docs: align release guidance with Base 1.10

.github/workflows/scenarios.yml

@@ -26,7 +26,7 @@ jobs:
             base: ac8d294421e1bfc14afa8c6a2a12f1affb5268ee
             options: ""
           - lane: advisory-v1.10-candidate
-            base: 5f316aeddc3680b92bd209fcfe652eac020d02d0
+            base: 06715fed19aceff27844aba546ba2a0b4c594ac7
             options: --candidate
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

docs/base-capability-matrix.md

@@ -8,10 +8,12 @@ evidence that this repository does not execute.
 Current Base release: `1.9.0`  
 Planned Base release: `1.10.0`
 
-The repository's CI still exercises the immutable Base `v1.8.0` compatibility
-pin. That is recorded as a gap below until the compatibility train updates the
-pin and adds the release-specific evidence. A moving local Base checkout is
-useful for development, but does not by itself establish released compatibility.
+The stable CI lane exercises the immutable Base `v1.9.0` compatibility pin. A
+separate advisory lane exercises the exact Base `v1.10.0` candidate commit; it
+is useful release evidence, but does not establish released compatibility until
+Base publishes `v1.10.0` and the final downstream BOM is verified. A moving
+local Base checkout is useful for development, but does not by itself establish
+either claim.
 
 ## Capability matrix
 
@@ -22,16 +24,16 @@ useful for development, but does not by itself establish released compatibility.
 | Workspace onboarding, agent handoff, and AI context | `1.9.0` | Workspace onboarding and agent-brief JSON are checked in [`.github/workflows/tests.yml`](../.github/workflows/tests.yml); the project context is indexed by [`.ai-context/overview.md`](../.ai-context/overview.md) | Workspace paths must be inside the configured workspace; WSL2 follows the Linux boundary | Demonstrated | Base + base-demo | Add a row when a new handoff artifact becomes user-facing. |
 | Representative build, test, service, environment, and non-interactive demo loop | `1.9.0` | The manifest targets in [`base_manifest.yaml`](../base_manifest.yaml), baseline gate in [`tests/validate.sh`](../tests/validate.sh), and focused suites in [`tests/services_test.bats`](../tests/services_test.bats), [`tests/environments_test.bats`](../tests/environments_test.bats), and [`tests/demo_test.bats`](../tests/demo_test.bats) | Full project loop is macOS; Ubuntu/Debian validates Base setup and project health only | Demonstrated | base-demo | Add executable evidence before calling a new service or command demonstrated. |
 | Linux and WSL2 read-only support boundary | `1.9.0` | The supported commands and explicit native-Windows boundary are in [`README.md`](../README.md) and [`docs/contracts.md`](contracts.md); CI's Ubuntu path is in [`.github/workflows/tests.yml`](../.github/workflows/tests.yml) | Ubuntu/Debian and WSL2 use setup, dev-profile, check, and doctor/read-only paths; native Windows is excluded | Demonstrated | Base + base-demo | Keep platform claims tied to a hosted or repository-local check. |
-| Base `1.9.0` released-compatibility pin and full Go/live-HTTP evidence | `1.9.0` | Structured pins in [supported inputs](../.release/supported-dependencies.json), verified by `bin/base-demo-dependencies`; full-language and live-HTTP gates run in [`.github/workflows/tests.yml`](../.github/workflows/tests.yml) | Exact macOS 14 full demo and Ubuntu 24.04 setup/read-only scope; no Linux full-demo claim | Demonstrated | Base + base-demo | Bind final-candidate runs during #303; later dependency changes require fresh proof. |
+| Base `1.9.0` released-compatibility pin and full Go/live-HTTP evidence | `1.9.0` | Structured pins in [supported inputs](../.release/supported-dependencies.json), verified by `bin/base-demo-dependencies`; full-language and live-HTTP gates run in [`.github/workflows/tests.yml`](../.github/workflows/tests.yml) | Exact macOS 14 full demo and Ubuntu 24.04 setup/read-only scope; no Linux full-demo claim | Demonstrated | Base + base-demo | Keep the stable pin unchanged until the final v1.10.0 release BOM is verified; candidate refresh is tracked by #324. |
 | Workspace inventory, selected tests and targeted recovery | `1.9.0` reports; exact `1.10.0` candidate | `tests/scenarios/workspace.py` and [workspace scenario guide](workspace-scenarios.md), run by isolated scenario CI | macOS fixture lane; selection and expanded recovery require the exact candidate | Demonstrated | Base + base-demo | Refresh candidate evidence before release; do not claim stable 1.10 support. |
 | Trust lifecycle and separate runtime/IDE consent | `1.9.0` baseline; exact `1.10.0` candidate | `tests/scenarios/trust.py` and [trust scenario guide](trust-scenarios.md), executed by [isolated scenario CI](../.github/workflows/scenarios.yml) | macOS fixture lane; full historical revocation and runtime inspection require the pinned candidate | Demonstrated | Base + base-demo | Refresh exact candidate evidence before release; do not attribute candidate-only guarantees to v1.9.0. |
 | Optional `test.requirements` and uninstall guidance | `1.9.0` | The manifest test entry and contributor setup guidance are [`base_manifest.yaml`](../base_manifest.yaml) and [`README.md`](../README.md) | Optional metadata is not required for the baseline demo contract | Intentionally omitted | base-demo | Revisit when Base publishes a stable user-facing contract and a concrete scenario. |
 | Native Windows support | `1.11.0` (planned) | The current non-goal is recorded in [`README.md`](../README.md); the staged Base work is tracked by [base-demo#302](https://github.com/basefoundry/base-demo/issues/302) and Base [#2215](https://github.com/basefoundry/base/issues/2215) | Native Windows is not shipped; Git Bash and WSL2 do not count as native Windows evidence | Blocked upstream | Base + base-demo | Wait for the PowerShell-first Base contract and hosted Windows evidence. |
 | First-class Base Docker-service contract | Future | The existing Compose fixture is documented in [`docs/tooling-testbed.md`](tooling-testbed.md) and [`infra/compose.yaml`](../infra/compose.yaml); adoption remains tracked by [base-demo#163](https://github.com/basefoundry/base-demo/issues/163) and Base [#124](https://github.com/basefoundry/base/issues/124) | Compose is a repository fixture; it does not establish a Base Docker-service contract | Blocked upstream | Base + base-demo | Do not make the future Base command a required demo dependency before Base publishes it. |
 
