dominus-sdk-nodejs 11.0.3 → 11.0.5

package/docs/atlas/2026-07-24-1231-sdk-nodejs-truthmap.md

@@ -1,43 +1,43 @@
-# Atlas Truthmap: dominus-sdk-nodejs
-
-Generated: 2026-07-24 12:31 EDT
-
-Target repo: `C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs`
-
-Branch/status: `## production...origin/production [behind 4]
-?? _worktrees/`
-HEAD: `8f41170dc3bf2eda08195031ab2d956c127a7a34`
-
-## Executive Truth
-
-- TypeScript/ESM SDK for Dominus platform services.
-- Production truth checked at `8f41170` on the repo's production branch after ff-pull when available.
-- Sample code surfaces: `src/index.ts`, `src/contracts/versioned-storage.ts`, `src/lib/cache.ts`, `src/lib/client.ts`, `src/lib/config.ts`, `src/lib/console-capture.ts`, `src/lib/conversation-format.ts`, `src/lib/crypto.ts`, `src/lib/errors.ts`, `src/lib/page-rules.ts`, `src/lib/schema-builder.ts`, `src/lib/trace.ts`.
-- Recent commits:
-- `8f41170 feat(db): hard-cut provisioning verify to capabilities`
-- `3d60ff8 Release SDK 7.3.0: dominus.db.verifyProvisioning (required-provisioning probe)`
-- `cd35f90 feat: browser session-capture fields on ensureRun (storageState, sessionSlotId, sessionArtifactRef)`
-- `563eca4 Release SDK 7.1.0: per-call seed/bootstrap timeouts + service-JWT force refresh`
-- `2a2d4d7 Release Node SDK Authority verdict API`
-- `ffaef8a docs: clarify routes-services.md namespace counts (#2)`
-- Agent-guide snapshot(s) 2026-06-27-0849 — verify vs HEAD commits.
-
-## Claim Map
-
-| Claim | Status | Strongest evidence | Freshness | Disproves / weakens |
-|---|---|---|---|---|
-| Repo purpose matches README/CLAUDE | PRESENT | README/CLAUDE heads | HEAD | — |
-| Agent-guide fully current vs HEAD | STALE/CHECK | dated guide vs recent log | guide dates | Prefer code |
-| Local test matrix green | UNKNOWN | not run this pass | — | Do not claim green |
-
-## Source Graph
-
-| Area | Code | Tests | Docs | Live/CI/deploy | Owner |
-|---|---|---|---|---|---|
-| Primary | code roots above | tests/ if present | README, CLAUDE, agent-guide | deploy workflows / wrangler / Cloud Run as applicable | maintainers |
-
-## Agent Read Order
-
-1. `CLAUDE.md` / `README.md`
-2. Primary entry module(s)
-3. This atlas when docs disagree with code
+# Atlas Truthmap: dominus-sdk-nodejs
+
+Generated: 2026-07-24 12:31 EDT
+
+Target repo: `C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs`
+
+Branch/status: `## production...origin/production [behind 4]
+?? _worktrees/`
+HEAD: `8f41170dc3bf2eda08195031ab2d956c127a7a34`
+
+## Executive Truth
+
+- TypeScript/ESM SDK for Dominus platform services.
+- Production truth checked at `8f41170` on the repo's production branch after ff-pull when available.
+- Sample code surfaces: `src/index.ts`, `src/contracts/versioned-storage.ts`, `src/lib/cache.ts`, `src/lib/client.ts`, `src/lib/config.ts`, `src/lib/console-capture.ts`, `src/lib/conversation-format.ts`, `src/lib/crypto.ts`, `src/lib/errors.ts`, `src/lib/page-rules.ts`, `src/lib/schema-builder.ts`, `src/lib/trace.ts`.
+- Recent commits:
+- `8f41170 feat(db): hard-cut provisioning verify to capabilities`
+- `3d60ff8 Release SDK 7.3.0: dominus.db.verifyProvisioning (required-provisioning probe)`
+- `cd35f90 feat: browser session-capture fields on ensureRun (storageState, sessionSlotId, sessionArtifactRef)`
+- `563eca4 Release SDK 7.1.0: per-call seed/bootstrap timeouts + service-JWT force refresh`
+- `2a2d4d7 Release Node SDK Authority verdict API`
+- `ffaef8a docs: clarify routes-services.md namespace counts (#2)`
+- Agent-guide snapshot(s) 2026-06-27-0849 — verify vs HEAD commits.
+
+## Claim Map
+
+| Claim | Status | Strongest evidence | Freshness | Disproves / weakens |
+|---|---|---|---|---|
+| Repo purpose matches README/CLAUDE | PRESENT | README/CLAUDE heads | HEAD | — |
+| Agent-guide fully current vs HEAD | STALE/CHECK | dated guide vs recent log | guide dates | Prefer code |
+| Local test matrix green | UNKNOWN | not run this pass | — | Do not claim green |
+
+## Source Graph
+
+| Area | Code | Tests | Docs | Live/CI/deploy | Owner |
+|---|---|---|---|---|---|
+| Primary | code roots above | tests/ if present | README, CLAUDE, agent-guide | deploy workflows / wrangler / Cloud Run as applicable | maintainers |
+
+## Agent Read Order
+
+1. `CLAUDE.md` / `README.md`
+2. Primary entry module(s)
+3. This atlas when docs disagree with code

