diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 02a710e..811fadd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,8 @@ on:
         options:
           - test
           - stable
+          - stable-prepare-pr
+          - stable-publish
       config:
         description: Config file path
         required: true
@@ -46,11 +48,24 @@ jobs:
       - name: Update npm to latest
         run: npm install -g npm@latest
 
+      - name: Preflight GitHub token permissions
+        env:
+          GH_TOKEN: ${{ secrets.GIT_PUSH_TOKEN }}
+        run: |
+          if [ -z "$GH_TOKEN" ]; then
+            echo "GIT_PUSH_TOKEN secret is missing" >&2
+            exit 1
+          fi
+          gh --version
+          gh auth status -h github.com
+          gh api repos/SolidOS/solid-logic --jq '.full_name + " permissions=" + (if .permissions.push then "push" else "no-push" end)'
+
       - name: Run release orchestrator
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GIT_PUSH_TOKEN }}
           GIT_PUSH_TOKEN: ${{ secrets.GIT_PUSH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GIT_PUSH_TOKEN }}
         run: |
           BRANCH_ARG=""
           if [ -n "${{ inputs.branch }}" ]; then
diff --git a/.github/workflows/unpublish.yml b/.github/workflows/unpublish.yml
index 5bb8a08..cbf111e 100644
--- a/.github/workflows/unpublish.yml
+++ b/.github/workflows/unpublish.yml
@@ -11,6 +11,20 @@ on:
         description: Exact version to unpublish (e.g. 4.0.5)
         required: true
         type: string
+      action:
+        description: Choose operation (unpublish, deprecate, or auto fallback)
+        required: true
+        default: auto
+        type: choice
+        options:
+          - auto
+          - unpublish
+          - deprecate
+      deprecate_message:
+        description: Message used when deprecating (required for deprecate/auto fallback)
+        required: true
+        default: "Deprecated due to release rollback. Please use the latest stable version."
+        type: string
       dry_run:
         description: Dry run only (do not execute unpublish)
         required: true
@@ -52,29 +66,88 @@ jobs:
       - name: Show target
         run: |
           echo "Target: ${{ inputs.package_name }}@${{ inputs.version }}"
+          echo "Action: ${{ inputs.action }}"
           echo "Dry run: ${{ inputs.dry_run }}"
 
       - name: Dry run check
         if: ${{ inputs.dry_run }}
         run: |
           echo "Dry run enabled. No unpublish command executed."
-          echo "Would run: npm unpublish ${{ inputs.package_name }}@${{ inputs.version }} --force"
+          if [ "${{ inputs.action }}" = "deprecate" ]; then
+            echo "Would run: npm deprecate -f '${{ inputs.package_name }}@${{ inputs.version }}' '${{ inputs.deprecate_message }}'"
+          elif [ "${{ inputs.action }}" = "unpublish" ]; then
+            echo "Would run: npm unpublish ${{ inputs.package_name }}@${{ inputs.version }} --force"
+          else
+            echo "Would run: npm unpublish ${{ inputs.package_name }}@${{ inputs.version }} --force"
+            echo "If blocked by npm policy, would run: npm deprecate -f '${{ inputs.package_name }}@${{ inputs.version }}' '${{ inputs.deprecate_message }}'"
+          fi
 
-      - name: Unpublish exact version
+      - name: Execute package retirement action
         if: ${{ !inputs.dry_run }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          npm unpublish ${{ inputs.package_name }}@${{ inputs.version }} --force
+          set -euo pipefail
+          target="${{ inputs.package_name }}@${{ inputs.version }}"
+          message="${{ inputs.deprecate_message }}"
+
+          if [ "${{ inputs.action }}" = "deprecate" ]; then
+            npm deprecate -f "$target" "$message"
+            exit 0
+          fi
+
+          if [ "${{ inputs.action }}" = "unpublish" ]; then
+            npm unpublish "$target" --force
+            exit 0
+          fi
+
+          set +e
+          output=$(npm unpublish "$target" --force 2>&1)
+          status=$?
+          set -e
 
-      - name: Verify version is no longer available
+          echo "$output"
+          if [ $status -eq 0 ]; then
+            echo "Unpublish succeeded."
+            exit 0
+          fi
+
+          if echo "$output" | grep -qi "You can no longer unpublish this package\|Failed criteria\|E405"; then
+            echo "Unpublish blocked by npm policy; falling back to deprecate..."
+            npm deprecate -f "$target" "$message"
+            exit 0
+          fi
+
+          echo "Unpublish failed for a reason other than npm policy; not falling back."
+          exit $status
+
+      - name: Verify outcome
         if: ${{ !inputs.dry_run }}
         run: |
+          if [ "${{ inputs.action }}" = "deprecate" ]; then
+            npm view ${{ inputs.package_name }}@${{ inputs.version }} deprecated
+            exit 0
+          fi
+
+          if [ "${{ inputs.action }}" = "auto" ]; then
+            # In auto mode, either unpublish (version no longer resolves) or deprecate (deprecated message exists) is acceptable.
+            set +e
+            npm view ${{ inputs.package_name }}@${{ inputs.version }} version >/dev/null 2>&1
+            exists_status=$?
+            set -e
+            if [ $exists_status -ne 0 ]; then
+              echo "Version no longer resolvable (unpublished)."
+              exit 0
+            fi
+            npm view ${{ inputs.package_name }}@${{ inputs.version }} deprecated
+            exit 0
+          fi
+
           set +e
           npm view ${{ inputs.package_name }}@${{ inputs.version }} version
           status=$?
           if [ $status -eq 0 ]; then
-            echo "Version still resolvable from npm registry."
+            echo "Version still resolvable from npm registry (unpublish did not occur)."
             exit 1
           fi
           echo "Unpublish appears successful (version not resolvable)."
diff --git a/RELEASE-HOWTO.md b/RELEASE-HOWTO.md
index 24f8574..2a6a8af 100644
--- a/RELEASE-HOWTO.md
+++ b/RELEASE-HOWTO.md
@@ -27,10 +27,12 @@ Before the release workflow can publish stable versions from GitHub Actions:
 3. In `solidos/solidos` → Settings → Secrets and variables → Actions, add:
   - `GIT_PUSH_TOKEN`
   - `NPM_TOKEN`
-4. Confirm target repos allow the token/account to push to `main`, or decide to use a PR-based merge flow instead.
-5. Run the `Solidos Release` workflow manually with:
+4. For **protected branches on main**: Use `mode=stable-publish` (no extra config needed—it auto-merges PRs)
+5. For **unprotected main branch**: Use `mode=stable` (requires direct push access)
+6. Run the `Solidos Release` workflow manually with:
   - `mode=test` for prerelease publishing
-  - `mode=stable` for `@latest`
+  - `mode=stable-publish` for `@latest` (protected branch)
+  - `mode=stable` for `@latest` (direct push)
 
 ## How It Works
 
@@ -40,40 +42,31 @@ Before the release workflow can publish stable versions from GitHub Actions:
 |----------|---------|-------|-----------|
 | **Local Testing** | `node scripts/release-orchestrator.js --dry-run=true` | Your computer | ❌ No (prints what would happen) |
 | **Test Release** | Manual trigger: mode=test | GitHub Actions | ✅ Yes (@test tag) |
-| **Stable Release** | Manual trigger: mode=stable | GitHub Actions | ✅ Yes (@latest tag) |
+| **Stable Release (Direct Push)** | Manual trigger: mode=stable | GitHub Actions | ✅ Yes (@latest tag) |
+| **Stable Release (Protected Branch)** | Manual trigger: mode=stable-publish | GitHub Actions | ✅ Yes (@latest tag, auto-merges PR) |
 
-**Workflow:**
+**Workflow (stable-publish mode with protected branches):**
 ```
-You click "Run workflow" button in GitHub Actions (mode=test or mode=stable)
-          ↓
-release.yml starts
-          ↓
-Runs: node scripts/release-orchestrator.js --mode <test|stable> ...
-          ↓
-Script reads release.config.json (list of repos to release)
-          ↓
+You click "Run workflow" → mode=stable-publish
+          ↓ Step 1/3: Create Release PR
+Creates release branch from dev → Merges dev into main → Pushes branch → Opens PR
+          ↓ Step 2/3: Auto-Merge PR
+Waits for CI checks to pass → Auto-merges PR with --squash → Fetches updated main
+          ↓ Step 3/3: Publish
 For each repo listed:
-  - Clone if missing (optional)
-  - Checkout branch (dev for test, main for stable)
   - npm install
-  - afterInstall with @test or @latest tags (with fallback)
-  
-  [Stable mode only: Check skip logic]
-    - Compare origin/dev vs main
-    - If dev has new commits → merge origin/dev into main with [skip ci]
-    - If no changes and --branch not specified → skip this repo
-  
-  [Test mode: always continues]
-  
-  - npm test
-  - npm run build
-  - npm version (bump patch/minor/major/prerelease)
-  - npm publish (to npm registry with @test or @latest tag)
-  - git push + tags (stable only)
-          ↓
-Generates release-summary.json
+  - npm version (bump patch/minor/major)
+  - npm publish (@latest tag)
+  - git push + tags all at once
 ```
 
+**Old two-step flow (still supported for manual workflows):**
+- Step 1: `mode=stable-prepare-pr` - creates PR, human reviews/merges
+- Step 2: `mode=stable-publish` - requires manual merge first
+
+**New unified flow (recommended):**
+- Single `mode=stable-publish` - does all three: create PR, auto-merge, publish
+
 ## Key Points
 
 - **Individual repos need nothing special** — they just need `package.json` and npm scripts
@@ -115,7 +108,21 @@ node scripts/release-orchestrator.js --mode test --dry-run=true
 - **Always publishes** (no skip logic)
 - **Use case:** Pre-release versions for testing from dev branch
 
-**Scenario 3: GitHub Stable Release**
+**Scenario 3: GitHub Stable Release (Protected Branches)**
+- Click Actions → "Solidos Release" → Run workflow
+- Inputs: mode=stable-publish, dry_run=false
+- **Single command that does everything:**
+  1. Creates release branch from dev
+  2. Opens PR to main
+  3. Waits for CI checks to pass
+  4. Auto-merges PR (squash merge)
+  5. Publishes all packages to npm with `@latest` tag
+  6. Pushes git tags to main
+- Eliminates manual PR merge step
+- **Perfect for:** Organizations with branch protection rules on `main`
+- **Use case:** Automated stable releases without human intervention on PR merge
+
+**Scenario 4: GitHub Stable Release (Direct Push)**
 - Click Actions → "Solidos Release" → Run workflow
 - Inputs: mode=stable, dry_run=false
 - Automatically merges origin/dev → main if dev has new commits
@@ -123,7 +130,8 @@ node scripts/release-orchestrator.js --mode test --dry-run=true
 - Creates git tags and pushes to GitHub
 - Results in GitHub Actions logs and artifacts
 - Skips if dev has no new commits (unless --branch=main specified)
-- **Use case:** Production releases to @latest
+- **WARNING:** Requires write access to protected branches, may fail with 403
+- **Use case:** Repositories without branch protection on `main`
 