-The matrix intentionally leaves release-process, BOM, and dependency alignment
-implementation out of this train. Those lanes remain separately tracked and
-must not be inferred from the capability statuses above.
+The matrix intentionally does not treat the advisory candidate lane as a stable
+release or final BOM. Release publication and final evidence binding remain
+separately tracked and must not be inferred from the capability statuses above.
 
 ## Release review checklist
 

docs/dependency-inputs.md

@@ -50,9 +50,12 @@ No successful run, wrong input, failed job, or unavailable GitHub lookup means
 no publication. Finalizing without `--evidence-run` remains useful for identity
 fixtures but does not certify the artifacts for publication.
 
-The README interim installer remains deliberately pinned to older reviewed
-script bytes, which consume Base 1.8.0 and demo 0.1.0. Current source inputs do
-not change that historical script. #303 owns the new public release-asset URL.
+The published README installer is pinned to the reviewed v0.2.0 release asset,
+which consumes Base 1.9.0 and demo v0.2.0. The stable source inputs remain
+unchanged while Base v1.10.0 is still a candidate. Refreshing the advisory
+candidate source revision is tracked by #324; it must not be mistaken for a
+stable dependency update or a final release asset. #303 owns the public
+release-asset URL.
 
 ## Candidate boundary
 

docs/first-success.md

@@ -12,7 +12,7 @@ build, test and demo paths require macOS. Bash must be 4.2 or newer. Contributor
 need the toolchains declared by the manifest/mise configuration; setup may
 install tools and change the project environment, so preview it first.
 
-Need Base first? Follow the canonical [adopter golden path](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/adopter-golden-path.md)
+Need Base first? Follow the canonical [adopter golden path](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/adopter-golden-path.md)
 for install and consent decisions, then select the stable inputs above. That
 document is pinned for reference, not an instruction to substitute its candidate
 for the stable runtime. The README's checksum-verified [Quick Start](../README.md#quick-start)
@@ -56,20 +56,20 @@ an unexplained error. `--yes` does not grant command trust or IDE consent.
 new project under a separate workspace. Choose one existing, harmless project
 validation command; do not copy the demo's entire toolchain or service graph.
 
-Follow [the adopter golden path's project recipe](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/adopter-golden-path.md#adopt-an-external-style-project)
+Follow [the adopter golden path's project recipe](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/adopter-golden-path.md#adopt-an-external-style-project)
 to declare that command in your own manifest, preview setup, inspect command
 surfaces, approve the reviewed digest, and run your project's test. Keep command
 approval, runtime inspection and IDE mutation as separate decisions. The demo's
 `test: mise: validate` is an example, not a requirement for adopters.
 
 **Done:** your declared test passes in the intended checkout and a handoff PR
 contains the manifest, test output, version/provider identities and remaining
-warnings. Use [JSON quickstart](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/json-output-quickstart.md)
+warnings. Use [JSON quickstart](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/json-output-quickstart.md)
 for machine-readable evidence; check both JSON status and process exit.
 
