@orkestrel/scaffold 0.0.5 → 0.0.7

package/dist/host/guides/src/scaffold.md

@@ -29,7 +29,7 @@ that projection, expressed as data. Rendered defaults ship as versioned package
 here rather than a hand edit in every workspace.
 
 The module is mechanism, never product policy. The judgment calls — the name, the description, the
-keywords, which src and app environments, which dependencies, any template override —
+keywords, which src and app environments, which dependencies, any artifact override —
 belong to the caller. What this module supplies is the closed vocabularies, the variant matrix as
 data, exact-record validation, a fail-closed gate, a deterministic pin, and lossless projections.
 
@@ -127,49 +127,50 @@ plan.artifacts.some((artifact) => artifact.path === 'app/server/main.ts') // tru
 
 From [`types.ts`](../../src/core/types.ts).
 
-| Name                   | Kind      |
-| ---------------------- | --------- |
-| `Environment`          | type      |
-| `BuildFormat`          | type      |
-| `SrcDefinition`        | interface |
-| `AppDefinition`        | interface |
-| `ViteMachinery`        | interface |
-| `Origin`               | type      |
-| `Group`                | type      |
-| `Category`             | type      |
-| `CatalogEntry`         | interface |
-| `Drift`                | type      |
-| `Freshness`            | type      |
-| `CompileStage`         | type      |
-| `ScaffoldErrorCode`    | type      |
-| `Dependency`           | interface |
-| `Override`             | interface |
-| `Blueprint`            | interface |
-| `Member`               | interface |
-| `ArtifactBase`         | interface |
-| `HostArtifact`         | interface |
-| `ContentArtifact`      | interface |
-| `Artifact`             | type      |
-| `Snapshot`             | type      |
-| `Plan`                 | interface |
-| `Finding`              | interface |
-| `Audit`                | interface |
-| `Question`             | interface |
-| `Validation`           | interface |
-| `GuideSync`            | interface |
-| `VersionSync`          | interface |
-| `SyncReport`           | interface |
-| `PlanSummary`          | interface |
-| `CompileRecord`        | interface |
-| `CompileFailure`       | interface |
-| `Scaffolding`          | interface |
-| `PlanRecord`           | interface |
-| `CompilerEventMap`     | type      |
-| `CompilerOptions`      | interface |
-| `CompilerInterface`    | interface |
-| `PlanManagerEventMap`  | type      |
-| `PlanManagerOptions`   | interface |
-| `PlanManagerInterface` | interface |
+| Name                      | Kind      |
+| ------------------------- | --------- |
+| `Environment`             | type      |
+| `BuildFormat`             | type      |
+| `SrcDefinition`           | interface |
+| `AppDefinition`           | interface |
+| `ViteMachinery`           | interface |
+| `ViteProjectRegistration` | interface |
+| `Origin`                  | type      |
+| `Group`                   | type      |
+| `Category`                | type      |
+| `CatalogEntry`            | interface |
+| `Drift`                   | type      |
+| `Freshness`               | type      |
+| `CompileStage`            | type      |
+| `ScaffoldErrorCode`       | type      |
+| `Dependency`              | interface |
+| `Override`                | interface |
+| `Blueprint`               | interface |
+| `Member`                  | interface |
+| `ArtifactBase`            | interface |
+| `HostArtifact`            | interface |
+| `ContentArtifact`         | interface |
+| `Artifact`                | type      |
+| `Snapshot`                | type      |
+| `Plan`                    | interface |
+| `Finding`                 | interface |
+| `Audit`                   | interface |
+| `Question`                | interface |
+| `Validation`              | interface |
+| `GuideSync`               | interface |
+| `VersionSync`             | interface |
+| `SyncReport`              | interface |
+| `PlanSummary`             | interface |
+| `CompileRecord`           | interface |
+| `CompileFailure`          | interface |
+| `Scaffolding`             | interface |
+| `PlanRecord`              | interface |
+| `CompilerEventMap`        | type      |
+| `CompilerOptions`         | interface |
+| `CompilerInterface`       | interface |
+| `PlanManagerEventMap`     | type      |
+| `PlanManagerOptions`      | interface |
+| `PlanManagerInterface`    | interface |
 
 The closed vocabularies are small and total. `Environment` is `'core' | 'browser' | 'server'`.
 `BuildFormat` is `'es' | 'cjs'`. `Origin` is `'host' | 'template' | 'computed'`. `Group` is
@@ -190,6 +191,10 @@ single-file-component, HTML, and development-server machinery an application bro
 needs, and `output` for build-output containment. It never selects a boundary guarantee — those ship
 in every shape, as the compilers section sets out.
 
