@ccslabs/xtend 0.1.0-rc.1 → 0.1.2

package/docs/en/rc0-adoption-guide.md

@@ -0,0 +1,102 @@
+# RC0 Adoption Guide
+
+- Contract: `xtend.epic12.docs-adoption.v1`
+- Report: `xtend.epic12.docs-adoption-report.v1`
+- Workpackage: `WP-E12-15`
+- Local gate: `node scripts/run_xtend_tests.js epic12-docs-adoption --json`
+
+This guide is the production-close entry point for teams evaluating XTend after Epic 12 as a release-candidate candidate. It connects the migration notes from long-tail runtime, visual snapshots, design tokens, RMT DSL authoring polish and RC0 gate matrix.
+
+RC0 remains a local review candidate. `private-until-release-owner-approval` remains active; a green gate run is not a publish approval.
+
+## Migration Notes
+
+### Long-Tail Runtime Closure
+
+Closed:
+
+- `x-tabs`: performance profile, keyboard, browser smoke, theme matrix
+- `x-theme`: a11y, reduced motion, forced colors, performance, theme propagation, density boundary
+- `x-button`: performance budget, interaction budget, Fabric measurement, RMT metadata
+- `x-menu`: performance, keyboard navigation, router compatibility, Fabric measurement, RMT metadata
+
+Accepted RC0 residuals:
+
+- `xstate`: non-visual boundary probe, `contract-gated`
+- `x-utils`: utility boundary, `typed-contract-gated`
+
+These residuals are not hidden blockers. They remain visible because infrastructure modules are not artificially treated as UI shells.
+
+### DOM-First Visual Snapshots
+
+The RC0 snapshot path is DOM-first:
+
+```bash
+node scripts/run_xtend_tests.js visual-snapshots --json
+node scripts/run_xtend_tests.js design-tokens --json
+```
+
+Pixel baselines are optional locally. The reviewable baseline is in `tests/browser/visual-baselines/visual-snapshots.dom-baseline.json`.
+
+### Design Token Productization
+
+New components and RMT shells use the `--xtend-*` token line. Theme packs, density packs, high contrast, forced colors and CSS parts are public styling surfaces and need migration notes when they change.
+
+### RMT DSL Authoring Polish
+
+New RMT app documents can author shells, routes, links, outlets, components, slots, commands, hydration and lanes through the DSL polish layer. XTendRMT remains framework-agnostic: the kernel imports no XTend types and no XRouter implementation.
+
+### RC0 Gate Matrix
+
+Before owner review:
+
+```bash
+node scripts/run_xtend_tests.js epic12-docs-adoption --json
+node scripts/run_xtend_tests.js rc0-gate-matrix --json
+npm run test:release:full:report
+npm run pack:dry-run
+```
+
+Conditional network gates:
+
+```bash
+npm audit --audit-level=moderate
+npm sbom --sbom-format=cyclonedx --json
+```
+
+If network access is unavailable, RC0 remains locally reviewable; publishing remains blocked.
+
+## Component Author Checklist
+
+| Check | Required |
+|-------|----------|
+| use `xtend-loader.js` and local manifest | yes |
+| document types, events, a11y and performance | yes |
+| treat design tokens and CSS parts as public API | yes |
+| set Fabric lanes and RMT schedule hints correctly | yes |
+| check snapshot and theme matrix impact | yes |
+| mark breaking changes with migration notes | yes |
+
+## App Author Checklist
+
+| Check | Required |
+|-------|----------|
+| describe app shell shell-first in RMT where possible | yes |
+| route XRouter routes through native RMT `routes` records | yes |
+| treat Parsedown, rich HTML or media as scheduled content components | yes |
+| check Trusted DOM boundary for `html_fragment` | yes |
+| run `rmt-dsl-authoring-polish` and `docs-rmt-pilot` for RMT paths | yes |
+
+## Known Residual Policy
+
+RC0 accepts:
+
+- `xstate`
+- `x-utils`
+- `xtend.component.hydrate`
+
+The hydration warning remains accepted as long as it stays below the failure threshold and below `maxWarningCount = 2`. Failures are not allowed.
+
+## Handoff to WP-E12-16
+
+`WP-E12-16` used this guide, the [RC0 Gate Matrix](./rc0-gate-matrix.md), the Package Dry Run, the Conditional Network Gates and the Known Residual Policy to build the [Epic 12 RC0 Handoff](./epic12-rc0-handoff.md) for release owners.

