@treeseed/sdk 0.11.0 → 0.12.5

package/dist/workflow/operations.js

@@ -1,6 +1,15 @@
 import { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
+import {
+  compileTreeseedDesiredResourceGraph,
+  compileTreeseedDesiredUnitsFromGraph
+} from "../platform/desired-state.js";
+import {
+  collectTreeseedReconcileStatus,
+  planTreeseedReconciliation,
+  reconcileTreeseedTarget
+} from "../reconcile/index.js";
 import {
   applyTreeseedEnvironmentToProcess,
   applyTreeseedConfigValues,
@@ -8,6 +17,7 @@ import {
   assertTreeseedCommandEnvironment,
   checkTreeseedProviderConnections,
   collectTreeseedConfigContext,
+  collectTreeseedConfigSeedValues,
   collectTreeseedPrintEnvReport,
   ensureTreeseedSecretSessionForConfig,
   ensureTreeseedActVerificationTooling,
@@ -24,23 +34,18 @@ import {
   setTreeseedRemoteSession,
   writeTreeseedMachineConfig
 } from "../operations/services/config-runtime.js";
-import { collectTreeseedToolStatus, formatTreeseedDependencyFailureDetails, installTreeseedDependencies } from "../managed-dependencies.js";
+import { formatTreeseedDependencyFailureDetails, installTreeseedDependencies } from "../managed-dependencies.js";
 import { ControlPlaneClient } from "../control-plane-client.js";
 import { exportTreeseedCodebase } from "../operations/services/export-runtime.js";
 import {
-  assertDeploymentInitialized,
   buildProvisioningSummary,
   cleanupDestroyedState,
   createBranchPreviewDeployTarget,
   createPersistentDeployTarget,
-  destroyCloudflareResources,
   destroyTreeseedEnvironmentResources,
-  ensureGeneratedWranglerConfig,
-  finalizeDeploymentState,
   loadDeployState,
   recordHostedDeploymentState,
-  runRemoteD1Migrations,
-  validateDeployPrerequisites,
+  resolveConfiguredSurfaceDomain,
   validateDestroyPrerequisites
 } from "../operations/services/deploy.js";
 import {
@@ -49,7 +54,6 @@ import {
   assertFeatureBranch,
   branchExists,
   checkoutBranch,
-  checkoutDetachedOriginBranch,
   checkoutTaskBranchFromStaging,
   createDeprecatedTaskTag,
   deleteLocalBranch,
@@ -58,36 +62,36 @@ import {
   gitWorkflowRoot,
   headCommit,
   listTaskBranches,
-  mergeBranchIntoTarget,
-  prepareReleaseBranches,
+  mergeBranchDownIntoFeature,
   PRODUCTION_BRANCH,
+  promoteCommitToBranchWithExpectedHead,
   pushBranch,
-  pushHeadToBranch,
   reattachDetachedHeadIfSafe,
+  remoteHeadCommit,
   remoteBranchExists,
   STAGING_BRANCH,
-  squashMergeBranchIntoStaging,
-  syncBranchWithOrigin
+  syncBranchWithOrigin,
+  waitForStagingAutomation
 } from "../operations/services/git-workflow.js";
 import { resolveGitHubRepositorySlug } from "../operations/services/github-automation.js";
 import { resolveGitHubCredentialForRepository } from "../operations/services/github-credentials.js";
-import { dispatchGitHubWorkflowRun } from "../operations/services/github-api.js";
 import {
   formatGitHubActionsGateFailure,
   inspectGitHubActionsVerification,
   skippedGitHubActionsGate,
   waitForGitHubActionsGate
 } from "../operations/services/github-actions-verification.js";
-import {
-  runReleaseCandidateGate
-} from "../operations/services/release-candidate.js";
+import { cleanProofLedger } from "../operations/services/release-proof-ledger.js";
+import { buildTreeseedProofPlan, hostedWorkflowForPackage, summarizeTreeseedProofLedger } from "../operations/services/release-proof-planner.js";
+import { runTreeseedProof } from "../operations/services/release-proof-runner.js";
+import { createTreeseedWorkflowTimer } from "../operations/services/workflow-timing.js";
 import {
   collectReleaseHistoryCommits,
   renderAdministrativeCommitMessage,
   upsertReleaseChangelog
 } from "../operations/services/release-history.js";
-import { loadCliDeployConfig, packageScriptPath, resolveWranglerBin } from "../operations/services/runtime-tools.js";
-import { runTenantDeployPreflight, runWorkspaceReleasePreflight, runWorkspaceSavePreflight } from "../operations/services/save-deploy-preflight.js";
+import { packageScriptPath } from "../operations/services/runtime-tools.js";
+import { loadTreeseedPlatformConfig } from "../platform/config.js";
 import { collectCliPreflight } from "../operations/services/workspace-preflight.js";
 import {
   collectMergeConflictReport,
@@ -104,20 +108,14 @@ import {
 } from "../operations/services/workspace-save.js";
 import {
   planRepositorySave,
-  refreshAndValidateRootWorkspaceLockfileForSave,
   repositorySaveErrorDetails,
   runRepositorySaveOrchestrator
 } from "../operations/services/repository-save-orchestrator.js";
 import { discoverTreeseedPackageAdapters } from "../operations/services/package-adapters.js";
 import {
-  assertNoInternalDevReferences,
-  cleanupStaleTreeseedDevTags,
-  collectTreeseedDevTagCleanupPlan,
   collectInternalDevReferenceIssues,
-  devTagFromDependencySpec,
   installableInternalDependencyVersions,
-  normalizeGitRemoteForManifest,
-  rewriteProjectInternalDependenciesToStableVersions
+  normalizeGitRemoteForManifest
 } from "../operations/services/package-reference-policy.js";
 import {
   ensureLocalWorkspaceLinks,
@@ -125,7 +123,6 @@ import {
   unlinkLocalWorkspaceLinks
 } from "../operations/services/workspace-dependency-mode.js";
 import {
-  hasCompleteTreeseedPackageCheckout,
   changedWorkspacePackages,
   publishableWorkspacePackages,
   run,
@@ -133,13 +130,13 @@ import {
   workspacePackages,
   workspaceRoot
 } from "../operations/services/workspace-tools.js";
-import { runTreeseedHostingAudit } from "../operations/services/hosting-audit.js";
-import { collectTreeseedHostedServiceChecks } from "../operations/services/hosted-service-checks.js";
+import { classifyTreeseedGitMode, runTreeseedGit, runTreeseedGitOk, runTreeseedGitText } from "../operations/services/git-runner.js";
 import { collectTreeseedDeploymentReadiness } from "../operations/services/deployment-readiness.js";
 import { collectTreeseedLiveHostedServiceChecks } from "../operations/services/live-hosted-service-checks.js";
 import { discoverTreeseedApplications } from "../hosting/apps.js";
+import { compileTreeseedHostingGraph } from "../hosting/graph.js";
 import { resolveTreeseedWorkflowState } from "../workflow-state.js";
-import { createTreeseedReconcileRegistry, deriveTreeseedDesiredUnits, filterTreeseedDesiredUnitsByBootstrapSystems, planTreeseedReconciliation, resolveTreeseedBootstrapSelection, reconcileTreeseedTarget } from "../reconcile/index.js";
+import { createTreeseedReconcileRegistry, deriveTreeseedDesiredUnits, destroyTreeseedTargetUnits, filterTreeseedDesiredUnitsByBootstrapSystems, resolveTreeseedBootstrapSelection } from "../reconcile/index.js";
 import {
   acquireWorkflowLock,
   archiveWorkflowRun,
@@ -161,6 +158,7 @@ import {
   checkedOutWorkspacePackageRepos,
   resolveTreeseedWorkflowSession
 } from "./session.js";
+import { checkedOutManagedWorkflowRepos } from "../operations/services/managed-repositories.js";
 import {
   classifyTreeseedBranchRole,
   resolveTreeseedWorkflowPaths
@@ -192,6 +190,14 @@ function defaultWrite(output, stream = "stdout") {
   (stream === "stderr" ? process.stderr : process.stdout).write(`${output}
 `);
 }
+function runGit(args, options) {
+  return runTreeseedGitText(args, {
+    cwd: options.cwd,
+    mode: classifyTreeseedGitMode(args),
+    timeoutMs: options.timeoutMs,
+    maxBuffer: options.maxBuffer
+  });
+}
 function shouldManageWorkspaceLinks(mode, env = process.env) {
   if (mode === "off") return false;
   const envMode = String(env?.TREESEED_WORKSPACE_LINKS ?? "auto").trim().toLowerCase();
@@ -223,7 +229,7 @@ function ensureWorkflowWorkspacePackageArtifacts(root, helpers) {
   const packages = [
     { name: "@treeseed/sdk", dir: "packages/sdk", artifacts: ["dist/workflow-support.js", "dist/plugin-default.js", "dist/platform/env.yaml"] },
     { name: "@treeseed/ui", dir: "packages/ui", artifacts: ["dist/index.js"] },
-    { name: "@treeseed/agent", dir: "packages/agent", artifacts: ["dist/api/index.js", "dist/services/worker.js"] },
+    { name: "@treeseed/agent", dir: "packages/agent", artifacts: ["dist/api/index.js", "dist/services/manager.js", "dist/provider/runner.js"] },
     { name: "@treeseed/core", dir: "packages/core", artifacts: ["dist/plugin-default.js"] },
     { name: "@treeseed/admin", dir: "packages/admin", artifacts: ["dist/plugin.js"] },
     { name: "@treeseed/cli", dir: "packages/cli", artifacts: ["dist/cli/main.js"] }
@@ -267,7 +273,7 @@ function ensureWorkflowCommandBins(root, helpers) {
   }
 }
 function unresolvedMergePaths(repoDir) {
-  return run("git", ["diff", "--name-only", "--diff-filter=U"], { cwd: repoDir, capture: true }).split("\n").map((line) => line.trim()).filter(Boolean);
+  return runGit(["diff", "--name-only", "--diff-filter=U"], { cwd: repoDir, capture: true }).split("\n").map((line) => line.trim()).filter(Boolean);
 }
 function resolveRootReleaseSubmoduleConflicts(root, selectedPackageNames) {
   const gitRoot = repoRoot(root);
@@ -288,7 +294,7 @@ function resolveRootReleaseSubmoduleConflicts(root, selectedPackageNames) {
   const entries = [];
   for (const pkg of packages) {
     syncBranchWithOrigin(pkg.dir, PRODUCTION_BRANCH);
-    run("git", ["add", pkg.repoPath], { cwd: gitRoot });
+    runGit(["add", pkg.repoPath], { cwd: gitRoot });
     entries.push({
       packageName: pkg.name,
       path: pkg.repoPath,
@@ -323,7 +329,7 @@ function normalizeSaveLane(lane) {
 }
 function normalizeSaveCiMode(mode, branch, lane = "fast") {
   if (mode === "hosted" || mode === "off") return mode;
-  if (lane === "promotion") return branch === STAGING_BRANCH ? "hosted" : "off";
+  if (lane === "promotion") return branch === STAGING_BRANCH || branch === PRODUCTION_BRANCH ? "hosted" : "off";
   return "off";
 }
 function normalizeSaveVerifyMode(mode) {
@@ -377,35 +383,27 @@ function helpersForCwd(helpers, cwd) {
 function shouldDispatchSwitchToManagedWorktree(root, input, env) {
   return !isManagedWorkflowWorktree(root) && effectiveWorkflowWorktreeMode(input.worktreeMode, env) === "on";
 }
-function assertHostedGitHubWorkflowAuthReady(operation, root) {
-  const tools = collectTreeseedToolStatus({
-    tenantRoot: root,
-    env: process.env
-  });
-  const github = tools.auth.github;
-  if (!github.authenticated) {
-    const command = github.command.length > 0 ? github.command.join(" ") : "npx trsd tools --json";
-    workflowError(
-      operation,
-      "github_auth_unavailable",
-      [
-        "Treeseed hosted GitHub workflow gates require an authenticated managed GitHub CLI.",
-        github.detail,
-        `Managed gh check: ${command}`,
-        "Remediation:",
-        ...github.remediation.map((item) => `- ${item}`)
-      ].join("\n"),
-      {
-        details: {
-          toolsHome: tools.toolsHome,
-          ghConfigDir: tools.ghConfigDir,
-          github,
-          tools: tools.tools
-        }
-      }
-    );
+function assertHostedGitHubWorkflowCredentialsReady(operation, root, gates) {
+  const missing = [];
+  for (const gate of gates) {
+    const repository = gate.repository ?? resolveGitHubRepositorySlug(gate.repoPath);
+    const scope = gate.branch === PRODUCTION_BRANCH ? "prod" : "staging";
+    const values = resolveTreeseedMachineEnvironmentValues(root, scope);
+    const credential = resolveGitHubCredentialForRepository(repository, { values, env: process.env });
+    if (!credential.token) {
+      missing.push({ name: gate.name, repository: credential.repository, envName: credential.envName });
+    }
   }
-  return tools;
+  if (missing.length === 0) return;
+  workflowError(
+    operation,
+    "github_auth_unavailable",
+    [
+      "Treeseed hosted GitHub workflow gates require Treeseed-prefixed GitHub credentials.",
+      ...missing.map((gate) => `- ${gate.name}: configure ${gate.envName} for ${gate.repository}, or TREESEED_GITHUB_TOKEN as a fallback.`)
+    ].join("\n"),
+    { details: { missing } }
+  );
 }
 async function waitForWorkflowGates(operation, gates, ciMode, options = {}) {
   if (ciMode === "off" || process.env.TREESEED_STAGE_WAIT_MODE === "skip") {
@@ -414,42 +412,49 @@ async function waitForWorkflowGates(operation, gates, ciMode, options = {}) {
   if (gates.length === 0) {
     return [];
   }
-  assertHostedGitHubWorkflowAuthReady(operation, options.root ?? gates[0].repoPath);
+  if (operation === "save" && gates.every((gate) => !gate.repository && githubRepositoryForRepo(gate.repoPath) == null)) {
+    return gates.map((gate) => skippedGitHubActionsGate(gate, "non-github-repository"));
+  }
+  assertHostedGitHubWorkflowCredentialsReady(operation, options.root ?? gates[0].repoPath, gates);
   const results = [];
   for (const gate of gates) {
+    const gateWithTimeout = {
+      ...gate,
+      timeoutSeconds: gate.timeoutSeconds ?? HOSTED_WORKFLOW_GATE_TIMEOUT_SECONDS
+    };
     if (options.root && options.runId) {
       const cached = getCachedSuccessfulWorkflowGate(options.root, options.runId, {
-        repository: gate.repository ?? null,
-        workflow: gate.workflow,
-        headSha: gate.headSha,
-        branch: gate.branch
+        repository: gateWithTimeout.repository ?? null,
+        workflow: gateWithTimeout.workflow,
+        headSha: gateWithTimeout.headSha,
+        branch: gateWithTimeout.branch
       });
       if (cached) {
         results.push({
           ...cached.result,
-          name: gate.name,
+          name: gateWithTimeout.name,
           cached: true
         });
         continue;
       }
     }
-    const result = await waitForGitHubActionsGate(gate, {
+    const result = await waitForGitHubActionsGate(gateWithTimeout, {
       operation,
-      env: githubWorkflowGateEnv(options.root, gate),
+      env: githubWorkflowGateEnv(options.root, gateWithTimeout),
       onProgress: options.onProgress
     });
     const normalized = {
-      name: gate.name,
+      name: gateWithTimeout.name,
       ...result,
-      workflow: String(result.workflow ?? gate.workflow),
-      branch: String(result.branch ?? gate.branch),
-      headSha: String(result.headSha ?? gate.headSha),
-      timeoutSeconds: gate.timeoutSeconds ?? null,
+      workflow: String(result.workflow ?? gateWithTimeout.workflow),
+      branch: String(result.branch ?? gateWithTimeout.branch),
+      headSha: String(result.headSha ?? gateWithTimeout.headSha),
+      timeoutSeconds: gateWithTimeout.timeoutSeconds,
       cached: false
     };
     if (normalized.status === "completed" && normalized.conclusion !== "success") {
-      workflowError(operation, "github_workflow_failed", formatGitHubActionsGateFailure(gate, normalized), {
-        details: { gate, workflow: normalized }
+      workflowError(operation, "github_workflow_failed", formatGitHubActionsGateFailure(gateWithTimeout, normalized), {
+        details: { gate: gateWithTimeout, workflow: normalized }
       });
     }
     if (options.root && options.runId && normalized.status === "completed" && normalized.conclusion === "success") {
@@ -469,6 +474,7 @@ function githubWorkflowGateEnv(root, gate) {
     if (!credential.token) return process.env;
     return {
       ...process.env,
+      TREESEED_GITHUB_TOKEN: credential.token,
       GH_TOKEN: credential.token,
       GITHUB_TOKEN: credential.token
     };
@@ -477,12 +483,127 @@ function githubWorkflowGateEnv(root, gate) {
   }
 }
 const HOSTED_DEPLOY_GATE_TIMEOUT_SECONDS = 45 * 60;
+const HOSTED_WORKFLOW_GATE_TIMEOUT_SECONDS = 45 * 60;
 function hostedDeployGate(gate) {
   return {
     ...gate,
     timeoutSeconds: gate.timeoutSeconds ?? HOSTED_DEPLOY_GATE_TIMEOUT_SECONDS
   };
 }
+function saveHostedEnvironmentForBranch(branch) {
+  if (branch === STAGING_BRANCH) return "staging";
+  if (branch === PRODUCTION_BRANCH) return "prod";
+  return null;
+}
+function selectorFromWorkflowHostingGraph(graph) {
+  const includesApi = graph.units.some((unit) => unit.id === "api" || unit.config.serviceName === "treeseed-api");
+  const scope = graph.environment;
+  const target = createPersistentDeployTarget(scope);
+  const webDomain = resolveConfiguredSurfaceDomain(graph.deployConfig, target, "web");
+  const apiDomain = resolveConfiguredSurfaceDomain(graph.deployConfig, target, "api");
+  const domainServiceIds = [
+    webDomain,
+    webDomain ? `web:${webDomain}` : null,
+    apiDomain,
+    apiDomain ? `api:${apiDomain}` : null
+  ];
+  return {
+    host: [...new Set([
+      ...graph.units.map((unit) => unit.host.id),
+      ...includesApi ? ["cloudflare-dns"] : []
+    ].filter((hostId) => hostId !== "smtp" && hostId !== "local-process" && hostId !== "local-docker"))],
+    serviceId: [...new Set(graph.units.flatMap((unit) => [
+      unit.id,
+      typeof unit.config.serviceName === "string" ? unit.config.serviceName : null
+    ]).concat(domainServiceIds).filter((value) => Boolean(value)))],
+    serviceType: [...new Set(graph.units.flatMap((unit) => {
+      if (unit.id === "api") return ["api-runtime", "railway-service:api", "custom-domain:api", "dns-record"];
+      if (unit.id === "operationsRunner") return ["operations-runner-runtime", "railway-service:operations-runner"];
+      if (unit.placement === "runner-capacity") return ["api-runtime", "operations-runner-runtime", "railway-service:api", "railway-service:operations-runner"];
+      if (unit.host.id === "cloudflare") return ["web-ui", "edge-worker", "content-store", "database", "kv-form-guard", "turnstile-widget", "pages-project", "custom-domain:web", "dns-record"];
+      return [];
+    }))]
+  };
+}
+async function reconcileSaveHostedEnvironment(root, environment, helpers, workflowRunId) {
+  const graph = compileTreeseedHostingGraph({ tenantRoot: root, environment });
+  const selector = selectorFromWorkflowHostingGraph(graph);
+  if (process.env.TREESEED_WORKFLOW_HOSTED_RECONCILE_MODE === "skip") {
+    return {
+      status: "skipped",
+      reason: "disabled",
+      environment,
+      selectedApps: [...new Set(graph.units.map((unit) => unit.application?.id).filter((value) => Boolean(value)))],
+      selectedResources: graph.units.map((unit) => ({
+        id: unit.id,
+        host: unit.host.id,
+        serviceType: unit.serviceType.id,
+        placement: unit.placement,
+        serviceName: typeof unit.config.serviceName === "string" ? unit.config.serviceName : null
+      }))
+    };
+  }
+  const target = createPersistentDeployTarget(environment);
+  const env = {
+    ...helpers.context.env,
+    ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
+  };
+  helpers.write(`[save][workflow] Reconciling ${environment} hosted deployments for ${graph.units.length} selected resources.`);
+  const reconcile = await reconcileTreeseedTarget({
+    tenantRoot: root,
+    target,
+    env,
+    selector,
+    dryRun: false,
+    write: (line) => helpers.write(`[save][reconcile] ${line}`, "stderr"),
+    session: /* @__PURE__ */ new Map([["workflowRunId", workflowRunId]])
+  });
+  const status = await collectTreeseedReconcileStatus({
+    tenantRoot: root,
+    target,
+    env,
+    selector
+  });
+  if (!status.ready) {
+    workflowError("save", "hosted_reconcile_failed", `Hosted reconciliation for ${environment} did not verify:
+${status.blockers.join("\n")}`, {
+      details: { environment, selector, status, reconcile }
+    });
+  }
+  const live = await collectTreeseedLiveHostedServiceChecks({
+    tenantRoot: root,
+    target: environment,
+    strict: true,
+    requireLiveRailway: true,
+    requireLiveHttp: true,
+    env
+  });
+  const liveFailures = [
+    ...live.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.issues.join("; ") || "failed"}`),
+    ...live.liveObservation.issues
+  ];
+  if (liveFailures.length > 0) {
+    workflowError("save", "hosted_live_verification_failed", `Hosted live verification for ${environment} failed:
+${liveFailures.join("\n")}`, {
+      details: { environment, selector, live, reconcile }
+    });
+  }
+  return {
+    status: "reconciled",
+    environment,
+    selectedApps: [...new Set(graph.units.map((unit) => unit.application?.id).filter((value) => Boolean(value)))],
+    selectedResources: graph.units.map((unit) => ({
+      id: unit.id,
+      host: unit.host.id,
+      serviceType: unit.serviceType.id,
+      placement: unit.placement,
+      serviceName: typeof unit.config.serviceName === "string" ? unit.config.serviceName : null
+    })),
+    reconcile,
+    postApplyStatus: status,
+    liveVerification: live
+  };
+}
 function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGates) {
   const gates = Array.isArray(workflowGates) ? workflowGates.map((gate) => stringRecord(gate)).filter((gate) => Boolean(gate)) : [];
   const releaseRecord = stringRecord(rootRelease) ?? {};
@@ -548,6 +669,22 @@ ${missing.map((check) => `${check.id}: ${check.path}`).join("\n")}`, {
   }
   return report;
 }
+function ensureTreeseedLocalStateExcluded(root) {
+  const gitDir = runTreeseedGit(["rev-parse", "--git-dir"], { cwd: root, mode: "read", allowFailure: true }).stdout.trim();
+  if (!gitDir) return;
+  const excludePath = resolve(root, gitDir, "info", "exclude");
+  const current = existsSync(excludePath) ? readFileSync(excludePath, "utf8") : "";
+  const requiredEntries = ["/.treeseed/config/", "/.treeseed/workflow/", "/.treeseed/state/", "/.treeseed/workspace-links.json"];
+  const missing = requiredEntries.filter((entry) => !current.split(/\r?\n/u).includes(entry));
+  if (missing.length === 0) return;
+  mkdirSync(dirname(excludePath), { recursive: true });
+  writeFileSync(
+    excludePath,
+    `${current}${current.endsWith("\n") || current.length === 0 ? "" : "\n"}${missing.join("\n")}
+`,
+    "utf8"
+  );
+}
 function workflowError(operation, code, message, options = {}) {
   throw new TreeseedWorkflowError(operation, code, message, options);
 }
@@ -650,6 +787,9 @@ function createWorkspaceRootRepoReport(root) {
 function createWorkspacePackageReports(root) {
   return checkedOutWorkspacePackageRepos(root).map((pkg) => createRepoReport(pkg.name, pkg.dir, currentBranch(pkg.dir) || null, hasMeaningfulChanges(pkg.dir)));
 }
+function createManagedWorkflowRepoReports(root) {
+  return checkedOutManagedWorkflowRepos(root).map((repo) => createRepoReport(repo.name, repo.dir, currentBranch(repo.dir) || null, hasMeaningfulChanges(repo.dir)));
+}
 function findReportByName(reports, name) {
   return reports.find((report) => report.name === name) ?? null;
 }
@@ -657,15 +797,20 @@ function findReportByPath(reports, path) {
   return reports.find((report) => report.path === path) ?? null;
 }
 function assertWorkspaceClean(root) {
-  const repoDirs = [repoRoot(root), ...checkedOutWorkspacePackageRepos(root).map((pkg) => pkg.dir)];
+  const repoDirs = [repoRoot(root), ...checkedOutManagedWorkflowRepos(root).map((repo) => repo.dir)];
   assertCleanWorktrees(repoDirs);
   return repoDirs;
 }
 function buildWorkflowResult(operation, cwd, payload, options = {}) {
+  const timing = options.timing ?? createTreeseedWorkflowTimer().finish();
   const resolvedPayload = options.includeFinalState ?? true ? {
     ...payload,
+    timing,
     finalState: resolveWorkflowStateSnapshot(cwd)
-  } : payload;
+  } : {
+    ...payload,
+    timing
+  };
   return {
     schemaVersion: 1,
     kind: "treeseed.workflow.result",
@@ -756,7 +901,7 @@ function selectWorkflowApplications(root, input = {}) {
 function singleSelectedWorkflowAppId(selection) {
   return selection.selected.length === 1 ? selection.selected[0] : void 0;
 }
-async function runWorkflowHostedResourceVerification(operation, root, helpers, environment, options = { enabled: true }) {
