@pulse-compute/cli 1.0.0-beta.2 → 1.0.0-beta.3

package/API.md

@@ -487,7 +487,7 @@ Older `/pulsewasm` imports are compatibility-only and are isolated in the
 
 ## Entities API
 
-`@pulse-compute/entities` is part of the synchronized `1.0.0-beta.2` package
+`@pulse-compute/entities` is part of the synchronized `1.0.0-beta.3` package
 set. The application surface has two runtime values:
 
 ```ts

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 Pulse follows semantic versioning for public releases. The repository begins its public history with the `1.0.0-beta.1` prerelease.
 
+## 1.0.0-beta.3 — Beta (2026-09-14)
+
+- Fix CLI storage execution on Node Native, Node JavaScript and the Fastly Native local fixture host, including S3 response streams, bindings and conditional KV.
+- Keep the last working Native application available when a development reload fails.
+- Allow bounded npm registry propagation time and publish future releases directly under the `latest` npm tag while retaining the Beta release label.
+
 ## 1.0.0-beta.2 — Beta (2026-09-13)
 
 This candidate synchronizes the 19-package release catalog and prepares the

package/README.md

@@ -7,13 +7,13 @@
 > **Supported entry points:** `pulse binary`, `@pulse-compute/cli`, `@pulse-compute/cli/workflow`, `@pulse-compute/cli/project-config`, `@pulse-compute/cli/project-execution`, `@pulse-compute/cli/project-config-schema`, `@pulse-compute/cli/diagnostics`, `@pulse-compute/cli/project-config.schema.json`, `@pulse-compute/cli/cli-spec.json`, `@pulse-compute/cli/release-manifest.json`, `@pulse-compute/cli/documentation-versions.json`, `@pulse-compute/cli/documentation-site.json`<br>
 > **Stability:** Supported Beta workflow and project-configuration contract.<br>
 > **npm:** [`@pulse-compute/cli`](https://www.npmjs.com/package/@pulse-compute/cli)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.2/packages/cli/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.3/packages/cli/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.2` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.3` package policy.
 <!-- pulse-package-status:end -->
 
 The public CLI and conventional `@pulse-compute/pulse` application root are
-both part of the synchronized `1.0.0-beta.2` release set. Validate the generated
+both part of the synchronized `1.0.0-beta.3` release set. Validate the generated
 workflow from the repository or the exact packed acceptance set:
 
 ```bash

package/cli-spec.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "pulse.cli-command-spec.v5",
-  "cliVersion": "1.0.0-beta.2",
+  "cliVersion": "1.0.0-beta.3",
   "completionShells": [
     "bash",
     "zsh",

package/docs/README.md

@@ -1,6 +1,6 @@
 # Pulse documentation
 
-Pulse documentation is organized in layers so you can stop when you have enough detail. The `1.0.0-beta.2` candidate uses async-shaped managed handlers, trusted Pulse effects, a conventional `.pulse/config.ts` workspace, and the `pulse` CLI. The synchronized 18-package release catalog remains the authority for npm availability and support tiers.
+Pulse documentation is organized in layers so you can stop when you have enough detail. The `1.0.0-beta.3` candidate uses async-shaped managed handlers, trusted Pulse effects, a conventional `.pulse/config.ts` workspace, and the `pulse` CLI. The synchronized 18-package release catalog remains the authority for npm availability and support tiers.
 
 ## 1. Start and ship a first project
 

package/docs/architecture/current-contracts.md

@@ -238,6 +238,18 @@ guest-link packaging authorization have already been checked. It does not
 contain a TypeScript AST/service, compiler cache, builder, mutable manifest,
 compiled-program object, raw target option bag, or alternate target.
 
+CLI Native test/dev execution that needs guest crypto or conditional KV uses
+an optional provider-owned `prepareNativeExecution` driver hook. It receives the
+same immutable, validated invocation with action `execute-native` and returns a
+local request executor. The CLI never substitutes another provider's host.
+Node executes the compiled neutral Wasm with its provider adapter. Fastly
+realizes its own Native artifact and runs the existing fixture ABI, including
+the conditional-KV authority. Its result identifies the artifact hash and fixture
+kind; unavailable effect telemetry is reported as such. This does not establish
+Viceroy or deployed Fastly acceptance. S3 fixtures preserve raw response streams
+inside the provider transport while ordinary fetch retains its opaque response
+contract. Dev retains a last-good Native executor if recompilation fails.
+
 Native realization and JavaScript source packaging are normalized into
 versioned, data-only results before the CLI consumes them. Provider packaging
 must report the same artifact identity authorized by the final guest audit.
@@ -335,7 +347,7 @@ without moving package semantics into the compiler or widening the trust model.
 
