@wenathlan/saddle 2.0.154 → 2.0.155

package/docker.config

@@ -2,7 +2,7 @@
   "meta": {
     "name": "docker.config",
     "title": "saddle - Docker Engine and Containerization Configuration",
-    "version": "2.1.6",
+    "version": "2.0.154",
     "date": "2026-08-22",
     "language": "en",
     "sources": [
@@ -106,14 +106,21 @@
   "platforms": {
     "architectures": [
       "linux/amd64",
+      "linux/amd64/v2",
       "linux/arm64",
+      "linux/arm/v7",
+      "linux/arm/v6",
       "linux/ppc64le",
-      "linux/s390x"
+      "linux/s390x",
+      "linux/riscv64",
+      "linux/386",
+      "linux/mips64le",
+      "linux/loong64"
     ],
     "primary": "linux/amd64",
     "qemuEmulation": true,
     "nativeBuild": true,
-    "note": "the four-arch family standard (amd64, arm64, ppc64le, s390x) the one container file and the publish lanes carry; amd64 builds native, the other legs ride QEMU emulation; unknown/* stays rejected as not runnable"
+    "note": "the eleven-arch family standard (PR15b: amd64, amd64/v2, arm64, arm/v7, arm/v6, ppc64le, s390x, riscv64, 386, mips64le, loong64 - the complete linux platform surface docker/buildx carries, the owner's law: eleven OS architectures for every container of every application) the one container file and the publish lanes carry; amd64 and amd64/v2 build native, the other nine legs ride QEMU emulation; unknown/* stays rejected as not runnable"
   },
   "runtimeBase": {
     "nodeImage": "node:26.7.0-alpine",
@@ -471,11 +478,18 @@
     "multiArch": {
       "platforms": [
         "linux/amd64",
+        "linux/amd64/v2",
         "linux/arm64",
+        "linux/arm/v7",
+        "linux/arm/v6",
         "linux/ppc64le",
-        "linux/s390x"
+        "linux/s390x",
+        "linux/riscv64",
+        "linux/386",
+        "linux/mips64le",
+        "linux/loong64"
       ],
-      "command": "docker buildx build --platform linux/amd64,linux/arm64,linux/ppc64le,linux/s390x --cache-from type=gha --cache-to type=gha,mode=max --push -t ghcr.io/vhe/sandbox:29.7.2 ."
+      "command": "docker buildx build --platform linux/amd64,linux/amd64/v2,linux/arm64,linux/arm/v7,linux/arm/v6,linux/ppc64le,linux/s390x,linux/riscv64,linux/386,linux/mips64le,linux/loong64 --cache-from type=gha --cache-to type=gha,mode=max --push -t ghcr.io/vhe/sandbox:29.7.2 ."
     },
     "actionsWorkflowUses": [
       "docker/setup-buildx-action@v4.3.0",
@@ -623,7 +637,7 @@
   "labels": {
     "org.opencontainers.image.title": "saddle-v6",
     "org.opencontainers.image.description": "Saddle v6 virtualization orchestrator with QEMU 11.1.0, Node 22 LTS, Python 3.13.5, MTTG, Passage, OVMF",
-    "org.opencontainers.image.version": "2.1.6",
+    "org.opencontainers.image.version": "2.0.154",
     "org.opencontainers.image.created": "2026-08-22T00:00:00Z",
     "org.opencontainers.image.authors": "Saddle Core <core@saddle.dev>",
     "org.opencontainers.image.url": "https://saddle.dev",
@@ -635,7 +649,7 @@
     "org.opencontainers.image.base.name": "debian:bookworm-slim",
     "org.opencontainers.image.base.digest": "sha256:bookworm-slim-pinned-2026-08-22",
     "saddle": {
-      "com.saddle.version": "2.1.6",
+      "com.saddle.version": "2.0.154",
       "com.saddle.engine": "qemu-11.1.0",
       "com.saddle.modes": "32",
       "com.saddle.forge.mirrors": "github,gitea,forgejo",
@@ -660,9 +674,16 @@
     "target": "runtime-base",
     "platforms": [
       "linux/amd64",
+      "linux/amd64/v2",
       "linux/arm64",
+      "linux/arm/v7",
+      "linux/arm/v6",
       "linux/ppc64le",
-      "linux/s390x"
+      "linux/s390x",
+      "linux/riscv64",
+      "linux/386",
+      "linux/mips64le",
+      "linux/loong64"
     ],
     "cacheFrom": [
       "type=gha",

package/docs/artifactavailability.md

@@ -141,7 +141,7 @@ The available metadata files are `manifest.android.1.8.15.json`, `manifest.conta
 
