@orkestrel/scaffold 0.0.2 → 0.0.4

package/dist/src/server/index.js

@@ -1,40 +1,1695 @@
-import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { CONTROL_CHARACTER_PATTERN, DEFAULT_ENGINES, DEFAULT_VERSION, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, HEX_PATTERN, HOST_PATHS, INVALID_PATH_CHARACTER_PATTERN, MAX_ARTIFACT_BYTES, MAX_ARTIFACT_HEX_LENGTH, MAX_COLLECTION_ITEMS, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_TOTAL_ARTIFACT_BYTES, SYNC_BASELINE_PATTERN, ScaffoldError, VERSION_PATTERN, blueprint, bytesToHex, contentByteLength, devDependenciesFor, diffPlan, findFileConflict, findPathConflict, hasOnlyDataProperties, hasValidAuditBytes, hasValidSnapshotBytes, isDenseDataArray, isDependency, isEmitterErrorHandler, isPlan, isSyncReport, isWorkspaceName, manifestToDependencies, ownDataValue, parsePlan, parseSyncReport, rangeToFreshness, snapshotPlan, validateDependencyArray, validatePlan } from "../core/index.js";
+import { attempt, booleanShape, createContract, integerShape, isError, isFunction, isRecord, isString, objectShape, optionalShape, parseJSON, parseJSONAs, stringShape } from "@orkestrel/contract";
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, closeSync, constants, copyFileSync, existsSync, fstatSync, linkSync, lstatSync, mkdirSync, openSync, opendirSync, readSync, realpathSync, renameSync, rmSync, rmdirSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { flattenText, isBlockquoteNode, isParagraphNode, parseDocument, walkNodes } from "@orkestrel/markdown";
-import { DEFAULT_ENGINES, DEFAULT_VERSION, HOST_PATHS, ScaffoldError, blueprint, devDependenciesFor, manifestToDependencies, rangeToFreshness } from "../core/index.js";
 import { Emitter } from "@orkestrel/emitter";
+//#region src/server/constants.ts
+/**
+* The prune-owned directories. Files outside these roots are never candidates
+* for removal, including project-owned skills under `.agents/skills` and
+* `.claude/skills`.
+*
+* @example
+* ```ts
+* import { PRUNE_DIRECTORIES } from '@orkestrel/scaffold/server'
+*
+* PRUNE_DIRECTORIES // ['.claude/agents', '.codex/agents', 'scripts']
+* ```
+*/
+var PRUNE_DIRECTORIES = Object.freeze([
+	".claude/agents",
+	".codex/agents",
+	"scripts"
+]);
+/** Reserved metadata file written at the root of every staged host. */
+var HOST_MANIFEST_PATH = "manifest.json";
+/** Local configuration and credential-like paths that must never enter a vendored host. */
+var SENSITIVE_HOST_PATH_PATTERN = /(?:^|\/)(?:(?:\.git|\.ssh|\.aws|\.azure|\.docker|\.kube|\.gnupg|\.env(?:\.[^/]*)?)(?:\/|$)|(?:\.npmrc|\.pypirc|\.netrc|\.git-credentials|settings\.local\.json|auth\.json|credentials(?:\.json)?|application_default_credentials\.json|id_rsa|id_ed25519|kubeconfig)(?:\/|$)|\.config\/(?:gh|gcloud)(?:\/|$)|\.local\/share\/keyrings(?:\/|$)|[^/]*service-account[^/]*\.json$|[^/]*\.(?:jks|key|p12|pem|pfx|pkcs12)$)/i;
+/** Existing repository metadata that a materialization target must never own. */
+var RESERVED_TARGET_PATH_PATTERN = /(?:^|\/)\.git(?:\/|$)/i;
+/** Maximum normalized package-catalog description length. */
+var MAX_CATALOG_DESCRIPTION_LENGTH = 500;
+/** Maximum UTF-8 bytes parsed from one local package guide. */
+var MAX_GUIDE_BYTES = MAX_ARTIFACT_BYTES;
+/** Maximum filesystem entries accepted by one vendored-host traversal. */
+var MAX_HOST_ENTRIES = 4096;
+/** Maximum directory nesting accepted by one vendored-host traversal. */
+var MAX_HOST_DEPTH = 32;
+/** Maximum caller-controlled filesystem path depth accepted before filesystem work. */
+var MAX_FILESYSTEM_DEPTH = 64;
+/** Maximum UTF-8 bytes accepted in one portable filesystem path segment. */
+var MAX_PATH_SEGMENT_BYTES = 255;
+/** Windows device names that remain reserved even when followed by an extension. */
+var RESERVED_PATH_SEGMENT_PATTERN = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9]|conin\$|conout\$)(?:\..*)?$/i;
+/** Maximum simultaneous upstream requests accepted by `Sync`. */
+var MAX_SYNC_CONCURRENCY = 64;
+/** Default simultaneous upstream requests used by `Sync`. */
+var DEFAULT_SYNC_CONCURRENCY = 6;
+/** Maximum retry count accepted by `Sync`. */
+var MAX_SYNC_RETRIES = 5;
+/** Maximum per-request timeout accepted by `Sync`, in milliseconds. */
+var MAX_SYNC_TIMEOUT = 3e5;
+/** Default per-request timeout used by `Sync`, in milliseconds. */
+var DEFAULT_SYNC_TIMEOUT = 1e4;
+/** Maximum response body accepted by `Sync`, in bytes. */
+var MAX_SYNC_LIMIT = MAX_ARTIFACT_BYTES;
+/** Default per-response byte limit used by `Sync`. */
+var DEFAULT_SYNC_LIMIT = MAX_ARTIFACT_BYTES;
+/** Default maximum dependencies or catalog entries retained by one Sync operation. */
+var DEFAULT_SYNC_ITEMS = 256;
+/** Maximum configurable dependencies or catalog entries for one Sync operation. */
+var MAX_SYNC_ITEMS = 1e3;
+/** Default cumulative response bytes retained by one Sync operation. */
+var DEFAULT_SYNC_BUDGET = 16777216;
+/** Maximum configurable cumulative response bytes retained by one Sync operation. */
+var MAX_SYNC_BUDGET = 104857600;
+/** Maximum caller-supplied endpoint characters inspected before URL allocation. */
+var MAX_SYNC_BASE_LENGTH = 2048;
+/** Maximum portable Git branch characters accepted by the guide endpoint. */
+var MAX_SYNC_BRANCH_LENGTH = 255;
+/** Exact SHA-256 digest accepted by write preconditions. */
+var WRITE_DIGEST_PATTERN = /^[0-9a-f]{64}$/;
+/** Safe ASCII branch alphabet accepted before Git ref-component validation. */
+var SYNC_BRANCH_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+//#endregion
+//#region src/server/shapers.ts
+/** Build the closed upstream-guide endpoint options shape. */
+function syncGuideOptionsShape() {
+	return objectShape({
+		base: optionalShape(stringShape({
+			min: 1,
+			max: MAX_SYNC_BASE_LENGTH
+		})),
+		branch: optionalShape(stringShape({
+			min: 1,
+			max: 255
+		})),
+		timeout: optionalShape(integerShape({
+			min: 1,
+			max: MAX_SYNC_TIMEOUT
+		}))
+	});
+}
+/** Build the closed registry endpoint options shape. */
+function syncRegistryOptionsShape() {
+	return objectShape({
+		base: optionalShape(stringShape({
+			min: 1,
+			max: MAX_SYNC_BASE_LENGTH
+		})),
+		timeout: optionalShape(integerShape({
+			min: 1,
+			max: MAX_SYNC_TIMEOUT
+		}))
+	});
+}
+/** Build the closed data-only `SyncOptions` shape. */
+function syncOptionsShape() {
+	return objectShape({
+		guides: optionalShape(syncGuideOptionsShape()),
+		registry: optionalShape(syncRegistryOptionsShape()),
+		concurrency: optionalShape(integerShape({
+			min: 1,
+			max: 64
+		})),
+		retries: optionalShape(integerShape({
+			min: 0,
+			max: 5
+		})),
+		strict: optionalShape(booleanShape()),
+		limit: optionalShape(integerShape({
+			min: 1,
+			max: MAX_SYNC_LIMIT
+		})),
+		items: optionalShape(integerShape({
+			min: 1,
+			max: MAX_SYNC_ITEMS
+		})),
+		budget: optionalShape(integerShape({
+			min: 1,
+			max: MAX_SYNC_BUDGET
+		}))
+	});
+}
+/** Build the closed data-only `MaterializerOptions` shape. */
+function materializerOptionsShape() {
+	return objectShape({ host: optionalShape(stringShape({
+		min: 1,
+		max: MAX_PATH_LENGTH
+	})) });
+}
+//#endregion
+//#region src/server/contracts.ts
+/** The compiled, closed data-only `SyncOptions` contract. */
+var syncOptionsContract = createContract(syncOptionsShape());
+/** The compiled, closed data-only `MaterializerOptions` contract. */
+var materializerOptionsContract = createContract(materializerOptionsShape());
+//#endregion
+//#region src/server/validators.ts
+/** Narrow one exact aggregate fleet traversal allowance. */
+function isCatalogAllowance(value) {
+	const result = attempt(() => {
+		const bufferGetter = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Float64Array.prototype), "buffer")?.get;
+		if (bufferGetter === void 0 || !ArrayBuffer.isView(value) || !(value instanceof Float64Array) || !(Reflect.apply(bufferGetter, value, []) instanceof ArrayBuffer) || value.length !== 1) return false;
+		const remaining = value[0];
+		return remaining !== void 0 && Number.isSafeInteger(remaining) && remaining >= 0 && remaining <= 4096;
+	});
+	return result.success && result.value;
+}
+/**
+* Determine whether a value is a non-empty portable relative POSIX path.
+*
+* @param value - The candidate path.
+* @returns `true` when every path segment is safe and portable.
+*/
+function isPortablePath(value) {
+	if (!isString(value) || value.length === 0 || value.length > MAX_PATH_LENGTH) return false;
+	if (INVALID_PATH_CHARACTER_PATTERN.test(value) || CONTROL_CHARACTER_PATTERN.test(value)) return false;
+	const segments = value.split("/");
+	return segments.length <= 64 && !segments.some((segment) => segment === "" || segment === "." || segment === ".." || segment.endsWith(".") || segment.endsWith(" ") || contentByteLength(segment) > 255 || RESERVED_PATH_SEGMENT_PATTERN.test(segment));
+}
+/** Whether one host filesystem path is bounded, non-empty, and safe to render in a terminal. */
+function isFilesystemPath(value) {
+	if (!isString(value) || value.length === 0 || value.length > MAX_PATH_LENGTH || CONTROL_CHARACTER_PATTERN.test(value)) return false;
+	const normalized = value.replaceAll("\\", "/");
+	const withoutRoot = normalized.startsWith("//") ? normalized.slice(2) : normalized.startsWith("/") ? normalized.slice(1) : normalized;
+	if (withoutRoot.includes("//")) return false;
+	const segments = withoutRoot.split("/").filter((segment) => segment.length > 0);
+	if (segments.length > 64) return false;
+	return !segments.some((segment, index) => {
+		if (segment === "." || segment === "..") return false;
+		if (index === 0 && /^[A-Za-z]:$/u.test(segment)) return false;
+		return /[<>:"|?*]/u.test(segment) || segment.endsWith(".") || segment.endsWith(" ") || contentByteLength(segment) > 255 || RESERVED_PATH_SEGMENT_PATTERN.test(segment);
+	});
+}
+/** Whether one externally supplied string is safe to render in terminal or JSON diagnostics. */
+function isTerminalText(value) {
+	return isString(value) && !CONTROL_CHARACTER_PATTERN.test(value);
+}
+/** Whether one dependency is an exact data-property record safe to snapshot. */
+function isDependencyData(value) {
+	return hasOnlyDataProperties(value) && isDependency(value);
+}
+/**
+* Determine whether a host-relative path resembles local configuration or credentials.
+*
+* @param value - The portable candidate path.
+* @returns `true` when the path must be excluded from vendored host output.
+*/
+function isSensitiveHostPath(value) {
+	return SENSITIVE_HOST_PATH_PATTERN.test(value.replaceAll("\\", "/"));
+}
+/** Determine whether a target-relative path addresses preserved repository metadata. */
+function isReservedTargetPath(value) {
+	return RESERVED_TARGET_PATH_PATTERN.test(value.replaceAll("\\", "/"));
+}
+/** Whether a normalized catalog description is bounded and contains no controls. */
+function isCatalogDescription(value) {
+	return isString(value) && value.length <= 500 && !CONTROL_CHARACTER_PATTERN.test(value);
+}
+/**
+* Determine whether a caught filesystem error reports an absent path.
+*
+* @param value - The caught value.
+* @returns `true` only for an `Error` whose `code` is exactly `ENOENT`.
+*/
+function isMissingPathError(value) {
+	const result = attempt(() => isError(value) && Reflect.get(value, "code") === "ENOENT");
+	return result.success && result.value;
+}
+/** Narrow one exact transaction destination precondition. */
+function isWritePrecondition(value) {
+	const result = attempt(() => {
+		if (!isRecord(value)) return false;
+		const keys = Reflect.ownKeys(value);
+		if (keys.some((key) => key !== "path" && key !== "shape" && key !== "digest") || keys.length < 2 || keys.length > 3) return false;
+		const path = Reflect.getOwnPropertyDescriptor(value, "path");
+		const shape = Reflect.getOwnPropertyDescriptor(value, "shape");
+		const digest = Reflect.getOwnPropertyDescriptor(value, "digest");
+		if (path === void 0 || !Reflect.has(path, "value") || shape === void 0 || !Reflect.has(shape, "value") || digest !== void 0 && !Reflect.has(digest, "value") || !isPortablePath(path.value)) return false;
+		return shape.value === "absent" ? digest === void 0 : shape.value === "file" && digest !== void 0 && typeof digest.value === "string" && WRITE_DIGEST_PATTERN.test(digest.value);
+	});
+	return result.success && result.value;
+}
+/**
+* Narrow a value to one exact vendored-host manifest entry.
+*
+* @param value - The candidate raw manifest entry.
+* @returns `true` only for the exact safe entry shape.
+*/
+function isManifestEntry(value) {
+	const result = attempt(() => {
+		if (!isRecord(value)) return false;
+		const keys = Reflect.ownKeys(value);
+		const storage = Reflect.getOwnPropertyDescriptor(value, "storage");
+		const destination = Reflect.getOwnPropertyDescriptor(value, "destination");
+		const executable = Reflect.getOwnPropertyDescriptor(value, "executable");
+		return keys.length === 3 && keys.every((key) => key === "storage" || key === "destination" || key === "executable") && storage !== void 0 && Reflect.has(storage, "value") && destination !== void 0 && Reflect.has(destination, "value") && executable !== void 0 && Reflect.has(executable, "value") && isPortablePath(storage.value) && isPortablePath(destination.value) && typeof executable.value === "boolean";
+	});
+	return result.success && result.value;
+}
+/**
+* Narrow a value to one exact complete vendored-host manifest.
+*
+* @param value - The candidate manifest value.
+* @returns `true` only for an exact `{ entries, roots }` record with safe paths.
+*/
+function isHostManifest(value) {
+	const result = attempt(() => {
+		if (!isRecord(value)) return false;
+		const keys = Reflect.ownKeys(value);
+		const entries = Reflect.getOwnPropertyDescriptor(value, "entries");
+		const roots = Reflect.getOwnPropertyDescriptor(value, "roots");
+		return keys.length === 2 && keys.every((key) => key === "entries" || key === "roots") && entries !== void 0 && Reflect.has(entries, "value") && roots !== void 0 && Reflect.has(roots, "value") && isDenseDataArray(entries.value, 4096, isManifestEntry) && isDenseDataArray(roots.value, 4096, isPortablePath);
+	});
+	return result.success && result.value;
+}
+/** Narrow an exact initial-listener record for `Sync`. */
+function isSyncEventHooks(value) {
+	const result = attempt(() => {
+		if (!isRecord(value)) return false;
+		const keys = Reflect.ownKeys(value);
+		if (keys.some((key) => key !== "guide" && key !== "version" && key !== "package" && key !== "write" && key !== "done" && key !== "error" && key !== "destroy")) return false;
+		return keys.every((key) => {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+			return descriptor !== void 0 && Reflect.has(descriptor, "value") && isFunction(descriptor.value);
+		});
+	});
+	return result.success && result.value;
+}
+/** Narrow an exact initial-listener record for `Materializer`. */
+function isMaterializerEventHooks(value) {
+	const result = attempt(() => {
+		if (!isRecord(value)) return false;
+		const keys = Reflect.ownKeys(value);
+		if (keys.some((key) => key !== "copy" && key !== "write" && key !== "remove" && key !== "done" && key !== "error" && key !== "destroy")) return false;
+		return keys.every((key) => {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+			return descriptor !== void 0 && Reflect.has(descriptor, "value") && isFunction(descriptor.value);
+		});
+	});
+	return result.success && result.value;
+}
+//#endregion
+//#region src/server/parsers.ts
+/** Parse and semantically validate dependency data before Sync performs network I/O. */
+function parseSyncDependencies(value, external) {
+	const owned = attempt(() => {
+		if (!isDenseDataArray(value, 1e3, isDependencyData)) throw new Error("dependencies are malformed");
+		const length = Reflect.getOwnPropertyDescriptor(value, "length")?.value;
+		if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > 1e3) throw new Error("dependency length is malformed");
+		const dependencies = [];
+		for (let index = 0; index < length; index += 1) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+			if (descriptor === void 0 || !Reflect.has(descriptor, "value") || !isDependencyData(descriptor.value)) throw new Error("dependency is malformed");
+			const name = Reflect.getOwnPropertyDescriptor(descriptor.value, "name")?.value;
+			const range = Reflect.getOwnPropertyDescriptor(descriptor.value, "range")?.value;
+			const optional = Reflect.getOwnPropertyDescriptor(descriptor.value, "optional")?.value;
+			if (typeof name !== "string" || typeof range !== "string" || optional !== void 0 && typeof optional !== "boolean") throw new Error("dependency is malformed");
+			dependencies.push(Object.freeze({
+				name,
+				range,
+				...optional === void 0 ? {} : { optional }
+			}));
+		}
+		return Object.freeze(dependencies);
+	});
+	if (!owned.success) throw new ScaffoldError("INVALID", "Sync dependencies are malformed", { error: owned.error });
+	const snapshot = owned.value;
+	const validation = validateDependencyArray(external ? "extras" : "dependencies", snapshot);
+	if (validation.questions.length > 0) throw new ScaffoldError("INVALID", "Sync dependencies are invalid", { questions: validation.questions });
+	return snapshot;
+}
+/** Parse a bounded dense array of host filesystem paths without invoking caller methods. */
+function parseFilesystemPaths(value, limit) {
+	const parsed = attempt(() => {
+		if (!Number.isSafeInteger(limit) || limit < 0 || !isDenseDataArray(value, limit, isFilesystemPath)) return;
+		const length = Reflect.getOwnPropertyDescriptor(value, "length")?.value;
+		if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > limit) return;
+		const paths = [];
+		for (let index = 0; index < length; index += 1) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+			if (descriptor === void 0 || !Reflect.has(descriptor, "value") || !isFilesystemPath(descriptor.value)) return;
+			paths.push(descriptor.value);
+		}
+		return Object.freeze(paths);
+	});
+	return parsed.success ? parsed.value : void 0;
+}
+/** Parse a bounded dense array of portable paths without invoking caller methods. */
+function parsePortablePaths(value, limit) {
+	const parsed = attempt(() => {
+		if (!Number.isSafeInteger(limit) || limit < 0 || !isDenseDataArray(value, limit, isPortablePath)) return;
+		const length = Reflect.getOwnPropertyDescriptor(value, "length")?.value;
+		if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > limit) return;
+		const paths = [];
+		for (let index = 0; index < length; index += 1) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+			if (descriptor === void 0 || !Reflect.has(descriptor, "value") || !isPortablePath(descriptor.value)) return;
+			paths.push(descriptor.value);
+		}
+		return Object.freeze(paths);
+	});
+	return parsed.success ? parsed.value : void 0;
+}
+/** Parse bounded exact transaction preconditions without invoking caller methods. */
+function parseWritePreconditions(value, limit) {
+	const parsed = attempt(() => {
+		if (!Number.isSafeInteger(limit) || limit < 0 || !isDenseDataArray(value, limit, isWritePrecondition)) return;
+		const length = Reflect.getOwnPropertyDescriptor(value, "length")?.value;
+		if (typeof length !== "number" || !Number.isSafeInteger(length) || length < 0 || length > limit) return;
+		const preconditions = [];
+		for (let index = 0; index < length; index += 1) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+			if (descriptor === void 0 || !Reflect.has(descriptor, "value") || !isWritePrecondition(descriptor.value)) return;
+			const precondition = descriptor.value;
+			const path = Reflect.getOwnPropertyDescriptor(precondition, "path")?.value;
+			const shape = Reflect.getOwnPropertyDescriptor(precondition, "shape")?.value;
+			const digest = Reflect.getOwnPropertyDescriptor(precondition, "digest")?.value;
+			if (typeof path !== "string") return void 0;
+			if (shape === "absent" && digest === void 0) {
+				const copy = {
+					path,
+					shape
+				};
+				if (!isWritePrecondition(copy)) return void 0;
+				preconditions.push(Object.freeze(copy));
+				continue;
+			}
+			if (shape !== "file" || typeof digest !== "string") return void 0;
+			const copy = {
+				path,
+				shape,
+				digest
+			};
+			if (!isWritePrecondition(copy)) return void 0;
+			preconditions.push(Object.freeze(copy));
+		}
+		return Object.freeze(preconditions);
+	});
+	return parsed.success ? parsed.value : void 0;
+}
+/** Parse and normalize one upstream HTTP(S) endpoint base. */
+function parseSyncBase(value) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 2048 || value !== value.trim() || /^[A-Za-z][A-Za-z0-9+.-]*:\/\//i.test(value) && !/^https?:\/\//i.test(value)) throw new ScaffoldError("INVALID", "Invalid Sync endpoint base", { value });
+	const normalized = /^https?:\/\//i.test(value) ? value : `https://${value}`;
+	const parsed = attempt(() => new URL(normalized));
+	if (!parsed.success || parsed.value.protocol !== "http:" && parsed.value.protocol !== "https:" || parsed.value.username.length > 0 || parsed.value.password.length > 0 || parsed.value.search.length > 0 || parsed.value.hash.length > 0 || parsed.value.protocol === "http:" && ![
+		"127.0.0.1",
+		"[::1]",
+		"localhost"
+	].includes(parsed.value.hostname.toLowerCase())) throw new ScaffoldError("INVALID", "Invalid Sync endpoint base", { value });
+	const base = parsed.value.href.replace(/\/+$/, "");
+	if (base.length > 2048) throw new ScaffoldError("INVALID", "Invalid Sync endpoint base", { value });
+	return base;
+}
+/**
+* Snapshot only declared guide references while enforcing per-file and cumulative byte limits.
+*
+* @param value - The caller-supplied guide content map.
+* @param names - Exact dependency names eligible for selection.
+* @param budget - Maximum cumulative UTF-8 bytes.
+* @returns A frozen selected map, or `undefined` when no map was supplied.
+*/
+function parseSyncCurrent(value, names, budget) {
+	if (value === void 0) return void 0;
+	const snapshot = attempt(() => {
+		if (!isRecord(value)) throw new Error("current must be a plain record");
+		const selected = {};
+		let consumed = 0;
+		for (const name of names) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(value, name);
+			if (descriptor === void 0) continue;
+			if (!Reflect.has(descriptor, "value") || typeof descriptor.value !== "string") throw new Error("current values must be string data properties");
+			const bytes = contentByteLength(descriptor.value);
+			consumed += bytes;
+			if (bytes > MAX_ARTIFACT_BYTES || consumed > budget) throw new Error("current guide content exceeds its byte allowance");
+			selected[name] = descriptor.value;
+		}
+		return Object.freeze(selected);
+	});
+	if (!snapshot.success) throw new ScaffoldError("INVALID", "Sync current guides are malformed", { error: snapshot.error });
+	return snapshot.value;
+}
+/** Parse a safe Git branch path for the canonical raw-guide URL. */
+function parseSyncBranch(value) {
+	const segments = typeof value === "string" ? value.split("/") : [];
+	if (typeof value !== "string" || value.length === 0 || value.length > 255 || !SYNC_BRANCH_PATTERN.test(value) || value.includes("..") || value.includes("@{") || value === "@" || segments.some((segment) => segment === "" || segment.startsWith(".") || segment.endsWith(".") || /\.lock$/iu.test(segment))) throw new ScaffoldError("INVALID", "Invalid Sync guide branch", { value });
+	return value;
+}
+/** Parse exact materializer options before allocating its emitter. */
+function parseMaterializerOptions(value) {
+	if (value === void 0) return {};
+	const read = attempt(() => {
+		if (!isRecord(value)) throw new Error("options must be a plain record");
+		const keys = Reflect.ownKeys(value);
+		if (keys.some((key) => key !== "host" && key !== "on" && key !== "error")) throw new Error("options contain an unknown key");
+		if (keys.map((key) => Reflect.getOwnPropertyDescriptor(value, key)).some((descriptor) => descriptor === void 0 || !Reflect.has(descriptor, "value"))) throw new Error("options must use data properties");
+		return {
+			host: Reflect.getOwnPropertyDescriptor(value, "host")?.value,
+			on: Reflect.getOwnPropertyDescriptor(value, "on")?.value,
+			error: Reflect.getOwnPropertyDescriptor(value, "error")?.value
+		};
+	});
+	if (!read.success) throw new ScaffoldError("INVALID", "Materializer options are malformed", { error: read.error });
+	const parsed = materializerOptionsContract.parse({ ...read.value.host === void 0 ? {} : { host: read.value.host } });
+	if (parsed === void 0 || parsed.host !== void 0 && !isFilesystemPath(parsed.host)) throw new ScaffoldError("INVALID", "Materializer host is malformed");
+	if (read.value.on !== void 0 && !isMaterializerEventHooks(read.value.on)) throw new ScaffoldError("INVALID", "Materializer event hooks are malformed");
+	const ownedHooks = attempt(() => {
+		const sourceHooks = read.value.on;
+		if (sourceHooks === void 0) return void 0;
+		if (typeof sourceHooks !== "object" || sourceHooks === null) throw new Error("event hooks are malformed");
+		const copy = Reflect.getOwnPropertyDescriptor(sourceHooks, "copy")?.value;
+		const write = Reflect.getOwnPropertyDescriptor(sourceHooks, "write")?.value;
+		const remove = Reflect.getOwnPropertyDescriptor(sourceHooks, "remove")?.value;
+		const done = Reflect.getOwnPropertyDescriptor(sourceHooks, "done")?.value;
+		const error = Reflect.getOwnPropertyDescriptor(sourceHooks, "error")?.value;
+		const destroy = Reflect.getOwnPropertyDescriptor(sourceHooks, "destroy")?.value;
+		if (copy !== void 0 && !isFunction(copy) || write !== void 0 && !isFunction(write) || remove !== void 0 && !isFunction(remove) || done !== void 0 && !isFunction(done) || error !== void 0 && !isFunction(error) || destroy !== void 0 && !isFunction(destroy)) throw new Error("event hooks are malformed");
+		return Object.freeze({
+			...copy === void 0 ? {} : { copy },
+			...write === void 0 ? {} : { write },
+			...remove === void 0 ? {} : { remove },
+			...done === void 0 ? {} : { done },
+			...error === void 0 ? {} : { error },
+			...destroy === void 0 ? {} : { destroy }
+		});
+	});
+	if (!ownedHooks.success) throw new ScaffoldError("INVALID", "Materializer event hooks are malformed", { error: ownedHooks.error });
+	const on = ownedHooks.value;
+	if (read.value.error !== void 0 && !isEmitterErrorHandler(read.value.error)) throw new ScaffoldError("INVALID", "Materializer error handler is malformed");
+	return {
+		...parsed.host === void 0 ? {} : { host: parsed.host },
+		...on === void 0 ? {} : { on },
+		...read.value.error === void 0 ? {} : { error: read.value.error }
+	};
+}
+/**
+* Parse the exact bounded `SyncOptions` boundary before allocating resources.
