@ultimat3/manifest 23.0.0 → 25.0.0

package/CLAUDE.md

@@ -44,7 +44,7 @@ by the CLI, not imported.
 - Top-level key order in the file is fixed by `KEY_ORDER` in `emit.ts` — `as const satisfies
   readonly (keyof Manifest)[]` AND walked by `emit.test.ts`, the treatment `ARRAY_SECTIONS` has,
   because the annotation catches a key that is not on `Manifest` and only the walk catches one that
-  is MISSING. `manifestJson` writes those keys and no others while `contentHash` hashes the whole
+  is MISSING. `manifestJson` writes those keys and no others while `fingerprint` hashes the whole
   body, so a 14th field would go into the hash and be dropped from the file — after which
   `assertNoDrift` convicts the committed manifest as HAND_EDITED, a correct refusal with the wrong
   diagnosis, about a file nobody touched.
@@ -62,7 +62,10 @@ by the CLI, not imported.
   they already carried — so the swap is observable only where the old form folded. **The published
   document is `manifestJson` and is still `JSON.stringify` with a fixed key order**: an injective
   form emits tokens JSON cannot parse, which is why `@ultimat3/action`'s `stableStringify` exists
-  as a separate function and why this one may not be written to disk.
+  as a separate function and why this one may not be written to disk. **So a fact the document
+  cannot hold is refused at build** (`As of 2026-10-02`, `finite-facts.ts`, `X_MANIFEST_FACT_INVALID`
+  with `meta.path`): `NaN`, `±Infinity` and `-0` hashed apart from what the file wrote, so a manifest
+  carrying one failed its own `verifyBuildId` and read as drift on every build.
 - Job `steps` keep declared order. Everything else sorts.
 - `permissions` is derived, never a second declared list — and derived from each operation's own
   `permissions`, **never from `policy`**. `policy` is a DISPLAY label: a composite renders as
@@ -136,6 +139,11 @@ by the CLI, not imported.
   "no key", so a dropped one is classified. `surface`, `offline`, `hydrate`, `budget` and
   `revalidateTags` absent means "this file predates the field", so `diffScalar` skips a side that
   carries nothing rather than reporting every route in an upgraded app as re-surfaced.
+  `QueryFact.input` follows the same rule (`As of 2026-10-02`): `sources.ts` now projects the
+  handle's schema through `jsonSchemaOf` — it wrote none before, so the README's promise was false
+  and the input compare never fired — and a committed manifest from before carries none.
+  `hasDefault` is different: absent IS "no default", so a NOT NULL column losing one is breaking,
+  a nullable one `internal`, gaining one additive.
 - **`MANIFEST_VERSION` bumps only when a reader built for the old version would be WRONG** — a
   field removed, retyped, or given a new meaning — never for one that is merely added. Two costs
   make the reflex expensive: `isCompatible` is an equality check, so a bump rejects every
@@ -154,7 +162,7 @@ by the CLI, not imported.
 - `diff.ts` reads `mcp.expose` through `isMcpExposed` from `@ultimat3/core`, on **both** sides.
   `before` is a file parsed off disk, so an older or hand-trimmed manifest can carry an absent or
   non-boolean value that `!==` would classify from; and the fact `sources.ts` publishes has to be
-  the answer `toMcpTools` gives, or the gate demands a major bump for a tool that never existed.
+  the answer `@ultimat3/mcp`'s catalog gives, or the gate demands a major bump for a tool that never existed.
 
 ## Commands
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/manifest",
-  "version": "23.0.0",
+  "version": "25.0.0",
   "description": "x.manifest.json: deterministic generated facts, contract diff, AGENTS.md budget",
   "license": "MIT",
   "type": "module",
@@ -25,18 +25,18 @@
     "LICENSE"
   ],
   "engines": {
-    "bun": ">=1.4.0"
+    "bun": ">=1.4.2"
   },
   "scripts": {
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/action": "23.0.0",
-    "@ultimat3/core": "23.0.0",
-    "@ultimat3/entity": "23.0.0",
-    "@ultimat3/jobs": "23.0.0",
-    "@ultimat3/query": "23.0.0",
-    "@ultimat3/realtime": "23.0.0"
+    "@ultimat3/action": "25.0.0",
+    "@ultimat3/core": "25.0.0",
+    "@ultimat3/entity": "25.0.0",
+    "@ultimat3/jobs": "25.0.0",
+    "@ultimat3/query": "25.0.0",
+    "@ultimat3/realtime": "25.0.0"
   }
 }

package/src/build.ts

@@ -16,7 +16,8 @@
 // assembled per app — both outside what this tier may import — so the CLI supplies them and
 // this function stays pure and unit-testable.
 
