diff --git a/docs/tracking/vsl-implementation-tracker.md b/docs/tracking/vsl-implementation-tracker.md
index 6d19bd2..9163500 100644
--- a/docs/tracking/vsl-implementation-tracker.md
+++ b/docs/tracking/vsl-implementation-tracker.md
@@ -14,7 +14,7 @@ doc_type: [TRACKING]
 > One row per task; update the row in the **same increment** as the code. Design
 > context: front door [`../plans/vsl-overview.md`](../plans/vsl-overview.md).
 
-**Status (2026-06-12 s4): M0a CLOSED — the install/verify/uninstall lifecycle is proven on BOTH engines over the driver path. YDB: `v pkg … --engine ydb` on vehu (T0a.3/T0a.4). IRIS: `v pkg … --engine iris --transport remote` on foia (2026-06-12 s4) — install → #9.7 status=3 + `$$PING^ZZSKEL`→"pong"; verify → installed=1; uninstall → reversible (routine + #9.7/#9.6 gone). The dual-engine exit gate (T0a.5) is GREEN; v-pkg unchanged. **Loose ends B + C CLOSED (2026-06-13 s12):** (B) v-cli registry regenerated with the 3 lifecycle verbs (install/verify/uninstall) — v-cli `chore/registry-regen-lifecycle-verbs`; (C) the m/v waterline **G1 dependency-direction gate is built** — `m arch check` in m-cli (`arch-waterline-g1`), m-cli + m-stdlib self-declare `layer` and gate clean. **T0b.1 DONE (s12):** v-stdlib scaffolded + pushed (public, layer v, smoke 2/2 both engines). **(D) layer tags DONE (s12):** all 8 ecosystem repos now declare `layer` and gate clean via `m arch check` — m-cli/m-stdlib/m-driver-sdk/m-ydb/m-iris = **m** (Go+M arms clean); v-pkg/v-cli/v-stdlib = **v** (pass trivially). Each tag is a root `repo.meta.json` (layer is a repo property, not a per-domain/generated-contract field). **(D-residual) org CI workflow WIRED + VERIFIED LIVE (s12):** `.github/.github/workflows/arch-waterline.yml` runs `m arch check` in any repo. **All 3 activation steps done:** (1) m-cli `arch-waterline-g1`→main merged (PR#5, `m arch check` on m-cli main); (2) `.github` workflow→main merged (PR#1) + a follow-up fix→main (PR#2: build `m` via `git clone --branch`, not `go install …@main` — the module proxy's branch cache lags a fresh merge ~30 min → would build a stale `m` without `arch check`); (3) the one-line `arch:` caller added to all 8 repos' `ci.yml` (v-cli + v-stdlib got their first `ci.yml`). **Verified GREEN on real CI:** v-stdlib PR#1 `arch/arch SUCCESS` (v-layer trivial) + m-cli PR#6 `arch/arch SUCCESS` (m-layer **Go-arm** — `go list` closure clean). m-cli + v-stdlib callers merged to main (gate live there); the other 6 callers ride on their repos' current feature branches and activate as those branches merge. No local-path `replace` in the m Go repos (Go-arm safe in CI). Resume: (E) **T0b.3 — the four drift gates + `seams` block** (next M0b step).**
+**Status (2026-06-12 s4): M0a CLOSED — the install/verify/uninstall lifecycle is proven on BOTH engines over the driver path. YDB: `v pkg … --engine ydb` on vehu (T0a.3/T0a.4). IRIS: `v pkg … --engine iris --transport remote` on foia (2026-06-12 s4) — install → #9.7 status=3 + `$$PING^ZZSKEL`→"pong"; verify → installed=1; uninstall → reversible (routine + #9.7/#9.6 gone). The dual-engine exit gate (T0a.5) is GREEN; v-pkg unchanged. **Loose ends B + C CLOSED (2026-06-13 s12):** (B) v-cli registry regenerated with the 3 lifecycle verbs (install/verify/uninstall) — v-cli `chore/registry-regen-lifecycle-verbs`; (C) the m/v waterline **G1 dependency-direction gate is built** — `m arch check` in m-cli (`arch-waterline-g1`), m-cli + m-stdlib self-declare `layer` and gate clean. **T0b.1 DONE (s12):** v-stdlib scaffolded + pushed (public, layer v, smoke 2/2 both engines). **(D) layer tags DONE (s12):** all 8 ecosystem repos now declare `layer` and gate clean via `m arch check` — m-cli/m-stdlib/m-driver-sdk/m-ydb/m-iris = **m** (Go+M arms clean); v-pkg/v-cli/v-stdlib = **v** (pass trivially). Each tag is a root `repo.meta.json` (layer is a repo property, not a per-domain/generated-contract field). **(D-residual) org CI workflow