/**
 * Current protocol version. Used for cache invalidation and capability discovery.
 *
 * The block comment below is a chronological changelog of protocol
 * wire-shape changes. Each dated entry describes a wire-shape or
 * schema change; the most recent change anchors {@link PROTOCOL_VERSION}.
 *
 * --------------------------------------------------------------------
 * The runtime sends the render-failure report (2026-10-02, ggui#1679: no
 * schema change, same draft stamp). The emit step of ggui#1609's
 * `ggui_runtime_report_render_failure`: `@ggui-ai/iframe-runtime` reports a
 * card whose component threw past its error boundary's retry, once per
 * session, with `{sessionId, appId, phase, errorName, catches}` and the view
 * proof on the call, over the same host relay every runtime tool rides. A
 * report that is refused, unanswered or met with tool-not-found (a server
 * from before the tool) is dropped in silence and never resent (SPEC §4.9).
 * `renderFailureErrorName` now reads "is an Error" by brand
 * (`[object Error]`) rather than `instanceof`, so an Error thrown in another
 * realm (a document-injected module) still reports its class name; a plain
 * object with a `name` is still `"Error"`. The vocabulary moves to its own
 * PURE-CONST module with a new subpath export, `@ggui-ai/protocol/render-failure`
 * (as `runtime-telemetry` is): importing these names from the package root
 * pulled the whole `schemas/mcp` module into the card runtime's bundle
 * (+34 KB against its budget). The root re-exports the same bindings, so
 * nothing on the root surface moves; `RenderFailurePhase` is newly exported.
 * No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * The server refuses a second gesture on a spent one-shot (2026-10-02,
 * ggui#1424: no schema change, same draft stamp). `ggui_runtime_submit_action`
 * claims the spend before the pipe append; a second committed dispatch of a
 * declared `oneShot` on the same card under a different `actionId`, once the
 * holder's delivery is marked, answers `{ok:false, code:'CONTRACT_VIOLATION'}`
 * with one violation at `actionSpec.<name>.oneShot` — the normative
 * discriminator from "bad payload" — and reaches no agent. Both the code and
 * `violations` were declared and emitted since ggui#1358, so no reader
 * changes. The `oneShot` docblock names the exception to "the RELAY never
 * collapses distinct actionIds"; SPEC's spent-oneShot clause gains the
 * refusal. No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * `ggui_render` captures the host-session slice; its fields are bounded
 * (2026-10-02, ggui#1339: same draft stamp). The request's
 * `_meta["ai.ggui/host-session"]` pair is stored on the session the render
 * creates, as the extension doc's section 2.4 already said, so
 * `ggui_list_sessions` filtered by the pair returns it. The render request
 * is the one that must carry the slice; the handshake creates no session.
 * `parseMcpAppAiGguiHostSessionMeta` now refuses a `hostName` or
 * `hostSessionId` longer than `MCP_APP_HOST_SESSION_FIELD_MAX_LENGTH` (256,
 * a new export) as `MALFORMED_HOST_SESSION`, and a server treats a
 * malformed slice as absent: the render succeeds, ungrouped. No server
 * stored the slice before, so no stored pair is affected. No
 * `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * Coverage on a judged reuse compares load-bearing action members
 * (2026-10-02, ggui#1428: no schema change, same draft stamp). A
 * `COVERAGE_GAP` finding's `path` may now be `actionSpec.<name>.<member>`
 * for `oneShot`, `confirm` or `nextStep`: the draft declares the member on
 * an action both contracts carry and the proposed stored entry does not
 * match. `SuggestionFinding.path` is an open string, so an earlier reader
 * reads it as one. The finding stays `warn`; reuse stays the default.
 * --------------------------------------------------------------------
 * A render whose generator returns no contract commits the agreed one
 * (2026-10-02, ggui#1429: no schema change, same draft stamp).
 * `UIGenerationResponse.contract` states it: a returned contract is
 * complete, never a patch, and an omitted one means the negotiated contract
 * unchanged. The committed session then carries the agreed `actionSpec`,
 * `streamSpec`, `contextSpec` and `clientCapabilities`, where before it
 * carried only the agreed `propsSpec`.
 * --------------------------------------------------------------------
 * A repaired handshake draft keeps every declared member on every spec
 * (2026-10-01, ggui#1430: no schema change, same draft stamp). The
 * `origin: 'synth'` repair keeps, under the same key, every member the
 * draft declared on its props, context slots, stream channels and tools,
 * beside its actions (ggui#1421), changing only what a repair may
 * re-author. A draft tool the repair dropped is restored whole and named
 * `REPAIR_ENTRY_RESTORED` (`warn`) at `agentCapabilities.tools.<name>`, a new
 * `validationFindings` code; `SuggestionFinding.code` is an open string, so
 * a reader on an earlier release reads it as one. `REPAIR_ENTRY_DROPPED` now
 * names a renamed, moved or removed entry on every spec. SPEC's "Repair
 * fidelity" clause is widened to match. No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * The self-contained shell shows a runtime it cannot load (2026-10-01,
 * ggui#1518: PATCH-class, no schema change, same draft stamp). After its
 * bundle-failure script posts the one `BUNDLE_FETCH_FAILED` (ggui#1503), it
 * removes `[data-ggui-shell-loading]` and paints a failure line
 * (`[data-ggui-shell-failure]`, `role="alert"`) with the thin shell's
 * wording and a Retry that reloads the frame. Nothing is painted while the
 * unhashed twin is still being tried. `gguiShellHtml` stays a pure function
 * of its inputs and gains no option.
 * --------------------------------------------------------------------
 * `ggui_runtime_refresh_ws_token` stops declaring `REFRESH_WINDOW_CLOSED`
 * (2026-10-01, a wire removal, ggui#1510: same draft stamp). The output
 * schema's `code` enum names `BOOTSTRAP_INVALID` and `BOOTSTRAP_NOT_SUPPORTED`,
 * and `GguiRefreshWsTokenOutput` types those two. No server has sent the
 * member since the refresh became an authorized re-mint (ggui#1496 part B
 * slice 1, `79b4ced2e`: in npm 0.25.0, and on dev, staging and prod), and
 * it stayed declared one release after that, so a client holding an older
 * schema accepts every answer. The advertised schema is pinned byte for
 * byte (tag 14's without the member). The ack's `sessionToken` and the
 * `'session'` token kind are NOT removed here: npm 0.25.0 still mints the
 * ack's reconnect token, so they wait for the release after the one that
 * stops it on npm. No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * The build stamp rides the reference registry's row, a portable export and
 * a seed-pool import (2026-10-01, ggui#1476: no schema change, same draft
 * stamp). The registry writes `build` into its vector-store row (a JSON
 * string, written only when present) and reads it back through one reader
 * that validates it with `generatorBuildSchema` — an unreadable value drops
 * the fact, never the row — so a dedup return and a reuse name the MINTING
 * build. The exporter ships `PortableBlueprint.build` (declared with
 * ggui#1280), and a seed-pool import keeps it. The admission rule gains a
 * bound: a stamp over 1024 bytes serialized is dropped with a line, because
 * the stamp rides every row's vector metadata. Release order: the #1280
 * emit (2026-09-27, below) serves on dev, staging and prod, and npm 0.25.0
 * declares `PortableBlueprint.build`, so an importer from 0.25.0 reads an
 * exported stamp. An older importer reads only the keys it names, so it
 * ignores the stamp and imports the row.
 * --------------------------------------------------------------------
 * Runtime telemetry vocabulary (2026-10-01, additive, ggui#1381 — MINOR,
 * same draft stamp): a new subpath, `@ggui-ai/protocol/runtime-telemetry`,
 * holds the kinds `ggui_runtime_telemetry` carries: `RUNTIME_TELEMETRY_KINDS`
 * (each kind, its batch `health` | `diagnostic`, and the one `detail` shape it
 * admits), `CHANNEL_LOG_EVENTS` / `ChannelLogEvent` (moved here from
 * `@ggui-ai/live-channel`, which re-exports them), `CONNECTION_STATUSES`, and
 * the kind types. The emitter and a host's door import one list. PURE-CONST
 * by contract (no runtime imports; a test pins it). The server stays
 * tolerant: an unknown kind is logged, never refused (N−1). No wire change.
 * --------------------------------------------------------------------
 * The render result's `effort` is now SENT (2026-10-01, ggui#1459 emit step:
 * no schema change, same draft stamp). `ggui_render` states the named level
 * the generation that produced the render's code applied, from that
 * generation's own `GenerationMetadata.effort`: on `rendered`, and on
 * `failed` when a generation ran and failed after applying a level (its own
 * failure metadata, or a generation whose commit was rejected). Absent on a
 * reuse, a probe or placeholder render, a refusal, a generator that threw,
 * and when no level applied. `structuredContent` only — not the
 * `ai.ggui/render` slice. Release order: the declare step (2026-09-27,
 * below) serves on dev, staging and prod and shipped on npm in 0.25.0, so a
 * server's own `tools/list` names the member wherever it is sent. An npm
 * reader before 0.25.0 strips it (`renderOutputSchema` is not strict).
 * --------------------------------------------------------------------
 * JSON-value schema emits a model-API-safe shape (2026-10-01, ggui#1637 —
 * PATCH-class wire fix, same draft stamp): `jsonValueSchema`'s object arm
 * checks its members in code instead of recursing, so the JSON Schema served
 * on `tools/list` has no definition that reaches itself through required
 * members (`additionalProperties: {}` in place of a `$ref` back to itself).
 * Google's function-declaration validator refused the old shape for every
 * tool that embeds it (`ggui_handshake`, `ggui_render`,
 * `ggui_runtime_sync_context`). The accepted set is unchanged, pinned against
 * the recursing form case by case; a deep invalid member is reported at its
 * member path. The array arm still recurses. No export changes.
 * --------------------------------------------------------------------
 * Theme carry read NAMES an uninterpretable stored document (2026-09-30,
 * additive, ggui#1175 — MINOR, same draft stamp): `appThemeGetResponseSchema`
 * gains an optional `uninterpretable: { issueCount, issues: [{ path, code }] }`,
 * present exactly when the row holds a `theme` that fails the carry shape
 * (`theme` is then `null`; never beside `interpreted`, refused by the schema).
 * New exports: `THEME_ISSUE_CODES` / `ThemeIssueCode` (a closed set the
 * protocol owns, never zod's codes), `THEME_ISSUES_MAX` (20),
 * `THEME_ISSUE_SEGMENT_MAX` (100), `THEME_ISSUE_PATH_MAX` (16),
 * `appThemeUninterpretableSchema` / `AppThemeUninterpretable`, and
 * `describeUninterpretableTheme` (the one mapping; unknown issues map to
 * `other`). No stored value is carried. N−1: an additive optional member;
 * the previous release's three payloads parse unchanged (pinned), and the
 * one outside reader drops an unknown member. Kit: a second
 * `app-theme-carry` forward case.
 * --------------------------------------------------------------------
 * A copied row now SAYS it is a copy: `Blueprint.clonedFrom` is EMITTED
 * (2026-09-30, ggui#1570 emit step: no schema change, same draft stamp).
 * The declare step served on dev, staging and prod before any writer set
 * it, because the previous release's strict `blueprintSchema` refuses a row
 * with a member it does not name. `ggui_ops_register_blueprint`
 * gains an optional input, `clonedFrom` (the parent's id), which
 * `createRegisterGeneratedBlueprint` parses too. The durable row records it,
 * and an empty id, the row's own id, and any id that is not a row of the
 * registering app are refused before anything is persisted. Nothing that
 * serves reads it. N−1: over MCP a server from before this STRIPS the member
 * (the SDK registers the input's shape), so a newer client's copy lands
 * unmarked, silently; a writer outside the server's own image checks the
 * server's `tools/list` before relying on the mark.
 * No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * A card whose render failed can say so: `ggui_runtime_report_render_failure`
 * is declared (2026-09-30, additive, ggui#1609 declare step: MINOR, same
 * draft stamp). It is a new app-only runtime tool, the seventh (SPEC §4.9):
 * `{sessionId, appId, phase, errorName, catches}`, the thrown value's class
 * name and never its message or stack. The server records a report only for
 * the session its view proof binds, answers `ok` whatever the verdict, and
 * never enqueues it as a turn. `VIEW_PROOF_V1_BOUND_ARGS` gains the tool's
 * row. Adding a row for a new tool is not a new label: no earlier signer
 * sends it and no earlier verifier accepts it, so the v1 vectors stand. No
 * runtime sends it until relays admit the name and this release's server
 * serves on that env. New exports: `reportRenderFailureInputShape`,
 * `reportRenderFailureInputSchema`, `reportRenderFailureOutputSchema`,
 * `GguiReportRenderFailureInput`, `GguiReportRenderFailureOutput`,
 * `RENDER_FAILURE_PHASES`, `RENDER_FAILURE_ERROR_NAME_PATTERN`,
 * `RENDER_FAILURE_MAX_CATCHES`, `RENDER_FAILURE_MAX_ID_LENGTH` (`sessionId` and
 * `appId` are 1 to 256 characters, the bound a relaying door applies too) and
 * `renderFailureErrorName`. A card sends at most one report per session.
 * No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * `ggui_ops_generate_blueprint`'s output drops `validatorScore`
 * (2026-09-30, a removal, ggui#1579: MINOR, same draft stamp).
 * `opsGenerateBlueprintOutputSchema` no longer declares the optional
 * member. No release ever populated it: the handler read it off the
 * generator's metadata through an undeclared field that no generator
 * sets. So §3.6's N−1 clock is already satisfied: the release that
 * "stops sending" it is every release, and a client holding a previous
 * `tools/list` that declares it meets outputs without it, as it always
 * did. `Blueprint.validatorScore`, on durable rows, is a different field
 * and is unchanged. No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * A copied blueprint row can say it is a copy (2026-09-29, additive,
 * ggui#1570 declare step: MINOR, same draft stamp). `Blueprint.clonedFrom?`
 * names the row whose code bytes the row copies; the copy's `source`,
 * `build` and `codeHash` stay its original's. Nothing that serves reads it.
 * `blueprintSchema` (strict) and so `ggui_ops_list_blueprints`' output
 * declare it; no writer emits it until this release serves everywhere,
 * because the previous release's strict schema would refuse such a row. The
 * portable form does not carry it. No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * A retried `ggui_runtime_submit_action` dispatch is one gesture
 * (2026-09-29, additive, ggui#1519: MINOR, same draft stamp). SPEC §11.1
 * promises it as a SHOULD this release and a MUST from the next: a repeat of
 * an earlier committed `(sessionId, actionId)` is answered as the first was,
 * with no second pending event, `user.submitted` row or spend, even in
 * flight at once. An `actionId` reused for a different gesture (its
 * `intent` and `actionData`, compared by a digest of
 * `dispatchGestureBytes`) keeps the first. `ggui_runtime_submit_action`
 * declares `ACTION_ID_REUSED` on its closed output in `tools/list`, one
 * release before any server answers it; until then a reuse is answered as
 * a duplicate, and logged. New exports `dispatchGestureBytes`,
 * `DISPATCH_GESTURE_LABEL_V1` and `ACTION_ID_REUSED`
 * (`@ggui-ai/protocol/integrations/mcp-apps`).
 * No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * A session's stream counter carries a generation, `streamEpoch`
 * (2026-09-29, additive, ggui#1531: MINOR, same draft stamp). Three
 * optional fields: `StreamEnvelope.streamEpoch` beside every `seq`,
 * `AckPayload.streamEpoch` beside `streamSeq`, and
 * `SubscribePayload.fromEpoch` beside `fromSeq`. A new epoch means the
 * counter restarted, so `seq` values may repeat: a client that dedupes by
 * `seq` resets to nothing applied, and a server holding another epoch
 * than a resume's `fromEpoch` replays everything it retains. An absent
 * epoch is unknown, never a mismatch, so either side may predate it.
 * No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * The view-origin proof v1 is declared (2026-09-29, additive, ggui#1415:
 * MINOR, same draft stamp). Nothing sends a proof or refuses a call at this
 * release. Three pieces reach the wire:
 *   - the request key `params._meta["ai.ggui/view"]` and its v1 grammar
 *     (`@ggui-ai/protocol/integrations/mcp-apps`, `view-proof.ts`), which
 *     no runtime sends yet;
 *   - a ws token minted by a key-issuing door carries two optional claims,
 *     `kid` and `src` (`VIEW_ROOT_SRC`, a closed set widened only a release
 *     ahead of use); a verifier from before this release ignores them, and
 *     no door mints them yet;
 *   - `ggui_runtime_submit_action` and `ggui_runtime_sync_context` declare
 *     `VIEW_ORIGIN_UNPROVEN` on their closed outputs in `tools/list` (SPEC
 *     §4.7, §7.9), one release before any server answers it.
 * No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * A fresh subscribe's reserved-channel replay is written into SPEC §12.2.1
 * (2026-09-28, ggui#1521: an erratum, same draft stamp; no byte on the wire
 * changes). A subscribe without `fromSeq` still replays no agent-declared
 * channel. The server SHOULD send known-reserved channels' retained envelopes
 * after the ack, at `seq <= streamSeq`, which both reference servers have
 * done since before the old text said "the server MUST NOT replay history".
 * New client obligation: apply those frames, and dedupe against the highest
 * `seq` applied, never against `streamSeq`.
 * --------------------------------------------------------------------
 * The self-contained shell reports a runtime bundle that fails to load
 * (2026-09-28, ggui#1503: MINOR, same draft stamp). It posts ONE
 * `ggui:bootstrap-failed` with `BUNDLE_FETCH_FAILED` (SPEC §5.5.2), after the
 * #1501 twin when it has one, at once otherwise, as the thin shell does. Every
 * external runtime URL's shell now carries the capture-phase listener and a
 * `data-ggui-runtime="src"` mark on its runtime element, so those shells'
 * bytes change; an inlined runtime has nothing to fetch and is unchanged.
 * --------------------------------------------------------------------
 * The subscribe ack stops carrying a reconnect `sessionToken` (2026-09-28,
 * ggui#1488 / ggui#1496 part B slice 3: MINOR, same draft stamp). No server
 * ever verified the token and no client read it, so the SHOULD that asked
 * servers to mint one is withdrawn. `AckPayload.sessionToken` stays declared
 * optional and `@deprecated` through this release and is removed in the
 * next (VERSION-POLICY §3.6), so a client parsing an ack from either
 * release accepts it.
 * --------------------------------------------------------------------
 * The durable blueprint's build stamp is now EMITTED (2026-09-27, ggui#1280
 * emit step: no schema change, same draft stamp). A generation mint writes
 * `Blueprint.build` from the generation's `GenerationMetadata.build`: the
 * `ggui_render` cold-generation registration and `ggui_ops_generate_blueprint`
 * (its durable row, and, under the same id, the row its cache mirror writes
 * through to a separate durable store; ggui#1497). Operator-registered, installed and seed-imported rows
 * carry none, and a dedup keeps the row's MINTING build. One admission rule
 * (`admitGeneratorBuild`, mcp-server-handlers) keeps a stamp only on
 * `llm`-sourced code and only when it passes `generatorBuildSchema`;
 * otherwise the stamp is dropped with a line and the row registers
 * unstamped. The stamp lives on the durable record; the reference
 * registry's vector-store row does not carry it. Release order, per channel:
 * the hosted declare step (`d9132ae6f`) serves everywhere since tag 14
 * (`b68b964a7`), and on npm the declare ships in 0.25.0 and the emit from the
 * release after — so every rolling reader's `blueprintSchema` accepts a
 * stamped row before any writer produces one.
 * --------------------------------------------------------------------
 * `GET /api/sessions/:id/state` renewals are bounded (2026-09-28, ggui#1496
 * part B, slice 2: MINOR, same draft stamp). The ws token gains an optional
 * `rootIat` claim. A Path C renewal carries its chain's root forward (the
 * presented token's `rootIat`, else its `iat`) and clamps its `exp` to
 * `rootIat + refresh window`, with the window at least the TTL; every other
 * door mints a root without it. So every token of a chain is past its `exp`
 * by `rootIat + window`, and every gate refuses it in the same second, while
 * the window has not shrunk since the chain's root was minted and every
 * server sharing the secret uses the same window. A
 * verifier that predates the claim ignores it, and a token without it is its
 * own root (the N−1 token fixture is pinned in `@ggui-ai/mcp-server-core`).
 * --------------------------------------------------------------------
 * `ggui_runtime_refresh_ws_token` is an AUTHORIZED re-mint (2026-09-28,
 * ggui#1496 part B, slice 1: MINOR, same draft stamp). It re-mints a view's
 * live credential, at any age, only for a caller the render read door's
 * own predicate admits to the envelope's session (the app, then the
 * subject, on the live row). A missing, foreign or subject-refused session
 * gets the same not-found `ggui_runtime_pull` throws, and no refresh window
 * applies.
 *
 * The advertised output schema is byte-identical to the previous release's.
 * It still declares `REFRESH_WINDOW_CLOSED`, which only a previous-release
 * server sends, so a client that cached either release's schema accepts
 * every answer (the N−1 fixture is pinned in `@ggui-ai/mcp-server`).
 *
 * New export `withWsToken(url, wsToken)`: the inverse of
 * {@link composeSessionApiUrls}' token parameter, so a view that holds a
 * refreshed token re-derives its token-bearing URLs without the refresh
 * sending them. The package-API removals this slice makes ride VERSION-POLICY
 * §3.7 (a pre-1.0 lockstep minor).
 * --------------------------------------------------------------------
 * A shell retries a content-hashed runtime bundle ONCE through its unhashed
 * twin (2026-09-28, additive, ggui#1501: MINOR, same draft stamp); the thin
 * shell then reports `BUNDLE_FETCH_FAILED` as before, and the self-contained
 * shell still reports no bundle failure (a known §5.5.2 gap, ggui#1503). New exports `runtimeBundleHashedNameSource` and
 * `runtimeBundlePlainTwin` define the twin: the failed URL with only
 * `.<12 hex>` removed (same origin, same path; the inverse of the server's
 * hash insertion), and nothing for any other URL. `GguiShellHtmlOptions`
 * gains `runtimeBundlePlainName?`. When it is set and the URL is hashed, the
 * self-contained shell adds a capture-phase `error` listener script and
 * marks its runtime tag `data-ggui-runtime="src"`. Without it, the document
 * is byte-identical. The thin postMessage shell resolves the same pattern in
 * the frame. Why: a rolling deploy, a rollback or a replayed envelope can
 * name a hash no serving replica has, and every replica serves the unhashed
 * name. N−1: a slice is unchanged. A retried card runs the replica's current
 * runtime against its envelope, which is the N−1 direction the runtime
 * already owes.
 * --------------------------------------------------------------------
 * The render result declares `effort?` (2026-09-27, additive, ggui#1459
 * declare step: MINOR, same draft stamp). `renderOutputSchema.effort` is the
 * named level (`APP_GENERATION_PROFILE_EFFORTS`) the generation that produced
 * the render's code RAN — the engine reports it on
 * `GenerationMetadata.effort?` (core port, additive) and ui-gen sets it
 * exactly when a named level's dials were applied, on success and on
 * harness-failed metadata. Two-step by
 * design: this release DECLARES the member (the output reaches `tools/list`
 * closed, so a host must cache a schema naming it first); no server sends
 * it until this release serves everywhere, and then only on `rendered` /
 * `failed` results whose generation applied a named level.
 * --------------------------------------------------------------------
 * The durable blueprint carries its minting engine's build (2026-09-27,
 * additive, ggui#1280 declare step: MINOR, same draft stamp).
 * `GeneratorBuild { version?, mode?, digests }` is declared HERE (the core
 * port re-exports the same name), `Blueprint.build?` and
 * `PortableBlueprint.build?` carry it, `generatorBuildSchema` mirrors it
 * (strict; digest values are lowercase hex sha256). Readers treat absence
 * as `mintedBy: unknown` — a reported category, never an error. Two-step by
 * design: this release DECLARES the field and every store persists it when
 * given; no writer EMITS it until this release serves everywhere, because
 * the previous release's `ggui_ops_list_blueprints` output validation parses
 * rows with its strict `blueprintSchema` and would refuse a stamped row
 * (N−1). The emit — handlers passing `metadata.build` into
 * `registerBlueprint` — lands one release later.
 * --------------------------------------------------------------------
 * Text blocks carry an optional `phase` (2026-09-27, additive, ggui#1441:
 * MINOR, same draft stamp). `textBlockSchema` gains `phase?: string` —
 * `"interim"` is narration between tool calls, absent or any other value is
 * answer text; the vocabulary is open (it mirrors AgJSON's `phase`, not ours
 * to narrow), and a consumer never refuses a value it does not recognize.
 * N−1 both ways by construction: the previous release's payload (no
 * `phase`) parses unchanged, a payload with `phase` keeps it, an older
 * reader strips it and shows answer text, an older server never sends it.
 * No PROTOCOL_VERSION move.
 * --------------------------------------------------------------------
 * `ggui_consume`'s `nextStep` is now SENT (2026-09-27, ggui#1399 step 2:
 * no schema change, same draft stamp). Declared in 0.24.0 (step 1), the
 * member rides every non-empty drain as `{ tool: 'ggui_amend',
 * description, example, args: { sessionId } }` — the input's session id
 * verbatim, the example in copy-paste form — and is absent on an empty
 * drain and on a late drain from an expired render. A host that cached the 0.24.0 output schema accepts it; the
 * model-visible content leads with the example in plain text, as the
 * render → consume hint does. No PROTOCOL_VERSION move.
 * --------------------------------------------------------------------
 * `MODELS.openrouter` gains `openai/gpt-6-sol`, `openai/gpt-6-luna` and
 * `anthropic/claude-opus-5.5` (2026-09-27, additive, ggui#1267: MINOR,
 * same draft stamp). Autocomplete only — every `<author>/<model>` string
 * was already accepted by shape under `openrouter`. Listed after the
 * OpenRouter tools smoke the founder gated them on (D3) passed on a clean
 * session: 3/3 tool calls returned per id with `tool_choice: required`,
 * 0 errors. Opus 5.5 followed the two GPT-6 ids by one landing: its dotted
 * id listed only once it resolved to a price row (the dashed Anthropic
 * tail tried after the dotted one). No PROTOCOL_VERSION move.
 * --------------------------------------------------------------------
 * The register door takes the fit facts (2026-09-26, additive,
 * ggui#1427: MINOR, same draft stamp). `opsRegisterBlueprintInputSchema`
 * gains four optional non-identity inputs: `intent` (the request's own
 * sentence, symmetric with `*_generate_*`'s), `judgedCanvases` (a
 * non-empty list — unknown is omission, never an empty list, which would
 * declare a card judged on no canvas), `aestheticPreset { id, version? }`
 * and `directionDigest` (normalised sha256 hex), plus `directionScope`
 * (`app` — the direction the app's profile carries; `request` — a
 * direction given with the request itself; only beside a digest, refused
 * without one; a digest without a scope stays accepted). None joins the cache
 * identity; each rides the cache row for the semantic reuse pre-filter
 * (`fits()`: data-shape, surface, direction), and an omitted fact reads
 * not-evaluated. The schema is strict and its only senders are the
 * server's own in-process registrars, so an older control-plane caller
 * never sends the keys and nothing skews across a release. No
 * `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * The relay enforces the action contract at receipt (2026-09-26, ggui#1358
 * step 2: a first-party server meets a MUST it had missed on one path —
 * VERSION-POLICY §1.3, "the bar was always there"; same draft stamp).
 * `ggui_runtime_submit_action` now validates a dispatch's `actionData`
 * against the render's `actionSpec[intent].schema` before the pipe and
 * ledger writes, exactly as the live channel does, and answers a failing
 * dispatch `{ ok: false, code: 'CONTRACT_VIOLATION', message, violations }`
 * — the code and member declared one release earlier (entry below). A card
 * with no `actionSpec`, a non-component render, or a server with no render
 * store has nothing to enforce and passes as before; a store read that
 * fails is named on one warn line and the dispatch passes ungated. No
 * `PROTOCOL_VERSION` move.
 * The consume result declares its next-call hint (2026-09-26, additive,
 * ggui#1399: MINOR, same draft stamp). `gguiConsumeOutputSchema` gains an
 * optional `nextStep: { tool: 'ggui_amend', description, example, args:
 * { sessionId } }` — the render → consume chain's shape, closing the loop
 * from the drained gesture back to the card: present iff `events` is
 * non-empty, absent on an empty drain, the decision the agent's. SPEC §7.3
 * names it. DECLARED here, EMITTED one release later: the handler returns
 * no hint yet, and the tool's output reaches `tools/list` closed
 * (ggui#1333), so a host must cache a schema naming the member before any
 * server answers with it. No `PROTOCOL_VERSION` move.
 *
 * --------------------------------------------------------------------
 * The relay declares its contract-violation answer (2026-09-25,
 * additive, ggui#1358: MINOR, same draft stamp). `contractViolationSchema`
 * is the zod mirror of `ContractViolation`; `ggui_runtime_submit_action`'s
 * output `code` enum gains `CONTRACT_VIOLATION` and the output gains an
 * optional `violations: ContractViolation[]`. SPEC §4.7's handler contract
 * and §2.4's failure modes name the relay's answer beside the live
 * channel's frame. DECLARED here, ENFORCED one release later: the relay
 * does not yet run the `actionSpec` gate, and the tool's output reaches
 * `tools/list` closed (ggui#1333), so a host must cache a schema naming the
 * code before any server answers with it. No `PROTOCOL_VERSION` move.
 *
 * --------------------------------------------------------------------
 * The handshake suggestion names the card a judged hit proposes
 * (2026-09-25, additive, ggui#1336: MINOR, same draft stamp).
 * `BlueprintMeta.matchedIntent?` carries the stored intent the reuse judge
 * compared with the request, capped at `MATCHED_INTENT_MAX_CHARS` (280,
 * the judge's own truncation), so the agent (which holds the
 * conversation) can decline a proposal it reads as the wrong card. Present
 * only on a judged hit from the requesting app's own pool, never from a
 * pool shared across apps. DECLARED in this change, EMITTED one release
 * later: every output object reaches `tools/list` closed
 * (`additionalProperties: false`, ggui#1333), so a host that cached the
 * previous release's schema would refuse a member it did not name. The
 * member carries a `.describe()` naming its meaning and the decline path
 * (`forceCreate`), so the agent that receives it knows what it is for. The
 * `intent` input's description now says it is stored and shown to later
 * requests of the same app, and names the task, never the end user.
 * Kit: the `n1-compat` catalog gains the `handshake-suggestion` wire and
 * tag 9.1's cache-hit suggestion as a BACKWARD case. No
 * `PROTOCOL_VERSION` move.
 *
 * --------------------------------------------------------------------
 * The read-plane-only posture is normative, and graded (2026-09-24,
 * additive, ggui#1304: MINOR, same draft stamp). SPEC §7.10.6 states the
 * posture the reference server has run since ggui#537: a result publishes
 * the render locator on `structuredContent.resourceUri` and the same
 * value on `_meta.ui.resourceUri`, and carries neither the
 * `ai.ggui/render` slice nor a live-channel token; the locator's read
 * then mounts. A host that mounts the declaration-level shell against
 * such a server MUST answer that read, and a host that advertises
 * `serverResources` MUST answer `resources/read`. Kit: the new
 * `read-plane-only-conformance` catalog grades the server; the
 * host-helper catalog's H2 probe map gains `serverResources` →
 * `resources/read`. Kit, same row: the `bootstrap-protocol` fixtures
 * describe the live delivery paths (the inline global, the forwarded
 * tool result's top-level `_meta`), a new `tool-result-override` setup
 * directive drives the missing-slice failure, and that fixture expects
 * `MISSING_META_GGUI_BOOTSTRAP`, the spelling emitters send (§5.5.2 now
 * says so; `BOOTSTRAP_META_MISSING` names the same condition). No wire
 * shape moves. No `PROTOCOL_VERSION` move.
 *
 * --------------------------------------------------------------------
 * Host-declared gesture delivery (2026-09-24, additive, ggui#1309: MINOR,
 * same draft stamp). New exports: `GGUI_HOST_CAPABILITIES_HEADER`
 * (`ggui-host-capabilities`), `HOST_CAPABILITY_UI_MESSAGE_TURN`
 * (`ui-message-turn`), `parseHostCapabilitiesHeader`. A host's own code
 * declares the token on its MCP connection's header; `ggui_render` then
 * omits its `nextStep: ggui_consume` hint, so the agent ends its turn at
 * paint. Unknown tokens are ignored. No `PROTOCOL_VERSION` move.
 *
 * --------------------------------------------------------------------
 * A member-level clear on a theme write (2026-09-23, additive, ggui#1308:
 * MINOR, same draft stamp). New exports: `APP_THEME_CLEARABLE_MEMBERS`
 * (`mode`, `name`, `frameless`, `fonts`, `imagery` — the optional members
 * outside the attestation), `AppThemeClearableMember`,
 * `appThemeWriteSchema` / `AppThemeWrite` (the write form, where those
 * members also accept `null`), and `splitAppThemeWrite`. `appThemeSchema`
 * and `AppTheme` are unchanged and null-free. The #1124 refusal text names
 * the member-level clear for each clearable dropped member. The shared
 * writer's half (storing the split document, naming the cleared members)
 * lands WITH this (cloud). No `PROTOCOL_VERSION` move.
 *
 * --------------------------------------------------------------------
 * The card's spent `oneShot` names on the render slice (2026-09-23,
 * additive, ggui#1223: MINOR, same draft stamp).