-import { canonicalJson } from '@ultimat3/core';
+import { fingerprint } from '@ultimat3/core';
+import { assertFiniteFacts } from './finite-facts';
 import type {
   ActionFact,
   AdminFact,
@@ -96,21 +97,14 @@ export function buildManifest(sources: ManifestSources): Manifest {
     errorCodes,
   };
 
-  return { ...body, buildId: contentHash(body) };
-}
-
-/**
- * Content hash of the manifest body. Deliberately excludes `buildId` itself, and is taken over
- * `@ultimat3/core`'s `canonicalJson` — the same INJECTIVE form the diff compares on, so a fact
- * that changed cannot hash the same as the fact it replaced.
- *
- * This is a HASH, never the published document: `manifestJson` in `emit.ts` is what reaches disk,
- * and it is `JSON.stringify` with a fixed key order for exactly that reason.
- */
-export function contentHash(body: Omit<Manifest, 'buildId'>): string {
-  const hasher = new Bun.CryptoHasher('sha256');
-  hasher.update(canonicalJson(body));
-  return hasher.digest('hex').slice(0, 16);
+  // Before the hash: a fact the written file cannot hold must never get a buildId at all.
+  assertFiniteFacts(body, '');
+  // The build id is `@ultimat3/core`'s `fingerprint` of the body — SHA-256/16 over the same
+  // INJECTIVE `canonicalJson` the diff compares on, so a fact that changed cannot hash the same as
+  // the fact it replaced — and deliberately excludes `buildId` itself. A HASH, never the published
+  // document: `manifestJson` in `emit.ts` is what reaches disk, with a fixed key order. The
+  // `contentHash` alias this package exported for it left in 25.0.0 (plan 101, M3).
+  return { ...body, buildId: fingerprint(body) };
 }
 
 function sortBy<T>(items: readonly T[], key: (item: T) => string): readonly T[] {

package/src/diff-admin.ts

@@ -28,6 +28,35 @@ const flag = (
         },
       ];
 
+/**
+ * The admin-level gate, as `adminPermissionForAction` (`@ultimat3/admin`) decides it: `destructive`
+ * and `matching` hold the write gate, and only then does `readonly` lower it. Restated, not
+ * imported: the admin is a tier above this package. `destructive` reports its own change (and its
+ * own `admin:destroy` gate), so this only says read or write.
+ */
+const gateOf = (action: AdminActionFact): 'admin:read' | 'admin:write' =>
+  action.readonly && !action.destructive && !action.matching ? 'admin:read' : 'admin:write';
+
+/** `readonly` / `matching` flipping: a caller sees it only when the gate moves. */
+function diffGate(at: string, before: AdminActionFact, after: AdminActionFact): ManifestChange[] {
+  const changes: ManifestChange[] = [];
+  const [was, is] = [gateOf(before), gateOf(after)];
+  if (was !== is) {
+    // Write → read lets an `admin:read` caller in; read → write refuses one it served.
+    const kind = is === 'admin:write' ? 'breaking' : 'additive';
+    changes.push({ kind, path: `${at}.gate`, detail: `admin gate ${was} -> ${is}` });
+  }
+  for (const key of ['readonly', 'matching'] as const) {
+    // An absent flag reads as `false` (`schema.ts`): a baseline written before the field existed
+    // is not a change against a build that states `false`.
+    const [had, has] = [before[key] === true, after[key] === true];
+    if (had === has) continue;
+    const detail = `${key} ${String(had)} -> ${String(has)}`;
+    changes.push({ kind: 'internal', path: `${at}.${key}`, detail });
+  }
+  return changes;
+}
+
 function diffActions(
   path: string,
   before: readonly AdminActionFact[],
@@ -58,6 +87,7 @@ function diffActions(
       ...flag(`${at}.input`, action.input, now.input, true, 'input schema'),
       ...flag(`${at}.destructive`, action.destructive, now.destructive, true, 'destructive'),
     );
+    changes.push(...diffGate(at, action, now));
     if (action.threshold !== now.threshold) {
       changes.push({
         kind: 'internal',

package/src/diff-entities.ts

@@ -108,6 +108,7 @@ function diffColumns(
           : { kind: 'breaking', path: `${at}.nullable`, detail: 'became NOT NULL' },
       );
     }
+    changes.push(...diffDefault(`${at}.hasDefault`, column.hasDefault === true, next));
     changes.push(...diffKey(at, 'primaryKey', keyOf(column), keyOf(next)));
     changes.push(...diffKey(at, 'references', column.references, next.references));
     changes.push(...diffSealed(`${at}.sealed`, column.sealed, next.sealed));
@@ -133,6 +134,27 @@ function diffColumns(
   return changes;
 }
 