 Local dry-run
 - Show the exact commands without running them:
diff --git a/RELEASE-STATUS.md b/RELEASE-STATUS.md
new file mode 100644
index 0000000..ec6e7b7
--- /dev/null
+++ b/RELEASE-STATUS.md
@@ -0,0 +1,429 @@
+# Release Orchestrator - Current Status
+
+**Date:** March 20, 2026  
+**Status:** ✅ Single source of truth adopted for `latest` publish: repository `ci.yml` on `main`
+
+---
+
+## Checkpoint (March 20, 2026 - latest)
+
+Final decision for stable releases:
+- `stable-publish` in orchestrator now stops after PR merge.
+- `latest` publication is delegated to each target repository's `ci.yml` on `main`.
+- This removes duplicate publish attempts (orchestrator + repo CI) and keeps one publisher for `latest`.
+
+Implemented commit in `solidos`:
+- `8b1a5ef` — `refactor(release): delegate stable-publish latest publish to repo CI`
+
+Versioning policy clarification:
+- Source of truth for release version is `main`, not npm latest lookup.
+- `stable-publish` should bump from `main` state and merge that bump via PR.
+
+Next run planned:
+1. Execute `release.yml` on branch `release` for `pane-registry` in `stable-publish` mode.
+2. Expect orchestrator summary status `published-by-repo-ci` (no direct npm publish in step 3).
+3. Confirm `pane-registry` `ci.yml` on `main` performs the single `latest` publish.
+
+---
+
+## Checkpoint (March 20, 2026 - final)
+
+**BREAKTHROUGH**: `stable-publish` now successfully creates release PR, triggers required CI checks, merges, and completes step 2/3.
+
+### Problem Solved
+- Required checks (`build (22)` / `build (24)`) were configured on `main` ruleset but not triggering for release PRs.
+- Cause: `ci.yml` listeners to `pull_request` event, which only fires on natural PR creation; orchestrator was trying workflow dispatch (wrong event type).
+- Solution: Force-push an empty commit to the release branch → GitHub re-fires `pull_request` event → CI runs and checks post back to PR → merge proceeds.
+
+### Changes in orchestrator
+- Commit `375b0cc`: Added `git reset --hard && git clean -fd` before checkout to handle uncommitted changes left after empty-commit force-push.
+- Earlier commits: CI-trigger via empty commit (commit `93b14ca`), transient error handling, required-checks diagnostics.
+
+### Result (from last run, PR #228)
+```
+Found PR #228. Requesting auto-merge...
+  PR #228: state=OPEN, mergeState=BLOCKED, review=UNKNOWN, pendingChecks=0, failingChecks=0
+  PR #228: state=OPEN, mergeState=BLOCKED, review=UNKNOWN, pendingChecks=0, failingChecks=0
+... (2 poll cycles) ...
+  Pushed empty commit to release/solid-logic-202603201747 to trigger PR CI checks.
+  PR #228: state=OPEN, mergeState=BLOCKED, review=UNKNOWN, pendingChecks=2, failingChecks=0
+  PR #228: state=OPEN, mergeState=BLOCKED, review=UNKNOWN, pendingChecks=1, failingChecks=0
+  PR #228: state=MERGED, mergeState=UNKNOWN, review=UNKNOWN, pendingChecks=1, failingChecks=0
+PR #228 merged at 2026-03-20T17:49:44Z.
+```
+✅ **PR merged successfully.**
+
+The only remaining error was `git checkout main` due to dirty working tree, which is now fixed by commit `375b0cc`.
+
+### Future optimization
+- User suggestion: Run CI earlier (before version bump) so it's ready when PR opens, avoiding need for empty-commit re-trigger.
+- Feasibility: Needs testing; could reduce merge wait time from ~2min to ~30s.
+- Implementation: Create release branch, push immediately, PR opens → CI runs → version bump → PR auto-merges (if CI passes quickly).
+
+---
+## Latest Test Run Results
+
+```
+Release summary:
+- profile-pane: published 3.1.2-test.5 (test)
+- solid-panes: published 4.2.3-test.0 (test)
+- mashlib: published 2.1.3-test.0 (test)
+Summary written to /home/runner/work/solidos/solidos/release-summary.json
+```
+
+## Authentication Setup (RESOLVED)
+
+### Individual Repos (SolidOS org)
+- **ci.yml workflows** use OIDC authentication
+- `permissions: id-token: write`
+- No secrets needed
+- npm trusted publisher: `SolidOS/solid-panes` → `solid-panes` package
+- Works perfectly with npm provenance
+
+### Central Orchestrator (solidos/solidos repo)
+- **release.yml** uses manual token (`NODE_AUTH_TOKEN`)
+- Cannot use OIDC due to npm limitation: **one trusted publisher per package**
+- Packages already trust their individual repos, can't add second trusted publisher
+- Token requires: Granular Access Token with "Bypass 2FA" permission ✅
+- Added `--no-provenance` flag to prevent provenance conflicts
+
+**Why solid-panes had 403 but profile-pane worked:**
+- solid-panes was published with provenance via OIDC before
+- npm expected provenance on subsequent publishes
+- Manual token can't provide provenance
+- Solution: `--no-provenance` flag explicitly opts out
+
+---
+
+## Clarified Objectives (March 19, 2026)
+
+1. Stable releases should be published from `main` (or an equivalent production branch), not from feature/dev branches.
+2. `stable-prepare-pr` should focus on preparing a merge path from development branch to `main` and surfacing merge conflicts early.
+3. `stable-publish` should run after `main` is updated, then version and publish from that updated `main` state.
+4. Branch override remains available for special cases, but the default and recommended stable target is `main`.
+
+### ✅ Completed Features
+
+1. **Mode-specific npm tag injection**
+   - Test mode: `npm install pkg@test || npm install pkg@latest`
+   - Stable mode: `npm install pkg@latest`
+   - Fallback pattern works correctly
+
+2. **Skip logic**
+   - Test mode: Always publishes (no skip)
+   - Stable mode: Compares `origin/dev` vs `main`, skips if identical
+   - `--branch` parameter overrides skip logic
+
+3. **Auto-merge for direct stable mode**
+   - Merges `origin/dev` → `main` before publishing
+   - Commit message includes `[skip ci]` to prevent triggering individual ci.yml
+
+4. **Stable publish PR flow (current implementation)**
+  - `mode=stable-publish` creates a release branch from the selected target branch, bumps version there, opens PR, auto-merges, then publishes from the merged target branch.
+  - This supports protected branches and guarantees publish happens after target branch is updated.
+  - Merge mode is `--merge` (not squash) to preserve release/version commit history.
+
+5. **Version collision handling**
+   - Test mode: Checks if version exists, auto-bumps up to 5 times
+   - Stable mode: Standard bump
+
+6. **Lifecycle scripts disabled**
+  - `--ignore-scripts` on `npm publish` prevents postpublish git push
+  - `npm version ... --ignore-scripts` avoids dirty working tree issues
+
+7. **Enhanced summary output**
+   - JSON includes: `packageName`, `version`, `tag`, `publishedAs`
+   - Written to `release-summary.json`
+
+8. **Branch checkout improvements**
+   - `git fetch --all` gets remote branches
+   - `git switch` with fallback to create from origin
+
+9. **Dry-run improvements**
+   - Allows untracked files (friendly for local testing)
+
+10. **Authentication**
+   - release.yml uses `NODE_AUTH_TOKEN`
+   - npm updated to latest in workflow
+   - `--no-provenance` flag added to both publish commands
+
+11. **CI git auth hardening**
+  - Uses `GIT_PUSH_TOKEN` (preferred) and falls back to `GITHUB_TOKEN`
+  - Authenticated clone URLs in runner mode
+  - Preflight push check for direct stable mode to fail early on permission issues
+
+---
+
+## How Stable Mode Decides Whether to Publish
+
+For each repo, the orchestrator runs this decision tree:
+
+```
+git rev-list --count main..origin/dev
+      │
+      ├─ 0 commits ahead ──► SKIP (already up to date)
+      │
+      └─ N commits ahead ──► MERGE + PUBLISH
+             │
+             ├─ git merge origin/dev  (local, inside runner clone)
+             ├─ lock dependency versions in package.json
+             ├─ git commit [skip ci]
+             ├─ npm version patch      (bumps version + git tag)
+             ├─ npm publish
+             ├─ wait for npm registry propagation
+             └─ git push origin main --follow-tags
+```
+
+**Override behaviour (direct stable mode):**
+- `--branch <name>` on the CLI → skip the commit-count check entirely; always merge + publish
+- `skipIfNoDiff: false` in config → same; always merge + publish
+- Dry-run → commit-count check is also skipped (no real git state exists)
+
+---
+
+## Protected Branch Flow (Recommended)
+
+When branch protection forbids direct push to `main`, the intended workflow is:
+
+1. `mode=stable-prepare-pr`
+  - Prepare/validate merge path from `dev` (or configured integration branch) into `main`
+  - Surface merge conflicts early (without publishing)
+2. Merge PR to `main` (manual or auto-merge policy)
+3. `mode=stable-publish`
+  - Version and publish from updated `main`
+
+This keeps stable publication tied to `main` history and works with "PR required" rulesets.
+
+Note: An optional enhancement under consideration is auto-merge during `stable-prepare-pr` to turn it into a conflict-check + merge stage before publish.
+
+---
+
+## Open Questions / Pending Decisions
+
+### 0. gh CLI vs direct git push for main ✅ RESOLVED
+
+**The problem:**  
+The orchestrator currently merges `origin/dev` into `main` locally and then pushes:
+```bash
+git merge origin/dev -m "Merge dev into main for release [skip ci]"
+# ... version bump, publish ...
+git push origin main --follow-tags
+```
+
+**This works only if** the runner's token can push directly to `main`.  
+If any SolidOS repo has a branch protection rule that requires pull requests (no direct push), this will fail with a 403.
+
+**Two options:**
+
+**Option A — Direct push (current approach)**  
+- Works when branch protection allows the token or PAT to bypass.
+- Requires `GIT_PUSH_TOKEN` (a PAT with "Allow bypassing branch protection") or repo rules configured to allow the Actions bot.
+- Simpler code, no PR trail.
+
+**Option B — PR-based merge via `gh` CLI**  
+```bash
+gh pr create --base main --head dev --title "Release [skip ci]" --body "Automated stable release"
+gh pr merge --merge --auto
+```
+- Works even with strict branch protection ("Require a pull request before merging").
+- Creates an audit trail (PR per release).
+- Requires `gh` auth in the runner (`gh auth login` or `GH_TOKEN` env var).
+- More complex: need to wait for PR to merge before continuing with publish.
+
+**Outcome:**
+- SolidOS repos use branch protection requiring PR before merge.
+- Two-step stable flow was implemented (`stable-prepare-pr` + `stable-publish`).
+- Direct `stable` mode remains available only for repos/environments that allow direct push.
+
+---
+
+### 1. Release Summary Artifact ⏳
+
+**Current:** `release-summary.json` created but deleted after workflow ends
+
+**Options:**
+- **A. Upload as artifact** (recommended)
+  ```yaml
+  - name: Upload release summary
+    uses: actions/upload-artifact@v4
+    if: always()
+    with:
+      name: release-summary
+      path: release-summary.json
+      retention-days: 30
+  ```
+  Download from Actions tab → Workflow run → Artifacts section (bottom of page)
+
+- **B. Cat in logs** (simple)
+  ```yaml
+  - name: Show release summary
+    if: always()
+    run: cat release-summary.json || echo "No summary generated"
+  ```
+
+- **C. Commit back to repo** (complex, probably overkill)
+
+**Decision needed:** Which approach to implement?
+
+---
+
+### 2. Dependency Updates in Stable Mode ✅ IMPLEMENTED
+
+**Current behavior:**
+- Test mode: Dependencies are not locked in package.json (ephemeral behavior remains)
+- Stable mode: Dependencies installed by `afterInstall` are now locked before publish
+
+**Implemented algorithm (stable mode):**
+```javascript
+// After running afterInstall in stable mode:
+1. Parse afterInstall commands to find installed packages
+2. Get actual installed version from node_modules
+3. Update package.json dependencies to exact version
+4. npm install (to update package-lock.json)
+5. git commit with [skip ci]
+6. THEN do version bump and publish
+```
+
+**Example result:**
+```json
+{
+  "version": "4.2.3",
+  "dependencies": {
+    "profile-pane": "3.1.2"  // Exact version tested
+  }
+}
+```
+
+**Defaults implemented:**
+- Exact pins for reproducibility (no prefix)
+- Update `dependencies` and `devDependencies` when keys already exist
+- Order A: lock deps and commit first, then version bump and publish
+
+**Optional config knobs supported:**
+- `lockDependencyFields` (array)
+- `lockDependencyPrefix` (string)
+- `lockInstallCommand` (string)
+- `lockCommitMessage` (string)
+
+---
+
+## Configuration Files
+
+### release.config.json
+```json
+{
+  "modes": [
+    {
+      "name": "test",
+      "branch": "dev",
+      "versionBump": "prerelease",
+      "preid": "test",
+      "npmTag": "test"
+    },
+    {
+      "name": "stable",
+      "branch": "main",
+      "versionBump": "patch",
+      "npmTag": "latest"
+    }
+  ],
+  "repos": [
+    {
+      "name": "profile-pane",
+      "path": "../profile-pane",
+      "afterInstall": []
+    },
+    {
+      "name": "solid-panes",
+      "path": "../solid-panes",
+      "afterInstall": ["npm install profile-pane@latest"]
+    },
+    {
+      "name": "mashlib",
+      "path": "../mashlib",
+      "afterInstall": [
+        "npm install solid-panes@latest",
+        "npm install profile-pane@latest"
+      ]
+    }
+  ]
+}
+```
+
+### Key files modified:
+- `scripts/release-orchestrator.js` - Core logic
+- `.github/workflows/release.yml` - GitHub Actions workflow
+- `RELEASE-HOWTO.md` - Documentation
+
+---
+
+## Known Issues / Limitations
+
+1. **Git credentials in CI:** Currently relies on GITHUB_TOKEN for git operations
+2. **npm token permissions:** Requires "Bypass 2FA" for publishing
+3. **Single trusted publisher limit:** Cannot use OIDC for central orchestrator
+4. **Dependencies not locked:** Resolved for stable mode in orchestrator implementation
+
+---
+
+## Testing Checklist
+
+After implementing dependency locking:
+
+- [ ] Test mode publishes correctly with @test tag
+- [ ] Test mode behavior remains as expected for prerelease publishes
+- [ ] Stable mode auto-merges dev → main
+- [ ] Stable mode updates dependencies to exact versions
+- [ ] Stable mode commits with [skip ci]
+- [ ] Stable mode publishes with locked dependencies
+- [ ] Verify published packages have correct dependency versions on npm
+- [ ] Test fallback pattern: `npm install pkg@test || npm install pkg@latest`
+
+---
+
+## Questions for Tomorrow
+
+1. **Artifact upload:** Which option for release-summary.json?
+2. **Dependency locking:** Exact pins or caret ranges?
+3. **Which dependency fields:** dependencies only, or also devDependencies?
+4. **Verification:** Should we add `npm ls` check after afterInstall to log what was installed?
+
+---
+
+## Quick Reference
+
+### Run test publish:
+```bash
+# From solidos repo
+node scripts/release-orchestrator.js \
+  --config release.config.json \
+  --mode test \
+  --dry-run=false \
+  --clone-missing=true
+```
+
+### Run stable publish:
+```bash
+node scripts/release-orchestrator.js \
+  --config release.config.json \
+  --mode stable \
+  --dry-run=false \
+  --clone-missing=true
+```
+
+### Check published versions:
+```bash
+npm view solid-panes@test
+npm view profile-pane@test
+npm view mashlib@test
+npm dist-tag ls solid-panes
+```
+
+---
+
+## Contact / References
+
+- Main repo: https://github.com/solidos/solidos