+*
+* @param value - Caller-supplied options.
+* @returns A fresh, validated options record.
+*/
+function parseSyncOptions(value) {
+	if (value === void 0) return {};
+	const read = attempt(() => {
+		if (!isRecord(value)) throw new Error("options must be a plain record");
+		const keys = Reflect.ownKeys(value);
+		if (keys.some((key) => key !== "guides" && key !== "registry" && key !== "concurrency" && key !== "retries" && key !== "strict" && key !== "limit" && key !== "items" && key !== "budget" && key !== "on" && key !== "error")) throw new Error("options contain an unknown key");
+		if (keys.map((key) => Reflect.getOwnPropertyDescriptor(value, key)).some((descriptor) => descriptor === void 0 || !Reflect.has(descriptor, "value"))) throw new Error("options must use data properties");
+		return {
+			guides: Reflect.getOwnPropertyDescriptor(value, "guides")?.value,
+			registry: Reflect.getOwnPropertyDescriptor(value, "registry")?.value,
+			concurrency: Reflect.getOwnPropertyDescriptor(value, "concurrency")?.value,
+			retries: Reflect.getOwnPropertyDescriptor(value, "retries")?.value,
+			strict: Reflect.getOwnPropertyDescriptor(value, "strict")?.value,
+			limit: Reflect.getOwnPropertyDescriptor(value, "limit")?.value,
+			items: Reflect.getOwnPropertyDescriptor(value, "items")?.value,
+			budget: Reflect.getOwnPropertyDescriptor(value, "budget")?.value,
+			on: Reflect.getOwnPropertyDescriptor(value, "on")?.value,
+			error: Reflect.getOwnPropertyDescriptor(value, "error")?.value
+		};
+	});
+	if (!read.success) throw new ScaffoldError("INVALID", "Sync options are malformed", { error: read.error });
+	const nested = attempt(() => {
+		let guides;
+		if (read.value.guides !== void 0) {
+			const source = read.value.guides;
+			if (!isRecord(source)) throw new Error("guides must be a plain record");
+			const keys = Reflect.ownKeys(source);
+			if (keys.some((key) => key !== "base" && key !== "branch" && key !== "timeout")) throw new Error("guides contain an unknown key");
+			if (keys.map((key) => Reflect.getOwnPropertyDescriptor(source, key)).some((descriptor) => descriptor === void 0 || !Reflect.has(descriptor, "value"))) throw new Error("guides must use data properties");
+			guides = {
+				base: Reflect.getOwnPropertyDescriptor(source, "base")?.value,
+				branch: Reflect.getOwnPropertyDescriptor(source, "branch")?.value,
+				timeout: Reflect.getOwnPropertyDescriptor(source, "timeout")?.value
+			};
+		}
+		let registry;
+		if (read.value.registry !== void 0) {
+			const source = read.value.registry;
+			if (!isRecord(source)) throw new Error("registry must be a plain record");
+			const keys = Reflect.ownKeys(source);
+			if (keys.some((key) => key !== "base" && key !== "timeout")) throw new Error("registry contains an unknown key");
+			if (keys.map((key) => Reflect.getOwnPropertyDescriptor(source, key)).some((descriptor) => descriptor === void 0 || !Reflect.has(descriptor, "value"))) throw new Error("registry must use data properties");
+			registry = {
+				base: Reflect.getOwnPropertyDescriptor(source, "base")?.value,
+				timeout: Reflect.getOwnPropertyDescriptor(source, "timeout")?.value
+			};
+		}
+		return {
+			guides,
+			registry
+		};
+	});
+	if (!nested.success) throw new ScaffoldError("INVALID", "Sync endpoint options are malformed", { error: nested.error });
+	const configuration = {
+		...nested.value.guides === void 0 ? {} : { guides: nested.value.guides },
+		...nested.value.registry === void 0 ? {} : { registry: nested.value.registry },
+		...read.value.concurrency === void 0 ? {} : { concurrency: read.value.concurrency },
+		...read.value.retries === void 0 ? {} : { retries: read.value.retries },
+		...read.value.strict === void 0 ? {} : { strict: read.value.strict },
+		...read.value.limit === void 0 ? {} : { limit: read.value.limit },
+		...read.value.items === void 0 ? {} : { items: read.value.items },
+		...read.value.budget === void 0 ? {} : { budget: read.value.budget }
+	};
+	const parsed = syncOptionsContract.parse(configuration);
+	if (parsed === void 0) throw new ScaffoldError("INVALID", "Sync options are malformed");
+	if (read.value.on !== void 0 && !isSyncEventHooks(read.value.on)) throw new ScaffoldError("INVALID", "Sync event hooks are malformed");
+	const ownedHooks = attempt(() => {
+		const sourceHooks = read.value.on;
+		if (sourceHooks === void 0) return void 0;
+		if (typeof sourceHooks !== "object" || sourceHooks === null) throw new Error("event hooks are malformed");
+		const guide = Reflect.getOwnPropertyDescriptor(sourceHooks, "guide")?.value;
+		const version = Reflect.getOwnPropertyDescriptor(sourceHooks, "version")?.value;
+		const packageListener = Reflect.getOwnPropertyDescriptor(sourceHooks, "package")?.value;
+		const write = Reflect.getOwnPropertyDescriptor(sourceHooks, "write")?.value;
+		const done = Reflect.getOwnPropertyDescriptor(sourceHooks, "done")?.value;
+		const error = Reflect.getOwnPropertyDescriptor(sourceHooks, "error")?.value;
+		const destroy = Reflect.getOwnPropertyDescriptor(sourceHooks, "destroy")?.value;
+		if (guide !== void 0 && !isFunction(guide) || version !== void 0 && !isFunction(version) || packageListener !== void 0 && !isFunction(packageListener) || write !== void 0 && !isFunction(write) || done !== void 0 && !isFunction(done) || error !== void 0 && !isFunction(error) || destroy !== void 0 && !isFunction(destroy)) throw new Error("event hooks are malformed");
+		return Object.freeze({
+			...guide === void 0 ? {} : { guide },
+			...version === void 0 ? {} : { version },
+			...packageListener === void 0 ? {} : { package: packageListener },
+			...write === void 0 ? {} : { write },
+			...done === void 0 ? {} : { done },
+			...error === void 0 ? {} : { error },
+			...destroy === void 0 ? {} : { destroy }
+		});
+	});
+	if (!ownedHooks.success) throw new ScaffoldError("INVALID", "Sync event hooks are malformed", { error: ownedHooks.error });
+	const on = ownedHooks.value;
+	if (read.value.error !== void 0 && !isEmitterErrorHandler(read.value.error)) throw new ScaffoldError("INVALID", "Sync error handler is malformed");
+	const guides = parsed.guides === void 0 ? void 0 : {
+		...parsed.guides.base === void 0 ? {} : { base: parseSyncBase(parsed.guides.base) },
+		...parsed.guides.branch === void 0 ? {} : { branch: parseSyncBranch(parsed.guides.branch) },
+		...parsed.guides.timeout === void 0 ? {} : { timeout: parsed.guides.timeout }
+	};
+	const registry = parsed.registry === void 0 ? void 0 : {
+		...parsed.registry.base === void 0 ? {} : { base: parseSyncBase(parsed.registry.base) },
+		...parsed.registry.timeout === void 0 ? {} : { timeout: parsed.registry.timeout }
+	};
+	return {
+		...guides === void 0 ? {} : { guides },
+		...registry === void 0 ? {} : { registry },
+		...parsed.concurrency === void 0 ? {} : { concurrency: parsed.concurrency },
+		...parsed.retries === void 0 ? {} : { retries: parsed.retries },
+		...parsed.strict === void 0 ? {} : { strict: parsed.strict },
+		...parsed.limit === void 0 ? {} : { limit: parsed.limit },
+		...parsed.items === void 0 ? {} : { items: parsed.items },
+		...parsed.budget === void 0 ? {} : { budget: parsed.budget },
+		...on === void 0 ? {} : { on },
+		...read.value.error === void 0 ? {} : { error: read.value.error }
+	};
+}
+//#endregion
+//#region src/server/WriteTransaction.ts
+/**
+* Nominal, same-volume write-transaction state. Construction derives every
+* filesystem path from a target and portable relative paths; callers cannot
+* supply a deletion root or mutate captured arrays.
+*/
+var WriteTransaction = class WriteTransaction {
+	static #token = Object.freeze({});
+	#target;
+	#root;
+	#stage;
+	#backup;
+	#expectations;
+	#parents;
+	#directories;
+	#anchor;
+	#existing;
+	constructor(token, target, root, stage, backup, expectations, parents, directories, anchor, existing) {
+		if (token !== WriteTransaction.#token) throw new ScaffoldError("WRITE", "WriteTransaction must be created through create()");
+		this.#target = target;
+		this.#root = root;
+		this.#stage = stage;
+		this.#backup = backup;
+		this.#expectations = Object.freeze([...expectations]);
+		this.#parents = Object.freeze(parents.map((parent) => Object.freeze({ ...parent })));
+		this.#directories = Object.freeze(directories.map((directory) => Object.freeze({ ...directory })));
+		this.#anchor = Object.freeze({ ...anchor });
+		this.#existing = existing === void 0 ? void 0 : Object.freeze({ ...existing });
+	}
+	/** Create private staging state and snapshot every destination before mutation. */
+	static create(target, paths, preconditions) {
+		if (!isFilesystemPath(target)) throw new ScaffoldError("WRITE", "Write transaction target is malformed", { target });
+		const resolvedTarget = resolve(target);
+		const requested = parsePortablePaths(paths, MAX_COLLECTION_ITEMS);
+		if (requested === void 0) throw new ScaffoldError("WRITE", "Write transaction paths are malformed", { target: resolvedTarget });
+		const conditions = preconditions === void 0 ? void 0 : parseWritePreconditions(preconditions, MAX_COLLECTION_ITEMS);
+		if (preconditions !== void 0 && conditions === void 0) throw new ScaffoldError("WRITE", "Write transaction preconditions are malformed", { target: resolvedTarget });
+		const conflict = findFileConflict(requested);
+		if (conflict !== void 0) throw new ScaffoldError("WRITE", `Write transaction collision between "${conflict[0]}" and "${conflict[1]}"`, {
+			paths: conflict,
+			committed: false
+		});
+		if (conditions !== void 0 && (conditions.length !== requested.length || requested.some((path) => !conditions.some((condition) => condition.path === path)) || conditions.some((condition) => !isPortablePath(condition.path) || condition.shape === "file" && (condition.digest === void 0 || !WRITE_DIGEST_PATTERN.test(condition.digest)) || condition.shape === "absent" && condition.digest !== void 0))) throw new ScaffoldError("WRITE", "Write transaction preconditions are malformed", { paths: requested });
+		const parent = dirname(resolvedTarget);
+		const missingParents = [];
+		let ancestor = parent;
+		let anchor;
+		while (anchor === void 0) {
+			const status = attempt(() => lstatSync(ancestor));
+			if (status.success) {
+				if (!status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError("WRITE", "Write transaction parent is not a real directory", {
+					target: resolvedTarget,
+					parent: ancestor
+				});
+				anchor = Object.freeze({
+					path: ancestor,
+					device: status.value.dev,
+					inode: status.value.ino
+				});
+				break;
+			}
+			if (!isMissingPathError(status.error)) throw new ScaffoldError("WRITE", "Failed to inspect write transaction parent", {
+				target: resolvedTarget,
+				parent: ancestor,
+				error: status.error
+			});
+			missingParents.push(ancestor);
+			const next = dirname(ancestor);
+			if (next === ancestor) throw new ScaffoldError("WRITE", "Write transaction has no existing parent", { target: resolvedTarget });
+			ancestor = next;
+		}
+		const targetStatus = attempt(() => lstatSync(resolvedTarget));
+		const existing = targetStatus.success && targetStatus.value.isDirectory() && !targetStatus.value.isSymbolicLink() ? Object.freeze({
+			path: resolvedTarget,
+			device: targetStatus.value.dev,
+			inode: targetStatus.value.ino
+		}) : void 0;
+		if (!targetStatus.success && !isMissingPathError(targetStatus.error)) throw new ScaffoldError("WRITE", "Failed to inspect write transaction target", {
+			target: resolvedTarget,
+			error: targetStatus.error
+		});
+		if (targetStatus.success && existing === void 0) throw new ScaffoldError("WRITE", "Write transaction target is not a real directory", { target: resolvedTarget });
+		const expectations = [];
+		for (const path of requested) {
+			if (!isPortablePath(path)) throw new ScaffoldError("WRITE", `Invalid transaction path at ${path}`, { path });
+			const precondition = conditions?.find((condition) => condition.path === path);
+			const destination = resolvePhysicalPath(resolvedTarget, path, "WRITE", "target");
+			const current = attempt(() => lstatSync(destination));
+			if (!current.success) {
+				if (!isMissingPathError(current.error)) throw new ScaffoldError("WRITE", `Failed to inspect transaction destination at ${path}`, {
+					path,
+					error: current.error
+				});
+				if (precondition?.shape === "file") throw new ScaffoldError("WRITE", `Write precondition changed at ${path}`, { path });
+				expectations.push(Object.freeze({
+					path,
+					shape: "absent"
+				}));
+				continue;
+			}
+			if (current.value.isSymbolicLink() || current.value.isFile() && current.value.nlink !== 1 || !current.value.isFile() && !current.value.isDirectory()) throw new ScaffoldError("WRITE", `Unsafe transaction destination at ${path}`, { path });
+			if (current.value.isDirectory()) {
+				if (precondition !== void 0) throw new ScaffoldError("WRITE", `Write precondition changed at ${path}`, { path });
+				expectations.push(Object.freeze({
+					path,
+					shape: "directory",
+					device: current.value.dev,
+					inode: current.value.ino,
+					modified: current.value.mtimeMs,
+					size: current.value.size
+				}));
+				continue;
+			}
+			const content = attempt(() => digestFile(destination));
+			if (!content.success) throw new ScaffoldError("WRITE", `Failed to snapshot transaction destination at ${path}`, {
+				path,
+				error: content.error
+			});
+			if (precondition?.shape === "absent" || precondition?.shape === "file" && precondition.digest !== content.value) throw new ScaffoldError("WRITE", `Write precondition changed at ${path}`, { path });
+			expectations.push(Object.freeze({
+				path,
+				shape: "file",
+				device: current.value.dev,
+				inode: current.value.ino,
+				modified: current.value.mtimeMs,
+				size: current.value.size,
+				digest: content.value
+			}));
+		}
+		const token = randomUUID();
+		const root = join(parent, `.${basename(resolvedTarget)}.write-${token}`);
+		const stage = join(root, "stage");
+		const backup = join(root, "backup");
+		const parents = [];
+		const directories = [];
+		const created = attempt(() => {
+			const anchored = lstatSync(anchor.path);
+			if (!anchored.isDirectory() || anchored.isSymbolicLink() || anchored.dev !== anchor.device || anchored.ino !== anchor.inode) throw new Error("write transaction anchor changed");
+			for (const directory of [...missingParents].reverse()) {
+				mkdirSync(directory);
+				const status = lstatSync(directory);
+				if (!status.isDirectory() || status.isSymbolicLink()) throw new Error(`write transaction parent changed at ${directory}`);
+				parents.push(Object.freeze({
+					path: directory,
+					device: status.dev,
+					inode: status.ino
+				}));
+			}
+			mkdirSync(root, { mode: 448 });
+			const rootStatus = lstatSync(root);
+			if (!rootStatus.isDirectory() || rootStatus.isSymbolicLink()) throw new Error("write transaction root is not a real directory");
+			directories.push(Object.freeze({
+				path: root,
+				device: rootStatus.dev,
+				inode: rootStatus.ino
+			}));
+			mkdirSync(stage, { mode: 448 });
+			const stageStatus = lstatSync(stage);
+			if (!stageStatus.isDirectory() || stageStatus.isSymbolicLink()) throw new Error("write transaction stage is not a real directory");
+			directories.push(Object.freeze({
+				path: stage,
+				device: stageStatus.dev,
+				inode: stageStatus.ino
+			}));
+			mkdirSync(backup, { mode: 448 });
+			const backupStatus = lstatSync(backup);
+			if (!backupStatus.isDirectory() || backupStatus.isSymbolicLink()) throw new Error("write transaction backup is not a real directory");
+			directories.push(Object.freeze({
+				path: backup,
+				device: backupStatus.dev,
+				inode: backupStatus.ino
+			}));
+			for (const directory of [...parents, ...directories]) {
+				const status = lstatSync(directory.path);
+				if (!status.isDirectory() || status.isSymbolicLink() || status.dev !== directory.device || status.ino !== directory.inode) throw new Error(`write transaction directory changed at ${directory.path}`);
+			}
+		});
+		if (!created.success) {
+			if (attempt(() => {
+				for (const directory of directories) {
+					const status = lstatSync(directory.path);
+					if (!status.isDirectory() || status.isSymbolicLink() || status.dev !== directory.device || status.ino !== directory.inode) throw new Error(`write transaction directory changed at ${directory.path}`);
+				}
+				if (directories.length > 0) rmSync(root, { recursive: true });
+			}).success) for (const directory of [...parents].reverse()) attempt(() => {
+				const status = lstatSync(directory.path);
+				if (!status.isDirectory() || status.isSymbolicLink() || status.dev !== directory.device || status.ino !== directory.inode) throw new Error(`write transaction parent changed at ${directory.path}`);
+				rmdirSync(directory.path);
+			});
+			throw new ScaffoldError("WRITE", "Failed to create write transaction", {
+				target: resolvedTarget,
+				root,
+				error: created.error
+			});
+		}
+		return new WriteTransaction(WriteTransaction.#token, resolvedTarget, root, stage, backup, expectations, parents, directories, anchor, existing);
+	}
+	get target() {
+		return this.#target;
+	}
+	get root() {
+		return this.#root;
+	}
+	get stage() {
+		return this.#stage;
+	}
+	get backup() {
+		return this.#backup;
+	}
+	get expectations() {
+		return this.#expectations;
+	}
+	get parents() {
+		return this.#parents;
+	}
+	get directories() {
+		return this.#directories;
+	}
+	get anchor() {
+		return this.#anchor;
+	}
+	get existing() {
+		return this.#existing;
+	}
+};
+//#endregion
 //#region src/server/helpers.ts
 /**
-* Locate this MODULE's own installed package root — the nearest ancestor of
-* `import.meta.url` holding a `package.json` — and return its vendored
-* `dist/host` data root. THE single source of truth for the default
-* `Materializer` / `scaffold` bin host: once installed, walking up from the
-* module's own file (not `process.cwd()`, which points at whichever project
-* happens to be running) resolves to `node_modules/@orkestrel/scaffold`, the
-* correct default host — the package ships its vendored data with itself.
-* `dist/host` may not exist yet when this resolves from SOURCE under a test
-* runner; that is fine — existence is checked at the point of use, not here.
+* Whether a path is an existing physical directory rather than a file or link.
+*
+* @param path - The filesystem path to inspect without following links.
+* @returns `true` only for a successful `lstat` reporting a directory.
+*/
+function isRealDirectory(path) {
+	const status = attempt(() => lstatSync(path).isDirectory());
+	return status.success && status.value;
+}
+/**
+* Compute a bounded-memory SHA-256 digest for one file.
+*
+* @param path - The file to read.
+* @returns Its lowercase SHA-256 digest.
+*/
+function digestFile(path) {
+	const initial = lstatSync(path);
+	if (!initial.isFile() || initial.isSymbolicLink() || initial.nlink !== 1) throw new Error(`Digest source is not a physical file at ${path}`);
+	if (initial.size > MAX_ARTIFACT_BYTES) throw new Error(`Digest source exceeds ${MAX_ARTIFACT_BYTES} bytes at ${path}`);
+	const handle = openSync(path, "r");
+	const hash = createHash("sha256");
+	const buffer = Buffer.allocUnsafe(65536);
+	const read = attempt(() => {
+		const current = fstatSync(handle);
+		if (!current.isFile() || current.nlink !== 1 || current.dev !== initial.dev || current.ino !== initial.ino) throw new Error(`Digest source changed before reading at ${path}`);
+		let size = 0;
+		for (;;) {
+			const length = readSync(handle, buffer, 0, buffer.byteLength, null);
+			if (length === 0) break;
+			size += length;
+			if (size > MAX_ARTIFACT_BYTES) throw new Error(`Digest source exceeds ${MAX_ARTIFACT_BYTES} bytes at ${path}`);
+			hash.update(buffer.subarray(0, length));
+		}
+		const after = fstatSync(handle);
+		const pathStatus = lstatSync(path);
+		if (size !== current.size || after.dev !== current.dev || after.ino !== current.ino || after.mtimeMs !== current.mtimeMs || after.size !== current.size || !pathStatus.isFile() || pathStatus.isSymbolicLink() || pathStatus.nlink !== 1 || pathStatus.dev !== current.dev || pathStatus.ino !== current.ino) throw new Error(`Digest source changed while reading at ${path}`);
+		return hash.digest("hex");
+	});
+	const closed = attempt(() => closeSync(handle));
+	if (!read.success) throw read.error;
+	if (!closed.success) throw closed.error;
+	return read.value;
+}
+/**
+* Compute SHA-256 from exact lowercase hexadecimal bytes without decoding the whole value at once.
+*
+* @param hex - Exact hexadecimal bytes.
+* @returns Their lowercase SHA-256 digest.
+*/
+function digestHex(hex) {
+	if (hex.length > MAX_ARTIFACT_HEX_LENGTH || !HEX_PATTERN.test(hex)) throw new Error("Digest input is not bounded exact hexadecimal bytes");
+	const hash = createHash("sha256");
+	for (let offset = 0; offset < hex.length; offset += 131072) hash.update(Buffer.from(hex.slice(offset, offset + 131072), "hex"));
+	return hash.digest("hex");
+}
+/**
+* Compute SHA-256 from UTF-8 text.
+*
+* @param value - The text to hash.
+* @returns Its lowercase SHA-256 digest.
+*/
+function digestText(value) {
+	return createHash("sha256").update(value, "utf8").digest("hex");
+}
+/**
+* Render the local pointer written when an upstream dependency guide is not vendored yet.
+*
+* @param source - The canonical `guides/src/<name>.md` source path.
+* @returns The deterministic pointer content.
+*/
+function guideStub(source) {
+	return `> Vendored guide for @orkestrel/${source.slice(11, source.length - 3)} — run \`scaffold pull\` to fetch it.\n`;
+}
+/**
+* Remove the canonical Orkestrel scope from a dependency name.
+*
+* @param name - A dependency name.
+* @returns Its unscoped member when canonical, otherwise the original name.
+*/
+function packageShortName(name) {
+	return name.startsWith("@orkestrel/") ? name.slice(11) : name;
+}
+/**
+* Read bounded physical local guide mirrors for declared dependencies.
+*
+* @param target - The package root.
+* @param dependencies - The declared dependencies whose mirrors are eligible.
+* @returns Existing guide content keyed by dependency name.
+*/
+function readGuideReferences(target, dependencies) {
+	const current = {};
+	for (const dependency of dependencies) {
+		const path = `guides/src/${packageShortName(dependency.name)}.md`;
+		const full = resolvePhysicalPath(target, path, "TARGET", "target");
+		const status = attempt(() => lstatSync(full));
+		if (!status.success) {
+			if (isMissingPathError(status.error)) continue;
+			throw new ScaffoldError("TARGET", `Failed to inspect local guide at ${path}`, {
+				path,
+				error: status.error
+			});
+		}
+		if (!status.value.isFile() || status.value.isSymbolicLink() || status.value.nlink !== 1) throw new ScaffoldError("TARGET", `Local guide is not a physical file at ${path}`, { path });
+		current[dependency.name] = readFileText(target, path, "TARGET", "target");
+	}
+	return Object.freeze(current);
+}
+/**
+* Assemble one synchronization report from already ordered guide and version outcomes.
+*
+* @param target - The target package root.
+* @param guides - Guide outcomes.
+* @param versions - Version outcomes.
+* @returns The derived whole report.
