@weftlet/toolkit 0.1.2 → 0.2.1

package/docs/RELEASING.md

@@ -1,6 +1,16 @@
 # Weftlet npm releases
 
-`@weftlet/core@0.1.1` and `@weftlet/toolkit@0.1.1` are published. Their first trusted
+`@weftlet/core@0.2.0` and `@weftlet/toolkit@0.2.0` are published through GitHub OIDC.
+[Run 40344526047](https://github.com/jchewitt/weftlet/actions/runs/40344526047) completed at
+commit `ffe7f1d81f0421b35220bd7ba5b1555246c7a0e1`, including registry integrity checks,
+package tags and GitHub Releases. The first attempt published core, then toolkit publication
+stopped with Sigstore `TLOG_CREATE_ENTRY_ERROR` HTTP 409. Re-running failed jobs on the same
+workflow restored the prepared archives and acceptance receipt; attempt 2 completed without
+changing versions. See [validation](VALIDATION.md) for the verification record.
+
+The first automatic release, 0.1.2, completed in
+[run 39672652013](https://github.com/jchewitt/weftlet/actions/runs/39672652013),
+including package tags and GitHub Releases at commit `3d8d1f38a9e70b38178921cdabf5e8714c417c1c`. The first trusted
 publication passed in [run 39661957651](https://github.com/jchewitt/weftlet/actions/runs/39661957651)
 from commit `720a5f964fe3cb6c438be6d22b4aa8b4ad44de17`, with matching registry archive integrity,
 npm provenance and a fresh public CLI installation. Earlier Weftlet and `@launch-echo` releases
@@ -24,8 +34,8 @@ preparation route; native Windows has focused CI coverage. See [validation](VALI
    **before** npm publication. Do not manually bump manifests or edit the generated plan.
 4. The plan change triggers **Weftlet release**. It validates and prepares both archives, publishes
    core followed by toolkit using npm trusted publishing, then verifies registry integrity.
-5. After both versions are verified, a separate job creates tags such as `@weftlet/core@0.1.2`
-   and `@weftlet/toolkit@0.1.2`, plus corresponding GitHub Releases, at that exact source commit.
+5. After both versions are verified, a separate job creates tags such as `@weftlet/core@0.2.0`
+   and `@weftlet/toolkit@0.2.0`, plus corresponding GitHub Releases, at that exact source commit.
    Existing tags are never moved. The publication job does not commit back to main.
 
 The bot uses GitHub's built-in token, not a personal access token. GitHub may require Settings →
@@ -138,7 +148,7 @@ Package-specific tags identify the exact published source, for example:
 
 ```sh
 git fetch --tags
-git switch --detach '@weftlet/toolkit@0.1.2'
+git switch --detach '@weftlet/toolkit@0.2.0'
 ```
 
 Tags support inspection and reproduction, not mutation of npm history. To roll a consumer back,
@@ -148,8 +158,8 @@ Verify a new public release in a fresh disposable project, substituting its vers
 
 ```sh
 npm init -y
-npx --yes @weftlet/toolkit@0.1.1 init --yes
-npx --yes @weftlet/toolkit@0.1.1 config validate
+npx --yes @weftlet/toolkit@0.2.0 init --yes
+npx --yes @weftlet/toolkit@0.2.0 config validate
 ```
 
 Check registry hashes, transitive core resolution and provenance. Deprecating the previous

package/docs/ROADMAP.md

@@ -3,6 +3,14 @@
 Project: `jchewitt/weftlet`. Extraction provenance is recorded in the
 [source inventory](SOURCE-INVENTORY.md).
 
+Forward direction is captured in the [Weftlet 2.0 product plan](WEFTLET-2.0-PLAN.md):
+consumer hardening, cited code-derived drafts, scoped approvals and reconciliation, an optional
+review website, source publication, managed AI and guided setup. “2.0” is a planning label;
+the published packages remain 0.2.0. The received consumer findings are tracked in the
+[consumer hardening and 1.0 task list](RELEASE-1.0-PLAN.md): first release the blocking
+document-identity patch, then address setup, reuse, diagnostics and document coverage before
+official 1.0 acceptance. The 2.0 plan distinguishes proposed work from delivered capability.
+
 | Milestone | Delivered and checked | Remaining limits |
 | --- | --- | --- |
 | 1. Standalone | Explicit committed inventory, core/toolkit boundary, public examples, build/tests, packed independent consumer and real TypeScript indexing | GitHub exported; both @launch-echo packages published at 0.1.0 and public installation verified |
@@ -10,7 +18,7 @@ Project: `jchewitt/weftlet`. Extraction provenance is recorded in the
 | 2b. Draft overlays | Base/content identity, reindexed replacement, delete/rename handling, separate checkout/agent heads | Full implementation reindex; changed prose invalidated pending re-extraction |
 | 3. Unified graph | RDF/SPARQL, SHACL, lossless projection, bounded continuation, six-stage async cross-source fixture, negative extraction/linkage cases | Local SELECT only; 100,000-fact projection bound; no universal language support |
 | 4. Governance | Canonical approved rules, dependency-cruiser/ESLint/jscpd, scoped debt/expiry, transitive inference, optional OML ADR/parity | No active OWL reasoner; live formal compilation unverified; heuristics remain advisory |
-| 5. Providers/DX | Codex adapter, HDesk live Windows public-example pass and cache reuse, CLI init/config and npx setup, tested module contract, validation/budgets/timeouts/cancellation/retries/cache identity, diagnostics/progress | Cloud live run remains filesystem-blocked; native Windows npm executable discovery needs improvement; other real providers planned |
+| 5. Providers/DX | Codex adapter, HDesk live Windows public-example pass and cache reuse, CLI init/config and npx setup, tested module contract, validation/budgets/timeouts/cancellation/retries/cache identity, diagnostics/progress | Cloud live run remains filesystem-blocked; native npm launcher discovery and CRLF integrity validated in hosted Windows; live auth follow-up and other real providers remain |
 | 6. Viewer | Same facts as agents, clustering, drill-down, bounded path highlighting, optional commit source links, authority/coverage/staleness | No real-browser automation; bounded pages, not a complete interactive explorer |
 
