@orkestrel/scaffold 0.0.67 → 0.0.69

package/dist/src/server/index.js

@@ -1,10 +1,12 @@
-import { andOf, arrayOf, attempt, boundsOf, compareValues, holds, isArray, isBoolean, isError, isFunction, isInteger, isRecord, isString, parseJSON, parseJSONAs, parseStringField, recordOf, stringOf, unionOf } from "@orkestrel/contract";
-import { CANON_PATHS, CATALOG_AGENT_PATH, CATALOG_CLOSING_MARKER, CATALOG_OPENING_MARKER, CONTROL_CHARACTER_PATTERN, EXECUTABLE_PATHS, HOST_INVENTORY_PATH, HOST_PATHS, MAX_ARTIFACT_BYTES, MAX_COLLECTION_ITEMS, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_RANGE_LENGTH, MAX_REGISTRY_BYTES, MAX_TOTAL_ARTIFACT_BYTES, MAX_TOTAL_REGISTRY_BYTES, ScaffoldError, bytesToHex, catalogToLayers, cloneValue, compareVersions, computeBytes, contentToHex, extractRangeMajor, extractVersion, inferGroup, isAudit, isCatalogEntry, isCollection, isDependency, isDependencyName, isFloorPath, isHex, isManifestScript, isMirror, isPath, isPlan, isRetainedPath, isSnapshot, matchesDriftReachability, matchesRange, nameToGuide, planToFindings, replaceManifestRanges, replaceManifestScripts } from "../core/index.js";
+import { createRequire } from "node:module";
+import { andOf, arrayOf, attempt, boundsOf, compareValues, holds, isArray, isBoolean, isError, isFunction, isInteger, isRecord, isString, parseJSON, parseJSONAs, parseStringField, recordOf, stringOf, unionOf, whereOf } from "@orkestrel/contract";
+import { CANON_PATHS, CATALOG_AGENT_PATH, CATALOG_CLOSING_MARKER, CATALOG_OPENING_MARKER, CONTROL_CHARACTER_PATTERN, DEPENDENCY_NAME_PATTERN, EXECUTABLE_PATHS, HOST_INVENTORY_PATH, HOST_PATHS, MAX_ARTIFACT_BYTES, MAX_COLLECTION_ITEMS, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_RANGE_LENGTH, MAX_REGISTRY_BYTES, MAX_TOTAL_ARTIFACT_BYTES, MAX_TOTAL_REGISTRY_BYTES, REFERENCE_PATHS, ScaffoldError, bytesToHex, catalogToLayers, cloneValue, compareVersions, computeBytes, contentToHex, extractRangeMajor, extractVersion, inferGroup, isAudit, isCatalogEntry, isCollection, isDependency, isDependencyName, isFloorPath, isHex, isManifestScript, isMirror, isPath, isPlan, isRetainedPath, isSnapshot, matchesDriftReachability, matchesRange, nameToGuide, planToFindings, replaceManifestRanges, replaceManifestScripts } from "../core/index.js";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, copyFileSync, fstatSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, opendirSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, extname, join, parse, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createMarkdown, flattenText, isTableNode } from "@orkestrel/markdown";
 import { Emitter } from "@orkestrel/emitter";
 //#region src/server/constants.ts
 /**
@@ -160,2022 +162,2162 @@ var UNREADABLE_VERSION_NOTE = "the answer carries no readable latest version";
 */
 var PACKUMENT_MEDIA_TYPE = "application/vnd.npm.install-v1+json";
 //#endregion
-//#region src/server/validators.ts
+//#region src/server/helpers.ts
 /**
-* Narrows a value to a path naming a location on this host.
+* Tests whether a caught filesystem error reports an absent path.
 *
-* @param value - The candidate host path.
-* @returns True if the value is a bounded absolute or relative path whose every segment
-* is portable across the supported filesystems; false otherwise.
+* @param error - The caught value.
+* @returns True if `error` is an `Error` whose `code` is exactly `ENOENT`; false otherwise.
 *
 * @remarks
-* The counterpart to the core path law, not a copy of it. A target directory and
-* the vendored host root are locations on the machine rather than paths inside a
-* workspace, so a drive prefix, a UNC share, and a backslash separator are all
-* admitted here and `..` is a legitimate way to name a sibling directory.
-* Containment is still enforced, but by the core law over the artifact paths
-* written beneath the target, not by this one.
-*
-* What it does refuse is a segment no supported filesystem can hold: an empty
-* one, a reserved Windows device name, a trailing dot or space, a wildcard or
-* redirection character, a colon anywhere but the drive prefix, and a name past
-* the byte ceiling. The character ceiling is read first so an oversized string is
-* refused before it is split.
-*
-* The spellings of an empty segment are answered differently. A trailing
-* separator terminates a directory rather than opening a segment, and every
-* supported filesystem and every Node path API reads `project/` and `project` as
-* one location, so it is admitted. A doubled separator is a genuine empty
-* segment, so `project//src` is refused. Nothing normalizes the argument first —
-* every server entry point guards the caller's text and resolves it afterwards —
-* so a directory taken from a shell completion arrives carrying the separator the
-* shell appended and names the directory it appears to name.
+* The one place absence is told apart from failure. Every read here answers
+* `undefined` or an empty result for a path that is not there and reports a path
+* that is there but unreadable, so they must never be read from the same
+* caught value by eye. Total for any caught value, including a hostile one.
 *
 * @example
 * ```ts
-* import { isFilesystemPath } from '@orkestrel/scaffold/server'
+* import { matchesMissingPath } from '@orkestrel/scaffold/server'
 *
-* isFilesystemPath('C:/Users/sample/project') // true
-* isFilesystemPath('../sibling') // true
-* isFilesystemPath('project/') // true
-* isFilesystemPath('project//src') // false
-* isFilesystemPath('project/nul') // false
+* matchesMissingPath(Object.assign(new Error('gone'), { code: 'ENOENT' })) // true
+* matchesMissingPath(new Error('gone')) // false
 * ```
 */
-function isFilesystemPath(value) {
-	return holds(() => {
-		if (!isString(value) || value.length === 0 || value.length > MAX_PATH_LENGTH) return false;
-		if (CONTROL_CHARACTER_PATTERN.test(value)) return false;
-		const normalized = value.replaceAll("\\", "/");
-		const rooted = normalized.startsWith("//") ? normalized.slice(2) : normalized.startsWith("/") ? normalized.slice(1) : normalized;
-		const segments = (rooted.endsWith("/") ? rooted.slice(0, -1) : rooted).split("/");
-		if (segments.length > 64) return false;
-		for (const [index, segment] of segments.entries()) {
-			if (segment === "." || segment === "..") continue;
-			if (index === 0 && DRIVE_PATTERN.test(segment)) continue;
-			if (segment.length === 0) return false;
-			if (INVALID_SEGMENT_CHARACTER_PATTERN.test(segment)) return false;
-			if (segment.endsWith(".") || segment.endsWith(" ")) return false;
-			if (computeBytes(segment) > 255) return false;
-			if (RESERVED_SEGMENT_PATTERN.test(segment)) return false;
-		}
-		return true;
-	});
+function matchesMissingPath(error) {
+	return holds(() => isError(error) && Reflect.get(error, "code") === "ENOENT");
 }
 /**
-* Narrows a value to one exact SHA-256 digest.
+* Tests whether a path addresses a target's own repository metadata.
+*
+* @param path - The path to classify; either separator is read.
+* @returns True if the path is `.git` or sits beneath it; false otherwise.
 *
 * @remarks
-* The identity a vendored host manifest and a write precondition are both stated
-* in. Fixed at sixty-four lowercase digits, so the value either is a digest of
-* that algorithm or is refused; there is no shorter or longer accepted form.
+* The one home of the `.git` membership rule, read in either direction. A target
+* holding nothing but this directory is still vacant, because a checkout of an
+* empty repository is where a fresh workspace legitimately starts. A path
+* beneath it is never removed and never vendored, because deleting a target's
+* history is not a repair.
 *
 * @example
 * ```ts
-* import { isDigest } from '@orkestrel/scaffold/server'
+* import { matchesGitPath } from '@orkestrel/scaffold/server'
 *
-* isDigest('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855') // true
-* isDigest('E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855') // false
+* matchesGitPath('.git') // true
+* matchesGitPath('.git/config') // true
+* matchesGitPath('.gitignore') // false
 * ```
 */
-var isDigest = stringOf({ pattern: DIGEST_PATTERN });
+function matchesGitPath(path) {
+	return /(?:^|\/)\.git(?:\/|$)/i.test(path.replaceAll("\\", "/"));
+}
 /**
-* Narrows a value to a working-tree inventory within the limit one target may report.
+* Tests whether a target-relative path is one no verb may delete.
 *
-* @param value - The candidate inventory.
-* @returns True if the value is an array of no more than
-* `MAX_INVENTORY_PATHS` items; false otherwise.
+* @param path - The target-relative path to classify.
+* @returns True if the path must survive every verb this package runs; false otherwise.
 *
 * @remarks
-* Compose this ahead of an element guard exactly as the core collection guard is
-* composed, and for the same reason: the item count is settled before anything
-* walks the items, and a hostile `length` accessor answers `false` rather than
-* escaping as a throw. It exists beside that guard rather than reusing it
-* because they bound different things — one bounds what a caller may hand a
-* public method, this one bounds what a checkout may contain.
+* The deletion deny-list, stated as a rule over paths rather than as a list of
+* directories. It is the inversion the contract asks for: the candidate set
+* is re-derived from the plan and narrowed by what git tracks, and the audit
+* must agree with that derivation rather than supply the set itself.
+* Git metadata is protected because losing history is not a repair,
+* and a target's own `src` and `app` trees are protected because a
+* workspace's source is the one thing scaffold never plans and never owns. A
+* plan the compiler emits never maps a protected root, so this guard exists
+* for the caller-authored plan a consumer can still supply.
 *
 * @example
 * ```ts
-* import { isInventory } from '@orkestrel/scaffold/server'
+* import { matchesProtectedPath } from '@orkestrel/scaffold/server'
 *
-* isInventory(['AGENTS.md']) // true
-* isInventory('AGENTS.md') // false
+* matchesProtectedPath('src/core/index.ts') // true
+* matchesProtectedPath('.git/config') // true
+* matchesProtectedPath('.claude/agents/rogue.md') // false
 * ```
 */
-function isInventory(value) {
-	return holds(() => isArray(value) && value.length <= 1e5);
+function matchesProtectedPath(path) {
+	const normalized = path.replaceAll("\\", "/");
+	if (matchesGitPath(normalized)) return true;
+	if (normalized === "src" || normalized === "app") return true;
+	return normalized.startsWith("src/") || normalized.startsWith("app/");
 }
 /**
-* Narrows a value to a bounded upstream endpoint.
+* Tests whether a path names local configuration or a credential.
 *
-* @remarks
-* Length only. Which schemes and hosts an endpoint may name is the reader's law,
-* because it builds the request and can report why one was refused, where a
-* guard has only `false` to say.
-*/
-var isEndpoint = stringOf({
-	min: 1,
-	max: MAX_ENDPOINT_LENGTH
-});
-/**
-* Narrows a value to a Git branch the repository endpoint accepts.
+* @param path - The path to classify; either separator is read.
+* @returns True if the path must never be copied into a vendored host; false otherwise.
 *
 * @remarks
-* A branch reaches the repository URL's path, so the syntax is closed rather than
-* merely bounded and no `..` is admitted anywhere in it.
+* The vendoring deny-list. A host root is staged from a real checkout, so the
+* refusal is stated over the path rather than over the file's content: a
+* credential is recognizable by where it sits and what it is called long before
+* anything reads it. Git metadata is included through
+* {@link matchesGitPath}, so one call answers the whole question and no caller
+* has to remember to ask twice.
 *
 * @example
 * ```ts
-* import { isBranch } from '@orkestrel/scaffold/server'
+* import { matchesSensitivePath } from '@orkestrel/scaffold/server'
 *
-* isBranch('main') // true
-* isBranch('main/../etc') // false
+* matchesSensitivePath('.npmrc') // true
+* matchesSensitivePath('.claude/settings.local.json') // true
+* matchesSensitivePath('.claude/settings.json') // false
 * ```
 */
-var isBranch = stringOf({
-	min: 1,
-	max: 255,
-	pattern: BRANCH_PATTERN
-});
+function matchesSensitivePath(path) {
+	const normalized = path.replaceAll("\\", "/");
+	if (matchesGitPath(normalized)) return true;
+	return /(?:^|\/)(?:(?:\.ssh|\.aws|\.azure|\.docker|\.kube|\.gnupg|\.env(?:\.[^/]*)?)(?:\/|$)|(?:\.npmrc|\.pypirc|\.netrc|\.git-credentials|settings\.local\.json|auth\.json|credentials(?:\.json)?|application_default_credentials\.json|id_rsa|id_ed25519|kubeconfig)$|\.config\/(?:gh|gcloud)(?:\/|$)|\.local\/share\/keyrings(?:\/|$)|[^/]*service-account[^/]*\.json$|[^/]*\.(?:jks|key|p12|pem|pfx|pkcs12)$)/i.test(normalized);
+}
 /**
-* Narrows a value to a per-request timeout in milliseconds.
+* Tests whether a vendored path is one a target receives executable.
 *
-* @remarks
-* A whole number of milliseconds, at least one and no more than
-* {@link MAX_UPSTREAM_TIMEOUT}. Zero is refused because a request that may not
-* take any time is a request that cannot succeed.
-*/
-var isTimeout = andOf(isInteger, boundsOf(1, MAX_UPSTREAM_TIMEOUT));
-/**
-* Narrows a value to a bounded list of `@orkestrel` package names.
+* @param path - The target-relative path to classify; either separator is read.
+* @returns True if the path is declared in {@link EXECUTABLE_PATHS}; false otherwise.
 *
 * @remarks
-* Composed from the core collection and dependency-name guards rather than
-* restated, so the scope law that keeps a derived guide mirror inside its
-* directory has exactly one home.
+* The declaration is the whole answer, and deliberately so. Reading the staging
+* host's mode instead makes the manifest depend on where the package was built:
+* Windows carries no executable bit, so a host staged there declares every entry
+* non-executable and every target it later fills receives hooks at `0644`. One
+* checkout stages one manifest on every host because this predicate never
+* consults the filesystem.
 *
 * @example
 * ```ts
-* import { isDependencyNames } from '@orkestrel/scaffold/server'
+* import { matchesExecutablePath } from '@orkestrel/scaffold/server'
 *
-* isDependencyNames(['@orkestrel/router']) // true
-* isDependencyNames(['router']) // false
+* matchesExecutablePath('scripts/codex.sh') // true
+* matchesExecutablePath('scripts\\deps.sh') // true
+* matchesExecutablePath('AGENTS.md') // false
 * ```
 */
-var isDependencyNames = andOf(isCollection, arrayOf(isDependencyName));
+function matchesExecutablePath(path) {
+	return EXECUTABLE_PATHS.includes(path.replaceAll("\\", "/"));
+}
 /**
-* Narrows a value to a bounded list of target-relative paths.
+* Projects a target-relative path to the storage name a vendored host holds it under.
+*
+* @param path - The target-relative path the file is written to.
+* @returns The storage name beneath the host root.
 *
 * @remarks
-* Composed from the core collection and path guards rather than restated, so
-* the containment law that keeps a caller-supplied path inside its target has
-* exactly one home. It bounds what a caller may hand a public method, which is
-* why it is not {@link isInventory}: that one bounds what a checkout may hold.
+* A staged host is a plain directory that npm packs, and npm's own ignore rules
+* would drop a leading-dot entry from the tarball. So every dot that opens a
+* segment comes off, and a dotted file at the root moves under `dotfiles/` to
+* keep it from colliding with an undotted sibling of the same name. The mapping
+* is one direction only: a staged host's manifest records the destination each
+* storage name answers for, so the reader never re-derives this.
 *
 * @example
 * ```ts
-* import { isPaths } from '@orkestrel/scaffold/server'
+* import { pathToStorage } from '@orkestrel/scaffold/server'
 *
-* isPaths(['AGENTS.md']) // true
-* isPaths(['../secrets']) // false
+* pathToStorage('.gitignore') // 'dotfiles/gitignore'
+* pathToStorage('.claude/rules/names.md') // 'claude/rules/names.md'
+* pathToStorage('AGENTS.md') // 'AGENTS.md'
 * ```
 */
-var isPaths = andOf(isCollection, arrayOf(isPath));
-/** Narrows a value to a bounded list of declared runtime dependencies. */
-var isDependencies = andOf(isCollection, arrayOf(isDependency));
+function pathToStorage(path) {
+	const segments = path.split("/");
+	if (segments.length === 1) return path.startsWith(".") ? `dotfiles/${path.slice(1)}` : path;
+	return segments.map((segment) => segment.startsWith(".") ? segment.slice(1) : segment).join("/");
+}
 /**
-* Narrows a value to one {@link ManifestRegionSet}.
+* Computes the SHA-256 digest of text.
+*
+* @param content - The text to digest.
+* @returns Sixty-four lowercase hexadecimal digits.
 *
 * @remarks
-* The whole closed record a manifest-writing method accepts, so a caller
-* naming a region the writer does not carry is refused before any byte moves.
-* Each region is bounded by the same collection law its own list guard applies.
+* The identity the server face states, and the reason it differs from core's:
+* core settled on a folded 64-bit identity because compilation is synchronous by
+* contract and the only cryptographic digest a host-independent scope reaches is
+* asynchronous. A Node host reaches the real one synchronously, and
+* `HostManifest.digest` is documented as SHA-256, so this is what the server
+* uses everywhere a digest is claimed.
 *
 * @example
 * ```ts
-* import { isManifestRegionSet } from '@orkestrel/scaffold/server'
+* import { computeDigest } from '@orkestrel/scaffold/server'
 *
-* isManifestRegionSet({ pins: { runtime: [], development: [] }, scripts: [] }) // true
-* isManifestRegionSet({ pins: { runtime: [], development: [] } }) // false
+* computeDigest('hi\n') // '98ea6e4f216f2fb4b69fff9b3a44842c38686ca685f3f55dc48c5d3fb1107be4'
 * ```
 */
-var isManifestRegionSet = recordOf({
-	pins: recordOf({
-		runtime: isDependencies,
-		development: isDependencies
-	}),
-	scripts: andOf(isCollection, arrayOf(isManifestScript))
-});
-/** Narrows a value to a bounded list of fetched guide mirrors. */
-var isMirrors = andOf(isCollection, arrayOf(isMirror));
-/** Narrows a value to a bounded list of fleet catalog rows. */
-var isCatalogEntries = andOf(isCollection, arrayOf(isCatalogEntry));
+function computeDigest(content) {
+	return createHash("sha256").update(content, "utf8").digest("hex");
+}
 /**
-* Narrows a value to one {@link ManifestEntry}.
+* Projects exact bytes stated in hexadecimal to their SHA-256 digest.
 *
-* @remarks
-* Both paths are measured by the core path law, because a vendored host's
-* storage name and the destination it maps to are each a path inside a
-* workspace. That is what stops a hand-edited manifest from mapping a vendored
-* file to a destination outside the target.
+* @param hex - The exact lowercase hexadecimal bytes to digest.
+* @returns Sixty-four lowercase hexadecimal digits.
+* @throws `ScaffoldError('INVALID', …)` when `hex` is not exact bounded
+* lowercase hexadecimal text.
 *
 * @example
 * ```ts
-* import { isManifestEntry } from '@orkestrel/scaffold/server'
+* import { hexToDigest } from '@orkestrel/scaffold/server'
 *
-* isManifestEntry({
-*   storage: 'AGENTS.md',
-*   destination: 'AGENTS.md',
-*   executable: false,
-*   digest: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
-* }) // true
+* hexToDigest('68690a') // '98ea6e4f216f2fb4b69fff9b3a44842c38686ca685f3f55dc48c5d3fb1107be4'
 * ```
 */
-var isManifestEntry = recordOf({
-	storage: isPath,
-	destination: isPath,
-	executable: isBoolean,
-	digest: isDigest
-});
-/**
-* Narrows a value to one {@link HostManifest}.
-*
-* @remarks
-* The manifest is read from a directory a caller named, so it is the least
-* trusted value the server face handles and is guarded whole: every entry, every
-* declared root, and the digest that authenticates their membership.
-*/
-var isHostManifest = recordOf({
-	entries: andOf(isCollection, arrayOf(isManifestEntry)),
-	roots: andOf(isCollection, arrayOf(isPath)),
-	digest: isDigest
-});
+function hexToDigest(hex) {
+	if (!isHex(hex)) throw new ScaffoldError("INVALID", "Digest input is not exact hexadecimal bytes", { hex });
+	return createHash("sha256").update(Buffer.from(hex, "hex")).digest("hex");
+}
 /**
-* Narrows a value to one {@link Host}.
-*
-* @remarks
-* A whole vendored host handed in as a value is as untrusted as one read from a
-* directory a caller named, so both halves are guarded: the manifest by the same
-* membership law a read root is held to, and the bytes by the core snapshot law,
-* which bounds the fill and reads every key as a path and every value as exact
-* lowercase hexadecimal. Whether those halves agree with each other is the
-* reader's question rather than this one's, because a guard has only `false` to
-* say and a mismatch has a path to name.
-*
-* @example
-* ```ts
-* import { isHost } from '@orkestrel/scaffold/server'
-*
-* const digest = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+* Computes the digest of a vendored host's declared membership.
 *
-* isHost({ manifest: { entries: [], roots: [], digest }, bytes: {} }) // true
-* isHost({ manifest: { entries: [], roots: [], digest } }) // false
-* ```
-*/
-var isHost = recordOf({
-	manifest: isHostManifest,
-	bytes: isSnapshot
-});
-/**
-* Narrows a value to a {@link Worktree}.
+* @param entries - The ordered file membership declarations.
+* @param roots - The ordered directory membership declarations.
+* @param surface - The ordered Surface collisions and their ordered guide owners.
+* @returns The SHA-256 of that exact membership, in that exact order.
 *
 * @remarks
-* Both path lists are target-relative, so both are measured by the core path
-* law: a reported path that is not one this package could have planned is not a
-* path it will delete. The inventory guard bounds the lists, because a checkout
-* is legitimately far larger than any collection a caller hands a method.
