From d72ca001ce698b46dd356534c30d1ab5ba373512 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 16 Oct 2026 19:03:37 +0000
Subject: [PATCH 1/4] Blocks catalog and provenance UI: pin the verdict, the
 catalog and the lifecycle, fail-first

Step 4 of the Phase 2 release plan (sections 7 H3 and 8). Tests only:

- composer-core: provenanceVerdict earns "made with block X vN" only by
  exact expansion identity (a trusted record whose call re-expands to the
  digest it recorded, on a surface that is that expansion); everything else
  is inert with its specific reason (reference, base, block, version,
  validation, expansion, edited, not-offered, stored) and no label; imported
  and repository projects are unavailable; a verdict carries no action or
  grant, and a labelled surface's altered messages still bind nothing.
  parseProvenance keeps the reason it reduced a record for.
- runtime: blocksCatalog lists every bundled block with reference, version,
  status, intents, declared actions and streaming policy; provenanceVerdicts
  per surface; import keeps reasons.
- e2e (experimental): the read-only Catalog section; Preview's provenance
  line and host-owned note, with no request on any action; edited, duplicated,
  deleted, imported, forged and stale provenance; an Example session's save
  pruning its provenance (it does not today: the duplicate carries 1 stale
  record).
- e2e (default build): an imported beta file's provenance is never stored
  and no block UI appears (a guard; passes today).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R6Ax8qvfN3gYUC85oSGnoi
---
 .../experimental/blocks-runtime.test.ts       | 100 +++++++
 e2e/composer-blocks-provenance.spec.ts        | 266 ++++++++++++++++++
 e2e/composer-prod-smoke.spec.ts               |  27 ++
 .../src/blocks/provenance-verdict.test.ts     | 231 +++++++++++++++
 .../src/blocks/provenance.test.ts             |   8 +-
 playwright.composer-experimental.config.ts    |   2 +-
 6 files changed, 629 insertions(+), 5 deletions(-)
 create mode 100644 e2e/composer-blocks-provenance.spec.ts
 create mode 100644 packages/composer-core/src/blocks/provenance-verdict.test.ts

diff --git a/apps/composer/experimental/blocks-runtime.test.ts b/apps/composer/experimental/blocks-runtime.test.ts
index 3c922aa..a1fa43b 100644
--- a/apps/composer/experimental/blocks-runtime.test.ts
+++ b/apps/composer/experimental/blocks-runtime.test.ts
@@ -16,8 +16,12 @@ import {
   blockBinding,
   blockContext,
   blockRunFor,
+  blocksCatalog,
   chooseBlock,
+  importProvenance,
+  memoryProvenanceStore,
   planGoalWithBlocks,
+  provenanceVerdicts,
   readBlocksBeta,
   runHostedBlockBuild,
   withActionManifest,
@@ -515,3 +519,99 @@ describe("the beta's Catalog export carries the action manifest (docs/blocks/HOS
     for (const s of surfaces) expect(s.block).toBeNull();
   });
 });
+
+describe("the Blocks catalog (Phase 2 plan, §7, H3): every bundled block, read-only", () => {
+  it("each packaged reference lists its blocks with version, status, intents, declared actions and streaming policy", async () => {
+    const catalog = await blocksCatalog();
+    expect(catalog.map((r) => r.referenceId)).toEqual(["shadcn", "astryx"]);
+    const astryxRef = catalog.find((r) => r.referenceId === "astryx")!;
+    expect(astryxRef).toMatchObject({ label: "Astryx", reference: { name: "Astryx", dspack: "0.4", version: "0.1.4" }, binding: "ok", sidecarStatus: "approved", issues: [] });
+    expect(astryxRef.withheld).toBeUndefined();
+    expect(astryxRef.blocks.map((b) => b.id)).toEqual(["records-table", "auth-form", "guide-steps"]);
+    expect(astryxRef.blocks.find((b) => b.id === "auth-form")).toEqual({
+      id: "auth-form",
+      name: "Account access",
+      version: 1,
+      status: "approved",
+      offered: true,
+      disabled: [],
+      intents: ["data-collection"],
+      actions: ["auth_submit", "auth_forgot", "auth_provider_google", "auth_provider_github", "auth_provider_microsoft", "auth_provider_apple"],
+      streaming: "disable-actions-until-complete",
+    });
+    expect(astryxRef.blocks.find((b) => b.id === "guide-steps")).toMatchObject({ actions: ["guide_start", "guide_save"], streaming: "static-safe" });
+    const shadcnRef = catalog.find((r) => r.referenceId === "shadcn")!;
+    expect(shadcnRef.reference).toEqual({ name: "shadcn/ui", dspack: "0.4", version: "3.2.0" });
+    expect(shadcnRef.withheld).toMatch(/withheld from this beta/);
+  });
+
+  it("it is data only: no handler, no function, nothing that could run an action", async () => {
+    const catalog = await blocksCatalog();
+    expect(JSON.parse(JSON.stringify(catalog))).toEqual(catalog);
+  });
+});
+
+describe("provenance verdicts for a project's surfaces (Phase 2 plan, §8)", () => {
+  async function accepted() {
+    const base = (await blockBinding(reference))!;
+    const block = base.sidecar.blocks.find((b) => b.id === "auth-form")!;
+    const example = block.examples[0]!;
+    const expanded = expandBlock(block, example.call, { reference: base.sidecar.reference, intent: example.intent });
+    if (!expanded.ok) throw new Error(expanded.message);
+    const surface = expanded.surface as unknown as Json;
+    const entry = {
+      v: 1,
+      reference: base.sidecar.reference,
+      baseSha256: base.sidecar.baseSha256,
+      block: "auth-form",
+      version: 1,
+      intent: example.intent,
+      blockSchemaSha256: "a".repeat(64),
+      encoding: "named",
+      call: example.call,
+      expansionDigest: await expansionDigest(surface),
+    };
+    const edited = structuredClone(surface);
+    edited.root.children[0].text = "Edited by hand";
+    return { entry, surface, edited };
+  }
+
+  it("a reference project: the accepted block surface is made with auth-form v1 and refinable; an edited one is inert and unlabelled", async () => {
+    const { entry, surface, edited } = await accepted();
+    const verdicts = await provenanceVerdicts({
+      provenance: { "ex.chat-1": entry, "ex.chat-2": entry, "ex.gone": entry },
+      examples: [
+        { id: "ex.chat-1", surface },
+        { id: "ex.chat-2", surface: edited },
+      ],
+      project: { kind: "reference", referenceId: "astryx" },
+    });
+    expect(verdicts["ex.chat-1"]).toEqual({ block: "auth-form", version: 1, madeWith: true, status: "refinable" });
+    expect(verdicts["ex.chat-2"]).toEqual({ block: "auth-form", version: 1, madeWith: false, status: "inert", reason: "edited" });
+    // A record whose surface is gone has no surface to describe; the next save drops it.
+    expect(verdicts["ex.gone"]).toBeUndefined();
+  });
+
+  it("a shadcn/ui project trusts only shadcn/ui provenance", async () => {
+    const { entry, surface } = await accepted();
+    const verdicts = await provenanceVerdicts({ provenance: { a: entry }, examples: [{ id: "a", surface }], project: { kind: "reference", referenceId: "shadcn" } });
+    expect(verdicts.a).toMatchObject({ madeWith: false, status: "inert", reason: "reference" });
+  });
+
+  it("an imported project's provenance is unavailable; a repository project's too", async () => {
+    const { entry, surface } = await accepted();
+    for (const [kind, reason] of [["imported", "imported"], ["agent", "repository"]] as const) {
+      const verdicts = await provenanceVerdicts({ provenance: { a: entry }, examples: [{ id: "a", surface }], project: { kind } });
+      expect(verdicts.a).toEqual({ block: "auth-form", version: 1, madeWith: true, status: "unavailable", reason });
+    }
+  });
+
+  it("an import keeps the reason each record was reduced to inert for", async () => {
+    const { entry } = await accepted();
+    const holder = { current: {} as Record<string, unknown> };
+    await importProvenance(memoryProvenanceStore(holder, "import-test"), { a: entry, b: { ...entry, version: 4 }, c: { ...entry, baseSha256: "1".repeat(64) } });
+    expect(holder.current.a).toEqual(entry);
+    expect(holder.current.b).toEqual({ block: "auth-form", version: 4, status: "inert", reason: "version" });
+    expect(holder.current.c).toEqual({ block: "auth-form", version: 1, status: "inert", reason: "base" });
+  });
+});
diff --git a/e2e/composer-blocks-provenance.spec.ts b/e2e/composer-blocks-provenance.spec.ts
new file mode 100644
index 0000000..ab2d238
--- /dev/null
+++ b/e2e/composer-blocks-provenance.spec.ts
@@ -0,0 +1,266 @@
+/**
+ * Phase 2, step 4 (docs/blocks/PHASE-2-RELEASE-PLAN.md, §7 H3 and §8) in the
+ * EXPERIMENTAL composer artifact: the read-only Blocks catalog, Preview's
+ * provenance line and host-owned wording, and provenance through save,
+ * export, import, duplicate and delete. Agent-free: /api/models is stubbed,
+ * every build is scripted, and no model is called.
+ */
+import AxeBuilder from "@axe-core/playwright";
+import { expect, test, type Page } from "@playwright/test";
+
+type Json = Record<string, any>;
+
+/** WCAG 2 A/AA over what this step adds, and nothing else on the page. */
+const scanOf = (page: Page, testId: string) =>
+  new AxeBuilder({ page }).withTags(["wcag2a", "wcag2aa"]).disableRules(["region"]).include(`[data-testid="${testId}"]`).analyze();
+
+const SWITCH_ON = { enabled: true, references: ["shadcn", "astryx"], blocks: ["records-table", "auth-form", "guide-steps"] };
+
+async function setUp(page: Page) {
+  await page.addInitScript(() => localStorage.setItem("composer.experimental.v1", JSON.stringify({ blocks: true })));
+  await page.route("**/api/models", (route) => route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify({ models: ["scripted"], blocks: SWITCH_ON }) }));
+  await page.goto("/");
+}
+
+async function newProject(page: Page, name: string) {
+  await page.getByTestId("nav-projects").click();
+  await page.getByTestId("new-project-name").fill(name);
+  await page.getByTestId("new-source-shadcn").click();
+  await page.getByTestId("new-project-create").click();
+  await expect(page.getByTestId("build-prompt")).toBeVisible();
+}
+
+/** A scripted sign-in build on shadcn/ui expands auth-form; accept it and return its example id. */
+async function acceptAuthForm(page: Page): Promise<string> {
+  await page.getByTestId("build-model").selectOption("scripted");
+  await page.getByTestId("build-intent").selectOption("structured-input");
+  await page.getByTestId("build-prompt").fill("a sign-in form with email and password");
+  await page.getByTestId("build-run").click();
+  await expect(page.getByTestId("build-gate-summary-1")).toContainText("Follows your design-system rules", { timeout: 30_000 });
+  await expect(page.getByTestId("build-block-1")).toContainText("block auth-form v1");
+  await page.getByTestId("build-accept-1").click();
+  await expect(page.getByTestId("build-accepted-1")).toContainText(/ex\.chat-\d+/);
+  return (await page.getByTestId("build-accepted-1").innerText()).match(/ex\.chat-\d+/)![0];
+}
+
+/** Every provenance map in this browser, by storage key. */
+const storedProvenance = (page: Page) =>
+  page.evaluate(() => {
+    const out: Record<string, Record<string, unknown>> = {};
+    for (let i = 0; i < localStorage.length; i++) {
+      const key = localStorage.key(i)!;
+      if (key.startsWith("composer.project.blocks.")) out[key] = JSON.parse(localStorage.getItem(key)!);
+    }
+    return out;
+  });
+
+/** Wait until provenance for `id` is stored (it is written after the accept, off the critical path). */
+async function provenanceStoredFor(page: Page, id: string) {
+  await expect.poll(async () => Object.values(await storedProvenance(page)).some((map) => id in map)).toBe(true);
+}
+
+/** Edit the accepted auth-form surface's "Email address" label in Surfaces, and save. */
+async function editSurface(page: Page, id: string) {
+  await page.getByTestId("nav-surfaces").click();
+  await page.getByTestId(`edit-${id}`).click();
+  const texts = page.locator('[data-testid^="node-text-"]');
+  const n = await texts.count();
+  let edited = false;
+  for (let i = 0; i < n && !edited; i++) {
+    if ((await texts.nth(i).inputValue()) === "Email address") {
+      await texts.nth(i).fill("Work email address");
+      edited = true;
+    }
+  }
+  expect(edited).toBe(true);
+  await expect(page.getByTestId("save-scenario")).toBeEnabled();
+  await page.getByTestId("save-scenario").click();
+}
+
+/** Export the open project from the hub and return the file's JSON. */
+async function exportProjectFile(page: Page): Promise<Json> {
+  await page.getByTestId("nav-projects").click();
+  const [download] = await Promise.all([page.waitForEvent("download"), page.locator('[data-testid^="project-export-"]').first().click()]);
+  const path = await download.path();
+  const { readFileSync } = await import("node:fs");
+  return JSON.parse(readFileSync(path!, "utf8")) as Json;
+}
+
+/** Import a project file through the hub. */
+async function importProjectFile(page: Page, file: Json, name: string) {
+  await page.getByTestId("nav-projects").click();
+  await page.getByTestId("import-project-input").setInputFiles({ name: `${name}.composerproject.json`, mimeType: "application/json", buffer: Buffer.from(JSON.stringify(file)) });
+  await expect(page.getByTestId("build-prompt")).toBeVisible();
+}
+
+test("the Catalog lists every bundled block, read-only: reference, version, status, intents, declared actions and streaming policy", async ({ page }) => {
+  await setUp(page);
+  await newProject(page, "Catalog");
+  await page.getByTestId("nav-inventory").click();
+  const catalog = page.getByTestId("blocks-catalog");
+  await expect(catalog).toBeVisible();
+  await expect(catalog).toContainText("Interface blocks");
+
+  const shadcn = page.getByTestId("blocks-catalog-ref-shadcn");
+  await expect(shadcn).toContainText("shadcn/ui 3.2.0");
+  await expect(shadcn).toContainText("this project");
+  await expect(shadcn).toContainText(/withheld from this beta/);
+  const astryx = page.getByTestId("blocks-catalog-ref-astryx");
+  await expect(astryx).toContainText("Astryx 0.1.4");
+  await expect(astryx).not.toContainText("this project");
+
+  const auth = page.getByTestId("blocks-catalog-shadcn-auth-form");
+  for (const text of ["auth-form", "Account access", "v1", "approved", "structured-input", "auth_submit", "auth_forgot", "auth_provider_apple", "disable actions until complete"]) {
+    await expect(auth).toContainText(text);
+  }
+  const guide = page.getByTestId("blocks-catalog-astryx-guide-steps");
+  for (const text of ["guide-steps", "structured-editing", "guide_start", "guide_save", "static-safe"]) await expect(guide).toContainText(text);
+  await expect(page.getByTestId("blocks-catalog-astryx-records-table")).toContainText("records_refresh");
+
+  // Read-only: nothing in it can be pressed, typed into or chosen.
+  await expect(catalog.locator("button, input, select, textarea, a[href]")).toHaveCount(0);
+  await expect(catalog).toContainText(/host-owned/);
+  expect((await scanOf(page, "blocks-catalog")).violations).toEqual([]);
+});
+
+test("trusted: an accepted block surface is made with its block and refinable; its actions are host-owned and Composer sends nothing", async ({ page }) => {
+  await setUp(page);
+  await newProject(page, "Trusted");
+  const id = await acceptAuthForm(page);
+  await provenanceStoredFor(page, id);
+
+  await page.getByTestId("nav-preview").click();
+  await page.getByTestId(`surface-${id}`).click();
+  const line = page.getByTestId("preview-provenance");
+  await expect(line).toContainText("Made with block auth-form v1");
+  await expect(line).toContainText(/refinable/i);
+  const note = page.getByTestId("preview-host-owned");
+  await expect(note).toContainText("host-owned");
+  await expect(note).toContainText(/not executed here/);
+
+  // Every action the surface dispatches is recorded, and none leaves the page.
+  const requests: string[] = [];
+  page.on("request", (r) => requests.push(`${r.method()} ${r.url()}`));
+  const buttons = page.locator("[data-project-canvas] button:not([disabled])");
+  const count = await buttons.count();
+  expect(count).toBeGreaterThan(0);
+  for (let i = 0; i < count; i++) await buttons.nth(i).click();
+  await expect(page.getByTestId("action-log")).toContainText("auth_submit");
+  await page.waitForTimeout(500);
+  expect(requests).toEqual([]);
+
+  expect((await scanOf(page, "preview-provenance")).violations).toEqual([]);
+  expect((await scanOf(page, "preview-host-owned")).violations).toEqual([]);
+});
+
+test("edited: saving a hand edit drops the provenance, and the surface previews as an ordinary one", async ({ page }) => {
+  await setUp(page);
+  await newProject(page, "Edited");
+  const id = await acceptAuthForm(page);
+  await provenanceStoredFor(page, id);
+
+  await editSurface(page, id);
+  await expect.poll(async () => Object.values(await storedProvenance(page)).some((map) => id in map)).toBe(false);
+  await page.getByTestId("nav-preview").click();
+  await page.getByTestId(`surface-${id}`).click();
+  await expect(page.locator("[data-project-canvas]")).toContainText("Work email address");
+  await expect(page.getByTestId("preview-provenance")).toHaveCount(0);
+  await expect(page.getByTestId("preview-host-owned")).toHaveCount(0);
+});
+
+test("duplicated and deleted: a duplicate carries provenance that still verifies; deleting a project deletes its provenance", async ({ page }) => {
+  await setUp(page);
+  await newProject(page, "Original");
+  const id = await acceptAuthForm(page);
+  await provenanceStoredFor(page, id);
+
+  await page.getByTestId("nav-projects").click();
+  const grid = page.getByTestId("projects-grid");
+  const originalId = (await grid.locator(".af-card").filter({ hasText: "Original" }).first().getAttribute("data-testid"))!.replace("project-", "");
+  await page.getByTestId(`project-duplicate-${originalId}`).click();
+  await expect(grid).toContainText("Original copy");
+  const copyId = (await grid.locator(".af-card").filter({ hasText: "Original copy" }).first().getAttribute("data-testid"))!.replace("project-", "");
+  expect(Object.keys((await storedProvenance(page))[`composer.project.blocks.${copyId}`] ?? {})).toEqual([id]);
+
+  await page.getByTestId(`project-build-${copyId}`).click();
+  await page.getByTestId("nav-preview").click();
+  await page.getByTestId(`surface-${id}`).click();
+  await expect(page.getByTestId("preview-provenance")).toContainText("Made with block auth-form v1");
+  await expect(page.getByTestId("preview-provenance")).toContainText(/refinable/i);
+
+  await page.getByTestId("nav-projects").click();
+  await page.getByTestId(`project-delete-${copyId}`).click();
+  await page.getByTestId(`project-delete-confirm-${copyId}`).click();
+  await expect(grid).not.toContainText("Original copy");
+  const left = await storedProvenance(page);
+  expect(left[`composer.project.blocks.${copyId}`]).toBeUndefined();
+  expect(Object.keys(left[`composer.project.blocks.${originalId}`] ?? {})).toEqual([id]);
+});
+
+test("imported: provenance survives export and import, still labels the surface, and is unavailable for refinement", async ({ page }) => {
+  await setUp(page);
+  await newProject(page, "Portable blocks");
+  const id = await acceptAuthForm(page);
+  await provenanceStoredFor(page, id);
+
+  const file = await exportProjectFile(page);
+  expect(Object.keys(file.blockProvenance ?? {})).toEqual([id]);
+  await importProjectFile(page, file, "portable-blocks");
+  await page.getByTestId("nav-preview").click();
+  await page.getByTestId(`surface-${id}`).click();
+  const line = page.getByTestId("preview-provenance");
+  await expect(line).toContainText("Made with block auth-form v1");
+  await expect(line).toContainText(/unavailable/i);
+  await expect(line).toContainText("imported projects never refine from provenance");
+  expect((await scanOf(page, "preview-provenance")).violations).toEqual([]);
+});
+
+test("forged and stale: an imported record that does not verify is inert, names the reason, and earns no label", async ({ page }) => {
+  await setUp(page);
+  await newProject(page, "Forgery source");
+  const id = await acceptAuthForm(page);
+  await provenanceStoredFor(page, id);
+  const file = await exportProjectFile(page);
+  const record = file.blockProvenance[id] as Json;
+
+  // A forged call under the recorded digest: it validates, but does not expand to this surface.
+  const forgedCall = structuredClone(file);
+  forgedCall.name = "Forged call";
+  forgedCall.blockProvenance[id] = { ...record, call: { ...record.call, title: "Someone else's sign in" } };
+  await importProjectFile(page, forgedCall, "forged-call");
+  await page.getByTestId("nav-preview").click();
+  await page.getByTestId(`surface-${id}`).click();
+  await expect(page.getByTestId("preview-provenance")).toContainText(/inert/i);
+  await expect(page.getByTestId("preview-provenance")).toContainText("its call does not expand to this surface");
+  await expect(page.getByTestId("preview-provenance")).not.toContainText("Made with");
+  await expect(page.getByTestId("preview-host-owned")).toHaveCount(0);
+
+  // A record for a block version this build does not have: reduced to inert on import, with its reason kept.
+  const stale = structuredClone(file);
+  stale.name = "Stale version";
+  stale.blockProvenance[id] = { ...record, version: 2 };
+  await importProjectFile(page, stale, "stale-version");
+  await page.getByTestId("nav-preview").click();
+  await page.getByTestId(`surface-${id}`).click();
+  await expect(page.getByTestId("preview-provenance")).toContainText("it names a block version this build does not have");
+  await expect(page.getByTestId("preview-provenance")).not.toContainText("Made with");
+  expect((await scanOf(page, "preview-provenance")).violations).toEqual([]);
+});
+
+test("an Example session's save prunes its provenance too, so duplicating it carries nothing stale", async ({ page }) => {
+  await setUp(page);
+  await page.getByTestId("example-open-shadcn").click();
+  await expect(page.getByTestId("example-banner")).toBeVisible();
+  await page.getByTestId("nav-build").click();
+  const id = await acceptAuthForm(page);
+  await editSurface(page, id);
+  // Let the accept's provenance write and the save's prune settle before duplicating.
+  await page.waitForTimeout(500);
+  await page.getByTestId("example-duplicate").click();
+  await expect(page.getByTestId("project-context")).toContainText("My shadcn/ui project");
+  await expect.poll(async () => Object.values(await storedProvenance(page)).filter((map) => id in map).length).toBe(0);
+  await page.getByTestId("nav-preview").click();
+  await page.getByTestId(`surface-${id}`).click();
+  await expect(page.locator("[data-project-canvas]")).toContainText("Work email address");
+  await expect(page.getByTestId("preview-provenance")).toHaveCount(0);
+});
diff --git a/e2e/composer-prod-smoke.spec.ts b/e2e/composer-prod-smoke.spec.ts
index 98b3082..487fb7a 100644
--- a/e2e/composer-prod-smoke.spec.ts
+++ b/e2e/composer-prod-smoke.spec.ts
@@ -675,6 +675,33 @@ test("the Catalog export is today's: the catalog and each surface's messages, an
   expect(text).toBe(JSON.stringify(bundle, null, 2));
 });
 