 HDesk results for `6710e9391a6a01345dab5f5be4ae0656e1c9d1ae` are recorded in
@@ -32,8 +40,48 @@ See [provider configuration](PROVIDERS.md#codex-authentication) and the validati
 Native Windows archive conversion, concurrent head-replacement and MCP file-symlink fixes are
 implemented with regression tests and pass focused hosted Windows CI. HDesk confirmation and
 full native Windows release preparation remain separate checks.
-Next work should be separate, reviewed increments: improve CRLF checkout integrity checks;
-run bounded semantic-quality evaluations; retain the passing hosted Ubuntu CI gate; validate fresh-cloud
+The Windows reliability increment adds native/npm Codex discovery, process-tree cancellation
+and Git-aware CRLF inventory/license checks. Hosted Windows passed 34 selected tests plus
+repository inventory and licenses; hosted Ubuntu passed the full 178-test publication gate.
+Browser and live authentication checks remain deferred. An advisory [self-repository impact
+evaluation](IMPACT-EVALUATION.md) now measures four realistic changes with real SCIP/RDF/SHACL
+and zero model assertions: 13/24 expected candidate files on the first page, 16/24 within
+three pages. The opt-in [committed source-project increment](ADR-010-committed-source-indexing.md)
+adds test/workspace indexing and improves the same cases to 15/24 first-page and 18/24
+three-page candidates, with typed relationships from 33 test files. [Explicit document linkage](ADR-011-explicit-document-links.md) now resolves cited Markdown
+references against committed files. With new contributor source mappings, a separately recorded
+input returns 22/24 first-page and 24/24 three-page candidates; three labeled distractions also
+appear. The old-source control remains 15/24 and 18/24 for that ordering.
+[Query ranking](ADR-012-impact-ranking.md) was measured against those exact saved snapshots
+without hydration: the document-link input improves to 24/24 on page one, with labeled distractions
+reduced from three to one within three pages. The older control improves to 19/24 on page
+one, but its distraction count worsens from zero to one. Missing document relationships stay
+missing, and all reachable facts remain available through versioned continuation. See the
+[fixed-input comparison](IMPACT-EVALUATION.md#fixed-snapshot-ranking-comparison).
+Broad query reachability and live semantic quality remain gaps; these four cases do not
+establish generalization or exhaustive precision.
+The [prospective dispatch evaluation](IMPACT-EVALUATION.md#prospective-dispatch-evaluation)
+adds three frozen synthetic cases outside Weftlet internals. Unchanged ranking retrieves
+15/16 expected files on page one; all seven case-specific distractions appear on later pages.
+Full continuation confirms the topic-string archival consumer is disconnected, while generic
+relative-import identity joins distinct domain modules. No cases or ranking were tuned after
+measurement. Original saved-snapshot results remain unchanged.
+[Relative module request identity](ADR-013-relative-module-requests.md) now scopes imports
+to their requesting directory. On those same frozen inputs, dispatch retains 15/16 candidates
+while three-page distractions fall from 7/7 to 0/7; Weftlet retains 24/24 first-page candidates
+and one later-page distraction. Refreshes and overlays have versioned identities, and old
+snapshots remain readable with their original facts. The archival routing gap remains without
+additional source evidence. [Explicit routing declarations](ADR-014-routing-declarations.md)
+now supply opt-in, cited producer/consumer bindings with inferred authority. A separately
+committed authored mapping improves same-SHA dispatch retrieval from 15/16 to 16/16 on page
+one, with zero labeled distractions. Drafts rebuild and invalidate affected bindings; these
+results do not establish deployed subscriptions or observed delivery.
+Next work should be separate, reviewed increments:
+run the [private consumer trial](CONSUMER-TRIAL.md) on predeclared real-project tasks;
+evaluate actual deployment/runtime routing evidence against the unchanged dispatch control;
+review explicit mappings
+and run a bounded live semantic comparison when the maintainer is ready;
+retain the passing hosted Ubuntu CI gate; validate fresh-cloud
 restoration; resolve the cloud-specific live provider block; add browser
 interaction/accessibility tests; benchmark larger RDF graphs; evaluate a second real provider.
 Figma and source-application reintegration are future adapter work.
@@ -49,8 +97,8 @@ preparation/publication under `@launch-echo`; the maintainer completed the 0.1.0
 source-application reintegration remain outside the authorized scope. See [release instructions](RELEASING.md).
 
