From 31f1e75fd5c457e20ef7cf4c0e4e8b362856ce4d Mon Sep 17 00:00:00 2001
From: Wess Cope <apple@wess.io>
Date: Thu, 22 Oct 2026 12:55:41 -0400
Subject: [PATCH 1/4] Preserve native credential stores across dependency
 upgrades

Use current platform providers directly so Linux retains kernel keyutils and its existing keyring-rs entry identity. Keep macOS login Keychain and Windows Credential Manager without changing process-wide store defaults or migrating credentials.

Add Linux compatibility and Windows store checks alongside the desktop workspace gate. Advance the desktop workspace to 0.1.2 and coordinate the repository libraries at 0.4.5.
---
 .github/workflows/ci.yml                   |  19 +++
 CLEANUP_TODO.md                            |  17 +-
 desktop/Cargo.lock                         | 190 +++++----------------
 desktop/Cargo.toml                         |   4 +-
 desktop/crates/store/Cargo.toml            |  11 +-
 desktop/crates/store/src/keychain.rs       |  11 +-
 desktop/crates/store/src/keychain/store.rs |  38 +++++
 desktop/crates/store/tests/keychain.rs     |  31 ++++
 desktop/docs/architecture.md               |   6 +
 package.json                               |   2 +-
 web/AGENTS.md                              |   2 +-
 web/CLAUDE.md                              |   2 +-
 web/README.md                              |   6 +-
 web/docs/agents.md                         |   2 +-
 web/package.json                           |   2 +-
 web/packages/cli/AGENTS.md                 |   4 +-
 web/packages/cli/modules/catalog.json      |   2 +-
 web/packages/cli/test/init.test.ts         |  14 +-
 web/templates/admin/package.json           |  14 +-
 web/templates/ai/package.json              |  14 +-
 web/templates/api/package.json             |  12 +-
 web/templates/cms/package.json             |  20 +--
 web/templates/edge/package.json            |  10 +-
 web/templates/fullstack/package.json       |  12 +-
 web/templates/minimal/package.json         |   8 +-
 web/templates/realtime/package.json        |   8 +-
 web/templates/socialnetwork/package.json   |  18 +-
 web/templates/worker/package.json          |  10 +-
 28 files changed, 245 insertions(+), 244 deletions(-)
 create mode 100644 desktop/crates/store/src/keychain/store.rs
 create mode 100644 desktop/crates/store/tests/keychain.rs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8eee9b7..318b32c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,6 +13,25 @@ permissions:
   contents: read
 
 jobs:
+  store:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          workspaces: desktop
+      - run: cargo test -p atlas-store --locked
+
   web:
     runs-on: ubuntu-latest
     timeout-minutes: 15
diff --git a/CLEANUP_TODO.md b/CLEANUP_TODO.md
index 80818f5..992de70 100644
--- a/CLEANUP_TODO.md
+++ b/CLEANUP_TODO.md
@@ -18,14 +18,17 @@ original dependency declarations; it is not a claim about deployed versions.
 
 ## Current validation and release status
 
-The modular **0.4.3 release is published** with all 22 library artifacts and its
-integrity catalog. All 11 direct applications have been migrated in their local
-working trees to GitHub release URLs and canonical imports after isolated
-0.4.3 installs, typechecks, audits, CLI checks, and application tests passed.
+The modular **0.4.4 release is published** with all 22 library artifacts and its
+integrity catalog. All 11 direct applications use it in their local working trees,
+with frozen GitHub installs, typechecks, and the shipped CLI guard passing.
+Isolated 0.4.3 application suites passed; 0.4.4 changes dependency closure and the
+CLI guard, with a new isolated production UI render gate. Inkling's actual 0.4.4
+PostgreSQL suite also passes all 397 cases.
 Original files and lockfiles are retained in the private migration backup recorded
-by the local migration receipt. The 0.4.4 candidate adds explicit required external
-peers for production UI installs and excludes hidden checkouts from source checks;
-it must pass release verification before applications advance to it.
+by the local migration receipt. The 0.4.5 candidate preserves native credential
+backends and Linux entry names after the keyring upgrade. Old/new macOS credential
+interoperability passed with a disposable test entry; Linux and Windows checks
+must pass before this candidate is released or native clients advance to it.
 Distribution stays in `wess/atlas`; no npm token or local Atlas checkout is required.
 Production has only been inspected read-only; no application deployment has changed.
 
diff --git a/desktop/Cargo.lock b/desktop/Cargo.lock
index a856922..fedeafc 100644
--- a/desktop/Cargo.lock
+++ b/desktop/Cargo.lock
@@ -15,22 +15,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
- "cipher 0.4.4",
+ "cipher",
  "cpufeatures 0.2.17",
  "zeroize",
 ]
 
-[[package]]
-name = "aes"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
-dependencies = [
- "cipher 0.5.2",
- "cpubits",
- "cpufeatures 0.3.1",
-]
-
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -442,7 +431,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-bridge"
-version = "0.1.1"
+version = "0.1.2"
 dependencies = [
  "futures",
  "gpui",
@@ -451,11 +440,11 @@ dependencies = [
 
 [[package]]
 name = "atlas-build"
-version = "0.1.1"
+version = "0.1.2"
 
 [[package]]
 name = "atlas-core"
-version = "0.1.1"
+version = "0.1.2"
 dependencies = [
  "chrono",
  "uuid",
@@ -463,7 +452,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-desktop"
-version = "0.1.1"
+version = "0.1.2"
 dependencies = [
  "atlas-bridge",
  "atlas-core",
@@ -475,7 +464,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-shell"
-version = "0.1.1"
+version = "0.1.2"
 dependencies = [
  "gpui",
  "guise-ui",
@@ -483,14 +472,17 @@ dependencies = [
 
 [[package]]
 name = "atlas-store"
-version = "0.1.1"
+version = "0.1.2"
 dependencies = [
+ "apple-native-keyring-store",
  "dirs 7.0.0",
- "keyring",
+ "keyring-core",
+ "linux-keyutils-keyring-store",
  "serde",
  "serde_json",
  "tempfile",
  "tracing",
+ "windows-native-keyring-store",
 ]
 
 [[package]]
@@ -713,15 +705,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-padding"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "710f1dd022ef4e93f8a438b4ba958de7f64308434fa6a87104481645cc30068b"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "block2"
 version = "0.6.2"
@@ -836,16 +819,7 @@ version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
 dependencies = [
- "cipher 0.4.4",
-]
-
-[[package]]
-name = "cbc"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896"
-dependencies = [
- "cipher 0.5.2",
+ "cipher",
 ]
 
 [[package]]
@@ -940,20 +914,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
- "inout 0.1.4",
+ "inout",
  "zeroize",
 ]
 
-[[package]]
-name = "cipher"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
-dependencies = [
- "crypto-common 0.2.2",
- "inout 0.2.5",
-]
-
 [[package]]
 name = "clang-sys"
 version = "1.9.1"
@@ -965,12 +929,6 @@ dependencies = [
  "libloading",
 ]
 
-[[package]]
-name = "cmov"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
-
 [[package]]
 name = "cocoa"
 version = "0.25.0"
@@ -1281,12 +1239,6 @@ dependencies = [
  "unicode-segmentation",
 ]
 
-[[package]]
-name = "cpubits"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
-
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1390,15 +1342,6 @@ version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2931af7e13dc045d8e9d26afccc6fa115d64e115c9c84b1166288b46f6782c2"
 
-[[package]]
-name = "ctutils"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
-dependencies = [
- "cmov",
-]
-
 [[package]]
 name = "data-url"
 version = "0.3.2"
@@ -1444,7 +1387,6 @@ dependencies = [
  "block-buffer 0.12.1",
  "const-oid",
  "crypto-common 0.2.2",
- "ctutils",
 ]
 
 [[package]]
@@ -2611,16 +2553,7 @@ version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
- "hmac 0.12.1",
-]
-
-[[package]]
-name = "hkdf"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
-dependencies = [
- "hmac 0.13.0",
+ "hmac",
 ]
 
 [[package]]
@@ -2632,15 +2565,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "hmac"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
-dependencies = [
- "digest 0.11.3",
-]
-
 [[package]]
 name = "home"
 version = "0.5.12"
@@ -2948,20 +2872,10 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "block-padding 0.3.3",
+ "block-padding",
  "generic-array",
 ]
 