package/docs/atlas/2026-08-04-sdk-nodejs-blockers.md

@@ -1,12 +1,12 @@
-# Blocker map: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local.
-
-| Item | Status | Interpretation |
-|---|---|---|
-| Linked worktree reconciliation | Open | Timeline v9 and secret-presence v10 branches need one explicit candidate selection. |
-| Production branch freshness | Addressed for snapshot | Docs are based on current `origin/production` tip `0e68c79`; main checkout remains preserved. |
-| Package release version | Candidate-dependent | Class D publication requires a new version not already present in the registry. |
-| Hosted service parity | Ongoing | SDK contract proof should be paired with the corresponding Gateway/worker contracts. |
-
-This is a coordination map, not a negative judgment on the feature branches.
+# Blocker map: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local.
+
+| Item | Status | Interpretation |
+|---|---|---|
+| Linked worktree reconciliation | Open | Timeline v9 and secret-presence v10 branches need one explicit candidate selection. |
+| Production branch freshness | Addressed for snapshot | Docs are based on current `origin/production` tip `0e68c79`; main checkout remains preserved. |
+| Package release version | Candidate-dependent | Class D publication requires a new version not already present in the registry. |
+| Hosted service parity | Ongoing | SDK contract proof should be paired with the corresponding Gateway/worker contracts. |
+
+This is a coordination map, not a negative judgment on the feature branches.

package/docs/atlas/2026-08-04-sdk-nodejs-proof-ladder.md

@@ -1,9 +1,9 @@
-# Proof ladder: dominus-sdk-nodejs
-
-| Layer | Evidence | Audit result / next proof |
-|---|---|---|
-| Source map | README, package entry, namespaces, tests, publish workflow | Production snapshot mapped at `0e68c79`. |
-| Build/type proof | `npm run build`; `npm run test:types` | Passed on the production snapshot with the temporary release version. |
-| Runtime suite | `npm test` | 106 Node tests passed after `npm ci` in the isolated snapshot. Linked worktree feature lines were not merged in this pass. |
-| Registry publish | `publish-production.yml` | Production push targets new package version 10.0.1; registry check found that version absent. |
-| Service behavior | Gateway/worker contract evidence | SDK tests do not establish current hosted server behavior. |
+# Proof ladder: dominus-sdk-nodejs
+
+| Layer | Evidence | Audit result / next proof |
+|---|---|---|
+| Source map | README, package entry, namespaces, tests, publish workflow | Production snapshot mapped at `0e68c79`. |
+| Build/type proof | `npm run build`; `npm run test:types` | Passed on the production snapshot with the temporary release version. |
+| Runtime suite | `npm test` | 106 Node tests passed after `npm ci` in the isolated snapshot. Linked worktree feature lines were not merged in this pass. |
+| Registry publish | `publish-production.yml` | Production push targets new package version 10.0.1; registry check found that version absent. |
+| Service behavior | Gateway/worker contract evidence | SDK tests do not establish current hosted server behavior. |

