@wenathlan/saddle 2.1.6 → 2.1.7

package/Dockerfile

@@ -1,19 +1,28 @@
 # syntax=docker/dockerfile:1
 # saddle v2.0.0 grand merge — THE ONE CONTAINER FILE.
 #
+# build context: this file COPYs from two trees (saddle/ and the
+# engine-ownership sibling vault/), so every build runs from the
+# repository root with an explicit -f: docker build -f saddle/Dockerfile .
+# (add --target saddle-runtime for the node service or --target
+# qemu-runtime for the guest runner). building from inside saddle/
+# breaks the vault COPY - the sibling rides the context beside this
+# directory, never inside it.
+#
 # this Dockerfile carries BOTH container surfaces of the merged repository:
 #   1. the saddle virtual-hardware engine image (the five stages below:
 #      builder, python-bridge, qemu, qemu-runtime, runtime) — the default
 #      build target, published as ghcr.io/wenathlan/saddle:vhe-<version>
-#      across three profiles and four architectures;
+#      across three profiles and eleven architectures;
 #   2. the saddle node-engine image (the saddle-build and saddle-runtime
 #      stages at the end of this file, folded from the former
 #      dockerfile.saddle) — an explicit build target
 #      (`docker build --target saddle-runtime .`), the node 26 storage and
 #      compute service published as ghcr.io/wenathlan/saddle:<version>
-#      across the four-arch family standard (amd64, arm64, ppc64le, s390x
+#      across the eleven-arch family standard (amd64, amd64/v2, arm64,
+#      arm/v7, arm/v6, ppc64le, s390x, riscv64, 386, mips64le, loong64
 #      — the trixie slim base line; the stage also builds the web SPA so
-#      the image serves the self-hosted console via `node /app/web/server.ts`).
+#      the image serves the self-hosted console via `node /app/webserver.ts`).
 #
 # saddle v2 (grand merge) - virtual hardware engine, multi-stage, multi-arch image.
 #
@@ -53,17 +62,22 @@
 #                  build target (docker build / the engine docker run
 #                  recipe below).
 #
-# platforms: linux/amd64, linux/arm64, linux/ppc64le and linux/s390x
-# through buildx --platform (the four-arch registry surface); every
+# platforms: linux/amd64, linux/amd64/v2, linux/arm64, linux/arm/v7,
+# linux/arm/v6, linux/ppc64le, linux/s390x, linux/riscv64, linux/386,
+# linux/mips64le and linux/loong64 through buildx --platform (the
+# eleven-arch registry surface — the complete linux platform list
+# docker/buildx carries, the owner's law: eleven OS architectures for
+# every container of every application); every
 # stage compiles for the portable baseline of its target architecture
-# by default (x86-64 / armv8-a / power8 / z196, resolved from
-# TARGETARCH) so the layers stay valid on every host and every
-# gha-cached runner cpu; pass --build-arg VHE_MARCH=native for
+# by default (x86-64 / i686 / armv8-a / armv7-a / armv6 / power8 / z196 /
+# rv64gc / mips64r2 / loongarch64, resolved from
+# TARGETARCH and TARGETVARIANT) so the layers stay valid on every host
+# and every gha-cached runner cpu; pass --build-arg VHE_MARCH=native for
 # host-tuned local builds, or an explicit -march value when
 # cross-building for a known deployment target.
 #
 # profiles: the three profiles (max, balanced, lite) are all built for
-# all four architectures; each profile carries a distinct virtual CPU
+# all eleven architectures; each profile carries a distinct virtual CPU
 # identity (model name, vcpus, threads, ram) baked into /etc/virtual.
 #
 # the one container file (the gateway 1.1.5 standard): the compose stack
@@ -94,7 +108,7 @@
 #     -v vmdata:/data/vmdata -v webdata:/data/web \
 #     -v ./vm.config.json:/engine/vm.config.json:ro \
 #     -e PORT=8080 -e NODE_ENV=production -p 31280:8080 \
-#     ghcr.io/wenathlan/saddle:vhe-2.1.6
+#     ghcr.io/wenathlan/saddle:vhe-2.0.154
 #
 #   vheqemu (the guest runner; build it first with
 #   docker build --target qemu-runtime -t saddle/qemu:11.1.0 . because the
@@ -128,7 +142,7 @@
 #     -e VHE_GPU_PROFILE=b200 -e VHE_GPUS=8 -e VHE_MIG=1 \
 #     -e VHE_SMI_DRIVER=575.57.08 -e VHE_SMI_CUDA=12.9 \
 #     -e VHE_SMI_INTERVAL=30 -e VHE_SKIP_XVFB=1 -e VHE_SKIP_VALIDATE=1 \
-#     ghcr.io/wenathlan/saddle:vhe-2.1.6 /bin/bash -c '
+#     ghcr.io/wenathlan/saddle:vhe-2.0.154 /bin/bash -c '
 #       while true; do
 #         /usr/local/bin/nvidia-smi "$VHE_GPU_PROFILE" "$VHE_GPUS" || true
 #         sleep "$VHE_SMI_INTERVAL"
@@ -145,7 +159,7 @@
 #     -v qemudata:/data/qemudata \
 #     -v ./qemubridge.py:/engine/qemubridge.py:ro \
 #     -e QMP_SOCKET=/run/vhe/vm.qmp -e PYTHONUNBUFFERED=1 \
-#     ghcr.io/wenathlan/saddle:vhe-2.1.6 \
+#     ghcr.io/wenathlan/saddle:vhe-2.0.154 \
 #     python3 /engine/qemubridge.py --socket /run/vhe/vm.qmp status
 #
 #   saddle-node (the node-engine service, the former compose.yml
@@ -159,7 +173,7 @@
 #     --log-driver json-file --log-opt max-size=50m --log-opt max-file=5 \
 #     --tmpfs /tmp:size=2g,mode=1777 \
 #     -e SADDLE_MEMORY_ENGINE=ram -e SBOT_PLATFORM= -e SBOT_CDN_URL= \
-#     ghcr.io/wenathlan/saddle:2.1.6 \
+#     ghcr.io/wenathlan/saddle:2.0.154 \
 #     node dist/cli.js plan
 #
 #   observability (the former prometheus scraper of the full profile)
@@ -175,7 +189,7 @@
 # ever binds a hardcoded address.
 
