From 033bd008a52b7d389abe5a5acf59d23c6edc2716 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 26 May 2026 12:05:16 +0100
Subject: [PATCH 1/3] chore(ci): convert hypatia-scan.yml to thin wrapper of
 standards reusable

Replaces ~416 lines of duplicated Hypatia scan plumbing with a 29-line
wrapper calling hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml
at SHA 2569c10e831e293f9dd6580d82a494aca039deee (standards#191 HEAD).

Behaviour-preserving: same triggers, same concurrency group, same
permissions, same secrets passthrough.

Refs standards#191.
---
 .github/workflows/hypatia-scan.yml | 407 +----------------------------
 1 file changed, 11 insertions(+), 396 deletions(-)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index dfacf3b..9e384bc 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,414 +1,29 @@
 # SPDX-License-Identifier: MPL-2.0
-# Hypatia Neurosymbolic CI/CD Security Scan
+# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
+# See standards#191 for the reusable's purpose and design.
+
 name: Hypatia Security Scan
 
 on:
   push:
-    branches: [ main, master, develop ]
+    branches: [main, master, develop]
   pull_request:
-    branches: [ main, master ]
+    branches: [main, master]
   schedule:
-    - cron: '0 0 * * 0'  # Weekly on Sunday
+    - cron: '0 0 * * 0'
   workflow_dispatch:
-# Estate guardrail: cancel superseded runs so re-pushes don't pile up
-# queued runs across the estate. Safe here because this workflow only
-# performs read-only checks/lint/test/scan with no publish or mutation.
+
+# Estate guardrail: cancel superseded runs so re-pushes don't pile up.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
   contents: read
-  # security-events: write serves two purposes (write implies read):
-  #   1. read — lets the built-in GITHUB_TOKEN query this repo's own
-  #      Dependabot alerts via the Hypatia DependabotAlerts rule
-  #      (DA001-DA004). Without read, `scan_from_path` gets HTTP 403
-  #      and the rule silently returns no findings.
-  #      See 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
-  #   2. write — lets the "Upload SARIF to code scanning" step publish
-  #      Hypatia findings to the Security → Code scanning page so they
-  #      are triaged/deduplicated like CodeQL alerts instead of living
-  #      only in a build artifact nobody is required to look at.
-  #      See hyperpolymath/burble#35 (SARIF integration).
-  # This is a single-job workflow, so job-level scoping would not
-  # narrow the grant further; it stays workflow-level and documented.
   security-events: write
-  # pull-requests: write lets the advisory "Comment on PR with findings"
-  # step post its summary. Without it the built-in GITHUB_TOKEN gets
-  # "Resource not accessible by integration" and (absent continue-on-error)
-  # hard-fails the scan — exactly what the gate-decoupling design forbids.
   pull-requests: write
 
 jobs:
-  scan:
-    name: Hypatia Neurosymbolic Analysis
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0  # Full history for better pattern analysis
-
-      - name: Setup Elixir for Hypatia scanner
-        uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.18.2
-        with:
-          elixir-version: '1.18'
-          otp-version: '27'
-
-      - name: Clone Hypatia
-        run: |
-          if [ ! -d "$HOME/hypatia" ]; then
-            git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia"
-          fi
-
-      - name: Build Hypatia scanner (if needed)
-        run: |
-          cd "$HOME/hypatia"
-          if [ ! -f hypatia ]; then
-            echo "Building hypatia scanner..."
-            mix deps.get
-            mix escript.build
-          fi
-
-      - name: Run Hypatia scan
-        id: scan
-        env:
-          # Pass the built-in Actions token through to Hypatia so the
-          # DependabotAlerts rule can query this repo's own alerts.
-          # For cross-repo scanning (fleet-coordinator scan-supervised),
-          # a PAT with `security_events` scope is required instead.
