@sleepy_panda_srl/portulan 0.1.2 → 0.2.0

package/evals/releases/0.2.0.json

@@ -0,0 +1,146 @@
+{
+    "portulan": {
+        "releaseEval": "1"
+    },
+    "version": "0.2.0",
+    "captured": "2026-09-30",
+    "source": {
+        "commit": "0b150002910d34a0a79408e82439cb81e1a0a0b9",
+        "clean": true
+    },
+    "host": {
+        "node": "v26.9.0",
+        "platform": "darwin"
+    },
+    "recipes": [
+        {
+            "id": "docs",
+            "exit": 0
+        },
+        {
+            "id": "json",
+            "exit": 0
+        },
+        {
+            "id": "doctor",
+            "exit": 0
+        },
+        {
+            "id": "tests",
+            "exit": 0
+        },
+        {
+            "id": "plugin",
+            "exit": 0
+        },
+        {
+            "id": "compile",
+            "exit": 0
+        },
+        {
+            "id": "workflow-filters",
+            "exit": 0
+        },
+        {
+            "id": "index",
+            "exit": 0
+        },
+        {
+            "id": "context",
+            "exit": 0
+        },
+        {
+            "id": "ledger",
+            "exit": 0
+        },
+        {
+            "id": "control-chars",
+            "exit": 0
+        },
+        {
+            "id": "comments",
+            "exit": 0
+        },
+        {
+            "id": "rule-carriers",
+            "exit": 0
+        },
+        {
+            "id": "pack-version",
+            "exit": 0
+        },
+        {
+            "id": "pack-identity",
+            "exit": 0
+        },
+        {
+            "id": "payload",
+            "exit": 0
+        },
+        {
+            "id": "eval-bundle",
+            "exit": 0
+        },
+        {
+            "id": "goldens",
+            "exit": 0
+        },
+        {
+            "id": "mutants",
+            "exit": 0
+        },
+        {
+            "id": "fuzz-shell",
+            "exit": 0
+        },
+        {
+            "id": "version-carriers",
+            "exit": 0
+        },
+        {
+            "id": "skill-goldens",
+            "exit": 0
+        },
+        {
+            "id": "review-loop",
+            "exit": 0
+        },
+        {
+            "id": "telemetry",
+            "exit": 0
+        },
+        {
+            "id": "drills",
+            "exit": 0
+        },
+        {
+            "id": "ab",
+            "exit": 0
+        },
+        {
+            "id": "ab-grade",
+            "exit": 0
+        },
+        {
+            "id": "ab-run",
+            "exit": 0
+        },
+        {
+            "id": "tools/github:actions-pinned",
+            "exit": 0
+        }
+    ],
+    "excluded": [
+        {
+            "id": "release-eval",
+            "why": "a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file."
+        }
+    ],
+    "abBaseline": {
+        "snapshot": "evals/ab/baseline.json",
+        "register": "evals/ab/baseline.md",
+        "captured": "2026-08-31T09:05:32.699Z",
+        "commit": "a642d551eec6c146c67ef0acfe3f8ba535c5ce6e",
+        "clean": false
+    }
+}