package/docs/en/rc0-gate-matrix.md

@@ -0,0 +1,58 @@
+# RC0 Gate Matrix
+
+`xtend.epic12.rc0-gate-matrix.v1` describes XTend's first release-candidate-capable gate interface. RC0 is a local review candidate, not a publish.
+
+Local self check:
+
+```bash
+node scripts/run_xtend_tests.js rc0-gate-matrix --json
+npm run test:rc0-gate-matrix
+```
+
+## Required Gates
+
+| Area | Command |
+|------|---------|
+| PR Fast | `npm run test:pr:report` |
+| Full Release | `npm run test:release:full:report` |
+| Snapshot Gate | `node scripts/run_xtend_tests.js component-shell-theme-matrix visual-snapshot-automation visual-snapshots design-tokens --json` |
+| RMT Authoring Gate | `node scripts/run_xtend_tests.js rmt-shell-authoring-ux rmt-first-class-app rmt-first-demo-app docs-rmt-pilot rmt-dsl-authoring-polish --json` |
+| Package Dry Run | `npm run pack:dry-run` |
+| Matrix Self Check | `node scripts/run_xtend_tests.js rc0-gate-matrix --json` |
+
+## Snapshot and Design Tokens
+
+The snapshot gate uses `visual-snapshots` and `design-tokens`. Pixel baselines remain optional; the reviewable RC0 basis is the DOM baseline at `tests/browser/visual-baselines/visual-snapshots.dom-baseline.json`.
+
+## RMT Authoring
+
+The RMT authoring gate connects shell authoring, RMT-first apps, Docs Parsedown scheduling and the new `rmt-dsl-authoring-polish` gate. This makes it checkable that XTend UI, XRouter and XTendRMT work together without importing XTend types into the RMT kernel.
+
+## Conditional Network Gates
+
+Before publish, network gates must run or be intentionally deferred in the handoff:
+
+```bash
+npm audit --audit-level=moderate
+npm sbom --sbom-format=cyclonedx --json
+```
+
+These gates are not part of the local default runner.
+
+## Known Residual Policy
+
+RC0 currently accepts:
+
+- `xstate` as a `contract-gated` non-visual boundary probe
+- `x-utils` as a `typed-contract-gated` utility boundary
+- the known performance warning `xtend.component.hydrate` as long as it stays below the failure threshold
+
+`private-until-release-owner-approval` remains active. Even a green RC0 gate run does not mean publish approval.
+
+## Migration and Adoption
+
+The operational docs for teams have lived in the [RC0 Adoption Guide](./rc0-adoption-guide.md) since `WP-E12-15`. It brings together long-tail runtime closure, DOM-first snapshot baseline, design-token productization, RMT DSL authoring polish, known residual policy and migration notes for component authors and app authors.
+
+The final owner handoff has lived under [Epic 12 RC0 Handoff](./epic12-rc0-handoff.md) since `WP-E12-16`. It sets the Epic 12 status to `ready-for-release-owner-review-not-publish` and keeps publishing blocked until Release Owner Acceptance.
+
+Canonical path: `docs/rc0-adoption-guide.md`.

