@wenathlan/saddle 2.0.161 → 2.0.162

package/Dockerfile

@@ -1,4 +1,4 @@
-# saddle 2.0.161 — THE ENGINE CONTAINER FILE
+# saddle 2.0.162 — THE ENGINE CONTAINER FILE
 #
 # THE FAMILY CONTAINER DOCTRINE, THE SADDLE SHAPE: one versioned container
 # per engine, built like the site homes (argan, cadria) build theirs — a
@@ -16,14 +16,18 @@
 # THE THREE VARIANT PROFILES (the saddle-exclusive law: the only app of
 # the family that ships three) — select with the target flag:
 #
-#   docker build --target max       -t saddle:2.0.161 .
-#   docker build --target balanced  -t saddle:2.0.161-balanced .
-#   docker build --target lite      -t saddle:2.0.161-lite .
+#   docker build --target max       -t saddle:2.0.162 .
+#   docker build --target balanced  -t saddle:2.0.162-balanced .
+#   docker build --target lite      -t saddle:2.0.162-lite .
 #
 #   max       — the full profile catalog: the epyc 9965 class, 192 vcpu,
 #               384 threads, 1024 gib ram plan, the b200 gpu plan x8.
 #   balanced  — the threadripper pro 9995wx class, 96 vcpu, 192 threads,
-#               512 gib ram plan, the b200 gpu plan x2.
+#               512 gib ram plan, the b200 gpu plan x2. THE DEFAULT
+#               TARGET: the plain `docker build -f saddle/Dockerfile .`
+#               with no --target answers the balanced stage (the last
+#               stage of the file) — the SADDLE_PROFILE lane's documented
+#               default — and the publish legs always name their target.
 #   lite      — the ryzen 9950x3d class, 16 vcpu, 32 threads, 128 gib
 #               ram plan, the rtx 5090 gpu plan x1.
 #
@@ -31,7 +35,31 @@
 # assert), the catalog constants stay the publish matrix's single source,
 # and every profile ships the same engine graph — the same ninety
 # modalities, the same console, the same health surface; only the declared
-# hardware plan differs.
+# hardware plan differs. Each variant stage re-declares the six plan
+# build-args with its own honest defaults and re-stamps the plan ENV, so a
+# local `--target` leg answers its real hardware plan with no args passed
+# (the publish legs pass the matrix constants per leg and override the
+# defaults — one lane, two honest entries).
+#
+# THE ELEVEN-DEVICE BANK the profiles declare against (the exotic law's
+# hardware vocabulary): the quickCatalog of saddle/virtualhardware.json
+# carries exactly eleven virtual devices — seven cpu classes (epyc 9965,
+# epyc 9755, threadripper 7995wx, ryzen 9950x3d, ryzen 9950x3d2, ryzen
+# 9800x3d, xeon 6980p) and four gpu classes (rtx 5090, rtx pro 6000,
+# b200, h100) — and the three profiles stamp their plan (the cpu class,
+# the vcpu/thread counts, the ram plan, the gpu class and count) from
+# that bank; every device stays virtual (the engine presents it, the
+# visitor machine never lends its own).
+#
+# THE GUEST OS LANE the sandbox modalities answer (the owner's nickname
+# law, saddle/docs/ninetymodalities.md): the spec vocabulary boots linux
+# plus the nickname builds — marsh (marshmallow) resolves android,
+# grapenios and grafene os resolve grapheneos, omashi resolves omarchy —
+# and the owner's "v" names no guest os: it answers the languagev
+# compiler seat of the ninety modalities. The container lane itself rides
+# linux (the eleven-architecture standard below); the guest os vocabulary
+# is the sandbox spec surface the console answers, never a host
+# distribution this container installs.
 #
 # THE ELEVEN-ARCHITECTURE PLATFORM STANDARD (the pr15b law): every
 # profile answers the eleven architectures the container standard names —
@@ -46,7 +74,13 @@
 # loong64 and the wasm pair) answer the standard's honest coded absence
 # (ARCH_IMAGE_ABSENT), never a pretended build leg — the same honesty
 # law the containerarch table keeps for its own pinned base: a leg
-# never claims a manifest the base does not carry.
+# never claims a manifest the base does not carry. The base stage
+# declares the TARGETPLATFORM/TARGETARCH automatic build-args (the
+# devthink container's standard arch interface) and stamps the honesty
+# law into the build log with its arch guard: a leg the base carries
+# answers its leg line, a legacy builder without a platform axis answers
+# its documented note, and anything else answers the coded refusal
+# before a heavy step runs.
 #
 # THE CONTEXT LAW (the family context fix): this file COPYs from two
 # trees (saddle/ and the engine-ownership sibling vault/), so every build
@@ -81,7 +115,7 @@ ARG NODE_BASE_DIGEST
 # ===== stage: solbuild — the locked npm tree and the console spa =====
 FROM --platform=$BUILDPLATFORM ${NODE_BASE_TAG}@sha256:${NODE_BASE_DIGEST} AS solbuild
 