package/evals/releases/0.2.0.md

@@ -0,0 +1,67 @@
+# Eval result — Portulan 0.2.0
+
+> **Generated. Do not edit.** Rendered from [`evals/releases/0.2.0.json`](0.2.0.json) by [`cli/release-eval.mjs`](../../cli/release-eval.mjs) and byte-compared by the `release-eval` verify recipe. This is the eval result milestone 8 requires a release to carry — `docs/plan.md`, Protocol → Versioning.
+
+## What this release was measured at
+
+| | |
+|---|---|
+| Version | `0.2.0` |
+| Captured | 2026-09-30 |
+| Commit | `0b150002910d34a0a79408e82439cb81e1a0a0b9` |
+| Tree at capture | clean |
+| Node | `v26.9.0` |
+| Platform | `darwin` |
+
+## The rails, and what each returned
+
+29 of the 30 recipes this workspace yielded at capture. The set is derived from [`cli/recipe-set.mjs`](../../cli/recipe-set.mjs) and never listed by hand.
+
+| Recipe | Verdict |
+|---|---|
+| `docs` | green |
+| `json` | green |
+| `doctor` | green |
+| `tests` | green |
+| `plugin` | green |
+| `compile` | green |
+| `workflow-filters` | green |
+| `index` | green |
+| `context` | green |
+| `ledger` | green |
+| `control-chars` | green |
+| `comments` | green |
+| `rule-carriers` | green |
+| `pack-version` | green |
+| `pack-identity` | green |
+| `payload` | green |
+| `eval-bundle` | green |
+| `goldens` | green |
+| `mutants` | green |
+| `fuzz-shell` | green |
+| `version-carriers` | green |
+| `skill-goldens` | green |
+| `review-loop` | green |
+| `telemetry` | green |
+| `drills` | green |
+| `ab` | green |
+| `ab-grade` | green |
+| `ab-run` | green |
+| `tools/github:actions-pinned` | green |
+
+**`release-eval` is excluded**, and the reason is printed rather than the row silently dropped: a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file.
+
+## The A/B baseline this release ships against
+
+[`evals/ab/baseline.md`](https://github.com/sleepy-panda-srl/portulan/blob/v0.2.0/evals/ab/baseline.md), rendered from `evals/ab/baseline.json` — captured 2026-08-31T09:05:32.699Z at `a642d551eec6c146c67ef0acfe3f8ba535c5ce6e`, over a tree that was **not clean**.
+
+**Its figures are not repeated here.** They have one carrier and this is not it.
+
+## What this record does not establish
+
+- **A green says this record agrees with its own capture — never that the release is good.** Every line below is what the recipes returned at one commit, and a recipe's own green establishes only what that recipe's documentation says it establishes.
+- **The recipes were not run at the tag.** They ran at `0b150002910d34a0a79408e82439cb81e1a0a0b9`, and this record is committed *in* the cut change — so the tagged tree is this commit plus whatever that change still adds after the capture, the record itself at minimum. A record cannot be captured at a commit that does not exist yet, and printing the one it was captured at is the only honest form.
+- **`release-eval` is excluded from the rows above**, because a capture cannot be accurate about the record it is inside. Its verdict for this release is the rail's own run on the pull request that carries this file.
+- **This record measures the Portulan repository's own build**, at the commit named above — never the workspace, project or package this release is installed into. Nothing here has looked at your tree.
+- **The tree was clean at capture**, so the commit named above is what was measured.
+- **The A/B baseline's figures are NOT restated here.** This record names which baseline the release ships against; the figures and everything that may not be concluded from them live in that register alone.

package/evals/releases/README.md

@@ -0,0 +1,32 @@
+# `evals/releases/`
+
+The eval result each release carries, one pair per version — milestone 8's ninth clause. The limits are
+in [`../README.md`](../README.md); the argument, the mechanism and the two designs a fresh context
+reversed are in [`../../cli/release-eval.mjs`](../../cli/release-eval.mjs). This file does not restate
+either, because a rule with two carriers is obeyed at the narrower one.
+
+- `<version>.json` — the **capture**: the verdict every recipe the workspace yielded returned, at a named
+  commit, plus the identity of the A/B baseline that release ships against. Written by
+  `node cli/release-eval.mjs --capture`, which runs them. **A hand-edited capture is NOT caught by the
+  byte comparison** — that holds the register to the capture, so `--write` re-renders the edit and the
+  pair agrees perfectly. What guards a capture is the rail's reading of its *contents*: an exclusion
+  list that is anything but the self-exclusion, a recorded non-zero exit, a version not matching the
+  release it is filed under, a record for a version never cut or for one the clause does not govern.
+  This sentence used to claim the opposite, and a sentence claiming a guard that does not exist is what
+  makes the gap it describes look unreachable.
+- `<version>.md` — the **register**, rendered from the capture. Generated; do not edit. `--write`
+  re-renders it and the `release-eval` recipe refuses any difference.
+
+**Which releases have records is not written here.** `ls` this directory, or run
+`node cli/release-eval.mjs --verify`, which prints the governed set and is the carrier — a sentence
+counting the files beside it would be a hand-maintained figure of a subject that grows once per release,
+which is the defect this repository deletes on sight.
+
+**What is fixed, and is the only thing this file states about coverage:** the clause binds *from
+milestone 8* — [`../../docs/plan.md`](../../docs/plan.md), Protocol → Versioning — so `v0.1.0`, `v0.1.1`
+and `v0.1.2` carry none and are never asked to. That is history and cannot change.
+
+_(This paragraph read **"This directory is empty of records"** as a standing claim. It would have gone
+false in the very commit that wrote the first record — and, since this directory ships inside the npm
+payload, it would then have been **frozen false beside the record it denied**, in a tarball only another
+release could correct. Caught by a second opinion before the first cut rather than by a reader of it.)_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleepy_panda_srl/portulan",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Portulan — an agentic-engineering framework whose product is its files. The CLI wraps the file-based mechanics for hosts beyond Claude Code.",
   "license": "Apache-2.0",
   "type": "module",
@@ -15,13 +15,20 @@
     "core/",
     "spec/",
     "packs/",
+    "evals/releases/",
     "README.md",
     "LICENSE",
     "NOTICE",
     "!cli/*.test.mjs",
     "!cli/fixtures",
     "!cli/eval-bundle.mjs",
-    "!cli/eval-license.template.md"
+    "!cli/eval-license.template.md",
+    "!cli/ab.mjs",
+    "!cli/ab-run.mjs",
+    "!cli/ab-grade.mjs",
+    "!cli/warm.mjs",
+    "!cli/payload.mjs",
+    "!cli/roster.mjs"
   ],
   "repository": {
     "type": "git",

