@topy-ai/maggie 0.7.20 → 0.7.22

package/README.md

@@ -76,6 +76,15 @@ maggie qa summary --project . --run <run-id>
 The QA workflow stores secret-free run state under `.maggie/qa-runs/` and
 keeps project-specific scenarios and evidence outside the npm package.
 
+Before recording a passing user-facing assertion, lint it against runtime
+evidence; source-only class or markup checks are rejected:
+
+```bash
+maggie qa assertion-audit --project . \
+  --assertions .maggie/qa-assertions.json \
+  --output docs/qa-assertion-audit.json
+```
+
 Dashboard and documentation audits are provider-neutral and keep host data
 behind explicit evidence files:
 
@@ -123,6 +132,24 @@ variants use market/locale-aware canonical routes and reciprocal hreflang.
 Release preflight consumes the latest matching scenario QA run when one is
 configured and blocks incomplete evidence.
 
+The provider-owned parser also supports safe catalogue and lifecycle review:
+
+```bash
+maggie service catalogue-check "<provider-location-url>" \
+  --treatment "Lymphatic drainage massage"
+maggie service sync-report --project .
+maggie service retirement-audit --project . \
+  --catalogue .maggie/booking/services.json \
+  --evidence .maggie/booking/retirement-evidence.json
+```
+
+`catalogue-check` avoids marketplace noise when the provider exposes an
+authoritative embedded catalogue. `sync-report` shows field and variant
+before/after changes. `retirement-audit` validates sanitized runtime evidence
+for `pending`, `redirect`, `tombstone`, or `gone` endings, including HTTP
+status, booking suppression, noindex/unavailable signals, and sitemap
+exclusion. Response bodies are never stored.
+
 For Google integrations, validate a redacted provider matrix before reporting
 access. The command fails closed on unknown scopes, missing Ads prerequisites,
 duplicate provider resources, and unverified edit/publish claims:
@@ -183,7 +210,7 @@ maggie memory ...                # confirmed preferences and lessons
 maggie feedback ...              # redact, preview, submit, list
 maggie qa ...                    # scenario browser QA, fix/retest, release gate
 maggie localization ...          # plan, validate, review, publish, stale
-maggie service ...               # import, sync, capability audit, validate
+maggie service ...               # import, sync/report, catalogue, lifecycle, validate
 maggie seo performance ...       # sampled PageSpeed/CWV report and baseline
 maggie seo images ...             # inventory, variants, confirmation, validate
 maggie seo sitemap ...            # typed/semantic plan, agent-files, apply, rollback
@@ -192,6 +219,7 @@ maggie seo social-cards ...       # per-page og:image format/dimension audit
 maggie seo head-tags ...          # rendered-shell head metadata drift audit
 maggie ops favicon-check ...      # served favicon behaviour check
 maggie deployment | migration | release | analytics | schedule
+maggie deployment readiness --project PATH
 maggie migration identity --identity-file FILE [--expected-file FILE]
 maggie deployment canary --asset URL=SHA256 --render-report report.json
 maggie design icon-inventory --source-dir src --runtime assets/icons.css
@@ -280,6 +308,25 @@ The canary report requires a screenshot and zero console errors, missing
 assets, and visual placeholders for every route. It records safe cache headers
 only and never stores response bodies, cookies, or credentials.
 
+Unit regression does not establish runtime release readiness. Produce unit
+evidence and then validate all five release evidence slots:
+
+```bash
+python3 tools/tests/run_regression.py \
+  --report .maggie/verification/unit-regression.json
+maggie deployment readiness --project . \
+  --package-report .maggie/verification/package-smoke.json \
+  --browser-report .maggie/verification/browser-evidence.json \
+  --rendered-canary .maggie/deployment-canary.json \
+  --deployment-preflight .maggie/release-preflight.json \
+  --output .maggie/deployment-readiness.json
+```
+
+The readiness report follows `maggie-deployment-readiness.v1`. It reports unit
+regression, package smoke, host browser evidence, rendered canary, and
+deployment preflight separately. Missing host adapter evidence is
+`inconclusive`; only five passing slots produce `passed`.
+
 ### Localization and analytics release gates
 
 Extract real page strings before creating a localization job, then require a
@@ -305,8 +352,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.20 update --project . --force
-npx @topy-ai/maggie@0.7.20 cleanup --project .