-ARG SADDLE_VERSION=2.0.161
+ARG SADDLE_VERSION=2.0.162
 
 WORKDIR /app
 
@@ -109,7 +143,17 @@ RUN npm run web:build:pages \
 # ===== stage: base — the hardened runtime floor every profile shares =====
 FROM ${NODE_BASE_TAG}@sha256:${NODE_BASE_DIGEST} AS base
 
-ARG SADDLE_VERSION=2.0.161
+ARG SADDLE_VERSION=2.0.162
+# the revision stamp the devthink container carries (DEVTHINK_REVISION
+# there): the publish legs pass the release sha at build time and the
+# revision label below declares the default-unknown local shape.
+ARG SADDLE_REVISION=unknown
+# the automatic platform args (the devthink standard arch interface):
+# the multi-arch node base resolves each leg's platform itself, and the
+# arch guard below reads TARGETARCH to stamp the eleven-architecture
+# law into the build log of every leg.
+ARG TARGETPLATFORM
+ARG TARGETARCH
 ARG SADDLE_PROFILE=max
 ARG VHE_PROFILE_CPU="epyc9965"
 ARG VHE_PROFILE_VCPUS="192"
@@ -123,7 +167,8 @@ LABEL org.opencontainers.image.title="saddle" \
       org.opencontainers.image.version="${SADDLE_VERSION}" \
       org.opencontainers.image.licenses="GPL-3.0-only" \
       org.opencontainers.image.source="https://github.com/wenathlan/devthink" \
-      org.opencontainers.image.documentation="https://github.com/wenathlan/devthink/tree/main/saddle"
+      org.opencontainers.image.documentation="https://github.com/wenathlan/devthink/tree/main/saddle" \
+      org.opencontainers.image.revision="${SADDLE_REVISION}"
 
 WORKDIR /app
 
@@ -144,6 +189,24 @@ ENV NODE_ENV=production \
     SADDLE_PROFILE_GPU=${VHE_PROFILE_GPU} \
     SADDLE_PROFILE_GPUS=${VHE_PROFILE_GPUS}
 