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo "Scanning repository: ${{ github.repository }}"
-
-          # Run scanner (exits non-zero when findings exist — suppress to continue)
-          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json || true
-
-          # Count findings
-          FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)
-          echo "findings_count=$FINDING_COUNT" >> $GITHUB_OUTPUT
-
-          # Extract severity counts
-          CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json)
-          HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json)
-          MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json)
-
-          echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
-          echo "high=$HIGH" >> $GITHUB_OUTPUT
-          echo "medium=$MEDIUM" >> $GITHUB_OUTPUT
-
-          echo "## Hypatia Scan Results" >> $GITHUB_STEP_SUMMARY
-          echo "- Total findings: $FINDING_COUNT" >> $GITHUB_STEP_SUMMARY
-          echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY
-          echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY
-          echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
-
-      - name: Upload findings artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: hypatia-findings
-          path: hypatia-findings.json
-          retention-days: 90
-
-      - name: Convert Hypatia findings to SARIF
-        # Always runs (no findings_count guard): an EMPTY SARIF run is
-        # valid and intentional — uploading it clears stale Hypatia
-        # alerts from the code-scanning page when a repo goes clean.
-        # The converter is dependency-free Node (Node ships on
-        # ubuntu-latest; no npm install — estate npm ban respected) and
-        # is hardened against the heterogeneous Hypatia JSON schema:
-        # most findings are {rule_module,severity,type,file,reason,
-        # action}; only some carry an integer `line`; `file` may be
-        # empty or absolute. See lib/hypatia/cli.ex (collect_findings).
-        run: |
-          cat > "$RUNNER_TEMP/hypatia-sarif.cjs" <<'CJS'
-          const fs = require('fs');
-          const path = require('path');
-          const crypto = require('crypto');
-
-          const ws = process.env.GITHUB_WORKSPACE || process.cwd();
-
-          let findings = [];
-          try {
-            const parsed = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));
-            if (Array.isArray(parsed)) findings = parsed;
-          } catch (_) {
-            // Scanner unavailable / empty / malformed -> empty SARIF.
-            // Intentionally clears stale alerts rather than erroring.
-            findings = [];
-          }
-
-          // Mirrors Hypatia's own "github" annotation mapping
-          // (lib/hypatia/cli.ex output/2): critical|high -> error,
-          // medium -> warning, everything else -> note.
-          const levelFor = (sev) => {
-            switch (String(sev || '').toLowerCase()) {
-              case 'critical':
-              case 'high': return 'error';
-              case 'medium': return 'warning';
-              default: return 'note';
-            }
-          };
-
-          // SARIF artifactLocation.uri must be a repo-relative POSIX
-          // path. Hypatia may emit absolute paths (scanned under
-          // $GITHUB_WORKSPACE) or "" / "." for repo-level findings.
-          const relUri = (file) => {
-            if (!file) return '.';
-            let f = String(file);
-            if (path.isAbsolute(f)) {
-              const rel = path.relative(ws, f);
-              f = (rel && !rel.startsWith('..')) ? rel : path.basename(f);
-            }
-            f = f.replace(/\\/g, '/').replace(/^\.\//, '');
-            return f || '.';
-          };
-
-          const rules = new Map();
-          const results = findings.map((f) => {
-            const mod = String(f.rule_module || 'hypatia');
-            const type = String(f.type || 'finding');
-            const ruleId = `hypatia/${mod}/${type}`;
-            const level = levelFor(f.severity);
-            if (!rules.has(ruleId)) {
-              rules.set(ruleId, {
-                id: ruleId,
-                name: `${mod}.${type}`,
-                shortDescription: { text: `Hypatia ${mod}: ${type}` },
-                defaultConfiguration: { level }
-              });
-            }
-            const uri = relUri(f.file);
-            const msg = String(f.reason || f.type || 'Hypatia finding');
-            const startLine =
-              Number.isInteger(f.line) && f.line > 0 ? f.line : 1;
-            // Stable cross-run fingerprint for dedupe (no line, so a
-            // moved finding in the same file/rule stays one alert).
