paperlint 12.0.0 → 13.0.0

package/presets/agentverify.md

@@ -0,0 +1,85 @@
+---
+title: "AGENTVERIFY @ ICSE — venue card"
+---
+
+# AGENTVERIFY @ ICSE
+
+The card of the venue preset `paperlint:agentverify` ([`agentverify.jsonc`](agentverify.jsonc)):
+what the venue asks for, in prose. The numbers a machine checks live in the preset; the section at
+the end is generated from it. The `submit-paper` skill reads this card for the venue's specifics.
+
+**Re-verify the call for papers every year**
+([agentverify2027.github.io/cfp.html](https://agentverify2027.github.io/cfp.html)). Sources read
+2026-10-26: that page, [the home page](https://agentverify2027.github.io/), the portal's
+[deadlines page](https://icse2027-agentverify.hotcrp.com/deadlines), and the
+[ICSE 2027 workshops page](https://conf.researchr.org/track/icse-2027/icse-2027-workshops). The
+researchr page `conf.researchr.org/home/agentverify-2027` only redirects to the workshop's site.
+
+## The venue (2027 edition)
+
+- **Venue**: Workshop on Infrastructure for Trustworthy Software Agents, an ICSE 2027 workshop,
+  Sun 25 April 2027, Dublin.
+- **Portal**: HotCRP, `https://icse2027-agentverify.hotcrp.com/` («Submit Your Paper →»).
+- **Format and review**: «Papers will be submitted via HotCRP and reviewed double-blind.
+  Submissions should follow the IEEE format in line with ICSE 2027 and present an original
+  contribution.» The portal's status data carries `"blind":true`. No class line is given, so the
+  preset keeps the family's `\documentclass[conference]{IEEEtran}`.
+- **Publisher**: «Accepted papers will appear in the ICSE 2027 workshop proceedings by default.»
+  The ICSE workshops page: «The workshop papers will be published by the IEEE.» The CFP does not
+  say what a non-default route would be, or whether it is archival.
+- **Presenting**: «At least one author of each accepted paper must register and present.»
+- **Deadlines (AoE)**: submission 13 Nov 2026, reviews due 5 Dec, final notification 11 Dec 2026,
+  camera-ready 29 Jan 2027.
+
+## 🔴 The submission deadline moved
+
+The organizers' email of 2026-10-23 (as received by an author; the email itself is not public):
+
+> The submission deadline for AGENTVERIFY 2027 has been updated to November 13, 2026. We do not
+> have a separate abstract submission deadline.
+
+Source: **organizers' email, 2026-10-23**. On 2026-10-26 every public source agreed with it: the
+CFP, the home page («Papers are due November 13th, 2026 (AoE)»), the ICSE workshops page («Workshop
+Papers Submission Deadline for all Workshops: 13 November 2026») and the portal (`"sub":1794657599`,
+2026-11-14T11:59:59Z). None of the pages read showed 6 November. If a cached copy of any of them
+does, the email and the live pages win.
+
+## Paper kinds and limits
+
+| kind       | pages | the call's words                                                                                                                        |
+| ---------- | ----: | --------------------------------------------------------------------------------------------------------------------------------------- |
+| `full`     |     8 | «Full Papers: Maximum of 8 pages, including references.»                                                                                |
+| `short`    |     4 | «Short & Demonstration Papers: Maximum of 4 pages, including references.»                                                               |
+| `abstract` |     2 | «Extended Abstracts: Maximum of 2 pages, including references.» They «are free of APC charges and will be included in the proceedings.» |
+
+🔴 **Every limit is a total, references included.** `format/page-limit` can only compare banal's
+body count with the number, so references standing alone on a page after a full body pass the rule
+and are over the limit. Count the PDF's pages yourself before submitting.
+
+## What else the preset encodes
+
+- **The IEEE template**, through `extends: paperlint:ieee-conference` ([`ieee-conference.md`](ieee-conference.md)).
+- **Double-blind review** (`blind`), so `anonymity/identity` checks the PDF against the paper's
+  declared `identity`.
+- **Portal and deadlines**: the submission reading is the portal's, refreshed by paperlint's
+  scheduled workflow; notification and camera-ready are the site's. No `registration`: there is no
+  abstract deadline.
+
+## Not verified
+
+- **Remote presentation**: not stated (only «must register and present»).
+- **Archival / non-archival choice**: «by default» suggests an alternative; none is described.
+- **AI / LLM usage policy and required sections**: none stated.
+
+## What the preset resolves to
+
+<!-- paperlint:preset-rules -->
+<!-- prettier-ignore-start -->
+<!-- Generated from agentverify.jsonc by `npx eslint --fix` (rule preset/card-rules). Edit the preset, not this section. -->
+
+**`paperlint:agentverify`** — venue preset for AGENTVERIFY · call for papers: <https://agentverify2027.github.io/cfp.html> · extends `paperlint:ieee-conference`
+
+No preset of this chain sets a rule: under it, every rule keeps paperlint's default.
+
+<!-- prettier-ignore-end -->
+<!-- /paperlint:preset-rules -->

