refactor: route selector-resolution structural stages into typed policy (#1744)

* refactor: route selector structural stages into typed policy

#1649 landed the per-caller ambiguity matrix and deliberately left four
structural columns out: occlusion, off-screen, hittable-ancestor promotion,
and the poll budget were per-caller pipeline code, so declaring them would
have been an unverifiable claim (nothing consumed them; flipping one left the
suite green).

This adds the missing half as a table with runners. `SELECTOR_PIPELINE_POLICIES`
(src/core/selector-pipeline-policy.ts) gives each caller ONE row naming its
ambiguity contract plus its four stages, and every stage is reached only
through a runner that reads the row:

- occlusion -> selectorPipelineCandidates (candidacy) and
  resolveSelectorPipelineTarget (refusal). Acting rows exclude covered nodes
  and refuse covered targets; `find` and the diagnosis probe keep them as
  candidates and refuse at the target; reads and `wait` ignore them.
- promotion -> resolveSelectorPipelineTarget. The per-call-site
  `promoteToHittableAncestor: boolean` is gone: click/press/longpress name
  `promotedTarget`, fill/focus/scroll/drag endpoints and the native-ref
  preflight name `resolvedTarget`. `find`'s below-the-root variant is a
  declared value rather than a second local helper.
- off-screen -> throwIfOffscreenInteractionTarget, which now takes the row and
  returns the node untouched (no iOS rescue round trip) for observation rows.
- poll -> selectorPollBudget, which createWaitPolling derives its deadline and
  inter-poll delay from; the two wait loops carry a budget, every other row
  carries none and cannot be polled.

Behavior is byte-identical. The acting refusal keeps its exact node, label and
details in every branch (promotion declines to retarget away from a covered
node, so the "both covered" case names the same node it always did), and
`find` carries the occlusion verdict to the focus/type seam rather than
raising it early, because find click/fill still delegate that refusal to the
interaction leaf's own error shape.

selector-pipeline-policy.test.ts drives EVERY row through EVERY runner,
including the rows whose answer is "skip" — the half that used to be an
absence of code, and an absence cannot fail. Each stage was proven red by
flipping its cell (occlusion, promotion, off-screen, poll, plus the
declare-only-what-is-enforced guard). The ADR 0011 occlusion/nonHittable
`via` pointers for the runtime tree paths now name the runner that makes the
decision, not the predicate it applies.

Closes #1656; prework for #1739 (waves 4-5).

* docs: state constraints instead of narrating the refactor

Comment pass over #1656: drop the "used to be per-caller code" /
"not module constants" / "rather than an omission" narration — a comment
should say what a future edit must respect, not what the previous shape was —
and compress the find occlusion-verdict and poll-budget notes to the
constraint they actually carry.

* refactor: make the selector pipeline the only door to the engine

Review of #1744: the structural rows were declared but bypassable. Read and
wait routes composed `selectorPipelineCandidates(row, nodes)` with the raw
`resolveSelectorChainWithPolicy(..., row.resolution)` and never entered the
promotion or off-screen stages, so flipping a read row's `promotion` or
`offscreen` changed only the policy unit tests — production `get`/`is`/`wait`
were unaffected, which is the unverifiable-column failure #1656 exists to
remove. Callers could also pair one row's candidate set with another row's
ambiguity contract, and `find list` reached the engine directly.

The owning interface (src/core/selector-pipeline.ts) now runs every stage a row
declares, skips included, and the stage functions are private to it:

- `resolveSelectorPipeline` — single-target rows: candidacy, ambiguity, the
  replay-guard hook, promotion, occlusion, off-screen.
- `listSelectorPipelineMatches` — `reject-candidates` rows, returning the
  candidate set AND the tree the row sees, so ranking and equivalence
  classification judge the same nodes candidacy produced.
- `runNodePipelineStages` — the node stages for a target from a non-chain
  matcher (`@ref`, find's fuzzy locator) or a narrowed candidate set.