-            const fp = crypto
-              .createHash('sha256')
-              .update([ruleId, uri, type, msg].join('|'))
-              .digest('hex');
-            return {
-              ruleId,
-              level,
-              message: { text: msg },
-              locations: [
-                {
-                  physicalLocation: {
-                    artifactLocation: { uri },
-                    region: { startLine }
-                  }
-                }
-              ],
-              partialFingerprints: { 'hypatiaFindingHash/v1': fp }
-            };
-          });
-
-          const sarif = {
-            $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
-            version: '2.1.0',
-            runs: [
-              {
-                tool: {
-                  driver: {
-                    name: 'Hypatia',
-                    informationUri: 'https://github.com/hyperpolymath/hypatia',
-                    rules: Array.from(rules.values())
-                  }
-                },
-                results
-              }
-            ]
-          };
-
-          fs.writeFileSync('hypatia.sarif', JSON.stringify(sarif, null, 2));
-          console.log(`hypatia.sarif written: ${results.length} result(s).`);
-          CJS
-          node "$RUNNER_TEMP/hypatia-sarif.cjs"
-
-      - name: Upload SARIF to GitHub code scanning
-        # Fork PRs get a read-only GITHUB_TOKEN, so security-events:write
-        # is unavailable and upload-sarif cannot publish — skip there
-        # rather than hard-fail (the push/schedule run on the default
-        # branch is the authoritative upload). Same-repo PRs and pushes
-        # do upload. This step is deliberately NOT continue-on-error:
-        # if the security-surface integration breaks we want a loud red,
-        # not a silently-ungated scanner (the exact failure mode #35
-        # exists to end). The empty-SARIF "clear stale alerts" path is
-        # handled in the converter above and does not error here.
-        if: >-
-          always() &&
-          (github.event_name != 'pull_request' ||
-           github.event.pull_request.head.repo.fork != true)
-        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1
-        with:
-          sarif_file: hypatia.sarif
-          # Distinct category so Hypatia results coexist with CodeQL's
-          # (codeql.yml) instead of overwriting them on the same surface.
-          category: hypatia
-
-      - name: Submit findings to gitbot-fleet (Phase 2)
-        if: steps.scan.outputs.findings_count > 0
-        # Phase 2 is the collaborative LEARNING side-channel ("bots share
-        # findings via gitbot-fleet"), not the security gate. The gate is
-        # the baseline-aware "Check for critical or high-severity issues"
-        # step below. A fleet-side regression (e.g. the submit script being
-        # moved/removed) must NEVER hard-fail every consuming repo's scan.
-        # Same reasoning as the "Comment on PR with findings" step.
-        # See hyperpolymath/hypatia#213 (gate decoupling) and the exit-127
-        # estate-wide breakage when gitbot-fleet/scripts/submit-finding.sh
-        # no longer existed on the default branch.
-        continue-on-error: true
-        env:
-          # All GitHub context values surface as env vars so the run
-          # block never interpolates `${{ … }}` inline (closes the
-          # workflow_audit/unsafe_curl_payload + actions_expression_injection
-          # findings).
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          FLEET_PUSH_TOKEN: ${{ secrets.HYPATIA_DISPATCH_PAT }}
-          FLEET_DISPATCH_TOKEN: ${{ secrets.HYPATIA_DISPATCH_PAT }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          GITHUB_SHA: ${{ github.sha }}
-          FINDINGS_COUNT: ${{ steps.scan.outputs.findings_count }}
-        run: |
-          echo "📤 Submitting $FINDINGS_COUNT findings to gitbot-fleet..."
-
-          # Clone gitbot-fleet to temp directory. A clone failure (network,
-          # repo gone) is non-fatal: learning submission is best-effort.
-          FLEET_DIR="/tmp/gitbot-fleet-$$"
-          if ! git clone --depth 1 https://github.com/hyperpolymath/gitbot-fleet.git "$FLEET_DIR"; then
-            echo "::warning::Could not clone gitbot-fleet — skipping Phase 2 learning submission (non-fatal)."
-            exit 0
-          fi
-
-          # The submission script's location in gitbot-fleet has drifted
-          # before (it was absent from the default branch, which exit-127'd
-          # every consuming repo's scan). Probe known locations rather than
-          # hard-coding one path, and skip gracefully if none is present.
-          SUBMIT_SCRIPT=""
-          for cand in \
-            "$FLEET_DIR/scripts/submit-finding.sh" \
-            "$FLEET_DIR/scripts/submit_finding.sh" \
-            "$FLEET_DIR/bin/submit-finding.sh" \
-            "$FLEET_DIR/submit-finding.sh"; do
-            if [ -f "$cand" ]; then
-              SUBMIT_SCRIPT="$cand"
-              break
-            fi
-          done
-
-          if [ -z "$SUBMIT_SCRIPT" ]; then
-            echo "::warning::gitbot-fleet submit-finding script not found at any known path — skipping Phase 2 learning submission (non-fatal). Findings are still uploaded as an artifact and gated below."