 ## JWT verification
 
-The synchronized `1.0.0-beta.2` JWT/crypto packages compose
+The synchronized `1.0.0-beta.3` JWT/crypto packages compose
 `@pulse-compute/jwt` over the lower-level, provider-neutral verification
 contract owned by `@pulse-compute/crypto`. The executable algorithm set is
 HS256 and ES256. Crypto verifies a MAC or signature over caller-supplied bytes
@@ -416,7 +428,7 @@ publish, promote, deploy, or activate the release.
 
 ## Support, release, and authority
 
-Pulse `1.0.0-beta.2` is a Beta intended for the `beta` channel.
+Pulse `1.0.0-beta.3` is a Beta intended for the `beta` channel.
 Documented, evidence-backed behavior is intentional, but public surfaces may
 change deliberately before a compatibility-bearing release. Unsupported
 behavior fails explicitly, historical and implementation subpaths gain no

package/docs/concepts/compilation-and-lowering.md

@@ -408,7 +408,7 @@ generic loader handles reachable-graph discovery and trusted invocation. Older
 `/pulsewasm` imports are isolated in the
 [compatibility migration guide](../guides/compatibility-imports.md).
 
-In Pulse `1.0.0-beta.2`, package-owned builders must declare `compiler.trust: 'first-party'` and ship in the synchronized release set. This is an internal contributor mechanism, not a general third-party plugin API. See [Add a first-party package-owned lowerer](../contributing/adding-first-party-lowerer.md).
+In Pulse `1.0.0-beta.3`, package-owned builders must declare `compiler.trust: 'first-party'` and ship in the synchronized release set. This is an internal contributor mechanism, not a general third-party plugin API. See [Add a first-party package-owned lowerer](../contributing/adding-first-party-lowerer.md).
 
 ## Provider lowering is a second contract
 

package/docs/concepts/contracts-and-providers.md

@@ -38,7 +38,7 @@ GRIP uses the same split. `isWebSocket`, `subscribe`, and `handoff` are pure HTT
 
 ## Provider selection
 
-Pulse `1.0.0-beta.2` has three provider driver identifiers:
+Pulse `1.0.0-beta.3` has three provider driver identifiers:
 
 | Provider | Local execution | Deployable build | Purpose |
 |---|---:|---:|---|
@@ -96,7 +96,7 @@ For Fastly, `pulse build` additionally emits a real Compute target. The explicit
 
 ## Current extension boundary
 
-There is no automatic provider plugin registry in `1.0.0-beta.2`. Configuration
+There is no automatic provider plugin registry in `1.0.0-beta.3`. Configuration
 selects a bare host ID, internal `none`, or an exact scoped project-installed
 package name. Bare IDs resolve by the `@pulse-compute/provider-<id>` convention.
 A package is loadable only when selected and when it exports the versioned

package/docs/concepts/package-owned-lowering.md

@@ -2,7 +2,7 @@
 
 Package-owned lowering lets a synchronized Pulse package extend the canonical compiler with narrow, statically recognized operations while keeping domain rules out of compiler core.
 
-The synchronized `1.0.0-beta.2` release uses this pattern for Assets, GRIP,
+The synchronized `1.0.0-beta.3` release uses this pattern for Assets, GRIP,
 JWT, and Entities.
 It is a **trusted first-party synchronization mechanism**, not a public
 registry that executes arbitrary npm compiler plugins.

package/docs/concepts/targets-and-hosts.md

@@ -16,7 +16,7 @@ require Native-compatible source; use `pulse build` for a JavaScript package.
 
