Server Component browser reference integrity (0.14.0 qualification work)

Scope and starting point

This is a test-only increment from origin/main SHA 7c6942f5b458335d57265c527b3195362814d300 (2026-10-29). The working tree was clean before the change. The branch is feat/server-components-browser-integrity-v014. The package remains @strata-sc/server-components 0.13.0; a test-only empty Changeset is present so release status reports no package version bump; no production runtime, Vite behavior or public contract changed. This work does not claim a 0.14.0 release.

The checked-in package manifests identify Strata versions @strata-sc/core 0.2.2, @strata-sc/analog 0.11.0 and @strata-sc/server-components 0.13.0. The local failure fixture resolved Node 22.23.1, Angular core/common/compiler/platform-browser/platform-server/router 22.2.3, Analog platform and Vite Angular plugin 2.7.2, Nitro 2.13.4, Vite 8.3.0, TypeScript 6.0.3 and Playwright 1.62.1. The isolated packed consumer resolved Nitro 2.13.5, Analog Router 2.8.1, Wrangler 4.135.0 and the same Angular/Vite/TypeScript tuple. The pack contained the actual 0.13.0 tarball (141,711 bytes).

Implemented and locally integrated

tools/server-components/lib/failures.ts adds a browser-controlled negative case to the existing failure harness. Before Chromium receives the response, the harness renames one SSR boundary in host B from <failure-island> to <missing-island> while retaining its SSR subtree and Angular hydration attributes. The browser preflight finds no matching registered reference and refuses the entire host with category reference. This does not weaken or bypass Vite analysis: the fixture is a controlled mutation of SSR boundary metadata, testing the established runtime preflight layer.

The test asserts one StrataBoundaryError through Angular ErrorHandler, exactly one preflight-refused host event with failureCategory: "reference", zero committed boundaries, buildMismatch: false, no island construction, no hydrated markers, unchanged DOM node identity and positions, inert server output, working independent sibling hosts, no page error or unhandled rejection, no retry, and one document request with the same JavaScript realm. The same scenario passes on Nitro Node and local Wrangler Pages/workerd. Existing protocol and resource refusal cases run in the same suite: protocol 999, the 128-boundary ceiling and the 1 MiB aggregate limit all retain all-or-nothing behavior. Protocol v1 is exercised by the failure fixture; both v1 and v2 are covered by the packed positive consumer.

Evidence level: IMPLEMENTED, UNIT TESTED (existing registry tests), LOCALLY INTEGRATED (Node + Chromium and workerd + Chromium). The browser negative is an unknown boundary selector; it does not exercise a malformed generated descriptor or descriptor accessor throwing inside buildClientReferenceRegistry. Those descriptor cases remain unit-only.

Packed consumer

pnpm test:server-component-package-consumer passes. It builds and packs the real 0.13.0 package, installs it with npm into a temporary app outside the workspace, verifies package entry-point resolution from node_modules, one Angular core/compiler and Vite runtime, strict TypeScript 6.0.3 and 5.9.2 declarations, Angular partial compilation/linking, v1 and v2 SSR, aliased public inputs, SSR DOM identity, interaction, server-only output scans, an installed-package 129-boundary refusal, development server edit/reload, and local workerd hydration. Its observer-rejection control also passes without changing hydration or ErrorHandler delivery.

The installed consumer does not yet add browser negatives for package selector mismatch, installed selector conflicts, missing Angular metadata or controlled invalid descriptors. The existing positive controls remain intact. No claim is made that Angular/Vite compiler protection for those cases was exercised in Chromium in this increment.

Evidence level: PACKED-CONSUMER QUALIFIED for the existing positive matrix, budget refusal, observer rejection and confidentiality scans; not qualified for the listed installed-package reference negatives.

Vite cache, security and performance

The test:server-component-optimized-deps suite passes cold, warm, forced, included, excluded, linked-package and production optimizer checks. Its controlled installed-package mutation also reproduces the expected Vite behavior: after an already optimized package is edited in place, the warm cache serves the old chunk; optimizeDeps.force or a cold start detects the new server-only assertion. This is an in-place dependency replacement limitation, and the suite records restart with --force as the recovery procedure. It does not reproduce a descriptor-format change generated by Strata or distinguish a package-version upgrade from file replacement. The regular test:server-component-dev suite passes generated surrogate add/swap/remove, server-owned reloads, client HMR with realm retained, and 247 graph refreshes (8 ms minimum, 17 ms median, 150 ms maximum). The packed consumer also passes its installed-package server-owned edit/reload. The older 0.12.0 report's descriptor-format observation remains unconfirmed and isolated; its layer cannot be assigned from this run. No Vite internals were patched and no Strata-owned cache defect was demonstrated.

The packed consumer's positive and negative server-only graph scans pass, including public browser source maps and synthetic canaries. The dedicated test:server-component-security suite also passes on Node and local workerd. Registry construction and browser preflight timing series (1, 8, 32 and repeated references, malformed input) and separate browser/server bundle measurements were not collected; no performance claim is made.

Check results and outstanding evidence

The origin/main remote-tracking ref was already at the starting SHA. A pruning fetch completed before branch creation. No hosted run was available through the connected run lookup for that SHA. PR #153 is open with hosted checks pending. Issue #117 is still open; it concerns exact-SHA release workflow transition evidence and is outside this qualification. No M3, M4, M5, 1.0, hosted-CI, deployed or production-adoption completion is claimed.