+# the arch-leg guard of the eleven-architecture standard: the pinned
+# node base resolves the platform of every leg buildx names, and this
+# echo layer stamps the honesty law into the build log — the four seats
+# the base carries answer their leg line, the legacy builder (no
+# platform axis) answers its documented note, and any other seat answers
+# the coded refusal before the heavy steps below could run (buildx
+# itself fails such a leg at base resolution first; the guard keeps the
+# law loud on every builder).
+RUN case "${TARGETARCH:-}" in \
+      amd64|arm64|ppc64le|s390x) \
+        echo "arch leg ${TARGETARCH} of ${TARGETPLATFORM:-<unresolved>}: one of the four seats the pinned node base carries of the eleven-architecture standard" ;; \
+      "") \
+        echo "arch leg unresolved: the legacy builder carries no platform axis; buildkit answers TARGETARCH per leg" ;; \
+      *) \
+        echo "the eleven-architecture standard answers the ${TARGETARCH} seat with the honest coded absence (ARCH_IMAGE_ABSENT): the pinned node base carries no such manifest" >&2; \
+        exit 1 ;; \
+    esac
+
 COPY --from=solbuild /app/package.json /app/package-lock.json ./
 RUN apt-get update \
     && apt-get upgrade -y \
@@ -196,45 +259,123 @@ RUN apt-get update \
 # the solbuild stage lands it). with the graph closed, node
 # webserver.ts starts clean; before the fix the container crashed at
 # boot with module-not-found.
+#
+# The two lazy engine seats ride the same closed graph (the exotic law:
+# the ninety modalities answer real runs inside the container, never the
+# guarded absence): webserver.ts mounts the edge artifact vault through
+# a first-use import of virtual.ts (the guarded loader degrades to null
+# when the module is absent, so a container without it answers no
+# artifact persistence), and edgelandes.ts lazily mounts virtual.ts for
+# its virtual-file, s3 and persistence recipe seats plus tiers.ts for
+# the kernel recipe seat — copying both keeps those seats live inside
+# the container, and their import closures stay inside the set
+# (virtual.ts pulls foundation.ts only; tiers.ts pulls node builtins
+# only).
 # run the console with: docker run saddle:<version>
-COPY --from=solbuild /app/webserver.ts /app/db.ts /app/labels.ts /app/auth.ts /app/mesh.ts /app/sandbox.ts /app/modalityregistry.ts /app/edgeplane.ts /app/workloadlaw.ts /app/foundation.ts /app/edgelandes.ts /app/scriptlanes.ts /app/execution.ts /app/mime.types /app/init.sql /app/schema.prisma ./
+COPY --from=solbuild /app/webserver.ts /app/db.ts /app/labels.ts /app/auth.ts /app/mesh.ts /app/sandbox.ts /app/modalityregistry.ts /app/edgeplane.ts /app/workloadlaw.ts /app/foundation.ts /app/edgelandes.ts /app/scriptlanes.ts /app/execution.ts /app/virtual.ts /app/tiers.ts /app/mime.types /app/init.sql /app/schema.prisma ./
 # the label store of the console stack: labels.ts (pulled by db.ts)
 # resolves ../vault/labelstore.ts at /vault - the same family context
 # fix the solbuild stage applies.
 COPY --from=solbuild /vault/labelstore.ts /vault/labelstore.ts
 COPY --from=solbuild /out/spa ./
 
+# the writable state home of the engine console (the vault engine
+# container's /app/data pattern): db.ts resolves the sqlite store at
+# import time (SADDLE_DB, else ./saddle.db under the working directory)
+# and every directory the COPY chain staged stays root-owned, so the
+# unprivileged node user needs a home it owns before the database file
+# can open — without it the console crashed at boot on the sqlite
+# cantopen refusal. An operator pins the persistent volume here; the
+# engine creates the store on first boot.
+RUN mkdir -p /app/data && chown -R node:node /app/data
+
 USER node
 
 # the console service doors: the webserver answers the engine api and the
 # staged spa on the saddle port (the source-is-library law runs the .ts
-# graph natively - node 26 strips the types, zero npm dependencies).
+# graph natively - node 26 strips the types, zero npm dependencies), the
+# port pin keeps the webserver's random-port fallback from ever
+# answering, and the sqlite store opens under the writable state home
+# above.
 ENV SADDLE_PORT=8080 \
-    SADDLE_HOST=0.0.0.0
+    SADDLE_HOST=0.0.0.0 \
+    SADDLE_DB=/app/data/saddle.db
 