WIRED + VERIFIED LIVE (s12):** `.github/.github/workflows/arch-waterline.yml` runs `m arch check` in any repo. **All 3 activation steps done:** (1) m-cli `arch-waterline-g1`→main merged (PR#5, `m arch check` on m-cli main); (2) `.github` workflow→main merged (PR#1) + a follow-up fix→main (PR#2: build `m` via `git clone --branch`, not `go install …@main` — the module proxy's branch cache lags a fresh merge ~30 min → would build a stale `m` without `arch check`); (3) the one-line `arch:` caller added to all 8 repos' `ci.yml` (v-cli + v-stdlib got their first `ci.yml`). **Verified GREEN on real CI:** v-stdlib PR#1 `arch/arch SUCCESS` (v-layer trivial) + m-cli PR#6 `arch/arch SUCCESS` (m-layer **Go-arm** — `go list` closure clean). m-cli + v-stdlib callers merged to main (gate live there); the other 6 callers ride on their repos' current feature branches and activate as those branches merge. No local-path `replace` in the m Go repos (Go-arm safe in CI). **Phase A stabilization STARTED (s12) — m-layer landed:** per the orchestration runbook ([`../plans/msl-vsl-orchestration-kickoff.md`](../plans/msl-vsl-orchestration-kickoff.md)), landed the ready m-layer repos to main leaf-first — m-stdlib (master), m-driver-sdk, m-ydb (+its driver work), m-cli already current. **Phase A COMPLETE (s12):** all 8 repos' mains are now canonical with the waterline gate enforcing (layer tag + arch CI caller live on every main). Landed: m-stdlib, m-driver-sdk, m-ydb, m-cli (m-side) + v-pkg, v-cli, v-stdlib, m-iris (v/remaining). **v-pkg tagged `v0.1.0`**; **v-cli** dropped its dev `replace => ../v-pkg` and pins `v0.1.0` (G4 seam-pin satisfied). **m-iris** landed after trivial lint cleanup (errcheck/unused-param/typo; tests were already green, conformance 16/16) — its `m-iris-driver` branch kept for continued M8 work. Dependabot: 3/4 merged, m-ydb #1 rebasing. CI fix found+fixed: `go-ci.yml` schema-check assumes m-cli's `schema` command → library (m-driver-sdk) + driver (m-ydb/m-iris) repos set `schema-check: false`. **Resume: Phase B** (standardize: one root `repo.meta.json` everywhere + G2–G4 + the meta-gate + `m-ci.yml` + tag m-cli & pin `m-cli-ref`), then (E) **T0b.3**. See [`../plans/msl-vsl-orchestration-kickoff.md`](../plans/msl-vsl-orchestration-kickoff.md).**
 The `VistaEngine` substrate is built on the **m engine-driver contract** (the
 chosen integration is **subprocess + JSON envelope**, not in-process import —
 driver-contract §2/§11). Foundational driver work landed this session: m-ydb
@@ -79,6 +79,8 @@ _(Append one dated line per increment as tasks move. Newest last.)_
 - 2026-06-13 (s12) — **T0b.1 DONE — v-stdlib scaffolded + pushed.** Created github.com/vista-cloud-dev/v-stdlib (public, matching the m-stdlib/v-pkg/v-cli siblings; `main` `f5bbb64`). No automated scaffolder exists (the Go m-cli has no `new` verb, the legacy Python `m` is gone, `~/claude/templates/m-project/` is empty), so modeled the skeleton on m-stdlib, adapted to layer v / VSL*: `.m-cli.toml` (modern, pythonic-lower, target-engine any), `Makefile` (`check-fast` = fmt-check+lint+arch engine-free; engine-bound `test`/`coverage` stage STDASSERT from m-stdlib via `--routines`, with `ENGINE`/`DOCKER` vars), `dist/repo.meta.json` with **`layer: v`** (gated by `m arch check` → passes trivially, v→m allowed), `tests/VSLSMOKETST.m` (trivial `^STDASSERT` smoke), README + CLAUDE.md (waterline rules, TDD, dual-engine). Gotcha: `m fmt --rules` only accepts `identity|canonical`; the `pythonic-lower` style comes from `.m-cli.toml` `[fmt]` when no `--rules` is passed (mirror m-stdlib's bare `m fmt`). **Verified green:** fmt-check + lint (0 findings) + arch (layer v, clean); **VSLSMOKETST 2/2 on YDB (m-test-engine) AND 2/2 on IRIS (m-test-iris)** — empty-suite-green exit criterion met dual-engine. No `VSL*` modules yet; VSLCFG (XPAR config, binds STDENV) is first at M1/T1.2. **Next M0b step: T0b.3** (the four drift gates + `seams` block).
