arkgate 4.8.5 → 4.8.7

package/dist/{types-BuM8WNqe.d.ts → types-BK47clMl.d.ts}

@@ -1,4 +1,4 @@
-import { a as ArkConfigRule, f as ArkConfigLayer, A as ArkConfig } from './configTypes-dy5PfTqS.js';
+import { a as ArkConfigRule, f as ArkConfigLayer, A as ArkConfig } from './configTypes-0eHpocR3.js';
 
 /**
  * Policy types for the Ark kernel.

package/dist/{types-CzE6LMaW.d.ts → types-CwZ_oz1N.d.ts}

@@ -1,4 +1,4 @@
-import { i as Policy, P as PolicyViolation, I as IntentName, j as IntentCreator, k as IntentRelationship, b as ArchitectureProfile, D as DomainEvent, E as EventMetadata, h as PolicyEnforcementMode, A as ArchitectureLayer, c as ArchitectureRule, d as ArkCheckConfig } from './types-BuM8WNqe.js';
+import { i as Policy, P as PolicyViolation, I as IntentName, j as IntentCreator, k as IntentRelationship, b as ArchitectureProfile, D as DomainEvent, E as EventMetadata, h as PolicyEnforcementMode, A as ArchitectureLayer, c as ArchitectureRule, d as ArkCheckConfig } from './types-BK47clMl.js';
 
 /**
  * PolicyEngine
@@ -862,20 +862,35 @@ type ArkRunInformationPackageComponent = {
     sends: string[];
     extendedInfo?: ArkRunExtendedInfo;
 };
+declare const ARK_RUN_DECISION_TAPE_RESIDUAL_KINDS: readonly ["absorb", "escalate_up", "hold"];
+type ArkRunDecisionTapeResidualKind = (typeof ARK_RUN_DECISION_TAPE_RESIDUAL_KINDS)[number];
+/** Additive Order residual tape (ADR 0034 D6). Not a bus. Not durable. */
+type ArkRunDecisionTapeRecord = {
+    xiHash: string;
+    event: {
+        kind: string;
+        payload?: Record<string, string | number | boolean | null>;
+    };
+    residual: {
+        kind: ArkRunDecisionTapeResidualKind;
+        reasonCode?: string;
+        eventId?: string;
+        target?: string;
+    };
+};
 type DependencyInformationPackage = {
     schemaVersion: typeof ARK_RUN_INFORMATION_PACKAGE_SCHEMA_VERSION;
     kernelInstanceId: string;
     components: ArkRunInformationPackageComponent[];
+    /** Optional; omitted keeps the 4.8.x component snapshot shape. */
+    decisionTape?: ArkRunDecisionTapeRecord[];
 };
-/**
- * Build a JSON-serializable snapshot from unknown component records.
- * Only id, lifetime, the four declaration lists, and optional extendedInfo
- * survive — extra keys (factory, instance, DTO payloads) are dropped.
- */
 declare function buildDependencyInformationPackage(input: {
     kernelInstanceId?: unknown;
     components?: unknown;
+    decisionTape?: unknown;
 }): DependencyInformationPackage;
+declare function appendDecisionTape(pack: DependencyInformationPackage, record: unknown): DependencyInformationPackage;
 
 /**
  * ArkRun requestGraph slices (RN13). Tooling only — never a gate verdict.
@@ -1234,4 +1249,4 @@ interface CreateArkKernelFromConfigOptions extends Omit<CreateArkKernelOptions,
 }
 type ArkKernelConfig = ArkCheckConfig;
 