-[[package]]
-name = "inout"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b5cf4372d022092674a83b8febf5865f7a573cc0c5baec5e49c879b6a20978f"
-dependencies = [
- "block-padding 0.4.2",
- "hybrid-array",
-]
-
 [[package]]
 name = "instant"
 version = "0.1.13"
@@ -3073,18 +2987,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "keyring"
-version = "4.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2270074a3d26bcac93c1dc5d2845eb4c089e8d761ccf6e0ea266a16004640627"
-dependencies = [
- "apple-native-keyring-store",
- "keyring-core",
- "windows-native-keyring-store",
- "zbus-secret-service-keyring-store",
-]
-
 [[package]]
 name = "keyring-core"
 version = "1.0.1"
@@ -3195,6 +3097,26 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "linux-keyutils"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83270a18e9f90d0707c41e9f35efada77b64c0e6f3f1810e71c8368a864d5590"
+dependencies = [
+ "bitflags 2.13.2",
+ "libc",
+]
+
+[[package]]
+name = "linux-keyutils-keyring-store"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39fbed79f71dc21eb21d3d07c0e908a3c58ff9a1fdbf5cf44230fb3deb6d994b"
+dependencies = [
+ "keyring-core",
+ "linux-keyutils",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.15"
@@ -3815,21 +3737,21 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3299dd401feaf1d45afd8fd1c0586f10fcfb22f244bb9afa942cec73503b89d"
 dependencies = [
- "aes 0.8.4",
+ "aes",
  "ashpd 0.12.3",
  "async-fs",
  "async-io",
  "async-lock",
  "blocking",
- "cbc 0.1.2",
- "cipher 0.4.4",
+ "cbc",
+ "cipher",
  "digest 0.10.7",
  "endi",
  "futures-lite 2.6.1",
  "futures-util",
  "getrandom 0.3.4",
- "hkdf 0.12.4",
- "hmac 0.12.1",
+ "hkdf",
+ "hmac",
  "md-5",
  "num",
  "num-bigint-dig",
@@ -3943,7 +3865,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
 dependencies = [
  "digest 0.10.7",
- "hmac 0.12.1",
+ "hmac",
 ]
 
 [[package]]
@@ -4904,25 +4826,6 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 
-[[package]]
-name = "secret-service"
-version = "5.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5107b24b91445dd2aa449a258a1807b63240942157292354dc5bfdbeb8bc6db8"
-dependencies = [
- "aes 0.9.3",
- "cbc 0.2.1",
- "futures-util",
- "getrandom 0.4.3",
- "hkdf 0.13.0",
- "hybrid-array",
- "num",
- "once_cell",
- "serde",
- "sha2 0.11.1",
- "zbus",
-]
-
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -7205,17 +7108,6 @@ dependencies = [
  "zvariant",
 ]
 
-[[package]]
-name = "zbus-secret-service-keyring-store"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74801d001b9e7729adb4f1825b67b398185fed424749aa3d8bacf70417137d9a"
-dependencies = [
- "keyring-core",
- "secret-service",
- "zbus",
-]
-
 [[package]]
 name = "zbus_macros"
 version = "5.19.0"
diff --git a/desktop/Cargo.toml b/desktop/Cargo.toml
index 57f5313..72e83ee 100644
--- a/desktop/Cargo.toml
+++ b/desktop/Cargo.toml
@@ -13,7 +13,7 @@ members = [
 exclude = ["templates"]
 
 [workspace.package]
-version = "0.1.1"
+version = "0.1.2"
 edition = "2021"
 license = "MIT"
 authors = ["Wess Cope <opensource@wess.io>"]
@@ -41,7 +41,7 @@ chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1", features = ["v4"] }
 dirs = "7.0.0"
 tracing = "0.1"
-keyring = "4.2.0"
+keyring-core = "1.0.1"
 
 # The Atlas crates themselves.
 atlas-core = { version = "0.1.0", path = "crates/core" }
diff --git a/desktop/crates/store/Cargo.toml b/desktop/crates/store/Cargo.toml
index 39af4e7..9f113db 100644
--- a/desktop/crates/store/Cargo.toml
+++ b/desktop/crates/store/Cargo.toml
@@ -15,6 +15,15 @@ path = "src/lib.rs"
 serde = { workspace = true }
 serde_json = { workspace = true }
 dirs = { workspace = true }
-keyring = { workspace = true }
+keyring-core = { workspace = true }
 tracing = { workspace = true }
 tempfile = "3"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+apple-native-keyring-store = { version = "1.0.2", features = ["keychain"] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+linux-keyutils-keyring-store = "1.0.0"
+
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-native-keyring-store = "1.1.0"
diff --git a/desktop/crates/store/src/keychain.rs b/desktop/crates/store/src/keychain.rs
index 2618241..2babd24 100644
--- a/desktop/crates/store/src/keychain.rs
+++ b/desktop/crates/store/src/keychain.rs
@@ -9,13 +9,16 @@
 //! — so every document is written as single-line JSON, and that is asserted
 //! rather than assumed.
 //!
-//! Every operation degrades to `None`/`false` rather than panicking. A machine
-//! with no keychain (a headless Linux box with no secret service running) must
-//! still start the app; it just cannot remember a password.
+//! Every operation degrades to `None`/`false` rather than panicking when the
+//! native store is unavailable. macOS uses the login keychain, Windows uses
+//! Credential Manager, and Linux keeps kernel keyutils and its existing key names.
 
+use keyring_core as keyring;
 use serde::de::DeserializeOwned;
 use serde::Serialize;
 
+mod store;
+
 #[derive(Clone, Debug)]
 pub struct Keychain {
     service: String,
@@ -31,7 +34,7 @@ impl Keychain {
     }
 
     fn entry(&self, key: &str) -> Option<keyring::Entry> {
-        match keyring::Entry::new(&self.service, key) {
+        match store::entry(&self.service, key) {
             Ok(entry) => Some(entry),
             Err(e) => {
                 tracing::warn!("keychain unavailable for {key}: {e}");
diff --git a/desktop/crates/store/src/keychain/store.rs b/desktop/crates/store/src/keychain/store.rs
new file mode 100644
index 0000000..259f7f5
--- /dev/null
+++ b/desktop/crates/store/src/keychain/store.rs
@@ -0,0 +1,38 @@
+use std::sync::{Arc, LazyLock};
+
+use keyring_core::{CredentialStore, Entry, Error, Result};
+
+static STORE: LazyLock<Result<Arc<CredentialStore>>> = LazyLock::new(open);
+
+#[cfg(target_os = "macos")]
+fn open() -> Result<Arc<CredentialStore>> {
+  Ok(apple_native_keyring_store::keychain::Store::new()?)
+}
+
+#[cfg(target_os = "linux")]
+fn open() -> Result<Arc<CredentialStore>> {
+  Ok(linux_keyutils_keyring_store::Store::new()?)
+}
+
+#[cfg(target_os = "windows")]
+fn open() -> Result<Arc<CredentialStore>> {
+  Ok(windows_native_keyring_store::Store::new()?)
+}
+
+#[cfg(not(any(target_os = "macos", target_os = "linux", target_os = "windows")))]
+fn open() -> Result<Arc<CredentialStore>> {
+  Err(Error::NoDefaultStore)
+}
+
+pub(super) fn entry(service: &str, key: &str) -> Result<Entry> {
+  let store = STORE.as_ref().map_err(|_| Error::NoDefaultStore)?;
+  #[cfg(target_os = "linux")]
+  {
+    // keep the v3 kernel-key identity; the new provider defaults to another format
+    let description = format!("keyring-rs:{key}@{service}");
+    let modifiers = std::collections::HashMap::from([("description", description.as_str())]);
+    store.build(service, key, Some(&modifiers))
+  }
+  #[cfg(not(target_os = "linux"))]
+  store.build(service, key, None)
+}
diff --git a/desktop/crates/store/tests/keychain.rs b/desktop/crates/store/tests/keychain.rs
new file mode 100644
index 0000000..6f8470c
--- /dev/null
+++ b/desktop/crates/store/tests/keychain.rs
@@ -0,0 +1,31 @@
+#[cfg(target_os = "linux")]
+#[test]
+fn credentials_keep_the_existing_kernel_key_identity() {
+  use atlasstore::Keychain;
+  use keyring_core::api::CredentialStoreApi;
+  use std::collections::HashMap;
+  use std::time::{SystemTime, UNIX_EPOCH};
+
+  let id = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_nanos();
+  let service = format!("io.wess.atlas.tests.{}.{}", std::process::id(), id);
+  let description = format!("keyring-rs:legacy@{service}");
+  let modifiers = HashMap::from([("description", description.as_str())]);
+  let legacy = linux_keyutils_keyring_store::Store::new()
+    .unwrap()
+    .build(&service, "legacy", Some(&modifiers))
+    .unwrap();
+  legacy.set_password("previous-test-value").unwrap();
+
+  let vault = Keychain::new(&service);
+  let previous = vault.get("legacy");
+  let written = vault.put("legacy", "updated-test-value");
+  let updated = legacy.get_password();
+  vault.delete("legacy");
+  let removed = matches!(legacy.get_password(), Err(keyring_core::Error::NoEntry));
+  let _ = legacy.delete_credential();
+
+  assert_eq!(previous.as_deref(), Some("previous-test-value"));
+  assert!(written);
+  assert_eq!(updated.unwrap(), "updated-test-value");
+  assert!(removed);
+}
diff --git a/desktop/docs/architecture.md b/desktop/docs/architecture.md
index 0a6de03..c8c58ef 100644
--- a/desktop/docs/architecture.md
+++ b/desktop/docs/architecture.md
@@ -102,6 +102,12 @@ Secrets go to the keychain, never into the JSON. The values are written as
 single-line JSON because **the macOS keychain hex-encodes a value containing a
 newline**, which silently corrupts it on read.
 
