arkgate 4.8.5 → 4.8.6

package/dist/{types-CzE6LMaW.d.ts → types-DrqsOiTY.d.ts}

@@ -862,20 +862,35 @@ type ArkRunInformationPackageComponent = {
     sends: string[];
     extendedInfo?: ArkRunExtendedInfo;
 };
+declare const ARK_RUN_DECISION_TAPE_RESIDUAL_KINDS: readonly ["absorb", "escalate_up", "hold"];
+type ArkRunDecisionTapeResidualKind = (typeof ARK_RUN_DECISION_TAPE_RESIDUAL_KINDS)[number];
+/** Additive Order residual tape (ADR 0034 D6). Not a bus. Not durable. */
+type ArkRunDecisionTapeRecord = {
+    xiHash: string;
+    event: {
+        kind: string;
+        payload?: Record<string, string | number | boolean | null>;
+    };
+    residual: {
+        kind: ArkRunDecisionTapeResidualKind;
+        reasonCode?: string;
+        eventId?: string;
+        target?: string;
+    };
+};
 type DependencyInformationPackage = {
     schemaVersion: typeof ARK_RUN_INFORMATION_PACKAGE_SCHEMA_VERSION;
     kernelInstanceId: string;
     components: ArkRunInformationPackageComponent[];
+    /** Optional; omitted keeps the 4.8.x component snapshot shape. */
+    decisionTape?: ArkRunDecisionTapeRecord[];
 };
-/**
- * Build a JSON-serializable snapshot from unknown component records.
- * Only id, lifetime, the four declaration lists, and optional extendedInfo
- * survive — extra keys (factory, instance, DTO payloads) are dropped.
- */
 declare function buildDependencyInformationPackage(input: {
     kernelInstanceId?: unknown;
     components?: unknown;
+    decisionTape?: unknown;
 }): DependencyInformationPackage;
+declare function appendDecisionTape(pack: DependencyInformationPackage, record: unknown): DependencyInformationPackage;
 
 /**
  * ArkRun requestGraph slices (RN13). Tooling only — never a gate verdict.
@@ -1234,4 +1249,4 @@ interface CreateArkKernelFromConfigOptions extends Omit<CreateArkKernelOptions,
 }
 type ArkKernelConfig = ArkCheckConfig;
 
-export { ARK_RUN_INSPECTOR_EVENTS_PATH as $, type ArkKernel as A, type OutboxStatus as B, type CreateArkKernelOptions as C, type DefineIntentOptions as D, type EventContractRegistry as E, type OutboxRecord as F, type GraphEdge as G, type ObservabilityDriftReport as H, IntentRegistry as I, ARK_RUN_COMPONENT_LIFETIMES as J, ARK_RUN_EPHEMERAL_DEFAULT as K, ARK_RUN_GRAPH_DEFAULT_SLICE as L, type MetadataRegistry as M, ARK_RUN_GRAPH_NODE_KINDS as N, type ObservabilityReporter as O, type ProjectionRegistry as P, ARK_RUN_GRAPH_PROCESS_EDGE_KINDS as Q, type ReadModelStore as R, type SagaContext as S, type TraceRecordType as T, ARK_RUN_GRAPH_SCHEMA_VERSION as U, ARK_RUN_GRAPH_SLICES as V, type WorkflowStore as W, ARK_RUN_GRAPH_TECHNICAL_EDGE_KINDS as X, ARK_RUN_INFORMATION_PACKAGE_SCHEMA_VERSION as Y, ARK_RUN_INSPECTOR_DEFAULT_HOST as Z, ARK_RUN_INSPECTOR_DEFAULT_PORT as _, type DependencyGraph as a, InvalidArkRunSendOptionError as a$, ARK_RUN_INSPECTOR_GRAPH_PATH as a0, ARK_RUN_INSPECTOR_SCHEMA_VERSION as a1, ARK_RUN_INSPECTOR_SNAPSHOT_PATH as a2, ARK_RUN_INSPECTOR_SSE_EVENT as a3, ARK_RUN_INSPECTOR_TRANSPORT_FALLBACK as a4, ARK_RUN_TRANSPORT_KINDS as a5, type ArkManifestArchitecture as a6, type ArkManifestData as a7, type ArkManifestEntityLink as a8, type ArkManifestGraph as a9, type ArkRunInspectorSnapshotInput as aA, type ArkRunInspectorSource as aB, type ArkRunInspectorTransportFacts as aC, type ArkRunPublisher as aD, type ArkRunRegisterOptions as aE, type ArkRunRegistrationHandle as aF, type ArkRunSendOptions as aG, type ArkRunSendPlan as aH, type ArkRunSendPlanInput as aI, type ArkRunSendResult as aJ, type ArkRunTransportKind as aK, type AuditRecordInput as aL, type AuditRecordType as aM, type EntityMeta as aN, type EventContractIssue as aO, type EventHandler as aP, type EventInterceptionInfo as aQ, type EventInterceptor as aR, type EventInterceptorContext as aS, type EventPayloadPatch as aT, type EventPayloadSchema as aU, type EventPublisher as aV, type EventSchemaField as aW, type EventSchemaFieldType as aX, type FieldMeta as aY, type GraphNode as aZ, InvalidArkRunGraphQueryError as a_, type ArkManifestIntent as aa, type ArkManifestPolicy as ab, type ArkManifestProjection as ac, type ArkRunBrokerAdapter as ad, type ArkRunComponentLifetime as ae, type ArkRunDeliveredVia as af, type ArkRunExtendedInfo as ag, type ArkRunGraph as ah, type ArkRunGraphEdge as ai, type ArkRunGraphEdgeKind as aj, type ArkRunGraphMatch as ak, type ArkRunGraphMatchInput as al, type ArkRunGraphNode as am, type ArkRunGraphNodeKind as an, type ArkRunGraphProcessEdgeKind as ao, type ArkRunGraphQuery as ap, type ArkRunGraphResolvedQuery as aq, type ArkRunGraphSlice as ar, type ArkRunGraphTechnicalEdgeKind as as, type ArkRunInformationPackageComponent as at, type ArkRunInspectorBind as au, ArkRunInspectorBindError as av, type ArkRunInspectorBindInput as aw, type ArkRunInspectorHandle as ax, ArkRunInspectorProductionError as ay, type ArkRunInspectorSnapshot as az, type AuditStore as b, type ObservabilityFlow as b0, type ObservedLayerFlowMode as b1, type OutboxStore as b2, type PolicyEvaluationResult as b3, type ProjectionCheckpoint as b4, type ProjectionDefinition as b5, type PublishedEventRecord as b6, type RetryPolicy as b7, type SagaStatus as b8, type SagaStep as b9, type StartArkRunInspectorOptions as ba, type TraceSink as bb, type Unsubscribe as bc, type WorkflowDefinition as bd, type WorkflowStatus as be, type WorkflowStep as bf, arkRunGraphQueryFromSearchParams as bg, arkRunInspectorUrl as bh, buildArkRunInspectorSnapshot as bi, buildDependencyInformationPackage as bj, closeArkRunGraphQuery as bk, closedArkRunEphemeral as bl, closedArkRunTransportKind as bm, formatArkRunGraphMermaid as bn, formatArkRunInspectorSseEvent as bo, isArkRunInspectorLoopbackHost as bp, isArkRunInspectorProductionEnv as bq, requestArkRunGraph as br, resolveArkRunInspectorBind as bs, resolveArkRunSendPlan as bt, startArkRunInspector as bu, type AuditRecord as c, type AuditQuery as d, type CreateAuditTrailOptions as e, type AuditTrail as f, type EventContract as g, type EventContractValidationResult as h, type CreateProjectionRegistryOptions as i, type EventBufferStore as j, type EventBufferRecord as k, type EventBufferStatus as l, type EventBusOptions as m, type EventBus as n, type CreateObservabilityReporterOptions as o, PolicyEngine as p, type ArkManifest as q, type WorkflowSnapshot as r, type SagaDefinition as s, type CreateWorkflowEngineOptions as t, type SagaInstance as u, type WorkflowEngine as v, type DependencyInformationPackage as w, type ArkKernelConfig as x, type CreateArkKernelFromConfigOptions as y, type TraceRecord as z };
+export { ARK_RUN_INSPECTOR_EVENTS_PATH as $, type ArkKernel as A, type OutboxStatus as B, type CreateArkKernelOptions as C, type DefineIntentOptions as D, type EventContractRegistry as E, type OutboxRecord as F, type GraphEdge as G, type ObservabilityDriftReport as H, IntentRegistry as I, ARK_RUN_COMPONENT_LIFETIMES as J, ARK_RUN_EPHEMERAL_DEFAULT as K, ARK_RUN_GRAPH_DEFAULT_SLICE as L, type MetadataRegistry as M, ARK_RUN_GRAPH_NODE_KINDS as N, type ObservabilityReporter as O, type ProjectionRegistry as P, ARK_RUN_GRAPH_PROCESS_EDGE_KINDS as Q, type ReadModelStore as R, type SagaContext as S, type TraceRecordType as T, ARK_RUN_GRAPH_SCHEMA_VERSION as U, ARK_RUN_GRAPH_SLICES as V, type WorkflowStore as W, ARK_RUN_GRAPH_TECHNICAL_EDGE_KINDS as X, ARK_RUN_INFORMATION_PACKAGE_SCHEMA_VERSION as Y, ARK_RUN_INSPECTOR_DEFAULT_HOST as Z, ARK_RUN_INSPECTOR_DEFAULT_PORT as _, type DependencyGraph as a, InvalidArkRunSendOptionError as a$, ARK_RUN_INSPECTOR_GRAPH_PATH as a0, ARK_RUN_INSPECTOR_SCHEMA_VERSION as a1, ARK_RUN_INSPECTOR_SNAPSHOT_PATH as a2, ARK_RUN_INSPECTOR_SSE_EVENT as a3, ARK_RUN_INSPECTOR_TRANSPORT_FALLBACK as a4, ARK_RUN_TRANSPORT_KINDS as a5, type ArkManifestArchitecture as a6, type ArkManifestData as a7, type ArkManifestEntityLink as a8, type ArkManifestGraph as a9, type ArkRunInspectorSnapshotInput as aA, type ArkRunInspectorSource as aB, type ArkRunInspectorTransportFacts as aC, type ArkRunPublisher as aD, type ArkRunRegisterOptions as aE, type ArkRunRegistrationHandle as aF, type ArkRunSendOptions as aG, type ArkRunSendPlan as aH, type ArkRunSendPlanInput as aI, type ArkRunSendResult as aJ, type ArkRunTransportKind as aK, type AuditRecordInput as aL, type AuditRecordType as aM, type EntityMeta as aN, type EventContractIssue as aO, type EventHandler as aP, type EventInterceptionInfo as aQ, type EventInterceptor as aR, type EventInterceptorContext as aS, type EventPayloadPatch as aT, type EventPayloadSchema as aU, type EventPublisher as aV, type EventSchemaField as aW, type EventSchemaFieldType as aX, type FieldMeta as aY, type GraphNode as aZ, InvalidArkRunGraphQueryError as a_, type ArkManifestIntent as aa, type ArkManifestPolicy as ab, type ArkManifestProjection as ac, type ArkRunBrokerAdapter as ad, type ArkRunComponentLifetime as ae, type ArkRunDeliveredVia as af, type ArkRunExtendedInfo as ag, type ArkRunGraph as ah, type ArkRunGraphEdge as ai, type ArkRunGraphEdgeKind as aj, type ArkRunGraphMatch as ak, type ArkRunGraphMatchInput as al, type ArkRunGraphNode as am, type ArkRunGraphNodeKind as an, type ArkRunGraphProcessEdgeKind as ao, type ArkRunGraphQuery as ap, type ArkRunGraphResolvedQuery as aq, type ArkRunGraphSlice as ar, type ArkRunGraphTechnicalEdgeKind as as, type ArkRunInformationPackageComponent as at, type ArkRunInspectorBind as au, ArkRunInspectorBindError as av, type ArkRunInspectorBindInput as aw, type ArkRunInspectorHandle as ax, ArkRunInspectorProductionError as ay, type ArkRunInspectorSnapshot as az, type AuditStore as b, type ObservabilityFlow as b0, type ObservedLayerFlowMode as b1, type OutboxStore as b2, type PolicyEvaluationResult as b3, type ProjectionCheckpoint as b4, type ProjectionDefinition as b5, type PublishedEventRecord as b6, type RetryPolicy as b7, type SagaStatus as b8, type SagaStep as b9, type StartArkRunInspectorOptions as ba, type TraceSink as bb, type Unsubscribe as bc, type WorkflowDefinition as bd, type WorkflowStatus as be, type WorkflowStep as bf, appendDecisionTape as bg, arkRunGraphQueryFromSearchParams as bh, arkRunInspectorUrl as bi, buildArkRunInspectorSnapshot as bj, buildDependencyInformationPackage as bk, closeArkRunGraphQuery as bl, closedArkRunEphemeral as bm, closedArkRunTransportKind as bn, formatArkRunGraphMermaid as bo, formatArkRunInspectorSseEvent as bp, isArkRunInspectorLoopbackHost as bq, isArkRunInspectorProductionEnv as br, requestArkRunGraph as bs, resolveArkRunInspectorBind as bt, resolveArkRunSendPlan as bu, startArkRunInspector as bv, type AuditRecord as c, type AuditQuery as d, type CreateAuditTrailOptions as e, type AuditTrail as f, type EventContract as g, type EventContractValidationResult as h, type CreateProjectionRegistryOptions as i, type EventBufferStore as j, type EventBufferRecord as k, type EventBufferStatus as l, type EventBusOptions as m, type EventBus as n, type CreateObservabilityReporterOptions as o, PolicyEngine as p, type ArkManifest as q, type WorkflowSnapshot as r, type SagaDefinition as s, type CreateWorkflowEngineOptions as t, type SagaInstance as u, type WorkflowEngine as v, type DependencyInformationPackage as w, type ArkKernelConfig as x, type CreateArkKernelFromConfigOptions as y, type TraceRecord as z };

