@ultimat3/cli 20.2.1 → 22.0.0

package/src/serve.ts

@@ -4,211 +4,33 @@
 // `dev: true`. The only production-shaped decisions live here: which role, which port, and which
 // interface — every one by default, because a container is reached through a port mapping.
 
-import type { Role } from '@ultimat3/core';
-import {
-  configureErrorReporting,
-  isRole,
-  logger,
-  ROLES,
-  sentryErrorReporter,
-} from '@ultimat3/core';
-import {
-  assertNoDrift,
-  checkDrift,
-  type DriftReport,
-  type MigrationReport,
-  migrate,
-} from '@ultimat3/db';
-import type { Route } from '@ultimat3/http';
-import { describeRoutes } from '@ultimat3/render';
-import { createIsrController } from '@ultimat3/render/server';
-import { apiRoutes } from './api-routes';
-import { loadSignInPath } from './app-auth';
-import { loadApp } from './app-load';
-import { appManifest } from './app-manifest';
-import { mountAppMcp } from './app-mcp';
+import { assertNoDevSecretsOutsideLocal, logger } from '@ultimat3/core';
+import { assertNoDrift, checkDrift, migrate } from '@ultimat3/db';
 import { loadAppRuntime } from './app-runtime';
 import { acceptCreatedTables } from './db-accept-created';
-import { assetRoutes } from './dev-assets';
-import { startQueue } from './dev-queue';
-import { appRoutes } from './dev-render';
-import { replicaOverrides } from './dev-replica';
-import type { RunningRoles, WebBinding } from './dev-roles';
-import { startRoles } from './dev-roles';
-import type { RunningServices } from './dev-runtime';
-import { startServices } from './dev-runtime';
-import type { Env } from './dev-services';
-import { resolveServices } from './dev-services';
-import { storageRoutes } from './dev-storage';
-import { errorPageStyleSources } from './error-page-csp';
-import { PortInvalidError, RoleUnknownError } from './errors';
 import { holdUntilShutdown } from './hold';
-import { buildIslands } from './island-bundle';
-import { islandRoutes } from './island-routes';
-import { DEFAULT_METRICS_PORT } from './metrics-endpoint';
+import { startMetricsEndpoint } from './metrics-endpoint';
 import { readMigrations } from './migrations';
-import { startOtlpExport } from './otlp-export';
-import { loadPwaArtifacts } from './pwa-artifacts';
-import type { RuntimeOverrides } from './runtime-overrides';
-import { styleBundle } from './style-bundle';
-import { styleRoutes } from './style-routes';
-import { serviceWorkerArtifacts } from './sw-artifacts';
-import { serviceWorkerRoutes } from './sw-routes';
-import { loadThemeMode, themeBoot } from './theme-boot';
-
-export const DEFAULT_PORT = 3000;
-
-/**
- * Every interface, which is what a role binds when nothing says otherwise: a container bound to
- * loopback is unreachable through its own port mapping. `HOST` and `ServeOptions.hostname` are the
- * two ways of saying otherwise — see `hostnameFromEnv`.
- */
-export const CONTAINER_BINDING: WebBinding = { dev: false, hostname: '0.0.0.0' };
-
-/**
- * The interface the `web` and `sync` roles bind, and the metrics endpoint with them (`WebBinding`
- * is one decision). Read the way `PORT` is: empty or whitespace is the default.
- *
- * Exists because a container had exactly one binding, `0.0.0.0`, and an app whose auth mode is
- * "nobody logs in, one implicit actor" must refuse a public interface — so it could not run in a
- * container at all. `HOST=127.0.0.1` is unreachable through `docker run -p` (the proxy connects to
