@rightkit/release 0.3.0 → 0.4.1

package/local-publish.mjs

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-// `right-release publish npm|cargo ... --local`: publish ONE @rightkit npm package or crate from the Mac under
-// Adrian's local-build grant (2026-10-14, committed .rightkit-local-build.json). It does not weaken the
-// publication gate: it runs the unit's own CI tests (ci/gate.config.json, ci/asset-gated.json,
-// scripts/ci/gate.mjs semantics), packs the artifact, writes a schema-1 evidence file with one darwin receipt
-// (hostPolicy "darwin-only"), then calls the EXISTING enforcePublicationGate and the EXISTING publisher
+// `right-release publish npm|cargo ... --local`: publish ONE @rightkit npm package or crate from the Mac (npm and
+// crates) or from Windows (crates only) under Adrian's local-build grant (2026-10-14, committed
+// .rightkit-local-build.json). It does not weaken the publication gate: it runs the unit's own CI tests
+// (ci/gate.config.json, ci/asset-gated.json, scripts/ci/gate.mjs semantics), packs the artifact, writes a
+// schema-1 evidence file with one receipt for the publishing host (hostPolicy "darwin-only" on the Mac,
+// "win32-only" on Windows), then calls the EXISTING enforcePublicationGate and the EXISTING publisher
 // (publishGatedTarball for npm, runCargoPublish for cargo). There is no way to skip a test or the evidence.
 //
 // Batch mode (`cargo --crates a,b,c | --crates-file f --local`): fmt, the secret scan and clippy run ONCE for
@@ -20,15 +21,19 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { runCargoAsync, runCargoSync, spawnCollect } from "./managed-cargo.mjs";
 import { localBuildGranted, LOCAL_BUILD_FILE } from "./execution-policy.mjs";
-import { GATE_SCHEMA, defaultEvidencePath, enforcePublicationGate, publishGatedTarball } from "./publication-gate.mjs";
-import { runCargoPublish, scanCrateForSecrets } from "./publish-cargo.mjs";
+import { GATE_SCHEMA, MAX_CARGO_JOBS, defaultEvidencePath, enforcePublicationGate, publishGatedTarball } from "./publication-gate.mjs";
+import { runCargoPublish, runCargoReadOnly, scanCrateForSecrets } from "./publish-cargo.mjs";
 import { cargoIndexUrl } from "./cargo-registry-readback.mjs";
 import { pathDependencyDirs, readCargoPackage } from "./crate-graph.mjs";
-import { recordPublished, stageSourceVersions } from "./rightkit-sync.mjs";
+import { recordPublished, stageSourceVersions, workspaceFeedOptions } from "./rightkit-sync.mjs";
 import { prepareSwapHelper, SWAP_HELPER_CARGO_ARGS, SWAP_HELPER_PACKAGE } from "./swap-helper-bundle.mjs";
 
 export const LOCAL_OPERATOR = "agent (local-build grant)";
 export const LOCAL_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); Windows covered by the next CI run";
+export const LOCAL_WIN32_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); published from the Windows host, the macOS run is not part of this receipt";
+// The hosts `--local` accepts and the host policy each records in the evidence.
+export const LOCAL_HOST_POLICIES = Object.freeze({ darwin: "darwin-only", win32: "win32-only" });
+const localHostPolicyReason = (platform) => (platform === "win32" ? LOCAL_WIN32_HOST_POLICY_REASON : LOCAL_HOST_POLICY_REASON);
 const STEP_TIMEOUT_MS = 30 * 60 * 1000;
 
 export class LocalPublishError extends Error {
@@ -39,6 +44,11 @@ const refuse = (message) => { throw new LocalPublishError(message); };
 export const DEFAULT_CONCURRENCY = 4;
 const MAX_CONCURRENCY = 8;
 const CRATE_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const JOBS_SUBCOMMANDS = new Set(["test", "clippy", "check", "package"]);
+export function withCargoJobs(args, jobs) {
+  return jobs !== undefined && JOBS_SUBCOMMANDS.has(args[0])
+    ? [args[0], "--jobs", String(jobs), ...args.slice(1)] : args;
+}
 
 const crateList = (text, what) => {
   const names = String(text ?? "").split(",").map((name) => name.trim()).filter(Boolean);
@@ -103,23 +113,37 @@ export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
   const flag = kind === "npm" ? "--package" : "--crate";
   const batchFlags = kind === "cargo" ? ", --crates <a,b,c>, --crates-file <file>, --concurrency <n>, --allow-ignored-units <a,b>" : "";
   let unit; let workspace; let local = false; let allowIgnored = false;
+  let qualifyOnly = false; let bundle; let jobsText;
   let crates; let cratesFile; let concurrency = DEFAULT_CONCURRENCY; let allowIgnoredUnits = [];
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--local") local = true;
     else if (arg === flag) unit = argv[++i];
     else if (arg === "--workspace") workspace = argv[++i];
+    else if (kind === "cargo" && arg === "--qualify-only") qualifyOnly = true;
+    else if (kind === "cargo" && arg === "--bundle") bundle = argv[++i];
     // Same meaning as publish.yml's allow_ignored: this unit may have ignored tests; the count is recorded.
     else if (arg === "--allow-ignored") allowIgnored = true;
     else if (kind === "cargo" && arg === "--crates") crates = crateList(argv[++i], "--crates");
     else if (kind === "cargo" && arg === "--crates-file") cratesFile = argv[++i];
     else if (kind === "cargo" && arg === "--concurrency") concurrency = Number(argv[++i]);
     else if (kind === "cargo" && arg === "--allow-ignored-units") allowIgnoredUnits = crateList(argv[++i], "--allow-ignored-units");
+    else if (kind === "cargo" && arg === "--jobs") jobsText = argv[++i] ?? "";
     else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>${batchFlags}, --workspace <dir>, --allow-ignored, --local)`);
   }
   if (!local) refuse("--local is required");
   if (!Number.isInteger(concurrency) || concurrency < 1 || concurrency > MAX_CONCURRENCY) refuse(`--concurrency must be an integer from 1 to ${MAX_CONCURRENCY}`);
   const workspaceRoot = path.resolve(workspace ?? cwd);
+  if (qualifyOnly && (crates !== undefined || cratesFile !== undefined)) refuse("--qualify-only currently requires one --crate");
+  if (qualifyOnly && !String(bundle ?? "").trim()) refuse("--qualify-only requires --bundle <new-directory>");
+  if (bundle !== undefined && !qualifyOnly) refuse("--bundle requires --qualify-only");
+  const bundleDir = bundle === undefined ? undefined : path.resolve(cwd, bundle);
+  let jobs;
+  if (jobsText !== undefined) {
+    if (!/^[0-9]+$/.test(jobsText) || Number(jobsText) < 1 || Number(jobsText) > MAX_CARGO_JOBS) refuse(`--jobs must be an integer from 1 to ${MAX_CARGO_JOBS}`);
+    if (!qualifyOnly) refuse("--jobs requires --qualify-only");
+    jobs = Number(jobsText);
+  }
   if (kind === "cargo" && (crates !== undefined || cratesFile !== undefined)) {
     if (unit !== undefined) refuse("--crate cannot be combined with --crates or --crates-file");
     if (crates !== undefined && cratesFile !== undefined) refuse("use --crates or --crates-file, not both");
@@ -131,7 +155,7 @@ export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
   }
   if (kind === "npm" && !/^@rightkit\/[a-z0-9-]+$/.test(unit ?? "")) refuse("publish npm --local requires --package @rightkit/<name>");
   if (kind === "cargo" && !CRATE_NAME.test(unit ?? "")) refuse("publish cargo --local requires --crate <name> (or --crates / --crates-file)");
-  return { kind, unit, allowIgnored, allowIgnoredUnits, workspaceRoot, concurrency, batch: undefined };
+  return { kind, unit, allowIgnored, allowIgnoredUnits, workspaceRoot, concurrency, batch: undefined, ...(qualifyOnly ? { qualifyOnly, bundleDir } : {}), ...(jobs === undefined ? {} : { jobs }) };
 }
 
