diff --git a/packages/tool-registry-publish/README.md b/packages/tool-registry-publish/README.md
index 59681160fa..a188a9aa10 100644
--- a/packages/tool-registry-publish/README.md
+++ b/packages/tool-registry-publish/README.md
@@ -71,6 +71,18 @@ for how a pin resolves through it).
 - Any workflow definition or `DEFAULT_WORKFLOWS` — this package knows
   which tool packages to publish, never which workflows pin them.
 
+## CL-7587 end state
+
+This package stays pack + explicit publish: no boot-time publish (the
+hub only reads the registry; `seedTenant` never packs), no daemon or
+freshness loop (freshness is a `check:structural` gate and a publish
+precondition, never a background task), no registry table (the registry
+is a `package-registry` asset, not a SQL row), and pins resolve on
+immutable `name@version` tarball filenames. Full deletion is blocked
+until `@corbits/seeding`, `@workbench/onboarding`, and
+`scripts/checks/tool-package-freshness` migrate off this package's
+library entry (their lanes own those moves).
+
 ## Running tests
 
 ```sh
diff --git a/packages/tool-registry-publish/src/index.ts b/packages/tool-registry-publish/src/index.ts
index 2a7e5638ce..ba7b34ae13 100644
--- a/packages/tool-registry-publish/src/index.ts
+++ b/packages/tool-registry-publish/src/index.ts
@@ -22,7 +22,6 @@ export {
   sha512Integrity,
   fetchRegistryTarballSource,
   installRegistryTarball,
-  TarballVersionCollisionError,
   EmptyRegistryPublishError,
   type ApiCall,
   type ApiResult,
diff --git a/packages/tool-registry-publish/src/publish.ts b/packages/tool-registry-publish/src/publish.ts
index 8c31480dfe..8fc4d6d879 100644
--- a/packages/tool-registry-publish/src/publish.ts
+++ b/packages/tool-registry-publish/src/publish.ts
@@ -144,25 +144,6 @@ const TarballSummary = type({
 });
 const TarballListResponse = TarballSummary.array();
 
-/**
- * Thrown when a tarball whose filename (hence its `name@version`) is
- * already published to the registry would be overwritten with
- * different bytes. Republishing under an unchanged version is the
- * exact failure mode that leaves running agents on stale tool code —
- * the resolver and sidecar caches key on `name@version`, not on
- * content, so a same-version overwrite never reaches an already
- * -launched or freshly-materialized run. Bumping the package's
- * `version` is the only supported way to ship new tool-package bytes.
- */
-export class TarballVersionCollisionError extends Error {
-  constructor(filename: string) {
-    super(
-      `publishCorbitsToolsRegistry: ${filename} is already published with different content; bump the package's version before republishing. Tool-package resolution keys on name@version, so overwriting an unchanged version never reaches a running or freshly-launched agent.`,
-    );
-    this.name = "TarballVersionCollisionError";
-  }
-}
-
 /**
  * Thrown when a publish run leaves `corbits-tools` without the required
  * seed tarballs (`@corbits/memory-tools`). Covers both zero uploads onto