+async function workflowHostedVerificationGateRequired(operation, root, helpers, environment, options = { enabled: true }) {
   if (!options.enabled) return null;
   const target = environment === "prod" ? "prod" : environment === "local" ? "local" : "staging";
   const readiness = collectTreeseedDeploymentReadiness({
@@ -771,53 +916,20 @@ ${failures.join("\n")}`, {
       details: { readiness }
     });
   }
-  const hostingAudit = await runTreeseedHostingAudit({
-    tenantRoot: root,
-    environment,
-    repair: false,
-    hostKinds: options.appId === "api" ? ["repository"] : void 0,
-    env: helpers.context.env,
-    write: (line) => helpers.write(line)
-  });
-  const hostedServices = options.live ? await collectTreeseedLiveHostedServiceChecks({
-    tenantRoot: root,
-    target,
-    strict: options.strict === true,
-    requireLiveRailway: options.strict === true,
-    requireLiveHttp: options.strict === true,
-    appId: options.appId,
-    retry: { attempts: 12, intervalMs: 1e4 },
-    env: helpers.context.env
-  }) : collectTreeseedHostedServiceChecks({
-    tenantRoot: root,
-    target,
-    appId: options.appId
+  workflowError(operation, "validation_failed", `Hosted live verification for ${target} is reconciler-owned. Use stage/release release-gate:hosted-reconcile and release-gate:live-verify resources, or run trsd reconcile verify with a hosted selector.`, {
+    details: {
+      readiness,
+      live: options.live === true,
+      appId: options.appId ?? null
+    }
   });
-  if (options.strict && !hostingAudit.ok) {
-    workflowError(operation, "validation_failed", `Hosting audit failed for ${hostingAudit.environment}: ${hostingAudit.blockers.join("\n")}`, {
-      details: { hostingAudit, hostedServices, readiness }
-    });
-  }
-  if (options.strict && hostedServices.summary.failed > 0) {
-    const failures = hostedServices.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.issues.join("; ") || check.description}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`);
-    workflowError(operation, "validation_failed", `Hosted service checks failed for ${hostedServices.target}:
-${failures.join("\n")}`, {
-      details: { hostingAudit, hostedServices, readiness }
-    });
-  }
-  return {
-    hostingAudit,
-    hostedServices,
-    readiness,
-    live: options.live === true
-  };
 }
 function normalizeExecutionMode(input) {
   return input?.plan === true || input?.dryRun === true ? "plan" : "execute";
 }
 function submodulePointerForRef(repoDir, ref, relativeDir) {
   try {
-    const output = run("git", ["ls-tree", ref, relativeDir], { cwd: repoDir, capture: true }).trim();
+    const output = runGit(["ls-tree", ref, relativeDir], { cwd: repoDir, capture: true }).trim();
     if (!output) {
       return null;
     }
@@ -905,13 +1017,13 @@ function stablePackageGitReferences(root, versions) {
 }
 function gitObjectCommit(repoDir, ref) {
   try {
-    return run("git", ["rev-list", "-n", "1", ref], { cwd: repoDir, capture: true }).trim() || null;
+    return runGit(["rev-list", "-n", "1", ref], { cwd: repoDir, capture: true }).trim() || null;
   } catch {
     return null;
   }
 }
 function remoteTagCommit(repoDir, tagName) {
-  const output = run("git", ["ls-remote", "origin", `refs/tags/${tagName}`, `refs/tags/${tagName}^{}`], { cwd: repoDir, capture: true }).trim();
+  const output = runGit(["ls-remote", "origin", `refs/tags/${tagName}`, `refs/tags/${tagName}^{}`], { cwd: repoDir, capture: true }).trim();
   if (!output) return null;
   const peeled = output.split("\n").find((line) => line.endsWith(`refs/tags/${tagName}^{}`));
   const direct = output.split("\n").find((line) => line.endsWith(`refs/tags/${tagName}`));
@@ -923,14 +1035,14 @@ function ensureReleaseTag(repoDir, tagName, commitSha, message) {
     throw new Error(`Release tag ${tagName} already exists locally at ${localCommit}, expected ${commitSha}.`);
   }
   if (!localCommit) {
-    run("git", ["tag", "-a", tagName, commitSha, "-m", message ?? `release: ${tagName}`], { cwd: repoDir });
+    runGit(["tag", "-a", tagName, commitSha, "-m", message ?? `release: ${tagName}`], { cwd: repoDir });
   }
   const remoteCommit = remoteTagCommit(repoDir, tagName);
   if (remoteCommit && remoteCommit !== commitSha) {
     throw new Error(`Release tag ${tagName} already exists on origin at ${remoteCommit}, expected ${commitSha}.`);
   }
   if (!remoteCommit) {
-    run("git", ["push", "origin", tagName], { cwd: repoDir });
+    runGit(["push", "origin", tagName], { cwd: repoDir });
   }
   return {
     tagName,
@@ -938,12 +1050,28 @@ function ensureReleaseTag(repoDir, tagName, commitSha, message) {
     remote: remoteCommit ? "existing" : "pushed"
   };
 }
+function promoteCommitToProductionBranch(repoDir, commitSha) {
+  const expectedBefore = remoteBranchExists(repoDir, PRODUCTION_BRANCH) ? remoteHeadCommit(repoDir, PRODUCTION_BRANCH) : null;
+  const lease = expectedBefore ? `--force-with-lease=refs/heads/${PRODUCTION_BRANCH}:${expectedBefore}` : "--force-with-lease";
+  runGit(["push", lease, "origin", `${commitSha}:refs/heads/${PRODUCTION_BRANCH}`], { cwd: repoDir });
+  const observed = remoteHeadCommit(repoDir, PRODUCTION_BRANCH);
+  if (observed !== commitSha) {
+    throw new Error(`Production promotion verification failed; expected ${commitSha}, observed ${observed}.`);
+  }
+  return {
+    targetBranch: PRODUCTION_BRANCH,
+    expectedBefore,
+    commitSha,
+    pushed: true,
+    verified: true
+  };
+}
 function commitAllIfChanged(repoDir, message) {
-  run("git", ["add", "-A"], { cwd: repoDir });
+  runGit(["add", "-A"], { cwd: repoDir });
   if (!hasMeaningfulChanges(repoDir)) {
     return { committed: false, commitSha: headCommit(repoDir) };
   }
-  run("git", ["commit", "-m", message], { cwd: repoDir });
+  runGit(["commit", "-m", message], { cwd: repoDir });
   return { committed: true, commitSha: headCommit(repoDir) };
 }
 function releaseHistoryCommits(repoDir, sourceRef = `origin/${PRODUCTION_BRANCH}`, targetRef = "HEAD") {
@@ -1021,6 +1149,11 @@ function defaultCiWorkflows(kind, branch) {
   }
   return ["verify.yml"];
 }
+function packageCiWorkflowsForRepo(repoDir) {
+  const adapters = discoverTreeseedPackageAdapters(workspaceRoot(repoDir));
+  const adapter = adapters.find((candidate) => resolve(candidate.dir) === resolve(repoDir));
+  return adapter ? [hostedWorkflowForPackage(adapter)] : null;
+}
 function githubRepositoryForRepo(repoDir) {
   try {
     return resolveGitHubRepositorySlug(repoDir);
@@ -1030,7 +1163,7 @@ function githubRepositoryForRepo(repoDir) {
 }
 function ciTargetForRepo(repo, kind, input, workflowOverrides) {
   const branch = typeof input.branch === "string" && input.branch.trim() ? input.branch.trim() : repo.branchName;
-  const workflows = workflowOverrides.length > 0 ? workflowOverrides : defaultCiWorkflows(kind, branch);
+  const workflows = workflowOverrides.length > 0 ? workflowOverrides : kind === "package" ? packageCiWorkflowsForRepo(repo.path) ?? defaultCiWorkflows(kind, branch) : defaultCiWorkflows(kind, branch);
   return {
     name: repo.name,
     repoPath: repo.path,
@@ -1083,7 +1216,7 @@ async function createCiResult(cwd, input) {
 function createTasksResult(cwd) {
   const tenantRoot = cwd;
   const repoDir = gitWorkflowRoot(tenantRoot);
-  const deployConfig = loadCliDeployConfig(tenantRoot);
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: "staging", env: process.env }).deployConfig;
   const dirty = gitStatusPorcelain(repoDir).length > 0;
   const tasks = listTaskBranches(repoDir).map((branch) => {
     const previewState = loadDeployState(tenantRoot, deployConfig, {
@@ -1332,7 +1465,32 @@ function findAutoResumableSaveRun(root, branch) {
   if (branch === STAGING_BRANCH && (hasMeaningfulChanges(repoRoot(root)) || checkedOutWorkspacePackageRepos(root).some((repo) => hasMeaningfulChanges(repo.dir)))) {
     return null;
   }
-  return listInterruptedWorkflowRuns(root).find((journal) => journal.command === "save" && journal.resumable && journal.session.branchName === branch) ?? null;
+  const currentHeads = Object.fromEntries([
+    ["@treeseed/market", runGit(["rev-parse", "HEAD"], { cwd: repoRoot(root), capture: true }).trim()],
+    ...checkedOutWorkspacePackageRepos(root).map((repo) => [
+      repo.name,
+      runGit(["rev-parse", "HEAD"], { cwd: repo.dir, capture: true }).trim()
+    ])
+  ]);
+  return listInterruptedWorkflowRuns(root).find((journal) => {
+    if (journal.command !== "save" || !journal.resumable || journal.session.branchName !== branch) {
+      return false;
+    }
+    const classification = classifyWorkflowRunJournal(journal, {
+      currentBranch: branch,
+      currentHeads
+    });
+    if (classification.state === "resumable") {
+      return true;
+    }
+    if (classification.state === "stale") {
+      archiveWorkflowRun(root, journal.runId, {
+        ...classification,
+        reasons: ["save auto-resume skipped stale failed save", ...classification.reasons]
+      });
+    }
+    return false;
+  }) ?? null;
 }
 function workflowFileExists(repoPath, workflow) {
   return existsSync(resolve(repoPath, ".github", "workflows", workflow));
@@ -1426,7 +1584,7 @@ function generatedReleaseMetadataFiles(repoDir) {
   return ["package.json", "package-lock.json", "npm-shrinkwrap.json"].filter((filePath) => {
     if (existsSync(resolve(repoDir, filePath))) return true;
     try {
-      run("git", ["ls-files", "--error-unmatch", filePath], { cwd: repoDir, capture: true });
+      runGit(["ls-files", "--error-unmatch", filePath], { cwd: repoDir, capture: true });
       return true;
     } catch {
       return false;
@@ -1455,12 +1613,12 @@ function restoreReleaseGeneratedMetadata(repo) {
   const restored = [];
   const skipped = [];
   for (const filePath of repo.files) {
-    const status = run("git", ["status", "--porcelain", "--", filePath], { cwd: repo.path, capture: true });
+    const status = runGit(["status", "--porcelain", "--", filePath], { cwd: repo.path, capture: true });
     if (!status.trim()) {
       skipped.push(filePath);
       continue;
     }
-    run("git", ["restore", "--staged", "--worktree", "--", filePath], { cwd: repo.path, capture: true });
+    runGit(["restore", "--staged", "--worktree", "--", filePath], { cwd: repo.path, capture: true });
     restored.push(filePath);
   }
   return { restored, skipped };
@@ -1697,7 +1855,12 @@ function failWorkflowRun(root, runId, error, recovery) {
   releaseWorkflowLock(root, runId);
 }
 function validatePackageReleaseWorkflows(root, packageNames) {
-  const missing = checkedOutWorkspacePackageRepos(root).filter((pkg) => packageNames.includes(pkg.name)).filter((pkg) => !existsSync(resolve(pkg.dir, ".github", "workflows", "publish.yml"))).map((pkg) => pkg.name);
+  const adapterById = new Map(discoverTreeseedPackageAdapters(root).map((adapter) => [adapter.id, adapter]));
+  const missing = checkedOutWorkspacePackageRepos(root).filter((pkg) => packageNames.includes(pkg.name)).filter((pkg) => {
+    const adapter = adapterById.get(pkg.name);
+    const workflow = adapter?.kind === "beam-elixir-rust" && typeof adapter.metadata.hostedVerifyWorkflow === "string" ? String(adapter.metadata.hostedVerifyWorkflow) : ".github/workflows/publish.yml";
+    return !existsSync(resolve(pkg.dir, workflow));
+  }).map((pkg) => pkg.name);
   if (missing.length > 0) {
     workflowError("release", "workflow_contract_missing", `Treeseed release requires .github/workflows/publish.yml in: ${missing.join(", ")}.`, {
       details: {
@@ -1706,6 +1869,26 @@ function validatePackageReleaseWorkflows(root, packageNames) {
     });
   }
 }
+function releaseWorkflowForPackage(root, packageName) {
+  const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === packageName || entry.name === packageName);
+  const workflow = adapter?.kind === "beam-elixir-rust" && typeof adapter.metadata.hostedVerifyWorkflow === "string" ? String(adapter.metadata.hostedVerifyWorkflow) : ".github/workflows/publish.yml";
+  return workflow.split("/").at(-1) || "publish.yml";
+}
+function prepareAdapterReleaseMetadata(root, pkg, version) {
+  const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === pkg.name || entry.name === pkg.name);
+  if (adapter?.kind === "beam-elixir-rust" && existsSync(resolve(pkg.dir, "scripts", "bump-release-version.ts"))) {
+    run("tsx", ["scripts/bump-release-version.ts", version], { cwd: pkg.dir });
+    return { status: "updated", adapter: adapter.id, command: "tsx scripts/bump-release-version.ts" };
+  }
+  if (existsSync(resolve(pkg.dir, "package.json"))) {
+    return {
+      status: "npm-install",
+      adapter: adapter?.id ?? pkg.name,
+      ...runReleaseNpmInstall(pkg.dir, { workspaceRoot: root })
+    };
+  }
+  return { status: "skipped", adapter: adapter?.id ?? pkg.name, reason: "no package metadata updater" };
+}
 function validateStagingWorkflowContracts(root) {
   if (process.env.TREESEED_STAGE_WAIT_MODE === "skip") {
     return;
@@ -1725,17 +1908,38 @@ function validateStagingWorkflowContracts(root) {
 function shouldSkipReleaseInstall() {
   return process.env.TREESEED_SAVE_NPM_INSTALL_MODE === "skip";
 }
+function npmCommandForWorkflowSpawn(args) {
+  if (process.platform === "win32") {
+    return { command: "npm", args };
+  }
+  return {
+    command: "bash",
+    args: [
+      "-lc",
+      'ulimit -n 65535 2>/dev/null || ulimit -n 32768 2>/dev/null || ulimit -n 16384 2>/dev/null || true; exec npm "$@"',
+      "npm-fd-guard",
+      ...args
+    ]
+  };
+}
 function runReleaseNpmInstall(repoDir, options = {}) {
   if (shouldSkipReleaseInstall()) {
     return { status: "skipped", reason: "disabled" };
   }
   const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
-  const result = spawnSync("npm", args, {
+  const spawnCommand = npmCommandForWorkflowSpawn(args);
+  const result = spawnSync(spawnCommand.command, spawnCommand.args, {
     cwd: repoDir,
     env: {
       ...process.env,
       npm_config_audit: "false",
-      npm_config_fund: "false"
+      npm_config_fetch_retries: "2",
+      npm_config_fund: "false",
+      npm_config_foreground_scripts: "true",
+      npm_config_loglevel: "warn",
+      npm_config_maxsockets: "4",
+      npm_config_prefer_offline: "true",
+      npm_config_progress: "false"
     },
     stdio: "pipe",
     encoding: "utf8"
@@ -1770,7 +1974,7 @@ function backMergeProductionIntoStaging(repoDir, repoName, message) {
   syncBranchWithOrigin(repoDir, STAGING_BRANCH);
   checkoutBranch(repoDir, STAGING_BRANCH);
   try {
-    run("git", ["merge-base", "--is-ancestor", `origin/${PRODUCTION_BRANCH}`, "HEAD"], { cwd: repoDir, capture: true });
+    runGit(["merge-base", "--is-ancestor", `origin/${PRODUCTION_BRANCH}`, "HEAD"], { cwd: repoDir, capture: true });
     return {
       status: "up-to-date",
       merged: false,
@@ -1782,7 +1986,7 @@ function backMergeProductionIntoStaging(repoDir, repoName, message) {
   } catch {
   }
   try {
-    run("git", ["merge", "--no-ff", `origin/${PRODUCTION_BRANCH}`, "-m", message ?? `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`], { cwd: repoDir });
+    runGit(["merge", "--no-ff", `origin/${PRODUCTION_BRANCH}`, "-m", message ?? `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`], { cwd: repoDir });
   } catch (error) {
     const report = collectMergeConflictReport(repoDir);
     throw new TreeseedWorkflowError("release", "merge_conflict", formatMergeConflictReport(report, repoDir, STAGING_BRANCH), {
@@ -1835,69 +2039,6 @@ function backMergeRootProductionIntoStaging(root, syncPackageStagingHeads, optio
     packageStagingPointerCommit: pointerSync.commitSha
   };
 }
-function collectActiveDevTagReferences(root) {
-  return collectInternalDevReferenceIssues(root).map((issue) => devTagFromDependencySpec(issue.spec) ?? (issue.spec.includes("-dev.") ? issue.spec : null)).filter((value) => Boolean(value));
-}
-function normalizeIncludePackages(value) {
-  if (!value) return null;
-  const values = Array.isArray(value) ? value : String(value).split(",");
-  const normalized = values.map((entry) => String(entry).trim()).filter(Boolean);
-  return normalized.length > 0 ? new Set(normalized) : null;
-}
-function normalizeDevTagBranchScope(value) {
-  return value === "staging" || value === "preview" || value === "all" ? value : "all";
-}
-function packageJsonVersion(repoDir) {
-  const packageJson = JSON.parse(readFileSync(resolve(repoDir, "package.json"), "utf8"));
-  return String(packageJson.version ?? "");
-}
-function collectStaleDevTagCleanupReports(root, input, options) {
-  const includePackages = normalizeIncludePackages(input.includePackages);
-  const branchScope = normalizeDevTagBranchScope(input.branchScope);
-  const activeDevTags = collectActiveDevTagReferences(root);
-  const repos = checkedOutWorkspacePackageRepos(root).filter((pkg) => !includePackages || includePackages.has(pkg.name)).map((pkg) => {
-    const currentVersion = packageJsonVersion(pkg.dir);
-    const report = options.execute ? cleanupStaleTreeseedDevTags({
-      repoDir: pkg.dir,
-      packageName: pkg.name,
-      currentVersion,
-      activeReferences: activeDevTags,
-      branchScope
-    }) : {
-      ...collectTreeseedDevTagCleanupPlan({
-        repoDir: pkg.dir,
-        packageName: pkg.name,
-        currentVersion,
-        activeReferences: activeDevTags,
-        branchScope
-      }),
-      status: "planned",
-      candidateCount: 0,
-      cleaned: [],
-      cleanedCount: 0,
-      skippedCount: 0
-    };
-    if (!options.execute) {
-      const planned = report;
-      planned.candidateCount = planned.candidates.length;
-      planned.skippedCount = planned.skipped.length;
-    }
-    return {
-      name: pkg.name,
-      path: relative(root, pkg.dir),
-      ...report
-    };
-  });
-  return {
-    status: options.execute ? "completed" : "planned",
-    branchScope,
-    includePackages: includePackages ? [...includePackages].sort() : [],
-    repos,
-    candidateCount: repos.reduce((total, repo) => total + Number(repo.candidateCount ?? 0), 0),
-    cleanedCount: repos.reduce((total, repo) => total + Number(repo.cleanedCount ?? 0), 0),
-    skippedCount: repos.reduce((total, repo) => total + Number(repo.skippedCount ?? 0), 0)
-  };
-}
 function releasePlanVersionMap(plannedVersions) {
   return new Map(
     Object.entries(plannedVersions).filter(([name]) => name !== "@treeseed/market").map(([name, version]) => [name, String(version)])
@@ -1929,38 +2070,233 @@ function stableDependencyVersionsForReleaseLine(root, options) {
   }
   return versions;
 }
-function assertReleaseCandidatePassed(operation, report) {
-  if (report.status === "passed") {
-    return;
-  }
-  const rendered = report.failures.map((failure) => `- ${failure.scope}${failure.provider ? ` ${failure.provider}` : ""}: ${failure.message}`);
-  workflowError(operation, "validation_failed", [
-    "Treeseed release-candidate readiness failed.",
-    ...rendered
-  ].join("\n"), {
-    details: {
-      releaseCandidate: report
-    }
-  });
+function releaseCandidateProofDriver(mode, lane = "fast") {
+  if (lane === "promotion" || mode === "strict") return "github-hosted";
+  return "local";
 }
-async function runReleaseCandidateForPlan(operation, root, plannedRelease, options = {}) {
-  const plannedVersions = plannedRelease.plannedVersions && typeof plannedRelease.plannedVersions === "object" && !Array.isArray(plannedRelease.plannedVersions) ? plannedRelease.plannedVersions : {};
-  const stableDependencyVersions = plannedRelease.stableDependencyVersions && typeof plannedRelease.stableDependencyVersions === "object" && !Array.isArray(plannedRelease.stableDependencyVersions) ? plannedRelease.stableDependencyVersions : {};
+async function runReleaseCandidateProofForPlan(operation, root, plannedRelease, options = {}) {
   const packageSelection = releasePlanPackageSelection(plannedRelease.packageSelection);
-  const report = await runReleaseCandidateGate({
+  const mode = options.mode ?? normalizeReleaseCandidateMode(void 0, operation);
+  const driver = releaseCandidateProofDriver(mode, options.lane ?? "fast");
+  const proof = await runTreeseedProof({
     root,
-    plannedVersions: { ...stableDependencyVersions, ...plannedVersions },
-    selectedPackageNames: packageSelection.selected,
-    allowReuse: options.allowReuse,
-    mode: options.mode ?? normalizeReleaseCandidateMode(void 0, operation)
+    target: operation === "release" ? "prod" : "staging",
+    driver,
+    write: options.write
   });
-  assertReleaseCandidatePassed(operation, report);
-  return report;
+  if (proof.failures.length > 0) {
+    const first = proof.failures[0];
+    workflowError(operation, "validation_failed", [
+      "Treeseed release-candidate proof failed.",
+      `- ${first.subject.id}: ${first.invalidationReasons[0] ?? first.status}`,
+      first.result.workflow?.url ? `Run: ${first.result.workflow.url}` : null,
+      driver === "github-hosted" ? "Hosted GitHub workflow proof is authoritative; local action simulation is advisory." : "Local proof is exact-input cached in the proof ledger and reruns only missing or invalid subjects."
+    ].filter(Boolean).join("\n"), { details: { proof } });
+  }
+  return {
+    mode,
+    driver,
+    selectedPackageNames: packageSelection.selected,
+    proof,
+    status: "passed",
+    reused: proof.reused.length,
+    records: proof.records.length
+  };
+}
+function parseProofOlderThan(value) {
+  if (!value) return 30 * 24 * 60 * 60 * 1e3;
+  const match = value.trim().match(/^(\d+)([smhd])?$/u);
+  if (!match) return 30 * 24 * 60 * 60 * 1e3;
+  const amount = Number(match[1]);
+  const unit = match[2] ?? "d";
+  if (!Number.isFinite(amount) || amount < 0) return 30 * 24 * 60 * 60 * 1e3;
+  if (unit === "s") return amount * 1e3;
+  if (unit === "m") return amount * 60 * 1e3;
+  if (unit === "h") return amount * 60 * 60 * 1e3;
+  return amount * 24 * 60 * 60 * 1e3;
+}
+async function workflowProof(helpers, input = {}) {
+  try {
+    return await withContextEnv(helpers.context.env, async () => {
+      const timer = createTreeseedWorkflowTimer();
+      const tenantRoot = resolveProjectRootOrThrow("proof", helpers.cwd());
+      const root = workspaceRoot(tenantRoot);
+      const action = input.action ?? (input.plan || input.dryRun ? "plan" : "status");
+      const target = input.target ?? "staging";
+      const driver = input.driver ?? "github-hosted";
+      const executionMode = action === "plan" || input.plan || input.dryRun ? "plan" : "execute";
+      let payload;
+      if (action === "run") {
+        const result = await timer.phaseAsync("proof-run", "Run release proof subjects", () => runTreeseedProof({
+          root,
+          target,
+          driver,
+          subject: input.subject ?? null,
+          write: (line, stream) => helpers.write(line, stream)
+        }));
+        payload = {
+          action,
+          target,
+          driver,
+          subject: input.subject ?? null,
+          ...result,
+          authority: driver === "github-hosted" ? "authoritative" : "advisory"
+        };
+        if (result.failures.length > 0) {
+          const first = result.failures[0];
+          workflowError("proof", "validation_failed", [
+            "Treeseed release proof failed.",
+            `- ${first.subject.id}: ${first.invalidationReasons[0] ?? first.status}`,
+            first.result.workflow?.url ? `Run: ${first.result.workflow.url}` : null,
+            "Hosted GitHub workflow proof is authoritative; local action simulation is advisory."