 function defaultGit(args, cwd) {
@@ -212,8 +236,101 @@ export function allFeatureCheckSets(entry = {}) {
   return entry.checkFeatureSets ?? [["--all-features"]];
 }
 
+const CONSUMER_ROW_KEYS = new Set(["manifestPath", "args", "kind", "targets", "locked"]);
+const CONSUMER_KINDS = new Set(["check"]);
+const CONSUMER_MANIFEST = /^ci\/consumers\/(?:[A-Za-z0-9._-]+\/)+Cargo\.toml$/;
+const CONSUMER_TARGET = /^[A-Za-z0-9_]+(?:-[A-Za-z0-9_.]+){2,3}$/;
+// The row owns manifest, lock, target and output format; arguments may only choose features and target kinds.
+// An ALLOWLIST (0.4.1 review A1): any token not listed is refused, so --help/-h/--version (a "passing" no-op),
+// --target-dir, -C/--directory, --color, --timings, -Z and every other Cargo option stay out of a row.
+// Keep in step with scripts/ci/gate.mjs.
+const CONSUMER_ARG_FLAGS = new Set(["--no-default-features", "--all-features", "--lib", "--bins", "--tests", "--examples", "--benches", "--all-targets"]);
+const CONSUMER_FEATURE_FLAGS = new Set(["--features", "-F"]);
+const CONSUMER_FEATURE_LIST = /^[A-Za-z0-9_][A-Za-z0-9_.+/?:,-]*$/;
+const CONSUMER_ARGS_ALLOWED = `--features <list> (or --features=<list>, -F <list>), ${[...CONSUMER_ARG_FLAGS].join(", ")}`;
+
+/**
+ * Validate the `consumerRows` of one crate's ci/gate.config.json entry and return them normalised. A consumer row
+ * checks the owning crate through a SEPARATE Cargo workspace (its own Cargo.lock), run as
+ * `cargo check --manifest-path <manifestPath> --locked [--target <t>] <args>`. Unknown fields are refused.
+ */
+export function consumerRows(unit, entry = {}) {
+  const rows = entry.consumerRows;
+  if (rows === undefined) return [];
+  const where = (index) => `${unit} consumerRows[${index}]`;
+  if (!Array.isArray(rows)) refuse(`${unit}: consumerRows must be an array`);
+  const seen = new Set();
+  return rows.map((row, index) => {
+    if (row === null || typeof row !== "object" || Array.isArray(row)) refuse(`${where(index)} must be an object`);
+    for (const key of Object.keys(row)) if (!CONSUMER_ROW_KEYS.has(key)) refuse(`${where(index)}: unknown field ${JSON.stringify(key)} (allowed: ${[...CONSUMER_ROW_KEYS].join(", ")})`);
+    const manifestPath = row.manifestPath;
+    if (typeof manifestPath !== "string" || !CONSUMER_MANIFEST.test(manifestPath) || manifestPath.split("/").some((part) => part === "." || part === "..")) {
+      refuse(`${where(index)}: manifestPath must be a relative ci/consumers/<name>/Cargo.toml path with forward slashes, got ${JSON.stringify(manifestPath)}`);
+    }
+    const kind = row.kind ?? "check";
+    if (!CONSUMER_KINDS.has(kind)) refuse(`${where(index)}: kind must be one of ${[...CONSUMER_KINDS].join(", ")}, got ${JSON.stringify(kind)}`);
+    if (row.locked !== undefined && row.locked !== true) refuse(`${where(index)}: locked must be true; a consumer row never runs without its lock file`);
+    const args = row.args ?? [];
+    if (!Array.isArray(args) || args.some((arg) => typeof arg !== "string" || arg === "")) refuse(`${where(index)}: args must be an array of non-empty strings`);
+    for (let position = 0; position < args.length; position += 1) {
+      const arg = args[position];
+      if (CONSUMER_ARG_FLAGS.has(arg)) continue;
+      if (CONSUMER_FEATURE_FLAGS.has(arg)) {
+        const list = args[position + 1];
+        if (typeof list !== "string" || !CONSUMER_FEATURE_LIST.test(list)) refuse(`${where(index)}: ${arg} needs a feature list (names separated by commas, not starting with "-"), got ${JSON.stringify(list)}`);
+        position += 1;
+        continue;
+      }
+      if (arg.startsWith("--features=") && CONSUMER_FEATURE_LIST.test(arg.slice("--features=".length))) continue;
+      refuse(`${where(index)}: args may not contain ${JSON.stringify(arg)}; the row sets manifest path, lock, target and output itself, and allows only ${CONSUMER_ARGS_ALLOWED}`);
+    }
+    const targets = row.targets ?? [];
+    if (!Array.isArray(targets) || targets.some((target) => typeof target !== "string" || !CONSUMER_TARGET.test(target))) refuse(`${where(index)}: targets must be an array of target triples`);
+    if (new Set(targets).size !== targets.length) refuse(`${where(index)}: targets lists a triple twice`);
+    const key = JSON.stringify([manifestPath, args, targets]);
+    if (seen.has(key)) refuse(`${where(index)} repeats an earlier row`);
+    seen.add(key);
+    return { manifestPath, kind, args: [...args], targets: [...targets], locked: true };
+  });
+}
+
+/** One Cargo step per target (or one host step when no target is named) for one consumer row. */
+export function consumerRowInvocations(row) {
+  const targets = row.targets.length ? row.targets : [null];
+  return targets.map((target) => ({ command: "cargo", args: [row.kind, "--manifest-path", row.manifestPath, "--locked", ...(target ? ["--target", target] : []), ...row.args], test: false }));
+}
+
+/**
+ * Refuse a consumer row whose manifest or lock is missing from the workspace, is not tracked by git, or resolves
+ * (through a symlink) to anywhere but its own path inside the workspace (fail closed before any command;
