@wenathlan/saddle 2.0.165 → 2.0.167

package/Dockerfile

@@ -1,4 +1,4 @@
-# saddle 2.0.165 — THE ENGINE CONTAINER FILE
+# saddle 2.0.167 — THE ENGINE CONTAINER FILE
 #
 # THE FAMILY CONTAINER DOCTRINE, THE SADDLE SHAPE: one versioned container
 # per engine, built like the site homes (argan, cadria) build theirs — a
@@ -62,15 +62,26 @@
 # distribution this container installs.
 #
 # THE OS DISTRIBUTION SEATS the saddle container carries (the osdistrib
-# law, saddle/containerarch.ts — the owner's sentence: "iniciar
+# law, saddle/containerarch.ts — the owner's sentences: "iniciar
 # distribuição do container saddle com por exemplo, grapheneos, omarchy
-# e outros sistemas dentro do saddle"): the container starts its
-# distribution catalog with the seven system seats the OSDISTRIBUTIONS
-# registry pins — grapheneos (a privacy and security hardened version of
-# android), omarchy (the arch linux-based distribution created by dhh),
-# vanilla os (based on ubuntu), maru os (firmware, not an application),
-# the v seat (the vlang platform the dependency catalog pins at 0.5.2,
-# never a guest distribution), the normal linux baseline and android —
+# e outros sistemas dentro do saddle" and "o saddle nao ta com mais de
+# 15 devido as disvbriçoe s com sistem aoperacional como graphene os e
+# etc" — the more-than-fifteen directive): the container carries the
+# sixteen system seats the OSDISTRIBUTIONS
+# registry pins — the seven named law seats (grapheneos a privacy and
+# security hardened version of android, omarchy the arch linux-based
+# distribution created by dhh, vanilla os based on ubuntu, maru os
+# firmware not an application, the v seat the vlang platform the
+# dependency catalog pins at 0.5.2 never a guest distribution, the
+# normal linux baseline and android) beside the nine honest additions —
+# postmarketos (the alpine-based mobile distribution), lineageos (the
+# community android continuation), calyxos (the privacy-focused android
+# distribution), archlinux (the rolling-release distribution omarchy
+# builds on), alpine (the musl-based lightweight distribution), debian
+# (the universal operating system), fedora (the red-hat-upstream
+# community distribution), nixos (the declarative distribution the nix
+# package manager builds) and void (the independent source-rolling
+# distribution) —
 # every seat paired with the architecture legs the eleven-architecture
 # standard already carries (the mobile and firmware seats ride the arm64
 # legs, the desktop and baseline seats ride amd64 and arm64) and bound
@@ -117,13 +128,17 @@
 # building from inside saddle/ breaks the vault COPY - the sibling rides
 # the context beside this directory, never inside it.
 #
-# THE DIGEST LAW: the FROM lines ride name@sha256:${NODE_BASE_DIGEST}
-# (the scorecard-file form the supply-chain gate reads as pinned) while
-# the digest itself never lands in a source file — the publish lanes
-# resolve the manifest-list digest on the runner at build time and pass
-# it as the NODE_BASE_DIGEST build-arg, and a local build resolves the
-# same lane before docker build (the signature is generated during the
-# build, never hardcoded).
+# THE DIGEST LAW (the local-build heal): the FROM lines ride
+# name@sha256:${NODE_BASE_DIGEST} (the scorecard-file form the
+# supply-chain gate reads as pinned) and the ARG carries the resolved
+# manifest-list digest of the pinned tag as its default — the same floor
+# the debonair/forge seats stamp as their hardcoded digest, so a plain
+# local `docker build -f saddle/Dockerfile .` never dies on an empty
+# `@sha256:` reference the way the digest-never-hardcoded era did (the
+# owner's law: the container must build functional like the other ten).
+# The publish lanes still resolve the manifest digest on the runner at
+# build time and override the default with the fresh value — the pin
+# form the gate reads stays identical either way.
 #
 # THE VERSION LAW: the ARG default below mirrors saddle/package.json
 # (the metadata lockstep the registry lanes stamp); the publish lanes pass
@@ -131,19 +146,19 @@
 # the stamp.
 
 ARG NODE_BASE_TAG="node:26.13.0-slim"
-# the digest-never-hardcoded law, the scorecard-file form: the FROM lines
-# ride name@sha256:${ARG} (the exact pattern the supply-chain gate reads
-# as pinned) while the digest itself still resolves at build time on the
-# runner (the bases step of the publish lanes) — no 64-hex ever enters the
-# repository, the manifest-list digest serves the whole build matrix
-# (the four base-carried legs of the eleven-architecture standard), and a
-# local build resolves the same lane before docker build.
-ARG NODE_BASE_DIGEST
+# the resolved manifest-list digest of node:26.13.0-slim (the local-build
+# floor the ARG default stamps — the publish lanes override it with the
+# freshly resolved digest at build time, and the FROM lines keep the
+# name@sha256:${ARG} pin form the supply-chain gate reads either way):
+# the default ends the empty-@sha256: era where a local build without the
+# build-arg answered an invalid base reference and the container the
+# owner charged functional never built at all.
+ARG NODE_BASE_DIGEST=5adad64f9a1fca2d51972caa65983634c8a774eb300d72b20f7f2a0f60368072
 
 # ===== stage: solbuild — the locked npm tree and the console spa =====
 FROM --platform=$BUILDPLATFORM ${NODE_BASE_TAG}@sha256:${NODE_BASE_DIGEST} AS solbuild
 
-ARG SADDLE_VERSION=2.0.165
+ARG SADDLE_VERSION=2.0.167
 
 WORKDIR /app
 
@@ -171,7 +186,7 @@ RUN npm run web:build:pages \
 # ===== stage: base — the hardened runtime floor every profile shares =====
 FROM ${NODE_BASE_TAG}@sha256:${NODE_BASE_DIGEST} AS base
 