+The native provider is explicit: macOS login Keychain, Windows Credential Manager,
+and Linux kernel keyutils. Linux retains the existing `keyring-rs:<key>@<service>`
+description when dependencies change. Provider entries are built directly, without
+changing another library's process-wide credential store. No credential migration
+or Secret Service dependency is required.
+
 ## The chrome
 
 `atlas-shell` is everything that draws and is not the product:
diff --git a/package.json b/package.json
index 77e343f..9fd35a0 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@wess/atlas",
   "private": true,
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Composable Bun/TypeScript packages for building APIs, full-stack apps, and CLI tools",
   "license": "MIT",
   "repository": {
diff --git a/web/AGENTS.md b/web/AGENTS.md
index 3e5e002..97688d7 100644
--- a/web/AGENTS.md
+++ b/web/AGENTS.md
@@ -6,7 +6,7 @@ Composable, functional Bun/TypeScript building blocks. No classes, no mutation,
 
 Consumers import public `@wess/atlas/<module>` entry points. The modular release
 uses a thin facade and separately distributed implementation libraries. After the
-release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server db/postgres db/query`
+release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server db/postgres db/query`
 to record only selected modules and their dependencies. See README.md for release
 status and installation commands. Do not configure aliases into node_modules or
 require a neighboring Atlas checkout.
diff --git a/web/CLAUDE.md b/web/CLAUDE.md
index 198f0f8..12ba625 100644
--- a/web/CLAUDE.md
+++ b/web/CLAUDE.md
@@ -6,7 +6,7 @@ Composable, functional Bun/TypeScript building blocks. No classes, no mutation,
 
 Consumers import public `@wess/atlas/<module>` entry points. The modular release
 uses a thin facade and separately distributed implementation libraries. After the
-release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server db/postgres db/query`
+release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server db/postgres db/query`
 to record only selected modules and their dependencies. See README.md for release
 status and installation commands. Do not configure aliases into node_modules or
 require a neighboring Atlas checkout.
diff --git a/web/README.md b/web/README.md
index a585386..bc0e7b0 100644
--- a/web/README.md
+++ b/web/README.md
@@ -12,11 +12,11 @@ No framework lock-in. No classes. Just functions and immutable data flowing thro
 
 ## Install
 
-Install the coordinated `0.4.4` libraries from this repository's GitHub release
+Install the coordinated `0.4.5` libraries from this repository's GitHub release
 assets. The release workflow verifies all artifacts before making them available.
 
 ```sh
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server config db/query db/postgres
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server config db/query db/postgres
 ```
 
 The installer records exact GitHub release URLs, tested external versions, and the dependency closure for
@@ -89,7 +89,7 @@ Build a user API with authentication in 60 lines.
 ```bash
 mkdir myapp && cd myapp
 bun init -y
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server config db/sqlite db/query migrate auth/flows auth/token
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server config db/sqlite db/query migrate auth/flows auth/token
 ```
 
 The example below uses public `@wess/atlas/<pkg>` exports from the selected libraries.
diff --git a/web/docs/agents.md b/web/docs/agents.md
index 3e64c06..4f2a86a 100644
--- a/web/docs/agents.md
+++ b/web/docs/agents.md
@@ -33,7 +33,7 @@ the document head.
 Select released library modules with the Atlas installer:
 
 ```sh
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas add server config db/postgres db/query
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server config db/postgres db/query
 ```
 
 See README.md for the release candidate's publication status. Import public
diff --git a/web/package.json b/web/package.json
index 2ab6dc3..f8055fe 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@wess/atlas",
   "private": true,
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Composable Bun/TypeScript packages for building APIs, full-stack apps, and CLI tools",
   "license": "MIT",
   "repository": {
diff --git a/web/packages/cli/AGENTS.md b/web/packages/cli/AGENTS.md
index 71e1833..b2415c3 100644
--- a/web/packages/cli/AGENTS.md
+++ b/web/packages/cli/AGENTS.md
@@ -86,7 +86,7 @@ atlas add               # lists available packages
 Check an application's manifests, Bun lockfile, installed Atlas links, source imports,
 and TypeScript aliases. Atlas facade and backing libraries must use the same exact
 stable version. Local paths, legacy aliases, and links outside node_modules fail the check.
-Run `bunx --package https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz atlas check` in application CI after a frozen install.
+Run `bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas check` in application CI after a frozen install.
 
 ### atlas dev
 
@@ -147,7 +147,7 @@ const questions = getQuestionSpec()
 ## Global Installation
 
 ```sh
-bun add -g https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz
+bun add -g https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz
 atlas init
 ```
 
diff --git a/web/packages/cli/modules/catalog.json b/web/packages/cli/modules/catalog.json
index 236d177..5ef8b01 100644
--- a/web/packages/cli/modules/catalog.json
+++ b/web/packages/cli/modules/catalog.json
@@ -1,5 +1,5 @@
 {
-  "version": "0.4.4",
+  "version": "0.4.5",
   "exports": {
     "./admin": {
       "entry": "packages/admin/index.ts",
diff --git a/web/packages/cli/test/init.test.ts b/web/packages/cli/test/init.test.ts
index c98285e..6d9f668 100644
--- a/web/packages/cli/test/init.test.ts
+++ b/web/packages/cli/test/init.test.ts
@@ -72,11 +72,11 @@ test("applyDefaults accepts partial overrides", () => {
 test("generated projects select versioned Atlas libraries", () => {
   const answers = applyDefaults({ template: "custom", features: ["auth", "storage", "admin"] });
   const pkg = JSON.parse(generatePackageJson(answers));
-  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-server"]).toBe(releaseUrl("@wess/atlas-server", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-auth"]).toBe(releaseUrl("@wess/atlas-auth", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-admin"]).toBe(releaseUrl("@wess/atlas-admin", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-storage"]).toBe(releaseUrl("@wess/atlas-storage", "0.4.4"));
+  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.5"));
+  expect(pkg.dependencies["@wess/atlas-server"]).toBe(releaseUrl("@wess/atlas-server", "0.4.5"));
+  expect(pkg.dependencies["@wess/atlas-auth"]).toBe(releaseUrl("@wess/atlas-auth", "0.4.5"));
+  expect(pkg.dependencies["@wess/atlas-admin"]).toBe(releaseUrl("@wess/atlas-admin", "0.4.5"));
+  expect(pkg.dependencies["@wess/atlas-storage"]).toBe(releaseUrl("@wess/atlas-storage", "0.4.5"));
   expect(Object.values(pkg.dependencies).some((value) => /^(file:|link:|workspace:|github:)/.test(String(value)))).toBe(
     false,
   );
@@ -107,8 +107,8 @@ test("frontend scaffolds declare the UI peer dependencies", () => {
   const pkg = JSON.parse(generatePackageJson(applyDefaults({ template: "custom", frontend: true })));
   expect(pkg.dependencies.react).toBeDefined();
   expect(pkg.dependencies["@mantine/core"]).toBeDefined();
-  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.4"));
-  expect(pkg.dependencies["@wess/atlas-ui"]).toBe(releaseUrl("@wess/atlas-ui", "0.4.4"));
+  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.5"));
+  expect(pkg.dependencies["@wess/atlas-ui"]).toBe(releaseUrl("@wess/atlas-ui", "0.4.5"));
   expect(pkg.dependencies["@tanstack/react-table"]).toBeUndefined();
 });
 