+test("a default build ignores and drops block provenance: an imported file's provenance is never stored, and no Blocks catalog or provenance line appears", async ({ page }) => {
+  // A beta export carries blockProvenance; production drops it on import and
+  // shows no block UI (docs/blocks/PHASE-2-RELEASE-PLAN.md, §8).
+  await page.addInitScript(() => {
+    localStorage.setItem("composer.experimental.v1", JSON.stringify({ blocks: true }));
+  });
+  await page.goto("/");
+  await newProject(page, "shadcn", "Beta file");
+  await page.getByTestId("nav-projects").click();
+  const [download] = await Promise.all([page.waitForEvent("download"), page.locator('[data-testid^="project-export-"]').first().click()]);
+  const file = JSON.parse(readFileSync((await download.path())!, "utf8")) as Record<string, any>;
+  expect(file).not.toHaveProperty("blockProvenance");
+  const id = String(((file.contract?.examples ?? []) as Array<{ id: string }>)[0]?.id ?? "ex.chat-1");
+  file.name = "Beta file with provenance";
+  file.blockProvenance = { [id]: { v: 1, reference: { name: "shadcn/ui", dspack: "0.4", version: "3.2.0" }, baseSha256: "0".repeat(64), block: "auth-form", version: 1, intent: "structured-input", blockSchemaSha256: "a".repeat(64), encoding: "named", call: {}, expansionDigest: "b".repeat(64) } };
+  await page.getByTestId("import-project-input").setInputFiles({ name: "beta.composerproject.json", mimeType: "application/json", buffer: Buffer.from(JSON.stringify(file)) });
+  await expect(page.getByTestId("project-context")).toContainText("Beta file with provenance");
+  const keys = await page.evaluate(() => Array.from({ length: localStorage.length }, (_, i) => localStorage.key(i)!).filter((k) => k.startsWith("composer.project.blocks.")));
+  expect(keys).toEqual([]);
+  await page.getByTestId("nav-inventory").click();
+  await expect(page.getByTestId("catalog-summary")).toBeVisible();
+  await expect(page.getByTestId("blocks-catalog")).toHaveCount(0);
+  await page.getByTestId("nav-preview").click();
+  await expect(page.getByTestId("preview-provenance")).toHaveCount(0);
+  await expect(page.getByTestId("preview-host-owned")).toHaveCount(0);
+});
+
 test("the default build ships no interface-block code (docs/BLOCKS.md: blocks stay out of default builds)", () => {
   // Scans the served artifact on disk, so a lazily loaded chunk cannot hide it.
   const chunks = fileURLToPath(new URL("../apps/composer/out/_next/static/chunks/", import.meta.url));
diff --git a/packages/composer-core/src/blocks/provenance-verdict.test.ts b/packages/composer-core/src/blocks/provenance-verdict.test.ts
new file mode 100644
index 0000000..df820f4
--- /dev/null
+++ b/packages/composer-core/src/blocks/provenance-verdict.test.ts
@@ -0,0 +1,231 @@
+/**
+ * The provenance verdict (docs/blocks/PHASE-2-RELEASE-PLAN.md, §8; step 4):
+ * what the beta's Preview says about a surface's block provenance. A surface
+ * earns "made with block X vN" only by exact expansion identity: the record
+ * is trusted against a bundled sidecar, its call re-expands to the digest it
+ * recorded, and the surface is that expansion. Anything less is inert, with
+ * the specific reason, and no label. The verdict states what a surface is;
+ * it never carries an action or a grant.
+ */
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { beforeAll, describe, expect, it } from "vitest";
+import { loadProfile, type Profile } from "@aestheticfunction/dspack-emit";
+import {
+  actionManifest,
+  expandBlock,
+  expansionDigest,
+  loadBlocks,
+  parseBlocksSidecar,
+  parseProvenance,
+  PROVENANCE_REASON_TEXT,
+  provenanceVerdict,
+  type LoadedBlocks,
+  type ProvenanceVerdict,
+} from "./index";
+
+type Json = Record<string, any>;
+const repo = (rel: string) => fileURLToPath(new URL(`../../../../${rel}`, import.meta.url));
+const json = (rel: string) => JSON.parse(readFileSync(repo(rel), "utf8")) as Json;
+
+const rawSidecar = json("apps/composer/experimental/blocks/astryx.blocks.json");
+const contract = json("apps/composer/astryx-project/astryx.dspack.json");
+const profile = loadProfile(json("apps/composer/astryx-project/astryx.profile.json") as never) as Profile;
+const parsed = parseBlocksSidecar(rawSidecar);
+if (!parsed.ok) throw new Error(JSON.stringify(parsed.issues));
+const sidecar = parsed.sidecar;
+const authForm = sidecar.blocks.find((b) => b.id === "auth-form")!;
+const example = authForm.examples[0]!;
+const expanded = expandBlock(authForm, example.call, { reference: sidecar.reference, intent: example.intent });
+if (!expanded.ok) throw new Error(expanded.message);
+const surface = expanded.surface as unknown as Json;
+
+/** The same surface after a hand edit: no longer the expansion. */
+const edited = structuredClone(surface);
+edited.root.children[0].text = "Edited by hand";
+
+let loaded: LoadedBlocks;
+let record: Json;
+const REFERENCE_PROJECT = { kind: "reference" as const, reference: sidecar.reference };
+
+beforeAll(async () => {
+  loaded = await loadBlocks(rawSidecar, { baseContract: contract, profile });
+  record = {
+    v: 1,
+    reference: sidecar.reference,
+    baseSha256: sidecar.baseSha256,
+    block: "auth-form",
+    version: 1,
+    intent: example.intent,
+    blockSchemaSha256: "a".repeat(64),
+    encoding: "named",
+    call: example.call,
+    expansionDigest: await expansionDigest(surface),
+  };
+});
+
+const verdict = (overrides: Partial<Parameters<typeof provenanceVerdict>[0]> = {}) =>
+  provenanceVerdict({ record, surface, loaded: [loaded], project: REFERENCE_PROJECT, ...overrides });
+
+describe("trusted provenance earns the label", () => {
+  it("a reference project's accepted block surface is made with its block, and refinable", async () => {
+    expect(await verdict()).toEqual({ block: "auth-form", version: 1, madeWith: true, status: "refinable" });
+  });
+
+  it("an Example session is a reference project too", async () => {
+    expect(await verdict({ project: { kind: "reference", reference: sidecar.reference } })).toMatchObject({ madeWith: true, status: "refinable" });
+  });
+});
+
+describe("only exact expansion identity earns the label", () => {
+  it("edited: a surface changed after acceptance is inert, with no label; saving drops the record", async () => {
+    expect(await verdict({ surface: edited })).toEqual({ block: "auth-form", version: 1, madeWith: false, status: "inert", reason: "edited" });
+  });
+
+  it("forged digest: a record that claims the edited surface's digest still cannot label it, because its call does not expand to it", async () => {
+    const forged = { ...record, expansionDigest: await expansionDigest(edited) };
+    expect(await verdict({ record: forged, surface: edited })).toEqual({ block: "auth-form", version: 1, madeWith: false, status: "inert", reason: "expansion" });
+  });
+
+  it("forged call: another valid call under the recorded digest does not expand to it", async () => {
+    const forged = { ...record, call: { ...example.call, title: "Someone else's title" } };
+    expect(await verdict({ record: forged })).toEqual({ block: "auth-form", version: 1, madeWith: false, status: "inert", reason: "expansion" });
+  });
+
+  it("forged or stale bindings: each is inert, with the specific reason", async () => {
+    const cases: Array<[string, Json, string]> = [
+      ["a reference this build does not bundle", { ...record, reference: { name: "Elsewhere", dspack: "0.4", version: "9.9.9" } }, "reference"],
+      ["another base contract", { ...record, baseSha256: "0".repeat(64) }, "base"],
+      ["a block this build does not bundle", { ...record, block: "auth-wizard" }, "block"],
+      ["a version this build does not bundle", { ...record, version: 2 }, "version"],
+      ["a call that fails B1", { ...record, call: { ...example.call, mode: "sign-ip" } }, "validation"],
+      ["an intent the block does not declare", { ...record, intent: "record-collection" }, "validation"],
+      ["the wrong encoding", { ...record, encoding: "positional" }, "validation"],
+    ];
+    for (const [what, forged, reason] of cases) {
+      expect(await verdict({ record: forged }), what).toEqual({ block: forged.block, version: forged.version, madeWith: false, status: "inert", reason });
+    }
+  });
+
+  it("a reference project only trusts provenance for its own reference", async () => {
+    const shadcn = { name: "shadcn/ui", dspack: "0.4", version: "3.2.0" };
+    expect(await verdict({ project: { kind: "reference", reference: shadcn } })).toMatchObject({ madeWith: false, status: "inert", reason: "reference" });
+  });
+
+  it("a sidecar that no longer binds to this build's base contract vouches for nothing", async () => {
+    const moved: LoadedBlocks = { ...loaded, binding: "mismatch", usable: [] };
+    expect(await verdict({ loaded: [moved] })).toMatchObject({ madeWith: false, status: "inert", reason: "base" });
+  });
+
+  it("a record already reduced to inert keeps its stated reason, or says it was stored inert; neither earns a label", async () => {
+    expect(await verdict({ record: { block: "auth-form", version: 2, status: "inert", reason: "version" } })).toEqual({ block: "auth-form", version: 2, madeWith: false, status: "inert", reason: "version" });
+    expect(await verdict({ record: { block: "auth-form", version: 1, status: "inert" } })).toEqual({ block: "auth-form", version: 1, madeWith: false, status: "inert", reason: "stored" });
+    expect(await verdict({ record: { block: "auth-form", version: 1, status: "inert", reason: "grants-everything" } })).toMatchObject({ madeWith: false, reason: "stored" });
+  });
+
+  it("nothing to say about garbage: no verdict", async () => {
+    for (const junk of [null, "x", 7, [], {}, { block: "auth-form" }, { version: 1 }, { block: 1, version: 1 }]) {
+      expect(await verdict({ record: junk })).toBeNull();
+    }
+  });
+
+  it("a missing surface is never the expansion", async () => {
+    expect(await verdict({ surface: undefined })).toMatchObject({ madeWith: false, status: "inert", reason: "edited" });
+  });
+});
+
+describe("imported, repository and unoffered provenance", () => {
+  it("imported: the surface is still made with the block, but an imported project never refines from it", async () => {
+    expect(await verdict({ project: { kind: "imported" } })).toEqual({ block: "auth-form", version: 1, madeWith: true, status: "unavailable", reason: "imported" });
+  });
+
+  it("a repository project never refines from it either", async () => {
+    expect(await verdict({ project: { kind: "agent" } })).toEqual({ block: "auth-form", version: 1, madeWith: true, status: "unavailable", reason: "repository" });
+  });
+
+  it("an imported project's forged provenance is inert, not merely unavailable", async () => {
+    expect(await verdict({ project: { kind: "imported" }, surface: edited })).toMatchObject({ madeWith: false, status: "inert", reason: "edited" });
+  });
+
+  it("a block this build does not offer (draft, or disabled at load) labels the surface but cannot refine it", async () => {
+    const draftBlock: LoadedBlocks = { ...loaded, sidecar: { ...sidecar, blocks: sidecar.blocks.map((b) => (b.id === "auth-form" ? { ...b, status: "draft" as const } : b)) } };
+    const draftSidecar: LoadedBlocks = { ...loaded, sidecar: { ...sidecar, status: "draft" } };
+    const disabled: LoadedBlocks = { ...loaded, usable: loaded.usable.filter((b) => b.id !== "auth-form"), disabled: [{ block: "auth-form", issues: ["B0"] }] };
+    for (const [what, l] of [["draft block", draftBlock], ["draft sidecar", draftSidecar], ["disabled at load", disabled]] as const) {
+      expect(await verdict({ loaded: [l] }), what).toEqual({ block: "auth-form", version: 1, madeWith: true, status: "inert", reason: "not-offered" });
+    }
+  });
+});
+
+describe("provenance never grants action authority", () => {
+  it("a verdict carries what the surface is, never an action, a declaration or a grant", async () => {
+    const all: ProvenanceVerdict[] = [
+      (await verdict())!,
+      (await verdict({ surface: edited }))!,
+      (await verdict({ project: { kind: "imported" } }))!,
+      (await verdict({ record: { ...record, version: 2 } }))!,
+    ];
+    for (const v of all) {
+      for (const key of Object.keys(v)) expect(["block", "version", "madeWith", "status", "reason"]).toContain(key);
+      expect(JSON.stringify(v)).not.toMatch(/auth_submit|declared|action|grant|authori[sz]/i);
+    }
+  });
+
+  it("the label does not bind actions: messages altered after the surface was labelled bind nothing in the manifest", async () => {
+    const { emitSurface } = await import("@aestheticfunction/dspack-emit");
+    const messages = emitSurface(surface as never, contract as never, { profile }).messages as Json[];
+    const altered = structuredClone(messages);
+    altered.find((m) => m.updateComponents)!.updateComponents.components[0].text = "Altered";
+    expect(await verdict()).toMatchObject({ madeWith: true });
+    const manifest = await actionManifest({
+      surfaces: [{ name: "ex.chat-1", messages: altered }],
+      examples: [{ id: "ex.chat-1", surface }],
+      provenance: { "ex.chat-1": record },
+      references: [{ loaded, contract, profile }],
+    });
+    expect(manifest.surfaces[0]!.block).toBeNull();
+    expect(manifest.surfaces[0]!.actions.every((a) => a.declared === false)).toBe(true);
+  });
+});
+
+describe("the words for every reason", () => {
+  it("every inert and unavailable reason has plain text, in the AF voice", () => {
+    const reasons = ["reference", "base", "block", "version", "validation", "expansion", "edited", "not-offered", "stored", "imported", "repository"];
+    expect(Object.keys(PROVENANCE_REASON_TEXT).sort()).toEqual([...reasons].sort());
+    for (const reason of reasons) {
+      const text = PROVENANCE_REASON_TEXT[reason as keyof typeof PROVENANCE_REASON_TEXT];
+      expect(text.length, reason).toBeGreaterThan(10);
+      expect(text, reason).not.toMatch(/—/);
+    }
+  });
+});
+
+describe("parseProvenance keeps the reason it reduced a record for", () => {
+  it("each record reduced to inert on import says why", async () => {
+    const out = parseProvenance(
+      {
+        ok: record,
+        reference: { ...record, reference: { name: "Elsewhere", dspack: "0.4", version: "9.9.9" } },
+        base: { ...record, baseSha256: "0".repeat(64) },
+        block: { ...record, block: "auth-wizard" },
+        version: { ...record, version: 7 },
+        validation: { ...record, call: { ...example.call, mode: "sign-ip" } },
+      },
+      [sidecar],
+    );
+    expect(out.ok).toEqual(record);
+    expect(out.reference).toEqual({ block: "auth-form", version: 1, status: "inert", reason: "reference" });
+    expect(out.base).toEqual({ block: "auth-form", version: 1, status: "inert", reason: "base" });
+    expect(out.block).toEqual({ block: "auth-wizard", version: 1, status: "inert", reason: "block" });
+    expect(out.version).toEqual({ block: "auth-form", version: 7, status: "inert", reason: "version" });
+    expect(out.validation).toEqual({ block: "auth-form", version: 1, status: "inert", reason: "validation" });
+  });
+
+  it("an inert record keeps a known reason and drops any other text", () => {
+    const out = parseProvenance(
+      { a: { block: "auth-form", version: 2, status: "inert", reason: "version" }, b: { block: "auth-form", version: 1, status: "inert", reason: "<script>" } },
+      [sidecar],
+    );
+    expect(out).toEqual({ a: { block: "auth-form", version: 2, status: "inert", reason: "version" }, b: { block: "auth-form", version: 1, status: "inert" } });
+  });
+});
diff --git a/packages/composer-core/src/blocks/provenance.test.ts b/packages/composer-core/src/blocks/provenance.test.ts
index d785ccd..016c89d 100644
--- a/packages/composer-core/src/blocks/provenance.test.ts
+++ b/packages/composer-core/src/blocks/provenance.test.ts
@@ -106,17 +106,17 @@ describe("parseProvenance", () => {
     expect(parseProvenance({ "ex.chat-1": entry }, [sidecar])).toEqual({ "ex.chat-1": entry });
   });
 
