diff --git a/apps/composer/app/catalog-export.test.ts b/apps/composer/app/catalog-export.test.ts
new file mode 100644
index 0000000..359c5b6
--- /dev/null
+++ b/apps/composer/app/catalog-export.test.ts
@@ -0,0 +1,54 @@
+/**
+ * The Catalog export (Preview's "export catalog"). The beta's experimental
+ * build adds a per-surface action manifest (docs/blocks/HOST-ACTIONS.md); the
+ * default build's export must stay byte-identical (docs/blocks/PHASE-2-RELEASE-PLAN.md,
+ * §12). The oracle below is the export as main wrote it before the action
+ * manifest (exportBundle in app/views/preview-view.tsx at 3edd589), kept
+ * verbatim minus the download, and the default export is held to it, byte for
+ * byte, over real project emits.
+ */
+import { describe, expect, it } from "vitest";
+import { catalogBundle, catalogJson } from "./catalog-export";
+import { REFERENCES } from "./demo-data";
+import { browserEmit, contractSurfaces } from "./validation";
+
+type Emit = { catalog?: Record<string, any>; surfaces?: Array<{ name: string; messages?: unknown[] }> };
+
+/** main's exportBundle at 3edd589, minus the download: the bytes it wrote. */
+function todaysBytes(emit: Emit, exportedAt: string): string {
+  const bundle = {
+    a2uiCatalog: emit.catalog,
+    surfaces: (emit.surfaces ?? [])
+      .filter((s) => s.messages)
+      .map((s) => ({ name: s.name, messages: s.messages })),
+    exportedAt,
+  };
+  return JSON.stringify(bundle, null, 2);
+}
+
+const AT = "2026-10-16T12:00:00.000Z";
+
+describe("the default Catalog export is byte-identical to today's", () => {
+  for (const id of Object.keys(REFERENCES)) {
+    it(`${id}: the reference's own emit, every surface, exported exactly as before`, () => {
+      const { contract, profile } = REFERENCES[id]!;
+      const emit = browserEmit(contract as Record<string, unknown>, profile as Record<string, unknown>, contractSurfaces(contract as Record<string, unknown>)) as Emit;
+      expect(emit.surfaces?.length).toBeGreaterThan(0);
+      const bytes = catalogJson(catalogBundle(emit, AT));
+      expect(bytes).toBe(todaysBytes(emit, AT));
+      expect(Object.keys(JSON.parse(bytes))).toEqual(["a2uiCatalog", "surfaces", "exportedAt"]);
+      expect(bytes).not.toContain("actionManifest");
+    });
+  }
+
+  it("a refused surface is left out and a missing catalog is omitted, as before", () => {
+    const emit: Emit = { surfaces: [{ name: "kept", messages: [{ version: "v0.9" }] }, { name: "refused" }] };
+    expect(catalogJson(catalogBundle(emit, AT))).toBe(todaysBytes(emit, AT));
+    expect(JSON.parse(catalogJson(catalogBundle(emit, AT)))).toEqual({ surfaces: [{ name: "kept", messages: [{ version: "v0.9" }] }], exportedAt: AT });
+  });
+
+  it("an emit with no surfaces exports an empty list, as before", () => {
+    const emit: Emit = { catalog: { components: {} } };
+    expect(catalogJson(catalogBundle(emit, AT))).toBe(todaysBytes(emit, AT));
+  });
+});
diff --git a/apps/composer/app/catalog-export.ts b/apps/composer/app/catalog-export.ts
new file mode 100644
index 0000000..46bb6cb
--- /dev/null
+++ b/apps/composer/app/catalog-export.ts
@@ -0,0 +1,53 @@
+/**
+ * The Catalog export (Preview's "export catalog"): the emitted A2UI catalog,
+ * the vocabulary an A2UI/AG-UI client consumes, plus every emitted surface's
+ * messages (worked AG-UI payloads), as one JSON download. A pure browser
+ * download, in demo mode and agent mode alike, with no filesystem round
+ * trip, so a hosted user can take the catalog away and use it.
+ *
+ * The beta's experimental build adds a per-surface action manifest to the
+ * bundle (docs/blocks/HOST-ACTIONS.md). Nothing here knows of it, and the
+ * default build's export stays byte-identical to the one before it
+ * (catalog-export.test.ts).
+ */
+
+/** What the export reads from an emit. */
+export interface CatalogEmit {
+  catalog?: unknown;
+  surfaces?: ReadonlyArray<{ name: string; messages?: unknown[] }>;
+}
+
+export interface CatalogBundle {
+  a2uiCatalog: unknown;
+  surfaces: Array<{ name: string; messages: unknown[] }>;
+  exportedAt: string;
+}
+
+/** The catalog and every surface that emitted; a refused surface has no messages to take away. */
+export function catalogBundle(emit: CatalogEmit, exportedAt: string): CatalogBundle {
+  return {
+    a2uiCatalog: emit.catalog,
+    surfaces: (emit.surfaces ?? [])
+      .filter((s) => s.messages)
+      .map((s) => ({ name: s.name, messages: s.messages as unknown[] })),
+    exportedAt,
+  };
+}
+
+/** The bytes the download holds. */
+export function catalogJson(bundle: object): string {
+  return JSON.stringify(bundle, null, 2);
+}
+
+/** Download a bundle as `<name>-catalog.json`. */
+export function downloadCatalog(bundle: object, name: string): void {
+  const blob = new Blob([catalogJson(bundle)], { type: "application/json" });
+  const url = URL.createObjectURL(blob);
+  const a = document.createElement("a");
+  a.href = url;
+  a.download = `${name.replace(/[^a-z0-9-]+/gi, "-").toLowerCase() || "a2ui"}-catalog.json`;
+  document.body.appendChild(a);
+  a.click();
+  a.remove();
+  URL.revokeObjectURL(url);
+}
diff --git a/apps/composer/app/state.tsx b/apps/composer/app/state.tsx
index 3cdf036..398707c 100644
--- a/apps/composer/app/state.tsx
+++ b/apps/composer/app/state.tsx
@@ -242,6 +242,8 @@ export interface ComposerState {
   importProject: (text: string) => { ok: true; name: string } | { ok: false; error: string };
   /** Export a project to a downloadable, portable file. */
   exportProject: (id: string) => void;
+  /** Interface blocks (experimental): a project's block provenance, which its project export and the beta's Catalog export carry. Always empty in default builds. */
+  blockProvenanceFor: (projectId: string) => Record<string, unknown>;
   /** Open a packaged reference as a read-only EXAMPLE workspace (ephemeral —
    *  never in "Your projects", pristine on every open, session edits only). */
   openExample: (referenceId: string) => void;
@@ -640,6 +642,17 @@ export function ComposerProvider({ children }: { children: ReactNode }) {
     [openProject],
   );
 
+  /**
+   * Interface blocks (experimental): a project's block provenance, for its
+   * project export and the beta's Catalog export (docs/blocks/HOST-ACTIONS.md).
+   * An Example session keeps its own in memory. Default builds read none.
+   */
+  const blockProvenanceFor = useCallback(
+    (id: string): Record<string, unknown> =>
+      process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1" ? (exampleProject && id === exampleProject.id ? sessionProvenance.current : loadBlockProvenance(id)) : {},
+    [exampleProject],
+  );
+
   /**
    * Export a project to a downloadable file — its identity plus its governed
    * vocabulary, nothing machine-specific. The OPEN project exports exactly
@@ -684,13 +697,12 @@ export function ComposerProvider({ children }: { children: ReactNode }) {
       const projectFlows = id === activeProjectId ? flows : loadFlowsStore(id);
       // Interface blocks (experimental): provenance is project data and rides
       // along, additive like flows. Default builds export none.
-      const blockProvenance =
-        process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1" ? (exampleProject && id === exampleProject.id ? sessionProvenance.current : loadBlockProvenance(id)) : {};
+      const blockProvenance = blockProvenanceFor(id);
       downloadProjectExport(
         buildProjectExport({ name: p.name, description: p.description, vocab, exportedAt: new Date().toISOString(), flows: projectFlows, blockProvenance }),
       );
     },
-    [activeProjectId, contract, profile, manifest, flows, exampleProject],
+    [activeProjectId, contract, profile, manifest, flows, blockProvenanceFor],
   );
 
   /** Return to the hub without loading a project (ends an example session). */
@@ -1668,6 +1680,7 @@ export function ComposerProvider({ children }: { children: ReactNode }) {
       deleteProject,
       importProject,
       exportProject,
+      blockProvenanceFor,
       openExample,
       isExample: exampleProject !== null,
       duplicateExample,
@@ -1703,7 +1716,7 @@ export function ComposerProvider({ children }: { children: ReactNode }) {
       experimental,
       setExperimental,
     }),
-    [mode, agentUp, projectPath, manifest, contract, profile, ledger, rediscovery, emit, validate, busy, notice, selected, connect, referenceId, loadReference, referenceExampleIds, projects, activeProject, newProject, openProject, closeProject, renameProject, duplicateProject, deleteProject, importProject, exportProject, openExample, exampleProject, duplicateExample, discover, rediscover, saveContract, saveProfile, resolveDeletion, resolveConflict, clearTombstone, acceptFreshFact, runEmit, runValidate, flows, saveFlows, buildTurns, buildBusy, buildModels, selectableModels, activeModel, setActiveModel, providerConfig, storedProviders, openaiKey, configureLocalProvider, readiness, runBuild, acceptBuildTurn, clearBuildThread, flowComposition, experimental, setExperimental],
+    [mode, agentUp, projectPath, manifest, contract, profile, ledger, rediscovery, emit, validate, busy, notice, selected, connect, referenceId, loadReference, referenceExampleIds, projects, activeProject, newProject, openProject, closeProject, renameProject, duplicateProject, deleteProject, importProject, exportProject, blockProvenanceFor, openExample, exampleProject, duplicateExample, discover, rediscover, saveContract, saveProfile, resolveDeletion, resolveConflict, clearTombstone, acceptFreshFact, runEmit, runValidate, flows, saveFlows, buildTurns, buildBusy, buildModels, selectableModels, activeModel, setActiveModel, providerConfig, storedProviders, openaiKey, configureLocalProvider, readiness, runBuild, acceptBuildTurn, clearBuildThread, flowComposition, experimental, setExperimental],
   );
 
   return <Ctx.Provider value={value}>{children}</Ctx.Provider>;
diff --git a/apps/composer/app/views/preview-view.tsx b/apps/composer/app/views/preview-view.tsx
index 0503d2e..35fd1ac 100644
--- a/apps/composer/app/views/preview-view.tsx
+++ b/apps/composer/app/views/preview-view.tsx
@@ -18,6 +18,7 @@
  */
 import { useEffect, useMemo, useRef, useState } from "react";
 import { A2uiCanvas, type A2uiClientAction, type Registry } from "@dspack-studio/a2ui-ingest";
+import { catalogBundle, downloadCatalog } from "../catalog-export";
 import { useComposer } from "../state";
 import { ViewHeader } from "../ui";
 import { isPendingStep, mintStepId, missingSurfaceMessage, nextFlowId, pendingStepMessage, type Flow, type FlowStep } from "../flows";
@@ -33,32 +34,6 @@ import {
 
 type RegistryId = "wireframe" | PreviewRegistryId;
 
-/**
- * Export the emitted artifacts as a downloadable JSON bundle: the A2UI
- * catalog (the vocabulary an A2UI/AG-UI client consumes) plus every emitted
- * surface's messages (worked AG-UI payloads). Pure browser download — works
- * in demo mode and agent mode alike, with no filesystem round-trip, so a
- * hosted user can actually take the catalog away and use it.
- */
-function exportBundle(emit: NonNullable<ReturnType<typeof useComposer>["emit"]>, name: string): void {
-  const bundle = {
-    a2uiCatalog: emit.catalog,
-    surfaces: (emit.surfaces ?? [])
-      .filter((s) => s.messages)
-      .map((s) => ({ name: s.name, messages: s.messages })),
-    exportedAt: new Date().toISOString(),
-  };
-  const blob = new Blob([JSON.stringify(bundle, null, 2)], { type: "application/json" });
-  const url = URL.createObjectURL(blob);
-  const a = document.createElement("a");
-  a.href = url;
-  a.download = `${name.replace(/[^a-z0-9-]+/gi, "-").toLowerCase() || "a2ui"}-catalog.json`;
-  document.body.appendChild(a);
-  a.click();
-  a.remove();
-  URL.revokeObjectURL(url);
-}
-
 const field = {
   fontFamily: "var(--mono)",
   fontSize: 12,
@@ -102,7 +77,7 @@ const draftFrom = (flow: Flow): FlowDraft => ({
 });
 
 export function PreviewView({ focus }: { focus?: "flows" } = {}) {
-  const { contract, emit, manifest, referenceExampleIds, isExample, mode, activeProject, projectPath, flows, saveFlows } = useComposer();
+  const { contract, emit, manifest, referenceExampleIds, isExample, mode, activeProject, projectPath, flows, saveFlows, blockProvenanceFor } = useComposer();
   // null = "no explicit choice yet" — the project's own design system draws
   // it. An explicit pick survives until the project changes (B5).
   const [registryId, setRegistryId] = useState<RegistryId | null>(null);
@@ -117,6 +92,27 @@ export function PreviewView({ focus }: { focus?: "flows" } = {}) {
 
   const catalog = emit?.catalog;
   const surfaces = (emit?.surfaces ?? []).filter((s) => s.messages);
+
+  /**
+   * The Catalog export (catalog-export.ts). The beta's experimental build adds
+   * its per-surface action manifest (docs/blocks/HOST-ACTIONS.md); if that
+   * cannot be built, today's export goes out instead, which binds nothing.
+   */
+  const exportCatalog = (current: NonNullable<typeof emit>, name: string) => {
+    const bundle = catalogBundle(current, new Date().toISOString());
+    if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1") {
+      const provenance = activeProject ? blockProvenanceFor(activeProject.id) : {};
+      const examples = (contract?.examples as Array<{ id?: unknown; surface?: unknown }> | undefined) ?? [];
+      void import("../../experimental/blocks-runtime")
+        .then((runtime) => runtime.withActionManifest(bundle, { surfaces: current.surfaces ?? [], examples, provenance }))
+        .then(
+          (withManifest) => downloadCatalog(withManifest, name),
+          () => downloadCatalog(bundle, name),
+        );
+      return;
+    }
+    downloadCatalog(bundle, name);
+  };
   // A surface a person reads by its TITLE — the goal that produced it, or the
   // name someone authored — with `ex.chat-1` kept beside it for audit (B7).
   const entriesById = useMemo(() => surfaceEntriesById(contract?.examples), [contract]);
@@ -394,7 +390,7 @@ export function PreviewView({ focus }: { focus?: "flows" } = {}) {
         <button
           className="st-btn st-btn--dashed"
           style={{ marginLeft: "auto" }}
-          onClick={() => emit && exportBundle(emit, manifest?.name ?? "a2ui")}
+          onClick={() => emit && exportCatalog(emit, manifest?.name ?? "a2ui")}
           data-testid="export-catalog"
           title="Download the emitted A2UI catalog + surface messages as JSON"
         >
diff --git a/apps/composer/experimental/blocks-runtime.test.ts b/apps/composer/experimental/blocks-runtime.test.ts
index 3e79c3e..3c922aa 100644
--- a/apps/composer/experimental/blocks-runtime.test.ts
+++ b/apps/composer/experimental/blocks-runtime.test.ts
@@ -9,8 +9,20 @@ import { createCallRecorder, foldBuildEvents, planDeterministic } from "@dspack-
 import { REFERENCES } from "../app/demo-data";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import type { BlocksBetaSwitch } from "@dspack-studio/composer-core/blocks";
-import { blockBinding, blockContext, blockRunFor, chooseBlock, planGoalWithBlocks, readBlocksBeta, runHostedBlockBuild, type BlockContext } from "./blocks-runtime";
+import { expandBlock, expansionDigest, type BlocksBetaSwitch } from "@dspack-studio/composer-core/blocks";
+import { catalogBundle } from "../app/catalog-export";
+import { browserEmit, contractSurfaces } from "../app/validation";
+import {
+  blockBinding,
+  blockContext,
+  blockRunFor,
+  chooseBlock,
+  planGoalWithBlocks,
+  readBlocksBeta,
+  runHostedBlockBuild,
+  withActionManifest,
+  type BlockContext,
+} from "./blocks-runtime";
 
 type Json = Record<string, any>;
 