diff --git a/web/templates/admin/package.json b/web/templates/admin/package.json
index 9d15976..c05bde2 100644
--- a/web/templates/admin/package.json
+++ b/web/templates/admin/package.json
@@ -11,18 +11,18 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-admin-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-admin-0.4.5.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }
diff --git a/web/templates/ai/package.json b/web/templates/ai/package.json
index bcf23e5..ca8e79b 100644
--- a/web/templates/ai/package.json
+++ b/web/templates/ai/package.json
@@ -10,16 +10,16 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-ai": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-ai-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
+    "@wess/atlas-ai": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-ai-0.4.5.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }
diff --git a/web/templates/api/package.json b/web/templates/api/package.json
index e4bd64e..b30d35d 100644
--- a/web/templates/api/package.json
+++ b/web/templates/api/package.json
@@ -11,16 +11,16 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }
diff --git a/web/templates/cms/package.json b/web/templates/cms/package.json
index e23a142..8f79489 100644
--- a/web/templates/cms/package.json
+++ b/web/templates/cms/package.json
@@ -9,20 +9,20 @@
     "migrate:down": "atlas migrate down"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-admin-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-admin-0.4.5.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-migrate-0.4.4.tgz",
-    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-storage-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-request": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-request-0.4.4.tgz"
+    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-migrate-0.4.5.tgz",
+    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-storage-0.4.5.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
+    "@wess/atlas-request": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-request-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }
diff --git a/web/templates/edge/package.json b/web/templates/edge/package.json
index da047a5..68a8ed2 100644
--- a/web/templates/edge/package.json
+++ b/web/templates/edge/package.json
@@ -9,15 +9,15 @@
     "lint": "bunx biome lint ."
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-edge": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-edge-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
+    "@wess/atlas-edge": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-edge-0.4.5.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }
diff --git a/web/templates/fullstack/package.json b/web/templates/fullstack/package.json
index 7aa2829..418cd95 100644
--- a/web/templates/fullstack/package.json
+++ b/web/templates/fullstack/package.json
@@ -15,11 +15,11 @@
     "@mantine/hooks": "^9.7.3",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-ui": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-ui-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
+    "@wess/atlas-ui": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-ui-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
@@ -27,6 +27,6 @@
     "@types/react-dom": "^19.3.0",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }
diff --git a/web/templates/minimal/package.json b/web/templates/minimal/package.json
index 1d358bf..f890df3 100644
--- a/web/templates/minimal/package.json
+++ b/web/templates/minimal/package.json
@@ -8,14 +8,14 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }
diff --git a/web/templates/realtime/package.json b/web/templates/realtime/package.json
index a95bcf6..1b4bb34 100644
--- a/web/templates/realtime/package.json
+++ b/web/templates/realtime/package.json
@@ -8,14 +8,14 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }
diff --git a/web/templates/socialnetwork/package.json b/web/templates/socialnetwork/package.json
index 22eac4a..b260a97 100644
--- a/web/templates/socialnetwork/package.json
+++ b/web/templates/socialnetwork/package.json
@@ -9,19 +9,19 @@
     "migrate:down": "atlas migrate down"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-admin-0.4.4.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-auth-0.4.4.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-db-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-admin-0.4.5.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-migrate-0.4.4.tgz",
-    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-storage-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-migrate-0.4.5.tgz",
+    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-storage-0.4.5.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }
diff --git a/web/templates/worker/package.json b/web/templates/worker/package.json
index 11a87f0..1ec3ea1 100644
--- a/web/templates/worker/package.json
+++ b/web/templates/worker/package.json
@@ -9,15 +9,15 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-0.4.4.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-server-0.4.4.tgz",
-    "@wess/atlas-cache": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cache-0.4.4.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-config-0.4.4.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
+    "@wess/atlas-cache": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cache-0.4.5.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.4/wess-atlas-cli-0.4.4.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
   }
 }

From f75c1a3656418df9a866edf4d4abaf677b67ee19 Mon Sep 17 00:00:00 2001
From: Wess Cope <apple@wess.io>
Date: Thu, 22 Oct 2026 13:01:56 -0400
Subject: [PATCH 2/4] Close settings handles before atomic replacement on
 Windows

Concurrent Windows writers could replace a file while its previous temporary handle was still open. Close the synced handle before persisting its path and keep the concurrency gate on Windows.
---
 CLEANUP_TODO.md                          |  2 +-
 desktop/Cargo.lock                       | 12 ++++++------
 desktop/Cargo.toml                       |  2 +-
 desktop/crates/store/src/json.rs         |  3 ++-
 package.json                             |  2 +-
 web/AGENTS.md                            |  2 +-
 web/CLAUDE.md                            |  2 +-
 web/README.md                            |  6 +++---
 web/docs/agents.md                       |  2 +-
 web/package.json                         |  2 +-
 web/packages/cli/AGENTS.md               |  4 ++--
 web/packages/cli/modules/catalog.json    |  2 +-
 web/packages/cli/test/init.test.ts       | 14 +++++++-------
 web/templates/admin/package.json         | 14 +++++++-------
 web/templates/ai/package.json            | 14 +++++++-------
 web/templates/api/package.json           | 12 ++++++------
 web/templates/cms/package.json           | 20 ++++++++++----------
 web/templates/edge/package.json          | 10 +++++-----
 web/templates/fullstack/package.json     | 12 ++++++------
 web/templates/minimal/package.json       |  8 ++++----
 web/templates/realtime/package.json      |  8 ++++----
 web/templates/socialnetwork/package.json | 18 +++++++++---------
 web/templates/worker/package.json        | 10 +++++-----
 23 files changed, 91 insertions(+), 90 deletions(-)

diff --git a/CLEANUP_TODO.md b/CLEANUP_TODO.md
index 992de70..7e63f63 100644
--- a/CLEANUP_TODO.md
+++ b/CLEANUP_TODO.md
@@ -25,7 +25,7 @@ Isolated 0.4.3 application suites passed; 0.4.4 changes dependency closure and t
 CLI guard, with a new isolated production UI render gate. Inkling's actual 0.4.4
 PostgreSQL suite also passes all 397 cases.
 Original files and lockfiles are retained in the private migration backup recorded
-by the local migration receipt. The 0.4.5 candidate preserves native credential
+by the local migration receipt. The 0.4.6 candidate preserves native credential
 backends and Linux entry names after the keyring upgrade. Old/new macOS credential
 interoperability passed with a disposable test entry; Linux and Windows checks
 must pass before this candidate is released or native clients advance to it.
diff --git a/desktop/Cargo.lock b/desktop/Cargo.lock
index fedeafc..04751ff 100644
--- a/desktop/Cargo.lock
+++ b/desktop/Cargo.lock
@@ -431,7 +431,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-bridge"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "futures",
  "gpui",
@@ -440,11 +440,11 @@ dependencies = [
 
 [[package]]
 name = "atlas-build"
-version = "0.1.2"
+version = "0.1.3"
 
 [[package]]
 name = "atlas-core"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "chrono",
  "uuid",
@@ -452,7 +452,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-desktop"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "atlas-bridge",
  "atlas-core",
@@ -464,7 +464,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-shell"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "gpui",
  "guise-ui",
@@ -472,7 +472,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-store"
-version = "0.1.2"
+version = "0.1.3"
 dependencies = [
  "apple-native-keyring-store",
  "dirs 7.0.0",
diff --git a/desktop/Cargo.toml b/desktop/Cargo.toml
index 72e83ee..0d879bc 100644
--- a/desktop/Cargo.toml
+++ b/desktop/Cargo.toml
@@ -13,7 +13,7 @@ members = [
 exclude = ["templates"]
 