+          ].filter(Boolean).join("\n"), { details: { proof: payload } });
+        }
+      } else if (action === "clean") {
+        payload = {
+          action,
+          target,
+          ...timer.phase("proof-clean", "Clean old proof records", () => cleanProofLedger(root, {
+            olderThanMs: parseProofOlderThan(input.olderThan)
+          }))
+        };
+      } else if (action === "failures") {
+        const ledger = timer.phase("proof-failures", "Inspect failed proof records", () => summarizeTreeseedProofLedger(root));
+        payload = { action, target, failures: ledger.failures, summary: ledger.summary };
+      } else if (action === "explain") {
+        const ledger = timer.phase("proof-explain", "Explain proof duration and reuse", () => summarizeTreeseedProofLedger(root));
+        payload = {
+          action,
+          target,
+          latest: ledger.latest,
+          slowest: ledger.slowest,
+          reuse: {
+            passed: ledger.summary.reusable,
+            rerun: Math.max(0, ledger.summary.records - ledger.summary.reusable),
+            blocked: ledger.summary.failed
+          },
+          summary: ledger.summary
+        };
+      } else {
+        const plan = timer.phase("proof-plan", "Plan release proof subjects", () => buildTreeseedProofPlan({
+          root,
+          target,
+          driver,
+          subject: input.subject ?? null
+        }));
+        payload = { action, target, driver, plan, authority: driver === "github-hosted" ? "authoritative" : "advisory" };
+      }
+      const timing = timer.finish();
+      return buildWorkflowResult("proof", root, payload, {
+        executionMode,
+        summary: action === "run" ? "Treeseed release proof run completed." : "Treeseed release proof report ready.",
+        timing,
+        nextSteps: createNextSteps([
+          { operation: "proof", reason: "Run missing authoritative hosted proof before promotion.", input: { action: "run", target, driver: "github-hosted" } }
+        ])
+      });
+    });
+  } catch (error) {
+    toError("proof", error);
+  }
+}
+function normalizeReleaseCandidatePackages(value) {
+  if (Array.isArray(value)) return value.map(String).filter(Boolean);
+  if (typeof value === "string" && value.trim()) return [value.trim()];
+  return [];
+}
+async function workflowReleaseCandidate(helpers, input = {}) {
+  try {
+    return await withContextEnv(helpers.context.env, async () => {
+      const timer = createTreeseedWorkflowTimer();
+      const tenantRoot = resolveProjectRootOrThrow("release-candidate", helpers.cwd());
+      const root = workspaceRoot(tenantRoot);
+      const executionMode = normalizeExecutionMode(input);
+      const selectedPackageNames = normalizeReleaseCandidatePackages(input.package);
+      const mode = input.mode ?? "strict";
+      const driver = input.verifyDriver === "local" ? "local" : input.verifyDriver === "action" ? "act" : releaseCandidateProofDriver(mode === "skip" ? "hybrid" : mode);
+      const proofSubject = selectedPackageNames.length === 1 ? `package:${selectedPackageNames[0]}` : null;
+      const plan = timer.phase("proof-plan", "Plan release-candidate proof subjects", () => buildTreeseedProofPlan({
+        root,
+        target: "staging",
+        driver,
+        subject: proofSubject
+      }));
+      const payload = {
+        mode,
+        driver,
+        verifyDriver: input.verifyDriver ?? "auto",
+        selectedPackageNames,
+        keepWorkspace: input.keepWorkspace === true,
+        plan,
+        plannedSteps: [
+          { id: "proof-plan", description: "Discover reusable exact-input proof records for package subjects." },
+          { id: "proof-run", description: "Run only missing or invalid release proof nodes." }
+        ]
+      };
+      if (executionMode === "plan") {
+        return buildWorkflowResult("release-candidate", root, payload, {
+          executionMode,
+          summary: "Treeseed release-candidate proof plan ready.",
+          nextSteps: createNextSteps([
+            { operation: "release-candidate", reason: "Run missing proof nodes before promotion." }
+          ])
+        });
+      }
+      if (mode === "skip") {
+        return buildWorkflowResult("release-candidate", root, {
+          ...payload,
+          status: "skipped",
+          failures: []
+        }, {
+          summary: "Treeseed release-candidate proof skipped.",
+          timing: timer.finish()
+        });
+      }
+      const proof = await timer.phaseAsync("proof-run", "Run release-candidate proof nodes", () => runTreeseedProof({
+        root,
+        target: "staging",
+        driver,
+        subject: proofSubject,
+        write: (line, stream) => helpers.write(line, stream)
+      }));
+      const resultPayload = {
+        ...payload,
+        proof,
+        failures: proof.failures
+      };
+      if (proof.failures.length > 0) {
+        const first = proof.failures[0];
+        workflowError("release-candidate", "validation_failed", [
+          "Treeseed release-candidate proof failed.",
+          `- ${first.subject.id}: ${first.invalidationReasons[0] ?? first.status}`,
+          first.result.workflow?.url ? `Run: ${first.result.workflow.url}` : null
+        ].filter(Boolean).join("\n"), {
+          details: { releaseCandidate: resultPayload }
+        });
+      }
+      return buildWorkflowResult("release-candidate", root, resultPayload, {
+        summary: "Treeseed release-candidate proof passed.",
+        timing: timer.finish(),
+        nextSteps: createNextSteps([
+          { operation: "stage", reason: "Run stage after the matching release proof passes." }
+        ])
+      });
+    });
+  } catch (error) {
+    toError("release-candidate", error);
+  }
 }
 function buildReleasePlanSnapshot(input) {
   const selectedPackageNames = new Set(input.packageSelection.selected);
   const applicationSelection = selectWorkflowApplications(input.root, { packageSelection: input.packageSelection });
   const versionPlan = planWorkspaceReleaseBump(input.level, input.root, input.mode === "recursive-workspace" ? { selectedPackageNames, repairVersionLine: input.repairVersionLine === true, targetVersionLine: input.targetVersionLine } : {});
+  if (input.repairVersionLine !== true) {
+    for (const adapter of discoverTreeseedPackageAdapters(input.root)) {
+      if (!selectedPackageNames.has(adapter.id) || versionPlan.versions.has(adapter.id) || !adapter.version) continue;
+      versionPlan.selected.add(adapter.id);
+      versionPlan.versions.set(adapter.id, incrementVersion(adapter.version, input.level));
+    }
+  }
   const plannedSelected = [...versionPlan.selected].filter((name) => versionPlan.versions.has(name));
   const plannedChanged = input.repairVersionLine === true ? plannedSelected : Array.from(new Set(input.packageSelection.changed.filter((name) => plannedSelected.includes(name))));
   const plannedDependents = plannedSelected.filter((name) => !plannedChanged.includes(name));
@@ -1999,7 +2335,7 @@ function buildReleasePlanSnapshot(input) {
     plannedDevReferenceRewrites,
     plannedPublishWaits: plannedPackageSelection.selected.map((name) => ({
       name,
-      workflow: "publish.yml",
+      workflow: releaseWorkflowForPackage(input.root, name),
       branch: String(plannedVersions[name] ?? PRODUCTION_BRANCH),
       status: "planned"
     })),
@@ -2018,7 +2354,6 @@ function buildReleasePlanSnapshot(input) {
       })),
       { id: "release-root", description: `Release market ${rootVersion}` },
       { id: "release-back-merge", description: "Back-merge production release history into staging" },
-      { id: "cleanup-dev-tags", description: "Clean replaced Treeseed dev tags after stable release" },
       { id: "workspace-link", description: "Restore local workspace links after release syncs back to staging" }
     ],
     blockers: input.blockers
@@ -2059,10 +2394,26 @@ function assertReleaseGitHubAutomationReady(root, selectedPackageNames, ciMode)
   if (ciMode === "off") {
     return;
   }
-  assertHostedGitHubWorkflowAuthReady("release", root);
+  const values = resolveTreeseedMachineEnvironmentValues(root, "prod");
+  const missing = [];
   for (const pkg of checkedOutWorkspacePackageRepos(root)) {
     if (!selectedPackageNames.has(pkg.name)) continue;
-    resolveGitHubRepositorySlug(pkg.dir);
+    const repository = resolveGitHubRepositorySlug(pkg.dir);
+    const credential = resolveGitHubCredentialForRepository(repository, { values, env: process.env });
+    if (!credential.token) {
+      missing.push({ packageName: pkg.name, repository: credential.repository, envName: credential.envName });
+    }
+  }
+  if (missing.length > 0) {
+    workflowError(
+      "release",
+      "github_auth_unavailable",
+      [
+        "Treeseed release automation requires Treeseed-prefixed GitHub credentials.",
+        ...missing.map((pkg) => `- ${pkg.packageName}: configure ${pkg.envName} for ${pkg.repository}, or TREESEED_GITHUB_TOKEN as a fallback.`)
+      ].join("\n"),
+      { details: { missing } }
+    );
   }
 }
 function assertReleaseGitHubWorkflowSucceeded(packageName, workflow) {
@@ -2089,31 +2440,31 @@ function assertSessionBranchSafety(operation, session, {
   requireCurrentBranch = false,
   allowPackageReposWithoutOrigin = false
 } = {}) {
-  const detached = session.packageRepos.filter((repo) => repo.detached).map((repo) => repo.name);
+  const detached = session.managedRepos.filter((repo) => repo.kind !== "fixture" && repo.detached).map((repo) => repo.name);
   if (detached.length > 0) {
-    workflowError(operation, "validation_failed", `Detached package heads detected: ${detached.join(", ")}.`, {
+    workflowError(operation, "validation_failed", `Detached managed repository heads detected: ${detached.join(", ")}.`, {
       details: { detached }
     });
   }
   if (requireCleanPackages) {
-    const dirty = session.packageRepos.filter((repo) => repo.dirty).map((repo) => repo.name);
+    const dirty = session.managedRepos.filter((repo) => repo.dirty).map((repo) => repo.name);
     if (dirty.length > 0) {
-      workflowError(operation, "validation_failed", `Dirty package repos block ${operation}: ${dirty.join(", ")}.`, {
+      workflowError(operation, "validation_failed", `Dirty managed repos block ${operation}: ${dirty.join(", ")}.`, {
         details: { dirty }
       });
     }
   }
   if (requireCurrentBranch && session.branchName) {
-    const missing = session.packageRepos.filter((repo) => repo.branchName !== session.branchName).map((repo) => ({ name: repo.name, branchName: repo.branchName }));
+    const missing = session.managedRepos.filter((repo) => repo.kind !== "fixture").filter((repo) => repo.branchName !== session.branchName).map((repo) => ({ name: repo.name, branchName: repo.branchName }));
     if (missing.length > 0) {
-      workflowError(operation, "validation_failed", `Package branch alignment is required for ${operation}.`, {
+      workflowError(operation, "validation_failed", `Managed repository branch alignment is required for ${operation}.`, {
         details: { expectedBranch: session.branchName, repos: missing }
       });
     }
   }
   const missingOriginRepos = [
     session.rootRepo,
-    ...allowPackageReposWithoutOrigin ? [] : session.packageRepos
+    ...allowPackageReposWithoutOrigin ? [] : session.managedRepos
   ].filter((repo) => !repo.hasOriginRemote).map((repo) => repo.name);
   if (missingOriginRepos.length > 0 && operation !== "destroy") {
     workflowError(operation, "validation_failed", `Missing origin remote on: ${missingOriginRepos.join(", ")}.`, {
@@ -2122,7 +2473,7 @@ function assertSessionBranchSafety(operation, session, {
   }
 }
 function previewStateFor(tenantRoot, branchName) {
-  const deployConfig = loadCliDeployConfig(tenantRoot);
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: "staging", env: process.env }).deployConfig;
   return loadDeployState(tenantRoot, deployConfig, {
     target: createBranchPreviewDeployTarget(branchName)
   });
@@ -2135,59 +2486,71 @@ function branchPreviewInitialized(tenantRoot, branchName) {
     return false;
   }
 }
-async function deployBranchPreview(tenantRoot, branchName, context, { initialize }) {
-  applyTreeseedEnvironmentToProcess({ tenantRoot, scope: "staging", override: true });
-  assertTreeseedCommandEnvironment({ tenantRoot, scope: "staging", purpose: "deploy" });
-  const target = createBranchPreviewDeployTarget(branchName);
-  const existingState = previewStateFor(tenantRoot, branchName);
-  if (initialize && !existingState.readiness?.initialized) {
-    validateDeployPrerequisites(tenantRoot, { requireRemote: true });
-    await reconcileTreeseedTarget({
-      tenantRoot,
-      target,
-      env: { ...process.env, ...context.env ?? {} },
-      write: (line) => context.write?.(line)
-    });
-    runRemoteD1Migrations(tenantRoot, { target });
-  } else {
-    assertDeploymentInitialized(tenantRoot, { target });
-    runRemoteD1Migrations(tenantRoot, { target });
-  }
-  runTenantDeployPreflight({ cwd: tenantRoot, scope: "staging" });
-  const { wranglerPath } = ensureGeneratedWranglerConfig(tenantRoot, { target });
-  runNodeScript("tenant-build", context, tenantRoot, "tenant build");
-  const deployResult = spawnSync(process.execPath, [resolveWranglerBin(), "deploy", "--config", wranglerPath], {
-    cwd: tenantRoot,
-    env: { ...process.env, ...context.env ?? {} },
-    stdio: "inherit"
+async function reconcileWorkflowBranchPreview(tenantRoot, branchName, context, { initialize }) {
+  return reconcileTreeseedBranchPreview({
+    root: tenantRoot,
+    branch: branchName,
+    dryRun: false,
+    execute: true,
+    workflowRunId: context.workflow?.resumeRunId ?? void 0,
+    initialize,
+    env: context.env
+  });
+}
+async function reconcileTreeseedBranchPreview(input) {
+  const target = { kind: "branch", branchName: input.branch };
+  const graph = compileTreeseedDesiredResourceGraph({ tenantRoot: input.root, target });
+  const selector = {
+    environment: "staging",
+    resourceKind: ["branch-preview"],
+    ...input.appId?.length ? { appId: input.appId } : {}
+  };
+  const units = compileTreeseedDesiredUnitsFromGraph(graph, selector);
+  const reconcile = input.dryRun || !input.execute ? await planTreeseedReconciliation({ tenantRoot: input.root, target, env: input.env ?? process.env, units, selector }) : await reconcileTreeseedTarget({
+    tenantRoot: input.root,
+    target,
+    env: input.env ?? process.env,
+    units,
+    selector,
+    dryRun: false
   });
-  if ((deployResult.status ?? 1) !== 0) {
-    workflowError("switch", "unsupported_state", "Preview deployment failed.", {
-      exitCode: deployResult.status ?? 1,
-      details: { branchName, wranglerPath }
-    });
-  }
-  const state = finalizeDeploymentState(tenantRoot, { target });
   return {
-    initialized: existingState.readiness?.initialized !== true,
-    previewUrl: state.lastDeployedUrl ?? null,
-    lastDeploymentTimestamp: state.lastDeploymentTimestamp ?? null,
-    wranglerPath
+    status: input.dryRun || !input.execute ? "planned" : "reconciled",
+    branch: input.branch,
+    initialize: input.initialize === true,
+    reconcile
   };
 }
-function destroyPreviewIfPresent(tenantRoot, branchName) {
-  const previewTarget = createBranchPreviewDeployTarget(branchName);
-  const deployConfig = loadCliDeployConfig(tenantRoot);
-  const previewState = loadDeployState(tenantRoot, deployConfig, { target: previewTarget });
-  if (previewState.readiness?.initialized) {
-    applyTreeseedEnvironmentToProcess({ tenantRoot, scope: "staging", override: true });
-    validateDestroyPrerequisites(tenantRoot, { requireRemote: true });
-    destroyCloudflareResources(tenantRoot, { target: previewTarget });
-  }
-  cleanupDestroyedState(tenantRoot, { target: previewTarget });
+async function destroyWorkflowBranchPreviewIfPresent(tenantRoot, branchName, context) {
+  return destroyTreeseedBranchPreview({
+    root: tenantRoot,
+    branch: branchName,
+    dryRun: false,
+    execute: true,
+    reason: "close",
+    env: context?.env
+  });
+}
+async function destroyTreeseedBranchPreview(input) {
+  const target = { kind: "branch", branchName: input.branch };
+  const graph = compileTreeseedDesiredResourceGraph({ tenantRoot: input.root, target });
+  const selector = {
+    environment: "staging",
+    resourceKind: ["branch-preview", "branch-preview-cleanup"]
+  };
+  const units = compileTreeseedDesiredUnitsFromGraph(graph, selector).map((unit) => unit.unitType === "branch-preview-cleanup" ? { ...unit, spec: { ...unit.spec, reason: input.reason } } : unit);
+  const reconcile = input.dryRun || !input.execute ? await planTreeseedReconciliation({ tenantRoot: input.root, target, env: input.env ?? process.env, units, selector }) : await destroyTreeseedTargetUnits({
+    tenantRoot: input.root,
+    target,
+    env: input.env ?? process.env,
+    units,
+    selector
+  });
   return {
-    performed: previewState.readiness?.initialized === true,
-    state: previewState
+    status: input.dryRun || !input.execute ? "planned" : "destroyed",
+    branch: input.branch,
+    reason: input.reason,
+    reconcile
   };
 }
 function resolveDestroyConfirmation(context, expected, input) {
@@ -2211,8 +2574,8 @@ function resolveDestroyConfirmation(context, expected, input) {
 function syncCurrentBranchToOrigin(operation, repoDir, branch) {
   try {
     if (remoteBranchExists(repoDir, branch)) {
-      run("git", ["pull", "--rebase", "origin", branch], { cwd: repoDir });
-      run("git", ["push", "origin", branch], { cwd: repoDir });
+      runGit(["pull", "--rebase", "origin", branch], { cwd: repoDir });
+      runGit(["push", "origin", branch], { cwd: repoDir });
       return {
         remoteBranchExisted: true,
         pulledRebase: true,
@@ -2221,7 +2584,7 @@ function syncCurrentBranchToOrigin(operation, repoDir, branch) {
         conflicts: false
       };
     }
-    run("git", ["push", "-u", "origin", branch], { cwd: repoDir });
+    runGit(["push", "-u", "origin", branch], { cwd: repoDir });
     return {
       remoteBranchExisted: false,
       pulledRebase: false,
@@ -2270,10 +2633,10 @@ function checkoutOrCreateSaveBranch(repoDir, branch) {
     return branch;
   }
   if (remoteBranchExists(repoDir, branch)) {
-    run("git", ["checkout", "-b", branch, `origin/${branch}`], { cwd: repoDir });
+    runGit(["checkout", "-b", branch, `origin/${branch}`], { cwd: repoDir });
     return branch;
   }
-  run("git", ["checkout", "-b", branch], { cwd: repoDir });
+  runGit(["checkout", "-b", branch], { cwd: repoDir });
   return branch;
 }
 function runPackageVerifyLocal(pkgDir) {
@@ -2283,8 +2646,8 @@ function branchNeedsSync(repoDir, branch) {
   if (!remoteBranchExists(repoDir, branch)) {
     return true;
   }
-  const localHead = run("git", ["rev-parse", "HEAD"], { cwd: repoDir, capture: true }).trim();
-  const remoteHead = run("git", ["rev-parse", `origin/${branch}`], { cwd: repoDir, capture: true }).trim();
+  const localHead = runGit(["rev-parse", "HEAD"], { cwd: repoDir, capture: true }).trim();
+  const remoteHead = runGit(["rev-parse", `origin/${branch}`], { cwd: repoDir, capture: true }).trim();
   return localHead !== remoteHead;
 }
 function savePackageRepo(report, message, branch, shouldVerify) {
@@ -2294,7 +2657,7 @@ function savePackageRepo(report, message, branch, shouldVerify) {
   const needsSync = branchNeedsSync(report.path, branch);
   if (!report.dirty && !needsSync) {
     report.skippedReason = "clean";
-    report.commitSha = run("git", ["rev-parse", "HEAD"], { cwd: report.path, capture: true }).trim();
+    report.commitSha = runGit(["rev-parse", "HEAD"], { cwd: report.path, capture: true }).trim();
     return report;
   }
   if (shouldVerify && report.dirty) {
@@ -2302,11 +2665,11 @@ function savePackageRepo(report, message, branch, shouldVerify) {
     report.verified = true;
   }
   if (report.dirty) {
-    run("git", ["add", "-A"], { cwd: report.path });
-    run("git", ["commit", "-m", message], { cwd: report.path });
+    runGit(["add", "-A"], { cwd: report.path });
+    runGit(["commit", "-m", message], { cwd: report.path });
     report.committed = true;
   }
-  report.commitSha = run("git", ["rev-parse", "HEAD"], { cwd: report.path, capture: true }).trim();
+  report.commitSha = runGit(["rev-parse", "HEAD"], { cwd: report.path, capture: true }).trim();
   const branchSync = syncCurrentBranchToOrigin("save", report.path, branch);
   report.pushed = branchSync.pushed === true;
   if (!report.dirty && needsSync) {
@@ -2344,14 +2707,14 @@ function ensureLocalTaskBranch(repoDir, branchName) {
   }
   return true;
 }
-function cleanupTaskBranchReport(report, branchName, message, { deleteBranch = true, targetBranch = STAGING_BRANCH } = {}) {
+function cleanupTaskBranchReport(report, branchName, _message, { deleteBranch = true, targetBranch = STAGING_BRANCH } = {}) {
   if (!ensureLocalTaskBranch(report.path, branchName)) {
     report.skippedReason = "branch-missing";
     return report;
   }
-  const deprecatedTag = createDeprecatedTaskTag(report.path, branchName, message);
-  report.tagName = deprecatedTag.tagName;
-  report.commitSha = deprecatedTag.head;
+  const tag = createDeprecatedTaskTag(report.path, branchName, _message);
+  report.tagName = tag.tagName;
+  report.commitSha = updateHead(report.path);
   report.deletedRemote = deleteBranch ? deleteRemoteBranch(report.path, branchName) : false;
   syncBranchWithOrigin(report.path, targetBranch);
   if (deleteBranch) {
@@ -2415,7 +2778,7 @@ function collectReleasePackageSelection(root) {
   };
 }
 function hasStagedChanges(repoDir) {
-  return run("git", ["diff", "--cached", "--name-only"], { cwd: repoDir, capture: true }).trim().length > 0;
+  return runGit(["diff", "--cached", "--name-only"], { cwd: repoDir, capture: true }).trim().length > 0;
 }
 async function workflowStatus(helpers, input = {}) {
   return withContextEnv(helpers.context.env, async () => {
@@ -2837,7 +3200,7 @@ async function workflowSwitch(helpers, input) {
       const mode = session.mode;
       const repoDir = session.gitRoot;
       const rootRepo = createWorkspaceRootRepoReport(root);
-      const packageReports = createWorkspacePackageReports(root);
+      const packageReports = createManagedWorkflowRepoReports(root);
       let previewResult = null;
       const dirtyRepos = [rootRepo, ...packageReports].filter((repo) => repo.dirty).map((repo) => repo.name);
       if (executionMode === "plan") {
@@ -2847,6 +3210,14 @@ async function workflowSwitch(helpers, input) {
           report.created = !local && !remote;
           report.resumed = local || remote;
         }
+        const previewPlan = preview ? await reconcileTreeseedBranchPreview({
+          root,
+          branch: branchName,
+          dryRun: true,
+          execute: false,
+          initialize: !branchPreviewInitialized(root, branchName),
+          env: helpers.context.env
+        }) : null;
         return buildWorkflowResult(
           "switch",
           root,
@@ -2864,7 +3235,8 @@ async function workflowSwitch(helpers, input) {
               ...packageReports.map((report) => ({ id: `switch-${report.name}`, description: `Mirror ${branchName} into ${report.name}` })),
               { id: "workspace-link", description: "Apply local workspace links for integrated development" },
               ...preview ? [{ id: "preview", description: `Provision or refresh preview for ${branchName}` }] : []
-            ]
+            ],
+            previewPlan
           },
           {
             executionMode,
@@ -2914,8 +3286,8 @@ async function workflowSwitch(helpers, input) {
         rootRepo.resumed = rootSwitch.resumed;
         rootRepo.commitSha = headCommit(repoDir);
         rootRepo.pushed = rootSwitch.created;
-        for (const pkg of checkedOutWorkspacePackageRepos(root)) {
-          const report = findReportByName(packageReports, pkg.name);
+        for (const managedRepo of checkedOutManagedWorkflowRepos(root)) {
+          const report = findReportByName(packageReports, managedRepo.name);
           if (!report) {
             continue;
           }
@@ -2923,16 +3295,16 @@ async function workflowSwitch(helpers, input) {
             root,
             workflowRun.runId,
             `switch-${report.name}`,
-            () => checkoutTaskBranchFromStaging(pkg.dir, branchName, {
+            () => checkoutTaskBranchFromStaging(managedRepo.dir, branchName, {
               createIfMissing: input.createIfMissing !== false,
               pushIfCreated: false
             })
           );
-          report.branch = currentBranch(pkg.dir) || branchName;
+          report.branch = currentBranch(managedRepo.dir) || branchName;
           report.created = packageSwitch.created;
           report.resumed = packageSwitch.resumed;
-          report.commitSha = headCommit(pkg.dir);
-          report.dirty = hasMeaningfulChanges(pkg.dir);
+          report.commitSha = headCommit(managedRepo.dir);
+          report.dirty = hasMeaningfulChanges(managedRepo.dir);
         }
         const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "workspace-link", () => ensureWorkflowWorkspaceLinks(root, helpers, input.workspaceLinks ?? "auto"));
         const stateAfterSwitch = resolveTreeseedWorkflowState(root);
@@ -2941,7 +3313,7 @@ async function workflowSwitch(helpers, input) {
             root,
             workflowRun.runId,
             "preview",
-            () => deployBranchPreview(root, branchName, helpers.context, { initialize: !stateAfterSwitch.preview.enabled })
+            () => reconcileWorkflowBranchPreview(root, branchName, helpers.context, { initialize: !stateAfterSwitch.preview.enabled })
           ) ?? null;
         }
         const state = resolveTreeseedWorkflowState(root);
@@ -2995,32 +3367,401 @@ async function workflowSwitch(helpers, input) {
     toError("switch", error);
   }
 }
-async function workflowDev(helpers, input = {}) {
-  try {
-    return withContextEnv(helpers.context.env, async () => {
-      if (helpers.context.transport === "api") {
-        workflowError("dev", "unsupported_transport", "Treeseed dev is not supported over the HTTP workflow API.");
-      }
-      const tenantRoot = resolveProjectRootOrThrow("dev", helpers.cwd());
-      const workspaceLinks = ensureWorkflowWorkspaceLinks(workspaceRoot(tenantRoot), helpers, input.workspaceLinks ?? "auto");
-      const readiness = ensureLocalReadinessOrThrow("dev", tenantRoot);
-      applyTreeseedEnvironmentToProcess({ tenantRoot, scope: "local", override: true });
-      assertTreeseedCommandEnvironment({ tenantRoot, scope: "local", purpose: "dev" });
-      const args = [packageScriptPath("tenant-dev")];
-      if (input.watch) {
-        args.push("--watch");
-      }
-      if (input.port !== void 0) {
-        args.push("--port", String(input.port));
-      }
-      const env = resolveTreeseedLaunchEnvironment({
-        tenantRoot,
-        scope: "local",
-        baseEnv: { ...process.env, ...helpers.context.env ?? {} }
-      });
-      if (input.background) {
-        const child = spawn(process.execPath, args, {
-          cwd: tenantRoot,
+function normalizeUpdateStrategy(strategy) {
+  return strategy === "ff-only" ? "ff-only" : "merge";
+}
+function normalizeUpdateSource(source) {
+  const normalized = String(source ?? STAGING_BRANCH).trim();
+  return normalized || STAGING_BRANCH;
+}
+function gitOutput(args, cwd, allowFailure = false) {
+  return runTreeseedGit(args, {
+    cwd,
+    mode: classifyTreeseedGitMode(args),
+    allowFailure
+  }).stdout.trim();
+}
+function updateHead(repoDir) {
+  return gitOutput(["rev-parse", "HEAD"], repoDir, true) || null;
+}
+function updateStatusLines(repoDir) {
+  const output = gitOutput(["status", "--porcelain"], repoDir, true);
+  return output ? output.split(/\r?\n/u).filter(Boolean) : [];
+}
+function updateChangedFiles(repoDir) {
+  return updateStatusLines(repoDir).map((line) => line.slice(3).trim()).filter(Boolean);
+}
+function updateConflictedFiles(repoDir) {
+  return updateStatusLines(repoDir).filter((line) => {
+    const status = line.slice(0, 2);
+    return status.includes("U") || ["AA", "DD"].includes(status);
+  }).map((line) => line.slice(3).trim()).filter(Boolean);
+}
+function sourceBranchExists(repoDir, sourceBranch) {
+  return runTreeseedGit(["ls-remote", "--exit-code", "--heads", "origin", sourceBranch], {
+    cwd: repoDir,
+    mode: "read",
+    allowFailure: true
+  }).status === 0;
+}
+function localRemoteRefExists(repoDir, sourceBranch) {
+  return runTreeseedGitOk(["show-ref", "--verify", `refs/remotes/origin/${sourceBranch}`], {
+    cwd: repoDir,
+    mode: "read"
+  });
+}
+function updateAheadBehind(repoDir, branch, sourceRef) {
+  if (!localRemoteRefExists(repoDir, sourceRef.replace(/^origin\//u, ""))) {
+    return { ahead: null, behind: null };
+  }
+  const output = gitOutput(["rev-list", "--left-right", "--count", `${branch}...${sourceRef}`], repoDir, true);
+  const [aheadRaw, behindRaw] = output.split(/\s+/u);
+  const ahead = Number.parseInt(aheadRaw ?? "", 10);
+  const behind = Number.parseInt(behindRaw ?? "", 10);
+  return {
+    ahead: Number.isFinite(ahead) ? ahead : null,
+    behind: Number.isFinite(behind) ? behind : null
+  };
+}
+function updatePlanChangedFiles(repoDir, sourceRef) {
+  if (!runTreeseedGitOk(["show-ref", "--verify", `refs/remotes/${sourceRef}`], { cwd: repoDir, mode: "read" })) {
+    return [];
+  }
+  const output = gitOutput(["diff", "--name-only", `HEAD...${sourceRef}`], repoDir, true);
+  return output ? output.split(/\r?\n/u).filter(Boolean).slice(0, 50) : [];
+}
+function planUpdateRepo(name, repoDir, branch, sourceBranch, strategy) {
+  const sourceRef = `origin/${sourceBranch}`;
+  const blockers = [];
+  if (!sourceBranchExists(repoDir, sourceBranch)) {
+    blockers.push(`origin/${sourceBranch} does not exist`);
+  }
+  const { ahead, behind } = blockers.length === 0 ? updateAheadBehind(repoDir, branch, sourceRef) : { ahead: null, behind: null };
+  const status = blockers.length > 0 ? "blocked" : behind === 0 ? "up-to-date" : strategy === "ff-only" && ahead === 0 ? "fast-forward" : "merge-needed";
+  return {
+    name,
+    path: repoDir,
+    branch,
+    sourceRef,
+    action: blockers.length > 0 ? "blocked" : "planned",
+    beforeHead: updateHead(repoDir),
+    afterHead: null,
+    pushed: false,
+    changedFiles: updatePlanChangedFiles(repoDir, sourceRef),
+    blockers,
+    ahead,
+    behind,
+    status
+  };
+}
+function ensureUpdateRepoReady(operation, repo, expectedBranch) {
+  if (repo.detached || !repo.branchName) {
+    workflowError(operation, "validation_failed", `${repo.name} is detached; update requires attached branches.`, {
+      details: { repo }
+    });
+  }
+  if (expectedBranch && repo.branchName !== expectedBranch) {
+    workflowError(operation, "validation_failed", `${repo.name} is on ${repo.branchName}, expected ${expectedBranch}.`, {
+      details: { repo, expectedBranch }
+    });
+  }
+  if (repo.dirty) {
+    workflowError(operation, "validation_failed", `${repo.name} has local changes. Run \`npx trsd save --json "checkpoint before update"\` first.`, {
+      details: { repo }
+    });
+  }
+  if (!repo.hasOriginRemote) {
+    workflowError(operation, "validation_failed", `${repo.name} is missing an origin remote.`, {
+      details: { repo }
+    });
+  }
+}
+function formatUpdateConflict(repoName, repoDir, sourceBranch, targetBranch) {
+  const files = updateConflictedFiles(repoDir);
+  const status = updateStatusLines(repoDir);
+  return {
+    message: [
+      `Treeseed update hit a merge conflict in ${repoName}.`,
+      `Repository: ${repoDir}`,
+      `Target branch: ${targetBranch}`,
+      `Source branch: origin/${sourceBranch}`,
+      files.length > 0 ? `Conflicted files:
+${files.map((file) => `- ${file}`).join("\n")}` : "Conflicted files: inspect git status.",
+      'Resolve the conflicts in that repository, then run `npx trsd save --json "resolve update conflict"` or abort manually and rerun `npx trsd update --from staging --json`.'