@@ -414,3 +426,92 @@ describe("named calls only (Phase 2 plan, §5)", () => {
     expect(source).not.toMatch(/positional/i);
   });
 });
+
+describe("the beta's Catalog export carries the action manifest (docs/blocks/HOST-ACTIONS.md)", () => {
+  const AT = "2026-10-16T12:00:00.000Z";
+  const ACCEPTED = "ex.chat-1";
+
+  /** An Astryx project that accepted the auth-form example as a block surface, and its provenance entry. */
+  async function acceptedAuthForm() {
+    const base = (await blockBinding(reference))!;
+    const block = base.sidecar.blocks.find((b) => b.id === "auth-form")!;
+    const example = block.examples[0]!;
+    const expanded = expandBlock(block, example.call, { reference: base.sidecar.reference, intent: example.intent });
+    if (!expanded.ok) throw new Error(expanded.message);
+    const surface = expanded.surface as unknown as Json;
+    const live = { ...(astryx.contract as Json), examples: [...((astryx.contract as Json).examples as Json[]), { id: ACCEPTED, name: "Sign in", intent: example.intent, prompt: "a sign-in form", surface }] };
+    const entry = {
+      v: 1,
+      reference: base.sidecar.reference,
+      baseSha256: base.sidecar.baseSha256,
+      block: "auth-form",
+      version: 1,
+      intent: example.intent,
+      blockSchemaSha256: "a".repeat(64),
+      encoding: "named",
+      call: example.call,
+      expansionDigest: await expansionDigest(surface),
+    };
+    return { live, entry, surface };
+  }
+
+  /** Exactly what Preview exports: the app's own emit, today's bundle, then the manifest. */
+  async function exported(live: Json, provenance: Record<string, unknown>) {
+    const emit = browserEmit(live, astryx.profile as Json, contractSurfaces(live));
+    const bundle = catalogBundle(emit, AT);
+    const out = await withActionManifest(bundle, { surfaces: emit.surfaces ?? [], examples: (live.examples as Json[]) ?? [], provenance });
+    return { bundle, out: out as Json };
+  }
+
+  it("adds the manifest before exportedAt and changes nothing else; the accepted block surface binds, the reference's own examples bind nothing", async () => {
+    const { live, entry } = await acceptedAuthForm();
+    const { bundle, out } = await exported(live, { [ACCEPTED]: entry });
+    expect(Object.keys(out)).toEqual(["a2uiCatalog", "surfaces", "actionManifest", "exportedAt"]);
+    expect(out.a2uiCatalog).toEqual(bundle.a2uiCatalog);
+    expect(out.surfaces).toEqual(bundle.surfaces);
+    expect(out.exportedAt).toBe(AT);
+
+    const manifest = out.actionManifest as Json;
+    expect(manifest.v).toBe(1);
+    expect(manifest.surfaces.map((s: Json) => s.surface)).toEqual(bundle.surfaces.map((s) => s.name));
+    const accepted = manifest.surfaces.find((s: Json) => s.surface === ACCEPTED);
+    expect(accepted.block).toMatchObject({ id: "auth-form", version: 1, intent: "data-collection", streaming: "disable-actions-until-complete", expansionDigest: entry.expansionDigest });
+    expect(accepted.actions).toEqual([
+      { name: "auth_provider_github", declared: true },
+      { name: "auth_submit", declared: true },
+    ]);
+    for (const other of manifest.surfaces.filter((s: Json) => s.surface !== ACCEPTED)) {
+      expect(other.block).toBeNull();
+      expect(other.actions.every((a: Json) => a.declared === false)).toBe(true);
+    }
+  });
+
+  it("an accepted surface edited afterwards: the manifest is recomputed from its messages, with no binding and the new action undeclared", async () => {
+    const { live, entry, surface } = await acceptedAuthForm();
+    const edited = structuredClone(surface);
+    edited.root.children.push({ component: "button", id: "auth-delete-account", props: { label: "Delete account", variant: "secondary" } });
+    const examples = (live.examples as Json[]).map((e) => (e.id === ACCEPTED ? { ...e, surface: edited } : e));
+    const { out } = await exported({ ...live, examples }, { [ACCEPTED]: entry });
+    const accepted = (out.actionManifest as Json).surfaces.find((s: Json) => s.surface === ACCEPTED);
+    expect(accepted.block).toBeNull();
+    expect(accepted.actions).toContainEqual({ name: "auth_delete_account", declared: false });
+    expect(accepted.actions.every((a: Json) => a.declared === false)).toBe(true);
+  });
+
+  it("forged provenance on a reference example grants nothing", async () => {
+    const { live, entry } = await acceptedAuthForm();
+    const target = ((astryx.contract as Json).examples as Json[]).find((e) => e.surface)!.id as string;
+    const { out } = await exported(live, { [target]: { ...entry, expansionDigest: "f".repeat(64) }, [ACCEPTED]: entry });
+    const forged = (out.actionManifest as Json).surfaces.find((s: Json) => s.surface === target);
+    expect(forged.block).toBeNull();
+    expect(forged.actions.every((a: Json) => a.declared === false)).toBe(true);
+  });
+
+  it("no provenance at all: every surface is listed, and none binds", async () => {
+    const { live } = await acceptedAuthForm();
+    const { out } = await exported(live, {});
+    const surfaces = (out.actionManifest as Json).surfaces as Json[];
+    expect(surfaces.length).toBeGreaterThan(1);
+    for (const s of surfaces) expect(s.block).toBeNull();
+  });
+});
diff --git a/apps/composer/experimental/blocks-runtime.ts b/apps/composer/experimental/blocks-runtime.ts
index 4778611..0fb052f 100644
--- a/apps/composer/experimental/blocks-runtime.ts
+++ b/apps/composer/experimental/blocks-runtime.ts
@@ -16,7 +16,8 @@
  * phase, then the SAME runPipeline with its attempt 0 decided), provenance
  * for accepted block surfaces, and the status Settings shows. Phase 2 adds
  * the beta's runtime switch (docs/blocks/PHASE-2-RELEASE-PLAN.md, §6), read
- * from /api/models before every build.
+ * from /api/models before every build, and the action manifest the beta's
+ * Catalog export carries (§7; docs/blocks/HOST-ACTIONS.md).
  */
 import { loadProfile, type Profile } from "@aestheticfunction/dspack-emit";
 import { AdapterOutputError } from "@aestheticfunction/dspack-gen/adapter-types";
@@ -34,6 +35,7 @@ import {
   type ModelCallRecord,
 } from "@dspack-studio/composer-core";
 import {
+  actionManifest,
   budgetedInner,
   buildProvenanceEntry,
   createBudget,
@@ -52,6 +54,7 @@ import {
   scriptedBlockScript,
   selectBlockDeterministic,
   withBlockChoice,
+  type ActionManifest,
   type BlockDefinition,
   type BlockPhaseDeps,
   type BlockSeed,
@@ -62,11 +65,13 @@ import {
   type ErrorKind,
   type IneligibleReason,
   type LoadedBlocks,
+  type ManifestReference,
   type StructuralAdapter,
   type SwitchReason,
 } from "@dspack-studio/composer-core/blocks";
 import type { BuildRunInput } from "../app/agent-client";
 import { loadBlockProvenance, saveBlockProvenance } from "../app/block-provenance";
+import type { CatalogBundle } from "../app/catalog-export";
 import { REFERENCES } from "../app/demo-data";
 import { GatewayError, gatewayAdapter, recordedScripted, runGatewayRequest, scriptedRunAdapter } from "../app/hosted-build";
 import astryxSidecar from "./blocks/astryx.blocks.json";
@@ -499,6 +504,40 @@ export function exportProvenance(store: ProvenanceStore): Record<string, unknown
   return store.load();
 }
 
+// ---------------------------------------------------------------------------
+// The beta's Catalog export: the per-surface action manifest (§7, H2).
+
+/** Every packaged reference, as loaded (B0 and H1 applied), with the base contract and profile its surfaces emit under. */
+async function manifestReferences(): Promise<ManifestReference[]> {
+  return Promise.all(
+    Object.keys(SIDECARS).map(async (referenceId) => ({
+      loaded: await loadedFor(referenceId),
+      contract: REFERENCES[referenceId]!.contract as Json,
+      profile: baseProfile(referenceId).parsed,
+    })),
+  );
+}
+
+/**
+ * The Catalog export with its action manifest, placed before exportedAt;
+ * everything else in the bundle is untouched. A surface binds a block only
+ * when it verifiably is that block's expansion (composer-core actionManifest),
+ * whatever the switch says now: the manifest states what a surface is, and a
+ * host decides what to grant.
+ */
+export async function withActionManifest(
+  bundle: CatalogBundle,
+  input: {
+    surfaces: ReadonlyArray<{ name: string; messages?: unknown[] }>;
+    examples: ReadonlyArray<{ id?: unknown; surface?: unknown }>;
+    provenance: Record<string, unknown>;
+  },
+): Promise<Omit<CatalogBundle, "exportedAt"> & { actionManifest: ActionManifest; exportedAt: string }> {
+  const manifest = await actionManifest({ ...input, references: await manifestReferences() });
+  const { exportedAt, ...rest } = bundle;
+  return { ...rest, actionManifest: manifest, exportedAt };
+}
+
 // ---------------------------------------------------------------------------
 // Status for Settings.
 
diff --git a/apps/composer/lib/blocks-ratchet.test.mjs b/apps/composer/lib/blocks-ratchet.test.mjs
index 6523a3f..d69794e 100644
--- a/apps/composer/lib/blocks-ratchet.test.mjs
+++ b/apps/composer/lib/blocks-ratchet.test.mjs
@@ -8,18 +8,23 @@
  *   2. that surface, played through the REAL runPipeline under the reference
  *      profile exactly as hosted-build.ts runs it, passes at attempt 0 with no
  *      representability refusal and every A-gate green on A2UI 0.9.1 and 1.0;
- *   3. the emitted action names are a subset of the block's declared actions;
+ *   3. the emitted action names are a subset of the block's declared actions,
+ *      and every action carries an empty context, so no credential or entered
+ *      value can ride along (docs/blocks/HOST-ACTIONS.md);
  *   4. boundary calls (minimum and maximum items, optional props omitted and
  *      present) satisfy B1 and B2 and survive the same pipeline;
  *   5. the sidecar binds to the packaged base (its baseSha256 equals the
- *      current digest), and a corrupted template or a B0 drift fails closed.
+ *      current digest), and a corrupted template or a B0 drift fails closed;
+ *   6. H1: the names each template can emit equal its declared actions.
  */
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
-import { loadProfile } from "@aestheticfunction/dspack-emit";
+import { emitSurface, loadProfile } from "@aestheticfunction/dspack-emit";
 import { runPipeline, ScriptedAdapter } from "@aestheticfunction/dspack-gen/browser";
 import {
+  actionComponents,
+  actionEvents,
   checkActions,
   checkConstraints,
   emitCheck,
@@ -28,6 +33,7 @@ import {
   parseBlocksSidecar,
   rootScope,
   specAtPath,
+  templateActionNames,
   validateCall,
 } from "@dspack-studio/composer-core/blocks";
 
@@ -70,6 +76,18 @@ async function pipelinePasses(surface, contract, profile, intent) {
   };
 }
 
+/**
+ * Every action the surface dispatches is declared and carries an empty
+ * context: auth-form's credentials and entered values never enter one.
+ */
+function expectEmptyContexts(block, surface, contract, profile) {
+  const events = actionEvents(emitSurface(surface, contract, { profile }).messages);
+  for (const event of events) {
+    expect(block.actions).toContain(event.name);
+    expect(event.context).toEqual({});
+  }
+}
+
 /** A string at a prop's minimum or maximum length, read from the signature. */
 function str(block, path, bound) {
   const spec = specAtPath(rootScope(block), path, true);
@@ -156,6 +174,11 @@ for (const [ref, paths] of Object.entries(REFERENCES)) {
       expect(loaded.binding).toBe("ok");
       expect(loaded.disabled).toEqual([]);
       expect(loaded.usable.length).toBe(sidecar.blocks.length);
+      for (const block of sidecar.blocks) {
+        const proven = templateActionNames(block, actionComponents(profile));
+        expect(proven.issues, block.id).toEqual([]);
+        expect(proven.names, block.id).toEqual([...block.actions].sort());
+      }
     });
 
     for (const block of sidecar.blocks) {
@@ -168,6 +191,7 @@ for (const [ref, paths] of Object.entries(REFERENCES)) {
           const emitted = emitCheck(expanded.surface, contract, profile);
           if (!emitted.ok) throw new Error(emitted.refusal);
           expect(checkActions(block, emitted.actions)).toEqual([]);
+          expectEmptyContexts(block, expanded.surface, contract, profile);
 
           const run = await pipelinePasses(expanded.surface, contract, profile, example.intent);
           expect(run).toEqual({ outcome: "passed", attempts: 1, representability: undefined, versions: ["0.9.1", "1.0"], failedGates: [] });
@@ -186,6 +210,7 @@ for (const [ref, paths] of Object.entries(REFERENCES)) {
           const emitted = emitCheck(expanded.surface, contract, profile);
           if (!emitted.ok) throw new Error(emitted.refusal);
           expect(checkActions(block, emitted.actions)).toEqual([]);
+          expectEmptyContexts(block, expanded.surface, contract, profile);
           const run = await pipelinePasses(expanded.surface, contract, profile, intent);
           expect(run).toEqual({ outcome: "passed", attempts: 1, representability: undefined, versions: ["0.9.1", "1.0"], failedGates: [] });
         });
diff --git a/docs/BLOCKS.md b/docs/BLOCKS.md
index a91f0ec..548502a 100644
--- a/docs/BLOCKS.md
+++ b/docs/BLOCKS.md
@@ -3,7 +3,7 @@
 **Status: Phase 1B complete; Phase 2 under way. The beta's delivery path, guards and switches are built; no beta is deployed.**
 - **What is built.** Phases 0, 0.5 and 1A landed in aestheticfunction/dspack-studio#88. Blocks exist only in a private experimental build. The default build, the one that deploys, carries no block code, and its requests are unchanged (the byte-identity oracle checks them). What the deployed composer did gain is usage accounting: per-turn receipts, and Worker replies that report each provider call (#88, with later Worker changes in #98 and #101).
 - **What Phase 1B measured** on the hosted model: Astryx **pass, clear**; shadcn/ui v3 **pass, uncertain**. The record is [blocks/PHASE-1B-MILESTONE-REPORT.md](blocks/PHASE-1B-MILESTONE-REPORT.md).
-- **What follows.** The owner selected Phase 2 branch C, an Astryx-only experimental beta, and deferred shadcn/ui v3 Stage 4 ([blocks/PHASE-2-DECISION-RECORD.md](blocks/PHASE-2-DECISION-RECORD.md)). The release plan's step 2, the beta's delivery path, guards and switches, is built ("The beta (Phase 2)", below); the first beta deploy waits on the later steps and the owner's prerequisites ([deployment.md](deployment.md), "The beta composer").
+- **What follows.** The owner selected Phase 2 branch C, an Astryx-only experimental beta, and deferred shadcn/ui v3 Stage 4 ([blocks/PHASE-2-DECISION-RECORD.md](blocks/PHASE-2-DECISION-RECORD.md)). The release plan's step 2, the beta's delivery path, guards and switches, is built ("The beta (Phase 2)", below), and so is step 3, the host-action foundation ([blocks/HOST-ACTIONS.md](blocks/HOST-ACTIONS.md)); the first beta deploy waits on the later steps and the owner's prerequisites ([deployment.md](deployment.md), "The beta composer").
 
 The block format is an RFC that is not proposed upstream. The owner approved the three block definitions on each reference, and the frozen Phase 1B corpus, on 2026-10-11; their wording, templates, keywords and action names are owner-authored governance. The format specification is [blocks/RFC-dspack-blocks.md](blocks/RFC-dspack-blocks.md). The measurements are in [packages/block-bench/RESULTS.md](../packages/block-bench/RESULTS.md).
 
@@ -188,6 +188,11 @@ Two rules apply in every experimental build. A block is offered only when it and
 
 **Byte identity.** With blocks off, or on a reference the switch does not list, the beta posts today's planning and generation bytes: `e2e/composer-beta.spec.ts` hashes them against `packages/block-bench/results.json`. Production's `/api/models` reply is pinned byte for byte by `apps/composer/worker/blocks-beta.test.mjs`.
 
+**Host actions (step 3; [blocks/PHASE-2-RELEASE-PLAN.md](blocks/PHASE-2-RELEASE-PLAN.md), §7).** Composer still executes no action.
+- **H1.** B0 now covers action names. Every node the profile gives an action carries an id built only from literals and enum props, and the names a template can emit must equal its declared `actions`; otherwise the block is disabled at load (`packages/composer-core/src/blocks/actions.ts`).
+- **H2.** In an experimental build, Preview's "export catalog" adds an `actionManifest` that binds each surface's actions by surface and name. Only a surface that verifiably is its block's expansion gets a block binding (`manifest.ts`; `withActionManifest` in the runtime). The default build's export is byte-identical.
+- **H4.** How a host binds and authorizes these actions is [blocks/HOST-ACTIONS.md](blocks/HOST-ACTIONS.md).
+
 ## The live evaluation (Phase 1B)
 
