chore: use published i18n and UI beta.147 packages

apps/electron/package.json

@@ -10,7 +10,7 @@
   },
   "dependencies": {
     "@lingui/core": "6.10.1",
-    "@mdbase-dev/i18n": "file:../../vendor/mdbase-dev-i18n-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/i18n": "0.1.0-beta.147",
     "@mdbase-reader/platform": "workspace:*",
     "electron": "latest"
   }

apps/extension/package.json

@@ -18,9 +18,9 @@
     "@mdbase-dev/sdk-staging": "file:../../packages/connect/vendor/sdk-dev-eaa4e697-staging.tgz",
     "@lingui/core": "6.10.1",
     "@lingui/react": "6.10.1",
-    "@mdbase-dev/i18n": "file:../../vendor/mdbase-dev-i18n-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/i18n": "0.1.0-beta.147",
     "@mdbase-reader/i18n": "workspace:*",
-    "@mdbase-dev/ui": "file:../../vendor/mdbase-dev-ui-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/ui": "0.1.0-beta.147",
     "@mdbase-reader/connect": "workspace:*",
     "@mdbase-reader/core": "workspace:*",
     "@mdbase-reader/platform": "workspace:*",

apps/reader/package.json

@@ -29,12 +29,12 @@
     "@mdbase-dev/sdk": "file:../../packages/connect/vendor/sdk-dce61ff5-production-beta141.tgz",
     "@mdbase-dev/sdk-lab": "file:../../packages/connect/vendor/sdk-dev-eaa4e697-lab.tgz",
     "@mdbase-dev/sdk-staging": "file:../../packages/connect/vendor/sdk-dev-eaa4e697-staging.tgz",
-    "@mdbase-dev/i18n": "file:../../vendor/mdbase-dev-i18n-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/i18n": "0.1.0-beta.147",
     "@citation-js/plugin-csl": "0.9.0",
     "@lingui/core": "6.10.1",
     "@lingui/react": "6.10.1",
     "@mdbase-dev/sdk-legacy-729b5391": "file:../../vendor/mdbase-dev-sdk-0.0.0-729b5391.tgz",
-    "@mdbase-dev/ui": "file:../../vendor/mdbase-dev-ui-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/ui": "0.1.0-beta.147",
     "@mdbase-reader/connect": "workspace:*",
     "@mdbase-reader/core": "workspace:*",
     "@mdbase-reader/i18n": "workspace:*",

docs/new-sdk.md

@@ -77,10 +77,9 @@ is introduced. Writer's optional file-access consent remains a later SDK capabil
 - Unsupported features are refused (`unsupported_operation`), never emulated. See the gap list
   in the coordinator's `reader-sdk-gaps.md`.
 - `SdkReaderRoot` renders the shared `CollectionGate` from `@mdbase-dev/ui/collections`
-  (this multilingual branch uses `vendor/mdbase-dev-ui-0.1.0-beta.141-24e9f5d0.tgz`,
-  recorded in `vendor/mdbase-ui-i18n.json`; it is strict-complete multilingual integration,
-  not publisher/release-qualified.
-  The prior dev-intake original and `vendor/mdbase-ui-dev.json` remain untouched):
+  (`@mdbase-dev/ui@0.1.0-beta.147` from npm; this is strict-complete multilingual
+  integration, not native publisher/release qualification. The prior dev-intake
+  original and `vendor/mdbase-ui-dev.json` remain untouched):
   - The gate owns sign-in, choosing, approval, setup review, problems and sign-out
     (`signOut()`, never `close()`). Reader supplies only its name and mark.
   - It starts the entry once (StrictMode-safe); the entry follows page visibility.

docs/translations.md

@@ -21,7 +21,7 @@ pnpm i18n:check
 
 During local authoring only, `check:code` runs the unchanged lint/typecheck/test suite and `build:code` builds every workspace without asserting catalogue completeness. Neither substitutes for the normal release gates. Run finite checks/builds via `rpnpm` on this machine.
 
-Kit commit `24e9f5d0` includes the public-bin fix, nested plural/explicit-instance/class-field source-guard repairs, field-level tracking, rendered-state notice detection, compiled-catalogue composition checking and obsolete-message pruning. Scripts invoke its public `mdbase-i18n` bin directly; no adapter or source exclusions are needed. Its source guard passes all 487 modules without newly unmarked copy, so adoption adds no English message IDs.
+The published `@mdbase-dev/i18n@0.1.0-beta.147` includes the public-bin fix, nested plural/explicit-instance/class-field source-guard repairs, field-level tracking, rendered-state notice detection, compiled-catalogue composition checking and obsolete-message pruning. Scripts invoke its public `mdbase-i18n` bin directly; no adapter or source exclusions are needed.
 
 While catalogues are being authored, `pnpm exec lingui compile --workers 1` permits development fallback; it is **not** evidence of translation completeness. Empty target PO entries must never be filled with English just to pass checks.
 
@@ -35,16 +35,15 @@ Electron's main process initializes synchronous English from copied compiler-own
 
 ## Shared kit dependency
 
-This branch vendors `@mdbase-dev/i18n` from Connect commit `24e9f5d0`:
-
-- `vendor/mdbase-dev-i18n-0.1.0-beta.141-24e9f5d0.tgz`
-- SHA256 `b65ce6066f9e096eea183209c93b42950f21f8e78a0d105838a15da9ca82ce46`
+Every workspace pins `@mdbase-dev/i18n` and `@mdbase-dev/ui` to exactly `0.1.0-beta.147` from npm, with integrity recorded in `pnpm-lock.yaml`. Do not use a range or dist-tag: i18n's `latest` tag is a staging placeholder.
 