-export { ARK_RUN_INSPECTOR_EVENTS_PATH as $, type ArkKernel as A, type OutboxStatus as B, type CreateArkKernelOptions as C, type DefineIntentOptions as D, type EventContractRegistry as E, type OutboxRecord as F, type GraphEdge as G, type ObservabilityDriftReport as H, IntentRegistry as I, ARK_RUN_COMPONENT_LIFETIMES as J, ARK_RUN_EPHEMERAL_DEFAULT as K, ARK_RUN_GRAPH_DEFAULT_SLICE as L, type MetadataRegistry as M, ARK_RUN_GRAPH_NODE_KINDS as N, type ObservabilityReporter as O, type ProjectionRegistry as P, ARK_RUN_GRAPH_PROCESS_EDGE_KINDS as Q, type ReadModelStore as R, type SagaContext as S, type TraceRecordType as T, ARK_RUN_GRAPH_SCHEMA_VERSION as U, ARK_RUN_GRAPH_SLICES as V, type WorkflowStore as W, ARK_RUN_GRAPH_TECHNICAL_EDGE_KINDS as X, ARK_RUN_INFORMATION_PACKAGE_SCHEMA_VERSION as Y, ARK_RUN_INSPECTOR_DEFAULT_HOST as Z, ARK_RUN_INSPECTOR_DEFAULT_PORT as _, type DependencyGraph as a, InvalidArkRunSendOptionError as a$, ARK_RUN_INSPECTOR_GRAPH_PATH as a0, ARK_RUN_INSPECTOR_SCHEMA_VERSION as a1, ARK_RUN_INSPECTOR_SNAPSHOT_PATH as a2, ARK_RUN_INSPECTOR_SSE_EVENT as a3, ARK_RUN_INSPECTOR_TRANSPORT_FALLBACK as a4, ARK_RUN_TRANSPORT_KINDS as a5, type ArkManifestArchitecture as a6, type ArkManifestData as a7, type ArkManifestEntityLink as a8, type ArkManifestGraph as a9, type ArkRunInspectorSnapshotInput as aA, type ArkRunInspectorSource as aB, type ArkRunInspectorTransportFacts as aC, type ArkRunPublisher as aD, type ArkRunRegisterOptions as aE, type ArkRunRegistrationHandle as aF, type ArkRunSendOptions as aG, type ArkRunSendPlan as aH, type ArkRunSendPlanInput as aI, type ArkRunSendResult as aJ, type ArkRunTransportKind as aK, type AuditRecordInput as aL, type AuditRecordType as aM, type EntityMeta as aN, type EventContractIssue as aO, type EventHandler as aP, type EventInterceptionInfo as aQ, type EventInterceptor as aR, type EventInterceptorContext as aS, type EventPayloadPatch as aT, type EventPayloadSchema as aU, type EventPublisher as aV, type EventSchemaField as aW, type EventSchemaFieldType as aX, type FieldMeta as aY, type GraphNode as aZ, InvalidArkRunGraphQueryError as a_, type ArkManifestIntent as aa, type ArkManifestPolicy as ab, type ArkManifestProjection as ac, type ArkRunBrokerAdapter as ad, type ArkRunComponentLifetime as ae, type ArkRunDeliveredVia as af, type ArkRunExtendedInfo as ag, type ArkRunGraph as ah, type ArkRunGraphEdge as ai, type ArkRunGraphEdgeKind as aj, type ArkRunGraphMatch as ak, type ArkRunGraphMatchInput as al, type ArkRunGraphNode as am, type ArkRunGraphNodeKind as an, type ArkRunGraphProcessEdgeKind as ao, type ArkRunGraphQuery as ap, type ArkRunGraphResolvedQuery as aq, type ArkRunGraphSlice as ar, type ArkRunGraphTechnicalEdgeKind as as, type ArkRunInformationPackageComponent as at, type ArkRunInspectorBind as au, ArkRunInspectorBindError as av, type ArkRunInspectorBindInput as aw, type ArkRunInspectorHandle as ax, ArkRunInspectorProductionError as ay, type ArkRunInspectorSnapshot as az, type AuditStore as b, type ObservabilityFlow as b0, type ObservedLayerFlowMode as b1, type OutboxStore as b2, type PolicyEvaluationResult as b3, type ProjectionCheckpoint as b4, type ProjectionDefinition as b5, type PublishedEventRecord as b6, type RetryPolicy as b7, type SagaStatus as b8, type SagaStep as b9, type StartArkRunInspectorOptions as ba, type TraceSink as bb, type Unsubscribe as bc, type WorkflowDefinition as bd, type WorkflowStatus as be, type WorkflowStep as bf, arkRunGraphQueryFromSearchParams as bg, arkRunInspectorUrl as bh, buildArkRunInspectorSnapshot as bi, buildDependencyInformationPackage as bj, closeArkRunGraphQuery as bk, closedArkRunEphemeral as bl, closedArkRunTransportKind as bm, formatArkRunGraphMermaid as bn, formatArkRunInspectorSseEvent as bo, isArkRunInspectorLoopbackHost as bp, isArkRunInspectorProductionEnv as bq, requestArkRunGraph as br, resolveArkRunInspectorBind as bs, resolveArkRunSendPlan as bt, startArkRunInspector as bu, type AuditRecord as c, type AuditQuery as d, type CreateAuditTrailOptions as e, type AuditTrail as f, type EventContract as g, type EventContractValidationResult as h, type CreateProjectionRegistryOptions as i, type EventBufferStore as j, type EventBufferRecord as k, type EventBufferStatus as l, type EventBusOptions as m, type EventBus as n, type CreateObservabilityReporterOptions as o, PolicyEngine as p, type ArkManifest as q, type WorkflowSnapshot as r, type SagaDefinition as s, type CreateWorkflowEngineOptions as t, type SagaInstance as u, type WorkflowEngine as v, type DependencyInformationPackage as w, type ArkKernelConfig as x, type CreateArkKernelFromConfigOptions as y, type TraceRecord as z };
+export { ARK_RUN_INSPECTOR_EVENTS_PATH as $, type ArkKernel as A, type OutboxStatus as B, type CreateArkKernelOptions as C, type DefineIntentOptions as D, type EventContractRegistry as E, type OutboxRecord as F, type GraphEdge as G, type ObservabilityDriftReport as H, IntentRegistry as I, ARK_RUN_COMPONENT_LIFETIMES as J, ARK_RUN_EPHEMERAL_DEFAULT as K, ARK_RUN_GRAPH_DEFAULT_SLICE as L, type MetadataRegistry as M, ARK_RUN_GRAPH_NODE_KINDS as N, type ObservabilityReporter as O, type ProjectionRegistry as P, ARK_RUN_GRAPH_PROCESS_EDGE_KINDS as Q, type ReadModelStore as R, type SagaContext as S, type TraceRecordType as T, ARK_RUN_GRAPH_SCHEMA_VERSION as U, ARK_RUN_GRAPH_SLICES as V, type WorkflowStore as W, ARK_RUN_GRAPH_TECHNICAL_EDGE_KINDS as X, ARK_RUN_INFORMATION_PACKAGE_SCHEMA_VERSION as Y, ARK_RUN_INSPECTOR_DEFAULT_HOST as Z, ARK_RUN_INSPECTOR_DEFAULT_PORT as _, type DependencyGraph as a, InvalidArkRunSendOptionError as a$, ARK_RUN_INSPECTOR_GRAPH_PATH as a0, ARK_RUN_INSPECTOR_SCHEMA_VERSION as a1, ARK_RUN_INSPECTOR_SNAPSHOT_PATH as a2, ARK_RUN_INSPECTOR_SSE_EVENT as a3, ARK_RUN_INSPECTOR_TRANSPORT_FALLBACK as a4, ARK_RUN_TRANSPORT_KINDS as a5, type ArkManifestArchitecture as a6, type ArkManifestData as a7, type ArkManifestEntityLink as a8, type ArkManifestGraph as a9, type ArkRunInspectorSnapshotInput as aA, type ArkRunInspectorSource as aB, type ArkRunInspectorTransportFacts as aC, type ArkRunPublisher as aD, type ArkRunRegisterOptions as aE, type ArkRunRegistrationHandle as aF, type ArkRunSendOptions as aG, type ArkRunSendPlan as aH, type ArkRunSendPlanInput as aI, type ArkRunSendResult as aJ, type ArkRunTransportKind as aK, type AuditRecordInput as aL, type AuditRecordType as aM, type EntityMeta as aN, type EventContractIssue as aO, type EventHandler as aP, type EventInterceptionInfo as aQ, type EventInterceptor as aR, type EventInterceptorContext as aS, type EventPayloadPatch as aT, type EventPayloadSchema as aU, type EventPublisher as aV, type EventSchemaField as aW, type EventSchemaFieldType as aX, type FieldMeta as aY, type GraphNode as aZ, InvalidArkRunGraphQueryError as a_, type ArkManifestIntent as aa, type ArkManifestPolicy as ab, type ArkManifestProjection as ac, type ArkRunBrokerAdapter as ad, type ArkRunComponentLifetime as ae, type ArkRunDeliveredVia as af, type ArkRunExtendedInfo as ag, type ArkRunGraph as ah, type ArkRunGraphEdge as ai, type ArkRunGraphEdgeKind as aj, type ArkRunGraphMatch as ak, type ArkRunGraphMatchInput as al, type ArkRunGraphNode as am, type ArkRunGraphNodeKind as an, type ArkRunGraphProcessEdgeKind as ao, type ArkRunGraphQuery as ap, type ArkRunGraphResolvedQuery as aq, type ArkRunGraphSlice as ar, type ArkRunGraphTechnicalEdgeKind as as, type ArkRunInformationPackageComponent as at, type ArkRunInspectorBind as au, ArkRunInspectorBindError as av, type ArkRunInspectorBindInput as aw, type ArkRunInspectorHandle as ax, ArkRunInspectorProductionError as ay, type ArkRunInspectorSnapshot as az, type AuditStore as b, type ObservabilityFlow as b0, type ObservedLayerFlowMode as b1, type OutboxStore as b2, type PolicyEvaluationResult as b3, type ProjectionCheckpoint as b4, type ProjectionDefinition as b5, type PublishedEventRecord as b6, type RetryPolicy as b7, type SagaStatus as b8, type SagaStep as b9, type StartArkRunInspectorOptions as ba, type TraceSink as bb, type Unsubscribe as bc, type WorkflowDefinition as bd, type WorkflowStatus as be, type WorkflowStep as bf, appendDecisionTape as bg, arkRunGraphQueryFromSearchParams as bh, arkRunInspectorUrl as bi, buildArkRunInspectorSnapshot as bj, buildDependencyInformationPackage as bk, closeArkRunGraphQuery as bl, closedArkRunEphemeral as bm, closedArkRunTransportKind as bn, formatArkRunGraphMermaid as bo, formatArkRunInspectorSseEvent as bp, isArkRunInspectorLoopbackHost as bq, isArkRunInspectorProductionEnv as br, requestArkRunGraph as bs, resolveArkRunInspectorBind as bt, resolveArkRunSendPlan as bu, startArkRunInspector as bv, type AuditRecord as c, type AuditQuery as d, type CreateAuditTrailOptions as e, type AuditTrail as f, type EventContract as g, type EventContractValidationResult as h, type CreateProjectionRegistryOptions as i, type EventBufferStore as j, type EventBufferRecord as k, type EventBufferStatus as l, type EventBusOptions as m, type EventBus as n, type CreateObservabilityReporterOptions as o, PolicyEngine as p, type ArkManifest as q, type WorkflowSnapshot as r, type SagaDefinition as s, type CreateWorkflowEngineOptions as t, type SagaInstance as u, type WorkflowEngine as v, type DependencyInformationPackage as w, type ArkKernelConfig as x, type CreateArkKernelFromConfigOptions as y, type TraceRecord as z };

package/docs/README.md

@@ -46,7 +46,7 @@ Product site: [arkgate.online](https://www.arkgate.online/) · npm: [`arkgate`](
 |-----|------------|
 | [CONTRIBUTING.md](../CONTRIBUTING.md) | Setup, rules, PR/release |
 | [ROADMAP.md](../ROADMAP.md) | Live implementation queue (one `doing` at a time). History: [archive/roadmap-history.md](archive/roadmap-history.md) |
-| [adr/](adr/README.md) | Architecture decisions ([0032](adr/0032-writes-via-aggregate-sensor.md) writes-via-aggregate · [0033](adr/0033-arkorder-runtime-half-is-arkrun.md) ArkOrder runtime half) |
+| [adr/](adr/README.md) | Architecture decisions ([0032](adr/0032-writes-via-aggregate-sensor.md) writes-via-aggregate · [0033](adr/0033-arkorder-runtime-half-is-arkrun.md) ArkOrder runtime half · [0034](adr/0034-arkorder-valved-loop.md) valved loop) |
 | [SECURITY.md](../SECURITY.md) · [threat-model.md](threat-model.md) | Security |
 
