@wenathlan/saddle 2.0.167 → 2.0.168

package/Dockerfile

@@ -1,4 +1,4 @@
-# saddle 2.0.167 — THE ENGINE CONTAINER FILE
+# saddle 2.0.168 — THE ENGINE CONTAINER FILE
 #
 # THE FAMILY CONTAINER DOCTRINE, THE SADDLE SHAPE: one versioned container
 # per engine, built like the site homes (argan, cadria) build theirs — a
@@ -158,7 +158,7 @@ ARG NODE_BASE_DIGEST=5adad64f9a1fca2d51972caa65983634c8a774eb300d72b20f7f2a0f603
 # ===== stage: solbuild — the locked npm tree and the console spa =====
 FROM --platform=$BUILDPLATFORM ${NODE_BASE_TAG}@sha256:${NODE_BASE_DIGEST} AS solbuild
 
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 
 WORKDIR /app
 
@@ -172,6 +172,12 @@ COPY saddle/ .
 # so the vault sources ride the context beside the saddle and land at
 # /vault where the import resolves (the family context fix).
 COPY vault/ /vault
+# the routerbase sibling of the family law: saddle/routerbase.ts
+# re-exports the family routerBase from ../devthink/routerbase.ts, so
+# the devthink sources land at /devthink where the sol build resolves
+# the re-export (sources only - the same never-installed law the vault
+# sibling above rides, the family context fix the lanes carry).
+COPY devthink/ /devthink
 RUN npm run web:build:pages \
     # the theme build emits the hashed SPA bundles straight at the app
     # root (the family static-first vite contract): stage them into a
@@ -186,7 +192,7 @@ RUN npm run web:build:pages \
 # ===== stage: base — the hardened runtime floor every profile shares =====
 FROM ${NODE_BASE_TAG}@sha256:${NODE_BASE_DIGEST} AS base
 
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 # the revision stamp the devthink container carries (DEVTHINK_REVISION
 # there): the publish legs pass the release sha at build time and the
 # revision label below declares the default-unknown local shape.
@@ -489,7 +495,7 @@ LABEL org.opencontainers.image.title="saddle (the android os-distribution lane)"
 #   docker build --target osv          -t saddle:2.0.165-v .
 #   docker build --target oswindows    -t saddle:2.0.165-windows .
 FROM scratch AS osgrapheneos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="grapheneos"
 ENV SADDLE_OS_PROFILE=grapheneos
 LABEL org.opencontainers.image.title="saddle (the grapheneos os-distribution catalog lane)" \
@@ -500,7 +506,7 @@ LABEL org.opencontainers.image.title="saddle (the grapheneos os-distribution cat
 COPY osprofiles/grapheneos.json /saddle/osprofile.json
 
 FROM scratch AS osmaruos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="maruos"
 ENV SADDLE_OS_PROFILE=maruos
 LABEL org.opencontainers.image.title="saddle (the maru os os-distribution catalog lane)" \
@@ -511,7 +517,7 @@ LABEL org.opencontainers.image.title="saddle (the maru os os-distribution catalo
 COPY osprofiles/maruos.json /saddle/osprofile.json
 
 FROM scratch AS osv
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="v"
 ENV SADDLE_OS_PROFILE=v
 LABEL org.opencontainers.image.title="saddle (the v os-distribution catalog lane)" \
@@ -522,7 +528,7 @@ LABEL org.opencontainers.image.title="saddle (the v os-distribution catalog lane
 COPY osprofiles/v.json /saddle/osprofile.json
 
 FROM scratch AS oswindows
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="windows"
 ENV SADDLE_OS_PROFILE=windows
 LABEL org.opencontainers.image.title="saddle (the windows os-distribution catalog lane)" \
@@ -533,7 +539,7 @@ LABEL org.opencontainers.image.title="saddle (the windows os-distribution catalo
 COPY osprofiles/windows.json /saddle/osprofile.json
 
 FROM scratch AS ospostmarketos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="postmarketos"
 ENV SADDLE_OS_PROFILE=postmarketos
 LABEL org.opencontainers.image.title="saddle (the postmarketos os-distribution catalog lane)" \
@@ -544,7 +550,7 @@ LABEL org.opencontainers.image.title="saddle (the postmarketos os-distribution c
 COPY osprofiles/postmarketos.json /saddle/osprofile.json
 
 FROM scratch AS oslineageos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="lineageos"
 ENV SADDLE_OS_PROFILE=lineageos
 LABEL org.opencontainers.image.title="saddle (the lineageos os-distribution catalog lane)" \
@@ -555,7 +561,7 @@ LABEL org.opencontainers.image.title="saddle (the lineageos os-distribution cata
 COPY osprofiles/lineageos.json /saddle/osprofile.json
 
 FROM scratch AS oscalyxos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="calyxos"
 ENV SADDLE_OS_PROFILE=calyxos
 LABEL org.opencontainers.image.title="saddle (the calyxos os-distribution catalog lane)" \
@@ -566,7 +572,7 @@ LABEL org.opencontainers.image.title="saddle (the calyxos os-distribution catalo
 COPY osprofiles/calyxos.json /saddle/osprofile.json
 
 FROM scratch AS osarchlinux
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="archlinux"
 ENV SADDLE_OS_PROFILE=archlinux
 LABEL org.opencontainers.image.title="saddle (the archlinux os-distribution catalog lane)" \
@@ -577,7 +583,7 @@ LABEL org.opencontainers.image.title="saddle (the archlinux os-distribution cata
 COPY osprofiles/archlinux.json /saddle/osprofile.json
 
 FROM scratch AS osalpine
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="alpine"
 ENV SADDLE_OS_PROFILE=alpine
 LABEL org.opencontainers.image.title="saddle (the alpine os-distribution catalog lane)" \
@@ -588,7 +594,7 @@ LABEL org.opencontainers.image.title="saddle (the alpine os-distribution catalog
 COPY osprofiles/alpine.json /saddle/osprofile.json
 
 FROM scratch AS osdebian
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="debian"
 ENV SADDLE_OS_PROFILE=debian
 LABEL org.opencontainers.image.title="saddle (the debian os-distribution catalog lane)" \
@@ -599,7 +605,7 @@ LABEL org.opencontainers.image.title="saddle (the debian os-distribution catalog
 COPY osprofiles/debian.json /saddle/osprofile.json
 
 FROM scratch AS osfedora
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="fedora"
 ENV SADDLE_OS_PROFILE=fedora
 LABEL org.opencontainers.image.title="saddle (the fedora os-distribution catalog lane)" \
@@ -610,7 +616,7 @@ LABEL org.opencontainers.image.title="saddle (the fedora os-distribution catalog
 COPY osprofiles/fedora.json /saddle/osprofile.json
 
 FROM scratch AS osnixos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="nixos"
 ENV SADDLE_OS_PROFILE=nixos
 LABEL org.opencontainers.image.title="saddle (the nixos os-distribution catalog lane)" \
@@ -621,7 +627,7 @@ LABEL org.opencontainers.image.title="saddle (the nixos os-distribution catalog
 COPY osprofiles/nixos.json /saddle/osprofile.json
 