 The harness lives in `packages/block-bench/live/` and is run by the owner; nothing in it runs in CI except its own tests and a dry run on the scripted provider. It measures the real code paths, never a re-implementation: composer-core's block phase, budget and refinement decision; dspack-gen's `runPipeline`; the request bytes the app posts (`proposeBody`); the app's fold (`foldBuildEvents`). The hosted client is held to the app's gateway adapter by a parity test over every reply shape.
diff --git a/docs/blocks/HOST-ACTIONS.md b/docs/blocks/HOST-ACTIONS.md
new file mode 100644
index 0000000..88ac481
--- /dev/null
+++ b/docs/blocks/HOST-ACTIONS.md
@@ -0,0 +1,159 @@
+# Host actions: binding and authorizing interface-block actions
+
+> **Status.** Experimental beta (Phase 2, step 3 of [PHASE-2-RELEASE-PLAN.md](PHASE-2-RELEASE-PLAN.md), §7). This guide is for a host that renders surfaces exported from the beta. The owner reviews it before the beta ships (§12). GA stays blocked on the vocabulary and host semantics in §10.
+
+Composer composes and governs interface surfaces. It never executes an action ([../ARCHITECTURE.md](../ARCHITECTURE.md), §9). The Build canvas ignores actions. Preview records the name and may advance a flow walk. Neither sends anything anywhere. A **host** is the application that renders an exported surface and decides what each action does. Every action is the host's to bind and authorize, on its own server.
+
+## 1. Who does what
+
+| Party | Does |
+|---|---|
+| The sidecar owner | Declares each block's actions and streaming policy (`apps/composer/experimental/blocks/*.blocks.json`). |
+| Composer, at load | **H1.** Proves that every node able to dispatch an action has an id built only from literals and enum props (§2), and that the names the template can emit equal the declared actions, exactly. A block that fails is disabled. |
+| Composer, per expansion | **B2.** Holds every expansion's emitted names to the declaration. An undeclared name is an invariant failure, never repaired by a model. |
+| Composer, on export | **H2.** The beta's Catalog export carries a per-surface action manifest (§3). |
+| The host | Binds each action to an effect and authorizes every effect on its server (§4). |
+
+## 2. What a surface dispatches
+
+The emitter (dspack-emit 0.7.0) gives a node an action only where the reference profile says so. On both packaged references, that is a `button` or an `alert-dialog`. The action is `{"event": {"name": <slug of the node id>, "context": {}}}`: the id lowercased, with every run of other characters turned into `_` and any `_` at either end removed; an id with no letter or digit becomes `surface`. When a user activates it, the A2UI client reports `{name, surfaceId, sourceComponentId, timestamp, context}` to the host.
+
+Without an id, the emitter would name the action from an alert dialog's confirm label, the node's text or its component, and a model can write the first two. So H1 refuses any action node whose id is missing or depends on anything but literals and enum props. An id may be a literal, an enum prop's value, a literal that an enum or boolean prop picks through `$case`, or several of these joined with `$concat`. It may not hold a string the model fills, a position (`$index`), or an optional enum where it may be absent. The model fills content; it never names an action. Nor may a template carry an action event in another way: H1 refuses a template value shaped like one, which a passthrough prop such as Astryx's table `data` would carry into the messages verbatim, and a signature field named `event`, which a call could fill. Function calls and data bindings are a limit (§7).
+
+H1 then counts the names a call can make each id produce, at most 256 per id; an id whose props have more than 4096 combinations is refused before any is evaluated. It evaluates the id as the expander does, over every combination of the enum and boolean props it reads, along the branches each `$if` allows: a test of a prop's truthiness, or of its equality with a literal, narrows that prop, and a branch no call can take counts nothing. Those names must equal the block's declared `actions`. Where a condition or a cross-field constraint is beyond that reading, H1 counts the name anyway, so it may count a name no call reaches, but never misses one a call can emit.
+
+| Block | Action names, the same on both references | Present when | Streaming policy |
+|---|---|---|---|
+| records-table | `records_create`, `records_export`, `records_refresh` | listed in `actions` | `disable-actions-until-complete` |
+| auth-form | `auth_submit`; `auth_forgot`; `auth_provider_google`, `auth_provider_github`, `auth_provider_microsoft`, `auth_provider_apple` | always; when `recovery` is set; one per provider | `disable-actions-until-complete` |
+| guide-steps | `guide_start`, `guide_save` | listed in `actions` | `static-safe` |
+
+## 3. The action manifest
+
+**Where.** In the beta's experimental build, Preview's "export catalog" downloads the catalog, every surface's messages and an `actionManifest`. The default build's export is unchanged, byte for byte, and carries no manifest.
+
+**Shape (v1).** One entry per exported surface, in the export's order:
+
+```json
+{
+  "a2uiCatalog": { "...": "..." },
+  "surfaces": [{ "name": "ex.chat-1", "messages": ["..."] }],
+  "actionManifest": {
+    "v": 1,
+    "surfaces": [
+      {
+        "surface": "ex.chat-1",
+        "surfaceId": "data_collection",
+        "messagesSha256": "<sha256 of this surface's messages>",
+        "actions": [
+          { "name": "auth_provider_github", "declared": true },
+          { "name": "auth_submit", "declared": true }
+        ],
+        "block": {
+          "id": "auth-form",
+          "version": 1,
+          "reference": { "name": "Astryx", "dspack": "0.4", "version": "0.1.4" },
+          "baseSha256": "<the sidecar's base binding>",
+          "intent": "data-collection",
+          "expansionDigest": "<sha256 of the surface>",
+          "declaredActions": ["auth_submit", "auth_forgot", "auth_provider_google", "auth_provider_github", "auth_provider_microsoft", "auth_provider_apple"],
+          "streaming": "disable-actions-until-complete"
+        }
+      }
+    ]
+  },
+  "exportedAt": "2026-10-16T12:00:00.000Z"
+}
+```
+
+| Field | Meaning |
+|---|---|
+| `surface` | The surface's name in this export: its `surfaces[].name`, the project's example id. Look entries up by it. A surface whose name the export repeats binds nothing. |
+| `surfaceId` | The A2UI surfaceId its messages create, or `null` when they do not name exactly one. It is the slug of the surface's intent, so every exported surface of one intent shares it: never look an entry up by it. |
+| `messagesSha256` | The sha256, in lowercase hex, of the surface's `messages` exactly as exported: the messages this entry describes. How to recompute it follows this table. |
+| `actions` | Every action name its messages dispatch, sorted. `declared` is `true` only when this surface's verified block declares the name. |
+| `block` | The block this surface verifiably is, or `null`. |
+| `block.expansionDigest` | The expansion identity: sha256 of the surface's compact JSON, equal to the expansion of the stored call. |
+| `block.declaredActions` | Everything the block declares, which can include names this surface does not dispatch (a provider it does not show). What a host may authorize for this surface is its `actions` entries with `declared: true`. |
+
+**Recomputing `messagesSha256`.**
+- **The bytes.** Hash the UTF-8 bytes of the surface's `messages` serialized as `JSON.stringify` writes them: no whitespace, and non-ASCII text left as it is, unescaped.
+- **From the download.** It is pretty-printed, so parse it first. In JavaScript, `JSON.stringify(JSON.parse(file).surfaces[i].messages)` gives the bytes.
+- **In another language,** match that serializer exactly. In Python, `json.dumps(messages, separators=(",", ":"), ensure_ascii=False)` matches for ordinary text and integers; the default, which escapes non-ASCII text, does not.
+- **When.** Check the hash before you render the messages under a surfaceId of your own (§4, rule 2): substituting it changes the bytes.
+
+**How a surface earns a block binding.** The manifest is recomputed from the surface's messages at every export, so an edited surface reports what it dispatches now. A surface binds a block only when all of these hold:
+- Its provenance names an approved block of an approved sidecar that the build bundles, and B0 (with H1) accepted that block at load.
+- The stored call passes B1 and the block's constraints.
+- Re-expanded, the call gives exactly the stored surface.
+- That expansion's emission is exactly the exported messages.
+- Every action in those messages is declared by the block and carries an empty context.
+- The export holds no other surface of the same name, and the messages name exactly one surfaceId.
+
+**What gets no binding.** Anything else gets `block: null`, with every action `declared: false`. That covers a primitive surface whose node id happens to slug to a block's name, a surface edited after it was accepted, and provenance that does not re-expand to the surface, however it got there. An export without an `actionManifest` binds nothing: a default build's, or a beta export whose manifest could not be built.
+
+**What the manifest is not.** It is not a grant. It states what each exported surface dispatches and which block it verifiably is, as of the export, and a binding certifies structure, not who wrote the copy. A host still authorizes every effect itself (§4). The manifest is not signed: treat an export as configuration you reviewed, never as input that arrives at runtime.
+
+## 4. Authorizing an action
+
+1. **Names are not capabilities.** A surface id plus an action name grants nothing. Another surface can dispatch the same name: a primitive surface whose button id is `auth-submit` also dispatches `auth_submit`.
+2. **A block action needs both.** Authorize a block action only when:
+   - the surface's block identity verifies: the surface still equals its block's expansion, under a sidecar you trust; and
+   - the action is declared for that surface in the manifest you reviewed.
+
+   "Declared for that surface" means listed in that surface's entry, in its `actions`, with `declared: true`: never the block's whole `declaredActions`. Deny everything else.
+
+   Bind actions by the surface you rendered, not by what the client reports. Look an entry up by `surface`, never by `surfaceId`, which surfaces of one intent share. Check the surface's messages, exactly as exported, against the entry's `messagesSha256` (§3), and render nothing that does not match. Then render them under a surfaceId of your own, and keep on your server which entry it is. Every field of an action event (`name`, `surfaceId`, `sourceComponentId`, `context`) is client-supplied and untrusted.
+3. **Authorize on the server, per effect.** An action event is a request, never a grant. For each effect, check the session, the user's permission for that effect and the resource it touches, on your own server. Never trust a client-side check, the manifest or the presence of a button.
+4. **Make effects idempotent.** Replays and double submits happen: retries, double clicks, a client that resends. A2UI action events carry no idempotency key of their own, and anything a client sends can be replayed or forged, so the key is your server's. It must stay the same for a retry and change for each new operation: a key made only of the session, the effect and its target would answer a second, intended save with the first one's result. So key each effect by an operation id your server issued, bound to the session, the effect, its target and its parameters. The surfaceId you render a surface under (rule 2) can serve: issue a fresh one each time an action should be possible again, and treat a repeat under the same one as a retry. Keep the store bounded, and answer a repeat with the first result. The exhibit's agent shows that shape for honest retries only: it keeps the answer for each client-chosen `actionId` and returns it again for a repeat (`answeredActions` in `apps/agent/src/server.ts`). A host must not trust a key the client chose. Rate-limit what can be repeated.
+5. **Honour the streaming policy.** For `disable-actions-until-complete`, keep the block's actions disabled in the client, and refuse them on the server, until the surface's message stream has completed. For `static-safe`, they may be enabled once rendered. A host that cannot tell when a stream completes treats every block as `disable-actions-until-complete`.
+6. **Treat model content as untrusted data.** Every string in a call can be model-written: titles, captions, descriptions, column headings, cells, steps, items and their heading, meta labels and details, summaries and intro text.
+   - Render them as text: never as HTML or markdown, never as a link or URL.
+   - Never evaluate them, and never use them as identifiers or as input to an authorization decision.
+   - Never pass them to a model as instructions.
+
+   B1 bounds their length and S3 checks them, but a person should still review copy before it ships: misleading copy is possible within the bounds.
+7. **auth-form: credentials and entered values never enter action context.**
+   - The call has no slot for an entered value, a default, a credential or runtime state (B1). Labels and input types are template literals chosen by enum. Only `title` and `intro` are model text, capped at 80 and 200 characters.
+   - Every action it emits carries `context: {}`. Tests pin this for every example and for the largest call on both references. The manifest refuses to bind a block action whose context is not empty.
+   - Its fields carry no data-model binding, so the A2UI client has nothing to sync when an action fires. Typed text stays in the page.
+   - Submit credentials from your own form state straight to your own auth endpoint, in your own request. Never put them in an action context, in a data model relayed to an agent or a model, in a log or in a URL, and never add a binding that would sync them.
+   - Provider buttons start your own OAuth flow. Composer holds no client ids or secrets.
+8. **Provenance is a claim, and a binding certifies structure, not authorship.** An import keeps only the provenance the bundled sidecars can vouch for, and the manifest still re-expands it. An entry binds only when its call re-expands to exactly the surface and the exported messages, so provenance that does not describe the surface binds nothing, and so grants nothing. A hand-written entry that does describe a genuine expansion binds like any other: it certifies what the surface is, never who wrote its copy (rule 6). Imported projects are never offered blocks.
+
+## 5. Threat cases
+
+| Threat | Control |
+|---|---|
+| The model coins an action | No action slot in any call; H1 at load requires action ids built only from literals and enum props, equal to the declaration; B2 makes an undeclared emitted name an invariant failure. |
+| Another surface emits a block's name | Names are not capabilities: the manifest marks it `declared: false` with no block, and the host grants nothing without verified block identity and the manifest. |
+| An accepted surface is edited to add a button | The manifest is recomputed from the messages at export: the edited surface has no block binding and its new action is listed undeclared. Provenance for it is pruned on save. |
+| Forged `blockProvenance` in an imported file | Import keeps only what the bundled sidecars vouch for; the manifest re-expands the call, so provenance that does not describe the surface binds nothing. |
+| An action event smuggled through a passthrough prop | H1 refuses template values shaped like an action event, and signature fields named `event`, at load; B2 checks every expansion. |
+| A template writes an A2UI function call or data binding | Not refused by H1. On both packaged references, none reaches a property the client evaluates (§7). |
+| Messages altered after export | Each entry's `messagesSha256`; host rule 2 renders only matching messages. |
+| A host looks an entry up by `surfaceId` | `surfaceId` is shared by surfaces of one intent; host rule 2 looks entries up by `surface` and renders under a surfaceId of its own. |
+| A host relays entered values to an agent or a model | Actions carry an empty context (tested), fields carry no binding, and the manifest refuses a non-empty context; host rule 7. |
+| Misleading copy in `title` or `intro` | B1 length bounds, S3 rules and a person accepting the surface; host rule 6. |
+| Actions enabled while the surface streams | The manifest exports each block's policy; host rule 5. |
+| Replay or double submit | Host rule 4: idempotency keys built from operation ids your server issued, and rate limits. |
+
+## 6. Where these properties are tested
+
+| Property | Tests |
+|---|---|
+| H1: bounded action ids, names equal to the declaration, failures disable the block at load | `packages/composer-core/src/blocks/actions.test.ts`; `apps/composer/lib/blocks-ratchet.test.mjs` |
+| Emitted names within the declaration, every context empty, auth-form included | `actions.test.ts`; the ratchet, over every example and boundary call on both references |
+| The manifest: binding by surface and name, forged provenance, edited surfaces, undeclared actions and contexts failing closed, `messagesSha256` | `packages/composer-core/src/blocks/manifest.test.ts`; `manifest-context.test.ts`, which makes the emitter write a context so that only the guard can refuse it; `apps/composer/experimental/blocks-runtime.test.ts` |
+| The default Catalog export is byte-identical | `apps/composer/app/catalog-export.test.ts`; `e2e/composer-prod-smoke.spec.ts` |
+| The beta's export carries the manifest, end to end | `e2e/composer-blocks.spec.ts` |
+
+## 7. Limits
+
+- **One emitter path.** H1's proof covers the emitter's one source of action events in dspack-emit 0.7.0, the synthesized action. An emitter upgrade re-runs these tests before it lands, and B2 still checks every expansion.
+- **Composer's side only.** The manifest says what a surface dispatches. Whether an effect is allowed is decided by the host, on its server.
+- **Other A2UI constructs.** H1 refuses an action event, the only kind of action the emitter writes, in a template's props and text, and it refuses a call field named `event`. It does not look in template values for A2UI function calls (`{"call": …}`) or data bindings (`{"path": …}`), nor at a node id that is an object.
+  - On both packaged references, none of these reaches a property the client evaluates. A node id that is an object never reaches the messages. Where a template could write a function call, S1 or S3 refuses it, or the property holds static data.
+  - A reference whose catalog would let a template write a property the client evaluates needs H1 to refuse these as well.
+- **The packaged reference's emission.** The manifest re-emits each expansion under the packaged reference's own contract and profile. A project edit that changes the emitted messages leaves its block surfaces bound to nothing. An edit to the profile can do that, and so can an edit to a design token the profile writes into them (on shadcn/ui, `color.primary`).
+- **Later Phase 2 steps.** Composer has no host handlers. The Blocks catalog and provenance UI, and the Preview label "host-owned, not executed here", are step 4 (H3).
diff --git a/docs/blocks/PHASE-2-RELEASE-PLAN.md b/docs/blocks/PHASE-2-RELEASE-PLAN.md
index d9f2218..8148bde 100644
--- a/docs/blocks/PHASE-2-RELEASE-PLAN.md
+++ b/docs/blocks/PHASE-2-RELEASE-PLAN.md
@@ -4,6 +4,7 @@
 > - On 2026-10-16 the owner accepted the shadcn/ui v3 result as valid (pass, uncertain), selected **branch C**, and answered §13's decisions 1 to 4, 6, 13 and 14 (5 does not arise under branch C). The answers are in [PHASE-2-DECISION-RECORD.md](PHASE-2-DECISION-RECORD.md).
 > - G1 has landed: the records on main that §3 lists. So the plan's statements about what main holds describe `7e260c3`, before G1. For example, `docs/blocks/baseline.json` is now committed ([BASELINE.md](BASELINE.md)).
 > - The owner authorized step 2 on 2026-10-16, and it is built: the beta's delivery path, guards and switches ([../BLOCKS.md](../BLOCKS.md), "The beta (Phase 2)"; [../deployment.md](../deployment.md), "The beta composer"). No beta is deployed. Each later Phase 2 change still needs the owner's authorization.
+> - The owner authorized step 3 on 2026-10-16, limited to H1, H2 and H4 (§7), and it is built: the B0 action-id proof, the action manifest in the beta's Catalog export, and the host guide ([HOST-ACTIONS.md](HOST-ACTIONS.md)). The Catalog export that §7 locates at `exportBundle` in `preview-view.tsx` is now built by `catalogBundle` in `apps/composer/app/catalog-export.ts`. The manifest reads each surface's actions with `actionEvents` (`packages/composer-core/src/blocks/actions.ts`), which also reads each context, rather than `emittedActionNames`. H3, the Blocks catalog view and Preview's label, belongs to step 4.
 