-ARG SADDLE_VERSION=2.0.165
+ARG SADDLE_VERSION=2.0.167
 # the revision stamp the devthink container carries (DEVTHINK_REVISION
 # there): the publish legs pass the release sha at build time and the
 # revision label below declares the default-unknown local shape.
@@ -283,8 +298,9 @@ RUN apt-get update \
 # edgeplane.ts
 # pulls foundation.ts and the one edgelandes keyword file (the edgelandes
 # fold retired the host/inproc/virtual/ninety arms into it); the lazy
-# script-lane surface (webserver.ts imports scriptlanes.ts on first use)
-# pulls execution.ts through scriptlanes.ts, so both ride the copy and
+# script-lane surface (webserver.ts imports the one scripts keyword
+# file on first use — the scripts fold retired the scriptlanes seat into
+# it) pulls execution.ts through scripts.ts, so both ride the copy and
 # the lane answers real runs instead of the honest 503; db.ts pulls
 # labels.ts whose ../vault/labelstore.ts import resolves at /vault (the
 # family context fix - the vault source lands beside /app the same way
@@ -304,7 +320,7 @@ RUN apt-get update \
 # (virtual.ts pulls foundation.ts only; tiers.ts pulls node builtins
 # only).
 # run the console with: docker run saddle:<version>
-COPY --from=solbuild /app/webserver.ts /app/db.ts /app/labels.ts /app/auth.ts /app/mesh.ts /app/sandbox.ts /app/modalityregistry.ts /app/edgeplane.ts /app/workloadlaw.ts /app/foundation.ts /app/edgelandes.ts /app/scriptlanes.ts /app/execution.ts /app/virtual.ts /app/tiers.ts /app/mime.types /app/init.sql /app/schema.prisma ./
+COPY --from=solbuild /app/webserver.ts /app/db.ts /app/labels.ts /app/auth.ts /app/mesh.ts /app/sandbox.ts /app/modalityregistry.ts /app/edgeplane.ts /app/workloadlaw.ts /app/foundation.ts /app/edgelandes.ts /app/scripts.ts /app/execution.ts /app/virtual.ts /app/tiers.ts /app/mime.types /app/init.sql /app/schema.prisma ./
 # the label store of the console stack: labels.ts (pulled by db.ts)
 # resolves ../vault/labelstore.ts at /vault - the same family context
 # fix the solbuild stage applies.
@@ -411,3 +427,221 @@ ENV SADDLE_PROFILE=balanced \
     SADDLE_PROFILE_RAM_GB=${VHE_PROFILE_RAM_GB} \
     SADDLE_PROFILE_GPU=${VHE_PROFILE_GPU} \
     SADDLE_PROFILE_GPUS=${VHE_PROFILE_GPUS}
+
+# ===== the os-distribution flavor lanes (the container-lane law) =====
+# THE OS-DISTRIBUTION AXIS BESIDE THE PROFILE AXIS (the owner's
+# container-lane law: the saddle container carries MORE THAN 15 lanes):
+# the four seats of the OSDISTRIBUTIONS catalog that ride the same honest
+# node base legs — linux (the baseline seat), omarchy (the arch
+# linux-based desktop distribution created by dhh), vanilla os (the
+# ubuntu-based atomic distribution) and android (the mobile platform the
+# grapheneos hardening builds on) — answer four flavor targets that stamp
+# the catalog seat into the image config (SADDLE_OS_PROFILE + the OCI
+# labels), binding the max plan the baseline seat rides. the flavor is
+# the GUEST SEAT the engine hosts (the catalog law of
+# saddle/containerarch.ts: the engine presents the profile, it never
+# installs a host distribution) — the same engine graph, the same ninety
+# modalities, the same health surface, one honest seat stamp per lane:
+#
+#   docker build --target oslinux      -t saddle:2.0.165-linux .
+#   docker build --target osomarchy    -t saddle:2.0.165-omarchy .
+#   docker build --target osvanillaos  -t saddle:2.0.165-vanillaos .
+#   docker build --target osandroid    -t saddle:2.0.165-android .
+FROM max AS oslinux
+ARG SADDLE_OS_PROFILE="linux"
+ENV SADDLE_OS_PROFILE=linux
+LABEL org.opencontainers.image.title="saddle (the linux os-distribution lane)" \
+      org.opencontainers.image.description="saddle — the master virtualization engine bound to the linux os-distribution seat of the catalog: the baseline distribution the container itself rides."
+
+FROM max AS osomarchy
+ARG SADDLE_OS_PROFILE="omarchy"
+ENV SADDLE_OS_PROFILE=omarchy
+LABEL org.opencontainers.image.title="saddle (the omarchy os-distribution lane)" \
+      org.opencontainers.image.description="saddle — the master virtualization engine bound to the omarchy os-distribution seat of the catalog: the arch linux-based distribution created by dhh, hosted as the desktop guest profile."
+
+FROM max AS osvanillaos
+ARG SADDLE_OS_PROFILE="vanillaos"
+ENV SADDLE_OS_PROFILE=vanillaos
+LABEL org.opencontainers.image.title="saddle (the vanilla os os-distribution lane)" \
+      org.opencontainers.image.description="saddle — the master virtualization engine bound to the vanilla os os-distribution seat of the catalog: the ubuntu-based atomic distribution, hosted as the desktop guest profile."
+
+FROM max AS osandroid
+ARG SADDLE_OS_PROFILE="android"
+ENV SADDLE_OS_PROFILE=android
+LABEL org.opencontainers.image.title="saddle (the android os-distribution lane)" \
+      org.opencontainers.image.description="saddle — the master virtualization engine bound to the android os-distribution seat of the catalog: the mobile platform the grapheneos hardening builds on, hosted as the mobile guest profile."
+
+# ===== the os-distribution catalog lanes (the no-base seats) =====
+# THE EXOTIC HALF OF THE AXIS: the os distribution seats with NO runnable
+# container base — grapheneos (a privacy and security hardened version of
+# android) and maru os (firmware, not an application) are android
+# firmware seats, the v seat is the vlang platform target (never a guest
+# distribution) and the windows seat is the guest vocabulary the exe
+# seats execute — never pretend a runnable image. the catalog lane
+# publishes the profile itself: a scratch-based image (no base at all —
+# the digest law rides trivially) whose config carries the seat stamp and
+# whose single file is the profile row the osprofiles catalog answers,
+# rendered to json beside the build context (osprofiles/<id>.json, the
+# publish lane generates it from the tagged source):
+#
+#   docker build --target osgrapheneos -t saddle:2.0.165-grapheneos .
+#   docker build --target osmaruos     -t saddle:2.0.165-maruos .
+#   docker build --target osv          -t saddle:2.0.165-v .
+#   docker build --target oswindows    -t saddle:2.0.165-windows .
+FROM scratch AS osgrapheneos
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="grapheneos"
+ENV SADDLE_OS_PROFILE=grapheneos
+LABEL org.opencontainers.image.title="saddle (the grapheneos os-distribution catalog lane)" \
+      org.opencontainers.image.description="the grapheneos os-distribution seat as a catalog lane: a privacy and security hardened version of android — no runnable container base exists for an android firmware seat, the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/grapheneos.json /saddle/osprofile.json
+
+FROM scratch AS osmaruos
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="maruos"
+ENV SADDLE_OS_PROFILE=maruos
+LABEL org.opencontainers.image.title="saddle (the maru os os-distribution catalog lane)" \