-  it("an unknown block version keeps only {block, version, status: inert}: the call is stripped", async () => {
+  it("an unknown block version keeps only {block, version, status: inert} and why: the call is stripped", async () => {
     const entry = { ...(await valid()), version: 7 };
-    expect(parseProvenance({ "ex.chat-1": entry }, [sidecar])).toEqual({ "ex.chat-1": { block: "auth-form", version: 7, status: "inert" } });
+    expect(parseProvenance({ "ex.chat-1": entry }, [sidecar])).toEqual({ "ex.chat-1": { block: "auth-form", version: 7, status: "inert", reason: "version" } });
   });
 
   it("a binding to another base, or a call that fails B1, is inert too", async () => {
     const other = { ...(await valid()), baseSha256: "0".repeat(64) };
     const broken = { ...(await valid()), call: { ...example.call, mode: "sign-ip" } };
     expect(parseProvenance({ a: other, b: broken }, [sidecar])).toEqual({
-      a: { block: "auth-form", version: 1, status: "inert" },
-      b: { block: "auth-form", version: 1, status: "inert" },
+      a: { block: "auth-form", version: 1, status: "inert", reason: "base" },
+      b: { block: "auth-form", version: 1, status: "inert", reason: "validation" },
     });
   });
 
diff --git a/playwright.composer-experimental.config.ts b/playwright.composer-experimental.config.ts
index ca936c4..a0a28be 100644
--- a/playwright.composer-experimental.config.ts
+++ b/playwright.composer-experimental.config.ts
@@ -24,7 +24,7 @@ export default defineConfig({
     baseURL: `http://localhost:${PORT}`,
     contextOptions: { reducedMotion: "reduce" },
   },
-  projects: [{ name: "composer-experimental", testMatch: ["composer-blocks.spec.ts", "composer-beta.spec.ts"] }],
+  projects: [{ name: "composer-experimental", testMatch: ["composer-blocks.spec.ts", "composer-blocks-provenance.spec.ts", "composer-beta.spec.ts"] }],
   webServer: [
     {
       command: "node e2e/serve-composer.mjs",

From ac52215732438441c195c1cf4af959c4efc19bd6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 16 Oct 2026 19:17:05 +0000
Subject: [PATCH 2/4] Blocks catalog and provenance UI: the verdict, the
 read-only views and the lifecycle

Step 4 of the Phase 2 release plan (sections 7 H3 and 8), read-only and
experimental-only.

- composer-core: provenanceVerdict. A surface is "made with block X vN"
  only by exact expansion identity: a record trusted against a bundled
  sidecar that binds to this build's base, whose call re-expands to the
  digest it recorded, on a surface that is that expansion. Refinable on a
  reference project whose build offers the block; unavailable on imported
  and repository projects; otherwise inert with its specific reason and,
  unless only the offer is missing, no label. parseProvenance keeps the
  reason it reduced a record for; PROVENANCE_REASON_TEXT words each one.
- runtime: blocksCatalog (every bundled block: reference, version,
  status, intents, declared actions, streaming policy) and
  provenanceVerdicts per surface. Data only.
- Catalog view: a read-only Interface blocks section. Preview: the
  provenance line with its status and reason, and for a block surface the
  note that its actions are host-owned and not executed here. Nothing new
  can be pressed, and Preview still only records what a surface dispatches.
- Lifecycle: an Example session's save now prunes its in-memory
  provenance, so "duplicate to keep" carries nothing stale.
- The guarded views wrap today's JSX rather than adding a child, so a
  default build's application chunks are byte-identical to main's.
- HOST-ACTIONS.md: step 3's first three accepted clarifications (the id
  form and enum loop variables; the recipe's string, surface and refusal;
  surfaceIds the server issued and a repeat with other parameters).
- Release plan status line and a BLOCKS.md note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R6Ax8qvfN3gYUC85oSGnoi
---
 apps/composer/app/state.tsx                   |   8 ++
 apps/composer/app/views/inventory-view.tsx    | 117 ++++++++++++++-
 apps/composer/app/views/preview-view.tsx      | 135 ++++++++++++++----
 .../experimental/blocks-runtime.test.ts       |   3 +-
 apps/composer/experimental/blocks-runtime.ts  |  98 +++++++++++++
 docs/BLOCKS.md                                |   5 +
 docs/blocks/HOST-ACTIONS.md                   |   7 +-
 docs/blocks/PHASE-2-RELEASE-PLAN.md           |   1 +
 packages/composer-core/src/blocks/index.ts    |   6 +
 .../composer-core/src/blocks/provenance.ts    | 126 +++++++++++++++-
 10 files changed, 469 insertions(+), 37 deletions(-)

diff --git a/apps/composer/app/state.tsx b/apps/composer/app/state.tsx
index 398707c..3cfa27b 100644
--- a/apps/composer/app/state.tsx
+++ b/apps/composer/app/state.tsx
@@ -860,6 +860,14 @@ export function ComposerProvider({ children }: { children: ReactNode }) {
               .then((runtime) => runtime.gcProvenance(runtime.projectProvenanceStore(p.id), live))
               .catch(() => undefined);
           }
+        } else if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1") {
+          // No stored project: an Example session, which keeps its provenance
+          // in memory. A save prunes it the same way, so "duplicate to keep"
+          // carries nothing stale; outside a session the map is empty.
+          const live = ((doc.examples as ExampleEntry[] | undefined) ?? []) as ExampleEntry[];
+          void import("../experimental/blocks-runtime")
+            .then((runtime) => runtime.gcProvenance(runtime.memoryProvenanceStore(sessionProvenance), live))
+            .catch(() => undefined);
         }
         return { savedInMemory: true as const };
       }
diff --git a/apps/composer/app/views/inventory-view.tsx b/apps/composer/app/views/inventory-view.tsx
index 890c808..79d4811 100644
--- a/apps/composer/app/views/inventory-view.tsx
+++ b/apps/composer/app/views/inventory-view.tsx
@@ -1,5 +1,6 @@
 "use client";
 
+import { useEffect, useState } from "react";
 import { useComposer } from "../state";
 import { ViewHeader } from "../ui";
 
@@ -26,7 +27,7 @@ export function InventoryView({ onOpen }: { onOpen: () => void }) {
     </span>
   );
 
