forgetrail 0.3.0 → 0.4.1

package/README.md

@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="site/static/logo.png" alt="ForgeTrail" width="180" />
+</p>
+
 # ForgeTrail
 
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
@@ -8,191 +12,46 @@
 
 A persistent development system for building software with AI agents.
 
-**ForgeTrail** gives solo developers (and small teams) a 7-phase playbook so agents plan before they build, keep the trail of decisions across sessions, and leave structured knowledge that improves the next project.
-
-**Who it is for:** builders using Cursor, Claude Code, Codex, or similar agents who want structure without a heavyweight process.
-
-**Why it works:** phases with exit criteria, a live `.forgetrail/workflow_tracking.json`, and templates pre-loaded with production lessons. Each project leaves a trail of decisions, gotchas, and breadcrumbs that future work can follow.
-
-**Try it now (no MCP):** [TRY_FORGETRAIL.md](TRY_FORGETRAIL.md): write a `docs/GENESIS.md` in any AI chat, drop in ForgeTrail Lite, paste one kickoff line into your coding agent.
-
-Site: [forgetrail.dev](https://forgetrail.dev). Open source under [Apache License 2.0](LICENSE). Distilled from [Exec Foundry](https://execfoundry.com) and refined across about a dozen further projects. Built by [Catalyst Forge](https://catalystforge.com).
-
----
-
-## Quickstart (ranked)
-
-### 1. Try (no MCP): start here
-
-Follow **[TRY_FORGETRAIL.md](TRY_FORGETRAIL.md)** (~15 minutes of setup, plus time to iterate your spec):
-
-1. Paste the [Genesis prompt](content/GENESIS_SPEC_PROMPT.md) into ChatGPT, Claude, Grok, or a local Ollama UI.
-2. Save the result as `docs/GENESIS.md` in a **new empty project folder**.
-3. Add [ForgeTrail Lite](content/FORGETRAIL_LITE.md) as `.forgetrail/FORGETRAIL_LITE.md`. If you have Node 20+: `npx forgetrail install --lite --with-genesis-stub`.
-4. Paste the kickoff line from TRY_FORGETRAIL.md into your coding agent. Approve the Phase 1 brief before any scaffold.
-
-Optional shape reference (fiction): [Mars habitat duty roster](content/examples/GENESIS_SAMPLE_mars-habitat-roster.md).
-
-Stuck? Use the [Try ForgeTrail checklist](https://github.com/Catalyst-Forge-LLC/forgetrail/issues/new?template=try-forgetrail-checklist.md) issue template.
+**Docs:** [forgetrail.dev/docs](https://forgetrail.dev/docs) · **Site:** [forgetrail.dev](https://forgetrail.dev)
 
-### 2. MCP (Cursor / Claude power users)
+## Install
 
-Installer and MCP bins are on npm. This is a channel, not a library: do not add `forgetrail` to an app’s `dependencies`.
-
-```json
-{
-  "mcpServers": {
-    "forgetrail": {
-      "command": "npx",
-      "args": ["-y", "forgetrail-mcp"],
-      "env": {
-        "FORGETRAIL_ROOT": "/absolute/path/to/forgetrail-or-node_modules/forgetrail"
-      }
-    }
-  }
-}
-```
-
-If `forgetrail` is installed in the same tree as the MCP package, you can omit `FORGETRAIL_ROOT`. From a clone instead: `pnpm run mcp:build`. Details: [mcp-server/README.md](mcp-server/README.md).
-
-First chat: *"Call `getNewProjectKickoff` and set up the project."* Resume later with *"Call `getResumeSessionInstructions`."*
-
-### 3. Full / vendored methodology
-
-Need the whole template tree on disk (offline, no MCP):
+Node.js 20+. Prefer `pnpm dlx` on Windows.
 
 ```bash
-npx forgetrail install --lite --with-genesis-stub
-npx forgetrail install
+pnpm dlx forgetrail install --lite --with-genesis-stub
 ```
 
-From a clone: `pnpm run link:global`, then the same `forgetrail install` commands. Or copy this repo into the app as `_forgetrail/` and use [INITIAL_PROMPT.md](INITIAL_PROMPT.md).
-
-**Graduation:** Try (copy Lite) → `npx forgetrail install --lite` → `npx -y forgetrail-mcp` → full `_forgetrail/` only when you need vendored templates. Details in [TRY_FORGETRAIL.md](TRY_FORGETRAIL.md).
-
----
-
-## The 7 phases (short)
-
-| Phase | Name | What happens |
-| ----- | ---- | ------------ |
-| 1 | **Plan** | Lock architecture in `PHASE_1_BRIEF.md` before code |
-| 2 | **Build** | Full runnable spine in one pass |
-| 3 | **Stabilize** | Env, paths, auth: make the foundation solid |
-| 4 | **Iterate** | Feature by feature with real data |
-| 5 | **Refine** | Systematic cleanup before complexity owns you |
-| 6 | **Align** | Cut what does not serve the product vision |
-| 7 | **Harden** | Security, performance, production docs |
-
-Phases 4 and 5 often alternate. Full playbooks: [WORKFLOW.md](WORKFLOW.md). Docs arrive progressively (brief first; no empty boilerplate day one).
+or `npx forgetrail install --lite --with-genesis-stub`. MCP: `npx -y forgetrail-mcp` (set `FORGETRAIL_ROOT`). Do not add `forgetrail` to an app's `dependencies`.
 
----
+## Quick start
 
-## Why ForgeTrail
+1. Write a `docs/GENESIS.md` (what, not how) in a **new empty project folder**.
+2. Add Lite: the command above, or copy [`content/FORGETRAIL_LITE.md`](content/FORGETRAIL_LITE.md) to `.forgetrail/FORGETRAIL_LITE.md`.
+3. Paste the kickoff line from [TRY_FORGETRAIL.md](TRY_FORGETRAIL.md). Approve the Phase 1 brief before any scaffold.
 
-Most AI chats forget. ForgeTrail keeps **phase state**, **decisions**, and **gotchas** in the repo, and leaves a trail of lessons the next build can follow via [prompts/propagate-to-forgetrail.md](prompts/propagate-to-forgetrail.md) ([update-log.md](update-log.md)).
+No Node required if you copy Lite by hand. Full recipe: [Try](https://forgetrail.dev/docs/try).
 