 Final version, 2026-10-16. The owner accepted the plan on 2026-10-15 as the conditional working plan for the next AF Composer release, and this version carries the owner's three clarifications (below) and the shadcn/ui v3 result. It is not authorization to begin Phase 2: nothing in it starts until the owner authorizes it. No code.
 
diff --git a/e2e/composer-blocks.spec.ts b/e2e/composer-blocks.spec.ts
index bee6343..7a96ce7 100644
--- a/e2e/composer-blocks.spec.ts
+++ b/e2e/composer-blocks.spec.ts
@@ -118,6 +118,69 @@ test("scripted: a sign-in goal on shadcn expands auth-form at attempt 0, passes,
   await expect(row).toContainText(String(entry.expansionDigest).slice(0, 12));
 });
 
+test("the beta's Catalog export carries the action manifest: the accepted auth-form surface binds its actions by surface and name, and nothing else binds", async ({ page }) => {
+  await preferenceOn(page);
+  await scriptedSwitchOn(page);
+  await page.goto("/");
+  await newProject(page, "Blocks export");
+  await page.getByTestId("build-model").selectOption("scripted");
+  await page.getByTestId("build-intent").selectOption("structured-input");
+  await page.getByTestId("build-prompt").fill("a sign-in form with email and password");
+  await page.getByTestId("build-run").click();
+  await expect(page.getByTestId("build-block-1")).toContainText("expanded", { timeout: 30_000 });
+  await page.getByTestId("build-accept-1").click();
+  await expect(page.getByTestId("build-accepted-1")).toContainText(/ex\.chat-\d+/);
+  const accepted = ((await page.getByTestId("build-accepted-1").textContent()) ?? "").match(/ex\.chat-\d+/)![0];
+  // Provenance is written after the accept, off the click's path.
+  await expect
+    .poll(() => page.evaluate(() => Object.keys(localStorage).filter((k) => k.startsWith("composer.project.blocks.")).length))
+    .toBe(1);
+
+  await page.getByTestId("nav-preview").click();
+  const [download] = await Promise.all([page.waitForEvent("download"), page.getByTestId("export-catalog").click()]);
+  const fs = await import("node:fs/promises");
+  const bundle = JSON.parse(await fs.readFile((await download.path())!, "utf8")) as Json;
+  expect(Object.keys(bundle)).toEqual(["a2uiCatalog", "surfaces", "actionManifest", "exportedAt"]);
+
+  const manifest = bundle.actionManifest as Json;
+  expect(manifest.v).toBe(1);
+  expect(manifest.surfaces.map((s: Json) => s.surface)).toEqual(bundle.surfaces.map((s: Json) => s.name));
+  const auth = (sidecar.blocks as Json[]).find((b) => b.id === "auth-form")!;
+  const mine = manifest.surfaces.find((s: Json) => s.surface === accepted);
+  expect(mine.surfaceId).toBe("structured_input");
+  expect(mine.block).toMatchObject({ id: "auth-form", version: 1, intent: "structured-input", declaredActions: auth.actions, streaming: "disable-actions-until-complete" });
+  expect(mine.block.expansionDigest).toMatch(/^[0-9a-f]{64}$/);
+  // Each entry pins the exact messages it describes.
+  const { createHash } = await import("node:crypto");
+  for (const surface of bundle.surfaces as Json[]) {
+    const entry = manifest.surfaces.find((s: Json) => s.surface === surface.name);
+    expect(entry.messagesSha256).toBe(createHash("sha256").update(JSON.stringify(surface.messages)).digest("hex"));
+  }
+  expect(mine.actions.map((a: Json) => a.name)).toContain("auth_submit");
+  for (const action of mine.actions) {
+    expect(action.declared).toBe(true);
+    expect(auth.actions).toContain(action.name);
+  }
+  // The reference's own surfaces were never block expansions: names alone grant nothing.
+  for (const other of manifest.surfaces.filter((s: Json) => s.surface !== accepted)) {
+    expect(other.block).toBeNull();
+    for (const action of other.actions) expect(action.declared).toBe(false);
+  }
+  // auth-form's actions carry no entered value: every context in what a host renders is empty.
+  const events: Json[] = [];
+  const walk = (value: unknown): void => {
+    if (Array.isArray(value)) value.forEach(walk);
+    else if (value && typeof value === "object") {
+      const event = (value as Json).event;
+      if (event && typeof event === "object") events.push(event as Json);
+      Object.values(value as Json).forEach(walk);
+    }
+  };
+  walk(bundle.surfaces.find((s: Json) => s.name === accepted).messages);
+  expect(events.length).toBeGreaterThan(0);
+  for (const event of events) expect(event.context).toEqual({});
+});
+
 test("scripted: a refinement whose prior turn has no trace stays a refinement; it never restarts as a fresh block build", async ({ page }) => {
   // T1 expands a block. T2 refines with the preference OFF (today's path, no
   // trace). T3 refines again with the preference back ON: its plan inherits
diff --git a/e2e/composer-prod-smoke.spec.ts b/e2e/composer-prod-smoke.spec.ts
index 75084e0..98b3082 100644
--- a/e2e/composer-prod-smoke.spec.ts
+++ b/e2e/composer-prod-smoke.spec.ts
@@ -651,6 +651,30 @@ test("a seeded experimental preference changes nothing in the default build: no
   expect(planBodies[0]).not.toHaveProperty("maxCalls");
 });
 