 ## 1.8.16 verified release matrix
 
-The published [v1.8.16 release](https://github.com/wenathlan/saddle/releases/tag/v1.8.16) contains 38 attached assets: six Linux desktop artifacts, six Windows desktop artifacts, four macOS desktop artifacts, two Android artifacts, one container archive, one browser extension, nine manifests, and nine checksum files. The asset names match the matrix in [releasenotes.1.8.16.md](releasenotes.1.8.16.md).
+The published [v1.8.16 release](https://github.com/wenathlan/saddle/releases/tag/v1.8.16) contains 38 attached assets: six Linux desktop artifacts, six Windows desktop artifacts, four macOS desktop artifacts, two Android artifacts, one container archive, one browser extension, nine manifests, and nine checksum files. The asset names match the matrix in [releasenotes1816.md](releasenotes1816.md).
 
 The release-event Android workflow stopped because production signing secrets were not configured. The separately successful manual Android run `31839378707` used the workflow's explicit `ci-test-key` option and attached the APK, AAB, checksum, and manifest. No iOS artifact is claimed because Apple signing, provisioning, and export credentials were not configured. Desktop artifacts remain `unsigned`, the container manifest remains `caller-owned`, and no result is represented as production signing, notarization, registry trust, SBOM validation, or vulnerability status without its own evidence.
 
@@ -151,7 +151,7 @@ The release-evidence API can normalize and evaluate results supplied by complete
 
 The 1.8.17 candidate keeps the established release asset contract while expanding the GHCR image index to `linux/amd64`, `linux/arm64`, and `linux/ppc64le`. The workflow must inspect the pushed index before this document treats those platform variants as available. The attached `saddle.container.1.8.17.tar.gz` remains one archive artifact and is not evidence of a Windows container variant.
 
-`windows/amd64`, `linux/arm/v7`, and `linux/386` are not claimed by this candidate. A Windows image requires its own versioned Windows base, Dockerfile, runner, and compatibility validation; the existing Debian Linux Dockerfile cannot produce it by adding a platform string. `unknown` descriptors are not runnable targets. The platform decision and evidence limits are detailed in [containerplatforms.1.8.17.md](containerplatforms.1.8.17.md).
+`windows/amd64`, `linux/arm/v7`, and `linux/386` are not claimed by this candidate. A Windows image requires its own versioned Windows base, Dockerfile, runner, and compatibility validation; the existing Debian Linux Dockerfile cannot produce it by adding a platform string. `unknown` descriptors are not runnable targets. The platform decision and evidence limits are detailed in [containerplatforms1817.md](containerplatforms1817.md).
 
 ## 1.8.17 verified container publication
 

package/docs/browser.md

@@ -1,7 +1,24 @@
 # Saddle browser surface
 
-The root `browser/` directory contains the transport-neutral browser-agent contracts: session state, context, snapshots, fingerprints, Playwright integration, recording and agent orchestration. It is library logic and is shared by callers; it is not a second copy of the desktop UI.
+The root `browser.ts` carries the transport-neutral browser-agent contracts of the engine: session state, context, snapshots, fingerprints, the virtual-browser request/decision/handoff/receipt family, the optional Playwright adapter, recording and agent orchestration (sections 1-9 of the grand merge). It is library logic and is shared by callers; it is not a second copy of the desktop UI.
 
 The user-facing browser application is the existing Tauri shell in `desktop/`, which wraps the compiled `web/dist/public` surface on Windows, Linux and macOS. Android and iOS convert the same web output through Capacitor. This boundary keeps browser behavior in the library and keeps presentation and native packaging in their target surfaces.
 