+    ].join("\n"),
+    files,
+    status
+  };
+}
+function mergeUpdateRepo(input) {
+  const sourceRef = `origin/${input.sourceBranch}`;
+  const beforeHead = updateHead(input.repoDir);
+  runTreeseedGit(["fetch", "origin"], { cwd: input.repoDir, mode: "mutate" });
+  if (!sourceBranchExists(input.repoDir, input.sourceBranch)) {
+    return {
+      name: input.name,
+      path: input.repoDir,
+      branch: input.branch,
+      sourceRef,
+      action: "blocked",
+      beforeHead,
+      afterHead: beforeHead,
+      pushed: false,
+      changedFiles: [],
+      blockers: [`origin/${input.sourceBranch} does not exist`]
+    };
+  }
+  const mergeArgs = input.strategy === "ff-only" ? ["merge", "--ff-only", sourceRef] : ["merge", "--no-edit", sourceRef];
+  const merge = runTreeseedGit(mergeArgs, {
+    cwd: input.repoDir,
+    mode: "mutate",
+    allowFailure: true
+  });
+  if (merge.status !== 0) {
+    const conflict = formatUpdateConflict(input.name, input.repoDir, input.sourceBranch, input.branch);
+    throw new TreeseedWorkflowError("update", "merge_conflict", conflict.message, {
+      details: {
+        repo: input.name,
+        path: input.repoDir,
+        files: conflict.files,
+        status: conflict.status,
+        sourceBranch: input.sourceBranch,
+        targetBranch: input.branch
+      },
+      exitCode: 12
+    });
+  }
+  const afterHead = updateHead(input.repoDir);
+  const changed = beforeHead !== afterHead;
+  let pushed = false;
+  if (changed && input.push) {
+    runTreeseedGit(["push", "origin", input.branch], { cwd: input.repoDir, mode: "mutate" });
+    pushed = true;
+  }
+  return {
+    name: input.name,
+    path: input.repoDir,
+    branch: input.branch,
+    sourceRef,
+    action: changed ? input.strategy === "ff-only" ? "fast-forwarded" : "merged" : "up-to-date",
+    beforeHead,
+    afterHead,
+    pushed,
+    changedFiles: [],
+    blockers: []
+  };
+}
+function commitRootUpdateIfNeeded(root, branch, push) {
+  const changedFiles = updateChangedFiles(repoRoot(root));
+  if (changedFiles.length === 0) {
+    let pushed2 = false;
+    if (push) {
+      runTreeseedGit(["push", "origin", branch], { cwd: repoRoot(root), mode: "mutate" });
+      pushed2 = true;
+    }
+    return {
+      committed: false,
+      pushed: pushed2,
+      commitSha: updateHead(repoRoot(root)),
+      changedFiles
+    };
+  }
+  runTreeseedGit(["add", "-A"], { cwd: repoRoot(root), mode: "mutate" });
+  runTreeseedGit(["commit", "-m", `chore(workflow): update ${branch} from staging`], { cwd: repoRoot(root), mode: "mutate" });
+  const commitSha = updateHead(repoRoot(root));
+  let pushed = false;
+  if (push) {
+    runTreeseedGit(["push", "origin", branch], { cwd: repoRoot(root), mode: "mutate" });
+    pushed = true;
+  }
+  return {
+    committed: true,
+    pushed,
+    commitSha,
+    changedFiles
+  };
+}
+async function workflowUpdate(helpers, input = {}) {
+  try {
+    return await withContextEnv(helpers.context.env, async () => {
+      const tenantRoot = resolveProjectRootOrThrow("update", helpers.cwd());
+      const root = workspaceRoot(tenantRoot);
+      const session = resolveTreeseedWorkflowSession(root);
+      const sourceBranch = normalizeUpdateSource(input.from);
+      const strategy = normalizeUpdateStrategy(input.strategy);
+      const push = input.push !== false;
+      const executionMode = normalizeExecutionMode(input);
+      const branch = session.branchName;
+      if (!branch) {
+        workflowError("update", "validation_failed", "Treeseed update requires an attached current branch.");
+      }
+      if (branch === STAGING_BRANCH || branch === PRODUCTION_BRANCH) {
+        workflowError("update", "validation_failed", `Treeseed update must run from a task branch, not ${branch}.`, {
+          details: { branch }
+        });
+      }
+      if (sourceBranch === branch) {
+        workflowError("update", "validation_failed", "Treeseed update source branch cannot match the current branch.", {
+          details: { branch, sourceBranch }
+        });
+      }
+      ensureUpdateRepoReady("update", session.rootRepo);
+      for (const repo of session.managedRepos) {
+        ensureUpdateRepoReady("update", repo, branch);
+      }
+      const repoPlans = session.managedRepos.map((repo) => planUpdateRepo(repo.name, repo.path, branch, sourceBranch, strategy));
+      const rootPlan = planUpdateRepo("@treeseed/market", session.gitRoot, branch, sourceBranch, strategy);
+      const blockers = [...repoPlans, rootPlan].flatMap((repo) => repo.blockers.map((blocker) => `${repo.name}: ${blocker}`));
+      if (executionMode === "plan") {
+        return buildWorkflowResult("update", root, {
+          mode: session.mode,
+          branch,
+          sourceBranch,
+          sourceRef: `origin/${sourceBranch}`,
+          strategy,
+          pushed: false,
+          plan: true,
+          repos: repoPlans,
+          rootRepo: rootPlan,
+          conflicts: [],
+          blockers,
+          ...worktreePayload(root, input.worktreeMode)
+        }, {
+          executionMode,
+          includeFinalState: false,
+          nextSteps: createNextSteps([
+            { operation: "update", reason: "Run without --plan to merge staging into the current branch.", input: { from: sourceBranch } }
+          ])
+        });
+      }
+      if (blockers.length > 0) {
+        workflowError("update", "validation_failed", `Treeseed update is blocked:
+${blockers.join("\n")}`, {
+          details: { blockers, repos: repoPlans, rootRepo: rootPlan }
+        });
+      }
+      const workflowRun = acquireWorkflowRun(
+        "update",
+        session,
+        { from: sourceBranch, strategy, push, workspaceLinks: input.workspaceLinks ?? "auto" },
+        [
+          { id: "validate-update", description: `Validate update from ${sourceBranch}`, repoName: session.rootRepo.name, repoPath: session.rootRepo.path, branch, resumable: true },
+          ...session.managedRepos.map((repo) => ({
+            id: `update-${repo.name}`,
+            description: `Merge origin/${sourceBranch} into ${repo.name}`,
+            repoName: repo.name,
+            repoPath: repo.path,
+            branch,
+            resumable: true
+          })),
+          { id: "update-root", description: `Merge origin/${sourceBranch} into market`, repoName: session.rootRepo.name, repoPath: session.rootRepo.path, branch, resumable: true },
+          { id: "refresh-root-pointers", description: "Commit updated root pointers if package heads changed", repoName: session.rootRepo.name, repoPath: session.rootRepo.path, branch, resumable: true },
+          { id: "restore-workspace-links", description: "Restore local workspace links", repoName: session.rootRepo.name, repoPath: session.rootRepo.path, branch, resumable: true }
+        ],
+        helpers.context
+      );
+      try {
+        await executeJournalStep(root, workflowRun.runId, "validate-update", () => ({
+          branch,
+          sourceBranch,
+          strategy,
+          push
+        }));
+        const repos = [];
+        for (const repo of session.managedRepos) {
+          const result = await executeJournalStep(root, workflowRun.runId, `update-${repo.name}`, () => mergeUpdateRepo({
+            name: repo.name,
+            repoDir: repo.path,
+            branch,
+            sourceBranch,
+            strategy,
+            push
+          }));
+          if (result) repos.push(result);
+        }
+        const rootMerge = await executeJournalStep(root, workflowRun.runId, "update-root", () => mergeUpdateRepo({
+          name: "@treeseed/market",
+          repoDir: session.gitRoot,
+          branch,
+          sourceBranch,
+          strategy,
+          push: false
+        }));
+        const rootCommit = await executeJournalStep(root, workflowRun.runId, "refresh-root-pointers", () => commitRootUpdateIfNeeded(root, branch, push));
+        const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "restore-workspace-links", () => ensureWorkflowWorkspaceLinks(root, helpers, input.workspaceLinks ?? "auto"));
+        const rootRepo = {
+          ...rootMerge,
+          action: rootCommit?.committed ? "committed" : rootMerge.action,
+          commitSha: rootCommit?.commitSha ?? rootMerge.afterHead,
+          pushed: rootCommit?.pushed ?? false,
+          changedFiles: rootCommit?.changedFiles ?? rootMerge.changedFiles
+        };
+        const payload = {
+          mode: session.mode,
+          branch,
+          sourceBranch,
+          sourceRef: `origin/${sourceBranch}`,
+          strategy,
+          pushed: push,
+          plan: false,
+          repos,
+          rootRepo,
+          conflicts: [],
+          workspaceLinks,
+          ...worktreePayload(root, input.worktreeMode)
+        };
+        completeWorkflowRun(root, workflowRun.runId, payload);
+        return buildWorkflowResult("update", root, payload, {
+          runId: workflowRun.runId,
+          summary: `Treeseed update merged ${sourceBranch} into ${branch}.`,
+          includeFinalState: false,
+          nextSteps: createNextSteps([
+            { operation: "save", reason: "Checkpoint any follow-up conflict resolutions or generated pointer changes.", input: { message: "sync with staging" } },
+            { operation: "stage", reason: "Merge the updated task branch into staging when it is ready.", input: { message: "describe the resolution" } }
+          ])
+        });
+      } catch (error) {
+        failWorkflowRun(root, workflowRun.runId, error, {
+          resumable: true,
+          runId: workflowRun.runId,
+          command: "update",
+          message: `Resume the interrupted update for ${branch}.`,
+          recoverCommand: "treeseed recover",
+          resumeCommand: `treeseed resume ${workflowRun.runId}`
+        });
+        throw error;
+      }
+    });
+  } catch (error) {
+    toError("update", error);
+  }
+}
+async function workflowDev(helpers, input = {}) {
+  try {
+    return withContextEnv(helpers.context.env, async () => {
+      if (helpers.context.transport === "api") {
+        workflowError("dev", "unsupported_transport", "Treeseed dev is not supported over the HTTP workflow API.");
+      }
+      const tenantRoot = resolveProjectRootOrThrow("dev", helpers.cwd());
+      const workspaceLinks = ensureWorkflowWorkspaceLinks(workspaceRoot(tenantRoot), helpers, input.workspaceLinks ?? "auto");
+      const readiness = ensureLocalReadinessOrThrow("dev", tenantRoot);
+      applyTreeseedEnvironmentToProcess({ tenantRoot, scope: "local", override: true });
+      assertTreeseedCommandEnvironment({ tenantRoot, scope: "local", purpose: "dev" });
+      const args = [packageScriptPath("tenant-dev")];
+      if (input.watch) {
+        args.push("--watch");
+      }
+      if (input.port !== void 0) {
+        args.push("--port", String(input.port));
+      }
+      const env = resolveTreeseedLaunchEnvironment({
+        tenantRoot,
+        scope: "local",
+        baseEnv: { ...process.env, ...helpers.context.env ?? {} }
+      });
+      if (input.background) {
+        const child = spawn(process.execPath, args, {
+          cwd: tenantRoot,
           env,
           stdio: input.stdio ?? "inherit",
           detached: process.platform !== "win32"
@@ -3073,6 +3814,7 @@ async function workflowSave(helpers, input) {
     return await withContextEnv(helpers.context.env, async () => {
       const tenantRoot = resolveProjectRootOrThrow("save", helpers.cwd());
       const root = workspaceRoot(tenantRoot);
+      ensureTreeseedLocalStateExcluded(root);
       const rootBranch = currentBranch(repoRoot(root)) || null;
       reattachRepairablePackageRepos(root, [rootBranch, STAGING_BRANCH, PRODUCTION_BRANCH].filter((branch2) => Boolean(branch2)), {
         operation: "save",
@@ -3104,7 +3846,7 @@ async function workflowSave(helpers, input) {
       if (branch === PRODUCTION_BRANCH && !optionsHotfix) {
         workflowError("save", "unsupported_state", "Treeseed save is blocked on main unless --hotfix is explicitly set.");
       }
-      const packageReports = createWorkspacePackageReports(root);
+      const packageReports = createManagedWorkflowRepoReports(root);
       const rootRepo = createRepoReport("@treeseed/market", gitRoot, branch, hasMeaningfulChanges(gitRoot));
       const blockers = [];
       if (executionMode === "plan") {
@@ -3121,7 +3863,7 @@ async function workflowSave(helpers, input) {
           message,
           bump: effectiveInput.bump ?? "patch",
           devVersionStrategy: effectiveInput.devVersionStrategy ?? "prerelease",
-          devDependencyReferenceMode: effectiveInput.devDependencyReferenceMode ?? "git-tag",
+          devDependencyReferenceMode: effectiveInput.devDependencyReferenceMode ?? "git-commit",
           gitDependencyProtocol: effectiveInput.gitDependencyProtocol ?? "preserve-origin",
           gitRemoteWriteMode: effectiveInput.gitRemoteWriteMode ?? "ssh-pushurl",
           verifyMode: normalizeSaveVerifyMode(effectiveInput.verify === false ? "skip" : effectiveInput.verifyMode),
@@ -3160,8 +3902,9 @@ async function workflowSave(helpers, input) {
               { id: "workspace-unlink", description: "Remove local workspace links before deployment install and lockfile updates" },
               ...repositoryPlan.plannedSteps,
               { id: "lockfile-validation", description: "Validate refreshed package-lock.json files before any save commit is pushed" },
-              ...shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? [{ id: "hosted-ci", description: `Wait for hosted save workflows on ${branch}` }] : [],
-              ...branch === STAGING_BRANCH ? [{ id: "release-candidate", description: `Run ${releaseCandidateMode} release-candidate readiness checks for the saved staging state` }] : [],
+              ...shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? [{ id: "hosted-ci", description: saveHostedEnvironmentForBranch(branch) ? `Reconcile and verify hosted deployments for ${saveHostedEnvironmentForBranch(branch)}` : `Wait for hosted save workflows on ${branch}` }] : [],
+              ...saveLane === "promotion" ? [{ id: "release-proof", description: "Run or reuse authoritative hosted release proof records for exact package refs" }] : [],
+              ...branch === STAGING_BRANCH && releaseCandidateMode !== "skip" ? [{ id: "release-candidate", description: `Run ${releaseCandidateMode} release-candidate readiness checks for the saved staging state` }] : [],
               { id: "workspace-link", description: "Restore local workspace links after save" },
               ...beforeState.branchRole === "feature" && (effectiveInput.preview === true || previewInitialized) ? [{ id: "preview", description: `Refresh preview deployment for ${branch}` }] : []
             ]
@@ -3193,7 +3936,7 @@ async function workflowSave(helpers, input) {
           verify: effectiveInput.verify !== false,
           bump: effectiveInput.bump ?? "patch",
           devVersionStrategy: effectiveInput.devVersionStrategy ?? "prerelease",
-          devDependencyReferenceMode: effectiveInput.devDependencyReferenceMode ?? "git-tag",
+          devDependencyReferenceMode: effectiveInput.devDependencyReferenceMode ?? "git-commit",
           gitDependencyProtocol: effectiveInput.gitDependencyProtocol ?? "preserve-origin",
           gitRemoteWriteMode: effectiveInput.gitRemoteWriteMode ?? "ssh-pushurl",
           verifyMode: effectiveInput.verifyMode ?? (effectiveInput.verify === false ? "skip" : "fast"),
@@ -3216,13 +3959,21 @@ async function workflowSave(helpers, input) {
           },
           ...shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? [{
             id: "hosted-ci",
-            description: `Wait for hosted save workflows on ${branch}`,
+            description: saveHostedEnvironmentForBranch(branch) ? `Reconcile and verify hosted deployments for ${saveHostedEnvironmentForBranch(branch)}` : `Wait for hosted save workflows on ${branch}`,
+            repoName: rootRepo.name,
+            repoPath: rootRepo.path,
+            branch,
+            resumable: true
+          }] : [],
+          ...saveLane === "promotion" ? [{
+            id: "release-proof",
+            description: "Run authoritative hosted release proof records",
             repoName: rootRepo.name,
             repoPath: rootRepo.path,
             branch,
             resumable: true
           }] : [],
-          ...branch === STAGING_BRANCH ? [{
+          ...branch === STAGING_BRANCH && releaseCandidateMode !== "skip" ? [{
             id: "release-candidate",
             description: "Run release-candidate readiness checks",
             repoName: rootRepo.name,
@@ -3263,19 +4014,21 @@ async function workflowSave(helpers, input) {
               message,
               bump: effectiveInput.bump ?? "patch",
               devVersionStrategy: effectiveInput.devVersionStrategy ?? "prerelease",
-              devDependencyReferenceMode: effectiveInput.devDependencyReferenceMode ?? "git-tag",
+              devDependencyReferenceMode: effectiveInput.devDependencyReferenceMode ?? "git-commit",
               gitDependencyProtocol: effectiveInput.gitDependencyProtocol ?? "preserve-origin",
               gitRemoteWriteMode: effectiveInput.gitRemoteWriteMode ?? "ssh-pushurl",
               verifyMode: normalizeSaveVerifyMode(effectiveInput.verify === false ? "skip" : effectiveInput.verifyMode),
               commitMessageMode: effectiveInput.commitMessageMode ?? "auto",
               workflowRunId: workflowRun.runId,
+              deferPushUntilVerified: branch === STAGING_BRANCH,
               onProgress: (line, stream) => helpers.write(line, stream),
               onWaveSaved: branch === STAGING_BRANCH && shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? async ({ nodes, reports, rootRepo: waveRootRepo }) => {
                 const nonRootReportsForWave = reports.filter((repo, index) => nodes[index]?.id !== ".");
                 const rootReportForWave = nodes.some((node) => node.id === ".") ? waveRootRepo : null;
+                const hostedEnvironment = saveHostedEnvironmentForBranch(branch);
                 const gates = [
                   ...gatesForSavedRepositoryReports(root, nonRootReportsForWave),
-                  ...rootReportForWave ? gateForSavedRootReport(rootReportForWave, branch, scope) : []
+                  ...rootReportForWave && !hostedEnvironment ? gateForSavedRootReport(rootReportForWave, branch, scope) : []
                 ];
                 if (gates.length === 0) {
                   return [];
@@ -3283,7 +4036,7 @@ async function workflowSave(helpers, input) {
                 const repositoryNames = gates.map((gate) => gate.name).join(", ");
                 if (nonRootReportsForWave.length > 0) {
                   helpers.write(`[save][workflow] Waiting for hosted repository gates before saving dependents: ${repositoryNames}.`);
-                } else if (rootReportForWave) {
+                } else if (rootReportForWave && !hostedEnvironment) {
                   helpers.write("[save][workflow] Waiting for hosted market deploy gate.");
                 }
                 return waitForWorkflowGates("save", gates, "hosted", {
@@ -3300,7 +4053,7 @@ async function workflowSave(helpers, input) {
         const savedPackageReports = saveResult?.repos ?? packageReports;
         const savedRootRepo = saveResult?.rootRepo ?? rootRepo;
         helpers.write("[save][workflow] Repository save phase complete; checking command readiness.");
-        const head = savedRootRepo.commitSha ?? run("git", ["rev-parse", "HEAD"], { cwd: gitRoot, capture: true }).trim();
+        const head = savedRootRepo.commitSha ?? runGit(["rev-parse", "HEAD"], { cwd: gitRoot, capture: true }).trim();
         const commitCreated = savedRootRepo.committed === true;
         const branchSync = {
           ...savedRootRepo.publishWait ?? {},
@@ -3317,42 +4070,12 @@ async function workflowSave(helpers, input) {
           }))
         };
         const saveWorkflowGates = shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? await executeJournalStep(root, workflowRun.runId, "hosted-ci", async () => {
-          if (branch === STAGING_BRANCH) {
+          const hostedEnvironment = saveHostedEnvironmentForBranch(branch);
+          if (hostedEnvironment) {
             const workflowGates = saveResult?.workflowGates ?? [];
-            if (effectiveInput.verifyDeployedResources !== true || scope === "local" || !savedRootRepo.commitSha) {
-              return { workflowGates };
-            }
-            helpers.write("[save][workflow] Dispatching hosted market deploy gate for deployed resource verification.");
-            const repository = resolveGitHubRepositorySlug(savedRootRepo.path);
-            await dispatchGitHubWorkflowRun(repository, {
-              workflow: "deploy.yml",
-              branch,
-              inputs: {
-                environment: "staging",
-                action_kind: "deploy_web"
-              }
-            });
-            await sleep(5e3);
-            helpers.write("[save][workflow] Waiting for hosted market deploy gate.");
-            const dispatchedGates = await waitForWorkflowGates("save", [
-              hostedDeployGate({
-                name: savedRootRepo.name,
-                repoPath: savedRootRepo.path,
-                repository,
-                workflow: "deploy.yml",
-                branch,
-                headSha: savedRootRepo.commitSha
-              })
-            ], "hosted", {
-              root,
-              runId: workflowRun.runId,
-              onProgress: (line, stream) => helpers.write(line, stream)
-            });
             return {
-              workflowGates: [
-                ...workflowGates.filter((gate) => !(gate.repository === repository && gate.workflow === "deploy.yml")),
-                ...dispatchedGates
-              ]
+              workflowGates,
+              hostedReconcile: await reconcileSaveHostedEnvironment(root, hostedEnvironment, helpers, workflowRun.runId)
             };
           }
           helpers.write("[save][workflow] Waiting for hosted save workflow gates.");
@@ -3371,21 +4094,44 @@ async function workflowSave(helpers, input) {
               branch,
               headSha: savedRootRepo.commitSha
             })] : [],
-            ...savedPackageReports.filter((repo) => repo.pushed && repo.commitSha && repo.branch).map((repo) => ({
-              name: repo.name,
-              repoPath: repo.path,
-              workflow: "verify.yml",
-              branch: String(repo.branch),
-              headSha: String(repo.commitSha)
-            }))
+            ...savedPackageReports.filter((repo) => repo.pushed && repo.commitSha && repo.branch).map((repo) => {
+              const workflow = hostedWorkflowForSavedRepository(root, repo);
+              const gate = {
+                name: repo.name,
+                repoPath: repo.path,
+                workflow,
+                branch: String(repo.branch),
+                headSha: String(repo.commitSha)
+              };
+              return /^deploy(?:[-.]|$)/u.test(workflow) ? hostedDeployGate(gate) : gate;
+            })
           ], "hosted", {
             root,
             runId: workflowRun.runId,
             onProgress: (line, stream) => helpers.write(line, stream)
           }).then((workflowGates) => ({ workflowGates }));
         }) : { workflowGates: [] };
-        const releaseCandidate = branch === STAGING_BRANCH ? await executeJournalStep(root, workflowRun.runId, "release-candidate", () => {
-          helpers.write(`[save][workflow] Running staging release-candidate readiness checks (${releaseCandidateMode}).`);
+        const releaseProof = saveLane === "promotion" && process.env.TREESEED_STAGE_WAIT_MODE !== "skip" ? await executeJournalStep(root, workflowRun.runId, "release-proof", async () => {
+          helpers.write("[save][workflow] Running authoritative hosted release proof.");
+          const proof = await runTreeseedProof({
+            root,
+            target: scope === "prod" ? "prod" : scope === "local" ? "local" : "staging",
+            driver: "github-hosted",
+            write: (line, stream) => helpers.write(line, stream)
+          });
+          if (proof.failures.length > 0) {
+            const first = proof.failures[0];
+            workflowError("save", "validation_failed", [
+              "Treeseed promotion proof failed.",
+              `- ${first.subject.id}: ${first.invalidationReasons[0] ?? first.status}`,
+              first.result.workflow?.url ? `Run: ${first.result.workflow.url}` : null,
+              "Hosted GitHub workflow proof is authoritative; local action simulation is advisory."