+ * 0.4.1 review A5). The clean-tree check covers only the files git sees under the consumer directory, so a
+ * symlinked or ignored file would otherwise be a checked file nobody reviewed.
+ */
+function assertConsumerFiles(workspaceRoot, unit, rows, git = defaultGit) {
+  let realRoot;
+  try { realRoot = fs.realpathSync(workspaceRoot); } catch { refuse(`${unit}: cannot resolve the workspace ${workspaceRoot}`); }
+  for (const row of rows) {
+    for (const file of [row.manifestPath, row.manifestPath.replace(/Cargo\.toml$/, "Cargo.lock")]) {
+      const absolute = path.join(workspaceRoot, file);
+      if (!fs.existsSync(absolute)) refuse(`${unit}: consumer row needs ${file}, which is not in the workspace`);
+      let real;
+      try { real = fs.realpathSync(absolute); } catch { refuse(`${unit}: consumer row file ${file} cannot be resolved`); }
+      if (path.relative(realRoot, real) !== path.normalize(file)) refuse(`${unit}: consumer row file ${file} resolves outside its own path in the workspace (${real}); a symlink is not allowed`);
+      if (git(["ls-files", "--error-unmatch", "--", file], workspaceRoot) === null) refuse(`${unit}: consumer row file ${file} is not tracked by git; commit it first`);
+    }
+  }
+}
+
+/** The directories whose cleanliness a set of consumer rows depends on. */
+const consumerDirs = (rows) => [...new Set(rows.map((row) => path.posix.dirname(row.manifestPath)))];
+
+// The files that decide WHICH steps a publish runs: an uncommitted edit would change the plan the evidence is bound to
+// (0.4.1 review A3). Chosen over reading the HEAD blob so the publisher, the replay and the batch apply one rule:
+// the file on disk must be the committed file, or the publish is refused.
+export const GATE_CONFIG_FILES = Object.freeze(["ci/gate.config.json", "ci/asset-gated.json"]);
+
 /** The CI gate's commands for one unit (scripts/ci/gate.mjs npmGate/rustGate), mirrored exactly. */
-export function localTestPlan({ kind, unit, dir, config, manifest, batch = false }) {
+export function localTestPlan({ kind, unit, dir, config, manifest, batch = false, platform = "darwin" }) {
   if (kind === "npm") {
     if (!manifest?.scripts?.test) refuse(`${unit} has no test script; --local never publishes an untested package`);
     return {
@@ -225,17 +342,24 @@ export function localTestPlan({ kind, unit, dir, config, manifest, batch = false
     };
   }
   const entry = config?.rust?.[unit] ?? {};
-  if (entry.os && !entry.os.includes("macos")) refuse(`${unit} is restricted to ${entry.os.join(", ")} by ci/gate.config.json; it cannot be qualified on this Mac`);
+  // gate.config.json names hosts "macos" and "windows" (scripts/ci/gate.mjs HOST).
+  const gateHost = platform === "win32" ? "windows" : "macos";
+  if (entry.os && !entry.os.includes(gateHost)) refuse(`${unit} is restricted to ${entry.os.join(", ")} by ci/gate.config.json; it cannot be qualified on this ${platform === "win32" ? "Windows host" : "Mac"}`);
   const featureSets = entry.featureSets ?? [[]];
+  // Stream Cargo artifact records to the broker; libtest summaries remain plain text for ResultScanner.
   const steps = [];
   for (const features of featureSets) {
-    steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--show-output"], test: true });
-    if (entry.alsoSerial) steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--test-threads=1", "--show-output"], test: true });
+    steps.push({ command: "cargo", args: ["test", "-p", unit, "--message-format=json-render-diagnostics", ...features, "--no-fail-fast", "--", "--show-output"], test: true });
+    if (entry.alsoSerial) steps.push({ command: "cargo", args: ["test", "-p", unit, "--message-format=json-render-diagnostics", ...features, "--no-fail-fast", "--", "--test-threads=1", "--show-output"], test: true });
   }
   // Batch mode lints the whole batch once (batchClippyInvocations) and records it as a batch receipt.
-  if (!batch) steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--no-deps", "--all-targets", ...featureSets[0], "--", "-D", "warnings"], test: false });
-  for (const features of allFeatureCheckSets(entry)) steps.push({ command: "cargo", args: ["check", "-p", unit, "--all-targets", ...features], test: false });
-  return { id: `rust:${unit}`, featureLabels: featureSets.map((features) => features.join(" ") || "default"), steps };
+  // Every tested feature set is linted (-D warnings), not only the first.
+  if (!batch) for (const features of featureSets) steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"], test: false });
+  for (const features of allFeatureCheckSets(entry)) steps.push({ command: "cargo", args: ["check", "-p", unit, "--message-format=json-render-diagnostics", "--all-targets", ...features], test: false });
+  // Consumer rows (separate Cargo workspaces) gate only this crate: they come from this crate's own entry.
+  const consumers = consumerRows(unit, entry);
+  for (const row of consumers) steps.push(...consumerRowInvocations(row));
+  return { id: `rust:${unit}`, featureLabels: featureSets.map((features) => features.join(" ") || "default"), consumerRows: consumers, steps };
 }
 