 * `McpAppAiGguiRenderMeta.spentOneShots?: readonly string[]`, projected only
 * by `deriveRenderMeta` from the stored `ComponentGguiSession.spentOneShots`
 * record (`SpentOneShotsRecord` = `{ epoch, actions }`) — only when the
 * record's epoch is the projected card's, filtered to the names that card
 * declares `oneShot`. A consumed action re-served after a reload rendered
 * live again; the runtime now seeds its guard from the slice. New exports:
 * `spentOneShotsSchema`, `SpentOneShotsRecord`; the parser options gain
 * `onInvalidSpentOneShots` (a malformed value is dropped and named, never
 * fatal). Kit: the `render-meta` forward case carries the member. The store
 * write (ggui#1305) and the runtime seed land separately. No
 * `PROTOCOL_VERSION` move.
 *
 * --------------------------------------------------------------------
 * `actionSpec` on the static render slice (2026-09-23, additive, ggui#1178:
 * MINOR, same draft stamp). `McpAppAiGguiRenderMeta.actionSpec?: ActionSpec`,
 * projected only by `deriveRenderMeta` (component renders) and WHOLE, the
 * same value the live WS session carries. A runtime painting without a live
 * session frame (past the wsToken TTL, the pre-WS window, no live trio) held
 * `{}` and failed open: no `oneShot` guard, permissive validation. New
 * exports: `actionSpecReadSchema`, `parseActionSpecAtReadDoor`, and
 * `ActionSpecReadDoorResult`, the tolerant READ door that strips and names
 * unknown entry members (`actionEntrySchema` is `.strict()`, so a strict read
 * would drop the whole spec on a newer server's member). The parser options
 * gain `onInvalidActionSpec` and `onStrippedActionSpecMembers`. Kit: wire
 * `render-meta`, forward case. The runtime half (seed + the
 * `one-shot-unenforceable` trace) is rnd's, landing AFTER this. No
 * `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * Model registry: `anthropic/claude-opus-5-5`, `openai/gpt-6-sol`,
 * `openai/gpt-6-luna` (2026-09-23, additive, ggui#1252 — MINOR, same draft
 * stamp; the protocol half of the new-models support batch ggui#1251, WITH
 * cloud's LiteLLM re-vendor). Three `ModelId` rows + `MODELS.anthropic` /
 * `MODELS.openai` entries; all `active`, none in the lineup, no default
 * moves. Opus 5.5 4 / 20 / 5 / 0.2 (0.05× cache read), `maxTokens`
 * 1000000, `retireNotBefore` 2027-09-22; Sol 2 / 10 / 2.5 / 0.2 and Luna
 * 0.1 / 0.5 / 0.125 / 0.01, `maxTokens` 1050000 (the context window), no
 * retirement floor published. Every field quoted from the vendor page on
 * the issue. `mistralai/mistral-large-2512` leaves `MODELS.openrouter`
 * (retired upstream: LiteLLM dropped it, OpenRouter no longer lists it);
 * the route stays accepted by shape like any uncurated slug. Bedrock Opus
 * 5.5 is not registered (held). No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * Theme CARRY read (2026-09-17, additive, ggui#1155 — MINOR, same draft
 * stamp): `appThemeCarrySchema` / `AppThemeCarry` and
 * `appThemeGetResponseSchema` / `AppThemeGetResponse` — the REPRODUCE side
 * of the two-read-paths rule. A theme GET returns the stored document
 * VERBATIM (unknown members kept; a shape check over the named members,
 * never a strip) or `null`, with an optional `interpreted.stripped`
 * (`.min(1)`: present ⇔ at least one name) naming what an INTERPRET
 * reader would drop. Exists so a writer's carry cannot be turned into the
 * ggui#1124 defect by the reader it carries from. New exports only; no
 * existing shape changes. Kit: wire `app-theme-carry`, forward case.
 * --------------------------------------------------------------------
 * `ggui:dismiss` (2026-09-16, additive, ggui#1109 — MINOR, same draft
 * stamp): a user dismiss GESTURE forwarded from the card to its host as
 * an INTENT, on a new protocol-owned tag in the `ggui:` postMessage
 * family beside `ggui:lifecycle`. The card MUST NOT act on it (the host
 * owns what dismissal means) and emits at most one intent per gesture;
 * the host decides, and ignoring is CONFORMANT — so adoption breaks no
 * host. `reason` is extensibly-closed ('escape' today), and the type
 * guard validates SHAPE only: checking today's reason set would make a
 * release-N host silently drop a release-N+1 intent (§3.6). Not on
 * `ggui:observe` (a host may ignore telemetry by contract) and not a
 * `ui/notifications/*` name (a frozen external namespace).
 * --------------------------------------------------------------------
 * Motion tempo override (2026-09-16, additive, ggui#1093 P1c — MINOR,
 * same draft stamp; no WIRE change). The theming spec's §2.3 retirement
 * of per-app motion is AMENDED (protocol + rnd): layer-1 keeps the motion
 * SCALE, and the document may state a BOUNDED tempo override — `duration`
 * (fast/base/slow), `easing` (standard/emphasized/exit, each validated at
 * the door as a CSS keyword, cubic-bezier or steps) and `reduce` — the
 * standing `palette` has always had. The retired FREE-MAP ladders stay
 * refused and the door's guard test pins the narrower rule. Reversed, not
 * widened: §2.3's stated ground ("zero consumers today") expired when
 * ggui#1075 created the consumer.
 * --------------------------------------------------------------------
 * Theme DOCUMENT members (2026-09-16, additive, ggui#1093 P1b — MINOR,
 * same draft stamp; no WIRE change at all). `ThemeDocumentV2` and design's
 * `DtcgTheme` gain optional `typeScale` (five roles; `leading` is a ratio),
 * `rhythm` (bounded `base` + named steps) and `scrim`; they reach the card
 * through `deriveThemeVariables` → the overlay, so the wire's `AppTheme`
 * is untouched and this entry moves no stamp. Motion is NOT here: it would
 * reverse the theming spec's §2.3 layer-1 ruling and lands as ggui#1093
 * P1c with that reversal, co-signed.
 * --------------------------------------------------------------------
 * AppTheme carrier, wire half (2026-09-15, additive, ggui#1093 P1a —
 * MINOR, same draft stamp; #1075 Track C (a), closes #990's wire half).
 * Two OPTIONAL members on `appThemeSchema`: `fonts` (1..16 faces on
 * `fontFaceDeclarationSchema` — #987 §5's document grammar lifted into
 * the protocol; `@ggui-ai/project-config` imports it back, one grammar
 * for the document door and the wire) and `imagery` (`mark` / `hero` /
 * `pattern`, each `{ src https, alt? ≤ 200, tone? light|dark }`). Grammar
 * at the door, never fetched; outside the attestation (`OverlayHashInput`
 * unchanged). Belt fixtures moved to a synthetic `futureMember` because
 * `fonts` is now a named member.
 * --------------------------------------------------------------------
 * AppTheme read-door posture (2026-09-15, additive, ggui#1093 belt —
 * MINOR, same draft stamp; VERSION-POLICY §3.6 forward twin, ruled with
 * cloud). `appThemeReadSchema` + `parseAppThemeAtReadDoor`: READ doors
 * strip unknown TOP-LEVEL members, keep the overlays, name the stripped
 * keys; WRITE doors stay on the strict `appThemeSchema`. The render-meta
 * reader adopts it (`onStrippedThemeMembers`). The kit's `n1-compat`
 * catalog gains its first FORWARD case (`app-theme-read`). Wire bytes
 * unchanged; the belt under the #1093 carrier (`fonts?` / `imagery?`).
 * --------------------------------------------------------------------
 * `ggui_ops_generate_blueprint` gains `intent` (2026-09-13, additive,
 * ggui#1046 — MINOR, same draft stamp): the generation prompt as a
 * NON-identity field, bounded at `OPS_GENERATE_BLUEPRINT_INTENT_MAX_CHARS`
 * (2000); `seedPrompt` stays a variance key (cache identity). The handler's
 * silent placeholder is observable this release and refused next
 * (`prompt_required`). The kit's `n1-compat` catalog pins Release 2's
 * input (contract + seedPrompt, no intent).
 * --------------------------------------------------------------------
 * Generator profile widened (2026-09-13, additive, ggui#1058 — MINOR, same
 * draft stamp; founder's A2 "profile OVER engine"). Two optional members on
 * `appGenerationProfileSchema`: `effort` (one of five names — the wire
 * carries the name, the reader owns the dials table; an unavailable level
 * is refused `{ profile: { effort: 'unavailable' } }`, never downgraded) and
 * `aesthetic { id, version? }` (a grammar-checked reference into the
 * deployment's catalogue, resolved at read, unresolvable = non-fatal +
 * `profile_aesthetic_unresolved`). The kit's `n1-compat` catalog gains the
 * `generation-profile` wire (Release 2's three-member payload accepted).
 * --------------------------------------------------------------------
 * Generator profile member `direction` (2026-09-11, additive, ggui#1027
 * follower on the ggui#991 slot — MINOR, same draft stamp). A fourth
 * optional member on `appGenerationProfileSchema`: one variant's
 * COMPOSITION direction — what leads, what is left out, motion or none —
 * free text under the same `profileText` rule, door-bounded at
 * `APP_GENERATION_PROFILE_BOUNDS.direction = 600`, named by the refusal
 * body. §3.6 (N−1): a door on the previous release validates with the
 * `.strict()` schema that lacks the member and REFUSES a payload carrying
 * it, so the WRITER emits `direction` only where the reader is on this
 * line — the bootstrap lane composing variant profiles server-side in
 * the same publication holds it by construction; a console or platform
 * writer waits for the release carrying it. No `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * Rendering-context vocabulary: `renderingContextSchema` (2026-09-11,
 * additive, ggui#1000 — MINOR). The `{ shell, device, viewport? }`
 * vocabulary that lived as two hand-declared unions (mcp-server-core
 * `UiGenerateInput.rendering`, ui-gen `RenderingContext`) becomes ONE
 * schema here; both consumers now derive their type from it, and the
 * bootstrap door validates `items[].rendering?` with it. No existing wire
 * changes shape; no `PROTOCOL_VERSION` move.
 * --------------------------------------------------------------------
 * Generator profile slot: `appGenerationProfileSchema` (2026-09-10,
 * additive, ggui#991 — MINOR; the D7 mechanism of ggui#987). One new
 * schema on the app's `generation` section — `profile?: { styling?,
 * density?, layout? }`, free text, trimmed, door-bounded at
 * `APP_GENERATION_PROFILE_BOUNDS` (2000 / 200 / 200), control characters
 * refused — plus its refusal body. A generation-time input, never a
 * token; absent or empty leaves the generator's prompts byte-identical.
 * No existing type changes; readers and doors land with the #991 set.
 * --------------------------------------------------------------------
 * Theming revision — the overlay is the projection, the host owns runtime
 * mode (2026-09-10, ggui#987 — **BREAKING on the draft wave**, named by the
 * conformance kit: `protocol-conformance/src/theme-binding-conformance`
 * promoted today's pins in the prior commit, and this change fails them —
 * VERSION-POLICY §1.1; shipped under §1.4's `draft-` clause, §3.5's window
 * waived pre-v1.0). Founder rulings D1–D7 (2026-09-09/10), joint spec
 * `docs/superpowers/specs/2026-09-09-theming-revision-protocol-half.md`.
 * `appThemeSchema` v2: `overlays: { light, dark }` REQUIRED (the derived
 * projection for both modes — one producer, `@ggui-ai/design`'s
 * `deriveThemeVariables`), `overlayHash` REQUIRED (`canonicalOverlayHash`,
 * recomputed at every write door), `mode` optional and a DEFAULT only,
 * `name` a label; `base` DELETED with the registration tier (D2 = B). The
 * client projection of `themeMode` flips — `hostAnnounced ?? stamped ??
 * sessionSidecar` (D4 = A: M1 + M2, "follow the widget") — the server stamp
 * is unchanged; `themeId` loses its `sidecarName` leg. `AppThemeRefusalBody`
 * is the one write-door refusal shape. `parseMcpAppAiGguiRenderMeta` gains
 * `onInvalidTheme` so the read door is never silent. The render shell paints
 * `--ggui-color-ground` (the surface-layering roles of §2.1).
 * --------------------------------------------------------------------
 * Model registry: `openai/gpt-6-astra` (2026-09-09, additive, ggui#977 —
 * MINOR; Exp 008's founder-ruled second arm, ggui#972). One new `ModelId`
 * union member and one `MODELS.openai` allowlist entry; premium, active,
 * not in the lineup; costs 10 / 50 / 12.5 / 1.0 per 1M (input / output /
 * cache write / cache read), `maxTokens` 922000, tools — every field a
 * receipt on the issue; `retireNotBefore` unset (none published).
 * --------------------------------------------------------------------
 * Refusal registry v11 — the retail plan model retired (2026-09-08,
 * wire-code, pre-launch, ggui#960 — MINOR on the 0.16.0 draft wave; the
 * protocol half of the pricing publication ggui#949, WITH cloud's arm
 * deletion). Founder's ruling: one product, prepaid pay-as-you-go at flat
 * rates, trial and tiers retired, the welcome credit as the free entry.
 * Eleven codes lose their emitting arms and retire in the same slice —
 * render-gate `trial_exhausted`, `trial_expired`, `app_canceled`
 * (`RENDER_GATE_REFUSAL_CODES` 14 → 11); owner-api `subscription_exists`,
 * `no_subscription`, `subscription_unchanged`, `portal_unavailable`,
 * `card_update_unavailable`, `managed_app_no_portal`,
 * `managed_app_no_card_update`, `managed_app_no_checkout` (9 → 1: the
 * prepaid wallet's one Stripe surface is the top-up, user-scoped). Four
 * rows re-described in the new model's words: `billing_path_missing`,
 * `model_not_allowed` (per-account grant), `checkout_unavailable`
 * (top-ups), `insufficient_credit` (pool or BYOK). New typed exports
 * `OWNER_API_REFUSAL_CODES` + `OwnerApiRefusalCode`. Not breaking under
 * §2: pre-launch draft wave, every retired code had lost its emitter in
 * the same publication; the kit's non-render-surface case re-aims to the
 * surviving owner-api code. `managed_default_cap_exceeded` stays (ggui#965).
 * --------------------------------------------------------------------
 * Blueprint provenance de-modeled (2026-09-06, wire-tightening, pre-launch,
 * ggui#924 — MINOR; half of ggui#923, one WITH publication across six
 * lanes). `LlmBlueprintSource.generator` is the identity `ui-gen-<tier>`
 * (one tier token — `ui-gen-default` / `ui-gen-advanced` / an operator
 * tier; `GENERATOR_ID_PATTERN`, `isGeneratorId`) and `model` is the run's route
 * in the registry's spelling (`ModelRef` = `<prefix>/<model>`, composed only
 * by `modelRefOfRoute`, recovered by `parseModelRef`; registry `ModelId`s
 * are the subset — a self-hoster's bedrock/OpenRouter route is a ref the
 * registry does not list; `MODEL_IDS`, `isModelId` narrow to the subset).
 * Before: both were `string`, and the identity embedded the model
 * (`ui-gen-default-haiku-4-5`) — a model retirement (Haiku 4.5,
 * 2026-10-15) would rename the identity against every stored record.
 * `parseBlueprintSource` and `llmBlueprintSourceSchema` refuse a modeled
 * identity and a bare model name; the handshake draft's `generator` hint
 * and the operator tools' `generator` inputs take the same grammar. No
 * alias, no dual-read (pre-launch): a row written before the rename reads
 * as no provenance; stores reseed. Not breaking under VERSION-POLICY §2
 * (no kit fixture asserts a modeled id or a bare model); MINOR under §1.2
 * as a schema tightening on the 0.16.0 draft wave. Post-launch this would
 * be a MAJOR with a migration doc and a dual-read shim — the reason it
 * ships now.
 * --------------------------------------------------------------------
 * Five phantom numeric codes retired-reserved + the emitter census
 * (2026-09-06, wire-code, pre-launch, ggui#910 — PATCH). `CAPABILITY_DENIED`
 * (-32005), `GENERATION_QUOTA_EXCEEDED` (-32010), `APP_LIMIT_EXCEEDED`
 * (-32011), `CONCURRENT_SESSION_LIMIT` (-32012) and the numeric
 * `CONTRACT_VIOLATION` (-32020 — the census found it once the gate
 * existed; the live `CONTRACT_VIOLATION` is a string on the channel and
 * the Plane-3 render error, and tools/call has Plane-2
 * `contract_violation`) were declared,
 * SPEC-fenced and mirrored into four tables, and emitted by nothing
 * first-party — a census by constant and by number over oss/packages,
 * cloud and backend. The constants leave; the numbers stay reserved
 * (SPEC §7.9); an unauthorised key is a bare 403 carrying -32007; quota,
 * app-limit and concurrency states are refusals or implementation-range
 * codes. Cheap only before launch: after the `draft-` rule flips each
 * removal would be a MAJOR with a migration doc. The mirrors gate now
 * also asserts the inverse — every declared non-standard code has a
 * first-party emitter (one `git grep` per code; seeded self-test) — so a
 * phantom cannot be declared again silently. Pinned by
 * `types/__tests__/retired-error-codes.test.ts` (eight retired numbers).
 * Not breaking under VERSION-POLICY §2; PATCH under §1.3.
 * --------------------------------------------------------------------
 *
 * --------------------------------------------------------------------
 * `-32013 RATE_LIMIT_EXCEEDED` retired-reserved (2026-09-06, wire-code,
 * pre-launch, ggui#890 — PATCH). After ggui#886 (the per-app cap denies as
 * the registry's `app_rate_limited` refusal) and the `RateLimitedError`
 * deletion, no first-party implementation emits the number: the reference
 * server refuses in-band, the hosted transport's only 429 is a per-IP
 * backstop with no JSON-RPC body. The constant leaves
 * `PLATFORM_ERROR_CODES` and SPEC §7.9's platform fence; the number stays
 * reserved (the `-32001` / `-32004` convention) so no future canonical code
 * reuses it. Not breaking under VERSION-POLICY §2 — no kit fixture asserts
 * it; PATCH under §1.3. Pinned by `types/__tests__/retired-error-codes.test.ts`
 * (no constant declares a retired number; no tracked source emits one) and
 * by the mirrors gate, which reds the docs tables' rows until they leave
 * in the same publication.
 *
 * --------------------------------------------------------------------
 * The registries export their literal-typed rows (2026-09-06, types-only,
 * pre-launch, ggui#889 — PATCH). `PRE_GENERATION_REFUSAL_CODES` and
 * `DOMAIN_ERROR_REGISTRY` are the normalized views (`Record<Code, Row>`),
 * which erase the per-key literal the `const` definers preserve — so a
 * producer that must satisfy a wire enum from a row had to parse it
 * through the enum (ggui#886). `PRE_GENERATION_REFUSAL_ROWS` and
 * `DOMAIN_ERROR_ROWS` are the SAME objects with the literal types kept:
 * each row's `code` is typed as its own key. No wire change;
 * the kit's registry-completeness catalog reads the normalized view as
 * before. Not breaking under VERSION-POLICY §2; PATCH under §1.3.
 *
 * --------------------------------------------------------------------
 * Plane-2 slugs lead the wire text (2026-09-06, wire-text, pre-launch,
 * ggui#880 — MINOR). SPEC
 * §7.9 promised "the `code` field on each class is the wire literal"
 * while the MCP SDK ships every thrown handler error to the agent as
 * `{content: [{type: 'text', text: error.message}], isError: true}` and
 * nothing else — executed against the built server: `session_not_found`
 * and `handshake_not_found` reached neither a field nor the text, and
 * descriptions, presets and the SPEC taught agents to branch on them.
 *
 *   de1. **`DomainError` base** (`errors/domain-error.ts`) — the ONLY
 *      composer of a Plane-2 error's `message`: `${code}: ${detail}`.
 *      Refuses an empty detail and a detail that begins with any
 *      registered domain OR refusal code + `': '`
 *      (`DomainErrorDetailCollisionError`, a `TypeError` the emitter's
 *      own suite sees — never the wire); a tool-name prefix is prose.
 *      `isDomainError` detects by `Symbol.for('ai.ggui.domainError')`
 *      marker + shape, never `instanceof`; `parseDomainErrorText` is
 *      the reader side.
 *   de2. **`DOMAIN_ERROR_CODES` registry** (`types/domain-error-codes.ts`)
 *      — the CLOSED Plane-2 set, fifteen rows from the executed census,
 *      each with the data-plane `tools` that emit it, a `recovery` class
 *      (`retry-same-id` | `re-mint` | `later`), an `emitter` and a
 *      self-hoster `description`. Pinned disjoint from
 *      `PRE_GENERATION_REFUSAL_CODES` (one code, one plane). SPEC §7.9's
 *      Plane-2 table is its mirror (pinned from the registry's own suite):
 *      the four phantom classes the table listed (`ContractRequiredError`,
 *      `ContractHashMismatchError`, `UnknownActionToolError`,
 *      `EventNotAllowedError`) are gone; `cross_reference_unresolved` /
 *      `contract_schema_invalid` are not wire codes (no caller throws
 *      them — the lint gate throws `contract_validation_failed`).
 *   de3. **The two protocol-owned emitters extend the base** —
 *      `ContractViolationError` (`contract_violation`; `toErrorData()`
 *      keeps its `{error, tool, violations, hint, propsSchemaHash?}`
 *      shape) and `ContractValidationError` (`contract_validation_failed`,
 *      phase + issues kept). Consumers detecting them by `instanceof`
 *      are unchanged; their message now leads with the slug.
 *   de4. **The wire plane is the MCP spec's** — a Plane-2 failure is a
 *      tool RESULT with `isError: true`, never a JSON-RPC error frame;
 *      no `structuredContent` (the SDK client validates it against the
 *      tool's `outputSchema` whenever present, so a typed envelope would
 *      demote every success field to optional — refused). SPEC §7.9.1:
 *      `SESSION_NOT_FOUND` (-32002) is the live-channel / runtime Plane-1
 *      code; on `tools/call` the same state is `session_not_found`.
 *   de5. **The conformance kit's first `tools/call` driver** — catalog
 *      `domain-error`: six no-setup scenarios (unknown `handshakeId` on
 *      `ggui_render`; unknown `sessionId` on `ggui_consume` /
 *      `ggui_get_session` / `ggui_update` / `ggui_amend` / `ggui_emit`)
 *      graded on the raw result via `runConformance({ toolCallDriver })`
 *      / `--tool-call-driver <module>`. Before this wave every first-party
 *      server failed all six on `slug-leads`.
 *
 * Conformance-kit verdict: not breaking under VERSION-POLICY §2 — no
 * prior fixture asserts Plane-2 text; the leading slug is additive to
 * prose and the new catalog is an addition. MINOR under §1.2 (new
 * exported base, registry and kit catalog); rides the 0.16.0 wave. The
 * adoption of the base by the handler / core / mcp-server classes lands
 * WITH this entry (oss's half of ggui#880); until both are on a server,
 * that server fails the catalog — which is the point.
 *
 * --------------------------------------------------------------------
 * The pending-event row is a schema (2026-09-06, store-boundary, pre-launch,
 * ggui#839 — the #817 C2 follower; cite `3f3d86b86`). The consume pipe's
 * stored row — what `submit_action` / the WS ingress append and
 * `PendingEventConsumer.consumeAndClear` drains — was a hand-written
 * interface the adapters typed as `Record<string, unknown>` and the consume
 * handler coerced with defaults; nothing validated it. A store-boundary
 * contract (producers ↔ adapters ↔ the consume handler), never wire:
 * `ggui_consume` returns the entries, never the wrapper.
 *
 *   pe1. **`pendingEventSchema` + `PendingEvent` derived** —
 *      `{ id: string.min(1), envelope: consumeEventEntrySchema, createdAt:
 *      string }`; `createdAt` stays a string (the relay copies a client
 *      `firedAt` the ingress accepts as a diagnostic).
 *   pe2. **`sequence` deleted** — zero writers (both producers append
 *      `{id, envelope, createdAt}`; sqlite's `seq` never joined the row;
 *      the pod stores the literal), zero readers (the only read was the
 *      handler's own default-to-0), named in neither SPEC nor the kit.
 *   pe3. **`id` required and non-empty** — the drain_ack key and the
 *      idempotency key per `(sessionId, id)`; the id-less append branches
 *      (core docstring, in-memory, sqlite, the pod's `ddb.ts`) deleted in
 *      the same publication.
 *   pe4. **No string envelope arm** — every writer passes the object; a
 *      store that serializes the whole row. `parsePendingEnvelope`
 *      collapsed into the row parse (`envelope-adapters.ts` deleted).
 *   pe5. **`PendingEventMalformedError` + the per-adapter failure mode** —
 *      `consumeAndClear` MUST NOT return a row that fails the schema and
 *      MUST NOT drop a well-formed row because a sibling failed: a
 *      transactional drain (sqlite) refuses whole and rolls back; a
 *      destructive drain (DynamoDB) quarantines per row with a
 *      `pending_event_malformed` structured log; in-memory holds the typed
 *      struct it validated on append. `append` refuses a malformed row
 *      before storing it. The consume handler maps the error to a
 *      `HandlerFailure` carrying `{ events: [], status }`, never a JSON-RPC
 *      error, and the parse runs before any `drain_ack` fires.
 *
 * Conformance-kit verdict: not breaking under VERSION-POLICY §2 — the kit
 * never names the wrapper (`git grep PendingEvent -- oss/packages/protocol-conformance`
 * = 0); its only `sequence` is the `action-ack-sequence` fixture's WS ack
 * `payload.sequence`, the ledger's `appendEvent` seq, never the pipe row's
 * deleted field. The observable
 * violation is `@ggui-ai/mcp-server-core`'s published contract-tests suite
 * (a seeded malformed row is refused or quarantined per form). PATCH-class
 * under §1.3 for `@ggui-ai/protocol`; rides the 0.16.0 wave.
 *
 * --------------------------------------------------------------------
 * The endpoint-level refusal carries the app as DATA (2026-09-05, wire
 * field, pre-launch, ggui#870 — the ggui#782 ↔ guuey#708 re-sitting's
 * D6, guuey#836's blocker). `transportRefusalSchema` — what rides
 * `error.data.refusal` on a per-app endpoint's typed 403 (ggui#825/#836)
 * — was strict `{ code, message, fix, retry }` with the app named only
 * in `message`; a tenant's repair loop cannot parse prose safely.
 *
 *   ai1. **`data.refusal.appId: string` — REQUIRED** — the app id the
 *      refused endpoint serves, equal to the endpoint path's `{appId}`.
 *      The ggui id the bound caller already holds, never the tenant's
 *      own `ownerRef`; the tenant maps it to its own id from the
 *      `gguiAppId` it stored at create. Required, not optional: a field
 *      a repair loop cannot rely on is a hope, not a contract.
 *
 *   ai2. **Who receives the typed face** (the fact from the pod's code,
 *      ggui#812 identity-first): a correctly bound federated identity
 *      only — an anonymous request is refused by the auth adapter as
 *      401 before this arm and learns nothing about the app; a native
 *      key mismatch gets the bare default-deny 403. SPEC §7.1's
 *      endpoint paragraph says so now; the anonymous typed face is
 *      deliberately not a contract (it would trade disclosure).
 *
 * Conformance-kit verdict: BREAKING by the letter of VERSION-POLICY §2 —
 * the kit's `transport-refusal` cases now carry `appId` and the strict
 * schema refuses a projection without it, so an emitter built against
 * 0.15.0 fails the 0.16.0 kit — and, the wire being `z.strictObject`, a
 * 0.15.0 STRICT reader of the body is failed by a 0.16.0 emitter too
 * (zero such readers exist today; guuey's is step 3, not started). Shipped under §1.4's `draft-` clause in
 * the 0.16.0 wave; the pod's emitter (cloud, ggui#870's other half)
 * lands WITH this change, after the tombstone fix for ggui#785/G26.
 *
 * Package version — classification MADE here: MAJOR-class change carried
 * by a MINOR wave under `draft-` (§1.4) for `@ggui-ai/protocol` and
 * `@ggui-ai/protocol-conformance`. PROTOCOL_VERSION unchanged — no WS
 * envelope moved.
 *
 * --------------------------------------------------------------------
 * Two refusal codes lose the word "tier" (2026-09-05, rename, pre-launch,
 * ggui#802 — #786 review finding F6). A code name ships to npm and, for a
 * render-gate code, reaches every self-hoster's LLM as JSON-Schema enum
 * metadata on `tools/list`; "tier" names a plan ladder a self-hoster does
 * not have (docs/principles/oss-purity.md, the type-literal class). Ruled
 * by a three-lens judge panel under the registry's naming rules:
 *
 *   rt1. **`model_not_in_tier` → `model_not_allowed`** (render-gate,
 *      after-fix, fixBy caller) — the state the row's own description,
 *      the kit case's `fix` and SPEC §7.9 already name ("not among those
 *      the app is allowed to use"); subject-first like the rest of the
 *      registry; true on a deployment with one allow-list per app and no
 *      prices. Not `model_not_available`: `*_unavailable` is this
 *      registry's `later` / operator class, the wrong retry class for the
 *      one code an agent may act on itself.
 *
 *   rt2. **`already_on_tier` → `subscription_unchanged`** (owner-api,
 *      after-fix, fixBy owner) — the owner-api noun the registry already
 *      uses (`subscription_exists`, `no_subscription`); the state is
 *      "requested == held", no ladder word.
 *
 *   rt3. `tier_unrecognized` is NOT a registry code (deleted from the
 *      wire at registry v9): a backend allowance state read by the
 *      console, whose column is literally `tier`. Unchanged.
 *
 * Conformance-kit verdict: BREAKING by the letter of VERSION-POLICY §2 —
 * the kit's `refuse-after-fix-caller` case pinned the old name, so an
 * emitter built against 0.15.0 fails the 0.16.0 kit's `renderRefusalSchema`
 * enum. Shipped under §1.4's `draft-` clause (semver describes intent
 * pre-v1) in the 0.16.0 wave, with the changelog's Unreleased section
 * naming the move; every mirror moves in one change (the kit case, SPEC,
 * the docs, the console's copy, the backend's owner-api refusals, the pod's
 * emitter, cs macros). The registry's purity pin now allows NO code name to
 * carry plan-tier vocabulary — the grandfather list is gone.
 *
 * Package version — classification MADE here: MAJOR-class change carried
 * by a MINOR wave under `draft-` (§1.4) for `@ggui-ai/protocol` and
 * `@ggui-ai/protocol-conformance`, pre-1.0 and pre-launch.
 * PROTOCOL_VERSION unchanged — no WS envelope moved.
 *
 * --------------------------------------------------------------------
 * `UNAUTHORIZED` moves from `-32001` to `-32007` (2026-09-05, renumber,
 * pre-launch, ggui#853; found by ggui-main in the prod skew-gate log).
 * `-32001` is the MCP SDK client's own `ErrorCode.RequestTimeout`
 * (`@modelcontextprotocol/sdk` types.js, beside `ConnectionClosed`
 * -32000) — minted LOCALLY, never sent by a server — so a client reading
 * the number could not tell a server's UNAUTHORIZED from its own
 * timeout: the class ggui#836 closed for -32000, on a number ggui had
 * chosen long before #836 (0.14.0 and earlier).
 *
 *   uc1. **`MCP_ERROR_CODES.UNAUTHORIZED = -32007`** — the next free
 *      canonical slot per this table's own note; `-32001` joins
 *      `-32004` as retired-reserved. Every mirror moves in this one
 *      change (SPEC §7.9 + its table, the gated doc mirrors, the
 *      endpoint routes' tests, the kit's transport-refusal wording, the
 *      pod's auth arm, the live journeys). HTTP status and message are
 *      unchanged: 401/403 + the same text.
 *
 *   uc2. **The guard #836 lacked** — `types/error-codes-vs-sdk.test.ts`
 *      pins every ggui-chosen code (`MCP_ERROR_CODES` minus the five
 *      JSON-RPC standard codes, plus `PLATFORM_ERROR_CODES`) disjoint
 *      from every code the SDK's `ErrorCode` enum owns, and ggui's
 *      copies of the standard five equal to the SDK's. It was RED on
 *      -32001 before uc1 and is what reds the next collision.
 *
 * Conformance-kit verdict: no fixture on 0.15.0 pinned `-32001` (the
 * transport-refusal catalog grades `-32003 + data.refusal` and `null`;
 * its prose named -32001 and now names -32007) — a renumbered
 * canonical code with no kit regression; guuey's clients branch on
 * -32002/-32006 only (ggui#836 record). Bytes on the wire: one number.
 *
 * Package version — classification MADE here: MINOR for
 * `@ggui-ai/protocol` and `@ggui-ai/mcp-server` (a canonical code
 * renumbered, `draft-` intent per VERSION-POLICY §1.4), pre-1.0 and
 * pre-launch. PROTOCOL_VERSION unchanged — no WS envelope moved.
 *
 * --------------------------------------------------------------------
 * SPEC §7.1's refused arm is ONE primitive (2026-09-05, additive,
 * pre-launch, ggui#803 leg 9). The tool result a render gate answers a
 * pre-generation refusal with was built by hand in
 * `@ggui-ai/mcp-server-handlers` (`buildRenderRefusalText` + an inline
 * `{ outcome: 'refused', refusal }`), the conformance kit carried its
 * own reference, and the reference server could not project it at all
 * — so the reference server was not a reference for the refused
 * envelope, and a third hand-built copy there would only have re-graded
 * the kit's reference.