+* Independent of the manifest's own `digest` field, which is what lets a reader
+* detect a membership edit that did not update it. Order is part of the claim
+* rather than normalized away, because a staged manifest sorts its entries and
+* roots once and a reordered copy is a different file. Each entry is projected
+* to exactly the declared fields, so a hand-added property cannot ride
+* into the digest and cannot change it either.
 *
 * @example
 * ```ts
-* import { isWorktree } from '@orkestrel/scaffold/server'
+* import { computeManifestDigest } from '@orkestrel/scaffold/server'
 *
-* isWorktree({ tracked: ['AGENTS.md'], dirty: [] }) // true
-* isWorktree({ tracked: ['../secrets'], dirty: [] }) // false
+* computeManifestDigest([], [], []) // the digest of the empty membership
 * ```
 */
-var isWorktree = recordOf({
-	tracked: andOf(isInventory, arrayOf(isPath)),
-	dirty: andOf(isInventory, arrayOf(isPath))
-});
+function computeManifestDigest(entries, roots, surface) {
+	return computeDigest(JSON.stringify({
+		entries: entries.map((entry) => ({
+			storage: entry.storage,
+			destination: entry.destination,
+			executable: entry.executable,
+			digest: entry.digest
+		})),
+		roots: [...roots],
+		surface: surface.map(({ name, owners }) => ({
+			name,
+			owners: [...owners]
+		}))
+	}));
+}
 /**
-* Narrows a value to the materializer's initial listener record.
+* Tests whether a path is a physical file this package will read or replace.
 *
-* @remarks
-* Every event is optional and every declared value is a function. A key outside
-* the materializer's event map is refused, so a listener wired to a misspelled
-* event fails at construction instead of never firing.
-*/
-var isMaterializerHooks = recordOf({
-	write: isFunction,
-	remove: isFunction,
-	finish: isFunction,
-	error: isFunction,
-	destroy: isFunction
-}, true);
-/**
-* Narrows a value to {@link MaterializerOptions}.
+* @param path - The resolved host path to inspect, without following links.
+* @returns True if the path is a regular file that is neither a link nor hard-linked
+* elsewhere; false otherwise.
 *
 * @remarks
-* `host` admits both representations of one vendored root: a directory path and
-* a whole {@link Host} value. They share a key because they are one setting
-* stated two ways rather than two settings, so nothing downstream has to
-* reconcile a pair that could disagree.
+* The link tests are the point. A symbolic link is a path pointing somewhere
+* else, so writing through one writes outside the target; a hard link means a
+* second name shares the same bytes, so replacing them changes a file nobody
+* asked about. Both are refused rather than followed.
 *
 * @example
 * ```ts
-* import { isMaterializerOptions } from '@orkestrel/scaffold/server'
+* import { isPhysicalFile } from '@orkestrel/scaffold/server'
 *
-* isMaterializerOptions({}) // true
-* isMaterializerOptions({ host: 'dist/host*' }) // false
+* isPhysicalFile('/tmp/project/AGENTS.md') // true for a plain file
 * ```
 */
-var isMaterializerOptions = recordOf({
-	host: unionOf(isFilesystemPath, isHost),
-	on: isMaterializerHooks,
-	error: isFunction
-}, true);
+function isPhysicalFile(path) {
+	const status = attempt(() => lstatSync(path));
+	return status.success && status.value.isFile() && !status.value.isSymbolicLink() && status.value.nlink === 1;
+}
 /**
-* Narrows a value to the upstream reader's initial listener record.
+* Tests whether a path is a physical file with exact on-disk casing.
 *
-* @remarks
-* Closed to the reader's own events for the same reason the materializer's
-* record is closed to its own.
-*/
-var isUpstreamHooks = recordOf({
-	release: isFunction,
-	mirror: isFunction,
-	file: isFunction,
-	error: isFunction,
-	destroy: isFunction
-}, true);
-/**
-* Narrows a value to {@link UpstreamOptions}.
+* @param path - The host path to inspect segment by segment.
+* @returns True if the path is a physical file whose requested segments exactly match
+* the names each parent directory stores; false otherwise.
 *
 * @remarks
-* Each grouped endpoint is closed to its own leaves, so a setting written under
-* the wrong entity is refused rather than ignored. Every numeric leaf is a whole
-* number inside a ceiling: an unbounded concurrency, retry count, response
-* limit, or call budget is a way to exhaust the caller, so the ceiling is stated
-* here rather than left to the reader. The byte ceilings are the core
-* artifact and total-artifact limits, because a fetched guide is an artifact and
-* a whole call retains no more than a whole plan.
+* A direct file lookup follows the host's case-folding rules on Windows and
+* common macOS filesystems. Reading each parent directory supplies the stored
+* names, so this predicate can enforce the package's exact-case structural
+* contract on every supported host.
 *
 * @example
 * ```ts
-* import { isUpstreamOptions } from '@orkestrel/scaffold/server'
+* import { isExactCaseFile } from '@orkestrel/scaffold/server'
 *
-* isUpstreamOptions({ repository: { branch: 'main' }, concurrency: 4 }) // true
-* isUpstreamOptions({ concurrency: 0 }) // false
+* isExactCaseFile('/tmp/project/src/bin/main.ts') // true only for that exact spelling
 * ```
 */
-var isUpstreamOptions = recordOf({
-	repository: recordOf({
-		base: isEndpoint,
-		branch: isBranch,
-		timeout: isTimeout
-	}, true),
-	registry: recordOf({
-		base: isEndpoint,
-		timeout: isTimeout
-	}, true),
-	concurrency: andOf(isInteger, boundsOf(1, 64)),
-	retries: andOf(isInteger, boundsOf(0, 5)),
-	limit: andOf(isInteger, boundsOf(1, MAX_ARTIFACT_BYTES)),
-	budget: andOf(isInteger, boundsOf(1, MAX_TOTAL_ARTIFACT_BYTES)),
-	on: isUpstreamHooks,
-	error: isFunction
-}, true);
-//#endregion
-//#region src/server/helpers.ts
+function isExactCaseFile(path) {
+	const full = resolve(path);
+	if (!isPhysicalFile(full)) return false;
+	const root = parse(full).root;
+	const segments = relative(root, full).split(sep);
+	let parent = root;
+	for (const segment of segments) {
+		const entries = attempt(() => readdirSync(parent));
+		if (entries.success) {
+			if (!entries.value.includes(segment)) return false;
+		} else {
+			const actual = attempt(() => realpathSync.native(join(parent, segment)));
+			if (!actual.success || basename(actual.value) !== segment) return false;
+		}
+		parent = join(parent, segment);
+	}
+	return true;
+}
 /**
-* Tests whether a caught filesystem error reports an absent path.
+* Tests whether a path is a physical directory this package will read or write into.
 *
-* @param error - The caught value.
-* @returns True if `error` is an `Error` whose `code` is exactly `ENOENT`; false otherwise.
+* @param path - The resolved host path to inspect, without following links.
+* @returns True if the path is a directory that is not a link; false otherwise.
 *
 * @remarks
-* The one place absence is told apart from failure. Every read here answers
-* `undefined` or an empty result for a path that is not there and reports a path
-* that is there but unreadable, so they must never be read from the same
-* caught value by eye. Total for any caught value, including a hostile one.
+* A junction and a directory symbolic link both report as directories after
+* they are followed, so the inspection deliberately does not follow: a redirected
+* directory is refused here rather than silently accepted as the one the caller
+* named.
 *
 * @example
 * ```ts
-* import { matchesMissingPath } from '@orkestrel/scaffold/server'
+* import { isPhysicalDirectory } from '@orkestrel/scaffold/server'
 *
-* matchesMissingPath(Object.assign(new Error('gone'), { code: 'ENOENT' })) // true
-* matchesMissingPath(new Error('gone')) // false
+* isPhysicalDirectory('/tmp/project') // true for a plain directory
 * ```
 */
-function matchesMissingPath(error) {
-	return holds(() => isError(error) && Reflect.get(error, "code") === "ENOENT");
+function isPhysicalDirectory(path) {
+	const status = attempt(() => lstatSync(path));
+	return status.success && status.value.isDirectory() && !status.value.isSymbolicLink();
 }
 /**
-* Tests whether a path addresses a target's own repository metadata.
+* Computes the SHA-256 digest of one file's exact bytes.
 *
-* @param path - The path to classify; either separator is read.
-* @returns True if the path is `.git` or sits beneath it; false otherwise.
+* @param path - The resolved host path to digest.
+* @returns The digest, or `undefined` when the path is not a physical file, is
+* past the artifact ceiling, or moved while it was being read.
 *
 * @remarks
-* The one home of the `.git` membership rule, read in either direction. A target
-* holding nothing but this directory is still vacant, because a checkout of an
-* empty repository is where a fresh workspace legitimately starts. A path
-* beneath it is never removed and never vendored, because deleting a target's
-* history is not a repair.
+* Read in bounded chunks rather than loaded whole, so digesting a large file
+* costs one buffer instead of its size. The file's identity and size are
+* measured before and after the read and a mismatch answers `undefined`, so a
+* digest is either of one settled file or is not produced at all.
 *
 * @example
 * ```ts
-* import { matchesGitPath } from '@orkestrel/scaffold/server'
+* import { computeFileDigest } from '@orkestrel/scaffold/server'
 *
-* matchesGitPath('.git') // true
-* matchesGitPath('.git/config') // true
-* matchesGitPath('.gitignore') // false
+* computeFileDigest('/tmp/project/AGENTS.md') // the file's SHA-256
+* computeFileDigest('/tmp/project/absent.md') // undefined
 * ```
 */
-function matchesGitPath(path) {
-	return /(?:^|\/)\.git(?:\/|$)/i.test(path.replaceAll("\\", "/"));
+function computeFileDigest(path) {
+	if (!isPhysicalFile(path)) return void 0;
+	const opened = attempt(() => openSync(path, "r"));
+	if (!opened.success) return void 0;
+	const handle = opened.value;
+	const read = attempt(() => {
+		const before = fstatSync(handle);
+		if (!before.isFile() || before.nlink !== 1 || before.size > MAX_ARTIFACT_BYTES) return void 0;
+		const hash = createHash("sha256");
+		const buffer = Buffer.alloc(65536);
+		let size = 0;
+		for (;;) {
+			const length = readSync(handle, buffer, 0, buffer.byteLength, null);
+			if (length === 0) break;
+			size += length;
+			if (size > MAX_ARTIFACT_BYTES) return void 0;
+			hash.update(buffer.subarray(0, length));
+		}
+		const after = fstatSync(handle);
+		if (size !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) return;
+		return hash.digest("hex");
+	});
+	attempt(() => closeSync(handle));
+	return read.success ? read.value : void 0;
 }
 /**
-* Tests whether a target-relative path is one no verb may delete.
+* Resolves a path through the real filesystem, keeping the part that does not exist yet.
 *
-* @param path - The target-relative path to classify.
-* @returns True if the path must survive every verb this package runs; false otherwise.
+* @param path - The absolute or relative host path to resolve.
+* @returns The lexical resolution of `path`, with its existing prefix then
+* resolved through every link, or `undefined` when the text is not a host path,
+* no bounded existing ancestor resolves, a link target cannot be read, a link
+* target carries a `..` segment, or an ancestor cannot be read.
 *
 * @remarks
-* The deletion deny-list, stated as a rule over paths rather than as a list of
-* directories. It is the inversion the contract asks for: the candidate set
-* is re-derived from the plan and narrowed by what git tracks, and the audit
-* must agree with that derivation rather than supply the set itself.
-* Git metadata is protected because losing history is not a repair,
-* and a target's own `src` and `app` trees are protected because a
-* workspace's source is the one thing scaffold never plans and never owns. A
-* plan the compiler emits never maps a protected root, so this guard exists
-* for the caller-authored plan a consumer can still supply.
-*
-* @example
-* ```ts
-* import { matchesProtectedPath } from '@orkestrel/scaffold/server'
+* A containment decision has to be made about a destination that does not exist
+* yet, and a lexical answer is not enough: a link anywhere in the existing
+* prefix moves the destination somewhere the text never named. So the deepest
+* existing ancestor is resolved and the remaining segments are re-joined onto
+* it. The climb is bounded by the path-depth ceiling, so an adversarial path
+* cannot make it walk indefinitely.
 *
-* matchesProtectedPath('src/core/index.ts') // true
-* matchesProtectedPath('.git/config') // true
-* matchesProtectedPath('.claude/agents/rogue.md') // false
-* ```
-*/
-function matchesProtectedPath(path) {
-	const normalized = path.replaceAll("\\", "/");
-	if (matchesGitPath(normalized)) return true;
-	if (normalized === "src" || normalized === "app") return true;
-	return normalized.startsWith("src/") || normalized.startsWith("app/");
-}
-/**
-* Tests whether a path names local configuration or a credential.
+* The caller's own text is collapsed first, which is what `resolve` does with a
+* `..` the caller wrote: it cancels the segment before it as text, before any
+* link in that segment is read. So `<root>/hop/..` answers `<root>` even where
+* `hop` links elsewhere, rather than the directory holding what `hop` points at.
+* The collapse only ever shortens the caller's path, so nothing reaches outside
+* it by this; the answer is that lexical location resolved through links, not
+* the physical location the links lead to. {@link resolveContainedPath} passes
+* its `root` through here, so a root written with a parent segment is contained
+* against its collapsed spelling.
 *
-* @param path - The path to classify; either separator is read.
-* @returns True if the path must never be copied into a vendored host; false otherwise.
+* `realpath` answers `ENOENT` both for a name that is not there and for a link
+* whose target is not there. The name is therefore inspected without following
+* it: a dangling link redirects the walk to its target, while a genuinely absent
+* name is retained as one segment of the unresolved suffix. A dangling link
+* target containing a `..` segment is refused. Resolving that target as one
+* lexical string could discard a preceding link before the filesystem gives
+* `..` its physical meaning.
 *
-* @remarks
-* The vendoring deny-list. A host root is staged from a real checkout, so the
-* refusal is stated over the path rather than over the file's content: a
-* credential is recognizable by where it sits and what it is called long before
-* anything reads it. Git metadata is included through
-* {@link matchesGitPath}, so one call answers the whole question and no caller
-* has to remember to ask twice.
+* That target is split on both separators on every host, which is the reading
+* `isPath` already gives a planned path. A POSIX filename legally containing a
+* backslash is therefore refused with it: `weird\..\name` is one name to the
+* host and three segments here. The package keeps one separator law rather than
+* a host-dependent second one, and this is the conservative side of it.
 *
 * @example
 * ```ts
-* import { matchesSensitivePath } from '@orkestrel/scaffold/server'
+* import { resolveRealPath } from '@orkestrel/scaffold/server'
 *
-* matchesSensitivePath('.npmrc') // true
-* matchesSensitivePath('.claude/settings.local.json') // true
-* matchesSensitivePath('.claude/settings.json') // false
+* resolveRealPath('./packages/new/src') // the real path of `packages`, plus `new/src`
 * ```
 */
-function matchesSensitivePath(path) {
-	const normalized = path.replaceAll("\\", "/");
-	if (matchesGitPath(normalized)) return true;
-	return /(?:^|\/)(?:(?:\.ssh|\.aws|\.azure|\.docker|\.kube|\.gnupg|\.env(?:\.[^/]*)?)(?:\/|$)|(?:\.npmrc|\.pypirc|\.netrc|\.git-credentials|settings\.local\.json|auth\.json|credentials(?:\.json)?|application_default_credentials\.json|id_rsa|id_ed25519|kubeconfig)$|\.config\/(?:gh|gcloud)(?:\/|$)|\.local\/share\/keyrings(?:\/|$)|[^/]*service-account[^/]*\.json$|[^/]*\.(?:jks|key|p12|pem|pfx|pkcs12)$)/i.test(normalized);
+function resolveRealPath(path) {
+	if (!isFilesystemPath(path)) return void 0;
+	let current = resolve(path);
+	const pending = [];
+	for (let depth = 0; depth <= 64; depth += 1) {
+		const real = attempt(() => realpathSync(current));
+		if (real.success) {
+			let physical = real.value;
+			for (const segment of pending) physical = join(physical, segment);
+			return physical;
+		}
+		if (!matchesMissingPath(real.error)) return void 0;
+		const status = attempt(() => lstatSync(current));
+		if (status.success) {
+			if (!status.value.isSymbolicLink()) return void 0;
+			const target = attempt(() => readlinkSync(current));
+			if (!target.success) return void 0;
+			if (target.value.split(/[\\/]/u).includes("..")) return void 0;
+			current = resolve(dirname(current), target.value);
+			continue;
+		}
+		if (!matchesMissingPath(status.error)) return void 0;
+		const parent = dirname(current);
+		if (parent === current) return void 0;
+		pending.unshift(relative(parent, current));
+		current = parent;
+	}
 }
 /**
-* Tests whether a vendored path is one a target receives executable.
+* Resolves a root-relative path and refuses one that leaves its root.
 *
-* @param path - The target-relative path to classify; either separator is read.
-* @returns True if the path is declared in {@link EXECUTABLE_PATHS}; false otherwise.
+* @param root - The containing host directory.
+* @param path - The portable root-relative path.
+* @returns The destination as this package will address it, or `undefined` when
+* either argument is off contract or the destination lies outside `root`.
 *
 * @remarks
-* The declaration is the whole answer, and deliberately so. Reading the staging
-* host's mode instead makes the manifest depend on where the package was built:
-* Windows carries no executable bit, so a host staged there declares every entry
-* non-executable and every target it later fills receives hooks at `0644`. One
-* checkout stages one manifest on every host because this predicate never
-* consults the filesystem.
+* The containment law, and the one door every read in this module goes through.
+* Both sides are resolved through the real filesystem before they are compared.
+* A dangling link is followed only when its raw target contains no parent
+* traversal. The answer is then the lexical join of `root` and `path` — an
+* absolute path under `root`, not a root-relative one — so the caller operates
+* on the path it named rather than on a resolved form the target may not
+* recognize. A `root` written with a parent segment is collapsed by that
+* resolution before anything is read, so containment is measured against the
+* directory the caller's text names.
+*
+* Comparison is exact text, which fails closed on a case-insensitive
+* filesystem: a root and a path spelled with different case resolve to
+* different strings there and are refused, never wrongly admitted.
+*
+* The answer describes the namespace this call read. The contract excludes a
+* concurrent rename or link swap during the call or before the caller finishes
+* using the returned path. This helper returns a string, not a filesystem
+* handle, so it cannot bind its containment check to a later operation. A caller
+* that admits hostile concurrent namespace mutation needs a handle-bound
+* operation instead.
 *
 * @example
 * ```ts
-* import { matchesExecutablePath } from '@orkestrel/scaffold/server'
+* import { resolveContainedPath } from '@orkestrel/scaffold/server'
 *
-* matchesExecutablePath('scripts/codex.sh') // true
-* matchesExecutablePath('scripts\\deps.sh') // true
-* matchesExecutablePath('AGENTS.md') // false
+* resolveContainedPath('/tmp/project', 'guides/router.md')?.endsWith('router.md') // true
+* resolveContainedPath('/tmp/project', '../secrets') // undefined
 * ```
 */
-function matchesExecutablePath(path) {
-	return EXECUTABLE_PATHS.includes(path.replaceAll("\\", "/"));
+function resolveContainedPath(root, path) {
+	if (!isFilesystemPath(root) || !isPath(path)) return void 0;
+	const base = resolve(root);
+	const destination = join(base, path);
+	const physicalRoot = resolveRealPath(base);
+	const physical = resolveRealPath(destination);
+	if (physicalRoot === void 0 || physical === void 0) return void 0;
+	if (physical !== physicalRoot && !physical.startsWith(physicalRoot + sep)) return void 0;
+	return destination;
 }
 /**
-* Projects a target-relative path to the storage name a vendored host holds it under.
+* Tests whether a target is safe to write a fresh workspace into.
 *
-* @param path - The target-relative path the file is written to.
-* @returns The storage name beneath the host root.
+* @param target - The candidate target directory.
+* @returns True if the target is absent, empty, or holds nothing but its own `.git`
+* directory; false otherwise.
 *
 * @remarks
-* A staged host is a plain directory that npm packs, and npm's own ignore rules
-* would drop a leading-dot entry from the tarball. So every dot that opens a
-* segment comes off, and a dotted file at the root moves under `dotfiles/` to
-* keep it from colliding with an undotted sibling of the same name. The mapping
-* is one direction only: a staged host's manifest records the destination each
-* storage name answers for, so the reader never re-derives this.
+* The green-field law. A checkout of an empty repository is where a new
+* workspace legitimately starts, so that one directory is admitted and nothing
+* else is; anything more means the caller is repairing a workspace rather than
+* creating one. Only the first two entries are read, so the answer costs the
+* same on an empty directory and on a full one.
 *
 * @example
 * ```ts
-* import { pathToStorage } from '@orkestrel/scaffold/server'
+* import { isVacant } from '@orkestrel/scaffold/server'
 *
-* pathToStorage('.gitignore') // 'dotfiles/gitignore'
-* pathToStorage('.claude/rules/names.md') // 'claude/rules/names.md'
-* pathToStorage('AGENTS.md') // 'AGENTS.md'
+* isVacant('./packages/router-new') // true when absent, empty, or `.git` only
 * ```
 */
-function pathToStorage(path) {
-	const segments = path.split("/");
-	if (segments.length === 1) return path.startsWith(".") ? `dotfiles/${path.slice(1)}` : path;
-	return segments.map((segment) => segment.startsWith(".") ? segment.slice(1) : segment).join("/");
+function isVacant(target) {
+	if (!isFilesystemPath(target)) return false;
+	const status = attempt(() => lstatSync(target));
+	if (!status.success) return matchesMissingPath(status.error);
+	if (!status.value.isDirectory() || status.value.isSymbolicLink()) return false;
+	const opened = attempt(() => opendirSync(target));
+	if (!opened.success) return false;
+	const handle = opened.value;
+	const read = attempt(() => {
+		const first = handle.readSync();
+		if (first === null) return true;
+		if (handle.readSync() !== null) return false;
+		return matchesGitPath(first.name) && first.isDirectory() && !first.isSymbolicLink();
+	});
+	attempt(() => handle.closeSync());
+	return read.success && read.value;
 }
 /**
-* Computes the SHA-256 digest of text.
