@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.1

package/apps/storefront/src/components/membership/TierComparisonTable.astro

@@ -6,8 +6,8 @@
  * subscription mechanics; a tier's optional figure and CTA are display/handoff
  * only.
  *
- * Illustrative-figures affordance (decision compliance-widgets-platform-owned):
- * when any tier shows an illustrative figure the header carries a first-class
+ * Illustrative-figures affordance: when any tier shows an illustrative
+ * figure the header carries a first-class
  * <IllustrativeLabel> badge, each such figure gets an "e.g." affordance +
  * data-illustrative hook, and a footnote spells it out — an example number is
  * never presented as a live offer.

package/apps/storefront/src/components/subscription/SavingsExplainer.astro

@@ -6,8 +6,8 @@
  * subscription mechanics — the CTA is a link into the tenant's own
  * (product-owned) subscribe/learn flow.
  *
- * Illustrative-figure affordance (decision compliance-widgets-platform-owned):
- * the figure is treated as an EXAMPLE by default (isIllustrative). When
+ * Illustrative-figure affordance: the figure is treated as an EXAMPLE by
+ * default (isIllustrative). When
  * illustrative, the figure carries an "e.g." affordance + a first-class
  * <IllustrativeLabel> badge/footnote so an example number is never presented
  * as a live offer. A tenant opts out only by asserting `real: true` on a

package/apps/storefront/src/config/adminTenantLookup.ts

@@ -0,0 +1,35 @@
+/**
+ * Admin integration plane — arbitrary-tenant lookup provider (ext-kernel-09).
+ *
+ * The `/api/apps/admin/*` integration routes resolve a tenant named in the operator
+ * session (`auth.tenantId` — a vendor may administer a tenant that is NOT the
+ * request's own host scope, so `Astro.locals.tenant` does not apply). Materializing
+ * a tenant's OWN (tenant-local) declarations needs its full config (`compliance`,
+ * `siteType`, `integrations`), which requires the concrete resolver selection — and
+ * the `tenancy-resolver-fence` extractability invariant forbids pages/lib from
+ * importing that directly.
+ *
+ * This module lives in `src/config` (an approved location) and encapsulates
+ * `getTenantResolver()` + `staticTenants`, exposing exactly the by-id lookup the
+ * admin routes need, typed against the public `TenantConfig`. Mirrors
+ * `previewTenantLookup.ts`; the concrete resolver selection stays in `config`, so a
+ * constant single-tenant resolver remains a drop-in and the codebase stays
+ * always-extractable.
+ */
+import type { TenantConfig } from "@tot/public-runtime";
+import { getTenantResolver } from "@/config/resolver";
+import { staticTenants } from "@/config/tenants";
+
+/**
+ * Resolve the admin operator's tenant id (== appDomain for the built-in tenants) to
+ * its config. Strict domain match first (KV-backed in prod, static in dev), then the
+ * static registry by appDomain or tenant_id. Null for an unknown tenant.
+ */
+export async function resolveAdminTenant(tenantId: string): Promise<TenantConfig | null> {
+  const resolver = await getTenantResolver();
+  return (
+    (await resolver.resolveStrict(tenantId)) ??
+    staticTenants.find((t) => t.appDomain === tenantId || t.tenant_id === tenantId) ??
+    null
+  );
+}