-            rm -rf "$FLEET_DIR"
-            exit 0
-          fi
-
-          # Run submission script. Pass the findings path as ABSOLUTE —
-          # the script cd's into its own working dir before reading the
-          # file, so a relative path would resolve to the wrong place.
-          # A submission-script failure is logged but non-fatal.
-          if bash "$SUBMIT_SCRIPT" "$GITHUB_WORKSPACE/hypatia-findings.json"; then
-            echo "✅ Finding submission complete"
-          else
-            echo "::warning::gitbot-fleet submission script exited non-zero — Phase 2 learning submission skipped (non-fatal)."
-          fi
-
-          # Cleanup
-          rm -rf "$FLEET_DIR"
-
-      - name: Check for critical issues
-        if: steps.scan.outputs.critical > 0
-        # GATING POLICY (explicit, by design — not an oversight):
-        # Hypatia is ADVISORY here. Critical findings are surfaced
-        # (step annotation + SARIF alert on the code-scanning page +
-        # PR comment) but do NOT fail this check. Enforcement is
-        # delegated to the code-scanning surface: tighten by adding a
-        # branch-protection "required" status on the `hypatia` SARIF
-        # category, not by reintroducing an `exit 1` here. This keeps
-        # the gate decision in one auditable place (hypatia#213 gate
-        # decoupling) and lets a repo opt into fail-on-critical without
-        # editing this canonical workflow. To change the policy, change
-        # branch protection — deliberately no commented-out `exit 1`.
-        run: |
-          echo "::warning::Hypatia found critical security issue(s) — advisory."
-          echo "See the Security → Code scanning page (category: hypatia)"
-          echo "and the hypatia-findings.json artifact for details."
-
-      - name: Generate scan report
-        run: |
-          cat << EOF > hypatia-report.md
-          # Hypatia Security Scan Report
-
-          **Repository:** ${{ github.repository }}
-          **Scan Date:** $(date -u +"%Y-%m-%d %H:%M:%S UTC")
-          **Commit:** ${{ github.sha }}
-
-          ## Summary
-
-          | Severity | Count |
-          |----------|-------|
-          | Critical | ${{ steps.scan.outputs.critical }} |
-          | High     | ${{ steps.scan.outputs.high }} |
-          | Medium   | ${{ steps.scan.outputs.medium }} |
-          | **Total**| ${{ steps.scan.outputs.findings_count }} |
-
-          ## Next Steps
-
-          1. Triage findings on the **Security → Code scanning** page
-             (SARIF category \`hypatia\`) — dismiss/track them there like
-             CodeQL alerts.
-          2. The full finding set is also attached as the
-             \`hypatia-findings.json\` build artifact for offline review.
-          3. Findings are **advisory** today (surfaced, not gated); the
-             gating policy is documented in the workflow's "Check for
-             critical issues" step.
-
-          ## Learning
-
-          These findings feed Hypatia's learning engine to improve future rules.
-
-          ---
-          *Powered by [Hypatia](https://github.com/hyperpolymath/hypatia) - Neurosymbolic CI/CD Intelligence*
-          EOF
-
-          cat hypatia-report.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Comment on PR with findings
-        if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0
-        # Advisory only — posting findings as a PR comment must never gate
-        # the scan (hypatia#213 gate decoupling). Belt-and-braces alongside
-        # the pull-requests: write permission above: a token/API hiccup or
-        # a fork PR (read-only token) skips the comment, not the check.