 ## Current Beta targets
 
-`1.0.0-beta.2` exercises four explicit modes through one conformance corpus:
+`1.0.0-beta.3` exercises four explicit modes through one conformance corpus:
 
 | Host | Target | Current release status | Build shape |
 |---|---|---|---|
@@ -45,7 +45,7 @@ adapter, lifecycle, conformance evidence, and package claim.
 The [ESP32 reference host](https://github.com/pulsecompute/pulse-esp32-host)
 tests whether the event/effect/continuation model remains useful without a
 JavaScript fallback, abundant memory, or an HTTP-centered lifecycle. It is a
-boundary witness, not a `1.0.0-beta.2` provider or compatibility promise. The
+boundary witness, not a `1.0.0-beta.3` provider or compatibility promise. The
 [architecture vision](../architecture/vision.md#esp32-as-a-boundary-witness)
 describes the intended host-owned interrupt queue and non-reentrant Wasm entry.
 

package/docs/contributing/adding-core-provider.md

@@ -75,7 +75,7 @@ Descriptors are normalized by the shared provider contract. A conceptual descrip
 ```js
 const EXAMPLE_PROVIDER_DESCRIPTOR = createProviderDescriptor({
   id: 'example',
-  providerVersion: '1.0.0-beta.2',
+  providerVersion: '1.0.0-beta.3',
   package: '@pulse-compute/provider-example',
   runtime: 'pulse.canonical-example-runtime.v1',
   buildTarget: 'example-edge',

package/docs/contributing/adding-first-party-lowerer.md

@@ -11,7 +11,7 @@ Start with [Pulse-aware package authoring](./pulse-aware-packages.md) to decide
 whether the package needs Native lowering at all. Ordinary target-compatible
 JavaScript packages do not require a compiler builder.
 
-> **Scope and trust boundary:** Pulse `1.0.0-beta.2` executes package-owned compiler builders only when their manifest declares `compiler.trust: 'first-party'` and the package is part of the synchronized release set. This is a core-repository contributor workflow, **not an external plugin** interface or a supported third-party plugin API. An external package cannot self-register arbitrary compiler code.
+> **Scope and trust boundary:** Pulse `1.0.0-beta.3` executes package-owned compiler builders only when their manifest declares `compiler.trust: 'first-party'` and the package is part of the synchronized release set. This is a core-repository contributor workflow, **not an external plugin** interface or a supported third-party plugin API. An external package cannot self-register arbitrary compiler code.
 
 A package-owned lowerer lets one release package define a narrow TypeScript facade and keep its domain-specific static validation outside compiler core. GRIP is the clearest current example; assets is the second implementation proving that the generic loader is not GRIP-specific.
 

package/docs/contributing/package-lowerer-contract.md

@@ -8,7 +8,7 @@ pulse-doc-meta:end -->
 # Package lowerer contract reference
 
 This reference describes the internal first-party lowerer protocol used by the
-synchronized `1.0.0-beta.2` release. It documents current repository
+synchronized `1.0.0-beta.3` release. It documents current repository
 interfaces; it is not a third-party plugin compatibility promise. Package
 availability remains owned by the release catalog.
 
@@ -370,7 +370,7 @@ Package lowerer code must not choose `node.*`, `fastly.*`, backend names, store
 
 ## Compatibility status
 
-This protocol is synchronized inside the `1.0.0-beta.2` release set. It can change with compiler implementation needs. Only explicitly documented application facades carry the package support promise.
+This protocol is synchronized inside the `1.0.0-beta.3` release set. It can change with compiler implementation needs. Only explicitly documented application facades carry the package support promise.
 
 A public external lowerer API would require a new contract that addresses trust, sandboxing, provenance, protocol negotiation, resource limits, lifecycle support, and semver compatibility.
 

package/docs/maintainers/documentation-deployment.md

@@ -31,7 +31,7 @@ GitHub Pages deployment is no longer part of the repository workflow. The releas
 
 ## Object classes
 
-The `1.0.0-beta.2` layout is:
+The `1.0.0-beta.3` layout is:
 
 ```text
 <bucket>/pulse/
@@ -41,8 +41,8 @@ The `1.0.0-beta.2` layout is:
   versions.json                      mutable
   site-manifest.json                 mutable
   public-site-manifest.json          mutable
-  v1.0.0-beta.2/**                         immutable
-  deployments/v1.0.0-beta.2.json           immutable receipt
+  v1.0.0-beta.3/**                         immutable
+  deployments/v1.0.0-beta.3.json           immutable receipt
 ```
 
 The exact-version tree is the archival release. Root and `latest` are convenience surfaces promoted only after exact-version verification and matching npm package verification.
@@ -72,7 +72,7 @@ npm run docs:deployment:prepare
 npm run docs:deployment:verify
 ```
 