 # Base image contract (the gateway family policy): tags only, never a
-# @sha256: digest. A single digest cannot serve the four-architecture
+# @sha256: digest. A single digest cannot serve the eleven-architecture
 # matrix this image ships (the registry resolves the tag per platform),
 # and a digest written here would be a hardcoded hash - the checksums
 # that exist are generated by the GitHub runners and published as
@@ -204,12 +218,15 @@ ARG QEMU_VERSION="11.1.0"
 FROM ${UBUNTU} AS builder
 ARG TARGETPLATFORM
 ARG TARGETARCH
+ARG TARGETVARIANT
 ARG BUILDARCH
 ARG LLVM_VERSION
 ARG NODE_VERSION
 ARG MESA_VERSION
-# empty = portable baseline resolved from TARGETARCH at the compile step
-# (x86-64 / armv8-a); "native" is the opt-in for host-tuned local builds.
+# empty = portable baseline resolved from TARGETARCH (and TARGETVARIANT
+# for the 32-bit arm legs) at the compile step (x86-64 / i686 / armv8-a /
+# armv7-a / armv6 / power8 / z196 / rv64gc / mips64r2 / loongarch64);
+# "native" is the opt-in for host-tuned local builds.
 ARG VHE_MARCH=""
 # NOTE: the VHE_PROFILE_* build-args are deliberately NOT declared in the
 # builder stage. The builder compiles mesa/node/native shims which are
@@ -287,15 +304,18 @@ RUN set -eux; \
 # it off, the build is rust-free.
 
