diff --git a/.changeset/pre.json b/.changeset/pre.json
new file mode 100644
index 0000000..bdcad14
--- /dev/null
+++ b/.changeset/pre.json
@@ -0,0 +1,80 @@
+{
+  "mode": "pre",
+  "tag": "next",
+  "initialVersions": {
+    "@buildtovalue/adapters-bpmn": "1.1.0",
+    "@buildtovalue/agentflow": "1.0.0",
+    "@buildtovalue/anchor-git": "1.0.1",
+    "@buildtovalue/anchor-rfc3161": "1.0.1",
+    "@buildtovalue/anchor-s3": "1.0.1",
+    "@buildtovalue/audit": "1.1.0",
+    "@buildtovalue/cli": "1.0.1",
+    "@buildtovalue/conformance": "1.1.0",
+    "@buildtovalue/copilot": "1.0.1",
+    "@buildtovalue/core": "1.1.0",
+    "@buildtovalue/dmn": "1.0.1",
+    "@buildtovalue/domain-example": "1.0.0",
+    "@buildtovalue/engine": "1.1.0-next.0",
+    "@buildtovalue/example": "1.0.0",
+    "@buildtovalue/forms": "1.0.0-next.0",
+    "@buildtovalue/forms-react": "1.0.0-next.0",
+    "@buildtovalue/healthcare": "1.0.0",
+    "@buildtovalue/identity": "1.0.1",
+    "@buildtovalue/library": "1.0.0",
+    "@buildtovalue/library-react": "1.0.1",
+    "@buildtovalue/lint": "1.1.0",
+    "@buildtovalue/react": "1.1.0",
+    "@buildtovalue/registry": "1.0.1",
+    "@buildtovalue/replay": "1.0.0",
+    "@buildtovalue/sfeel": "1.0.0",
+    "@buildtovalue/simulation": "1.0.1",
+    "@buildtovalue/soundness": "1.0.1",
+    "@buildtovalue/studio": "1.1.0"
+  },
+  "changesets": [
+    "command-palette-cheatsheet",
+    "compensation-core",
+    "compensation-ledger",
+    "compensation-lint",
+    "compensation-react",
+    "compensation-simulation",
+    "conformance-eventsubprocess-errata",
+    "copilot-apply-not-approve",
+    "escalation-bridge-ledger",
+    "escalation-core-bucket",
+    "escalation-lint-profiles",
+    "escalation-react-visual",
+    "escalation-simulation",
+    "event-defs-ui",
+    "event-io-execution-tab",
+    "event-subprocess-core",
+    "event-subprocess-interactions",
+    "event-subprocess-lint",
+    "event-subprocess-shapes",
+    "event-subprocess-simulation",
+    "foreign-extension-passthrough",
+    "governed-event-bindings",
+    "honest-event-matching",
+    "lane-body-tiling",
+    "library-react-i18n",
+    "named-event-definitions",
+    "preferredtypes-contract",
+    "public-compensation-fixtures",
+    "request-changes-cycle",
+    "sl-1-tool-contract",
+    "sl-10-simulate-squad",
+    "sl-10-squad-trail",
+    "sl-11-evidence-bundle",
+    "sl-12-bpmn-bridge",
+    "sl-13-readiness-reconciliation",
+    "sl-2-tool-provider",
+    "sl-3-budget",
+    "sl-4-schema-delegate",
+    "sl-5-inspector-tabs",
+    "sl-6-problems-panel",
+    "sl-7-evalset-coverage",
+    "sl-8-squad-readiness",
+    "sl-9-squad-studio",
+    "timer-and-event-lint"
+  ]
+}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0980fc1..be723b2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,12 +44,27 @@ jobs:
 
       # Releases consume changesets: fail loudly when pending changesets have
       # not been versioned (`pnpm version-packages`) before dispatching.
+      # PRE-MODE aware: em pre mode os .md ficam no diretório até o
+      # `changeset pre exit` — "pendente" é só o que NÃO consta como aplicado
+      # em .changeset/pre.json. Sem pre.json, todo .md é pendente (fluxo comum).
       - name: Check for unconsumed changesets
         run: |
-          if npx changeset status --output=/dev/null 2>/dev/null && [ -n "$(find .changeset -name '*.md' ! -name 'README.md' -print -quit)" ]; then
-            echo "::error::Pending changesets found — run 'pnpm version-packages' and merge the version PR before releasing."
-            exit 1
-          fi
+          node -e "
+            const fs = require('fs');
+            const pre = fs.existsSync('.changeset/pre.json')
+              ? JSON.parse(fs.readFileSync('.changeset/pre.json', 'utf8'))
+              : null;
+            const mds = fs.readdirSync('.changeset')
+              .filter((f) => f.endsWith('.md') && f !== 'README.md')
+              .map((f) => f.replace(/\.md$/, ''));
+            const applied = new Set(pre ? pre.changesets : []);
+            const pending = mds.filter((id) => !applied.has(id));
+            if (pending.length > 0) {
+              console.error('::error::Pending changesets (' + pending.length + '): ' + pending.join(', ') + \" — run 'pnpm version-packages' and merge the version PR before releasing.\");
+              process.exit(1);
+            }
+            console.log(pre ? 'pre mode (' + pre.tag + '): ' + applied.size + ' changesets versionados retidos — ok' : 'nenhum changeset pendente — ok');
+          "
 
       # Software Bill of Materials for the release (CycloneDX JSON), attached
       # as a build artifact for supply-chain transparency / SBOM requirements.
diff --git a/packages/adapters-bpmn/CHANGELOG.md b/packages/adapters-bpmn/CHANGELOG.md
index 3997a27..860f5ac 100644
--- a/packages/adapters-bpmn/CHANGELOG.md
+++ b/packages/adapters-bpmn/CHANGELOG.md
@@ -1,5 +1,200 @@
 # @buildtovalue/adapters-bpmn
 
