@orkestrel/scaffold 0.0.20 → 0.0.21

package/dist/host/CLAUDE.md

@@ -163,10 +163,12 @@ absorbed.
    patches serially; route cross-cutting findings.
 5. **Audit adversarially.** Every nontrivial implementation gets `reviewer` (Opus 5, design
    fit) and `analyst` (Sol, correctness and constraints) independently, plus `checker` for
-   mechanical conformance. In a fix round the unit's auditor is an engine that did not write
-   it. Multi-round audits use one fixed verdict shape with a single terminal line, defined by
-   the campaign skill. Reconcile their evidence; a finding neither engine can substantiate
-   against the evidence is dropped on the record.
+   mechanical conformance. An audit brief states its subject as numbered falsifiable claims
+   and requires per-claim CONFIRMED/BROKEN with evidence, per the Falsification law in
+   `.claude/rules/quality.md`. In a fix round the unit's auditor is an engine that did not
+   write it. Multi-round audits use one fixed verdict shape with a single terminal line,
+   defined by the campaign skill. Reconcile their evidence; a finding neither engine can
+   substantiate against the evidence is dropped on the record.
 6. **Verify.** One independent `verifier` runs the authoritative gates.
 7. **Accept.** The Orchestrator decides and reports concise outcomes, decisions, evidence, and
    remaining risk.
@@ -198,13 +200,34 @@ Workflow failures use the same ladder; do not absorb their raw logs into the mai
   writing nodes — never two concurrent writers in the tree.
 - Every node names a role and its engine.
 
+Every dispatch is a file before it is a launch:
+
+- The brief is written to a file under `tmp/`, named for its unit, before the unit is
+  launched, whatever engine executes it. A brief composed only inside a launch argument
+  cannot be corrected, resumed, or re-run once that call ends.
+- The unit's returned report is captured to a file beside its brief under the same unit name,
+  so a unit's instruction and its outcome are one pair on disk.
+- A re-run amends its brief instead of restating it: a mid-campaign correction produces a
+  successor file recording what changed and why, and the original stays. A fix round's brief
+  names the findings it carries and where each came from.
+- Brief and report files are unit evidence, not deliverables. They are never committed, and
+  they are swept when the campaign that produced them is accepted.
+- Anything in a brief or a report that must outlive the campaign is promoted into a durable
+  artifact — a commit message, a guide, a rule, a retrospective — before the sweep. What is
+  only in a swept file did not survive.
+
 Every dispatch contains:
 
 - **Role/engine** — named role and explicit engine.
 - **Objective** — one concrete outcome.
 - **Context** — the evidence slice, paths, decisions, `AGENTS.md`, applicable rules, the
   skill name and required references (or explicit none), and the guide/spec.
+- **Unknowns** — what the Orchestrator does not yet know that the unit needs, named as
+  unknown, with how the unit reports back on it. A brief that cannot be fully specified says
+  so instead of shipping a guess the executor would have to invent an answer around.
 - **Scope** — owned files, shared and off-limits files, allowed tools, permission limits.
+- **Execution** — the executor performs the assignment directly and spawns nothing. Every
+  brief states it; an executor deep in a task does not re-read this contract.
 - **Output** — the exact distilled return shape; no process diary.
 - **Deviation contract** — required stop/report behaviour for writers.
 - **Acceptance criteria** — independently checkable completion conditions.
@@ -230,22 +253,20 @@ Four bench laws apply to every external engine:
   transport where one exists. Long-running work — audits, implementation units, anything
   multi-minute — uses the journaled CLI and never MCP: an interrupted MCP call loses its
   session invisibly, while a journal survives any client-side failure.
-- **Journal first.** Every bench invocation leaves a tailable on-disk record under
-  `tmp/<bench>/` (`tmp/codex/`, `tmp/cursor/`): the brief as a file, the event stream or
-  output log, and the final answer. Every long exec also carries exactly one Monitor on its
-  journal — a filtered tail that emits milestones (commands run, files changed, agent
-  messages, terminal states) and never the raw event firehose — so progress arrives in the
-  conversation while the journal stays tailable for depth. The filter exits on the exec's
-  terminal event, so the monitor's lifecycle matches the exec's and no watcher outlives its
-  subject. The journal's mtime is the liveness signal; the session id in the journal head is
-  the recovery handle. Briefs never travel as fragile shell arguments.
+- **Journal first.** Every bench invocation leaves a tailable on-disk record beside its brief
+  under `tmp/<bench>/` (`tmp/codex/`, `tmp/cursor/`): the event stream or output log and the
+  final answer. Every long exec also carries exactly one Monitor on its journal — a filtered
+  tail that emits milestones (commands run, files changed, agent messages, terminal states)
+  and never the raw event firehose — so progress arrives in the conversation while the
+  journal stays tailable for depth. The filter exits on the exec's terminal event, so the
+  monitor's lifecycle matches the exec's and no watcher outlives its subject. The journal's
+  mtime is the liveness signal; the session id in the journal head is the recovery handle.
 - **Tracked, never loose.** Every bench unit is registered in the session task registry at
   launch — subject, journal path, session id — and completed there at acceptance, so "what is
   running" always has a first-class answer instead of a recollection of a command.
-- **Ephemeral journals.** Everything under `tmp/` is unit evidence, never committed. Bridges
-  never delete journals; the Orchestrator sweeps `tmp/codex/` and `tmp/cursor/` once at
-  campaign acceptance, after the final gate evidence is recorded. A journal surviving past
-  its campaign is residue.
+- **Ephemeral journals.** Bridges never delete journals; the Orchestrator sweeps them with
+  the campaign's other unit evidence at acceptance, after the final gate evidence is
+  recorded. A journal surviving past its campaign is residue.
 