-`.pulse-documentation-deployment/documentation-deployment-manifest.json` records every object key, local source, byte length, SHA-256, content type, cache class, mutability, source commit, public documentation route, and independent storage prefix. Its deterministic deployment receipt records the complete generated-site digest and the exact-version object inventory and tree digest for `deployments/v1.0.0-beta.2.json`. Candidate verification rejects any root or site file outside that sealed inventory.
+`.pulse-documentation-deployment/documentation-deployment-manifest.json` records every object key, local source, byte length, SHA-256, content type, cache class, mutability, source commit, public documentation route, and independent storage prefix. Its deterministic deployment receipt records the complete generated-site digest and the exact-version object inventory and tree digest for `deployments/v1.0.0-beta.3.json`. Candidate verification rejects any root or site file outside that sealed inventory.
 
 A local adapter exercised by `npm run publication:check` proves:
 

package/docs/maintainers/documentation-versioning.md

@@ -26,7 +26,7 @@ The homepage and exact current documentation load the same assets under `/v<vers
 The canonical URL for this release begins with:
 
 ```text
-https://pulsecompute.io/v1.0.0-beta.2/
+https://pulsecompute.io/v1.0.0-beta.3/
 ```
 
 Diagnostics, package status blocks, and package metadata use exact-version URLs. This prevents a diagnostic emitted by an older CLI from silently opening instructions for a newer contract.

package/docs/maintainers/maintenance-policy.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "pulse.maintenance-policy.v2",
   "policyVersion": 7,
-  "releaseVersion": "1.0.0-beta.2",
+  "releaseVersion": "1.0.0-beta.3",
   "reviewedAt": "2026-09-13",
   "maintainerModel": {
     "residentMaintainer": "Codex",

package/docs/maintainers/maintenance-policy.md

@@ -6,7 +6,7 @@ Pulse uses a machine-readable maintenance policy so repository automation and Co
 
 - **Policy schema:** `pulse.maintenance-policy.v2`
 - **Policy version:** `7`
-- **Release:** `1.0.0-beta.2`
+- **Release:** `1.0.0-beta.3`
 - **Reviewed:** `2026-09-13`
 - **Resident maintainer:** Codex
 - **Merge authority:** human-only

package/docs/maintainers/npm-publishing.md

@@ -29,7 +29,7 @@ The machine-readable publication contract is the `publication` object in `releas
 Use the manifest-owned preparation policy instead of repository-wide version replacement:
 
 ```bash
-pnpm release:prepare -- 1.0.0-beta.2 --channel beta --replace-unpublished
+pnpm release:prepare -- 1.0.0-beta.3 --channel beta --replace-unpublished
 ```
 
 `--replace-unpublished` replaces the current candidate without inventing release history. After a version has actually shipped, use `--archive-current`; that mode requires the committed immutable documentation snapshot. The command updates only catalogued JSON, package, guest-metadata, and current-documentation owners, runs named generators, rejects newly changed paths outside its allowlist, and writes an ignored stale-version-token report for review.
@@ -44,8 +44,8 @@ For example:
 
 ```bash
 gh workflow run npm-publish.yml \
-  --ref v1.0.0-beta.2 \
-  -f release_tag=v1.0.0-beta.2 \
+  --ref v1.0.0-beta.3 \
+  -f release_tag=v1.0.0-beta.3 \
   -f operation=audit
 ```
 