 The maintainer authorized the Weftlet migration on 2026-10-21. Both `@weftlet/core` and
-`@weftlet/toolkit` are published at 0.1.1 through GitHub OIDC, with provenance and a fresh public
-installation verified. Changesets now prepares reviewed version PRs for the fixed package group;
+`@weftlet/toolkit` are published at 0.2.0 through GitHub OIDC; the publication and verification
+record is in [validation](VALIDATION.md). Changesets prepares reviewed version PRs for the fixed package group;
 merging a release plan triggers publication and package-specific tags/GitHub Releases.
 See [ADR 009](ADR-009-release-automation.md) and [release instructions](RELEASING.md).
 Earlier Tently packages remain available and undeprecated.

package/docs/SOURCE-INVENTORY.md

@@ -46,3 +46,13 @@ On 2026-10-21 the maintainer selected and created the `@weftlet` scope and autho
 to `@weftlet/core` and `@weftlet/toolkit`. This changes destination package names only; the original
 source SHA, imported-path inventory, copyright and attribution remain intact. The maintainer subsequently renamed GitHub to
 `jchewitt/weftlet` on the same date; the checkout remains `/workspace/tently`. See [migration](MIGRATING-TO-WEFTLET.md) and [release status](RELEASING.md).
+
+## Checkout line endings
+
+Destination inventory hashes use Git's CRLF-to-LF conversion only when Git would apply it to that
+path. Checks use `hash-object` without writing objects or staging; they do not change the index,
+Git configuration or checkout bytes. Binary and `-text` files retain their exact bytes. Real
+content edits still invalidate the inventory. Original imported source hashes are never normalized
+or recalculated. Custom clean filters/working-tree encodings on CRLF inputs are rejected instead
+of executed by the checker. Updates preserve CRLF in existing checkout files and the manifest.
+Generated license-notice checks also tolerate CRLF formatting while comparing the complete text.

package/docs/VALIDATION.md

@@ -8,6 +8,397 @@ The milestone entries below record the original cloud checks. Subsequent
 establishes live Codex success on Windows and the full deterministic checks on WSL,
 while identifying remaining native Windows issues.
 