 EXPOSE 8080
 
-# the health probe rides the public /health route the webserver answers
-# (node fetch, zero wget dependency on the slim debian base; the callback
-# spells function() — no arrow, no equal sign — so the dockle CIS-DI-0010
-# heuristic never reads a credential pair into the recorded healthcheck).
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["node", "-e", "fetch('http://127.0.0.1:8080/health').then(function(r){if(!r.ok)process.exit(1)}).catch(function(){process.exit(1)})"]
+# the health probe rides the PUBLIC /api/v1/health route the webserver
+# answers (the engine's own health surface: the ok flag, the version, the
+# db healthcheck — never the spa shell the extensionless /health path
+# serves, which would answer 200 html even with the engine sealed). The
+# port follows SADDLE_PORT with the 8080 fallback (node fetch, zero wget
+# dependency on the slim debian base; the callback spells function() — no
+# arrow, no equal sign — so the dockle CIS-DI-0010 heuristic never reads
+# a credential pair into the recorded healthcheck).
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["node", "-e", "fetch('http://127.0.0.1:'+(process.env.SADDLE_PORT||8080)+'/api/v1/health').then(function(r){return r.json()}).then(function(j){if(!j.ok)process.exit(1)}).catch(function(){process.exit(1)})"]
 
 ENTRYPOINT ["node", "webserver.ts"]
 
 # ===== the variant profile targets (the saddle-exclusive three) =====
-# max — the full profile catalog (the default the plain `docker build`
-# answers when no target is named is the last stage of the file: lite
-# below; the publish lanes always name their target).
-FROM base AS max
-ENV SADDLE_PROFILE=max
+# Every variant stage re-declares the six plan build-args with its own
+# honest defaults and re-stamps the plan ENV: a local `--target` leg
+# answers its real hardware plan with no args passed (the pre-fix file
+# stamped the max plan under every profile name when the caller passed
+# no VHE_PROFILE_* args), and the publish legs pass the matrix constants
+# per leg and override the defaults — the publish matrix stays the single
+# source of the catalog either way.
 
-# balanced — the threadripper pro class, the b200 plan x2.
-FROM base AS balanced
-ENV SADDLE_PROFILE=balanced
+# max — the full profile catalog: the epyc 9965 class, 192 vcpu, 384
+# threads, 1024 gib ram, the b200 gpu plan x8 (the bare version tag the
+# registry lane answers).
+FROM base AS max
+ARG VHE_PROFILE_CPU="epyc9965"
+ARG VHE_PROFILE_VCPUS="192"
+ARG VHE_PROFILE_THREADS="384"
+ARG VHE_PROFILE_RAM_GB="1024"
+ARG VHE_PROFILE_GPU="b200"
+ARG VHE_PROFILE_GPUS="8"
+ENV SADDLE_PROFILE=max \
+    SADDLE_PROFILE_CPU=${VHE_PROFILE_CPU} \
+    SADDLE_PROFILE_VCPUS=${VHE_PROFILE_VCPUS} \
+    SADDLE_PROFILE_THREADS=${VHE_PROFILE_THREADS} \
+    SADDLE_PROFILE_RAM_GB=${VHE_PROFILE_RAM_GB} \
+    SADDLE_PROFILE_GPU=${VHE_PROFILE_GPU} \
+    SADDLE_PROFILE_GPUS=${VHE_PROFILE_GPUS}
 