package/docs/en/rc1-gate-matrix-ci-handoff.md

@@ -0,0 +1,56 @@
+# RC1 Gate Matrix and CI Handoff
+
+Contract: `xtend.epic13.rc1-gate-matrix-ci-handoff.v1`
+
+Status: `accepted-rc1-gate-matrix-ci-handoff`
+
+Workpackage: `WP-E13-13`
+
+DPF package: `DPF-WP-01-rc1-gate-matrix-ci-handoff`
+
+## Goal
+
+The RC1 Gate Matrix bundles the Epic 13 evidence into a local, network-free handoff for CI maintainers and release owners. The gate does not check the productive network runs themselves, but whether their evidence paths, deferral rules, reports and owner metadata are registered.
+
+## Local Gate
+
+```bash
+node scripts/run_xtend_tests.js epic13-rc1-gate-matrix-ci-handoff --json
+npm run test:epic13-rc1-gate-matrix-ci-handoff
+```
+
+The report writes to `.xtend-test-results/xtend-epic13-rc1-gate-matrix-ci-handoff-report.json` during aggregate runs and uses `xtend.epic13.rc1-gate-matrix-ci-handoff-report.v1`.
+
+## Source Gates
+
+- `npm run test:epic13-rc1-readiness`
+- `npm run test:epic13-release-owner-acceptance`
+- `npm run test:epic13-conditional-network-evidence`
+- `npm run test:epic13-package-export-lock`
+- `npm run test:epic13-known-residual-triage`
+- `npm run test:epic13-hydration-performance-closure`
+- `npm run test:epic13-prod-browser-csp-smoke`
+- `npm run test:epic13-visual-owner-artifact`
+- `npm run test:epic13-rmt-production-readiness`
+- `npm run test:epic13-docs-rmt-production-hardening`
+- `npm run test:epic13-trusted-dom-boundary`
+- `npm run test:epic13-rc1-migration-notes`
+
+## CI Lanes
+
+| Lane | Purpose | Report |
+|------|---------|--------|
+| `pr-fast` | PR feedback with TypeExports drift handoff | `.xtend-test-results/xtend-pr-gate-report.json` |
+| `rc1-full-release` | complete RC1 release-gate matrix | `.xtend-test-results/xtend-release-gate-report.json` |
+| `conditional-network-evidence` | audit/SBOM execution or owner deferral | `.xtend-test-results/xtend-conditional-network-evidence-report.json` |
+| `owner-handoff` | release-owner interface for all Epic 13 gates | `.xtend-test-results/xtend-epic13-rc1-gate-matrix-ci-handoff-report.json` |
+
+## Release Owner Evidence
+
+[Release Report and Pack Dry Run Evidence](./release-report-pack-dry-run-evidence.md) adds `xtend.epic13.release-report-pack-dry-run-evidence.v1` to the handoff and writes `.xtend-test-results/xtend-epic13-release-report-pack-dry-run-evidence-report.json`.
+
+[Conditional Network Evidence CI](./conditional-network-evidence-ci.md) adds `xtend.epic13.conditional-network-evidence-ci.v1`, the CI job `conditional-network-evidence` and `.xtend-test-results/xtend-epic13-conditional-network-evidence-ci-report.json` to the handoff.
+
+## Publish Boundary
+
+`publishAllowed` remains `false`; `packagePrivateRequired` remains `true`. Network-based gates may only be referenced locally as `executed-or-owner-deferral`. `WP-E13-14` takes over from here for the final Epic 13 closure review and RC1 handoff.