package/packs/rituals/checkpoints/README.md

@@ -38,7 +38,7 @@ Four verdicts, and which are available depends on the checkpoint.
 | Verdict | Means | Available at |
 |---|---|---|
 | **APPROVE** | Proceed as it stands. | session-open · pre-commit |
-| **APPROVE-WITH-ADJUSTMENTS** | Proceed once the numbered adjustments are folded in. Not a soft failure — it is what a working checkpoint usually returns. | session-open · pre-commit |
+| **APPROVE-WITH-ADJUSTMENTS** | Proceed once the numbered adjustments are folded in. Not a soft failure — it is what a working checkpoint usually returns. **At pre-commit the fold itself is then graded** — see that skill. | session-open · pre-commit |
 | **REQUEST-CHANGES** | Does not meet the standard. Name what, and what would meet it. Needs a second pass at the same checkpoint. | all three |
 | **CLOSE** | Every clause of the criterion is demonstrated; the milestone may be marked done. | milestone-close only |
 
@@ -49,6 +49,13 @@ concerns is not a verdict.
 proceed on a promise to fold something in, and a close is the one decision with nothing downstream of
 it to catch what was folded in wrongly.
 
+**That argument reaches one moment earlier, which is why pre-commit's A-W-A grades its own fold**
+(proposal `0035`, 2026-08-29). Session-open's fold *does* have something downstream — the plan it folds
+into becomes a diff, and pre-commit grades that. **Pre-commit's fold has only the commit.** So the
+verdict that lets work proceed on a promise is, at that moment, a promise nothing checks; measured on a
+change where two of three later review findings were created by the fold and were absent from the graded
+diff.
+
 ## The fidelity note
 
 What a close leaves in the record once the session that wrote it is gone. Four parts, in one clause:
@@ -93,7 +100,7 @@ under, and the checkpoint section of that project's own gate map.
 
 **The evidence is that project's build record**, cited as provenance rather than as procedure: the
 fresh-context checkpoints changed *designs* rather than wording at two consecutive milestones — the
-story is in [milestone 4's record](https://github.com/sleepy-panda-srl/portulan/blob/main/docs/milestones/m04.md),
+story is in [milestone 4's record](https://github.com/sleepy-panda-srl/portulan/blob/8a33f9b/docs/milestones/m04.md),
 beside [the protocol itself](https://github.com/sleepy-panda-srl/portulan/blob/main/docs/plan.md) —
 while adopters received no artifact for the ritual that produced them. This pack is that artifact.
 

package/packs/rituals/checkpoints/pack.json

@@ -1,7 +1,7 @@
 {
   "portulan": {
     "pack": "1.0",
-    "version": "0.2.1"
+    "version": "0.3.0"
   },
 
   "name": "checkpoints",

package/packs/rituals/checkpoints/skills/pre-commit/SKILL.md

@@ -65,8 +65,38 @@ whether a status column changed.
 ## The verdicts this checkpoint may return
 