+      org.opencontainers.image.description="the maru os os-distribution seat as a catalog lane: maru os is firmware, not an application — no runnable container base exists for a firmware seat, the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/maruos.json /saddle/osprofile.json
+
+FROM scratch AS osv
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="v"
+ENV SADDLE_OS_PROFILE=v
+LABEL org.opencontainers.image.title="saddle (the v os-distribution catalog lane)" \
+      org.opencontainers.image.description="the v os-distribution seat as a catalog lane: the v language platform target the languagev compiler seat of the ninety modalities answers, never a guest distribution — the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/v.json /saddle/osprofile.json
+
+FROM scratch AS oswindows
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="windows"
+ENV SADDLE_OS_PROFILE=windows
+LABEL org.opencontainers.image.title="saddle (the windows os-distribution catalog lane)" \
+      org.opencontainers.image.description="the windows os-distribution seat as a catalog lane: the guest vocabulary the exe seats execute — the container standard answers the windows seats as binary targets, the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/windows.json /saddle/osprofile.json
+
+FROM scratch AS ospostmarketos
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="postmarketos"
+ENV SADDLE_OS_PROFILE=postmarketos
+LABEL org.opencontainers.image.title="saddle (the postmarketos os-distribution catalog lane)" \
+      org.opencontainers.image.description="the postmarketos os-distribution seat as a catalog lane: postmarketos is the alpine-based mobile distribution real devices boot — no runnable container base exists for this seat, the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/postmarketos.json /saddle/osprofile.json
+
+FROM scratch AS oslineageos
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="lineageos"
+ENV SADDLE_OS_PROFILE=lineageos
+LABEL org.opencontainers.image.title="saddle (the lineageos os-distribution catalog lane)" \
+      org.opencontainers.image.description="the lineageos os-distribution seat as a catalog lane: lineageos is the community android continuation — the aftermarket mobile seat on the arm64 legs, the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/lineageos.json /saddle/osprofile.json
+
+FROM scratch AS oscalyxos
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="calyxos"
+ENV SADDLE_OS_PROFILE=calyxos
+LABEL org.opencontainers.image.title="saddle (the calyxos os-distribution catalog lane)" \
+      org.opencontainers.image.description="the calyxos os-distribution seat as a catalog lane: calyxos is the privacy-focused android distribution, the hardened mobile seat beside grapheneos — the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/calyxos.json /saddle/osprofile.json
+
+FROM scratch AS osarchlinux
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="archlinux"
+ENV SADDLE_OS_PROFILE=archlinux
+LABEL org.opencontainers.image.title="saddle (the archlinux os-distribution catalog lane)" \
+      org.opencontainers.image.description="the archlinux os-distribution seat as a catalog lane: archlinux is the rolling-release distribution omarchy builds on, the pacman desktop seat — the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/archlinux.json /saddle/osprofile.json
+
+FROM scratch AS osalpine
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="alpine"
+ENV SADDLE_OS_PROFILE=alpine
+LABEL org.opencontainers.image.title="saddle (the alpine os-distribution catalog lane)" \
+      org.opencontainers.image.description="the alpine os-distribution seat as a catalog lane: alpine is the musl-based lightweight distribution, the small-footprint seat the musl legs answer — the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/alpine.json /saddle/osprofile.json
+
+FROM scratch AS osdebian
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="debian"
+ENV SADDLE_OS_PROFILE=debian
+LABEL org.opencontainers.image.title="saddle (the debian os-distribution catalog lane)" \
+      org.opencontainers.image.description="the debian os-distribution seat as a catalog lane: debian is the universal operating system, the apt desktop seat the widest hardware matrix answers — the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/debian.json /saddle/osprofile.json
+
+FROM scratch AS osfedora
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="fedora"
+ENV SADDLE_OS_PROFILE=fedora
+LABEL org.opencontainers.image.title="saddle (the fedora os-distribution catalog lane)" \
+      org.opencontainers.image.description="the fedora os-distribution seat as a catalog lane: fedora is the red-hat-upstream community distribution, the rpm desktop seat beside the apt rows — the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/fedora.json /saddle/osprofile.json
+
+FROM scratch AS osnixos
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="nixos"
+ENV SADDLE_OS_PROFILE=nixos
+LABEL org.opencontainers.image.title="saddle (the nixos os-distribution catalog lane)" \
+      org.opencontainers.image.description="the nixos os-distribution seat as a catalog lane: nixos is the declarative distribution the nix package manager builds, the reproducible-system seat — the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/nixos.json /saddle/osprofile.json
+
+FROM scratch AS osvoid
+ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_OS_PROFILE="void"
+ENV SADDLE_OS_PROFILE=void
+LABEL org.opencontainers.image.title="saddle (the void os-distribution catalog lane)" \
+      org.opencontainers.image.description="the void os-distribution seat as a catalog lane: void is the independent source-rolling distribution, the xbps seat the musl legs answer beside alpine — the lane publishes the profile config the engine reads." \
+      org.opencontainers.image.version="${SADDLE_VERSION}" \
+      org.opencontainers.image.licenses="GPL-3.0-only" \
+      org.opencontainers.image.source="https://github.com/wenathlan/devthink"
+COPY osprofiles/void.json /saddle/osprofile.json
+
+# ===== stage: default — the trailing balanced seat the header documents =====
+# THE DEFAULT TARGET LAW (the local-build heal): the header declares the
+# plain `docker build -f saddle/Dockerfile .` with no --target answers the
+# balanced profile, but the os-distribution scratch lanes below the
+# balanced stage used to end the file — the no-target build answered
+# osvoid, a scratch seat that COPYs the osprofiles/ folder only the
+# publish lanes render, so the local container the owner charged
+# functional died on the missing folder instead of building the engine.
+# This trailing alias re-seats the balanced profile as the last stage:
+# the no-target build answers the runnable engine (the same graph the
+# compose lane rides), every os lane keeps its own explicit --target,
+# and the profile axis (max / balanced / lite) stays addressable behind
+# its names exactly as before.
+FROM balanced

