From 19ff2c96e503f779688fe076815e0bccdb8e80cb Mon Sep 17 00:00:00 2001
From: Patrick Lee Scott <pat@patscott.io>
Date: Tue, 4 Aug 2026 16:40:42 -0500
Subject: [PATCH 1/6] feat(e2e-ui): ship blob board pure as WASM from blob-core

Extract pure simulate_move into blob-core (no distributed host), export
it via blob-wasm, and replace the TypeScript board twin with a thin
loader that registers the same pure id for auto-optimism.

make wasm / ui-install builds pkg; CI installs wasm-pack + wasm32.
---
 .github/workflows/integration-e2e-ui.yaml     |   8 +
 tests/e2e-ui/Cargo.toml                       |   2 +
 tests/e2e-ui/Makefile                         |  18 +-
 tests/e2e-ui/crates/blob-core/Cargo.toml      |  11 ++
 .../e2e-ui/crates/blob-core/src/direction.rs  |  31 +++
 tests/e2e-ui/crates/blob-core/src/lib.rs      |  10 +
 tests/e2e-ui/crates/blob-core/src/simulate.rs | 146 ++++++++++++++
 tests/e2e-ui/crates/blob-core/src/tile.rs     |   8 +
 tests/e2e-ui/crates/blob-domain/Cargo.toml    |   1 +
 tests/e2e-ui/crates/blob-domain/src/lib.rs    |   4 +-
 .../blob-domain/src/models/blob_game.rs       |  96 +---------
 .../blob-domain/src/models/direction.rs       |  32 +---
 .../crates/blob-domain/src/models/tile.rs     |   9 +-
 tests/e2e-ui/crates/blob-wasm/Cargo.toml      |  19 ++
 tests/e2e-ui/crates/blob-wasm/src/lib.rs      |  33 ++++
 .../e2e-ui/crates/service/src/modules/blob.rs |   2 +-
 tests/e2e-ui/ui/src/lib/blob/simulate-move.ts | 179 ++++++++----------
 .../src/routes/blob/[[gameId]]/+page.svelte   |  10 +-
 tests/e2e-ui/ui/vite.config.ts                |   5 +
 19 files changed, 390 insertions(+), 234 deletions(-)
 create mode 100644 tests/e2e-ui/crates/blob-core/Cargo.toml
 create mode 100644 tests/e2e-ui/crates/blob-core/src/direction.rs
 create mode 100644 tests/e2e-ui/crates/blob-core/src/lib.rs
 create mode 100644 tests/e2e-ui/crates/blob-core/src/simulate.rs
 create mode 100644 tests/e2e-ui/crates/blob-core/src/tile.rs
 create mode 100644 tests/e2e-ui/crates/blob-wasm/Cargo.toml
 create mode 100644 tests/e2e-ui/crates/blob-wasm/src/lib.rs

diff --git a/.github/workflows/integration-e2e-ui.yaml b/.github/workflows/integration-e2e-ui.yaml
index ec4b0ffc..19cd5470 100644
--- a/.github/workflows/integration-e2e-ui.yaml
+++ b/.github/workflows/integration-e2e-ui.yaml
@@ -28,12 +28,16 @@ jobs:
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
         with:
           toolchain: stable
+          targets: wasm32-unknown-unknown
 
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: tests/e2e-ui -> target
           shared-key: e2e-ui-offline
 
+      - name: Install wasm-pack
+        run: cargo install wasm-pack --locked || cargo install wasm-pack
+
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
@@ -62,12 +66,16 @@ jobs:
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
         with:
           toolchain: stable
+          targets: wasm32-unknown-unknown
 
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: tests/e2e-ui -> target
           shared-key: e2e-ui-browser
 
+      - name: Install wasm-pack
+        run: cargo install wasm-pack --locked || cargo install wasm-pack
+
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
diff --git a/tests/e2e-ui/Cargo.toml b/tests/e2e-ui/Cargo.toml
index cd0e2a16..62879695 100644
--- a/tests/e2e-ui/Cargo.toml
+++ b/tests/e2e-ui/Cargo.toml
@@ -7,7 +7,9 @@ resolver = "2"
 members = [
     "crates/todo-domain",
     "crates/chat-domain",
+    "crates/blob-core",
     "crates/blob-domain",
+    "crates/blob-wasm",
     "crates/readmodels",
     "crates/projections",
     "crates/service",
diff --git a/tests/e2e-ui/Makefile b/tests/e2e-ui/Makefile
index 4afb618c..2f622f86 100644
--- a/tests/e2e-ui/Makefile
+++ b/tests/e2e-ui/Makefile
@@ -6,7 +6,7 @@
 #   make test-browser # Playwright UI e2e (needs make up + make run)
 