-        continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7
-        with:
-          script: |
-            const fs = require('fs');
-            const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));
-
-            const critical = findings.filter(f => f.severity === 'critical').length;
-            const high = findings.filter(f => f.severity === 'high').length;
-
-            let comment = `## 🔍 Hypatia Security Scan\n\n`;
-            comment += `**Findings:** ${findings.length} issues detected\n\n`;
-            comment += `| Severity | Count |\n|----------|-------|\n`;
-            comment += `| 🔴 Critical | ${critical} |\n`;
-            comment += `| 🟠 High | ${high} |\n`;
-            comment += `| 🟡 Medium | ${findings.length - critical - high} |\n\n`;
-
-            if (critical > 0) {
-              comment += `⚠️ **Action Required:** Critical security issues found!\n\n`;
-            }
-
-            comment += `<details><summary>View findings</summary>\n\n`;
-            comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`;
-            comment += `</details>\n\n`;
-            comment += `*Powered by Hypatia Neurosymbolic CI/CD Intelligence*`;
-
-            github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: comment
-            });
\ No newline at end of file
+  hypatia:
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@2569c10e831e293f9dd6580d82a494aca039deee
+    secrets: inherit

From fb6651b1cd40e00f49394c376c79c4d1cc4a9eb2 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 26 May 2026 13:16:16 +0100
Subject: [PATCH 2/3] chore(ci): retarget hypatia-scan wrapper to standards#193
 HEAD

Standards #191 was closed in favour of #193 (parallel-session implementation
with simpler API: zero inputs except runs-on). Repointing the wrapper at
#193 HEAD 97df762107501909f50bb770e9bc200b6c415600 so it picks up the merged reusable once #193 lands.

Refs standards#193.
---
 .github/workflows/hypatia-scan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 9e384bc..1d6417e 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -25,5 +25,5 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@2569c10e831e293f9dd6580d82a494aca039deee
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@97df762107501909f50bb770e9bc200b6c415600
     secrets: inherit

From 5e1757a0d6bd5aed9ae8d9eab97960182ab6dc0f Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 26 May 2026 13:41:10 +0100
Subject: [PATCH 3/3] =?UTF-8?q?ci(sweep):=20codeql=20actions=20matrix,=20s?=
 =?UTF-8?q?afedom=20.res=E2=86=92.affine?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Replace codeql.yml `javascript-typescript` matrix entry with
  `actions` (repo has no JS/TS source). Matches the canonical fix
  in rsr-template-repo#71 / mtpc#8 / thunderbird#75.
- Replace examples/SafeDOMExample.res with the canonical
  examples/SafeDOMExample.affine (per gitbot-fleet#208 and the
  banned-ReScript anti-pattern policy).
---
 .github/workflows/codeql.yml   |   5 +-
 examples/SafeDOMExample.affine | 129 +++++++++++++++++++++++++++++++++
 examples/SafeDOMExample.res    | 109 ----------------------------
 3 files changed, 133 insertions(+), 110 deletions(-)
 create mode 100644 examples/SafeDOMExample.affine
 delete mode 100644 examples/SafeDOMExample.res

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9e32d15..1aa0293 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,7 +30,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          # Repo source is not JS/TS; scan workflow files via the
+          # actions extractor (every repo has those). See hypatia rule
+          # codeql_language_matrix_mismatch.
+          - language: actions
             build-mode: none
 
     steps:
diff --git a/examples/SafeDOMExample.affine b/examples/SafeDOMExample.affine
new file mode 100644
index 0000000..2a62c1d
--- /dev/null
+++ b/examples/SafeDOMExample.affine
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: MPL-2.0
+// SafeDOMExample.affine — formally-verified DOM mounting (aspirational).
+//
+// This example shows the *shape* of SafeDOM consumer code in current
+// AffineScript syntax. The `SafeDOM` stdlib surface it references
+// (`mount_safe`, `mount_when_ready`, `mount_batch`,
+// `proven_selector_validate`, `proven_html_validate`, `mount`) is the
+// target of `affinescript#56` (DOM+Pixi binding survey) and does not
+// yet exist in the published stdlib. The file is therefore
+// parse-checked but not type-checked end-to-end until #56 lands the
+// bindings; `affinescript check` reports `Resolve.UndefinedModule
+// SafeDOM` which is expected.
+//
+// Previous versions of this file (estate-wide, 5 dialect variants)
+// pre-dated ADR-014 (qualified paths), ADR-016 (effect rows), and the
+// `#{`-record-literal sigil (ADR-215). They were retired in favour of
+// this canonical via the gitbot-fleet#208 sweep (2026-05-26).