package/apps/storefront/src/config/devTenantSeed.ts

@@ -27,14 +27,14 @@ import type { DeepPartial, TenantConfig, ThemeTokens } from "@tot/public-runtime
 /** Per-dir overrides the resolver derives from disk before synthesis. */
 export interface DevTenantHints {
   /**
-   * (E3) The resolvable appDomain for a SLUG tenant whose dir name isn't its
+   * The resolvable appDomain for a SLUG tenant whose dir name isn't its
    * domain. Read from the checkout's `.tot/config.json` `scope` when that scope
    * looks like a hostname (has a dot) — mirrors scripts/tot-dev.mjs resolveDomain.
    * Undefined ⇒ the colocation convention (dir == appDomain == scope).
    */
   appDomain?: string;
   /**
-   * (E2) True when catalog fixtures for this tenant's data scope are committed on
+   * True when catalog fixtures for this tenant's data scope are committed on
    * disk (the same `packages/migration/out/catalog/<scope>/` the FixtureToTClient
    * reads). When true we serve a real COMMERCE tenant so /collections + /products
    * render from them; when false we degrade to a marketing home (no catalog).
@@ -45,9 +45,9 @@ export interface DevTenantHints {
 /**
  * A servable TenantConfig for a local dev-loop checkout. Identity defaults to the
  * colocated dir name (dir == id == appDomain == tot_data_scope); a slug tenant can
- * override the resolvable appDomain via `hints.appDomain` (E3). No Storyblok space
+ * override the resolvable appDomain via `hints.appDomain`. No Storyblok space
  * (a "PLACEHOLDER" token → LocalContentProvider serves the checkout's content/).
- * Commerce is data-driven (E2): with catalog fixtures on disk the tenant is
+ * Commerce is data-driven: with catalog fixtures on disk the tenant is
  * COMMERCE (catalog on); without them it degrades to a marketing home (siteType
  * "marketing" → no catalog required, so the root renders instead of 404ing).
  * Theme tokens come from the checkout's theme.json.
@@ -57,7 +57,7 @@ export function synthesizeDevTenant(
   themeTokens: DeepPartial<ThemeTokens>,
   hints: DevTenantHints = {},
 ): TenantConfig {
-  // (E3) Prefer the .tot/config.json scope for a slug tenant; else colocation.
+  // Prefer the .tot/config.json scope for a slug tenant; else colocation.
   const appDomain = hints.appDomain ?? id;
   const base: TenantConfig = {
     tenant_id: id,
@@ -74,7 +74,7 @@ export function synthesizeDevTenant(
     theme_tokens: themeTokens,
   };
   if (hints.hasCatalog) {
-    // (E2) Catalog fixtures on disk → a real commerce tenant (siteType omitted ==
+    // Catalog fixtures on disk → a real commerce tenant (siteType omitted ==
     // commerce → catalog on). Cart wires to the shared ToT demo checkout store
     // (test mode, no secret), the same as the bundled demo tenants — so
     // /collections + /products resolve and add-to-cart works on localhost.
@@ -90,9 +90,9 @@ export function synthesizeDevTenant(
 
 /** Per-dir disk facts the resolver supplies so synthesis can go beyond colocation. */
 export interface DevTenantSeedOptions {
-  /** (E3) Resolved appDomain for a slug tenant (from `.tot/config.json` scope). */
+  /** Resolved appDomain for a slug tenant (from `.tot/config.json` scope). */
   scopeFor?: (id: string) => string | undefined;
-  /** (E2) Whether catalog fixtures are committed on disk for a given data scope. */
+  /** Whether catalog fixtures are committed on disk for a given data scope. */
   hasCatalog?: (scope: string) => boolean;
 }
 
@@ -100,7 +100,7 @@ export interface DevTenantSeedOptions {
  * The dev tenants to seed ALONGSIDE staticTenants: one synthesized config per
  * local tenant dir that isn't already a static tenant (those keep their richer
  * hardcoded config). `themeFor` supplies each dir's theme tokens; `opts` carries
- * the per-dir disk facts (E2 catalog presence, E3 slug scope) the resolver reads.
+ * the per-dir disk facts (catalog presence, slug scope) the resolver reads.
  *
  * @param localDirIds dir names discovered under `tenants/*` (dir == tenant id)
  * @param staticIds   tenant_ids already in the static registry (skipped)

package/apps/storefront/src/config/resolver.ts

@@ -20,7 +20,7 @@
  * Changing that value flips which tenant a bare/unknown host serves — proof the
  * default is configurable, not hardcoded.
  */
-import type { TenantResolver } from "@tot/public-runtime";
+import { tenantIdFromPath, type TenantResolver } from "@tot/public-runtime";
 import { readEnv, readKv } from "@/lib/env";
 import {
   tenantResolver as staticResolver,
@@ -32,30 +32,38 @@ import { getTenantTheme } from "@/themes/tenants";
 import { devTenantsToSeed } from "@/config/devTenantSeed";
 import { MemoryKv } from "@/lib/memoryKv";
 