 *
 *   rr1. **`projectRenderRefusal(refusal): RenderRefusalResult`** (new
 *      export, `envelopes/render-refusal.ts`) — `isError: true`,
 *      `content[0].text` = `<code>: <message> <fix>`, `structuredContent`
 *      = `{ outcome: 'refused', refusal }` typed as **`RefusedRenderOutput`**
 *      (`z.infer<typeof refusedOutputSchema>`, new export), no `_meta`.
 *      Pure and synchronous. The four facts have one source.
 *
 *   rr2. **Consumers**: `mcp-server-handlers`' `ggui_render` builds the
 *      refused result here (its local builder, inline object and
 *      `RenderRefusedOutput` alias are deleted — no shim); the
 *      reference server supplies the kit's `refusalProjector` from the
 *      same primitive at the kit's stringly boundary (a code off
 *      `RENDER_GATE_REFUSAL_CODES` → `null`; anything else parsed by
 *      `renderRefusalSchema`), so its six `refusal-envelope/*` rows are
 *      GRADED, not skipped. The kit's own hand-built reference stays as
 *      the second source that catches the primitive drifting.
 *
 * Conformance-kit verdict: no new kit entry — the six `refusal-envelope`
 * cases already grade exactly these four facts; what changed is that
 * two implementations now answer them through one function, and the
 * reference server's exact-set assertion moved the rows from SKIPPED to
 * PASSING. Bytes on the wire: unchanged.
 *
 * Package version — classification MADE here: MINOR for
 * `@ggui-ai/protocol` (two new exports, additive) and for
 * `@ggui-ai/mcp-server-handlers` (same result, one source), pre-1.0 and
 * pre-launch. PROTOCOL_VERSION unchanged — no WS envelope moved.
 *
 * --------------------------------------------------------------------
 * Authorization refusals carry JSON-RPC `data` (2026-09-05, additive,
 * pre-launch, ggui#825). `@ggui-ai/mcp-server`'s per-app `authorize`
 * hook refuses by throwing, and the route answered every throw with a
 * bare `403 {code: -32000, message: "Forbidden"}` — correct in effect,
 * illegible to a client that needs to tell "this app is no longer served" from
 * "your credential is wrong".
 *
 *   ar1. **`ErrorMapperResult.data?: JsonValue`** — a deployment's
 *      `errorMapper` may attach JSON-RPC 2.0 error `data` (any JSON
 *      value) to a mapped result; serialized verbatim on `error.data`,
 *      omitted when absent. Applies to every mapped error, not only
 *      authorization refusals.
 *
 *   ar2. **The per-app authorization refusal consults the mapper**,
 *      bounded to 401 / 403: a mapper answering any other status, or
 *      throwing, is ignored and logged (`per_app_authorize_mapper_out_
 *      of_bounds` / `error_mapper_failed` on the route logger) and the
 *      default-deny 403 stands byte-identical to a deployment with no
 *      mapper. The allow path never consults the mapper.
 *
 * Conformance-kit verdict: no kit entry required — an optional field on
 * an operator-side hook result, no MCP tool name/shape touched; the
 * shape of any `data.refusal` a deployment chooses to attach is that
 * deployment's declaration, not this package's.
 *
 * Package version — classification MADE here: MINOR for
 * `@ggui-ai/mcp-server` (new optional field on `ErrorMapperResult` +
 * the authorization refusal path consults `errorMapper`), pre-1.0 and
 * pre-launch. PROTOCOL_VERSION unchanged — no WS envelope moved.
 * --------------------------------------------------------------------
 * Authored source rides blueprint reuse (2026-08-14, additive,
 * pre-launch). Cache-reuse renders (a repeated prompt semantic-matches
 * a cached blueprint) previously committed without authored
 * `sourceCode` — structurally, not incidentally: the reuse-commit path
 * never carried it, and blueprint registry rows never persisted it, so
 * `ggui_get_render_source` always returned `render_source_unavailable`
 * for every reuse render.
 *
 *   sc1. **`Blueprint.sourceCodeHash?: string`** added to
 *      `@ggui-ai/protocol` — content hash (`CodeStore.hashOf`) of the
 *      AUTHORED, pre-compile source body, distinct from the existing
 *      `codeHash` (compiled `componentCode`). The body itself is never
 *      stored on the row — persistent adapters keep vector/metadata
 *      rows small and content-address the body through the same
 *      `CodeStore` seam `codeHash` already implies. Absent on legacy
 *      rows and on blueprints with no authored form distinct from
 *      their compiled output.
 *
 *   sc2. **Registration threads it through.** `registerBlueprint`
 *      (`@ggui-ai/mcp-server-handlers`) gains an optional
 *      `sourceCode` input; when present, distinct from the compiled
 *      `componentCode` (fallback-collapse symmetry — a byte-identical
 *      pair is never worth persisting, since the read-side envelope
 *      guard would reject it anyway), and a `CodeStore` is bound, the
 *      registry computes + persists `sourceCodeHash` on the row and
 *      writes the body through the durability `CodeStore` (body-
 *      before-row ordering, same orphan-body-beats-dangling-pointer
 *      posture as the existing compiled-code write). New durability
 *      event `blueprint_source_write_failed` (additive, sibling to
 *      `blueprint_code_write_failed`) on a failed body write — the row
 *      still commits with the hash; a reuse read against a missing
 *      body degrades gracefully to `render_source_unavailable`, never
 *      an error.
 *
 *   sc3. **Reuse commit threads it back.** The cache-hit reuse branch
 *      resolves the body from `CodeStore` by the stored hash and
 *      stamps it onto `GenerationCacheHit.sourceCode`, which
 *      `commitCachedGguiSession` sidecars onto the render exactly like
 *      the cold-gen commit path already does — reuse renders now serve
 *      `ggui_get_render_source` identically to cold-gen renders.
 *
 * Conformance-kit verdict: no kit entry required — additive optional
 * fields + a new durability event, no existing wire shape changed, no
 * MCP tool name/shape touched.
 *
 * Package version — classification MADE here: PATCH for
 * `@ggui-ai/protocol` (additive optional field, no new export),
 * MINOR for `@ggui-ai/mcp-server-handlers` (new optional input field +
 * new event), pre-1.0 and pre-launch. PROTOCOL_VERSION unchanged.
 * --------------------------------------------------------------------
 * ops-blueprint appId input + app-access seam (2026-08-14, additive,
 * pre-launch, ggui#501). Cross-app curation seam for the operator-
 * class blueprint family — the prerequisite for the family mounting
 * beyond the OSS default server.
 *
 *   ob1. **Optional `appId` input** on all five `ggui_ops_*_blueprint`
 *      tools (`generate`, `register`, `list`, `update`, `delete`).
 *      Omitted ⇒ resolves to the caller's bound `ctx.appId` (unchanged
 *      default behavior). Present ⇒ the tool curates the NAMED app
 *      instead, subject to the authorizer below.
 *
 *   ob2. **`authorizeAppAccess` dep seam**
 *      (`OpsBlueprintAppAuthorizer`, exported from
 *      `@ggui-ai/mcp-server-handlers`'s ops-blueprint barrel):
 *      consulted via `resolveEffectiveAppId` on every resolution,
 *      bound or unbound `appId` input alike. Seam unbound ⇒ legacy
 *      bound-only posture — a cross-app `appId` input (different from
 *      `ctx.appId`) rejects with the new `cross_app_curation_unavailable`
 *      named code, mirroring the `app_scoped_keys_unavailable` idiom
 *      from the 2026-07-29 ops slice. Seam bound and denying ⇒
 *      `app_curation_denied` with a `not_found` / `not_owner` reason.
 *      `@ggui-ai/mcp-server`'s default server binds an allow-all
 *      authorizer when the operator supplies none — the
 *      single-operator trust model: whoever runs the server operates
 *      every app on it.
 *
 *   ob3. **Deployment boundary retired.** The restriction that pinned
 *      this family to the OSS default server only (2026-08-13 ruling,
 *      ggui#496) is retired: the family now mounts on any control
 *      plane whose deployment supplies the store/search/authorizer
 *      deps. Single-operator deployments bind an allow-all
 *      authorizer; multi-user deployments supply one that enforces
 *      their ownership model.
 *
 * Conformance-kit verdict: ops tools are not conformance-kit surface —
 * NO protocol stamp roll.
 *
 * Package version — classification MADE here: MINOR for
 * `@ggui-ai/protocol`, `@ggui-ai/mcp-server-handlers`,
 * `@ggui-ai/mcp-server` (additive), pre-1.0 and pre-launch.
 * PROTOCOL_VERSION unchanged.
 * --------------------------------------------------------------------
 * `ggui_get_render_source` data-plane tool (2026-08-14, additive,
 * pre-launch, ggui#282). New bare-wire-name MCP tool, `agent`
 * audience — the calling app reads the generated source of its OWN
 * render as `{sessionId, blueprint: {source, contract?,
 * fixtureProps?}}`. New input shape `getRenderSourceInputShape`
 * (mirrors `getSessionInputShape`) and output type
 * `GguiGetRenderSourceOutput` added to `@ggui-ai/protocol`; new
 * factory `createGguiGetRenderSourceHandler` (modeled on
 * `createGguiGetSessionHandler` — same tenancy posture via
 * `ctx.appId`, no heartbeat) plus the shared
 * `buildRenderSourceEnvelope` helper added to
 * `@ggui-ai/mcp-server-handlers`. The pre-existing control-plane
 * `ggui_ops_get_render_source` (cloud-only, connector-key tenancy —
 * a different caller, unchanged contract) now imports the SAME
 * shared helper so the two tools' envelope shape cannot drift apart;
 * a behavior-neutral refactor pinned by an envelope-equivalence test.
 * No existing wire shape changed.
 *
 * Conformance-kit verdict: no kit entry required. The kit's WS
 * live-channel conformance surface (`@ggui-ai/protocol-conformance`)
 * has zero enumeration of MCP tool names anywhere in its source —
 * verified by grepping the package for `ggui_` tool-name references
 * outside its fixtures/tests, which returns nothing; it grades
 * `GguiSessionChannelServer` wire-frame behavior (ack/error/data,
 * echoed requestId, session-state read-back), a surface this
 * addition never touches.
 *
 * Package version — the classification is MADE here, not deferred:
 * MINOR for `@ggui-ai/protocol` (new exports, additive) and
 * `@ggui-ai/mcp-server-handlers` (new factory + shared helper,
 * additive), pre-1.0 and pre-launch. PROTOCOL_VERSION is unchanged —
 * no WS envelope moved.
 * --------------------------------------------------------------------
 * MCP tool bindings & discovery (2026-08-10, additive, pre-launch,
 * ggui#259). Artifacts gain an optional MCP tool-binding list and
 * registry search gains a tool dimension, connecting the two
 * namespaces the registry serves: signed UI artifacts and the MCP
 * tools they render. SPEC §7.7.4.1 is the normative home.
 *
 *   tb1. **`mcpTools` on both manifest kinds**
 *      (`@ggui-ai/artifact-manifest`): 1–16 `{server?, tool}`
 *      entries, charset `/^[A-Za-z0-9_.-]{1,128}$/`,
 *      exact-duplicate `(server, tool)` pairs rejected with the
 *      existing `manifest_invalid` code. Declared wins entirely;
 *      a blueprint without the field derives bare `{tool}` entries
 *      from the union of its contract's per-prop `sourceTool` and
 *      `streamSpec` `source.tool` names (`resolveMcpToolBindings`,
 *      marked `derived`). Bindings are search metadata only — they
 *      never enter contract canonicalization or `blueprintKey`.
 *      NOTE: manifest schemas are strict-rooted, so an OLDER
 *      manifest parser REJECTS a manifest file carrying the field —
 *      the optionality guarantee below is wire-response-scoped
 *      (search/read), not manifest-file-scoped.
 *
 *   tb2. **Registry wire additions** (`@ggui-ai/registry-core`),
 *      all optional: `SearchResultEntry` += `mcpTools?`,
 *      `mcpToolsSource?: 'declared' | 'derived'`,
 *      `scopeVerification?: 'verified' | 'unverified'`,
 *      `verifiedDomain?`; the single-version read response += the
 *      same two verification fields; search input += `tool?` /
 *      `server?` exact filters (AND-composed with the existing
 *      filters, `matchesMcpToolFilters` semantics; an invalid
 *      charset value is the existing `invalid_request` 400).
 *      Pre-existing consumers see `undefined` and behave as before.
 *
 *   tb3. **Agent surface** (`@ggui-ai/mcp-server-handlers`):
 *      `ggui_search_blueprints` gains an opt-in `registry` source
 *      merged after the local sources; unreachable / timeout /
 *      unparseable-body answers degrade typed —
 *      `degradedSources: [{source: 'registry', reason:
 *      'unreachable' | 'timeout' | 'invalid_response'}]` — never a
 *      tool failure, never a thrown error.
 *
 * Conformance-kit verdict: additive, minor-intent while `draft-`,
 * so PROTOCOL_VERSION is unchanged — no WS envelope moved; the
 * change is confined to the manifest, registry HTTP, and MCP
 * tool-result surfaces. The new `binding-conformance` catalog in
 * `@ggui-ai/protocol-conformance` (`runBindingResolutionCases` /
 * `runBindingFilterCases`) arbitrates resolution precedence and
 * filter semantics; search/read response optionality is pinned by
 * registry-core unit tests, because the strict-rooted manifest
 * schema makes a manifest-file optionality fixture false (tb1).
 *
 * Package version — the classification is MADE here, not deferred:
 * MINOR for the `@ggui-ai/*` wave, additive under the version
 * policy's minor rule (every fixture that passed against the
 * current wave still passes; the delta is new surface), pre-1.0
 * and pre-launch. FOUR packages carry minor-class changes into
 * that wave — `@ggui-ai/artifact-manifest` (the field + resolver),
 * `@ggui-ai/registry-core` (wire + filters),
 * `@ggui-ai/mcp-server-handlers` (the registry source), and
 * `@ggui-ai/protocol-conformance` (the catalog that decides them).
 * Only the mechanical write is deferred: every `@ggui-ai/*`
 * package carries ONE wave version, so the release owner takes all
 * four bumps together at the next wave cut.
 * --------------------------------------------------------------------
 * Typed `resources/read` failures (2026-08-09, additive, pre-launch,
 * ggui#430). A read of a render locator
 * (`ui://ggui/render/{sessionId}/{blueprintKey}`) gains a closed failure
 * union and a canonical JSON-RPC number, so the read has exactly two
 * exits: a live mount, or a typed error. Before this, an unresolvable
 * read returned a SUCCESS-shaped result carrying a loading shell that
 * would never come alive — the same class of defect ruling B fixed for
 * `ggui_render`, on the resource surface instead of the tool surface.
 *
 *   rr1. **New closed enum `ResourceReadErrorCode`** = NOT_FOUND |
 *      BLUEPRINT_UNRESOLVABLE | NOT_SUPPORTED | NOT_MOUNTABLE, with
 *      `resourceReadErrorSchema {code, message, detail?}`. Deliberately
 *      NOT an extension of `renderErrorCodeSchema` (rb2): that enum
 *      classifies a `ggui_render` tool call that ran and failed and
 *      rides IN the tool result; this one classifies a resource read
 *      and rides ON a JSON-RPC error. Two surfaces, two closed enums,
 *      same UPPER_SNAKE house style.
 *
 *   rr2. **`-32006 MOUNT_UNAVAILABLE` claimed** — the first draw from
 *      the `-32006` onwards range that rb4 reserved when it retired
 *      `-32004`. The next free canonical slot is `-32007`. It covers
 *      BLUEPRINT_UNRESOLVABLE / NOT_SUPPORTED / NOT_MOUNTABLE.
 *      Deliberately NOT `INTERNAL_ERROR`: a component that is gone, a
 *      server that keeps no durable record, and a render with no
 *      delivery channel are all deterministic outcomes of a correctly
 *      functioning server, and `-32603` would report a malfunction and
 *      invite a retry that cannot succeed. The fine-grained class rides
 *      on `error.data.code`.
 *
 *   rr3. **NOT_FOUND maps to `-32002`**, which MCP uses for a missing
 *      resource and which this table already assigns to a missing
 *      session — for a locator keyed by `sessionId` those are one
 *      condition, not two.
 *
 *   rr4. **NOT_FOUND carries a CONSTANT body.** The mapper substitutes
 *      a fixed message and drops `detail`, so a read refused by the
 *      authorization check and a read of a locator that never existed
 *      are byte-identical on the wire. Anything that varies between the
 *      two makes the read an existence oracle for other callers'
 *      renders. The mapper closes the message half; the ordering half
 *      is a server obligation — a branch whose outcome VARIES WITH THE
 *      LOCATOR MUST NOT run before the authorization check, because
 *      reaching one tells the caller the locator resolved for somebody.
 *      A deployment-global answer is not such a branch: NOT_SUPPORTED
 *      is identical for every locator on the server that emits it, so
 *      answering it early discloses nothing. (Scoped this way in the
 *      same slice the conformance catalog landed, which grades the
 *      indistinguishability the rule exists to produce and deliberately
 *      does not grade ordering. The unscoped form would have declared
 *      a correct substrate-less server non-conformant.)
 *
 *   rr5. **A read that cannot mount is now an ERROR, not a
 *      success-shaped shell.** This is the observable wire change, and
 *      it is what rr1–rr4 exist to give a shape to. Every failure
 *      branch of the render-locator read used to return a result whose
 *      `contents` carried a loading shell — a page that waited forever
 *      for a render that was never coming. Those branches now throw,
 *      and the transport serializes them as the JSON-RPC errors above;
 *      the shell builder behind them is DELETED rather than left
 *      unreferenced, so no branch can produce one. Reads that CAN
 *      mount are unchanged byte for byte. A host that treated any
 *      successful read as mountable was right only by accident and is
 *      now right by construction; a host that never handled the error
 *      exit at all now has one to handle. The invariant this buys is
 *      the whole point: any successful `contents` result IS a live
 *      mount.
 *
 * Conformance-kit verdict: additive, minor-intent while `draft-`, so
 * PROTOCOL_VERSION is unchanged — no WS envelope moved, and the change
 * is confined to the MCP resource surface (same reasoning as rb's stamp
 * adjudication).
 *
 * The kit arbitrates this surface now. `resource-read-conformance` in
 * `@ggui-ai/protocol-conformance` binds the `resources/read` method:
 * `runResourceReadConformance()` drives an adopter-supplied scenario
 * driver through a 12-case catalog and grades the two numbers (rr1–rr3),
 * the closed classification on `error.data.code`, NOT_FOUND's absent
 * `detail` and constant message (rr4), the refused-equals-missing byte
 * identity across every server shape, and rr5's invariant on a live row
 * and a re-minted one alike. What it does NOT arbitrate is `tools/call`:
 * no driver is bound to that method, so the `ggui_consume` and
 * `ggui_emit` obligations stay kit-invisible and this entry closes
 * nothing for them.
 *
 * Because that catalog exists and ships, the package-version decision
 * below is stated outright rather than made conditional on a driver
 * that has yet to arrive.
 *
 * Five things stay ungraded on purpose and MUST NOT be read as
 * obligations: the ORDER in which a substrate-less server answers
 * NOT_SUPPORTED; `detail` wording on any code; the NOT_FOUND message
 * literal (its constancy is the obligation, not its prose); `-32603`
 * message text; and the NUMBER a URI naming no locator receives —
 * including negatively, since MCP itself assigns the resource-missing
 * number to a read of a URI a server does not serve, and banning it
 * would make every framework that leans on that assignment
 * non-conformant. On that last one the law is classification-only:
 * such a URI MUST NOT carry one of the four codes on `error.data.code`.
 *
 * Package version — the classification is MADE here, not deferred.
 * The resource-read surface and the new canonical code are a MINOR for
 * the `@ggui-ai/*` wave: additive under the version policy's minor rule
 * (every fixture that passed against the current wave still passes; the
 * delta is new surface), pre-1.0 and pre-launch. TWO packages carry
 * minor-class changes into that wave — `@ggui-ai/protocol` (the closed
 * enum, the canonical number, the projection) and
 * `@ggui-ai/protocol-conformance` (the catalog that decides them).
 *
 * What is deferred is only the mechanical write. Every `@ggui-ai/*`
 * package carries ONE wave version, and a wave cut moves all of them to
 * it in a single commit — no package's number can move on its own — so
 * the release owner takes both bumps together at the next cut. One
 * deferral, one owner, two named packages. Nothing about what the
 * change IS remains open.
 *
 * #457 (2026-08-10): the substrate stores' `durability` declaration —
 * a MINOR surface that SHIPPED IN 0.7.0 (the wave was published from
 * main after it landed; an earlier revision of this note deferred it
 * to the next cut, which the publish overtook). `@ggui-ai/mcp-server-core`
 * adds a required member to three published ports (pre-launch
 * no-compat: every in-tree impl moved in the same slice; out-of-tree
 * implementors add one literal) and `@ggui-ai/protocol-conformance`
 * adds the `all-ephemeral` wiring arm + its fusion case (additive —
 * the catalog's public-API additive-only rule holds; the SPEC §7.10.4
 * amendment defines "durable" as declared, which was previously
 * undefined, not different).
 *
 * On the kit's half, one thing is worth saying plainly rather than
 * calling its delta "purely additive": `parseCase` rejects unknown
 * keys, so a case file with a typo'd key throws instead of being
 * quietly ignored. That strictness is free on a sub-module with no
 * prior published version — nothing can be built against it yet — but
 * extending it over the existing fixture catalog would be a MAJOR, not
 * a minor, and must be adjudicated as one.
 *
 * #471 (2026-08-10): the fetch-free delivery surface — a MINOR for the
 * `@ggui-ai/protocol` wave, deferred to the next cut under the same
 * one-wave-version rule as above. Three additive pieces, one shared
 * motivation (hosts whose iframe CSP forbids every URL-scheme load
 * while permitting inline scripts):
 *
 *   if1. **`McpAppAiGguiRenderMeta.codeB64`** — optional base64
 *      compiled component source, the fetch-free twin of `codeUrl`
 *      (coexists with it; exclusive with `kind`). Every envelope that
 *      parsed before parses identically; the parser's new rejection
 *      arm (`codeB64` + `kind` both set) rejects a shape no producer
 *      ever emitted. `hasMountModeDiscriminator` widens PERMISSIVELY
 *      (a codeB64-only slice becomes mountable — previously
 *      undefined, not different).
 *
 *   if2. **`GguiShellHtmlOptions.runtimeInlineSource` +
 *      `escapeInlineScript`** — host-helper additions; the default
 *      (external `<script src>`) emission is byte-unchanged.
 *
 *   if3. Consumer-side: `@ggui-ai/design` gains the inline-exec
 *      module (new exports only); `@ggui-ai/mcp-server` gains the
 *      `mcpApps.inlineRuntimeShell` opt-in (default OFF — the served
 *      static shell is byte-unchanged for every existing mount) and
 *      `registerGguiRenderResource` gains a trailing optional
 *      CSP-fallback parameter (existing positional calls unchanged).
 *
 * Conformance-kit verdict: no fixture pins the render slice's closed
 * field set (the slice is verbatim-carry by design — the host-helper
 * suite's "unknown future fields ride along" case is the governing
 * posture), so the additive field breaks nothing. PROTOCOL_VERSION
 * unchanged — no wire frame changed shape.
 *
 * SSE middle rung (2026-08-11): the failover-ladder stream surface — a
 * MINOR for the `@ggui-ai/protocol` wave, deferred to the next cut
 * (≥ 0.9.0) under the same one-wave-version rule as above. Two
 * additive pieces, one motivation (hosts whose CSP blocks WebSocket
 * but permits `EventSource`, giving the ladder a live middle rung
 * between WS and cursor polling):
 *
 *   sm1. **`McpAppAiGguiRenderMeta.sseUrl`** — optional server-stamped
 *      `/api/sessions/<sessionId>/stream?wsToken=<token>` URL beside
 *      `pollingUrl`. Every envelope that parsed before parses
 *      identically (tolerant scalar posture, no pairing invariant —
 *      the URL is self-authorizing via its embedded token). Absent ⇒
 *      no SSE rung; the ladder is WS → polling. The stream contract
 *      the URL points at (ChannelFrame-per-`data:`-line byte-same as
 *      the WS push, `id:` = ledger seq on replay frames only,
 *      `: hb` comment heartbeat ≤ ~25s, `retry: 3000` first write,
 *      `Last-Event-ID` over `?sinceSequence=`, 401/404/410 mirroring
 *      `/events`) is pinned on the interface docstring.
 *
 *   sm2. **`composeSessionApiUrls` + `SessionApiUrls`** — the ONE
 *      pure composer every stamping surface (render/update resultMeta,
 *      self-contained shell, `/state` bootstrap) routes both URLs
 *      through — the `deriveRenderMeta` move applied to channel URLs.
 *      New exports only. This REPAIRS a confirmed drift: `/state` used
 *      to stamp an unconditional token-less `/state`-shaped
 *      pollingUrl that could only 401 through the events composer;
 *      both URLs now stamp ONLY when the live trio is minted, and
 *      omission is the honest no-HTTP-fallback signal.
 *
 * Conformance-kit verdict: same posture as if1 — no fixture pins the
 * render slice's closed field set (verbatim-carry by design), so the
 * additive field breaks nothing. Full SSE endpoint conformance cases
 * are a FLAGGED follow-up (unit tests ride this slice; conformance
 * ticket after launch — No Silent Block). PROTOCOL_VERSION unchanged —
 * no WS envelope moved; the SSE `data:` line reuses the ChannelFrame
 * shape byte for byte.
 *
 * --------------------------------------------------------------------
 * Bridge-pull terminal rung (2026-08-11): `ggui_runtime_pull` — a
 * MINOR for the `@ggui-ai/protocol` wave, riding the same next cut
 * (≥ 0.9.0) as the SSE entry above. One motivation: hosts whose CSP
 * blocks EVERY network API from the iframe (claude.ai's srcdoc
 * sandbox) can still pull the event ledger over the host's
 * `tools/call` postMessage bridge — the fourth and terminal rung of
 * the failover ladder (WS → SSE → HTTP polling → bridge-pull).
 *
 *   bp1. **`runtimePullInput/OutputSchema` + `GguiRuntimePullInput/
 *      Output`** — new tool contract, output byte-parity with the
 *      `/events` route (`EventsResponse` page arm |
 *      `REPLAY_HORIZON_PASSED` arm as a NORMAL result) so ONE client
 *      parse core serves both carriers. `_meta.ui.visibility: ['app']`
 *      restricts callers to MCP Apps views per spec §401.
 *
 *   bp2. **`wait` + `RUNTIME_PULL_MAX_WAIT_SECONDS`** — the
 *      subscription-mode hold: an empty cursor page holds the call
 *      server-side (≤ 20s, under `ggui_consume`'s proven 25s host
 *      tolerance) until an event lands. Back-to-back held single-shots
 *      emulate push through a request/response-only bridge; clients
 *      demote to sparse un-held pulls after consecutive empty holds.
 *
 * Conformance-kit verdict: additive tool, no existing fixture touches
 * it; bridge-carrier conformance cases join the SSE follow-up ticket
 * (No Silent Block). PROTOCOL_VERSION unchanged — no WS envelope
 * moved; the ledger event vocabulary gained active use of the
 * existing `'ui.updated'` taxonomy member (`ggui_update` now appends
 * it), not a new member.
 *
 * --------------------------------------------------------------------
 * Render outcome facet (2026-08-13, ggui#495; rides the next cut
 * after 0.9.0 — additive MINOR): `ComponentGguiSession` gains
 * `errorCode?: RenderErrorCode` — the SAME closed enum the §7.1
 * failure envelope carries, persisted on the committed error render
 * beside the existing `error` message (invariant: `errorCode` ⇒
 * `error`; one writer, the failure commit). Deliberately NOT a new
 * `GguiSessionStatus` member: outcome ⊥ lifecycle — errored rows
 * still TTL-expire. New exported predicate `isErroredGguiSession` +
 * accessor `erroredGguiSessionCode` are the single normative
 * definition of "errored" (message-only legacy rows count); store
 * `erroredOnly` filters (GguiSessionFilter, all three stores) and
 * `ggui_ops_list_recent_renders`' new `erroredOnly` arg + per-row
 * `errorCode` derive from them. The canonical `RenderErrorCode` type
 * declaration moved from `types/mcp.ts` beside its schema in
 * `schemas/mcp.ts` (types/mcp re-exports — import paths unchanged).
 *
 * --------------------------------------------------------------------
 * React/RN SDK-surface retirement (2026-08-13, owner ruling; rides
 * the same next cut ≥ 0.9.0): `@ggui-ai/react` + `@ggui-ai/react-
 * native` are MCP Apps HOST-HELPER libraries, not SDKs — embeds mount
 * views via the spec path (`AppRenderer` / RN `McpAppIframe`) and get
 * runtime semantics (freeze latch, crash card, epochs) from the
 * mounted iframe itself. Deleted from `@ggui-ai/react`: `GguiRender`
 * + its WS stack (`useWebSocket`, `WebSocketManager`, `EventBuffer`,
 * reserved-validators), local `ThemeProvider`, `SelfRepairBoundary`
 * family, `AgentBrowsePanel`, the dead wire-type re-exports, the
 * public `useGguiContext`/`useAdapter`/`AdapterRegistry` barrel
 * entries (impls stay internal), and `chat-thread/**` (both
 * packages — third-party chat framework, zero consumers; guuey built
 * `@guuey/threads` instead). RN's direct-render family was already
 * deleted pre-ruling (#425, 7d5c6955b). Zero-consumer adversarially
 * traced per export before deletion; guuey pins both packages at
 * 0.6.3 (npm-immutable — installs unaffected; handoff note per the
 * deletion discipline). Breaking TS-API shrink, 0.x MINOR carries it.
 * SAME-DAY RENAME RULING: the packages republish at this cut as
 * `@ggui-ai/mcp-apps-react` / `@ggui-ai/mcp-apps-react-native` —
 * the names must say "MCP Apps bindings," not "SDK." Old names get
 * `npm deprecate` + pointer at cut time (owner click, OTP; new names
 * need Trusted Publishing setup — see release:cut).
 *
 * --------------------------------------------------------------------
 * Mutation tool split + epoch history (2026-08-13, ggui#481→#483,
 * SUPERSEDES the same-night renderAsNew param design, which never
 * reached a cut): a MINOR for the `@ggui-ai/protocol` wave, riding
 * the same next cut (≥ 0.9.0). One motivation arc: hosts mint
 * per-result views from result shape, so mutation results must be
 * either complete mount packages or carry nothing — and once every
 * update result is a durable record, the records ARE a history.
 *
 *   ts1. **`ggui_amend`** — new tool: in-place mutation of the
 *      mounted card. Same replace/merge grammar as update
 *      (`amendInputSchema`/`amendOutputSchema` + inferred types); NOT
 *      UI-bound, results carry NO `_meta` under any outcome; the
 *      history epoch is untouched by construction. Additive.
 *
 *   ts2. **`ggui_update` semantics change, stated plainly:** every
 *      real update now mints a NEW history record — output gains
 *      mandatory `epoch` and its `resourceUri` is the epoch-PINNED
 *      URI (`…#N`); the result `_meta` is unconditionally the full
 *      bootable mount package (#481). `renderAsNew` is deleted from
 *      both arms. A consumer that treated update results as in-place
 *      acknowledgements sees new cards; the in-place path moved to
 *      ggui_amend. Pre-launch no-compat; the kit is the arbiter and
 *      update-family conformance cases ship IN THIS SLICE (epoch
 *      immutability, head aliasing, amend-mints-nothing), closing the
 *      previously flagged gap.
 *
 *   ts3. **Epoch surfaces:** `GguiSessionBase.epoch` +
 *      `McpAppsGguiSession.epoch` (optional, absent ⇒ 0 — the row is
 *      the authority; the ledger is horizon-bounded); `'ui.reminted'`
 *      joins the ledger taxonomy with `UiRemintedEventData`;
 *      `UiUpdatedEventData` types the props event (now epoch-stamped);
 *      `composeEpochUri`/`parseEpochUri` (the ONE encoding seam —
 *      fragment today, flippable post-host-probe);
 *      `deriveEpochFromEvents` (in-horizon reconstruction only).
 *      SPEC §7.1.2/§7.1.2.1/§7.1.2.2 are the normative text.
 *
 *   ts4. **Live-fan epoch obligation (2026-08-13 follow-up, same
 *      wave):** `PropsUpdatePayload.epoch` (`@ggui-ai/protocol`
 *      live-channel, optional on the wire) is the freeze-latch signal,
 *      and servers MUST stamp live `props_update` frames with the
 *      COMMIT-TIME epoch (SPEC §7.1.2.2). TS API surfaces moved with
 *      it: `PropsUpdateNotifier.sendPropsUpdate` gains a required
 *      `epoch` third param (`@ggui-ai/mcp-server-handlers`), as does
 *      `GguiSessionChannelServer.sendPropsUpdate`
 *      (`@ggui-ai/mcp-server`) — 2-arg callers break at compile time
 *      (pre-launch no-compat; 0.x MINOR carries it). Motivating
 *      incident: a second notifier impl (cloud pod) omitted the then-
 *      optional field and shipped epoch-less frames — the latch
 *      degraded to legacy-apply exactly as designed for skew, which
 *      is also the compat story: old runtime × new server ignores the
 *      extra field; new runtime × old server sees no epoch and
 *      applies as before. Graceful both directions.
 *
 * PROTOCOL_VERSION unchanged — no WS frame changed shape; the
 * `ai.ggui/render` slice's field set was never closed, and the
 * `ui.updated` / `props_update` payloads gained an optional field on
 * open payload surfaces.