 [workspace.package]
-version = "0.1.2"
+version = "0.1.3"
 edition = "2021"
 license = "MIT"
 authors = ["Wess Cope <opensource@wess.io>"]
diff --git a/desktop/crates/store/src/json.rs b/desktop/crates/store/src/json.rs
index 0743a10..e5b50d2 100644
--- a/desktop/crates/store/src/json.rs
+++ b/desktop/crates/store/src/json.rs
@@ -58,7 +58,8 @@ pub fn write<T: Serialize>(path: &Path, value: &T) -> std::io::Result<()> {
         writer.flush()?;
     }
     tmp.as_file().sync_all()?;
-    tmp.persist(path).map_err(|e| e.error)?;
+    // close the handle before replacement so another Windows writer can replace it
+    tmp.into_temp_path().persist(path).map_err(|e| e.error)?;
     Ok(())
 }
 
diff --git a/package.json b/package.json
index 9fd35a0..4365bab 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@wess/atlas",
   "private": true,
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Composable Bun/TypeScript packages for building APIs, full-stack apps, and CLI tools",
   "license": "MIT",
   "repository": {
diff --git a/web/AGENTS.md b/web/AGENTS.md
index 97688d7..b0f0875 100644
--- a/web/AGENTS.md
+++ b/web/AGENTS.md
@@ -6,7 +6,7 @@ Composable, functional Bun/TypeScript building blocks. No classes, no mutation,
 
 Consumers import public `@wess/atlas/<module>` entry points. The modular release
 uses a thin facade and separately distributed implementation libraries. After the
-release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server db/postgres db/query`
+release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server db/postgres db/query`
 to record only selected modules and their dependencies. See README.md for release
 status and installation commands. Do not configure aliases into node_modules or
 require a neighboring Atlas checkout.
diff --git a/web/CLAUDE.md b/web/CLAUDE.md
index 12ba625..b4de9d2 100644
--- a/web/CLAUDE.md
+++ b/web/CLAUDE.md
@@ -6,7 +6,7 @@ Composable, functional Bun/TypeScript building blocks. No classes, no mutation,
 
 Consumers import public `@wess/atlas/<module>` entry points. The modular release
 uses a thin facade and separately distributed implementation libraries. After the
-release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server db/postgres db/query`
+release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server db/postgres db/query`
 to record only selected modules and their dependencies. See README.md for release
 status and installation commands. Do not configure aliases into node_modules or
 require a neighboring Atlas checkout.
diff --git a/web/README.md b/web/README.md
index bc0e7b0..5ddda6e 100644
--- a/web/README.md
+++ b/web/README.md
@@ -12,11 +12,11 @@ No framework lock-in. No classes. Just functions and immutable data flowing thro
 
 ## Install
 
-Install the coordinated `0.4.5` libraries from this repository's GitHub release
+Install the coordinated `0.4.6` libraries from this repository's GitHub release
 assets. The release workflow verifies all artifacts before making them available.
 
 ```sh
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server config db/query db/postgres
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server config db/query db/postgres
 ```
 
 The installer records exact GitHub release URLs, tested external versions, and the dependency closure for
@@ -89,7 +89,7 @@ Build a user API with authentication in 60 lines.
 ```bash
 mkdir myapp && cd myapp
 bun init -y
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server config db/sqlite db/query migrate auth/flows auth/token
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server config db/sqlite db/query migrate auth/flows auth/token
 ```
 
 The example below uses public `@wess/atlas/<pkg>` exports from the selected libraries.
diff --git a/web/docs/agents.md b/web/docs/agents.md
index 4f2a86a..7775bca 100644
--- a/web/docs/agents.md
+++ b/web/docs/agents.md
@@ -33,7 +33,7 @@ the document head.
 Select released library modules with the Atlas installer:
 
 ```sh
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas add server config db/postgres db/query
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server config db/postgres db/query
 ```
 
 See README.md for the release candidate's publication status. Import public
diff --git a/web/package.json b/web/package.json
index f8055fe..6c42a4f 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@wess/atlas",
   "private": true,
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Composable Bun/TypeScript packages for building APIs, full-stack apps, and CLI tools",
   "license": "MIT",
   "repository": {
diff --git a/web/packages/cli/AGENTS.md b/web/packages/cli/AGENTS.md
index b2415c3..b025dd8 100644
--- a/web/packages/cli/AGENTS.md
+++ b/web/packages/cli/AGENTS.md
@@ -86,7 +86,7 @@ atlas add               # lists available packages
 Check an application's manifests, Bun lockfile, installed Atlas links, source imports,
 and TypeScript aliases. Atlas facade and backing libraries must use the same exact
 stable version. Local paths, legacy aliases, and links outside node_modules fail the check.
-Run `bunx --package https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz atlas check` in application CI after a frozen install.
+Run `bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas check` in application CI after a frozen install.
 
 ### atlas dev
 
@@ -147,7 +147,7 @@ const questions = getQuestionSpec()
 ## Global Installation
 
 ```sh
-bun add -g https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz
+bun add -g https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz
 atlas init
 ```
 
diff --git a/web/packages/cli/modules/catalog.json b/web/packages/cli/modules/catalog.json
index 5ef8b01..a69bb5e 100644
--- a/web/packages/cli/modules/catalog.json
+++ b/web/packages/cli/modules/catalog.json
@@ -1,5 +1,5 @@
 {
-  "version": "0.4.5",
+  "version": "0.4.6",
   "exports": {
     "./admin": {
       "entry": "packages/admin/index.ts",
diff --git a/web/packages/cli/test/init.test.ts b/web/packages/cli/test/init.test.ts
index 6d9f668..f35263c 100644
--- a/web/packages/cli/test/init.test.ts
+++ b/web/packages/cli/test/init.test.ts
@@ -72,11 +72,11 @@ test("applyDefaults accepts partial overrides", () => {
 test("generated projects select versioned Atlas libraries", () => {
   const answers = applyDefaults({ template: "custom", features: ["auth", "storage", "admin"] });
   const pkg = JSON.parse(generatePackageJson(answers));
-  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.5"));
-  expect(pkg.dependencies["@wess/atlas-server"]).toBe(releaseUrl("@wess/atlas-server", "0.4.5"));
-  expect(pkg.dependencies["@wess/atlas-auth"]).toBe(releaseUrl("@wess/atlas-auth", "0.4.5"));
-  expect(pkg.dependencies["@wess/atlas-admin"]).toBe(releaseUrl("@wess/atlas-admin", "0.4.5"));
-  expect(pkg.dependencies["@wess/atlas-storage"]).toBe(releaseUrl("@wess/atlas-storage", "0.4.5"));
+  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.6"));
+  expect(pkg.dependencies["@wess/atlas-server"]).toBe(releaseUrl("@wess/atlas-server", "0.4.6"));
+  expect(pkg.dependencies["@wess/atlas-auth"]).toBe(releaseUrl("@wess/atlas-auth", "0.4.6"));
+  expect(pkg.dependencies["@wess/atlas-admin"]).toBe(releaseUrl("@wess/atlas-admin", "0.4.6"));
+  expect(pkg.dependencies["@wess/atlas-storage"]).toBe(releaseUrl("@wess/atlas-storage", "0.4.6"));
   expect(Object.values(pkg.dependencies).some((value) => /^(file:|link:|workspace:|github:)/.test(String(value)))).toBe(
     false,
   );
@@ -107,8 +107,8 @@ test("frontend scaffolds declare the UI peer dependencies", () => {
   const pkg = JSON.parse(generatePackageJson(applyDefaults({ template: "custom", frontend: true })));
   expect(pkg.dependencies.react).toBeDefined();
   expect(pkg.dependencies["@mantine/core"]).toBeDefined();
-  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.5"));
-  expect(pkg.dependencies["@wess/atlas-ui"]).toBe(releaseUrl("@wess/atlas-ui", "0.4.5"));
+  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.6"));
+  expect(pkg.dependencies["@wess/atlas-ui"]).toBe(releaseUrl("@wess/atlas-ui", "0.4.6"));
   expect(pkg.dependencies["@tanstack/react-table"]).toBeUndefined();
 });
 