 Every long bench exec is launched by the Orchestrator as a harness-tracked background command
 under a hard time cap, never detached from inside a bridge agent: the harness owns the
@@ -261,12 +282,12 @@ unit.
 ### Cursor Grok
 
 - Reached only through the `grok` role, in ask mode:
-  `<agent-cli> -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" "<brief>" | tee tmp/cursor/<unit>.log`.
+  `<agent-cli> -p --trust --mode=ask --model "$CURSOR_GROK_MODEL" "<prompt>" | tee tmp/cursor/<unit>.log`.
   `<agent-cli>` resolves as bare `agent`, then `agent.cmd` (Windows installs ship only
   `.cmd`/`.ps1` shims, so bare `agent` does not resolve in Bash), then
-  `"$LOCALAPPDATA/cursor-agent/agent.cmd"` — verified with `--version` before first use. Long
-  briefs are written to `tmp/cursor/<unit>-brief.md` and the prompt points at the file. The
-  tee'd log is the bench's journal.
+  `"$LOCALAPPDATA/cursor-agent/agent.cmd"` — verified with `--version` before first use. The
+  prompt points at the unit's brief file, `tmp/cursor/<unit>-brief.md`. The tee'd log is the
+  bench's journal.
 - A long ask-mode run obeys the same launch, stream, and ledger discipline as a Codex exec:
   the Orchestrator starts it as a harness-tracked background command under a time cap,
   registers the unit in the task registry, and arms one Monitor on the tee'd log for

package/dist/host/agents/skills/orkestrel-debrief/references/field-testing.md

@@ -1,7 +1,7 @@
 # Field testing an agent-facing surface
 
-The method for producing the live evidence a debrief judges by. Proven across the
-supervisor MCP campaign's five-model roster; portable to any surface a model consumes.
+The method for producing the live evidence a debrief judges by. Proven across a five-model
+roster and portable to any surface a model consumes.
 
 ## The tier ladder
 

package/dist/host/agents/skills/orkestrel-debrief/references/instruction-audit.md

@@ -63,6 +63,18 @@ Findings land as one of:
   probe-first, journal-first, verdict shapes, launch ownership) land in the operating
   contract, mirrored across providers.
 
+## Three questions every round asks
+
+- **Which findings came from falsification rather than diff reading**, and is the brief
+  shape that produced them doctrine yet? Route to the Falsification law in
+  `.claude/rules/quality.md`.
+- **Which shipped gaps were accepted as untestable**, and was each one genuinely
+  irreducible or a missing seam? Route to the missing-seam law in
+  `.claude/rules/tests.md`.
+- **Which units could not be re-run from their own recorded brief**, and why? A unit whose
+  instruction never became a file, or whose correction left its brief behind, is a defect in
+  the dispatch. Route to the brief-and-report laws in the operating contract.
+
 ## Mirror discipline
 
 Every roster or contract change lands on all provider surfaces in the same round: the

package/dist/host/claude/agents/codex.md

@@ -77,6 +77,13 @@ argument, diagnosis, correctness/security audit, and constraint review. Capture
 repository status before and after. Require evidence for every claim and return
 unsupported claims as dropped.
 
+An audit brief states its subject as a numbered list of falsifiable claims rather
+than a diff to read, and requires Sol to attempt refutation: each claim comes back
+CONFIRMED with the evidence that convinced it, or BROKEN with the exact failing
+input, state, or interleaving. The Falsification section of
+`.claude/rules/quality.md` owns that method — point the brief at it instead of
+restating it.
+
 ## Implementer
 