-// LOCAL dev loop discovery: enumerate the colocated `tenants/<id>/` dirs on disk,
+// LOCAL dev loop discovery: enumerate the colocated tenant dirs on disk,
 // INCLUDING a developer's checkout grafted in by `tot dev` (scripts/tot-dev.mjs).
 // Keys only — the loaders are never invoked. Vite resolves this glob at
 // dev-server boot (after the graft) and re-resolves on HMR, so a newly grafted
 // tenant dir is discovered. Mirrors the content/theme dir globs the app already
 // uses (provider.ts, themes/tenants/index.ts). Depth: from src/config/ the repo
 // root is four levels up (config→src→storefront→apps→root).
+//
+// Both tiers are globbed: real tenants at `tenants/<id>/`, platform test tenants
+// one level deeper at `tenants/e2e/<id>/` (tenantDirRelative). Vite needs literal
+// patterns, so the nesting is spelled out here and `tenantIdFromPath` — the one
+// inverse of that mapping — recovers the id from either shape.
 const localTenantFiles = import.meta.glob([
   "../../../../tenants/*/theme.json",
   "../../../../tenants/*/content/home.html",
   "../../../../tenants/*/content/home.json",
+  "../../../../tenants/e2e/*/theme.json",
+  "../../../../tenants/e2e/*/content/home.html",
+  "../../../../tenants/e2e/*/content/home.json",
 ]);
 
-/** Dir names under `tenants/*` (dir == tenant id), from the discovery glob keys. */
+/** Tenant ids with a local dir (dir == tenant id), from the discovery glob keys. */
 function localTenantDirIds(): string[] {
   const ids = new Set<string>();
   for (const key of Object.keys(localTenantFiles)) {
-    const id = /\/tenants\/([^/]+)\//.exec(key)?.[1];
+    const id = tenantIdFromPath(key);
     if (id) ids.add(id);
   }
   return [...ids];
 }
 
-// (E2) Catalog fixtures committed on disk, keyed by data scope (== out/catalog dir
+// Catalog fixtures committed on disk, keyed by data scope (== out/catalog dir
 // name). A dev tenant whose scope has fixtures is served as a real COMMERCE tenant
 // (see devTenantSeed); one without them degrades to a marketing home. Keys only —
 // the same fixtures the FixtureToTClient reads. Repo root is four up from config/.
@@ -73,14 +81,14 @@ function catalogScopes(): Set<string> {
   return scopes;
 }
 
-// (E3) A slug tenant (dir name != its domain) declares its resolvable appDomain in
+// A slug tenant (dir name != its domain) declares its resolvable appDomain in
 // the checkout's `.tot/config.json` `scope`. Read eagerly (tiny JSON) so synthesis
 // can resolve it at `/<domain>/`; trusted only when it looks like a hostname (has a
 // dot), mirroring scripts/tot-dev.mjs resolveDomain. Only the DEV fallback consults
 // it. The explicit `.tot` literal in the pattern matches the dotdir; if the glob
 // sees nothing, synthesis simply falls back to the colocation convention.
 const tenantMarkerFiles = import.meta.glob<{ scope?: string }>(
-  "../../../../tenants/*/.tot/config.json",
+  ["../../../../tenants/*/.tot/config.json", "../../../../tenants/e2e/*/.tot/config.json"],
   { eager: true, import: "default" },
 );
 