package/presets/ieee-conference.md

@@ -30,7 +30,7 @@ versions. `compsoc` changes the text block and the headings, and nothing the `pd
 <!-- prettier-ignore-start -->
 <!-- Generated from ieee-conference.jsonc by `npx eslint --fix` (rule preset/card-rules). Edit the preset, not this section. -->
 
-**`paperlint:ieee-conference`** — template family, no venue of its own · extended by `paperlint:aidc`, `paperlint:msr`
+**`paperlint:ieee-conference`** — template family, no venue of its own · extended by `paperlint:agent`, `paperlint:agentverify`, `paperlint:aidc`, `paperlint:msr`, `paperlint:nlbse`
 
 No preset of this chain sets a rule: under it, every rule keeps paperlint's default.
 

package/presets/nlbse.jsonc

@@ -0,0 +1,76 @@
+// NLBSE 2027 (the 6th Natural Language-based Software Engineering Workshop, an ICSE 2027 workshop)
+// — a VENUE preset over the IEEE conference family. Everything the IEEEtran template decides comes
+// from ieee-conference.jsonc; this file adds what NLBSE's call sets. Its card, in prose:
+// `nlbse.md` beside this file.
+//
+// Verbatim from https://conf.researchr.org/home/icse-2027/nlbse-2027 (fetched 2026-10-26):
+//   «Full papers (maximum of 8 pages, including references).» · «Education tools and materials
+//    (maximum of 8 pages, including references).» · «Replication Studies and Negative results
+//    (maximum of 8 pages, including references).» · «Short and demonstration papers (maximum of 4
+//    pages, including references).» · «Position papers (maximum of 2 pages, including
+//    references).» · «Tool Competition entries (maximum of 4 pages, including references).»
+//   «All submissions must conform to the ICSE’27 formatting and submission instructions. All
+//    submissions must be anonymized, in PDF format and should be performed electronically through
+//    HotCRP: https://icse2027-nlbse.hotcrp.com/.»
+//   Dates: «Fri 13 Nov 2026 (updated) Paper submission / Fri 27 Nov 2026 (new) Tool
+//    competition/Research challenge paper submission / Fri 11 Dec 2026 Author notification / Fri
+//    29 Jan 2027 Camera ready», «All dates are Anywhere on Earth (AoE).»
+{
+  "type": "venue",
+  "name": "NLBSE",
+  // The call quoted above.
+  "url": "https://conf.researchr.org/home/icse-2027/nlbse-2027",
+  "extends": "paperlint:ieee-conference",
+
+  // «All submissions must be anonymized» (the call above), and `"blind":true` in the portal's
+  // status data (https://icse2027-nlbse.hotcrp.com/deadlines, read 2026-10-26). The call never
+  // says «double-blind»; anonymity/identity then requires the paper's `identity`.
+  "blind": true,
+
+  // «should be performed electronically through HotCRP» (the call above).
+  "portal": { "kind": "hotcrp", "url": "https://icse2027-nlbse.hotcrp.com" },
+
+  // 🔴 THE PORTAL HOLDS NO DEADLINE YET: on 2026-10-26 its status data read `"sub":{"open":false}`
+  // with no date, while the call lists 13 Nov. So these are the call's readings, in UTC at the end
+  // of the AoE day; the refresh adds the portal's the day it publishes one (the earlier binds).
+  // The competition papers' 27 Nov is in the card only: one reading per kind and source.
+  "deadlines": [
+    {
+      "what": "submission",
+      "at": "2026-11-14T11:59:59Z",
+      "source": "call",
+      "url": "https://conf.researchr.org/home/icse-2027/nlbse-2027",
+      "read": "2026-10-26",
+    },
+    {
+      "what": "notification",
+      "at": "2026-12-12T11:59:59Z",
+      "source": "call",
+      "url": "https://conf.researchr.org/home/icse-2027/nlbse-2027",
+      "read": "2026-10-26",
+    },
+    {
+      "what": "camera-ready",
+      "at": "2027-01-30T11:59:59Z",
+      "source": "call",
+      "url": "https://conf.researchr.org/home/icse-2027/nlbse-2027",
+      "read": "2026-10-26",
+    },
+  ],
+
+  "format": {
+    // 🔴 EVERY LIMIT INCLUDES THE REFERENCES, and no key gates a total: `body_pages_max` is banal's
+    // body count, never more than the total, so a paper over it is over the limit; references alone
+    // on a page after a full body pass this gate and are still over (nlbse.md). The competition
+    // papers' «2-4 pages» (Multitask Code Classification) does not say whether references count, so
+    // only the call's «Tool Competition entries» line is a kind; the research challenge has no limit.
+    "kinds": {
+      "full": { "body_pages_max": 8 },
+      "education": { "body_pages_max": 8 },
+      "replication": { "body_pages_max": 8 },
+      "short": { "body_pages_max": 4 },
+      "position": { "body_pages_max": 2 },
+      "tool-competition": { "body_pages_max": 4 },
+    },
+  },
+}