 Sandbox `workspace-write`, main checkout, sole serial writer from a clean

package/dist/host/claude/agents/orkestrel.md

@@ -44,11 +44,11 @@ descriptions never enter agent instruction context.
 | @orkestrel/database   | 0.0.7   |
 | @orkestrel/emitter    | 0.0.5   |
 | @orkestrel/guide      | 0.0.8   |
-| @orkestrel/html       | 0.0.1   |
+| @orkestrel/html       | 0.0.2   |
 | @orkestrel/indexeddb  | 0.0.6   |
 | @orkestrel/interpret  | 0.0.7   |
 | @orkestrel/markdown   | 0.0.7   |
-| @orkestrel/mcp        | 0.0.11  |
+| @orkestrel/mcp        | 0.0.12  |
 | @orkestrel/middleware | 0.0.9   |
 | @orkestrel/msg        | 0.0.5   |
 | @orkestrel/ndjson     | 0.0.5   |
@@ -61,7 +61,7 @@ descriptions never enter agent instruction context.
 | @orkestrel/reason     | 0.0.4   |
 | @orkestrel/relation   | 0.0.7   |
 | @orkestrel/router     | 0.0.8   |
-| @orkestrel/scaffold   | 0.0.18  |
+| @orkestrel/scaffold   | 0.0.20  |
 | @orkestrel/sea        | 0.0.5   |
 | @orkestrel/server     | 0.0.10  |
 | @orkestrel/sqlite     | 0.0.6   |

package/dist/host/claude/agents/reviewer.md

@@ -33,6 +33,11 @@ Audit the changed work only through Opus 5's subjective and creative lens:
 5. **Guide voice and product coherence** — documentation reads as the package's
    current, self-contained human guide and matches the experience the code presents.
 
+Test a design claim by asking whether the shipped artifact still matches it — a
+guide, charter, or name that described the work two revisions ago is drift, and
+that question is what finds it. Anything you cannot settle on subjective grounds
+becomes an Analyst referral rather than a verdict of yours.
+
 For a rendered or externally driven surface, the supplied capture portfolio is the
 primary evidence and source is corroboration only: cite a capture for every rendered
 claim, mark what the portfolio cannot show as NOT-EVIDENCED instead of inferring it,

package/dist/host/claude/rules/quality.md

@@ -21,6 +21,16 @@ paths:
 - Treat existing code, tests, `old/`, branches, and copied projects as evidence rather than authority.
 - Build a capability/defect matrix before a broad API or production-readiness change. Every row ends as implement, repair, retain, or intentionally exclude with evidence.
 
+## Falsification
+
+A review that reads a diff finds what the diff shows; a review that tries to break named claims finds what the diff hides. Code that has already passed diff review several times can still carry a defect nobody has yet tried to trigger.
+
+- State an audit's subject as a numbered list of the claims the work makes, never as “review this diff”. Each claim is falsifiable: a property some concrete input, state, or interleaving could show false.
+- Instruct the auditor to attempt refutation rather than confirmation. A claim it cannot break is reported CONFIRMED with the evidence that convinced it; a claim it breaks is reported BROKEN with the exact failing input, state, or interleaving, plus the smallest correct fix.
+- Derive claims from what the change asserts under adverse conditions: cancellation, restart, concurrency, partial failure, hostile input, resource exhaustion, and the orderings a happy path never reaches.
+- Read the installed declaration or implementation of every substrate a claim depends on. A claim about `stop()` is unfalsifiable until you know what `stop()` does when the status is not the one the caller assumed.
+- An audit returning only confirmations has either audited trivial claims or has not tried. Name the claims you could not break, so the next round knows what has already been attacked.
+
 ## Ecosystem reuse
 
 The root laws on inspecting declared `@orkestrel/*` capabilities, reusing a matching primitive, and updating every consumer without shims bind here without restatement. They leave this file the judgment calls:

package/dist/host/claude/rules/tests.md

@@ -111,6 +111,16 @@ Keep Vitest/provider configuration minimal:
 - Remove exploratory settings after fixing the cause.
 - Config comments explain the current reason, not the history of failed experiments.
 
+## Untestable usually means missing seam
+
+Before accepting that a behavior cannot be tested, look for the seam that would make it testable.
+
+- A collaborator reached through a hard-coded global — a stream, a clock source, a spawn, a fetch — is a missing injection point, not an untestable truth. An injected collaborator with a real minimal implementation is a sanctioned boundary stub, not a mock of project-owned behavior.
+- Prefer adding the seam over shipping the gap whenever the seam is one the design would welcome anyway, and whenever a sibling collaborator is already injected.
+- When a gap is genuinely irreducible, record it where a reader meets it: what is unproven, why it cannot be driven, and what would change that. A silent untested guard reads exactly like a tested one.
+
+Coverage reporting is a discovery input, never evidence of proof. It answers one cheap mechanical question — which code no test even executed — and that question reliably finds forgotten branches and rules nothing calls. It cannot tell you whether an executed line is asserted, so a fully covered file can still be entirely unproven. Read a coverage report to find candidates for the adequacy audit; never cite it as the audit's result, and never let a percentage become the target.
+
 ## Discovery and adequacy audit
 
