@wenathlan/saddle 2.0.167 → 2.0.170

package/Dockerfile

@@ -1,4 +1,4 @@
-# saddle 2.0.167 — THE ENGINE CONTAINER FILE
+# saddle 2.0.170 — THE ENGINE CONTAINER FILE
 #
 # THE FAMILY CONTAINER DOCTRINE, THE SADDLE SHAPE: one versioned container
 # per engine, built like the site homes (argan, cadria) build theirs — a
@@ -158,7 +158,7 @@ ARG NODE_BASE_DIGEST=5adad64f9a1fca2d51972caa65983634c8a774eb300d72b20f7f2a0f603
 # ===== stage: solbuild — the locked npm tree and the console spa =====
 FROM --platform=$BUILDPLATFORM ${NODE_BASE_TAG}@sha256:${NODE_BASE_DIGEST} AS solbuild
 
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 
 WORKDIR /app
 
@@ -172,6 +172,12 @@ COPY saddle/ .
 # so the vault sources ride the context beside the saddle and land at
 # /vault where the import resolves (the family context fix).
 COPY vault/ /vault
+# the routerbase sibling of the family law: saddle/routerbase.ts
+# re-exports the family routerBase from ../devthink/routerbase.ts, so
+# the devthink sources land at /devthink where the sol build resolves
+# the re-export (sources only - the same never-installed law the vault
+# sibling above rides, the family context fix the lanes carry).
+COPY devthink/ /devthink
 RUN npm run web:build:pages \
     # the theme build emits the hashed SPA bundles straight at the app
     # root (the family static-first vite contract): stage them into a
@@ -186,7 +192,7 @@ RUN npm run web:build:pages \
 # ===== stage: base — the hardened runtime floor every profile shares =====
 FROM ${NODE_BASE_TAG}@sha256:${NODE_BASE_DIGEST} AS base
 
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 # the revision stamp the devthink container carries (DEVTHINK_REVISION
 # there): the publish legs pass the release sha at build time and the
 # revision label below declares the default-unknown local shape.
@@ -255,6 +261,20 @@ RUN case "${TARGETARCH:-}" in \
     esac
 
 COPY --from=solbuild /app/package.json /app/package-lock.json ./
+# the both-blocks grammar heal (the saddle container law): the family
+# manifest carries the same seats inside dependencies and
+# devDependencies, and every npm tested (11.19.1 and 12.0.2) answers
+# that duplicate seat by planting dev:true over the whole lock tree -
+# so a plain `npm ci --omit=dev` installs nothing and the runtime stage
+# dies at the cleanup walk with no node_modules to sweep. The derived
+# prod-only manifest (the dependencies block alone, byte-identical
+# specs) restores the honest production install: the lock the
+# foundry/lockprod.ts heal stamped walks beside it and the --omit=dev
+# lane lands the full production closure (the 1372-package install the
+# local verification measured). Nothing is removed - the dev seats stay
+# in the lock for the full-install lanes, only the runtime's own view
+# of the manifest narrows.
+RUN node -e "const fs=require('node:fs');const m=JSON.parse(fs.readFileSync('package.json','utf8'));delete m.devDependencies;fs.writeFileSync('package.json',JSON.stringify(m,null,2)+'\n')"
 RUN apt-get update \
     && apt-get upgrade -y \
     && rm -rf /var/lib/apt/lists/* \
@@ -489,7 +509,7 @@ LABEL org.opencontainers.image.title="saddle (the android os-distribution lane)"
 #   docker build --target osv          -t saddle:2.0.165-v .
 #   docker build --target oswindows    -t saddle:2.0.165-windows .
 FROM scratch AS osgrapheneos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="grapheneos"
 ENV SADDLE_OS_PROFILE=grapheneos
 LABEL org.opencontainers.image.title="saddle (the grapheneos os-distribution catalog lane)" \
@@ -500,7 +520,7 @@ LABEL org.opencontainers.image.title="saddle (the grapheneos os-distribution cat
 COPY osprofiles/grapheneos.json /saddle/osprofile.json
 