+npx @topy-ai/maggie@0.7.22 update --project . --force
+npx @topy-ai/maggie@0.7.22 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -316,6 +363,11 @@ as a command-line argument:
 node scripts/publish-npm.mjs --maggie-env-file ../.env
 ```
 
+The 0.7.22 workflow adds provider-catalogue authority checks, field/variant
+sync reports, separate supply/display states, site-owned slug proposals,
+withdrawal endings, retirement evidence audits, and runtime QA assertion lint.
+The 0.7.21 workflow adds operation-specific localization quality checks,
+explicit deployment readiness evidence states, and serialized package assembly.
 The 0.7.20 workflow completes the MaggieDash Activity and Navigation
 workspaces and dashboard UI v3 contract. The 0.7.19 workflow adds
 documentation hygiene audits, live URL API contract

package/README.zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.20 init --agent all
+npx @topy-ai/maggie@0.7.22 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,6 +25,11 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
+0.7.22 加入 provider catalogue authority check、field/variant sync report、
+supply/display lifecycle state、site-owned slug proposal、withdrawal ending、
+retirement evidence audit，以及 runtime QA assertion lint。
+0.7.21 增加 localization polish/rewrite 的 operation-specific quality checks、
+deployment readiness evidence 狀態，以及並發 package assembly 保護。
 0.7.20 完成 MaggieDash Activity 與 Navigation workspace，以及 dashboard UI v3
 contract。0.7.19 加入文件 hygiene audit、live URL API contract、schema reader audit、
 dashboard runtime evidence，以及 activity-log 和 managed-navigation contracts。
@@ -38,6 +43,10 @@ MaggieDash 也提供穩定 section identity、可重用 section arrangement、
 section registry、短期 agent content bridge，以及 translation out-of-band write
 後的 restart gate。`maggie doctor` 會比較 install manifest 與磁碟上的實際 skills。
 
+`maggie deployment readiness` 會分開檢查 unit regression、package smoke、host
+browser evidence、rendered canary 與 deployment preflight。缺少必要 adapter 時
+回傳 `inconclusive`，只有五組 evidence 全部通過才回傳 `passed`。
+
 新版 release gates：
 
 ```bash
@@ -70,6 +79,14 @@ maggie service capability-audit --project . \
   --catalogue .maggie/booking/services.json \
   --capabilities-file .maggie/booking/provider-capabilities.json \
   --fixture .maggie/booking/fixtures/provider.json
+
+# Provider catalogue and withdrawal lifecycle review
+maggie service catalogue-check "<provider-location-url>" \
+  --treatment "Lymphatic drainage massage"
+maggie service sync-report --project .
+maggie service retirement-audit --project . \
+  --catalogue .maggie/booking/services.json \
+  --evidence .maggie/booking/retirement-evidence.json
 ```
 
 完整中文說明、19 個 skills 清單和 roadmap：

package/bin/maggie.js

@@ -100,6 +100,9 @@ Usage:
   maggie design status <job-id>
   maggie service import <provider-url> --project PATH
   maggie service sync <provider-url> --project PATH
+  maggie service catalogue-check <provider-url> --treatment NAME
+  maggie service sync-report --project PATH
+  maggie service retirement-audit --project PATH --evidence FILE
   maggie service generate --project PATH
   maggie service capability-audit --project PATH --catalogue FILE --capabilities-file FILE --fixture FILE
   maggie service validate --project PATH
@@ -108,6 +111,7 @@ Usage:
   maggie service convert-page <page-path> --project PATH
   maggie service match-pages --project PATH --pages-dir src/pages
   maggie deployment --project PATH --target vps-with-cloudflare-dns
+  maggie deployment readiness --project PATH
   maggie deployment canary --project PATH --asset URL=SHA256 --render-report report.json --output docs/deployment-canary.json
   maggie migration --project PATH --environment staging
   maggie migration identity --identity-file FILE [--expected-file FILE]
@@ -119,7 +123,7 @@ Usage:
   maggie localization <extract|plan|generate|preview|validate|review|publish|stale|glossary> [options]
   maggie seo performance|images|sitemap|indexnow|social-cards|head-tags [options] (sitemap supports strict validate and agent-files)
   maggie feedback <collect|preview|submit|list> [options]
-  maggie qa <start|record|summary|export> [options]
+  maggie qa <start|record|summary|export|assertion-audit> [options]