 Before acceptance:

package/dist/host/codex/agents/analyst.toml

@@ -9,7 +9,11 @@ governing guide/spec, and the exact scope. For design, take the same brief as Op
 independently and argue what contracts, evidence, and constraints permit. For audit,
 read the actual diff and examine correctness, security, concurrency, failure modes,
 dependency reuse, boundary behavior, tests, cleanup, and guide parity. Require
-file:line evidence and drop unsupported claims. For a rendered or externally driven
+file:line evidence and drop unsupported claims. When the brief states its subject as
+numbered falsifiable claims, attempt refutation rather than confirmation and return
+each claim CONFIRMED with the evidence that convinced you or BROKEN with the exact
+failing input, state, or interleaving, per the Falsification section of
+.claude/rules/quality.md. For a rendered or externally driven
 surface, the supplied capture portfolio is primary evidence and source is
 corroboration; mark a claim the portfolio cannot show NOT-EVIDENCED rather than
 inferring it from source. Never edit, implement, reconcile, accept, or spawn. Return

package/dist/host/codex/agents/reviewer.toml

@@ -15,7 +15,9 @@ Verify that the `claude` CLI is available before dispatch. If it is absent or th
 dispatch fails, return the failure immediately so the Sol main session can run the
 design-audit pass itself and record that Opus was unavailable for this round.
 Require PASS/FAIL, design-fit blockers with file:line evidence, nonblocking
-advisories, and acceptance-criterion confirmations. For a rendered or externally
+advisories, and acceptance-criterion confirmations. Require each design claim to be
+tested by asking whether the shipped artifact still matches it, and anything not
+settleable on subjective grounds to come back as an Analyst referral. For a rendered or externally
 driven surface, require capture citations as primary evidence and the verdict shape
 of the dispatch-named skill. Forbid edits, commands, orchestration, reconciliation,
 and acceptance. Never invoke Fable, read credentials,

package/dist/host/codex/config.toml

@@ -53,10 +53,16 @@ concurrently.
 
 Every dispatch includes objective, context, AGENTS.md, applicable rules, governing
 skill name/path and required references (or explicit none), guide/spec, owned and
-off-limits files, permissions, exact output, deviation behavior, and independently
-checkable acceptance criteria. Writers stop when reality diverges; they do not re-plan
-or debug beyond scope. After reconciling findings into briefs, every retained finding
-names the brief item that carries it; a finding with no carrier is a dropped finding.
+off-limits files, permissions, exact output, deviation behavior, declared unknowns
+with how the unit reports them, the requirement that the executor spawns nothing,
+and independently checkable acceptance criteria. Every brief is a file under tmp/
+written before its unit launches, with the unit's report captured beside it; a
+re-run amends the brief in a successor file rather than restating it; both are
+swept at campaign acceptance, so anything that must outlive the campaign is
+promoted into a durable artifact first. Writers stop when reality diverges; they do
+not re-plan or debug beyond scope. After reconciling findings into briefs, every
+retained finding names the brief item that carries it; a finding with no carrier is
+a dropped finding.
 
 A claim about a rendered or externally driven surface is evidenced by its capture
 portfolio or a real foreign client driving it, never by source alone; the campaign

package/dist/host/guides/src/scaffold.md

@@ -67,11 +67,41 @@ than aspirational:
 - `app/browser` reaches server behavior only through shared `app/core` contracts and transports,
   never through a server implementation import.
 
