Global CLI Bundled Baseline Downgrade

Initial Debt

Issue 43 reported that global @punks/cli@2.1.11 could resolve dp update --yes to the bundled 2.1.11 baseline after a newer stable scaffold baseline had been published. That path reintroduced stale scaffold assets such as old plan-mode guidance and removed newer skill primitives.

Why It Matters

dp update --yes is used by non-interactive harness flows. If stable baseline resolution fails and update silently applies bundled fallback content against a manifest recorded from a newer stable baseline, the command can downgrade managed agent guidance without an explicit operator decision.

Resolution

apps/cli/src/update/run.ts now refuses write/apply mode when all of these are true:

• the recorded manifest baseline version differs from the active baseline version
• the active baseline source is bundled
• the operator did not explicitly force bundled with --baseline bundled or DP_BASELINE=bundled

Check/json mode still reports drift without writing. Explicit bundled mode remains available for intentional fallback.

Validation

• bun --cwd apps/cli test src/update/run.test.ts src/baseline/resolve.test.ts
• bun --cwd apps/cli test src/content/content.test.ts src/update/run.test.ts
• bun run check
• git diff --check

Closeout

Resolved for issue 43 by guarding the dangerous write path and documenting the operator behavior in docs/README.md, docs/runbooks/dp-cli-scaffolding.md, and routed wiki docs. The backlog mirror was commented with validation evidence and closed as completed.