package/README.md

@@ -31,7 +31,7 @@ domain modules land beside the saddle domains:
 | `media.ts`, `render.ts`, `quantum.ts`, `tiers.ts` | media pipeline, GPU registry, quantum simulation, tier policy |
 | `security.ts`, `alternatives.ts` | hardening gates and the alternative-stack catalog |
 | `index.html`, `App.tsx`, `sol/` | the single SPA shell and the Sol theme (one tsx app with one stylesheet per theme) |
-| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.165 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
+| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.167 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
 | `vercel.json`, `netlify.toml` | the platform deploy adapters beside the surface they publish (the caddy ghost stays out of the tree) |
 | `specs/*` package exports | processors, gpus, cores, boards and the qemu/mttg/passage/docker envelopes |
 
@@ -170,7 +170,7 @@ The package export map is defined by the root manifest. Runnable public examples
 
 ## Browser extension
 
-The extension surface migrated to the devthink app with the wave 2 regrouping: it is a TypeScript-first Manifest V3 reference surface (popup, service worker, isolated content bridge, read-only page-world `pagefacts` boundary, snapshot diffs and persisted window/tab/frame context for explicit resume) that runs in the user's browser, so it is not a VM modality of the engine — its module, tracked assets and tests now live at `devthink/browserextension.ts`, the devthink root `extension*` asset family and `devthink/tests/browserextension.test.ts` (see `docs/browser.md` for the migration map).
+The extension surface migrated to the devthink app with the wave 2 regrouping: it is a TypeScript-first Manifest V3 reference surface (popup, service worker, isolated content bridge, read-only page-world `pagefacts` boundary, snapshot diffs and persisted window/tab/frame context for explicit resume) that runs in the user's browser, so it is not a VM modality of the engine — its module, tracked assets and tests now live at `devthink/browserextension.ts`, the devthink root `extension*` asset family and `devthink/test/browserextension.test.ts` (see `docs/browser.md` for the migration map).
 
 ```bash
 # build an isolated JavaScript artifact from the devthink app root using the version supplied by the caller or release tag
@@ -284,7 +284,7 @@ server.ts, webserver.ts, api.ts, cli.ts
                the self-hosted api surfaces, the web console and the stable cli
 sol/           the Sol theme — the platform's web surface (one tsx app, one stylesheet per theme)
 specs          processors.json, gpus.json, cores.json, boards.json and the qemu/mttg/passage/docker/vm envelopes
-tests/         deterministic engine and extension coverage
+test/         deterministic engine and extension coverage
 docs/          architecture, API, security, release and registry notes
 ```
 

package/biome.jsonc

@@ -21,8 +21,8 @@
       "!**/bun.lock",
       "!**/*.min.js",
       "!**/docs",
-      "!**/tests/tmp",
-      "!**/tests/code",
+      "!**/test/tmp",
+      "!**/test/code",
       "!**/sol/dist",
       "!**/sol/.vite",
       "!**/sol/node_modules",
@@ -113,7 +113,7 @@
       }
     },
     {
-      "includes": ["tests/workflowcheck.ts", "tests/publishlanes.test.ts"],
+      "includes": ["test/workflowcheck.ts", "test/publishlanes.test.ts"],
       "linter": {
         "rules": {
           "suspicious": {

package/cli.ts

@@ -32,7 +32,7 @@ import {
   runscriptbackground,
   scriptRunStatus,
   type ScriptPlan,
-} from "./scriptlanes.ts";
+} from "./scripts.ts";
 
 /* ════════════════════════════════════════════════════════════════════ */
 /* Section 1: cli/main.ts — the saddle command-line entry point (the bin "saddle" resolves to this source through the source-is-library law (node 26 strips the types, the shebang hands the file to the runtime)). */
@@ -164,7 +164,7 @@ async function rendergpus() {
 /* ══════════════════════════════════════════════════════════════════ */
 /* Section 3: the script lanes renderer — the sh/yml/yaml execution   */
 /* surface of the engine lane (PR15): run, background, status, docker */
-/* and compile ride the very scriptlanes.ts functions the webserver   */
+/* and compile ride the very scripts.ts functions the webserver        */
 /* routes serve, so the bin and the api speak one lane.               */
 /* ══════════════════════════════════════════════════════════════════ */
 /**

package/docker.config

@@ -2,8 +2,8 @@
   "meta": {
     "name": "docker.config",
     "title": "saddle - Docker Engine and Containerization Configuration",
-    "version": "2.0.154",
-    "date": "2026-08-22",
+    "version": "2.0.167",
+    "date": "2026-11-06",
     "language": "en",
     "sources": [
       "pool:docker.config [S6 TOML 24 sections; repaired broken section headers 'eta]'->'[meta]', 'ealthcheck]'->'[healthcheck]']",

package/docs/architecture.md

@@ -17,7 +17,7 @@ syntax, variants, open infrastructure, version pinning, CI graph.
 | # | Principle | Concrete rule in this repository |
 | --- | --- | --- |
 | 1 | Library-first | TypeScript is the primary API; zero runtime dependencies; ESM; `package.json` subpaths per module; Python (`qemubridge.py`) and C++ (`libs/`) act as bridges and mirrors, not as the main surface |
-| 2 | Flat monolith | Tracked files stay flat: root-first plus exactly five directories (`libs/`, `docs/`, `tests/`, `web/`, `.github/workflows/`), at most two levels, lowercase names without underscores or hyphens except the six dotted mandatory configs (`vm.config` family) |
+| 2 | Flat monolith | Tracked files stay flat: root-first plus exactly five directories (`libs/`, `docs/`, `test/`, `web/`, `.github/workflows/`), at most two levels, lowercase names without underscores or hyphens except the six dotted mandatory configs (`vm.config` family) |
 | 3 | 20-25 related contexts per file | Every module header lists its contexts; the count is a hard band enforced in review (god-file and scatter-file anti-patterns both rejected) |
 | 4 | Internal memory first | Mutable state lives in `Map`/`WeakMap` containers (`cpuRegistry`, `gpuregistry`, `engineRegistry`, `InternalMemory`, `regionledger`); no module-level mutable globals, no runtime-specific global state |
 | 5 | Three-layer engine | Layer 1 interposition (`libs/virtualhardware.c`), layer 2 identity and rendering (procfs generators + Mesa stack in `render.ts`), layer 3 execution engines (Docker/QEMU/Firecracker/gVisor/Kata/CLH orchestrated by `orchestrator.ts`) |
@@ -104,7 +104,7 @@ Line counts are the shipped files (v2 carryover plus the v3/v5/v6 additions); ev
 | `libs/gpumonitor.cpp` | 1543 | C++26 four-mode build: CLI smi-adapter, NVML/libcuda shim, N-API addon, forge mode (Plan/validate/qemu_argv, Mttg work-stealing mirror) | 12 hooks |
 | `libs/virtualhardware.c` | 1011 | C11 LD_PRELOAD core: open-family interception, vhe_translate, inotify regeneration thread, xorshift32 drift, constructor 101 | 12 hooks |
 