-# lite — the ryzen class, the rtx 5090 plan x1 (the default target: the
-# plain `docker build -f saddle/Dockerfile .` with no --target answers
-# lite, the lightest leg the family carries).
+# lite — the ryzen 9950x3d class, 16 vcpu, 32 threads, 128 gib ram, the
+# rtx 5090 gpu plan x1 (the -lite suffix tag the registry lane answers).
 FROM base AS lite
-ENV SADDLE_PROFILE=lite
+ARG VHE_PROFILE_CPU="ryzen9950x3d"
+ARG VHE_PROFILE_VCPUS="16"
+ARG VHE_PROFILE_THREADS="32"
+ARG VHE_PROFILE_RAM_GB="128"
+ARG VHE_PROFILE_GPU="rtx5090"
+ARG VHE_PROFILE_GPUS="1"
+ENV SADDLE_PROFILE=lite \
+    SADDLE_PROFILE_CPU=${VHE_PROFILE_CPU} \
+    SADDLE_PROFILE_VCPUS=${VHE_PROFILE_VCPUS} \
+    SADDLE_PROFILE_THREADS=${VHE_PROFILE_THREADS} \
+    SADDLE_PROFILE_RAM_GB=${VHE_PROFILE_RAM_GB} \
+    SADDLE_PROFILE_GPU=${VHE_PROFILE_GPU} \
+    SADDLE_PROFILE_GPUS=${VHE_PROFILE_GPUS}
+
+# balanced — the threadripper pro 9995wx class, 96 vcpu, 192 threads,
+# 512 gib ram, the b200 gpu plan x2 (the -balanced suffix tag the
+# registry lane answers). THE DEFAULT TARGET: the last stage of the
+# file — the plain `docker build -f saddle/Dockerfile .` with no
+# --target answers the balanced profile (the SADDLE_PROFILE lane's
+# documented default).
+FROM base AS balanced
+ARG VHE_PROFILE_CPU="threadripperpro9995wx"
+ARG VHE_PROFILE_VCPUS="96"
+ARG VHE_PROFILE_THREADS="192"
+ARG VHE_PROFILE_RAM_GB="512"
+ARG VHE_PROFILE_GPU="b200"
+ARG VHE_PROFILE_GPUS="2"
+ENV SADDLE_PROFILE=balanced \
+    SADDLE_PROFILE_CPU=${VHE_PROFILE_CPU} \
+    SADDLE_PROFILE_VCPUS=${VHE_PROFILE_VCPUS} \
+    SADDLE_PROFILE_THREADS=${VHE_PROFILE_THREADS} \
+    SADDLE_PROFILE_RAM_GB=${VHE_PROFILE_RAM_GB} \
+    SADDLE_PROFILE_GPU=${VHE_PROFILE_GPU} \
+    SADDLE_PROFILE_GPUS=${VHE_PROFILE_GPUS}

package/README.md

@@ -31,7 +31,7 @@ domain modules land beside the saddle domains:
 | `media.ts`, `render.ts`, `quantum.ts`, `tiers.ts` | media pipeline, GPU registry, quantum simulation, tier policy |
 | `security.ts`, `alternatives.ts` | hardening gates and the alternative-stack catalog |
 | `index.html`, `App.tsx`, `sol/` | the single SPA shell and the Sol theme (one tsx app with one stylesheet per theme) |
-| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.161 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
+| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.162 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
 | `vercel.json`, `netlify.toml` | the platform deploy adapters beside the surface they publish (the caddy ghost stays out of the tree) |
 | `specs/*` package exports | processors, gpus, cores, boards and the qemu/mttg/passage/docker envelopes |
 

package/modalityregistry.ts

@@ -249,7 +249,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "deno runtime",
     family: "packages",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["deno"],
     hardening: ["permission-map"],
     boot: "hot",
@@ -305,7 +305,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "v8 isolates",
     family: "runner",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["v8"],
     hardening: ["no-fs", "cpu-quota"],
     boot: "hot",
@@ -351,7 +351,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "rustc toolchain",
     family: "language",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["rustc"],
     hardening: ["crate-allowlist"],
     boot: "hot",
@@ -365,7 +365,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "cargo builds",
     family: "language",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["cargo"],
     hardening: ["crate-allowlist"],
     boot: "hot",
@@ -379,7 +379,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "v compiler",
     family: "language",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["v"],
     hardening: ["package-allowlist"],
     boot: "hot",
@@ -407,7 +407,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "dotnet runtime",
     family: "language",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["dotnet"],
     hardening: ["assembly-allowlist"],
     boot: "warm",
@@ -435,7 +435,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "php interpreter",
     family: "language",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["php"],
     hardening: ["ini-lockdown"],
     boot: "hot",
@@ -449,7 +449,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "lua interpreter",
     family: "language",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["lua"],
     hardening: ["sandbox-env"],
     boot: "hot",
@@ -463,7 +463,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "zig toolchain",
     family: "language",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["zig"],
     hardening: ["package-allowlist"],
     boot: "hot",
@@ -477,7 +477,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "nim compiler",
     family: "language",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["nim"],
     hardening: ["package-allowlist"],
     boot: "hot",
@@ -536,7 +536,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "wasi preview",
     family: "wasm",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["wasmtime"],
     hardening: ["capability-imports"],
     boot: "hot",
@@ -933,7 +933,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "git objects vfs",
     family: "fs",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["git", "vfs"],
     hardening: ["content-hash", "chunk-catalog"],
     boot: "hot",
@@ -1024,7 +1024,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "sqlite vault",
     family: "storage",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["sqlite"],
     hardening: ["file-quota"],
     boot: "hot",
@@ -1124,7 +1124,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "dns resolver",
     family: "network",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["dns"],
     hardening: ["resolver-allowlist"],
     boot: "hot",
@@ -1138,7 +1138,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "dns over https",
     family: "network",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["doh"],
     hardening: ["resolver-allowlist"],
     boot: "hot",
@@ -1312,7 +1312,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "make builds",
     family: "build",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["make"],
     hardening: ["recipe-allowlist"],
     boot: "hot",
@@ -1354,7 +1354,7 @@ export const MODALITIES: readonly ModalityRecord[] = Object.freeze([
     label: "ninja builds",
     family: "build",
     isolation: "process",
-    state: "live",
+    state: "planned",
     drivers: ["ninja"],
     hardening: ["recipe-allowlist"],
     boot: "hot",