+## The Manifest V3 extension migrated to devthink (wave 2 regrouping)
+
+The Chrome Manifest V3 extension surface — the former sections 10-17 of `browser.ts` (`extension/permissions`, `extension/protocol`, `extension/content`, `extension/popup`, `extension/pagebridge`, `extension/worker`, `extension/serviceworker`, `extension/build`) — now lives in **`devthink/browserextension.ts`** with every export under the same name and signature. The family rule that drove the move: the saddle is exclusively the virtualization engine (VM / sandbox / microVM / the ninety modalities / vGPU / vCPU) and never touches the browser, GPU, CPU or storage of the user — every feature that runs in the user's browser is not a VM modality and belongs to devthink, the owner of the family extension product (which already packages its own extension through `packageextension.ts` and `crossbrowser.ts`).
+
+What moved with the surface:
+
+| former saddle root file | devthink root file |
+| --- | --- |
+| `browser.ts` sections 10-17 | `devthink/browserextension.ts` |
+| `manifest.json` (MV3 bridge manifest) | `devthink/extensionmanifest.json` |
+| `popup.html` | `devthink/extensionpopup.html` |
+| `popup.css` | `devthink/extensionpopup.css` |
+| `icon32.png` / `icon64.png` / `icon128.png` | `devthink/extensionicon32.png` / `extensionicon64.png` / `extensionicon128.png` |
+| `tests/extension.test.ts` | `devthink/tests/browserextension.test.ts` |
+
+The tracked assets carry the `extension` prefix at the devthink root because devthink already owns its own extension surface (`manifest.json` of record, `popup.ts`, `design.html`) — no root name collides. The build adapter (section 17 of the migrated module) is self-referential: it extracts the seven script sections from `devthink/browserextension.ts` itself, reads `extensionmanifest.json` for the versioned manifest and copies the extension-prefixed assets into an isolated unpacked artifact (default output `build/browserextension`, so it never touches the `build/extension` directory owned by the devthink extension build). The `@wenathlan/saddle/extension` package export and the `extension:build` script retired with the migration — consumers import the surface from the devthink app.
+
 Release filenames identify the user-facing desktop browser with the dotted lowercase pattern `saddle.browser.1.8.14.<format>`. Internal module filenames remain API-compatible unless a deliberate public compatibility migration is documented.

package/docs/{containerplatforms.2.1.0.md → containerplatforms210.md}

@@ -8,7 +8,7 @@ from a three-platform Linux manifest index to the four-architecture family
 surface: `linux/amd64`, `linux/arm64`, `linux/ppc64le`, and `linux/s390x`.
 The selection unifies the container surfaces of the grand merge: the saddle
 lineage shipped amd64/arm64/ppc64le (the 1.8.17 decision, see
-[containerplatforms.1.8.17.md](containerplatforms.1.8.17.md)) and the e2ugh
+[containerplatforms1817.md](containerplatforms1817.md)) and the e2ugh
 lineage published all four architectures for the virtual-hardware engine
 (`publish ghcr vhe`). One product, one registry, one architecture surface:
 the s390x leg joins the node engine from the e2ugh side of the family.

package/docs/{documentmap.1.8.12.md → documentmap1812.md}

@@ -2,7 +2,7 @@
 
 ## Canonical root documents
 
-Project policies, notices and contribution guidance remain at the repository root so package consumers and forge interfaces can discover them without entering `docs`. The canonical license is the extensionless `LICENSE` file containing the official unmodified GNU GPL v3.0 text. Human-readable project policies use one Markdown file per context: `acceptable.use.policy.md`, `authors.md`, `bug.report.md`, `cla.md`, `code.of.conduct.md`, `contributing.md`, `copyright.md`, `disclaimer.md`, `eula.md`, `export.control.md`, `governance.md`, `notice.md`, `privacy.policy.md`, `pull.request.template.md`, `security.md`, `support.md`, `terms.and.conditions.md`, `terms.of.use.md`, `third.party.notices.md` and `trademark.policy.md`.
+Project policies, notices and contribution guidance remain at the repository root so package consumers and forge interfaces can discover them without entering `docs`. The canonical license is the extensionless `LICENSE` file containing the official unmodified GNU GPL v3.0 text. Human-readable project policies use one Markdown file per context: `acceptableusepolicy.md`, `authors.md`, `bugreport.md`, `cla.md`, `codeofconduct.md`, `contributing.md`, `copyright.md`, `disclaimer.md`, `eula.md`, `exportcontrol.md`, `governance.md`, `notice.md`, `privacypolicy.md`, `pullrequesttemplate.md`, `security.md`, `support.md`, `termsandconditions.md`, `termsofuse.md`, `thirdpartynotices.md` and `trademarkpolicy.md`.
 
 The public scope README remains `/home/ubuntu/upload/README.md` and was not modified. The repository's own `README.md` remains a public project document and can receive release or signing-policy updates separately from the immutable scope reference.
 

package/docs/extension.md

@@ -1,5 +1,16 @@
 # saddle browser bridge
 
+> **Migration note (wave 2 regrouping):** the extension surface moved to
+> `devthink/browserextension.ts` (sections 10-17 of the former
+> `saddle/browser.ts`), with its tracked assets at the devthink root
+> (`extensionmanifest.json`, `extensionpopup.html`, `extensionpopup.css`,
+> `extensionicon32.png`, `extensionicon64.png`, `extensionicon128.png`)
+> and its test battery at `devthink/tests/browserextension.test.ts`. The
+> saddle is exclusively the virtualization engine; everything that runs
+> in the user's browser belongs to devthink, the owner of the family
+> extension product. The notes below describe the bridge design and stay
+> accurate for the migrated surface.
+
 This directory contains the first Manifest V3 surface for Saddle. It is a user initiated bridge, not a hidden automation service.
 