 - 2026-06-13 (s12) — **(D) layer tags landed across all 8 ecosystem repos.** Tagged the 5 remaining repos (m-cli + m-stdlib were tagged when G1 was built; v-stdlib at scaffold): **m** = m-driver-sdk (`coordination`), m-ydb (`m-ydb-driver`), m-iris (`m-iris-driver`); **v** = v-pkg (`refile-v-pkg`), v-cli (`chore/registry-regen-lifecycle-verbs`). Each via a root `repo.meta.json` — the layer is a **repo** property, so it does NOT belong in the per-domain generated `dist/v-contract.json` (v-pkg) or aggregate `dist/v-registry.json` (v-cli); `ResolveLayer` reads root `repo.meta.json` (falling through past those generated artifacts, which carry no `layer` key). All 3 `m` repos gate **clean on the Go arm** (`go list -deps` → no `vista-cloud-dev/v-*` in closure) + M arm; the 2 `v` repos pass G1 trivially. Each committed on its current working branch + pushed. **Residual:** the gate runs locally / in each repo's `make` only — the reusable org CI workflow (ADR §3.3.2, `.github/workflows/arch-waterline.yml`) is not yet wired, so CI doesn't enforce it on push yet. Next M0b: T0b.3.
 - 2026-06-14 (s12) — **Org CI workflow wired + verified live; G1 now enforced in CI.** Created the reusable `.github/.github/workflows/arch-waterline.yml` (ADR §3.3.2) and completed all activation: merged m-cli arch→main (PR#5, a merge commit that also landed the stacked T0.1 VistaEngine + SDK-dedupe — both already verified), merged the workflow→`.github` main (PR#1), and added the `arch:` caller to all 8 repos. **Two non-obvious CI findings:** (1) the workflow first used `go install github.com/vista-cloud-dev/m-cli@main`, but the **Go module proxy caches the `@main` branch→commit resolution** and lagged the fresh merge ~30 min (kept resolving the pre-merge `856065b` with no `arch check`) → switched to `git clone --depth 1 --branch ${ref}` + `go build` (exact HEAD immediately; m-cli's deps still via proxy) — PR#2, validated locally vs m-cli main `47c4e49`. (2) v-cli has a dev `replace => ../v-pkg`, which would break the Go-arm's `go list` in CI — but v-cli is layer v, so arch **skips** the Go arm (trivial pass); the m-layer Go repos have no local-path replace, so their Go-arm is CI-safe. **Verified GREEN on GitHub Actions:** v-stdlib `arch/arch SUCCESS` (chain proof: caller→reusable@main→clone+build m→`m arch check`) and m-cli `arch/arch SUCCESS` (real m-layer Go-arm). m-cli + v-stdlib callers merged to main (each also got its first/updated `ci.yml`); the other 6 callers sit on their repos' current feature branches and activate when those merge.