 FROM scratch AS osvoid
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.168
 ARG SADDLE_OS_PROFILE="void"
 ENV SADDLE_OS_PROFILE=void
 LABEL org.opencontainers.image.title="saddle (the void os-distribution catalog lane)" \

package/README.md

@@ -31,7 +31,7 @@ domain modules land beside the saddle domains:
 | `media.ts`, `render.ts`, `quantum.ts`, `tiers.ts` | media pipeline, GPU registry, quantum simulation, tier policy |
 | `security.ts`, `alternatives.ts` | hardening gates and the alternative-stack catalog |
 | `index.html`, `App.tsx`, `sol/` | the single SPA shell and the Sol theme (one tsx app with one stylesheet per theme) |
-| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.167 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
+| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.168 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
 | `vercel.json`, `netlify.toml` | the platform deploy adapters beside the surface they publish (the caddy ghost stays out of the tree) |
 | `specs/*` package exports | processors, gpus, cores, boards and the qemu/mttg/passage/docker envelopes |
 

package/docs/architecture.md

@@ -121,9 +121,9 @@ The remaining categories of the old file were already domain-owned: kernel featu
 
 ## 3b. Test patterns
 
-Tests live in the `test/` directory (one of the five allowed directories) and run with the Node built-in runner: `node --test 'test/*.test.ts'` (153 tests across eleven files - engine, features, media, render, simulation, specs, virtualcpu, virtualgpu, virtualmemory, web, workflow - all passing on Node 24 and 26), the same runner the ci.yml smoke gate executes on Node 26.7.0. Patterns:
+Tests live in the `test/` directory (one of the five allowed directories) and run on vitest: `vitest run` reads `test/*.test.ts` (153 tests across eleven files - engine, features, media, render, simulation, specs, virtualcpu, virtualgpu, virtualmemory, web, workflow), the same runner the ci.yml family suite executes through the app's `npm test`. Patterns:
 
-- `node:test` (`describe`/`it` or top-level `test`) plus `node:assert/strict`; no Jest, no third-party harness, no install step (the engine has zero runtime dependencies).
+- vitest (`describe`/`it`) plus `node:assert/strict`; no Jest, no node:test (vitest is the only CI runner), no install step beyond the dev tooling (the engine has zero runtime dependencies).
 - One test file per area under test (planner and lint rules, cpuinfo/meminfo generators, MIG density validator, QEMU argv builder); assertions target public exports, never module internals.
 - Doc-tests remain `@example` blocks in JSDoc (the planner asserts in `index.ts`), and every test stays deterministic: ports use the 30000-59999 random band or explicit ephemeral allocation, no network, no timing-dependent assertions.
 
@@ -266,7 +266,7 @@ Supporting subsystems: warm pool (prewarm/acquire/release/refill/drain, MAP_PRIV
 | TypeScript | 7.0.2 (Go-native port); `strict`, `verbatimModuleSyntax`, `isolatedModules`, `erasableSyntaxOnly`, `exactOptionalPropertyTypes`, `noUncheckedIndexedAccess`; ES2025 target with `lib ES2025+ESNext.Disposable` |
 | Erasable modern syntax | `using`/`await using` (modellease, MetricsStore, sandboxhandle), `satisfies` (`engineversions as const satisfies Record<string,string>`), const type parameters (`validateSpec<const T>`), `#private` fields and accessors, `import.meta.filename` for CLI detection |
 | ESM | `"type": "module"`; relative imports carry the `.ts` extension; no CommonJS `require` |
-| Tests | `node:test` + `node:assert/strict` executed with `node --test 'test/*.test.ts'`; the dedicated `test/` directory holds eleven test files (148 cases: 86 planner/generator originals, 24 workflow/simulation gates, 18 feature-audit builders, 4 media pipeline, 1 snapshot regression, 9 web edition), ci.yml runs them on Node 26.7.0; no Jest; doc-tests as `@example` blocks (the planner asserts live in `index.ts` planner docs) |
+| Tests | vitest + `node:assert/strict` executed with `vitest run` over `test/*.test.ts`; the dedicated `test/` directory holds eleven test files (148 cases: 86 planner/generator originals, 24 workflow/simulation gates, 18 feature-audit builders, 4 media pipeline, 1 snapshot regression, 9 web edition), ci.yml runs them through the app's `npm test`; no Jest; no node:test; doc-tests as `@example` blocks (the planner asserts live in `index.ts` planner docs) |
 | C++26 | `import std;` permitted, `std::expected` as the error channel, `std::mdspan` with the p2662r3 fallback guard, `std::print`/`std::format`, `enum class`, `[[nodiscard]]` on validate/argv/topology, RAII for every fd/socket (no exceptions in happy paths) |
 | C | C11 with `_GNU_SOURCE`, `dlsym(RTLD_NEXT)` resolution, xorshift32 deterministic drift, constructor priority 101 |
 | Python | 3.14 floor; stdlib only (socket, json, logging); try/except logging on every operation |
@@ -318,7 +318,7 @@ The old pins survive only inside `legacyCatalog` provenance blocks in `virtualha
 
 ## 15. CI graph (summary)
 
-Five workflows gate the tree: ci.yml (lint, typecheck matrix Node 24/26, the node:test suite in `test/`, build, flat-structure md5 guard, JSON schema validation of the ten data files), publishghcr.yml (the combined container pipeline: per-arch validation legs on push - clinfo/vulkaninfo/glxinfo probes inside the image - and the four-arch GHCR publication with provenance+SBOM on release), release.yml (GHCR + npm provenance + level-9 zip with SHA-256), pages.yml (the merged web pipeline: module syntax gate, boot smoke on port 37810, html lint, the webapi auth/mesh suite with a throwaway `E2UGH_DB`, the zip -9 static bundle and the GitHub Pages deployment of the web tree) and security.yml (CodeQL C/C++/TS, dependency review, Dockle/Trivy SARIF, gitleaks, Scorecard, Biome security group, license allowlist). Full descriptions and pins are in `readme.md`; the workflows themselves are the executable contract.
+Five workflows gate the tree: ci.yml (lint, typecheck matrix Node 24/26, the vitest suite in `test/`, build, flat-structure md5 guard, JSON schema validation of the ten data files), publishghcr.yml (the combined container pipeline: per-arch validation legs on push - clinfo/vulkaninfo/glxinfo probes inside the image - and the four-arch GHCR publication with provenance+SBOM on release), release.yml (GHCR + npm provenance + level-9 zip with SHA-256), pages.yml (the merged web pipeline: module syntax gate, boot smoke on port 37810, html lint, the webapi auth/mesh suite with a throwaway `E2UGH_DB`, the zip -9 static bundle and the GitHub Pages deployment of the web tree) and security.yml (CodeQL C/C++/TS, dependency review, Dockle/Trivy SARIF, gitleaks, Scorecard, Biome security group, license allowlist). Full descriptions and pins are in `readme.md`; the workflows themselves are the executable contract.
 
