@unoverse-platform/studio 0.1.84 → 0.1.86

package/vendor/sdk/lib/app.tsx

@@ -39,6 +39,8 @@ import { renderNode, styleToCss, keyframesCss, type ActionHandler, type SlotReso
 // existing consumers keep their import path.
 export { collectSurfacedViews, computeAppWidth, orderedClaims, resolveActiveLayout, resolveActiveView, selectPointers, viewOf } from "./core";
 import { UnoverseComponent } from "./UnoverseComponent";
+import { MountArrangement } from "./transition/index";
+import { guestHeldPointers } from "./transition/guestHold";
 
 /**
  * FLIP wrapper for a multi-occupant slot: when arrivals reorder the list (a refreshed
@@ -217,6 +219,29 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
     };
   }, [client, uri]);
 
+  // A PAGE THAT STREAMED IN is on screen exactly like a mounted one, and claims exactly
+  // as much — but the app never named it, so nothing has fetched its definition. Its
+  // ADDRESS says what it is (`unoverse://templates/…`, §9c), which is all the SDK needs
+  // to learn what it claims. Fetched once per instance, into the same map the mounts use.
+  useEffect(() => {
+    let alive = true;
+    for (const p of store.getResponses().flatMap((r) => r.components)) {
+      const { chatId: c, nodeId: n } = store.split(p);
+      const url = store.getComponentUrl(c, n);
+      if (!url || !url.includes("://templates/")) continue;
+      const key = url.replace(/^unoverse:\/\/templates\//, "");
+      if (mounted[key]) continue;
+      client
+        .readDefinition(url)
+        .then((t) => alive && t && setMounted((m) => (m[key] ? m : { ...m, [key]: t })))
+        .catch((e) => console.warn(`[unoverse] streamed template "${key}" failed to load:`, e));
+    }
+    return () => {
+      alive = false;
+    };
+  }, [client, store, structureVersion, mounted]);
+
+
   // ARRIVAL PLACEMENT (STATE_MODEL v2 §5 rule 3): nobody sends a state — the HOST
   // places the actor at spawn. For each arrived component whose slice has no view yet:
   //   1. the component's DECLARED INITIAL, if this template has a state for it (the
@@ -240,7 +265,7 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
         if (!menu) continue;
         const initial = typeof slice.initialView === "string" ? slice.initialView : undefined;
         const face = initial && order.includes(initial) ? initial : order.find((s) => menu.includes(s));
-        if (face) store.apply({ type: "COMPONENT_DATA", chatId, nodeId, data: { view: face } });
+        if (face) store.apply({ type: "COMPONENT_DATA", chatId, nodeId, data: { state: face } });
       }
   }, [def, store, structureVersion]);
 