- * the container's bridge address, never its loopback); it is reachable where the container shares
- * the host's network namespace (`--network host`), or through a sidecar and `ssh -L` inside it —
- * which is the exposure such an app wants. Not `HOSTNAME`: Docker sets that to the container id.
- */
-export function hostnameFromEnv(env: Env): string {
-  const raw = env['HOST']?.trim();
-  return raw === undefined || raw.length === 0 ? CONTAINER_BINDING.hostname : raw;
-}
-
-/** What `serveApp` hands `startRoles`: the caller's hostname, else `HOST`, else every interface. */
-export const containerBinding = (env: Env, hostname?: string): WebBinding => ({
-  dev: false,
-  hostname: hostname ?? hostnameFromEnv(env),
-});
-
-/**
- * `ROLE` is the one knob one image exposes. Validated rather than defaulted: a typo that fell back
- * to `web` would start a process that serves nothing the operator asked for and reports healthy.
- */
-export function roleFromEnv(env: Env): Role {
-  const raw = env['ROLE'] ?? 'web';
-  if (!isRole(raw)) throw new RoleUnknownError({ role: raw, known: ROLES });
-  return raw;
-}
-
-/**
- * `Number.parseInt` would read `80abc` as 80, so the whole string has to be a port — a
- * partially-parsed port is a deploy that binds somewhere nobody asked for.
- */
-function portValue(env: Env, name: string, fallback: number): number {
-  const raw = env[name];
-  if (raw === undefined || raw.trim().length === 0) return fallback;
-  const port = Number(raw.trim());
-  if (!Number.isInteger(port) || port < 0 || port > 65_535)
-    throw new PortInvalidError({ value: raw, name });
-  return port;
-}
-
-/** Every PaaS injects `PORT` and routes traffic to exactly it. */
-export function portFromEnv(env: Env): number {
-  return portValue(env, 'PORT', DEFAULT_PORT);
-}
-
-/**
- * The scrape port, deliberately its own env var and not `PORT + n`: an operator who moves the app
- * port must not silently move the port their Prometheus is configured against, and the roles that
- * set no `PORT` at all — `worker`, `scheduler`, `replicator` — still need this one.
- */
-export function metricsPortFromEnv(env: Env): number {
-  return portValue(env, 'METRICS_PORT', DEFAULT_METRICS_PORT);
-}
-
-/**
- * The scrape port a boot uses, given the app port it already resolved. One expression, and it is
- * exported because `x dev` is the second caller: `cmd-dev.ts` passed no `metricsPort` at all, so
- * `METRICS_PORT` was honoured in the container and ignored on a laptop — the dev/prod parity break
- * `dev-roles.ts`'s own header forbids, and a second copy of this rule would be the same break
- * one edit later.
- *
- * An in-process caller asking for an ephemeral app port is a test, and a test that grabbed the
- * fixed 9090 would fail the next suite to boot beside it. An environment that names the port still
- * wins — that is the deploy talking.
- */
-export const metricsPortFor = (env: Env, port: number, override?: number): number =>
-  override ?? (port === 0 && env['METRICS_PORT'] === undefined ? 0 : metricsPortFromEnv(env));
-
-/**
- * The one env var that turns error monitoring on, and the only vendor-shaped name in the boot
- * path. Not a platform primitive (axiom 7): the value is a URL to whatever the operator runs, the
- * wire format behind it is documented and self-hostable, and `SENTRY_DSN` is what every monitor
- * that speaks it already documents — inventing a second spelling would mean an operator's existing
- * tooling sets a variable this framework ignores. Exactly the precedent
