test(tools): gate published artifacts against dead v0.43 residue (#1273, B2.13)

check-package-artifacts.ts scans the packed npm tarballs (which ship
src/**), so it is the cheapest honest place to keep the B2.13 deletions
from silently reappearing in a release:

- FORBIDDEN_LEGACY_PATHS: the five proven-dead @openelement/element
  modules removed in the B2.13 audit fail the gate if they ever re-enter
  the packed artifact.
- FORBIDDEN_LEGACY_SOURCE_PATTERNS: the removed marker-hydration channel
  (DATA_SSR_PROPS export, data-eid/data-signal* attributes,
  oe-branch:/oe-for-item: comment markers) is rejected in comment-stripped
  packed sources, extending the check-v044-legacy-absence.ts dist contract
  to the published src payload.

The gate is already wired at ci+release tiers in tools/autoflow/policy.ts
(package-artifacts:check) and runs before consumer:packaged. Unit tests
cover both rules plus comment/other-package false-positive guards.

Refs #1273. Stage #1288 risk #8.

Author: DevBot

tools/check-package-artifacts.test.ts

@@ -148,3 +148,76 @@ Deno.test('package artifacts: rejects adapter tests and fixtures', async () => {
     },
   );
 });
+
+Deno.test('package artifacts: rejects dead v0.43 residue paths (#1273/B2.13)', async () => {
+  await withPackage(
+    '@openelement/element',
+    {
+      'index.js': 'export {};',
+      'src/types.ts': 'export interface ElementDefinition {}',
+      'src/internal/protocol/vnode.ts': 'export interface VNode {}',
+      'src/internal/protocol/prop.ts': 'export type PropDecl = never;',
+      'src/internal/core/dom-utils.ts': 'export function clearChildren() {}',
+      'src/internal/core/dsd-shadow-root.ts': 'export function hasPopulatedShadowRoot() {}',
+    },
+    (root) => {
+      const messages = scanExtractedPackage('@openelement/element', root).violations.map((v) =>
+        v.message
+      );
+      assertEquals(
+        messages.filter((message) =>
+          message === 'dead v0.43 residue must not be published (#1273/B2.13)'
+        ).length,
+        5,
+      );
+    },
+  );
+});
+
+Deno.test('package artifacts: rejects legacy hydration markers in packed sources', async () => {
+  await withPackage(
+    '@openelement/element',
+    {
+      'index.js': 'export {};',
+      'src/internal/protocol/hydration-markers.ts': `
+        export const DATA_SSR_PROPS = 'data-ssr-props';
+        export const DATA_SIGNAL = 'data-signal';
+        export const BRANCH_MARKER_PREFIX = 'oe-branch:';
+      `,
+    },
+    (root) => {
+      const messages = scanExtractedPackage('@openelement/element', root).violations.map((v) =>
+        v.message
+      );
+      assert(messages.includes('dead data-ssr-props channel export (#836, removed in 0.44)'));
+      assert(messages.includes('legacy marker-based hydration attribute'));
+      assert(messages.includes('legacy branch/list hydration comment marker'));
+    },
+  );
+});
+
+Deno.test('package artifacts: marker scan ignores comments and other packages', async () => {
+  await withPackage(
+    '@openelement/element',
+    {
+      'index.js': 'export {};',
+      'src/migration-note.ts': `
+        // The removed channel was documented as data-ssr-props; do not re-add.
+        export const DATA_OE_LIGHT = 'data-oe-light';
+      `,
+    },
+    (root) => {
+      assertEquals(scanExtractedPackage('@openelement/element', root).violations, []);
+    },
+  );
+  await withPackage(
+    '@openelement/app',
+    {
+      'index.js': 'export {};',
+      'src/notes.ts': `export const marker = 'data-signal';`,
+    },
+    (root) => {
+      assertEquals(scanExtractedPackage('@openelement/app', root).violations, []);
+    },
+  );
+});

tools/check-package-artifacts.ts

@@ -38,6 +38,42 @@ const HOST_PATTERNS: Array<[RegExp, string]> = [
   [/\bclearImmediate\b/, 'Node clearImmediate global'],
 ];
 
+// #1273 / B2.13 (stage #1288 risk #8): dead v0.43 renderer/binding/hydration
+// residue must not silently reappear in PUBLISHED artifacts (the packages
+// ship src/**, so a removed module that comes back would go straight to
+// npm). Paths are relative to the extracted package root; the audit table in
+// the B2.13 PR records the dead-code proof for each entry.
+const FORBIDDEN_LEGACY_PATHS: Record<string, ReadonlyArray<string>> = {
+  '@openelement/element': [
+    // Legacy ElementDefinition / runtime-renderer typing (VNode model).
+    'src/types.ts',
+    'src/internal/protocol/vnode.ts',
+    // Legacy static prop-declaration typing (ADR-0052 era), superseded by the
+    // compiler's __compiledProperties metadata.
+    'src/internal/protocol/prop.ts',
+    // Legacy renderer DOM helpers with no consumer in the compiled model.
+    'src/internal/core/dom-utils.ts',
+    'src/internal/core/dsd-shadow-root.ts',
+  ],
+};
+
+// Marker strings of the removed v0.43 marker-hydration channel, scanned in
+// comment-stripped packed sources. The same literals are forbidden in built
+// artifacts by tools/check-v044-legacy-absence.ts; this rule extends that
+// absence contract to the published src/** payload.
+const FORBIDDEN_LEGACY_SOURCE_PATTERNS: Record<string, ReadonlyArray<[RegExp, string]>> = {
+  '@openelement/element': [
+    [/\bDATA_SSR_PROPS\b/u, 'dead data-ssr-props channel export (#836, removed in 0.44)'],
+    [
+      /['"]data-(?:eid|signal)(?:-[^'"]*)?['"]/u,
+      'legacy marker-based hydration attribute',
+    ],
+    [/['"]oe-(?:branch|for-item):/u, 'legacy branch/list hydration comment marker'],
+  ],
+};
+
+const SOURCE_SCAN_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.mjs', '.cjs']);
+
 export interface ArtifactViolation {
   path: string;
   message: string;
@@ -137,6 +173,8 @@ export function scanExtractedPackage(packageName: string, packageRoot: string):
   pushPackageJsonViolations(packageName, `${packageRoot}/package.json`, violations);
 
   const runtimeFree = RUNTIME_FREE_PACKAGES.has(packageName);
+  const forbiddenPaths = FORBIDDEN_LEGACY_PATHS[packageName] ?? [];
+  const forbiddenSourcePatterns = FORBIDDEN_LEGACY_SOURCE_PATTERNS[packageName] ?? [];
   const files = new Set<string>();
   for (
     const entry of walkSync(packageRoot, {
@@ -146,6 +184,22 @@ export function scanExtractedPackage(packageName: string, packageRoot: string):
   ) {
     const relative = entry.path.slice(packageRoot.length + 1);
     files.add(relative);
+    if (forbiddenPaths.includes(relative)) {
+      violations.push({
+        path: `${packageName}/${relative}`,
+        message: 'dead v0.43 residue must not be published (#1273/B2.13)',
+      });
+    }
+    if (
+      forbiddenSourcePatterns.length > 0 && SOURCE_SCAN_EXTENSIONS.has(extension(entry.path))
+    ) {
+      const text = stripComments(Deno.readTextFileSync(entry.path));
+      for (const [pattern, message] of forbiddenSourcePatterns) {
+        if (pattern.test(text)) {
+          violations.push({ path: `${packageName}/${relative}`, message });
+        }
+      }
+    }
     if (
       packageName === '@openelement/adapter-vite' &&
       relative.split('/').some((segment) =>