From 205f046f17bb0e41e3cb48554c2ccf6f31a69b5a Mon Sep 17 00:00:00 2001
From: systemfsoftware-maker <ryan@younna.com>
Date: Wed, 7 Oct 2026 23:43:26 +0000
Subject: [PATCH 1/2] build(release): call the reusable release workflow with
 the inputs and permissions it now requires

Every Release run since 65155c73 is startup_failure: the caller passed tools-ref, which the reusable no longer declares, omitted the required ci-workflow input, and granted no actions: write. The reusable runs version-management and github-release-management from this repo's dev shell, which did not provide them, and bump reads the root package.json version, which was absent (VersionIntentMalformed: path=package.json). The root takes 0.0.0: it is private, outside pnpm-workspace.yaml packages, never packed into workspace-tarballs, and the changesets strategy only reads it

Verdict-Semantics: unchanged
---
 .github/workflows/ci.yml      |  1 +
 .github/workflows/release.yml | 19 +++++++++++--------
 flake.nix                     |  3 +++
 package.json                  |  3 ++-
 4 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8283d27ad..21ce2622e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 82fa4cdec..fb6e5270f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,12 +1,14 @@
 # The release flow is the single definition in
 # systemfsoftware/pnpm-release-management/.github/workflows/release.yml. This
-# caller only supplies the trigger and the permissions; the reusable derives
-# the phase from repository state, opens the version PR, and on a push that
-# leaves untagged versions it tags each one and cuts its GitHub Release. tools-ref
-# pins the toolchain revision — a back-edge to the shared tools, consumed per the
-# documented contract. There is no npm publish: distribution is this repo's Nix
-# flake outputs consumed from a git ref, and the <pkg>@vX.Y.Z git tag is the
-# durable record that a version shipped
+# caller only supplies the trigger, the permissions every reusable job asks for,
+# and the CI workflow the reusable dispatches on the release PR branch (a PR the
+# workflow token opens starts no workflows on its own). The reusable derives the
+# phase from repository state, opens the version PR, and on a push that leaves
+# untagged versions it tags each one and cuts its GitHub Release. It runs the
+# release tools from this repo's dev shell, so flake.lock's
+# pnpm-release-management input pins their revision. There is no npm publish:
+# distribution is this repo's Nix flake outputs consumed from a git ref, and the
+# <pkg>@vX.Y.Z git tag is the durable record that a version shipped
 name: Release
 
 on:
@@ -14,6 +16,7 @@ on:
     branches: [main]
 
 permissions:
+  actions: write
   contents: write
   pull-requests: write
 
@@ -21,4 +24,4 @@ jobs:
   release:
     uses: systemfsoftware/pnpm-release-management/.github/workflows/release.yml@main
     with:
-      tools-ref: main
+      ci-workflow: ci.yml
diff --git a/flake.nix b/flake.nix
index e9d57f1e0..b458e5c74 100644
--- a/flake.nix
+++ b/flake.nix
@@ -83,6 +83,9 @@
             pkgs.nodejs_24
             pkgs.deno
             pkgs.process-compose
+            # version-management and github-release-management, which the
+            # reusable release workflow runs through `nix develop --command`
+            pnpm-release-management.packages.${pkgs.stdenv.hostPlatform.system}.release-tools
           ];
         };
       });
diff --git a/package.json b/package.json
index eaa43dbff..79610e127 100644
--- a/package.json
+++ b/package.json
@@ -40,5 +40,6 @@
     "typecheck": "turbo --concurrency=${TURBO_CONCURRENCY:-100%} --continue typecheck typecheck:node",
     "typecheck:node": "tsc -p tsconfig.node.json --noEmit"
   },
-  "type": "module"
+  "type": "module",
+  "version": "0.0.0"
 }

From 2e9cc4ff4b0e114a774a19515f74d23464324cc4 Mon Sep 17 00:00:00 2001
From: systemfsoftware-maker <ryan@younna.com>
Date: Wed, 7 Oct 2026 23:44:59 +0000
Subject: [PATCH 2/2] build(release): keep the changelog directory
 version-management writes into

version-management bump writes each moved member's section to release.jsonc changelogDir (.changeset/changelogs) without creating it, and #196 left that directory empty, so git dropped it and bump failed with ChangelogUnwritable ... NotFound. The guard only reads *.md there

Verdict-Semantics: unchanged
---
 .changeset/changelogs/.gitkeep | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 .changeset/changelogs/.gitkeep

diff --git a/.changeset/changelogs/.gitkeep b/.changeset/changelogs/.gitkeep
new file mode 100644
index 000000000..e69de29bb