@@ -260,6 +285,14 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
     // it holds must not also render in the flow — one instance, one placeholder.
     for (const tpl of Object.values(mounted)) {
       for (const name of Object.keys(tpl.layouts ?? {})) views.add(name);
+      // A TEMPLATE CLAIMS WHAT ITS SECTIONS CLAIM, not just its state names. A grid-page
+      // holds its content in its own states, so the names were enough; a rich page holds
+      // its content in PARTS — a written hero, a section head, the band's cards — and
+      // each wears the section's face. Without these the parts are unclaimed at app
+      // level, so the SDK draws the page in its surface AND every piece of it again in
+      // the conversation flow (observed live 2026-08-30: the whole page, twice).
+      for (const secs of Object.values((tpl as { sections?: Record<string, { face?: string }[]> }).sections ?? {}))
+        for (const sec of secs) if (sec?.face) views.add(sec.face);
     }
     return views;
   }, [activeRoot, def, mounted]);
@@ -419,38 +452,95 @@ export function StreamedUnoverseApp({ client, store, uri, onAction, theme: theme
       // nothing collapses.
       if (spec?.template) {
         const tpl = mounted[spec.template];
-        const active = tpl ? resolveActiveLayout(tpl, store) : undefined;
+        if (!tpl) return null;
         // HOLD: LATEST (basic form, UNOVERSE_TEMPLATE_MODEL §9b): the mount holds
-        // only the CURRENT delivery — the guest's send clears the set.
+        // only the CURRENT delivery — spent by the settle or the clear, never the
+        // guest's send. A judged DIRECTOR_VERDICT narrows it further (§7); no
+        // verdict, or a verdict holding nothing that survives, falls back to the
+        // whole delivery.
+        const active = resolveActiveLayout(tpl, store);
         const delivery = store.currentDeliveryPointers();
-        const held = active ? collectSlotPointers(active, store, delivery) : [];
-        if (!tpl) return null;
-        if (!active) return null;
-        if (!held.length) return null;
-        const tree = renderNode(active, store.getAppState() as Record<string, unknown>, dispatch, theme, `${String(key ?? cname)}-tpl`, makeResolveSlot(delivery), tpl.defs);
-        // A PLACE DECLARES ITS WIDTH ONCE (docs/design/05), same law as a slot
-        // panel: `appWidth` resolves via theme.appSize and sizes the frame box —
-        // `flex` is the served "all remaining space" name. Without it the frame's
-        // own styles decide (and a width-less frame beside a fixed-width chat
-        // collapsed to its padding — observed live 2026-08-28).
-        const declaredW = (node as { appWidth?: string }).appWidth;
-        const placeW = cssWidth(typeof declaredW === "string" ? (theme.appSize?.[declaredW] ?? declaredW) : undefined);
-        // THEME-FREE FALLBACK (same law as computeAppWidth's marker): a theme without
-        // an `appSize.flex` token must still mean "fill the remaining host space" —
-        // an unresolved name collapsed the place to its padding (observed live
-        // 2026-08-28, the light theme's missing `flex`).
-        const flexFallback = !placeW && declaredW === "flex";
-        const rawFrame = (node as { frame?: UnoverseNode }).frame;
-        if (rawFrame) {
-          const frame = placeW
-            ? ({ ...rawFrame, style: { ...(rawFrame.style ?? {}), width: placeW, flex: "0 0 auto" } } as UnoverseNode)
-            : flexFallback
-              ? ({ ...rawFrame, style: { ...(rawFrame.style ?? {}), flex: "1 1 0%", minWidth: 0 } } as UnoverseNode)
-              : rawFrame;
-          const innerSlot: SlotResolver = () => tree;
-          return renderNode(frame, store.getAppState() as Record<string, unknown>, dispatch, theme, `${String(key ?? cname)}-frame`, innerSlot, def?.defs);
-        }
-        return <div key={key} style={{ display: "flex", flexDirection: "column", minHeight: 0, ...(placeW ? { width: placeW, flex: "0 0 auto" } : flexFallback ? { flex: "1 1 0%", minWidth: 0 } : {}) }}>{tree}</div>;
+        const dirScope = store.directorScope(delivery);
+        const tplLayouts = (tpl as { layouts?: Record<string, UnoverseNode> }).layouts ?? {};
+        // THE GUEST'S HAND OUTRANKS THE SETTLE (§6b rule 3, state priority): an
+        // instance the guest holds open in a non-base face (Detail View) stays in
+        // the mount's scope through deliveries and settles — a new batch landing
+        // below must not unseat it. The hold releases when the guest writes the
+        // face back to the base (✕), and the CURRENT arrangement takes over.
+        const layoutNames = Object.keys(tplLayouts);
+        const baseLayout = (tpl as { defaultLayout?: string }).defaultLayout ?? layoutNames[0] ?? null;
