[MoebiusX]

First promotion since #131 (0.5.0, 2026-10-01): 33 merged PRs (#121, #134 – #165). It completes the store: every docs/STORE_PLAN.md slice is on develop. The release notes are the CHANGELOG's ## Unreleased section.

What it carries

• The store, completed:
  • slice 4a, the pack registry on the store (Store slice 4a: the pack registry on the store #140);
  • slice 4b, services, environments and MCP endpoints (Store slice 4b: services, environments and MCP endpoints #141);
  • slice 5, the audit: GET /api/audit and packc store audit (The store, slice 5: the audit — the remaining rows, the login in deploys.jsonl, GET /api/audit, packc store audit #144);
  • slice 6a, the Services home and the service page (STORE_PLAN slice 6a — Studio: services as the axis #147);
  • slice 6b, Settings for operators, admins and owners (STORE_PLAN slice 6b-i — Settings for operators and admins; the MCP pickers on mcpEndpointId #148, STORE_PLAN slice 6b-ii: Settings for owners (users, organisations, the join role, Act in) #153).
• Downstream seams (Downstream seams: vendor manifest, transport hook, taxonomy, proxy auth, static bundle, brand #142, Seams follow-up: redact a fetchImpl's returned Response; strip the journey's persisted MCP URL #143): the vendor manifest, the transport hook, the taxonomy, proxy auth, the static bundle and brand.
• Rebadge batches 2–4 (Rebadge batch 2, PR 1: bundle parity (B1), canonical packs (B2), Windows portability (B4) #145, Rebadge batch 3: MCP target privilege, ping, true snapshot, comparison identity modes #150, Rebadge batch 4: in-page MCP server settings (descriptor contract, browser-direct modal, policy seam, opt-in proxy) #151):
  • bundle parity and canonical packs;
  • MCP target privilege, ping and true snapshot;
  • comparison identity modes;
  • in-page MCP server settings.
• GAP batch 2 (GAP batch 2: verdicts, waivers, diagnose → remediate flow, glossary widgets, service audit report #146): verdicts, waivers, the Diagnose → Remediate flow, glossary widgets and the service audit report.
• Spec 1.4 and the crawler (fix(crawler): Grafana alert provisioning no longer lost on a YAML escape; mini-yaml quotes a scalar ending in ":" #138, feat(crawler): spec 1.4 — operational alert rules are crawled into alerting.rules, shown, and paired with the live rules #139): operational alert rules are crawled, shown and paired with live rules.
• Compare in the static bundle (feat(bundle): Compare in the static bundle — the PromQL parser and its licences inlined from the lockfile, parity with the server body for body #162): the PromQL parser and its licences are inlined from the lockfile; Compare, retrofeed and the audit report run offline. The bundle loads no font over the network by default (--remote-fonts opts back in), and every tools/lib sort uses one collation.
• Windows:
  • a CI leg on windows-latest, Node 22.16.0 and the latest 22, with a failure summary at the end of every suites job (ci: a Windows leg — npm test on windows-latest (Node 22.16.0 and the latest 22), a failure summary at the end of every suites job log, and windows-vs-linux holding both to node-floor #157);
  • path scope compared by what a path names (fix(scope): on Windows the org-scope and store checks compare paths by what they name, not how they are spelled #156);
  • purge-org's Windows refusals (fix(store): on Windows purge-org refuses a users file whose recorded path cannot be fully resolved — a link or reparse point whose target cannot be opened, or a volume whose paths do not resolve #161, fix(store): purge-org decides the users file by what deleting the root takes — a mount or link of a directory under the root no longer lets it delete the users file, and "move it out first" works when followed #163, fix(store): on Windows the path comparison reads a path's volume through a handle — on Node 22.16.x (libuv 1.49.2) a path through a share of the workspace compared as outside it #165), including the libuv 1.49.x volume-serial bug that Node 22.16 ships (fix(store): purge-org decides the users file by what deleting the root takes — a mount or link of a directory under the root no longer lets it delete the users file, and "move it out first" works when followed #163, fix(store): on Windows the path comparison reads a path's volume through a handle — on Node 22.16.x (libuv 1.49.2) a path through a share of the workspace compared as outside it #165).
• purge-org decides the users file by what deleting the root takes (fix(store): purge-org decides the users file by what deleting the root takes — a mount or link of a directory under the root no longer lets it delete the users file, and "move it out first" works when followed #163): mounts, links, overlay and chroot cases, each refusal with a way out that works when followed literally.
• Fixes:
  • journeys notify only through their org's own hooks (fix(journeys): a server-run journey notifies only through its org's own hook pair (journey-notify-env-ownership) #158);
  • the id clocks under load (fix(classify): the id clocks never refuse a fast pattern on a loaded machine or a slow device — the 50 ms budget measures the pattern's own work, not the time the thread was descheduled #159);
  • the settings-policy worker's per-rule deadline and fail-closed start (fix(server): the settings-policy worker — a deadline per rule, and a worker that cannot start fails closed #155);
  • a malformed JSON body is answered as a 400 (fix(server): a malformed JSON body is answered 400 as JSON on every route, with no fragment in the answer or the log #152);
  • the studio's sign-in hints and the phone-width bar (fix(studio): without sign-in the studio names the server's own way in; the OBSERVA bar fits a phone in every mode #154);
  • the scan catalogue: one scan or one live draft is one pack (fix(studio): one scan or one live draft is one pack in the catalogue #134);
  • Compare's one-pack metrics (feat(studio): Compare says what reads a metric only one pack holds #135);
  • folder pick (feat(studio): pick a folder walks the repository itself and never lists its dependencies #136);
  • the account menu (fix(studio): the account menu is reachable on every screen — home and Build no longer hide it #121);
  • the stale-scan smoke race (test(smoke): the stale-scan adopt test holds /api/validate to the YAML's own content id (a pre-existing race that fails on fast Linux runners) #164);
  • npm audit fix in the lockfile only (fix(deps): npm audit fix — proxy-addr 2.0.8, body-parser 2.3.0, qs 6.16.0 (lockfile only) #149).

Against main

main carries only #131's merge commit beyond develop. A trial merge of develop into main applies with no conflict. develop at aac37c8 is green on all seven CI jobs: validate, node-floor, both Windows legs, windows-vs-linux, store-prestore and backend-live. npm test runs 1520 tests.

Not cut yet

There is no release cut. package.json is still 0.5.0, and the CHANGELOG has everything under ## Unreleased. If this promotion should be tagged, cut the release into develop first, as #133 did for 0.5.0: version in package.json/lock, the studio footer label, the image tags, and an ## 0.6.0 — <date> heading. Then tag on main after the merge.

Merging to main is the maintainer's act (docs/BRANCHING.md).

🤖 Generated with Claude Code

https://claude.ai/code/session_01UhPGnqVJ24goSVtbKpdkLJ

---

Generated by Claude Code