 /**
@@ -247,18 +371,23 @@ export function localTestPlan({ kind, unit, dir, config, manifest, batch = false
  * unify extra features into a selected crate and each is linted with exactly the features it was before.
  * Crates with a different RIGHTKIT_REQUIRE_ASSETS (asset-gated) stay apart so the environment is unchanged.
  */
-export function batchClippyInvocations(layer, { featuresOf = () => [], assetGatedOf = () => false } = {}) {
+export function batchClippyInvocations(layer, { featuresOf = () => [], featureSetsOf = (unit) => [featuresOf(unit)], assetGatedOf = () => false } = {}) {
   const groups = new Map();
   for (const unit of layer) {
-    const features = featuresOf(unit) ?? [];
-    const shared = features.length === 0 || (features.length === 1 && features[0] === "--all-features");
-    const key = shared ? JSON.stringify([features, assetGatedOf(unit)]) : `unit:${unit}`;
-    if (!groups.has(key)) groups.set(key, { crates: [], features, assetGated: assetGatedOf(unit) });
-    groups.get(key).crates.push(unit);
+    // Every tested feature set of a crate is linted, in order; identical sets of one crate collapse to one run.
+    const sets = featureSetsOf(unit) ?? [[]];
+    const unique = sets.filter((set, index) => sets.findIndex((other) => JSON.stringify(other ?? []) === JSON.stringify(set ?? [])) === index);
+    for (const set of unique) {
+      const features = set ?? [];
+      const shared = features.length === 0 || (features.length === 1 && features[0] === "--all-features");
+      const key = shared ? JSON.stringify([features, assetGatedOf(unit)]) : `unit:${unit}:${JSON.stringify(features)}`;
+      if (!groups.has(key)) groups.set(key, { crates: [], features, assetGated: assetGatedOf(unit) });
+      groups.get(key).crates.push(unit);
+    }
   }
   return [...groups.values()].map(({ crates, features, assetGated }) => ({
     crates, assetGated,
-    args: ["clippy", ...crates.flatMap((unit) => ["-p", unit]), "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
+    args: ["clippy", ...crates.flatMap((unit) => ["-p", unit]), "--message-format=json-render-diagnostics", "--no-deps", "--all-targets", ...features, "--", "-D", "warnings"],
   }));
 }
 
@@ -273,10 +402,12 @@ function testEnv(deps, isAssetGated) {
   return { ...inherited, RIGHTKIT_REQUIRE_ASSETS: isAssetGated ? "0" : "1", RIGHTKIT_ISOLATED_CHECKOUT: "1", CARGO_TERM_COLOR: "never" };
 }
 
-function assertLocalHost(deps, workspaceRoot) {
+function assertLocalHost(deps, workspaceRoot, kind) {
   const platform = deps.platform ?? process.platform;
   if (!(deps.localBuildGranted ?? localBuildGranted)(workspaceRoot)) refuse(`--local needs the local-build grant: a committed ${LOCAL_BUILD_FILE} (allow "build-test-publish") naming this repository at ${workspaceRoot}`);
-  if (platform !== "darwin") refuse(`--local publishes from the Mac only (host policy: darwin-only); this host is ${platform}`);
+  if (!Object.hasOwn(LOCAL_HOST_POLICIES, platform)) refuse(`--local publishes from the Mac only (host policy: darwin-only) or from Windows (host policy: win32-only); this host is ${platform}`);
+  // The npm path reads the registry token from the macOS Keychain and ships a Developer-ID-signed helper: Mac only.
+  if (kind === "npm" && platform !== "darwin") refuse(`publish npm --local needs the macOS Keychain npm token and runs on the Mac only; Windows publishes crates (publish cargo --local); this host is ${platform}`);
   return platform;
 }
 
@@ -300,7 +431,8 @@ async function publishUnit(parsed, deps, batch) {
   const run = deps.run ?? (batch ? defaultRunAsync : defaultRun);
 
   // 1. Preconditions, fail closed.
-  const platform = assertLocalHost(deps, workspaceRoot);
+  const platform = assertLocalHost(deps, workspaceRoot, kind);
+  if (parsed.qualifyOnly && fs.existsSync(parsed.bundleDir)) refuse(`qualification bundle already exists: ${parsed.bundleDir}`);
   const dir = kind === "npm" ? `packages/${unit.slice("@rightkit/".length)}` : `crates/${unit}`;
   const unitPath = path.join(workspaceRoot, dir);
   if (!fs.existsSync(unitPath)) refuse(`unit directory not found: ${unitPath}`);
@@ -324,18 +456,30 @@ async function publishUnit(parsed, deps, batch) {
     const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
     if (tree !== batch.tree) refuse(`${unit}: HEAD tree ${tree} differs from the batch tree ${batch.tree}`);
   }
-  const dirty = git(["status", "--porcelain", "--", dir], workspaceRoot);
+  const dirty = git(["status", "--porcelain", "--", dir, ...GATE_CONFIG_FILES, ...(parsed.qualifyOnly ? ["Cargo.toml", "Cargo.lock"] : [])], workspaceRoot);
   if (dirty === null) refuse(`cannot read git status for ${dir}`);
-  if (dirty !== "") refuse(`tree is not clean for ${dir}; commit first:\n${dirty}`);
+  if (dirty !== "") refuse(`tree is not clean for ${dir} or the gate config (${GATE_CONFIG_FILES.join(", ")}); commit first:\n${dirty}`);
   if (await (deps.registryHas ?? defaultRegistryHas)({ kind, name: unit, version })) refuse(`${unit}@${version} is already on the ${kind === "npm" ? "npm" : "crates.io"} registry; bump the version`);
-  log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, darwin-only policy)`);
+  log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, ${LOCAL_HOST_POLICIES[platform]} policy)`);
 