+        const guestHeld = guestHeldPointers(
+          store.getResponses().flatMap((r) => r.components),
+          {
+            touchOf: (p) => store.touchOf(p),
+            interactionTouchOf: (p) => store.interactionTouchOf(p),
+            viewOf: (p) => {
+              const { chatId, nodeId } = store.split(p);
+              return viewOf(store.get(chatId, nodeId) as Record<string, unknown> | undefined);
+            },
+          },
+          layoutNames,
+          baseLayout,
+        );
+        const scope = guestHeld.length ? new Set([...(dirScope ?? delivery), ...guestHeld]) : (dirScope ?? delivery);
+        const held = active ? collectSlotPointers(active, store, scope) : [];
+        // THE TRANSITION MODEL (§13): the mount double-buffers — this render
+        // derives the NEXT arrangement; MountArrangement commits it only at a
+        // boundary (verdict change, guest layout change, un-directed mount), so
+        // a data ripple can never move the shelf, and EMPTY COLLAPSES only when
+        // an arrangement holding nothing is COMMITTED. Content inside held
+        // instances stays live: the closure reads slices at render time.
+        const nextArrangement = {
+          layoutName: active ? (Object.entries(tplLayouts).find(([, t]) => t === active)?.[0] ?? null) : null,
+          held,
+          verdictSig: dirScope ? [...dirScope].sort().join("|") : null,
+        };
+        const motion = ((theme as { motion?: { mount?: string } }).motion?.mount ?? "") === "transition";
+        return (
+          <MountArrangement
+            key={key ?? cname}
+            next={nextArrangement}
+            directed={
+              // THE ONE HOME (§9b clause 5): the grant is the template's own
+              // director SECTION, compiled into the served def's `sections`;
+              // the placement's `director:` block is the legacy fallback.
+              Object.values(((tpl as { sections?: Record<string, { kind?: string }[]> }).sections ?? {}))
+                .flat()
+                .some((s) => s?.kind === "director") || Boolean((spec as { director?: unknown }).director)
+            }
+            motion={motion}
+            render={(arr) => {
+              if (!arr.held.length) return null;
+              const arrActive = (arr.layoutName ? tplLayouts[arr.layoutName] : undefined) ?? active;
+              if (!arrActive) return null;
+              const arrScope = new Set(arr.held);
+              const tree = renderNode(arrActive, store.getAppState() as Record<string, unknown>, dispatch, theme, `${String(key ?? cname)}-tpl`, makeResolveSlot(arrScope), tpl.defs);
+              // A PLACE DECLARES ITS WIDTH ONCE (docs/design/05), same law as a slot
+              // panel: `appWidth` resolves via theme.appSize and sizes the frame box —
+              // `flex` is the served "all remaining space" name. Without it the frame's
+              // own styles decide (and a width-less frame beside a fixed-width chat
+              // collapsed to its padding — observed live 2026-08-28).
+              const declaredW = (node as { appWidth?: string }).appWidth;
+              const placeW = cssWidth(typeof declaredW === "string" ? (theme.appSize?.[declaredW] ?? declaredW) : undefined);
+              // THEME-FREE FALLBACK (same law as computeAppWidth's marker): a theme without
+              // an `appSize.flex` token must still mean "fill the remaining host space" —
+              // an unresolved name collapsed the place to its padding (observed live
+              // 2026-08-28, the light theme's missing `flex`).
+              const flexFallback = !placeW && declaredW === "flex";
+              const rawFrame = (node as { frame?: UnoverseNode }).frame;
+              if (rawFrame) {
+                const frame = placeW
+                  ? ({ ...rawFrame, style: { ...(rawFrame.style ?? {}), width: placeW, flex: "0 0 auto" } } as UnoverseNode)
+                  : flexFallback
+                    ? ({ ...rawFrame, style: { ...(rawFrame.style ?? {}), flex: "1 1 0%", minWidth: 0 } } as UnoverseNode)
+                    : rawFrame;
+                const innerSlot: SlotResolver = () => tree;
+                return renderNode(frame, store.getAppState() as Record<string, unknown>, dispatch, theme, `${String(key ?? cname)}-frame`, innerSlot, def?.defs);
+              }
+              return <div style={{ display: "flex", flexDirection: "column", minHeight: 0, ...(placeW ? { width: placeW, flex: "0 0 auto" } : flexFallback ? { flex: "1 1 0%", minWidth: 0 } : {}) }}>{tree}</div>;
+            }}
+          />
+        );
       }
       const stateNames = spec?.states ? Object.keys(spec.states) : [];
       const appState = store.getAppState() as Record<string, unknown>;

