fix: restore protected enrollment after release registration and archiving

.agents/skills/atlas/assets/seed/records/0e9612ab3e2095fdf2eeeb3b08d690f03ce16e7f7ce948a10d2159b267769651.json

@@ -0,0 +1 @@
+{"citations":[{"path":"tools/routine-delivery.py","repository":"FS-GG/.github","revision":"838710090ed81c09506fb24c34ffdaa6576faee0","sha256":"a4bd7aef91505d84a5a3f13da8006f98d4c67473ecd3e290031c9f8551915097"},{"path":".github/workflows/routine-eligibility.yml","repository":"FS-GG/.github","revision":"838710090ed81c09506fb24c34ffdaa6576faee0","sha256":"45bbb3d5fe1780ac135c1576b3fd76196f3cd636b33371b9f502a8795baf8d93"},{"path":".github/workflows/routine-eligibility.yml","repository":"FS-GG/HighBarV3","revision":"9f9c873a2fc6d8ec761c2f5faf2ffe25eeac508d","sha256":"45bbb3d5fe1780ac135c1576b3fd76196f3cd636b33371b9f502a8795baf8d93"}],"conflictsWith":[],"id":"github/highbar-routine-bootstrap","kind":"lesson","recordedAt":"2026-11-02T21:15:22Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"HighBar first-install qualification is receiver-bound: authenticate repository identity, default branch, permissions, complete current classic/effective/inherited policy and repository/organization runner variables. Preserve the pinned existing ci.yml and all pre-existing leaves while adding exactly the canonical five producer files. Require the candidate original pull_request attempt, ten job/check identities, native app/run/suite joins and successful expected technical steps. Conditional self-hosted skips are acceptable only when the independently observed variable state disables them; reported required checks remain additional. Denied or incomplete metadata cannot prove empty policy. Existing receivers retain their guards. Source integration alone does not establish producer installation, and installation readback remains activation-pending until a genuine ordinary event succeeds.\n\nObserved on 2026-11-02: source PR5262 merged as83871009; HighBar PR18 original ci run41525442352/a1 qualified five hosted successes and five conditional skips. Canonical installation merged as9f9c873a and retained all1,293 original leaves plus five additions. A meaningful PR17 description update, with its reviewed3b2969af head and markers unchanged, produced actual edited pull_request_target run41526415756/a1. Its live-base validator resolved the stale event base b57f11f2 to installed default9f9c873a, and normal maintained inspection returned routineEligibility=passed and producerInstallation=not-selected. Thus an old PR base payload is not evidence of stale validator execution; verify the live-base resolution and exact native job/run instead. Client merge/adoption remains separate. These observations are historical acceptance evidence, not authority for future effects; refresh all operational facts.","supersedes":[],"tags":["highbar","routine","bootstrap","ci","provenance"],"title":"HighBar bootstrap separates canonical installation from normal client eligibility"}

.agents/skills/atlas/assets/seed/records/3242912d15a34fbaba05e5e4ef959577b2572533305bdd2e4aa24fe8b0fd1173.json