+- Individual repos: SolidOS org
+- Documentation: RELEASE-HOWTO.md
+- This status: RELEASE-STATUS.md
diff --git a/release.config.from-chat-pane.json b/release.config.from-chat-pane.json
new file mode 100644
index 0000000..96af9da
--- /dev/null
+++ b/release.config.from-chat-pane.json
@@ -0,0 +1,98 @@
+{
+  "defaultBranch": "main",
+  "skipIfNoDiff": true,
+  "defaultInstall": "npm install",
+  "defaultTest": "npm test",
+  "defaultBuild": "npm run build",
+  "modes": {
+    "stable": {
+      "branch": "main",
+      "versionBump": "patch",
+      "npmTag": "latest",
+      "gitTag": true,
+      "gitPush": true
+    },
+    "test": {
+      "branch": "dev",
+      "versionBump": "prerelease",
+      "preid": "test",
+      "npmTag": "test",
+      "gitTag": false,
+      "gitPush": false
+    }
+  },
+  "repos": [
+    {
+      "name": "chat-pane",
+      "path": "workspaces/chat-pane",
+      "repo": "https://github.com/SolidOS/chat-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "folder-pane",
+      "path": "workspaces/folder-pane",
+      "repo": "https://github.com/SolidOS/folder-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "issue-pane",
+      "path": "workspaces/issue-pane",
+      "repo": "https://github.com/SolidOS/issue-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "meeting-pane",
+      "path": "workspaces/meeting-pane",
+      "repo": "https://github.com/SolidOS/meeting-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "contacts-pane",
+      "path": "workspaces/contacts-pane",
+      "repo": "https://github.com/SolidOS/contacts-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "profile-pane",
+      "path": "workspaces/profile-pane",
+      "repo": "https://github.com/SolidOS/profile-pane.git",
+      "afterInstall": [
+        "npm install chat-pane solid-ui pane-registry solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "source-pane",
+      "path": "workspaces/source-pane",
+      "repo": "https://github.com/SolidOS/source-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "solid-panes",
+      "path": "workspaces/solid-panes",
+      "repo": "https://github.com/SolidOS/solid-panes.git",
+      "afterInstall": [
+          "npm install activitystreams-pane chat-pane contacts-pane folder-pane issue-pane meeting-pane pane-registry profile-pane source-pane solid-ui solid-logic solid-namespace@latest rdflib@latest"
+      ]
+    },
+    {
+      "name": "mashlib",
+      "path": "workspaces/mashlib",
+      "repo": "https://github.com/SolidOS/mashlib.git",
+      "afterInstall": [
+        "npm install solid-panes solid-ui solid-logic rdflib@latest"
+      ]
+    }
+  ]
+}
diff --git a/release.config.from-folder-pane.json b/release.config.from-folder-pane.json
new file mode 100644
index 0000000..15408cc
--- /dev/null
+++ b/release.config.from-folder-pane.json
@@ -0,0 +1,90 @@
+{
+  "defaultBranch": "main",
+  "skipIfNoDiff": true,
+  "defaultInstall": "npm install",
+  "defaultTest": "npm test",
+  "defaultBuild": "npm run build",
+  "modes": {
+    "stable": {
+      "branch": "main",
+      "versionBump": "patch",
+      "npmTag": "latest",
+      "gitTag": true,
+      "gitPush": true
+    },
+    "test": {
+      "branch": "dev",
+      "versionBump": "prerelease",
+      "preid": "test",
+      "npmTag": "test",
+      "gitTag": false,
+      "gitPush": false
+    }
+  },
+  "repos": [
+    {
+      "name": "folder-pane",
+      "path": "workspaces/folder-pane",
+      "repo": "https://github.com/SolidOS/folder-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "issue-pane",
+      "path": "workspaces/issue-pane",
+      "repo": "https://github.com/SolidOS/issue-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "meeting-pane",
+      "path": "workspaces/meeting-pane",
+      "repo": "https://github.com/SolidOS/meeting-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "contacts-pane",
+      "path": "workspaces/contacts-pane",
+      "repo": "https://github.com/SolidOS/contacts-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "profile-pane",
+      "path": "workspaces/profile-pane",
+      "repo": "https://github.com/SolidOS/profile-pane.git",
+      "afterInstall": [
+        "npm install chat-pane solid-ui pane-registry solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "source-pane",
+      "path": "workspaces/source-pane",
+      "repo": "https://github.com/SolidOS/source-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "solid-panes",
+      "path": "workspaces/solid-panes",
+      "repo": "https://github.com/SolidOS/solid-panes.git",
+      "afterInstall": [
+          "npm install activitystreams-pane chat-pane contacts-pane folder-pane issue-pane meeting-pane pane-registry profile-pane source-pane solid-ui solid-logic solid-namespace@latest rdflib@latest"
+      ]
+    },
+    {
+      "name": "mashlib",
+      "path": "workspaces/mashlib",
+      "repo": "https://github.com/SolidOS/mashlib.git",
+      "afterInstall": [
+        "npm install solid-panes solid-ui solid-logic rdflib@latest"
+      ]
+    }
+  ]
+}
diff --git a/release.config.from-issue-pane.json b/release.config.from-issue-pane.json
new file mode 100644
index 0000000..5fd3e0f
--- /dev/null
+++ b/release.config.from-issue-pane.json
@@ -0,0 +1,82 @@
+{
+  "defaultBranch": "main",
+  "skipIfNoDiff": true,
+  "defaultInstall": "npm install",
+  "defaultTest": "npm test",
+  "defaultBuild": "npm run build",
+  "modes": {
+    "stable": {
+      "branch": "main",
+      "versionBump": "patch",
+      "npmTag": "latest",
+      "gitTag": true,
+      "gitPush": true
+    },
+    "test": {
+      "branch": "dev",
+      "versionBump": "prerelease",
+      "preid": "test",
+      "npmTag": "test",
+      "gitTag": false,
+      "gitPush": false
+    }
+  },
+  "repos": [
+    {
+      "name": "issue-pane",
+      "path": "workspaces/issue-pane",
+      "repo": "https://github.com/SolidOS/issue-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "meeting-pane",
+      "path": "workspaces/meeting-pane",
+      "repo": "https://github.com/SolidOS/meeting-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "contacts-pane",
+      "path": "workspaces/contacts-pane",
+      "repo": "https://github.com/SolidOS/contacts-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "profile-pane",
+      "path": "workspaces/profile-pane",
+      "repo": "https://github.com/SolidOS/profile-pane.git",
+      "afterInstall": [
+        "npm install chat-pane solid-ui pane-registry solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "source-pane",
+      "path": "workspaces/source-pane",
+      "repo": "https://github.com/SolidOS/source-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "solid-panes",
+      "path": "workspaces/solid-panes",
+      "repo": "https://github.com/SolidOS/solid-panes.git",
+      "afterInstall": [
+          "npm install activitystreams-pane chat-pane contacts-pane folder-pane issue-pane meeting-pane pane-registry profile-pane source-pane solid-ui solid-logic solid-namespace@latest rdflib@latest"
+      ]
+    },
+    {
+      "name": "mashlib",
+      "path": "workspaces/mashlib",
+      "repo": "https://github.com/SolidOS/mashlib.git",
+      "afterInstall": [
+        "npm install solid-panes solid-ui solid-logic rdflib@latest"
+      ]
+    }
+  ]
+}
diff --git a/release.config.from-solid-panes.json b/release.config.from-solid-panes.json
new file mode 100644
index 0000000..9ee734d
--- /dev/null
+++ b/release.config.from-solid-panes.json
@@ -0,0 +1,42 @@
+{
+  "defaultBranch": "main",
+  "skipIfNoDiff": true,
+  "defaultInstall": "npm install",
+  "defaultTest": "npm test",
+  "defaultBuild": "npm run build",
+  "modes": {
+    "stable": {
+      "branch": "main",
+      "versionBump": "patch",
+      "npmTag": "latest",
+      "gitTag": true,
+      "gitPush": true
+    },
+    "test": {
+      "branch": "dev",
+      "versionBump": "prerelease",
+      "preid": "test",
+      "npmTag": "test",
+      "gitTag": false,
+      "gitPush": false
+    }
+  },
+  "repos": [
+    {
+      "name": "solid-panes",
+      "path": "workspaces/solid-panes",
+      "repo": "https://github.com/SolidOS/solid-panes.git",
+      "afterInstall": [
+          "npm install activitystreams-pane chat-pane contacts-pane folder-pane issue-pane meeting-pane pane-registry profile-pane source-pane solid-ui solid-logic solid-namespace@latest rdflib@latest"
+      ]
+    },
+    {
+      "name": "mashlib",
+      "path": "workspaces/mashlib",
+      "repo": "https://github.com/SolidOS/mashlib.git",
+      "afterInstall": [
+        "npm install solid-panes solid-ui solid-logic rdflib@latest"
+      ]
+    }
+  ]
+}
diff --git a/release.config.from-solid-ui.json b/release.config.from-solid-ui.json
new file mode 100644
index 0000000..83a9484
--- /dev/null
+++ b/release.config.from-solid-ui.json
@@ -0,0 +1,114 @@
+{
+  "defaultBranch": "main",
+  "skipIfNoDiff": true,
+  "defaultInstall": "npm install",
+  "defaultTest": "npm test",
+  "defaultBuild": "npm run build",
+  "modes": {
+    "stable": {
+      "branch": "main",
+      "versionBump": "patch",
+      "npmTag": "latest",
+      "gitTag": true,
+      "gitPush": true
+    },
+    "test": {
+      "branch": "dev",
+      "versionBump": "prerelease",
+      "preid": "test",
+      "npmTag": "test",
+      "gitTag": false,
+      "gitPush": false
+    }
+  },
+  "repos": [
+    {
+      "name": "solid-ui",
+      "path": "workspaces/solid-ui",
+      "repo": "https://github.com/SolidOS/solid-ui.git",
+      "afterInstall": [
+        "npm install pane-registry@latest solid-logic@latest rdflib@latest solid-namespace@latest"
+      ]
+    },
+    {
+      "name": "activitystreams-pane",
+      "path": "workspaces/activitystreams-pane",
+      "repo": "https://github.com/SolidOS/activitystreams-pane.git",
+      "afterInstall": [
+        "npm install solid-ui pane-registry solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "chat-pane",
+      "path": "workspaces/chat-pane",
+      "repo": "https://github.com/SolidOS/chat-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "folder-pane",
+      "path": "workspaces/folder-pane",
+      "repo": "https://github.com/SolidOS/folder-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "issue-pane",
+      "path": "workspaces/issue-pane",
+      "repo": "https://github.com/SolidOS/issue-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "meeting-pane",
+      "path": "workspaces/meeting-pane",
+      "repo": "https://github.com/SolidOS/meeting-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "contacts-pane",
+      "path": "workspaces/contacts-pane",
+      "repo": "https://github.com/SolidOS/contacts-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "profile-pane",
+      "path": "workspaces/profile-pane",
+      "repo": "https://github.com/SolidOS/profile-pane.git",
+      "afterInstall": [
+        "npm install chat-pane solid-ui pane-registry solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "source-pane",
+      "path": "workspaces/source-pane",
+      "repo": "https://github.com/SolidOS/source-pane.git",
+      "afterInstall": [
+        "npm install solid-ui solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "solid-panes",
+      "path": "workspaces/solid-panes",
+      "repo": "https://github.com/SolidOS/solid-panes.git",
+      "afterInstall": [
+          "npm install activitystreams-pane chat-pane contacts-pane folder-pane issue-pane meeting-pane pane-registry profile-pane source-pane solid-ui solid-logic solid-namespace@latest rdflib@latest"
+      ]
+    },
+    {
+      "name": "mashlib",
+      "path": "workspaces/mashlib",
+      "repo": "https://github.com/SolidOS/mashlib.git",
+      "afterInstall": [
+        "npm install solid-panes solid-ui solid-logic rdflib@latest"
+      ]
+    }
+  ]
+}
diff --git a/release.config.json b/release.config.json
index e9c28ba..fe4ea8b 100644
--- a/release.config.json
+++ b/release.config.json
@@ -114,7 +114,6 @@
       "name": "solid-panes",
       "path": "workspaces/solid-panes",
       "repo": "https://github.com/SolidOS/solid-panes.git",
-      "build": "npm run clean && npm run build-version && npm run typecheck && babel src --out-dir dist --extensions '.ts,.js' --source-maps && tsc --emitDeclarationOnly && npm run postbuild-js",
       "afterInstall": [
           "npm install activitystreams-pane chat-pane contacts-pane folder-pane issue-pane meeting-pane pane-registry profile-pane source-pane solid-ui solid-logic solid-namespace@latest rdflib@latest"
       ]
diff --git a/release.config.milestone2k.json b/release.config.milestone2k.json
new file mode 100644
index 0000000..fd6ca01
--- /dev/null
+++ b/release.config.milestone2k.json
@@ -0,0 +1,50 @@
+{
+  "defaultBranch": "main",
+  "skipIfNoDiff": true,
+  "defaultInstall": "npm install",
+  "defaultTest": "npm test",
+  "defaultBuild": "npm run build",
+  "modes": {
+    "stable": {
+      "branch": "main",
+      "versionBump": "patch",
+      "npmTag": "latest",
+      "gitTag": true,
+      "gitPush": true
+    },
+    "test": {
+      "branch": "dev",
+      "versionBump": "prerelease",
+      "preid": "test",
+      "npmTag": "test",
+      "gitTag": false,
+      "gitPush": false
+    }
+  },
+  "repos": [
+    {
+      "name": "pane-registry",
+      "path": "workspaces/pane-registry",
+      "repo": "https://github.com/SolidOS/pane-registry.git",
+      "afterInstall": [
+        "npm install solid-logic rdflib@latest"
+      ]
+    },
+    {
+      "name": "solid-panes",
+      "path": "workspaces/solid-panes",
+      "repo": "https://github.com/SolidOS/solid-panes.git",
+      "afterInstall": [
+          "npm install activitystreams-pane chat-pane contacts-pane folder-pane issue-pane meeting-pane pane-registry profile-pane source-pane solid-ui solid-logic solid-namespace@latest rdflib@latest"
+      ]
+    },
+    {
+      "name": "mashlib",
+      "path": "workspaces/mashlib",
+      "repo": "https://github.com/SolidOS/mashlib.git",
+      "afterInstall": [
+        "npm install solid-panes solid-ui solid-logic rdflib@latest"
+      ]
+    }
+  ]
+}
diff --git a/release.pane-registry.config.json b/release.pane-registry.config.json
new file mode 100644
index 0000000..855d822
--- /dev/null
+++ b/release.pane-registry.config.json
@@ -0,0 +1,34 @@
+{
+  "defaultBranch": "main",
+  "skipIfNoDiff": true,
+  "defaultInstall": "npm install",
+  "defaultTest": "npm test",
+  "defaultBuild": "npm run build",
+  "modes": {
+    "stable": {
+      "branch": "main",
+      "versionBump": "patch",
+      "npmTag": "latest",
+      "gitTag": true,
+      "gitPush": true
+    },
+    "test": {
+      "branch": "dev",
+      "versionBump": "prerelease",
+      "preid": "test",
+      "npmTag": "test",
+      "gitTag": false,
+      "gitPush": false
+    }
+  },
+  "repos": [
+    {
+      "name": "pane-registry",
+      "path": "workspaces/pane-registry",
+      "repo": "https://github.com/SolidOS/pane-registry.git",
+      "afterInstall": [
+        "npm install solid-logic@latest rdflib@latest"
+      ]
+    }
+  ]
+}
diff --git a/scripts/release-orchestrator.js b/scripts/release-orchestrator.js
index 396f8b2..ecf5223 100644
--- a/scripts/release-orchestrator.js
+++ b/scripts/release-orchestrator.js
@@ -23,6 +23,18 @@ function parseArgs(argv) {
   return args;
 }
 