+
+module SafeDOMExample;
+
+use prelude::{Option, Some, None, Result, Ok, Err};
+
+// `Element` and friends are nominal extern types for now — the real
+// shape lands with affinescript#56.
+extern type Element;
+extern type Selector;
+extern type ValidHTML;
+
+// Single-mount status, lifted from the host into a typed tag union.
+enum MountStatus {
+  Mounted(Element),
+  MountPointNotFound(String),
+  InvalidSelector(String),
+  InvalidHTML(String)
+}
+
+// Batch-mount result.
+enum MountResult {
+  Mounted([Element]),
+  Failed(String)
+}
+
+// Spec for one element in a batch mount.
+struct MountSpec {
+  selector: String,
+  html: String
+}
+
+// SafeDOM's host-side surface, all IO-effecting. Callbacks are passed
+// as separate parameters (rather than a `MountCallbacks` record)
+// because fn-typed struct fields are not currently parser-supported.
+extern fn mount_safe(
+  selector: ref String,
+  html: ref String,
+  on_success: fn(Element) -> (),
+  on_error: fn(String) -> (),
+) -{IO}-> ();
+
+extern fn mount_when_ready(
+  selector: ref String,
+  html: ref String,
+  on_success: fn(Element) -> (),
+  on_error: fn(String) -> (),
+) -{IO}-> ();
+
+extern fn mount_batch(specs: ref [MountSpec]) -{IO}-> MountResult;
+
+extern fn proven_selector_validate(s: ref String) -{IO}-> Result<Selector, String>;
+extern fn proven_html_validate(s: ref String) -{IO}-> Result<ValidHTML, String>;
+extern fn mount(sel: ref Selector, html: ref ValidHTML) -{IO}-> MountStatus;
+
+extern fn array_for_each(xs: ref [Element], f: fn(Element) -> ()) -{IO}-> ();
+extern fn array_len(xs: ref [Element]) -> Int;
+
+// Example 1 — basic mount with success/error branches.
+pub fn mount_app() -{IO}-> () {
+  mount_safe(
+    "#app",
+    "<div><h1>Hello, World!</h1><p>Mounted safely with proofs.</p></div>",
+    fn(el) -> () { Console::log("App mounted successfully"); },
+    fn(err) -> () { Console::error("Mount failed: " ++ err); },
+  );
+}
+
+// Example 2 — defer until DOM ready.
+pub fn mount_when_dom_ready() -{IO}-> () {
+  mount_when_ready(
+    "#app",
+    "<div class='container'><h1>App Title</h1></div>",
+    fn(_el) -> () { Console::log("Mounted after DOM ready"); },
+    fn(err) -> () { Console::error("Failed: " ++ err); },
+  );
+}
+
+// Example 3 — atomic batch mount.
+pub fn mount_multiple() -{IO}-> () {
+  let specs = [
+    MountSpec #{ selector: "#header", html: "<header><h1>Site Title</h1></header>" },
+    MountSpec #{ selector: "#nav",    html: "<nav><a href='/'>Home</a></nav>" },
+    MountSpec #{ selector: "#main",   html: "<main><p>Content here</p></main>" },
+    MountSpec #{ selector: "#footer", html: "<footer>2026</footer>" },
+  ];
+
+  match mount_batch(specs) {
+    Mounted(elements) => {
+      Console::log("Batch mount succeeded");
+      array_for_each(elements, fn(_el) -> () { Console::log("  element"); });
+    },
+    Failed(err) => {
+      Console::error("Batch mount failed (atomic — none mounted): " ++ err);
+    }
+  }
+}
+
+// Example 4 — explicit two-stage validation before mounting.