package/docs/en/rc1-migration-notes.md

@@ -0,0 +1,69 @@
+# RC1 Migration Notes
+
+Contract: `xtend.epic13.rc1-migration-notes-semver.v1`
+
+WP-E13-12 prepares consumer communication for the first RC1 candidate. The applied state is `0.1.0-rc.1`; the package boundary is opened to `private: false` for RC1 publish prep. The actual publish command remains a separate manual owner step.
+
+## SemVer
+
+| Field | Value |
+| --- | --- |
+| Current Version | `0.1.0-rc.1` |
+| Proposed Version | `0.1.0-rc.1` |
+| Classification | `minor-pre-1.0-release-candidate` |
+| Publish | prepared, `private: false`; `npm publish` not executed |
+
+## Migration Sections
+
+### loader-local-esm-cdn-free
+
+XTend apps should use local ESM loader paths. Deprecated CDN bootstraps, especially old `xstate` references, do not belong in RC1-close apps.
+
+### package-export-surface
+
+The Package Export Lock is the binding public surface. New tooling exports, including `./catalog/epic13-rc1-migration-notes`, must appear in the export lock, README, changelog and release gates.
+
+### rmt-first-app-authoring
+
+RMT is the shell-first app authoring path. XTend components are connected through adapters; the RMT kernel imports no XTend types.
+
+### docs-rmt-parsedown-shell
+
+Parsedown is a schedulable docs component inside the RMT shell. Rich HTML or multimedia slots can later be orchestrated alongside it.
+
+### trusted-dom-boundary
+
+`dom_descriptor` remains preferred. `html_fragment` and Parsedown HTML must pass through `xtend.security.trusted-dom-sanitizer.v1` before DOM sinks.
+
+### fabric-lanes-telemetry
+
+Fabric, lanes and RMT lane mapping are the preferred bridge for telemetry and scheduler signals in components.
+
+### component-typescript-and-dts
+
+Component types and `.d.ts` files are part of the consumer contract. App code should consume these types instead of implicit DOM conventions.
+
+### known-residuals-and-watchpoints
+
+`xstate` and `x-utils` remain boundary contracts. The old hydration watchpoint is closed, but should remain visible in RC1 gates.
+
+### visual-owner-artifacts
+
+Visual proofs remain owner-reviewable. Local gates may remain static; CI or release owners can provide screenshots as artifacts.
+
+### conditional-network-evidence
+
+Audit and SBOM are either executed or explicitly owner-deferred. Without evidence or deferral, there is no publish approval.
+
+### publish-boundary
+
+`private: false` is set for RC1 publish prep. Automatic publish remains blocked; the final `npm publish` still requires the manual owner command.
+
+## Local Gate
+
+```bash
+node scripts/run_xtend_tests.js epic13-rc1-migration-notes --json
+npm run test:epic13-rc1-migration-notes
+```
+
+The direct handoff from this package was `WP-E13-13` with `rc1-gate-matrix-ci-handoff`; the corresponding gate matrix is now documented under [RC1 Gate Matrix and CI Handoff](./rc1-gate-matrix-ci-handoff.md).

package/docs/en/rc1-readiness.md

@@ -0,0 +1,46 @@
+# RC1 Readiness
+
+- Contract: `xtend.epic13.rc1-production-readiness.v1`
+- Report: `xtend.epic13.rc1-readiness-report.v1`
+- Workpackage: `WP-E13-01`
+- Local gate: `node scripts/run_xtend_tests.js epic13-rc1-readiness --json`
+- Target state: `rc1-production-candidate-ready`
+
+RC1 carries the RC0 handoff into a release candidate that is closer to production. The status does not mean publish. `private-until-release-owner-acceptance` remains active.
