chore: version packages (rc) (#768)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: github-actions[bot]

.changeset/pre.json

@@ -48,13 +48,18 @@
     "boot-check-merged-shape",
     "boot-deadlines-and-diagnosability",
     "boot-fetch-transient-retry",
+    "boot-snapshot-boot-rung",
+    "boot-snapshot-health-provenance",
+    "boot-snapshot-schema",
     "bos-app-ts-canonical-config-form",
     "bos-app-ts-operative",
     "bos-dev-overlay-command-modules",
     "bos-import-workspace",
     "bos-kill-escalation-and-adoption",
+    "bos-lock-producer",
     "bos-login-gasless-publish",
     "bos-manifest-command",
+    "bos-promote",
     "bos-rollback",
     "bos-typecheck-command",
     "bos-upgrade-release-sync",
@@ -85,12 +90,14 @@
     "compose-drop-degraded-toast",
     "compose-failure-isolation",
     "compose-shadow-subtree-parentage",
+    "composition-lockfile-schema",
     "concurrent-boot-artifact-race",
     "concurrent-migration-ddl-race",
     "config-declared-permissions",
     "config-discovery-dependencies",
     "config-pipeline-effect-native",
     "configured-slot-stamping",
+    "confirm-action-indexed-outcome",
     "consolidated-deploy-train",
     "consumer-coupling-fixes",
     "consumer-release-plane",
@@ -109,6 +116,7 @@
     "debrand-naming-sweep",
     "degraded-compose-core-only-tree",
     "deploy-cdn-origin-guard",
+    "deploy-confirm-tx-status",
     "deploy-folder-form-plugin-uis",
     "deploy-image-leg-run-stdout",
     "deploy-key-mint",
@@ -119,9 +127,11 @@
     "deploy-preflight-schema-guard",
     "deploy-prerequisite-build-mode",
     "deploy-smoke-digest-and-registry-read",
+    "deploy-smoke-thin-tag-decode",
     "deploy-speed-430",
     "deploy-train-service",
     "deploy-train-smoke-gate",
+    "deploy-wallet-rpc-pin",
     "deps-catalog-bump-nov",
     "dev-bootstrap-effect-program",
     "dev-chain-audit",
@@ -182,12 +192,14 @@
     "image-leg-split-from-deploy",
     "image-native-artifacts",
     "import-migration-reconciliation",
+    "init-auth-types-stale-copy",
     "init-prune-unused-ui",
     "key-generate-staging-flag",
     "lint-zero-warnings",
     "local-auth-plugin-client-gen",
     "local-stack-base-url-and-lock-timeout",
     "locale-negotiation-ssr",
+    "lockfile-boot-consumes",
     "login-redirect-loop-fix",
     "lossless-descriptor-round-trip",
     "manifest-composition-rework",
@@ -233,7 +245,9 @@
     "pnpm-v2-node-image",
     "polite-passkey-autofill",
     "pr-train-021-hardening",
+    "preflight-publish-key-health",
     "promote-agent-docs",
+    "publish-balance-gate",
     "publish-pin-verification-gate",
     "published-exports-src-dangling",
     "purge-stale-surface-006",
@@ -332,8 +346,10 @@
     "tenant-framework-subpath",
     "test-database-isolation",
     "test-scripts-if-present-placement",
+    "train-writes-lockfile",
     "transport-neutral-module-hosting",
     "two-database-contract",
+    "two-plane-boot-staging",
     "typecheck-plugin-uis",
     "typed-effect-errors-host-packages",
     "typed-mount-contract",