diff --git a/web/templates/admin/package.json b/web/templates/admin/package.json
index c05bde2..96eaf3f 100644
--- a/web/templates/admin/package.json
+++ b/web/templates/admin/package.json
@@ -11,18 +11,18 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-admin-0.4.5.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-admin-0.4.6.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }
diff --git a/web/templates/ai/package.json b/web/templates/ai/package.json
index ca8e79b..f800369 100644
--- a/web/templates/ai/package.json
+++ b/web/templates/ai/package.json
@@ -10,16 +10,16 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
-    "@wess/atlas-ai": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-ai-0.4.5.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
+    "@wess/atlas-ai": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-ai-0.4.6.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }
diff --git a/web/templates/api/package.json b/web/templates/api/package.json
index b30d35d..f9a4ba6 100644
--- a/web/templates/api/package.json
+++ b/web/templates/api/package.json
@@ -11,16 +11,16 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }
diff --git a/web/templates/cms/package.json b/web/templates/cms/package.json
index 8f79489..05cf57e 100644
--- a/web/templates/cms/package.json
+++ b/web/templates/cms/package.json
@@ -9,20 +9,20 @@
     "migrate:down": "atlas migrate down"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-admin-0.4.5.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-admin-0.4.6.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-migrate-0.4.5.tgz",
-    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-storage-0.4.5.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
-    "@wess/atlas-request": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-request-0.4.5.tgz"
+    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-migrate-0.4.6.tgz",
+    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-storage-0.4.6.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
+    "@wess/atlas-request": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-request-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }
diff --git a/web/templates/edge/package.json b/web/templates/edge/package.json
index 68a8ed2..9328aa4 100644
--- a/web/templates/edge/package.json
+++ b/web/templates/edge/package.json
@@ -9,15 +9,15 @@
     "lint": "bunx biome lint ."
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
-    "@wess/atlas-edge": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-edge-0.4.5.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
+    "@wess/atlas-edge": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-edge-0.4.6.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }
diff --git a/web/templates/fullstack/package.json b/web/templates/fullstack/package.json
index 418cd95..fb5f223 100644
--- a/web/templates/fullstack/package.json
+++ b/web/templates/fullstack/package.json
@@ -15,11 +15,11 @@
     "@mantine/hooks": "^9.7.3",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
-    "@wess/atlas-ui": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-ui-0.4.5.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
+    "@wess/atlas-ui": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-ui-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
@@ -27,6 +27,6 @@
     "@types/react-dom": "^19.3.0",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }
diff --git a/web/templates/minimal/package.json b/web/templates/minimal/package.json
index f890df3..2cd94c5 100644
--- a/web/templates/minimal/package.json
+++ b/web/templates/minimal/package.json
@@ -8,14 +8,14 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }
diff --git a/web/templates/realtime/package.json b/web/templates/realtime/package.json
index 1b4bb34..bef2f12 100644
--- a/web/templates/realtime/package.json
+++ b/web/templates/realtime/package.json
@@ -8,14 +8,14 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }
diff --git a/web/templates/socialnetwork/package.json b/web/templates/socialnetwork/package.json
index b260a97..1490329 100644
--- a/web/templates/socialnetwork/package.json
+++ b/web/templates/socialnetwork/package.json
@@ -9,19 +9,19 @@
     "migrate:down": "atlas migrate down"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-admin-0.4.5.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-auth-0.4.5.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-db-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-admin-0.4.6.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-migrate-0.4.5.tgz",
-    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-storage-0.4.5.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
+    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-migrate-0.4.6.tgz",
+    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-storage-0.4.6.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }
diff --git a/web/templates/worker/package.json b/web/templates/worker/package.json
index 1ec3ea1..db59133 100644
--- a/web/templates/worker/package.json
+++ b/web/templates/worker/package.json
@@ -9,15 +9,15 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-0.4.5.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-server-0.4.5.tgz",
-    "@wess/atlas-cache": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cache-0.4.5.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-config-0.4.5.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
+    "@wess/atlas-cache": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cache-0.4.6.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.5/wess-atlas-cli-0.4.5.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
   }
 }

From 63f22d775015489d58a589e3c22e53177311c5ed Mon Sep 17 00:00:00 2001
From: Wess Cope <apple@wess.io>
Date: Thu, 22 Oct 2026 13:03:16 -0400
Subject: [PATCH 3/4] Derive site migration pins from the validated Inkling
 version

Use the candidate manifest instead of a hardcoded future tag so migration receipts point to the release that was actually checked. Record the HTTP comparison and coordinate the next Atlas library release.
---
 CLEANUP_TODO.md                          | 11 ++++++++---
 package.json                             |  2 +-
 web/AGENTS.md                            |  2 +-
 web/CLAUDE.md                            |  2 +-
 web/README.md                            |  6 +++---
 web/docs/agents.md                       |  2 +-
 web/package.json                         |  2 +-
 web/packages/cli/AGENTS.md               |  4 ++--
 web/packages/cli/modules/catalog.json    |  2 +-
 web/packages/cli/test/init.test.ts       | 14 +++++++-------
 web/templates/admin/package.json         | 14 +++++++-------
 web/templates/ai/package.json            | 14 +++++++-------
 web/templates/api/package.json           | 12 ++++++------
 web/templates/cms/package.json           | 20 ++++++++++----------
 web/templates/edge/package.json          | 10 +++++-----
 web/templates/fullstack/package.json     | 12 ++++++------
 web/templates/minimal/package.json       |  8 ++++----
 web/templates/realtime/package.json      |  8 ++++----
 web/templates/socialnetwork/package.json | 18 +++++++++---------
 web/templates/worker/package.json        | 10 +++++-----
 web/validation/fleet.ts                  |  2 +-
 21 files changed, 90 insertions(+), 85 deletions(-)

diff --git a/CLEANUP_TODO.md b/CLEANUP_TODO.md
index 7e63f63..4ee30ea 100644
--- a/CLEANUP_TODO.md
+++ b/CLEANUP_TODO.md
@@ -25,7 +25,7 @@ Isolated 0.4.3 application suites passed; 0.4.4 changes dependency closure and t
 CLI guard, with a new isolated production UI render gate. Inkling's actual 0.4.4
 PostgreSQL suite also passes all 397 cases.
 Original files and lockfiles are retained in the private migration backup recorded
-by the local migration receipt. The 0.4.6 candidate preserves native credential
+by the local migration receipt. The 0.4.7 candidate preserves native credential
 backends and Linux entry names after the keyring upgrade. Old/new macOS credential
 interoperability passed with a disposable test entry; Linux and Windows checks
 must pass before this candidate is released or native clients advance to it.
@@ -48,8 +48,8 @@ Production has only been inspected read-only; no application deployment has chan
   signup/login/post persistence, and admin API access for anonymous/user/admin roles.
   The fixture verifier is now required in CI and release workflows.
 - Pluck's Sharp security update is applied to its working tree and lockfile. Other
-  compatibility fixes are applied where they remain compatible with pinned Atlas;
-  the full Atlas dependency migrations remain pending publication.
+  compatibility fixes and modular library migrations are applied to the 11 direct
+  app working trees; downstream site and native-client updates remain in progress.
 - Web dependency audit reports no vulnerabilities or outdated packages. Desktop
   `cargo audit` reports zero vulnerabilities but 13 unmaintained dependency warnings
   (including duplicate versions). These are unresolved maintenance risks, not a
@@ -65,6 +65,11 @@ Production has only been inspected read-only; no application deployment has chan
   bytes RSS; the packed candidate peaked at 110,706,688 bytes (about 90% less).
   Total time was 582 ms versus 495 ms. These local results include the receiver
   in the same process and do not replace production latency or capacity testing.
+- A three-trial local HTTP comparison (32 concurrent clients, 20,000 measured
+  requests after warmup per trial) produced median throughput of 57,709 versus
+  57,688 requests/sec and p95 latency of 0.809 versus 0.841 ms. Median startup
+  was 12.62 versus 12.89 ms. This small server fixture shows similar performance;
+  it does not establish fleet-wide resource or latency changes.
 - Clean production installs use `bun install --production --omit=peer --frozen-lockfile`.
   Selected module closures and external peers are explicit application dependencies.
   The plain `--production` test retained the development CLI through optional peers;
diff --git a/package.json b/package.json
index 4365bab..b9d988f 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@wess/atlas",
   "private": true,
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Composable Bun/TypeScript packages for building APIs, full-stack apps, and CLI tools",
   "license": "MIT",
   "repository": {
diff --git a/web/AGENTS.md b/web/AGENTS.md
index b0f0875..4ef13d2 100644
--- a/web/AGENTS.md
+++ b/web/AGENTS.md
@@ -6,7 +6,7 @@ Composable, functional Bun/TypeScript building blocks. No classes, no mutation,
 