@@ -66,10 +66,24 @@ environment: npm-publish
 ```
 
 The workflow publishes public packages directly under the dist-tag in the
-release manifest. OIDC is deliberately not combined with a post-publication
-`npm dist-tag` mutation. The protected script verifies the native GitHub tag ref
+release manifest, now explicitly `latest` for future releases. The release
+channel and prerelease version remain Beta; the npm tag determines what an
+unqualified `npm install` selects. Release preparation preserves this tag
+policy across version bumps. An explicitly configured channel tag remains
+supported for a release intended for a separate preview stream.
+
+The pinned npm CLI's trusted publishing does not support a separate
+post-publication `npm dist-tag` update. Each successful `npm publish --tag latest`
+therefore advances that package's default version as part of publication;
+the historical `beta` alias is not also advanced. The package set is published
+in dependency order, with the public CLI last, and promotion is not atomic
+across packages. The protected script verifies the native GitHub tag ref
 and SHA against the sealed candidate before the first publish.
 
+This policy applies to future candidate source. Finish an already-started
+release using its original tag, tooling, and sealed tarballs. Do not move that
+tag or rebuild the same published version to adopt a new publication policy.
+
 ## One-time package bootstrap
 
 An npm trusted publisher can be configured only after the package name exists under the intended owner. Before enabling production publication, run:
@@ -78,7 +92,7 @@ An npm trusted publisher can be configured only after the package name exists un
 npm run release:audit-npm
 ```
 
-The command derives every package name from the release manifest and writes a timestamped, manifest-digest-bound report to `.pulse-release-preflight/npm-catalog-audit.json`. That report is ignored source evidence: it never rewrites the canonical preflight policy and it performs no registry mutation. The audit is ready only when every name exists, `bootstrap` points to `0.0.0`, and `latest` is either absent or still points to the same inert `0.0.0` placeholder. A different `latest` target remains blocking and any required dist-tag remediation is an explicit human registry action.
+The command derives every package name from the release manifest and writes a timestamped, manifest-digest-bound report to `.pulse-release-preflight/npm-catalog-audit.json`. That report is ignored source evidence: it never rewrites the canonical preflight policy and it performs no registry mutation. Every name must exist with the inert `0.0.0` version and `bootstrap` tag. The `latest` tag may be absent, point to that placeholder, or point to a version both present in the registry and listed in `release/documentation-versions.json`. This preserves existing releases during the next bootstrap audit. Missing versions and unknown release targets remain blocking; any remediation is an explicit human registry action.
 
 Any missing package name requires a one-time human, 2FA-protected bootstrap publication through `scripts/npm_bootstrap.sh <package-name>`. After all names exist:
 
@@ -129,6 +143,20 @@ version present with different integrity
 
 This is resumable after a partially completed synchronized-package release without pretending npm publication is transactional. A same-version integrity mismatch cannot be repaired by overwriting the registry artifact; the human release authority must investigate and choose a new version if necessary.
 
+npm can accept an upload while the version is still being processed. After
+each successful publish, the script polls for up to ten minutes for both the
+sealed integrity and configured tag, using fresh registry reads and intervals
+capped at 30 seconds. Progress goes to stderr and identifies the package,
+attempt, elapsed time, and whether the version or tag is still pending.
+An observed integrity conflict stops immediately.
+
+If processing exceeds the deadline, wait for registry visibility and use
+**Re-run failed jobs** on the same workflow run. Keep the release tag and sealed
+candidate unchanged: matching published packages are skipped, and publication
+continues with the remaining packages. No new seal is required for that retry.
+If source changes and a tag is moved before any publication, start a new workflow
+dispatch instead; GitHub reruns retain the original event's commit SHA.
+
 ## Verification
 
 The protected publish job verifies each package immediately. A separate unprivileged job then confirms:

package/docs/maintainers/plugin-readiness.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "pulse.plugin-readiness.v1",
-  "releaseVersion": "1.0.0-beta.2",
+  "releaseVersion": "1.0.0-beta.3",
   "publicPluginApi": false,
   "decision": "deferred",
   "requirements": {

package/docs/maintainers/plugin-readiness.md

@@ -4,7 +4,7 @@
 
 > **Decision:** Deferred. No public third-party plugin API is available in this release.
 