 - **APPROVE** — commit as it stands.
-- **APPROVE-WITH-ADJUSTMENTS** — commit once the numbered adjustments are folded in.
-- **REQUEST-CHANGES** — the diff does not meet the criterion; it needs work and a second pre-commit pass.
+- **APPROVE-WITH-ADJUSTMENTS** — fold the numbered adjustments, then **grade the fold**: a pass over
+  **the fold delta alone**, in a context that did not perform the fold, before the commit.
+- **REQUEST-CHANGES** — the diff does not meet the criterion; it needs work and a second pre-commit pass
+  **over the whole diff**.
+
+**Grade a fully staged diff.** The whole procedure below is index-shaped, so anything left unstaged was
+not graded and will not appear in the fold delta either — it would pass through both nets. Stage first,
+then grade; this is what practice here already did, and it is stated because the mechanism now depends
+on it rather than merely benefiting from it.
+
+**A checkpoint records the tree it graded** — the index it read, as a tree object (`git write-tree`). The
+fold delta is then **`git diff --cached <graded-tree>`**: the recorded tree against the index, which is
+what is about to be committed. Derived, not reconstructed from memory by the person who folded.
+
+_Why the fold is graded at all, and why the A-W-A pass is scoped to the delta._ **The tree that ships is
+not the tree that was graded**, and the difference is where a remediation can inject what the checkpoint
+just caught elsewhere. Measured: on one change, folding an adjustment split a table row and left a
+summary count stale three sections above, and folding another **re-measured a question the checkpoint had
+answered correctly** — with a line-based tool against a normalising scanner — and wrote the wrong answer
+over the right one. Neither defect was in the graded diff. A full re-grade after every A-W-A would double
+the cost of the cheapest verdict, which is the ceremony a definition of done should refuse; **the delta is
+the only region a fold-injected defect can be in.**
+
+_The delta is **whatever was staged after the grade** — it *should* be the adjustments and nothing else,
+and the mechanism does not guarantee that. **Where it is wider, that is not noise; it is the finding.**
+Post-grade edits nobody proposed are exactly what escapes a checkpoint today, so a pass that sees them is
+worth more than one over a delta that had been trimmed to what the verdict asked for._
+
+_What this does not buy, said plainly: whether a fresh context actually read the delta is not checkable —
+a session can claim a pass it did not run. What changes is that the pass now has a **defined subject**,
+derived from the tree rather than recalled by the one who folded._ Provenance: proposal `0035`,
+accepted 2026-08-29.
 
 ## Why it earns its tokens
 

package/packs/tools/github/verify/actions-pinned.sh

@@ -1,34 +1,13 @@
 #!/usr/bin/env bash
-#
 # Every `uses:` in a GitHub Actions workflow is pinned to a full 40-character commit SHA.
-#
-# Exit 0 green · 1 red · 2 could not run. The third is load-bearing here, as everywhere in this
-# project: a recipe that could not look must never report what a recipe that looked and found nothing
-# reports. See `README.md` beside this file for what the check does NOT cover and why it exists at all
-# given that GitHub can enforce pinning itself.
-#
-# Composed into an adopting workspace through `pack.json`'s `contributes.verify`, whose `run` names
-# this file through `${PACK_ROOT}` — the pack does not know the adopter's layout and must not guess it.
+# Exit 0 green · 1 red · 2 could not run.
 
 set -uo pipefail
 
+# Relative to the working directory, the adopter's root: where the pack sits says nothing about it.
 WORKFLOWS=".github/workflows"
 
-# ---------------------------------------------------------------------------------------------
-# The tools this recipe invokes, checked before it invokes them.
-#
-# Without this the failure is SILENT and GREEN: the two loops below read from process substitutions,
-# so a missing `find` or `grep` yields no lines at all, every counter stays zero, `status` stays 0 —
-# and the recipe reports a pass having examined nothing. That is the false green — "nothing looked"
-# reported as "nothing wrong" — and it is precisely what `.portulan/memory/verify-preconditions-fail-closed.md`
-# exists to refuse. The header below already cited that rule for the workflows DIRECTORY and did not
-# apply it to the recipe's own dependencies: a rule obeyed at one of its two sites, in a file that
-# quotes the rule. Copilot round 5.
-#
-# `requires` in `pack.json` declares the same list. Two carriers, deliberately — the manifest's is
-# what a host reads to decide whether to run at all, this one is what fires when it ran anyway — and
-# they are checked against each other by nothing, which is stated here rather than implied.
-# ---------------------------------------------------------------------------------------------
+# `pack.json`'s `requires` lists these tools too, and nothing checks that the two agree.
 missing=""
 for tool in find grep sed sort cut wc tr; do
     command -v "$tool" >/dev/null 2>&1 || missing="$missing $tool"
@@ -40,16 +19,6 @@ if [ -n "$missing" ]; then
     exit 2
 fi
 