+## 1.2.0-next.0
+
+### Minor Changes
+
+- 2d65a69: Handoff 19 CO-5 (§6e) — compensation → ledger glue + the read-only planner that
+  completes the OMG trigger family (message/signal/error/escalation/compensation).
+
+  - `@buildtovalue/adapters-bpmn` gains `compensationTriggeredEntry` +
+    `COMPENSATION_TRIGGERED_TYPE`: a PURE builder (the engine stays intact) the
+    host appends when compensation ACTUALLY runs. The entry ties the EXECUTED plan
+    (`compensated` in reverse order + `uncompensated` declared); `details.author`
+    prefixed `ia.copilot@` paints the ✦ AI seal (the `aiAuthorOf` rule). A blocked
+    specific target appends NOTHING (reforço 8).
+  - `@buildtovalue/simulation` exposes `compensationPlan(activityRef?)` — a
+    READ-ONLY computation (reforço 7: it reads the trail/diagram, never mutates)
+    that is the SINGLE source both `compensate()` (record + run) and the host's
+    ledger glue (append the EXECUTED reversal) consume, so the two never
+    re-derive. New exported types `CompensationPlan` / `CompensationStep`.
+  - `@buildtovalue/react` `BpmnSimulator` gains the `onCompensationTriggered`
+    prop (path a — the engine stays pure): the demo/host reads the plan BEFORE
+    firing and appends the ledger entry only when something reversed.
+
+- a127e70: feat(adapters-bpmn): escalationRaisedEntry + catálogo governado de escalação (Handoff 18 EC-3, §5c)
+
+  A ponte agente→humano ganha a cola de ledger, sem tocar o motor nem o agentflow:
+
+  - **`escalationRaisedEntry({actor, code, target})`** — builder PURO (molde
+    `eventBindingChangedEntry`/`reviewCommentEntry`) que mapeia uma escalação RAISADA
+    para o `AuditEntryInput` que o HOST appenda via `command.executed`; motor
+    intacto. `details.author` carrega o ator para o selo ✦ do Explorer
+    (`aiAuthorOf`): escalação de IA (`ia.copilot@…`) sela ✦, humana não — na mesma
+    trilha. `ESCALATION_RAISED_TYPE` exportado; apiSurface.
+  - **`GovernedEventDefinitionRecord`** passa a tipar `kind` por `EventDefinitionRefKind`
+    (fonte única, ganha `escalation`) e `definition` ganha `escalationCode?` — o
+    catálogo/resolver E-3 resolve refs governadas de escalação (chip esc@ VIGENTE).
+
+  **Semântica (reforço 7):** `ESCALATION_RAISED` = "a escalação ACONTECEU", nunca
+  "o boundary foi desenhado". Nesta EC: builder + teste de host-append com gatilho
+  DEMONSTRATIVO no teste — a cola runtime (append quando `throwEscalation` disparar)
+  é da EC-5 (registrado em `pendencias.md`). O demo `?agentbridge=1` (no `example`)
+  mostra o desenho da ponte — agentTask (🤖 + ref), boundary NÃO-interrupting
+  governado (chip esc@ + chip de autoridade ↟) e revisão/assinatura humana — sem
+  observar o ledger ainda.
+
+  Zero dependência nova entre pacotes: agentflow segue independente (guard
+  `no-runtime-deps` + teste de independência), adapters-bpmn não importa react, o
+  `example` faz a cola. Degradação sem agentflow intacta (o agentTask renderiza pelo
+  shape do react core — teste).
+
+- 5215bae: Handoff 16 E-3 — governed event-definition bindings (`nome@semver`) via the
+  Biblioteca (spec §3b). react: the host injects a synchronous
+  `EventDefinitionResolver` through `BpmnPlugin.eventDefinitionResolver` (first
+  wins — the editor never consults a registry); the E-2 picker gains a
+  "Da Biblioteca" section whose selection binds in ONE composite
+  (`buildBindCommand`: local `gov-{nome}` mirror upsert + `eventDefinitionRef` +
+  pinned `properties.eventDefinitionBinding`, serialized as an ordinary
+  `bpmnr:property` — byte-stable, never a vendor attribute); unbinding
+  (`buildUnbindCommand`) garbage-collects the orphaned mirror in the same
+  composite. A canvas chip (transient — excluded from exports) and a panel seal
+  show the resolution state with glyph+text (`✓ VIGENTE` / `⚠ CANDIDATA` /
+  `✕ NÃO RESOLVIDA`), degrading DECLAREDLY to plain text when no resolver is
+  configured. `eventBindingRule(resolver)` validates bindings —
+  `SIG_REF_MISSING` (error) / `SIG_REF_STALE` (warning) — through the existing
+  issue badges. The `gov-*` mirror is read-only in the panel (managed by the
+  Library; editing = promoting a new version) and counts as a normal usage for
+  the deletion veto, and the pin never moves on artifact promotion — only an
+  explicit, audited re-bind. adapters-bpmn: `eventDefinitionCatalogAdapter`
+  (read-only Biblioteca catalog, one card per name with the version timeline)
+  and `eventBindingChangedEntry`/`EVENT_BINDING_CHANGED_TYPE` (ledger builder
+  for the explicit ref change, host-appended).
+- 47d0de8: Handoff 15 V-6 — request-changes cycle (spec §2e). `VersionStatus` grows the
+  additive `in-review` (EM REVISÃO ⟲) state: entered only by request-changes
+  (candidate → in-review) and left only by re-submission (→ candidate), both
+  through the core state machine; the status round-trips in XML via
+  `bpmnr:version` like every other. `identity` adds
+  `buildChangeRequestPayload` (+`CanonicalChangeRequestPayload`): the signed
+  request binds versionRef + attached open threadRefs + the mandatory
+  justification, verified by the unchanged `verifySignature`. `react` adds
+  `buildChangeRequestPayloadFor`, the ⟲ gold seal (StatusBadge/VersionTimeline/
+  i18n `status.in-review`) and scopes `reviewThreadsRule` to `target: 'active'`
+  only — request-changes passes with open threads by design. `adapters-bpmn`
+  adds `reviewChangesRequestedEntry` (+`REVIEW_CHANGES_REQUESTED` type) and maps
+  `in-review` → `candidate` for the Biblioteca (documented loss) with the ⟲
+  seal surviving in the gallery meta. `studio` adds `requestChanges` (the
+  default soft path — `rejectPromotion` stays as the documented hard reject),
+  the signed "Pedir mudanças…" flow in the ReviewScreen, the
+  `review.changes.requested` N-3 bridge (`onReviewEvent`) and the re-submission
+  diff that opens against the version that requested changes (v-pedido →
+  v-nova) via registry lineage.
+- b4557cd: SL-11 — EvidenceBundle as a canonical audit entry + ExecutionStore + LedgerExplorer renderer
+  (Handoff 22 "Squad Lane").
+
+  - `EvidenceBundle` (adapters-bpmn) — a neutral, serializable evidence record for one squad run, the
+    squad analog of a simulation `Session`. It wraps the masked fact trail from `simulateSquad` (agentflow,
+    which never imports audit/core) and REQUIRES the three governance refs: `policyRefs`,
+    `decisionRuleRefs`, `maskingPolicyRef` (acceptance §10.4). `buildEvidenceBundle` REFUSES (throws) a bundle
+    whose masked trail names no masking policy — masked evidence with no named policy is not attributable.
+    It reuses core's integrity primitives (`canonicalJsonExact` + `sha256Hex`), never a bespoke format:
+    `canonicalEvidenceBundle` exports byte-identical canonical JSON and `hashEvidenceBundle` hashes it
+    deterministically (2× identical).
+  - `evidenceBundleEntry` maps a bundle to an `AuditEntryInput`. Appended through the normal
+    `AuditLedger.append()`, the entry is hashed whole by core's v2 `computeEntryHash`, so the ledger's own
+    `verify()` — and `@buildtovalue/audit`'s `verifyLedger`, which recomputes the identical hash — validate it
+    with NO evidence-specific code. Tampering with a recorded ref breaks the chain (proven). `evidenceBundleOf`
+    reconstructs the bundle from the chain (the chain IS the store).
+  - `ExecutionStore` (born here) — the injected, DEGRADABLE seam where a host persists evidence bundles: a
+    consumer given `undefined` simply does not persist (the run still produces its bundle).
+    `createInMemoryExecutionStore` is the default (records + lists newest-first) for tests/demos; a real host
+    swaps durable storage without this package importing one.
+  - LedgerExplorer (studio) — a dedicated `evidence` category chip + a governance-refs detail section that
+    surfaces the mandatory masking policy / policies / decision rules + the masked fact count, with a canonical
+    evidence-bundle download. The section only renders when the masking policy is present (never unattributed
+    evidence). i18n EN + PT-BR (react studio fragment).
+  - Vectors: mandatory-refs enforcement, canonical + hash determinism, ledger verify (+ tamper detection),
+    chain round-trip, ExecutionStore degradability, and the renderer. apiSurface (adapters-bpmn) + typedoc updated.
+
+- 627dbea: SL-2 — TOOL catalog + selector binding + the injectable `ToolProvider` (Handoff 22 "Squad Lane").
+
+  - **adapters-bpmn:** `toolAdapter(contracts)` surfaces `ToolContract` artifacts in the Biblioteca as
+    "mais um adapter" (type `FERRAMENTA`), mirroring the non-diagram `copilotPromptAdapter` mold — one
+    artifact per tool id, versions grouped, governance posture (effect/authorization) in `meta`,
+    read-only. `resolveToolContract(contracts)` is the shared headless resolver the catalog and the
+    react provider both use (one registry, never a parallel truth).
+  - **react:** the `ToolProvider` interface is born here (`{ resolve; list?() }`, implementing agentflow's
+    `ResolveTool` — types flow down react→agentflow) plus `createToolProvider(contracts)`. It is injected
+    as an optional `toolProvider` prop on `AgentStudio` (the `AIProvider`/H9 mold). The tool inspector
+    binds by **selector/autocomplete** — impossible to type a loose string (cerca §2.2) — showing the
+    resolved contract's effect + capability inline, and a declared `TOOL_UNRESOLVED` warning when the bound
+    ref is not in the catalog. `validateGraph` now runs with `{ resolveTool: toolProvider?.resolve }`.
+  - **Degradability:** with no provider the binding degrades to the pre-SL-2 typed text field and the graph
+    still validates (contract-aware checks simply do not run) — never a crash, never silence. Covered by a
+    render test (provider undefined → plain field; provider that lists → selector + effect chip; provider
+    that cannot resolve → visible warning, no validation error).
+  - Drag-into-node from the catalog is explicitly OUT of the MVP and registered in `pendencias.md` (§11).
+
+- 88b9f0f: SL-7 — EvalSet + promotion gate + prompt coverage validator (Handoff 22 "Squad Lane").
+
+  - **agentflow (headless):** the `EvalSet` artifact (`eval:*@semver`, assertions ONLY regex/contains/schema —
+    never code) + `runEvalSet(evalSet, wf)` which runs every case through the deterministic `simulate` engine
+    and scores the assertion pass-rate. A new `finalOutput(state)` recovers the run's merged output from the
+    `end` trail entry (SimulationState is parity-pinned, so it carries no output field) — one tested owner of
+    that parsing; a blocked run yields `undefined` and fails the case honestly. Same fixtures 10× → identical
+    report.
+  - **adapters-bpmn:** `evalSetAdapter(evalSets)` surfaces EvalSets in the Biblioteca (type `AVALIAÇÃO`, TOOL
+    mold) and `evalPromotionGate(wf, evalSet)` blocks promotion to active below `promotionThreshold` — a
+    `RuleVerdict` in the SAME shape as `agentPromotionGate` (reusing the evaluateGates/PromotionRule path, not
+    a new mechanism), with `EVAL_BELOW_THRESHOLD` as the stable token in the reason. An eval with no assertions
+    never blocks (honest degradation).
+  - **react:** the `PromptProvider` interface (`resolve`/`save`, mirroring `ToolProvider`) + `createPromptProvider`,
+    injected as an optional `AgentStudio` prop. The Intelligence tab gains the prototype-05 **coverage validator**
+    (transparent textarea over a highlight backdrop of `{{var}}` spans + a coverage bar) — the prompt TEXT is
+    resolved through the provider (the body lives in the Library btv:prompt artifact, NEVER on the AgentWorkflow),
+    edits persist via `save`, and it degrades honestly (no provider → absent; unresolvable ref → declared warning;
+    no `save` → read-only). Reduced-motion respected on the coverage bar.
+  - Positive + negative + determinism vectors for `runEvalSet`/`finalOutput`; the four-case promotion-gate
+    pattern for `evalPromotionGate`; adapter list/get/reject; coverage-validator render + degradation + "edits
+    hit the artifact, not the workflow". i18n EN+PT_BR; independence/structuralShape/corpus untouched.
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [2d65a69]
+- Updated dependencies [81e4756]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [3d7be05]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [b204522]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [fcaaa8f]
+- Updated dependencies [56fe142]
+- Updated dependencies [c8223c9]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [98b285e]
+- Updated dependencies [7f73b05]
+- Updated dependencies [dc29b38]
+- Updated dependencies [5de2c92]
+- Updated dependencies [9a715ec]
+- Updated dependencies [b9d565e]
+- Updated dependencies [88b9f0f]
+- Updated dependencies [fdc42b9]
+- Updated dependencies [febc376]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+  - @buildtovalue/simulation@1.1.0-next.0
+  - @buildtovalue/lint@1.2.0-next.0
+  - @buildtovalue/agentflow@1.1.0-next.0
+  - @buildtovalue/copilot@1.1.0-next.0
+  - @buildtovalue/registry@1.0.2-next.0
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/adapters-bpmn/package.json b/packages/adapters-bpmn/package.json
index 2978cd1..a4da4d8 100644
--- a/packages/adapters-bpmn/package.json
+++ b/packages/adapters-bpmn/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/adapters-bpmn",
-  "version": "1.1.0",
+  "version": "1.2.0-next.0",
   "description": "ArtifactAdapter implementations for the BuildToValue Studio library (Handoff 6 S-2): BPMN flow, persona, prompt, connector and policy adapters over the version registry, a DMN decision adapter, headless SVG thumbnails, plus the in-memory \"recipe\" fixture adapter that proves the library's genericity (acid test §10.1). Zero runtime dependencies beyond @buildtovalue/*.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/agentflow/CHANGELOG.md b/packages/agentflow/CHANGELOG.md
new file mode 100644
index 0000000..c7b90d4
--- /dev/null
+++ b/packages/agentflow/CHANGELOG.md
@@ -0,0 +1,200 @@
+# @buildtovalue/agentflow
+
+## 1.1.0-next.0
+
+### Minor Changes
+
+- 98b285e: SL-1 — Tool as a versioned contract (Handoff 22 "Squad Lane").
+
+  - New `ToolContract` artifact type (capability + I/O schema + effect/authorization
+    matrix, cerca §2.8) and the honest JSON-Schema subset it uses (`ToolSchema`,
+    `ToolSchemaField`). Pure, headless, zero ecosystem imports (independence test).
+  - `tool` nodes now bind to a versioned `tool:*@semver` ref (`usesTool`), validated
+    by `validateGraph`:
+    - `TOOL_REF_INVALID` (error) — `usesTool` is not a `tool:id@major.minor.patch` ref;
+    - `TOOL_REF_ABBREVIATED` (warning) — an abbreviated tool version, never accepted silently;
+    - `TOOL_UNRESOLVED` (warning) — the injected `ToolProvider` (`resolveTool`) cannot resolve
+      the ref (declared, never silent §2.4); with no provider the check degrades to the
+      structural ref check only;
+    - `TOOL_PARAMS_MISMATCH` (error) — node params do not satisfy the contract `inputSchema`
+      (missing required / unknown keys);
+    - `TOOL_EFFECT_UNGATED` (error) — a `write-irreversible`/`external-commitment` effect whose
+      contract `authorization` is not `gate`. This is the acid-safe HEADLESS half — it reads only the
+      injected `ToolContract`, never the process. The process-level rules the handoff §6 lists
+      (`EFFECT_NEEDS_GATE` / `GATE_NOT_COVERING`, "a gate covering the action" over `reachableGateFrom`)
+      are born in `@buildtovalue/core` at SL-12 and reuse the pure predicate below.
+  - New helpers `isToolRef`, `matchToolParams`, and the pure classifier `effectRequiresGate(effect)`
+    (the `requiresDownstreamGate` mold, consumed by core in SL-12); `ValidateOptions` gains the injected,
+    degradable `resolveTool`. Positive + negative + remediation vectors for every new code; the acid test
+    binds a tool through an injected provider (no library/registry/core).
+  - The Research Agent template's tool now uses `tool:browser-search@1.2.0` (was a bare name).
+
+- 7f73b05: SL-10 (headless) — `simulateSquad` + the `AgentRunner` seam + the `CTX_PURPOSE_VIOLATION` flow rule
+  (Handoff 22 "Squad Lane"). All pure, deterministic, zero ecosystem imports.
+
+  - `AgentRunner` — how one agent workflow is executed for a squad run: `simulate` (the always-present
+    deterministic mock, agentflow's own engine — never the BPMN one) and an OPTIONAL `run?` (a real backend,
+    ABSENT in this frontend-only delivery). `defaultAgentRunner` supplies `simulate` and nothing else, so the
+    seam is degradable and agentflow imports no backend (independence stays green).
+  - `simulateSquad(manifest, options)` — traverses the squad's `delegar` edges from the orchestrator in
+    manifest order, running each member through the injected runner's `simulate`. Deterministic (order from
+    the manifest, outputs from declared fixtures — same squad + fixtures 10× → byte-identical facts). Honest
+    CROSS-agent stops: a member that blocks (or a member whose workflow/ref does not resolve) names the agent,
+    the node, and the reason — never a silent skip.
+  - The FACT TRAIL (D1): an ordered `intencao → acao → io → decisao → evidencia` (+ `parada`) record, each
+    labeled `fixture` vs `evidencia-declarada` (E6 — the host declares which member fixtures are captured real
+    evidence), with sensitive I/O MASKED (`sensitivity`/`forbidden` keys go through the injected `maskingPolicy`,
+    or are conservatively redacted to `MASKED_VALUE` when none is injected — never leaks PII), and a per-step
+    masked shared-context snapshot for the step mode (D8). Facts are flat, so a UI filters by agent / kind / error.
+  - `validateSquadFlow(manifest, contract, { resolveWorkflow, resolveTool })` — the FLOW half of
+    `CTX_PURPOSE_VIOLATION` (E5), which only exists once the squad graph + members' resolved tool effects are
+    known: a `grounding` key read by a role whose workflow reaches a gate-requiring tool effect
+    (`external-commitment`/`write-irreversible`) with NO gate in the squad is flagged. A squad WITH gates defers
+    the precise per-path coverage to SL-12's `GATE_NOT_COVERING` (documented, not silently skipped). Fully
+    degradable (both resolvers required) and reuses SL-1's `effectRequiresGate` predicate.
+  - Positive + negative + remediation + determinism (10×) + degradability vectors. apiSurface updated;
+    independence / acidez / structuralShape untouched.
+
+- 5de2c92: SL-3 — extended LlmConfig + governed budget + honest BUDGET_EXCEEDED stop (Handoff 22 "Squad Lane").
+
+  - `LlmConfig` gains additive optional fields `provider` ("host-injetado" label, never a key/endpoint),
+    `fallbackModel`, `temperature`, `maxOutputTokens` (feeds the budget projection).
+  - `AgentWorkflow.budget?: AgentBudget { maxTokens, maxCostBRL, maxWallTimeMs, maxSteps }` — additive.
+  - `validateGraph` adds `BUDGET_MISSING` (warning) when autonomy ≥ 2 declares no budget (never blocks;
+    the run still simulates, just without a governed ceiling).
+  - `simulate` stops honestly with a `BlockedDecision { cell: 'budget' }` — alongside the existing
+    micro-step safety cap — the moment a projected dimension overflows, naming node + reason + count
+    (e.g. "projected steps 2 exceed budget maxSteps 1"). Deterministic: no clock, no random, same fixtures
+    10× → byte-identical trail.
+  - Honest projection boundary (anti "invented pricing", §2.7): **steps** (real count) and **tokens**
+    (from each llm call's declared `maxOutputTokens`) are projected/enforced ALWAYS; **cost** and
+    **wall-time** need a rate the frontend does not honestly have, so they are enforced ONLY when the host
+    injects `SimulateOptions.costModel`. `DEFAULT_COST_MODEL` stays exported as an OPT-IN convenience the
+    host may pass explicitly — it is no longer a silent default, so no fictional "R$ x.xx" is ever shown.
+  - The Research (autonomy 2, llm `maxOutputTokens` 4096) and Document Review (autonomy 3) templates now
+    declare a budget.
+  - Positive + negative + remediation vectors for `BUDGET_MISSING`; honest-stop + determinism vectors for
+    `BUDGET_EXCEEDED`. `structuralShape` parity untouched (the stop rides the existing `BlockedDecision`).
+
+- 9a715ec: SL-4 — honest SchemaNode + cross-workflow delegate contracts (Handoff 22 "Squad Lane").
+
+  - `SchemaShape` becomes `Record<string, string | SchemaNode>` — a purely ADDITIVE union (MINOR): every
+    existing plain type-token schema stays byte-stable, and the new `SchemaNode` (honest JSON-Schema subset:
+    `type`/`required`/`enum`/`items`/`properties`) is lifted from strings by `normalizeSchema` /
+    `normalizeSchemaField` so readers see one shape. New pure helpers: `isSchemaNode`, `requiredKeys`,
+    `unsupportedKeywords`, `SUPPORTED_SCHEMA_KEYWORDS`.
+  - `SCHEMA_UNSUPPORTED_KEYWORD` (warning) — any keyword outside the honest subset is declared, never
+    silently honored.
+  - `ValidateOptions.resolveDelegate` widened ADDITIVELY to return `AgentWorkflow | boolean | undefined`
+    (a boolean resolver still works). When it returns the delegate's workflow, the cross-workflow checks run:
+    - `DELEGATE_CONTRACT_MISMATCH` (error) — the delegator `outputSchema` does not cover the delegate's
+      required `inputSchema` keys;
+    - `DELEGATE_CYCLE` (error) — the delegate chain returns to its start (A → … → A), naming the path;
+    - `AUTONOMY_CHAIN` (error) — the declared autonomy is below the chain's maximum (max of the delegates).
+      A boolean/absent resolver degrades honestly — none of these run, and `DELEGATE_UNRESOLVED` still covers
+      absence.
+  - Positive + negative + remediation vectors for every new code; the `structuralShape` parity and corpus
+    round-trip are untouched (SchemaShape is not a parity-pinned shape).
+
+- b9d565e: SL-5 — tab-registered inspector sections + Wave-1 agent tabs + headless promptCoverage (Handoff 22 "Squad Lane").
+
+  - **agentflow (headless):** `promptCoverage(inputVars, promptText)` — a pure, deterministic check emitting
+    `PROMPT_VAR_UNUSED` (warning) for each declared input variable the prompt never references as `{{name}}`.
+    It is a SEPARATE entry point (not wired into `validateGraph`, which has only the `promptRef`): the host
+    feeds resolved prompt text; with none it simply is not called. `promptVariables` exposes the bare-`{{name}}`
+    extractor, deliberately distinct from the simulate engine's `{{node.output.path}}` tool-param form. Zero
+    ecosystem imports (independence preserved).
+  - **react — reusable infra:** `InspectorSection` gains an optional `tab?: { id, label }` (additive, MINOR).
+    `PropertiesPanel` generalizes its hardcoded General/Execution pair into a tab registry: a section that
+    declares a `tab` renders as its own registered tab; sections without `tab` stay inline in General exactly
+    as before. General/Execution and every existing node-type render byte-identically (regression tests green);
+    no engine + no tab section → no tab strip, unchanged.
+  - **react — Wave 1 (O1):** the AgentStudio node inspector is organized into **Identity** + **Intelligence**
+    tabs. Intelligence shows the model-facing config (model, promptRef, provider shown as a host-injected label
+    — never a key field, structuredOutput) and, for a tool node, the resolved contract effect via the injected
+    `ToolProvider` (degrading with a declared warning when absent — inherited from SL-2). Decorators + remove
+    stay below the tabs (Waves 2/3 are not pre-empted; the errorBoundary flow is unchanged).
+  - The agentTask node in the main canvas keeps its current inline inspector; giving it Wave tabs needs an
+    injected agent-workflow resolver and lands at the SL-12 bridge (registered in `pendencias.md` §11).
+  - i18n EN+PT_BR for all new strings; PropertiesPanel/AgentStudio stay on the migrated no-hardcoded-strings
+    surface. Positive + negative + remediation vectors for `PROMPT_VAR_UNUSED`.
+
+- 88b9f0f: SL-7 — EvalSet + promotion gate + prompt coverage validator (Handoff 22 "Squad Lane").
+
+  - **agentflow (headless):** the `EvalSet` artifact (`eval:*@semver`, assertions ONLY regex/contains/schema —
+    never code) + `runEvalSet(evalSet, wf)` which runs every case through the deterministic `simulate` engine
+    and scores the assertion pass-rate. A new `finalOutput(state)` recovers the run's merged output from the
+    `end` trail entry (SimulationState is parity-pinned, so it carries no output field) — one tested owner of
+    that parsing; a blocked run yields `undefined` and fails the case honestly. Same fixtures 10× → identical
+    report.
+  - **adapters-bpmn:** `evalSetAdapter(evalSets)` surfaces EvalSets in the Biblioteca (type `AVALIAÇÃO`, TOOL
+    mold) and `evalPromotionGate(wf, evalSet)` blocks promotion to active below `promotionThreshold` — a
+    `RuleVerdict` in the SAME shape as `agentPromotionGate` (reusing the evaluateGates/PromotionRule path, not
+    a new mechanism), with `EVAL_BELOW_THRESHOLD` as the stable token in the reason. An eval with no assertions
+    never blocks (honest degradation).
+  - **react:** the `PromptProvider` interface (`resolve`/`save`, mirroring `ToolProvider`) + `createPromptProvider`,
+    injected as an optional `AgentStudio` prop. The Intelligence tab gains the prototype-05 **coverage validator**
+    (transparent textarea over a highlight backdrop of `{{var}}` spans + a coverage bar) — the prompt TEXT is
+    resolved through the provider (the body lives in the Library btv:prompt artifact, NEVER on the AgentWorkflow),
+    edits persist via `save`, and it degrades honestly (no provider → absent; unresolvable ref → declared warning;
+    no `save` → read-only). Reduced-motion respected on the coverage bar.
+  - Positive + negative + determinism vectors for `runEvalSet`/`finalOutput`; the four-case promotion-gate
+    pattern for `evalPromotionGate`; adapter list/get/reject; coverage-validator render + degradation + "edits
+    hit the artifact, not the workflow". i18n EN+PT_BR; independence/structuralShape/corpus untouched.
+
+- fdc42b9: SL-8 — SquadManifest + ContextContract + readinessState (Handoff 22 "Squad Lane"), headless-pure.
+
+  - `SquadManifest` (`sqd-*@semver`): members (`agentRef` + `personaRef` + role), `dynamic`
+    (hierarquico/sequencial/paralelo/blackboard), the six edge kinds, `contextContractRef`, gates.
+  - `ContextContract` (`ctx-contract:*@semver`) is its OWN reusable artifact referenced BY the manifest
+    (never inlined — E5), so two squads share one contract by ref. Keys carry
+    owner/readers/writers/purpose/merge/ttl/sensitivity/immutableAfterGate/forbidden.
+  - `validateContextContract` — `CTX_WRITE_FORBIDDEN` (a forbidden key still granting access) and
+    `CTX_PURPOSE_VIOLATION` (immutableAfterGate on a non-operational key, or grounding that merges by
+    exigir-decisao). `validateSquad` — structural validity (dynamic, the six edge kinds, versioned refs)
+    plus `SQUAD_MEMBER_STALE` (warning) via an INJECTED, degradable `resolveMemberStatus` (candidata/
+    obsoleta is a registry concept — no resolver → no warning, and agentflow never imports the registry).
+  - `squadAutonomy(manifest, resolveMember)` — the squad's composite autonomy is the MAX over resolved
+    members (the SL-4 "max of the chain" rule reused, not a new one).
+  - `readinessState(wf, ctx)` (E1) — the single PURE source of `rascunho` → `validado` →
+    `simulado-com-evidencia` → `apto-para-integracao`. Ceiling is `apto-para-integracao`; the host states
+    `executando`/`erro-de-integracao` are NEVER derived here. Tested without DOM.
+  - Positive + negative + remediation vectors for CTX\_\*/SQUAD_MEMBER_STALE and the readiness ladder.
+    independence/acidez/structuralShape/corpus untouched.
+
+- febc376: SL-9 — Squad Studio (Handoff 22 "Squad Lane"), the a11y-heavy piece (§10.9). A `SquadManifest`
+  rendered as a STANDARD BPMN diagram over the EXISTING editor — no new canvas, no fork.
+
+  - `buildSquadDiagram(manifest)` — the DETERMINISTIC projection of the manifest (the source of truth,
+    D5) into a `BpmnDiagram`: a pool with one lane per role (orchestrator + members, plus a `humano`
+    lane only when an edge references it), an `agentTask` per lane carrying `agentWorkflowRef`/`personaRef`,
+    and one edge per drawable squad relation with the kind as `edge.type`. A `*` broadcast fans out to
+    every non-human member; edges to unknown roles are dropped rather than inventing a lane. Same manifest
+    → byte-identical diagram.
+  - `SquadStudio` — instantiates `BpmnDesigner` with the squad plugin; zoom/pan/keyboard-navigation/inspection
+    are the editor's, reused. The diagram is READ-ONLY on purpose: a projection with no write-back must not
+    accept mutation gestures (drag/connect/delete), or an edit would vanish on the next projection — silent
+    loss, which the doctrine forbids. Read-only keeps every inspection affordance alive (perspective toggle,
+    legend, roving keyboard focus over nodes/edges that drives the announce, governance tab). Squad editing
+    happens via the manifest UI; the full manifest↔diagram round-trip (edits mapped back to manifest commands)
+    is a registered pendência, not SL-9. Chrome mounts INSIDE the editor providers so it reads the same store:
+    an Estrutura↔Colaboração toggle that flips only the new `viewMode` store key, a keyboard-navigable legend,
+    a manifest + context-contract summary panel, and a coordinated-promotion warning driven by an OPTIONAL
+    host-injected `staleMembers` (absent → no warning; degradable).
+  - `validateSquad` (agentflow) gains `SQUAD_EDGE_ROLE_UNKNOWN` (error): an edge whose `from`/`to` is not a
+    known role (`orch`, a declared member role, `humano`, or `*` as a broadcast source). This is the SAME
+    known-role set the projection treats as drawable, so an edge the diagram silently omits is exactly an edge
+    this check flags — the omission is never mute (the user sees it in the Problems Panel). Positive + negative
+    - remediation vectors added.
+  - `createSquadPlugin` / `SQUAD_EDGE_STYLES` / `SQUAD_EDGE_GLYPH` — the six collaboration edges are
+    distinguishable WITHOUT color (distinct marker + dash + glyph + localized label). `EdgeStyle` gains an
+    additive `collaboration` override that only thickens the stroke in the Colaboração view (DMN/escalation
+    edges unaffected). The plugin also registers the Wave-3 (O3) Memória/Governança inspector tab for a
+    squad member (role, persona, autonomy, downstream-gate need, and the member's context keys).
+  - New canvas-store `viewMode` (`estrutura`/`colaboracao`, default `estrutura`) — a pure renderer switch,
+    read by `EdgeRenderer` to apply the collaboration override. Focusing a squad edge announces
+    kind + from → to in an `aria-live` region.
+  - Tests: the projection (determinism, lanes, broadcast fan-out, unknown-role drop, humano lane) and the
+    Studio (canvas render, toggle preserves selection, six-edge legend, edge announce, stale-member warning,
+    and a zero-serious/critical axe gate). i18n EN + PT-BR; both new surfaces added to the hardcoded-string
+    cerca.
diff --git a/packages/agentflow/package.json b/packages/agentflow/package.json
index 0416949..16a0b75 100644
--- a/packages/agentflow/package.json
+++ b/packages/agentflow/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/agentflow",
-  "version": "1.0.0",
+  "version": "1.1.0-next.0",
   "description": "Headless agent-workflow model (Handoff 12 A-1): the JSON schema for a governed AI-agent sub-workflow — exactly three node types (llm/tool/decision) plus decorators (memory/planner/errorBoundary) — a versioned id@semver reference parser, and graph validation (honest stop criterion, bounded retries, structured-output coherence, delegate resolution, non-empty schemas) with a normative autonomyLevel 0-5 scale. Property naming aligns with the AgentO/AIAO vocabulary WITHOUT any JSON-LD @context/@type claim. Operates on a plain abstract graph and imports NOTHING from the ecosystem (integrations arrive by injection). Zero dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/anchor-git/CHANGELOG.md b/packages/anchor-git/CHANGELOG.md
index 57489bd..1f25319 100644
--- a/packages/anchor-git/CHANGELOG.md
+++ b/packages/anchor-git/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @buildtovalue/anchor-git
 
+## 1.0.2-next.0
+
+### Patch Changes
+
+- Updated dependencies [47d0de8]
+  - @buildtovalue/identity@1.1.0-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/anchor-git/package.json b/packages/anchor-git/package.json
index 07aaaea..d84e711 100644
--- a/packages/anchor-git/package.json
+++ b/packages/anchor-git/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/anchor-git",
-  "version": "1.0.1",
+  "version": "1.0.2-next.0",
   "description": "Git anchor adapter (Handoff 8): anchors the ledger chain head to a commit via a HOST-injected transport (the library never does network or shells out to git). Implements the AnchorAdapter contract from @buildtovalue/identity. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/anchor-rfc3161/CHANGELOG.md b/packages/anchor-rfc3161/CHANGELOG.md
index ac4b511..6532d4e 100644
--- a/packages/anchor-rfc3161/CHANGELOG.md
+++ b/packages/anchor-rfc3161/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @buildtovalue/anchor-rfc3161
 