-  return (
+  const catalog = (
     <>
       <ViewHeader
         eyebrow="Catalog"
@@ -101,4 +102,118 @@ export function InventoryView({ onOpen }: { onOpen: () => void }) {
       </table>
     </>
   );
+  // Interface blocks (experimental): the read-only Blocks catalog follows the
+  // components. The default build folds this branch away and returns the
+  // catalog exactly as before.
+  if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1") {
+    return (
+      <>
+        {catalog}
+        <BlocksCatalogSection />
+      </>
+    );
+  }
+  return catalog;
+}
+
+/**
+ * Interface blocks (experimental; docs/blocks/PHASE-2-RELEASE-PLAN.md, §7 H3):
+ * every block this build bundles, read-only. Rendered only in an experimental
+ * build: the literal flag check above folds this away in the default build,
+ * and the catalog is read through the guarded import. Nothing in it can be
+ * pressed: a block's actions are host-owned, and Composer executes none.
+ */
+function BlocksCatalogSection() {
+  const { activeProject } = useComposer();
+  const projectReferenceId = activeProject?.source.kind === "reference" ? activeProject.source.referenceId : null;
+  type Catalog = Array<{
+    referenceId: string;
+    label: string;
+    reference: { name: string; dspack: string; version: string } | null;
+    binding: string;
+    sidecarStatus: string | null;
+    withheld?: string;
+    issues: string[];
+    blocks: Array<{ id: string; name: string; version: number; status: string; disabled: string[]; intents: string[]; actions: string[]; streamingText: string }>;
+  }>;
+  const [catalog, setCatalog] = useState<Catalog | null>(null);
+  useEffect(() => {
+    let cancelled = false;
+    if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1") {
+      void import("../../experimental/blocks-runtime")
+        .then(async (runtime) => {
+          const next = await runtime.blocksCatalog();
+          if (!cancelled) setCatalog(next);
+        })
+        .catch(() => undefined);
+    }
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+  const cell = { padding: "6px 8px", verticalAlign: "top" } as const;
+  return (
+    <section aria-labelledby="blocks-catalog-h" data-testid="blocks-catalog" style={{ marginTop: "clamp(32px,5vw,52px)" }}>
+      <h2 id="blocks-catalog-h" className="af-h2" style={{ marginBottom: 6 }}>
+        Interface blocks
+      </h2>
+      <p style={{ fontSize: 13, color: "var(--fg-body)", maxWidth: 720, margin: "0 0 12px" }}>
+        Every block this experimental build bundles, read-only. A block&rsquo;s declared actions are host-owned: Composer never executes them,
+        and a host binds and authorizes each one on its own server.
+      </p>
+      {catalog === null && <p style={{ fontSize: 12, color: "var(--fg-dim)" }}>Reading the blocks…</p>}
+      {(catalog ?? []).map((ref) => {
+        const headingId = `blocks-catalog-${ref.referenceId}-h`;
+        return (
+          <div key={ref.referenceId} data-testid={`blocks-catalog-ref-${ref.referenceId}`} style={{ marginTop: 18 }}>
+            <h3 id={headingId} style={{ fontSize: 14, margin: "0 0 4px", color: "var(--fg)" }}>
+              {ref.reference ? `${ref.reference.name} ${ref.reference.version}` : ref.label}
+              {ref.referenceId === projectReferenceId && <span style={{ fontWeight: 400, color: "var(--fg-body)" }}> · this project&rsquo;s reference</span>}
+            </h3>
+            <p style={{ fontSize: 12, color: "var(--fg-body)", margin: "0 0 6px" }}>
+              Sidecar {ref.sidecarStatus ?? "unreadable"} · binding {ref.binding}
+              {ref.withheld && <> · {ref.withheld}</>}
+            </p>
+            {ref.issues.map((issue) => (
+              <p key={issue} style={{ fontSize: 12, color: "var(--err)", margin: "0 0 6px" }}>
+                {issue}
+              </p>
+            ))}
+            {ref.blocks.length > 0 && (
+              <table aria-labelledby={headingId} style={{ width: "100%", borderCollapse: "collapse", fontSize: 13 }}>
+                <thead>
+                  <tr style={{ textAlign: "left", fontFamily: "var(--mono)", fontSize: 11, textTransform: "uppercase", color: "var(--fg-body)" }}>
+                    <th scope="col" style={cell}>Block</th>
+                    <th scope="col" style={cell}>Version</th>
+                    <th scope="col" style={cell}>Status</th>
+                    <th scope="col" style={cell}>Intents</th>
+                    <th scope="col" style={cell}>Declared actions (host-owned)</th>
+                    <th scope="col" style={cell}>Streaming policy</th>
+                  </tr>
+                </thead>
+                <tbody>
+                  {ref.blocks.map((b) => (
+                    <tr key={b.id} style={{ borderTop: "1px solid var(--line-soft)" }} data-testid={`blocks-catalog-${ref.referenceId}-${b.id}`}>
+                      <th scope="row" style={{ ...cell, textAlign: "left", fontWeight: 400 }}>
+                        <span style={{ fontFamily: "var(--mono)", color: "var(--fg)" }}>{b.id}</span>
+                        <span style={{ display: "block", fontSize: 12, color: "var(--fg-body)" }}>{b.name}</span>
+                      </th>
+                      <td style={{ ...cell, fontFamily: "var(--mono)", fontSize: 12 }}>v{b.version}</td>
+                      <td style={{ ...cell, fontSize: 12 }}>
+                        {b.status}
+                        {b.disabled.length > 0 && <span style={{ display: "block", color: "var(--err)" }}>disabled at load: {b.disabled.join("; ")}</span>}
+                      </td>
+                      <td style={{ ...cell, fontFamily: "var(--mono)", fontSize: 12 }}>{b.intents.join(", ")}</td>
+                      <td style={{ ...cell, fontFamily: "var(--mono)", fontSize: 12 }}>{b.actions.join(", ")}</td>
+                      <td style={{ ...cell, fontSize: 12 }}>{b.streamingText}</td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+            )}
+          </div>
+        );
+      })}
+    </section>
+  );
 }
diff --git a/apps/composer/app/views/preview-view.tsx b/apps/composer/app/views/preview-view.tsx
index 35fd1ac..f184730 100644
--- a/apps/composer/app/views/preview-view.tsx
+++ b/apps/composer/app/views/preview-view.tsx
@@ -318,33 +318,47 @@ export function PreviewView({ focus }: { focus?: "flows" } = {}) {
 
   /** The step's surface through the IDENTICAL single-surface path (same
    *  canvas, same key pattern, same registry scope) — used by both modes. */
-  const renderSurface = (surf: NonNullable<typeof active>) => (
-    <>
-      {!isExample && referenceExampleIds?.has(surf.name) && (
-        <p style={{ fontSize: 12, color: "var(--fg-dim)", margin: "0 0 6px" }}>
-          Reference surface from {manifest?.name ?? "the design system"} — teaching material, not part of your project&rsquo;s work.
-        </p>
-      )}
-      <div
-        {...canvasScopeFor(activeRegistryId, canvasMode).attrs}
-        data-project-canvas="composer"
-        style={{
-          border: "1px solid var(--line)",
-          borderRadius: 4,
-          padding: 20,
-          background: canvasScopeFor(activeRegistryId, canvasMode).background,
-        }}
-      >
-        <A2uiCanvas
-          key={`${surf.name}:${activeRegistryId}`}
-          catalog={catalog}
-          registry={registry}
-          messages={surf.messages!}
-          onAction={handleAction}
-        />
-      </div>
-    </>
-  );
+  const renderSurface = (surf: NonNullable<typeof active>) => {
+    const rendered = (
+      <>
+        {!isExample && referenceExampleIds?.has(surf.name) && (
+          <p style={{ fontSize: 12, color: "var(--fg-dim)", margin: "0 0 6px" }}>
+            Reference surface from {manifest?.name ?? "the design system"} — teaching material, not part of your project&rsquo;s work.
+          </p>
+        )}
+        <div
+          {...canvasScopeFor(activeRegistryId, canvasMode).attrs}
+          data-project-canvas="composer"
+          style={{
+            border: "1px solid var(--line)",
+            borderRadius: 4,
+            padding: 20,
+            background: canvasScopeFor(activeRegistryId, canvasMode).background,
+          }}
+        >
+          <A2uiCanvas
+            key={`${surf.name}:${activeRegistryId}`}
+            catalog={catalog}
+            registry={registry}
+            messages={surf.messages!}
+            onAction={handleAction}
+          />
+        </div>
+      </>
+    );
+    // Interface blocks (experimental): what the surface's block provenance
+    // means, above it. The default build folds this branch away and renders
+    // the surface exactly as before.
+    if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1") {
+      return (
+        <>
+          <BlockProvenanceNote surfaceName={surf.name} />
+          {rendered}
+        </>
+      );
+    }
+    return rendered;
+  };
 
   return (
     <section>
@@ -693,3 +707,70 @@ export function PreviewView({ focus }: { focus?: "flows" } = {}) {
     </section>
   );
 }
+
+/**
+ * Interface blocks (experimental; docs/blocks/PHASE-2-RELEASE-PLAN.md, §7 H3
+ * and §8): what this surface's block provenance means here, and, for a block
+ * surface, that its actions are host-owned. Rendered only in an experimental
+ * build: the literal flag check above folds it away in the default build, and
+ * the verdict is read through the guarded import. Only exact expansion
+ * identity earns "made with"; a verdict grants no action anything, and
+ * Preview still only records what a surface dispatches.
+ */
+function BlockProvenanceNote({ surfaceName }: { surfaceName: string }) {
+  const { activeProject, contract, blockProvenanceFor } = useComposer();
+  type Note = { block: string; version: number; madeWith: boolean; status: string; reasonText?: string };
+  const [note, setNote] = useState<Note | null>(null);
+  useEffect(() => {
+    let cancelled = false;
+    setNote(null);
+    const provenance = activeProject ? blockProvenanceFor(activeProject.id) : {};
+    if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1" && activeProject && Object.hasOwn(provenance, surfaceName)) {
+      const source = activeProject.source;
+      const examples = (contract?.examples as Array<{ id?: unknown; surface?: unknown }> | undefined) ?? [];
+      void import("../../experimental/blocks-runtime")
+        .then(async (runtime) => {
+          const verdicts = await runtime.provenanceVerdicts({
+            provenance: { [surfaceName]: provenance[surfaceName] },
+            examples,
+            project: source.kind === "reference" ? { kind: "reference", referenceId: source.referenceId } : { kind: source.kind },
+          });
+          const verdict = verdicts[surfaceName];
+          if (cancelled || !verdict) return;
+          setNote({ ...verdict, ...(verdict.reason ? { reasonText: runtime.PROVENANCE_REASON_TEXT[verdict.reason] } : {}) });
+        })
+        .catch(() => undefined);
+    }
+    return () => {
+      cancelled = true;
+    };
+  }, [activeProject, contract, surfaceName, blockProvenanceFor]);
+  if (!note) return null;
+  const label = `block ${note.block} v${note.version}`;
+  return (
+    <div style={{ margin: "0 0 8px", maxWidth: 720 }}>
+      <p data-testid="preview-provenance" style={{ fontSize: 12, color: "var(--fg-body)", margin: "0 0 4px" }}>
+        {note.madeWith ? (
+          <>
+            Made with {label}.{" "}
+            {note.status === "refinable"
+              ? "Refinable: this build verifies the record and offers the block."
+              : note.status === "unavailable"
+                ? `Unavailable: ${note.reasonText}.`
+                : `Inert: ${note.reasonText}.`}
+          </>
+        ) : (
+          <>
+            Block provenance inert: {note.reasonText} (the record names {note.block} v{note.version}). This surface previews as an ordinary one.
+          </>
+        )}
+      </p>
+      {note.madeWith && (
+        <p data-testid="preview-host-owned" style={{ fontSize: 12, color: "var(--fg-body)", margin: 0 }}>
+          Block actions are host-owned and not executed here: Composer records each one it dispatches, and a host binds and authorizes it on its
+          own server.
+        </p>
+      )}
+    </div>
+  );
+}
diff --git a/apps/composer/experimental/blocks-runtime.test.ts b/apps/composer/experimental/blocks-runtime.test.ts
index a1fa43b..f8e4707 100644
--- a/apps/composer/experimental/blocks-runtime.test.ts
+++ b/apps/composer/experimental/blocks-runtime.test.ts
@@ -538,8 +538,9 @@ describe("the Blocks catalog (Phase 2 plan, §7, H3): every bundled block, read-
       intents: ["data-collection"],
       actions: ["auth_submit", "auth_forgot", "auth_provider_google", "auth_provider_github", "auth_provider_microsoft", "auth_provider_apple"],
       streaming: "disable-actions-until-complete",
+      streamingText: "disable actions until complete: a host keeps them off until the surface finishes streaming",
     });
-    expect(astryxRef.blocks.find((b) => b.id === "guide-steps")).toMatchObject({ actions: ["guide_start", "guide_save"], streaming: "static-safe" });
+    expect(astryxRef.blocks.find((b) => b.id === "guide-steps")).toMatchObject({ actions: ["guide_start", "guide_save"], streaming: "static-safe", streamingText: "static-safe: actions may be enabled once the surface renders" });
     const shadcnRef = catalog.find((r) => r.referenceId === "shadcn")!;
     expect(shadcnRef.reference).toEqual({ name: "shadcn/ui", dspack: "0.4", version: "3.2.0" });
     expect(shadcnRef.withheld).toMatch(/withheld from this beta/);
diff --git a/apps/composer/experimental/blocks-runtime.ts b/apps/composer/experimental/blocks-runtime.ts
index 0fb052f..ebd32bf 100644
--- a/apps/composer/experimental/blocks-runtime.ts
+++ b/apps/composer/experimental/blocks-runtime.ts
@@ -47,6 +47,7 @@ import {
   parseBlocksBeta,
   parseProvenance,
   preloadedAdapter,
+  provenanceVerdict,
   pruneProvenance,
   recheckBlockChoice,
   reconcileBlockChoice,
@@ -66,6 +67,7 @@ import {
   type IneligibleReason,
   type LoadedBlocks,
   type ManifestReference,
+  type ProvenanceVerdict,
   type StructuralAdapter,
   type SwitchReason,
 } from "@dspack-studio/composer-core/blocks";
@@ -538,6 +540,102 @@ export async function withActionManifest(
   return { ...rest, actionManifest: manifest, exportedAt };
 }
 
+// ---------------------------------------------------------------------------
+// Step 4 (docs/blocks/PHASE-2-RELEASE-PLAN.md, §7 H3 and §8): the read-only
+// Blocks catalog, and what each surface's provenance means. Data only: nothing
+// here can run an action, and a verdict grants nothing.
+
+/** The words Preview shows for each inert or unavailable reason. */
+export { PROVENANCE_REASON_TEXT } from "@dspack-studio/composer-core/blocks";
+
+/** How a streaming policy reads in the catalog. */
+const STREAMING_TEXT: Record<BlockDefinition["streaming"], string> = {
+  "disable-actions-until-complete": "disable actions until complete: a host keeps them off until the surface finishes streaming",
+  "static-safe": "static-safe: actions may be enabled once the surface renders",
+};
+
+export interface BlocksCatalogBlock {
+  id: string;
+  name: string;
+  version: number;
+  status: BlockDefinition["status"];
+  /** Whether this build offers it: approved in an approved sidecar that binds, and not disabled at load. */
+  offered: boolean;
+  /** Why it is disabled at load (B0, with H1), when it is. */
+  disabled: string[];
+  intents: string[];
+  /** The action names it declares: host-owned; Composer never executes them. */
+  actions: string[];
+  streaming: BlockDefinition["streaming"];
+  streamingText: string;
+}
+
+export interface BlocksCatalogReference {
+  referenceId: string;
+  label: string;
+  reference: { name: string; dspack: string; version: string } | null;
+  binding: LoadedBlocks["binding"];
+  sidecarStatus: BlocksSidecar["status"] | null;
+  /** Why the beta holds this reference out, when it does. */
+  withheld?: string;
+  issues: string[];
+  blocks: BlocksCatalogBlock[];
+}
+
+/** Every bundled block, by packaged reference, in sidecar order: the Blocks catalog (H3). */
+export async function blocksCatalog(): Promise<BlocksCatalogReference[]> {
+  const out: BlocksCatalogReference[] = [];
+  for (const referenceId of Object.keys(SIDECARS)) {
+    const loaded = await loadedFor(referenceId);
+    const sidecar = loaded.sidecar;
+    out.push({
+      referenceId,
+      label: String((REFERENCES[referenceId] as Json).label ?? REFERENCES[referenceId]!.contract.name ?? referenceId),
+      reference: sidecar ? { ...sidecar.reference } : null,
+      binding: loaded.binding,
+      sidecarStatus: sidecar?.status ?? null,
+      ...(WITHHELD[referenceId] ? { withheld: WITHHELD[referenceId] } : {}),
+      issues: [...loaded.issues],
+      blocks: (sidecar?.blocks ?? []).map((block) => ({
+        id: block.id,
+        name: block.name,
+        version: block.version,
+        status: block.status,
+        offered: loaded.binding === "ok" && sidecar?.status === "approved" && block.status === "approved" && loaded.usable.some((b) => b.id === block.id && b.version === block.version),
+        disabled: loaded.disabled.find((d) => d.block === block.id)?.issues ?? [],
+        intents: [...block.intents],
+        actions: [...block.actions],
+        streaming: block.streaming,
+        streamingText: STREAMING_TEXT[block.streaming],
+      })),
+    });
+  }
+  return out;
+}
+
+/**
+ * The verdict for each of a project's surfaces that its provenance names
+ * (composer-core provenanceVerdict). A record whose surface is gone has
+ * nothing to describe, and the next save drops it.
+ */
+export async function provenanceVerdicts(input: {
+  provenance: Record<string, unknown>;
+  examples: ReadonlyArray<{ id?: unknown; surface?: unknown }>;
+  project: { kind: "reference" | "imported" | "agent"; referenceId?: string };
+}): Promise<Record<string, ProvenanceVerdict>> {
+  const loaded = await Promise.all(Object.keys(SIDECARS).map((id) => loadedFor(id)));
+  const own = input.project.kind === "reference" && input.project.referenceId && SIDECARS[input.project.referenceId] ? (await loadedFor(input.project.referenceId)).sidecar : undefined;
+  const project = { kind: input.project.kind, ...(own ? { reference: own.reference } : {}) };
+  const out: Record<string, ProvenanceVerdict> = {};
+  for (const [id, record] of Object.entries(input.provenance)) {
+    const example = input.examples.find((e) => e.id === id);
+    if (!example) continue;
+    const verdict = await provenanceVerdict({ record, surface: example.surface, loaded, project });
+    if (verdict) out[id] = verdict;
+  }
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // Status for Settings.
 
diff --git a/docs/BLOCKS.md b/docs/BLOCKS.md
index 548502a..2d28841 100644
--- a/docs/BLOCKS.md
+++ b/docs/BLOCKS.md
@@ -193,6 +193,11 @@ Two rules apply in every experimental build. A block is offered only when it and
 - **H2.** In an experimental build, Preview's "export catalog" adds an `actionManifest` that binds each surface's actions by surface and name. Only a surface that verifiably is its block's expansion gets a block binding (`manifest.ts`; `withActionManifest` in the runtime). The default build's export is byte-identical.
 - **H4.** How a host binds and authorizes these actions is [blocks/HOST-ACTIONS.md](blocks/HOST-ACTIONS.md).
 