+test("the Catalog export is today's: the catalog and each surface's messages, and no action manifest, even with the experimental preference seeded", async ({ page }) => {
+  // The action manifest is the beta's alone (docs/blocks/HOST-ACTIONS.md);
+  // app/catalog-export.test.ts holds these bytes to the export before it.
+  await page.addInitScript(() => {
+    localStorage.setItem("composer.experimental.v1", JSON.stringify({ blocks: true }));
+  });
+  await page.goto("/");
+  await newProject(page, "shadcn", "Catalog export");
+  await scriptedBuild(page, "destructive-action", "let people permanently delete their account");
+  await page.getByTestId("build-accept-1").click();
+  await expect(page.getByTestId("build-accepted-1")).toContainText(/ex\.chat-\d+/);
+  await page.getByTestId("nav-preview").click();
+  const [download] = await Promise.all([page.waitForEvent("download"), page.getByTestId("export-catalog").click()]);
+  expect(download.suggestedFilename()).toMatch(/-catalog\.json$/);
+  const fs = await import("node:fs/promises");
+  const text = await fs.readFile((await download.path())!, "utf8");
+  const bundle = JSON.parse(text) as Record<string, any>;
+  expect(Object.keys(bundle)).toEqual(["a2uiCatalog", "surfaces", "exportedAt"]);
+  expect(bundle.surfaces.length).toBeGreaterThan(1);
+  for (const surface of bundle.surfaces) expect(Object.keys(surface)).toEqual(["name", "messages"]);
+  expect(text).not.toContain("actionManifest");
+  expect(text).toBe(JSON.stringify(bundle, null, 2));
+});
+
 test("the default build ships no interface-block code (docs/BLOCKS.md: blocks stay out of default builds)", () => {
   // Scans the served artifact on disk, so a lazily loaded chunk cannot hide it.
   const chunks = fileURLToPath(new URL("../apps/composer/out/_next/static/chunks/", import.meta.url));
@@ -665,7 +689,8 @@ test("the default build ships no interface-block code (docs/BLOCKS.md: blocks st
   expect(files.length).toBeGreaterThan(0);
   for (const file of files) {
     const body = readFileSync(file, "utf8");
-    for (const marker of ["blocksSidecar", "disable-actions-until-complete", "records-table", "auth-form", "guide-steps", "blocks-runtime", "reference-not-in-beta", "beta-switch-"]) {
+    // actionManifest: the beta's Catalog export key (docs/blocks/HOST-ACTIONS.md).
+    for (const marker of ["blocksSidecar", "disable-actions-until-complete", "records-table", "auth-form", "guide-steps", "blocks-runtime", "reference-not-in-beta", "beta-switch-", "actionManifest"]) {
       expect(body.includes(marker), `${file} contains ${marker}`).toBe(false);
     }
   }
diff --git a/packages/composer-core/src/blocks/actions.test.ts b/packages/composer-core/src/blocks/actions.test.ts
new file mode 100644
index 0000000..b46dead
--- /dev/null
+++ b/packages/composer-core/src/blocks/actions.test.ts
@@ -0,0 +1,472 @@
+/**
+ * Host actions, H1 (docs/blocks/HOST-ACTIONS.md; docs/blocks/PHASE-2-RELEASE-PLAN.md,
+ * §7): B0 proves the action allowlist at load. Every node the profile gives
+ * an action carries an id built only from literals and enum props, so the
+ * model can never coin an action name, and the names a template can emit
+ * equal the block's declared `actions`, exactly. A block that fails either
+ * rule is disabled at load, like any other B0 failure.
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { emitSurface, loadProfile, type Profile } from "@aestheticfunction/dspack-emit";
+import {
+  actionComponents,
+  actionEvents,
+  b0Issues,
+  checkConstraints,
+  emitCheck,
+  expandBlock,
+  generationView,
+  loadBlocks,
+  parseBlocksSidecar,
+  templateActionNames,
+  validateCall,
+  type BlockDefinition,
+  type BlocksSidecar,
+} from "./index";
+
+type Json = Record<string, any>;
+const repo = (rel: string) => fileURLToPath(new URL(`../../../../${rel}`, import.meta.url));
+const json = (rel: string) => JSON.parse(readFileSync(repo(rel), "utf8")) as Json;
+
+const REFS = {
+  "shadcn-v3": {
+    sidecar: "apps/composer/experimental/blocks/shadcn-v3.blocks.json",
+    contract: "apps/composer/shadcn-v3-project/shadcn-ui.dspack.json",
+    profile: "apps/composer/shadcn-v3-project/shadcn-v3.profile.json",
+  },
+  astryx: {
+    sidecar: "apps/composer/experimental/blocks/astryx.blocks.json",
+    contract: "apps/composer/astryx-project/astryx.dspack.json",
+    profile: "apps/composer/astryx-project/astryx.profile.json",
+  },
+} as const;
+type Ref = keyof typeof REFS;
+const REF_IDS = Object.keys(REFS) as Ref[];
+
+const inputs = (ref: Ref) => ({
+  sidecar: json(REFS[ref].sidecar),
+  contract: json(REFS[ref].contract),
+  profile: loadProfile(json(REFS[ref].profile) as never) as Profile,
+});
+
+function parsed(raw: Json): BlocksSidecar {
+  const result = parseBlocksSidecar(raw);
+  if (!result.ok) throw new Error(JSON.stringify(result.issues));
+  return result.sidecar;
+}
+
+const blockOf = (ref: Ref, id: string): BlockDefinition => parsed(inputs(ref).sidecar).blocks.find((b) => b.id === id)!;
+
+/** The §7 table: the names each block can dispatch, the same on both references. */
+const TABLE: Record<string, string[]> = {
+  "records-table": ["records_create", "records_export", "records_refresh"],
+  "auth-form": ["auth_forgot", "auth_provider_apple", "auth_provider_github", "auth_provider_google", "auth_provider_microsoft", "auth_submit"],
+  "guide-steps": ["guide_save", "guide_start"],
+};
+
+const surfaceOf = (contract: Json, intent: string, root: Json) => ({ dspackSurface: "0.1", system: contract.name, intent, root });
+
+describe("actionComponents: the nodes the emitter gives an action, read from the profile", () => {
+  it("Astryx (profile language v1) and shadcn/ui v3 (v2): buttons and alert dialogs", () => {
+    expect([...actionComponents(inputs("astryx").profile)].sort()).toEqual(["alert-dialog", "button"]);
+    expect([...actionComponents(inputs("shadcn-v3").profile)].sort()).toEqual(["alert-dialog", "button"]);
+  });
+
+  it("with no profile, the emitter's own default, as emitSurface falls back to it", () => {
+    expect([...actionComponents()].sort()).toEqual(["alert-dialog", "button"]);
+  });
+
+  it("the generation view carries them, so B0 holds every template to them", () => {
+    for (const ref of REF_IDS) {
+      const { contract, profile } = inputs(ref);
+      expect(generationView(contract, profile).actionComponents).toEqual(actionComponents(profile));
+    }
+  });
+
+  it("the hazard H1 closes: an action node without an id is named from its text, which a model may write", () => {
+    const { contract, profile } = inputs("shadcn-v3");
+    const card = (button: Json) => ({ component: "card", id: "c", children: [{ component: "card-content", id: "cc", children: [button] }] });
+    const named = emitCheck(surfaceOf(contract, "structured-input", card({ component: "button", id: "auth-submit", text: "Sign in" })), contract, profile);
+    const unnamed = emitCheck(surfaceOf(contract, "structured-input", card({ component: "button", text: "Delete everything" })), contract, profile);
+    expect(named).toEqual({ ok: true, actions: ["auth_submit"] });
+    expect(unnamed).toEqual({ ok: true, actions: ["delete_everything"] });
+  });
+});
+
+describe("H1 at load: an action id is built only from literals and enum props", () => {
+  const view = (ref: Ref) => generationView(inputs(ref).contract, inputs(ref).profile);
+  /** auth-form on Astryx with its template replaced and, when given, its actions and props. */
+  const auth = (template: Json, overrides: Partial<BlockDefinition> = {}): BlockDefinition => ({ ...blockOf("astryx", "auth-form"), template: template as never, ...overrides });
+  const card = (...children: Json[]) => ({ component: "card", id: "auth-card", children });
+  const submit = (id: unknown) => ({ component: "button", id, props: { label: "Go", variant: "primary" } });
+  const issues = (block: BlockDefinition) => b0Issues(block, view("astryx")).join("\n");
+
+  it("a button whose id is a string the model fills: the model would coin its action", () => {
+    expect(issues(auth(card(submit({ $prop: "title" })), { actions: ["auth_submit"] }))).toMatch(/'title' is a string the model fills/);
+  });
+
+  it("a button with no id: the emitter would name its action from its text or its component", () => {
+    expect(issues(auth(card({ component: "button", props: { label: "Go", variant: "primary" } }), { actions: ["auth_submit"] }))).toMatch(
+      /'button' dispatches an action, so it needs an id/,
+    );
+  });
+
+  it("a $concat with a part the model fills", () => {
+    expect(issues(auth(card(submit({ $concat: ["auth-", { $prop: "title" }] })), { actions: ["auth_submit"] }))).toMatch(/'title' is a string the model fills/);
+  });
+
+  it("an id from a position ($index): a count, not a literal or an enum", () => {
+    const template = card({ $each: "fields", as: "field", children: [submit({ $concat: ["auth-", { $index: "field" }] })] });
+    expect(issues(auth(template, { actions: ["auth_1"] }))).toMatch(/\$index/);
+  });
+
+  it("an id that is not a string", () => {
+    expect(issues(auth(card(submit(7)), { actions: ["auth_submit"] }))).toMatch(/not a string/);
+  });
+
+  it("an optional enum prop with no default: the id could be missing, and the name with it", () => {
+    const props = [...blockOf("astryx", "auth-form").props, { name: "variant", type: "enum" as const, values: ["submit", "next"] }];
+    expect(issues(auth(card(submit({ $concat: ["auth-", { $prop: "variant" }] })), { props, actions: ["auth_next", "auth_submit"] }))).toMatch(/'variant' may be absent/);
+    // A default makes it total: every call names an action the template declares.
+    expect(issues(auth(card(submit({ $concat: ["auth-", { $prop: "variant", default: "submit" }] })), { props, actions: ["auth_next", "auth_submit"] }))).toBe("");
+  });
+
+  it("a $case over an enum, onto literal ids, is bounded, and each result is a name", () => {
+    const id = { $case: "mode", map: { "sign-in": "auth-sign-in", "sign-up": "auth-sign-up", reset: "auth-reset" } };
+    expect(issues(auth(card(submit(id)), { actions: ["auth_reset", "auth_sign_in", "auth_sign_up"] }))).toBe("");
+    expect(templateActionNames(auth(card(submit(id))), view("astryx").actionComponents).names).toEqual(["auth_reset", "auth_sign_in", "auth_sign_up"]);
+  });
+
+  it("the names must equal the declaration: a name the template can emit but does not declare fails at load", () => {
+    const block = blockOf("astryx", "auth-form");
+    expect(issues({ ...block, actions: block.actions.filter((a) => a !== "auth_forgot") })).toMatch(/can emit 'auth_forgot', which is not declared/);
+  });
+
+  it("and a declared name that no node can emit fails at load", () => {
+    const block = blockOf("astryx", "auth-form");
+    expect(issues({ ...block, actions: [...block.actions, "auth_logout"] })).toMatch(/'auth_logout' is declared, but no node of the template can emit it/);
+  });
+
+  it("a name declared twice", () => {
+    const block = blockOf("astryx", "auth-form");
+    expect(issues({ ...block, actions: [...block.actions, "auth_submit"] })).toMatch(/'auth_submit' is declared more than once/);
+  });
+
+  it("an id whose combinations would make an unbounded list of names", () => {
+    const props = [
+      ...blockOf("astryx", "auth-form").props,
+      ...["a", "b", "c"].map((name) => ({ name, required: true, type: "enum" as const, values: Array.from({ length: 10 }, (_, i) => `${name}${i}`) })),
+    ];
+    // 10 × 10 × 10 ids: past the cap, a declaration could not be read or reviewed.
+    const id = { $concat: ["auth-", { $prop: "a" }, "-", { $prop: "b" }, "-", { $prop: "c" }] };
+    expect(issues(auth(card(submit(id)), { props, actions: ["auth_submit"] }))).toMatch(/more than 256 possible names/);
+  });
+
+  it("only action nodes are held to it: a badge numbered by position stays fine", () => {
+    const template = card(submit("auth-submit"), { $each: "fields", as: "field", children: [{ component: "badge", id: { $concat: ["auth-badge-", { $index: "field" }] }, text: "x" }] });
+    expect(issues(auth(template, { actions: ["auth_submit"] }))).toBe("");
+  });
+
+  it("an alert dialog dispatches an action too, and is held to the same rule", () => {
+    const found = issues(auth(card({ component: "alert-dialog" }), { actions: ["auth_submit"] }));
+    expect(found).toMatch(/'alert-dialog' dispatches an action, so it needs an id/);
+    // The issue names everything the emitter would fall back to, a dialog's confirm label first.
+    expect(found).toMatch(/from a confirm label, the node's text or its component, and a model can write the first two/);
+  });
+});
+
+/** Every subset of a list, the empty one included. */
+const subsets = <T,>(items: readonly T[]): T[][] => items.reduce<T[][]>((all, item) => [...all, ...all.map((s) => [...s, item])], [[]]);
+
+/**
+ * Every auth-form call that varies what can decide an action name: each mode,
+ * each set of fields the constraints allow, providers absent or any set of
+ * them, and recovery absent, on or off.
+ */
+function authCalls(block: BlockDefinition, extra: Json = {}): Json[] {
+  const values = (name: string) => block.props.find((p) => p.name === name)!.items!.values!;
+  const calls: Json[] = [];
+  for (const mode of block.props.find((p) => p.name === "mode")!.values!) {
+    for (const fields of subsets(values("fields")).filter((f) => f.length > 0)) {
+      for (const providers of [undefined, ...subsets(values("providers"))]) {
+        for (const recovery of [undefined, true, false]) {
+          const call: Json = { block: block.id, version: block.version, mode, title: "Welcome", fields, ...extra };
+          if (providers !== undefined) call.providers = providers;
+          if (recovery !== undefined) call.recovery = recovery;
+          if (validateCall(block, call).length === 0 && checkConstraints(block, call).length === 0) calls.push(call);
+        }
+      }
+    }
+  }
+  return calls;
+}
+
+/** The names the real expander and emitter produce over some calls: what a template can actually dispatch. */
+function reachableNames(ref: Ref, block: BlockDefinition, calls: readonly Json[]): string[] {
+  const { sidecar, contract, profile } = inputs(ref);
+  const reference = parsed(sidecar).reference;
+  const names = new Set<string>();
+  for (const call of calls) {
+    const expanded = expandBlock(block, call, { reference, intent: block.intents[0]! });
+    if (!expanded.ok) continue;
+    const emitted = emitCheck(expanded.surface, contract, profile);
+    if (!emitted.ok) throw new Error(emitted.refusal);
+    for (const name of emitted.actions) names.add(name);
+  }
+  return [...names].sort();
+}
+
+describe("H1 counts the names a call can reach, no more", () => {
+  const view = (ref: Ref) => generationView(inputs(ref).contract, inputs(ref).profile);
+  const auth = (template: Json, overrides: Partial<BlockDefinition> = {}): BlockDefinition => ({ ...blockOf("astryx", "auth-form"), template: template as never, ...overrides });
+  const card = (...children: Json[]) => ({ component: "card", id: "auth-card", children });
+  const submit = (id: unknown) => ({ component: "button", id, props: { label: "Go", variant: "primary" } });
+  const names = (block: BlockDefinition) => templateActionNames(block, view("astryx").actionComponents);
+  const issues = (block: BlockDefinition) => b0Issues(block, view("astryx")).join("\n");
+  const withEnum = (name: string, count: number, required = true) => [
+    ...blockOf("astryx", "auth-form").props,
+    { name, ...(required ? { required: true } : {}), type: "enum" as const, values: Array.from({ length: count }, (_, i) => `v${i}`) },
+  ];
+
+  it("a name read twice holds one value: a repeated reference is not two independent choices", () => {
+    const block = auth(card(submit({ $concat: [{ $prop: "mode" }, "-", { $prop: "mode" }] })));
+    expect(names(block).names).toEqual(["reset_reset", "sign_in_sign_in", "sign_up_sign_up"]);
+    expect(issues({ ...block, actions: ["reset_reset", "sign_in_sign_in", "sign_up_sign_up"] })).toBe("");
+    expect(issues({ ...block, actions: ["reset_reset", "reset_sign_in", "sign_in_sign_in", "sign_up_sign_up"] })).toMatch(/'reset_sign_in' is declared, but no node of the template can emit it/);
+  });
+
+  it("a branch no call can take counts nothing, and declaring its name is a declaration no node can emit", () => {
+    const template = card(submit("auth-submit"), { $if: { $eq: [1, 2] }, children: [submit("never")] });
+    expect(names(auth(template)).names).toEqual(["auth_submit"]);
+    expect(issues(auth(template, { actions: ["auth_submit"] }))).toBe("");
+    expect(issues(auth(template, { actions: ["auth_submit", "never"] }))).toMatch(/'never' is declared, but no node of the template can emit it/);
+  });
+
+  it("an $if on an enum narrows that enum in each branch", () => {
+    const template = card({
+      $if: { $eq: [{ $prop: "mode" }, "reset"] },
+      children: [submit({ $concat: ["auth-", { $prop: "mode" }] })],
+      else: [submit({ $concat: ["auth-go-", { $prop: "mode" }] })],
+    });
+    expect(names(auth(template)).names).toEqual(["auth_go_sign_in", "auth_go_sign_up", "auth_reset"]);
+  });
+
+  it("an $if on a boolean narrows a $case on it", () => {
+    const template = card({ $if: "recovery", children: [submit({ $case: "recovery", map: { true: "auth-forgot", false: "auth-never" } })] });
+    expect(names(auth(template)).names).toEqual(["auth_forgot"]);
+  });
+
+  it("an $if comparing an enum read with a default narrows it with the default", () => {
+    const props = withEnum("variant", 2, false);
+    const read = { $prop: "variant", default: "v0" };
+    const template = card({ $if: { $eq: [read, "v0"] }, children: [submit({ $concat: ["auth-", read] })] });
+    expect(names(auth(template, { props })).names).toEqual(["auth_v0"]);
+  });
+
+  it("an optional enum may name an action where an $if guarantees it, and nowhere else", () => {
+    const props = withEnum("variant", 2, false);
+    const guarded = card({ $if: "variant", children: [submit({ $concat: ["auth-", { $prop: "variant" }] })] });
+    expect(issues(auth(guarded, { props, actions: ["auth_v0", "auth_v1"] }))).toBe("");
+    expect(issues(auth(card(submit({ $prop: "variant" })), { props, actions: ["v0", "v1"] }))).toMatch(/'variant' may be absent/);
+  });
+
+  it("an id read straight from an enum is capped at 256 names, like a combination", () => {
+    const at = (count: number) => auth(card(submit({ $prop: "big" })), { props: withEnum("big", count), actions: Array.from({ length: count }, (_, i) => `v${i}`) });
+    expect(issues(at(256))).toBe("");
+    expect(issues(at(257))).toMatch(/more than 256 possible names/);
+  });
+
+  it("an id read through a $case is capped at 256 names too", () => {
+    const at = (count: number) => {
+      const map = Object.fromEntries(Array.from({ length: count }, (_, i) => [`v${i}`, `auth-k${i}`]));
+      return auth(card(submit({ $case: "big", map })), { props: withEnum("big", count), actions: Array.from({ length: count }, (_, i) => `auth_k${i}`) });
+    };
+    expect(issues(at(256))).toBe("");
+    expect(issues(at(257))).toMatch(/more than 256 possible names/);
+  });
+
+  it("an id with too many combinations to evaluate is refused before any is evaluated", () => {
+    const props = [...blockOf("astryx", "auth-form").props, ...["a", "b", "c", "d"].map((name) => ({ name, required: true, type: "enum" as const, values: Array.from({ length: 10 }, (_, i) => `${name}${i}`) }))];
+    const id = { $concat: [{ $prop: "a" }, { $prop: "b" }, { $prop: "c" }, { $prop: "d" }] };
+    expect(issues(auth(card(submit(id)), { props, actions: ["x"] }))).toMatch(/more than 4096 combinations/);
+  });
+
+  it("on templates that narrow, H1's names are exactly what the real expander and emitter dispatch over every call", () => {
+    const narrowing = card(
+      { $if: { $eq: [{ $prop: "mode" }, "reset"] }, children: [submit({ $concat: ["auth-", { $prop: "mode" }] })], else: [submit({ $concat: ["auth-go-", { $prop: "mode" }] })] },
+      { $if: "recovery", children: [submit({ $case: "recovery", map: { true: "auth-forgot", false: "auth-never" } })] },
+      { $each: "providers", as: "provider", children: [{ $if: { $eq: [{ $prop: "provider" }, "github"] }, children: [submit({ $concat: ["auth-", { $prop: "provider" }] })] }] },
+    );
+    const block = auth(narrowing);
+    expect(names(block).names).toEqual(reachableNames("astryx", block, authCalls(block)));
+    expect(names(block).names).toEqual(["auth_forgot", "auth_github", "auth_go_sign_in", "auth_go_sign_up", "auth_reset"]);
+  });
+
+  it("an optional $case with a default names its default where the prop is absent", () => {
+    const template = card(submit({ $case: "recovery", map: { true: "auth-forgot", false: "auth-stay" }, default: "auth-none" }));
+    const block = auth(template);
+    expect(names(block).names).toEqual(["auth_forgot", "auth_none", "auth_stay"]);
+    expect(names(block).names).toEqual(reachableNames("astryx", block, authCalls(block)));
+  });
+
+  for (const ref of REF_IDS) {
+    it(`${ref}: on the shipped auth-form, H1's names are exactly what the real expander and emitter dispatch over every call`, () => {
+      const block = blockOf(ref, "auth-form");
+      expect(templateActionNames(block, actionComponents(inputs(ref).profile)).names).toEqual(reachableNames(ref, block, authCalls(block)));
+    });
+  }
+});
+
+describe("H1: no action enters a surface but the emitter's own", () => {
+  const view = () => generationView(inputs("astryx").contract, inputs("astryx").profile);
+  const auth = (template: Json, overrides: Partial<BlockDefinition> = {}): BlockDefinition => ({ ...blockOf("astryx", "auth-form"), template: template as never, actions: ["auth_submit"], ...overrides });
+  const submit = { component: "button", id: "auth-submit", props: { label: "Go", variant: "primary" } };
+  const table = (data: unknown) => ({ component: "table", id: "auth-table", props: { columns: ["A"], data } });
+  const issues = (block: BlockDefinition) => b0Issues(block, view()).join("\n");
+
+  it("a template value shaped like an action event is refused at load, whoever names it", () => {
+    // Astryx passes a table's data through verbatim, so an event inside it would reach the messages.
+    const modelNamed = table([{ cells: ["x"], event: { name: { $prop: "title" }, context: {} } }]);
+    expect(issues(auth({ component: "card", id: "auth-card", children: [submit, modelNamed] }))).toMatch(/carries an action event/);
+    const ownerNamed = table([{ cells: ["x"], event: { name: "auth_submit", context: {} } }]);
+    expect(issues(auth({ component: "card", id: "auth-card", children: [submit, ownerNamed] }))).toMatch(/carries an action event/);
+  });
+
+  it("an event built by a $map is refused too", () => {
+    const mapped = table({ $map: "fields", as: "field", value: { cells: [{ $prop: "field" }], event: { name: "auth_x", context: {} } } });
+    expect(issues(auth({ component: "card", id: "auth-card", children: [submit, mapped] }))).toMatch(/carries an action event/);
+  });
+
+  it("a signature object with a field named event is refused, so no call can supply one", () => {
+    const props = [
+      ...blockOf("astryx", "auth-form").props,
+      { name: "extra", type: "array" as const, maxItems: 2, items: { type: "object" as const, props: [{ name: "event", required: true, type: "string" as const, maxLength: 10 }] } },
+    ];
+    expect(issues(auth({ component: "card", id: "auth-card", children: [submit] }, { props }))).toMatch(/'extra\.\*\.event'/);
+  });
+
+  it("the shipped templates carry no event of their own", () => {
+    for (const ref of REF_IDS) {
+      const { sidecar, contract, profile } = inputs(ref);
+      for (const block of parsed(sidecar).blocks) expect(b0Issues(block, generationView(contract, profile)), `${ref}/${block.id}`).toEqual([]);
+    }
+  });
+});
+
+describe("H1 on the shipped sidecars: the names each template can emit are the §7 table, and equal its declaration", () => {
+  for (const ref of REF_IDS) {
+    it(ref, () => {
+      const { sidecar, profile } = inputs(ref);
+      const components = actionComponents(profile);
+      for (const block of parsed(sidecar).blocks) {
+        const { names, issues } = templateActionNames(block, components);
+        expect(issues, block.id).toEqual([]);
+        expect(names, block.id).toEqual(TABLE[block.id]);
+        expect([...block.actions].sort(), block.id).toEqual(TABLE[block.id]);
+      }
+    });
+  }
+});
+
+describe("loadBlocks: a block whose action names differ from its declaration is disabled at load", () => {
+  it("one name fewer declared disables that block only, with the H1 reason", async () => {
+    const { sidecar, contract, profile } = inputs("astryx");
+    const changed = structuredClone(sidecar);
+    const auth = changed.blocks.find((b: Json) => b.id === "auth-form");
+    auth.actions = auth.actions.filter((a: string) => a !== "auth_forgot");
+    const loaded = await loadBlocks(changed, { baseContract: contract, profile });
+    expect(loaded.binding).toBe("ok");
+    expect(loaded.usable.map((b) => b.id)).toEqual(["records-table", "guide-steps"]);
+    expect(loaded.disabled.map((d) => d.block)).toEqual(["auth-form"]);
+    expect(loaded.disabled[0]!.issues.join(" ")).toMatch(/auth_forgot/);
+  });
+
+  it("a template edited so the model fills a button id is disabled at load", async () => {
+    const { sidecar, contract, profile } = inputs("shadcn-v3");
+    const changed = structuredClone(sidecar);
+    const guide = changed.blocks.find((b: Json) => b.id === "guide-steps");
