@ultimat3/cli 19.1.3 → 19.3.1

package/src/gitignore.ts

@@ -0,0 +1,145 @@
+// What git ignores, as data. The one reader of a `.gitignore` in this package: `dev-watch.ts` asks
+// it which directories `x dev` must not watch, and `fix-path.ts` asks it which citations name a
+// file this repository never commits. A second reader would be a second answer, and the two would
+// disagree on the first pattern neither author anticipated.
+
+// why: Bun exposes no synchronous file read and no synchronous existence primitive —
+// `Bun.file(p).text()` is async, and the ignore set is rebuilt inside an `fs.watch` callback where
+// an await opens a window for the next event. Delete when Bun ships sync equivalents.
+import { existsSync, readFileSync } from 'node:fs';
+// why: Bun exposes no path-join, dirname or relative primitive. The same necessity `fix-path.ts`
+// already records for `join`.
+import { dirname, join, relative, sep } from 'node:path';
+
+/** One line of a `.gitignore`, read for what it states rather than for what a reader assumes. */
+export interface IgnorePattern {
+  /** The glob, without its leading `/` or trailing `/`. */
+  readonly glob: string;
+  /** Held against the whole path relative to the file's own directory, never the basename. */
+  readonly anchored: boolean;
+  /** A trailing `/`: it matches a directory and never a file of that name. */
+  readonly directoryOnly: boolean;
+  /** A leading `!`: it re-includes what an earlier pattern ignored, at the same level. */
+  readonly negated: boolean;
+}
+
+/** One `.gitignore` file and the directory every one of its patterns is relative to. */
+export interface IgnoreScope {
+  readonly base: string;
+  readonly patterns: readonly IgnorePattern[];
+}
+
+/**
+ * A pattern is ANCHORED when it holds a `/` anywhere but at its end — git's own rule, and the one
+ * a hand-rolled reader gets wrong in both directions: `coverage/` ignores a `coverage` directory at
+ * any depth, while `/coverage/` and a pattern holding an inner slash only ever match where they
+ * are written.
+ */
+export function parseGitignore(text: string): readonly IgnorePattern[] {
+  const patterns: IgnorePattern[] = [];
+  for (const raw of text.split('\n')) {
+    // Trailing whitespace carries no rule unless escaped; a leading `#` is a comment, and `\#` is
+    // a filename that starts with one.
+    const line = raw.replace(/\\?\s+$/, (match) => (match.startsWith('\\') ? match : ''));
+    if (line === '' || line.startsWith('#')) continue;
+    const negated = line.startsWith('!');
+    const body = (negated ? line.slice(1) : line).replace(/^\\(?=[#!])/, '');
+    if (body === '' || body === '/') continue;
+    const directoryOnly = body.endsWith('/');
+    const trimmed = directoryOnly ? body.slice(0, -1) : body;
+    const rooted = trimmed.startsWith('/');
+    const glob = rooted ? trimmed.slice(1) : trimmed;
+    if (glob === '') continue;
+    patterns.push({ glob, anchored: rooted || glob.includes('/'), directoryOnly, negated });
+  }
+  return patterns;
+}
+
+/** The patterns one directory's own `.gitignore` states, or none where it has no such file. */
+export function readIgnoreFile(directory: string): readonly IgnorePattern[] {
+  const file = join(directory, '.gitignore');
+  return existsSync(file) ? parseGitignore(readFileSync(file, 'utf8')) : [];
+}
+
+/**
+ * The `.gitignore` files that govern `root`: its own last, then every ancestor up to and including
+ * the directory holding `.git`. Outermost first, so a nearer file's pattern is read last and wins —
+ * `examples/dummy` carries no ignore file of its own and every rule about it lives in the
+ * repository root's, which is why reading one file made `touch tsconfig.tsbuildinfo` a full reload.
+ */
+export function ignoreScopes(root: string): readonly IgnoreScope[] {
+  const scopes: IgnoreScope[] = [];
+  let directory = root;
+  for (;;) {
+    const patterns = readIgnoreFile(directory);
+    if (patterns.length > 0) scopes.unshift({ base: directory, patterns });
+    if (existsSync(join(directory, '.git'))) break;
+    const parent = dirname(directory);
+    if (parent === directory) break;
+    directory = parent;
+  }
+  return scopes;
+}
+
+/** Compiled once per pattern: one `x dev` walk asks the same glob of every directory it meets. */
+const globs = new Map<string, Bun.Glob>();
+
+function globFor(pattern: string): Bun.Glob {
+  const known = globs.get(pattern);
+  if (known !== undefined) return known;
+  const glob = new Bun.Glob(pattern);
+  globs.set(pattern, glob);
+  return glob;
+}
+
+/** The path relative to `base`, POSIX-separated, or `undefined` when it is not under it. */
+function relativeUnder(base: string, path: string): string | undefined {
+  const rel = relative(base, path).split(sep).join('/');
+  return rel === '' || rel.startsWith('../') || rel === '..' ? undefined : rel;
+}
+
+function matches(pattern: IgnorePattern, path: string, isDirectory: boolean): boolean {
+  if (pattern.directoryOnly && !isDirectory) return false;
+  const subject = pattern.anchored ? path : (path.split('/').at(-1) ?? path);
+  return globFor(pattern.glob).match(subject);
+}
+
+/** Last match wins, across every scope in order — git's rule, and the reason `!` works at all. */
+function verdictFor(
+  scopes: readonly IgnoreScope[],
+  path: string,
+  isDirectory: boolean,
+): boolean | undefined {
+  let verdict: boolean | undefined;
+  for (const scope of scopes) {
+    const rel = relativeUnder(scope.base, path);
+    if (rel === undefined) continue;
+    for (const pattern of scope.patterns) {
+      if (matches(pattern, rel, isDirectory)) verdict = !pattern.negated;
+    }
+  }
+  return verdict;
+}
+
+/**
+ * Whether git would ignore this absolute path. Every ancestor between the outermost scope and the
+ * path is judged as a DIRECTORY first: an ignored directory takes everything under it, which is how
+ * `coverage/` reaches `coverage/lcov.info` and the only reason a walk may prune at all.
+ */
+export function isGitIgnored(
+  scopes: readonly IgnoreScope[],
+  path: string,
+  isDirectory: boolean,
+): boolean {
+  const outermost = scopes[0];
+  if (outermost === undefined) return false;
+  const rel = relativeUnder(outermost.base, path);
+  if (rel === undefined) return false;
+  const segments = rel.split('/');
+  for (let depth = 0; depth < segments.length; depth += 1) {
+    const prefix = join(outermost.base, ...segments.slice(0, depth + 1));
+    const last = depth === segments.length - 1;
+    if (verdictFor(scopes, prefix, last ? isDirectory : true) === true) return true;
+  }
+  return false;
+}