+- 2026-06-14 (s12) — **Phase A stabilization started — m-layer landed to main; a real CI bug fixed en route.** Wrote the orchestration runbook (`docs/plans/msl-vsl-orchestration-kickoff.md`: stabilize→standardize→implement; one-session↔one-repo↔one-branch; seam-as-coupling; handoff/session-boundary rules) and began Phase A leaf-first. Landed via PR (CI green): **m-stdlib**→master (waterline + tracker + memory + runbook), **m-driver-sdk**→main, **m-ydb**→main (also lands its driver work: `$ZGBLDIR` fix, SSH remote transport, clikit ResultExit). **CI bug found + fixed:** `go-ci.yml`'s schema-check step runs `go run . schema`, which assumes m-cli's `schema` command — so **m-driver-sdk** (library, `package mdriver` → "not a main package") and **m-ydb** (driver, no `schema` verb → exit 2 under pipefail) were RED on go-ci (pre-existing, masked by stale mains). Fix: `with: schema-check: false` in their go-ci callers; both then fully green (lint+test+matrix+arch). **Phase-B item:** standardize this (every Go repo's go-ci caller sets schema-check correctly, or the drivers add a `schema` verb). **HELD (then landed — see s12 close):** m-iris.
+- 2026-06-14 (s12 close) — **Phase A COMPLETE — all 8 mains canonical, gate enforcing everywhere.** Landed the v-side + m-iris on top of the m-side: **v-pkg** `refile-v-pkg`→main (the m-kids→v-pkg refile + M0a lifecycle) **+ tagged `v0.1.0`**; **v-cli** dropped the dev `replace => ../v-pkg` and pinned `v-pkg v0.1.0` (registry unchanged; G4 seam-pin satisfied) → main; **m-iris** `m-iris-driver`→main after **trivial lint cleanup** (10 golangci-lint findings — httptest `w.Write`/`io.WriteString` errcheck, two unused `cc` params in remote-unsupported lifecycle stubs, an unused test param, a comment typo; tests already green, conformance 16/16) — merged with a merge commit and the **branch kept** so continued M8 work isn't disrupted. All landings CI-green (lint+test+matrix+arch). **Dependabot:** v-pkg/m-cli/m-iris merged; m-ydb #1 sent `@dependabot rebase` (its branch predated the `schema-check: false` ci.yml fix). **Not touched (genuine pending features, not stale-main artifacts):** m-stdlib PR#1 `iris-native-backends`, m-cli PR#2 `engine-chset-byte-mode` — left for their own review/merge. **Next: Phase B** (standardize substrate) then T0b.3.
 - 2026-06-13 (s10) — **File I/O made dual-engine: STDFS portable facade + 5-consumer migration (Variant B "full refactor").** STDFS (was YDB-only by design) now has public `$$openRead/$$openWrite/$$openAppend` + private `readLn`/`closeDelete`/`sizeIris`, engine-branched (`readonly→"R"`, `newversion:stream:nowrap→"WNS"`, `append→"WA"`, `close:(delete)→close:"D"`, `$ZEOF`↔`<ENDOFFILE>`-catch), with off-engine syntax `xecute`-hidden so each compiler parses only its own arm. **STDFSTST 50/50 BOTH engines** (was 0/0 IRIS). STDOS.env got a `$system.Util.GetEnviron` IRIS arm (was `$ztrnlnm`). STDJSON/STDCSV/STDSEED/STDLOG routed through STDFS; STDSEEDTST/STDCSVTST fixtures ported. **YDB full 2098/0 — no regression**; fmt clean, lint errors=0, KIDS drift-gate ✓, dist regenerated. **KEY OUTCOME:** the file-I/O refactor makes the file layer portable but does **NOT** turn the consumer SUITES green on IRIS — they have separate non-file blockers (discoveries P2 2026-06-13): **STDJSON byte-mode parser** (`$$parse` crashes on IRIS, no file involved), **STDCSV `@callback@(args)` indirection** (crashes on IRIS even ASCII), and **wide-char descriptions** (STDCSV/STDSEED/STDLOG/STDXML → m-iris GetOut/session-capture lane). Only **STDFS** goes green on IRIS this session. Coverage note: STDFS 69.3% / STDOS 83.7% per-file (dual-engine IRIS arms unreachable on the YDB coverage tier — same documented situation as STDHARN 76.7%). **To actually green the IRIS consumer suites still needs: byte-mode portability + a portable `parseFile` callback idiom + the wide-char capture path** — all separate from file I/O. Engines restored (vehu up, foia stopped).
 
 ## Per-milestone notes