 ## 16. Compliance checklist
 

package/docs/e2ughengine.md

@@ -220,7 +220,7 @@ The CI pipeline enforces the flat contract: one concern per file with 20-25 rela
 | 42 | `docs/viability.md` | the proof, research methodology, 145-entry bibliography and roadmap appendices A-C |
 | 43 | `docs/alternatives.md` | ten alternative sandbox families compared against the engine |
 | 43b | `docs/optimization.md` | the build-pipeline optimization roadmap (cross-compilation, prebuilt QEMU/Mesa layers, runner strategy) for the slow multi-arch grid |
-| 44 | `test/` | node:test suite executed by ci.yml with `node --test` (153 cases, including CI-gate replay and end-to-end simulation suites) |
+| 44 | `test/` | vitest suite executed by ci.yml (`npm test`, `vitest run` over `test/*.test.ts`; 153 cases, including CI-gate replay and end-to-end simulation suites) |
 | 45 | `web/` | the web node (v7): `index.html` terminal sandbox, `login.html`/`register.html`/`dashboard.html` auth pages, `sandbox.js` browser-pure engine port (20 commands), `localauth.js` static-edge browser accounts (login/register/dashboard keep working on github pages with no api; accounts are mirrored to IndexedDB so partial clears never lose them, the dashboard carries backup/restore keyfile buttons, and the CODEOWNERS admins iakadion + akadion are seeded automatically with the shared bootstrap password - surviving any storage reset), `server.js` self-hosted node:http API (`/api/v1` sandboxes and exec), `db.js` sqlite persistence layer, `auth.js` scrypt password hashing with cookie sessions, `mesh.js` HMAC-signed node-to-node calls, `package.json`/`Dockerfile` (image `ghcr.io/wenathlan/e2ugh`; node pinned by the root `.nvmrc`), `schema.prisma`/`init.sql` database definition kept flat per the two-level contract, `mime.types`, `vercel.json`/`netlify.toml` static deploy without functions, `caddyfile` self-host proxy for devthink.pro, `readme.md` web docs |
 | 46 | `LICENSE` | full MIT text (Copyright (c) 2026 wenathlan) |
 
@@ -327,7 +327,7 @@ docker run --rm -p 37810:37810 -e E2UGH_DB=/data/e2ugh.db -v e2ughdata:/data \
 
 Five workflows gate the repository, all pinned to action releases verified on 2026-08-22:
 
-- **ci.yml** (every push and pull request) - six gates: Biome 2.5.11 lint and format; `tsc --noEmit` with TypeScript 7.0.2 on a Node 24/26 matrix; the Node built-in test runner over the dedicated `test/` suite (153 node:test cases); a build gate; the flat-structure contract (flat tree, no deep nesting, no duplicated content via md5); strict JSON schema validation of every tracked data file.
+- **ci.yml** (every push and pull request) - six gates: Biome 2.5.11 lint and format; `tsc --noEmit` with TypeScript 7.0.2 on a Node 24/26 matrix; the vitest runner over the dedicated `test/` suite (153 test cases); a build gate; the flat-structure contract (flat tree, no deep nesting, no duplicated content via md5); strict JSON schema validation of every tracked data file.
 - **hardware variants** (publishghcr.yml matrix) - one dockerfile, three curated profiles baked at build time so operators pull exactly the flavor they need: `ghcr.io/wenathlan/e2ugh:latest` (max: EPYC 9965 192c/384t, 1 TiB plan, 8x B200), `:balanced` (Threadripper PRO 9995WX 96c/192t, 512 GiB, 2x B200) and `:lite` (Ryzen 9 9950X3D 16c/32t, 128 GiB, 1x RTX 5090); every profile tag also carries semver and sha suffixes, and the runtime overlay (`VHE_TOTALRAM_GB`, `VHE_CPUS`, `VHE_GPU_PROFILE` environment variables) still lets any variant report any catalog identity up to 18 TiB at run time - the baked profile is the default identity, never a ceiling.
 - **publishghcr.yml** (the combined container pipeline; main, tags and releases) - per-architecture validation legs (`linux/amd64` native; `linux/arm64`, `linux/ppc64le` and `linux/s390x` under QEMU user emulation) that validate the live stack inside the built image: `clinfo` must report Rusticl OpenCL 3.1 on llvmpipe, `vulkaninfo --summary` must find lavapipe Vulkan 1.4, and Xvfb + `glxinfo` must report llvmpipe OpenGL 4.6, executed with `--memory-swap=-1 --shm-size=2g`. On releases, production builds push per-arch images by digest (the max profile ships the four-arch registry surface: amd64, arm64, ppc64le, s390x) with provenance `mode=max` and SBOM attestations before `docker buildx imagetools` assembles the per-profile manifest indexes.
 - **release.yml** (version tags and releases) - three publications: the multi-arch GHCR image, the npm package with `--provenance --access public` (zero runtime dependencies), and a maximum-compression (level 9) source zip with SHA-256 checksums.
@@ -384,7 +384,7 @@ The test contract is the Node built-in runner: no Jest, no third-party harness,
 # from a checkout (Node 24+)
 npm run typecheck                 # tsc --noEmit, the TypeScript 7.0.2 gate
 npm run lint                      # Biome 2.5.11
-node --test 'test/*.test.ts'      # the node:test suite (153 tests) - the glob form ci.yml uses
+npm test                          # the vitest suite (153 tests) - vitest run over test/*.test.ts, the form ci.yml uses
 
 # from the published image (GHCR, linux/amd64 and linux/arm64)
 docker run --rm --memory-swap=-1 --shm-size=2g \
@@ -424,7 +424,7 @@ The `test/` suite (Node 26.7.0 in CI, Node 24+ locally, `node:assert/strict`, 15
 | SADDLE v5 / v6 (Meta TS) | 2026-08-22 wave | `src_core_orchestrator.ts` (2080 lines) and `coreorchestrator.ts` (1283 lines): RBAC, NUMA scheduler, balloon, SR-IOV, passage protocols, quotas, preemption, leader election, OTel exporter; plus `pipelinememorypassage.ts` host-aware memory planning | Unique subsystems absorbed into `orchestrator.ts` (5238 lines) and `virtualmemory.ts`; duplicated buses/state machines/metrics collapsed into one of each |
 | Virtual Hardware Engine v5 (e2ugh) | 2026-08-22, English | The 44-file public repo generation: 9 TS modules, 11 JSONs, 4 workflows, 10 English docs with ~120 cited sources | Baseline of the v2 code tree; modules renamed and extended (hardware -> virtualcpu, memory -> virtualmemory) |
 | e2ugh v2 | 2026-08-22+ | The merge: 57 CPUs, 19 GPUs + APUs, one event bus (51 typed topics), one 15-state lifecycle, one metrics store | Baseline of the v3 redistribution |
-| e2ugh v3-v9 (this repo) | 2026-08-23+ | The rebrand and redistribution: github.com/wenathlan/e2ugh, package 1.2.1, `future.ts` decomposed into `scheduler.ts` and `compute.ts` (checkpoint plans into `virtualization.ts`, post-quantum into `security.ts`), a `test/` node:test suite, and the corrected version ledger (kernel 7.1.9/6.18.45, edk2-stable202605, wgpu 30.x, Spin 3.6.0, containerd 2.3.4, WireGuard via kernel mainline) | Current |
+| e2ugh v3-v9 (this repo) | 2026-08-23+ | The rebrand and redistribution: github.com/wenathlan/e2ugh, package 1.2.1, `future.ts` decomposed into `scheduler.ts` and `compute.ts` (checkpoint plans into `virtualization.ts`, post-quantum into `security.ts`), a `test/` vitest suite, and the corrected version ledger (kernel 7.1.9/6.18.45, edk2-stable202605, wgpu 30.x, Spin 3.6.0, containerd 2.3.4, WireGuard via kernel mainline) | Current |
 
 Full per-generation detail, including the verification reports for each wave, is preserved in `docs/viability.md`.
 