-| Framework | Core idea | Where ForgeTrail differs |
-|-----------|-----------|------------------------|
-| **GitHub Spec Kit** | Gated specify → plan → tasks | Templates arrive **pre-loaded with production lessons** and keep absorbing new ones |
-| **BMAD-Method** | Many agent personas | One developer + one agent; invests in **lifecycle memory**, not persona breadth |
-| **OpenSpec** | Change deltas in an existing repo | Complementary: OpenSpec for changes; ForgeTrail for the **whole product lifecycle** |
-| **Per-project retros** | Lessons in one repo's instruction file | ForgeTrail propagation is **cross-project** |
+## What you get
 
-ForgeTrail earns its weight when you build **repeatedly**. For a single gated change, Spec Kit or OpenSpec may be enough.
+A 7-phase playbook, a live `.forgetrail/workflow_tracking.json`, and templates pre-loaded with production lessons. Each project leaves a trail of decisions, gotchas, and breadcrumbs that future work follows. Flags, MCP, and the phase table live in the [docs](https://forgetrail.dev/docs).
 
----
+<!-- xfacts-nutrition-label -->
 
-## How to use it (deeper)
+## Nutrition label
 
-### MCP details
+- **AppFacts:** [viewer](https://appfacts.dev/v#af1.eNp1Uk1r3DAQ_StiTg1o10mOPrUYcihJCCS3UsqsNNaqK2uENHbiLvvfi2x320tvg3hf8zRnmKC90xBxIGjhgbOjt4w-gAaZU30riYxqlDAHHx1oKIIyFmgBjfiJQEPwhmKp4C8JzZF29_vbFWhO0J4hYHQjugr4ihO-muyTaPU2J1pn0JDHKH4J8cyW9j9LTbB5tvDEloLqOAp9iHrJLGw4qE9P3csNaDhykRXYBR5tHzATXDRYSgXab2eI0MLnoYqYVSNtEk2xJ9CQ_u9RKE-UlR9SoIGioHiOcNGr6C-2G_3VHGlANWHwdsEojFbVEpWPPWWKhq6094zRBcob929qZSkFnqvRUvmV4Uh6HyhlKmVjPfhAuwMWsmrZKooaMKJbYsLlu4Yymev6_zSjIUP7pzSVMk_eUlY9Z_VOh-KFFvZh9MHW_0toTujox6peuSmmoRacKXHxwnmugiKptE3jvBzHw97w0HQoGOYiu-Wydo-PXdPXSZYbu_wGeaPbgQ) · [raw](https://github.com/Catalyst-Forge-LLC/forgetrail/blob/main/APP_FACTS.md)
+- **ToolFacts:** [viewer](https://toolfacts.dev/v#tf1.eNrFl8Fy2zYQhl9lhye7IymJL53RzVVjTxrV8shuc8hkPDC4pBCBAAuAUjWevHv_pUhJVdxceuCNAyyA_9tdLJYv2SabvhtlTlWcTbMbH0p-DMpY-n12Tw8cNhyyUZbzhq2v8T3NZiopu4uJWmNMwiQa7zD1dnI1ucJITCo1EQNKJ7MRG2s0uyhHXNdKr3h8NXmL4bVxOcYqXY9jf1ZoXDKi5iXjv1k3ab-39VrZcR285hhhloJysfYhYS6m3Pjs2yjTgXPGcmWjrA_8V2MwlE0_f8Esl0HWYiKx5YpT2GGx845bxJiMU3Ja7OyT97LP55fePRtlTa6SeEhDeimoJucnLgrWSYADq1wYGJByUGEsRziLK5Gp4UKZdpy2PqyPh3dYjC0KaGccjn2r2ifQZNMUGoZRE2rf-vDPTgdNColBkoC9kR0L67dPqVM3-Rq9owvjrHFMvz0s7sgH8rUgKktHaVSrtLokVSrjENeI-FSKlMupXqnIFBpYwr0HP9Svsncsr7N3k_-XfOadY0kqk3YEnXo9pcCpCS6SX49AoteqZOpyckQ3i-Xt-8fl9Yf503KxeBy1WNsVpxUH-