 ## load unpacked
@@ -7,7 +18,7 @@ This directory contains the first Manifest V3 surface for Saddle. It is a user i
 1. Open `chrome://extensions`.
 2. Enable developer mode.
 3. Choose **Load unpacked**.
-4. Select this `extension/` directory.
+4. Select the built artifact directory (the unpacked output of the build adapter below).
 5. Open a page, invoke Saddle from the extension action and choose `Snapshot` or `Read page`.
 
 The manifest requests only `activeTab`, `scripting` and `storage`. It does not request broad host permissions, cookies, tabs, webRequest or debugger access. `activeTab` gives temporary access after the user invokes the action for the current tab.
@@ -20,7 +31,7 @@ The content bridge runs in Chrome's isolated world. It exposes bounded page meta
 
 ## deterministic release artifact
 
-The Node-only build adapter creates an isolated unpacked artifact with the release version in its manifest. A caller can run `npm run extension:build -- --version 1.8.14 --output build/extension` and package that directory with the archive tool available in the host environment. The release workflow derives the version from the published tag and attaches `saddle.extension.<version>.zip` without changing the source manifest.
+The Node-only build adapter creates an isolated unpacked artifact with the release version in its manifest. A caller can run `node --import tsx ./browserextension.ts --version 1.8.14 --output build/browserextension` from the devthink app root (the retired saddle `extension:build` script went with the migration) and package that directory with the archive tool available in the host environment. The release workflow derives the version from the published tag and attaches `saddle.extension.<version>.zip` without changing the source manifest.
 
 ## next slices
 

package/docs/libraryapi.md

@@ -60,7 +60,7 @@ The `fetcher`, browser adapter, persistence adapter, proxy pool, captcha solver,
 
 The package exposes explicit subpaths for `./browser`, `./bot`, `./captcha`, `./memory-engine`, `./deploy`, and `./release-evidence`. Desktop, mobile, target-plan and n8n contracts are exported from the root entry; the root entry remains the complete compiled JavaScript API with generated TypeScript declarations for consumers that prefer one import.
 
-The `./extension` subpath exposes browser-neutral message, snapshot and service-worker routing contracts. The concrete Manifest V3 files live in `extension/`; they are not imported by the core at runtime and do not require Chrome when the library is used as a Node package. The browser surface also exposes snapshots, tab/frame context, action results, bounded action batches and recording through `./browser`.
+The former `./extension` subpath retired with the wave 2 regrouping: the Chrome Manifest V3 surface (message, snapshot and service-worker routing contracts, the content and page bridges, the popup and the build adapter) runs in the user's browser, so it is not a VM modality of the engine and migrated to `devthink/browserextension.ts` with every export under the same name. The browser surface keeps exposing snapshots, tab/frame context, action results, bounded action batches and recording through `./browser`.
 
 The current release exposes `desktopmanifest`, `mobilemanifest`, `desktopadapter`, `mobileadapter`, `n8nnode`, `n8nmatch`, `n8nexecute`, `controlsurface`, `controlservice`, and `workerbridge`. These factories describe surface boundaries and invoke caller-owned handlers; they do not install a native toolkit, start an n8n server, create a dashboard, or store credentials.
 

package/docs/{ninety.modalities.md → ninetymodalities.md}

@@ -14,7 +14,7 @@ sandbox seat only through the debonair precedent (4 ids).
 