package/docs/atlas/2026-08-04-sdk-nodejs-truthmap.md

@@ -1,21 +1,21 @@
-# Atlas truth map: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local. Production snapshot: `0e68c79`.
-
-| Concern | Strongest source | Current truth |
-|---|---|---|
-| Package contract | `package.json`, `src/index.ts` | ESM package version 10.0.0 in the production snapshot, root export only, Node >=18. |
-| Namespace surface | `src/` and public export tests | Broad typed facades for gateway-first Dominus services. |
-| Workflow | workflow namespace and tests | Authority-backed `ensure` lifecycle is preferred over the retired saved-workflow chain. |
-| Timeline/archive | Authority and Logs namespaces | Timeline truth, archive status, bounded archive/repair/verify/prune helpers. |
-| Secret/admin | secret and admin namespaces | Safe presence grids/previews and persisted root-role reads without secret values. |
-| Gateway contracts | client/transport helpers and contract tests | Base64/text envelope, route transforms, typed errors, actor/per-call controls. |
-| Release | `publish-production.yml` | Production branch publishes the package to the configured registry. |
-
-## Preserved local work
-
-Repo-local worktrees cover a timeline contract v9 line that retires the company
-query option after adding a target filter, and a secret-presence-grid v10 line
-that adds safe presence data, persisted root-role exposure, and code-point-aware
-preview counting. Reconciled/release branches carry those changes, while the
-main checkout was left untouched for this docs pass.
+# Atlas truth map: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local. Production snapshot: `0e68c79`.
+
+| Concern | Strongest source | Current truth |
+|---|---|---|
+| Package contract | `package.json`, `src/index.ts` | ESM package version 10.0.0 in the production snapshot, root export only, Node >=18. |
+| Namespace surface | `src/` and public export tests | Broad typed facades for gateway-first Dominus services. |
+| Workflow | workflow namespace and tests | Authority-backed `ensure` lifecycle is preferred over the retired saved-workflow chain. |
+| Timeline/archive | Authority and Logs namespaces | Timeline truth, archive status, bounded archive/repair/verify/prune helpers. |
+| Secret/admin | secret and admin namespaces | Safe presence grids/previews and persisted root-role reads without secret values. |
+| Gateway contracts | client/transport helpers and contract tests | Base64/text envelope, route transforms, typed errors, actor/per-call controls. |
+| Release | `publish-production.yml` | Production branch publishes the package to the configured registry. |
+
+## Preserved local work
+
+Repo-local worktrees cover a timeline contract v9 line that retires the company
+query option after adding a target filter, and a secret-presence-grid v10 line
+that adds safe presence data, persisted root-role exposure, and code-point-aware
+preview counting. Reconciled/release branches carry those changes, while the
+main checkout was left untouched for this docs pass.

package/docs/atlas/INDEX.md

@@ -1,26 +1,26 @@
-# Atlas Index
-
-Last updated: 2026-08-04 local
-
-Latest snapshot:
-[truthmap](2026-08-04-sdk-nodejs-truthmap.md),
-[proof ladder](2026-08-04-sdk-nodejs-proof-ladder.md), and
-[blockers](2026-08-04-sdk-nodejs-blockers.md).
-
-## Current Truth Owners
-
-| Area | Strongest source | Notes |
-|---|---|---|
-| Public package | `package.json`, `src/index.ts`, `dist/` build | One root export: `dominus-sdk-nodejs`; no subpath exports. |
-| Namespace APIs | `src/` | Auth, DB/DDL, files/stash, AI/runtime, browser, jobs, workflow, Authority, logs, platform, publisher, admin, and control-plane facades. |
-| Workflow lifecycle | `src/namespaces/workflow*`, Authority namespace | Authority-backed `workflow.ensure` is preferred; saved-workflow legacy chain is retired. |
-| Secret/admin surfaces | `src/namespaces/secrets*`, admin namespace | Safe presence/preview and persisted root-role surfaces avoid returning secret values. |
-| Runtime transport | shared gateway/client helpers in `src/` | Gateway-first route transforms, typed error/wire contracts, and per-call controls. |
-| Publish | `.github/workflows/publish-production.yml` | Registry package publication on the `production` lane. |
-
-## Preserved local work
-
-The main checkout is clean in tracked files but has four repo-local linked
-worktrees: Authority timeline contract v9 and three secret-presence-grid
-reconciled/release lines. The high-level path for that work is in the pending
-summary; the implementation was not merged or modified here.
+# Atlas Index
+
+Last updated: 2026-08-04 local
+
+Latest snapshot:
+[truthmap](2026-08-04-sdk-nodejs-truthmap.md),
+[proof ladder](2026-08-04-sdk-nodejs-proof-ladder.md), and
+[blockers](2026-08-04-sdk-nodejs-blockers.md).
+
+## Current Truth Owners
+
+| Area | Strongest source | Notes |
+|---|---|---|
+| Public package | `package.json`, `src/index.ts`, `dist/` build | One root export: `dominus-sdk-nodejs`; no subpath exports. |
+| Namespace APIs | `src/` | Auth, DB/DDL, files/stash, AI/runtime, browser, jobs, workflow, Authority, logs, platform, publisher, admin, and control-plane facades. |
+| Workflow lifecycle | `src/namespaces/workflow*`, Authority namespace | Authority-backed `workflow.ensure` is preferred; saved-workflow legacy chain is retired. |
+| Secret/admin surfaces | `src/namespaces/secrets*`, admin namespace | Safe presence/preview and persisted root-role surfaces avoid returning secret values. |
+| Runtime transport | shared gateway/client helpers in `src/` | Gateway-first route transforms, typed error/wire contracts, and per-call controls. |
+| Publish | `.github/workflows/publish-production.yml` | Registry package publication on the `production` lane. |
+
+## Preserved local work
+
+The main checkout is clean in tracked files but has four repo-local linked
+worktrees: Authority timeline contract v9 and three secret-presence-grid
+reconciled/release lines. The high-level path for that work is in the pending
+summary; the implementation was not merged or modified here.