A row whose off-screen stage refuses must supply a refusal shape, so flipping
an observation row to `refuse` fails on its real route instead of silently
observing. `find list` now names a `readList` row (the new
`reject-candidates`/no-rect ambiguity row) instead of calling the engine.

R17 selector-pipeline-ownership (scripts/layering/) makes the bypass
structurally inexpressible: only the owner may import the engine entry points.
Proven against a planted import in selector-read.ts, which the repo-wide scan
rejects with the entry points that replace it.

Flips now fail through REAL command routes, verified one at a time:
readUnique.occlusion/offscreen/promotion and wait.occlusion via get attrs / is
/ wait; readAny.offscreen via is exists and find; readList.occlusion via find
list; promotedTarget.promotion via runtime click. The wait route test needed an
advancing clock first — with the frozen one a refused wait spun instead of
failing, so the flip hung rather than asserting.

* refactor: drop find's dead candidate binding

The selector branch bound the row's candidate set and never read it: only the
acting classification needs that tree, and find's locator branch brings its own
matcher. Names what actually governs the locator target — the shared node
stages below, not a candidate set it never had.

* refactor: reserve the selector engine behind the pipeline owner

Review of #1744 (three blockers).

**Listing rows no longer claim stages they cannot run.** `find <q> list`
resolves to a candidate SET, so promotion, the off-screen guard and a poll
budget have nothing to apply to — a listing has no single element to retarget,
keep on screen, or wait for. `readList` now declares only the two stages a
listing executes (`SelectorListPolicy`: resolution + occlusion), and the
narrower shape is load-bearing: `runNodePipelineStages` and `selectorPollBudget`
take the full row, so handing them a listing row is a compile error rather than
a silently skipped stage. Pinned with `@ts-expect-error` — widening `readList`
makes the directives unused and fails the typecheck.

**The engine door is a specifier, not a symbol.** R17's regex could not see a
namespace import, a re-export, or a deferred `import()`, none of which mention
the symbol it matched. The two engine entries moved to
`@agent-device/selectors/engine`, and R19 enforces over the resolved import
graph, where every one of those forms is the same edge. Proven on the
repo-wide scan by planting each form into a shipped route: namespace import,
dynamic import, and `export *` laundering all come back red.

`resolveImportEdges` drops an edge whose specifier resolves to nothing, so a
specifier rule goes quiet — not red — if the subpath is ever retired. The gate
now says that out loud instead of scanning clean.

**R19, not R17.** #1750 allocates R17/R18. Verified free against origin/main
and that PR's diff, then validated by real merges in both directions: the
uniqueness gate passes either way and the three ids stay distinct.

The gate itself is new (`scripts/layering/rule-ids.ts`): two branches taking one
free number do not conflict in git, so nothing caught R17 twice. Matching whole
string literals is what separates a declaration from prose that names a rule,
and it is what let the gate see #1750's `const RULE = '…'` shape — the first
version missed it and would have been vacuous. `main`'s two pre-existing
collisions (R11, R13) are listed as known, not pinned by equality, so #1750
lands in either order without breaking this.

Also: the root façade now exposes no resolver at all, and its surface test
pins both doors.

* fix(layering): make each rule-id allowance expire with its collision

Review of #1744: `KNOWN_RULE_ID_COLLISIONS` filtered the exact R11/R13
collision strings, so once #1750 renames those rules apart the entries would
keep waving those very collisions through if anyone reintroduced them. "Inert"
was wrong — a stale allowance fails open, permanently.

`ruleIdCollisionFailures` now checks the transition from both sides: a
collision nobody allowed fails, AND an allowance whose collision is absent
from the scan fails as a stale allowance. The entry therefore has to be deleted
in the same change that removes the collision, and the list burns down to
empty, which admits nothing.

