Merge remote-tracking branch 'origin/main' into ci/tiered-test-gates

Author: elliotBraem

.changeset/non-destructive-pending-boundary.md

@@ -0,0 +1,5 @@
+---
+"everything-dev": patch
+---
+
+De-scale the router's default pending boundary so navigations no longer blank the page: the default pending component renders a compact centered spinner instead of a full-viewport "Loading..." takeover, and `defaultPendingMs` moves from 100ms to 333ms so brief navigations keep the previous page visible with the root progress bar carrying the signal. Pairs with the login route rendering instantly from the hydrated session cache instead of blocking on a session fetch.

.changeset/pre.json

@@ -201,6 +201,7 @@
     "image-cdn-only-distribution",
     "image-leg-split-from-deploy",
     "image-native-artifacts",
+    "immutable-version-dirs",
     "import-migration-reconciliation",
     "init-auth-types-stale-copy",
     "init-prune-unused-ui",
@@ -215,6 +216,7 @@
     "manifest-composition-rework",
     "manifest-contract-v2",
     "modernize-ui-rsbuild-environments",
+    "mount-guards",
     "near-account-management-mobile-login",
     "near-auth-network-recipient",
     "near-connect-fork3-webauthn-bridge",
@@ -375,6 +377,7 @@
     "types-gen-hermetic-resolution",
     "ui-authored-router-factory",
     "ui-generated-bootstrap-stubs",
+    "ui-only-deploys-drift-alarm",
     "ui-route-grafting-foundation",
     "ui-rsbuild-synthesis",
     "ui-surface-durable-cleanup",

packages/better-near-auth/src/near.sandbox.test.ts

@@ -1,4 +1,4 @@
-import { base58, base64, hex } from "@scure/base";
+import { base64, hex } from "@scure/base";
 import { getTestInstance } from "better-auth/test";
 import { generateKey, MlDsa65KeyPair, Near } from "near-kit";
 import { Sandbox } from "near-kit/sandbox";

packages/every-plugin/CHANGELOG.md

@@ -1,5 +1,22 @@
 # every-plugin
 
+## 3.0.0-rc.16
+
+### Minor Changes
+
+- e685c4c: Immutable version directories — parent republishes can no longer rot pinned slots (#826)
+
+  Workspace deploys now dual-write every dist file into a content-addressed `versions/<dirId>/…` directory beside the existing flat slot-root layout, and the version manifest declares its directory via a new `dir` field. Pin resolution prefixes artifact coordinates (`entryUrl`, `browserManifestUrl`, `ssrEntryUrl`) with the manifest's directory, so a child pinned to an older slot keeps loading the old deploy's entry **and** its expose chunk, chunks, and manifests from the same frozen directory — a parent republish that overwrites the fixed-name files at the slot root no longer produces mixed builds (`__webpack_modules__[r] is not a function`). Legacy manifests without `dir` resolve exactly as before.
+
+  - `versionDirPath(files)` derives the directory from the dist's file map (content-addressed: identical bytes → identical directory → unchanged redeploys skip the copy entirely via the previous pin's `dir`)
+  - The upload service treats `versions/**` as write-once: an upload whose bytes differ from the stored object fails with a new `CONFLICT` (409) error, mirroring the platform "version is burned" rule; identical bytes stay an idempotent skip
+  - Serving classification treats everything under `versions/` as immutable (cache-control `immutable`), independent of filename hashing
+  - Staged (in-image) dists ignore the directory — the staged namespace materializes flat, so staged resolution passes `{ ignoreDir: true }`
+
+### Patch Changes
+
+- ad8414f: Mount guards are ordinary beforeLoads supplied by the composing framework, replacing gate kinds. The mount registry now carries shape metadata only (`guarded`, `implemented`) and `constructTree` takes `guards` keyed by mount id — construction fails loudly when a guarded mount has none. The default wiring guards `authenticated` with `requireSession` and `admin` with `requireAdmin`, so a client-rendered full page load resolves the session through the query cache instead of reading a signed-in visitor as signed out (#818): full loads of authed pages no longer bounce through `/login`, and admin pages keep the `?redirect=` return path. Banned users now bounce at the mount, and signed-in non-admins on admin mounts land on `/dashboard`. The engine's invented `HostContext`/`GateUser` types are gone — it has no auth semantics.
+
 ## 3.0.0-rc.15
 
 ### Patch Changes

packages/every-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "every-plugin",
-  "version": "3.0.0-rc.15",
+  "version": "3.0.0-rc.16",
   "type": "module",
   "publishConfig": {
     "access": "public"