@@ -88,7 +96,7 @@ const tenantMarkerFiles = import.meta.glob<{ scope?: string }>(
 function slugScopes(): Map<string, string> {
   const map = new Map<string, string>();
   for (const [key, cfg] of Object.entries(tenantMarkerFiles)) {
-    const id = /\/tenants\/([^/]+)\//.exec(key)?.[1];
+    const id = tenantIdFromPath(key);
     const scope = cfg?.scope;
     // A hostname scope that DIFFERS from the dir is the slug override; a scope
     // equal to the dir (the colocation norm) needs no override.
@@ -110,8 +118,8 @@ function slugScopes(): Map<string, string> {
 function devFallbackResolver(): TenantResolver {
   if (!import.meta.env.DEV) return staticResolver;
   const staticIds = new Set(staticTenants.map((t) => t.tenant_id));
-  const withCatalog = catalogScopes(); // E2
-  const scopes = slugScopes(); // E3
+  const withCatalog = catalogScopes();
+  const scopes = slugScopes();
   const dev = devTenantsToSeed(localTenantDirIds(), staticIds, getTenantTheme, {
     scopeFor: (id) => scopes.get(id),
     hasCatalog: (scope) => withCatalog.has(scope),

package/apps/storefront/src/layouts/Layout.astro

@@ -23,6 +23,9 @@ import { referenceTheme } from "@/themes/reference";
 import { mergeTheme } from "@/themes/schema";
 import { organizationLd, websiteLd } from "@/lib/jsonld";
 import { nonceInlineTags, CHROME_BODY_MARKER } from "@/lib/rawMarketingHtml";
+import { resolveHeaderVariant, resolveFooterVariant } from "@/lib/chrome/variant";
+import type { HeaderVariant, FooterVariant } from "@/lib/chrome/model";
+import { renderIntegrationPhases } from "@tot/public-runtime";
 import { readViewerSession } from "@/lib/auth/route";
 import AppWidgetFrame from "@/components/apps/AppWidgetFrame.astro";
 import { getRegistryService } from "@/lib/apps/adminService.js";
@@ -40,7 +43,18 @@ interface Props {
   feeds?: { title: string; href: string }[];
   /** Wider pages (PLP/home) drop the prose max-width. */
   fullBleed?: boolean;
-  // --- B1.6 article SEO hardening: pass-through to <Seo> (all additive) ---
+  /**
+   * Explicit per-page header/footer content-variant override (see
+   * lib/chrome/model.ts HeaderVariant/FooterVariant). NEVER inferred from the
+   * route/CSS/title — a page that wants e.g. a minimal checkout header sets
+   * this prop. Absent ⇒ the tenant's chrome-config default
+   * (chrome.header.variant / chrome.footer.variant). An unrecognized value
+   * (page-supplied or the config's own default) fails closed with an
+   * actionable error rather than silently falling back.
+   */
+  headerVariant?: HeaderVariant;
+  footerVariant?: FooterVariant;
+  // --- Article SEO hardening: pass-through to <Seo> (all additive) ---
   article?: import("@/lib/seo/meta.js").ArticleMeta;
   imageAlt?: string;
   imageWidth?: number;
@@ -48,7 +62,7 @@ interface Props {
   twitterSite?: string;
   twitterCreator?: string;
   canonicalOverride?: string;
-  // --- I2 hreflang / <html lang> (additive) ---
+  // --- hreflang / <html lang> (additive) ---
   /** Per-variant `hreflang` alternates for a translated article; threaded to
    *  <Seo>. Absent/empty ⇒ no alternate links (singleton unchanged). */
   alternates?: import("@/lib/seo/alternates.js").Alternate[];
@@ -75,10 +89,20 @@ const {
   canonicalOverride,
   alternates,
   lang,
+  headerVariant,
+  footerVariant,
 } = Astro.props;
 const { tenant, themeStyle, canonicalBase, basePath, cspNonce, features, capabilities } =
   Astro.locals;
 