package/docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md

@@ -1,102 +1,102 @@
-# Janitor Cleanup Audit: dominus-sdk-nodejs
-
-Generated: 2026-06-27 08:49 local
-Target repo: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
-Git root: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
-Branch/status: `production` — clean before this pass (no tracked or untracked changes).
-
-## Summary
-
-Wrote a source-backed agent-guide pack and wired it into `README.md` and
-`CLAUDE.md`. Corrected one proven-stale fact ("no committed automated tests")
-in three places. Auto-cleaned generated `dist/` (gitignored, reproducible).
-Everything left uncommitted per instructions. No tracked source, branches,
-worktrees, plans, or release artifacts deleted.
-
-## Executive Actions Applied
-
-| Action | Path | Why safe | Verification |
-|---|---|---|---|
-| Wrote agent-guide pack | `docs/agent-guide/**` | New docs only; no source touched. | Files present; INDEX/current point at snapshot. |
-| Wrote cleanup audit | `docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md` | New doc only. | This file. |
-| Wired guide into README | `README.md` | Added small "Agent Guide" section near top; no other content changed. | `git diff README.md` is the one added block. |
-| Wired guide into CLAUDE | `CLAUDE.md` | Added "Agent Guide Pack" pointer near top. | `git diff CLAUDE.md`. |
-| Fixed stale tests fact | `CLAUDE.md`, `docs/architecture.md` | `tests/` has 24 committed files run by `npm test`; old "no committed tests" claim was provably false. | `ls tests` (24 files); `package.json scripts.test` lists them. |
-| Auto-clean generated build | `dist/` | Gitignored, untracked, reproducible via `npm run build`; `prepublishOnly` rebuilds it. | `git check-ignore dist` = ignored; `git ls-files dist` empty; post-delete `git status` shows no tracked change. |
-
-## Docs Written
-
-| File | Purpose | Source-backed by |
-|---|---|---|
-| `docs/agent-guide/INDEX.md` | Stable entrypoint + snapshot history. | repo layout. |
-| `docs/agent-guide/current.md` | Latest snapshot pointer + top-5 refresh facts. | `package.json`, `src/index.ts`, `tests/`. |
-| `.../00-reading-order.md` | Read order + per-task source map + stale flags. | existing docs, `src/`. |
-| `.../01-purpose-and-boundaries.md` | Purpose, ownership, runtime class, boundary. | `package.json`, `CLAUDE.md`, workflows. |
-| `.../02-repo-map-and-entrypoints.md` | Directory map + entrypoints. | `find src`, `package.json`, `.github/workflows`. |
-| `.../03-api-surface.md` | 27 namespaces + auth/scope map. | `src/index.ts` wiring, `routes-services.md`. |
-| `.../04-data-state-and-storage.md` | Storage surfaces + in-process caches. | `docs/architecture.md` §2a, `src/lib/*`. |
-| `.../05-integrations-and-runtime.md` | Deps, gateway routing, env categories. | `package.json`, `CLAUDE.md`, `src/lib/config.ts`. |
-| `.../06-workflows-commands-and-ci.md` | Commands + CI lanes. | `package.json scripts`, `.github/workflows`. |
-| `.../07-operations-release-and-live-proof.md` | npm release lane + proof. | `publish-production.yml`, `package.json`, `workflow-hard-cut-release.md`. |
-| `.../08-security-privacy-and-secrets.md` | Auth boundaries, secret resolution. | `CLAUDE.md`, `src/lib/config.ts`, `.gitignore`. |
-| `.../09-known-risks-and-debt.md` | Stale docs, doc-drift, generated residue. | this audit, `docs/*`. |
-| `.../10-agent-playbook.md` | If-changing-X-read-Y + Kyle routing. | `CLAUDE.md`, `src/`. |
-
-## Drift Findings
-
-| Finding | Evidence | Risk | Recommendation | Approval needed |
-|---|---|---|---|---|
-| "No committed automated tests" claim stale | `tests/` has 24 files; `package.json scripts.test` runs them | Low (misleads agents) | Fixed in CLAUDE.md + architecture.md §10 | Done |
-| Hand-maintained counts may drift | `routes-services.md` says "450 commands / 29 surfaces"; actual `src/namespaces/` = 27 files | Low | Noted in 09 + architecture §10; re-derive from source before quoting | No |
-
-## Stale Or Conflicting Docs
-
-| Doc | Problem | Stronger source | Proposed action |
-|---|---|---|---|
-| `docs/architecture.md` §10 | claimed no committed tests | `tests/` + `package.json` | Fixed (replaced with count-drift note). |
-| `CLAUDE.md` Validation | "If tests are absent" framing | `tests/` (24 files) | Fixed to state tests are committed. |
-| `routes-services.md` counts | "29 namespace surfaces" vs 27 top-level files | `src/namespaces/` | Left as-is (counts include `ai.*` sub-namespaces + `auth` local helpers; not provably wrong). Flagged for re-derivation. |
