sebyx07 · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026 · Aug 20, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -4,7 +4,7 @@ Hand-written, deliberately short. The *facts* about this codebase are generated
 
 ## What this repo is
 
-The **Ultimate** web framework. Bun-only, Postgres, SolidJS, SCSS tokens. A monorepo of 27 `@ultimat3/*` packages — the `x` CLI among them — plus the unscoped `create-ultimate`. All 28 publish to npm at **1.0.0** in lockstep, `As of 2026-08`.
+The **Ultimate** web framework. Bun-only, Postgres, SolidJS, SCSS tokens. A monorepo of 29 `@ultimat3/*` packages — the `x` CLI among them — plus the unscoped `create-ultimate`. All 30 publish to npm at **3.0.0** in lockstep, `As of 2026-08-19`. Run `bun run scripts/list-workspaces.ts` rather than trusting this line; `scripts/release-facts.ts` now fails the gate when it drifts.
 
 No ORM dependency, `As of 2026-08`: `entity()` is the one table declaration, and `postgresDriver()` (`packages/entity/src/pg-driver.ts`, `pg-sql.ts`) is hand-written parameterised SQL. Generated apps declare their tables the same way — `packages/db/` holds those declarations plus plain-SQL migrations.
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,11 +8,12 @@ Semver applies from 1.0.0. A breaking change to a documented API needs a major
 
 ## [Unreleased]
 
-Five bug sweeps since 3.0.0. The second was six independent auditors over the packages the 3.0.0
+Six bug sweeps since 3.0.0. The second was six independent auditors over the packages the 3.0.0
 sweep did not reach; the third added a whole-repo security pass and an architecture review, and
 found more than the first two combined; the fourth closed the known-gaps backlog; the fifth
-typechecked the 966 test files no compiler had ever read and then deleted what nothing calls.
-**Twenty-two** of the entries below are breaking changes to documented APIs and one needs a
+typechecked the 966 test files no compiler had ever read and then deleted what nothing calls; the
+sixth closed the known-gaps backlog and mounted two gates that had been built and never wired.
+**Twenty-six** of the entries below are breaking changes to documented APIs and one needs a
 migration run, so the next release is a major.
 
 Four findings are worth reading even if you skip the rest, because each was a guarantee the code
@@ -21,6 +22,47 @@ stated in a comment and did not keep: every authenticated websocket carried `act
 built and handed to nobody, and `references(() => t.id, { onDelete: 'cascade' })` had type-checked
 since 1.0 while reaching no SQL at all.
 
