Update one dependency slice

1. Require a current pui-orient capability-envelope, the exact pui-deps dependency-report, an applicable pui-trace authority-map, and implementation-authorization from the current bounded request, governed work item, or active standing scope. The dependency report does not replace the authority map.
2. Re-read every affected manifest and lockfile, the resolved package identity and provenance, direct and reverse consumers, package-manager policy, release surface, current advisory facts, and rollback boundary.
3. Confirm that current authority fixes the supported runtime range and compatibility result. A genuinely undecided public compatibility promise routes to unresolved-product-direction; security disclosure, publication, release, or a provenance exception routes to privileged-or-irreversible-operation.
4. Use Node.js 22 and the repository-declared pnpm through Corepack. Apply the smallest coherent manifest edit and let the package manager generate its lockfile projection; preserve unrelated resolutions and user changes.
5. Update direct compatibility evidence or consumer fixtures only when the dependency report includes them in the governed slice. Semantic changes owned by a Module, Host Capability, Adapter, Prototype, or regression route through that owning leaf.
6. Run frozen-install or lockfile integrity checks, focused consumer tests, type checks, and applicable release/package-surface checks. Record environmental limitations without converting them into product uncertainty.
7. Return the exact package identities before and after, actual diff, affected consumers, generated files, evidence, rollback command or revision boundary, residual risks, and one eligible validation or review handoff.

The transition changes tracked feature-branch content only. External publication and release remain outside this leaf.

Explicit handoff

Return exactly one handoff conforming to internal/agent-operations/schemas/skill-handoff.schema.json. Carry capability-envelope, dependency-report, authority-map, and implementation-authorization by reference, preserving their existing references and any digests, and include the registered candidate-change. Set nextSkillId to one eligible registered leaf or null without loading it. Carry all artifacts required by that next leaf and validate the handoff before it is loaded; both pui-validate and pui-review require the existing authority map, and review additionally requires evidence-report and review-input.

Communicate with the user in the user's current language. Keep package names, versions, registries, and revision identities canonical.