state ?? "never", surfaces: unit?.surfaces ?? {} };
 }
+function limitScope(address) {
+  if (address.kind === "link") return "link";
+  if (address.kind === "definition") return "definition";
+  if (address.kind === "faq")
+    return address.field === "source" ? "faq source" : `faq ${address.field}`;
+  return address.kind === "bio" ? "bio" : "headline";
+}
 function limitPreflight(profile, address, text) {
-  if (address.kind === "statement") return void 0;
+  if (address.kind === "statement" || address.kind === "faq" && address.field === "source") {
+    return void 0;
+  }
+  const length = [...text].length;
+  if (address.kind === "definition" || address.kind === "faq") {
+    const limit2 = contractLimit(
+      address.kind === "definition" ? "definition" : address.field === "q" ? "faq.q" : "faq.a"
+    );
+    return { limit: limit2, length, over: length > limit2.cap, enforced: true };
+  }
   const surface = address.kind === "bio" ? "bio" : "headline";
-  const checks = profile.checks.length > 0 ? profile.checks : DEFAULT_CHECKS;
+  const checks = capCatalog(profile, DEFAULT_CHECKS);
   const limit = applicableLimit(checks, address.platform, surface);
-  const length = [...text].length;
   return {
     ...limit === void 0 ? {} : { limit },
     length,
@@ -6361,11 +7527,11 @@ function warningsForEdit(published, preflight, profile, address, workspace, pasc
   }
   if (preflight?.limit !== void 0 && preflight.over) {
     out.push(
-      `${preflight.length} chars is over the published cap ${preflight.limit.cap} (${preflight.limit.source})`
+      preflight.enforced === true ? `${preflight.length} chars is over the contract cap ${preflight.limit.cap} \u2014 the schema refuses the write (D12): shorten it first (${preflight.limit.source})` : `${preflight.length} chars is over the published cap ${preflight.limit.cap} (${preflight.limit.source})`
     );
   }
   if (address.kind === "headline" || address.kind === "bio") {
-    const checks = profile.checks.length > 0 ? profile.checks : DEFAULT_CHECKS;
+    const checks = capCatalog(profile, DEFAULT_CHECKS);
     for (const finding3 of limitFindings(profile, checks, address.platform)) {
       if (finding3.message.includes("non-numeric")) out.push(finding3.message);
     }
@@ -6374,6 +7540,8 @@ function warningsForEdit(published, preflight, profile, address, workspace, pasc
 }
 function scopeLabel(address) {
   if (address.kind === "statement") return "every rendered platform";
+  if (address.kind === "definition") return "every artifact that embeds the entity JSON-LD";
+  if (address.kind === "faq") return "the entity FAQPage (`pasco entity --jsonld`, #360)";
   if (address.kind === "link") return "verbatim \u2014 the URL SSOT (\xA73)";
   return `${address.platform}/${address.lang}`;
 }
@@ -6384,6 +7552,18 @@ function runEdit(args) {
   } catch (err) {
     return failLoad(err);
   }
+  if (args.createRoot !== void 0) return runCreate(args);
+  if (args.list === true) {
+    const listed = listEditAddresses(profile, args.listBlock);
+    line("addresses:");
+    for (const entry of listed.addresses) {
+      line(`${entry.address}${entry.readOnly ? "  (read-only)" : ""}`);
+    }
+    for (const warning of listed.warnings) warn2(warning);
+    return report("edit", true, EXIT.OK, {
+      data: { addresses: listed.addresses, warnings: listed.warnings }
+    });
+  }
   if (args.addressArg === void 0) {
     throw new UsageError("usage: pasco edit <contract-path> [--set <text> --check]");
   }
@@ -6540,14 +7720,16 @@ function runEdit(args) {
     line("resolves to 0 rows \u2014 no current value");
     if (proposed !== void 0) {
       line(`proposed: ${proposed}`);
-      line("(edit does not create rows: the field must already exist in the schema and the file)");
+      line(
+        "(edit does not create rows: the field must already exist in the schema and the file; --create seeds a root the workspace does not declare yet)"
+      );
     }
     if (target.available.length > 0) {
       line("available:");
       for (const candidate of target.available) line(`  ${candidate}`);
     }
   } else {
-    const kind = address.kind === "bio" ? "a duplicate row is drift/duplicate-bio" : address.kind === "link" ? "several links share this platform \u2014 add label=<\u2026> (not a drift finding: drift flags the same URL twice)" : "several rows share this address";
+    const kind = address.kind === "bio" ? "a duplicate row is drift/duplicate-bio" : address.kind === "link" ? "several links share this platform \u2014 add label=<\u2026> (not a drift finding: drift flags the same URL twice)" : address.kind === "faq" ? "several faq rows share this id \u2014 fix the duplicate id first" : "several rows share this address";
     line(`resolves to ${target.matches} rows \u2014 ${kind}; edit refuses to choose`);
     target.rows.forEach((row, index) => {
       line(
@@ -6556,7 +7738,7 @@ function runEdit(args) {
     });
   }
   if (preflight !== void 0) {
-    const scope = `${address.kind === "bio" ? "bio" : "headline"}`;
+    const scope = limitScope(address);
     if (preflight.limit === void 0) {
       line(
         `limits: ${preflight.length} chars \u2014 cap unknown (no sourced max-chars for this ${scope} in the catalog: the workspace's content/checks.yaml or the caps shipped with pasco)`
@@ -6568,7 +7750,7 @@ function runEdit(args) {
       );
       if (preflight.over) {
         warn2(
-          `${scope} is ${preflight.length} chars, over the published cap ${preflight.limit.cap} \u2014 the platform may truncate it (${preflight.limit.source})`
+          preflight.enforced === true ? `${scope} is ${preflight.length} chars, over the contract cap ${preflight.limit.cap} \u2014 the schema refuses the write (D12); shorten it (${preflight.limit.source})` : `${scope} is ${preflight.length} chars, over the published cap ${preflight.limit.cap} \u2014 the platform may truncate it (${preflight.limit.source})`
         );
       }
     }
@@ -6624,6 +7806,96 @@ function runEdit(args) {
     }
   });
 }
+function seedLimits(root) {
+  if (root !== "faq") return [];
+  const limits = [];
+  for (const field of ["q", "a"]) {
+    const limit = contractLimit(field === "q" ? "faq.q" : "faq.a");
+    const length = Math.max(...SEED_FAQ_ENTRIES.map((entry) => [...entry[field]].length));
+    limits.push({
+      field,
+      cap: limit.cap,
+      length,
+      over: length > limit.cap,
+      source: limit.source
+    });
+  }
+  return limits;
+}
+function runCreate(args) {
+  const root = args.createRoot;
+  const text = seedTemplate(root);
+  const limits = seedLimits(root);
+  const preview = args.check;
+  const seedLabel = root === "faq" ? `${SEED_FAQ_ENTRIES.length} pairs (the schema minimum) \u2014 replace every <placeholder>` : "template";
+  let file;
+  try {
+    file = preview ? previewCreate({ workspace: args.workspace, root, text }).file : createRoot({ workspace: args.workspace, root, text }).file;
+  } catch (err) {
+    if (err instanceof WriteRefusedError || err instanceof StaleEditError) {
+      return report("edit", false, EXIT.FAIL, {
+        error: {
+          kind: err instanceof StaleEditError ? "stale" : "refused",
+          message: err.message
+        }
+      });
+    }
+    if (err instanceof SchemaValidationError || err instanceof LoadError) {
+      return report("edit", false, EXIT.FAIL, {
+        error: {
+          kind: err instanceof SchemaValidationError ? "schema" : "load",
+          message: err.message,
+          ...err instanceof SchemaValidationError ? { violations: [...err.issues] } : {}
+        }
+      });
+    }
+    throw err;
+  }
+  line(`root:     ${root}`);
+  line(`file:     ${file}`);
+  line(`seed:     ${seedLabel}`);
+  if (limits.length > 0) {
+    for (const limit of limits) {
+      line(
+        `limits:   ${limit.field} ${limit.length}/${limit.cap}${limit.over ? " \u2014 OVER" : " \u2014 ok"} \u2014 ${limit.source}`
+      );
+      if (limit.over) {
+        warn2(
+          `${limit.field} is ${limit.length} chars, over the contract cap ${limit.cap} \u2014 the schema refuses the write (D12); shorten it (${limit.source})`
+        );
+      }
+    }
+  }
+  line(
+    preview ? "would create: yes (--check: validated, nothing was written)" : "written:  yes (validated by load()+schema over a temp copy, then written)"
+  );
+  if (preview) {
+    line("--- seed (nothing was written) ---");
+    for (const seedLine of text.trimEnd().split("\n")) line(`  ${seedLine}`);
+  }
+  line("validates: yes (schema)");
+  return report("edit", true, EXIT.OK, {
+    data: {
+      mode: "create",
+      root,
+      file,
+      created: !preview,
+      preview,
+      seed: seedLabel,
+      // The machine contract carries the template too: a label is not a preview
+      // (#451 fresh pass 2, F2).
+      ...preview ? { template: text } : {},
+      limits: limits.map((limit) => ({
+        field: limit.field,
+        cap: limit.cap,
+        length: limit.length,
+        over: limit.over,
+        source: limit.source
+      })),
+      warnings: []
+    }
+  });
+}
 
 // src/commands/entity.ts
 import { existsSync as existsSync9, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
@@ -6775,12 +8047,12 @@ function runEntity(args) {
 import {
   existsSync as existsSync10,
   mkdirSync as mkdirSync2,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync as renameSync3,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync4
 } from "fs";
-import { join as join11, resolve as resolve3 } from "path";
+import { join as join10, resolve as resolve3 } from "path";
 var AI_POLICY_SCHEMA_VERSION = "1";
 var AI_POLICY_MAX_AGE_DAYS = 180;
 var AI_POLICY_FILES = ["robots.txt", "llms.txt", "AI-POLICY.md"];
@@ -7100,10 +8372,10 @@ function aiPolicyArtifacts(input) {
   };
 }
 function writeArtifacts(dir, artifacts, force) {
-  const targets = AI_POLICY_FILES.map((name) => ({ name, path: join11(dir, name) }));
+  const targets = AI_POLICY_FILES.map((name) => ({ name, path: join10(dir, name) }));
   for (const target of targets) {
     if (!force && existsSync10(target.path)) {
-      const current = readFileSync10(target.path, "utf8");
+      const current = readFileSync11(target.path, "utf8");
       if (!current.includes(AI_POLICY_MARKER)) {
         return {
           error: `refusing to overwrite "${target.path}" \u2014 it was not generated by pasco (pass --force to replace it)`
@@ -7350,7 +8622,20 @@ function runExportProfile(args) {
 
 // src/commands/init.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync3, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12, resolve as resolve4 } from "path";
+import { join as join11, resolve as resolve4 } from "path";
+
+// src/version.ts
+import { readFileSync as readFileSync12 } from "fs";
+var CLI_VERSION = (() => {
+  try {
+    const pkg = JSON.parse(readFileSync12(new URL("../package.json", import.meta.url), "utf8"));
+    return pkg.version;
+  } catch {
+    return "0.0.0";
+  }
+})();
+
+// src/commands/init.ts
 var FLAVOR_BRAND_TEMPLATE = `# ${WORKSPACE_NAME} brand workspace \u2014 content/ flavor (D15/\xA717)
 # The file value IS the root value: a bare scalar (file name = root property).
 brand
@@ -7438,18 +8723,36 @@ Your professional facts live here as text-first YAML (SPEC \xA72.1); the engine
 checks drift and renders per-platform texts. Facts are your own \u2014 this workspace is
 private by default and never leaves your control (D14: integration by configured path).
 