-# ---------------------------------------------------------------------------------------------
-# Preconditions fail closed. Enumeration is the precondition here exactly as it is in this project's
-# own recipes (`.portulan/memory/verify-preconditions-fail-closed.md`): a green computed over a
-# directory that was not there is a green about nothing.
-#
-# Both the absent directory and the present-but-empty one are could-not-run rather than vacuously
-# green, and the distinction between them is kept in the MESSAGE rather than in the exit code —
-# a workspace with no workflows has composed a pack that cannot do its job, and should hear that
-# sentence rather than a green it might mistake for coverage.
-# ---------------------------------------------------------------------------------------------
 if [ ! -d "$WORKFLOWS" ]; then
     printf 'actions-pinned: COULD NOT RUN — there is no %s directory in this repository.\n' "$WORKFLOWS" >&2
     printf '  A workspace with no GitHub Actions workflows has nothing for this recipe to check;\n' >&2
@@ -57,8 +26,6 @@ if [ ! -d "$WORKFLOWS" ]; then
     exit 2
 fi
 
-# `find` rather than a glob, so a directory holding only subdirectories is not mistaken for one
-# holding workflows. Sorted so the report is stable between runs and between machines.
 files=$(find "$WORKFLOWS" -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) | sort)
 
 if [ -z "$files" ]; then
@@ -69,30 +36,21 @@ fi
 status=0
 examined=0
 pinned=0
-local_refs=0
+exempt=0
 
 while IFS= read -r file; do
-    # One `uses:` per line is the shape every workflow in the wild uses; a folded or flow-mapping
-    # spelling would slip past this, which is stated in README.md as a known limit rather than
-    # covered by a matcher that would claim more than it reads.
+    # One `uses:` per line: a folded or flow-mapping spelling is not seen.
     while IFS= read -r line; do
         value=$(printf '%s\n' "$line" | sed -E 's/^[[:space:]]*-?[[:space:]]*uses:[[:space:]]*//; s/[[:space:]]*(#.*)?$//; s/^["'"'"']//; s/["'"'"']$//')
         [ -n "$value" ] || continue
 
-        # `examined` counts only references this recipe can actually judge, and the exempt ones are
-        # counted separately below. Counting them here made the summary print a ratio like `2 of 3
-        # pinned` on a run where every non-exempt reference WAS pinned — a green whose own number
-        # looked like a partial pass. Copilot round 2.
         case "$value" in
             ./*)
-                # A local action lives in this repository and moves with it — there is no third-party
-                # commit to pin, and demanding one would be a check that cannot be satisfied.
-                local_refs=$((local_refs + 1))
+                exempt=$((exempt + 1))
                 continue
                 ;;
             docker://*)
-                # A container reference is pinned by digest, not by commit. Out of scope and named.
-                local_refs=$((local_refs + 1))
+                exempt=$((exempt + 1))
                 continue
                 ;;
         esac
@@ -102,10 +60,7 @@ while IFS= read -r file; do
         if [ "$ref" = "$value" ]; then
             printf '  UNPINNED %s: `uses: %s` carries no `@ref` at all\n' "$file" "$value" >&2
             status=1
-        # Case-insensitive: a git object name is hex and hex is case-insensitive, so an uppercase or
-        # mixed-case SHA is a pinned SHA. Matching lowercase only would have reported a correctly
-        # pinned action as unpinned — a FALSE RED, which is the failure mode this project treats as
-        # worse than a missed catch, because it is the one that gets a check switched off.
+        # Case-insensitive, as hex is: an uppercase SHA is still a pinned one.
         elif printf '%s' "$ref" | grep -Eqi '^[0-9a-f]{40}$'; then
             pinned=$((pinned + 1))
         else
@@ -120,8 +75,8 @@ count=$(printf '%s\n' "$files" | wc -l | tr -d ' ')
 if [ "$status" -eq 0 ]; then
     printf 'actions-pinned: %s of %s `uses:` reference(s) pinned to a full commit SHA across %s workflow file(s)' \
         "$pinned" "$examined" "$count"
-    if [ "$local_refs" -gt 0 ]; then
-        printf ', %s local or container reference(s) exempt' "$local_refs"
+    if [ "$exempt" -gt 0 ]; then
+        printf ', %s local or container reference(s) exempt' "$exempt"
     fi
     printf '\n\nGREEN — verify recipe passed.\n'
 else