+* Lists a directory's files as sorted root-relative paths.
 *
-* @param content - The text to digest.
-* @returns Sixty-four lowercase hexadecimal digits.
+* @param root - The directory to inventory.
+* @returns Every descendant file as a `/`-separated root-relative path, in
+* code-unit order, and `[]` when `root` is absent.
+* @throws `ScaffoldError('INVALID', …)` when `root` is not a host path.
+* @throws `ScaffoldError('TARGET', …)` when `root` is present but is not a
+* physical directory, cannot be read, holds a name this package could not plan,
+* or carries more entries or more nesting than one inventory may report.
 *
 * @remarks
-* The identity the server face states, and the reason it differs from core's:
-* core settled on a folded 64-bit identity because compilation is synchronous by
-* contract and the only cryptographic digest a host-independent scope reaches is
-* asynchronous. A Node host reaches the real one synchronously, and
-* `HostManifest.digest` is documented as SHA-256, so this is what the server
-* uses everywhere a digest is claimed.
+* A whole-tree answer throws where a single-path answer returns `undefined`, and
+* the reason is that a partial inventory reads exactly like a complete one. A
+* caller comparing a target against a plan would treat a truncated listing as
+* proof that the missing files are not there.
+*
+* Absence is the one exception: nothing to inventory is a complete answer, so it
+* is the empty list. Links are listed as files rather than followed, so no
+* traversal can leave the root and no cycle can form.
 *
 * @example
 * ```ts
-* import { computeDigest } from '@orkestrel/scaffold/server'
+* import { listFiles } from '@orkestrel/scaffold/server'
 *
-* computeDigest('hi\n') // '98ea6e4f216f2fb4b69fff9b3a44842c38686ca685f3f55dc48c5d3fb1107be4'
+* listFiles('./dist/host') // ['AGENTS.md', 'CLAUDE.md', 'LICENSE', …]
 * ```
 */
-function computeDigest(content) {
-	return createHash("sha256").update(content, "utf8").digest("hex");
+function listFiles(root) {
+	if (!isFilesystemPath(root)) throw new ScaffoldError("INVALID", "Listing root is not a host path", { root });
+	const status = attempt(() => lstatSync(root));
+	if (!status.success) {
+		if (matchesMissingPath(status.error)) return [];
+		throw new ScaffoldError("TARGET", `Listing root cannot be inspected at ${root}`, {
+			root,
+			error: status.error
+		});
+	}
+	if (!status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Listing root is not a physical directory at ${root}`, { root });
+	const files = [];
+	const pending = [{
+		full: root,
+		path: "",
+		depth: 0
+	}];
+	let visited = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (current === void 0) break;
+		const opened = attempt(() => opendirSync(current.full));
+		if (!opened.success) throw new ScaffoldError("TARGET", `Listing directory cannot be read at ${current.full}`, {
+			root,
+			path: current.path,
+			error: opened.error
+		});
+		const handle = opened.value;
+		const walked = attempt(() => {
+			for (;;) {
+				const entry = handle.readSync();
+				if (entry === null) break;
+				visited += 1;
+				if (visited > 1e5) throw new ScaffoldError("TARGET", "Listing exceeds the paths one inventory may report", {
+					root,
+					limit: MAX_INVENTORY_PATHS
+				});
+				const path = current.path === "" ? entry.name : `${current.path}/${entry.name}`;
+				if (!isPath(path)) throw new ScaffoldError("TARGET", `Listing found a path this package cannot plan at ${path}`, {
+					root,
+					path
+				});
+				if (!entry.isDirectory() || entry.isSymbolicLink()) {
+					files.push(path);
+					continue;
+				}
+				const depth = current.depth + 1;
+				if (depth >= 64) throw new ScaffoldError("TARGET", `Listing exceeds the depth one path may carry at ${path}`, {
+					root,
+					path,
+					limit: 64
+				});
+				pending.push({
+					full: join(current.full, entry.name),
+					path,
+					depth
+				});
+			}
+		});
+		attempt(() => handle.closeSync());
+		if (!walked.success) throw walked.error;
+	}
+	return files.sort();
 }
 /**
-* Projects exact bytes stated in hexadecimal to their SHA-256 digest.
+* Lists a directory's descendant directories as sorted root-relative paths.
 *
-* @param hex - The exact lowercase hexadecimal bytes to digest.
-* @returns Sixty-four lowercase hexadecimal digits.
-* @throws `ScaffoldError('INVALID', …)` when `hex` is not exact bounded
-* lowercase hexadecimal text.
+* @param root - The directory to inventory.
+* @returns Every descendant directory as a `/`-separated root-relative path, in
+* code-unit order, and `[]` when `root` is absent.
+* @throws `ScaffoldError('INVALID', …)` when `root` is not a host path.
+* @throws `ScaffoldError('TARGET', …)` when `root` is present but is not a
+* physical directory, cannot be read, holds a name this package could not plan,
+* or carries more entries or more nesting than one inventory may report.
+*
+* @remarks
+* The sibling of {@link listFiles}, under the same bounds and the same refusals,
+* and it exists because a directory holding no file is invisible to a file walk.
+* That is the half a vendored host's `roots` declares and the half a file
+* inventory cannot check, so a stager needs both walks to state a complete
+* membership.
+*
+* `root` itself is not listed, because the answer is root-relative and the root
+* has no root-relative name. A redirected directory is not listed and is not
+* walked into, so no traversal can leave the root and no cycle can form.
 *
 * @example
 * ```ts
-* import { hexToDigest } from '@orkestrel/scaffold/server'
+* import { listDirectories } from '@orkestrel/scaffold/server'
 *
-* hexToDigest('68690a') // '98ea6e4f216f2fb4b69fff9b3a44842c38686ca685f3f55dc48c5d3fb1107be4'
+* listDirectories('./.claude') // ['agents', 'rules', 'skills', …]
 * ```
 */
-function hexToDigest(hex) {
-	if (!isHex(hex)) throw new ScaffoldError("INVALID", "Digest input is not exact hexadecimal bytes", { hex });
-	return createHash("sha256").update(Buffer.from(hex, "hex")).digest("hex");
+function listDirectories(root) {
+	if (!isFilesystemPath(root)) throw new ScaffoldError("INVALID", "Listing root is not a host path", { root });
+	const status = attempt(() => lstatSync(root));
+	if (!status.success) {
+		if (matchesMissingPath(status.error)) return [];
+		throw new ScaffoldError("TARGET", `Listing root cannot be inspected at ${root}`, {
+			root,
+			error: status.error
+		});
+	}
+	if (!status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Listing root is not a physical directory at ${root}`, { root });
+	const directories = [];
+	const pending = [{
+		full: root,
+		path: "",
+		depth: 0
+	}];
+	let visited = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (current === void 0) break;
+		const opened = attempt(() => opendirSync(current.full));
+		if (!opened.success) throw new ScaffoldError("TARGET", `Listing directory cannot be read at ${current.full}`, {
+			root,
+			path: current.path,
+			error: opened.error
+		});
+		const handle = opened.value;
+		const walked = attempt(() => {
+			for (;;) {
+				const entry = handle.readSync();
+				if (entry === null) break;
+				visited += 1;
+				if (visited > 1e5) throw new ScaffoldError("TARGET", "Listing exceeds the paths one inventory may report", {
+					root,
+					limit: MAX_INVENTORY_PATHS
+				});
+				const path = current.path === "" ? entry.name : `${current.path}/${entry.name}`;
+				if (!isPath(path)) throw new ScaffoldError("TARGET", `Listing found a path this package cannot plan at ${path}`, {
+					root,
+					path
+				});
+				if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
+				const depth = current.depth + 1;
+				if (depth >= 64) throw new ScaffoldError("TARGET", `Listing exceeds the depth one path may carry at ${path}`, {
+					root,
+					path,
+					limit: 64
+				});
+				directories.push(path);
+				pending.push({
+					full: join(current.full, entry.name),
+					path,
+					depth
+				});
+			}
+		});
+		attempt(() => handle.closeSync());
+		if (!walked.success) throw walked.error;
+	}
+	return directories.sort();
 }
 /**
-* Computes the digest of a vendored host's declared membership.
+* Lists the canon paths a target holds, filtered to a plan's groups.
 *
-* @param entries - The ordered file membership declarations.
-* @param roots - The ordered directory membership declarations.
-* @returns The SHA-256 of that exact membership, in that exact order.
+* @param target - The target directory to inspect.
+* @param groups - The artifact groups the plan covers; a held path whose group
+* is outside them is not listed.
+* @returns Every held canon path as a `/`-separated target-relative path, a
+* directory member expanded to the files beneath it, and `[]` when the target
+* holds none or cannot be resolved.
+* @throws `ScaffoldError('TARGET', …)` when a held canon directory cannot be
+* inventoried; {@link listFiles} states each refusal.
 *
 * @remarks
-* Independent of the manifest's own `digest` field, which is what lets a reader
-* detect a membership edit that did not update it. Order is part of the claim
-* rather than normalized away, because a staged manifest sorts its entries and
-* roots once and a reordered copy is a different file. Each entry is projected
-* to exactly the declared fields, so a hand-added property cannot ride
-* into the digest and cannot change it either.
+* A release stages the canon for reading rather than for a target, so a copy
+* sitting in one is an artifact of a release that vendored it, and reading it
+* here is what lets the deletion verb take it.
+*
+* A directory member is read by file, which is what pairs the paths a plan
+* claims inside the canon with their artifacts and leaves only the rest foreign,
+* with no case for a planned file. The plan's own selection gates the reading,
+* the same rule that decides a vendored path's group, so a scoped audit reports
+* nothing outside its groups. A member that cannot resolve inside the target is
+* not held by it.
 *
 * @example
 * ```ts
-* import { computeManifestDigest } from '@orkestrel/scaffold/server'
+* import { listCanonPaths } from '@orkestrel/scaffold/server'
 *
-* computeManifestDigest([], []) // the digest of the empty membership
+* listCanonPaths('vacant', ['orchestration']) // []
 * ```
 */
-function computeManifestDigest(entries, roots) {
-	return computeDigest(JSON.stringify({
-		entries: entries.map((entry) => ({
-			storage: entry.storage,
-			destination: entry.destination,
-			executable: entry.executable,
-			digest: entry.digest
-		})),
-		roots: [...roots]
-	}));
+function listCanonPaths(target, groups) {
+	const held = [];
+	for (const member of CANON_PATHS) {
+		const full = resolveContainedPath(target, member);
+		if (full === void 0) continue;
+		if (isPhysicalFile(full)) held.push(member);
+		else if (isPhysicalDirectory(full)) for (const name of listFiles(full)) held.push(`${member}/${name}`);
+	}
+	return held.filter((path) => groups.includes(inferGroup(path)));
 }
 /**
-* Tests whether a path is a physical file this package will read or replace.
+* Removes every directory one set of deletions emptied.
 *
-* @param path - The resolved host path to inspect, without following links.
-* @returns True if the path is a regular file that is neither a link nor hard-linked
-* elsewhere; false otherwise.
+* @param target - The directory the deleted paths are relative to.
+* @param removed - The `/`-separated target-relative paths the deletion took.
+* @returns Every removed directory as a target-relative path, in the order they
+* were taken, and `[]` when the target is absent or nothing it holds was
+* emptied.
 *
 * @remarks
-* The link tests are the point. A symbolic link is a path pointing somewhere
-* else, so writing through one writes outside the target; a hard link means a
-* second name shares the same bytes, so replacing them changes a file nobody
-* asked about. Both are refused rather than followed.
+* A deletion that takes the last file out of a directory leaves the directory
+* standing, and git records no directory, so a swept target keeps the shape of a
+* set it no longer holds while every reading of it reports clean. Only an
+* ancestor of a path this deletion took is a candidate, so nothing the deletion
+* did not reach is inspected, and the target itself is never a candidate.
+*
+* Candidates are taken deepest first, which is what lets a whole chain go: the
+* directory holding nothing but the emptied directory is empty in turn by the
+* time it is read. Each one is resolved through the containment law and left
+* standing when it escapes the target, is not a physical directory, still holds
+* an entry, or refuses removal, and a directory left standing is absent from the
+* answer.
 *
 * @example
 * ```ts
-* import { isPhysicalFile } from '@orkestrel/scaffold/server'
+* import { pruneEmptiedDirectories } from '@orkestrel/scaffold/server'
 *
-* isPhysicalFile('/tmp/project/AGENTS.md') // true for a plain file
+* pruneEmptiedDirectories('vacant', ['notes/entry.md']) // []
 * ```
 */
-function isPhysicalFile(path) {
-	const status = attempt(() => lstatSync(path));
-	return status.success && status.value.isFile() && !status.value.isSymbolicLink() && status.value.nlink === 1;
-}
-/**
-* Tests whether a path is a physical file with exact on-disk casing.
-*
-* @param path - The host path to inspect segment by segment.
-* @returns True if the path is a physical file whose requested segments exactly match
-* the names each parent directory stores; false otherwise.
-*
-* @remarks
-* A direct file lookup follows the host's case-folding rules on Windows and
-* common macOS filesystems. Reading each parent directory supplies the stored
-* names, so this predicate can enforce the package's exact-case structural
-* contract on every supported host.
-*
-* @example
-* ```ts
-* import { isExactCaseFile } from '@orkestrel/scaffold/server'
-*
-* isExactCaseFile('/tmp/project/src/bin/main.ts') // true only for that exact spelling
-* ```
-*/
-function isExactCaseFile(path) {
-	const full = resolve(path);
-	if (!isPhysicalFile(full)) return false;
-	const root = parse(full).root;
-	const segments = relative(root, full).split(sep);
-	let parent = root;
-	for (const segment of segments) {
-		const entries = attempt(() => readdirSync(parent));
-		if (entries.success) {
-			if (!entries.value.includes(segment)) return false;
-		} else {
-			const actual = attempt(() => realpathSync.native(join(parent, segment)));
-			if (!actual.success || basename(actual.value) !== segment) return false;
+function pruneEmptiedDirectories(target, removed) {
+	const candidates = /* @__PURE__ */ new Set();
+	for (const path of removed) {
+		let parent = dirname(path);
+		while (parent !== "." && parent !== dirname(parent) && !candidates.has(parent)) {
+			candidates.add(parent);
+			parent = dirname(parent);
 		}
-		parent = join(parent, segment);
 	}
-	return true;
-}
-/**
-* Tests whether a path is a physical directory this package will read or write into.
-*
-* @param path - The resolved host path to inspect, without following links.
-* @returns True if the path is a directory that is not a link; false otherwise.
-*
-* @remarks
-* A junction and a directory symbolic link both report as directories after
-* they are followed, so the inspection deliberately does not follow: a redirected
-* directory is refused here rather than silently accepted as the one the caller
-* named.
-*
-* @example
-* ```ts
-* import { isPhysicalDirectory } from '@orkestrel/scaffold/server'
-*
-* isPhysicalDirectory('/tmp/project') // true for a plain directory
-* ```
-*/
-function isPhysicalDirectory(path) {
-	const status = attempt(() => lstatSync(path));
-	return status.success && status.value.isDirectory() && !status.value.isSymbolicLink();
+	const ordered = [...candidates].sort((left, right) => compareValues(right.split("/").length, left.split("/").length) || compareValues(left, right));
+	const pruned = [];
+	for (const candidate of ordered) {
+		const directory = resolveContainedPath(target, candidate);
+		if (directory === void 0 || !isPhysicalDirectory(directory)) continue;
+		const entries = attempt(() => readdirSync(directory));
+		if (!entries.success || entries.value.length > 0) continue;
+		if (attempt(() => rmdirSync(directory)).success) pruned.push(candidate);
+	}
+	return pruned;
 }
 /**
-* Computes the SHA-256 digest of one file's exact bytes.
+* Reads one contained file as its exact bytes in lowercase hexadecimal.
 *
-* @param path - The resolved host path to digest.
-* @returns The digest, or `undefined` when the path is not a physical file, is
-* past the artifact ceiling, or moved while it was being read.
+* @param root - The containing host directory.
+* @param path - The portable root-relative file path.
+* @param limit - The most bytes this read accepts; the artifact ceiling by default.
+* @returns The exact bytes as hexadecimal, or `undefined` when the file is
+* absent, is not a physical readable file, is past `limit`, or moved while it
+* was being read.
+* @throws `ScaffoldError('INVALID', …)` when the arguments are off contract or
+* `path` leaves `root`.
 *
 * @remarks
-* Read in bounded chunks rather than loaded whole, so digesting a large file
-* costs one buffer instead of its size. The file's identity and size are
-* measured before and after the read and a mismatch answers `undefined`, so a
-* digest is either of one settled file or is not produced at all.
+* Hexadecimal rather than text, because this is what a byte comparison is stated
+* in everywhere in this package: a plan's artifact, an audit finding, and a
+* snapshot all compare as the same digits. The file's identity and size are
+* measured before and after the read, and one extra byte is requested past the
+* declared size, so a file that grew or was replaced mid-read answers
+* `undefined` rather than half of one file and half of another.
 *
 * @example
 * ```ts
-* import { computeFileDigest } from '@orkestrel/scaffold/server'
+* import { readFileHex } from '@orkestrel/scaffold/server'
 *
-* computeFileDigest('/tmp/project/AGENTS.md') // the file's SHA-256
-* computeFileDigest('/tmp/project/absent.md') // undefined
+* readFileHex('/tmp/project', 'AGENTS.md') // '2320416765…'
 * ```
 */
-function computeFileDigest(path) {
-	if (!isPhysicalFile(path)) return void 0;
-	const opened = attempt(() => openSync(path, "r"));
+function readFileHex(root, path, limit = MAX_ARTIFACT_BYTES) {
+	if (!Number.isSafeInteger(limit) || limit < 0 || limit > MAX_ARTIFACT_BYTES) throw new ScaffoldError("INVALID", `Byte limit is outside the artifact ceiling at ${path}`, {
+		root,
+		path,
+		limit
+	});
+	const full = resolveContainedPath(root, path);
+	if (full === void 0) throw new ScaffoldError("INVALID", `Path is off contract or leaves its root at ${path}`, {
+		root,
+		path
+	});
+	if (!isPhysicalFile(full)) return void 0;
+	const opened = attempt(() => openSync(full, "r"));
 	if (!opened.success) return void 0;
 	const handle = opened.value;
 	const read = attempt(() => {
 		const before = fstatSync(handle);
-		if (!before.isFile() || before.nlink !== 1 || before.size > MAX_ARTIFACT_BYTES) return void 0;
-		const hash = createHash("sha256");
-		const buffer = Buffer.alloc(65536);
-		let size = 0;
-		for (;;) {
-			const length = readSync(handle, buffer, 0, buffer.byteLength, null);
+		if (!before.isFile() || before.nlink !== 1 || before.size > limit) return void 0;
+		const bytes = Buffer.alloc(before.size);
+		let offset = 0;
+		while (offset < bytes.byteLength) {
+			const length = readSync(handle, bytes, offset, bytes.byteLength - offset, offset);
 			if (length === 0) break;
-			size += length;
-			if (size > MAX_ARTIFACT_BYTES) return void 0;
-			hash.update(buffer.subarray(0, length));
+			offset += length;
 		}
+		const overflow = readSync(handle, Buffer.alloc(1), 0, 1, offset);
 		const after = fstatSync(handle);
-		if (size !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) return;
-		return hash.digest("hex");
+		if (offset !== bytes.byteLength || overflow !== 0 || after.size !== before.size || after.mtimeMs !== before.mtimeMs) return;
+		return bytesToHex(bytes);
 	});
 	attempt(() => closeSync(handle));
 	return read.success ? read.value : void 0;
 }
 /**
-* Resolves a path through the real filesystem, keeping the part that does not exist yet.
+* Reads one contained file as bounded UTF-8 text.
 *
-* @param path - The absolute or relative host path to resolve.
-* @returns The lexical resolution of `path`, with its existing prefix then
-* resolved through every link, or `undefined` when the text is not a host path,
-* no bounded existing ancestor resolves, a link target cannot be read, a link
-* target carries a `..` segment, or an ancestor cannot be read.
+* @param root - The containing host directory.
+* @param path - The portable root-relative file path.
+* @param limit - The most bytes this read accepts; the artifact ceiling by default.
+* @returns The decoded text, or `undefined` when {@link readFileHex} answers
+* nothing or the bytes are not valid UTF-8.
+* @throws `ScaffoldError('INVALID', …)` when the arguments are off contract or
+* `path` leaves `root`.
 *
 * @remarks
-* A containment decision has to be made about a destination that does not exist
-* yet, and a lexical answer is not enough: a link anywhere in the existing
-* prefix moves the destination somewhere the text never named. So the deepest
-* existing ancestor is resolved and the remaining segments are re-joined onto
-* it. The climb is bounded by the path-depth ceiling, so an adversarial path
-* cannot make it walk indefinitely.
-*
-* The caller's own text is collapsed first, which is what `resolve` does with a
-* `..` the caller wrote: it cancels the segment before it as text, before any
-* link in that segment is read. So `<root>/hop/..` answers `<root>` even where
-* `hop` links elsewhere, rather than the directory holding what `hop` points at.
-* The collapse only ever shortens the caller's path, so nothing reaches outside
-* it by this; the answer is that lexical location resolved through links, not
-* the physical location the links lead to. {@link resolveContainedPath} passes
-* its `root` through here, so a root written with a parent segment is contained
-* against its collapsed spelling.
-*
-* `realpath` answers `ENOENT` both for a name that is not there and for a link
-* whose target is not there. The name is therefore inspected without following
-* it: a dangling link redirects the walk to its target, while a genuinely absent
-* name is retained as one segment of the unresolved suffix. A dangling link
-* target containing a `..` segment is refused. Resolving that target as one
-* lexical string could discard a preceding link before the filesystem gives
-* `..` its physical meaning.
-*
-* That target is split on both separators on every host, which is the reading
-* `isPath` already gives a planned path. A POSIX filename legally containing a
-* backslash is therefore refused with it: `weird\..\name` is one name to the
-* host and three segments here. The package keeps one separator law rather than
-* a host-dependent second one, and this is the conservative side of it.
+* Decoding is strict, so a file carrying an invalid sequence answers `undefined`
+* rather than text carrying replacement characters. That matters because the
+* text is parsed next: a manifest silently repaired into valid JSON by lossy
+* decoding would be trusted.