+function sleepMs(ms) {
+  const duration = Math.max(0, Number(ms) || 0);
+  if (duration === 0) return;
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, duration);
+}
+
+function preferGhToken() {
+  if (process.env.GIT_PUSH_TOKEN && !process.env.GH_TOKEN) {
+    process.env.GH_TOKEN = process.env.GIT_PUSH_TOKEN;
+  }
+}
+
 function toBool(value, defaultValue = false) {
   if (value === undefined) return defaultValue;
   if (typeof value === 'boolean') return value;
@@ -138,6 +150,42 @@ function getPackageVersion(repoDir) {
   return pkg ? pkg.version : null;
 }
 
+function parseBaseSemver(version) {
+  const match = String(version || '').trim().match(/^(\d+)\.(\d+)\.(\d+)$/);
+  if (!match) return null;
+  return [
+    parseInt(match[1], 10),
+    parseInt(match[2], 10),
+    parseInt(match[3], 10)
+  ];
+}
+
+function compareBaseSemver(a, b) {
+  const parsedA = parseBaseSemver(a);
+  const parsedB = parseBaseSemver(b);
+  if (!parsedA || !parsedB) return null;
+
+  for (let i = 0; i < 3; i += 1) {
+    if (parsedA[i] > parsedB[i]) return 1;
+    if (parsedA[i] < parsedB[i]) return -1;
+  }
+  return 0;
+}
+
+function pickHighestBaseSemver(baseVersion, stableVersion) {
+  if (!stableVersion) return baseVersion;
+  const comparison = compareBaseSemver(baseVersion, stableVersion);
+  if (comparison === null) return baseVersion;
+  return comparison >= 0 ? baseVersion : stableVersion;
+}
+
+function incrementPatchSemver(version) {
+  const parsed = parseBaseSemver(version);
+  if (!parsed) return null;
+  parsed[2] += 1;
+  return `${parsed[0]}.${parsed[1]}.${parsed[2]}`;
+}
+
 function getModeConfig(config, modeName) {
   if (!config || !config.modes) return {};
   if (Array.isArray(config.modes)) {
@@ -152,6 +200,42 @@ function getModeBranch(config, modeName, fallback = null) {
   return fallback;
 }
 