- * `OTEL_EXPORTER_OTLP_ENDPOINT` already sets in `docker/helm/values.yaml`.
- */
-export const ERROR_DSN_KEY = 'SENTRY_DSN';
-
-/**
- * Switch reporting on for this process. Unset DSN leaves core's no-op reporter in place, so a
- * laptop and a CI run pay nothing and page nobody — and the release every event carries is the
- * build id this boot already computed, never a second identity for the same deploy.
- */
-export function configureReporting(env: Env, buildId: string): void {
-  const dsn = env[ERROR_DSN_KEY]?.trim();
-  configureErrorReporting({
-    release: buildId,
-    // A malformed DSN throws here, at boot, rather than at the first outage: a monitor that was
-    // never connected looks exactly like an app that never failed.
-    ...(dsn === undefined || dsn.length === 0 ? {} : { reporter: sentryErrorReporter({ dsn }) }),
-  });
-}
-
-export interface ServeOptions {
-  readonly root: string;
-  readonly env: Env;
-  /** Overrides `ROLE`; `runRole` reads the environment when this is absent. */
-  readonly role?: Role;
-  /** Overrides `PORT`. 0 asks the kernel for an ephemeral one, which is what a test wants. */
-  readonly port?: number;
-  /** Overrides `METRICS_PORT`, on the same terms. */
-  readonly metricsPort?: number;
-  /**
-   * Overrides `HOST`: the interface the HTTP roles bind. An app that must never answer on a public
-   * interface passes `'127.0.0.1'` here rather than trusting the deployment to set the variable.
-   */
-  readonly hostname?: string;
-  /**
-   * The drivers this deployment supplies instead of the ones the environment would select.
-   *
-   * This field is why `apps/web/server.ts` can stay three lines and still run a custom queue, a
-   * shared ISR store or an app's own middleware. Before it there was nowhere to hand the framework
-   * a driver, so the only way was an ambient setter from an app module — which `loadApp` imports
-   * AFTER `startServices` has captured its own, giving a process that enqueues to one queue and
-   * claims from another. `startRoles` now refuses that split outright.
-   */
-  readonly runtime?: RuntimeOverrides;
-}
-
-export interface ServedApp {
-  readonly kind: 'served';
-  readonly role: Role;
-  /** `http://…` for the web role; null for the roles that open no HTTP socket. */
-  readonly url: string | null;
-  readonly buildId: string;
-  readonly running: RunningRoles;
-  readonly runtime: RunningServices;
-  stop(): Promise<void>;
-}
-
-export interface MigratedApp {
-  readonly kind: 'migrated';
-  readonly role: 'migrate';
-  readonly report: MigrationReport;
-  /** The post-condition: the live schema against the ledger this run just wrote. */
-  readonly drift: DriftReport;
-}
-
-export type StartedApp = ServedApp | MigratedApp;
+import { resolveServices } from './runtime-bindings';
+import { startQueue } from './runtime-queue';
+import { startServices } from './runtime-services';
+import { bootRoles } from './serve-boot';
+import { containerBinding, metricsPortFor, portFromEnv, roleFromEnv } from './serve-env';
+import type { MigratedApp, ServedApp, ServeOptions, StartedApp } from './serve-types';
+
+export {
+  CONTAINER_BINDING,
+  configureReporting,
+  containerBinding,
+  DEFAULT_PORT,
+  ERROR_DSN_KEY,
+  hostnameFromEnv,
+  metricsPortFor,
+  metricsPortFromEnv,
+  portFromEnv,
+  roleFromEnv,
+} from './serve-env';
+export type { MigratedApp, ServedApp, ServeOptions, StartedApp } from './serve-types';
 
