@bleedingdev/modern-js-create 3.5.0-ultramodern.9 → 3.5.0-ultramodern.90

package/templates/workspace-scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -3,33 +3,55 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 
+// Generated by modern-js-create with an immutable expected proof contract.
 const root = process.cwd();
-const packageScope = '{{packageScope}}';
-const expectedNodeVersion = '{{nodeVersion}}';
-const tailwindEnabled = {{tailwindEnabledJson}};
-const fullStackVerticals = {{fullStackVerticalsJson}};
-const shellNamespace = {{shellNamespaceJson}};
-const oldRemotePaths = {{oldRemotePathsJson}};
-const expectedBuildScript = {{expectedBuildScriptJson}};
-const expectedCloudflareBuildScript = {{expectedCloudflareBuildScriptJson}};
-const expectedCloudflareDeployScript = {{expectedCloudflareDeployScriptJson}};
-const expectedCloudflareSecurity = {{expectedCloudflareSecurityJson}};
-const publicSurfaceManagedSourceAssetPaths = {{publicSurfaceManagedSourceAssetPathsJson}};
-const compactConfigPath = '.modernjs/ultramodern.json';
-const retiredMetadataPaths = [
-  '.modernjs/ultramodern-generated-contract.json',
-  '.modernjs/ultramodern-package-source.json',
-  '.modernjs/ultramodern-workspace-template-manifest.json',
-];
-const modernPackageCohort = [
-  '@modern-js/create',
-  '@modern-js/code-tools',
-  '@modern-js/app-tools',
-  '@modern-js/plugin-bff',
-  '@modern-js/plugin-i18n',
-  '@modern-js/plugin-tanstack',
-  '@modern-js/runtime',
-];
+const workspaceValidationContract = {{workspaceValidationContractJson}};
+const packageScope = workspaceValidationContract.packageScope;
+const expectedNodeVersion = workspaceValidationContract.versions.node;
+const expectedEffectVersion = workspaceValidationContract.versions.effect;
+const expectedModuleFederationVersion =
+  workspaceValidationContract.versions.moduleFederation;
+const expectedCloudflareCompatibilityDate =
+  workspaceValidationContract.versions.cloudflareCompatibilityDate;
+const tailwindEnabled = workspaceValidationContract.tailwindEnabled;
+const fullStackVerticals = workspaceValidationContract.fullStackVerticals;
+// Backend-federation and Zerops runtime surfaces only exist when the workspace
+// exposes API-bearing verticals. Shell-only workspaces skip their
+// materialization during migrate, so the contract must not require them.
+const hasBackendSurfaces = fullStackVerticals.some(
+  vertical => vertical.emitsApi,
+);
+// Every vertical (ui-only and horizontal-remote included) is a delivery unit
+// and deploys via Zerops; only the BACKEND proof/generation surfaces depend on
+// an API-bearing unit existing (split gating).
+const hasDeliveryUnits = fullStackVerticals.length > 0;
+const shellNamespace = workspaceValidationContract.shellNamespace;
+const oldRemotePaths = workspaceValidationContract.oldRemotePaths;
+const expectedBuildScript = workspaceValidationContract.scripts.build;
+const expectedCloudflareBuildScript =
+  workspaceValidationContract.scripts.cloudflareBuild;
+const expectedCloudflareDeployScript =
+  workspaceValidationContract.scripts.cloudflareDeploy;
+const expectedCloudflareSecurity =
+  workspaceValidationContract.cloudflareSecurity;
+const publicSurfaceManagedSourceAssetPaths =
+  workspaceValidationContract.publicSurfaceManagedSourceAssetPaths;
+const shellRouteMetaPaths = workspaceValidationContract.shellRouteMetaPaths;
+const compactConfigPath =
+  workspaceValidationContract.metadata.compactConfig.path;
+const retiredMetadataPaths =
+  workspaceValidationContract.legacy.retiredMetadataPaths;
+const modernPackageCohort =
+  workspaceValidationContract.cohort.modernPackages;
+const expectedAdditionalShellIds =
+  workspaceValidationContract.cohort.additionalShellIds ?? [];
+const expectedAdditionalShells =
+  workspaceValidationContract.additionalShells ?? [];
+const expectedPrimaryShellVerticalIds =
+  workspaceValidationContract.topology?.referenceTopology?.shell
+    ?.verticalRefs ?? workspaceValidationContract.cohort.verticalIds;
+const expectedReleaseCohort =
+  workspaceValidationContract.cohort.releaseCohort;
 const expectedModernPackageSpecifier = packageName => {
   if (packageSource.strategy === 'workspace') {
     return 'workspace:*';
@@ -53,8 +75,64 @@ const assertExists = relativePath => {
 const assertNotExists = relativePath => {
   assert(!fs.existsSync(path.join(root, relativePath)), `Unexpected ${relativePath}`);
 };
+const assertAnyOf = relativePaths => {
+  assert(
+    relativePaths.some(relativePath =>
+      fs.existsSync(path.join(root, relativePath)),
+    ),
+    `Missing one of: ${relativePaths.join(', ')}`,
+  );
+};
+const requiredShellWorkerCompositionPath = shellPath => {
+  const workerCompositionPath = `${shellPath}/src/routes/vertical-components.worker.tsx`;
+  if (fs.existsSync(path.join(root, workerCompositionPath))) {
+    return workerCompositionPath;
+  }
+
+  const browserComposition = readText(
+    `${shellPath}/src/routes/vertical-components.tsx`,
+  );
+  const frameworkGeneratedComposition =
+    browserComposition.includes('const createRemoteComponent =') &&
+    browserComposition.includes('export const VerticalShowcase =');
+  return frameworkGeneratedComposition
+    ? workerCompositionPath
+    : `${shellPath}/src/federated-components.worker.tsx`;
+};
+const canonicalizeJson = value => {
+  if (Array.isArray(value)) {
+    const entries = value.map(canonicalizeJson);
+    const keyedEntries = entries.every(
+      entry =>
+        entry !== null &&
+        typeof entry === 'object' &&
+        !Array.isArray(entry) &&
+        typeof entry.id === 'string',
+    );
+    if (keyedEntries) {
+      const ids = entries.map(entry => entry.id);
+      if (new Set(ids).size === ids.length) {
+        return entries.toSorted((left, right) => left.id.localeCompare(right.id));
+      }
+    }
+    return entries;
+  }
+  if (value !== null && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.keys(value)
+        .toSorted()
+        .map(key => [key, canonicalizeJson(value[key])]),
+    );
+  }
+  return value;
+};
+const sameJson = (actual, expected) =>
+  JSON.stringify(canonicalizeJson(actual)) ===
+  JSON.stringify(canonicalizeJson(expected));
 const formatJson = value =>
-  value === undefined ? 'undefined' : JSON.stringify(value);
+  value === undefined ? 'undefined' : JSON.stringify(canonicalizeJson(value));
+const quoteYamlString = value => `'${String(value).replace(/'/gu, "''")}'`;
+const quoteShellValue = value => `'${String(value).replace(/'/gu, "'\\''")}'`;
 const selfCheckFailure = (contract, message, fixArea) =>
   `MicroVertical contract self-check failed: ${contract}. ${message}. Fix area: ${fixArea}.`;
 const assertSelfCheck = (condition, contract, message, fixArea) => {
@@ -62,7 +140,7 @@ const assertSelfCheck = (condition, contract, message, fixArea) => {
 };
 const assertSameJson = (actual, expected, contract, fixArea) => {
   assertSelfCheck(
-    JSON.stringify(actual) === JSON.stringify(expected),
+    sameJson(actual, expected),
     contract,
     `Expected ${formatJson(expected)}, found ${formatJson(actual)}`,
     fixArea,
@@ -84,6 +162,590 @@ const assertArray = (value, contract, fixArea) => {
     fixArea,
   );
 };
+const assertUniqueStrings = (values, contract) => {
+  assert(Array.isArray(values), `${contract} must be an array`);
+  const seen = new Set();
+  for (const value of values) {
+    assert(
+      typeof value === 'string' && value.length > 0,
+      `${contract} must contain non-empty strings`,
+    );
+    assert(!seen.has(value), `Duplicate value "${value}" in ${contract}`);
+    seen.add(value);
+  }
+};
+const assertUniqueIdEntries = (entries, contract) => {
+  assert(Array.isArray(entries), `${contract} must be an array`);
+  const seen = new Set();
+  for (const entry of entries) {
+    const id = entry?.id;
+    assert(
+      typeof id === 'string' && id.length > 0,
+      `${contract} entries must have non-empty string ids`,
+    );
+    assert(!seen.has(id), `Duplicate id "${id}" in ${contract}`);
+    seen.add(id);
+  }
+};
+const assertSameIdCohort = (entries, expectedIds, contract, fixArea) => {
+  assertUniqueIdEntries(entries, contract);
+  assertSameJson(
+    entries.map(entry => entry.id).toSorted(),
+    [...expectedIds].toSorted(),
+    `${contract} cohort`,
+    fixArea,
+  );
+};
+const assertWorkspaceValidationContract = contract => {
+  assert(
+    contract !== null &&
+      typeof contract === 'object' &&
+      !Array.isArray(contract),
+    'Workspace validation contract must be a JSON object',
+  );
+  assert(
+    contract.schemaVersion === 1,
+    `Unsupported workspace validation contract schemaVersion ${formatJson(contract.schemaVersion)}; expected 1`,
+  );
+  assert(
+    contract.kind === 'modernjs.ultramodern-workspace-validation-contract',
+    `Unsupported workspace validation contract kind ${formatJson(contract.kind)}`,
+  );
+
+  const metadataEntries = Object.entries(contract.metadata ?? {});
+  assert(
+    metadataEntries.length === (contract.cohort?.releaseCohort ? 5 : 4),
+    'Workspace validation contract must declare every structured metadata input',
+  );
+  for (const [name, metadata] of metadataEntries) {
+    assert(
+      typeof metadata?.path === 'string' && metadata.path.length > 0,
+      `Workspace validation contract metadata.${name}.path is required`,
+    );
+    assert(
+      metadata.schemaVersion === 1,
+      `Unsupported expected metadata schemaVersion ${formatJson(metadata.schemaVersion)} for ${name}`,
+    );
+  }
+
+  assertUniqueStrings(
+    contract.cohort?.modernPackages,
+    'workspace validation contract Modern package cohort',
+  );
+  assertUniqueStrings(
+    contract.cohort?.appIds,
+    'workspace validation contract app cohort',
+  );
+  assertUniqueStrings(
+    contract.cohort?.additionalShellIds ?? [],
+    'workspace validation contract additional-shell cohort',
+  );
+  for (const [field, label] of [
+    [
+      'additionalShellOwnerIds',
+      'workspace validation contract additional-shell owner cohort',
+    ],
+    [
+      'additionalShellDeliveryUnitIds',
+      'workspace validation contract additional-shell delivery-unit cohort',
+    ],
+    [
+      'additionalShellDegradedStateIds',
+      'workspace validation contract additional-shell degraded-state cohort',
+    ],
+    [
+      'additionalShellBuildMarkerIds',
+      'workspace validation contract additional-shell build-marker cohort',
+    ],
+  ]) {
+    assertUniqueStrings(contract.cohort?.[field] ?? [], label);
+  }
+  assertUniqueStrings(
+    contract.cohort?.backendAppIds,
+    'workspace validation contract backend app cohort',
+  );
+  assertUniqueStrings(
+    contract.cohort?.verticalIds,
+    'workspace validation contract vertical cohort',
+  );
+  assertUniqueStrings(
+    contract.cohort?.sharedPackageIds,
+    'workspace validation contract shared package cohort',
+  );
+  assertUniqueStrings(
+    contract.cohort?.ownerIds,
+    'workspace validation contract owner cohort',
+  );
+  assertUniqueIdEntries(
+    contract.cohort?.packageManifests,
+    'workspace validation contract package manifests',
+  );
+  assertUniqueStrings(
+    (contract.cohort?.packageManifests ?? []).map(manifest => manifest.path),
+    'workspace validation contract package manifest paths',
+  );
+
+  const generatedSurfacePolicy = contract.generatedSurfacePolicy;
+  assert(
+    generatedSurfacePolicy?.schemaVersion === 1,
+    `Unsupported generated surface policy schemaVersion ${formatJson(generatedSurfacePolicy?.schemaVersion)}; expected 1`,
+  );
+  assertUniqueIdEntries(
+    generatedSurfacePolicy?.rules,
+    'workspace validation contract generated surface policy rules',
+  );
+  for (const rule of generatedSurfacePolicy.rules) {
+    assertUniqueStrings(
+      (rule.paths ?? []).map(entry => entry.path),
+      `generated surface policy ${rule.id} paths`,
+    );
+    assert(
+      Array.isArray(rule.paths) && rule.paths.length > 0,
+      `generated surface policy ${rule.id} must target generated paths`,
+    );
+    for (const target of rule.paths) {
+      assert(
+        target?.kind === 'file' || target?.kind === 'directory',
+        `generated surface policy ${rule.id} has an invalid target kind`,
+      );
+      assert(
+        typeof target.path === 'string' && target.path.length > 0,
+        `generated surface policy ${rule.id} target path is required`,
+      );
+      if (target.kind === 'directory') {
+        assertUniqueStrings(
+          target.extensions,
+          `generated surface policy ${rule.id} directory extensions`,
+        );
+        assertUniqueStrings(
+          target.excludePaths ?? [],
+          `generated surface policy ${rule.id} directory exclusions`,
+        );
+      }
+    }
+    assertUniqueIdEntries(
+      rule.patterns,
+      `generated surface policy ${rule.id} patterns`,
+    );
+    for (const pattern of rule.patterns) {
+      if (pattern.structuralMatcher !== undefined) {
+        assert(
+          pattern.expression === undefined && pattern.flags === undefined,
+          `generated surface policy ${rule.id}.${pattern.id} must use exactly one matcher`,
+        );
+        assert(
+          pattern.structuralMatcher?.kind === 'jsx-attribute',
+          `generated surface policy ${rule.id}.${pattern.id} has an unsupported structural matcher`,
+        );
+        assert(
+          typeof pattern.structuralMatcher.elementName === 'string' &&
+            pattern.structuralMatcher.elementName.length > 0,
+          `generated surface policy ${rule.id}.${pattern.id} structural elementName is required`,
+        );
+        assert(
+          typeof pattern.structuralMatcher.attributeName === 'string' &&
+            pattern.structuralMatcher.attributeName.length > 0,
+          `generated surface policy ${rule.id}.${pattern.id} structural attributeName is required`,
+        );
+      } else {
+        assert(
+          typeof pattern.expression === 'string' && pattern.expression.length > 0,
+          `generated surface policy ${rule.id}.${pattern.id} expression is required`,
+        );
+        assert(
+          pattern.flags === 'u',
+          `generated surface policy ${rule.id}.${pattern.id} must use deterministic Unicode matching`,
+        );
+        new RegExp(pattern.expression, pattern.flags);
+      }
+      assert(
+        typeof pattern.diagnostic === 'string' && pattern.diagnostic.length > 0,
+        `generated surface policy ${rule.id}.${pattern.id} diagnostic is required`,
+      );
+      assert(
+        typeof pattern.fixArea === 'string' && pattern.fixArea.length > 0,
+        `generated surface policy ${rule.id}.${pattern.id} fixArea is required`,
+      );
+    }
+  }
+};
+const generatedSurfacePolicyFiles = target => {
+  const absolutePath = path.join(root, target.path);
+  if (target.kind === 'file') {
+    assert(fs.existsSync(absolutePath), `Missing generated surface policy file ${target.path}`);
+    return [target.path];
+  }
+
+  assert(fs.existsSync(absolutePath), `Missing generated surface policy directory ${target.path}`);
+  const files = [];
+  const queue = [absolutePath];
+  while (queue.length > 0) {
+    const current = queue.shift();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const absoluteEntryPath = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        queue.push(absoluteEntryPath);
+      } else if (target.extensions.includes(path.extname(entry.name))) {
+        files.push(path.relative(root, absoluteEntryPath).split(path.sep).join('/'));
+      }
+    }
+  }
+  const excludedPaths = new Set(target.excludePaths ?? []);
+  return files.filter(file => !excludedPaths.has(file)).toSorted();
+};
+const isJsxNameCharacter = character =>
+  typeof character === 'string' && /[\w:.-]/u.test(character);
+const skipQuotedSource = (source, start) => {
+  const quote = source[start];
+  let cursor = start + 1;
+  while (cursor < source.length) {
+    if (source[cursor] === '\\') {
+      cursor += 2;
+    } else if (source[cursor] === quote) {
+      return cursor + 1;
+    } else {
+      cursor += 1;
+    }
+  }
+  return cursor;
+};
+const skipSourceComment = (source, start) => {
+  if (source[start + 1] === '/') {
+    const lineEnd = source.indexOf('\n', start + 2);
+    return lineEnd === -1 ? source.length : lineEnd + 1;
+  }
+  if (source[start + 1] === '*') {
+    const commentEnd = source.indexOf('*/', start + 2);
+    return commentEnd === -1 ? source.length : commentEnd + 2;
+  }
+  return start;
+};
+const findJsxAttribute = (source, matcher) => {
+  const opening = `<${matcher.elementName}`;
+  let elementIndex = source.indexOf(opening);
+  while (elementIndex !== -1) {
+    const elementBoundary = source[elementIndex + opening.length];
+    if (!isJsxNameCharacter(elementBoundary)) {
+      let cursor = elementIndex + opening.length;
+      let expressionDepth = 0;
+      while (cursor < source.length) {
+        const character = source[cursor];
+        if (character === "'" || character === '"' || character === '`') {
+          cursor = skipQuotedSource(source, cursor);
+          continue;
+        }
+        if (character === '/') {
+          const afterComment = skipSourceComment(source, cursor);
+          if (afterComment !== cursor) {
+            cursor = afterComment;
+            continue;
+          }
+        }
+        if (character === '{') {
+          expressionDepth += 1;
+          cursor += 1;
+          continue;
+        }
+        if (character === '}') {
+          expressionDepth = Math.max(0, expressionDepth - 1);
+          cursor += 1;
+          continue;
+        }
+        if (character === '>' && expressionDepth === 0) {
+          break;
+        }
+        if (
+          expressionDepth === 0 &&
+          source.startsWith(matcher.attributeName, cursor) &&
+          !isJsxNameCharacter(source[cursor - 1]) &&
+          !isJsxNameCharacter(source[cursor + matcher.attributeName.length])
+        ) {
+          let equalsIndex = cursor + matcher.attributeName.length;
+          while (/\s/u.test(source[equalsIndex] ?? '')) {
+            equalsIndex += 1;
+          }
+          if (source[equalsIndex] === '=') {
+            return { index: cursor };
+          }
+        }
+        cursor += 1;
+      }
+    }
+    elementIndex = source.indexOf(opening, elementIndex + opening.length);
+  }
+  return null;
+};
+const findGeneratedSurfacePolicyMatch = (source, pattern) =>
+  pattern.structuralMatcher?.kind === 'jsx-attribute'
+    ? findJsxAttribute(source, pattern.structuralMatcher)
+    : new RegExp(pattern.expression, pattern.flags).exec(source);
+const assertGeneratedSurfacePolicy = () => {
+  for (const rule of workspaceValidationContract.generatedSurfacePolicy.rules) {
+    const files = rule.paths.flatMap(generatedSurfacePolicyFiles).toSorted();
+    for (const relativePath of files) {
+      const source = readText(relativePath);
+      for (const pattern of rule.patterns) {
+        const match = findGeneratedSurfacePolicyMatch(source, pattern);
+        assertSelfCheck(
+          match === null,
+          `generated surface policy ${rule.id}.${pattern.id}`,
+          `${pattern.diagnostic} Found forbidden source at ${relativePath}:${match?.index ?? 0}`,
+          pattern.fixArea,
+        );
+      }
+    }
+  }
+  if ((workspaceValidationContract.cohort?.additionalShellIds ?? []).length > 0) {
+    for (const field of [
+      'additionalShellOwnerIds',
+      'additionalShellDeliveryUnitIds',
+      'additionalShellDegradedStateIds',
+      'additionalShellBuildMarkerIds',
+    ]) {
+      assertSameJson(
+        workspaceValidationContract.cohort?.[field],
+        workspaceValidationContract.cohort.additionalShellIds,
+        `workspace validation contract ${field}`,
+        'restore every generated additional-shell cohort',
+      );
+    }
+    assertSameIdCohort(
+      workspaceValidationContract.cohort?.additionalShellManifests,
+      workspaceValidationContract.cohort.additionalShellIds,
+      'workspace validation contract additional-shell manifests',
+      'restore every generated additional-shell package manifest',
+    );
+    assertSameIdCohort(
+      workspaceValidationContract.additionalShells,
+      workspaceValidationContract.cohort.additionalShellIds,
+      'workspace validation contract additional-shell records',
+      'restore every generated additional-shell contract record',
+    );
+  } else {
+    assert(
+      workspaceValidationContract.cohort?.additionalShellManifests === undefined,
+      'Single-shell workspace must not declare additional-shell manifests',
+    );
+    assert(
+      workspaceValidationContract.additionalShells === undefined,
+      'Single-shell workspace must not declare additional-shell records',
+    );
+    for (const field of [
+      'additionalShellOwnerIds',
+      'additionalShellDeliveryUnitIds',
+      'additionalShellDegradedStateIds',
+      'additionalShellBuildMarkerIds',
+    ]) {
+      assert(
+        workspaceValidationContract.cohort?.[field] === undefined,
+        `Single-shell workspace must not declare ${field}`,
+      );
+    }
+  }
+};
+const compactConfigPolicyView = config => ({
+  schemaVersion: config.schemaVersion,
+  profile: config.profile,
+  workspace: config.workspace,
+  features: config.features,
+  deploy: config.deploy,
+  moduleFederation: config.moduleFederation,
+  backendFederation: config.backendFederation,
+  agentSkills: config.agentSkills,
+  tooling: config.tooling,
+});
+const assertStructuredWorkspaceMetadata = ({
+  ultramodernConfig,
+  topology,
+  ownership,
+  overlay,
+}) => {
+  const observedMetadata = [
+    {
+      contract: workspaceValidationContract.metadata.compactConfig,
+      value: ultramodernConfig,
+    },
+    {
+      contract: workspaceValidationContract.metadata.referenceTopology,
+      value: topology,
+    },
+    {
+      contract: workspaceValidationContract.metadata.ownership,
+      value: ownership,
+    },
+    {
+      contract: workspaceValidationContract.metadata.developmentOverlay,
+      value: overlay,
+    },
+  ];
+
+  for (const entry of observedMetadata) {
+    assert(
+      entry.value !== null &&
+        typeof entry.value === 'object' &&
+        !Array.isArray(entry.value),
+      `${entry.contract.path} must contain a JSON object`,
+    );
+    assert(
+      Number.isInteger(entry.value.schemaVersion),
+      `${entry.contract.path} must declare an integer schemaVersion`,
+    );
+  }
+
+  const observedSchemaVersions = new Set(
+    observedMetadata.map(entry => entry.value.schemaVersion),
+  );
+  assert(
+    observedSchemaVersions.size === 1,
+    `Mixed workspace metadata schema versions: ${observedMetadata
+      .map(entry => `${entry.contract.path}=${entry.value.schemaVersion}`)
+      .join(', ')}`,
+  );
+  for (const entry of observedMetadata) {
+    assert(
+      entry.value.schemaVersion === entry.contract.schemaVersion,
+      `Unsupported workspace metadata schemaVersion ${entry.value.schemaVersion} at ${entry.contract.path}; expected ${entry.contract.schemaVersion}`,
+    );
+  }
+
+  assertObject(
+    ultramodernConfig.packageSource,
+    `${compactConfigPath} packageSource`,
+    'restore generated compact package-source metadata',
+  );
+  for (const field of
+    workspaceValidationContract.legacy.forbiddenCompactConfigFields) {
+    assert(
+      !Object.hasOwn(ultramodernConfig, field),
+      `Stale legacy field ${compactConfigPath}.${field} is forbidden`,
+    );
+  }
+  for (const field of
+    workspaceValidationContract.legacy.forbiddenPackageSourceFields) {
+    assert(
+      !Object.hasOwn(ultramodernConfig.packageSource, field),
+      `Stale legacy field ${compactConfigPath}.packageSource.${field} is forbidden`,
+    );
+  }
+  for (const field of workspaceValidationContract.legacy.forbiddenTopologyFields) {
+    assert(
+      !Object.hasOwn(topology, field),
+      `Stale legacy field ${workspaceValidationContract.metadata.referenceTopology.path}.${field} is forbidden`,
+    );
+  }
+
+  assertSameIdCohort(
+    ultramodernConfig.topology?.apps,
+    workspaceValidationContract.cohort.appIds,
+    `${compactConfigPath} topology.apps`,
+    'restore the complete generated app cohort',
+  );
+  assertSameIdCohort(
+    ultramodernConfig.moduleFederation?.apps,
+    workspaceValidationContract.cohort.appIds,
+    `${compactConfigPath} moduleFederation.apps`,
+    'restore the complete generated Module Federation app cohort',
+  );
+  assertSameIdCohort(
+    ultramodernConfig.backendFederation?.apps,
+    workspaceValidationContract.cohort.backendAppIds,
+    `${compactConfigPath} backendFederation.apps`,
+    'restore the complete generated backend app cohort',
+  );
+  assertSameIdCohort(
+    topology.verticals,
+    workspaceValidationContract.cohort.verticalIds,
+    `${workspaceValidationContract.metadata.referenceTopology.path} verticals`,
+    'restore the complete generated vertical cohort',
+  );
+  assertSameIdCohort(
+    topology.sharedPackages,
+    workspaceValidationContract.cohort.sharedPackageIds,
+    `${workspaceValidationContract.metadata.referenceTopology.path} sharedPackages`,
+    'restore the complete generated shared package cohort',
+  );
+  assertSameIdCohort(
+    topology.shell?.moduleFederation?.remotes,
+    workspaceValidationContract.topology.referenceTopology.shell.moduleFederation.remotes.map(
+      remote => remote.id,
+    ),
+    `${workspaceValidationContract.metadata.referenceTopology.path} shell.moduleFederation.remotes`,
+    'restore the complete generated shell remote cohort',
+  );
+  assertSameIdCohort(
+    ownership.owners,
+    workspaceValidationContract.cohort.ownerIds,
+    `${workspaceValidationContract.metadata.ownership.path} owners`,
+    'restore the complete generated ownership cohort',
+  );
+
+  for (const manifest of workspaceValidationContract.cohort.packageManifests) {
+    assertExists(manifest.path);
+    const packageJson = readJson(manifest.path);
+    assert(
+      packageJson.name === manifest.packageName,
+      `${manifest.path} package name must be ${manifest.packageName}`,
+    );
+    if (manifest.role === 'shell' || manifest.role === 'vertical') {
+      assert(
+        packageJson.modernjs?.appId === manifest.id,
+        `${manifest.path} modernjs.appId must be ${manifest.id}`,
+      );
+    }
+  }
+  if (expectedReleaseCohort) {
+    const releaseCohortContract = workspaceValidationContract.metadata.releaseCohort;
+    assertSelfCheck(
+      releaseCohortContract?.path === '.modernjs/release-cohort.json',
+      'authenticated release cohort projection',
+      'Expected release-cohort metadata path is missing or invalid',
+      '.modernjs/release-cohort.json',
+    );
+    assertSameJson(
+      readJson(releaseCohortContract.path),
+      expectedReleaseCohort,
+      'authenticated release cohort projection',
+      releaseCohortContract.path,
+    );
+  }
+};
+const assertStructuredWorkspaceMetadataSemantics = ({
+  ultramodernConfig,
+  topology,
+  ownership,
+  overlay,
+}) => {
+  assertSameJson(
+    compactConfigPolicyView(ultramodernConfig),
+    workspaceValidationContract.policy.compactConfig,
+    `${compactConfigPath} policy`,
+    'restore generated compact workspace policy metadata',
+  );
+  assertSameJson(
+    ultramodernConfig.topology,
+    workspaceValidationContract.topology.compactConfig,
+    `${compactConfigPath} topology`,
+    'restore the complete generated compact topology cohort',
+  );
+  assertSameJson(
+    topology,
+    workspaceValidationContract.topology.referenceTopology,
+    workspaceValidationContract.metadata.referenceTopology.path,
+    'restore the complete generated reference topology',
+  );
+  assertSameJson(
+    ownership,
+    workspaceValidationContract.topology.ownership,
+    workspaceValidationContract.metadata.ownership.path,
+    'restore the complete generated ownership topology',
+  );
+  assertSameJson(
+    overlay,
+    workspaceValidationContract.topology.developmentOverlay,
+    workspaceValidationContract.metadata.developmentOverlay.path,
+    'restore the complete generated development topology',
+  );
+};
 const findById = (entries, id) =>
   Array.isArray(entries) ? entries.find(entry => entry?.id === id) : undefined;
 const generatedContractLabel = compactConfigPath;
@@ -136,6 +798,40 @@ const buildMarkerFor = app =>
     .update(`${packageScope}:${app.packageSuffix}:${app.id}:0.1.0`)
     .digest('hex')
     .slice(0, 16);
+const deliveryUnitIdentityFixArea =
+  'regenerate vertical identity from delivery-unit record; do not hand-edit surface markers';
+const deliveryUnitBlock = record => ({
+  schemaVersion: record?.schemaVersion,
+  kind: record?.kind,
+  unitId: record?.unitId,
+  packageName: record?.packageName,
+  version: record?.version,
+  buildMarker: record?.buildMarker,
+  sourceRevision: record?.sourceRevision,
+});
+const expectedCompactAppFor = id =>
+  workspaceValidationContract.topology.compactConfig?.apps?.find(
+    entry => entry?.id === id,
+  );
+const expectedDeliveryUnitFor = vertical => {
+  const expectedApp = expectedCompactAppFor(vertical.id);
+  return (
+    expectedApp?.backendFederation?.deliveryUnit ??
+    expectedApp?.deliveryUnit ??
+    vertical.deliveryUnit
+  );
+};
+const assertBuildFacadeExport = (source, exportName, sourcePath, contract) => {
+  const exportPattern = new RegExp(
+    `export const ${exportName} = ${sourcePath.replace(/\./gu, '\\.')};`,
+  );
+  assertSelfCheck(
+    exportPattern.test(source),
+    contract,
+    `${exportName} must re-export the canonical ultramodern-build.json artifact rather than hand-forking fields`,
+    deliveryUnitIdentityFixArea,
+  );
+};
 const normalizeCompactApp = rawApp => {
   const id = String(rawApp.id);
   const kind = rawApp.kind === 'vertical' ? 'vertical' : 'shell';
@@ -175,6 +871,10 @@ const normalizeCompactApp = rawApp => {
                 consumer => typeof consumer === 'string',
               )
             : ['shell-super-app', id],
+          // Preserve the API protocol so the synthesized generated contract can
+          // branch between the REST (`shared/api.ts` + `./api/client`) and RPC
+          // (`shared/rpc.ts` + `./api/rpc-client`) surfaces.
+          protocol: rawApp.api.protocol === 'rpc' ? 'rpc' : 'rest',
         }
       : undefined;
 