package/presets/nlbse.md

@@ -0,0 +1,85 @@
+---
+title: "NLBSE @ ICSE — venue card"
+---
+
+# NLBSE @ ICSE
+
+The card of the venue preset `paperlint:nlbse` ([`nlbse.jsonc`](nlbse.jsonc)): what the venue asks
+for, in prose. The numbers a machine checks live in the preset; the section at the end is generated
+from it. The `submit-paper` skill reads this card for the venue's specifics.
+
+**Re-verify the call for papers every year**
+([conf.researchr.org/home/icse-2027/nlbse-2027](https://conf.researchr.org/home/icse-2027/nlbse-2027)).
+Sources read 2026-10-26: that page, the portal's
+[deadlines page](https://icse2027-nlbse.hotcrp.com/deadlines), and the
+[ICSE 2027 workshops page](https://conf.researchr.org/track/icse-2027/icse-2027-workshops).
+
+## The venue (2027 edition)
+
+- **Venue**: The 6th Natural Language-based Software Engineering Workshop, an ICSE 2027 workshop,
+  Sun 25 April 2027, Dublin. «NLBSE 2027 is sponsored by ACM SIGSOFT and IEEE-CS TCSE.»
+- **Portal**: HotCRP, `https://icse2027-nlbse.hotcrp.com/`.
+- **Format**: «All submissions must conform to the ICSE’27 formatting and submission instructions.»
+  No template or class line is named on the page; the ICSE 2027 workshops page says «The workshop
+  papers will be published by the IEEE.» and links the IEEE templates only for workshop proposals.
+  The preset keeps the family's `\documentclass[conference]{IEEEtran}`, an inference, not a quote.
+- **Review**: «All submissions must be anonymized, in PDF format». The call never says single- or
+  double-blind; the portal's status data carries `"blind":true`, which the preset follows.
+- **Publisher**: the call says only «The accepted submissions will be published in the workshop
+  proceedings.» (tool competitions) and «Accepted papers will appear in the NLBSE ’27 proceedings.»
+  (research challenge, skill classification). IEEE comes from the ICSE page above. No archival /
+  non-archival choice is mentioned.
+- **Deadlines (AoE)**: paper submission 13 Nov 2026 (marked «updated»), tool competition and
+  research challenge papers **27 Nov 2026** (marked «new»), notification 11 Dec 2026, camera-ready
+  29 Jan 2027. Only the 13 Nov line is in the preset.
+- 🔴 **Disagreement**: the call lists 13 Nov, but the portal's status data on 2026-10-26 reads
+  `"sub":{"open":false}` with no date, i.e. it was closed and showed none. The preset therefore
+  carries the call's reading until the portal publishes one.
+
+## Paper kinds and limits
+
+Every limit says «including references».
+
+| kind               | pages | the call's words                                                                       |
+| ------------------ | ----: | -------------------------------------------------------------------------------------- |
+| `full`             |     8 | «Full papers (maximum of 8 pages, including references).»                              |
+| `education`        |     8 | «Education tools and materials (maximum of 8 pages, including references).»            |
+| `replication`      |     8 | «Replication Studies and Negative results (maximum of 8 pages, including references).» |
+| `short`            |     4 | «Short and demonstration papers (maximum of 4 pages, including references).»           |
+| `position`         |     2 | «Position papers (maximum of 2 pages, including references).»                          |
+| `tool-competition` |     4 | «Tool Competition entries (maximum of 4 pages, including references).»                 |
+
+Two competition papers have no kind. Multitask Code Classification: «you must write a paper (2-4
+pages)», references not mentioned. The research challenge states no limit.
+
+🔴 **The limits are totals.** `format/page-limit` can only compare banal's body count with the
+number, so references standing alone on a page after a full body pass the rule and are over the
+limit. Count the PDF's pages yourself before submitting.
+
+## What else the preset encodes
+
+- **The IEEE template**, through `extends: paperlint:ieee-conference` ([`ieee-conference.md`](ieee-conference.md)).
+- **Anonymous review** (`blind`), so `anonymity/identity` checks the PDF against the paper's
+  declared `identity`.
+- **Portal and deadlines**: all three readings are the call's for now (see Disagreement above).
+
+## Not verified
+
+- **Remote presentation**: not stated on the page.
+- **AI / LLM usage policy**: not stated. Required content exists only for the competition papers
+  (model, pre-processing, tuning, validation results, code link; the challenge: research problem,
+  role of natural language, dataset version, methods, findings, reproducibility link).
+- **The template's class line** and **whether a non-archival route exists**: not stated.
+
+## What the preset resolves to
+
+<!-- paperlint:preset-rules -->
+<!-- prettier-ignore-start -->
+<!-- Generated from nlbse.jsonc by `npx eslint --fix` (rule preset/card-rules). Edit the preset, not this section. -->
+
+**`paperlint:nlbse`** — venue preset for NLBSE · call for papers: <https://conf.researchr.org/home/icse-2027/nlbse-2027> · extends `paperlint:ieee-conference`
+
+No preset of this chain sets a rule: under it, every rule keeps paperlint's default.
+
+<!-- prettier-ignore-end -->
+<!-- /paperlint:preset-rules -->