package/vendor/sdk/lib/core/actions.ts

@@ -69,8 +69,8 @@ export function dispatchAction(
     // on the channel path every other server action uses; the server decides whether
     // any hook cares. The payload carries both spellings during the migration (the
     // server's lifecycle scope historically read `layout`).
-    if (ctx.nodeId && ("view" in patch || "defaultState" in patch)) {
-      const entered = patch.view ?? patch.defaultState;
+    if (ctx.nodeId && ("state" in patch || "view" in patch || "defaultState" in patch)) {
+      const entered = patch.state ?? patch.view ?? patch.defaultState;
       ctx.sendToServer?.("viewEntered", { layout: entered, view: entered });
     }
   } else if (spec.type === "setAppValue") {

package/vendor/sdk/lib/core/apps.ts

@@ -15,17 +15,18 @@ import type { ComponentStore } from "./store";
 import type { UnoverseDefinition, UnoverseNode } from "./types";
 
 /**
- * THE PUBLIC AXIS (STATE_MODEL v2 §2): a component's public state lives in its slice
- * under `view`; `defaultState` is the read-compatible legacy alias during migration.
- * Every derivation reads through these two helpers so the alias lives in ONE place.
+ * THE PUBLIC AXIS: a component's public state lives in its slice under `state`
+ * (the word ruled 2026-08-29, finishing the v2 rename journey); `view` and
+ * `defaultState` are the read-compatible legacy aliases during migration.
+ * Every derivation reads through these two helpers so the aliases live in ONE place.
  */
 export const viewOf = (slice: Record<string, unknown> | null | undefined): string | undefined => {
-  const v = slice?.view ?? slice?.defaultState;
+  const v = slice?.state ?? slice?.view ?? slice?.defaultState;
   return typeof v === "string" ? v : undefined;
 };
 
-/** Is a `select.where` field the public axis? Accepts both spellings during migration. */
-export const isViewField = (f: unknown): boolean => f === "view" || f === "defaultState";
+/** Is a `select.where` field the public axis? Accepts every spelling during migration. */
+export const isViewField = (f: unknown): boolean => f === "state" || f === "view" || f === "defaultState";
 
 /**
  * THE TEMPLATE'S DECLARED ORDER (STATE_MODEL v2 §5 rule 5) — its priority ladder and
@@ -323,11 +324,16 @@ export function resolveLatch(
 /** Resolve a ComponentSlot's `select` against the store → ordered pointers. */
 export function selectPointers(store: ComponentStore, node: UnoverseNode, scope?: Set<string>): string[] {
   const sel = (node.select ?? {}) as { from?: string; type?: string; where?: { field?: string; eq?: unknown; ne?: unknown }; limit?: number };
+  // A SCOPED selection (the mount's hold: latest) spans ALL turns and the SCOPE is
+  // the boundary — never the latest assistant turn. The guest's send opens a new
+  // (empty) turn immediately, so latest-turn scoping emptied the mount at every
+  // send and refilled it as renders landed: the shelf flicker ruled out in
+  // UNOVERSE_TEMPLATE_MODEL §12e. The delivery scope is touch-based for exactly
+  // this reason (turn position says nothing about freshness).
   let pointers =
-    sel.from === "all"
+    sel.from === "all" || scope
       ? store.getResponses().flatMap((r) => r.components)
       : (store.latestResponse()?.components ?? []);
-  // A SCOPED selection (the mount's hold: latest) sees only the given pointers.
   if (scope) pointers = pointers.filter((p) => scope.has(p));
 
   // `where` — select by COMPONENT STATE (the reaction contract, STATE_MODEL §5b): any

package/vendor/sdk/lib/core/conditions.ts

@@ -10,9 +10,21 @@
  */
 import type { Condition, VisibleWhen, UnoverseNode } from "./types";
 
+/** THE PUBLIC AXIS ALIASES (`state` is the ruled word, 2026-08-29; `view` and
+ *  `defaultState` are the legacy spellings): a lookup on any axis word falls
+ *  through the aliases, so a layout authored in either era reads a slice keyed in
+ *  either era. Lives HERE so every "react to state" mechanism shares it. */
+const AXIS_WORDS = ["state", "view", "defaultState"] as const;
+function scopeValue(data: Record<string, unknown>, field: string): unknown {
+  const v = data[field];
+  if (v !== undefined || !(AXIS_WORDS as readonly string[]).includes(field)) return v;
+  for (const w of AXIS_WORDS) if (data[w] !== undefined) return data[w];
+  return undefined;
+}
+
 /** Does a `Condition` hold against the data scope? `eq`/`ne`/`in`, else a truthy test. */
 export function matches(cond: Condition, data: Record<string, unknown>): boolean {
-  const v = data[cond.field];
+  const v = scopeValue(data, cond.field);
   if ("eq" in cond) return v === cond.eq;
   if ("ne" in cond) return v !== cond.ne;
   if ("in" in cond) return Array.isArray(cond.in) && cond.in.includes(v);
@@ -24,7 +36,7 @@ export function matches(cond: Condition, data: Record<string, unknown>): boolean
  *  `Condition`. Returns whether the node should render. */
 export function visible(vw: VisibleWhen, data: Record<string, unknown>): boolean {
   if (typeof vw === "string") {
-    const v = data[vw];
+    const v = scopeValue(data, vw);
     return !(v == null || v === "" || v === false || (Array.isArray(v) && v.length === 0));
   }
   return matches(vw, data);
@@ -38,6 +50,6 @@ export function selectCase(
 ): UnoverseNode | undefined {
   const cases = node.cases;
   if (!cases) return undefined;
-  const key = node.on != null ? String(data[node.on] ?? "") : "";
+  const key = node.on != null ? String(scopeValue(data, node.on) ?? "") : "";
   return cases[key] ?? cases.default;
 }