 ---
@@ -58,13 +58,14 @@ These are **not** the day-to-day product path. They stay in the repo for evidenc
 | Area | Path |
 |------|------|
 | Release notes (by version) | [releases/](releases/) · npm [CHANGELOG.md](../CHANGELOG.md) (Unreleased + 4.6.x) · [pre-4.6 archive](archive/CHANGELOG-pre-4.6.md) |
-| Epic plans | [plans/](plans/) — maintainer seeds, not required to use the package. Live: [alive-in-six-months](plans/alive-in-six-months/README.md) (`AL01`–`AL04` done; `AL05` parked). [arkrun](plans/arkrun/README.md) (Phase RN; `RN01`–`RN17` done; shipped **4.7.0** + companion **4.7.4**; ADRs [0020](adr/0020-arkrun-gated-extra-plane.md)–[0024](adr/0024-arkrun-transport-ports.md) accepted). [one-catalog-one-root](plans/one-catalog-one-root/README.md) (Phase HS; `HS01`–`HS05` done; shipped **4.7.1**). [arkorder](plans/arkorder/README.md) (Phase OR; `OR01`–`OR07` done; shipped **4.8.0**; extra **inside** package `arkgate` as `arkgate/order`; ADRs [0027](adr/0027-arkorder-gated-extra-plane.md)–[0031](adr/0031-one-package-extras-deprecate-companion.md)). [arkorder-arkrun](plans/arkorder-arkrun/README.md) (Phase XP; `XP01`–`XP08` done on tree; **4.8.5** prepared; ADR [0033](adr/0033-arkorder-runtime-half-is-arkrun.md)). |
+| Epic plans | [plans/](plans/) — maintainer seeds, not required to use the package. Live: [alive-in-six-months](plans/alive-in-six-months/README.md) (`AL01`–`AL04` done; `AL05` parked). [arkrun](plans/arkrun/README.md) (Phase RN; `RN01`–`RN17` done; shipped **4.7.0** + companion **4.7.4**; ADRs [0020](adr/0020-arkrun-gated-extra-plane.md)–[0024](adr/0024-arkrun-transport-ports.md) accepted). [one-catalog-one-root](plans/one-catalog-one-root/README.md) (Phase HS; `HS01`–`HS05` done; shipped **4.7.1**). [arkorder](plans/arkorder/README.md) (Phase OR; `OR01`–`OR07` done; shipped **4.8.0**; extra **inside** package `arkgate` as `arkgate/order`; ADRs [0027](adr/0027-arkorder-gated-extra-plane.md)–[0031](adr/0031-one-package-extras-deprecate-companion.md)). [arkorder-arkrun](plans/arkorder-arkrun/README.md) (Phase XP; `XP01`–`XP08` done; shipped **4.8.5**; ADR [0033](adr/0033-arkorder-runtime-half-is-arkrun.md)). [arkorder-valve-loop](plans/arkorder-valve-loop/README.md) (Phase LV; `LV01`–`LV09` done; shipped **4.8.6**; [ADR 0034](adr/0034-arkorder-valved-loop.md); does not close K01). [layer-description-projection](plans/layer-description-projection/README.md) (Phase LD; `LD01`–`LD06` done on tree; **4.8.7** prepared; [ADR 0035](adr/0035-layer-description-projection.md); project `layers[].description`; no schema bump). |
 | Claims audit | [audit/claims-matrix.md](audit/claims-matrix.md) |
 | Field adoption kit (scaffolding, not closed) | [field/](field/) |
 | Runtime hardening (experimental) | [production-hardening.md](production-hardening.md) |
 
-Current tree: [releases/4.8.5.md](releases/4.8.5.md) (`arkgate@4.8.5`, prepared). Current published: [releases/4.8.4.md](releases/4.8.4.md) (`arkgate@4.8.4` on npm `latest`; does not close `K01`).
-Prior: [releases/4.8.3.md](releases/4.8.3.md) · [releases/4.8.2.md](releases/4.8.2.md) · [releases/4.8.1.md](releases/4.8.1.md) · [4.8.0](releases/4.8.0.md) · [4.7.6](releases/4.7.6.md) · [4.7.5](releases/4.7.5.md) · [4.7.4](releases/4.7.4.md) · [4.7.3](releases/4.7.3.md) · [4.7.2](releases/4.7.2.md) · [4.7.1](releases/4.7.1.md) · [4.7.0](releases/4.7.0.md) · [4.6.7](releases/4.6.7.md) · [4.6.6](releases/4.6.6.md) · [4.6.5](releases/4.6.5.md) · [4.6.4](releases/4.6.4.md) · [4.6.3](releases/4.6.3.md) · [4.6.2](releases/4.6.2.md) · [4.6.1](releases/4.6.1.md) · [4.6.0](releases/4.6.0.md).
+Current published: [releases/4.8.6.md](releases/4.8.6.md) (`arkgate@4.8.6` on npm `latest`; does not close `K01`).
+Tree: [releases/4.8.7.md](releases/4.8.7.md) (`arkgate@4.8.7` prepared).
+Prior: [releases/4.8.5.md](releases/4.8.5.md) · [releases/4.8.4.md](releases/4.8.4.md) · [releases/4.8.3.md](releases/4.8.3.md) · [releases/4.8.2.md](releases/4.8.2.md) · [releases/4.8.1.md](releases/4.8.1.md) · [4.8.0](releases/4.8.0.md) · [4.7.6](releases/4.7.6.md) · [4.7.5](releases/4.7.5.md) · [4.7.4](releases/4.7.4.md) · [4.7.3](releases/4.7.3.md) · [4.7.2](releases/4.7.2.md) · [4.7.1](releases/4.7.1.md) · [4.7.0](releases/4.7.0.md) · [4.6.7](releases/4.6.7.md) · [4.6.6](releases/4.6.6.md) · [4.6.5](releases/4.6.5.md) · [4.6.4](releases/4.6.4.md) · [4.6.3](releases/4.6.3.md) · [4.6.2](releases/4.6.2.md) · [4.6.1](releases/4.6.1.md) · [4.6.0](releases/4.6.0.md).
 Older notes: [releases/](releases/). Config: [configuration.md](configuration.md).
 
 ---

package/docs/agent-guide.md

@@ -507,6 +507,8 @@ npx ark-check --promote <ruleId> --apply      # write mode "enforced" into that
 **`--sensors`** lists every sensor ArkGate ships — ArkRules, ArkRun and
 ArkOrder — with its plane, its tier and whether it can *ever* be enforced, so
 Tier-2 shows up before you write the rule rather than after you wait for a run.
+ArkOrder: `proposeRelease` then `apply`; `refreshSigma`; ingest residual;
+capacity pack; `ReleaseStore`; ArkRun `decisionTape`. No `/ark-order` skill.
 It also says *how*: only the ArkRules plane is promoted per rule; ArkRun and
 ArkOrder are switched by the plane-level `arkRun.mode` / `arkOrder.mode`, and
 `--promote --apply` writes ArkRules documents only.

package/docs/ai-gates.md

@@ -33,8 +33,11 @@ Prefer fail-closed honesty over fake hard guarantees on advisory hosts.
 Everything below uses the same `ark.config.json` as `arkgate-check` / `ark-check` (CI) — one
 rules file shared by every surface. From **4.0**, optional **ArkRules** (`arkRules` map +
 `arkrules/*.json`) ride the **same** write path, doctor, and CI adapter; absence of ArkRules
-does not change inter-layer verdicts. Label residual **`[Layer]`** vs **`[ArkRules]`**. See
-[configuration — ArkRules](configuration.md#arkrules-intra-layer-opt-in).
+does not change inter-layer verdicts. Optional ArkRun / ArkOrder extras ride that envelope
+when on (`proposeRelease` then `apply`). Absence is silent. Label residual **`[Layer]`** vs
+**`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**. See
+[configuration — ArkRules](configuration.md#arkrules-intra-layer-opt-in) ·
+[ArkOrder](arkorder.md).
 
 Generate the layer contract once:
 

package/docs/arkorder.md

@@ -8,12 +8,13 @@ Import: `arkgate/order` (same npm package `arkgate`). Off until you add
 `arkOrder` on schema `1.3`. Absence is silent. In-memory. Not durable. It is
 a library plus sensors, not a service. Does **not** replace ArkRun.
 