@@ -210,6 +910,14 @@ const normalizeCompactApp = rawApp => {
     verticalRefs: Array.isArray(moduleFederation.verticalRefs)
       ? moduleFederation.verticalRefs.filter(ref => typeof ref === 'string')
       : [],
+    deliveryUnit:
+      rawApp.deliveryUnit && typeof rawApp.deliveryUnit === 'object'
+        ? rawApp.deliveryUnit
+        : undefined,
+    backendFederation:
+      rawApp.backendFederation && typeof rawApp.backendFederation === 'object'
+        ? rawApp.backendFederation
+        : undefined,
     api,
   };
 };
@@ -287,7 +995,7 @@ const createPublicSurface = app => {
     metadataExport: './src/routes/ultramodern-route-metadata',
     generator: 'scripts/generate-public-surface-assets.mts',
     outputRoot: 'dist/public',
-    cloudflareOutputRoot: '.output/public',
+    cloudflareBuildOutputRoot: 'dist-cloudflare/public',
     privateRoutePolicy: 'omit-from-generated-public-surface',
     files:
       publicRoutes.length > 0
@@ -394,7 +1102,10 @@ const createCloudflareRoutes = app => ({
   ssr: '/en',
   mfManifest: '/mf-manifest.json',
   locale: `/locales/en/${appNamespace(app)}.json`,
-  ...(app.api
+  // Mirrors policy.ts:76 — the Cloudflare proof carries a REST readiness route
+  // only for `rest` units. An `rpc` unit exposes its `/rpc` route instead and
+  // must not emit (or require) a REST readiness path.
+  ...(app.api && app.api.protocol === 'rest'
     ? {
         apiReadiness: `${app.api.prefix}/${app.api.stem}/readiness`,
       }
@@ -404,7 +1115,7 @@ const createCloudflareDeploy = app => ({
   target: 'cloudflare',
   workerName: expectedWorkerName(app.packageSuffix),
   publicUrlEnv: `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(app.id)}`,
-  compatibilityDate: '{{cloudflareCompatibilityDate}}',
+  compatibilityDate: expectedCloudflareCompatibilityDate,
   compatibilityFlags: ['nodejs_compat', 'global_fetch_strictly_public'],
   assetsBinding: 'ASSETS',
   routes: createCloudflareRoutes(app),
@@ -486,7 +1197,7 @@ const createAppConfigContract = app => ({
     'zephyrRspackPlugin',
   ],
   dev: {
-    assetPrefix: '/',
+    assetPrefix: app.kind === 'shell' ? '/' : 'app-public-origin',
   },
   output: {
     assetPrefix: {
@@ -585,7 +1296,7 @@ const createAppContract = (app, apps) => ({
     target: 'cloudflare',
     cloudflare: createCloudflareDeploy(app),
     worker: {
-      compatibilityDate: '{{cloudflareCompatibilityDate}}',
+      compatibilityDate: expectedCloudflareCompatibilityDate,
       name: expectedWorkerName(app.packageSuffix),
       security: expectedCloudflareSecurity,
       ssr: true,
@@ -593,7 +1304,7 @@ const createAppContract = (app, apps) => ({
   },
   ssr: app.moduleFederationSsr
     ? {
-        mode: 'string',
+        mode: 'stream',
         moduleFederationAppSSR: true,
       }
     : undefined,
@@ -625,37 +1336,55 @@ const createAppContract = (app, apps) => ({
       : {}),
     exposes: app.exposes,
     dts: {
-      compilerInstance: 'tsgo',
+      compilerInstance: 'effect-tsgo',
       displayErrorInTerminal: true,
       tsConfigPath: './tsconfig.mf-types.json',
     },
     browserSafeExposesOnly: true,
   },
-  marker: {
-    appId: app.id,
-    packageName: app.package ?? packageNameFor(packageScope, app.packageSuffix),
-    version: '0.1.0',
-    build: buildMarkerFor(app),
-    deployProfile: 'cloudflare-ssr-mf-effect-v1',
-    uiSurface: 'ui',
-    ...(app.api ? { apiSurface: 'api' } : {}),
+    marker: {
+      appId: app.id,
+      packageName: app.package ?? packageNameFor(packageScope, app.packageSuffix),
+      version: '0.1.0',
+      build: app.deliveryUnit?.buildMarker ?? buildMarkerFor(app),
+      deployProfile: 'cloudflare-ssr-mf-effect-v1',
+      uiSurface: 'ui',
+      ...(app.api ? { apiSurface: 'api' } : {}),
   },
   ...(app.api
     ? {
-        api: {
-          runtime: 'effect',
-          import: '@modern-js/plugin-bff/effect-edge',
-          prefix: app.api.prefix,
-          openapi: '/openapi.json',
-          strictEffectApproach: true,
-          workerEntry: 'worker/__modern_bff_effect.js',
-          contract: './api',
-          client: './api/client',
-          readiness: createEffectReadiness(app),
-          requestContext: createEffectRequestContext(),
-          domainOperations: createEffectDomainOperations(app),
-          ...createEffectOperationContract(app),
-        },
+        // An `rpc` unit exposes the Effect RpcGroup contract/client and the
+        // `/rpc` route instead of the REST `shared/api.ts` + `./api/client`
+        // surface, so it carries no OpenAPI/readiness/domain-operation metadata.
+        api:
+          (app.api.protocol ?? 'rest') === 'rpc'
+            ? {
+                runtime: 'effect',
+                import: '@modern-js/plugin-bff/effect-edge',
+                prefix: app.api.prefix,
+                protocol: 'rpc',
+                strictEffectApproach: true,
+                workerEntry: 'worker/__modern_bff_effect.js',
+                contract: './api',
+                client: './api/rpc-client',
+                group: toCamelCase(app.api.stem),
+                rpc: { path: '/rpc', serialization: 'json' },
+                rpcPath: `${app.api.prefix}/rpc`,
+              }
+            : {
+                runtime: 'effect',
+                import: '@modern-js/plugin-bff/effect-edge',
+                prefix: app.api.prefix,
+                openapi: '/openapi.json',
+                strictEffectApproach: true,
+                workerEntry: 'worker/__modern_bff_effect.js',
+                contract: './api',
+                client: './api/client',
+                readiness: createEffectReadiness(app),
+                requestContext: createEffectRequestContext(),
+                domainOperations: createEffectDomainOperations(app),
+                ...createEffectOperationContract(app),
+              },
       }
     : {}),
 });
@@ -720,13 +1449,26 @@ const createModernPackageAliases = packageSourceConfig => {
     ]),
   );
 };
-const synthesizePackageSourceFromCompact = config => {
-  const source = config.packageSource ?? {};
-  const strategy = source.strategy === 'install' ? 'install' : 'workspace';
+const createPackageSourceView = config => {
+  const source = config.packageSource;
+  assert(
+    source !== null && typeof source === 'object' && !Array.isArray(source),
+    `${compactConfigPath} packageSource must be a JSON object`,
+  );
+  assert(
+    source.strategy === 'workspace' || source.strategy === 'install',
+    `${compactConfigPath} packageSource.strategy must be workspace or install`,
+  );
+  if (source.strategy === 'install') {
+    assert(
+      typeof source.modernPackageVersion === 'string' &&
+        source.modernPackageVersion.length > 0,
+      `${compactConfigPath} install package source must declare modernPackageVersion`,
+    );
+  }
+  const strategy = source.strategy;
   const specifier =
-    strategy === 'install' && typeof source.modernPackageVersion === 'string'
-      ? source.modernPackageVersion
-      : 'workspace:*';
+    strategy === 'install' ? source.modernPackageVersion : 'workspace:*';
   const aliases = createModernPackageAliases(source);
   return {
     schemaVersion: 1,
@@ -762,16 +1504,124 @@ const synthesizeGeneratedContractFromCompact = config => {
     apps: apps.map(app => createAppContract(app, apps)),
   };
 };
-const readPackageSourceView = config => {
-  return synthesizePackageSourceFromCompact(config);
-};
 const readGeneratedContractView = config => {
   return synthesizeGeneratedContractFromCompact(config);
 };
 const expectedManifestUrl = vertical =>
   `http://localhost:${vertical.port}/mf-manifest.json`;
 const expectedApiUrl = vertical =>
-  `http://localhost:${vertical.port}${vertical.apiPrefix}`;
+  `http://localhost:${vertical.port}${vertical.apiPrefix}${
+    vertical.apiProtocol === 'rpc' ? '/rpc' : ''
+  }`;
+const expectedBackendFederationName = vertical => `${vertical.mfName}Backend`;
+const expectedBackendManifestUrl = vertical =>
+  `http://localhost:${vertical.port}/backend-mf-manifest.json`;
+const expectedBackendContainerEntry = vertical =>
+  `http://localhost:${vertical.port}/backendRemoteEntry.cjs`;
+const expectedBackendManifestEnv = vertical =>
+  `VERTICAL_${toEnvSegment(vertical.domain ?? vertical.id)}_BACKEND_MF_MANIFEST`;
+const expectedPublicUrlEnv = vertical =>
+  `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(vertical.id)}`;
+const expectedCloudflareWorkerName = vertical =>
+  toKebabCase(`${packageScope}-${vertical.packageSuffix ?? vertical.id}`).slice(
+    0,
+    63,
+  );
+const backendFederationSubset = backendFederation => ({
+  role: backendFederation?.role,
+  name: backendFederation?.name,
+  runtimeFramework: backendFederation?.runtimeFramework,
+  strictEffectApproach: backendFederation?.strictEffectApproach,
+  exposeRuntime: backendFederation?.exposes?.['./effect-api']?.runtime,
+  exposeReadiness: backendFederation?.exposes?.['./effect-api']?.readiness,
+  versionBoundary: {
+    invariant: backendFederation?.versionBoundary?.invariant,
+    uiManifestUrl: backendFederation?.versionBoundary?.ui?.manifestUrl,
+    apiReadiness: backendFederation?.versionBoundary?.api?.readiness,
+  },
+  cloudflare: {
+    kind: backendFederation?.executionSurfaces?.cloudflare?.kind,
+    workerName: backendFederation?.executionSurfaces?.cloudflare?.workerName,
+    publicUrlEnv:
+      backendFederation?.executionSurfaces?.cloudflare?.publicUrlEnv,
+    zephyrRuntime:
+      backendFederation?.executionSurfaces?.cloudflare?.zephyr?.runtime,
+  },
+  node: {
+    kind: backendFederation?.executionSurfaces?.node?.kind,
+    remoteName: backendFederation?.executionSurfaces?.node?.remoteName,
+    manifestEnv: backendFederation?.executionSurfaces?.node?.manifestEnv,
+    manifestUrl: backendFederation?.executionSurfaces?.node?.manifestUrl,
+    containerEntry:
+      backendFederation?.executionSurfaces?.node?.containerEntry,
+    remoteType: backendFederation?.executionSurfaces?.node?.remoteType,
+    expose: backendFederation?.executionSurfaces?.node?.expose,
+  },
+  compatibility: {
+    contractVersion: backendFederation?.compatibility?.contractVersion,
+  },
+  topLevelManifestUrl: backendFederation?.manifestUrl,
+  topLevelContainerEntry: backendFederation?.containerEntry,
+});
+const expectedBackendFederationSubset = vertical => ({
+  role: 'microvertical-server',
+  name: expectedBackendFederationName(vertical),
+  runtimeFramework: 'effect',
+  strictEffectApproach: true,
+  exposeRuntime: `${vertical.path}/api/index.ts`,
+  // The RPC surface exposes no REST readiness endpoint, so its backend
+  // federation contract omits the readiness probes (G7a).
+  exposeReadiness:
+    vertical.apiProtocol === 'rpc'
+      ? undefined
+      : `${vertical.apiPrefix}/${vertical.stem}/readiness`,
+  versionBoundary: {
+    invariant: 'web-and-api-same-build',
+    uiManifestUrl: expectedManifestUrl(vertical),
+    apiReadiness:
+      vertical.apiProtocol === 'rpc'
+        ? undefined
+        : `${vertical.apiPrefix}/${vertical.stem}/readiness`,
+  },
+  cloudflare: {
+    kind: 'cloudflare-worker-snapshot',
+    workerName: expectedCloudflareWorkerName(vertical),
+    publicUrlEnv: expectedPublicUrlEnv(vertical),
+    zephyrRuntime: 'ssr-worker',
+  },
+  node: {
+    kind: 'node-mf-runtime',
+    remoteName: expectedBackendFederationName(vertical),
+    manifestEnv: expectedBackendManifestEnv(vertical),
+    manifestUrl: expectedBackendManifestUrl(vertical),
+    containerEntry: expectedBackendContainerEntry(vertical),
+    remoteType: 'commonjs-module',
+    expose: './effect-api',
+  },
+  compatibility: {
+    contractVersion: 'microvertical-server-effect-v1',
+  },
+  topLevelManifestUrl: undefined,
+  topLevelContainerEntry: undefined,
+});
+const serverExecutionSubset = serverExecution => ({
+  apiBaseUrl: serverExecution?.apiBaseUrl,
+  versionBoundary: serverExecution?.versionBoundary,
+  cloudflareKind: serverExecution?.cloudflare?.kind,
+  cloudflareWorkerName: serverExecution?.cloudflare?.workerName,
+  nodeKind: serverExecution?.node?.kind,
+  nodeManifestUrl: serverExecution?.node?.manifestUrl,
+  nodeContainerEntry: serverExecution?.node?.containerEntry,
+});
+const expectedServerExecutionSubset = vertical => ({
+  apiBaseUrl: expectedApiUrl(vertical),
+  versionBoundary: 'web-and-api-same-build',
+  cloudflareKind: 'cloudflare-worker-snapshot',
+  cloudflareWorkerName: expectedCloudflareWorkerName(vertical),
+  nodeKind: 'node-mf-runtime',
+  nodeManifestUrl: expectedBackendManifestUrl(vertical),
+  nodeContainerEntry: expectedBackendContainerEntry(vertical),
+});
 const remoteContractSubset = remote => ({
   id: remote?.id,
   name: remote?.name,
@@ -792,25 +1642,78 @@ const requiredMicroVerticalPaths = vertical => [
   `${vertical.path}/tsconfig.json`,
   `${vertical.path}/tsconfig.mf-types.json`,
   `${vertical.path}/modern.config.ts`,
-  `${vertical.path}/module-federation.config.ts`,
-  `${vertical.path}/api/index.ts`,
-  `${vertical.path}/shared/api.ts`,
-  `${vertical.path}/src/api/${vertical.stem}-client.ts`,
   `${vertical.path}/src/modern-app-env.d.ts`,
   `${vertical.path}/src/modern.runtime.ts`,
-  `${vertical.path}/src/federation-entry.tsx`,
-  ...vertical.componentPaths,
   `${vertical.path}/locales/en/translation.json`,
   `${vertical.path}/locales/en/${vertical.namespace}.json`,
   `${vertical.path}/locales/cs/translation.json`,
   `${vertical.path}/locales/cs/${vertical.namespace}.json`,
-  `${vertical.path}/src/routes/index.css`,
-  `${vertical.path}/src/routes/layout.tsx`,
-  `${vertical.path}/src/routes/ultramodern-route-head.tsx`,
-  `${vertical.path}/src/routes/ultramodern-route-metadata.ts`,
-  `${vertical.path}/src/routes/[lang]/page.tsx`,
-  ...vertical.routePagePaths,
-  ...vertical.routeMetaPaths,
+  ...(vertical.emitsUi
+    ? [
+        `${vertical.path}/module-federation.config.ts`,
+        `${vertical.path}/src/federation-entry.tsx`,
+        ...vertical.componentPaths,
+        `${vertical.path}/src/routes/index.css`,
+        `${vertical.path}/src/routes/layout.tsx`,
+        `${vertical.path}/src/routes/ultramodern-route-head.tsx`,
+        `${vertical.path}/src/routes/ultramodern-route-metadata.ts`,
+        `${vertical.path}/src/routes/[lang]/page.tsx`,
+        ...(vertical.exposes.includes('./Widget')
+          ? [
+              `${vertical.path}/src/routes/[lang]/_mf/fragment/widget/page.tsx`,
+            ]
+          : []),
+        ...vertical.routePagePaths,
+        ...vertical.routeMetaPaths,
+      ]
+    : []),
+  ...(vertical.emitsApi
+    ? [
+        `${vertical.path}/backend-federation.config.ts`,
+        `${vertical.path}/api/effect-api.ts`,
+        `${vertical.path}/api/index.ts`,
+        `${vertical.path}/${vertical.apiContractPath}`,
+        `${vertical.path}/${vertical.apiClientPath}`,
+      ]
+    : []),
+];
+// UI/MF artifacts an `api-only` unit must NOT emit (headless invariant), and
+// API/BFF artifacts a `ui-only`/Horizontal Remote unit must NOT emit.
+const forbiddenMicroVerticalPaths = vertical => [
+  ...(vertical.emitsUi
+    ? []
+    : [
+        `${vertical.path}/module-federation.config.ts`,
+        `${vertical.path}/src/federation-entry.tsx`,
+        // The federated demo `./Widget` component (descriptors.ts:127 ->
+        // remoteComponentOutputPath) is a UI-only artifact; a headless api-only
+        // unit exposes no browser component and must not ship it.
+        `${vertical.path}/src/components/${vertical.domain ?? vertical.id}-widget.tsx`,
+        `${vertical.path}/src/routes/layout.tsx`,
+        `${vertical.path}/src/routes/[lang]/page.tsx`,
+        `${vertical.path}/src/routes/[lang]/_mf/fragment/widget/page.tsx`,
+        // A headless api-only unit renders no browser surface, so it must not
+        // ship route components, the colocated route-metadata/head modules, or
+        // the colocated `[lang]/route.meta.ts` route-meta file.
+        `${vertical.path}/src/routes/[lang]/route.meta.ts`,
+        `${vertical.path}/src/routes/ultramodern-route-head.tsx`,
+        `${vertical.path}/src/routes/ultramodern-route-metadata.ts`,
+        `${vertical.path}/src/routes/index.css`,
+      ]),
+  ...(vertical.emitsApi
+    ? []
+    : [
+        `${vertical.path}/shared/api.ts`,
+        // A ui-only/Horizontal Remote unit carries no API contract in either
+        // protocol (neither the REST `shared/api.ts` nor the RPC `shared/rpc.ts`)
+        // and no generated API client.
+        `${vertical.path}/shared/rpc.ts`,
+        `${vertical.path}/backend-federation.config.ts`,
+        `${vertical.path}/api/index.ts`,
+        `${vertical.path}/api/effect-api.ts`,
+        `${vertical.path}/src/api/${vertical.domain ?? vertical.id}-client.ts`,
+        `${vertical.path}/src/api/${vertical.domain ?? vertical.id}-rpc-client.ts`,
+      ]),
 ];
 const assertRequiredVerticalFile = vertical => relativePath => {
   assertSelfCheck(
@@ -820,6 +1723,14 @@ const assertRequiredVerticalFile = vertical => relativePath => {
     'restore the generated MicroVertical files or rerun the MicroVertical generator',
   );
 };
+const assertForbiddenVerticalFile = vertical => relativePath => {
+  assertSelfCheck(
+    !fs.existsSync(path.join(root, relativePath)),
+    `forbidden files for ${vertical.id}`,
+    `Unexpected ${relativePath} for a ${vertical.surfaceProfile} unit`,
+    `remove ${relativePath}; a ${vertical.surfaceProfile} unit does not emit this surface`,
+  );
+};
 const assertMicroVerticalContractGraph = ({
   generatedContract,
   topology,
@@ -829,8 +1740,16 @@ const assertMicroVerticalContractGraph = ({
 }) => {
   const expectedVerticalIds = fullStackVerticals.map(vertical => vertical.id);
   const expectedAppIds = ['shell-super-app', ...expectedVerticalIds];
-  const expectedShellRemotes = fullStackVerticals.map(
-    expectedRemoteContractSubset,
+  const expectedShellVerticalIds = expectedPrimaryShellVerticalIds;
+  const expectedShellRemotes = expectedShellVerticalIds.flatMap(
+    verticalId => {
+      const vertical = fullStackVerticals.find(
+        candidate => candidate.id === verticalId,
+      );
+      return vertical === undefined
+        ? []
+        : [expectedRemoteContractSubset(vertical)];
+    },
   );
 