 *
 * --------------------------------------------------------------------
 * Credential-broker surface retired (2026-08-08, BREAKING, pre-launch,
 * ggui#436). The `system` frame's auth vocabulary and the
 * `ggui_request_credential` tool leave the protocol entirely.
 * Credential ceremony for an agent's own MCP tools is the AGENT HOST's
 * responsibility — it owns the runtime, the user relationship, and the
 * consent chrome. ggui's wire deliberately carries no auth frames.
 *
 *   rc1. **`SystemPayload` / `SystemAction` deleted**, and `'system'`
 *      leaves `WebSocketMessageType` + the `WebSocketMessage` union.
 *      The vocabulary was `auth_required` / `credential_ready` and
 *      nothing else — with the broker gone there is no other action to
 *      carry, so the frame class dies with it rather than surviving as
 *      an empty discriminator.
 *
 *   rc2. **`requestCredentialInputSchema` /
 *      `requestCredentialInputShape` / `GguiRequestCredentialInput` /
 *      `GguiRequestCredentialOutput` deleted.** The only handler that
 *      ever implemented the tool (the hosted pod's
 *      `tools/request-credential.ts`) was deleted the day before in
 *      the same issue: it pushed its consent overlay through an API
 *      Gateway WebSocket leg the pod never had, so the tool could not
 *      function. `ggui_request_credential` is appended to the
 *      mcp-server RETIRED_TOOL_NAMES regression lock.
 *
 *   rc3. **Client lanes deleted, not stubbed.** `@ggui-ai/react`'s
 *      `GguiRenderProps.onSystemMessage` (+ its dispatch arm),
 *      `@ggui-ai/iframe-runtime`'s `channels/system.ts` handler and
 *      its `auth-required` `ObservabilityEvent` arm
 *      (`AuthRequiredEvent`), and both SDKs' `SystemPayload` /
 *      `SystemAction` re-exports go. The observability event was a
 *      projection of `SystemPayload` — with no payload to project it
 *      has no producer.
 *
 * Conformance-kit verdict: no kit fixture asserted the `system` frame
 * and no first-party server ever emitted one (the pod's broker was the
 * only would-be emitter and it was pre-transport dead) — same posture
 * as the 2026-07-27 dead-vocabulary entry. PROTOCOL_VERSION unchanged;
 * rolling it would force a lockstep UPGRADE_REQUIRED break on every
 * pinned client to version a frame class that never flew.
 *
 * --------------------------------------------------------------------
 * Ops-tool console-parity slice (2026-07-29, BREAKING on the ops
 * surface only, pre-launch, ggui#400). Rename ledger — same treatment
 * as the `ggui_ops_register_blueprint` → `ggui_ops_save_library_blueprint`
 * split and the r4.1 `ggui_runtime_refresh_bootstrap` retirement:
 *
 *   op1. **`ggui_ops_rename_app` + `ggui_ops_update_app_system_prompt`
 *      → consolidated `ggui_ops_update_app`.** One partial-update tool
 *      carries `displayName?` + `systemPrompt?` + `rateLimitPerMinute?`
 *      (at least one required). Clearing sentinels: `systemPrompt: ''`
 *      clears the override (unchanged semantics); `rateLimitPerMinute:
 *      0` clears the limit — the console client's empty/0 → null
 *      normalization moves server-side so the stored column keeps ONE
 *      "unlimited" representation. Both old wire names are appended to
 *      the mcp-server RETIRED_TOOL_NAMES regression lock. No shims,
 *      pre-launch delete-in-same-slice.
 *
 *   op2. **New ops wire names** (additive): `ggui_ops_set_app_theme`
 *      (validates with the protocol's `appThemeSchema` — the same
 *      validator every `GguiApp.theme` write surface runs),
 *      `ggui_ops_rename_org` (owner-or-admin), `ggui_ops_remove_org_member`
 *      (role-matrix enforced; owner never removable),
 *      `ggui_ops_get_org_balance` (any-member read, allowlisted in
 *      SINGLE_CALL_OPS), and the app-scoped `appId?` argument on
 *      `ggui_ops_set_provider_key` / `ggui_ops_remove_provider_key`
 *      (optional seam — deployments without app-scoped key storage
 *      reject it with `app_scoped_keys_unavailable`).
 *
 *   op3. **My-blueprint curation trio** (additive, cloud-deployment
 *      tools beside `ggui_ops_list_my_blueprints`):
 *      `ggui_ops_update_my_blueprint` (rename + description/tags;
 *      canonical kebab-case blueprint-name rule),
 *      `ggui_ops_delete_my_blueprint`, and
 *      `ggui_ops_get_my_blueprint_source` (returns the stored
 *      `{source, contract?, fixtureProps?}` definition envelope;
 *      allowlisted in SINGLE_CALL_OPS).
 *
 * Conformance-kit verdict: ops tools are not conformance-kit surface —
 * NO protocol stamp roll. Recorded here because retired wire names are
 * ledgered (retired-tool-names regression lock mirrors this entry).
 *
 * --------------------------------------------------------------------
 * Dead capability/quality vocabulary deleted (2026-07-27, pre-launch,
 * ggui#394). `CapabilityPermissions`, `ComponentCapability`, and
 * `QualityMetadata` are removed from the package's public API, along
 * with the never-populated `capabilities?` / `quality?` fields on
 * `ComponentGguiSession` (types/capabilities.ts deleted).
 *
 *   cp1. Census before delete: zero producers, zero consumers — the
 *        only reference in the repo was the type-level field
 *        declaration itself. The `capabilities` name was ALREADY
 *        retired contract vocabulary (RETIRED_CONTRACT_FIELDS,
 *        hygiene-rules.ts) and hard-rejected at the render/handshake
 *        seams, so the surviving session-layer type contradicted the
 *        shipped posture.
 *   cp2. Not wired into `_meta.ui.csp` because no lossless mapping
 *        exists: the live CSP model is origin LISTS derived from
 *        publicBaseUrl + gadget descriptors; a six-verb grant list
 *        carries no origin data, and hardware grants already flow
 *        through per-gadget `permission` → Permissions-Policy.
 *   cp3. Quality evaluation stays internal to @ggui-ai/ui-gen (its own
 *        local QualityMetadata in evaluation/types.ts is untouched);
 *        the protocol carries no scores because nothing downstream of
 *        commit consumes them.
 *
 * Conformance-kit verdict: no wire-shape change (nothing ever emitted
 * these fields) — PROTOCOL_VERSION unchanged. Package-API removal
 * only, licensed by the pre-launch no-backward-compat rule.
 *
 * --------------------------------------------------------------------
 * Render failure envelope — in-result isError tool errors (2026-07-23,
 * BREAKING, pre-launch). Ruling B. A `ggui_render` that fails or is
 * rejected is a `tools/call` RESULT carrying `isError: true` — never a
 * thrown JSON-RPC error. Before this, failures returned a
 * SUCCESS-shaped envelope: an accident of the 2026-05-14 codeReady
 * byte-trim, not a design, which mounted error renders as blank divs
 * and let render meters count failures as billable.
 *
 *   rb1. Failures stay SCHEMA-CONFORMANT. MCP SDK clients validate
 *        `structuredContent` against `outputSchema` even when
 *        `isError` is set, so the failure envelope must satisfy
 *        `renderOutputSchema` — it is not a free-form error shape.
 *        SPEC §7.1 / §7.9 Plane 3.
 *   rb2. `renderOutputSchema` gains optional `error: {code, message}`,
 *        present iff `isError`. `code` is the closed enum
 *        `RenderErrorCode` = PRODUCTION_FAILED | VALIDATION_ERROR |
 *        NO_PLATFORM_KEY | NO_CREDENTIALS; `message` is agent-facing
 *        guidance, not a stack.
 *   rb3. `resourceUri` becomes OPTIONAL — present iff the render is
 *        mountable. A failure carries no resource, so consumers must
 *        stop assuming presence. `updateOutputSchema` was synced for
 *        the same stripped-field class.
 *   rb4. The phantom JSON-RPC error code -32004 (PRODUCTION_FAILED) is
 *        RETIRED from `MCP_ERROR_CODES`. It was never emitted; the
 *        in-result contract above replaces it.
 *   rb5. NO `_meta` on failures (nothing to project), and the error
 *        session still COMMITS — the handshakeId is consumed, so
 *        recovery is re-handshake, not retry.
 *
 * Conformance-kit verdict: minor-intent while `draft-`, so
 * PROTOCOL_VERSION is unchanged and no migration doc is required (see
 * docs/protocol/VERSION-POLICY.md). Recorded here because the wire
 * shape changed even though the stamp did not.
 *
 * Stamp adjudication (re-examined 2026-07-27, pre-beta audit): the
 * "two failure contracts share one stamp" concern was weighed and the
 * stamp DELIBERATELY not rolled. PROTOCOL_VERSION gates the WS
 * subscribe handshake (versionPolicy default 'reject' — a mismatch
 * CLOSES the connection), and ruling B changed the MCP tools/call
 * result surface while leaving every WS envelope untouched. Rolling
 * the stamp would have forced a lockstep UPGRADE_REQUIRED break on
 * every client pinned to 0.4.0-rc.0 at the next server deploy, to
 * version a layer that did not change. MCP-path failure-contract
 * discovery is by package version (exact pins are the pre-launch
 * consumer contract), not by wire handshake. The stamp next moves
 * when the WS envelope layer itself changes, or at the v1.0 freeze.
 *
 * --------------------------------------------------------------------
 * Consolidated cleanliness release (2026-06-12, BREAKING, pre-launch).
 * Four strands from the 2026-06-12 cleanliness + orphan audits, every
 * finding adversarially re-verified before action: the dv* entries
 * purge dead wire vocabulary and SSoT-wire the MCP tool input schemas;
 * the ug* and dg* entries clean the `@ggui-ai/ui-gen` + `@ggui-ai/design`
 * published artifacts (dead generation island, prompt-builder
 * consolidation, packaging — no wire change); the tw* entries
 * single-source twin/mirror surfaces across the react / react-native /
 * server packages (no wire change).
 *
 *   dv1. **MCP tool input schemas are SSoT-wired.** `schemas/mcp.ts`'s
 *      "the server handler imports these" docstring is now TRUE: the
 *      handlers in `@ggui-ai/mcp-server-handlers` (+ the hosted pod's
 *      `ggui_discover` / `ggui_request_credential`) import the new
 *      `*InputShape` raw shapes (consume / emit / get-session /
 *      list-featured / search / render-blueprint / discover /
 *      request-credential / render) instead of hand-authoring mirrors.
 *      The schemas reconciled TOWARD the shipped handler behavior (the
 *      live wire): `sessionId` gains `.min(1)`, consume `timeout` is
 *      `.int()`, search `limit` is int 1..100, render-blueprint loses
 *      the never-read `props` field, list-featured + discover are
 *      EMPTY shapes (the filter vocabulary died in the pre-launch
 *      scrub), and the aspirational `.strict()` posture drops to match
 *      the `z.object(shape)` strip-unknown-keys behavior every live
 *      handler actually enforces. `renderInputSchema` — the one drift
 *      case decided the other way, toward the truthful contract —
 *      gains the live `themeId` + `infra.model` fields the published
 *      schema was missing (it would have REJECTED valid live wire
 *      calls), and the handler adopts the schema's richer handshakeId
 *      validation messages. Hand types `GguiConsumeInput` /
 *      `GguiGetSessionInput` / `GguiSearchBlueprintsInput` /
 *      `GguiRenderBlueprintInput` / `GguiRequestCredentialInput` are
 *      now `z.infer` of those schemas ("kept in sync by convention"
 *      dies); `ggui_handshake` / `ggui_update` keep their documented
 *      deliberate handler-side divergences (loose-on-purpose draft
 *      contract; optional sessionId for in-process dispatch).
 *
 *   dv2. **`EventType` collapses to its one real member
 *      `'data:submit'`** (actions-vs-context: actions drive turns;
 *      there is no third category). The 8 producer-less members
 *      (`data:change`, `lifecycle:focus`/`blur`,
 *      `interaction:click`/`hover`/`scroll`, `error:validation`/
 *      `connection`) are deleted along with their dead client lanes:
 *      the RN WebViewRenderer's legacy bridge emissions and both SDKs'
 *      never-firing `GguiRenderProps.onInteraction` callback. Server
 *      runtime behavior is unchanged — non-submit wire envelopes were
 *      already ledger-only and never reached `ggui_consume`.
 *
 *   dv3. **`'url'` / `'close'` / `'internal:progress'` leave the WS
 *      message union** — pre-flatten vocabulary that survived the
 *      rc4/rc7 frame purges. `'url'` + `UrlPayload`: zero emitters
 *      since the post-R5 `/r/` short-code drop. `'close'` +
 *      `ClosePayload`: SPEC §12.2 already records the close frame
 *      deleted in draft-2026-05-27 ("no terminal close ceremony");
 *      the server's consumer-with-no-emitter socket-router arm goes
 *      with it — clients just close the socket. `'internal:progress'`
 *      + `InternalProgressPayload` + `ProgressStep`: zero producers,
 *      zero handler arms; rc7's "ProgressStep survives" retention was
 *      circular (its only consumer was InternalProgressPayload).
 *
 *   dv4. **Emitterless union members deleted**: `GenerationStrategy`
 *      loses `'creative'`; `ScreenMechanic` loses `'drag'` / `'swipe'`
 *      (no authored blueprint ever used them; the generator infers
 *      gesture mechanics from the prompt).
 *
 *   dv5. **Client pre-ack error classification matches the real
 *      wire**: the iframe-runtime's `classifyPreAckError` /
 *      `fromAuthFailure` / `ProtocolError`'s `auth` arm drop the
 *      never-emitted `AUTH_REJECTED` / `TOKEN_EXPIRED` codes (`git
 *      log -S` proves no first-party server ever minted them) in
 *      favor of the codes servers actually send pre-ack:
 *      `BOOTSTRAP_EXPIRED` / `BOOTSTRAP_INVALID` /
 *      `BOOTSTRAP_SESSION_MISMATCH` / `BOOTSTRAP_APP_MISMATCH` /
 *      `UNAUTHENTICATED` (+ the kept `SESSION_NOT_FOUND`). A real
 *      ws-token expiry now classifies as `auth` instead of falling
 *      into the generic `protocol` bucket. The conformance kit's
 *      authored ProtocolError mirror follows. `AUTH_REJECTED` remains
 *      ONLY on the §5.5.2 postMessage `BootstrapFailureReason` plane,
 *      where SPEC documents it.
 *
 *   dv6. **Dead published exports pruned** (zero consumers + zero
 *      docs — published-API ladder rung 3): the Streamable-Invoke
 *      narrowing aliases (`TextDelta`, `InputJsonDelta`,
 *      `ContentBlockDeltaPayload`, `MessageStartEvent`,
 *      `ContentBlockStartEvent`, `ContentBlockDeltaEvent`,
 *      `ContentBlockStopEvent`, `MessageDeltaEvent`,
 *      `MessageStopEvent`, `PingEvent`, `ErrorEvent`, `InvokeRequest`
 *      — the zod schemas in `schemas/invoke.ts` stay); the
 *      model-catalog helpers (`PROVIDER_INFO`, `isValidModelId`,
 *      `getModelsForProvider`, `getModelsForTier`, `selectModelByTier`
 *      — `MODEL_REGISTRY` / `ModelId` / `DEFAULT_MODEL` stay);
 *      `DESIGN_SYSTEM_VERSION` + the StyleFingerprint cluster
 *      (`StyleFingerprintInput`, `computeStyleFingerprint`);
 *      `DeclareToolCatalogInput` (the schema + Output type stay);
 *      inference utilities `GadgetNames` / `InferContextNames` /
 *      `InferContextValue` / `PropsOf`; and the featured-blueprints
 *      wire-liars `GguiListFeaturedBlueprintsInput` / `...Output` +
 *      `GguiDiscoverInput` / `GguiDiscoverOutput` (the live handlers'
 *      shapes are the wire; the dead handler `category` filter branch
 *      parsed from an empty schema dies too). Sibling-package prunes
 *      in the same slice: `@ggui-ai/react` loses the explicit
 *      back-compat alias `extractBootstrapMeta` (+ the unreachable
 *      `SelfRepairBoundary` default export); `@ggui-ai/mcp-server`
 *      loses dead auth fragments (`formatClearUserSessionCookieHeader`
 *      with its false /logout docstrings, `OAuthAuthResult`);
 *      `@ggui-ai/iframe-runtime` drops the dead `./runtime.js`
 *      exports-map subpath.
 *
 *   dv7. **protocol src adopts its own `isRecord`** at ~20 guarded
 *      `as Record<string, unknown>` cast sites (no wire change; one
 *      deliberate tightening: `isGguiSubmitActionInput` now rejects
 *      ARRAY payloads for unknown extension kinds — payload-object
 *      presence is the documented invariant).
 *
 *   dv8. **The Component Bridge is now inbound-only** (SPEC §8
 *      rewritten). The legacy user-data half — postMessage type
 *      `'ggui-user-data'` (`BRIDGE_EVENTS.USER_DATA_POST`),
 *      CustomEvent `'ggui:user-data'` (`BRIDGE_EVENTS.USER_DATA`),
 *      lifecycle types `'ggui-resize'` / `'ggui-render-success'` /
 *      `'ggui-render-error'` (`RESIZE` / `RENDER_SUCCESS` /
 *      `RENDER_ERROR`), and the `SRCDOC_USER_DATA_BRIDGE` capture
 *      snippet — is deleted end-to-end: zero injectors, zero
 *      dispatchers, zero receivers existed (the consuming
 *      IframeComponentRenderer died in the component-renderer
 *      retirement; both SDKs' `GguiRender` listeners could never
 *      fire). Outbound user interaction has ONE path: component
 *      action hooks (`useAction`) → `data:submit` `ActionEnvelope`
 *      over the live channel → consume buffer (§5, §7.3, §8.4).
 *      `BRIDGE_EVENTS.AGENT_DATA_POST` / `AGENT_DATA` +
 *      `SRCDOC_AGENT_DATA_BRIDGE` (the live agent→component half)
 *      are unchanged.
 *
 *   dv9. **`ProgressUpdate` deleted** — the producer-internal
 *      generation-progress type had exactly one consumer chain: the
 *      never-implemented `UiGenerator.stream?()` /
 *      `UiGenerateEvent` seam in `@ggui-ai/mcp-server-core`, which
 *      dies in the same slice (the one consumer-position handler
 *      documented that it deliberately ignores it; provisional
 *      preview on `_ggui:preview` is the shipped
 *      progress-visibility channel). Client-visible progress
 *      vocabulary is unchanged.
 *
 *   dv10. **`'ggui:request-repair'` client event deleted** with its
 *      whole dead seam: no listener has existed since the BaseShell
 *      deletion (2026-04-23) — `GguiSessionRenderer`'s dispatch, the
 *      never-supplied `onRequestRepair` option threading in
 *      `@ggui-ai/react` (`ReactComponentRendererProps`) and
 *      `@ggui-ai/iframe-runtime` (`RenderItemOptions` /
 *      `ReactRootMountOptions`), and the false "render-item wires
 *      this to the envelope it dispatches" docstring all go. The
 *      `SelfRepairBoundary` tier (separate, honestly-`@experimental`
 *      surface) is untouched.
 *
 *   dv11. **Inbound MCP-Apps hosting plumbing removed; the wire
 *      variant stays.** The producer-less server island —
 *      `CreateGguiServerOptions.connectors` (its forwarded value was
 *      silently swallowed by a conditional spread into a handler
 *      that never read it), the unmountable `/mcp-apps/resource` +
 *      `/mcp-apps/tools-call` proxy module, `ConnectorRegistry` /
 *      `InMemoryConnectorRegistry`, the never-set
 *      `mcpAppsServerBaseUrl` renderer option, and the
 *      hardcoded-false `isMcpAppsGguiSession` provisional-preview
 *      gate input — is deleted (rebuild-from-git when a real
 *      embedding customer materializes; the producing
 *      `shortcuts.mcpApps` input died in the handshake-first
 *      collapse). `McpAppsGguiSession` / `McpAppsSource` and every
 *      union-forced client/handler guard branch REMAIN published
 *      wire surface per SPEC §6 + the MCP-Apps composition strategy.
 *
 *   dv12. **`ggui.json#theme` (ThemeDocument) drops the optional
 *      `canvas` group**, and `DtcgTheme` / `ParsedTheme` drop
 *      `canvas` / `canvasConfig` + the `--ggui-canvas-*` CSS
 *      variables (design-package + open file-format vocabulary, not
 *      MCP wire). The consuming GenerativeCanvas shells left with
 *      the guuey split; no renderer, prompt, or app shell read the
 *      tokens since. Operator theme files carrying a `canvas` block
 *      now fail strict parse — delete the block.
 *
 *   dv13. **`checkSecurity` + `SecurityCheckResult` deleted;
 *      `FULLSTACK_IMPORT_PREFIXES` un-exported** (published npm
 *      surface, no wire change — DEAD-PROTO-04 follow-up). The
 *      convenience checker had zero consumers repo-wide: every live
 *      validation path runs `validateComponentDetailed` in
 *      `@ggui-ai/ui-gen`, which imports `DANGEROUS_PATTERNS` directly
 *      and emits richer per-violation diagnostics. The prefix list
 *      stays as the internal input of the still-published
 *      `classifyUi`. `DANGEROUS_PATTERNS` / `DangerousPattern` /
 *      `UiClass` / `classifyUi` are unchanged.
 *
 *   ug1. **`@ggui-ai/ui-gen` superseded coding-agent generation
 *      island deleted** (no wire change — published npm surface +
 *      dist bytes). The pre-harness virtual-git orchestration
 *      (`coding-agent/{index,agent,planner,file-agent,boilerplate,
 *      prompts,trace,context}.ts`, `runCodingAgent` / `runPlanner` /
 *      `runFileAgent`), the legacy `apply_diff` unified-diff tool
 *      case + `diff-processor.ts` (reachable only from the island),
 *      the island-only `fullToolSchemas` / `initialToolSchemas` /
 *      `executeToolBatch` registries, the text-only
 *      `runEnforcedCodingLoop` / `buildFeedback` loop, and the
 *      legacy prompt constants (`LEAN_PROMPT`, `CODER_PROMPT`,
 *      `ENFORCED_CODER_PROMPT`, `SELF_CHECK_RULES`,
 *      `buildEnforcedCoderPrompt`, `injectDesignSpec`,
 *      `injectFeedback`, `CONTEXT_TOOL_NAMES`, `BUILD_TOOL_NAMES`)
 *      are gone — all superseded by `harness/coding/run-coding-turn`
 *      + `boilerplate/system-prompt`. The two stale tsup entries
 *      that kept shipping unroutable `dist/coding-agent/*` bytes
 *      after the rc13 subpath prune die with it. KEPT (live via
 *      `harness/coding/*`): `workspace.ts`, `tools.ts`, `types.ts`
 *      (pruned to its consumed members), `self-check.ts`,
 *      `tag-balance.ts`.
 *
 *   ug2. **`@ggui-ai/ui-gen/harness/prompts` re-exports the
 *      canonical prompt-context builders** from `contract-context.ts`
 *      (the module the live `createUiGenerator` path uses) instead of
 *      carrying a hand-maintained twin that had silently drifted (no
 *      variance block, no stream `source.tool` annotation, hooks-only
 *      gadget teaching). One module now owns the LLM-visible strings,
 *      and the duplicate mutable `RenderingContext` in
 *      `harness/result-types` collapses to a re-export of the
 *      canonical readonly type. The LIVE generation path's emitted
 *      prompt is byte-identical (snapshot-proven); the multi-sdk
 *      benchmark's deep-import path now exercises production prompt
 *      content instead of the drifted fork.
 *
 *   ug3. **`runTier0Checks` / `runTier0` (`@ggui-ai/ui-gen/check`)
 *      drop the never-read `compiledCode` positional parameter.**
 *      Compile failure has been signaled by `buildErrors` alone since
 *      the S6 tier-0 migration; the documented-but-ignored parameter
 *      was an unflagged contract gap on a published signature.
 *
 *   ug4. **`provider-adapter-mock` leaves the published artifact**
 *      — relocated to `provider-adapter-mock.test-util.ts` (excluded
 *      from the tarball), its stale tsup entry deleted. rc13 already
 *      killed the `./provider-adapter-mock` subpath; the dist bytes
 *      had been shipping with no exports route to reach them.
 *
 *   ug5. **`@ggui-ai/ui-gen` stops bundling provider SDKs**
 *      (packaging only): `@google/adk`, `@openai/agents`,
 *      `puppeteer-core` move devDependencies → optional
 *      peerDependencies + tsup externals. They are lazy
 *      `await import(...)`s in the Google/OpenAI adapters + visual
 *      evaluator, but as devDeps tsup inlined their full transitive
 *      trees into every entry chunk. Tarball: 84.7MB → 16.1MB
 *      unpacked (17.7MB → 4.0MB packed). Consumers using those
 *      adapters install the SDK themselves.
 *
 *   ug6. **`./advanced` subpath actually builds** (packaging only):
 *      `src/advanced/index.ts` was never a tsup entry — the documented
 *      `@ggui-ai/ui-gen/advanced` exports-map target only resolved
 *      because a stale pre-tsup `dist/advanced/` orphan kept shipping,
 *      and the clean-build hygiene in this release exposed the dangling
 *      subpath. The entry is now registered (the DTS graph growth needs
 *      an 8GB heap cap on the build script).
 *
 *   dg1. **`@ggui-ai/design` stops shipping Storybook stories**
 *      (packaging only): `files[]` negations + `tsconfig.build.json`
 *      excludes drop the 37 `src/*.stories.tsx` + their compiled dist
 *      output (209 pack entries, incl. the orphaned
 *      `dist/blueprints` / `dist/templates` story remnants of deleted
 *      src dirs); pack list 891 → 601 files.
 *
 *   tw1. **`ai.ggui/render` slice deps single-sourced** (published
 *      npm surface, no wire change). `@ggui-ai/mcp-server-handlers`
 *      exports `RenderSliceMetaDeps` + `assembleRenderSliceBase`;
 *      `GguiRenderHandlerDeps` and `GguiUpdateHandlerDeps` now
 *      `extend` the shared interface instead of hand-mirroring
 *      `mintWsToken` / `runtimeUrl` / `themeId` / `themeMode` /
 *      `themeProvider`, and both handlers assemble the envelope base
 *      (runtimeUrl fallback, `token`→`wsToken` remap, layered theme
 *      resolution) through the one helper. DELETED with it: update's
 *      vestigial `streamWebSocketLocalTools` dep (declared + plumbed
 *      through `@ggui-ai/mcp-server`'s `UpdateDeps`, never read — the
 *      post-update slice is a deliberate props-only subset that never
 *      emitted the field; it remains mount-time bootstrap data owned
 *      by `ggui_render`).
 *
 *   tw2. **`@ggui-ai/design` `ClickableProps.onClick` /
 *      `PressableProps.onPress` widen to
 *      `MouseEvent | KeyboardEvent`** (published type surface; runtime
 *      unchanged). Enter/Space keyboard activation always delivered a
 *      `KeyboardEvent` through a handler typed `MouseEvent` via a
 *      double cast — the union makes the published type honest and
 *      deletes both casts. Handlers annotating the event parameter as
 *      bare `MouseEvent` must widen (or drop) the annotation.
 *
 *   tw3. **react ↔ react-native twin-parity gate extended** (test
 *      infrastructure; both SDK suites). The websocket/provider
 *      family (`WebSocketManager`, `EventBuffer`, `useWebSocket`,
 *      `GguiProvider` + the two websocket test files) joins a new
 *      `DOCUMENTED_DELTA_TWINS` structural gate (both copies exist,
 *      RN file-top "Platform delta" header required, exported
 *      surfaces equal modulo annotated platform-only exports), and
 *      the reserved-validators A2UI adapter trio
 *      (react / react-native / mcp-server) is pinned by a new
 *      comment-stripped `CODE_IDENTICAL_MIRRORS` gate. One behavioral
 *      convergence: the RN `useWebSocket.sendAction` now re-stamps
 *      `schemaVersion` via `makeActionEnvelope` exactly like the web
 *      hook (RN's docstring already claimed symmetry); RN gains the
 *      formerly web-only `useWebSocket` test suite.
 *
 * --------------------------------------------------------------------
 * Blueprint provenance (`BlueprintSource` union + `PortableBlueprint`
 * v2) + retired-surface cleanup (2026-06-11, BREAKING, pre-launch).
 * One release, four strands: the bp* entries introduce provenance on
 * the wire; the rc* entries delete vocabulary that had no emitter;
 * the ab* entries close the action→consume loop on the WS transport
 * and collapse the duplicated client wire-config pipeline; the hc*
 * entries clean the helper-package published surfaces (dead exports,
 * packaging, conformance execution, component re-homing — no wire
 * change) plus the one additive ops-tool schema change (hc4) and one
 * published-symbol rename (hc5); the cc1 entry restores the SPEC §7.3
 * `ggui_consume` timeout bound on the wire; the pa1 entry de-vendors
 * the CLI publish-auth surface (no wire change).
 *
 *   bp1. **`BlueprintSource` discriminated union introduced**
 *      (`kind: 'llm' | 'user' | 'curated'`), replacing the flat
 *      provenance strings that previously lived on three separate
 *      seams (catalog entries, screen blueprints, the runtime cache
 *      registry). The `llm` arm REQUIRES `generator` + `model`; the
 *      legacy `heuristic` arm is deleted (zero mint sites repo-wide).
 *      `parseBlueprintSource` / `isBlueprintSource` validate at trust
 *      boundaries — legacy flat strings are rejected, never coerced.
 *
 *   bp2. **`PortableBlueprint` v2**
 *      (`PORTABLE_BLUEPRINT_SCHEMA_VERSION = 2`): `source` and
 *      `generatorProtocolVersion` are REQUIRED (the latter's
 *      optional-for-back-compat shim dies). `fromPortableBlueprint`
 *      is the validating importer: v1 artifacts and era-mismatched
 *      records are REJECTED — a rejected seed entry is just a
 *      cold-gen; the fix is to re-export the pool, never to coerce.
 *      `toolIdentityCatalogHash` stays optional (an offline pool
 *      export has no runtime handshake catalog to hash).
 *
 *   bp3. **Provenance is stamped at every mint site** and persisted
 *      on stored blueprint rows. Rows whose `source` does not parse
 *      are dropped at the load boundary, never coerced — blueprints
 *      are a cache (invalidation = regeneration, never data loss).
 *
 *   bp4. **MVB `Blueprint.generator` → `Blueprint.source`** — the
 *      multi-variant blueprint record (and `blueprintSchema`) joins
 *      the single provenance vocabulary; the bare engine slug dies.
 *      `createdBy` is KEPT — a different axis (who initiated the
 *      mint): an `ggui_ops_generate_blueprint` row is
 *      `createdBy: 'operator'` AND `source.kind: 'llm'`. Ripples:
 *      `BlueprintMeta.generator: string` (required) →
 *      `BlueprintMeta.source?: BlueprintSource`, present iff
 *      `origin === 'cache'` (the matched row's stored provenance);
 *      absent on `agent`/`synth` — gen pending, nothing truthful to
 *      report (the old field stamped a static deployment slug even
 *      on cache hits, itself a fabrication). The
 *      `HandshakeDecisionAdapter.generatorSlug` seam retires with
 *      it. `ggui_ops_generate_blueprint` output `generator` →
 *      `source` (llm arm, from the engine's own metadata stamp).
 *      `ggui_ops_register_blueprint` input `generator` DELETED and
 *      output `generator` → `source` (always `{kind: 'user'}`) —
 *      the handler no longer fabricates a registry-default slug for
 *      hand-authored bytes. `ggui_ops_list_blueprints` keeps the
 *      `generator` filter, redefined to match `llm`-sourced rows
 *      only. New Zod mirrors exported: `blueprintSourceSchema` +
 *      per-arm `llm`/`user`/`curated` schemas.
 *
 *   rc1. **`SubscribePayload.appId` required → optional (widening).**
 *      Absent appId no longer flows through raw: the server resolves
 *      the caller's identity-default app before any store work —
 *      token-bound appId, else the deployment's identity mapping
 *      (`defaultAppIdFromIdentity`, same rule as the MCP route), else
 *      the deployment default. A PRESENT appId must still match the
 *      GguiSession's bound app or subscribe fails `APP_MISMATCH`.
 *      Closes the absent-appId bifurcation (silent provisioning of a
 *      GguiSession row with `appId: undefined` on in-memory stores).
 *
 *   rc2. **`CanvasLifecyclePayload` → `GguiLifecyclePayload`** (and
 *      `validateCanvasLifecyclePayload` → `validateGguiLifecyclePayload`).
 *      Internal type rename only — the `_ggui:lifecycle` reserved
 *      channel and its event vocabulary are unchanged on the wire.
 *      Canvas MODE is discarded (MCP Apps display modes are the
 *      model); the lifecycle channel is generation-progress, not
 *      canvas.
 *
 *   rc3. **`unknown_generator` leaves `GadgetGateErrorCode`.** The
 *      throwing gate had no production call site (render's strict
 *      override path carries no generator field); the live surface is
 *      the forgiving `GENERATOR_UNKNOWN` handshake draft finding.
 *      Render-time generator selection is deferred to v2.
 *
 *   rc4. **`'feedback'` leaves the WS message union** (both
 *      `WebSocketMessageType` and the `WebSocketMessage` variant,
 *      which carried a bare `JsonObject` payload). The frame was
 *      vocabulary with no emitter in either direction: no client ever
 *      constructed it, and the only server touch rejected it
 *      `NOT_IMPLEMENTED`. The iframe-runtime's inbound no-op stub
 *      handler (a shim for servers that never existed) is deleted
 *      with it. Conformance-kit-invisible (the kit never covered the
 *      frame). If love/dislike feedback ships later it re-enters with
 *      a real producer + consumer and a typed payload.