@@ -0,0 +1 @@
+{"citations":[{"path":"src/FS.GG.Coord.GitHub/V2ConstructorClosure.fs","repository":"FS-GG/.github","revision":"6e31c592cc3ef34ad75071aa0e820150a236a033","sha256":"71cf7d414de66a0823a5ad0610d2d19e1f675045c51de76817dfd986259b7de1"},{"path":"src/FS.GG.Coord.GitHub/V2EnrollmentCommands.fs","repository":"FS-GG/.github","revision":"6e31c592cc3ef34ad75071aa0e820150a236a033","sha256":"49abbf8ae59b3dcfa73e030ba815f23f71484e973e3bffd5d78568da3b1b1e91"},{"path":"src/FS.GG.Coord.GitHub/V2Projection.fs","repository":"FS-GG/.github","revision":"6e31c592cc3ef34ad75071aa0e820150a236a033","sha256":"e116511602039b4f3d2e904c8a60d458a2add783d534574c950850cf5b41d2cf"},{"path":"docs/coordination/board-v2-import-preparation.md","repository":"FS-GG/.github","revision":"6e31c592cc3ef34ad75071aa0e820150a236a033","sha256":"c9822ee7e2eb4a96fbfb9834115c7f655ac7ed5bf6042ad50b001eb7ed26d0c9"}],"conflictsWith":[],"id":"github/enrollment-release-registration-and-archived-membership","kind":"lesson","recordedAt":"2026-11-02T21:31:33Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"Observed during protected enrollment recovery: the published0.114.4 constructor refused its descendant main solely because the accepted postpublication registry flip changed dist/dotnet/.config/dotnet-tools.json from0.114.3 to0.114.4 inside its build closure. Republishing alone repeats that cycle. The reviewed source adds one typed equivalence for the exact self-pin semantic change, joined to the actual engine host stable version, loaded constructor/host source and native coherent-set tag; all other closure and ancestry refusals remain. Separately, an active Project inventory omits archived enrolled cards although issue.projectItems retains them. Reconcile missing predecessor nodes through the maintained complete exact-project identity/pagination reader, requiring explicit archive state, and preserve the original enrollment prefix; do not infer removal from absence. Conflicting, partial or unarchived reads remain Unknown. Original Unsupported evidence and effects stay immutable. Source review/325offline controls do not establish publication, installed caller qualification, successor enrollment or scheduled acceptance. A successor requires supported runtime/reader rebinding and joint archive binding, commitment, reader and matching acceptance receipt qualification before activation; neither a prior receipt nor a source merge authenticates new inputs.","supersedes":[],"tags":["enrollment","release","source-identity","archived-membership","qualification"],"title":"Protected enrollment must distinguish release registration from source drift and archived from absent membership"}

.agents/skills/publishing-and-deployment/SKILL.md

@@ -36,7 +36,7 @@ Registry release inventory: 20 package-bearing contracts across 10 producers; 17
 | `game` | `game-render-browser` | `0.19.0` | `0.19.0` | `game:0.19.0` | FS.GG.Game.Render.Browser package — Fable browser host for renderer selection: RendererDriver, SvgSurface, RetainedSvgSurface, PixiSurface and BabylonSurface over the shared FS.GG.UI.Scene, the canvas SceneInteraction input host, BrowserRenderers and BrowserConformance; npm @babylonjs/core 9.33.1 and pixi.js 8.22.0 |
 | `audio` | `fs-gg-audio` | `0.6.0` | `0.6.0` | `audio:0.6.0` | FS.GG.Audio.Core/.Host/.Engine/.Elmish/.WebBrowser public .fsi surfaces — AudioEffect vocabulary + IAudioBackend/IMixingBackend seam + mixing Engine + Audio.Cmd Elmish bridge + browser Web Audio host |
 | `net` | `fs-gg-net` | `0.6.0` | `0.6.0` | `net:0.6.0` | FS.GG.Net.Core/.WebSocket/.WebSocket.Server/.Protobuf/.Grpc/.Elmish public .fsi surfaces — ITransport/IMessageChannel seam + Sequential/Multiplexed correlation + serve/ServerEcho + WebSocket client/server transport + Google.Protobuf/protobuf-net codecs + gRPC lifecycle bridge + Elmish Cmd/Sub |
-| `github` | `coord-engine` | `0.114.4` | `0.114.4` | `github:0.114.4` | the `fsgg-coord-engine` CLI verb surface (claim/take/batch/who/widen/set-paths/say/landable/done/release/flush/…) + its exit-code contract, emitted from src/FS.GG.Coord.Core/Protocol.fs; shipped as the FS.GG.Coord.Cli dotnet tool |
+| `github` | `coord-engine` | `0.114.5` | `0.114.4` | `github:0.114.4` | the `fsgg-coord-engine` CLI verb surface (claim/take/batch/who/widen/set-paths/say/landable/done/release/flush/…) + its exit-code contract, emitted from src/FS.GG.Coord.Core/Protocol.fs; shipped as the FS.GG.Coord.Cli dotnet tool |
 | `github` | `telemetry-host` | `0.9.0` | `0.9.0` | `github:0.9.0` | optional Linux x64 FS.GG.Telemetry.Host dotnet tool — authenticated workspace-scoped ingestion, private dashboard, protected native capture and bounded learning export; independently versioned from the github coordination coherent set |
 | `github` | `new-sdd-workspace` | `0.23.1` | `0.23.1` | `github:0.23.1` | the `new-sdd-workspace` scaffolder CLI (package FS.GG.NewSddWorkspace) — one-command full-stack SDD workspace creation, wrapping the FS.GG.Templates `rendering` provider (ADR-0016); shipped as a dotnet tool |
 | `templates` | `fs-gg-workspace-template` | `0.20.1` | `0.20.1` | `templates:0.20.1` | FS.GG.Workspace.Template package, twelve template configurations and eleven `dotnet new` selectors: workspace-provider identities — `fs-gg-console` (provider `console` — minimal F# executable, no npm lane, ADR-0072 §2); `fs-gg-web` (provider `web` — F# ASP.NET Core + plain TypeScript/Vite website, ADR-0071 §3); `fs-gg-fable-game` (provider `fable-game` — F# ASP.NET Core + Fable/Elmish game client, SignalR for connection-oriented real-time traffic + plain HTTP endpoints with explicit versioned DTOs for typed request/response per ADR-0073, consuming the published `fs-gg-game-core-fable-lockstep-v1` profile per ADR-0069); `fs-gg-fable-bindings` (provider `fable-bindings` — Fable interop library over an exactly pinned npm package/declaration closure, ADR-0072 §3, first proved by the unreleased EHotwagner/babylonjsBindings reference) — plus `fs-gg-governance`, the separately registered pre-existing governance overlay template folded into this package at the same rename; `fs-gg-project-knowledge` and `fs-gg-python` are also already packaged; 0.20.0 adds the four distinct executable CLI workspace providers `fs-gg-typescript-cli`, `fs-gg-javascript-cli`, `fs-gg-rust-cli` and `fs-gg-go-cli` (Templates#441). The current and legacy fable-game configurations share one selector.  |