+/**
+ * A declared default on a column that was already there. It was read for an ADDED column only, so
+ * a NOT NULL column losing its default reported nothing but `buildId` — while every writer that
+ * omits the column is refused from then on. Dropped from a nullable column, an omitted value
+ * becomes NULL instead: nobody is refused, but the stored meaning moved. Gaining one only widens.
+ */
+function diffDefault(
+  path: string,
+  had: boolean,
+  next: EntityFact['columns'][number],
+): readonly ManifestChange[] {
+  const has = next.hasDefault === true;
+  if (had === has) return [];
+  if (has) return [{ kind: 'additive', path, detail: 'default added' }];
+  return [
+    next.nullable
+      ? { kind: 'internal', path, detail: 'default dropped; an omitted value is now NULL' }
+      : { kind: 'breaking', path, detail: 'default dropped; a writer that omits it is refused' },
+  ];
+}
+
 /**
  * How a column is sealed is a WIRE fact as much as a storage one: `.sealed()` emits no DDL and
  * leaves the column's type alone, so nothing else in the file moves — while the field leaves every

package/src/diff-operations.ts

@@ -117,7 +117,13 @@ export function diffQueries(
       changes.push({ kind: 'breaking', path, detail: 'query removed' });
       continue;
     }
-    if (canonicalJson(query.input) !== canonicalJson(next.input)) {
+    // Both sides or neither: a manifest committed before queries published their input carries
+    // none, and a side with nothing on it is no evidence of a change (`diff-routes.ts`'s rule).
+    if (
+      query.input !== undefined &&
+      next.input !== undefined &&
+      canonicalJson(query.input) !== canonicalJson(next.input)
+    ) {
       changes.push({ kind: 'breaking', path: `${path}.input`, detail: 'input schema changed' });
     }
     if (query.policy !== next.policy) {

package/src/docs-scan.ts

@@ -158,18 +158,21 @@ async function guideEntries(
   // id — silently, which is the failure mode the search's own coverage floor exists to prevent,
   // and a direct contradiction of `DocEntry.topic`'s promise to be unique within a package. No
   // shipped guide collides today; an app's own package is one heading away from it. The suffix
-  // follows document order, so the id is still derived and still reproducible.
-  const used = new Map<string, number>();
+  // follows document order, so the id is still derived and still reproducible. EVERY emitted id is
+  // recorded and a suffix climbs past a taken one: `## Retry`, `## Retry`, `## Retry 2` otherwise
+  // gave the second `Retry` and the real `Retry 2` the same `retry-2`.
+  const emitted = new Set<string>();
   for (const file of GUIDE_FILES) {
     const markdown = await read(join(dir, file));
     if (markdown === undefined) continue;
     const stem = basename(file, '.md');
     for (const section of parseGuideSections(markdown)) {
       const base = `${shortName(name)}.${stem}#${slug(section.heading)}`;
-      const seen = (used.get(base) ?? 0) + 1;
-      used.set(base, seen);
+      let topic = base;
+      for (let suffix = 2; emitted.has(topic); suffix += 1) topic = `${base}-${suffix}`;
+      emitted.add(topic);
       entries.push({
-        topic: seen === 1 ? base : `${base}-${seen}`,
+        topic,
         package: name,
         version,
         kind: 'guide',

package/src/emit.ts

@@ -4,8 +4,7 @@
 // so a refactor that reorders a struct literal does not produce a diff. Two-space indent and
 // a trailing newline: the file is reviewed by humans and diffed by git.
 