-A generated `app/server` owns strict `APP_HOST`, `APP_PORT`, and `APP_START_TIMEOUT` parsing, a
-repeat-safe HTTP lifecycle, bounded connection behavior, and process signal cleanup. Its exported
+A generated `app/server` owns strict grouped `server.host`, `server.port`, and `server.timeout`
+options plus the `APP_HOST`, `APP_PORT`, and `APP_START_TIMEOUT` environment boundaries. It
+composes the installed router, server, and boundary/security/deadline middleware substrates around
+a fresh `GET /health` dispatcher from `createApplicationDispatcher`, supports repeated start/stop
+cycles and terminal destroy of both the server and its owned dispatcher, and writes exactly one
+`[READY] <name> <url>` diagnostic after process-owned readiness. The process runner owns an emitter
+whose `ApplicationServerRunnerEventMap` publishes `ready(url)` and `fail(error)`; initial
+`ApplicationServerRunnerOptions.on` hooks run before the runner's own announcement and reporting
+listeners; a synchronous fail hook sees an otherwise-unset `process.exitCode` as `undefined` before
+the default reporter sets it to `1`. Concurrent stops join one substrate shutdown. In-process tests park on those events,
+while child-process tests still observe the readiness line across the process boundary. Its exported
 `reportApplicationServerError` handler writes only a stable configuration, lifecycle, or unknown
-failure code; process-owned diagnostics never serialize a rejected value, nested cause, stack, or
-other error context.
+failure code; process-owned failures never serialize a rejected value, nested cause, stack,
+secret, or other error context. `ApplicationState` extends middleware's `IdentifierState` and adds
+only the connection fact. `ApplicationServer.url` is `undefined` until a real port is bound and
+again after stop or destroy; the redundant `listening` projection is not part of the generated
+interface. The runner narrows the post-start URL before writing `[READY]`, so it never announces a
+stale or unbound address, and it stops the server as part of failing that narrowing rather than
+leaving a bound listener without a shutdown owner. It also serializes every start and stop on one
+lifecycle queue, so a stop waits for the startup it aborted to settle before closing the server,
+and a restart issued during that shutdown is honoured after it rather than lost.
+
+The health contract belongs to whichever layer both hosts can reach. While the server alone reads
+it, `ApplicationRecord`, `APP_HEALTH_METHOD`, and `APP_HEALTH_PATH` stay declared in `app/server`.
+The moment a blueprint declares `app/browser` beside `app/server` — a combination that already
+requires `app/core` — those three declarations move to `app/core` and gain `APP_HEALTH_TIMEOUT`,
+the `isApplicationRecord` guard, and `readApplicationHealth`. That one asynchronous read is the
+whole browser/server boundary: it fetches the running server's health route, reads the body as
+`unknown`, narrows it with the shared guard, and returns the shared `Application` identity or
+`undefined` for an unreachable, slow, or off-contract answer. Nothing is duplicated by the move —
+`app/server` imports the relocated contract from `@app/core`, and `app/browser` still never imports
+a server module. The generated browser entry then mounts `mountBrowserApplication`, which performs
+that single read before mounting and falls back to the locally configured identity when the
+boundary yields `undefined`. A rejected mount reports the context-free
+`[ERROR] Browser application failed`, the browser twin of that server-side discipline.
 
 Every environment barrel is an export-star barrel: `index.ts` contains only `export * from './x.js'`
 rows and nothing else. Named, default, namespace, and type-only barrel rows are absent by design,
@@ -416,7 +446,9 @@ From [`constants.ts`](../../src/core/constants.ts).
 | `SCAFFOLD_RANGE`                  | const |
 | `BASE_DEV_DEPENDENCIES`           | const |
 | `SOURCE_BROWSER_DEV_DEPENDENCIES` | const |
+| `APP_DEV_DEPENDENCIES`            | const |
 | `APP_BROWSER_DEV_DEPENDENCIES`    | const |
+| `APP_SERVER_DEV_DEPENDENCIES`     | const |
 | `CHECKOUT_ACTION_SHA`             | const |
 | `SETUP_NODE_ACTION_SHA`           | const |
 | `COMPILER_ID`                     | const |
@@ -464,8 +496,11 @@ form. `HEX_PATTERN` requires whole lowercase byte pairs, and `SYNC_BASELINE_PATT
 `MINIMUM_NODE_VERSION` is `22.12.0`, `DEFAULT_ENGINES` derives from it, and `DEFAULT_VERSION` is
 `0.0.1`. `BASE_DEV_DEPENDENCIES` is the host-neutral tooling baseline every generated workspace
 gets; `SOURCE_BROWSER_DEV_DEPENDENCIES` adds the real browser providers a published browser environment
-needs, and `APP_BROWSER_DEV_DEPENDENCIES` extends that with the Vue toolchain a private browser
-application needs. Vite is minor-pinned at `~8.2.0`: the generated boundary consumes the reviewed
+needs; `APP_DEV_DEPENDENCIES` is the baseline every private application environment gets;
+`APP_BROWSER_DEV_DEPENDENCIES` adds the Vue toolchain and `@orkestrel/html` start-tag parser a
+private browser application needs;
+and `APP_SERVER_DEV_DEPENDENCIES` adds the emitter, middleware, router, and server packages a private
+server application needs. Vite is minor-pinned at `~8.2.0`: the generated boundary consumes the reviewed
 8.2 `CSSOptions`, `preprocessCSS`, and `isCSSRequest` surface, while the selected
 `css.transformer` / `lightningcss` path is experimental and must not float into an unreviewed minor.
 `SCAFFOLD_RANGE` is the range generated workspaces pin this package at.
@@ -788,6 +823,8 @@ From [`helpers.ts`](../../src/core/helpers.ts).
 | `pascalCase`                | function |
 | `escapeHtmlText`            | function |
 | `serializeTypeScriptString` | function |
+| `hasApplicationBoundary`    | function |
+| `hasApplicationShowcase`    | function |
 | `blueprintToMembers`        | function |
 | `catalogNames`              | function |
 | `alignTable`                | function |
@@ -824,6 +861,7 @@ From [`helpers.ts`](../../src/core/helpers.ts).
 | `renderArray`               | function |
 | `renderObject`              | function |
 | `renderValue`               | function |
+| `renderStringArray`         | function |
 | `formatJson`                | function |
 | `pinPlan`                   | function |
 
@@ -836,7 +874,9 @@ guard. `blueprint` fills the defaults: `version` and `engines` from their consta
 derives the entity name from a lowercase-hyphen package name, and `blueprintToMembers` derives the
 declared public `Member[]` — a full entity, options type, interface, and factory per published
 environment, plus the exact declaration inventory each selected application environment
-contributes.
+contributes. `hasApplicationBoundary` recognizes exactly app/core + app/browser + app/server,
+while `hasApplicationShowcase` requires showcase intent beside app/browser; plan assembly, tests,
+guides, and member inventory share those predicates.
 