rRYfryZLz5NKoypSIVvkI8noPDtvbjgtoG_neZhoJctICFhVz731pc7KjtBkBxIUXc_KyzvYnbxbvzz5SlKZBX0ao5jJcEH4XhoJRBcTyeFxraSCPmsnkX5847WvMNB55F4xM4WWT9oENSp9NzrpvV56qRREXwlw_HNT0iqUwCUtesmN2lg9REzGt-ckxI5hI2qOrV5JIHRTQhtFgX_FfroIvccyXkpC8q1JiIk4qIxmRTZFpdncZrJtbQmDo3aI-heT3dZKjk0YW_qmIvG2qPVedZ11fShrYqDIvXOf6XKdzU7cMEIHwrVvyGu8Sbeq5Q4DHX3O4T-xkj6QdO47kTtL44AnlS580ocfPuAo6P41WuJR46HaVCc7cqgoAHqUAEiJU9oQ6QYGEeiYV-Rz2DueHu_z8-PRq99UQzKAb-yKwzbnJ69TygSqsZburNe5cDQFqXClSgeKiBc1Ode-5geGopZEyJu1HfdwnoPeHs4Y6DXB2oIj_xrzqetSasOlPccS2CQ7NFCOg93BOwA_B_D3fn9-mEhv5PVEvomtXfsJFIUpZ1Ch_1f6flLnw-DJij-RsaFCajh0qLKEyZ9uty1NidR1U9SuC_8PTLa7p1k68nLbRyWiisC1_6M_Wg2NwN3G22rdOxg5x8e30uvKr896hnB68IsxMlrb39I8kct_wxxcCDRQs1ezKGkyNOMml9KnHoaKlWNy_ZFfvYap2Gf7zf-9g9m9jXP) · [raw](https://github.com/Catalyst-Forge-LLC/forgetrail/blob/main/mcp-server/TOOL_FACTS.md)
+- **SkillFacts:** [viewer](https://skillfacts.dev/v#sf1.eNq9lN9v20YMx_-Vg_rSGJHspsA26C1LmmKo1xqzsZcoMGSZtq6W7oy7Uzyj6d-19_1lI3n65dhe1wItgqQVyePxSH4_n4LHIH51Gai0hCAOVtqswZlUFsFlsIRHKPQWDDpuUpcWe-vEHUWg8xGMlVqhaxS9jkZosS51lUVDmjn5SDGFzEBZynu9TbMcwisO3Ei1RFtWGatNaDeyoNu2ldlqDn6jsIwMhMvBXzejgsTP4TZPLYhCriDbZwWIVC1FmUrl8FdEXe3DnTabVaF3c_zM8Lp19NFqJVLLOS2-A0qhV8JAps2SLjf6EVSqMrz_U2B1Zeh_Qe7c1sbD4Vq6vFpEmS6HTSNCriwcj2-GB03bVotC2vxU0z5fBlJZZyrsj1Z2bgCbwvflgC2IA_hriy2TDtMocPQINMoSjUBFrmQBvnY04-FluDPScV6ndUEJV2AAH4Htvf_q4oeLQi-G1M9hmW1DCwZnPJx9-DCe313fzKZRSUVg8ITG8LaSS-7XZWAqdV0tuWwLqcnyMVhst6UtSQsMczRBngOFVOs1WDetFukalLvFEZQ4eEk98flngE_GQ_7rPewmRn-EzL2T2UavVt78B9iqhCnehOd-67U1eLgMFpVaFrCcp8bJFa4jbuU9mmFtMJ467qCAEp-9x04qrYC33TqpUp8Dw7GruS5hi1X2NqFrV4TyoMcDF6851Tfsi0l3eDAMw0SxEuZc77yWVywS1NeraJQEiSKNxqI7nahWobE43LVEHSR47RN4hcbCCzRRtT5j0ckzUaTOWPTFmaham5TsR4uT6m7mEIvTY0hUN4Uu5v8OAZ_Xqj9OlBBe_t-SSIhW_scTOda-v43EH4tG-2SqxR-LWvtk68Qfi077iXqufM4Ziu8gfp_4uf69tUGA_zqggDc9B0Ed-B8saK9rcNAajojQes5CIVFHSOBG3T8kylOBP1ssxIKoQKY-FmKOx0rBYD2-1fSoWFyNrn4KR7-EVyOy1REalyBHGYRp5XJtaI4Z_pX13W2e-Q6H1K0ba45L9LstxKKShZsv9qS_w63qTXq320VZ7eS58tBJPgyXRL0QU8os7ig1HuwvbqKeBP7gPxjMv2QZDG4bwAwG6H92dx3zpycNRzBqGseUccN2T5zGMfbcYU-Hnsb7DgHErj6DyJkoPNngBVdiv9B6I6h5rXq8mpg9nUh62hGsu0hMNILJitT1Gfb7zUTMUE7coGjAPXshJp599PXD2VdX0OLp3KCmTCx0fK3sfc8nDbROzphr6IvJN_FsLTyBp24kbH3vkYb2mmnefNdN5qk_seZaGgfd19CNzN8JbqfQ1gfbEdZOQe1LSHsGtHM4-xLMuDe_eqKJlmhkf0ncuqgj3jDZzg1q1sAOfXTKT-S2xzt0-Hx-HsyRwdsGW1559wwVlszDy9MIuxD__I3VIsPEYi_uDzesO3QaYBeow-Dzv2dji3E) · [raw](https://github.com/Catalyst-Forge-LLC/forgetrail/blob/main/content/skills/forgetrail/SKILL_FACTS.md)
 