package/docs/README.md

@@ -46,7 +46,7 @@ Product site: [arkgate.online](https://www.arkgate.online/) · npm: [`arkgate`](
 |-----|------------|
 | [CONTRIBUTING.md](../CONTRIBUTING.md) | Setup, rules, PR/release |
 | [ROADMAP.md](../ROADMAP.md) | Live implementation queue (one `doing` at a time). History: [archive/roadmap-history.md](archive/roadmap-history.md) |
-| [adr/](adr/README.md) | Architecture decisions ([0032](adr/0032-writes-via-aggregate-sensor.md) writes-via-aggregate · [0033](adr/0033-arkorder-runtime-half-is-arkrun.md) ArkOrder runtime half) |
+| [adr/](adr/README.md) | Architecture decisions ([0032](adr/0032-writes-via-aggregate-sensor.md) writes-via-aggregate · [0033](adr/0033-arkorder-runtime-half-is-arkrun.md) ArkOrder runtime half · [0034](adr/0034-arkorder-valved-loop.md) valved loop) |
 | [SECURITY.md](../SECURITY.md) · [threat-model.md](threat-model.md) | Security |
 
 ---
@@ -58,13 +58,14 @@ These are **not** the day-to-day product path. They stay in the repo for evidenc
 | Area | Path |
 |------|------|
 | Release notes (by version) | [releases/](releases/) · npm [CHANGELOG.md](../CHANGELOG.md) (Unreleased + 4.6.x) · [pre-4.6 archive](archive/CHANGELOG-pre-4.6.md) |
-| Epic plans | [plans/](plans/) — maintainer seeds, not required to use the package. Live: [alive-in-six-months](plans/alive-in-six-months/README.md) (`AL01`–`AL04` done; `AL05` parked). [arkrun](plans/arkrun/README.md) (Phase RN; `RN01`–`RN17` done; shipped **4.7.0** + companion **4.7.4**; ADRs [0020](adr/0020-arkrun-gated-extra-plane.md)–[0024](adr/0024-arkrun-transport-ports.md) accepted). [one-catalog-one-root](plans/one-catalog-one-root/README.md) (Phase HS; `HS01`–`HS05` done; shipped **4.7.1**). [arkorder](plans/arkorder/README.md) (Phase OR; `OR01`–`OR07` done; shipped **4.8.0**; extra **inside** package `arkgate` as `arkgate/order`; ADRs [0027](adr/0027-arkorder-gated-extra-plane.md)–[0031](adr/0031-one-package-extras-deprecate-companion.md)). [arkorder-arkrun](plans/arkorder-arkrun/README.md) (Phase XP; `XP01`–`XP08` done on tree; **4.8.5** prepared; ADR [0033](adr/0033-arkorder-runtime-half-is-arkrun.md)). |
+| Epic plans | [plans/](plans/) — maintainer seeds, not required to use the package. Live: [alive-in-six-months](plans/alive-in-six-months/README.md) (`AL01`–`AL04` done; `AL05` parked). [arkrun](plans/arkrun/README.md) (Phase RN; `RN01`–`RN17` done; shipped **4.7.0** + companion **4.7.4**; ADRs [0020](adr/0020-arkrun-gated-extra-plane.md)–[0024](adr/0024-arkrun-transport-ports.md) accepted). [one-catalog-one-root](plans/one-catalog-one-root/README.md) (Phase HS; `HS01`–`HS05` done; shipped **4.7.1**). [arkorder](plans/arkorder/README.md) (Phase OR; `OR01`–`OR07` done; shipped **4.8.0**; extra **inside** package `arkgate` as `arkgate/order`; ADRs [0027](adr/0027-arkorder-gated-extra-plane.md)–[0031](adr/0031-one-package-extras-deprecate-companion.md)). [arkorder-arkrun](plans/arkorder-arkrun/README.md) (Phase XP; `XP01`–`XP08` done; shipped **4.8.5**; ADR [0033](adr/0033-arkorder-runtime-half-is-arkrun.md)). [arkorder-valve-loop](plans/arkorder-valve-loop/README.md) (Phase LV; `LV01`–`LV09` done on tree; **4.8.6** prepared; [ADR 0034](adr/0034-arkorder-valved-loop.md); does not close K01). |
 | Claims audit | [audit/claims-matrix.md](audit/claims-matrix.md) |
 | Field adoption kit (scaffolding, not closed) | [field/](field/) |
 | Runtime hardening (experimental) | [production-hardening.md](production-hardening.md) |
 