 `escapeHtmlText` and `serializeTypeScriptString` are the two escaping leaves used when a
 caller-supplied name reaches generated HTML or generated TypeScript source; the latter preserves
@@ -888,7 +928,12 @@ id is already registered: an identical plan is idempotent, while a distinct payl
 `formatJson` and its leaves — `renderValue`,
 `renderArray`, `renderObject`, `computeColumnWidth`, and `fitsPrintWidth` — emit JSON that matches the fleet
 formatter byte for byte, collapsing a short array onto one line and breaking a long one, so
-computed configuration JSON is format-stable by construction.
+computed configuration JSON is format-stable by construction. `renderStringArray` applies the same
+inline-or-broken width rule to single-quoted TypeScript string-array literals — with a trailing
+comma on every broken line, matching `oxfmt`'s `trailingComma: "all"` for non-JSON files — so
+generated TypeScript configuration is format-stable too. It serializes every string element through
+`serializeTypeScriptString`, so quotes, backslashes, controls, and line separators remain inert in
+both layouts.
 
 ### Helpers — server
 
@@ -1049,6 +1094,7 @@ From [`compilers.ts`](../../src/core/compilers.ts).
 | `renderViteTest`           | function |
 | `viteHeader`               | function |
 | `policyViteProject`        | function |
+| `configViteProject`        | function |
 | `guidesViteProject`        | function |
 | `binViteProject`           | function |
 | `integrationViteProject`   | function |
@@ -1136,7 +1182,7 @@ formatter's 100-column fixed point: a complete registration-array line, includin
 its trailing comma, stays collapsed when it fits and expands one entry per line otherwise.
 `viteProjectRegistrations` is the one registration derivation every root shape consumes: it derives
 the selected source and application projects from the canonical environment order, then appends
-`policy`, `guides`, and the optional `srcBin`, `integration`, and `service` projects.
+`policy`, `config`, `guides`, and the optional `srcBin`, `integration`, and `service` projects.
 `viteProjectDefinitions` renders the standalone proof and structural-fact definitions in that same
 order with one blank line between declarations. Both consume `ViteFacts`, so each optional project
 is controlled only by its matching `bin`, `integration`, or `service` blueprint fact; the same
@@ -1149,8 +1195,9 @@ the root `srcCore` factory and its wrapper stay host-independent even when the w
 browser target. `binTsconfig` emits the executable declaration scope; `rootViteConfig`,
 `singleSrcViteConfig`, and `applicationViteConfig` emit the root configuration for a library-only,
 single non-core `src` environment, and application-bearing workspace respectively; and
-`policyViteProject`, `guidesViteProject`, `integrationViteProject`, and `serviceViteProject` emit
-the standalone Node proof projects, with `binViteProject` the single executable-project emitter. A
+`policyViteProject`, `configViteProject`, `guidesViteProject`, `integrationViteProject`, and
+`serviceViteProject` emit the standalone Node proof projects, with `binViteProject` the single
+executable-project emitter. A
 proof project is structurally derived from the directory holding its tests and never wraps a source
 or application environment project. The guides project therefore uses only `tests/setup.ts`, never
 `setupServer.ts`, `setupBrowser.ts`, or `setupService.ts`; and its `tests/src/**/*.test.ts` and
@@ -1540,13 +1587,13 @@ a fixed, interleaved order so aggregates sit immediately before their per-enviro
 - `format`, `format:check`, `lint:check`
 - `test`, then `test:src` and its per-environment scopes, the optional `test:integration`,
   `test:equivalence`, and `test:service` proofs, `test:app` and its per-environment scopes, then
-  `test:policy` and `test:guides`
+  `test:policy`, `test:config`, and `test:guides`
 - `build`, then `build:src` and its per-environment targets, `build:app` and its runtime targets, and
   `build:host` for a bin workspace
 - `dev` when a browser application is selected; `serve` and `serve:build` when a server application
   is selected
 - `showcase`, `build:showcase`, and `show` only when the physical showcase wrapper is present;
-  `show` builds and copies `dist/showcase/index.html` to `demo/showcase.html`
+  `show` formats, then builds, then copies `dist/showcase/index.html` to `demo/showcase.html`
 - `prepublishOnly` chaining `format:check → lint:check → check → build → test`, followed by
   `test:integration` when the integration axis is selected
 