 *
 * @example
 * ```ts
-* import { resolveRealPath } from '@orkestrel/scaffold/server'
+* import { readFileText } from '@orkestrel/scaffold/server'
 *
-* resolveRealPath('./packages/new/src') // the real path of `packages`, plus `new/src`
+* readFileText('/tmp/project', 'package.json') // '{ "name": "@orkestrel/router", … }'
 * ```
 */
-function resolveRealPath(path) {
-	if (!isFilesystemPath(path)) return void 0;
-	let current = resolve(path);
-	const pending = [];
-	for (let depth = 0; depth <= 64; depth += 1) {
-		const real = attempt(() => realpathSync(current));
-		if (real.success) {
-			let physical = real.value;
-			for (const segment of pending) physical = join(physical, segment);
-			return physical;
-		}
-		if (!matchesMissingPath(real.error)) return void 0;
-		const status = attempt(() => lstatSync(current));
-		if (status.success) {
-			if (!status.value.isSymbolicLink()) return void 0;
-			const target = attempt(() => readlinkSync(current));
-			if (!target.success) return void 0;
-			if (target.value.split(/[\\/]/u).includes("..")) return void 0;
-			current = resolve(dirname(current), target.value);
-			continue;
-		}
-		if (!matchesMissingPath(status.error)) return void 0;
-		const parent = dirname(current);
-		if (parent === current) return void 0;
-		pending.unshift(relative(parent, current));
-		current = parent;
-	}
+function readFileText(root, path, limit = MAX_ARTIFACT_BYTES) {
+	const hex = readFileHex(root, path, limit);
+	if (hex === void 0) return void 0;
+	const decoded = attempt(() => new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(hex, "hex")));
+	return decoded.success ? decoded.value : void 0;
 }
 /**
-* Resolves a root-relative path and refuses one that leaves its root.
+* Reads a target's current bytes at the paths a plan claims.
 *
-* @param root - The containing host directory.
-* @param path - The portable root-relative path.
-* @returns The destination as this package will address it, or `undefined` when
-* either argument is off contract or the destination lies outside `root`.
+* @param target - The target directory to read.
+* @param paths - The plan-relative paths to probe.
+* @returns One entry per path that is there: a file maps to its exact bytes as
+* hexadecimal and a directory maps to `''`, which records presence with no bytes
+* to compare. An absent path is omitted.
+* @throws `ScaffoldError('INVALID', …)` when `target` is not a host path or
+* `paths` is not a bounded list of plannable paths.
+* @throws `ScaffoldError('TARGET', …)` when a path that is there cannot be read,
+* or when the whole read would retain more bytes than one plan may.
 *
 * @remarks
-* The containment law, and the one door every read in this module goes through.
-* Both sides are resolved through the real filesystem before they are compared.
-* A dangling link is followed only when its raw target contains no parent
-* traversal. The answer is then the lexical join of `root` and `path` — an
-* absolute path under `root`, not a root-relative one — so the caller operates
-* on the path it named rather than on a resolved form the target may not
-* recognize. A `root` written with a parent segment is collapsed by that
-* resolution before anything is read, so containment is measured against the
-* directory the caller's text names.
-*
-* Comparison is exact text, which fails closed on a case-insensitive
-* filesystem: a root and a path spelled with different case resolve to
-* different strings there and are refused, never wrongly admitted.
-*
-* The answer describes the namespace this call read. The contract excludes a
-* concurrent rename or link swap during the call or before the caller finishes
-* using the returned path. This helper returns a string, not a filesystem
-* handle, so it cannot bind its containment check to a later operation. A caller
-* that admits hostile concurrent namespace mutation needs a handle-bound
-* operation instead.
+* The one door from a real directory into the vocabulary an audit compares in.
+* Absence is omission rather than an empty value, because core reads a missing
+* key as a missing destination and an empty string as a present directory;
+* they are different verdicts. A path that is there but unreadable throws instead
+* of being omitted, because omission would report it as missing and a repair
+* would then overwrite whatever is actually sitting there.
 *
 * @example
 * ```ts
-* import { resolveContainedPath } from '@orkestrel/scaffold/server'
+* import { readSnapshot } from '@orkestrel/scaffold/server'
 *
-* resolveContainedPath('/tmp/project', 'guides/router.md')?.endsWith('router.md') // true
-* resolveContainedPath('/tmp/project', '../secrets') // undefined
-* ```
-*/
-function resolveContainedPath(root, path) {
-	if (!isFilesystemPath(root) || !isPath(path)) return void 0;
-	const base = resolve(root);
-	const destination = join(base, path);
-	const physicalRoot = resolveRealPath(base);
-	const physical = resolveRealPath(destination);
-	if (physicalRoot === void 0 || physical === void 0) return void 0;
-	if (physical !== physicalRoot && !physical.startsWith(physicalRoot + sep)) return void 0;
-	return destination;
-}
-/**
-* Tests whether a target is safe to write a fresh workspace into.
-*
-* @param target - The candidate target directory.
-* @returns True if the target is absent, empty, or holds nothing but its own `.git`
-* directory; false otherwise.
-*
-* @remarks
-* The green-field law. A checkout of an empty repository is where a new
-* workspace legitimately starts, so that one directory is admitted and nothing
-* else is; anything more means the caller is repairing a workspace rather than
-* creating one. Only the first two entries are read, so the answer costs the
-* same on an empty directory and on a full one.
-*
-* @example
-* ```ts
-* import { isVacant } from '@orkestrel/scaffold/server'
-*
-* isVacant('./packages/router-new') // true when absent, empty, or `.git` only
+* readSnapshot('./packages/router', ['package.json', 'guides'])
+* // { 'package.json': '7b226e…', guides: '' }
 * ```
 */
-function isVacant(target) {
-	if (!isFilesystemPath(target)) return false;
-	const status = attempt(() => lstatSync(target));
-	if (!status.success) return matchesMissingPath(status.error);
-	if (!status.value.isDirectory() || status.value.isSymbolicLink()) return false;
-	const opened = attempt(() => opendirSync(target));
-	if (!opened.success) return false;
-	const handle = opened.value;
-	const read = attempt(() => {
-		const first = handle.readSync();
-		if (first === null) return true;
-		if (handle.readSync() !== null) return false;
-		return matchesGitPath(first.name) && first.isDirectory() && !first.isSymbolicLink();
+function readSnapshot(target, paths) {
+	if (!isFilesystemPath(target)) throw new ScaffoldError("INVALID", "Snapshot target is not a host path", { target });
+	if (!isCollection(paths) || !paths.every((path) => isPath(path))) throw new ScaffoldError("INVALID", "Snapshot paths are not a bounded list of plannable paths", {
+		target,
+		limit: MAX_COLLECTION_ITEMS
 	});
-	attempt(() => handle.closeSync());
-	return read.success && read.value;
+	let remaining = MAX_TOTAL_ARTIFACT_BYTES;
+	const snapshot = {};
+	for (const path of paths) {
+		const full = resolveContainedPath(target, path);
+		if (full === void 0) throw new ScaffoldError("INVALID", `Snapshot path leaves its target at ${path}`, {
+			target,
+			path
+		});
+		const status = attempt(() => lstatSync(full));
+		if (!status.success) {
+			if (matchesMissingPath(status.error)) continue;
+			throw new ScaffoldError("TARGET", `Snapshot path cannot be inspected at ${path}`, {
+				target,
+				path,
+				error: status.error
+			});
+		}
+		if (isPhysicalDirectory(full)) {
+			snapshot[path] = "";
+			continue;
+		}
+		const hex = readFileHex(target, path, Math.min(MAX_ARTIFACT_BYTES, remaining));
+		if (hex === void 0) throw new ScaffoldError("TARGET", `Snapshot path is not a readable file at ${path}`, {
+			target,
+			path,
+			limit: MAX_TOTAL_ARTIFACT_BYTES
+		});
+		remaining -= hex.length / 2;
+		snapshot[path] = hex;
+	}
+	return snapshot;
 }
 /**
-* Lists a directory's files as sorted root-relative paths.
+* Reads a vendored host's manifest, when it carries one.
 *
-* @param root - The directory to inventory.
-* @returns Every descendant file as a `/`-separated root-relative path, in
-* code-unit order, and `[]` when `root` is absent.
-* @throws `ScaffoldError('INVALID', …)` when `root` is not a host path.
-* @throws `ScaffoldError('TARGET', …)` when `root` is present but is not a
-* physical directory, cannot be read, holds a name this package could not plan,
-* or carries more entries or more nesting than one inventory may report.
+* @param host - The vendored host root to read.
+* @param name - The root-relative manifest path. Default: `manifest.json`.
+* @returns The manifest, or `undefined` when the host carries none.
+* @throws `ScaffoldError('INVALID', …)` when `host` is not a host path.
+* @throws `ScaffoldError('TARGET', …)` when the manifest is there but cannot be
+* read, is not the declared shape, or does not match its own membership.
 *
 * @remarks
-* A whole-tree answer throws where a single-path answer returns `undefined`, and
-* the reason is that a partial inventory reads exactly like a complete one. A
-* caller comparing a target against a plan would treat a truncated listing as
-* proof that the missing files are not there.
+* The failures are held apart deliberately. A host with no manifest is a
+* raw checkout, and a caller reads it by mapping each path one to one. A host
+* with a manifest that does not verify is a staged host that has been edited,
+* and answering `undefined` there would degrade it to that same one-to-one
+* mapping — which is how an edited manifest would get a caller to read files it
+* never declared. So absence answers and corruption throws.
 *
-* Absence is the one exception: nothing to inventory is a complete answer, so it
-* is the empty list. Links are listed as files rather than followed, so no
-* traversal can leave the root and no cycle can form.
+* Verification here is the manifest's own self-consistency: the digest against
+* the exact membership beside it. Whether that membership matches the files
+* actually stored is a separate question, and it belongs to the reader that
+* walks the host.
 *
 * @example
 * ```ts
-* import { listFiles } from '@orkestrel/scaffold/server'
+* import { readHostManifest } from '@orkestrel/scaffold/server'
 *
-* listFiles('./dist/host') // ['AGENTS.md', 'CLAUDE.md', 'LICENSE', …]
+* readHostManifest('./dist/host') // the manifest, or undefined for a raw root
 * ```
 */
-function listFiles(root) {
-	if (!isFilesystemPath(root)) throw new ScaffoldError("INVALID", "Listing root is not a host path", { root });
-	const status = attempt(() => lstatSync(root));
+function readHostManifest(host, name = MANIFEST_NAME) {
+	if (!isFilesystemPath(host)) throw new ScaffoldError("INVALID", "Host root is not a host path", { host });
+	const full = resolveContainedPath(host, name);
+	if (full === void 0) throw new ScaffoldError("INVALID", `Host manifest leaves its root at ${host}`, { host });
+	const status = attempt(() => lstatSync(full));
 	if (!status.success) {
-		if (matchesMissingPath(status.error)) return [];
-		throw new ScaffoldError("TARGET", `Listing root cannot be inspected at ${root}`, {
-			root,
+		if (matchesMissingPath(status.error)) return void 0;
+		throw new ScaffoldError("TARGET", `Host manifest cannot be inspected at ${full}`, {
+			host,
 			error: status.error
 		});
 	}
-	if (!status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Listing root is not a physical directory at ${root}`, { root });
-	const files = [];
-	const pending = [{
-		full: root,
-		path: "",
-		depth: 0
-	}];
-	let visited = 0;
-	while (pending.length > 0) {
-		const current = pending.pop();
-		if (current === void 0) break;
-		const opened = attempt(() => opendirSync(current.full));
-		if (!opened.success) throw new ScaffoldError("TARGET", `Listing directory cannot be read at ${current.full}`, {
-			root,
-			path: current.path,
-			error: opened.error
-		});
-		const handle = opened.value;
-		const walked = attempt(() => {
-			for (;;) {
-				const entry = handle.readSync();
-				if (entry === null) break;
-				visited += 1;
-				if (visited > 1e5) throw new ScaffoldError("TARGET", "Listing exceeds the paths one inventory may report", {
-					root,
-					limit: MAX_INVENTORY_PATHS
-				});
-				const path = current.path === "" ? entry.name : `${current.path}/${entry.name}`;
-				if (!isPath(path)) throw new ScaffoldError("TARGET", `Listing found a path this package cannot plan at ${path}`, {
-					root,
-					path
-				});
-				if (!entry.isDirectory() || entry.isSymbolicLink()) {
-					files.push(path);
-					continue;
-				}
-				const depth = current.depth + 1;
-				if (depth >= 64) throw new ScaffoldError("TARGET", `Listing exceeds the depth one path may carry at ${path}`, {
-					root,
-					path,
-					limit: 64
-				});
-				pending.push({
-					full: join(current.full, entry.name),
-					path,
-					depth
-				});
-			}
-		});
-		attempt(() => handle.closeSync());
-		if (!walked.success) throw walked.error;
-	}
-	return files.sort();
+	const text = readFileText(host, name, MAX_MANIFEST_BYTES);
+	if (text === void 0) throw new ScaffoldError("TARGET", `Host manifest is not readable text at ${full}`, { host });
+	const manifest = parseJSONAs(text, isHostManifest);
+	if (manifest === void 0) throw new ScaffoldError("TARGET", `Host manifest is malformed at ${full}`, { host });
+	if (manifest.digest !== computeManifestDigest(manifest.entries, manifest.roots, manifest.surface)) throw new ScaffoldError("TARGET", `Host manifest membership is corrupted at ${full}`, { host });
+	return manifest;
 }
 /**
-* Lists a directory's descendant directories as sorted root-relative paths.
+* Reads the installed vendored host floor as a value.
 *
-* @param root - The directory to inventory.
-* @returns Every descendant directory as a `/`-separated root-relative path, in
-* code-unit order, and `[]` when `root` is absent.
-* @throws `ScaffoldError('INVALID', …)` when `root` is not a host path.
-* @throws `ScaffoldError('TARGET', …)` when `root` is present but is not a
-* physical directory, cannot be read, holds a name this package could not plan,
-* or carries more entries or more nesting than one inventory may report.
+* @param root - The vendored host root. Default: the installed package's
+* vendored root, resolved from this module's location.
+* @returns The verified manifest and the exact bytes of every declared entry.
+* @throws `ScaffoldError('TARGET', …)` when the root is not a readable physical
+* directory, its manifest is absent or unreadable, the manifest does not verify,
+* or a declared file is unreadable or misses its digest.
 *
 * @remarks
-* The sibling of {@link listFiles}, under the same bounds and the same refusals,
-* and it exists because a directory holding no file is invisible to a file walk.
-* That is the half a vendored host's `roots` declares and the half a file
-* inventory cannot check, so a stager needs both walks to state a complete
-* membership.
-*
-* `root` itself is not listed, because the answer is root-relative and the root
-* has no root-relative name. A redirected directory is not listed and is not
-* walked into, so no traversal can leave the root and no cycle can form.
+* Reads the same default floor the {@link Materializer} uses. Each declared
+* file is addressed through the manifest's storage name and retained under its
+* destination, so the returned value has the same shape as the installed root.
+* When this module executes from TypeScript source, the committed inventory is
+* the manifest and each checkout destination supplies its bytes. The emitted
+* module reads the staged `manifest.json` file and each storage path instead.
 *
 * @example
 * ```ts
-* import { listDirectories } from '@orkestrel/scaffold/server'
+* import { readHostFloor } from '@orkestrel/scaffold/server'
 *
-* listDirectories('./.claude') // ['agents', 'rules', 'skills', …]
+* readHostFloor().manifest // the installed floor's verified membership
 * ```
 */
-function listDirectories(root) {
-	if (!isFilesystemPath(root)) throw new ScaffoldError("INVALID", "Listing root is not a host path", { root });
-	const status = attempt(() => lstatSync(root));
-	if (!status.success) {
-		if (matchesMissingPath(status.error)) return [];
-		throw new ScaffoldError("TARGET", `Listing root cannot be inspected at ${root}`, {
-			root,
-			error: status.error
+function readHostFloor(root) {
+	const location = fileURLToPath(import.meta.url);
+	const module = dirname(location);
+	const source = root === void 0 && extname(location) === ".ts";
+	const host = root ?? resolve(module, source ? "../.." : "../../host");
+	if (!isPhysicalDirectory(host)) throw new ScaffoldError("TARGET", `The vendored host root is not readable at ${host}`, { host });
+	const manifest = readHostManifest(host, source ? HOST_INVENTORY_PATH : MANIFEST_NAME);
+	if (manifest === void 0) throw new ScaffoldError("TARGET", `The vendored host carries no manifest at ${host}`, { host });
+	const bytes = {};
+	for (const entry of manifest.entries) {
+		const path = source ? entry.destination : entry.storage;
+		const hex = readFileHex(host, path);
+		if (hex === void 0 || hexToDigest(hex) !== entry.digest) throw new ScaffoldError("TARGET", `The vendored host cannot read the declared file at ${path}`, {
+			host,
+			path,
+			destination: entry.destination
 		});
+		bytes[entry.destination] = hex;
 	}
-	if (!status.value.isDirectory() || status.value.isSymbolicLink()) throw new ScaffoldError("TARGET", `Listing root is not a physical directory at ${root}`, { root });
-	const directories = [];
-	const pending = [{
-		full: root,
-		path: "",
-		depth: 0
-	}];
-	let visited = 0;
-	while (pending.length > 0) {
-		const current = pending.pop();
-		if (current === void 0) break;
-		const opened = attempt(() => opendirSync(current.full));
-		if (!opened.success) throw new ScaffoldError("TARGET", `Listing directory cannot be read at ${current.full}`, {
-			root,
-			path: current.path,
-			error: opened.error
-		});
-		const handle = opened.value;
-		const walked = attempt(() => {
-			for (;;) {
-				const entry = handle.readSync();
-				if (entry === null) break;
-				visited += 1;
-				if (visited > 1e5) throw new ScaffoldError("TARGET", "Listing exceeds the paths one inventory may report", {
-					root,
-					limit: MAX_INVENTORY_PATHS
-				});
-				const path = current.path === "" ? entry.name : `${current.path}/${entry.name}`;
-				if (!isPath(path)) throw new ScaffoldError("TARGET", `Listing found a path this package cannot plan at ${path}`, {
-					root,
-					path
-				});
-				if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
-				const depth = current.depth + 1;
-				if (depth >= 64) throw new ScaffoldError("TARGET", `Listing exceeds the depth one path may carry at ${path}`, {
-					root,
-					path,
-					limit: 64
-				});
-				directories.push(path);
-				pending.push({
-					full: join(current.full, entry.name),
-					path,
-					depth
-				});
-			}
-		});
-		attempt(() => handle.closeSync());
-		if (!walked.success) throw walked.error;
-	}
-	return directories.sort();
+	return {
+		manifest,
+		bytes
+	};
 }
 /**
-* Lists the canon paths a target holds, filtered to a plan's groups.
+* Derives one vendored-host manifest entry from a file in a checkout.
 *
-* @param target - The target directory to inspect.
-* @param groups - The artifact groups the plan covers; a held path whose group
-* is outside them is not listed.
-* @returns Every held canon path as a `/`-separated target-relative path, a
-* directory member expanded to the files beneath it, and `[]` when the target
-* holds none or cannot be resolved.
-* @throws `ScaffoldError('TARGET', …)` when a held canon directory cannot be
-* inventoried; {@link listFiles} states each refusal.
+* @param destination - The target-relative path the file is written to.
+* @param source - The resolved host path the bytes are read from.
+* @returns The entry, or `undefined` when `source` is not a physical file this
+* package will vendor or carries more bytes than one artifact may.
 *
 * @remarks
-* A release stages the canon for reading rather than for a target, so a copy
-* sitting in one is an artifact of a release that vendored it, and reading it
-* here is what lets the deletion verb take it.
+* The one place the declared fields are decided together, because they are
+* readings of one path: {@link pathToStorage} decides where it is stored,
+* the destination is the path it answers for, and {@link matchesExecutablePath}
+* decides whether a target receives it executable.
 *
-* A directory member is read by file, which is what pairs the paths a plan
-* claims inside the canon with their artifacts and leaves only the rest foreign,
-* with no case for a planned file. The plan's own selection gates the reading,
-* the same rule that decides a vendored path's group, so a scoped audit reports
-* nothing outside its groups. A member that cannot resolve inside the target is
-* not held by it.
+* The bit is read from that declaration rather than from the source's mode, so
+* the entry does not depend on where the package was staged. A Windows host
+* reports no executable bit at all, and reading the mode there declared every
+* entry non-executable and shipped consumers hooks they could not run.
 *
 * @example
 * ```ts
-* import { listCanonPaths } from '@orkestrel/scaffold/server'
+* import { readManifestEntry } from '@orkestrel/scaffold/server'
 *
-* listCanonPaths('vacant', ['orchestration']) // []
+* readManifestEntry('.gitignore', '/tmp/checkout/.gitignore')
+* // { storage: 'dotfiles/gitignore', destination: '.gitignore', executable: false, digest: '...' }
 * ```
 */
-function listCanonPaths(target, groups) {
-	const held = [];
-	for (const member of CANON_PATHS) {
-		const full = resolveContainedPath(target, member);
-		if (full === void 0) continue;
-		if (isPhysicalFile(full)) held.push(member);
-		else if (isPhysicalDirectory(full)) for (const name of listFiles(full)) held.push(`${member}/${name}`);
-	}
-	return held.filter((path) => groups.includes(inferGroup(path)));
+function readManifestEntry(destination, source) {
+	const digest = computeFileDigest(source);
+	if (digest === void 0) return void 0;
+	return {
+		storage: pathToStorage(destination),
+		destination,
+		executable: matchesExecutablePath(destination),
+		digest
+	};
 }
 /**
-* Removes every directory one set of deletions emptied.
+* Assembles a whole vendored host from live files and the installed floor.
 *
-* @param target - The directory the deleted paths are relative to.
-* @param removed - The `/`-separated target-relative paths the deletion took.
-* @returns Every removed directory as a target-relative path, in the order they
-* were taken, and `[]` when the target is absent or nothing it holds was
-* emptied.
+* @param files - The host-owned vendored files read from the repository, one
+* row per path.
+* @param floor - The installed host floor, which fixes the membership a fill
+* may draw from and supplies the bytes owned by another surface.
