arcane-os 0.1.0-dev.5 → 0.1.0

package/docs/publishing.md

@@ -1,42 +1,34 @@
-# Development publication
-
-## Current branch stage
-
-Until the first official SDK release, `main` is the single canonical working,
-integration, publication, and documentation branch. Pull requests and pushes
-target `main`, and the complete Node/platform matrix runs there. Do not use a
-separate development branch during this prerelease stage.
-
-After the first official release, ordinary work will move to a long-lived
-`dev` branch while `main` remains the canonical released line. That transition
-must be made as one explicit release change that updates branch protections,
-checks, trusted publication rules, documentation channels, and contributor
-instructions together. The future branch name alone grants no authority.
-
-## Development npm publication
-
-The current development npm version is `0.1.0-dev.5` and `publishConfig.tag` is
-`dev`, so a development publication does not become the default `latest`
-release. Query `npm view arcane-os@dev version` for current registry
-availability; immutable package documentation does not assert mutable registry
-state. npm is the canonical SDK distribution: application repositories add an
-exact `arcane-os` project dependency and invoke its local CLI with
-`npm exec -- arcane`. A separate global installer, standalone SDK executable,
-NuGet package, Homebrew formula, or OS package is not part of this release
-surface. Vanilla Test's C# and Rust lifecycles do not turn this JavaScript SDK
-into a .NET or Rust package.
-
-`Check` first runs the development suite, then one unprivileged producer packs
-one `.tgz` under pinned Node and npm versions. The producer writes a canonical
+# npm publication
+
+## Canonical main and npm channels
+
+`main` is the single canonical working and publication branch before and after
+the first release. Do not create a development branch. `-dev` versions select
+the npm `dev` dist-tag, while bare numeric stable versions select
+`latest`. These are registry channels, not Git branches.
+
+## Stable and development npm publication
+
+The package version and `publishConfig.tag` must agree exactly: `-dev` uses
+`dev`, and a bare numeric stable version uses `latest`. npm is the canonical
+SDK distribution: application repositories add an exact `arcane-os` project
+dependency and invoke its local CLI with `npm exec -- arcane`. A separate
+global installer, standalone SDK executable, NuGet package, Homebrew formula,
+or OS package is not part of this release surface.
+
+`Check` validates the source once, then one unprivileged producer packs one
+`.tgz` under pinned Node and npm versions. The producer writes a canonical
 manifest containing the source SHA, clean-checkout flag, package inventory,
 byte length, SHA-256, npm SHA-1 shasum, and SHA-512 integrity. Windows x64,
 Linux x64, and a real macOS arm64 runner use the declared Node `22.23.2` floor
 and each download that same Actions
 artifact by immutable artifact id. They never repack it. Each runner verifies
 the receipt, installs the tarball into a disposable project, exercises
-`npm exec --offline -- arcane`, and runs a test imported from
-`arcane-os/testing` through the installed package's `arcane-test.mjs`. A final
-readiness job fails unless the producer and the complete native matrix pass.
+`npm exec --offline -- arcane`, and runs one small capability contract through
+the installed package's `arcane-test.mjs`. A final readiness job verifies the
+same artifact's identity, integrity, shasum, license inventory, and content
+boundary once. Browser/process simulations, Pages, Examples, and presentation
+work are post-registry follow-through rather than npm publication gates.
 
 `publish-dev.yml` can run only when manually dispatched from `main` in
 `TheWizardNexus/arcane-os-sdk`. Dispatch requires an authorized npm content
@@ -49,14 +41,19 @@ promotion. Direct trusted publishing is not permitted for that class.
 