 *
 *   rc5. **`SubscribePayload.bootstrap` dead duplicate deleted.** The
 *      R4 rename (r4.1 below) moved the live-channel auth credential
 *      to `wsToken`, but the retired slot survived on the published
 *      wire type as a "generic transport-bootstrap" judgment call with
 *      ZERO emitters or readers in either direction. The field, its
 *      boundary-test pin, and every docstring still teaching it as
 *      live are deleted; `wsToken` is the only subscribe credential.
 *
 *   rc6. **The `_ggui:contract-error` surface is deleted entirely.**
 *      The channel was normative vocabulary with ZERO emitters
 *      anywhere (SPEC carried an explicit "no first-party emitter"
 *      gap since draft-2026-06-10); pre-launch, vocabulary nothing
 *      produces is dead surface. Gone: `CONTRACT_ERROR_CHANNEL`, the
 *      `ContractErrorPayload` type, the `ContractErrorCode` union,
 *      `makeContractErrorPayload`, `validateContractErrorPayload` +
 *      its `BUILTIN_RESERVED_VALIDATORS` entry, the iframe-runtime's
 *      `fromContractErrorPayload` parser + the `ProtocolError`
 *      `'contract'` variant, the conformance kit's authored
 *      `ContractErrorCode` mirror, and SPEC §4.4's payload section +
 *      §5.5.3's reserved-MAY dual-emission path. The reserved
 *      `_ggui:` NAMESPACE policy survives unchanged (agents and
 *      renderers MUST NOT author `_ggui:*` deliveries — SPEC §4.4 is
 *      now that authority section); `_ggui:lifecycle` remains the
 *      protocol-owned built-in-validated reserved channel. Codes the
 *      union once named keep living on their REAL surfaces: WS error
 *      frames (`SESSION_NOT_FOUND`, `AUTH_REJECTED`,
 *      `CONTRACT_VIOLATION`), tool `structuredContent` rejections
 *      (`INVALID_ACTION_KIND`, `PIPE_NOT_FOUND`, `CONTEXT_TOO_LARGE`),
 *      and push-time schema-compat rejection (`SCHEMA_MISMATCH_ERROR`).
 *      `sanitizeCausedBy` survives — its consumer is the
 *      `channel_error` frame's `details` diagnostic, not this payload.
 *
 *   rc7. **`'stream'` / `'progress'` / `'agent-msg'` leave the WS
 *      message union** (both `WebSocketMessageType` and the
 *      `WebSocketMessage` variants). Frame census of every
 *      first-party server send site: only `data` / `ack` / `render` /
 *      `props_update` / `pong` / `error` / `drain_ack` / `channel_*`
 *      are ever emitted — the three frames were pure vocabulary, and
 *      client-visible generation progress already flows as
 *      `{type:'data'}` envelopes on the reserved `_ggui:lifecycle`
 *      channel (SPEC §4.5). Deleted with the members: the
 *      `StreamPayload` / `ProgressPayload` / `AgentMsgPayload` /
 *      `AgentMsgType` payload types (`ProgressStep` survived this
 *      purge as `InternalProgressPayload`'s vocabulary — circular;
 *      dv3 above deletes both), the
 *      `BRIDGE_EVENTS.AGENT_STREAM` / `AGENT_MSG` / `AGENT_LOGS`
 *      CustomEvent names + every dispatch site, the SDKs'
 *      `GguiRenderProps.onStream` / `onProgress` dead callbacks (and
 *      the client-fabricated synthetic matchType "progress" event),
 *      and the RN SDK's listener-with-no-emitter hook
 *      `useGenerationProgress`. SPEC §2.8 (NDA) + §8.2 now teach the
 *      lifecycle channel as the one progress mechanism. The
 *      conformance kit's stream-update matcher behavior is unchanged
 *      (it only ever accepted `{type:'data'}`); its docs/tests now
 *      pin the text-chunk frame as retired rather than "a different
 *      wire type".
 *
 *   rc8. **Client-side data-binding vocabulary leaves the protocol**
 *      (`types/data-bindings.ts`: `ClientToolName`, `ClientToolConfig`,
 *      `DataBindings`, `TypedToolConfig` + the per-tool config types).
 *      No wire envelope ever carried these; the only consumers were
 *      the two SDKs' orphaned client-side tools subsystems
 *      (registry / hooks / resolver / built-ins, the `/query` TanStack
 *      integration, and the `/testing` mock-tools helpers), deleted in
 *      the same slice (`@ggui-ai/react` + `@ggui-ai/react-native` lose
 *      the `tools`, `/query`, and `/testing` surfaces and the dead
 *      `queryClient` / `sessionId` provider plumbing). A future
 *      native-controller story reintroduces a resolver WITH a real
 *      producer, per the protocol-and-contract bar.
 *
 *   rc9. **MCP Apps thin shell emits the canonical
 *      `MALFORMED_BOOTSTRAP` reason.** The `ui://ggui/render` shell's
 *      `ggui:bootstrap-failed` postMessage carried the out-of-
 *      vocabulary `BOOTSTRAP_MALFORMED` (transposed words) — outside
 *      the SPEC §5.5.2 `BootstrapFailureReason` union, so spec-
 *      conformant hosts switch-casing on `reason` misclassified the
 *      known failure as unknown. The emit and its docstring now use
 *      the canonical member. (The CSP script hash is derived from the
 *      shell body at module load, so it tracks automatically.)
 *
 *   rc10. **`EVENT_NOT_ALLOWED` WS error code deleted** along with the
 *      no-op `assertEventAllowed` stub and the never-thrown
 *      `EventNotAllowedError` class in `@ggui-ai/mcp-server`. The
 *      pre-Phase-B `subscription.events` allowlist lost its wire
 *      shape in the session-stack collapse; the surviving ceremony
 *      was a defined failure mode with no reachable emitter. Inbound
 *      actions are gated by `assertActionContract` alone; docstrings
 *      across protocol / handlers / SDKs now say so. Per-render event
 *      policy, if wanted, re-enters as a designed slice with a real
 *      wire shape.
 *
 *   rc11. **`BOOTSTRAP_EXPIRED` guidance message names the live
 *      refresh tool.** The live channel's expired-credential error
 *      message (and five server docstrings + the cloud e2e G14 spec)
 *      still instructed callers to invoke the retired
 *      `ggui_runtime_refresh_bootstrap` name (renamed in r4.1). All
 *      now name `ggui_runtime_refresh_ws_token`; a grep-based
 *      regression test in `@ggui-ai/mcp-server` locks the retired
 *      name out of the package source.
 *
 *   rc12. **`UI_GEN_VERSION` deleted from `@ggui-ai/ui-gen`.** The
 *      published constant claimed to be "kept in sync with
 *      `package.json`" while shipping a stale value, and had zero
 *      consumers repo-wide — a published-API lie with no reader. No
 *      replacement; consumers that need the package version read it
 *      from the package manifest.
 *
 *   rc13. **`@ggui-ai/ui-gen` export map pruned 55 → 37 subpaths.**
 *      Fifteen never-imported subpath entries deleted
 *      (`./evaluation/mcp-server`, `./evaluation/prompts`,
 *      `./adapters/provider-router`, `./adapters/{claude,openai,
 *      google}/raw`, `./coding-agent`, `./coding-agent/boilerplate`,
 *      `./tools`, `./provider-adapter-mock`, `./compile`,
 *      `./validation/ui-compiler`, `./design-system-docs`,
 *      `./tools/get-wire`, `./tools/render-check`) plus the three
 *      redundant `/index` duplicate aliases (`./harness/index`,
 *      `./adapters/index`, `./evaluation/axis-checks/index` — the six
 *      monorepo import sites retargeted to the bare forms). The
 *      underlying modules stay (internal relative imports); only the
 *      dead published surface dies. `./blueprint-hint`, `./strategy`,
 *      `./user-request` were initially KEPT pending the
 *      predefined-match pipeline existence decision; that decision
 *      landed within this same release (wave-2 approved forks): the
 *      predefined-match pipeline was deleted and all three subpaths
 *      were removed with it.
 *
 *   ab1. **WS `data:submit` action ingress now feeds the consume
 *      pipe.** The live channel's `handleInboundAction` dual-writes
 *      every accepted `data:submit` envelope: the retained
 *      `user.submitted` ledger event (ack `payload.sequence` source —
 *      unchanged) AND a canonical consume entry
 *      (`{intent, actionData, uiContext, actionId, firedAt}`, the
 *      SAME shape `ggui_runtime_submit_action`'s dispatch branch
 *      appends) on the sessionId-keyed pending-events pipe — so
 *      `ggui_consume` drains WS-originated gestures identically to
 *      tools/call-relayed ones. `uiContext` is `{}` on this transport
 *      (WS clients mirror no contextSpec snapshot); `actionId` is a
 *      server-minted 8-hex correlation id; `firedAt` is server clock.
 *      New optional `GguiSessionChannelOptions.pendingEventConsumer`
 *      seam (`@ggui-ai/mcp-server`); `createGguiServer` threads its
 *      shared pipe instance whenever it composed the default handler
 *      set. Pipe-append failure degrades to ledger-only with a
 *      `render_channel_consume_append_failed` warn — ack semantics
 *      unchanged. This makes the long-documented SDK promise ("the
 *      agent receives actions via `ggui_consume`") TRUE on the WS
 *      transport; the `tool` hint is clarified as LEDGER-only
 *      vocabulary (operator surfaces) — consume entries carry no tool
 *      slot on either transport (SPEC §nextStep routing + walkthrough
 *      updated to the canonical drained shape).
 *
 *   ab2. **Client wire-config pipeline unified in `@ggui-ai/wire`.**
 *      New exports `buildWireConfig` (the ONE envelope-build →
 *      validate → emit dispatch pipeline + bus-backed subscribe) and
 *      `StreamBus` (+ `RESERVED_CHANNEL_REPLAY_MAX`), hoisted from
 *      `@ggui-ai/iframe-runtime`. `buildRootWireConfig` becomes an
 *      iframe-side adapter injecting its CSP-precompiled validator,
 *      ProtocolError dual-emission, and the tools/call-vs-WS
 *      transport seam; `@ggui-ai/react`'s `<GguiRender>` builds its
 *      `WireConfig` through the same shared pipeline (transport = WS
 *      `action` frame, violations → `onError`, `clientSeq` shared
 *      with `api.action`). `<GguiRender>` inbound `data` frames now
 *      land on a per-render `StreamBus` with the bounded reserved-
 *      channel replay ring — `_ggui:preview` frames arriving between
 *      the subscribe ack and the provisional renderer's mount replay
 *      to the late subscriber instead of dropping (behavior now
 *      identical across both first-party renderers, per MCP Apps
 *      Compliance). `useChannelStream` subscribes via the new
 *      internal `StreamBusContext` instead of `window` CustomEvents;
 *      the `BRIDGE_EVENTS.AGENT_DATA` window dispatch survives as a
 *      one-way host-shell broadcast. React-Native twins unchanged —
 *      porting the shared builder + bus to RN is the pending RN
 *      WireProvider slice.
 *
 *   hc1. **`@ggui-ai/mcp-server-handlers` dead public surface deleted
 *      (no wire change).** `UpdateUnsupportedError` (error class with
 *      zero throw sites; its `update_unsupported` code appeared in no
 *      spec or transport mapping); the empty `./contract-tests`
 *      subpath (an `export {}` module promising a
 *      `runRenderHandlerContract` battery that never landed) + the
 *      vestigial `peerDependenciesMeta.vitest`; the retired
 *      intent-keyed cache tail (`generationCacheKey`,
 *      `DEFAULT_CACHE_SIMILARITY_THRESHOLD`,
 *      `GenerationCacheDeps.similarityThreshold` — zero readers). The
 *      live-LLM dev probe no longer compiles into the published dist
 *      (tsconfig.build exclude).
 *
 *   hc2. **`@ggui-ai/mcp-server-core` contract-tests become executed
 *      truth.** `gguiSessionStoreContract` +
 *      `runGguiSessionStoreConformance` now RUN against both shipped
 *      stores (in-memory + sqlite, temp-file db) from the stores' own
 *      test files; `vitest` is declared as an optional peer dependency
 *      (the `./contract-tests` subpath imports it explicitly — the
 *      prior Jest-globals claim was false). Sqlite row reads narrow
 *      through validating guards instead of `as Row` casts (operator-
 *      mutable file = trust boundary); phantom impl names
 *      (PostgresGguiSessionStore, S3VectorsStore, FileVectorStore)
 *      leave the seam docstrings; ws-token prose names the real
 *      `wsToken` slice field and the G14 multi-use-within-TTL posture.
 *
 *   hc3. **`startSandboxProxyServer` re-homed to
 *      `@ggui-ai/agent-server`** (from `@ggui-ai/dev-stack`; module +
 *      test suite moved verbatim, exported from the agent-server
 *      barrel). agent-server drops its dev-stack dependency, so a
 *      published agent install no longer eagerly pulls the dev-stack
 *      toolchain (esbuild, chokidar). `@ggui-ai/dev-stack` also drops
 *      its zero-consumer discovery re-export block — the canonical
 *      home stays `@ggui-ai/project-config/node`. No compat
 *      re-exports (pre-launch).
 *
 *   hc4. **`ggui_ops_create_app` output schema gains optional
 *      `connectUrl`** (per-app MCP connect URL; emitted only by
 *      deployments exposing per-app ingress — the default OSS
 *      composition has no ingress knowledge and never sets it). The
 *      cloud pod's variant converges onto the full OSS output shape
 *      (`{appId, displayName, systemPrompt?, createdAt, updatedAt,
 *      connectUrl?}`), and the pod tool-registry parity gate now pins
 *      OUTPUT-schema identity (alongside input) for every shared wire
 *      name, so host output drift is structurally caught. Additive —
 *      existing callers unaffected.
 *
 *   hc5. **`@ggui-ai/negotiator` `validateContractStructure` →
 *      `validateContractRedundancy`** (TS-symbol rename, no wire
 *      change). The name collided with `@ggui-ai/protocol`'s normative
 *      structural validator of the same name while carrying different
 *      semantics (advisory warn-only redundant-action heuristic vs
 *      `ContractViolation` list). Protocol remains the sole owner of
 *      the `validateContractStructure` name; the negotiator export now
 *      says what it detects. No compat alias (pre-launch).
 *
 *   cc1. **`ggui_consume.timeout` bound restored to SPEC §7.3
 *      `[0, 25]`.** The shipped handler had drifted to a schema max of
 *      600s with a silent server-side truncation to a 120s default cap
 *      (and a `maxTimeoutSeconds` deployment override). All three die:
 *      the input schema now enforces integer `[0, 25]`, out-of-range
 *      values reject `INVALID_PARAMS` (-32602) at the tool-argument
 *      validation layer instead of being silently truncated, and the
 *      override knob is deleted (zero consumers; the bound is
 *      normative). SPEC §7.3's output section is simultaneously
 *      rewritten to the REAL drained-row shape — `ConsumeEventEntry`
 *      `{type:'action', sessionId, intent, actionData, uiContext,
 *      actionId, firedAt}` (+ the optional `client.hostContext` echo)
 *      — replacing the stale `{events: ActionEnvelope[]}` claim; the
 *      dedup guidance moves from `(sessionId, clientSeq)` (an ingress
 *      key) to `(sessionId, actionId)`. Agents that long-polled with
 *      `timeout > 25` MUST re-call `ggui_consume` in a loop instead.
 *
 *   pa1. **CLI publish-auth de-vendored (no wire change).** The
 *      `ggui {gadget,blueprint} publish` / `ggui keys register`
 *      default auth path no longer talks to an identity provider from
 *      the CLI: the direct-IdP `USER_PASSWORD_AUTH` + refresh flows,
 *      the `@aws-sdk/client-cognito-identity-provider` dependency (the
 *      only AWS SDK in any published `@ggui-ai/*` package), the
 *      `GGUI_REGISTRY_COGNITO_POOL_ID` /
 *      `GGUI_REGISTRY_COGNITO_APP_CLIENT_ID` env surface, and the
 *      per-registry `~/.ggui/auth/<host>/token.json` cache are all
 *      deleted. The default credential is the stored `ggui login`
 *      session (`~/.ggui/auth.json`), refreshed via
 *      `POST /v1/auth/refresh`; `--auth=bearer` is unchanged. Auth
 *      errors are rewritten vendor-neutrally, and an HTTP 401 from
 *      the registry surfaces as `auth_failed` with a credential-
 *      kind-specific diagnosis. (The hosted-registry server side
 *      landed 2026-06-11: the write routes' gateway authorizer
 *      validates `cli_at_*` session bearers, so the default auth
 *      path works end-to-end against `registry.ggui.ai`.)
 *
 * --------------------------------------------------------------------
 * Synchronous wired-action dispatch retired — agent-routed consume
 * loop is the single action model (2026-06-10, BREAKING, pre-launch):
 *
 *   wa1. **`StreamChannelEntry.tool` (refresh hint) deleted.** The
 *      per-channel "refresh this channel from tool X after an action"
 *      declaration is gone from the type and from
 *      `streamChannelEntrySchema`. The entry schema is `.strict()`,
 *      so a contract carrying a stray `tool` key now fails
 *      `CTR_SHAPE_UNRECOGNIZED_KEYS` at lint time. The channel data
 *      feed `StreamChannelEntry.source` (`{tool, args?}`) is a
 *      DIFFERENT axis and survives unchanged.
 *      `ResolvedStreamChannel` drops the matching passthrough.
 *
 *   wa2. **`ContractErrorCode` narrows.** `TOOL_NOT_FOUND`,
 *      `TOOL_THREW`, and `TOOL_TIMEOUT` leave the named union — their
 *      only emitters were the synchronous dispatch routers. The union
 *      stays extensibly-closed (`(string & {})` branch);
 *      `SCHEMA_VIOLATION` survives as the generic
 *      value-violates-contract-declared-schema code.
 *
 *   wa3. **`ContractErrorPayload` narrows to
 *      `{toolName, error, timestamp, schemaVersion?}`.**
 *      `actionName` and `sourceAction` (the
 *      `'wired-action' | 'refresh-stream'` dispatch provenance) are
 *      deleted along with their `validateContractErrorPayload` arms
 *      and the `makeContractErrorPayload` builder inputs. The
 *      `_ggui:contract-error` reserved channel, the payload validator,
 *      and `BUILTIN_RESERVED_VALIDATORS` all remain defined vocabulary.
 *
 *   wa4. **`actionNextSteps` deleted from the `ai.ggui/render`
 *      slice.** The per-action nextStep map (SPEC name
 *      `wiredActionTools`) existed to gate the client-side direct
 *      `tools/call` arm, which is retired; the agent hint now derives
 *      server-side from the render's `actionSpec[name].nextStep` when
 *      the consume event is built. `RefreshInput` /
 *      `EMPTY_REFRESH_INPUT` (router-only refresh-tool input types)
 *      are deleted with the dispatch path.
 *
 * --------------------------------------------------------------------
 * `AgentToolEntry` restructured — `{serverInfo?, toolInfo, usage, example}`
 * (2026-06-02, BREAKING, pre-launch):
 *
 *   z1. **`AgentToolEntry` fields regrouped.** The flat per-tool entry
 *      (`{description?, usage?, inputSchema?, outputSchema?, example?}`)
 *      is restructured to separate MCP-native descriptor from ggui
 *      authoring metadata:
 *        - NEW `serverInfo?: {name, version?}` — owning MCP server
 *          identity from the `initialize` handshake. OPTIONAL: populated
 *          by the agent-server catalog-builder / a host that exposes it;
 *          absent for hand-authored contracts. `(server, toolName)` is
 *          the canonical cross-framework identity; `serverInfo.version`
 *          is metadata, NOT identity.
 *        - NEW `toolInfo: {inputSchema, description?, outputSchema?}` —
 *          the MCP `tools/list` descriptor echoed verbatim (minus
 *          `name`, which is the catalog key). `inputSchema` is now
 *          REQUIRED (every MCP tool has one); the former top-level
 *          `description` / `inputSchema` / `outputSchema` MOVED here.
 *        - `usage` + `example` stay on the entry (the ggui authoring
 *          layer, not MCP).
 *      Entries remain keyed by bare `toolName` in
 *      `agentCapabilities.tools` (unchanged). The canonical contract
 *      hash strips ONLY `serverInfo.version` (metadata, not identity);
 *      `serverInfo.name` IS identity — it disambiguates two servers that
 *      expose a byte-identical bare tool name (e.g. Todoist vs Google-Tasks
 *      `todo_add`) — and remains in the hash, alongside
 *      `toolInfo.inputSchema` / `toolInfo.outputSchema`. (Refined
 *      2026-06-03: name promoted to identity; `serverInfo.version`
 *      relaxed to optional.)
 *      Pre-launch no-backcompat: every contract author / catalog-builder
 *      that emitted the flat shape MUST migrate to the nested
 *      `toolInfo`. `agentToolEntrySchema` is `.strict()` on both the
 *      outer entry and the inner `toolInfo` / `serverInfo` / `example`
 *      objects.
 *
 * --------------------------------------------------------------------
 * R4 — auth-credential `bootstrap` renamed to `wsToken`; aggregate
 * polling endpoint deleted; console session-meta route renamed
 * (BREAKING, pre-launch):
 *
 *   r4.1. **WS auth-credential field renamed.** The wire field that
 *      authenticates a live-channel subscribe was named "bootstrap" by
 *      historical accident — post-R3 the only thing called "bootstrap"
 *      on the wire was the credential, so the term lost its meaning.
 *      Renamed everywhere internally to `wsToken` (sharper, symmetric
 *      with `wsUrl`):
 *        - `SubscribePayload.bootstrap` → `SubscribePayload.wsToken`
 *        - `?bootstrap=<token>` WS upgrade query → `?wsToken=<token>`
 *        - `McpAppAiGguiSessionMeta.token` slice field → `wsToken`
 *        - `ChannelClientBootstrap.token` → `wsToken`
 *        - `bootstrap-tokens.ts` module → `ws-tokens.ts`
 *        - `mintBootstrapToken` / `verifyBootstrapToken` →
 *          `mintWsToken` / `verifyWsToken`
 *        - `refresh-bootstrap.ts` handler → `refresh-ws-token.ts`
 *        - `ggui_runtime_refresh_bootstrap` MCP tool →
 *          `ggui_runtime_refresh_ws_token`
 *        - Server config `bootstrapSecret` → `wsTokenSecret`
 *      The boot-lifecycle observable surface is independent and
 *      survives unchanged: {@link BootstrapFailureReason} +
 *      `ggui:bootstrap-failed` postMessage describe the boot lifecycle
 *      (mounting → code-ready → error), not the credential.
 *
 *   r4.2. **`/api/bootstrap/:shortCode` deleted; `/r/:shortCode`
 *      content-negotiated.** The standalone JSON polling endpoint was
 *      a workaround for `_meta`-stripping hosts + the iframe-runtime's
 *      `PollingTransport`. The HTML at `/r/<shortCode>` already
 *      inlines the same projection via `__GGUI_META__`. Replaced
 *      with one URL, two representations:
 *        - `GET /r/:shortCode` with `Accept: text/html` (or default) →
 *          HTML shell (unchanged byte-for-byte).
 *        - `GET /r/:shortCode` with `Accept: application/json` → slice
 *          envelope (`{"ai.ggui/session": {...}, "ai.ggui/stack-item":
 *          {...}}`), same shape as the wire `_meta` and the inline
 *          `__GGUI_META__` global. Single source of truth.
 *      Consumers (iframe-runtime polling, sample-agent useChat
 *      fallback, future cross-host clients) all migrate to the
 *      content-negotiated endpoint.
 *
 *   r4.3. **Inline global renamed.** `window.__GGUI_BOOTSTRAP__` →
 *      `window.__GGUI_META__`. The "BOOTSTRAP" prefix referred to the
 *      retired aggregate; the global now carries the slice meta pair
 *      (same shape as the wire `_meta`), so the name aligns with what
 *      the global is.
 *
 *   r4.4. **Console meta route renamed.**
 *      `/ggui/console/session-bootstrap?session=<id>` →
 *      `/ggui/console/sessions/:sessionId/meta`. Same JSON response
 *      shape (slice envelope post-R3). Console SessionViewer migrated.
 *
 *   r4.5. **Server-side `StackItemBootstrapView` →
 *      `StackItemMetaView`; `deriveStackItemBootstrapView` →
 *      `deriveStackItemMeta`.** The projection layer's "bootstrap" name
 *      was the last lingering vestige of the deleted aggregate.
 *
 * --------------------------------------------------------------------
 * R3 — `_meta.ggui.bootstrap` aggregate split into per-stability-window
 * slices (#109, BREAKING, pre-launch):
 *
 *   r3.1. **`_meta.ggui.bootstrap` aggregate DELETED from the wire.**
 *      The single-key MCP-Apps envelope ggui shipped for the iframe
 *      runtime is replaced by two per-stability-window keys on `_meta`:
 *
 *        - `_meta["ai.ggui/session"]` — mount-time identity, boot
 *          wiring, live-channel auth, capability advertisements
 *          ({@link McpAppAiGguiSessionMeta}).
 *        - `_meta["ai.ggui/stack-item"]` — the active stack item:
 *          stackItemId, props, action hints, contract pointer,
 *          component-mode discriminator
 *          ({@link McpAppAiGguiStackItemMeta}).
 *
 *      Hosts cache the session slice keyed by `sessionId`; render-only
 *      delta pushes carry just `stack-item`. Auth-rotation pushes carry
 *      just `session`.
 *
 *   r3.2. **`McpAppAiGguiMountView` deleted.** The aggregated TS type
 *      (and its pre-R1 `GguiBootstrapMeta` predecessor) is gone.
 *      Replaced by {@link McpAppAiGguiMeta} = `{session?, stackItem?}`
 *      — the parsed slice pair {@link parseMcpAppAiGguiMeta} returns.
 *      Wire-emitter helpers `mergeSlicesIntoMountView`,
 *      `splitMountViewIntoSlices`, `mountViewToMcpAppMeta`,
 *      `slicesToMcpAppMeta`, `combineMcpAppAiGguiMeta` all retired
 *      in favor of {@link parseMcpAppAiGguiMeta} (parse) +
 *      {@link toMcpAppEnvelope} (emit).
 *
 *   r3.3. **Auth-credential `bootstrap` survives R3.** R3 kept the
 *      `bootstrap` naming on the auth-credential surface
 *      ({@link SubscribePayload.wsToken}, `ws-tokens.ts`, the
 *      `wsTokenSecret` config field, the `mintWsToken` minter, the
 *      `__GGUI_META__` inline global, and the
 *      `ggui_runtime_refresh_ws_token` tool) on the principle that
 *      "bootstrap-the-credential" is a distinct namespace from
 *      "bootstrap-the-aggregate". R4 (entry above) retired that
 *      naming too — the credential namespace is now `wsToken` /
 *      `ws-tokens.*`.
 *
 *   r3.4. **Server projection layer renamed in R4.** R3 kept
 *      `StackItemBootstrapView` + `deriveStackItemBootstrapView` on
 *      the principle that the projection layer is its own namespace.
 *      R4 (entry above) renamed both to `StackItemMetaView` +
 *      `deriveStackItemMeta` — the projection now feeds slice meta
 *      (`{ "ai.ggui/session", "ai.ggui/stack-item" }`), so the
 *      "Meta" naming aligns with what the projection produces.
 *
 * --------------------------------------------------------------------
 * `McpAppAiGguiMeta.compiledValidators` — precompiled eval-free
 * runtime validators (ADDITIVE, non-breaking):
 *
 *   - `McpAppAiGguiMeta` (and the server's `StackItemMetaView`
 *     projection) gain an optional `compiledValidators` field —
 *     `CompiledContractValidators`: ESM validator-module source
 *     strings, one per `propsSpec` / `actionSpec` entry / `streamSpec`
 *     channel / `contextSpec` slot, compiled server-side by
 *     `compileValidatorModule`.
 *   - The renderer iframe runs under a strict CSP with no
 *     `'unsafe-eval'`, so it cannot run `ajv.compile()` (which builds
 *     validators via `new Function`). Validators are now compiled at
 *     push time — where `eval` is legal and the contract schema is
 *     fixed — and shipped; the iframe loads them via `blob:` dynamic
 *     import and only ever RUNS them.
 *   - Additive + optional: a bootstrap without the field is valid;
 *     a consumer that ignores it falls back to the server as the sole
 *     contract authority.
 *
 * --------------------------------------------------------------------
 * Wire `GadgetRef` retired — `clientCapabilities.gadgets` package-keyed,
 * `version` dropped from the wire (BREAKING, pre-launch):
 *
 *   w1. **`clientCapabilities.gadgets` is package-keyed.** The wire map
 *      flipped from `Record<bindingName, GadgetRef>` to
 *      `Record<packageName, GadgetPackageUse>`, where
 *      `GadgetPackageUse = Record<exportName, GadgetExportUse>` and
 *      `GadgetExportUse = { description?, usage? }`. A package entry IS
 *      its export map — the wire has no package-level field, so there
 *      is no `exports` wrapper. The export NAME is the inner map key;
 *      its grammar (`use`-prefixed hook vs PascalCase component)
 *      discriminates kind — there is no `hook` / `component` field and
 *      no arbitrary `binding` name.
 *
 *   w2. **`version` is OFF the wire.** A wire gadget reference carries
 *      identity only — `(package, export name)`. `version` is the
 *      operator's deployment pin in `App.gadgets`, not the agent's to
 *      author: the ggui server resolves the full `GadgetDescriptor`
 *      (version + transport metadata) from the catalog at push time.
 *      The catalog lint enforces ≤1 descriptor per package, so
 *      `(name, package)` resolves to exactly one registered export.
 *
 *   w3. **`GadgetRef` / `GadgetHookRef` / `GadgetComponentRef` /
 *      `GadgetRefBase` + schema `gadgetRefSchema` + helper
 *      `gadgetPackageKey` deleted.** New: `GadgetPackageUse`,
 *      `GadgetExportUse`, `GadgetUse` (a flattened `{ package, name,
 *      description?, usage? }` view) + `listContractGadgets(contract)`
 *      flatten helper. `gadgetIdentityKey` re-keyed to `(name, package)`.
 *
 *   w4. **Push reject `gadget_version_not_registered` removed.** With no
 *      wire `version` there is nothing to mismatch;
 *      `assertGadgetsRegistered` keeps `gadget_not_registered` +
 *      `gadget_package_mismatch`. New fatal catalog lint
 *      `LINT_GADGET_DUPLICATE_PACKAGE` enforces ≤1 descriptor per
 *      package in an app's `App.gadgets`.
 *
 * --------------------------------------------------------------------
 * `loadGadgets()` retired — gadgets direct-imported, runtime registry
 * per-package (BREAKING, pre-launch):
 *
 *   v1. **`McpAppAiGguiMeta.gadgets` is per-package.** The channel
 *      flipped from one entry per hook (`{hook, package?, bundleUrl?,
 *      bundleSri?}`) to one entry per registered gadget PACKAGE
 *      (`{package, bundleUrl?, bundleSri?}` — `package` REQUIRED). The
 *      iframe-runtime loads each package's module namespace once and
 *      stores it under `globalThis.__ggui__.gadgets[package]`, so every
 *      hook AND component export the package ships is reachable. The
 *      runtime `gadgets` slot is correspondingly keyed by package name
 *      (`Record<package, ModuleNamespace>`), not flat by hook name.
 *
 *   v2. **`loadGadgets()` removed from `@ggui-ai/gadgets`.** Generated
 *      component code now direct-imports gadget exports
 *      (`import { useLeafletMap } from '@my-org/leaflet'`) — one idiom
 *      with the design-system primitives. The `loadGadgets()` accessor
 *      + its `GadgetsCatalog` Proxy are gone; the 7 STDLIB hooks stay
 *      as plain named exports of `@ggui-ai/gadgets`. The iframe-runtime
 *      rewriter resolves every gadget package specifier to a
 *      per-package data-URL shim (hook exports → lazy thunks, component
 *      exports → error-boundary-wrapped components).
 *
 * --------------------------------------------------------------------
 * Component gadgets — `GadgetDescriptor` normalized to a package
 * (BREAKING, pre-launch):
 *
 *   u1. **`GadgetDescriptor` is now a PACKAGE.** A descriptor carries
 *      package identity (`package`, `version`) + transport metadata
 *      (`bundleUrl`, `bundleHost`, `bundleSri`, `styleUrl`, `connect`,
 *      `requires`, `typesUrl`, `typesSri`) once at the package level,
 *      plus an `exports: GadgetExport[]` array (≥1, enforced by the
 *      schema). The per-export fields that used to sit flat on the
 *      descriptor — `hook`, `description`, `usage`, `example`,
 *      `gotchas`, `permission`, `required` — MOVED onto each
 *      `exports[*]`. A gadget package can now ship more than one
 *      export behind a single npm identity + bundle.
 *
 *   u2. **`GadgetExport` is a union discriminated by field presence
 *      (`hook` vs `component`) — no `kind` field.**
 *      `GadgetExport = GadgetHookExport | GadgetComponentExport`,
 *      told apart by which identifier field is present: `{hook, …}` is
 *      a `use`-prefixed React hook the generated component calls;
 *      `{component, …}` is a PascalCase React component the generated
 *      code renders as JSX. Both share the per-export teaching text
 *      (`description` / `usage` / `example` / `gotchas`) + runtime
 *      gates (`permission` / `required`) via `GadgetExportBase`. New
 *      schemas `gadgetExportSchema` (wire-permissive) +
 *      `strictGadgetExportSchema` (registry — teaching text required,
 *      `permission` enum-tight).