-Current tree: [releases/4.8.5.md](releases/4.8.5.md) (`arkgate@4.8.5`, prepared). Current published: [releases/4.8.4.md](releases/4.8.4.md) (`arkgate@4.8.4` on npm `latest`; does not close `K01`).
-Prior: [releases/4.8.3.md](releases/4.8.3.md) · [releases/4.8.2.md](releases/4.8.2.md) · [releases/4.8.1.md](releases/4.8.1.md) · [4.8.0](releases/4.8.0.md) · [4.7.6](releases/4.7.6.md) · [4.7.5](releases/4.7.5.md) · [4.7.4](releases/4.7.4.md) · [4.7.3](releases/4.7.3.md) · [4.7.2](releases/4.7.2.md) · [4.7.1](releases/4.7.1.md) · [4.7.0](releases/4.7.0.md) · [4.6.7](releases/4.6.7.md) · [4.6.6](releases/4.6.6.md) · [4.6.5](releases/4.6.5.md) · [4.6.4](releases/4.6.4.md) · [4.6.3](releases/4.6.3.md) · [4.6.2](releases/4.6.2.md) · [4.6.1](releases/4.6.1.md) · [4.6.0](releases/4.6.0.md).
+Current published: [releases/4.8.5.md](releases/4.8.5.md) (`arkgate@4.8.5` on npm `latest`; does not close `K01`).
+Tree: [releases/4.8.6.md](releases/4.8.6.md) (`arkgate@4.8.6` prepared).
+Prior: [releases/4.8.4.md](releases/4.8.4.md) · [releases/4.8.3.md](releases/4.8.3.md) · [releases/4.8.2.md](releases/4.8.2.md) · [releases/4.8.1.md](releases/4.8.1.md) · [4.8.0](releases/4.8.0.md) · [4.7.6](releases/4.7.6.md) · [4.7.5](releases/4.7.5.md) · [4.7.4](releases/4.7.4.md) · [4.7.3](releases/4.7.3.md) · [4.7.2](releases/4.7.2.md) · [4.7.1](releases/4.7.1.md) · [4.7.0](releases/4.7.0.md) · [4.6.7](releases/4.6.7.md) · [4.6.6](releases/4.6.6.md) · [4.6.5](releases/4.6.5.md) · [4.6.4](releases/4.6.4.md) · [4.6.3](releases/4.6.3.md) · [4.6.2](releases/4.6.2.md) · [4.6.1](releases/4.6.1.md) · [4.6.0](releases/4.6.0.md).
 Older notes: [releases/](releases/). Config: [configuration.md](configuration.md).
 
 ---

package/docs/agent-guide.md

@@ -507,6 +507,8 @@ npx ark-check --promote <ruleId> --apply      # write mode "enforced" into that
 **`--sensors`** lists every sensor ArkGate ships — ArkRules, ArkRun and
 ArkOrder — with its plane, its tier and whether it can *ever* be enforced, so
 Tier-2 shows up before you write the rule rather than after you wait for a run.
+ArkOrder: `proposeRelease` then `apply`; `refreshSigma`; ingest residual;
+capacity pack; `ReleaseStore`; ArkRun `decisionTape`. No `/ark-order` skill.
 It also says *how*: only the ArkRules plane is promoted per rule; ArkRun and
 ArkOrder are switched by the plane-level `arkRun.mode` / `arkOrder.mode`, and
 `--promote --apply` writes ArkRules documents only.

package/docs/ai-gates.md

@@ -33,8 +33,11 @@ Prefer fail-closed honesty over fake hard guarantees on advisory hosts.
 Everything below uses the same `ark.config.json` as `arkgate-check` / `ark-check` (CI) — one
 rules file shared by every surface. From **4.0**, optional **ArkRules** (`arkRules` map +
 `arkrules/*.json`) ride the **same** write path, doctor, and CI adapter; absence of ArkRules
-does not change inter-layer verdicts. Label residual **`[Layer]`** vs **`[ArkRules]`**. See
-[configuration — ArkRules](configuration.md#arkrules-intra-layer-opt-in).
+does not change inter-layer verdicts. Optional ArkRun / ArkOrder extras ride that envelope
+when on (`proposeRelease` then `apply`). Absence is silent. Label residual **`[Layer]`** vs
+**`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**. See
+[configuration — ArkRules](configuration.md#arkrules-intra-layer-opt-in) ·
+[ArkOrder](arkorder.md).
 
 Generate the layer contract once:
 

package/docs/arkorder.md

@@ -8,12 +8,13 @@ Import: `arkgate/order` (same npm package `arkgate`). Off until you add
 `arkOrder` on schema `1.3`. Absence is silent. In-memory. Not durable. It is
 a library plus sensors, not a service. Does **not** replace ArkRun.
 
-First-contact copy: freeze / four verbs / no `update`. Haken (ξ vs s) lives
-below.
+First-contact copy: freeze through a valve / no `update`. Haken (ξ vs s) lives
+below. **ArkOrder freezes the pattern through a valve. ArkRun is how the residual travels.**
 
 Canonical plan seed: [plans/arkorder/README.md](plans/arkorder/README.md).
 ADRs: [0027](adr/0027-arkorder-gated-extra-plane.md)–[0030](adr/0030-opt-in-extras-same-npm-package.md),
-[0033](adr/0033-arkorder-runtime-half-is-arkrun.md) (runtime half is ArkRun).
+[0033](adr/0033-arkorder-runtime-half-is-arkrun.md) (runtime half is ArkRun),
+[0034](adr/0034-arkorder-valved-loop.md) (valved loop; public verbs in 4.8.6).
 Config: [configuration.md](configuration.md). Surface:
 [package-surface.md](package-surface.md#experimental-opt-in-surfaces).
 
@@ -24,7 +25,7 @@ Config: [configuration.md](configuration.md). Surface:
 | Is | Is not |
 |----|--------|
 | A **library** (`createOrderPlane`) plus **static sensors** | A running service, daemon, or hosted plane |
-| Four verbs: `release` / `project` / `ingest` / `proposeRelease` | A generic `update` / `patch` / `set` |
+| Valved verbs: `release` / `project` / `ingest` / `proposeRelease` / `apply` / `refreshSigma` | A generic `update` / `patch` / `set` |
 | Opt-in extra on `ark.config.json` | Always-on; compact starters leave it off |
 | Consumer-named slow keys (`xiKeys`) | A construction OS, BIM, or FirmPack |
 | Same npm tarball | not `@arkgate/order` |
@@ -49,10 +50,10 @@ They already exist:
 