+**The Blocks catalog and provenance UI (step 4; [blocks/PHASE-2-RELEASE-PLAN.md](blocks/PHASE-2-RELEASE-PLAN.md), §7 H3 and §8).** Read-only, and only in an experimental build.
+- **Catalog.** A Blocks section lists every bundled block: its reference, version, status, intents, declared actions and streaming policy.
+- **Preview.** A surface's provenance reads "made with block X vN" only when its trusted call re-expands to exactly that surface (`provenanceVerdict` in `packages/composer-core/src/blocks/provenance.ts`). It is refinable, unavailable (an imported or repository project) or inert, and an inert record names its reason. A block surface also says its actions are host-owned and not executed here. A verdict grants nothing.
+- **Lifecycle.** Provenance follows a project through export, import, duplicate and delete as before. A save drops stale records, now in an Example session too.
+
 ## The live evaluation (Phase 1B)
 
 The harness lives in `packages/block-bench/live/` and is run by the owner; nothing in it runs in CI except its own tests and a dry run on the scripted provider. It measures the real code paths, never a re-implementation: composer-core's block phase, budget and refinement decision; dspack-gen's `runPipeline`; the request bytes the app posts (`proposeBody`); the app's fold (`foldBuildEvents`). The hosted client is held to the app's gateway adapter by a parity test over every reply shape.
diff --git a/docs/blocks/HOST-ACTIONS.md b/docs/blocks/HOST-ACTIONS.md
index 88ac481..fbdc9b9 100644
--- a/docs/blocks/HOST-ACTIONS.md
+++ b/docs/blocks/HOST-ACTIONS.md
@@ -18,7 +18,7 @@ Composer composes and governs interface surfaces. It never executes an action ([
 
 The emitter (dspack-emit 0.7.0) gives a node an action only where the reference profile says so. On both packaged references, that is a `button` or an `alert-dialog`. The action is `{"event": {"name": <slug of the node id>, "context": {}}}`: the id lowercased, with every run of other characters turned into `_` and any `_` at either end removed; an id with no letter or digit becomes `surface`. When a user activates it, the A2UI client reports `{name, surfaceId, sourceComponentId, timestamp, context}` to the host.
 
-Without an id, the emitter would name the action from an alert dialog's confirm label, the node's text or its component, and a model can write the first two. So H1 refuses any action node whose id is missing or depends on anything but literals and enum props. An id may be a literal, an enum prop's value, a literal that an enum or boolean prop picks through `$case`, or several of these joined with `$concat`. It may not hold a string the model fills, a position (`$index`), or an optional enum where it may be absent. The model fills content; it never names an action. Nor may a template carry an action event in another way: H1 refuses a template value shaped like one, which a passthrough prop such as Astryx's table `data` would carry into the messages verbatim, and a signature field named `event`, which a call could fill. Function calls and data bindings are a limit (§7).
+Without an id, the emitter would name the action from an alert dialog's confirm label, the node's text or its component, and a model can write the first two. So H1 refuses any action node whose id is missing or depends on anything but literals and enum props. An id may be a string literal, an enum prop's value, a string literal that an enum or boolean prop picks through `$case`, or several of these joined with `$concat`. An `$each` loop variable over an enum array counts as an enum prop: the shipped records-table, guide-steps and auth-form provider ids read one. A number may appear only as a part of a `$concat`, and a `$case` result or a `$prop` default follows the same rule. It may not hold a string the model fills, a position (`$index`), or an optional enum where it may be absent. The model fills content; it never names an action. Nor may a template carry an action event in another way: H1 refuses a template value shaped like one, which a passthrough prop such as Astryx's table `data` would carry into the messages verbatim, and a signature field named `event`, which a call could fill. Function calls and data bindings are a limit (§7).
 
 H1 then counts the names a call can make each id produce, at most 256 per id; an id whose props have more than 4096 combinations is refused before any is evaluated. It evaluates the id as the expander does, over every combination of the enum and boolean props it reads, along the branches each `$if` allows: a test of a prop's truthiness, or of its equality with a literal, narrows that prop, and a branch no call can take counts nothing. Those names must equal the block's declared `actions`. Where a condition or a cross-field constraint is beyond that reading, H1 counts the name anyway, so it may count a name no call reaches, but never misses one a call can emit.
 
@@ -78,9 +78,10 @@ H1 then counts the names a call can make each id produce, at most 256 per id; an
 
 **Recomputing `messagesSha256`.**
 - **The bytes.** Hash the UTF-8 bytes of the surface's `messages` serialized as `JSON.stringify` writes them: no whitespace, and non-ASCII text left as it is, unescaped.
-- **From the download.** It is pretty-printed, so parse it first. In JavaScript, `JSON.stringify(JSON.parse(file).surfaces[i].messages)` gives the bytes.
+- **From the download.** It is pretty-printed, so parse it first. In JavaScript, `JSON.stringify(JSON.parse(file).surfaces[i].messages)` gives the string, where `surfaces[i]` is the surface whose `name` is the entry's `surface`. Its UTF-8 encoding is the bytes.
 - **In another language,** match that serializer exactly. In Python, `json.dumps(messages, separators=(",", ":"), ensure_ascii=False)` matches for ordinary text and integers; the default, which escapes non-ASCII text, does not.
 - **When.** Check the hash before you render the messages under a surfaceId of your own (§4, rule 2): substituting it changes the bytes.
+- **If it does not match.** A host that cannot reproduce the bytes refuses to render the surface.
 
 **How a surface earns a block binding.** The manifest is recomputed from the surface's messages at every export, so an edited surface reports what it dispatches now. A surface binds a block only when all of these hold:
 - Its provenance names an approved block of an approved sidecar that the build bundles, and B0 (with H1) accepted that block at load.
@@ -105,7 +106,7 @@ H1 then counts the names a call can make each id produce, at most 256 per id; an
 
    Bind actions by the surface you rendered, not by what the client reports. Look an entry up by `surface`, never by `surfaceId`, which surfaces of one intent share. Check the surface's messages, exactly as exported, against the entry's `messagesSha256` (§3), and render nothing that does not match. Then render them under a surfaceId of your own, and keep on your server which entry it is. Every field of an action event (`name`, `surfaceId`, `sourceComponentId`, `context`) is client-supplied and untrusted.
 3. **Authorize on the server, per effect.** An action event is a request, never a grant. For each effect, check the session, the user's permission for that effect and the resource it touches, on your own server. Never trust a client-side check, the manifest or the presence of a button.
-4. **Make effects idempotent.** Replays and double submits happen: retries, double clicks, a client that resends. A2UI action events carry no idempotency key of their own, and anything a client sends can be replayed or forged, so the key is your server's. It must stay the same for a retry and change for each new operation: a key made only of the session, the effect and its target would answer a second, intended save with the first one's result. So key each effect by an operation id your server issued, bound to the session, the effect, its target and its parameters. The surfaceId you render a surface under (rule 2) can serve: issue a fresh one each time an action should be possible again, and treat a repeat under the same one as a retry. Keep the store bounded, and answer a repeat with the first result. The exhibit's agent shows that shape for honest retries only: it keeps the answer for each client-chosen `actionId` and returns it again for a repeat (`answeredActions` in `apps/agent/src/server.ts`). A host must not trust a key the client chose. Rate-limit what can be repeated.
+4. **Make effects idempotent.** Replays and double submits happen: retries, double clicks, a client that resends. A2UI action events carry no idempotency key of their own, and anything a client sends can be replayed or forged, so the key is your server's. It must stay the same for a retry and change for each new operation: a key made only of the session, the effect and its target would answer a second, intended save with the first one's result. So key each effect by an operation id your server issued, bound to the session, the effect, its target and its parameters. The surfaceId you render a surface under (rule 2) can serve: issue a fresh one each time an action should be possible again, and treat a repeat under the same one as a retry. Accept an event only under a surfaceId your server issued to that session and has not retired, and refuse any other: a client that minted its own ids would make every replay look new. A repeat under the same operation id with other parameters is refused, never answered with the first result. Keep the store bounded, and answer a repeat with the first result. The exhibit's agent shows that shape for honest retries only: it keeps the answer for each client-chosen `actionId` and returns it again for a repeat (`answeredActions` in `apps/agent/src/server.ts`). A host must not trust a key the client chose. Rate-limit what can be repeated.
 5. **Honour the streaming policy.** For `disable-actions-until-complete`, keep the block's actions disabled in the client, and refuse them on the server, until the surface's message stream has completed. For `static-safe`, they may be enabled once rendered. A host that cannot tell when a stream completes treats every block as `disable-actions-until-complete`.
 6. **Treat model content as untrusted data.** Every string in a call can be model-written: titles, captions, descriptions, column headings, cells, steps, items and their heading, meta labels and details, summaries and intro text.
    - Render them as text: never as HTML or markdown, never as a link or URL.
diff --git a/docs/blocks/PHASE-2-RELEASE-PLAN.md b/docs/blocks/PHASE-2-RELEASE-PLAN.md
index 8148bde..897a818 100644
--- a/docs/blocks/PHASE-2-RELEASE-PLAN.md
+++ b/docs/blocks/PHASE-2-RELEASE-PLAN.md
@@ -5,6 +5,7 @@
 > - G1 has landed: the records on main that §3 lists. So the plan's statements about what main holds describe `7e260c3`, before G1. For example, `docs/blocks/baseline.json` is now committed ([BASELINE.md](BASELINE.md)).
 > - The owner authorized step 2 on 2026-10-16, and it is built: the beta's delivery path, guards and switches ([../BLOCKS.md](../BLOCKS.md), "The beta (Phase 2)"; [../deployment.md](../deployment.md), "The beta composer"). No beta is deployed. Each later Phase 2 change still needs the owner's authorization.
 > - The owner authorized step 3 on 2026-10-16, limited to H1, H2 and H4 (§7), and it is built: the B0 action-id proof, the action manifest in the beta's Catalog export, and the host guide ([HOST-ACTIONS.md](HOST-ACTIONS.md)). The Catalog export that §7 locates at `exportBundle` in `preview-view.tsx` is now built by `catalogBundle` in `apps/composer/app/catalog-export.ts`. The manifest reads each surface's actions with `actionEvents` (`packages/composer-core/src/blocks/actions.ts`), which also reads each context, rather than `emittedActionNames`. H3, the Blocks catalog view and Preview's label, belongs to step 4.
+> - The owner authorized step 4 on 2026-10-16: the read-only Blocks catalog and provenance UI (§7 H3, §8), and the first three host-guide clarifications from step 3's review. It is built: a Blocks section in the Catalog view; in Preview, a surface's provenance ("made with block X vN", only by exact expansion identity) with its status and specific reason, and the note that block actions are host-owned and not executed here; and §8's lifecycle, with an Example session's save now pruning its provenance too. Nothing grants an action anything, and the default build is unchanged.
 
 Final version, 2026-10-16. The owner accepted the plan on 2026-10-15 as the conditional working plan for the next AF Composer release, and this version carries the owner's three clarifications (below) and the shadcn/ui v3 result. It is not authorization to begin Phase 2: nothing in it starts until the owner authorizes it. No code.
 
diff --git a/packages/composer-core/src/blocks/index.ts b/packages/composer-core/src/blocks/index.ts
index 8f5b4f1..983e2a0 100644
--- a/packages/composer-core/src/blocks/index.ts
+++ b/packages/composer-core/src/blocks/index.ts
@@ -62,15 +62,21 @@ export {
 export { decideRefinement, type BlockSeed, type RefinementDecision, type SwitchReason } from "./refine";
 export {
   buildProvenanceEntry,
+  INERT_REASONS,
   parseProvenance,
+  PROVENANCE_REASON_TEXT,
   provenanceStatus,
+  provenanceVerdict,
   pruneProvenance,
   PROVENANCE_MAX_BYTES,
   trustedProvenance,
   type BlockProvenanceEntry,
   type InertProvenance,
+  type InertReason,
   type ProvenanceRecord,
   type ProvenanceStatus,
+  type ProvenanceVerdict,
+  type UnavailableReason,
 } from "./provenance";
 export { recheckBlockChoice, reconcileBlockChoice, selectBlockDeterministic, withBlockChoice } from "./select";
 export { eligibleBlocks, liveBaseDigest, type EligibilityInput, type IneligibleReason } from "./eligibility";
diff --git a/packages/composer-core/src/blocks/provenance.ts b/packages/composer-core/src/blocks/provenance.ts
index 01f47a2..a43efed 100644
--- a/packages/composer-core/src/blocks/provenance.ts
+++ b/packages/composer-core/src/blocks/provenance.ts
@@ -8,10 +8,16 @@
  * has no slot for an entered value, a default, a credential or runtime
  * state. An entry is written only when the accepted surface is exactly the
  * expansion; on import, anything that cannot be trusted is reduced to an
- * inert {block, version, status} and the surface renders as an ordinary one.
+ * inert {block, version, status, reason} and the surface renders as an
+ * ordinary one.
+ *
+ * What a surface's provenance means is the verdict (provenanceVerdict): a
+ * surface is "made with block X vN" only by exact expansion identity, and a
+ * verdict says what a surface is, never what anyone may do with it.
  */
 import { checkConstraints, validateCall } from "./call";
-import { expansionDigest } from "./expand";
+import { expandBlock, expansionDigest } from "./expand";
+import type { LoadedBlocks } from "./load";
 import type { BlockTrace } from "./phase";
 import type { BlocksSidecar } from "./schema";
 
@@ -32,10 +38,26 @@ export interface BlockProvenanceEntry {
   expansionDigest: string;
 }
 
+/**
+ * Why provenance is inert. Trust: the record names a reference this build
+ * does not bundle (or that is not the project's own), another base contract,
+ * a block or a version this build does not have, or fails validation (B1,
+ * constraints, intent, encoding). Identity: its call does not expand to the
+ * digest it recorded, or the surface is no longer that expansion (edited; the
+ * next save drops it). Offer: this build does not offer the block (draft, or
+ * disabled at load). Stored: it was reduced to inert before, without a
+ * reason this build can read.
+ */
+export const INERT_REASONS = ["reference", "base", "block", "version", "validation", "expansion", "edited", "not-offered", "stored"] as const;
+export type InertReason = (typeof INERT_REASONS)[number];
+/** Why verified provenance still cannot refine: the project is not a reference project. */
+export type UnavailableReason = "imported" | "repository";
+
 export interface InertProvenance {
   block: string;
   version: number;
   status: "inert";
+  reason?: InertReason;
 }
 
 export type ProvenanceRecord = BlockProvenanceEntry | InertProvenance;
@@ -100,14 +122,33 @@ export function trustedProvenance(value: Json, sidecars: readonly BlocksSidecar[
   };
 }
 