+## Repository document identity patch, 2026-10-26
+
+The public reproduction confirms the reported 0.2.0 defect: two unchanged semantic
+assertions give one repository document ID different kinds and fail single-kind SHACL.
+[ADR-015](ADR-015-repository-document-identity.md) records the canonical identity policy,
+cache contract and immutable snapshot migration. The consumer follow-ups are tracked in
+the [1.0 plan](RELEASE-1.0-PLAN.md).
+
+- Local `pnpm context-graph:publication-check` passed: 227 deterministic tests (1 core,
+  226 toolkit), one optional OML skip, 12 advisory architecture findings, inventory,
+  licenses and a fresh packed-consumer CLI/npx/MCP, real SCIP and RDF/SHACL smoke.
+- The new public regression uses two committed source documents and a deterministic
+  module provider that reproduces the conflicting classifications. Both semantic facts
+  retain their citations, confidence and separate source/assertion authority; deterministic
+  document links and SPARQL join the canonical document. Real TypeScript indexing and
+  SHACL pass. Fresh extraction reports 2 extracted/0 reused; repeat reports 0/2 with
+  identical snapshot identity/content digest. Raw provider output is preserved byte for byte.
+- Seeded artifacts using the released 0.2.0 cache-key formula are not reused or overwritten.
+  Historical graph-v4 snapshot bytes remain unchanged and readable. Subject references
+  normalize too; unrelated concept-kind conflicts still fail SHACL. A missing document
+  mentioned in plain prose retains a cited implementation-gap diagnostic.
+- Independent review found and resolved that missing-path diagnostic regression. No blocking
+  findings remained. All 79 original imported source paths and source hashes are preserved.
+
+These are deterministic upstream checks, not live semantic-quality or private consumer
+acceptance results. The consumer's full hydration was stopped after its isolated reproduction;
+no complete consumer SHACL verdict or published snapshot is claimed. Full-graph validation
+latency remains a separate investigation. Release and hosted-check evidence will be recorded
+after the patch completes the normal publishing workflow.
+
+## Weftlet 0.2.0 publication, 2026-10-26
+
+The maintainer authorized publication of both packages. [Release PR 4](https://github.com/jchewitt/weftlet/pull/4)
+committed their `0.2.0` versions to main at `ffe7f1d81f0421b35220bd7ba5b1555246c7a0e1`.
+[Trusted-publishing run 40344526047](https://github.com/jchewitt/weftlet/actions/runs/40344526047)
+completed successfully on attempt 2. Both npm `latest` tags resolve to `0.2.0`.
+
+- Exact release-PR head `a818ee6312f6970015cea66f55cf6bb2cc62e363` passed the
+  [dispatched Ubuntu/Windows checks](https://github.com/jchewitt/weftlet/actions/runs/40042137308).
+  Local `pnpm release:prepare` also passed 222 deterministic tests, one optional OML skip,
+  12 advisory architecture findings, inventory, licenses and fresh packed-consumer checks.
+  The publication workflow repeated preparation at the merged source commit.
+- Independent review checked the generated release plan, versions/changelogs, all 79 original
+  source identities and the actual archives. Core contains 11 entries and toolkit 179;
+  runtime assets, public examples and licenses/notices are present. No credentials, Git history,
+  caches or generated graph snapshots were included. Toolkit's packed core dependency is `^0.2.0`.
+- Both public npm tarballs match the hosted prepared archives byte for byte, and those hashes
+  match the locally reviewed archives. Public SLSA provenance subjects match their SHA-512
+  digests and reference this exact commit, repository and `publish.yml` workflow. This checks
+  provenance content and source identity; it is not a separate cryptographic signature audit.
+- Attempt 1 published and verified core, then toolkit's provenance submission failed with
+  `TLOG_CREATE_ENTRY_ERROR` / HTTP 409 for an equivalent transparency-log entry. The core
+  acceptance receipt and original archives were retained. Registry state was inspected before
+  rerunning only failed jobs in the same run. Attempt 2 completed toolkit publication using the
+  unchanged version/archives; core was already present. No provenance setting was disabled.
+- Package tags `@weftlet/core@0.2.0` and `@weftlet/toolkit@0.2.0`, and their public GitHub
+  Releases, point to `ffe7f1d81f0421b35220bd7ba5b1555246c7a0e1`. The release records contain
+  the verified archive digests. Main's package versions agree with npm.
+- A fresh public-registry consumer on Linux / Node 24.19.0 installed only
+  `@weftlet/toolkit@0.2.0` directly (`npm install --ignore-scripts`); core resolved transitively
+  to `0.2.0`. Both lockfile registry URLs and integrity hashes match the prepared archives.
+  CLI init/configuration and the npm-exec launcher passed. Real TypeScript indexing produced
+  15 SCIP facts within 22 total facts; the impact query returned 22 and SHACL conformed.
+  Repeat hydration preserved snapshot identity/content. Saved queries preserved snapshot bytes
+  and labeled excluded working edits. MCP initialized, discovered `impact.scan`, returned a
+  bounded 20-fact response and reported a missing snapshot as an error. No semantic documents
+  were selected: both hydrations extracted/reused zero artifacts, so this does not establish
+  model extraction or semantic artifact reuse.
+
+Live model/authentication quality, browser interaction and genuine fresh-task cloud restoration
+remain separate. No source application was changed and no live model call was made for release.
+
+## Development workspace recovery, 2026-10-23
+
+The existing Codex development workspace became executable again at repository commit
+`3617c71e29af869feccec1f5b1390c3082149b12`. Runtime status reported current observations and
+connected execution; shell access, the repository identity and its initially clean worktree
+were confirmed. The cause of the earlier executor failure was not established. A reported
+OAuth 404 from another project was not reproduced or attributed to the executor failure.
+
+Linux, Node 24.19.0, pnpm 10.18.2:
+
+- The existing restoration checkpoint passed `node scripts/check-restoration.mjs --verify`:
+  its snapshot digest was retained, ten facts were queried with an intentionally unavailable
+  provider, and the historical evidence remained ineligible for current-diff validation.
+  No checkpoint or saved evidence was regenerated to obtain that result. A build had already
+  run; verification preceded the new governance run.
+- The full deterministic publication gate passed again: **222 tests** (1 core + 221 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses and
+  fresh packed-consumer installation/indexing/RDF/SHACL/viewer-generation/MCP checks.
+- The new [consumer-trial recipe](CONSUMER-TRIAL.md) was exercised in a separate public
+  dispatch Git repository using fresh npm installation of locally packed core/toolkit archives.
+  The documented Bash blocks ran with only the sample task/path replaced. The deterministic
+  zero-assertion provider produced three artifacts; the repeat extracted zero and reused three