#1750 is still open, so the transitional entries stay for now (option (b)).
Verified against a scratch tree carrying that PR's rename: leaving the list
untouched reports both entries as stale; deleting them is clean; and
reintroducing `R11 names contracts-implementation-authority and
package-boundaries` afterwards is rejected. The last of those is also a unit
regression, so the post-transition guarantee is pinned rather than argued.

Author: thymikee

packages/contracts/src/interaction-guarantees.ts

@@ -150,9 +150,12 @@ const SHARED_RESPONSE_CONSTRUCTION: GuaranteeEnforcement = {
 // guard/observation implementations; only how the target is found
 // (disambiguation) and how failures are described (errorTaxonomy) differ.
 const RUNTIME_TREE_SHARED_GUARANTEES = {
+  // #1656: the decision point is the pipeline runner, which reads the acting
+  // row's occlusion stage; isSnapshotNodeInteractionBlocked stays the
+  // predicate it applies (and the annotation contract it reads).
   occlusion: {
     kind: 'runtime',
-    via: 'src/snapshot/snapshot-occlusion.ts#isSnapshotNodeInteractionBlocked',
+    via: 'src/core/selector-pipeline.ts#runNodePipelineStages',
   },
   parentOwnedTouchPoint: {
     kind: 'runtime',
@@ -171,9 +174,11 @@ const RUNTIME_TREE_SHARED_GUARANTEES = {
     kind: 'runtime',
     via: 'src/commands/interaction/runtime/resolution.ts#throwIfOffscreenInteractionTarget',
   },
+  // Promotion runs only for rows that declare it (#1656); the retarget itself
+  // is still resolveActionableTouchResolution.
   nonHittable: {
     kind: 'runtime',
-    via: 'src/core/interaction-targeting.ts#resolveActionableTouchResolution',
+    via: 'src/core/selector-pipeline.ts#runNodePipelineStages',
   },
   responseConstruction: SHARED_RESPONSE_CONSTRUCTION,
   responseIdentity: {
@@ -249,7 +254,7 @@ export const INTERACTION_DISPATCH_PATHS: Record<InteractionPathId, InteractionPa
       },
       occlusion: {
         kind: 'runtime',
-        via: 'src/snapshot/snapshot-occlusion.ts#isSnapshotNodeInteractionBlocked',
+        via: 'src/core/selector-pipeline.ts#runNodePipelineStages',
       },
       parentOwnedTouchPoint: {
         kind: 'runtime',
@@ -370,7 +375,7 @@ export const INTERACTION_DISPATCH_PATHS: Record<InteractionPathId, InteractionPa
       },
       occlusion: {
         kind: 'runtime',
-        via: 'src/snapshot/snapshot-occlusion.ts#isSnapshotNodeInteractionBlocked',
+        via: 'src/core/selector-pipeline.ts#runNodePipelineStages',
       },
       parentOwnedTouchPoint: {
         kind: 'inapplicable',

packages/selectors/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "sideEffects": false,
   "type": "module",
-  "description": "Shared selector matching, argument, and replay semantics for agent-device. `.` is string-only; `./ast` is the published parser surface behind `agent-device/selectors`.",
+  "description": "Shared selector matching, argument, and replay semantics for agent-device. `.` is string-only; `./ast` is the published parser surface behind `agent-device/selectors`; `./engine` is the resolve/list surface reserved for the selector-pipeline owner (R19).",
   "dependencies": {
     "@agent-device/ad-script": "workspace:*",
     "@agent-device/contracts": "workspace:*",
@@ -18,6 +18,10 @@
     "./ast": {
       "types": "./src/ast.ts",
       "default": "./src/ast.ts"
+    },
+    "./engine": {
+      "types": "./src/engine.ts",
+      "default": "./src/engine.ts"
     }
   },
   "devDependencies": {