   maggie site-audit URL [--crawl] [--access-log FILE] [--require-sitemap-request] [--languages en-GB,es-MX,ja-JP] [--check-hreflang]
   maggie site-audit URL --crawl --save-baseline FILE --reviewer NAME
   maggie site-audit URL --crawl --baseline FILE
@@ -408,6 +412,7 @@ try {
   else if (command === "seo") seo(args);
   else if (command === "ops") workflowCli("maggie_ops.py", args);
   else if (command === "deployment" && args[0] === "canary") workflowCli("maggie_deployment_canary.py", args.slice(1));
+  else if (command === "deployment" && args[0] === "readiness") workflowCli("maggie_deployment_readiness.py", args.slice(1));
   else if (command === "deployment") workflowCli("maggie_deployment.py", args);
   else if (command === "migration") workflowCli("maggie_migration.py", args);
   else if (command === "schedule") workflowCli("maggie_schedule.py", args);

package/bundled-contracts/maggie-deployment/readiness-v1.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://maggie.noblox.app/contracts/deployment-readiness-v1.json",
+  "title": "Maggie deployment readiness evidence summary",
+  "type": "object",
+  "required": ["schemaVersion", "status", "checks"],
+  "properties": {
+    "schemaVersion": {"const": "maggie-deployment-readiness.v1"},
+    "status": {"enum": ["passed", "failed", "inconclusive"]},
+    "checks": {
+      "type": "object",
+      "required": ["unitRegression", "packageSmoke", "browserEvidence", "renderedCanary", "deploymentPreflight"],
+      "additionalProperties": false,
+      "properties": {
+        "unitRegression": {"$ref": "#/$defs/check"},
+        "packageSmoke": {"$ref": "#/$defs/check"},
+        "browserEvidence": {"$ref": "#/$defs/check"},
+        "renderedCanary": {"$ref": "#/$defs/check"},
+        "deploymentPreflight": {"$ref": "#/$defs/check"}
+      }
+    }
+  },
+  "$defs": {
+    "check": {
+      "type": "object",
+      "required": ["state", "configured"],
+      "properties": {
+        "state": {"enum": ["passed", "failed", "inconclusive", "not-configured"]},
+        "configured": {"type": "boolean"},
+        "path": {"type": "string"},
+        "reason": {"type": "string"}
+      },
+      "additionalProperties": true
+    }
+  },
+  "additionalProperties": false
+}

package/bundled-references/content-localization-contract.md

@@ -61,6 +61,15 @@ Supported operations are distinct: `translate`, `polish`, `rewrite`,
 source. A source revision change marks dependent translations stale. Fallback
 content is never indexable.
 
+`polish` and `rewrite` validation includes deterministic output checks. Polish
+must keep the source language, change the copy, preserve protected fact tokens,
+and show a clarity signal (shorter maximum sentence, clearer sentence
+segmentation, placeholder reduction, or explicit quality evidence). Rewrite
+must change the copy and its observable structure, while preserving protected
+fact tokens. These are conservative heuristics, not semantic equivalence
+proof: every result contains `quality.humanReview.required: true` and marks
+semantic equivalence as `not-certified` until a named reviewer approves it.
+
 The following are protected by default: price, currency, rating, provider
 facts, booking URL, legal/health claims, content ID, slug, canonical owner,
 and translation group. Changes require structured approval and evidence.

package/bundled-references/universal-booking-adapter.md

@@ -57,7 +57,7 @@ The stable model is deliberately small and provider-neutral:
 - **category**: `level1` and `level2`; a service may belong to more than one
   provider category through `additional.provider.categories`;
 - **service**: identity, slug, title, description, active/archived status,
-  timestamps, and variants;
+  timestamps, supply/display state, and variants;
 - **variant**: identity, display name, duration, price, currency, discount or
   price range when the provider exposes them;
 - **booking actions**: booking URL, payment URL, and optional action metadata;
@@ -67,6 +67,44 @@ The stable model is deliberately small and provider-neutral:
 - **sync**: source, fetched time, content hash, parser version, and change
   status.