   // 2. The unit's own tests, exactly as the CI gate defines them.
   const gateConfig = readJson(path.join(workspaceRoot, "ci", "gate.config.json")) ?? {};
   const assetGated = readJson(path.join(workspaceRoot, "ci", "asset-gated.json")) ?? {};
   const gatedSection = assetGated[kind === "npm" ? "npm" : "crates"] ?? {};
   const isAssetGated = Object.hasOwn(gatedSection, unit);
-  const plan = localTestPlan({ kind, unit, dir, config: gateConfig, manifest, batch: Boolean(batch) });
+  const plan = localTestPlan({ kind, unit, dir, config: gateConfig, manifest, batch: Boolean(batch), platform });
+  if (plan.consumerRows?.length) {
+    // The consumer workspaces are part of the qualified commit: present, and unmodified like the unit itself.
+    assertConsumerFiles(workspaceRoot, unit, plan.consumerRows, git);
+    const consumerDirty = git(["status", "--porcelain", "--", ...consumerDirs(plan.consumerRows)], workspaceRoot);
+    if (consumerDirty === null) refuse(`cannot read git status for the consumer rows of ${unit}`);
+    if (consumerDirty !== "") refuse(`tree is not clean for the consumer rows of ${unit}; commit first:\n${consumerDirty}`);
+  }
+  if (parsed.qualifyOnly) {
+    const violations = (deps.scanSecrets ?? scanCrateForSecrets)(unitPath);
+    if (violations.length) refuse(`qualification secret scan rejected: ${violations.join(", ")}`);
+    plan.steps.unshift({ command: "cargo", args: ["fmt", "-p", unit, "--check"], test: false });
+  }
   const modules = await (deps.loadWorkspaceModules ?? defaultLoadWorkspaceModules)(workspaceRoot);
   const { ResultScanner, TEST_COMMAND, judgeUnit } = modules.results;
   const env = testEnv(deps, isAssetGated);
@@ -343,15 +487,15 @@ async function publishUnit(parsed, deps, batch) {
   // written reason in ci/gate.config.json (rust.<crate>.allowIgnored). The count stays in the evidence.
   const configReason = kind === "cargo" && typeof gateConfig?.rust?.[unit]?.allowIgnored === "string" ? gateConfig.rust[unit].allowIgnored.trim() : "";
   const ignoredAllowed = Boolean(allowIgnored || parsed.allowIgnoredUnits?.includes(unit) || configReason);
-  const steps = [];
+  const steps = parsed.qualifyOnly ? [{ command: `scanCrateForSecrets ${dir}`, ok: true }] : [];
   for (const step of plan.steps) {
     const commandText = `${step.command} ${step.args.join(" ")}`;
     log(`[right-release] ${plan.id}: ${commandText}`);
-    const result = await run(step.command, step.args, { cwd: workspaceRoot, env });
+    const result = await run(step.command, step.command === "cargo" ? withCargoJobs(step.args, parsed.jobs) : step.args, { cwd: workspaceRoot, env });
     const row = { command: commandText, ok: false, isTest: step.test && TEST_COMMAND.test(commandText) };
     if (result.error || result.status !== 0) {
       steps.push(row);
-      refuse(`${plan.id} step failed (${result.error?.message ?? `exit ${result.status}`}): ${commandText}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+      refuse(`${plan.id} step failed (${result.error?.message ?? `exit ${result.status}`}): ${commandText}\nstdout:\n${result.stdout ?? ""}\nstderr:\n${result.stderr ?? ""}`);
     }
     row.ok = true;
     if (row.isTest) {
@@ -391,16 +535,23 @@ async function publishUnit(parsed, deps, batch) {
       const checked = modules.checkNpmTarball({ file: artifactFile, name: unit, version, dir, spawn: deps.spawnSync ?? spawnSync });
       if (checked.problems.length) refuse(`${unit}: packed tarball refused:\n  - ${checked.problems.join("\n  - ")}`);
     } else {
-      // The archive is hashed here; Cargo's verify build runs once, in the real `cargo publish` (before any
-      // upload), instead of here and again in a registry dry-run (see runCargoPublish verifyOnPublish).
-      packCommands.push(`cargo package --locked --no-verify -p ${unit}`);
-      const packed = await run("cargo", ["package", "--locked", "--no-verify", "-p", unit], { cwd: workspaceRoot, env });
+      // A combined publish verifies once in `cargo publish`; detached qualification verifies here before
+      // its evidence leaves this host, so the publishing host can reuse that exact archive's proof.
+      const packageArgs = ["package", "--locked", ...(parsed.qualifyOnly ? [] : ["--no-verify"]), "-p", unit];
+      packCommands.push(`cargo ${packageArgs.join(" ")}`);
+      const packed = await run("cargo", withCargoJobs(packageArgs, parsed.jobs), { cwd: workspaceRoot, env });
       if (packed.error || packed.status !== 0) refuse(`cargo package failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
-      packCommands.push("cargo metadata --format-version 1 --no-deps");
-      const meta = await run("cargo", ["metadata", "--format-version", "1", "--no-deps"], { cwd: workspaceRoot, env });
+      if (parsed.qualifyOnly) steps.push({ command: `cargo ${packageArgs.join(" ")}`, ok: true });
+      const metadataArgs = ["metadata", "--offline", "--format-version", "1", "--no-deps"];
+      const meta = await runCargoReadOnly(metadataArgs, { cwd: workspaceRoot, env }, (_command, args, settings) => run("cargo", args, settings),
+        (failed) => log(`[right-release] offline Cargo metadata missed cache; retrying online once\n${failed.stdout ?? ""}${failed.stderr ? `\n${failed.stderr}` : ""}`));
+      const actualMetadataArgs = meta.usedOfflineFallback ? metadataArgs.filter((arg) => arg !== "--offline") : metadataArgs;
+      packCommands.push(`cargo ${actualMetadataArgs.join(" ")}`);
       let targetDir;
       try { targetDir = JSON.parse(meta.stdout).target_directory; } catch { /* refused below */ }
-      if (meta.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) refuse("cannot read the Cargo target directory");
+      if (meta.error || meta.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) {
+        refuse(`cannot read the Cargo target directory\n${tail(`${meta.error?.message ?? ""}\n${meta.stdout ?? ""}\n${meta.stderr ?? ""}`)}`);
+      }
       artifactFile = path.join(targetDir, "package", `${unit}-${version}.crate`);
       if (!fs.existsSync(artifactFile)) refuse(`cargo package did not produce ${artifactFile}`);
     }
@@ -411,13 +562,14 @@ async function publishUnit(parsed, deps, batch) {
     const timestamp = (deps.now ?? (() => new Date().toISOString()))();
     const evidence = {
       schema: GATE_SCHEMA, kind, name: unit, version, commit: head, artifactSha256,
-      hostPolicy: "darwin-only", hostPolicyReason: LOCAL_HOST_POLICY_REASON,
+      hostPolicy: LOCAL_HOST_POLICIES[platform], hostPolicyReason: localHostPolicyReason(platform),
       runs: [{
-        host: { os: "darwin", arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
+        host: { os: platform, arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
         command: commands.join(" && "), operator: LOCAL_OPERATOR, timestamp,
         passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored, allowIgnored: ignoredAllowed,
         ...(configReason ? { allowIgnoredReason: configReason } : {}),
         requireAssets: env.RIGHTKIT_REQUIRE_ASSETS, assetGated: isAssetGated,
+        ...(parsed.jobs === undefined ? {} : { jobs: parsed.jobs }),
         ...(batch ? { batch: structuredClone(batch.receipt) } : {}),
         steps: steps.map(({ command, ok, executed, failed, ignored, skipped, binaries }) => ({ command, ok, ...(executed === undefined ? {} : { executed, failed, ignored, skipped, binaries }) })),
       }],
@@ -429,16 +581,28 @@ async function publishUnit(parsed, deps, batch) {
     const gateOptions = { kind, name: unit, version, packagePath: unitPath, evidencePath };
     (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { write: (line) => log(line.replace(/\n$/, "")) });
 