-
-## Orphan / Generated / Scratch Candidates
-
-| Path | Evidence | Proposed action | Safe now? |
-|---|---|---|---|
-| `dist/` | gitignored build output (~1.6 MB) | Deleted | Yes (done) |
-| `node_modules/` | gitignored installed deps | Leave; not in the auto-apply allowlist; reproducible via `npm ci` but may be in use by a dev session | Not auto-deleted |
-
-## Auto-Cleanup Performed
-
-| Path | Evidence | Action | Verification |
-|---|---|---|---|
-| `dist/` | `git check-ignore dist` = ignored; `git ls-files dist` empty; reproducible via `npm run build` | `rm -rf dist` | Post-delete `git status` shows no tracked change; rebuild with `npm run build`. |
-
-## Expert Review Queue
-
-| Candidate | Why expert should view it first | Suggested expert | First review question |
-|---|---|---|---|
-| `routes-services.md` "450 commands / 29 surfaces" reconciliation | Authoritative re-count of public commands vs. the maintained matrix touches the platform client contract surface | dominus-expert | Are the documented counts accurate against current `src/namespaces/*.ts`, and should they be regenerated by a script instead of hand-maintained? |
-
-## Worktree / Branch / Plan Residue
-
-| Item | Evidence | Proposed action | Owner |
-|---|---|---|---|
-| None | Single repo dir; no `.git/worktrees` scratch, no stray plans found | None | — |
-
-## Approval Queue
-
-- [ ] Delete `node_modules/` (reproducible via `npm ci`) — only if no dev session is using it — validate with `npm ci && npm test`.
-
-## Not Touching
-
-- `dist/` rebuild — left for the developer to regenerate via `npm run build`.
-- `node_modules/` — installed deps; outside the granted auto-clean allowlist.
-- `docs/usage-reference.md` (~98 KB) — large reference, not rewritten; only flagged for count drift.
-- All tracked source, `CHANGELOG.md` history, CI workflows, branches.
-
-## Follow-Up Skills
-
-| Need | Skill | First action |
-|---|---|---|
-| Reconcile documented command counts | dominus-expert | Re-count public commands against `src/namespaces/`. |
-| If truth scatters across code/docs/CI | kyle-atlas | Build `docs/atlas/INDEX.md`. |
-| Durable cross-repo facts | kyle-learn | Promote to `.claude/knowledge` if reused. |
+# Janitor Cleanup Audit: dominus-sdk-nodejs
+
+Generated: 2026-06-27 08:49 local
+Target repo: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
+Git root: C:\developer\codingroot\repos\dominus_active\dominus-sdk-nodejs
+Branch/status: `production` — clean before this pass (no tracked or untracked changes).
+
+## Summary
+
+Wrote a source-backed agent-guide pack and wired it into `README.md` and
+`CLAUDE.md`. Corrected one proven-stale fact ("no committed automated tests")
+in three places. Auto-cleaned generated `dist/` (gitignored, reproducible).
+Everything left uncommitted per instructions. No tracked source, branches,
+worktrees, plans, or release artifacts deleted.
+
+## Executive Actions Applied
+
+| Action | Path | Why safe | Verification |
+|---|---|---|---|
+| Wrote agent-guide pack | `docs/agent-guide/**` | New docs only; no source touched. | Files present; INDEX/current point at snapshot. |
+| Wrote cleanup audit | `docs/janitor/2026-06-27-0849-sdk-orient-cleanup-audit.md` | New doc only. | This file. |
+| Wired guide into README | `README.md` | Added small "Agent Guide" section near top; no other content changed. | `git diff README.md` is the one added block. |
+| Wired guide into CLAUDE | `CLAUDE.md` | Added "Agent Guide Pack" pointer near top. | `git diff CLAUDE.md`. |
+| Fixed stale tests fact | `CLAUDE.md`, `docs/architecture.md` | `tests/` has 24 committed files run by `npm test`; old "no committed tests" claim was provably false. | `ls tests` (24 files); `package.json scripts.test` lists them. |
+| Auto-clean generated build | `dist/` | Gitignored, untracked, reproducible via `npm run build`; `prepublishOnly` rebuilds it. | `git check-ignore dist` = ignored; `git ls-files dist` empty; post-delete `git status` shows no tracked change. |
+
+## Docs Written
+
+| File | Purpose | Source-backed by |
+|---|---|---|
+| `docs/agent-guide/INDEX.md` | Stable entrypoint + snapshot history. | repo layout. |
+| `docs/agent-guide/current.md` | Latest snapshot pointer + top-5 refresh facts. | `package.json`, `src/index.ts`, `tests/`. |
+| `.../00-reading-order.md` | Read order + per-task source map + stale flags. | existing docs, `src/`. |