+## The cycle
+
+\`\`\`sh
+pasco init <dir>        scaffold a workspace (content/, README.md, .pascorc)
+edit content/*.yaml     the single source of truth \u2014 edit these, not profiles/
+pasco validate          schema + drift + geo (warnings)
+pasco build [platform]  write the per-platform artifacts
+\`\`\`
+
 ## Files
 
-Three top-level directories, three grains \u2014 nothing nests one inside another:
+Three grains, one per area \u2014 nothing nests one inside another:
 \`content/\` is identity, \`profiles/\` is generated output (its \`variants/\` subdir is input),
 \`posts/\` is the stream.
 
-- \`content/*.yaml\` \u2014 identity facts, the SSOT (file name = root property, see schema/README.md)
+- \`content/*.yaml\` \u2014 identity facts, the SSOT (file name = root property; the contract is described in the [schema documentation](https://github.com/ChristianLuciani/profile-as-code/blob/main/schema/README.md))
 - \`profiles/\` \u2014 generated outputs (created by pasco build; committed: they ARE the deploy artifacts)
 - \`profiles/<platform>/variants/\` \u2014 chosen variant bodies (INPUT, #238; preserved by build)
 - \`posts/\` \u2014 the stream, created by \`pasco post\` (#264): seeds + per-channel projections; never identity facts
 - \`.pascorc\` \u2014 workspace config (defaults)
 
+## Skills
+
+The platform playbooks ship with \`pasco\`, outside this workspace. Run this from
+the workspace root when you need to know what to write for a channel:
+\`pasco skills:export .pasco-skills\` copies them in; each channel lands under
+\`.pasco-skills/<platform>/\`, where you can read its guidance.
+The copy is disposable: add it to .gitignore if you do not want it committed
+(re-running needs \`--force\`).
+
 ## Workflow
 
 \`\`\`sh
@@ -7458,7 +8761,7 @@ pasco build github-readme --lang en   # deterministic base texts
 pasco refine github-readme --variants 3   # agent-driven variants (template + --choose; full flow M3)
 \`\`\`
 
-See packages/cli/README.md for the full command reference.
+See the [CLI reference](https://github.com/ChristianLuciani/profile-as-code/tree/main/packages/cli#readme) for the full command reference, including what \`check\` compares against \`content/\`, the order \`build\` chooses an artifact, and where the per-platform character caps come from.
 `;
 var BRAND_README_TEMPLATE = `# ${WORKSPACE_NAME}
 
@@ -7467,18 +8770,36 @@ Brand workspace for [profile-as-code](https://github.com/ChristianLuciani/profil
 podcast, press, audiences \u2014 live here as text-first YAML; the engine validates,
 checks drift and renders brand surfaces. Private by default (D14: configured path).
 
+## The cycle
+
+\`\`\`sh
+pasco init <dir>        scaffold a workspace (content/, README.md, .pascorc)
+edit content/*.yaml     the single source of truth \u2014 edit these, not profiles/
+pasco validate          schema + drift + geo (warnings)
+pasco build [platform]  write the per-platform artifacts
+\`\`\`
+
 ## Files
 
-Three top-level directories, three grains \u2014 nothing nests one inside another:
+Three grains, one per area \u2014 nothing nests one inside another:
 \`content/\` is identity, \`profiles/\` is generated output (its \`variants/\` subdir is input),
 \`posts/\` is the stream.
 
-- \`content/*.yaml\` \u2014 the brand profile, identity facts (file name = root property, see schema/README.md)
+- \`content/*.yaml\` \u2014 the brand profile, identity facts (file name = root property; the contract is described in the [schema documentation](https://github.com/ChristianLuciani/profile-as-code/blob/main/schema/README.md))
 - \`profiles/\` \u2014 generated outputs (github-org README is the first deploy artifact; pasco build also writes manual-paste files)
 - \`profiles/<platform>/variants/\` \u2014 chosen variant bodies (INPUT, #238; preserved by build)
 - \`posts/\` \u2014 the stream, created by \`pasco post\` (#264): seeds + per-channel projections; never identity facts
 - \`.pascorc\` \u2014 workspace config (defaults)
 
+## Skills
+
+The platform playbooks ship with \`pasco\`, outside this workspace. Run this from
+the workspace root when you need to know what to write for a channel:
+\`pasco skills:export .pasco-skills\` copies them in; each channel lands under
+\`.pasco-skills/<platform>/\`, where you can read its guidance.
+The copy is disposable: add it to .gitignore if you do not want it committed
+(re-running needs \`--force\`).
+
 ## Workflow
 
 \`\`\`sh
@@ -7487,14 +8808,19 @@ pasco check                   # handle-matrix rules (handle-claimed / handle-con
 pasco build github-org --lang en   # org README (git deploy)
 \`\`\`
 
-See packages/cli/README.md for the full command reference.
+See the [CLI reference](https://github.com/ChristianLuciani/profile-as-code/tree/main/packages/cli#readme) for the full command reference, including what \`check\` compares against \`content/\`, the order \`build\` chooses an artifact, and where the per-platform character caps come from.
+`;
+function pascorcTemplate(engineVersion) {
+  const floor = engineFloorFor(engineVersion);
+  const engine = floor === null ? "" : `  "engine": "${floor}",
 `;
-var PASCORC_TEMPLATE = `{
+  return `{
   "workspace": ".",
-  "defaults": { "lang": "en", "variants": 3 },
+${engine}  "defaults": { "lang": "en", "variants": 3 },
   "diff": { "tagPattern": "release-*" }
 }
 `;
+}
 var BRAND_FILES = {
   "identity.yaml": BRAND_IDENTITY_TEMPLATE,
   "socialHandles.yaml": BRAND_SOCIAL_HANDLES_TEMPLATE,
@@ -7506,7 +8832,7 @@ var BRAND_FILES = {
 };
 function runInit(args) {
   const dir = resolve4(args.cwd, args.dir ?? ".");
-  const contentDir = join12(dir, "content");
+  const contentDir = join11(dir, "content");
   const brand = args.flavor === "brand";
   if (existsSync11(contentDir)) {
     return report("init", false, EXIT.FAIL, {
@@ -7515,9 +8841,9 @@ function runInit(args) {
   }
   const files = brand ? { ...BRAND_FILES, "checks.yaml": DEFAULT_CHECKS_YAML } : { "identity.yaml": IDENTITY_TEMPLATE, "checks.yaml": DEFAULT_CHECKS_YAML };
   const targets = [
-    ...Object.entries(files).map(([name, content]) => ({ path: join12(contentDir, name), content })),
-    { path: join12(dir, "README.md"), content: brand ? BRAND_README_TEMPLATE : README_TEMPLATE },
-    { path: join12(dir, ".pascorc"), content: PASCORC_TEMPLATE }
+    ...Object.entries(files).map(([name, content]) => ({ path: join11(contentDir, name), content })),
+    { path: join11(dir, "README.md"), content: brand ? BRAND_README_TEMPLATE : README_TEMPLATE },
+    { path: join11(dir, ".pascorc"), content: pascorcTemplate(CLI_VERSION) }
   ];
   for (const t of targets) {
     if (existsSync11(t.path)) {
@@ -7543,37 +8869,37 @@ function runInit(args) {
 }
 
 // src/commands/post.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync6, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname5, join as join14 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readdirSync as readdirSync6, readFileSync as readFileSync14, statSync as statSync6, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname5, join as join13 } from "path";
 import { parseDocument as parseDocument4 } from "yaml";
 