 FROM scratch AS osmaruos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="maruos"
 ENV SADDLE_OS_PROFILE=maruos
 LABEL org.opencontainers.image.title="saddle (the maru os os-distribution catalog lane)" \
@@ -511,7 +531,7 @@ LABEL org.opencontainers.image.title="saddle (the maru os os-distribution catalo
 COPY osprofiles/maruos.json /saddle/osprofile.json
 
 FROM scratch AS osv
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="v"
 ENV SADDLE_OS_PROFILE=v
 LABEL org.opencontainers.image.title="saddle (the v os-distribution catalog lane)" \
@@ -522,7 +542,7 @@ LABEL org.opencontainers.image.title="saddle (the v os-distribution catalog lane
 COPY osprofiles/v.json /saddle/osprofile.json
 
 FROM scratch AS oswindows
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="windows"
 ENV SADDLE_OS_PROFILE=windows
 LABEL org.opencontainers.image.title="saddle (the windows os-distribution catalog lane)" \
@@ -533,7 +553,7 @@ LABEL org.opencontainers.image.title="saddle (the windows os-distribution catalo
 COPY osprofiles/windows.json /saddle/osprofile.json
 
 FROM scratch AS ospostmarketos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="postmarketos"
 ENV SADDLE_OS_PROFILE=postmarketos
 LABEL org.opencontainers.image.title="saddle (the postmarketos os-distribution catalog lane)" \
@@ -544,7 +564,7 @@ LABEL org.opencontainers.image.title="saddle (the postmarketos os-distribution c
 COPY osprofiles/postmarketos.json /saddle/osprofile.json
 
 FROM scratch AS oslineageos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="lineageos"
 ENV SADDLE_OS_PROFILE=lineageos
 LABEL org.opencontainers.image.title="saddle (the lineageos os-distribution catalog lane)" \
@@ -555,7 +575,7 @@ LABEL org.opencontainers.image.title="saddle (the lineageos os-distribution cata
 COPY osprofiles/lineageos.json /saddle/osprofile.json
 
 FROM scratch AS oscalyxos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="calyxos"
 ENV SADDLE_OS_PROFILE=calyxos
 LABEL org.opencontainers.image.title="saddle (the calyxos os-distribution catalog lane)" \
@@ -566,7 +586,7 @@ LABEL org.opencontainers.image.title="saddle (the calyxos os-distribution catalo
 COPY osprofiles/calyxos.json /saddle/osprofile.json
 
 FROM scratch AS osarchlinux
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="archlinux"
 ENV SADDLE_OS_PROFILE=archlinux
 LABEL org.opencontainers.image.title="saddle (the archlinux os-distribution catalog lane)" \
@@ -577,7 +597,7 @@ LABEL org.opencontainers.image.title="saddle (the archlinux os-distribution cata
 COPY osprofiles/archlinux.json /saddle/osprofile.json
 
 FROM scratch AS osalpine
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="alpine"
 ENV SADDLE_OS_PROFILE=alpine
 LABEL org.opencontainers.image.title="saddle (the alpine os-distribution catalog lane)" \
@@ -588,7 +608,7 @@ LABEL org.opencontainers.image.title="saddle (the alpine os-distribution catalog
 COPY osprofiles/alpine.json /saddle/osprofile.json
 
 FROM scratch AS osdebian
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="debian"
 ENV SADDLE_OS_PROFILE=debian
 LABEL org.opencontainers.image.title="saddle (the debian os-distribution catalog lane)" \
@@ -599,7 +619,7 @@ LABEL org.opencontainers.image.title="saddle (the debian os-distribution catalog
 COPY osprofiles/debian.json /saddle/osprofile.json
 
 FROM scratch AS osfedora
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="fedora"
 ENV SADDLE_OS_PROFILE=fedora
 LABEL org.opencontainers.image.title="saddle (the fedora os-distribution catalog lane)" \
@@ -610,7 +630,7 @@ LABEL org.opencontainers.image.title="saddle (the fedora os-distribution catalog
 COPY osprofiles/fedora.json /saddle/osprofile.json
 