-First-contact copy: freeze / four verbs / no `update`. Haken (ξ vs s) lives
-below.
+First-contact copy: freeze through a valve / no `update`. Haken (ξ vs s) lives
+below. **ArkOrder freezes the pattern through a valve. ArkRun is how the residual travels.**
 
 Canonical plan seed: [plans/arkorder/README.md](plans/arkorder/README.md).
 ADRs: [0027](adr/0027-arkorder-gated-extra-plane.md)–[0030](adr/0030-opt-in-extras-same-npm-package.md),
-[0033](adr/0033-arkorder-runtime-half-is-arkrun.md) (runtime half is ArkRun).
+[0033](adr/0033-arkorder-runtime-half-is-arkrun.md) (runtime half is ArkRun),
+[0034](adr/0034-arkorder-valved-loop.md) (valved loop; public verbs in 4.8.6).
 Config: [configuration.md](configuration.md). Surface:
 [package-surface.md](package-surface.md#experimental-opt-in-surfaces).
 
@@ -24,7 +25,7 @@ Config: [configuration.md](configuration.md). Surface:
 | Is | Is not |
 |----|--------|
 | A **library** (`createOrderPlane`) plus **static sensors** | A running service, daemon, or hosted plane |
-| Four verbs: `release` / `project` / `ingest` / `proposeRelease` | A generic `update` / `patch` / `set` |
+| Valved verbs: `release` / `project` / `ingest` / `proposeRelease` / `apply` / `refreshSigma` | A generic `update` / `patch` / `set` |
 | Opt-in extra on `ark.config.json` | Always-on; compact starters leave it off |
 | Consumer-named slow keys (`xiKeys`) | A construction OS, BIM, or FirmPack |
 | Same npm tarball | not `@arkgate/order` |
@@ -49,10 +50,10 @@ They already exist:
 
 | Ask | API | Since |
 |-----|-----|-------|
-| Escalation as a first-class concept | `IngestResult = IngestAbsorb \| IngestEscalate` (`kind`, `reason`) | 4.8.0 |
+| Escalation as a first-class concept | `IngestResult` residual `absorb \| escalate_up \| hold` (`reasonCode`, `IngestEscalate.target`) | 4.8.0 / 4.8.6 |
 | Projection at the boundary | `Projector = (release, sigma) => Projection` | 4.8.0 |
 | Cap on badly designed slow parameters | `DEFAULT_MAX_XI_KEYS = 7`, `maxXiKeys`, `ARKORDER_TOO_MANY_PARAMS`, `ARKORDER_EMPTY_XI`, `ARKORDER_NESTED_XI` | 4.8.0 |
-| Valved proposals, never direct mutation | `ProposeResult { nextXi, blastRadius, invalidations }` | 4.8.0 |
+| Valved proposals, never direct mutation | `ProposeResult` then `apply` (`ARKORDER_UNVALVED_RELEASE`) | 4.8.0 / 4.8.6 |
 | Typed cell schema | `XiSchema` / `XiPropertySchema` | 4.8.0 |
 | Named slow keys on the write path | `arkOrder.xiKeys`; `ARKORDER_XI_FIELD_WRITE` | 4.8.3 |
 | Factory isolation | `createOrderPlane` from `arkgate/order` only | 4.8.0 |
@@ -60,13 +61,20 @@ They already exist:
 | σ freshness, never ξ | `sigmaMaxAgeMs` / `σ.freshUntil`; `ARKORDER_XI_TTL`, `ARKORDER_STALE_SIGMA` | 4.8.5 |
 | Escalate to a person | `IngestEscalate.target` including `human` | 4.8.5 |
 | Shadow / replay / compare | ArkRun `shadowInformationPackage` / `compareInformationPackages` / `replayInformationPackages` | 4.8.5 |
+| Decision tape | ArkRun information package `decisionTape` `{ xiHash, event, residual }` | 4.8.6 |
+| σ vs ξ identity | `xiHash` / `sigmaHash` / `refreshSigma` | 4.8.6 |
+| Capacity as data | `ConstraintPack.capacity` (`kind` / `sigmaKey` / `payloadKey` / `op`) | 4.8.6 |
+| Store port | `ReleaseStore` / `createMemoryReleaseStore` in-memory default — not durable, not K01 | 4.8.6 |
+| Thin travel helper | `ingestTravelAction` absorb→`send` / escalate_up human→`raises` | 4.8.6 |
 
 Nothing here is a hosted runtime. Nothing here can be “down”. A degraded-mode
 contract would defend against an outage that cannot happen.
 
 ---
 
-## Four verbs
+## Valved loop
+
+**ArkOrder freezes the pattern through a valve. ArkRun is how the residual travels.**
 
 ```ts
 import { createOrderPlane } from 'arkgate/order';
@@ -76,26 +84,32 @@ const plane = createOrderPlane({
   xiSchema,           // JSON Schema object; additionalProperties false
   maxXiKeys,          // default 7
   clocks,             // injected; Domain must not call Date.now
-  packs,              // data, not user predicates
+  packs,              // data, not user predicates (capacity is kind/sigmaKey/payloadKey/op)
   informationBudget,  // optional { cannotObserve: ['ledger'] } — not a config key
   sigmaMaxAgeMs,      // optional σ freshness; never on ξ — not a config key
+  store,              // optional ReleaseStore; default in-memory is not durable
+  catalogDigest,      // optional; keyed by ξ.catalogReleaseId — SKU set does not enter the hash
 });
 
-plane.release(xi, sigma);      // freeze, version, hash. No in-place mutate
+plane.release(xi, sigma);      // first freeze only
 plane.project();               // derive allowed s + invalidations
-plane.ingest(event);           // absorb or escalate. Never returns a Release
+plane.ingest(event);           // residual absorb | escalate_up | hold. Never a Release
 plane.proposeRelease(delta);   // blast radius. Empty blast = domain error
+plane.apply(proposal);         // valve: later ξ change
+plane.refreshSigma(sigma);     // saldo / clocks; xiHash unchanged
 ```
 
 There is no `update()`. Calling `update` / `patch` / `set` on the plane throws
 `ARKORDER_FORBIDDEN_METHOD` and, on the write path, emits
-`ARKORDER_GENERIC_UPDATE`.
+`ARKORDER_GENERIC_UPDATE`. A second `release()` whose ξ differs fails
+`ARKORDER_UNVALVED_RELEASE`.
 
 | Field write | Verb |
 |-------------|------|
-| Invoice, seat within cap, timesheet, daily log | `ingest` → absorb |
-| Over cap / invariant pressure | `ingest` → escalate |
-| Change plan / protocol / cost-code bound | `proposeRelease` then `release` |
+| Invoice, seat within cap, timesheet, daily log | `ingest` → absorb (`ingestTravelAction` may `send`) |
+| Over cap (capacity pack) / stale σ | `ingest` → hold |
+| Kind not in h(ξ) | `ingest` → escalate_up (`target: human`; `ingestTravelAction` may `raises`) |
+| Change plan / protocol / cost-code bound | `proposeRelease` then `apply` |
 | PATCH the slow key through Prisma/Drizzle | `ARKORDER_XI_FIELD_WRITE` |
 
 Copy [examples/arkorder-billing/](../examples/arkorder-billing/) and rename the
@@ -199,6 +213,10 @@ Durability (`K01`) stays parked. In-memory is the honesty line.
 
 If a “slow parameter” changes with every click, it is not an order parameter.
 
+The valved loop ships in **4.8.6** ([ADR 0034](adr/0034-arkorder-valved-loop.md)).
+In-memory `ReleaseStore` is **not** durable. Doctor / status `arkOrder` stays
+`notAScore`. This does **not** close `K01` / `Z09`. No `/ark-order` skill.
+
 ---
 
 ## Next step

package/docs/configuration.md

@@ -131,8 +131,10 @@ Top-level fields:
   `enforced` mode fails closed (`ARKORDER_MISSING_PLANE`). `xiKeys` are the 3–5 slow
   names the product already knows (plan, protocol, cost-code bound). Empty `xiKeys`
   leaves `ARKORDER_XI_FIELD_WRITE` silent. Membership ids are not keys. Factory options
-  `informationBudget` and `sigmaMaxAgeMs` belong on `createOrderPlane`, not this extra
-  object. Demotion or deletion is a policy-delta **weakening**. Field ingest never mints
+  `informationBudget`, `sigmaMaxAgeMs`, `store` (`ReleaseStore`), and capacity packs
+  belong on `createOrderPlane`, not this extra object. Later ξ is `proposeRelease`
+  then `apply`; `refreshSigma`; ingest residual `absorb | escalate_up | hold`.
+  Demotion or deletion is a policy-delta **weakening**. Field ingest never mints
   a pattern.
 