+// Fixed-phase integration engine (ext-kernel-04): ONE engine emits the
+// renderer-owned phases (platform.environment, consent.defaults, head.early,
+// body.start, document.deferred) into the head + body-start + body-deferred
+// boundaries. `rawHtmlResponse` is the other mount of the SAME engine, so both
+// documents carry byte-identical phase markup. The nonce is stamped per response
+// from a placeholder by the middleware, never serialized (ADR 0018).
+const integrationPhases = renderIntegrationPhases(Astro.locals.integrationPlan, cspNonce);
+
 // Organization JSON-LD is emitted site-wide (brief §8); pages add their own
 // graphs (Product, BreadcrumbList…) via the jsonLd prop.
 const pageGraphs = jsonLd ? (Array.isArray(jsonLd) ? jsonLd : [jsonLd]) : [];
@@ -92,6 +116,12 @@ const theme = mergeTheme(referenceTheme, tenant.theme_tokens);
 
 const chrome = await Astro.locals.content.getChrome();
 
+// Explicit variant resolution (fail-closed): the page's override wins over
+// the tenant's chrome-config default; an unrecognized value throws with an
+// actionable message rather than silently falling back (lib/chrome/variant.ts).
+const resolvedHeaderVariant = resolveHeaderVariant(headerVariant, chrome.header.variant);
+const resolvedFooterVariant = resolveFooterVariant(footerVariant, chrome.footer.variant);
+
 // SHARED CHROME: if the tenant ships content/<id>/chrome.html (the pixel-perfect
 // header/footer the raw marketing pages use), render THAT chrome around the
 // Layout content too — so commerce pages (collections/products/search/…) share
@@ -99,7 +129,7 @@ const chrome = await Astro.locals.content.getChrome();
 // <!--PAGE_BODY-->: everything before = header, after = footer; pull its tenant
 // stylesheet links into <head>; nonce its inline tags for CSP. Tenants without a
 // chrome.html keep the token-driven Header/Footer (below).
-const chromeHtml = await Astro.locals.content.getChromeHtml();
+const chromeHtml = await Astro.locals.content.getChromeHtml(path);
 let sharedChrome: { header: string; footer: string; css: string[] } | null = null;
 if (chromeHtml && chromeHtml.includes(CHROME_BODY_MARKER)) {
   const headEnd = chromeHtml.indexOf("</head>");
@@ -119,7 +149,7 @@ if (chromeHtml && chromeHtml.includes(CHROME_BODY_MARKER)) {
 
 const compliance = tenant.compliance;
 
-// Site-chrome data resolution (unit I4 — chrome/* is the canonical, prop-driven
+// Site-chrome data resolution (chrome/* is the canonical, prop-driven
 // component set; this Layout is the ONE place that resolves session/feature/
 // theme state into their props. Skipped entirely when sharedChrome (a raw
 // content/<id>/chrome.html override) is present — that path wins outright.
@@ -153,25 +183,34 @@ if (features.catalog) {
 // white logo); a light header always shows the text wordmark (no logo image).
 const headerDark = theme.brand.headerVariant === "dark";
 const headerLogoSrc = headerDark ? theme.brand.logoLight : theme.brand.logoDark;
-const headerLogo =
+const themeHeaderLogo =
   headerDark && headerLogoSrc && /^(https?:|\/)/.test(headerLogoSrc)
     ? { src: headerLogoSrc, alt: tenant.displayName }
     : undefined;
 