 For the standard path, the workflow authenticates a successful `Check` push
 run for that exact `main` SHA, downloads its immutable package artifact,
-reverifies the manifest and bytes, and publishes the downloaded `.tgz`. It
+reverifies the manifest and bytes, derives `dev` or `latest` from the strict
+version, and publishes the downloaded `.tgz`. It
 never invokes `npm pack` or `npm publish .` under publication authority. A
 repository-wide concurrency group prevents simultaneous publication jobs;
 GitHub may replace an older pending dispatch, and each surviving dispatch is
-safe to rerun. Preflight rejects byte mismatches, a backward `dev` move, or any
-dist-tag other than `dev`; an already-published matching version is an
-idempotent success. Post-publication
-verification tolerates npm's publish-time scanning for up to 15 minutes. If
+safe to rerun. Preflight rejects byte mismatches, tag rollback, malformed
+registry state, or any dist-tag other than `dev` and `latest`; an
+already-published matching version is an idempotent success. The historical
+first-version state where both tags identify `0.1.0-dev.5` is accepted only
+with its recorded integrity and shasum and only while no stable version exists.
+Post-publication verification preserves the other channel, checks integrity
+and shasum, and validates trusted-publisher provenance. It tolerates npm's
+publish-time scanning for up to 15 minutes. If
 scanning or manual review remains pending, the workflow reports that state and
 a rerun safely resumes verification without republishing immutable bytes.
 
@@ -73,7 +70,7 @@ integrity. Arcane separately requires the installed package to identify exactly
 as `arcane-os@0.1.0-dev.5` and verifies the locked runtime. A local directory
 `file:` install is intentionally unsupported because it may be linked.
 
-Before the first development publish, or while the registry package is absent:
+The first-version bootstrap established these permanent audit boundaries:
 
 1. Push the intended clean `main` commit and require the complete Check workflow,
    including the exact-artifact Windows/Linux/macOS matrix, to pass.
@@ -93,12 +90,10 @@ Before the first development publish, or while the registry package is absent:
    tarball. Do not rebuild or repack it for this bootstrap. After the package
    exists, standard releases may publish directly through OIDC, while dual-use
    releases must use `npm stage publish` and human 2FA promotion.
-5. Allow for npm publish-time scanning, then verify the registry's
-   `dist.integrity` equals the manifest, verify `dev` is
-   the only dist-tag, add a second appropriate owner, and configure npm trusted
-   publishing for the exact `publish-dev.yml` workflow and `npm` environment.
-   For a dual-use classification, grant stage-only trust instead of direct
-   publish authority.
+5. Verify the registry's `dist.integrity` and shasum. npm's required bootstrap
+   state has both `dev` and `latest` at the immutable `0.1.0-dev.5` bytes
+   until the first stable publish moves only `latest`. The sole trusted
+   publisher is the exact `publish-dev.yml` workflow and `npm` environment.
 6. Later standard development versions may use the workflow's direct OIDC
    authority. A dual-use version must be staged and promoted with human 2FA.
    Any missing policy decision, package bootstrap, environment, publisher
@@ -170,12 +165,12 @@ internal checksums alone do not grant authority.
 Stable versioning, the npm `latest` tag, and an official GitHub release remain a
 separate explicit release decision. Current `main` development does not
 silently convert a `-dev` package into an official release. A stable release
-must publish the same matrix-tested `.tgz` under `latest`; only after registry
+must publish the same source-validated and platform-smoked `.tgz` under
+`latest`; only after registry
 integrity matches may GitHub attach that `.tgz`, manifest, and checksum. Its Git
 tag and GitHub release title must both be the same bare numeric
-`MAJOR.MINOR.PATCH`. The first stable change must also activate the documented
-`dev`/`main` branch transition and protections; prerelease versions do not get a
-misleading numeric GitHub release.
+`MAJOR.MINOR.PATCH`. Prerelease versions do not get a misleading numeric
+GitHub release, and no release creates a Git branch for an npm dist-tag.
 
 ## Documentation publication
 
@@ -188,16 +183,14 @@ It does not rerun the SDK test suite or execute repository build code.
 
 The deployment job holds only the read, Pages, and OIDC permissions required by
 that single checked artifact. The `github-pages` environment remains the final
-deployment authority. A separate `/dev/` documentation channel is deferred to
-the same explicit post-release branch transition described above.
+deployment authority. Documentation channels are post-registry presentation
+work and do not change the canonical source branch.
 