+* @returns The assembled host, or `undefined` when any row produced no answer or
+* names a path the floor does not declare, or when a host-owned path is absent.
 *
 * @remarks
-* A deletion that takes the last file out of a directory leaves the directory
-* standing, and git records no directory, so a swept target keeps the shape of a
-* set it no longer holds while every reading of it reports clean. Only an
-* ancestor of a path this deletion took is a candidate, so nothing the deletion
-* did not reach is inspected, and the target itself is never a candidate.
+* The one place the host-owned all-or-nothing rule is decided, so no verb
+* restates it. The host surface contributes one baseline: a fill carries live
+* bytes for every path that surface writes, or it is nothing. A row that failed,
+* went missing, names an undeclared path, or leaves a host-owned path absent
+* answers `undefined`. Every {@link isFloorPath} destination keeps the installed
+* floor's bytes instead, claimed or not, so a fill carrying no row for one is
+* complete rather than spoiled. One `Host` can therefore carry live host bytes
+* beside floor bytes without mixing baselines within a surface.
 *
-* Candidates are taken deepest first, which is what lets a whole chain go: the
-* directory holding nothing but the emptied directory is empty in turn by the
-* time it is read. Each one is resolved through the containment law and left
-* standing when it escapes the target, is not a physical directory, still holds
-* an entry, or refuses removal, and a directory left standing is absent from the
-* answer.
+* The emitted entries keep the release's own order and its storage and
+* executable declarations, and carry digests recomputed over the bytes the fill
+* actually holds. That is what lets a reader verify the value against itself,
+* and it is why an undeclared path is refused rather than added: membership
+* moves with a release, never with a fetch.
 *
 * @example
 * ```ts
-* import { pruneEmptiedDirectories } from '@orkestrel/scaffold/server'
+* import { filesToHost } from '@orkestrel/scaffold/server'
 *
-* pruneEmptiedDirectories('vacant', ['notes/entry.md']) // []
+* // A floor declaring the host-owned `scripts/codex.sh` path and the canon
+* // `AGENTS.md` destination. The script's live bytes are taken; the canon
+* // destination keeps the floor's.
+* filesToHost([{ path: 'scripts/codex.sh', lookup: 'found', hex: '23212f62696e2f73680a' }], floor)
+* // { manifest: { entries: [ … ], roots: [ … ], digest: '…' },
+* //   bytes: { 'scripts/codex.sh': '23212f62696e2f73680a', 'AGENTS.md': floor.bytes['AGENTS.md'] } }
 * ```
 */
-function pruneEmptiedDirectories(target, removed) {
-	const candidates = /* @__PURE__ */ new Set();
-	for (const path of removed) {
-		let parent = dirname(path);
-		while (parent !== "." && parent !== dirname(parent) && !candidates.has(parent)) {
-			candidates.add(parent);
-			parent = dirname(parent);
-		}
+function filesToHost(files, floor) {
+	const declared = new Set(floor.manifest.entries.map((entry) => entry.destination));
+	const held = /* @__PURE__ */ new Map();
+	for (const file of files) {
+		if (file.lookup !== "found" || !declared.has(file.path)) return void 0;
+		if (!isFloorPath(file.path)) held.set(file.path, file.hex);
 	}
-	const ordered = [...candidates].sort((left, right) => compareValues(right.split("/").length, left.split("/").length) || compareValues(left, right));
-	const pruned = [];
-	for (const candidate of ordered) {
-		const directory = resolveContainedPath(target, candidate);
-		if (directory === void 0 || !isPhysicalDirectory(directory)) continue;
-		const entries = attempt(() => readdirSync(directory));
-		if (!entries.success || entries.value.length > 0) continue;
-		if (attempt(() => rmdirSync(directory)).success) pruned.push(candidate);
+	const entries = [];
+	const bytes = {};
+	for (const entry of floor.manifest.entries) {
+		const hex = isFloorPath(entry.destination) ? floor.bytes[entry.destination] : held.get(entry.destination);
+		if (hex === void 0) return void 0;
+		entries.push({
+			storage: entry.storage,
+			destination: entry.destination,
+			executable: entry.executable,
+			digest: hexToDigest(hex)
+		});
+		bytes[entry.destination] = hex;
 	}
-	return pruned;
+	return {
+		manifest: {
+			entries,
+			roots: floor.manifest.roots,
+			surface: floor.manifest.surface,
+			digest: computeManifestDigest(entries, floor.manifest.roots, floor.manifest.surface)
+		},
+		bytes
+	};
 }
 /**
-* Reads one contained file as its exact bytes in lowercase hexadecimal.
+* Stages the named destinations of a value host into a private root.
 *
-* @param root - The containing host directory.
-* @param path - The portable root-relative file path.
-* @param limit - The most bytes this read accepts; the artifact ceiling by default.
-* @returns The exact bytes as hexadecimal, or `undefined` when the file is
-* absent, is not a physical readable file, is past `limit`, or moved while it
-* was being read.
-* @throws `ScaffoldError('INVALID', …)` when the arguments are off contract or
-* `path` leaves `root`.
+* @param host - The host whose bytes are written, keyed by destination.
+* @param root - The private directory to fill; it must already be a directory
+* this process may write into.
+* @param destinations - The destinations to stage, each declared by `host`.
+* @returns The entry staged for each destination, in the order requested.
+* @throws `ScaffoldError('INVALID', …)` when `root` is not a host path or a
+* storage name leaves it.
+* @throws `ScaffoldError('TARGET', …)` when a destination is one the host does
+* not declare, carries no bytes, or carries bytes that miss its declared digest.
+* @throws `ScaffoldError('WRITE', …)` when a file cannot be written or does not
+* read back as the bytes it was given.
 *
 * @remarks
-* Hexadecimal rather than text, because this is what a byte comparison is stated
-* in everywhere in this package: a plan's artifact, an audit finding, and a
-* snapshot all compare as the same digits. The file's identity and size are
-* measured before and after the read, and one extra byte is requested past the
-* declared size, so a file that grew or was replaced mid-read answers
-* `undefined` rather than half of one file and half of another.
+* Each file lands under the storage name the manifest declares and takes the
+* executable bit that manifest records, so a root filled from a value is the
+* same shape as one staged from a checkout and a reader cannot tell them apart.
+* That is what lets a mutation copy real files with real modes from bytes a
+* caller supplied, instead of degrading them to plain text writes.
+*
+* The bytes are digested before the write and the staged file after it, so a
+* value that disagrees with its own manifest is told apart from a write that
+* did not land.
 *
 * @example
 * ```ts
-* import { readFileHex } from '@orkestrel/scaffold/server'
+* import { stageBytes } from '@orkestrel/scaffold/server'
 *
-* readFileHex('/tmp/project', 'AGENTS.md') // '2320416765…'
+* stageBytes(host, '/tmp/orkestrel-host-a1b2', ['scripts/codex.sh'])
+* // [{ storage: 'scripts/codex.sh', destination: 'scripts/codex.sh', executable: true, digest: '…' }]
 * ```
 */
-function readFileHex(root, path, limit = MAX_ARTIFACT_BYTES) {
-	if (!Number.isSafeInteger(limit) || limit < 0 || limit > MAX_ARTIFACT_BYTES) throw new ScaffoldError("INVALID", `Byte limit is outside the artifact ceiling at ${path}`, {
-		root,
-		path,
-		limit
-	});
-	const full = resolveContainedPath(root, path);
-	if (full === void 0) throw new ScaffoldError("INVALID", `Path is off contract or leaves its root at ${path}`, {
-		root,
-		path
-	});
-	if (!isPhysicalFile(full)) return void 0;
-	const opened = attempt(() => openSync(full, "r"));
-	if (!opened.success) return void 0;
-	const handle = opened.value;
-	const read = attempt(() => {
-		const before = fstatSync(handle);
-		if (!before.isFile() || before.nlink !== 1 || before.size > limit) return void 0;
-		const bytes = Buffer.alloc(before.size);
-		let offset = 0;
-		while (offset < bytes.byteLength) {
-			const length = readSync(handle, bytes, offset, bytes.byteLength - offset, offset);
-			if (length === 0) break;
-			offset += length;
-		}
-		const overflow = readSync(handle, Buffer.alloc(1), 0, 1, offset);
-		const after = fstatSync(handle);
-		if (offset !== bytes.byteLength || overflow !== 0 || after.size !== before.size || after.mtimeMs !== before.mtimeMs) return;
-		return bytesToHex(bytes);
-	});
-	attempt(() => closeSync(handle));
-	return read.success ? read.value : void 0;
+function stageBytes(host, root, destinations) {
+	if (!isFilesystemPath(root)) throw new ScaffoldError("INVALID", "Staging host root is not a host path", { host: root });
+	const declared = new Map(host.manifest.entries.map((entry) => [entry.destination, entry]));
+	const staged = [];
+	for (const destination of destinations) {
+		const entry = declared.get(destination);
+		const hex = host.bytes[destination];
+		if (entry === void 0 || hex === void 0) throw new ScaffoldError("TARGET", `The host carries no bytes for ${destination}`, {
+			host: root,
+			destination
+		});
+		if (hexToDigest(hex) !== entry.digest) throw new ScaffoldError("TARGET", `The host bytes for ${destination} miss its digest`, {
+			host: root,
+			destination
+		});
+		const full = resolveContainedPath(root, entry.storage);
+		if (full === void 0) throw new ScaffoldError("INVALID", `Host storage leaves its root at ${entry.storage}`, {
+			host: root,
+			storage: entry.storage
+		});
+		const written = attempt(() => {
+			mkdirSync(dirname(full), { recursive: true });
+			writeFileSync(full, Buffer.from(hex, "hex"), { flag: "wx" });
+			if (entry.executable) chmodSync(full, 493);
+		});
+		if (!written.success) throw new ScaffoldError("WRITE", `Host bytes could not be staged at ${entry.storage}`, {
+			host: root,
+			storage: entry.storage,
+			error: written.error
+		});
+		if (computeFileDigest(full) !== entry.digest) throw new ScaffoldError("WRITE", `Staged host bytes at ${entry.storage} did not read back`, {
+			host: root,
+			storage: entry.storage
+		});
+		staged.push(entry);
+	}
+	return staged;
 }
 /**
-* Reads one contained file as bounded UTF-8 text.
+* Stages a vendored host root from a real checkout.
 *
-* @param root - The containing host directory.
-* @param path - The portable root-relative file path.
-* @param limit - The most bytes this read accepts; the artifact ceiling by default.
-* @returns The decoded text, or `undefined` when {@link readFileHex} answers
-* nothing or the bytes are not valid UTF-8.
-* @throws `ScaffoldError('INVALID', …)` when the arguments are off contract or
-* `path` leaves `root`.
+* @param checkout - The checkout the vendored paths are read from.
+* @param host - The vendored host root to fill; it must be absent or empty.
+* @param options - The inventory selection, establishment switch, and reporting callback.
+* Default: no reporting.
+* @returns One entry per staged file, sorted by storage name.
+* @throws `ScaffoldError('INVALID', …)` when either argument is not a host path
+* or a vendored path leaves the checkout or the host root.
+* @throws `ScaffoldError('TARGET', …)` when the checkout is not a directory, the
+* host root is not vacant, the checkout does not carry every vendored path, two
+* vendored files claim one storage name, a vendored file is not a plain file
+* within the artifact ceiling, published guides are unreadable, a staged
+* collision's owner set is not a subset of its published owner set, the inventory is absent without
+* `establish: true`, or the staged manifest does not read back.
+* @throws `ScaffoldError('WRITE', …)` when a staged file or the manifest cannot
+* be written.
 *
 * @remarks
-* Decoding is strict, so a file carrying an invalid sequence answers `undefined`
-* rather than text carrying replacement characters. That matters because the
-* text is parsed next: a manifest silently repaired into valid JSON by lossy
-* decoding would be trusted.
+* This is the producer half of the vendored host, and it is not the mutation
+* contract `MaterializerInterface` states. That contract owns **target**
+* writes: it materializes a compiled plan into a consumer's workspace, binds
+* every destination to what the caller observed, and rolls a failed commit back.
+* This reads this package's own checkout at build time and fills its own build
+* output. Different direction, different lifetime, no consumer target involved,
+* so they do not overlap and neither one belongs inside the other.
 *
-* @example
-* ```ts
-* import { readFileText } from '@orkestrel/scaffold/server'
+* Staging is plain rather than transactional for the same reason. A
+* `WriteTransaction` exists to hold a directory that already holds work
+* still; a build output holds nothing, is deleted whole before every build, and
+* has no concurrent reader. What replaces it is refusing early and ordering the
+* writes: the whole membership is derived before anything is created, so a
+* membership refusal leaves no host root at all, and `manifest.json` is
+* written last, so a copy or Surface refusal leaves a root every
+* reader treats as a raw checkout and fails loudly on.
 *
-* readFileText('/tmp/project', 'package.json') // '{ "name": "@orkestrel/router", … }'
-* ```
-*/
-function readFileText(root, path, limit = MAX_ARTIFACT_BYTES) {
-	const hex = readFileHex(root, path, limit);
-	if (hex === void 0) return void 0;
-	const decoded = attempt(() => new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(hex, "hex")));
-	return decoded.success ? decoded.value : void 0;
-}
-/**
-* Reads a target's current bytes at the paths a plan claims.
+* A missing vendored path is refused rather than staged around. A partial root
+* is not detectably partial: it fails later, in a consumer's terminal, on
+* whichever path the plan reached first. Refusing here fails the build that
+* produced it, where the maintainer can act, and it names every missing path at
+* once. A directory is the same case — declaring an absent directory as an empty
+* root would create an empty directory in every generated workspace.
 *
-* @param target - The target directory to read.
-* @param paths - The plan-relative paths to probe.
-* @returns One entry per path that is there: a file maps to its exact bytes as
-* hexadecimal and a directory maps to `''`, which records presence with no bytes
-* to compare. An absent path is omitted.
-* @throws `ScaffoldError('INVALID', …)` when `target` is not a host path or
-* `paths` is not a bounded list of plannable paths.
-* @throws `ScaffoldError('TARGET', …)` when a path that is there cannot be read,
-* or when the whole read would retain more bytes than one plan may.
+* The walk covers `HOST_PATHS`, `CANON_PATHS`, and `REFERENCE_PATHS` together.
+* A plan selects the paths a target receives; the installed package also carries
+* the canon and reference files for reading. Every catalog package must have a
+* guide in the discovered membership before the host is written.
+* Copied guides must carry no collision whose name and exact owner set the
+* committed inventory lacks. An absent inventory requires `establish: true`;
+* an inventory without a valid recorded Surface is refused.
+* Everything downstream — the missing-path refusal, the
+* storage collision guard, the sort, the digests, and the root inventory — reads
+* the union, so every staged path follows the same law.
 *
-* @remarks
-* The one door from a real directory into the vocabulary an audit compares in.
-* Absence is omission rather than an empty value, because core reads a missing
-* key as a missing destination and an empty string as a present directory;
-* they are different verdicts. A path that is there but unreadable throws instead
-* of being omitted, because omission would report it as missing and a repair
-* would then overwrite whatever is actually sitting there.
+* The vendoring deny-list applies to what the walk discovers beneath a staged
+* directory, where a maintainer's local credential can legitimately sit, and
+* such a path is skipped. A path a staging list names itself is curated data
+* rather than discovery, so it is staged or the stage is refused.
 *
-* @example
+* @example Vendored data root
 * ```ts
-* import { readSnapshot } from '@orkestrel/scaffold/server'
+* import { stageHost } from '@orkestrel/scaffold/server'
 *
-* readSnapshot('./packages/router', ['package.json', 'guides'])
-* // { 'package.json': '7b226e…', guides: '' }
+* stageHost(process.cwd(), 'dist/host') // one ManifestEntry per file staged
 * ```
 */
-function readSnapshot(target, paths) {
-	if (!isFilesystemPath(target)) throw new ScaffoldError("INVALID", "Snapshot target is not a host path", { target });
-	if (!isCollection(paths) || !paths.every((path) => isPath(path))) throw new ScaffoldError("INVALID", "Snapshot paths are not a bounded list of plannable paths", {
-		target,
-		limit: MAX_COLLECTION_ITEMS
-	});
-	let remaining = MAX_TOTAL_ARTIFACT_BYTES;
-	const snapshot = {};
-	for (const path of paths) {
-		const full = resolveContainedPath(target, path);
-		if (full === void 0) throw new ScaffoldError("INVALID", `Snapshot path leaves its target at ${path}`, {
-			target,
+function stageHost(checkout, host, options) {
+	if (!isFilesystemPath(checkout)) throw new ScaffoldError("INVALID", "Staging checkout is not a host path", { checkout });
+	if (!isFilesystemPath(host)) throw new ScaffoldError("INVALID", "Staging host root is not a host path", { host });
+	const source = resolve(checkout);
+	if (!isPhysicalDirectory(source)) throw new ScaffoldError("TARGET", `Staging checkout is not a physical directory at ${source}`, { checkout: source });
+	if (!isVacant(host)) throw new ScaffoldError("TARGET", `Staging host root is not vacant at ${host}`, { host });
+	const vendored = [];
+	const roots = [];
+	const missing = [];
+	for (const path of [
+		...HOST_PATHS,
+		...CANON_PATHS,
+		...REFERENCE_PATHS
+	]) {
+		const full = resolveContainedPath(source, path);
+		if (full === void 0) throw new ScaffoldError("INVALID", `Vendored path leaves its checkout at ${path}`, {
+			checkout: source,
 			path
 		});
-		const status = attempt(() => lstatSync(full));
-		if (!status.success) {
-			if (matchesMissingPath(status.error)) continue;
-			throw new ScaffoldError("TARGET", `Snapshot path cannot be inspected at ${path}`, {
-				target,
-				path,
-				error: status.error
-			});
+		if (isPhysicalFile(full)) {
+			vendored.push(path);
+			continue;
 		}
-		if (isPhysicalDirectory(full)) {
-			snapshot[path] = "";
+		if (!isPhysicalDirectory(full)) {
+			missing.push(path);
 			continue;
 		}
-		const hex = readFileHex(target, path, Math.min(MAX_ARTIFACT_BYTES, remaining));
-		if (hex === void 0) throw new ScaffoldError("TARGET", `Snapshot path is not a readable file at ${path}`, {
-			target,
-			path,
-			limit: MAX_TOTAL_ARTIFACT_BYTES
+		roots.push(path);
+		for (const nested of listDirectories(full)) {
+			const rooted = `${path}/${nested}`;
+			if (!matchesSensitivePath(rooted)) roots.push(rooted);
+		}
+		for (const name of listFiles(full)) {
+			const destination = `${path}/${name}`;
+			if (!matchesSensitivePath(destination)) vendored.push(destination);
+		}
+	}
+	if (missing.length > 0) throw new ScaffoldError("TARGET", "The checkout does not carry every vendored path", {
+		checkout: source,
+		missing
+	});
+	const catalog = readFileText(source, CATALOG_AGENT_PATH);
+	if (catalog === void 0) throw new ScaffoldError("TARGET", `The checkout carries no catalog at ${CATALOG_AGENT_PATH}`, { checkout: source });
+	const guides = new Set(vendored);
+	for (const table of createMarkdown(catalog).filter(isTableNode)) for (const row of table.rows) {
+		const [cell] = row;
+		if (cell === void 0) continue;
+		const name = cell.map(flattenText).join("").trim();
+		if (!DEPENDENCY_NAME_PATTERN.test(name)) continue;
+		const path = nameToGuide(name);
+		if (!guides.has(path)) throw new ScaffoldError("TARGET", `Catalog package ${name} has no staged guide at ${path}`, {
+			checkout: source,
+			name,
+			path
 		});
-		remaining -= hex.length / 2;
-		snapshot[path] = hex;
 	}
-	return snapshot;
-}
-/**
-* Reads a vendored host's manifest, when it carries one.
-*
-* @param host - The vendored host root to read.
-* @param name - The root-relative manifest path. Default: `manifest.json`.
-* @returns The manifest, or `undefined` when the host carries none.
-* @throws `ScaffoldError('INVALID', …)` when `host` is not a host path.
-* @throws `ScaffoldError('TARGET', …)` when the manifest is there but cannot be
-* read, is not the declared shape, or does not match its own membership.
-*
-* @remarks
-* The failures are held apart deliberately. A host with no manifest is a
-* raw checkout, and a caller reads it by mapping each path one to one. A host
-* with a manifest that does not verify is a staged host that has been edited,
-* and answering `undefined` there would degrade it to that same one-to-one
-* mapping — which is how an edited manifest would get a caller to read files it
-* never declared. So absence answers and corruption throws.
-*
-* Verification here is the manifest's own self-consistency: the digest against
-* the exact membership beside it. Whether that membership matches the files
-* actually stored is a separate question, and it belongs to the reader that
-* walks the host.