+function remoteBranchExists(repoDir, branch) {
+  if (!branch) return false;
+  try {
+    const result = runQuiet(`git ls-remote --heads origin ${branch}`, repoDir);
+    return Boolean(result);
+  } catch (err) {
+    return false;
+  }
+}
+
+function getReleaseSourceBranch(repoDir, repo, config, targetBranch, dryRun) {
+  const stablePublishConfig = getModeConfig(config, 'stable-publish');
+  const stableConfig = getModeConfig(config, 'stable');
+  const configuredSourceBranch =
+    repo.releaseSourceBranch ||
+    repo.sourceBranch ||
+    stablePublishConfig.sourceBranch ||
+    stableConfig.sourceBranch ||
+    config.releaseSourceBranch ||
+    getModeBranch(config, 'test', null);
+
+  if (dryRun) {
+    return configuredSourceBranch || targetBranch;
+  }
+
+  if (configuredSourceBranch && remoteBranchExists(repoDir, configuredSourceBranch)) {
+    return configuredSourceBranch;
+  }
+
+  if (configuredSourceBranch && configuredSourceBranch !== targetBranch) {
+    console.log(`Warning: Release source branch '${configuredSourceBranch}' not found on origin. Falling back to '${targetBranch}'.`);
+  }
+
+  return targetBranch;
+}
+
 function hasScript(pkg, scriptName) {
   return !!(pkg && pkg.scripts && pkg.scripts[scriptName]);
 }
@@ -230,6 +314,451 @@ function withCiGitAuth(url) {
   return `https://x-access-token:${token}@github.com/${match[1]}`;
 }
 