package/scripts/coverage-config.test.ts

@@ -403,6 +403,9 @@ test("the exclude list is exactly the justified set", () => {
     // skill and CLAUDE.md sources vigiles compiles; a glob's `**` skips a dot directory
     "**/*.spec.ts",
     ".github/*.spec.ts",
+    // the same two kinds in a maintainer skill, which does not ship (`.claude/skills/<name>/`)
+    ".claude/skills/*/*.spec.ts",
+    ".claude/skills/*/*.eval.*",
     // type declarations
     "**/*.d.ts",
     "**/*.d.mts",

package/skills/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- vigiles:sha256:e0aa2cec8926b04f compiled from skills/CLAUDE.md.spec.ts -->
+<!-- vigiles:sha256:b9427668f4875ea5 compiled from skills/CLAUDE.md.spec.ts -->
 
 # CLAUDE.md
 
@@ -12,7 +12,7 @@ package's location come from `skills/paper-pipeline/scripts/consumer.mjs`; the l
 
 ### Skills Ship In Skills
 
-**Guidance only** — Skills ship in `skills/`, never `.claude/skills/`. `paperlint init` symlinks each one into the consumer's `.claude/skills/<name>`; the link's directory name is the skill's name. `skills/` is the npm layout: of 855 packages scanned, 336 shipped `skills/` against 15 `.claude/skills/`. Rejected: leaving the skills for Claude Code to find inside `node_modules` (`docs/install.md`); a symlink loads at startup, deterministically.
+**Guidance only** — Skills ship in `skills/`, never `.claude/skills/`. `paperlint init` symlinks each one into the consumer's `.claude/skills/<name>`; the link's directory name is the skill's name. `skills/` is the npm layout: of 855 packages scanned, 336 shipped `skills/` against 15 `.claude/skills/`. Rejected: leaving the skills for Claude Code to find inside `node_modules` (`docs/install.md`); a symlink loads at startup, deterministically. A skill for working on paperlint itself (it edits this repository's presets, tests or source) does not ship: it lives in `.claude/skills/<name>/` as a real directory, outside `files`, and no shipped skill or user doc names it (`add-venue`).
 