package/modalities.ts

@@ -2492,7 +2492,7 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     slug: "runnerdeno",
     lane: "runner",
     isolation: "process",
-    state: "planned",
+    state: "live",
     drivers: ["deno"],
     hardening: ["permission-map"],
     boot: "hot",
@@ -2508,10 +2508,18 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       num: 19,
       lane: "runner",
       binary: "deno",
-      // the payload rides the staged program file — the read permission maps
-      // the sandbox alone, the stdin dash never rides (no pipe is written).
+      // the real deno runner: the payload rides the staged program file —
+      // the read permission maps the sandbox alone, the module cache rides
+      // the sandbox tree (DENO_DIR never touches the host home — the same
+      // seat the edge lane carries), the stdin dash never rides (no pipe
+      // is written). the runtime detection rides the spawner's own absence
+      // grammar — the same probehostbinary seat the edge lane table
+      // carries — and a host without the deno binary answers the honest
+      // coded absence, never a faked run (the seat never fakes a runtime).
       argv: ({ file }) => ["deno", "run", "--allow-read=/sandbox", file],
+      env: { DENO_DIR: "/sandbox/denodir" },
       hardening: ["permission-map"],
+      probe: "the host must carry the deno runtime (the runner-deno seat the owner's law 268 charges)",
     }),
   },
   {
@@ -4191,7 +4199,7 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     slug: "storagesqlite",
     lane: "sandbox",
     isolation: "process",
-    state: "planned",
+    state: "live",
     drivers: ["sqlite"],
     hardening: ["file-quota"],
     boot: "hot",
@@ -4207,27 +4215,60 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       num: 72,
       lane: "sandbox",
       operate: async (request) => {
+        // the real vault roundtrip: the node:sqlite runtime the engine host
+        // carries — without it the seat answers the honest coded absence, and
+        // with it one full roundtrip (create, insert, select, drop) on a
+        // private in-memory table, the readback compared against the payload
+        // character for character (the seat never fakes a database and never
+        // opens a file — the store rides :memory: alone, the caller values
+        // ride parameterized statements, only the seat's own generated table
+        // name rides the statement text).
+        let sqlite: typeof import("node:sqlite");
         try {
-          const sqlite = (await import("node:sqlite")) as typeof import("node:sqlite");
-          const database = new sqlite.DatabaseSync(":memory:");
-          try {
-            database.exec("CREATE TABLE sandbox_artifacts (id INTEGER PRIMARY KEY, payload TEXT)");
-            const statement = database.prepare("INSERT INTO sandbox_artifacts (payload) VALUES (?)");
-            statement.run(request.code.slice(0, 1024));
-            const rows = database.prepare("SELECT id, payload FROM sandbox_artifacts").all();
-            return {
-              stdout: `sqlite vault: ${rows.length} row(s) answered by the in-memory store (node:sqlite, :memory:)`,
-              artifact: { rows: rows.length, engine: "node:sqlite" },
-            };
-          } finally {
-            database.close();
-          }
+          sqlite = (await import("node:sqlite")) as typeof import("node:sqlite");
         } catch (error) {
           throw Object.assign(
             new Error(`the sqlite runtime is absent from this host: ${error instanceof Error ? error.message : String(error)}`),
             { code: "HOST_RUNTIME_ABSENT" },
           );
         }
+        const table = `saddle_sqlite_${Date.now().toString(36)}${Math.floor(Math.random() * 1679616).toString(36)}`;
+        const payload = request.code;
+        let readback = "";
+        const database = new sqlite.DatabaseSync(":memory:");
+        try {
+          database.exec(`CREATE TABLE ${table} (k TEXT PRIMARY KEY, v TEXT)`);
+          database.prepare(`INSERT INTO ${table} (k, v) VALUES (?, ?)`).run("saddle-payload", payload);
+          readback = String(
+            (database.prepare(`SELECT v FROM ${table} WHERE k = ?`).get("saddle-payload") as { v?: unknown } | undefined)?.v ?? "",
+          );
+        } catch (error) {
+          throw Object.assign(
+            new Error(`the sqlite vault refused the roundtrip: ${error instanceof Error ? error.message : String(error)}`),
+            { code: "SQLITE_ROUNDTRIP_FAILED" },
+          );
+        } finally {
+          try {
+            database.exec(`DROP TABLE IF EXISTS ${table}`);
+          } catch {
+            /* the roundtrip already answered; the drop is best effort */
+          }
+          try {
+            database.close();
+          } catch {
+            /* the close is best effort */
+          }
+        }
+        if (readback !== payload) {
+          throw Object.assign(
+            new Error(`the sqlite roundtrip answered ${readback.length} characters for ${payload.length} written`),
+            { code: "SQLITE_ROUNDTRIP_FAILED" },
+          );
+        }
+        return {
+          stdout: `sqlite vault: ${payload.length} characters roundtripped through the node:sqlite in-memory store`,
+          artifact: { rows: 1, engine: "node:sqlite", roundtrip: true, store: ":memory:" },
+        };
       },
     }),
   },
@@ -4427,7 +4468,7 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     slug: "networkdns",
     lane: "sandbox",
     isolation: "process",
-    state: "planned",
+    state: "live",
     drivers: ["dns"],
     hardening: ["resolver-allowlist"],
     boot: "hot",
@@ -4443,11 +4484,47 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       num: 77,
       lane: "sandbox",
       operate: async (request) => {
+        // the real resolution roundtrip: the node:dns resolver the engine
+        // host carries — one lookup of the pinned well-known name
+        // ("localhost", the name every host resolver answers; the caller
+        // may name another, the roundtrip rides the same resolver call)
+        // with the answered records verified as the honest result (the
+        // non-empty answer, the address, the address family). the seat
+        // never fakes a response and never opens a socket beyond the
+        // resolver call — a host without a working resolver path answers
+        // the honest coded refusal, never a canned answer (the wire
+        // question the builddnsquery builder frames rides the artifact
+        // beside the records the resolver actually answered — the same
+        // grammar the sqlite vault roundtrip carries).
+        const dns = await import("node:dns");
         const inputs = (request.inputs ?? {}) as { domain?: string; qtype?: string };
-        const packet = builddnsquery(inputs.domain ?? "devthink.dev", inputs.qtype ?? "a");
+        const domain = inputs.domain ?? "localhost";
+        const qtype = (inputs.qtype ?? "a").toLowerCase();
+        const packet = builddnsquery(domain, qtype);
+        const family = qtype === "a" ? 4 : qtype === "aaaa" ? 6 : 0;
+        let records: import("node:dns").LookupAddress[];
+        try {
+          records = await dns.promises.lookup(domain, { all: true, family });
+        } catch (error) {
+          throw Object.assign(
+            new Error(
+              `the host resolver refused the ${qtype} roundtrip for ${domain}: ${error instanceof Error ? error.message : String(error)}`,
+            ),
+            { code: "DNS_RESOLUTION_REFUSED" },
+          );
+        }
+        if (
+          records.length === 0 ||
+          records.some((record) => record.address.length === 0 || (record.family !== 4 && record.family !== 6))
+        ) {
+          throw Object.assign(