package/src/hold.ts

@@ -33,12 +33,15 @@ export interface HoldOptions {
  * handler opened them against. It is the resources core never learned about: the embedded
  * Postgres, the worker, the file watcher.
  *
- * It runs INSIDE the drain's own deadline, and that is not a detail. `drain()` ABANDONS a hook
- * that overruns `ShutdownReason.deadlineAt` — the process is meant to exit without it — and
- * `release` here re-enters the very same teardown one call later: `app.stop()` ->
- * `startRoles().stop()` -> `worker.stop()`, memoised in the package that owns it, so awaiting it
- * is awaiting the promise the drain just walked away from. Unbounded, that hangs forever and the
- * deadline buys nothing.
+ * It is BOUNDED, and that is not a detail. `drain()` ABANDONS a hook that overruns
+ * `ShutdownReason.deadlineAt` — the process is meant to exit without it — and `release` here
+ * re-enters the very same teardown one call later: `app.stop()` -> `startRoles().stop()` ->
+ * `worker.stop()`, memoised in the package that owns it, so awaiting it is awaiting the promise
+ * the drain just walked away from. Unbounded, that hangs forever and the deadline buys nothing.
+ *
+ * The bound is what is LEFT of the drain's budget, under a floor of `MIN_RELEASE_MS` — see there
+ * for why the remainder alone answered `0` on every busy pod and abandoned the teardown before it
+ * closed anything.
  */
 export function holdUntilShutdown(
   name: string,
@@ -48,8 +51,8 @@ export function holdUntilShutdown(
   const uninstall = installSignalHandlers({ exit: false });
   let unregister = (): void => {};
   // The hook's own `reason`, not a stopwatch of ours: `deadlineAt` is the instant core computed
-  // when the drain began, on the same real monotonic clock, so this budget IS the drain's budget
-  // rather than a second one that happens to be the same length.
+  // when the drain began, on the same real monotonic clock, so what is left of the drain's budget
+  // is read off the drain's own number and never off a second one of the same length.
   const shuttingDown = new Promise<number>((resolve) => {
     unregister = onShutdown(
       `cli:${name}:hold`,
@@ -71,7 +74,7 @@ export function holdUntilShutdown(
       await drain();
       unregister();
       uninstall();
-      await releaseWithin(name, release, deadlineAt - systemClock.monotonic());
+      await releaseWithin(name, release, releaseBudgetMs(deadlineAt - systemClock.monotonic()));
       options.exit?.(0);
     })();
     return held;
@@ -79,33 +82,63 @@ export function holdUntilShutdown(
 }
 