 Consumers import public `@wess/atlas/<module>` entry points. The modular release
 uses a thin facade and separately distributed implementation libraries. After the
-release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server db/postgres db/query`
+release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server db/postgres db/query`
 to record only selected modules and their dependencies. See README.md for release
 status and installation commands. Do not configure aliases into node_modules or
 require a neighboring Atlas checkout.
diff --git a/web/CLAUDE.md b/web/CLAUDE.md
index b4de9d2..10008f1 100644
--- a/web/CLAUDE.md
+++ b/web/CLAUDE.md
@@ -6,7 +6,7 @@ Composable, functional Bun/TypeScript building blocks. No classes, no mutation,
 
 Consumers import public `@wess/atlas/<module>` entry points. The modular release
 uses a thin facade and separately distributed implementation libraries. After the
-release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server db/postgres db/query`
+release is published, use `bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server db/postgres db/query`
 to record only selected modules and their dependencies. See README.md for release
 status and installation commands. Do not configure aliases into node_modules or
 require a neighboring Atlas checkout.
diff --git a/web/README.md b/web/README.md
index 5ddda6e..484038c 100644
--- a/web/README.md
+++ b/web/README.md
@@ -12,11 +12,11 @@ No framework lock-in. No classes. Just functions and immutable data flowing thro
 
 ## Install
 
-Install the coordinated `0.4.6` libraries from this repository's GitHub release
+Install the coordinated `0.4.7` libraries from this repository's GitHub release
 assets. The release workflow verifies all artifacts before making them available.
 
 ```sh
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server config db/query db/postgres
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server config db/query db/postgres
 ```
 
 The installer records exact GitHub release URLs, tested external versions, and the dependency closure for
@@ -89,7 +89,7 @@ Build a user API with authentication in 60 lines.
 ```bash
 mkdir myapp && cd myapp
 bun init -y
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server config db/sqlite db/query migrate auth/flows auth/token
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server config db/sqlite db/query migrate auth/flows auth/token
 ```
 
 The example below uses public `@wess/atlas/<pkg>` exports from the selected libraries.
diff --git a/web/docs/agents.md b/web/docs/agents.md
index 7775bca..b11a8ca 100644
--- a/web/docs/agents.md
+++ b/web/docs/agents.md
@@ -33,7 +33,7 @@ the document head.
 Select released library modules with the Atlas installer:
 
 ```sh
-bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas add server config db/postgres db/query
+bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas add server config db/postgres db/query
 ```
 
 See README.md for the release candidate's publication status. Import public
diff --git a/web/package.json b/web/package.json
index 6c42a4f..0d38ec5 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@wess/atlas",
   "private": true,
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Composable Bun/TypeScript packages for building APIs, full-stack apps, and CLI tools",
   "license": "MIT",
   "repository": {
diff --git a/web/packages/cli/AGENTS.md b/web/packages/cli/AGENTS.md
index b025dd8..de79de9 100644
--- a/web/packages/cli/AGENTS.md
+++ b/web/packages/cli/AGENTS.md
@@ -86,7 +86,7 @@ atlas add               # lists available packages
 Check an application's manifests, Bun lockfile, installed Atlas links, source imports,
 and TypeScript aliases. Atlas facade and backing libraries must use the same exact
 stable version. Local paths, legacy aliases, and links outside node_modules fail the check.
-Run `bunx --package https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz atlas check` in application CI after a frozen install.
+Run `bunx --package https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz atlas check` in application CI after a frozen install.
 
 ### atlas dev
 
@@ -147,7 +147,7 @@ const questions = getQuestionSpec()
 ## Global Installation
 
 ```sh
-bun add -g https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz
+bun add -g https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz
 atlas init
 ```
 
diff --git a/web/packages/cli/modules/catalog.json b/web/packages/cli/modules/catalog.json
index a69bb5e..872423e 100644
--- a/web/packages/cli/modules/catalog.json
+++ b/web/packages/cli/modules/catalog.json
@@ -1,5 +1,5 @@
 {
-  "version": "0.4.6",
+  "version": "0.4.7",
   "exports": {
     "./admin": {
       "entry": "packages/admin/index.ts",
diff --git a/web/packages/cli/test/init.test.ts b/web/packages/cli/test/init.test.ts
index f35263c..067a5ec 100644
--- a/web/packages/cli/test/init.test.ts
+++ b/web/packages/cli/test/init.test.ts
@@ -72,11 +72,11 @@ test("applyDefaults accepts partial overrides", () => {
 test("generated projects select versioned Atlas libraries", () => {
   const answers = applyDefaults({ template: "custom", features: ["auth", "storage", "admin"] });
   const pkg = JSON.parse(generatePackageJson(answers));
-  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.6"));
-  expect(pkg.dependencies["@wess/atlas-server"]).toBe(releaseUrl("@wess/atlas-server", "0.4.6"));
-  expect(pkg.dependencies["@wess/atlas-auth"]).toBe(releaseUrl("@wess/atlas-auth", "0.4.6"));
-  expect(pkg.dependencies["@wess/atlas-admin"]).toBe(releaseUrl("@wess/atlas-admin", "0.4.6"));
-  expect(pkg.dependencies["@wess/atlas-storage"]).toBe(releaseUrl("@wess/atlas-storage", "0.4.6"));
+  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-server"]).toBe(releaseUrl("@wess/atlas-server", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-auth"]).toBe(releaseUrl("@wess/atlas-auth", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-admin"]).toBe(releaseUrl("@wess/atlas-admin", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-storage"]).toBe(releaseUrl("@wess/atlas-storage", "0.4.7"));
   expect(Object.values(pkg.dependencies).some((value) => /^(file:|link:|workspace:|github:)/.test(String(value)))).toBe(
     false,
   );
@@ -107,8 +107,8 @@ test("frontend scaffolds declare the UI peer dependencies", () => {
   const pkg = JSON.parse(generatePackageJson(applyDefaults({ template: "custom", frontend: true })));
   expect(pkg.dependencies.react).toBeDefined();
   expect(pkg.dependencies["@mantine/core"]).toBeDefined();
-  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.6"));
-  expect(pkg.dependencies["@wess/atlas-ui"]).toBe(releaseUrl("@wess/atlas-ui", "0.4.6"));
+  expect(pkg.dependencies["@wess/atlas"]).toBe(releaseUrl("@wess/atlas", "0.4.7"));
+  expect(pkg.dependencies["@wess/atlas-ui"]).toBe(releaseUrl("@wess/atlas-ui", "0.4.7"));
   expect(pkg.dependencies["@tanstack/react-table"]).toBeUndefined();
 });
 