+*/
+function syncReportOf(target, guides, versions) {
+	const failed = [...guides, ...versions].filter((entry) => entry.freshness === "missing" || entry.freshness === "failed").length;
+	return {
+		target,
+		guides,
+		versions,
+		clean: failed === 0 && guides.every((guide) => guide.freshness === "current") && versions.every((version) => version.freshness === "current"),
+		failed
+	};
+}
+/**
+* Locate this MODULE's own installed package root — the nearest ancestor of
+* `import.meta.url` holding a `package.json` — and return its vendored
+* `dist/host` data root. THE single source of truth for the default
+* `Materializer` / `scaffold` bin host: once installed, walking up from the
+* module's own file (not `process.cwd()`, which points at whichever project
+* happens to be running) resolves to `node_modules/@orkestrel/scaffold`, the
+* correct default host — the package ships its vendored data with itself.
+* `dist/host` may not exist yet when this resolves from SOURCE under a test
+* runner; that is fine — existence is checked at the point of use, not here.
+*
+* @returns The absolute vendored `dist/host` path.
+* @throws `ScaffoldError('TARGET', …)` when no ancestor of this module's own
+*   location holds a `package.json`.
+*
+* @example
+* ```ts
+* import { hostRoot } from '@orkestrel/scaffold/server'
+*
+* hostRoot() // '/…/node_modules/@orkestrel/scaffold/dist/host'
+* ```
+*/
+function hostRoot() {
+	let dir = dirname(fileURLToPath(import.meta.url));
+	for (;;) {
+		if (existsSync(join(dir, "package.json"))) return join(dir, "dist", "host");
+		const parent = dirname(dir);
+		if (parent === dir) throw new ScaffoldError("TARGET", "No package root found above the module location", { module: import.meta.url });
+		dir = parent;
+	}
+}
+/**
+* Resolve the deepest existing ancestor of a path through the real filesystem.
+*
+* @param path - The absolute or relative path to resolve.
+* @returns A path whose existing prefix has been resolved through symlinks.
+*/
+function resolveRealPath(path) {
+	if (!isFilesystemPath(path)) throw new ScaffoldError("TARGET", "Filesystem path is malformed or exceeds its bounds");
+	let current = resolve(path);
+	const unresolved = [];
+	while (!existsSync(current)) {
+		const parent = dirname(current);
+		if (parent === current || unresolved.length >= 64) throw new ScaffoldError("TARGET", "Filesystem path has no bounded existing ancestor", {
+			path,
+			limit: 64
+		});
+		unresolved.unshift(relative(parent, current));
+		current = parent;
+	}
+	let physical = realpathSync(current);
+	for (const segment of unresolved) physical = join(physical, segment);
+	return physical;
+}
+/**
+* Resolve a path beneath a declared root and reject lexical or symlink escape.
+*
+* @param root - The containing filesystem root.
+* @param path - The candidate path, relative or absolute.
+* @param code - The coded error to raise on escape.
+* @param boundary - The boundary name used in diagnostics.
+* @returns The lexically resolved candidate after realpath-aware validation.
+*/
+function resolveContainedPath(root, path, code, boundary) {
+	if (!isFilesystemPath(root) || !isFilesystemPath(path)) throw new ScaffoldError(code, `${boundary} path is malformed or exceeds its bounds`, {
+		path,
+		root
+	});
+	const resolvedRoot = resolveRealPath(resolve(root));
+	const resolvedCandidate = resolveRealPath(resolve(root, path));
+	if (resolvedCandidate !== resolvedRoot && !resolvedCandidate.startsWith(resolvedRoot + sep)) throw new ScaffoldError(code, `Path "${path}" escapes the ${boundary} root`, {
+		path,
+		root
+	});
+	return resolve(root, path);
+}
+/**
+* Resolve a contained path whose existing ancestor chain contains no links.
+*
+* @param root - The trusted lexical and physical root.
+* @param path - The portable root-relative path.
+* @param code - The coded error to raise on failure.
+* @param boundary - The boundary name used in diagnostics.
+* @returns The contained destination.
+* @throws `ScaffoldError` when containment fails or an ancestor is not a real directory.
+*/
+function resolvePhysicalPath(root, path, code, boundary) {
+	const resolvedRoot = resolve(root);
+	const destination = resolveContainedPath(resolvedRoot, path, code, boundary);
+	if (destination === resolvedRoot) {
+		const status = attempt(() => lstatSync(resolvedRoot));
+		if (!status.success || !status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError(code, `${boundary} root is not a real directory`, {
+			path,
+			root,
+			...status.success ? {} : { error: status.error }
+		});
+		return destination;
+	}
+	let parent = dirname(destination);
+	for (;;) {
+		if (existsSync(parent)) {
+			const status = attempt(() => lstatSync(parent));
+			if (!status.success || !status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError(code, `${boundary} parent is not a real directory`, {
+				path,
+				parent,
+				...status.success ? {} : { error: status.error }
+			});
+		}
+		if (parent === resolvedRoot) break;
+		const next = dirname(parent);
+		if (next === parent) throw new ScaffoldError(code, `${boundary} parent escapes its root`, {
+			path,
+			root
+		});
+		parent = next;
+	}
+	return destination;
+}
+/**
+* Revalidate one captured physical-directory identity without following links.
+*
+* @param anchor - The captured path, device, and inode.
+* @param boundary - The boundary name used in diagnostics.
+* @throws `ScaffoldError('WRITE', ...)` when the directory is missing or changed.
+*/
+function validateWriteAnchor(anchor, boundary) {
+	const status = attempt(() => lstatSync(anchor.path));
+	if (!status.success || !status.value.isDirectory() || status.value.isSymbolicLink() || status.value.dev !== anchor.device || status.value.ino !== anchor.inode) throw new ScaffoldError("WRITE", `Write transaction ${boundary} changed`, {
+		path: anchor.path,
+		...status.success ? {} : { error: status.error }
+	});
+}
+/**
+* Create a physical directory path one segment at a time behind captured identities.
+*
+* @param path - The absolute directory path to establish.
+* @param boundary - The boundary name used in diagnostics.
+* @returns The final directory anchor and the subset created by this call.
+*/
+function createWriteDirectory(path, boundary) {
+	const destination = resolve(path);
+	const missing = [];
+	let current = destination;
+	let existing;
+	for (;;) {
+		const status = attempt(() => lstatSync(current));
+		if (status.success) {
+			if (!status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError("WRITE", `${boundary} is not a physical directory`, { path: current });
+			existing = Object.freeze({
+				path: current,
+				device: status.value.dev,
+				inode: status.value.ino
+			});
+			break;
+		}
+		if (!isMissingPathError(status.error)) throw new ScaffoldError("WRITE", `Failed to inspect ${boundary}`, {
+			path: current,
+			error: status.error
+		});
+		missing.push(current);
+		const parent = dirname(current);
+		if (parent === current) throw new ScaffoldError("WRITE", `Cannot establish ${boundary}`, { path: destination });
+		current = parent;
+	}
+	const created = [];
+	let anchor = existing;
+	for (const directory of [...missing].reverse()) {
+		validateWriteAnchor(anchor, boundary);
+		mkdirSync(directory);
+		validateWriteAnchor(anchor, boundary);
+		const status = lstatSync(directory);
+		if (!status.isDirectory() || status.isSymbolicLink()) throw new ScaffoldError("WRITE", `${boundary} changed while creating it`, { path: directory });
+		anchor = Object.freeze({
+			path: directory,
+			device: status.dev,
+			inode: status.ino
+		});
+		created.push(anchor);
+	}
+	return {
+		anchor,
+		created
+	};
+}
+/**
+* Revalidate every private directory owned by a write transaction.
+*
+* @param transaction - The nominal transaction state.
+* @throws `ScaffoldError('WRITE', ...)` when any private directory changed.
+*/
+function validateWriteDirectories(transaction) {
+	validateWriteAnchor(transaction.anchor, "anchor");
+	for (const parent of transaction.parents) validateWriteAnchor(parent, "parent");
+	for (const directory of transaction.directories) validateWriteAnchor(directory, "private directory");
+}
+/**
+* Revalidate the transaction target against its original or transaction-owned identity.
+*
+* @param transaction - The nominal transaction state.
+* @param owned - A target directory created by the current commit.
+* @throws `ScaffoldError('WRITE', ...)` when the target identity changed.
+*/
+function validateWriteTarget(transaction, owned) {
+	validateWriteDirectories(transaction);
+	const expected = transaction.existing ?? owned;
+	const status = attempt(() => lstatSync(transaction.target));
+	if (expected === void 0) {
+		if (status.success || !isMissingPathError(status.error)) throw new ScaffoldError("WRITE", "Write transaction target changed", {
+			target: transaction.target,
+			...status.success ? {} : { error: status.error }
+		});
+		return;
+	}
+	if (!status.success || !status.value.isDirectory() || status.value.isSymbolicLink() || status.value.dev !== expected.device || status.value.ino !== expected.inode) throw new ScaffoldError("WRITE", "Write transaction target changed", {
+		target: transaction.target,
+		...status.success ? {} : { error: status.error }
+	});
+}
+/**
+* Remove an uncommitted or already-committed write transaction's private residue.
+*
+* @param transaction - The transaction to discard.
+* @throws `ScaffoldError('WRITE', ...)` when its private root cannot be removed.
+*/
+function discardWriteTransaction(transaction) {
+	if (!(transaction instanceof WriteTransaction)) throw new ScaffoldError("WRITE", "Write transaction identity is invalid");
+	validateWriteDirectories(transaction);
+	const discarded = attempt(() => rmSync(transaction.root, { recursive: true }));
+	if (!discarded.success) throw new ScaffoldError("WRITE", "Failed to discard write transaction", {
+		target: transaction.target,
+		root: transaction.root,
+		error: discarded.error
+	});
+	for (const parent of [...transaction.parents].reverse()) {
+		const removed = attempt(() => {
+			const status = lstatSync(parent.path);
+			if (!status.isDirectory() || status.isSymbolicLink() || status.dev !== parent.device || status.ino !== parent.inode) throw new Error(`write transaction parent changed at ${parent.path}`);
+			rmdirSync(parent.path);
+		});
+		if (!removed.success && !isMissingPathError(removed.error)) throw new ScaffoldError("WRITE", "Failed to discard write transaction parent", {
+			target: transaction.target,
+			root: transaction.root,
+			parent: parent.path,
+			error: removed.error
+		});
+	}
+}
+/**
+* Promote a complete staged set and roll every earlier destination back when
+* any later promotion fails.
+*
+* @param transaction - Same-volume sibling staging state.
+* @param paths - Portable target-relative files to promote.
+* @throws `ScaffoldError('WRITE', ...)` with recovery details on failure.
+*/
+function commitWriteTransaction(transaction, paths) {
+	if (!(transaction instanceof WriteTransaction)) throw new ScaffoldError("WRITE", "Write transaction identity is invalid");
+	const requested = parsePortablePaths(paths, MAX_COLLECTION_ITEMS);
+	const conflict = requested === void 0 ? void 0 : findFileConflict(requested);
+	if (requested === void 0 || conflict !== void 0 || requested.length !== transaction.expectations.length || requested.some((path) => !transaction.expectations.some((expectation) => expectation.path === path)) || transaction.expectations.some((expectation) => !requested.some((path) => path === expectation.path))) {
+		discardWriteTransaction(transaction);
+		throw new ScaffoldError("WRITE", requested !== void 0 && conflict === void 0 ? "Write transaction paths do not match its expectations" : requested !== void 0 ? `Write transaction collision between "${conflict?.[0]}" and "${conflict?.[1]}"` : "Write transaction paths are malformed", {
+			paths: conflict ?? requested ?? [],
+			committed: false
+		});
+	}
+	const preflight = attempt(() => {
+		validateWriteTarget(transaction, void 0);
+		validateWriteDirectories(transaction);
+		for (const path of requested) {
+			if (!isPortablePath(path)) throw new ScaffoldError("WRITE", `Invalid transaction path at ${path}`, { path });
+			const expectation = transaction.expectations.find((candidate) => candidate.path === path);
+			if (expectation === void 0) throw new ScaffoldError("WRITE", `Missing transaction expectation at ${path}`, { path });
+			const staged = resolvePhysicalPath(transaction.stage, path, "WRITE", "staging");
+			const stagedStatus = attempt(() => lstatSync(staged));
+			if (!stagedStatus.success || stagedStatus.value.isSymbolicLink() || !stagedStatus.value.isFile() || stagedStatus.value.nlink !== 1) throw new ScaffoldError("WRITE", `Invalid staged transaction entry at ${path}`, {
+				path,
+				error: stagedStatus.success ? void 0 : stagedStatus.error
+			});
+			const destination = resolvePhysicalPath(transaction.target, path, "WRITE", "target");
+			const current = attempt(() => lstatSync(destination));
+			if (expectation.shape === "absent") {
+				if (current.success || !isMissingPathError(current.error)) throw new ScaffoldError("WRITE", `Transaction destination changed at ${path}`, {
+					path,
+					error: current.success ? void 0 : current.error
+				});
+				continue;
+			}
+			if (!current.success) throw new ScaffoldError("WRITE", `Transaction destination changed at ${path}`, {
+				path,
+				error: current.error
+			});
+			const shape = current.value.isDirectory() ? "directory" : "file";
+			const content = shape === "file" ? attempt(() => digestFile(destination)) : void 0;
+			if (current.value.isSymbolicLink() || current.value.isFile() && current.value.nlink !== 1 || current.value.isDirectory() !== stagedStatus.value.isDirectory() || current.value.isDirectory() || shape !== expectation.shape || current.value.dev !== expectation.device || current.value.ino !== expectation.inode || current.value.mtimeMs !== expectation.modified || current.value.size !== expectation.size || content !== void 0 && (!content.success || content.value !== expectation.digest)) throw new ScaffoldError("WRITE", `Transaction destination changed at ${path}`, {
+				path,
+				...content?.success === false ? { error: content.error } : {}
+			});
+		}
+	});
+	if (!preflight.success) {
+		const cleanup = attempt(() => discardWriteTransaction(transaction));
+		throw new ScaffoldError("WRITE", "Write transaction failed preflight", {
+			target: transaction.target,
+			error: preflight.error,
+			committed: false,
+			...cleanup.success ? {} : { cleanup: cleanup.error }
+		});
+	}
+	const preserved = [];
+	const promoted = [];
+	const createdParents = [];
+	let ownedTarget;
+	const committed = attempt(() => {
+		for (const path of requested) {
+			validateWriteTarget(transaction, ownedTarget);
+			validateWriteDirectories(transaction);
+			if (!isPortablePath(path)) throw new ScaffoldError("WRITE", `Invalid transaction path at ${path}`, { path });
+			const staged = resolvePhysicalPath(transaction.stage, path, "WRITE", "staging");
+			const stagedStatus = attempt(() => lstatSync(staged));
+			if (!stagedStatus.success || stagedStatus.value.isSymbolicLink() || !stagedStatus.value.isFile() || stagedStatus.value.nlink !== 1) throw new ScaffoldError("WRITE", `Invalid staged transaction entry at ${path}`, {
+				path,
+				error: stagedStatus.success ? void 0 : stagedStatus.error
+			});
+			const destination = resolvePhysicalPath(transaction.target, path, "WRITE", "target");
+			const backup = resolvePhysicalPath(transaction.backup, path, "WRITE", "backup");
+			const expectation = transaction.expectations.find((candidate) => candidate.path === path);
+			if (expectation === void 0) throw new ScaffoldError("WRITE", `Missing transaction expectation at ${path}`, { path });
+			const current = attempt(() => lstatSync(destination));
+			if (expectation.shape === "absent") {
+				if (current.success || !isMissingPathError(current.error)) throw new ScaffoldError("WRITE", `Transaction destination changed at ${path}`, {
+					path,
+					error: current.success ? void 0 : current.error
+				});
+			} else if (current.success) {
+				const shape = current.value.isDirectory() ? "directory" : "file";
+				const content = shape === "file" ? attempt(() => digestFile(destination)) : void 0;
+				if (current.value.isSymbolicLink() || current.value.isFile() && current.value.nlink !== 1 || current.value.isDirectory() !== stagedStatus.value.isDirectory() || current.value.isDirectory() || shape !== expectation.shape || current.value.dev !== expectation.device || current.value.ino !== expectation.inode || current.value.mtimeMs !== expectation.modified || current.value.size !== expectation.size || content !== void 0 && (!content.success || content.value !== expectation.digest)) throw new ScaffoldError("WRITE", `Transaction destination changed at ${path}`, {
+					path,
+					...content?.success === false ? { error: content.error } : {}
+				});
+				mkdirSync(dirname(backup), { recursive: true });
+				renameSync(destination, backup);
+				preserved.push(path);
+				const capturedStatus = lstatSync(backup);
+				const capturedContent = digestFile(backup);
+				if (!capturedStatus.isFile() || capturedStatus.isSymbolicLink() || capturedStatus.nlink !== 1 || capturedStatus.dev !== expectation.device || capturedStatus.ino !== expectation.inode || capturedStatus.mtimeMs !== expectation.modified || capturedStatus.size !== expectation.size || capturedContent !== expectation.digest) throw new ScaffoldError("WRITE", `Transaction destination changed during preservation at ${path}`, { path });
+			} else throw new ScaffoldError("WRITE", `Transaction destination changed at ${path}`, {
+				path,
+				error: current.error
+			});
+			const missingParents = [];
+			let parent = dirname(destination);
+			while (parent !== dirname(transaction.target)) {
+				const status = attempt(() => lstatSync(parent));
+				if (status.success) {
+					if (transaction.existing === void 0 && ownedTarget === void 0 && parent === transaction.target) throw new ScaffoldError("WRITE", "Write transaction target changed", { target: transaction.target });
+					break;
+				}
+				if (!isMissingPathError(status.error)) throw status.error;
+				missingParents.push(parent);
+				parent = dirname(parent);
+			}
+			for (const createdParent of [...missingParents].reverse()) {
+				mkdirSync(createdParent);
+				const status = lstatSync(createdParent);
+				if (!status.isDirectory() || status.isSymbolicLink()) throw new ScaffoldError("WRITE", `Write transaction parent changed at ${createdParent}`, {
+					target: transaction.target,
+					parent: createdParent
+				});
+				if (!createdParents.some((candidate) => candidate.path === createdParent)) {
+					const captured = Object.freeze({
+						path: createdParent,
+						device: status.dev,
+						inode: status.ino
+					});
+					createdParents.push(captured);
+					if (createdParent === transaction.target) ownedTarget = captured;
+				}
+			}
+			if (transaction.existing === void 0 && ownedTarget === void 0) throw new ScaffoldError("WRITE", "Write transaction target was not created safely", { target: transaction.target });
+			linkSync(staged, destination);
+			const linkedStatus = lstatSync(destination);
+			const stagedAfterLink = lstatSync(staged);
+			if (!linkedStatus.isFile() || linkedStatus.isSymbolicLink() || linkedStatus.dev !== stagedStatus.value.dev || linkedStatus.ino !== stagedStatus.value.ino || stagedAfterLink.dev !== linkedStatus.dev || stagedAfterLink.ino !== linkedStatus.ino) throw new ScaffoldError("WRITE", `Staged promotion changed at ${path}`, { path });
+			const unlinked = attempt(() => rmSync(staged));
+			if (!unlinked.success) {
+				const cleanup = attempt(() => {
+					const destinationStatus = lstatSync(destination);
+					if (destinationStatus.dev !== linkedStatus.dev || destinationStatus.ino !== linkedStatus.ino) throw new Error(`promoted file changed at ${path}`);
+					rmSync(destination);
+				});
+				throw new ScaffoldError("WRITE", `Failed to release staged link at ${path}`, {
+					path,
+					error: unlinked.error,
+					cleanup: cleanup.success ? void 0 : cleanup.error
+				});
+			}
+			const promotedStatus = lstatSync(destination);
+			promoted.push(Object.freeze({
+				path,
+				shape: "file",
+				device: promotedStatus.dev,
+				inode: promotedStatus.ino,
+				modified: promotedStatus.mtimeMs,
+				size: promotedStatus.size,
+				digest: digestFile(destination)
+			}));
+		}
+	});
+	if (!committed.success) {
+		const recoveryErrors = [];
+		let preserveResidue = false;
+		for (const promotion of [...promoted].reverse()) {
+			const removed = attempt(() => {
+				validateWriteTarget(transaction, ownedTarget);
+				const destination = resolvePhysicalPath(transaction.target, promotion.path, "WRITE", "target");
+				const status = lstatSync(destination);
+				const shape = status.isDirectory() ? "directory" : "file";
+				const digest = shape === "file" ? attempt(() => digestFile(destination)) : void 0;
+				if (status.isSymbolicLink() || shape !== promotion.shape || status.dev !== promotion.device || status.ino !== promotion.inode || digest !== void 0 && (!digest.success || status.mtimeMs !== promotion.modified || status.size !== promotion.size || digest.value !== promotion.digest)) throw new ScaffoldError("WRITE", `Promoted transaction destination changed at ${promotion.path}`, {
+					path: promotion.path,
+					...digest?.success === false ? { error: digest.error } : {}
+				});
+				if (shape === "directory") {
+					const recovery = resolvePhysicalPath(transaction.stage, `.rollback/${promotion.path}`, "WRITE", "rollback");
+					mkdirSync(dirname(recovery), { recursive: true });
+					validateWriteTarget(transaction, ownedTarget);
+					renameSync(destination, recovery);
+					preserveResidue = true;
+				} else rmSync(destination);
+			});
+			if (!removed.success) recoveryErrors.push(removed.error);
+		}
+		for (const path of [...preserved].reverse()) {
+			const restored = attempt(() => {
+				validateWriteTarget(transaction, ownedTarget);
+				validateWriteDirectories(transaction);
+				const destination = resolvePhysicalPath(transaction.target, path, "WRITE", "target");
+				const backup = resolvePhysicalPath(transaction.backup, path, "WRITE", "backup");
+				mkdirSync(dirname(destination), { recursive: true });
+				linkSync(backup, destination);
+				rmSync(backup);
+			});
+			if (!restored.success) recoveryErrors.push(restored.error);
+		}
+		for (const parent of [...createdParents].reverse()) {
+			const removed = attempt(() => {
+				validateWriteTarget(transaction, ownedTarget);
+				validateWriteDirectories(transaction);
+				validateWriteAnchor(parent, "created parent");
+				rmdirSync(parent.path);
+			});
+			if (!removed.success && !isMissingPathError(removed.error)) recoveryErrors.push(removed.error);
+		}
+		const cleanup = recoveryErrors.length === 0 && !preserveResidue ? attempt(() => discardWriteTransaction(transaction)) : void 0;
+		throw new ScaffoldError("WRITE", "Write transaction failed before commit", {
+			target: transaction.target,
+			root: transaction.root,
+			error: committed.error,
+			committed: false,
+			recovery: recoveryErrors,
+			residue: preserveResidue ? transaction.root : void 0,
+			cleanup: cleanup?.success === false ? cleanup.error : void 0
+		});
+	}
+	validateWriteDirectories(transaction);
+	const cleanup = attempt(() => rmSync(transaction.root, { recursive: true }));
+	if (!cleanup.success) throw new ScaffoldError("WRITE", "Write transaction committed with cleanup residue", {
+		target: transaction.target,
+		root: transaction.root,
+		error: cleanup.error,
+		committed: true
+	});
+}
+/**
+* Resolve and completely preflight the canonical guide destinations a sync may write.
 *
-* @returns The absolute vendored `dist/host` path.
-* @throws `ScaffoldError('TARGET', …)` when no ancestor of this module's own
-*   location holds a `package.json`.
-*
-* @example
-* ```ts
-* import { hostRoot } from '@orkestrel/scaffold/server'
+* @param guides - Structurally validated behind guide results.
+* @param target - The repository root that owns `guides/src`.
+* @returns Each guide paired with its contained destination.
+* @throws `ScaffoldError('WRITE', ...)` before mutation for ownership, collision,
+* containment, or existing filesystem-shape violations.
+*/
+function resolveGuideWrites(guides, target) {
+	const copied = attempt(() => guides.map((guide) => {
+		const name = guide.name;
+		const path = guide.path;
+		const content = guide.content;
+		const freshness = guide.freshness;
+		const note = guide.note;
+		const baseline = guide.baseline;
+		return {
+			name,
+			path,
+			content,
+			freshness,
+			...note === void 0 ? {} : { note },
+			...baseline === void 0 ? {} : { baseline }
+		};
+	}));
+	if (!copied.success) throw new ScaffoldError("WRITE", "Sync guides could not be read safely", { error: copied.error });
+	const behind = copied.value.filter((guide) => guide.freshness === "behind");
+	const paths = [];
+	for (const guide of behind) {
+		if (!DEPENDENCY_NAME_PATTERN.test(guide.name)) throw new ScaffoldError("WRITE", `Invalid guide dependency name at ${guide.name}`, { name: guide.name });
+		const expected = `guides/src/${packageShortName(guide.name)}.md`;
+		if (guide.path !== expected) throw new ScaffoldError("WRITE", `Guide path "${guide.path}" does not match dependency ${guide.name}`, {
+			path: guide.path,
+			expected
+		});
+		paths.push(guide.path);
+	}
+	const conflict = findFileConflict(paths);
+	if (conflict !== void 0) throw new ScaffoldError("WRITE", `Guide destination collision between "${conflict[0]}" and "${conflict[1]}"`, { paths: conflict });
+	const resolvedTarget = resolve(target);
+	const destinations = behind.map((guide) => ({
+		guide,
+		destination: resolvePhysicalPath(target, guide.path, "WRITE", "target")
+	}));
+	for (const { guide, destination } of destinations) {
+		if (existsSync(destination)) {
+			const status = attempt(() => lstatSync(destination));
+			if (!status.success || !status.value.isFile() || status.value.isSymbolicLink() || status.value.nlink !== 1) throw new ScaffoldError("WRITE", `Guide destination is not a file at ${guide.path}`, {
+				path: guide.path,
+				...status.success ? {} : { error: status.error }
+			});
+		}
+		if (!destination.startsWith(resolvedTarget + sep)) throw new ScaffoldError("WRITE", `Guide destination escapes the target for ${guide.path}`, {
+			path: guide.path,
+			target
+		});
+	}
+	return destinations;
+}
+/**
+* Restore quarantined files to their original target-relative paths.