 ## Work-amplification record
 
-The prerelease branch cardinality is one checked `main` SHA, one npm release
-candidate, one static site, and one Pages artifact. Four source-check jobs cover
-two supported Node lines on Windows and Linux. One producer creates the npm
-tarball once; three native consumers execute those exact bytes on Windows,
-Linux, and macOS; one readiness gate aggregates them. Development publication
-and Pages authenticate and reuse that successful exact-SHA evidence. Neither
-rebuilds the SDK package or reruns the suite, and Pages does not create a second
-site placement.
+The release graph is one checked `main` SHA and one npm release candidate. One
+source-validation job runs the suite once; one producer creates the tarball;
+three small installed-package consumers execute those exact bytes on Windows,
+Linux, and macOS; and one readiness job verifies identity and legal inventory.
+OIDC publication reuses that successful exact-SHA artifact without rebuilding.
+Pages and broader presentation work follow registry verification separately.

package/docs/reference/event-manager.md

@@ -235,11 +235,11 @@ Seeking never rewrites DOM, storage, native state, processes, or network state.
 
 ```javascript
 await events.playback({
-    stack=null,
-    fromSequence=1,
-    toSequence=Number.MAX_SAFE_INTEGER,
-    speed=0,
-    mode='review',
+    stack:null,
+    fromSequence:1,
+    toSequence:Number.MAX_SAFE_INTEGER,
+    speed:0,
+    mode:'review',
     signal,
     onRecord
 });

package/docs/work-amplification.md

@@ -50,9 +50,10 @@ format, or signing loop and does not produce app output.
 
 - Scaffold: approximately 15-25 files, less than 100 KiB, target under one
   second before an optional dependency installation.
-- Shared browser payload: 158 files / 3,359,960 bytes, comprising the exact
-  155-file / 3,320,994-byte dev.4 runtime receipt plus three SDK licensing files
-  / 38,966 bytes, verified once per exact SDK installation state.
+- Shared browser payload: 166 files / 3,478,345 bytes, comprising the exact
+  155-file / 3,320,994-byte Arcane-upstream runtime receipt, the separate
+  8-file / 118,385-byte SDK browser-runtime receipt, and three SDK licensing
+  files / 38,966 bytes, verified once per exact SDK installation state.
 - Small browser package: app bytes plus the shared runtime, copied and inventoried
   once into an atomic staging directory.
 - Portable build: one explicitly selected app and one host platform request. In

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "arcane-os",
-  "version": "0.1.0-dev.5",
-  "description": "Arcane OS application SDK, CLI, browser runtime, and cross-platform build toolchain.",
+  "version": "0.1.0",
+  "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
   "bin": {
@@ -33,6 +33,7 @@
   },
   "files": [
     "bin/",
+    "browser-runtime/",
     "src/",
     "runtime/",
     "schemas/",
@@ -45,11 +46,14 @@
   ],
   "scripts": {
     "test": "npm run test:unit && npm run test:functional && npm run test:integration && npm run test:regression",
-    "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/contracts.test.mjs test/doctor.test.mjs test/targets.test.mjs",
-    "test:functional": "node ./bin/arcane-test.mjs test/cli.test.mjs test/dev-server.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/packaging.test.mjs test/reference-completeness.test.mjs test/runtime-api-behavior.test.mjs test/runtime-sync.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/site.test.mjs test/update-check.test.mjs",
-    "test:integration": "node ./bin/arcane-test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/native-plan.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs",
+    "test:release": "npm run test:unit && npm run test:functional:release && npm run test:integration && npm run test:regression",
+    "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/contracts.test.mjs test/doctor.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
+    "test:functional": "node ./bin/arcane-test.mjs test/cli.test.mjs test/dev-server.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/import-map.test.mjs test/packaging.test.mjs test/reference-completeness.test.mjs test/runtime-api-behavior.test.mjs test/runtime-sync.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/site.test.mjs test/update-check.test.mjs",