+`ViteProjectRegistration` carries one generated project factory identifier and its optional browser
+label. Root configuration renderers preserve that browser ownership as data through registration
+instead of inferring it from a project identifier.
+
 `Blueprint` is the closed input spec:
 
 ```ts
@@ -370,7 +375,9 @@ value lists behind their literal unions. `SRC_MATRIX` is the `src` environment m
 data — each environment's `configs/src` files, test-project label, `exports` subpath, and build
 formats. `APP_MATRIX` is its application sibling, adding the runtime entry where an environment produces
 one (`app/browser/index.html`, `app/server/main.ts`). `HOST_PATHS` is the ordered list of
-byte-copied host artifacts.
+byte-copied host artifacts, and it is the staging manifest rather than the per-plan carried set:
+`stageHost` vendors every path on it, while each plan carries the subset `selectHostPaths` selects
+for that one workspace.
 
 The bounds are public because they are part of the contract, not implementation trivia.
 `MAX_ARTIFACT_BYTES` caps one artifact at 5 MiB and `MAX_TOTAL_ARTIFACT_BYTES` caps one blueprint,
@@ -544,7 +551,8 @@ entity allocation.
 then checks every override against the exact artifact set the plan would write. An override whose
 `path` matches no planned artifact, targets a `host`-origin artifact, or targets the
 blueprint-owned `package.json` publication boundary is a blocking question rather than a silent
-no-op.
+no-op. An override that clears all three lands a `warnings` entry naming the path it replaces — the
+declaration is accepted, and it is never accepted silently.
 
 ### Validators — server
 
@@ -736,11 +744,13 @@ From [`helpers.ts`](../../src/core/helpers.ts).
 | `contentByteLength`         | function |
 | `contentToHex`              | function |
 | `snapshotOf`                | function |
+| `selectHostPaths`           | function |
 | `findPathConflict`          | function |
 | `findFileConflict`          | function |
 | `validateDependencyArray`   | function |
 | `validateBlueprint`         | function |
 | `manifestToDependencies`    | function |
+| `manifestToName`            | function |
 | `rangeToFreshness`          | function |
 | `computeHash`               | function |
 | `stableStringify`           | function |
@@ -786,14 +796,20 @@ report projections count with.
 `snapshotOf`, `contentToHex`, `contentToBytes`, `contentByteLength`, `contentCodePoint`, and
 `bytesToHex` are the host-independent byte leaves that make exact comparison possible without a
 host encoder or buffer; an unpaired surrogate encodes as `U+FFFD` rather than throwing.
-`findPathConflict` finds the first exact or case-insensitive collision in a path list, and
-`findFileConflict` additionally rejects a file that would sit inside another planned path.
+`selectHostPaths` is the one-owner filter plan assembly applies before it carries anything: it
+returns the host paths in input order minus `guides/src/<name>.md`, so a workspace never plans a
+vendored mirror of the guide it writes itself. `findPathConflict` finds the first exact or
+case-insensitive collision in a path list, and `findFileConflict` additionally rejects a file that
+would sit inside another planned path — the loud backstop behind that selection.
 
 `validateBlueprint` and `validateDependencyArray` are the semantic pass. The array validator is
 pure — it returns its questions and the set of names it saw, so the caller can apply the
 cross-array overlap rules on top. `manifestToDependencies` reads a manifest's `dependencies`,
 `devDependencies`, and `peerDependencies` in that order, keeps only own data sections and scoped
-names, deduplicates, and never throws. `rangeToFreshness` applies the exact-pin comparison; the `missing` and `failed`
+names, deduplicates, and never throws. `manifestToName` is its self-reading sibling over the same
+text: the manifest's own string `name`, or `undefined` when the text is oversized, malformed,
+rootless, or nameless — the projection that lets a target recognize itself in its own declared
+dependencies. `rangeToFreshness` applies the exact-pin comparison; the `missing` and `failed`
 verdicts come from the fetch layer, never from this pure comparison.
 
 `computeHash` is a deterministic FNV-1a digest and `stableStringify` a key-order-independent
@@ -904,7 +920,9 @@ dependency-less stand-in. Environments come from `src/<environment>/` and `app/<
 scoped entries, with an optional peer recovered from `peerDependenciesMeta`; and `extras` is every
 development dependency minus the generated baseline and minus anything already declared as a