-The MCP server exposes methodology to Cursor, Claude Desktop, Claude Code, Windsurf, and other MCP clients without copying ForgeTrail into the app repo.
+## Development
 
-1. Enable the server ([mcp-server/README.md](mcp-server/README.md)).
-2. Call `getNewProjectKickoff` (or use Genesis + `ingestPlanArtifact` if you already have `docs/GENESIS.md`).
-3. In Phase 1, use `getGreenfieldIntakePrompt` with `getChecklist(before-session-1)` for exports, tenancy, compliance, and hero flow.
-4. Your app repo keeps **your code**, **your docs**, and **`.forgetrail/workflow_tracking.json`**.
-
-### Template-in-repo
-
-1. Copy this folder as `_forgetrail/` (or keep it as a sibling and adjust paths in `INITIAL_PROMPT.md`).
-2. Paste `INITIAL_PROMPT.md` into the first agent chat; fill bracketed placeholders.
-3. Resume later with `CONTINUATION_PROMPT.md`.
-
-### Optional patterns (when your brief needs them)
-
-- **Seed / fixture JSON from any LLM:** [FORGETRAIL_LITE.md](content/FORGETRAIL_LITE.md) §4.3; also WORKFLOW.md Phase 2.
-- **Live web search (Tavily, Brave, …):** [FORGETRAIL_LITE.md](content/FORGETRAIL_LITE.md) §4.4.
-- **LLM-backed content (runtime / build-time / BYO-LLM):** [FORGETRAIL_LITE.md](content/FORGETRAIL_LITE.md) §7.1; local Ollama: §4.8 and [SYSTEM_HEALTH_CHECKS.md](content/SYSTEM_HEALTH_CHECKS.md).
-- **URL import / markup drift:** Lite §7.2; [docs/TECHNICAL_REFERENCE.md](docs/TECHNICAL_REFERENCE.md).
-- **Web app state: local vs accounts:** Lite §7 (A-local vs A-persistent).
-- **Local PocketBase:** port in `.env`; version at install ([ONE_CLICK_DEV_SETUP.md](content/ONE_CLICK_DEV_SETUP.md)).
-- **gstack:** ForgeTrail owns lifecycle; gstack owns sprint skills. WORKFLOW.md §1b.
-- **Propagate lessons back:** [prompts/propagate-to-forgetrail.md](prompts/propagate-to-forgetrail.md); wrap protocol in WORKFLOW.md §1e.
-
----
-
-## What your project looks like
-
-After Phase 2, a typical app repo:
-
-```
-my-app/
-  .forgetrail/
-    workflow_tracking.json   ← Live progress (AI-updated)
-    FORGETRAIL_LITE.md         ← If you used the Try / Lite path
-    IDEAS.md
-  CONTEXT_PROMPT.md
-  docs/
-    GENESIS.md               ← Optional pre-Phase-1 "what, not how" spec
-    PHASE_1_BRIEF.md
-  README.md
-  TODO.md
-  src/
-```
-
-Later phases add docs only when needed (`TECHNICAL_REFERENCE`, `DESIGN_SYSTEM`, `BRAND_AND_PRODUCT`, hardening docs, …).
-
----
-
-## What's in the box
-
-```
-forgetrail/                  ← clone folder; product name is ForgeTrail
-  RESUME.md                ← Resume *this* methodology repo (not an app)
-  TRY_FORGETRAIL.md          ← Human prove-it path (start here)
-  WORKFLOW.md              ← 7-phase lifecycle
-  INITIAL_PROMPT.md        ← App starter prompt (do not use on this repo)
-  CONTINUATION_PROMPT.md   ← App resume prompt (do not use on this repo)
-  site/                    ← forgetrail.dev (FilePress + Wrangler)
-  TRACKING_SCHEMA.md
-  update-log.md
-  content/
-    GENESIS_SPEC_PROMPT.md ← Paste into any LLM chat
-    FORGETRAIL_LITE.md       ← Portable single-file protocol
-    examples/              ← Sample Genesis (Mars roster, fiction)
-  docs/                    ← Phase templates (brief, SPEC_FEATURE_TEMPLATE, audits, …)
-  prompts/                 ← Audits, marketing, propagate-to-forgetrail, …
-  mcp-server/              ← MCP server (see mcp-server/README.md)
-  specs/                   ← ForgeTrail meta-specs (including NUX)
+```bash
+pnpm --dir mcp-server install
+pnpm run mcp:build
+pnpm site:dev
 ```
 
-Doc templates use `[BRACKETED]` placeholders and callouts (💡 lesson, 📝 example, 🔧 guidance). MCP can serve **shell** or **full** mode: [mcp-server/TEMPLATE_STRIPPING.md](mcp-server/TEMPLATE_STRIPPING.md). Methodology is **stack-agnostic**; embedded lessons lean SvelteKit + PocketBase + common LLM providers (including local Ollama).
-
----
-
-## Prerequisites
-
-- **Try path:** any LLM chat + any file-reading coding agent. No Node/MCP required to start.
-- **MCP:** Node.js to run the server; Cursor, Claude Desktop, Claude Code, Windsurf, or other MCP clients.
-- **Lite / full greenfield (when the agent scaffolds):** Git, Node.js 20+, npm, pnpm (Lite §4.1). Phase 2 adds stack-specific checks (PocketBase, Ollama, Playwright, …) per [FORGETRAIL_LITE.md](content/FORGETRAIL_LITE.md) §4.1.2.
-- **gstack (optional):** [gstack](https://github.com/garrytan/gstack) for sprint skills inside ForgeTrail phases.
-
----
-
-## License and support
-
-**Apache License 2.0.** See [LICENSE](LICENSE). Contribute via [CONTRIBUTING.md](CONTRIBUTING.md). Security: [SECURITY.md](SECURITY.md).
+Site (FilePress + docs mount): `pnpm ship`.
 
-**Support:** community best-effort via GitHub issues (including the [Try checklist](https://github.com/Catalyst-Forge-LLC/forgetrail/issues/new?template=try-forgetrail-checklist.md)). No SLA or paid support bundled with the license.
+Apache-2.0 · [Catalyst Forge LLC](https://catalystforge.com)

package/TRY_FORGETRAIL.md

@@ -2,6 +2,8 @@
 
 Prove ForgeTrail in one sitting: write a **what, not how** spec in any AI chat, drop it next to **ForgeTrail Lite**, and let your coding agent forge the path and keep the trail.
 
+**Docs:** [forgetrail.dev/docs](https://forgetrail.dev/docs) (same recipe, plus CLI and MCP).
+
 **You need:** any LLM chat (ChatGPT, Claude, Grok, a local Ollama UI, …) and any coding agent that can read files (Cursor, Claude Code, Codex, …).
 
 **You do not need:** Node MCP setup, `pnpm run mcp:build`, or `forgetrail` on PATH (those are optional shortcuts below).

package/content/cursor-rules/npm-name-hold.mdc

@@ -0,0 +1,23 @@
+---
+description: Reserve an npm name with a throwaway 0.0.0 stub; the user always publishes
+alwaysApply: true
+---
+
+# Initial npm name hold
+
+The **user always publishes**. Never run `npm publish`, `pnpm publish`, or `yarn npm publish`.
+
+**Exception:** LocalHelm / LocalBerth `auth` can put a granular automation token in the **user** `~/.npmrc` (never in a repo). Only those tools may publish, and only when the operator asked (`localhelm publish <id> --apply`). A raw `npm publish` from any other repo is expected to fail (passkey / 2FA) — do not try it, and never print or copy the token.
+
+When they want to grab an unscoped name before the package is real:
+
+1. Do **not** publish from the app repo. That ships `dist/`, source maps, fixtures, or a `prepublishOnly` build.
+2. Create a **throwaway directory outside git** (`mktemp -d`).
+3. Write only:
