@sleepy_panda_srl/portulan 0.1.2 → 0.1.3

package/cli/pack-identity.mjs

@@ -43,8 +43,15 @@ class CannotRun extends Error {}
 
 const run = (cmd, args, opts = {}) => execFileSync(cmd, args, { encoding: "buffer", maxBuffer: 64 * 1024 * 1024, ...opts });
 
-/** What the package would contain, as repo-relative paths. */
-function packedPaths(root) {
+/**
+ * What the package would contain, as repo-relative paths.
+ *
+ * **Exported because `./payload.mjs` classifies exactly this roster**, and two enumerations of *what
+ * npm would pack* is the second-carrier defect this repository keeps paying for. That rail asks which
+ * files ship; this one asks whether each is byte-identical to its source. One question about
+ * membership, asked once, answered here.
+ */
+export function packedPaths(root) {
     let out;
     try {
         out = run("npm", ["pack", "--dry-run", "--json"], { cwd: root, stdio: ["ignore", "pipe", "pipe"] }).toString("utf8");

package/cli/pack-version.mjs

@@ -13,6 +13,13 @@
 // for a single field. `portulan.version` is per-pack, so it cannot contend. Tying the bundle to the pack
 // manifests is arm 4 of the issue and is deliberately NOT here.
 //
+// **Re-measured 2026-08-29: the bundle now agrees with NEITHER pack** — `rituals/checkpoints` moved to
+// `0.3.0` when proposal `0035` added an obligation to its pre-commit verdict, while the bundle stayed
+// `0.2.1` and `tools/github` stayed `0.1.0`. The measurement above is stamped to `c93a819` and remains
+// true of that commit; what changed is that the coincidence it names has ended, which STRENGTHENS the
+// argument rather than dating it. A reader finding three different numbers is looking at three
+// independently versioned things, not at drift.
+//
 // ## Why the whole `contributes` block, not only `gates`
 //
 // The issue's title asks about gate fragments; arm 3's own text says *"touching a pack's `contributes`

package/cli/recipe-set.mjs

@@ -83,6 +83,12 @@ import { AUTO, discoverPackRoots, namedWithAuto } from "./discover.mjs";
 export const RECIPE_SET_READERS = Object.freeze([
     ".github/workflows/verify.yml",
     "cli/doctor.mjs",
+    // Added 2026-08-25 with milestone 8 clause (d). `cli/drills.mjs` reads the set to know which rails
+    // it must drill — and it is the reader that shows the live sweep's own boundary: it calls
+    // `recipeSet()` rather than enumerating `verify.recipes`, so the sweep for an undeclared
+    // *enumeration* could not see it and this roster went stale in the one way the pair above was
+    // arranged not to allow. Raised as a suppressed note by Copilot, round 1 on #343.
+    "cli/drills.mjs",
     "cli/stop-gate.mjs",
     "cli/vendor.mjs",
 ]);