package/vendor/sdk/lib/core/connection.ts

@@ -140,10 +140,26 @@ export function applyServerMessage(store: ComponentStore, msg: ServerMessage, se
     case "COMPONENTS_CLEAR": {
       // Rule 5's empty delivery (STATE_MODEL §5, amended 2026-08-26): a turn that ran
       // with cards enabled and surfaced none owns the screen — earlier-turn components
-      // in public states retract to inline. The sender decided WHEN; this only obeys.
+      // in public states retract to inline, and the delivery is SPENT (§12e: the
+      // confirmed-empty boundary — the mount collapses now, not at the guest's send).
+      // The sender decided WHEN; this only obeys.
+      store.spendDelivery();
       store.supersedeAll(typeof msg.chatId === "string" ? msg.chatId : undefined);
       return;
     }
+    case "DIRECTOR_VERDICT": {
+      // The director's judged hold for the delivery (UNOVERSE_TEMPLATE_MODEL §7):
+      // ids and order only, judged server-side at run completion. Each item names
+      // the chatId it was DELIVERED under (turn or conversation — the durable
+      // lane), so the pointer is exact. This only obeys — exactly the
+      // COMPONENTS_CLEAR contract, for the held-something verdict.
+      const raw = (msg as { items?: unknown }).items;
+      const items = Array.isArray(raw)
+        ? raw.filter((x): x is { chatId: string; nodeId: string } => !!x && typeof (x as { chatId?: unknown }).chatId === "string" && typeof (x as { nodeId?: unknown }).nodeId === "string")
+        : [];
+      if (items.length) store.applyDirectorVerdict(items);
+      return;
+    }
     // No AUDIO_STATE case: voice is a NATIVE SERVICE on the WS audio lane (useVoiceService),
     // NOT the structured MCP stream. Audio-state events never arrive here (UNOVERSE_SPEC §2e-1).
     case "APP_DATA": {