-Data files: `gpus.json` 2408, `processors.json` 2217, `vm.config.json` 1910, `cores.json` 1801, `mttg.config` 1548, `boards.json` 1517, `passage.config` 1330, `qemu.config` 1061, `virtualhardware.json` 739, `docker.config` 768. Web node (`web/`, the v6 edition plus the v7 wave): `sandbox.ts` 1433 is the browser-pure engine port (bank, procfs payloads, the 89-char smi table, mesa summaries, boot dmesg and the command dispatcher), `server.ts` 640 serves the console plus the `/api/v1` contract (health, spec catalogs, sandbox lifecycle, exec) over `node:http`, `index.html` 646 renders the spec panel, terminal and bus timeline, adapters `vercel.json`/`netlify.toml`/`caddyfile` (static edge, api reverse proxied) and `readme.md` 120; the v7 wave completes the node with `db.ts` (sqlite persistence for users, sessions and sandboxes), `auth.ts` (scrypt password hashing, timing-safe verification, cookie sessions), `mesh.ts` (HMAC-SHA256 signed clone-to-main calls with replay windows), the `login.html`/`register.html`/`dashboard.html` pages, `package.json`/`Dockerfile` (image `ghcr.io/wenathlan/e2ugh (main image, web/ included)`; node pinned by the root `.nvmrc`), the database definition kept flat as `schema.prisma` plus `init.sql`, and `mime.types`. Total repository: about 62,200 lines across 83 tracked files (the v2 carryover plus the v3 domains, the v5 media/test waves and the v6 web edition; the `tests/` suite alone is 3,674 lines across eleven files).
+Data files: `gpus.json` 2408, `processors.json` 2217, `vm.config.json` 1910, `cores.json` 1801, `mttg.config` 1548, `boards.json` 1517, `passage.config` 1330, `qemu.config` 1061, `virtualhardware.json` 739, `docker.config` 768. Web node (`web/`, the v6 edition plus the v7 wave): `sandbox.ts` 1433 is the browser-pure engine port (bank, procfs payloads, the 89-char smi table, mesa summaries, boot dmesg and the command dispatcher), `server.ts` 640 serves the console plus the `/api/v1` contract (health, spec catalogs, sandbox lifecycle, exec) over `node:http`, `index.html` 646 renders the spec panel, terminal and bus timeline, adapters `vercel.json`/`netlify.toml`/`caddyfile` (static edge, api reverse proxied) and `readme.md` 120; the v7 wave completes the node with `db.ts` (sqlite persistence for users, sessions and sandboxes), `auth.ts` (scrypt password hashing, timing-safe verification, cookie sessions), `mesh.ts` (HMAC-SHA256 signed clone-to-main calls with replay windows), the `login.html`/`register.html`/`dashboard.html` pages, `package.json`/`Dockerfile` (image `ghcr.io/wenathlan/e2ugh (main image, web/ included)`; node pinned by the root `.nvmrc`), the database definition kept flat as `schema.prisma` plus `init.sql`, and `mime.types`. Total repository: about 62,200 lines across 83 tracked files (the v2 carryover plus the v3 domains, the v5 media/test waves and the v6 web edition; the `test/` suite alone is 3,674 lines across eleven files).
 
 ## 3a. v3 redistribution: features live in domains
 
@@ -121,7 +121,7 @@ The remaining categories of the old file were already domain-owned: kernel featu
 
 ## 3b. Test patterns
 
-Tests live in the `tests/` directory (one of the five allowed directories) and run with the Node built-in runner: `node --test 'tests/*.test.ts'` (153 tests across eleven files - engine, features, media, render, simulation, specs, virtualcpu, virtualgpu, virtualmemory, web, workflow - all passing on Node 24 and 26), the same runner the ci.yml smoke gate executes on Node 26.7.0. Patterns:
+Tests live in the `test/` directory (one of the five allowed directories) and run with the Node built-in runner: `node --test 'test/*.test.ts'` (153 tests across eleven files - engine, features, media, render, simulation, specs, virtualcpu, virtualgpu, virtualmemory, web, workflow - all passing on Node 24 and 26), the same runner the ci.yml smoke gate executes on Node 26.7.0. Patterns:
 
 - `node:test` (`describe`/`it` or top-level `test`) plus `node:assert/strict`; no Jest, no third-party harness, no install step (the engine has zero runtime dependencies).
 - One test file per area under test (planner and lint rules, cpuinfo/meminfo generators, MIG density validator, QEMU argv builder); assertions target public exports, never module internals.
@@ -266,7 +266,7 @@ Supporting subsystems: warm pool (prewarm/acquire/release/refill/drain, MAP_PRIV
 | TypeScript | 7.0.2 (Go-native port); `strict`, `verbatimModuleSyntax`, `isolatedModules`, `erasableSyntaxOnly`, `exactOptionalPropertyTypes`, `noUncheckedIndexedAccess`; ES2025 target with `lib ES2025+ESNext.Disposable` |
 | Erasable modern syntax | `using`/`await using` (modellease, MetricsStore, sandboxhandle), `satisfies` (`engineversions as const satisfies Record<string,string>`), const type parameters (`validateSpec<const T>`), `#private` fields and accessors, `import.meta.filename` for CLI detection |
 | ESM | `"type": "module"`; relative imports carry the `.ts` extension; no CommonJS `require` |
-| Tests | `node:test` + `node:assert/strict` executed with `node --test 'tests/*.test.ts'`; the dedicated `tests/` directory holds eleven test files (148 cases: 86 planner/generator originals, 24 workflow/simulation gates, 18 feature-audit builders, 4 media pipeline, 1 snapshot regression, 9 web edition), ci.yml runs them on Node 26.7.0; no Jest; doc-tests as `@example` blocks (the planner asserts live in `index.ts` planner docs) |
+| Tests | `node:test` + `node:assert/strict` executed with `node --test 'test/*.test.ts'`; the dedicated `test/` directory holds eleven test files (148 cases: 86 planner/generator originals, 24 workflow/simulation gates, 18 feature-audit builders, 4 media pipeline, 1 snapshot regression, 9 web edition), ci.yml runs them on Node 26.7.0; no Jest; doc-tests as `@example` blocks (the planner asserts live in `index.ts` planner docs) |
 | C++26 | `import std;` permitted, `std::expected` as the error channel, `std::mdspan` with the p2662r3 fallback guard, `std::print`/`std::format`, `enum class`, `[[nodiscard]]` on validate/argv/topology, RAII for every fd/socket (no exceptions in happy paths) |
 | C | C11 with `_GNU_SOURCE`, `dlsym(RTLD_NEXT)` resolution, xorshift32 deterministic drift, constructor priority 101 |
 | Python | 3.14 floor; stdlib only (socket, json, logging); try/except logging on every operation |
@@ -318,11 +318,11 @@ The old pins survive only inside `legacyCatalog` provenance blocks in `virtualha
 