 # node 26.7.0 (current line, v8 14.6, temporal api, NODE_MODULE_VERSION 147).
-# amd64 and arm64 install the pinned nodesource deb; ppc64le (any arch the
-# nodesource apt repo does not carry) falls back to the official nodejs.org
-# binary tarball, extracted straight into /usr so bin/node, include/node and
+# amd64 (with its amd64/v2 variant) and arm64 install the pinned nodesource
+# deb; every architecture the nodesource apt repo does not carry (ppc64le,
+# s390x, riscv64, loong64, mips64le, arm and 386 - the eleven-arch law's
+# non-nodesource legs) falls back to the official nodejs.org binary tarball
+# (mapped to the nodejs.org arch spellings: x64, armv7l, mips64el, x86),
+# extracted straight into /usr so bin/node, include/node and
 # lib/node_modules land exactly where the nodesource package (and the runtime
 # stage COPY --from=builder directives) expect them. the node headers
 # (/usr/include/node) are required by the ADDON build mode of gpumonitor.cpp.
 RUN set -eux; \
     nodesrc_ok="1"; \
-    case "${TARGETARCH}" in ppc64le|s390x|riscv64|loongarch64) nodesrc_ok="0" ;; esac; \
+    case "${TARGETARCH}" in ppc64le|s390x|riscv64|loong64|loongarch64|mips64le|arm|386) nodesrc_ok="0" ;; esac; \
     if [ "$nodesrc_ok" = "1" ]; then \
         # the version-line setup script (setup_26.x) is the nodesource
         # distribution contract: no hardcoded digest in this file. The
@@ -312,7 +332,14 @@ RUN set -eux; \
             "nodejs=${NODE_VERSION}-1nodesource1" \
             || apt-get install -y --no-install-recommends nodejs; \
     else \
-        tarball="node-v${NODE_VERSION}-linux-${TARGETARCH}.tar.xz"; \
+        case "${TARGETARCH}" in \
+            amd64) nodearch="x64" ;; \
+            386|i386) nodearch="x86" ;; \
+            arm) nodearch="armv7l" ;; \
+            mips64le) nodearch="mips64el" ;; \
+            *) nodearch="${TARGETARCH}" ;; \
+        esac; \
+        tarball="node-v${NODE_VERSION}-linux-${nodearch}.tar.xz"; \
         curl -fsSL --retry 5 --retry-all-errors -o "/tmp/${tarball}" \
             "https://nodejs.org/dist/v${NODE_VERSION}/${tarball}"; \
         tar -xJf "/tmp/${tarball}" -C /usr --strip-components=1; \
@@ -323,9 +350,11 @@ RUN set -eux; \
     # (nodesource node 26.7.0 ships npm 11.19.0) and surgically refresh
     # the four nested dependencies whose bundled versions carry the CVEs
     # the trivy release gate rejects (brace-expansion CVE-2026-14257 /
-    # CVE-2026-69152, ip-address CVE-2026-69192 / CVE-2026-54272 /
-    # CVE-2026-69198, tar CVE-2026-73566, undici CVE-2026-16728 /
-    # CVE-2026-16729 / CVE-2026-15157). published npm tarballs freeze
+    # CVE-2026-69152 / CVE-2026-102276 / CVE-2026-102278, ip-address
+    # CVE-2026-69192 / CVE-2026-54272 / CVE-2026-69198, tar
+    # CVE-2026-73566, undici CVE-2026-16728 / CVE-2026-16729 /
+    # CVE-2026-15157 / CVE-2026-109383 / CVE-2026-109869 /
+    # CVE-2026-19534 / CVE-2026-87018). published npm tarballs freeze
     # their bundled node_modules at publish time, so the swap alone
     # still ships brace-expansion 5.0.7; each fixed release is packed
     # separately and extracted over the nested path, then asserted: the
@@ -358,10 +387,10 @@ RUN set -eux; \
         fi; \
         echo "npm tree $fname $fgot"; \
     }; \
-    fixdep brace-expansion 5.0.9; \
+    fixdep brace-expansion 5.0.11; \
     fixdep ip-address 10.3.1; \
     fixdep tar 7.5.21; \
-    fixdep undici 6.28.0; \
+    fixdep undici 6.29.1; \
     rm -rf /root/.npm 2>/dev/null || true
 