-Pulse 1.0.0-beta.2 keeps general plugin discovery and package lowering inside the synchronized trusted release. Provider bootstrap is explicit and exact. The current boundaries are:
+Pulse 1.0.0-beta.3 keeps general plugin discovery and package lowering inside the synchronized trusted release. Provider bootstrap is explicit and exact. The current boundaries are:
 
 - **Lowerers:** trusted first-party release packages only.
 - **Providers:** explicit package selection through pulse.provider-toolchain.v1; bare host IDs use the @pulse-compute/provider-<id> convention, scoped names are exact, and none is internal; no scanning or self-registration.

package/docs/maintainers/release-acceptance.md

@@ -8,7 +8,7 @@ pulse-doc-meta:end -->
 # Release packages and clean-consumer acceptance
 
 The current Beta candidate contains nineteen publishable packages
-synchronized at version `1.0.0-beta.2`. The product-facing packages are:
+synchronized at version `1.0.0-beta.3`. The product-facing packages are:
 
 ```text
 @pulse-compute/pulse
@@ -271,7 +271,7 @@ The release owns a versioned hosted-documentation gate:
 pnpm docs:site:check
 ```
 
-The check builds the exact `v1.0.0-beta.2` site and `latest` tree in a temporary directory, creates one search entry per public page, validates local hosted links, verifies release/version manifests, and requires the search, version, owner, and review UI on every page.
+The check builds the exact `v1.0.0-beta.3` site and `latest` tree in a temporary directory, creates one search entry per public page, validates local hosted links, verifies release/version manifests, and requires the search, version, owner, and review UI on every page.
 
 The **Documentation** workflow repeats those checks for pull requests and `main`, seals a preview deployment manifest, and uploads artifacts without production credentials. It does not deploy to GitHub Pages.
 
@@ -279,7 +279,7 @@ Production delivery uses the manually dispatched **Documentation deployment** wo
 
 ```text
 build and seal
-→ upload/verify v1.0.0-beta.2 and its receipt immutably
+→ upload/verify v1.0.0-beta.3 and its receipt immutably
 → verify all matching npm packages and configured dist-tags
 → promote root and latest
 → verify representative URLs through Fastly

package/docs/maintainers/release-manifest.md

@@ -6,8 +6,8 @@
 
 ## Beta candidate
 
-- **Candidate:** Pulse 1.0.0-beta.2 — Beta
-- **Version:** `1.0.0-beta.2`
+- **Candidate:** Pulse 1.0.0-beta.3 — Beta
+- **Version:** `1.0.0-beta.3`
 - **Activation stage:** `documentation-release`
 - **License:** `Apache-2.0`
 - **Supported Node:** `^22.14.0 || ^24.0.0`
@@ -16,7 +16,7 @@
 - **Reproducible publication toolchain:** Node `24.18.0` with npm `11.15.0`
 - **Readiness register:** `release/release-preflight.json`
 - **Documentation inventory:** `release/documentation-inventory.json`
-- **Exact documentation:** `https://pulsecompute.io/v1.0.0-beta.2/`
+- **Exact documentation:** `https://pulsecompute.io/v1.0.0-beta.3/`
 - **Runtime targets:** 3
 - **Packages:** 19
 

package/docs/maintainers/testing.md

@@ -237,7 +237,7 @@ node wasm/scripts/run-wasm-tests.cjs --task deployment-candidates --no-report
 
 ## JWT and crypto proof seals
 
-The `1.0.0-beta.2` JWT/crypto packages build on the focused crypto seal,
+The `1.0.0-beta.3` JWT/crypto packages build on the focused crypto seal,
 which replays the
 configuration, JavaScript runtime, Native guest-source, shared cross-target
 corpus, and real Fastly Compute proofs. First record the one phase-boundary

package/docs/packages/README.md

@@ -2,7 +2,7 @@
 
 <!-- Generated by wasm/scripts/sync-reference-docs.cjs. Edit the source catalog, not this file. -->
 
-Pulse 1.0.0-beta.2 publishes one synchronized 19-package release set. Publication does not make every package an application-author SDK: the support tier and listed entry points define the release promise.
+Pulse 1.0.0-beta.3 publishes one synchronized 19-package release set. Publication does not make every package an application-author SDK: the support tier and listed entry points define the release promise.
 
 | Package on npm | Guide | Support tier | Install directly | Release promise |
 |---|---|---|---:|---|
@@ -44,9 +44,9 @@ Installable as part of the synchronized release set, without an application-auth
 
 Every packed README begins with a generated status block covering audience, direct-install guidance, supported entry points, and stability. An export that is not listed in that block is not automatically a supported application-author entry point.
 
-## Extension and provider boundary in 1.0.0-beta.2
+## Extension and provider boundary in 1.0.0-beta.3
 
-Pulse supports the documented package-owned assets and GRIP facades and the documented Fastly provider entry points. Their implementation demonstrates the internal contract, but `1.0.0-beta.2` does **not** expose a general third-party plugin registry:
+Pulse supports the documented package-owned assets and GRIP facades and the documented Fastly provider entry points. Their implementation demonstrates the internal contract, but `1.0.0-beta.3` does **not** expose a general third-party plugin registry:
 
 - lowerer manifests are accepted only from trusted first-party release packages;
 - arbitrary external lowerer discovery and execution are not supported;

package/docs/packages/assets.md

@@ -7,7 +7,7 @@ The package root exposes the complete JavaScript asset implementation—local fi
 ## Install
 