packages/selectors/src/engine.ts

@@ -0,0 +1,24 @@
+/**
+ * The matching engine's own door (#1656).
+ *
+ * "Resolve a selector against a screen" and "list what it matched" are the two
+ * decisions a pipeline policy row exists to qualify: which nodes may be
+ * candidates, whether several matches refuse or collapse, and which structural
+ * stages run around the answer. A caller that reaches these directly gets the
+ * ambiguity contract and silently skips every structural stage — the failure
+ * #1649 caught in the first policy matrix and #1656's review caught in the
+ * second.
+ *
+ * So they live behind a subpath of their own rather than on the root façade,
+ * and R19 selector-pipeline-ownership admits exactly one importer:
+ * `src/core/selector-pipeline.ts`. A specifier is what the import graph
+ * resolves, so namespace imports, dynamic imports, and re-exports are all the
+ * same edge and all equally refused — which a name-shaped check could not say.
+ *
+ * Everything else selectors publishes (parsing, matching, formatting, replay)
+ * stays on the root façade: none of it decides what a row decides.
+ */
+export {
+  listSelectorChainMatches,
+  resolveSelectorChainWithPolicy,
+} from './internal/facade-engine.ts';

packages/selectors/src/index.test.ts

@@ -1,14 +1,15 @@
 import assert from 'node:assert/strict';
+import { resolveSelectorChainWithPolicy } from './engine.ts';
 import { test } from 'vitest';
 import type { SnapshotNode } from '@agent-device/kernel/snapshot';
 import * as selectorsFacade from './index.ts';
+import * as selectorsEngine from './engine.ts';
 import {
   buildSelectorCandidates,
   readReplaySelectorDisplayValue,
   readSelectorExpression,
   resolveRecordedTarget,
   resolveReplaySuggestionCandidate,
-  resolveSelectorChainWithPolicy,
   SELECTOR_RESOLUTION_POLICIES,
 } from './index.ts';
 
@@ -201,16 +202,36 @@ test('replay suggestion resolution and display values stay string-only at the fa
  * preserved semantics — so no fixture-tree assertion can catch a revert
  * (#1715 review). The absence of the symbol is the only observable.
  */
-test('the façade exposes no resolver that bypasses the policy matrix', () => {
+test('the façade exposes no resolver at all, and the engine door exposes only the two entries', () => {
   const exported = Object.keys(selectorsFacade);
-  assert.ok(exported.includes('resolveSelectorChainWithPolicy'));
-  assert.ok(!exported.includes('resolveSelectorChain'), 'knob-taking resolver must stay private');
+  // #1656 moved both engine entries behind `./engine`, which R19 reserves for
+  // the selector-pipeline owner: a route that could reach a resolver from the
+  // root façade would get an ambiguity contract while skipping every
+  // structural stage its policy row declares.
   assert.ok(
-    !exported.includes('findSelectorChainMatch'),
-    'count-only existence lookup must stay private; `is exists` names the readAny row',
+    !exported.includes('resolveSelectorChainWithPolicy'),
+    'resolution belongs to the engine subpath, behind the pipeline owner',
   );
   assert.ok(
-    !exported.includes('selectorResolutionKnobs'),
-    'knob derivation must stay private so a call site cannot rebuild a contract from knobs',
+    !exported.includes('listSelectorChainMatches'),
+    'enumeration belongs to the engine subpath, behind the pipeline owner',
   );
+  assert.deepEqual(Object.keys(selectorsEngine).sort(), [
+    'listSelectorChainMatches',
+    'resolveSelectorChainWithPolicy',
+  ]);
+
+  // Unchanged since #1630, on both surfaces: neither door hands out a knob
+  // resolver a call site could rebuild its contract from.
+  for (const [surface, names] of [
+    ['facade', exported],
+    ['engine', Object.keys(selectorsEngine)],
+  ] as const) {
+    assert.ok(!names.includes('resolveSelectorChain'), `${surface}: knob-taking resolver`);
+    assert.ok(
+      !names.includes('findSelectorChainMatch'),
+      `${surface}: count-only existence lookup; \`is exists\` names the readAny row`,
+    );
+    assert.ok(!names.includes('selectorResolutionKnobs'), `${surface}: knob derivation`);
+  }
 });