+    "test:functional:release": "node ./bin/arcane-test.mjs test/cli.test.mjs test/dev-server.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/import-map.test.mjs test/packaging.test.mjs test/runtime-api-behavior.test.mjs test/runtime-sync.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/update-check.test.mjs",
+    "test:integration": "node ./bin/arcane-test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/native-plan.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/release-capability-smoke.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs",
     "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/native-provider-generation.test.mjs test/testing.test.mjs test/test-sets.test.mjs",
-    "check": "node tools/check-source.mjs && node tools/runtime-manifest.mjs --verify && npm test",
+    "check": "node tools/check-source.mjs && node tools/runtime-manifest.mjs --verify && node tools/sdk-browser-runtime-manifest.mjs --verify && npm test",
+    "check:release": "node tools/check-source.mjs && node tools/runtime-manifest.mjs --verify && node tools/sdk-browser-runtime-manifest.mjs --verify && npm run test:release",
     "runtime:verify": "node tools/runtime-manifest.mjs --verify",
     "runtime:sync": "node tools/sync-runtime.mjs",
     "pack:local": "npm pack --ignore-scripts",
@@ -81,7 +85,7 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",
-    "tag": "dev"
+    "tag": "latest"
   },
   "dependencies": {
     "event-pubsub": "6.1.0",

package/runtime/ARCANE_RUNTIME_RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "builder": "arcane-sdk-runtime-v1",
-  "sdkVersion": "0.1.0-dev.5",
+  "sdkVersion": "0.1.0",
   "source": {
     "repository": "https://github.com/TheWizardNexus/ARCANE-OS.git",
     "commit": "567ad110bf57a1c2d4a3daa22ae93716cc5f4d7e",

package/schemas/arcane-lock.schema.json

@@ -9,6 +9,7 @@
     "schemaVersion",
     "sdk",
     "runtime",
+    "sdkBrowserRuntime",
     "protocols"
   ],
   "properties": {
@@ -27,7 +28,7 @@
           "const": "arcane-os"
         },
         "version": {
-          "const": "0.1.0-dev.5"
+          "const": "0.1.0"
         }
       }
     },
@@ -52,6 +53,90 @@
         }
       }
     },
+    "sdkBrowserRuntime": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "manifest",
+        "manifestSha256",
+        "contentSha256",
+        "builder",
+        "sdkVersion",
+        "source"
+      ],
+      "properties": {
+        "manifest": {
+          "const": "node_modules/arcane-os/browser-runtime/ARCANE_SDK_BROWSER_RELEASE.json"
+        },
+        "manifestSha256": {
+          "const": "43baaec850291c28795f6c194001deb5febab88ccab1b033bce6597dd6f6f08f"
+        },
+        "contentSha256": {
+          "const": "0caa302bc07d4a45f5290504ec62ddce98fdf5e3412f916c10aae3d51b1e5f7c"
+        },
+        "builder": {
+          "const": "arcane-sdk-browser-runtime-v1"
+        },
+        "sdkVersion": {
+          "const": "0.1.0"
+        },
+        "source": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "authority",
+            "repository",
+            "protocol",
+            "browserEntry",
+            "dependencies"
+          ],
+          "properties": {
+            "authority": {
+              "const": "arcane-os-sdk"
+            },
+            "repository": {
+              "const": "https://github.com/TheWizardNexus/arcane-os-sdk.git"
+            },
+            "protocol": {
+              "const": "arcane-sdk-browser-runtime/1"
+            },
+            "browserEntry": {
+              "const": "arcane-os/event-manager"
+            },
+            "dependencies": {
+              "type": "array",
+              "minItems": 2,
+              "maxItems": 2,
+              "prefixItems": [
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["name", "version", "resolved", "integrity"],
+                  "properties": {
+                    "name": {"const": "event-pubsub"},
+                    "version": {"const": "6.1.0"},
+                    "resolved": {"const": "https://registry.npmjs.org/event-pubsub/-/event-pubsub-6.1.0.tgz"},