+### Removed — BREAKING (sixth sweep: the known-gaps backlog)
+
+- **BREAKING — `CaptureOptions.timeoutMs` and the public `CaptureRequest.timeout` are deleted from
+  `@ultimat3/scraping`** (#211). The port required it, `page-over-target.ts` threaded it, and **no
+  driver honoured it** — `cdp-target.ts` reads only `fullPage`, its `pdf` names the parameter
+  `_options`, and `html-target.ts` ignores it. Deleted rather than honoured for a reason worth
+  recording: the CDP port's own `screenshot({ fullPage })` has no timeout slot to forward to, and a
+  generic deadline in `page-over-target.ts` would have to race `ScrapeClock.sleep` — which under
+  `testClock` advances the clock and resolves on the first microtask, so the deadline would win
+  every race and **every capture in every test would time out**. A knob no driver honoured takes
+  nothing away when it goes; a deadline that fires in tests and not in production would. Both
+  layers went, because leaving the public `CaptureRequest.timeout` behind would make it the new lie.
+- **BREAKING — `ScrapeTarget.click`'s `index` parameter is deleted** (#212). The HTML driver
+  honoured it and the CDP driver dropped it, and they agreed only because the sole caller passed
+  `0`. The decisive fact: **`index` was unreachable from the public vocabulary** — `ScrapeFrame.click`
+  takes `(selector, options?: WaitOptions)` and has no index, so no app could set it. A port member
+  no caller can reach, honoured by one driver and dropped by the other, is a divergence waiting for
+  an app to find. A three-driver parity test over a multi-match fixture now covers it.
+- **BREAKING — `adminResource` no longer pluralises an entity name.** `@ultimat3/admin` carried a
+  private English pluralizer, and **every entity in both tracked apps is already named plural** —
+  so `entity('orgs')` was served at `/admin/orgses`, with `/admin/medias` and `/admin/likeses`
+  queued behind it. The fix is a deletion rather than a better pluralizer: which plural a name
+  takes is an app's convention, not a mechanism the framework can own (axiom 8), and `path:` was
+  always the override. Migration: an app relying on the old doubled URL sets `path:` explicitly.
+
+### Added (sixth sweep)
+
+- **`X_SCRAPE_YIELD_HISTORY_MISSING`** (#154) — `expect.maxDrop` measures a fall against a trailing
+  baseline, and with no `history:` store `expect.ts` reads `[]` forever, so `X_SCRAPE_YIELD_COLLAPSED`
+  could never fire. A silent no-op in a scrape *expectation* is a scrape that cannot fail. Refused
+  at declaration time, where it is written, before any attempt exists. `expect.minRows` is an
+  absolute floor checked *before* the history gate and stays legal on its own.
+- **`StorageDriver.verifySigned` and `X_STORAGE_URL_UNVERIFIABLE`** (#145) — `acceptSignedUpload`
+  required a `secret:` that no route could supply, because the signing secret was closed over inside
+  `localDriver`'s factory. `StorageDriver` already hoisted `signedUrlBase` so "the minting half and
+  the verifying half cannot state it twice"; the secret was the other half of that pair and was
+  never hoisted. The new member exposes **verification, never the key** — a member returning the
+  secret would let any holder of a driver mint a URL for any key, and would put it in every
+  `JSON.stringify(disk)` a log performs. `acceptSignedUpload` now works with no secret in the call.
+  The `PUT` route is still unmounted; the seam that blocked it is not.
+
 ### Removed — BREAKING (fifth sweep: delete what nothing calls)
 
 - **BREAKING — `PrecacheAsset.critical` is deleted from `@ultimat3/pwa`.** It was declared and read
@@ -360,6 +402,63 @@ reach. Five of the entries below are **breaking changes to documented APIs**.
 - Everything else in PRs #179–#186, each of which names the defect it closes.
 