 /**
  * The release phase, as a role. `migrate` is not a server: it applies the app's own migrations
@@ -308,153 +130,37 @@ export async function withAppRuntime(options: ServeOptions): Promise<ServeOption
 }
 
 export async function serveApp(input: ServeOptions): Promise<ServedApp> {
+  // FIRST, before any service starts: a production process on a key this framework publishes is
+  // refused, rather than reported by `x doctor` and served anyway (plan 101, slices 01 e and 12 h).
+  // The storage twin is `startStorage`'s own `LocalDiskUnsafeError`, one step later, where the
+  // disk is chosen.
+  assertNoDevSecretsOutsideLocal({ env: input.env });
   const options = await withAppRuntime(input);
   const role = options.role ?? roleFromEnv(options.env);
-  const runtime = await startServices(
-    resolveServices(options.root, options.env),
-    options.env,
-    options.runtime,
-  );
+  // The scrape listener before ANY boot work — the services, the app's modules, the island build —
+  // so a cold pod answers `/metrics` (and the chart's startup probe on it) while it boots. It was
+  // opened inside `startRoles`, after all of that, so `_helpers.tpl`'s "FIRST" was not true.
+  const port = options.port ?? portFromEnv(options.env);
+  const metrics = startMetricsEndpoint({
+    port: metricsPortFor(options.env, port, options.metricsPort),
+    hostname: containerBinding(options.env, options.hostname).hostname,
+  });
   // Everything acquired from here down, in order, so a throw anywhere below gives it all back.
-  const acquired: (() => void | Promise<void>)[] = [() => runtime.stop()];
+  const acquired: (() => void | Promise<void>)[] = [() => metrics.stop()];
   try {
-    return await bootRoles({ options, role, runtime, acquired });
+    const runtime = await startServices(
+      resolveServices(options.root, options.env),
+      options.env,
+      options.runtime,
+    );
+    acquired.push(() => runtime.stop());
+    return await bootRoles({ options, role, runtime, acquired, metrics });
   } catch (error) {
     await releaseBoot(acquired);
     throw error;
   }
 }
 