 // src/post-store.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync5, writeFileSync as writeFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync4, readdirSync as readdirSync5, readFileSync as readFileSync13, statSync as statSync5, writeFileSync as writeFileSync6 } from "fs";
+import { join as join12 } from "path";
 import { parseDocument as parseDocument3, stringify as stringify2 } from "yaml";
 var SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function isSafeSeedId(id) {
   return SAFE_ID.test(id) && !id.includes("..");
 }
 function postsDir(workspace) {
-  return join13(workspace, "posts");
+  return join12(workspace, "posts");
 }
 function seedDir(workspace, id) {
   if (!isSafeSeedId(id)) throw new Error(`unsafe seed id ${JSON.stringify(id)}`);
-  return join13(postsDir(workspace), id);
+  return join12(postsDir(workspace), id);
 }
 function seedPath(workspace, id) {
-  return join13(seedDir(workspace, id), "seed.md");
+  return join12(seedDir(workspace, id), "seed.md");
 }
 function ledgerPath(workspace, id) {
-  return join13(seedDir(workspace, id), "post.yaml");
+  return join12(seedDir(workspace, id), "post.yaml");
 }
 function variantPath(workspace, id, channel, variant) {
   if (!SAFE_ID.test(variant) || variant.includes("..")) {
     throw new Error(`unsafe variant id ${JSON.stringify(variant)}`);
   }
-  return join13(seedDir(workspace, id), channel, `${variant}.md`);
+  return join12(seedDir(workspace, id), channel, `${variant}.md`);
 }
 function hashText(text) {
   return createHash3("sha256").update(text).digest("hex");
@@ -7595,7 +8921,7 @@ function defaultLedger(id, source, options = {}) {
 function readLedger(workspace, id) {
   const path = ledgerPath(workspace, id);
   if (!existsSync12(path)) throw new Error(`no post ledger at ${path}`);
-  const doc = parseDocument3(readFileSync11(path, "utf8"));
+  const doc = parseDocument3(readFileSync13(path, "utf8"));
   if (doc.errors.length > 0) {
     throw new Error(`${path}: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`);
   }
@@ -7631,7 +8957,7 @@ function seedText(workspace, id, seen = /* @__PURE__ */ new Set()) {
   }
   const path = seedPath(workspace, id);
   if (!existsSync12(path)) throw new Error(`no seed at ${path}`);
-  return readFileSync11(path, "utf8");
+  return readFileSync13(path, "utf8");
 }
 function createSeed(workspace, id, text, source = "authored", options = {}) {
   if (!isSafeSeedId(id)) throw new Error(`unsafe seed id ${JSON.stringify(id)}`);
@@ -7655,7 +8981,7 @@ function listSeedIds(workspace) {
   if (!existsSync12(dir)) return [];
   return readdirSync5(dir).filter((name) => {
     try {
-      return statSync5(join13(dir, name)).isDirectory() && isSafeSeedId(name);
+      return statSync5(join12(dir, name)).isDirectory() && isSafeSeedId(name);
     } catch {
       return false;
     }
@@ -7664,7 +8990,7 @@ function listSeedIds(workspace) {
 function chooseVariant(workspace, id, channel, variant, publishedText) {
   const path = variantPath(workspace, id, channel, variant);
   if (!existsSync12(path)) throw new Error(`no variant body at ${path}`);
-  const text = readFileSync11(path, "utf8");
+  const text = readFileSync13(path, "utf8");
   if (text.trim() === "") throw new Error(`variant body is empty at ${path}`);
   const ledger = readLedger(workspace, id);
   const templateHash = hashText(text);
@@ -7688,7 +9014,7 @@ function chosenVariant(workspace, ledger, channel) {
   if (chosen === void 0) return void 0;
   const path = variantPath(workspace, ledger.id, channel, chosen);
   if (!existsSync12(path)) return void 0;
-  const text = readFileSync11(path, "utf8");
+  const text = readFileSync13(path, "utf8");
   return { variant: chosen, text, path };
 }
 
@@ -7711,7 +9037,7 @@ function readRules(channel, format) {
       skillsDir() === void 0 ? NOT_SHIPPED_MESSAGE : `no ${format} post skill for "${channel}" \u2014 expected skills/${channel}/${file}`
     );
   }
-  const doc = parseDocument4(readFileSync12(path, "utf8"));
+  const doc = parseDocument4(readFileSync14(path, "utf8"));
   if (doc.errors.length > 0) {
     throw new UsageError(`${path}: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`);
   }
@@ -8155,9 +9481,9 @@ function buildLongformTask(args) {
   ].join("\n");
 }
 function readPostizConfig(workspace) {
-  const path = join14(workspace, "postiz.yaml");
+  const path = join13(workspace, "postiz.yaml");
   if (!existsSync13(path)) return {};
-  const doc = parseDocument4(readFileSync12(path, "utf8"));
+  const doc = parseDocument4(readFileSync14(path, "utf8"));
   if (doc.errors.length > 0) {
     throw new UsageError(`${path}: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`);
   }
@@ -8226,7 +9552,7 @@ function handleSeed(args) {
   if (!existsSync13(args.textArg)) {
     throw new UsageError(`seed file not found: ${args.textArg}`);
   }
-  const text = readFileSync12(args.textArg, "utf8");
+  const text = readFileSync14(args.textArg, "utf8");
   if (text.trim() === "") throw new UsageError("seed text is empty");
   if (existsSync13(seedPath(args.workspace, seedId))) {
     throw new UsageError(
@@ -8266,7 +9592,7 @@ function handleTask(args) {
   const channels = splitChannels(args.channelArg);
   const variants = parseVariants(
     args.variantsArg,
-    format === "longform" ? 1 : args.pascorc.defaults?.variants ?? 3
+    format === "longform" ? 1 : args.pascorc.defaults?.variants ?? DEFAULT_VARIANTS
   );
   const lang = parseLang(defaultsLang(args.pascorc));
   const existing = existsSync13(ledgerPath(args.workspace, seedId)) ? readLedger(args.workspace, seedId) : void 0;
@@ -8326,7 +9652,7 @@ function handleTask(args) {
       lang,
       ...from !== void 0 ? { derivedFrom: from } : {}
     });
-    const taskPath = join14(seedDir(args.workspace, seedId), channel, "task.md");
+    const taskPath = join13(seedDir(args.workspace, seedId), channel, "task.md");
     mkdirSync5(dirname5(taskPath), { recursive: true });
     writeFileSync7(taskPath, task);
     results.push({
@@ -8374,7 +9700,7 @@ function handleChoose(args) {
     if (!existsSync13(args.textArg)) throw new UsageError(`variant file not found: ${args.textArg}`);
     const target = variantPath(args.workspace, seedId, channel, args.variantArg);
     mkdirSync5(dirname5(target), { recursive: true });
-    writeFileSync7(target, readFileSync12(args.textArg, "utf8"));
+    writeFileSync7(target, readFileSync14(args.textArg, "utf8"));
   }
   const loaded = loadProfile3(args.workspace);
   if (typeof loaded === "number") return loaded;
@@ -8382,7 +9708,7 @@ function handleChoose(args) {
   if (!existsSync13(variantFile)) {
     throw new UsageError(`no variant body at ${variantFile}`);
   }
-  const rendered = renderFacts(readFileSync12(variantFile, "utf8"), loaded);
+  const rendered = renderFacts(readFileSync14(variantFile, "utf8"), loaded);
   if (rendered.dangling.length > 0) {
     throw new UsageError(`dangling fact ref(s): ${rendered.dangling.join(", ")}`);
   }
@@ -8638,7 +9964,7 @@ function handleExport(args) {
       posts.push(item.post);
       continue;
     }
-    const path = join14(seedDir(args.workspace, ledger.id), item.channel, "paste-checklist.md");
+    const path = join13(seedDir(args.workspace, ledger.id), item.channel, "paste-checklist.md");
     mkdirSync5(dirname5(path), { recursive: true });
     writeFileSync7(
       path,
@@ -8658,7 +9984,7 @@ function handleExport(args) {
     });
   }
   const payload = { type, date, shortLink: false, tags: [], posts };
-  const out = args.outArg ?? join14(seedDir(args.workspace, seedId), "postiz.json");
+  const out = args.outArg ?? join13(seedDir(args.workspace, seedId), "postiz.json");
   if (posts.length > 0) {
     mkdirSync5(dirname5(out), { recursive: true });
     writeFileSync7(out, `${JSON.stringify(payload, null, 2)}
@@ -8716,7 +10042,7 @@ function handleImport(args) {
   const started = Date.now();
   const imported = [];
   for (const file of files) {
-    const text = readFileSync12(join14(sourceDir, file), "utf8");
+    const text = readFileSync14(join13(sourceDir, file), "utf8");
     if (text.trim() === "") continue;
     const base = slugify(file.replace(/\.md$/, "")) || "post";
     let id = `imported-${base}`;
@@ -8813,7 +10139,7 @@ function runPost(args) {
 
 // src/commands/presence.ts
 var PRESENCE_SCHEMA_VERSION = "1";
-function loadOrReport(command, workspace) {
+function loadOrReport2(command, workspace) {
   try {
     return { profile: load(workspace) };
   } catch (err) {
@@ -8856,7 +10182,7 @@ function releasePlanPayload(plan) {
 }
 var KIND_ORDER = ["repo-meta", "profile", "distribution"];
 function runPresence(args) {
-  const loaded = loadOrReport("presence", args.workspace);
+  const loaded = loadOrReport2("presence", args.workspace);
   if ("fail" in loaded) return loaded.fail;
   let board;
   try {
@@ -8885,7 +10211,7 @@ function runPresence(args) {
   return EXIT.OK;
 }
 function runReleasePlan(args) {
-  const loaded = loadOrReport("release plan", args.workspace);
+  const loaded = loadOrReport2("release plan", args.workspace);
   if ("fail" in loaded) return loaded.fail;
   let plan;
   try {
@@ -8900,11 +10226,16 @@ function runReleasePlan(args) {
     `Release plan v${plan.release.version} (${plan.release.date}) \xB7 ${plan.release.id} \u2014 ${plan.release.summary}`
   );
   line("ORDER  KIND            SURFACE               STATE");
-  plan.surfaces.forEach((row, index) => {
-    const order = String(index + 1).padStart(5);
+  plan.surfaces.forEach((row) => {
+    const order = String(row.order).padStart(5);
     line(`${order}  ${row.kind.padEnd(15)} ${row.surface.padEnd(21)} ${row.state}`);
+    for (const unknown of row.unknownUnits) {
+      line(`       \u21B3 changedUnit "${unknown}" is not an SSOT unit \u2014 fix the release row`);
+    }
     for (const missing of row.missingUnits) {
-      line(`       \u21B3 changedUnit "${missing}" is not an SSOT unit \u2014 fix the release row`);
+      line(
+        `       \u21B3 changedUnit "${missing}" has no deploy record on this surface yet \u2014 pending fan-out`
+      );
     }
   });
   section("Base text (factual spine; the copy per kind lives in the shipped skills)");
@@ -8921,13 +10252,13 @@ import {
   existsSync as existsSync15,
   mkdirSync as mkdirSync6,
   readdirSync as readdirSync7,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync15,
   renameSync as renameSync4,
   rmSync as rmSync3,
   statSync as statSync7,
   writeFileSync as writeFileSync8
 } from "fs";
-import { basename as basename2, join as join16, dirname as parentDir, relative as relative4, resolve as resolve6 } from "path";
+import { basename as basename2, join as join15, dirname as parentDir, relative as relative4, resolve as resolve6 } from "path";
 