+            ].filter(Boolean).join("\n"), { details: { proof } });
+          }
+          return proof;
+        }) : saveLane === "promotion" ? (skipJournalStep(root, workflowRun.runId, "release-proof", { skippedReason: "disabled" }), { skipped: true, reason: "disabled" }) : null;
+        const releaseCandidate = branch === STAGING_BRANCH && releaseCandidateMode !== "skip" ? await executeJournalStep(root, workflowRun.runId, "release-candidate", () => {
+          helpers.write(`[save][workflow] Running staging release-candidate proof checks (${releaseCandidateMode}).`);
           const releaseSession = resolveTreeseedWorkflowSession(root);
           const stagingReleasePlan = buildReleasePlanSnapshot({
             root,
@@ -3396,19 +4142,23 @@ async function workflowSave(helpers, input) {
             rootRepo: savedRootRepo,
             blockers: []
           });
-          return runReleaseCandidateForPlan("save", root, stagingReleasePlan, { mode: releaseCandidateMode });
+          return runReleaseCandidateProofForPlan("save", root, stagingReleasePlan, {
+            mode: releaseCandidateMode,
+            lane: saveLane,
+            write: (line, stream) => helpers.write(line, stream)
+          });
         }) : null;
         let previewAction = { status: "skipped" };
         if (beforeState.branchRole === "feature" && branch) {
           if (effectiveInput.preview === true) {
             previewAction = {
               status: previewInitialized ? "refreshed" : "created",
-              details: await executeJournalStep(root, workflowRun.runId, "preview", () => deployBranchPreview(root, branch, helpers.context, { initialize: !previewInitialized }))
+              details: await executeJournalStep(root, workflowRun.runId, "preview", () => reconcileWorkflowBranchPreview(root, branch, helpers.context, { initialize: !previewInitialized }))
             };
           } else if (effectiveInput.refreshPreview !== false && previewInitialized) {
             previewAction = {
               status: "refreshed",
-              details: await executeJournalStep(root, workflowRun.runId, "preview", () => deployBranchPreview(root, branch, helpers.context, { initialize: false }))
+              details: await executeJournalStep(root, workflowRun.runId, "preview", () => reconcileWorkflowBranchPreview(root, branch, helpers.context, { initialize: false }))
             };
           }
         }
@@ -3417,7 +4167,7 @@ async function workflowSave(helpers, input) {
             selected: savedPackageReports.map((report) => report.name)
           }
         });
-        const hostingAudit = await runWorkflowHostedResourceVerification(
+        const hostingAudit = await workflowHostedVerificationGateRequired(
           "save",
           root,
           helpers,
@@ -3458,7 +4208,9 @@ async function workflowSave(helpers, input) {
           releaseCandidateMode,
           applicationSelection,
           workflowGates: saveWorkflowGates?.workflowGates ?? [],
+          hostedReconcile: saveWorkflowGates?.hostedReconcile ?? null,
           releaseCandidate,
+          releaseProof,
           hostingAudit,
           ...worktreePayload(root, effectiveInput.worktreeMode)
         };
@@ -3540,17 +4292,17 @@ async function workflowClose(helpers, input) {
               failure: planAutoResumeRun.failure
             } : null,
             ...worktreePayload(root, effectiveInput.worktreeMode),
-            autoSaveRequired: session.rootRepo.dirty || session.packageRepos.some((repo) => repo.dirty),
-            repos: createWorkspacePackageReports(root),
+            autoSaveRequired: session.rootRepo.dirty || session.managedRepos.some((repo) => repo.dirty),
+            repos: createManagedWorkflowRepoReports(root),
             rootRepo: createWorkspaceRootRepoReport(root),
             blockers,
             plannedSteps: [
               { id: "workspace-unlink", description: "Remove local workspace links before task cleanup" },
               { id: "preview-cleanup", description: `Destroy preview resources for ${branchName ?? "(current task)"}` },
               { id: "cleanup-root", description: `Archive and delete ${branchName ?? "(current task)"} in market` },
-              ...checkedOutWorkspacePackageRepos(root).map((pkg) => ({
-                id: `cleanup-${pkg.name}`,
-                description: `Archive and delete ${branchName ?? "(current task)"} in ${pkg.name}`
+              ...checkedOutManagedWorkflowRepos(root).map((repo) => ({
+                id: `cleanup-${repo.name}`,
+                description: `Archive and delete ${branchName ?? "(current task)"} in ${repo.name}`
               })),
               { id: "workspace-link", description: "Restore local workspace links on the final branch" },
               ...isManagedWorkflowWorktree(root) ? [{ id: "worktree-cleanup", description: "Remove managed workflow worktree" }] : []
@@ -3572,6 +4324,7 @@ async function workflowClose(helpers, input) {
       const featureBranch = assertFeatureBranch(root);
       const mode = activeSession.mode;
       const repoDir = activeSession.gitRoot;
+      const managedWorktreeForClose = isManagedWorkflowWorktree(root);
       assertSessionBranchSafety("close", activeSession);
       if (mode === "recursive-workspace") {
         assertWorkspaceClean(root);
@@ -3579,7 +4332,7 @@ async function workflowClose(helpers, input) {
         assertCleanWorktree(root);
       }
       const rootRepo = createWorkspaceRootRepoReport(root);
-      const packageReports = createWorkspacePackageReports(root);
+      const packageReports = createManagedWorkflowRepoReports(root);
       const workflowRun = acquireWorkflowRun(
         "close",
         activeSession,
@@ -3617,30 +4370,34 @@ async function workflowClose(helpers, input) {
       }
       try {
         await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"), { rerunCompleted: true });
-        const previewCleanup = effectiveInput.deletePreview === false ? (skipJournalStep(root, workflowRun.runId, "preview-cleanup", { performed: false }), { performed: false }) : await executeJournalStep(root, workflowRun.runId, "preview-cleanup", () => destroyPreviewIfPresent(root, featureBranch));
+        const previewCleanup = effectiveInput.deletePreview === false ? (skipJournalStep(root, workflowRun.runId, "preview-cleanup", { performed: false }), { performed: false }) : await executeJournalStep(root, workflowRun.runId, "preview-cleanup", () => destroyWorkflowBranchPreviewIfPresent(root, featureBranch, helpers.context));
         const rootCleanup = await executeJournalStep(root, workflowRun.runId, "cleanup-root", () => {
-          const deprecatedTag = createDeprecatedTaskTag(repoDir, featureBranch, `close: ${message}`);
+          const head = updateHead(repoDir);
+          const tag = createDeprecatedTaskTag(repoDir, featureBranch, `close: ${message}`);
           const deletedRemote = effectiveInput.deleteBranch === false ? false : deleteRemoteBranch(repoDir, featureBranch);
-          syncBranchWithOrigin(repoDir, STAGING_BRANCH);
-          if (effectiveInput.deleteBranch !== false) {
+          if (!managedWorktreeForClose) {
+            syncBranchWithOrigin(repoDir, STAGING_BRANCH);
+          }
+          if (effectiveInput.deleteBranch !== false && !managedWorktreeForClose) {
             deleteLocalBranch(repoDir, featureBranch);
           }
           return {
-            deprecatedTag,
+            head,
+            tagName: tag.tagName,
             deletedRemote,
-            deletedLocal: effectiveInput.deleteBranch !== false,
-            branch: currentBranch(repoDir) || STAGING_BRANCH,
+            deletedLocal: effectiveInput.deleteBranch !== false && !managedWorktreeForClose,
+            branch: managedWorktreeForClose ? featureBranch : currentBranch(repoDir) || STAGING_BRANCH,
             dirty: hasMeaningfulChanges(repoDir)
           };
         });
-        rootRepo.tagName = String(rootCleanup?.deprecatedTag?.tagName ?? null);
-        rootRepo.commitSha = String(rootCleanup?.deprecatedTag?.head ?? rootRepo.commitSha ?? "");
+        rootRepo.tagName = typeof rootCleanup?.tagName === "string" ? rootCleanup.tagName : null;
+        rootRepo.commitSha = String(rootCleanup?.head ?? rootRepo.commitSha ?? "");
         rootRepo.deletedRemote = rootCleanup?.deletedRemote === true;
         rootRepo.deletedLocal = rootCleanup?.deletedLocal === true;
         rootRepo.branch = typeof rootCleanup?.branch === "string" ? rootCleanup.branch : currentBranch(repoDir) || STAGING_BRANCH;
         rootRepo.dirty = rootCleanup?.dirty === true;
-        for (const pkg of checkedOutWorkspacePackageRepos(root)) {
-          const report = findReportByName(packageReports, pkg.name);
+        for (const managedRepo of checkedOutManagedWorkflowRepos(root)) {
+          const report = findReportByName(packageReports, managedRepo.name);
           if (!report) {
             continue;
           }
@@ -3651,16 +4408,21 @@ async function workflowClose(helpers, input) {
           Object.assign(report, cleanup);
         }
         const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "workspace-link", () => ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
-        const finalBranch = currentBranch(repoDir) || STAGING_BRANCH;
+        const finalBranch = managedWorktreeForClose ? STAGING_BRANCH : currentBranch(repoDir) || STAGING_BRANCH;
         const managedWorktree = managedWorkflowWorktreeMetadata(root);
-        const worktreeCleanup = isManagedWorkflowWorktree(root) ? await executeJournalStep(root, workflowRun.runId, "worktree-cleanup", () => removeManagedWorkflowWorktree(root)) : { removed: false, reason: "not-managed" };
+        const worktreeCleanup = managedWorktreeForClose ? await executeJournalStep(root, workflowRun.runId, "worktree-cleanup", () => removeManagedWorkflowWorktree(root, {
+          deleteBranch: effectiveInput.deleteBranch !== false
+        })) : { removed: false, reason: "not-managed" };
+        if (worktreeCleanup.deletedLocalBranch === true) {
+          rootRepo.deletedLocal = true;
+          rootRepo.branch = STAGING_BRANCH;
+        }
         const payload = {
           mode,
           branchName: featureBranch,
           message,
           autoSaved: autoSave.performed,
           autoSaveResult: autoSave.save,
-          deprecatedTag: rootCleanup?.deprecatedTag ?? null,
           repos: packageReports,
           rootRepo,
           previewCleanup,
@@ -3681,6 +4443,7 @@ async function workflowClose(helpers, input) {
           payload,
           {
             runId: workflowRun.runId,
+            includeFinalState: !managedWorktreeForClose,
             nextSteps: createNextSteps([
               { operation: "tasks", reason: "Inspect the remaining task branches after closing this one." }
             ])
@@ -3703,371 +4466,460 @@ async function workflowClose(helpers, input) {
     toError("close", error);
   }
 }
+function normalizeStageVerifyMode(value) {
+  return value === "local" || value === "none" ? value : "action";
+}
+function normalizeStageCiMode(input) {
+  if (input.ciMode === "hosted" || input.waitForStaging === true) return "hosted";
+  return "off";
+}
+function normalizeStageCleanupMode(input) {
+  if (input.cleanupMode === "success" || input.deleteBranch === true) return "success";
+  return "manual";
+}
+function stageCandidateManifestPath(root, runId) {
+  return {
+    latest: resolve(root, ".treeseed", "workflow", "stage-candidates", "latest.json"),
+    run: resolve(root, ".treeseed", "workflow", "runs", runId, "stage-candidate.json")
+  };
+}
+function writeStageCandidateManifest(root, runId, manifest) {
+  const paths = stageCandidateManifestPath(root, runId);
+  for (const filePath of [paths.latest, paths.run]) {
+    mkdirSync(dirname(filePath), { recursive: true });
+    writeFileSync(filePath, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+  }
+  return manifest;
+}
+function checkedOutStagePackageRepos(root) {
+  return checkedOutManagedWorkflowRepos(root).filter((repo) => repo.kind === "package");
+}
+function buildStagePromotionPlan(root, branchName, input) {
+  const gitRoot = repoRoot(root);
+  const repos = [
+    ...checkedOutStagePackageRepos(root).map((repo) => ({
+      name: repo.name,
+      path: repo.dir,
+      kind: "managed",
+      sourceBranch: branchName,
+      targetBranch: STAGING_BRANCH,
+      remoteSourceExists: remoteBranchExists(repo.dir, branchName),
+      beforeHead: branchExists(repo.dir, branchName) ? headCommit(repo.dir, branchName) : null,
+      stagingHeadBefore: remoteBranchExists(repo.dir, STAGING_BRANCH) ? remoteHeadCommit(repo.dir, STAGING_BRANCH) : null
+    })),
+    {
+      name: "@treeseed/market",
+      path: gitRoot,
+      kind: "root",
+      sourceBranch: branchName,
+      targetBranch: STAGING_BRANCH,
+      remoteSourceExists: remoteBranchExists(gitRoot, branchName),
+      beforeHead: branchExists(gitRoot, branchName) ? headCommit(gitRoot, branchName) : null,
+      stagingHeadBefore: remoteBranchExists(gitRoot, STAGING_BRANCH) ? remoteHeadCommit(gitRoot, STAGING_BRANCH) : null
+    }
+  ];
+  return {
+    schemaVersion: 1,
+    branchName,
+    targetBranch: STAGING_BRANCH,
+    updateFrom: input.updateFrom,
+    verifyMode: input.verifyMode,
+    ciMode: input.ciMode,
+    cleanupMode: input.cleanupMode,
+    repos,
+    phases: [
+      "preflight",
+      "merge-staging-down",
+      "save-integrated-feature",
+      "verify-integrated-feature",
+      "promote-to-staging",
+      "verify-staging-refs",
+      "workspace-link-restore",
+      "cleanup-source"
+    ]
+  };
+}
+function stagePreflightBlockers(root, branchName, plan) {
+  const blockers = [];
+  if (!branchName || branchName === STAGING_BRANCH || branchName === PRODUCTION_BRANCH) {
+    blockers.push(`stage requires a feature branch; current branch is ${branchName || "(none)"}.`);
+  }
+  for (const repo of plan.repos) {
+    const branch = currentBranch(repo.path) || null;
+    if (hasMeaningfulChanges(repo.path)) {
+      blockers.push(`${repo.name} has uncommitted changes.`);
+    }
+    if (branch !== branchName && repo.kind === "managed" && repo.remoteSourceExists) {
+      blockers.push(`${repo.name} is on ${branch ?? "(detached)"} instead of ${branchName}.`);
+    }
+    if (repo.kind === "root" && branch !== branchName) {
+      blockers.push(`${repo.name} is on ${branch ?? "(detached)"} instead of ${branchName}.`);
+    }
+    try {
+      originRemoteUrl(repo.path);
+    } catch {
+      blockers.push(`${repo.name} has no readable origin remote.`);
+    }
+    if (repo.kind === "root" && !repo.remoteSourceExists) {
+      blockers.push(`${repo.name} feature branch ${branchName} has not been pushed to origin.`);
+    }
+    if (repo.kind === "managed" && branchExists(repo.path, branchName) && repo.remoteSourceExists) {
+      const localHead = headCommit(repo.path, branchName);
+      const remoteHead = remoteHeadCommit(repo.path, branchName);
+      if (localHead !== remoteHead) {
+        blockers.push(`${repo.name} local ${branchName} (${localHead.slice(0, 12)}) does not match origin/${branchName} (${remoteHead.slice(0, 12)}). Run save first.`);
+      }
+    }
+  }
+  return blockers;
+}
+function stageConflictError(message, details) {
+  return new TreeseedWorkflowError("stage", "merge_conflict", message, {
+    details,
+    exitCode: 12
+  });
+}
+function createStageCandidateManifest(root, runId, branchName, plan, verification) {
+  const gitRoot = repoRoot(root);
+  const packageRepos = plan.repos.filter((repo) => repo.kind === "managed" && repo.remoteSourceExists);
+  return {
+    schemaVersion: 1,
+    kind: "treeseed.stage-candidate",
+    runId,
+    branchName,
+    targetBranch: STAGING_BRANCH,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    root: {
+      repo: "@treeseed/market",
+      commit: headCommit(gitRoot),
+      verified: verification.status === "passed" || verification.status === "skipped"
+    },
+    packages: packageRepos.map((repo) => ({
+      name: repo.name,
+      path: repo.path,
+      commit: headCommit(repo.path),
+      remote: (() => {
+        try {
+          return originRemoteUrl(repo.path);
+        } catch {
+          return null;
+        }
+      })(),
+      verified: verification.status === "passed" || verification.status === "skipped"
+    })),
+    verification,
+    stagingHeadsBefore: Object.fromEntries(plan.repos.map((repo) => [repo.name, repo.stagingHeadBefore]))
+  };
+}
+function cleanupStageSourceBranches(root, branchName, manifest) {
+  const results = [];
+  for (const repo of checkedOutStagePackageRepos(root)) {
+    const manifestRepo = manifest.packages.find((entry) => entry.name === repo.name);
+    if (!manifestRepo) continue;
+    const remoteDeleted = deleteRemoteBranch(repo.dir, branchName);
+    if ((currentBranch(repo.dir) || null) === branchName) {
+      syncBranchWithOrigin(repo.dir, STAGING_BRANCH);
+    }
+    const localExists = branchExists(repo.dir, branchName);
+    if (localExists && (currentBranch(repo.dir) || null) !== branchName) {
+      deleteLocalBranch(repo.dir, branchName);
+    }
+    results.push({
+      name: repo.name,
+      path: repo.dir,
+      remoteDeleted,
+      localDeleted: localExists && !branchExists(repo.dir, branchName)
+    });
+  }
+  const gitRoot = repoRoot(root);
+  const rootRemoteDeleted = deleteRemoteBranch(gitRoot, branchName);
+  const managedWorktree = managedWorkflowWorktreeMetadata(root);
+  const worktreeCleanup = managedWorktree ? removeManagedWorkflowWorktree(root, { deleteBranch: false }) : { removed: false, reason: "not-managed" };
+  const branchDeletionRoot = managedWorktree?.primaryRoot ? repoRoot(managedWorktree.primaryRoot) : gitRoot;
+  if (!managedWorktree && (currentBranch(gitRoot) || null) === branchName) {
+    syncBranchWithOrigin(gitRoot, STAGING_BRANCH);
+  }
+  const rootLocalExists = branchExists(branchDeletionRoot, branchName);
+  if (rootLocalExists && (currentBranch(branchDeletionRoot) || null) !== branchName) {
+    deleteLocalBranch(branchDeletionRoot, branchName);
+  }
+  results.push({
+    name: "@treeseed/market",
+    path: branchDeletionRoot,
+    remoteDeleted: rootRemoteDeleted,
+    localDeleted: rootLocalExists && !branchExists(branchDeletionRoot, branchName)
+  });
+  return {
+    status: "completed",
+    repos: results,
+    worktreeCleanup
+  };
+}
 async function workflowStage(helpers, input) {
   try {
     return await withContextEnv(helpers.context.env, async () => {
       const tenantRoot = resolveProjectRootOrThrow("stage", helpers.cwd());
       const root = workspaceRoot(tenantRoot);
       const executionMode = normalizeExecutionMode(input);
-      const initialSession = resolveTreeseedWorkflowSession(root);
+      const session = resolveTreeseedWorkflowSession(root);
       const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? null;
-      const autoResumeRun = executionMode === "execute" && !explicitResumeRunId ? findAutoResumableTaskRun(root, "stage", initialSession.branchName) : null;
-      const planAutoResumeRun = executionMode === "plan" ? findAutoResumableTaskRun(root, "stage", initialSession.branchName) : null;
+      const rawAutoResumeRun = executionMode === "execute" && !explicitResumeRunId ? findAutoResumableTaskRun(root, "stage", session.branchName) : null;
+      const autoResumeRun = rawAutoResumeRun?.steps.some((step) => step.id === "preflight") ? rawAutoResumeRun : null;
+      const planAutoResumeRun = executionMode === "plan" ? findAutoResumableTaskRun(root, "stage", session.branchName) : null;
       const effectiveInput = autoResumeRun ? autoResumeRun.input : input;
       const message = ensureMessage("stage", effectiveInput.message, "a resolution message");
-      const ciMode = normalizeCiMode(effectiveInput.ciMode, "stage");
-      const waitForStaging = effectiveInput.verifyDeployedResources === true || effectiveInput.waitForStaging !== false;
-      if (executionMode === "plan") {
-        const blockers = [];
-        if (initialSession.branchRole !== "feature") {
-          blockers.push("Stage only applies to task branches.");
-        }
-        try {
-          validateStagingWorkflowContracts(root);
-        } catch (error) {
-          blockers.push(error instanceof Error ? error.message : String(error));
-        }
-        const applicationSelection = selectWorkflowApplications(root, { packageSelection: initialSession.packageSelection });
-        const readiness = collectTreeseedDeploymentReadiness({
-          tenantRoot: root,
-          environment: "staging",
-          appId: singleSelectedWorkflowAppId(applicationSelection)
-        });
-        blockers.push(...readiness.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.message}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`));
-        return buildWorkflowResult(
-          "stage",
-          root,
-          {
-            mode: initialSession.mode,
-            branchName: initialSession.branchName,
-            mergeTarget: STAGING_BRANCH,
-            mergeStrategy: "squash",
-            message,
-            ciMode,
-            applicationSelection,
-            autoResumeCandidate: planAutoResumeRun ? {
-              runId: planAutoResumeRun.runId,
-              branch: planAutoResumeRun.session.branchName,
-              failure: planAutoResumeRun.failure
-            } : null,
-            ...worktreePayload(root, effectiveInput.worktreeMode),
-            autoSaveRequired: initialSession.rootRepo.dirty || initialSession.packageRepos.some((repo) => repo.dirty),
-            blockers,
-            readiness,
-            rootRepo: createWorkspaceRootRepoReport(root),
-            repos: createWorkspacePackageReports(root),
-            plannedSteps: [
-              ...checkedOutWorkspacePackageRepos(root).map((pkg) => ({
-                id: `merge-${pkg.name}`,
-                description: `Squash-merge ${initialSession.branchName ?? "(current task)"} into ${pkg.name} staging`
-              })),
-              { id: "workspace-unlink", description: "Remove local workspace links before staging promotion" },
-              { id: "merge-root", description: `Squash-merge ${initialSession.branchName ?? "(current task)"} into market staging` },
-              { id: "lockfile-validation", description: "Refresh and validate the merged root workspace lockfile before pushing staging" },
-              { id: "wait-staging", description: "Wait for exact-SHA staging GitHub Actions gates" },
-              { id: "release-candidate", description: "Run release-candidate readiness checks for the exact staging state" },
-              { id: "preview-cleanup", description: "Destroy preview resources" },
-              { id: "cleanup-root", description: "Archive and delete the task branch from market" },
-              ...checkedOutWorkspacePackageRepos(root).map((pkg) => ({
-                id: `cleanup-${pkg.name}`,
-                description: `Archive and delete the task branch from ${pkg.name}`
-              })),
-              { id: "workspace-link", description: "Restore local workspace links on staging" }
-            ]
-          },
-          {
-            executionMode,
-            nextSteps: createNextSteps([
-              { operation: "stage", reason: "Run without --plan to promote the task branch into staging.", input: { message } }
-            ])
-          }
-        );
+      if (effectiveInput.verifyDeployedResources === true) {
+        workflowError("stage", "validation_failed", "Stage no longer verifies deployed resources. Promote refs with stage, then run staging release/hosting verification separately.");
       }
-      const autoSave = await maybeAutoSaveCurrentTaskBranch(helpers, "stage", {
-        message,
-        autoSave: effectiveInput.autoSave
-      });
-      const session = resolveTreeseedWorkflowSession(root);
-      const featureBranch = assertFeatureBranch(root);
-      const mode = session.mode;
-      assertSessionBranchSafety("stage", session);
-      if (mode === "recursive-workspace") {
-        assertWorkspaceClean(root);
-      } else {
-        assertCleanWorktree(root);
+      const verifyMode = normalizeStageVerifyMode(effectiveInput.verifyMode);
+      const ciMode = normalizeStageCiMode(effectiveInput);
+      const cleanupMode = normalizeStageCleanupMode(effectiveInput);
+      const updateFrom = effectiveInput.updateFrom ?? STAGING_BRANCH;
+      if (updateFrom !== STAGING_BRANCH) {
+        workflowError("stage", "validation_failed", `Stage currently supports only --update-from ${STAGING_BRANCH}. Received ${updateFrom}.`);
       }
-      ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
-      applyTreeseedEnvironmentToProcess({ tenantRoot: root, scope: "staging", override: true });
-      validateStagingWorkflowContracts(root);
-      runWorkspaceSavePreflight({ cwd: root });
-      const stagingReadiness = collectTreeseedDeploymentReadiness({ tenantRoot: root, environment: "staging" });
-      if (!stagingReadiness.ok) {
-        workflowError(
-          "stage",
-          "validation_failed",
-          `Deployment readiness failed for staging:
-${stagingReadiness.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.message}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`).join("\n")}`,
-          { details: { readiness: stagingReadiness } }
-        );