 ### A Criterion That Judges Prose
 

package/skills/CLAUDE.md.spec.ts

@@ -9,7 +9,7 @@ ${file("src/link-skills.ts")}; install-specific paths are flagged by ${file("esl
   },
   rules: {
     "skills-ship-in-skills": guidance(
-      "Skills ship in `skills/`, never `.claude/skills/`. `paperlint init` symlinks each one into the consumer's `.claude/skills/<name>`; the link's directory name is the skill's name. `skills/` is the npm layout: of 855 packages scanned, 336 shipped `skills/` against 15 `.claude/skills/`. Rejected: leaving the skills for Claude Code to find inside `node_modules` (`docs/install.md`); a symlink loads at startup, deterministically.",
+      "Skills ship in `skills/`, never `.claude/skills/`. `paperlint init` symlinks each one into the consumer's `.claude/skills/<name>`; the link's directory name is the skill's name. `skills/` is the npm layout: of 855 packages scanned, 336 shipped `skills/` against 15 `.claude/skills/`. Rejected: leaving the skills for Claude Code to find inside `node_modules` (`docs/install.md`); a symlink loads at startup, deterministically. A skill for working on paperlint itself (it edits this repository's presets, tests or source) does not ship: it lives in `.claude/skills/<name>/` as a real directory, outside `files`, and no shipped skill or user doc names it (`add-venue`).",
     ),
     "a-criterion-that-judges-prose": guidance(
       'It follows the five principles in `eslint-rules/CLAUDE.md` ("A rule that judges prose"). A skill does not grep prose for what a rule can count.',

package/skills/paper-pipeline/references/pipeline-status-template.md

@@ -11,7 +11,10 @@ the verdict line's wording and the `☐`/`☑` marks as they are, or the hook go
 
 ## The front matter
 
-Above the sections, the file carries YAML. The rules read its `stages` field:
+Above the sections, the file carries YAML. In a paper WITHOUT `cycles` in its `paperlint.json`, the
+rules read its `stages` field (a paper with `cycles` keeps no such list: its frozen versions are the
+folders `versions/<cycle>/` and the generated `versions/lock.json`, and `paperlint versions migrate`
+moves an old list there):
 
 ```yaml
 ---

package/skills/submit-paper/SKILL.md

@@ -4,7 +4,7 @@ description: End-to-end playbook for submitting a peer-reviewed paper to a doubl
 allowed-tools: [Read, Write, Edit, Grep, Glob, Bash, WebSearch, WebFetch, Skill]
 ---
 
-<!-- vigiles:sha256:81d5777962c2864a compiled from skills/submit-paper/SKILL.md.spec.ts -->
+<!-- vigiles:sha256:567bfff9583abdf1 compiled from skills/submit-paper/SKILL.md.spec.ts -->
 
 # submit-paper — get a reviewed paper from "done" to "ready for review"
 
@@ -137,20 +137,28 @@ Many workshop HotCRPs have **no supplementary-upload field** — check first; if
 
 ## 7. Freeze the version you actually uploaded
 
-🔴 **The moment the portal accepts the file, download it back and commit it.** The rendered PDF is the
-only artifact git cannot reconstruct — it was built outside the repo and lived on the portal.
+🔴 **What the reviewers read is the one version git cannot rebuild for you later** — it was built
+outside the repo and lives on the portal. Freeze it at the send.
+
+In a paper that keeps `cycles` in `paperlint.json`, the send freezes it:
+`paperlint submission update <paper> --save` (and `new --save`) writes the exact PDF it sent and the
+source the build read into
 