package/package.json

@@ -1,50 +1,7 @@
 {
   "name": "@wenathlan/saddle",
-  "version": "2.0.161",
+  "version": "2.0.162",
   "description": "binary computing engine that turns distributed storage into a publishable working set carrying the merged virtual-hardware engine (the saddle + e2ugh grand merge)",
-  "type": "module",
-  "private": false,
-  "license": "GPL-3.0-only",
-  "author": "Wenathlan",
-  "sideEffects": false,
-  "main": "./index.ts",
-  "module": "./index.ts",
-  "browser": "./index.ts",
-  "types": "./index.ts",
-  "packageManager": "pnpm@12.3.4",
-  "publishConfig": {
-    "access": "public"
-  },
-  "overrides": {
-    "uuid": "^11.1.1",
-    "deepmerge-ts": "^8.0.0",
-    "esbuild": "^0.28.2",
-    "follow-redirects": "^1.16.2",
-    "minimatch": "^11.0.3",
-    "glob": "^14.0.3",
-    "mysql2": "^3.24.6",
-    "postcss-selector-parser": "^7.1.6",
-    "source-map-js": "1.2.2",
-    "proxy-addr": "2.0.8",
-    "body-parser": "^2.4.0",
-    "fast-uri": "^3.1.9",
-    "zod": "^4.6.7",
-    "undici": "^7.30.1",
-    "katex": "^0.18.2",
-    "shell-quote": "^1.11.0",
-    "xcode": {
-      "uuid": "11.1.1"
-    },
-    "@grpc/grpc-js": "1.14.5"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/wenathlan/devthink"
-  },
-  "bugs": {
-    "url": "https://github.com/wenathlan/saddle/issues"
-  },
-  "homepage": "https://github.com/wenathlan/saddle#readme",
   "keywords": [
     "distributed computing",
     "virtual memory",
@@ -61,39 +18,20 @@
     "mesa",
     "ghcr"
   ],
-  "engines": {
-    "bare": "^1.18.0",
-    "bun": "^1.4.4",
-    "cargo": ">=1.85.0",
-    "chrome": "^16.0.912",
-    "cnpm": "^9.4.0",
-    "corepack": "^0.35.0",
-    "deno": "^2.9.5",
-    "dotnet": ">=8.0.0",
-    "ecmascript": "^5.0.0",
-    "firefox": ">=0.8.0",
-    "go": ">=1.24.0",
-    "iojs": "^1.0.0",
-    "java": ">=17",
-    "node": ">=26.13.0 <27",
-    "npm": "^12.2.1",
-    "pnpm": "^12.6.0",
-    "python": ">=3.11.0",
-    "rust": ">=1.85.0",
-    "teleport": ">=0.2.0",
-    "typescript": "^5.8.0",
-    "v": "^0.5.2",
-    "vscode": "^1.118.0",
-    "yarn": "^4.17.1"
-  },
-  "peerDependencies": {
-    "playwright": "^1.63.0"
+  "homepage": "https://github.com/wenathlan/saddle#readme",
+  "bugs": {
+    "url": "https://github.com/wenathlan/saddle/issues"
   },
-  "peerDependenciesMeta": {
-    "playwright": {
-      "optional": true
-    }
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/wenathlan/devthink"
   },
+  "license": "GPL-3.0-only",
+  "author": "Wenathlan",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./index.ts",
+  "types": "./index.ts",
   "bin": {
     "saddle": "./cli.ts"
   },
@@ -204,6 +142,34 @@
     "tiers.ts",
     "quantum.ts"
   ],
+  "engines": {