+      const applicationSelection = selectWorkflowApplications(root, { packageSelection: session.packageSelection });
+      const featureBranch = executionMode === "execute" ? assertFeatureBranch(root) : session.branchName ?? "";
+      let plan = buildStagePromotionPlan(root, featureBranch, { verifyMode, ciMode, cleanupMode, updateFrom });
+      let blockers = stagePreflightBlockers(root, featureBranch, plan);
+      const basePayload = {
+        mode: "stage-promotion",
+        branchName: featureBranch,
+        branchRole: session.branchRole,
+        mergeTarget: STAGING_BRANCH,
+        mergeStrategy: "merge-staging-down-then-exact-sha",
+        message,
+        verifyMode,
+        ciMode,
+        cleanupMode,
+        updateFrom,
+        waitForStaging: ciMode === "hosted",
+        applicationSelection,
+        plan,
+        phases: plan.phases,
+        blockers,
+        autoResumeCandidate: planAutoResumeRun ? {
+          runId: planAutoResumeRun.runId,
+          branch: planAutoResumeRun.session.branchName,
+          failure: planAutoResumeRun.failure
+        } : null,
+        legacyMutationPathDisabled: true,
+        ...worktreePayload(root, effectiveInput.worktreeMode)
+      };
+      if (executionMode === "plan") {
+        return buildWorkflowResult("stage", root, basePayload, {
+          executionMode,
+          summary: blockers.length > 0 ? "Treeseed stage plan blocked." : "Treeseed stage promotion plan ready.",
+          includeFinalState: false,
+          nextSteps: createNextSteps([
+            blockers.length > 0 ? { operation: "status", reason: "Resolve blockers before staging." } : { operation: "stage", reason: "Promote the verified feature branch to staging.", input: { message } }
+          ])
+        });
       }
-      const repoDir = session.gitRoot;
-      const rootRepo = createWorkspaceRootRepoReport(root);
-      const packageReports = createWorkspacePackageReports(root);
-      const workflowRun = acquireWorkflowRun(
-        "stage",
-        session,
-        {
+      if (effectiveInput.autoSave === true) {
+        await maybeAutoSaveCurrentTaskBranch(helpers, "stage", {
           message,
-          waitForStaging,
-          deletePreview: effectiveInput.deletePreview !== false,
-          deleteBranch: effectiveInput.deleteBranch !== false,
-          ciMode,
-          worktreeMode: effectiveInput.worktreeMode ?? "auto",
-          verifyDeployedResources: effectiveInput.verifyDeployedResources === true
-        },
-        [
-          { id: "workspace-unlink", description: "Remove local workspace links", repoName: rootRepo.name, repoPath: rootRepo.path, branch: featureBranch, resumable: true },
-          ...packageReports.map((report) => ({
-            id: `merge-${report.name}`,
-            description: `Merge ${featureBranch} into ${report.name} staging`,
-            repoName: report.name,
-            repoPath: report.path,
-            branch: featureBranch,
-            resumable: true
-          })),
-          { id: "merge-root", description: `Merge ${featureBranch} into market staging`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: featureBranch, resumable: true },
-          { id: "wait-staging", description: "Wait for exact-SHA staging GitHub Actions gates", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
-          { id: "release-candidate", description: "Run release-candidate readiness checks", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
-          { id: "preview-cleanup", description: "Destroy preview resources", repoName: rootRepo.name, repoPath: rootRepo.path, branch: featureBranch, resumable: true },
-          { id: "cleanup-root", description: `Archive ${featureBranch} in market`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: featureBranch, resumable: true },
-          ...packageReports.map((report) => ({
-            id: `cleanup-${report.name}`,
-            description: `Archive ${featureBranch} in ${report.name}`,
-            repoName: report.name,
-            repoPath: report.path,
-            branch: featureBranch,
-            resumable: true
-          })),
-          { id: "workspace-link", description: "Restore local workspace links", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
-          ...isManagedWorkflowWorktree(root) ? [{ id: "worktree-cleanup", description: "Remove managed workflow worktree", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: false }] : []
-        ],
-        autoResumeRun ? {
-          ...helpers.context,
-          workflow: {
-            ...helpers.context.workflow ?? {},
-            resumeRunId: autoResumeRun.runId
-          }
-        } : helpers.context
-      );
-      if (autoResumeRun) {
-        helpers.write(`[workflow][resume] Resuming interrupted stage ${autoResumeRun.runId} on ${featureBranch}.`);
+          autoSave: true,
+          verify: false,
+          preview: false
+        });
+        plan = buildStagePromotionPlan(root, featureBranch, { verifyMode, ciMode, cleanupMode, updateFrom });
+        blockers = stagePreflightBlockers(root, featureBranch, plan);
+      }
+      if (blockers.length > 0) {
+        workflowError("stage", "validation_failed", `stage is blocked:
+${blockers.map((entry) => `- ${entry}`).join("\n")}`, {
+          details: { blockers, plan }
+        });
       }
+      const workflowRun = acquireWorkflowRun("stage", resolveTreeseedWorkflowSession(root), {
+        ...effectiveInput,
+        verifyMode,
+        ciMode,
+        cleanupMode,
+        updateFrom
+      }, [
+        { id: "preflight", description: "Validate clean feature branch before staging", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: featureBranch, resumable: true },
+        { id: "merge-staging-down", description: "Merge staging into feature branches", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: featureBranch, resumable: true },
+        { id: "save-integrated-feature", description: "Save integrated feature state after staging merge-down", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: featureBranch, resumable: true },
+        { id: "verify-integrated-feature", description: "Run local proof before staging mutation", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: featureBranch, resumable: true },
+        { id: "write-stage-candidate", description: "Write exact stage candidate manifest", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: featureBranch, resumable: true },
+        { id: "promote-to-staging", description: "Promote exact verified refs to staging", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: featureBranch, resumable: true },
+        { id: "verify-staging-refs", description: "Verify remote staging refs match promoted commits", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: STAGING_BRANCH, resumable: true },
+        { id: "hosted-ci", description: "Wait for hosted staging CI when explicitly requested", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: STAGING_BRANCH, resumable: true },
+        { id: "workspace-link-restore", description: "Restore local workspace links after stage", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: STAGING_BRANCH, resumable: true },
+        { id: "cleanup-source", description: "Clean up source branches and worktree after successful promotion", repoName: "@treeseed/market", repoPath: repoRoot(root), branch: featureBranch, resumable: true }
+      ], helpers.context);
       try {
-        await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"), { rerunCompleted: true });
-        for (const pkg of checkedOutWorkspacePackageRepos(root)) {
-          const report = findReportByName(packageReports, pkg.name);
-          if (!report) {
-            continue;
-          }
-          if (!ensureLocalTaskBranch(pkg.dir, featureBranch)) {
-            report.skippedReason = "branch-missing";
-            skipJournalStep(root, workflowRun.runId, `merge-${report.name}`, { skippedReason: "branch-missing" });
-            continue;
+        await executeJournalStep(root, workflowRun.runId, "preflight", () => {
+          const currentPlan = buildStagePromotionPlan(root, featureBranch, { verifyMode, ciMode, cleanupMode, updateFrom });
+          const currentBlockers = stagePreflightBlockers(root, featureBranch, currentPlan);
+          if (currentBlockers.length > 0) {
+            workflowError("stage", "validation_failed", `stage is blocked:
+${currentBlockers.map((entry) => `- ${entry}`).join("\n")}`, {
+              details: { blockers: currentBlockers, plan: currentPlan }
+            });
           }
+          return { status: "passed", checkedAt: (/* @__PURE__ */ new Date()).toISOString() };
+        });
+        const mergeDown = await executeJournalStep(root, workflowRun.runId, "merge-staging-down", () => {
+          const results = [];
           try {
-            const mergeResult = await executeJournalStep(root, workflowRun.runId, `merge-${report.name}`, () => squashMergeBranchIntoStaging(pkg.dir, featureBranch, message, { pushTarget: true }));
-            report.merged = mergeResult.committed;
-            report.committed = mergeResult.committed;
-            report.pushed = mergeResult.pushed;
-            report.commitSha = mergeResult.commitSha;
-            report.branch = STAGING_BRANCH;
-            checkoutBranch(pkg.dir, featureBranch);
-            report.branch = featureBranch;
+            for (const repo of checkedOutStagePackageRepos(root)) {
+              if (!remoteBranchExists(repo.dir, featureBranch)) {
+                results.push({ name: repo.name, path: repo.dir, skipped: true, reason: "remote-branch-missing" });
+                continue;
+              }
+              results.push({
+                name: repo.name,
+                path: repo.dir,
+                ...mergeBranchDownIntoFeature(repo.dir, {
+                  featureBranch,
+                  sourceBranch: STAGING_BRANCH,
+                  message: `stage: merge ${STAGING_BRANCH} into ${featureBranch}`,
+                  allowGeneratedMetadataAutoResolution: true
+                })
+              });
+            }
+            results.push({
+              name: "@treeseed/market",
+              path: repoRoot(root),
+              ...mergeBranchDownIntoFeature(repoRoot(root), {
+                featureBranch,
+                sourceBranch: STAGING_BRANCH,
+                message: `stage: merge ${STAGING_BRANCH} into ${featureBranch}`,
+                allowGeneratedMetadataAutoResolution: true
+              })
+            });
           } catch (error) {
-            const reportData = collectMergeConflictReport(pkg.dir);
-            throw new TreeseedWorkflowError("stage", "merge_conflict", formatMergeConflictReport(reportData, pkg.dir, STAGING_BRANCH), {
-              details: { branch: featureBranch, packageName: pkg.name, report: reportData, originalError: error instanceof Error ? error.message : String(error) },
-              exitCode: 12
+            const details = error && typeof error === "object" ? error : {};
+            throw stageConflictError(error instanceof Error ? error.message : String(error), {
+              ...details,
+              results,
+              branchName: featureBranch,
+              targetBranch: STAGING_BRANCH
             });
           }
-        }
-        let rootMerge = null;
-        try {
-          rootMerge = await executeJournalStep(root, workflowRun.runId, "merge-root", async () => {
-            assertCleanWorktree(root);
-            if (isManagedWorkflowWorktree(root)) {
-              checkoutDetachedOriginBranch(repoDir, STAGING_BRANCH);
-            } else {
-              syncBranchWithOrigin(repoDir, STAGING_BRANCH);
-            }
-            run("git", ["merge", "--squash", featureBranch], { cwd: repoDir });
-            if (mode === "recursive-workspace") {
-              syncAllCheckedOutPackageRepos(root, STAGING_BRANCH);
-            }
-            const lockfileSafety = await refreshAndValidateRootWorkspaceLockfileForSave({
-              root,
-              gitRoot: repoDir,
-              branch: STAGING_BRANCH,
-              onProgress: (line, stream) => helpers.write(line, stream)
-            });
-            if (hasStagedChanges(repoDir) || hasMeaningfulChanges(repoDir)) {
-              run("git", ["add", "-A"], { cwd: repoDir });
-              run("git", ["commit", "-m", message], { cwd: repoDir });
-            }
-            if (isManagedWorkflowWorktree(root)) {
-              pushHeadToBranch(repoDir, STAGING_BRANCH);
-            } else {
-              pushBranch(repoDir, STAGING_BRANCH);
-            }
-            return {
-              commitSha: headCommit(repoDir),
-              branch: STAGING_BRANCH,
-              committed: hasMeaningfulChanges(repoDir) ? false : true,
-              lockfileValidation: lockfileSafety.lockfileValidation,
-              lockfileInstall: lockfileSafety.install
-            };
-          });
-          rootRepo.merged = true;
-          rootRepo.committed = true;
-          rootRepo.commitSha = String(rootMerge?.commitSha ?? headCommit(repoDir));
-          rootRepo.pushed = true;
-          rootRepo.branch = typeof rootMerge?.branch === "string" ? rootMerge.branch : currentBranch(repoDir) || STAGING_BRANCH;
-        } catch (error) {
-          const report = collectMergeConflictReport(repoDir);
-          throw new TreeseedWorkflowError("stage", "merge_conflict", formatMergeConflictReport(report, repoDir, STAGING_BRANCH), {
-            details: { branch: featureBranch, report, originalError: error instanceof Error ? error.message : String(error) },
-            exitCode: 12
-          });
-        }
-        const stageWorkflowGateResult = !waitForStaging ? (skipJournalStep(root, workflowRun.runId, "wait-staging", { status: "skipped", reason: "disabled" }), { status: "skipped", reason: "disabled" }) : await executeJournalStep(root, workflowRun.runId, "wait-staging", () => waitForWorkflowGates("stage", [
-          hostedDeployGate({
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "deploy.yml",
-            branch: STAGING_BRANCH,
-            headSha: rootRepo.commitSha
-          }),
-          ...packageReports.filter((report) => report.merged && report.commitSha).map((report) => ({
-            name: report.name,
-            repoPath: report.path,
-            workflow: "verify.yml",
-            branch: STAGING_BRANCH,
-            headSha: String(report.commitSha)
-          }))
-        ], ciMode, {
-          root,
-          runId: workflowRun.runId,
-          onProgress: (line, stream) => helpers.write(line, stream)
-        }).then((workflowGates) => ({
-          status: "completed",
-          workflowGates
-        })));
-        const stagingWait = {
-          status: String(stageWorkflowGateResult?.status ?? "completed"),
-          workflowGates: Array.isArray(stageWorkflowGateResult?.workflowGates) ? stageWorkflowGateResult.workflowGates : []
-        };
-        const stageReleasePlan = buildReleasePlanSnapshot({
-          root,
-          mode,
-          level: "patch",
-          packageSelection: session.packageSelection,
-          packageReports,
-          rootRepo,
-          blockers: []
+          return { status: "completed", results };
         });
-        const releaseCandidate = await executeJournalStep(root, workflowRun.runId, "release-candidate", () => runReleaseCandidateForPlan("stage", root, stageReleasePlan));
-        const applicationSelection = selectWorkflowApplications(root, { packageSelection: session.packageSelection });
-        const hostingAudit = await runWorkflowHostedResourceVerification(
-          "stage",
-          root,
-          helpers,
-          "staging",
-          {
-            enabled: effectiveInput.verifyDeployedResources === true,
-            strict: true,
-            live: effectiveInput.verifyDeployedResources === true,
-            appId: singleSelectedWorkflowAppId(applicationSelection)
-          }
-        );
-        const previewCleanup = effectiveInput.deletePreview === false ? (skipJournalStep(root, workflowRun.runId, "preview-cleanup", { performed: false }), { performed: false }) : await executeJournalStep(root, workflowRun.runId, "preview-cleanup", () => destroyPreviewIfPresent(root, featureBranch));
-        const rootCleanup = await executeJournalStep(root, workflowRun.runId, "cleanup-root", () => {
-          const deprecatedTag = createDeprecatedTaskTag(repoDir, featureBranch, `stage: ${message}`);
-          const deletedRemote = effectiveInput.deleteBranch === false ? false : deleteRemoteBranch(repoDir, featureBranch);
-          if (effectiveInput.deleteBranch !== false) {
-            deleteLocalBranch(repoDir, featureBranch);
+        const mergeChanged = Array.isArray(mergeDown?.results) && mergeDown.results.some((entry) => Boolean(entry.merged));
+        const saveResult = mergeChanged || hasMeaningfulChanges(repoRoot(root)) ? await executeJournalStep(root, workflowRun.runId, "save-integrated-feature", () => workflowSave(helpersForCwd(helpers, root), {
+          message: `integrate staging before stage: ${message}`,
+          verifyMode: "skip",
+          ciMode: "off",
+          refreshPreview: false,
+          preview: false,
+          workspaceLinks: effectiveInput.workspaceLinks ?? "auto"
+        })) : (skipJournalStep(root, workflowRun.runId, "save-integrated-feature", { skippedReason: "staging already integrated" }), null);
+        const verification = verifyMode === "none" || process.env.TREESEED_RELEASE_CANDIDATE_REHEARSAL_MODE === "skip" ? (skipJournalStep(root, workflowRun.runId, "verify-integrated-feature", { mode: verifyMode, status: "skipped" }), {
+          mode: verifyMode,
+          status: "skipped",
+          completedAt: null
+        }) : await executeJournalStep(root, workflowRun.runId, "verify-integrated-feature", async () => {
+          const proof = await runTreeseedProof({
+            root,
+            target: "staging",
+            driver: verifyMode === "action" ? "act" : "local",
+            write: (line, stream) => helpers.write(`[stage][verify] ${line}`, stream)
+          });
+          if (proof.failures.length > 0) {
+            const first = proof.failures[0];
+            workflowError("stage", "validation_failed", [
+              "Treeseed stage proof failed.",
+              `- ${first.subject.id}: ${first.invalidationReasons[0] ?? first.status}`,
+              first.result.workflow?.url ? `Run: ${first.result.workflow.url}` : null
+            ].join("\n"), {
+              details: { proof }
+            });
           }
           return {
-            deprecatedTag,
-            deletedRemote,
-            deletedLocal: effectiveInput.deleteBranch !== false,
-            branch: currentBranch(repoDir) || STAGING_BRANCH
+            mode: verifyMode,
+            status: "passed",
+            completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            proof
           };
         });
-        rootRepo.tagName = String(rootCleanup?.deprecatedTag?.tagName ?? rootRepo.tagName ?? "");
-        rootRepo.commitSha = String(rootCleanup?.deprecatedTag?.head ?? rootRepo.commitSha ?? "");
-        rootRepo.deletedRemote = rootCleanup?.deletedRemote === true;
-        rootRepo.deletedLocal = rootCleanup?.deletedLocal === true;
-        rootRepo.branch = typeof rootCleanup?.branch === "string" ? rootCleanup.branch : currentBranch(repoDir) || STAGING_BRANCH;
-        for (const pkg of checkedOutWorkspacePackageRepos(root)) {
-          const report = findReportByName(packageReports, pkg.name);
-          if (!report) {
-            continue;
-          }
-          const cleanup = await executeJournalStep(root, workflowRun.runId, `cleanup-${report.name}`, () => cleanupTaskBranchReport(report, featureBranch, `stage: ${message}`, {
-            deleteBranch: effectiveInput.deleteBranch !== false,
-            targetBranch: STAGING_BRANCH
+        const manifest = await executeJournalStep(root, workflowRun.runId, "write-stage-candidate", () => {
+          const currentPlan = buildStagePromotionPlan(root, featureBranch, { verifyMode, ciMode, cleanupMode, updateFrom });
+          return writeStageCandidateManifest(root, workflowRun.runId, createStageCandidateManifest(root, workflowRun.runId, featureBranch, currentPlan, {
+            mode: verifyMode,
+            status: verification.status,
+            completedAt: verification.completedAt
           }));
-          Object.assign(report, cleanup);
-        }
-        const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "workspace-link", () => ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
-        const finalBranch = currentBranch(repoDir) || STAGING_BRANCH;
-        const managedWorktree = managedWorkflowWorktreeMetadata(root);
-        const worktreeCleanup = isManagedWorkflowWorktree(root) ? await executeJournalStep(root, workflowRun.runId, "worktree-cleanup", () => removeManagedWorkflowWorktree(root)) : { removed: false, reason: "not-managed" };
+        });
+        const typedManifest = manifest;
+        const promotion = await executeJournalStep(root, workflowRun.runId, "promote-to-staging", () => {
+          const results = [];
+          for (const pkg of typedManifest.packages) {
+            results.push({
+              name: pkg.name,
+              ...promoteCommitToBranchWithExpectedHead(resolve(root, pkg.path), {
+                commitSha: pkg.commit,
+                targetBranch: STAGING_BRANCH,
+                expectedBefore: typedManifest.stagingHeadsBefore[pkg.name] ?? null
+              })
+            });
+          }
+          results.push({
+            name: "@treeseed/market",
+            ...promoteCommitToBranchWithExpectedHead(repoRoot(root), {
+              commitSha: typedManifest.root.commit,
+              targetBranch: STAGING_BRANCH,
+              expectedBefore: typedManifest.stagingHeadsBefore["@treeseed/market"] ?? null
+            })
+          });
+          return { status: "completed", results };
+        });
+        const stagingRefs = await executeJournalStep(root, workflowRun.runId, "verify-staging-refs", () => {
+          const refs = {};
+          for (const pkg of typedManifest.packages) {
+            const observed = remoteHeadCommit(resolve(root, pkg.path), STAGING_BRANCH);
+            if (observed !== pkg.commit) {
+              throw new Error(`${pkg.name} staging ref mismatch: expected ${pkg.commit}, observed ${observed}.`);
+            }
+            refs[pkg.name] = observed;
+          }
+          const rootObserved = remoteHeadCommit(repoRoot(root), STAGING_BRANCH);
+          if (rootObserved !== typedManifest.root.commit) {
+            throw new Error(`@treeseed/market staging ref mismatch: expected ${typedManifest.root.commit}, observed ${rootObserved}.`);
+          }
+          refs["@treeseed/market"] = rootObserved;
+          return { status: "verified", refs };
+        });
+        const hostedCi = ciMode === "hosted" ? await executeJournalStep(root, workflowRun.runId, "hosted-ci", () => waitForStagingAutomation(repoRoot(root))) : (skipJournalStep(root, workflowRun.runId, "hosted-ci", { skippedReason: "ci off" }), { status: "skipped", reason: "ci off" });
+        const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "workspace-link-restore", () => ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
+        const cleanup = cleanupMode === "success" ? await executeJournalStep(root, workflowRun.runId, "cleanup-source", () => cleanupStageSourceBranches(root, featureBranch, typedManifest)) : (skipJournalStep(root, workflowRun.runId, "cleanup-source", { skippedReason: "manual cleanup selected" }), { status: "skipped", reason: "manual cleanup selected" });
         const payload = {
-          mode,
-          branchName: featureBranch,
-          mergeTarget: STAGING_BRANCH,
-          mergeStrategy: "squash",
-          message,
-          autoSaved: autoSave.performed,
-          autoSaveResult: autoSave.save,
-          deprecatedTag: rootCleanup?.deprecatedTag ?? null,
-          repos: packageReports,
-          rootRepo,
-          stagingWait,
-          releaseCandidate,
-          applicationSelection,
-          previewCleanup,
-          lockfileValidation: rootMerge?.lockfileValidation ?? null,
-          lockfileInstall: rootMerge?.lockfileInstall ?? null,
-          remoteDeleted: rootRepo.deletedRemote,
-          localDeleted: rootRepo.deletedLocal,
-          finalBranch,
+          ...basePayload,
+          blockers: [],
+          runId: workflowRun.runId,
+          mergeDown,
+          saveResult,
+          verification,
+          manifest: typedManifest,
+          promotion,
+          stagingRefs,
+          hostedCi,
+          cleanup,
           workspaceLinks,
-          ciMode,
-          workflowGates: stagingWait.workflowGates,
-          hostingAudit,
-          worktreeCleanup,
-          worktreeMode: effectiveInput.worktreeMode ?? "auto",
-          managedWorktree,
-          worktreePath: managedWorktree?.worktreePath ?? null,
-          primaryRoot: managedWorktree?.primaryRoot ?? null
+          finalBranch: cleanupMode === "success" ? STAGING_BRANCH : currentBranch(repoRoot(root)) || featureBranch,
+          summary: "Stage promoted refs only. Hosted CI/CD was not waited on by default. Run `npx trsd ci --branch staging --json` or assign the staging release agent for CI/CD repair."