+## 1.0.2-next.0
+
+### Patch Changes
+
+- Updated dependencies [47d0de8]
+  - @buildtovalue/identity@1.1.0-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/anchor-rfc3161/package.json b/packages/anchor-rfc3161/package.json
index 3659f79..65869ed 100644
--- a/packages/anchor-rfc3161/package.json
+++ b/packages/anchor-rfc3161/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/anchor-rfc3161",
-  "version": "1.0.1",
+  "version": "1.0.2-next.0",
   "description": "RFC 3161 timestamp anchor adapter (Handoff 8): anchors the ledger chain head to a TSA timestamp token via a HOST-injected transport (the library never does network). Implements the AnchorAdapter contract from @buildtovalue/identity. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/anchor-s3/CHANGELOG.md b/packages/anchor-s3/CHANGELOG.md
index 16e1e3e..9c8464d 100644
--- a/packages/anchor-s3/CHANGELOG.md
+++ b/packages/anchor-s3/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @buildtovalue/anchor-s3
 
+## 1.0.2-next.0
+
+### Patch Changes
+
+- Updated dependencies [47d0de8]
+  - @buildtovalue/identity@1.1.0-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/anchor-s3/package.json b/packages/anchor-s3/package.json
index c8eed1a..4fe842c 100644
--- a/packages/anchor-s3/package.json
+++ b/packages/anchor-s3/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/anchor-s3",
-  "version": "1.0.1",
+  "version": "1.0.2-next.0",
   "description": "S3 (object-lock) anchor adapter (Handoff 8): anchors the ledger chain head to a write-once object via a HOST-injected client (the library never does network). Implements the AnchorAdapter contract from @buildtovalue/identity. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/audit/CHANGELOG.md b/packages/audit/CHANGELOG.md
index 12ead78..e433272 100644
--- a/packages/audit/CHANGELOG.md
+++ b/packages/audit/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @buildtovalue/audit
 
+## 1.1.1-next.0
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+  - @buildtovalue/identity@1.1.0-next.0
+  - @buildtovalue/registry@1.0.2-next.0
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/audit/package.json b/packages/audit/package.json
index 6da080f..c86bf96 100644
--- a/packages/audit/package.json
+++ b/packages/audit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/audit",
-  "version": "1.1.0",
+  "version": "1.1.1-next.0",
   "description": "Demonstrable integrity for bpmn-react governance: hash-chain ledger verification (verifyLedger), canonical promotion attestations (attestVersion) and XES export for process mining. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index aa3e7ac..8f99305 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @buildtovalue/cli
 
+## 1.0.2-next.0
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [c4ad4fe]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+  - @buildtovalue/conformance@1.2.0-next.0
+  - @buildtovalue/audit@1.1.1-next.0
+  - @buildtovalue/registry@1.0.2-next.0
+  - @buildtovalue/soundness@1.0.2-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 78b8b74..6eaebdd 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/cli",
-  "version": "1.0.1",
+  "version": "1.0.2-next.0",
   "description": "Headless CLI for bpmn-react diagrams: validate, export (xml/json) and diff.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/conformance/CHANGELOG.md b/packages/conformance/CHANGELOG.md
index 334b81e..56320a3 100644
--- a/packages/conformance/CHANGELOG.md
+++ b/packages/conformance/CHANGELOG.md
@@ -1,5 +1,120 @@
 # @buildtovalue/conformance
 
+## 1.2.0-next.0
+
+### Minor Changes
+
+- 0627ee6: Handoff 19 CO-1 (§6a) — compensation in the core model + converter, completing
+  the OMG trigger family. No named root and no bucket (unlike the H16–H18 path):
+  the internal event kind is `compensate` (== the OMG element prefix
+  `compensateEventDefinition`), so it round-trips through the generic
+  `${kind}EventDefinition` machinery with zero special-case.
+
+  - The trio round-trips byte-stably: a compensation boundary (⟲) with a bare
+    `compensateEventDefinition` (no `cancelActivity` — it fires post-completion),
+    linked to its handler by `bpmn:association` (an already first-class built-in
+    edge type, reused not forked), and the handler carrying `isForCompensation`.
+  - `isForCompensation` is now read on import (it was silently dropped before —
+    an un-prefixed native attribute) and emitted, default `false` omitted.
+  - The compensate THROW carries an optional `activityRef`
+    (`properties.compensateActivityRef`; absent = broadcast) and `waitForCompletion`
+    (default `true` omitted); a CATCH never emits them.
+  - Structural veto (`edge.connect.pre`, both sides): a handler neither receives
+    nor emits sequence flow, and a compensation boundary emits no outgoing
+    sequence flow — the handler is reached only by association. An error/message
+    boundary keeps flowing normally (kind-gated); associations pass.
+  - CONFORMANCE promotes `bpmn:compensateEventDefinition`; a real book-hotel corpus
+    file (`60-compensation-v1.bpmn`) imports the full trio with zero warnings.
+
+### Patch Changes
+
+- c4ad4fe: Errata da matriz de conformidade (pré-Handoff 18): a linha `eventSubProcess`
+  ainda declarava `⛔ unsupported` ("Deliberately out of scope before v2.x."),
+  o que a main não pode afirmar depois do Handoff 17 — o event subprocess foi
+  entregue e está verde (ES-1..ES-5, PRs #128–#133). Corrigida via a fonte única
+  `packages/conformance/src/matrix.ts` para `✅ supported` / classe `analytic`,
+  mapeando para `subProcess (triggeredByEvent)` (contenção F7 reusada, helper
+  `isEventSubprocess`; starts tipados interrupting/não-interrupting round-trip
+  byte-estáveis; lint `EVT_SUBPROC_START`/`EVT_SUBPROC_FLOW`; precedência honesta
+  na simulação). `CONFORMANCE.md` regenerado pelo gerador (gate de frescor
+  intacto — `matrix.test.ts`). A matriz não pode mentir; fora do escopo do
+  Handoff 18.
+- cbe56a7: feat(core): escalation como o 4º bucket nomeado (Handoff 18 EC-1, §5a)
+
+  Escalation entra nas MESMAS fontes únicas da E-1/E-3 (zero fork), completando a
+  família de gatilhos OMG pelo caminho já pavimentado:
+
+  - **Modelo aditivo**: `EscalationEventDefinition { id, name, escalationCode? }`
+    (molde exato do `errorCode`, código omitido quando indefinido); `EventDefinitions`
+    ganha `escalations` (opcional/aditivo — `eventDefinitionsOf` preenche o bucket
+    ausente, então o resto do core o trata como sempre-presente).
+  - **Fonte única**: `EVENT_DEFINITION_REF_KINDS`/`EVENT_DEFINITION_BUCKETS`/`ID_PREFIX`
+    (prefixo `esc`) ganham o kind; os comandos parametrizados (add id auto `esc-1`,
+    update `name`/`escalationCode`, remoção vetada listando usos, rename cascata 1
+    undo) e a resolução de picker/refs seguem por construção.
+  - **Converter OMG**: root `<bpmn:escalation id name escalationCode?/>` na ordem do
+    XSD (após error, antes do process); `escalationRef` no child dos 4 hosts (throw
+    intermediate/end, catch boundary + start de event subprocess); órfã sintetiza com
+    warning; round-trip byte-estável (fixpoint com o anchor de boundary re-derivado).
+  - **Neutralidade congelada**: fixture nova `escalationFrozen.json` (bucket ausente/
+    vazio = bytes e hash idênticos); `eventDefsFrozen`/`passthroughFrozen`/
+    `eventSubprocFrozen` intactas.
+  - **CONFORMANCE**: promove `bpmn:escalation` (root) via o gerador; `certify` passa a
+    mapear os roots de definição nomeada (message/signal/error/escalation) — lacuna
+    latente da H16 que o 1º corpus com root de definição expôs. Corpus real novo
+    `59-escalation-v1.bpmn` (root + boundary não-interrupting + end throw) importa com
+    significado pleno e 0 warnings.
+
+  Fora da EC-1 (próximas PRs): glifo/paleta/chips/autoridade (EC-2), ponte
+  agente→humano + ledger (EC-3), regras de lint + perfis 1.3.0 (EC-4),
+  `throwEscalation`/dissolve/limitations (EC-5).
+
+- 56fe142: Foreign extension passthrough (`zeebe:*`/`camunda:*` — the registered
+  pendency's dedicated PR). Foreign `extensionElements` children on flow nodes,
+  edges and the `<bpmn:process>` itself, foreign-prefixed attributes
+  (`zeebe:modelerTemplate`, `camunda:asyncBefore`) and the root's foreign
+  `xmlns:*` declarations now survive the round-trip: semantically lossless on
+  import, byte-stable between bpmn-react exports. Model storage is additive
+  (`foreignExtensions`/`foreignAttributes` on nodes/edges,
+  `processForeignExtensions`/`foreignNamespaces` on the diagram) — absent
+  fields keep every pre-existing hash and export byte-identical (frozen-fixture
+  proven). Changed foreign extensions surface in `computeDiff`/`diffDiagrams`
+  as NAMED fields (the element tag, or `@`-prefixed attribute name) so the
+  review ΔN popover renders them per field — never an opaque blob. The
+  whitespace-trim and CDATA→escaped-text normalizations are documented contract
+  in `docs/format-spec.md`. Conformance: real-corpus assertion that preserved
+  extensions re-export; CONFORMANCE.md generator gains the passthrough section.
+- 8825d62: Named event definitions of first class (Handoff 16 §3a, E-1 — headless).
+  `diagram.definitions.{messages,signals,errors}[]` stores the OMG root
+  elements (`bpmn:message`/`bpmn:signal`/`bpmn:error` with `errorCode`);
+  events reference them via `properties.eventDefinitionRef`, exported as the
+  standard `messageRef`/`signalRef`/`errorRef` attributes. Undoable CRUD
+  commands: add (collision-safe auto ids `msg-1`/`sig-1`/`err-1` via
+  `nextEventDefinitionId`), update (rename cascades to every referencing event
+  by construction — nodes are never touched — and one undo restores all), and
+  remove, VETOED by the default rules while referenced, listing every usage.
+  Import populates the model from root elements; an orphan `*Ref` is
+  synthesized (`id = name = ref`) WITH an informative warning naming the event
+  — never silent loss. Round-trip is byte-stable and the additive field keeps
+  every pre-existing hash and export byte-identical (frozen fixture
+  `eventDefsFrozen.json`). CONFORMANCE matrix promotes the three root elements;
+  real-corpus assertion covers `messageRef` files importing without discard.
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/conformance/package.json b/packages/conformance/package.json
index 130cea6..2cf7525 100644
--- a/packages/conformance/package.json
+++ b/packages/conformance/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/conformance",
-  "version": "1.1.0",
+  "version": "1.2.0-next.0",
   "description": "OMG BPMN 2.0 conformance tooling for bpmn-react: interoperability corpus, element-by-element conformance matrix and generated CONFORMANCE.md. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/copilot/CHANGELOG.md b/packages/copilot/CHANGELOG.md
index d965b18..c3f50af 100644
--- a/packages/copilot/CHANGELOG.md
+++ b/packages/copilot/CHANGELOG.md
@@ -1,5 +1,73 @@
 # @buildtovalue/copilot
 
+## 1.1.0-next.0
+
+### Minor Changes
+
+- dc29b38: SL-12 — BPMN bridge (Handoff 22 "Squad Lane"), core half: process-level gate coverage.
+
+  - `gateBypassRoute(diagram, startId, isGate, isTerminal?)` — the process-path-coverage companion to
+    `reachableGateFrom`, over the SAME sequence-flow graph (never a new traversal model). Returns the id of an
+    ungated commit point (a terminal — default an `endEvent` — or a sink) reachable WITHOUT passing a gate;
+    gate nodes are walls (a gate covers everything downstream of itself). `undefined` means every route to a
+    commit passes a gate.
+  - `agentGateCoverageViolations` + `agentGateCoverageRule` — `GATE_NOT_COVERING` (§6): every agentTask whose
+    autonomy requires a gate where a gate IS reachable (so NOT the no-gate case that `agentGateViolations`
+    already reports — the two stay distinct, no double-report) but a route (fallback/retry/bypass) reaches a
+    commit without passing it. The violation names the bypass route; the promotion rule blocks activation with a
+    `GATE_NOT_COVERING` reason. Built over `reachableGateFrom` + `effectRequiresGate` (SL-1) — the
+    process-path-coverage layer the SL-1 `TOOL_EFFECT_UNGATED` (contract-level) and the SL-11 squad grounding
+    check deliberately deferred.
+  - Positive + negative + remediation + no-double-report + sink + cyclic + custom-terminal + promotion-block
+    vectors. apiSurface updated.
+
+  - `scaffoldSquad(template, options?)` (copilot) — the whitelisted squad scaffolder (§8-08), a PROPOSAL
+    GENERATOR built ENTIRELY from the primitive whitelisted commands (`addNode`/`addEdge`), so it is
+    structurally incapable of expressing anything off the whitelist. It flows through the ordinary
+    PROPOSTA → APLICADA pipeline (`validateProposal` → `buildPlan` → CopilotPanel): applying runs through the
+    CommandStack like any edit and NEVER approves/promotes (#150). Four templates (`hierarquico` / `sequencial`
+    / `paralelo` / `revisao`), each scaffolding a gate-covered squad process — a start, agentTasks with an
+    `autonomyLevel`, an approval gate (a core `userTask` marked `properties.gate`, since the domain `btv:gate`
+    is not core-creatable) before the end, and the sequence flows. Deterministic (ids/positions from
+    template + prefix); a `prefix` option namespaces ids so two squads coexist. Vectors: whitelist-only,
+    node-before-edge order, validates against a fresh diagram, gate-covered projection, determinism,
+    prefix-collision. apiSurface updated.
+
+  - BPMN bridge deep-link (react, §8-08, closes pendências §1.2): `?load=<versionId>` opens the EXACT
+    artifact version instead of the demo diagram. `readLoadVersionId` + `resolveDeepLink` parse the param and
+    call an injected `VersionResolver` (degradable — an absent/unresolved version falls back to the default,
+    never guesses); `buildLoadSearch` builds the URL the host pushes to history. The host owns URL/history
+    (never `window`/`history` here). `BpmnDesigner` gains `initialCanvasState` so "voltar" restores the saved
+    viewport/selection.
+  - `MAPPING_TRANSFORM_ILLEGAL` (react): `PayloadMapping` gains optional additive `transform`/`adapterRef`;
+    `payloadMappingIssues(rows, catalog)` flags a mapping that names a transform OUTSIDE the injected catalog,
+    or a catalog conversion with no `adapterRef` (a plain source→target copy is always legal). Degradable
+    (host-owned catalog, the `resolveTool` mold).
+  - Squad Studio Wave-3 wiring: the Memória/Governança inspector tab registered in SL-9 was not actually
+    reachable (SquadStudio uses `BpmnDesigner`, which renders no inspector, and read-only blocks canvas
+    selection). Fixed: SquadStudio now renders the `PropertiesPanel`, and a member list drives selection for
+    inspection (read-only-safe — it only sets `selectedIds`, never mutates). Render vectors added (governance
+    tab shows role/persona/context keys; degrades without a contract).
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+  - @buildtovalue/soundness@1.0.2-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/copilot/package.json b/packages/copilot/package.json
index 34cf429..761a99e 100644
--- a/packages/copilot/package.json
+++ b/packages/copilot/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/copilot",
-  "version": "1.0.1",
+  "version": "1.1.0-next.0",
   "description": "Headless governed-AI copilot layer (Handoff 9 CP-1): the HOST-injected AIProvider contract, proposal parsing/validation into whitelisted ProposedCommand[] (unknown command → INTEGRAL rejection, never partial application), one undoable composite plan, and a locally computed soundness preview BEFORE presenting. The AI never promotes, approves or signs — this package has no import path to identity or promotion rules (CI-enforced). Zero network, zero LLM SDK; consumes only @buildtovalue/core and @buildtovalue/soundness.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 077954c..d65927c 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,305 @@
 # @buildtovalue/core
 