 ## 15. CI graph (summary)
 
-Five workflows gate the tree: ci.yml (lint, typecheck matrix Node 24/26, the node:test suite in `tests/`, build, flat-structure md5 guard, JSON schema validation of the ten data files), publishghcr.yml (the combined container pipeline: per-arch validation legs on push - clinfo/vulkaninfo/glxinfo probes inside the image - and the four-arch GHCR publication with provenance+SBOM on release), release.yml (GHCR + npm provenance + level-9 zip with SHA-256), pages.yml (the merged web pipeline: module syntax gate, boot smoke on port 37810, html lint, the webapi auth/mesh suite with a throwaway `E2UGH_DB`, the zip -9 static bundle and the GitHub Pages deployment of the web tree) and security.yml (CodeQL C/C++/TS, dependency review, Dockle/Trivy SARIF, gitleaks, Scorecard, Biome security group, license allowlist). Full descriptions and pins are in `readme.md`; the workflows themselves are the executable contract.
+Five workflows gate the tree: ci.yml (lint, typecheck matrix Node 24/26, the node:test suite in `test/`, build, flat-structure md5 guard, JSON schema validation of the ten data files), publishghcr.yml (the combined container pipeline: per-arch validation legs on push - clinfo/vulkaninfo/glxinfo probes inside the image - and the four-arch GHCR publication with provenance+SBOM on release), release.yml (GHCR + npm provenance + level-9 zip with SHA-256), pages.yml (the merged web pipeline: module syntax gate, boot smoke on port 37810, html lint, the webapi auth/mesh suite with a throwaway `E2UGH_DB`, the zip -9 static bundle and the GitHub Pages deployment of the web tree) and security.yml (CodeQL C/C++/TS, dependency review, Dockle/Trivy SARIF, gitleaks, Scorecard, Biome security group, license allowlist). Full descriptions and pins are in `readme.md`; the workflows themselves are the executable contract.
 
 ## 16. Compliance checklist
 
-Flat tree (root plus `libs/`, `docs/`, `tests/`, `web/`, `.github/workflows/` only); no `src/`; lowercase names; six dotted configs present; every module header carries contexts, provenance and sources; no emoji; no hardcoded localhost; `node:*` first; one bus, one machine, one metrics; data files parse as strict JSON with `$schema`/`meta` headers; docs exceed 40 sections across the set; every version claim dated and primary-sourced. CI enforces the machine-checkable items; review enforces the rest.
+Flat tree (root plus `libs/`, `docs/`, `test/`, `web/`, `.github/workflows/` only); no `src/`; lowercase names; six dotted configs present; every module header carries contexts, provenance and sources; no emoji; no hardcoded localhost; `node:*` first; one bus, one machine, one metrics; data files parse as strict JSON with `$schema`/`meta` headers; docs exceed 40 sections across the set; every version claim dated and primary-sourced. CI enforces the machine-checkable items; review enforces the rest.
 
 ## 17. Future extensions within the flat budget
 

package/docs/browser.md

@@ -17,7 +17,7 @@ What moved with the surface:
 | `popup.html` | `devthink/extensionpopup.html` |
 | `popup.css` | `devthink/extensionpopup.css` |
 | `icon32.png` / `icon64.png` / `icon128.png` | `devthink/extensionicon32.png` / `extensionicon64.png` / `extensionicon128.png` |
-| `tests/extension.test.ts` | `devthink/tests/browserextension.test.ts` |
+| `test/extension.test.ts` | `devthink/test/browserextension.test.ts` |
 
 The tracked assets carry the `extension` prefix at the devthink root because devthink already owns its own extension surface (`manifest.json` of record, `popup.ts`, `design.html`) — no root name collides. The build adapter (section 17 of the migrated module) is self-referential: it extracts the seven script sections from `devthink/browserextension.ts` itself, reads `extensionmanifest.json` for the versioned manifest and copies the extension-prefixed assets into an isolated unpacked artifact (default output `build/browserextension`, so it never touches the `build/extension` directory owned by the devthink extension build). The `@wenathlan/saddle/extension` package export and the `extension:build` script retired with the migration — consumers import the surface from the devthink app.
 

package/docs/distributionlanes.md

@@ -6,7 +6,7 @@ The eleven distribution lanes of the PR14 law and the honest status each lane an
 | --- | --- | --- | --- |
 | npmjs | package.json — @wenathlan/saddle | live | the family-npmjs lane publishes the engine envelope (the heaviest pass, always last) |
 | GitHub Packages npm | package.json — @wenathlan/saddle | live | the family-githubnpm lane publishes the same envelope idempotently |
-| Maven | pom.xml — io.github.wenathlan:saddle | live | the family-maven lane deploys the one real jar of the family (the Saddle.java adapter) |
+| Maven | pom.xml — com.wenathlan:saddle | live | the family-maven lane deploys the one real jar of the family (the Saddle.java adapter) |
 | NuGet | saddle.csproj | live | the family-nuget lane packs the engine envelope |
 | Gradle | build.gradle.kts — com.wenathlan:saddle | live | the family-gradle lane publishes the module beside the maven coordinates |
 | Ruby Gems | saddle.gemspec | live | the family-rubygems lane pushes the gem carrying the SaddleCli.rb process adapter |

package/docs/e2ughengine.md

@@ -172,7 +172,7 @@ Modularity ceilings, documented with all three historical answers and the chosen
 
 ## Repository structure (flat tree)
 
-The CI pipeline enforces the flat contract: one concern per file with 20-25 related contexts inside, at most two directory levels (`libs/`, `docs/`, `tests/`, `web/`, `.github/workflows/`), lowercase file names, and no duplicated content between files (the md5 guard that caught the README-cloning failure of earlier generations). The table reflects the tree as `find . -type f` lists it; `scheduler.ts`, `compute.ts` and the `tests/` suite are the v3 additions (the former `future.ts` was decomposed into them).
+The CI pipeline enforces the flat contract: one concern per file with 20-25 related contexts inside, at most two directory levels (`libs/`, `docs/`, `test/`, `web/`, `.github/workflows/`), lowercase file names, and no duplicated content between files (the md5 guard that caught the README-cloning failure of earlier generations). The table reflects the tree as `find . -type f` lists it; `scheduler.ts`, `compute.ts` and the `test/` suite are the v3 additions (the former `future.ts` was decomposed into them).
 