 /**
- * `release()` raced against what is left of the drain's budget.
+ * The floor under `release`'s budget, and the reason the drain's REMAINDER alone is the wrong one.
+ *
+ * The remainder is what is left of a budget that was spent on something else. A drain that used
+ * all of it — one request over budget is enough, and that is the ordinary shutdown on a busy pod —
+ * hands `release` a NEGATIVE number, `Math.max(0, …)` reads it as `0`, and `setTimeout(resolve, 0)`
+ * wins against any teardown whose first await is real work. Measured at `deadlineMs: 60` with one
+ * `beginWork()` outstanding: the release STARTED and was abandoned 0ms later, so `app.stop()` never
+ * reached the pool close, the NATS close, the cache tiers or the mail driver, and the outbox relay
+ * was abandoned somewhere between `driver.enqueue` and `markPublished` — a duplicate job on the
+ * next boot. The abandonment is not the harmless "exit slightly early" it was written as: it is
+ * every resource the process holds, left to the kernel.
+ *
+ * So `release` gets a budget of its own, floored, never a leftover. 5s, and the arithmetic is
+ * what makes it defensible rather than a feel: `DEFAULT_DEADLINE_MS` is 25s
+ * (`packages/core/src/lifecycle.ts`) and `docker/helm/templates/deployments.yaml` sets
+ * `terminationGracePeriodSeconds: 45`, so a drain that spends everything PLUS a release that
+ * spends everything is 30s — still inside the grace period, so the kubelet never SIGKILLs a
+ * process this floor kept alive. It stays a floor and not a clamp: an app that raised
+ * `deadlineMs` for a slow teardown keeps the bigger number.
+ */
+export const MIN_RELEASE_MS = 5_000;
+
+/**
+ * What `release` really gets. Non-finite is the floor rather than the input, for the reason
+ * `packages/core/src/lifecycle-bounds.test.ts` exists: `Math.max(n, NaN)` is `NaN` and
+ * `setTimeout(fn, NaN)` fires on the next tick, which is this whole defect a second time.
+ */
+export const releaseBudgetMs = (remainingMs: number): number =>
+  Number.isFinite(remainingMs) ? Math.max(MIN_RELEASE_MS, remainingMs) : MIN_RELEASE_MS;
+
+/**
+ * `release()` raced against its own budget.
  *
  * A local race and not core's `settleWithin`, which is internal to `lifecycle-deadline.ts` and not
  * on core's barrel. The semantics are deliberately the same, including the one that matters: a
  * REJECTION still rejects — `dispatch` awaits the hold inside its own `try`, and an embedded
  * database that would not close is a finding on the way out, never a clean exit over it.
- *
- * A budget already spent is `0`, and that abandons immediately by design: past `deadlineAt` the
- * orchestrator is already counting down to SIGKILL, so the honest move is to say so and exit
- * rather than to start a second grace period nobody granted.
  */
 async function releaseWithin(
   name: string,
   release: () => Promise<void>,
   budgetMs: number,
 ): Promise<void> {
-  const budget = Math.max(0, budgetMs);
+  // Screened by `releaseBudgetMs`, which is the one answer to "how long does a teardown get" —
+  // a second `Math.max` here would be a second, quieter one.
   let timer: ReturnType<typeof setTimeout> | undefined;
   const abandoned = new Promise<'abandoned'>((resolve) => {
-    timer = setTimeout(() => resolve('abandoned'), budget);
+    timer = setTimeout(() => resolve('abandoned'), budgetMs);
   });
   try {
     const outcome = await Promise.race([release().then(() => 'released' as const), abandoned]);
     if (outcome === 'released') return;
     logger.warn('X_SHUTDOWN_TIMEOUT', {
       code: 'X_SHUTDOWN_TIMEOUT',
-      cause: `the "${name}" release was still running ${budget}ms after the drain finished and has been ABANDONED — the process exits without it, so anything it held may not be closed`,
+      // Rounded: `deadlineAt - monotonic()` is a float, and `4923.185900000001ms` in a shutdown
+      // log reads as a bug in the number rather than as the budget it is.
+      cause: `the "${name}" release was still running ${Math.round(budgetMs)}ms after the drain finished and has been ABANDONED — the process exits without it, so anything it held may not be closed`,
       fix: 'raise the budget past the slowest teardown — configureLifecycle({ deadlineMs: 600_000 }) for a 10-minute one — and set terminationGracePeriodSeconds to at least as many seconds',
     });
   } finally {