 # mesa 26.2.1 from source (the "build" arm of the PPA-or-build policy):
@@ -454,17 +483,25 @@ RUN set -eux; \
 # without one). virtualizationcore.cpp additionally builds its selftest
 # binary and runs it: the stage fails if a single assert trips.
 WORKDIR /src
-COPY virtualhardware.c gpumonitor.cpp virtualizationcore.cpp /src/libs/
+COPY saddle/virtualhardware.c saddle/gpumonitor.cpp saddle/virtualizationcore.cpp /src/libs/
 RUN set -eux; \
     # portable baseline per architecture, with the ARCH FLAG the compiler
     # family actually accepts: x86 and arm speak -march; the ppc64le gcc
     # port rejects '-march=power8' ('did you mean -mcpu=power8?') so that
-    # architecture selects the -mcpu spelling; s390x accepts -march=z196.
+    # architecture selects the -mcpu spelling; s390x accepts -march=z196;
+    # the eleven-arch law's remaining legs resolve their own baselines
+    # (armv7-a / armv6 by TARGETVARIANT, rv64gc, loongarch64, mips64r2,
+    # i686 for the 386 leg).
     archflag="-march"; \
     case "${TARGETARCH}" in \
         arm64|aarch64) march="armv8-a" ;; \
+        arm) if [ "${TARGETVARIANT}" = "v7" ]; then march="armv7-a"; else march="armv6"; fi ;; \
         ppc64le) march="power8"; archflag="-mcpu" ;; \
         s390x) march="z196" ;; \
+        riscv64) march="rv64gc" ;; \
+        loong64|loongarch64) march="loongarch64" ;; \
+        mips64le) march="mips64r2" ;; \
+        386|i386) march="i686" ;; \
         *) march="x86-64" ;; \
     esac; \
     if [ -n "${VHE_MARCH}" ]; then march="${VHE_MARCH}"; archflag="-march"; fi; \
@@ -536,7 +573,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 # (qemu-bridge/cffi wheels) because the bridge talks raw QMP over a unix
 # socket without any native binding. the py_compile run is the syntax gate
 # (error catcher: a bridge that does not compile fails the image build).
-COPY qemubridge.py /bridge/qemubridge.py
+COPY saddle/qemubridge.py /bridge/qemubridge.py
 RUN set -eux; \
     python3 -m py_compile /bridge/qemubridge.py; \
     python3 /bridge/qemubridge.py --help >/dev/null; \
@@ -641,29 +678,46 @@ ENTRYPOINT ["/usr/bin/tini", "--", "qemu-system-x86_64"]
 # ---------------------------------------------------------------------------
 # saddle-build: the node-engine build stage (defined here, before the
 # vhe runtime, so BOTH container surfaces can consume its output: the
-# vhe runtime copies the built web SPA for its /engine/web console and
-# the saddle-runtime stage copies the engine dist plus the same web
-# tree - one build, two consumers). The stage runs native (never under
-# QEMU): its outputs are platform-independent static/js payloads.
+# vhe runtime copies the built web SPA beside the console server at
+# /engine and the saddle-runtime stage copies the engine dist plus the
+# same staged SPA - one build, two consumers). The stage runs native
+# (never under QEMU): its outputs are platform-independent static/js
+# payloads.
 
 # the build stage pins to the native build platform ($BUILDPLATFORM): its
 # outputs (the engine dist, pure js, and the web SPA, static assets) are
 # architecture-independent, while the tailwind/lightningcss pipeline only
 # ships native bindings for the builder platforms - the per-arch legs never
-# run it under QEMU.
-FROM --platform=$BUILDPLATFORM node:26.8.1-slim AS saddle-build
+# run it under QEMU. The base rides the family tag contract (tags only,
+# never a @sha256: digest - a single digest cannot serve the
+# eleven-architecture matrix the registry resolves per platform).
+FROM --platform=$BUILDPLATFORM node:26.13.0-slim AS saddle-build
 
-ARG SADDLE_VERSION
+ARG SADDLE_VERSION=2.0.154
 WORKDIR /app
 
 ENV NPM_CONFIG_LEGACY_PEER_DEPS=true
 
-COPY package.json package-lock.json ./
+COPY saddle/package.json saddle/package-lock.json ./
 RUN npm ci --ignore-scripts --legacy-peer-deps
-COPY . .
+COPY saddle/ .
+# the engine-ownership sibling: the saddle labels resolve
+# ../vault/labelstore.ts (the node-side fork reads the source file raw),
+# so the vault sources ride the context beside the saddle and land at
+# /vault where the import resolves (the family context fix).
+COPY vault/ /vault
 RUN npm run build:engine \
     && node --check dist/cli.js \
-    && npm run web:build:pages
+    && npm run web:build:pages \
+    # the theme build emits the hashed SPA bundles straight at the app
+    # root (the family static-first vite contract): stage them into a
+    # clean folder so the runtime stages copy exactly the console
+    # surface - the shell, the hashed js/css bundles and the icon and
+    # manifest assets the shell references. the extension popup
+    # stylesheet is the one root css that never belongs to the spa.
+    && mkdir -p /out/spa \
+    && cp index.html *.js *.css *.svg *.webmanifest /out/spa/ \
+    && rm -f /out/spa/popup.css
 