 *
 *   u3. **`GadgetRef` (wire) is a union discriminated by field
 *      presence (`hook` vs `component`) — no `kind` field.**
 *      `GadgetRef = GadgetHookRef | GadgetComponentRef` — the wire
 *      ref selects ONE export of a registered package:
 *      `{hook, package, version, description?, usage?}`
 *      or `{component, package, version, description?, usage?}`.
 *      `gadgetRefSchema` is a `z.union([…])` of two `.strict()`
 *      members — transport fields + per-export registry metadata stay
 *      off the wire.
 *
 *   u4. **`descriptorToJSDoc` → `exportToJSDoc`.** The codegen helper
 *      now takes a `GadgetExport` (`exportToJSDoc(entry: GadgetExport)`)
 *      and projects its per-export teaching text. `catalogToAugmentationDts`
 *      walks `descriptor.exports`, emitting one `typeof import(...)`
 *      declaration per HOOK export (component exports are skipped —
 *      `GadgetsCatalog` is the `loadGadgets()` hook surface).
 *      (`catalogToAugmentationDts` retired GG.8.3 — the descriptor-
 *      derived TS augmentation supersedes it.)
 *
 *   u5. **New helpers `gadgetExportName` / `gadgetPackageKey`.**
 *      `gadgetExportName(x: GadgetRef | GadgetExport)` returns the
 *      `hook` | `component` name — the single accessor every site
 *      that used to read `.hook` now calls. `gadgetPackageKey({package,
 *      version})` is the canonical `(package, version)` dedup key the
 *      resolver keys on; `gadgetIdentityKey(ref)` is the full
 *      `(name, package, version)` export-identity key the push-time
 *      gates agree on (the hook / component name grammars are
 *      disjoint, so the name itself is kind-disambiguating).
 *      (`gadgetPackageKey` + `GadgetRef` retired in GG.8.8 — the wire
 *      went package-keyed, so `version` left the wire and the
 *      `(package, version)` key collapsed to package-only; see the
 *      w-block. `gadgetIdentityKey` now keys `(name, package)`.)
 *
 *   u6. **New name grammars `HOOK_NAME_RE` + `COMPONENT_NAME_RE`.**
 *      `HOOK_NAME_RE` (`/^use[A-Z][A-Za-z0-9]*$/`) pins the
 *      `use`-prefixed hook grammar; `COMPONENT_NAME_RE`
 *      (`/^[A-Z][A-Za-z0-9]*$/`) pins the PascalCase component
 *      grammar. Both the wire `gadgetRefSchema` and the registry
 *      `gadget(Strict)ExportSchema` enforce them, so a malformed
 *      export name fails loudly at parse time.
 *      (`gadgetRefSchema` retired GG.8.8 with the wire shift to the
 *      package-keyed `clientCapabilities.gadgets` map; the grammars
 *      themselves stay live — see the w-block.)
 *
 *   `STDLIB_GADGETS` collapses to a 1-element array — the
 *   `@ggui-ai/gadgets` package descriptor whose `exports` are the
 *   seven stdlib hook exports. `loadGadgets()` + component-gadget
 *   rendering are GG.8.2+ work; GG.8.1 is the type/schema layer only.
 *
 * --------------------------------------------------------------------
 * Client-library plugin SDK + registry-membership gate (additive, no
 * wire breakage):
 *
 *   p1. **`createGguiGadget` SDK** in `@ggui-ai/gadgets`.
 *      Authors a single wrapper that publishes a stable React hook
 *      contract atop a 3rd-party library (Leaflet, Mapbox, Stripe,
 *      Chart.js, …) so the LLM never sees raw library APIs. Every
 *      wrapper carries `{description, usage, example}` (required) +
 *      optional `{gotchas, version, package, bundleUrl, styleUrl,
 *      connect[]}`. The factory zod-validates the spec at module load
 *      and throws `WrapperConformanceError` with field-path violations
 *      on shape misses. Returns a callable hook whose immutable
 *      `.descriptor` is what operators register on
 *      `App.gadgets`.
 *
 *   p2. **Two-schema strictness pattern on `GadgetDescriptor`.** A
 *      single TS type drives both the registry (strict —
 *      `strictGadgetDescriptorSchema` requires `description` /
 *      `usage` / `example` and at least one of `package` /
 *      `bundleUrl`) and the contract refs (permissive —
 *      `gadgetDescriptorSchema` for wire/contract use). Strictness
 *      lives in the validators, not the type, so consumers don't
 *      duplicate type defs.
 *
 *   p3. **Registry-membership gate at push validation.**
 *      `assertGadgetsRegistered(contract, appGadgets)`
 *      walks `contract.clientCapabilities.gadgets[*].hook` and
 *      throws `GadgetNotRegisteredError` on any reference not
 *      present in `App.gadgets`. Carries did-you-mean
 *      suggestions via `findClosestRegisteredHook` (Levenshtein < 3
 *      cutoff). Push falls back to `STDLIB_GADGETS` when the
 *      `App` row exists but doesn't carry an explicit catalog —
 *      symmetric with handshake.ts and list-gadgets.ts so
 *      every default-configured server enforces the gate without
 *      explicit operator config.
 *
 *   p4. **Push-time enrichment of `StackItem.clientCapabilities`.**
 *      Thin contract Refs are merged with the canonical registry
 *      descriptor so the persisted StackItem carries the FULL entry
 *      (teaching text + bundleUrl + styleUrl + connect[]).
 *      Contract-side overrides win on conflict so agents may author
 *      intent-specific description/usage at the mount site.
 *
 *   p5. **CSP derivation from registered gadget origins.** New
 *      `deriveBundleOrigins(item)` reads `bundleUrl` / `styleUrl` /
 *      `connect[]` off the enriched StackItem and emits per-directive
 *      origin buckets. `composeContentSecurityPolicy(origins)` formats
 *      them into a `Content-Security-Policy` header value
 *      (`script-src 'self' 'unsafe-inline' <origins>` so the inline
 *      `__GGUI_META__` survives, `style-src 'self' 'unsafe-inline'
 *      <origins>`, `connect-src 'self' <origins>`, `img-src 'self'
 *      data: <connect-origins>` so map tiles load). The renderer route
 *      attaches the header on `/r/<shortCode>` ONLY when libraries
 *      declare external origins — pre-plugin scenarios stay
 *      header-clean.
 *
 *   p6. **Boilerplate generator prefers `bundleUrl` over `package`.**
 *      Imports group by `bundleUrl ?? package` so a gadget with a
 *      hosted bundle emits
 *      `import { useLeafletMap } from 'https://registry.ggui.ai/leaflet@0.0.1/bundle.js'`,
 *      while npm-packaged-only libraries fall through to the existing
 *      bare-specifier path.
 *
 *   p7. **Teaching-text plumb into BOTH LLM paths.** The same
 *      `composeAvailableGadgetsSection(libraries)` helper feeds the
 *      synth prompt (`synthesize-contract.ts`) AND the decision-LLM
 *      prompt (`decision.ts`'s `buildDecisionUserMessage`). Both paths
 *      now see `description` + `usage` for every registered gadget
 *      with bounded per-entry (300 chars) + total (3 KB) budgets, so
 *      `App.gadgets`-registered plugins instruct the LLM
 *      uniformly without per-gadget prompt engineering.
 *
 *   p8. **CLI seed via `ggui.json#app.gadgets`.** Manifest
 *      schema gains an optional array of full registry descriptors;
 *      the CLI threads them into `InMemoryAppMetadataStore` so the
 *      same in-process singleton powers `ggui_list_gadgets`,
 *      handshake, push validation + enrichment, and CSP derivation.
 *
 *   p9. **Reference plugin + e2e gate.** `@ggui-samples/gadget-leaflet`
 *      ships as the canonical wrapper-author example;
 *      `@ggui-samples/ggui-leaflet-demo` is a sample server with the
 *      Leaflet plugin pre-registered. e2e/scenarios/19 pins the
 *      registry-membership gate end-to-end on the wire (registered
 *      hook accepts, unregistered hook rejects with
 *      `gadget_not_registered`, typo gets did-you-mean).
 *      Live-verified against `ggui-default` with a real LLM-backed
 *      negotiator.
 *
 * --------------------------------------------------------------------
 * Ajv layered validation (single source of truth for inner JSON
 * Schema + runtime data validation):
 *
 *   v1. **All four runtime validators use Ajv + closed-shape.** The
 *      hand-rolled JSON-Schema-subset validator is retired.
 *      `validatePropsData` / `validateActionData` / `validateStreamData`
 *      / `validateContextData` now share one seam — `compileForValidation()`
 *      from `@ggui-ai/protocol/validation/ajv-runtime` — which injects
 *      `additionalProperties: false` at every object node before Ajv
 *      compiles. Closed-shape applies uniformly at any depth (arrays
 *      of objects, oneOf branches, additionalProperties-as-schema).
 *      The `done`-vs-declared-`completed` class of bug — and any
 *      similar field-name divergence — surfaces as a wire-time
 *      `ContractViolationError` with the exact path (`todos[0].done`)
 *      instead of rendering silently as `undefined`.
 *      Authors who genuinely want an opaque-object escape hatch set
 *      `additionalProperties: true` explicitly on the schema; the
 *      injector preserves author intent (boolean kept, schema-form
 *      recursed into).
 *      Tolerated keywords: `example` (OpenAPI metadata) and
 *      `nullable` (OpenAPI 3.0 shorthand) registered as no-ops so
 *      Ajv strict mode doesn't reject schemas that carry them.
 *      Pre-launch no-backcompat: stream / action / context schemas
 *      authored as `{type: 'object'}` with no `properties` now mean
 *      "empty object only" (not "any object"). Migrate to explicit
 *      `properties` declarations OR set `additionalProperties: true`.
 *
 *   v2. **Layer-B meta-validation at handshake + push.**
 *      `assertContractSchemasValid(contract)` walks the six inner
 *      JSON Schema fields (`propsSpec.properties[*].schema`,
 *      `actionSpec[*].schema`, `streamSpec[*].schema`,
 *      `contextSpec[*].schema`,
 *      `agentCapabilities.tools[*].toolInfo.inputSchema`,
 *      `agentCapabilities.tools[*].toolInfo.outputSchema`) and runs
 *      `compileForValidation()` on each. Ajv strict mode throws at
 *      compile-time on malformed schemas (unknown keywords, properties
 *      values that aren't schemas, array schemas with non-schema
 *      items). Every offender collects into one
 *      `ContractSchemaMetaError` so the agent fixes them all in one
 *      round rather than retry-per-field. Called BEFORE the
 *      negotiator runs (handshake) and BEFORE any state mutation
 *      (push). Same fail-fast posture as the cross-reference +
 *      name-invariant + schema-compat assertions already in place.
 *
 *   v3. **Wrapper zod schemas are `.strict()`.** Seven entry/spec
 *      wrappers in `@ggui-ai/protocol/schemas/data-contract` flipped
 *      from `.passthrough()` to `.strict()`:
 *      `propEntrySchema`, `propsSpecSchema`, `actionEntrySchema`,
 *      `streamChannelEntrySchema` (+ its inner `source` schema),
 *      `contextEntrySchema`, `agentToolEntrySchema` (+ its inner
 *      `example` schema), `gadgetDescriptorSchema`. Extras at the
 *      wrapper layer now reject — symmetric with the closed-shape
 *      rigor at the data layer. `jsonSchemaSchema` and the outer
 *      `dataContractSchema` envelope stay permissive (vendor JSON
 *      Schema extensions + forward-compatibility for future top-
 *      level fields).
 *      Pre-launch no-backcompat: agents that put unknown fields at
 *      wrapper layers MUST migrate. Common offender: `required: []`
 *      on the `propsSpec` wrapper (required lives per-entry, not at
 *      the spec level).
 *
 * --------------------------------------------------------------------
 * propsSpec closed-shape (strict mode) + wire-schema trim:
 *
 *   u3. **`pushOutputSchema` + `updateOutputSchema` + `handshakeOutputSchema`
 *      trimmed to match handler reality.** Three response schemas in
 *      `@ggui-ai/protocol/schemas/mcp` were carrying retired fields
 *      that handlers had already stopped emitting (zod strips them
 *      before serialization). Public schema now mirrors what flows on
 *      the wire — third-party importers see the same shape the
 *      structuredContent carries:
 *        - `handshakeOutputSchema`: dropped `reason`, `target`,
 *          `alternatives`, `contractHash`, `serverCapabilities`.
 *          `serverCapabilities` flows via `_meta.ggui.bootstrap` instead.
 *          (`reason` was later reinstated as an optional ≤280-char wire
 *          field — see the o-block below.)
 *        - `pushOutputSchema`: dropped `sessionId`, `shortCode`,
 *          `codeReady`, `handshakeId`, `decision`, `contract`,
 *          `interaction`, `contractHash`, `cache.*`, `codeUrl`,
 *          `codeHash`. Wire shape is now `{stackItemId, url, action,
 *          nextStep?}` — 90% byte reduction at the trim layer.
 *        - `updateOutputSchema`: dropped `sessionId`, `decision`,
 *          `contract`, `interaction`, `contractHash`. Wire shape is
 *          now `{stackItemId, updated}`.
 *      Pre-launch no-backcompat: consumers that read any of the dropped
 *      fields off the wire response MUST migrate. Internal telemetry
 *      threading via the TS-only `HandshakeOutput` / `PushOutput`
 *      shapes is preserved for handler-side callers. (`ggui_update`'s
 *      parallel TS shape is gone as of ggui#798 — the handler's return
 *      type is `GguiUpdateOutput`, `z.infer` of `updateOutputSchema`,
 *      so there is nothing left for it to carry beyond the wire.)
 *
 *   u2. **`validatePropsData` is closed-shape (strict mode).** Keys
 *      not declared on `propsSpec.properties` are now rejected with
 *      `ContractViolationError{tool:'ggui_update'}` (or `'ggui_push'`
 *      depending on call site). Load-bearing for `ggui_update kind:'merge'`
 *      — without it, a typo'd patch field would silently land on the
 *      stack item with no propsSpec coverage. Symmetric with
 *      `validateActionData`'s allowlist enforcement; intentionally
 *      asymmetric with `actionSpec.data` / `streamSpec.payload` /
 *      `contextSpec.value` (those validate type-only, forward-compatible).
 *      Pre-launch no-backcompat: agents that sent extra metadata fields
 *      alongside declared props MUST refine the contract's `propsSpec`
 *      to declare them, or drop them from the wire payload.
 *
 * --------------------------------------------------------------------
 * `ggui_update` replace + merge modes:
 *
 *   u1. **`kind: 'replace' | 'merge'` discriminator on `ggui_update`.**
 *      Wire input reshaped from `{stackItemId, props}` to a
 *      discriminated union:
 *        - `{stackItemId, kind:'replace', props}` — full props
 *          replacement; the map IS the new state. Same semantics as
 *          the pre-discriminator wire.
 *        - `{stackItemId, kind:'merge', patch}` — RFC 7396 JSON Merge
 *          Patch (top-level shallow merge; nested objects recurse;
 *          `null` deletes the key; arrays fully replace). Use when
 *          most props stay the same and the agent only needs to send
 *          a delta — typical after a single domain-tool mutation.
 *      Both modes validate the FINAL props (post-merge for `merge`)
 *      against the stack item's `propsSpec` and reject on violation.
 *      Missing the required field for a mode (e.g. `kind:'merge'`
 *      without `patch`) throws `ContractViolationError{tool:
 *      'ggui_update'}` pre-mutation.
 *      Pre-launch no-backcompat: agents that issued the old
 *      `{stackItemId, props}` shape MUST migrate to
 *      `{stackItemId, kind:'replace', props}`. The OSS handler's
 *      handshakeId arm was retired in the same pass; protocol schema
 *      now mirrors the handler's direct-only surface.
 *
 * --------------------------------------------------------------------
 * Pipe-as-single-source-of-truth pivot:
 *
 *   t1. **`ggui_runtime_claim_pending` retired.** The iframe-side rescue
 *      drain + its 10s claim timer + per-action `pendingActions` map
 *      are gone. The pipe is the single source of truth: the agent
 *      retrieves every gesture EXCLUSIVELY via `ggui_consume`. When the
 *      event lands on the pipe but no consume long-poll is listening
 *      (`consumerPresent: false`), the iframe emits a pure-pointer
 *      `ui/message` doorbell so a fresh turn drains it; on enqueue
 *      failure (`PIPE_NOT_FOUND` / transport error) the gesture is on no
 *      pipe, so a local toast surfaces and no `ui/message` is sent. No
 *      timer, no rescue, no inline payload, no race between atomic-pop
 *      callers.
 *
 *   t2. **`content[0]._meta["ai.ggui/userAction"]` PURE DOORBELL.** A
 *      single `kind: 'user-action'` slice on `ui/message` envelopes
 *      (it replaced the earlier `fallback`/`nudge` split, and then the
 *      `queued`/`inline` discriminated union — the `inline` variant's
 *      inline payload was a double-trigger hazard). The slice carries
 *      ONLY a pointer to the render whose pipe holds the gesture
 *      (`renderId` + the prepared `{tool: 'ggui_consume', args:
 *      {renderId}}` nextStep); the agent retrieves the action
 *      EXCLUSIVELY via `ggui_consume`, so it fires exactly once.
 *      Emitted when `submit_action` returned `{ok:true,
 *      consumerPresent:false}`. The actionable directive lives in the
 *      iframe-authored `ui/message` TEXT (every host forwards it to the
 *      model); this `_meta` slice is the OPTIONAL structured mirror —
 *      `GguiUserActionMeta` on `@ggui-ai/protocol/integrations/
 *      mcp-apps`. No part of the loop depends on a server-side parse.
 *
 *   t3. **Per-event `uiContext` on the pipe.** `submit_action`'s
 *      `dispatch` payload reshaped from `{intent, data}` to `{intent,
 *      actionData, uiContext}`. The iframe captures the contract's
 *      `contextSpec` snapshot at gesture time and stores it on the
 *      pipe entry alongside the action data — `consume`'s output
 *      events now carry `{intent, actionData, uiContext, actionId,
 *      firedAt}` per event.
 *
 *   t4. **`GguiConsumeOutput.contextSnapshot` retired.** The top-level
 *      contextSpec snapshot on consume's output is gone. Per-event
 *      `uiContext` (t3) replaces it. Agents read state AS OF the
 *      moment the user acted — not the post-action state that might
 *      have already mutated by the time consume returns.
 *
 * --------------------------------------------------------------------
 * No-active-consumer fast-path:
 *
 *   s1. **`consumerPresent` on `ggui_runtime_submit_action` output.** New
 *      optional `consumerPresent?: boolean` field on the dispatch
 *      success branch. When `true`, at least one `ggui_consume`
 *      long-poll is currently registered against the targeted stack
 *      item — iframe takes today's path (10s claim timer + drain_ack
 *      race). When `false`, no consumer is registered: the action IS
 *      on the pipe, but the agent won't wake on its own. Iframe
 *      SHOULD immediately emit a `ui/message` nudge instead of
 *      waiting on the 10s timer. When `undefined`, the server doesn't
 *      have an active-consumer registry wired (graceful degradation;
 *      iframe falls back to the timer). Additive — agnostic consumers
 *      ignore the field.
 *
 *   s2. **`_meta.ggui.nudge` discriminator on `ui/message`.** New
 *      structured fingerprint paired with the free-form text nudge:
 *      `{reason: 'no_active_consumer', stackItemId, actionId,
 *      submittedAt}`. Sibling of `_meta.ggui.fallback` but
 *      semantically distinct — the nudge carries NO action payload
 *      (the pipe holds the data); it's a pure wake-up signal telling
 *      the agent to `ggui_consume({stackItemId})`. Type guard
 *      `isGguiNudgeMeta` mirrors `isGguiFallbackMeta` so ggui-aware
 *      SDKs route deterministically. Additive — agnostic hosts ignore
 *      the field; free-form text alone is enough to act on.
 *
 *   s3. **`ActiveConsumerRegistry` seam (`@ggui-ai/mcp-server-core`).**
 *      Optional in-process reference-count seam tracking which stack
 *      items currently have an in-flight `ggui_consume` long-poll.
 *      `consume.ts` wraps its long-poll in `enter`/`exit`;
 *      `submit-action.ts` queries `hasActive` after a successful pipe
 *      append. Reference impl `InMemoryActiveConsumerRegistry` ships;
 *      cloud/multi-pod deployments wire a Redis-backed adapter
 *      against the same interface. Mirrors the optional-seam pattern
 *      of `DrainAckNotifier` / `ObserverNotifier` / `ConsumeLogger`.
 *
 * --------------------------------------------------------------------
 * Action drain guarantee:
 *
 *   r1. **Drain-guarantee envelope + WS channel.** New optional
 *      `_meta.ggui.fallback` discriminator on `ui/message` envelopes
 *      (`reason: 'pipe_not_found' | 'timeout'`) so ggui-aware SDKs
 *      can route fallback gestures through their tool-result loop
 *      instead of injecting as a synthetic user prompt. New
 *      server→client `drain_ack` WS frame so the iframe-runtime can
 *      cancel its per-action 10s claim timer + dismiss the toast as
 *      `consumed` when an event drains via `ggui_consume`.
 *      Additive — agnostic hosts ignore the `_meta.ggui.fallback`
 *      field and the unrecognized WS frame (no protocol break).
 *
 *   r2. **`ggui_runtime_claim_pending` wire.** New `audience: 'runtime'`
 *      tool the iframe calls from its per-action 10s timer to
 *      atomically pop a stale pipe entry when the host agent isn't
 *      draining. Same `consumeAndClear` primitive `ggui_consume` uses
 *      (one caller wins; race resolves at the server-side lock). The
 *      tool isn't agent-addressable; it surfaces on `/mcp` only and
 *      gates through the postMessage relay.
 *
 *   r3. **Drain-guarantee telemetry.** New `action_consume_slow`
 *      info-event (submit → drain latency >2s) and
 *      `action_claim_timeout` warn-event (claim_pending fired because
 *      nobody drained for 10s). Operators derive the fallback-ratio
 *      protocol-adherence metric from these.
 *
 * --------------------------------------------------------------------
 * Bootstrap-meta cleanup:
 *
 *   q1. **`_meta.ggui.bootstrap.componentCode` retired.** The
 *      inline base64 ESM channel on the bootstrap envelope is deleted.
 *      Static-component bootstraps now travel exclusively via the
 *      content-addressable `codeUrl` channel composed by the push
 *      handler from its `codeStore` + `codeBaseUrl` deps. The
 *      `hasPushBootstrapMeta` discriminator collapses from
 *      `{wsUrl-with-token, componentCode, codeUrl, kind}` to
 *      `{wsUrl-with-token, codeUrl, kind}`. `StackItemMetaView`
 *      drops the field on the projection layer. `buildSelfContainedShell`
 *      accepts `{codeUrl, codeHash}` (or `systemKind`, or live-mode
 *      trio); throws when none are set. `/r/<shortCode>` mints
 *      codeUrl via codeStore.hashOf + put; falls through to live-mode
 *      when codeStore isn't wired. Iframe-runtime parser drops
 *      `componentCode` read + the inline-base64 `decodeBase64Utf8`
 *      helper. Saves 5-50KB per push.
 *
 *   q2. **`_meta.ggui.bootstrap.adapters` retired.** The
 *      dormant dynamic-import-at-boot adapter loader is deleted from
 *      the wire surface. `McpAppAiGguiMeta.adapters?` field removed;
 *      `parseAdapterSpecs` + `installAdapters` + the
 *      `globalThis.__ggui__.adapters` registry slot retired from
 *      iframe-runtime. An earlier change had already moved capability
 *      hooks to `@ggui-ai/gadgets`; this cleanup closes the
 *      dead surface. Native shells (`@ggui-ai/camera`,
 *      `@ggui-ai/ggui-react-native`) unchanged — they register
 *      adapters via their own `<GguiProvider>` React Context, never
 *      via bootstrap-meta.
 *
 * --------------------------------------------------------------------
 * MCP Apps compliance & update fan-out:
 *
 *   p1. **`ggui_stream` → `ggui_emit` rename (wire name + symbol prefix).**
 *      The send-from-agent-to-iframe tool was named `ggui_stream`, which
 *      reads as a noun referring to the stream object rather than the
 *      imperative act of emitting. `ggui_emit` reads correctly as an
 *      action and disambiguates from the wire field `streamSpec` (which
 *      keeps its name — it describes channels, not the act of emitting).
 *      Mechanical sweep across `@ggui-ai/protocol`, `@ggui-ai/mcp-server-handlers`,
 *      `@ggui-ai/mcp-server`, `@ggui-ai/ggui-cli`, `@ggui-ai/ggui-react-native`,
 *      `cloud/ggui-protocol-pod`, `cloud/generation-runtime`, and `cloud/cdk`:
 *
 *      - Wire-name literal `'ggui_stream'` → `'ggui_emit'`
 *      - Pascal symbol prefix `GguiStream` → `GguiEmit` (covers
 *        `GguiEmitInput`, `GguiEmitOutput`, `GguiEmitHandlerDeps`,
 *        `createGguiEmitHandler`)
 *      - Test-d file rename `ggui-stream.test-d.ts` → `ggui-emit.test-d.ts`
 *
 *      Untouched (NOT the tool name): `streamSpec`, `StreamChannelEntry`,
 *      `StreamEnvelope`, `SessionChannelServer`, `streamReplayOps`, and
 *      file paths like `renders/stream.ts`. These describe the
 *      channel data plane, not the imperative emit action.
 *      Pre-launch breaking rename; no compatibility shim.
 *
 *   p2. **`ggui_update` emits `_meta.ggui.bootstrap` on tool result.**
 *      Previously, the canonical re-apply path
 *      (MCP Apps `ui/notifications/tool-result` → host postMessage → iframe
 *      `_meta.ggui.bootstrap` consumer in `@ggui-ai/iframe-runtime`) had
 *      no envelope to deliver: `ggui_update`'s `resultMeta` was empty.
 *      Hosts that forwarded tool results couldn't trigger the spec-compliant
 *      live-update path. `createGguiUpdateHandler` now accepts the same
 *      bootstrap-emitting deps as `ggui_push` (`mintBootstrap`, `runtimeUrl`,
 *      `themeId`, `themeMode`, `themeProvider`, `appCallableTools`,
 *      `streamWebSocketLocalTools`) and emits `_meta.ggui.bootstrap`
 *      derived from the just-patched stack item via the shared
 *      `deriveStackItemMeta` projection — byte-identical to
 *      `ggui_push`'s bootstrap envelope at the projection boundary.
 *      Strictly additive: prior consumers that ignored `resultMeta` are
 *      unaffected; hosts that DO forward `_meta.ggui.bootstrap` now
 *      receive the new envelope and can re-render without losing client
 *      state. Follows the MCP Apps tool-result forwarding rule.
 *      No wire-shape change; behavior change on `ggui_update`'s response
 *      `_meta` only.
 *
 *   p3. **`/r/<shortCode>` mints the live trio (`wsUrl + token + expiresAt`)
 *      and inlines it in `__GGUI_META__`.** Previously the public
 *      render route minted no bootstrap token, so iframe-runtime's
 *      `subscribe.ts` rejected the envelope as "live-mode required" and
 *      never opened a WS — `props_update` and stream frames never reached
 *      the iframe even when the server fan-out fired. The route now calls
 *      `mintBootstrap(sessionId, appId)` when the minter is wired,
 *      rewrites localhost wsUrl to the request host (mirroring
 *      `/api/bootstrap/<shortCode>`), and threads the three fields into
 *      `buildSelfContainedShell`. `SelfContainedShellInputs` gains the
 *      three optional live-trio fields. Strictly additive — pre-existing
 *      static-only renders behave identically when no minter is wired.
 *
 * --------------------------------------------------------------------
 * Multi-variant Blueprints — three-step handshake protocol:
 *
 *   o. **Three-step handshake protocol.** `match` / `plan` /
 *      `hint` / `provisional` / `contractHash` (the previous
 *      top-level shape) DELETED from `handshakeOutputSchema`; replaced
 *      by a
 *      single `suggestion: HandshakeSuggestion` carrying a
 *      `origin: 'cache' | 'agent' | 'synth'` enum that routes the
 *      agent's next decision. `blueprintMeta` is ALWAYS present.
 *      `handshakeInputSchema` reshape: `contract?` + `hint?` ⇒ single
 *      `blueprintDraft: {contract, variance?, generator?}` (top-level
 *      `hint` field deleted in this slice). `handshakeOutputSchema`
 *      gains optional `alternatives: Blueprint[]` (top-N search misses
 *      below threshold so the agent can override into one).
 *      `pushInputSchema` reshape: `contract?` + `contractHash?` triad
 *      DELETED; replaced by a `decision` discriminator
 *      (`{kind: 'accept'} | {kind: 'override', blueprintDraft: {...}}`).
 *      `accept` reuses the provisional `blueprintId` from the
 *      handshake's `suggestion.blueprintMeta`; `override` mints a
 *      fresh `blueprintId` against a NEW draft. New types
 *      `BlueprintDraft`, `BlueprintMeta`, `SuggestionOrigin`,
 *      `HandshakeSuggestion`, `PushDecision`, `JsonPatch` ship in
 *      `@ggui-ai/protocol/types/handshake-suggestion` with zod mirrors
 *      in `@ggui-ai/protocol/schemas/handshake-suggestion`. A breaking
 *      reshape.
 *
 * --------------------------------------------------------------------
 * Multi-variant Blueprints — operator-class blueprint tools:
 *
 *   o. **Operator-class blueprint tool schemas** added to
 *      `@ggui-ai/protocol/schemas/ops-blueprint`. Four input/output
 *      pairs for the operator MCP tools:
 *
 *      - `opsGenerateBlueprintInputSchema` /
 *        `opsGenerateBlueprintOutputSchema` — `ggui_ops_generate_blueprint`.
 *        Operator-authored blueprint generation, persona-tagged,
 *        optional `setAsOperatorDefault` flag.
 *      - `opsListBlueprintsInputSchema` /
 *        `opsListBlueprintsOutputSchema` — `ggui_ops_list_blueprints`.
 *        Indexed `(appId, contractHash)` list OR semantic search via
 *        `BlueprintSearch` when `intentKeywords` / `persona` is set.
 *      - `opsUpdateBlueprintInputSchema` /
 *        `opsUpdateBlueprintOutputSchema` — `ggui_ops_update_blueprint`.
 *        Mutable-field patch — `isOperatorDefault?: true` + partial
 *        `variance?`. Immutable fields (contractHash, appId,
 *        codeS3Url, codeHash, generator, createdAt, createdBy) are
 *        absent from the schema.
 *      - `opsDeleteBlueprintInputSchema` /
 *        `opsDeleteBlueprintOutputSchema` — `ggui_ops_delete_blueprint`.
 *        Idempotent — second delete returns `{deleted: true}`.
 *
 *      All four tools tag `audience: ['ops']`; agents on `/mcp` do
 *      not see them. Strictly additive — existing handshake / push /
 *      list paths unchanged. No agent companion tool — agent
 *      blueprint authoring stays through the normal handshake → push
 *      flow.
 *
 * --------------------------------------------------------------------
 * Multi-variant Blueprints — multi-axis blueprint search:
 *
 *   n. **`Blueprint.contractEmbedding?: readonly number[]`** added —
 *      cached embedding vector written by `BlueprintStore.put` when an
 *      `EmbeddingProvider` is wired; read by `BlueprintSearch` on the
 *      embed axis (cosine similarity). Strictly additive — every
 *      existing `Blueprint` row deserializes with `contractEmbedding:
 *      undefined`, and the search layer's embed axis contributes zero
 *      in that case. Other axes (hash, structural, variance, intent)
 *      still carry the decision.
 *   nn. **`BlueprintSearchWeights` + `AppBlueprintSearchConfig`** types
 *      + zod schemas added. Per-app blueprint-search configuration
 *      lives on the `App` record in `@ggui-ai/mcp-server-core` as
 *      `App.blueprintSearchConfig?`; the wire shape stays in protocol
 *      so cloud-DDB + OSS in-memory adapters share one source of
 *      truth. Defaults applied at the impl layer
 *      (`DEFAULT_BLUEPRINT_SEARCH_WEIGHTS` / `THRESHOLD` / `TOP_K`
 *      in `@ggui-ai/mcp-server-core/blueprint-search`).
 *
 * --------------------------------------------------------------------
 * Multi-variant Blueprints — the `Blueprint` record:
 *
 *   m. **`Blueprint` type + zod schema** added to `@ggui-ai/protocol`.
 *      Represents the variant-unit between a `DataContract` and the
 *      generated UI code that renders it. Multiple `Blueprint` rows
 *      MAY share `(appId, contractHash)`; they differ on `generator`
 *      and/or `variance`. Fields: `blueprintId`, `contractHash`,
 *      `appId`, optional `codeS3Url + codeHash` (cached code pointer),
 *      `generator` (slug), optional `validatorScore`, `variance`
 *      (`{persona?, context?, seedPrompt?}`), optional
 *      `isOperatorDefault: true`, `createdAt`, `createdBy`
 *      ('agent' | 'operator'), and a read-cache copy of `contract`.
 *      Strictly additive — no fields removed; no consumer sees a
 *      schema-incompatible change. Consumers using `BlueprintProvider`
 *      see no break.