-import { canonicalJson } from '@ultimat3/core';
-import { contentHash } from './build';
+import { canonicalJson, fingerprint } from '@ultimat3/core';
 import { ManifestDriftError } from './errors';
 import type { Manifest } from './schema';
 import { isManifest } from './schema';
@@ -18,7 +17,7 @@ export const MANIFEST_FILENAME = 'x.manifest.json';
  * `as const satisfies` and a test that WALKS it, the treatment `ARRAY_SECTIONS` already has
  * (`schema.ts`) — the annotation catches a key that is not on `Manifest`, only a walk catches one
  * that is missing. It was a bare annotation, and `manifestJson` writes these keys and no others
- * while `contentHash` hashes the whole body: a 14th field added to `Manifest` would have gone into
+ * while `fingerprint` hashes the whole body: a 14th field added to `Manifest` would have gone into
  * the hash and been dropped from the file, after which `assertNoDrift` convicts the committed
  * manifest as HAND_EDITED — a correct refusal carrying the wrong diagnosis, about a file nobody
  * touched. Exported for that test alone; deliberately NOT re-exported by `src/index.ts`, because
@@ -150,7 +149,7 @@ function describeDrift(onDisk: Manifest, fresh: Manifest): readonly string[] {
 /** Verify a file's `buildId` against its own contents — catches a hand-edited manifest. */
 export function verifyBuildId(manifest: Manifest): boolean {
   const { buildId, ...body } = manifest;
-  return contentHash(body) === buildId;
+  return fingerprint(body) === buildId;
 }
 
 async function readIfExists(path: string): Promise<string | undefined> {

package/src/errors.ts

@@ -8,6 +8,7 @@ export const MANIFEST_ERROR_CODES = [
   'X_MANIFEST_BREAKING',
   'X_AGENTS_MD_MISSING',
   'X_AGENTS_MD_TOO_LARGE',
+  'X_MANIFEST_FACT_INVALID',
 ] as const;
 
 export type ManifestErrorCode = (typeof MANIFEST_ERROR_CODES)[number];
@@ -17,6 +18,7 @@ export const MANIFEST_ERROR_TITLES: Readonly<Record<ManifestErrorCode, string>>
   X_MANIFEST_BREAKING: 'a published contract was removed or narrowed',
   X_AGENTS_MD_MISSING: 'no AGENTS.md',
   X_AGENTS_MD_TOO_LARGE: 'AGENTS.md grew past its cap',
+  X_MANIFEST_FACT_INVALID: 'a manifest fact is a number JSON cannot write back',
 };
 
 // Titles must be registered for format() to render the contract's first line. Every code above is
@@ -116,6 +118,26 @@ export class AgentsMdTooLargeError extends UltimateError {
   }
 }
 
+/**
+ * A number in the manifest body that JSON cannot write back as itself. `canonicalJson` hashes `NaN`,
+ * `Infinity` and `-0` as those tokens and `JSON.stringify` writes them as `null` and `0`, so a
+ * manifest built from one fails its own `verifyBuildId` the moment it is read back, and the
+ * committed file reads as drift on every build. `path` is where in the body it sits.
+ */
+export class ManifestFactInvalidError extends UltimateError {
+  constructor(input: { path: string; value: string }) {
+    super({
+      code: 'X_MANIFEST_FACT_INVALID',
+      cause: `the manifest fact at ${input.path} is ${input.value}, which x.manifest.json would write as ${input.value === '-0' ? '0' : 'null'} — the file could never match its own buildId`,
+      fix:
+        input.value === '-0'
+          ? `set the declaration that publishes ${input.path} to 0, then run x manifest`
+          : `set the declaration that publishes ${input.path} to a finite number, then run x manifest`,
+      meta: { path: input.path, value: input.value },
+    });
+  }
+}
+
 /** First three items plus a count — a message with 400 entries is a message nobody reads. */
 function summarize(items: readonly string[]): string {
   if (items.length <= 3) return items.join('; ');

package/src/finite-facts.ts

@@ -0,0 +1,28 @@
+// Single responsibility: refuse a manifest number JSON cannot write back as itself. The body is
+// hashed by `canonicalJson`, which keeps `NaN`, `Infinity` and `-0` distinct, and written by
+// `JSON.stringify`, which does not — so one such fact made a manifest that failed its own buildId.
+
+import { ManifestFactInvalidError } from './errors';
+
+/** Depth-first, in key order, so the refusal names the FIRST offending fact the file would hold. */
+export function assertFiniteFacts(value: unknown, path: string): void {
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value) || Object.is(value, -0)) {
+      throw new ManifestFactInvalidError({
+        path,
+        value: Object.is(value, -0) ? '-0' : String(value),
+      });
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item: unknown, index) => {
+      assertFiniteFacts(item, `${path}[${String(index)}]`);
+    });
+    return;
+  }
+  if (value === null || typeof value !== 'object') return;
+  for (const [key, item] of Object.entries(value)) {
+    assertFiniteFacts(item, path === '' ? key : `${path}.${key}`);
+  }
+}