+    if (parsed.qualifyOnly) {
+      // Keep bytes and their normal gate evidence together outside the checkout. Never overwrite a bundle.
+      fs.mkdirSync(parsed.bundleDir, { recursive: false });
+      const bundledArtifact = path.join(parsed.bundleDir, path.basename(artifactFile));
+      const bundledEvidence = path.join(parsed.bundleDir, "gate.json");
+      fs.copyFileSync(artifactFile, bundledArtifact, fs.constants.COPYFILE_EXCL);
+      if (sha256(fs.readFileSync(bundledArtifact)) !== artifactSha256) refuse("qualification archive changed while copying");
+      fs.copyFileSync(evidencePath, bundledEvidence, fs.constants.COPYFILE_EXCL);
+      log(`[right-release] qualified ${unit}@${version}; bundle ${parsed.bundleDir}; publish cargo --crate ${unit} --from-evidence ${bundledEvidence}`);
+      return { kind, name: unit, version, commit: head, artifactSha256, evidencePath: bundledEvidence, artifactFile: bundledArtifact, qualifiedOnly: true };
+    }
+
     // 5. The EXISTING publish path.
     if (kind === "npm") {
-      (deps.publishGatedTarball ?? publishGatedTarball)({ name: unit, version, tarball: artifactFile, evidencePath }, deps.publishDeps ?? {});
+      (deps.publishGatedTarball ?? publishGatedTarball)({ name: unit, version, tarball: artifactFile, evidencePath, workspaceRoot }, deps.publishDeps ?? {});
     } else {
       // trustEvidenceSteps: the evidence just written (and validated by the gate above) proves this commit's tests
       // and clippy, so the publisher does not repeat them; verifyOnPublish: Cargo's verify build runs in the
       // publish itself. Package contents, the runtime budget, the archive hash and the readback always run.
       const execute = deps.cargoExecute ?? (batch ? batchCargoExecute(unit) : undefined);
-      const published = await (deps.runCargoPublish ?? runCargoPublish)({ crate: unit, dryRun: false, allowDirty: false, workspaceRoot, evidence: evidencePath, trustEvidenceSteps: true, verifyOnPublish: true }, execute, deps.cargoDeps ?? {});
-      await withVersionsLock(() => (deps.recordPublished ?? recordPublished)({ registry: "cargo", name: published.name, version: published.version }));
+      const published = await (deps.runCargoPublish ?? runCargoPublish)({ crate: unit, dryRun: false, allowDirty: false, workspaceRoot, evidence: evidencePath, trustEvidenceSteps: true, verifyOnPublish: true, offlineReadOnly: true }, execute, deps.cargoDeps ?? {});
+      await withVersionsLock(() => (deps.recordPublished ?? recordPublished)({ registry: "cargo", name: published.name, version: published.version }, workspaceFeedOptions(workspaceRoot)));
     }
     log(`[right-release] published ${unit}@${version}`);
     return { kind, name: unit, version, commit: head, artifactSha256, evidencePath };
@@ -460,7 +624,7 @@ async function runLocalPublishBatch(parsed, deps) {
   const git = deps.git ?? defaultGit;
   const readJson = deps.readJson ?? defaultReadJson;
   const run = deps.run ?? defaultRunAsync;
-  assertLocalHost(deps, workspaceRoot);
+  const platform = assertLocalHost(deps, workspaceRoot, "cargo");
 