 FROM scratch AS osnixos
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="nixos"
 ENV SADDLE_OS_PROFILE=nixos
 LABEL org.opencontainers.image.title="saddle (the nixos os-distribution catalog lane)" \
@@ -621,7 +641,7 @@ LABEL org.opencontainers.image.title="saddle (the nixos os-distribution catalog
 COPY osprofiles/nixos.json /saddle/osprofile.json
 
 FROM scratch AS osvoid
-ARG SADDLE_VERSION=2.0.167
+ARG SADDLE_VERSION=2.0.170
 ARG SADDLE_OS_PROFILE="void"
 ENV SADDLE_OS_PROFILE=void
 LABEL org.opencontainers.image.title="saddle (the void os-distribution catalog lane)" \

package/README.md

@@ -31,7 +31,7 @@ domain modules land beside the saddle domains:
 | `media.ts`, `render.ts`, `quantum.ts`, `tiers.ts` | media pipeline, GPU registry, quantum simulation, tier policy |
 | `security.ts`, `alternatives.ts` | hardening gates and the alternative-stack catalog |
 | `index.html`, `App.tsx`, `sol/` | the single SPA shell and the Sol theme (one tsx app with one stylesheet per theme) |
-| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.167 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
+| `server.ts`, `sandbox.ts` | the zero-dependency self-hosted API of the 2.0.170 grand-merge envelope (`node server.ts`; the api answers its version at `/api/v1/health`) and the browser-pure engine port |
 | `vercel.json`, `netlify.toml` | the platform deploy adapters beside the surface they publish (the caddy ghost stays out of the tree) |
 | `specs/*` package exports | processors, gpus, cores, boards and the qemu/mttg/passage/docker envelopes |
 

package/docker.config

@@ -2,7 +2,7 @@
   "meta": {
     "name": "docker.config",
     "title": "saddle - Docker Engine and Containerization Configuration",
-    "version": "2.0.167",
+    "version": "2.0.170",
     "date": "2026-11-06",
     "language": "en",
     "sources": [

package/docs/architecture.md

@@ -121,9 +121,9 @@ The remaining categories of the old file were already domain-owned: kernel featu
 
 ## 3b. Test patterns
 
-Tests live in the `test/` directory (one of the five allowed directories) and run with the Node built-in runner: `node --test 'test/*.test.ts'` (153 tests across eleven files - engine, features, media, render, simulation, specs, virtualcpu, virtualgpu, virtualmemory, web, workflow - all passing on Node 24 and 26), the same runner the ci.yml smoke gate executes on Node 26.7.0. Patterns:
+Tests live in the `test/` directory (one of the five allowed directories) and run on vitest: `vitest run` reads `test/*.test.ts` (153 tests across eleven files - engine, features, media, render, simulation, specs, virtualcpu, virtualgpu, virtualmemory, web, workflow), the same runner the ci.yml family suite executes through the app's `npm test`. Patterns:
 
-- `node:test` (`describe`/`it` or top-level `test`) plus `node:assert/strict`; no Jest, no third-party harness, no install step (the engine has zero runtime dependencies).
+- vitest (`describe`/`it`) plus `node:assert/strict`; no Jest, no node:test (vitest is the only CI runner), no install step beyond the dev tooling (the engine has zero runtime dependencies).
 - One test file per area under test (planner and lint rules, cpuinfo/meminfo generators, MIG density validator, QEMU argv builder); assertions target public exports, never module internals.
 - Doc-tests remain `@example` blocks in JSDoc (the planner asserts in `index.ts`), and every test stays deterministic: ports use the 30000-59999 random band or explicit ephemeral allocation, no network, no timing-dependent assertions.
 