+   - `package.json`: `name`, `version` `0.0.0`, `description` `"Name hold."`, `license`, `private: false`, `publishConfig.access: public`. No homepage, bin, files, deps, or repository.
+   - optional one-line `README.md`: `Name hold.`
+4. Run `npm pack --dry-run` (expect 2–3 files). Show the listing and the exact `npm publish --access public` command for **them** to run in that directory.
+5. Leave the stub in place until they publish, then they can delete it.
+6. Leave the repo at `0.0.0`. The **first real release bumps** (0.0.1 or 0.1.0). `0.0.0` is spent.
+
+This is a name stake, not a product release.

package/content/cursor-rules/writing-voice.mdc

@@ -0,0 +1,33 @@
+---
+description: Brand voice and positioning-spine rules for all user-facing copy, marketing, and long-form narrative
+alwaysApply: true
+---
+
+# Writing Voice and Theme
+
+Fill the bracketed placeholders once brand voice crystallizes (usually after several tone passes), then keep this rule always-applied so sessions audit copy against it instead of re-litigating tone. Methodology: ForgeTrail `docs/BRAND_AND_PRODUCT.md` → *Positioning spine (theme lock)*.
+
+## The positioning spine
+
+**[ONE SENTENCE: what the product supplies, and what it never claims about the user.]**
+
+- The product supplies **[infrastructure / tooling / leverage — name it]**. It does **not** improve, transform, or elevate the person.
+- **Banned:** person-transformation framing ("from [lesser] to [greater]", "makes you sound [status]"). For expert audiences, competence is assumed and demonstrated, never defended.
+- Craft metaphors aim at the **materials**, or strengthen what already exists (temper, steel) — never create the person.
+- **Assure the standard, never guarantee the outcome.** No result promises ([offers, interviews, rankings — name the domain's outcome]).
+- Signature line(s): **[LOCKED SIGNATURE + where it may appear]**. Read every signature at skim speed; if the wrong noun can catch the blame or the claim, rewrite so the absence/gap carries it.
+
+## Hard beats
+
+- No anxiety-dwelling, panic, survival framing, or "you're falling behind" pressure in user-facing copy.
+- **Reality-check beats are allowed** ([domain facts: long timelines, fixed budgets — name them]) when framed as **fact and terrain, never grievance**. Land every hard beat on agency, standard, or momentum.
+
+## Register
+
+- **[NAME THE REGISTER — e.g. polished Gen-X, plainspoken trade, clinical].** Fluid sentences over staccato fragment reveals; understated confidence over declarative punches; short-sentence pairs reserved for locked signatures.
+- **Ban vague nouns** in marketing and narrative copy: "something," "stuff," "things" (fine in error strings). Name the thing.
+- **Ban squish intensifiers:** "strongly," "deeply," "easily," "incredibly," "very." If the sentence needs the intensifier, rewrite the sentence.
+
+## Named-person constraints (narratives)
+
+If real people appear in origin/brand narratives, record their hard constraints here (employer safety, public roles, verb restrictions like "no founder verbs for X") and audit after every pass. Keep narrative locks in a constraints file next to the long-form (LOCKED FRAMING / ARC / VOICE pattern).

package/content/skills/forgetrail/SKILL_FACTS.md

@@ -0,0 +1,97 @@
+---
+skill_facts_version: "0.1.0"
+name: forgetrail
+developer: Catalyst Forge
+version: "0.3.0"
+status: active
+license: Apache-2.0
+kind: cursor-skill
+purpose: "Enforce the ForgeTrail 7-phase lifecycle and maintain .forgetrail/workflow_tracking.json as the system of record"
+homepage: https://forgetrail.dev
+repository: https://github.com/Catalyst-Forge-LLC/forgetrail
+provenance:
+  source: https://github.com/Catalyst-Forge-LLC/forgetrail
+  publisher: Catalyst Forge
+instructions_reach:
+  shell: explicit
+  network: implied
+  filesystem: read-write
+tools_referenced:
+  - https://github.com/Catalyst-Forge-LLC/forgetrail/blob/main/mcp-server/TOOL_FACTS.md
+  - getPhaseGuidance
+  - runAudit
+  - searchLessons
+  - validateTracking
+  - suggestSubagentDecomposition
+  - getTemplate
+  - getNewProjectKickoff
+  - getResumeSessionInstructions
+bundled_artifacts:
+  []
+egress:
+  telemetry: none
+  destinations: []
+generated:
+  date: 2026-08-20
+  generator: hand-authored
+credits:
+  generated_with: https://skillfacts.dev
+  built_by: "Catalyst Forge - https://www.catalystforge.com/"
+---
+
+# Skill Facts - forgetrail
+
+| | |
+|---|---|
+| **Developer** | Catalyst Forge |
+| **Version** | 0.3.0 |
+| **Status** | active |
+| **License** | Apache-2.0 |
+| **Kind** | cursor-skill |
+
+*Lifecycle playbook with explicit shell and read-write filesystem reach. Points at ForgeTrail MCP ToolFacts.*
+
+## Purpose
+
+Enforce the ForgeTrail 7-phase lifecycle and maintain .forgetrail/workflow_tracking.json as the system of record
+
+## Provenance
+
+| | |
+|---|---|
+| Source | https://github.com/Catalyst-Forge-LLC/forgetrail |
+| Publisher | Catalyst Forge |
+
+## Instructions reach
+
+| | |
+|---|---|
+| Shell | explicit |
+| Network | implied |
+| Filesystem | read-write |
+
+## Tools referenced
+
+- https://github.com/Catalyst-Forge-LLC/forgetrail/blob/main/mcp-server/TOOL_FACTS.md
+- getPhaseGuidance
+- runAudit
+- searchLessons
+- validateTracking
+- suggestSubagentDecomposition
+- getTemplate
+- getNewProjectKickoff
+- getResumeSessionInstructions
+
+## Bundled artifacts
+
+(none)
+
+## Egress
+
+| | |
+|---|---|
+| Telemetry | none |
+| Destinations | (none) |
+
+---
+*Generated with [SkillFacts](https://skillfacts.dev) · Built by [Catalyst Forge](https://www.catalystforge.com/)*

package/docs/BRAND_AND_PRODUCT.md

@@ -205,6 +205,26 @@ When the product produces **cover letters**, **outreach**, or other **persuasive
 >
 > 💡 **Lesson learned:** **Anti-self-importance and position-of-strength rules prevent grandiose and striving registers.** When generating outbound copy representing the user, explicitly instruct the LLM to write in a plain, confident, and professional tone. Ban grandiose framing of routine work, visionary self-positioning, analytical flattery, name-dropping by negation, performative specificity, and modifier stacking. Enforce a "position of strength" posture: ban mirroring the job description as proof of fit, delivering maxims/theses as quotable wisdom, branding ordinary habits as named methods, using striving/grind vocabulary, and using rhetorical scaffolding, self-narration, or clever self-authored aphorisms. Let the facts of what the user built carry the weight directly.
 
+### Positioning spine (theme lock)
+
