fix: correct stale probe-timeout and 13->16 component counts

README.md

@@ -69,7 +69,7 @@ restore, remove, and custom-target usage.
 
 Each directory under `zcode_tools/marketplaces/` is a complete setup:
 
-- `nddev-builder` enables its reusable 13-skill, 13-command `core` toolkit for
+- `nddev-builder` enables its reusable 16-skill, 16-command `core` toolkit for
   creating and managing ZCode marketplaces, plugins, and components.
 - `nddev-designer` is a deliberately lean product-design profile focused on
   design-system consistency, accessibility, responsive states, and

SECURITY.md

@@ -94,7 +94,8 @@ accepted report within 30 business days. These targets are best-effort.
   dpkg-owned path/version and SHA-512 equality with that verified entry are
   required.
 - Runtime CLI probing resolves one canonical executable and limits execution to
-  3 seconds and 64 KiB of output. Normal install treats probe failure as
+  a bounded timeout (30 seconds by default, clamped to at most 120 seconds) and
+  64 KiB of output. Normal install treats probe failure as
   advisory unknown state; bootstrap rejects it as a failed postcondition.
 - Lifecycle mutations use canonical/disjoint path checks, target and backup-pool
   locks, same-filesystem staging, pre-commit verification, atomic rename, and

build/manifest.json

@@ -64,7 +64,7 @@
   },
   "runtime_probe_policy": {
     "resolution": "resolve and canonicalize one executable before invoking it",
-    "timeout_seconds": 3,
+    "timeout_seconds": 30,
     "max_output_bytes": 65536,
     "advisory_failure": "timeout, nonzero exit, excessive output, decode/runtime error, or missing executable becomes unknown/not-installed without aborting install",
     "bootstrap_postcondition": "bootstrap remains strict and rejects an unknown or mismatched CLI version"

build/release-evidence.json

@@ -2,11 +2,11 @@
   "schema_version": 2,
   "module": {
     "repository": "NDDev-it-com/nddev-zcode-app",
-    "setup_digest": "sha256:b0e22d023e2d56303eedd3bb8ffefdd91608b25ba3f3e7182a14af26ce720e5a"
+    "setup_digest": "sha256:51f95a940c545ea1c590d8613a7bd018815dbef6864acdfc974f7e4dd0fb689a"
   },
   "harness": {
     "repository": "NDDev-it-com/nddev-harnesses",
-    "commit": "275354c5fca5af5da0baff1be96f0c15219a7587"
+    "commit": "f00fc21cc43b1510b33160e5026a743a6591d890"
   },
   "adapter": {
     "id": "zcode",
@@ -30,8 +30,8 @@
     }
   ],
   "lanes": [],
-  "generated_at_utc": "2026-07-18T06:15:06Z",
-  "expires_at_utc": "2027-01-14T06:15:06Z",
+  "generated_at_utc": "2026-07-19T02:11:35Z",
+  "expires_at_utc": "2027-01-15T02:11:35Z",
   "promotion": {
     "decision": "pending",
     "waivers": []

cli-tools/validate_public_contracts.py

@@ -250,6 +250,22 @@ def main() -> int:
             errors.append(
                 "nddev-builder core plugin version disagrees with build/version.json:build_version"
             )
+        marketplace = load_json(
+            "zcode_tools/marketplaces/nddev-builder/marketplace.json", errors
+        )
+        if marketplace is not None:
+            core_entries = [
+                entry
+                for entry in marketplace.get("plugins", [])
+                if isinstance(entry, dict) and entry.get("name") == "core"
+            ]
+            if len(core_entries) == 1 and core_entries[0].get("version") != version.get(
+                "build_version"
+            ):
+                errors.append(
+                    "nddev-builder marketplace core plugin version disagrees with "
+                    "build/version.json:build_version"
+                )
 
     if manifest is not None and version is not None:
         if manifest.get("build_version") != version.get("build_version"):

docs/architecture.md

@@ -52,7 +52,7 @@ prefix.
 ### Setup profiles
 
 - `nddev-builder` enables `core@nddev-builder`, a native component-authoring
-  toolkit with 13 skills, 13 matching commands, and one reviewer agent.
+  toolkit with 16 skills, 16 matching commands, and one reviewer agent.
 - `nddev-designer` is a production-ready minimal design profile. Its empty
   extension maps are intentional; project-specific design tools come from the
   active workspace.

zcode_tools/marketplaces/nddev-builder/plugins/core/README.md

@@ -3,14 +3,16 @@
 The `core` plugin is a reusable ZCode-native toolkit for creating and managing
 marketplaces, plugins, and convention-discovered components.
 
-- **13 skills**: `add-marketplace`, `add-plugin`, `add-skill`, `add-command`,
+- **16 skills**: `add-marketplace`, `add-plugin`, `add-skill`, `add-command`,
   `add-agent`, `add-hook`, `add-mcp-server`, `add-provider`, `add-reference`,
-  `add-tool`, `list-components`, `remove-component`, and `enable-plugin`.
-- **13 slash commands**: `/nddev-add-marketplace`, `/nddev-add-plugin`,
+  `add-tool`, `add-instructions`, `list-components`, `remove-component`,
+  `enable-plugin`, `nddev-builder-orientation`, and `validate-components`.
+- **16 slash commands**: `/nddev-add-marketplace`, `/nddev-add-plugin`,
   `/nddev-add-skill`, `/nddev-add-command`, `/nddev-add-agent`,
   `/nddev-add-hook`, `/nddev-add-mcp`, `/nddev-add-provider`,
-  `/nddev-add-reference`, `/nddev-add-tool`, `/nddev-list`, `/nddev-remove`,
-  and `/nddev-enable`.
+  `/nddev-add-reference`, `/nddev-add-tool`, `/nddev-add-instructions`,
+  `/nddev-list`, `/nddev-remove`, `/nddev-enable`, `/nddev-orient`, and
+  `/nddev-validate`.
 - **1 subagent**: `nddev-native-reviewer` (GLM-5.2).
 
 ## Capabilities