 ```bash
-npm install @pulse-compute/assets@1.0.0-beta.2
+npm install @pulse-compute/assets@1.0.0-beta.3
 ```
 
 ## Portable lookup surface

package/docs/packages/crypto.md

@@ -4,7 +4,7 @@
 verification for Pulse applications and first-party capability packages.
 
 ```bash
-npm install @pulse-compute/crypto@1.0.0-beta.2
+npm install @pulse-compute/crypto@1.0.0-beta.3
 ```
 
 ## Verification surface

package/docs/packages/entities.md

@@ -4,7 +4,7 @@
 operations through the first-party JSON-RPC adapter.
 
 ```bash
-npm install @pulse-compute/entities@1.0.0-beta.2
+npm install @pulse-compute/entities@1.0.0-beta.3
 ```
 
 ## Declare an entity router

package/docs/packages/grip.md

@@ -5,7 +5,7 @@
 ## Install
 
 ```bash
-npm install @pulse-compute/grip@1.0.0-beta.2
+npm install @pulse-compute/grip@1.0.0-beta.3
 ```
 
 ## Package-root API

package/docs/packages/implementation-packages.md

@@ -4,7 +4,7 @@
 
 These packages are synchronized parts of the release set for compiler, provider, runtime, and package-lowering maintainers. They are not application-author SDKs.
 
-The package status and supported entry-point lists below come from the synchronized Pulse 1.0.0-beta.2 release policy.
+The package status and supported entry-point lists below come from the synchronized Pulse 1.0.0-beta.3 release policy.
 
 ## `@pulse-compute/wasm-build-support`
 

package/docs/packages/jwt.md

@@ -4,7 +4,7 @@
 Pulse handlers.
 
 ```bash
-npm install @pulse-compute/jwt@1.0.0-beta.2
+npm install @pulse-compute/jwt@1.0.0-beta.3
 ```
 
 ## Verify a bearer token

package/docs/packages/provider-fastly.md

@@ -10,7 +10,7 @@ Install it only in projects that select the Fastly provider.
 ## Install
 
 ```bash
-npm install @pulse-compute/provider-fastly@1.0.0-beta.2
+npm install @pulse-compute/provider-fastly@1.0.0-beta.3
 ```
 
 ## Configure a project

package/docs/packages/pulse.md

@@ -8,7 +8,7 @@ provider-neutral runtime contract.
 ## Install
 
 ```bash
-npm install @pulse-compute/pulse@1.0.0-beta.2
+npm install @pulse-compute/pulse@1.0.0-beta.3
 ```
 
 The package exposes two supported entry points:

package/docs/packages/runtime.md

@@ -5,7 +5,7 @@
 ## Install
 