 Its `createI18nRuntime` encodes backslashes in interpolated string values once per Lingui instance, so user text such as `C:\x41dir` renders literally. Reader relies on it and has no wrapper of its own; a second encoding pass would display `\` as `\u005c`.
 
-Public UI integration uses `vendor/mdbase-dev-ui-0.1.0-beta.141-24e9f5d0.tgz` (SHA256 `1230707f2ba9545a041f2a9325ab5e2d25ed001885ebc0369d836e00b19d30f0`). Its `uiCatalogues` source is composed by the shared runtime, so library strings remain library-owned and use the exact same Lingui singleton. Reader gives potentially colliding generic messages semantic contexts to prevent independent PO translations from conflicting. This is the coordinator's strict-complete shared UI pin: 197 active messages per locale, with obsolete `nzHlj8` pruned. Translation integration is complete; it is not publisher/release qualification. Reader’s protected publisher gate currently refuses it against the approved UI original. Historical approved tarballs, trust pins and verification tests have not been changed; normal authorized intake/release qualification is required before that gate can be green.
+The UI's `uiCatalogues` source is composed by the shared runtime, so library strings remain library-owned and use the exact same Lingui singleton. Reader gives potentially colliding generic messages semantic contexts to prevent independent PO translations from conflicting. The npm UI has 197 active messages per locale, with obsolete `nzHlj8` pruned.
+
+Publisher tests compare every installed UI member against `scripts/tests/fixtures/ui-npm-members.json`, generated with `originalMembers` from npm's integrity-verified beta.147 archive (`npm pack @mdbase-dev/ui@0.1.0-beta.147`). Compared with the prior 24e9f5d0 tarball, all 94 UI members are identical except `package.json` (version and development i18n pin). All 37 kit members are identical except its package version. No catalogue regeneration or runtime patch is needed.
 
-**Replace the file dependency with the published npm version at merge time**, after the next Connect release. No publication or deployment is authorized by this branch.
+npm installation is **not native publisher/release qualification**: the live native guard still requires an independently approved file intake. Historical approved UI archives and protected hashes remain unchanged; tests use them only in disposable historical fixtures. No publication or deployment is authorized by this dependency swap.
 
 Italian also appears in the separate citation-output locale picker. The citation-js bundled locale subset has no Italian data, so `src/locales/csl-it-IT.xml` supplies pinned, attributed CSL data (see its adjacent README), loaded lazily from Reader’s own deployment. Citation output language remains an explicit choice, separate from interface language; source metadata is never rewritten.
 

package.json

@@ -53,7 +53,7 @@
     "@lingui/vite-plugin": "6.9.0",
     "@mdbase-dev/connect-dev": "0.1.0-beta.125",
     "@mdbase-dev/connect-protocol": "file:packages/connect/vendor/mdbase-dev-connect-protocol-0.1.0-beta.129-c280cd194ffd.tgz",
-    "@mdbase-dev/i18n": "file:vendor/mdbase-dev-i18n-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/i18n": "0.1.0-beta.147",
     "@mdbase-reader/i18n": "workspace:0.1.0-beta.0",
     "@types/node": "^22.19.11",
     "eslint": "^9.39.2",

packages/i18n/package.json

@@ -15,8 +15,8 @@
   "dependencies": {
     "@lingui/core": "6.10.1",
     "@lingui/react": "6.10.1",
-    "@mdbase-dev/ui": "file:../../vendor/mdbase-dev-ui-0.1.0-beta.141-24e9f5d0.tgz",
-    "@mdbase-dev/i18n": "file:../../vendor/mdbase-dev-i18n-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/ui": "0.1.0-beta.147",
+    "@mdbase-dev/i18n": "0.1.0-beta.147",
     "react": "^19.3.1"
   },
   "devDependencies": {

packages/markdown-editor/package.json

@@ -22,8 +22,8 @@
     "@codemirror/view": "^6.43.15",
     "@lezer/highlight": "^1.2.5",
     "@lingui/core": "6.10.1",
-    "@mdbase-dev/i18n": "file:../../vendor/mdbase-dev-i18n-0.1.0-beta.141-24e9f5d0.tgz",
-    "@mdbase-dev/ui": "file:../../vendor/mdbase-dev-ui-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/i18n": "0.1.0-beta.147",
+    "@mdbase-dev/ui": "0.1.0-beta.147",
     "@mdbase-reader/core": "workspace:*",
     "react": "^19.3.1"
   },

packages/ui/package.json

@@ -15,11 +15,11 @@
   },
   "dependencies": {
     "@citation-js/plugin-csl": "0.9.0",
-    "@mdbase-dev/i18n": "file:../../vendor/mdbase-dev-i18n-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/i18n": "0.1.0-beta.147",
     "@fontsource/atkinson-hyperlegible": "^5.3.0",
     "@fontsource/azeret-mono": "^5.3.0",
     "@lingui/core": "6.10.1",
-    "@mdbase-dev/ui": "file:../../vendor/mdbase-dev-ui-0.1.0-beta.141-24e9f5d0.tgz",
+    "@mdbase-dev/ui": "0.1.0-beta.147",
     "@phosphor-icons/react": "^2.1.10",
     "citeproc": "2.4.63",
     "react": "^19.3.1"