 | Ask | API | Since |
 |-----|-----|-------|
-| Escalation as a first-class concept | `IngestResult = IngestAbsorb \| IngestEscalate` (`kind`, `reason`) | 4.8.0 |
+| Escalation as a first-class concept | `IngestResult` residual `absorb \| escalate_up \| hold` (`reasonCode`, `IngestEscalate.target`) | 4.8.0 / 4.8.6 |
 | Projection at the boundary | `Projector = (release, sigma) => Projection` | 4.8.0 |
 | Cap on badly designed slow parameters | `DEFAULT_MAX_XI_KEYS = 7`, `maxXiKeys`, `ARKORDER_TOO_MANY_PARAMS`, `ARKORDER_EMPTY_XI`, `ARKORDER_NESTED_XI` | 4.8.0 |
-| Valved proposals, never direct mutation | `ProposeResult { nextXi, blastRadius, invalidations }` | 4.8.0 |
+| Valved proposals, never direct mutation | `ProposeResult` then `apply` (`ARKORDER_UNVALVED_RELEASE`) | 4.8.0 / 4.8.6 |
 | Typed cell schema | `XiSchema` / `XiPropertySchema` | 4.8.0 |
 | Named slow keys on the write path | `arkOrder.xiKeys`; `ARKORDER_XI_FIELD_WRITE` | 4.8.3 |
 | Factory isolation | `createOrderPlane` from `arkgate/order` only | 4.8.0 |
@@ -60,13 +61,20 @@ They already exist:
 | σ freshness, never ξ | `sigmaMaxAgeMs` / `σ.freshUntil`; `ARKORDER_XI_TTL`, `ARKORDER_STALE_SIGMA` | 4.8.5 |
 | Escalate to a person | `IngestEscalate.target` including `human` | 4.8.5 |
 | Shadow / replay / compare | ArkRun `shadowInformationPackage` / `compareInformationPackages` / `replayInformationPackages` | 4.8.5 |
+| Decision tape | ArkRun information package `decisionTape` `{ xiHash, event, residual }` | 4.8.6 |
+| σ vs ξ identity | `xiHash` / `sigmaHash` / `refreshSigma` | 4.8.6 |
+| Capacity as data | `ConstraintPack.capacity` (`kind` / `sigmaKey` / `payloadKey` / `op`) | 4.8.6 |
+| Store port | `ReleaseStore` / `createMemoryReleaseStore` in-memory default — not durable, not K01 | 4.8.6 |
+| Thin travel helper | `ingestTravelAction` absorb→`send` / escalate_up human→`raises` | 4.8.6 |
 
 Nothing here is a hosted runtime. Nothing here can be “down”. A degraded-mode
 contract would defend against an outage that cannot happen.
 
 ---
 
-## Four verbs
+## Valved loop
+
+**ArkOrder freezes the pattern through a valve. ArkRun is how the residual travels.**
 
 ```ts
 import { createOrderPlane } from 'arkgate/order';
@@ -76,26 +84,32 @@ const plane = createOrderPlane({
   xiSchema,           // JSON Schema object; additionalProperties false
   maxXiKeys,          // default 7
   clocks,             // injected; Domain must not call Date.now
-  packs,              // data, not user predicates
+  packs,              // data, not user predicates (capacity is kind/sigmaKey/payloadKey/op)
   informationBudget,  // optional { cannotObserve: ['ledger'] } — not a config key
   sigmaMaxAgeMs,      // optional σ freshness; never on ξ — not a config key
+  store,              // optional ReleaseStore; default in-memory is not durable
+  catalogDigest,      // optional; keyed by ξ.catalogReleaseId — SKU set does not enter the hash
 });
 
-plane.release(xi, sigma);      // freeze, version, hash. No in-place mutate
+plane.release(xi, sigma);      // first freeze only
 plane.project();               // derive allowed s + invalidations
-plane.ingest(event);           // absorb or escalate. Never returns a Release
+plane.ingest(event);           // residual absorb | escalate_up | hold. Never a Release
 plane.proposeRelease(delta);   // blast radius. Empty blast = domain error
+plane.apply(proposal);         // valve: later ξ change
+plane.refreshSigma(sigma);     // saldo / clocks; xiHash unchanged
 ```
 
 There is no `update()`. Calling `update` / `patch` / `set` on the plane throws
 `ARKORDER_FORBIDDEN_METHOD` and, on the write path, emits
-`ARKORDER_GENERIC_UPDATE`.
+`ARKORDER_GENERIC_UPDATE`. A second `release()` whose ξ differs fails
+`ARKORDER_UNVALVED_RELEASE`.
 
 | Field write | Verb |
 |-------------|------|
-| Invoice, seat within cap, timesheet, daily log | `ingest` → absorb |
-| Over cap / invariant pressure | `ingest` → escalate |
-| Change plan / protocol / cost-code bound | `proposeRelease` then `release` |
+| Invoice, seat within cap, timesheet, daily log | `ingest` → absorb (`ingestTravelAction` may `send`) |
+| Over cap (capacity pack) / stale σ | `ingest` → hold |
+| Kind not in h(ξ) | `ingest` → escalate_up (`target: human`; `ingestTravelAction` may `raises`) |
+| Change plan / protocol / cost-code bound | `proposeRelease` then `apply` |
 | PATCH the slow key through Prisma/Drizzle | `ARKORDER_XI_FIELD_WRITE` |
 
 Copy [examples/arkorder-billing/](../examples/arkorder-billing/) and rename the
@@ -199,6 +213,10 @@ Durability (`K01`) stays parked. In-memory is the honesty line.
 
 If a “slow parameter” changes with every click, it is not an order parameter.
 
+The valved loop ships in **4.8.6** ([ADR 0034](adr/0034-arkorder-valved-loop.md)).
+In-memory `ReleaseStore` is **not** durable. Doctor / status `arkOrder` stays
+`notAScore`. This does **not** close `K01` / `Z09`. No `/ark-order` skill.
+
 ---
 
 ## Next step

package/docs/configuration.md

@@ -131,8 +131,10 @@ Top-level fields:
   `enforced` mode fails closed (`ARKORDER_MISSING_PLANE`). `xiKeys` are the 3–5 slow
   names the product already knows (plan, protocol, cost-code bound). Empty `xiKeys`
   leaves `ARKORDER_XI_FIELD_WRITE` silent. Membership ids are not keys. Factory options
-  `informationBudget` and `sigmaMaxAgeMs` belong on `createOrderPlane`, not this extra
-  object. Demotion or deletion is a policy-delta **weakening**. Field ingest never mints
+  `informationBudget`, `sigmaMaxAgeMs`, `store` (`ReleaseStore`), and capacity packs
+  belong on `createOrderPlane`, not this extra object. Later ξ is `proposeRelease`
+  then `apply`; `refreshSigma`; ingest residual `absorb | escalate_up | hold`.
+  Demotion or deletion is a policy-delta **weakening**. Field ingest never mints
   a pattern.
 
 **Activation is one shape.** ArkRun and ArkOrder both use `mode` + `managedLayers`.
@@ -246,7 +248,7 @@ See [brownfield adoption](brownfield-adoption.md#nextjs-honesty-default-overlays
 | **Structure sensors** | Intra-layer heuristics | Only `mode: "enforced"` |
 | **Invariants** | Catalog + coverage evidence (not a business runtime) | Only enforced + proven-uncovered |
 | **ArkRun** (opt-in extra) | Kernel usage + complete declarations | Only `arkRun.mode: "enforced"` when classified |
-| **ArkOrder** (opt-in extra) | Frozen pattern + four verbs (no `update`) | Only `arkOrder.mode: "enforced"` when classified |
+| **ArkOrder** (opt-in extra) | Frozen pattern; first freeze `release()`, later ξ is `proposeRelease` then `apply` (no `update`) | Only `arkOrder.mode: "enforced"` when classified |
 
 Absence of `arkRules`, `arkRun`, or `arkOrder` adds **no** extra merge teeth. **Advisory** structure sensors, advisory
 invariants, advisory ArkRun, and advisory ArkOrder also add **no** merge teeth (FG-ARKRULES-ADVISORY-ONLY / ADR 0020 / ADR 0027) — packing every starter

package/docs/develop.md

@@ -202,9 +202,14 @@ The plane is `arkgate/order` in package `arkgate`, not a second install.
 stays plane-free. Empty `planeRoots` in `enforced` mode fails closed
 (`ARKORDER_MISSING_PLANE`). In-memory. Not durable. Does not replace ArkRun.
 
+First freeze is `release()`. Later pattern change is `proposeRelease` then
+`apply` (`ARKORDER_UNVALVED_RELEASE`). `refreshSigma`; ingest residual
+`absorb | escalate_up | hold` + `reasonCode`; capacity pack as data;
+`createMemoryReleaseStore`; `ingestTravelAction`; ArkRun `decisionTape`.
+
 Copy [examples/arkorder-billing/](../examples/arkorder-billing/) (`plan` / `cycle` /
-`tenancy`) and rename the keys. Posting an invoice is absorbed; changing plan is a
-new release. See [configuration.md](configuration.md) and
+`tenancy`) and rename the keys. Posting an invoice is absorbed; changing plan is
+`proposeRelease` then `apply`. See [configuration.md](configuration.md) and
 [package-surface.md](package-surface.md).
 