package/vendor/sdk/lib/core/store.ts

@@ -94,8 +94,15 @@ export class ComponentStore {
   //     ComponentSlot.select.where's "most recent state-write wins" ordering (§5b).
   //     Generic bookkeeping: core stamps WHEN a slice changed, never reads WHAT. ---
   private touches = new Map<string, number>();
-  /** The touch sequence at the guest's last send — the CURRENT DELIVERY's floor. */
+  /** The CURRENT DELIVERY's floor — advanced by the settle (applyDirectorVerdict)
+   *  and the confirmed-empty clear (spendDelivery), NEVER by the guest's send
+   *  (§12e ruling 2: the replacement is the boundary). */
   private deliveryWatermark = 0;
+  /** A judged DIRECTOR_VERDICT's held pointers for the current delivery (null = no
+   *  verdict — the mount holds the whole delivery). Generic bookkeeping: core stores
+   *  WHICH slices the sender's verdict held, never why (the judging happened
+   *  server-side; this only obeys, exactly like COMPONENTS_CLEAR). */
+  private directorHeld: Set<string> | null = null;
   /** Slices whose LATEST write was a guest interaction (`mergeComponentState`) — value is
    *  that write's touch seq. Powers `pinned` layouts: guest writes move them, arrivals don't. */
   private interactionTouches = new Map<string, number>();
@@ -129,12 +136,22 @@ export class ComponentStore {
    * the ONE home for the reset every boundary uses (new turn, guest close, template
    * swap) — never re-hardcode `"inline"` at a call site.
    */
+  /** THE FACE-WRITE KEY: the spelling this slice already speaks — `state` (the
+   *  ruled word, 2026-08-29), else the legacy alias it was seeded with. New
+   *  slices always land on `state`. */
+  private faceKey(slice: Record<string, unknown>): "state" | "view" | "defaultState" {
+    if ("state" in slice) return "state";
+    if ("view" in slice) return "view";
+    if ("defaultState" in slice) return "defaultState";
+    return "state";
+  }
+
   private retractSlice(key: string, slice: Record<string, unknown>): boolean {
-    const current = (slice.view ?? slice.defaultState) as unknown;
+    const current = (slice.state ?? slice.view ?? slice.defaultState) as unknown;
     const base = typeof slice.initialView === "string" ? slice.initialView : "inline";
     if (typeof current !== "string" || current === base) return false;
     const next: Record<string, unknown> = { ...slice };
-    if ("view" in next || !("defaultState" in next)) next.view = base;
+    next[this.faceKey(next)] = base;
     if ("defaultState" in next) next.defaultState = base;
     this.data.set(key, next);
     this.touches.set(key, ++this.touchSeq);
@@ -210,10 +227,10 @@ export class ComponentStore {
     for (const [key, slice] of this.data) {
       if (arrivingChatId && key.startsWith(`${arrivingChatId}:`)) continue;
       if (slice.lifetime === "conversation") continue;
-      const v = (slice.view ?? slice.defaultState) as unknown;
+      const v = (slice.state ?? slice.view ?? slice.defaultState) as unknown;
       if (typeof v !== "string" || !v || v === "inline") continue;
       const next: Record<string, unknown> = { ...slice };
-      if ("view" in next || !("defaultState" in next)) next.view = "inline";
+      next[this.faceKey(next)] = "inline";
       if ("defaultState" in next) next.defaultState = "inline";
       this.data.set(key, next);
       this.touches.set(key, ++this.touchSeq);
@@ -227,11 +244,17 @@ export class ComponentStore {
     let changed = false;
     for (const [key, slice] of this.data) {
       if (key.startsWith(`${arrivingChatId}:`)) continue; // same turn = same delivery
+      // A DIRECTOR-HELD slice is under the director's authority (§12e): its
+      // replacement belongs to the settle, never to the mechanical refresh — a
+      // new batch's first card must not retract the held shelf mid-search (the
+      // between-turns flicker, observed live after the durable shield retired).
+      // Un-directed apps are untouched: no verdict, no hold, rule 5 as ever.
+      if (this.directorHeld?.has(key)) continue;
       if (slice.lifetime === "conversation") continue;
-      const v = (slice.view ?? slice.defaultState) as unknown;
+      const v = (slice.state ?? slice.view ?? slice.defaultState) as unknown;
       if (v !== view) continue;
       const next: Record<string, unknown> = { ...slice };
-      if ("view" in next || !("defaultState" in next)) next.view = "inline";
+      next[this.faceKey(next)] = "inline";
       if ("defaultState" in next) next.defaultState = "inline";
       this.data.set(key, next);
       this.touches.set(key, ++this.touchSeq);
@@ -257,8 +280,8 @@ export class ComponentStore {
     let changed = false;
     for (const [key, slice] of this.data) {
       if (slice.lifetime === "conversation") continue;
-      if (!below.has((slice.view ?? slice.defaultState) as string)) continue;
-      this.data.set(key, { ...slice, ...("defaultState" in slice ? { defaultState: "inline" } : { view: "inline" }) });
+      if (!below.has((slice.state ?? slice.view ?? slice.defaultState) as string)) continue;
+      this.data.set(key, { ...slice, [this.faceKey(slice)]: "inline", ...("defaultState" in slice ? { defaultState: "inline" } : {}) });
       this.touches.set(key, ++this.touchSeq);
       changed = true;
     }
@@ -331,6 +354,24 @@ export class ComponentStore {
     this.bump();
   }
 