 FROM ${UBUNTU} AS runtime
 ARG TARGETARCH
@@ -895,19 +949,30 @@ COPY --from=python-bridge /bridge/qemubridge.py /engine/qemubridge.py
 # the engine sources and the specification files consumed at runtime
 # (docker.config "final" stage copies the whole tree; the flat layout
 # keeps that a single COPY layer).
-COPY *.ts package.json tsconfig.json biome.json jsdom.d.ts /engine/
-COPY processors.json gpus.json cores.json boards.json vm.config.json virtualhardware.json /engine/
-COPY qemu.config mttg.config passage.config docker.config /engine/
+COPY saddle/*.ts saddle/package.json saddle/tsconfig.json saddle/biome.jsonc saddle/jsdomtypes.ts /engine/
+COPY saddle/processors.json saddle/gpus.json saddle/cores.json saddle/boards.json saddle/vm.config.json saddle/virtualhardware.json /engine/
+COPY saddle/qemu.config saddle/mttg.config saddle/passage.config docker.config saddle/mime.types /engine/
+# the engine-ownership sibling: db.ts pulls labels.ts whose
+# ../vault/labelstore.ts import resolves at /vault - the vault source
+# rides the context beside the saddle and lands at /vault where the
+# import resolves (the same family context fix as the saddle-build
+# stage), so the engine webserver below finds the label store.
+COPY vault/labelstore.ts /vault/labelstore.ts
 
 # the web node ships inside the main container: the mesh edition (auth,
 # sqlite database, dashboard and the browser sandbox pages) runs from the
 # same image, so one container serves the engine AND the web surface.
-# run it with: docker run ghcr.io/wenathlan/saddle node /engine/web/server.ts
-COPY web /engine/web
-# the built web SPA (vite, from the saddle-build stage): the console
-# server (node /engine/web/server.ts) serves web/dist/public - the
-# unified React interface that absorbed the former static pages.
-COPY --from=saddle-build /app/web/dist /engine/web/dist
+# run it with: docker run ghcr.io/wenathlan/saddle node /engine/webserver.ts
+# (the console server is a root engine source - the COPY *.ts line above
+# already lands it at /engine together with its console stack, and the
+# extension denylist of its static resolver keeps every .ts/.json/.sql
+# source unreachable).
+# the built web SPA (vite, staged by saddle-build): the theme build emits
+# the hashed bundles straight at the app root, so the staged spa lands
+# beside the console server at /engine and webserver.ts serves it from
+# its own module directory - the unified React interface that absorbed
+# the former static pages.
+COPY --from=saddle-build /out/spa /engine/
 