 // src/preview/document.ts
 import { Marked } from "marked";
@@ -9031,7 +10362,7 @@ function renderSection(section2, assets) {
   ${notes}
 </section>`;
 }
-function renderChecks(checks, limits) {
+function renderChecks(checks, limits, limitsSource) {
   const errors = checks.filter((c) => c.severity === "error").length;
   const warns = checks.length - errors;
   const rows = checks.length === 0 ? `<p class="empty">no finding \u2014 the offline rules that ran did not complain</p>` : `<ul class="findings">${checks.map(
@@ -9043,7 +10374,7 @@ function renderChecks(checks, limits) {
     <span class="tag">${errors} error(s) \xB7 ${warns} warning(s)</span>
     <span class="path">the same offline rules pasco check runs</span>
   </header>
-  <div class="body">${renderLimits(limits)}${rows}</div>
+  <div class="body">${renderLimits(limits, limitsSource)}${rows}</div>
 </section>`;
 }
 function renderUnpublished(items) {
@@ -9056,9 +10387,10 @@ function renderUnpublished(items) {
   <div class="body"><ul class="findings">${items.map((item) => `<li><code>${escapeHtml(item.id)}</code> \u2014 ${escapeHtml(item.reason)}</li>`).join("")}</ul></div>
 </section>`;
 }
-function renderLimits(limits) {
+function renderLimits(limits, source) {
   if (limits.length === 0) return "";
-  return `<table class="limits"><caption>declared limits (content/checks.yaml)</caption><thead><tr><th>platform</th><th>rule</th><th>value</th></tr></thead><tbody>${limits.map(
+  const caption = source === "workspace" ? "declared limits (content/)" : "declared limits (caps shipped with pasco, #240)";
+  return `<table class="limits"><caption>${caption}</caption><thead><tr><th>platform</th><th>rule</th><th>value</th></tr></thead><tbody>${limits.map(
     (l) => `<tr><td><code>${escapeHtml(l.platform)}</code></td><td>${escapeHtml(l.rule)}</td><td><code>${escapeHtml(l.value)}</code></td></tr>`
   ).join("")}</tbody></table>`;
 }
@@ -9090,7 +10422,7 @@ function renderPreviewDocument(doc) {
 <main>
 ${doc.sections.map((s) => renderSection(s, assets)).join("\n")}
 ${renderUnpublished(doc.unpublished)}
-${renderChecks(doc.checks, doc.limits)}
+${renderChecks(doc.checks, doc.limits, doc.limitsSource)}
 ${warnings}
 ${omitted === "" ? "" : `<section class="surface" id="assets" aria-labelledby="assets-title">
   <header><h2 id="assets-title">assets</h2><span class="tag">${doc.assets.length} embedded \xB7 ${doc.omitted.length} left out</span></header>
@@ -9108,7 +10440,7 @@ ${omitted === "" ? "" : `<section class="surface" id="assets" aria-labelledby="a
 
 // src/preview/privacy.ts
 import { existsSync as existsSync14, realpathSync as realpathSync4 } from "fs";
-import { basename, join as join15, resolve as resolve5, sep } from "path";
+import { basename, join as join14, resolve as resolve5, sep } from "path";
 var ABSOLUTE_PATHS = [
   {
     name: "posix-home-or-system",
@@ -9317,13 +10649,13 @@ function countFacts(value) {
   return 0;
 }
 function contentSources(workspace) {
-  const root = join16(workspace, "content");
+  const root = join15(workspace, "content");
   if (!existsSync15(root)) return [];
   const out = [];
   const walk = (dir) => {
     for (const name of readdirSync7(dir).sort()) {
       if (name.startsWith(".")) continue;
-      const path = join16(dir, name);
+      const path = join15(dir, name);
       if (statSync7(path).isDirectory()) {
         walk(path);
         continue;
@@ -9374,7 +10706,7 @@ function inlineAssets(bundle) {
       omitted.push({ target: asset.target, reason: "source file is gone" });
       continue;
     }
-    const bytes = readFileSync13(asset.source);
+    const bytes = readFileSync15(asset.source);
     total += bytes.byteLength;
     assets.push({
       target: asset.target,
@@ -9502,11 +10834,11 @@ function runPreview(args) {
       `fact-present not run for ${finding3}: no artifact on disk or no renderer for the flavor`
     );
   }
-  const outDir = args.outArg === void 0 ? join16(args.workspace, ".pasco", "preview") : resolve6(process.cwd(), args.outArg);
-  const file = join16(outDir, "index.html");
+  const outDir = args.outArg === void 0 ? join15(args.workspace, ".pasco", "preview") : resolve6(process.cwd(), args.outArg);
+  const file = join15(outDir, "index.html");
   if (outIsUnignoredInRepo(outDir, file)) {
     warnings.push(
-      `--out lands inside a git work tree and is not ignored \u2014 commit only if you mean to publish it (add "${relative4(resolve6(args.workspace), file)}" to .gitignore)`
+      `preview output (${relative4(resolve6(args.workspace), file)}) lands inside a git work tree and is not ignored \u2014 commit only if you mean to publish it (add it to .gitignore)`
     );
   }
   const facts = countFacts(profile);
@@ -9527,11 +10859,12 @@ function runPreview(args) {
       rule: row.rule,
       value: JSON.stringify(row.value)
     })),
+    limitsSource: catalogSource(profile),
     warnings
   });
   const sources = [
     ...contentSources(args.workspace),
-    ...existsSync15(join16(args.workspace, ".pascorc")) ? [{ role: "config", path: join16(args.workspace, ".pascorc") }] : [],
+    ...existsSync15(join15(args.workspace, ".pascorc")) ? [{ role: "config", path: join15(args.workspace, ".pascorc") }] : [],
     ...inlined.sources
   ];
   const privacy = privacyFindings({
@@ -9627,8 +10960,8 @@ function runPreview(args) {
 }
 
 // src/commands/refine.ts
-import { existsSync as existsSync16, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
+import { join as join16 } from "path";
 import { parseDocument as parseDocument5, stringify as stringify3 } from "yaml";
 var REFINE_OWNER = "M3 SOTA research per platform \u2192 skills v1 + the full refine flow (SPEC \xA712/\xA716 M3); model-agnostic (D10/D11/D13)";
 function loadProfile4(workspace) {
@@ -9651,10 +10984,10 @@ function loadProfile4(workspace) {
   }
 }
 function recordVariant(workspace, platform, lang, variantId) {
-  const activePath = join17(workspace, "content", "active.yaml");
+  const activePath = join16(workspace, "content", "active.yaml");
   let active = {};
   if (existsSync16(activePath)) {
-    const doc = parseDocument5(readFileSync14(activePath, "utf8"));
+    const doc = parseDocument5(readFileSync16(activePath, "utf8"));
     if (doc.errors.length > 0) {
       throw new Error(
         `content/active.yaml: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`
@@ -9681,7 +11014,10 @@ function runRefine(args) {
   }
   const platform = parsePlatform(args.platformArg);
   const lang = parseLang(defaultsLang(args.pascorc, args.langArg));
-  const variants = parseVariants(args.variantsArg, args.pascorc.defaults?.variants ?? 3);
+  const variants = parseVariants(
+    args.variantsArg,
+    args.pascorc.defaults?.variants ?? DEFAULT_VARIANTS
+  );
   if (args.choose !== void 0 && !isSafeVariantId(args.choose)) {
     throw new UsageError(
       "--choose <variantId> must be a safe id (letters, digits, dot, underscore, dash; no slash or '..')"
@@ -9728,7 +11064,12 @@ function runRefine(args) {
   const slice = compile(profile, platform, lang);
   const identity = slice.identity;
   const links = (identity.links ?? []).map((l) => `${l.platform ?? "?"}:${l.url}`).join(", ");
-  const experience = slice.experience.map((e) => `${e.role} @ ${e.org} (${e.start}\u2013${e.end ?? "present"})`).join(" | ");
+  const experience = slice.experience.map((e) => `${textOf(e.role, lang)} @ ${e.org} (${e.start}\u2013${e.end ?? "present"})`).join(" | ");
+  const variantPrefix = platform.replace(/[^a-z]/g, "");
+  const variantExamples = Array.from(
+    { length: Math.min(variants, 3) },
+    (_, i) => `${variantPrefix}-${lang}-${i + 1}`
+  ).join(", ");
   const projects = slice.projects.map((p) => p.name).join(", ");
   const publications = slice.publications.map((p) => p.title).join(" | ");
   const anchors = slice.keywords.geo.associations?.join(", ") ?? "";
@@ -9744,9 +11085,9 @@ function runRefine(args) {
     `Language: ${lang}`,
     `Skill (communicative strategy \u2014 READ IT FIRST): ${skillLine(skill)}`,
     `Research (dated sources): ${researchPath}`,
-    `Variant id convention: ${platform.replace(/[^a-z]/g, "")}-${lang}-<n> (e.g. gh-en-1, gh-en-2, gh-en-3).`,
+    `Variant id convention: ${variantPrefix}-${lang}-<n> (e.g. ${variantExamples}).`,
     ``,
-    `Facts (language-independent \u2014 MUST stay byte-identical across variants and platforms):`,
+    `Facts (language-independent \u2014 MUST stay byte-identical across variants and platforms, except \`role\`: a langMap shown in ${lang}, falling back to en):`,
     `  name: ${identity.name}`,
     `  location: ${identity.location ?? "\u2014"}`,
     `  links: ${links || "\u2014"}`,
@@ -9783,11 +11124,11 @@ function runRefine(args) {
 
 // src/commands/skills-export.ts
 import { cpSync as cpSync2, existsSync as existsSync17, mkdirSync as mkdirSync7, readdirSync as readdirSync8, statSync as statSync8 } from "fs";
-import { join as join18, resolve as resolve7, sep as sep2 } from "path";
+import { join as join17, resolve as resolve7, sep as sep2 } from "path";
 function countFiles(dir) {
   let total = 0;
   for (const entry of readdirSync8(dir, { withFileTypes: true })) {
-    if (entry.isDirectory()) total += countFiles(join18(dir, entry.name));
+    if (entry.isDirectory()) total += countFiles(join17(dir, entry.name));
     else total += 1;
   }
   return total;
@@ -9865,7 +11206,7 @@ function runSkillsExport(args) {
 
 // src/commands/status.ts
 import { writeFileSync as writeFileSync11 } from "fs";
-import { join as join20 } from "path";
+import { join as join19 } from "path";
 
 // src/report-shape.ts
 function summaryOf(data) {
@@ -9918,8 +11259,8 @@ function filterReport(reportData, platform) {
 
 // src/verify.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
+import { join as join18 } from "path";
 import { parseDocument as parseDocument6, stringify as stringify4 } from "yaml";
 