-/** The half of `serveApp` whose every acquisition is registered for rollback. */
-async function bootRoles(boot: {
-  readonly options: ServeOptions;
-  readonly role: Role;
-  readonly runtime: RunningServices;
-  readonly acquired: (() => void | Promise<void>)[];
-}): Promise<ServedApp> {
-  const { options, role, runtime, acquired } = boot;
-  // Importing the app's modules IS the registration: every route, action and job below is
-  // whatever this call put in the registries.
-  await loadApp(options.root);
-  // The build stamps `BUILD_ID` into the image; unstamped, the manifest's content hash is the same
-  // answer computed here, so `x-ultimate-build` is never absent and never a lie. Projected only
-  // when unstamped, because a stamped image already paid for it at build time and a replica's boot
-  // should not repeat it — the load above is the part every boot needs either way.
-  const stamped = options.env['BUILD_ID'];
-  const buildId =
-    stamped !== undefined && stamped.length > 0
-      ? stamped
-      : (await appManifest(options.root)).manifest.buildId;
-  // Before the first socket opens: everything above this line fails loudly into the container's
-  // own logs, everything below it is a served request, a claimed job or a routed frame.
-  configureReporting(options.env, buildId);
-  // Beside error reporting, and for the same reason it is here: `OTEL_EXPORTER_OTLP_ENDPOINT` is
-  // in the shipped chart and nothing read it, so every deployment that configured a collector got
-  // an empty dashboard. `x dev` keeps its own recorder — the `/_x` timeline is a different sink
-  // with a different lifetime — so this is the production boot's alone (axiom 6).
-  const stopOtlp = startOtlpExport(options.env);
-  acquired.push(stopOtlp);
-  // Built at boot rather than shipped prebuilt, so the container serves the same chunks `x dev`
-  // does from the same source — the alternative is a second bundler invocation in the image build
-  // whose output nothing compares against the one the dev loop proved.
-  const islands = await buildIslands(options.root);
-  // The same two strings `x dev` resolves, from the same reader: a `<link rel="manifest">` served
-  // on a laptop and absent in the image is exactly the dev/prod difference this file exists to
-  // prevent, and it is the one an operator cannot see without installing the app.
-  const pwa = await loadPwaArtifacts(options.root);
-  const theme = themeBoot(await loadThemeMode(options.root));
-  // The worker, from the SAME route table this process is about to serve — `describeRoutes()` is
-  // the one projection `x.manifest.json`, `/_x`, the sitemap and `sw.js` are all built from, so a
-  // route added here cannot be missing from the precache manifest.
-  const serviceWorker =
-    pwa === undefined
-      ? undefined
-      : serviceWorkerArtifacts({
-          pwa,
-          buildId,
-          routes: describeRoutes(),
-          islands,
-          styles: styleBundle(),
-        });
-  // The app's own MCP endpoint, through the same call `x dev` makes — see `app-mcp.ts`.
-  const mcpMount = await mountAppMcp(options.root);
-  const routes: readonly Route[] = [
-    ...apiRoutes(),
-    ...mcpMount.routes,
-    ...(serviceWorker === undefined ? [] : serviceWorkerRoutes(serviceWorker)),
-    ...assetRoutes({
-      root: options.root,
-      storage: runtime.storage,
-      ...(options.runtime?.images === undefined ? {} : { images: options.runtime.images }),
-      ...(pwa === undefined ? {} : { pwa }),
-    }),
-    ...storageRoutes({ storage: runtime.storage }),
-    ...islandRoutes(() => islands),
-    // The surface stylesheets the documents link. Built from the registry the `loadApp` above
-    // filled, so this process serves exactly the CSS it renders against.
-    ...styleRoutes(() => styleBundle()),
-    ...appRoutes({
-      buildId,
-      resolveIsland: (file) => islands.resolverFor(file),
-      themeHead: theme.head,
-      ...(pwa === undefined ? {} : { pwaHead: pwa.head + (serviceWorker?.head ?? '') }),
-      // Only when a store was supplied. `createIsrController` defaults to a per-process memory
-      // store, so twelve replicas hold twelve of them and a purge tag regenerates one twelfth of
-      // the fleet while the other eleven keep serving the page it just invalidated.
-      ...(options.runtime?.isrStore === undefined
-        ? {}
-        : { isr: createIsrController({ buildId, store: options.runtime.isrStore }) }),
-    }),
-  ];
-  const port = options.port ?? portFromEnv(options.env);
-  // An in-process caller asking for an ephemeral app port is a test, and a test that grabbed the
-  // fixed 9090 would fail the next suite to boot beside it. An environment that names the port
-  // still wins — that is the deploy talking.
-  const metricsPort = metricsPortFor(options.env, port, options.metricsPort);
-  const replicaOverride = replicaOverrides(options.runtime, runtime.services.db, options.env);
-  const running = await startRoles({
-    roles: [role],
-    port,
-    metricsPort,
-    buildId,
-    runtime,
-    routes,
-    env: options.env,
-    // Same declaration `x dev` reads. Without it a container answers a browser that opened a
-    // guarded page with the problem document, rendered as raw JSON in the viewport.
-    signInPath: await loadSignInPath(options.root),
-    // The enforced policy this process sends must admit the app's own error pages' `<style>` and
-    // the theme boot the documents carry; `x dev` is report-only, so only here was it a blank page.
-    inlineStyles: await errorPageStyleSources(options.root),
-    inlineScripts: [theme.cspSource],
-    // The app's own `apps/web/site/errors/<status>.html`, resolved inside `startWeb` so this
-    // process and `x dev` cannot answer a browser differently.
-    root: options.root,
-    http: containerBinding(options.env, options.hostname),
-    // The read-replica scope rides in FRONT of whatever the host supplied, or the host's own value
-    // passes through untouched. `DATABASE_REPLICA_URL` was read by no booted process before this:
-    // `defaultClient()` is the one composer of a replicated pair and it runs only when an app
-    // installed no client, which no framework boot leaves true (`dev-queue.ts`).
-    ...(replicaOverride === undefined ? {} : { overrides: replicaOverride }),
-  });
-  acquired.push(() => running.stop());
-  return {
-    kind: 'served',
-    role,
-    url: running.url,
-    buildId,
-    running,
-    runtime,
-    async stop() {
-      await running.stop();
-      await runtime.stop();
-      // Last: the exporters outlive the roles they were recording, so the drain's own spans and
-      // the final counter snapshot still have somewhere to go.
-      stopOtlp();
-    },
-  };
-}
-
 /**
  * What `apps/web/server.ts` calls. Returns for `migrate` — the process is meant to exit — and
  * holds for every other role until core's drain completes, so SIGTERM from a rolling restart takes