+  /**
+   * THE GUEST'S HAND OUTRANKS AN ARRIVAL'S RE-FACE (STATE_MODEL guest-control law,
+   * TEMPLATE_MODEL §6b rule 3: the director — and its deliveries — sit UNDER the
+   * guest's hand). Once the slice's LATEST write is the guest's own (an open Detail
+   * View), an inbound payload keeps its content but loses its face words: a
+   * re-delivered card must refresh WHAT the guest is reading, never yank them out
+   * of it (observed live 2026-08-29: a broad follow-up re-served the open card,
+   * its seeded `view: "grid"` overwrote the guest's `page`, the ladder fell to
+   * grid). The guest releases the face themselves (✕); from then on the server
+   * writes it again as ever.
+   */
+  private shieldGuestFace(key: string, payload: Record<string, unknown>): Record<string, unknown> {
+    if (!("state" in payload) && !("view" in payload) && !("defaultState" in payload)) return payload;
+    if ((this.interactionTouches.get(key) ?? -1) < (this.touches.get(key) ?? 0)) return payload;
+    const { state: _s, view: _v, defaultState: _d, ...content } = payload;
+    return content;
+  }
+
   /** Apply a streamed event (COMPONENT_INIT or COMPONENT_DATA). */
   apply(event: UnoverseEvent): void {
     const key = `${event.chatId}:${event.nodeId}`;
@@ -338,10 +379,10 @@ export class ComponentStore {
       this.types.set(key, event.component.type);
       if (event.component.componentUrl) this.urls.set(key, event.component.componentUrl);
       this.placeInTimeline(event.chatId, key); // structure: place the pointer ONCE
-      this.merge(key, event.component.props ?? {}); // data: seed
+      this.merge(key, this.shieldGuestFace(key, event.component.props ?? {})); // data: seed
       // Rule 5 — an arrival carrying a public state refreshes that state.
       const seeded = event.component.props as Record<string, unknown> | undefined;
-      this.supersede(event.chatId, seeded?.view ?? seeded?.defaultState);
+      this.supersede(event.chatId, seeded?.state ?? seeded?.view ?? seeded?.defaultState);
     } else {
       // NEW ACTIVITY reads newest-at-the-bottom: if this component is no longer the
       // LAST pointer in its turn (something was placed after it), fresh server data
@@ -354,10 +395,10 @@ export class ComponentStore {
         resp.components.push(key);
         this.bump();
       }
-      this.merge(key, event.data);
+      this.merge(key, this.shieldGuestFace(key, event.data));
       // Rule 5 — a server data-write that PLACES a component into a public state
       // (the host's arrival placement rides COMPONENT_DATA) refreshes that state.
-      this.supersede(event.chatId, (event.data as Record<string, unknown> | undefined)?.view ?? (event.data as Record<string, unknown> | undefined)?.defaultState);
+      this.supersede(event.chatId, (event.data as Record<string, unknown> | undefined)?.state ?? (event.data as Record<string, unknown> | undefined)?.view ?? (event.data as Record<string, unknown> | undefined)?.defaultState);
     }
   }
 
@@ -370,9 +411,11 @@ export class ComponentStore {
    *  guest's next message; a stale rail is cleared by the cards that replace it,
    *  never by the message that asked for them. */
   addUserMessage(chatId: string, text: string): void {
-    // The guest's send is the delivery boundary (hold: latest, basic form): every
-    // pointer not server-touched after this moment leaves the current set.
-    this.deliveryWatermark = this.touchSeq;
+    // RULE 7 RESTORED (UNOVERSE_TEMPLATE_MODEL §12e ruling 2): typing changes
+    // NOTHING. The delivery boundary is the REPLACEMENT — the judged batch's
+    // settle (applyDirectorVerdict) or the confirmed-empty clear (spendDelivery)
+    // — never the message that asked for it. The held set stays on screen
+    // through the whole search.
     this.timeline.push({ role: "user", id: `u${this.seq++}`, chatId, text, createdAt: Date.now() });
     this.evict();
     this.bump();
@@ -564,11 +607,10 @@ export class ComponentStore {
   getTimeline(): readonly Turn[] {
     return this.timeline;
   }
-  /** THE CURRENT DELIVERY (hold: latest, basic form — UNOVERSE_TEMPLATE_MODEL §9b):
-   *  the pointers placed since the guest's LAST SEND. A mounted template holds only
-   *  these, so the guest's own send clears the set — nothing stale ever survives a
-   *  turn, and the disappearance happens at the guest's action, never a background
-   *  delivery's. */
+  /** THE CURRENT DELIVERY (hold: latest — UNOVERSE_TEMPLATE_MODEL §9b, boundary per
+   *  §12e): the pointers placed since the last SETTLE or CLEAR. A mounted template
+   *  holds only these; the set survives the guest's next send and is spent exactly
+   *  when its replacement arrives (or emptiness is confirmed) — never sooner. */
   currentDeliveryPointers(): Set<string> {
     // TOUCH-BASED, not turn-based: durable-keyed instances (conversation-chatId
     // renders) file into ONE assistant turn across the whole conversation, so turn
@@ -581,6 +623,47 @@ export class ComponentStore {
         if ((this.touches.get(p) ?? 0) > this.deliveryWatermark) out.add(p);
     return out;
   }
+  /** THE DIRECTOR'S HOLD (UNOVERSE_TEMPLATE_MODEL §7): the verdict's pointers that are
+   *  still in the given delivery. null = no verdict, or nothing it held survives — the
+   *  caller falls back to the whole delivery (fail open, §6c rule 9: the screen never
+   *  pays for a stale or broken verdict). */
+  directorScope(delivery: Set<string>): Set<string> | null {
+    if (!this.directorHeld) return null;
+    const out = new Set<string>();
+    for (const p of this.directorHeld) if (delivery.has(p)) out.add(p);
+    return out.size ? out : null;
+  }
+  /** Apply a judged DIRECTOR_VERDICT: these instances are the delivery's held set, in
+   *  this order. Each item carries the chatId it was DELIVERED under (the turn's, or
+   *  the conversation's for durable renders) so the pointer is exact. ORDER IS RECENCY
+   *  — the strongest is re-stamped LAST so the existing touch-desc sort draws it
+   *  first: the platform's one ordering word, no new machinery. Only slices that
+   *  exist are stamped; unknown ids are ignored (selection only — a verdict can
+   *  never invent an instance). */
+  applyDirectorVerdict(items: Array<{ chatId: string; nodeId: string }>): void {
+    // THE SETTLE IS THE DELIVERY BOUNDARY (§12e ruling 2): spend everything
+    // older, then stamp the held set above the new line — one atomic replace,
+    // so the previous cards survive the whole search and leave exactly when
+    // their replacement arrives.
+    this.deliveryWatermark = this.touchSeq;
+    const held = new Set<string>();
+    for (let i = items.length - 1; i >= 0; i--) {
+      const p = `${items[i].chatId}:${items[i].nodeId}`;
+      if (!this.data.has(p)) continue;
+      held.add(p);
+      this.touches.set(p, ++this.touchSeq);
+    }
+    this.directorHeld = held.size ? held : null;
+    this.bump();
+  }
+  /** The confirmed-empty boundary (COMPONENTS_CLEAR): the run delivered nothing,
+   *  so the current set is spent with nothing replacing it — the mount collapses.
+   *  Same spend as the settle, without a new held set. */
+  spendDelivery(): void {
+    this.deliveryWatermark = this.touchSeq;
+    this.directorHeld = null;
+    this.bump();
+  }
   /** Just the assistant responses, in order. */
   getResponses(): AssistantTurn[] {
     return this.timeline.filter((t): t is AssistantTurn => t.role === "assistant");