+                    "integrity": {"const": "sha512-FEMlhTxwqGM0hztTixG6FhVFXqp7Eq1ltk5mSreK6Mhy3xWWpLAzEUR6OMvMdNqT3jgSxA8JDhnhyAG3X4Xy7Q=="}
+                  }
+                },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["name", "version", "resolved", "integrity"],
+                  "properties": {
+                    "name": {"const": "strong-type"},
+                    "version": {"const": "2.0.0"},
+                    "resolved": {"const": "https://registry.npmjs.org/strong-type/-/strong-type-2.0.0.tgz"},
+                    "integrity": {"const": "sha512-HHrY9qYC7yn+5mlewiI3k9RQM9gZqGQsqbomZcd10Ks0h4RlX01nnkWbCe4AsVPCI6KaFvpkWm1nHMD+Ykup6g=="}
+                  }
+                }
+              ],
+              "items": false
+            }
+          }
+        }
+      }
+    },
     "protocols": {
       "type": "object",
       "additionalProperties": false,

package/src/cli/main.mjs

@@ -39,6 +39,7 @@ Usage:
   ${CLI_NAME} new <id> [--path <directory>] [--display-name <name>] [--target <target>] [--git]
   ${CLI_NAME} init [id] [--workspace <directory>] [--display-name <name>] [--target <target>]
   ${CLI_NAME} doctor [--workspace <directory>] [--arcane-root <directory>]
+  ${CLI_NAME} import-map [--workspace <directory>] [--app <id>]
   ${CLI_NAME} dev [--app <id>] [--host 127.0.0.1] [--port 8000]
   ${CLI_NAME} test [--app <id>] [--scope app]
   ${CLI_NAME} test --scope shared --test-file <repo-relative.test.mjs>
@@ -220,6 +221,10 @@ function operationOptions(command,parsed,cwd){
             requireLocalAI:flags.has('require-local-ai')
         };
     }
+    if(command==='import-map'){
+        noExtraPositionals(command,positionals);
+        return common;
+    }
     if(command==='dev'){
         noExtraPositionals(command,positionals);
         return {

package/src/dev-server.mjs

@@ -9,10 +9,12 @@ import {
     RELEASE_MANIFEST_NAME
 } from './packager/core.mjs';
 import {
-    authenticateRuntimeReceipt,
-    readVerifiedRuntimeFile,
-    verifyRuntime
-} from './runtime.mjs';
+    authenticateWorkspaceRuntimeReceipt,
+    readVerifiedWorkspaceRuntimeFile,
+    verifyWorkspaceRuntime
+} from './workspace-runtime.mjs';
+import {verifyRuntime} from './runtime.mjs';
+import {verifySdkBrowserRuntime} from './sdk-browser-runtime.mjs';
 import {resolveWorkspace} from './workspace.mjs';
 import {createEventQueue} from './event-queue.mjs';
 
@@ -147,6 +149,31 @@ function identityMap(identities,prefix=''){
     return result;
 }
 
+function routePrefixKey(prefix){
+    return prefix.map(segment=>segment.normalize('NFC').toLowerCase()).join('/');
+}
+
+function deterministicMappings(mappings){
+    const seen=new Map();
+    for(const mapping of mappings){
+        const key=routePrefixKey(mapping.prefix);
+        const prior=seen.get(key);
+        if(prior){
+            fail(
+                `Development server routes collide after case/NFC normalization: `
+                +`/${prior.prefix.join('/')} and /${mapping.prefix.join('/')}.`
+            );
+        }
+        seen.set(key,mapping);
+    }
+    return [...mappings].sort((left,right)=>{
+        if(left.prefix.length!==right.prefix.length)return right.prefix.length-left.prefix.length;
+        const leftKey=routePrefixKey(left.prefix);
+        const rightKey=routePrefixKey(right.prefix);
+        return leftKey<rightKey?-1:leftKey>rightKey?1:0;
+    });
+}
+
 function createFileWorkLimiter(){
     let active=0;
     const pending=[];
@@ -318,7 +345,7 @@ function sharedPathAllowed(relative,route){
     });
 }
 
-async function sourceRoutes(workspaceRoot,appId,{runtimeReceipt,signal,onEvent}){
+async function sourceRoutes(workspaceRoot,appId,{workspaceRuntimeReceipt,signal}){
     const resolved=await resolveWorkspace({workspaceRoot,appId});
     if(resolved.config.workspaceMode==='integrated'){
         return {
@@ -340,16 +367,43 @@ async function sourceRoutes(workspaceRoot,appId,{runtimeReceipt,signal,onEvent})
             ]
         };
     }
-    const runtimeRoot=path.join(
-        resolved.workspaceRoot,
-        'node_modules',
-        'arcane-os',
-        'runtime'
-    );
-    const verified=runtimeReceipt??await verifyRuntime({runtimeRoot,signal,onEvent});
-    await authenticateRuntimeReceipt(verified,{runtimeRoot});
-    const arcaneIdentities=identityMap(verified.identities,'arcane');