 *
-* hostRoot() // '/…/node_modules/@orkestrel/scaffold/dist/host'
-* ```
+* @param transaction - The nominal transaction that owns the quarantine and target.
+* @param paths - The relative paths to restore, in their original move order.
+* @throws `ScaffoldError('WRITE', …)` after attempting every reverse-order
+*   restoration when one or more files could not be restored.
 */
-function hostRoot() {
-	let dir = dirname(fileURLToPath(import.meta.url));
-	for (;;) {
-		if (existsSync(join(dir, "package.json"))) return join(dir, "dist", "host");
-		const parent = dirname(dir);
-		if (parent === dir) throw new ScaffoldError("TARGET", "No package root found above the module location", { module: import.meta.url });
-		dir = parent;
+function restoreFiles(transaction, paths) {
+	const requested = parsePortablePaths(paths, MAX_COLLECTION_ITEMS);
+	if (requested === void 0) throw new ScaffoldError("WRITE", "Quarantine restore paths are malformed", { limit: MAX_COLLECTION_ITEMS });
+	const failed = [];
+	const errors = [];
+	for (const path of [...requested].reverse()) {
+		const restored = attempt(() => {
+			validateWriteTarget(transaction, void 0);
+			const from = resolvePhysicalPath(transaction.backup, path, "WRITE", "quarantine");
+			const to = resolvePhysicalPath(transaction.target, path, "WRITE", "target");
+			const sourceStatus = lstatSync(from);
+			if (!sourceStatus.isFile() || sourceStatus.isSymbolicLink() || sourceStatus.nlink !== 1) throw new ScaffoldError("WRITE", `Invalid quarantined file at ${path}`, { path });
+			mkdirSync(dirname(to), { recursive: true });
+			validateWriteTarget(transaction, void 0);
+			linkSync(from, to);
+			validateWriteTarget(transaction, void 0);
+			rmSync(from);
+		});
+		if (!restored.success) {
+			failed.push(path);
+			errors.push(restored.error);
+		}
 	}
+	if (failed.length > 0) throw new ScaffoldError("WRITE", "Failed to restore quarantined files", {
+		source: transaction.backup,
+		target: transaction.target,
+		paths: failed,
+		errors
+	});
+}
+/**
+* Atomically promote a staged sibling directory while preserving recoverable state.
+*
+* @param staging - The completed staging directory.
+* @param target - The destination directory to replace.
+* @param backup - The sibling path reserved for the prior target.
+* @throws `ScaffoldError('WRITE', …)` with explicit `committed` and recovery paths.
+*/
+function replaceDirectory(staging, target, backup) {
+	const resolvedStaging = resolve(staging);
+	const resolvedTarget = resolve(target);
+	const resolvedBackup = resolve(backup);
+	const parent = dirname(resolvedTarget);
+	const paths = [
+		resolvedStaging,
+		resolvedTarget,
+		resolvedBackup
+	];
+	if (dirname(resolvedStaging) !== parent || dirname(resolvedBackup) !== parent) throw new ScaffoldError("WRITE", "Directory replacement paths must share one parent", {
+		staging: resolvedStaging,
+		target: resolvedTarget,
+		backup: resolvedBackup,
+		committed: false
+	});
+	if (new Set(paths.map((path) => path.toLowerCase())).size !== paths.length) throw new ScaffoldError("WRITE", "Directory replacement paths must be distinct", {
+		staging: resolvedStaging,
+		target: resolvedTarget,
+		backup: resolvedBackup,
+		committed: false
+	});
+	const parentStatus = attempt(() => lstatSync(parent));
+	if (!parentStatus.success || !parentStatus.value.isDirectory() || parentStatus.value.isSymbolicLink()) throw new ScaffoldError("WRITE", "Directory replacement parent must be a real directory", {
+		staging: resolvedStaging,
+		target: resolvedTarget,
+		backup: resolvedBackup,
+		committed: false,
+		...parentStatus.success ? {} : { error: parentStatus.error }
+	});
+	const parentAnchor = Object.freeze({
+		path: parent,
+		device: parentStatus.value.dev,
+		inode: parentStatus.value.ino
+	});
+	const reserved = attempt(() => lstatSync(resolvedBackup));
+	if (reserved.success) throw new ScaffoldError("WRITE", "Directory replacement backup already exists", {
+		staging: resolvedStaging,
+		target: resolvedTarget,
+		backup: resolvedBackup,
+		committed: false
+	});
+	if (!isMissingPathError(reserved.error)) throw new ScaffoldError("WRITE", "Failed to inspect directory replacement backup", {
+		staging: resolvedStaging,
+		target: resolvedTarget,
+		backup: resolvedBackup,
+		committed: false,
+		error: reserved.error
+	});
+	const staged = attempt(() => lstatSync(resolvedStaging));
+	if (!staged.success || !staged.value.isDirectory() || staged.value.isSymbolicLink()) throw new ScaffoldError("WRITE", "Directory replacement staging must be a real directory", {
+		staging: resolvedStaging,
+		target: resolvedTarget,
+		backup: resolvedBackup,
+		committed: false,
+		error: staged.success ? void 0 : staged.error
+	});
+	const stagingAnchor = Object.freeze({
+		path: resolvedStaging,
+		device: staged.value.dev,
+		inode: staged.value.ino
+	});
+	const current = attempt(() => lstatSync(resolvedTarget));
+	if (!current.success && !isMissingPathError(current.error)) throw new ScaffoldError("WRITE", "Failed to inspect directory replacement target", {
+		staging: resolvedStaging,
+		target: resolvedTarget,
+		backup: resolvedBackup,
+		committed: false,
+		error: current.error
+	});
+	if (current.success && (!current.value.isDirectory() || current.value.isSymbolicLink())) throw new ScaffoldError("WRITE", "Directory replacement target must be a real directory", {
+		staging: resolvedStaging,
+		target: resolvedTarget,
+		backup: resolvedBackup,
+		committed: false
+	});
+	const existing = current.success;
+	const targetAnchor = current.success ? Object.freeze({
+		path: resolvedTarget,
+		device: current.value.dev,
+		inode: current.value.ino
+	}) : void 0;
+	let preserved = false;
+	let promoted = false;
+	const replacement = attempt(() => {
+		validateWriteAnchor(parentAnchor, "directory replacement parent");
+		validateWriteAnchor(stagingAnchor, "directory replacement staging");
+		if (existing) {
+			if (targetAnchor === void 0) throw new Error("directory replacement target identity is missing");
+			validateWriteAnchor(targetAnchor, "directory replacement target");
+			renameSync(resolvedTarget, resolvedBackup);
+			preserved = true;
+			validateWriteAnchor(parentAnchor, "directory replacement parent");
+			validateWriteAnchor(Object.freeze({
+				...targetAnchor,
+				path: resolvedBackup
+			}), "directory replacement backup");
+			const vacated = attempt(() => lstatSync(resolvedTarget));
+			if (vacated.success || !isMissingPathError(vacated.error)) throw new Error("directory replacement target was not vacated");
+		}
+		validateWriteAnchor(parentAnchor, "directory replacement parent");
+		validateWriteAnchor(stagingAnchor, "directory replacement staging");
+		renameSync(resolvedStaging, resolvedTarget);
+		promoted = true;
+		validateWriteAnchor(parentAnchor, "directory replacement parent");
+		validateWriteAnchor(Object.freeze({
+			...stagingAnchor,
+			path: resolvedTarget
+		}), "directory replacement target");
+		if (existing) {
+			if (targetAnchor === void 0) throw new Error("directory replacement backup identity is missing");
+			validateWriteAnchor(Object.freeze({
+				...targetAnchor,
+				path: resolvedBackup
+			}), "directory replacement backup");
+			rmSync(resolvedBackup, {
+				recursive: true,
+				force: true
+			});
+			preserved = false;
+		}
+		validateWriteAnchor(parentAnchor, "directory replacement parent");
+		validateWriteAnchor(Object.freeze({
+			...stagingAnchor,
+			path: resolvedTarget
+		}), "directory replacement target");
+	});
+	if (replacement.success) return;
+	const restored = existing && preserved && !promoted ? attempt(() => {
+		if (targetAnchor === void 0) throw new Error("directory replacement backup identity is missing");
+		validateWriteAnchor(parentAnchor, "directory replacement parent");
+		validateWriteAnchor(Object.freeze({
+			...targetAnchor,
+			path: resolvedBackup
+		}), "directory replacement backup");
+		const destination = attempt(() => lstatSync(resolvedTarget));
+		if (destination.success || !isMissingPathError(destination.error)) throw new Error("directory replacement target is not vacant");
+		renameSync(resolvedBackup, resolvedTarget);
+		validateWriteAnchor(targetAnchor, "directory replacement target");
+		preserved = false;
+	}) : void 0;
+	throw new ScaffoldError("WRITE", "Directory replacement failed", {
+		staging: resolvedStaging,
+		target: resolvedTarget,
+		backup: preserved ? resolvedBackup : void 0,
+		committed: promoted,
+		error: replacement.error,
+		restore: restored?.success === false ? restored.error : void 0
+	});
 }
 /**
 * Filter a manifest record's entries down to `@orkestrel/`-prefixed keys with
@@ -56,7 +1711,15 @@ function hostRoot() {
 */
 function selectOrkestrelEntries(value) {
 	if (!isRecord(value)) return [];
-	return Object.entries(value).filter((entry) => typeof entry[1] === "string" && entry[0].startsWith("@orkestrel/"));
+	const selected = attempt(() => {
+		const entries = [];
+		for (const [name, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+			if (!Reflect.has(descriptor, "value")) return [];
+			if (typeof descriptor.value === "string" && DEPENDENCY_NAME_PATTERN.test(name)) entries.push([name, descriptor.value]);
+		}
+		return entries;
+	});
+	return selected.success ? selected.value : [];
 }
 /**
 * Reconstruct a `Blueprint` from an EXISTING repo at `target` — the faithful
@@ -65,12 +1728,12 @@ function selectOrkestrelEntries(value) {
 *
 * @param target - The existing package directory to derive a `Blueprint` from.
 * @remarks
-* `name` strips the `@orkestrel/` prefix off `manifest.name` — a non-`@orkestrel`
-* name is a coded `TARGET` failure, since this tool derives only `@orkestrel`
-* packages. `surfaces` is read off the LIVE line: every surface the package
-* carries has a `src/<surface>/` directory, so each of `'core' | 'browser' |
-* 'server'` is included iff that directory exists at `target`; a target with
-* NONE of the three is also a coded `TARGET` failure. `dependencies` /
+* A scoped package name is stripped to its bounded safe short name. An
+* unscoped name is accepted only when the target is app-only, `private: true`,
+* and the name satisfies `isWorkspaceName`; every other name is a coded
+* `TARGET` failure. `src` is derived from `src/<environment>/` and `app` from
+* `app/<environment>/`; a target with no environment on either axis is also a coded
+* `TARGET` failure. `dependencies` /
 * `peers` are the `@orkestrel/`-prefixed entries of `manifest.dependencies` /
 * `manifest.peerDependencies` (a peer flagged `peerDependenciesMeta[name]
 * .optional === true` carries `optional: true`). `extras` is EVERY entry of
@@ -82,63 +1745,66 @@ function selectOrkestrelEntries(value) {
 * ALSO present in
 * `manifest.peerDependencies` or `manifest.dependencies` (e.g. a peer
 * dev-installed for local testing) is likewise excluded from `extras` — it
-* already surfaces as a `peer`/`dependency` above, and double-counting it as
+* already appears as a `peer`/`dependency` above, and double-counting it as
 * an `extra` would land it in `peers ∩ extras`, a blocking `validateBlueprint`
 * gate. `overrides` is always `[]` — derivation cannot know a caller's
 * template-override intent.
 * @returns The reconstructed `Blueprint`.
 * @throws `ScaffoldError('TARGET', …)` when `target`'s manifest is unreadable
-*   (via `readManifest`), is not valid JSON, its `name` is not `@orkestrel`-
-*   prefixed, or `target` carries none of the three surface directories.
+*   (via `readManifest`), is not valid JSON, its name is unsafe for its
+*   publication mode, or `target` carries no source or application environment.
 *
 * @example
 * ```ts
 * import { deriveBlueprint } from '@orkestrel/scaffold/server'
 *
-* deriveBlueprint('./packages/router') // { name: 'router', surfaces: ['core', 'server'], … }
+* deriveBlueprint('./packages/router') // { name: 'router', src: ['core', 'server'], … }
 * ```
 */
 function deriveBlueprint(target) {
-	const BASELINE_EXTRAS = /* @__PURE__ */ new Set([
+	const baselineExtras = /* @__PURE__ */ new Set([
 		...Object.keys(devDependenciesFor([])),
 		"@orkestrel/guide",
 		"@orkestrel/scaffold"
 	]);
-	const text = readManifest(target);
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch (error) {
-		throw new ScaffoldError("TARGET", `Manifest at ${target} is not valid JSON`, {
-			target,
-			error
-		});
-	}
-	if (!isRecord(parsed)) throw new ScaffoldError("TARGET", `Manifest at ${target} is not a JSON object`, { target });
-	const rawName = parsed.name;
-	if (typeof rawName !== "string" || !rawName.startsWith("@orkestrel/")) throw new ScaffoldError("TARGET", `Manifest name "${String(rawName)}" is not an @orkestrel package`, {
+	const parsed = parseJSON(readManifest(target));
+	if (!isRecord(parsed)) throw new ScaffoldError("TARGET", `Manifest at ${target} is not a valid JSON object`, { target });
+	const src = ENVIRONMENTS.filter((environment) => isRealDirectory(join(target, "src", environment)));
+	const app = ENVIRONMENTS.filter((environment) => isRealDirectory(join(target, "app", environment)));
+	if (src.length === 0 && app.length === 0) throw new ScaffoldError("TARGET", `No source or application environment directory found under ${target}`, { target });
+	const rawName = ownDataValue(parsed, "name");
+	if (typeof rawName !== "string") throw new ScaffoldError("TARGET", "Manifest name must be a string", {
+		target,
+		name: rawName
+	});
+	const scopedValue = rawName.startsWith("@orkestrel/") ? rawName.slice(11) : void 0;
+	const scopedName = isWorkspaceName(scopedValue);
+	const privateAppName = src.length === 0 && ownDataValue(parsed, "private") === true && isWorkspaceName(rawName);
+	if (!scopedName && !privateAppName) throw new ScaffoldError("TARGET", `Manifest name "${String(rawName)}" is neither an @orkestrel package nor a private application`, {
 		target,
 		name: rawName
 	});
-	const name = rawName.slice(11);
-	const description = typeof parsed.description === "string" ? parsed.description : void 0;
-	const keywords = Array.isArray(parsed.keywords) && parsed.keywords.every((word) => typeof word === "string") ? parsed.keywords : [];
-	const version = typeof parsed.version === "string" ? parsed.version : DEFAULT_VERSION;
-	const engines = isRecord(parsed.engines) && typeof parsed.engines.node === "string" ? parsed.engines.node : DEFAULT_ENGINES;
-	const surfaces = [
-		"core",
-		"browser",
-		"server"
-	].filter((surface) => existsSync(join(target, "src", surface)));
-	if (surfaces.length === 0) throw new ScaffoldError("TARGET", `No surface directory found under ${target}/src`, { target });
-	const dependencies = selectOrkestrelEntries(parsed.dependencies).map(([depName, range]) => ({
+	const name = scopedName ? scopedValue : rawName;
+	const rawDescription = ownDataValue(parsed, "description");
+	const description = typeof rawDescription === "string" ? rawDescription : void 0;
+	const rawKeywords = ownDataValue(parsed, "keywords");
+	const keywords = Array.isArray(rawKeywords) && rawKeywords.every((word) => typeof word === "string") ? rawKeywords : [];
+	const rawVersion = ownDataValue(parsed, "version");
+	const version = typeof rawVersion === "string" ? rawVersion : DEFAULT_VERSION;
+	const rawNode = ownDataValue(ownDataValue(parsed, "engines"), "node");
+	const engines = typeof rawNode === "string" ? rawNode : DEFAULT_ENGINES;
+	const engine = isRealDirectory(join(target, "src", "bin"));
+	const rawDependencies = ownDataValue(parsed, "dependencies");
+	const rawPeerDependencies = ownDataValue(parsed, "peerDependencies");
+	const dependencies = selectOrkestrelEntries(rawDependencies).map(([depName, range]) => ({
 		name: depName,
 		range
 	}));
-	const peersMeta = isRecord(parsed.peerDependenciesMeta) ? parsed.peerDependenciesMeta : void 0;
-	const peers = selectOrkestrelEntries(parsed.peerDependencies).map(([depName, range]) => {
-		const meta = peersMeta !== void 0 ? peersMeta[depName] : void 0;
-		return isRecord(meta) && meta.optional === true ? {
+	const rawPeersMeta = ownDataValue(parsed, "peerDependenciesMeta");
+	const peersMeta = isRecord(rawPeersMeta) ? rawPeersMeta : void 0;
+	const peers = selectOrkestrelEntries(rawPeerDependencies).map(([depName, range]) => {
+		const meta = ownDataValue(peersMeta, depName);
+		return isRecord(meta) && ownDataValue(meta, "optional") === true ? {
 			name: depName,
 			range,
 			optional: true
@@ -147,21 +1813,25 @@ function deriveBlueprint(target) {
 			range
 		};
 	});
-	const peerAndDependencyNames = /* @__PURE__ */ new Set([...selectOrkestrelEntries(parsed.peerDependencies).map(([depName]) => depName), ...selectOrkestrelEntries(parsed.dependencies).map(([depName]) => depName)]);
-	const devDependencies = isRecord(parsed.devDependencies) ? parsed.devDependencies : {};
+	const peerAndDependencyNames = /* @__PURE__ */ new Set([...selectOrkestrelEntries(rawPeerDependencies).map(([depName]) => depName), ...selectOrkestrelEntries(rawDependencies).map(([depName]) => depName)]);
+	const rawDevDependencies = ownDataValue(parsed, "devDependencies");
+	const devDependencies = isRecord(rawDevDependencies) ? rawDevDependencies : {};
+	const extras = Object.entries(devDependencies).filter((entry) => typeof entry[1] === "string").filter(([depName]) => !baselineExtras.has(depName) && !peerAndDependencyNames.has(depName)).map(([depName, range]) => ({
+		name: depName,
+		range
+	}));
 	return blueprint(name, {
-		description,
+		...description === void 0 ? {} : { description },
 		keywords,
-		surfaces,
+		src,
+		app,
 		dependencies,
 		peers,
-		extras: Object.entries(devDependencies).filter((entry) => typeof entry[1] === "string").filter(([depName]) => !BASELINE_EXTRAS.has(depName) && !peerAndDependencyNames.has(depName)).map(([depName, range]) => ({
-			name: depName,
-			range
-		})),
+		extras,
 		version,
 		engines,
-		overrides: []
+		overrides: [],
+		engine
 	});
 }
 /**
@@ -179,21 +1849,33 @@ function deriveBlueprint(target) {
 * ```
 */
 function isVacant(target) {
-	if (!existsSync(target)) return true;
-	if (!statSync(target).isDirectory()) return false;
-	const entries = readdirSync(target);
-	return entries.length === 0 || entries.length === 1 && entries[0] === ".git";
+	if (!isFilesystemPath(target)) return false;
+	const status = attempt(() => lstatSync(target));
+	if (!status.success) return isMissingPathError(status.error);
+	if (!status.value.isDirectory() || status.value.isSymbolicLink()) return false;
+	const handle = opendirSync(target);
+	let first;
+	let second = false;
+	try {
+		first = handle.readSync()?.name;
+		second = first === void 0 ? false : handle.readSync() !== null;
+	} finally {
+		handle.closeSync();
+	}
+	if (first === void 0) return true;
+	if (second || first !== ".git") return false;
+	const metadata = lstatSync(join(target, ".git"));
+	return metadata.isDirectory() && !metadata.isSymbolicLink();
 }
 /**
-* Read a target's current content at a set of relative paths into a
-* `Record<string, string>` — the I/O that feeds the pure `diffPlan`.
+* Read a target's current bytes at a set of relative paths into a
+* byte-exact hexadecimal {@link Snapshot} — the I/O that feeds `diffPlan`.
 *
 * @param target - The target directory to read from.
 * @param paths - The plan-relative artifact paths to probe.
-* @returns A record keyed by path; a directory entry maps to `''` (presence
-*   only — a `host`-origin directory artifact is audited by presence, never
-*   content), an absent path is OMITTED entirely (never an empty-string
-*   placeholder for a missing file, so `diffPlan` reports it `missing`).
+* @returns A snapshot keyed by path; each file maps to its exact lowercase
+*   hexadecimal bytes and a directly requested directory maps to `''`
+*   (presence only). An absent path is omitted entirely.
 * @throws `ScaffoldError('TARGET', …)` when an EXISTING path fails to read
 *   (e.g. `EACCES` / `EPERM`) — carries the offending relative `path` (and
 *   the resolved `full` path) in `context`. An absent path is never an
@@ -204,25 +1886,37 @@ function isVacant(target) {
 * import { readTarget } from '@orkestrel/scaffold/server'
 *
 * readTarget('./packages/router', ['package.json', 'src/core/index.ts'])
-* // { 'package.json': '{ "name": … }', 'src/core/index.ts': '…' }
+* // { 'package.json': '7b226e616d65223a…', 'src/core/index.ts': '6578706f7274…' }
 * ```
 */
 function readTarget(target, paths) {
-	const current = {};
-	for (const path of paths) {
-		const full = join(target, path);
+	if (!isFilesystemPath(target)) throw new ScaffoldError("TARGET", "Target path is malformed or exceeds its bounds", { target });
+	const requested = parsePortablePaths(paths, MAX_COLLECTION_ITEMS);
+	if (requested === void 0) throw new ScaffoldError("TARGET", "Target snapshot paths are malformed", {
+		target,
+		limit: MAX_COLLECTION_ITEMS
+	});
+	let remaining = MAX_TOTAL_ARTIFACT_BYTES;
+	const entries = [];
+	for (const path of requested) {
+		const full = resolvePhysicalPath(target, path, "TARGET", "target");
 		if (!existsSync(full)) continue;
-		try {
-			current[path] = statSync(full).isDirectory() ? "" : readFileSync(full, "utf8");
-		} catch (error) {
-			throw new ScaffoldError("TARGET", `Failed to read target file at ${path}`, {
-				path,
-				full,
-				error
-			});
+		const status = attempt(() => lstatSync(full));
+		if (!status.success || status.value.isSymbolicLink() || !status.value.isDirectory() && (!status.value.isFile() || status.value.nlink !== 1 || status.value.size > remaining)) throw new ScaffoldError("TARGET", `Failed to read target file at ${path}`, {
+			path,
+			full,
+			limit: MAX_TOTAL_ARTIFACT_BYTES,
+			...status.success ? {} : { error: status.error }
+		});
+		if (status.value.isDirectory()) {
+			entries.push([path, ""]);
+			continue;
 		}
+		const hex = readFileHex(target, path, "TARGET", "target", Math.min(MAX_ARTIFACT_BYTES, remaining));
+		remaining -= hex.length / 2;
+		entries.push([path, hex]);
 	}
-	return current;
+	return Object.fromEntries(entries);
 }
 /**
 * Read `target/package.json` text — the read that feeds `manifestToDependencies`.
@@ -241,105 +1935,230 @@ function readTarget(target, paths) {
 * ```
 */
 function readManifest(target) {
+	if (!isFilesystemPath(target)) throw new ScaffoldError("TARGET", "Manifest target is malformed or exceeds its bounds", { target });
 	const full = join(target, "package.json");
-	try {
-		return readFileSync(full, "utf8");
-	} catch (error) {
-		throw new ScaffoldError("TARGET", `Failed to read manifest at ${full}`, {
-			target,
-			full,
-			error
-		});
-	}
-}
-/**
-* Whether `value` is a plain object (not `null`, not an array).
-*
-* @param value - The candidate value.
-* @returns `true` when `value` narrows to `Record<string, unknown>`.
-*
-* @example
-* ```ts
-* import { isRecord } from '@orkestrel/scaffold/server'
-*
-* isRecord({ a: 1 }) // true
-* isRecord(null) // false
-* ```
-*/
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* Whether `value` is a well-formed `host/manifest.json` entry — a string
-* `storage`, a string `destination`, and a boolean `executable`.
-*
-* @param value - The candidate raw manifest entry.
-* @returns `true` when `value` narrows to `ManifestEntry`.
-*
-* @example
-* ```ts
-* import { isManifestEntry } from '@orkestrel/scaffold/server'
-*
-* isManifestEntry({ storage: 'a', destination: 'b', executable: false }) // true
-* isManifestEntry({ storage: 'a', destination: 'b' }) // false — missing `executable`
-* ```
-*/
-function isManifestEntry(value) {
-	if (!isRecord(value)) return false;
-	return typeof value.storage === "string" && typeof value.destination === "string" && typeof value.executable === "boolean";
+	const result = attempt(() => readFileText(target, "package.json", "TARGET", "target", MAX_MANIFEST_BYTES));
+	if (!result.success) throw new ScaffoldError("TARGET", `Failed to read manifest at ${full}`, {
+		target,
+		full,
+		error: result.error
+	});
+	return result.value;
 }
 /**
 * Read and validate a vendored host root's `manifest.json`, when present.
 *
 * @param host - The host root to probe.
-* @returns The parsed entries, or `undefined` when `host` has no
+* @returns The parsed complete manifest, or `undefined` when `host` has no
 *   `manifest.json` — the raw-repo-root fallback (`Materializer` then maps
 *   an artifact's `source` to `host` 1:1, no vendored staging indirection).
 * @throws `ScaffoldError('TARGET', …)` when `manifest.json` exists but is
-*   unreadable, is not valid JSON, or is not an array of `ManifestEntry`.
+*   unreadable, malformed, collision-prone, root-incomplete, or does not map
+*   bijectively and case-exactly onto real contained storage files.