   assertObject(
@@ -881,7 +1800,7 @@ const assertMicroVerticalContractGraph = ({
 
   assertSameJson(
     topology.shell.verticalRefs ?? [],
-    expectedVerticalIds,
+    expectedShellVerticalIds,
     'topology/reference-topology.json shell.verticalRefs',
     'restore generated topology shell references',
   );
@@ -912,7 +1831,7 @@ const assertMicroVerticalContractGraph = ({
   );
   assertSameJson(
     shellContract.moduleFederation?.verticalRefs ?? [],
-    expectedVerticalIds,
+    expectedShellVerticalIds,
     `${generatedContractLabel} shell moduleFederation.verticalRefs`,
     'regenerate the generated shell Module Federation contract',
   );
@@ -925,11 +1844,11 @@ const assertMicroVerticalContractGraph = ({
   assertSameJson(
     shellContract.ssr,
     {
-      mode: 'string',
+      mode: 'stream',
       moduleFederationAppSSR: true,
     },
     `${generatedContractLabel} shell SSR contract`,
-    'restore generated string SSR Module Federation settings',
+    'restore generated streaming SSR Module Federation settings',
   );
 
   for (const vertical of fullStackVerticals) {
@@ -964,10 +1883,14 @@ const assertMicroVerticalContractGraph = ({
             remoteContractSubset,
           ),
         },
-        api: {
-          prefix: topologyEntry.api?.bff?.prefix,
-          serverEntry: topologyEntry.api?.serverEntry,
-        },
+        ...(vertical.emitsApi
+          ? {
+              api: {
+                prefix: topologyEntry.api?.bff?.prefix,
+                serverEntry: topologyEntry.api?.serverEntry,
+              },
+            }
+          : {}),
       },
       {
         kind: 'vertical',
@@ -980,15 +1903,71 @@ const assertMicroVerticalContractGraph = ({
           verticalRefs: expectedRefs,
           remotes: expectedRemoteSubsetsForRefs(expectedRefs),
         },
-        api: {
-          prefix: vertical.apiPrefix,
-          serverEntry: `${vertical.path}/api/index.ts`,
-        },
+        ...(vertical.emitsApi
+          ? {
+              api: {
+                prefix: vertical.apiPrefix,
+                serverEntry: `${vertical.path}/api/index.ts`,
+              },
+            }
+          : {}),
       },
       `topology/reference-topology.json verticals.${vertical.id}`,
       'restore generated topology vertical entries',
     );
-
+    if (vertical.emitsApi) {
+      assertSameJson(
+        backendFederationSubset(topologyEntry.backendFederation),
+        expectedBackendFederationSubset(vertical),
+        `topology/reference-topology.json verticals.${vertical.id}.backendFederation`,
+        'restore generated MicroVertical server execution contract',
+      );
+    }
+
+    if (vertical.deliveryUnit) {
+      const compactApp = findById(
+        ultramodernConfig.topology?.apps,
+        vertical.id,
+      );
+      const expectedDeliveryUnit = deliveryUnitBlock(
+        expectedDeliveryUnitFor(vertical),
+      );
+      assertSameJson(
+        deliveryUnitBlock(compactApp?.deliveryUnit),
+        expectedDeliveryUnit,
+        `${generatedContractLabel} topology.apps.${vertical.id}.deliveryUnit`,
+        deliveryUnitIdentityFixArea,
+      );
+      if (vertical.emitsApi) {
+        assertSameJson(
+          deliveryUnitBlock(compactApp?.backendFederation?.deliveryUnit),
+          expectedDeliveryUnit,
+          `${generatedContractLabel} topology.apps.${vertical.id}.backendFederation.deliveryUnit`,
+          deliveryUnitIdentityFixArea,
+        );
+      }
+      assertSameJson(
+        deliveryUnitBlock(topologyEntry.deliveryUnit),
+        expectedDeliveryUnit,
+        `topology/reference-topology.json verticals.${vertical.id}.deliveryUnit`,
+        deliveryUnitIdentityFixArea,
+      );
+      if (vertical.emitsApi) {
+        assertSameJson(
+          deliveryUnitBlock(topologyEntry.backendFederation?.deliveryUnit),
+          expectedDeliveryUnit,
+          `topology/reference-topology.json verticals.${vertical.id}.backendFederation.deliveryUnit`,
+          deliveryUnitIdentityFixArea,
+        );
+        assertSelfCheck(
+          topologyEntry.backendFederation?.versionBoundary?.identityRoot === 'deliveryUnit',
+          `topology/reference-topology.json verticals.${vertical.id}.backendFederation.versionBoundary.identityRoot`,
+          `Expected "deliveryUnit", found ${formatJson(topologyEntry.backendFederation?.versionBoundary?.identityRoot)}`,
+          deliveryUnitIdentityFixArea,
+        );
+      }
+    }
+
     assertObject(
       ownershipEntry,
       `topology/ownership.json owners.${vertical.id}`,
@@ -1013,31 +1992,67 @@ const assertMicroVerticalContractGraph = ({
       `topology/local-overlays/development.json ports.${vertical.id}`,
       'restore generated local development port overlay',
     );
-    assertSameJson(
-      overlay.manifests[vertical.id],
-      expectedManifestUrl(vertical),
-      `topology/local-overlays/development.json manifests.${vertical.id}`,
-      'restore generated local Module Federation manifest overlay',
-    );
-    assertSameJson(
-      overlay.apis[vertical.id],
-      expectedApiUrl(vertical),
-      `topology/local-overlays/development.json apis.${vertical.id}`,
-      'restore generated local API overlay',
-    );
+    if (vertical.emitsUi) {
+      assertSameJson(
+        overlay.manifests[vertical.id],
+        expectedManifestUrl(vertical),
+        `topology/local-overlays/development.json manifests.${vertical.id}`,
+        'restore generated local Module Federation manifest overlay',
+      );
+    }
+    if (vertical.emitsApi) {
+      assertSameJson(
+        overlay.apis[vertical.id],
+        expectedApiUrl(vertical),
+        `topology/local-overlays/development.json apis.${vertical.id}`,
+        'restore generated local API overlay',
+      );
+      assertSameJson(
+        serverExecutionSubset(overlay.serverExecution?.[vertical.id]),
+        expectedServerExecutionSubset(vertical),
+        `topology/local-overlays/development.json serverExecution.${vertical.id}`,
+        'restore generated local MicroVertical server execution overlay',
+      );
+    }
 
-    assertSameJson(
-      shellPackage.dependencies?.[vertical.packageName],
-      'workspace:*',
-      `apps/shell-super-app/package.json dependencies.${vertical.packageName}`,
-      'restore shell dependency for the MicroVertical API consumer',
-    );
-    assertSameJson(
-      shellPackage['zephyr:dependencies']?.[vertical.zephyrAlias],
-      `${vertical.packageName}@workspace:*`,
-      `apps/shell-super-app/package.json zephyr:dependencies.${vertical.zephyrAlias}`,
-      'restore shell Zephyr dependency metadata for the MicroVertical',
-    );
+
+    // Plain workspace dependencies and Zephyr metadata are gated
+    // INDEPENDENTLY (G2a/G28): every shell depends on each API-emitting
+    // vertical (its vertical-clients.ts re-exports the client) regardless of
+    // UI composition, while Zephyr metadata follows UI composition refs only.
+    const shellPackagesForDependencyChecks = [
+      {
+        id: 'shell-super-app',
+        path: 'apps/shell-super-app',
+        pkg: shellPackage,
+        uiRefs: expectedShellVerticalIds,
+      },
+      ...expectedAdditionalShells.map(additionalShell => ({
+        id: additionalShell.id,
+        path: additionalShell.path,
+        pkg: readJson(`${additionalShell.path}/package.json`),
+        uiRefs: additionalShell.verticalRefs ?? [],
+      })),
+    ];
+    for (const shellEntry of shellPackagesForDependencyChecks) {
+      const composed = shellEntry.uiRefs.includes(vertical.id);
+      if (vertical.emitsApi || composed) {
+        assertSameJson(
+          shellEntry.pkg.dependencies?.[vertical.packageName],
+          'workspace:*',
+          `${shellEntry.path}/package.json dependencies.${vertical.packageName}`,
+          'restore shell dependency for the MicroVertical consumer',
+        );
+      }
+      if (composed) {
+        assertSameJson(
+          shellEntry.pkg['zephyr:dependencies']?.[vertical.zephyrAlias],
+          `${vertical.packageName}@workspace:*`,
+          `${shellEntry.path}/package.json zephyr:dependencies.${vertical.zephyrAlias}`,
+          'restore shell Zephyr dependency metadata for the MicroVertical',
+        );
+      }
+    }
 