+## 1.2.0-next.0
+
+### Minor Changes
+
+- 0627ee6: Handoff 19 CO-1 (§6a) — compensation in the core model + converter, completing
+  the OMG trigger family. No named root and no bucket (unlike the H16–H18 path):
+  the internal event kind is `compensate` (== the OMG element prefix
+  `compensateEventDefinition`), so it round-trips through the generic
+  `${kind}EventDefinition` machinery with zero special-case.
+
+  - The trio round-trips byte-stably: a compensation boundary (⟲) with a bare
+    `compensateEventDefinition` (no `cancelActivity` — it fires post-completion),
+    linked to its handler by `bpmn:association` (an already first-class built-in
+    edge type, reused not forked), and the handler carrying `isForCompensation`.
+  - `isForCompensation` is now read on import (it was silently dropped before —
+    an un-prefixed native attribute) and emitted, default `false` omitted.
+  - The compensate THROW carries an optional `activityRef`
+    (`properties.compensateActivityRef`; absent = broadcast) and `waitForCompletion`
+    (default `true` omitted); a CATCH never emits them.
+  - Structural veto (`edge.connect.pre`, both sides): a handler neither receives
+    nor emits sequence flow, and a compensation boundary emits no outgoing
+    sequence flow — the handler is reached only by association. An error/message
+    boundary keeps flowing normally (kind-gated); associations pass.
+  - CONFORMANCE promotes `bpmn:compensateEventDefinition`; a real book-hotel corpus
+    file (`60-compensation-v1.bpmn`) imports the full trio with zero warnings.
+
+- a99b6f9: Handoff 19 CO-2 (§6b) — compensation visual, palette pair and target picker.
+
+  - core: `compensableActivitiesOf(diagram, scope?)` — the scope-aware single
+    source of "which activities here can be compensated" (carry a ⟲ boundary),
+    consumed by the throw picker, the lint (CO-3) and the simulator (CO-4).
+  - react visual: the rewind ◀◀ glyph joins the single-source `eventGlyph` (throw
+    filled / catch hollow); the compensation boundary is always SOLID and its
+    interrupting toggle is absent (it fires post-completion); a `bpmn:association`
+    now renders as a dashed line with NO flow arrow (a new global `association`
+    edge style — BPMN-correct for every association, including text annotations); a
+    ◀◀ marker on `isForCompensation` handlers, coexisting with loop/MI markers.
+  - react UX: the «Compensation (pair)» palette composite drops the boundary +
+    handler (below the host) + linking association in ONE undo, lint-clean, with a
+    stable-DI association so the fresh diagram re-exports byte-stably; the throw's
+    transient «⟲ compensa: {activity|scope}» chip; and a target picker listing the
+    compensable activities of the throw's OWN scope (broadcast is the default).
+  - i18n EN/PT-BR; touch ≥44px; a `?comp=1` editor demo + e2e.
+
+- cbe56a7: feat(core): escalation como o 4º bucket nomeado (Handoff 18 EC-1, §5a)
+
+  Escalation entra nas MESMAS fontes únicas da E-1/E-3 (zero fork), completando a
+  família de gatilhos OMG pelo caminho já pavimentado:
+
+  - **Modelo aditivo**: `EscalationEventDefinition { id, name, escalationCode? }`
+    (molde exato do `errorCode`, código omitido quando indefinido); `EventDefinitions`
+    ganha `escalations` (opcional/aditivo — `eventDefinitionsOf` preenche o bucket
+    ausente, então o resto do core o trata como sempre-presente).
+  - **Fonte única**: `EVENT_DEFINITION_REF_KINDS`/`EVENT_DEFINITION_BUCKETS`/`ID_PREFIX`
+    (prefixo `esc`) ganham o kind; os comandos parametrizados (add id auto `esc-1`,
+    update `name`/`escalationCode`, remoção vetada listando usos, rename cascata 1
+    undo) e a resolução de picker/refs seguem por construção.
+  - **Converter OMG**: root `<bpmn:escalation id name escalationCode?/>` na ordem do
+    XSD (após error, antes do process); `escalationRef` no child dos 4 hosts (throw
+    intermediate/end, catch boundary + start de event subprocess); órfã sintetiza com
+    warning; round-trip byte-estável (fixpoint com o anchor de boundary re-derivado).
+  - **Neutralidade congelada**: fixture nova `escalationFrozen.json` (bucket ausente/
+    vazio = bytes e hash idênticos); `eventDefsFrozen`/`passthroughFrozen`/
+    `eventSubprocFrozen` intactas.
+  - **CONFORMANCE**: promove `bpmn:escalation` (root) via o gerador; `certify` passa a
+    mapear os roots de definição nomeada (message/signal/error/escalation) — lacuna
+    latente da H16 que o 1º corpus com root de definição expôs. Corpus real novo
+    `59-escalation-v1.bpmn` (root + boundary não-interrupting + end throw) importa com
+    significado pleno e 0 warnings.
+
+  Fora da EC-1 (próximas PRs): glifo/paleta/chips/autoridade (EC-2), ponte
+  agente→humano + ledger (EC-3), regras de lint + perfis 1.3.0 (EC-4),
+  `throwEscalation`/dissolve/limitations (EC-5).
+
+- 2dc3518: Handoff 17 ES-1 — event subprocess in the core (spec §4a). New single-source
+  predicates `isEventSubprocess` (a common `subProcess` with
+  `properties.triggeredByEvent === true` — F7 containment reused whole) and
+  `startIsInterrupting` (OMG default true; `false` only when explicit) — the
+  E-4 execution matrix and the tightened lint rules will CONSUME these helpers,
+  never reimplement the predicate. Converter: `triggeredByEvent="true"` and
+  `isInterrupting="false"` serialize as the standard OMG attributes on their
+  element kinds, reserved from the property soup exactly when emitted, with the
+  OMG default OMITTED — and a DECLARED emission rule: the attributes round-trip
+  byte-stably wherever they appear (the converter preserves, it never judges —
+  semantics are the 4d lint's job). Sequence flow to or from the
+  event-subprocess SHELL is vetoed by the default rules (both directions,
+  always declared; children connect normally), and the shell is exempt from
+  `UNREACHABLE_NODE` like a boundary event. Frozen fixture
+  `eventSubprocFrozen.json` proves neutrality: without `triggeredByEvent`,
+  `toXml` and `computeDiagramHash` are byte-identical to the pre-ES-1 build.
+- 56fe142: Foreign extension passthrough (`zeebe:*`/`camunda:*` — the registered
+  pendency's dedicated PR). Foreign `extensionElements` children on flow nodes,
+  edges and the `<bpmn:process>` itself, foreign-prefixed attributes
+  (`zeebe:modelerTemplate`, `camunda:asyncBefore`) and the root's foreign
+  `xmlns:*` declarations now survive the round-trip: semantically lossless on
+  import, byte-stable between bpmn-react exports. Model storage is additive
+  (`foreignExtensions`/`foreignAttributes` on nodes/edges,
+  `processForeignExtensions`/`foreignNamespaces` on the diagram) — absent
+  fields keep every pre-existing hash and export byte-identical (frozen-fixture
+  proven). Changed foreign extensions surface in `computeDiff`/`diffDiagrams`
+  as NAMED fields (the element tag, or `@`-prefixed attribute name) so the
+  review ΔN popover renders them per field — never an opaque blob. The
+  whitespace-trim and CDATA→escaped-text normalizations are documented contract
+  in `docs/format-spec.md`. Conformance: real-corpus assertion that preserved
+  extensions re-export; CONFORMANCE.md generator gains the passthrough section.
+- 40d6efd: #154 — lanes now tile the pool body at design time, and the lint names the gap.
+
+  - core: lane/pool body geometry as ONE shared source (`POOL_TITLE_BAND`,
+    `poolBodyOf`, `poolContainingRect`, `lanesOfPool`, `tileLaneRects`,
+    `lanesTileBody`) — consumed by both the react gesture and the lint rule so
+    interaction and diagnosis never drift.
+  - react: creating a lane inside a pool snaps it to the pool body
+    (`x = pool.x + 30`, `width = pool.width − 30`) and tiles the body equally
+    with its siblings; resizing a lane keeps the requested height and re-tiles
+    the siblings; resizing a pool reflows its lanes — each case inside the SAME
+    gesture (one composite, one undo). Import is untouched: imported DI stays
+    sovereign.
+  - lint: new etiquette rule `LANE_BODY_TILING` (warning) flags a lane whose
+    bounds do not partition the pool body (wrong x/width, vertical gap, overlap,
+    remainder), with the mechanical quick-fix "ajustar ao corpo do pool" (one
+    composite of ordinary resize commands). Etiquette profile 1.4.0 → 1.5.0.
+
+- 8825d62: Named event definitions of first class (Handoff 16 §3a, E-1 — headless).
+  `diagram.definitions.{messages,signals,errors}[]` stores the OMG root
+  elements (`bpmn:message`/`bpmn:signal`/`bpmn:error` with `errorCode`);
+  events reference them via `properties.eventDefinitionRef`, exported as the
+  standard `messageRef`/`signalRef`/`errorRef` attributes. Undoable CRUD
+  commands: add (collision-safe auto ids `msg-1`/`sig-1`/`err-1` via
+  `nextEventDefinitionId`), update (rename cascades to every referencing event
+  by construction — nodes are never touched — and one undo restores all), and
+  remove, VETOED by the default rules while referenced, listing every usage.
+  Import populates the model from root elements; an orphan `*Ref` is
+  synthesized (`id = name = ref`) WITH an informative warning naming the event
+  — never silent loss. Round-trip is byte-stable and the additive field keeps
+  every pre-existing hash and export byte-identical (frozen fixture
+  `eventDefsFrozen.json`). CONFORMANCE matrix promotes the three root elements;
+  real-corpus assertion covers `messageRef` files importing without discard.
+- 47d0de8: Handoff 15 V-6 — request-changes cycle (spec §2e). `VersionStatus` grows the
+  additive `in-review` (EM REVISÃO ⟲) state: entered only by request-changes
+  (candidate → in-review) and left only by re-submission (→ candidate), both
+  through the core state machine; the status round-trips in XML via
+  `bpmnr:version` like every other. `identity` adds
+  `buildChangeRequestPayload` (+`CanonicalChangeRequestPayload`): the signed
+  request binds versionRef + attached open threadRefs + the mandatory
+  justification, verified by the unchanged `verifySignature`. `react` adds
+  `buildChangeRequestPayloadFor`, the ⟲ gold seal (StatusBadge/VersionTimeline/
+  i18n `status.in-review`) and scopes `reviewThreadsRule` to `target: 'active'`
+  only — request-changes passes with open threads by design. `adapters-bpmn`
+  adds `reviewChangesRequestedEntry` (+`REVIEW_CHANGES_REQUESTED` type) and maps
+  `in-review` → `candidate` for the Biblioteca (documented loss) with the ⟲
+  seal surviving in the gallery meta. `studio` adds `requestChanges` (the
+  default soft path — `rejectPromotion` stays as the documented hard reject),
+  the signed "Pedir mudanças…" flow in the ReviewScreen, the
+  `review.changes.requested` N-3 bridge (`onReviewEvent`) and the re-submission
+  diff that opens against the version that requested changes (v-pedido →
+  v-nova) via registry lineage.
+- dc29b38: SL-12 — BPMN bridge (Handoff 22 "Squad Lane"), core half: process-level gate coverage.
+
+  - `gateBypassRoute(diagram, startId, isGate, isTerminal?)` — the process-path-coverage companion to
+    `reachableGateFrom`, over the SAME sequence-flow graph (never a new traversal model). Returns the id of an
+    ungated commit point (a terminal — default an `endEvent` — or a sink) reachable WITHOUT passing a gate;
+    gate nodes are walls (a gate covers everything downstream of itself). `undefined` means every route to a
+    commit passes a gate.
+  - `agentGateCoverageViolations` + `agentGateCoverageRule` — `GATE_NOT_COVERING` (§6): every agentTask whose
+    autonomy requires a gate where a gate IS reachable (so NOT the no-gate case that `agentGateViolations`
+    already reports — the two stay distinct, no double-report) but a route (fallback/retry/bypass) reaches a
+    commit without passing it. The violation names the bypass route; the promotion rule blocks activation with a
+    `GATE_NOT_COVERING` reason. Built over `reachableGateFrom` + `effectRequiresGate` (SL-1) — the
+    process-path-coverage layer the SL-1 `TOOL_EFFECT_UNGATED` (contract-level) and the SL-11 squad grounding
+    check deliberately deferred.
+  - Positive + negative + remediation + no-double-report + sink + cyclic + custom-terminal + promotion-block
+    vectors. apiSurface updated.
+
+  - `scaffoldSquad(template, options?)` (copilot) — the whitelisted squad scaffolder (§8-08), a PROPOSAL
+    GENERATOR built ENTIRELY from the primitive whitelisted commands (`addNode`/`addEdge`), so it is
+    structurally incapable of expressing anything off the whitelist. It flows through the ordinary
+    PROPOSTA → APLICADA pipeline (`validateProposal` → `buildPlan` → CopilotPanel): applying runs through the
+    CommandStack like any edit and NEVER approves/promotes (#150). Four templates (`hierarquico` / `sequencial`
+    / `paralelo` / `revisao`), each scaffolding a gate-covered squad process — a start, agentTasks with an
+    `autonomyLevel`, an approval gate (a core `userTask` marked `properties.gate`, since the domain `btv:gate`
+    is not core-creatable) before the end, and the sequence flows. Deterministic (ids/positions from
+    template + prefix); a `prefix` option namespaces ids so two squads coexist. Vectors: whitelist-only,
+    node-before-edge order, validates against a fresh diagram, gate-covered projection, determinism,
+    prefix-collision. apiSurface updated.
+
+  - BPMN bridge deep-link (react, §8-08, closes pendências §1.2): `?load=<versionId>` opens the EXACT
+    artifact version instead of the demo diagram. `readLoadVersionId` + `resolveDeepLink` parse the param and
+    call an injected `VersionResolver` (degradable — an absent/unresolved version falls back to the default,
+    never guesses); `buildLoadSearch` builds the URL the host pushes to history. The host owns URL/history
+    (never `window`/`history` here). `BpmnDesigner` gains `initialCanvasState` so "voltar" restores the saved
+    viewport/selection.
+  - `MAPPING_TRANSFORM_ILLEGAL` (react): `PayloadMapping` gains optional additive `transform`/`adapterRef`;
+    `payloadMappingIssues(rows, catalog)` flags a mapping that names a transform OUTSIDE the injected catalog,
+    or a catalog conversion with no `adapterRef` (a plain source→target copy is always legal). Degradable
+    (host-owned catalog, the `resolveTool` mold).
+  - Squad Studio Wave-3 wiring: the Memória/Governança inspector tab registered in SL-9 was not actually
+    reachable (SquadStudio uses `BpmnDesigner`, which renders no inspector, and read-only blocks canvas
+    selection). Fixed: SquadStudio now renders the `PropertiesPanel`, and a member list drives selection for
+    inspection (read-only-safe — it only sets `selectedIds`, never mutates). Render vectors added (governance
+    tab shows role/persona/context keys; degrades without a contract).
+
+- 031c379: Handoff 16 E-5 — EVT*\*/TIMER*\* lint, headless ISO 8601 parser and the timer
+  editor (spec §3d, with the E-0 amendment). core: `parseTimerExpression`
+  (date / duration / cycle — total, never throws; `P1M` is one MONTH, `PT1M`
+  one MINUTE) returning a STRUCTURED result, plus the canonical
+  `properties.timer = { kind, expression }` exported as the standard OMG
+  `timeDate`/`timeDuration`/`timeCycle` child of the `timerEventDefinition` —
+  ONLY on timer events (on any other node the property stays an ordinary
+  `bpmnr:property`, never an orphan OMG child); byte-stable round-trip, absent
+  field keeps prior exports byte-identical. lint: new rules in the shipped
+  profiles (now 1.1.0 — a new promotable policy version): `EVT_START_THROW`,
+  `EVT_END_CATCH`, `EVT_ERROR_START_TOPLEVEL` (etiquette; same containment
+  predicate as the editor's Execução matrix) and `EVT_REF_MISSING` (warning,
+  with a KIND-AWARE mechanical quick-fix: one composite creating a definition
+  of the event's own kind and referencing it) + `TIMER_MALFORMED` (error via
+  the parser; no mechanical fix — guessing intent is not mechanical). react:
+  `TimerSection` — kind select, ISO 8601 expression and a HUMAN i18n preview
+  built from the parser's structured result; an invalid expression shows ONLY
+  the glyph+text notice (never a guessed preview) and an empty expression
+  removes the property entirely.
+
+### Patch Changes
+
+- b9b625a: feat(lint): escalação nas regras vivas + perfis 1.3.0 (Handoff 18 EC-4, §5d)
+
+  Escalação entra nas regras de lint pela MESMA fonte única (zero fork):
+
+  - **`EVT_REF_MISSING` ganha o kind**: `NAMED_REF_KINDS` ganha `escalation`; o
+    quick-fix cria `bpmn:escalation` no bucket `escalations` (molde do «+», nunca
+    genérica).
+  - **`EVT_ESCALATION_START_TOPLEVEL`** (erro): molde EXATO do de erro, consumindo
+    o mesmo `isEventSubprocess` — concordância com a matriz E-4 testada nos dois
+    lados (escalação não carrega I/O de engine, então a matriz a trata como null,
+    DECLARADO; o predicado compartilhado é `isEventSubprocess`).
+  - **`ESC_NO_CATCH`** (WARNING, não erro): throw de escalação sem catch elegível.
+    A razão de ser warning está no código — escalação sem destino DISSOLVE (legal
+    na OMG, diferente de erro, que é parada). Destino via a fonte única do core
+    `eligibleEscalationCatches` (boundaries + esub-starts; ref ou catch-all).
+  - **`EVT_ESCALATION_CATCH_ILLEGAL`** (reforço 8): um `intermediateCatchEvent` de
+    escalação é ilegal (só boundary/esub-start capturam) — nunca silêncio sobre um
+    catch que nenhum matching alcança. (Regra geral erro+escalação = follow-up em
+    `pendencias.md`.)
+  - **`EVT_SUBPROC_START` ganha escalation** em `SUBPROC_TRIGGER_KINDS` — fecha o
+    transitório EC-2→EC-4; os testes ES-4 que rejeitavam escalation migraram para
+    positivos. `EVT_START_THROW`/`EVT_END_CATCH` revisadas (escalação legal em
+    end-throw e esub-start).
+  - **Perfis 1.2.0 → 1.3.0** pela MESMA fonte — header do dock + `lintProfileAdapter`
+    da Biblioteca refletem por construção (teste dedicado).
+
+  core (patch): `eligibleEscalationCatches(diagram, throwRef?)` — enumeração
+  headless diagram-wide (sem escopo/tiers) com retorno estruturado
+  `{node, catchKind, matchType}`; a EC-5 constrói a RESOLUÇÃO (escopo+tiers) por
+  cima sem re-derivar — o lint e a simulação nunca forkam a topologia de catch.
+
+- e04c719: Handoff 16 E-4 — event I/O on the Execução tab (spec §3c). react: executable
+  EVENTS join activities behind the SAME `BpmnPlugin.engine` gate (no plugin →
+  panel byte-identical); the matrix lives in react (`eventExecutionModeOf` —
+  OMG semantics, not an engine opinion): message/signal throws (intermediate +
+  end) edit payload mappings (var → destino), error catches (boundary + error
+  start inside a subProcess) edit the errCode/errMsg capture variables — the
+  throw/catch asymmetry is imposed by the UI (payload never on catch, capture
+  never on throw). Props live under engine-named keys (`payloadKey`,
+  `errorCodeVariableKey`, `errorMessageVariableKey` on `EngineBridge`, with
+  `{id}:*` defaults), every commit is one undoable `updateNodeCommand`, and the
+  essential keys are excluded from the advanced fold (no double render). Clean
+  model: blank mapping rows are pruned on commit and an empty list removes the
+  property entirely — the absent field keeps prior exports byte-identical.
+  core: `updateNodeCommand`/`updateEdgeCommand` now DROP keys patched to
+  `undefined` instead of keeping an own key with an undefined value, which
+  leaked a value-less `bpmnr:property` into exports.
+- 6d7f410: Event subprocess lint (Handoff 17 ES-4, painel 4d): novas regras
+  `EVT_SUBPROC_FLOW` (fluxo de sequência tocando a casca — 1 finding por
+  aresta nomeando as duas pontas) e `EVT_SUBPROC_START` (exatamente 1 start
+  tipado entre os filhos DIRETOS — 0, >1 e sem-gatilho com mensagens
+  distintas; kind fora da lista aceita acusa nomeando os aceitos), quick-fix
+  mecânico só para 0 starts reusando o builder compartilhado
+  `typedMessageStartCommands` (a MESMA forma do composto da paleta ES-2),
+  aperto do `EVT_ERROR_START_TOPLEVEL` consumindo `isEventSubprocess`
+  (fonte única — concordância com a matriz de executáveis), perfis
+  etiquette/executability em 1.2.0. Core: o converter captura/emite
+  `triggeredByEvent`/`isInterrupting` por TAG OMG (subProcess/startEvent),
+  preservando os atributos mesmo quando o host mapeia a tag para um tipo
+  próprio via `preferredTypes`.
+- 24c4684: Handoff 21 N-1 — `preferredTypes` no longer degrades a node's type identity in
+  silence (the library's "declared, never silent" fence).
+
+  - On import, the two paths that dropped a requested type identity without a
+    warning now declare it: an unregistered `meta.type` warns per element
+    (`… requested meta type "X", which is not registered — imported as <tag>`),
+    and an unregistered `preferredTypes` entry warns once per requested type
+    (`Preferred type "X" is not registered — ignored`). Type resolution itself is
+    unchanged; `NodeTypeRegistry.typeForXmlTag` stays a pure primitive.
+  - The full behavior is frozen as a **contract matrix** in `docs/format-spec.md`
+    (using the conformance vocabulary supported/degraded/unsupported), and every
+    row cites the test in `packages/core/tests/preferredTypesContract.test.ts`
+    that pins it — matrix and suite cannot drift.
+  - Fidelity snapshot `corpus-warnings.json` regenerated: `58-agent-task-v1.bpmn`
+    goes 0 → 1 warning, surfacing a `btv:gate` identity that was silently
+    downgraded to `<task>`.
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index da5fcf3..76de3c8 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/core",
-  "version": "1.1.0",
+  "version": "1.2.0-next.0",
   "description": "Zero-dependency BPMN domain engine: model, lifecycle governance, validation, structured diff, hash-chained audit ledger, geometry and BPMN 2.0 XML (with DI).",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/dmn/CHANGELOG.md b/packages/dmn/CHANGELOG.md
index c73a3b6..8a161b4 100644
--- a/packages/dmn/CHANGELOG.md
+++ b/packages/dmn/CHANGELOG.md
@@ -1,5 +1,66 @@
 # @buildtovalue/dmn
 