 *
 * @example
 * ```ts
 * import { readHostManifest } from '@orkestrel/scaffold/server'
 *
-* readHostManifest('./dist/host') // readonly ManifestEntry[] | undefined
+* readHostManifest('./dist/host') // HostManifest | undefined
 * ```
 */
 function readHostManifest(host) {
-	const full = join(host, "manifest.json");
+	if (!isFilesystemPath(host)) throw new ScaffoldError("TARGET", "Host path is malformed or exceeds its bounds", { host });
+	const full = resolvePhysicalPath(host, HOST_MANIFEST_PATH, "TARGET", "host");
 	if (!existsSync(full)) return void 0;
-	let text;
-	try {
-		text = readFileSync(full, "utf8");
-	} catch (error) {
-		throw new ScaffoldError("TARGET", `Failed to read host manifest at ${full}`, {
+	const text = attempt(() => readFileText(host, HOST_MANIFEST_PATH, "TARGET", "host", MAX_MANIFEST_BYTES));
+	if (!text.success) throw new ScaffoldError("TARGET", `Failed to read host manifest at ${full}`, {
+		host,
+		full,
+		error: text.error
+	});
+	const manifest = parseJSONAs(text.value, isHostManifest);
+	if (manifest === void 0) throw new ScaffoldError("TARGET", `Host manifest at ${full} is malformed`, {
+		host,
+		full
+	});
+	const destinationConflict = findFileConflict(manifest.entries.map((entry) => entry.destination));
+	if (destinationConflict !== void 0) throw new ScaffoldError("TARGET", `Host manifest destination collision between "${destinationConflict[0]}" and "${destinationConflict[1]}"`, {
+		host,
+		full,
+		field: "destination",
+		paths: destinationConflict
+	});
+	const storageConflict = findFileConflict([HOST_MANIFEST_PATH, ...manifest.entries.map((entry) => entry.storage)]);
+	if (storageConflict !== void 0) throw new ScaffoldError("TARGET", `Host manifest storage collision between "${storageConflict[0]}" and "${storageConflict[1]}"`, {
+		host,
+		full,
+		field: "storage",
+		paths: storageConflict
+	});
+	const rootConflict = findPathConflict(manifest.roots);
+	if (rootConflict !== void 0) throw new ScaffoldError("TARGET", `Host manifest root collision between "${rootConflict[0]}" and "${rootConflict[1]}"`, {
+		host,
+		full,
+		field: "root",
+		paths: rootConflict
+	});
+	const declaredRoots = new Set(manifest.roots);
+	for (const entry of manifest.entries) {
+		const segments = entry.destination.split("/");
+		for (let index = 1; index < segments.length; index += 1) {
+			const root = segments.slice(0, index).join("/");
+			if (!declaredRoots.has(root)) throw new ScaffoldError("TARGET", `Host manifest does not declare destination root "${root}"`, {
+				host,
+				full,
+				root,
+				destination: entry.destination
+			});
+		}
+	}
+	for (const root of manifest.roots) {
+		const foldedRoot = root.toLowerCase();
+		const file = manifest.entries.find((entry) => {
+			const destination = entry.destination.toLowerCase();
+			return foldedRoot === destination || foldedRoot.startsWith(`${destination}/`);
+		});
+		if (file !== void 0) throw new ScaffoldError("TARGET", `Host manifest directory "${root}" conflicts with file "${file.destination}"`, {
 			host,
 			full,
-			error
+			root,
+			destination: file.destination
 		});
 	}
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch (error) {
-		throw new ScaffoldError("TARGET", `Host manifest at ${full} is not valid JSON`, {
+	const listed = attempt(() => listFiles(host));
+	if (!listed.success) throw new ScaffoldError("TARGET", `Failed to inventory host storage at ${host}`, {
+		host,
+		full,
+		error: listed.error
+	});
+	const stored = listed.value.filter((path) => path !== HOST_MANIFEST_PATH);
+	const storedConflict = findPathConflict(stored);
+	if (storedConflict !== void 0) throw new ScaffoldError("TARGET", `Host storage collision between "${storedConflict[0]}" and "${storedConflict[1]}"`, {
+		host,
+		full,
+		paths: storedConflict
+	});
+	const storedByPath = new Map(stored.map((path) => [path.toLowerCase(), path]));
+	const declaredStorage = new Set(manifest.entries.map((entry) => entry.storage.toLowerCase()));
+	for (const path of stored) if (!declaredStorage.has(path.toLowerCase())) throw new ScaffoldError("TARGET", `Host storage file "${path}" is not declared`, {
+		host,
+		full,
+		path
+	});
+	for (const entry of manifest.entries) {
+		const storedPath = storedByPath.get(entry.storage.toLowerCase());
+		if (storedPath === void 0 || storedPath !== entry.storage) throw new ScaffoldError("TARGET", `Host storage file "${entry.storage}" is missing or case-mismatched`, {
+			host,
+			full,
+			storage: entry.storage,
+			actual: storedPath
+		});
+		const storage = resolvePhysicalPath(host, entry.storage, "TARGET", "host");
+		const status = attempt(() => lstatSync(storage));
+		if (!status.success || !status.value.isFile() || status.value.isSymbolicLink() || status.value.nlink !== 1) throw new ScaffoldError("TARGET", `Host storage at "${entry.storage}" is not a file`, {
 			host,
 			full,
-			error
+			storage: entry.storage,
+			error: status.success ? void 0 : status.error
 		});
 	}
-	if (!Array.isArray(parsed) || !parsed.every(isManifestEntry)) throw new ScaffoldError("TARGET", `Host manifest at ${full} is not an array of manifest entries`, {
-		host,
-		full
+	return manifest;
+}
+/**
+* Read one contained file as exact lowercase hexadecimal bytes.
+*
+* @param root - The declared containing root.
+* @param path - The root-relative file path.
+* @param code - The coded failure for containment or reading.
+* @param boundary - The boundary name used in diagnostics.
+* @returns The exact file bytes encoded as lowercase hexadecimal.
+*/
+function readFileHex(root, path, code, boundary, limit = MAX_ARTIFACT_BYTES) {
+	if (!Number.isSafeInteger(limit) || limit < 0 || limit > MAX_ARTIFACT_BYTES) throw new ScaffoldError(code, `Invalid file byte limit at ${path}`, {
+		path,
+		root,
+		limit
+	});
+	if (!isPortablePath(path)) throw new ScaffoldError(code, `Unsafe file path at ${path}`, {
+		path,
+		root
+	});
+	const full = resolvePhysicalPath(root, path, code, boundary);
+	const status = attempt(() => lstatSync(full));
+	if (!status.success || !status.value.isFile() || status.value.isSymbolicLink() || status.value.nlink !== 1) throw new ScaffoldError(code, `File is not a physical readable file at ${path}`, {
+		path,
+		full,
+		...status.success ? {} : { error: status.error }
+	});
+	const opened = attempt(() => openSync(full, "r"));
+	if (!opened.success) throw new ScaffoldError(code, `Failed to read file at ${path}`, {
+		path,
+		full,
+		error: opened.error
 	});
-	return parsed;
+	const handle = opened.value;
+	const result = attempt(() => {
+		const current = fstatSync(handle);
+		if (!current.isFile() || current.nlink !== 1 || current.dev !== status.value.dev || current.ino !== status.value.ino) throw new ScaffoldError(code, `File changed before reading at ${path}`, {
+			path,
+			full
+		});
+		if (current.size > limit) throw new ScaffoldError(code, `File exceeds the artifact limit at ${path}`, {
+			path,
+			full,
+			limit,
+			size: current.size
+		});
+		const bytes = Buffer.alloc(current.size);
+		let offset = 0;
+		while (offset < bytes.byteLength) {
+			const length = readSync(handle, bytes, offset, bytes.byteLength - offset, offset);
+			if (length === 0) break;
+			offset += length;
+		}
+		const overflow = Buffer.alloc(1);
+		const extra = readSync(handle, overflow, 0, overflow.byteLength, offset);
+		const after = fstatSync(handle);
+		const pathStatus = lstatSync(full);
+		if (offset !== bytes.byteLength || extra !== 0 || after.dev !== current.dev || after.ino !== current.ino || after.mtimeMs !== current.mtimeMs || after.size !== current.size || !pathStatus.isFile() || pathStatus.isSymbolicLink() || pathStatus.nlink !== 1 || pathStatus.dev !== current.dev || pathStatus.ino !== current.ino) throw new ScaffoldError(code, `File changed while reading at ${path}`, {
+			path,
+			full
+		});
+		return bytesToHex(bytes);
+	});
+	const closed = attempt(() => closeSync(handle));
+	if (!result.success) throw result.error;
+	if (!closed.success) throw new ScaffoldError(code, `Failed to close file at ${path}`, {
+		path,
+		full,
+		error: closed.error
+	});
+	return result.value;
+}
+/**
+* Read one contained physical file as bounded UTF-8 text.
+*
+* @param root - The declared containing root.
+* @param path - The root-relative file path.
+* @param code - The coded failure for containment or reading.
+* @param boundary - The boundary name used in diagnostics.
+* @returns The exact file bytes decoded as UTF-8 text.
+*/
+function readFileText(root, path, code, boundary, limit = MAX_ARTIFACT_BYTES) {
+	const decoded = attempt(() => new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(readFileHex(root, path, code, boundary, limit), "hex")));
+	if (!decoded.success) throw new ScaffoldError(code, `File is not valid UTF-8 at ${path}`, {
+		path,
+		root,
+		error: decoded.error
+	});
+	return decoded.value;
 }
 /**
 * Recursively list a directory's files as root-relative paths.
 *
 * @param root - The directory to list.
-* @returns Root-relative file paths (posix-style `/` separators), or `[]`
-*   when `root` is absent.
+* @returns Root-relative file paths (posix-style `/` separators), code-unit
+*   sorted, or `[]` when `root` is absent.
 *
 * @example
 * ```ts
@@ -349,20 +2168,122 @@ function readHostManifest(host) {
 * ```
 */
 function listFiles(root) {
-	if (!existsSync(root)) return [];
+	if (!isFilesystemPath(root)) throw new ScaffoldError("TARGET", "Listing root is malformed or exceeds its bounds", { root });
+	const rootStatus = attempt(() => lstatSync(root));
+	if (!rootStatus.success) {
+		if (isMissingPathError(rootStatus.error)) return [];
+		throw new ScaffoldError("TARGET", "Failed to inspect listing root", {
+			root,
+			error: rootStatus.error
+		});
+	}
+	if (!rootStatus.value.isDirectory() || rootStatus.value.isSymbolicLink()) throw new ScaffoldError("TARGET", "Listing root is not a physical directory", { root });
 	const files = [];
-	for (const entry of readdirSync(root, { withFileTypes: true })) {
-		const full = join(root, entry.name);
-		if (entry.isDirectory()) for (const nested of listFiles(full)) files.push(`${entry.name}/${nested}`);
-		else files.push(entry.name);
+	const pending = [{
+		full: root,
+		path: "",
+		depth: 0
+	}];
+	let visited = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (current === void 0) break;
+		const handle = opendirSync(current.full);
+		try {
+			for (;;) {
+				const entry = handle.readSync();
+				if (entry === null) break;
+				visited += 1;
+				if (visited > 4096) throw new ScaffoldError("TARGET", `Host traversal exceeds ${MAX_HOST_ENTRIES} entries`, {
+					root,
+					limit: MAX_HOST_ENTRIES
+				});
+				const path = current.path === "" ? entry.name : `${current.path}/${entry.name}`;
+				if (!isPortablePath(path)) throw new ScaffoldError("TARGET", "Filesystem traversal found a non-portable path");
+				if (entry.isDirectory() && !entry.isSymbolicLink()) {
+					const depth = current.depth + 1;
+					if (depth > 32) throw new ScaffoldError("TARGET", `Host traversal exceeds depth 32`, {
+						root,
+						path,
+						limit: 32
+					});
+					pending.push({
+						full: join(current.full, entry.name),
+						path,
+						depth
+					});
+				} else files.push(path);
+			}
+		} finally {
+			handle.closeSync();
+		}
+	}
+	return files.sort();
+}
+/**
+* Recursively list a directory's descendant directories.
+*
+* @param root - The directory to list.
+* @returns Root-relative POSIX directory paths in code-unit order.
+*/
+function listDirectories(root) {
+	if (!isFilesystemPath(root)) throw new ScaffoldError("TARGET", "Listing root is malformed or exceeds its bounds", { root });
+	const rootStatus = attempt(() => lstatSync(root));
+	if (!rootStatus.success) {
+		if (isMissingPathError(rootStatus.error)) return [];
+		throw new ScaffoldError("TARGET", "Failed to inspect listing root", {
+			root,
+			error: rootStatus.error
+		});
+	}
+	if (!rootStatus.value.isDirectory() || rootStatus.value.isSymbolicLink()) throw new ScaffoldError("TARGET", "Listing root is not a physical directory", { root });
+	const directories = [];
+	const pending = [{
+		full: root,
+		path: "",
+		depth: 0
+	}];
+	let visited = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (current === void 0) break;
+		const handle = opendirSync(current.full);
+		try {
+			for (;;) {
+				const entry = handle.readSync();
+				if (entry === null) break;
+				visited += 1;
+				if (visited > 4096) throw new ScaffoldError("TARGET", `Host traversal exceeds ${MAX_HOST_ENTRIES} entries`, {
+					root,
+					limit: MAX_HOST_ENTRIES
+				});
+				if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+				const path = current.path === "" ? entry.name : `${current.path}/${entry.name}`;
+				if (!isPortablePath(path)) throw new ScaffoldError("TARGET", "Filesystem traversal found a non-portable path");
+				const depth = current.depth + 1;
+				if (depth > 32) throw new ScaffoldError("TARGET", `Host traversal exceeds depth 32`, {
+					root,
+					path,
+					limit: 32
+				});
+				directories.push(path);
+				pending.push({
+					full: join(current.full, entry.name),
+					path,
+					depth
+				});
+			}
+		} finally {
+			handle.closeSync();
+		}
 	}
-	return files;
+	return directories.sort();
 }
 /**
 * Map a repo-relative path to its vendored-host STAGING path, per the
 * dotfile-mapping rule `stageHost` writes into `manifest.json`.
 *
-* @param path - The repo-relative source path (e.g. `.claude/agents/scout.md`).
+* @param path - The repo-relative source path (e.g. `.claude/agents/reviewer.md`).
 * @returns The mapped storage path: a leading-dot TOP-LEVEL FILE maps to
 *   `dotfiles/<name-without-dot>`; a leading-dot DIRECTORY segment loses its
 *   dot wherever it appears; an undotted path is unchanged.
@@ -372,7 +2293,7 @@ function listFiles(root) {
 * import { storagePath } from '@orkestrel/scaffold/server'
 *
 * storagePath('.gitignore') // 'dotfiles/gitignore'
-* storagePath('.claude/agents/scout.md') // 'claude/agents/scout.md'
+* storagePath('.claude/agents/reviewer.md') // 'claude/agents/reviewer.md'
 * storagePath('.github/workflows/ci.yml') // 'github/workflows/ci.yml'
 * storagePath('AGENTS.md') // 'AGENTS.md'
 * ```
@@ -381,6 +2302,7 @@ function storagePath(path) {
 	const segments = path.split("/");
 	if (segments.length === 1) {
 		const name = segments[0];
+		if (name === void 0) return path;
 		return name.startsWith(".") ? `dotfiles/${name.slice(1)}` : name;
 	}
 	return segments.map((segment) => segment.startsWith(".") ? segment.slice(1) : segment).join("/");
@@ -393,26 +2315,20 @@ function storagePath(path) {
 * writes (via `hostRoot` / `readHostManifest`).
 *
 * @param root - The repo root every `paths` entry resolves against.
-* @param out - The output directory to wipe and stage into (typically `dist/host`).
+* @param out - The output directory to replace after staging completes.
 * @param paths - The repo-relative file/directory entries to stage; defaults
 *   to the package's own vendored set (`HOST_PATHS`) — a caller passes an
 *   explicit list only to stage an arbitrary/test set.
 * @remarks
-* `out` is wiped (`rmSync(out, { recursive: true, force: true })`) BEFORE
-* staging, so a stale file left over from a prior run never lingers. Each
-* `paths` entry is walked to its per-file leaves (a directory recursively,
-* via `listFiles`; a file, itself) and copied byte-for-byte
-* (`copyFileSync`) to `<out>/<storagePath(path)>`. The `executable` flag
-* `entries` reports is derived from the `.sh` suffix on `destination` —
-* deterministic on every build platform (Windows `stat` carries no execute
-* bit); all vendored executables are shell scripts by construction.
-* `manifest.json` is written LAST, as `entries` code-unit sorted by
-* `destination`, tab-indented JSON with a trailing newline.
+* Every source, path collision, and root/output relationship is preflighted
+* before output mutation. Files are copied into a temporary sibling; the
+* completed staging tree atomically replaces `out`, with rollback when the
+* swap fails. The manifest records both sorted file `entries` and the
+* complete sorted directory `roots` inventory so destructive consumers can
+* distinguish a declared-empty root from a truncated manifest.
 * @returns The written manifest's entries (`{ storage, destination, executable }`).
-* @throws `ScaffoldError('TARGET', …)` naming the offending path when a
-*   `paths` entry has no source under `root`, or naming BOTH colliding
-*   destinations when two entries map to the same `storagePath` (the guard
-*   run BEFORE `manifest.json` is written).
+* @throws `ScaffoldError('TARGET', …)` for an invalid/escaping source or path
+*   collision, and `ScaffoldError('WRITE', …)` for staging/swap failures.
 *
 * @example
 * ```ts
@@ -423,53 +2339,200 @@ function storagePath(path) {
 * ```
 */
 function stageHost(root, out, paths = HOST_PATHS) {
+	if (!isFilesystemPath(root) || !isFilesystemPath(out)) throw new ScaffoldError("TARGET", "Host root or output is malformed or exceeds its bounds", {
+		root,
+		out
+	});
+	const copiedPaths = parsePortablePaths(paths, MAX_HOST_ENTRIES);
+	if (copiedPaths === void 0) throw new ScaffoldError("TARGET", "Host source paths are malformed", {
+		root,
+		out,
+		limit: MAX_HOST_ENTRIES
+	});
 	const destinations = [];
-	for (const path of paths) {
-		const absolute = join(root, path);
+	const roots = [];
+	const resolvedRoot = resolveRealPath(resolve(root));
+	const resolvedOut = resolveRealPath(resolve(out));
+	if (resolvedRoot === resolvedOut || resolvedRoot.startsWith(resolvedOut + sep)) throw new ScaffoldError("TARGET", `Host output at ${out} contains the source root`, {
+		root,
+		out
+	});
+	for (const path of copiedPaths) {
+		if (!isPortablePath(path) || isSensitiveHostPath(path)) throw new ScaffoldError("TARGET", `Invalid host source path at ${path}`, {
+			path,
+			root
+		});
+		const absolute = resolvePhysicalPath(root, path, "TARGET", "host");
 		if (!existsSync(absolute)) throw new ScaffoldError("TARGET", `Missing host source at ${path}`, {
 			path,
 			root
 		});
-		if (statSync(absolute).isDirectory()) for (const nested of listFiles(absolute)) destinations.push(`${path}/${nested}`);
-		else destinations.push(path);
+		const status = attempt(() => lstatSync(absolute));
+		if (!status.success) throw new ScaffoldError("TARGET", `Failed to inspect host source at ${path}`, {
+			path,
+			root,
+			error: status.error
+		});
+		if (status.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Host source is linked at ${path}`, {
+			path,
+			root
+		});
+		if (status.value.isDirectory()) {
+			const resolvedSource = resolveRealPath(absolute);
+			if (resolvedOut === resolvedSource || resolvedOut.startsWith(resolvedSource + sep)) throw new ScaffoldError("TARGET", `Host output at ${out} is inside source ${path}`, {
+				root,
+				out,
+				path
+			});
+			roots.push(path);
+			for (const nested of listDirectories(absolute)) roots.push(`${path}/${nested}`);
+			for (const nested of listFiles(absolute)) destinations.push(`${path}/${nested}`);
+		} else destinations.push(path);
 	}
-	rmSync(out, {
-		recursive: true,
-		force: true
+	if (destinations.length > 4096 || roots.length > 4096) throw new ScaffoldError("TARGET", "Host source inventory exceeds the entry limit", {
+		root,
+		limit: MAX_HOST_ENTRIES
 	});
 	const entries = [];
+	const expectations = [];
+	let totalBytes = 0;
 	for (const destination of destinations) {
+		if (isSensitiveHostPath(destination)) throw new ScaffoldError("TARGET", `Sensitive host source is not vendorable at ${destination}`, {
+			root,
+			destination
+		});
+		const source = resolvePhysicalPath(root, destination, "TARGET", "host");
+		const status = attempt(() => lstatSync(source));
+		if (!status.success || !status.value.isFile() || status.value.isSymbolicLink() || status.value.nlink !== 1) throw new ScaffoldError("TARGET", `Host source is not a readable file at ${destination}`, {
+			root,
+			destination,
+			error: status.success ? void 0 : status.error
+		});
+		totalBytes += status.value.size;
+		if (totalBytes > MAX_TOTAL_ARTIFACT_BYTES) throw new ScaffoldError("TARGET", "Host source inventory exceeds the aggregate byte limit", {
+			root,
+			limit: MAX_TOTAL_ARTIFACT_BYTES
+		});
+		expectations.push(Object.freeze({
+			path: destination,
+			shape: "file",
+			device: status.value.dev,
+			inode: status.value.ino,
+			modified: status.value.mtimeMs,
+			size: status.value.size,
+			digest: digestFile(source)
+		}));
 		const storage = storagePath(destination);
-		const sourceAbsolute = join(root, destination);
-		const destinationAbsolute = join(out, storage);
-		mkdirSync(dirname(destinationAbsolute), { recursive: true });
-		copyFileSync(sourceAbsolute, destinationAbsolute);
 		const executable = destination.endsWith(".sh");
 		entries.push({
 			storage,
 			destination,
 			executable
 		});
-	}
-	entries.sort((a, b) => a.destination < b.destination ? -1 : a.destination > b.destination ? 1 : 0);
-	const byStorage = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		const existing = byStorage.get(entry.storage);
-		if (existing !== void 0) throw new ScaffoldError("TARGET", `Storage path collision at "${entry.storage}" — destinations "${existing}" and "${entry.destination}" both map to it`, {
-			storage: entry.storage,
-			destinations: [existing, entry.destination]
+		const segments = destination.split("/");
+		for (let index = 1; index < segments.length; index += 1) roots.push(segments.slice(0, index).join("/"));
+	}
+	entries.sort((a, b) => a.destination < b.destination ? -1 : a.destination > b.destination ? 1 : 0);
+	const destinationConflict = findFileConflict(entries.map((entry) => entry.destination));
+	if (destinationConflict !== void 0) throw new ScaffoldError("TARGET", `Destination collision between "${destinationConflict[0]}" and "${destinationConflict[1]}"`, { paths: destinationConflict });
+	const storageConflict = findFileConflict(entries.map((entry) => entry.storage));
+	if (storageConflict !== void 0) {
+		const storageDestinations = entries.filter((entry) => entry.storage.toLowerCase() === storageConflict[0].toLowerCase()).map((entry) => entry.destination);
+		throw new ScaffoldError("TARGET", `Storage collision at "${storageConflict[0]}" between destinations "${storageDestinations[0] ?? ""}" and "${storageDestinations[1] ?? ""}"`, {
+			storage: storageConflict[0],
+			destinations: storageDestinations
+		});
+	}
+	const manifestConflict = findFileConflict([HOST_MANIFEST_PATH, ...entries.map((entry) => entry.storage)]);
+	if (manifestConflict !== void 0) throw new ScaffoldError("TARGET", `Storage path "${manifestConflict[1]}" collides with reserved manifest.json`, { paths: manifestConflict });
+	const uniqueRoots = [...new Set(roots)].sort();
+	if (uniqueRoots.length > 4096) throw new ScaffoldError("TARGET", "Host source inventory exceeds the entry limit", {
+		root,
+		limit: MAX_HOST_ENTRIES
+	});
+	const rootConflict = findPathConflict(uniqueRoots);
+	if (rootConflict !== void 0) throw new ScaffoldError("TARGET", `Directory collision between "${rootConflict[0]}" and "${rootConflict[1]}"`, { paths: rootConflict });
+	const manifest = {
+		entries,
+		roots: uniqueRoots
+	};
+	const parent = dirname(resolve(out));
+	const name = basename(resolve(out));
+	const token = randomUUID();
+	const staging = resolveContainedPath(parent, `.${name}.stage-${token}`, "WRITE", "output");
+	const backup = resolveContainedPath(parent, `.${name}.backup-${token}`, "WRITE", "output");
+	let stagingAnchor;
+	let parentDirectory;
+	const staged = attempt(() => {
+		parentDirectory = createWriteDirectory(parent, "host output parent");
+		validateWriteAnchor(parentDirectory.anchor, "host output parent");
+		mkdirSync(staging, { recursive: false });
+		validateWriteAnchor(parentDirectory.anchor, "host output parent");
+		const stagingStatus = lstatSync(staging);
+		if (!stagingStatus.isDirectory() || stagingStatus.isSymbolicLink()) throw new ScaffoldError("WRITE", "Host staging root is not a physical directory", { staging });
+		stagingAnchor = Object.freeze({
+			path: staging,
+			device: stagingStatus.dev,
+			inode: stagingStatus.ino
+		});
+		for (const entry of entries) {
+			validateWriteAnchor(parentDirectory.anchor, "host output parent");
+			validateWriteAnchor(stagingAnchor, "host staging root");
+			const source = resolvePhysicalPath(root, entry.destination, "TARGET", "host");
+			const expectation = expectations.find((candidate) => candidate.path === entry.destination);
+			const sourceStatus = lstatSync(source);
+			const sourceDigest = digestFile(source);
+			if (expectation === void 0 || !sourceStatus.isFile() || sourceStatus.isSymbolicLink() || sourceStatus.nlink !== 1 || sourceStatus.dev !== expectation.device || sourceStatus.ino !== expectation.inode || sourceStatus.mtimeMs !== expectation.modified || sourceStatus.size !== expectation.size || sourceDigest !== expectation.digest) throw new ScaffoldError("TARGET", `Host source changed at ${entry.destination}`, {
+				root,
+				destination: entry.destination
+			});
+			mkdirSync(dirname(resolvePhysicalPath(staging, entry.storage, "WRITE", "staging")), { recursive: true });
+			validateWriteAnchor(stagingAnchor, "host staging root");
+			const containedDestination = resolvePhysicalPath(staging, entry.storage, "WRITE", "staging");
+			copyFileSync(source, containedDestination, constants.COPYFILE_EXCL);
+			const copiedStatus = lstatSync(containedDestination);
+			if (!copiedStatus.isFile() || copiedStatus.isSymbolicLink() || copiedStatus.nlink !== 1 || digestFile(containedDestination) !== expectation.digest) throw new ScaffoldError("WRITE", `Host staging copy changed at ${entry.destination}`, {
+				staging,
+				destination: entry.destination
+			});
+		}
+		writeFileSync(join(staging, HOST_MANIFEST_PATH), `${JSON.stringify(manifest, null, "	")}\n`, {
+			encoding: "utf8",
+			flag: "wx"
+		});
+		validateWriteAnchor(parentDirectory.anchor, "host output parent");
+		if (readHostManifest(staging) === void 0) throw new ScaffoldError("WRITE", "Staged host manifest could not be verified", { staging });
+	});
+	if (!staged.success) {
+		const identity = stagingAnchor;
+		const cleanup = identity === void 0 ? void 0 : attempt(() => {
+			validateWriteAnchor(identity, "host staging root");
+			rmSync(staging, { recursive: true });
+		});
+		const parentCleanup = attempt(() => {
+			for (const created of [...parentDirectory?.created ?? []].reverse()) {
+				validateWriteAnchor(created, "host output parent");
+				rmdirSync(created.path);
+			}
+		});
+		throw new ScaffoldError("WRITE", `Failed to stage host output at ${out}`, {
+			root,
+			out,
+			error: staged.error,
+			cleanup: cleanup?.success === false ? cleanup.error : void 0,
+			parentCleanup: parentCleanup.success ? void 0 : parentCleanup.error
 		});
-		byStorage.set(entry.storage, entry.destination);
 	}
-	mkdirSync(out, { recursive: true });
-	writeFileSync(join(out, "manifest.json"), `${JSON.stringify(entries, null, "	")}\n`);
+	if (parentDirectory === void 0) throw new ScaffoldError("WRITE", "Host output parent was not established", { out });
+	validateWriteAnchor(parentDirectory.anchor, "host output parent");
+	replaceDirectory(staging, out, backup);
 	return entries;
 }
 /**
 * Resolve the absolute host-storage path for a host-origin artifact's
 * `source`, manifest-aware.