 dependency or peer, so a hand-added development dependency round-trips and stays audit-clean.
-`overrides` is always empty, because derivation cannot know a caller's override intent.
+Derivation yields no `overrides`: they are caller-time inputs, not repository state. A computed
+artifact that must differ reveals a gap in the canon; the blueprint grows an axis for that
+distinction rather than the repository forking the file.
 
 `storagePath`, `stageHost`, `readHostManifest`, `locateHostSource`, `remapArtifactPath`, and
 `hydratePlan` are the vendored-host path. `storagePath` maps a repo-relative path to its un-dotted
@@ -926,7 +944,9 @@ anything.
 `consumeCatalogAllowance` decrements the single shared entry allowance and throws `TARGET` before an
 over-budget traversal continues. `discoverPackages` requires a real, unlinked root and lists its
 immediate child directories whose bounded manifest names a scoped package, skipping anything else
-silently. `catalogPackages` applies one allowance across every root and directory rather than
+silently. A control-bearing child directory fails closed before its manifest is read and the
+untrusted name is never reflected in the diagnostic. `catalogPackages` applies one allowance across
+every root and directory rather than
 resetting a per-root budget, then draws each description from the first paragraph of the first
 blockquote of that package's own bounded guide via `guideToDescription`; a missing guide, an
 unreadable or oversized one, or one with no blockquote yields an empty description rather than an
@@ -954,6 +974,7 @@ From [`compilers.ts`](../../src/core/compilers.ts).
 | `packageManifest`       | function |
 | `rootTsconfig`          | function |
 | `viteMachinery`         | function |
+| `renderViteTest`        | function |
 | `viteHeader`            | function |
 | `policyViteProject`     | function |
 | `singleSrcViteConfig`   | function |
@@ -994,7 +1015,13 @@ optional metadata, and engines.
 
 `rootTsconfig` emits the root compiler options and one path alias per declared environment;
 `coreTsconfig`, `srcTsconfig`, and `appTsconfig` emit the scoped configurations that remove the
-wrong host's globals from each environment. `viteHeader` renders the shared header — the alias block
+wrong host's globals from each environment. A core scope is the interesting one: `lib` is
+`["ESNext", "WebWorker"]` and `types` stays `[]`, which declares the WHATWG surface that is
+identical across Node, browsers, and workers — `fetch` and its request/response/header types,
+streams, `URL`, `AbortController`, the text encoders, `crypto`, timers, `console`, `DOMException`,
+`structuredClone` — while leaving `document`, `window`, and every `node:*` type unresolvable. That
+is one declaration set for a host-independent module, not a host. `viteHeader` renders the shared
+header — the alias block
 derived from the tsconfig paths, plus the environment-boundary plugin — and `viteMachinery` is the
 one place the header's axes are derived, read by `rootViteConfig`, `singleSrcViteConfig`,
 `applicationViteConfig`, and `configArtifacts` alike so no caller can invent a fourth answer.
@@ -1006,7 +1033,8 @@ emits `environmentBoundary`, its `resolveId` / `load` / `buildEnd` walks, the mo
 plus its `environmentPathError` / `environmentSourceError` clauses). Those enforce owner-independent
 laws: core stays host-independent whatever else the workspace declares, a server module never
 imports a stylesheet, and a `@vite-ignore` dynamic import — which `resolveId` never sees and the
-module graph never records — has no other enforcement point. Only host-specific pipelines vary,
+module graph never records — has no other enforcement point in workspace-owned source. Dependency
+and toolchain modules are outside that ownership boundary. Only host-specific pipelines vary,
 along the three `ViteMachinery` axes:
 
 | Machinery                                                         | Emitted when                         |
@@ -1019,6 +1047,10 @@ along the three `ViteMachinery` axes:
 An application of `app/core` alone is the sole shape that builds nothing, so it is the sole shape
 without output containment — and it still carries every boundary guarantee above.
 
+`renderViteTest` is the single root-project renderer. It consumes ordered
+`ViteProjectRegistration` data and emits either the plain project list or the browser gate, keeping
+source and application root configurations byte-consistent without reconstructing browser ownership.
+
 `coreViteConfig`, `srcViteConfig`, and `appViteConfig` emit the thin per-target wrappers;