-    const strongTypeIdentities=identityMap(verified.identities,'strong-type');
+    const runtimeRoot=path.join(resolved.workspaceRoot,'arcane');
+    let verified=workspaceRuntimeReceipt;
+    if(!verified){
+        const sdkRuntimeRoot=path.join(
+            resolved.workspaceRoot,
+            'node_modules',
+            'arcane-os',
+            'runtime'
+        );
+        const sdkRuntimeReceipt=await verifyRuntime({
+            runtimeRoot:sdkRuntimeRoot,
+            signal
+        });
+        const sdkBrowserRuntimeRoot=path.join(
+            resolved.workspaceRoot,
+            'node_modules',
+            'arcane-os',
+            'browser-runtime'
+        );
+        const sdkBrowserRuntimeReceipt=await verifySdkBrowserRuntime({
+            browserRuntimeRoot:sdkBrowserRuntimeRoot,
+            signal
+        });
+        verified=await verifyWorkspaceRuntime({
+            workspaceRoot:resolved.workspaceRoot,
+            runtimeRoot:sdkRuntimeRoot,
+            runtimeReceipt:sdkRuntimeReceipt,
+            browserRuntimeRoot:sdkBrowserRuntimeRoot,
+            sdkBrowserRuntimeReceipt,
+            signal
+        });
+    }
+    verified=await authenticateWorkspaceRuntimeReceipt(verified,{
+        workspaceRoot:resolved.workspaceRoot,
+        signal
+    });
+    const arcaneIdentities=identityMap(verified.identities);
     return {
         workspaceRoot:resolved.workspaceRoot,
         workspaceMode:'external',
@@ -363,25 +417,14 @@ async function sourceRoutes(workspaceRoot,appId,{runtimeReceipt,signal,onEvent})
             },
             {
                 prefix:['arcane'],
-                root:path.join(runtimeRoot,'arcane'),
+                root:runtimeRoot,
                 identities:arcaneIdentities,
-                read:relative=>readVerifiedRuntimeFile(verified,{
-                    runtimeRoot,
-                    relativePath:`arcane/${relative.join('/')}`,
+                read:relative=>readVerifiedWorkspaceRuntimeFile(verified,{
+                    workspaceRoot:resolved.workspaceRoot,
+                    relativePath:relative.join('/'),
                     signal
                 }),
                 allow:relative=>arcaneIdentities.has(inventoryKey(relative.join('/')))
-            },
-            {
-                prefix:['node_modules','strong-type'],
-                root:path.join(runtimeRoot,'strong-type'),
-                identities:strongTypeIdentities,
-                read:relative=>readVerifiedRuntimeFile(verified,{
-                    runtimeRoot,
-                    relativePath:`strong-type/${relative.join('/')}`,
-                    signal
-                }),
-                allow:relative=>strongTypeIdentities.has(inventoryKey(relative.join('/')))
             }
         ]
     };
@@ -461,7 +504,7 @@ async function startOwnedDevServer({
     host='127.0.0.1',
     port=0,
     signal,
-    runtimeReceipt,
+    workspaceRuntimeReceipt,
     releaseReceipt
 }={},events,releaseSignal){
     throwIfAborted(signal);
@@ -473,12 +516,13 @@ async function startOwnedDevServer({
     await events.send({type:'server.starting',mode,host,port,appId});
     const routeSet=mode==='source'
         ?await sourceRoutes(workspaceRoot,appId,{
-            runtimeReceipt,
+            workspaceRuntimeReceipt,
             signal,
             onEvent:event=>events.send(event)
         })
         :await packagedRoutes(releaseRoot,releaseReceipt,{signal});
-    for(const mapping of routeSet.mappings){
+    const mappings=deterministicMappings(routeSet.mappings);
+    for(const mapping of mappings){
         const info=await lstat(mapping.root);
         if(info.isSymbolicLink()||!info.isDirectory())fail(`Server route root must be a real directory: ${mapping.root}.`);
         mapping.root=await realpath(mapping.root);
@@ -533,7 +577,7 @@ async function startOwnedDevServer({
                 response.end();
                 return;
             }
-            const mapping=routeSet.mappings.find(route=>
+            const mapping=mappings.find(route=>
                 route.prefix.every((segment,index)=>segments[index]===segment)
             );
             if(!mapping){deny(response,404,'Not found.');return;}