@@ -266,7 +266,7 @@ Supporting subsystems: warm pool (prewarm/acquire/release/refill/drain, MAP_PRIV
 | TypeScript | 7.0.2 (Go-native port); `strict`, `verbatimModuleSyntax`, `isolatedModules`, `erasableSyntaxOnly`, `exactOptionalPropertyTypes`, `noUncheckedIndexedAccess`; ES2025 target with `lib ES2025+ESNext.Disposable` |
 | Erasable modern syntax | `using`/`await using` (modellease, MetricsStore, sandboxhandle), `satisfies` (`engineversions as const satisfies Record<string,string>`), const type parameters (`validateSpec<const T>`), `#private` fields and accessors, `import.meta.filename` for CLI detection |
 | ESM | `"type": "module"`; relative imports carry the `.ts` extension; no CommonJS `require` |
-| Tests | `node:test` + `node:assert/strict` executed with `node --test 'test/*.test.ts'`; the dedicated `test/` directory holds eleven test files (148 cases: 86 planner/generator originals, 24 workflow/simulation gates, 18 feature-audit builders, 4 media pipeline, 1 snapshot regression, 9 web edition), ci.yml runs them on Node 26.7.0; no Jest; doc-tests as `@example` blocks (the planner asserts live in `index.ts` planner docs) |
+| Tests | vitest + `node:assert/strict` executed with `vitest run` over `test/*.test.ts`; the dedicated `test/` directory holds eleven test files (148 cases: 86 planner/generator originals, 24 workflow/simulation gates, 18 feature-audit builders, 4 media pipeline, 1 snapshot regression, 9 web edition), ci.yml runs them through the app's `npm test`; no Jest; no node:test; doc-tests as `@example` blocks (the planner asserts live in `index.ts` planner docs) |
 | C++26 | `import std;` permitted, `std::expected` as the error channel, `std::mdspan` with the p2662r3 fallback guard, `std::print`/`std::format`, `enum class`, `[[nodiscard]]` on validate/argv/topology, RAII for every fd/socket (no exceptions in happy paths) |
 | C | C11 with `_GNU_SOURCE`, `dlsym(RTLD_NEXT)` resolution, xorshift32 deterministic drift, constructor priority 101 |
 | Python | 3.14 floor; stdlib only (socket, json, logging); try/except logging on every operation |
@@ -318,7 +318,7 @@ The old pins survive only inside `legacyCatalog` provenance blocks in `virtualha
 
 ## 15. CI graph (summary)
 
-Five workflows gate the tree: ci.yml (lint, typecheck matrix Node 24/26, the node:test suite in `test/`, build, flat-structure md5 guard, JSON schema validation of the ten data files), publishghcr.yml (the combined container pipeline: per-arch validation legs on push - clinfo/vulkaninfo/glxinfo probes inside the image - and the four-arch GHCR publication with provenance+SBOM on release), release.yml (GHCR + npm provenance + level-9 zip with SHA-256), pages.yml (the merged web pipeline: module syntax gate, boot smoke on port 37810, html lint, the webapi auth/mesh suite with a throwaway `E2UGH_DB`, the zip -9 static bundle and the GitHub Pages deployment of the web tree) and security.yml (CodeQL C/C++/TS, dependency review, Dockle/Trivy SARIF, gitleaks, Scorecard, Biome security group, license allowlist). Full descriptions and pins are in `readme.md`; the workflows themselves are the executable contract.
+Five workflows gate the tree: ci.yml (lint, typecheck matrix Node 24/26, the vitest suite in `test/`, build, flat-structure md5 guard, JSON schema validation of the ten data files), publishghcr.yml (the combined container pipeline: per-arch validation legs on push - clinfo/vulkaninfo/glxinfo probes inside the image - and the four-arch GHCR publication with provenance+SBOM on release), release.yml (GHCR + npm provenance + level-9 zip with SHA-256), pages.yml (the merged web pipeline: module syntax gate, boot smoke on port 37810, html lint, the webapi auth/mesh suite with a throwaway `E2UGH_DB`, the zip -9 static bundle and the GitHub Pages deployment of the web tree) and security.yml (CodeQL C/C++/TS, dependency review, Dockle/Trivy SARIF, gitleaks, Scorecard, Biome security group, license allowlist). Full descriptions and pins are in `readme.md`; the workflows themselves are the executable contract.
 