+
+## What RC1 Must Make Checkable
+
+| Area | RC1 obligation |
+|------|----------------|
+| Release Owner Acceptance | formal contract with accepted, deferred and blocked decisions |
+| Conditional Network Gates | run `npm audit --audit-level=moderate` and `npm sbom --sbom-format=cyclonedx --json`, or document owner deferral |
+| Package Dry Run | check package content and export surface in a machine-readable way |
+| Known Residuals | `xstate` and `x-utils` are closed; `xtend.component.hydrate` is closed without owner dependency in `WP-E13-06` |
+| Browser/CSP | production-close same-origin, nonce and loader smokes are prepared under [PROD Browser CSP Smokes](./prod-browser-csp-smokes.md) |
+| Visual Evidence | keep DOM-first snapshots and normalize optional screenshot/pixels artifact under [Visual Owner Artifacts](./visual-owner-artifacts.md) |
+| RMT Apps | bundle RMT-first app shell, routing, components, Fabric, lanes and diagnostics |
+| Docs app | Parsedown remains an orchestrated component inside an RMT shell |
+| Trusted DOM | Parsedown/RMT HTML boundary checked close to the browser |
+| Migration Notes | prepare RC1 SemVer and changelog decision |
+
+## Baseline Gates
+
+```bash
+node scripts/run_xtend_tests.js epic13-rc1-readiness --json
+node scripts/run_xtend_tests.js epic12-rc0-handoff --json
+node scripts/run_xtend_tests.js rc0-gate-matrix --json
+node scripts/run_xtend_tests.js references --json
+```
+
+## Feature Drift
+
+Not part of RC1:
+
+- embedding XTend into the RMT kernel
+- bringing CDN fallbacks back into default paths
+- building new product features without a production-readiness purpose
+- automatically opening `private: true`
+
+## Handoff
+
+`WP-E13-02` is complete and documents the Release Owner Acceptance contract under [Release Owner Acceptance](./release-owner-acceptance.md). `WP-E13-03` is also complete and documents the Conditional Network Evidence under [Conditional Network Evidence](./conditional-network-evidence.md). `WP-E13-04` is complete and documents the Package Export Lock under [Package Export Lock](./package-export-lock.md). `WP-E13-05` is complete and documents the Known Residual Triage under [Known Residual Triage](./known-residual-triage.md). `WP-E13-06` is complete and documents the [Hydration Performance Closure](./hydration-performance-closure.md). `WP-E13-07` is complete and documents the [PROD Browser CSP Smokes](./prod-browser-csp-smokes.md). `WP-E13-08` is complete and documents `xtend.epic13.visual-owner-artifact.v1` under [Visual Owner Artifacts](./visual-owner-artifacts.md). `WP-E13-09` is complete and documents `xtend.epic13.rmt-production-readiness.v1` under [RMT Production Readiness](./rmt-production-readiness.md). `WP-E13-10` is complete and documents `xtend.epic13.docs-rmt-production-hardening.v1` under [Docs RMT Production Hardening](./docs-rmt-production-hardening.md). `WP-E13-11` is complete and documents `xtend.epic13.trusted-dom-boundary.v1` under [Trusted DOM Boundary Browser Proof](./trusted-dom-boundary-browser-proof.md). `WP-E13-12` is complete and documents `xtend.epic13.rc1-migration-notes-semver.v1` under [RC1 Migration Notes](./rc1-migration-notes.md). `WP-E13-13` is complete and documents `xtend.epic13.rc1-gate-matrix-ci-handoff.v1` under [RC1 Gate Matrix and CI Handoff](./rc1-gate-matrix-ci-handoff.md). `WP-E13-14` is ready for the final Epic 13 closure review.