+            new Error(`the dns roundtrip answered ${records.length} records for ${domain} — the honest result never rides a malformed answer`),
+            { code: "DNS_ROUNDTRIP_FAILED" },
+          );
+        }
         return {
-          stdout: `dns: the ${inputs.qtype ?? "a"} query for ${inputs.domain ?? "devthink.dev"} answered as a ${packet.length / 2}-byte wire packet`,
-          artifact: { packet, domain: inputs.domain ?? "devthink.dev", qtype: inputs.qtype ?? "a" },
+          stdout: `dns resolver: ${domain} resolved ${records.length} records through the node:dns host resolver (the ${qtype} question, the honest roundtrip)`,
+          artifact: { packet, domain, qtype, records, resolved: true, resolver: "node:dns" },
         };
       },
     }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/saddle",
-  "version": "2.0.167",
+  "version": "2.0.168",
   "private": false,
   "description": "binary computing engine that turns distributed storage into a publishable working set carrying the merged virtual-hardware engine (the saddle + e2ugh grand merge)",
   "license": "GPL-3.0-only",
@@ -48,9 +48,9 @@
     "vm:create": "node --import tsx ./cli.ts vm",
     "vm:validate": "node --import tsx ./cli.ts vmlint",
     "gpu:list": "node --import tsx ./cli.ts gpus",
-    "docker:build": "docker build -f Dockerfile -t saddle:2.0.167 ..",
-    "docker:run": "docker run --rm --memory-swap=-1 --shm-size=2g saddle:2.0.167",
-    "docker:health": "docker run --rm -d --name saddle-health -p 8080:8080 saddle:2.0.167 >/dev/null && sleep 5; curl -fsS http://localhost:8080/api/v1/health || true; docker rm -f saddle-health >/dev/null 2>&1 || true",
+    "docker:build": "docker build -f Dockerfile -t saddle:2.0.168 ..",
+    "docker:run": "docker run --rm --memory-swap=-1 --shm-size=2g saddle:2.0.168",
+    "docker:health": "docker run --rm -d --name saddle-health -p 8080:8080 saddle:2.0.168 >/dev/null && sleep 5; curl -fsS http://localhost:8080/api/v1/health || true; docker rm -f saddle-health >/dev/null 2>&1 || true",
     "firecracker:boot": "firecracker --api-sock /tmp/fc-saddle.sock --config-file vmconfig.json 2>/dev/null || echo 'firecracker 1.16.1 warm-pool boot 125ms target'",
     "py:bridge": "python3 qemubridge.py",
     "py:test": "python3 -m pytest -q || python3 qemubridge.py",
@@ -59,9 +59,9 @@
     "start:engine": "node --import tsx ./cli.ts plan"
   },
   "dependencies": {
-    "@ai-sdk/openai": "^4.0.110",
-    "@ai-sdk/openai-compatible": "^3.0.86",
-    "@ai-sdk/provider-utils": "^5.0.75",
+    "@ai-sdk/openai": "^4.0.111",
+    "@ai-sdk/openai-compatible": "^3.0.87",
+    "@ai-sdk/provider-utils": "^5.0.76",
     "@anthropic-ai/sdk": "^1.6.0",
     "@biomejs/biome": "^2.6.6",
     "@capacitor/android": "^8.6.0",
@@ -131,15 +131,15 @@
     "@types/react-dom": "^19.3.0",
     "@types/three": "^0.187.0",
     "@vitejs/plugin-react": "^6.2.1",
-    "@wenathlan/argan": "~2.0.166",
-    "@wenathlan/cadria": "~2.0.166",
-    "@wenathlan/debonair": "~2.0.166",
-    "@wenathlan/devthink": "~2.0.166",
-    "@wenathlan/getry": "~2.0.166",
-    "@wenathlan/saddle": "~2.0.166",
-    "@wenathlan/vault": "~2.0.166",
+    "@wenathlan/argan": "~2.0.167",
+    "@wenathlan/cadria": "~2.0.167",
+    "@wenathlan/debonair": "~2.0.167",
+    "@wenathlan/devthink": "~2.0.167",
+    "@wenathlan/getry": "~2.0.167",
+    "@wenathlan/saddle": "~2.0.167",
+    "@wenathlan/vault": "~2.0.167",
     "add": "^2.0.9",
-    "ai": "^7.0.164",
+    "ai": "^7.0.165",
     "autoprefixer": "^10.6.2",
     "axios": "^1.21.0",
     "baseline-browser-mapping": "^2.11.35",
@@ -150,7 +150,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "commander": "^15.0.0",
+    "commander": "^15.1.0",
     "date-fns": "^4.4.0",
     "deepmerge-ts": "^8.0.2",
     "dockerode": "^5.0.1",
@@ -168,13 +168,12 @@
     "framer-motion": "^14.10.1",
     "glob": "^14.0.4",
     "gsap": "^3.15.1",
-    "hono": "^4.13.16",
+    "hono": "^4.13.17",
     "ink": "^8.0.0",
     "input-otp": "^1.5.0",
     "js-yaml": "^5.5.0",
     "jsdom": "^31.0.0",
     "katex": "^0.19.1",
-    "lucide-react": "^1.70.0",
     "minimatch": "^11.0.5",
     "motion": "^14.10.1",
     "mysql2": "^3.24.6",
@@ -233,9 +232,9 @@
     "zustand": "^5.1.0"
   },
   "devDependencies": {
-    "@ai-sdk/openai": "^4.0.110",
-    "@ai-sdk/openai-compatible": "^3.0.86",
-    "@ai-sdk/provider-utils": "^5.0.75",
+    "@ai-sdk/openai": "^4.0.111",
+    "@ai-sdk/openai-compatible": "^3.0.87",
+    "@ai-sdk/provider-utils": "^5.0.76",
     "@anthropic-ai/sdk": "^1.6.0",
     "@biomejs/biome": "^2.6.6",
     "@capacitor/android": "^8.6.0",
@@ -305,15 +304,15 @@
     "@types/react-dom": "^19.3.0",
     "@types/three": "^0.187.0",
     "@vitejs/plugin-react": "^6.2.1",
-    "@wenathlan/argan": "~2.0.166",
-    "@wenathlan/cadria": "~2.0.166",
-    "@wenathlan/debonair": "~2.0.166",
-    "@wenathlan/devthink": "~2.0.166",
-    "@wenathlan/getry": "~2.0.166",
-    "@wenathlan/saddle": "~2.0.166",
-    "@wenathlan/vault": "~2.0.166",
+    "@wenathlan/argan": "~2.0.167",
+    "@wenathlan/cadria": "~2.0.167",
+    "@wenathlan/debonair": "~2.0.167",
+    "@wenathlan/devthink": "~2.0.167",
+    "@wenathlan/getry": "~2.0.167",
+    "@wenathlan/saddle": "~2.0.167",
+    "@wenathlan/vault": "~2.0.167",
     "add": "^2.0.9",
-    "ai": "^7.0.164",
+    "ai": "^7.0.165",
     "autoprefixer": "^10.6.2",
     "axios": "^1.21.0",
     "baseline-browser-mapping": "^2.11.35",
@@ -324,7 +323,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "commander": "^15.0.0",
+    "commander": "^15.1.0",
     "date-fns": "^4.4.0",
     "deepmerge-ts": "^8.0.2",
     "dockerode": "^5.0.1",
@@ -342,13 +341,12 @@
     "framer-motion": "^14.10.1",
     "glob": "^14.0.4",
     "gsap": "^3.15.1",
-    "hono": "^4.13.16",
+    "hono": "^4.13.17",
     "ink": "^8.0.0",
     "input-otp": "^1.5.0",
     "js-yaml": "^5.5.0",
     "jsdom": "^31.0.0",
     "katex": "^0.19.1",
-    "lucide-react": "^1.70.0",
     "minimatch": "^11.0.5",
     "motion": "^14.10.1",
     "mysql2": "^3.24.6",
@@ -407,9 +405,9 @@
     "zustand": "^5.1.0"
   },
   "overrides": {
-    "@ai-sdk/openai": "^4.0.110",
-    "@ai-sdk/openai-compatible": "^3.0.86",
-    "@ai-sdk/provider-utils": "^5.0.75",
+    "@ai-sdk/openai": "^4.0.111",
+    "@ai-sdk/openai-compatible": "^3.0.87",
+    "@ai-sdk/provider-utils": "^5.0.76",
     "@anthropic-ai/sdk": "^1.6.0",
     "@biomejs/biome": "^2.6.6",
     "@capacitor/android": "^8.6.0",
@@ -479,15 +477,15 @@
     "@types/react-dom": "^19.3.0",
     "@types/three": "^0.187.0",
     "@vitejs/plugin-react": "^6.2.1",
-    "@wenathlan/argan": "~2.0.166",
-    "@wenathlan/cadria": "~2.0.166",
-    "@wenathlan/debonair": "~2.0.166",
-    "@wenathlan/devthink": "~2.0.166",
-    "@wenathlan/getry": "~2.0.166",
-    "@wenathlan/saddle": "~2.0.166",
-    "@wenathlan/vault": "~2.0.166",
+    "@wenathlan/argan": "~2.0.167",
+    "@wenathlan/cadria": "~2.0.167",
+    "@wenathlan/debonair": "~2.0.167",
+    "@wenathlan/devthink": "~2.0.167",
+    "@wenathlan/getry": "~2.0.167",
+    "@wenathlan/saddle": "~2.0.167",
+    "@wenathlan/vault": "~2.0.167",
     "add": "^2.0.9",
-    "ai": "^7.0.164",
+    "ai": "^7.0.165",
     "autoprefixer": "^10.6.2",
     "axios": "^1.21.0",
     "baseline-browser-mapping": "^2.11.35",
@@ -498,7 +496,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "commander": "^15.0.0",
+    "commander": "^15.1.0",
     "date-fns": "^4.4.0",
     "deepmerge-ts": "^8.0.2",
     "dockerode": "^5.0.1",
@@ -516,13 +514,12 @@
     "framer-motion": "^14.10.1",
     "glob": "^14.0.4",
     "gsap": "^3.15.1",
-    "hono": "^4.13.16",
+    "hono": "^4.13.17",
     "ink": "^8.0.0",
     "input-otp": "^1.5.0",
     "js-yaml": "^5.5.0",
     "jsdom": "^31.0.0",
     "katex": "^0.19.1",
-    "lucide-react": "^1.70.0",
     "minimatch": "^11.0.5",
     "motion": "^14.10.1",
     "mysql2": "^3.24.6",