package/spec/README.md

@@ -114,7 +114,9 @@ carries, applied to the handoff series — `slots.handoffs` when `handoffs` is d
 either counted as a handoff by the `record` check's correspondence or failed by it for carrying no
 date; and, as of 2.6, that same pair a third time over the per-persona scope layer — `slots.personas`
 when `personas` is declared, and `personas.index.path` resolving **outside** `slots.personas`, since
-`index`'s orphan sweep would examine a file sited there as an undeclared persona location.
+`index`'s orphan sweep would examine a file sited there as an undeclared persona location; and, as of
+2.11, `memory.store.budget.record_kilobytes` when `memory.store.budget.cutoff` is declared, since a
+cutoff says which records that cap binds and alone configures nothing.
 Everything else is optional.
 
 _The 2.6 pair was enforced in `doctor` from the day the keys landed and was missing from this list until
@@ -139,7 +141,7 @@ a manifest in *another repository*, and no contract over a single document can s
 join the list, and the reason is what keeps that list meaningful: every entry there is a dependency
 between two keys **of one manifest**, which is the thing a reader of the schema alone would expect to find
 and does not. A check that needs a second repository is not in that category, and folding it in would make
-the count measure two different things at once. **The count stays at nine**, and it counts what it always
+the count measure two different things at once. **The count stays at ten**, and it counts what it always
 counted.
 
 [`slots.md`](slots.md) argues each one.
@@ -150,8 +152,8 @@ defect [#77](https://github.com/sleepy-panda-srl/portulan/issues/77) is filed ab
 and adding to the list at 2.5 is exactly the edit that would have left it stale again — which is how
 this one was noticed._
 
-That the count went from one to three in a single MINOR, then to five, then to seven, and now stands at
-**nine**, is worth noticing rather than absorbing. Each is a genuine dependency between two keys and none
+That the count went from one to three in a single MINOR, then to five, then to seven, then to nine, and
+now stands at **ten**, is worth noticing rather than absorbing. Each is a genuine dependency between two keys and none
 can be written in the declared subset, so the gap between *what the schema says* and *what a conforming
 manifest must satisfy* is widening — and a constraint invisible to someone reading the schema alone is a
 real cost, stated here rather than discovered. The subset earns its narrowness by being implementable
@@ -179,6 +181,38 @@ subset can say, and `doctor` returns at *the manifest must conform first* before
 runs. It is a live hole for `cli/index.mjs` alone, which validates against no schema by design and
 therefore refuses the string itself.)_
 
+**2.9 adds nothing to that list either**: `context` requires `ratio`, and `ratio` requires its two
+fields, in the schema itself, because `required` is in the subset. It adds **two** keys to the hand-check,
+so it covers **nine**. `context.always.budget.tokens` is the fifth budget the subset can only type as
+`number`. `context.ratio.bytes_per_token` is the first key held to something other than a positive
+integer: 2.99 bytes per token is a real figure, so the check is *at least 1*, since a token covers at
+least one byte and a smaller figure is tokens per byte entered inverted. For that key `minimum` alone
+would close the gap.
+
+**2.10 adds nothing to either list.** `slots.context` is a directory path, which the schema types in full,
+and what a unit's frontmatter may say is `compile`'s to refuse, because the subset cannot see inside a
+file. `doctor` checks the slot as it checks every directory slot, and gates it to 2.10.
+
+**2.11 adds one to each list.** `memory.store.budget.cutoff` needs `record_kilobytes` beside it, the
+tenth conditional requirement; and its `pattern` admits a day that does not exist, such as `2026-02-30`,
+so `doctor` and `cli/index.mjs` refuse one by hand, and the hand-check covers **ten**.
+`sessions` adds nothing to either: every field of it is a boolean or one of two strings, which the
+schema types in full with `type` and `enum`, so `doctor` only gates the key to 2.11.
+
+**2.12 adds five to the hand-check and nothing to the conditional requirements.** `required` holds both
+halves of `spend.multipliers` and both lifetimes of its `write` in the schema itself, and the subset types
+the four figures only as `number`, the horizon included, since it cannot say `integer`, so `doctor` holds
+the read in (0, 1], each write at least 1 and the horizon to a positive integer by hand, and refuses a write
+the read divides past the largest number, since the restart threshold divides one by the other; the
+hand-check covers **fifteen**. For the two writes `minimum` alone would close the gap, as it would for the
+ratio; the read is the first figure bounded above, so it would need `exclusiveMinimum` and `maximum`, and
+the horizon the budgets' `minimum` and `integer`; no keyword in the subset relates two figures, so the
+quotient stays by hand.
+
+**2.13 adds nothing to either list.** `spend.restart` is one of two strings, which the subset types in full
+with `type` and `enum`, so the key needs no hand-check, only the gate to 2.13, which `doctor` and `compile`
+both hold.
+
 _These figures are history rather than state: what 2.3 and 2.4 added cannot change, so they do not go
 stale the way the removed count did. The one forward-looking sentence is the growth rate, and it is
 dated by the version it names._
@@ -194,15 +228,87 @@ number governing both would make a bump in either mean a change in the other:
 