 `rootViteConfig`, `singleSrcViteConfig`, and `applicationViteConfig` emit the root configuration for
 a library-only, single non-core `src` environment, and application-bearing workspace respectively;
@@ -1125,8 +1157,9 @@ The public methods of each behavioral interface, one table per type.
 `Scaffolding`; the optional group selection scopes the plan to those artifact groups.
 `audit(blueprint, current, groups?)` compiles and then diffs the resulting plan against the
 caller-supplied current content; a gated blueprint returns `complete: false` with the gate's
-blocking questions and zero findings. `destroy()` is idempotent teardown. The interface also
-exposes the readonly `emitter`.
+blocking questions and zero findings, and a complete one carries the gate's advisories on that same
+`questions` field. `destroy()` is idempotent teardown. The interface also exposes the readonly
+`emitter`.
 
 #### `PlanManagerInterface`
 
@@ -1190,12 +1223,14 @@ in-flight request. The interface also exposes the readonly `emitter`.
 `compile` runs three stages in fixed order and records each as a `CompileRecord` carrying its input,
 its output, whether it failed, and any error text.
 
-1. **draft** — `blueprintToPlan` selects the covered groups, drafts each group's artifacts, appends
-   the host set, applies overrides, and pins the draft. A throw here records a `draft` failure coded
+1. **draft** — `blueprintToPlan` selects the covered groups, drafts each group's artifacts, carries
+   the selected host set — every vendored host path except the workspace's own guide — applies
+   overrides, and pins the draft. A throw here records a `draft` failure coded
    `INVALID`, emits `error`, marks the remaining two stages skipped, and returns incomplete.
 2. **gate** — `validatePlan` runs the semantic pass over the blueprint and checks every override
-   against the drafted artifact set. Blocking questions fail the stage; a dependency outside the
-   vendored guide set contributes a non-blocking advisory question instead.
+   against the drafted artifact set. Blocking questions fail the stage; an accepted override and a
+   dependency outside the vendored guide set each contribute a non-blocking advisory question
+   instead.
 3. **pin** — a host-origin pointer artifact is appended for each non-vendored dependency, and
    `pinPlan` fills `trace` and `hash` from the plan's own content.
 
@@ -1227,7 +1262,8 @@ how it is audited, and whether it may ever be overwritten.
 - **`host`** — byte-copied from the vendored data root. These are the shared files a whole fleet
   keeps identical: the root instruction documents and licence, the agent, rule, and skill
   directories, the session scripts, the repository coding-law policy module, the byte-identical root
-  dotfiles, and the two guide mirrors every workspace carries. `HOST_PATHS` is the exact list.
+  dotfiles, and the two line guide mirrors a workspace carries for contracts other than its own.
+  `HOST_PATHS` is the exact vendored list; what a given plan carries is `selectHostPaths` of it.
 - **`template`** — filled from a frozen template definition by a pure fill engine. These are
   starter files: source stubs, test stubs, the starter guide, the README.
 - **`computed`** — derived by this package's own combination logic. These are the structural files:
@@ -1256,18 +1292,31 @@ anything, so a mature workspace's hand-written source, tests, guides, and manife
 overwritten with a stub. A consequence worth stating plainly: the generated
 `.github/workflows/ci.yml` is a **computed** artifact, so **user-owned CI is never repaired**. Once
 a workspace has its own workflow, that copy stands, and any change to it is an ordinary edit in that
-workspace.
+workspace. Audit still compares it because computed artifacts are content-aware canon. A legitimate
+difference that the blueprint cannot express is a canon gap: add the missing blueprint axis rather
+than forking the computed file in one repository.
 
 Overrides respect the same boundary from the other direction. `applyOverrides` never replaces a
 host-origin artifact and never replaces `package.json`; the gate turns either attempt — and an
 override matching no planned artifact at all — into a blocking question rather than a silent no-op.
-
-Guide mirrors are the one place ownership is conditional. A dependency this package vendors a
-byte-identical mirror for gets a real host-origin copy of `guides/src/<short>.md`. Any other
-dependency gets a host-origin _pointer_ artifact plus a non-blocking question, never a fabricated
-mirror; on materialization that pointer degrades to a short stub, and `scaffold pull` fetches the