 | # | File | One-line role |
 | --- | --- | --- |
@@ -220,7 +220,7 @@ The CI pipeline enforces the flat contract: one concern per file with 20-25 rela
 | 42 | `docs/viability.md` | the proof, research methodology, 145-entry bibliography and roadmap appendices A-C |
 | 43 | `docs/alternatives.md` | ten alternative sandbox families compared against the engine |
 | 43b | `docs/optimization.md` | the build-pipeline optimization roadmap (cross-compilation, prebuilt QEMU/Mesa layers, runner strategy) for the slow multi-arch grid |
-| 44 | `tests/` | node:test suite executed by ci.yml with `node --test` (153 cases, including CI-gate replay and end-to-end simulation suites) |
+| 44 | `test/` | node:test suite executed by ci.yml with `node --test` (153 cases, including CI-gate replay and end-to-end simulation suites) |
 | 45 | `web/` | the web node (v7): `index.html` terminal sandbox, `login.html`/`register.html`/`dashboard.html` auth pages, `sandbox.js` browser-pure engine port (20 commands), `localauth.js` static-edge browser accounts (login/register/dashboard keep working on github pages with no api; accounts are mirrored to IndexedDB so partial clears never lose them, the dashboard carries backup/restore keyfile buttons, and the CODEOWNERS admins iakadion + akadion are seeded automatically with the shared bootstrap password - surviving any storage reset), `server.js` self-hosted node:http API (`/api/v1` sandboxes and exec), `db.js` sqlite persistence layer, `auth.js` scrypt password hashing with cookie sessions, `mesh.js` HMAC-signed node-to-node calls, `package.json`/`Dockerfile` (image `ghcr.io/wenathlan/e2ugh`; node pinned by the root `.nvmrc`), `schema.prisma`/`init.sql` database definition kept flat per the two-level contract, `mime.types`, `vercel.json`/`netlify.toml` static deploy without functions, `caddyfile` self-host proxy for devthink.pro, `readme.md` web docs |
 | 46 | `LICENSE` | full MIT text (Copyright (c) 2026 wenathlan) |
 
@@ -327,11 +327,11 @@ docker run --rm -p 37810:37810 -e E2UGH_DB=/data/e2ugh.db -v e2ughdata:/data \
 
 Five workflows gate the repository, all pinned to action releases verified on 2026-08-22:
 
-- **ci.yml** (every push and pull request) - six gates: Biome 2.5.11 lint and format; `tsc --noEmit` with TypeScript 7.0.2 on a Node 24/26 matrix; the Node built-in test runner over the dedicated `tests/` suite (153 node:test cases); a build gate; the flat-structure contract (flat tree, no deep nesting, no duplicated content via md5); strict JSON schema validation of every tracked data file.
+- **ci.yml** (every push and pull request) - six gates: Biome 2.5.11 lint and format; `tsc --noEmit` with TypeScript 7.0.2 on a Node 24/26 matrix; the Node built-in test runner over the dedicated `test/` suite (153 node:test cases); a build gate; the flat-structure contract (flat tree, no deep nesting, no duplicated content via md5); strict JSON schema validation of every tracked data file.
 - **hardware variants** (publishghcr.yml matrix) - one dockerfile, three curated profiles baked at build time so operators pull exactly the flavor they need: `ghcr.io/wenathlan/e2ugh:latest` (max: EPYC 9965 192c/384t, 1 TiB plan, 8x B200), `:balanced` (Threadripper PRO 9995WX 96c/192t, 512 GiB, 2x B200) and `:lite` (Ryzen 9 9950X3D 16c/32t, 128 GiB, 1x RTX 5090); every profile tag also carries semver and sha suffixes, and the runtime overlay (`VHE_TOTALRAM_GB`, `VHE_CPUS`, `VHE_GPU_PROFILE` environment variables) still lets any variant report any catalog identity up to 18 TiB at run time - the baked profile is the default identity, never a ceiling.
 - **publishghcr.yml** (the combined container pipeline; main, tags and releases) - per-architecture validation legs (`linux/amd64` native; `linux/arm64`, `linux/ppc64le` and `linux/s390x` under QEMU user emulation) that validate the live stack inside the built image: `clinfo` must report Rusticl OpenCL 3.1 on llvmpipe, `vulkaninfo --summary` must find lavapipe Vulkan 1.4, and Xvfb + `glxinfo` must report llvmpipe OpenGL 4.6, executed with `--memory-swap=-1 --shm-size=2g`. On releases, production builds push per-arch images by digest (the max profile ships the four-arch registry surface: amd64, arm64, ppc64le, s390x) with provenance `mode=max` and SBOM attestations before `docker buildx imagetools` assembles the per-profile manifest indexes.
 - **release.yml** (version tags and releases) - three publications: the multi-arch GHCR image, the npm package with `--provenance --access public` (zero runtime dependencies), and a maximum-compression (level 9) source zip with SHA-256 checksums.
-- **pages.yml** (web/ or tests/ changes on main, manual) - the web pipeline in one workflow: `node --check` on the five web modules (`server.js`, `db.js`, `auth.js`, `mesh.js`, `sandbox.js`), a boot smoke test on the pinned port 37810 (health endpoint and login page must answer 200), a python `html.parser` well-formedness lint of the four pages, the node:test webapi suite (auth and mesh coverage) with a throwaway `E2UGH_DB`, a zip -9 static bundle with SHA-256 checksums as an artifact (attached to tag releases by `release.yml`), and the GitHub Pages deployment of the whole `web/` tree (static-first, SPA fallback, `.nojekyll`) through configure-pages/upload-pages-artifact/deploy-pages. The pages are page-relative (`login.html`, `dashboard.html`) so every route resolves both on the self-hosted node and inside the `/e2ugh/` sub-path of github pages.
+- **pages.yml** (web/ or test/ changes on main, manual) - the web pipeline in one workflow: `node --check` on the five web modules (`server.js`, `db.js`, `auth.js`, `mesh.js`, `sandbox.js`), a boot smoke test on the pinned port 37810 (health endpoint and login page must answer 200), a python `html.parser` well-formedness lint of the four pages, the node:test webapi suite (auth and mesh coverage) with a throwaway `E2UGH_DB`, a zip -9 static bundle with SHA-256 checksums as an artifact (attached to tag releases by `release.yml`), and the GitHub Pages deployment of the whole `web/` tree (static-first, SPA fallback, `.nojekyll`) through configure-pages/upload-pages-artifact/deploy-pages. The pages are page-relative (`login.html`, `dashboard.html`) so every route resolves both on the self-hosted node and inside the `/e2ugh/` sub-path of github pages.
 - **security.yml** (pushes, pull requests, weekly) - CodeQL semantic analysis for C/C++ and TypeScript, dependency review, Dockle and Trivy container scans with SARIF upload, gitleaks history scan, OSSF Scorecard, the Biome security rule group at blocking severity and an npm license allow list.
 