packages/selectors/src/index.ts

@@ -1,11 +1,4 @@
-import type { SnapshotState } from '@agent-device/kernel/snapshot';
 import type { Selector } from './internal/parse.ts';
-import type {
-  PolicyResolutionOutcome,
-  SelectorChainMatchList,
-  SelectorMatchOptions,
-} from './internal/public-resolution-types.ts';
-import { resolveSelectorChainWithPolicy as resolveSelectorChainWithPolicyAst } from './internal/resolve-with-policy.ts';
 import {
   checkElementTargetArgs,
   checkGetFormat,
@@ -30,11 +23,7 @@ import {
   IS_PREDICATE_USAGE_HINT,
   normalizeIsPositionals,
 } from './internal/predicates.ts';
-import {
-  listSelectorChainMatches as listSelectorChainMatchesAst,
-  selectorFailureHint,
-  STALE_REF_HINT,
-} from './internal/resolve.ts';
+import { selectorFailureHint, STALE_REF_HINT } from './internal/resolve.ts';
 import {
   findBestMatchesByLocator,
   checkFindArgs,
@@ -59,6 +48,7 @@ export type { IsPredicate } from './internal/predicates.ts';
 export type {
   PolicyResolutionOutcome,
   SelectorChainMatchList,
+  SelectorMatchOptions,
   SelectorResolution,
 } from './internal/public-resolution-types.ts';
 export { formatSelectorFailure } from './internal/resolve.ts';
@@ -80,7 +70,6 @@ export {
   isRoleHintWord,
   isSelectorToken,
   isValidSelectorExpression,
-  listSelectorChainMatches,
   normalizeIsPositionals,
   normalizeSelectorText,
   parseFindArgs,
@@ -225,52 +214,5 @@ function validateSelectorExpression(expression: string): void {
   parseSelectorChain(expression);
 }
 
-/** Public façade wrapper that accepts/returns selector text, never an AST. */
-function listSelectorChainMatches(
-  nodes: SnapshotState['nodes'],
-  expression: string,
-  options: SelectorMatchOptions,
-): SelectorChainMatchList | null {
-  const result = listSelectorChainMatchesAst(nodes, parseSelectorChain(expression), options);
-  return result ? { ...result, selector: result.selector.raw } : null;
-}
-
 export { SELECTOR_RESOLUTION_POLICIES } from './internal/resolution-policy.ts';
 export type { SelectorResolutionPolicy } from './internal/resolution-policy.ts';
-import type { SelectorResolutionPolicy } from './internal/resolution-policy.ts';
-
-/**
- * The façade's ONLY selector-resolution entry (#1630): every native consumer
- * of "resolve a selector against the screen" states its contract by naming a
- * `SELECTOR_RESOLUTION_POLICIES` row, because there is no knob-taking resolver
- * here to state it inline with instead. Accepts selector text and returns
- * selector text — never an AST, in either direction.
- *
- * The return leg is the half that is easy to miss: the parser-side outcome
- * carries the winning `Selector` node inside `resolution`, and returning it
- * unchanged would put a package-private parser object back in every caller's
- * hands through a nested field. The façade's own boundary gate reads exported
- * *names*, so it cannot see that; `selector-wait.ts` reading
- * `outcome.resolution.selector.raw` was the runtime proof it had happened.
- * Flattening here is the same treatment `listSelectorChainMatches` above gives
- * its own selector node (#1589).
- */
-function resolveSelectorChainWithPolicy(
-  nodes: SnapshotState['nodes'],
-  expression: string,
-  policy: SelectorResolutionPolicy,
-  options: SelectorMatchOptions,
-): PolicyResolutionOutcome {
-  const outcome = resolveSelectorChainWithPolicyAst(
-    nodes,
-    parseSelectorChain(expression),
-    policy,
-    options,
-  );
-  if (outcome.kind !== 'resolved') return outcome;
-  return {
-    ...outcome,
-    resolution: { ...outcome.resolution, selector: outcome.resolution.selector.raw },
-  };
-}
-export { resolveSelectorChainWithPolicy };