package/workloadlaw.ts

@@ -1,5 +1,6 @@
-// # workloadlaw — the family workload lane catalog and the join law of the
-// engine (root layer, wave WL1). One row per heavy workload lane of every
+// # workloadlaw — the family workload lane catalog, the join law of the
+// engine and the lane seat factory of the app seats (root layer, waves
+// WL1 + W5). One row per heavy workload lane of every
 // official app of the family: the app that owns the lane, the lane's name,
 // the demand the lane puts on the sandbox (gpu, network, isolation depth,
 // boot budget) and where the lane runs today. The law this module answers
@@ -89,52 +90,268 @@ export type LaneJoin = {
  * the join computes the answer from the registry of record. */
 export const FAMILYLANES: readonly WorkloadLane[] = Object.freeze([
   // the argan lanes: the dns engine's heavy passes
-  { app: "argan", lane: "dnssec-validate", role: "the dnssec chain validation walk: rrsig parsing, key tag checksums, validity windows and ds match rules over untrusted input", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "app-lane" },
-  { app: "argan", lane: "zonefile-parse-diff", role: "the master file parse and the external-dns diff: tokenizer, normalization, creates/deletes/updates by group", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "app-lane" },
-  { app: "argan", lane: "catalog-registry-serve", role: "the registry tables the catalog serves: mime types, protocols and seed rows over https and db, never the browser fallback", demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 }, today: "app-lane" },
-  { app: "argan", lane: "label-store-seed", role: "the label manifest seed into the store: the upsert walk that protects translated rows, mirrored server-side", demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 }, today: "app-lane" },
+  {
+    app: "argan",
+    lane: "dnssec-validate",
+    role: "the dnssec chain validation walk: rrsig parsing, key tag checksums, validity windows and ds match rules over untrusted input",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
+  {
+    app: "argan",
+    lane: "zonefile-parse-diff",
+    role: "the master file parse and the external-dns diff: tokenizer, normalization, creates/deletes/updates by group",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
+  {
+    app: "argan",
+    lane: "catalog-registry-serve",
+    role: "the registry tables the catalog serves: mime types, protocols and seed rows over https and db, never the browser fallback",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 },
+    today: "app-lane",
+  },
+  {
+    app: "argan",
+    lane: "label-store-seed",
+    role: "the label manifest seed into the store: the upsert walk that protects translated rows, mirrored server-side",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
   // the cadria lanes: the versawaze engine's generation passes
-  { app: "cadria", lane: "analyze-wav", role: "the audio analysis pipeline: decode, downmix, resample, stft and the spectrum, rhythm, tonality, timbre and structure fusion", demand: { gpu: false, network: false, isolation: "process", bootbudget: 800 }, today: "engine-lane" },
-  { app: "cadria", lane: "generate-image", role: "the image generation walk: palette, composition blocks, rhythm scatter, texture and motion into the deterministic project", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "engine-lane" },
-  { app: "cadria", lane: "render-svg", role: "the svg render of the image project: draw command compilation and the byte-deterministic serialization", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "engine-lane" },
-  { app: "cadria", lane: "decode-video", role: "the frame-accurate video decode lane: the container-namespace pass the codec walk rides, never the visitor decoder", demand: { gpu: false, network: false, isolation: "namespace", bootbudget: 800 }, today: "app-lane" },
-  { app: "cadria", lane: "compile-shader", role: "the shader program assembly: the fragment library, the deterministic manifest and the sha digest, no visitor gpu ever compiles", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "engine-lane" },
+  {
+    app: "cadria",
+    lane: "analyze-wav",
+    role: "the audio analysis pipeline: decode, downmix, resample, stft and the spectrum, rhythm, tonality, timbre and structure fusion",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 800 },
+    today: "engine-lane",
+  },
+  {
+    app: "cadria",
+    lane: "generate-image",
+    role: "the image generation walk: palette, composition blocks, rhythm scatter, texture and motion into the deterministic project",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "engine-lane",
+  },
+  {
+    app: "cadria",
+    lane: "render-svg",
+    role: "the svg render of the image project: draw command compilation and the byte-deterministic serialization",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "engine-lane",
+  },
+  {
+    app: "cadria",
+    lane: "decode-video",
+    role: "the frame-accurate video decode lane: the container-namespace pass the codec walk rides, never the visitor decoder",
+    demand: { gpu: false, network: false, isolation: "namespace", bootbudget: 800 },
+    today: "app-lane",
+  },
+  {
+    app: "cadria",
+    lane: "compile-shader",
+    role: "the shader program assembly: the fragment library, the deterministic manifest and the sha digest, no visitor gpu ever compiles",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "engine-lane",
+  },
   // the cobaia lanes: the monetization surface's light walks
-  { app: "cobaia", lane: "plan-checkout", role: "the plan checkout surface: mrr plan rows, link validation and the billing webhook walk when it lands, secrets server-side", demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 }, today: "app-lane" },
-  { app: "cobaia", lane: "ads-slot", role: "the honest ad slot lane: the reserved slots and the rotation decision the deploy answers before the render", demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 }, today: "app-lane" },
-  { app: "cobaia", lane: "label-seed", role: "the label manifest seed of the monetization face: the store walk the sqlite vault carries", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "app-lane" },
+  {
+    app: "cobaia",
+    lane: "plan-checkout",
+    role: "the plan checkout surface: mrr plan rows, link validation and the billing webhook walk when it lands, secrets server-side",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
+  {
+    app: "cobaia",
+    lane: "ads-slot",
+    role: "the honest ad slot lane: the reserved slots and the rotation decision the deploy answers before the render",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
+  {
+    app: "cobaia",
+    lane: "label-seed",
+    role: "the label manifest seed of the monetization face: the store walk the sqlite vault carries",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
   // the debonair lanes: the kathesis engine's audio walks
-  { app: "debonair", lane: "ingest-audio", role: "the ingest worker: the stream separation, the pcm downmix and the payload json the reconstruction reads", demand: { gpu: false, network: false, isolation: "process", bootbudget: 800 }, today: "engine-lane" },
-  { app: "debonair", lane: "render-track", role: "the render worker: the composed plan render, the mastering chain and the wav encode into the take store", demand: { gpu: false, network: false, isolation: "process", bootbudget: 800 }, today: "engine-lane" },
+  {
+    app: "debonair",
+    lane: "ingest-audio",
+    role: "the ingest worker: the stream separation, the pcm downmix and the payload json the reconstruction reads",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 800 },
+    today: "engine-lane",
+  },
+  {
+    app: "debonair",
+    lane: "render-track",
+    role: "the render worker: the composed plan render, the mastering chain and the wav encode into the take store",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 800 },
+    today: "engine-lane",
+  },
   // the forge lanes: the execution clone's run walks
-  { app: "forge", lane: "binary-run", role: "the binary run lane: the runner the saddle engine answers for the fleet, the mode gate resolving through the join", demand: { gpu: false, network: true, isolation: "namespace", bootbudget: 800 }, today: "app-lane" },
-  { app: "forge", lane: "queue-priority", role: " the run queue walk: express, normal and batch ordering over the queue the lane serves", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "app-lane" },
+  {
+    app: "forge",
+    lane: "binary-run",
+    role: "the binary run lane: the runner the saddle engine answers for the fleet, the mode gate resolving through the join",
+    demand: { gpu: false, network: true, isolation: "namespace", bootbudget: 800 },
+    today: "app-lane",
+  },
+  {
+    app: "forge",
+    lane: "queue-priority",
+    role: " the run queue walk: express, normal and batch ordering over the queue the lane serves",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
   // the foundry lanes: the pipeline clone's graph walks
-  { app: "foundry", lane: "pipeline-graph", role: "the pipeline graph lane: provision, pull, run, collect and store — the plan walk the herd drives", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "app-lane" },
-  { app: "foundry", lane: "image-artifact", role: "the image artifact lane: the format plans, the checksum seals and the shelf records the vault stores", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "app-lane" },
+  {
+    app: "foundry",
+    lane: "pipeline-graph",
+    role: "the pipeline graph lane: provision, pull, run, collect and store — the plan walk the herd drives",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