+When brand copy has been through several tone passes and still drifts, stop editing lines and converge on a **single positioning spine**: one sentence stating what the product supplies and what it never claims about the user. Then codify it as an **always-apply agent rule** (e.g. `.cursor/rules/writing-voice.mdc`) so future sessions audit against it instead of re-litigating tone. Every marketing surface either serves the spine or gets rewritten.
+
+> 📝 **Example:** An expert-audience product locked: "What's missing is never the person; it is the tooling available to them." Competence is assumed and demonstrated; the product supplies infrastructure that carries operational weight across months.
+
+> 💡 **Lesson learned:** **Ban person-transformation framing for expert audiences.** Taglines shaped like "from [lesser status] to [greater status]" imply the user lacked the status before buying — the opposite of an infrastructure positioning, and quietly condescending to the exact buyer you want. If the brand uses a craft metaphor, aim it at the **materials** or pick a verb that strengthens what already exists (temper/steel metal that is already steel), never one that creates the person. Corollary: **assure the standard, never guarantee the outcome** — no offer/interview/result promises (a legal-safety rule as much as a tone rule).
+
+> 💡 **Lesson learned:** **Signature lines must survive a fast read.** A punchy short-sentence signature can misparse at skim speed (e.g. "The raw material was never the problem. The foundry was." reads on a fast pass as blaming the foundry itself). Read every locked signature the way a skimmer would; if the wrong noun can attach to the blame or the claim, rewrite so the **absence** or the **gap** carries it ("What was missing was a foundry equal to it").
+
+> 💡 **Lesson learned:** **Reality-check beats are allowed; grievance is not.** Hard domain facts (long timelines, life not pausing, fixed runways) build trust when framed as terrain that the product prices in, and read as fear-marketing when framed as complaint or dwelled on. Land every hard beat on agency, standard, or momentum — never on the user's anxiety.
+
+> 💡 **Lesson learned:** **Staccato fragment cadence reads as LinkedIn-post voice.** ("Not the market. Not my record. The process.") For senior audiences, fold the punches into subordinate clauses and reserve short-sentence pairs for one or two locked signatures. In the same register pass, ban vague nouns ("something," "stuff") and squish intensifiers ("strongly," "deeply," "incredibly") from marketing prose — if a sentence needs the intensifier, the sentence is not done.
+
+### Long-form origin narrative (constraints file)
+
+A founder/origin narrative that goes through multiple refinement passes needs a **constraints file next to the narrative** (e.g. `ORIGIN_STORY_NOTES.md`) holding **LOCKED FRAMING** (hard constraints), the **ARC** (beat list), and **VOICE** rules. Without it, each pass re-litigates settled decisions and retired beats creep back. Record each pass as a dated addendum in the source spec so the "why" behind every lock survives the sessions that made it.
+
+> 💡 **Lesson learned:** **People named in a narrative may carry constraints the copy must obey** — a current employer, a public role, a legal sensitivity. Write those down as **hard rules**, not tone preferences ("no founder/builder verbs for X," "the search is presented as past fact with no cause given"), and audit the full piece against them after every pass. A narrative that is compelling but gets a named person in trouble is a failed narrative.
+
 ### Assertive product voice (no hedging *can*)
 
 Marketing, help, onboarding, and feature descriptions should state **what the product does** in the present tense with direct verbs — not tentative capability language.

package/docs/CONTEXT_PROMPT.md

@@ -295,7 +295,9 @@ _Proven patterns from this project that Claude should replicate when building ne
 - **Factual grounding and veracity checks:** When generating tailored documents (cover letters, statements of interest, custom pitches) representing the user, always pass the full verbatim text of their source document of record (e.g. base resume) directly in the prompt to prevent the model from inventing credentials or metrics. Run a fast, cheap semantic veracity pass immediately after generation to flag ungrounded claims in the UI with exact excerpts, reasons, and suggested repairs. WHY: Prevents hallucinated claims from leaking into final submissions and establishes user trust.
 - **Anti-self-importance and position-of-strength posture:** When generating outbound copy representing the user (such as cover letters or outreach), explicitly prompt the LLM to write in a plain, confident, and professional tone. Ban grandiose framing, visionary self-positioning, analytical flattery, name-dropping by negation, performative specificity, and modifier stacking. Enforce a "position of strength" posture: ban mirroring the job description as proof of fit, delivering maxims/theses as quotable wisdom, branding ordinary habits as named methods, using striving/grind vocabulary, and using rhetorical scaffolding, self-narration, or clever self-authored aphorisms. Let the facts of what was built carry the weight directly. WHY: Prevents the output from sounding like a typical "LLM-generated" brag sheet and establishes professional credibility.
 - **Assertive product voice in copy modules:** When writing marketing, help, onboarding, or API prerequisite strings, describe **shipped capabilities** with direct present-tense verbs (`strengthens`, `suggests`, `keeps`) — not hedging **can** (`can strengthen`, `can suggest`). Reserve **can** for user options, factual extraction limits, or people. Grep `\bcan\b` after landing/how-it-works edits. WHY: Hedged capability copy undercuts premium positioning and drifts back in via LLM-generated strings if prompts use the same hedge.
+- **Positioning spine as an always-apply rule file:** Once brand voice and theme crystallize (usually after several tone passes), write them into an always-apply agent rule (e.g. `.cursor/rules/writing-voice.mdc`): the one-sentence positioning spine, banned framings, register rules, and locked signature lines. Audit copy surfaces against the rule after marketing edits. WHY: Voice decisions made across many sessions evaporate without a rule file; each new session reinvents tone and reintroduces retired framings. See `docs/BRAND_AND_PRODUCT.md` → *Positioning spine (theme lock)*.