 **Safe failure/recovery:** preview setup with `basectl setup --dry-run` before
 applying it. A missing prerequisite or stale environment is a diagnostic, not
-permission to grant more trust. Use [first-run troubleshooting](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/first-run-troubleshooting.md)
+permission to grant more trust. Use [first-run troubleshooting](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/first-run-troubleshooting.md)
 to repair the specific finding and rerun validation. Review any proposed IDE or
 shell-profile changes separately. This internal rehearsal is not independent
 external-adoption evidence.
@@ -102,7 +102,7 @@ does not select a service environment or fix other readiness findings. Inspect
 each remaining finding; do not declare success from the marker alone. Services
 use `services --env dev` separately; staging/prod are non-operational examples.
 
-For release work, use the canonical [downstream release smoke test](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/downstream-release-smoke-test.md)
+For release work, use the canonical [downstream release smoke test](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/downstream-release-smoke-test.md)
 and the demo's [release policy](release.md). A contributor PR is not permission
 to tag or publish. The [complete command reference](../README.md#complete-command-reference)
 remains available after these short paths.

docs/trust-scenarios.md

@@ -31,7 +31,7 @@ inspection are demonstrated only against the implemented v1.10 candidate.
 The stable lane prints this boundary and does not invoke candidate-only flags.
 
 The separate advisory lane uses exact Base commit
-`5f316aeddc3680b92bd209fcfe652eac020d02d0`. Run the same command with that
+`06715fed19aceff27844aba546ba2a0b4c594ac7`. Run the same command with that
 checkout/commit and add `--candidate`. A published v1.10 release is not required,
 but a moving branch is not an acceptable substitute for the recorded revision.
 Both lanes run in [isolated scenario CI](../.github/workflows/scenarios.yml).
@@ -62,4 +62,4 @@ that the host is ready. Local temporary paths are redacted from assertion
 diagnostics. `tests/scenario_harness_test.py` verifies cleanup and redaction.
 
 For the authoritative boundaries, see Base's
-[command-trust policy](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/manifest-command-trust.md).
+[command-trust policy](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/manifest-command-trust.md).

docs/workspace-scenarios.md

@@ -23,7 +23,7 @@ workspace identity, missing-peer reporting and read-only behavior. It prints
 an explicit supported-version boundary without invoking newer flags.
 
 For the implemented 1.10 candidate, select its checkout and exact commit
-`5f316aeddc3680b92bd209fcfe652eac020d02d0`, and add `--candidate`.
+`06715fed19aceff27844aba546ba2a0b4c594ac7`, and add `--candidate`.
 [Scenario CI](../.github/workflows/scenarios.yml) runs both lanes. This is
 advisory candidate evidence, not a stable-release compatibility claim.
 
@@ -46,5 +46,5 @@ The candidate asserts:
 
 Each completed assertion group prints `PASS`; fixtures are removed on success
 or exception. There is no second application stack and no host-readiness claim.
-See the exact candidate's [workspace contract](https://github.com/basefoundry/base/blob/5f316aeddc3680b92bd209fcfe652eac020d02d0/docs/workspace-manifest.md)
+See the exact candidate's [workspace contract](https://github.com/basefoundry/base/blob/06715fed19aceff27844aba546ba2a0b4c594ac7/docs/workspace-manifest.md)
 for the authoritative API.

services/demo-console/package.json

@@ -28,5 +28,8 @@
     "jsdom": "28.1.0",
     "vite": "8.0.16",
     "vitest": "4.1.11"
+  },
+  "overrides": {
+    "source-map-js": "^1.2.2"
   }
 }

tests/dependency_inputs_test.py

@@ -1,5 +1,6 @@
 """The selection record and its materialized consumers must never drift."""
 import json
+import re
 from pathlib import Path
 import shutil
 import subprocess
@@ -51,6 +52,29 @@ def test_github_outputs_are_only_validated_scalars(self):
         self.assertEqual(output["base_cli_version"], "0.4.3")
         self.assertEqual(len(output["base_commit"]), 40)
 
+    def test_advisory_candidate_pin_matches_documented_references(self):
+        workflow = (ROOT / ".github/workflows/scenarios.yml").read_text()
+        match = re.search(
+            r"- lane: advisory-v1\.10-candidate\s+base: ([0-9a-f]{40})",
+            workflow,
+        )
+        self.assertIsNotNone(match)
+        candidate = match.group(1)
+        stable = json.loads(
+            (ROOT / ".release/supported-dependencies.json").read_text()
+        )["components"]["base"]["commit"]
+        documented = set()
+        for filename in (
+            "docs/trust-scenarios.md",
+            "docs/workspace-scenarios.md",
+            "docs/first-success.md",
+        ):
+            with self.subTest(filename=filename):
+                text = (ROOT / filename).read_text()
+                self.assertIn(candidate, text)
+                documented.update(re.findall(r"\b[0-9a-f]{40}\b", text))
+        self.assertEqual(documented, {stable, candidate})
+
 
 if __name__ == "__main__":
     unittest.main()