     assertObject(
       contractEntry,
@@ -1057,11 +2072,15 @@ const assertMicroVerticalContractGraph = ({
             remoteContractSubset,
           ),
         },
-        api: {
-          prefix: contractEntry.api?.prefix,
-          contract: contractEntry.api?.contract,
-          client: contractEntry.api?.client,
-        },
+        ...(vertical.emitsApi
+          ? {
+              api: {
+                prefix: contractEntry.api?.prefix,
+                contract: contractEntry.api?.contract,
+                client: contractEntry.api?.client,
+              },
+            }
+          : {}),
         ssr: contractEntry.ssr,
       },
       {
@@ -1074,13 +2093,19 @@ const assertMicroVerticalContractGraph = ({
           verticalRefs: expectedRefs,
           remotes: expectedRemoteSubsetsForRefs(expectedRefs),
         },
-        api: {
-          prefix: vertical.apiPrefix,
-          contract: './api',
-          client: './api/client',
-        },
+        ...(vertical.emitsApi
+          ? {
+              api: {
+                prefix: vertical.apiPrefix,
+                // Protocol-aware exports: `rest` -> `./api`/`./api/client`,
+                // `rpc` -> `./api`/`./api/rpc-client`.
+                contract: vertical.apiContractExport,
+                client: vertical.apiClientExport,
+              },
+            }
+          : {}),
         ssr: {
-          mode: 'string',
+          mode: 'stream',
           moduleFederationAppSSR: true,
         },
       },
@@ -1116,19 +2141,34 @@ const assertProjectReferenceEmitConfig = (tsConfig, packagePath) => {
   );
 };
 const assertTsConfigReferenceGraph = () => {
+  const baseTsConfig = readJson('tsconfig.base.json');
   const rootTsConfig = readJson('tsconfig.json');
   const shellTsConfig = readJson('apps/shell-super-app/tsconfig.json');
   const shellMfTypesTsConfig = readJson(
     'apps/shell-super-app/tsconfig.mf-types.json',
   );
+  const additionalShellPaths = (
+    workspaceValidationContract.structuralShellPolicy?.shells ?? []
+  )
+    .filter(shell => shell.id !== 'shell-super-app')
+    .map(shell => shell.packageDir);
   const expectedRootReferences = [
     ...sharedPackagePaths,
     'apps/shell-super-app',
     ...fullStackVerticals.map(vertical => vertical.path),
+    ...additionalShellPaths,
   ].map(referencePath => ({ path: referencePath }));
   const expectedShellReferences = [
     ...sharedPackagePaths,
-    ...fullStackVerticals.map(vertical => vertical.path),
+    ...(topology.shell?.verticalRefs ?? [])
+      .map(verticalRef =>
+        fullStackVerticals.find(candidate => candidate.id === verticalRef),
+      )
+      .filter(Boolean)
+      // The shell only project-references verticals whose API client types it
+      // imports; UI-only remotes are federated at runtime, not type-referenced.
+      .filter(vertical => vertical.emitsApi)
+      .map(vertical => vertical.path),
   ].map(referencePath =>
     referenceFrom('apps/shell-super-app', referencePath),
   );
@@ -1151,6 +2191,13 @@ const assertTsConfigReferenceGraph = () => {
     'apps/shell-super-app/tsconfig.json references',
     'restore the generated shell project-reference graph',
   );
+  assert(baseTsConfig.compilerOptions?.skipLibCheck !== true, 'tsconfig.base.json must not use skipLibCheck');
+  assertSameJson(
+    shellTsConfig.include ?? [],
+    ['src', 'locales/**/*.json', 'package.json', 'shared'],
+    'apps/shell-super-app/tsconfig.json include',
+    'restore the generated shell typecheck boundary',
+  );
   assertProjectReferenceEmitConfig(
     shellTsConfig,
     'apps/shell-super-app',
@@ -1158,7 +2205,7 @@ const assertTsConfigReferenceGraph = () => {
   assertSameJson(
     shellMfTypesTsConfig,
     {
-      extends: './tsconfig.json',
+      extends: '../../tsconfig.base.json',
       include: ['src/modern-app-env.d.ts'],
     },
     'apps/shell-super-app/tsconfig.mf-types.json',
@@ -1191,23 +2238,77 @@ const assertTsConfigReferenceGraph = () => {
       `${vertical.path}/tsconfig.json references`,
       'restore the generated MicroVertical project-reference graph',
     );
+    assertSameJson(
+      verticalTsConfig.include ?? [],
+      [
+        'src',
+        'locales/**/*.json',
+        'package.json',
+        'shared',
+        ...(vertical.emitsApi ? ['api'] : []),
+      ],
+      `${vertical.path}/tsconfig.json include`,
+      'restore the generated MicroVertical typecheck boundary',
+    );
     assertProjectReferenceEmitConfig(verticalTsConfig, vertical.path);
     assertSameJson(
       verticalMfTypesTsConfig,
       {
-        extends: './tsconfig.json',
-        include: [
-          'src/federation-entry.tsx',
-          ...vertical.componentPaths.map(componentPath =>
-            componentPath.replace(`${vertical.path}/`, ''),
-          ),
-          'src/modern-app-env.d.ts',
-        ],
+        extends: '../../tsconfig.base.json',
+        // A headless (api-only) unit exposes no Module Federation surface, so
+        // its DTS boundary only covers the ambient env declarations (G2a).
+        include: vertical.emitsUi
+          ? [
+              'src/federation-entry.tsx',
+              ...vertical.componentPaths.map(componentPath =>
+                componentPath.replace(`${vertical.path}/`, ''),
+              ),
+              'src/modern-app-env.d.ts',
+            ]
+          : ['src/modern-app-env.d.ts'],
       },
       `${vertical.path}/tsconfig.mf-types.json`,
       'restore the generated MicroVertical Module Federation DTS boundary',
     );
   }
+
+  for (const shell of expectedAdditionalShells) {
+    const shellTsConfig = readJson(`${shell.path}/tsconfig.json`);
+    const shellMfTypesTsConfig = readJson(
+      `${shell.path}/tsconfig.mf-types.json`,
+    );
+    const expectedShellReferences = [
+      ...sharedPackagePaths,
+      ...(shell.verticalRefs ?? [])
+        .map(verticalRef =>
+          fullStackVerticals.find(candidate => candidate.id === verticalRef),
+        )
+        .filter(Boolean)
+        .map(referencedVertical => referencedVertical.path),
+    ].map(referencePath => referenceFrom(shell.path, referencePath));
+    assertSameJson(
+      shellTsConfig.references ?? [],
+      expectedShellReferences,
+      `${shell.path}/tsconfig.json references`,
+      'restore the generated additional-shell project-reference graph',
+    );
+    assertSameJson(
+      shellTsConfig.include ?? [],
+      ['src', 'locales/**/*.json', 'package.json', 'shared'],
+      `${shell.path}/tsconfig.json include`,
+      'restore the generated additional-shell typecheck boundary',
+    );
+    assertProjectReferenceEmitConfig(shellTsConfig, shell.path);
+    assertSameJson(
+      shellMfTypesTsConfig,
+      {
+        extends: '../../tsconfig.base.json',
+        include: ['src/modern-app-env.d.ts'],
+      },
+      `${shell.path}/tsconfig.mf-types.json`,
+      'restore the generated additional-shell Module Federation DTS boundary',
+    );
+  }
 };
 const packageJsonFiles = startDir => {
   const files = [];
@@ -1216,7 +2317,7 @@ const packageJsonFiles = startDir => {
     const current = queue.shift();
     for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
       if (
-        ['.git', '.output', 'dist', 'node_modules', 'repos'].includes(
+      ['.git', '.output', '.zerops', 'dist', 'node_modules', 'repos'].includes(
           entry.name,
         )
       ) {
@@ -1235,35 +2336,52 @@ const packageJsonFiles = startDir => {
 const modernDependencyNames = packageJson =>
   [
     ...new Set(
-      ['dependencies', 'devDependencies']
+      [
+        'dependencies',
+        'devDependencies',
+        'optionalDependencies',
+        'peerDependencies',
+      ]
         .flatMap(section => Object.keys(packageJson[section] ?? {}))
         .filter(packageName => packageName.startsWith('@modern-js/')),
     ),
   ];
 const assertModernPackageCohort = () => {
-  const modernPackageNames = packageSource.modernPackages?.packages;
-  assert(
-    Array.isArray(modernPackageNames) && modernPackageNames.length > 0,
-    'Package source metadata must list the Modern package cohort',
-  );
-  for (const packageName of modernPackageNames) {
-    assert(
-      typeof packageName === 'string' && packageName.startsWith('@modern-js/'),
-      `Package source metadata contains invalid Modern package name ${packageName}`,
-    );
-  }
-
+  const modernPackageNames = workspaceValidationContract.cohort.modernPackages;
   const modernPackageNameSet = new Set(modernPackageNames);
+  const observedModernPackageNames = new Set();
+  const observedAppIds = [];
+  // Additional shells (G28) are their own Delivery Units registered in the
+  // additive `config.shells` collection and gated by the structural thin-shell
+  // policy; they are deliberately kept out of the strict topology.apps cohort,
+  // so their package manifests are excluded from the app-id cohort walk here.
+  const additionalShellAppIds = new Set(
+    (workspaceValidationContract.structuralShellPolicy?.shells ?? [])
+      .map(shell => shell.id)
+      .filter(id => id !== 'shell-super-app'),
+  );
   for (const packageJsonPath of packageJsonFiles(root)) {
     const relativePath = path.relative(root, packageJsonPath).split(path.sep).join('/');
     const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
+    if (
+      typeof packageJson.modernjs?.appId === 'string' &&
+      !additionalShellAppIds.has(packageJson.modernjs.appId)
+    ) {
+      observedAppIds.push(packageJson.modernjs.appId);
+    }
     for (const packageName of modernDependencyNames(packageJson)) {
+      observedModernPackageNames.add(packageName);
       assert(
         modernPackageNameSet.has(packageName),
         `${relativePath} declares ${packageName} outside package source metadata`,
       );
     }
-    for (const section of ['dependencies', 'devDependencies']) {
+    for (const section of [
+      'dependencies',
+      'devDependencies',
+      'optionalDependencies',
+      'peerDependencies',
+    ]) {
       for (const packageName of modernPackageNames) {
         const actual = packageJson[section]?.[packageName];
         if (actual !== undefined) {
@@ -1275,6 +2393,25 @@ const assertModernPackageCohort = () => {
       }
     }
   }
+
+  for (const packageName of modernPackageNames) {
+    assert(
+      observedModernPackageNames.has(packageName),
+      `Modern package cohort is missing ${packageName}`,
+    );
+  }
+  assertUniqueStrings(observedAppIds, 'generated app package manifests');
+  // The app-id cohort is a SET: observedAppIds is discovered by a
+  // filesystem-ordered package.json walk, while cohort.appIds is in generation
+  // insertion order. Compare order-insensitively (every other cohort check uses
+  // the same sorted comparison via assertSameIdCohort) so a multi-vertical
+  // workspace whose insertion order differs from filesystem order still passes.
+  assertSameJson(
+    [...observedAppIds].toSorted(),
+    [...workspaceValidationContract.cohort.appIds].toSorted(),
+    'generated app package manifest cohort',
+    'restore every generated app package manifest',
+  );
 };
 const assertPublicSurfaceAssets = (appPath, publicRoutes) => {
   for (const relativePath of publicSurfaceManagedSourceAssetPaths) {
@@ -1286,7 +2423,8 @@ const assertPublicSurfaceContract = (appId, publicSurface) => {
   assert(publicSurface?.artifactLifecycle === 'build-and-deploy-output', `${appId} public surface artifacts must be build/deploy outputs`);
   assert(publicSurface?.generator === 'scripts/generate-public-surface-assets.mts', `${appId} public surface generator script is incorrect`);
   assert(publicSurface?.outputRoot === 'dist/public', `${appId} public surface dist outputRoot is incorrect`);
-  assert(publicSurface?.cloudflareOutputRoot === '.output/public', `${appId} public surface Cloudflare outputRoot is incorrect`);
+  assert(publicSurface?.cloudflareBuildOutputRoot === 'dist-cloudflare/public', `${appId} public surface Cloudflare build outputRoot is incorrect`);
+  assert(!('cloudflareOutputRoot' in (publicSurface ?? {})), `${appId} public surface must not target final .output directly`);
   assert(!('staticRoot' in (publicSurface ?? {})), `${appId} public surface must not point at source config/public`);
   assert((publicSurface?.files ?? []).includes('robots.txt'), `${appId} public surface must always emit robots.txt`);
   assert(publicSurface?.contentExpansion?.authoring === 'route-owned-esm-provider', `${appId} public content expansion authoring is incorrect`);
@@ -1349,21 +2487,41 @@ const extractAssetPrefixExpression = modernConfig => {
   assert(match?.groups?.expression, 'modern.config.ts must assign assetPrefix');
   return match.groups.expression;
 };
-const assertBuildCacheBase = (appId, modernConfig) => {
+const assertTargetIsolatedBuildArtifacts = (appId, modernConfig) => {
   assert(
-    modernConfig.includes("const buildCacheTarget = cloudflareDeployEnabled ? 'cloudflare' : 'web';") &&
-      modernConfig.includes('const buildCacheDirectory = `node_modules/.cache/rspack-${appId}-${buildCacheTarget}`;') &&
+    modernConfig.includes("const buildTarget = cloudflareDeployEnabled ? 'cloudflare' : 'web';") &&
+      modernConfig.includes("const buildOutputRoot = cloudflareDeployEnabled ? 'dist-cloudflare' : 'dist';") &&
+      modernConfig.includes('const buildTempDirectory = `node_modules/.modern-js-${appId}-${buildTarget}`;') &&
+      modernConfig.includes('const buildCacheDirectory = `node_modules/.cache/rspack-${appId}-${buildTarget}`;') &&
+      modernConfig.includes('root: buildOutputRoot,') &&
+      modernConfig.includes('tempDir: buildTempDirectory,') &&
+      modernConfig.includes('cacheDigest: [appId, buildTarget],') &&
       modernConfig.includes('cacheDirectory: buildCacheDirectory,'),
-    `${appId} must provide a per-app/per-target Rspack cache base directory`,
+    `${appId} must isolate build output, Modern temp files, and Rspack cache by app and build target`,
   );
 };
 const assertCloudflareBuildSkipsDeployRebuild = (appId, packageJson) => {
+  const cloudflareBuild = packageJson.scripts?.['cloudflare:build'] ?? '';
+  const buildCommand = 'MODERNJS_DEPLOY=cloudflare modern build';
+  const publicSurfaceCommand = `--app ${appId} --target cloudflare-dist`;
+  const deployCommand =
+    'MODERNJS_DEPLOY=cloudflare modern deploy --skip-build';
   assert(
-    packageJson.scripts?.['cloudflare:build']?.includes(
-      'ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy --skip-build',
-    ),
+    cloudflareBuild.includes(deployCommand),
     `${appId} cloudflare:build must deploy with --skip-build after the explicit Cloudflare build`,
   );
+  assert(
+    cloudflareBuild.includes(publicSurfaceCommand) &&
+      cloudflareBuild.indexOf(buildCommand) <
+        cloudflareBuild.indexOf(publicSurfaceCommand) &&
+      cloudflareBuild.indexOf(publicSurfaceCommand) <
+        cloudflareBuild.indexOf(deployCommand),
+    `${appId} cloudflare:build must generate public-surface assets in the explicit Cloudflare build output before deploy`,
+  );
+  assert(
+    !/--target (?:dist|cloudflare)(?=\s|$)/u.test(cloudflareBuild),
+    `${appId} cloudflare:build must not target the Node dist or final Cloudflare output directly`,
+  );
 };
 const stripYamlInlineComment = value => {
   let quote = undefined;
@@ -1478,6 +2636,9 @@ const requiredPaths = [
   '.gitignore',
   'package.json',
   'pnpm-workspace.yaml',
+  `patches/@module-federation__modern-js-v3@${expectedModuleFederationVersion}.patch`,
+  `patches/@module-federation__bridge-react@${expectedModuleFederationVersion}.patch`,
+  'patches/effect-schema-error-type-id.patch',
   'tsconfig.json',
   'tsconfig.base.json',
   'oxlint.config.ts',
@@ -1485,8 +2646,6 @@ const requiredPaths = [
   '.github/renovate.json',
   '.github/workflows/ultramodern-workspace-gates.yml',
   '.agents/agent-reference-repos.json',
-  '.codex/skills-lock.json',
-  '.codex/rstackjs-agent-skills-LICENSE',
   'topology/reference-topology.json',
   'topology/ownership.json',
   'topology/local-overlays/development.json',
@@ -1494,13 +2653,18 @@ const requiredPaths = [
   'scripts/bootstrap-agent-skills.mts',
   'scripts/check-ultramodern-api-boundaries.mts',
   'scripts/check-ultramodern-i18n-boundaries.mts',
+  ...(hasBackendSurfaces ? ['scripts/generate-node-backend-federation.mts'] : []),
   'scripts/generate-public-surface-assets.mts',
+  'scripts/generate-tanstack-routes.mts',
   'scripts/proof-cloudflare-version.mts',
+  ...(hasDeliveryUnits ? ['scripts/proof-workerd-ssr.mts'] : []),
+  ...(hasBackendSurfaces ? ['scripts/proof-node-backend-federation.mts'] : []),
   'scripts/setup-agent-reference-repos.mts',
   'scripts/ultramodern-performance-readiness.config.mjs',
   'scripts/ultramodern-performance-readiness.mts',
   'scripts/ultramodern-typecheck.mts',
   'scripts/validate-ultramodern-workspace.mts',
+  'scripts/verify-cloudflare-output.mts',
   'apps/shell-super-app/package.json',
   'apps/shell-super-app/tsconfig.json',
   'apps/shell-super-app/tsconfig.mf-types.json',
@@ -1515,10 +2679,13 @@ const requiredPaths = [
   `apps/shell-super-app/locales/cs/${shellNamespace}.json`,
   'apps/shell-super-app/src/routes/index.css',
   'apps/shell-super-app/src/routes/layout.tsx',
+  'apps/shell-super-app/src/routes/shell-frame.tsx',
   'apps/shell-super-app/src/routes/ultramodern-route-head.tsx',
   'apps/shell-super-app/src/routes/ultramodern-route-metadata.ts',
+  'apps/shell-super-app/src/routes/vertical-components.tsx',
+  requiredShellWorkerCompositionPath('apps/shell-super-app'),
   'apps/shell-super-app/src/routes/[lang]/page.tsx',
-  ...{{shellRouteMetaPathsJson}},
+  ...shellRouteMetaPaths,
   'packages/shared-contracts/package.json',
   'packages/shared-contracts/src/index.ts',
   'packages/shared-contracts/tsconfig.json',
@@ -1534,12 +2701,10 @@ for (const vertical of fullStackVerticals) {
 
 if (tailwindEnabled) {
   requiredPaths.push(
-    'apps/shell-super-app/postcss.config.mjs',
     'apps/shell-super-app/tailwind.config.ts',
-    ...fullStackVerticals.flatMap(vertical => [
-      `${vertical.path}/postcss.config.mjs`,
-      `${vertical.path}/tailwind.config.ts`,
-    ]),
+    ...fullStackVerticals
+      .filter(vertical => vertical.emitsUi)
+      .flatMap(vertical => [`${vertical.path}/tailwind.config.ts`]),
   );
 }
 
@@ -1549,10 +2714,86 @@ for (const vertical of fullStackVerticals) {
   requiredMicroVerticalPaths(vertical).forEach(
     assertRequiredVerticalFile(vertical),
   );
+  // Reject profile-foreign surfaces planted into a unit (e.g. a browser MF
+  // config in a headless api-only unit, or an API contract in a UI-only unit).
+  forbiddenMicroVerticalPaths(vertical).forEach(
+    assertForbiddenVerticalFile(vertical),
+  );
+}
+for (const shell of expectedAdditionalShells) {
+  requiredPaths.push(
+    `${shell.path}/package.json`,
+    `${shell.path}/tsconfig.json`,
+    `${shell.path}/tsconfig.mf-types.json`,
+    `${shell.path}/modern.config.ts`,
+    `${shell.path}/module-federation.config.ts`,
+    `${shell.path}/src/modern-app-env.d.ts`,
+    `${shell.path}/src/modern.runtime.ts`,
+    `${shell.path}/src/api/vertical-clients.ts`,
+    `${shell.path}/locales/en/translation.json`,
+    `${shell.path}/locales/en/${shellNamespace}.json`,
+    `${shell.path}/locales/cs/translation.json`,
+    `${shell.path}/locales/cs/${shellNamespace}.json`,
+    `${shell.path}/src/routes/index.css`,
+    `${shell.path}/src/routes/layout.tsx`,
+    `${shell.path}/src/routes/shell-frame.tsx`,
+    `${shell.path}/src/routes/vertical-components.tsx`,
+    requiredShellWorkerCompositionPath(shell.path),
+    `${shell.path}/src/routes/ultramodern-route-head.tsx`,
+    `${shell.path}/src/routes/ultramodern-route-metadata.ts`,
+    `${shell.path}/src/routes/[lang]/page.tsx`,
+    ...shellRouteMetaPaths.map(relativePath =>
+      relativePath.replace(/^apps\/shell-super-app/u, shell.path),
+    ),
+  );
+  if (tailwindEnabled) {
+    requiredPaths.push(`${shell.path}/tailwind.config.ts`);
+  }
 }
 for (const requiredPath of requiredPaths) {
   assertExists(requiredPath);
 }
+// Agent skills metadata may live under .agents/ (agents-standard layout) or
+// .codex/ (legacy scaffold default).
+assertAnyOf(['.agents/skills-lock.json', '.codex/skills-lock.json']);
+assertAnyOf([
+  '.agents/rstackjs-agent-skills-LICENSE',
+  '.codex/rstackjs-agent-skills-LICENSE',
+]);
+const pnpmWorkspace = readText('pnpm-workspace.yaml');
+assert(
+  pnpmWorkspace.includes(`'@effect/opentelemetry': ${expectedEffectVersion}`),
+  'pnpm-workspace.yaml must override @effect/opentelemetry to the generated Effect cohort',
+);
+assert(
+  pnpmWorkspace.includes(`effect: ${expectedEffectVersion}`),
+  'pnpm-workspace.yaml must override effect to the generated Effect cohort',
+);
+assert(
+  pnpmWorkspace.includes(
+    `'@module-federation/modern-js-v3@${expectedModuleFederationVersion}': patches/@module-federation__modern-js-v3@${expectedModuleFederationVersion}.patch`,
+  ),
+  'pnpm-workspace.yaml must patch the generated Module Federation Modern.js integration cohort',
+);
+assert(
+  pnpmWorkspace.includes(
+    `'@module-federation/bridge-react@${expectedModuleFederationVersion}': patches/@module-federation__bridge-react@${expectedModuleFederationVersion}.patch`,
+  ),
+  'pnpm-workspace.yaml must patch the generated Module Federation React bridge cohort',
+);
+assert(
+  [
+    `'effect@${expectedEffectVersion}'`,
+    `effect@${expectedEffectVersion}`,
+  ].some(effectPatchKey =>
+    pnpmWorkspace.includes(
+      `${effectPatchKey}: patches/effect-schema-error-type-id.patch`,
+    ),
+  ),
+  'pnpm-workspace.yaml must patch the generated Effect declaration cohort',
+);
+assertWorkspaceValidationContract(workspaceValidationContract);
+assertGeneratedSurfacePolicy();
 for (const oldRemotePath of oldRemotePaths) {
   assertNotExists(oldRemotePath);
 }
@@ -1561,13 +2802,23 @@ for (const retiredMetadataPath of retiredMetadataPaths) {
 }
 const rootPackage = readJson('package.json');
 const ultramodernConfig = readJson(compactConfigPath);
+const topology = readJson(
+  workspaceValidationContract.metadata.referenceTopology.path,
+);
+const ownership = readJson(workspaceValidationContract.metadata.ownership.path);
+const overlay = readJson(
+  workspaceValidationContract.metadata.developmentOverlay.path,
+);
+assertStructuredWorkspaceMetadata({
+  ultramodernConfig,
+  topology,
+  ownership,
+  overlay,
+});
 const bridgeConfig =
   ultramodernConfig?.bridge?.enabled === true ? ultramodernConfig.bridge : undefined;
-const packageSource = readPackageSourceView(ultramodernConfig);
+const packageSource = createPackageSourceView(ultramodernConfig);
 const generatedContract = readGeneratedContractView(ultramodernConfig);
-const topology = readJson('topology/reference-topology.json');
-const ownership = readJson('topology/ownership.json');
-const overlay = readJson('topology/local-overlays/development.json');
 const shellPackage = readJson('apps/shell-super-app/package.json');
 