packages/everything-dev/CHANGELOG.md

@@ -1,5 +1,29 @@
 # everything-dev
 
+## 2.0.0-rc.38
+
+### Minor Changes
+
+- e633d93: The approved boot snapshot's wire schema ships as the `everything-dev/snapshot` subpath (ADR 0041): a persisted, verified serving state — runtime ref, authorizing manifest tag, pointer fingerprint, the resolved published config, the pinned-remote mirror, and the deploy-record key — written on adopt so a restart can serve the approved composition during a registry/CDN outage. Schema and path helpers only; the coordinator and boot-path wiring follow in the boot-snapshot sprint's next tickets.
+- bde5817: `bos lock` — freeze the resolved composition into `bos.lock.json` (ADR 0042). The command resolves the authored config through the full extends chain + release stamping (the same resolution session the deploy train uses) and writes the lockfile atomically; `bos lock --check` re-resolves and exits 1 on drift for CI. The runtime map gains lockfile provenance: when a lockfile exists, the generated map carries its fingerprint, release, and resolved-at, and names every source/backend whose serving digest differs from the frozen one (`lockfile.drift`) — the explainer can no longer drift silently from the frozen composition. `everything-dev/lockfile` gains `readLockfileIfExists` and the shared `writeLockfile` producer seam.
+- c797040: `bos promote <block-height>` — activate a recorded deployment without rebuilding (ADR 0042 ticket 05, absorbing the unified-rollback plan): the same SRI-verified, boot-checked, pointer-restoring republish as `bos rollback --version`, framed as promotion — no rolledBackFrom brand on the payload, an already-live target is an idempotent no-op rather than a refusal, and the version is required (promotion targets a record, not "previous"). The lockfile consumption rides the train's ticket-04 leg: the promoted composition is frozen into bos.lock.json atomically after confirm, and the deployment record named its digest all along. The Railway image leg stays in CI's deploy workflow (the CLI holds no Railway credential); the config/pointer/lockfile plane is complete from here.
+- e633d93: The composition lockfile's wire schema ships as the `everything-dev/lockfile` subpath (ADR 0042): `bos.lock.json` freezes one runtime's exact composition — the pinned descriptors and bare plugin refs in walk order, optional shared-singleton and contract records, and a fingerprint that equals the pointer fingerprint of the frozen config and recomputes from the stored record alone. Schema and path helpers only; the `bos lock` producer and boot consumer follow in the composition-lockfile sprint's next tickets.
+- fc552a6: Registry starts consume `bos.lock.json` (ADR 0042 ticket 03): when a lockfile is present for the booting runtime, its frozen remote coordinates are the boot's authority — missing pins are stamped from the frozen descriptors and drifted coordinates are overridden, with every stamp and disagreement reported as a loud warning in the start summary. The boot never fails because of the lockfile — enforcement lives in CI via `bos lock --check`. The `everything-dev/lockfile` surface gains `applyCompositionLockfile` (pure application: stamping, drift reporting, runtime-ref guard).
+- f015cb3: The deploy train freezes the composition it publishes (ADR 0042 ticket 04): every publish composes `bos.lock.json` from the exact publish payload and writes it atomically (healed on already-published idempotent runs), and the per-deploy audit record (`deploys/<ts>.json`) names the lockfile's content digest and fingerprint — a deployment record now answers "what exact composition was live". `everything-dev/lockfile` gains `digestOfLockfile` and the sync `writeLockfileSync` (the train's publish path is sync-fs). The registry's fingerprint module consolidates both identity hashes: `pointerFingerprint` remains THE composition identity (lockfile, deploy records, watch change-detection); `deploymentFingerprint` (the serving-generation payload hash, moved here from the host) is documented as derived from the same remotes after entry resolution — their semantic merge stays a recorded seam, since both sides of every existing comparison must move together.
+- 7e8575d: The two-plane boot, staging leg (ADR 0043): the deploy train now writes the approved boot snapshot for the composition it just confirmed live — stamped with the release thin tag (when the release leg ran) and the lockfile's content digest — so restarts of the published runtime boot from the staged state instead of resolving. Non-fatal like every provenance leg. `everything-dev/snapshot`'s `bootSnapshotOf`/`BootSnapshotSchema` gain the optional `lockfileDigest` staging stamp (the identity tying an approved generation to the deployment record that named it — enforcement deferred; the strict-reader downgrade window is accepted per the ADR 0040 posture). The ADR names the contract: the control plane (registry + train + CI) produces and activates; the application runtime starts from a digest-verified artifact, converges through the watch, and stays fail-loud for fresh activations. Remote-tier staging rides the hosting adapter later (recorded seam).
+
+### Patch Changes
+