+  {
+    app: "foundry",
+    lane: "image-artifact",
+    role: "the image artifact lane: the format plans, the checksum seals and the shelf records the vault stores",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
   // the getry lanes: the ai gateway's inference walks
-  { app: "getry", lane: "inference-route", role: "the inference route lane: the provider pool, the sse parse and the model masking over the upstream calls", demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 }, today: "engine-lane" },
-  { app: "getry", lane: "stream-fallback", role: "the resilience runner: the verdict ladder, the backoff walk and the trail the retry lane keeps", demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 }, today: "engine-lane" },
-  { app: "getry", lane: "thinking-ladder", role: "the seven-level reasoning ladder: the budget resolution the request injects before the upstream call", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "engine-lane" },
-  { app: "getry", lane: "router-rotation", role: "the rotation lane: the weighted draw, the cooldown ledger and the session rows the store keeps", demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 }, today: "engine-lane" },
+  {
+    app: "getry",
+    lane: "inference-route",
+    role: "the inference route lane: the provider pool, the sse parse and the model masking over the upstream calls",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 },
+    today: "engine-lane",
+  },
+  {
+    app: "getry",
+    lane: "stream-fallback",
+    role: "the resilience runner: the verdict ladder, the backoff walk and the trail the retry lane keeps",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 },
+    today: "engine-lane",
+  },
+  {
+    app: "getry",
+    lane: "thinking-ladder",
+    role: "the seven-level reasoning ladder: the budget resolution the request injects before the upstream call",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "engine-lane",
+  },
+  {
+    app: "getry",
+    lane: "router-rotation",
+    role: "the rotation lane: the weighted draw, the cooldown ledger and the session rows the store keeps",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 },
+    today: "engine-lane",
+  },
   // the saddle lanes: the engine's own dispatch surface
-  { app: "saddle", lane: "edge-dispatch", role: "the edge plane dispatch itself: the visitor guard, the lane resolution and the artifact commit through the vault seam", demand: { gpu: false, network: true, isolation: "process", bootbudget: 1500 }, today: "engine-lane" },
+  {
+    app: "saddle",
+    lane: "edge-dispatch",
+    role: "the edge plane dispatch itself: the visitor guard, the lane resolution and the artifact commit through the vault seam",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 1500 },
+    today: "engine-lane",
+  },
   // the stealthhead lanes: the fps platform's simulation walks
-  { app: "stealthhead", lane: "match-simulate", role: "the authoritative match simulation: the fixed-step physics, the reconcile and rewind twin and the seeded spawns", demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 }, today: "app-lane" },
-  { app: "stealthhead", lane: "rank-compute", role: "the ranking walk: the elo ladder, the season batch and the position assignment over the standing rows", demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 }, today: "app-lane" },
-  { app: "stealthhead", lane: "world-bake", role: "the world pre-compilation: the map bake through the render engine — the gpu pass the planned modalities answer", demand: { gpu: true, network: true, isolation: "vm", bootbudget: 1500 }, today: "app-lane" },
-  { app: "stealthhead", lane: "ballistics-balance", role: "the armory balance sweep: falloff, shots-to-kill and ttk validation, offline and deterministic", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "app-lane" },
+  {
+    app: "stealthhead",
+    lane: "match-simulate",
+    role: "the authoritative match simulation: the fixed-step physics, the reconcile and rewind twin and the seeded spawns",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
+  {
+    app: "stealthhead",
+    lane: "rank-compute",
+    role: "the ranking walk: the elo ladder, the season batch and the position assignment over the standing rows",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 },
+    today: "app-lane",
+  },
+  {
+    app: "stealthhead",
+    lane: "world-bake",
+    role: "the world pre-compilation: the map bake through the render engine — the gpu pass the planned modalities answer",
+    demand: { gpu: true, network: true, isolation: "vm", bootbudget: 1500 },
+    today: "app-lane",
+  },
+  {
+    app: "stealthhead",
+    lane: "ballistics-balance",
+    role: "the armory balance sweep: falloff, shots-to-kill and ttk validation, offline and deterministic",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "app-lane",
+  },
   // the vault lanes: the storage engine's object walks
-  { app: "vault", lane: "blob-ingest", role: "the object deposit lane: path and mime validation, the quota gate inside the write transaction and the detach walk", demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 }, today: "engine-lane" },
-  { app: "vault", lane: "chunk-window", role: "the chunk window lane: the fixed slicing, the per-window digest and the brotli decision over the byte stream", demand: { gpu: false, network: false, isolation: "process", bootbudget: 800 }, today: "engine-lane" },
-  { app: "vault", lane: "digest-sha256", role: "the digest engine: the sha-256 master and chunk walks and the full re-verification the read path answers", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "engine-lane" },
-  { app: "vault", lane: "ref-gc", role: "the reference gc lane: the soft-delete tombstones, the ref detach and the orphan sweep the store drives", demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 }, today: "engine-lane" },
+  {
+    app: "vault",
+    lane: "blob-ingest",
+    role: "the object deposit lane: path and mime validation, the quota gate inside the write transaction and the detach walk",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 },
+    today: "engine-lane",
+  },
+  {
+    app: "vault",
+    lane: "chunk-window",
+    role: "the chunk window lane: the fixed slicing, the per-window digest and the brotli decision over the byte stream",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 800 },
+    today: "engine-lane",
+  },
+  {
+    app: "vault",
+    lane: "digest-sha256",
+    role: "the digest engine: the sha-256 master and chunk walks and the full re-verification the read path answers",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "engine-lane",
+  },
+  {
+    app: "vault",
+    lane: "ref-gc",
+    role: "the reference gc lane: the soft-delete tombstones, the ref detach and the orphan sweep the store drives",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 },
+    today: "engine-lane",
+  },
   // the devthink lanes: the os envelope's command walks
-  { app: "devthink", lane: "chat-sandbox", role: "the chat sandbox lane: the session jail, the tool surface and the exec walks the engine dispatches server-side", demand: { gpu: false, network: true, isolation: "namespace", bootbudget: 1500 }, today: "engine-lane" },
-  { app: "devthink", lane: "llm-gateway", role: "the universal gateway pipeline: model resolution, auth, body building, retry and the streaming byte passthrough", demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 }, today: "engine-lane" },
-  { app: "devthink", lane: "stream-parse", role: "the streaming parser: the tolerant sse walk, the payload normalization and the delta tracking over the live stream", demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 }, today: "engine-lane" },
-  { app: "devthink", lane: "graph-run", role: "the graph runner: the deterministic stage walk, the retry ladder and the progress views the console draws", demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 }, today: "engine-lane" },
-  { app: "devthink", lane: "mcp-serve", role: "the mcp registry lane: the tool catalog, the approval gates and the transports the server answers", demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 }, today: "engine-lane" },
+  {
+    app: "devthink",
+    lane: "chat-sandbox",
+    role: "the chat sandbox lane: the session jail, the tool surface and the exec walks the engine dispatches server-side",
+    demand: { gpu: false, network: true, isolation: "namespace", bootbudget: 1500 },
+    today: "engine-lane",
+  },
+  {
+    app: "devthink",
+    lane: "llm-gateway",
+    role: "the universal gateway pipeline: model resolution, auth, body building, retry and the streaming byte passthrough",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 },
+    today: "engine-lane",
+  },
+  {
+    app: "devthink",
+    lane: "stream-parse",
+    role: "the streaming parser: the tolerant sse walk, the payload normalization and the delta tracking over the live stream",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 25 },
+    today: "engine-lane",
+  },
+  {
+    app: "devthink",
+    lane: "graph-run",
+    role: "the graph runner: the deterministic stage walk, the retry ladder and the progress views the console draws",
+    demand: { gpu: false, network: false, isolation: "process", bootbudget: 25 },
+    today: "engine-lane",
+  },
+  {
+    app: "devthink",
+    lane: "mcp-serve",
+    role: "the mcp registry lane: the tool catalog, the approval gates and the transports the server answers",
+    demand: { gpu: false, network: true, isolation: "process", bootbudget: 800 },
+    today: "engine-lane",
+  },
 ]);
 