 ## the wiring the wave answered
 
-- **edgelandes.host.ts** (group a, 25 lanes): the sandbox jails
+- **edgelandeshost.ts** (group a, 25 lanes): the sandbox jails
   (bubblewrap, nsjail, chroot with the fakechroot fallback and the
   privilege gate), the container extensions (podman, containerd, runc,
   crun, the docker max/lite/ghcr profiles), the runtimes (clr, workerd),
@@ -25,7 +25,7 @@ sandbox seat only through the debonair precedent (4 ids).
   keygen law) and the storage daemons (minio mc, garage). every lane
   probes its binary, runs under the hard deadline in a private temp dir
   and answers the coded absence when the host carries no runtime.
-- **edgelandes.inproc.ts** (group b, 19 lanes): the ram recipes (tmpfs,
+- **edgelandesinproc.ts** (group b, 19 lanes): the ram recipes (tmpfs,
   mmap, overlayfs, loopram, gitram, zram with the real stored-block
   zlib stream, zswap with the lru pool, swapfile) behind the oom-guard
   quota, the delivery protocols (the cdn mirror manifest, the rfc6455
@@ -34,14 +34,14 @@ sandbox seat only through the debonair precedent (4 ids).
   handshake packet, the postgres startup message, the s3 canonical
   signer), the webcontainer seat (the frozen module vm) and the
   local-optin consent gate — pure ts, deterministic, in-process.
-- **edgelandes.virtual.ts** (group c, 7 lanes): the virtual hardware
+- **edgelandesvirtual.ts** (group c, 7 lanes): the virtual hardware
   compositions riding the engine's own catalogs — the full machine, the
   vgpu mig slice, the screen with the session otp, the driver surface,
   the kvm plan (the qemu argv through the lazy virtualization domain —
   the .js specifier graph loads inside the executor, never the boot),
   the gpuless mesa render and the virgl context. every report says
   composed, never booted.
-- **edgelandes.ninety.ts** (the merge seat): the six heavyweight probes
+- **edgelandesninety.ts** (the merge seat): the six heavyweight probes
   (browser-server, mobile-capacitor, mobile-postmarketos, pod-session,
   confidential-sevsnp, confidential-tdx) and the merged lane tables the
   dispatch plane reads — 73 lanes in the plane, every one carrying its
@@ -106,3 +106,86 @@ planned-only lanes, and the batteries say so.
 - the six heavyweight lanes stay host (probe only): the execution
   wiring of a confidential compute seat or a pod session is the next
   rung, and the registry says so.
+
+## the wiring wave (wave four, pr15 — branch wave/ninety.wiring)
+
+the wiring wave closed the last gap of the ninety plan: the registry
+carried the ninety records with 81 live and 9 host while the plane
+drove only 73 lanes — seventeen registry-live modalities waited without
+a lane. the wave wired all seventeen, honestly, and the plane table
+now answers the full plan: **90 lanes, 66 live, 24 host.**
+
+### the state the wave found
+
+- the plane: 73 lanes (61 live, 12 host); the registry live set ahead
+  of the lane table by seventeen ids — runner-deno, runner-serverless,
+  language-rust, language-cargo, language-v, language-dotnet,
+  language-php, language-lua, language-zig, language-nim, runner-wasi,
+  fs-gitobjects, storage-sqlite, network-dns, network-doh, build-make
+  and build-ninja, every one already live in the registry.
+
+### the wiring the wave answered
+
+- **edgelandeshost.ts** (group a, +12 lanes): the language toolchains
+  (rustc with the compile-then-run seat, cargo with CARGO_HOME and the
+  target tree inside the private dir, v with HOME at the temp dir,
+  dotnet with the csproj seat and DOTNET_CLI_HOME inside, php, lua, zig
+  with the global cache inside, nim with the nimcache inside), the
+  runner seats (deno with the scoped read permission and DENO_DIR
+  inside, wasi through wasmtime with the base64 module bytes) and the
+  build tail (make with the Makefile as the code field, ninja with the
+  build.ninja as the code field). every lane probes its binary, runs
+  under the hard deadline in the private temp dir and answers the coded
+  absence when the host carries no runtime — the twelve ride kind host
+  (the runtime probe rung), the twenty-five of the first wave stay kind
+  live.
+- **edgelandesinproc.ts** (group b, +5 lanes): the serverless runner
+  (the v8 isolate manifest — one fresh node:vm context per run, the
+  module fingerprint fnv-1a, the frozen inputs surface), the git
+  objects vfs (the loose-object header law and the two-hex-char
+  fan-out), the sqlite vault (the hundred-byte page-one header with the
+  fnv-1a statement id as the change counter) and the network resolvers
+  (the rfc1035 question bytes of dns, the rfc8484 base64url ride of
+  doh under the https-only resolver law) — pure ts, deterministic,
+  seeded, in-process.
+- **edgelandesninety.ts / edgeplane.ts**: the stale sixty-three
+  comments now state the post-wiring truth — ninety lanes, sixty-six
+  live, twenty-four host.
+- **the pinned tests**: the host battery 25 → 37 (the twelve wave ids
+  in alphabetical order, kind host), the inproc battery 19 → 24 with
+  the five samples and the wave four seat laws (the isolate, the
+  fan-out, the page and the resolvers), the plane table 61/12 → 66/24,
+  and the runner-deno refusal test rewired to the wired truth (a real
+  run or the coded absence — the gap it proved is closed).
+
+### the verification the wave recorded
+
+- saddle: 30 files / **437 tests green** (436 base + 1 seat law test)
+- the build green, dist carrying both lane files
+- biome zero findings on every file the wave touched
+- the live proof: the plane table answers 66 live and 24 host of 90 —
+  /api/v1/edge/lanes now reports the ninety probed lanes
+
+### the honest notes
+
+- the twelve host seats ride kind host with real executors: the plane
+  probes the runtime and the executor drives it when the host carries
+  it — an absent runtime answers HOST_RUNTIME_ABSENT naming the runtime,
+  exactly like the live seats of the first wave (the kind answers the
+  rung the table reports, the executor answers the run).
+- the inproc seats stay deterministic: fixed fnv-1a addresses, rfc1035
+  big-endian fields and stored hex — no clock, no randomness, the same
+  payload answers the same bytes every run.
+- this engine host carries make only: the eleven other runtimes answer
+  the coded absence here while the make lane proves a real run — the
+  batteries stay green on both kinds of host.
+
+## the os nicknames of the owner (reference)
+
+sandboxprofile.ts answers five guest os ids — android, grapheneos, linux,
+omarchy, windows — and the owner's spoken names are nicknames of those
+builds, not new ids: marsh (marshmallow) → android, grapenios and grafene
+os → grapheneos, omashi → omarchy, linux normal → linux. the owner's "v"
+names no guest os: it answers the language-v lane of the modality
+registry (the v compiler seat). nothing to add — the vocabulary already
+covers every name the owner used.

