docs: refresh release candidate evidence

Author: Shaelz

CHANGELOG.md

@@ -12,8 +12,11 @@
   help-line overlay after medium/large local validation.
 - Clarify the cold-user install-to-first-map path across README, installed
   `SKILL.md`, CLI help, and installer/package contract checks.
-- Refresh the M6 release-candidate record for the current private `main` tip
-  with working-tree and fresh-clone deterministic validation evidence.
+- Refresh the M6 release-candidate record for the latest validated candidate
+  content with working-tree and fresh-clone deterministic validation evidence.
+- Align the README with the sister `codebase-orient` style, including a
+  user-first quickstart, delegated install prompt, first-use separation,
+  authority-boundary table, validation guidance, and release-status navigation.
 - Add the active `v1.0.0` release plan, including fixed scope, product
   contracts, implementation workstreams, release gates, validation matrices,
   known risks, and the immediate self-contained-package milestone.

README.md

@@ -386,7 +386,7 @@ This repository is still pre-public and pre-tag. For release navigation:
 - Medium/large pressure evidence: [`docs/releases/MEDIUM_LARGE_PRESSURE_VALIDATION.md`](docs/releases/MEDIUM_LARGE_PRESSURE_VALIDATION.md)
 - Remaining questions: [`docs/ai/OPEN_QUESTIONS.md`](docs/ai/OPEN_QUESTIONS.md)
 
-Current `main` is deterministic-check ready for the remaining human and publication gates, not public-release complete. Independent cold-user validation, final manual GitHub UI-only checks, public-only security/ruleset setup, and the final tag/release/publication decision remain. If new commits land before tagging, exact-candidate validation must be refreshed.
+The latest validated candidate content is deterministic-check ready for the remaining human and publication gates, not public-release complete. Independent cold-user validation, final manual GitHub UI-only checks, public-only security/ruleset setup, and the final tag/release/publication decision remain. If maintainers choose a later content commit for tagging, exact-candidate validation must be refreshed.
 
 ## Reference and contributor notes
 

docs/V1_RELEASE_PLAN.md

@@ -24,12 +24,12 @@ final validation record is frozen.
 | `docs/releases/M6_REWRITE_DRY_RUN_RECORD.md` | historical rewrite dry-run evidence |
 | `docs/ai/OPEN_QUESTIONS.md` | remaining non-blocking questions and final gates |
 
-Current `main` is deterministic-check ready for independent cold-user
-validation and final publication preparation. It is not public-release complete
-until independent validation, manual GitHub UI-only checks, public-only
-security/ruleset setup, and the final tag/release/publication decision finish.
-If any new commits land before tagging, refresh exact-candidate validation for
-the new tip.
+The latest validated candidate content is deterministic-check ready for
+independent cold-user validation and final publication preparation. It is not
+public-release complete until independent validation, manual GitHub UI-only
+checks, public-only security/ruleset setup, and the final tag/release/publication
+decision finish. If maintainers choose a later content commit for tagging,
+refresh exact-candidate validation for that content.
 
 ## 1. V1 definition
 
@@ -724,7 +724,8 @@ before visibility changes.
 
 The initial GitHub exposure inventory, controlled rewrite plan, rewrite dry
 run, real private-history rewrite, private-safe GitHub settings pass, and
-current-tip deterministic release-candidate validation are complete. The next
-M6 execution slice is independent cold-user validation and final public-switch
-preparation; visibility remains private throughout. If any new commits land
-before tagging, exact-candidate validation must be refreshed again.
+validated-candidate deterministic release-candidate evidence is complete. The
+next M6 execution slice is independent cold-user validation and final
+public-switch preparation; visibility remains private throughout. If maintainers
+choose a later content commit for tagging, exact-candidate validation must be
+refreshed again.

docs/ai/OPEN_QUESTIONS.md

@@ -13,12 +13,12 @@ Last refreshed: 2026-06-06
   available.
 - **Final publication gates:** The private remote history has been rewritten,
   the publishable-history audit passes, private-safe GitHub settings are
-  applied, and the current private `main` tip has deterministic
-  release-candidate validation from both the working tree and a fresh private
+  applied, and the latest validated candidate content has deterministic
+  release-candidate evidence from both the working tree and a fresh private
   clone. Remaining gates are independent cold-user validation, final manual
   GitHub UI-only checks, public-only security/ruleset setup, and the final
-  tag/release/publication decision. If new commits land before tagging, refresh
-  exact-candidate validation for the new tip.
+  tag/release/publication decision. If maintainers choose a later content
+  commit for tagging, refresh exact-candidate validation for that content.
 - **Manual GitHub UI checks:** The maintained API audit is in
   `docs/releases/M6_GITHUB_EXPOSURE_AUDIT.md`. Before changing visibility,
   manually glance at UI-only surfaces such as social preview and any package

docs/releases/M6_RELEASE_CANDIDATE_VALIDATION.md

@@ -4,10 +4,10 @@ Status: current private release candidate validated; final publication pending
 
 Date: 2026-06-06
 
-## Candidate
+## Candidate Content
 
-- Revision: `3af10027da52a8e10897422cc8bdc93ee927356b`
-- Tree: `4be5e6b5b5d1278b7e481de36c4e15fa11b111d9`
+- Revision: `ea12abe1a6499b69ffaafe66dbe233d213960808`
+- Tree: `bbe6422f8b8217500203cdb5620506c5bbc6c56b`
 - Product version: `0.0.1`
 - Graph schema version: `1.0.0`
 - Repository visibility during validation: private
@@ -20,6 +20,16 @@ The current candidate was validated from the maintainer worktree and from a
 fresh private GitHub clone outside the repository. Raw local clone paths and
 command logs are intentionally not recorded in maintained documentation.
 