 ## 16. Compliance checklist
 

package/docs/e2ughengine.md

@@ -220,7 +220,7 @@ The CI pipeline enforces the flat contract: one concern per file with 20-25 rela
 | 42 | `docs/viability.md` | the proof, research methodology, 145-entry bibliography and roadmap appendices A-C |
 | 43 | `docs/alternatives.md` | ten alternative sandbox families compared against the engine |
 | 43b | `docs/optimization.md` | the build-pipeline optimization roadmap (cross-compilation, prebuilt QEMU/Mesa layers, runner strategy) for the slow multi-arch grid |
-| 44 | `test/` | node:test suite executed by ci.yml with `node --test` (153 cases, including CI-gate replay and end-to-end simulation suites) |
+| 44 | `test/` | vitest suite executed by ci.yml (`npm test`, `vitest run` over `test/*.test.ts`; 153 cases, including CI-gate replay and end-to-end simulation suites) |
 | 45 | `web/` | the web node (v7): `index.html` terminal sandbox, `login.html`/`register.html`/`dashboard.html` auth pages, `sandbox.js` browser-pure engine port (20 commands), `localauth.js` static-edge browser accounts (login/register/dashboard keep working on github pages with no api; accounts are mirrored to IndexedDB so partial clears never lose them, the dashboard carries backup/restore keyfile buttons, and the CODEOWNERS admins iakadion + akadion are seeded automatically with the shared bootstrap password - surviving any storage reset), `server.js` self-hosted node:http API (`/api/v1` sandboxes and exec), `db.js` sqlite persistence layer, `auth.js` scrypt password hashing with cookie sessions, `mesh.js` HMAC-signed node-to-node calls, `package.json`/`Dockerfile` (image `ghcr.io/wenathlan/e2ugh`; node pinned by the root `.nvmrc`), `schema.prisma`/`init.sql` database definition kept flat per the two-level contract, `mime.types`, `vercel.json`/`netlify.toml` static deploy without functions, `caddyfile` self-host proxy for devthink.pro, `readme.md` web docs |
 | 46 | `LICENSE` | full MIT text (Copyright (c) 2026 wenathlan) |
 
@@ -327,7 +327,7 @@ docker run --rm -p 37810:37810 -e E2UGH_DB=/data/e2ugh.db -v e2ughdata:/data \
 
 Five workflows gate the repository, all pinned to action releases verified on 2026-08-22:
 
-- **ci.yml** (every push and pull request) - six gates: Biome 2.5.11 lint and format; `tsc --noEmit` with TypeScript 7.0.2 on a Node 24/26 matrix; the Node built-in test runner over the dedicated `test/` suite (153 node:test cases); a build gate; the flat-structure contract (flat tree, no deep nesting, no duplicated content via md5); strict JSON schema validation of every tracked data file.
+- **ci.yml** (every push and pull request) - six gates: Biome 2.5.11 lint and format; `tsc --noEmit` with TypeScript 7.0.2 on a Node 24/26 matrix; the vitest runner over the dedicated `test/` suite (153 test cases); a build gate; the flat-structure contract (flat tree, no deep nesting, no duplicated content via md5); strict JSON schema validation of every tracked data file.
 - **hardware variants** (publishghcr.yml matrix) - one dockerfile, three curated profiles baked at build time so operators pull exactly the flavor they need: `ghcr.io/wenathlan/e2ugh:latest` (max: EPYC 9965 192c/384t, 1 TiB plan, 8x B200), `:balanced` (Threadripper PRO 9995WX 96c/192t, 512 GiB, 2x B200) and `:lite` (Ryzen 9 9950X3D 16c/32t, 128 GiB, 1x RTX 5090); every profile tag also carries semver and sha suffixes, and the runtime overlay (`VHE_TOTALRAM_GB`, `VHE_CPUS`, `VHE_GPU_PROFILE` environment variables) still lets any variant report any catalog identity up to 18 TiB at run time - the baked profile is the default identity, never a ceiling.
 - **publishghcr.yml** (the combined container pipeline; main, tags and releases) - per-architecture validation legs (`linux/amd64` native; `linux/arm64`, `linux/ppc64le` and `linux/s390x` under QEMU user emulation) that validate the live stack inside the built image: `clinfo` must report Rusticl OpenCL 3.1 on llvmpipe, `vulkaninfo --summary` must find lavapipe Vulkan 1.4, and Xvfb + `glxinfo` must report llvmpipe OpenGL 4.6, executed with `--memory-swap=-1 --shm-size=2g`. On releases, production builds push per-arch images by digest (the max profile ships the four-arch registry surface: amd64, arm64, ppc64le, s390x) with provenance `mode=max` and SBOM attestations before `docker buildx imagetools` assembles the per-profile manifest indexes.
 - **release.yml** (version tags and releases) - three publications: the multi-arch GHCR image, the npm package with `--provenance --access public` (zero runtime dependencies), and a maximum-compression (level 9) source zip with SHA-256 checksums.
@@ -384,7 +384,7 @@ The test contract is the Node built-in runner: no Jest, no third-party harness,
 # from a checkout (Node 24+)
 npm run typecheck                 # tsc --noEmit, the TypeScript 7.0.2 gate
 npm run lint                      # Biome 2.5.11
-node --test 'test/*.test.ts'      # the node:test suite (153 tests) - the glob form ci.yml uses
+npm test                          # the vitest suite (153 tests) - vitest run over test/*.test.ts, the form ci.yml uses
 