 
+The portable lifecycle model keeps two owners separate:
+
+- `supplyState`: provider sync state, either `live` or `withdrawn`;
+- `displayState`: human publication decision, either `published`, `hidden`, or
+  `retired`.
+
+Sync may change `supplyState` when the provider adds or removes a service, but
+must preserve `displayState`. A withdrawn/published record is an explicit
+interim state: keep the URL answerable, suppress booking and indexing, and
+open a human retirement decision. The legacy `status` field may remain for
+backwards compatibility, but it must not be used as both provider availability
+and display policy.
+
+The `slug` is site-owned. A provider rename may produce a `slugProposal` in a
+sync report, but the stored slug remains unchanged until a person accepts the
+proposal and the host writes the new slug plus its redirect in one transaction.
+
+## Withdrawal and retirement contract
+
+Provider removal is not permission to delete a public route. The adapter keeps
+the record with `supplyState: "withdrawn"` and the host chooses a reviewed
+`retirement.ending`:
+
+| Ending | Required host response | Required safety signals |
+|---|---|---|
+| `pending` | HTTP 200 interim page | unavailable notice, no booking action, `noindex`, absent from sitemap |
+| `redirect` | HTTP 301 or 308 to a different same-site route | no booking action, absent from sitemap |
+| `tombstone` | HTTP 200 unavailable page | unavailable notice, no booking action, `noindex`, absent from sitemap |
+| `gone` | HTTP 410 | no booking action, absent from sitemap |
+
+The host must preserve the old route long enough to apply its chosen ending,
+and must not return a generic 404 as a substitute for the reviewed contract.
+`maggie service retirement-audit` validates sanitized runtime evidence against
+the catalogue and records only service IDs, ending decisions, statuses, and
+safe pass/fail metadata. It does not fetch private routes, store response
+bodies, or invent redirect targets. A person must review redirect destination,
+copy, and accessibility before publication.
+
 The service page must render only canonical fields. `additional` is an
 explicit extension point for provider-specific or future fields and must be
 namespaced by concern (`provider`, `location`, `presentation`, `compliance`,
@@ -74,6 +112,21 @@ namespaced by concern (`provider`, `location`, `presentation`, `compliance`,
 nullable-safe, and must never override canonical fields. Unknown data stays in
 `additional`; it is not guessed into the stable model.
 
+## Source ownership and onboarding precedence
+
+When a host onboarding flow collects a value directly from the merchant, that
+explicit value is authoritative for the project. Provider research, imported
+profiles, search results, and inferred metadata may fill an empty field only;
+they must never replace a non-empty merchant entry. Persist the source of each
+value when the host supports it, and show a conflict for human review when two
+non-empty sources disagree. This rule applies to the website URL as well as
+business name, address, phone, category, and booking-provider identity.
+
+The shared service-booking parser does not implement a host's onboarding UI.
+Adapters must enforce this precedence before passing project identity into
+provider research or sync. A provider URL is evidence about the provider
+catalogue, not permission to overwrite the merchant's website URL.
+
 Pages can also enter the model without a provider. A normal page conversion
 creates a `draft` service with `additional.conversion.sourcePage` and no
 invented price, duration, or booking URL. It becomes `active` only after the
@@ -104,6 +157,14 @@ silent conversion, idempotent add/update/archive synchronisation, source
 snapshots/checksums, import-run audit records and generated service pages with
 provider booking CTAs.
 
+When a provider exposes an authoritative venue-owned catalogue, use that
+adapter extraction for sync decisions and treatment-presence checks. Generic
+JSON-LD, navigation links, and page-wide text can contain marketplace or other
+business entities and are not proof that the connected venue still sells a
+treatment. A read-only catalogue query should call the same parser as import
+and sync so an operator can review a reproducible answer before applying a
+withdrawal.
+
 It must not claim real-time availability, booking creation, cancellation sync
 or webhooks unless an official Fresha partner/API capability is available for
 that account. Public booking links remain the safe fallback. The paid Fresha

package/bundled-skills/maggie-content-localization/SKILL.md

@@ -14,9 +14,12 @@ metadata:
 changes; translate and polish preserve meaning; localise enables market
 adaptation. A host generation adapter or the authoring agent must apply these
 instructions when producing copy. Planning does not invoke a model or generate
-translations. Validation currently checks mode consistency and rewrite
-permission, not whether prose was actually restructured. Review the produced
-copy against the requested operation before approval.