package/docs/en/release-owner-acceptance.md

@@ -0,0 +1,56 @@
+# Release Owner Acceptance
+
+`xtend.epic13.release-owner-acceptance.v1` describes the first RC1 owner interface after the RC1 Readiness Model.
+
+Local gate:
+
+```bash
+node scripts/run_xtend_tests.js epic13-release-owner-acceptance --json
+```
+
+or:
+
+```bash
+npm run test:epic13-release-owner-acceptance
+```
+
+## What the Contract Defines
+
+- Release Owner Acceptance is a review contract, not a publish approval.
+- `private-until-release-owner-acceptance` remains active.
+- `publishAllowed` remains `false`.
+- `automaticPublishApproval` remains `false`.
+- Owner decisions use `accepted`, `deferred` and `blocked`.
+
+## Checklist Model
+
+| Status | Use |
+|--------|-----|
+| `accepted` | baseline is accepted as a review basis |
+| `deferred` | open evidence is visible and has a target package |
+| `blocked` | decision must not happen automatically |
+
+The intentionally blocked entry is `automatic-publish-approval`. A green test run therefore remains a review signal, not a publish signal.
+
+## Current Handoff
+
+`WP-E13-03` prepared the Conditional Network Gate Evidence under [Conditional Network Evidence](./conditional-network-evidence.md) with `xtend.epic13.conditional-network-evidence.v1`:
+
+- `npm audit --audit-level=moderate`
+- `npm sbom --sbom-format=cyclonedx --json`
+
+If these gates cannot run locally because of sandbox, network or policy, a structured owner deferral is created.
+
+`WP-E13-04` completed the [Package Export Lock](./package-export-lock.md) with `xtend.epic13.package-export-lock.v1`. `WP-E13-05` completed the [Known Residual Triage](./known-residual-triage.md) with `xtend.epic13.known-residual-triage.v1`. `WP-E13-06` completed the [Hydration Performance Closure](./hydration-performance-closure.md) with `xtend.epic13.hydration-performance-closure.v1`. `WP-E13-07` completed the [PROD Browser CSP Smokes](./prod-browser-csp-smokes.md) with `xtend.epic13.prod-browser-csp-smoke.v1`. `WP-E13-08` normalized [Visual Owner Artifacts](./visual-owner-artifacts.md) with `xtend.epic13.visual-owner-artifact.v1`.
+
+The checklist entry `known-residual-renewal` is therefore `accepted`: `xstate` and `x-utils` are boundary contracts, `xtend.component.hydrate` is closed without owner dependency. The checklist entry `visual-owner-artifact` is `accepted`; `rmt-production-readiness` has also been `accepted` since `WP-E13-09` and `xtend.epic13.rmt-production-readiness.v1`. `docs-rmt-production-hardening` has been accepted since `WP-E13-10` and `xtend.epic13.docs-rmt-production-hardening.v1`. `prod-browser-csp-smoke` and `trusted-dom-boundary` have been accepted since `WP-E13-11`; the Trusted DOM evidence is under [Trusted DOM Boundary Browser Proof](./trusted-dom-boundary-browser-proof.md) and `xtend.epic13.trusted-dom-boundary.v1`. `rc1-migration-notes` has been accepted since `WP-E13-12`; the evidence is under [RC1 Migration Notes](./rc1-migration-notes.md) and `xtend.epic13.rc1-migration-notes-semver.v1`. `rc1-gate-matrix-ci-handoff` has been accepted since `WP-E13-13`; the evidence is under [RC1 Gate Matrix and CI Handoff](./rc1-gate-matrix-ci-handoff.md) and `xtend.epic13.rc1-gate-matrix-ci-handoff.v1`. The next handoff goes to `WP-E13-14`.
+
+Further reading: [RC1 Readiness](./rc1-readiness.md).
+
+## RC1 Test-Build Acceptance
+
+`RC1TB-WP-08` concretizes the owner interface for the first local RC1 test build in `development/XTend-RC1-Test-Build-Owner-Acceptance.md` under `xtend.rc1.test-build-owner-acceptance.v1`.
+
+The decision for this interface is `accepted-for-internal-test-build-not-publish`: the test build may be used internally against the documented gate reports, the RMT vNext Reference Demo and the XTendRMT Bestcase Demo. `npm-audit-moderate` and `npm-sbom-json` were executed and accepted in the owner publish step; version `0.1.0-rc.1` and `private: false` are set for publish prep, while `automaticPublishApproval: false` remains active.
+
+The separate owner publish decision is created in `development/XTend-RC1-Release-Owner-Publish-Decision.md` under `xtend.rc1.release-owner-publish-decision.v1`. Its current state is `accepted-for-publish-prep`; the actual publish command was not executed. The license decision for the complete stack is `Apache-2.0`; audit and SBOM are accepted.

package/docs/en/release-report-pack-dry-run-evidence.md

@@ -0,0 +1,39 @@
+# Release Report and Pack Dry Run Evidence
+
+Contract: `xtend.epic13.release-report-pack-dry-run-evidence.v1`
+
+Status: `accepted-release-report-pack-dry-run-evidence`
+
+Workpackage: `DPF-WP-02-release-report-pack-dry-run`
+
+## Goal
+
+This package turns `release:report` and `pack:dry-run` into reproducible release-owner evidence. Both commands remain local and network-free; audit/SBOM, public publish and the license decision remain follow-up packages.
+
+## Local Gate
+
+```bash
+node scripts/run_xtend_tests.js epic13-release-report-pack-dry-run-evidence --json
+npm run test:epic13-release-report-pack-dry-run-evidence
+```
+
+## Evidence Commands
+
+```bash
+npm run release:report
+npm run pack:dry-run
+```
+
+`npm run release:report` writes `.xtend-test-results/xtend-release-report.json`.
+
+`npm run pack:dry-run` writes:
+
+- `.xtend-test-results/xtend-pack-dry-run.json`
+- `.xtend-test-results/xtend-package-export-surface-lock.json`
+- `.xtend-test-results/xtend-package-export-lock-report.json`
+
+The raw npm text run remains available through `npm run pack:dry-run:raw`.
+
+## RC1 Handoff
+
+The evidence is referenced in the RC1 handoff under `xtend.epic13.rc1-gate-matrix-ci-handoff.v1`. The DPF-WP-02 report uses `.xtend-test-results/xtend-epic13-release-report-pack-dry-run-evidence-report.json` and hands off to `DPF-WP-03` [Conditional Network Evidence CI](./conditional-network-evidence-ci.md) with `xtend.epic13.conditional-network-evidence-ci.v1`.