+| `.../01-purpose-and-boundaries.md` | Purpose, ownership, runtime class, boundary. | `package.json`, `CLAUDE.md`, workflows. |
+| `.../02-repo-map-and-entrypoints.md` | Directory map + entrypoints. | `find src`, `package.json`, `.github/workflows`. |
+| `.../03-api-surface.md` | 27 namespaces + auth/scope map. | `src/index.ts` wiring, `routes-services.md`. |
+| `.../04-data-state-and-storage.md` | Storage surfaces + in-process caches. | `docs/architecture.md` §2a, `src/lib/*`. |
+| `.../05-integrations-and-runtime.md` | Deps, gateway routing, env categories. | `package.json`, `CLAUDE.md`, `src/lib/config.ts`. |
+| `.../06-workflows-commands-and-ci.md` | Commands + CI lanes. | `package.json scripts`, `.github/workflows`. |
+| `.../07-operations-release-and-live-proof.md` | npm release lane + proof. | `publish-production.yml`, `package.json`, `workflow-hard-cut-release.md`. |
+| `.../08-security-privacy-and-secrets.md` | Auth boundaries, secret resolution. | `CLAUDE.md`, `src/lib/config.ts`, `.gitignore`. |
+| `.../09-known-risks-and-debt.md` | Stale docs, doc-drift, generated residue. | this audit, `docs/*`. |
+| `.../10-agent-playbook.md` | If-changing-X-read-Y + Kyle routing. | `CLAUDE.md`, `src/`. |
+
+## Drift Findings
+
+| Finding | Evidence | Risk | Recommendation | Approval needed |
+|---|---|---|---|---|
+| "No committed automated tests" claim stale | `tests/` has 24 files; `package.json scripts.test` runs them | Low (misleads agents) | Fixed in CLAUDE.md + architecture.md §10 | Done |
+| Hand-maintained counts may drift | `routes-services.md` says "450 commands / 29 surfaces"; actual `src/namespaces/` = 27 files | Low | Noted in 09 + architecture §10; re-derive from source before quoting | No |
+
+## Stale Or Conflicting Docs
+
+| Doc | Problem | Stronger source | Proposed action |
+|---|---|---|---|
+| `docs/architecture.md` §10 | claimed no committed tests | `tests/` + `package.json` | Fixed (replaced with count-drift note). |
+| `CLAUDE.md` Validation | "If tests are absent" framing | `tests/` (24 files) | Fixed to state tests are committed. |
+| `routes-services.md` counts | "29 namespace surfaces" vs 27 top-level files | `src/namespaces/` | Left as-is (counts include `ai.*` sub-namespaces + `auth` local helpers; not provably wrong). Flagged for re-derivation. |
+
+## Orphan / Generated / Scratch Candidates
+
+| Path | Evidence | Proposed action | Safe now? |
+|---|---|---|---|
+| `dist/` | gitignored build output (~1.6 MB) | Deleted | Yes (done) |
+| `node_modules/` | gitignored installed deps | Leave; not in the auto-apply allowlist; reproducible via `npm ci` but may be in use by a dev session | Not auto-deleted |
+
+## Auto-Cleanup Performed
+
+| Path | Evidence | Action | Verification |
+|---|---|---|---|
+| `dist/` | `git check-ignore dist` = ignored; `git ls-files dist` empty; reproducible via `npm run build` | `rm -rf dist` | Post-delete `git status` shows no tracked change; rebuild with `npm run build`. |
+
+## Expert Review Queue
+
+| Candidate | Why expert should view it first | Suggested expert | First review question |
+|---|---|---|---|
+| `routes-services.md` "450 commands / 29 surfaces" reconciliation | Authoritative re-count of public commands vs. the maintained matrix touches the platform client contract surface | dominus-expert | Are the documented counts accurate against current `src/namespaces/*.ts`, and should they be regenerated by a script instead of hand-maintained? |
+
+## Worktree / Branch / Plan Residue
+
+| Item | Evidence | Proposed action | Owner |
+|---|---|---|---|
+| None | Single repo dir; no `.git/worktrees` scratch, no stray plans found | None | — |
+
+## Approval Queue
+
+- [ ] Delete `node_modules/` (reproducible via `npm ci`) — only if no dev session is using it — validate with `npm ci && npm test`.
+
+## Not Touching
+
+- `dist/` rebuild — left for the developer to regenerate via `npm run build`.
+- `node_modules/` — installed deps; outside the granted auto-clean allowlist.
+- `docs/usage-reference.md` (~98 KB) — large reference, not rewritten; only flagged for count drift.
+- All tracked source, `CHANGELOG.md` history, CI workflows, branches.
+
+## Follow-Up Skills
+
+| Need | Skill | First action |
+|---|---|---|
+| Reconcile documented command counts | dominus-expert | Re-count public commands against `src/namespaces/`. |
+| If truth scatters across code/docs/CI | kyle-atlas | Build `docs/atlas/INDEX.md`. |
+| Durable cross-repo facts | kyle-learn | Promote to `.claude/knowledge` if reused. |