 ---

package/docs/diagnostics.md

@@ -57,6 +57,7 @@ Link form for agents: `docs/diagnostics.md#RULE_ID` (exact-case HTML anchors bel
 | [`ARKORDER_GENERIC_UPDATE`](#ARKORDER_GENERIC_UPDATE) | arkorder | Generic update of ξ |
 | [`ARKORDER_TOO_MANY_PARAMS`](#ARKORDER_TOO_MANY_PARAMS) | arkorder | Too many slow keys |
 | [`ARKORDER_INGEST_WRITES_XI`](#ARKORDER_INGEST_WRITES_XI) | arkorder | ingest assigned into ξ |
+| [`ARKORDER_UNVALVED_RELEASE`](#ARKORDER_UNVALVED_RELEASE) | arkorder | Unvalved second freeze of ξ |
 | [`INVALID_CHANGE_PATH`](#INVALID_CHANGE_PATH) | preflight | Unsafe change path |
 | [`DUPLICATE_CHANGE_PATH`](#DUPLICATE_CHANGE_PATH) | preflight | Duplicate path in change set |
 | [`DELETE_TARGET_MISSING`](#DELETE_TARGET_MISSING) | preflight | Delete target missing |
@@ -395,7 +396,7 @@ Haken slaving: few slow keys (ξ) determine derived fast state. Field ingest nev
 **Generic update of ξ**
 
 - **Why:** A call to update/patch/set on the order plane rewrites the slow pattern. Haken slaving forbids generic ξ mutation.
-- **Fix:** Use release() to freeze ξ or proposeRelease() for a pattern change with blast radius, then preflight again. Never mechanical-safe.
+- **Fix:** Use release() for the first freeze of ξ. Later pattern change is proposeRelease then apply(ProposeResult). Never update/patch/set. Never mechanical-safe.
 
 <a id="ARKORDER_TOO_MANY_PARAMS"></a>
 
@@ -412,8 +413,8 @@ Haken slaving: few slow keys (ξ) determine derived fast state. Field ingest nev
 
 **ingest assigned into ξ**
 
-- **Why:** An ingest() result is written into a Release or ξ store. ingest may absorb or escalate; it never mints a pattern.
-- **Fix:** Keep ingest results as absorb/escalate only. Change ξ with proposeRelease + release. Never mechanical-safe.
+- **Why:** An ingest() result is written into a Release or ξ store. ingest may absorb, escalate_up, or hold; it never mints a pattern.
+- **Fix:** Keep ingest results as absorb/escalate_up/hold only. Change ξ with proposeRelease then apply(ProposeResult). Never mechanical-safe.
 
 <a id="ARKORDER_XI_FIELD_WRITE"></a>
 
@@ -422,7 +423,7 @@ Haken slaving: few slow keys (ξ) determine derived fast state. Field ingest nev
 **Slow key written around the order plane**
 
 - **Why:** A managed-layer file imports a persistence driver and writes a declared arkOrder.xiKeys name. Field events absorb or escalate; they do not PATCH the slow pattern.
-- **Fix:** Keep invoices, seats, hours, and logs on ingest. Change the slow key with proposeRelease + release, then preflight again. Never mechanical-safe.
+- **Fix:** Keep invoices, seats, hours, and logs on ingest. Change the slow key with proposeRelease then apply(ProposeResult), then preflight again. Never mechanical-safe.
 
 <a id="ARKORDER_INFORMATION_BUDGET"></a>
 
@@ -449,7 +450,16 @@ Haken slaving: few slow keys (ξ) determine derived fast state. Field ingest nev
 **σ is stale**
 
 - **Why:** ingest ran after σ.freshUntil (or sigmaMaxAgeMs). ξ does not TTL.
-- **Fix:** Refresh σ and ingest again, or freeze a new release if the pattern changed. Never mechanical-safe.
+- **Fix:** Call refreshSigma and ingest again, or proposeRelease then apply(ProposeResult) if the pattern changed. Never mechanical-safe.
+
+<a id="ARKORDER_UNVALVED_RELEASE"></a>
+
+### `ARKORDER_UNVALVED_RELEASE`
+
+**Unvalved second freeze of ξ**
+
+- **Why:** release() ran after a pattern was already frozen and the new ξ differs. First freeze is release(); later pattern change is proposeRelease then apply.
+- **Fix:** Change ξ with proposeRelease then apply(ProposeResult). release() is only the first freeze. Never mechanical-safe.
 
 ## Atomic preflight and change sets
 

package/docs/package-surface.md

@@ -161,21 +161,24 @@ The type-only root exports are also semver-supported:
 - Config contract: `ArkConfig`, `ArkConfigLoadResult`.
 
 Runtime-kernel factories, `CAPABILITY_IDS`, `collectCapabilityUses`, and Domain capability mapping
-helpers are deliberately absent from this root. Use `@arkgate/runtime` for the experimental
-**ArkRun** kernel, and `analyzeProject(...).ir.capabilityUses` for public capability evidence.
+helpers are deliberately absent from this root. Use `arkgate/runtime` for the
+**ArkRun** kernel (experimental here means **durability**: in-memory stores, not
+Postgres), and `analyzeProject(...).ir.capabilityUses` for public capability evidence.
 
 ---
 
 ## Experimental opt-in surfaces
 
-These APIs are implemented for evaluation and compatibility, but they are **not production-ready
-product claims**. Static architecture enforcement does not depend on them.
+**Experimental** names **durability** (in-memory stores, not Postgres) — not the extras
+themselves. ArkRun and ArkOrder are opt-in extras of package `arkgate`. These APIs are
+implemented for evaluation and compatibility; they are **not** production durability
+claims. Static architecture enforcement does not depend on them.
 