package/docs/en/rmt-action-effect-runtime.md

@@ -0,0 +1,101 @@
+# RMT Action Effect Runtime
+
+- Contract: `xtend.epic18.rmt-action-effect-runtime.v1`
+- Workpackage: `WP-E18-08`
+- Runtime: `xtendrmt/rmt-action-effect-runtime.js`
+- Types: `xtendrmt/rmt-action-effect-runtime.d.ts`
+- Fixture: `tests/fixtures/rmt-action-effect-runtime.rmt`
+- Local gate: `node scripts/run_xtend_tests.js rmt-action-effect-runtime --json`
+- Next: `WP-E18-09`
+
+## Purpose
+
+The Action Effect Runtime turns common app flows into native RMT platform
+primitives. Apps can load fixture, REST, SSR or host-adapter data; update typed
+state; publish feedback; navigate; focus controls; lazy-load modules; and own
+resources without product-local action frameworks.
+
+The runtime is deliberately domain-neutral. It does not define product surfaces
+or record taxonomies. Developers provide their own actions, contracts, adapters,
+effects and resources.
+
+## DataSources
+
+Supported datasource kinds:
+
+- `fixture`: returns static fixture records for local app fixtures and tests.
+- `rest`: calls an injected adapter with an endpoint and payload.
+- `ssr`: reads a prehydrated payload and can project it with `resultPath`.
+- `host`: calls an explicit host adapter for mutations or platform commands.
+
+Runtime code never reaches for global network APIs directly. REST and host work
+through injected adapters so browser, server, test and shell environments can
+choose their own transport policy.
+
+## Actions
+
+An action can declare:
+
+- `datasource`
+- `resultState`
+- `loadingState`
+- `statusState`
+- `effects`
+- `resources`
+- `resourceOwner`
+- `cancelable`
+
+`runAction(id, payload)` moves the action through loading, success, error or
+cancelled states. If a typed state runtime is passed in, loading and status are
+written through `setState` and `patchState`, while datasource results can be
+stored in `resultState`.
+
+## Effects
+
+Supported effect kinds:
+
+- `toast` and `feedback`
+- `navigation`
+- `focus`
+- `lazy-import`
+- `side-effect`
+
+Feedback, navigation, focus and custom side effects use injected adapters.
+Lazy imports are modeled as resources, which means they can share the same
+ownership and cleanup model as other runtime resources.
+
+## Resource Ownership
+
+Supported resource kinds:
+
+- `object-url`
+- `stream`
+- `observer`
+- `timer`
+- `lazy-import`
+
+Resources are acquired under an owner, normally the action id. The resource
+manager exposes `releaseOwner(ownerId)` so surface destroy, render-unit destroy
+or action cancel can clean up only the resources they own.
+
+## Diagnostics
+
+The runtime emits diagnostics with
+`xtend.epic18.rmt-action-effect-diagnostic.v1` on the
+`rmt.app_platform.action_effect` channel. Loading, success, error and cancel
+are all visible in the local runtime history and in an optional diagnostics hub.
+
+## Boundaries
+
+- The RMT kernel imports no XTend UI components.
+- Data access goes through injected adapters.
+- Product-local action frameworks are not part of the platform contract.
+- Product flow names remain app code, not framework defaults.
+- Normal app UI still uses RMT templates and DOM descriptors instead of HTML
+  string renderers.
+
+## Handoff
+
+`WP-E18-09` builds on this runtime by connecting declarative DOM and custom
+events to actions. The event layer should reuse the Action Effect Runtime
+instead of creating another action execution path.