 - **Progressive async UI: snapshot callbacks before close/unmount:** When a modal or panel calls `onClose()` (or unmounts) mid-flight but an async finalize step still needs parent callbacks (`onComplete`, `onFailed`, import hooks), **capture callback refs in locals before the first `await`**. Parent props can be stale after unmount. WHY: Silent finalize failures and “stuck importing” states when the initiating surface disappears while work continues.
+- **npm name hold from a throwaway folder:** To reserve an unscoped name before the product exists, prepare `0.0.0` in a temp directory (`package.json` with `description: "Name hold."`, one-line README, no homepage/bin/deps). The **operator** runs `npm publish`. Agents never publish, except LocalHelm / LocalBerth after `auth` when the operator asked for a named `--apply`. A raw `npm publish` is expected to fail (passkey / 2FA). Token stays in user `~/.npmrc`, never in a repo. See `content/cursor-rules/npm-name-hold.mdc`. WHY: A repo `prepublishOnly` build ships `dist/` when all you wanted was the name; publishing is a human gate.
 
 ## Anti-Patterns to Avoid
 
@@ -309,6 +311,7 @@ _Things we tried that failed. Claude should NOT repeat these._
 > - Don't zero out list or plan quotas to block **new** creation if that also hides existing records or breaks list/detail views. Preserve read/list headroom for legacy data; block creation with an explicit plan flag, feature gate, or server check instead.
 > - Don't maintain a persistent free tier with non-zero limits. It creates a leaky bucket where trial users settle into free usage and never convert. Instead, expire accounts to zero limits after trial and offer a low-cost Hold tier for data preservation. The "expired" state with a retention window (e.g., 30 days) creates urgency without being punitive.
 > - Don't bury usage counts only in billing/settings pages. Users hit limit errors with no warning. Place inline usage indicators adjacent to each feature's trigger so remaining capacity is visible before they act.
+> - Don't sell expert-audience products with person-transformation taglines ("from [lesser status] to [greater status]", "makes you sound senior"). The buyer already holds the status; the product supplies infrastructure. Aim craft metaphors at the materials, and assure the standard rather than guarantee the outcome. See `docs/BRAND_AND_PRODUCT.md` → *Positioning spine (theme lock)*.
 > - **Don't use a `fixed inset-0` backdrop div for click-outside detection when any ancestor has `backdrop-filter`.** The backdrop becomes scoped to the ancestor's bounds, not the viewport. Discovered when `<nav class="backdrop-blur-sm">` caused the menu backdrop to only cover the navbar, letting all page-content clicks pass through. Use the document `pointerdown` pattern instead (see Patterns to Follow).
 > - **Don't delete parents before dependents when relations are required.** A 500 "record is part of a required relation" (common in BaaS like PocketBase) means a child still referenced a removed parent. Map referencing collections and delete leaf records first.
 > - **Don't assume `deleteRule: null` means "everyone" in PocketBase.** It means superusers only. Set explicit delete rules in migrations/setup; otherwise production 403s masquerade as auth bugs.
@@ -318,6 +321,7 @@ _Things we tried that failed. Claude should NOT repeat these._
 > - **Don't expose backend service names in user-facing error messages.** "Is PocketBase running?" or "Supabase connection failed" means nothing to users and leaks implementation details. Catch blocks in auth flows are the most visible — they're the first thing new users see when something goes wrong. Use plain-language alternatives: "Something went wrong. Check your connection and try again."
 > - **Don't use `hostname.includes('brand.com')` (or full-URL `includes`) for security-ish host allow/deny.** Substring matches accept lookalikes and trip CodeQL incomplete-URL-substring alerts en masse. Use suffix-safe host helpers; never return `err.stack` or raw exception text in HTTP JSON to clients.
 > - **Don't classify IP ranges by string prefix or exact equality.** `host === '127.0.0.1'` leaves the rest of `127/8`; string prefixes miss IPv4-mapped IPv6 (`::ffff:7f00:1`) and trailing-dot hosts (`localhost.`). Compare numerically after normalizing the host, and cover each blocked class with a test that fails against the old guard.
+> - **Don't publish the app repo to reserve an npm name.** That is a product snapshot, not a stake. Use a throwaway `0.0.0` stub (`content/cursor-rules/npm-name-hold.mdc`).
 > - **Don't parallelize many SDK list/read calls to the same collection through one client instance** without addressing library auto-cancellation (see Critical Patterns → PocketBase JS SDK). Symptom: aborted requests, empty nested arrays on list endpoints, data “missing” after refresh while single-record fetches still work.
 > - **Don't apply page-load–era rate limits to SPAs without retuning.** Navigations fire parallel data fetches; limits that suit one-document-per-request stacks may starve a SPA. Raise general API caps and reserve tight limits for genuinely expensive endpoints (LLM, scraping, bulk export), tuned from real session traces.
 > - **Don't duplicate policy numbers** (trial days, usage-period days, per-tier caps, trial download limits) across auth hooks, entitlements, export routes, and setup scripts. Extract named constants and one shared day-length helper; mirror literals in non-TS scripts only with an explicit sync comment pointing at the canonical module.

package/docs/NPM.md

@@ -2,6 +2,10 @@
 
 You run `pnpm publish`. The gate does not log in or publish.
 
+**Name hold (any new unscoped package):** do not publish the app repo. Prepare `0.0.0` in a throwaway folder (`package.json` + one-line README, description `Name hold.`, no homepage). **You** run `npm publish`. Agents never publish. Rule: `content/cursor-rules/npm-name-hold.mdc`. First real release bumps.
+
+---
+
 Two public unscoped packages:
 
 | Package | Version | From | What it is |
@@ -38,24 +42,28 @@ pnpm run pack:check
 pnpm publish --dry-run --access public
 pnpm publish --access public
 
-# 3. MCP server (prepublishOnly runs tsc)
-pnpm --dir mcp-server publish --dry-run --access public
-pnpm --dir mcp-server publish --access public
+# 3. MCP server — cd in. Do not use `pnpm --dir mcp-server publish`.
+# npm 12 treats leftover `--dir` tokens as extra package-specs and exits EUSAGE.
+cd mcp-server
+pnpm publish --access public
+cd ..
 ```
 