packages/selectors/src/internal/facade-engine.ts

@@ -0,0 +1,62 @@
+import type { SnapshotState } from '@agent-device/kernel/snapshot';
+import { parseSelectorChain } from './parse.ts';
+import { listSelectorChainMatches as listSelectorChainMatchesAst } from './resolve.ts';
+import { resolveSelectorChainWithPolicy as resolveSelectorChainWithPolicyAst } from './resolve-with-policy.ts';
+import type { SelectorResolutionPolicy } from './resolution-policy.ts';
+import type {
+  PolicyResolutionOutcome,
+  SelectorChainMatchList,
+  SelectorMatchOptions,
+} from './public-resolution-types.ts';
+
+/**
+ * The two engine entries, behind `@agent-device/selectors/engine` (#1656).
+ * Both are string-in/string-out façade wrappers (#1589): a nested parser node
+ * would reopen the AST boundary invisibly, since the package-boundary gate
+ * reads exported *names* and cannot see into a returned shape.
+ */
+
+/** Public façade wrapper that accepts/returns selector text, never an AST. */
+export function listSelectorChainMatches(
+  nodes: SnapshotState['nodes'],
+  expression: string,
+  options: SelectorMatchOptions,
+): SelectorChainMatchList | null {
+  const result = listSelectorChainMatchesAst(nodes, parseSelectorChain(expression), options);
+  return result ? { ...result, selector: result.selector.raw } : null;
+}
+
+/**
+ * The façade's ONLY selector-resolution entry (#1630): every native consumer
+ * of "resolve a selector against the screen" states its contract by naming a
+ * `SELECTOR_RESOLUTION_POLICIES` row, because there is no knob-taking resolver
+ * here to state it inline with instead. Accepts selector text and returns
+ * selector text — never an AST, in either direction.
+ *
+ * The return leg is the half that is easy to miss: the parser-side outcome
+ * carries the winning `Selector` node inside `resolution`, and returning it
+ * unchanged would put a package-private parser object back in every caller's
+ * hands through a nested field. The façade's own boundary gate reads exported
+ * *names*, so it cannot see that; `selector-wait.ts` reading
+ * `outcome.resolution.selector.raw` was the runtime proof it had happened.
+ * Flattening here is the same treatment `listSelectorChainMatches` above gives
+ * its own selector node (#1589).
+ */
+export function resolveSelectorChainWithPolicy(
+  nodes: SnapshotState['nodes'],
+  expression: string,
+  policy: SelectorResolutionPolicy,
+  options: SelectorMatchOptions,
+): PolicyResolutionOutcome {
+  const outcome = resolveSelectorChainWithPolicyAst(
+    nodes,
+    parseSelectorChain(expression),
+    policy,
+    options,
+  );
+  if (outcome.kind !== 'resolved') return outcome;
+  return {
+    ...outcome,
+    resolution: { ...outcome.resolution, selector: outcome.resolution.selector.raw },
+  };
+}

packages/selectors/src/internal/resolution-policy.ts

@@ -28,11 +28,12 @@ import type { SelectorResolutionOptions } from './public-resolution-types.ts';
  * documented semantics fails a test.
  *
  * The surrounding pipeline stages — occlusion, the off-screen guard,
- * hittable-ancestor promotion, and the wait poll budget — still live in the
- * callers and are NOT declared here. An earlier revision listed them as
- * columns; nothing consumed them, so they were unverifiable claims that read
- * as truth while being free to drift (#1649 review). Routing them into typed
- * behavior is tracked in #1656.
+ * hittable-ancestor promotion, and the wait poll budget — are declared in the
+ * companion structural table, `src/core/selector-pipeline-policy.ts` (#1656),
+ * whose rows each name one row of this matrix. They live there rather than
+ * here because this package is deliberately blind to snapshot occlusion
+ * annotations, backend visibility probes, and the wait clock: a column here
+ * would be a claim nothing in this package could enforce (#1649 review).
  */
 