+    const walk = (node: Json): void => {
+      if (node.component === "button") node.id = { $concat: ["guide-", { $prop: "title" }] };
+      for (const child of node.children ?? []) walk(child);
+    };
+    walk(guide.template);
+    const loaded = await loadBlocks(changed, { baseContract: contract, profile });
+    expect(loaded.usable.map((b) => b.id)).toEqual(["records-table", "auth-form"]);
+    expect(loaded.disabled[0]!.issues.join(" ")).toMatch(/'title' is a string the model fills/);
+  });
+});
+
+/** auth-form's largest call: every field and provider, recovery on. */
+const fullAuthCall = (block: BlockDefinition): Json => ({
+  block: block.id,
+  version: block.version,
+  mode: "sign-up",
+  title: "Create your account",
+  fields: block.props.find((p) => p.name === "fields")!.items!.values!,
+  intro: "Use your work email.",
+  providers: block.props.find((p) => p.name === "providers")!.items!.values!,
+  recovery: true,
+});
+
+describe("what the emitter dispatches: names within H1's, and an empty context", () => {
+  for (const ref of REF_IDS) {
+    it(`${ref}: every example dispatches only names H1 proved, each with an empty context`, () => {
+      const { sidecar, contract, profile } = inputs(ref);
+      const loaded = parsed(sidecar);
+      const components = actionComponents(profile);
+      for (const block of loaded.blocks) {
+        const allowed = templateActionNames(block, components).names;
+        for (const example of block.examples) {
+          const expanded = expandBlock(block, example.call, { reference: loaded.reference, intent: example.intent });
+          if (!expanded.ok) throw new Error(expanded.message);
+          const events = actionEvents(emitSurface(expanded.surface as never, contract as never, { profile }).messages);
+          expect(events.length, `${block.id}/${example.id}`).toBeGreaterThan(0);
+          for (const event of events) {
+            expect(allowed, `${block.id}/${example.id}`).toContain(event.name);
+            expect(event.context, `${block.id}/${example.id}`).toEqual({});
+          }
+        }
+      }
+    });
+
+    it(`${ref}: auth-form actions carry an empty context, even for its largest call: no credential or entered value can ride along`, () => {
+      const { sidecar, contract, profile } = inputs(ref);
+      const loaded = parsed(sidecar);
+      const block = loaded.blocks.find((b) => b.id === "auth-form")!;
+      const call = fullAuthCall(block);
+      expect(validateCall(block, call)).toEqual([]);
+      expect(checkConstraints(block, call)).toEqual([]);
+      const expanded = expandBlock(block, call, { reference: loaded.reference, intent: block.intents[0]! });
+      if (!expanded.ok) throw new Error(expanded.message);
+      const messages = emitSurface(expanded.surface as never, contract as never, { profile }).messages as Json[];
+      const events = actionEvents(messages);
+      expect(events.map((e) => e.name).sort()).toEqual(TABLE["auth-form"]);
+      for (const event of events) expect(Reflect.ownKeys(event.context as object)).toEqual([]);
+      // No field is bound to a data model, so an action has nothing to sync: typed text stays in the page.
+      const bound: unknown[] = [];
+      const walk = (value: unknown): void => {
+        if (Array.isArray(value)) value.forEach(walk);
+        else if (value && typeof value === "object") {
+          if ("path" in value) bound.push(value);
+          Object.values(value).forEach(walk);
+        }
+      };
+      walk(messages);
+      expect(bound).toEqual([]);
+      expect(messages.flatMap((m) => Object.keys(m)).sort()).toEqual(["createSurface", "updateComponents", "version", "version"]);
+    });
+  }
+
+  it("actionEvents reads every event, whatever else the messages hold", () => {
+    const messages = [
+      { version: "v0.9", createSurface: { surfaceId: "s" } },
+      { version: "v0.9", updateComponents: { surfaceId: "s", components: [{ id: "a", action: { event: { name: "x_one", context: {} } } }, { id: "b", nested: [{ action: { event: { name: "x_two", context: { k: 1 } } } }] }] } },
+    ];
+    expect(actionEvents(messages)).toEqual([
+      { name: "x_one", context: {} },
+      { name: "x_two", context: { k: 1 } },
+    ]);
+  });
+});
diff --git a/packages/composer-core/src/blocks/actions.ts b/packages/composer-core/src/blocks/actions.ts
new file mode 100644
index 0000000..1df4a75
--- /dev/null
+++ b/packages/composer-core/src/blocks/actions.ts
@@ -0,0 +1,347 @@
+/**
+ * Interface blocks (experimental): host actions, H1 (docs/blocks/HOST-ACTIONS.md;
+ * docs/blocks/PHASE-2-RELEASE-PLAN.md, §7).
+ *
+ * Composer never executes an action; a host binds and authorizes each one.
+ * What a block's surface can dispatch is settled when its sidecar loads. The
+ * emitter (dspack-emit 0.7.0) gives a node an action only where the profile
+ * says so, a v1 `surfacePlan.actionProp` or a v2 route from
+ * `synthesized.action`, and names it with a slug of the node's id. Without an
+ * id it would name it from an alert dialog's confirm label, the node's text or
+ * its component instead, and those can be model-written. So H1 holds every
+ * such node to an id built only from literals and enum props: the model fills
+ * content, never an action name. Nor may a template carry an action event in
+ * another way: H1 also refuses a template value shaped like one (a
+ * passthrough prop would carry it into the messages verbatim) and a signature
+ * object with a field named `event`, which a call could fill. It does not
+ * look for A2UI function calls or data bindings (HOST-ACTIONS.md, §7).
+ * The names a template can produce, at most 256 per id, must equal its
+ * declared `actions`, exactly (templateActionNames says how they are
+ * counted). Either failure is a B0 failure, which disables the block at load
+ * (load.ts); B2 still holds every expansion's emitted names to the same list.
+ */
+import { shadcnProfile, slug, type Profile } from "@aestheticfunction/dspack-emit";
+import { alwaysPresent, rootScope, specAtPath, type BlockDefinition, type PropSpec, type Scope, type TemplateChild, type ValueSpec } from "./schema";
+
+type Json = Record<string, unknown>;
+
+const isObject = (value: unknown): value is Json => !!value && typeof value === "object" && !Array.isArray(value);
+
+/** The most names one action id may stand for: past it, a declaration could not be read or reviewed. */
+export const MAX_ACTION_NAMES = 256;
+/** The most combinations of the names one action id reads that H1 evaluates. */
+export const MAX_ACTION_COMBINATIONS = 4096;
+
+/**
+ * The components whose emitted instances dispatch an action under a profile,
+ * read the way emitSurface reads it, with its default profile when none is
+ * given.
+ */
+export function actionComponents(profile?: Profile): Set<string> {
+  const plans = ((profile ?? shadcnProfile) as unknown as { components?: unknown[] }).components ?? [];
+  const out = new Set<string>();
+  for (const plan of plans) {
+    if (!isObject(plan) || typeof plan.dspackId !== "string") continue;
+    const v1 = isObject(plan.surfacePlan) && !!plan.surfacePlan.actionProp;
+    const routes = isObject(plan.surface) && Array.isArray(plan.surface.routes) ? plan.surface.routes : [];
+    const v2 = routes.some((route) => isObject(route) && Array.isArray(route.from) && route.from.includes("synthesized.action"));
+    if (v1 || v2) out.add(plan.dspackId);
+  }
+  return out;
+}
+
+/** A value an enum or boolean name can take on a path, or its absence. */
+const ABSENT: unique symbol = Symbol("absent");
+type Value = string | boolean | typeof ABSENT;
+/** The values each enum or boolean name can still take where an enclosing $if narrowed it. */
+type Narrowed = ReadonlyMap<string, readonly Value[]>;
+
+const kind = (value: unknown): string => (value === null ? "null" : Array.isArray(value) ? "an array" : `${/^[aeiou]/.test(typeof value) ? "an" : "a"} ${typeof value}`);
+const isLiteral = (value: unknown) => value === null || ["string", "number", "boolean"].includes(typeof value);
+
+/** The values a name in scope can take: an enum's or a boolean's, with absence when a call may omit it, as narrowed on this path. Null for any other type. */
+function domain(scope: Scope, path: string, narrowed: Narrowed): readonly Value[] | null {
+  const known = narrowed.get(path);
+  if (known) return known;
+  const spec = specAtPath(scope, path);
+  const present: Value[] | null = spec?.type === "enum" ? [...(spec.values ?? [])] : spec?.type === "boolean" ? [true, false] : null;
+  if (!present) return null;
+  return alwaysPresent(scope, path) ? present : [...present, ABSENT];
+}
+
+/**
+ * The names an action id reads, or why it is not built from literals and enum
+ * props alone. Inside a $concat a number is text; on its own, an id must be a
+ * string.
+ */
+function idForm(value: unknown, scope: Scope, at: string): { reads: string[] } | { issue: string } {
+  const reads = new Set<string>();
+  const check = (v: unknown, where: string, part: boolean): string | null => {
+    const text = (x: unknown) => typeof x === "string" || (part && typeof x === "number");
+    if (text(v)) return null;
+    if (!isObject(v)) return `${where}: ${kind(v)} is not a string`;
+    if ("$prop" in v) {
+      const path = String(v.$prop);
+      const spec = specAtPath(scope, path);
+      if (!spec) return `${where}: '${path}' does not resolve`;
+      if (spec.type === "string") return `${where}: '${path}' is a string the model fills, so the model would name the action`;
+      if (spec.type !== "enum") return `${where}: '${path}' is ${/^[aeiou]/.test(spec.type) ? "an" : "a"} ${spec.type} prop, not an enum`;
+      if (v.default !== undefined && !text(v.default)) return `${where}: the default of '${path}' is ${kind(v.default)}, not a string`;
+      reads.add(path);
+      return null;
+    }
+    if ("$case" in v) {
+      const path = String(v.$case);
+      const spec = specAtPath(scope, path);
+      if (!spec || (spec.type !== "enum" && spec.type !== "boolean")) return `${where}: '${path}' is not an enum or a boolean`;
+      const results = [...Object.values(isObject(v.map) ? v.map : {}), ...(v.default !== undefined ? [v.default] : [])];
+      const bad = results.filter((r) => !text(r));
+      if (bad.length > 0) return `${where}: a $case result is ${kind(bad[0])}, not a string`;
+      reads.add(path);
+      return null;
+    }
+    if ("$concat" in v) {
+      if (!Array.isArray(v.$concat) || v.$concat.length === 0) return `${where}: $concat takes a non-empty array`;
+      for (const [i, p] of v.$concat.entries()) {
+        const issue = check(p, `${where}.$concat.${i}`, true);
+        if (issue) return issue;
+      }
+      return null;
+    }
+    if ("$index" in v) return `${where}: $index is a position, not a literal or an enum`;
+    if ("$map" in v) return `${where}: $map makes a list, not a name`;
+    return `${where}: an object is not a string`;
+  };
+  const issue = check(value, at, false);
+  return issue ? { issue } : { reads: [...reads] };
+}
+
+type IdValue = { text: string } | { absent: string } | { fails: string };
+
+/** An action id under one assignment of the names it reads, evaluated as the expander evaluates it (expand.ts). */
+function evaluateId(value: unknown, assignment: ReadonlyMap<string, Value>, at: string): IdValue {
+  if (typeof value === "string" || typeof value === "number") return { text: String(value) };
+  const v = value as Json;
+  if ("$prop" in v) {
+    const got = assignment.get(String(v.$prop));
+    if (got === ABSENT || got === undefined) return v.default !== undefined ? { text: String(v.default) } : { absent: String(v.$prop) };
+    return { text: String(got) };
+  }
+  if ("$case" in v) {
+    const got = assignment.get(String(v.$case));
+    const key = typeof got === "string" ? got : typeof got === "boolean" ? String(got) : undefined;
+    const map = isObject(v.map) ? v.map : {};
+    if (key !== undefined && Object.hasOwn(map, key)) return { text: String(map[key]) };
+    if (v.default !== undefined) return { text: String(v.default) };
+    return { fails: `${at}: the $case on '${String(v.$case)}' has no value for ${key === undefined ? "its absence" : `'${key}'`}` };
+  }
+  let out = "";
+  for (const [i, part] of (v.$concat as unknown[]).entries()) {
+    const found = evaluateId(part, assignment, `${at}.$concat.${i}`);
+    if ("fails" in found) return found;
+    if ("absent" in found) return { fails: `${at}.$concat.${i}: '${found.absent}' may be absent, and an action id cannot be; make it required or give it a default` };
+    out += found.text;
+  }
+  return { text: out };
+}
+
+/**
+ * How an $if splits the values of the names it tests: truthiness of a name,
+ * or a name's equality with a literal (with the default it reads when absent),
+ * narrows that name in each branch; a comparison of two literals picks one
+ * branch. Null marks a branch no call can take. Any other test narrows
+ * nothing, and both branches count.
+ */
+function branches(test: unknown, scope: Scope, narrowed: Narrowed): { then: Narrowed | null; otherwise: Narrowed | null } {
+  const split = (path: string, holds: (v: Value) => boolean) => {
+    const values = domain(scope, path, narrowed);
+    if (!values) return { then: narrowed, otherwise: narrowed };
+    const yes = values.filter(holds);
+    const no = values.filter((v) => !holds(v));
+    return { then: yes.length > 0 ? new Map(narrowed).set(path, yes) : null, otherwise: no.length > 0 ? new Map(narrowed).set(path, no) : null };
+  };
+  if (typeof test === "string") return split(test, (v) => v !== ABSENT && v !== false && v !== "");
+  if (isObject(test) && Array.isArray(test.$eq) && test.$eq.length === 2) {
+    const [a, b] = test.$eq as [unknown, unknown];
+    if (isLiteral(a) && isLiteral(b)) {
+      const same = JSON.stringify(a) === JSON.stringify(b);
+      return { then: same ? narrowed : null, otherwise: same ? null : narrowed };
+    }
+    const bare = (x: unknown): x is Json => isObject(x) && "$prop" in x && Object.keys(x).every((k) => k === "$prop" || k === "default");
+    const pair = bare(a) && isLiteral(b) ? ([a, b] as const) : bare(b) && isLiteral(a) ? ([b, a] as const) : null;
+    if (pair) {
+      const [prop, literal] = pair;
+      return split(String(prop.$prop), (v) => {
+        const read = v === ABSENT ? (prop.default !== undefined ? prop.default : ABSENT) : v;
+        return read !== ABSENT && JSON.stringify(read) === JSON.stringify(literal);
+      });
+    }
+  }
+  return { then: narrowed, otherwise: narrowed };
+}
+
+/**
+ * Every action name a block's template can make its surface dispatch, under
+ * a profile's action components, and every node whose name is not bounded.
+ * Each action id is evaluated as the expander evaluates it, over every
+ * combination of the enum and boolean names it reads, so a name read twice
+ * holds one value. An $if that tests a name's truthiness or its equality
+ * with a literal narrows that name in each branch, and a branch no call can
+ * take counts nothing. Other conditions, and the cross-field constraints a
+ * call must meet, are taken as able to hold either way: the set may then
+ * include a name no call reaches, never miss one a call can emit.
+ */
+export function templateActionNames(block: Pick<BlockDefinition, "props" | "template">, components: ReadonlySet<string>): { names: string[]; issues: string[] } {
+  const names = new Set<string>();
+  const issues: string[] = [];
+
+  const walkNode = (node: Json, at: string, scope: Scope, narrowed: Narrowed) => {
+    const component = String(node.component);
+    if (components.has(component)) {
+      const where = `${at}.id`;
+      const form = node.id === undefined ? null : idForm(node.id, scope, where);
+      if (form === null) {
+        issues.push(`${at}: '${component}' dispatches an action, so it needs an id built from literals and enum props; without one, the emitter names the action from a confirm label, the node's text or its component, and a model can write the first two`);
+      } else if ("issue" in form) {
+        issues.push(form.issue);
+      } else {
+        const values = form.reads.map((path) => domain(scope, path, narrowed) ?? []);
+        const combinations = values.reduce((n, v) => n * v.length, 1);
+        if (combinations > MAX_ACTION_COMBINATIONS) {
+          issues.push(`${where}: more than ${MAX_ACTION_COMBINATIONS} combinations of the names it reads`);
+        } else {
+          const own = new Set<string>();
+          const found = new Set<string>();
+          for (let n = 0; n < combinations; n++) {
+            const assignment = new Map<string, Value>();
+            let rest = n;
+            form.reads.forEach((path, i) => {
+              assignment.set(path, values[i]![rest % values[i]!.length]!);
+              rest = Math.floor(rest / values[i]!.length);
+            });
+            const result = evaluateId(node.id, assignment, where);
+            if ("fails" in result) found.add(result.fails);
+            else if ("absent" in result) found.add(`${where}: '${result.absent}' may be absent, and an action id cannot be; make it required or give it a default`);
+            else own.add(slug(result.text));
+          }
+          if (own.size > MAX_ACTION_NAMES) found.add(`${where}: more than ${MAX_ACTION_NAMES} possible names`);
+          issues.push(...found);
+          for (const name of own) names.add(name);
+        }
+      }
+    }
+    if (Array.isArray(node.children)) walkChildren(node.children as TemplateChild[], `${at}.children`, scope, narrowed);
+  };
+
+  const walkChildren = (children: TemplateChild[], at: string, scope: Scope, narrowed: Narrowed) => {
+    children.forEach((child, i) => {
+      const entry = child as Json;
+      const path = `${at}.${i}`;
+      if ("$each" in entry) {
+        const items = specAtPath(scope, String(entry.$each))?.items;
+        const inner: Scope = new Map(scope);
+        const innerNarrowed = new Map(narrowed);
+        innerNarrowed.delete(String(entry.as));
+        if (items) inner.set(String(entry.as), { spec: items, loop: true });
+        walkChildren((entry.children ?? []) as TemplateChild[], `${path}.children`, inner, innerNarrowed);
+      } else if ("$if" in entry) {
+        const split = branches(entry.$if, scope, narrowed);
+        if (split.then) walkChildren((entry.children ?? []) as TemplateChild[], `${path}.children`, scope, split.then);
+        if (split.otherwise) walkChildren((entry.else ?? []) as TemplateChild[], `${path}.else`, scope, split.otherwise);
+      } else {
+        walkNode(entry, path, scope, narrowed);
+      }
+    });
+  };
+
+  walkNode(block.template as unknown as Json, "template", rootScope(block), new Map());
+  return { names: [...names].sort(), issues };
+}
+
+/** Every signature field named `event`, by path: a call could fill one with an action event. */
+function eventFields(props: readonly PropSpec[] | undefined, at: string): string[] {
+  const out: string[] = [];
+  const walk = (spec: ValueSpec, path: string) => {
+    if (spec.type === "array" && spec.items) walk(spec.items, `${path}.*`);
+    for (const field of spec.type === "object" ? (spec.props ?? []) : []) {
+      if (field.name === "event") out.push(`${path}.event`);
+      walk(field, `${path}.${field.name}`);
+    }
+  };
+  for (const prop of props ?? []) {
+    if (prop.name === "event") out.push(`${at}${prop.name}`);
+    walk(prop, `${at}${prop.name}`);
+  }
+  return out;
+}
+
+/** Every place in a template's props and text that writes an object with an `event` key, literally or through a $map or $concat. */
+function eventValues(block: Pick<BlockDefinition, "template">): string[] {
+  const out: string[] = [];
+  const value = (v: unknown, at: string): void => {
+    if (Array.isArray(v)) {
+      v.forEach((entry, i) => value(entry, `${at}.${i}`));
+      return;
+    }
+    if (!isObject(v)) return;
+    if ("$map" in v) return value(v.value, `${at}.value`);
+    if ("$concat" in v) return value(v.$concat, `${at}.$concat`);
+    if (Object.keys(v).some((k) => k.startsWith("$"))) return;
+    if (Object.hasOwn(v, "event")) out.push(at);
+    for (const [key, entry] of Object.entries(v)) value(entry, `${at}.${key}`);
+  };
+  const node = (n: unknown, at: string): void => {
+    if (Array.isArray(n)) {
+      n.forEach((entry, i) => node(entry, `${at}.${i}`));
+      return;
+    }
+    if (!isObject(n)) return;
+    if ("$each" in n || "$if" in n) {
+      node(n.children, `${at}.children`);
+      node(n.else, `${at}.else`);
+      return;
+    }
+    if (n.props !== undefined) value(n.props, `${at}.props`);
+    if (n.text !== undefined) value(n.text, `${at}.text`);
+    node(n.children, `${at}.children`);
+  };
+  node(block.template, "template");
+  return out;
+}
+
+/** H1 for one block: anything that could carry an action but the emitter, unbounded action ids, then every difference between the names it can emit and the ones it declares. */
+export function actionIssues(block: Pick<BlockDefinition, "props" | "template" | "actions">, components: ReadonlySet<string>): string[] {
+  const carried = [
+    ...eventValues(block).map((at) => `${at}: carries an action event; a surface dispatches only the emitter's actions, named from bounded ids`),
+    ...eventFields(block.props, "").map((path) => `props: '${path}' is a field a call fills, so it could carry an action event; rename it`),
+  ];
+  if (carried.length > 0) return carried;
+  const { names, issues } = templateActionNames(block, components);
+  // An unbounded id leaves the set of names unknown, so there is nothing to compare.
+  if (issues.length > 0) return issues;
+  const out: string[] = [];
+  const declared = new Set<string>();
+  for (const name of block.actions) {
+    if (declared.has(name)) out.push(`actions: '${name}' is declared more than once`);
+    declared.add(name);
+  }
+  for (const name of names) if (!declared.has(name)) out.push(`actions: the template can emit '${name}', which is not declared`);
+  for (const name of declared) if (!names.includes(name)) out.push(`actions: '${name}' is declared, but no node of the template can emit it`);
+  return out;
+}
+
+/** Every action event a message stream carries, in document order, with its name and context as written. */
+export function actionEvents(messages: unknown): Array<{ name: unknown; context: unknown }> {
+  const out: Array<{ name: unknown; context: unknown }> = [];
+  const walk = (value: unknown): void => {
+    if (Array.isArray(value)) {
+      value.forEach(walk);
+      return;
+    }
+    if (!isObject(value)) return;
+    if (isObject(value.event)) out.push({ name: value.event.name, context: value.event.context });
+    Object.values(value).forEach(walk);
+  };
+  walk(messages);
+  return out;
+}
diff --git a/packages/composer-core/src/blocks/index.ts b/packages/composer-core/src/blocks/index.ts
index 61ad903..8f5b4f1 100644
--- a/packages/composer-core/src/blocks/index.ts
+++ b/packages/composer-core/src/blocks/index.ts
@@ -66,6 +66,7 @@ export {
   provenanceStatus,
   pruneProvenance,
   PROVENANCE_MAX_BYTES,
+  trustedProvenance,
   type BlockProvenanceEntry,
   type InertProvenance,
   type ProvenanceRecord,
@@ -75,3 +76,14 @@ export { recheckBlockChoice, reconcileBlockChoice, selectBlockDeterministic, wit
 export { eligibleBlocks, liveBaseDigest, type EligibilityInput, type IneligibleReason } from "./eligibility";
 export { gateBlocksBeta, parseBlocksBeta, type BlocksBetaKnown, type BlocksBetaOff, type BlocksBetaReason, type BlocksBetaSwitch } from "./beta";
 export { b0Issues, checkActions, emitCheck, emittedActionNames, loadBlocks, type EmitCheck, type LoadedBlocks } from "./load";
+export { actionComponents, actionEvents, actionIssues, MAX_ACTION_NAMES, templateActionNames } from "./actions";
+export {
+  ACTION_MANIFEST_VERSION,
+  actionManifest,
+  type ActionManifest,
+  type ActionManifestInput,
+  type ManifestAction,
+  type ManifestBlock,
+  type ManifestReference,
+  type ManifestSurface,
+} from "./manifest";
diff --git a/packages/composer-core/src/blocks/load.ts b/packages/composer-core/src/blocks/load.ts
index 02270d7..ed513b6 100644
--- a/packages/composer-core/src/blocks/load.ts
+++ b/packages/composer-core/src/blocks/load.ts
@@ -10,12 +10,15 @@
  *   props only (none on sub-components or prop-less components), enum values
  *   from the contract, and an id wherever a profile join keys on it. (The
  *   schema's unroll depth constrains decoding, not the S1 surface gate, so it
- *   does not bind an expansion.) A block that fails B0 is disabled and reported; the others
- *   stay usable.
+ *   does not bind an expansion.) H1 belongs to B0 too: every node the profile
+ *   gives an action has an id built only from literals and enum props, and the
+ *   names the template can emit equal its declared actions (actions.ts). A
+ *   block that fails B0 is disabled and reported; the others stay usable.
  * - emitCheck: the representability check every expansion passes before the
  *   pipeline, and the source of B2's emitted action names.
  */
 import { emitSurface, type Profile } from "@aestheticfunction/dspack-emit";
+import { actionIssues } from "./actions";
 import type { CallIssue } from "./call";
 import { contractDigest } from "./digest";
 import { alwaysPresent, parseBlocksSidecar, rootScope, specAtPath, type BlockDefinition, type BlocksSidecar, type Scope, type TemplateChild } from "./schema";
@@ -100,6 +103,7 @@ export function b0Issues(block: BlockDefinition, view: GenerationView): string[]
   };
 