 ```
-<paper-dir>/versions/<ISO-date>-submitted.pdf
+<paper-dir>/versions/<cycle id>/submitted.pdf
+<paper-dir>/versions/<cycle id>/submitted.tex
 ```
 
-and in `PIPELINE-STATUS.md`, on the Submit row, the source that produced it: the literal word
-**`commit <hash>`**. Stages are `submitted` / `camera-ready` / `arxiv`; each one you *declare* in
-PIPELINE-STATUS needs its own frozen file.
+and records their bytes and sha256 in `versions/lock.json` (generated; never edit it). After an
+acceptance the same command freezes `camera-ready.{pdf,tex}`. An upload made on the portal by hand:
+put that PDF and its source there under those names and run `npx paperlint versions lock <paper>`.
+`npx paperlint versions` prints which version is under review and how far `paper.tex` has moved.
 
-**This is enforced, not advised** — `checkFrozenVersions()` in `.claude/hooks/paper-lint.mjs` reads the
-declared stages and reports a paper that declared one without freezing it. The convention itself is
-documented per-paper in `versions/README.md`.
+**This is enforced, not advised** — `cycle/submitted-frozen` fails a cycle that has a submission and
+no frozen `submitted.pdf`, and `versions/layout` fails a frozen file that no longer matches the lock.
+A paper without `cycles` records each stage in `PIPELINE-STATUS.md`'s `stages:` list instead,
+checked by `paper/stages` and `paper/source`; `npx paperlint versions migrate` moves it to the
+folders once it keeps `cycles`.
 
 **Why it is a step and not hygiene:** `agenticdev-2026` kept a folder for exactly this for a month and
 the file inside was the wrong build (340 952 B vs the real 352 357 B). It surfaced only when a reviewer

package/skills/submit-paper/SKILL.md.spec.ts

@@ -153,20 +153,28 @@ Many workshop HotCRPs have **no supplementary-upload field** — check first; if
 
 ## 7. Freeze the version you actually uploaded
 
-🔴 **The moment the portal accepts the file, download it back and commit it.** The rendered PDF is the
-only artifact git cannot reconstruct — it was built outside the repo and lived on the portal.
+🔴 **What the reviewers read is the one version git cannot rebuild for you later** — it was built
+outside the repo and lives on the portal. Freeze it at the send.
+
+In a paper that keeps \`cycles\` in \`paperlint.json\`, the send freezes it:
+\`paperlint submission update <paper> --save\` (and \`new --save\`) writes the exact PDF it sent and the
+source the build read into
 
 \`\`\`
-<paper-dir>/versions/<ISO-date>-submitted.pdf
+<paper-dir>/versions/<cycle id>/submitted.pdf
+<paper-dir>/versions/<cycle id>/submitted.tex
 \`\`\`
 
-and in \`PIPELINE-STATUS.md\`, on the Submit row, the source that produced it: the literal word
-**\`commit <hash>\`**. Stages are \`submitted\` / \`camera-ready\` / \`arxiv\`; each one you *declare* in
-PIPELINE-STATUS needs its own frozen file.
+and records their bytes and sha256 in \`versions/lock.json\` (generated; never edit it). After an
+acceptance the same command freezes \`camera-ready.{pdf,tex}\`. An upload made on the portal by hand:
+put that PDF and its source there under those names and run \`npx paperlint versions lock <paper>\`.
+\`npx paperlint versions\` prints which version is under review and how far \`paper.tex\` has moved.
 
-**This is enforced, not advised** — \`checkFrozenVersions()\` in \`.claude/hooks/paper-lint.mjs\` reads the
-declared stages and reports a paper that declared one without freezing it. The convention itself is
-documented per-paper in \`versions/README.md\`.
+**This is enforced, not advised** — \`cycle/submitted-frozen\` fails a cycle that has a submission and
+no frozen \`submitted.pdf\`, and \`versions/layout\` fails a frozen file that no longer matches the lock.
+A paper without \`cycles\` records each stage in \`PIPELINE-STATUS.md\`'s \`stages:\` list instead,
+checked by \`paper/stages\` and \`paper/source\`; \`npx paperlint versions migrate\` moves it to the
+folders once it keeps \`cycles\`.
 
 **Why it is a step and not hygiene:** \`agenticdev-2026\` kept a folder for exactly this for a month and
 the file inside was the wrong build (340 952 B vs the real 352 357 B). It surfaced only when a reviewer