 /** The official app slugs the catalog covers — the lockstep vocabulary the
@@ -291,3 +508,85 @@ export function workloadreport(): FamilyWorkloadReport {
     perapp,
   };
 }
+
+// The lane seat engine (wave W5, the dedup law): every app file of the
+// family once carried its own copy of the seat resolver (the deploy's
+// opt-in walk — local, join or a pinned modality id), the env reader and
+// the lane lookup beside its own lane table. The engine lives here once
+// now: the factory below binds the law — ported verbatim from the app
+// seats the wave folded, zero behavior change — to the app's own slug,
+// env var name and lane table, and the app seats re-export the bound
+// functions under the historical names their batteries pin, so the
+// engine is never duplicated between apps (the family law: the owner
+// exports, the apps import). The seat stays as pure as the catalog: no
+// new imports, no storage, the browser-pure bundle keeps carrying it.
+
+/** One workload lane row as the app seats speak it — the historical
+ * surface name of the engine's own row shape (WorkloadLane above): the
+ * alias keeps every app importer stable while the engine owns the shape
+ * (the dedup law — one row shape, one owner). */
+export type AppWorkloadLane = WorkloadLane;
+
+/** The typed answer of the lane seat: the declaration the deploy reads —
+ * local (the lanes run in the deploy's own process), join (the platform
+ * resolves every lane through the engine's join resolver), or the pinned
+ * modality id the deploy named (validated by the platform's join at
+ * dispatch, never judged here). every answer is honest: an absent or
+ * blank choice answers the declared default, never a silent switch. */
+export type LaneSeatResult =
+  | { ok: true; seat: "local"; sandboxed: false }
+  | { ok: true; seat: "join"; sandboxed: true; pinned: false }
+  | { ok: true; seat: string; sandboxed: true; pinned: true };
+
+/** One app's lane seating — the bound engine the app seats re-export:
+ * the app's own slug, env var name and lane table beside the seat
+ * functions the app surface speaks (the names the batteries pin). */
+export type LaneSeating = {
+  /** The official app slug the seating carries. */
+  APPSLUG: string;
+  /** The environment name the deploy pins the seat through. */
+  SANDBOXLANEENV: string;
+  /** The lane table the seating answers lookups from. */
+  WORKLOADLANES: readonly AppWorkloadLane[];
+  /** Resolves the sandbox lane seat — the deploy's opt-in choice walk. */
+  lanesandbox: (choice: string | undefined) => LaneSeatResult;
+  /** Reads the seat off one environment lookup — the injected env carrier. */
+  lanesandboxfromenv: (lookup: (key: string) => string | undefined) => LaneSeatResult;
+  /** Answers one lane row by lane id — the lookup the app surfaces read. */
+  laneof: (lane: string) => AppWorkloadLane | undefined;
+};
+
+/** Builds one app's lane seating — the lane seat engine of the family
+ * bound to the app's own data: the resolver, the env reader and the lane
+ * lookup ported verbatim from the app files the wave folded, closed over
+ * the env var name and the lane table the app hands in. the app seat
+ * keeps only its data — the slug, the env var name, the lane table — and
+ * re-exports the bound functions under the names its surface always
+ * spoke, so the engine is never duplicated between apps (the family law:
+ * the owner exports, the apps import).
+ *
+ * @param options the app's own seating data: the slug, the env var name
+ * the deploy pins the seat through and the lane table the lookups read.
+ * @returns the bound seating.
+ */
+export function laneseating(options: { slug: string; envvar: string; lanes: readonly AppWorkloadLane[] }): LaneSeating {
+  const SANDBOXLANEENV = options.envvar;
+  const WORKLOADLANES = options.lanes;
+  function lanesandbox(choice: string | undefined): LaneSeatResult {
+    const name = choice?.trim() ?? "";
+    if (name.length === 0 || name === "local") {
+      return { ok: true, seat: "local", sandboxed: false };
+    }
+    if (name === "join") {
+      return { ok: true, seat: "join", sandboxed: true, pinned: false };
+    }
+    return { ok: true, seat: name, sandboxed: true, pinned: true };
+  }
+  function lanesandboxfromenv(lookup: (key: string) => string | undefined): LaneSeatResult {
+    return lanesandbox(lookup(SANDBOXLANEENV));
+  }
+  function laneof(lane: string): AppWorkloadLane | undefined {
+    return WORKLOADLANES.find((row) => row.lane === lane);
+  }
+  return { APPSLUG: options.slug, SANDBOXLANEENV, WORKLOADLANES, lanesandbox, lanesandboxfromenv, laneof };
+}