 `prepublishOnly` on the root re-runs the pack check. It refuses `private: true` and a tarball that includes `site/` or `specs/`.
 
+The `Debugger listening` line on MCP `prepack` is Cursor attaching to a one-line `node -e`. It is harmless. Do not let it rewrite the publish command.
+
 ---
 
 ## After publish (verify)
 
 ```bash
-# fresh npx, not your clone
-npx --yes forgetrail@0.3.0 --help
-npx --yes forgetrail@0.3.0 install --lite --dry-run
+# Prefer pnpm dlx. npm 12 `npx forgetrail --help` on Windows failed to spawn the bin.
+pnpm dlx forgetrail@0.3.0 --help
+pnpm dlx forgetrail@0.3.0 install --lite --dry-run
 
 # MCP starts; needs content via FORGETRAIL_ROOT or a sibling forgetrail install
-npx --yes forgetrail-mcp@0.2.2
+pnpm dlx forgetrail-mcp@0.2.2
 ```
 
 Optional Cursor MCP (content from a `forgetrail` install, or set the path):

package/package.json

@@ -1,68 +1,69 @@
-{
-  "name": "forgetrail",
-  "version": "0.3.0",
-  "private": false,
-  "description": "ForgeTrail: a persistent development system for building software with AI agents. CLI, Lite protocol, and methodology templates.",
-  "license": "Apache-2.0",
-  "type": "module",
-  "bin": {
-    "forgetrail": "./scripts/forgetrail-cli.mjs"
-  },
-  "files": [
-    "scripts/",
-    "content/",
-    "docs/",
-    "prompts/",
-    "WORKFLOW.md",
-    "TRACKING_SCHEMA.md",
-    "workflow_tracking.json",
-    "INITIAL_PROMPT.md",
-    "CONTINUATION_PROMPT.md",
-    "TRY_FORGETRAIL.md",
-    "README.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=20"
-  },
-  "keywords": [
-    "forgetrail",
-    "mcp",
-    "ai-agents",
-    "cursor",
-    "claude",
-    "methodology",
-    "lite"
-  ],
-  "author": {
-    "name": "Catalyst Forge LLC",
-    "url": "https://catalystforge.com"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Catalyst-Forge-LLC/forgetrail.git"
-  },
-  "bugs": {
-    "url": "https://github.com/Catalyst-Forge-LLC/forgetrail/issues"
-  },
-  "homepage": "https://forgetrail.dev",
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "install:forgetrail": "node scripts/install-forgetrail.mjs",
-    "install:lite": "node scripts/install-forgetrail-lite.mjs",
-    "link:global": "node scripts/link-global.mjs",
-    "mcp": "node scripts/mcp-status.mjs dev",
-    "mcp:build": "node scripts/mcp-status.mjs build",
-    "mcp:status": "node scripts/mcp-status.mjs status",
-    "mcp:ping": "node scripts/mcp-status.mjs ping",
-    "mcp:cursor-config": "node scripts/mcp-status.mjs cursor-config",
-    "mcp:inspector": "node scripts/mcp-status.mjs inspector",
-    "ship": "pnpm --dir site run ship",
-    "site:dev": "pnpm --dir site dev",
-    "site:build": "pnpm --dir site run build",
-    "site:deploy": "pnpm --dir site run ship",
-    "pack:check": "node scripts/publish-gate.mjs"
-  }
-}
+{
+  "name": "forgetrail",
+  "version": "0.4.1",
+  "private": false,
+  "description": "ForgeTrail: a persistent development system for building software with AI agents. CLI, Lite protocol, and methodology templates.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "bin": {
+    "forgetrail": "./scripts/forgetrail-cli.mjs"
+  },
+  "files": [
+    "scripts/",
+    "content/",
+    "docs/",
+    "prompts/",
+    "WORKFLOW.md",
+    "TRACKING_SCHEMA.md",
+    "workflow_tracking.json",
+    "INITIAL_PROMPT.md",
+    "CONTINUATION_PROMPT.md",
+    "TRY_FORGETRAIL.md",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "install:forgetrail": "node scripts/install-forgetrail.mjs",
+    "install:lite": "node scripts/install-forgetrail-lite.mjs",
+    "link:global": "node scripts/link-global.mjs",
+    "mcp": "node scripts/mcp-status.mjs dev",
+    "mcp:build": "node scripts/mcp-status.mjs build",
+    "mcp:status": "node scripts/mcp-status.mjs status",
+    "mcp:ping": "node scripts/mcp-status.mjs ping",
+    "mcp:cursor-config": "node scripts/mcp-status.mjs cursor-config",
+    "mcp:inspector": "node scripts/mcp-status.mjs inspector",
+    "ship": "pnpm --dir site run ship",
+    "site:dev": "pnpm --dir site dev",
+    "site:build": "pnpm --dir site run build",
+    "site:deploy": "pnpm --dir site run ship",
+    "pack:check": "node scripts/publish-gate.mjs",
+    "prepublishOnly": "node scripts/publish-gate.mjs"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "forgetrail",
+    "mcp",
+    "ai-agents",
+    "cursor",
+    "claude",
+    "methodology",
+    "lite"
+  ],
+  "author": {
+    "name": "Catalyst Forge LLC",
+    "url": "https://catalystforge.com"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Catalyst-Forge-LLC/forgetrail.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Catalyst-Forge-LLC/forgetrail/issues"
+  },
+  "homepage": "https://forgetrail.dev",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/prompts/propagate-to-forgetrail.md

@@ -98,6 +98,7 @@ Run after meaningful implementation work **and** after substantive **documentati
 | **`.cursor/rules/` git / commit policy** | e.g. `git-user-commits.mdc`, `commit-messages.mdc` — keep **this repo’s** `.cursor/rules/` aligned with your app when you propagate workflow changes: **end of each request**, stage only paths from that request and **commit** with message from **`git diff --staged`** (multi-line body by default); push remains explicit-only. |
 | **Microcopy centralization completed or copy-module pattern adopted** | **`prompts/microcopy-centralization.md`**, **`docs/TECHNICAL_REFERENCE.md`** § User-facing copy, **`docs/CODE_QUALITY.md`** audit checklist, **`docs/BRAND_AND_PRODUCT.md`** duplication policy, **`docs/CONTEXT_PROMPT.md`**, **`.cursor/rules/user-facing-content.mdc`**, **`.cursor/rules/us-english.mdc`**, **`content/cursor-rules/`** mirrors — generalize patterns only, not app-specific strings. |
 | **Assertive product voice / hedging *can* removed from capability copy** | **`.cursor/rules/user-facing-content.mdc`** (Assertive capability copy), **`docs/BRAND_AND_PRODUCT.md`** (We say / We don't say table), **`docs/CONTEXT_PROMPT.md`**, **`docs/CODE_QUALITY.md`** pre-launch grep, **`docs/TEST_PLAN.md`** §4.5; MCP **`cursor-rules/`** mirror. |
+| **Brand theme / positioning spine crystallized** (voice rule file, banned framings, signature-line system, origin-narrative constraints) | **`docs/BRAND_AND_PRODUCT.md`** → *Positioning spine (theme lock)* + *Long-form origin narrative (constraints file)*; **`docs/CONTEXT_PROMPT.md`** pattern + anti-pattern; **`content/cursor-rules/writing-voice.mdc`** template. |
 | **Structured eligibility or requirement fit** (education, clearance, license, work auth — taxonomy + extraction + badges + filters + LLM context) | **`docs/TECHNICAL_REFERENCE.md`** → *[Structured eligibility / requirement fit]* stub; **`docs/TEST_PLAN.md`** §4.6; **`docs/BRAND_AND_PRODUCT.md`** one-line declare-once lesson; do **not** copy domain-specific enums/regex. |
 | **App-owned transactional email or documented deletion lifecycle** | Central outbound module (BaaS/auth SMTP vs product mail), env vars, webhook idempotency, DNS/SPF/DKIM; **TECHNICAL_REFERENCE** data-model subsection for cascade vs soft delete and orphan risks — also **DEPLOYMENT**, **TEST_PLAN**, **CONTEXT_PROMPT**, **pre-launch-audit**, **WORKFLOW** cross-checks. |
 | **`docs/DEV_ESTIMATE.md` materially updated** | Inventory methodology (LOC, route modules), hour bands, or US cost scenarios → align ForgeTrail **`docs/DEV_ESTIMATE.md`** generalized placeholders and guidance. |