package/src/shot-server.ts

@@ -7,8 +7,8 @@
 import { join } from 'node:path';
 import { startDev } from './cmd-dev';
 import { clearLock, isProcessAlive, lockPath, parseLock, preflight, writeLock } from './dev-lock';
-import { DEV_BINDING } from './dev-roles';
-import { resolveServices } from './dev-services';
+import { DEV_BINDING } from './role-start';
+import { resolveServices } from './runtime-bindings';
 
 export const SHOT_DIR = join('.x', 'shot');
 

package/src/shot-settle.ts

@@ -57,6 +57,15 @@ export async function settleIslands(
   return answer;
 }
 
+/**
+ * Quiet AND answered: the island mounted or failed. `ready` alone was not enough (#474) — an island
+ * on the `idle` strategy mounts up to `IDLE_HYDRATE_TIMEOUT_MS` after the page went quiet, in idle
+ * time the activity counter never sees, so a busy machine read `mounted: false` and reported "did
+ * not finish mounting" with most of the window unused.
+ */
+const readinessSettled = (answer: IslandReadiness | null): boolean =>
+  answer?.ready === true && (answer.mounted || answer.failed !== null);
+
 /**
  * Read the harness's readiness until the page goes QUIET or the window runs out.
  *
@@ -76,7 +85,7 @@ export async function settleReadiness(
   const sleep = options.sleep ?? ((ms: number): Promise<void> => Bun.sleep(ms));
   let answer = await probe();
   let waited = 0;
-  while (answer?.ready !== true && waited < options.windowMs) {
+  while (!readinessSettled(answer) && waited < options.windowMs) {
     // At least 1ms, or a `pollMs` of zero is a loop with no exit while the window stands.
     const step = Math.max(1, Math.min(options.pollMs, options.windowMs - waited));
     await sleep(step);

package/src/shot-theme.ts

@@ -6,7 +6,7 @@
 // before the boot reads it: the picture is then what a visitor who chose that theme sees.
 
 import { THEME_STORAGE_KEY } from '@ultimat3/render';
-import type { ColorScheme } from '@ultimat3/scraping';
+import type { ShotColorScheme } from './browser-launcher-port';
 import { BadFlagError } from './errors';
 
 /** What `x shot --theme` accepts: the two the boot honours from storage, and nothing else. */
@@ -19,7 +19,7 @@ const isShotTheme = (value: string): value is ShotTheme =>
 /**
  * `--theme light|dark` on a ROUTE shot, or nothing — the box's own preference and the app's own
  * default, which is what `x shot` has always photographed. Refused by name for any other value:
- * `no-preference` is the scraping vocabulary's clear, not a theme a reader can ask for.
+ * `no-preference` is the browser port's clear, not a theme a reader can ask for.
  */
 export function readThemeFlag(value: string | undefined): ShotTheme | undefined {
   if (value === undefined) return undefined;
@@ -43,7 +43,7 @@ export function readThemeFlag(value: string | undefined): ShotTheme | undefined
  * `about:blank` is opaque and its `localStorage` throws, and a throw from a new-document script
  * would surface as a page error on a capture that has not navigated yet.
  */
-export function themeChoiceExpression(scheme: ColorScheme): string | undefined {
+export function themeChoiceExpression(scheme: ShotColorScheme): string | undefined {
   if (scheme === 'no-preference') return undefined;
   return (
     `try{localStorage.setItem(${JSON.stringify(THEME_STORAGE_KEY)},${JSON.stringify(scheme)})}` +

package/src/shot-verdict.ts

@@ -6,7 +6,7 @@ import { probeImage } from '@ultimat3/core';
 import { ISLAND_FAILED_ATTRIBUTE, ISLAND_MOUNTED_ATTRIBUTE } from '@ultimat3/render';
 import type { StandardSchemaV1 } from '@ultimat3/schema';
 import { t, validate } from '@ultimat3/schema';
-import type { ConsoleLine, NetworkEntry, PageError } from '@ultimat3/scraping';
+import type { ConsoleLine, NetworkEntry, PageError } from './browser-launcher-port';
 import { msg } from './messages';
 import type { JsonValue } from './output';
 