 A deliberate CI fact: GitHub-hosted runners expose no `/dev/kvm` ([actions/runner-images#12933](https://github.com/actions/runner-images/issues/12933)), so QEMU-based validation runs under TCG with `thread=multi`, and Firecracker/Kata/Cloud Hypervisor paths are exercised only on self-hosted or bare-metal runners - the orchestrator detects the absence and falls back automatically.
@@ -372,7 +372,7 @@ const lint = planlint(defaultplan);      // mttg floor, overcommit ceiling check
 const toml  = plantoml(defaultplan);     // human-editable vm.config output
 ```
 
-The planner doubles as a CLI: `node --experimental-strip-types index.ts` reads a `vm.config.toml`, plans the topology, and emits QEMU argv, a `docker run` line and a lint report. Development commands: `npm run typecheck` (TypeScript 7.0.2 gate), `npm run lint` (Biome 2.5.11) and `node --test tests/` (see How to test below). Operational runbooks (host hardening, VFIO troubleshooting, capacity planning, incident: unbind of the only GPU) are condensed in `docs/virtualization.md` and expanded per-layer in the sibling docs.
+The planner doubles as a CLI: `node --experimental-strip-types index.ts` reads a `vm.config.toml`, plans the topology, and emits QEMU argv, a `docker run` line and a lint report. Development commands: `npm run typecheck` (TypeScript 7.0.2 gate), `npm run lint` (Biome 2.5.11) and `node --test test/` (see How to test below). Operational runbooks (host hardening, VFIO troubleshooting, capacity planning, incident: unbind of the only GPU) are condensed in `docs/virtualization.md` and expanded per-layer in the sibling docs.
 
 ---
 
@@ -384,7 +384,7 @@ The test contract is the Node built-in runner: no Jest, no third-party harness,
 # from a checkout (Node 24+)
 npm run typecheck                 # tsc --noEmit, the TypeScript 7.0.2 gate
 npm run lint                      # Biome 2.5.11
-node --test 'tests/*.test.ts'      # the node:test suite (153 tests) - the glob form ci.yml uses
+node --test 'test/*.test.ts'      # the node:test suite (153 tests) - the glob form ci.yml uses
 
 # from the published image (GHCR, linux/amd64 and linux/arm64)
 docker run --rm --memory-swap=-1 --shm-size=2g \
@@ -392,7 +392,7 @@ docker run --rm --memory-swap=-1 --shm-size=2g \
   bash -lc 'lscpu | head -3; free -h; nvidia-smi | head -12; clinfo -B | head -4'
 ```
 
-The `tests/` suite (Node 26.7.0 in CI, Node 24+ locally, `node:assert/strict`, 153 tests across eleven files: engine, render, specs, virtualcpu, virtualgpu, virtualmemory, media, features, plus workflow and simulation suites that replay the CI gates and the engine end to end) covers the planner and its lint rules, the `/proc/cpuinfo` and `/proc/meminfo` generators, the MIG density validator and the QEMU argv builder; the patterns are documented in `docs/architecture.md`. The docker probe above is the same surface `publishghcr.yml` validates inside the image: `clinfo` must report Rusticl OpenCL 3.1 on llvmpipe, `vulkaninfo --summary` must find lavapipe Vulkan 1.4 and `glxinfo` on Xvfb must report llvmpipe OpenGL 4.6.
+The `test/` suite (Node 26.7.0 in CI, Node 24+ locally, `node:assert/strict`, 153 tests across eleven files: engine, render, specs, virtualcpu, virtualgpu, virtualmemory, media, features, plus workflow and simulation suites that replay the CI gates and the engine end to end) covers the planner and its lint rules, the `/proc/cpuinfo` and `/proc/meminfo` generators, the MIG density validator and the QEMU argv builder; the patterns are documented in `docs/architecture.md`. The docker probe above is the same surface `publishghcr.yml` validates inside the image: `clinfo` must report Rusticl OpenCL 3.1 on llvmpipe, `vulkaninfo --summary` must find lavapipe Vulkan 1.4 and `glxinfo` on Xvfb must report llvmpipe OpenGL 4.6.
 
 ---
 
@@ -424,7 +424,7 @@ The `tests/` suite (Node 26.7.0 in CI, Node 24+ locally, `node:assert/strict`, 1
 | SADDLE v5 / v6 (Meta TS) | 2026-08-22 wave | `src_core_orchestrator.ts` (2080 lines) and `coreorchestrator.ts` (1283 lines): RBAC, NUMA scheduler, balloon, SR-IOV, passage protocols, quotas, preemption, leader election, OTel exporter; plus `pipelinememorypassage.ts` host-aware memory planning | Unique subsystems absorbed into `orchestrator.ts` (5238 lines) and `virtualmemory.ts`; duplicated buses/state machines/metrics collapsed into one of each |
 | Virtual Hardware Engine v5 (e2ugh) | 2026-08-22, English | The 44-file public repo generation: 9 TS modules, 11 JSONs, 4 workflows, 10 English docs with ~120 cited sources | Baseline of the v2 code tree; modules renamed and extended (hardware -> virtualcpu, memory -> virtualmemory) |
 | e2ugh v2 | 2026-08-22+ | The merge: 57 CPUs, 19 GPUs + APUs, one event bus (51 typed topics), one 15-state lifecycle, one metrics store | Baseline of the v3 redistribution |
-| e2ugh v3-v9 (this repo) | 2026-08-23+ | The rebrand and redistribution: github.com/wenathlan/e2ugh, package 1.2.1, `future.ts` decomposed into `scheduler.ts` and `compute.ts` (checkpoint plans into `virtualization.ts`, post-quantum into `security.ts`), a `tests/` node:test suite, and the corrected version ledger (kernel 7.1.9/6.18.45, edk2-stable202605, wgpu 30.x, Spin 3.6.0, containerd 2.3.4, WireGuard via kernel mainline) | Current |
+| e2ugh v3-v9 (this repo) | 2026-08-23+ | The rebrand and redistribution: github.com/wenathlan/e2ugh, package 1.2.1, `future.ts` decomposed into `scheduler.ts` and `compute.ts` (checkpoint plans into `virtualization.ts`, post-quantum into `security.ts`), a `test/` node:test suite, and the corrected version ledger (kernel 7.1.9/6.18.45, edk2-stable202605, wgpu 30.x, Spin 3.6.0, containerd 2.3.4, WireGuard via kernel mainline) | Current |
 
 Full per-generation detail, including the verification reports for each wave, is preserved in `docs/viability.md`.
 

package/docs/extension.md

@@ -5,7 +5,7 @@
 > `saddle/browser.ts`), with its tracked assets at the devthink root
 > (`extensionmanifest.json`, `extensionpopup.html`, `extensionpopup.css`,
 > `extensionicon32.png`, `extensionicon64.png`, `extensionicon128.png`)
-> and its test battery at `devthink/tests/browserextension.test.ts`. The
+> and its test battery at `devthink/test/browserextension.test.ts`. The
 > saddle is exclusively the virtualization engine; everything that runs
 > in the user's browser belongs to devthink, the owner of the family
 > extension product. The notes below describe the bridge design and stay