package/src/index.ts

@@ -10,7 +10,7 @@ export {
   checkAgentsMd,
 } from './agents-md';
 export type { ManifestSources } from './build';
-export { buildManifest, contentHash } from './build';
+export { buildManifest } from './build';
 export type { ChangeKind, ManifestChange, ManifestDiff } from './diff';
 export { diffManifest, formatDiff } from './diff';
 export type { DocEntry, DocEntryKind } from './docs-scan';
@@ -39,6 +39,7 @@ export {
   MANIFEST_ERROR_TITLES,
   ManifestBreakingError,
   ManifestDriftError,
+  ManifestFactInvalidError,
 } from './errors';
 export type {
   ActionFact,

package/src/schema.ts

@@ -36,7 +36,7 @@ export interface RouteFact {
   readonly offline?: OfflineStrategy;
   readonly hydrate?: HydrateStrategy;
   readonly revalidateTags?: readonly string[];
-  readonly budget?: { readonly js?: string; readonly lcp?: number };
+  readonly budget?: { readonly js?: string };
   /** Which surface the route lives in — `site` may never import from `app`. */
   readonly surface?: 'site' | 'app' | 'api';
 }
@@ -69,6 +69,13 @@ export interface AdminActionFact {
   readonly when: boolean;
   readonly batch: boolean;
   readonly threshold: number | null;
+  /**
+   * The two inputs of the admin-level gate besides `destructive`: `readonly` lowers it to
+   * `admin:read`, `matching` (a set-based write) holds it at `admin:write`. Absent from a file
+   * written before they were recorded, and read there as `false`.
+   */
+  readonly readonly: boolean;
+  readonly matching: boolean;
 }
 
 /** One resource of a generated admin: what its list answers, and whether a row scope narrows it. */
@@ -173,7 +180,11 @@ export interface ActionFact {
 
 export interface QueryFact {
   readonly name: string;
-  /** Optional: `QueryDescriptor` is schema-erased, so a live query may not expose one. */
+  /**
+   * The input's JSON Schema, projected from the query handle as an action's is. Optional only for
+   * a manifest committed before queries published it; `diffQueries` reads an absent side as no
+   * evidence rather than as a changed schema.
+   */
   readonly input?: JsonValue;
   /** The policy's DISPLAY label — see `ActionFact.policy`, and read `permissions` to match on. */
   readonly policy: string | null;

package/src/sources-admin.ts

@@ -75,6 +75,8 @@ const actionOf = (value: unknown): AdminActionFact | undefined => {
     when: bag['when'] === true,
     batch: bag['batch'] === true,
     threshold,
+    readonly: bag['readonly'] === true,
+    matching: bag['matching'] === true,
   };
 };
 

package/src/sources.ts

@@ -5,10 +5,10 @@
 // a global registry. Routes and policies are supplied by the caller: the route table lives
 // in `@ultimat3/render`, which is this same tier.
 
-import { describeActions } from '@ultimat3/action';
+import { describeActions, jsonSchemaOf } from '@ultimat3/action';
 import { describeEntities, registeredEntities, sealedFields } from '@ultimat3/entity';
 import { describeJobs } from '@ultimat3/jobs';
-import { describeQueries } from '@ultimat3/query';
+import { describeQueries, getQuery } from '@ultimat3/query';
 import { describeChannels } from '@ultimat3/realtime/server';
 import type { ManifestSources } from './build';
 import type {
@@ -23,7 +23,7 @@ import { declaredAdmins } from './sources-admin';
 
 export interface FrameworkSourcesInput {
   readonly app: { readonly name: string; readonly version: string };
-  /** From `@ultimat3/render`'s `describeRoutes()`. */
+  /** From `@ultimat3/render`'s `describePages()`. */
   readonly routes?: readonly RouteFact[];
   /** Assembled per app from its policy modules. */
   readonly policies?: readonly PolicyFact[];
@@ -49,6 +49,12 @@ export interface FrameworkSourcesInput {
  */
 const asJson = (value: object): JsonValue => value as JsonValue;
 