+function parseGitHubRepoSlug(url) {
+  const raw = String(url || '').trim();
+  if (!raw) return null;
+  const withoutSuffix = raw.replace(/\.git$/i, '');
+  const match = withoutSuffix.match(/github\.com[:/]([^/]+\/[^/]+)$/i);
+  return match && match[1] ? match[1] : null;
+}
+
+function buildReleaseBranchName(repoName) {
+  const stamp = new Date().toISOString().replace(/[-:TZ.]/g, '').slice(0, 12);
+  const sanitized = String(repoName || 'repo').toLowerCase().replace(/[^a-z0-9._-]+/g, '-');
+  return `release/${sanitized}-${stamp}`;
+}
+
+function maybeCreatePullRequest(repoDir, repo, baseBranch, headBranch, dryRun, options = {}) {
+  const slug = parseGitHubRepoSlug(repo.repo || runQuiet('git remote get-url origin', repoDir));
+  const title = `Release: merge ${headBranch} into ${baseBranch}`;
+  const body = 'Automated stable release preparation.';
+  const required = toBool(options.required, false);
+
+  if (dryRun) {
+    console.log(`[dry-run] Would create PR for ${slug || repo.name}: ${headBranch} -> ${baseBranch}`);
+    return { status: 'dry-run' };
+  }
+
+  try {
+    runQuiet('gh --version', repoDir);
+  } catch (err) {
+    if (required) {
+      throw new Error('gh CLI not available in runner. Cannot create required release PR.');
+    }
+    console.log('gh CLI not available in runner. Skipping automatic PR creation.');
+    return { status: 'skipped', reason: 'no-gh-cli' };
+  }
+
+  try {
+    const repoArg = slug ? `--repo ${slug}` : '';
+    run(`gh pr create ${repoArg} --base ${baseBranch} --head ${headBranch} --title "${title}" --body "${body}"`.trim(), repoDir, dryRun);
+    return { status: 'created' };
+  } catch (err) {
+    if (required) {
+      throw new Error(
+        `PR create failed for ${repo.name}: ${err.message}. ` +
+        'Ensure GH_TOKEN/GIT_PUSH_TOKEN has access to target repo and Pull requests: Read and write permission.'
+      );
+    }
+    console.log(`PR create skipped for ${repo.name}: ${err.message}`);
+    return { status: 'skipped', reason: 'create-failed' };
+  }
+}
+
+function createReleaseBranch(repoDir, repo, baseBranch, dryRun) {
+  const releaseBranch = buildReleaseBranchName(repo.name);
+  ensureCiPushAccess(repoDir, releaseBranch, dryRun, { gitPush: true });
+  run(`git switch -c ${releaseBranch}`, repoDir, dryRun);
+  return releaseBranch;
+}
+
+function prepareStablePullRequest(repoDir, repo, config, branch, dryRun, branchOverride) {
+  const skipIfNoDiff = repo.skipIfNoDiff ?? config.skipIfNoDiff ?? true;
+  const shouldCheckDiff = !dryRun && skipIfNoDiff && !branchOverride;
+  const sourceBranch = getReleaseSourceBranch(repoDir, repo, config, branch, dryRun);
+
+  if (sourceBranch === branch) {
+    return {
+      status: dryRun ? 'dry-run' : 'skipped',
+      reason: dryRun ? null : 'source-equals-target',
+      releaseBranch: null,
+      sourceBranch,
+      targetBranch: branch
+    };
+  }
+
+  try {
+    runQuiet(`git fetch origin ${sourceBranch}:refs/remotes/origin/${sourceBranch}`, repoDir);
+  } catch (err) {
+    console.log(`Warning: Could not fetch ${sourceBranch}: ${err.message}`);
+  }
+
+  const commitsAhead = parseInt(runQuiet(`git rev-list --count ${branch}..origin/${sourceBranch}`, repoDir)) || 0;
+  if (shouldCheckDiff && commitsAhead === 0) {
+    return { status: 'skipped', reason: 'no-diff' };
+  }
+
+  const releaseBranch = buildReleaseBranchName(repo.name);
+  ensureCiPushAccess(repoDir, releaseBranch, dryRun, { gitPush: true });
+  run(`git switch -c ${releaseBranch}`, repoDir, dryRun);
+  run(`git merge origin/${sourceBranch} -m "Merge ${sourceBranch} into ${branch} for release [skip ci]"`, repoDir, dryRun);
+  run(`git push -u origin ${releaseBranch}`, repoDir, dryRun);
+  maybeCreatePullRequest(repoDir, repo, branch, releaseBranch, dryRun);
+
+  return {
+    status: dryRun ? 'dry-run' : 'prepared-pr',
+    releaseBranch,
+    sourceBranch,
+    targetBranch: branch
+  };
+}
+
+function ensureMainContainsStableChanges(repoDir, config, branch, dryRun) {
+  if (dryRun) return;
+  const sourceBranch = getReleaseSourceBranch(repoDir, {}, config, branch, dryRun);
+  if (sourceBranch === branch) return;
+  try {
+    runQuiet(`git fetch origin ${sourceBranch}:refs/remotes/origin/${sourceBranch}`, repoDir);
+    const commitsAhead = parseInt(runQuiet(`git rev-list --count ${branch}..origin/${sourceBranch}`, repoDir)) || 0;
+    if (commitsAhead > 0) {
+      throw new Error(
+        `${commitsAhead} commit(s) still in ${sourceBranch} but not in ${branch}. ` +
+        'Merge the release PR into main before running mode=stable-publish.'
+      );
+    }
+  } catch (err) {
+    if (err.message.includes('Merge the release PR')) {
+      throw err;
+    }
+    console.log(`Warning: Could not validate ${sourceBranch} vs ${branch}: ${err.message}`);
+  }
+}
+
+function waitForPRMerge(repoDir, repo, headBranch, baseBranch, dryRun, options = {}) {
+  const required = toBool(options.required, false);
+  if (dryRun) {
+    console.log(`[dry-run] Would wait for and merge PR: ${headBranch} -> ${baseBranch}`);
+    return { status: 'dry-run', prNumber: null };
+  }
+
+  const slug = parseGitHubRepoSlug(repo.repo || runQuiet('git remote get-url origin', repoDir));
+  if (!slug) {
+    if (required) {
+      throw new Error('Could not determine GitHub repo slug. Cannot merge required release PR.');
+    }
+    console.log('Warning: Could not determine GitHub repo slug. Skipping PR merge.');
+    return { status: 'skip', reason: 'no-slug' };
+  }
+
+  try {
+    runQuiet('gh --version', repoDir);
+  } catch (err) {
+    if (required) {
+      throw new Error('gh CLI not available in runner. Cannot merge required release PR.');
+    }
+    console.log('gh CLI not available in runner. Skipping automatic PR merge.');
+    return { status: 'skip', reason: 'no-gh-cli' };
+  }
+
+  try {
+    // Find the PR number for this head branch
+    const prQuery = `gh pr list --repo ${slug} --head ${headBranch} --base ${baseBranch} --state open --json number --jq '.[0].number'`;
+    let prNumber;
+    try {
+      prNumber = parseInt(runQuiet(prQuery, repoDir), 10);
+    } catch (err) {
+      if (required) {
+        throw new Error(`No open PR found for ${headBranch} -> ${baseBranch}`);
+      }
+      console.log(`No open PR found for ${headBranch} -> ${baseBranch}`);
+      return { status: 'skip', reason: 'no-pr' };
+    }
+
+    if (!prNumber) {
+      if (required) {
+        throw new Error(`No open PR found for ${headBranch} -> ${baseBranch}`);
+      }
+      console.log(`No open PR found for ${headBranch} -> ${baseBranch}`);
+      return { status: 'skip', reason: 'no-pr' };
+    }
+
+    let requiredCheckContexts = [];
+    try {
+      const rawContexts = runQuiet(
+        `gh api repos/${slug}/branches/${baseBranch}/protection --jq '.required_status_checks.checks[].context'`,
+        repoDir
+      );
+      requiredCheckContexts = String(rawContexts || '')
+        .split('\n')
+        .map((s) => s.trim())
+        .filter(Boolean);
+      if (requiredCheckContexts.length > 0) {
+        console.log(`Required status checks on ${baseBranch}: ${requiredCheckContexts.join(', ')}`);
+      }
+    } catch (err) {
+      // Rulesets API visibility varies by token/repo configuration; keep merge flow working even if introspection fails.
+      console.log(`Warning: Could not read required status checks for ${baseBranch}: ${err.message}`);
+    }
+
+    console.log(`Found PR #${prNumber}. Requesting auto-merge...`);
+    let autoMergeRequested = false;
+    try {
+      run(`gh pr merge ${prNumber} --repo ${slug} --merge --auto --delete-branch`.trim(), repoDir, dryRun);
+      autoMergeRequested = true;
+    } catch (err) {
+      const message = String(err.message || err);
+      // Some repos reject auto-merge requests while checks are still being initialized.
+      if (
+        /Repository rule violations found/i.test(message) ||
+        /required status checks are expected/i.test(message) ||
+        /required status check/i.test(message)
+      ) {
+        console.log(`  Auto-merge not accepted yet: ${message.split('\n')[0]}`);
+      } else {
+        throw err;
+      }
+    }
+
+    const maxWaitTime = 20 * 60 * 1000;
+    const pollInterval = 15 * 1000;
+    const startTime = Date.now();
+    let finalMergedAt = '';
+    let sawAnyChecks = false;
+    let blockedNoChecksCycles = 0;
+    const blockedNoChecksLimit = 8; // ~2 minutes at 15s polling
+    let ciKickoffAttempted = false;
+    const requiredChecksWorkflow = options.requiredChecksWorkflow || 'ci.yml';
+
+    const isTransientRuleViolation = (err) => {
+      const text = [
+        String(err && err.message ? err.message : ''),
+        String(err && err.stderr ? err.stderr : ''),
+        String(err && err.stdout ? err.stdout : '')
+      ].join('\n');
+      return (
+        /Repository rule violations found/i.test(text) ||
+        /required status checks are expected/i.test(text) ||
+        /required status check/i.test(text)
+      );
+    };
+
+    while ((Date.now() - startTime) < maxWaitTime) {
+      let payload;
+      try {
+        const query = `gh pr view ${prNumber} --repo ${slug} --json state,mergedAt,mergeStateStatus,reviewDecision,statusCheckRollup`;
+        payload = JSON.parse(runQuiet(query, repoDir) || '{}');
+      } catch (err) {
+        console.log(`  Warning reading PR state: ${err.message}`);
+        sleepMs(pollInterval);
+        continue;
+      }
+
+      const state = payload.state || 'UNKNOWN';
+      const mergedAt = payload.mergedAt || '';
+      const mergeStateStatus = payload.mergeStateStatus || 'UNKNOWN';
+      const reviewDecision = payload.reviewDecision || 'UNKNOWN';
+      const checks = Array.isArray(payload.statusCheckRollup) ? payload.statusCheckRollup : [];
+      if (checks.length > 0) {
+        sawAnyChecks = true;
+      }
+
+      const pendingChecks = checks.filter((c) => {
+        const s = String((c && c.status) || '').toUpperCase();
+        return s === 'PENDING' || s === 'IN_PROGRESS' || s === 'QUEUED' || s === 'EXPECTED';
+      }).length;
+
+      const failingChecks = checks.filter((c) => {
+        const conclusion = String((c && c.conclusion) || '').toUpperCase();
+        return conclusion === 'FAILURE' || conclusion === 'TIMED_OUT' || conclusion === 'CANCELLED' || conclusion === 'ACTION_REQUIRED';
+      }).length;
+
+      console.log(
+        `  PR #${prNumber}: state=${state}, mergeState=${mergeStateStatus}, review=${reviewDecision}, pendingChecks=${pendingChecks}, failingChecks=${failingChecks}`
+      );
+
+      if (mergeStateStatus === 'BLOCKED' && checks.length === 0 && pendingChecks === 0) {
+        blockedNoChecksCycles += 1;
+      } else {
+        blockedNoChecksCycles = 0;
+      }
+
+      // If the PR is blocked and no checks have appeared, force-push an empty commit to trigger PR CI.
+      // This re-triggers the pull_request event and materializes required checks on the PR.
+      if (!ciKickoffAttempted && blockedNoChecksCycles >= 2) {
+        try {
+          run(`git commit --allow-empty -m "Trigger CI checks"`, repoDir, dryRun);
+          run(`git push -f origin ${headBranch}`, repoDir, dryRun);
+          ciKickoffAttempted = true;
+          console.log(`  Pushed empty commit to ${headBranch} to trigger PR CI checks.`);
+        } catch (err) {
+          ciKickoffAttempted = true;
+          console.log(`  Warning: Could not push to ${headBranch}: ${err.message}`);
+        }
+      }
+
+      if (mergedAt) {
+        finalMergedAt = mergedAt;
+        break;
+      }
+
+      if (state === 'CLOSED') {
+        throw new Error(`PR #${prNumber} was closed without merge.`);
+      }
+
+      if (failingChecks > 0) {
+        throw new Error(`PR #${prNumber} has failing required checks.`);
+      }
+
+      if (blockedNoChecksCycles >= blockedNoChecksLimit) {
+        const requiredLabel = requiredCheckContexts.length > 0
+          ? ` Required checks configured: ${requiredCheckContexts.join(', ')}.`
+          : '';
+        throw new Error(
+          `PR #${prNumber} stayed BLOCKED with no status checks for ${(blockedNoChecksCycles * pollInterval) / 1000}s. ` +
+          `This usually means required checks are configured but not running for this PR (workflow trigger/path filter/permissions mismatch).` +
+          requiredLabel
+        );
+      }
+
+      // Retry requesting auto-merge once checks have started appearing.
+      if (!autoMergeRequested && (pendingChecks > 0 || sawAnyChecks)) {
+        try {
+          run(`gh pr merge ${prNumber} --repo ${slug} --merge --auto --delete-branch`.trim(), repoDir, dryRun);
+          autoMergeRequested = true;
+          console.log(`  Auto-merge request accepted for PR #${prNumber}.`);
+        } catch (err) {
+          console.log(`  Auto-merge still blocked: ${String((err && err.message) || err).split('\n')[0]}`);
+        }
+      }
+
+      // If checks have materialized and everything is green but merge is still blocked
+      // (e.g. review requirement), try admin merge. Do not do this before checks exist.
+      if (sawAnyChecks && checks.length > 0 && pendingChecks === 0 && mergeStateStatus === 'BLOCKED') {
+        try {
+          run(`gh pr merge ${prNumber} --repo ${slug} --merge --admin --delete-branch`.trim(), repoDir, dryRun);
+        } catch (err) {
+          if (!isTransientRuleViolation(err)) {
+            throw err;
+          }
+          console.log('  Admin merge blocked while checks/rules are still settling; will retry.');
+        }
+      }
+
+      sleepMs(pollInterval);
+    }
+
+    if (!finalMergedAt) {
+      finalMergedAt = runQuiet(`gh pr view ${prNumber} --repo ${slug} --json mergedAt --jq '.mergedAt // ""'`, repoDir).trim();
+    }
+
+    if (!finalMergedAt) {
+      throw new Error(`Timed out waiting for PR #${prNumber} to merge.`);
+    }
+
+    console.log(`PR #${prNumber} merged at ${finalMergedAt}.`);
+
+    // Clean working tree before switching branches (force-push of empty commit may leave local changes)
+    run(`git reset --hard`, repoDir, dryRun);
+    run(`git clean -fd`, repoDir, dryRun);
+
+    // Fetch the updated main branch
+    run(`git fetch origin ${baseBranch}`, repoDir, dryRun);
+    run(`git checkout ${baseBranch}`, repoDir, dryRun);
+    run(`git pull origin ${baseBranch}`, repoDir, dryRun);
+
+    return { status: 'merged', prNumber };
+  } catch (err) {
+    console.error(`Error during PR merge: ${err.message}`);
+    throw err;
+  }
+}
+
+function ensureCiPushAccess(repoDir, branch, dryRun, modeConfig = {}) {
+  if (process.env.GITHUB_ACTIONS !== 'true') return;
+  if (dryRun) return;
+  if (modeConfig.gitPush === false) return;
+
+  const tokenSource = process.env.GIT_PUSH_TOKEN ? 'GIT_PUSH_TOKEN' : (process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN' : null);
+  if (!tokenSource) {
+    throw new Error(`No git push token available for ${repoDir}. Configure GIT_PUSH_TOKEN or GITHUB_TOKEN in CI.`);
+  }
+
+  try {
+    runQuiet(`git push --dry-run origin HEAD:${branch}`, repoDir);
+  } catch (err) {
+    throw new Error(
+      `Push access check failed for branch '${branch}'. ` +
+      `The CI job is authenticated with ${tokenSource}, but that token cannot push to this repository/branch. ` +
+      `Use a fine-grained PAT in GIT_PUSH_TOKEN with Contents: Read and write on the target SolidOS repos, ` +
+      `and ensure branch protection allows that token/account to push.`
+    );
+  }
+}
+
+function waitForWorkflowSuccess(repoDir, repo, workflowRef, branch, headSha, dryRun, options = {}) {
+  if (dryRun) {
+    console.log(`[dry-run] Would wait for workflow ${workflowRef} on ${branch} at ${headSha}.`);
+    return { status: 'dry-run' };
+  }
+
+  const slug = parseGitHubRepoSlug(repo.repo || runQuiet('git remote get-url origin', repoDir));
+  if (!slug) {
+    throw new Error(`Could not determine GitHub repo slug. Cannot wait for workflow ${workflowRef}.`);
+  }
+
+  try {
+    runQuiet('gh --version', repoDir);
+  } catch (err) {
+    throw new Error(`gh CLI not available in runner. Cannot wait for workflow ${workflowRef}.`);
+  }
+
+  const maxWaitTime = options.timeoutMs || 20 * 60 * 1000;
+  const pollInterval = options.pollIntervalMs || 15 * 1000;
+  const startTime = Date.now();
+
+  while ((Date.now() - startTime) < maxWaitTime) {
+    let runs = [];
+    try {
+      const query = `gh run list --repo ${slug} --workflow ${workflowRef} --branch ${branch} --event push --limit 20 --json databaseId,headSha,status,conclusion,url,displayTitle`;
+      runs = JSON.parse(runQuiet(query, repoDir) || '[]');
+    } catch (err) {
+      console.log(`  Warning reading workflow state for ${workflowRef}: ${err.message}`);
+      sleepMs(pollInterval);
+      continue;
+    }
+
+    const matchingRun = Array.isArray(runs)
+      ? runs.find((runInfo) => String(runInfo.headSha || '').trim() === String(headSha || '').trim())
+      : null;
+
+    if (!matchingRun) {
+      console.log(`  Waiting for workflow ${workflowRef} on ${branch} for commit ${headSha} to start...`);
+      sleepMs(pollInterval);
+      continue;
+    }
+
+    const status = String(matchingRun.status || 'unknown');
+    const conclusion = String(matchingRun.conclusion || '');
+    console.log(`  Workflow ${workflowRef}: status=${status}, conclusion=${conclusion || 'pending'}`);
+
+    if (status !== 'completed') {
+      sleepMs(pollInterval);
+      continue;
+    }
+
+    if (conclusion === 'success') {
+      return { status: 'success', runId: matchingRun.databaseId || null, url: matchingRun.url || null };
+    }
+
+    throw new Error(
+      `Workflow ${workflowRef} failed for ${slug}@${headSha} with conclusion=${conclusion || 'unknown'}.` +
+      `${matchingRun.url ? ` See ${matchingRun.url}` : ''}`
+    );
+  }
+
+  throw new Error(`Timed out waiting for workflow ${workflowRef} on ${branch} for commit ${headSha}.`);
+}
+
 function getAheadBehind(repoDir, branch) {
   const raw = runQuiet(`git rev-list --left-right --count origin/${branch}...HEAD`, repoDir);
   const [behind, ahead] = raw.split('\t').map(Number);
@@ -357,7 +886,7 @@ function lockStableDependencyVersions(repoDir, repo, config, modeConfig, dryRun)
   }
 