 # from the published image (GHCR, linux/amd64 and linux/arm64)
 docker run --rm --memory-swap=-1 --shm-size=2g \
@@ -424,7 +424,7 @@ The `test/` suite (Node 26.7.0 in CI, Node 24+ locally, `node:assert/strict`, 15
 | SADDLE v5 / v6 (Meta TS) | 2026-08-22 wave | `src_core_orchestrator.ts` (2080 lines) and `coreorchestrator.ts` (1283 lines): RBAC, NUMA scheduler, balloon, SR-IOV, passage protocols, quotas, preemption, leader election, OTel exporter; plus `pipelinememorypassage.ts` host-aware memory planning | Unique subsystems absorbed into `orchestrator.ts` (5238 lines) and `virtualmemory.ts`; duplicated buses/state machines/metrics collapsed into one of each |
 | Virtual Hardware Engine v5 (e2ugh) | 2026-08-22, English | The 44-file public repo generation: 9 TS modules, 11 JSONs, 4 workflows, 10 English docs with ~120 cited sources | Baseline of the v2 code tree; modules renamed and extended (hardware -> virtualcpu, memory -> virtualmemory) |
 | e2ugh v2 | 2026-08-22+ | The merge: 57 CPUs, 19 GPUs + APUs, one event bus (51 typed topics), one 15-state lifecycle, one metrics store | Baseline of the v3 redistribution |
-| e2ugh v3-v9 (this repo) | 2026-08-23+ | The rebrand and redistribution: github.com/wenathlan/e2ugh, package 1.2.1, `future.ts` decomposed into `scheduler.ts` and `compute.ts` (checkpoint plans into `virtualization.ts`, post-quantum into `security.ts`), a `test/` node:test suite, and the corrected version ledger (kernel 7.1.9/6.18.45, edk2-stable202605, wgpu 30.x, Spin 3.6.0, containerd 2.3.4, WireGuard via kernel mainline) | Current |
+| e2ugh v3-v9 (this repo) | 2026-08-23+ | The rebrand and redistribution: github.com/wenathlan/e2ugh, package 1.2.1, `future.ts` decomposed into `scheduler.ts` and `compute.ts` (checkpoint plans into `virtualization.ts`, post-quantum into `security.ts`), a `test/` vitest suite, and the corrected version ledger (kernel 7.1.9/6.18.45, edk2-stable202605, wgpu 30.x, Spin 3.6.0, containerd 2.3.4, WireGuard via kernel mainline) | Current |
 
 Full per-generation detail, including the verification reports for each wave, is preserved in `docs/viability.md`.
 