 .PHONY: all up down run run-api stop test ci-offline test-domain test-suite \
-	test-browser test-browser-install js-install js-build ui-install ui-build ui-check ui-test \
+	test-browser test-browser-install js-install js-build wasm ui-install ui-build ui-check ui-test \
 	gen-client check-client contracts-check check clean help
 
 # Defaults only — do NOT `include e2e-ui.env` (shell-quoted dotenv breaks Make).
@@ -118,7 +118,7 @@ ci-offline: ui-install
 	echo "OK — generated drift + offline Rust/UI suites"
 
 test-domain:
-	cargo test -p todo-domain -p chat-domain $(CARGO_TEST_FLAGS)
+	cargo test -p todo-domain -p chat-domain -p blob-core -p blob-domain $(CARGO_TEST_FLAGS)
 
 test-suite:
 	cargo test -p e2e-suite --test behavioral $(CARGO_TEST_FLAGS)
@@ -140,7 +140,14 @@ js-install:
 js-build: js-install
 	cd $(JS_DIR) && $(NPM) run build
 
-ui-install: js-build
+## Pure blob board rules → ui/src/lib/blob/pkg (wasm-pack; requires wasm32-unknown-unknown).
+wasm:
+	@command -v wasm-pack >/dev/null || { echo "wasm-pack required: cargo install wasm-pack"; exit 1; }
+	@rustup target list --installed | grep -q wasm32-unknown-unknown || rustup target add wasm32-unknown-unknown
+	@out="$(CURDIR)/ui/src/lib/blob/pkg"; \
+	  wasm-pack build crates/blob-wasm --target web --out-dir "$$out" --out-name blob_wasm
+
+ui-install: js-build wasm
 	cd ui && $(NPM) install
 
 ui-build: ui-install
@@ -171,13 +178,13 @@ contracts-check:
 
 check: check-client
 	cargo check --workspace
-	cargo test -p todo-domain -p chat-domain --no-run
+	cargo test -p todo-domain -p chat-domain -p blob-core -p blob-domain --no-run
 	cargo test -p e2e-suite --test behavioral --no-run
 
 clean: stop
 	cargo clean
 	rm -f .make-runner.log e2e-ui.db
-	rm -rf ui/node_modules ui/build ui/.svelte-kit
+	rm -rf ui/node_modules ui/build ui/.svelte-kit ui/src/lib/blob/pkg
 