   const lockFields = modeConfig.lockDependencyFields || config.lockDependencyFields || ['dependencies', 'devDependencies'];
-  const versionPrefix = modeConfig.lockDependencyPrefix ?? config.lockDependencyPrefix ?? '';
+  const versionPrefix = modeConfig.lockDependencyPrefix ?? config.lockDependencyPrefix ?? '^';
   const packageJson = readJson(pkgPath);
   let changed = false;
 
@@ -519,19 +1048,36 @@ function ensureCleanBeforeVersion(repoDir, dryRun, options = {}) {
   run(`git commit -m "${commitMessage}"`, repoDir, dryRun);
 }
 
-function publishStable(repoDir, modeConfig, dryRun, buildCmd) {
+function bumpStableVersion(repoDir, modeConfig, dryRun) {
   ensureCleanBeforeVersion(repoDir, dryRun, {
     autoCommit: modeConfig.autoCommitBeforeVersion ?? (process.env.GITHUB_ACTIONS === 'true'),
     commitMessage: modeConfig.preVersionCommitMessage || 'chore(release): sync release prep changes [skip ci]'
   });
 
   const bump = modeConfig.versionBump || 'patch';
-  if (modeConfig.gitTag === false) {
-    run(`npm version ${bump} --no-git-tag-version --ignore-scripts`, repoDir, dryRun);
-  } else {
-    run(`npm version ${bump} -m "Release %s" --ignore-scripts`, repoDir, dryRun);
-  }
+  const doVersionBump = () => {
+    if (modeConfig.gitTag === false) {
+      run(`npm version ${bump} --no-git-tag-version --ignore-scripts`, repoDir, dryRun);
+      // --no-git-tag-version only edits package.json; commit the change explicitly.
+      run(`git add package.json package-lock.json`, repoDir, dryRun);
+      const bumpedVer = getPackageVersion(repoDir);
+      run(`git commit -m "Release ${bumpedVer} [skip ci]" --allow-empty`, repoDir, dryRun);
+    } else {
+      run(`npm version ${bump} -m "Release %s" --ignore-scripts`, repoDir, dryRun);
+    }
+  };
 
+  doVersionBump();
+
+  const updatedPkg = getPackageJson(repoDir);
+  return {
+    packageName: updatedPkg ? updatedPkg.name : null,
+    version: getPackageVersion(repoDir),
+    tag: modeConfig.npmTag || 'latest'
+  };
+}
+
+function publishPreparedStable(repoDir, modeConfig, dryRun, buildCmd) {
   const pkg = getPackageJson(repoDir);
   const packageName = pkg ? pkg.name : null;
   const version = getPackageVersion(repoDir);
@@ -540,11 +1086,9 @@ function publishStable(repoDir, modeConfig, dryRun, buildCmd) {
     ? `--tag ${modeConfig.npmTag}`
     : '';
   ensurePublishableArtifacts(repoDir, dryRun, buildCmd);
-  // Ignore lifecycle scripts to avoid postpublish git pushes in CI.
   console.log(`Publishing ${packageName || 'package'}@${version} with tag ${modeConfig.npmTag || 'latest'}...`);
   run(`npm publish ${tag} --ignore-scripts --no-provenance`.trim(), repoDir, dryRun);
 
-  // Wait for the version to be available on npm registry
   if (!dryRun && packageName && version) {
     console.log(`Waiting for ${packageName}@${version} to be available on npm...`);
     const registryReady = waitForNpmVersion(packageName, version, repoDir, 120000, 3000);
@@ -561,6 +1105,11 @@ function publishStable(repoDir, modeConfig, dryRun, buildCmd) {
   return { packageName, version, tag: modeConfig.npmTag || 'latest' };
 }
 
+function publishStable(repoDir, modeConfig, dryRun, buildCmd) {
+  bumpStableVersion(repoDir, modeConfig, dryRun);
+  return publishPreparedStable(repoDir, modeConfig, dryRun, buildCmd);
+}
+
 function publishTest(repoDir, modeConfig, dryRun, buildCmd) {
   const preid = modeConfig.preid || 'test';
   const pkg = getPackageJson(repoDir);
@@ -644,10 +1193,25 @@ function publishTest(repoDir, modeConfig, dryRun, buildCmd) {
           fs.writeFileSync(pkgPath, JSON.stringify(pkgData, null, 2) + '\n');
         }
       } else {
-        // Base version doesn't match stable, increment the test counter
-        const nextCounter = parseInt(counterMatch[2], 10) + 1;
-        version = `${publishedBaseVersion}-${preid}.${nextCounter}`;
-        console.log(`Latest @${preid} is ${latestTestVersion}. Incrementing to ${version}...`);
+        // Base version doesn't match stable.
+        // If @test is behind @latest, reset to stable as the base.
+        const stableComparison = latestStableVersion
+          ? compareBaseSemver(publishedBaseVersion, latestStableVersion)
+          : null;
+
+        if (latestStableVersion && stableComparison === -1) {
+          const bumpedStableBase = incrementPatchSemver(latestStableVersion);
+          version = bumpedStableBase
+            ? `${bumpedStableBase}-${preid}.0`
+            : `${latestStableVersion}-${preid}.0`;
+          console.log(
+            `Published @${preid} base ${publishedBaseVersion} is behind stable ${latestStableVersion}. Resetting to ${version}...`
+          );
+        } else {
+          const nextCounter = publishedCounter + 1;
+          version = `${publishedBaseVersion}-${preid}.${nextCounter}`;
+          console.log(`Latest @${preid} is ${latestTestVersion}. Incrementing to ${version}...`);
+        }
 
         // Update package.json manually with this version
         const pkgPath = path.join(repoDir, 'package.json');
@@ -686,9 +1250,20 @@ function publishTest(repoDir, modeConfig, dryRun, buildCmd) {
             fs.writeFileSync(pkgPath, JSON.stringify(pkgData, null, 2) + '\n');
           }
         } else {
-          // Base version doesn't match stable, use this version as starting point for -test
-          version = `${publishedBaseVersion}-${preid}.0`;
-          console.log(`Base version ${publishedBaseVersion} differs from stable. Starting test version at ${version}...`);
+          // Base version doesn't match stable; start from the higher of published base and stable.
+          const selectedBaseVersion = pickHighestBaseSemver(publishedBaseVersion, latestStableVersion);
+          const bumpFromStable = latestStableVersion && selectedBaseVersion === latestStableVersion;
+          const outputBaseVersion = bumpFromStable
+            ? (incrementPatchSemver(selectedBaseVersion) || selectedBaseVersion)
+            : selectedBaseVersion;
+          version = `${outputBaseVersion}-${preid}.0`;
+          if (latestStableVersion && selectedBaseVersion !== publishedBaseVersion) {
+            console.log(
+              `Base version ${publishedBaseVersion} is behind stable ${latestStableVersion}. Starting test version at ${version}...`
+            );
+          } else {
+            console.log(`Base version ${publishedBaseVersion} differs from stable. Starting test version at ${version}...`);
+          }
           
           // Update package.json manually with this version
           if (!dryRun) {
@@ -780,7 +1355,28 @@ function publishTest(repoDir, modeConfig, dryRun, buildCmd) {
   return { packageName: name, version, tag };
 }
 
+function emitReleaseSummary(mode, dryRun, summary, summaryPath) {
+  console.log('\nRelease summary:');
+  for (const item of summary) {
+    if (item.status === 'published' || item.status === 'published-by-repo-ci' || item.status === 'dry-run') {
+      console.log(`- ${item.name}: ${item.status} ${item.version || ''} (${item.tag || 'latest'})`.trim());
+    } else {
+      console.log(`- ${item.name}: ${item.status} (${item.reason})`);
+    }
+  }
+
+  const summaryPayload = {
+    mode,
+    dryRun,
+    generatedAt: new Date().toISOString(),
+    items: summary
+  };
+  fs.writeFileSync(summaryPath, JSON.stringify(summaryPayload, null, 2));
+  console.log(`Summary written to ${summaryPath}`);
+}
+
 function main() {
+  preferGhToken();
   const args = parseArgs(process.argv.slice(2));
   const mode = args.mode || 'stable';
   const configPath = path.resolve(process.cwd(), args.config || 'release.config.json');
@@ -801,18 +1397,31 @@ function main() {
 
   const config = readJson(configPath);
   const configDir = path.dirname(configPath);
-  const modeConfig = getModeConfig(config, mode);
+  const isStablePrepareMode = mode === 'stable-prepare-pr';
+  const isStablePublishMode = mode === 'stable-publish';
+  const isStableMode = mode === 'stable';
+  const modeConfigBase = getModeConfig(config, mode) || {};
+  const stableBaseConfig = getModeConfig(config, 'stable') || {};
+  const modeConfig = isStablePrepareMode
+    ? { ...stableBaseConfig, ...modeConfigBase, gitPush: false, gitTag: false }
+    : isStablePublishMode
+      ? { ...stableBaseConfig, ...modeConfigBase, gitPush: false, gitTag: false }
+      : modeConfigBase;
 
   if (!config.repos || !Array.isArray(config.repos)) {
     throw new Error('Config must include a repos array.');
   }
 
   const summary = [];
+  let fatalError = null;
 
+  try {
   for (const repo of config.repos) {
+    try {
     const repoDir = path.resolve(configDir, repo.path);
     const branch = branchOverride || repo.branch || modeConfig.branch || config.defaultBranch || 'main';
     const effectiveModeConfig = { ...modeConfig, branch };
+    let stablePublishReleaseBranch = null;
 
     console.log(`\n==> ${repo.name} (${repoDir})`);
 