@@ -1560,8 +1607,9 @@ only where `bin` and `integration` are both set:
 | `test:equivalence` | no         | no               | no                         |
 | `test:service`     | no         | never            | after `scripts/service.sh` |
 
-No proof joins the default chain: `npm test` runs the source, application, policy, and guide
-projects, and nothing there needs a build artifact or a foreign process. Publication is the one
+No opt-in proof joins the default chain: `npm test` runs the source, application, policy,
+configuration, and guide projects, and nothing there needs a build artifact or a foreign process.
+Publication is the one
 asymmetry — `prepublishOnly` appends `test:integration`, because a package about to be published
 should prove itself against its own built output, while `test:service` is never in that chain.
 Neither default testing nor publication starts or requires a foreign process.
@@ -1633,10 +1681,16 @@ comments, text, raw blocks, attributes, adjacent tokens, casing, and user-author
 byte-stable. The trusted preparation hook owns the final pre-parse phase; inline proxy code is
 restored before module analysis, and the first normal post-parse hook restores the original HTML
 spelling. The browser entry begins with a generated, byte-stable security prologue: the doctype,
-document and head opening, and a `Content-Security-Policy` meta element are one required prefix.
-Preparation rejects a missing, moved, or changed prologue before Vite parses the document, and the
-final trusted post-hook verifies that Vite retained the policy. CRLF and LF files are both accepted;
-the prologue's markup and ordering are otherwise exact. Vite's `%ENV%` HTML substitution is rejected
+head opening, and `Content-Security-Policy` meta markup, ordering, and indentation are exact. The
+opening `html` start tag is parsed by `@orkestrel/html`'s fail-closed `parseStartTag` boundary,
+so ASCII case and well-formed attributes such as `lang`, `data-bs-theme`, and `data-bs-core`
+may vary without weakening the position of the following head and policy. A malformed, incomplete,
+duplicate-attribute, wrong-name, or syntactically slashed root still fails closed. Preparation owns
+that positional check while the document is still generated bytes; the final trusted post-hook
+checks only that the exact
+policy survived because Vite may legitimately inject into the head. CRLF and LF files are both
+accepted. Vite's
+`%ENV%` HTML substitution is rejected
 before parsing because Vite performs that expansion after every plugin pre-hook, where it could
 otherwise create a late control attribute. The guard walks the exact left-to-right `%(\S+?)%`
 tokens Vite recognizes instead of performing a substring search, and each preparation plugin owns
@@ -1685,15 +1739,31 @@ still rejects public directories, browser asset inlining, and output path overri
 post-factory composition as defense in depth; that narrow check is not a general extension seam.
 
 When the showcase fact is present, the generated root also exports closed
-`appShowcase(...config: never[])`; both factories reject every argument at runtime and
-share one fixed internal browser configuration. The ordinary factory retains its strict
+`appShowcase(...config: never[])`; both factories reject every argument at runtime. The
+ordinary factory retains its strict
 `script-src 'self'` policy, external asset auditing, and `dist/app/browser` output. The showcase
-factory alone writes `dist/showcase`, applies `viteSingleFile` with
+factory is a standalone configuration with `base: './'`, unlimited asset inlining, and
+`dist/showcase` output. It applies `viteSingleFile` with
 `removeViteModuleLoader: true` and `useRecommendedBuildConfig: true`, uses Oxc and Lightning CSS
-minification for an `esnext` build without source maps or module preload, and inserts a non-empty ISO
-`build-id` meta. Its generated CSP admits only the inline script and style required by the
-self-contained `file://` artifact while retaining `script-src-attr 'none'`, `object-src 'none'`, and
-`base-uri 'none'`.
+minification for an `esnext` build without source maps or module preload, and inserts a SHA-256
+`build-id` derived from the secured, fully inlined document. An unchanged document therefore keeps
+the same id, while any changed byte changes it. The showcase development CSP keeps scripts
+same-origin and permits Vue's injected inline styles. Its built CSP swaps that script permission to
+inline and admits only inline styles plus data images and fonts, while both policies retain
+`default-src 'none'`, `script-src-attr 'none'`, `object-src 'none'`, and `base-uri 'none'`.
+
+The showcase fact also emits its own entry pair, `app/browser/showcase.html` and
+`app/browser/showcase.ts`, beside the application's `index.html` and `main.ts`. Both HTML entries
+open with a generated security prologue: the application carries the ordinary strict policy and the
+showcase carries its development policy. The boundary plugins select and validate the matching
+prologue; the showcase build alone swaps in the self-contained policy before hashing and renames its
+single HTML output to `index.html`, which is what `show` copies to `demo/showcase.html`. The showcase entry
+mounts `mountShowcaseApplication`, and `app/browser/seeders.ts` exports exactly one seeder,
+`seedApplication`, returning a frozen identity of the same shape the shipped root view receives.
+The two mount factories differ in the seed expression alone. Both explicitly pass
+`{ name: seed.name }` to the same `createBrowserApplication` root: the showcase seed comes from
+`seedApplication()`, while the shipped application seed comes from `readApplicationHealth` with
+the configured identity as its fallback.
 