package/docs/en/rmt-app-platform-authoring.md

@@ -0,0 +1,47 @@
+# RMT App Platform Authoring
+
+- Contract: `xtend.epic18.rmt-app-platform-authoring.v1`
+- Fixture: `tests/fixtures/rmt-app-platform-authoring.rmt`
+- Local gate: `node scripts/run_xtend_tests.js rmt-app-platform-authoring --json`
+- Workpackage: `WP-E18-04`
+
+## Purpose
+
+This authoring model defines RMT as a generic app platform. It is not a port of a concrete product surface. Developers can combine their own app domains, record contracts, component families, surfaces, state graphs, actions, datasources, resources and events.
+
+## Primitives
+
+| Primitive | Purpose |
+|-----------|---------|
+| `app` | app metadata, shell, domain, record contract and entry points |
+| `route` | maps URL or navigation state to surface and template |
+| `surface` | keyed app areas with lifecycle, placement, state and persistence |
+| `slot` | named composition points between templates and components |
+| `template` | structured UI as DOM Descriptor, not as HTML string |
+| `component` | binds arbitrary custom elements through a capability catalog |
+| `state` | typed app state for collections, selection, filters and form values |
+| `selector` | derived read views on state |
+| `derive` | computed values with clear output type |
+| `repeat` | keyed lists without product renderer |
+| `when` | declarative conditions, empty and fallback states |
+| `bind` | maps state, selectors or derived values to attributes/properties |
+| `action` | declarative commands for app flows |
+| `effect` | async execution with lanes and feedback |
+| `datasource` | fixture, REST, SSR or later host data adapters |
+| `resource` | lazy/preload/cleanup resources including trusted-HTML special case |
+| `event` | scoped event routing without an implicit global event bus |
+
+## Boundaries
+
+- `no-media-manager-product-surface-clone`
+- `no-product-record-contract-required`
+- `structured-ui-before-trusted-html`
+- `trusted-html-explicit-boundary-only`
+- `no-rmt-kernel-import-of-xtend-types`
+- `no-external-innerhtml-helper-required`
+
+Normal app UI must be modelable through structured templates. HTML remains an explicit Trusted DOM boundary for special cases and is not the default path for component development.
+
+## Handoff
+
+`WP-E18-04` only defines the authoring model. `WP-E18-05` then builds the safe DOM Descriptor Renderer and No-Manual-HTML gate. `WP-E18-06` implements the component-native template primitives on top of that.

package/docs/en/rmt-app-platform-fixture.md

@@ -0,0 +1,35 @@
+# RMT App Platform Fixture
+
+WP-E18-12 delivers the generic reference fixture for the RMT App Platform. It proves that the Epic 18 primitives are not coupled to a product surface: the same RMT building blocks carry a `generic-catalog`, an `admin-queue` and a `content-board`.
+
+## Contract
+
+- Schema: `xtend.epic18.rmt-app-platform-fixture.v1`
+- Fixture schema: `xtend.epic18.rmt-app-platform-fixture-source.v1`
+- Local gate: `node scripts/run_xtend_tests.js rmt-app-platform-fixture --json`
+- Package script: `npm run test:rmt-app-platform-fixture`
+- Handoff: `WP-E18-13`
+
+## Covered Platform Capabilities
+
+- configurable record contracts without a fixed record class
+- list, detail, toolbar, feedback and overlay composition with DOM Descriptor templates
+- actions with fixture, REST, SSR and host datasources
+- feedback, navigation, focus, lazy-import and side-effect flows
+- dynamic surfaces for multiple domains from the same primitives
+- portals and overlays including stack behavior
+- resource ownership and cleanup for streams, observers, timers, object URLs and lazy imports
+- scaffold build evidence through the RMT App Platform generator
+
+## Boundaries
+
+Normal RMT UI remains declarative. `innerHTML`, `outerHTML`, `insertAdjacentHTML` and `document.write` do not belong in the app fixture; the No-Manual-HTML gate checks this explicitly. Product-bound surface lists are avoided as well. Developers should be able to build in XTend app structures without external shell renderers or local registry rewrites.
+
+## Fixture Artifacts
+
+- `catalog/epic18-rmt-app-platform-fixture.js`
+- `tests/fixtures/rmt-app-platform-fixture.rmt`
+- `tests/rmt/rmt_app_platform_fixture_suite.js`
+- `development/WP-E18-12-Generische-RMT-App-Platform-Fixture-bauen.md`
+
+The gate renders the fixture with the DOM Descriptor Renderer, routes events into actions, swaps datasources, materializes surfaces, opens overlays and proves cleanup through resource disposals.