+## 1.0.2-next.0
+
+### Patch Changes
+
+- 47d0de8: Handoff 15 V-6 — request-changes cycle (spec §2e). `VersionStatus` grows the
+  additive `in-review` (EM REVISÃO ⟲) state: entered only by request-changes
+  (candidate → in-review) and left only by re-submission (→ candidate), both
+  through the core state machine; the status round-trips in XML via
+  `bpmnr:version` like every other. `identity` adds
+  `buildChangeRequestPayload` (+`CanonicalChangeRequestPayload`): the signed
+  request binds versionRef + attached open threadRefs + the mandatory
+  justification, verified by the unchanged `verifySignature`. `react` adds
+  `buildChangeRequestPayloadFor`, the ⟲ gold seal (StatusBadge/VersionTimeline/
+  i18n `status.in-review`) and scopes `reviewThreadsRule` to `target: 'active'`
+  only — request-changes passes with open threads by design. `adapters-bpmn`
+  adds `reviewChangesRequestedEntry` (+`REVIEW_CHANGES_REQUESTED` type) and maps
+  `in-review` → `candidate` for the Biblioteca (documented loss) with the ⟲
+  seal surviving in the gallery meta. `studio` adds `requestChanges` (the
+  default soft path — `rejectPromotion` stays as the documented hard reject),
+  the signed "Pedir mudanças…" flow in the ReviewScreen, the
+  `review.changes.requested` N-3 bridge (`onReviewEvent`) and the re-submission
+  diff that opens against the version that requested changes (v-pedido →
+  v-nova) via registry lineage.
+- Updated dependencies [c4f2cbb]
+- Updated dependencies [0627ee6]
+- Updated dependencies [2d65a69]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [3d7be05]
+- Updated dependencies [db362a2]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [febfdb1]
+- Updated dependencies [b204522]
+- Updated dependencies [a3058f3]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [00b17de]
+- Updated dependencies [6d7f410]
+- Updated dependencies [f034a2a]
+- Updated dependencies [fcaaa8f]
+- Updated dependencies [56fe142]
+- Updated dependencies [5215bae]
+- Updated dependencies [c8223c9]
+- Updated dependencies [40d6efd]
+- Updated dependencies [6dbc87a]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [c944070]
+- Updated dependencies [b4557cd]
+- Updated dependencies [dc29b38]
+- Updated dependencies [d8d3269]
+- Updated dependencies [627dbea]
+- Updated dependencies [b9d565e]
+- Updated dependencies [a8b3dda]
+- Updated dependencies [88b9f0f]
+- Updated dependencies [febc376]
+- Updated dependencies [031c379]
+  - @buildtovalue/react@1.2.0-next.0
+  - @buildtovalue/core@1.2.0-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/dmn/package.json b/packages/dmn/package.json
index 6faca2a..8f429b5 100644
--- a/packages/dmn/package.json
+++ b/packages/dmn/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/dmn",
-  "version": "1.0.1",
+  "version": "1.0.2-next.0",
   "description": "DMN family for bpmn-react (Handoff 5, wheel degree 185): DRD node types and shapes (decision, inputData, knowledgeSource, businessKnowledgeModel), requirement edges (straight routing) and a DMN 1.4 XML converter. Zero runtime dependencies beyond @buildtovalue/*.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/domain-example/CHANGELOG.md b/packages/domain-example/CHANGELOG.md
new file mode 100644
index 0000000..0be8db3
--- /dev/null
+++ b/packages/domain-example/CHANGELOG.md
@@ -0,0 +1,56 @@
+# @buildtovalue/domain-example
+
+## 1.1.0-next.0
+
+### Minor Changes
+
+- 7258bb7: #152 — the compensation demo seeds are PUBLIC fixtures now.
+
+  New `@buildtovalue/domain-example/fixtures` entry exporting
+  `buildCompensationEditorDiagram`, `buildCompensationSimDiagram`,
+  `buildCompensationPackageDiagram` and `buildCompensationNoHandlerDiagram` —
+  moved verbatim from the example app (`packages/example/src/sampleDiagram.ts`),
+  which now imports the same entry (one source of truth; hosts reproducing the
+  `?compensation=1` demo can drop their ported copies). Pure builders over the
+  core factories: zero runtime/behavior change. The package is now publishable
+  (`private` flag removed) so the entry actually reaches npm consumers.
+
+### Patch Changes
+
+- Updated dependencies [c4f2cbb]
+- Updated dependencies [0627ee6]
+- Updated dependencies [2d65a69]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [3d7be05]
+- Updated dependencies [db362a2]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [febfdb1]
+- Updated dependencies [b204522]
+- Updated dependencies [a3058f3]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [00b17de]
+- Updated dependencies [6d7f410]
+- Updated dependencies [f034a2a]
+- Updated dependencies [fcaaa8f]
+- Updated dependencies [56fe142]
+- Updated dependencies [5215bae]
+- Updated dependencies [c8223c9]
+- Updated dependencies [40d6efd]
+- Updated dependencies [6dbc87a]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [c944070]
+- Updated dependencies [b4557cd]
+- Updated dependencies [dc29b38]
+- Updated dependencies [d8d3269]
+- Updated dependencies [627dbea]
+- Updated dependencies [b9d565e]
+- Updated dependencies [a8b3dda]
+- Updated dependencies [88b9f0f]
+- Updated dependencies [febc376]
+- Updated dependencies [031c379]
+  - @buildtovalue/react@1.2.0-next.0
+  - @buildtovalue/core@1.2.0-next.0
diff --git a/packages/domain-example/package.json b/packages/domain-example/package.json
index df9865c..bb93f47 100644
--- a/packages/domain-example/package.json
+++ b/packages/domain-example/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/domain-example",
-  "version": "1.0.0",
+  "version": "1.1.0-next.0",
   "private": true,
   "description": "Example domain plugin for bpmn-react: squads, personas, gates, prompts, connectors and deliverables — a template for building your own domain vocabulary on top of the generic core.",
   "license": "Apache-2.0",
diff --git a/packages/engine/CHANGELOG.md b/packages/engine/CHANGELOG.md
new file mode 100644
index 0000000..97f9dae
--- /dev/null
+++ b/packages/engine/CHANGELOG.md
@@ -0,0 +1,21 @@
+# @buildtovalue/engine
+
+## 1.1.0-next.1
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
diff --git a/packages/engine/package.json b/packages/engine/package.json
index 8e11451..54e4df2 100644
--- a/packages/engine/package.json
+++ b/packages/engine/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/engine",
-  "version": "1.1.0-next.0",
+  "version": "1.1.0-next.1",
   "description": "Deterministic BPMN execution kernel for the BuildToValue platform: pure advance(state, event) -> {state, effects}. Extracted from @buildtovalue/simulation (ADR-0001). v1 semantic subset: sequence flow, XOR with S-FEEL conditions, AND fork/join, user task, service task (jobs), intermediate + boundary timers, cancellation. Consumes only @buildtovalue/core. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/identity/CHANGELOG.md b/packages/identity/CHANGELOG.md
index 5b5784f..d4e707d 100644
--- a/packages/identity/CHANGELOG.md
+++ b/packages/identity/CHANGELOG.md
@@ -1,5 +1,47 @@
 # @buildtovalue/identity
 
+## 1.1.0-next.0
+
+### Minor Changes
+
+- 47d0de8: Handoff 15 V-6 — request-changes cycle (spec §2e). `VersionStatus` grows the
+  additive `in-review` (EM REVISÃO ⟲) state: entered only by request-changes
+  (candidate → in-review) and left only by re-submission (→ candidate), both
+  through the core state machine; the status round-trips in XML via
+  `bpmnr:version` like every other. `identity` adds
+  `buildChangeRequestPayload` (+`CanonicalChangeRequestPayload`): the signed
+  request binds versionRef + attached open threadRefs + the mandatory
+  justification, verified by the unchanged `verifySignature`. `react` adds
+  `buildChangeRequestPayloadFor`, the ⟲ gold seal (StatusBadge/VersionTimeline/
+  i18n `status.in-review`) and scopes `reviewThreadsRule` to `target: 'active'`
+  only — request-changes passes with open threads by design. `adapters-bpmn`
+  adds `reviewChangesRequestedEntry` (+`REVIEW_CHANGES_REQUESTED` type) and maps
+  `in-review` → `candidate` for the Biblioteca (documented loss) with the ⟲
+  seal surviving in the gallery meta. `studio` adds `requestChanges` (the
+  default soft path — `rejectPromotion` stays as the documented hard reject),
+  the signed "Pedir mudanças…" flow in the ReviewScreen, the
+  `review.changes.requested` N-3 bridge (`onReviewEvent`) and the re-submission
+  diff that opens against the version that requested changes (v-pedido →
+  v-nova) via registry lineage.
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/identity/package.json b/packages/identity/package.json
index 6298458..f1cfa29 100644
--- a/packages/identity/package.json
+++ b/packages/identity/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/identity",
-  "version": "1.0.1",
+  "version": "1.1.0-next.0",
   "description": "Headless identity, signature and RBAC-verification layer (Handoff 8): Ed25519 approval signatures over the canonical payload (WebCrypto, offline verification), and role-requirement evaluation. NEVER generates, stores or manages keys — the Signer is always injected by the host (SSO/YubiKey/git key). Consumes only @buildtovalue/core (canonicalJson + types). Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/library-react/CHANGELOG.md b/packages/library-react/CHANGELOG.md
index 3425dfc..33ec9a8 100644
--- a/packages/library-react/CHANGELOG.md
+++ b/packages/library-react/CHANGELOG.md
@@ -1,5 +1,54 @@
 # @buildtovalue/library-react
 
+## 1.1.0-next.0
+
+### Minor Changes
+
+- 6dbc87a: #151 — i18n for the Biblioteca surfaces: `LibraryView`, `ArtifactCard` and
+  `ArtifactDrawer` join the same i18n contract as every other public surface.
+
+  - library-react: the three components accept `messages?: Messages` and resolve
+    every UI string through `useT()` — resolution order: `messages` prop → an
+    ancestor `<I18nProvider>` → the per-key English fallback (no provider, no
+    prop → English, the standard embedded default).
+  - react: new `library.*` dictionary fragment (EN + PT-BR) covering filters,
+    search, sort, empty state, card runs chips and the whole detail drawer; the
+    keys ship in `PT_BR` so `messages={PT_BR}` (or the host toggle) localizes the
+    entire `/library` screen.
+  - The three files join the `check-no-hardcoded-strings` static gate (MIGRATED).
+
+### Patch Changes
+
+- Updated dependencies [c4f2cbb]
+- Updated dependencies [2d65a69]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [3d7be05]
+- Updated dependencies [db362a2]
+- Updated dependencies [febfdb1]
+- Updated dependencies [b204522]
+- Updated dependencies [a3058f3]
+- Updated dependencies [e04c719]
+- Updated dependencies [00b17de]
+- Updated dependencies [6d7f410]
+- Updated dependencies [f034a2a]
+- Updated dependencies [fcaaa8f]
+- Updated dependencies [5215bae]
+- Updated dependencies [c8223c9]
+- Updated dependencies [40d6efd]
+- Updated dependencies [6dbc87a]
+- Updated dependencies [47d0de8]
+- Updated dependencies [c944070]
+- Updated dependencies [b4557cd]
+- Updated dependencies [dc29b38]
+- Updated dependencies [d8d3269]
+- Updated dependencies [627dbea]
+- Updated dependencies [b9d565e]
+- Updated dependencies [a8b3dda]
+- Updated dependencies [88b9f0f]
+- Updated dependencies [febc376]
+- Updated dependencies [031c379]
+  - @buildtovalue/react@1.2.0-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/library-react/package.json b/packages/library-react/package.json
index 33bc65e..0b669d0 100644
--- a/packages/library-react/package.json
+++ b/packages/library-react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/library-react",
-  "version": "1.0.1",
+  "version": "1.1.0-next.0",
   "description": "React UI for the generic BuildToValue library (Handoff 6 S-3): gallery with status/type filter chips, search, artifact cards and the detail drawer — all generic, driven exclusively by the ArtifactAdapter contract. Zero runtime dependencies beyond @buildtovalue/*.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/lint/CHANGELOG.md b/packages/lint/CHANGELOG.md
index aa3e83f..9672804 100644
--- a/packages/lint/CHANGELOG.md
+++ b/packages/lint/CHANGELOG.md
@@ -1,5 +1,129 @@
 # @buildtovalue/lint
 
+## 1.2.0-next.0
+
+### Minor Changes
+
+- 81e4756: Handoff 19 CO-3 (§6c) — compensation lint rules; profiles → 1.4.0.
+
+  - `COMP_HANDLER_FLOW` (error) — a compensation handler (`isForCompensation`)
+    touched by sequence flow; one finding per edge naming the handler(s), covering
+    both roles (handler as source OR target — the import path the core veto can't
+    see).
+  - `COMP_BOUNDARY_NO_HANDLER` (error) — a compensation boundary with no
+    association to a handler; MECHANICAL quick-fix via the new shared
+    `compensationHandlerCommands` builder (the EXACT FORM of the CO-2 «Compensation
+    (pair)» palette composite — the react palette was refactored to consume it, so
+    fix and palette never drift).
+  - `COMP_REF_NOT_COMPENSABLE` (warning) — a compensation throw whose `activityRef`
+    targets an activity with no ⟲ boundary in the throw's OWN scope, read from the
+    shared `compensableActivitiesOf`.
+  - `COMP_CATCH_ATTRS` (warning) — a catch carrying `activityRef`/`waitForCompletion`
+    (non-OMG); warning only, since the converter already preserves them in the
+    bpmnr: soup and never re-emits them on the OMG child (CO-1).
+  - `EVT_SUBPROC_START` accepts a `compensate` start (the compensation event
+    subprocess); `COMP_START_TOPLEVEL` flags a compensation start outside one.
+  - Both profiles promoted 1.3.0 → 1.4.0 from the single version source.
+
+- b9b625a: feat(lint): escalação nas regras vivas + perfis 1.3.0 (Handoff 18 EC-4, §5d)
+
+  Escalação entra nas regras de lint pela MESMA fonte única (zero fork):
+
+  - **`EVT_REF_MISSING` ganha o kind**: `NAMED_REF_KINDS` ganha `escalation`; o
+    quick-fix cria `bpmn:escalation` no bucket `escalations` (molde do «+», nunca
+    genérica).
+  - **`EVT_ESCALATION_START_TOPLEVEL`** (erro): molde EXATO do de erro, consumindo
+    o mesmo `isEventSubprocess` — concordância com a matriz E-4 testada nos dois
+    lados (escalação não carrega I/O de engine, então a matriz a trata como null,
+    DECLARADO; o predicado compartilhado é `isEventSubprocess`).
+  - **`ESC_NO_CATCH`** (WARNING, não erro): throw de escalação sem catch elegível.
+    A razão de ser warning está no código — escalação sem destino DISSOLVE (legal
+    na OMG, diferente de erro, que é parada). Destino via a fonte única do core
+    `eligibleEscalationCatches` (boundaries + esub-starts; ref ou catch-all).
+  - **`EVT_ESCALATION_CATCH_ILLEGAL`** (reforço 8): um `intermediateCatchEvent` de
+    escalação é ilegal (só boundary/esub-start capturam) — nunca silêncio sobre um
+    catch que nenhum matching alcança. (Regra geral erro+escalação = follow-up em
+    `pendencias.md`.)
+  - **`EVT_SUBPROC_START` ganha escalation** em `SUBPROC_TRIGGER_KINDS` — fecha o
+    transitório EC-2→EC-4; os testes ES-4 que rejeitavam escalation migraram para
+    positivos. `EVT_START_THROW`/`EVT_END_CATCH` revisadas (escalação legal em
+    end-throw e esub-start).
+  - **Perfis 1.2.0 → 1.3.0** pela MESMA fonte — header do dock + `lintProfileAdapter`
+    da Biblioteca refletem por construção (teste dedicado).
+
+  core (patch): `eligibleEscalationCatches(diagram, throwRef?)` — enumeração
+  headless diagram-wide (sem escopo/tiers) com retorno estruturado
+  `{node, catchKind, matchType}`; a EC-5 constrói a RESOLUÇÃO (escopo+tiers) por
+  cima sem re-derivar — o lint e a simulação nunca forkam a topologia de catch.
+
+- 6d7f410: Event subprocess lint (Handoff 17 ES-4, painel 4d): novas regras
+  `EVT_SUBPROC_FLOW` (fluxo de sequência tocando a casca — 1 finding por
+  aresta nomeando as duas pontas) e `EVT_SUBPROC_START` (exatamente 1 start
+  tipado entre os filhos DIRETOS — 0, >1 e sem-gatilho com mensagens
+  distintas; kind fora da lista aceita acusa nomeando os aceitos), quick-fix
+  mecânico só para 0 starts reusando o builder compartilhado
+  `typedMessageStartCommands` (a MESMA forma do composto da paleta ES-2),
+  aperto do `EVT_ERROR_START_TOPLEVEL` consumindo `isEventSubprocess`
+  (fonte única — concordância com a matriz de executáveis), perfis
+  etiquette/executability em 1.2.0. Core: o converter captura/emite
+  `triggeredByEvent`/`isInterrupting` por TAG OMG (subProcess/startEvent),
+  preservando os atributos mesmo quando o host mapeia a tag para um tipo
+  próprio via `preferredTypes`.
+- 40d6efd: #154 — lanes now tile the pool body at design time, and the lint names the gap.
+
+  - core: lane/pool body geometry as ONE shared source (`POOL_TITLE_BAND`,
+    `poolBodyOf`, `poolContainingRect`, `lanesOfPool`, `tileLaneRects`,
+    `lanesTileBody`) — consumed by both the react gesture and the lint rule so
+    interaction and diagnosis never drift.
+  - react: creating a lane inside a pool snaps it to the pool body
+    (`x = pool.x + 30`, `width = pool.width − 30`) and tiles the body equally
+    with its siblings; resizing a lane keeps the requested height and re-tiles
+    the siblings; resizing a pool reflows its lanes — each case inside the SAME
+    gesture (one composite, one undo). Import is untouched: imported DI stays
+    sovereign.
+  - lint: new etiquette rule `LANE_BODY_TILING` (warning) flags a lane whose
+    bounds do not partition the pool body (wrong x/width, vertical gap, overlap,
+    remainder), with the mechanical quick-fix "ajustar ao corpo do pool" (one
+    composite of ordinary resize commands). Etiquette profile 1.4.0 → 1.5.0.
+
+- 031c379: Handoff 16 E-5 — EVT*\*/TIMER*\* lint, headless ISO 8601 parser and the timer
+  editor (spec §3d, with the E-0 amendment). core: `parseTimerExpression`
+  (date / duration / cycle — total, never throws; `P1M` is one MONTH, `PT1M`
+  one MINUTE) returning a STRUCTURED result, plus the canonical
+  `properties.timer = { kind, expression }` exported as the standard OMG
+  `timeDate`/`timeDuration`/`timeCycle` child of the `timerEventDefinition` —
+  ONLY on timer events (on any other node the property stays an ordinary
+  `bpmnr:property`, never an orphan OMG child); byte-stable round-trip, absent
+  field keeps prior exports byte-identical. lint: new rules in the shipped
+  profiles (now 1.1.0 — a new promotable policy version): `EVT_START_THROW`,
+  `EVT_END_CATCH`, `EVT_ERROR_START_TOPLEVEL` (etiquette; same containment
+  predicate as the editor's Execução matrix) and `EVT_REF_MISSING` (warning,
+  with a KIND-AWARE mechanical quick-fix: one composite creating a definition
+  of the event's own kind and referencing it) + `TIMER_MALFORMED` (error via
+  the parser; no mechanical fix — guessing intent is not mechanical). react:
+  `TimerSection` — kind select, ISO 8601 expression and a HUMAN i18n preview
+  built from the parser's structured result; an invalid expression shows ONLY
+  the glyph+text notice (never a guessed preview) and an empty expression
+  removes the property entirely.
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/lint/package.json b/packages/lint/package.json
index 7a4a6b4..648b4c2 100644
--- a/packages/lint/package.json
+++ b/packages/lint/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/lint",
-  "version": "1.1.0",
+  "version": "1.2.0-next.0",
   "description": "bpmnlint-style extensible modelling lint for bpmn-react: an etiquette profile (naming, superfluous gateways, implicit splits/joins, duplicate flows) and an executability profile (engine-readiness checks), delivered as plugin-compatible validation rules. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
index f4d91d2..a3486d3 100644
--- a/packages/react/CHANGELOG.md
+++ b/packages/react/CHANGELOG.md
@@ -1,5 +1,614 @@
 # @buildtovalue/react
 