 assertMicroVerticalContractGraph({
@@ -1577,6 +2828,12 @@ assertMicroVerticalContractGraph({
   overlay,
   shellPackage,
 });
+assertStructuredWorkspaceMetadataSemantics({
+  ultramodernConfig,
+  topology,
+  ownership,
+  overlay,
+});
 assertTsConfigReferenceGraph();
 
 assert(rootPackage.private === true, 'Root package must be private');
@@ -1611,6 +2868,594 @@ assert(rootPackage.modernjs?.packageSource?.strategy === packageSource.strategy,
 assert(packageSource.strategy === 'workspace' || packageSource.strategy === 'install', 'Package source strategy must be workspace or install');
 assert(packageSource.strategy === 'install' || packageSource.modernPackages?.specifier === 'workspace:*', 'Workspace package source must be explicitly backed by workspace:*');
 assertModernPackageCohort();
+const assertStructuralShellPolicy = () => {
+  const policy = workspaceValidationContract.structuralShellPolicy;
+  const compositionPolicy =
+    workspaceValidationContract.federatedCompositionSourcePolicy;
+  if (!policy && !compositionPolicy) {
+    return;
+  }
+  const collectSourceFiles = absoluteDir => {
+    const files = [];
+    const queue = [absoluteDir];
+    while (queue.length > 0) {
+      const current = queue.shift();
+      let entries;
+      try {
+        entries = fs.readdirSync(current, { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const entry of entries) {
+        const absoluteEntry = path.join(current, entry.name);
+        if (entry.isDirectory()) {
+          queue.push(absoluteEntry);
+        } else if (/\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/u.test(entry.name)) {
+          files.push(absoluteEntry);
+        }
+      }
+    }
+    return files.toSorted();
+  };
+  // Strip comments before scanning imports so the structural gate reasons
+  // about executable source only. A specifier that lives inside a comment
+  // (`// import x from '../../../verticals/catalog/src/internal'` or a /* */
+  // block) must not trip the gate, and — conversely — a real import carrying a
+  // magic comment (`import(/* webpackChunkName */ '...')`) must still be
+  // detected once the comment is removed. The scanner is string-literal aware,
+  // so a `//` inside a string (e.g. `'http://example.com'`) is preserved and
+  // never mistaken for a comment start. It is also regex-literal aware, so a
+  // quote inside a regex (`const q = /['"]/;`) never opens a phantom string
+  // that would swallow a later real comment, and template-interpolation aware,
+  // so a comment inside `${ … }` is stripped like any other code. Regex-vs-
+  // division is resolved from the previous significant token; `<`/`>` are
+  // deliberately excluded so JSX closing tags (`</div>`) are never mistaken for
+  // regex literals. Dependency-free by construction.
+  const stripSourceComments = code => {
+    const isIdentifierChar = ch => ch !== '' && /[A-Za-z0-9_$]/u.test(ch);
+    // Punctuation after which a `/` opens a regex literal (not a division op).
+    // `<`/`>` are intentionally omitted to keep JSX closing/self-closing tags
+    // (`</div>`, `<br/>`) parsing as code rather than as regex.
+    const regexPrecedingPunct = new Set([
+      '(', ',', '=', '[', '{', ';', ':', '!', '&', '|', '?', '+', '-', '*',
+      '%', '^', '~',
+    ]);
+    // Keywords after which a `/` opens a regex literal.
+    const regexPrecedingKeywords = new Set([
+      'return', 'typeof', 'instanceof', 'in', 'of', 'new', 'delete', 'void',
+      'do', 'else', 'yield', 'await', 'case',
+    ]);
+    let result = '';
+    let state = 'code';
+    // Last significant (non-whitespace) code character emitted and the trailing
+    // identifier word — together they decide regex-vs-division for a `/`.
+    let lastSignificant = '';
+    let currentWord = '';
+    let regexInClass = false;
+    // Stack of open `${ … }` interpolations; each entry is the `{ }` nesting
+    // depth reached inside that interpolation so the matching close brace pops
+    // back to template text. Comments inside an interpolation are code.
+    const interpolations = [];
+    const regexCanFollow = () => {
+      if (lastSignificant === '') {
+        return true;
+      }
+      if (regexPrecedingPunct.has(lastSignificant)) {
+        return true;
+      }
+      if (isIdentifierChar(lastSignificant)) {
+        return regexPrecedingKeywords.has(currentWord);
+      }
+      return false;
+    };
+    const emitCodeChar = ch => {
+      result += ch;
+      if (/\s/u.test(ch)) {
+        return;
+      }
+      if (isIdentifierChar(ch)) {
+        currentWord += ch;
+      } else {
+        currentWord = '';
+      }
+      lastSignificant = ch;
+    };
+    for (let index = 0; index < code.length; index += 1) {
+      const char = code[index];
+      const next = index + 1 < code.length ? code[index + 1] : '';
+      if (state === 'code') {
+        if (char === '/' && next === '/') {
+          state = 'line';
+          index += 1;
+        } else if (char === '/' && next === '*') {
+          state = 'block';
+          result += ' ';
+          index += 1;
+        } else if (char === '/' && regexCanFollow()) {
+          state = 'regex';
+          regexInClass = false;
+          emitCodeChar(char);
+        } else if (char === "'") {
+          state = 'single';
+          result += char;
+        } else if (char === '"') {
+          state = 'double';
+          result += char;
+        } else if (char === '`') {
+          state = 'template';
+          result += char;
+        } else if (
+          char === '}' &&
+          interpolations.length > 0 &&
+          interpolations[interpolations.length - 1] === 0
+        ) {
+          // The closing brace of the current `${ … }` interpolation: resume the
+          // enclosing template literal text.
+          interpolations.pop();
+          state = 'template';
+          result += char;
+          lastSignificant = char;
+          currentWord = '';
+        } else {
+          if (interpolations.length > 0) {
+            if (char === '{') {
+              interpolations[interpolations.length - 1] += 1;
+            } else if (char === '}') {
+              interpolations[interpolations.length - 1] -= 1;
+            }
+          }
+          emitCodeChar(char);
+        }
+        continue;
+      }
+      if (state === 'line') {
+        if (char === '\n') {
+          state = 'code';
+          result += char;
+        }
+        continue;
+      }
+      if (state === 'block') {
+        if (char === '*' && next === '/') {
+          state = 'code';
+          index += 1;
+        } else if (char === '\n') {
+          result += char;
+        }
+        continue;
+      }
+      if (state === 'regex') {
+        // Regex body passes through as code. Honor escapes and character
+        // classes (`[...]`), where `/` need not be escaped, so the literal ends
+        // only at the true closing `/`.
+        if (char === '\\') {
+          result += char + next;
+          index += 1;
+          continue;
+        }
+        if (char === '[') {
+          regexInClass = true;
+        } else if (char === ']') {
+          regexInClass = false;
+        } else if (char === '/' && !regexInClass) {
+          state = 'code';
+          result += char;
+          lastSignificant = char;
+          currentWord = '';
+          continue;
+        }
+        result += char;
+        continue;
+      }
+      if (state === 'template') {
+        if (char === '\\') {
+          result += char + next;
+          index += 1;
+          continue;
+        }
+        if (char === '`') {
+          state = 'code';
+          result += char;
+          lastSignificant = char;
+          currentWord = '';
+          continue;
+        }
+        if (char === '$' && next === '{') {
+          // Enter a `${ … }` interpolation: its body is code, so re-enter the
+          // full scanner (nesting-aware) to strip comments inside it.
+          interpolations.push(0);
+          state = 'code';
+          result += '${';
+          index += 1;
+          lastSignificant = '{';
+          currentWord = '';
+          continue;
+        }
+        result += char;
+        continue;
+      }
+      // Inside a single- or double-quoted string literal: preserve every
+      // character, honor escapes so a closing quote is not misread, and never
+      // treat `//` or `/*` as comments.
+      if (char === '\\') {
+        result += char + next;
+        index += 1;
+        continue;
+      }
+      if (
+        (state === 'single' && char === "'") ||
+        (state === 'double' && char === '"')
+      ) {
+        state = 'code';
+        result += char;
+        lastSignificant = char;
+        currentWord = '';
+        continue;
+      }
+      result += char;
+    }
+    return result;
+  };
+  for (const shell of policy?.shells ?? []) {
+    for (const forbidden of policy?.forbiddenPathClasses ?? []) {
+      assert(
+        !fs.existsSync(path.join(root, shell.packageDir, forbidden.path)),
+        selfCheckFailure(
+          `structural thin-shell ${forbidden.id}`,
+          `${forbidden.diagnostic} Forbidden artifact ${shell.packageDir}/${forbidden.path} exists`,
+          `remove forbidden thin-shell artifact ${shell.packageDir}/${forbidden.path}`,
+        ),
+      );
+    }
+    const srcAbsolute = path.join(root, shell.srcDir);
+    if (!fs.existsSync(srcAbsolute)) {
+      continue;
+    }
+    for (const file of collectSourceFiles(srcAbsolute)) {
+      const source = stripSourceComments(fs.readFileSync(file, 'utf-8'));
+      const relative = path.relative(root, file).split(path.sep).join('/');
+      for (const pattern of policy?.forbiddenImportPatterns ?? []) {
+        const match = new RegExp(pattern.expression, pattern.flags).exec(source);
+        assert(
+          match === null,
+          selfCheckFailure(
+            `structural thin-shell ${pattern.id}`,
+            `${pattern.diagnostic} Found forbidden import at ${relative}:${match?.index ?? 0}`,
+            'consume only published surfaces from the thin shell',
+          ),
+        );
+      }
+    }
+  }
+
+  const runtimeModuleSpecifiers = source => {
+    const specifiers = [];
+    const matchAll = expression => {
+      for (const match of source.matchAll(expression)) {
+        specifiers.push(match.at(-1));
+      }
+    };
+    for (const match of source.matchAll(/\b(?:import|export)\s+([^;'"`]+?)\s+from\s*['"]([^'"]+)['"]/gu)) {
+      if (!match[1].trimStart().startsWith('type ')) {
+        specifiers.push(match[2]);
+      }
+    }
+    matchAll(/\bimport\s*['"]([^'"]+)['"]/gu);
+    matchAll(/\bimport\s*\(\s*['"]([^'"]+)['"]/gu);
+    matchAll(/\brequire\s*\(\s*['"]([^'"]+)['"]/gu);
+    return specifiers;
+  };
+  const remoteImplementationFor = (specifier, remotes) =>
+    remotes.find(remote => {
+      const packageSubpath = specifier.startsWith(`${remote.packageName}/`)
+        ? specifier.slice(remote.packageName.length + 1)
+        : undefined;
+      if (
+        specifier === remote.packageName ||
+        (packageSubpath !== undefined && !packageSubpath.startsWith('api'))
+      ) {
+        return true;
+      }
+      const normalizedSpecifier = specifier.replaceAll('\\', '/');
+      return normalizedSpecifier.includes(`${remote.directory}/`);
+    });
+
+  for (const host of compositionPolicy?.hosts ?? []) {
+    const srcAbsolute = path.join(root, host.srcDir);
+    if (!fs.existsSync(srcAbsolute)) {
+      continue;
+    }
+    for (const file of collectSourceFiles(srcAbsolute)) {
+      const source = stripSourceComments(fs.readFileSync(file, 'utf-8'));
+      const relative = path.relative(root, file).split(path.sep).join('/');
+      for (const pattern of compositionPolicy.forbiddenSourcePatterns ?? []) {
+        const match = new RegExp(pattern.expression, pattern.flags).exec(source);
+        assert(
+          match === null,
+          selfCheckFailure(
+            `federated composition ${pattern.id}`,
+            `${pattern.diagnostic} Found forbidden source at ${relative}:${match?.index ?? 0}`,
+            'compose remote rendering through framework Module Federation primitives',
+          ),
+        );
+      }
+      // Declaration files cannot execute. Ambient federation declarations may
+      // re-export a workspace component solely to preserve its public prop
+      // type, so treating their specifiers as runtime implementation imports
+      // produces a false positive.
+      if (/\.d\.(?:ts|mts|cts)$/u.test(relative)) {
+        continue;
+      }
+      for (const specifier of runtimeModuleSpecifiers(source)) {
+        const remote = remoteImplementationFor(specifier, host.remotes ?? []);
+        assert(
+          remote === undefined,
+          selfCheckFailure(
+            'federated composition remote-runtime-package-import',
+            `Host ${host.id} imports remote render implementation ${specifier} from ${remote?.id} at ${relative}`,
+            'use import type for contracts or compose the implementation through Module Federation',
+          ),
+        );
+      }
+    }
+  }
+};
+assertStructuralShellPolicy();
+const assertAdditionalShellCohort = () => {
+  const primaryShellConfig = findById(
+    ultramodernConfig.topology?.apps,
+    'shell-super-app',
+  );
+  const overlayPorts = overlay.ports ?? {};
+  const configuredPorts = [
+    ...Object.entries(overlayPorts).map(([id, port]) => ({ id, port })),
+    ...(!Object.hasOwn(overlayPorts, 'shell-super-app')
+      ? [{ id: 'shell-super-app', port: primaryShellConfig?.port }]
+      : []),
+    ...expectedAdditionalShells.map(shell => ({
+      id: shell.id,
+      port: shell.port,
+    })),
+  ];
+  const portsByValue = new Map();
+  for (const { id, port } of configuredPorts) {
+    assert(
+      typeof port === 'number' && Number.isFinite(port),
+      `Configured development port for ${id} must be finite`,
+    );
+    const previous = portsByValue.get(port);
+    assert(
+      previous === undefined,
+      `Duplicate configured development port ${port} for ${previous} and ${id}`,
+    );
+    portsByValue.set(port, id);
+  }
+
+  if (expectedAdditionalShellIds.length === 0) {
+    assert(
+      ultramodernConfig.shells === undefined,
+      'Single-shell workspace must not declare config.shells',
+    );
+    return;
+  }
+
+  assertSameIdCohort(
+    ultramodernConfig.shells,
+    expectedAdditionalShellIds,
+    `${compactConfigPath} shells`,
+    'restore every configured additional shell',
+  );
+  const configuredShellRecords = ultramodernConfig.shells;
+  const configuredShellById = new Map(
+    configuredShellRecords.map(shell => [shell.id, shell]),
+  );
+  assertUniqueStrings(
+    [
+      primaryShellConfig?.moduleFederation?.name,
+      ...expectedAdditionalShells.map(shell => shell.mfName),
+    ],
+    'configured shell Module Federation identities',
+  );
+  assertUniqueStrings(
+    expectedAdditionalShells.map(
+      shell => shell.deliveryUnit?.buildMarker,
+    ),
+    'configured shell build markers',
+  );
+
+  const configuredOrigins = [...portsByValue.keys()]
+    .toSorted((left, right) => left - right)
+    .map(port => `http://localhost:${port}`);
+
+  for (const shell of expectedAdditionalShells) {
+    const configShell = configuredShellById.get(shell.id);
+    assertObject(
+      configShell,
+      `${compactConfigPath} shells.${shell.id}`,
+      'restore the generated additional-shell config record',
+    );
+    assertSameJson(
+      {
+        id: configShell.id,
+        name: configShell.name,
+        kind: configShell.kind,
+        package: configShell.package,
+        path: configShell.path,
+        port: configShell.port,
+        portEnv: configShell.portEnv,
+        mfName: configShell.mfName,
+        verticalRefs: configShell.verticalRefs,
+        owner: configShell.owner,
+        deliveryUnit: configShell.deliveryUnit,
+        moduleFederation: configShell.moduleFederation,
+      },
+      {
+        id: shell.id,
+        name: shell.id.replace(/^shell-/u, ''),
+        kind: 'shell',
+        package: shell.packageName,
+        path: shell.path,
+        port: shell.port,
+        portEnv: shell.portEnv,
+        mfName: shell.mfName,
+        verticalRefs: shell.verticalRefs,
+        owner: shell.owner,
+        deliveryUnit: shell.deliveryUnit,
+        moduleFederation: shell.moduleFederation,
+      },
+      `${compactConfigPath} shells.${shell.id}`,
+      'restore the complete additional-shell config record',
+    );
+    assert(
+      !Object.hasOwn(overlay.ports ?? {}, shell.id),
+      `${shell.id} port must stay in config.shells, not the development overlay`,
+    );
+    const owner = configShell.owner;
+    assertObject(
+      owner,
+      `${compactConfigPath} shells.${shell.id}.owner`,
+      'record exactly one owner for every configured Delivery Unit',
+    );
+    assert(
+      ['team', 'agent', 'agent-team'].includes(owner.kind) &&
+        typeof owner.id === 'string' &&
+        owner.id.length > 0,
+      `${compactConfigPath} shells.${shell.id}.owner must identify one accountable owner`,
+    );
+    assertSameJson(
+      owner,
+      shell.owner,
+      `${compactConfigPath} shells.${shell.id}.owner`,
+      'restore the generated additional-shell owner attribution',
+    );
+    assertObject(
+      configShell.deliveryUnit,
+      `${compactConfigPath} shells.${shell.id}.deliveryUnit`,
+      'restore the generated additional-shell Delivery Unit identity',
+    );
+    assert(
+      typeof configShell.deliveryUnit.unitId === 'string' &&
+        configShell.deliveryUnit.unitId.length > 0 &&
+        typeof configShell.deliveryUnit.buildMarker === 'string' &&
+        configShell.deliveryUnit.buildMarker.length > 0,
+      `${compactConfigPath} shells.${shell.id}.deliveryUnit must carry unitId and buildMarker`,
+    );
+
+    const packagePath = `${shell.path}/package.json`;
+    const packageJson = readJson(packagePath);
+    assert(packageJson.name === shell.packageName, `${shell.id} package name is incorrect`);
+    assert(packageJson.modernjs?.appId === shell.id, `${shell.id} package modernjs.appId is incorrect`);
+    assert(packageJson.modernjs?.role === 'shell', `${shell.id} package modernjs.role must be shell`);
+    assert(packageJson.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', `${shell.id} must expose cloudflare:deploy`);
+    assert(packageJson.scripts?.['cloudflare:proof']?.includes(`--app ${shell.id}`), `${shell.id} must expose cloudflare:proof`);
+
+    const buildArtifact = readJson(`${shell.path}/shared/ultramodern-build.json`);
+    const buildSource = readText(`${shell.path}/shared/ultramodern-build.ts`);
+    assert(buildArtifact.deliveryUnit?.appId === shell.id, `${shell.id} build artifact appId is incorrect`);
+    assert(buildArtifact.deliveryUnit?.buildMarker === shell.deliveryUnit?.buildMarker, `${shell.id} build marker is not participating in the build artifact`);
+    assertSameJson(
+      deliveryUnitBlock(configShell.deliveryUnit),
+      deliveryUnitBlock(shell.deliveryUnit),
+      `${compactConfigPath} shells.${shell.id}.deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSameJson(
+      deliveryUnitBlock(buildArtifact.deliveryUnit),
+      deliveryUnitBlock(shell.deliveryUnit),
+      `${shell.path}/shared/ultramodern-build.json deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+    assert(
+      buildSource.includes('export const ultramodernDeliveryUnit = ultramodernBuildArtifact.deliveryUnit;'),
+      `${shell.path}/shared/ultramodern-build.ts must expose the shell delivery-unit identity`,
+    );
+    assertBuildFacadeExport(
+      buildSource,
+      'ultramodernUiMarker',
+      'ultramodernBuildArtifact.surfaces.ui',
+      `${shell.path}/shared/ultramodern-build.ts ultramodernUiMarker`,
+    );
+    assert(
+      shell.degradedState?.appId === shell.id &&
+        shell.degradedState?.status === 'degraded',
+      `${shell.id} degraded-state contract must identify its own shell`,
+    );
+
+    const modernConfig = readText(`${shell.path}/modern.config.ts`);
+    const moduleFederationConfig = readText(
+      `${shell.path}/module-federation.config.ts`,
+    );
+    const runtimeConfig = readText(`${shell.path}/src/modern.runtime.ts`);
+    const styles = readText(`${shell.path}/src/routes/index.css`);
+    const shellFrame = readText(`${shell.path}/src/routes/shell-frame.tsx`);
+    const routePage = readText(`${shell.path}/src/routes/[lang]/page.tsx`);
+    const remoteComponents = readText(
+      `${shell.path}/src/routes/vertical-components.tsx`,
+    );
+    const workerRemoteComponents = readText(
+      requiredShellWorkerCompositionPath(shell.path),
+    );
+    assert(modernConfig.includes(`const appId = '${shell.id}';`), `${shell.id} modern.config.ts appId is incorrect`);
+    assert(modernConfig.includes(`const port = Number(getBuildConfigEnvironment('${shell.portEnv}') ?? ${shell.port});`), `${shell.id} modern.config.ts port is incorrect`);
+    assert(modernConfig.includes(`uniqueName('${shell.mfName}')`), `${shell.id} modern.config.ts Rspack identity is incorrect`);
+    assert(moduleFederationConfig.includes(`name: '${shell.mfName}'`), `${shell.id} Module Federation container name is incorrect`);
+    assert(new RegExp(`appId:\\s*['"]${shell.id}['"]`, 'u').test(runtimeConfig), `${shell.id} runtime boundary metadata must identify its own shell`);
+    assert(routePage.includes('ShellFrame') && routePage.includes('VerticalShowcase'), `${shell.id} route page must use its own shell composition host`);
+    assert(remoteComponents.includes(`data-modern-boundary-id="${shell.mfName}"`), `${shell.id} remote composition boundary must use its own MF identity`);
+    assert(workerRemoteComponents.includes('DistributedSsrBoundary'), `${shell.id} Worker SSR must use distributed fragment boundaries`);
+    assert(!workerRemoteComponents.includes('@module-federation') && !workerRemoteComponents.includes('import('), `${shell.id} Worker SSR must not include native Module Federation runtime or remote imports`);
+    if (tailwindEnabled) {
+      assert(styles.includes(`prefix(${shell.tailwindPrefix})`), `${shell.id} styles must use its shell-specific Tailwind prefix`);
+    }
+    assert(shellFrame.includes(`${shell.tailwindPrefix}:`), `${shell.id} shell-frame must use its shell-specific Tailwind prefix`);
+    if ((shell.verticalRefs ?? []).length > 0) {
+      assert(
+        shell.degradedState.required === true,
+        `${shell.id} degraded-state contract must be required for remote consumption`,
+      );
+      assert(remoteComponents.includes(`${shell.tailwindPrefix}:text-red-900`), `${shell.id} degraded fallback must report its own shell identity`);
+      assert(remoteComponents.includes('fallback: <RemoteUnavailable />'), `${shell.id} consumption points must have a degraded fallback`);
+      assert(!remoteComponents.includes('data-modern-boundary-id="shellSuperApp"'), `${shell.id} degraded fallback must not report the primary shell`);
+    }
+  }
+
+  for (const appPath of [
+    'apps/shell-super-app',
+    ...expectedAdditionalShells.map(shell => shell.path),
+    ...fullStackVerticals.map(vertical => vertical.path),
+  ]) {
+    const modernConfig = readText(`${appPath}/modern.config.ts`);
+    for (const origin of configuredOrigins) {
+      assert(
+        modernConfig.includes(`'${origin}'`),
+        `${appPath} MF dev CORS must allow configured origin ${origin}`,
+      );
+    }
+    assert(modernConfig.includes('credentials: false'), `${appPath} MF asset CORS must disable credentials`);
+    assert(!modernConfig.includes('credentials: true'), `${appPath} MF asset CORS must not enable credentials`);
+    assert(!/origin:\s*(?:true|\*|['"]\*['"])/u.test(modernConfig), `${appPath} MF dev CORS must not reflect arbitrary origins`);
+  }
+
+  // Zerops artifacts exist whenever the workspace has delivery units at all
+  // (ui-only and horizontal-remote units deploy too); a shell-only workspace
+  // must not carry one.
+  if (!hasDeliveryUnits) {
+    assertNotExists('zerops.yaml');
+  } else {
+  assertExists('zerops.yaml');
+  const zeropsYaml = readText('zerops.yaml');
+  assert(
+    zeropsYaml.includes(`setup: ${quoteYamlString('shell-super-app')}`),
+    'shell-super-app must have a Zerops service',
+  );
+  for (const shell of expectedAdditionalShells) {
+    assert(zeropsYaml.includes(`setup: ${quoteYamlString(shell.id)}`), `${shell.id} must have a Zerops service`);
+    assert(zeropsYaml.includes(`start: cd ${quoteShellValue(`.zerops/runtime/${shell.id}`)} && npm run serve`), `${shell.id} Zerops service start command is missing`);
+    assert(zeropsYaml.includes(`        ${shell.portEnv}: ${quoteYamlString(String(shell.port))}`), `${shell.id} Zerops service port environment is missing`);
+  }
+  }
+};
+assertAdditionalShellCohort();
 assert(
   rootPackage.devDependencies?.['@modern-js/create'] ===
     expectedModernPackageSpecifier('@modern-js/create'),
@@ -1621,6 +3466,11 @@ assert(
     expectedModernPackageSpecifier('@modern-js/code-tools'),
   'Root must depend on @modern-js/code-tools through package source metadata',
 );
+assert(
+  rootPackage.devDependencies?.['@modern-js/plugin-bff'] ===
+    expectedModernPackageSpecifier('@modern-js/plugin-bff'),
+  'Root must depend on @modern-js/plugin-bff for Node backend federation proof',
+);
 if (packageSource.strategy === 'install') {
   const installSpecifier = packageSource.modernPackages?.specifier;
   assert(
@@ -1680,20 +3530,90 @@ if (bridgeConfig) {
   }
   assert(rootPackage.scripts?.['bridge:check'], 'Bridge workspaces must expose bridge:check');
 } else {
-  assert(rootPackage.scripts?.typecheck === 'node ./scripts/ultramodern-typecheck.mts --build tsconfig.json', 'Root typecheck must run TS-Go build mode across project references');
+  assert(rootPackage.scripts?.typecheck === 'node ./scripts/ultramodern-typecheck.mts --project tsconfig.json', 'Root typecheck must run TS-Go across the root project reference graph');
 }
 assert(rootPackage.scripts?.['contract:check'] === 'node ./scripts/validate-ultramodern-workspace.mts', 'Root must expose contract:check');
 assert(rootPackage.scripts?.['api:check'] === 'node ./scripts/check-ultramodern-api-boundaries.mts', 'Root must expose api:check');
 assert(rootPackage.scripts?.['i18n:boundaries'] === 'node ./scripts/check-ultramodern-i18n-boundaries.mts', 'Root must expose i18n:boundaries');
 assert(rootPackage.scripts?.['performance:readiness'] === 'node ./scripts/ultramodern-performance-readiness.mts', 'Root must expose default-on performance readiness diagnostics');
+if (hasBackendSurfaces) {
+  assert(rootPackage.scripts?.['node:backend-federation:generate'] === 'node ./scripts/generate-node-backend-federation.mts', 'Root must expose local Node backend federation artifact generation');
+  assert(
+    rootPackage.scripts?.['node:proof'] ===
+      'node ./scripts/proof-node-backend-federation.mts',
+    'Root must expose read-only node:proof for already-built backend federation Effect modules',
+  );
+} else {
+  assert(rootPackage.scripts?.['node:backend-federation:generate'] === undefined, 'Root must not expose backend federation generation without an API surface');
+  assert(rootPackage.scripts?.['node:proof'] === undefined, 'Root must not expose node:proof without an API surface');
+}
+if (hasDeliveryUnits) {
+  assert(rootPackage.scripts?.['zerops:materialize'] === 'node ./scripts/materialize-zerops-runtime.mjs', 'Root must expose Zerops runtime materialization script');
+  assert(rootPackage.scripts?.['cloudflare:ssr-proof'] === 'node ./scripts/proof-workerd-ssr.mts', 'Root must expose workerd distributed SSR composition proof');
+  assert(rootPackage.scripts?.['cloudflare:build']?.endsWith('&& pnpm cloudflare:ssr-proof'), 'Root Cloudflare build must finish with workerd distributed SSR composition proof');
+} else {
+  assert(rootPackage.scripts?.['zerops:materialize'] === undefined, 'Root must not expose Zerops materialization in a shell-only workspace');
+  assert(rootPackage.scripts?.['cloudflare:ssr-proof'] === undefined, 'Root must not expose workerd SSR proof in a shell-only workspace');
+}
+assertNotExists('scripts/generate-node-backend-federation.mjs');
+assertNotExists('scripts/proof-node-backend-federation.mjs');
+assertNotExists('scripts/verify-cloudflare-output.mjs');
+assertNotExists('scripts/generate-tanstack-routes.mjs');
 assert(
-  bridgeConfig
-    ? rootPackage.scripts?.check?.includes('pnpm api:check') &&
-        rootPackage.scripts.check.endsWith('&& pnpm performance:readiness && pnpm bridge:check')
-    : rootPackage.scripts?.check?.includes('pnpm api:check') &&
-        rootPackage.scripts.check.endsWith('&& pnpm performance:readiness'),
-  'Root check must run default-on performance readiness diagnostics and bridge gates when configured',
+  rootPackage.scripts?.check?.includes('pnpm api:check') &&
+    !rootPackage.scripts.check.includes('pnpm node:proof') &&
+    rootPackage.scripts.check.endsWith(
+      bridgeConfig
+        ? '&& pnpm performance:readiness && pnpm bridge:check'
+        : '&& pnpm performance:readiness',
+    ),
+  'Root check must remain static while running default-on performance readiness diagnostics and bridge gates when configured',
 );
+if (hasDeliveryUnits) {
+  const zeropsYaml = readText('zerops.yaml');
+  assert(zeropsYaml.includes('zerops:'), 'Zerops manifest must include zerops services');
+  assert(zeropsYaml.includes(`setup: ${quoteYamlString('shell-super-app')}`), 'Zerops manifest must include shell service');
+  assert(zeropsYaml.includes(`base: ${quoteYamlString('nodejs@26')}`), 'Zerops manifest must use generated Node runtime major');
+  assert(zeropsYaml.includes('deployFiles:'), 'Zerops manifest must deploy package-pruned runtime directories');
+  assert(
+    zeropsYaml.includes(`start: cd ${quoteShellValue('.zerops/runtime/shell-super-app')} && npm run serve`),
+    'Zerops shell service must start from materialized runtime package',
+  );
+  assert(
+    zeropsYaml.includes('SHELL_SUPER_APP_PORT:') &&
+      zeropsYaml.includes('ULTRAMODERN_ZEROPS_SERVICE:'),
+    'Zerops manifest must expose service identity and ports',
+  );
+  for (const vertical of fullStackVerticals) {
+    assert(zeropsYaml.includes(`setup: ${quoteYamlString(vertical.id)}`), `${vertical.id} must have a Zerops service`);
+    assert(
+      zeropsYaml.includes(`~/.local/bin/mise exec -- pnpm run zerops:materialize -- --app ${quoteShellValue(vertical.id)} --package ${quoteShellValue(vertical.packageName)} --package-dir ${quoteShellValue(vertical.path)}`),
+      `${vertical.id} Zerops service must materialize its runtime package`,
+    );
+    // Only REST-backed (or headless-less UI) units expose an HTTP readiness
+    // probe; the RPC surface has no REST readiness endpoint (G7a).
+    if (!vertical.emitsApi || vertical.apiProtocol === 'rest') {
+      const zeropsReadinessPath = vertical.emitsApi
+        ? `${vertical.apiPrefix}/${vertical.stem}/readiness`
+        : '/';
+      assert(
+        zeropsYaml.includes(`path: ${quoteYamlString(zeropsReadinessPath)}`),
+        `${vertical.id} BFF readiness path must use generated API prefix`,
+      );
+    }
+  }
+  const zeropsMaterializer = readText('scripts/materialize-zerops-runtime.mjs');
+  assert(zeropsMaterializer.includes("MODERNJS_DEPLOY: 'node'"), 'Zerops materializer must use Modern.js Node deploy target');
+  assert(/'deploy',\s*'--skip-build'/.test(zeropsMaterializer), 'Zerops materializer must pass --skip-build directly to Modern deploy');
+  assert(zeropsMaterializer.includes('normalizeRuntimePackageDependencies'), 'Zerops materializer must normalize generated Modern package aliases before installing dependencies');
+  assert(zeropsMaterializer.includes('officialPackageName'), 'Zerops materializer must add official Modern.js npm aliases for generated runtime imports');
+  assert(zeropsMaterializer.includes('installRuntimeDependencies'), 'Zerops materializer must install dependencies outside the workspace copy runtime node_modules');
+  assert(zeropsMaterializer.includes('copyWorkspacePackage'), 'Zerops materializer must preserve generated local workspace package dependencies');
+  assert(zeropsMaterializer.includes('makeWorkspacePackageRuntimeSafe'), 'Zerops materializer must rewrite copied workspace packages to runtime-safe JavaScript exports');
+  assert(zeropsMaterializer.includes("serve: runtimePackage.scripts?.serve ?? 'node index.js'"), 'Zerops materializer must preserve runtime serve script fallback');
+  assert(/'install',\s*'--omit=dev'/.test(zeropsMaterializer), 'Zerops materializer must omit dev dependencies from runtime installs');
+  assert(zeropsMaterializer.includes("'--legacy-peer-deps'"), 'Zerops materializer must tolerate generated-workspace peer dependency ranges in npm runtime install');
+}
 const performanceReadinessConfig = readText('scripts/ultramodern-performance-readiness.config.mjs');
 const assertToolWrapper = (scriptPath, command) => {
   const source = readText(scriptPath);
@@ -1705,7 +3625,6 @@ const assertToolWrapper = (scriptPath, command) => {
 assert(performanceReadinessConfig.includes('UltramodernPerformanceReadinessDiagnosticsConfig'), 'Performance readiness config must carry the typed opt-out surface');
 assert(performanceReadinessConfig.includes('enabled: true'), 'Performance readiness diagnostics must be default-on');
 assert(performanceReadinessConfig.includes("failOn: 'framework-invariant'"), 'Performance readiness diagnostics must only fail framework invariants by default');
-assertToolWrapper('scripts/validate-ultramodern-workspace.mts', 'validate');
 assertToolWrapper('scripts/ultramodern-performance-readiness.mts', 'performance-readiness');
 const i18nBoundaryScript = readText('scripts/check-ultramodern-i18n-boundaries.mts');
 assertToolWrapper('scripts/ultramodern-typecheck.mts', 'typecheck');
@@ -1720,12 +3639,18 @@ assert(rootPackage.scripts?.['cloudflare:proof'] === 'node ./scripts/proof-cloud
 assert(rootPackage.scripts?.['migrate:strict-effect'] === 'node ./scripts/migrate-strict-effect.mts', 'Root must expose migrate:strict-effect');
 assert(rootPackage.scripts?.['skills:install'] === 'node ./scripts/bootstrap-agent-skills.mts', 'Root must expose skills:install');
 assert(rootPackage.scripts?.['skills:check'] === 'node ./scripts/bootstrap-agent-skills.mts --check', 'Root must expose skills:check');
-assert(rootPackage.scripts?.postinstall === "oxfmt . '!repos/**' && node ./scripts/bootstrap-agent-skills.mts --postinstall", 'Root postinstall must format, run the default-on Codex skills bootstrap, and leave reference repository installs explicit');
+assert(rootPackage.scripts?.postinstall === "node ./scripts/bootstrap-agent-skills.mts --postinstall && oxfmt . '!repos/**'", 'Root postinstall must run the default-on Codex skills bootstrap, format installed skills, and leave reference repository installs explicit');
 assert(rootPackage.scripts?.['agents:refs:install'] === 'node ./scripts/setup-agent-reference-repos.mts', 'Root must expose agents:refs:install as the explicit reference repo installer');
 const agentSkillsBootstrap = readText('scripts/bootstrap-agent-skills.mts');
 assertToolWrapper('scripts/assert-mf-types.mts', 'mf-types');
+if (hasBackendSurfaces) {
+  assertToolWrapper('scripts/generate-node-backend-federation.mts', 'backend-federation-generate');
+  assertToolWrapper('scripts/proof-node-backend-federation.mts', 'backend-federation-proof');
+}
 assertToolWrapper('scripts/generate-public-surface-assets.mts', 'public-surface');
+assertToolWrapper('scripts/generate-tanstack-routes.mts', 'routes-generate');
 assertToolWrapper('scripts/proof-cloudflare-version.mts', 'cloudflare-proof');
+assertToolWrapper('scripts/verify-cloudflare-output.mts', 'cloudflare-output-verify');
 assertToolWrapper('scripts/migrate-strict-effect.mts', 'migrate-strict-effect');
 assertToolWrapper('scripts/bootstrap-agent-skills.mts', 'skills');
 assert(!agentSkillsBootstrap.includes("run('brew'") && !agentSkillsBootstrap.includes('runShell('), 'Agent skills bootstrap must never invoke system package managers');
@@ -1735,10 +3660,9 @@ assert(agentReferenceRepoSetup.includes("commitInstallerChanges('Initialize Ultr
 assert(agentReferenceRepoSetup.includes("commitInstallerChanges('Record agent reference repo manifest')"), 'Agent reference repo manifest commit must use the installer commit helper');
 