package/skills/submit-paper/references/publishers/acm.md

@@ -81,9 +81,11 @@ need to wait for them or make them up.
 
 ## The frozen version
 
-Camera-ready is a separate **stage** in the sense of `versions/` (see `checkFrozenVersions()` in
-`paper-lint.mjs`): the uploaded PDF is stored as `versions/<date>-camera-ready.pdf`, and the commit
-of its source is recorded in `PIPELINE-STATUS.md` as `commit <hash>`.
+Camera-ready is a separate **stage** in `versions/`: once the cycle's `outcome` is `accepted`,
+`paperlint submission update <paper> --save` freezes the PDF it sends and its source as
+`versions/<cycle>/camera-ready.{pdf,tex}` and records them in `versions/lock.json`. A camera-ready
+uploaded through the publisher's own system (not the review portal) goes there by hand, followed by
+`npx paperlint versions lock <paper>`.
 
 **Why this isn't a formality:** the arXiv posting and the extension paper get diffed against
 camera-ready later, and reviewer references to line numbers only resolve against the exact render

package/src/adapters/memory/index.test.ts

@@ -6,9 +6,31 @@ import {
   fixedDownload,
   memoryFiles,
   memoryListEntries,
+  memoryCopyFile,
+  memoryMoveFile,
   memoryWorkspace,
 } from "./index.ts";
 
+test("memoryMoveFile: the bytes move to the new path; a path holding nothing throws", () => {
+  const files = memoryFiles({ "/p/a.pdf": "x" });
+  const move = memoryMoveFile(files);
+  move(absolutePath("/p/a.pdf"), absolutePath("/p/v/b.pdf"));
+  assert.deepEqual([...files.map.keys()], ["/p/v/b.pdf"]);
+  assert.throws(() => {
+    move(absolutePath("/p/a.pdf"), absolutePath("/p/c.pdf"));
+  }, /ENOENT/);
+});
+
+test("memoryCopyFile: the bytes under the new path too; a path holding nothing throws", () => {
+  const files = memoryFiles({ "/p/a.tex": "x" });
+  const copy = memoryCopyFile(files);
+  copy(absolutePath("/p/a.tex"), absolutePath("/p/v/b.tex"));
+  assert.deepEqual([...files.map.keys()], ["/p/a.tex", "/p/v/b.tex"]);
+  assert.throws(() => {
+    copy(absolutePath("/p/none"), absolutePath("/p/c.tex"));
+  }, /ENOENT/);
+});
+
 test("memoryWorkspace: a `within` that throws is recorded as `threw`, and the error goes on", () => {
   const ws = memoryWorkspace();
   assert.throws(

package/src/adapters/memory/index.ts

@@ -7,6 +7,7 @@ import type { Download } from "../../ports/download.ts";
 import type { Files } from "../../ports/files.ts";
 import type { ListDir } from "../../ports/talk-media.ts";
 import type { ListEntries } from "../../ports/list-entries.ts";
+import type { CopyFile, MoveFile } from "../../ports/move-file.ts";
 import type { Command, ProcessExit, RunProcess } from "../../ports/process.ts";
 import type { NotAPromise, Scratch, Workspace } from "../../ports/workspace.ts";
 import { err, ok } from "../../domain/result.ts";
@@ -73,6 +74,26 @@ export const memoryListDir =
     ),
   ];
 
+/** `MoveFile` over `memoryFiles`: the bytes under the new path, none under the old; nothing there throws. */
+/** `CopyFile` over `memoryFiles`: the bytes under the new path too; nothing there throws. */
+export const memoryCopyFile =
+  (files: MemoryFiles): CopyFile =>
+  (from, to) => {
+    const b = files.map.get(from);
+    if (b === undefined) throw new Error(`ENOENT: no file to copy at ${from}`);
+    files.writeAtomic(to, b);
+  };
+
+export const memoryMoveFile =
+  (files: MemoryFiles): MoveFile =>
+  (from, to) => {
+    const b = files.map.get(from);
+    if (b === undefined) throw new Error(`ENOENT: no file to move at ${from}`);
+    files.writeAtomic(to, b);
+    // eslint-disable-next-line functional/immutable-data -- a test double's disk is the mutable map memoryFiles keeps
+    files.map.delete(from);
+  };
+
 /**
  * `ListEntries` over `memoryFiles`: each name directly under a directory, a file when it is one, else a
  * directory. Memory holds no links: the walk's refusal to follow one is the node adapter's to show.

package/src/adapters/node/index.ts

@@ -36,3 +36,4 @@ export { spawnProcess, type SpawnSync } from "./process.io.ts";