 
+## 3.0.1
+
+### Added
+
+- four conventions become build errors, and two were already broken
+- typecheck the tests, on a ratchet — 966 files the gate never read (#208)
+- canonicalJson, fingerprint and compareDecimalText — one home for three that had two (#191)
+
+### Fixed
+
+- the production image ran the dev server, and nothing built it (#215)
+- two documented options that no caller could make effective (#207)
+- both tracked apps could bake .env.production into their image (#206)
+- secrets shipped inside the production image, and four other things x new got wrong (#205)
+- delete a knob nothing read, stop echoing request bodies, and check the identity live queries depend on (#203)
+- the generated schema told four lies, and drift could see none of them (#202)
+- the error-render gate could not see the shape it let through six times (#198)
+- the wedge watchdog's abort half was built and never wired (#197)
+- the semantic cache defaulted to one store for every tenant (#196)
+- qidOf was queryHash written twice, and the two already disagreed (#195)
+- every Date collided into one cache key, and two tenants shared one dedupe slot (#194)
+- a thrown code named toString made Pipeline.handle reject (#193)
+- an allow list sent as a string matched every subject containing it (#192)
+- 90 recorded ranges said 1.2.0 and 2.0.0 while every package.json said 3.0.0 (#190)
+- deleting every scheduled task and dropping every primary key was a clean x verify (#185)
+- the icon name from network data reached a filesystem path and a TypeScript identifier (#186)
+- a permanent mail refusal was retried five times, and one document indexed as nine copies of one sentence (#184)
+- every authenticated websocket carried actor: null, and the test stub hid it (#183)
+- a limiter shed vanished from queue_depth, silencing the HPA exactly when saturated (#182)
+- an actor holding a role named "constructor" turned every authz denial into a 500 (#181)
+- an app shipping only Spanish served English error pages, and nothing could see it (#180)
+- a declared field named toString was unsatisfiable for every input (#179)
+- two admin actions could share a name and dispatch to the wrong one (#178)
+- an ISR route with a policy served the first actor's HTML to everybody (#177)
+- an unreadable TOTP secret verified against a code needing no secret (#176)
+- a serialization retry budget of NaN ran the transaction zero times (#175)
+- three of these bugs were reachable through a key nobody typed (#174)
+- close the four deferred issues — and two of them were not what their issue said (#163)
+
+### Changed
+
+- a direct grant was unspellable, and userActor silently dropped it (#218)
+- delete two declarations that describe features nothing implements (#217)
+- the last 102 test typecheck errors, and RowPatch could not spell the value it refuses (#216)
+- 229 more test typecheck errors, and the fetch seam no caller could fill (#214)
+- the tests typecheck, and four of the errors were the type being wrong (#210)
+- the gap registry said "fixed" about six things that were not, and "open" about fourteen that were (#209)
+- replace a stale economy measurement with a reproducible one (#204)
+- all 30 packages clear 95%, and six bugs found while getting there (#201)
+- ui moves 5 → 4, and the admin → ui exception is deleted (#200)
+- three sweeps, twelve breaking changes and one migration — the next release is a major (#199)
+- how much code you do not write, and why the bugs matter more than the lines (#189)
+- one job per package — its own tests, its own lint, its own coverage bar (#188)
+- the second sweep landed five breaking changes, and the next release is a major (#187)
+- 3.0.0 is on npm, and the publishers were re-attached, not attached (#162)
+
+
 ## 3.0.0 - 2026-08-19
 
 The first release the workflow has published since 1.2.0. Every package has an OIDC trusted

diff --git a/README.md b/README.md
@@ -68,9 +68,21 @@ do with the product. The framework's job is to have already decided those things
 spends its budget on the feature, and on a floor whose failure modes were found once, here, rather
 than once per app.
 
+**Roughly 9× — that is the multiplier.** For every line of production code the author of
+[`dummy/social-media-clone`](dummy/social-media-clone/) owns, the framework already runs **8.8** on
+their behalf: 63,949 code lines across the 17 packages that app executes, against 7,227 of its own.
+Counting everything hand-written including tests, against all framework source, it is **11.1 : 1**.
+
+Read that as *code you never own, never test and never fix* — **not** as "a DIY build of this app
+would be nine times bigger". It would not be: a DIY build reaches for libraries too. What the
+multiplier measures is how much of the surface has already been decided, and where a bug gets fixed
+when one is found. The honest per-feature figure is sharper anyway: **~16 code lines buy a fully
+projected endpoint** — input schema, output schema, policy, an OpenAPI operation, an MCP tool and a
+typed client, all drift-checked. Write those six by hand once and the ratio stops being abstract.
+
 **A line the app author never writes cannot carry a bug.** So the payoff is measured as how little
 the author owns. The worked example is [`dummy/social-media-clone`](dummy/social-media-clone/) — the
-deployed demo, `As of 2026-08-19`, counted with `git ls-files` + `tokei 14.0.0`. Every figure below
+deployed demo, `As of 2026-08-20`, counted with `git ls-files` + `tokei 14.0.0`. Every figure below
 is **code** lines, never `wc -l`: comments are 21% of this app's raw lines, so a raw count overstates
 it by a fifth. Where a raw number appears it is labelled raw.
 