-real thing. That degrade is scoped exactly to guide pointers: any other missing manifest entry
-means a corrupt or truncated vendored manifest, and fails closed.
+What survives those three refusals is applied and announced: the gate carries a non-blocking
+advisory naming each replaced path, and that advisory rides the `Scaffolding` and the `Audit` all
+the way through the library result.
+
+Guide mirrors are the one place ownership is conditional, and the law is one owner per guide path.
+**A workspace mirrors every line guide except its own.** When the name matches — the guide package
+on `guides/src/guide.md`, this package on `guides/src/scaffold.md` — the workspace itself is the
+owner, keeping that path as its **template**-origin starter guide, and `selectHostPaths` drops the
+vendored mirror so the path is contributed exactly once. For every other contract the mirror is the
+owner: a dependency this package vendors a byte-identical mirror for gets a real host-origin copy of
+`guides/src/<short>.md`, contributed once whether it arrives through the host set or through the
+dependency, so a package depending on `@orkestrel/guide` plans one `guides/src/guide.md` rather than
+two. Any other dependency gets a host-origin _pointer_ artifact plus a non-blocking question, never
+a fabricated mirror; on materialization that pointer degrades to a short stub, and `scaffold pull`
+fetches the real thing. That degrade is scoped exactly to guide pointers: any other missing manifest
+entry means a corrupt or truncated vendored manifest, and fails closed. Selection is the law and
+`findFileConflict` is its backstop: two artifacts at one path refuse the plan rather than racing to
+be the last writer.
 
 ## Audit, repair, and prune
 
@@ -1317,10 +1366,15 @@ because there is nothing to explain.
 `pull` is the target-aware composition. It reads the target's declared scoped dependencies from its
 manifest, rejects any explicit selection the target does not declare, builds the reference map from
 the target's own `guides/src/<short>.md` mirrors, fetches guides and versions under one shared
-allowance, and assembles a report whose `clean` flag requires both no drift and no failures. `write`
-then commits only the `behind` guides — never `current`, `missing`, or `failed`, none of which carry
-trustworthy content — under the same containment and precondition law `Materializer` enforces,
-including a baseline digest check against what is actually on disk.
+allowance, and assembles a report whose `clean` flag requires both no drift and no failures. A
+target that declares itself is the one asymmetry, and it follows the same single-owner law: the
+guide pass drops the self dependency, so `pull` never fetches or writes a workspace's own contract
+guide over the copy that workspace owns, while the version pass keeps it and still reports its
+freshness. A `--live` audit reads upstream through the same two passes and applies the same
+self-exclusion, so the freshness a workspace reports about itself never depends on which verb asked.
+`write` then commits only the `behind` guides — never `current`, `missing`, or `failed`,
+none of which carry trustworthy content — under the same containment and precondition law
+`Materializer` enforces, including a baseline digest check against what is actually on disk.
 
 `catalog` builds the fleet package catalog from three reads per entry. The registry's exact
 organization package list is authoritative and unconditionally required. Each package's own registry
@@ -1353,7 +1407,7 @@ a fixed, interleaved order so aggregates sit immediately before their per-enviro
   Vue typechecker, every other scope uses plain `tsc`
 - `test`, then `test:src` and its per-environment scopes, `test:app` and its per-environment scopes,
   `test:policy`, and `test:guides`; an engine also receives the deliberately non-default
-  `test:integration` live installed-consumer gate
+  `test:integration` live installed-consumer gate and `test:equivalence` driver-reference proof
 - `build`, then `build:src` and its per-environment targets, `build:app` and its runtime targets, and
   `build:host` for an engine workspace
 - `dev` when a browser application is selected; `serve` and `serve:build` when a server application
@@ -1361,11 +1415,25 @@ a fixed, interleaved order so aggregates sit immediately before their per-enviro
 - `prepublishOnly` chaining `format:check → lint:check → check → build → test`, followed by the
   live generated-consumer integration gate for the scaffold engine itself
 