 The browser development server applies the same trust boundary before Vite's internal middleware.
 Its explicit filesystem allowlist contains only browser/core source roots, browser tests, their
@@ -1756,12 +1826,26 @@ it is not a general-purpose source analyzer. Generated workspaces receive the sa
 module as a host-origin file and run it as a dedicated Node-only `policy` test project over
 `tests/policy.test.ts`.
 
+**The configuration suite.** Policy reads source, the `config` project exercises the root
+configuration, and integration builds for real. Every generated workspace therefore receives a
+universal Node-only
+`config` project over `tests/config/**/*.test.ts`. Its base cases execute the root module's physical
+workspace containment and environment-direction helpers; conditional cases exercise output
+containment when the workspace builds, managed/system browser discovery when a browser environment
+exists, and the HTML/CSP boundary only for an application browser. Those cases import the generated
+root `vite.config.ts` itself, so a failure is repaired in the generator rather than patched into a
+consumer. The generated-consumer integration matrix remains the fidelity boundary for real builds;
+the configuration suite supplies deterministic edge coverage without duplicating build orchestration.
+When scaffold changes a generated configuration invariant, an existing consumer's `vite.config.ts`
+is intentionally reported stale until that consumer accepts the regenerated configuration and its
+matching config test.
+
 **Real browser capability.** Browser test projects are gated on one centralized discovery chain:
 Playwright's pinned Chromium executable first, then a managed Chromium alias or cached revision,
 then stable system Chrome, then stable system Edge. Managed candidates must be executable regular
 files. System channels are selected only when their executable exists at Playwright's standard
 Linux, macOS, or Windows installation location; custom installations are not guessed. The generated
-policy test consumes the same discovery helpers and accepts either an executable managed path or the
+configuration test consumes the same discovery helpers and accepts either an executable managed path or the
 stable `chrome` / `msedge` channel, so it does not maintain a second heuristic.
 
 A browser suite runs when any one of those real browser capabilities is available and is skipped
@@ -1900,7 +1984,10 @@ renderer behind the table and blockquote work; the template engine behind every
 artifact; and, consumed only at the executable boundary, the terminal prompt toolkit and the console
 reporter. The core face uses the first four and stays pure; the server face adds only `node:*`
 builtins. Development dependencies are the shared tooling baseline plus the guide-parity toolkit
-that drives [`parity.test.ts`](../../tests/guides/src/parity.test.ts). The engines floor is Node
+that drives [`parity.test.ts`](../../tests/guides/src/parity.test.ts) and `@orkestrel/html`,
+which this package's real emitted-configuration tests execute. Generated manifests keep that HTML
+dependency scoped to `app/browser`; source-only, `app/core`, and `app/server` workspaces do not
+receive it. The engines floor is Node
 `>=22.12.0`, and the build emits ES and CJS for both library faces plus an ES executable.
 
 ## Patterns
@@ -2245,6 +2332,7 @@ import {
 	appViteConfig,
 	applicationViteConfig,
 	binViteProject,
+	configViteProject,
 	coreTsconfig,
 	coreViteConfig,
 	guidesViteProject,
@@ -2276,13 +2364,14 @@ coreViteConfig()
 srcViteConfig('browser')
 appViteConfig('server')
 policyViteProject()
+configViteProject()
 guidesViteProject()
 binViteProject()
 integrationViteProject({ bin: true, integration: true, global: true })
 serviceViteProject()
 viteProjectDefinitions({ integration: true }).includes('export const integration =') // true
 viteProjectRegistrations(['core'], [], { integration: true }).map(({ project }) => project)
-// ['srcCore', 'policy', 'guides', 'integration']
+// ['srcCore', 'policy', 'config', 'guides', 'integration']
 
 rootViteConfig(['core', 'server'], { bin: true })
 singleSrcViteConfig('server').includes('srcServer') // true
@@ -2576,6 +2665,8 @@ isMissingPathError(caught) // true only for an ENOENT error
   ids, the batch-overload semantics, and all-or-nothing list removal.
 - [`tests/src/core/policy.test.ts`](../../tests/src/core/policy.test.ts) — the repository coding-law
   policy module against this workspace and against deliberately hostile fixtures.
+- [`tests/config/vite.test.ts`](../../tests/config/vite.test.ts) — the executable root Vite
+  invariants for workspace, environment, and output containment.
 - [`tests/src/server/helpers.test.ts`](../../tests/src/server/helpers.test.ts) — containment,
   digests, host staging, hydration, derivation, prune scanning, and the local catalog.
 - [`tests/src/server/validators.test.ts`](../../tests/src/server/validators.test.ts) — the portable