         };
         completeWorkflowRun(root, workflowRun.runId, payload);
-        return buildWorkflowResult(
-          "stage",
-          root,
-          payload,
-          {
-            runId: workflowRun.runId,
-            nextSteps: createNextSteps([
-              { operation: "release", reason: "Promote the updated staging branch into production when ready.", input: { bump: "patch" } },
-              { operation: "status", reason: "Inspect staging readiness after the task branch merge." }
-            ])
-          }
-        );
+        return buildWorkflowResult("stage", root, payload, {
+          runId: workflowRun.runId,
+          summary: "Treeseed stage completed successfully.",
+          includeFinalState: false,
+          nextSteps: createNextSteps([
+            { operation: "ci", reason: "Inspect staging CI/CD status after branch promotion.", input: { branch: STAGING_BRANCH, failed: true } }
+          ])
+        });
       } catch (error) {
-        ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
+        try {
+          ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
+        } catch {
+        }
         failWorkflowRun(root, workflowRun.runId, error, {
           resumable: true,
           runId: workflowRun.runId,
@@ -4083,44 +4935,97 @@ ${stagingReadiness.checks.filter((check) => check.status === "failed").map((chec
     toError("stage", error);
   }
 }
-async function workflowTagsCleanup(helpers, input = {}) {
-  try {
-    return await withContextEnv(helpers.context.env, async () => {
-      const root = resolveProjectRootOrThrow("tags:cleanup", helpers.cwd());
-      const executionMode = input.plan === true || input.dryRun === true ? "plan" : "execute";
-      const cleanup = collectStaleDevTagCleanupReports(root, input, { execute: executionMode === "execute" });
-      return buildWorkflowResult("tags:cleanup", root, {
-        ...cleanup,
-        mode: hasCompleteTreeseedPackageCheckout(root) ? "recursive-workspace" : "root-only"
-      }, {
-        executionMode,
-        summary: executionMode === "plan" ? "Treeseed dev tag cleanup plan ready." : "Treeseed dev tag cleanup completed.",
-        nextSteps: executionMode === "plan" ? createNextSteps([{ operation: "tags:cleanup", reason: "Run without --plan to delete the stale Treeseed-managed dev tags.", input: { branchScope: cleanup.branchScope } }]) : createNextSteps([{ operation: "status", reason: "Inspect workspace state after tag cleanup." }])
-      });
+async function runReleaseGateReconcileFacade(operation, helpers, root, target, input, extraPayload = {}) {
+  const executionMode = normalizeExecutionMode(input);
+  const selector = {
+    environment: target.kind === "persistent" ? target.scope : "staging",
+    resourceKind: ["release-gate"],
+    provider: ["treeseed"]
+  };
+  const desiredGraph = compileTreeseedDesiredResourceGraph({ tenantRoot: root, target });
+  const rawUnits = compileTreeseedDesiredUnitsFromGraph(desiredGraph).filter((unit) => unit.provider === "treeseed" && (unit.unitType === "package-manifest" || unit.unitType.startsWith("release-gate:")) || unit.provider === "github" && (unit.unitType === "github-environment" || unit.unitType === "github-secret-binding" || unit.unitType === "github-variable-binding"));
+  const rawUnitIds = new Set(rawUnits.map((unit) => unit.unitId));
+  const units = rawUnits.map((unit) => ({
+    ...unit,
+    dependencies: unit.dependencies.filter((dependency) => rawUnitIds.has(dependency))
+  }));
+  const unitSelector = {
+    environment: selector.environment,
+    unitId: units.map((unit) => unit.unitId)
+  };
+  const plan = await planTreeseedReconciliation({
+    tenantRoot: root,
+    target,
+    env: helpers.context.env,
+    units,
+    selector: unitSelector,
+    write: (line) => helpers.write(`[${operation}][reconcile] ${line}`, "stderr")
+  });
+  const blockers = Array.isArray(extraPayload.blockers) ? extraPayload.blockers.map((blocker) => String(blocker)).filter(Boolean) : [];
+  if (executionMode === "execute" && blockers.length > 0) {
+    workflowError(operation, "validation_failed", `${operation} is blocked:
+${blockers.join("\n")}`, {
+      details: {
+        blockers,
+        target,
+        plannedSteps: plan.plans.map((entry) => ({
+          id: entry.unit.unitId,
+          action: entry.diff.action,
+          reasons: entry.diff.reasons
+        }))
+      }
     });
-  } catch (error) {
-    toError("tags:cleanup", error);
   }
+  const result = executionMode === "execute" ? await reconcileTreeseedTarget({
+    tenantRoot: root,
+    target,
+    env: helpers.context.env,
+    units,
+    selector: unitSelector,
+    dryRun: input.execute !== true,
+    write: (line) => helpers.write(`[${operation}][reconcile] ${line}`, "stderr")
+  }) : null;
+  const payload = {
+    ...extraPayload,
+    mode: "reconcile-release-gates",
+    target,
+    executionMode,
+    verifyDeployedResources: input.verifyDeployedResources === true,
+    desiredGraph,
+    units: units.map((unit) => ({
+      unitId: unit.unitId,
+      unitType: unit.unitType,
+      provider: unit.provider,
+      logicalName: unit.logicalName,
+      dependencies: unit.dependencies
+    })),
+    plannedSteps: plan.plans.map((entry) => ({
+      id: entry.unit.unitId,
+      description: `${entry.unit.provider}:${entry.unit.unitType} ${entry.unit.logicalName}`,
+      action: entry.diff.action,
+      reasons: entry.diff.reasons
+    })),
+    reconcile: result,
+    legacyMutationPathDisabled: true
+  };
+  return buildWorkflowResult(operation, root, payload, {
+    executionMode,
+    summary: executionMode === "execute" ? `${operation} release gates reconciled through the canonical adapter path.` : `${operation} release gate plan ready.`,
+    nextSteps: createNextSteps([
+      operation === "stage" ? { operation: "release", reason: "Promote production after the staging release-gate candidate is green.", input: { bump: "patch", plan: true } } : { operation: "status", reason: "Inspect production readiness after release gates complete." }
+    ])
+  });
 }
 async function workflowRelease(helpers, input) {
   try {
     return await withContextEnv(helpers.context.env, async () => {
-      const root = resolveProjectRootOrThrow("release", helpers.cwd());
-      reattachRepairablePackageRepos(root, [STAGING_BRANCH, PRODUCTION_BRANCH], {
-        operation: "release",
-        onProgress: (line, stream) => helpers.write(line, stream),
-        throwOnBlocker: true
-      });
+      const root = workspaceRoot(resolveProjectRootOrThrow("release", helpers.cwd()));
       const session = resolveTreeseedWorkflowSession(root);
-      const gitRoot = session.gitRoot;
-      const mode = session.mode;
       const executionMode = normalizeExecutionMode(input);
       const rootRepo = createWorkspaceRootRepoReport(root);
       const packageReports = createWorkspacePackageReports(root);
       const explicitResumeRunId = helpers.context.workflow?.resumeRunId ?? null;
-      const freshRelease = input.fresh === true && !explicitResumeRunId;
-      const freshPreparation = freshRelease && executionMode === "execute" ? prepareFreshReleaseRun(root, session.branchName, rootRepo, packageReports) : { archived: [], blockers: [] };
-      const autoResumeRun = executionMode === "execute" && !explicitResumeRunId && !freshRelease ? findAutoResumableReleaseRun(root, session.branchName, rootRepo, packageReports, { archiveStale: true }) : null;
+      const autoResumeRun = executionMode === "execute" && !explicitResumeRunId && input.fresh !== true ? findAutoResumableReleaseRun(root, session.branchName, rootRepo, packageReports, { archiveStale: false }) : null;
       const planAutoResumeRun = executionMode === "plan" && input.fresh !== true ? findAutoResumableReleaseRun(root, session.branchName, rootRepo, packageReports) : null;
       const effectiveInput = autoResumeRun ? {
         ...autoResumeRun.input,
@@ -4128,11 +5033,10 @@ async function workflowRelease(helpers, input) {
       } : input;
       const level = effectiveInput.bump ?? "patch";
       const ciMode = normalizeCiMode(effectiveInput.ciMode, "release");
-      const isResume = Boolean(explicitResumeRunId || autoResumeRun);
       const packageSelection = session.packageSelection;
       const plannedRelease = buildReleasePlanSnapshot({
         root,
-        mode,
+        mode: session.mode,
         level,
         repairVersionLine: effectiveInput.repairVersionLine === true,
         targetVersionLine: effectiveInput.targetVersionLine,
@@ -4141,9 +5045,8 @@ async function workflowRelease(helpers, input) {
         rootRepo,
         blockers: []
       });
-      const plannedPackageSelection = releasePlanPackageSelection(plannedRelease.packageSelection);
-      const selectedPackageNames = new Set(plannedPackageSelection.selected);
-      const blockers = isResume ? [] : collectReleasePlanBlockers(session, mode, plannedPackageSelection.selected, {
+      const selectedPackageNames = releasePlanPackageSelection(plannedRelease.packageSelection).selected;
+      const blockers = collectReleasePlanBlockers(session, session.mode, selectedPackageNames, {
         level,
         repairVersionLine: effectiveInput.repairVersionLine === true
       });
@@ -4152,68 +5055,81 @@ async function workflowRelease(helpers, input) {
         environment: "prod",
         appId: singleSelectedWorkflowAppId(plannedRelease.applicationSelection)
       });
-      if (!isResume) {
-        blockers.push(...plannedReadiness.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.message}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`));
-      }
+      blockers.push(...plannedReadiness.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.message}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`));
       plannedRelease.blockers = blockers;
+      const releaseBasePayload = {
+        ...plannedRelease,
+        readiness: plannedReadiness,
+        ciMode,
+        level,
+        fresh: input.fresh === true,
+        freshArchivedRuns: [],
+        autoResumeCandidate: planAutoResumeRun ? {
+          runId: planAutoResumeRun.runId,
+          branch: planAutoResumeRun.session.branchName,
+          failure: planAutoResumeRun.failure
+        } : null,
+        ...worktreePayload(root, effectiveInput.worktreeMode)
+      };
       if (executionMode === "plan") {
-        return buildWorkflowResult("release", root, {
-          ...plannedRelease,
-          readiness: plannedReadiness,
-          ciMode,
-          fresh: input.fresh === true,
-          freshArchivedRuns: [],
-          ...worktreePayload(root, effectiveInput.worktreeMode),
-          autoResumeCandidate: planAutoResumeRun ? {
-            runId: planAutoResumeRun.runId,
-            branch: planAutoResumeRun.session.branchName,
-            failure: planAutoResumeRun.failure
-          } : null
-        }, {
-          executionMode,
-          nextSteps: createNextSteps([
-            { operation: "release", reason: planAutoResumeRun ? `Run without --plan to resume ${planAutoResumeRun.runId}.` : "Run without --plan to promote staging into production.", input: { bump: level } }
-          ])
-        });
+        return runReleaseGateReconcileFacade(
+          "release",
+          helpers,
+          root,
+          { kind: "persistent", scope: "prod" },
+          {
+            plan: true,
+            verifyDeployedResources: effectiveInput.verifyDeployedResources
+          },
+          releaseBasePayload
+        );
       }
       if (blockers.length > 0) {
-        workflowError("release", "validation_failed", blockers.join("\n"), {
-          details: { blockers }
+        workflowError("release", "validation_failed", `Treeseed release cannot continue until blockers are resolved:
+${blockers.join("\n")}`, {
+          details: { blockers, releasePlan: plannedRelease }
         });
       }
+      const freshPreparation = input.fresh === true ? prepareFreshReleaseRun(root, session.branchName, rootRepo, packageReports) : { archived: [], blockers: [] };
+      const selectedVersions = releasePlanVersionMap(plannedRelease.plannedVersions);
+      const stableVersions = new Map([
+        ...releasePlanStableDependencyVersionMap(plannedRelease).entries(),
+        ...selectedVersions.entries()
+      ]);
+      const allVersions = new Map([
+        ["@treeseed/market", plannedRelease.rootVersion],
+        ...stableVersions.entries()
+      ]);
+      const selectedPackageSet = new Set(selectedPackageNames);
       const workflowRun = acquireWorkflowRun(
         "release",
         session,
         {
+          ...effectiveInput,
           bump: level,
-          repairVersionLine: effectiveInput.repairVersionLine === true,
-          targetVersionLine: effectiveInput.targetVersionLine,
-          devTagCleanup: effectiveInput.devTagCleanup ?? "safe-after-release",
-          gitDependencyProtocol: effectiveInput.gitDependencyProtocol ?? "preserve-origin",
-          gitRemoteWriteMode: effectiveInput.gitRemoteWriteMode ?? "ssh-pushurl",
           ciMode,
-          fresh: input.fresh === true,
-          worktreeMode: effectiveInput.worktreeMode ?? "auto",
-          workspaceLinks: effectiveInput.workspaceLinks ?? "auto"
+          fresh: input.fresh === true
         },
         [
-          { id: "release-plan", description: "Record release plan", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
-          { id: "release-staging-gates", description: "Verify current staging GitHub Actions gates", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
-          { id: "release-candidate", description: "Run release-candidate readiness checks", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
-          { id: "workspace-unlink", description: "Remove local workspace links before release", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
-          ...mode === "recursive-workspace" ? [{ id: "prepare-release-metadata", description: "Rewrite stable release metadata", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }] : [],
-          ...packageReports.filter((report) => selectedPackageNames.has(report.name)).map((report) => ({
-            id: `release-${report.name}`,
-            description: `Release ${report.name}`,
-            repoName: report.name,
-            repoPath: report.path,
-            branch: STAGING_BRANCH,
-            resumable: true
-          })),
-          { id: "release-root", description: "Release market repo", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
-          { id: "release-root-gates", description: "Wait for market release GitHub Actions gates", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
-          { id: "release-back-merge", description: "Back-merge main into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
-          ...mode === "recursive-workspace" ? [{ id: "cleanup-dev-tags", description: "Clean replaced dev package tags", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }] : []
+          { id: "release-plan", description: "Record immutable release plan and target versions", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
+          { id: "release-gates", description: "Run production release gates against staging evidence", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
+          { id: "workspace-unlink", description: "Remove local workspace links before stable release metadata", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
+          { id: "prepare-release-metadata", description: "Rewrite package metadata and lockfiles to production dependency mode", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
+          ...selectedPackageNames.map((name) => {
+            const report = packageReports.find((entry) => entry.name === name);
+            return {
+              id: `release-${name}`,
+              description: `Release ${name} ${selectedVersions.get(name) ?? "(planned)"}`,
+              repoName: name,
+              repoPath: report?.path ?? root,
+              branch: STAGING_BRANCH,
+              resumable: true
+            };
+          }),
+          { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
+          { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
+          { id: "workspace-link", description: "Restore local workspace links after release", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }
         ],
         autoResumeRun ? {
           ...helpers.context,
@@ -4224,565 +5140,188 @@ async function workflowRelease(helpers, input) {
         } : helpers.context
       );
       if (autoResumeRun) {
-        helpers.write(`[workflow][resume] Resuming interrupted release ${autoResumeRun.runId} on ${STAGING_BRANCH}.`);
-      }
-      const resumeAtRootGates = workflowRun.resumed && shouldResumeReleaseAtRootGates(root, workflowRun.runId);
-      if (resumeAtRootGates) {
-        helpers.write(`[workflow][resume] Resuming release ${workflowRun.runId} directly at production deploy gates.`);
+        helpers.write(`[workflow][resume] Resuming interrupted release ${autoResumeRun.runId}.`);
       }
-      let releaseCleanupSnapshot = null;
       try {
-        const releasePlan = await executeJournalStep(root, workflowRun.runId, "release-plan", () => plannedRelease);
-        const effectivePackageSelection = releasePlanPackageSelection(releasePlan.packageSelection);
-        const effectiveSelectedPackageNames = new Set(effectivePackageSelection.selected);
-        const effectiveVersions = releasePlanVersionMap(releasePlan.plannedVersions);
-        const effectiveStableDependencyVersions = releasePlanStableDependencyVersionMap(releasePlan);
-        const effectiveDependencyReplacementVersions = new Map([
-          ...effectiveStableDependencyVersions.entries(),
-          ...effectiveVersions.entries()
-        ]);
-        const rootVersion = String(releasePlan.rootVersion);
-        applyTreeseedEnvironmentToProcess({ tenantRoot: root, scope: "staging", override: true });
-        assertReleaseGitHubAutomationReady(root, effectiveSelectedPackageNames, ciMode);
-        const productionReadiness = collectTreeseedDeploymentReadiness({ tenantRoot: root, environment: "prod" });
-        if (!productionReadiness.ok) {
-          workflowError(
-            "release",
-            "validation_failed",
-            `Deployment readiness failed for prod:
-${productionReadiness.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.message}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`).join("\n")}`,
-            { details: { readiness: productionReadiness } }
-          );
-        }
-        const stagingGateResult = resumeAtRootGates ? completedJournalStepData(root, workflowRun.runId, "release-staging-gates") : await executeJournalStep(root, workflowRun.runId, "release-staging-gates", () => {
-          helpers.write("[release][workflow] Verifying current staging gates before production release.");
-          const packageGates = checkedOutWorkspacePackageRepos(root).filter((pkg) => effectiveSelectedPackageNames.has(pkg.name)).map((pkg) => ({
+        const releasePlan = await executeJournalStep(root, workflowRun.runId, "release-plan", () => ({
+          ...releaseBasePayload,
+          freshArchivedRuns: freshPreparation.archived
+        }));
+        const releaseGates = await executeJournalStep(root, workflowRun.runId, "release-gates", async () => runReleaseGateReconcileFacade(
+          "release",
+          helpers,
+          root,
+          { kind: "persistent", scope: "prod" },
+          {
+            execute: true,
+            verifyDeployedResources: effectiveInput.verifyDeployedResources
+          },
+          {
+            ...releaseBasePayload,
+            freshArchivedRuns: freshPreparation.archived
+          }
+        ));
+        const workspaceUnlink = await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
+        const releaseMetadata = await executeJournalStep(root, workflowRun.runId, "prepare-release-metadata", () => {
+          applyStableWorkspaceVersionChanges(root, allVersions);
+          const adapterMetadata = checkedOutWorkspacePackageRepos(root).filter((pkg) => selectedPackageSet.has(pkg.name)).map((pkg) => ({
             name: pkg.name,
-            repoPath: pkg.dir,
-            workflow: "verify.yml",
-            branch: STAGING_BRANCH,
-            headSha: headCommit(pkg.dir)
-          }));
-          return waitForWorkflowGates("release", [
-            hostedDeployGate({
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "deploy.yml",
-              branch: STAGING_BRANCH,
-              headSha: headCommit(gitRoot)
-            }),
-            ...packageGates
-          ], ciMode, {
-            root,
-            runId: workflowRun.runId,
-            onProgress: (line, stream) => helpers.write(line, stream)
-          }).then((workflowGates) => ({ workflowGates }));
-        });
-        const releaseCandidate = resumeAtRootGates ? completedJournalStepData(root, workflowRun.runId, "release-candidate") : await executeJournalStep(root, workflowRun.runId, "release-candidate", () => runReleaseCandidateForPlan("release", root, releasePlan, { allowReuse: true }));
-        if (!resumeAtRootGates && !isResume) {
-          assertSessionBranchSafety("release", session, { requireCleanPackages: true, requireCurrentBranch: true });
-          assertCleanWorktree(root);
-        }
-        if (!resumeAtRootGates) {
-          prepareReleaseBranches(root);
-          ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
-          runWorkspaceReleasePreflight({ cwd: root });
-          await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"), { rerunCompleted: true });
-        }
-        if (mode === "root-only") {
-          const rootRelease2 = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
-            setRootPackageJsonVersion(root, rootVersion);
-            run("git", ["checkout", STAGING_BRANCH], { cwd: gitRoot });
-            const rootCommitsBeforeChangelog = releaseHistoryCommits(gitRoot);
-            const changelog = updateReleaseChangelog(gitRoot, {
-              version: rootVersion,
-              commits: rootCommitsBeforeChangelog,
-              extraDependencyBullets: [`Release @treeseed/market ${rootVersion}.`]
-            });
-            commitAllIfChanged(gitRoot, releaseAdminMessage({
-              subject: `release: ${level} bump`,
-              version: rootVersion,
-              tagName: rootVersion,
-              commits: rootCommitsBeforeChangelog,
-              changelog
-            }));
-            pushBranch(gitRoot, STAGING_BRANCH);
-            const stagingCommit = headCommit(gitRoot);
-            const rootCommits = releaseHistoryCommits(gitRoot);
-            const released = mergeBranchIntoTarget(root, {
-              sourceBranch: STAGING_BRANCH,
-              targetBranch: PRODUCTION_BRANCH,
-              message: releaseAdminMessage({
-                subject: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
-                version: rootVersion,
-                tagName: rootVersion,
-                commits: rootCommits,
-                changelog
-              }),
-              pushTarget: true
-            });
-            const tag = ensureReleaseTag(gitRoot, rootVersion, released.commitSha, releaseAdminMessage({
-              subject: `release: ${rootVersion}`,
-              version: rootVersion,
-              tagName: rootVersion,
-              commits: rootCommits,
-              changelog
-            }));
-            syncBranchWithOrigin(gitRoot, STAGING_BRANCH);
-            return {
-              rootVersion,
-              stagingCommit,
-              releasedCommit: released.commitSha,
-              tag,
-              changelog,
-              adminCommitSummary: {
-                commitCount: rootCommits.length,
-                notableCommits: rootCommits.slice(0, 12)
-              }
-            };
-          });
-          rootRepo.committed = true;
-          rootRepo.pushed = true;
-          rootRepo.merged = true;
-          rootRepo.branch = PRODUCTION_BRANCH;
-          rootRepo.commitSha = String(rootRelease2?.releasedCommit ?? headCommit(gitRoot));
-          rootRepo.tagName = String(rootRelease2?.rootVersion ?? "");
-          const rootWorkflowGateResult2 = await executeJournalStep(root, workflowRun.runId, "release-root-gates", () => waitForWorkflowGates("release", [
-            hostedDeployGate({
-              name: rootRepo.name,
-              repoPath: rootRepo.path,
-              workflow: "deploy.yml",
-              branch: rootVersion,
-              headSha: String(rootRelease2?.releasedCommit ?? rootRepo.commitSha ?? "")
-            })
-          ].filter((gate) => gate.headSha), ciMode, {
-            root,
-            runId: workflowRun.runId,
-            onProgress: (line, stream) => helpers.write(line, stream)
-          }).then((workflowGates) => ({ workflowGates })));
-          const hostedDeploymentState2 = recordHostedDeploymentStatesFromRootGates(root, rootRelease2, rootWorkflowGateResult2?.workflowGates);
-          ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
-          const applicationSelection2 = selectWorkflowApplications(root, { changedPaths: ["treeseed.site.yaml"] });
-          const hostingAudit2 = await runWorkflowHostedResourceVerification("release", root, helpers, "prod", {
-            enabled: true,
-            strict: effectiveInput.verifyDeployedResources === true,
-            live: effectiveInput.verifyDeployedResources === true,
-            appId: singleSelectedWorkflowAppId(applicationSelection2)
-          });
-          const releaseBackMerge2 = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, false, {
-            version: rootVersion,
-            changelog: rootRelease2?.changelog ?? null
+            version: selectedVersions.get(pkg.name) ?? null,
+            result: selectedVersions.has(pkg.name) ? prepareAdapterReleaseMetadata(root, pkg, selectedVersions.get(pkg.name)) : { status: "skipped", reason: "no planned version" }
           }));
-          const workspaceLinks2 = ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
-          const payload2 = {
-            mode,
-            mergeStrategy: "merge-commit",
-            level,
-            fresh: input.fresh === true,
-            freshArchivedRuns: freshPreparation.archived,
-            resumed: workflowRun.resumed,
-            resumedRunId: workflowRun.resumed ? workflowRun.runId : null,
-            autoResumed: autoResumeRun != null,
-            rootVersion: String(rootRelease2?.rootVersion ?? ""),
-            releaseTag: String(rootRelease2?.rootVersion ?? ""),
-            releasedCommit: String(rootRelease2?.releasedCommit ?? rootRepo.commitSha ?? ""),
-            stagingBranch: STAGING_BRANCH,
-            productionBranch: PRODUCTION_BRANCH,
-            touchedPackages: [],
-            packageSelection: { changed: [], dependents: [], selected: [] },
-            applicationSelection: applicationSelection2,
-            publishWait: [],
-            repos: [],
-            rootRepo,
-            releaseCandidate,
-            stagingWorkflowGates: stagingGateResult?.workflowGates ?? [],
-            releaseBackMerge: releaseBackMerge2,
-            hostedDeploymentState: hostedDeploymentState2,
-            finalBranch: currentBranch(gitRoot) || STAGING_BRANCH,
-            pushStatus: { stagingPushed: true, productionPushed: true, tagPushed: true },
-            workspaceLinks: workspaceLinks2,
-            ciMode,
-            workflowGates: [
-              ...Array.isArray(stagingGateResult?.workflowGates) ? stagingGateResult.workflowGates : [],
-              ...Array.isArray(rootWorkflowGateResult2?.workflowGates) ? rootWorkflowGateResult2.workflowGates : []
-            ],
-            hostingAudit: hostingAudit2,
-            ...worktreePayload(root, effectiveInput.worktreeMode)
-          };
-          completeWorkflowRun(root, workflowRun.runId, payload2);
-          return buildWorkflowResult("release", root, payload2, {
-            runId: workflowRun.runId,
-            nextSteps: createNextSteps([
-              { operation: "status", reason: "Inspect release readiness and production state after the promotion." }
-            ])
-          });
-        }
-        if (!resumeAtRootGates) {
-          validatePackageReleaseWorkflows(root, effectivePackageSelection.selected);
-          for (const pkg of checkedOutWorkspacePackageRepos(root)) {
-            if (effectiveSelectedPackageNames.has(pkg.name)) {
-              prepareReleaseBranches(pkg.dir);
-            }
+          const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
+          const remainingDevReferences = collectInternalDevReferenceIssues(root, selectedPackageSet).filter((issue) => issue.reason !== "git-release-ref" && issue.reason !== "lockfile-git-release-ref");
+          if (remainingDevReferences.length > 0) {
+            const rendered = remainingDevReferences.map((issue) => `${issue.repoName}: ${issue.filePath} ${issue.dependencyName ?? ""} ${issue.reason} ${issue.spec}`).join("\n");
+            throw new Error(`Stable release metadata still contains development references.