package/docs/janitor/2026-08-04-sdk-nodejs-cleanup-audit.md

@@ -1,14 +1,14 @@
-# Janitor cleanup audit: dominus-sdk-nodejs
-
-Generated: 2026-08-04 local.
-
-Refreshed the README and guide/atlas indexes, added a current reading-order
-pack, and mapped the root package surface, namespace ownership, lifecycle
-truth, secret/admin surfaces, and registry release path. Added a neutral
-pending-work summary for the preserved linked worktrees.
-
-No implementation branch or linked worktree was merged, rebased, deleted, or
-modified. Historical docs remain available. The Class D release metadata was
-bumped from 10.0.0 to 10.0.1 after verifying 10.0.1 was absent from the npm
-registry. After `npm ci` in the isolated snapshot, build, type tests, and the
-full 106-test runtime suite passed. `git diff --check` was run before commit.
+# Janitor cleanup audit: dominus-sdk-nodejs
+
+Generated: 2026-08-04 local.
+
+Refreshed the README and guide/atlas indexes, added a current reading-order
+pack, and mapped the root package surface, namespace ownership, lifecycle
+truth, secret/admin surfaces, and registry release path. Added a neutral
+pending-work summary for the preserved linked worktrees.
+
+No implementation branch or linked worktree was merged, rebased, deleted, or
+modified. Historical docs remain available. The Class D release metadata was
+bumped from 10.0.0 to 10.0.1 after verifying 10.0.1 was absent from the npm
+registry. After `npm ci` in the isolated snapshot, build, type tests, and the
+full 106-test runtime suite passed. `git diff --check` was run before commit.