diff --git a/web/templates/admin/package.json b/web/templates/admin/package.json
index 96eaf3f..dd4683b 100644
--- a/web/templates/admin/package.json
+++ b/web/templates/admin/package.json
@@ -11,18 +11,18 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-admin-0.4.6.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-admin-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/ai/package.json b/web/templates/ai/package.json
index f800369..307ca83 100644
--- a/web/templates/ai/package.json
+++ b/web/templates/ai/package.json
@@ -10,16 +10,16 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
-    "@wess/atlas-ai": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-ai-0.4.6.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-ai": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-ai-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/api/package.json b/web/templates/api/package.json
index f9a4ba6..173fa0c 100644
--- a/web/templates/api/package.json
+++ b/web/templates/api/package.json
@@ -11,16 +11,16 @@
     "migrate:new": "atlas migrate new"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/cms/package.json b/web/templates/cms/package.json
index 05cf57e..033f1f1 100644
--- a/web/templates/cms/package.json
+++ b/web/templates/cms/package.json
@@ -9,20 +9,20 @@
     "migrate:down": "atlas migrate down"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-admin-0.4.6.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-admin-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-migrate-0.4.6.tgz",
-    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-storage-0.4.6.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
-    "@wess/atlas-request": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-request-0.4.6.tgz"
+    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-migrate-0.4.7.tgz",
+    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-storage-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-request": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-request-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/edge/package.json b/web/templates/edge/package.json
index 9328aa4..299f255 100644
--- a/web/templates/edge/package.json
+++ b/web/templates/edge/package.json
@@ -9,15 +9,15 @@
     "lint": "bunx biome lint ."
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
-    "@wess/atlas-edge": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-edge-0.4.6.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-edge": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-edge-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/fullstack/package.json b/web/templates/fullstack/package.json
index fb5f223..23c3883 100644
--- a/web/templates/fullstack/package.json
+++ b/web/templates/fullstack/package.json
@@ -15,11 +15,11 @@
     "@mantine/hooks": "^9.7.3",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
-    "@wess/atlas-ui": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-ui-0.4.6.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-ui": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-ui-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
@@ -27,6 +27,6 @@
     "@types/react-dom": "^19.3.0",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/minimal/package.json b/web/templates/minimal/package.json
index 2cd94c5..d3417d6 100644
--- a/web/templates/minimal/package.json
+++ b/web/templates/minimal/package.json
@@ -8,14 +8,14 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/realtime/package.json b/web/templates/realtime/package.json
index bef2f12..2df1adc 100644
--- a/web/templates/realtime/package.json
+++ b/web/templates/realtime/package.json
@@ -8,14 +8,14 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/socialnetwork/package.json b/web/templates/socialnetwork/package.json
index 1490329..4d8e35d 100644
--- a/web/templates/socialnetwork/package.json
+++ b/web/templates/socialnetwork/package.json
@@ -9,19 +9,19 @@
     "migrate:down": "atlas migrate down"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-admin-0.4.6.tgz",
-    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-auth-0.4.6.tgz",
-    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-db-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-admin": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-admin-0.4.7.tgz",
+    "@wess/atlas-auth": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-auth-0.4.7.tgz",
+    "@wess/atlas-db": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-db-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
     "zod": "^4.6.7",
-    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-migrate-0.4.6.tgz",
-    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-storage-0.4.6.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
+    "@wess/atlas-migrate": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-migrate-0.4.7.tgz",
+    "@wess/atlas-storage": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-storage-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/templates/worker/package.json b/web/templates/worker/package.json
index db59133..e1f8cf8 100644
--- a/web/templates/worker/package.json
+++ b/web/templates/worker/package.json
@@ -9,15 +9,15 @@
     "lint": "bunx biome lint src/"
   },
   "dependencies": {
-    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-0.4.6.tgz",
-    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-server-0.4.6.tgz",
-    "@wess/atlas-cache": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cache-0.4.6.tgz",
-    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-config-0.4.6.tgz"
+    "@wess/atlas": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-0.4.7.tgz",
+    "@wess/atlas-server": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-server-0.4.7.tgz",
+    "@wess/atlas-cache": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cache-0.4.7.tgz",
+    "@wess/atlas-config": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-config-0.4.7.tgz"
   },
   "devDependencies": {
     "@types/bun": "^1.4.3",
     "@biomejs/biome": "2.6.2",
     "typescript": "^7.0.2",
-    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.6/wess-atlas-cli-0.4.6.tgz"
+    "@wess/atlas-cli": "https://github.com/wess/atlas/releases/download/v0.4.7/wess-atlas-cli-0.4.7.tgz"
   }
 }
diff --git a/web/validation/fleet.ts b/web/validation/fleet.ts
index f20e3a9..733c1d2 100644
--- a/web/validation/fleet.ts
+++ b/web/validation/fleet.ts
@@ -73,7 +73,7 @@ export async function validateFleet(
     }
     const intended = structuredClone(app);
     // the next Inkling tag must be released with GitHub-backed Atlas dependencies
-    intended.dependencies.inkling = "github:wess/inkling#v1.24.0";
+    intended.dependencies.inkling = `github:wess/inkling#v${manifest.version}`;
     intended.engines = { ...intended.engines, bun: ">=1.4.4" };
     await Bun.write(join(directory, "migration.json"), JSON.stringify(intended, null, 2));
     app.dependencies.inkling = tarball;

From 77a5797842954a23c24f314ca67a5bc97c85e7ee Mon Sep 17 00:00:00 2001
From: Wess Cope <apple@wess.io>
Date: Thu, 22 Oct 2026 13:04:04 -0400
Subject: [PATCH 4/4] Use standard atomic replacement for native settings

The Windows tempfile persistence implementation does not use modern rename sharing semantics. Use the standard library rename after syncing and closing the temporary file, and verify concurrent writes, retained readers, and cleanup on failure.
---
 desktop/Cargo.lock                 | 12 ++++++------
 desktop/Cargo.toml                 |  2 +-
 desktop/crates/store/src/json.rs   |  6 ++++--
 desktop/crates/store/tests/json.rs | 29 +++++++++++++++++++++++++++++
 4 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/desktop/Cargo.lock b/desktop/Cargo.lock
index 04751ff..cc6f4ca 100644
--- a/desktop/Cargo.lock
+++ b/desktop/Cargo.lock
@@ -431,7 +431,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-bridge"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
  "futures",
  "gpui",
@@ -440,11 +440,11 @@ dependencies = [
 
 [[package]]
 name = "atlas-build"
-version = "0.1.3"
+version = "0.1.4"
 
 [[package]]
 name = "atlas-core"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
  "chrono",
  "uuid",
@@ -452,7 +452,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-desktop"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
  "atlas-bridge",
  "atlas-core",
@@ -464,7 +464,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-shell"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
  "gpui",
  "guise-ui",
@@ -472,7 +472,7 @@ dependencies = [
 
 [[package]]
 name = "atlas-store"
-version = "0.1.3"
+version = "0.1.4"
 dependencies = [
  "apple-native-keyring-store",
  "dirs 7.0.0",
diff --git a/desktop/Cargo.toml b/desktop/Cargo.toml
index 0d879bc..f9cf059 100644
--- a/desktop/Cargo.toml
+++ b/desktop/Cargo.toml
@@ -13,7 +13,7 @@ members = [
 exclude = ["templates"]
 
 [workspace.package]
-version = "0.1.3"
+version = "0.1.4"
 edition = "2021"
 license = "MIT"
 authors = ["Wess Cope <opensource@wess.io>"]
diff --git a/desktop/crates/store/src/json.rs b/desktop/crates/store/src/json.rs
index e5b50d2..1d9528f 100644
--- a/desktop/crates/store/src/json.rs
+++ b/desktop/crates/store/src/json.rs
@@ -58,8 +58,10 @@ pub fn write<T: Serialize>(path: &Path, value: &T) -> std::io::Result<()> {
         writer.flush()?;
     }
     tmp.as_file().sync_all()?;
-    // close the handle before replacement so another Windows writer can replace it
-    tmp.into_temp_path().persist(path).map_err(|e| e.error)?;
+    // std handles open destination readers on Windows; tempfile's persist does not
+    let mut tmp = tmp.into_temp_path();
+    std::fs::rename(&tmp, path)?;
+    tmp.disable_cleanup(true);
     Ok(())
 }
 
diff --git a/desktop/crates/store/tests/json.rs b/desktop/crates/store/tests/json.rs
index 713fac9..2e00e55 100644
--- a/desktop/crates/store/tests/json.rs
+++ b/desktop/crates/store/tests/json.rs
@@ -1,5 +1,34 @@
 use atlasstore::json;
 
+#[test]
+fn open_readers_keep_the_previous_document_during_replacement() {
+    use std::io::Read;
+
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("state.json");
+    json::write(&path, &"previous").unwrap();
+    let mut previous = std::fs::File::open(&path).unwrap();
+    json::write(&path, &"updated").unwrap();
+
+    let mut text = String::new();
+    previous.read_to_string(&mut text).unwrap();
+    assert_eq!(serde_json::from_str::<String>(&text).unwrap(), "previous");
+    assert_eq!(json::read::<String>(&path).unwrap().unwrap(), "updated");
+    assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 1);
+}
+
+#[test]
+fn failed_replacement_preserves_the_destination_and_removes_the_temporary_file() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("state.json");
+    std::fs::create_dir(&path).unwrap();
+    std::fs::write(path.join("keep"), "untouched").unwrap();
+
+    assert!(json::write(&path, &"updated").is_err());
+    assert_eq!(std::fs::read_to_string(path.join("keep")).unwrap(), "untouched");
+    assert_eq!(std::fs::read_dir(dir.path()).unwrap().count(), 1);
+}
+
 #[test]
 fn simultaneous_writes_leave_one_complete_document() {
     let dir = tempfile::tempdir().unwrap();