+translations. Validation now applies deterministic operation-specific checks to
+polish and rewrite outputs: source/output text must be present, protected fact
+tokens must remain unchanged, polish must show a clarity signal, and rewrite
+must change observable structure. These checks are conservative heuristics,
+not semantic equivalence proof. Every result requires named human review and
+reports `semanticEquivalence: not-certified` until approval.
 
 ### Resumable draft generation
 

package/bundled-skills/maggie-deployment/SKILL.md

@@ -37,6 +37,31 @@ visitor-facing files. The canary must include screenshots, zero console or
 network errors, and zero placeholder matches. Query-driven routes belong in
 behavior/API checks, not static byte baselines.
 
+## Release readiness evidence
+
+Unit regression is necessary but does not prove runtime release readiness. The
+readiness command keeps five evidence slots separate: dependency-free unit
+regression, package smoke, host browser evidence, rendered canary, and
+deployment preflight:
+
+```bash
+python3 tools/tests/run_regression.py \
+  --report .maggie/verification/unit-regression.json
+maggie deployment readiness --project . \
+  --package-report .maggie/verification/package-smoke.json \
+  --browser-report .maggie/verification/browser-evidence.json \
+  --rendered-canary .maggie/deployment-canary.json \
+  --deployment-preflight .maggie/release-preflight.json \
+  --output .maggie/deployment-readiness.json
+```
+
+The report follows `maggie-deployment-readiness.v1`. A failed evidence file
+returns `failed`; a missing or unavailable host/browser adapter returns
+`inconclusive`; only five passing evidence slots return `passed`. Maggie does
+not fabricate browser, rendered, or deployment evidence and does not deploy
+from this command. See
+[`readiness-v1.schema.json`](../../bundled-contracts/maggie-deployment/readiness-v1.schema.json).
+
 ## Automatic memory hook
 
 Follow [Maggie Memory Hook](../../references/memory-hook.md) at invocation and completion.

package/bundled-skills/maggie-qa-workflow/SKILL.md

@@ -74,6 +74,26 @@ the host browser adapter. The adapter owns console, network, authentication,
 URL, viewport, and screenshot capture; this skill stores only a relative path,
 URL reference, and hash when a local file exists.
 
+## Assert the requirement at runtime
+
+Do not use a source class, edited markup fragment, or implementation detail as
+the proof of a user-facing requirement. Describe runtime assertions in a
+project-local manifest and lint it before recording a passing scenario:
+
+```bash
+maggie qa assertion-audit --project . \
+  --assertions .maggie/qa-assertions.json \
+  --output docs/qa-assertion-audit.json
+```
+
+The `maggie.qa-assertions.v1` manifest requires a route, `transport: "http"`,
+HTTP status evidence, a screenshot/reference, and boolean results for runtime
+checks such as `text-present`, `text-absent`, `meta`, `link-absent`, or
+`redirect`. Source/class/markup-only checks are rejected. The audit stores
+assertion IDs and safe pass/fail metadata, never response bodies, credentials,
+or cookies. A passing assertion audit complements browser evidence; it does
+not replace the host adapter's actual HTTP and screenshot capture.
+
 ## Gate and release evidence
 
 The run gate is `fail` when any scenario fails, `blocked` when there is no

package/bundled-skills/maggie-service-booking/SKILL.md

@@ -2,7 +2,7 @@
 name: maggie-service-booking
 description: Import, synchronise, validate, and design SPA service pages from a booking provider such as Fresha. Use for service catalogues, treatment variants, prices, durations, booking links, payment links, and booking-aware page generation.
 metadata:
-  version: 1.1.0
+  version: 1.2.0
 ---
 
 # Maggie Service Booking
@@ -49,6 +49,13 @@ passed the provider capability check. A project without Fresha may use Google
 Calendar as a simple fallback, but it must be recorded as a separate
 BookingProvider.
 
+If onboarding also asks the merchant for a website or business identity, the
+merchant's non-empty answer owns that field. Imported provider/profile/search
+values are fallback evidence for empty fields only; a disagreement must become
+a visible review item, never a silent replacement. This skill does not own the
+host onboarding UI, so enforce the rule in the host adapter before starting
+provider research.