 | Surface | Import path | Notes |
 |---------|-------------|--------|
-| **ArkRun kernel** | **`arkgate/runtime`** | Public brand **ArkRun**. Same npm package `arkgate` (ADR 0031). Factory `createStrictArkKernel` (each call is an isolated instance; no process-wide `getKernel()` singleton). Root export does **not** include the factory. Optional extra `arkRun` on schema `1.2+`. Event bus, intents, policies, sagas, event buffer, projections, and strict helpers. Managed components declare `uses` / `reactsTo` / `raises` / `sends` on `register()`; `getDependencyInformationPackage()` is a JSON snapshot of ids, lifetime, and declarations and never includes factories, live instances, or input DTOs (ADR 0023). `requestGraph()` slices that snapshot into **process** or **technical** graphs with optional `nodeIds`, `degreesOfSeparation`, and include/exclude query; `formatArkRunGraphMermaid()` (also `graph.mermaid`) is a helper string, never a score. `send()` is the transport port (local / localBlocking / broker); missing broker falls back to in-process local delivery, `ephemeral` defaults true, and **no cloud SDKs ship** in the package (ADR 0024). Opt-in `startInspector()` / `startArkRunInspector()` binds **`127.0.0.1` only**, refuses `NODE_ENV=production`, lazy-loads HTTP, and serves JSON snapshots, SSE, and `/graph` slices of the information package (no public / authless bind). **Shadow / replay / compare** (`shadowInformationPackage`, `compareInformationPackages`, `replayInformationPackages`) are in-memory helpers on that snapshot — not durable, not a second bus (ADR 0033). Built-in stores are **InMemory reference only**. Branding ArkRun is not a production-durability claim. **`@arkgate/runtime` is deprecated** leftover 0.x (`experimental` dist-tag). |
+| **ArkRun kernel** | **`arkgate/runtime`** | Public brand **ArkRun**. Same npm package `arkgate` (ADR 0031). Factory `createStrictArkKernel` (each call is an isolated instance; no process-wide `getKernel()` singleton). Root export does **not** include the factory. Optional extra `arkRun` on schema `1.2+`. Event bus, intents, policies, sagas, event buffer, projections, and strict helpers. Managed components declare `uses` / `reactsTo` / `raises` / `sends` on `register()`; `getDependencyInformationPackage()` is a JSON snapshot of ids, lifetime, and declarations and never includes factories, live instances, or input DTOs (ADR 0023). `requestGraph()` slices that snapshot into **process** or **technical** graphs with optional `nodeIds`, `degreesOfSeparation`, and include/exclude query; `formatArkRunGraphMermaid()` (also `graph.mermaid`) is a helper string, never a score. `send()` is the transport port (local / localBlocking / broker); missing broker falls back to in-process local delivery, `ephemeral` defaults true, and **no cloud SDKs ship** in the package (ADR 0024). Opt-in `startInspector()` / `startArkRunInspector()` binds **`127.0.0.1` only**, refuses `NODE_ENV=production`, lazy-loads HTTP, and serves JSON snapshots, SSE, and `/graph` slices of the information package (no public / authless bind). **Shadow / replay / compare** (`shadowInformationPackage`, `compareInformationPackages`, `replayInformationPackages`) are in-memory helpers on that snapshot — not durable, not a second bus (ADR 0033). **Decision tape** `decisionTape` `{ xiHash, event, residual }` via `appendDecisionTape` (ADR 0034). Built-in stores are **InMemory reference only**. Branding ArkRun is not a production-durability claim. **`@arkgate/runtime` is deprecated** leftover 0.x (`experimental` dist-tag). |
 | **NestJS adapter** | **`arkgate/nestjs`** | Experimental optional peer `@nestjs/common` for the ArkRun kernel. Same npm package. `@arkgate/runtime/nestjs` is deprecated. |
-| **ArkOrder plane** | **`arkgate/order`** | Public brand **ArkOrder**. Same npm package `arkgate` (ADR 0030) — not `@arkgate/order`. Factory `createOrderPlane`. Four verbs: `release` / `project` / `ingest` / `proposeRelease`. No `update`. Haken: few slow keys; ingest never mints a pattern; empty blast fails closed. Factory options (not config keys): `informationBudget.cannotObserve`, `sigmaMaxAgeMs` (freshness on σ, never ξ). `IngestEscalate.target` includes `human`. Root `arkgate` export does **not** include the factory. Optional extra `arkOrder` on schema `1.3`. In-memory; not durable. Does not replace ArkRun. Runtime half (shadow/replay/compare) is ArkRun (ADR 0033). Canonical: [ArkOrder](arkorder.md). |
+| **ArkOrder plane** | **`arkgate/order`** | Public brand **ArkOrder**. Same npm package `arkgate` (ADR 0030) — not `@arkgate/order`. Factory `createOrderPlane`. Valved verbs: `release` / `project` / `ingest` / `proposeRelease` / `apply` / `refreshSigma`. No `update`. First freeze is `release()`; later ξ change is `apply` (`ARKORDER_UNVALVED_RELEASE`). Haken: few slow keys; ingest residual `absorb | escalate_up | hold` + closed `reasonCode`; empty blast fails closed. Capacity pack as data (`kind` / `sigmaKey` / `payloadKey` / `op`). Factory options (not config keys): `informationBudget.cannotObserve`, `sigmaMaxAgeMs`, `store` (`ReleaseStore` / `createMemoryReleaseStore`), `catalogDigest`. Thin travel: `ingestTravelAction` absorb→`send` / escalate_up human→`raises`. `IngestEscalate.target` includes `human`. Root `arkgate` export does **not** include the factory. Optional extra `arkOrder` on schema `1.3`. In-memory; not durable; does not close K01. Does not replace ArkRun. Runtime half (shadow/replay/compare + `decisionTape` / `appendDecisionTape`) is ArkRun (ADR 0033 / 0034). Canonical: [ArkOrder](arkorder.md). |
 
 ---
 
@@ -241,16 +244,16 @@ production deployment would need to satisfy; it is not a readiness certification
 | Break CLI JSON field, MCP tool rename, or required `ark.config` field | **major** |
 | New optional config field, new CLI flag, additive JSON | **minor** |
 | Bugfix with no contract change | **patch** |
-| Additive experimental ArkRun kernel API | `@arkgate/runtime` prerelease/minor |
-| Remove deprecated `arkgate/runtime` / `arkgate/nestjs` forwarding shims | **Done (AR04)** — use `@arkgate/runtime` / `@arkgate/runtime/nestjs` |
+| Additive experimental ArkRun kernel API | `arkgate/runtime` patch/minor (`@arkgate/runtime` is deprecated) |
+| Remove deprecated `arkgate/runtime` / `arkgate/nestjs` forwarding shims | **Done (AR04)** — use `arkgate/runtime` / `arkgate/nestjs` |
 
 ---
 
 ## Release notes (maintainers)
 
 Ship notes for a version live under [releases/](https://github.com/pedroknigge/arkgate/tree/main/docs/releases)
-(current tree prepared: [4.8.5.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.5.md);
-current published: [4.8.4.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.4.md);
+(current published: [4.8.5.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.5.md);
+prior published: [4.8.4.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.4.md);
 prior published: [4.8.3.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.3.md);
 prior published: [4.8.2.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.2.md);
 prior published: [4.8.1.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.1.md);

package/docs/product-voice.md

@@ -77,7 +77,7 @@ Three beats when a line teaches:
 | The agent imported Infrastructure from Domain. The write didn’t land. Next: `/ark-place`. | Ship it 🚀 crush the spaghetti |
 | Import rules pass. The tree still needs a refactor. Next: one small change. | You don’t need to understand anything |
 | ArkRun is experimental. In-memory. Data is gone on restart. | The kernel is production-ready |
-| The agent PATCHed the billing plan as if it were a seat count. The write didn’t land. Next: a new release, not `update`. | Freeze ξ. Four verbs. Haken slaving. |
+| The agent PATCHed the billing plan as if it were a seat count. The write didn’t land. Next: `proposeRelease` then `apply`, not `update`. | Freeze ξ. Four verbs. Haken slaving. |
 | Status: one light, one next step. | Become an architect in 60 seconds |
 
 **Brands, then the common word:** ArkGate, ArkRules, ArkRun, ArkOrder. Gloss once.
@@ -90,7 +90,7 @@ Three beats when a line teaches:
 | `arkgate-check --doctor` — **status**, one next step | control plane, coach, doctor as the product name |
 | optional policies inside a layer | dual plane, intra-layer sensors, Saturday tidy |
 | experimental runtime / in-memory / not Postgres | production kernel, durable runtime, training wheels |
-| the few slow product decisions / billing plan vs seats / that PUT doesn’t land | four verbs, freeze a pattern, Haken, slaving, ξ vs s, extra plane, construction OS |
+| the few slow product decisions / billing plan vs seats / that PUT doesn’t land / `proposeRelease` then `apply` | four verbs, freeze a pattern, Haken, slaving, ξ vs s, extra plane, construction OS |
 
 Command names stay command names (`--doctor` is a flag). If a word is not here,
 cut it or put it below the fold (develop, JSON, ADRs).
@@ -111,7 +111,7 @@ These are product law, not vibe:
 - Host write hardness differs. Required CI is the shared hard line.
 - ArkRun stores are **in-memory**. Not production durability. Do not imply otherwise.
 - Absence of ArkRules, ArkRun, or ArkOrder is silent. Label leftovers **`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**.
-- ArkOrder is in-memory and not durable. It does not replace ArkRun. Do not imply a second npm package.
+- ArkOrder is in-memory and not durable. It does not replace ArkRun. Do not imply a second npm package. Later pattern change is `proposeRelease` then `apply`.
 
 Full engineering queue: [ROADMAP.md](../ROADMAP.md). Do not narrate phase ids in consumer copy.
 

package/docs/use.md

@@ -81,7 +81,7 @@ The config only binds when the write doesn’t land and CI is required.
 | **ArkGate** (layers) | Import rules. The write doesn’t land. The PR fails. | Always — this is the product |
 | **ArkRules** | Optional policies *inside* a layer. | Off until you turn it on (start may ship advisory templates) |
 | **ArkRun** | Optional experimental runtime (`arkgate/runtime`) | Off. In-memory. Not Postgres. |
-| **ArkOrder** | Stops the agent rewriting the few slow product decisions as CRUD (`arkgate/order`). Library + sensors, [not a service](arkorder.md). | Off. Name `xiKeys` (plan / protocol, not `projectId`). Invoices and seats still flow. In-memory. Not durable. |
+| **ArkOrder** | Stops the agent rewriting the few slow product decisions as CRUD (`arkgate/order`). Library + sensors, [not a service](arkorder.md). Valve: `proposeRelease` then `apply`; `refreshSigma`; ingest residual; capacity pack; `ReleaseStore`; ArkRun `decisionTape`. ArkOrder freezes the pattern through a valve. ArkRun is how the residual travels. | Off. Name `xiKeys` (plan / protocol, not `projectId`). Invoices and seats still flow. In-memory. Not durable. |
 