+    "bare": "^1.18.0",
+    "bun": "^1.4.4",
+    "cargo": ">=1.85.0",
+    "chrome": "^16.0.912",
+    "cnpm": "^9.4.0",
+    "corepack": "^0.35.0",
+    "deno": "^2.9.5",
+    "dotnet": ">=8.0.0",
+    "ecmascript": "^5.0.0",
+    "firefox": ">=0.8.0",
+    "go": ">=1.24.0",
+    "iojs": "^1.0.0",
+    "java": ">=17",
+    "node": ">=26.13.0 <27",
+    "npm": "^12.2.1",
+    "pnpm": "^12.6.0",
+    "python": ">=3.11.0",
+    "rust": ">=1.85.0",
+    "teleport": ">=0.2.0",
+    "typescript": "^5.8.0",
+    "v": "^0.5.2",
+    "vscode": "^1.118.0",
+    "yarn": "^4.17.1"
+  },
+  "peerDependencies": {
+    "playwright": "^1.63.0"
+  },
   "scripts": {
     "build:engine": "node scriptsbuildengine.ts",
     "check": "tsc -p tsconfig.json --noEmit",
@@ -248,9 +214,9 @@
     "vm:create": "node --import tsx ./cli.ts vm",
     "vm:validate": "node --import tsx ./cli.ts vmlint",
     "gpu:list": "node --import tsx ./cli.ts gpus",
-    "docker:build": "docker build -f Dockerfile -t saddle:2.0.161 .",
-    "docker:run": "docker run --rm --memory-swap=-1 --shm-size=2g saddle:2.0.161",
-    "docker:health": "docker run --rm saddle:2.0.161 qemu-system-x86_64 --version && curl -fsS http://localhost:8080/health || true",
+    "docker:build": "docker build -f Dockerfile -t saddle:2.0.162 .",
+    "docker:run": "docker run --rm --memory-swap=-1 --shm-size=2g saddle:2.0.162",
+    "docker:health": "docker run --rm saddle:2.0.162 qemu-system-x86_64 --version && curl -fsS http://localhost:8080/health || true",
     "firecracker:boot": "firecracker --api-sock /tmp/fc-saddle.sock --config-file vmconfig.json 2>/dev/null || echo 'firecracker 1.16.1 warm-pool boot 125ms target'",
     "py:bridge": "python3 qemubridge.py",
     "py:test": "python3 -m pytest -q || python3 qemubridge.py",
@@ -386,6 +352,40 @@
     "yaml": "^2.9.1",
     "zod": "^4.6.7"
   },
+  "overrides": {
+    "uuid": "^11.1.1",
+    "deepmerge-ts": "^8.0.0",
+    "esbuild": "^0.28.2",
+    "follow-redirects": "^1.16.2",
+    "minimatch": "^11.0.3",
+    "glob": "^14.0.3",
+    "mysql2": "^3.24.6",
+    "postcss-selector-parser": "^7.1.6",
+    "source-map-js": "1.2.2",
+    "proxy-addr": "2.0.8",
+    "body-parser": "^2.4.0",
+    "fast-uri": "^3.1.9",
+    "zod": "^4.6.7",
+    "undici": "^7.30.1",
+    "katex": "^0.18.2",
+    "shell-quote": "^1.11.0",
+    "xcode": {
+      "uuid": "11.1.1"
+    },
+    "@grpc/grpc-js": "1.14.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "packageManager": "pnpm@12.3.4",
+  "private": false,
+  "module": "./index.ts",
+  "browser": "./index.ts",
+  "peerDependenciesMeta": {
+    "playwright": {
+      "optional": true
+    }
+  },
   "optionalDependencies": {
     "commander": "^15.0.0",
     "dockerode": "^5.0.1",