+/** `describeQueries` and `getQuery` read one registry, so the handle is always there. */
+const queryInput = (name: string): { readonly input?: JsonValue } => {
+  const handle = getQuery(name);
+  return handle === undefined ? {} : { input: asJson(jsonSchemaOf(handle.input)) };
+};
+
 /** Absent stays absent: only a sealed column carries the field. */
 const sealedFact = (
   how: 'opaque' | 'lookup' | undefined,
@@ -121,6 +127,9 @@ export function frameworkSources(input: FrameworkSourcesInput): ManifestSources
     })),
     queries: describeQueries().map((query) => ({
       name: query.name,
+      // The handle's own schema, projected exactly as an action's is: the descriptor is
+      // schema-erased, and without this `diffQueries`' input compare never fired on a real app.
+      ...queryInput(query.name),
       policy: query.capability,
       permissions: query.permissions,
       live: query.live,

package/src/diff-fixtures.ts

@@ -1,96 +0,0 @@
-// TEST-ONLY. One fully-populated `ManifestSources` for the diff suites, so every section carries a
-// fact and every fact carries every field its type declares — a fixture with an empty `tasks` is
-// how a section nothing classifies stays green. Never exported from `index.ts`.
-
-import type { ManifestSources } from './build';
-import { buildManifest } from './build';
-import type { Manifest } from './schema';
-
-export const fixtureAction = (
-  name: string,
-  policy: string,
-  expose = true,
-  permissions = [policy],
-) => ({
-  name,
-  input: { id: 'uuid' },
-  output: { ok: 'boolean' },
-  policy,
-  permissions,
-  cacheInvalidates: ['post'],
-  mcp: { expose },
-});
-
-export const fixtureQuery = (name: string, policy: string, permissions = [policy]) => ({
-  name,
-  input: {},
-  policy,
-  permissions,
-  live: true,
-  subscribes: ['posts'],
-  cacheTags: ['post'],
-});
-
-/**
- * Built through a helper rather than written as `{ code: 'X_…' }`: `x verify`'s `errors` step
- * reads a `code:` key with an `X_*` literal as a DECLARATION, and this file is not a test file, so
- * the literal would have published a fixture's code into `framework.manifest.json` as one this
- * package owns.
- */
-export const fixtureErrorCode = (code: string, owner: string) => ({ code, package: owner });
-
-/** Every section non-empty, every optional field present. */
-export const FIXTURE: ManifestSources = {
-  app: { name: 'acme', version: '1.4.2' },
-  routes: [
-    {
-      url: '/posts',
-      render: 'isr',
-      offline: 'precache',
-      hydrate: 'idle',
-      revalidateTags: ['post'],
-      budget: { js: '40kb', lcp: 2000 },
-      surface: 'site',
-    },
-  ],
-  entities: [
-    {
-      name: 'post',
-      table: 'posts',
-      columns: [
-        { name: 'id', type: 'uuid', nullable: false, primaryKey: true },
-        { name: 'authorId', type: 'uuid', nullable: false, references: 'users.id' },
-        { name: 'note', type: 'text', nullable: true },
-      ],
-      invariants: ['post_title_present'],
-    },
-  ],
-  actions: [fixtureAction('publishPost', 'post:publish')],
-  queries: [fixtureQuery('feed', 'feed:read')],
-  jobs: [
-    {
-      name: 'sendMail',
-      input: { orgId: 'uuid' },
-      queue: 'critical',
-      retry: { attempts: 5, backoff: 'exponential' },
-      steps: ['a'],
-    },
-  ],
-  tasks: [
-    { name: 'nightlyDigest', cron: '0 3 * * *', tz: 'Europe/Berlin', enqueues: ['sendMail'] },
-  ],
-  policies: [
-    { permission: 'post:publish', description: 'publish a draft', enforcedIn: ['actions.publish'] },
-  ],
-  locales: ['en'],
-  // A code that is genuinely REGISTERED, not an invented one. `error-catalog.test.ts` scans every
-  // non-test file under `packages/*/src` for an `X_*` literal and treats an unregistered one as a
-  // code handed to a reader that no gate can see. A fixture is not shipped source in spirit, but
-  // it is in fact — and widening that scanner to excuse a filename is a worse trade than picking a
-  // real code here, since the diff classifier only ever compares the string.
-  errorCodes: [fixtureErrorCode('X_NOT_FOUND', 'app')],
-};
-
-/** The fixture, built. */
-export const fixtureManifest = (overrides: Partial<ManifestSources> = {}): Manifest =>
-  buildManifest({ ...FIXTURE, ...overrides });