 *
 * --------------------------------------------------------------------
 * Wire-shape v2 — contract vocabulary reshape:
 *
 *   0. `broadcast` field deleted; channel data sources move inline as
 *      `streamSpec[ch].source = { tool, args? }`. Server-side
 *      `runBroadcastLoop` removed entirely (no replacement on server;
 *      transport now runtime-negotiated by `@ggui-ai/wire`).
 *
 *   00. `DataContract.props` → `DataContract.propsSpec` rename. Aligns the
 *      contract-level declaration with the other three typed surfaces
 *      (`actionSpec` / `streamSpec` / `contextSpec`). Wire-side `props`
 *      field on `ggui_push.input` / `ggui_update.input` stays as `props`
 *      — those carry values, not the spec.
 *
 *   000. `DataContract.wiredTools` → `DataContract.agentTools` rename +
 *      entry restructure: drop `label`, rename `requestSchema`/`responseSchema`
 *      → `inputSchema`/`outputSchema` (MCP alignment), rename
 *      `example: {request, response}` → `example: {input, output}`, add
 *      `usage?: string` field. All `WiredTool*` types rename to `AgentTool*`.
 *      Hook name `useWiredTool` retired in a follow-up commit (paired
 *      with kind removal). `PushStory.wiredTools?: string[]` shorthand
 *      input ALSO renamed to `agentTools` in the same follow-up.
 *
 *   000a. `DataContract.agentTools` → `DataContract.agentCapabilities`
 *      rename. The catalog parent is renamed for symmetry with
 *      `clientCapabilities` — both are capability declarations grouped
 *      under a `*Capabilities` parent so the protocol's capability
 *      namespace reads as `{agent,client}Capabilities`. Inner map stays
 *      as `.tools` (e.g., `agentCapabilities.tools.fetch_quote`). Type
 *      alias `AgentToolSpec` → `AgentCapabilitiesSpec`; `AgentToolEntry`
 *      unchanged. Catalog-level `description?` field dropped (vestigial,
 *      no consumer). Linter rule messages + paths updated. `PushStory`
 *      shorthand input `agentTools: string[]` is left under its current
 *      name (retired later alongside PushStory itself).
 *
 *   000b. `DataContract.clientCapabilities.capabilities` →
 *      `DataContract.clientCapabilities.gadgets` rename + reshape.
 *      Inner map renamed for vocabulary parity with the agent side
 *      (`agentCapabilities.tools` vs `clientCapabilities.gadgets`).
 *      Per-entry type renamed: `ClientCapabilityEntry` →
 *      `GadgetDescriptor`; spec renamed: `ClientCapabilitySpec` →
 *      `ClientCapabilitiesSpec`. Hook generic renamed:
 *      `ClientCapabilityHook` → `GadgetHook`; lifecycle types
 *      `CapabilityStatus` → `GadgetStatus`, `CapabilityError` →
 *      `GadgetError`. Catalog-level `description?` dropped (vestigial,
 *      no consumer). New optional `example?: JsonValue` on
 *      `GadgetDescriptor` parallels `AgentToolEntry.example` so the
 *      agent has a concrete shape to reference for unfamiliar libraries.
 *      Hygiene rule codes renamed: `LINT_CAP_*` → `LINT_LIB_*`.
 *      Helper `getClientCapabilityNames` → `getGadgetNames` in
 *      `@ggui-ai/ui-gen/evaluation/axis-checks`. The
 *      `@ggui-ai/client-tools` package literal is renamed separately
 *      (see entry 000c) alongside the workspace directory move.
 *
 *   000e. Per-app library discovery. Three changes ship together
 *      (the data-plane half of the per-app library story; UX +
 *      renderer follow up):
 *
 *      a. **App model** — the OSS `@ggui-ai/mcp-server-core` adds an
 *         `App` type with `gadgets: readonly GadgetDescriptor[]`
 *         and an `AppMetadataStore` seam. Reference `InMemoryAppMetadataStore` seeds
 *         every registered app with `STDLIB_GADGETS`.
 *      b. **Cloud DDB adapter** — `AppRecord.gadgets` added.
 *         `getApp` applies the **default-on-read** pattern at the row
 *         projection site so existing rows without the column survive.
 *      c. **New tool `ggui_list_gadgets`** — audience `['agent']`,
 *         bare `ggui_*` prefix (NOT `ggui_protocol_*` — fetches runtime,
 *         per-app data, not static spec). Input `{appId?: string}` —
 *         defaults to `ctx.appId`; explicit mismatch throws
 *         `AppAccessDeniedError` (code `app_access_denied`). App-not-found
 *         falls back to `STDLIB_GADGETS` (sandbox-app permitted-
 *         error path).
 *
 *      Operator console UX to mutate per-app lists and renderer support for
 *      serving operator-added custom libraries are deferred to later
 *      work; initially every app's `gadgets` == stdlib by default.
 *
 *   000g. Generation triad vocabulary sweep. `@ggui-ai/ui-gen`'s
 *      HOW / WHAT / CHECK surfaces all speak the renamed contract
 *      paths (`agentCapabilities.tools`, `clientCapabilities.gadgets`).
 *
 *      a. **HOW prompts** (`harness/prompts.ts`) — every reference to
 *         the catalog now uses `agentCapabilities.tools` /
 *         `clientCapabilities.gadgets`; pre-rename hook identifiers
 *         (`useWiredTool` / `useAgentTool` / `useClientTool`) are
 *         described as retired rather than mentioned by name.
 *      b. **WHAT classifier** (`classifier/inspect.ts`) — the inner
 *         `clientCapabilities.capabilities` read path was stale; now
 *         reads `clientCapabilities.gadgets` to match the current
 *         wire shape.
 *      c. **CHECK Tier 0** (`check/run-tier0.ts`) — `wire_undeclared`
 *         remediation messages no longer reference the retired
 *         `story.contract`; they name the flat `contract` field on
 *         `ggui_push`.
 *      d. **CHECK evaluator** (`evaluation/llm-evaluator.ts`,
 *         `evaluation/types-public.ts`) — eval criteria descriptions
 *         use `agentCapabilities.tools` and `clientCapabilities.gadgets`.
 *      e. **Anti-pattern grep gate** (`evaluation/axis-checks/checks/
 *         tooling.ts`) — `RETIRED_IDENTIFIERS` extended with
 *         `useAgentTool`, `callWiredTool`, `agentTools` (top-level
 *         field), `clientCapabilities.capabilities`,
 *         `@ggui-ai/client-tools` (package), `PushStory`,
 *         `pushStorySchema`, `story.adapters`, `declaredAdapters`,
 *         `assertAdaptersDeclared`, `HandshakeStoredStory`, and
 *         `record.story`. Each emits one issue per detection so the
 *         LLM rewrites toward the current shape before evaluation
 *         completes.
 *
 *   000h. Bench corpus rebuild. The static bench corpora carried
 *      example contracts and prose docstrings on the old catalog
 *      shape; this sweep updates them so every fixture and comment
 *      reads as a valid contract under the new wire shape.
 *
 *      a. **Negotiator synth corpus** (`packages/negotiator/src/
 *         synth-bench/corpus.ts`) — docstring path `agentTools[*]` /
 *         `agentTools.tools[*]` → `agentCapabilities.tools[*]`.
 *         Fixture data already carried the new shape; only the prose
 *         drifted.
 *      b. **Multi-SDK gen fixtures** (`packages/benchmark/src/multi-
 *         sdk/commits.ts` + `fixtures/{activity-feed,inbox-triage,
 *         place-search,uber-ride}.fixture.ts`) — `agentCapabilities.
 *         tools` entries reshaped: drop `label`,
 *         `requestSchema`/`responseSchema` → `inputSchema`/
 *         `outputSchema`, `example: {request, response}` →
 *         `example: {input, output}`. `clientCapabilities.
 *         capabilities` → `clientCapabilities.gadgets`.
 *      c. **Floor-test contract** (`packages/benchmark/src/multi-sdk/
 *         floor.test.ts`) — sample `{ props: { properties: {} } }`
 *         → `{ propsSpec: { properties: {} } }` per the
 *         DataContract.props → propsSpec rename.
 *
 *   000f. Permissions-Policy derivation from
 *      `DataContract.clientCapabilities.gadgets[*].permission`.
 *      Replaces the previous App-level `declaredAdapters` runtime
 *      gate with per-contract derivation. `StackItem` gains an
 *      optional `clientCapabilities?: ClientCapabilitiesSpec` field
 *      so push commit-time persists the catalog onto the active stack
 *      item. `StackItemMetaView.permissionsPolicy?: readonly
 *      string[]` projects the union-deduplicated directive list every
 *      transport reads — public-render `/r/<shortCode>` emits a
 *      `Permissions-Policy` HTTP response header (`<directive>=(self)`
 *      per W3C Permissions Policy), MCP-Apps `_meta.ui.permissions`
 *      forwards into the iframe host's `allow=""` attribute, and the
 *      inline bootstrap mirrors `permissionsPolicy` so the
 *      iframe-runtime can surface the gate set to in-iframe consumers.
 *      Browser-enforced gates flow from the parent transport; the
 *      iframe-runtime itself cannot mutate Permissions-Policy
 *      post-load. `McpAppAiGguiMeta` gains an optional matching
 *      `permissionsPolicy?: readonly string[]` field;
 *      `validateMcpAppAiGguiMeta` validates the array shape.
 *      Boilerplate generator (`@ggui-ai/ui-gen`) reads
 *      `clientCapabilities.gadgets` and emits
 *      one combined `import { hookA, hookB } from '<pkg>'` per
 *      declared package, alphabetically sorted within each group for
 *      stable diffs. The intermediate inner key
 *      `clientCapabilities.capabilities` is fully retired in the
 *      generator surface.
 *
 *   000d. Handshake input redesigned to flat fields + hint group.
 *      `handshakeInputSchema` was `{sessionId, story: {intent, data?, sourceTools?,
 *      agentTools?, prompt?, context?, contract?}, forceCreate?}`. The story
 *      nesting is dismantled: `intent` and `contract` are promoted to top-level
 *      on the input; `data`/`prompt`/`context`/`availableAgentTools`/`sourceTools`
 *      move under a labeled `hint?: HandshakeHint` group (cold-path synth signal).
 *      `agentTools` rename → `availableAgentTools` clarifies role (catalog seed,
 *      not authority). `PushStory` interface + `pushStorySchema` Zod retired
 *      entirely (no consumer left). Vestigial sub-schemas `pushSessionSchema`/
 *      `pushRenderingSchema`/`pushInfraSchema`/`pushShortcutsSchema` + their
 *      TS interfaces (`PushSession`/`PushRendering`/`PushInfra`/`PushShortcuts`)
 *      also dropped — dead code (no consumer outside sync-check).
 *      OSS handler's internal `HandshakeStoredStory` → `HandshakeStoredInput`
 *      reshape: `{intent, contract?, forceCreate?, hint?}` (drops legacy
 *      `context`/`schema`/`adapters` passthrough plumbing — schema lives in
 *      `contract.propsSpec`; adapters retire alongside the
 *      `declaredAdapters` deployment-policy field, replaced by per-app
 *      `gadgets` permissions). Negotiator
 *      `decide({story, sessionId, ctx})` → `decide({intent, contract?, hint?,
 *      sessionId, ctx})`. Push consumers (`push.ts`, `update.ts`) read
 *      `record.input.*` not `record.story.*`. `provisional-preview.ts` field
 *      `story` → `input` to match.
 *
 *   000g. Negotiator synth refactor. Synth now reads + writes the
 *      renamed catalog paths and threads per-app library context
 *      through.
 *
 *      a. **Synth prompt + DECISION_TOOL JSON-schema** flipped from
 *         `clientCapabilities.capabilities` → `clientCapabilities.gadgets`.
 *         Inner field shape unchanged ({hook, package?, permission?,
 *         usage?}); only the parent key renamed. Worked examples in the
 *         synth system prompt match.
 *      b. **`parseToolInput` + `buildContract`** now extract
 *         `agentCapabilities.tools` AND `clientCapabilities.gadgets`
 *         from the LLM tool output and populate them on the assembled
 *         contract. Previously both catalogs were dropped silently —
 *         the LLM authored entries the contract never carried.
 *      c. **`NegotiatorInput.agent.gadgets?: readonly GadgetDescriptor[]`**
 *         + **`NegotiatorDecisionInput.gadgets?`**. The
 *         handshake handler reads `app.gadgets` via the bound
 *         `AppMetadataStore` and threads the catalog to the
 *         negotiator. The decision-prompt user message gains a
 *         "Client-side libraries available" section listing each
 *         hook + permission so the LLM authors valid bindings.
 *      d. **`mergeAgentTools` → `mergeAgentCapabilities`** rename.
 *         Behavior unchanged.
 *      e. **`mergeGadgets(contract, appGadgets)`** new
 *         function — enriches partial LLM-emitted gadget entries
 *         (missing package/permission) from the app's canonical
 *         catalog. Bindings whose `hook` doesn't match any app entry
 *         are preserved verbatim (third-party packages outside the
 *         seed). Wires into all three return paths (structured-output
 *         success, regex JSON fallback, buildFallbackDecision).
 *      f. **HandshakeNegotiator.decide** interface gains optional
 *         `gadgets`. OSS llm-backed-negotiator + cloud pod's
 *         Bedrock negotiator forward to `negotiate(input.agent.gadgets)`.
 *      g. **GguiHandshakeHandlerDeps.appMetadataStore** new optional field.
 *         OSS `createGguiServer` resolves it from `deps.handshake.appMetadataStore`
 *         or top-level `deps.appMetadataStore` (same store the
 *         `ggui_list_gadgets` tool uses).
 *      h. **Anti-pattern list** extended in synth + decision prompts
 *         with retired identifiers — `clientCapabilities.capabilities`,
 *         `PushStory`/`story.*`, `@ggui-ai/client-tools`,
 *         `story.adapters`/`declaredAdapters`, `useAgentTool`. Prevents
 *         LLM regression on older training data.
 *
 *   000c. `@ggui-ai/client-tools` → `@ggui-ai/gadgets` package
 *      rename. The workspace directory moves from `packages/client-tools`
 *      to `packages/gadgets`; the published package name
 *      changes from `@ggui-ai/client-tools` to `@ggui-ai/gadgets`.
 *      All import strings across the workspace flip simultaneously
 *      (negotiator synth prompt, ui-gen boilerplate + system prompt +
 *      eval axis checks, design rewrite-imports, ggui-react test
 *      fixtures, mcp-server-handlers blueprint docs, hygiene-rules
 *      `DEFAULT_GADGET_PACKAGE` literal). The exported hook surface
 *      (`useGeolocation`, `useClipboardWrite`, `useClipboardPaste`,
 *      `useNotifications`, `useFilePicker`, `useMicrophone`,
 *      `useCamera`) is unchanged. Package version stays at 0.1.0.
 *
 *   00000000. Protocol-level schema-compat invariant in
 *      `@ggui-ai/protocol/validation/schema-compat-invariants`:
 *      `CTR_SCHEMA_INCOMPAT` validates `actionSpec[*].schema` is a
 *      subset of the referenced
 *      `agentCapabilities.tools[*].toolInfo.inputSchema`,
 *      and `streamSpec[*].schema` is a superset of the referenced
 *      `agentCapabilities.tools[*].toolInfo.outputSchema`. Compares against the
 *      contract's OWN agentCapabilities catalog (no runtime tool registry,
 *      no zod conversion) — author-visible bug class. Distinct from
 *      and complementary to the server-level F4 check
 *      (`checkStackItemSchemaCompat` in `@ggui-ai/mcp-server`),
 *      which compares the same action/stream schemas against the
 *      live tool registry's zod schemas. Folded into
 *      `validateContractStructure` and wired into the push handler
 *      via `assertSchemaCompat(contract)`.
 *
 *   0000000. Name-invariant rules in
 *      `@ggui-ai/protocol/validation/name-invariants`:
 *      `CTR_DUP_NAME` (no name collision across `actionSpec` /
 *      `streamSpec` / `contextSpec` keys — boilerplate generator emits
 *      identifiers from these; a collision shadows or compiles
 *      ambiguously) + `CTR_RESERVED_NAME` (no `_ggui:`-prefixed keys on
 *      `actionSpec` or `contextSpec` — the streamSpec equivalent
 *      already fires in `validateContractStructure`; this extends the
 *      rule uniformly to the other two inbound spec maps). Both folded
 *      into `validateContractStructure` and into the push handler via
 *      `assertNameInvariants(contract)`, which throws
 *      `NameInvariantError` listing every offending name. Companion
 *      to the `CTR_REF_*` cross-reference rules in
 *      `@ggui-ai/protocol/validation/cross-references`.
 *
 *   000000. Cross-reference invariants in `@ggui-ai/protocol/validation/cross-references`:
 *      `CTR_REF_NEXT_STEP` (validates `actionSpec[*].nextStep` resolves
 *      to `agentCapabilities.tools[*]`) + `CTR_REF_STREAM_SOURCE` (validates
 *      `streamSpec[*].source.tool` resolves to `agentCapabilities.tools[*]`).
 *      Both wired into `validateContractStructure` (so blueprint-registry +
 *      future structural-validator callers get cross-refs free) and into
 *      the push handler via `assertCrossReferences(contract)`, which
 *      throws `CrossReferenceError` listing every dangling reference in
 *      one pass. Separate from `assertActionRoutingTargets` (which checks
 *      `nextStep` against the SERVER's `knownTools` registry); both run
 *      at push and surface author-recoverable failures before any state
 *      mutation.
 *      No migration doc — purely additive enforcement of invariants
 *      already documented in the type-system (`StreamChannelEntry.source`,
 *      `ActionEntry.nextStep` reference `CTR_REF_*` linter rules in their
 *      docstrings; this commit ships the linter behind those mentions).
 *
 *   00000. `ActionEntry.dispatch` discriminated-union collapsed to a
 *      single shape with an optional `nextStep?: string` hint. All
 *      actions are agent-routed by default; the pre-rename
 *      `kind: 'tool'` synchronous-tool dispatch path is retired (it
 *      silently bypassed the agent's reasoning loop, which conflicted
 *      with the actions-vs-context placement rule). Removed:
 *      `ActionDispatch` type, `dispatchTo` helper namespace,
 *      `actionDispatchSchema` zod variant. Renamed: `dispatch.tool` →
 *      `nextStep`, `dispatch.intendedTool` → `nextStep` (the two collapse
 *      into one optional advisory hint). The cross-ref linter
 *      (`CTR_REF_NEXT_STEP`) enforces that `nextStep` resolves to a
 *      declared `agentCapabilities.tools[*]` key on the same
 *      contract. `UnknownActionToolError` retained but reframed
 *      to fire on `nextStep` resolution rather than `dispatch.tool`.
 *
 *   0000. `DataContract.clientTools` → `DataContract.clientCapabilities`
 *      complete reframe. The pre-rename `ClientToolEntry` carried
 *      `argsSchema`/`responseSchema`/`example` as if the agent invoked
 *      the tool RPC-style; that was inverted — browser-capability hooks
 *      are owned by the UI, fire from the user side, and only become
 *      agent-observable when the UI threads their value into a
 *      `contextSpec` slot or an `actionSpec` payload. New entry shape:
 *      `{description?, usage?, hook, package?, permission?, required?}`
 *      — pure declaration, no input/output, no example. The catalog map
 *      key rename `tools` → `capabilities` mirrors the conceptual shift.
 *      `ClientCapabilityHook<TOutput, TOptions=void>` generic + `CapabilityStatus`
 *      + `CapabilityError` ship in `@ggui-ai/protocol`'s
 *      `types/gadget.ts` to lock the runtime contract every
 *      hook in the planned `@ggui-ai/gadgets` v1 catalog MUST
 *      satisfy. `useClientTool` React hook + `registerClientTool` /
 *      `WireClientToolArgs` / `WireClientToolResult` types + iframe
 *      `tool:<name>` channel RPC path are deleted — no RPC channel
 *      surface remains.
 *
 * --------------------------------------------------------------------
 * Four wire-shape changes:
 *
 *   1. `ActionEntry` discriminated-union dispatch: collapsed
 *      `{tool, mode}` into `dispatch: {kind: 'tool', tool} | {kind:
 *      'agent', intendedTool?}`. Renamed `mode: 'host-routed'` →
 *      `kind: 'agent'` for vendor-neutrality. Deleted
 *      `OrphanActionError` + `AmbiguousActionRoutingError`
 *      (structurally impossible).
 *
 *   2. F4 schema-compat fail-fast at push validation: agent-recoverable
 *      schema violations throw `SchemaCompatError` at push time instead
 *      of silently committing a fallback error stack item. Eliminates
 *      the "stuck on Generating UI…" trap.
 *
 *   3. `ggui_new_session` introduced + `sessionId` REQUIRED on
 *      `ggui_handshake`: server-mints / agent-threads (SEP-2567 aligned).
 *      Optional `seed` enables deterministic idempotent derivation.
 *      Three-tool flow: `ggui_new_session` → `ggui_handshake` → `ggui_push`.
 *
 *   4. `pageId` → `stackItemId` rename: mechanical 1:1 sweep across
 *      protocol/handlers/server/SDKs/cloud. `getSessionByPageId` →
 *      `getSessionByStackItemId`; `PageNotFoundError` →
 *      `StackItemNotFoundError`; `targetPageId` → `targetStackItemId`.
 *
 * --------------------------------------------------------------------
 * Marketplace registry:
 *
 *   1. `GadgetDescriptor.bundleSri?: string` — additive optional
 *      field carrying the registry-emitted SHA-384 SRI hash of the
 *      bundle bytes (`sha384-<base64>` format, validated via
 *      `BUNDLE_SRI_RE`). When present, the iframe-runtime emits the
 *      bundle import as a `<link rel="modulepreload" integrity>`
 *      element so a CDN compromise can't silently swap the bundle.
 *      Both `gadgetDescriptorSchema` (wire) and
 *      `strictGadgetDescriptorSchema` (registry) carry the
 *      same regex. Authors do NOT set this manually; registry
 *      install writes it.
 *
 *   2. Marketplace registry HTTP API (`/search` / `/pkg` /
 *      `/publish` / `/conformance/check`). Off the WS wire surface
 *      — a distinct HTTP service, not a wire-protocol surface, and
 *      therefore not a conformance-kit bump.
 *
 * --------------------------------------------------------------------
 * Canvas mode (additive):
 *
 *   1. `McpAppAiGguiMeta.displayMode?: 'inline' | 'fullscreen'` —
 *      discriminator for the iframe-runtime canvas-mount path.
 *      When `'fullscreen'`, the runtime mounts a session-scoped
 *      `CanvasShell` (one iframe for the whole session) instead of
 *      the legacy per-stack-item iframe. Mutually exclusive with
 *      `stackItemId`. Producers SHOULD reject bootstraps with both
 *      `displayMode === 'fullscreen'` and `stackItemId` set; the
 *      protocol does not require them to. Absent ⇒ existing inline
 *      behavior. Spec-aligned with MCP App `McpUiDisplayMode` (the
 *      `'pip'` literal is reserved for a future floating-canvas
 *      variant, not yet implemented).
 *
 *   2. `_ggui:lifecycle` reserved channel + `CanvasLifecyclePayload`
 *      discriminated union. Server publishes lifecycle envelopes
 *      (`handshake_started` / `handshake_completed` /
 *      `push_started` / `consume_polling`) on the reserved channel;
 *      the canvas animator pill state machine advances on each kind.
 *      Wire shape lives in `@ggui-ai/protocol/types/canvas-lifecycle`;
 *      structural validator registered in `BUILTIN_RESERVED_VALIDATORS`.
 *
 *   3. `canvas_navigated` WS message type (Client → Server) with
 *      `CanvasNavigatedPayload`. Emitted by the canvas iframe when
 *      the user back-navigates; the server updates
 *      `Session.activeStackItemId` and MAY abort in-flight cold-gen
 *      for the popped item. Payload carries `sessionId` +
 *      `previousActiveItemId` + `activeItemId` (no `appId` — the
 *      subscriber binding is the authoritative scope).
 *
 *   4. `host_context_observed` WS message type (Client → Server) with
 *      `HostContextObservedPayload`. The iframe echoes the
 *      `McpUiHostContext` it received from `ui/initialize` so the
 *      server can persist a `HostContextProjection` on the session.
 *      Updates flow on every `host-context-changed` notification so
 *      the projection stays current for canvas display-mode policy.
 *
 * --------------------------------------------------------------------
 * Schema hardening:
 *
 *   1. `StackItem.adapters?: AdapterType[]` — DELETED. Grant model now
 *      lives entirely on `clientCapabilities.gadgets[*].permission`
 *      which projects to the iframe's `Permissions-Policy` header.
 *      `AdapterType` / `ADAPTER_TYPES` / `AdapterTypeSchema` removed
 *      from `@ggui-ai/protocol`. SDK + cloud-pod call sites that
 *      threaded `adapters: []` now drop the field entirely. The
 *      runtime `AdapterPermissions` permission-state interface +
 *      `AdapterRegistry` impl slot stay (orthogonal to the grant model
 *      retired here).
 *
 *   2. `ggui.json#registryAuth` — DELETED. Source-controlled config no
 *      longer carries Cognito pool ids. The publish CLI reads from
 *      env exclusively: canonical `GGUI_REGISTRY_COGNITO_POOL_ID` /
 *      `GGUI_REGISTRY_COGNITO_APP_CLIENT_ID`, legacy-fallback
 *      `GGUI_COGNITO_POOL_ID` / `GGUI_COGNITO_APP_CLIENT_ID`. No
 *      filesystem walk-up for ggui.json#registryAuth. Per-project
 *      pinning still possible via `.envrc` / shell wrapper.
 *
 *   3. Blueprint name regex unified under gadget rules.
 *      `BLUEPRINT_NAME_RE` is retired; both gadgets and blueprints now
 *      share `GADGET_NAME_RE` (`/^[a-z][a-z0-9-]{1,62}[a-z0-9]$/` —
 *      kebab-case, 2–64 chars, no underscores, no single-char). Names
 *      that previously passed the looser blueprint regex (e.g.
 *      `weather_card`, single-char `a`) now reject at publish + at
 *      `register_blueprint`. The sample fixture `weather_card` was
 *      renamed to `weather-card` to satisfy the unified rule.
 *
 *   4. `pluginId` → `artifactId` wire-side rename in
 *      `@ggui-ai/registry-core` and the cloud Lambda env. The
 *      registry stores both gadgets and blueprints under one row
 *      family keyed by `kind: 'gadget' | 'blueprint'`; `artifactId`
 *      matches what the field actually carries. Renames:
 *      `PLUGINS_METADATA_SK → ARTIFACTS_METADATA_SK`,
 *      `Plugins/Plugin*Row → Artifacts/Artifact*Row`,
 *      `Row.pluginId → Row.artifactId`,
 *      `SearchResultEntry.pluginId → .artifactId`,
 *      `PublishResponseBody.pluginId → .artifactId`,
 *      RegistryStorage methods (`getPluginMetadata` etc.) → `…Artifact…`,
 *      CDK tables `<env>-Plugins` / `<env>-PluginVersions` →
 *      `…-Artifacts` / `…-ArtifactVersions`, Lambda env vars
 *      `PLUGINS_TABLE` / `PLUGIN_VERSIONS_TABLE` → `ARTIFACTS_TABLE` /
 *      `ARTIFACT_VERSIONS_TABLE`.
 *
 *   5. Schema tighten-ups — the protocol+handler boundaries now
 *      hard-reject misconfigured input that previously silently rode
 *      through:
 *
 *        - `clientCapabilitiesSpecSchema` is `.strict()` — the retired
 *          `libraries` field name fails parse instead of being
 *          silently dropped.
 *        - `LINT_CONTRACT_RETIRED_FIELD` / `RETIRED_CONTRACT_FIELDS` /
 *          `assertContractNoRetiredFields` — push + handshake reject
 *          contracts that carry `libraries`, `dispatch`, `wiredTools`,
 *          `clientTools`, `broadcast`, `capabilities`.
 *        - `strictGadgetDescriptorSchema.permission` is
 *          `z.enum(KNOWN_PERMISSION_NAMES)` — typos
 *          (`geolocaiton`) fail at parse.
 *        - `bundleUrl` / `styleUrl` / `connect[]` use `z.url()` not
 *          `z.string().min(1)`.
 *        - `tags` capped: ≤20 entries, each ≤64 chars, charset
 *          `[a-z0-9-]`.
 *        - `InMemoryAppMetadataStore` + cloud `dynamoAppMetadataStore`
 *          re-validate every gadget through `strictGadgetDescriptorSchema`
 *          on register + on read — strict-schema posture at the store
 *          seam.
 *        - `resolveGadgetUrls` uses `bundleHostScheme()` — `http://`
 *          for loopback, `https://` elsewhere.
 *        - `enrichContractGadgets` hoisted to `@ggui-ai/protocol` —
 *          one canonical site shared by push (handlers) and
 *          generation-dispatch (ui-gen).
 *        - `assertGeneratorRegistered` extracted — handshake + push
 *          share one allow-list check.
 *        - `gadgetRequiresSchema` extracted — single source for the
 *          `requires[]` field across wire / registry / artifact-manifest
 *          schemas.
 *        - `baseGadgetFieldsShape` extracted — both gadgetEntry
 *          schemas spread from one shape constant.
 *        - `manifestToRegistryEntry` helper hoisted from CLI to
 *          `@ggui-ai/artifact-manifest`; install CLI imports the
 *          canonical helper.
 *        - `ReadErrorCode` adds `'yanked'` for the 410-Gone path;
 *          `SearchErrorCode` defined as a closed enum; both are
 *          closed unions.
 *        - `conformanceFailureCode` sub-discriminator added on the
 *          publish conformance-failed response.
 *        - `GadgetGateErrorCode` closed enum union — single-source
 *          for push-gate error codes (`gadget_not_registered`,
 *          `gadget_public_env_missing`, `unknown_generator`).
 *        - `handshakeOutputSchema.reason?: string (≤280 chars)` —
 *          optional truncated diagnostic.
 *        - `assertNoDuplicateGadgetHooks` (slug:
 *          `duplicate_gadget_hook`) — hard reject when two bindings
 *          declare the same `(package, hook)` pair.
 *        - `resolveGadgetUrls` memoized — WeakMap-keyed cache on
 *          entry object identity.
 *
 * --------------------------------------------------------------------
 * Blueprint conformance gate:
 *
 *   1. `ConformanceErrorCode` (closed union, exported from
 *      `@ggui-ai/registry-core`) gains six new entries. The blueprint
 *      branch of `checkConformance()` was previously a no-op
 *      short-circuit; it is now five mandatory static gates plus one
 *      opt-in runtime probe:
 *
 *        - `blueprint_source_too_large` — `manifest.source` exceeds
 *          {@link MAX_BLUEPRINT_SOURCE_BYTES} (5 MiB, symmetric with
 *          the gadget bundle ceiling).
 *        - `blueprint_compile_error` — `esbuild.transformSync({
 *          loader: 'tsx' })` rejects the TSX source.
 *        - `blueprint_disallowed_import` — `oxc-parser` walks the
 *          source TSX (not compiled JS — esbuild tree-shakes unused
 *          imports even with `treeShaking: false`) and rejects any
 *          import outside `{ react, react/jsx-runtime, react-dom,
 *          @ggui-ai/gadgets }`. Blueprints have no `peerDeps` channel.
 *        - `blueprint_missing_default_export` — iframe runtime mounts
 *          the default export as the root component.
 *        - `fixture_props_shape_mismatch` — when both
 *          `manifest.fixtureProps` and `manifest.contract.propsSpec`
 *          are present, every key marked `required: true` on
 *          `propsSpec.properties` must appear on the fixture.
 *        - `blueprint_runtime_probe_failed` — opt-in via
 *          `PublishArtifactDeps.blueprintProbe`. Probe compiles TSX →
 *          CJS, evaluates in Node `vm.runInContext` with a `require`
 *          shim, mounts the default export via
 *          `react-dom/server.renderToString` with the manifest's
 *          fixtureProps; any thrown error during compile / module
 *          load / mount / render surfaces this code.
 *
 *      Consumers with an exhaustive `switch` on
 *      `ConformanceErrorCode` MUST add the six new branches. Closed-
 *      union semantics mean prior-version exhaustive consumers
 *      silently fall through on the new codes.
 *
 *   2. New constant `MAX_BLUEPRINT_SOURCE_BYTES` (= `5 * 1024 * 1024`)
 *      exported from `@ggui-ai/registry-core`. Symmetric with the
 *      gadget bundle ceiling so publishers can pre-check source size
 *      before invoking `ggui blueprint publish`.
 *
 *   3. New optional `PublishArtifactDeps.blueprintProbe?:
 *      BlueprintProbeRunner` deps slot on the publish op. Implementa-
 *      tions wiring this slot get the 6th conformance gate (the
 *      runtime probe); leaving it `undefined` preserves the
 *      static-only behavior. Reference implementation:
 *      `@ggui-ai/blueprint-probe`.
 *
 *   4. `POST /conformance` runs the 5 static gates only. `POST
 *      /publish` MAY additionally run the runtime probe when the
 *      deploy wires `blueprintProbe`. A blueprint passing
 *      `/conformance` MAY still be rejected by `/publish` with
 *      `blueprint_runtime_probe_failed`. Publishers SHOULD run the
 *      local probe before publishing.
 *
 * Security posture for the runtime probe (read before wiring it).
 * `vm.runInContext` is NOT a security sandbox — it's a JavaScript-
 * isolation primitive, not an adversarial-code-execution boundary.