-*
-* @example
-* ```ts
-* import { readHostManifest } from '@orkestrel/scaffold/server'
-*
-* readHostManifest('./dist/host') // the manifest, or undefined for a raw root
-* ```
-*/
-function readHostManifest(host, name = MANIFEST_NAME) {
-	if (!isFilesystemPath(host)) throw new ScaffoldError("INVALID", "Host root is not a host path", { host });
-	const full = resolveContainedPath(host, name);
-	if (full === void 0) throw new ScaffoldError("INVALID", `Host manifest leaves its root at ${host}`, { host });
-	const status = attempt(() => lstatSync(full));
-	if (!status.success) {
-		if (matchesMissingPath(status.error)) return void 0;
-		throw new ScaffoldError("TARGET", `Host manifest cannot be inspected at ${full}`, {
-			host,
-			error: status.error
+	const stored = /* @__PURE__ */ new Set([MANIFEST_NAME]);
+	const candidates = [];
+	for (const destination of vendored) {
+		const full = resolveContainedPath(source, destination);
+		if (full === void 0) throw new ScaffoldError("INVALID", `Vendored path leaves its checkout at ${destination}`, {
+			checkout: source,
+			path: destination
 		});
+		const entry = readManifestEntry(destination, full);
+		if (entry === void 0) throw new ScaffoldError("TARGET", `Vendored path is not a plain file within the artifact ceiling at ${destination}`, {
+			checkout: source,
+			path: destination,
+			limit: MAX_ARTIFACT_BYTES
+		});
+		if (stored.has(entry.storage)) throw new ScaffoldError("TARGET", `Two vendored paths claim the storage name ${entry.storage}`, {
+			checkout: source,
+			path: destination,
+			storage: entry.storage
+		});
+		stored.add(entry.storage);
+		candidates.push(entry);
 	}
-	const text = readFileText(host, name, MAX_MANIFEST_BYTES);
-	if (text === void 0) throw new ScaffoldError("TARGET", `Host manifest is not readable text at ${full}`, { host });
-	const manifest = parseJSONAs(text, isHostManifest);
-	if (manifest === void 0) throw new ScaffoldError("TARGET", `Host manifest is malformed at ${full}`, { host });
-	if (manifest.digest !== computeManifestDigest(manifest.entries, manifest.roots)) throw new ScaffoldError("TARGET", `Host manifest membership is corrupted at ${full}`, { host });
-	return manifest;
+	candidates.sort((first, second) => first.storage < second.storage ? -1 : 1);
+	roots.sort();
+	const baseline = resolveContainedPath(source, options?.inventory ?? HOST_INVENTORY_PATH);
+	if (baseline === void 0) throw new ScaffoldError("INVALID", "Surface inventory leaves its checkout", {
+		checkout: source,
+		inventory: options?.inventory
+	});
+	const recorded = readSurfaceBaseline(source, options?.inventory);
+	if (recorded === void 0 && options?.establish !== true) throw new ScaffoldError("TARGET", `Surface inventory is absent at ${baseline}; set establish: true to establish the baseline`, {
+		checkout: source,
+		inventory: baseline
+	});
+	const published = recorded === void 0 ? void 0 : new Map(recorded.map(({ name, owners }) => [name, owners]));
+	const message = published === void 0 ? `Inventory Surface baseline absent at ${baseline}; this stage establishes the baseline` : `Inventory Surface baseline: ${baseline}`;
+	options?.report?.(message);
+	const root = resolve(host);
+	const established = attempt(() => mkdirSync(root, { recursive: true }));
+	if (!established.success || !isPhysicalDirectory(root)) throw new ScaffoldError("WRITE", `Staging host root could not be established at ${root}`, {
+		host: root,
+		...established.success ? {} : { error: established.error }
+	});
+	const entries = [];
+	for (const entry of candidates) {
+		const origin = resolveContainedPath(source, entry.destination);
+		const destination = resolveContainedPath(root, entry.storage);
+		if (origin === void 0 || destination === void 0) throw new ScaffoldError("INVALID", `Vendored path leaves its root at ${entry.destination}`, {
+			checkout: source,
+			host: root,
+			path: entry.destination,
+			storage: entry.storage
+		});
+		const copied = attempt(() => {
+			mkdirSync(dirname(destination), { recursive: true });
+			copyFileSync(origin, destination, constants.COPYFILE_EXCL);
+			if (entry.executable) chmodSync(destination, 493);
+		});
+		if (!copied.success) throw new ScaffoldError("WRITE", `Vendored file could not be staged at ${entry.storage}`, {
+			host: root,
+			storage: entry.storage,
+			error: copied.error
+		});
+		const digest = computeFileDigest(destination);
+		if (digest === void 0) throw new ScaffoldError("WRITE", `Vendored file could not be verified at ${entry.storage}`, {
+			host: root,
+			storage: entry.storage
+		});
+		entries.push({
+			...entry,
+			digest
+		});
+	}
+	const collisions = readSurfaceCollisions(join(root, "guides"));
+	const growth = [];
+	if (published !== void 0) for (const [name, owners] of collisions) {
+		const record = published.get(name);
+		if (!(record !== void 0 && owners.every((owner) => record.includes(owner)))) growth.push(`${name} staged (${owners.join(", ")}), recorded (${record?.join(", ") ?? "absent"})`);
+	}
+	if (growth.length > 0) throw new ScaffoldError("TARGET", `Staged Surface collisions differ from the inventory: ${growth.join("; ")}`, {
+		checkout: source,
+		host: root,
+		baseline,
+		collisions: growth
+	});
+	const surface = [...collisions].map(([name, owners]) => ({
+		name,
+		owners
+	}));
+	const manifest = {
+		entries,
+		roots,
+		surface,
+		digest: computeManifestDigest(entries, roots, surface)
+	};
+	const metadata = resolveContainedPath(root, MANIFEST_NAME);
+	if (metadata === void 0) throw new ScaffoldError("INVALID", `Host manifest leaves its root at ${root}`, { host: root });
+	const written = attempt(() => writeFileSync(metadata, `${JSON.stringify(manifest, null, "	")}\n`, {
+		encoding: "utf8",
+		flag: "wx"
+	}));
+	if (!written.success) throw new ScaffoldError("WRITE", `Host manifest could not be staged at ${metadata}`, {
+		host: root,
+		error: written.error
+	});
+	const verified = readHostManifest(root);
+	if (verified === void 0 || verified.digest !== manifest.digest) throw new ScaffoldError("TARGET", `The staged host manifest does not read back at ${root}`, { host: root });
+	return entries;
 }
 /**
-* Reads the installed vendored host floor as a value.
+* Reads bare Surface names claimed by distinct package guides.
 *
-* @param root - The vendored host root. Default: the installed package's
-* vendored root, resolved from this module's location.
-* @returns The verified manifest and the exact bytes of every declared entry.
-* @throws `ScaffoldError('TARGET', …)` when the root is not a readable physical
-* directory, its manifest is absent or unreadable, the manifest does not verify,
-* or a declared file is unreadable or misses its digest.
+* @param root - The physical directory containing the package guides.
+* @returns Colliding names and their distinct owners, sorted by name and owner.
+* @throws `ScaffoldError('TARGET', …)` when the directory or a guide cannot be read.
+* @throws `ScaffoldError('TARGET', …)` when `@orkestrel/guide` cannot be loaded.
 *
 * @remarks
-* Reads the same default floor the {@link Materializer} uses. Each declared
-* file is addressed through the manifest's storage name and retained under its
-* destination, so the returned value has the same shape as the installed root.
-* When this module executes from TypeScript source, the committed inventory is
-* the manifest and each checkout destination supplies its bytes. The emitted
-* module reads the staged `manifest.json` file and each storage path instead.
+* Reads immediate `.md` files except `README.md` through `createGuide().surface()`.
+* Requires `@orkestrel/guide` in this module's resolution path; Scaffold declares it
+* only for development. Loads it only when called, so importing the server entry
+* requires no guide tooling in a production install.
 *
 * @example
 * ```ts
-* import { readHostFloor } from '@orkestrel/scaffold/server'
+* import { readSurfaceCollisions } from '@orkestrel/scaffold/server'
 *
-* readHostFloor().manifest // the installed floor's verified membership
+* readSurfaceCollisions('./guides').get('Shared') // the guides claiming Shared, if it collides
 * ```
 */
-function readHostFloor(root) {
-	const location = fileURLToPath(import.meta.url);
-	const module = dirname(location);
-	const source = root === void 0 && extname(location) === ".ts";
-	const host = root ?? resolve(module, source ? "../.." : "../../host");
-	if (!isPhysicalDirectory(host)) throw new ScaffoldError("TARGET", `The vendored host root is not readable at ${host}`, { host });
-	const manifest = readHostManifest(host, source ? HOST_INVENTORY_PATH : MANIFEST_NAME);
-	if (manifest === void 0) throw new ScaffoldError("TARGET", `The vendored host carries no manifest at ${host}`, { host });
-	const bytes = {};
-	for (const entry of manifest.entries) {
-		const path = source ? entry.destination : entry.storage;
-		const hex = readFileHex(host, path);
-		if (hex === void 0 || hexToDigest(hex) !== entry.digest) throw new ScaffoldError("TARGET", `The vendored host cannot read the declared file at ${path}`, {
-			host,
-			path,
-			destination: entry.destination
+function readSurfaceCollisions(root) {
+	if (!isPhysicalDirectory(root)) throw new ScaffoldError("TARGET", `Surface guide directory is not readable at ${root}`, { root });
+	const loaded = attempt(() => createRequire(import.meta.url)("@orkestrel/guide"));
+	if (!loaded.success) throw new ScaffoldError("TARGET", "Surface reflection requires the module @orkestrel/guide", {
+		root,
+		error: loaded.error
+	});
+	const guide = loaded.value;
+	const owners = /* @__PURE__ */ new Map();
+	for (const path of listFiles(root)) {
+		if (path.includes("/") || extname(path) !== ".md" || path === "README.md") continue;
+		const text = readFileText(root, path);
+		if (text === void 0) throw new ScaffoldError("TARGET", `Surface guide cannot be read at ${path}`, {
+			root,
+			path
 		});
-		bytes[entry.destination] = hex;
+		for (const symbol of guide.createGuide(text).surface()) {
+			const claimed = owners.get(symbol.name) ?? /* @__PURE__ */ new Set();
+			claimed.add(basename(path, ".md"));
+			owners.set(symbol.name, claimed);
+		}
 	}
-	return {
-		manifest,
-		bytes
-	};
+	const collisions = /* @__PURE__ */ new Map();
+	for (const name of [...owners.keys()].sort()) {
+		const claimed = owners.get(name);
+		if (claimed !== void 0 && claimed.size > 1) collisions.set(name, [...claimed].sort());
+	}
+	return collisions;
 }
 /**
-* Derives one vendored-host manifest entry from a file in a checkout.
-*
-* @param destination - The target-relative path the file is written to.
-* @param source - The resolved host path the bytes are read from.
-* @returns The entry, or `undefined` when `source` is not a physical file this
-* package will vendor or carries more bytes than one artifact may.
-*
-* @remarks
-* The one place the declared fields are decided together, because they are
-* readings of one path: {@link pathToStorage} decides where it is stored,
-* the destination is the path it answers for, and {@link matchesExecutablePath}
-* decides whether a target receives it executable.
+* Reads the Surface collision baseline from a committed inventory.
 *
-* The bit is read from that declaration rather than from the source's mode, so
-* the entry does not depend on where the package was staged. A Windows host
-* reports no executable bit at all, and reading the mode there declared every
-* entry non-executable and shipped consumers hooks they could not run.
+* @param root - The checkout's host path.
+* @param name - The checkout-relative inventory path. Default: `host.json`.
+* @returns The recorded collisions, or `undefined` when the inventory is absent.
+* @throws `ScaffoldError('INVALID', …)` when `root` is not a host path or `name` leaves it.
+* @throws `ScaffoldError('TARGET', …)` when an existing inventory is unreadable,
+* malformed, or inconsistent with its digest.
 *
 * @example
 * ```ts
-* import { readManifestEntry } from '@orkestrel/scaffold/server'
+* import { readSurfaceBaseline } from '@orkestrel/scaffold/server'
 *
-* readManifestEntry('.gitignore', '/tmp/checkout/.gitignore')
-* // { storage: 'dotfiles/gitignore', destination: '.gitignore', executable: false, digest: '...' }
+* readSurfaceBaseline('.') // the recorded collisions, if the inventory exists
 * ```
 */
-function readManifestEntry(destination, source) {
-	const digest = computeFileDigest(source);
-	if (digest === void 0) return void 0;
-	return {
-		storage: pathToStorage(destination),
-		destination,
-		executable: matchesExecutablePath(destination),
-		digest
-	};
+function readSurfaceBaseline(root, name = HOST_INVENTORY_PATH) {
+	return readHostManifest(root, name)?.surface;
 }
 /**
-* Assembles a whole vendored host from live files and the installed floor.
+* Stages the committed inventory of the files a vendored host carries.
 *
-* @param files - The host-owned vendored files read from the repository, one
-* row per path.
-* @param floor - The installed host floor, which fixes the membership a fill
-* may draw from and supplies the bytes owned by another surface.
-* @returns The assembled host, or `undefined` when any row produced no answer or
-* names a path the floor does not declare, or when a host-owned path is absent.
+* @param checkout - The checkout whose vendored paths are inventoried.
+* @param path - The host path where the JSON inventory is written.
+* @returns The validated manifest written to `path`.
+* @throws `ScaffoldError('INVALID', …)` when `path` is not a host path.
+* @throws `ScaffoldError('WRITE', …)` when a temporary host or the inventory
+* cannot be written or removed.
+* @throws `ScaffoldError('TARGET', …)` when the staged inventory does not read
+* back through the manifest validator.
 *
 * @remarks
-* The one place the host-owned all-or-nothing rule is decided, so no verb
-* restates it. The host surface contributes one baseline: a fill carries live
-* bytes for every path that surface writes, or it is nothing. A row that failed,
-* went missing, names an undeclared path, or leaves a host-owned path absent
-* answers `undefined`. Every {@link isFloorPath} destination keeps the installed
-* floor's bytes instead, claimed or not, so a fill carrying no row for one is
-* complete rather than spoiled. One `Host` can therefore carry live host bytes
-* beside floor bytes without mixing baselines within a surface.
-*
-* The emitted entries keep the release's own order and its storage and
-* executable declarations, and carry digests recomputed over the bytes the fill
-* actually holds. That is what lets a reader verify the value against itself,
-* and it is why an undeclared path is refused rather than added: membership
-* moves with a release, never with a fetch.
+* Uses {@link stageHost} as the single vendored-path expansion. The temporary
+* host supplies the same entries, roots, per-file digests, and membership
+* digest as the published host while the requested output remains one JSON
+* file.
 *
 * @example
 * ```ts
-* import { filesToHost } from '@orkestrel/scaffold/server'
+* import { stageInventory } from '@orkestrel/scaffold/server'
 *
-* // A floor declaring the host-owned `scripts/codex.sh` path and the canon
-* // `AGENTS.md` destination. The script's live bytes are taken; the canon
-* // destination keeps the floor's.
-* filesToHost([{ path: 'scripts/codex.sh', lookup: 'found', hex: '23212f62696e2f73680a' }], floor)
-* // { manifest: { entries: [ … ], roots: [ … ], digest: '…' },
-* //   bytes: { 'scripts/codex.sh': '23212f62696e2f73680a', 'AGENTS.md': floor.bytes['AGENTS.md'] } }
+* stageInventory(process.cwd(), 'host.json') // the committed host inventory
 * ```
 */
-function filesToHost(files, floor) {
-	const declared = new Set(floor.manifest.entries.map((entry) => entry.destination));
-	const held = /* @__PURE__ */ new Map();
-	for (const file of files) {
-		if (file.lookup !== "found" || !declared.has(file.path)) return void 0;
-		if (!isFloorPath(file.path)) held.set(file.path, file.hex);
-	}
-	const entries = [];
-	const bytes = {};
-	for (const entry of floor.manifest.entries) {
-		const hex = isFloorPath(entry.destination) ? floor.bytes[entry.destination] : held.get(entry.destination);
-		if (hex === void 0) return void 0;
-		entries.push({
-			storage: entry.storage,
-			destination: entry.destination,
-			executable: entry.executable,
-			digest: hexToDigest(hex)
+function stageInventory(checkout, path = HOST_INVENTORY_PATH) {
+	if (!isFilesystemPath(path)) throw new ScaffoldError("INVALID", "Inventory destination is not a host path", { path });
+	const temporary = attempt(() => mkdtempSync(join(tmpdir(), "orkestrel-scaffold-host-")));
+	if (!temporary.success) throw new ScaffoldError("WRITE", "Inventory staging root could not be established", {
+		path,
+		error: temporary.error
+	});
+	const staged = attempt(() => {
+		stageHost(checkout, temporary.value);
+		const manifest = readHostManifest(temporary.value);
+		if (manifest === void 0) throw new ScaffoldError("TARGET", "The staged inventory carries no manifest", { path });
+		const target = resolve(path);
+		const published = attempt(() => {
+			mkdirSync(dirname(target), { recursive: true });
+			writeFileSync(target, `${JSON.stringify(manifest, null, "	")}\n`, "utf8");
 		});
-		bytes[entry.destination] = hex;
-	}
-	return {
-		manifest: {
-			entries,
-			roots: floor.manifest.roots,
-			digest: computeManifestDigest(entries, floor.manifest.roots)
-		},
-		bytes
-	};
+		if (!published.success) throw new ScaffoldError("WRITE", `Inventory could not be written at ${target}`, {
+			path: target,
+			error: published.error
+		});
+		const text = readFileText(dirname(target), basename(target), MAX_MANIFEST_BYTES);
+		const verified = text === void 0 ? void 0 : parseJSONAs(text, isHostManifest);
+		if (verified === void 0 || verified.digest !== computeManifestDigest(verified.entries, verified.roots, verified.surface)) throw new ScaffoldError("TARGET", `Inventory does not read back at ${target}`, { path: target });
+		return verified;
+	});
+	const removed = attempt(() => rmSync(temporary.value, {
+		recursive: true,
+		force: true
+	}));
+	if (!removed.success) throw new ScaffoldError("WRITE", `Inventory staging root could not be removed`, {
+		path: temporary.value,
+		error: removed.error
+	});
+	if (!staged.success) throw staged.error;
+	return staged.value;
 }
 /**
-* Stages the named destinations of a value host into a private root.
+* Captures one directory's physical identity.
 *
-* @param host - The host whose bytes are written, keyed by destination.
-* @param root - The private directory to fill; it must already be a directory
-* this process may write into.
-* @param destinations - The destinations to stage, each declared by `host`.
-* @returns The entry staged for each destination, in the order requested.
-* @throws `ScaffoldError('INVALID', …)` when `root` is not a host path or a
-* storage name leaves it.
-* @throws `ScaffoldError('TARGET', …)` when a destination is one the host does
-* not declare, carries no bytes, or carries bytes that miss its declared digest.
-* @throws `ScaffoldError('WRITE', …)` when a file cannot be written or does not
-* read back as the bytes it was given.
+* @param path - The resolved directory path to capture.
+* @returns The anchor, or `undefined` when the path is not a physical directory.
 *
 * @remarks
-* Each file lands under the storage name the manifest declares and takes the
-* executable bit that manifest records, so a root filled from a value is the
-* same shape as one staged from a checkout and a reader cannot tell them apart.
-* That is what lets a mutation copy real files with real modes from bytes a
-* caller supplied, instead of degrading them to plain text writes.
-*
-* The bytes are digested before the write and the staged file after it, so a
-* value that disagrees with its own manifest is told apart from a write that
-* did not land.
+* Device and inode rather than the path, because the path is the thing that can
+* be swapped underneath a write. An anchor captured before a mutation and
+* checked again after it proves the directory written into sits where the
+* inspected one sat, not that it is the one that was inspected.
 *
 * @example
 * ```ts
-* import { stageBytes } from '@orkestrel/scaffold/server'
+* import { readAnchor } from '@orkestrel/scaffold/server'
 *
-* stageBytes(host, '/tmp/orkestrel-host-a1b2', ['scripts/codex.sh'])
-* // [{ storage: 'scripts/codex.sh', destination: 'scripts/codex.sh', executable: true, digest: '…' }]
+* readAnchor('/tmp/project') // { path: '/tmp/project', device: 1, inode: 2 }
 * ```
 */
-function stageBytes(host, root, destinations) {
-	if (!isFilesystemPath(root)) throw new ScaffoldError("INVALID", "Staging host root is not a host path", { host: root });
-	const declared = new Map(host.manifest.entries.map((entry) => [entry.destination, entry]));
-	const staged = [];
-	for (const destination of destinations) {
-		const entry = declared.get(destination);
-		const hex = host.bytes[destination];
-		if (entry === void 0 || hex === void 0) throw new ScaffoldError("TARGET", `The host carries no bytes for ${destination}`, {
-			host: root,
-			destination
-		});
-		if (hexToDigest(hex) !== entry.digest) throw new ScaffoldError("TARGET", `The host bytes for ${destination} miss its digest`, {
-			host: root,
-			destination
-		});
-		const full = resolveContainedPath(root, entry.storage);
-		if (full === void 0) throw new ScaffoldError("INVALID", `Host storage leaves its root at ${entry.storage}`, {
-			host: root,
-			storage: entry.storage
-		});
-		const written = attempt(() => {
-			mkdirSync(dirname(full), { recursive: true });
-			writeFileSync(full, Buffer.from(hex, "hex"), { flag: "wx" });
-			if (entry.executable) chmodSync(full, 493);
-		});
-		if (!written.success) throw new ScaffoldError("WRITE", `Host bytes could not be staged at ${entry.storage}`, {
-			host: root,
-			storage: entry.storage,
-			error: written.error
-		});
-		if (computeFileDigest(full) !== entry.digest) throw new ScaffoldError("WRITE", `Staged host bytes at ${entry.storage} did not read back`, {
-			host: root,
-			storage: entry.storage
-		});
-		staged.push(entry);
-	}
-	return staged;
+function readAnchor(path) {
+	const status = attempt(() => lstatSync(path));
+	if (!status.success || !status.value.isDirectory() || status.value.isSymbolicLink()) return;
+	return {
+		path,
+		device: status.value.dev,
+		inode: status.value.ino
+	};
 }
 /**
-* Stages a vendored host root from a real checkout.
+* Tests whether a captured directory is still the same directory.
 *
-* @param checkout - The checkout the vendored paths are read from.
-* @param host - The vendored host root to fill; it must be absent or empty.
-* @returns One entry per staged file, sorted by storage name.
-* @throws `ScaffoldError('INVALID', …)` when either argument is not a host path
-* or a vendored path leaves the checkout or the host root.
-* @throws `ScaffoldError('TARGET', …)` when the checkout is not a directory, the
-* host root is not vacant, the checkout does not carry every vendored path, two
-* vendored files claim one storage name, a vendored file is not a plain file
-* within the artifact ceiling, or the staged manifest does not read back.
-* @throws `ScaffoldError('WRITE', …)` when a staged file or the manifest cannot
-* be written.
+* @param anchor - The identity captured earlier.
+* @returns True if the path still holds a physical directory of that exact device and
+* inode; false otherwise.
 *
 * @remarks
-* This is the producer half of the vendored host, and it is not the mutation
-* contract `MaterializerInterface` states. That contract owns **target**
-* writes: it materializes a compiled plan into a consumer's workspace, binds
-* every destination to what the caller observed, and rolls a failed commit back.
-* This reads this package's own checkout at build time and fills its own build
-* output. Different direction, different lifetime, no consumer target involved,
-* so they do not overlap and neither one belongs inside the other.