+// chrome.header.brand (lib/chrome/model.ts ChromeBrand) is the governed,
+// schema-validated brand identity — SOURCE OF TRUTH per field when set,
+// falling back to the theme-derived values above only where a field is
+// absent, so a tenant that hasn't authored a brand config is unaffected.
+const brand = chrome.header.brand;
+const brandLogoValid = brand?.logo && /^(https?:|\/)/.test(brand.logo.src) ? brand.logo : undefined;
+const headerLogo = brandLogoValid ?? themeHeaderLogo;
+const headerWordmark = brand?.label ?? tenant.displayName;
+const headerBrandHref = brand?.href;
+
 // Footer bottom bar: a "Legal"-titled column's links win; otherwise every
 // column's links flatten into the policy-link row (mirrors the retired
 // nav/Footer.astro exactly).
 const legalCol = chrome.footer.columns.find((c) => /legal/i.test(c.title));
 const bottomLinks = legalCol ? legalCol.links : chrome.footer.columns.flatMap((c) => c.links);
-const legalLine = `© ${new Date().getFullYear()} ${tenant.displayName}${
-  chrome.footer.legal ? ` · ${chrome.footer.legal}` : ""
-}`;
+const legalBase = chrome.footer.bottom?.copyright ?? `© ${new Date().getFullYear()} ${tenant.displayName}`;
+const legalLine = `${legalBase}${chrome.footer.bottom?.note ? ` · ${chrome.footer.bottom.note}` : ""}`;
 
 const analyticsToken = import.meta.env.PUBLIC_CF_ANALYTICS_TOKEN;
 const analyticsEnabled =
   analyticsToken && !/REPLACE|PLACEHOLDER/i.test(analyticsToken);
 
-// Private-app widgets (D5) — global.footer slot. Resolved once here so it
+// Private-app widgets — global.footer slot. Resolved once here so it
 // renders for BOTH footer paths below (the tenant-owned chrome.html splice
 // and the generic <Footer>) instead of being owned by either. No dark-mode
 // preference infra exists yet — "light" is the only theme hint until it does.
@@ -194,6 +233,14 @@ const footerWidgets = await renderWidgetSlot(
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
+
+    {/* Renderer-owned head phases (platform.environment → consent.defaults →
+        head.early), emitted before any tenant/app code — the Layout half of "one
+        engine, two mounts" (rawHtmlResponse is the other). Same engine output, so
+        both mounts are byte-identical. Carries only public values; the nonce is a
+        script attribute stamped per response, never serialized (ADR 0018). */}
+    <Fragment set:html={integrationPhases.head} />
+
     <link rel="icon" type="image/svg+xml" href={theme.brand.favicon} />
 
     {/* Per-tenant theme tokens injected at the edge (brief §7). The id is the
@@ -241,6 +288,10 @@ const footerWidgets = await renderWidgetSlot(
     }
   </head>
   <body>
+    {/* body.start fallback boundary (ext-kernel-04) — the renderer-owned mount
+        point for body-start contributions, before any page content. */}
+    <Fragment set:html={integrationPhases.bodyStart} />
+
     <a
       href="#main"
       class="sr-only focus:not-sr-only focus:absolute focus:z-50 focus:m-3 focus:rounded-md focus:bg-[var(--color-primary)] focus:px-4 focus:py-2 focus:text-[var(--color-primary-contrast)]"
@@ -257,16 +308,20 @@ const footerWidgets = await renderWidgetSlot(
     ) : (
       <>
         <div class="sticky top-0 z-40">
-          {chrome.announcement && <AnnouncementBar text={chrome.announcement} variant="static" />}
+          {chrome.header.announcement?.messages[0] && (
+            <AnnouncementBar text={chrome.header.announcement.messages[0]} variant="static" />
+          )}
           <SiteHeader
             logo={headerLogo}
-            wordmark={tenant.displayName}
-            nav={chrome.nav}
+            wordmark={headerWordmark}
+            brandHref={headerBrandHref}
+            nav={chrome.header.nav}
             variant={headerDark ? "dark" : "light"}
-            announcement={chrome.announcement}
+            layout={resolvedHeaderVariant}
+            announcement={chrome.header.announcement?.messages[0]}
             searchAction={features.productSearch ? "/search" : undefined}
             savedItemsHref={features.savedItems ? "/saved" : undefined}
-            headerCtas={chrome.headerCtas}
+            headerCtas={chrome.header.ctas}
             authLink={authLink}
             sticky={false}
           />
@@ -287,8 +342,9 @@ const footerWidgets = await renderWidgetSlot(
         <SiteFooter
           brand={{
             wordmark: tenant.displayName,
-            contact: chrome.footer.tagline ? [chrome.footer.tagline] : undefined,
+            contact: chrome.footer.brand?.text ? [chrome.footer.brand.text] : undefined,
           }}
+          variant={resolvedFooterVariant}
           columns={chrome.footer.columns}
           newsletter={features.newsletter ? { title: "Newsletter", placeholder: "you@example.com" } : undefined}
           social={chrome.footer.social}
@@ -298,7 +354,7 @@ const footerWidgets = await renderWidgetSlot(
       </>
     )}
 