 *
-* @param manifest - The host's parsed `manifest.json` entries, or `undefined`
+* @param manifest - The parsed complete host manifest, or `undefined`
 *   when the host carries none (raw-repo-root fallback).
 * @param source - The artifact's `source` (or `path`) to resolve.
 * @param host - The resolved host root the path is joined against.
@@ -485,27 +2548,54 @@ function stageHost(root, out, paths = HOST_PATHS) {
 * import { locateHostSource } from '@orkestrel/scaffold/server'
 *
 * locateHostSource(undefined, 'package.json', './dist/host') // './dist/host/package.json'
-* locateHostSource([{ storage: 'pkg.tmpl', destination: 'package.json', executable: false }], 'package.json', './dist/host')
+* locateHostSource(
+*   {
+*     entries: [{ storage: 'pkg.tmpl', destination: 'package.json', executable: false }],
+*     roots: [],
+*   },
+*   'package.json',
+*   './dist/host',
+* )
 * // './dist/host/pkg.tmpl'
 * ```
 */
 function locateHostSource(manifest, source, host) {
 	if (manifest === void 0) return join(host, source);
-	const entries = manifest.filter((entry) => entry.destination === source);
+	const entries = manifest.entries.filter((entry) => entry.destination === source);
 	if (entries.length !== 1) return void 0;
-	return join(host, entries[0].storage);
+	const [entry] = entries;
+	return entry === void 0 ? void 0 : join(host, entry.storage);
+}
+/**
+* Map a manifest destination from an artifact's source prefix to its target prefix.
+*
+* @param artifact - The host artifact carrying the target path and optional source.
+* @param destination - The matched manifest destination.
+* @returns The exact target-relative path for the matched manifest file.
+* @throws `ScaffoldError('INVALID', …)` when `destination` is outside the source prefix.
+*/
+function remapArtifactPath(artifact, destination) {
+	const source = artifact.source ?? artifact.path;
+	if (destination === source) return artifact.path;
+	if (!destination.startsWith(`${source}/`)) throw new ScaffoldError("INVALID", `Manifest destination does not match ${source}`, {
+		source,
+		destination
+	});
+	return `${artifact.path}/${destination.slice(source.length + 1)}`;
 }
 /**
-* Rehydrate a `Plan`'s `host`-origin artifacts with their real byte content
-* read from `host` — manifest-aware, via `locateHostSource`.
+* Rehydrate a `Plan`'s `host`-origin artifacts with their exact byte hex read
+* from `host` — manifest-aware, via `locateHostSource`.
 *
 * @param plan - The plan to hydrate.
 * @param host - The resolved host root to read from.
-* @returns A new `Plan` whose file-shaped `host` artifacts carry `content`;
-*   `template` / `computed` artifacts and directory-shaped `host` artifacts
-*   (no single storage file to read) pass through untouched.
-* @throws `ScaffoldError('TARGET', …)` when a resolved, existing host source
-*   file fails to read.
+* @returns A new `Plan` whose file-shaped `host` artifacts carry exact `hex`.
+*   Directory-shaped host artifacts expand into one byte-aware artifact
+*   per file, preserving their group and mapping the artifact/source prefixes.
+*   `template` / `computed` artifacts pass through untouched.
+* @throws `ScaffoldError('TARGET', …)` when the host is not a readable
+*   directory, a present manifest is invalid/incomplete, or a required source
+*   is absent, escaping, not a file/directory as declared, or unreadable.
 *
 * @example
 * ```ts
@@ -515,43 +2605,136 @@ function locateHostSource(manifest, source, host) {
 * ```
 */
 function hydratePlan(plan, host) {
+	if (!isFilesystemPath(host)) throw new ScaffoldError("TARGET", "Host path is malformed or exceeds its bounds", { host });
+	const owned = snapshotPlan(plan);
+	const status = attempt(() => lstatSync(host));
+	if (!status.success || !status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Host root is not a readable directory at ${host}`, {
+		host,
+		error: status.success ? void 0 : status.error
+	});
 	const manifest = readHostManifest(host);
-	const artifacts = plan.artifacts.map((artifact) => {
-		if (artifact.origin !== "host") return artifact;
+	const artifacts = [];
+	let remaining = MAX_TOTAL_ARTIFACT_BYTES;
+	for (const artifact of owned.artifacts) if (artifact.origin !== "host") remaining -= Buffer.byteLength(artifact.content, "utf8");
+	for (const artifact of owned.artifacts) {
+		if (artifact.origin !== "host") {
+			artifacts.push(artifact);
+			continue;
+		}
 		const source = artifact.source ?? artifact.path;
+		if (!isPortablePath(source) || isSensitiveHostPath(source)) throw new ScaffoldError("TARGET", `Unsafe host artifact source at ${source}`, {
+			host,
+			source
+		});
 		const full = locateHostSource(manifest, source, host);
-		if (full === void 0 || !existsSync(full) || statSync(full).isDirectory()) return artifact;
-		try {
-			return {
+		const relative$1 = full === void 0 ? void 0 : relative(host, full).split(sep).join("/");
+		if (relative$1 !== void 0) {
+			const contained = resolvePhysicalPath(host, relative$1, "TARGET", "host");
+			if (existsSync(contained)) {
+				const exact = attempt(() => lstatSync(contained));
+				if (!exact.success) throw new ScaffoldError("TARGET", `Failed to inspect host artifact source at ${source}`, {
+					host,
+					source,
+					error: exact.error
+				});
+				if (exact.value.isFile() && !exact.value.isSymbolicLink() && exact.value.nlink === 1) {
+					const hex = readFileHex(host, relative$1, "TARGET", "host", Math.min(MAX_ARTIFACT_BYTES, remaining));
+					remaining -= hex.length / 2;
+					artifacts.push({
+						...artifact,
+						hex
+					});
+					continue;
+				}
+				if (manifest !== void 0) throw new ScaffoldError("TARGET", `Host artifact source is not a file at ${source}`, {
+					host,
+					source
+				});
+			}
+			if (manifest !== void 0) throw new ScaffoldError("TARGET", `Host artifact source is missing at ${source}`, {
+				host,
+				source
+			});
+		}
+		if (manifest !== void 0) {
+			const entries = manifest.entries.filter((entry) => entry.destination.startsWith(`${source}/`));
+			if (artifacts.length + entries.length > MAX_COLLECTION_ITEMS) throw new ScaffoldError("TARGET", "Hydrated plan exceeds the artifact count limit", {
+				host,
+				limit: MAX_COLLECTION_ITEMS
+			});
+			if (entries.length === 0) {
+				if (source.startsWith("guides/src/") && source.endsWith(".md")) {
+					artifacts.push(artifact);
+					continue;
+				}
+				throw new ScaffoldError("TARGET", `Host manifest does not declare ${source}`, {
+					host,
+					source
+				});
+			}
+			for (const entry of entries) {
+				if (isSensitiveHostPath(entry.destination)) throw new ScaffoldError("TARGET", `Sensitive host artifact source at ${entry.destination}`, {
+					host,
+					source: entry.destination
+				});
+				const nestedPath = entry.destination.slice(source.length + 1);
+				const hex = readFileHex(host, entry.storage, "TARGET", "host", Math.min(MAX_ARTIFACT_BYTES, remaining));
+				remaining -= hex.length / 2;
+				artifacts.push({
+					...artifact,
+					path: `${artifact.path}/${nestedPath}`,
+					source: entry.destination,
+					hex
+				});
+			}
+			continue;
+		}
+		const directory = resolvePhysicalPath(host, source, "TARGET", "host");
+		if (!existsSync(directory)) throw new ScaffoldError("TARGET", `Host artifact source is missing at ${source}`, {
+			host,
+			source
+		});
+		const directoryStatus = attempt(() => lstatSync(directory));
+		if (!directoryStatus.success || !directoryStatus.value.isDirectory() || directoryStatus.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Host artifact source is not a directory at ${source}`, {
+			host,
+			source,
+			error: directoryStatus.success ? void 0 : directoryStatus.error
+		});
+		const relatives = listFiles(directory);
+		if (artifacts.length + relatives.length > MAX_COLLECTION_ITEMS) throw new ScaffoldError("TARGET", "Hydrated plan exceeds the artifact count limit", {
+			host,
+			limit: MAX_COLLECTION_ITEMS
+		});
+		if (relatives.length === 0) {
+			artifacts.push(artifact);
+			continue;
+		}
+		for (const nestedPath of relatives) {
+			const nestedSource = `${source}/${nestedPath}`;
+			if (isSensitiveHostPath(nestedSource)) throw new ScaffoldError("TARGET", `Sensitive host artifact source at ${nestedSource}`, {
+				host,
+				source: nestedSource
+			});
+			const hex = readFileHex(host, nestedSource, "TARGET", "host", Math.min(MAX_ARTIFACT_BYTES, remaining));
+			remaining -= hex.length / 2;
+			artifacts.push({
 				...artifact,
-				content: readFileSync(full, "utf8")
-			};
-		} catch (error) {
-			throw new ScaffoldError("TARGET", `Failed to read host artifact at ${source}`, {
-				source,
-				full,
-				error
+				path: `${artifact.path}/${nestedPath}`,
+				source: nestedSource,
+				hex
 			});
 		}
-	});
-	return {
-		...plan,
+	}
+	const conflict = findFileConflict(artifacts.map((artifact) => artifact.path));
+	if (conflict !== void 0) throw new ScaffoldError("INVALID", `Hydrated artifact collision between "${conflict[0]}" and "${conflict[1]}"`, { paths: conflict });
+	const hydrated = {
+		...owned,
 		artifacts
 	};
+	if (!isPlan(hydrated)) throw new ScaffoldError("INVALID", "Hydrated plan violates the bounded Plan contract");
+	return hydrated;
 }
 /**
-* The `prune`-owned directories — a hard allowlist; `pruneTargets` (and the
-* `Materializer.prune` that consumes it) never scans anything outside these two.
-*
-* @example
-* ```ts
-* import { PRUNE_DIRECTORIES } from '@orkestrel/scaffold/server'
-*
-* PRUNE_DIRECTORIES // ['.claude/agents', 'scripts']
-* ```
-*/
-var PRUNE_DIRECTORIES = [".claude/agents", "scripts"];
-/**
 * The vendored set of destination-relative paths under `directory` (one of
 * `PRUNE_DIRECTORIES`) that `pruneTargets` must NOT report — read from the
 * manifest's `destination`s when `host` has one, else listed straight off
@@ -576,7 +2759,7 @@ var PRUNE_DIRECTORIES = [".claude/agents", "scripts"];
 * ```ts
 * import { vendoredPruneSet } from '@orkestrel/scaffold/server'
 *
-* vendoredPruneSet('./dist/host', '.claude/agents') // Set { '.claude/agents/scout.md', … }
+* vendoredPruneSet('./dist/host', '.claude/agents') // Set { '.claude/agents/reviewer.md', … }
 * ```
 */
 function vendoredPruneSet(host, directory) {
@@ -585,18 +2768,30 @@ function vendoredPruneSet(host, directory) {
 		directory
 	});
 	const manifest = readHostManifest(host);
-	if (manifest !== void 0) return new Set(manifest.filter((entry) => entry.destination.startsWith(`${directory}/`)).map((entry) => entry.destination));
-	const hostDirectory = join(host, directory);
+	if (manifest !== void 0) {
+		if (!manifest.roots.includes(directory)) throw new ScaffoldError("TARGET", `Cannot establish vendored source for prune: manifest does not declare ${directory}`, {
+			host,
+			directory
+		});
+		return new Set(manifest.entries.filter((entry) => entry.destination.startsWith(`${directory}/`)).map((entry) => entry.destination));
+	}
+	const hostDirectory = resolvePhysicalPath(host, directory, "TARGET", "host");
 	if (!existsSync(hostDirectory)) throw new ScaffoldError("TARGET", `Cannot establish vendored source for prune: no manifest.json and no host directory at ${hostDirectory}`, {
 		host,
 		directory
 	});
+	const hostStatus = attempt(() => lstatSync(hostDirectory));
+	if (!hostStatus.success || !hostStatus.value.isDirectory() || hostStatus.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Cannot establish vendored source for prune: host directory is not physical at ${hostDirectory}`, {
+		host,
+		directory,
+		...hostStatus.success ? {} : { error: hostStatus.error }
+	});
 	return new Set(listFiles(hostDirectory).map((relative) => `${directory}/${relative}`));
 }
 /**
 * List the repo-relative POSIX paths under `target`'s prune directories
-* (`.claude/agents`, `scripts`) that the vendored `host` allowlist does NOT
-* declare — THE single source of truth for prune drift, consumed by both
+* (`.claude/agents`, `.codex/agents`, `scripts`) that the vendored `host`
+* allowlist does NOT declare — THE single source of truth for prune drift, consumed by both
 * `Materializer.prune` (which deletes exactly these paths) and the bin's
 * audit/preview UX (which now shows them honestly instead of a
 * structurally-always-zero `audit.foreign`).
@@ -618,10 +2813,20 @@ function vendoredPruneSet(host, directory) {
 * ```
 */
 function pruneTargets(target, host) {
+	if (!isFilesystemPath(target) || !isFilesystemPath(host)) throw new ScaffoldError("TARGET", "Prune root is malformed or exceeds its bounds", {
+		target,
+		host
+	});
 	const paths = [];
 	for (const directory of PRUNE_DIRECTORIES) {
-		const root = join(target, directory);
+		const root = resolvePhysicalPath(target, directory, "TARGET", "target");
 		if (!existsSync(root)) continue;
+		const status = attempt(() => lstatSync(root));
+		if (!status.success || !status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Prune root is not a physical directory at ${root}`, {
+			target,
+			directory,
+			...status.success ? {} : { error: status.error }
+		});
 		const allowed = vendoredPruneSet(host, directory);
 		for (const relative of listFiles(root)) {
 			const path = `${directory}/${relative}`;
@@ -630,6 +2835,22 @@ function pruneTargets(target, host) {
 	}
 	return paths;
 }
+/** Consume one aggregate fleet-catalog traversal slot. */
+function consumeCatalogAllowance(allowance, root) {
+	const consumed = attempt(() => {
+		if (!isCatalogAllowance(allowance)) throw new Error("allowance must be one Float64 cell");
+		const remaining = allowance[0];
+		if (remaining === void 0 || !Number.isSafeInteger(remaining) || remaining < 1 || remaining > 4096) throw new Error("allowance is outside its bounds");
+		const next = remaining - 1;
+		allowance[0] = next;
+		if (allowance[0] !== next) throw new Error("allowance decrement was not retained");
+	});
+	if (!consumed.success) throw new ScaffoldError("TARGET", "Fleet catalog exceeds its aggregate entry limit", {
+		root,
+		limit: MAX_HOST_ENTRIES,
+		error: consumed.error
+	});
+}
 /**
 * List a fleet root's `@orkestrel/*` package directories.
 *
@@ -647,26 +2868,71 @@ function pruneTargets(target, host) {
 * discoverPackages('./packages') // ['/abs/packages/router', '/abs/packages/budget']
 * ```
 */
-function discoverPackages(root) {
+function discoverPackages(root, allowance = new Float64Array([MAX_HOST_ENTRIES])) {
+	if (!isCatalogAllowance(allowance)) throw new ScaffoldError("TARGET", "Fleet catalog allowance is malformed", {
+		root,
+		limit: MAX_HOST_ENTRIES
+	});
+	if (!isFilesystemPath(root)) throw new ScaffoldError("TARGET", "Fleet root is malformed or exceeds its bounds", { root });
+	const rootStatus = attempt(() => lstatSync(root));
+	if (!rootStatus.success || !rootStatus.value.isDirectory() || rootStatus.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Fleet root is not a physical directory at ${root}`, {
+		root,
+		...rootStatus.success ? {} : { error: rootStatus.error }
+	});
 	const packages = [];
-	for (const entry of readdirSync(root, { withFileTypes: true })) {
-		if (!entry.isDirectory()) continue;
-		const directory = join(root, entry.name);
-		const manifestPath = join(directory, "package.json");
-		if (!existsSync(manifestPath)) continue;
-		let parsed;
-		try {
-			parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
-		} catch {
-			continue;
+	const handle = opendirSync(root);
+	try {
+		for (;;) {
+			const entry = handle.readSync();
+			if (entry === null) break;
+			consumeCatalogAllowance(allowance, root);
+			if (!entry.isDirectory()) continue;
+			const directory = join(root, entry.name);
+			const text = attempt(() => readFileText(directory, "package.json", "TARGET", "package", MAX_MANIFEST_BYTES));
+			if (!text.success) continue;
+			const parsed = parseJSON(text.value);
+			if (!isRecord(parsed)) continue;
+			const name = ownDataValue(parsed, "name");
+			if (typeof name !== "string" || !DEPENDENCY_NAME_PATTERN.test(name)) continue;
+			if (!isPortablePath(entry.name)) throw new ScaffoldError("TARGET", "Fleet discovery found a non-portable directory");
+			packages.push(directory);
 		}
-		if (!isRecord(parsed)) continue;
-		const name = parsed.name;
-		if (typeof name === "string" && name.startsWith("@orkestrel/")) packages.push(directory);
+	} finally {
+		handle.closeSync();
 	}
 	return packages.sort();
 }
 /**
+* Extract the first paragraph from the first blockquote in a Markdown guide.
+*
+* @param text - The guide Markdown to traverse.
+* @returns A normalized one-line description, or `undefined` when parsing
+*   fails, no blockquote paragraph exists, or the paragraph is empty.
+*
+* @example
+* ```ts
+* import { guideToDescription } from '@orkestrel/scaffold/server'
+*
+* guideToDescription('> A concise package description.\n>\n> More detail.')
+* // 'A concise package description.'
+* ```
+*/
+function guideToDescription(text) {
+	if (text.length > MAX_GUIDE_BYTES || contentByteLength(text) > MAX_GUIDE_BYTES) return;
+	const parsed = attempt(() => parseDocument(text));
+	if (!parsed.success) return void 0;
+	let quote;
+	for (const node of walkNodes(parsed.value)) if (isBlockquoteNode(node)) {
+		quote = node;
+		break;
+	}
+	if (quote === void 0) return void 0;
+	const paragraph = quote.children.find((child) => isParagraphNode(child));
+	if (paragraph === void 0) return void 0;
+	const description = flattenText(paragraph).replace(/\s+/g, " ").trim();
+	return description.length > 0 && isCatalogDescription(description) ? description : void 0;
+}
+/**
 * Build the fleet package catalog — one `CatalogEntry` per `@orkestrel/*`
 * package discovered under each root, its description drawn from its own
 * guide's FIRST blockquote.
@@ -698,47 +2964,39 @@ function discoverPackages(root) {
 * catalogPackages(['/repos']) // [{ name: '@orkestrel/contract', version: '0.0.5', description: '…' }, …]
 * ```
 */
-function catalogPackages(roots) {
+function catalogPackages(roots, limit = MAX_HOST_ENTRIES) {
+	const requested = parseFilesystemPaths(roots, MAX_HOST_ENTRIES);
+	if (requested === void 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 4096) throw new ScaffoldError("TARGET", "Catalog roots are malformed", { limit: MAX_HOST_ENTRIES });
 	const merged = /* @__PURE__ */ new Map();
-	for (const root of roots) for (const directory of discoverPackages(root)) {
-		let parsed;
-		try {
-			parsed = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
-		} catch {
-			continue;
-		}
-		if (!isRecord(parsed)) continue;
-		const name = parsed.name;
-		if (typeof name !== "string" || !name.startsWith("@orkestrel/")) continue;
-		const version = typeof parsed.version === "string" ? parsed.version : DEFAULT_VERSION;
-		const guidePath = join(directory, "guides", "src", `${name.slice(11)}.md`);
-		let description = "";
-		if (existsSync(guidePath)) try {
-			const document = parseDocument(readFileSync(guidePath, "utf8"));
-			let quote;
-			for (const node of walkNodes(document)) if (isBlockquoteNode(node)) {
-				quote = node;
-				break;
-			}
-			if (quote !== void 0) {
-				const paragraph = quote.children.find((child) => isParagraphNode(child));
-				if (paragraph !== void 0) description = flattenText(paragraph).replace(/\s+/g, " ").trim();
-			}
-		} catch {
-			description = "";
+	const allowance = new Float64Array([limit]);
+	for (const root of requested) {
+		consumeCatalogAllowance(allowance, root);
+		for (const directory of discoverPackages(root, allowance)) {
+			const text = attempt(() => readFileText(directory, "package.json", "TARGET", "package", MAX_MANIFEST_BYTES));
+			if (!text.success) continue;
+			const parsed = parseJSON(text.value);
+			if (!isRecord(parsed)) continue;
+			const name = ownDataValue(parsed, "name");
+			if (typeof name !== "string" || !DEPENDENCY_NAME_PATTERN.test(name)) continue;
+			const version = ownDataValue(parsed, "version");
+			if (typeof version !== "string" || !VERSION_PATTERN.test(version)) continue;
+			const short = packageShortName(name);
+			let description = "";
+			const guide = attempt(() => readFileText(directory, `guides/src/${short}.md`, "TARGET", "package", MAX_GUIDE_BYTES));
+			if (guide.success) description = guideToDescription(guide.value) ?? "";
+			merged.set(name, {
+				name,
+				version,
+				description
+			});
 		}
-		merged.set(name, {
-			name,
-			version,
-			description
-		});
 	}
 	return [...merged.values()].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
 }
 //#endregion
 //#region src/server/Materializer.ts
 /**
-* The materialization entity (server) — the only impure surface in the
+* The materialization entity (server) — the only impure environment in the
 * package, writing a `Plan` to `node:fs` behind an explicit call.
 *
 * @remarks
@@ -748,10 +3006,16 @@ function catalogPackages(roots) {
 * `content`, failing fast on any write error (`ScaffoldError('WRITE', …)`).
 * `repair` is into-existing: it skips the vacancy check and writes ONLY the
 * `missing` / `stale` artifacts an `Audit` names, leaving `aligned` ones
-* untouched. `prune` deletes stale files under `target/.claude/agents/` and
-* `target/scripts/` that the vendored `host` no longer names — the retired
-* `mirror.sh`/`scaffold.sh` cleanup step, now a method. After `destroy()`
+* untouched. Hydrated directory-shaped host entries are expanded into
+* file-shaped artifacts, so canonical skills and agent configuration are
+* audited and repaired file by file. `prune` deletes stale files under
+* `target/.claude/agents/`, `target/.codex/agents/`, and `target/scripts/`
+* that the vendored `host` does not name. After `destroy()`
 * every method throws `DESTROYED`; teardown is idempotent, emitter last.
+* Before the vacancy check or any write, `materialize` and `repair` require a
+* structural `isPlan` match and a valid `validatePlan` result. Contextual
+* overrides that are missing from the artifact set, host-owned, or target
+* `package.json` therefore fail closed instead of being silently ignored.