 **Activation is one shape.** ArkRun and ArkOrder both use `mode` + `managedLayers`.
@@ -142,7 +144,28 @@ name different factories: `arkRun.kernelRoots` (`compositionRoots` alias) vs
 
 Layer fields:
 
-- `name`, `patterns`, `exclude`, `description`
+- `name`, `patterns`, `exclude`
+- **`layers[].description`** (optional) — **app-context caption**: one product sentence for what
+  this folder is *in the app*, not architecture jargon. `/ark-place` prints it next to
+  the layer name and globs; doctor, coverage, and the HTML report show the same text.
+  Changing the sentence does **not** change `policyHash` (same strip as `stewards`) and
+  does **not** need a weakening ack. Absence is silent: never fails `--strict-config`,
+  never invents a doctor residual, never flips `valid`. Empty string is invalid JSON for
+  the field (`minLength: 1`). Compact starters may omit it. `/ark-adopt` writes it when
+  the product map or glossary names the house; it does not invent captions. No
+  `/ark-describe`.
+
+```json
+"layers": [
+  {
+    "name": "Application",
+    "patterns": ["src/application/**"],
+    "description": "Purchase requests — from asked to received."
+  }
+]
+```
+
+That sentence is product copy. Not “Rich domain model, business rules, and domain events.”
 - `intentPrefixes`, `forbiddenGlobals`, `mayImportInfrastructure`, `optional`
 - `reserved` / `allowEmpty` — future houses whose globs match nothing yet. `--strict-config` does not fail; `CONFIG_LAYER_PATTERN_NO_MATCHES` (typo warning) is skipped. A typo warning fires only when the glob is not reserved.
 - `capabilities: { deny: [...] }` — opt-in effect walls over the seven capability ids
@@ -246,7 +269,7 @@ See [brownfield adoption](brownfield-adoption.md#nextjs-honesty-default-overlays
 | **Structure sensors** | Intra-layer heuristics | Only `mode: "enforced"` |
 | **Invariants** | Catalog + coverage evidence (not a business runtime) | Only enforced + proven-uncovered |
 | **ArkRun** (opt-in extra) | Kernel usage + complete declarations | Only `arkRun.mode: "enforced"` when classified |
-| **ArkOrder** (opt-in extra) | Frozen pattern + four verbs (no `update`) | Only `arkOrder.mode: "enforced"` when classified |
+| **ArkOrder** (opt-in extra) | Frozen pattern; first freeze `release()`, later ξ is `proposeRelease` then `apply` (no `update`) | Only `arkOrder.mode: "enforced"` when classified |
 
 Absence of `arkRules`, `arkRun`, or `arkOrder` adds **no** extra merge teeth. **Advisory** structure sensors, advisory
 invariants, advisory ArkRun, and advisory ArkOrder also add **no** merge teeth (FG-ARKRULES-ADVISORY-ONLY / ADR 0020 / ADR 0027) — packing every starter
@@ -351,7 +374,7 @@ changing either contract changes its hash and invalidates the acknowledgement.
 
 Optional `stewards` lists **GitHub handles or emails** who may **loosen** the contract or
 **grow** the baseline (`pedroknigge` or `pedroknigge@users.noreply.github.com` — not
-`Pedro Knigge`). The field is metadata — it does not change the policy hash. The lock
+`Pedro Knigge`). The field is metadata — it does not change the policy hash. `layers[].description` is stripped the same way (caption-only edits do not change `policyHash` and do not need a weakening ack; `contractHash` still fingerprints the raw config). The lock
 matches `--author`, then `GITHUB_ACTOR` / `ARK_STEWARD`, then `GIT_AUTHOR_EMAIL`. A
 noreply GitHub mail and the handle are the same person. Git `user.name` is not identity.
 

package/docs/develop.md

@@ -202,9 +202,14 @@ The plane is `arkgate/order` in package `arkgate`, not a second install.
 stays plane-free. Empty `planeRoots` in `enforced` mode fails closed
 (`ARKORDER_MISSING_PLANE`). In-memory. Not durable. Does not replace ArkRun.
 
+First freeze is `release()`. Later pattern change is `proposeRelease` then
+`apply` (`ARKORDER_UNVALVED_RELEASE`). `refreshSigma`; ingest residual
+`absorb | escalate_up | hold` + `reasonCode`; capacity pack as data;
+`createMemoryReleaseStore`; `ingestTravelAction`; ArkRun `decisionTape`.
+
 Copy [examples/arkorder-billing/](../examples/arkorder-billing/) (`plan` / `cycle` /
-`tenancy`) and rename the keys. Posting an invoice is absorbed; changing plan is a
-new release. See [configuration.md](configuration.md) and
+`tenancy`) and rename the keys. Posting an invoice is absorbed; changing plan is
+`proposeRelease` then `apply`. See [configuration.md](configuration.md) and
 [package-surface.md](package-surface.md).
 
 ---

package/docs/diagnostics.md

@@ -57,6 +57,7 @@ Link form for agents: `docs/diagnostics.md#RULE_ID` (exact-case HTML anchors bel
 | [`ARKORDER_GENERIC_UPDATE`](#ARKORDER_GENERIC_UPDATE) | arkorder | Generic update of ξ |
 | [`ARKORDER_TOO_MANY_PARAMS`](#ARKORDER_TOO_MANY_PARAMS) | arkorder | Too many slow keys |
 | [`ARKORDER_INGEST_WRITES_XI`](#ARKORDER_INGEST_WRITES_XI) | arkorder | ingest assigned into ξ |
+| [`ARKORDER_UNVALVED_RELEASE`](#ARKORDER_UNVALVED_RELEASE) | arkorder | Unvalved second freeze of ξ |
 | [`INVALID_CHANGE_PATH`](#INVALID_CHANGE_PATH) | preflight | Unsafe change path |
 | [`DUPLICATE_CHANGE_PATH`](#DUPLICATE_CHANGE_PATH) | preflight | Duplicate path in change set |
 | [`DELETE_TARGET_MISSING`](#DELETE_TARGET_MISSING) | preflight | Delete target missing |
@@ -395,7 +396,7 @@ Haken slaving: few slow keys (ξ) determine derived fast state. Field ingest nev
 **Generic update of ξ**
 
 - **Why:** A call to update/patch/set on the order plane rewrites the slow pattern. Haken slaving forbids generic ξ mutation.
-- **Fix:** Use release() to freeze ξ or proposeRelease() for a pattern change with blast radius, then preflight again. Never mechanical-safe.
+- **Fix:** Use release() for the first freeze of ξ. Later pattern change is proposeRelease then apply(ProposeResult). Never update/patch/set. Never mechanical-safe.
 
 <a id="ARKORDER_TOO_MANY_PARAMS"></a>
 
@@ -412,8 +413,8 @@ Haken slaving: few slow keys (ξ) determine derived fast state. Field ingest nev
 
 **ingest assigned into ξ**
 
-- **Why:** An ingest() result is written into a Release or ξ store. ingest may absorb or escalate; it never mints a pattern.
-- **Fix:** Keep ingest results as absorb/escalate only. Change ξ with proposeRelease + release. Never mechanical-safe.
+- **Why:** An ingest() result is written into a Release or ξ store. ingest may absorb, escalate_up, or hold; it never mints a pattern.
+- **Fix:** Keep ingest results as absorb/escalate_up/hold only. Change ξ with proposeRelease then apply(ProposeResult). Never mechanical-safe.
 
