wip(sync): merge main into next with combined resolutions

README.md

@@ -107,7 +107,10 @@ mosaic config path           # Print config file path
 ```bash
 mosaic doctor                # Health audit — detect drift and missing files
 mosaic sync                  # Sync skills from canonical source
-mosaic update                # Check for and install CLI updates
+mosaic skill list            # Audit Claude skill registrations and conflicts
+mosaic skill register <name> # Register one canonical skill with Claude Code
+mosaic skill unregister <name> # Remove one Mosaic-owned Claude link
+mosaic update                # Update CLI/framework and auto-register canonical skills
 mosaic wizard                # Full guided setup wizard
 mosaic bootstrap <path>      # Bootstrap a repo with Mosaic standards
 mosaic coord init            # Initialize a new orchestration mission
@@ -167,7 +170,12 @@ mosaic storage status
 mosaic storage tier
 mosaic storage export
 mosaic storage import
-mosaic storage migrate
+# Schema migration is unavailable in this release. The current storage wrapper shells
+# directly to `pnpm --filter @mosaicstack/db db:migrate`; it is legacy N-1,
+# uncertified, and MUST NOT be invoked pending KBN-101-02/-03/-06/-08 activation.
+# Future schema migration is non-operative: external bootstrap → TLS/roles → runner
+# --run → runner --verify → readiness. Tier copy uses only the separately held secure
+# migrate-tier route.
 ```
 
 ### Telemetry
@@ -202,33 +210,50 @@ Consent state is persisted in config. Remote upload is a no-op until you run `mo
 git clone [email protected]:mosaicstack/stack.git
 cd stack
 
-# Start infrastructure (Postgres, Valkey, Jaeger)
-docker compose up -d
-
-# Install dependencies
+# Install dependencies. The local tier uses in-process PGlite; leave DATABASE_URL unset.
+# The pnpm store defaults to $HOME/.local/share/pnpm/store. Override it without
+# editing the checkout with NPM_CONFIG_STORE_DIR=$HOME/another-store if needed.
 pnpm install
 
-# Run migrations
-pnpm --filter @mosaicstack/db run db:migrate
+# Verify dependencies and generated state before running source-quality gates.
+# Missing dependencies exit 42; stale/foreign apps/web/.next state exits 43.
+# The web build certifies its exact standalone symlink manifest; added, removed,
+# retargeted, or manifest-only-tampered generated links also exit 43. This detects
+# accidental, independent, stale, and foreign-residue mutation—the class exposed by
+# a five-month-stale .next that produced 19 phantom TS2307 errors.
+# It does NOT defend against a same-UID actor that can rewrite both manifest and
+# marker consistently (CWE-345). RM-59 tracks the required executor/spine-side
+# trust anchor outside worktree authority.
+pnpm preflight
 
-# Start all services in dev mode
-pnpm dev
+# Optional local queue service only. This does not start PostgreSQL.
+docker compose up -d valkey
+
+# The current Gateway/Web local process is held; see docs/guides/dev-guide.md.
+# Do not start it until KBN-101-02 makes inherited dotenv/DSN state fail closed.
 ```
 
-### Infrastructure
+### Held future procedure
 
-Docker Compose provides:
+The checked-in Compose PostgreSQL service mounts legacy initialization SQL and is **not** a
+current PostgreSQL, standalone, or federated developer route. Do not start it with Compose,
+invoke initialization SQL, or treat the planned migrator as currently executable.
 
-| Service               | Port      | Purpose                |
-| --------------------- | --------- | ---------------------- |
-| PostgreSQL (pgvector) | 5433      | Primary database       |
-| Valkey                | 6380      | Task queue + caching   |
-| Jaeger                | 16686     | Distributed tracing UI |
-| OTEL Collector        | 4317/4318 | Telemetry ingestion    |
+**Held future activation procedure — non-operative and no current command authority until KBN-101-00, KBN-101-03, and KBN-101-05
+land:** external bootstrap → TLS/roles → `mosaic-db-migrator --run` →
+`mosaic-db-migrator --verify` → Gateway/Compose readiness. The future deployment artifacts—not
+this README—will provide the reviewed commands and secret-consumer interface.
+
+For local data-layer work, PGlite needs no PostgreSQL service. The optional Compose command above
+starts only Valkey; OTEL Collector and Jaeger may likewise be started individually if needed,
+without starting PostgreSQL. A Gateway/Web local process is not currently a safe PGlite route:
+its unguarded dotenv loader may inherit a daemon PostgreSQL DSN. Do not use root `pnpm dev` or a
+Gateway start command until KBN-101-02 makes that state fail closed.
 
 ### Quality Gates
 
 ```bash
+pnpm preflight               # Checkout/dependency/generated-state validation
 pnpm typecheck               # TypeScript type checking (all packages)
 pnpm lint                    # ESLint (all packages)
 pnpm test                    # Vitest (all packages)
@@ -241,7 +266,7 @@ pnpm format                  # Prettier auto-fix
 Woodpecker CI runs on every push:
 
 - `pnpm install --frozen-lockfile`
-- Database migration against a fresh Postgres
+- **Legacy N-1 CI status only — active, uncertified, and non-authorizing as an operator route:** the checked-in job currently invokes `pnpm --filter @mosaicstack/db run db:migrate` with `DATABASE_URL` against an isolated disposable PostgreSQL CI database. It performs direct DDL in that CI database, is not approved ordinary behavior or an operator route, and remains a known exception pending KBN-101-06 removal/replacement by the certified runner-backed CI path.
 - `pnpm test` (Turbo-orchestrated across all packages)
 
 npm packages are published to the Gitea package registry on main merges.
@@ -353,6 +378,8 @@ bash tools/install.sh --yes             # Non-interactive, accept all defaults
 bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```
 
+The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage.
+
 ## Contributing
 
 ```bash