 *
 * @remarks
 * `host`-origin copies are MANIFEST-AWARE: when the resolved `host` root
@@ -811,40 +3075,34 @@ function catalogPackages(roots) {
 * import { blueprint, blueprintToPlan } from '@orkestrel/scaffold'
 * import { createMaterializer } from '@orkestrel/scaffold/server'
 *
-* const plan = blueprintToPlan(blueprint('budget', { surfaces: ['core'] }))
+* const plan = blueprintToPlan(blueprint('budget', { src: ['core'] }))
 * const materializer = createMaterializer()
 * materializer.materialize(plan, './packages/budget-new')
 * materializer.destroy()
 * ```
 */
-var Materializer = class Materializer {
+var Materializer = class {
 	#emitter;
 	#host;
 	#manifestLoaded = false;
-	#manifestEntries;
+	#manifestValue;
 	#destroyed = false;
 	constructor(options) {
+		const parsed = parseMaterializerOptions(options);
 		this.#emitter = new Emitter({
-			on: options?.on,
-			error: options?.error
+			...parsed.on === void 0 ? {} : { on: parsed.on },
+			...parsed.error === void 0 ? {} : { error: parsed.error }
 		});
-		this.#host = options?.host ?? hostRoot();
+		this.#host = parsed.host ?? hostRoot();
 	}
 	get emitter() {
 		return this.#emitter;
 	}
 	materialize(plan, target) {
 		this.#ensureAlive();
+		const prepared = this.#prepare(plan, target);
 		if (!isVacant(target)) throw new ScaffoldError("TARGET", "materialize requires a vacant target", { target });
-		const written = [];
-		const copied = [];
-		for (const artifact of plan.artifacts) if (artifact.origin === "host") {
-			this.#copy(artifact, target);
-			copied.push(artifact.path);
-		} else {
-			this.#write(artifact, target);
-			written.push(artifact.path);
-		}
+		const { written, copied } = this.#apply(prepared, target);
 		const result = {
 			target,
 			written,
@@ -857,24 +3115,39 @@ var Materializer = class Materializer {
 	}
 	repair(plan, audit, target) {
 		this.#ensureAlive();
-		const drifted = new Map(audit.findings.map((finding) => [finding.path, finding.drift]));
-		const written = [];
-		const copied = [];
+		const context = this.#prepare(plan, target, plan, false);
+		if (!hasOnlyDataProperties(audit) || !hasValidAuditBytes(audit)) throw new ScaffoldError("INVALID", "repair requires a bounded audit snapshot");
+		const preview = attempt(() => structuredClone(audit));
+		if (!preview.success || !Array.isArray(preview.value.findings)) throw new ScaffoldError("INVALID", "repair requires a structurally valid audit", { ...preview.success ? {} : { error: preview.error } });
+		const drifted = new Set(preview.value.findings.filter((finding) => finding.drift === "missing" || finding.drift === "stale").map((finding) => finding.path));
+		const selected = {
+			...context,
+			artifacts: context.artifacts.filter((artifact) => drifted.has(artifact.path))
+		};
+		const prepared = this.#prepare(selected, target, context);
+		const preparedByPath = new Map(prepared.artifacts.map((artifact) => [artifact.path, artifact]));
+		const comparison = {
+			...context,
+			artifacts: context.artifacts.map((artifact) => preparedByPath.get(artifact.path) ?? artifact)
+		};
+		const current = diffPlan(comparison, readTarget(target, comparison.artifacts.map((artifact) => artifact.path)));
+		if (JSON.stringify(current.findings) !== JSON.stringify(preview.value.findings)) throw new ScaffoldError("TARGET", "Repair target changed after its audit preview", { target });
+		const preconditions = prepared.artifacts.map((artifact) => {
+			const finding = preview.value.findings.find((candidate) => candidate.path === artifact.path);
+			if (finding?.drift === "missing") return {
+				path: artifact.path,
+				shape: "absent"
+			};
+			if (finding?.drift === "stale" && finding.observed !== void 0) return {
+				path: artifact.path,
+				shape: "file",
+				digest: digestHex(finding.observed)
+			};
+			throw new ScaffoldError("INVALID", `Repair precondition is missing at ${artifact.path}`, { path: artifact.path });
+		});
 		const skipped = [];
-		for (const artifact of plan.artifacts) {
-			const drift = drifted.get(artifact.path);
-			if (drift !== "missing" && drift !== "stale") {
-				skipped.push(artifact.path);
-				continue;
-			}
-			if (artifact.origin === "host") {
-				this.#copy(artifact, target);
-				copied.push(artifact.path);
-			} else {
-				this.#write(artifact, target);
-				written.push(artifact.path);
-			}
-		}
+		for (const artifact of context.artifacts) if (!drifted.has(artifact.path)) skipped.push(artifact.path);
+		const { written, copied } = this.#apply(prepared, target, preconditions);
 		const result = {
 			target,
 			written,
@@ -885,14 +3158,75 @@ var Materializer = class Materializer {
 		this.#emitter.emit("done", result);
 		return result;
 	}
-	prune(target) {
+	prune(target, expected) {
 		this.#ensureAlive();
-		const removed = [];
-		for (const path of pruneTargets(target, this.#host)) {
-			unlinkSync(Materializer.#assertContained(target, path, "WRITE", path));
-			removed.push(path);
-			this.#emitter.emit("remove", path);
+		if (!isFilesystemPath(target)) throw new ScaffoldError("TARGET", "Prune target is malformed or exceeds its bounds", { target });
+		const paths = pruneTargets(target, this.#host);
+		if (!hasOnlyDataProperties(expected) || !hasValidSnapshotBytes(expected)) throw new ScaffoldError("TARGET", "Prune preview is malformed or unbounded", { target });
+		const preview = attempt(() => structuredClone(expected));
+		const expectedPaths = preview.success ? Object.keys(preview.value).sort() : [];
+		if (!preview.success || JSON.stringify(expectedPaths) !== JSON.stringify([...paths].sort()) || JSON.stringify(readTarget(target, paths)) !== JSON.stringify(preview.value)) throw new ScaffoldError("TARGET", "Prune targets changed after their preview", {
+			target,
+			...preview.success ? {} : { error: preview.error }
+		});
+		if (paths.length === 0) {
+			const result = {
+				target,
+				written: [],
+				copied: [],
+				skipped: [],
+				removed: []
+			};
+			this.#emitter.emit("done", result);
+			return result;
+		}
+		const transaction = WriteTransaction.create(target, []);
+		const files = paths.map((path) => {
+			resolvePhysicalPath(target, path, "WRITE", "target");
+			return { path };
+		});
+		const moved = [];
+		const staged = attempt(() => {
+			for (const file of files) {
+				validateWriteTarget(transaction, void 0);
+				const source = resolvePhysicalPath(target, file.path, "WRITE", "target");
+				const sourceStatus = lstatSync(source);
+				if (!sourceStatus.isFile() || sourceStatus.isSymbolicLink() || sourceStatus.nlink !== 1) throw new ScaffoldError("WRITE", `Prune target is not a physical file at ${file.path}`, { path: file.path });
+				const sourceDigest = digestFile(source);
+				const expectedHex = preview.value[file.path];
+				if (expectedHex === void 0 || sourceDigest !== digestHex(expectedHex)) throw new ScaffoldError("WRITE", `Prune target changed at ${file.path}`, { path: file.path });
+				mkdirSync(dirname(resolvePhysicalPath(transaction.backup, file.path, "WRITE", "quarantine")), { recursive: true });
+				validateWriteTarget(transaction, void 0);
+				const containedDestination = resolvePhysicalPath(transaction.backup, file.path, "WRITE", "quarantine");
+				renameSync(source, containedDestination);
+				moved.push(file);
+				const capturedStatus = lstatSync(containedDestination);
+				const capturedDigest = digestFile(containedDestination);
+				if (!capturedStatus.isFile() || capturedStatus.isSymbolicLink() || capturedStatus.nlink !== 1 || capturedStatus.dev !== sourceStatus.dev || capturedStatus.ino !== sourceStatus.ino || capturedStatus.mtimeMs !== sourceStatus.mtimeMs || capturedStatus.size !== sourceStatus.size || capturedDigest !== sourceDigest) throw new ScaffoldError("WRITE", `Prune target changed at ${file.path}`, { path: file.path });
+			}
+		});
+		if (!staged.success) {
+			const recovery = attempt(() => restoreFiles(transaction, moved.map((file) => file.path)));
+			const cleanup = recovery.success ? attempt(() => discardWriteTransaction(transaction)) : void 0;
+			throw new ScaffoldError("WRITE", "Failed to stage prune targets", {
+				target,
+				error: staged.error,
+				quarantine: transaction.backup,
+				committed: false,
+				recovery: recovery.success ? void 0 : recovery.error,
+				cleanup: cleanup?.success === false ? cleanup.error : void 0
+			});
 		}
+		const removed = files.map((file) => file.path);
+		const cleared = attempt(() => discardWriteTransaction(transaction));
+		if (!cleared.success) throw new ScaffoldError("WRITE", "Prune committed with cleanup residue", {
+			target,
+			error: cleared.error,
+			quarantine: transaction.backup,
+			committed: true,
+			removed
+		});
+		for (const path of removed) this.#emitter.emit("remove", path);
 		const result = {
 			target,
 			written: [],
@@ -909,100 +3243,183 @@ var Materializer = class Materializer {
 		this.#emitter.emit("destroy");
 		this.#emitter.destroy();
 	}
-	#copy(artifact, target) {
-		const source = artifact.source ?? artifact.path;
-		const manifest = this.#manifest();
-		if (manifest === void 0) {
-			const from = Materializer.#assertContained(this.#host, source, "TARGET", artifact.path);
-			const to = Materializer.#assertContained(target, artifact.path, "WRITE", artifact.path);
-			try {
-				mkdirSync(dirname(to), { recursive: true });
-				cpSync(from, to, { recursive: true });
-			} catch (error) {
-				this.#emitter.emit("error", error);
-				throw new ScaffoldError("WRITE", `Failed to copy host artifact at ${artifact.path}`, {
-					path: artifact.path,
-					error
-				});
+	#apply(plan, target, preconditions) {
+		if (plan.artifacts.length === 0) return {
+			written: [],
+			copied: []
+		};
+		const paths = plan.artifacts.map((artifact) => artifact.path);
+		const transaction = WriteTransaction.create(target, paths, preconditions);
+		const staged = attempt(() => {
+			for (const artifact of plan.artifacts) {
+				validateWriteDirectories(transaction);
+				if (artifact.origin === "host") this.#copy(artifact, transaction);
+				else this.#write(artifact, transaction);
 			}
-			this.#emitter.emit("copy", artifact.path);
-			return;
+		});
+		if (!staged.success) {
+			const cleanup = attempt(() => discardWriteTransaction(transaction));
+			this.#emitter.emit("error", staged.error);
+			throw new ScaffoldError("WRITE", "Failed to stage materialization", {
+				target,
+				error: staged.error,
+				cleanup: cleanup.success ? void 0 : cleanup.error
+			});
+		}
+		const committed = attempt(() => commitWriteTransaction(transaction, paths));
+		if (!committed.success) {
+			this.#emitter.emit("error", committed.error);
+			throw committed.error;
 		}
-		const entries = manifest.filter((entry) => entry.destination === source || entry.destination.startsWith(`${source}/`));
-		if (entries.length === 0) {
+		const written = plan.artifacts.filter((artifact) => artifact.origin !== "host").map((artifact) => artifact.path);
+		const copied = plan.artifacts.filter((artifact) => artifact.origin === "host").map((artifact) => artifact.path);
+		for (const path of written) this.#emitter.emit("write", path);
+		for (const path of copied) this.#emitter.emit("copy", path);
+		return {
+			written,
+			copied
+		};
+	}
+	#copy(artifact, transaction) {
+		const source = artifact.source ?? artifact.path;
+		const manifest = this.#manifest();
+		const entries = manifest?.entries.filter((entry) => entry.destination === source || entry.destination.startsWith(`${source}/`)) ?? [];
+		if (manifest !== void 0 && entries.length === 0) {
 			if (!source.startsWith("guides/src/") || !source.endsWith(".md")) throw new ScaffoldError("TARGET", `Manifest entry for "${source}" is missing — the vendored manifest may be corrupted or truncated`, {
-				target,
+				target: transaction.stage,
 				source
 			});
-			const to = Materializer.#assertContained(target, artifact.path, "WRITE", artifact.path);
+			const to = resolvePhysicalPath(transaction.stage, artifact.path, "WRITE", "staging");
 			try {
 				mkdirSync(dirname(to), { recursive: true });
-				writeFileSync(to, Materializer.#stub(source), "utf8");
+				validateWriteDirectories(transaction);
+				const destination = resolvePhysicalPath(transaction.stage, artifact.path, "WRITE", "staging");
+				const content = guideStub(source);
+				writeFileSync(destination, content, {
+					encoding: "utf8",
+					flag: "wx"
+				});
+				const status = lstatSync(destination);
+				if (!status.isFile() || status.isSymbolicLink() || status.nlink !== 1 || digestFile(destination) !== digestText(content)) throw new Error(`staged guide pointer changed at ${artifact.path}`);
+				validateWriteDirectories(transaction);
 			} catch (error) {
-				this.#emitter.emit("error", error);
 				throw new ScaffoldError("WRITE", `Failed to write host artifact stub at ${artifact.path}`, {
 					path: artifact.path,
 					error
 				});
 			}
-			this.#emitter.emit("copy", artifact.path);
 			return;
 		}
-		for (const entry of entries) {
-			const from = Materializer.#assertContained(this.#host, entry.storage, "TARGET", artifact.path);
-			const to = Materializer.#assertContained(target, entry.destination, "WRITE", artifact.path);
-			try {
-				mkdirSync(dirname(to), { recursive: true });
-				cpSync(from, to);
-				if (entry.executable) chmodSync(to, 493);
-			} catch (error) {
-				this.#emitter.emit("error", error);
-				throw new ScaffoldError("WRITE", `Failed to copy host artifact at ${artifact.path}`, {
-					path: artifact.path,
-					error
+		if (manifest === void 0 && artifact.hex === void 0) {
+			const status = lstatSync(resolvePhysicalPath(this.#host, source, "TARGET", "host"));
+			if (!status.isDirectory() || status.isSymbolicLink()) throw new ScaffoldError("TARGET", `Host artifact is not a physical directory at ${source}`, { source });
+			const destination = resolvePhysicalPath(transaction.stage, artifact.path, "WRITE", "staging");
+			mkdirSync(destination, { recursive: true });
+			validateWriteDirectories(transaction);
+			const staged = lstatSync(destination);
+			if (!staged.isDirectory() || staged.isSymbolicLink()) throw new ScaffoldError("WRITE", `Staged host directory changed at ${artifact.path}`, { path: artifact.path });
+			return;
+		}
+		const entry = entries[0];
+		const sourcePath = entry === void 0 ? source : entry.storage;
+		const destinationPath = entry === void 0 ? artifact.path : remapArtifactPath(artifact, entry.destination);
+		const expected = artifact.hex;
+		if (expected === void 0) throw new ScaffoldError("TARGET", `Host artifact has no byte snapshot at ${source}`, { source });
+		const from = resolvePhysicalPath(this.#host, sourcePath, "TARGET", "host");
+		const sourceStatus = lstatSync(from);
+		if (!sourceStatus.isFile() || sourceStatus.isSymbolicLink() || sourceStatus.nlink !== 1 || digestFile(from) !== digestHex(expected)) throw new ScaffoldError("TARGET", `Host artifact changed at ${source}`, { source });
+		const to = resolvePhysicalPath(transaction.stage, destinationPath, "WRITE", "staging");
+		try {
+			mkdirSync(dirname(to), { recursive: true });
+			validateWriteDirectories(transaction);
+			const destination = resolvePhysicalPath(transaction.stage, destinationPath, "WRITE", "staging");
+			copyFileSync(from, destination, constants.COPYFILE_EXCL);
+			if (entry?.executable === true) chmodSync(destination, 493);
+			const copied = lstatSync(destination);
+			if (!copied.isFile() || copied.isSymbolicLink() || copied.nlink !== 1 || digestFile(destination) !== digestHex(expected)) throw new Error(`staged host artifact changed at ${artifact.path}`);
+			validateWriteDirectories(transaction);
+		} catch (error) {
+			throw new ScaffoldError("WRITE", `Failed to copy host artifact at ${artifact.path}`, {
+				path: artifact.path,
+				error
+			});
+		}
+	}
+	#prepare(plan, target, context = plan, hydrate = true) {
+		if (!isFilesystemPath(target)) throw new ScaffoldError("TARGET", "Materializer target is malformed or exceeds its bounds", { target });
+		if (!hasOnlyDataProperties(plan)) throw new ScaffoldError("INVALID", "Materializer requires a data-only Plan");
+		const snapshot = attempt(() => structuredClone(plan));
+		const parsed = snapshot.success ? parsePlan(snapshot.value) : void 0;
+		if (parsed === void 0) throw new ScaffoldError("INVALID", "Materializer requires a valid Plan", { ...snapshot.success ? {} : { error: snapshot.error } });
+		const contextSnapshot = context === plan ? snapshot : hasOnlyDataProperties(context) ? attempt(() => structuredClone(context)) : void 0;
+		const parsedContext = context === plan ? parsed : contextSnapshot?.success === true ? parsePlan(contextSnapshot.value) : void 0;
+		if (parsedContext === void 0) throw new ScaffoldError("INVALID", "Materializer requires a valid contextual Plan", { ...contextSnapshot?.success === false ? { error: contextSnapshot.error } : {} });
+		const validation = validatePlan(parsedContext);
+		if (!validation.valid) throw new ScaffoldError("INVALID", "Materializer requires a semantically and contextually valid Plan", { questions: validation.questions });
+		for (const artifact of parsed.artifacts) {
+			if (!isPortablePath(artifact.path)) throw new ScaffoldError("WRITE", `Invalid artifact path at ${artifact.path}`, { path: artifact.path });
+			if (isReservedTargetPath(artifact.path)) throw new ScaffoldError("WRITE", `Artifact path targets reserved repository metadata at ${artifact.path}`, { path: artifact.path });
+			if (artifact.source !== void 0 && !isPortablePath(artifact.source)) throw new ScaffoldError("TARGET", `Invalid artifact source at ${artifact.source}`, { source: artifact.source });
+		}
+		const hosted = parsed.artifacts.some((artifact) => artifact.origin === "host");
+		const prepared = hydrate && hosted ? hydratePlan(parsed, this.#host) : parsed;
+		const conflict = findFileConflict(prepared.artifacts.map((artifact) => artifact.path));
+		if (conflict !== void 0) throw new ScaffoldError("INVALID", `Plan artifact collision between "${conflict[0]}" and "${conflict[1]}"`, { paths: conflict });
+		if (!hydrate) return prepared;
+		const manifest = hosted ? this.#manifest() : void 0;
+		for (const artifact of prepared.artifacts) {
+			const destination = resolvePhysicalPath(target, artifact.path, "WRITE", "target");
+			if (!existsSync(destination)) continue;
+			const destinationStatus = attempt(() => lstatSync(destination));
+			if (!destinationStatus.success) throw new ScaffoldError("TARGET", `Failed to inspect artifact target at ${artifact.path}`, {
+				path: artifact.path,
+				error: destinationStatus.error
+			});
+			if (destinationStatus.value.isSymbolicLink() || destinationStatus.value.isFile() && destinationStatus.value.nlink !== 1) throw new ScaffoldError("TARGET", `Artifact target is linked at ${artifact.path}`, { path: artifact.path });
+			let directory = false;
+			if (artifact.origin === "host" && manifest === void 0 && artifact.hex === void 0) {
+				const source = artifact.source ?? artifact.path;
+				const sourcePath = resolvePhysicalPath(this.#host, source, "TARGET", "host");
+				const sourceStatus = attempt(() => lstatSync(sourcePath));
+				if (!sourceStatus.success) throw new ScaffoldError("TARGET", `Failed to inspect host artifact at ${source}`, {
+					source,
+					error: sourceStatus.error
 				});
+				directory = sourceStatus.value.isDirectory() && !sourceStatus.value.isSymbolicLink();
 			}
+			if (destinationStatus.value.isDirectory() !== directory) throw new ScaffoldError("TARGET", `Artifact target has an incompatible shape at ${artifact.path}`, {
+				path: artifact.path,
+				directory
+			});
 		}
-		this.#emitter.emit("copy", artifact.path);
+		return prepared;
 	}
 	#manifest() {
 		if (!this.#manifestLoaded) {
-			this.#manifestEntries = readHostManifest(this.#host);
+			this.#manifestValue = readHostManifest(this.#host);
 			this.#manifestLoaded = true;
 		}
-		return this.#manifestEntries;
+		return this.#manifestValue;
 	}
-	#write(artifact, target) {
-		const to = Materializer.#assertContained(target, artifact.path, "WRITE", artifact.path);
+	#write(artifact, transaction) {
+		const to = resolvePhysicalPath(transaction.stage, artifact.path, "WRITE", "staging");
 		try {
 			mkdirSync(dirname(to), { recursive: true });
-			writeFileSync(to, artifact.content ?? "", "utf8");
+			validateWriteDirectories(transaction);
+			const destination = resolvePhysicalPath(transaction.stage, artifact.path, "WRITE", "staging");
+			writeFileSync(destination, artifact.content, {
+				encoding: "utf8",
+				flag: "wx"
+			});
+			const status = lstatSync(destination);
+			if (!status.isFile() || status.isSymbolicLink() || status.nlink !== 1 || digestFile(destination) !== digestText(artifact.content)) throw new Error(`staged artifact changed at ${artifact.path}`);
+			validateWriteDirectories(transaction);
 		} catch (error) {
-			this.#emitter.emit("error", error);
 			throw new ScaffoldError("WRITE", `Failed to write artifact at ${artifact.path}`, {
 				path: artifact.path,
 				error
 			});
 		}
-		this.#emitter.emit("write", artifact.path);
-	}
-	static #assertContained(root, relative, code, path) {
-		const resolvedRoot = Materializer.#resolveReal(resolve(root));
-		const resolvedCandidate = Materializer.#resolveReal(resolve(root, relative));
-		if (resolvedCandidate !== resolvedRoot && !resolvedCandidate.startsWith(resolvedRoot + sep)) throw new ScaffoldError(code, `Artifact path "${path}" escapes the ${code === "WRITE" ? "target" : "host"} root`, {
-			path,
-			root
-		});
-		return resolve(root, relative);
-	}
-	static #stub(source) {
-		return `> Vendored guide for @orkestrel/${source.slice(11, source.length - 3)} — run \`scaffold pull\` to fetch it.\n`;
-	}
-	static #resolveReal(path) {
-		if (existsSync(path)) return realpathSync(path);
-		const parent = dirname(path);
-		if (parent === path) return path;
-		return join(Materializer.#resolveReal(parent), relative(parent, path));
 	}
 	#ensureAlive() {
 		if (this.#destroyed) throw new ScaffoldError("DESTROYED", "Materializer has been destroyed");
@@ -1044,9 +3461,6 @@ var Materializer = class Materializer {
 * ```
 */
 var Sync = class Sync {
-	static #DEFAULT_TIMEOUT = 1e4;
-	static #DEFAULT_CONCURRENCY = 6;
-	static #DEFAULT_LIMIT = 5242880;
 	#emitter;
 	#guidesBase;
 	#branch;
@@ -1057,32 +3471,51 @@ var Sync = class Sync {
 	#retries;
 	#strict;
 	#limit;
+	#items;
+	#budget;
+	#controller = new AbortController();
 	#destroyed = false;
 	constructor(options) {
+		const parsed = parseSyncOptions(options);
 		this.#emitter = new Emitter({
-			on: options?.on,
-			error: options?.error
-		});
-		this.#guidesBase = options?.guides?.base ?? "raw.githubusercontent.com";
-		this.#branch = options?.guides?.branch ?? "main";
-		this.#guidesTimeout = options?.guides?.timeout ?? Sync.#DEFAULT_TIMEOUT;
-		this.#registryBase = options?.registry?.base ?? "registry.npmjs.org";
-		this.#registryTimeout = options?.registry?.timeout ?? Sync.#DEFAULT_TIMEOUT;
-		this.#concurrency = options?.concurrency ?? Sync.#DEFAULT_CONCURRENCY;
-		this.#retries = options?.retries ?? 0;
-		this.#strict = options?.strict ?? false;
-		this.#limit = options?.limit ?? Sync.#DEFAULT_LIMIT;
+			...parsed.on === void 0 ? {} : { on: parsed.on },
+			...parsed.error === void 0 ? {} : { error: parsed.error }
+		});
+		this.#guidesBase = parsed.guides?.base ?? "https://raw.githubusercontent.com";
+		this.#branch = parsed.guides?.branch ?? "main";
+		this.#guidesTimeout = parsed.guides?.timeout ?? 1e4;
+		this.#registryBase = parsed.registry?.base ?? "https://registry.npmjs.org";
+		this.#registryTimeout = parsed.registry?.timeout ?? 1e4;
+		this.#concurrency = parsed.concurrency ?? 6;
+		this.#retries = parsed.retries ?? 0;
+		this.#strict = parsed.strict ?? false;
+		this.#limit = parsed.limit ?? DEFAULT_SYNC_LIMIT;
+		this.#items = parsed.items ?? 256;
+		this.#budget = parsed.budget ?? 16777216;
 	}
 	get emitter() {
 		return this.#emitter;
 	}
 	async guides(deps, current) {
 		this.#ensureAlive();
-		return Sync.#runPool(deps, this.#concurrency, async (dep) => {
-			const short = Sync.#shortName(dep.name);
+		return this.#guides(deps, current, Float64Array.of(this.#budget));
+	}
+	async versions(deps) {
+		this.#ensureAlive();
+		return this.#versions(deps, Float64Array.of(this.#budget));
+	}
+	#guides(deps, current, allowance) {
+		const parsed = parseSyncDependencies(deps, false);
+		if (parsed.length > this.#items) throw new ScaffoldError("INVALID", "Sync dependency count exceeds its item limit", {
+			items: parsed.length,
+			limit: this.#items
+		});
+		const reference = parseSyncCurrent(current, parsed.map((dependency) => dependency.name), this.#budget);
+		return Sync.#runPool(parsed, this.#concurrency, async (dep) => {
+			const short = packageShortName(dep.name);