.claude/skills/atlas/assets/seed/records/0e9612ab3e2095fdf2eeeb3b08d690f03ce16e7f7ce948a10d2159b267769651.json

@@ -0,0 +1 @@
+{"citations":[{"path":"tools/routine-delivery.py","repository":"FS-GG/.github","revision":"838710090ed81c09506fb24c34ffdaa6576faee0","sha256":"a4bd7aef91505d84a5a3f13da8006f98d4c67473ecd3e290031c9f8551915097"},{"path":".github/workflows/routine-eligibility.yml","repository":"FS-GG/.github","revision":"838710090ed81c09506fb24c34ffdaa6576faee0","sha256":"45bbb3d5fe1780ac135c1576b3fd76196f3cd636b33371b9f502a8795baf8d93"},{"path":".github/workflows/routine-eligibility.yml","repository":"FS-GG/HighBarV3","revision":"9f9c873a2fc6d8ec761c2f5faf2ffe25eeac508d","sha256":"45bbb3d5fe1780ac135c1576b3fd76196f3cd636b33371b9f502a8795baf8d93"}],"conflictsWith":[],"id":"github/highbar-routine-bootstrap","kind":"lesson","recordedAt":"2026-11-02T21:15:22Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"HighBar first-install qualification is receiver-bound: authenticate repository identity, default branch, permissions, complete current classic/effective/inherited policy and repository/organization runner variables. Preserve the pinned existing ci.yml and all pre-existing leaves while adding exactly the canonical five producer files. Require the candidate original pull_request attempt, ten job/check identities, native app/run/suite joins and successful expected technical steps. Conditional self-hosted skips are acceptable only when the independently observed variable state disables them; reported required checks remain additional. Denied or incomplete metadata cannot prove empty policy. Existing receivers retain their guards. Source integration alone does not establish producer installation, and installation readback remains activation-pending until a genuine ordinary event succeeds.\n\nObserved on 2026-11-02: source PR5262 merged as83871009; HighBar PR18 original ci run41525442352/a1 qualified five hosted successes and five conditional skips. Canonical installation merged as9f9c873a and retained all1,293 original leaves plus five additions. A meaningful PR17 description update, with its reviewed3b2969af head and markers unchanged, produced actual edited pull_request_target run41526415756/a1. Its live-base validator resolved the stale event base b57f11f2 to installed default9f9c873a, and normal maintained inspection returned routineEligibility=passed and producerInstallation=not-selected. Thus an old PR base payload is not evidence of stale validator execution; verify the live-base resolution and exact native job/run instead. Client merge/adoption remains separate. These observations are historical acceptance evidence, not authority for future effects; refresh all operational facts.","supersedes":[],"tags":["highbar","routine","bootstrap","ci","provenance"],"title":"HighBar bootstrap separates canonical installation from normal client eligibility"}

.claude/skills/atlas/assets/seed/records/3242912d15a34fbaba05e5e4ef959577b2572533305bdd2e4aa24fe8b0fd1173.json