+- 741fe1a: Registry starts gain the approved-snapshot boot rung (ADR 0041): every verified generation is persisted (`.bos/snapshot/<account>/<gateway>.json`, `BOS_SNAPSHOT_DIR` overrides the root) by the host's snapshot coordinator on adopt — and by `bos start` itself when it resolves the registry cold — so a restart during a registry/CDN outage boots from the last verified composition, with a loud warning in the start summary; the pointer watch adopts the published config the moment the registry returns. A definitive "no config published" still fails loud; a corrupt or fingerprint-mismatched snapshot refuses instead of serving; `BOS_SNAPSHOT_BOOT=never` disables the rung. The `everything-dev/snapshot` subpath gains `readBootSnapshot`, `verifiedBootSnapshot`, and `BootSnapshotIntegrityError`.
+- fefd0a0: The host's /health carries composition provenance for the approved-snapshot boot rung (ADR 0041): a `snapshot` block reports whether the process booted from the persisted snapshot, whether the pointer watch has adopted a published generation since boot, and whether the boot is still degraded (snapshot-sourced, not yet adopted). The overall status stays "ready" — degradation is provenance, not readiness — and the marker clears the moment the watch adopts. `bos start` stamps the host process with the marker env only when it actually served the snapshot.
+- af52791: Publish confirmation now treats a failed on-chain execution as the designed success state: the registry namespace is codeless, so publishes execute with `CodeDoesNotExist` and the transaction classifier maps near-kit's typed errors (execution failure → included, consumed nonce or missing publish key → terminal with a `bos login --key` repair hint, chain-unknown → grace window) instead of regexing messages. The content read-back also outranks the transaction probe — a "dropped at broadcast" verdict can only be emitted after the registry content check failed to verify in the same iteration, never before a verify.
+- 4d16ba1: Publish confirmation now queries the submitted transaction's status: rejected or dropped transactions fail fast with their on-chain fate instead of a generic "registry serves a different value" timeout, and a transaction that will never apply is retried once with identical content (fresh nonce) before the deploy fails.
+- 4d16ba1: The release deploy's post-publish smoke now decodes the `manifest.json` pointer through the thin-tag schema (`version`) instead of the pre-cutover field name (`frameworkVersion`), so release trains after the registry wire cutover verify the published pointer instead of always failing with "release pointer serves nothing" and rolling back a good config.
+- ebbaaf2: `bos deploy --wallet` now parses (the deploy schema was missing the `wallet` field that publish and rollback already had — the gasless NEP-366 relay path was unreachable from the deploy command). The signing stack also honors `NEAR_RPC_URL`: near-kit's default mainnet RPC (free.rpc.fastnear.com) currently accepts signed broadcasts and silently drops them post-acceptance, so publishes can pin the signing stack to an endpoint with a real transaction pool (set `NEAR_RPC_URL=https://rpc.mainnet.near.org`).
+- 2f7902c: Stop the init/sync copy from carrying `*.gen.ts` artifacts into child projects, and make contract-type generation degrade to the `.bos/generated/auth` stubs when auth resolution fails instead of skipping the write. Together these fix child typechecks failing with `TS2307: Cannot find module '.../auth/src/auth-export.ts'` when a stale root-authored `plugins/_template` gen file leaked into the scaffold and a transient auth-registry outage prevented regeneration.
+- 64763ca: The deploy preflight verifies the signing key's on-chain health before the build train runs: the key must exist on the publisher account and be scoped to `__fastdata_kv` on the registry namespace with enough remaining allowance for one publish (300 Tgas prepaid). A rotated or exhausted key now fails in seconds with the exact on-chain repair command (`near account add-key …`) instead of surfacing after a full build as a broadcast that never appears on-chain. The confirmation classifier also recognizes the chain's real not-found shape (`UNKNOWN_TRANSACTION`), so a dropped broadcast again reaches the terminal verdict and its one identical resubmit instead of timing out generically.
+- abb3596: The deploy preflight checks the publish account's balance before building: a publish whose account cannot cover the gas prepayment now fails in seconds with the exact amounts and a top-up hint, instead of dying hours later as a silent "dropped at broadcast". Broadcasts surface the pool's admission verdict (`NotEnoughBalance`, stale nonce) at submit time instead of fire-and-forget, registry writes attach 30 Tgas instead of 300 Tgas (shrinking the prepayment lock 10×), and the function-call key allowance floor follows.
+
 ## 2.0.0-rc.37
 
 ### Minor Changes

packages/everything-dev/package.json

@@ -1,6 +1,6 @@
 {
   "name": "everything-dev",
-  "version": "2.0.0-rc.37",
+  "version": "2.0.0-rc.38",
   "type": "module",
   "engines": {
     "node": ">=20.11"

packages/everything-dev/src/services/scaffold/upgrade-audit/steps/v2-catalog.ts

@@ -66,7 +66,7 @@ export const V2_CATALOG: Readonly<Record<string, string>> = {
   "drizzle-orm": "^0.45.4",
   effect: "4.0.0-rc.118",
   "every-plugin": "^3.0.0-rc.15",
-  "everything-dev": "^2.0.0-rc.37",
+  "everything-dev": "^2.0.0-rc.38",
   "near-kit": "^0.20.2",
   pg: "^8.12.0",
   react: "19.3.1",

pnpm-workspace.yaml

@@ -69,7 +69,7 @@ catalog:
   drizzle-orm: ^0.45.4
   effect: 4.0.0-rc.118
   every-plugin: ^3.0.0-rc.15
-  everything-dev: ^2.0.0-rc.37
+  everything-dev: ^2.0.0-rc.38
   near-kit: ^0.20.2
   pg: ^8.12.0
   react: 19.3.1