 <a id="ARKORDER_XI_FIELD_WRITE"></a>
 
@@ -422,7 +423,7 @@ Haken slaving: few slow keys (ξ) determine derived fast state. Field ingest nev
 **Slow key written around the order plane**
 
 - **Why:** A managed-layer file imports a persistence driver and writes a declared arkOrder.xiKeys name. Field events absorb or escalate; they do not PATCH the slow pattern.
-- **Fix:** Keep invoices, seats, hours, and logs on ingest. Change the slow key with proposeRelease + release, then preflight again. Never mechanical-safe.
+- **Fix:** Keep invoices, seats, hours, and logs on ingest. Change the slow key with proposeRelease then apply(ProposeResult), then preflight again. Never mechanical-safe.
 
 <a id="ARKORDER_INFORMATION_BUDGET"></a>
 
@@ -449,7 +450,16 @@ Haken slaving: few slow keys (ξ) determine derived fast state. Field ingest nev
 **σ is stale**
 
 - **Why:** ingest ran after σ.freshUntil (or sigmaMaxAgeMs). ξ does not TTL.
-- **Fix:** Refresh σ and ingest again, or freeze a new release if the pattern changed. Never mechanical-safe.
+- **Fix:** Call refreshSigma and ingest again, or proposeRelease then apply(ProposeResult) if the pattern changed. Never mechanical-safe.
+
+<a id="ARKORDER_UNVALVED_RELEASE"></a>
+
+### `ARKORDER_UNVALVED_RELEASE`
+
+**Unvalved second freeze of ξ**
+
+- **Why:** release() ran after a pattern was already frozen and the new ξ differs. First freeze is release(); later pattern change is proposeRelease then apply.
+- **Fix:** Change ξ with proposeRelease then apply(ProposeResult). release() is only the first freeze. Never mechanical-safe.
 
 ## Atomic preflight and change sets
 

package/docs/package-surface.md

@@ -51,14 +51,15 @@ hardening guide remains repository-hosted rather than duplicated in the gate tar
 | **Report parity and snapshot evidence (4.2)** | `ark-check --report` → advisory sections (`data-advisory="contractHealth\|ambientState\|parseHealth\|arkRun"`, nested `governanceWeight`) + layer wall badges; `.ark/reports/*.json` | The report is a rendering of doctor truth. **Standing rule:** every doctor advisory ships with its report section — enforced by the `reportParity` guard, which enumerates the doctor's advisory keys and fails on any missing section. Snapshots add best-effort Git `HEAD`/branch/dirty provenance without a shell; unavailable Git is explicit. Evolution renders the Ark score delta only when both snapshots name the same ArkGate version, while retaining raw facts across versions. Thin `arkRun` on `latest.json` is `notAScore` residual honesty for `ark status`. |
 | **MCP project identity (4.2)** | `ark_identity`; `arkgate/schema/project-identity` or `arkgate/schema/ark.project-identity.schema.json`; root API constants/helpers/types | Schema `1.0`. `projectId` hashes canonical root + config path and stays stable across contract edits/restarts; runtime id/start time are separate. Every project-bound tool result and error carries `projectIdentity`, `binding` (`matched` / `unverified` / `mismatch`), and `authoritative`. Canonical out-of-root config/file evidence fails before project data. |
 | **MCP tools and compatibility resource** | `arkgate-mcp`; `ark_manifest`; `ark_status`; `ark://manifest` | Tool names and primary argument shapes are stable within a major. Every tool accepts additive `project.expectedRoot` / optional `expectedProjectId`. The initial handshake requires the exact project root; a contained descendant is authoritative only together with the matching project id. Legacy tool calls remain callable but `unverified` and non-authoritative. `ark_manifest` is the authoritative contract surface after binding. **`ark_status`** returns the status manifest envelope (parity with `ark status --json`). Standard `resources/read` cannot portably carry the expectation, so `ark://manifest` remains compatibility-only and always unverified/non-authoritative. The server never retargets from input. |
-| **`ark.config.json`** | Layer globs, rules, include/exclude, forbiddenGlobals, intent prefixes, `peerIsolation`, `dynamicImportAllowlist`, `safety` thresholds; optional **`coverage`** controls (`testGlobs`, `maxFiles`); optional **`arkRules`** map (schema `1.1+`); optional **`arkRun`** extra (schema `1.2+`); optional **`arkOrder`** extra (schema `1.3+`) | Versioned by `schemaVersion`; unknown fields fail closed and migrations preserve the previous supported major. Absence of `coverage`, `arkRules`, `arkRun`, or `arkOrder` is byte-for-byte silent on Layers / ArkRules verdicts. Enforced extra teeth share the CLI / MCP / hook / preflight / CI verdict and arm only when the layer plane is classified (same ArkRules floor). |
+| **`ark.config.json`** | Layer globs, optional `layers[].description`, rules, include/exclude, forbiddenGlobals, intent prefixes, `peerIsolation`, `dynamicImportAllowlist`, `safety` thresholds; optional **`coverage`** controls (`testGlobs`, `maxFiles`); optional **`arkRules`** map (schema `1.1+`); optional **`arkRun`** extra (schema `1.2+`); optional **`arkOrder`** extra (schema `1.3+`) | Versioned by `schemaVersion`; unknown fields fail closed and migrations preserve the previous supported major. Absence of `coverage`, `arkRules`, `arkRun`, or `arkOrder` is byte-for-byte silent on Layers / ArkRules verdicts. Enforced extra teeth share the CLI / MCP / hook / preflight / CI verdict and arm only when the layer plane is classified (same ArkRules floor). |
+| **Layer caption (`layers[].description`, 4.8.7)** | Optional string on each layer. Projected onto `ark_place` / prepare-write / MCP place JSON, doctor JSON + human, coverage JSON, and the HTML Purpose column when present. `/ark-adopt` writes it from the product map or glossary; `/ark-place` prints it next to layer name + globs. | Existing optional field — **no `schemaVersion` bump**, no new key, no 14th skill. Copy is **app context** (a product sentence such as `Purchase requests — from asked to received.`), not architecture jargon. Stripped from `policyHash` like `stewards`; caption-only edits are neutral. Absence is silent: never a residual, never a score, never `--strict-config` fail, never flips `valid`. Compact starters may omit. |
 | **ArkRules inventory / under-contract (4.0; layer context 4.2)** | `ark-check --rules-inventory [--json]`; doctor `rulesUnderContract`; MCP `ark_rules_inventory` | Additive. Honest counts (inventoried / under-contract / frozen) — **never a score**. When configured layer evidence exists it overrides filename role guesses: a Domain file named `handler` is not a controller candidate. Test/fixture/seed/migration/exclusion surfaces plus narrow development-identity, PostgreSQL OID, and technical I/O constants are silent. Without layer evidence, backward-compatible path/content heuristics remain. Structure/invariant diagnostics use adapter `1.4` provenance. |
 | **`arkgate/schema/project-identity`** or **`arkgate/schema/ark.project-identity.schema.json`** | MCP canonical project, contract, runtime, expectation, and binding envelope | Schema `1.0`. Initial `expectedRoot` must be the exact project root. A contained descendant can match only when `expectedProjectId` is also present and correct; id-only matching stays non-authoritative. Mismatch codes are `PROJECT_ROOT_MISMATCH`, `PROJECT_ID_MISMATCH`, and `INVALID_PROJECT_EXPECTATION`. |
 | **Package pin dual-truth (4.0)** | doctor JSON `packageVersionTruth`; upgrade JSON/human note when pin behind CLI | Additive, advisory. Surfaces after `upgrade --no-install` when managed CLI is ahead of package.json. |
 | **Managed upgrade self-service honesty (4.5 / DF05)** | `ark upgrade [--json]` → `selfService` (+ human “Self-service honesty” lines) | Additive, advisory. Answers without a maintainer: write-path activation labels per selected host (`hard`\|`advisory`\|`unavailable`) and customized content-identity preserve (`customizedPaths` / `customizedContentPreserved`). Soft hosts never hard; upgrade never invents `hardWriteActive` from disk alone. Always `notAScore: true`. Not a gate input; not part of `planDigest`. |
 | **Product honesty readiness split (4.1.1)** | doctor JSON `productHonesty` | Additive. `unfinished` / `headline` / `primaryNextAction` / `reasonIds` remain; EH adds `contractReadiness` (`ready`\|`partial`\|`not-ready`), `localWriteBoundary` (`advisory`\|`hard`\|`unverified`\|`unknown`), `architectureReasonIds`, `environmentResidualIds` / `environmentResiduals`. Soft-write hosts stay in evidence without alone forcing global **Not finished**. `notAScore: true` always. |
 | **Policy transition analysis (3.1.0)** | `analyzePolicyDelta(...)`; MCP `ark_policy_delta`; CLI `--policy-base` / `--policy-base-ref` / `--policy-ack`; check JSON `policyDelta` | Additive schema `1.0`. Classifications and finding ids are deterministic. Weakening/judgment requires an acknowledgement bound to both policy hashes and the exact blocking finding set. |
-| **Team parliament (law vs feature)** | Optional `stewards` on `ark.config.json` (GitHub handle or email); CLI `--changed` / `--against` / `--base` / `--contract-diff` / `--contract-session` / `--persona` / `--author`; check JSON `teamParliament`; `ark status --vs`; write-gate mixed-batch deny | Additive. Law files must not mix with product source. Loosen / baseline-grow are steward-only when `stewards` is set. `--against` ratchets vs the base-ref baseline. `--changed` scans touched sources. `stewards` is excluded from policy hash. Identity is handle or email, not git `user.name`. No org plane. |
+| **Team parliament (law vs feature)** | Optional `stewards` on `ark.config.json` (GitHub handle or email); CLI `--changed` / `--against` / `--base` / `--contract-diff` / `--contract-session` / `--persona` / `--author`; check JSON `teamParliament`; `ark status --vs`; write-gate mixed-batch deny | Additive. Law files must not mix with product source. Loosen / baseline-grow are steward-only when `stewards` is set. `--against` ratchets vs the base-ref baseline. `--changed` scans touched sources. `stewards` and `layers[].description` are excluded from policy hash. Identity is handle or email, not git `user.name`. No org plane. |
 | **Atomic change preflight (3.1.0)** | `preflightChange(...)`; CLI `ark preflight --changes <file> --json`; MCP `ark_prepare_change` | Additive schema `1.0`. One complete governed production-source `{path,content}` / `{path,delete:true}` batch; read-only; returns operation, content/tree/policy/compiler fingerprints and stable graph findings. MCP availability alone is advisory. |
 | **Architecture change map (3.1.0)** | `arkgate/schema/change-map` or `arkgate/schema/ark.change-map.schema.json`; CLI `ark preflight --change-map <file>`; MCP `ark_prepare_change.changeMap` | Optional strict schema `1.0`. Canonical planned paths + operations + resolved Ark layers + dependencies between planned files. Preflight returns `changeMapHash`; absence is normal and adds no project file. Structural intent only, never behavioral completion. |
 | **Structural convergence (3.1.0)** | `analyzeArchitectureConvergence(...)`; map-enabled `preflightChange(...)`; existing CLI/MCP preflight adapters | Additive `convergence` result with stable `satisfied`, `missing`, `contradictory`, and `unplanned` findings. Uses the supplied/current project tree as base and the explicit complete change set as candidate; no implicit Git or LLM input. `readOnly: true`; `behavioralCompletion: "not-evaluated"`. Structural mismatch makes preflight invalid. |
@@ -161,21 +162,24 @@ The type-only root exports are also semver-supported:
 - Config contract: `ArkConfig`, `ArkConfigLoadResult`.
 