+  with unchanged snapshot identity/content. Diagnostics, SHACL and two distinct 60-fact pages
+  passed. A deliberate exit-7 child retained its error/status and stopped the shell before a
+  subsequent marker could run. Independent review confirmed the corrected fail-fast handling,
+  captured-commit pinning and command compatibility. This is a command-recipe check, not a
+  live semantic-quality measurement. An initial source-workspace rehearsal stopped at npm's
+  `workspace:^` metadata handling; the successful check used the documented installed consumer.
+
+This was recovery within the existing conversation, not the new-task procedure in
+[environment validation](ENVIRONMENT-VALIDATION.md). It establishes neither fresh-cloud
+restoration nor live model/authentication recovery. No model request, source-application
+change or npm publication was part of these checks.
+
+## Explicit routing declarations, 2026-10-23
+
+[ADR 014](ADR-014-routing-declarations.md) adds opt-in committed source mappings for explicit
+producer/consumer bindings. Implementation `5b8d49679f48837fe2ea465940b8c852e543cf5d` was
+measured on input/protocol commit `e5510479c0545e38a41a902b65839529a3e66e73`, frozen before
+measurement. The original 27 dispatch inputs, cases and evaluator/ranking hashes are unchanged.
+The public-safe comparison is `evaluations/dispatch/routing-baseline.json`.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- The same-SHA no-routing control retains **15/16 expected files** on page one and within
+  three pages, with **0/7 labeled distractions**. Enabling the single authored declaration
+  retrieves **16/16 on page one and within three pages**, retaining **0/7 distractions**.
+  This measures use of a supplied mapping, not discovery or verification of a deployed route.
+- Hydration produces **227 control facts / 229 enabled facts**. Only two inferred,
+  deterministic routing facts are added; every non-routing fact field matches except its
+  containing snapshot ID. Diagnostics, SCIP digest and semantic artifact keys are unchanged.
+  Both runs reuse all three control artifacts with zero extraction/model calls. Repeating
+  enabled hydration retains snapshot identity/content and again reuses all three artifacts.
+- Full continuation returns **198 unique facts** (60/60/60/18), versus 183 reachable in the
+  control. All six archival implementation facts and seven archival test facts are reachable;
+  three implementation facts and one test fact appear on page one. A test-file relationship
+  does not assert test execution or delivery. No refund/audit distraction facts are returned.
+- Direct SPARQL returns the exact producer/binding/consumer pair with inferred authority.
+  SHACL conforms and RDF projection matches every fact field. The existing unresolved
+  Markdown reference remains a diagnostic; no approved intent or runtime evidence is added.
+- The final full publication gate passed **222 deterministic tests** (1 core + 221 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses and
+  fresh packed-consumer installation. The installed smoke extracts a committed routing file
+  and includes its consumer in the complete SCIP/RDF/SHACL/query/viewer/MCP path.
+- Tests cover strict schemas/duplicate JSON keys, bounds, scoped identity, same-topic binding
+  isolation, exact regular Git blobs including Unicode/spaced paths, missing/ambiguous
+  endpoints, dirty committed querying, rename/delete, tracked-but-ignored manifests, repeated
+  overlays, draft authority, outside-scope endpoint rejection and failed-refresh preservation.
+  Secondary review found and resolved diagnostic ordering and draft freshness issues before
+  the final full gate. The isolated overlay now preserves all archived tracked inputs even
+  when `.gitignore` matches them.
+- Five historical snapshot files retain their recorded SHA-256 digests. Saved-only rescoring
+  of the latest dispatch and Weftlet graphs preserves their scores and reachability (15/16
+  and 24/24 first-page candidates respectively). All 79 original imported source paths/source
+  hashes remain intact. No source application was modified.
+
+Hosted Ubuntu/Windows results are attached to the implementation PR. Browser interaction,
+live provider authentication, broader semantic quality and actual deployment/runtime routing
+validation remain separate. This increment includes a minor changeset but no npm publication.
+
+## Relative module request identities, 2026-10-22
+
+[ADR 013](ADR-013-relative-module-requests.md) scopes generic relative imports to the
+importing directory. Implementation `26c47d5b55f9390fe38b4928d1a8274eaf893583` was measured
+against the frozen dispatch input and the existing Weftlet document-link input. Cases,
+configuration, budgets, evaluator and ranking bytes are unchanged. The public-safe record
+is `evaluations/dispatch/relative-imports-baseline.json`.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- Dispatch retains **15/16 expected candidates** on page one and within three pages.
+  Three-page labeled distractions fall from **7/7 to 0/7**; page one remains 0/7.
+  The reachable component shrinks from 214 to 183 facts. Full continuation returns all
+  183 unique facts (60/60/60/3), with no refund/audit distraction or archival consumer.
+  The archival file still has six local facts but no extracted operational route.
+- The Weftlet input retains **24/24 first-page and three-page candidates**, with 0/4
+  first-page and 1/4 three-page distractions. All scans still reach 3,648 facts and stop
+  at 180; telemetry remains a later-page distraction for atomic publication. These results
+  do not establish exhaustive precision or broader semantic quality.
+- Real SCIP/document/RDF/SHACL hydration retains 227 dispatch and 3,648 Weftlet facts.
+  SCIP and document facts match their prior versions in every field except containing
+  snapshot ID. Dispatch reused three semantic control artifacts and Weftlet reused six,
+  extracting zero. A repeated dispatch refresh preserves identity/content and reuses all
+  three again. No model calls, approved sources or runtime observations were added.
+- Snapshot assembly v4 and file extractor v2 coexist with old saved evidence. Draft
+  overlay publication identity also binds the extractor version, while capture-v2 digests
+  remain compatible. Tests cover old/new overlay coexistence, immutable committed heads,
+  repeated draft identity, rename/delete behavior and manifest versions.
+- The full publication gate passed **208 deterministic tests** (1 core + 207 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses and
+  fresh packed-consumer installation. The installed smoke exercises the new relative-request
+  module alongside actual SCIP, RDF/SHACL, continuation, visualization and MCP checks.
+  Actionlint passed without shellcheck.
+- Independent review verified all 27 frozen dispatch input hashes, six evaluator hashes,
+  three legacy saved-snapshot byte hashes and their original scores/reachability. All 79
+  imported source paths/source hashes are preserved. Code review found no blockers; its
+  control-character coverage observation was corrected before the final full gate.
+