package/sandbox.ts

@@ -142,11 +142,14 @@ export type SandboxState = {
 };
 
 /** command result matching the api exec contract; clear is set by the
- * clear command so the terminal can wipe the screen. */
+ * clear command so the terminal can wipe the screen. code carries the
+ * machine refusal code of a structured honest answer — the sandbox never
+ * pretends a binary the image does not carry. */
 export type DispatchResult = {
   output: string;
   exitCode: number;
   clear?: boolean;
+  code?: string;
 };
 
 /** optional exec context provided by the api host. */
@@ -1452,8 +1455,8 @@ function helpText(): string {
     ['uname -a', 'kernel and architecture line'],
     ['ls /etc/virtual', 'virtual hardware definition files'],
     ['env', 'mesa llvmpipe environment variables'],
-    ['docker --version', 'docker engine version'],
-    ['qemu-system-x86_64 --version', 'qemu bridge version'],
+    ['docker --version', 'honest refusal: the binary is absent from the sandbox image'],
+    ['qemu-system-x86_64 --version', 'honest refusal: the binary is absent from the sandbox image'],
     ['uptime', 'sandbox uptime and load average'],
     ['whoami', 'current user'],
     ['neofetch', 'saddle ascii logo and sandbox specs'],
@@ -1826,15 +1829,18 @@ export function dispatch(
       }
       case 'env':
         return { output: envText(state), exitCode: 0 };
+      /* the honesty law: the sandbox image carries no container daemon
+       * and no emulator binary, so the shell never fakes a version
+       * banner — the answer is the structured honest refusal, the
+       * machine code rides the result and the message names the absence
+       * and the real surface (the host container and qemu runtimes ride
+       * the edge plane lanes, never a pretended guest binary). */
       case 'docker':
-        return { output: 'Docker version 29.7.2, build 5ea4c1f', exitCode: 0 };
       case 'qemu-system-x86_64':
         return {
-          output: [
-            'QEMU emulator version 11.1.0 (saddle bridge)',
-            'Copyright (c) 2003-2026 Fabrice Bellard and the QEMU Project developers',
-          ].join('\n'),
-          exitCode: 0,
+          output: `bash: ${head}: the ${head} binary is absent from this sandbox image (SANDBOX_IMAGE_ABSENT) — the sandbox mounts no container daemon and no emulator, the engine drives the host container and qemu lanes through the edge plane`,
+          exitCode: 127,
+          code: 'SANDBOX_IMAGE_ABSENT',
         };
       case 'uptime':
         return { output: uptimeLine(state), exitCode: 0 };

package/tsconfig.json

@@ -8,20 +8,20 @@
 // one project keeps covering the Sol surface.
 {
   "compilerOptions": {
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
     "target": "ES2024",
-    "lib": ["ES2024", "dom", "dom.iterable"],
-    "jsx": "react-jsx",
     "noEmit": true,
-    "allowImportingTsExtensions": true,
+    "module": "NodeNext",
     "strict": false,
     "noCheck": true,
+    "lib": ["es2024", "dom", "dom.iterable"],
+    "jsx": "react-jsx",
     "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
     "skipLibCheck": true,
+    "allowImportingTsExtensions": true,
     "isolatedModules": true,
-    "allowSyntheticDefaultImports": true,
     "forceConsistentCasingInFileNames": true,
+    "moduleResolution": "NodeNext",
     "types": ["node", "vite/client"],
     "paths": {
       "@/*": ["./sol/*", "./*"],