package/src/i18n-registration.ts

@@ -19,12 +19,17 @@ import {
   registeredLocales,
 } from '@ultimat3/i18n';
 import { loadApp } from './app-load';
+import type { DuplicateProbe } from './duplicate-packages';
+import { duplicateCause, duplicateFinding, findDuplicateInstalls } from './duplicate-packages';
 import { auditApp } from './i18n-audit';
 import { I18N_INDEX_PATH } from './i18n-index';
 import type { Finding } from './output';
 import { findingFrom } from './output';
 import { CATALOG_ROOT, catalogPath } from './templates/locales';
 
+/** The one package this check probes for a duplicate: its registry is the one it reads. */
+const I18N_PKG = '@ultimat3/i18n';
+
 /**
  * What this check needs of a boot. The seam is injected so a fixture can be exactly "the app
  * loaded and registered nothing" — the shipped shape of the bug — without a temp directory that
@@ -43,6 +48,8 @@ export interface RegistrationInput {
   readonly extraction: Extraction;
   readonly ignoreUnused: readonly string[];
   readonly load?: AppLoader;
+  /** The duplicate-install probe; `findDuplicateInstalls` is the production value. */
+  readonly duplicates?: DuplicateProbe;
 }
 
 export interface RegistrationReport {
@@ -74,17 +81,39 @@ function unresolvedUsedKeys(input: RegistrationInput, locale: Locale): readonly
   return report.locales[0]?.missing ?? [];
 }
 
+/** What `X_PACKAGE_DUPLICATED`'s fix runs once the install is one copy again. */
+const RECHECK = 'x i18n check --json';
+
 export async function checkRegistration(input: RegistrationInput): Promise<RegistrationReport> {
   // Importing the app's modules IS the registration, in this process exactly as in the server's.
   const app = await (input.load ?? loadApp)(input.root);
 