 Runtime-kernel factories, `CAPABILITY_IDS`, `collectCapabilityUses`, and Domain capability mapping
-helpers are deliberately absent from this root. Use `@arkgate/runtime` for the experimental
-**ArkRun** kernel, and `analyzeProject(...).ir.capabilityUses` for public capability evidence.
+helpers are deliberately absent from this root. Use `arkgate/runtime` for the
+**ArkRun** kernel (experimental here means **durability**: in-memory stores, not
+Postgres), and `analyzeProject(...).ir.capabilityUses` for public capability evidence.
 
 ---
 
 ## Experimental opt-in surfaces
 
-These APIs are implemented for evaluation and compatibility, but they are **not production-ready
-product claims**. Static architecture enforcement does not depend on them.
+**Experimental** names **durability** (in-memory stores, not Postgres) — not the extras
+themselves. ArkRun and ArkOrder are opt-in extras of package `arkgate`. These APIs are
+implemented for evaluation and compatibility; they are **not** production durability
+claims. Static architecture enforcement does not depend on them.
 
 | Surface | Import path | Notes |
 |---------|-------------|--------|
-| **ArkRun kernel** | **`arkgate/runtime`** | Public brand **ArkRun**. Same npm package `arkgate` (ADR 0031). Factory `createStrictArkKernel` (each call is an isolated instance; no process-wide `getKernel()` singleton). Root export does **not** include the factory. Optional extra `arkRun` on schema `1.2+`. Event bus, intents, policies, sagas, event buffer, projections, and strict helpers. Managed components declare `uses` / `reactsTo` / `raises` / `sends` on `register()`; `getDependencyInformationPackage()` is a JSON snapshot of ids, lifetime, and declarations and never includes factories, live instances, or input DTOs (ADR 0023). `requestGraph()` slices that snapshot into **process** or **technical** graphs with optional `nodeIds`, `degreesOfSeparation`, and include/exclude query; `formatArkRunGraphMermaid()` (also `graph.mermaid`) is a helper string, never a score. `send()` is the transport port (local / localBlocking / broker); missing broker falls back to in-process local delivery, `ephemeral` defaults true, and **no cloud SDKs ship** in the package (ADR 0024). Opt-in `startInspector()` / `startArkRunInspector()` binds **`127.0.0.1` only**, refuses `NODE_ENV=production`, lazy-loads HTTP, and serves JSON snapshots, SSE, and `/graph` slices of the information package (no public / authless bind). **Shadow / replay / compare** (`shadowInformationPackage`, `compareInformationPackages`, `replayInformationPackages`) are in-memory helpers on that snapshot — not durable, not a second bus (ADR 0033). Built-in stores are **InMemory reference only**. Branding ArkRun is not a production-durability claim. **`@arkgate/runtime` is deprecated** leftover 0.x (`experimental` dist-tag). |
+| **ArkRun kernel** | **`arkgate/runtime`** | Public brand **ArkRun**. Same npm package `arkgate` (ADR 0031). Factory `createStrictArkKernel` (each call is an isolated instance; no process-wide `getKernel()` singleton). Root export does **not** include the factory. Optional extra `arkRun` on schema `1.2+`. Event bus, intents, policies, sagas, event buffer, projections, and strict helpers. Managed components declare `uses` / `reactsTo` / `raises` / `sends` on `register()`; `getDependencyInformationPackage()` is a JSON snapshot of ids, lifetime, and declarations and never includes factories, live instances, or input DTOs (ADR 0023). `requestGraph()` slices that snapshot into **process** or **technical** graphs with optional `nodeIds`, `degreesOfSeparation`, and include/exclude query; `formatArkRunGraphMermaid()` (also `graph.mermaid`) is a helper string, never a score. `send()` is the transport port (local / localBlocking / broker); missing broker falls back to in-process local delivery, `ephemeral` defaults true, and **no cloud SDKs ship** in the package (ADR 0024). Opt-in `startInspector()` / `startArkRunInspector()` binds **`127.0.0.1` only**, refuses `NODE_ENV=production`, lazy-loads HTTP, and serves JSON snapshots, SSE, and `/graph` slices of the information package (no public / authless bind). **Shadow / replay / compare** (`shadowInformationPackage`, `compareInformationPackages`, `replayInformationPackages`) are in-memory helpers on that snapshot — not durable, not a second bus (ADR 0033). **Decision tape** `decisionTape` `{ xiHash, event, residual }` via `appendDecisionTape` (ADR 0034). Built-in stores are **InMemory reference only**. Branding ArkRun is not a production-durability claim. **`@arkgate/runtime` is deprecated** leftover 0.x (`experimental` dist-tag). |
 | **NestJS adapter** | **`arkgate/nestjs`** | Experimental optional peer `@nestjs/common` for the ArkRun kernel. Same npm package. `@arkgate/runtime/nestjs` is deprecated. |
-| **ArkOrder plane** | **`arkgate/order`** | Public brand **ArkOrder**. Same npm package `arkgate` (ADR 0030) — not `@arkgate/order`. Factory `createOrderPlane`. Four verbs: `release` / `project` / `ingest` / `proposeRelease`. No `update`. Haken: few slow keys; ingest never mints a pattern; empty blast fails closed. Factory options (not config keys): `informationBudget.cannotObserve`, `sigmaMaxAgeMs` (freshness on σ, never ξ). `IngestEscalate.target` includes `human`. Root `arkgate` export does **not** include the factory. Optional extra `arkOrder` on schema `1.3`. In-memory; not durable. Does not replace ArkRun. Runtime half (shadow/replay/compare) is ArkRun (ADR 0033). Canonical: [ArkOrder](arkorder.md). |
+| **ArkOrder plane** | **`arkgate/order`** | Public brand **ArkOrder**. Same npm package `arkgate` (ADR 0030) — not `@arkgate/order`. Factory `createOrderPlane`. Valved verbs: `release` / `project` / `ingest` / `proposeRelease` / `apply` / `refreshSigma`. No `update`. First freeze is `release()`; later ξ change is `apply` (`ARKORDER_UNVALVED_RELEASE`). Haken: few slow keys; ingest residual `absorb | escalate_up | hold` + closed `reasonCode`; empty blast fails closed. Capacity pack as data (`kind` / `sigmaKey` / `payloadKey` / `op`). Factory options (not config keys): `informationBudget.cannotObserve`, `sigmaMaxAgeMs`, `store` (`ReleaseStore` / `createMemoryReleaseStore`), `catalogDigest`. Thin travel: `ingestTravelAction` absorb→`send` / escalate_up human→`raises`. `IngestEscalate.target` includes `human`. Root `arkgate` export does **not** include the factory. Optional extra `arkOrder` on schema `1.3`. In-memory; not durable; does not close K01. Does not replace ArkRun. Runtime half (shadow/replay/compare + `decisionTape` / `appendDecisionTape`) is ArkRun (ADR 0033 / 0034). Canonical: [ArkOrder](arkorder.md). |
 