+Run `npm run test:equivalence` after changing the persistent boundary build driver. It reruns the
+integration project in dual-path mode and proves each programmatic driver verdict against the
+spawned npm-script reference; ordinary integration runs keep the faster driver-only path.
+
 **Environment isolation.** Scoped TypeScript projects remove the wrong host's globals from each
-environment: core scopes carry no DOM, no Node, and no host globals at all; browser scopes carry DOM
-and no Node; server scopes carry Node and no DOM. Lint restricts declared package, alias, and
-conventional relative imports in the same directions. Neither replaces the other, and neither
-replaces the build.
+environment: core scopes carry the WHATWG web-interop surface and no host at all — no DOM, no Node,
+no `vite/client`; browser scopes carry DOM and no Node; server scopes carry Node and no DOM. The
+worker-only globals the `WebWorker` declarations would otherwise admit — `name`, `onrtctransform`,
+`close`, `postMessage`, `dispatchEvent`, `location`, `onerror`, `onlanguagechange`, `onoffline`,
+`ononline`, `onrejectionhandled`, `onunhandledrejection`, `self`, `importScripts`, `fonts`, `caches`,
+`crossOriginIsolated`, `indexedDB`, `isSecureContext`, `origin`, `scheduler`, `createImageBitmap`,
+`reportError`, `cancelAnimationFrame`, `requestAnimationFrame`, `onmessage`, `onmessageerror`,
+`addEventListener`, and `removeEventListener` — are fenced out of `src/core` and `app/core` sources
+by the policy suite, so the declarations widen what a host-independent module may call without
+widening where it may run. On every TypeScript bump, derive this list from the module-scope
+global-object `declare var` and `declare function` declarations in the installed
+`lib.webworker.d.ts`, then subtract values supplied by `lib.esnext*` or current Node globals. Lint
+restricts declared package, alias, and conventional relative imports in the same directions.
+Neither replaces the other, and neither replaces the build.
 
 **The generated build boundary.** The emitted configuration carries an environment-boundary plugin
 that resolves the real module graph rather than re-implementing a parser. **TypeScript and
@@ -1398,10 +1466,10 @@ application's module graph through `import.meta.env` instead.
 Asset URLs that force `?inline` are rejected before Vite can read them outside that auditable output
 graph. Dynamic imports must use a static quoted string or expression-free template string; even
 `/* @vite-ignore */` static values repeat the same environment and containment checks inside the
-transform boundary, including inline HTML proxy modules and trusted dependency modules. Trusted
-dependency modules also pass through a bounded, no-follow, identity-checked load inspection before
-Vite transforms or tree-shakes their raw source, so dependency-side asset references cannot escape
-the physical package root by disappearing from the later graph.
+transform boundary, including inline HTML proxy modules. The transform, load, resolution, emitted
+asset, and finished-module-graph passes apply that law only to workspace-owned `src/*` and `app/*`
+modules. Resolved ids under any `node_modules` segment, Vite/Vitest virtual ids, and tooling client
+injections remain owned by their toolchain and are exempt.
 
 Browser application scripts are modules. Vite's parsed HTML asset callback rejects a classic
 external `<script src>` before resolution and directs the author to `type="module"`. A module
@@ -1416,9 +1484,9 @@ path remains Vite-owned and passes through the environment resolver, which rejec
 ASCII control range and every non-Node URL scheme before loading or output. No second HTML parser or global
 reference rewrite is involved, so comments, text, non-script attributes, and entity-spelled asset
 filenames retain Vite's native parsing and resolution behavior.
-The resolver leaves NUL-prefixed Rolldown/Vite virtual module IDs to the tool that owns that
-namespace; author module and asset URLs are extracted and validated before they reach that resolver
-exception.
+The resolver leaves NUL-prefixed and `virtual:` Rolldown/Vite module IDs, tooling client injections,
+and every resolved `node_modules` module to the tool that owns that namespace; author module and
+asset URLs are extracted and validated before they reach those resolver exceptions.
 SVG script `href` and `xlink:href` attributes are parsed too and rejected as classic script loads.
 Inline module scripts enter Vite's HTML proxy graph and receive the same Oxc boundary analysis as
 module files. Classic inline scripts cannot enter that graph, so the required security prologue places