+Hosted Ubuntu/Windows results are attached to the implementation PR. Corrected extraction
+requires an explicit refresh; saved queries keep their original facts and do not rebuild.
+Browser interaction, live authentication and broader semantic quality remain separate.
+No npm publication is part of this increment.
+
+## Prospective dispatch evaluation, 2026-10-22
+
+Inputs, labels and protocol were committed at `fa902165a1f212a6d3245c847e1ab9b64a69715b`
+before any queries. Production ranking remains byte-identical to `proximity-diversity-v1`.
+The [evaluation protocol](IMPACT-EVALUATION.md#prospective-dispatch-evaluation) and
+`evaluations/dispatch/baseline.json` record the public-safe measurements and provenance.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- Real SCIP/document/RDF/SHACL hydration produced **227 facts**, with zero model assertions,
+  approved intent sources or runtime references. Repeat hydration extracted zero and reused
+  three control artifacts, retaining snapshot identity/content digest. Fixture TypeScript
+  checking and four exported behavior checks passed separately.
+- All three cases use the existing 60-fact/three-page/depth-32 budget. Candidate recall is
+  **15/16 on page one and within three pages**. No labeled distraction appears on page one;
+  **7/7 case-specific distraction labels** appear within three pages. These are synthetic
+  candidate-file measurements, not a quality gate or exhaustive precision result.
+- Supplemental full continuation returned 214 unique facts across four pages, with no
+  archival-file fact. Its local relationships exist but the expected operational route is
+  disconnected. SCIP distinguishes the two domain policy functions; cited generic import
+  witnesses show the cross-domain `./policy.js` connection. The intentionally unresolved
+  Markdown reference has a diagnostic and no guessed target.
+- Original Weftlet snapshots, suite, reachable counts, recall and distraction scores remain
+  unchanged. Both saved snapshot files match their recorded SHA-256 digests. All 79 original
+  imported source paths and source hashes are preserved.
+- Focused evaluator checks pass with a real independent Git repository and an unrelated cwd:
+  selected suite/config, separate evaluator/evidence commits, real indexing/document links,
+  saved-only scoring, immutable snapshot content, failed-report preservation, missing-snapshot
+  refusal and live-provider refresh refusal. Boundary tests also reject impostor modules and
+  repository/suite/configuration/draft mismatches. Fixture result scores are not CI thresholds.
+- The full publication gate passed **203 deterministic tests** (1 core + 202 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses and
+  fresh packed-consumer installation/indexing/RDF/SHACL/MCP checks. Actionlint passed without
+  shellcheck; strict TypeScript checking of the evaluator also passed.
+
+Hosted Ubuntu/Windows outcomes are recorded with the implementation PR.
+No ranking/source-extraction change, live model call, browser result, authentication result
+or npm publication is part of this increment. Broader real-project and semantic-quality
+validation remain separate.
+
+## Impact ranking, 2026-10-22
+
+[ADR 012](ADR-012-impact-ranking.md) describes query ordering by weighted proximity and
+source diversity. Implementation `2e4a3bbc55bd3a15cf619f56827963a699a5b56b` was measured
+against two existing immutable snapshots, with no hydration or model calls. The public-safe
+record is `evaluations/weftlet/ranking-baseline.json`; cases, labels, budgets, configuration,
+snapshot bytes and reachable fact counts are unchanged.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- On the document-link snapshot, first-page candidate retrieval improved from **22/24 to
+  24/24**, retaining 24/24 within three pages. Labeled distractions fell from 1/4 to 0/4
+  on page one and from 3/4 to 1/4 within three pages. The query test and setup doctor now
+  appear on page one. Telemetry is a new later-page distraction for atomic publication;
+  the aggregate improvement does not mean that every case has less noise.
+- On the older source-project control, first-page retrieval improved from 15/24 to 19/24
+  and three-page retrieval from 18/24 to 19/24. The five missing document relationships
+  remain absent. Labeled distractions worsened from 0/4 to 1/4 within three pages, again
+  telemetry. These four cases from one repository do not establish generalization or
+  exhaustive precision. Every scan remains truncated after 180 facts with continuation.
+- The full publication gate passed: **197 deterministic tests** (1 core + 196 toolkit),
+  one optional OML skip, build, 12 advisory architecture findings, inventory, licenses
+  and fresh packed-consumer installation. The installed smoke now exhausts ranked
+  continuation over actual extracted facts, checking for duplicate or missing results.
+- Focused coverage includes large-source consumer diversity, deep asynchronous flows,
+  generic shared imports, citation-only anchors, stable ties across commit-derived IDs,
+  complete pagination, versioned continuation rejection and evaluator version drift.
+  The real TypeScript/RDF pipeline retains field-for-field projection equivalence.
+- The first full run omitted the cloud's writable cache/store settings, causing four
+  installation-fixture failures. Correcting the command environment produced the passing
+  full rerun above; no source workaround was needed. Actionlint passed without shellcheck.
+  All 79 original import paths and source hashes remain unchanged.
+
+Hosted Ubuntu/Windows outcomes are attached to the implementation PR. Ranking changes
+ordering only, preserving evidence authority, confidence, scope and current-diff eligibility.
+Saved snapshots need no refresh; old continuation tokens require restarting the scan.
+Browser interaction, live-provider/authentication checks and broader semantic quality remain
+deferred. No new source approval, runtime observation or npm publication is claimed.
+
+## Explicit document linkage, 2026-10-22
+
+[ADR 011](ADR-011-explicit-document-links.md) describes committed Markdown references,
+precise citations, authority boundaries, and the new snapshot assembly identity. Implementation
+`90726be3751cf23de7f1cdd595d1e9ddb151b139` is measured separately from the evidence inputs.
+The six documents' source mappings were committed at
+`dcef64001d8d47cd1aeb4c1434992612158a104a`, before the linker implementation.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- Full publication gate: **192 deterministic tests** (1 core + 191 toolkit), one optional
+  OML skip, build, 12 advisory architecture findings, inventory, licenses and fresh packed
+  consumer. The installed smoke now parses committed Markdown and combines its references
+  with real SCIP facts before RDF/SHACL validation. Actionlint passed without shellcheck.
+- Focused cases cover relative/root/reference-style/encoded Markdown destinations, CRLF
+  source citations, duplicate basenames without guessing, missing/deleted/renamed paths,
+  directories, URLs, code examples, and distinct source approval/assertion review. Real