 RUN set -eux; \
     chmod 0755 /usr/local/bin/nvidia-smi /usr/local/bin/aetherforge; \
@@ -916,8 +981,13 @@ RUN set -eux; \
     mkdir -p /etc/OpenCL/vendors; \
     case "${TARGETARCH}" in \
         arm64|aarch64) ln -sf lvp_icd.aarch64.json /usr/share/vulkan/icd.d/lvp_icd.json ;; \
+        arm) ln -sf lvp_icd.arm.json /usr/share/vulkan/icd.d/lvp_icd.json ;; \
         ppc64le) ln -sf lvp_icd.ppc64le.json /usr/share/vulkan/icd.d/lvp_icd.json ;; \
         s390x) ln -sf lvp_icd.s390x.json /usr/share/vulkan/icd.d/lvp_icd.json ;; \
+        riscv64) ln -sf lvp_icd.riscv64.json /usr/share/vulkan/icd.d/lvp_icd.json ;; \
+        loong64|loongarch64) ln -sf lvp_icd.loongarch64.json /usr/share/vulkan/icd.d/lvp_icd.json ;; \
+        mips64le) ln -sf lvp_icd.mips64.json /usr/share/vulkan/icd.d/lvp_icd.json ;; \
+        386|i386) ln -sf lvp_icd.x86.json /usr/share/vulkan/icd.d/lvp_icd.json ;; \
         *) ln -sf lvp_icd.x86_64.json /usr/share/vulkan/icd.d/lvp_icd.json ;; \
     esac; \
     ldconfig; \
@@ -1271,7 +1341,7 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --start-interval=5s
 # OCI labels for registry introspection.
 LABEL org.opencontainers.image.title="saddle virtual-hardware engine (the grand merge)" \
       org.opencontainers.image.description="100% software virtual hardware: per-profile CPU/memory spoofing via LD_PRELOAD (max/balanced/lite), mesa 26.2.1 llvmpipe/lavapipe/rusticl, QEMU 11.1.0 TCG/MTTCG, virtual nvidia-smi adapter + NVML/CUDA shims, node 26.7.0, python bridge" \
-      org.opencontainers.image.version="2.1.6" \
+      org.opencontainers.image.version="2.0.154" \
       org.opencontainers.image.licenses="MIT" \
       org.opencontainers.image.source="https://github.com/wenathlan/saddle" \
       org.opencontainers.image.documentation="https://github.com/wenathlan/saddle/blob/main/README.md" \
@@ -1302,6 +1372,14 @@ VOLUME /data /cache/mesa_shader_cache
 # pid 1.
 ENTRYPOINT ["/entrypoint.sh"]
 
+# the engine service command: without a CMD the entrypoint exec "$@"
+# fell back to /bin/bash and the engine recipe (host 31280 -> container
+# 8080) bound nothing. the webserver is the console server the COPY
+# above landed at /engine: the default command starts it, and the
+# entrypoint exports PORT (8080 unless -e PORT overrides) before the
+# exec, so the service answers on 8080 out of the box.
+CMD ["node", "/engine/webserver.ts"]
+
 # ══════════════════════════════════════════════════════════════════════
 # saddle node-engine stages — the storage/compute node service of the
 # grand merge (folded verbatim from the former dockerfile.saddle: the
@@ -1310,9 +1388,9 @@ ENTRYPOINT ["/entrypoint.sh"]
 #   docker build --target saddle-runtime -t saddle:<version> .
 # ══════════════════════════════════════════════════════════════════════
 
-FROM node:26.8.1-slim AS saddle-runtime
+FROM node:26.13.0-slim AS saddle-runtime
 