-/** Stored or imported provenance, each record kept only as far as it can be trusted. */
+/** A reason as stored, kept only when it is one this build knows. */
+const knownReason = (value: unknown): InertReason | undefined => (INERT_REASONS as readonly unknown[]).includes(value) ? (value as InertReason) : undefined;
+
+/** Why a record cannot be trusted against the bundled sidecars, or null when it can (trustedProvenance). */
+function untrustedReason(value: Json, sidecars: readonly BlocksSidecar[]): Extract<InertReason, "reference" | "base" | "block" | "version" | "validation"> | null {
+  const sameRef = sidecars.filter((s) => sameReference(value.reference as Json | undefined, s.reference));
+  if (sameRef.length === 0) return "reference";
+  const sidecar = sameRef.find((s) => s.baseSha256 === value.baseSha256);
+  if (!sidecar) return "base";
+  const versions = sidecar.blocks.filter((b) => b.id === value.block);
+  if (versions.length === 0) return "block";
+  if (!versions.some((b) => b.version === value.version)) return "version";
+  return trustedProvenance(value, [sidecar]) ? null : "validation";
+}
+
+/** Stored or imported provenance, each record kept only as far as it can be trusted, and an inert one with why. */
 export function parseProvenance(raw: unknown, sidecars: readonly BlocksSidecar[]): Record<string, ProvenanceRecord> {
   if (!isObject(raw)) return {};
   const out: Record<string, ProvenanceRecord> = {};
   for (const [id, value] of Object.entries(raw)) {
     if (!isObject(value) || typeof value.block !== "string" || !Number.isInteger(value.version)) continue;
-    const inert: InertProvenance = { block: value.block, version: value.version as number, status: "inert" };
-    out[id] = value.status === "inert" ? inert : (trustedProvenance(value, sidecars) ?? inert);
+    const inert = (reason: InertReason | undefined): InertProvenance => ({ block: value.block as string, version: value.version as number, status: "inert", ...(reason ? { reason } : {}) });
+    if (value.status === "inert") {
+      out[id] = inert(knownReason(value.reason));
+      continue;
+    }
+    out[id] = trustedProvenance(value, sidecars) ?? inert(untrustedReason(value, sidecars) ?? "validation");
   }
   return out;
 }
@@ -124,6 +165,81 @@ export function provenanceStatus(
   return trustedProvenance(record as unknown as Json, context.sidecars) ? "refinable" : "inert";
 }
 
+/**
+ * What a surface's provenance means here (docs/blocks/PHASE-2-RELEASE-PLAN.md,
+ * §8). `madeWith` is the label "made with block X vN", and only exact
+ * expansion identity earns it. The record must be trusted against a bundled
+ * sidecar that binds to this build's base contract. Its call must re-expand
+ * to the digest it recorded. The surface must be that expansion. Then it
+ * is refinable on a reference project whose build offers the block,
+ * unavailable on an imported or repository project, and inert, with its
+ * label, when this build does not offer the block. Anything less is inert
+ * with no label, and the surface renders as an ordinary one. A verdict says
+ * what a surface is; it never carries an action, a declaration or a grant.
+ */
+export interface ProvenanceVerdict {
+  block: string;
+  version: number;
+  madeWith: boolean;
+  status: ProvenanceStatus;
+  /** Why it is inert or unavailable; absent when refinable. */
+  reason?: InertReason | UnavailableReason;
+}
+
+/** Plain words for every reason, as Preview shows them. */
+export const PROVENANCE_REASON_TEXT: Record<InertReason | UnavailableReason, string> = {
+  reference: "it names a design-system reference that is not this project's, or not in this build",
+  base: "it was bound to another version of the reference's base contract",
+  block: "it names a block this build does not have",
+  version: "it names a block version this build does not have",
+  validation: "its call does not pass the block's checks",
+  expansion: "its call does not expand to this surface",
+  edited: "this surface was changed after it was accepted, and the next save drops the record",
+  "not-offered": "this build does not offer the block: it is a draft, or disabled at load",
+  stored: "it was reduced to inert when it was stored or imported",
+  imported: "imported projects never refine from provenance",
+  repository: "repository projects never refine from provenance",
+};
+
+export async function provenanceVerdict(input: {
+  /** The stored record, as the project holds it. */
+  record: unknown;
+  /** The surface the record's example holds now. */
+  surface: unknown;
+  /** Every bundled sidecar, as loaded (B0 and H1 applied). */
+  loaded: readonly LoadedBlocks[];
+  /** A reference project names its packaged reference; an imported or repository project does not. */
+  project: { kind: "reference" | "imported" | "agent"; reference?: { name: string; dspack: string; version: string } };
+}): Promise<ProvenanceVerdict | null> {
+  const { record, project } = input;
+  if (!isObject(record) || typeof record.block !== "string" || !Number.isInteger(record.version)) return null;
+  const named = { block: record.block, version: record.version as number };
+  const inert = (reason: InertReason, madeWith = false): ProvenanceVerdict => ({ ...named, madeWith, status: "inert", reason });
+  if (record.status === "inert") return inert(knownReason(record.reason) ?? "stored");
+  try {
+    if (project.kind === "reference" && project.reference && !sameReference(record.reference as Json | undefined, project.reference)) return inert("reference");
+    const sidecars = input.loaded.flatMap((l) => (l.sidecar ? [l.sidecar] : []));
+    const untrusted = untrustedReason(record, sidecars);
+    if (untrusted) return inert(untrusted);
+    const loaded = input.loaded.find((l) => l.sidecar && sameReference(record.reference as Json | undefined, l.sidecar.reference) && l.sidecar.baseSha256 === record.baseSha256)!;
+    const sidecar = loaded.sidecar!;
+    if (loaded.binding !== "ok") return inert("base");
+    const entry = trustedProvenance(record, [sidecar])!;
+    const block = sidecar.blocks.find((b) => b.id === entry.block && b.version === entry.version)!;
+
+    // The proof: the trusted call re-expands to the digest it recorded, and the surface is that expansion.
+    const expanded = expandBlock(block, entry.call, { reference: sidecar.reference, intent: entry.intent });
+    if (!expanded.ok || (await expansionDigest(expanded.surface)) !== entry.expansionDigest) return inert("expansion");
+    if (!isObject(input.surface) || (await expansionDigest(input.surface)) !== entry.expansionDigest) return inert("edited");
+
+    if (project.kind !== "reference") return { ...named, madeWith: true, status: "unavailable", reason: project.kind === "imported" ? "imported" : "repository" };
+    const offered = sidecar.status === "approved" && block.status === "approved" && loaded.usable.some((b) => b.id === block.id && b.version === block.version);
+    return offered ? { ...named, madeWith: true, status: "refinable" } : inert("not-offered", true);
+  } catch {
+    return inert("validation");
+  }
+}
+
 /** Drop records whose example vanished or whose surface no longer equals the expansion. */
 export async function pruneProvenance(
   map: Record<string, unknown>,

From 7a4f8b6c64058a7c27ddbc8b3b6cb166c978a44c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 16 Oct 2026 19:36:27 +0000
Subject: [PATCH 3/4] Blocks catalog and provenance UI review: pin the seven
 findings, fail-first

The independent review of ac52215 found no blocker, three minor issues and
four nits. These tests pin each one and fail against ac52215:

- Preview's refinable line says what the record is, never that a build
  offers the block (the beta switch, Settings and eligibility decide that).
- A record that names no block id or version has no verdict and is dropped
  on parse, so an imported name is never shown.
- Duplicating an Example session copies its provenance after every pending
  write, pruned against the examples the duplicate keeps; the e2e loses its
  sleep.
- An import prunes against the imported project's examples.
- A reference project whose reference this build does not bundle trusts no
  provenance.
- Both default-artifact scans look for step 4's UI and runtime call, and the
  experimental positive control finds each marker in its artifact.
- Every provenance write notifies listeners, so an open Preview re-reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R6Ax8qvfN3gYUC85oSGnoi
---
 .../experimental/blocks-runtime.test.ts       | 64 ++++++++++++++++++-
 .../scripts/check-default-artifact.mjs        | 16 ++++-
 e2e/composer-blocks-provenance.spec.ts        | 56 +++++++++++-----
 e2e/composer-blocks.spec.ts                   |  5 ++
 e2e/composer-prod-smoke.spec.ts               |  6 +-
 .../src/blocks/provenance-verdict.test.ts     | 35 ++++++++++
 6 files changed, 161 insertions(+), 21 deletions(-)

diff --git a/apps/composer/experimental/blocks-runtime.test.ts b/apps/composer/experimental/blocks-runtime.test.ts
index f8e4707..22941e7 100644
--- a/apps/composer/experimental/blocks-runtime.test.ts
+++ b/apps/composer/experimental/blocks-runtime.test.ts
@@ -18,8 +18,11 @@ import {
   blockRunFor,
   blocksCatalog,
   chooseBlock,
+  copyProvenance,
+  gcProvenance,
   importProvenance,
   memoryProvenanceStore,
+  onProvenanceChange,
   planGoalWithBlocks,
   provenanceVerdicts,
   readBlocksBeta,
@@ -599,6 +602,12 @@ describe("provenance verdicts for a project's surfaces (Phase 2 plan, §8)", ()
     expect(verdicts.a).toMatchObject({ madeWith: false, status: "inert", reason: "reference" });
   });
 
+  it("a project on a reference this build does not bundle trusts no provenance", async () => {
+    const { entry, surface } = await accepted();
+    const verdicts = await provenanceVerdicts({ provenance: { a: entry }, examples: [{ id: "a", surface }], project: { kind: "reference", referenceId: "retired-reference" } });
+    expect(verdicts.a).toEqual({ block: "auth-form", version: 1, madeWith: false, status: "inert", reason: "reference" });
+  });
+
   it("an imported project's provenance is unavailable; a repository project's too", async () => {
     const { entry, surface } = await accepted();
     for (const [kind, reason] of [["imported", "imported"], ["agent", "repository"]] as const) {
@@ -608,11 +617,62 @@ describe("provenance verdicts for a project's surfaces (Phase 2 plan, §8)", ()
   });
 
   it("an import keeps the reason each record was reduced to inert for", async () => {
-    const { entry } = await accepted();
+    const { entry, surface } = await accepted();
     const holder = { current: {} as Record<string, unknown> };
-    await importProvenance(memoryProvenanceStore(holder, "import-test"), { a: entry, b: { ...entry, version: 4 }, c: { ...entry, baseSha256: "1".repeat(64) } });
+    const examples = ["a", "b", "c"].map((id) => ({ id, surface }));
+    await importProvenance(memoryProvenanceStore(holder, "import-test"), { a: entry, b: { ...entry, version: 4 }, c: { ...entry, baseSha256: "1".repeat(64) } }, examples);
     expect(holder.current.a).toEqual(entry);
     expect(holder.current.b).toEqual({ block: "auth-form", version: 4, status: "inert", reason: "version" });
     expect(holder.current.c).toEqual({ block: "auth-form", version: 1, status: "inert", reason: "base" });
   });
+
+  it("an import prunes against the imported project's examples: a record for a missing or edited surface is dropped", async () => {
+    const { entry, surface, edited } = await accepted();
+    const holder = { current: {} as Record<string, unknown> };
+    await importProvenance(memoryProvenanceStore(holder, "import-prune"), { kept: entry, gone: entry, changed: entry, stale: { ...entry, version: 4 } }, [
+      { id: "kept", surface },
+      { id: "changed", surface: edited },
+      { id: "stale", surface },
+    ]);
+    expect(holder.current).toEqual({ kept: entry, stale: { block: "auth-form", version: 4, status: "inert", reason: "version" } });
+  });
+
+  it("duplicating an Example session copies its provenance once every pending write has landed, pruned against the examples the duplicate keeps", async () => {
+    const { entry, surface, edited } = await accepted();
+    const session = { current: { stale: entry } as Record<string, unknown> };
+    const from = memoryProvenanceStore(session, "copy-test-session");
+    const saved: Array<Record<string, unknown>> = [];
+    const to = { key: "copy-test-project", load: () => ({}), save: (map: Record<string, unknown>) => void saved.push(map) };
+    // A write still on its way to the session's store: the copy waits for it.
+    void importProvenance(from, { stale: entry, late: entry }, [
+      { id: "stale", surface },
+      { id: "late", surface },
+    ]);
+    await copyProvenance(from, to, [
+      { id: "stale", surface: edited },
+      { id: "late", surface },
+    ]);
+    expect(saved).toEqual([{ late: entry }]);
+  });
+
+  it("a session with nothing that still verifies carries nothing", async () => {
+    const { entry, edited } = await accepted();
+    const saved: unknown[] = [];
+    const to = { key: "copy-empty-project", load: () => ({}), save: (map: Record<string, unknown>) => void saved.push(map) };
+    await copyProvenance(memoryProvenanceStore({ current: {} }, "copy-empty"), to, []);
+    await copyProvenance(memoryProvenanceStore({ current: { a: entry } }, "copy-stale"), to, [{ id: "a", surface: edited }]);
+    expect(saved).toEqual([]);
+  });
+
+  it("every provenance write tells its listeners, so an open Preview re-reads; unsubscribing stops it", async () => {
+    const { entry, surface } = await accepted();
+    const seen: string[] = [];
+    const off = onProvenanceChange((key) => seen.push(key));
+    await gcProvenance(memoryProvenanceStore({ current: { a: entry } }, "notify-1"), [{ id: "a", surface }]);
+    await importProvenance(memoryProvenanceStore({ current: {} }, "notify-2"), { a: entry }, [{ id: "a", surface }]);
+    expect(seen.filter((key) => key.startsWith("notify-"))).toEqual(["notify-1", "notify-2"]);
+    off();
+    await gcProvenance(memoryProvenanceStore({ current: { a: entry } }, "notify-3"), [{ id: "a", surface }]);
+    expect(seen.filter((key) => key.startsWith("notify-"))).toEqual(["notify-1", "notify-2"]);
+  });
 });
diff --git a/apps/composer/scripts/check-default-artifact.mjs b/apps/composer/scripts/check-default-artifact.mjs
index cddfd5c..76414be 100644
--- a/apps/composer/scripts/check-default-artifact.mjs
+++ b/apps/composer/scripts/check-default-artifact.mjs
@@ -16,9 +16,19 @@ const composer = fileURLToPath(new URL("..", import.meta.url));
 const out = join(composer, "out");
 const sidecars = join(composer, "experimental", "blocks");
 
-// The sidecar envelope key, a template directive, and the beta switch's reasons
-// (packages/composer-core/src/blocks/beta.ts).
-const markers = new Set(["blocksSidecar", "disable-actions-until-complete", "reference-not-in-beta", "beta-switch-"]);
+// The sidecar envelope key, a template directive, the beta switch's reasons
+// (packages/composer-core/src/blocks/beta.ts), and step 4's Blocks catalog and
+// Preview provenance line with the runtime call behind them.
+const markers = new Set([
+  "blocksSidecar",
+  "disable-actions-until-complete",
+  "reference-not-in-beta",
+  "beta-switch-",
+  "blocks-catalog",
+  "preview-provenance",
+  "preview-host-owned",
+  "provenanceVerdicts",
+]);
 for (const file of readdirSync(sidecars).filter((f) => f.endsWith(".blocks.json"))) {
   const doc = JSON.parse(readFileSync(join(sidecars, file), "utf8"));
   for (const block of doc.blocks ?? []) markers.add(block.id);
diff --git a/e2e/composer-blocks-provenance.spec.ts b/e2e/composer-blocks-provenance.spec.ts
index ab2d238..b89e9ec 100644
--- a/e2e/composer-blocks-provenance.spec.ts
+++ b/e2e/composer-blocks-provenance.spec.ts
@@ -30,17 +30,17 @@ async function newProject(page: Page, name: string) {
   await expect(page.getByTestId("build-prompt")).toBeVisible();
 }
 