package/docs/{planning.ninety.md → planningninety.md}

@@ -11,14 +11,14 @@ the ladder below — every rung checked before the merge.
 
 ## the groups
 
-- group a — edgelandes.host.ts: the host binary lanes (the spawn pattern of
+- group a — edgelandeshost.ts: the host binary lanes (the spawn pattern of
   edgelandes.ts): the sandbox jails, the container extensions, the runtimes,
   the screens, the builds, the ci runners, the network tunnels and the
   storage daemons the host may carry.
-- group b — edgelandes.inproc.ts: the in-process pure ts lanes: the ram
+- group b — edgelandesinproc.ts: the in-process pure ts lanes: the ram
   recipes, the delivery protocols, the storage wire protocols, the
   webcontainer lane and the local opt-in gate.
-- group c — edgelandes.virtual.ts: the virtual hardware composition lanes
+- group c — edgelandesvirtual.ts: the virtual hardware composition lanes
   that ride the engine's own virtualcpu, virtualgpu and virtualmemory
   payloads (sandbox.ts) — the full machine, the vgpu slice, the screen, the
   drivers, the kvm seat, the gpuless render and the virgl slice.
@@ -71,7 +71,7 @@ the ladder below — every rung checked before the merge.
 
 ### phase 2a — the host lanes (106)
 
-- [x] 2a.007 write the file header and the imports of edgelandes.host.ts
+- [x] 2a.007 write the file header and the imports of edgelandeshost.ts
 - [x] 2a.008 export the executor and spec types riding the edgelandes contract
 - [x] 2a.009 sandbox-bubblewrap: the bwrap probe
 - [x] 2a.010 sandbox-bubblewrap: the executor (bwrap --ro-bind / / --unshare-all)
@@ -174,7 +174,7 @@ the ladder below — every rung checked before the merge.
 
 ### phase 2b — the in-process lanes (82)
 
-- [x] 2b.007 write the file header and the imports of edgelandes.inproc.ts
+- [x] 2b.007 write the file header and the imports of edgelandesinproc.ts
 - [x] 2b.008 export the executor and spec types riding the contract
 - [x] 2b.009 ram-tmpfs: the tmpfs mount recipe
 - [x] 2b.010 ram-tmpfs: the executor (the in-memory fs tree)
@@ -253,7 +253,7 @@ the ladder below — every rung checked before the merge.
 
 ### phase 2c — the virtual hardware lanes (41)
 
-- [x] 2c.007 write the file header and the imports of edgelandes.virtual.ts
+- [x] 2c.007 write the file header and the imports of edgelandesvirtual.ts
 - [x] 2c.008 export the executor and spec types riding the contract
 - [x] 2c.009 virtual-full: the complete machine composition
 - [x] 2c.010 virtual-full: the executor (cpu, gpu, memory, boot sequence)

package/docs/{releasenotes.1.8.13.md → releasenotes1813.md}

@@ -1,6 +1,6 @@
 # Saddle 1.8.13
 
-Saddle 1.8.13 carries the active code and release-facing manifests forward from 1.8.12. The previous [1.8.12 release notes](releasenotes.1.8.12.md) remain the canonical record for the licensing and artifact baseline. The comparative 1.8.21 research is planning material and is not presented as a shipped feature.
+Saddle 1.8.13 carries the active code and release-facing manifests forward from 1.8.12. The previous [1.8.12 release notes](releasenotes1812.md) remain the canonical record for the licensing and artifact baseline. The comparative 1.8.21 research is planning material and is not presented as a shipped feature.
 