package/docs/migration-error-base.md

@@ -0,0 +1,115 @@
+# Node SDK Error Migration Guide: `DominusError` Subclasses
+
+**Version:** v1 (existing class names preserved) → planned v2 (deprecation warnings) → v3 (alias removal)
+
+**ADR:** [0010-sdk-exception-base-name.md](https://github.com/carebridgesystems/dominus-platform/blob/main/docs/adr/0010-sdk-exception-base-name.md) (Seams fork 6)
+
+This document is the S-4.8 / M-2 migration note. **No behavior change in v1.**
+
+---
+
+## (a) What changed
+
+The Node SDK already uses one canonical base, `DominusError`. Existing public
+exception class names remain subclasses of that base. `DominusError.toJSON()`
+emits the canonical envelope (`kind`, `code`, `request_id`, `http_status`,
+`envelope_version: "1"`, `recovery_action`).
+
+| Canonical Kind          | Existing class (v1)     | Default HTTP |
+|-------------------------|-------------------------|--------------|
+| `unauthorized`          | `AuthenticationError`   | 401          |
+| `forbidden`             | `AuthorizationError`    | 403          |
+| `not_found`             | `NotFoundError`         | 404          |
+| `validation_failed`     | `ValidationError`       | 400          |
+| `conflict`              | `ConflictError`         | 409          |
+| `upstream_unavailable`  | `ServiceError`          | 500          |
+| `timeout`               | `TimeoutError`          | —            |
+
+`ConnectionError` and `SecureTableError` also subclass `DominusError`.
+`raiseForStatus` still maps HTTP status codes to these same classes.
+
+---
+
+## (b) What stayed
+
+**Every existing public class name is preserved** in v1.
+`AuthenticationError` and the other historical names still subclass
+`DominusError`. Existing `instanceof` checks keep working.
+
+```ts
+import { AuthenticationError, DominusError } from 'dominus-sdk-nodejs';
+
+const err = new AuthenticationError('bad token');
+err instanceof AuthenticationError; // true
+err instanceof DominusError;        // true
+err.kind;                           // "unauthorized"
+```
+
+Existing catch sites do **not** need to change in v1.
+
+---
+
+## (c) How to migrate
+
+**Recommended v1 pattern** — catch `DominusError` and dispatch on `kind`:
+
+```ts
+import { DominusError } from 'dominus-sdk-nodejs';
+
+try {
+  await dominus.stash.put(/* ... */);
+} catch (err) {
+  if (err instanceof DominusError) {
+    if (err.kind === 'unauthorized') reauth();
+    else if (err.kind === 'rate_limited') backoff(err);
+    else throw err;
+  } else {
+    throw err;
+  }
+}
+```
+
+---
+
+## (d) v1 import pattern (now)
+
+```ts
+import {
+  DominusError,
+  AuthenticationError,
+  AuthorizationError,
+  NotFoundError,
+  ValidationError,
+  ConflictError,
+  ServiceError,
+  ConnectionError,
+  TimeoutError,
+  SecureTableError,
+  raiseForStatus,
+} from 'dominus-sdk-nodejs';
+```
+
+These names remain the public API in v1. They are the aliases that v2 will
+deprecate in favor of catching `DominusError` and branching on `kind`.
+
+---
+
+## (e) v2 deprecation timeline
+
+- **v1** (current): Existing exception class names remain `DominusError`
+  subclasses. **No warnings. No behavior change.**
+- **v2** (next major): The historical names (`AuthenticationError`,
+  `AuthorizationError`, `ValidationError`, `ServiceError`, `ConnectionError`,
+  `SecureTableError`) become deprecated aliases. They still construct and
+  catch the same errors.
+- **v3** (later): Those aliases are removed. Consumers catch `DominusError`
+  (or a per-`kind` subclass) and dispatch on `kind`.
+
+The deprecation window is governed by `dominus-cli/docs/deprecation-policy.md`.
+
+---
+
+## (f) Rollback
+
+Pin the SDK to the current major if you must stay on the historical class
+names only. v1 is fully backward-compatible; you can stay on it indefinitely.