+## 1.2.0-next.0
+
+### Minor Changes
+
+- c4f2cbb: Handoff 15 V-7 — command palette, cheatsheet and empty state (spec §2f). The
+  ContextMenu's conditional built-ins are extracted into a command registry
+  (`builtinMenuItems`/`pluginMenuItems`/`pluginPadItems`, equivalence-tested
+  before the refactor) and joined by `builtinGlobalCommands` (toolbar-level
+  actions). The new Ctrl/Cmd+K `CommandPalette` has NO list of its own — it
+  aggregates exactly those registries, respects `when()` against the real
+  selection context, executes only via commands, and rides the single Esc
+  dismissal stack. The "?" `Cheatsheet` is generated from the SAME aggregate
+  plus the declared `KEYBOARD_SHORTCUT_CATALOG` (an anti-drift sweep test fails
+  on any handler key not in the catalog). The empty canvas shows a teaching
+  `EmptyState` with a one-click GOVERNED example (`buildGovernedExample` — real
+  version block, not a loose sample); it disappears at the first element and
+  returns if the canvas empties.
+- 2d65a69: Handoff 19 CO-5 (§6e) — compensation → ledger glue + the read-only planner that
+  completes the OMG trigger family (message/signal/error/escalation/compensation).
+
+  - `@buildtovalue/adapters-bpmn` gains `compensationTriggeredEntry` +
+    `COMPENSATION_TRIGGERED_TYPE`: a PURE builder (the engine stays intact) the
+    host appends when compensation ACTUALLY runs. The entry ties the EXECUTED plan
+    (`compensated` in reverse order + `uncompensated` declared); `details.author`
+    prefixed `ia.copilot@` paints the ✦ AI seal (the `aiAuthorOf` rule). A blocked
+    specific target appends NOTHING (reforço 8).
+  - `@buildtovalue/simulation` exposes `compensationPlan(activityRef?)` — a
+    READ-ONLY computation (reforço 7: it reads the trail/diagram, never mutates)
+    that is the SINGLE source both `compensate()` (record + run) and the host's
+    ledger glue (append the EXECUTED reversal) consume, so the two never
+    re-derive. New exported types `CompensationPlan` / `CompensationStep`.
+  - `@buildtovalue/react` `BpmnSimulator` gains the `onCompensationTriggered`
+    prop (path a — the engine stays pure): the demo/host reads the plan BEFORE
+    firing and appends the ledger entry only when something reversed.
+
+- a99b6f9: Handoff 19 CO-2 (§6b) — compensation visual, palette pair and target picker.
+
+  - core: `compensableActivitiesOf(diagram, scope?)` — the scope-aware single
+    source of "which activities here can be compensated" (carry a ⟲ boundary),
+    consumed by the throw picker, the lint (CO-3) and the simulator (CO-4).
+  - react visual: the rewind ◀◀ glyph joins the single-source `eventGlyph` (throw
+    filled / catch hollow); the compensation boundary is always SOLID and its
+    interrupting toggle is absent (it fires post-completion); a `bpmn:association`
+    now renders as a dashed line with NO flow arrow (a new global `association`
+    edge style — BPMN-correct for every association, including text annotations); a
+    ◀◀ marker on `isForCompensation` handlers, coexisting with loop/MI markers.
+  - react UX: the «Compensation (pair)» palette composite drops the boundary +
+    handler (below the host) + linking association in ONE undo, lint-clean, with a
+    stable-DI association so the fresh diagram re-exports byte-stably; the throw's
+    transient «⟲ compensa: {activity|scope}» chip; and a target picker listing the
+    compensable activities of the throw's OWN scope (broadcast is the default).
+  - i18n EN/PT-BR; touch ≥44px; a `?comp=1` editor demo + e2e.
+
+- 3d7be05: Handoff 19 CO-4 (§6d) — compensation in the token simulator (`compensate`).
+
+  - `compensate(activityRef)` runs only that activity's handler; `compensate()`
+    (broadcast) runs every completed compensable activity's handler in REVERSE
+    order and fires the scope's compensation event subprocesses. Which activities
+    are compensable comes from the shared core source (`compensableActivitiesOf`);
+    the handler is resolved from the boundary's association.
+  - Completion is derived from the trail (`'move'`/`'end'`), never a second record
+    type; the loop rule is declared (last completion wins). A completed activity
+    with no handler is a declared trail line; a specific non-compensable/incomplete
+    target is a declared stop; `waitForCompletion` is declared in the trail.
+  - Compensation has no ref-matching, so the ES-5 tier precedence does not apply —
+    broadcast fires boundary handlers and esub-starts together; a specific target
+    never fires an esub-start (reforço 9).
+  - New `Decision` variant `compensate` (anchored to `atStep`), serializable and
+    replayed bit-for-bit; existing E-6/ES-5/EC-5 scenarios replay unchanged.
+  - The react `SimulationPanel` gains the «Compensate» card — broadcast (default)
+    shows the reversal COUNT (reforço 10), each compensable activity is fireable
+    when completed else listed not-eligible with a reason.
+
+- db362a2: #150 — CopilotPanel makes aplicar ≠ aprovar VISIBLE with three card states.
+
+  - PROPOSTA: a valid proposal arrives as a neutral card (diff summary + local
+    soundness preview) and touches NOTHING; actions `[Aplicar no rascunho]`
+    `[Descartar]` — the apply copy never says "accept/approve".
+  - APLICADA · NÃO APROVADA: applying executes the ONE composite through the
+    normal CommandStack (RuleEngine/lint validate it like any edit; a veto is
+    declared on the card). The card never disappears: amber pill + banner
+    "passou pela mesma validação de qualquer edição; aprovação é ação separada";
+    actions `[Desfazer]` (single undo) `[Ver diff]` `[Enviar p/ aprovação]`.
+  - APROVADA: the green pill paints ONLY from the host lifecycle signal — new
+    optional props `onSubmitForApproval` (routes the intent) and
+    `suggestionStatus` (registry/RBAC verdict by applied command id), mirroring
+    the `promptStatus` precedent. Applying never changes lifecycle status.
+  - New `copilot.*` i18n keys (EN + PT-BR) for the pills, banner and actions.
+
+- febfdb1: feat(react): escalação visual + autoridade + paleta não-interrupting (Handoff 18 EC-2, §5b)
+
+  O kind escalation entra em TODOS os gates locais da react (zero fork) e ganha a
+  personalidade BTV:
+
+  - **Gates alinhados na mesma PR**: `REF_KINDS`/`eventKindOf`
+    (`EventDefinitionSection`), `eventBindingRule` e o overlay de chips
+    (`overlays`) passam a aceitar `escalation`; o picker E-2 lista o bucket com
+    `escalationCode` por tipo (molde do `errorCode`, assimetria testada).
+  - **Glifo + tracejado**: o chevron ↟ vem da fonte única `eventGlyph` (já
+    existia — pintado, nunca duplicado); tracejado só não-interrupting via
+    `isNonInterrupting`. Snapshot do boundary comum intacto.
+  - **Item de paleta dedicado «Escalation (boundary)»** (composto, molde ES-2):
+    boundary + definição local + ref num 1 undo, `cancelActivity:false` explícito
+    (default não-interrupting DECLARADO). **Reforço 7**: o drop precisa de host —
+    sobre uma atividade anexa (anchor N-1), em canvas vazio recusa com veto
+    declarado no 🔒 (`announceVeto`), nunca boundary órfão nem no-op mudo. O
+    `InterruptingToggle` existente passa a servir boundaries (flipa `cancelActivity`).
+  - **Chips governados + autoridade**: o resolver E-3 (widened na EC-1) resolve
+    escalação ponta-a-ponta; chip `esc-nome@semver` + selo. Novo chip de
+    **autoridade** (`properties.escalationAuthority` → `bpmnr:`) — **reforço 8**: lê
+    o valor ASSENTADO (commit no blur do inspector), autoridade vazia = ausente
+    (sem chip). Ambos os chips são overlays transientes (nunca exportados).
+  - **Esub**: o shape colapsado já pinta o glifo do start de escalação.
+    **Estado transitório registrado**: a lista de kinds do lint `EVT_SUBPROC_START`
+    só ganha escalation na EC-4 — entre EC-2 e EC-4 o esub-escalação renderiza mas
+    o lint ainda o sinaliza (dock advisório, sem quebra).
+  - **Transversais**: i18n EN/PT-BR (código, autoridade, veto, composto), touch,
+    apiSurface react (`buildEscalationBoundaryInsert`, `hasInterruptingToggle`,
+    `PaletteInsertResult`), pisos, dark, e2e (`?escalation=1` + veto em `?empty=1`).
+
+  Fora da EC-2: EC-3 ponte agente→humano + ledger · EC-4 lint 1.3.0 · EC-5
+  `throwEscalation`/dissolve.
+
+- b204522: Handoff 18 §5e — escalation throws in the token simulator (`throwEscalation`),
+  completing the OMG trigger family. The candidate topology is enumerated by the
+  SAME shared core source as the lint (`eligibleEscalationCatches`, no fork); the
+  simulator builds the scoped, tiered resolution on top — the identical total
+  order and ambiguity rule as `throwError` (`especificidade > escopo > catch-all`;
+
+  > 1 in the winning tier is a `BlockedDecision`).
+
+  Two things differ, both declared: the personality is NON-INTERRUPTING (a
+  non-interrupting catch leaves the host token in place and re-emerges a parallel
+  token at the catch — the host continues), and NO eligible catch = the escalation
+  DISSOLVES (a declared no-op in the trail, the host token continues), the binding
+  contrast with an uncaught error's stop.
+
+  New public types `EscalationDestination` / `EscalationThrowOption` and the
+  `escalationThrowOptions` state; the react `SimulationPanel` gains the «Escalate»
+  card, which predicts each option's destination + mode as glyph + text before the
+  throw (informed decision). `BpmnSimulator` gains an `onEscalationThrown` callback
+  (the engine stays pure) so the host maps a fired escalation to a ledger entry
+  (`escalationRaisedEntry` — the escalation actually happened).
+
+- a3058f3: Named event definitions UI (Handoff 16 §3a, E-2). The properties panel gains
+  an "Evento" section for message/signal/error events: a named-definition
+  picker with the «+» flow — ONE composite command (add definition + reference
+  the node) so a single undo reverts both; inline rename whose cascade to every
+  referencing event is by construction (refs are by id — nodes never touched);
+  an honest usage list with click-to-navigate (U-4 animated pan,
+  reduced-motion respected); and deletion whose core veto (usage list in the
+  reason) surfaces through the existing `lastVeto` channel — the managed
+  definition survives unlinking so the Axelor flow "change ref → delete" is
+  reachable while the veto stays honest. `errorCode` renders only for error
+  definitions. i18n EN/PT-BR (`eventDefs` fragment), touch ≥44px, dark theme.
+- e04c719: Handoff 16 E-4 — event I/O on the Execução tab (spec §3c). react: executable
+  EVENTS join activities behind the SAME `BpmnPlugin.engine` gate (no plugin →
+  panel byte-identical); the matrix lives in react (`eventExecutionModeOf` —
+  OMG semantics, not an engine opinion): message/signal throws (intermediate +
+  end) edit payload mappings (var → destino), error catches (boundary + error
+  start inside a subProcess) edit the errCode/errMsg capture variables — the
+  throw/catch asymmetry is imposed by the UI (payload never on catch, capture
+  never on throw). Props live under engine-named keys (`payloadKey`,
+  `errorCodeVariableKey`, `errorMessageVariableKey` on `EngineBridge`, with
+  `{id}:*` defaults), every commit is one undoable `updateNodeCommand`, and the
+  essential keys are excluded from the advanced fold (no double render). Clean
+  model: blank mapping rows are pruned on commit and an empty list removes the
+  property entirely — the absent field keeps prior exports byte-identical.
+  core: `updateNodeCommand`/`updateEdgeCommand` now DROP keys patched to
+  `undefined` instead of keeping an own key with an undefined value, which
+  leaked a value-less `bpmnr:property` into exports.
+- 00b17de: Handoff 17 ES-3 — event-subprocess interactions (spec §4c). New
+  `announceVeto(reason)` on the diagram context: the DECLARED gesture-veto
+  channel — a rejected connect drop or a Tab on the event-subprocess shell
+  lights the same 🔒 surface as `lastVeto`, with the same lifecycle (replaced
+  by the next veto, cleared by the next successful command). The shell offers
+  NO connection ports and its context pad drops connect/append entries;
+  children keep the full pad and Tab chaining (the veto is shell-only, both
+  directions, with the ES-1 rule's message — one message, one source).
+  `InterruptingToggle` ("Interrompe o escopo") appears ONLY on the start of an
+  event subprocess (`isEventSubprocessStart` — core helpers on both sides of
+  the predicate): one undoable `updateNodeCommand`, with the OMG default
+  (interrupting) stored as the ABSENT field. The E-4 execution matrix is
+  TIGHTENED: `eventExecutionModeOf` catch-error now requires
+  `isEventSubprocess` on the parent (the same single-source helper the ES-4
+  lint will consume); the old "any subProcess" case is the new negative, and
+  the E-4 artifacts (tests + `?eventio=1` demo) migrate in this change.
+  Cross-scope flow (child → outside) keeps the behavior inherited from common
+  sub-processes — parity tested; the OMG non-conformance is registered in
+  pendencias.md, never a silent divergence.
+- 6d7f410: Event subprocess lint (Handoff 17 ES-4, painel 4d): novas regras
+  `EVT_SUBPROC_FLOW` (fluxo de sequência tocando a casca — 1 finding por
+  aresta nomeando as duas pontas) e `EVT_SUBPROC_START` (exatamente 1 start
+  tipado entre os filhos DIRETOS — 0, >1 e sem-gatilho com mensagens
+  distintas; kind fora da lista aceita acusa nomeando os aceitos), quick-fix
+  mecânico só para 0 starts reusando o builder compartilhado
+  `typedMessageStartCommands` (a MESMA forma do composto da paleta ES-2),
+  aperto do `EVT_ERROR_START_TOPLEVEL` consumindo `isEventSubprocess`
+  (fonte única — concordância com a matriz de executáveis), perfis
+  etiquette/executability em 1.2.0. Core: o converter captura/emite
+  `triggeredByEvent`/`isInterrupting` por TAG OMG (subProcess/startEvent),
+  preservando os atributos mesmo quando o host mapeia a tag para um tipo
+  próprio via `preferredTypes`.
+- f034a2a: Handoff 17 ES-2 — event-subprocess shapes and the composite palette item
+  (spec §4b). `SubProcessShape` consumes the core `isEventSubprocess` predicate
+  (never reimplemented): the OMG thin DOTTED border + `event subProcess` tag,
+  with the COMMON subProcess byte-identical to before (frozen markup fixture);
+  collapsed containers show the trigger glyph of the FIRST typed start child —
+  0 starts / >1 starts / kindless starts degrade to no glyph, never a crash
+  (fixing the model is the lint's job). `StartEventShape` draws DASHED when
+  `startIsInterrupting(node) === false` (the H6 boundary dash), glyphs reused
+  from the single `eventGlyph` source. New documented public surface:
+  `PaletteItem.build` — a composite insert factory resolved by ONE code path
+  (`paletteInsertCommand`/`insertPaletteItem`) shared by the palette click and
+  the new `palette.insert.*` ⌘K registry (`paletteInsertCommands`, anti-drift
+  tested). The shipped «Event Subprocess» item creates container + typed
+  message start + referenced named definition in ONE undo — lint-clean by
+  construction. Palette labels now resolve `palette.item.{id}` from the i18n
+  dictionary when present (additive; existing items unchanged). Dashes are SVG
+  geometry, faithful in SVG/PNG export and both themes. Also new:
+  `useDiagramOrNull` (tolerant context hook for pure shapes).
+- fcaaa8f: Simulação do event subprocess (Handoff 17 ES-5, painel 4e): candidatos de
+  `throwError`/`throwSignal`/`throwMessage` passam a incluir os starts tipados
+  dos event subprocesses do escopo do token (elegibilidade via os helpers
+  fonte-única `isEventSubprocess`/`startIsInterrupting`); precedência do erro em
+  ordem TOTAL declarada (esub-exato > boundary-exato > esub-catch-all >
+  boundary-catch-all; >1 no tier vencedor = `BlockedDecision` nomeando
+  candidatos); token no CONTÊINER com descida declarada não-simulada;
+  interrupção nomeada na trilha (contagem de tokens cancelados + escopo, uma
+  vez por throw — os tokens recém-colocados pelo mesmo throw sobrevivem);
+  timer/conditional NUNCA auto-dispara — card manual novo
+  (`eventSubprocessOptions`/`fireEventSubprocess`, decisão `eventSubprocess`
+  ancorada em `atStep` para replay bit a bit); compat E-6: cenários sem event
+  subprocess replayam com trilha byte-idêntica. React: card manual no
+  `SimulationPanel` com o modo declarado (glifo+texto) e i18n EN/PT-BR;
+  limitations.md atualizado no mesmo PR.
+- 5215bae: Handoff 16 E-3 — governed event-definition bindings (`nome@semver`) via the
+  Biblioteca (spec §3b). react: the host injects a synchronous
+  `EventDefinitionResolver` through `BpmnPlugin.eventDefinitionResolver` (first
+  wins — the editor never consults a registry); the E-2 picker gains a
+  "Da Biblioteca" section whose selection binds in ONE composite
+  (`buildBindCommand`: local `gov-{nome}` mirror upsert + `eventDefinitionRef` +
+  pinned `properties.eventDefinitionBinding`, serialized as an ordinary
+  `bpmnr:property` — byte-stable, never a vendor attribute); unbinding
+  (`buildUnbindCommand`) garbage-collects the orphaned mirror in the same
+  composite. A canvas chip (transient — excluded from exports) and a panel seal
+  show the resolution state with glyph+text (`✓ VIGENTE` / `⚠ CANDIDATA` /
+  `✕ NÃO RESOLVIDA`), degrading DECLAREDLY to plain text when no resolver is
+  configured. `eventBindingRule(resolver)` validates bindings —
+  `SIG_REF_MISSING` (error) / `SIG_REF_STALE` (warning) — through the existing
+  issue badges. The `gov-*` mirror is read-only in the panel (managed by the
+  Library; editing = promoting a new version) and counts as a normal usage for
+  the deletion veto, and the pin never moves on artifact promotion — only an
+  explicit, audited re-bind. adapters-bpmn: `eventDefinitionCatalogAdapter`
+  (read-only Biblioteca catalog, one card per name with the version timeline)
+  and `eventBindingChangedEntry`/`EVENT_BINDING_CHANGED_TYPE` (ledger builder
+  for the explicit ref change, host-appended).
+- c8223c9: Handoff 16 E-6 — honest event matching in the simulator (spec §3e, S-FEEL
+  discipline: exact where possible, a DECLARED stop everywhere else, never a
+  guessed route). simulation: `throwError(host, errorRef?)` — the user throws
+  the ERROR (named definition or uncatalogued), the ENGINE resolves the boundary
+  by matching: a specific `errorRef` match beats the DECLARED catch-all
+  (documented precedence — both present is NOT ambiguity); two eligible
+  specifics, two catch-alls, or an uncaught error are `BlockedDecision` stops
+  naming node, reason and candidates. `throwSignal` broadcasts to every waiting
+  matching catch; `throwMessage` delivers to a single destination — more than
+  one waiting candidate is a declared stop (runtime correlation is not
+  simulable; documented in limitations.md). All three are new serializable
+  `Decision` kinds that replay through the SAME matching; `fireBoundary` and
+  old scenarios stay intact, and error boundaries leave the manual
+  `boundaryOptions` list for the new `errorThrowOptions` cards. react: the
+  SimulationPanel renders the inverted "Throw error" card (per-definition
+  buttons + the "uncatalogued error" path that exercises the catch-all).
+- 40d6efd: #154 — lanes now tile the pool body at design time, and the lint names the gap.
+
+  - core: lane/pool body geometry as ONE shared source (`POOL_TITLE_BAND`,
+    `poolBodyOf`, `poolContainingRect`, `lanesOfPool`, `tileLaneRects`,
+    `lanesTileBody`) — consumed by both the react gesture and the lint rule so
+    interaction and diagnosis never drift.
+  - react: creating a lane inside a pool snaps it to the pool body
+    (`x = pool.x + 30`, `width = pool.width − 30`) and tiles the body equally
+    with its siblings; resizing a lane keeps the requested height and re-tiles
+    the siblings; resizing a pool reflows its lanes — each case inside the SAME
+    gesture (one composite, one undo). Import is untouched: imported DI stays
+    sovereign.
+  - lint: new etiquette rule `LANE_BODY_TILING` (warning) flags a lane whose
+    bounds do not partition the pool body (wrong x/width, vertical gap, overlap,
+    remainder), with the mechanical quick-fix "ajustar ao corpo do pool" (one
+    composite of ordinary resize commands). Etiquette profile 1.4.0 → 1.5.0.
+
+- 6dbc87a: #151 — i18n for the Biblioteca surfaces: `LibraryView`, `ArtifactCard` and
+  `ArtifactDrawer` join the same i18n contract as every other public surface.
+
+  - library-react: the three components accept `messages?: Messages` and resolve
+    every UI string through `useT()` — resolution order: `messages` prop → an
+    ancestor `<I18nProvider>` → the per-key English fallback (no provider, no
+    prop → English, the standard embedded default).
+  - react: new `library.*` dictionary fragment (EN + PT-BR) covering filters,
+    search, sort, empty state, card runs chips and the whole detail drawer; the
+    keys ship in `PT_BR` so `messages={PT_BR}` (or the host toggle) localizes the
+    entire `/library` screen.
+  - The three files join the `check-no-hardcoded-strings` static gate (MIGRATED).
+
+- 47d0de8: Handoff 15 V-6 — request-changes cycle (spec §2e). `VersionStatus` grows the
+  additive `in-review` (EM REVISÃO ⟲) state: entered only by request-changes
+  (candidate → in-review) and left only by re-submission (→ candidate), both
+  through the core state machine; the status round-trips in XML via
+  `bpmnr:version` like every other. `identity` adds
+  `buildChangeRequestPayload` (+`CanonicalChangeRequestPayload`): the signed
+  request binds versionRef + attached open threadRefs + the mandatory
+  justification, verified by the unchanged `verifySignature`. `react` adds
+  `buildChangeRequestPayloadFor`, the ⟲ gold seal (StatusBadge/VersionTimeline/
+  i18n `status.in-review`) and scopes `reviewThreadsRule` to `target: 'active'`
+  only — request-changes passes with open threads by design. `adapters-bpmn`
+  adds `reviewChangesRequestedEntry` (+`REVIEW_CHANGES_REQUESTED` type) and maps
+  `in-review` → `candidate` for the Biblioteca (documented loss) with the ⟲
+  seal surviving in the gallery meta. `studio` adds `requestChanges` (the
+  default soft path — `rejectPromotion` stays as the documented hard reject),
+  the signed "Pedir mudanças…" flow in the ReviewScreen, the
+  `review.changes.requested` N-3 bridge (`onReviewEvent`) and the re-submission
+  diff that opens against the version that requested changes (v-pedido →
+  v-nova) via registry lineage.
+- c944070: SL-10 (react) — the squad fact trail + the off-thread squad run (Handoff 22 "Squad Lane").
+
+  - `SquadTrail` — renders a headless `SquadSimResult` as the fact trail (D1): an ordered
+    `intencao → acao → io → decisao → evidencia` list, each fact labeled with its provenance
+    (`fixture` vs `evidencia-declarada`, E6) and its masked I/O. It is VIRTUALIZED with its OWN windowing
+    (E8 — no react-window): a fixed row height + a scroll spacer means only the visible slice (+ overscan)
+    mounts, so a 10k-fact trail scrolls with a bounded DOM. It is FILTERABLE by agent / kind / error, and