 // src/capabilities.ts
@@ -9946,13 +11287,13 @@ var depsOf = (args, profile) => ({
   fetchText: args.deps?.fetchText ?? (async () => ({ status: 0 }))
 });
 function ledgerPathOf(workspace) {
-  return join19(workspace, "content", "deployments.yaml");
+  return join18(workspace, "content", "deployments.yaml");
 }
 function readLedger2(args, kind) {
   const ledgerPath2 = ledgerPathOf(args.workspace);
   let ledger = {};
   if (existsSync18(ledgerPath2)) {
-    const doc = parseDocument6(readFileSync15(ledgerPath2, "utf8"));
+    const doc = parseDocument6(readFileSync17(ledgerPath2, "utf8"));
     if (doc.errors.length > 0) {
       return {
         fail: report("status", false, EXIT.FAIL, {
@@ -10059,7 +11400,7 @@ function finishVerify(args, profile, verdicts, requests) {
     });
   }
   section(
-    `verified \u2014 ${requests} fetch(es) for ${verdicts.length} record(s)${args.platformArg !== void 0 ? ` (surface: ${args.platformArg})` : ""}`
+    `checked ${verdicts.length} record(s) \u2014 ${requests} fetch(es)${args.platformArg !== void 0 ? ` (surface: ${args.platformArg})` : ""}`
   );
   for (const { key, verdict } of verdicts) {
     line(`  ${key} \u2192 ${verdict.surface}: ${certToken(verdict.certification)}`);
@@ -10135,23 +11476,23 @@ async function verifySurface(surface, existing, capability, fetchText) {
       write: true
     };
   }
-  let digest;
+  let digest2;
   if (response.text !== void 0) {
     try {
-      digest = digestOf(extractor(response.text));
+      digest2 = digestOf(extractor(response.text));
     } catch {
-      digest = void 0;
+      digest2 = void 0;
     }
   }
   const verdict = certificationVerdict(
     { certification: stored },
-    { status: response.status, ...digest !== void 0 ? { digest } : {} }
+    { status: response.status, ...digest2 !== void 0 ? { digest: digest2 } : {} }
   );
   return {
     surface,
     certification: attemptRecord(verdict, {
       ...evidence,
-      ...digest !== void 0 ? { liveHash: digest } : {}
+      ...digest2 !== void 0 ? { liveHash: digest2 } : {}
     }),
     fetched: true,
     write: true
@@ -10162,9 +11503,9 @@ async function verifySurface(surface, existing, capability, fetchText) {
 var CHECKLIST_HEADER = `# CHECKLIST \u2014 deploy status
 
 <!-- AUTO-GENERATED by \`pasco status --write-checklist\` (D18, SPEC \xA719) \u2014 do not edit by hand.
-     Regenerate after every deploy confirm: pasco status --mark <ledgerKey> <surface>.
+     Regenerate after every deploy confirm: pasco status --mark <ledgerKey> <platform>.
      Source of truth: content/deployments.yaml (only \`pasco\` mutates it). -->`;
-function loadOrReport2(args) {
+function loadOrReport3(args) {
   try {
     return { profile: load(args.workspace) };
   } catch (err) {
@@ -10234,13 +11575,13 @@ function markDeployed(args, profile) {
   }
   let deployedAt = (/* @__PURE__ */ new Date()).toISOString();
   if (args.markAt !== void 0) {
-    const at = new Date(args.markAt);
-    if (Number.isNaN(at.getTime())) {
+    const at2 = new Date(args.markAt);
+    if (Number.isNaN(at2.getTime())) {
       return report("status", false, EXIT.FAIL, {
         error: { kind: "mark", message: `--at "${args.markAt}" is not a valid ISO 8601 date-time` }
       });
     }
-    deployedAt = at.toISOString();
+    deployedAt = at2.toISOString();
   }
   const read = readLedger2(args, "mark");
   if ("fail" in read) return read.fail;
@@ -10466,7 +11807,7 @@ async function runStatus(args) {
       }
     });
   }
-  const loaded = loadOrReport2(args);
+  const loaded = loadOrReport3(args);
   if ("fail" in loaded) return loaded.fail;
   const profile = loaded.profile;
   if (args.markKey !== void 0) return markDeployed(args, profile);
@@ -10479,7 +11820,7 @@ async function runStatus(args) {
   const publication = publicationOf(args, profile, reportData);
   if (args.writeChecklist === true) {
     writeFileSync11(
-      join20(args.workspace, "CHECKLIST.md"),
+      join19(args.workspace, "CHECKLIST.md"),
       checklistBody(reportData, completion, profile, publicationAll),
       "utf8"
     );
@@ -10547,23 +11888,40 @@ async function runStatus(args) {
     line(`  coverage: ${publicationCoverageLine(publication)}`);
   }
   line(
-    "  \u2192 pasco status --mark <ledgerKey> <surface> confirms a paste; --verify [platform] runs the opt-in C1 live check; --write-checklist regenerates CHECKLIST.md"
+    "  \u2192 pasco status --mark <ledgerKey> <platform> confirms a paste; --verify [platform] runs the opt-in C1 live check; --write-checklist regenerates CHECKLIST.md"
   );
   return EXIT.OK;
 }
 
 // src/commands/validate.ts
+function unrecognizedKeyHint(issues, floor) {
+  if (floor?.declared != null && !floor.met) return null;
+  if (!issues.some((issue2) => issue2.message.trim().toLowerCase().startsWith("unrecognized key"))) {
+    return null;
+  }
+  return `hint: the data has a field this engine does not know \u2014 the data may be newer than this CLI; upgrade with \`${ENGINE_UPGRADE_COMMAND}\`, then run \`pasco doctor\``;
+}
+function geoSectionLine(s) {
+  return `  ${s.label}: ${s.applicable === false ? "n/a" : `${s.score}/100`} \u2014 ${s.detail}`;
+}
 function runValidate(args) {
   let profile;
   try {
     profile = load(args.workspace);
   } catch (err) {
     if (err instanceof SchemaValidationError) {
+      const declared = readWorkspacePascorc(args.workspace).engine;
+      const floor = args.floor ?? {
+        declared: typeof declared === "string" ? declared : null,
+        met: true
+      };
+      const hint = unrecognizedKeyHint(err.issues, floor);
       return report("validate", false, EXIT.FAIL, {
         error: {
           kind: "schema",
           message: `schema validation failed (D12 fail-on-schema) \u2014 ${err.issues.length} violation(s)`,
-          violations: [...err.issues]
+          violations: [...err.issues],
+          ...hint === null ? {} : { hint }
         }
       });
     }
@@ -10587,19 +11945,26 @@ function runValidate(args) {
   if (drift.length === 0) {
     line("no drift warnings");
   } else {
-    for (const issue of drift) {
-      const where = issue.path ? ` (${issue.path})` : "";
-      const surfaces = issue.surfaces?.length ? ` [${issue.surfaces.join(", ")}]` : "";
-      line(`  warn: [${issue.code}]${surfaces} ${issue.message}${where}`);
+    for (const issue2 of drift) {
+      const where = issue2.path ? ` (${issue2.path})` : "";
+      const surfaces = issue2.surfaces?.length ? ` [${issue2.surfaces.join(", ")}]` : "";
+      line(`  warn: [${issue2.code}]${surfaces} ${issue2.message}${where}`);
     }
     line(`  ${drift.length} warning(s) \u2014 exit 0 (D12: facts warn, schema fails)`);
   }
   section("geo");
+  line(
+    `  basis: heuristic index over the declared fields (${geo.basis}) \u2014 not a measurement of citations`
+  );
   line(`  overall score: ${geo.score}/100`);
   for (const s of Object.values(geo.sections)) {
-    line(`  ${s.label}: ${s.score}/100 \u2014 ${s.detail}`);
+    line(geoSectionLine(s));
   }
   for (const c of geo.checks) {
+    if (c.applicable === false) {
+      line(`  n/a: [${c.code}] ${c.detail}`);
+      continue;
+    }
     if (c.score > 0) continue;
     const prefix = c.severity === "info" ? "info" : "warn";
     line(`  ${prefix}: [${c.code}] ${c.detail}`);
@@ -10608,84 +11973,96 @@ function runValidate(args) {
 }
 
 // src/index.ts
-var VERSION = (() => {
-  try {
-    const pkg = JSON.parse(readFileSync16(new URL("../package.json", import.meta.url), "utf8"));
-    return pkg.version;
-  } catch {
-    return "0.0.0";
-  }
-})();
+var VERSION = CLI_VERSION;
 var GLOBAL_HELP = `pasco \u2014 profile-as-code CLI v${VERSION}
 