 Start always gives you **layers**. Compact starters do **not** turn on ArkRun or
 ArkOrder. No extras is fine — only ArkGate runs. Leftovers are labeled

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkgate",
-  "version": "4.8.5",
+  "version": "4.8.6",
   "description": "When the agent writes a bad import, the write doesn’t land. The same check fails the pull request.",
   "type": "module",
   "main": "./dist/index.cjs",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/pedroknigge/arkgate",
     "source": "github"
   },
-  "version": "4.8.5",
+  "version": "4.8.6",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "arkgate",
-      "version": "4.8.5",
+      "version": "4.8.6",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/templates/agent-skills/README.md

@@ -7,7 +7,7 @@
 This directory is the **Agent Skills–compatible** packaging of the same **13**
 `/ark-*` skills shipped as flat templates for Ark install. **No new skill names.**
 
-Package version when last generated context: **arkgate@4.8.5**
+Package version when last generated context: **arkgate@4.8.6**
 Schema: agent-skills package contract `1.0`
 
 ## Skills (frozen catalog)

package/templates/agent-skills/ark-adopt/SKILL.md

@@ -126,8 +126,8 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 |-------|------------------|----------------|-----------------|
 | **Layers** (inter-layer) | Who may import whom, capabilities, pure/forbiddenGlobals, peerIsolation | `ark.config.json` → `layers[]`, `rules[]` | graph check, baseline edges, doctor coverage % |
 | **ArkRules** (intra-layer) | Structure inside a layer + domain invariants as data | `arkRules` map + `arkrules/<ExactLayerName>.json` | structure sensors, invariant coverage, `--rules-inventory`, doctor `rulesUnderContract` |
-| **ArkRun** (extra) | Kernel usage + complete declarations | `arkRun` on `ark.config.json` (schema `1.2+`); factory `arkgate/runtime`; **`kernelRoots` preferred**, `compositionRoots` alias | `ARKRUN_*`, doctor `arkRun` (`notAScore`) |
-| **ArkOrder** (extra) | Operational pattern (ξ vs s) | `arkOrder` on `ark.config.json` (schema `1.3+`); factory `arkgate/order` | `ARKORDER_*` |
+| **ArkRun** (extra) | Kernel usage + complete declarations; information package `decisionTape` `{ xiHash, event, residual }` | `arkRun` on `ark.config.json` (schema `1.2+`); factory `arkgate/runtime`; **`kernelRoots` preferred**, `compositionRoots` alias | `ARKRUN_*`, doctor `arkRun` (`notAScore`) |
+| **ArkOrder** (extra) | Operational pattern (ξ vs s). Valve: first `release()`, later ξ is `proposeRelease` then `apply`; `refreshSigma`; ingest residual `absorb \| escalate_up \| hold` + `reasonCode`; capacity pack as data; in-memory `ReleaseStore` | `arkOrder` on `ark.config.json` (schema `1.3+`); factory `arkgate/order` | `ARKORDER_*` |
 
 **Rules for every report / answer:**
 1. Prefix each finding or next step with **`[Layer]`** or **`[ArkRules]`** or **`[ArkRun]`** or **`[ArkOrder]`** (or a table with those headers).
@@ -151,7 +151,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 - Do **not** put `arkRun` on the compact starter / `ark start` scaffold. Brownfield stays advisory until the team promotes.
 - Absence is valid and **silent** — never force the extra. Never force the kernel over existing Nest/DI. Do not invent `/ark-run`.
 - Import from `arkgate/runtime` (factory `createStrictArkKernel`, per instance, no process-wide singleton). `@arkgate/runtime` is deprecated. No shipped cloud broker SDKs.
-- In-memory stores are **not** production durability. Branding ArkRun is not a durability claim. Doctor / status `arkRun` is `notAScore`.
+- In-memory stores are **not** production durability. Branding ArkRun is not a durability claim. Doctor / status `arkRun` is `notAScore`. Information package `decisionTape` / `appendDecisionTape` is in-memory, not a bus.
 - Demoting enforced → advisory or deleting the extra is policy-delta **weakening**.
 - After the extra is honest: handoff `/ark-runtime` to wire one candidate, `/ark-place` for new kernel-managed files. Skills never enforce.
 