@@ -0,0 +1 @@
+{"citations":[{"path":"src/FS.GG.Coord.GitHub/V2ConstructorClosure.fs","repository":"FS-GG/.github","revision":"6e31c592cc3ef34ad75071aa0e820150a236a033","sha256":"71cf7d414de66a0823a5ad0610d2d19e1f675045c51de76817dfd986259b7de1"},{"path":"src/FS.GG.Coord.GitHub/V2EnrollmentCommands.fs","repository":"FS-GG/.github","revision":"6e31c592cc3ef34ad75071aa0e820150a236a033","sha256":"49abbf8ae59b3dcfa73e030ba815f23f71484e973e3bffd5d78568da3b1b1e91"},{"path":"src/FS.GG.Coord.GitHub/V2Projection.fs","repository":"FS-GG/.github","revision":"6e31c592cc3ef34ad75071aa0e820150a236a033","sha256":"e116511602039b4f3d2e904c8a60d458a2add783d534574c950850cf5b41d2cf"},{"path":"docs/coordination/board-v2-import-preparation.md","repository":"FS-GG/.github","revision":"6e31c592cc3ef34ad75071aa0e820150a236a033","sha256":"c9822ee7e2eb4a96fbfb9834115c7f655ac7ed5bf6042ad50b001eb7ed26d0c9"}],"conflictsWith":[],"id":"github/enrollment-release-registration-and-archived-membership","kind":"lesson","recordedAt":"2026-11-02T21:31:33Z","repository":"FS-GG/.github","schema":"fsgg.atlas/1","status":"recorded","summary":"Observed during protected enrollment recovery: the published0.114.4 constructor refused its descendant main solely because the accepted postpublication registry flip changed dist/dotnet/.config/dotnet-tools.json from0.114.3 to0.114.4 inside its build closure. Republishing alone repeats that cycle. The reviewed source adds one typed equivalence for the exact self-pin semantic change, joined to the actual engine host stable version, loaded constructor/host source and native coherent-set tag; all other closure and ancestry refusals remain. Separately, an active Project inventory omits archived enrolled cards although issue.projectItems retains them. Reconcile missing predecessor nodes through the maintained complete exact-project identity/pagination reader, requiring explicit archive state, and preserve the original enrollment prefix; do not infer removal from absence. Conflicting, partial or unarchived reads remain Unknown. Original Unsupported evidence and effects stay immutable. Source review/325offline controls do not establish publication, installed caller qualification, successor enrollment or scheduled acceptance. A successor requires supported runtime/reader rebinding and joint archive binding, commitment, reader and matching acceptance receipt qualification before activation; neither a prior receipt nor a source merge authenticates new inputs.","supersedes":[],"tags":["enrollment","release","source-identity","archived-membership","qualification"],"title":"Protected enrollment must distinguish release registration from source drift and archived from absent membership"}