package/modalities.ts

@@ -2492,7 +2492,7 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     slug: "runnerdeno",
     lane: "runner",
     isolation: "process",
-    state: "planned",
+    state: "live",
     drivers: ["deno"],
     hardening: ["permission-map"],
     boot: "hot",
@@ -2508,10 +2508,18 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       num: 19,
       lane: "runner",
       binary: "deno",
-      // the payload rides the staged program file — the read permission maps
-      // the sandbox alone, the stdin dash never rides (no pipe is written).
+      // the real deno runner: the payload rides the staged program file —
+      // the read permission maps the sandbox alone, the module cache rides
+      // the sandbox tree (DENO_DIR never touches the host home — the same
+      // seat the edge lane carries), the stdin dash never rides (no pipe
+      // is written). the runtime detection rides the spawner's own absence
+      // grammar — the same probehostbinary seat the edge lane table
+      // carries — and a host without the deno binary answers the honest
+      // coded absence, never a faked run (the seat never fakes a runtime).
       argv: ({ file }) => ["deno", "run", "--allow-read=/sandbox", file],
+      env: { DENO_DIR: "/sandbox/denodir" },
       hardening: ["permission-map"],
+      probe: "the host must carry the deno runtime (the runner-deno seat the owner's law 268 charges)",
     }),
   },
   {
@@ -4191,7 +4199,7 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     slug: "storagesqlite",
     lane: "sandbox",
     isolation: "process",
-    state: "planned",
+    state: "live",
     drivers: ["sqlite"],
     hardening: ["file-quota"],
     boot: "hot",
@@ -4207,27 +4215,60 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       num: 72,
       lane: "sandbox",
       operate: async (request) => {
+        // the real vault roundtrip: the node:sqlite runtime the engine host
+        // carries — without it the seat answers the honest coded absence, and
+        // with it one full roundtrip (create, insert, select, drop) on a
+        // private in-memory table, the readback compared against the payload
+        // character for character (the seat never fakes a database and never
+        // opens a file — the store rides :memory: alone, the caller values
+        // ride parameterized statements, only the seat's own generated table
+        // name rides the statement text).
+        let sqlite: typeof import("node:sqlite");
         try {
-          const sqlite = (await import("node:sqlite")) as typeof import("node:sqlite");
-          const database = new sqlite.DatabaseSync(":memory:");
-          try {
-            database.exec("CREATE TABLE sandbox_artifacts (id INTEGER PRIMARY KEY, payload TEXT)");
-            const statement = database.prepare("INSERT INTO sandbox_artifacts (payload) VALUES (?)");
-            statement.run(request.code.slice(0, 1024));
-            const rows = database.prepare("SELECT id, payload FROM sandbox_artifacts").all();
-            return {
-              stdout: `sqlite vault: ${rows.length} row(s) answered by the in-memory store (node:sqlite, :memory:)`,
-              artifact: { rows: rows.length, engine: "node:sqlite" },
-            };
-          } finally {
-            database.close();
-          }
+          sqlite = (await import("node:sqlite")) as typeof import("node:sqlite");
         } catch (error) {
           throw Object.assign(
             new Error(`the sqlite runtime is absent from this host: ${error instanceof Error ? error.message : String(error)}`),
             { code: "HOST_RUNTIME_ABSENT" },
           );
         }
+        const table = `saddle_sqlite_${Date.now().toString(36)}${Math.floor(Math.random() * 1679616).toString(36)}`;
+        const payload = request.code;
+        let readback = "";
+        const database = new sqlite.DatabaseSync(":memory:");
+        try {
+          database.exec(`CREATE TABLE ${table} (k TEXT PRIMARY KEY, v TEXT)`);
+          database.prepare(`INSERT INTO ${table} (k, v) VALUES (?, ?)`).run("saddle-payload", payload);
+          readback = String(
+            (database.prepare(`SELECT v FROM ${table} WHERE k = ?`).get("saddle-payload") as { v?: unknown } | undefined)?.v ?? "",