@@ -38,7 +38,6 @@ export const SHOT_MESSAGE_KEYS = [
   'cli.shot.console',
   'cli.shot.threw',
   'cli.shot.pageError',
-  'cli.shot.blind.status',
 ] as const;
 
 /**
@@ -157,6 +156,11 @@ export interface ShotVerdict extends ShotInput {
   readonly warnings: number;
   readonly canvas: ShotCanvas | null;
   readonly refused: number;
+  /**
+   * Responses with a status of 400 or above — a 404 script, a 500 API read. RECORDED and never
+   * gating, like a console warning: a missing favicon would otherwise fail every shot of every app.
+   */
+  readonly failed: number;
   /** What this verdict cannot see, stated every time — a `0` whose blind spots are named. */
   readonly blind: readonly string[];
 }
@@ -166,12 +170,14 @@ export interface ShotVerdict extends ShotInput {
  * these are properties of the browser port, not of a run — and in the artifact because `errors: 0`
  * read without them is a claim the tool cannot support.
  *
- * It was three. `pageErrors` and `hydration` both left on 2026-08-21, when `@ultimat3/scraping`
- * learned to capture `pageerror` and the hydration prelude learned to mark a mount's outcome. A
- * blind spot is worth stating while it is true and worth DELETING the moment it is not: a stale
- * one teaches an agent to distrust an answer the tool can now give.
+ * It was three. `pageErrors` and `hydration` both left on 2026-08-21, when the driver learned to
+ * capture `pageerror` and the hydration prelude learned to mark a mount's outcome; response status
+ * left in 22.0.0, when the raw-CDP driver began reading `Network.responseReceived`. A blind spot is
+ * worth stating while it is true and worth DELETING the moment it is not: a stale one teaches an
+ * agent to distrust an answer the tool can now give. The list is empty and stays in the artifact,
+ * so the next one has a place to be stated.
  */
-export const BLIND_SPOTS = ['cli.shot.blind.status'] as const;
+export const BLIND_SPOTS: readonly string[] = [];
 
 const levelCount = (lines: readonly ConsoleLine[], level: ConsoleLine['level']): number =>
   lines.filter((line) => line.level === level).length;
@@ -204,6 +210,7 @@ export function buildVerdict(input: ShotInput): ShotVerdict {
     warnings: levelCount(input.console, 'warn'),
     canvas: canvasOf(input.bytes),
     refused: input.network.filter((entry) => entry.refused !== undefined).length,
+    failed: input.network.filter((entry) => (entry.status ?? 0) >= 400).length,
     blind: BLIND_SPOTS.map((key) => msg(key)),
   };
 }
@@ -267,6 +274,7 @@ export function verdictJson(verdict: ShotVerdict): JsonValue {
     network: {
       requests: verdict.network.length,
       refused: verdict.refused,
+      failed: verdict.failed,
       dropped: verdict.networkDropped,
     },
     blind: [...verdict.blind],
@@ -308,6 +316,7 @@ export function shotLines(artifacts: ShotArtifacts): readonly string[] {
     msg('cli.shot.network', {
       requests: verdict.network.length,
       refused: verdict.refused,
+      failed: verdict.failed,
       dropped: verdict.networkDropped,
     }),
     ...verdict.pageErrors.map((error) =>

package/src/signal-shred.ts

@@ -0,0 +1,27 @@
+// Delete a plaintext buffer when the process is signalled, and then let the signal do what it
+// came to do. A bare `process.once('SIGINT', shred)` ran the shred and SWALLOWED the signal — a
+// listener replaces the default action — so Ctrl-C in `x secrets edit` left the command running.
+
+export type Reraise = (signal: NodeJS.Signals) => void;
+
+const reraiseDefault: Reraise = (signal) => {
+  process.kill(process.pid, signal);
+};
+
+/**
+ * Shred on SIGINT/SIGTERM, then re-raise the same signal: `once` has already removed this
+ * listener, so the re-raised signal meets the default action and terminates. Returns the undo for
+ * the normal path, which shreds in its own `finally`.
+ */
+export function shredOnSignal(shred: () => void, reraise: Reraise = reraiseDefault): () => void {
+  const handler = (signal: NodeJS.Signals): void => {
+    shred();
+    reraise(signal);
+  };
+  process.once('SIGINT', handler);
+  process.once('SIGTERM', handler);
+  return () => {
+    process.off('SIGINT', handler);
+    process.off('SIGTERM', handler);
+  };
+}

