[smiggleworth]

Behavior follow-up: the provider launcher, Node types, and asset-root fixes have landed independently on develop in #189 (1c2b8e3f0f4608cf07a32489423abb14f82824c4) after all ordinary hosted checks passed. This release candidate still requires a refresh against current develop and the final published dependency graph; its local candidate archive evidence below does not qualify the merged develop tree for publication.

Prepare CLI 0.5.0 and generated applications for the 0.5 platform floor. The CLI peer/development ranges, five shipped templates, database generator and minimum-peer checks now select the current 0.5 candidates. Provider launchers pass APP_ORIGIN to the Node transport, include Node types, and serve built browser assets from dist while excluding server bundles and Vite manifests.

The packed-template gate now owns every command process tree, retains command receipts, and allows five ordinary candidate installs/checks to finish within a bounded ten-minute case. Its prior three-minute bound failed during normal installs; observed cold installs took approximately 106 seconds. Unix groups and Windows taskkill cancellation have lifecycle regression coverage; native Unix cancellation/deadline probes confirmed no surviving descendant processes.

Validation against the local exact candidate registry:

• Node 24.21.0, npm 12.0.1; credential-free isolated registry configuration; normal clean npm ci with reviewed install scripts enabled.
• All 11 physical first-party lock edges match canonical URLs and exact catalog SRIs; 9,777 installed files match their retained archives byte for byte.
• Four generated-launcher regressions fail against the original implementation and pass with the fixes.
• npm run fmt -- --check and npm run check pass, including 599 coverage tests and installed public types.
• All five packed templates pass in 243.12s; 23 retained command receipts report successful closes. SSG scoped JSX passes under TypeScript 6 and 7.
• test:peer-floor, test:types, test:analyze-cancellation and test:analyze-access pass; all 22 CLI benchmark budgets pass.
• test:registry-database passes with ASKR_CLI_REGISTRY_VERSION=file:; ORM and transitive packages come from the local candidate registry. This is an explicit local candidate-archive substitution, not public-registry qualification.
• Two normal npm packs and a third repack from the clean committed tree run prepack builds and produce identical archive bytes/SRI.
• npm audit against the public npm advisory endpoint reports zero vulnerabilities. The GET-only candidate registry returns 405 for the audit endpoint; no dependency graph or registry fixture was changed to work around it.

One initial focused generator run hit the existing create --auth uses the same provider artifacts as add auth 5000ms timeout at tests/provider-auth-generator.test.ts:239 (body 5617ms), followed by ENOTEMPTY cleanup in the still-running creation directory. It did not recur in the targeted retry or either subsequent full release check. The existing test was not changed.

The shared candidate catalog remains unchanged by this PR. Packages are unpublished by design; public npm 0.5.0 installation and hosted checks that need those unpublished packages are not established by local candidate qualification. Existing develop-to-main promotion #187 remains open.

Hosted CI run 38334702312 fails during npm ci with E404 for the canonical @askrjs/vite@0.5.0 archive. This affects all seven CI package jobs, including Linux, macOS and Windows; their application checks have not run. Local candidate qualification does not replace those hosted checks.