+          );
+        } catch (error) {
+          throw Object.assign(
+            new Error(`the sqlite vault refused the roundtrip: ${error instanceof Error ? error.message : String(error)}`),
+            { code: "SQLITE_ROUNDTRIP_FAILED" },
+          );
+        } finally {
+          try {
+            database.exec(`DROP TABLE IF EXISTS ${table}`);
+          } catch {
+            /* the roundtrip already answered; the drop is best effort */
+          }
+          try {
+            database.close();
+          } catch {
+            /* the close is best effort */
+          }
+        }
+        if (readback !== payload) {
+          throw Object.assign(
+            new Error(`the sqlite roundtrip answered ${readback.length} characters for ${payload.length} written`),
+            { code: "SQLITE_ROUNDTRIP_FAILED" },
+          );
+        }
+        return {
+          stdout: `sqlite vault: ${payload.length} characters roundtripped through the node:sqlite in-memory store`,
+          artifact: { rows: 1, engine: "node:sqlite", roundtrip: true, store: ":memory:" },
+        };
       },
     }),
   },
@@ -4427,7 +4468,7 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
     slug: "networkdns",
     lane: "sandbox",
     isolation: "process",
-    state: "planned",
+    state: "live",
     drivers: ["dns"],
     hardening: ["resolver-allowlist"],
     boot: "hot",
@@ -4443,11 +4484,47 @@ export const MODALITYENGINE: readonly ModalitySpec[] = [
       num: 77,
       lane: "sandbox",
       operate: async (request) => {
+        // the real resolution roundtrip: the node:dns resolver the engine
+        // host carries — one lookup of the pinned well-known name
+        // ("localhost", the name every host resolver answers; the caller
+        // may name another, the roundtrip rides the same resolver call)
+        // with the answered records verified as the honest result (the
+        // non-empty answer, the address, the address family). the seat
+        // never fakes a response and never opens a socket beyond the
+        // resolver call — a host without a working resolver path answers
+        // the honest coded refusal, never a canned answer (the wire
+        // question the builddnsquery builder frames rides the artifact
+        // beside the records the resolver actually answered — the same
+        // grammar the sqlite vault roundtrip carries).
+        const dns = await import("node:dns");
         const inputs = (request.inputs ?? {}) as { domain?: string; qtype?: string };
-        const packet = builddnsquery(inputs.domain ?? "devthink.dev", inputs.qtype ?? "a");
+        const domain = inputs.domain ?? "localhost";
+        const qtype = (inputs.qtype ?? "a").toLowerCase();
+        const packet = builddnsquery(domain, qtype);
+        const family = qtype === "a" ? 4 : qtype === "aaaa" ? 6 : 0;
+        let records: import("node:dns").LookupAddress[];
+        try {
+          records = await dns.promises.lookup(domain, { all: true, family });
+        } catch (error) {
+          throw Object.assign(
+            new Error(
+              `the host resolver refused the ${qtype} roundtrip for ${domain}: ${error instanceof Error ? error.message : String(error)}`,
+            ),
+            { code: "DNS_RESOLUTION_REFUSED" },
+          );
+        }
+        if (
+          records.length === 0 ||
+          records.some((record) => record.address.length === 0 || (record.family !== 4 && record.family !== 6))
+        ) {
+          throw Object.assign(
+            new Error(`the dns roundtrip answered ${records.length} records for ${domain} — the honest result never rides a malformed answer`),
+            { code: "DNS_ROUNDTRIP_FAILED" },
+          );
+        }
         return {
-          stdout: `dns: the ${inputs.qtype ?? "a"} query for ${inputs.domain ?? "devthink.dev"} answered as a ${packet.length / 2}-byte wire packet`,
-          artifact: { packet, domain: inputs.domain ?? "devthink.dev", qtype: inputs.qtype ?? "a" },
+          stdout: `dns resolver: ${domain} resolved ${records.length} records through the node:dns host resolver (the ${qtype} question, the honest roundtrip)`,
+          artifact: { packet, domain, qtype, records, resolved: true, resolver: "node:dns" },
         };
       },
     }),