+  pipeline hydration links a test using SCIP's Evidence identity, passes SHACL and retains
+  field-for-field RDF projection equivalence. Cached prose is rechecked against target
+  deletion, while the preceding immutable snapshot stays readable.
+- The original saved v2 evidence was queried without hydration: its digest and 15/24
+  first-page, 18/24 three-page scores remain unchanged. Fresh assembly uses a different
+  identity, binds the linker version, and reuses the existing semantic artifacts.
+- The fixed old-source control still returns 15/24 first-page and 18/24 three-page candidates.
+  With the new explicit source mappings, the measurement returns **22/24 first-page and
+  24/24 three-page candidates**. All five expected intent-document paths are retrieved.
+  This new input also contains the intervening source-indexing implementation; it is not
+  an isolated model-quality or ranking experiment. The original case labels and budgets
+  are unchanged. `evaluations/weftlet/document-links-baseline.json` records the evidence
+  identities, provenance witnesses, scores, noise and limitations.
+- Three of four labeled distractions appear within three pages, including one on the first
+  page. All scans remain truncated at 180 facts. Better candidate recall does not establish
+  precision, complete product understanding, or a safe change. Ranking is measured separately
+  in the subsequent increment above.
+- An initial real-document run caught false missing-file diagnostics for slash-separated
+  prose and package names. The final linker diagnoses unresolved explicit Markdown links;
+  unresolved literal mentions are ignored. Regression cases include the observed examples.
+  All 79 original import paths and source hashes remain unchanged.
+
+Hosted Ubuntu/Windows outcomes are attached to the implementation PR. No live model call,
+new source approval, browser interaction, runtime behavior or authentication result is claimed.
+The control provider returns no assertions. Browser and live-provider validation remain deferred.
+
+## Committed source-project indexing, 2026-10-22
+
+[ADR 010](ADR-010-committed-source-indexing.md) records the opt-in profile and its limits.
+Toolkit implementation `1c2c699` was evaluated against the same evidence commit
+`eeaaa342d62c11eeef44bfdf81fa8dedcfeb205d`, unchanged case labels and query budgets.
+`evaluations/weftlet/source-project-baseline.json` records the full implementation SHA,
+snapshot/configuration/index digests, scores, remaining misses and source coverage.
+
+Linux cloud, Node 24.19.0, pnpm 10.18.2:
+
+- First-page candidate retrieval improved from 13/24 to 15/24; three-page retrieval
+  improved from 16/24 to 18/24. Typed SCIP relationships now cover 33 test files, including
+  the lifecycle test, and link the shared core contract. Five expected intent documents
+  remain unlinked and the MCP file remains outside the query budget.
+- The new graph has 3,490 facts (2,970 SCIP and 520 repository-file facts). Repeated
+  hydration reused all six document-control artifacts with identical snapshot identity
+  and content digest `6f30f62900e37a6d2d266bcd3bba54941b1cab3997602eefef3320b0d0e66fc3`.
+  Rerunning the original profile preserved its prior snapshot, digest and scores.
+- Real SCIP regression fixtures prove committed contract/test linkage through a workspace
+  re-export, ignored/dirty-source isolation, repeat digest stability, rename/delete
+  replacement, and capture of draft changes outside ordinary code/evidence roots.
+  Invalid scopes/aliases fail before SCIP. Missing alias-definition selection was caught
+  during development; both entry points and definition files must be explicitly selected.
+- The full publication gate passed: 187 deterministic tests (1 core + 186 toolkit),
+  one optional OML skip, builds, 12 advisory architecture findings, inventory and licenses.
+  Fresh packed-consumer checks now also exercise a source alias and a test excluded by
+  its build config, along with the existing npx/RDF/SHACL/viewer-output/MCP checks.
+- Workflow syntax passed actionlint. All 79 original source import paths/hashes remain
+  unchanged. The Windows workflow includes the new real-indexing and overlay regressions;
+  hosted outcomes are attached to the implementation PR.
+
+No dependency installation in evidence archives, live model run, runtime observation,
+owner approval, browser interaction or new authentication result is claimed. This mode
+does not inherit build compiler settings or establish complete external dependency resolution.
+
+## Self-repository impact evaluation, 2026-10-21
+
+The [evaluation protocol](IMPACT-EVALUATION.md) and public-safe
+`evaluations/weftlet/baseline.json` record a deterministic control against committed
+Weftlet `eeaaa342d62c11eeef44bfdf81fa8dedcfeb205d`. The active checkout contained
+the new evaluator; its source/suite/configuration digests are recorded separately.
+No current working source bytes were substituted for that evidence commit.
+
+On Linux, Node 24.19.0 and pnpm 10.18.2:
+
+- Real SCIP, RDF/SHACL and publication produced 1,369 facts. Four fixed scenarios
+  retrieved 13/24 expected candidate files on the first page and 16/24 in three pages.
+  These are measurements, not a quality pass. Intent documents, workspace contracts,
+  test coverage and query ranking have the gaps described in the protocol.
+- Repeated hydration extracted zero and reused six document-control artifacts, retaining
+  snapshot identity and content digest
+  `5b4003c527b0f797d45814679326c59da995bc677d0706768a9d9b1b21aedb4f`.
+- Saved-snapshot scoring succeeded with the semantic-artifact directory temporarily
+  unavailable and returned identical recall. No hydration phases ran; artifacts were
+  restored afterward. Missing-snapshot and live-provider-refresh probes both failed
+  clearly without starting an indexer or model.
+- Five evaluator tests passed, covering first/later-page scores, extraction versus
+  bounded-retrieval misses, non-relationship exclusions, duplicate/drifting pages,
+  stale case paths and invalid budgets. Strict TypeScript checking of the evaluator passed.
+- The full publication gate passed: 183 deterministic tests (1 core + 182 toolkit),
+  one optional OML integration skipped, builds, 12 advisory architecture findings,
+  inventory, licenses and fresh packed-consumer installation/indexing/RDF/MCP smoke.
+  All 79 original import paths and source hashes remain unchanged.
+
+Hosted [checks for the initial evaluation commit
+8e82453d92357451e832f3bf16666a6bef89b6de](https://github.com/jchewitt/weftlet/actions/runs/39687986720)
+also passed on Ubuntu (full publication gate) and Windows (34 selected reliability tests,
+inventory and licenses). The full self-repository control run above was performed in Linux
+cloud; these hosted checks do not imply a Windows evaluation run or browser validation.
+
+No live semantic assertions, runtime traces, owner approvals, browser interactions or
+new authentication results are claimed. The control sends no model requests. Broader
+semantic quality still needs a separately bounded live run and human citation review.
+
 ## Milestone 1: standalone baseline
 