.claude/skills/publishing-and-deployment/SKILL.md

@@ -36,7 +36,7 @@ Registry release inventory: 20 package-bearing contracts across 10 producers; 17
 | `game` | `game-render-browser` | `0.19.0` | `0.19.0` | `game:0.19.0` | FS.GG.Game.Render.Browser package — Fable browser host for renderer selection: RendererDriver, SvgSurface, RetainedSvgSurface, PixiSurface and BabylonSurface over the shared FS.GG.UI.Scene, the canvas SceneInteraction input host, BrowserRenderers and BrowserConformance; npm @babylonjs/core 9.33.1 and pixi.js 8.22.0 |
 | `audio` | `fs-gg-audio` | `0.6.0` | `0.6.0` | `audio:0.6.0` | FS.GG.Audio.Core/.Host/.Engine/.Elmish/.WebBrowser public .fsi surfaces — AudioEffect vocabulary + IAudioBackend/IMixingBackend seam + mixing Engine + Audio.Cmd Elmish bridge + browser Web Audio host |
 | `net` | `fs-gg-net` | `0.6.0` | `0.6.0` | `net:0.6.0` | FS.GG.Net.Core/.WebSocket/.WebSocket.Server/.Protobuf/.Grpc/.Elmish public .fsi surfaces — ITransport/IMessageChannel seam + Sequential/Multiplexed correlation + serve/ServerEcho + WebSocket client/server transport + Google.Protobuf/protobuf-net codecs + gRPC lifecycle bridge + Elmish Cmd/Sub |
-| `github` | `coord-engine` | `0.114.4` | `0.114.4` | `github:0.114.4` | the `fsgg-coord-engine` CLI verb surface (claim/take/batch/who/widen/set-paths/say/landable/done/release/flush/…) + its exit-code contract, emitted from src/FS.GG.Coord.Core/Protocol.fs; shipped as the FS.GG.Coord.Cli dotnet tool |
+| `github` | `coord-engine` | `0.114.5` | `0.114.4` | `github:0.114.4` | the `fsgg-coord-engine` CLI verb surface (claim/take/batch/who/widen/set-paths/say/landable/done/release/flush/…) + its exit-code contract, emitted from src/FS.GG.Coord.Core/Protocol.fs; shipped as the FS.GG.Coord.Cli dotnet tool |
 | `github` | `telemetry-host` | `0.9.0` | `0.9.0` | `github:0.9.0` | optional Linux x64 FS.GG.Telemetry.Host dotnet tool — authenticated workspace-scoped ingestion, private dashboard, protected native capture and bounded learning export; independently versioned from the github coordination coherent set |
 | `github` | `new-sdd-workspace` | `0.23.1` | `0.23.1` | `github:0.23.1` | the `new-sdd-workspace` scaffolder CLI (package FS.GG.NewSddWorkspace) — one-command full-stack SDD workspace creation, wrapping the FS.GG.Templates `rendering` provider (ADR-0016); shipped as a dotnet tool |
 | `templates` | `fs-gg-workspace-template` | `0.20.1` | `0.20.1` | `templates:0.20.1` | FS.GG.Workspace.Template package, twelve template configurations and eleven `dotnet new` selectors: workspace-provider identities — `fs-gg-console` (provider `console` — minimal F# executable, no npm lane, ADR-0072 §2); `fs-gg-web` (provider `web` — F# ASP.NET Core + plain TypeScript/Vite website, ADR-0071 §3); `fs-gg-fable-game` (provider `fable-game` — F# ASP.NET Core + Fable/Elmish game client, SignalR for connection-oriented real-time traffic + plain HTTP endpoints with explicit versioned DTOs for typed request/response per ADR-0073, consuming the published `fs-gg-game-core-fable-lockstep-v1` profile per ADR-0069); `fs-gg-fable-bindings` (provider `fable-bindings` — Fable interop library over an exactly pinned npm package/declaration closure, ADR-0072 §3, first proved by the unreleased EHotwagner/babylonjsBindings reference) — plus `fs-gg-governance`, the separately registered pre-existing governance overlay template folded into this package at the same rename; `fs-gg-project-knowledge` and `fs-gg-python` are also already packaged; 0.20.0 adds the four distinct executable CLI workspace providers `fs-gg-typescript-cli`, `fs-gg-javascript-cli`, `fs-gg-rust-cli` and `fs-gg-go-cli` (Templates#441). The current and legacy fable-game configurations share one selector.  |

Directory.Build.props

@@ -658,7 +658,7 @@
     <!-- Unpublished 0.114.4 source cut also carries the ordinary active Core 10.1.403
          baseline (#5253) and reviewed LEARN Atlas records (#5249). Existing published
          identities and frozen runtime/profile inputs remain separately qualified. -->
-    <FsggCoherentSetVersion>0.114.4</FsggCoherentSetVersion>
+    <FsggCoherentSetVersion>0.114.5</FsggCoherentSetVersion>
   </PropertyGroup>
 
 </Project>

docs/architecture.md

@@ -669,7 +669,7 @@ product's `FS.GG.UI.*` pin), which is a different axis from the template package
 | `game-render-browser` | FS.GG.Game | `0.19.0` | `0.19.0` |
 | `fs-gg-audio` | FS.GG.Audio | `0.6.0` | `0.6.0` |
 | `fs-gg-net` | FS.GG.Net | `0.6.0` | `0.6.0` |
-| `coord-engine` | FS-GG/.github | `0.114.4` | `0.114.4` |
+| `coord-engine` | FS-GG/.github | `0.114.5` | `0.114.4` |
 | `telemetry-host` | FS-GG/.github | `0.9.0` | `0.9.0` |
 | `new-sdd-workspace` | FS-GG/.github | `0.23.1` | `0.23.1` |
 | `fs-gg-workspace-template` | FS.GG.Templates | `0.20.1` | `0.20.1` |