ci: refresh Base v1.10 candidate pin

.github/workflows/scenarios.yml

@@ -26,7 +26,7 @@ jobs:
             base: ac8d294421e1bfc14afa8c6a2a12f1affb5268ee
             options: ""
           - lane: advisory-v1.10-candidate
-            base: 5f316aeddc3680b92bd209fcfe652eac020d02d0
+            base: 06715fed19aceff27844aba546ba2a0b4c594ac7
             options: --candidate
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

docs/first-success.md

@@ -12,7 +12,7 @@ build, test and demo paths require macOS. Bash must be 4.2 or newer. Contributor
 need the toolchains declared by the manifest/mise configuration; setup may
 install tools and change the project environment, so preview it first.
 
-Need Base first? Follow the canonical [adopter golden path](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/adopter-golden-path.md)
+Need Base first? Follow the canonical [adopter golden path](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/adopter-golden-path.md)
 for install and consent decisions, then select the stable inputs above. That
 document is pinned for reference, not an instruction to substitute its candidate
 for the stable runtime. The README's checksum-verified [Quick Start](../README.md#quick-start)
@@ -56,20 +56,20 @@ an unexplained error. `--yes` does not grant command trust or IDE consent.
 new project under a separate workspace. Choose one existing, harmless project
 validation command; do not copy the demo's entire toolchain or service graph.
 
-Follow [the adopter golden path's project recipe](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/adopter-golden-path.md#adopt-an-external-style-project)
+Follow [the adopter golden path's project recipe](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/adopter-golden-path.md#adopt-an-external-style-project)
 to declare that command in your own manifest, preview setup, inspect command
 surfaces, approve the reviewed digest, and run your project's test. Keep command
 approval, runtime inspection and IDE mutation as separate decisions. The demo's
 `test: mise: validate` is an example, not a requirement for adopters.
 
 **Done:** your declared test passes in the intended checkout and a handoff PR
 contains the manifest, test output, version/provider identities and remaining
-warnings. Use [JSON quickstart](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/json-output-quickstart.md)
+warnings. Use [JSON quickstart](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/json-output-quickstart.md)
 for machine-readable evidence; check both JSON status and process exit.
 
 **Safe failure/recovery:** preview setup with `basectl setup --dry-run` before
 applying it. A missing prerequisite or stale environment is a diagnostic, not
-permission to grant more trust. Use [first-run troubleshooting](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/first-run-troubleshooting.md)
+permission to grant more trust. Use [first-run troubleshooting](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/first-run-troubleshooting.md)
 to repair the specific finding and rerun validation. Review any proposed IDE or
 shell-profile changes separately. This internal rehearsal is not independent
 external-adoption evidence.
@@ -102,7 +102,7 @@ does not select a service environment or fix other readiness findings. Inspect
 each remaining finding; do not declare success from the marker alone. Services
 use `services --env dev` separately; staging/prod are non-operational examples.
 
-For release work, use the canonical [downstream release smoke test](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/downstream-release-smoke-test.md)
+For release work, use the canonical [downstream release smoke test](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/downstream-release-smoke-test.md)
 and the demo's [release policy](release.md). A contributor PR is not permission
 to tag or publish. The [complete command reference](../README.md#complete-command-reference)
 remains available after these short paths.

docs/trust-scenarios.md

@@ -31,7 +31,7 @@ inspection are demonstrated only against the implemented v1.10 candidate.
 The stable lane prints this boundary and does not invoke candidate-only flags.
 
 The separate advisory lane uses exact Base commit
-`5f316aeddc3680b92bd209fcfe652eac020d02d0`. Run the same command with that
+`06715fed19aceff27844aba546ba2a0b4c594ac7`. Run the same command with that
 checkout/commit and add `--candidate`. A published v1.10 release is not required,
 but a moving branch is not an acceptable substitute for the recorded revision.
 Both lanes run in [isolated scenario CI](../.github/workflows/scenarios.yml).
@@ -62,4 +62,4 @@ that the host is ready. Local temporary paths are redacted from assertion
 diagnostics. `tests/scenario_harness_test.py` verifies cleanup and redaction.
 
 For the authoritative boundaries, see Base's
-[command-trust policy](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/manifest-command-trust.md).
+[command-trust policy](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/manifest-command-trust.md).

docs/workspace-scenarios.md

@@ -23,7 +23,7 @@ workspace identity, missing-peer reporting and read-only behavior. It prints
 an explicit supported-version boundary without invoking newer flags.
 
 For the implemented 1.10 candidate, select its checkout and exact commit
-`5f316aeddc3680b92bd209fcfe652eac020d02d0`, and add `--candidate`.
+`06715fed19aceff27844aba546ba2a0b4c594ac7`, and add `--candidate`.
 [Scenario CI](../.github/workflows/scenarios.yml) runs both lanes. This is
 advisory candidate evidence, not a stable-release compatibility claim.
 
@@ -46,5 +46,5 @@ The candidate asserts:
 
 Each completed assertion group prints `PASS`; fixtures are removed on success
 or exception. There is no second application stack and no host-readiness claim.
-See the exact candidate's [workspace contract](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/workspace-manifest.md)
+See the exact candidate's [workspace contract](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/workspace-manifest.md)
 for the authoritative API.

services/demo-console/package.json

@@ -28,5 +28,8 @@
     "jsdom": "28.1.0",
     "vite": "8.0.16",
     "vitest": "4.1.11"
+  },
+  "overrides": {
+    "source-map-js": "^1.2.2"
   }
 }

tests/dependency_inputs_test.py

@@ -1,5 +1,6 @@
 """The selection record and its materialized consumers must never drift."""
 import json
+import re
 from pathlib import Path
 import shutil
 import subprocess
@@ -51,6 +52,29 @@ def test_github_outputs_are_only_validated_scalars(self):
         self.assertEqual(output["base_cli_version"], "0.4.3")
         self.assertEqual(len(output["base_commit"]), 40)
 
+    def test_advisory_candidate_pin_matches_documented_references(self):
+        workflow = (ROOT / ".github/workflows/scenarios.yml").read_text()
+        match = re.search(
+            r"- lane: advisory-v1\.10-candidate\s+base: ([0-9a-f]{40})",
+            workflow,
+        )
+        self.assertIsNotNone(match)
+        candidate = match.group(1)
+        stable = json.loads(
+            (ROOT / ".release/supported-dependencies.json").read_text()
+        )["components"]["base"]["commit"]
+        documented = set()
+        for filename in (
+            "docs/trust-scenarios.md",
+            "docs/workspace-scenarios.md",
+            "docs/first-success.md",
+        ):
+            with self.subTest(filename=filename):
+                text = (ROOT / filename).read_text()
+                self.assertIn(candidate, text)
+                documented.update(re.findall(r"\b[0-9a-f]{40}\b", text))
+        self.assertEqual(documented, {stable, candidate})
+
 
 if __name__ == "__main__":
     unittest.main()