-*
-* Staging is plain rather than transactional for the same reason. A
-* `WriteTransaction` exists to hold a directory that already holds work
-* still; a build output holds nothing, is deleted whole before every build, and
-* has no concurrent reader. What replaces it is refusing early and ordering the
-* writes: the whole membership is derived before anything is created, so a
-* checkout this refuses leaves no host root at all, and `manifest.json` is
-* written last, so a stage that failed part way through leaves a root every
-* reader treats as a raw checkout and fails loudly on.
-*
-* A missing vendored path is refused rather than staged around. A partial root
-* is not detectably partial: it fails later, in a consumer's terminal, on
-* whichever path the plan reached first. Refusing here fails the build that
-* produced it, where the maintainer can act, and it names every missing path at
-* once. A directory is the same case — declaring an absent directory as an empty
-* root would create an empty directory in every generated workspace.
-*
-* The walk covers `HOST_PATHS` and `CANON_PATHS` together, because a release
-* ships both: a target receives the first set, and reads the second one out of
-* the installed package. Everything downstream — the missing-path refusal, the
-* storage collision guard, the sort, the digests, and the root inventory — reads
-* the union, so a canon path is staged under exactly the law a vendored one is.
-*
-* The vendoring deny-list applies to what the walk discovers beneath a staged
-* directory, where a maintainer's local credential can legitimately sit, and
-* such a path is skipped. A path either list names itself is curated data
-* rather than discovery, so it is staged or the stage is refused.
+* This binds location rather than history. `true` means the path still resolves
+* to the same physical directory on the same device, so the next write lands
+* where the last one did. A path holding nothing, a file, or a symlink
+* answers `false`; a directory swapped in by `rename` also answers `false`
+* because the replacement carries its own inode. A directory deleted and made
+* again under the same name can receive the old inode back and answers `true`,
+* which nothing here detects.
 *
-* @example Vendored data root
+* @example
 * ```ts
-* import { stageHost } from '@orkestrel/scaffold/server'
+* import { matchesAnchor, readAnchor } from '@orkestrel/scaffold/server'
 *
-* stageHost(process.cwd(), 'dist/host') // one ManifestEntry per file staged
+* const anchor = readAnchor('/tmp/project')
+* anchor !== undefined && matchesAnchor(anchor) // true while it is untouched
 * ```
 */
-function stageHost(checkout, host) {
-	if (!isFilesystemPath(checkout)) throw new ScaffoldError("INVALID", "Staging checkout is not a host path", { checkout });
-	if (!isFilesystemPath(host)) throw new ScaffoldError("INVALID", "Staging host root is not a host path", { host });
-	const source = resolve(checkout);
-	if (!isPhysicalDirectory(source)) throw new ScaffoldError("TARGET", `Staging checkout is not a physical directory at ${source}`, { checkout: source });
-	if (!isVacant(host)) throw new ScaffoldError("TARGET", `Staging host root is not vacant at ${host}`, { host });
-	const vendored = [];
-	const roots = [];
-	const missing = [];
-	for (const path of [...HOST_PATHS, ...CANON_PATHS]) {
-		const full = resolveContainedPath(source, path);
-		if (full === void 0) throw new ScaffoldError("INVALID", `Vendored path leaves its checkout at ${path}`, {
-			checkout: source,
-			path
-		});
-		if (isPhysicalFile(full)) {
-			vendored.push(path);
-			continue;
-		}
-		if (!isPhysicalDirectory(full)) {
-			missing.push(path);
-			continue;
-		}
-		roots.push(path);
-		for (const nested of listDirectories(full)) {
-			const rooted = `${path}/${nested}`;
-			if (!matchesSensitivePath(rooted)) roots.push(rooted);
-		}
-		for (const name of listFiles(full)) {
-			const destination = `${path}/${name}`;
-			if (!matchesSensitivePath(destination)) vendored.push(destination);
-		}
-	}
-	if (missing.length > 0) throw new ScaffoldError("TARGET", "The checkout does not carry every vendored path", {
-		checkout: source,
-		missing
-	});
-	const stored = /* @__PURE__ */ new Set([MANIFEST_NAME]);
-	const candidates = [];
-	for (const destination of vendored) {
-		const full = resolveContainedPath(source, destination);
-		if (full === void 0) throw new ScaffoldError("INVALID", `Vendored path leaves its checkout at ${destination}`, {
-			checkout: source,
-			path: destination
-		});
-		const entry = readManifestEntry(destination, full);
-		if (entry === void 0) throw new ScaffoldError("TARGET", `Vendored path is not a plain file within the artifact ceiling at ${destination}`, {
-			checkout: source,
-			path: destination,
-			limit: MAX_ARTIFACT_BYTES
-		});
-		if (stored.has(entry.storage)) throw new ScaffoldError("TARGET", `Two vendored paths claim the storage name ${entry.storage}`, {
-			checkout: source,
-			path: destination,
-			storage: entry.storage
-		});
-		stored.add(entry.storage);
-		candidates.push(entry);
-	}
-	candidates.sort((first, second) => first.storage < second.storage ? -1 : 1);
-	roots.sort();
-	const root = resolve(host);
-	const established = attempt(() => mkdirSync(root, { recursive: true }));
-	if (!established.success || !isPhysicalDirectory(root)) throw new ScaffoldError("WRITE", `Staging host root could not be established at ${root}`, {
-		host: root,
-		...established.success ? {} : { error: established.error }
-	});
-	const entries = [];
-	for (const entry of candidates) {
-		const origin = resolveContainedPath(source, entry.destination);
-		const destination = resolveContainedPath(root, entry.storage);
-		if (origin === void 0 || destination === void 0) throw new ScaffoldError("INVALID", `Vendored path leaves its root at ${entry.destination}`, {
-			checkout: source,
-			host: root,
-			path: entry.destination,
-			storage: entry.storage
-		});
-		const copied = attempt(() => {
-			mkdirSync(dirname(destination), { recursive: true });
-			copyFileSync(origin, destination, constants.COPYFILE_EXCL);
-			if (entry.executable) chmodSync(destination, 493);
-		});
-		if (!copied.success) throw new ScaffoldError("WRITE", `Vendored file could not be staged at ${entry.storage}`, {
-			host: root,
-			storage: entry.storage,
-			error: copied.error
-		});
-		const digest = computeFileDigest(destination);
-		if (digest === void 0) throw new ScaffoldError("WRITE", `Vendored file could not be verified at ${entry.storage}`, {
-			host: root,
-			storage: entry.storage
-		});
-		entries.push({
-			...entry,
-			digest
-		});
-	}
-	const manifest = {
-		entries,
-		roots,
-		digest: computeManifestDigest(entries, roots)
-	};
-	const metadata = resolveContainedPath(root, MANIFEST_NAME);
-	if (metadata === void 0) throw new ScaffoldError("INVALID", `Host manifest leaves its root at ${root}`, { host: root });
-	const published = attempt(() => writeFileSync(metadata, `${JSON.stringify(manifest, null, "	")}\n`, {
-		encoding: "utf8",
-		flag: "wx"
-	}));
-	if (!published.success) throw new ScaffoldError("WRITE", `Host manifest could not be staged at ${metadata}`, {
-		host: root,
-		error: published.error
-	});
-	const verified = readHostManifest(root);
-	if (verified === void 0 || verified.digest !== manifest.digest) throw new ScaffoldError("TARGET", `The staged host manifest does not read back at ${root}`, { host: root });
-	return entries;
+function matchesAnchor(anchor) {
+	const current = readAnchor(anchor.path);
+	return current !== void 0 && current.device === anchor.device && current.inode === anchor.inode;
 }
 /**
-* Stages the committed inventory of the files a vendored host carries.
+* Captures what one destination holds before a write.
 *
-* @param checkout - The checkout whose vendored paths are inventoried.
-* @param path - The host path where the JSON inventory is written.
-* @returns The validated manifest written to `path`.
-* @throws `ScaffoldError('INVALID', …)` when `path` is not a host path.
-* @throws `ScaffoldError('WRITE', …)` when a temporary host or the inventory
-* cannot be written or removed.
-* @throws `ScaffoldError('TARGET', …)` when the staged inventory does not read
-* back through the manifest validator.
+* @param path - The resolved destination path to capture.
+* @returns The expectation, or `undefined` when the destination is a link or a
+* shape this package will not write over.
 *
 * @remarks
-* Uses {@link stageHost} as the single vendored-path expansion. The temporary
-* host supplies the same entries, roots, per-file digests, and membership
-* digest as the published host while the requested output remains one JSON
-* file.
+* Absence is a captured state rather than a failure, because most writes expect
+* exactly that. Each shape carries only the facts it supplies: a directory
+* carries its identity, a file carries its identity, size, and bytes, and an
+* absent destination carries nothing at all. A file past the artifact ceiling
+* carries no digest and is bound by its identity, size, and modification time
+* alone, which is the strongest honest claim about bytes nobody read.
 *
 * @example
 * ```ts
-* import { stageInventory } from '@orkestrel/scaffold/server'
+* import { readExpectation } from '@orkestrel/scaffold/server'
 *
-* stageInventory(process.cwd(), 'host.json') // the committed host inventory
+* readExpectation('/tmp/project/absent.md') // { path: …, shape: 'absent' }
 * ```
 */
-function stageInventory(checkout, path) {
-	if (!isFilesystemPath(path)) throw new ScaffoldError("INVALID", "Inventory destination is not a host path", { path });
-	const temporary = attempt(() => mkdtempSync(join(tmpdir(), "orkestrel-scaffold-host-")));
-	if (!temporary.success) throw new ScaffoldError("WRITE", "Inventory staging root could not be established", {
-		path,
-		error: temporary.error
-	});
-	const staged = attempt(() => {
-		stageHost(checkout, temporary.value);
-		const manifest = readHostManifest(temporary.value);
-		if (manifest === void 0) throw new ScaffoldError("TARGET", "The staged inventory carries no manifest", { path });
-		const target = resolve(path);
-		const published = attempt(() => {
-			mkdirSync(dirname(target), { recursive: true });
-			writeFileSync(target, `${JSON.stringify(manifest, null, "	")}\n`, "utf8");
-		});
-		if (!published.success) throw new ScaffoldError("WRITE", `Inventory could not be written at ${target}`, {
-			path: target,
-			error: published.error
-		});
-		const text = readFileText(dirname(target), basename(target), MAX_MANIFEST_BYTES);
-		const verified = text === void 0 ? void 0 : parseJSONAs(text, isHostManifest);
-		if (verified === void 0 || verified.digest !== computeManifestDigest(verified.entries, verified.roots)) throw new ScaffoldError("TARGET", `Inventory does not read back at ${target}`, { path: target });
-		return verified;
-	});
-	const removed = attempt(() => rmSync(temporary.value, {
-		recursive: true,
-		force: true
-	}));
-	if (!removed.success) throw new ScaffoldError("WRITE", `Inventory staging root could not be removed`, {
-		path: temporary.value,
-		error: removed.error
+function readExpectation(path) {
+	const status = attempt(() => lstatSync(path));
+	if (!status.success) return matchesMissingPath(status.error) ? {
+		path,
+		shape: "absent"
+	} : void 0;
+	const stats = status.value;
+	if (stats.isSymbolicLink()) return void 0;
+	if (stats.isDirectory()) return {
+		path,
+		shape: "directory",
+		device: stats.dev,
+		inode: stats.ino,
+		modified: stats.mtimeMs
+	};
+	if (!stats.isFile() || stats.nlink !== 1) return void 0;
+	const digest = computeFileDigest(path);
+	return {
+		path,
+		shape: "file",
+		device: stats.dev,
+		inode: stats.ino,
+		modified: stats.mtimeMs,
+		size: stats.size,
+		...digest === void 0 ? {} : { digest }
+	};
+}
+/**
+* Tests whether a destination still holds what was captured of it.
+*
+* @param expectation - The state captured earlier.
+* @returns True if re-reading the destination produces that same state; false otherwise.
+*
+* @remarks
+* Compared field for field against a fresh {@link readExpectation}, so an
+* expectation recorded without a digest matches only a destination that still
+* has no digest to give. That is what keeps the comparison honest in both
+* directions: nothing is treated as satisfied because it was never measured.
+*
+* @example
+* ```ts
+* import { matchesExpectation, readExpectation } from '@orkestrel/scaffold/server'
+*
+* const expectation = readExpectation('/tmp/project/AGENTS.md')
+* expectation !== undefined && matchesExpectation(expectation) // true while untouched
+* ```
+*/
+function matchesExpectation(expectation) {
+	const current = readExpectation(expectation.path);
+	if (current === void 0) return false;
+	return current.shape === expectation.shape && current.device === expectation.device && current.inode === expectation.inode && current.modified === expectation.modified && current.size === expectation.size && current.digest === expectation.digest;
+}
+/**
+* Tests whether a destination still matches the narrower state a caller observed.
+*
+* @param precondition - The caller-observed state the write is held to.
+* @returns True if the destination is absent as stated, or holds a physical file whose
+* bytes digest to the stated value; false otherwise.
+*
+* @remarks
+* Narrower than {@link matchesExpectation} on purpose. A caller observed bytes,
+* not inodes and timestamps, so binding a write to a device identity it never
+* saw would refuse writes that are perfectly safe — a file rewritten to
+* identical bytes by an editor is still the file the caller read. A precondition
+* that states no digest claims presence only.
+*
+* @example
+* ```ts
+* import { matchesPrecondition } from '@orkestrel/scaffold/server'
+*
+* matchesPrecondition({ path: '/tmp/project/new.md', shape: 'absent' }) // true while absent
+* ```
+*/
+function matchesPrecondition(precondition) {
+	const status = attempt(() => lstatSync(precondition.path));
+	if (!status.success) return precondition.shape === "absent" && matchesMissingPath(status.error);
+	if (precondition.shape !== "file" || !isPhysicalFile(precondition.path)) return false;
+	if (precondition.digest === void 0) return true;
+	return computeFileDigest(precondition.path) === precondition.digest;
+}
+//#endregion
+//#region src/server/validators.ts
+/**
+* Narrows a value to a path naming a location on this host.
+*
+* @param value - The candidate host path.
+* @returns True if the value is a bounded absolute or relative path whose every segment
+* is portable across the supported filesystems; false otherwise.
+*
+* @remarks
+* The counterpart to the core path law, not a copy of it. A target directory and
+* the vendored host root are locations on the machine rather than paths inside a
+* workspace, so a drive prefix, a UNC share, and a backslash separator are all
+* admitted here and `..` is a legitimate way to name a sibling directory.
+* Containment is still enforced, but by the core law over the artifact paths
+* written beneath the target, not by this one.
+*
+* What it does refuse is a segment no supported filesystem can hold: an empty
+* one, a reserved Windows device name, a trailing dot or space, a wildcard or
+* redirection character, a colon anywhere but the drive prefix, and a name past
+* the byte ceiling. The character ceiling is read first so an oversized string is
+* refused before it is split.
+*
+* The spellings of an empty segment are answered differently. A trailing
+* separator terminates a directory rather than opening a segment, and every
+* supported filesystem and every Node path API reads `project/` and `project` as
+* one location, so it is admitted. A doubled separator is a genuine empty
+* segment, so `project//src` is refused. Nothing normalizes the argument first —
+* every server entry point guards the caller's text and resolves it afterwards —
+* so a directory taken from a shell completion arrives carrying the separator the
+* shell appended and names the directory it appears to name.
+*
+* @example
+* ```ts
+* import { isFilesystemPath } from '@orkestrel/scaffold/server'
+*
+* isFilesystemPath('C:/Users/sample/project') // true
+* isFilesystemPath('../sibling') // true
+* isFilesystemPath('project/') // true
+* isFilesystemPath('project//src') // false
+* isFilesystemPath('project/nul') // false
+* ```
+*/
+function isFilesystemPath(value) {
+	return holds(() => {
+		if (!isString(value) || value.length === 0 || value.length > MAX_PATH_LENGTH) return false;
+		if (CONTROL_CHARACTER_PATTERN.test(value)) return false;
+		const normalized = value.replaceAll("\\", "/");
+		const rooted = normalized.startsWith("//") ? normalized.slice(2) : normalized.startsWith("/") ? normalized.slice(1) : normalized;
+		const segments = (rooted.endsWith("/") ? rooted.slice(0, -1) : rooted).split("/");
+		if (segments.length > 64) return false;
+		for (const [index, segment] of segments.entries()) {
+			if (segment === "." || segment === "..") continue;
+			if (index === 0 && DRIVE_PATTERN.test(segment)) continue;
+			if (segment.length === 0) return false;
+			if (INVALID_SEGMENT_CHARACTER_PATTERN.test(segment)) return false;
+			if (segment.endsWith(".") || segment.endsWith(" ")) return false;
+			if (computeBytes(segment) > 255) return false;
+			if (RESERVED_SEGMENT_PATTERN.test(segment)) return false;
+		}
+		return true;
 	});
-	if (!staged.success) throw staged.error;
-	return staged.value;
 }
 /**
-* Captures one directory's physical identity.
+* Narrows a value to one exact SHA-256 digest.
+*
+* @remarks
+* The identity a vendored host manifest and a write precondition are both stated
+* in. Fixed at sixty-four lowercase digits, so the value either is a digest of
+* that algorithm or is refused; there is no shorter or longer accepted form.
+*
+* @example
+* ```ts
+* import { isDigest } from '@orkestrel/scaffold/server'
+*
+* isDigest('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855') // true
+* isDigest('E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855') // false
+* ```
+*/
+var isDigest = stringOf({ pattern: DIGEST_PATTERN });
+/**
+* Narrows a value to a working-tree inventory within the limit one target may report.
+*
+* @param value - The candidate inventory.
+* @returns True if the value is an array of no more than
+* `MAX_INVENTORY_PATHS` items; false otherwise.
+*
+* @remarks
+* Compose this ahead of an element guard exactly as the core collection guard is
+* composed, and for the same reason: the item count is settled before anything
+* walks the items, and a hostile `length` accessor answers `false` rather than
+* escaping as a throw. It exists beside that guard rather than reusing it
+* because they bound different things — one bounds what a caller may hand a
+* public method, this one bounds what a checkout may contain.
+*
+* @example
+* ```ts
+* import { isInventory } from '@orkestrel/scaffold/server'
+*
+* isInventory(['AGENTS.md']) // true
+* isInventory('AGENTS.md') // false
+* ```
+*/
+function isInventory(value) {
+	return holds(() => isArray(value) && value.length <= 1e5);
+}
+/**
+* Narrows a value to a bounded upstream endpoint.
+*
+* @remarks
+* Length only. Which schemes and hosts an endpoint may name is the reader's law,
+* because it builds the request and can report why one was refused, where a
+* guard has only `false` to say.
+*/
+var isEndpoint = stringOf({
+	min: 1,
+	max: MAX_ENDPOINT_LENGTH
+});
+/**
+* Narrows a value to a Git branch the repository endpoint accepts.
+*
+* @remarks
+* A branch reaches the repository URL's path, so the syntax is closed rather than
+* merely bounded and no `..` is admitted anywhere in it.
+*
+* @example
+* ```ts
+* import { isBranch } from '@orkestrel/scaffold/server'
+*
+* isBranch('main') // true
+* isBranch('main/../etc') // false
+* ```
+*/
+var isBranch = stringOf({
+	min: 1,
+	max: 255,
+	pattern: BRANCH_PATTERN
+});
+/**
+* Narrows a value to a per-request timeout in milliseconds.
+*
+* @remarks
+* A whole number of milliseconds, at least one and no more than
+* {@link MAX_UPSTREAM_TIMEOUT}. Zero is refused because a request that may not
+* take any time is a request that cannot succeed.
+*/
+var isTimeout = andOf(isInteger, boundsOf(1, MAX_UPSTREAM_TIMEOUT));
+/**
+* Narrows a value to a bounded list of `@orkestrel` package names.
+*
+* @remarks
+* Composed from the core collection and dependency-name guards rather than
+* restated, so the scope law that keeps a derived guide mirror inside its
+* directory has exactly one home.
+*
+* @example
+* ```ts
+* import { isDependencyNames } from '@orkestrel/scaffold/server'
+*
+* isDependencyNames(['@orkestrel/router']) // true
+* isDependencyNames(['router']) // false
+* ```
+*/
+var isDependencyNames = andOf(isCollection, arrayOf(isDependencyName));
+/**
+* Narrows a value to a bounded list of target-relative paths.
+*
+* @remarks
+* Composed from the core collection and path guards rather than restated, so
+* the containment law that keeps a caller-supplied path inside its target has
+* exactly one home. It bounds what a caller may hand a public method, which is
+* why it is not {@link isInventory}: that one bounds what a checkout may hold.
+*
+* @example
+* ```ts
+* import { isPaths } from '@orkestrel/scaffold/server'
+*
+* isPaths(['AGENTS.md']) // true
+* isPaths(['../secrets']) // false
+* ```
+*/
+var isPaths = andOf(isCollection, arrayOf(isPath));
+/** Narrows a value to a bounded list of declared runtime dependencies. */
+var isDependencies = andOf(isCollection, arrayOf(isDependency));
+/**
+* Narrows a value to one {@link ManifestRegionSet}.
+*
+* @remarks
+* The whole closed record a manifest-writing method accepts, so a caller
+* naming a region the writer does not carry is refused before any byte moves.
+* Each region is bounded by the same collection law its own list guard applies.
+*
+* @example
+* ```ts
+* import { isManifestRegionSet } from '@orkestrel/scaffold/server'
 *
-* @param path - The resolved directory path to capture.
-* @returns The anchor, or `undefined` when the path is not a physical directory.
+* isManifestRegionSet({ pins: { runtime: [], development: [] }, scripts: [] }) // true
+* isManifestRegionSet({ pins: { runtime: [], development: [] } }) // false
+* ```
+*/
+var isManifestRegionSet = recordOf({
+	pins: recordOf({
+		runtime: isDependencies,
+		development: isDependencies
+	}),
+	scripts: andOf(isCollection, arrayOf(isManifestScript))
+});
+/** Narrows a value to a bounded list of fetched guide mirrors. */
+var isMirrors = andOf(isCollection, arrayOf(isMirror));
+/** Narrows a value to a bounded list of fleet catalog rows. */
+var isCatalogEntries = andOf(isCollection, arrayOf(isCatalogEntry));
+/**
+* Narrows a value to one {@link ManifestEntry}.