-    {/* Private-app widgets (D5, global.footer) — sandboxed per install; one
+    {/* Private-app widgets (global.footer) — sandboxed per install; one
         resolution above covers both footer paths. */}
     {footerWidgets.map((w) => (
       <div class="container-prose py-6">
@@ -426,7 +482,7 @@ const footerWidgets = await renderWidgetSlot(
       </script>
     )}
 
-    {/* Dev-loop theme hot-patch (D1): tenant-hot-reload.mjs broadcasts a
+    {/* Dev-loop theme hot-patch: tenant-hot-reload.mjs broadcasts a
         `tot:theme-vars` HMR custom event on every theme.json save instead of
         forcing a full reload; swap the CSS var block in place so edits repaint
         instantly with no lost scroll position. import.meta.hot is undefined in
@@ -442,7 +498,7 @@ const footerWidgets = await renderWidgetSlot(
       </script>
     )}
 
-    {/* Private-app widget postMessage bridge (D5) — mounted unconditionally
+    {/* Private-app widget postMessage bridge — mounted unconditionally
         (cheap no-op with zero tracked iframes); scans for
         `[data-tot-widget-origin]` frames itself, so it doesn't need to know
         which slots rendered above. */}
@@ -476,14 +532,38 @@ const footerWidgets = await renderWidgetSlot(
       }
     </script>
 
-    {/* Field Web Vitals (F14 RUM) — measures LCP/INP/CLS for real visitors and
+    {/* Field Web Vitals (RUM) — measures LCP/INP/CLS for real visitors and
         beacons per-route samples to the RUM sink. ~1KB, no framework; no-ops
         where PerformanceObserver is absent. This is the per-route-template
-        signal F16's `core-web-vitals` monitor consumes (the CF Web Analytics
+        signal the `core-web-vitals` monitor consumes (the CF Web Analytics
         beacon above only gives aggregate field CWV). */}
     <script>
       import { startWebVitals } from "@/lib/analytics/webVitals";
       startWebVitals();
     </script>
+
+    {/* Protected-surface tamper sentinel (ext-policy-09, D-R7) — a DETECTIVE
+        runtime control. Full-parent third-party code shares this document and its
+        DOM reach can't be enforceably narrowed, so this never prevents mutation: it
+        detects tampering of the platform-owned compliance/commerce surfaces
+        (policy-04 PROTECTED_SURFACES), restores safe state, evidences it, and
+        suspends the attributable integration. No-ops when no integration plan is
+        present. */}
+    <script>
+      import { bootTamperSentinel } from "@/lib/compliance/tamper-sentinel-boot";
+      bootTamperSentinel();
+    </script>
+
+    {/* document.deferred global-entry boundary (ext-kernel-04) — the last phase,
+        the renderer-owned mount point for the deferred integration entry. */}
+    <Fragment set:html={integrationPhases.bodyDeferred} />
+
+    {/* document.deferred lifecycle boot (ext-kernel-05) — initializes the plan's
+        integrations exactly once per document, wires the reserved completed-
+        navigation event, and disposes on teardown; a no-op for an empty plan. */}
+    <script>
+      import { bootIntegrationLifecycleFromDocument } from "@tot/public-runtime";
+      bootIntegrationLifecycleFromDocument();
+    </script>
   </body>
 </html>