 ## Changes
 
@@ -67,4 +67,4 @@ The queue, structured extraction, browser context, workflow compensation and ret
 
 [1]: https://github.com/wenathlan/saddle "Saddle source repository"
 [2]: https://github.com/wenathlan/saddle/releases "Saddle release archive"
-[3]: https://github.com/wenathlan/saddle/blob/main/docs/releasenotes.1.8.12.md "Saddle 1.8.12 release notes"
+[3]: https://github.com/wenathlan/saddle/blob/main/docs/releasenotes1812.md "Saddle 1.8.12 release notes"

package/docs/{releasenotes.1.8.14.md → releasenotes1814.md}

@@ -64,4 +64,4 @@ Local gates passed before the tag was created. Desktop run `31806235468` complet
 
 [1]: https://github.com/wenathlan/saddle "Saddle source repository"
 [2]: https://github.com/wenathlan/saddle/releases "Saddle release archive"
-[3]: https://github.com/wenathlan/saddle/blob/main/docs/releasenotes.1.8.13.md "Saddle 1.8.13 release notes"
+[3]: https://github.com/wenathlan/saddle/blob/main/docs/releasenotes1813.md "Saddle 1.8.13 release notes"

package/docs/{repo.synthesis.1.8.16.md → reposynthesis1816.md}

@@ -2,7 +2,7 @@
 
 ## Scope and evidence boundary
 
-This synthesis evaluates the 100 primary repository sources recorded in [repo.research.1.8.16.md](./repo.research.1.8.16.md). It does not copy source code, vendor dependencies, credentials, workflow configuration, service setup, operating assumptions, or claims of the reviewed projects. A candidate that lacked successful primary extraction is retained only as a pending source and is not used as implementation evidence.
+This synthesis evaluates the 100 primary repository sources recorded in [reporesearch1816.md](./reporesearch1816.md). It does not copy source code, vendor dependencies, credentials, workflow configuration, service setup, operating assumptions, or claims of the reviewed projects. A candidate that lacked successful primary extraction is retained only as a pending source and is not used as implementation evidence.
 
 The current baseline is Saddle 1.8.15. It already has deterministic storage pools and budgets, working-set planning, archive inspection, transform cache eligibility, provider-chain selection and cancellation plans, declarative delivery/PWA/surface requirements, release asset generation and local checksum verification. The selected 1.8.16 additions must remain additive, TypeScript-first, root-first, dependency-free, serializable and adapter-owned for all privileged or remote effects.
 

package/docs/todo.md

@@ -696,9 +696,9 @@ The following blocks are the execution order for the complete ecosystem. A block
 
 - [x] Read the supplied scope references in full, distinguish verified constraints from aspirational proposals, and preserve both files unchanged.
 - [x] Map the active 1.8.14 engine, exports, tests, package surfaces and release rules against the realistic 1.8.15 opportunity set.
-- [x] Create `docs/todo.1.8.15.md` with more than 400 individually checkable research, contract, implementation, test, documentation, validation and release steps.
+- [x] Create `docs/todo1815.md` with more than 400 individually checkable research, contract, implementation, test, documentation, validation and release steps.
 - [ ] Define a public-repository research rubric and category quota for the 1.8.16 comparative analysis, targeting 100–300 relevant repositories without treating any external implementation as a copy source.
-- [x] Create `docs/todo.1.8.16.md` with 600–900 individually checkable steps covering repository research, evidence capture, gap selection, implementation, tests, documentation, release and post-release verification.
+- [x] Create `docs/todo1816.md` with 600–900 individually checkable steps covering repository research, evidence capture, gap selection, implementation, tests, documentation, release and post-release verification.
 - [x] Review both versioned plans for architectural constraints, security, feasibility, feature ownership and release-gate dependencies before beginning implementation.
 