packages/everything-dev/CHANGELOG.md

@@ -1,5 +1,32 @@
 # everything-dev
 
+## 2.0.0-rc.41
+
+### Minor Changes
+
+- e685c4c: Immutable version directories — parent republishes can no longer rot pinned slots (#826)
+
+  Workspace deploys now dual-write every dist file into a content-addressed `versions/<dirId>/…` directory beside the existing flat slot-root layout, and the version manifest declares its directory via a new `dir` field. Pin resolution prefixes artifact coordinates (`entryUrl`, `browserManifestUrl`, `ssrEntryUrl`) with the manifest's directory, so a child pinned to an older slot keeps loading the old deploy's entry **and** its expose chunk, chunks, and manifests from the same frozen directory — a parent republish that overwrites the fixed-name files at the slot root no longer produces mixed builds (`__webpack_modules__[r] is not a function`). Legacy manifests without `dir` resolve exactly as before.
+
+  - `versionDirPath(files)` derives the directory from the dist's file map (content-addressed: identical bytes → identical directory → unchanged redeploys skip the copy entirely via the previous pin's `dir`)
+  - The upload service treats `versions/**` as write-once: an upload whose bytes differ from the stored object fails with a new `CONFLICT` (409) error, mirroring the platform "version is burned" rule; identical bytes stay an idempotent skip
+  - Serving classification treats everything under `versions/` as immutable (cache-control `immutable`), independent of filename hashing
+  - Staged (in-image) dists ignore the directory — the staged namespace materializes flat, so staged resolution passes `{ ignoreDir: true }`
+
+- 0e2e7f9: Right-sized deploys: ui-only trains skip Railway, drift alarm (`bos verify`), restart advisory
+
+  - **Ui-only deploys stop restarting the host** (#826 follow-up): the train diffs the published config against the live one, and when the change touches only SnapshotWatch-adopted surfaces (the ui slot, plugin ui overrides) the Railway leg skips — the soft-refresh banner carries the adoption instead of a restart. `--force-railway` overrides; any backend/host/config change keeps the full train; uncertainty reads cold.
+  - **`bos verify`** — the drift alarm: for every published pin, SRI-verify the version manifest and hash every file it names against the served bytes (the manual curl+sha384 sweep, automated). Rot fails the command naming the file; being behind the parent's live release is advisory. Child deploys run it post-publish, non-blocking, with the report on the job summary.
+  - **Restart advisory**: when a snapshot adopt moves a boot-frozen slot's pin (api/auth/plugin backends — the swap cannot adopt them), the host surfaces `restartRequired` at `/.well-known/version` and `/health` instead of silently serving the previous generation.
+  - **Ui-only CI runs the smoke spec**: a diff confined to `ui/` replaces the full sharded browser regression matrix with the app-load spec (boot + hydration + runtime-config shape).
+
+### Patch Changes
+
+- ad8414f: Mount guards are ordinary beforeLoads supplied by the composing framework, replacing gate kinds. The mount registry now carries shape metadata only (`guarded`, `implemented`) and `constructTree` takes `guards` keyed by mount id — construction fails loudly when a guarded mount has none. The default wiring guards `authenticated` with `requireSession` and `admin` with `requireAdmin`, so a client-rendered full page load resolves the session through the query cache instead of reading a signed-in visitor as signed out (#818): full loads of authed pages no longer bounce through `/login`, and admin pages keep the `?redirect=` return path. Banned users now bounce at the mount, and signed-in non-admins on admin mounts land on `/dashboard`. The engine's invented `HostContext`/`GateUser` types are gone — it has no auth semantics.
+- Updated dependencies [e685c4c]
+- Updated dependencies [ad8414f]
+  - every-plugin@3.0.0-rc.16
+
 ## 2.0.0-rc.40
 
 ### Minor Changes

packages/everything-dev/package.json

@@ -1,6 +1,6 @@
 {
   "name": "everything-dev",
-  "version": "2.0.0-rc.40",
+  "version": "2.0.0-rc.41",
   "type": "module",
   "engines": {
     "node": ">=20.11"

packages/everything-dev/src/services/scaffold/upgrade-audit/steps/v2-catalog.ts

@@ -65,8 +65,8 @@ export const V2_CATALOG: Readonly<Record<string, string>> = {
   "drizzle-kit": "^0.31.11",
   "drizzle-orm": "^0.45.4",
   effect: "4.0.0-rc.118",
-  "every-plugin": "^3.0.0-rc.15",
-  "everything-dev": "^2.0.0-rc.40",
+  "every-plugin": "^3.0.0-rc.16",
+  "everything-dev": "^2.0.0-rc.41",
   "near-kit": "^0.20.2",
   pg: "^8.12.0",
   react: "19.3.1",

packages/everything-dev/src/ui/router-client.tsx

@@ -66,10 +66,11 @@ export function createRouter<
     scrollRestoration: true,
     defaultStructuralSharing: true,
     defaultPreloadStaleTime: 0,
-    // Show the pending boundary fast (#683): the router's 1000ms default left
-    // cold authed navigations blank for up to a second, forcing every child
-    // to re-declare pendingMs.
-    defaultPendingMs: 100,
+    // Pending boundary at 333ms: brief navigations keep the previous page
+    // rendered with the root progress bar carrying the signal, and the
+    // compact spinner is reserved for genuinely slow or first loads — still
+    // well inside the 1000ms blank window #683 fixed.
+    defaultPendingMs: 333,
     defaultPendingMinMs: 0,
     defaultErrorComponent: RouterError,
     defaultNotFoundComponent,

packages/everything-dev/src/ui/router-defaults.tsx

@@ -19,11 +19,12 @@ export function defaultNotFoundComponent() {
 
 export function defaultPendingComponent() {
   return (
-    <div className="min-h-screen flex items-center justify-center bg-background px-6">
-      <div className="flex flex-col items-center gap-3" role="status" aria-live="polite">
-        <div className="h-6 w-6 animate-spin rounded-full border-2 border-border border-t-foreground" />
-        <p className="text-sm text-muted-foreground">Loading...</p>
-      </div>
+    <div
+      className="flex min-h-48 flex-1 items-center justify-center bg-background p-6"
+      role="status"
+      aria-live="polite"
+    >
+      <div className="h-6 w-6 animate-spin rounded-full border-2 border-border border-t-foreground" />
     </div>
   );
 }