+The cycle:
+  pasco init <dir>        scaffold a workspace (content/, README.md, .pascorc)
+  edit content/*.yaml     the single source of truth \u2014 edit these, not profiles/
+  pasco validate          schema + drift + geo (warnings)
+  pasco build [platform]  write the per-platform artifacts
+
+Each command's tag says where it sits in the cycle: [write] \xB7 [read] \xB7 [check].
+The rules behind it (fact-present, build's order, char caps): README.md in the installed package.
+
 Commands:
-  init [dir]                    Scaffold a ${WORKSPACE_NAME} workspace (content/, README.md, .pascorc)
-  validate [--json]             Schema (FAIL, exit 1) + drift/geo (WARN, exit 0) \u2014 D12
-  doctor [--json]               Engine \xB7 schema \xB7 workspace on one line (SPEC \xA77.6, #348):
+  init [dir]                    [write] Scaffold a ${WORKSPACE_NAME} workspace (content/, README.md, .pascorc)
+  validate [--json]             [check] Schema (FAIL, exit 1) + drift/geo (WARN, exit 0) \u2014 D12
+  doctor [--json]               [check] Engine \xB7 schema \xB7 workspace on one line (SPEC \xA77.6, #348):
                                 installed version, the profile contract it validates,
                                 and whether the workspace loads; also reports the
                                 .pascorc engine requirement (unmet \u21D2 exit 1)
-  build [platform] [--lang]     Deterministic base texts per platform+lang
-  preview [--out <dir>]         ONE self-contained HTML page of the rendered surfaces
+  build [platform] [--lang]     [write] Deterministic base texts per platform+lang
+  preview [--out <dir>]         [read]  ONE self-contained HTML page of the rendered surfaces
           [--no-open] [--lang <l>]  (inline CSS, no JS, no external asset) written to
                                 <workspace>/.pasco/preview and opened locally; --out writes
                                 elsewhere and never opens (the CI-artifact transport). Warns when
                                 the destination sits in a repo without an ignore entry.
                                 Not a publication
-  edit <contract-path>          Resolve one contract field; --set writes it (comment-preserving,
+  edit <contract-path>          [write] Resolve one contract field; --set writes it (comment-preserving,
           [--set <text> [--check]]  validated, atomic) and --set --check previews the published lines
-  diff [--json]                 Changes since the last release tag (git-based \u2192 CHANGELOG hint)
-  refine <platform> [--lang]    PARTIAL: emit agent task template; --choose <id> records the
+  edit --list [<block>]         [read]  Every addressable contract path of the workspace, one per line
+  diff [--json]                 [read]  Changes since the last release tag (git-based \u2192 CHANGELOG hint)
+  refine <platform> [--lang]    [write] PARTIAL: emit agent task template; --choose <id> records the
           [--variants N]        chosen variant in content/active.yaml (agent-driven, D11/D13;
                                 full variant flow M3)
-  check [platform]              Executes offline rules: brand handle matrix (M6/\xA717,
+  check [platform]              [check] Executes offline rules: brand handle matrix (M6/\xA717,
                                 brand flavor), registry checks (M7/\xA718.8) and
                                 media-transport rules (M8/\xA718.6) and max-chars/min-chars
                                 over headlines/bios (offline, #240) and fact-present
                                 (the built surface's facts vs the SSOT, #283);
                                 remaining rows M3/M4
-  audit [--json]                Offline diagnostic projection: findings only (no score,
+  audit [--json]                [check] Offline diagnostic projection: findings only (no score,
                                 no prioritisation) in three fixed classes \u2014 dangling-ref,
                                 contradiction, unsourced-claim; stricter than
                                 validate/check on those classes; exit 1 iff any FAIL
-  discover <url>... [--json]    Provisional profile from public surfaces: reads each
-                                surface's schema.org JSON-LD + links, writes nothing and
+  discover <url>... [--json]    [read]  Provisional profile from public surfaces: reads each
+          [--observations <file>]
+                                surface's schema.org Person/Organization JSON-LD + links
+                                (a GitHub profile has no such node), writes nothing and
                                 marks every fact unattested; reports the audit classes
-                                (dangling-ref \xB7 contradiction \xB7 unsourced-claim)
-  entity [--json] [--jsonld]    The schema.org entity projection: facts, @id, sameAs,
+                                (dangling-ref \xB7 contradiction \xB7 unsourced-claim). A
+                                surface the machine cannot read gets a hand-read row
+                                via --observations (YAML: surface, field, value, url,
+                                retrieved_at) \u2014 no request, same audit
+  entity [--json] [--jsonld]    [read]  The schema.org entity projection: facts, @id, sameAs,
           [--out <file> [--force]] [--bare] [--lang <l>]
                                 readiness gaps and the FAQPage node as JSON, or the
                                 paste-ready JSON-LD blocks (entity + FAQPage when faq[]
                                 is declared) for surfaces the engine does not render.
                                 Exit 1 when @id is absent (no declared home)
-  cite-check [<answers.ndjson>] Match the workspace's entity against saved answer-engine
+  cite-check [<answers.ndjson>] [check] Match the workspace's entity against saved answer-engine
           [--json]              answers (NDJSON; stdin when no path). Offline, no model,
                                 no clock: per answer it reports cited \xB7 confidence \xB7 spans
                                 \xB7 reasons, never a rate; exit 2 on malformed NDJSON
-  post <subcommand>             MVP (week-1 experiment): seed \u2192 task bundle \u2192 choose \u2192
+  post <subcommand>             [write] MVP (week-1 experiment): seed \u2192 task bundle \u2192 choose \u2192
                                 check \u2192 optional Postiz draft payload. No LLM call.
                                 Subcommands: seed \xB7 task \xB7 choose \xB7 check \xB7 export \xB7 import \xB7 list
-  status [platform] [--verify]   Per-entry deploy report \u2014 origin \xB7 surfaces \xB7 in-sync/stale/never
+  status [platform] [--verify]  [read]  Per-entry deploy report \u2014 origin \xB7 surfaces \xB7 in-sync/stale/never
                                  + certification (D18/\xA719.5); --verify runs the opt-in C1
                                  live check (the engine's ONE network path, \xA719.5)
-  presence [--json]             The presence board (D23/\xA722): every surface a release
+  presence [--json]             [read]  The presence board (D23/\xA722): every surface a release
                                 has addressed, at its newest release, with the
                                 ledger-derived state (in-sync/stale/never)
-  release plan [id] [--json]    One release's ordered fan-out (repo-meta \u2192 profile \u2192
+  release plan [id] [--json]    [read]  One release's ordered fan-out (repo-meta \u2192 profile \u2192
                                 distribution), each surface's state and the per-kind
                                 factual spine; the copy lives in the shipped skills
-  export ai-policy              Write the AI-policy artifacts (SPEC \xA77.3, M9): robots.txt
+  achievements [--targets]      [read]  The career impact log (D24/\xA723): every row's DERIVED
+          [--json]              status (planned \xB7 measured \xB7 achieved \xB7 partial), the
+                                formatted metric and how the result is known (basis);
+                                --targets prints only the planned goals
+  export ai-policy              [write] Write the AI-policy artifacts (SPEC \xA77.3, M9): robots.txt
           [--out <dir> | --check] [--lang <l>]  (two named groups \u2014 listed retrieval crawlers
                                 allowed, listed training crawlers disallowed, no wildcard) +
                                 llms.txt (the workspace index) + AI-POLICY.md, into <dir>;
                                 --check (exit 1) fails an unsourced, stale or incomplete entry
-  export profile [--json]       The normalized profile for programmatic consumers (SPEC \xA77.5,
+  export profile [--json]       [read]  The normalized profile for programmatic consumers (SPEC \xA77.5,
           [--now <iso8601>]     #348): { schemaVersion, engine, source: { commit, generatedAt },
                                 profile } \u2014 every root the workspace declares, plus every list
                                 root defaulted to [], from the same load() the other commands
                                 use. No clock is read: generatedAt is null unless --now pins
                                 it. Offline; byte-identical across runs
-  skills:export <dir>           Copy the skill channels this package ships into <dir>
+  skills:export <dir>           [write] Copy the skill channels this package ships into <dir>
           [--force] [--list]     (--force overlays; --list shows them); no harness paths
 
 Common flags (after the command):
@@ -10705,7 +12082,8 @@ NDJSON, never a silent skip). Drift warnings exit 0 (D12: facts warn, schema fai
 pasco is free (MIT). Consider a tip ;)
   https://ko-fi.com/christianluciani \xB7 https://github.com/sponsors/ChristianLuciani
 