 ### Authorized execution order

package/docs/{todo.1.8.15.md → todo1815.md}

@@ -470,7 +470,7 @@
 - [ ] Verify all active version manifests remain at 1.8.14 until implementation and release notes are ready.
 - [ ] Bump all active version manifests to 1.8.15 only after the release candidate is validated.
 - [ ] Update the iOS build number to 1008015 only as part of the validated version bump.
-- [ ] Create docs/releasenotes.1.8.15.md from verified claims and the real generated artifact inventory.
+- [ ] Create docs/releasenotes1815.md from verified claims and the real generated artifact inventory.
 - [ ] Update changelog.md with concise, evidence-backed 1.8.15 entries.
 - [ ] Update docs/artifactavailability.md using only post-build and post-release evidence.
 - [ ] Create a commit authored as iakadion after the full local gate passes.

package/docs/{todo.1.8.16.md → todo1816.md}

@@ -541,7 +541,7 @@
 - [x] Derive the 1.8.16 verification check for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability. Completed by deterministic acceptance, insufficiency, mismatch, and readiness tests in `tests/engine.test.ts`.
 - [ ] Derive the 1.8.16 workflow test for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
 - [x] Derive the 1.8.16 failure policy for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability. Completed by ordered `rejected` and `insufficient` reason codes without positive assurance claims.
-- [x] Derive the 1.8.16 documentation for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability. Completed in `docs/enginearchitecture.md` and `docs/repo.synthesis.1.8.16.md`.
+- [x] Derive the 1.8.16 documentation for release evidence only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability. Completed in `docs/enginearchitecture.md` and `docs/reposynthesis1816.md`.
 - [ ] Derive the 1.8.16 contract for cross-runtime compatibility only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
 - [ ] Derive the 1.8.16 capability matrix for cross-runtime compatibility only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
 - [ ] Derive the 1.8.16 import graph audit for cross-runtime compatibility only after comparative evidence identifies a concrete gap that does not duplicate an existing Saddle capability.
@@ -626,15 +626,15 @@
 
 ## 8. Documentation, compatibility, and release execution
 
-- [ ] Update docs/repo.research.1.8.16.md with the complete selected repository inventory and source evidence.
+- [ ] Update docs/reporesearch1816.md with the complete selected repository inventory and source evidence.
 - [ ] Update docs/repo-analysis-1.8.16.json with structured metadata, classification, source paths, and implementation disposition for every analyzed repository.
-- [ ] Update docs/repo.synthesis.1.8.16.md with feature-gap rankings, accepted patterns, rejected patterns, and implementation rationale.
+- [ ] Update docs/reposynthesis1816.md with feature-gap rankings, accepted patterns, rejected patterns, and implementation rationale.
 - [ ] Update docs/gapmatrix.md only after comparing the implemented result against the final 1.8.16 code and tests.
 - [ ] Update README claims only when a corresponding capability is public, tested, documented, and not caller-owned or speculative.
 - [ ] Update package exports only for stable, explicitly documented additive contracts.
 - [ ] Update type declarations and package-import tests for every export-map change.
 - [ ] Update changelog.md from verified completed work rather than the original research hypothesis.
-- [x] Create docs/releasenotes.1.8.16.md only after artifact inventory, signing status, workflows, and registry results are known. The final release record lists 38 attached assets and the manual Android fallback state.
+- [x] Create docs/releasenotes1816.md only after artifact inventory, signing status, workflows, and registry results are known. The final release record lists 38 attached assets and the manual Android fallback state.
 - [x] Update docs/artifactavailability.md only from generated and remotely verified release evidence. The 1.8.15 and 1.8.16 matrices use published release inventories.
 - [x] Run npm test, legacy tests, web typecheck, web build, formatcheck, package dry-run, high-severity audit, and flat-native validation on the final candidate. The candidate passed 136 active and 69 legacy tests with all required gates.
 - [x] Review CI workflows for tag-derived versioning, no hardcoded release version, no exposed secrets, and no unverified publish claim. Tag-triggered registry and asset workflows completed with explicit signing-state boundaries.
@@ -670,7 +670,7 @@
 - [x] Compare requested operating-system and architecture combinations against Docker Buildx, OCI image-index, Node runtime, and runner support.
 - [x] Distinguish publishable Linux OCI variants from Windows container variants that require a compatible Windows base image and Windows runner.
 - [x] Avoid claiming an `unknown` platform as a runnable operating-system or architecture target.
-- [x] Select a supported 1.8.17 Linux multi-architecture matrix and record rejected or deferred combinations with their technical reason in `docs/containerplatforms.1.8.17.md`.
+- [x] Select a supported 1.8.17 Linux multi-architecture matrix and record rejected or deferred combinations with their technical reason in `docs/containerplatforms1817.md`.
 - [x] Review the current container workflow, image base, tags, OCI labels, post-push pull, label verification, and smoke test before modifying it.
 - [x] Extend the container workflow only for platform combinations that can build and execute the packaged Saddle runtime: `linux/amd64`, `linux/arm64`, and `linux/ppc64le`.
 - [x] Keep release-tag version derivation, registry credentials, permissions, and the container-first documentation order intact.