package/vendor/sdk/lib/transition/MountArrangement.tsx

@@ -0,0 +1,71 @@
+/**
+ * The double-buffered mount (UNOVERSE_TEMPLATE_MODEL §13.3): renders its LAST
+ * COMMITTED arrangement and commits the next one only when the decision allows —
+ * so a data ripple can never move the shelf, and the boundary commit is the one
+ * designed (and, with theme motion, animated) change. Content inside held
+ * instances stays live automatically: the render closure reads slices from the
+ * store at render time; only membership and order are buffered here.
+ *
+ * Fail open (§13.5): a "hold" with no boundary inside the grace window commits
+ * anyway — the screen never pays for machinery failure.
+ *
+ * RENDER-LAYER state, deliberately: the portable core stays frozen and "no UI
+ * state in the store" holds.
+ */
+
+import React, { useEffect, useRef, useState } from "react";
+import type { ReactNode } from "react";
+import { decideCommit, type Arrangement } from "./decide";
+import { commitArrangement } from "./viewTransition";
+
+/** A held-back change commits anyway after this long without a boundary. */
+const GRACE_MS = 4000;
+
+export function MountArrangement({
+  next,
+  directed,
+  motion,
+  render,
+}: {
+  /** The arrangement the store derives RIGHT NOW. */
+  next: Arrangement;
+  /** The placement grants a director — every delivery settles, so membership
+   *  waits for the settle (decide.ts). */
+  directed: boolean;
+  /** Theme-requested motion (§13.4) — absent theme word = instant commits. */
+  motion: boolean;
+  /** Build the tree for an arrangement; slices are read live inside. */
+  render: (arrangement: Arrangement) => ReactNode;
+}) {
+  const [committed, setCommitted] = useState<Arrangement | null>(null);
+  const graceTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const decision = decideCommit(committed, next, directed);
+
+  useEffect(() => {
+    if (decision === "none") return;
+    if (decision === "hold") {
+      if (!graceTimer.current) {
+        graceTimer.current = setTimeout(() => {
+          graceTimer.current = null;
+          setCommitted(next);
+        }, GRACE_MS);
+      }
+      return;
+    }
+    if (graceTimer.current) {
+      clearTimeout(graceTimer.current);
+      graceTimer.current = null;
+    }
+    if (decision === "transition") commitArrangement(() => setCommitted(next), motion);
+    else setCommitted(next);
+  });
+
+  useEffect(
+    () => () => {
+      if (graceTimer.current) clearTimeout(graceTimer.current);
+    },
+    [],
+  );
+
+  return <>{render(committed ?? next)}</>;
+}