+  // Asked BEFORE the registry is: two copies of `@ultimat3/i18n` in one app are two registries,
+  // and every gap below is then a symptom of the install, not of where `defineCatalogs()` sits.
+  // Reported even with no gap — the CLI may share the app's index module's copy while a page in
+  // another workspace reads the other, which renders `⟦key⟧` under a green gate.
+  const duplicate = (await (input.duplicates ?? findDuplicateInstalls)(input.root, [I18N_PKG]))[0];
   const gaps = catalogRegistrationGaps(input.catalogs);
   const index = await indexSource(input.root);
-  const findings: Finding[] = gaps.map((gap) => ({
-    ...findingFrom(catalogUnregistered(gap)),
-    ...unregisteredFix(gap.locale, index),
-    at: catalogPath(gap.locale),
-  }));
+  const findings: Finding[] =
+    duplicate === undefined ? [] : [duplicateFinding(input.root, duplicate, RECHECK)];
+  for (const gap of gaps) {
+    const finding = findingFrom(catalogUnregistered(gap));
+    findings.push(
+      duplicate === undefined
+        ? { ...finding, ...unregisteredFix(gap.locale, index), at: catalogPath(gap.locale) }
+        : // The registry's own fix names a source edit — move the `defineCatalogs()` call — that an
+          // agent following it performs on a file that is already right (ai-maxxing, 2026-09-05).
+          // With a duplicate on disk the cause IS the install, so the finding says so and the fix
+          // is the one the duplicate carries.
+          {
+            ...finding,
+            cause: `${duplicateCause(input.root, duplicate)}; ${gap.missing.length} of ${catalogPath(gap.locale)}'s ${gap.shipped} key(s) registered into the copy the CLI does not read`,
+            fix: findings[0]?.fix ?? finding.fix,
+            at: catalogPath(gap.locale),
+          },
+    );
+  }
   let unregistered = gaps.reduce((sum, gap) => sum + gap.missing.length, 0);
   let locales = gaps.length;
 

package/src/index.ts

@@ -68,7 +68,7 @@ export { deployCommand, planDeploy } from './cmd-deploy';
 export type { DevServer, StartDevOptions } from './cmd-dev';
 export { devCommand, startDev } from './cmd-dev';
 export type { DoctorProbe } from './cmd-doctor';
-export { doctorCommand, OFFLINE_FALLBACK, probeFor, runDoctor } from './cmd-doctor';
+export { doctorCommand, ENV_DEVELOPMENT, probeFor, runDoctor } from './cmd-doctor';
 export { ERRORS_SUBCOMMANDS, errorsCommand } from './cmd-errors';
 export { FIX_SUBCOMMANDS, fixCommand } from './cmd-fix';
 export type { GenerateOptions, Generator } from './cmd-generate';
@@ -361,6 +361,8 @@ export {
   skipReasonFor,
   writeStaticReport,
 } from './static-report';
+export type { StyleBundle, StyleChunk } from './style-bundle';
+export { STYLE_BASE_PATH, styleBundle } from './style-bundle';
 export type { TestCounts } from './test-counts';
 export { countsOf } from './test-counts';
 export type { TestFile } from './test-select';

package/src/island-bundle.ts

@@ -1,16 +1,18 @@
 // The island chunk table: every `*.island.tsx` in the app compiled as its OWN bundle entry point,
-// content-hashed, plus the resolver that turns a page's `src` specifier into the URL its
+// addressed by a hash of its SOURCE GRAPH (`graphHash` — `Bun.build`'s minified output is not
+// byte-deterministic), plus the resolver that turns a page's `src` specifier into the URL its
 // `data-x-entry` carries. One entry point per island is axiom 6 made mechanical — the page's graph
 // never reaches an island, so a `site/` document stays at 0kb whatever the island imports.
 
 // Bun ships no path API. `posix` does the specifier arithmetic (an app-relative route file is
 // POSIX by construction), `join`/`basename` the filesystem side.
 import { basename, join, posix, relative, sep } from 'node:path';
-import { renderThrowable } from '@ultimat3/core';
+import { frameworkVersion, renderThrowable } from '@ultimat3/core';
 import { ISLAND_EXTENSION, IslandInvalidError, islandModuleId } from '@ultimat3/render';
 import { contentHash } from '@ultimat3/render/server';
 import { IslandBuildFailedError } from './errors';
 import { islandStylesPlugin } from './island-styles';
+import { hasPathSegment } from './path-segments';
 import { solidJsxPlugin } from './solid-loader';
 