-See packages/cli/README.md for details.
+See README.md in the installed package, or
+https://github.com/ChristianLuciani/profile-as-code for details.
 `;
 function parseCommandFlags(args, extra = {}) {
   let values;
@@ -10730,20 +12108,37 @@ function parseCommandFlags(args, extra = {}) {
   return { flags: values, positionals };
 }
 var COMMAND_HELP = {
-  discover: `pasco discover <url>... [--json] [--allow-host <hosts>]
+  discover: `pasco discover <url>... [--json] [--allow-host <hosts>] [--observations <file>]
 Read public surfaces and build a PROVISIONAL profile so the audit's checks can
 run for a prospect who has no workspace. Every populated fact carries its
 source (surface, URL, retrieval time) and attested:false; fields that could not
 be discovered are listed as absent, never defaulted. Facts come only from the
-surfaces' schema.org JSON-LD and their links - never prose mining.
+surfaces' schema.org JSON-LD and their links - never prose mining. A surface
+QUALIFIES only when it declares a schema.org Person or Organization node: a
+GitHub profile carries none, and neither does a product/application page
+(SoftwareApplication), so point discover at a personal site or page that does.
+An unsourced quantitative sentence is reported only when it is ABOUT the entity
+(it names it or its handle, or is first-person) - a badge counter or a nameless
+footer is not a claim about the person. Identical sentences are reported once.
+A surface the machine cannot read (a wall: http-999/403; no Person node) is a
+job for a human: --observations takes a YAML sequence of rows the operator read
+by hand, each with surface, field (name | link | experience), value, url and
+retrieved_at. Those rows make NO request - their URL is a provenance label - and
+they enter the same provisional profile, so the same classes run over them.
+Two surfaces that declare different names, or experience rows that disagree,
+are reported as a contradiction; what the machine-read surfaces cannot supply
+(a page text for unsourced-claim) is simply not part of a manual row.
 Requests are sequential, never retried, credential-free and confined to a
 closed host allowlist: the platform hosts the engine ships, plus --allow-host
 (comma-separated). A URL outside it is reported as
 host-not-allowed with NO request made. Nothing is written: no content/, no
 ledger, no artifact.
-  --json        machine-readable report: surfaces, unchecked URLs, the
-                provisional profile, its per-fact provenance and the findings
+  --json        machine-readable report: surfaces (with via: fetch|manual),
+                unchecked URLs, the provisional profile, its per-fact provenance
+                and the findings
   --allow-host  extra hostnames the operator declares, comma-separated
+  --observations  YAML rows read by hand (no request made); refused with the row
+                number when a row is malformed
 Exit 1 iff a FAIL finding exists (dangling-ref or contradiction).`,
   init: `pasco init [dir] [--flavor person|brand]
 Scaffold a ${WORKSPACE_NAME} workspace skeleton (SPEC \xA79): content/identity.yaml,
@@ -10754,7 +12149,9 @@ README.md, .pascorc. Minimal but pasco validate-clean. Refuses to overwrite.
   dir   target directory (default: current directory)`,
   validate: `pasco validate [--json] [--workspace <path>]
 Load + validate the workspace (D12): schema violations FAIL (exit 1); drift and
-GEO are warnings (exit 0). See schema/README.md "Validation semantics".
+GEO are warnings (exit 0). See
+https://github.com/ChristianLuciani/profile-as-code/blob/main/schema/README.md
+"Validation semantics".
 A .pascorc "engine" requirement is enforced BEFORE the load: an installed engine
 older than the declared minimum fails with the installed version, the required
 version and the upgrade command (SPEC \xA77.6).`,
@@ -10764,8 +12161,8 @@ Engine \xB7 schema \xB7 workspace on one line (SPEC \xA77.6, #348):
   schema    the profile contract version this build validates (from the schema $id)
   workspace the resolved path, whether it loads, and the effective .pascorc
             engine requirement (the strictest declaration in every config the
-            resolution consulted, with the file it came from \xB7 met / NOT MET /
-            INVALID \xB7 upgrade command)
+            resolution consulted \xB7 absent when none declares one \xB7 met / NOT
+            MET / INVALID, with the declaring file and the upgrade command)
 It writes nothing, reads no clock and touches no network. Exit: 0 healthy
 (workspace loads and any declared engine requirement is met) \xB7 1 unhealthy (the
 workspace fails to load, or the requirement is unmet/malformed) \xB7 2 usage. It
@@ -10788,17 +12185,48 @@ is left out of the page and listed (never inlined); a remote image becomes a tex
   build: `pasco build [platform] [--view <name>] [--lang <l>] [--json] [--workspace <path>]
 Deterministic base texts per platform+lang (compile() slices). No platform =
 all platforms. lang defaults to .pascorc defaults.lang or 'en'.
+The artifact path carries no lang: one path per surface, so building another
+lang OVERWRITES the artifact the previous build wrote (one README per repo on
+GitHub; for the paste surfaces, re-build before pasting the other language).
 A .pascorc "engine" requirement is enforced before any render (SPEC \xA77.6).
 --view resolves a declared view (D22/\xA721): its rule may carry the platform, the
 lang and the fact selection, so the surface shows a SUBSET of the SSOT. Every
 omission is reported as a warning; an addressed key that resolves to nothing is
 an error. No selection policy = byte-identical output.`,
   edit: `pasco edit <contract-path> [--set <text> [--check]] [--json] [--workspace <path>]
+       pasco edit --list [<block>] [--json] [--workspace <path>]
+       pasco edit --create <root> [--check] [--json] [--workspace <path>]
 Resolve ONE contract field (epic #247, S1\u2013S5 \u2014 read \xB7 preview \xB7 write \xB7 surface impact \xB7 cap pre-flight \xB7 agent contract):
   positioning.statement.<lang>
   headlines[platform=<p>,lang=<l>].text
   bios[platform=<p>,lang=<l>,length=<len>].text
+  identity.definition.<lang>
+  faq[id=<slug>,lang=<l>].q | .a
+  faq[id=<slug>].source
   identity.links[platform=<p>,label=<l>].url     (read-only; label optional)
+--list is the read-only discovery surface (#411): it prints every addressable row
+of this workspace, one per line, built by the same constructors resolution uses \u2014
+no second grammar. <block> scopes it to positioning | headlines | bios |
+identity.definition | identity.links | faq; an unknown block, --set, --check,
+--create or an address next to it is usage (exit 2). A link row whose platform
+cannot be expressed as a selector is a warning; a label the grammar cannot
+express is dropped and the row is listed by its platform when that resolves to
+one row (the warning says so). Any address that resolves to more than one row
+(a duplicate headline/bio, a repeated faq id, a label-less link sharing its
+platform) is a warning too \u2014 never printed as a path the command would reject.
+It never locates a CST node, takes the edit lock or writes; an empty workspace
+prints the header alone (exit 0). --json payload { addresses: [{ address, kind,
+readOnly }], warnings }.
+--create <root> seeds a root the workspace does NOT declare yet \u2014 a DIFFERENT
+operation from the splice: the splice never invents bytes and --create never
+overwrites one. It writes a schema-valid template (--create faq, or the file form
+--create content/faq.yaml), refuses when the root already exists under any
+extension case (idempotent: nothing is written), and runs the same validation
+(load()+schema over a temp copy) and cap pre-flight as --set. --check previews
+the seed: it validates it and writes nothing. Seedable roots:
+${SEEDABLE_ROOTS.join(", ")} (3 placeholder pairs, the schema minimum) \u2014 replace every <placeholder> with the owner's own
+facts, never invented copy. --json payload { mode, root, file, created, preview,
+seed, limits, warnings }.
 Without --set it prints the current value. With --set it WRITES the value \u2014 a
 byte-range splice over the original text (the CST locates, it never
 re-serializes), so comments, layout and CRLF survive and the diff is one line;
@@ -10814,16 +12242,24 @@ failure is only detected by the write.
 With --set --check it PREVIEWS instead: it renders the surface the way
 \`pasco build\` does \u2014 active variant (#238) \u2192 renderer \u2192 shared paste source,
 current vs proposed \u2014 and prints the artifact lines the edit changes, saying so
-(with the reason) when the edit does not reach the artifact.
+(with the reason) when the edit does not reach the artifact. A faq[] value has no
+pasco build artifact: its published surface is the FAQPage node of
+\`pasco entity --jsonld\` (#360), and --check previews that node's bytes.
+identity.definition reaches the entity JSON-LD that github-readme/github-org
+embed, so its preview is the artifact's JSON-LD block.
 Every run against a resolved, writable address also prints the edited unit's
 SURFACE IMPACT from the \xA719 ledger: each
 recorded surface prints stale (the edit changed the hash) or in-sync (it still
 matches), and a unit with no record rolls up to never \u2014 derived, never stored.
-The block also carries the measured drift count.
+faq[] has no \xA719 unit, so it prints no surface-impact block (rather than naming a
+fabricated one). The block also carries the measured drift count.
 A headline/bio value is pre-flighted against the catalog's own max-chars cap (the
 workspace's checks.yaml, else the sourced caps shipped with pasco) and prints the
 cap, its cited source and tier; over-cap is a WARNING (D12), never a block, and a platform
-with no sourced cap reads \`cap: unknown\`.
+with no sourced cap reads \`cap unknown\`. identity.definition and faq[].q|.a are
+pre-flighted against the contract's own caps (160 / 90 / 320 chars per value,
+#288): over one is a schema failure (D12), so the pre-flight warns and the write
+is refused by validation.
 An active variant (#238) on the addressed platform is NAMED (edit never chooses the
 live variant \u2014 that is refine --choose).
 \`--json\` payload { address, current, proposed, rendered, ok, noop, written,
@@ -10831,12 +12267,15 @@ warnings, stale, state, drift, limit, over, variant, reason } inside the usual
 envelope
 (command \xB7 ok \xB7 exitCode);
 warnings carries a non-blocking finding the write proceeded through.
-Exit: 0 a read / written / noop / the preview changes the artifact \xB7 1 the address
-did not resolve to exactly one row, the target is read-only or changed under the
-command (stale \u2014 nothing was written), the validation refused the result, or
-(preview) the artifact does not change \xB7 2 usage (malformed address, unknown
-platform or language, read-only field, block or multi-line scalar, anchored/aliased
-scalar, a value with a line break, an empty --set, --check without --set).`,
+Exit: 0 a read / written / noop / the preview changes the artifact / the seed was
+written (or previewed) \xB7 1 the address did not resolve to exactly one row, the
+target is read-only or changed under the command (stale \u2014 nothing was written),
+--create found the root already present (nothing was written), the validation
+refused the result, or (preview) the artifact does not change \xB7 2 usage
+(malformed address, unknown platform or language, read-only field, block or
+multi-line scalar, anchored/aliased scalar, a value with a line break, an empty
+--set, --check without --set, --create with no seedable root or next to --set /
+--list / an address).`,
   diff: `pasco diff [--json] [--workspace <path>]
 Git-based: what changed since the last tag matching release-* (.pascorc
 diff.tagPattern) \u2014 commits + changed content files \u2192 CHANGELOG hint.`,
@@ -10856,8 +12295,7 @@ carries and the other does not, a URL the surface adds, prose no token
 explains), else WARN (D12). A declared surface with no artifact reports the
 rule as not run, never OK; declared: [] says no catalog declares the premise.
 Remaining rows in content/checks.yaml ship with the skills checks.yaml union
-(M3) and the full pasco check (M4). Prints its owner line
-(src/commands/check.ts).`,
+(M3) and the full pasco check (M4).`,
   audit: `pasco audit [--json] [--workspace <path>]
 The offline diagnostic projection over the identity (SPEC \xA77.1, issue #283):
 findings only \u2014 no score, no prioritisation, no branding (those belong to the
@@ -10873,8 +12311,10 @@ URL resolves \u2014 canonicalization, which validate warns about) and geoCheck's
 coverage codes.
 Composes load (schema), driftCheck with validate's #238 variant-store
 reconciliation, geoCheck (the faq-coverage premise gate only), the
-completeness evidence premise and fact-present (the built surface's facts vs
-the SSOT render, symmetric; it runs only where the catalog declares it).
+completeness evidence premise, the achievements evidence posture (a public