 ```bash
-npm install @pulse-compute/runtime@1.0.0-beta.2
+npm install @pulse-compute/runtime@1.0.0-beta.3
 ```
 
 A project created by `pulse init` depends on the public

package/docs/packages/s3.md

@@ -1,7 +1,7 @@
 # `@pulse-compute/s3`
 
 S3 provides bounded exact-key `head`, `getText` and `putText` effects. It is a
-supported extension in the synchronized `1.0.0-beta.2` candidate. Candidate
+supported extension in the synchronized `1.0.0-beta.3` candidate. Candidate
 preparation does not assert that the package has been published to npm. Consume
 the exact compatible S3, Pulse, CLI and provider tarballs from one release pack.
 

package/docs/preview-scope.md

@@ -1,6 +1,6 @@
 # Beta scope
 
-Pulse `1.0.0-beta.2` is a Beta of one provider-neutral application contract
+Pulse `1.0.0-beta.3` is a Beta of one provider-neutral application contract
 with explicit Native and JavaScript execution targets. The intended 1.0
 surface is present, but deliberate corrections may still occur before the
 stable `1.0.0` release.

package/docs/reference/cli-spec.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "pulse.cli-command-spec.v5",
-  "cliVersion": "1.0.0-beta.2",
+  "cliVersion": "1.0.0-beta.3",
   "completionShells": [
     "bash",
     "zsh",

package/docs/reference/cli.md

@@ -2,7 +2,7 @@
 
 <!-- Generated by wasm/scripts/sync-reference-docs.cjs. Edit the source catalog, not this file. -->
 
-The `pulse` CLI in `@pulse-compute/cli@1.0.0-beta.2` is the supported project workflow. One command specification generates this page, installed help, and the shipped Bash, Zsh, and Fish completion scripts, so a public command or option cannot drift between those surfaces.
+The `pulse` CLI in `@pulse-compute/cli@1.0.0-beta.3` is the supported project workflow. One command specification generates this page, installed help, and the shipped Bash, Zsh, and Fish completion scripts, so a public command or option cannot drift between those surfaces.
 
 ## Meta invocations
 

package/docs/reference/compatibility-matrix.md

@@ -86,7 +86,7 @@ separate ordinary-lifecycle and Fastly Native integration boundaries.
 ## JWT and crypto Beta packages
 
 This table records the sealed Phase D and E behavior of the synchronized
-`1.0.0-beta.2` JWT/crypto packages. Validation does not itself authorize npm
+`1.0.0-beta.3` JWT/crypto packages. Validation does not itself authorize npm
 publication.
 
 | Candidate capability | Node JS | Fastly JS | Node Native | Fastly Native | Notes |

package/docs/reference/diagnostics.md

@@ -2,11 +2,11 @@
 
 <!-- Generated by wasm/scripts/sync-reference-docs.cjs. Edit the source catalog, not this file. -->
 
-Pulse 1.0.0-beta.2 treats the 114 codes on this page as the stable public CLI diagnostic catalog. Code, category, summary, remediation intent, exit class, and anchor are generated from the same source used by the CLI. Human wording may improve compatibly.
+Pulse 1.0.0-beta.3 treats the 114 codes on this page as the stable public CLI diagnostic catalog. Code, category, summary, remediation intent, exit class, and anchor are generated from the same source used by the CLI. Human wording may improve compatibly.
 
 Every catalogued failure links to a versioned installed artifact under:
 
-`https://pulsecompute.io/v1.0.0-beta.2/reference/diagnostics/`
+`https://pulsecompute.io/v1.0.0-beta.3/reference/diagnostics/`
 
 Uncatalogued/internal or forward-compatible codes link to that reference root instead of inventing a nonexistent anchor. Internal `PULSEWASM_*` proof/compiler tokens are not part of this public catalog.
 
@@ -22,7 +22,7 @@ A Native eligibility diagnostic never authorizes automatic JavaScript fallback.
 ```json
 {
   "status": "error",
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.3",
   "error": {
     "name": "PulseProjectError",
     "code": "PULSE_BUILD_OUT_UNSAFE",
@@ -35,7 +35,7 @@ A Native eligibility diagnostic never authorizes automatic JavaScript fallback.
     ],
     "stability": "preview-stable",
     "scope": "public",
-    "docs": "https://pulsecompute.io/v1.0.0-beta.2/reference/diagnostics/#pulse-build-out-unsafe"
+    "docs": "https://pulsecompute.io/v1.0.0-beta.3/reference/diagnostics/#pulse-build-out-unsafe"
   }
 }
 ```
@@ -89,7 +89,7 @@ pulse test examples/02-request-schema --case invalid-user --json
       "expectedError": {
         "code": "PULSE_SCHEMA_DECODE",
         "category": "request",
-        "docs": "https://pulsecompute.io/v1.0.0-beta.2/reference/diagnostics/#pulse-schema-decode"
+        "docs": "https://pulsecompute.io/v1.0.0-beta.3/reference/diagnostics/#pulse-schema-decode"
       }
     }
   ]