 export type KnobBackedSelectorAmbiguity = 'disambiguate' | 'fail-closed' | 'first-match';
@@ -80,6 +81,14 @@ export const SELECTOR_RESOLUTION_POLICIES = {
     ambiguity: 'reject-candidates',
     requireRect: true,
   },
+  /**
+   * `find <q> list` — the inspection surface: every match is the ANSWER, so the
+   * candidate set stays whole and nothing needs a tap point.
+   */
+  readList: {
+    ambiguity: 'reject-candidates',
+    requireRect: false,
+  },
 } as const satisfies Record<string, SelectorResolutionPolicy>;
 
 /**

scripts/layering/check.ts

@@ -102,6 +102,7 @@ import {
   sourceExecutedUsingDeclarationViolations,
 } from './logs-runtime-cutover-policy.ts';
 import { contractsImplementationAuthorityViolations } from './contracts-implementation-policy.ts';
+import { selectorPipelineOwnershipViolations } from './selector-pipeline-ownership.ts';
 import {
   networkLegacyRouteViolations,
   networkRuntimeNarrowingViolations,
@@ -670,6 +671,7 @@ export const LAYERING_RULE_IDS = [
   'value-import-cycles',
   'logs-runtime-cutover',
   'contracts-implementation-authority',
+  'selector-pipeline-ownership',
   'network-runtime-cutover',
   'record-runtime-cutover',
   'back-edges',
@@ -691,6 +693,8 @@ export const LAYERING_RULES: Readonly<Record<LayeringRuleId, LayeringRule>> = {
   'logs-runtime-cutover': (context) => checkLogsRuntimeCutover(context.sources),
   'contracts-implementation-authority': (context) =>
     checkContractsImplementationAuthority(context.sources),
+  'selector-pipeline-ownership': (context) =>
+    selectorPipelineOwnershipViolations(context.edges, workspaceSpecifierTargets(repoRoot)),
   'network-runtime-cutover': (context) => checkNetworkRuntimeCutover(context.sources),
   'record-runtime-cutover': (context) => checkRecordRuntimeCutover(context.sources),
   'back-edges': (context) => checkBackEdges(context.edges),

scripts/layering/package-boundaries.test.ts

@@ -387,13 +387,17 @@ test('the real tree parses, declares, and passes R11', () => {
   );
   const selectorsPackage = packages.find((pkg) => pkg.name === '@agent-device/selectors');
   assert.ok(selectorsPackage, 'selectors package must exist');
-  // Two subpaths, and the split is the point: `.` is the string-only façade
+  // Three subpaths, and each split is the point: `.` is the string-only façade
   // every in-repo consumer uses, `./ast` is the published parser surface that
   // `agent-device/selectors` has shipped since before the engine moved into
-  // this package. A third subpath, or the AST leaking into `.`, fails here.
+  // this package, and `./engine` is the resolve/list surface reserved for the
+  // selector-pipeline owner (R19, #1656) — a route reaching it skips the
+  // structural stages its policy row declares. A fourth subpath, or the AST
+  // leaking into `.`, fails here.
   assert.deepEqual([...selectorsPackage.exportTargets.keys()].sort(), [
     '@agent-device/selectors',
     '@agent-device/selectors/ast',
+    '@agent-device/selectors/engine',
   ]);
   assert.deepEqual([...selectorsPackage.workspaceDependencies].sort(), [
     '@agent-device/ad-script',