   // 1. The crate list and its dependency layers.
   const requested = parsed.batch.file ? parseCrateLayers((deps.readText ?? ((file) => fs.readFileSync(file, "utf8")))(parsed.batch.file)) : [parsed.batch.crates];
@@ -476,6 +640,7 @@ async function runLocalPublishBatch(parsed, deps) {
   const assetGated = readJson(path.join(workspaceRoot, "ci", "asset-gated.json")) ?? {};
   const isAssetGated = (unit) => Object.hasOwn(assetGated.crates ?? {}, unit);
   const versions = new Map();
+  const batchConsumerDirs = new Set();
   for (const unit of crates) {
     const dir = `crates/${unit}`;
     if (!fs.existsSync(path.join(workspaceRoot, dir))) refuse(`unit directory not found: ${path.join(workspaceRoot, dir)}`);
@@ -483,20 +648,24 @@ async function runLocalPublishBatch(parsed, deps) {
     if (pkg.name !== unit) refuse(`Cargo.toml [package].name ${JSON.stringify(pkg.name)} differs from --crates entry ${unit}`);
     if (typeof pkg.version !== "string" || !pkg.version.trim()) refuse(`${unit} has no literal version`);
     versions.set(unit, pkg.version);
-    localTestPlan({ kind: "cargo", unit, dir, config: gateConfig, batch: true }); // refuses an OS-restricted crate now, not mid-batch
+    // Refuses an OS-restricted crate, a malformed consumer row, or an untracked or symlinked consumer file now, not mid-batch.
+    const rows = localTestPlan({ kind: "cargo", unit, dir, config: gateConfig, batch: true, platform }).consumerRows ?? [];
+    assertConsumerFiles(workspaceRoot, unit, rows, git);
+    for (const consumerDir of consumerDirs(rows)) batchConsumerDirs.add(consumerDir);
   }
   const head = git(["rev-parse", "HEAD"], workspaceRoot);
   if (!head || !/^[0-9a-f]{40}$/.test(head)) refuse("cannot resolve HEAD");
   const tree = git(["rev-parse", "HEAD^{tree}"], workspaceRoot);
   if (!tree || !/^[0-9a-f]{40}$/.test(tree)) refuse("cannot resolve the HEAD tree");
-  // Every batch crate and the workspace manifest and lock must match the commit the batch checks are bound to.
-  const dirty = git(["status", "--porcelain", "--", ...crates.map((unit) => `crates/${unit}`), "Cargo.toml", "Cargo.lock"], workspaceRoot);
+  // Every batch crate, the workspace manifest and lock, the gate config and EVERY crate's consumer directories must
+  // match the commit the batch checks are bound to, before the first layer publishes (0.4.1 review A3, A4).
+  const dirty = git(["status", "--porcelain", "--", ...crates.map((unit) => `crates/${unit}`), "Cargo.toml", "Cargo.lock", ...GATE_CONFIG_FILES, ...batchConsumerDirs], workspaceRoot);
   if (dirty === null) refuse("cannot read git status for the batch");
-  if (dirty !== "") refuse(`tree is not clean for the batch crates or the workspace manifest; commit first:\n${dirty}`);
+  if (dirty !== "") refuse(`tree is not clean for the batch crates, the workspace manifest, the gate config or a consumer directory; commit first:\n${dirty}`);
   const registryHas = deps.registryHas ?? defaultRegistryHas;
   const published = (await Promise.all(crates.map(async (unit) => ((await registryHas({ kind: "cargo", name: unit, version: versions.get(unit) })) ? `${unit}@${versions.get(unit)}` : null)))).filter(Boolean);
   if (published.length) refuse(`already on the crates.io registry: ${published.join(", ")}; bump the version or remove them from the batch`);
-  log(`[right-release] local publish cargo batch: ${crates.length} crate(s) in ${layers.length} layer(s) at ${head.slice(0, 12)}, concurrency ${concurrency} (local-build grant, darwin-only policy)`);
+  log(`[right-release] local publish cargo batch: ${crates.length} crate(s) in ${layers.length} layer(s) at ${head.slice(0, 12)}, concurrency ${concurrency} (local-build grant, ${LOCAL_HOST_POLICIES[platform]} policy)`);
 
   // 3. Batch-level checks, once, at the batch commit. Each is recorded in every crate's evidence.
   const env = testEnv(deps, false);
@@ -518,9 +687,9 @@ async function runLocalPublishBatch(parsed, deps) {
   const scanText = `scanCrateForSecrets ${crates.map((unit) => `crates/${unit}`).join(" ")}`;
   checks.push({ name: "secret-scan", command: scanText, ok: true, ...stamp, crates });
   commands.push(scanText);
-  const featuresOf = (unit) => (gateConfig?.rust?.[unit]?.featureSets ?? [[]])[0];
+  const featureSetsOf = (unit) => gateConfig?.rust?.[unit]?.featureSets ?? [[]];
   for (const layer of layers) {
-    for (const invocation of batchClippyInvocations(layer, { featuresOf, assetGatedOf: isAssetGated })) {
+    for (const invocation of batchClippyInvocations(layer, { featureSetsOf, assetGatedOf: isAssetGated })) {
       await batchCheck("clippy", "cargo", invocation.args, invocation.crates, testEnv(deps, invocation.assetGated));
     }
   }

package/managed-cargo.mjs

@@ -18,6 +18,14 @@ export function managedRuntimeClient(env = process.env, platform = process.platf
     const client = path.posix.join(env.HOME || homedir(), 'Library', 'Application Support', 'RustRight', 'runtime', 'rustright');
     if (exists(client)) return client;
   }
+  // RustRight's own install on Windows (2026-10-18 cutover): the runtime moved out of the control root to
+  // <drive>\.rustright\runtime, beside the control root's drive, and runtime-current was retired.
+  if (platform === 'win32') {
+    for (const root of roots) {
+      const client = path.win32.join(path.win32.parse(root).root, '.rustright', 'runtime', 'rustright.exe');
+      if (exists(client)) return client;
+    }
+  }
   return undefined;
 }
 

package/mirror-root-artifact.mjs

@@ -6,6 +6,7 @@
 // `{ file, name?, pruneSuffix? }`. `pruneSuffix` (for example "-setup.exe") then removes the other files with that suffix
 // from the managed directory, so it holds exactly the current artifact. Run it as `targets.<platform>.postSign`.
 // Output goes only to RIGHT_RELEASE_ARTIFACT_DIR (outside the repository); it never writes into the repository root.
+import { configuredManagedRootSpellings } from "./artifact-storage.mjs";
 import { copyFileSync, lstatSync, mkdirSync, readdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
 import { execFileSync } from "./background-process.mjs";
 import path from "node:path";
@@ -113,11 +114,14 @@ function atomicCopy(from, to) {
 function assertSafePath(target) {
   const absolute = path.resolve(target);
   const root = path.parse(absolute).root;
+  // Only the configured managed root itself may be a symlink (same rule as artifact-storage assertSafeMutation).
+  const managedRoots = configuredManagedRootSpellings();
+  const configured = (candidate) => managedRoots.has(process.platform === "win32" ? path.resolve(candidate).toLowerCase() : path.resolve(candidate));
   let cursor = root;
   for (const segment of path.relative(root, absolute).split(path.sep).filter(Boolean)) {
     cursor = path.join(cursor, segment);
     try {
-      if (lstatSync(cursor).isSymbolicLink()) throw new Error(`refusing filesystem mutation through symlink: ${cursor}`);
+      if (lstatSync(cursor).isSymbolicLink() && !configured(cursor)) throw new Error(`refusing filesystem mutation through symlink: ${cursor}`);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }

package/native-cargo-layout.mjs

@@ -18,6 +18,8 @@ export function resolveNativeCargoLayout({
   read = (file) => readFileSync(file, "utf8"),
   requireManifest = false,
   requireLock = false,
+  // The repository the app lives in. A manifest outside the app searches for its workspace only up to this directory.
+  repoRoot,
 } = {}) {
   if (!appRoot) throw new TypeError("native Cargo layout requires appRoot");
   const resolvedAppRoot = path.resolve(appRoot);
@@ -31,7 +33,7 @@ export function resolveNativeCargoLayout({
   const explicitWorkspace = nativeAssembly?.workspaceRoot ?? nativeAssembly?.cargoWorkspaceRoot;
   const workspaceRoot = explicitWorkspace
     ? normalizeWorkspaceRoot(resolveDeclaredPath(resolvedAppRoot, explicitWorkspace), exists)
-    : discoverWorkspaceRoot({ appRoot: resolvedAppRoot, manifestPath, manifestDir, manifestText, exists, read });
+    : discoverWorkspaceRoot({ appRoot: resolvedAppRoot, manifestPath, manifestDir, manifestText, exists, read, repoRoot: repoRoot ? path.resolve(repoRoot) : undefined });
 
   const lock = resolveCargoLock({
     appRoot: resolvedAppRoot,
@@ -84,6 +86,28 @@ export function resolveNativeCargoLayout({
   return layout;
 }
 
+/**
+ * True when the app has a native Cargo manifest the release must hash and build against: the config declares one
+ * (nativeAssembly.cargoManifest / manifest) or the historical src-tauri/Cargo.toml exists. A native iOS app (xcodegen
+ * project, Rust static library built by iosPackage.prepare) has neither, and then owns no Cargo layout at all.
+ */
+export function nativeCargoDeclared({ appRoot, config, nativeAssembly = config?.nativeAssembly, exists = existsSync } = {}) {
+  if (!appRoot) throw new TypeError("native Cargo layout requires appRoot");
+  if (nativeAssembly?.cargoManifest ?? nativeAssembly?.manifest) return true;
+  return exists(path.resolve(appRoot, DEFAULT_MANIFEST));
+}
+
+/** The manifest nativeAssembly names, if any (a path relative to the app root, or absolute). */
+export function declaredCargoManifest(config, nativeAssembly = config?.nativeAssembly) {
+  return nativeAssembly?.cargoManifest ?? nativeAssembly?.manifest;
+}
+
+/** True when the historical Tauri host manifest exists. */
+export function hasDefaultTauriManifest({ appRoot, exists = existsSync } = {}) {
+  if (!appRoot) throw new TypeError("native Cargo layout requires appRoot");
+  return exists(path.resolve(appRoot, DEFAULT_MANIFEST));
+}
+
 export const resolveCargoLayout = resolveNativeCargoLayout;
 export const resolveNativeCargoManifest = resolveNativeCargoLayout;
 export const resolveCargoManifest = resolveNativeCargoLayout;
@@ -160,20 +184,29 @@ function resolveCargoLock({ appRoot, manifestPath, manifestDir, workspaceRoot, n
   return { path: found, source: found ? orderedSources[candidates.indexOf(found)] : undefined, candidates };
 }
 
-function discoverWorkspaceRoot({ appRoot, manifestPath, manifestDir, manifestText, exists, read }) {
+function discoverWorkspaceRoot({ appRoot, manifestPath, manifestDir, manifestText, exists, read, repoRoot }) {
   const parsed = parseCargoManifest(manifestText);
   const declaredWorkspace = parsed.workspacePath ?? parsed.packageWorkspace;
   if (declaredWorkspace) {
     return normalizeWorkspaceRoot(resolveDeclaredPath(manifestDir, declaredWorkspace), exists);
   }
   if (parsed.hasWorkspace) return manifestDir;
+  // A manifest inside the app searches up to the app root (unchanged); one outside it (a shared crates/ tree) searches up to the
+  // nearest directory that contains both, which is where its workspace and Cargo.lock live.
+  // Only a caller that names the repository opts in to the climb above the app (native iOS); every other caller keeps the
+  // exact historical search, which never leaves the app root.
+  let boundary = appRoot;
+  if (repoRoot && !isWithin(appRoot, manifestDir)) {
+    boundary = commonAncestor(appRoot, manifestDir);
+    if (!isWithin(repoRoot, boundary)) boundary = repoRoot;
+  }
   let current = manifestDir;
   for (;;) {
     const candidate = path.join(current, "Cargo.toml");
     if (candidate !== manifestPath && exists(candidate) && parseCargoManifest(readIfPresent(candidate, exists, read)).hasWorkspace) return current;
-    if (current === appRoot) break;
+    if (current === boundary) break;
     const parent = path.dirname(current);
-    if (parent === current || !isWithin(appRoot, parent)) break;
+    if (parent === current || !isWithin(boundary, parent)) break;
     current = parent;
   }
   return manifestDir;
@@ -231,6 +264,16 @@ function readIfPresent(file, exists, read) {
   try { return exists(file) ? read(file) : ""; } catch { return ""; }
 }
 
+function commonAncestor(left, right) {
+  let current = path.resolve(left);
+  while (!isWithin(current, path.resolve(right))) {
+    const parent = path.dirname(current);
+    if (parent === current) return current;
+    current = parent;
+  }
+  return current;
+}
+
 function isWithin(root, candidate) {
   const relative = path.relative(root, candidate);
   return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));