-ARG SADDLE_VERSION
+ARG SADDLE_VERSION=2.0.154
 LABEL org.opencontainers.image.title="Saddle" \
       org.opencontainers.image.description="Storage-backed browser and compute engine (the grand-merge node service)" \
       org.opencontainers.image.source="https://github.com/wenathlan/saddle" \
@@ -1335,17 +1413,23 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/* \
     && npm install --global npm@12.0.2 \
     && tempdir="$(mktemp -d)" \
-    && npm pack brace-expansion@5.0.9 ip-address@10.3.1 tar@7.5.22 --pack-destination "$tempdir" \
-    && mkdir -p /usr/local/lib/node_modules/npm/node_modules/brace-expansion /usr/local/lib/node_modules/npm/node_modules/ip-address /usr/local/lib/node_modules/npm/node_modules/tar \
-    && tar -xzf "$tempdir/brace-expansion-5.0.9.tgz" --strip-components=1 -C /usr/local/lib/node_modules/npm/node_modules/brace-expansion \
+    && npm pack brace-expansion@5.0.11 ip-address@10.3.1 tar@7.5.22 undici@6.29.1 --pack-destination "$tempdir" \
+    && mkdir -p /usr/local/lib/node_modules/npm/node_modules/brace-expansion /usr/local/lib/node_modules/npm/node_modules/ip-address /usr/local/lib/node_modules/npm/node_modules/tar /usr/local/lib/node_modules/npm/node_modules/undici \
+    && tar -xzf "$tempdir/brace-expansion-5.0.11.tgz" --strip-components=1 -C /usr/local/lib/node_modules/npm/node_modules/brace-expansion \
     && tar -xzf "$tempdir/ip-address-10.3.1.tgz" --strip-components=1 -C /usr/local/lib/node_modules/npm/node_modules/ip-address \
     # the npm@12.0.2 tarball freezes its bundled node_modules at publish
     # time (the same lesson as the vhe builder's fixdep): its tar@7.5.19
     # carries CVE-2026-73566 (long-path DoS), fixed in 7.5.21+. The
     # lockfile already resolves app tar to 7.5.22 - the global npm tree
     # gets the same treatment and the version is asserted after install.
+    # The same freeze ships brace-expansion 5.0.9 (CVE-2026-102276 /
+    # CVE-2026-102278, fixed in 5.0.10+) and undici 6.28.0 (CVE-2026-109383
+    # / CVE-2026-109869 / CVE-2026-19534 / CVE-2026-87018, fixed in
+    # 6.29.1+): both carriers ride the swap and the assert proves it.
     && tar -xzf "$tempdir/tar-7.5.22.tgz" --strip-components=1 -C /usr/local/lib/node_modules/npm/node_modules/tar \
+    && tar -xzf "$tempdir/undici-6.29.1.tgz" --strip-components=1 -C /usr/local/lib/node_modules/npm/node_modules/undici \
     && test "$(node -p "require('/usr/local/lib/node_modules/npm/node_modules/tar/package.json').version")" = "7.5.22" \
+    && test "$(node -p "require('/usr/local/lib/node_modules/npm/node_modules/undici/package.json').version")" = "6.29.1" \
     && rm -rf "$tempdir" \
     && npm ci --omit=dev --ignore-scripts --legacy-peer-deps \
     # prune the vendored build toolchains of optional native deps: the
@@ -1357,12 +1441,26 @@ RUN apt-get update \
     && rm -rf node_modules/cpu-features/deps \
     && find node_modules -type f -name Dockerfile -delete
 COPY --from=saddle-build /app/dist ./dist
-# the web service surface (self-hosted console): the built SPA
-# (web/dist/public from the saddle-build vite run) plus the pure-node
-# server stack (server.ts, db.ts, auth.ts, mesh.ts, sandbox.ts,
-# mime.types, init.sql, schema.prisma) - zero npm dependencies, the
-# node 26 runtime carries everything (node:sqlite, node:crypto).
-COPY --from=saddle-build /app/web ./web
+# the web service surface (self-hosted console): the staged spa plus the
+# pure-node server stack - zero npm dependencies, the node 26 runtime
+# carries everything (node:sqlite, node:crypto, native type stripping
+# for the .ts sources). the console set closes the whole import graph:
+# webserver.ts pulls modalityregistry.ts, edgeplane.ts and
+# workloadlaw.ts; edgeplane.ts pulls foundation.ts and the edgelandes
+# family (edgelandes.ts, edgelandeshost.ts, edgelandesinproc.ts,
+# edgelandesvirtual.ts, edgelandesninety.ts); db.ts pulls labels.ts
+# whose ../vault/labelstore.ts import resolves at /vault (the family
+# context fix - the vault source lands beside /app the same way the
+# saddle-build stage lands it). with the graph closed, node
+# webserver.ts starts clean; before the fix the container crashed at
+# boot with module-not-found.
+# run the console with: docker run saddle:<version> node webserver.ts
+COPY --from=saddle-build /app/webserver.ts /app/db.ts /app/labels.ts /app/auth.ts /app/mesh.ts /app/sandbox.ts /app/sandboxprofile.ts /app/sandboxenvprofile.ts /app/sandboxquota.ts /app/modalityregistry.ts /app/edgeplane.ts /app/workloadlaw.ts /app/foundation.ts /app/edgelandes.ts /app/edgelandeshost.ts /app/edgelandesinproc.ts /app/edgelandesvirtual.ts /app/edgelandesninety.ts /app/mime.types /app/init.sql /app/schema.prisma ./
+# the label store of the console stack: labels.ts (pulled by db.ts)
+# resolves ../vault/labelstore.ts at /vault - the same family context
+# fix the saddle-build stage applies.
+COPY --from=saddle-build /vault/labelstore.ts /vault/labelstore.ts
+COPY --from=saddle-build /out/spa ./
 
 USER node