 | Schema | Manifest key | Current | What it governs |
 |---|---|---|---|
-| [`workspace.schema.json`](workspace.schema.json) | `portulan.spec` | **2.8** | the Workspace Definition — the manifest at a workspace root |
+| [`workspace.schema.json`](workspace.schema.json) | `portulan.spec` | **2.13** | the Workspace Definition — the manifest at a workspace root |
 | [`pack.schema.json`](pack.schema.json) | `portulan.pack` | **1.0** | the Pack Definition — the manifest at a pack root. |
 
 The rules below apply to each train independently. `portulan.spec` is `MAJOR.MINOR`, and the current
-Workspace Definition version is **2.8**. It did **not** move when the Pack Definition arrived, because
+Workspace Definition version is **2.13**. It did **not** move when the Pack Definition arrived, because
 `workspace.schema.json` was byte-identical across that change: `packs` already existed as an array of
 strings and was deliberately left that way, since tightening its items to the canonical `category/name`
 form would be a constraint an existing manifest could newly fail, which is a MAJOR.
 
+**2.13 is a MINOR on 2.8's terms: optional keys only.** `spend.restart` is the last piece of item 5 of
+proposal `0038`'s order of work, the declared block its ruling 3 allows: `"advise"` is the restart advisory as
+it was, and `"block"` also holds a turn's end once, at the first stop at or past the threshold that no block
+provoked, with the advisory's line as the reason; [`slots.md`](slots.md) argues it. Nothing is removed,
+renamed, tightened or defaulted: without the key, or with `"advise"`, the settings compile byte for byte as
+before, so every 2.12 manifest is a valid 2.13 manifest unchanged. This repository's own workspace stays on
+2.11 and declares no block: it declares no multipliers either, and at the general ones the line comes early
+for a model whose cache reads cost less than a tenth, so a block would hold its sessions short of their real
+line. Nothing writes 2.13 unasked: `init` asks nothing about the key and `upgrade` offers nothing, since
+ruling 3 makes a block a workspace's own choice. `KNOWN_SPECS` in [`../cli/index.mjs`](../cli/index.mjs) and
+[`../cli/librarian.mjs`](../cli/librarian.mjs) gains `"2.13"` by addition, and `doctor` and `compile` both
+refuse the key in a manifest that declares an earlier MINOR.
+
+**2.12 is a MINOR on 2.8's terms: optional keys only.** `spend` is item 4 of proposal `0038`'s order of
+work: the multipliers the restart threshold is computed at, which its ruling 2 has the manifest declare, and
+the horizon the threshold is judged over, 20 requests under ruling 3 until the manifest declares another;
+[`slots.md`](slots.md) argues it. Nothing is removed, renamed, tightened or defaulted: without `spend`,
+[`../cli/ledger.mjs`](../cli/ledger.mjs) and the restart advisory price at the general multipliers as before
+and say `undeclared`, and the settings compile byte for byte as before, so every 2.11 manifest is a valid
+2.12 manifest unchanged. This repository's own workspace stays on 2.11 and declares no `spend`; it now
+declares `sessions.headless.cache_lifetime` `"5m"`, a 2.11 key. `examples/` stays on 2.4. `init` writes 2.11
+where a person takes the five-minute cache lifetime it now offers, since `sessions` is 2.11's key, and 2.10
+otherwise. `KNOWN_SPECS` in [`../cli/index.mjs`](../cli/index.mjs) and
+[`../cli/librarian.mjs`](../cli/librarian.mjs) gains `"2.12"` by addition, and `doctor` gates the key to
+2.12. `0038`'s third key, the declared Stop-gate block, takes the next free MINOR, 2.13, in its own change,
+and `0034`'s keys take the next free MINOR when they are drafted.
+
+**2.11 is a MINOR on 2.8's terms: optional keys only.** `memory.store.budget.cutoff`
+makes the per-record cap forward-only, in proposal `0037`'s shape for a handoff, and [`slots.md`](slots.md)
+argues it. `sessions` is the machine half of [`../core/operating/sessions.md`](../core/operating/sessions.md),