-/** A scripted sign-in build on shadcn/ui expands auth-form; accept it and return its example id. */
-async function acceptAuthForm(page: Page): Promise<string> {
+/** A scripted sign-in build on shadcn/ui expands auth-form; accept it (turn `turn` of the thread) and return its example id. */
+async function acceptAuthForm(page: Page, turn = 1): Promise<string> {
   await page.getByTestId("build-model").selectOption("scripted");
   await page.getByTestId("build-intent").selectOption("structured-input");
   await page.getByTestId("build-prompt").fill("a sign-in form with email and password");
   await page.getByTestId("build-run").click();
-  await expect(page.getByTestId("build-gate-summary-1")).toContainText("Follows your design-system rules", { timeout: 30_000 });
-  await expect(page.getByTestId("build-block-1")).toContainText("block auth-form v1");
-  await page.getByTestId("build-accept-1").click();
-  await expect(page.getByTestId("build-accepted-1")).toContainText(/ex\.chat-\d+/);
-  return (await page.getByTestId("build-accepted-1").innerText()).match(/ex\.chat-\d+/)![0];
+  await expect(page.getByTestId(`build-gate-summary-${turn}`)).toContainText("Follows your design-system rules", { timeout: 30_000 });
+  await expect(page.getByTestId(`build-block-${turn}`)).toContainText("block auth-form v1");
+  await page.getByTestId(`build-accept-${turn}`).click();
+  await expect(page.getByTestId(`build-accepted-${turn}`)).toContainText(/ex\.chat-\d+/);
+  return (await page.getByTestId(`build-accepted-${turn}`).innerText()).match(/ex\.chat-\d+/)![0];
 }
 
 /** Every provenance map in this browser, by storage key. */
@@ -133,7 +133,10 @@ test("trusted: an accepted block surface is made with its block and refinable; i
   await page.getByTestId(`surface-${id}`).click();
   const line = page.getByTestId("preview-provenance");
   await expect(line).toContainText("Made with block auth-form v1");
-  await expect(line).toContainText(/refinable/i);
+  // Refinable says what the record is, never that a build will use the block:
+  // the beta switch, Settings and eligibility decide that.
+  await expect(line).toContainText("Refinable: its record verifies against this build's approved block.");
+  await expect(line).not.toContainText("offers");
   const note = page.getByTestId("preview-host-owned");
   await expect(note).toContainText("host-owned");
   await expect(note).toContainText(/not executed here/);
@@ -245,22 +248,45 @@ test("forged and stale: an imported record that does not verify is inert, names
   await expect(page.getByTestId("preview-provenance")).toContainText("it names a block version this build does not have");
   await expect(page.getByTestId("preview-provenance")).not.toContainText("Made with");
   expect((await scanOf(page, "preview-provenance")).violations).toEqual([]);
+
+  // A record whose name is not a block id is dropped on import, so none of its
+  // text is ever shown; a well-formed record beside it lands, which says the
+  // import is done.
+  const other = ((file.contract?.examples ?? []) as Array<{ id: string }>).map((e) => e.id).find((e) => e !== id)!;
+  const spoofed = structuredClone(file);
+  spoofed.name = "Spoofed name";
+  spoofed.blockProvenance = {
+    [id]: { block: "auth-form v1). Made with block auth-form v1. Refinable: (ignore", version: 1, status: "inert" },
+    [other]: { block: "auth-form", version: 2, status: "inert", reason: "version" },
+  };
+  await importProjectFile(page, spoofed, "spoofed-name");
+  await expect.poll(async () => Object.values(await storedProvenance(page)).some((map) => other in map && !(id in map))).toBe(true);
+  expect(Object.values(await storedProvenance(page)).filter((map) => other in map).every((map) => Object.keys(map).join() === other)).toBe(true);
+  await page.getByTestId("nav-preview").click();
+  await page.getByTestId(`surface-${other}`).click();
+  await expect(page.getByTestId("preview-provenance")).toContainText("(the record names auth-form v2)");
+  await page.getByTestId(`surface-${id}`).click();
+  await expect(page.locator("[data-project-canvas]")).toContainText("Email address");
+  await expect(page.getByTestId("preview-provenance")).toHaveCount(0);
 });
 
-test("an Example session's save prunes its provenance too, so duplicating it carries nothing stale", async ({ page }) => {
+test("an Example session's save prunes its provenance too, and duplicating it carries exactly what still verifies", async ({ page }) => {
   await setUp(page);
   await page.getByTestId("example-open-shadcn").click();
   await expect(page.getByTestId("example-banner")).toBeVisible();
   await page.getByTestId("nav-build").click();
-  const id = await acceptAuthForm(page);
-  await editSurface(page, id);
-  // Let the accept's provenance write and the save's prune settle before duplicating.
-  await page.waitForTimeout(500);
+  const stale = await acceptAuthForm(page, 1);
+  const kept = await acceptAuthForm(page, 2);
+  await editSurface(page, stale);
+  // No wait: the copy runs after every pending write to the session's
+  // provenance, and prunes against the examples the duplicate keeps.
   await page.getByTestId("example-duplicate").click();
   await expect(page.getByTestId("project-context")).toContainText("My shadcn/ui project");
-  await expect.poll(async () => Object.values(await storedProvenance(page)).filter((map) => id in map).length).toBe(0);
+  await expect.poll(async () => Object.values(await storedProvenance(page)).map((map) => Object.keys(map).sort().join())).toEqual([kept]);
   await page.getByTestId("nav-preview").click();
-  await page.getByTestId(`surface-${id}`).click();
+  await page.getByTestId(`surface-${kept}`).click();
+  await expect(page.getByTestId("preview-provenance")).toContainText("Made with block auth-form v1");
+  await page.getByTestId(`surface-${stale}`).click();
   await expect(page.locator("[data-project-canvas]")).toContainText("Work email address");
   await expect(page.getByTestId("preview-provenance")).toHaveCount(0);
 });
diff --git a/e2e/composer-blocks.spec.ts b/e2e/composer-blocks.spec.ts
index 7a96ce7..44cfd26 100644
--- a/e2e/composer-blocks.spec.ts
+++ b/e2e/composer-blocks.spec.ts
@@ -310,4 +310,9 @@ test("positive control: the experimental artifact really carries the block code
   walk(chunks);
   const carrying = files.filter((file) => readFileSync(file, "utf8").includes("blocksSidecar"));
   expect(carrying.length).toBeGreaterThan(0);
+  // Step 4's markers, which the default scans look for, are really in the experimental artifact.
+  const bodies = files.map((file) => readFileSync(file, "utf8"));
+  for (const marker of ["blocks-catalog", "preview-provenance", "preview-host-owned", "provenanceVerdicts"]) {
+    expect(bodies.some((body) => body.includes(marker)), marker).toBe(true);
+  }
 });
diff --git a/e2e/composer-prod-smoke.spec.ts b/e2e/composer-prod-smoke.spec.ts
index 487fb7a..90f0ca4 100644
--- a/e2e/composer-prod-smoke.spec.ts
+++ b/e2e/composer-prod-smoke.spec.ts
@@ -702,6 +702,9 @@ test("a default build ignores and drops block provenance: an imported file's pro
   await expect(page.getByTestId("preview-host-owned")).toHaveCount(0);
 });
 
+/** Step 4's UI and runtime call; the experimental suite's positive control finds each in its artifact. */
+const STEP4_MARKERS = ["blocks-catalog", "preview-provenance", "preview-host-owned", "provenanceVerdicts"];
+
 test("the default build ships no interface-block code (docs/BLOCKS.md: blocks stay out of default builds)", () => {
   // Scans the served artifact on disk, so a lazily loaded chunk cannot hide it.
   const chunks = fileURLToPath(new URL("../apps/composer/out/_next/static/chunks/", import.meta.url));
@@ -717,7 +720,8 @@ test("the default build ships no interface-block code (docs/BLOCKS.md: blocks st
   for (const file of files) {
     const body = readFileSync(file, "utf8");
     // actionManifest: the beta's Catalog export key (docs/blocks/HOST-ACTIONS.md).
-    for (const marker of ["blocksSidecar", "disable-actions-until-complete", "records-table", "auth-form", "guide-steps", "blocks-runtime", "reference-not-in-beta", "beta-switch-", "actionManifest"]) {
+    // The rest: step 4's Blocks catalog and Preview provenance line, and the runtime call behind them.
+    for (const marker of ["blocksSidecar", "disable-actions-until-complete", "records-table", "auth-form", "guide-steps", "blocks-runtime", "reference-not-in-beta", "beta-switch-", "actionManifest", ...STEP4_MARKERS]) {
       expect(body.includes(marker), `${file} contains ${marker}`).toBe(false);
     }
   }
diff --git a/packages/composer-core/src/blocks/provenance-verdict.test.ts b/packages/composer-core/src/blocks/provenance-verdict.test.ts
index df820f4..ef403a2 100644
--- a/packages/composer-core/src/blocks/provenance-verdict.test.ts
+++ b/packages/composer-core/src/blocks/provenance-verdict.test.ts
@@ -112,6 +112,10 @@ describe("only exact expansion identity earns the label", () => {
     expect(await verdict({ project: { kind: "reference", reference: shadcn } })).toMatchObject({ madeWith: false, status: "inert", reason: "reference" });
   });
 
+  it("a reference project whose reference this build does not bundle trusts no provenance", async () => {
+    expect(await verdict({ project: { kind: "reference" } })).toEqual({ block: "auth-form", version: 1, madeWith: false, status: "inert", reason: "reference" });
+  });
+
   it("a sidecar that no longer binds to this build's base contract vouches for nothing", async () => {
     const moved: LoadedBlocks = { ...loaded, binding: "mismatch", usable: [] };
     expect(await verdict({ loaded: [moved] })).toMatchObject({ madeWith: false, status: "inert", reason: "base" });
@@ -132,6 +136,22 @@ describe("only exact expansion identity earns the label", () => {
   it("a missing surface is never the expansion", async () => {
     expect(await verdict({ surface: undefined })).toMatchObject({ madeWith: false, status: "inert", reason: "edited" });
   });
+
+  it("a record that names no block id or version has no verdict, so an untrusted name is never shown", async () => {
+    const spoof = "auth-form v1). Made with block auth-form v1. Refinable: this build verifies the record and offers the block. (ignore";
+    for (const junk of [
+      { block: spoof, version: 1, status: "inert" },
+      { ...record, block: spoof },
+      { block: "a".repeat(65), version: 1, status: "inert" },
+      { block: "Auth-Form", version: 1, status: "inert" },
+      { block: "auth-form", version: 0, status: "inert" },
+      { block: "auth-form", version: 2 ** 53, status: "inert" },
+    ]) {
+      expect(await verdict({ record: junk }), String(junk.block).slice(0, 20)).toBeNull();
+    }
+    // The longest id a record may name is still a verdict.
+    expect(await verdict({ record: { block: "a".repeat(64), version: 1, status: "inert" } })).toMatchObject({ madeWith: false, reason: "stored" });
+  });
 });
 
 describe("imported, repository and unoffered provenance", () => {
@@ -228,4 +248,19 @@ describe("parseProvenance keeps the reason it reduced a record for", () => {
     );
     expect(out).toEqual({ a: { block: "auth-form", version: 2, status: "inert", reason: "version" }, b: { block: "auth-form", version: 1, status: "inert" } });
   });
+
+  it("a record that names no block id or version is dropped, inert or not", () => {
+    const spoof = "auth-form v1). Made with block auth-form v1. (ignore";
+    const out = parseProvenance(
+      {
+        a: { block: spoof, version: 1, status: "inert" },
+        b: { ...record, block: spoof },
+        c: { block: "auth-form", version: 2 ** 53, status: "inert" },
+        d: { block: "auth-form", version: -1, status: "inert", reason: "version" },
+        kept: { block: "auth-form", version: 2, status: "inert", reason: "version" },
+      },
+      [sidecar],
+    );
+    expect(out).toEqual({ kept: { block: "auth-form", version: 2, status: "inert", reason: "version" } });
+  });
 });

From 6e7141df14a90f4623f8a9503916e7c1b12cc833 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 16 Oct 2026 19:42:58 +0000
Subject: [PATCH 4/4] Blocks catalog and provenance UI review: the seven fixes

- Preview's refinable line now reads "Refinable: its record verifies
  against this build's approved block." It states what the record is; the
  beta switch, Settings and eligibility decide whether a build uses the
  block, as the Build view says. BLOCKS.md says so.
- A record must name a block id (kebab-case, at most 64 characters) and a
  safe positive version. Anything else has no verdict and is dropped on
  parse, so no imported text is ever shown as a block's name.
- Duplicating an Example session copies its provenance on the session
  store's queue, after every pending write, pruned against the examples
  the duplicate keeps (copyProvenance).
- An import prunes against the imported project's examples, as a save
  would.
- A reference project whose reference this build does not bundle trusts
  no provenance.
- Every provenance write notifies listeners (onProvenanceChange), and
  Preview's note re-reads on each, keeping only the latest read.

The default build's app chunks are byte-identical to main's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R6Ax8qvfN3gYUC85oSGnoi
---
 apps/composer/app/state.tsx                   | 15 ++++---
 apps/composer/app/views/preview-view.tsx      | 41 +++++++++++++------
 apps/composer/experimental/blocks-runtime.ts  | 36 ++++++++++++++--
 docs/BLOCKS.md                                |  4 +-
 docs/blocks/PHASE-2-RELEASE-PLAN.md           |  2 +-
 .../composer-core/src/blocks/provenance.ts    | 19 +++++----
 packages/composer-core/src/blocks/schema.ts   |  3 +-
 7 files changed, 87 insertions(+), 33 deletions(-)