 export { hostDirs } from "./host.io.ts";
 export { nodeListDir } from "./list-dir.io.ts";
 export { nodeListEntries } from "./list-entries.io.ts";
+export { nodeCopyFile, nodeMoveFile } from "./move-file.io.ts";

package/src/adapters/node/move-file.io.ts

@@ -0,0 +1,21 @@
+/** `MoveFile` and `CopyFile` over `node:fs`: a rename or a copy, the directory made first. */
+import { copyFileSync, mkdirSync, renameSync } from "node:fs";
+import { dirname } from "node:path";
+import type { AbsolutePath } from "../../domain/paths.ts";
+import type { CopyFile, MoveFile } from "../../ports/move-file.ts";
+
+export const nodeMoveFile: MoveFile = (
+  from: AbsolutePath,
+  to: AbsolutePath,
+): void => {
+  mkdirSync(dirname(to), { recursive: true });
+  renameSync(from, to);
+};
+
+export const nodeCopyFile: CopyFile = (
+  from: AbsolutePath,
+  to: AbsolutePath,
+): void => {
+  mkdirSync(dirname(to), { recursive: true });
+  copyFileSync(from, to);
+};

package/src/adapters/node/move-file.test.ts

@@ -0,0 +1,51 @@
+/** `nodeMoveFile`: the file arrives with its bytes, into a folder made for it, and is gone from where it was. */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { absolutePath } from "../../domain/paths.ts";
+import { useTempDir } from "../../../test/support.ts";
+import { nodeCopyFile, nodeMoveFile } from "./move-file.io.ts";
+
+const root = useTempDir("paperlint-move-file-");
+
+describe("nodeMoveFile", () => {
+  it("moves a file into a folder that does not exist yet", () => {
+    writeFileSync(join(root, "a.pdf"), "bytes");
+    nodeMoveFile(
+      absolutePath(join(root, "a.pdf")),
+      absolutePath(join(root, "x", "y", "b.pdf")),
+    );
+    expect(existsSync(join(root, "a.pdf"))).toBe(false);
+    expect(readFileSync(join(root, "x", "y", "b.pdf"), "utf8")).toBe("bytes");
+  });
+
+  it("throws when there is nothing to move", () => {
+    expect(() => {
+      nodeMoveFile(
+        absolutePath(join(root, "none")),
+        absolutePath(join(root, "z")),
+      );
+    }).toThrow();
+  });
+});
+
+describe("nodeCopyFile", () => {
+  it("copies a file into a folder that does not exist yet, and leaves it where it was", () => {
+    writeFileSync(join(root, "s.tex"), "source");
+    nodeCopyFile(
+      absolutePath(join(root, "s.tex")),
+      absolutePath(join(root, "c", "d", "s.tex")),
+    );
+    expect(readFileSync(join(root, "s.tex"), "utf8")).toBe("source");
+    expect(readFileSync(join(root, "c", "d", "s.tex"), "utf8")).toBe("source");
+  });
+
+  it("throws when there is nothing to copy", () => {
+    expect(() => {
+      nodeCopyFile(
+        absolutePath(join(root, "none")),
+        absolutePath(join(root, "w")),
+      );
+    }).toThrow();
+  });
+});

package/src/adapters/yaml/index.test.ts

@@ -0,0 +1,16 @@
+/** `parseYaml`: the value, a bare date as a `Date`, or the parser's own message. */
+import { expect, test } from "vitest";
+import { parseYaml } from "./index.ts";
+
+test("parses a mapping, a date without quotes as a Date; refuses what is not YAML with the reason", () => {
+  expect(parseYaml("a: 1\nd: 2026-07-22\n")).toStrictEqual({
+    ok: true,
+    value: { a: 1, d: new Date("2026-07-22T00:00:00.000Z") },
+  });
+  const bad = parseYaml("a: [");
+  expect(bad.ok).toBe(false);
+  expect(bad).toStrictEqual({
+    ok: false,
+    error: "unexpected end of the stream within a flow collection (2:1)",
+  });
+});

package/src/adapters/yaml/index.ts

@@ -0,0 +1,17 @@
+/**
+ * `ParseYaml` over js-yaml: the one YAML reader of `src/`. A date without quotes reads as a `Date`.
+ * A refusal is the parser's first line — the reason and its line:column — without the excerpt it
+ * prints under it, so it fits in a one-line message.
+ */
+import { load } from "js-yaml";
+import { messageOf } from "../../domain/text.ts";
+import { err, ok } from "../../domain/result.ts";
+import type { ParseYaml } from "../../ports/yaml.ts";
+
+export const parseYaml: ParseYaml = (text) => {
+  try {
+    return ok(load(text));
+  } catch (e) {
+    return err(messageOf(e).split("\n", 1).join(""));
+  }
+};