 help:
 	@echo "e2e-ui"
@@ -185,6 +192,7 @@ help:
 	@echo "  make run        API + UI (source e2e-ui.env when present)"
 	@echo "  make test       offline suite + UI structural"
 	@echo "  make ci-offline CI drift + offline suites with safe pipeline overlap"
+	@echo "  make wasm            blob-core pure → ui/src/lib/blob/pkg (wasm-pack)"
 	@echo "  make gen-client      typed Service → generated user/admin clients"
 	@echo "  make check-client    verify generated artifacts byte-for-byte"
 	@echo "  make down       docker compose down"
diff --git a/tests/e2e-ui/crates/blob-core/Cargo.toml b/tests/e2e-ui/crates/blob-core/Cargo.toml
new file mode 100644
index 00000000..af41577f
--- /dev/null
+++ b/tests/e2e-ui/crates/blob-core/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "blob-core"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+description = "Pure blob board rules (WASM-eligible; no distributed host)"
+
+[dependencies]
+serde = { workspace = true }
+serde_json = { workspace = true }
diff --git a/tests/e2e-ui/crates/blob-core/src/direction.rs b/tests/e2e-ui/crates/blob-core/src/direction.rs
new file mode 100644
index 00000000..c2f35d8c
--- /dev/null
+++ b/tests/e2e-ui/crates/blob-core/src/direction.rs
@@ -0,0 +1,31 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Direction {
+    Up,
+    Down,
+    Left,
+    Right,
+}
+
+impl Direction {
+    pub fn parse(s: &str) -> Option<Self> {
+        match s.trim().to_ascii_lowercase().as_str() {
+            "up" => Some(Self::Up),
+            "down" => Some(Self::Down),
+            "left" => Some(Self::Left),
+            "right" => Some(Self::Right),
+            _ => None,
+        }
+    }
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Up => "up",
+            Self::Down => "down",
+            Self::Left => "left",
+            Self::Right => "right",
+        }
+    }
+}
diff --git a/tests/e2e-ui/crates/blob-core/src/lib.rs b/tests/e2e-ui/crates/blob-core/src/lib.rs
new file mode 100644
index 00000000..9d2c5603
--- /dev/null
+++ b/tests/e2e-ui/crates/blob-core/src/lib.rs
@@ -0,0 +1,10 @@
+//! Pure blob board rules shared by the domain aggregate and client WASM.
+//!
+//! No I/O, no `distributed`, no ownership — only map + score + direction.
+
+mod direction;
+mod simulate;
+pub mod tile;
+
+pub use direction::Direction;
+pub use simulate::{simulate_move, MovePreview, SimulateError};
diff --git a/tests/e2e-ui/crates/blob-core/src/simulate.rs b/tests/e2e-ui/crates/blob-core/src/simulate.rs
new file mode 100644
index 00000000..382a34fc
--- /dev/null
+++ b/tests/e2e-ui/crates/blob-core/src/simulate.rs
@@ -0,0 +1,146 @@
+//! Pure post-move board snapshot.
+
+use crate::tile;
+use crate::Direction;
+
+/// Pure post-move board snapshot (no ownership / aggregate checks).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct MovePreview {
+    pub map: Vec<Vec<u8>>,
+    pub score: i64,
+    pub player_dead: bool,
+    pub level_complete: bool,
+}
+
+impl MovePreview {
+    pub fn status(&self) -> String {
+        if self.player_dead {
+            "dead".into()
+        } else if self.level_complete {
+            "level_complete".into()
+        } else {
+            "active".into()
+        }
+    }
+}
+
+/// Failures from pure board simulation (fail-closed on the client).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum SimulateError {
+    NoActiveLevel,
+    CannotMove(&'static str),
+}
+
+/// Apply one direction to a map + score.
+pub fn simulate_move(
+    map: &[Vec<u8>],
+    score: i64,
+    direction: Direction,
+) -> Result<MovePreview, SimulateError> {
+    if map.is_empty() || map[0].is_empty() {
+        return Err(SimulateError::NoActiveLevel);
+    }
+    let (r, c) = player_pos_in(map)?;
+    let (nr, nc) = match direction {
+        Direction::Up => {
+            if r == 0 {
+                return Err(SimulateError::CannotMove("row already 0"));
+            }
+            (r - 1, c)
+        }
+        Direction::Down => {
+            if r + 1 >= map.len() {
+                return Err(SimulateError::CannotMove("already at bottom edge"));
+            }
+            (r + 1, c)
+        }
+        Direction::Left => {
+            if c == 0 {
+                return Err(SimulateError::CannotMove("column already 0"));
+            }
+            (r, c - 1)
+        }
+        Direction::Right => {
+            if c + 1 >= map[r].len() {
+                return Err(SimulateError::CannotMove("already at right edge"));
+            }
+            (r, c + 1)
+        }
+    };
+
+    let mut next_map = map.to_vec();
+    let mut score = score;
+    let mut player_dead = false;
+    let mut level_complete = false;
+
+    next_map[r][c] = tile::VISITED;
+    match next_map[nr][nc] {
+        tile::HOLE => next_map[nr][nc] = tile::DEAD_BY_HOLE,
+        tile::VISITED => next_map[nr][nc] = tile::DEAD_BY_SUICIDE,
+        tile::UNVISITED | tile::PLAYER => {
+            score += 1;
+            next_map[nr][nc] = tile::PLAYER;
+        }
+        _ => next_map[nr][nc] = tile::DEAD_BY_SUICIDE,
+    }
+    for row in &next_map {
+        if row.contains(&tile::DEAD_BY_HOLE) || row.contains(&tile::DEAD_BY_SUICIDE) {
+            player_dead = true;
+            level_complete = false;
+            break;
+        }
+    }
+    if !player_dead {
+        let any_u = next_map.iter().any(|row| row.contains(&tile::UNVISITED));
+        level_complete = !any_u;
+    }
+
+    Ok(MovePreview {
+        map: next_map,
+        score,
+        player_dead,
+        level_complete,
+    })
+}
+
+fn player_pos_in(map: &[Vec<u8>]) -> Result<(usize, usize), SimulateError> {
+    for (r, row) in map.iter().enumerate() {
+        for (c, &t) in row.iter().enumerate() {
+            if t == tile::PLAYER {
+                return Ok((r, c));
+            }
+        }
+    }
+    Err(SimulateError::NoActiveLevel)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::tile::*;
+
+    fn tiny() -> Vec<Vec<u8>> {
+        vec![
+            vec![PLAYER, UNVISITED, UNVISITED],
+            vec![UNVISITED, UNVISITED, UNVISITED],
+            vec![UNVISITED, UNVISITED, UNVISITED],
+        ]
+    }
+
+    #[test]
+    fn move_right_increments_score() {
+        let preview = simulate_move(&tiny(), 0, Direction::Right).unwrap();
+        assert_eq!(preview.score, 1);
+        assert!(!preview.player_dead);
+        assert_eq!(preview.map[0][0], VISITED);
+        assert_eq!(preview.map[0][1], PLAYER);
+    }
+
+    #[test]
+    fn edge_fails_closed() {
+        assert!(matches!(
+            simulate_move(&tiny(), 0, Direction::Up),
+            Err(SimulateError::CannotMove(_))
+        ));
+    }
+}
diff --git a/tests/e2e-ui/crates/blob-core/src/tile.rs b/tests/e2e-ui/crates/blob-core/src/tile.rs
new file mode 100644
index 00000000..9b2cb17f
--- /dev/null
+++ b/tests/e2e-ui/crates/blob-core/src/tile.rs
@@ -0,0 +1,8 @@
+//! Canonical tile values (client board + domain parity).
+
+pub const HOLE: u8 = 0;
+pub const UNVISITED: u8 = 1;
+pub const VISITED: u8 = 2;
+pub const DEAD_BY_SUICIDE: u8 = 3;
+pub const DEAD_BY_HOLE: u8 = 4;
+pub const PLAYER: u8 = 9;
diff --git a/tests/e2e-ui/crates/blob-domain/Cargo.toml b/tests/e2e-ui/crates/blob-domain/Cargo.toml
index c6b22f07..44779cd3 100644
--- a/tests/e2e-ui/crates/blob-domain/Cargo.toml
+++ b/tests/e2e-ui/crates/blob-domain/Cargo.toml
@@ -6,6 +6,7 @@ license.workspace = true
 publish.workspace = true
 