+This candidate includes the README sister-skill alignment pass that reshaped
+the README around the same user-first quickstart, first-use separation,
+authority-boundary, validation, and reference structure as `codebase-orient`.
+
+This record validates the candidate content revision above. The commit that
+updates this evidence record necessarily follows the validated candidate
+revision and should not be confused with a self-referential release-candidate
+proof. If maintainers choose a later commit as the tag target, exact-candidate
+validation must be refreshed for that later content.
+
 ## Environment
 
 - Primary OS: Windows with PowerShell
@@ -34,15 +44,16 @@ command logs are intentionally not recorded in maintained documentation.
 ## Automated Evidence
 
 - `npm run check`: passed from the working tree and fresh GitHub clone
-- `npm run check:evals`: passed from the working tree
+- `npm run check:evals`: passed from the working tree and WSL2 quick check
 - `npm run check:public`: passed from the working tree and fresh GitHub clone
 - `npm run check:public:history`: passed from the working tree and fresh
-  GitHub clone
+  GitHub clone; also passed in WSL2 quick check
 - `npm run check:public:contracts`: passed from the working tree and fresh
   GitHub clone
 - `npm audit --audit-level=high`: passed with zero vulnerabilities
 - CLI help for `scan`, `render`, and `visualize`: passed from both contexts
 - copied-package integrity check: passed through `npm run check`
+  and WSL2 quick check
 - installer matrix: passed through `npm run check`
 - generated-map interaction smoke check: passed through `npm run check`
 - `git diff --check`: passed in the working tree
@@ -53,8 +64,8 @@ command logs are intentionally not recorded in maintained documentation.
 
 The fresh private GitHub clone matched the candidate exactly:
 
-- Revision: `3af10027da52a8e10897422cc8bdc93ee927356b`
-- Tree: `4be5e6b5b5d1278b7e481de36c4e15fa11b111d9`
+- Revision: `ea12abe1a6499b69ffaafe66dbe233d213960808`
+- Tree: `bbe6422f8b8217500203cdb5620506c5bbc6c56b`
 - Branch: `main`
 - Worktree after checks: clean
 
@@ -69,18 +80,16 @@ Fresh-clone checks:
 
 ## Linux Quick Check
 
-The earlier WSL2 quick check used the then-current exact candidate checkout
-with Linux-native Node:
+The WSL2 quick check used the current exact candidate checkout with
+Linux-native Node:
 
 - `npm run check:public`: passed
 - `npm run check:public:history`: passed
 - `npm run check:package`: passed
 - `npm run check:evals`: passed
 
-The WSL2 GitHub clone attempt itself was not used as evidence because the
-private repository authentication path inside Ubuntu timed out. The Windows
-fresh GitHub clone is the authoritative clean-clone evidence for this refreshed
-record.
+The Windows fresh GitHub clone remains the authoritative clean-clone evidence
+for this refreshed record.
 
 ## Live-Fire And Visual Evidence
 
@@ -119,12 +128,12 @@ Known limitations:
   release settings remain deferred until visibility and release timing make
   them safe.
 - No `v1.0.0` tag or release has been created.
-- If any new commits are added before tagging, this exact-candidate validation
-  must be refreshed for the new tip.
+- If any later content commit is selected for tagging, this exact-candidate
+  validation must be refreshed for that content.
 
 Release decision:
 
-The current private `main` candidate is deterministic-check ready for the
-remaining human and publication gates. It is ready for independent cold-user
-validation and final publication preparation, but it is not yet public-release
-ready because independent validation and public-only GitHub actions remain.
+The validated candidate content is deterministic-check ready for the remaining
+human and publication gates. It is ready for independent cold-user validation
+and final publication preparation, but it is not yet public-release ready
+because independent validation and public-only GitHub actions remain.

docs/releases/PUBLIC_RELEASE_CHECKLIST.md

@@ -135,10 +135,10 @@ Maintained M6 records:
 
 Current deterministic candidate status:
 
-- Current private `main` tip has fresh working-tree and clean-clone
+- Latest validated candidate content has fresh working-tree and clean-clone
   deterministic validation evidence.
 - Independent cold-user validation, final manual GitHub UI-only checks,
   public-only security/ruleset setup, and final tag/release/publication
   decisions remain.
-- If any new commits land before tagging, refresh the exact-candidate
-  validation record for the new tip.
+- If maintainers choose a later content commit for tagging, refresh the
+  exact-candidate validation record for that content.