 const expectedAppIds = ['shell-super-app', ...fullStackVerticals.map(vertical => vertical.id)];
-const expectedCloudflareCompatibilityDate = '{{cloudflareCompatibilityDate}}';
 const expectedCloudflareCompatibilityFlags = ['nodejs_compat', 'global_fetch_strictly_public'];
 assert(
-  JSON.stringify(generatedContract.apps?.map(app => app.id)) === JSON.stringify(expectedAppIds),
+  sameJson(generatedContract.apps?.map(app => app.id), expectedAppIds),
   'Generated contract must contain shell plus the full-stack verticals',
 );
 assert(generatedContract.cssFederation?.sharedDesignTokens?.owner?.id === 'shared-design-tokens', 'CSS federation must declare shared design token ownership');
@@ -1763,38 +3687,57 @@ assert(generatedContract.performanceReadiness?.mode === 'diagnostic', 'Performan
 assert(generatedContract.performanceReadiness?.report?.script === 'scripts/ultramodern-performance-readiness.mts', 'Performance readiness contract must point at the generated script');
 assert(generatedContract.performanceReadiness?.report?.deterministic === true, 'Performance readiness reports must be deterministic');
 assert(generatedContract.performanceReadiness?.optOut?.env === 'ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS=false', 'Performance readiness env opt-out is incorrect');
-assert(JSON.stringify(generatedContract.performanceReadiness?.signals?.map(signal => signal.id)) === JSON.stringify(expectedPerformanceReadinessSignals), 'Performance readiness signal ids are incorrect');
+assert(sameJson(generatedContract.performanceReadiness?.signals?.map(signal => signal.id), expectedPerformanceReadinessSignals), 'Performance readiness signal ids are incorrect');
 