   walkNode(block.template as unknown as Json, "template", rootScope(block));
+  issues.push(...actionIssues(block, view.actionComponents));
   return issues;
 }
 
diff --git a/packages/composer-core/src/blocks/manifest-context.test.ts b/packages/composer-core/src/blocks/manifest-context.test.ts
new file mode 100644
index 0000000..35a8f33
--- /dev/null
+++ b/packages/composer-core/src/blocks/manifest-context.test.ts
@@ -0,0 +1,89 @@
+/**
+ * The action manifest's empty-context guard, alone (docs/blocks/HOST-ACTIONS.md).
+ * dspack-emit 0.7.0 always emits `context: {}`, so the guard is unreachable
+ * through the real emitter: messages carrying a context fail the manifest's
+ * emission check first. Here the emitter itself is made to write a context,
+ * so the exported messages ARE the expansion's own emission and only the
+ * guard can refuse the binding. The control proves the setup binds without
+ * the injected context.
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+
+const state = vi.hoisted(() => ({ context: null as Record<string, unknown> | null }));
+
+vi.mock("@aestheticfunction/dspack-emit", async (importOriginal) => {
+  const real = await importOriginal<typeof import("@aestheticfunction/dspack-emit")>();
+  const withContext = (value: unknown): void => {
+    if (Array.isArray(value)) value.forEach(withContext);
+    else if (value && typeof value === "object") {
+      const event = (value as Record<string, unknown>).event;
+      if (state.context && event && typeof event === "object") (event as Record<string, unknown>).context = structuredClone(state.context);
+      Object.values(value).forEach(withContext);
+    }
+  };
+  return {
+    ...real,
+    emitSurface: (...args: Parameters<typeof real.emitSurface>) => {
+      const out = real.emitSurface(...args);
+      withContext(out.messages);
+      return out;
+    },
+  };
+});
+
+const { emitSurface, loadProfile } = await import("@aestheticfunction/dspack-emit");
+const { actionManifest, expandBlock, expansionDigest, loadBlocks, parseBlocksSidecar } = await import("./index");
+
+type Json = Record<string, any>;
+const repo = (rel: string) => fileURLToPath(new URL(`../../../../${rel}`, import.meta.url));
+const json = (rel: string) => JSON.parse(readFileSync(repo(rel), "utf8")) as Json;
+
+async function exportOfAuthForm() {
+  const raw = json("apps/composer/experimental/blocks/astryx.blocks.json");
+  const contract = json("apps/composer/astryx-project/astryx.dspack.json");
+  const profile = loadProfile(json("apps/composer/astryx-project/astryx.profile.json") as never);
+  const parsed = parseBlocksSidecar(raw);
+  if (!parsed.ok) throw new Error(JSON.stringify(parsed.issues));
+  const block = parsed.sidecar.blocks.find((b) => b.id === "auth-form")!;
+  const example = block.examples[0]!;
+  const expanded = expandBlock(block, example.call, { reference: parsed.sidecar.reference, intent: example.intent });
+  if (!expanded.ok) throw new Error(expanded.message);
+  const messages = emitSurface(expanded.surface as never, contract as never, { profile }).messages as unknown[];
+  const entry = {
+    v: 1,
+    reference: parsed.sidecar.reference,
+    baseSha256: parsed.sidecar.baseSha256,
+    block: "auth-form",
+    version: 1,
+    intent: example.intent,
+    blockSchemaSha256: "a".repeat(64),
+    encoding: "named",
+    call: example.call,
+    expansionDigest: await expansionDigest(expanded.surface),
+  };
+  const loaded = await loadBlocks(raw, { baseContract: contract, profile });
+  return actionManifest({
+    surfaces: [{ name: "ex.chat-1", messages }],
+    examples: [{ id: "ex.chat-1", surface: expanded.surface }],
+    provenance: { "ex.chat-1": entry },
+    references: [{ loaded, contract, profile }],
+  });
+}
+
+describe("a block action whose context is not empty binds nothing, even when it is the expansion's own emission", () => {
+  it("control: with the emitter's own empty contexts, the surface binds", async () => {
+    state.context = null;
+    const manifest = await exportOfAuthForm();
+    expect(manifest.surfaces[0]!.block).toMatchObject({ id: "auth-form" });
+  });
+
+  it("an entered value in the context: no binding, and no action declared", async () => {
+    state.context = { password: { path: "/auth/password" } };
+    const manifest = await exportOfAuthForm();
+    state.context = null;
+    expect(manifest.surfaces[0]!.block).toBeNull();
+    expect(manifest.surfaces[0]!.actions.every((a) => a.declared === false)).toBe(true);
+  });
+});
diff --git a/packages/composer-core/src/blocks/manifest.test.ts b/packages/composer-core/src/blocks/manifest.test.ts
new file mode 100644
index 0000000..7d3923f
--- /dev/null
+++ b/packages/composer-core/src/blocks/manifest.test.ts
@@ -0,0 +1,334 @@
+/**
+ * Host actions, H2 (docs/blocks/HOST-ACTIONS.md; docs/blocks/PHASE-2-RELEASE-PLAN.md,
+ * §7): the per-surface action manifest the beta's Catalog export carries.
+ *
+ * It binds every action a surface's messages dispatch by surface and name. A
+ * surface gets a block binding (block id, version, expansion identity,
+ * declared actions, streaming policy) only when it verifiably IS its block's
+ * expansion: its provenance, under an approved sidecar the build bundles,
+ * re-expands to exactly the stored surface, and emits exactly the exported
+ * messages, every action declared and every context empty. Anything else,
+ * forged provenance and edited surfaces included, binds nothing: a surface
+ * name plus an action name alone grants nothing.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { beforeAll, describe, expect, it } from "vitest";
+import { emitSurface, loadProfile, type Profile } from "@aestheticfunction/dspack-emit";
+import {
+  ACTION_MANIFEST_VERSION,
+  actionManifest,
+  expandBlock,
+  expansionDigest,
+  loadBlocks,
+  parseBlocksSidecar,
+  sha256Hex,
+  type ActionManifest,
+  type LoadedBlocks,
+  type ManifestReference,
+} from "./index";
+
+type Json = Record<string, any>;
+const repo = (rel: string) => fileURLToPath(new URL(`../../../../${rel}`, import.meta.url));
+const json = (rel: string) => JSON.parse(readFileSync(repo(rel), "utf8")) as Json;
+
+const rawSidecar = json("apps/composer/experimental/blocks/astryx.blocks.json");
+const contract = json("apps/composer/astryx-project/astryx.dspack.json");
+const profile = loadProfile(json("apps/composer/astryx-project/astryx.profile.json") as never) as Profile;
+const parsed = parseBlocksSidecar(rawSidecar);
+if (!parsed.ok) throw new Error(JSON.stringify(parsed.issues));
+const sidecar = parsed.sidecar;
+const authForm = sidecar.blocks.find((b) => b.id === "auth-form")!;
+const example = authForm.examples[0]!;
+const expanded = expandBlock(authForm, example.call, { reference: sidecar.reference, intent: example.intent });
+if (!expanded.ok) throw new Error(expanded.message);
+const surface = expanded.surface as unknown as Json;
+const emit = (s: unknown) => emitSurface(s as never, contract as never, { profile }).messages as unknown[];
+const messages = emit(surface);
+
+/** The surface's name in the export: the accepted example's id. */
+const NAME = "ex.chat-1";
+const PRIMITIVE = "ex.chat-2";
+
+/** A hand-built surface (no block) whose button id slugs to a block's action name. */
+const primitive: Json = {
+  dspackSurface: "0.1",
+  system: contract.name,
+  intent: example.intent,
+  root: { component: "card", id: "auth-card", children: [{ component: "button", id: "auth-submit", props: { label: "Sign in", variant: "primary" } }] },
+};
+const primitiveMessages = emit(primitive);
+
+let digest: string;
+let entry: Json;
+let loaded: LoadedBlocks;
+let references: ManifestReference[];
+
+beforeAll(async () => {
+  digest = await expansionDigest(surface);
+  entry = {
+    v: 1,
+    reference: sidecar.reference,
+    baseSha256: sidecar.baseSha256,
+    block: "auth-form",
+    version: 1,
+    intent: example.intent,
+    blockSchemaSha256: "a".repeat(64),
+    encoding: "named",
+    call: example.call,
+    expansionDigest: digest,
+  };
+  loaded = await loadBlocks(rawSidecar, { baseContract: contract, profile });
+  references = [{ loaded, contract, profile }];
+});
+
+/** The export of one accepted block surface and one primitive surface, with provenance for the first. */
+const input = (overrides: Json = {}) => ({
+  surfaces: [
+    { name: NAME, messages },
+    { name: PRIMITIVE, messages: primitiveMessages },
+  ],
+  examples: [
+    { id: NAME, surface },
+    { id: PRIMITIVE, surface: primitive },
+  ],
+  provenance: { [NAME]: entry } as Record<string, unknown>,
+  references,
+  ...overrides,
+});
+
+const entryFor = (manifest: ActionManifest, name: string) => manifest.surfaces.find((s) => s.surface === name)!;
+const bindsNothing = (manifest: ActionManifest, name: string) => {
+  const found = entryFor(manifest, name);
+  expect(found.block).toBeNull();
+  expect(found.actions.length).toBeGreaterThan(0);
+  expect(found.actions.every((a) => a.declared === false)).toBe(true);
+};
+
+describe("a surface that is its block's expansion", () => {
+  it("binds each action it dispatches by surface and name, with the block id, version, expansion identity, declared actions and streaming policy", async () => {
+    const manifest = await actionManifest(input());
+    expect(manifest.v).toBe(ACTION_MANIFEST_VERSION);
+    expect(entryFor(manifest, NAME)).toEqual({
+      surface: NAME,
+      surfaceId: "data_collection",
+      messagesSha256: await sha256Hex(JSON.stringify(messages)),
+      actions: [
+        { name: "auth_provider_github", declared: true },
+        { name: "auth_submit", declared: true },
+      ],
+      block: {
+        id: "auth-form",
+        version: 1,
+        reference: sidecar.reference,
+        baseSha256: sidecar.baseSha256,
+        intent: example.intent,
+        expansionDigest: digest,
+        declaredActions: authForm.actions,
+        streaming: "disable-actions-until-complete",
+      },
+    });
+  });
+
+  it("names are not capabilities: a primitive surface whose button id slugs to auth_submit binds nothing", async () => {
+    const manifest = await actionManifest(input());
+    expect(entryFor(manifest, PRIMITIVE)).toEqual({
+      surface: PRIMITIVE,
+      surfaceId: "data_collection",
+      messagesSha256: await sha256Hex(JSON.stringify(primitiveMessages)),
+      actions: [{ name: "auth_submit", declared: false }],
+      block: null,
+    });
+  });
+
+  it("lists every exported surface in the export's order, and none without messages", async () => {
+    const manifest = await actionManifest(input({ surfaces: [{ name: PRIMITIVE, messages: primitiveMessages }, { name: "ex.refused" }, { name: NAME, messages }] }));
+    expect(manifest.surfaces.map((s) => s.surface)).toEqual([PRIMITIVE, NAME]);
+  });
+});
+
+describe("each entry pins the exact messages it describes", () => {
+  it("messagesSha256 is the sha256 of the exported messages, so a host can tell an altered export from the one reviewed", async () => {
+    const manifest = await actionManifest(input());
+    for (const [name, list] of [[NAME, messages], [PRIMITIVE, primitiveMessages]] as const) {
+      expect(entryFor(manifest, name).messagesSha256).toBe(await sha256Hex(JSON.stringify(list)));
+    }
+    const altered = structuredClone(messages) as Json[];
+    altered.find((m) => m.updateComponents)!.updateComponents.components[0].text = "Altered";
+    expect(await sha256Hex(JSON.stringify(altered))).not.toBe(entryFor(manifest, NAME).messagesSha256);
+  });
+
+  it("a host recomputes it from the downloaded file as the guide says: lowercase hex sha256 of the UTF-8 bytes of JSON.stringify(messages), non-ASCII text unescaped", async () => {
+    const label = "Créez votre compte ✓";
+    const accented: Json = { ...primitive, root: { ...primitive.root, children: [{ ...primitive.root.children[0], props: { label, variant: "primary" } }] } };
+    const list = emit(accented);
+    const manifest = await actionManifest(input({ surfaces: [{ name: "ex.accented", messages: list }], examples: [{ id: "ex.accented", surface: accented }], provenance: {} }));
+    // The download is pretty-printed; the host parses it and serializes the entry's messages compactly.
+    const file = JSON.stringify({ surfaces: [{ name: "ex.accented", messages: list }], actionManifest: manifest }, null, 2);
+    expect(file).toContain(label);
+    const downloaded = JSON.parse(file) as Json;
+    const compact = JSON.stringify(downloaded.surfaces[0].messages);
+    const recomputed = createHash("sha256").update(Buffer.from(compact, "utf8")).digest("hex");
+    expect(downloaded.actionManifest.surfaces[0].messagesSha256).toBe(recomputed);
+    expect(recomputed).toMatch(/^[0-9a-f]{64}$/);
+    // A serializer that escapes non-ASCII (Python's json.dumps by default) writes other bytes, so another hash.
+    const escaped = compact.replace(/[\u0080-￿]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+    expect(escaped).not.toBe(compact);
+    expect(createHash("sha256").update(Buffer.from(escaped, "utf8")).digest("hex")).not.toBe(recomputed);
+  });
+});
+
+describe("forged provenance grants no authority", () => {
+  const forgeries: Array<[string, () => Json]> = [
+    ["a real call filed against another surface's digest", () => ({ ...entry })],
+    ["a version the sidecar does not have", () => ({ ...entry, version: 2 })],
+    ["a reference the build does not bundle", () => ({ ...entry, reference: { ...sidecar.reference, version: "9.9.9" } })],
+    ["a base the sidecar is not bound to", () => ({ ...entry, baseSha256: "0".repeat(64) })],
+    ["a call with a slot for a password", () => ({ ...entry, call: { ...example.call, password: "hunter2" } })],
+    ["a call that is not the one that made the surface", () => ({ ...entry, call: { ...example.call, title: "Something else" } })],
+    ["an intent the block does not serve", () => ({ ...entry, intent: "record-collection" })],
+    ["an encoding the beta does not write", () => ({ ...entry, encoding: "positional" })],
+    ["an inert record", () => ({ block: "auth-form", version: 1, status: "inert" })],
+    ["a record for another block", () => ({ ...entry, block: "guide-steps" })],
+    ["a recorded digest that is not its call's expansion", () => ({ ...entry, expansionDigest: "f".repeat(64) })],
+  ];
+
+  it.each(forgeries)("%s: the primitive surface binds nothing", async (_name, forge) => {
+    const record = forge();
+    const forged = _name.startsWith("a real call") ? { ...record, expansionDigest: await expansionDigest(primitive) } : record;
+    const manifest = await actionManifest(input({ provenance: { [PRIMITIVE]: forged, [NAME]: entry } }));
+    bindsNothing(manifest, PRIMITIVE);
+  });
+
+  it.each(forgeries.slice(1))("%s: even the real block surface binds nothing", async (_name, forge) => {
+    const manifest = await actionManifest(input({ provenance: { [NAME]: forge() } }));
+    bindsNothing(manifest, NAME);
+  });
+
+  it("the real entry filed under a primitive surface's name binds nothing", async () => {
+    const manifest = await actionManifest(input({ provenance: { [PRIMITIVE]: entry } }));
+    bindsNothing(manifest, PRIMITIVE);
+    bindsNothing(manifest, NAME);
+  });
+
+  it("a record reached only through the prototype is not the surface's", async () => {
+    const manifest = await actionManifest(input({ provenance: Object.create({ [NAME]: entry }) }));
+    bindsNothing(manifest, NAME);
+  });
+
+  it("an entry the stored surface does not match: provenance is a claim, the expansion is the proof", async () => {
+    const manifest = await actionManifest(input({ examples: [{ id: NAME, surface: primitive }, { id: PRIMITIVE, surface: primitive }] }));
+    bindsNothing(manifest, NAME);
+  });
+
+  it("a draft sidecar or a draft block binds nothing", async () => {
+    const draftSidecar = await loadBlocks({ ...structuredClone(rawSidecar), status: "draft" }, { baseContract: contract, profile });
+    bindsNothing(await actionManifest(input({ references: [{ loaded: draftSidecar, contract, profile }] })), NAME);
+
+    const draftBlock = structuredClone(rawSidecar);
+    draftBlock.blocks.find((b: Json) => b.id === "auth-form").status = "draft";
+    const loadedDraft = await loadBlocks(draftBlock, { baseContract: contract, profile });
+    bindsNothing(await actionManifest(input({ references: [{ loaded: loadedDraft, contract, profile }] })), NAME);
+  });
+
+  it("a block B0 disabled at load binds nothing, whatever its provenance says", async () => {
+    const changed = structuredClone(rawSidecar);
+    const auth = changed.blocks.find((b: Json) => b.id === "auth-form");
+    auth.actions = auth.actions.filter((a: string) => a !== "auth_forgot");
+    const disabled = await loadBlocks(changed, { baseContract: contract, profile });
+    expect(disabled.disabled.map((d) => d.block)).toEqual(["auth-form"]);
+    bindsNothing(await actionManifest(input({ references: [{ loaded: disabled, contract, profile }] })), NAME);
+  });
+
+  it("a block whose declaration misses a name its template emits binds nothing, even if H1 were bypassed at load", async () => {
+    const auth = loaded.usable.find((b) => b.id === "auth-form")!;
+    const bypassed: LoadedBlocks = { ...loaded, usable: loaded.usable.map((b) => (b === auth ? { ...auth, actions: auth.actions.filter((a) => a !== "auth_provider_github") } : b)) };
+    const manifest = await actionManifest(input({ references: [{ loaded: bypassed, contract, profile }] }));
+    bindsNothing(manifest, NAME);
+  });
+
+  it("no bundled reference: nothing binds, and nothing throws", async () => {
+    const manifest = await actionManifest(input({ references: [] }));
+    bindsNothing(manifest, NAME);
+    bindsNothing(manifest, PRIMITIVE);
+  });
+
+  it("garbage in the provenance map binds nothing, and nothing throws", async () => {
+    for (const junk of [null, 7, "auth-form", [], { ...entry, call: null }, { ...entry, reference: null }, { ...entry, expansionDigest: 7 }]) {
+      bindsNothing(await actionManifest(input({ provenance: { [NAME]: junk } })), NAME);
+    }
+  });
+});
+
+describe("an edited surface recomputes its manifest from its messages", () => {
+  it("a button added to an accepted block surface: no block binding, and the new action is listed, undeclared", async () => {
+    const edited = structuredClone(surface);
+    edited.root.children.push({ component: "button", id: "auth-delete-account", props: { label: "Delete account", variant: "secondary" } });
+    const manifest = await actionManifest(input({ surfaces: [{ name: NAME, messages: emit(edited) }], examples: [{ id: NAME, surface: edited }] }));
+    expect(entryFor(manifest, NAME)).toEqual({
+      surface: NAME,
+      surfaceId: "data_collection",
+      messagesSha256: await sha256Hex(JSON.stringify(emit(edited))),
+      actions: [
+        { name: "auth_delete_account", declared: false },
+        { name: "auth_provider_github", declared: false },
+        { name: "auth_submit", declared: false },
+      ],
+      block: null,
+    });
+  });
+
+  it("copy edited alone: the same actions, none of them bound", async () => {
+    const edited = structuredClone(surface);
+    edited.root.children[0].text = "Welcome back, admin";
+    const manifest = await actionManifest(input({ surfaces: [{ name: NAME, messages: emit(edited) }], examples: [{ id: NAME, surface: edited }] }));
+    bindsNothing(manifest, NAME);
+    expect(entryFor(manifest, NAME).actions.map((a) => a.name)).toEqual(["auth_provider_github", "auth_submit"]);
+  });
+
+  it("messages that are not the stored surface's own emission bind nothing (a stale or altered export)", async () => {
+    const manifest = await actionManifest(input({ surfaces: [{ name: NAME, messages: primitiveMessages }] }));
+    bindsNothing(manifest, NAME);
+  });
+});
+
+describe("undeclared actions and action context fail closed", () => {
+  /** The verified messages with one component's action replaced. */
+  const withAction = (action: Json) => {
+    const altered = structuredClone(messages) as Json[];
+    const components = altered.find((m) => m.updateComponents)!.updateComponents.components as Json[];
+    const button = components.find((c) => c.action?.event?.name === "auth_submit")!;
+    button.action = action;
+    return altered;
+  };
+
+  it("an action the block does not declare binds nothing, and is listed undeclared", async () => {
+    const manifest = await actionManifest(input({ surfaces: [{ name: NAME, messages: withAction({ event: { name: "auth_delete_everything", context: {} } }) }] }));
+    bindsNothing(manifest, NAME);
+    expect(entryFor(manifest, NAME).actions).toContainEqual({ name: "auth_delete_everything", declared: false });
+  });
+
+  it("a block action whose context would carry an entered value binds nothing", async () => {
+    const manifest = await actionManifest(input({ surfaces: [{ name: NAME, messages: withAction({ event: { name: "auth_submit", context: { password: { path: "/password" } } } }) }] }));
+    bindsNothing(manifest, NAME);
+  });
+
+  it("an action with no name binds nothing", async () => {
+    const manifest = await actionManifest(input({ surfaces: [{ name: NAME, messages: withAction({ event: { context: {} } }) }] }));
+    expect(entryFor(manifest, NAME).block).toBeNull();
+  });
+
+  it("two exported surfaces under one name bind nothing: a host could not tell them apart", async () => {
+    const manifest = await actionManifest(input({ surfaces: [{ name: NAME, messages }, { name: NAME, messages }] }));
+    expect(manifest.surfaces).toHaveLength(2);
+    for (const found of manifest.surfaces) expect(found.block).toBeNull();
+  });
+
+  it("messages that name more than one surface report no single surfaceId, and bind nothing", async () => {
+    const two = [...messages, ...emit({ ...surface, intent: "record-collection" })];
+    const manifest = await actionManifest(input({ surfaces: [{ name: NAME, messages: two }] }));
+    expect(entryFor(manifest, NAME).surfaceId).toBeNull();
+    expect(entryFor(manifest, NAME).block).toBeNull();
+  });
+});
diff --git a/packages/composer-core/src/blocks/manifest.ts b/packages/composer-core/src/blocks/manifest.ts
new file mode 100644
index 0000000..e3443bf
--- /dev/null
+++ b/packages/composer-core/src/blocks/manifest.ts
@@ -0,0 +1,195 @@
+/**
+ * Interface blocks (experimental): the action manifest, H2
+ * (docs/blocks/HOST-ACTIONS.md; docs/blocks/PHASE-2-RELEASE-PLAN.md, §7).
+ *
+ * The beta's Catalog export carries one entry per exported surface, in the
+ * export's order. Each entry binds the actions the surface's messages
+ * dispatch by surface and name, recomputed from those messages whenever the
+ * catalog is exported, so an edited surface reports what it dispatches now.
+ *
+ * An action is `declared` only on a surface that verifiably IS its block's
+ * expansion. Its provenance must name an approved block of an approved
+ * sidecar this build bundles, one that B0 (with H1) accepted at load. The
+ * call must pass B1 and the block's constraints. Re-expanded, it must give
+ * exactly the stored surface, and that expansion must emit exactly the
+ * exported messages, each action declared by the block with an empty
+ * context. Only then does the entry carry the block: its id, version,
+ * expansion identity, declared actions and streaming policy.
+ *
+ * Provenance is a claim; the re-expansion is the proof. Provenance that does
+ * not re-expand to the surface binds nothing, and a surface name plus an
+ * action name alone grants nothing. A binding certifies structure, not who
+ * wrote the copy. Verification never throws: whatever cannot be verified
+ * binds nothing. Each entry also pins the messages it describes
+ * (`messagesSha256`), so a host can tell them from altered ones. Even a
+ * binding is a statement for a host to check, never a grant: the host
+ * authorizes every effect on its own server.
+ */
+import { emitSurface, type Profile } from "@aestheticfunction/dspack-emit";
+import { actionEvents } from "./actions";
+import { sha256Hex } from "./digest";
+import { expandBlock, expansionDigest } from "./expand";
+import type { LoadedBlocks } from "./load";
+import { trustedProvenance } from "./provenance";
+import type { BlockDefinition } from "./schema";
+
+type Json = Record<string, unknown>;
+
+export const ACTION_MANIFEST_VERSION = 1 as const;
+
+/** The block a surface verifiably is. */
+export interface ManifestBlock {
+  id: string;
+  version: number;
+  reference: { name: string; dspack: string; version: string };
+  baseSha256: string;
+  intent: string;
+  /** The expansion identity: sha256 of the surface, which equals the call's expansion. */
+  expansionDigest: string;
+  /** The block's declared actions, in sidecar order. */
+  declaredActions: string[];
+  streaming: BlockDefinition["streaming"];
+}
+
+export interface ManifestAction {
+  name: string;
+  /** True only when this surface's verified block declares the name. */
+  declared: boolean;
+}
+
+export interface ManifestSurface {
+  /** The surface's name in the export (its `surfaces[].name`). */
+  surface: string;
+  /**
+   * The A2UI surfaceId its messages create, or null when they do not name
+   * exactly one. It is the slug of the surface's intent, so surfaces of one
+   * intent share it: never look an entry up by it.
+   */
+  surfaceId: string | null;
+  /** sha256 of the compact JSON of its exported messages: the bytes this entry describes. */
+  messagesSha256: string;
+  /** Every action name its messages dispatch, sorted. */
+  actions: ManifestAction[];
+  /** The block this surface verifiably is, or null. */
+  block: ManifestBlock | null;
+}
+
+export interface ActionManifest {
+  v: typeof ACTION_MANIFEST_VERSION;
+  surfaces: ManifestSurface[];
+}
+
+/** A packaged reference the build bundles: its sidecar as loaded (B0 and H1 applied), and its base contract and profile. */
+export interface ManifestReference {
+  loaded: LoadedBlocks;
+  contract: Json;
+  profile?: Profile;
+}
+
+export interface ActionManifestInput {
+  /** The emitted surfaces; those without messages are not exported, so not listed. */
+  surfaces: ReadonlyArray<{ name: string; messages?: unknown[] }>;
+  /** The project's examples, whose ids name its surfaces. */
+  examples: ReadonlyArray<{ id?: unknown; surface?: unknown }>;
+  /** The project's block provenance, keyed by example id. */
+  provenance: Readonly<Record<string, unknown>>;
+  references: readonly ManifestReference[];
+}
+
+const isObject = (value: unknown): value is Json => !!value && typeof value === "object" && !Array.isArray(value);
+
+const sameReference = (a: unknown, b: { name: string; dspack: string; version: string }) =>
+  isObject(a) && a.name === b.name && a.dspack === b.dspack && a.version === b.version;
+
+const emptyContext = (context: unknown) => isObject(context) && Reflect.ownKeys(context).length === 0;
+
+/** The one surfaceId a message stream names, or null. */
+function onlySurfaceId(messages: unknown): string | null {
+  const ids = new Set<string>();
+  const walk = (value: unknown): void => {
+    if (Array.isArray(value)) {
+      value.forEach(walk);
+      return;
+    }
+    if (!isObject(value)) return;
+    if (typeof value.surfaceId === "string") ids.add(value.surfaceId);
+    Object.values(value).forEach(walk);
+  };
+  walk(messages);
+  return ids.size === 1 ? [...ids][0]! : null;
+}
+
+/** The block a surface verifiably is, or null. */
+async function verifiedBlock(
+  name: string,
+  messages: unknown[],
+  events: ReadonlyArray<{ name: unknown; context: unknown }>,
+  input: ActionManifestInput,
+): Promise<ManifestBlock | null> {
+  const record = Object.hasOwn(input.provenance, name) ? input.provenance[name] : undefined;
+  if (!isObject(record)) return null;
+  const reference = input.references.find(
+    ({ loaded }) => loaded.binding === "ok" && loaded.sidecar?.status === "approved" && sameReference(record.reference, loaded.sidecar.reference) && loaded.sidecar.baseSha256 === record.baseSha256,
+  );
+  const sidecar = reference?.loaded.sidecar;
+  if (!reference || !sidecar) return null;
+  const block = reference.loaded.usable.find((b) => b.id === record.block && b.version === record.version);
+  if (!block || block.status !== "approved") return null;
+  const entry = trustedProvenance(record, [sidecar]);
+  if (!entry) return null;
+
+  // The proof: the call re-expands to the stored surface, whose emission is the exported messages.
+  const expanded = expandBlock(block, entry.call, { reference: sidecar.reference, intent: entry.intent });
+  if (!expanded.ok) return null;
+  const digest = await expansionDigest(expanded.surface);
+  if (digest !== entry.expansionDigest) return null;
+  const stored = input.examples.filter((e) => e.id === name && isObject(e.surface));
+  if (stored.length !== 1 || (await expansionDigest(stored[0]!.surface as Json)) !== digest) return null;
+  const own = emitSurface(expanded.surface as never, reference.contract as never, reference.profile ? { profile: reference.profile } : {}).messages;
+  if (JSON.stringify(own) !== JSON.stringify(messages)) return null;
+  if (!events.every((e) => typeof e.name === "string" && block.actions.includes(e.name) && emptyContext(e.context))) return null;
+
+  return {
+    id: block.id,
+    version: block.version,
+    reference: sidecar.reference,
+    baseSha256: sidecar.baseSha256,
+    intent: entry.intent,
+    expansionDigest: digest,
+    declaredActions: [...block.actions],
+    streaming: block.streaming,
+  };
+}
+
+/** The action manifest for an export's surfaces. */
+export async function actionManifest(input: ActionManifestInput): Promise<ActionManifest> {
+  const listed = input.surfaces.filter((s) => s.messages);
+  const counts = new Map<string, number>();
+  for (const s of listed) counts.set(s.name, (counts.get(s.name) ?? 0) + 1);
+
+  const surfaces: ManifestSurface[] = [];
+  for (const s of listed) {
+    const messages = s.messages as unknown[];
+    const events = actionEvents(messages);
+    const names = [...new Set(events.map((e) => e.name).filter((n): n is string => typeof n === "string"))].sort();
+    const surfaceId = onlySurfaceId(messages);
+    let block: ManifestBlock | null = null;
+    // Bound by surface and name: a name the export repeats, or messages naming
+    // more than one surface, could not be told apart, so they bind nothing.
+    if (counts.get(s.name) === 1 && surfaceId !== null) {
+      try {
+        block = await verifiedBlock(s.name, messages, events, input);
+      } catch {
+        block = null;
+      }
+    }
+    surfaces.push({
+      surface: s.name,
+      surfaceId,
+      messagesSha256: await sha256Hex(JSON.stringify(messages)),
+      actions: names.map((name) => ({ name, declared: block !== null && block.declaredActions.includes(name) })),
+      block,
+    });
+  }
+  return { v: ACTION_MANIFEST_VERSION, surfaces };
+}
diff --git a/packages/composer-core/src/blocks/provenance.ts b/packages/composer-core/src/blocks/provenance.ts
index c993f76..01f47a2 100644
--- a/packages/composer-core/src/blocks/provenance.ts
+++ b/packages/composer-core/src/blocks/provenance.ts
@@ -71,8 +71,14 @@ function sameReference(a: Json | undefined, b: { name: string; dspack: string; v
   return !!a && a.name === b.name && a.dspack === b.dspack && a.version === b.version;
 }
 