@@ -843,6 +1452,27 @@ function main() {
     }
 
     ensureCiGitSetup(repoDir, dryRun);
+    if (isStableMode) {
+      ensureCiPushAccess(repoDir, branch, dryRun, effectiveModeConfig);
+    }
+
+    if (isStablePrepareMode) {
+      const prepareResult = prepareStablePullRequest(repoDir, repo, config, branch, dryRun, branchOverride);
+      summary.push({
+        name: repo.name,
+        status: prepareResult.status,
+        reason: prepareResult.reason || null,
+        releaseBranch: prepareResult.releaseBranch || null,
+        sourceBranch: prepareResult.sourceBranch || null,
+        targetBranch: prepareResult.targetBranch || null
+      });
+      continue;
+    }
+
+    if (isStablePublishMode) {
+      console.log(`Preparing protected-branch release from ${branch} for ${repo.name}...`);
+      stablePublishReleaseBranch = createReleaseBranch(repoDir, repo, branch, dryRun);
+    }
 
     // Skip ahead/behind check in dry-run since git commands don't actually execute
     if (!dryRun) {
@@ -868,26 +1498,26 @@ function main() {
     // Stable mode skips if no diff, unless branch was explicitly specified or dry-run
     let shouldMergeDev = false;
     
-    if (mode === 'stable') {
+    if (isStableMode) {
       const skipIfNoDiff = repo.skipIfNoDiff ?? config.skipIfNoDiff ?? true;
       const shouldCheckDiff = !dryRun && skipIfNoDiff && !branchOverride;
+      const sourceBranch = getReleaseSourceBranch(repoDir, repo, config, branch, dryRun);
       
-      if (shouldCheckDiff) {
-        // For stable mode: check if dev branch has changes that main doesn't
-        const devBranch = getModeBranch(config, 'test', 'dev') || 'dev';
+      if (shouldCheckDiff && sourceBranch !== branch) {
+        // For stable mode: check if source branch has changes that target doesn't
         
-        // Ensure we have latest dev refs
+        // Ensure we have latest source refs
         try {
-          runQuiet(`git fetch origin ${devBranch}:refs/remotes/origin/${devBranch}`, repoDir);
+          runQuiet(`git fetch origin ${sourceBranch}:refs/remotes/origin/${sourceBranch}`, repoDir);
         } catch (err) {
-          console.log(`Warning: Could not fetch ${devBranch}: ${err.message}`);
+          console.log(`Warning: Could not fetch ${sourceBranch}: ${err.message}`);
         }
         
-        // Count commits that dev has but main doesn't
-        const commitsAhead = parseInt(runQuiet(`git rev-list --count ${branch}..origin/${devBranch}`, repoDir)) || 0;
+        // Count commits that source has but target doesn't
+        const commitsAhead = parseInt(runQuiet(`git rev-list --count ${branch}..origin/${sourceBranch}`, repoDir)) || 0;
         
         if (commitsAhead === 0) {
-          console.log(`No changes in origin/${devBranch} vs ${branch}. Skipping publish.`);
+          console.log(`No changes in origin/${sourceBranch} vs ${branch}. Skipping publish.`);
           summary.push({
             name: repo.name,
             status: 'skipped',
@@ -895,42 +1525,46 @@ function main() {
           });
           continue;
         } else {
-          console.log(`Found ${commitsAhead} commit(s) in ${devBranch} not in ${branch}. Will merge and publish.`);
+          console.log(`Found ${commitsAhead} commit(s) in ${sourceBranch} not in ${branch}. Will merge and publish.`);
           shouldMergeDev = true;
         }
       }
     }
     
     // For stable mode: check if we need to merge dev (even if skipIfNoDiff is disabled)
-    if (mode === 'stable' && !shouldMergeDev) {
-      const devBranch = getModeBranch(config, 'test', 'dev') || 'dev';
+    if (isStableMode && !shouldMergeDev) {
+      const sourceBranch = getReleaseSourceBranch(repoDir, repo, config, branch, dryRun);
+      if (sourceBranch === branch) {
+        shouldMergeDev = false;
+      } else {
       
       try {
-        runQuiet(`git fetch origin ${devBranch}:refs/remotes/origin/${devBranch}`, repoDir);
-        const commitsAhead = parseInt(runQuiet(`git rev-list --count ${branch}..origin/${devBranch}`, repoDir)) || 0;
+        runQuiet(`git fetch origin ${sourceBranch}:refs/remotes/origin/${sourceBranch}`, repoDir);
+        const commitsAhead = parseInt(runQuiet(`git rev-list --count ${branch}..origin/${sourceBranch}`, repoDir)) || 0;
         
         if (commitsAhead > 0) {
-          console.log(`Found ${commitsAhead} commit(s) in ${devBranch} not in ${branch}. Will merge before publish.`);
+          console.log(`Found ${commitsAhead} commit(s) in ${sourceBranch} not in ${branch}. Will merge before publish.`);
           shouldMergeDev = true;
         }
       } catch (err) {
-        console.log(`Warning: Could not check ${devBranch}: ${err.message}`);
+        console.log(`Warning: Could not check ${sourceBranch}: ${err.message}`);
+      }
       }
     }
     
     // Merge dev into main before publishing (stable mode only)
-    if (mode === 'stable' && shouldMergeDev) {
-      const devBranch = getModeBranch(config, 'test', 'dev') || 'dev';
-      console.log(`Merging origin/${devBranch} into ${branch}...`);
+    if (isStableMode && shouldMergeDev) {
+      const sourceBranch = getReleaseSourceBranch(repoDir, repo, config, branch, dryRun);
+      console.log(`Merging origin/${sourceBranch} into ${branch}...`);
       try {
-        run(`git merge origin/${devBranch} -m "Merge ${devBranch} into ${branch} for release [skip ci]"`, repoDir, dryRun);
+        run(`git merge origin/${sourceBranch} -m "Merge ${sourceBranch} into ${branch} for release [skip ci]"`, repoDir, dryRun);
       } catch (err) {
-        throw new Error(`Failed to merge origin/${devBranch} into ${branch}. Please resolve conflicts manually.`);
+        throw new Error(`Failed to merge origin/${sourceBranch} into ${branch}. Please resolve conflicts manually.`);
       }
     }
 
     // Stable mode: lock dependency versions based on what afterInstall actually installed.
-    if (mode === 'stable') {
+    if (isStableMode || isStablePublishMode) {
       lockStableDependencyVersions(repoDir, repo, config, effectiveModeConfig, dryRun);
     }
 
@@ -969,7 +1603,57 @@ function main() {
         tag: result.tag,
         publishedAs: result.packageName ? `${result.packageName}@${result.version}` : null
       });
-    } else if (mode === 'stable') {
+    } else if (isStablePublishMode) {
+      bumpStableVersion(repoDir, effectiveModeConfig, dryRun);
+
+      console.log(`Step 1/3: Creating release PR from ${stablePublishReleaseBranch} -> ${branch}...`);
+      run(`git push -u origin ${stablePublishReleaseBranch}`, repoDir, dryRun);
+      maybeCreatePullRequest(repoDir, repo, branch, stablePublishReleaseBranch, dryRun, { required: true });
+
+      console.log('Step 2/3: Auto-merging release PR...');
+      waitForPRMerge(repoDir, repo, stablePublishReleaseBranch, branch, dryRun, {
+        required: true,
+        requiredChecksWorkflow: effectiveModeConfig.requiredChecksWorkflow || 'ci.yml'
+      });
+
+      ensureBranch(repoDir, branch, dryRun);
+
+      console.log('Step 3/3: Waiting for repository CI publish on main...');
+      const result = {
+        packageName: pkg ? pkg.name : null,
+        version: getPackageVersion(repoDir),
+        tag: effectiveModeConfig.npmTag || 'latest'
+      };
+
+      if (!dryRun && result.packageName && result.version) {
+        const workflowRef = effectiveModeConfig.repoCiWorkflow || effectiveModeConfig.requiredChecksWorkflow || 'ci.yml';
+        const headSha = runQuiet('git rev-parse HEAD', repoDir).trim();
+        console.log(`Waiting for workflow ${workflowRef} on ${branch} to succeed for commit ${headSha}...`);
+        waitForWorkflowSuccess(repoDir, repo, workflowRef, branch, headSha, dryRun, {
+          timeoutMs: effectiveModeConfig.repoCiWorkflowTimeoutMs || 20 * 60 * 1000,
+          pollIntervalMs: effectiveModeConfig.repoCiWorkflowPollIntervalMs || 15000
+        });
+
+        const timeoutMs = effectiveModeConfig.repoCiPublishTimeoutMs || 10 * 60 * 1000;
+        const pollIntervalMs = effectiveModeConfig.repoCiPublishPollIntervalMs || 5000;
+        console.log(`Waiting for ${result.packageName}@${result.version} to be available on npm...`);
+        const registryReady = waitForNpmVersion(result.packageName, result.version, repoDir, timeoutMs, pollIntervalMs);
+        if (!registryReady) {
+          throw new Error(
+            `Timed out waiting for repository CI to publish ${result.packageName}@${result.version} to npm.`
+          );
+        }
+      }
+
+      summary.push({
+        name: repo.name,
+        status: dryRun ? 'dry-run' : 'published-by-repo-ci',
+        packageName: result.packageName || null,
+        version: result.version,
+        tag: result.tag,
+        publishedAs: result.packageName ? `${result.packageName}@${result.version}` : null
+      });
+    } else if (isStableMode) {
       const result = publishStable(repoDir, effectiveModeConfig, dryRun, effectiveBuildCmd);
       summary.push({
         name: repo.name,
@@ -984,25 +1668,24 @@ function main() {
     }
 
     runSteps(repo.afterPublish, repoDir, dryRun);
-  }
-
-  console.log('\nRelease summary:');
-  for (const item of summary) {
-    if (item.status === 'published' || item.status === 'dry-run') {
-      console.log(`- ${item.name}: ${item.status} ${item.version || ''} (${item.tag || 'latest'})`.trim());
-    } else {
-      console.log(`- ${item.name}: ${item.status} (${item.reason})`);
+    } catch (err) {
+      summary.push({
+        name: repo.name,
+        status: 'failed',
+        reason: err.message || String(err)
+      });
+      throw err;
     }
   }
+  } catch (err) {
+    fatalError = err;
+  } finally {
+    emitReleaseSummary(mode, dryRun, summary, summaryPath);
+  }
 
-  const summaryPayload = {
-    mode,
-    dryRun,
-    generatedAt: new Date().toISOString(),
-    items: summary
-  };
-  fs.writeFileSync(summaryPath, JSON.stringify(summaryPayload, null, 2));
-  console.log(`Summary written to ${summaryPath}`);
+  if (fatalError) {
+    throw fatalError;
+  }
 }
 
 try {