package/src/solid-loader.ts

@@ -6,9 +6,7 @@
 // The reference is load-bearing, not decorative: @ultimat3/cli ships SOURCE, so an APP's
 // `tsc` compiles this file inside ITS program, where a `.d.ts` sitting in this directory is
 // not included and its `declare module` never applies. `tsc -b` proves it in this repo.
-import { transformAsync } from '@babel/core';
 import { contentHash } from '@ultimat3/render/server';
-import solidPreset from 'babel-preset-solid';
 import type { BunPlugin } from 'bun';
 import { IslandBuildFailedError } from './errors';
 
@@ -32,6 +30,31 @@ const PRESET_OPTIONS = { generate: 'dom', hydratable: false } as const;
  */
 const PARSER_PLUGINS = ['typescript', 'jsx'] as const;
 
+/**
+ * Babel and the Solid preset, loaded on the first island transform and never at import: ~330ms of
+ * module evaluation, measured, paid by every process that imported the island bundler — `x dev`'s
+ * whole module graph and the CLI registry before it went lazy — whether or not an island was built.
+ */
+let loadedBabel:
+  | Promise<{
+      readonly transformAsync: typeof import('@babel/core').transformAsync;
+      /** Opaque, as `types/babel-modules.d.ts` declares it: handed to `presets:`, never called. */
+      readonly solidPreset: unknown;
+    }>
+  | undefined;
+
+const babel = () => {
+  loadedBabel ??= Promise.all([import('@babel/core'), import('babel-preset-solid')]).then(
+    // The preset is CommonJS: a dynamic import hands back its `module.exports` as `default`,
+    // which the static default import it replaced was reading all along.
+    ([core, preset]) => ({
+      transformAsync: core.transformAsync,
+      solidPreset: Reflect.get(Object(preset), 'default') as unknown,
+    }),
+  );
+  return loadedBabel;
+};
+
 interface CacheEntry {
   /** `contentHash` of the source the code was compiled from. */
   readonly hash: string;
@@ -76,6 +99,7 @@ export async function transformIslandTsx(source: string, path: string): Promise<
     // `transformAsync` and never `transformFileAsync`: the latter is gated behind `@babel/core`'s
     // `browser` export condition and throws "Transforming files is not supported in browsers"
     // under `bun --conditions=browser`, which is the condition Solid work runs in.
+    const { transformAsync, solidPreset } = await babel();
     const result = await transformAsync(source, {
       filename: path,
       // The app's own Babel config is not this transform's business, and an app that happens to

package/src/static-report.ts

@@ -71,6 +71,12 @@ export type UnmeasuredRoute = {
   readonly code?: string;
   readonly cause?: string;
   readonly fix?: string;
+  /**
+   * `false` when no build can weigh the route by construction — a `render: 'ssr'` page with params,
+   * which may not declare `prerender()`, so the build holds no value to render it at. Not a defect
+   * in the app, so the `budgets` step prints it and raises no finding (`measure-paths.ts`).
+   */
+  readonly weighable?: false;
 };
 
 /** One HTML file in the artifact, and the declared route that produced it. */
@@ -192,7 +198,8 @@ const isUnmeasured = (value: unknown): value is UnmeasuredRoute =>
   typeof value['reason'] === 'string' &&
   optionalString(value['code']) &&
   optionalString(value['cause']) &&
-  optionalString(value['fix']);
+  optionalString(value['fix']) &&
+  (value['weighable'] === undefined || value['weighable'] === false);
 
 const isEmitted = (value: unknown): value is EmittedPage =>
   isRecord(value) &&