 ---
 
@@ -241,16 +245,18 @@ production deployment would need to satisfy; it is not a readiness certification
 | Break CLI JSON field, MCP tool rename, or required `ark.config` field | **major** |
 | New optional config field, new CLI flag, additive JSON | **minor** |
 | Bugfix with no contract change | **patch** |
-| Additive experimental ArkRun kernel API | `@arkgate/runtime` prerelease/minor |
-| Remove deprecated `arkgate/runtime` / `arkgate/nestjs` forwarding shims | **Done (AR04)** — use `@arkgate/runtime` / `@arkgate/runtime/nestjs` |
+| Additive experimental ArkRun kernel API | `arkgate/runtime` patch/minor (`@arkgate/runtime` is deprecated) |
+| Remove deprecated `arkgate/runtime` / `arkgate/nestjs` forwarding shims | **Done (AR04)** — use `arkgate/runtime` / `arkgate/nestjs` |
 
 ---
 
 ## Release notes (maintainers)
 
 Ship notes for a version live under [releases/](https://github.com/pedroknigge/arkgate/tree/main/docs/releases)
-(current tree prepared: [4.8.5.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.5.md);
-current published: [4.8.4.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.4.md);
+(current tree prepared: [4.8.7.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.7.md);
+current published: [4.8.6.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.6.md);
+prior published: [4.8.5.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.5.md);
+prior published: [4.8.4.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.4.md);
 prior published: [4.8.3.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.3.md);
 prior published: [4.8.2.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.2.md);
 prior published: [4.8.1.md](https://github.com/pedroknigge/arkgate/blob/main/docs/releases/4.8.1.md);

package/docs/product-voice.md

@@ -77,7 +77,7 @@ Three beats when a line teaches:
 | The agent imported Infrastructure from Domain. The write didn’t land. Next: `/ark-place`. | Ship it 🚀 crush the spaghetti |
 | Import rules pass. The tree still needs a refactor. Next: one small change. | You don’t need to understand anything |
 | ArkRun is experimental. In-memory. Data is gone on restart. | The kernel is production-ready |
-| The agent PATCHed the billing plan as if it were a seat count. The write didn’t land. Next: a new release, not `update`. | Freeze ξ. Four verbs. Haken slaving. |
+| The agent PATCHed the billing plan as if it were a seat count. The write didn’t land. Next: `proposeRelease` then `apply`, not `update`. | Freeze ξ. Four verbs. Haken slaving. |
 | Status: one light, one next step. | Become an architect in 60 seconds |
 
 **Brands, then the common word:** ArkGate, ArkRules, ArkRun, ArkOrder. Gloss once.
@@ -90,7 +90,7 @@ Three beats when a line teaches:
 | `arkgate-check --doctor` — **status**, one next step | control plane, coach, doctor as the product name |
 | optional policies inside a layer | dual plane, intra-layer sensors, Saturday tidy |
 | experimental runtime / in-memory / not Postgres | production kernel, durable runtime, training wheels |
-| the few slow product decisions / billing plan vs seats / that PUT doesn’t land | four verbs, freeze a pattern, Haken, slaving, ξ vs s, extra plane, construction OS |
+| the few slow product decisions / billing plan vs seats / that PUT doesn’t land / `proposeRelease` then `apply` | four verbs, freeze a pattern, Haken, slaving, ξ vs s, extra plane, construction OS |
 
 Command names stay command names (`--doctor` is a flag). If a word is not here,
 cut it or put it below the fold (develop, JSON, ADRs).
@@ -111,7 +111,7 @@ These are product law, not vibe:
 - Host write hardness differs. Required CI is the shared hard line.
 - ArkRun stores are **in-memory**. Not production durability. Do not imply otherwise.
 - Absence of ArkRules, ArkRun, or ArkOrder is silent. Label leftovers **`[Layer]`** vs **`[ArkRules]`** vs **`[ArkRun]`** vs **`[ArkOrder]`**.
-- ArkOrder is in-memory and not durable. It does not replace ArkRun. Do not imply a second npm package.
+- ArkOrder is in-memory and not durable. It does not replace ArkRun. Do not imply a second npm package. Later pattern change is `proposeRelease` then `apply`.
 
 Full engineering queue: [ROADMAP.md](../ROADMAP.md). Do not narrate phase ids in consumer copy.
 

package/docs/use.md

@@ -81,7 +81,7 @@ The config only binds when the write doesn’t land and CI is required.
 | **ArkGate** (layers) | Import rules. The write doesn’t land. The PR fails. | Always — this is the product |
 | **ArkRules** | Optional policies *inside* a layer. | Off until you turn it on (start may ship advisory templates) |
 | **ArkRun** | Optional experimental runtime (`arkgate/runtime`) | Off. In-memory. Not Postgres. |
-| **ArkOrder** | Stops the agent rewriting the few slow product decisions as CRUD (`arkgate/order`). Library + sensors, [not a service](arkorder.md). | Off. Name `xiKeys` (plan / protocol, not `projectId`). Invoices and seats still flow. In-memory. Not durable. |
+| **ArkOrder** | Stops the agent rewriting the few slow product decisions as CRUD (`arkgate/order`). Library + sensors, [not a service](arkorder.md). Valve: `proposeRelease` then `apply`; `refreshSigma`; ingest residual; capacity pack; `ReleaseStore`; ArkRun `decisionTape`. ArkOrder freezes the pattern through a valve. ArkRun is how the residual travels. | Off. Name `xiKeys` (plan / protocol, not `projectId`). Invoices and seats still flow. In-memory. Not durable. |
 
 Start always gives you **layers**. Compact starters do **not** turn on ArkRun or
 ArkOrder. No extras is fine — only ArkGate runs. Leftovers are labeled

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkgate",
-  "version": "4.8.5",
+  "version": "4.8.7",
   "description": "When the agent writes a bad import, the write doesn’t land. The same check fails the pull request.",
   "type": "module",
   "main": "./dist/index.cjs",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/pedroknigge/arkgate",
     "source": "github"
   },
-  "version": "4.8.5",
+  "version": "4.8.7",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "arkgate",
-      "version": "4.8.5",
+      "version": "4.8.7",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/templates/agent-skills/README.md

@@ -7,7 +7,7 @@
 This directory is the **Agent Skills–compatible** packaging of the same **13**
 `/ark-*` skills shipped as flat templates for Ark install. **No new skill names.**
 
-Package version when last generated context: **arkgate@4.8.5**
+Package version when last generated context: **arkgate@4.8.6**
 Schema: agent-skills package contract `1.0`
 
 ## Skills (frozen catalog)