+
 ## CLI workflow
 
 Run from the project root:
@@ -62,6 +69,8 @@ python3 tools/clis/maggie_service_booking.py sync \
   "https://www.fresha.com/a/spa-chevy-chase-chevy-chase-4500-north-park-avenue-sbic60h4?pId=512061" \
   --project .
 
+python3 tools/clis/maggie_service_booking.py sync-report --project .
+
 python3 tools/clis/maggie_service_booking.py generate --project . --copy-data docs/service-page-copy.json
 python3 tools/clis/maggie_service_booking.py validate --project .
 
@@ -116,17 +125,40 @@ python3 tools/clis/maggie_service_booking.py capability-audit \
   --catalogue .maggie/booking/services.json \
   --capabilities-file .maggie/booking/provider-capabilities.json \
   --fixture .maggie/booking/fixtures/provider.json
+
+# Answer whether provider-owned treatments are present using the same parser
+# as import/sync; do not search the whole provider page for a name.
+python3 tools/clis/maggie_service_booking.py catalogue-check \
+  "https://www.fresha.com/a/your-location" \
+  --provider fresha --treatment "Lymphatic drainage massage"
+
+python3 tools/clis/maggie_service_booking.py retirement-audit \
+  --project . \
+  --catalogue .maggie/booking/services.json \
+  --evidence .maggie/booking/retirement-evidence.json
 ```
 
 `import` creates the first catalogue. `sync` compares the newly imported
 catalogue with the previous snapshot and records `added`, `updated`,
-`removed`, and `unchanged` services. Removed services are archived in the
-manifest before any page is deleted. `generate` is retained as a compatibility
+`removed`, and `unchanged` services. Updated records include field-level
+before/after values, variant-level changes, and any pending slug proposal.
+`sync-report` is read-only and loads a saved `maggie-service-sync-report.v1`
+artifact for review. Removed services are archived in the manifest before any
+page is deleted. `generate` is retained as a compatibility
 guard and refuses to author public copy. The AI agent and the MaggieDash renderer
 must consume an approved copy artifact instead. `run` executes parse → persist
 → validate, then stops before public generation until an AI-authored copy
 artifact and editorial review are present; it records `.maggie/booking/job.json`.
 `inspect` is read-only and `status` reports the latest job state.
+`catalogue-check` is read-only and answers one or more treatment-presence
+questions from the same provider-owned extraction used by `import` and `sync`.
+It does not use arbitrary page links or marketplace JSON-LD as evidence when
+the provider exposes an authoritative embedded catalogue.
+`retirement-audit` is also read-only. It consumes a sanitized host-browser/HTTP
+evidence artifact and validates the selected ending (`pending`, `redirect`,
+`tombstone`, or `gone`), HTTP status, booking suppression, unavailable/noindex
+signals, and sitemap exclusion. It never stores response bodies or decides a
+redirect destination for the host.
 `convert-page` imports a normal page as a draft service without inventing
 booking facts. `match-pages` reads filesystem pages plus `docs/pages.json` and
 `docs/page-content.json`, writes candidate evidence to both `.maggie/booking`
@@ -220,6 +252,19 @@ Every active service must have:
 - a booking URL, and a payment URL only when explicitly supplied;
 - provider, source URL, `firstSeenAt`, `lastSeenAt`, and sync status.
 
+The portable catalogue also carries `supplyState` (`live` or `withdrawn`) and
+`displayState` (`published`, `hidden`, or `retired`). The sync owns only
+`supplyState`; it must preserve a person's `displayState` and must not silently
+republish a hidden or retired service. Keep legacy `status` only for
+compatibility, never as both meanings at once.
+
+Withdrawn services remain available for an explicit retirement decision. Set
+`retirement.ending` to `pending` while a host still serves a safe interim
+response, or to an approved `redirect`, `tombstone`, or `gone` ending. A
+withdrawn route must suppress booking and sitemap inclusion; the host owns the
+actual route/HTTP implementation and supplies sanitized evidence to
+`retirement-audit` before release.
+
 The canonical shape is documented in
 [`references/universal-booking-adapter.md`](../../references/universal-booking-adapter.md).
 Do not invent prices, availability, practitioner claims, ratings, medical