 /**
@@ -32,7 +34,10 @@ export interface IslandChunk {
   readonly file: string;
   /** `islandModuleId` of the filename — the id the document, the budget and a finding all name. */
   readonly moduleId: string;
-  /** Immutable, content-addressed URL. What `data-x-entry` carries and what a route serves. */
+  /**
+   * Immutable, source-addressed URL. What `data-x-entry` carries and what a route serves — stable
+   * for as long as the sources, the framework version and the Bun version are. See `graphHash`.
+   */
   readonly url: string;
   /** The built JavaScript. Held in memory so `x dev` and the container serve without a disk hop. */
   readonly code: string;
@@ -55,7 +60,7 @@ export interface IslandBundle {
 export async function discoverIslands(root: string): Promise<readonly string[]> {
   const files: string[] = [];
   for await (const absolute of new Bun.Glob(ISLAND_GLOB).scan({ cwd: root, absolute: true })) {
-    if (absolute.includes('node_modules')) continue;
+    if (hasPathSegment(absolute, 'node_modules')) continue;
     files.push(relative(root, absolute).split(sep).join('/'));
   }
   return files.sort();
@@ -101,30 +106,138 @@ async function buildOne(root: string, file: string): Promise<IslandChunk> {
       // `x dev` serves the same chunk the container does, and bytes that depend on the ambient
       // NODE_ENV are a content hash and a byte budget measured on a build nobody ships.
       define: { 'process.env.NODE_ENV': '"production"' },
+      // The fourth, and it is asked for its INPUT list rather than its output: `sourcesContent` is
+      // the whole module graph this chunk was built from, which is the only stable identity a
+      // chunk has. See `graphHash`. Measured on 1.4.0 against a 131 kB island: 277ms with it and
+      // 276ms without, so the map costs nothing worth naming.
+      sourcemap: 'external',
     });
   } catch (error) {
     throw new IslandBuildFailedError({ file, logs: describeBuildError(error) });
   }
   const output = built.outputs.find((artifact) => artifact.kind === 'entry-point');
-  if (!built.success || output === undefined) {
+  const map = built.outputs.find((artifact) => artifact.kind === 'sourcemap');
+  if (!built.success || output === undefined || map === undefined) {
     throw new IslandBuildFailedError({
       file,
       logs: built.logs.map((log) => String(log)).join('; '),
     });
   }
-  const code = await output.text();
+  const code = stripDebugId(await output.text());
+  const hash = graphHash(file, await map.text());
   const moduleId = islandModuleId(basename(file));
   return {
     file,
     moduleId,
-    // Hashed with the framework's own `contentHash`, the function that already stamps an ETag and
-    // a precache revision — one identity for a byte string, not a third.
-    url: `${ISLAND_BASE_PATH}/${moduleId}-${contentHash(code)}.js`,
-    code,
+    url: `${ISLAND_BASE_PATH}/${moduleId}-${hash}.js`,
+    // The FIRST bytes this process emitted for these inputs, so a URL served `immutable` answers
+    // one byte string for as long as the process lives. Without it `x dev` re-mints the chunk on
+    // every watcher tick and a browser holding the previous one under `max-age=31536000` has two
+    // different files at one address.
+    code: stableCode(file, hash, code),
     bytes: new TextEncoder().encode(code).byteLength,
   };
 }
 