 const shellModernConfig = readText('apps/shell-super-app/modern.config.ts');
 const shellModuleFederationConfig = readText('apps/shell-super-app/module-federation.config.ts');
+const shellModernAppEnv = readText('apps/shell-super-app/src/modern-app-env.d.ts');
+const gitignore = readText('.gitignore');
 const shellRouteHead = readText('apps/shell-super-app/src/routes/ultramodern-route-head.tsx');
 const shellRouteMetadata = readText('apps/shell-super-app/src/routes/ultramodern-route-metadata.ts');
+assert(/^\.mf\/$/mu.test(gitignore), 'Generated .gitignore must ignore root Module Federation diagnostics');
+assert(/^\*\*\/\.mf\/$/mu.test(gitignore), 'Generated .gitignore must ignore per-app Module Federation diagnostics');
+assert(/^dist-cloudflare\/$/mu.test(gitignore), 'Generated .gitignore must ignore Cloudflare build output');
+assert(/^\.output\/$/mu.test(gitignore), 'Generated .gitignore must ignore root final deployment output');
+assert(/^\*\*\/\.output\/$/mu.test(gitignore), 'Generated .gitignore must ignore per-app final deployment output');
+assert(/^\*\*\/src\/modern-tanstack\/$/mu.test(gitignore), 'Generated .gitignore must ignore framework-owned TanStack router output');
+assert(/^\*\*\/\.tsgo\.\*\.resolved\.json$/mu.test(gitignore), 'Generated .gitignore must ignore transient TS-Go resolution output');
+assert(shellModernAppEnv.includes('/// <reference types="@modern-js/app-tools/types" />'), 'Shell app env must reference the framework-owned app ambient type bundle while remaining an ambient declaration file');
+assert(/declare const ULTRAMODERN_SITE_URL: string;/u.test(shellModernAppEnv), 'Shell app env must keep generated globals explicit in ambient scope');
+assert(!shellModernAppEnv.includes("declare module '*.svg'"), 'Shell app env must not redeclare framework-owned svg asset modules');
+assert(!shellModernAppEnv.includes("declare module '*.css'"), 'Shell app env must not redeclare framework-owned css asset modules');
 assert(shellRouteMetadata.includes('@generated by @modern-js/create'), 'Shell route metadata compatibility manifest must be marked generated');
 assert(shellRouteMetadata.includes("authoring: 'colocated-route-meta'"), 'Shell route metadata manifest must advertise colocated authoring');
 const expectedZephyrDependencies = Object.fromEntries(
-  fullStackVerticals.map(vertical => [
-    vertical.zephyrAlias,
-    `${vertical.packageName}@workspace:*`,
-  ]),
+  expectedPrimaryShellVerticalIds.map(verticalId => {
+    const vertical = fullStackVerticals.find(
+      candidate => candidate.id === verticalId,
+    );
+    assert(vertical, `Missing primary-shell vertical ${verticalId}`);
+    return [
+      vertical.zephyrAlias,
+      `${vertical.packageName}@workspace:*`,
+    ];
+  }),
 );
 assert(
-  JSON.stringify(shellPackage['zephyr:dependencies']) ===
-    JSON.stringify(expectedZephyrDependencies),
-  'Shell Zephyr dependencies must reference every vertical package',
+  sameJson(shellPackage['zephyr:dependencies'], expectedZephyrDependencies),
+  'Shell Zephyr dependencies must reference every primary-shell vertical package',
 );
 assert(shellPackage.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), 'Shell app-tools dependency must match package source metadata');
 assert(shellPackage.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), 'Shell plugin-bff dependency must match package source metadata');
 assert(shellPackage.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), 'Shell plugin-i18n dependency must match package source metadata');
 assert(shellPackage.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), 'Shell plugin-tanstack dependency must match package source metadata');
 assert(shellPackage.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), 'Shell runtime dependency must match package source metadata');
-assertBuildCacheBase('shell-super-app', shellModernConfig);
+assert(shellPackage.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', 'Shell must expose cloudflare:deploy');
+assertTargetIsolatedBuildArtifacts('shell-super-app', shellModernConfig);
 assertCloudflareBuildSkipsDeployRebuild('shell-super-app', shellPackage);
 const shellContract = generatedContract.apps?.find(app => app.id === 'shell-super-app');
 assert(shellContract?.deploy?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell Cloudflare workerName is incorrect');
 assert(shellContract?.deploy?.cloudflare?.publicUrlEnv === 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'Shell Cloudflare public URL env is incorrect');
 assert(shellContract?.deploy?.cloudflare?.compatibilityDate === expectedCloudflareCompatibilityDate, 'Shell Cloudflare compatibilityDate is incorrect');
-assert(JSON.stringify(shellContract?.deploy?.cloudflare?.compatibilityFlags) === JSON.stringify(expectedCloudflareCompatibilityFlags), 'Shell Cloudflare compatibility flags are incorrect');
-assert(JSON.stringify(shellContract?.deploy?.cloudflare?.security) === JSON.stringify(expectedCloudflareSecurity), 'Shell Cloudflare security contract is incorrect');
+assert(sameJson(shellContract?.deploy?.cloudflare?.compatibilityFlags, expectedCloudflareCompatibilityFlags), 'Shell Cloudflare compatibility flags are incorrect');
+assert(sameJson(shellContract?.deploy?.cloudflare?.security, expectedCloudflareSecurity), 'Shell Cloudflare security contract is incorrect');
 assertCloudflareQualityGates('shell-super-app', shellContract?.deploy?.cloudflare?.qualityGates);
 assert(shellContract?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, 'Shell worker compatibilityDate is incorrect');
 assert(shellContract?.deploy?.worker?.name === expectedWorkerName('shell-super-app'), 'Shell worker name is incorrect');
@@ -1813,15 +3756,15 @@ assert(shellModernConfig.includes("assetPrefix: '/'"), 'Shell modern.config.ts m
 assert(shellModernConfig.includes('assetPrefix,'), 'Shell modern.config.ts must wire output.assetPrefix to the derived asset prefix');
 assert(shellContract?.config?.dev?.assetPrefix === '/', 'Shell dev asset prefix must stay origin-relative');
 assert(shellContract?.config?.output?.assetPrefix?.default === '/', 'Shell asset prefix must default to origin-relative paths');
-assert(JSON.stringify(shellContract?.config?.output?.assetPrefix?.envFallbackOrder) === JSON.stringify(['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), 'Shell asset prefix env fallback order is incorrect');
+assert(sameJson(shellContract?.config?.output?.assetPrefix?.envFallbackOrder, ['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), 'Shell asset prefix env fallback order is incorrect');
 assert(shellContract?.config?.output?.disableTsChecker === false, 'Shell must keep the framework TypeScript checker enabled');
 assert(shellContract?.config?.performance?.readinessDiagnostics?.default === 'enabled', 'Shell performance readiness diagnostics must be default-on');
 assert(shellContract?.config?.performance?.readinessDiagnostics?.failOn === 'framework-invariant', 'Shell performance readiness diagnostics must only fail framework invariants by default');
 assert(shellContract?.config?.performance?.readinessDiagnostics?.optOut?.env === 'ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS=false', 'Shell performance readiness env opt-out is incorrect');
-assert(JSON.stringify(shellContract?.config?.source?.siteUrl?.envFallbackOrder) === JSON.stringify(['MODERN_PUBLIC_SITE_URL', 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN', 'SHELL_SUPER_APP_PORT']), 'Shell site URL env fallback order is incorrect');
+assert(sameJson(shellContract?.config?.source?.siteUrl?.envFallbackOrder, ['MODERN_PUBLIC_SITE_URL', 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN', 'SHELL_SUPER_APP_PORT']), 'Shell site URL env fallback order is incorrect');
 assert(shellContract?.config?.rspack?.output?.uniqueName === 'shellSuperApp', 'Shell Rspack uniqueName is incorrect');
 assert(shellContract?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal('shellSuperApp'), 'Shell Rspack chunkLoadingGlobal is incorrect');
-assert(shellContract?.moduleFederation?.dts?.compilerInstance === 'tsgo', 'Shell must keep mandatory DTS compiler');
+assert(shellContract?.moduleFederation?.dts?.compilerInstance === 'effect-tsgo', 'Shell must keep mandatory DTS compiler');
 assert(shellContract?.moduleFederation?.dts?.tsConfigPath === './tsconfig.mf-types.json', 'Shell must keep dedicated Module Federation DTS tsconfig');
 assert(shellModuleFederationConfig.includes("tsConfigPath: './tsconfig.mf-types.json'"), 'Shell Module Federation config must use the dedicated DTS tsconfig');
 assert(topology.shell?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell topology Cloudflare workerName is incorrect');
@@ -1839,7 +3782,7 @@ assert(shellContract?.routes?.privateByDefault === true, 'Shell routes must be p
 assert(shellContract?.routes?.metadataAuthoring === 'colocated-route-meta', 'Shell route metadata authoring mode is incorrect');
 assert(shellContract?.routes?.generatedManifest === true, 'Shell route metadata manifest must be generated');
 assert(shellContract?.routes?.publicnessDefault === 'private-app-screen', 'Shell route publicness default is incorrect');
-assert(JSON.stringify(shellContract?.routes?.publicRoutes ?? []) === '[]', 'Shell must not expose generated public routes by default');
+assert(sameJson(shellContract?.routes?.publicRoutes ?? [], []), 'Shell must not expose generated public routes by default');
 assertPublicHeadContract('shell-super-app', shellContract?.routes?.publicHead, shellRouteHead);
 assertPublicSurfaceContract('shell-super-app', shellContract?.routes?.publicSurface);
 assert(
@@ -1848,7 +3791,7 @@ assert(
 );
 assertPublicSurfaceAssets('apps/shell-super-app', shellContract?.routes?.publicRoutes ?? []);
 assert(
-  topology.shell?.verticalRefs?.join(',') === fullStackVerticals.map(vertical => vertical.id).join(','),
+  topology.shell?.verticalRefs?.join(',') === expectedPrimaryShellVerticalIds.join(','),
   'Topology shell verticalRefs must match generated verticals',
 );
 assert(topology.verticals?.length === fullStackVerticals.length, 'Topology must contain only generated verticals');
@@ -1858,23 +3801,104 @@ assert(!('effectServices' in topology), 'Default APIs must be vertical-owned, no
 for (const vertical of fullStackVerticals) {
   const packageJson = readJson(`${vertical.path}/package.json`);
   const modernConfig = readText(`${vertical.path}/modern.config.ts`);
-  const moduleFederationConfig = readText(`${vertical.path}/module-federation.config.ts`);
-  const routeHead = readText(`${vertical.path}/src/routes/ultramodern-route-head.tsx`);
-  const routeMetadata = readText(`${vertical.path}/src/routes/ultramodern-route-metadata.ts`);
-  assert(routeMetadata.includes('@generated by @modern-js/create'), `${vertical.id} route metadata compatibility manifest must be marked generated`);
-  assert(routeMetadata.includes("authoring: 'colocated-route-meta'"), `${vertical.id} route metadata manifest must advertise colocated authoring`);
+  // The browser Module Federation config and colocated route surfaces only
+  // exist for UI-emitting units; a headless api-only unit emits none (G2a/P4).
+  const moduleFederationConfig = vertical.emitsUi
+    ? readText(`${vertical.path}/module-federation.config.ts`)
+    : '';
+  const modernAppEnv = readText(`${vertical.path}/src/modern-app-env.d.ts`);
+  const routeHead = vertical.emitsUi
+    ? readText(`${vertical.path}/src/routes/ultramodern-route-head.tsx`)
+    : '';
+  const routeMetadata = vertical.emitsUi
+    ? readText(`${vertical.path}/src/routes/ultramodern-route-metadata.ts`)
+    : '';
+  const ultramodernBuildSource = readText(`${vertical.path}/shared/ultramodern-build.ts`);
+  const ultramodernBuildArtifact = readJson(`${vertical.path}/shared/ultramodern-build.json`);
+  if (vertical.deliveryUnit) {
+    const topologyEntry = findById(topology.verticals, vertical.id);
+    const expectedDeliveryUnit = deliveryUnitBlock(
+      expectedDeliveryUnitFor(vertical, topologyEntry),
+    );
+    const buildLabel = `${vertical.path}/shared/ultramodern-build.json deliveryUnit`;
+    assertSelfCheck(
+      ultramodernBuildSource.includes('export const ultramodernDeliveryUnit'),
+      buildLabel,
+      'Missing ultramodernDeliveryUnit export',
+      deliveryUnitIdentityFixArea,
+    );
+    const buildIdentity = ultramodernBuildArtifact.deliveryUnit ?? {};
+    assertSelfCheck(
+      buildIdentity.buildMarker === expectedDeliveryUnit.buildMarker,
+      buildLabel,
+      `Expected build "${expectedDeliveryUnit.buildMarker}", found ${formatJson(buildIdentity.buildMarker)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      buildIdentity.unitId === expectedDeliveryUnit.unitId,
+      buildLabel,
+      `Expected unitId "${expectedDeliveryUnit.unitId}", found ${formatJson(buildIdentity.unitId)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      buildIdentity.packageName === expectedDeliveryUnit.packageName,
+      buildLabel,
+      `Expected packageName "${expectedDeliveryUnit.packageName}", found ${formatJson(buildIdentity.packageName)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      buildIdentity.version === expectedDeliveryUnit.version,
+      buildLabel,
+      `Expected version "${expectedDeliveryUnit.version}", found ${formatJson(buildIdentity.version)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertBuildFacadeExport(
+      ultramodernBuildSource,
+      'ultramodernUiMarker',
+      'ultramodernBuildArtifact.surfaces.ui',
+      `${vertical.path}/shared/ultramodern-build.ts ultramodernUiMarker`,
+    );
+    assertBuildFacadeExport(
+      ultramodernBuildSource,
+      'ultramodernApiMarker',
+      'ultramodernBuildArtifact.surfaces.api',
+      `${vertical.path}/shared/ultramodern-build.ts ultramodernApiMarker`,
+    );
+  }
+  assert(modernAppEnv.includes('/// <reference types="@modern-js/app-tools/types" />'), `${vertical.id} app env must reference the framework-owned app ambient type bundle while remaining an ambient declaration file`);
+  assert(/declare const ULTRAMODERN_SITE_URL: string;/u.test(modernAppEnv), `${vertical.id} app env must keep generated globals explicit in ambient scope`);
+  assert(!modernAppEnv.includes("declare module '*.svg'"), `${vertical.id} app env must not redeclare framework-owned svg asset modules`);
+  assert(!modernAppEnv.includes("declare module '*.css'"), `${vertical.id} app env must not redeclare framework-owned css asset modules`);
+  if (vertical.emitsUi) {
+    assert(routeMetadata.includes('@generated by @modern-js/create'), `${vertical.id} route metadata compatibility manifest must be marked generated`);
+    assert(routeMetadata.includes("authoring: 'colocated-route-meta'"), `${vertical.id} route metadata manifest must advertise colocated authoring`);
+  }
   assert(packageJson.name === vertical.packageName, `${vertical.id} package name is incorrect`);
   assert(packageJson.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', `${vertical.id} must expose cloudflare:deploy`);
-  assertBuildCacheBase(vertical.id, modernConfig);
+  assertTargetIsolatedBuildArtifacts(vertical.id, modernConfig);
   assertCloudflareBuildSkipsDeployRebuild(vertical.id, packageJson);
   assert(packageJson.scripts?.['cloudflare:proof']?.includes(`--app ${vertical.id}`), `${vertical.id} must expose cloudflare:proof`);
   assert(packageJson.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), `${vertical.id} app-tools dependency must match package source metadata`);
-  assert(packageJson.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), `${vertical.id} plugin-bff dependency must match package source metadata`);
+  if (vertical.emitsApi) {
+    assert(packageJson.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), `${vertical.id} plugin-bff dependency must match package source metadata`);
+  }
   assert(packageJson.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), `${vertical.id} plugin-i18n dependency must match package source metadata`);
   assert(packageJson.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), `${vertical.id} plugin-tanstack dependency must match package source metadata`);
   assert(packageJson.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), `${vertical.id} runtime dependency must match package source metadata`);
-  assert(packageJson.exports?.['./api/client'] === `./src/api/${vertical.stem}-client.ts`, `${vertical.id} must export its API client`);
-  assert(packageJson.exports?.['./api'] === './shared/api.ts', `${vertical.id} must export its API contract`);
+  if (vertical.emitsApi) {
+    assert(packageJson.exports?.[vertical.apiClientExport] === `./${vertical.apiClientPath}`, `${vertical.id} must export its API client`);
+    assert(packageJson.exports?.['./api'] === `./${vertical.apiContractPath}`, `${vertical.id} must export its API contract`);
+    // API protocol exclusivity (G7a): an RPC unit ships only the RPC contract
+    // and `${stem}-rpc-client`; a REST unit ships only the REST contract and
+    // `${stem}-client`. Neither may carry the other protocol's surface.
+    if (vertical.apiProtocol === 'rpc') {
+      assert(!fs.existsSync(path.join(root, `${vertical.path}/src/api/${vertical.stem}-client.ts`)), `${vertical.id} RPC unit must not emit the REST API client`);
+      assert(!fs.existsSync(path.join(root, `${vertical.path}/shared/api.ts`)), `${vertical.id} RPC unit must not emit the REST API contract`);
+    } else {
+      assert(!fs.existsSync(path.join(root, `${vertical.path}/src/api/${vertical.stem}-rpc-client.ts`)), `${vertical.id} REST unit must not emit the RPC API client`);
+      assert(!fs.existsSync(path.join(root, `${vertical.path}/shared/rpc.ts`)), `${vertical.id} REST unit must not emit the RPC API contract`);
+    }
+  }
   const expectedVerticalZephyrDependencies = Object.fromEntries(
     fullStackVerticals
       .filter(candidate => vertical.verticalRefs.includes(candidate.id))
@@ -1884,8 +3908,7 @@ for (const vertical of fullStackVerticals) {
       ]),
   );
   assert(
-    JSON.stringify(packageJson['zephyr:dependencies']) ===
-      JSON.stringify(expectedVerticalZephyrDependencies),
+    sameJson(packageJson['zephyr:dependencies'], expectedVerticalZephyrDependencies),
     `${vertical.id} Zephyr dependencies must match declared vertical refs`,
   );
 