package/apps/storefront/src/lib/activity/candidateSubmitLease.ts

@@ -0,0 +1,87 @@
+import type { D1Like } from "@/lib/d1/catalog";
+
+const DIAGNOSTIC_STUCK_AFTER_MS = 5 * 60 * 1000;
+
+/**
+ * Atomically reserve one tenant/change across authorization, Gitea, and finalization.
+ * `expires_at` is an operator-visible stuck-work deadline, never an automatic takeover:
+ * a live but slow submit cannot lose ownership underneath its forge mutation.
+ */
+export async function acquireCandidateSubmitLease(
+  db: D1Like,
+  tenantId: string,
+  changeId: string,
+  authorizationId: string,
+  now = new Date(),
+): Promise<boolean> {
+  const acquiredAt = now.toISOString();
+  const expiresAt = new Date(now.getTime() + DIAGNOSTIC_STUCK_AFTER_MS).toISOString();
+  const row = await db.prepare(`
+    INSERT INTO candidate_submit_leases
+      (tenant_id, change_id, authorization_id, status, acquired_at, expires_at)
+    VALUES (?, ?, ?, 'active', ?, ?)
+    ON CONFLICT(tenant_id, change_id) DO UPDATE SET
+      authorization_id = excluded.authorization_id,
+      status = 'active',
+      acquired_at = excluded.acquired_at,
+      expires_at = excluded.expires_at
+    WHERE candidate_submit_leases.status <> 'active'
+       OR candidate_submit_leases.authorization_id = excluded.authorization_id
+    RETURNING authorization_id
+  `).bind(tenantId, changeId, authorizationId, acquiredAt, expiresAt).first() as
+    { authorization_id?: string } | null;
+  return row?.authorization_id === authorizationId;
+}
+
+export type CandidateSubmitLeaseState = "active" | "completed" | "missing";
+
+/** Atomically prove ownership for the callback work. Active leases are never stolen. */
+export async function renewCandidateSubmitLease(
+  db: D1Like,
+  tenantId: string,
+  changeId: string,
+  authorizationId: string,
+  now = new Date(),
+): Promise<CandidateSubmitLeaseState> {
+  const current = await db.prepare(`
+    SELECT authorization_id, status FROM candidate_submit_leases
+    WHERE tenant_id = ? AND change_id = ?
+  `).bind(tenantId, changeId).first() as
+    { authorization_id?: string; status?: string } | null;
+  if (current?.authorization_id !== authorizationId) return "missing";
+  if (current.status === "completed") return "completed";
+  const expiresAt = new Date(now.getTime() + DIAGNOSTIC_STUCK_AFTER_MS).toISOString();
+  const row = await db.prepare(`
+    UPDATE candidate_submit_leases SET expires_at = ?
+    WHERE tenant_id = ? AND change_id = ? AND authorization_id = ? AND status = 'active'
+    RETURNING authorization_id
+  `).bind(expiresAt, tenantId, changeId, authorizationId).first() as
+    { authorization_id?: string } | null;
+  return row?.authorization_id === authorizationId ? "active" : "missing";
+}
+
+/** Mark the attempt immutable/idempotent while allowing a later submit to acquire. */
+export async function completeCandidateSubmitLease(
+  db: D1Like,
+  tenantId: string,
+  changeId: string,
+  authorizationId: string,
+): Promise<void> {
+  await db.prepare(`
+    UPDATE candidate_submit_leases SET status = 'completed'
+    WHERE tenant_id = ? AND change_id = ? AND authorization_id = ? AND status = 'active'
+  `).bind(tenantId, changeId, authorizationId).run();
+}
+
+/** Release only this attempt; it can never unlock a newer submit. */
+export async function releaseCandidateSubmitLease(
+  db: D1Like,
+  tenantId: string,
+  changeId: string,
+  authorizationId: string,
+): Promise<void> {
+  await db.prepare(`
+    DELETE FROM candidate_submit_leases
+    WHERE tenant_id = ? AND change_id = ? AND authorization_id = ? AND status = 'active'
+  `).bind(tenantId, changeId, authorizationId).run();
+}