+measured/attested row with no pointer is unsourced-claim, SPEC \xA723.3) and
+fact-present (the built surface's facts vs the SSOT render, symmetric; it runs
+only where the catalog declares it).
 Touches no network, and no finding derives from content/deployments.yaml.
 --json emits { schemaVersion: "1", scope: { catalog, declared, checked, notRun },
 findings: [ { class, severity, path, detail } ] }. scope is the artifact side:
@@ -10894,8 +12334,8 @@ the schema.org entity the renderers embed, exposed as an artifact.
              is null when no link declares role: identity \u2014 the engine never invents
              an @id. gaps are the structured-data geoCheck codes that scored below 1,
              verbatim. faqJsonLd is the FAQPage node when faq[] is declared, else null.
-  --jsonld   the SAME assembler output the renderers embed (core/src/structured-data.ts,
-             one home \u2014 never a second emitter), serialized as paste-ready
+  --jsonld   the SAME assembler output the renderers embed (the engine's single
+             assembler, one home \u2014 never a second emitter), serialized as paste-ready
              <script type="application/ld+json"> block(s): the entity block, plus the
              FAQPage block when faq[] is declared (never an empty FAQPage, no invented
              @id; faq[].source travels as acceptedAnswer.citation).
@@ -11019,6 +12459,10 @@ overlaid, nothing is deleted). No harness-specific destination is invented.`,
   post: `pasco post <seed|task|choose|check|export|import|list> [...] [--json] [--workspace <path>]
 MVP (week-1 experiment): a post is a PROJECTION of a seed, not an identity fact.
 Two seed formats (#266): short (distribution) and longform (the essay/newsletter).
+Short rules ship for: linkedin, x
+Long-form rules ship for: devto, ghost, hashnode, listmonk, medium, substack, wordpress
+(long-form needs --format longform; short is the default. A channel in neither
+list has no post rule \u2014 the usage error names the rule file it wanted.)
   seed <id> --text <file> [--format short|longform]
                                    create posts/<id>/seed.md + post.yaml
   task <id> --channel <c1,c2> [--variants N] [--format short|longform]
@@ -11037,9 +12481,28 @@ Two seed formats (#266): short (distribution) and longform (the essay/newsletter
                                    API channels \u2192 Postiz POST /posts payload
                                    (integration IDs from postiz.yaml; REPLACE_ME
                                    when missing); paste channels \u2192 paste-checklist.md
-  import <dir> --channel <c>       import historical .md posts as seeds
+  import <dir> --channel linkedin|x  import historical .md posts as seeds (a
+                                   short-rule channel); each is recorded
+                                   published by assumption (certification:
+                                   unverifiable, url: null; no URL-recording
+                                   command yet)
   list                             list seeds, formats, derivedFrom and chosen variants`,
-  status: `pasco status [platform] [--mark <ledgerKey> <surface>] [--at <iso8601>] [--verify] [--write-checklist] [--completeness] [--json] [--workspace <path>]
+  achievements: `pasco achievements [--targets] [--json] [--workspace <path>]
+The career impact log (D24, SPEC \xA723, issue #446): one row per RESULT \u2014 a metric
+or a milestone \u2014 with the units it belongs to (refs), how the result is known
+(basis: measured | estimated | reported | attested) and its required visibility.
+The status is DERIVED from the numbers, never stored: planned (a target with no
+value) \xB7 measured (a value with no goal) \xB7 achieved (the direction is met) \xB7
+partial (both numbers, goal missed). A milestone has no status. Rows are grouped
+by their first ref; Unattached collects the rest.
+--targets prints only the planned rows (the goal view).
+--json emits { schemaVersion: "1", scope, achievements: [...] } where each row
+carries its derived status (null for a milestone) and scope counts the rows this
+view returned \u2014 an empty scope reads as "nothing declared here", never as a
+fabricated zero.
+Exit: 0 a successful read \xB7 1 the workspace does not load (a dangling refs[]
+entry fails load, the same class as a dangling artifactRefs).`,
+  status: `pasco status [platform] [--mark <ledgerKey> <platform>] [--at <iso8601>] [--verify] [--write-checklist] [--completeness] [--json] [--workspace <path>]
 Per-entry deploy-status report (D18, \xA719): ledger key \xB7 origin (template/user) \xB7
 surfaces published \xB7 sync state (in-sync / stale / never) \xB7 certification
 (verified / attested / unverifiable / out-of-band-drift, \xA719.5) \u2014 plus untracked
@@ -11048,11 +12511,11 @@ It ends with the DERIVED publication truth per surface (SPEC \xA720.1, #242):
   <surface>: <sync> \xB7 artifact: <matches-SSOT|diverges|absent> \xB7 limits: <ok|over(cap)>
 \u2014 the artifact on disk vs what the SSOT renders TODAY (offline; offline cap
 warnings carry their source). Derived, never stored: nothing here writes.
-  --mark <ledgerKey> <surface>  confirm a manual paste: records deployedAt + the
+  --mark <ledgerKey> <platform>  confirm a manual paste: records deployedAt + the
         CURRENT contentHash in content/deployments.yaml (only pasco writes it,
         D14) plus certification.state attested \u2014 and the artifactHash ANCHOR when
         the surface can produce one. --at overrides the timestamp. The anchor is
-        the digest of profiles/<surface>/README.md (what \`pasco build\` wrote, so
+        the digest of profiles/<platform>/README.md (what \`pasco build\` wrote, so
         \`--lang\` is honoured); with no build artifact on disk it renders at
         .pascorc defaults.lang instead.
   --verify [platform]           \xA719.5 C1: the opt-in live check \u2014 the engine's ONE
@@ -11096,7 +12559,8 @@ the command prints the per-kind FACTUAL SPINE derived from the release row
 shipped per-platform skills, never in the engine (rule 7).
 <release-id> selects a release; absent = the newest by date (then id).
 --json emits { schemaVersion: "1", release, surfaces, baseText } inside the
-usual envelope.
+usual envelope; every surfaces[] row carries its 1-based \`order\`, the same
+number the human ORDER column prints (issue #421).
 Exit: 0 a successful read \xB7 1 the workspace does not load, declares no
 releases[], the id is not declared, or a surface is not in the registry \xB7
 2 usage (a subcommand other than plan).`
@@ -11159,7 +12623,11 @@ async function runMain() {
       const engineSources = readEnginePascorcSources(process.cwd(), flags.workspace, workspace);
       const engineGate = enforceEngineRequirement("validate", engineSources);
       if (engineGate !== null) return engineGate;
-      return runValidate({ workspace });
+      const requirement = evaluateEngineRequirements(engineSources, VERSION);
+      return runValidate({
+        workspace,
+        floor: { declared: requirement.declared, met: requirement.met }
+      });
     }
     case "doctor": {
       const { flags, positionals } = parseCommandFlags(rest);
@@ -11246,19 +12714,74 @@ async function runMain() {
     case "edit": {
       const { flags, positionals } = parseCommandFlags(rest, {
         set: { type: "string" },
-        check: { type: "boolean" }
+        check: { type: "boolean" },
+        list: { type: "boolean" },
+        create: { type: "string" }
       });
       if (flags.help === true) {
         process.stdout.write(`${COMMAND_HELP.edit}
 `);
         return EXIT.OK;
       }
-      if (positionals.length !== 1) {
-        throw new UsageError("usage: pasco edit <contract-path> [--set <text> [--check]]");
+      let listBlock;
+      let createRoot2;
+      if (flags.list === true) {
+        if (flags.set !== void 0 || flags.check === true || flags.create !== void 0) {
+          throw new UsageError(
+            "--list is read-only: it cannot be combined with --set, --check or --create"
+          );
+        }
+        if (positionals.length > 1) {
+          throw new UsageError("pasco edit --list [<block>]");
+        }
+        if (positionals.length === 1) {
+          const value = positionals[0];
+          try {
+            listBlock = parseEditListBlock(value);
+          } catch (err) {
+            try {
+              parseEditAddress(value);
+            } catch {
+              throw err;
+            }
+            throw new UsageError(
+              `--list takes a block, not an address: run \`pasco edit --list\` to list the addresses, or \`pasco edit '${value}'\` to read one`
+            );
+          }
+        }
+      } else if (flags.create !== void 0) {
+        if (flags.set !== void 0) {
+          throw new UsageError(
+            "--create seeds a missing root: it cannot be combined with --set (use --create <root> --check to preview the seed)"
+          );
+        }
+        if (positionals.length > 0) {
+          throw new UsageError("pasco edit --create <root> takes no address");
+        }
+        createRoot2 = parseCreateRoot(flags.create);
+      } else if (positionals.length !== 1) {
+        throw new UsageError("pasco edit <contract-path> [--set <text> [--check]]");
       }
       setJsonMode(flags.json === true);
       const workspace = resolveWorkspace(process.cwd(), flags.workspace);
       const pascorc = readWorkspacePascorc(workspace);
+      if (flags.list === true) {
+        return runEdit({
+          workspace,
+          list: true,
+          check: false,
+          ...listBlock === void 0 ? {} : { listBlock },
+          pascorc
+        });
+      }
+      if (createRoot2 !== void 0) {
+        return runEdit({
+          workspace,
+          createRoot: createRoot2,
+          check: flags.check === true,
+          pascorc
+        });
+      }
       return runEdit({
         workspace,
         addressArg: positionals[0],
@@ -11327,20 +12850,25 @@ async function runMain() {
     }
     case "discover": {
       const { flags, positionals } = parseCommandFlags(rest, {
-        "allow-host": { type: "string" }
+        "allow-host": { type: "string" },
+        observations: { type: "string" }
       });
       if (flags.help === true) {
         process.stdout.write(`${COMMAND_HELP.discover}
 `);
         return EXIT.OK;
       }
-      if (positionals.length === 0)
-        throw new UsageError("usage: pasco discover <url>... [--json] [--allow-host <hosts>]");
+      const observationsPath = typeof flags.observations === "string" ? flags.observations : void 0;
+      if (positionals.length === 0 && observationsPath === void 0)
+        throw new UsageError(
+          "usage: pasco discover <url>... [--observations <file>] [--json] [--allow-host <hosts>]"
+        );
       setJsonMode(flags.json === true);
       const allowHosts = typeof flags["allow-host"] === "string" ? flags["allow-host"].split(",").map((host) => host.trim()).filter((host) => host !== "") : void 0;
       return await runDiscover({
         urls: positionals,
-        ...allowHosts !== void 0 ? { allowHosts } : {}
+        ...allowHosts !== void 0 ? { allowHosts } : {},
+        ...observationsPath !== void 0 ? { observationsPath } : {}
       });
     }
     case "audit": {
@@ -11492,6 +13020,25 @@ async function runMain() {
       const workspace = resolveWorkspace(process.cwd(), flags.workspace);
       return runReleasePlan({ workspace, releaseArg: positionals[1] });
     }
+    case "achievements": {
+      const { flags, positionals } = parseCommandFlags(rest, {
+        targets: { type: "boolean" }
+      });
+      if (flags.help === true) {
+        process.stdout.write(`${COMMAND_HELP.achievements}
+`);
+        return EXIT.OK;
+      }
+      if (positionals.length > 0) {
+        throw new UsageError("usage: pasco achievements [--targets] [--json] [--workspace <path>]");
+      }
+      setJsonMode(flags.json === true);
+      const workspace = resolveWorkspace(process.cwd(), flags.workspace);
+      return runAchievements({
+        workspace,
+        ...flags.targets === true ? { targets: true } : {}
+      });
+    }
     case "status": {
       const { flags, positionals } = parseCommandFlags(rest, {
         mark: { type: "string" },
@@ -11508,7 +13055,7 @@ async function runMain() {
         return EXIT.OK;
       }
       if (flags.mark !== void 0 && positionals.length !== 1) {
-        throw new UsageError("usage: pasco status --mark <ledgerKey> <surface> [--at <iso8601>]");
+        throw new UsageError("usage: pasco status --mark <ledgerKey> <platform> [--at <iso8601>]");
       }
       if (flags.mark === void 0 && positionals.length > 1) {
         throw new UsageError(
@@ -11660,7 +13207,7 @@ try {
   exitCode = await runMain();
 } catch (err) {
   if (err instanceof UsageError) {
-    process.stderr.write(`usage: ${err.message}
+    process.stderr.write(`usage: ${err.message.replace(/^usage: */, "")}
 `);
     exitCode = EXIT.USAGE;
   } else if (err instanceof ConfigError) {