+    STEP-ABLE (D8): step mode walks the filtered facts one at a time and shows the shared-context snapshot
+    AT that step (already masked by the headless engine). It invents nothing — masking, provenance and the
+    context snapshot all come straight from `simulateSquad`.
+  - `squadSimJob` — the squad run as an F7 compute job, registered in `DEFAULT_JOBS` as `squad-sim`, so it
+    runs with the SAME agentflow engine off the main thread (or in-thread via the SyncExecutor — proven
+    byte-identical). A resolver FUNCTION cannot cross a worker boundary, so the host passes a serializable
+    map of member workflows keyed by `id@version` (the `routeJob` pattern); the job rebuilds the resolver
+    inside the worker. Masking uses the conservative redaction across the boundary (never leaks).
+  - Tests: virtualization (bounded DOM + window-follows-scroll), the three filters, step mode with per-step
+    context, provenance labels, the worker≡sync byte-identity, and a zero-serious/critical axe gate. i18n
+    EN + PT-BR; `SquadTrail` added to the hardcoded-string cerca. apiSurface + typedoc updated.
+
+- b4557cd: SL-11 — EvidenceBundle as a canonical audit entry + ExecutionStore + LedgerExplorer renderer
+  (Handoff 22 "Squad Lane").
+
+  - `EvidenceBundle` (adapters-bpmn) — a neutral, serializable evidence record for one squad run, the
+    squad analog of a simulation `Session`. It wraps the masked fact trail from `simulateSquad` (agentflow,
+    which never imports audit/core) and REQUIRES the three governance refs: `policyRefs`,
+    `decisionRuleRefs`, `maskingPolicyRef` (acceptance §10.4). `buildEvidenceBundle` REFUSES (throws) a bundle
+    whose masked trail names no masking policy — masked evidence with no named policy is not attributable.
+    It reuses core's integrity primitives (`canonicalJsonExact` + `sha256Hex`), never a bespoke format:
+    `canonicalEvidenceBundle` exports byte-identical canonical JSON and `hashEvidenceBundle` hashes it
+    deterministically (2× identical).
+  - `evidenceBundleEntry` maps a bundle to an `AuditEntryInput`. Appended through the normal
+    `AuditLedger.append()`, the entry is hashed whole by core's v2 `computeEntryHash`, so the ledger's own
+    `verify()` — and `@buildtovalue/audit`'s `verifyLedger`, which recomputes the identical hash — validate it
+    with NO evidence-specific code. Tampering with a recorded ref breaks the chain (proven). `evidenceBundleOf`
+    reconstructs the bundle from the chain (the chain IS the store).
+  - `ExecutionStore` (born here) — the injected, DEGRADABLE seam where a host persists evidence bundles: a
+    consumer given `undefined` simply does not persist (the run still produces its bundle).
+    `createInMemoryExecutionStore` is the default (records + lists newest-first) for tests/demos; a real host
+    swaps durable storage without this package importing one.
+  - LedgerExplorer (studio) — a dedicated `evidence` category chip + a governance-refs detail section that
+    surfaces the mandatory masking policy / policies / decision rules + the masked fact count, with a canonical
+    evidence-bundle download. The section only renders when the masking policy is present (never unattributed
+    evidence). i18n EN + PT-BR (react studio fragment).
+  - Vectors: mandatory-refs enforcement, canonical + hash determinism, ledger verify (+ tamper detection),
+    chain round-trip, ExecutionStore degradability, and the renderer. apiSurface (adapters-bpmn) + typedoc updated.
+
+- dc29b38: SL-12 — BPMN bridge (Handoff 22 "Squad Lane"), core half: process-level gate coverage.
+
+  - `gateBypassRoute(diagram, startId, isGate, isTerminal?)` — the process-path-coverage companion to
+    `reachableGateFrom`, over the SAME sequence-flow graph (never a new traversal model). Returns the id of an
+    ungated commit point (a terminal — default an `endEvent` — or a sink) reachable WITHOUT passing a gate;
+    gate nodes are walls (a gate covers everything downstream of itself). `undefined` means every route to a
+    commit passes a gate.
+  - `agentGateCoverageViolations` + `agentGateCoverageRule` — `GATE_NOT_COVERING` (§6): every agentTask whose
+    autonomy requires a gate where a gate IS reachable (so NOT the no-gate case that `agentGateViolations`
+    already reports — the two stay distinct, no double-report) but a route (fallback/retry/bypass) reaches a
+    commit without passing it. The violation names the bypass route; the promotion rule blocks activation with a
+    `GATE_NOT_COVERING` reason. Built over `reachableGateFrom` + `effectRequiresGate` (SL-1) — the
+    process-path-coverage layer the SL-1 `TOOL_EFFECT_UNGATED` (contract-level) and the SL-11 squad grounding
+    check deliberately deferred.
+  - Positive + negative + remediation + no-double-report + sink + cyclic + custom-terminal + promotion-block
+    vectors. apiSurface updated.
+
+  - `scaffoldSquad(template, options?)` (copilot) — the whitelisted squad scaffolder (§8-08), a PROPOSAL
+    GENERATOR built ENTIRELY from the primitive whitelisted commands (`addNode`/`addEdge`), so it is
+    structurally incapable of expressing anything off the whitelist. It flows through the ordinary
+    PROPOSTA → APLICADA pipeline (`validateProposal` → `buildPlan` → CopilotPanel): applying runs through the
+    CommandStack like any edit and NEVER approves/promotes (#150). Four templates (`hierarquico` / `sequencial`
+    / `paralelo` / `revisao`), each scaffolding a gate-covered squad process — a start, agentTasks with an
+    `autonomyLevel`, an approval gate (a core `userTask` marked `properties.gate`, since the domain `btv:gate`
+    is not core-creatable) before the end, and the sequence flows. Deterministic (ids/positions from
+    template + prefix); a `prefix` option namespaces ids so two squads coexist. Vectors: whitelist-only,
+    node-before-edge order, validates against a fresh diagram, gate-covered projection, determinism,
+    prefix-collision. apiSurface updated.
+
+  - BPMN bridge deep-link (react, §8-08, closes pendências §1.2): `?load=<versionId>` opens the EXACT
+    artifact version instead of the demo diagram. `readLoadVersionId` + `resolveDeepLink` parse the param and
+    call an injected `VersionResolver` (degradable — an absent/unresolved version falls back to the default,
+    never guesses); `buildLoadSearch` builds the URL the host pushes to history. The host owns URL/history
+    (never `window`/`history` here). `BpmnDesigner` gains `initialCanvasState` so "voltar" restores the saved
+    viewport/selection.
+  - `MAPPING_TRANSFORM_ILLEGAL` (react): `PayloadMapping` gains optional additive `transform`/`adapterRef`;
+    `payloadMappingIssues(rows, catalog)` flags a mapping that names a transform OUTSIDE the injected catalog,
+    or a catalog conversion with no `adapterRef` (a plain source→target copy is always legal). Degradable
+    (host-owned catalog, the `resolveTool` mold).
+  - Squad Studio Wave-3 wiring: the Memória/Governança inspector tab registered in SL-9 was not actually
+    reachable (SquadStudio uses `BpmnDesigner`, which renders no inspector, and read-only blocks canvas
+    selection). Fixed: SquadStudio now renders the `PropertiesPanel`, and a member list drives selection for
+    inspection (read-only-safe — it only sets `selectedIds`, never mutates). Render vectors added (governance
+    tab shows role/persona/context keys; degrades without a contract).
+
+- d8d3269: SL-13 — readiness badges (single source) + reconciliation + i18n/a11y sweep (Handoff 22 "Squad Lane"),
+  the closing chore.
+
+  - `ReadinessBadge` — the ONE way any surface paints an agent's/squad's readiness. It derives the state
+    SOLELY from the pure `readinessState()` (cerca §2.11 — painting a state in the UI is prohibited); the guard
+    test compares the badge to `readinessState()` across all four states, so a component that derived its own
+    state would break the build (acceptance §10.7). The four derived states are the ceiling; the host runtime
+    states (`executando` / `erro-de-integracao`) show ONLY when the host informs them via `hostStatus` —
+    `apto-para-integracao` never becomes `executando` on its own. Wired into AgentStudio's header (readiness
+    from the studio's own validation + whether a completed simulation exists). i18n EN + PT-BR; zero
+    serious/critical axe.
+  - `docs/design_handoff_btv_squad_lane/RECONCILIACAO.md` — the item-by-item scorecard of SL-1…SL-13 against
+    §10 (every acceptance criterion → where it is satisfied: SL, file, test), plus the registered boundaries
+    (the three distinct gate layers; manifest↔diagram round-trip; off-thread masking; host-only runtime states).
+  - i18n/a11y sweep: the new surface carries EN + PT-BR and passes the hardcoded-string cerca + the axe gate;
+    the full suite stays green under coverage with independence/acidez and the conformance corpus untouched.
+
+- 627dbea: SL-2 — TOOL catalog + selector binding + the injectable `ToolProvider` (Handoff 22 "Squad Lane").
+
+  - **adapters-bpmn:** `toolAdapter(contracts)` surfaces `ToolContract` artifacts in the Biblioteca as
+    "mais um adapter" (type `FERRAMENTA`), mirroring the non-diagram `copilotPromptAdapter` mold — one
+    artifact per tool id, versions grouped, governance posture (effect/authorization) in `meta`,
+    read-only. `resolveToolContract(contracts)` is the shared headless resolver the catalog and the
+    react provider both use (one registry, never a parallel truth).
+  - **react:** the `ToolProvider` interface is born here (`{ resolve; list?() }`, implementing agentflow's
+    `ResolveTool` — types flow down react→agentflow) plus `createToolProvider(contracts)`. It is injected
+    as an optional `toolProvider` prop on `AgentStudio` (the `AIProvider`/H9 mold). The tool inspector
+    binds by **selector/autocomplete** — impossible to type a loose string (cerca §2.2) — showing the
+    resolved contract's effect + capability inline, and a declared `TOOL_UNRESOLVED` warning when the bound
+    ref is not in the catalog. `validateGraph` now runs with `{ resolveTool: toolProvider?.resolve }`.
+  - **Degradability:** with no provider the binding degrades to the pre-SL-2 typed text field and the graph
+    still validates (contract-aware checks simply do not run) — never a crash, never silence. Covered by a
+    render test (provider undefined → plain field; provider that lists → selector + effect chip; provider
+    that cannot resolve → visible warning, no validation error).
+  - Drag-into-node from the catalog is explicitly OUT of the MVP and registered in `pendencias.md` (§11).
+
+- b9d565e: SL-5 — tab-registered inspector sections + Wave-1 agent tabs + headless promptCoverage (Handoff 22 "Squad Lane").
+
+  - **agentflow (headless):** `promptCoverage(inputVars, promptText)` — a pure, deterministic check emitting
+    `PROMPT_VAR_UNUSED` (warning) for each declared input variable the prompt never references as `{{name}}`.
+    It is a SEPARATE entry point (not wired into `validateGraph`, which has only the `promptRef`): the host
+    feeds resolved prompt text; with none it simply is not called. `promptVariables` exposes the bare-`{{name}}`
+    extractor, deliberately distinct from the simulate engine's `{{node.output.path}}` tool-param form. Zero
+    ecosystem imports (independence preserved).
+  - **react — reusable infra:** `InspectorSection` gains an optional `tab?: { id, label }` (additive, MINOR).
+    `PropertiesPanel` generalizes its hardcoded General/Execution pair into a tab registry: a section that
+    declares a `tab` renders as its own registered tab; sections without `tab` stay inline in General exactly
+    as before. General/Execution and every existing node-type render byte-identically (regression tests green);
+    no engine + no tab section → no tab strip, unchanged.
+  - **react — Wave 1 (O1):** the AgentStudio node inspector is organized into **Identity** + **Intelligence**
+    tabs. Intelligence shows the model-facing config (model, promptRef, provider shown as a host-injected label
+    — never a key field, structuredOutput) and, for a tool node, the resolved contract effect via the injected
+    `ToolProvider` (degrading with a declared warning when absent — inherited from SL-2). Decorators + remove
+    stay below the tabs (Waves 2/3 are not pre-empted; the errorBoundary flow is unchanged).
+  - The agentTask node in the main canvas keeps its current inline inspector; giving it Wave tabs needs an
+    injected agent-workflow resolver and lands at the SL-12 bridge (registered in `pendencias.md` §11).
+  - i18n EN+PT_BR for all new strings; PropertiesPanel/AgentStudio stay on the migrated no-hardcoded-strings
+    surface. Positive + negative + remediation vectors for `PROMPT_VAR_UNUSED`.
+
+- a8b3dda: SL-6 — Problems Panel (business language) + safe quick-fix + Wave-2 Contracts tab (Handoff 22 "Squad Lane").
+
+  - **Problems Panel** in the AgentStudio inspector: every `validateGraph` issue rendered in BUSINESS language
+    with the stable code beside it. Each code maps to a localized title AND a localized remediation; an
+    unmapped code falls back (title → generic localized title, remediation → the EN headless string), never a
+    raw code string. The headless `remediation` stays EN (host-agnostic); the UI localizes at the edge (N-6),
+    closing the mixed-language i18n gap (melhorias F5). "Locate" selects the issue's node (no `scrollIntoView`).
+  - **Safe quick-fix** rides the modal's single undoable command/undo stack (`apply(EditResult)`) — never a
+    parallel mutation path. A fix appears ONLY for codes that cannot change the I/O contract:
+    `RETRY_WITHOUT_MAX` (bounds the looping route with `maxRetries`) and `LLM_NOT_STRUCTURED` (sets
+    `structuredOutput`). Contract/gate/schema codes (`TOOL_EFFECT_UNGATED`, `TOOL_PARAMS_MISMATCH`,
+    `DELEGATE_CONTRACT_MISMATCH`, empty-schema, …) show the code with NO fix button.
+  - **Wave 2 (O2) — Contracts tab** on the node inspector: the workflow I/O contract (input/output schema,
+    read-only, normalized) and, for a tool node, the resolved `ToolContract` (capability/effect/authorization)
+    via the injected `ToolProvider`, degrading with a declared notice when absent. Memory/Governance (O3)
+    is untouched.
+  - The inspector now defaults to the **Intelligence** tab (the daily-work tab, prototype 02); Identity and
+    Contracts are deliberate clicks.
+  - i18n EN+PT_BR for all new strings; AgentStudio stays on the migrated no-hardcoded-strings surface.
+
+- 88b9f0f: SL-7 — EvalSet + promotion gate + prompt coverage validator (Handoff 22 "Squad Lane").
+
+  - **agentflow (headless):** the `EvalSet` artifact (`eval:*@semver`, assertions ONLY regex/contains/schema —
+    never code) + `runEvalSet(evalSet, wf)` which runs every case through the deterministic `simulate` engine
+    and scores the assertion pass-rate. A new `finalOutput(state)` recovers the run's merged output from the
+    `end` trail entry (SimulationState is parity-pinned, so it carries no output field) — one tested owner of
+    that parsing; a blocked run yields `undefined` and fails the case honestly. Same fixtures 10× → identical
+    report.
+  - **adapters-bpmn:** `evalSetAdapter(evalSets)` surfaces EvalSets in the Biblioteca (type `AVALIAÇÃO`, TOOL
+    mold) and `evalPromotionGate(wf, evalSet)` blocks promotion to active below `promotionThreshold` — a
+    `RuleVerdict` in the SAME shape as `agentPromotionGate` (reusing the evaluateGates/PromotionRule path, not
+    a new mechanism), with `EVAL_BELOW_THRESHOLD` as the stable token in the reason. An eval with no assertions
+    never blocks (honest degradation).
+  - **react:** the `PromptProvider` interface (`resolve`/`save`, mirroring `ToolProvider`) + `createPromptProvider`,
+    injected as an optional `AgentStudio` prop. The Intelligence tab gains the prototype-05 **coverage validator**
+    (transparent textarea over a highlight backdrop of `{{var}}` spans + a coverage bar) — the prompt TEXT is
+    resolved through the provider (the body lives in the Library btv:prompt artifact, NEVER on the AgentWorkflow),
+    edits persist via `save`, and it degrades honestly (no provider → absent; unresolvable ref → declared warning;
+    no `save` → read-only). Reduced-motion respected on the coverage bar.
+  - Positive + negative + determinism vectors for `runEvalSet`/`finalOutput`; the four-case promotion-gate
+    pattern for `evalPromotionGate`; adapter list/get/reject; coverage-validator render + degradation + "edits
+    hit the artifact, not the workflow". i18n EN+PT_BR; independence/structuralShape/corpus untouched.
+
+- febc376: SL-9 — Squad Studio (Handoff 22 "Squad Lane"), the a11y-heavy piece (§10.9). A `SquadManifest`
+  rendered as a STANDARD BPMN diagram over the EXISTING editor — no new canvas, no fork.
+
+  - `buildSquadDiagram(manifest)` — the DETERMINISTIC projection of the manifest (the source of truth,
+    D5) into a `BpmnDiagram`: a pool with one lane per role (orchestrator + members, plus a `humano`
+    lane only when an edge references it), an `agentTask` per lane carrying `agentWorkflowRef`/`personaRef`,
+    and one edge per drawable squad relation with the kind as `edge.type`. A `*` broadcast fans out to
+    every non-human member; edges to unknown roles are dropped rather than inventing a lane. Same manifest
+    → byte-identical diagram.
+  - `SquadStudio` — instantiates `BpmnDesigner` with the squad plugin; zoom/pan/keyboard-navigation/inspection
+    are the editor's, reused. The diagram is READ-ONLY on purpose: a projection with no write-back must not
+    accept mutation gestures (drag/connect/delete), or an edit would vanish on the next projection — silent
+    loss, which the doctrine forbids. Read-only keeps every inspection affordance alive (perspective toggle,
+    legend, roving keyboard focus over nodes/edges that drives the announce, governance tab). Squad editing
+    happens via the manifest UI; the full manifest↔diagram round-trip (edits mapped back to manifest commands)
+    is a registered pendência, not SL-9. Chrome mounts INSIDE the editor providers so it reads the same store:
+    an Estrutura↔Colaboração toggle that flips only the new `viewMode` store key, a keyboard-navigable legend,
+    a manifest + context-contract summary panel, and a coordinated-promotion warning driven by an OPTIONAL
+    host-injected `staleMembers` (absent → no warning; degradable).
+  - `validateSquad` (agentflow) gains `SQUAD_EDGE_ROLE_UNKNOWN` (error): an edge whose `from`/`to` is not a
+    known role (`orch`, a declared member role, `humano`, or `*` as a broadcast source). This is the SAME
+    known-role set the projection treats as drawable, so an edge the diagram silently omits is exactly an edge
+    this check flags — the omission is never mute (the user sees it in the Problems Panel). Positive + negative
+    - remediation vectors added.
+  - `createSquadPlugin` / `SQUAD_EDGE_STYLES` / `SQUAD_EDGE_GLYPH` — the six collaboration edges are
+    distinguishable WITHOUT color (distinct marker + dash + glyph + localized label). `EdgeStyle` gains an
+    additive `collaboration` override that only thickens the stroke in the Colaboração view (DMN/escalation
+    edges unaffected). The plugin also registers the Wave-3 (O3) Memória/Governança inspector tab for a
+    squad member (role, persona, autonomy, downstream-gate need, and the member's context keys).
+  - New canvas-store `viewMode` (`estrutura`/`colaboracao`, default `estrutura`) — a pure renderer switch,
+    read by `EdgeRenderer` to apply the collaboration override. Focusing a squad edge announces
+    kind + from → to in an `aria-live` region.
+  - Tests: the projection (determinism, lanes, broadcast fan-out, unknown-role drop, humano lane) and the
+    Studio (canvas render, toggle preserves selection, six-edge legend, edge announce, stale-member warning,
+    and a zero-serious/critical axe gate). i18n EN + PT-BR; both new surfaces added to the hardcoded-string
+    cerca.
+
+- 031c379: Handoff 16 E-5 — EVT*\*/TIMER*\* lint, headless ISO 8601 parser and the timer
+  editor (spec §3d, with the E-0 amendment). core: `parseTimerExpression`
+  (date / duration / cycle — total, never throws; `P1M` is one MONTH, `PT1M`
+  one MINUTE) returning a STRUCTURED result, plus the canonical
+  `properties.timer = { kind, expression }` exported as the standard OMG
+  `timeDate`/`timeDuration`/`timeCycle` child of the `timerEventDefinition` —
+  ONLY on timer events (on any other node the property stays an ordinary
+  `bpmnr:property`, never an orphan OMG child); byte-stable round-trip, absent
+  field keeps prior exports byte-identical. lint: new rules in the shipped
+  profiles (now 1.1.0 — a new promotable policy version): `EVT_START_THROW`,
+  `EVT_END_CATCH`, `EVT_ERROR_START_TOPLEVEL` (etiquette; same containment
+  predicate as the editor's Execução matrix) and `EVT_REF_MISSING` (warning,
+  with a KIND-AWARE mechanical quick-fix: one composite creating a definition
+  of the event's own kind and referencing it) + `TIMER_MALFORMED` (error via
+  the parser; no mechanical fix — guessing intent is not mechanical). react:
+  `TimerSection` — kind select, ISO 8601 expression and a HUMAN i18n preview
+  built from the parser's structured result; an invalid expression shows ONLY
+  the glyph+text notice (never a guessed preview) and an empty expression
+  removes the property entirely.
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [2d65a69]
+- Updated dependencies [81e4756]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [3d7be05]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [b204522]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [fcaaa8f]
+- Updated dependencies [56fe142]
+- Updated dependencies [c8223c9]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [98b285e]
+- Updated dependencies [7f73b05]
+- Updated dependencies [dc29b38]
+- Updated dependencies [5de2c92]
+- Updated dependencies [9a715ec]
+- Updated dependencies [b9d565e]
+- Updated dependencies [88b9f0f]
+- Updated dependencies [fdc42b9]
+- Updated dependencies [febc376]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+  - @buildtovalue/simulation@1.1.0-next.0
+  - @buildtovalue/lint@1.2.0-next.0
+  - @buildtovalue/identity@1.1.0-next.0
+  - @buildtovalue/agentflow@1.1.0-next.0
+  - @buildtovalue/copilot@1.1.0-next.0
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/react/package.json b/packages/react/package.json
index bcb67ba..0bdbd64 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/react",
-  "version": "1.1.0",
+  "version": "1.2.0-next.0",
   "description": "React layer for bpmn-react: native SVG canvas, shapes, gestures, palette, inspector, minimap and diff view. Zero runtime dependencies (react/react-dom as peers).",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/registry/CHANGELOG.md b/packages/registry/CHANGELOG.md
index 6674efe..c7fb42f 100644
--- a/packages/registry/CHANGELOG.md
+++ b/packages/registry/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @buildtovalue/registry
 