+pub fn mount_with_validation() -{IO}-> () {
+  match proven_selector_validate("#my-app") {
+    Err(e) => Console::error("Invalid selector: " ++ e),
+    Ok(valid_selector) => match proven_html_validate("<div>Content</div>") {
+      Err(e) => Console::error("Invalid HTML: " ++ e),
+      Ok(valid_html) => match mount(valid_selector, valid_html) {
+        Mounted(_el) => Console::log("Mounted with validated inputs"),
+        MountPointNotFound(s) => Console::error("Element not found: " ++ s),
+        InvalidSelector(_) => Console::error("impossible — already validated"),
+        InvalidHTML(_) => Console::error("impossible — already validated"),
+      },
+    },
+  }
+}
diff --git a/examples/SafeDOMExample.res b/examples/SafeDOMExample.res
deleted file mode 100644
index e5c9046..0000000
--- a/examples/SafeDOMExample.res
+++ /dev/null
@@ -1,109 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-// Example: Using SafeDOM for formally verified DOM mounting
-
-open SafeDOM
-
-// Example 1: Basic mounting with error handling
-let mountApp = () => {
-  mountSafe(
-    "#app",
-    "<div><h1>Hello, World!</h1><p>Mounted safely with proofs.</p></div>",
-    ~onSuccess=el => {
-      Console.log("✓ App mounted successfully!")
-      Console.log("Element:", el)
-    },
-    ~onError=err => {
-      Console.error("✗ Mount failed:", err)
-    }
-  )
-}
-
-// Example 2: Wait for DOM ready before mounting
-let mountWhenDOMReady = () => {
-  mountWhenReady(
-    "#app",
-    "<div class='container'><h1>App Title</h1></div>",
-    ~onSuccess=_ => Console.log("✓ Mounted after DOM ready"),
-    ~onError=err => Console.error("✗ Failed:", err)
-  )
-}
-
-// Example 3: Batch mounting (atomic - all or nothing)
-let mountMultiple = () => {
-  let specs = [
-    {selector: "#header", html: "<header><h1>Site Title</h1></header>"},
-    {selector: "#nav", html: "<nav><a href='/'>Home</a></nav>"},
-    {selector: "#main", html: "<main><p>Content here</p></main>"},
-    {selector: "#footer", html: "<footer>© 2026</footer>"}
-  ]
-
-  switch mountBatch(specs) {
-  | Ok(elements) => {
-      Console.log(`✓ Successfully mounted ${Array.length(elements)} elements`)
-      elements->Array.forEach(el => Console.log("  -", el))
-    }
-  | Error(err) => {
-      Console.error("✗ Batch mount failed:", err)
-      Console.error("  (None were mounted - atomic operation)")
-    }
-  }
-}
-
-// Example 4: Explicit validation before mounting
-let mountWithValidation = () => {
-  // Validate selector first
-  switch ProvenSelector.validate("#my-app") {
-  | Error(e) => Console.error(`Invalid selector: ${e}`)
-  | Ok(validSelector) => {
-      // Validate HTML
-      switch ProvenHTML.validate("<div>Content</div>") {
-      | Error(e) => Console.error(`Invalid HTML: ${e}`)
-      | Ok(validHtml) => {
-          // Now mount with proven safety
-          switch mount(validSelector, validHtml) {
-          | Mounted(el) => Console.log("✓ Mounted with validated inputs:", el)
-          | MountPointNotFound(s) => Console.error(`✗ Element not found: ${s}`)
-          | InvalidSelector(_) => Console.error("Impossible - already validated")
-          | InvalidHTML(_) => Console.error("Impossible - already validated")
-          }
-        }
-      }
-    }
-}
-
-// Example 5: Integration with TEA
-module MyApp = {
-  type model = {message: string}
-  type msg = NoOp
-
-  let init = () => {message: "Hello from TEA"}
-  let update = (model, _msg) => model
-  let view = model => `<div><h1>${model.message}</h1></div>`
-}
-
-let mountTEAApp = () => {
-  let model = MyApp.init()
-  let html = MyApp.view(model)
-
-  mountWhenReady(
-    "#tea-app",
-    html,
-    ~onSuccess=el => {
-      Console.log("✓ TEA app mounted")
-      // Set up event handlers, subscriptions here
-    },
-    ~onError=err => Console.error(`✗ TEA mount failed: ${err}`)
-  )
-}
-
-// Entry point
-let main = () => {
-  Console.log("SafeDOM Examples")
-  Console.log("================\n")
-
-  // Choose which example to run
-  mountWhenDOMReady()  // Run on DOM ready
-}
-
-// Auto-execute when module loads
-main()