@@ -1458,11 +1526,7 @@ What it rejects is equally deliberate:
   browser or server package subpath;
 - a browser module reaching a Node builtin or a server subpath;
 - a server module reaching a stylesheet, Vue, or a browser subpath;
-- a workspace-relative import that resolves outside the workspace, or a dependency import that
-  escapes the exact physical package root established by the nearest bounded, unlinked
-  `package.json` whose own `name` exactly matches the resolved dependency;
-- a package `#imports` mapping that resolves outside both the declaring package and another exact
-  physical package root;
+- a workspace-relative import that resolves outside the workspace;
 - an HTML reference carrying `vite-ignore` that violates the same environment or containment law
   as an ordinary reference, a Vite `%ENV%` HTML substitution, a classic external script, or a
   computed dynamic import in the module graph that would bypass graph resolution;
@@ -1485,7 +1549,8 @@ cannot express — that a centralized module exports every top-level declaration
 implementation files hold one class and no stray module-scope declaration, that no function is
 declared inside another function outside a directly-passed callback, that interface properties are
 readonly, that privacy is a runtime `#` field rather than a TypeScript modifier, that a barrel
-re-exports only through `export *`, and that a computed dynamic import cannot smuggle a
+re-exports only through `export *`, that a core source never names a worker-only global the
+`WebWorker` declarations expose, and that a computed dynamic import cannot smuggle a
 cross-environment dependency past the declared import rules. Vue components are inspected for the
 same evasions. It is a complement to lint and typecheck, never a second type system, and it is not a
 general-purpose source analyzer. Generated workspaces receive the same exported policy module as a
@@ -1495,7 +1560,14 @@ host-origin file and run it as a dedicated Node-only `policy` test project over
 **Real browser capability.** Browser test projects are gated on the real executable: the generated
 configuration and the generated policy test both probe `existsSync(chromium.executablePath())`. A
 browser suite runs when a real Chromium is installed and is skipped honestly when it is not, rather
-than being faked.
+than being faked. The gate is applied at registration, not inside the real browser project: without
+Chromium, each browser factory is replaced by a same-label Node/no-test placeholder, so generated
+`--project <label>` and `--project=<label>` filters still resolve while no browser code runs. The
+root permits an empty run only when every recognized exact project filter names one of those gated
+placeholders; an unreadable or mixed filter keeps the ordinary no-test failure semantics for its
+Node projects. One printed warning names every gated project label. A machine with a browser
+registers and runs the real browser suites unchanged; a machine without one runs the remaining
+projects and says so.
 
 **Continuous integration.** The generated workflow runs on push and pull request, on
 `ubuntu-latest`, with read-only contents permission, a 60-minute timeout, and a matrix that **tests
@@ -1903,6 +1975,7 @@ import {
 	hostGroup,
 	packageManifest,
 	paritySpecifiers,
+	selectHostPaths,
 	sourceArtifacts,
 	srcVariant,
 	testArtifacts,
@@ -1912,6 +1985,7 @@ const spec = blueprint('router', { src: ['core'], app: ['core', 'server'] })
 const members = blueprintToMembers(spec)
 
 hostGroup('AGENTS.md') // 'docs'
+selectHostPaths(['guides/src/router.md', 'LICENSE'], spec.name) // ['LICENSE'] — never its own guide
 srcVariant(['core', 'server']) // 'multi'
 entryFields(['browser']).main // './dist/src/browser/index.js'
 dualCondition('./dist/src/core/index')
@@ -1949,6 +2023,7 @@ import {
 	coreTsconfig,
 	coreViteConfig,
 	policyViteProject,
+	renderViteTest,
 	rootTsconfig,
 	rootViteConfig,
 	singleSrcViteConfig,
@@ -1965,6 +2040,7 @@ appTsconfig('browser', true)
 
 viteMachinery(['core']) // { browser: false, vue: false, output: true }
 viteMachinery([], ['core', 'browser']) // { browser: true, vue: true, output: true }
+renderViteTest([{ project: 'srcCore' }], false).includes('projects: [srcCore]') // true
 viteHeader(viteMachinery([], ['core', 'browser'])) // the shared header, with browser and Vue support
 coreViteConfig()
 srcViteConfig('browser')
@@ -1979,7 +2055,12 @@ applicationViteConfig([], ['core', 'server']).includes('appServer') // true
 ### Reading declared dependencies and comparing freshness
 