-/** Validate one stored record against the bundled sidecars; anything untrusted is inert. */
-function trusted(value: Json, sidecars: readonly BlocksSidecar[]): BlockProvenanceEntry | null {
+/**
+ * Validate one stored record against the bundled sidecars: its binding, block
+ * and version, intent, encoding, and a call that passes B1 and the block's
+ * constraints. Null when anything cannot be trusted. It never checks the
+ * record's digest against a surface; the action manifest re-expands the call
+ * for that (manifest.ts).
+ */
+export function trustedProvenance(value: Json, sidecars: readonly BlocksSidecar[]): BlockProvenanceEntry | null {
   const sidecar = sidecars.find((s) => sameReference(value.reference as Json | undefined, s.reference) && s.baseSha256 === value.baseSha256);
   const block = sidecar?.blocks.find((b) => b.id === value.block && b.version === value.version);
   if (!sidecar || !block) return null;
@@ -101,7 +107,7 @@ export function parseProvenance(raw: unknown, sidecars: readonly BlocksSidecar[]
   for (const [id, value] of Object.entries(raw)) {
     if (!isObject(value) || typeof value.block !== "string" || !Number.isInteger(value.version)) continue;
     const inert: InertProvenance = { block: value.block, version: value.version as number, status: "inert" };
-    out[id] = value.status === "inert" ? inert : (trusted(value, sidecars) ?? inert);
+    out[id] = value.status === "inert" ? inert : (trustedProvenance(value, sidecars) ?? inert);
   }
   return out;
 }
@@ -115,7 +121,7 @@ export function provenanceStatus(
 ): ProvenanceStatus {
   if (context.projectKind !== "reference") return "unavailable";
   if ("status" in record) return "inert";
-  return trusted(record as unknown as Json, context.sidecars) ? "refinable" : "inert";
+  return trustedProvenance(record as unknown as Json, context.sidecars) ? "refinable" : "inert";
 }
 
 /** Drop records whose example vanished or whose surface no longer equals the expansion. */
diff --git a/packages/composer-core/src/blocks/view.ts b/packages/composer-core/src/blocks/view.ts
index c4ce70c..5e5cceb 100644
--- a/packages/composer-core/src/blocks/view.ts
+++ b/packages/composer-core/src/blocks/view.ts
@@ -8,9 +8,11 @@
  * A template may only emit what generation itself could emit under the same
  * profile; anything else would be refused downstream. Parity with the real
  * generation schema is asserted by packages/block-bench, so this port cannot
- * drift silently.
+ * drift silently. The view also names the components the emitter gives an
+ * action, which H1 holds to bounded ids (actions.ts).
  */
 import type { Profile } from "@aestheticfunction/dspack-emit";
+import { actionComponents } from "./actions";
 
 type Json = Record<string, unknown>;
 
@@ -21,6 +23,8 @@ export interface GenerationView {
   components: Set<string>;
   /** Components whose id is required because a profile join keys on self.id. */
   joinIdComponents: Set<string>;
+  /** Components whose emitted instances dispatch an action (H1, actions.ts). */
+  actionComponents: Set<string>;
 }
 
 function usesCasualty(value: unknown, casualties: Set<string>): boolean {
@@ -65,5 +69,5 @@ export function generationView(contract: Json, profile?: Profile): GenerationVie
     const subs = (((component.composition ?? {}) as Json).subComponents ?? []) as Array<{ id: string }>;
     for (const sub of subs) ids.add(sub.id);
   }
-  return { contract: view, components: ids, joinIdComponents: joinIdComponents(profile) };
+  return { contract: view, components: ids, joinIdComponents: joinIdComponents(profile), actionComponents: actionComponents(profile) };
 }