 			const url = this.#guideUrl(short);
-			const outcome = await Sync.#fetchText(url, this.#guidesTimeout, this.#retries, this.#limit);
-			const guide = Sync.#toGuideSync(dep.name, short, outcome, current);
+			const outcome = await Sync.#fetchText(url, this.#guidesTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
+			const guide = Sync.#toGuideSync(dep.name, short, outcome, reference);
 			if (outcome.kind === "failed") this.#emitter.emit("error", outcome.error);
 			this.#emitter.emit("guide", dep.name);
 			if (this.#strict && (guide.freshness === "missing" || guide.freshness === "failed")) throw new ScaffoldError("FETCH", `Failed to fetch guide at ${url}`, {
@@ -1092,11 +3525,15 @@ var Sync = class Sync {
 			return guide;
 		});
 	}
-	async versions(deps) {
-		this.#ensureAlive();
-		return Sync.#runPool(deps, this.#concurrency, async (dep) => {
+	#versions(deps, allowance) {
+		const parsed = parseSyncDependencies(deps, true);
+		if (parsed.length > this.#items) throw new ScaffoldError("INVALID", "Sync dependency count exceeds its item limit", {
+			items: parsed.length,
+			limit: this.#items
+		});
+		return Sync.#runPool(parsed, this.#concurrency, async (dep) => {
 			const url = this.#registryUrl(dep.name);
-			const outcome = await Sync.#fetchText(url, this.#registryTimeout, this.#retries, this.#limit);
+			const outcome = await Sync.#fetchText(url, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
 			const version = Sync.#toVersionSync(dep, outcome);
 			if (outcome.kind === "failed") this.#emitter.emit("error", outcome.error);
 			this.#emitter.emit("version", dep.name);
@@ -1136,13 +3573,19 @@ var Sync = class Sync {
 	async catalog() {
 		this.#ensureAlive();
 		const orgUrl = this.#orgUrl();
-		const orgOutcome = await Sync.#fetchText(orgUrl, this.#registryTimeout, this.#retries, this.#limit);
+		const allowance = Float64Array.of(this.#budget);
+		const orgOutcome = await Sync.#fetchText(orgUrl, this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
 		const names = Sync.#toOrgPackages(orgOutcome, orgUrl);
+		if (names.length > this.#items) throw new ScaffoldError("FETCH", `Package list at ${orgUrl} exceeds the item limit`, {
+			url: orgUrl,
+			items: names.length,
+			limit: this.#items
+		});
 		return [...await Sync.#runPool(names, this.#concurrency, async (name) => {
-			const packumentOutcome = await Sync.#fetchText(this.#registryUrl(name), this.#registryTimeout, this.#retries, this.#limit);
+			const packumentOutcome = await Sync.#fetchText(this.#registryUrl(name), this.#registryTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
 			const packument = Sync.#toPackument(packumentOutcome);
-			const short = Sync.#shortName(name);
-			const guideOutcome = await Sync.#fetchText(this.#guideUrl(short), this.#guidesTimeout, this.#retries, this.#limit);
+			const short = packageShortName(name);
+			const guideOutcome = await Sync.#fetchText(this.#guideUrl(short), this.#guidesTimeout, this.#retries, this.#limit, allowance, this.#controller.signal);
 			const guide = Sync.#toGuideDescription(guideOutcome);
 			if (packumentOutcome.kind === "failed") this.#emitter.emit("error", packumentOutcome.error);
 			if (guideOutcome.kind === "failed") this.#emitter.emit("error", guideOutcome.error);
@@ -1156,74 +3599,104 @@ var Sync = class Sync {
 			};
 		})].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
 	}
-	async pull(target) {
+	async pull(target, dependencies) {
 		this.#ensureAlive();
-		const deps = manifestToDependencies(readManifest(target));
-		const current = {};
-		for (const dep of deps) {
-			const full = join(target, "guides", "src", `${Sync.#shortName(dep.name)}.md`);
-			if (!existsSync(full)) continue;
-			try {
-				current[dep.name] = readFileSync(full, "utf8");
-			} catch {}
-		}
-		const guides = await this.guides(deps, current);
-		const versions = await this.versions(deps);
-		const failed = [...guides, ...versions].filter((entry) => entry.freshness === "missing" || entry.freshness === "failed").length;
-		const report = {
-			target,
-			guides,
-			versions,
-			clean: failed === 0 && guides.every((guide) => guide.freshness === "current") && versions.every((version) => version.freshness === "current"),
-			failed
-		};
+		const declared = manifestToDependencies(readManifest(target));
+		const deps = dependencies === void 0 ? declared : parseSyncDependencies(dependencies, false);
+		if (dependencies !== void 0 && deps.some((dependency) => !declared.some((candidate) => candidate.name === dependency.name && candidate.range === dependency.range))) throw new ScaffoldError("INVALID", "Sync pull selection is not declared by the target");
+		const current = readGuideReferences(target, deps);
+		const allowance = Float64Array.of(this.#budget);
+		const report = syncReportOf(target, await this.#guides(deps, current, allowance), await this.#versions(deps, allowance));
 		this.#emitter.emit("done", report);
 		return report;
 	}
 	async write(report, target) {
 		this.#ensureAlive();
-		const written = [];
-		for (const guide of report.guides) {
-			if (guide.freshness !== "behind") continue;
-			const to = Sync.#assertContained(target, guide.path);
-			try {
-				mkdirSync(dirname(to), { recursive: true });
-				writeFileSync(to, guide.content, "utf8");
-			} catch (error) {
-				this.#emitter.emit("error", error);
-				throw new ScaffoldError("WRITE", `Failed to write guide at ${guide.path}`, {
+		if (!isFilesystemPath(target)) throw new ScaffoldError("WRITE", "Sync write target is malformed or exceeds its bounds", { target });
+		if (!hasOnlyDataProperties(report) || !isSyncReport(report)) throw new ScaffoldError("WRITE", "Sync report is malformed");
+		const snapshot = attempt(() => structuredClone(report));
+		const parsed = snapshot.success ? parseSyncReport(snapshot.value) : void 0;
+		if (parsed === void 0) throw new ScaffoldError("WRITE", "Sync report is malformed", { ...snapshot.success ? {} : { error: snapshot.error } });
+		const destinations = resolveGuideWrites(parsed.guides, target);
+		const written = destinations.map(({ guide }) => guide.path);
+		if (written.length === 0) return written;
+		const preconditions = [];
+		for (const { guide, destination } of destinations) {
+			if (guide.baseline === void 0 || !SYNC_BASELINE_PATTERN.test(guide.baseline)) throw new ScaffoldError("WRITE", `Guide baseline is missing or malformed at ${guide.path}`, { path: guide.path });
+			const status = attempt(() => lstatSync(destination));
+			if (guide.baseline === "absent") {
+				if (status.success || !isMissingPathError(status.error)) throw new ScaffoldError("WRITE", `Guide destination changed at ${guide.path}`, {
 					path: guide.path,
-					error
+					...status.success ? {} : { error: status.error }
+				});
+				preconditions.push({
+					path: guide.path,
+					shape: "absent"
+				});
+			} else if (!status.success || !status.value.isFile() || status.value.isSymbolicLink() || status.value.nlink !== 1 || digestFile(destination) !== guide.baseline) throw new ScaffoldError("WRITE", `Guide destination changed at ${guide.path}`, {
+				path: guide.path,
+				...status.success ? {} : { error: status.error }
+			});
+			else preconditions.push({
+				path: guide.path,
+				shape: "file",
+				digest: guide.baseline
+			});
+		}
+		const transaction = WriteTransaction.create(target, written, preconditions);
+		const staged = attempt(() => {
+			for (const { guide } of destinations) {
+				if (Buffer.byteLength(guide.content, "utf8") > MAX_ARTIFACT_BYTES) throw new ScaffoldError("WRITE", `Guide exceeds the artifact limit at ${guide.path}`, {
+					path: guide.path,
+					limit: MAX_ARTIFACT_BYTES
 				});
+				validateWriteDirectories(transaction);
+				mkdirSync(dirname(resolvePhysicalPath(transaction.stage, guide.path, "WRITE", "staging")), { recursive: true });
+				validateWriteDirectories(transaction);
+				const destination = resolvePhysicalPath(transaction.stage, guide.path, "WRITE", "staging");
+				writeFileSync(destination, guide.content, {
+					encoding: "utf8",
+					flag: "wx"
+				});
+				const status = lstatSync(destination);
+				if (!status.isFile() || status.isSymbolicLink() || status.nlink !== 1 || digestFile(destination) !== digestText(guide.content)) throw new ScaffoldError("WRITE", `Staged guide changed at ${guide.path}`, { path: guide.path });
+				validateWriteDirectories(transaction);
 			}
-			written.push(guide.path);
-			this.#emitter.emit("write", guide.path);
+		});
+		if (!staged.success) {
+			const cleanup = attempt(() => discardWriteTransaction(transaction));
+			this.#emitter.emit("error", staged.error);
+			throw new ScaffoldError("WRITE", "Failed to stage guide synchronization", {
+				target,
+				error: staged.error,
+				cleanup: cleanup.success ? void 0 : cleanup.error
+			});
 		}
+		const committed = attempt(() => commitWriteTransaction(transaction, written));
+		if (!committed.success) {
+			this.#emitter.emit("error", committed.error);
+			throw committed.error;
+		}
+		for (const path of written) this.#emitter.emit("write", path);
 		return written;
 	}
 	destroy() {
 		if (this.#destroyed) return;
 		this.#destroyed = true;
+		this.#controller.abort();
 		this.#emitter.emit("destroy");
 		this.#emitter.destroy();
 	}
 	#guideUrl(short) {
-		return `${Sync.#normalizeBase(this.#guidesBase)}/orkestrel/${short}/refs/heads/${this.#branch}/guides/src/${short}.md`;
+		const branch = this.#branch.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+		const encoded = encodeURIComponent(short);
+		return `${this.#guidesBase}/orkestrel/${encoded}/refs/heads/${branch}/guides/src/${encoded}.md`;
 	}
 	#registryUrl(name) {
-		return `${Sync.#normalizeBase(this.#registryBase)}/${name.replace("/", "%2F")}`;
+		return `${this.#registryBase}/${name.replace("/", "%2F")}`;
 	}
 	#orgUrl() {
-		return `${Sync.#normalizeBase(this.#registryBase)}/-/org/orkestrel/package`;
-	}
-	static #normalizeBase(base) {
-		return /^https?:\/\//.test(base) ? base : `https://${base}`;
-	}
-	static #shortName(name) {
-		return name.startsWith("@orkestrel/") ? name.slice(11) : name;
-	}
-	static #isRecord(value) {
-		return typeof value === "object" && value !== null && !Array.isArray(value);
+		return `${this.#registryBase}/-/org/orkestrel/package`;
 	}
 	static async #runPool(items, concurrency, worker) {
 		const results = new Array(items.length);
@@ -1248,8 +3721,10 @@ var Sync = class Sync {
 			const index = pool.state.cursor;
 			pool.state.cursor += 1;
 			if (index >= pool.items.length) return;
+			const item = pool.items[index];
+			if (item === void 0) return;
 			try {
-				pool.results[index] = await pool.worker(pool.items[index]);
+				pool.results[index] = await pool.worker(item);
 			} catch (error) {
 				if (pool.state.firstError === void 0) pool.state.firstError = { error };
 				pool.state.stopped = true;
@@ -1257,38 +3732,47 @@ var Sync = class Sync {
 			}
 		}
 	}
-	static async #fetchText(url, timeout, retries, limit) {
+	static async #fetchText(url, timeout, retries, limit, allowance, signal) {
 		let lastError;
 		let lastNote = "";
-		for (let attempt = 0; attempt <= retries; attempt += 1) try {
-			const response = await fetch(url, {
-				signal: AbortSignal.timeout(timeout),
-				redirect: "manual"
-			});
-			if (response.status === 404) return { kind: "missing" };
-			if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
-				lastNote = "redirected (redirect following is disabled)";
-				lastError = /* @__PURE__ */ new Error(`Redirect blocked for ${url}`);
-				continue;
-			}
-			if (!response.ok) {
-				lastNote = `HTTP ${String(response.status)}`;
-				lastError = /* @__PURE__ */ new Error(`Unexpected HTTP status ${response.status} for ${url}`);
-				continue;
-			}
-			const read = await Sync.#readBounded(response, url, limit);
-			if (!read.ok) {
-				lastError = read.error;
-				lastNote = read.note;
-				continue;
+		for (let retry = 0; retry <= retries; retry += 1) {
+			if (signal.aborted) throw new ScaffoldError("DESTROYED", "Sync has been destroyed");
+			try {
+				const response = await fetch(url, {
+					signal: AbortSignal.any([signal, AbortSignal.timeout(timeout)]),
+					redirect: "manual"
+				});
+				if (response.status === 404) {
+					await Sync.#cancel(response);
+					return { kind: "missing" };
+				}
+				if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
+					lastNote = "redirected (redirect following is disabled)";
+					lastError = /* @__PURE__ */ new Error(`Redirect blocked for ${url}`);
+					await Sync.#cancel(response);
+					continue;
+				}
+				if (!response.ok) {
+					lastNote = `HTTP ${String(response.status)}`;
+					lastError = /* @__PURE__ */ new Error(`Unexpected HTTP status ${response.status} for ${url}`);
+					await Sync.#cancel(response);
+					continue;
+				}
+				const read = await Sync.#readBounded(response, url, limit, allowance);
+				if (!read.ok) {
+					lastError = read.error;
+					lastNote = read.note;
+					continue;
+				}
+				return {
+					kind: "ok",
+					text: read.text
+				};
+			} catch (error) {
+				if (signal.aborted) throw new ScaffoldError("DESTROYED", "Sync has been destroyed", { error });
+				lastError = error;
+				lastNote = Sync.#transportNote(error);
 			}
-			return {
-				kind: "ok",
-				text: read.text
-			};
-		} catch (error) {
-			lastError = error;
-			lastNote = Sync.#transportNote(error);
 		}
 		return {
 			kind: "failed",
@@ -1296,6 +3780,9 @@ var Sync = class Sync {
 			note: lastNote
 		};
 	}
+	static async #cancel(response) {
+		await response.body?.cancel();
+	}
 	static #transportNote(error) {
 		if (!(error instanceof Error)) return String(error);
 		const code = Sync.#causeCode(error);
@@ -1307,15 +3794,19 @@ var Sync = class Sync {
 		if (!("code" in cause)) return void 0;
 		return typeof cause.code === "string" ? cause.code : void 0;
 	}
-	static async #readBounded(response, url, limit) {
+	static async #readBounded(response, url, limit, allowance) {
 		const declared = response.headers.get("content-length");
 		if (declared !== null) {
 			const declaredBytes = Number(declared);
-			if (Number.isFinite(declaredBytes) && declaredBytes > limit) return {
-				ok: false,
-				error: /* @__PURE__ */ new Error(`Response body for ${url} declares ${String(declaredBytes)} bytes, exceeding the ${String(limit)}-byte limit`),
-				note: `response exceeded limit (${String(limit)} bytes)`
-			};
+			if (Number.isFinite(declaredBytes) && (declaredBytes > limit || declaredBytes > (allowance[0] ?? 0))) {
+				await response.body?.cancel();
+				const threshold = Math.min(limit, allowance[0] ?? 0);
+				return {
+					ok: false,
+					error: /* @__PURE__ */ new Error(`Response body for ${url} declares ${String(declaredBytes)} bytes, exceeding the ${String(threshold)}-byte allowance`),
+					note: `response exceeded allowance (${String(threshold)} bytes)`
+				};
+			}
 		}
 		const body = response.body;
 		if (body === null) return {
@@ -1323,7 +3814,7 @@ var Sync = class Sync {
 			text: ""
 		};
 		const reader = body.getReader();
-		const decoder = new TextDecoder();
+		const decoder = new TextDecoder("utf-8", { fatal: true });
 		const chunks = [];
 		let total = 0;
 		try {
@@ -1331,14 +3822,23 @@ var Sync = class Sync {
 				const { done, value } = await reader.read();
 				if (done) break;
 				total += value.byteLength;
-				if (total > limit) return {
-					ok: false,
-					error: /* @__PURE__ */ new Error(`Response body for ${url} exceeded the ${String(limit)}-byte limit`),
-					note: `response exceeded limit (${String(limit)} bytes)`
-				};
+				if (total > limit || value.byteLength > (allowance[0] ?? 0)) {
+					await reader.cancel();
+					const threshold = Math.min(limit, total + (allowance[0] ?? 0) - value.byteLength);
+					allowance[0] = Math.max(0, (allowance[0] ?? 0) - value.byteLength);
+					return {
+						ok: false,
+						error: /* @__PURE__ */ new Error(`Response body for ${url} exceeded the ${String(threshold)}-byte allowance`),
+						note: `response exceeded allowance (${String(threshold)} bytes)`
+					};
+				}
+				allowance[0] = (allowance[0] ?? 0) - value.byteLength;
 				chunks.push(decoder.decode(value, { stream: true }));
 			}
 			chunks.push(decoder.decode());
+		} catch (error) {
+			await reader.cancel(error).catch(() => void 0);
+			throw error;
 		} finally {
 			reader.releaseLock();
 		}
@@ -1349,26 +3849,31 @@ var Sync = class Sync {
 	}
 	static #toGuideSync(name, short, outcome, current) {
 		const path = `guides/src/${short}.md`;
+		const local = current?.[name];
+		const baseline = current === void 0 ? void 0 : local === void 0 ? "absent" : digestText(local);
 		if (outcome.kind === "missing") return {
 			name,
 			path,
 			content: "",
 			freshness: "missing",
-			note: "HTTP 404"
+			note: "HTTP 404",
+			...baseline === void 0 ? {} : { baseline }
 		};
 		if (outcome.kind === "failed") return {
 			name,
 			path,
 			content: "",
 			freshness: "failed",
-			note: outcome.note
+			note: outcome.note,
+			...baseline === void 0 ? {} : { baseline }
 		};
-		const freshness = current?.[name] === outcome.text ? "current" : "behind";
+		const freshness = current !== void 0 && local !== void 0 && local === outcome.text ? "current" : "behind";
 		return {
 			name,
 			path,
 			content: outcome.text,
-			freshness
+			freshness,
+			...baseline === void 0 ? {} : { baseline }
 		};
 	}
 	static #toVersionSync(dep, outcome) {
@@ -1409,15 +3914,10 @@ var Sync = class Sync {
 				note
 			});
 		}
-		let parsed;
-		try {
-			parsed = JSON.parse(outcome.text);
-		} catch {
-			throw new ScaffoldError("FETCH", `Malformed package list response at ${url}`, { url });
-		}
-		if (!Sync.#isRecord(parsed)) throw new ScaffoldError("FETCH", `Malformed package list response at ${url}`, { url });
-		const names = Object.keys(parsed).filter((name) => name.startsWith("@orkestrel/"));
-		if (names.length === 0) throw new ScaffoldError("FETCH", `Malformed package list response at ${url}`, { url });
+		const parsed = parseJSON(outcome.text);
+		if (!isRecord(parsed)) throw new ScaffoldError("FETCH", `Malformed package list response at ${url}`, { url });
+		const names = Object.keys(parsed);
+		if (names.length === 0 || names.some((name) => !DEPENDENCY_NAME_PATTERN.test(name))) throw new ScaffoldError("FETCH", `Malformed package list response at ${url}`, { url });
 		return names;
 	}
 	static #toPackument(outcome) {
@@ -1431,26 +3931,24 @@ var Sync = class Sync {
 			description: "",
 			note: outcome.note
 		};
-		let parsed;
-		try {
-			parsed = JSON.parse(outcome.text);
-		} catch {
-			return {
-				version: "",
-				description: "",
-				note: "malformed registry response (invalid JSON)"
-			};
-		}
-		if (!Sync.#isRecord(parsed)) return {
+		const parsed = parseJSON(outcome.text);
+		if (parsed === void 0) return {
+			version: "",
+			description: "",
+			note: "malformed registry response (invalid JSON)"
+		};
+		if (!isRecord(parsed)) return {
 			version: "",
 			description: "",
 			note: "malformed registry response (not an object)"
 		};
-		const distTags = parsed["dist-tags"];
-		const version = Sync.#isRecord(distTags) && typeof distTags.latest === "string" ? distTags.latest : "";
+		const distTags = ownDataValue(parsed, "dist-tags");
+		const latest = ownDataValue(distTags, "latest");
+		const version = isRecord(distTags) && typeof latest === "string" && VERSION_PATTERN.test(latest) ? latest : "";
+		const rawDescription = ownDataValue(parsed, "description");
 		return {
 			version,
-			description: typeof parsed.description === "string" ? parsed.description : "",
+			description: isCatalogDescription(rawDescription) ? rawDescription : "",
 			note: version === "" ? "malformed registry response (missing dist-tags.latest)" : ""
 		};
 	}
@@ -1463,7 +3961,7 @@ var Sync = class Sync {
 			description: void 0,
 			note: outcome.note
 		};
-		const description = Sync.#firstBlockquoteParagraph(outcome.text);
+		const description = guideToDescription(outcome.text);
 		return description !== void 0 ? {
 			description,
 			note: ""
@@ -1472,24 +3970,6 @@ var Sync = class Sync {
 			note: "guide has no blockquote description"
 		};
 	}
-	static #firstBlockquoteParagraph(text) {
-		let document;
-		try {
-			document = parseDocument(text);
-		} catch {
-			return;
-		}
-		let quote;
-		for (const node of walkNodes(document)) if (isBlockquoteNode(node)) {
-			quote = node;
-			break;
-		}
-		if (quote === void 0) return void 0;
-		const paragraph = quote.children.find((child) => isParagraphNode(child));
-		if (paragraph === void 0) return void 0;
-		const flattened = flattenText(paragraph).replace(/\s+/g, " ").trim();
-		return flattened.length > 0 ? flattened : void 0;
-	}
 	static #combineNote(guideNote, packumentNote) {
 		const parts = [];
 		if (packumentNote !== "") parts.push(`version unavailable — ${packumentNote}`);
@@ -1497,32 +3977,12 @@ var Sync = class Sync {
 		return parts.join("; ");
 	}
 	static #parseLatest(text) {
-		let parsed;
-		try {
-			parsed = JSON.parse(text);
-		} catch {
-			return;
-		}
-		if (!Sync.#isRecord(parsed)) return void 0;
-		const distTags = parsed["dist-tags"];
-		if (!Sync.#isRecord(distTags)) return void 0;
-		const latest = distTags.latest;
-		return typeof latest === "string" ? latest : void 0;
-	}
-	static #assertContained(target, relative) {
-		const resolvedRoot = Sync.#resolveReal(resolve(target));
-		const resolvedCandidate = Sync.#resolveReal(resolve(target, relative));
-		if (resolvedCandidate !== resolvedRoot && !resolvedCandidate.startsWith(resolvedRoot + sep)) throw new ScaffoldError("WRITE", `Guide path "${relative}" escapes the target root`, {
-			path: relative,
-			target
-		});
-		return resolve(target, relative);
-	}
-	static #resolveReal(path) {
-		if (existsSync(path)) return realpathSync(path);
-		const parent = dirname(path);
-		if (parent === path) return path;
-		return join(Sync.#resolveReal(parent), relative(parent, path));
+		const parsed = parseJSON(text);
+		if (!isRecord(parsed)) return void 0;
+		const distTags = ownDataValue(parsed, "dist-tags");
+		if (!isRecord(distTags)) return void 0;
+		const latest = ownDataValue(distTags, "latest");
+		return typeof latest === "string" && VERSION_PATTERN.test(latest) ? latest : void 0;
 	}
 	#ensureAlive() {
 		if (this.#destroyed) throw new ScaffoldError("DESTROYED", "Sync has been destroyed");
@@ -1567,6 +4027,6 @@ function createSync(options) {
 	return new Sync(options);
 }
 //#endregion
-export { Materializer, PRUNE_DIRECTORIES, Sync, catalogPackages, createMaterializer, createSync, deriveBlueprint, discoverPackages, hostRoot, hydratePlan, isManifestEntry, isRecord, isVacant, listFiles, locateHostSource, pruneTargets, readHostManifest, readManifest, readTarget, selectOrkestrelEntries, stageHost, storagePath, vendoredPruneSet };
+export { DEFAULT_SYNC_BUDGET, DEFAULT_SYNC_CONCURRENCY, DEFAULT_SYNC_ITEMS, DEFAULT_SYNC_LIMIT, DEFAULT_SYNC_TIMEOUT, HOST_MANIFEST_PATH, MAX_CATALOG_DESCRIPTION_LENGTH, MAX_FILESYSTEM_DEPTH, MAX_GUIDE_BYTES, MAX_HOST_DEPTH, MAX_HOST_ENTRIES, MAX_PATH_SEGMENT_BYTES, MAX_SYNC_BASE_LENGTH, MAX_SYNC_BRANCH_LENGTH, MAX_SYNC_BUDGET, MAX_SYNC_CONCURRENCY, MAX_SYNC_ITEMS, MAX_SYNC_LIMIT, MAX_SYNC_RETRIES, MAX_SYNC_TIMEOUT, Materializer, PRUNE_DIRECTORIES, RESERVED_PATH_SEGMENT_PATTERN, RESERVED_TARGET_PATH_PATTERN, SENSITIVE_HOST_PATH_PATTERN, SYNC_BRANCH_PATTERN, Sync, WRITE_DIGEST_PATTERN, WriteTransaction, catalogPackages, commitWriteTransaction, consumeCatalogAllowance, createMaterializer, createSync, createWriteDirectory, deriveBlueprint, digestFile, digestHex, digestText, discardWriteTransaction, discoverPackages, guideStub, guideToDescription, hostRoot, hydratePlan, isCatalogAllowance, isCatalogDescription, isDependencyData, isFilesystemPath, isHostManifest, isManifestEntry, isMaterializerEventHooks, isMissingPathError, isPortablePath, isRealDirectory, isReservedTargetPath, isSensitiveHostPath, isSyncEventHooks, isTerminalText, isVacant, isWritePrecondition, listDirectories, listFiles, locateHostSource, materializerOptionsContract, materializerOptionsShape, packageShortName, parseFilesystemPaths, parseMaterializerOptions, parsePortablePaths, parseSyncBase, parseSyncBranch, parseSyncCurrent, parseSyncDependencies, parseSyncOptions, parseWritePreconditions, pruneTargets, readFileHex, readFileText, readGuideReferences, readHostManifest, readManifest, readTarget, remapArtifactPath, replaceDirectory, resolveContainedPath, resolveGuideWrites, resolvePhysicalPath, resolveRealPath, restoreFiles, selectOrkestrelEntries, stageHost, storagePath, syncGuideOptionsShape, syncOptionsContract, syncOptionsShape, syncRegistryOptionsShape, syncReportOf, validateWriteAnchor, validateWriteDirectories, validateWriteTarget, vendoredPruneSet };
 
 //# sourceMappingURL=index.js.map