+from `0038`'s rules 3 and 4: the host switches that change what a fresh session writes into the prompt cache,
+two of which `compile` writes into the settings it already generates and one of which only a runner can apply;
+[`slots.md`](slots.md) argues it too. Nothing is removed, renamed, tightened or defaulted: without the cutoff,
+`record_kilobytes` binds every record as it did, and without `sessions` the settings compile byte for byte as
+before, so every 2.10 manifest is a valid 2.11 manifest unchanged. This repository's own workspace moves from
+2.10 to 2.11 to declare the cutoff, with the cap lowered from 8 KB to 2 and the cutoff 2026-09-24, and declares
+no `sessions`; `examples/` stays on 2.4. `KNOWN_SPECS` in [`../cli/index.mjs`](../cli/index.mjs) and
+[`../cli/librarian.mjs`](../cli/librarian.mjs) gains `"2.11"` by addition, `doctor` gates both keys to 2.11,
+and the four writers stay at `2.7`, since nothing they scaffold declares either. `0034`'s key and the rest of
+`0038`'s still take the next free MINOR when they are drafted.
+
+**2.10 is a MINOR on 2.9's terms: one optional slot and nothing else.** `slots.context` is the content
+half of [`../core/operating/context.md`](../core/operating/context.md), from proposal `0036`'s compile
+targets: a directory of guidance, each file declaring in its frontmatter the load tier it belongs in, which
+`compile` emits in each host's own form. Nothing is removed, renamed, tightened or defaulted, so every 2.9
+manifest is a valid 2.10 manifest unchanged, and [`slots.md`](slots.md) argues the slot. It is the first
+MINOR with two digits, and every reader compares the MINOR as a number or matches the string whole, so
+`2.10` sorts after `2.9`. `0034`'s and `0038`'s keys still take the next free MINOR when they are drafted.
+
+**Measured across the bump:** `node cli/doctor.mjs .portulan examples` is GREEN, with `.portulan` on 2.8
+and `examples/` on 2.4, both untouched: the demo stays six MINORs behind for the reason given under 2.8,
+and no workspace here declares the slot, because moving guidance between tiers in this repository's own
+curated layer is its maintainer's change to make. `KNOWN_SPECS` in [`../cli/index.mjs`](../cli/index.mjs)
+and [`../cli/librarian.mjs`](../cli/librarian.mjs) gains `"2.10"` by addition, and the four writers stay at
+`2.7`, since nothing they scaffold declares the slot.
+
+**2.9 is a MINOR on 2.8's terms: one optional key and nothing else.** `context` is the machine half of
+[`../core/operating/context.md`](../core/operating/context.md), from proposal `0036`: an always-tier
+budget in tokens and the bytes-per-token ratio it is counted at, with the host whose exact count
+calibrated it. Nothing is removed, renamed, tightened or defaulted, so every 2.8 manifest is a valid 2.9
+manifest unchanged. [`slots.md`](slots.md) argues the key. **It carries `context` alone.** Proposals
+`0034` (`evals` and `telemetry`) and `0038` (its spend keys) each say their keys ride the MINOR this key
+needs and that neither waits for the other; none of them is drafted, and `0034`'s accepted text names no
+version number, so they take the next free MINOR when they are drafted.
+
+**Measured across the bump, as for 2.7 and 2.8:** `node cli/doctor.mjs .portulan examples` is GREEN, with
+`.portulan` still on 2.8 and `examples/` on 2.4, both untouched. Neither declares the key, because
+nothing measures the always tier yet and a budget nothing checks reads as a rail. What it costs:
+`KNOWN_SPECS` in [`../cli/index.mjs`](../cli/index.mjs) and [`../cli/librarian.mjs`](../cli/librarian.mjs)
+gains `"2.9"` by addition, and the four writers stay at `2.7`, since nothing they scaffold declares the
+key.
+
 **2.8 is a MINOR on the plainest terms in this train's history: one optional key and nothing else.**
 `memory.store.budget.record_kilobytes` — the most bytes any single record may hold — joins the sibling
 `kilobytes` it does not replace. Nothing is removed, renamed, tightened or defaulted, so every 2.7