 * A blueprint that passes all five static gates can climb the
 * prototype chain of the injected `react` module to reach the parent
 * process's `Function` constructor and execute arbitrary code in the
 * parent context.
 *
 * Because of this, **the cloud-hosted publish Lambda's default deps
 * do NOT wire `blueprintProbe`.** The static gates still run on every
 * publish. The runtime probe is local-trust-boundary-only by default
 * — CLI on the publisher's own machine, self-hosted registries with
 * a closed publisher pool. A fully isolated probe (isolated-vm,
 * separate process, execution timeout) is future work.
 *
 * --------------------------------------------------------------------
 * Sigstore signing for public-visibility artifacts. The trust chain
 * bifurcates: private artifacts → Ed25519 (existing); public
 * artifacts → sigstore (Fulcio short-lived cert + Rekor transparency
 * log + cosign bundle).
 *
 *   1. **`SigstoreSignature` widened** to embed a serialized cosign
 *      bundle (per `@sigstore/bundle` v0.3 spec) — `{ algorithm:
 *      'sigstore-cosign', bundleSha384, bundle: <serialized-json>,
 *      signedAt }`. Old narrow shape (`{ uuid, logIndex }`) carried
 *      only Rekor coordinates and was insufficient for offline
 *      verification. The widened shape ships everything a verifier
 *      needs: cert chain, inclusion proof, signed entry timestamp.
 *
 *   2. **`PublishArtifactInput.signature`** now typed
 *      `GadgetSignature = Ed25519Signature | SigstoreSignature`
 *      (discriminated union over `algorithm`). The publish op
 *      dispatches on the discriminator after a single-shape guard
 *      (`isGadgetSignature` from `@ggui-ai/gadget-signing`):
 *        - `'ed25519'` → AuthorKeys-rooted flow (unchanged).
 *        - `'sigstore-cosign'` → `verifyBundleSigstore` flow; on
 *          verify-OK the leaf cert PEM is extracted from
 *          `bundle.verificationMaterial.x509CertificateChain.certificates[0].rawBytes`
 *          and pinned as `ArtifactVersionRow.authorPublicKey`.
 *
 *   3. **`@ggui-ai/gadget-signing` exports** new canonical type
 *      guards `isEd25519Signature` / `isSigstoreSignature` /
 *      `isGadgetSignature` (collapsing 3 duplicated inline guards)
 *      and new error class `SigstoreSigningError` with discriminated
 *      `code: 'oidc_invalid' | 'fulcio_error' | 'rekor_error' |
 *      'unknown'`. The `SigstoreNotImplementedError` stub class is
 *      DELETED (pre-launch posture — no shims).
 *
 *   4. **`PublishError.error` gains** `oidc_resolution_failed`
 *      (sub-discriminated by `oidcCode`) for CLI publish-side failure
 *      to acquire an OIDC token. Server-side never returns this code
 *      — it's CLI-internal — but the wire shape allows for it so the
 *      same error envelope flows through the CLI's error printer.
 *
 *   5. **CLI publish dispatches on `manifest.visibility`**: `'public'`
 *      → sigstore flow (calls `resolveOidcToken` then
 *      `signBundleSigstore`); `'private'` → Ed25519 flow (unchanged).
 *      New `--identity-token <jwt>` flag + `GGUI_OIDC_TOKEN` env var.
 *      Resolution order: flag → env → GitHub Actions ambient (via
 *      `ACTIONS_ID_TOKEN_REQUEST_URL`) → interactive PKCE browser
 *      flow on a TTY.
 *
 *   6. **CLI install dispatches on `signature.algorithm`**:
 *      `'sigstore-cosign'` → `verifyBundleSigstore` with optional
 *      `--verify-identity <pattern>` (literal or `/regex/[flags]`
 *      form). The flag enforces that the bundle's Fulcio leaf cert
 *      SAN matches the supplied identity. Ed25519 unchanged.
 *
 * No exhaustive-switch concerns — `GadgetSignature` was already a
 * discriminated union; the changes widen the SigstoreSignature
 * variant in-place. Consumers that always hit the Ed25519 branch
 * keep working without modification.
 *
 * Trust chain table:
 *
 *   | visibility | trust chain                                    |
 *   | ---------- | ---------------------------------------------- |
 *   | `private`  | Ed25519 author key pinned in registry's        |
 *   |            | AuthorKeys table, base-rooted at the           |
 *   |            | publisher's Cognito subject.                   |
 *   | `public`   | Fulcio short-lived X.509 cert (OIDC-backed,    |
 *   |            | Sigstore-keyless) + Rekor inclusion proof,     |
 *   |            | offline-verifiable via the embedded cosign     |
 *   |            | bundle.                                        |
 *
 * --------------------------------------------------------------------
 * Two-layer storage for blueprint compiled bytes (TSX → JS compile
 * boundary):
 *
 *   - Blueprint version rows now carry a `compiledDigest` pointer
 *     (lowercase hex SHA-256 of the compiled bytes) into a new
 *     `<envName>-CompiledBlobs` DDB table; the previous
 *     `blueprintSource` column is deleted (raw TSX stays on
 *     `manifest.source` for audit / future-recompile).
 *   - `ReadPkgResponse` exposes `compiledDigest` + `compiledBytes`
 *     (base64); install consumers MUST read compiledBytes — the
 *     registry is now the trust boundary for the compile step.
 *   - `CompiledBlobRow` reserves `manifestSig` + `compiledSig`
 *     columns for a future signing wave; this change writes neither.
 *   - esbuild pinned to 0.25.12 (was `^0.25.0`) for digest stability.
 *
 * `compiledDigest` is the shareable cache key for cross-app cache
 * sharing and cross-registry federation; the reserved signature
 * columns ride on the blob row for a later signing wave.
 *
 * --------------------------------------------------------------------
 * `package.json`-style gadget refs + `GadgetRef` / `GadgetDescriptor`
 * split. The wire shape
 * `DataContract.clientCapabilities.gadgets[*]` carries the identity
 * tuple `{ hook, package, version, description?, usage? }`. Transport
 * metadata (`bundleUrl` / `bundleHost` / `bundleSri` / `typesUrl` /
 * `typesSri` / `permission` / `connect` / `requires` / `styleUrl` /
 * `required` / `gotchas` / `example`) stays on the registered
 * `GadgetDescriptor` resolved server-side from `App.gadgets`. The
 * resolved descriptor subset rides alongside the wire on
 * `SessionStackEntry.gadgetDescriptors` as a sidecar — no enrichment
 * overlay on the contract surface.
 *
 *   1. **`GadgetRef = { hook, package, version, description?, usage? }`**
 *      Wire-side identity matches `package.json` dependency pins:
 *      bare npm package name + exact semver pin (no ranges). Schema
 *      `gadgetRefSchema` is `.strict()` and rejects transport fields
 *      + range syntax at parse time.
 *
 *   2. **`GadgetEntry` → `GadgetDescriptor`** (TS interface rename).
 *      Sibling renames: `gadgetEntrySchema` →
 *      `gadgetDescriptorSchema`; `registryGadgetEntrySchema` →
 *      `strictGadgetDescriptorSchema`; `gadgetManifestToGadgetEntry`
 *      → `gadgetManifestToGadgetDescriptor`. No back-compat aliases.
 *
 *   3. **`ClientCapabilitiesSpec` is non-generic** — values are wire-side
 *      `GadgetRef` only. Post-resolution descriptors live on the
 *      `SessionStackEntry.gadgetDescriptors` sidecar (filtered subset
 *      of `App.gadgets`). `filterDescriptorsToContract(contract,
 *      appGadgets) → readonly GadgetDescriptor[]` replaces the prior
 *      `enrichContractGadgets` overlay.
 *
 *   4. **`assertNoDuplicateGadgetHooks` keys on `hook` alone.** Hook
 *      unique-per-app at registration time (`lintGadgetCatalog`);
 *      LLM-generated component code wouldn't disambiguate two
 *      destructure bindings with the same name. Operators pre-alias
 *      at registration if they want both.
 *
 *   5. **New `@ggui-ai/gadgets` adapter port**:
 *      `GadgetCatalogAdapter { list(appId): Promise<readonly
 *      GadgetDescriptor[]> }` + `InMemoryGadgetCatalog` (static map +
 *      `withDefault()` factory) + `CachingGadgetCatalog` (per-appId
 *      TTL + single-flight dedup + `invalidate(appId?)`). One batch
 *      method by design — never N+1 per-hook. Per-environment adapter
 *      implementations (JSON / DynamoDB) land separately.
 *
 *   6. **`NPM_PACKAGE_NAME_RE` + `SEMVER_PIN_RE`** schema constants
 *      published from `@ggui-ai/protocol`. Loose `z.string()` checks
 *      retired; agent prompts show exact pinned identity. Cache key
 *      `hashContract(wire, intent)` is a pure function of the wire
 *      bytes (no canonicalize step) — version bumps invalidate caches
 *      automatically.
 *
 * No exhaustive-switch concerns. Agents that previously omitted
 * `package` / `version` on a wire ref now fail at parse — the loud
 * failure is the design intent (a caller bug, not a forward-compat
 * hedge).
 *
 * --------------------------------------------------------------------
 * Phase B — flatten-render-identity. Session vessel deleted; renderId
 * is the single identity referenced across the wire (BREAKING,
 * pre-launch):
 *
 *   b1. **`Session` deleted.** The vessel-wrapping-a-stack-of-one model
 *      is gone. `SessionStackEntry` (the actual rendered thing) was
 *      promoted to a flat `Render` union (`ComponentRender | SystemRender
 *      | McpAppsRender`) and `SessionView` was retired. Conversation
 *      grouping (sibling renders within one host chat) flows via the
 *      unchanged `_meta["ai.ggui/host-session"]` channel captured ONCE
 *      at render creation, NOT by lifting fields onto every Render.
 *
 *   b2. **`sessionId` + `stackItemId` → `renderId`.** One identifier on
 *      the wire (the two values were already the same once each render
 *      was its own thing). Renames cover `SubscribePayload`, `AckPayload`,
 *      `StreamEnvelope`, `ActionEnvelope`, `GguiConsumeInput`,
 *      `GguiCloseInput`, `GguiEmitInput`, `PropsUpdatePayload`,
 *      `DrainAckPayload`, lifecycle events, `submit-action` envelope,
 *      user-action meta. `AckPayload.stack[]` → `AckPayload.render`
 *      (single item — vessel is gone).
 *
 *   b3. **Tools collapsed: `ggui_new_session` deleted; `ggui_push`
 *      renamed to `ggui_render`.** The three-tool flow is `ggui_handshake`
 *      → `ggui_render` → `ggui_update` / `ggui_consume`. The handshake
 *      mints the render server-side; `ggui_new_session` is gone (its
 *      sessionId minting folded into the handshake-internal renderId
 *      mint). TS aliases `GguiPushInput/Output` → `GguiRenderInput/Output`;
 *      Zod schemas `pushInputSchema` / `pushOutputSchema` → `renderInputSchema`
 *      / `renderOutputSchema`. `handshakeInputSchema.sessionId` REMOVED
 *      (handshake input no longer carries a session handle); `nextStep.tool`
 *      literal `'ggui_push'` → `'ggui_render'`; output `stackItemId` field
 *      → `renderId`. The `'compose'` action enum value dropped (was
 *      multi-item-stack push semantics, retired with the stack).
 *
 *   b4. **Slice envelope collapsed.** `_meta["ai.ggui/session"]` +
 *      `_meta["ai.ggui/stack-item"]` (the two-key pair) → one
 *      `_meta["ai.ggui/render"]` key carrying identity + boot wiring +
 *      live-channel auth + capability advertisements + render state +
 *      contract pointer + component-mode discriminator. Single-slice
 *      parser `parseMcpAppAiGguiRenderMeta`; emitter
 *      `toMcpAppEnvelope` emits one key.
 *
 *   b5. **Resource URI renamed.** `ui://ggui/session` → `ui://ggui/render`;
 *      `GGUI_SESSION_RESOURCE_URI` → `GGUI_RENDER_RESOURCE_URI`;
 *      `GGUI_SESSION_UI_META` → `GGUI_RENDER_UI_META`. Error codes
 *      renamed too: `SESSION_NOT_FOUND` → `RENDER_NOT_FOUND`;
 *      `STACK_ITEM_NOT_FOUND` → `RENDER_NOT_FOUND`;
 *      `CONCURRENT_SESSION_LIMIT` → `CONCURRENT_RENDER_LIMIT`. The
 *      live-channel wire-error codes were renamed in the same arc:
 *      `SESSION_MISMATCH` → `RENDER_MISMATCH`;
 *      `BOOTSTRAP_SESSION_MISMATCH` → `BOOTSTRAP_RENDER_MISMATCH`;
 *      `DEVTOOL_COOKIE_SESSION_MISMATCH` →
 *      `DEVTOOL_COOKIE_RENDER_MISMATCH`;
 *      `SESSION_CREATE_FAILED` → `RENDER_CREATE_FAILED`.
 *
 *   b6. **Retired wire-side payloads deleted (no shims).** `PushPayload`,
 *      `PopPayload`, `GetStackPayload`, `SessionPayload`,
 *      `CanvasNavigatedPayload`, `GeneratePayload`, `GenerateAckPayload`,
 *      `GguiNewSessionInput/Output`, `GguiGetStackInput/Output`,
 *      `StackItemSummary`, `EventSubscription`, `DEFAULT_SUBSCRIPTION`,
 *      `Action` re-export, lifecycle-event literals
 *      `lifecycle:stack_push`, `stack_pop`, `session_start`,
 *      `session_end`. `SessionSummaryWire` → `RenderSummaryWire`
 *      (always-1 `stackItemCount` field deleted). Stack-navigation
 *      reducer (`stackNavigationReducer`, `initialNavigationState`,
 *      `StackNavigationState`, `StackNavigationAction`) deleted — no
 *      stack of N to navigate.
 *
 *   b7. **`ggui_close` tool deleted.** Matches the earlier deletion of
 *      `ggui_new_session`: with the Session vessel gone, there is no
 *      entry-and-exit ceremony to bracket a render. Renders decay
 *      implicitly via TTL — created → active → expired. The
 *      `RenderStatus` union collapses from
 *      `'active' | 'completed' | 'expired'` to `'active' | 'expired'`;
 *      the `'session.closed'` `RenderEventType` literal is gone (no
 *      terminal ledger event); `GguiCloseInput` / `GguiCloseOutput`
 *      types + `closeInputSchema` Zod schema deleted from the protocol
 *      surface. `notifyRenderClosed` observer-notifier seam, the
 *      `RenderStore`-side `closed` bucket flag + per-render-close revoke
 *      paths (`shortCodeIndex.revokeByStackItemId`,
 *      `pendingEventConsumer.markDeleted`) all retire alongside.
 *      Agent-side: the long-poll loop terminates on TTL expiry rather
 *      than on an explicit terminal status.
 *
 *   b8. **SessionEvent dropped; RenderEvent is the single ledger
 *      primitive (Wave 7, 2026-05-28).** The protocol-side `SessionEvent`
 *      (sequence + emittedAt + type + payload) and the server-side
 *      `RenderEvent` (seq + timestamp[ms-epoch] + type + data) merge
 *      into one canonical `RenderEvent` owned by `@ggui-ai/protocol`.
 *      Field shape: `seq + type + timestamp[ISO 8601 UTC string] +
 *      data`. `EventsResponse.events` now ships `ReadonlyArray<RenderEvent>`.
 *      The WS replay frame discriminator renames
 *      `'session_event' → 'render_event'`; payload type follows the
 *      same shape. `@ggui-ai/mcp-server-core` re-exports `RenderEvent`
 *      / `RenderEventType` from `@ggui-ai/protocol` so downstream
 *      import paths stay stable. Sqlite + DDB stores stamp ISO
 *      strings on write; legacy numeric rows are coerced on read.
 *      Cross-deployment uniformity: the same field type ships from
 *      polling HTTP endpoint, WS replay frame, and store-side `observe()`.
 *
 *   b9. **GguiSession reintroduced as the render-OBJECT noun
 *      (2026-06-05).** The flatten arc named the rendered object
 *      `Render`; this restores `GguiSession` as that noun while `render`
 *      stays the VERB. Source-breaking TS-symbol renames for
 *      `@ggui-ai/*` importers: `Render`→`GguiSession` (+ `ComponentRender`,
 *      `SystemRender`, `McpAppsRender`, `RenderBase`, `RenderStatus`),
 *      `RenderEvent`→`GguiSessionEvent`, `RenderStore`→`GguiSessionStore`
 *      (+ every impl), `RenderStreamBuffer`, `RenderNotFoundError`,
 *      `RenderChannelServer`, `RenderApi`/`RenderInfo`/`RenderRef`,
 *      `RenderRenderer`→`GguiSessionRenderer`. WIRE-breaking renames: the
 *      canonical id `renderId`→`sessionId` (every payload/param/envelope/
 *      URL/_meta field); tools `ggui_list_renders`→`ggui_list_sessions`
 *      and `ggui_get_render`→`ggui_get_session`; error codes
 *      `RENDER_NOT_FOUND`/`RENDER_MISMATCH`/`RENDER_CREATE_FAILED`/
 *      `CONCURRENT_RENDER_LIMIT`→`SESSION_*` (numeric values unchanged);
 *      REST routes `/api/renders`, `/admin/renders`, `/console/renders`
 *      → `/…/sessions`; DOM `data-ggui-render-*`→`data-ggui-session-*`;
 *      ack `renderToken`→`sessionToken`. The VERB `render` is KEPT
 *      verbatim: the `ggui_render` (+ `ggui_render_blueprint`) tool,
 *      `renderInputSchema`/`renderOutputSchema` + `GguiRenderInput`/
 *      `GguiRenderOutput`, the `*Renderer` actor components, the
 *      `ai.ggui/render` _meta slice key, the `ui://ggui/render` resource
 *      URI (only its `{sessionId}` path segment follows the id rename),
 *      and the WS frame discriminators `'render'` / `'render_event'`.
 *      OSS-first; the cloud pod follows at its next image build. See
 *      `docs/protocol/migrations/2026-06-05-gguisession-reintroduction.md`.
 *
 * draft-2026-08-19 — SCHEMA-PRECISE RENDER (additive minor; frozen
 *      shape per the 2026-08-19 consumer review, design record
 *      `docs/plans/2026-08-19-schema-precise-render.md`):
 *
 *   c1. **Enforced props schema on the handshake output** (SPEC
 *      §2.3.2 + §7.1.1). `GguiHandshakeOutput` gains `propsSchema?`
 *      (the exact schema the paired render enforces, emission form,
 *      RFC 8785-canonical construction), `propsSchemaHash?` (sha256
 *      over the canonical bytes; on EVERY non-declined handshake) and
 *      `propsSchemaProfile?` ('grammar-safe' | 'full'; unknown values
 *      degrade to 'full'). The record persists the artifact and
 *      `ggui_render` validates against the PERSISTED value — the
 *      AUTHORITY obligation is structural under version skew.
 *   c2. **`ContractViolation.keyword`** (additive) + **`propsSchemaHash`
 *      on `contract_violation` error data** — the failure-class
 *      segmentation and breach-classifier surfaces (SPEC §7.9).
 *   c3. **`JsonSchema.type` admits draft-07 type arrays**
 *      (`['string','null']` — the canonical nullability form the
 *      emission rewrites OpenAPI `nullable: true` into). Acceptance
 *      widening only; the schema-subset checker compares type SETS.
 *   c4. **Conformance:** the `props-schema-conformance` catalog
 *      (drift / hash / profile / authority obligations; pins the
 *      2026-08-19 out-of-vocabulary enum incident as a permanent
 *      sample).
 *
 * draft-2026-09-10 — THEMING REVISION (ggui#987 protocol half, ggui#989
 *      OSS half, ggui#985 cloud half; BREAKING on the draft wave under
 *      VERSION-POLICY §1.1, shipped under §1.4's `draft-` clause — the
 *      substantive entry is the "Theming revision" block at the top of
 *      this changelog). The wire: `appThemeSchema` v2 (`overlays` +
 *      `overlayHash` required, `base` deleted), the client mode
 *      projection `hostAnnounced ?? stamped ?? sessionSidecar`, `themeId`
 *      without its sidecar-name leg, `AppThemeRefusalBody` at every write
 *      door, `parseMcpAppAiGguiRenderMeta`'s `onInvalidTheme`, the render
 *      shell on `--ggui-color-ground`. The 0.16.0 lockstep wave carries
 *      it; the samples, the e2e fixtures and the docs' draft strings move
 *      in this same commit.
 *
 * draft-2026-09-04 — PRE-GENERATION REFUSAL ENVELOPE (ggui#786;
 *      BREAKING IN INTENT, pre-launch so no shim and no `@deprecated`
 *      — see `docs/protocol/migrations/2026-09-04-pre-generation-refusal-envelope.md`):
 *
 *   r1. **`outcome` on every render result** (SPEC §7.1). A REQUIRED
 *      discriminant, `'rendered' | 'failed' | 'refused'`. Under
 *      §1.1 of VERSION-POLICY a required-field addition on an
 *      envelope is a major-class change; §1.4 waives the migration
 *      obligation while the version carries the `draft-` prefix, and
 *      the dated doc above is written anyway. `ggui_update` is
 *      UNCHANGED — it binds no pre-generation gate and consumes no
 *      handshake, so a mutation arm is a separate slice.
 *   r2. **Identity present-iff-committed** — `sessionId`, `action`,
 *      `contractHash`, `blueprintId`, `variantKey` and `cache` are
 *      OPTIONAL at the schema level and pinned present on the two
 *      committed outcomes by a presence refinement. A refusal
 *      commits nothing, so it carries none of them. The same
 *      refinement pins `resourceUri` present-iff-`'rendered'` — the
 *      mount affordance, whose iff its docstring already stated and
 *      nothing enforced: a `failed` result carrying one advertises a
 *      mount for a render that does not exist.
 *   r3. **The refusal envelope** — `refusal: {code, message, fix,
 *      retry, handshake: 'intact', balanceCentsAtCheck?}`, present
 *      iff `outcome: 'refused'` and then the ONLY field beside
 *      `outcome`. Enforced ON THE WIRE: a handler now declares
 *      `outputEnvelopeSchema` (the composed schema) beside
 *      `outputSchema` (the raw shape the SDK registers), and the
 *      transport validates against the former — so the presence
 *      rules a raw-shape rebuild would drop fail loudly instead.
 *   r4. **`PRE_GENERATION_REFUSAL_CODES`** — a closed registry, one
 *      `code` namespace across the render-gate, owner-api and
 *      provisioning-api surfaces, with `retry` on every row and
 *      `fixBy` on every `after-fix` row. `refusal.code` is the
 *      render-gate subset; a code outside it fails the wire enum.
 *   r5. **Hook contract** — `preValidationGate` RETURNS a refusal
 *      instead of throwing; the handler owns the envelope and
 *      projects it before the handler's OWN input parse (after the
 *      SDK's declared-shape validation, so a wire-malformed call
 *      never reaches a gate). A gate that throws to refuse is a
 *      conformance failure, observable in the `tool_invoked` line.
 *   r6. **Conformance:** two catalogs — `refusal-envelope-conformance`
 *      (the projection obligation, graded against a kit-local
 *      reference and against the shipping projector in
 *      `@ggui-ai/mcp-server-handlers`) and `registry-completeness`
 *      (the registry's structural pins, bound to the LIVE registry).
 *   r7. **Tool output shapes are protocol-owned (ggui#817 part C):**
 *      seven schemas — search / featured / validate / consume's
 *      host-context projection / list_sessions' summary / runtime_pull's
 *      page / get_session — registered as `.shape`, types derived and
 *      wearing `DeepReadonly` at the seam; `ggui_get_session`'s wire is the
 *      projection (`variant` + six base fields, `contextSnapshot` when the
 *      row has one), never a `GguiSession` — the alias was a lie the
 *      strip-parse hid. No `.readonly()` in a wire schema (zod 4 projects
 *      it as `readOnly`).
 *   r8. **`infra.model` route grammar (ggui#818):** either wire form —
 *      canonical `provider:model` or LiteLLM `provider/model`, aliases in
 *      both — or the handler's route guard fails at zod path `infra.model`
 *      BEFORE the pre-generation gate (`renderInputRouteGuardSchema`, the
 *      grammar and nothing else, so `{}` still reaches the gate per r5); the
 *      full envelope (`renderInputEnvelopeSchema`) parses after the gate.
 *      Bare model ids are out.
 *   r9. **Endpoint-level refusal (ggui#825):** registry surface
 *      `mcp-endpoint` (v11) and the transport envelope — a per-app MCP
 *      endpoint that refuses a request for a registry state answers HTTP
 *      403 with `{ code: -32000, message: 'Forbidden', data: { refusal } }`
 *      (`transportRefusalErrorSchema`; `refusal` = the projection without
 *      the render-only fields, `MCP_ENDPOINT_REFUSAL_CODES` derived — today
 *      `app_deprovisioned`). Untyped authorization failures keep the bare
 *      403 by contract. Additive.
 *   r10. **Consume / list_sessions / emit own their wire shapes (ggui#817
 *      part C2):** `consumeEventEntrySchema` (the drained row, closed),
 *      `gguiSessionStatusSchema` (`active` | `expired`), `gguiConsumeOutputSchema`,
 *      `gguiListSessionsOutputSchema`, `gguiEmitOutputSchema`; the types
 *      derive (`ConsumeEventEntry`, `GguiConsumeOutput`, `GguiEmitOutput`,
 *      `GguiListSessionsOutput`, `GguiSessionStatus`). `tools/list` now
 *      advertises the entry vocabulary and the status enum for
 *      `ggui_consume`; `parsePendingEnvelope` parsed a drained row instead
 *      of casting it, so a malformed pipe entry refused at the seam
 *      (follower: collapsed into `pendingEventSchema`'s row parse, pe4
 *      above). The wire bytes of a well-formed row are unchanged. Additive.
 *   r11. **Endpoint refusal codes (ggui#836):** the per-app endpoint speaks
 *      §7.9 Plane-1 rows — the typed deprovisioned arm is `-32003`
 *      (`APP_NOT_FOUND`, `App not found`) with `data.refusal`; untyped
 *      authorization failures are `-32001` (`UNAUTHORIZED`) with no
 *      `data`; HTTP 403 on both. `-32000` (the SDK client's
 *      `ConnectionClosed`) is never a code a first-party server chooses.
 *      Supersedes r9's literals; pre-launch, no compatibility arm.
 *   r12. **`GENERATION_OVERLOADED: -32014`** joins `PLATFORM_ERROR_CODES` —
 *      the generation queue is saturated (HTTP 503 + `Retry-After`; the
 *      server is the limit, unlike `-32013`). Additive; the four complete
 *      mirrors carry it under `check-error-code-mirrors`.
 *
 * FOLLOWER — moves in the SAME commit as this constant, pinned by a
 * gate that fails loud when it lags: the `protocol` field of every
 * shipped `samples/gguis/<name>/ggui.json` (the `@ggui-ai/project-config`
 * samples test). That pin is a HOUSE rule — shipped samples declare the
 * CURRENT stamp, because a new project starts from them. The CONTRACT
 * for any `ggui.json#protocol` is membership in
 * `CLIENT_SUPPORTED_VERSIONS`, enforced by the loader (`UPGRADE_REQUIRED`
 * on a non-member); the two coincide only while the set is a singleton.
 */
export declare const PROTOCOL_VERSION = "draft-2026-09-10";
/**
 * The shipped `@ggui-ai/*` WAVE version — bare semver, identical to
 * `package.json#version` on every published package (the lockstep
 * cohort; `@ggui-ai/protocol` is its anchor). Distinct from
 * {@link PROTOCOL_VERSION}: that names the WIRE draft (what the
 * messages mean), this names the SHIPPED BUILD (which release an agent
 * is actually talking to). Runtime surfaces that identify themselves
 * — MCP `serverInfo.version`, the MCP Apps `appInfo.version` — report
 * this, never a hand-typed literal (ggui#622: a hard-coded `0.0.1`
 * told every connected agent the wrong thing for four waves).
 *
 * Moves with every wave: `version.test.ts` pins it to this package's
 * `package.json#version` (the same parity pattern as
 * `STDLIB_GADGETS_VERSION` and `agent-server`'s `CLIENT_INFO`), and the
 * `/release:cut` straggler list names it so the bump is mechanical.
 *
 * Wave classifications (protocol seat; the kit is the arbiter,
 * docs/protocol/VERSION-POLICY.md §1–2):
 *
 *   - **0.15.0 — MINOR** (ruled 2026-09-05). Every `@ggui-ai/protocol`
 *     landing since the 0.14.0 cut (`f3cf6c906`) is additive under
 *     §1.2: the `@ggui-ai/protocol/wire` browser entry (ggui#819), the
 *     `GENERATION_OVERLOADED: -32014` canonical code and SPEC §7.9's
 *     Plane 0 (ggui#840), `ErrorMapperResult.data` (ggui#825), the
 *     endpoint-level refusal — `403 {code: -32003, data.refusal}` for
 *     `app_deprovisioned` (ggui#836), the `ggui_consume` /
 *     `ggui_list_sessions` / `ggui_emit` output schemas (ggui#817 C2),
 *     and the `.readonly()` removal from the gadget wire schema
 *     (ggui#824). The one non-additive-looking line — the untyped
 *     authorization refusal moving from `-32000` to `-32001
 *     UNAUTHORIZED` (ggui#836) — is not a fixture regression: no
 *     fixture on 0.14.0 pinned `-32000` (it was the SDK's default
 *     courtesy code, never a first-party choice; ggui#840's Plane-0
 *     ruling), and the transport-refusal catalog now states `-32001`.
 *     §1.4 (`draft-`: semver describes intent) applies on top. A
 *     0.14.1 is legitimate ONLY as a founder-ruled hotfix branch off
 *     `f3cf6c906` carrying ggui#846 alone (a declaration-emit fix —
 *     PATCH under §1.3); it cannot be cut from main, whose delta since
 *     0.14.0 is minor-class.
 */
export declare const GGUI_WAVE_VERSION = "0.26.0";
/**
 * Schema version stamped onto wire envelopes that opt into the
 * `schemaVersion` forward-compat field (see {@link ActionEnvelope},
 * {@link StreamEnvelope}).
 *
 * Pre-launch semantics (current): producers SHOULD stamp; consumers
 * SHOULD NOT reject on mismatch — the field is advisory and lets old
 * clients recognize the protocol generation their server emits.
 *
 * Launch-cutover semantics (future): a later change promotes this to
 * required on producers and tightens client-side policy (e.g.,
 * reject-with-UPGRADE-REQUIRED when the received version's major bumps
 * past the client's known major).
 *
 * Kept as a string so SemVer-like extensions (`'1.0.0-rc.2'`,
 * `'1.1.0'`) don't require retyping consumers. Value equals
 * {@link PROTOCOL_VERSION} today — the alias exists so envelope-layer
 * consumers can reference schema-versioning specifically without
 * coupling to the broader cache-invalidation constant.
 */
export declare const PROTOCOL_SCHEMA_VERSION = "draft-2026-09-10";
/**
 * Canonical live-channel error code emitted when a peer's declared
 * {@link SubscribePayload.supportedVersions} /
 * {@link AckPayload.serverVersion} does not overlap the receiver's
 * known compatible set.
 *
 * `ErrorPayload.code` is typed as `string` (open) rather than a closed
 * union — this constant anchors the canonical literal so consumers can
 * pattern-match against a typed reference instead of string-sniffing.
 *
 * Policy posture:
 *
 *   - OSS `createSessionChannelServer` default
 *     `versionPolicy: 'reject'`: server emits `UPGRADE_REQUIRED` AND
 *     closes the connection so the caller cannot proceed against a
 *     version-mismatched session. Canonical first-party posture.
 *   - `versionPolicy: 'advisory'` (legacy opt-out): server emits an
 *     `UPGRADE_REQUIRED` error envelope on mismatch but keeps the
 *     connection open. Use only for controlled migration windows
 *     during which legacy-version clients must remain attached.
 *
 * Consumers (clients and servers alike) MUST handle the code as a
 * string — the constant exists for authoring ergonomics, not to imply
 * a closed union on `ErrorPayload.code`.
 */
export declare const UPGRADE_REQUIRED = "UPGRADE_REQUIRED";
/**
 * Versions of the ggui protocol this client library accepts on the
 * wire.
 *
 * The first-party client declares this set on every subscribe via
 * {@link SubscribePayload.supportedVersions}. A server whose
 * {@link PROTOCOL_SCHEMA_VERSION} is NOT a member of this list is a
 * version mismatch — the server replies with an `UPGRADE_REQUIRED`
 * error envelope (see {@link UPGRADE_REQUIRED}). Symmetrically, if a
 * server returns {@link AckPayload.serverVersion} not in this set,
 * the client surfaces `UPGRADE_REQUIRED` to the caller.
 *
 * Seeded with {@link PROTOCOL_SCHEMA_VERSION}. Future minor-compatible
 * versions are added here as the protocol evolves — a client that
 * accepts both `"1.0.0"` and `"1.1.0"` ships with `['1.0.0', '1.1.0']`,
 * and `PROTOCOL_SCHEMA_VERSION` advances independently. The first stable
 * protocol version is spelled `1.0.0` — three components, never `1.0`
 * (founder, 2026-10-02, on ggui#909 / ggui#1338).
 *
 * Frozen so runtime consumers can't mutate the module-level array
 * (would be a cross-session leak).
 */
export declare const CLIENT_SUPPORTED_VERSIONS: readonly string[];
//# sourceMappingURL=version.d.ts.map