Simplify workspace authoring and isolate managed component styles

Use imperative scaffolds without a registry/refresh lifecycle; preserve authored runtime wiring and generate checked descriptors. Consolidate binding options, embed checked TSX/CSS source, queue mutable convergence while allowing parallel immutable checks, and preload real CLI observations. Add Shadow DOM boundaries with scoped overlays and composed-event handling. Update template/toolchain pins and document VM-free authoring, browser, and stateful acceptance; no deployment or default-template selection.

quixos-package-helpers.nix

@@ -539,7 +539,6 @@ EOF
       # An exact, compiler-produced BindingSchema JSON artifact and a backend.
       # Other language helpers can consume the same schema with their own generator/runtime.
       bindings ? null,
-      bindingOptions ? { },
       # A dedicated entrypoint calling SDK serveMigration; never start the
       # normal package server in the isolated migration execution boundary.
       migrationEntrypoint ? null,
@@ -593,14 +592,19 @@ EOF
           resources = bindingConfig.resources or [ ];
         });
         bindingOutput = if bindingConfig == null then "src/gen/qx.ts" else bindingConfig.output or "src/gen/qx.ts";
+        authoringCheck = builtins.fromJSON (builtins.readFile "${packageRoot}/quixos.check.json");
         bindingOptionsFile = if bindingConfig == null then null else
-          pkgs.writeText "qx-typescript-options.json" (builtins.toJSON (bindingConfig.options or bindingOptions));
+          pkgs.writeText "qx-typescript-options.json" (builtins.toJSON (authoringCheck.options or { }));
         bindingCommand = if bindingConfig == null then "" else ''
           mkdir -p ${lib.escapeShellArg (dirOf bindingOutput)}
           ${bindingConfig.generator}/bin/quixos-codegen-ts \
             ${lib.escapeShellArg (toString bindingSchema)} \
             ${lib.escapeShellArg bindingConfig.packageRevisionId} \
             ${lib.escapeShellArg bindingOutput} ${bindingOptionsFile}
+          ${lib.optionalString (installServer != null && descriptorPath != null) ''
+            ${bindingConfig.generator}/bin/quixos-qx package-descriptor ${lib.escapeShellArg (toString bindingSchema)} \
+              ${lib.escapeShellArg bindingConfig.packageRevisionId} > ${lib.escapeShellArg descriptorPath}
+          ''}
         '';
         generateBindings = pkgs.writeShellApplication {
           name = "qx-generate-bindings";
@@ -625,7 +629,14 @@ EOF
         bundleCommand =
           if bundle == null
           then ""
-          else ''
+          else if bundleConfig.browserSources or false then ''
+            ${nodejs}/bin/node ${./browser-source.mjs} ${lib.escapeShellArg (builtins.toJSON {
+              entryPoints = [ bundleConfig.entry ]; bundle = true; platform = bundlePlatform;
+              target = bundleTarget; format = bundleFormat; alias = bundleAliases;
+              preserveSymlinks = bundleConfig.preserveSymlinks or true;
+              banner.js = bundleBanner; outfile = bundleOutfile;
+            })}
+          '' else ''
             esbuild ${lib.escapeShellArg bundleConfig.entry} \
               --bundle \
               --platform=${bundlePlatform} \
@@ -693,6 +704,7 @@ EOF
               runHook preBuild
               ${exportsFor (callOption buildEnv)}
               ${bindingCommand}
+              ${lib.optionalString (bindingConfig != null && bundle != null) "${bindingConfig.generator}/bin/quixos-qx bundle-policy src"}
               ${lib.optionalString (bindingConfig != null) "yarn exec tsc --noEmit"}
               ${lib.optionalString (bindingConfig != null) "cp ${lib.escapeShellArg bindingOutput} .qx-checked-bindings"}
               ${buildCommand}