+/**
+ * `sourcemap: 'external'` appends `//# debugId=<hex>` to the chunk. It is a pointer to a map this
+ * framework does not serve, so it is removed rather than shipped — and removing it makes the
+ * emitted bytes identical to what the same build produced before the map was asked for, which is
+ * what keeps `bytes` a budget number and not a build-flag artefact. `slice`, never a `replace` with
+ * an empty replacement — `bun run sql-literal-copies` refuses that shape anywhere but `db/sql.ts`.
+ */
+const DEBUG_ID_COMMENT = '\n//# debugId=';
+
+function stripDebugId(code: string): string {
+  const at = code.lastIndexOf(DEBUG_ID_COMMENT);
+  return at === -1 ? code : code.slice(0, at);
+}
+
+/**
+ * The chunk's identity, computed from what went IN rather than from what came out.
+ *
+ * `Bun.build` is not byte-deterministic under `minify`. Measured on 1.4.0, one entry point, no
+ * source file touched: a 131,589-byte island alternated between two outputs of IDENTICAL length
+ * differing only in minified identifier names (`var ca=Object.defineProperty` against
+ * `var la=…`) — roughly one build in ten, which is a race in the renamer and not anything a caller
+ * can order. Hashing that output made the URL flap: ten distinct `session-console-*.js` names in
+ * ten minutes, so a service worker's precache manifest named a chunk that already 404ed and a
+ * browser's `immutable` cache never hit on a 131 kB download. Twelve consecutive builds hash
+ * identically here.
+ *
+ * `sourcesContent`, hashed per file and SORTED, so the identity is independent of the order the
+ * bundler happened to visit the graph in. The PATHS are deliberately not in it: they are absolute
+ * on the build machine and would make a chunk built in a container disagree with the same chunk
+ * built on a laptop for no difference a browser could observe. `file` is, so two islands with
+ * byte-identical sources under different names stay two chunks; the framework version and the Bun
+ * version are, because both decide the emitted bytes while no source file moves — an upgrade must
+ * mint a new URL rather than leave a stale chunk pinned in a browser for a year.
+ *
+ * What this gives up, stated plainly: the URL is source-addressed, not byte-addressed, so two
+ * processes building the same sources can serve two byte-strings at one URL. They are the same
+ * program under different local identifier names. That is the trade a nondeterministic bundler
+ * forces, and the alternative — `minify: { identifiers: false }`, which IS deterministic — was
+ * measured at 193,590 bytes against 131,649, +47% raw and +20% gzipped, on every island of every
+ * app. Delete this the day `Bun.build` is deterministic.
+ */
+function graphHash(file: string, map: string): string {
+  const parsed: unknown = JSON.parse(map);
+  const contents = sourcesContentOf(parsed);
+  if (contents === undefined) {
+    throw new IslandBuildFailedError({
+      file,
+      logs: 'the bundler emitted a source map with no sourcesContent, so the chunk has no stable identity',
+    });
+  }
+  const graph = contents.map((source) => contentHash(source)).sort();
+  return contentHash([file, frameworkVersion(), Bun.version, ...graph].join('\u0000'));
+}
+
+/**
+ * `sourcesContent`, read the way `aggregatedErrors` below reads `errors`: narrowed first,
+ * dereferenced inside a `try`, `undefined` for anything that is not a full list of strings. A
+ * partial list is refused rather than padded — a graph with holes in it hashes two different
+ * islands the same.
+ */
+function sourcesContentOf(value: unknown): readonly string[] | undefined {
+  if (typeof value !== 'object' || value === null) return undefined;
+  try {
+    const held: unknown = (value as Record<string, unknown>)['sourcesContent'];
+    if (!Array.isArray(held) || held.length === 0) return undefined;
+    return held.every((one: unknown) => typeof one === 'string')
+      ? (held as readonly string[])
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The code this process already emitted for these inputs, or the code it just built.
+ *
+ * Keyed by PATH and validated by the input hash, `transformIslandTsx`'s cache's shape and for its
+ * reason: one entry per island bounds the map by the island count, which is the only quantity that
+ * should bound it, and an entry whose hash no longer matches is replaced rather than served.
+ */
+const emitted = new Map<string, { readonly graph: string; readonly code: string }>();
+
+/** Test seam: the table is process-global because the dev server it serves is too. */
+export function clearIslandChunkCache(): void {
+  emitted.clear();
+}
+
+/**
+ * `graph`, never `hash`: `bun run secret-compare` reads the NAME of a comparison's operands, and a
+ * value called `hash` is a digest an attacker may be probing. This one is a build input's
+ * identity — the same reason `pr-threads.ts` calls a review state `wanted`.
+ */
+function stableCode(file: string, graph: string, code: string): string {
+  const hit = emitted.get(file);
+  if (hit !== undefined && hit.graph === graph) return hit.code;
+  emitted.set(file, { graph, code });
+  return code;
+}
+
 /**
  * The bundler's own diagnostics, kept verbatim. An `AggregateError` holds one entry per unresolved
  * import or syntax error, and flattening them is what puts the line number in the cause instead of

package/src/island-harness.ts

@@ -13,9 +13,9 @@ import {
   islandModuleId,
   SURFACES,
 } from '@ultimat3/render';
-import { stylesFor } from '@ultimat3/render/server';
 import type { IslandShotTarget, IslandState } from '@ultimat3/testing';
 import { harnessScript } from './island-harness-script';
+import { styleBundle } from './style-bundle';
 