@@ -1895,8 +3918,8 @@ for (const vertical of fullStackVerticals) {
   assert(contractEntry?.deploy?.cloudflare?.workerName === expectedWorkerName(vertical.id), `${vertical.id} Cloudflare workerName is incorrect`);
   assert(contractEntry?.deploy?.cloudflare?.publicUrlEnv === `ULTRAMODERN_PUBLIC_URL_${vertical.id.replace(/-/g, '_').toUpperCase()}`, `${vertical.id} Cloudflare public URL env is incorrect`);
   assert(contractEntry?.deploy?.cloudflare?.compatibilityDate === expectedCloudflareCompatibilityDate, `${vertical.id} Cloudflare compatibilityDate is incorrect`);
-  assert(JSON.stringify(contractEntry?.deploy?.cloudflare?.compatibilityFlags) === JSON.stringify(expectedCloudflareCompatibilityFlags), `${vertical.id} Cloudflare compatibility flags are incorrect`);
-  assert(JSON.stringify(contractEntry?.deploy?.cloudflare?.security) === JSON.stringify(expectedCloudflareSecurity), `${vertical.id} Cloudflare security contract is incorrect`);
+  assert(sameJson(contractEntry?.deploy?.cloudflare?.compatibilityFlags, expectedCloudflareCompatibilityFlags), `${vertical.id} Cloudflare compatibility flags are incorrect`);
+  assert(sameJson(contractEntry?.deploy?.cloudflare?.security, expectedCloudflareSecurity), `${vertical.id} Cloudflare security contract is incorrect`);
   assertCloudflareQualityGates(vertical.id, contractEntry?.deploy?.cloudflare?.qualityGates);
   assert(contractEntry?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, `${vertical.id} worker compatibilityDate is incorrect`);
   assert(contractEntry?.deploy?.worker?.name === expectedWorkerName(vertical.id), `${vertical.id} worker name is incorrect`);
@@ -1912,37 +3935,64 @@ for (const vertical of fullStackVerticals) {
   assert(!verticalAssetPrefixExpression.includes('configuredSiteUrl') && !verticalAssetPrefixExpression.includes('MODERN_PUBLIC_SITE_URL'), `${vertical.id} asset prefix must not fall back to MODERN_PUBLIC_SITE_URL`);
   assert(modernConfig.includes(`envValue('ULTRAMODERN_PUBLIC_URL_${vertical.id.replace(/-/g, '_').toUpperCase()}')`), `${vertical.id} asset prefix must read its per-app public URL`);
   assert(modernConfig.includes('inferredCloudflareUrl'), `${vertical.id} asset prefix must support workers.dev origin inference`);
-  assert(modernConfig.includes("assetPrefix: '/'"), `${vertical.id} modern.config.ts must keep dev assets origin-relative`);
+  assert(/dev:\s*\{[\s\S]*?\/\/ Remote dev manifests must publish an absolute publicPath[\s\S]*?assetPrefix,/u.test(modernConfig), `${vertical.id} modern.config.ts must publish dev assets from its own remote origin`);
   assert(modernConfig.includes('assetPrefix,'), `${vertical.id} modern.config.ts must wire output.assetPrefix to the derived asset prefix`);
-  assert(contractEntry?.config?.dev?.assetPrefix === '/', `${vertical.id} dev asset prefix must stay origin-relative`);
+  assert(contractEntry?.config?.dev?.assetPrefix === 'app-public-origin', `${vertical.id} dev asset prefix must default to its app public origin`);
   assert(contractEntry?.config?.output?.assetPrefix?.default === 'app-public-origin', `${vertical.id} asset prefix must default to its app public origin`);
-  assert(JSON.stringify(contractEntry?.config?.output?.assetPrefix?.envFallbackOrder) === JSON.stringify(['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), `${vertical.id} asset prefix env fallback order is incorrect`);
+  assert(sameJson(contractEntry?.config?.output?.assetPrefix?.envFallbackOrder, ['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), `${vertical.id} asset prefix env fallback order is incorrect`);
   assert(contractEntry?.config?.output?.disableTsChecker === false, `${vertical.id} must keep the framework TypeScript checker enabled`);
   assert(contractEntry?.config?.performance?.readinessDiagnostics?.default === 'enabled', `${vertical.id} performance readiness diagnostics must be default-on`);
   assert(contractEntry?.config?.performance?.readinessDiagnostics?.failOn === 'framework-invariant', `${vertical.id} performance readiness diagnostics must only fail framework invariants by default`);
   assert(contractEntry?.config?.performance?.readinessDiagnostics?.optOut?.config === 'scripts/ultramodern-performance-readiness.config.mjs', `${vertical.id} performance readiness opt-out config is incorrect`);
-  assert(contractEntry?.deploy?.cloudflare?.routes?.apiReadiness === `${vertical.apiPrefix}/${vertical.stem}/readiness`, `${vertical.id} Cloudflare proof readiness route is incorrect`);
+  if (vertical.emitsApi) {
+    // Per policy.ts:76 the Cloudflare proof advertises a REST readiness route
+    // only for `rest` units; an `rpc` unit must not carry one.
+    if (vertical.apiProtocol === 'rpc') {
+      assert(contractEntry?.deploy?.cloudflare?.routes?.apiReadiness === undefined, `${vertical.id} rpc unit must not carry a REST Cloudflare readiness route`);
+    } else {
+      assert(contractEntry?.deploy?.cloudflare?.routes?.apiReadiness === `${vertical.apiPrefix}/${vertical.stem}/readiness`, `${vertical.id} Cloudflare proof readiness route is incorrect`);
+    }
+  }
   assert(contractEntry?.config?.rspack?.output?.uniqueName === vertical.mfName, `${vertical.id} Rspack uniqueName is incorrect`);
   assert(contractEntry?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal(vertical.mfName), `${vertical.id} Rspack chunkLoadingGlobal is incorrect`);
   assert(contractEntry?.moduleFederation?.name === vertical.mfName, `${vertical.id} MF name is incorrect`);
-  assert(JSON.stringify(contractEntry?.moduleFederation?.exposes) === JSON.stringify(vertical.exposes), `${vertical.id} MF exposes are incorrect`);
-  assert(contractEntry?.moduleFederation?.dts?.compilerInstance === 'tsgo', `${vertical.id} must keep mandatory DTS compiler`);
-  assert(contractEntry?.moduleFederation?.dts?.tsConfigPath === './tsconfig.mf-types.json', `${vertical.id} must keep dedicated Module Federation DTS tsconfig`);
-  assert(moduleFederationConfig.includes("tsConfigPath: './tsconfig.mf-types.json'"), `${vertical.id} Module Federation config must use the dedicated DTS tsconfig`);
-  assert(JSON.stringify(contractEntry?.moduleFederation?.verticalRefs ?? []) === JSON.stringify(vertical.verticalRefs), `${vertical.id} MF verticalRefs are incorrect`);
+  assert(sameJson(contractEntry?.moduleFederation?.exposes, vertical.exposes), `${vertical.id} MF exposes are incorrect`);
+  // The browser Module Federation DTS surface and its config file only exist
+  // for UI-emitting units; a headless api-only unit federates no browser types.
+  if (vertical.emitsUi) {
+    assert(contractEntry?.moduleFederation?.dts?.compilerInstance === 'effect-tsgo', `${vertical.id} must keep mandatory DTS compiler`);
+    assert(contractEntry?.moduleFederation?.dts?.tsConfigPath === './tsconfig.mf-types.json', `${vertical.id} must keep dedicated Module Federation DTS tsconfig`);
+    assert(moduleFederationConfig.includes("tsConfigPath: './tsconfig.mf-types.json'"), `${vertical.id} Module Federation config must use the dedicated DTS tsconfig`);
+  }
+  assert(sameJson(contractEntry?.moduleFederation?.verticalRefs ?? [], vertical.verticalRefs), `${vertical.id} MF verticalRefs are incorrect`);
   assert(
-    JSON.stringify((contractEntry?.moduleFederation?.remotes ?? []).map(remote => remote.id)) ===
-      JSON.stringify(vertical.verticalRefs),
+    sameJson(
+      (contractEntry?.moduleFederation?.remotes ?? []).map(remote => remote.id),
+      vertical.verticalRefs,
+    ),
     `${vertical.id} MF consumed verticals are incorrect`,
   );
-  assert(contractEntry?.api?.prefix === vertical.apiPrefix, `${vertical.id} API prefix is incorrect`);
-  assert(contractEntry?.api?.group === vertical.group, `${vertical.id} API group is incorrect`);
-  assert(contractEntry?.api?.runtime === 'effect', `${vertical.id} API runtime must be Effect`);
-  assert(contractEntry?.api?.strictEffectApproach === true, `${vertical.id} strictEffectApproach must be enabled`);
-  assert(contractEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} readiness endpoint is incorrect`);
-  assert(contractEntry?.api?.operations?.readiness?.path === `/${vertical.stem}/readiness`, `${vertical.id} readiness operation is missing`);
-  assert(contractEntry?.api?.requestContext?.propagatedHeaders?.includes('traceparent'), `${vertical.id} trace context propagation is missing`);
-  assert(Object.keys(contractEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} domain operations are missing`);
+  // API contract surface is only present for API-bearing units.
+  if (vertical.emitsApi) {
+    assert(contractEntry?.api?.prefix === vertical.apiPrefix, `${vertical.id} API prefix is incorrect`);
+    assert(contractEntry?.api?.group === vertical.group, `${vertical.id} API group is incorrect`);
+    assert(contractEntry?.api?.runtime === 'effect', `${vertical.id} API runtime must be Effect`);
+    assert(contractEntry?.api?.strictEffectApproach === true, `${vertical.id} strictEffectApproach must be enabled`);
+    assert(contractEntry?.api?.contract === vertical.apiContractExport, `${vertical.id} API contract export is incorrect`);
+    assert(contractEntry?.api?.client === vertical.apiClientExport, `${vertical.id} API client export is incorrect`);
+    if (vertical.apiProtocol === 'rpc') {
+      // An `rpc` unit records the `/rpc` route/serialization; it must not carry
+      // REST readiness or domain-operation semantics.
+      assert(contractEntry?.api?.protocol === 'rpc', `${vertical.id} generated contract API protocol must be rpc`);
+      assert(contractEntry?.api?.rpc?.path === '/rpc', `${vertical.id} generated contract RPC route path is incorrect`);
+      assert(contractEntry?.api?.rpcPath === `${vertical.apiPrefix}/rpc`, `${vertical.id} generated contract RPC path is incorrect`);
+    } else {
+      assert(contractEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} readiness endpoint is incorrect`);
+      assert(contractEntry?.api?.operations?.readiness?.path === `/${vertical.stem}/readiness`, `${vertical.id} readiness operation is missing`);
+      assert(contractEntry?.api?.requestContext?.propagatedHeaders?.includes('traceparent'), `${vertical.id} trace context propagation is missing`);
+      assert(Object.keys(contractEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} domain operations are missing`);
+    }
+  }
   assert(contractEntry?.i18n?.languages?.includes('en') && contractEntry?.i18n?.languages?.includes('cs'), `${vertical.id} must declare i18n languages`);
   assert(contractEntry?.i18n?.namespace === vertical.namespace, `${vertical.id} i18n namespace is incorrect`);
   assert(
@@ -1956,23 +4006,32 @@ for (const vertical of fullStackVerticals) {
   assert(contractEntry?.routes?.privateByDefault === true, `${vertical.id} routes must be private by default`);
   assert(contractEntry?.routes?.publicnessDefault === 'private-app-screen', `${vertical.id} route publicness default is incorrect`);
   assert(JSON.stringify(contractEntry?.routes?.publicRoutes ?? []) === '[]', `${vertical.id} must not expose generated public routes by default`);
-  assertPublicHeadContract(vertical.id, contractEntry?.routes?.publicHead, routeHead);
-  assertPublicSurfaceContract(vertical.id, contractEntry?.routes?.publicSurface);
-  assert(
-    (contractEntry?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen' && typeof route.descriptionKey === 'string'),
-    `${vertical.id} owned routes must be non-indexable private app screens by default and include description keys`,
-  );
-  assertPublicSurfaceAssets(vertical.path, contractEntry?.routes?.publicRoutes ?? []);
-  assert(contractEntry?.styling?.federation?.owner?.id === vertical.id, `${vertical.id} CSS federation owner is missing`);
-  assert(contractEntry?.styling?.federation?.role === 'vertical-css', `${vertical.id} must own only vertical CSS`);
-  assert(contractEntry?.styling?.federation?.rootSelector === `[data-app-id="${vertical.id}"]`, `${vertical.id} CSS root selector is incorrect`);
-  assert(contractEntry?.styling?.federation?.classPrefix === `${vertical.tailwindPrefix}:`, `${vertical.id} CSS class prefix is incorrect`);
-  assert(contractEntry?.styling?.federation?.layers?.owned?.includes(`ultramodern-vertical-${vertical.domain}`), `${vertical.id} vertical CSS layer is missing`);
-  assert(!contractEntry?.styling?.federation?.layers?.owned?.includes('ultramodern-shell-base'), `${vertical.id} must not own shell base CSS`);
-  assert(contractEntry?.styling?.federation?.entrypoints?.federationEntry === 'src/federation-entry.tsx', `${vertical.id} CSS contract must include federation entry`);
-  assert(contractEntry?.styling?.federation?.assets?.shared?.some(asset => asset.endsWith('/shared-design-tokens/tokens.css')), `${vertical.id} must import shared design token CSS`);
-  assert(contractEntry?.styling?.federation?.dedupe?.runtimeLoad === 'once-per-content-hash', `${vertical.id} CSS dedupe strategy is incorrect`);
-  assert(contractEntry?.styling?.federation?.ssr?.verticalCss === 'federated-manifest-owned-css', `${vertical.id} SSR CSS loading contract is incorrect`);
+  // Public head/surface and owned browser routes only exist for UI-emitting
+  // units; a headless api-only unit renders no route head or public surface.
+  if (vertical.emitsUi) {
+    assertPublicHeadContract(vertical.id, contractEntry?.routes?.publicHead, routeHead);
+    assertPublicSurfaceContract(vertical.id, contractEntry?.routes?.publicSurface);
+    assert(
+      (contractEntry?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen' && typeof route.descriptionKey === 'string'),
+      `${vertical.id} owned routes must be non-indexable private app screens by default and include description keys`,
+    );
+    assertPublicSurfaceAssets(vertical.path, contractEntry?.routes?.publicRoutes ?? []);
+  }
+  // CSS federation (a federated browser stylesheet keyed off the federation
+  // entry) only applies to UI-emitting units; a headless api-only unit owns no
+  // vertical CSS surface.
+  if (vertical.emitsUi) {
+    assert(contractEntry?.styling?.federation?.owner?.id === vertical.id, `${vertical.id} CSS federation owner is missing`);
+    assert(contractEntry?.styling?.federation?.role === 'vertical-css', `${vertical.id} must own only vertical CSS`);
+    assert(contractEntry?.styling?.federation?.rootSelector === `[data-app-id="${vertical.id}"]`, `${vertical.id} CSS root selector is incorrect`);
+    assert(contractEntry?.styling?.federation?.classPrefix === `${vertical.tailwindPrefix}:`, `${vertical.id} CSS class prefix is incorrect`);
+    assert(contractEntry?.styling?.federation?.layers?.owned?.includes(`ultramodern-vertical-${vertical.domain}`), `${vertical.id} vertical CSS layer is missing`);
+    assert(!contractEntry?.styling?.federation?.layers?.owned?.includes('ultramodern-shell-base'), `${vertical.id} must not own shell base CSS`);
+    assert(contractEntry?.styling?.federation?.entrypoints?.federationEntry === 'src/federation-entry.tsx', `${vertical.id} CSS contract must include federation entry`);
+    assert(contractEntry?.styling?.federation?.assets?.shared?.some(asset => asset.endsWith('/shared-design-tokens/tokens.css')), `${vertical.id} must import shared design token CSS`);
+    assert(contractEntry?.styling?.federation?.dedupe?.runtimeLoad === 'once-per-content-hash', `${vertical.id} CSS dedupe strategy is incorrect`);
+    assert(contractEntry?.styling?.federation?.ssr?.verticalCss === 'federated-manifest-owned-css', `${vertical.id} SSR CSS loading contract is incorrect`);
+  }
 
   const topologyEntry = topology.verticals?.find(verticalEntry => verticalEntry.id === vertical.id);
   assert(topologyEntry?.kind === 'vertical', `${vertical.id} topology kind is incorrect`);
@@ -1981,16 +4040,135 @@ for (const vertical of fullStackVerticals) {
   assert(topologyEntry?.moduleFederation?.name === vertical.mfName, `${vertical.id} topology MF name is incorrect`);
   assert(JSON.stringify(topologyEntry?.moduleFederation?.exposes) === JSON.stringify(vertical.exposes), `${vertical.id} topology exposes are incorrect`);
   assert(JSON.stringify(topologyEntry?.moduleFederation?.verticalRefs ?? []) === JSON.stringify(vertical.verticalRefs), `${vertical.id} topology verticalRefs are incorrect`);
-  assert(topologyEntry?.api?.bff?.prefix === vertical.apiPrefix, `${vertical.id} topology API prefix is incorrect`);
-  assert(topologyEntry?.api?.bff?.strictEffectApproach === true, `${vertical.id} topology strictEffectApproach is incorrect`);
-  assert(topologyEntry?.api?.serverEntry === `${vertical.path}/api/index.ts`, `${vertical.id} topology server entry is incorrect`);
-  assert(topologyEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} topology readiness endpoint is incorrect`);
-  assert(Object.keys(topologyEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} topology domain operations are missing`);
+  // API/BFF topology metadata only exists for API-bearing units; and the REST
+  // readiness/domain-operation surface is absent for the RPC protocol (G7a).
+  if (vertical.emitsApi) {
+    assert(topologyEntry?.api?.bff?.prefix === vertical.apiPrefix, `${vertical.id} topology API prefix is incorrect`);
+    assert(topologyEntry?.api?.bff?.strictEffectApproach === true, `${vertical.id} topology strictEffectApproach is incorrect`);
+    assert(topologyEntry?.api?.serverEntry === `${vertical.path}/api/index.ts`, `${vertical.id} topology server entry is incorrect`);
+    if (vertical.apiProtocol !== 'rpc') {
+      assert(topologyEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} topology readiness endpoint is incorrect`);
+      assert(Object.keys(topologyEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} topology domain operations are missing`);
+    }
+  }
+
+  if (vertical.deliveryUnit) {
+    const expectedDeliveryUnit = deliveryUnitBlock(
+      expectedDeliveryUnitFor(vertical, topologyEntry),
+    );
+    const compactAppEntry = ultramodernConfig.topology?.apps?.find(
+      entry => entry?.id === vertical.id,
+    );
+    // The backend-federation delivery-unit mirror only exists for API-bearing
+    // units; a UI-only vertical carries just the app-level delivery unit.
+    if (vertical.emitsApi) {
+      const compactBackendDeliveryUnit = deliveryUnitBlock(
+        compactAppEntry?.backendFederation?.deliveryUnit,
+      );
+      assertSameJson(
+        deliveryUnitBlock(compactAppEntry?.deliveryUnit),
+        compactBackendDeliveryUnit,
+        `${compactConfigPath} topology.apps.${vertical.id}.deliveryUnit`,
+        deliveryUnitIdentityFixArea,
+      );
+      assertSameJson(
+        compactBackendDeliveryUnit,
+        expectedDeliveryUnit,
+        `${compactConfigPath} topology.apps.${vertical.id}.backendFederation.deliveryUnit`,
+        deliveryUnitIdentityFixArea,
+      );
+      assertSelfCheck(
+        compactAppEntry?.backendFederation?.versionBoundary?.identityRoot === 'deliveryUnit',
+        `${compactConfigPath} topology.apps.${vertical.id}.backendFederation.versionBoundary.identityRoot`,
+        `Expected "deliveryUnit", found ${formatJson(compactAppEntry?.backendFederation?.versionBoundary?.identityRoot)}`,
+        deliveryUnitIdentityFixArea,
+      );
+    }
+    assertSameJson(
+      deliveryUnitBlock(compactAppEntry?.deliveryUnit),
+      expectedDeliveryUnit,
+      `${compactConfigPath} topology.apps.${vertical.id}.deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSameJson(
+      deliveryUnitBlock(compactAppEntry?.deliveryUnit),
+      deliveryUnitBlock(topologyEntry?.deliveryUnit),
+      `${compactConfigPath} vs topology/reference-topology.json verticals.${vertical.id}.deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+  }
 
   assert(ownership.owners?.some(owner => owner.id === vertical.id && owner.path === vertical.path), `${vertical.id} ownership entry is missing`);
   assert(overlay.ports?.[vertical.id], `${vertical.id} development port is missing`);
-  assert(overlay.manifests?.[vertical.id]?.includes('/mf-manifest.json'), `${vertical.id} development manifest is missing`);
-  assert(overlay.apis?.[vertical.id]?.endsWith(vertical.apiPrefix), `${vertical.id} development API URL is missing`);
+  if (vertical.emitsUi) {
+    assert(overlay.manifests?.[vertical.id]?.includes('/mf-manifest.json'), `${vertical.id} development manifest is missing`);
+  }
+  if (vertical.emitsApi) {
+    assert(overlay.apis?.[vertical.id]?.endsWith(vertical.apiProtocol === 'rpc' ? `${vertical.apiPrefix}/rpc` : vertical.apiPrefix), `${vertical.id} development API URL is missing`);
+  }
+}
+
+// Delivery-unit identity for ALL unit kinds (G29). Every workspace app —
+// shell, UI-only vertical, and API-bearing vertical — is an indivisible
+// delivery unit and must carry one consistent identity record across the
+// compact config, the reference topology, and its generated build artifact
+// (ADR-0019: one delivery-unit record, one build marker).
+for (const expectedApp of workspaceValidationContract.topology.compactConfig?.apps ?? []) {
+  const unitLabel = `delivery-unit identity for ${expectedApp.id}`;
+  const expectedDeliveryUnit = deliveryUnitBlock(expectedApp.deliveryUnit);
+  assertSelfCheck(
+    typeof expectedDeliveryUnit.unitId === 'string' && expectedDeliveryUnit.unitId.length > 0 &&
+      typeof expectedDeliveryUnit.buildMarker === 'string' && expectedDeliveryUnit.buildMarker.length > 0,
+    unitLabel,
+    `Every unit kind must declare a delivery-unit record; found ${formatJson(expectedApp.deliveryUnit)}`,
+    deliveryUnitIdentityFixArea,
+  );
+
+  const compactAppEntry = ultramodernConfig.topology?.apps?.find(
+    entry => entry?.id === expectedApp.id,
+  );
+  assertSameJson(
+    compactAppEntry?.deploy?.cloudflare,
+    expectedApp.deploy?.cloudflare,
+    `${compactConfigPath} topology.apps.${expectedApp.id}.deploy.cloudflare`,
+    'regenerate the app Cloudflare deployment contract; do not add local proof-only smoke checks',
+  );
+  assertSameJson(
+    deliveryUnitBlock(compactAppEntry?.deliveryUnit),
+    expectedDeliveryUnit,
+    `${compactConfigPath} topology.apps.${expectedApp.id}.deliveryUnit`,
+    deliveryUnitIdentityFixArea,
+  );
+
+  const topologyUnitEntry =
+    expectedApp.kind === 'shell'
+      ? topology.shell
+      : topology.verticals?.find(entry => entry?.id === expectedApp.id);
+  assertSameJson(
+    deliveryUnitBlock(topologyUnitEntry?.deliveryUnit),
+    expectedDeliveryUnit,
+    `topology/reference-topology.json ${expectedApp.kind === 'shell' ? 'shell' : `verticals.${expectedApp.id}`}.deliveryUnit`,
+    deliveryUnitIdentityFixArea,
+  );
+
+  const appPath = expectedApp.path;
+  const buildArtifactPath = `${appPath}/shared/ultramodern-build.json`;
+  assertExists(buildArtifactPath);
+  const buildIdentity = readJson(buildArtifactPath).deliveryUnit ?? {};
+  assertSelfCheck(
+    buildIdentity.unitId === expectedDeliveryUnit.unitId &&
+      buildIdentity.buildMarker === expectedDeliveryUnit.buildMarker,
+    `${buildArtifactPath} deliveryUnit`,
+    `Expected ${formatJson({ unitId: expectedDeliveryUnit.unitId, buildMarker: expectedDeliveryUnit.buildMarker })}, found ${formatJson({ unitId: buildIdentity.unitId, buildMarker: buildIdentity.buildMarker })}`,
+    deliveryUnitIdentityFixArea,
+  );
+  const buildModuleSource = readText(`${appPath}/shared/ultramodern-build.ts`);
+  assertSelfCheck(
+    buildModuleSource.includes('export const ultramodernDeliveryUnit'),
+    `${appPath}/shared/ultramodern-build.ts`,
+    'Missing ultramodernDeliveryUnit export',
+    deliveryUnitIdentityFixArea,
+  );
 }
 
 console.log('UltraModern workspace scaffold validated');