+## 1.0.2-next.0
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/registry/package.json b/packages/registry/package.json
index 08db69b..3b15632 100644
--- a/packages/registry/package.json
+++ b/packages/registry/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/registry",
-  "version": "1.0.1",
+  "version": "1.0.2-next.0",
   "description": "Headless version governance for bpmn-react: a queryable registry of diagram versions with temporal validity, publication channels/environments, dual changelog and execution pinning (run-binding). Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/simulation/CHANGELOG.md b/packages/simulation/CHANGELOG.md
index bfdad7f..a834686 100644
--- a/packages/simulation/CHANGELOG.md
+++ b/packages/simulation/CHANGELOG.md
@@ -1,5 +1,118 @@
 # @buildtovalue/simulation
 
+## 1.1.0-next.0
+
+### Minor Changes
+
+- 2d65a69: Handoff 19 CO-5 (§6e) — compensation → ledger glue + the read-only planner that
+  completes the OMG trigger family (message/signal/error/escalation/compensation).
+
+  - `@buildtovalue/adapters-bpmn` gains `compensationTriggeredEntry` +
+    `COMPENSATION_TRIGGERED_TYPE`: a PURE builder (the engine stays intact) the
+    host appends when compensation ACTUALLY runs. The entry ties the EXECUTED plan
+    (`compensated` in reverse order + `uncompensated` declared); `details.author`
+    prefixed `ia.copilot@` paints the ✦ AI seal (the `aiAuthorOf` rule). A blocked
+    specific target appends NOTHING (reforço 8).
+  - `@buildtovalue/simulation` exposes `compensationPlan(activityRef?)` — a
+    READ-ONLY computation (reforço 7: it reads the trail/diagram, never mutates)
+    that is the SINGLE source both `compensate()` (record + run) and the host's
+    ledger glue (append the EXECUTED reversal) consume, so the two never
+    re-derive. New exported types `CompensationPlan` / `CompensationStep`.
+  - `@buildtovalue/react` `BpmnSimulator` gains the `onCompensationTriggered`
+    prop (path a — the engine stays pure): the demo/host reads the plan BEFORE
+    firing and appends the ledger entry only when something reversed.
+
+- 3d7be05: Handoff 19 CO-4 (§6d) — compensation in the token simulator (`compensate`).
+
+  - `compensate(activityRef)` runs only that activity's handler; `compensate()`
+    (broadcast) runs every completed compensable activity's handler in REVERSE
+    order and fires the scope's compensation event subprocesses. Which activities
+    are compensable comes from the shared core source (`compensableActivitiesOf`);
+    the handler is resolved from the boundary's association.
+  - Completion is derived from the trail (`'move'`/`'end'`), never a second record
+    type; the loop rule is declared (last completion wins). A completed activity
+    with no handler is a declared trail line; a specific non-compensable/incomplete
+    target is a declared stop; `waitForCompletion` is declared in the trail.
+  - Compensation has no ref-matching, so the ES-5 tier precedence does not apply —
+    broadcast fires boundary handlers and esub-starts together; a specific target
+    never fires an esub-start (reforço 9).
+  - New `Decision` variant `compensate` (anchored to `atStep`), serializable and
+    replayed bit-for-bit; existing E-6/ES-5/EC-5 scenarios replay unchanged.
+  - The react `SimulationPanel` gains the «Compensate» card — broadcast (default)
+    shows the reversal COUNT (reforço 10), each compensable activity is fireable
+    when completed else listed not-eligible with a reason.
+
+- b204522: Handoff 18 §5e — escalation throws in the token simulator (`throwEscalation`),
+  completing the OMG trigger family. The candidate topology is enumerated by the
+  SAME shared core source as the lint (`eligibleEscalationCatches`, no fork); the
+  simulator builds the scoped, tiered resolution on top — the identical total
+  order and ambiguity rule as `throwError` (`especificidade > escopo > catch-all`;
+
+  > 1 in the winning tier is a `BlockedDecision`).
+
+  Two things differ, both declared: the personality is NON-INTERRUPTING (a
+  non-interrupting catch leaves the host token in place and re-emerges a parallel
+  token at the catch — the host continues), and NO eligible catch = the escalation
+  DISSOLVES (a declared no-op in the trail, the host token continues), the binding
+  contrast with an uncaught error's stop.
+
+  New public types `EscalationDestination` / `EscalationThrowOption` and the
+  `escalationThrowOptions` state; the react `SimulationPanel` gains the «Escalate»
+  card, which predicts each option's destination + mode as glyph + text before the
+  throw (informed decision). `BpmnSimulator` gains an `onEscalationThrown` callback
+  (the engine stays pure) so the host maps a fired escalation to a ledger entry
+  (`escalationRaisedEntry` — the escalation actually happened).
+
+- fcaaa8f: Simulação do event subprocess (Handoff 17 ES-5, painel 4e): candidatos de
+  `throwError`/`throwSignal`/`throwMessage` passam a incluir os starts tipados
+  dos event subprocesses do escopo do token (elegibilidade via os helpers
+  fonte-única `isEventSubprocess`/`startIsInterrupting`); precedência do erro em
+  ordem TOTAL declarada (esub-exato > boundary-exato > esub-catch-all >
+  boundary-catch-all; >1 no tier vencedor = `BlockedDecision` nomeando
+  candidatos); token no CONTÊINER com descida declarada não-simulada;
+  interrupção nomeada na trilha (contagem de tokens cancelados + escopo, uma
+  vez por throw — os tokens recém-colocados pelo mesmo throw sobrevivem);
+  timer/conditional NUNCA auto-dispara — card manual novo
+  (`eventSubprocessOptions`/`fireEventSubprocess`, decisão `eventSubprocess`
+  ancorada em `atStep` para replay bit a bit); compat E-6: cenários sem event
+  subprocess replayam com trilha byte-idêntica. React: card manual no
+  `SimulationPanel` com o modo declarado (glifo+texto) e i18n EN/PT-BR;
+  limitations.md atualizado no mesmo PR.
+- c8223c9: Handoff 16 E-6 — honest event matching in the simulator (spec §3e, S-FEEL
+  discipline: exact where possible, a DECLARED stop everywhere else, never a
+  guessed route). simulation: `throwError(host, errorRef?)` — the user throws
+  the ERROR (named definition or uncatalogued), the ENGINE resolves the boundary
+  by matching: a specific `errorRef` match beats the DECLARED catch-all
+  (documented precedence — both present is NOT ambiguity); two eligible
+  specifics, two catch-alls, or an uncaught error are `BlockedDecision` stops
+  naming node, reason and candidates. `throwSignal` broadcasts to every waiting
+  matching catch; `throwMessage` delivers to a single destination — more than
+  one waiting candidate is a declared stop (runtime correlation is not
+  simulable; documented in limitations.md). All three are new serializable
+  `Decision` kinds that replay through the SAME matching; `fireBoundary` and
+  old scenarios stay intact, and error boundaries leave the manual
+  `boundaryOptions` list for the new `errorThrowOptions` cards. react: the
+  SimulationPanel renders the inverted "Throw error" card (per-definition
+  buttons + the "uncatalogued error" path that exercises the catch-all).
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/simulation/package.json b/packages/simulation/package.json
index b83b36f..046c432 100644
--- a/packages/simulation/package.json
+++ b/packages/simulation/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/simulation",
-  "version": "1.0.1",
+  "version": "1.1.0-next.0",
   "description": "Headless BPMN token-simulation engine for bpmn-react: XOR/AND/event-based semantics, boundary events, approximate OR, structural path coverage and replayable scenarios. Consumes only @buildtovalue/core. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/soundness/CHANGELOG.md b/packages/soundness/CHANGELOG.md
index 0da569e..ab79ff0 100644
--- a/packages/soundness/CHANGELOG.md
+++ b/packages/soundness/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @buildtovalue/soundness
 
+## 1.0.2-next.0
+
+### Patch Changes
+
+- Updated dependencies [0627ee6]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [6d7f410]
+- Updated dependencies [56fe142]
+- Updated dependencies [40d6efd]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [dc29b38]
+- Updated dependencies [031c379]
+  - @buildtovalue/core@1.2.0-next.0
+
 ## 1.0.1
 
 ### Patch Changes
diff --git a/packages/soundness/package.json b/packages/soundness/package.json
index c95e997..4431e33 100644
--- a/packages/soundness/package.json
+++ b/packages/soundness/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/soundness",
-  "version": "1.0.1",
+  "version": "1.0.2-next.0",
   "description": "Structural soundness analysis for bpmn-react: deadlock/livelock/dead-branch detection over the process graph (O(V+E), no state-space search), delivered as plugin-compatible validation rules. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "type": "module",
diff --git a/packages/studio/CHANGELOG.md b/packages/studio/CHANGELOG.md
index 32aa3c1..d52a7f8 100644
--- a/packages/studio/CHANGELOG.md
+++ b/packages/studio/CHANGELOG.md
@@ -1,5 +1,105 @@
 # @buildtovalue/studio
 
+## 1.2.0-next.0
+
+### Minor Changes
+
+- 47d0de8: Handoff 15 V-6 — request-changes cycle (spec §2e). `VersionStatus` grows the
+  additive `in-review` (EM REVISÃO ⟲) state: entered only by request-changes
+  (candidate → in-review) and left only by re-submission (→ candidate), both
+  through the core state machine; the status round-trips in XML via
+  `bpmnr:version` like every other. `identity` adds
+  `buildChangeRequestPayload` (+`CanonicalChangeRequestPayload`): the signed
+  request binds versionRef + attached open threadRefs + the mandatory
+  justification, verified by the unchanged `verifySignature`. `react` adds
+  `buildChangeRequestPayloadFor`, the ⟲ gold seal (StatusBadge/VersionTimeline/
+  i18n `status.in-review`) and scopes `reviewThreadsRule` to `target: 'active'`
+  only — request-changes passes with open threads by design. `adapters-bpmn`
+  adds `reviewChangesRequestedEntry` (+`REVIEW_CHANGES_REQUESTED` type) and maps
+  `in-review` → `candidate` for the Biblioteca (documented loss) with the ⟲
+  seal surviving in the gallery meta. `studio` adds `requestChanges` (the
+  default soft path — `rejectPromotion` stays as the documented hard reject),
+  the signed "Pedir mudanças…" flow in the ReviewScreen, the
+  `review.changes.requested` N-3 bridge (`onReviewEvent`) and the re-submission
+  diff that opens against the version that requested changes (v-pedido →
+  v-nova) via registry lineage.
+- b4557cd: SL-11 — EvidenceBundle as a canonical audit entry + ExecutionStore + LedgerExplorer renderer
+  (Handoff 22 "Squad Lane").
+
+  - `EvidenceBundle` (adapters-bpmn) — a neutral, serializable evidence record for one squad run, the
+    squad analog of a simulation `Session`. It wraps the masked fact trail from `simulateSquad` (agentflow,
+    which never imports audit/core) and REQUIRES the three governance refs: `policyRefs`,
+    `decisionRuleRefs`, `maskingPolicyRef` (acceptance §10.4). `buildEvidenceBundle` REFUSES (throws) a bundle
+    whose masked trail names no masking policy — masked evidence with no named policy is not attributable.
+    It reuses core's integrity primitives (`canonicalJsonExact` + `sha256Hex`), never a bespoke format:
+    `canonicalEvidenceBundle` exports byte-identical canonical JSON and `hashEvidenceBundle` hashes it
+    deterministically (2× identical).
+  - `evidenceBundleEntry` maps a bundle to an `AuditEntryInput`. Appended through the normal
+    `AuditLedger.append()`, the entry is hashed whole by core's v2 `computeEntryHash`, so the ledger's own
+    `verify()` — and `@buildtovalue/audit`'s `verifyLedger`, which recomputes the identical hash — validate it
+    with NO evidence-specific code. Tampering with a recorded ref breaks the chain (proven). `evidenceBundleOf`
+    reconstructs the bundle from the chain (the chain IS the store).
+  - `ExecutionStore` (born here) — the injected, DEGRADABLE seam where a host persists evidence bundles: a
+    consumer given `undefined` simply does not persist (the run still produces its bundle).
+    `createInMemoryExecutionStore` is the default (records + lists newest-first) for tests/demos; a real host
+    swaps durable storage without this package importing one.
+  - LedgerExplorer (studio) — a dedicated `evidence` category chip + a governance-refs detail section that
+    surfaces the mandatory masking policy / policies / decision rules + the masked fact count, with a canonical
+    evidence-bundle download. The section only renders when the masking policy is present (never unattributed
+    evidence). i18n EN + PT-BR (react studio fragment).
+  - Vectors: mandatory-refs enforcement, canonical + hash determinism, ledger verify (+ tamper detection),
+    chain round-trip, ExecutionStore degradability, and the renderer. apiSurface (adapters-bpmn) + typedoc updated.
+
+### Patch Changes
+
+- Updated dependencies [c4f2cbb]
+- Updated dependencies [0627ee6]
+- Updated dependencies [2d65a69]
+- Updated dependencies [a99b6f9]
+- Updated dependencies [3d7be05]
+- Updated dependencies [c4ad4fe]
+- Updated dependencies [db362a2]
+- Updated dependencies [a127e70]
+- Updated dependencies [cbe56a7]
+- Updated dependencies [b9b625a]
+- Updated dependencies [febfdb1]
+- Updated dependencies [b204522]
+- Updated dependencies [a3058f3]
+- Updated dependencies [e04c719]
+- Updated dependencies [2dc3518]
+- Updated dependencies [00b17de]
+- Updated dependencies [6d7f410]
+- Updated dependencies [f034a2a]
+- Updated dependencies [fcaaa8f]
+- Updated dependencies [56fe142]
+- Updated dependencies [5215bae]
+- Updated dependencies [c8223c9]
+- Updated dependencies [40d6efd]
+- Updated dependencies [6dbc87a]
+- Updated dependencies [8825d62]
+- Updated dependencies [24c4684]
+- Updated dependencies [47d0de8]
+- Updated dependencies [c944070]
+- Updated dependencies [b4557cd]
+- Updated dependencies [dc29b38]
+- Updated dependencies [d8d3269]
+- Updated dependencies [627dbea]
+- Updated dependencies [b9d565e]
+- Updated dependencies [a8b3dda]
+- Updated dependencies [88b9f0f]
+- Updated dependencies [febc376]
+- Updated dependencies [031c379]
+  - @buildtovalue/react@1.2.0-next.0
+  - @buildtovalue/core@1.2.0-next.0
+  - @buildtovalue/conformance@1.2.0-next.0
+  - @buildtovalue/adapters-bpmn@1.2.0-next.0
+  - @buildtovalue/library-react@1.1.0-next.0
+  - @buildtovalue/identity@1.1.0-next.0
+  - @buildtovalue/copilot@1.1.0-next.0
+  - @buildtovalue/audit@1.1.1-next.0
+  - @buildtovalue/registry@1.0.2-next.0
+  - @buildtovalue/soundness@1.0.2-next.0
+
 ## 1.1.0
 
 ### Minor Changes
diff --git a/packages/studio/package.json b/packages/studio/package.json
index 68301a7..e15307c 100644
--- a/packages/studio/package.json
+++ b/packages/studio/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@buildtovalue/studio",
-  "version": "1.1.0",
+  "version": "1.2.0-next.0",
   "description": "BuildToValue Studio (Handoff 6 S-4): the application layer for the no-screen personas — shell with hash navigation (no external router), the generic Biblioteca screen and the Revisão do Aprovador (engine-derived queue, real verification calls, immutable ledger decisions; approving never activates). Zero runtime dependencies beyond @buildtovalue/*.",
   "license": "Apache-2.0",
   "type": "module",