+${rendered}`);
           }
-        }
-        releaseCleanupSnapshot = resumeAtRootGates ? null : collectReleaseCleanupSnapshot(root, effectiveSelectedPackageNames);
-        const metadata = await executeJournalStep(root, workflowRun.runId, "prepare-release-metadata", () => {
-          const releasedPackageDevTags2 = Object.fromEntries(
-            checkedOutWorkspacePackageRepos(root).filter((pkg) => effectiveSelectedPackageNames.has(pkg.name)).map((pkg) => {
-              const packageJson = JSON.parse(readFileSync(resolve(pkg.dir, "package.json"), "utf8"));
-              return [pkg.name, String(packageJson.version ?? "")];
-            }).filter(([, version]) => version.includes("-dev."))
-          );
-          const replacedDevReferences2 = rewriteProjectInternalDependenciesToStableVersions(root, effectiveDependencyReplacementVersions);
-          applyStableWorkspaceVersionChanges(root, effectiveVersions);
-          setRootPackageJsonVersion(root, rootVersion);
-          const releaseInstalls2 = [
-            { name: "@treeseed/market", ...runReleaseNpmInstall(root, { workspaceRoot: root }) }
-          ];
-          assertNoInternalDevReferencesForRepo(root, root, effectiveSelectedPackageNames);
           return {
-            releasedPackageDevTags: releasedPackageDevTags2,
-            replacedDevReferences: replacedDevReferences2,
-            releaseInstalls: releaseInstalls2
+            versions: Object.fromEntries(allVersions.entries()),
+            adapterMetadata,
+            rootInstall,
+            workspaceUnlink
           };
-        }, { rerunCompleted: workflowRun.resumed && !resumeAtRootGates });
-        const replacedDevReferences = Array.isArray(metadata?.replacedDevReferences) ? metadata.replacedDevReferences : [];
-        const releaseInstalls = Array.isArray(metadata?.releaseInstalls) ? metadata.releaseInstalls : [];
-        const releasedPackageDevTags = new Map(Object.entries(metadata?.releasedPackageDevTags ?? {}).map(([name, version]) => [name, String(version)]));
-        const publishWait = [];
-        for (const pkg of checkedOutWorkspacePackageRepos(root)) {
-          const report = findReportByName(packageReports, pkg.name);
-          if (!report || !effectiveSelectedPackageNames.has(pkg.name)) {
-            if (report) {
-              report.skippedReason = "unchanged";
-            }
-            continue;
-          }
-          const releasedPackage = await executeJournalStep(root, workflowRun.runId, `release-${report.name}`, async () => {
-            checkoutBranch(pkg.dir, STAGING_BRANCH);
-            const tagName = String(effectiveVersions.get(pkg.name));
-            releaseInstalls.push({
-              name: pkg.name,
-              ...runReleaseNpmInstall(pkg.dir, { workspaceRoot: root })
-            });
-            assertNoInternalDevReferencesForRepo(root, pkg.dir, effectiveSelectedPackageNames);
-            const packageCommitsBeforeChangelog = releaseHistoryCommits(pkg.dir);
+        });
+        const packageReleases = [];
+        for (const pkg of checkedOutWorkspacePackageRepos(root).filter((entry) => selectedPackageSet.has(entry.name))) {
+          const version = selectedVersions.get(pkg.name);
+          if (!version) continue;
+          const packageRelease = await executeJournalStep(root, workflowRun.runId, `release-${pkg.name}`, () => {
             const changelog = updateReleaseChangelog(pkg.dir, {
-              version: tagName,
-              commits: packageCommitsBeforeChangelog,
-              extraDependencyBullets: [`Release ${pkg.name} ${tagName}.`]
+              version,
+              sourceRef: `origin/${PRODUCTION_BRANCH}`,
+              targetRef: "HEAD"
             });
-            if (hasMeaningfulChanges(pkg.dir)) {
-              run("git", ["add", "-A"], { cwd: pkg.dir });
-              run("git", ["commit", "-m", releaseAdminMessage({
-                subject: `release: ${tagName}`,
-                version: tagName,
-                tagName,
-                commits: packageCommitsBeforeChangelog,
-                changelog,
-                extraLines: [`Package: ${pkg.name}`]
-              })], { cwd: pkg.dir });
-            }
-            pushBranch(pkg.dir, STAGING_BRANCH);
-            const packageCommits = releaseHistoryCommits(pkg.dir);
-            const mergeResult = mergeBranchIntoTarget(pkg.dir, {
-              sourceBranch: STAGING_BRANCH,
-              targetBranch: PRODUCTION_BRANCH,
-              message: releaseAdminMessage({
-                subject: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
-                version: tagName,
-                tagName,
-                commits: packageCommits,
-                changelog,
-                extraLines: [`Package: ${pkg.name}`]
-              }),
-              pushTarget: true,
-              allowUnrelatedHistories: true
-            });
-            const tag = ensureReleaseTag(pkg.dir, tagName, mergeResult.commitSha, releaseAdminMessage({
-              subject: `release: ${tagName}`,
-              version: tagName,
-              tagName,
-              commits: packageCommits,
-              changelog,
-              extraLines: [`Package: ${pkg.name}`]
-            }));
-            const workflowGates = await waitForWorkflowGates("release", [
-              {
-                name: pkg.name,
-                repoPath: pkg.dir,
-                workflow: "publish.yml",
-                headSha: mergeResult.commitSha,
-                branch: tagName
-              }
-            ], ciMode, {
-              root,
-              runId: workflowRun.runId,
-              onProgress: (line, stream) => helpers.write(line, stream)
-            });
-            const publish = workflowGates.find((gate) => gate.workflow === "publish.yml") ?? workflowGates[0] ?? null;
-            assertReleaseGitHubWorkflowSucceeded(pkg.name, publish);
-            const backMerge = backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
-              subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
-              version: tagName,
-              tagName,
-              sourceRef: PRODUCTION_BRANCH,
-              targetRef: STAGING_BRANCH,
-              commits: packageCommits,
-              changelog,
-              extraLines: [`Package: ${pkg.name}`]
+            const commit = commitAllIfChanged(pkg.dir, releaseAdminMessage({
+              subject: `release: ${pkg.name} ${version}`,
+              version,
+              tagName: version,
+              sourceRef: STAGING_BRANCH,
+              targetRef: PRODUCTION_BRANCH,
+              changelog
             }));
-            syncBranchWithOrigin(pkg.dir, STAGING_BRANCH);
+            pushBranch(pkg.dir, STAGING_BRANCH);
+            const promotion = promoteCommitToProductionBranch(pkg.dir, commit.commitSha);
+            const tag = ensureReleaseTag(pkg.dir, version, commit.commitSha, `release: ${pkg.name} ${version}`);
             return {
-              commitSha: mergeResult.commitSha,
-              tagName,
-              tag,
+              name: pkg.name,
+              path: relative(root, pkg.dir),
+              version,
               changelog,
-              adminCommitSummary: {
-                commitCount: packageCommits.length,
-                notableCommits: packageCommits.slice(0, 12)
-              },
-              publish,
-              workflowGates,
-              backMerge
+              commit,
+              promotion,
+              tag
             };
           });
-          report.committed = true;
-          report.pushed = true;
-          report.merged = true;
-          report.tagName = String(releasedPackage?.tagName ?? "");
-          report.commitSha = String(releasedPackage?.commitSha ?? report.commitSha ?? "");
-          report.publishWait = releasedPackage?.publish ?? null;
-          report.workflowGates = Array.isArray(releasedPackage?.workflowGates) ? releasedPackage.workflowGates : [];
-          report.backMerge = releasedPackage?.backMerge ?? null;
-          report.changelog = releasedPackage?.changelog ?? null;
-          report.adminCommitSummary = releasedPackage?.adminCommitSummary ?? null;
-          report.branch = STAGING_BRANCH;
-          publishWait.push({
-            name: report.name,
-            ...releasedPackage?.publish ?? {}
-          });
+          packageReleases.push(packageRelease);
         }
-        assertNoInternalDevReferences(root, effectiveSelectedPackageNames);
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
-          setRootPackageJsonVersion(root, rootVersion);
-          run("git", ["checkout", STAGING_BRANCH], { cwd: gitRoot });
-          const rootCommitsBeforeChangelog = releaseHistoryCommits(gitRoot);
-          const changelog = updateReleaseChangelog(gitRoot, {
-            version: rootVersion,
-            commits: rootCommitsBeforeChangelog,
-            extraDependencyBullets: [
-              `Release @treeseed/market ${rootVersion}.`,
-              ...versionLines(effectiveVersions).map((line) => `Release package ${line}.`)
-            ]
-          });
-          commitAllIfChanged(gitRoot, releaseAdminMessage({
-            subject: `release: ${level} bump`,
-            version: rootVersion,
-            tagName: rootVersion,
-            commits: rootCommitsBeforeChangelog,
-            changelog,
-            extraLines: versionLines(effectiveVersions).map((line) => `Package ${line}`)
-          }));
-          pushBranch(gitRoot, STAGING_BRANCH);
-          const stagingCommit = headCommit(gitRoot);
-          const rootCommits = releaseHistoryCommits(gitRoot);
-          let released;
-          let submoduleReconciliation = null;
-          const mergeMessage = releaseAdminMessage({
-            subject: `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`,
-            version: rootVersion,
-            tagName: rootVersion,
-            commits: rootCommits,
-            changelog,
-            extraLines: versionLines(effectiveVersions).map((line) => `Package ${line}`)
+          const changelog = updateReleaseChangelog(repoRoot(root), {
+            version: plannedRelease.rootVersion,
+            sourceRef: `origin/${PRODUCTION_BRANCH}`,
+            targetRef: "HEAD",
+            extraDependencyBullets: versionLines(stableVersions)
           });
-          try {
-            released = mergeBranchIntoTarget(root, {
-              sourceBranch: STAGING_BRANCH,
-              targetBranch: PRODUCTION_BRANCH,
-              message: mergeMessage,
-              pushTarget: false,
-              quietMerge: true
-            });
-          } catch (error) {
-            const reconciliation = resolveRootReleaseSubmoduleConflicts(root, effectiveSelectedPackageNames);
-            if (!reconciliation.resolved) {
-              throw error;
-            }
-            helpers.write(`[release][reconcile] Resolving generated package pointer reconciliation for ${reconciliation.entries.map((entry) => String(entry.path)).join(", ")}.`);
-            submoduleReconciliation = reconciliation;
-            commitAllIfChanged(gitRoot, mergeMessage);
-            released = { commitSha: headCommit(gitRoot) };
-          }
-          for (const pkg of checkedOutWorkspacePackageRepos(root)) {
-            if (effectiveSelectedPackageNames.has(pkg.name)) {
-              syncBranchWithOrigin(pkg.dir, PRODUCTION_BRANCH);
-            }
-          }
-          const mainPointerCommits = releaseHistoryCommits(gitRoot, released.commitSha, "HEAD");
-          commitAllIfChanged(gitRoot, releaseAdminMessage({
-            subject: "release: sync package main heads",
-            version: rootVersion,
-            tagName: rootVersion,
-            sourceRef: "package main heads",
+          const commit = commitAllIfChanged(repoRoot(root), releaseAdminMessage({
+            subject: `release: market ${plannedRelease.rootVersion}`,
+            version: plannedRelease.rootVersion,
+            tagName: plannedRelease.releaseTag,
+            sourceRef: STAGING_BRANCH,
             targetRef: PRODUCTION_BRANCH,
-            commits: mainPointerCommits,
-            changelog,
-            extraLines: versionLines(effectiveVersions).map((line) => `Main package ${line}`)
-          }));
-          const releasedCommit = headCommit(gitRoot);
-          const tag = ensureReleaseTag(gitRoot, rootVersion, releasedCommit, releaseAdminMessage({
-            subject: `release: ${rootVersion}`,
-            version: rootVersion,
-            tagName: rootVersion,
-            commits: rootCommits,
             changelog,
-            extraLines: versionLines(effectiveVersions).map((line) => `Package ${line}`)
+            extraLines: versionLines(stableVersions).map((line) => `Released package ${line}`)
           }));
-          run("git", ["push", "origin", PRODUCTION_BRANCH], { cwd: gitRoot });
-          syncAllCheckedOutPackageRepos(root, STAGING_BRANCH);
-          syncBranchWithOrigin(gitRoot, STAGING_BRANCH);
+          pushBranch(repoRoot(root), STAGING_BRANCH);
+          const promotion = promoteCommitToProductionBranch(repoRoot(root), commit.commitSha);
+          const tag = ensureReleaseTag(repoRoot(root), plannedRelease.releaseTag, commit.commitSha, `release: market ${plannedRelease.rootVersion}`);
           return {
-            rootVersion,
-            stagingCommit,
-            releasedCommit,
-            mergeCommit: released.commitSha,
-            tag,
+            name: "@treeseed/market",
+            version: plannedRelease.rootVersion,
+            releaseTag: plannedRelease.releaseTag,
             changelog,
-            adminCommitSummary: {
-              commitCount: rootCommits.length,
-              notableCommits: rootCommits.slice(0, 12)
-            },
-            submoduleReconciliation
+            commit,
+            promotion,
+            tag
           };
         });
-        rootRepo.committed = true;
-        rootRepo.pushed = true;
-        rootRepo.merged = true;
-        rootRepo.branch = PRODUCTION_BRANCH;
-        rootRepo.commitSha = String(rootRelease?.releasedCommit ?? headCommit(gitRoot));
-        rootRepo.tagName = String(rootRelease?.rootVersion ?? "");
-        const rootWorkflowGateResult = await executeJournalStep(root, workflowRun.runId, "release-root-gates", () => waitForWorkflowGates("release", [
+        const publishGates = [
           hostedDeployGate({
-            name: rootRepo.name,
-            repoPath: rootRepo.path,
-            workflow: "deploy.yml",
-            branch: rootVersion,
-            headSha: String(rootRelease?.releasedCommit ?? rootRepo.commitSha ?? "")
-          })
-        ].filter((gate) => gate.headSha), ciMode, {
+            name: "@treeseed/market",
+            repoPath: repoRoot(root),
+            workflow: "deploy-web.yml",
+            branch: PRODUCTION_BRANCH,
+            headSha: String(rootRelease.commit.commitSha ?? ""),
+            dispatchIfMissing: true,
+            dispatchInputs: {
+              environment: "prod",
+              action_kind: "deploy_web"
+            }
+          }),
+          ...packageReleases.map((entry) => ({
+            name: String(entry.name),
+            repoPath: resolve(root, String(entry.path)),
+            workflow: releaseWorkflowForPackage(root, String(entry.name)),
+            branch: String(entry.version),
+            headSha: String(entry.commit.commitSha ?? "")
+          }))
+        ].filter((gate) => gate.headSha);
+        const publishWait = await executeJournalStep(root, workflowRun.runId, "publish-wait", () => waitForWorkflowGates("release", publishGates, ciMode, {
           root,
           runId: workflowRun.runId,
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
-        const hostedDeploymentState = recordHostedDeploymentStatesFromRootGates(root, rootRelease, rootWorkflowGateResult?.workflowGates);
-        ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
-        const applicationSelection = releasePlan.applicationSelection;
-        const hostingAudit = await runWorkflowHostedResourceVerification("release", root, helpers, "prod", {
-          enabled: true,
-          strict: effectiveInput.verifyDeployedResources === true,
-          live: effectiveInput.verifyDeployedResources === true,
-          appId: singleSelectedWorkflowAppId(applicationSelection)
-        });
-        const releaseBackMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => backMergeRootProductionIntoStaging(root, true, {
-          version: rootVersion,
-          changelog: rootRelease?.changelog ?? null,
-          selectedVersions: effectiveVersions
-        }));
-        const devTagCleanupMode = effectiveInput.devTagCleanup ?? "safe-after-release";
-        const devTagCleanup = devTagCleanupMode === "off" ? (skipJournalStep(root, workflowRun.runId, "cleanup-dev-tags", { status: "skipped", reason: "disabled" }), { status: "skipped", reason: "disabled" }) : await executeJournalStep(root, workflowRun.runId, "cleanup-dev-tags", () => {
-          const cleanup = collectStaleDevTagCleanupReports(root, {
-            includePackages: effectivePackageSelection.selected,
-            branchScope: "all"
-          }, { execute: true });
-          return { ...cleanup, replacedDevReferenceCount: replacedDevReferences.length, releasedPackageDevTagCount: releasedPackageDevTags.size };
+        const backMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => {
+          const packageBackMerges = checkedOutWorkspacePackageRepos(root).filter((pkg) => selectedPackageSet.has(pkg.name)).map((pkg) => backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
+            subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
+            version: selectedVersions.get(pkg.name) ?? null,
+            sourceRef: PRODUCTION_BRANCH,
+            targetRef: STAGING_BRANCH
+          })));
+          const rootBackMerge = backMergeRootProductionIntoStaging(root, true, {
+            version: plannedRelease.rootVersion,
+            selectedVersions: stableVersions
+          });
+          return { packages: packageBackMerges, root: rootBackMerge };
         });
-        syncAllCheckedOutPackageRepos(root, STAGING_BRANCH);
-        const workspaceLinks = ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
+        const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "workspace-link", () => ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
         const payload = {
-          mode,
-          mergeStrategy: "merge-commit",
-          level,
-          fresh: input.fresh === true,
-          freshArchivedRuns: freshPreparation.archived,
-          resumed: workflowRun.resumed,
-          resumedRunId: workflowRun.resumed ? workflowRun.runId : null,
-          autoResumed: autoResumeRun != null,
-          rootVersion: String(rootRelease?.rootVersion ?? ""),
-          releaseTag: String(rootRelease?.rootVersion ?? ""),
-          releasedCommit: String(rootRelease?.releasedCommit ?? rootRepo.commitSha ?? ""),
-          stagingBranch: STAGING_BRANCH,
-          productionBranch: PRODUCTION_BRANCH,
-          touchedPackages: effectivePackageSelection.selected,
-          packageSelection: effectivePackageSelection,
-          applicationSelection,
-          replacedDevReferences,
-          releaseInstalls,
-          devTagCleanup,
-          publishWait,
-          repos: packageReports,
-          rootRepo,
-          releaseCandidate,
-          stagingWorkflowGates: stagingGateResult?.workflowGates ?? [],
-          releaseBackMerge,
-          hostedDeploymentState,
-          finalBranch: currentBranch(gitRoot) || STAGING_BRANCH,
-          pushStatus: {
-            stagingPushed: true,
-            productionPushed: true,
-            tagPushed: true
-          },
+          ...releaseBasePayload,
+          mode: plannedRelease.mode,
+          runId: workflowRun.runId,
+          releasePlan,
+          releaseGates,
+          workspaceUnlink,
+          releaseMetadata,
+          packageReleases,
+          rootRelease,
+          publishWait: publishWait.workflowGates,
+          backMerge,
           workspaceLinks,
-          ciMode,
-          workflowGates: [
-            ...Array.isArray(stagingGateResult?.workflowGates) ? stagingGateResult.workflowGates : [],
-            ...packageReports.flatMap((report) => report.workflowGates),
-            ...Array.isArray(rootWorkflowGateResult?.workflowGates) ? rootWorkflowGateResult.workflowGates : []
-          ],
-          hostingAudit,
-          ...worktreePayload(root, effectiveInput.worktreeMode)
+          releasedCommit: String(rootRelease.commit.commitSha ?? ""),
+          touchedPackages: selectedPackageNames,
+          finalBranch: STAGING_BRANCH
         };
         completeWorkflowRun(root, workflowRun.runId, payload);
         return buildWorkflowResult("release", root, payload, {
           runId: workflowRun.runId,
+          summary: "Treeseed production release completed successfully.",
           nextSteps: createNextSteps([
-            { operation: "status", reason: "Inspect release readiness and production state after the promotion." }
+            { operation: "status", reason: "Inspect release state after production promotion." }
           ])
         });
       } catch (error) {
-        const localCleanup = cleanupFailedReleaseLocalState(root, helpers, releaseCleanupSnapshot, effectiveInput.workspaceLinks ?? "auto");
-        const latestJournal = readWorkflowRunJournal(root, workflowRun.runId);
-        const lastCompleted = [...latestJournal?.steps ?? []].reverse().find((step) => step.status === "completed") ?? null;
-        const nextPending = latestJournal?.steps.find((step) => step.status === "pending") ?? null;
-        helpers.write(`[release][recovery] Last release phase: ${lastCompleted?.id ?? "not-started"}; next phase: ${nextPending?.id ?? "none"}.`, "stderr");
         try {
-          const repair = reattachRepairablePackageRepos(root, [STAGING_BRANCH, PRODUCTION_BRANCH], {
-            onProgress: (line, stream) => helpers.write(line, stream)
-          });
-          if (repair.blockers.length > 0) {
-            helpers.write(`[release][recovery] Package repos need manual review before retrying:
-${repair.blockers.join("\n")}`, "stderr");
-          }
-        } catch (repairError) {
-          helpers.write(`[release][recovery] Package repo repair failed: ${repairError instanceof Error ? repairError.message : String(repairError)}`, "stderr");
-        }
-        if (localCleanup.restored.length > 0) {
-          helpers.write(`[release][recovery] Restored generated release metadata in ${localCleanup.restored.length} repo(s).`, "stderr");
-        }
-        if (localCleanup.manualReview.length > 0) {
-          helpers.write(`[release][recovery] Local cleanup needs manual review:
-${localCleanup.manualReview.map((entry) => `- ${String(entry.repo ?? entry.scope ?? "repo")}: ${String(entry.reason ?? "unknown")}`).join("\n")}`, "stderr");
+          ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
+        } catch {
         }
-        helpers.write(`Safe recovery: npx trsd release --${level} --json, npx trsd release --${level} --fresh --json, or inspect with npx trsd recover --json.`, "stderr");
         failWorkflowRun(root, workflowRun.runId, error, {
           resumable: true,
           runId: workflowRun.runId,
           command: "release",
-          message: `Resume the interrupted release on ${STAGING_BRANCH}. Last phase: ${lastCompleted?.id ?? "not-started"}; next phase: ${nextPending?.id ?? "none"}.`,
-          recoverCommand: "npx trsd recover --json",
-          resumeCommand: `npx trsd release --${level} --json`,
-          localCleanup
+          message: "Resume the interrupted production release after fixing the cause.",
+          recoverCommand: "treeseed recover",
+          resumeCommand: `treeseed resume ${workflowRun.runId}`
         });
         throw error;
       }
@@ -4844,6 +5383,8 @@ async function workflowResume(helpers, input) {
           return workflowSwitch(resumedHelpers, journal.input);
         case "save":
           return workflowSave(resumedHelpers, journal.input);
+        case "update":
+          return workflowUpdate(resumedHelpers, journal.input);
         case "close":
           return workflowClose(resumedHelpers, journal.input);
         case "stage":
@@ -4866,7 +5407,7 @@ async function workflowRecover(helpers, input = {}) {
   try {
     return await withContextEnv(helpers.context.env, async () => {
       const root = resolveProjectRootOrThrow("recover", helpers.cwd());
-      const lock = inspectWorkflowLock(root);
+      const lock = inspectWorkflowLock(root, { scope: "worktree" });
       const journals = listWorkflowRunJournals(root);
       const session = resolveTreeseedWorkflowSession(root);
       const currentHeads = Object.fromEntries(
@@ -5107,19 +5648,27 @@ async function workflowDestroy(helpers, input) {
 }
 export {
   TreeseedWorkflowError,
+  destroyTreeseedBranchPreview,
+  normalizeReleaseCandidateMode,
+  normalizeSaveCiMode,
+  normalizeSaveLane,
+  reconcileTreeseedBranchPreview,
+  shouldUseHostedSaveCi,
   workflowCi,
   workflowClose,
   workflowConfig,
   workflowDestroy,
   workflowDev,
   workflowExport,
+  workflowProof,
   workflowRecover,
   workflowRelease,
+  workflowReleaseCandidate,
   workflowResume,
   workflowSave,
   workflowStage,
   workflowStatus,
   workflowSwitch,
-  workflowTagsCleanup,
-  workflowTasks
+  workflowTasks,
+  workflowUpdate
 };