 /** Where the harness lives in `x dev`'s own namespace, so no app route can shadow it. */
 export const ISLAND_HARNESS_PATH = '/_x/island';
@@ -43,8 +43,13 @@ export function surfaceOf(island: string): Surface | null {
  * off because a picture taken mid-transition is a picture of a moment no user experiences; the
  * caret is invisible because a focused input blinks and two otherwise identical runs then differ.
  * Colours are semantic tokens, never literals — the app's own global layer defines them.
+ *
+ * Exported so `x dev` can hash it into `style-src`: it is emitted INLINE, so a policy that does
+ * not name it blocks the frame under an enforced CSP. It was never hashed at all until
+ * 2026-09-06 — invisible because `x dev` sends the policy report-only, which is exactly how the
+ * hydration runtime shipped blocked once already.
  */
-const FRAME_STYLE = `
+export const FRAME_STYLE = `
 *,*::before,*::after{animation:none !important;transition:none !important;
 scroll-behavior:auto !important;caret-color:transparent !important}
 html{background:rgb(var(--color-bg) / 1)}
@@ -74,13 +79,15 @@ export function harnessPage(input: HarnessPageInput): string {
     entry: input.entry,
     props: input.state.props,
   };
-  const css = stylesFor(surfaceOf(input.target.island));
+  // The same content-hashed file every real document links, so the picture is taken against the
+  // bytes a visitor gets — and the harness stops carrying 157 kB of inline CSS of its own.
+  const href = styleBundle().hrefFor(surfaceOf(input.target.island));
   return [
     '<!doctype html>',
     `<html lang="en" data-theme="${input.target.theme}">`,
     '<head><meta charset="utf-8">',
     `<title>${input.target.name} · ${input.target.state} · ${input.target.theme}</title>`,
-    css.length === 0 ? '' : `<style>${css}</style>`,
+    href === undefined ? '' : `<link rel="stylesheet" href="${href}">`,
     `<style>${FRAME_STYLE}</style>`,
     // Before the body and before every module script, which is the only ordering in which the
     // seal can catch a component's first request.

package/src/island-states-load.ts

@@ -16,6 +16,7 @@ import {
 } from '@ultimat3/testing';
 import { ISLAND_GLOB } from './island-bundle';
 import { IslandStatesFileEmptyError } from './island-shot-errors';
+import { hasPathSegment } from './path-segments';
 
 /**
  * `.island.states.ts`, built from the two constants that own its halves and restated as neither:
@@ -37,7 +38,7 @@ export async function discoverIslandStates(root: string): Promise<readonly strin
   const files: string[] = [];
   const scan = new Bun.Glob(ISLAND_STATES_GLOB).scan({ cwd: root, absolute: true });
   for await (const absolute of scan) {
-    if (absolute.includes('node_modules')) continue;
+    if (hasPathSegment(absolute, 'node_modules')) continue;
     files.push(relative(root, absolute).split(sep).join('/'));
   }
   return files.sort();

package/src/jobs-driver.ts

@@ -24,7 +24,10 @@ export async function withJobDriver(
   const ambient = jobDriver();
   if (ambient !== undefined) return fn(ambient);
   const services = resolveServices(root, ctx.env);
-  const queue = await startQueue(services);
+  // The command's own environment on both halves: `resolveServices` reads DATABASE_URL off it, so
+  // a queue that resolved its standby from `process.env` would talk to a pair the same call had
+  // just decided against.
+  const queue = await startQueue(services, undefined, ctx.env);
   try {
     return await fn(queue.jobs);
   } finally {

package/src/mcp-errors.ts

@@ -52,6 +52,8 @@ const CLI_FIXES: Readonly<Record<CliErrorCode, string>> = {
     'x verify --json   # the finding names the fix line and the path it cites',
   X_WORKSPACE_DEP_UNDECLARED:
     'x verify --json   # the package-shape finding carries the dependency line to add',
+  X_PACKAGE_DUPLICATED:
+    'x i18n check --json   # the finding names both copies and the package.json to pin',
   X_SHOT_BROWSER_MISSING: 'bun add -d puppeteer-core',
   // The four island-capture codes. Each one's real repair is an edit to the app's own states file
   // or component, which no command can perform — so each names the command that REPRODUCES it with