@@ -173,7 +173,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 }
 ```
 
-- `xiKeys` are meaning, not membership. `projectId` / `orgId` do not belong. If `proposeRelease` throws empty blast, that key does not order anything.
+- `xiKeys` are meaning, not membership. `projectId` / `orgId` do not belong. If `proposeRelease` throws empty blast, that key does not order anything. After the first `release()`, change ξ with `proposeRelease` then `apply` — not a second `release()` (`ARKORDER_UNVALVED_RELEASE`). `refreshSigma`; ingest residual `absorb | escalate_up | hold` + `reasonCode`; capacity pack as data; `createMemoryReleaseStore`; `ingestTravelAction`; ArkRun `decisionTape`.
 - A use-case that `prisma.*.update({ plan })` while `plan` is in `xiKeys` is **[ArkOrder]** `ARKORDER_XI_FIELD_WRITE`. Invoices and seats still flow through `ingest`.
 
 - Do **not** put `arkOrder` on the compact starter / `ark start` scaffold. Domain stays plane-free. Import `createOrderPlane` from `arkgate/order` (same npm package).

package/templates/agent-skills/ark-architect/SKILL.md

@@ -42,7 +42,7 @@ Then call **`ark_recommend`** with the same bound `project` envelope (or `ark-ch
 
 ## Dual plane — layers + extras (mandatory, except /ark-runtime)
 
-Label findings **`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**. Absence of extras is valid and silent. Session-0 extras (advisory `arkRun` / advisory `arkOrder`) live on **`/ark-adopt`**. Do not invent `/ark-run` or `/ark-order`. Skills never enforce.
+Label findings **`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**. Absence of extras is valid and silent. Session-0 extras (advisory `arkRun` / advisory `arkOrder`) live on **`/ark-adopt`**. When ArkOrder is on: first freeze `release()`, later ξ is `proposeRelease` then `apply`; `refreshSigma`; ingest residual `absorb | escalate_up | hold`; capacity pack as data; in-memory `ReleaseStore`; ArkRun `decisionTape`. Do not invent `/ark-run` or `/ark-order`. Skills never enforce.
 
 ## Subagent fan-out (optional, host-dependent)
 

package/templates/agent-skills/ark-autopilot/SKILL.md

@@ -119,8 +119,8 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 |-------|------------------|----------------|-----------------|
 | **Layers** (inter-layer) | Who may import whom, capabilities, pure/forbiddenGlobals, peerIsolation | `ark.config.json` → `layers[]`, `rules[]` | graph check, baseline edges, doctor coverage % |
 | **ArkRules** (intra-layer) | Structure inside a layer + domain invariants as data | `arkRules` map + `arkrules/<ExactLayerName>.json` | structure sensors, invariant coverage, `--rules-inventory`, doctor `rulesUnderContract` |
-| **ArkRun** (extra) | Kernel usage + complete declarations | `arkRun` on `ark.config.json` (schema `1.2+`); factory `arkgate/runtime`; **`kernelRoots` preferred**, `compositionRoots` alias | `ARKRUN_*`, doctor `arkRun` (`notAScore`) |
-| **ArkOrder** (extra) | Operational pattern (ξ vs s) | `arkOrder` on `ark.config.json` (schema `1.3+`); factory `arkgate/order` | `ARKORDER_*` |
+| **ArkRun** (extra) | Kernel usage + complete declarations; information package `decisionTape` `{ xiHash, event, residual }` | `arkRun` on `ark.config.json` (schema `1.2+`); factory `arkgate/runtime`; **`kernelRoots` preferred**, `compositionRoots` alias | `ARKRUN_*`, doctor `arkRun` (`notAScore`) |
+| **ArkOrder** (extra) | Operational pattern (ξ vs s). Valve: first `release()`, later ξ is `proposeRelease` then `apply`; `refreshSigma`; ingest residual `absorb \| escalate_up \| hold` + `reasonCode`; capacity pack as data; in-memory `ReleaseStore` | `arkOrder` on `ark.config.json` (schema `1.3+`); factory `arkgate/order` | `ARKORDER_*` |
 
 **Rules for every report / answer:**
 1. Prefix each finding or next step with **`[Layer]`** or **`[ArkRules]`** or **`[ArkRun]`** or **`[ArkOrder]`** (or a table with those headers).
@@ -141,13 +141,13 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 ### Autopilot + ArkRun
 When `arkRun` is present:
 - Grind skip clusters with judgment: `ARKRUN_DIRECT_NEW` / `ARKRUN_TRANSPORT_BYPASS` / `ARKRUN_KERNEL_IN_DOMAIN` / `ARKRUN_MISSING_ROOT`. Never invent `mechanical-safe` for new emits / homemade buses.
-- Factory only inside `arkRun.kernelRoots` (`compositionRoots` alias). Import `arkgate/runtime`. Doctor `arkRun` is `notAScore`.
+- Factory only inside `arkRun.kernelRoots` (`compositionRoots` alias). Import `arkgate/runtime`. Doctor `arkRun` is `notAScore`. Information package may carry `decisionTape` `{ xiHash, event, residual }` (`appendDecisionTape`). Shadow / compare / replay stay in-memory.
 - Extra off → `/ark-adopt` (advisory) or `/ark-runtime` (evaluate one candidate). Do not invent `/ark-run`.
 - Skills never enforce.
 
 ### Autopilot + ArkOrder
 When `arkOrder` is present:
-- Grind skip clusters with judgment: `ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE` / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`. Freeze ξ with `release()`; never `update`/`patch`/`set`. Name `xiKeys`; do not persist those keys from a use-case.
+- Grind skip clusters with judgment: `ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE` / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE` / `ARKORDER_UNVALVED_RELEASE`. First freeze with `release()`; later ξ change is `proposeRelease` then `apply`. `refreshSigma`; ingest residual `absorb | escalate_up | hold` + `reasonCode`; capacity pack; `createMemoryReleaseStore`; `ingestTravelAction`; ArkRun `decisionTape`. Never `update`/`patch`/`set`. Name `xiKeys`; do not persist those keys from a use-case. Doctor / status `arkOrder` is `notAScore`.
 - Extra off → `/ark-adopt` (advisory). Do not invent `/ark-order`.
 - Skills never enforce.
 

package/templates/agent-skills/ark-contract/SKILL.md

@@ -45,7 +45,7 @@ Label findings **`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrd
 
 Application / Features may declare advisory **`writes-via-aggregate`**: a use-case that imports a persistence driver and calls `.insert` / `.create` / `INSERT INTO` is the skip. Persistence adapters stay the write edge. Do not add `Externals/` or `admission.ts` as contract law.
 
-When `arkOrder` is on, name **`xiKeys`** (3–5 slow product decisions). Membership ids are not keys. A use-case that persists those keys is `ARKORDER_XI_FIELD_WRITE`. Copy [examples/arkorder-billing/](../../../examples/arkorder-billing/) and rename the three keys.
+When `arkOrder` is on, name **`xiKeys`** (3–5 slow product decisions). Membership ids are not keys. A use-case that persists those keys is `ARKORDER_XI_FIELD_WRITE`. First freeze is `release()`; later ξ is `proposeRelease` then `apply`; `refreshSigma`; ingest residual `absorb | escalate_up | hold` + `reasonCode`; capacity pack as data; in-memory `ReleaseStore`; ArkRun `decisionTape`. Copy [examples/arkorder-billing/](../../../examples/arkorder-billing/) and rename the three keys.
 
 ## Subagent fan-out (optional, host-dependent)
 

package/templates/agent-skills/ark-coverage/SKILL.md

@@ -83,8 +83,8 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 |-------|------------------|----------------|-----------------|
 | **Layers** (inter-layer) | Who may import whom, capabilities, pure/forbiddenGlobals, peerIsolation | `ark.config.json` → `layers[]`, `rules[]` | graph check, baseline edges, doctor coverage % |
 | **ArkRules** (intra-layer) | Structure inside a layer + domain invariants as data | `arkRules` map + `arkrules/<ExactLayerName>.json` | structure sensors, invariant coverage, `--rules-inventory`, doctor `rulesUnderContract` |
-| **ArkRun** (extra) | Kernel usage + complete declarations | `arkRun` on `ark.config.json` (schema `1.2+`); factory `arkgate/runtime`; **`kernelRoots` preferred**, `compositionRoots` alias | `ARKRUN_*`, doctor `arkRun` (`notAScore`) |
-| **ArkOrder** (extra) | Operational pattern (ξ vs s) | `arkOrder` on `ark.config.json` (schema `1.3+`); factory `arkgate/order` | `ARKORDER_*` |
+| **ArkRun** (extra) | Kernel usage + complete declarations; information package `decisionTape` `{ xiHash, event, residual }` | `arkRun` on `ark.config.json` (schema `1.2+`); factory `arkgate/runtime`; **`kernelRoots` preferred**, `compositionRoots` alias | `ARKRUN_*`, doctor `arkRun` (`notAScore`) |
+| **ArkOrder** (extra) | Operational pattern (ξ vs s). Valve: first `release()`, later ξ is `proposeRelease` then `apply`; `refreshSigma`; ingest residual `absorb \| escalate_up \| hold` + `reasonCode`; capacity pack as data; in-memory `ReleaseStore` | `arkOrder` on `ark.config.json` (schema `1.3+`); factory `arkgate/order` | `ARKORDER_*` |
 
 **Rules for every report / answer:**
 1. Prefix each finding or next step with **`[Layer]`** or **`[ArkRules]`** or **`[ArkRun]`** or **`[ArkOrder]`** (or a table with those headers).
@@ -102,6 +102,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 
 ### Coverage + extras
 - Extras silent when off. Doctor `arkRun` is `notAScore`. “No arkRun / arkOrder” is not a failed gate. Do not force extras.
+- When ArkOrder is on, fitness still labels **[ArkOrder]**: valve is `proposeRelease` then `apply`; `refreshSigma`; ingest residual `absorb | escalate_up | hold` + `reasonCode`; capacity pack as data; in-memory `ReleaseStore`. ArkRun residual may include `decisionTape`.
 
 ## Subagent fan-out (optional, host-dependent)
 

package/templates/agent-skills/ark-explain/SKILL.md

@@ -67,8 +67,8 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 |-------|------------------|----------------|-----------------|
 | **Layers** (inter-layer) | Who may import whom, capabilities, pure/forbiddenGlobals, peerIsolation | `ark.config.json` → `layers[]`, `rules[]` | graph check, baseline edges, doctor coverage % |
 | **ArkRules** (intra-layer) | Structure inside a layer + domain invariants as data | `arkRules` map + `arkrules/<ExactLayerName>.json` | structure sensors, invariant coverage, `--rules-inventory`, doctor `rulesUnderContract` |
-| **ArkRun** (extra) | Kernel usage + complete declarations | `arkRun` on `ark.config.json` (schema `1.2+`); factory `arkgate/runtime`; **`kernelRoots` preferred**, `compositionRoots` alias | `ARKRUN_*`, doctor `arkRun` (`notAScore`) |
-| **ArkOrder** (extra) | Operational pattern (ξ vs s) | `arkOrder` on `ark.config.json` (schema `1.3+`); factory `arkgate/order` | `ARKORDER_*` |
+| **ArkRun** (extra) | Kernel usage + complete declarations; information package `decisionTape` `{ xiHash, event, residual }` | `arkRun` on `ark.config.json` (schema `1.2+`); factory `arkgate/runtime`; **`kernelRoots` preferred**, `compositionRoots` alias | `ARKRUN_*`, doctor `arkRun` (`notAScore`) |
+| **ArkOrder** (extra) | Operational pattern (ξ vs s). Valve: first `release()`, later ξ is `proposeRelease` then `apply`; `refreshSigma`; ingest residual `absorb \| escalate_up \| hold` + `reasonCode`; capacity pack as data; in-memory `ReleaseStore` | `arkOrder` on `ark.config.json` (schema `1.3+`); factory `arkgate/order` | `ARKORDER_*` |
 
 **Rules for every report / answer:**
 1. Prefix each finding or next step with **`[Layer]`** or **`[ArkRules]`** or **`[ArkRun]`** or **`[ArkOrder]`** (or a table with those headers).
@@ -97,6 +97,7 @@ ArkGate has **always-on Layers** plus opt-in extras. The user chooses extras; yo
 
 ### Explain + extras
 - Extras silent when off. If `arkRun` is on, doctor `arkRun` is `notAScore` — never a tour score. Do not force extras.
+- If `arkOrder` is on, teach the valve in plain language: first freeze is `release()`; later pattern change is `proposeRelease` then `apply`; `refreshSigma` refreshes saldo; ingest returns `absorb | escalate_up | hold` plus `reasonCode`; capacity is a data pack; `ReleaseStore` is in-memory; ArkRun may carry `decisionTape`. Never `update`.
 
 ## Subagent fan-out (optional, host-dependent)