@@ -106,15 +118,15 @@ the five handles. The rest of the app holds the shape:
 | Tests | 45 | 2,482 |
 | SCSS | 25 | 1,658 |
 | the `en` catalog | 1 | 397 |
-| config, Compose, Dockerfiles, env, shell | 31 | 379 |
-| **Total** | **222** | **9,707** |
-| production only — total minus tests | 177 | **7,225** |
+| config, Compose, Dockerfiles, env, shell | 31 | 381 |
+| **Total** | **222** | **9,709** |
+| production only — total minus tests | 177 | **7,227** |
 
 | Framework : app | Ratio |
 |---|---|
-| the **17 runtime packages this app executes** (63,754 code) : its production code (7,225) | **8.8 : 1** |
-| all framework source (106,939 code, 1,073 files) : everything hand-written here (9,707) | **11.0 : 1** |
-| the same, plus the framework's 142,922 lines of test code : hand-written (9,707) | 25.7 : 1 — test code on one side only, so read it as reassurance, not leverage |
+| the **17 runtime packages this app executes** (63,949 code) : its production code (7,227) | **8.8 : 1** |
+| all framework source (107,809 code, 1,080 files) : everything hand-written here (9,709) | **11.1 : 1** |
+| the same, plus the framework's 144,046 lines of test code : hand-written (9,709) | 25.9 : 1 — test code on one side only, so read it as reassurance, not leverage |
 
 Re-derive all three (`tokei` 14.0.0; `node_modules`, `.x/`, `dist/` and `coverage/` are gitignored,
 so `git ls-files` never enters them):

diff --git a/docs/architecture/README.md b/docs/architecture/README.md
@@ -5,7 +5,7 @@ How Ultimate is built. [`../idea/`](../idea/README.md) answers *what and why*; t
 | Doc | Hook |
 |---|---|
 | [`00-conventions.md`](./00-conventions.md) | File layout, naming, export surface, LOC ceilings — the rules Biome and `x verify` enforce. |
-| [`01-package-map.md`](./01-package-map.md) | 28 packages, 6 tiers, one reason to change each. What every package owns and must never do. |
+| [`01-package-map.md`](./01-package-map.md) | 29 packages, 6 tiers, one reason to change each. What every package owns and must never do. |
 | [`02-boundaries.md`](./02-boundaries.md) | Tier violations are build errors. `scripts/boundaries.ts` resolves the transitive chain and prints it. |
 | [`03-request-lifecycle.md`](./03-request-lifecycle.md) | 17 ordered stages and why each sits where it does. ALS context, so no layer threads `actor`. |
 | [`04-error-contract.md`](./04-error-contract.md) | `UltimateError`: one object, three renderings. Every error carries an executable `fix:`. |

diff --git a/dummy/social-media-clone/openapi.json b/dummy/social-media-clone/openapi.json
@@ -605,6 +605,16 @@
               }
             },
             "description": "policy denied"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "createAccount",
@@ -664,6 +674,16 @@
               }
             },
             "description": "policy denied"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "runAdminAction",
@@ -744,6 +764,16 @@
               }
             },
             "description": "X_IDEMPOTENCY_CONFLICT"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "Ask another user to be friends",
@@ -824,6 +854,16 @@
               }
             },
             "description": "X_IDEMPOTENCY_CONFLICT"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "Accept or decline a friend request addressed to the caller",
@@ -883,6 +923,16 @@
               }
             },
             "description": "policy denied"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "Readiness of this process",
@@ -942,6 +992,16 @@
               }
             },
             "description": "policy denied"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "Send a message to a conversation the actor is already in",
@@ -1022,6 +1082,16 @@
               }
             },
             "description": "X_IDEMPOTENCY_CONFLICT"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "Mark the acting user's notifications as read",
@@ -1081,6 +1151,16 @@
               }
             },
             "description": "policy denied"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "createSession",
@@ -1140,6 +1220,16 @@
               }
             },
             "description": "policy denied"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "destroySession",
@@ -1220,6 +1310,16 @@
               }
             },
             "description": "X_IDEMPOTENCY_CONFLICT"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "Block a user and decline any friendship between them",
@@ -1279,6 +1379,16 @@
               }
             },
             "description": "policy denied"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "X_BODY_INVALID"
           }
         },
         "summary": "Lift a block this user placed",