 ```ts
-import { isBehind, manifestToDependencies, rangeToFreshness } from '@orkestrel/scaffold'
+import {
+	isBehind,
+	manifestToDependencies,
+	manifestToName,
+	rangeToFreshness,
+} from '@orkestrel/scaffold'
 import {
 	guideStub,
 	packageShortName,
@@ -1988,6 +2069,7 @@ import {
 } from '@orkestrel/scaffold/server'
 
 manifestToDependencies('{"dependencies":{"@orkestrel/contract":"^0.0.7"}}')
+manifestToName('{"name":"@orkestrel/router"}') // '@orkestrel/router' — the target's own name
 rangeToFreshness('^0.0.7', '0.0.7') // 'current'
 isBehind(rangeToFreshness('^0.0.7', '0.0.9')) // true
 
@@ -2220,7 +2302,8 @@ isMissingPathError(caught) // true only for an ENOENT error
 ## Tests
 
 - [`tests/src/core/helpers.test.ts`](../../tests/src/core/helpers.test.ts) — the pure leaves: table
-  alignment, byte encoding, snapshots, conflicts, projections, hashing, and format-stable JSON.
+  alignment, byte encoding, snapshots, host selection, conflicts, projections, hashing, and
+  format-stable JSON.
 - [`tests/src/core/builders.test.ts`](../../tests/src/core/builders.test.ts) — the blueprint,
   dependency, override, and member builders, including optional-field omission.
 - [`tests/src/core/validators.test.ts`](../../tests/src/core/validators.test.ts) — every guard and
@@ -2228,7 +2311,8 @@ isMissingPathError(caught) // true only for an ENOENT error
 - [`tests/src/core/shapers.test.ts`](../../tests/src/core/shapers.test.ts) — per-shape guard
   exactness, schema essentials, seeded generation, and parse round-trips.
 - [`tests/src/core/compilers.test.ts`](../../tests/src/core/compilers.test.ts) — every drafted
-  group, the manifest and exports combination rules, and the emitted configuration text.
+  group, the manifest and exports combination rules, the one-owner guide law for a workspace that
+  names a line guide, and the emitted configuration text.
 - [`tests/src/core/Compiler.test.ts`](../../tests/src/core/Compiler.test.ts) — the three-stage
   pipeline, the fail-closed gate, the emission sequences, and post-destroy behavior.
 - [`tests/src/core/PlanManager.test.ts`](../../tests/src/core/PlanManager.test.ts) — content-hash

package/dist/host/scripts/codex.sh

@@ -32,8 +32,10 @@ valid_effort() {
 
 if codex login status >/dev/null 2>&1; then
   auth="authentication ready"
+  recovery=""
 else
   auth="authentication unavailable"
+  recovery='codex login --device-auth'
 fi
 
 if valid_model "$analyst_model" &&
@@ -46,4 +48,7 @@ else
 fi
 
 echo "codex.sh: bench detected; ${auth}; ${routes}."
+if [ -n "$recovery" ]; then
+  echo "codex.sh: to recover, run \`${recovery}\`."
+fi
 exit 0