diff --git a/apps/composer/app/state.tsx b/apps/composer/app/state.tsx
index 3cfa27b..f86c7c0 100644
--- a/apps/composer/app/state.tsx
+++ b/apps/composer/app/state.tsx
@@ -79,7 +79,7 @@ import {
 } from "./providers";
 import { planGoal } from "./planning";
 import { loadExperimental, saveExperimental, type ExperimentalPreferences } from "./experimental";
-import { loadBlockProvenance, saveBlockProvenance } from "./block-provenance";
+import { loadBlockProvenance } from "./block-provenance";
 import {
   bindStepSurface,
   emittedActionsBySurface,
@@ -589,9 +589,13 @@ export function ComposerProvider({ children }: { children: ReactNode }) {
     const delta = examplesDelta(base, live);
     const p = createProject({ name: `My ${ref.label} project`, description: "", source: { kind: "reference", referenceId: refId } });
     if (delta.length > 0) saveExamplesDelta(p.id, delta);
-    // Interface blocks (experimental): the session's provenance comes along too.
-    if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1" && Object.keys(sessionProvenance.current).length > 0) {
-      saveBlockProvenance(p.id, sessionProvenance.current);
+    // Interface blocks (experimental): the session's provenance comes along
+    // too, once every write already queued for it has landed, pruned against
+    // the examples the duplicate keeps.
+    if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1") {
+      void import("../experimental/blocks-runtime")
+        .then((runtime) => runtime.copyProvenance(runtime.memoryProvenanceStore(sessionProvenance), runtime.projectProvenanceStore(p.id), live))
+        .catch(() => undefined);
     }
     setProjects(listProjects());
     openProject(p.id); // clears the example workspace, merges the delta
@@ -626,9 +630,10 @@ export function ComposerProvider({ children }: { children: ReactNode }) {
       if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1") {
         try {
           const raw = (JSON.parse(text) as { blockProvenance?: unknown }).blockProvenance;
+          const examples = ((parsed.vocab.contract.examples as ExampleEntry[] | undefined) ?? []) as ExampleEntry[];
           if (raw && typeof raw === "object") {
             void import("../experimental/blocks-runtime")
-              .then((runtime) => runtime.importProvenance(runtime.projectProvenanceStore(p.id), raw))
+              .then((runtime) => runtime.importProvenance(runtime.projectProvenanceStore(p.id), raw, examples))
               .catch(() => undefined);
           }
         } catch {
diff --git a/apps/composer/app/views/preview-view.tsx b/apps/composer/app/views/preview-view.tsx
index f184730..2acc8da 100644
--- a/apps/composer/app/views/preview-view.tsx
+++ b/apps/composer/app/views/preview-view.tsx
@@ -723,26 +723,41 @@ function BlockProvenanceNote({ surfaceName }: { surfaceName: string }) {
   const [note, setNote] = useState<Note | null>(null);
   useEffect(() => {
     let cancelled = false;
+    let unsubscribe = () => {};
     setNote(null);
-    const provenance = activeProject ? blockProvenanceFor(activeProject.id) : {};
-    if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1" && activeProject && Object.hasOwn(provenance, surfaceName)) {
-      const source = activeProject.source;
+    if (process.env.NEXT_PUBLIC_COMPOSER_EXPERIMENTAL === "1" && activeProject) {
+      const project = activeProject;
+      const source = project.source;
       const examples = (contract?.examples as Array<{ id?: unknown; surface?: unknown }> | undefined) ?? [];
       void import("../../experimental/blocks-runtime")
-        .then(async (runtime) => {
-          const verdicts = await runtime.provenanceVerdicts({
-            provenance: { [surfaceName]: provenance[surfaceName] },
-            examples,
-            project: source.kind === "reference" ? { kind: "reference", referenceId: source.referenceId } : { kind: source.kind },
-          });
-          const verdict = verdicts[surfaceName];
-          if (cancelled || !verdict) return;
-          setNote({ ...verdict, ...(verdict.reason ? { reasonText: runtime.PROVENANCE_REASON_TEXT[verdict.reason] } : {}) });
+        .then((runtime) => {
+          // Read now, and again after every provenance write (an accept, a
+          // prune, an import or a duplicate's copy can land after this mounts);
+          // only the latest read may set the note.
+          let reads = 0;
+          const read = async () => {
+            const seq = ++reads;
+            const provenance = blockProvenanceFor(project.id);
+            const verdicts = Object.hasOwn(provenance, surfaceName)
+              ? await runtime.provenanceVerdicts({
+                  provenance: { [surfaceName]: provenance[surfaceName] },
+                  examples,
+                  project: source.kind === "reference" ? { kind: "reference", referenceId: source.referenceId } : { kind: source.kind },
+                })
+              : {};
+            if (cancelled || seq !== reads) return;
+            const verdict = verdicts[surfaceName];
+            setNote(verdict ? { ...verdict, ...(verdict.reason ? { reasonText: runtime.PROVENANCE_REASON_TEXT[verdict.reason] } : {}) } : null);
+          };
+          if (cancelled) return;
+          unsubscribe = runtime.onProvenanceChange(() => void read().catch(() => undefined));
+          return read();
         })
         .catch(() => undefined);
     }
     return () => {
       cancelled = true;
+      unsubscribe();
     };
   }, [activeProject, contract, surfaceName, blockProvenanceFor]);
   if (!note) return null;
@@ -754,7 +769,7 @@ function BlockProvenanceNote({ surfaceName }: { surfaceName: string }) {
           <>
             Made with {label}.{" "}
             {note.status === "refinable"
-              ? "Refinable: this build verifies the record and offers the block."
+              ? "Refinable: its record verifies against this build's approved block."
               : note.status === "unavailable"
                 ? `Unavailable: ${note.reasonText}.`
                 : `Inert: ${note.reasonText}.`}
diff --git a/apps/composer/experimental/blocks-runtime.ts b/apps/composer/experimental/blocks-runtime.ts
index ebd32bf..40a7209 100644
--- a/apps/composer/experimental/blocks-runtime.ts
+++ b/apps/composer/experimental/blocks-runtime.ts
@@ -456,13 +456,28 @@ export function memoryProvenanceStore(holder: { current: Record<string, unknown>
 }
 
 const chains = new Map<string, Promise<void>>();
+const listeners = new Set<(key: string) => void>();
 function serialized(key: string, work: () => Promise<void>): Promise<void> {
   const prev = chains.get(key) ?? Promise.resolve();
-  const next = prev.then(work, work);
+  const next = prev.then(work, work).finally(() => {
+    for (const listener of listeners) {
+      try {
+        listener(key);
+      } catch {
+        /* a listener never breaks the chain */
+      }
+    }
+  });
   chains.set(key, next);
   return next;
 }
 
+/** Called with the store's key after every provenance write, so an open view can re-read. Returns the unsubscribe. */
+export function onProvenanceChange(listener: (key: string) => void): () => void {
+  listeners.add(listener);
+  return () => void listeners.delete(listener);
+}
+
 async function sidecarsLoaded(): Promise<BlocksSidecar[]> {
   const loaded = await Promise.all(Object.keys(SIDECARS).map((id) => loadedFor(id)));
   return loaded.map((l) => l.sidecar).filter((s): s is BlocksSidecar => !!s);
@@ -494,11 +509,24 @@ export function gcProvenance(store: ProvenanceStore, examples: ReadonlyArray<{ i
   });
 }
 
-/** On import: keep only what the bundled sidecars can vouch for. */
-export function importProvenance(store: ProvenanceStore, raw: unknown): Promise<void> {
+/** On import: keep only what the bundled sidecars can vouch for, pruned against the imported project's examples as a save would. */
+export function importProvenance(store: ProvenanceStore, raw: unknown, examples: ReadonlyArray<{ id: string; surface?: unknown }>): Promise<void> {
   return serialized(store.key, async () => {
     const sidecars = await sidecarsLoaded();
-    store.save(parseProvenance(raw, sidecars));
+    store.save(await pruneProvenance(parseProvenance(raw, sidecars), examples));
+  });
+}
+
+/**
+ * Duplicating an Example session: its provenance comes along once every
+ * write already queued for it has landed, pruned against the examples the
+ * duplicate keeps, so nothing stale travels whatever the timing.
+ */
+export function copyProvenance(from: ProvenanceStore, to: ProvenanceStore, examples: ReadonlyArray<{ id: string; surface?: unknown }>): Promise<void> {
+  return serialized(from.key, async () => {
+    const map = await pruneProvenance({ ...from.load() }, examples);
+    if (Object.keys(map).length === 0) return;
+    await serialized(to.key, async () => to.save(map));
   });
 }
 
diff --git a/docs/BLOCKS.md b/docs/BLOCKS.md
index 2d28841..4e2c1fa 100644
--- a/docs/BLOCKS.md
+++ b/docs/BLOCKS.md
@@ -195,8 +195,8 @@ Two rules apply in every experimental build. A block is offered only when it and
 
 **The Blocks catalog and provenance UI (step 4; [blocks/PHASE-2-RELEASE-PLAN.md](blocks/PHASE-2-RELEASE-PLAN.md), §7 H3 and §8).** Read-only, and only in an experimental build.
 - **Catalog.** A Blocks section lists every bundled block: its reference, version, status, intents, declared actions and streaming policy.
-- **Preview.** A surface's provenance reads "made with block X vN" only when its trusted call re-expands to exactly that surface (`provenanceVerdict` in `packages/composer-core/src/blocks/provenance.ts`). It is refinable, unavailable (an imported or repository project) or inert, and an inert record names its reason. A block surface also says its actions are host-owned and not executed here. A verdict grants nothing.
-- **Lifecycle.** Provenance follows a project through export, import, duplicate and delete as before. A save drops stale records, now in an Example session too.
+- **Preview.** A surface's provenance reads "made with block X vN" only when its trusted call re-expands to exactly that surface (`provenanceVerdict` in `packages/composer-core/src/blocks/provenance.ts`). It is refinable, unavailable (an imported or repository project) or inert, and an inert record names its reason. Refinable says what the record is: it verifies against an approved block this build loaded. It does not say a build will use the block; the beta switch, Settings and the project's eligibility decide that, as the Build view states. A record that names no block id is dropped, so an imported name is never shown. A block surface also says its actions are host-owned and not executed here. A verdict grants nothing.
+- **Lifecycle.** Provenance follows a project through export, import, duplicate and delete as before. A save drops stale records, now in an Example session too, and so does an import. Duplicating an Example session copies its provenance once every pending write has landed, pruned against the examples the duplicate keeps.
 
 ## The live evaluation (Phase 1B)
 
diff --git a/docs/blocks/PHASE-2-RELEASE-PLAN.md b/docs/blocks/PHASE-2-RELEASE-PLAN.md
index 897a818..bc82480 100644
--- a/docs/blocks/PHASE-2-RELEASE-PLAN.md
+++ b/docs/blocks/PHASE-2-RELEASE-PLAN.md
@@ -5,7 +5,7 @@
 > - G1 has landed: the records on main that §3 lists. So the plan's statements about what main holds describe `7e260c3`, before G1. For example, `docs/blocks/baseline.json` is now committed ([BASELINE.md](BASELINE.md)).
 > - The owner authorized step 2 on 2026-10-16, and it is built: the beta's delivery path, guards and switches ([../BLOCKS.md](../BLOCKS.md), "The beta (Phase 2)"; [../deployment.md](../deployment.md), "The beta composer"). No beta is deployed. Each later Phase 2 change still needs the owner's authorization.
 > - The owner authorized step 3 on 2026-10-16, limited to H1, H2 and H4 (§7), and it is built: the B0 action-id proof, the action manifest in the beta's Catalog export, and the host guide ([HOST-ACTIONS.md](HOST-ACTIONS.md)). The Catalog export that §7 locates at `exportBundle` in `preview-view.tsx` is now built by `catalogBundle` in `apps/composer/app/catalog-export.ts`. The manifest reads each surface's actions with `actionEvents` (`packages/composer-core/src/blocks/actions.ts`), which also reads each context, rather than `emittedActionNames`. H3, the Blocks catalog view and Preview's label, belongs to step 4.
-> - The owner authorized step 4 on 2026-10-16: the read-only Blocks catalog and provenance UI (§7 H3, §8), and the first three host-guide clarifications from step 3's review. It is built: a Blocks section in the Catalog view; in Preview, a surface's provenance ("made with block X vN", only by exact expansion identity) with its status and specific reason, and the note that block actions are host-owned and not executed here; and §8's lifecycle, with an Example session's save now pruning its provenance too. Nothing grants an action anything, and the default build is unchanged.
+> - The owner authorized step 4 on 2026-10-16: the read-only Blocks catalog and provenance UI (§7 H3, §8), and the first three host-guide clarifications from step 3's review. It is built: a Blocks section in the Catalog view; in Preview, a surface's provenance ("made with block X vN", only by exact expansion identity) with its status and specific reason, and the note that block actions are host-owned and not executed here; and §8's lifecycle, with an Example session's save, its duplicate and every import now pruning stale provenance too. Refinable states what a record is, not that a build will use the block. Nothing grants an action anything, and the default build is unchanged.
 
 Final version, 2026-10-16. The owner accepted the plan on 2026-10-15 as the conditional working plan for the next AF Composer release, and this version carries the owner's three clarifications (below) and the shadcn/ui v3 result. It is not authorization to begin Phase 2: nothing in it starts until the owner authorizes it. No code.
 
diff --git a/packages/composer-core/src/blocks/provenance.ts b/packages/composer-core/src/blocks/provenance.ts
index a43efed..36fa173 100644
--- a/packages/composer-core/src/blocks/provenance.ts
+++ b/packages/composer-core/src/blocks/provenance.ts
@@ -9,7 +9,8 @@
  * state. An entry is written only when the accepted surface is exactly the
  * expansion; on import, anything that cannot be trusted is reduced to an
  * inert {block, version, status, reason} and the surface renders as an
- * ordinary one.
+ * ordinary one. A record that does not name a block id and version is
+ * dropped, so no imported text is ever shown as a block's name.
  *
  * What a surface's provenance means is the verdict (provenanceVerdict): a
  * surface is "made with block X vN" only by exact expansion identity, and a
@@ -19,7 +20,7 @@ import { checkConstraints, validateCall } from "./call";
 import { expandBlock, expansionDigest } from "./expand";
 import type { LoadedBlocks } from "./load";
 import type { BlockTrace } from "./phase";
-import type { BlocksSidecar } from "./schema";
+import { BLOCK_ID, type BlocksSidecar } from "./schema";
 
 type Json = Record<string, unknown>;
 
@@ -64,6 +65,10 @@ export type ProvenanceRecord = BlockProvenanceEntry | InertProvenance;
 
 const isObject = (value: unknown): value is Json => !!value && typeof value === "object" && !Array.isArray(value);
 
+/** A name a record may give its block: a block id, at most 64 characters. Anything else is never shown. */
+const isBlockName = (value: unknown): value is string => typeof value === "string" && value.length <= 64 && BLOCK_ID.test(value);
+const isBlockVersion = (value: unknown): value is number => Number.isSafeInteger(value) && (value as number) >= 1;
+
 export async function buildProvenanceEntry(
   trace: BlockTrace,
   accepted: unknown,
@@ -142,7 +147,7 @@ export function parseProvenance(raw: unknown, sidecars: readonly BlocksSidecar[]
   if (!isObject(raw)) return {};
   const out: Record<string, ProvenanceRecord> = {};
   for (const [id, value] of Object.entries(raw)) {
-    if (!isObject(value) || typeof value.block !== "string" || !Number.isInteger(value.version)) continue;
+    if (!isObject(value) || !isBlockName(value.block) || !isBlockVersion(value.version)) continue;
     const inert = (reason: InertReason | undefined): InertProvenance => ({ block: value.block as string, version: value.version as number, status: "inert", ...(reason ? { reason } : {}) });
     if (value.status === "inert") {
       out[id] = inert(knownReason(value.reason));
@@ -208,16 +213,16 @@ export async function provenanceVerdict(input: {
   surface: unknown;
   /** Every bundled sidecar, as loaded (B0 and H1 applied). */
   loaded: readonly LoadedBlocks[];
-  /** A reference project names its packaged reference; an imported or repository project does not. */
+  /** A reference project names its packaged reference, and trusts no provenance without one; an imported or repository project names none. */
   project: { kind: "reference" | "imported" | "agent"; reference?: { name: string; dspack: string; version: string } };
 }): Promise<ProvenanceVerdict | null> {
   const { record, project } = input;
-  if (!isObject(record) || typeof record.block !== "string" || !Number.isInteger(record.version)) return null;
-  const named = { block: record.block, version: record.version as number };
+  if (!isObject(record) || !isBlockName(record.block) || !isBlockVersion(record.version)) return null;
+  const named = { block: record.block, version: record.version };
   const inert = (reason: InertReason, madeWith = false): ProvenanceVerdict => ({ ...named, madeWith, status: "inert", reason });
   if (record.status === "inert") return inert(knownReason(record.reason) ?? "stored");
   try {
-    if (project.kind === "reference" && project.reference && !sameReference(record.reference as Json | undefined, project.reference)) return inert("reference");
+    if (project.kind === "reference" && (!project.reference || !sameReference(record.reference as Json | undefined, project.reference))) return inert("reference");
     const sidecars = input.loaded.flatMap((l) => (l.sidecar ? [l.sidecar] : []));
     const untrusted = untrustedReason(record, sidecars);
     if (untrusted) return inert(untrusted);
diff --git a/packages/composer-core/src/blocks/schema.ts b/packages/composer-core/src/blocks/schema.ts
index 602ed06..6430c17 100644
--- a/packages/composer-core/src/blocks/schema.ts
+++ b/packages/composer-core/src/blocks/schema.ts
@@ -24,7 +24,8 @@ export const BLOCKS_SIDECAR_VERSION = "0.1";
 export const RESERVED_PROP_NAMES = new Set(["block", "version", "b", "v", "p"]);
 
 const PROP_NAME = /^[a-z][a-zA-Z0-9]*$/;
-const BLOCK_ID = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+/** A block id: kebab-case. Provenance also holds a name it shows to this grammar. */
+export const BLOCK_ID = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 const ACTION_NAME = /^[a-z0-9]+(?:_[a-z0-9]+)*$/;
 
 export type ValueType = "string" | "enum" | "boolean" | "integer" | "array" | "object";