 *
 * @remarks
-* Device and inode rather than the path, because the path is the thing that can
-* be swapped underneath a write. An anchor captured before a mutation and
-* checked again after it proves the directory written into sits where the
-* inspected one sat, not that it is the one that was inspected.
+* Both paths are measured by the core path law, because a vendored host's
+* storage name and the destination it maps to are each a path inside a
+* workspace. That is what stops a hand-edited manifest from mapping a vendored
+* file to a destination outside the target.
 *
 * @example
 * ```ts
-* import { readAnchor } from '@orkestrel/scaffold/server'
+* import { isManifestEntry } from '@orkestrel/scaffold/server'
 *
-* readAnchor('/tmp/project') // { path: '/tmp/project', device: 1, inode: 2 }
+* isManifestEntry({
+*   storage: 'AGENTS.md',
+*   destination: 'AGENTS.md',
+*   executable: false,
+*   digest: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
+* }) // true
 * ```
 */
-function readAnchor(path) {
-	const status = attempt(() => lstatSync(path));
-	if (!status.success || !status.value.isDirectory() || status.value.isSymbolicLink()) return;
-	return {
-		path,
-		device: status.value.dev,
-		inode: status.value.ino
-	};
-}
+var isManifestEntry = recordOf({
+	storage: isPath,
+	destination: isPath,
+	executable: isBoolean,
+	digest: isDigest
+});
 /**
-* Tests whether a captured directory is still the same directory.
+* Narrows a value to one {@link HostManifest}.
 *
-* @param anchor - The identity captured earlier.
-* @returns True if the path still holds a physical directory of that exact device and
-* inode; false otherwise.
+* @remarks
+* The manifest is read from a directory a caller named, so it is the least
+* trusted value the server face handles and is guarded whole: every entry, every
+* declared root, sorted Surface collisions with distinct sorted owners, and
+* the syntax of the digest that authenticates that membership.
+*/
+var isHostManifest = recordOf({
+	entries: andOf(isCollection, arrayOf(isManifestEntry)),
+	roots: andOf(isCollection, arrayOf(isPath)),
+	surface: whereOf(arrayOf(recordOf({
+		name: stringOf({ min: 1 }),
+		owners: whereOf(arrayOf(stringOf({ min: 1 })), (owners) => isCollection(owners) && owners.length > 1 && owners.every((owner, index) => index === 0 || (owners[index - 1] ?? owner) < owner))
+	})), (surface) => isCollection(surface) && surface.every((collision, index) => index === 0 || (surface[index - 1]?.name ?? collision.name) < collision.name)),
+	digest: isDigest
+});
+/**
+* Narrows a value to one {@link Host}.
 *
 * @remarks
-* This binds location rather than history. `true` means the path still resolves
-* to the same physical directory on the same device, so the next write lands
-* where the last one did. A path holding nothing, a file, or a symlink
-* answers `false`; a directory swapped in by `rename` also answers `false`
-* because the replacement carries its own inode. A directory deleted and made
-* again under the same name can receive the old inode back and answers `true`,
-* which nothing here detects.
+* A whole vendored host handed in as a value is as untrusted as one read from a
+* directory a caller named, so both halves are guarded: the manifest by the same
+* membership law a read root is held to, and the bytes by the core snapshot law,
+* which bounds the fill and reads every key as a path and every value as exact
+* lowercase hexadecimal. The manifest's digest must match its declared entries,
+* roots, and Surface collisions. Whether the fill agrees with the manifest is the
+* reader's question rather than this one's, because a guard has only `false` to
+* say and a mismatch has a path to name.
 *
 * @example
 * ```ts
-* import { matchesAnchor, readAnchor } from '@orkestrel/scaffold/server'
+* import { computeManifestDigest, isHost } from '@orkestrel/scaffold/server'
 *
-* const anchor = readAnchor('/tmp/project')
-* anchor !== undefined && matchesAnchor(anchor) // true while it is untouched
+* const digest = computeManifestDigest([], [], [])
+*
+* isHost({ manifest: { entries: [], roots: [], surface: [], digest }, bytes: {} }) // true
+* isHost({ manifest: { entries: [], roots: [], surface: [], digest } }) // false
 * ```
 */
-function matchesAnchor(anchor) {
-	const current = readAnchor(anchor.path);
-	return current !== void 0 && current.device === anchor.device && current.inode === anchor.inode;
-}
+var isHost = whereOf(recordOf({
+	manifest: isHostManifest,
+	bytes: isSnapshot
+}), ({ manifest }) => manifest.digest === computeManifestDigest(manifest.entries, manifest.roots, manifest.surface));
 /**
-* Captures what one destination holds before a write.
-*
-* @param path - The resolved destination path to capture.
-* @returns The expectation, or `undefined` when the destination is a link or a
-* shape this package will not write over.
+* Narrows a value to a {@link Worktree}.
 *
 * @remarks
-* Absence is a captured state rather than a failure, because most writes expect
-* exactly that. Each shape carries only the facts it supplies: a directory
-* carries its identity, a file carries its identity, size, and bytes, and an
-* absent destination carries nothing at all. A file past the artifact ceiling
-* carries no digest and is bound by its identity, size, and modification time
-* alone, which is the strongest honest claim about bytes nobody read.
+* Both path lists are target-relative, so both are measured by the core path
+* law: a reported path that is not one this package could have planned is not a
+* path it will delete. The inventory guard bounds the lists, because a checkout
+* is legitimately far larger than any collection a caller hands a method.
 *
 * @example
 * ```ts
-* import { readExpectation } from '@orkestrel/scaffold/server'
+* import { isWorktree } from '@orkestrel/scaffold/server'
 *
-* readExpectation('/tmp/project/absent.md') // { path: …, shape: 'absent' }
+* isWorktree({ tracked: ['AGENTS.md'], dirty: [] }) // true
+* isWorktree({ tracked: ['../secrets'], dirty: [] }) // false
 * ```
 */
-function readExpectation(path) {
-	const status = attempt(() => lstatSync(path));
-	if (!status.success) return matchesMissingPath(status.error) ? {
-		path,
-		shape: "absent"
-	} : void 0;
-	const stats = status.value;
-	if (stats.isSymbolicLink()) return void 0;
-	if (stats.isDirectory()) return {
-		path,
-		shape: "directory",
-		device: stats.dev,
-		inode: stats.ino,
-		modified: stats.mtimeMs
-	};
-	if (!stats.isFile() || stats.nlink !== 1) return void 0;
-	const digest = computeFileDigest(path);
-	return {
-		path,
-		shape: "file",
-		device: stats.dev,
-		inode: stats.ino,
-		modified: stats.mtimeMs,
-		size: stats.size,
-		...digest === void 0 ? {} : { digest }
-	};
-}
+var isWorktree = recordOf({
+	tracked: andOf(isInventory, arrayOf(isPath)),
+	dirty: andOf(isInventory, arrayOf(isPath))
+});
 /**
-* Tests whether a destination still holds what was captured of it.
+* Narrows a value to the materializer's initial listener record.
 *
-* @param expectation - The state captured earlier.
-* @returns True if re-reading the destination produces that same state; false otherwise.
+* @remarks
+* Every event is optional and every declared value is a function. A key outside
+* the materializer's event map is refused, so a listener wired to a misspelled
+* event fails at construction instead of never firing.
+*/
+var isMaterializerHooks = recordOf({
+	write: isFunction,
+	remove: isFunction,
+	finish: isFunction,
+	error: isFunction,
+	destroy: isFunction
+}, true);
+/**
+* Narrows a value to {@link MaterializerOptions}.
 *
 * @remarks
-* Compared field for field against a fresh {@link readExpectation}, so an
-* expectation recorded without a digest matches only a destination that still
-* has no digest to give. That is what keeps the comparison honest in both
-* directions: nothing is treated as satisfied because it was never measured.
+* `host` admits both representations of one vendored root: a directory path and
+* a whole {@link Host} value. They share a key because they are one setting
+* stated two ways rather than two settings, so nothing downstream has to
+* reconcile a pair that could disagree.
 *
 * @example
 * ```ts
-* import { matchesExpectation, readExpectation } from '@orkestrel/scaffold/server'
+* import { isMaterializerOptions } from '@orkestrel/scaffold/server'
 *
-* const expectation = readExpectation('/tmp/project/AGENTS.md')
-* expectation !== undefined && matchesExpectation(expectation) // true while untouched
+* isMaterializerOptions({}) // true
+* isMaterializerOptions({ host: 'dist/host*' }) // false
 * ```
 */
-function matchesExpectation(expectation) {
-	const current = readExpectation(expectation.path);
-	if (current === void 0) return false;
-	return current.shape === expectation.shape && current.device === expectation.device && current.inode === expectation.inode && current.modified === expectation.modified && current.size === expectation.size && current.digest === expectation.digest;
-}
+var isMaterializerOptions = recordOf({
+	host: unionOf(isFilesystemPath, isHost),
+	on: isMaterializerHooks,
+	error: isFunction
+}, true);
 /**
-* Tests whether a destination still matches the narrower state a caller observed.
+* Narrows a value to the upstream reader's initial listener record.
 *
-* @param precondition - The caller-observed state the write is held to.
-* @returns True if the destination is absent as stated, or holds a physical file whose
-* bytes digest to the stated value; false otherwise.
+* @remarks
+* Closed to the reader's own events for the same reason the materializer's
+* record is closed to its own.
+*/
+var isUpstreamHooks = recordOf({
+	release: isFunction,
+	mirror: isFunction,
+	file: isFunction,
+	error: isFunction,
+	destroy: isFunction
+}, true);
+/**
+* Narrows a value to {@link UpstreamOptions}.
 *
 * @remarks
-* Narrower than {@link matchesExpectation} on purpose. A caller observed bytes,
-* not inodes and timestamps, so binding a write to a device identity it never
-* saw would refuse writes that are perfectly safe — a file rewritten to
-* identical bytes by an editor is still the file the caller read. A precondition
-* that states no digest claims presence only.
+* Each grouped endpoint is closed to its own leaves, so a setting written under
+* the wrong entity is refused rather than ignored. Every numeric leaf is a whole
+* number inside a ceiling: an unbounded concurrency, retry count, response
+* limit, or call budget is a way to exhaust the caller, so the ceiling is stated
+* here rather than left to the reader. The byte ceilings are the core
+* artifact and total-artifact limits, because a fetched guide is an artifact and
+* a whole call retains no more than a whole plan.
 *
 * @example
 * ```ts
-* import { matchesPrecondition } from '@orkestrel/scaffold/server'
+* import { isUpstreamOptions } from '@orkestrel/scaffold/server'
 *
-* matchesPrecondition({ path: '/tmp/project/new.md', shape: 'absent' }) // true while absent
+* isUpstreamOptions({ repository: { branch: 'main' }, concurrency: 4 }) // true
+* isUpstreamOptions({ concurrency: 0 }) // false
 * ```
 */
-function matchesPrecondition(precondition) {
-	const status = attempt(() => lstatSync(precondition.path));
-	if (!status.success) return precondition.shape === "absent" && matchesMissingPath(status.error);
-	if (precondition.shape !== "file" || !isPhysicalFile(precondition.path)) return false;
-	if (precondition.digest === void 0) return true;
-	return computeFileDigest(precondition.path) === precondition.digest;
-}
+var isUpstreamOptions = recordOf({
+	repository: recordOf({
+		base: isEndpoint,
+		branch: isBranch,
+		timeout: isTimeout
+	}, true),
+	registry: recordOf({
+		base: isEndpoint,
+		timeout: isTimeout
+	}, true),
+	concurrency: andOf(isInteger, boundsOf(1, 64)),
+	retries: andOf(isInteger, boundsOf(0, 5)),
+	limit: andOf(isInteger, boundsOf(1, MAX_ARTIFACT_BYTES)),
+	budget: andOf(isInteger, boundsOf(1, MAX_TOTAL_ARTIFACT_BYTES)),
+	on: isUpstreamHooks,
+	error: isFunction
+}, true);
 //#endregion
 //#region src/server/WriteTransaction.ts
 /**
@@ -2804,7 +2946,8 @@ var Materializer = class {
 	*
 	* @param plan - The compiled plan to compare.
 	* @param target - The directory to inspect.
-	* @returns Findings for hydrated planned paths and selected foreign candidates.
+	* @returns Findings for hydrated planned paths and selected foreign candidates,
+	* plus non-blocking questions for present foreign mirrors differing from hosted guides.
 	* @throws {@link ScaffoldError} coded `INVALID` when an argument is not the
 	* exact shape, `TARGET` when the host or target cannot be read within its
 	* bounds, and `DESTROYED` after teardown.
@@ -2913,9 +3056,9 @@ var Materializer = class {
 	* the write cannot be staged or committed, and `DESTROYED` after teardown.
 	*
 	* @remarks
-	* A verdict carrying no bytes carries a cause instead, so it is skipped rather
-	* than written: one unreachable package never costs the caller the rest of the
-	* fetch, and it never empties a mirror it could not replace.
+	* A failed or absent upstream guide uses the verified hosted guide only when
+	* the observed target copy was absent. A present copy stays untouched. A guide
+	* unavailable from the host is skipped, retaining the upstream verdict.
 	*/
 	mirror(mirrors, target) {
 		this.#assertAlive();
@@ -2924,23 +3067,33 @@ var Materializer = class {
 		const writes = [];
 		const skipped = [];
 		const preconditions = [];
+		let remaining = MAX_TOTAL_ARTIFACT_BYTES;
 		for (const fetched of accepted) {
-			if (fetched.lookup !== "found" || fetched.observed === contentToHex(fetched.content)) {
+			const hex = fetched.lookup === "found" ? contentToHex(fetched.content) : fetched.observed === void 0 ? this.#reference(fetched.path, remaining) : void 0;
+			if (hex === void 0 || fetched.observed === hex) {
 				skipped.push(fetched.path);
 				continue;
 			}
+			remaining -= hex.length / 2;
+			if (remaining < 0) throw this.#error("TARGET", "The guide mirrors exceed the total artifact byte limit.");
 			const current = readFileHex(directory, fetched.path);
 			if (current !== fetched.observed) throw this.#error("TARGET", `The mirror at ${fetched.path} moved since it was fetched.`, {
 				target: directory,
 				path: fetched.path
 			});
 			preconditions.push(this.#bind(directory, fetched.path, current === void 0));
-			writes.push({
+			writes.push(fetched.lookup === "found" ? {
 				path: fetched.path,
 				group: inferGroup(fetched.path),
 				ownership: "content",
 				origin: "computed",
 				content: fetched.content
+			} : {
+				path: fetched.path,
+				group: "guides",
+				ownership: "content",
+				origin: "host",
+				hex
 			});
 		}
 		return this.#apply(directory, writes, [], skipped, preconditions);
@@ -3088,7 +3241,7 @@ var Materializer = class {
 	}
 	#verify(host) {
 		const { entries, roots } = host.manifest;
-		if (host.manifest.digest !== computeManifestDigest(entries, roots)) throw this.#error("TARGET", "The vendored host manifest does not cover the membership beside it.");
+		if (host.manifest.digest !== computeManifestDigest(entries, roots, host.manifest.surface)) throw this.#error("TARGET", "The vendored host manifest does not cover the membership beside it.");
 		if (this.#entries.size !== entries.length) throw this.#error("TARGET", "The vendored host manifest maps two files to one destination.");
 		if (new Set(entries.map((entry) => entry.storage)).size !== entries.length) throw this.#error("TARGET", "The vendored host manifest maps two destinations to one file.");
 		const held = Object.keys(host.bytes);
@@ -3151,11 +3304,39 @@ var Materializer = class {
 			for (const name of listFiles(directory)) paths.add(`${root}/${name}`);
 		}
 		for (const path of listCanonPaths(target, plan.groups)) paths.add(path);
+		const questions = [];
+		if (plan.groups.includes("guides")) {
+			const directory = resolveContainedPath(target, "guides");
+			let remaining = MAX_TOTAL_ARTIFACT_BYTES;
+			for (const file of directory === void 0 ? [] : listFiles(directory)) {
+				const path = `guides/${file}`;
+				if (file.includes("/") || file === "README.md" || !file.endsWith(".md") || path === nameToGuide(plan.blueprint.name)) continue;
+				const hosted = this.#reference(path, remaining);
+				if (hosted === void 0) continue;
+				remaining -= hosted.length / 2;
+				const present = readFileHex(target, path);
+				if (present !== void 0 && present !== hosted) questions.push({
+					field: "guides",
+					message: `The mirror at ${path} differs from the hosted guide. Run catalog to refresh it.`,
+					blocking: false
+				});
+			}
+		}
 		return {
 			findings: planToFindings(hydrated, readSnapshot(target, [...paths])),
-			questions: []
+			questions
 		};
 	}
+	#reference(path, budget) {
+		const entry = this.#entries.get(path);
+		if (entry !== void 0) {
+			const hex = this.#read(entry, budget);
+			if (hexToDigest(hex) !== entry.digest) throw this.#error("TARGET", `The hosted guide at ${path} misses its declared digest.`, { path });
+			return hex;
+		}
+		if (this.#manifest !== void 0 || this.#root === void 0) return void 0;
+		return readFileHex(this.#root, path, Math.max(0, Math.min(MAX_ARTIFACT_BYTES, budget)));
+	}
 	#roots(plan) {
 		const roots = /* @__PURE__ */ new Set();
 		for (const artifact of plan.artifacts) {
@@ -3970,7 +4151,7 @@ var Upstream = class {
 			lookup: "failed",
 			note: `the vendored inventory at ${url} is not a readable manifest`
 		};
-		if (manifest.digest !== computeManifestDigest(manifest.entries, manifest.roots)) return {
+		if (manifest.digest !== computeManifestDigest(manifest.entries, manifest.roots, manifest.surface)) return {
 			...empty,
 			lookup: "failed",
 			note: `the vendored inventory at ${url} does not match its own membership digest`
@@ -4297,6 +4478,6 @@ var Upstream = class {
 	}
 };
 //#endregion
-export { BRANCH_PATTERN, DEFAULT_BRANCH, DEFAULT_REGISTRY_BASE, DEFAULT_REPOSITORY_BASE, DEFAULT_UPSTREAM_CONCURRENCY, DEFAULT_UPSTREAM_RETRIES, DEFAULT_UPSTREAM_TIMEOUT, DIGEST_PATTERN, DRIVE_PATTERN, INVALID_SEGMENT_CHARACTER_PATTERN, MANIFEST_NAME, MAX_BRANCH_LENGTH, MAX_ENDPOINT_LENGTH, MAX_INVENTORY_PATHS, MAX_PATH_DEPTH, MAX_PATH_SEGMENT_BYTES, MAX_UPSTREAM_CONCURRENCY, MAX_UPSTREAM_RETRIES, MAX_UPSTREAM_TIMEOUT, Materializer, ORKESTREL_SCOPE, PACKUMENT_MEDIA_TYPE, RESERVED_SEGMENT_PATTERN, SCAFFOLD_REPOSITORY, UNREADABLE_VERSION_NOTE, Upstream, WriteTransaction, computeDigest, computeFileDigest, computeManifestDigest, filesToHost, hexToDigest, isBranch, isCatalogEntries, isDependencies, isDependencyNames, isDigest, isEndpoint, isExactCaseFile, isFilesystemPath, isHost, isHostManifest, isInventory, isManifestEntry, isManifestRegionSet, isMaterializerHooks, isMaterializerOptions, isMirrors, isPaths, isPhysicalDirectory, isPhysicalFile, isTimeout, isUpstreamHooks, isUpstreamOptions, isVacant, isWorktree, listCanonPaths, listDirectories, listFiles, matchesAnchor, matchesExecutablePath, matchesExpectation, matchesGitPath, matchesMissingPath, matchesPrecondition, matchesProtectedPath, matchesSensitivePath, pathToStorage, pruneEmptiedDirectories, readAnchor, readExpectation, readFileHex, readFileText, readHostFloor, readHostManifest, readManifestEntry, readSnapshot, resolveContainedPath, resolveRealPath, stageBytes, stageHost, stageInventory };
+export { BRANCH_PATTERN, DEFAULT_BRANCH, DEFAULT_REGISTRY_BASE, DEFAULT_REPOSITORY_BASE, DEFAULT_UPSTREAM_CONCURRENCY, DEFAULT_UPSTREAM_RETRIES, DEFAULT_UPSTREAM_TIMEOUT, DIGEST_PATTERN, DRIVE_PATTERN, INVALID_SEGMENT_CHARACTER_PATTERN, MANIFEST_NAME, MAX_BRANCH_LENGTH, MAX_ENDPOINT_LENGTH, MAX_INVENTORY_PATHS, MAX_PATH_DEPTH, MAX_PATH_SEGMENT_BYTES, MAX_UPSTREAM_CONCURRENCY, MAX_UPSTREAM_RETRIES, MAX_UPSTREAM_TIMEOUT, Materializer, ORKESTREL_SCOPE, PACKUMENT_MEDIA_TYPE, RESERVED_SEGMENT_PATTERN, SCAFFOLD_REPOSITORY, UNREADABLE_VERSION_NOTE, Upstream, WriteTransaction, computeDigest, computeFileDigest, computeManifestDigest, filesToHost, hexToDigest, isBranch, isCatalogEntries, isDependencies, isDependencyNames, isDigest, isEndpoint, isExactCaseFile, isFilesystemPath, isHost, isHostManifest, isInventory, isManifestEntry, isManifestRegionSet, isMaterializerHooks, isMaterializerOptions, isMirrors, isPaths, isPhysicalDirectory, isPhysicalFile, isTimeout, isUpstreamHooks, isUpstreamOptions, isVacant, isWorktree, listCanonPaths, listDirectories, listFiles, matchesAnchor, matchesExecutablePath, matchesExpectation, matchesGitPath, matchesMissingPath, matchesPrecondition, matchesProtectedPath, matchesSensitivePath, pathToStorage, pruneEmptiedDirectories, readAnchor, readExpectation, readFileHex, readFileText, readHostFloor, readHostManifest, readManifestEntry, readSnapshot, readSurfaceBaseline, readSurfaceCollisions, resolveContainedPath, resolveRealPath, stageBytes, stageHost, stageInventory };
 
 //# sourceMappingURL=index.js.map