 Passed `pnpm context-graph:publication-check`:
@@ -556,3 +947,50 @@ archives and conflicting tags, and resume interrupted creation without duplicate
 tests select earlier attempts and reject expired or ambiguous artifacts. No paid model call or
 new npm version was published by these tests. Hosted version-PR operation is checked separately;
 a future merged release remains the integration test of automatic publish and record creation.
+
+## Automatic 0.1.2 release and Windows reliability — 2026-10-21
+
+[Release run 39672652013](https://github.com/jchewitt/weftlet/actions/runs/39672652013) completed
+preparation, npm trusted publication and release records at
+`3d8d1f38a9e70b38178921cdabf5e8714c417c1c`. Both registry `latest` tags now identify 0.1.2.
+Both package-specific Git tags resolve to that exact commit, and GitHub Releases were created.
+Versions were committed on main before publication. This validates the first merged Changesets
+release through the automatic push trigger; no post-publication version commit was required.
+
+The next Windows reliability increment adds common discovery for native Codex executables and
+standard global/project-local npm launchers. Tests use actual npm-created launchers with a
+synthetic public CLI to exercise diagnostics, login status and source-isolated extraction. They
+also cover PATH precedence, spaces/metacharacters, rejected/broken shims, secret filtering,
+discovery timeout/cancellation, and termination of a launcher with an active child. They make no
+live Codex request and do not validate real account authentication or model quality.
+
+Inventory tests use actual Git checkouts with core.autocrlf=true and explicit eol=crlf attributes.
+They check unchanged source hashes, checkout bytes, Git configuration and index; genuine edits
+still fail. Binary and -text imports retain exact bytes. Custom filters are rejected without
+execution. License checks accept CRLF formatting while still comparing complete notice text.
+All 79 original source paths/hashes remain unchanged.
+
+The full local publication gate passed on Linux, Node 24.19.0 / pnpm 10.18.2: **177 deterministic
+tests** (1 core + 176 toolkit/example/script), one optional OML test skipped, build, architecture
+(12 advisory findings), inventory, licenses and fresh packed-consumer smoke. Actionlint passed
+with shellcheck integration disabled. The Windows CI job now runs the added launcher, process,
+inventory and license checks; its native result is recorded separately after execution. Browser
+interaction and live authentication testing remain explicitly deferred by the maintainer.
+
+
+The first hosted Windows run at `6f2f83f` passed all **33** selected tests and the repository
+inventory check, including real npm launchers and process-tree cancellation. Its newly enabled
+license check caught CRLF conversion of a pinned reviewed notice. That check now shares the
+Git-aware content reader; the reviewed notice and its approved SHA-256 remain unchanged.
+Discovery time is included in existing probe/extraction timeout budgets. Updated hosted checks
+are required before merging this increment.
+
+
+PASS: [hosted run 39676848049](https://github.com/jchewitt/weftlet/actions/runs/39676848049)
+at `ef2f8e31cbcae402ca08979e90aff4f00fb91c77`. Ubuntu passed the full publication gate with **178 deterministic tests**
+(1 core + 177 toolkit/example/script), one optional OML test skipped, 12 advisory architecture
+findings, build, inventory, licenses and packed-consumer smoke. Native Windows passed **34**
+selected tests, including global/local npm launcher installation, discovery, login/extraction
+plumbing, process-tree cancellation, CRLF inventories, storage/Git and all original MCP startup
+cases. The repository inventory and complete license checks also passed natively. This is focused
+Windows coverage, not a full native Windows publication gate or a live Codex account/model test.

package/docs/VIEWER.md

@@ -4,6 +4,11 @@
 renders the same Context Pack returned by `impact.scan`. HTML is self-contained; DOT and SVG
 remain available. No CDN, service, model or alternative graph extraction is involved.
 
+[Visualization rendering](../src/visualization/visualization.ts) consumes the
+[impact-query result](../src/graph/query.ts). [Viewer interaction](../src/visualization/viewer-interaction.ts)
+handles page-local filtering and path selection. [Rendering tests](../src/visualization/visualization.test.ts)
+check generated output; interactive browser validation remains a separate check.
+
 Nodes are grouped by evidence lane, then module/layer metadata or node kind. Filter by cluster,
 authority or source text. Select a node (click or Enter) to inspect its relationships, confidence,
 extractor, source approval, extraction review state and commit-bound citations. The neighbor