 [dependencies]
+blob-core = { path = "../blob-core" }
 distributed = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
diff --git a/tests/e2e-ui/crates/blob-domain/src/lib.rs b/tests/e2e-ui/crates/blob-domain/src/lib.rs
index ecaa3728..982b5f64 100644
--- a/tests/e2e-ui/crates/blob-domain/src/lib.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/lib.rs
@@ -1,7 +1,7 @@
 //! BlobGame aggregate — grid trail game (remake of ig-blob-game-model-service).
 //!
-//! Tile ints match JS `constants.ts` (player=9, hole=0, unvisited=1, visited=2,
-//! dead_by_suicide=3, dead_by_hole=4). Read models update only from emitted facts.
+//! Pure board rules live in [`blob_core`] (WASM-eligible). Tile ints match the
+//! client board helpers (player=9, hole=0, unvisited=1, visited=2, …).
 
 pub mod levels;
 pub mod models;
diff --git a/tests/e2e-ui/crates/blob-domain/src/models/blob_game.rs b/tests/e2e-ui/crates/blob-domain/src/models/blob_game.rs
index df0748f3..e197f328 100644
--- a/tests/e2e-ui/crates/blob-domain/src/models/blob_game.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/models/blob_game.rs
@@ -63,97 +63,17 @@ fn status_of(player_dead: bool, level_complete: bool) -> String {
     }
 }
 
-/// Pure post-move board snapshot (no ownership / aggregate checks).
-///
-/// Shared by the aggregate and client-side optimistic preview (TypeScript port
-/// in e2e-ui must stay byte-identical for tile rules).
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct MovePreview {
-    pub map: Vec<Vec<u8>>,
-    pub score: i64,
-    pub player_dead: bool,
-    pub level_complete: bool,
-}
+// Pure post-move board snapshot — defined in `blob_core`, re-exported here.
+pub use blob_core::{simulate_move, MovePreview};
 
-impl MovePreview {
-    pub fn status(&self) -> String {
-        status_of(self.player_dead, self.level_complete)
+fn map_simulate_err(err: blob_core::SimulateError) -> BlobError {
+    match err {
+        blob_core::SimulateError::NoActiveLevel => BlobError::NoActiveLevel,
+        blob_core::SimulateError::CannotMove(msg) => BlobError::CannotMove(msg.into()),
     }
 }
 
-/// Apply one direction to a map + score. Pure — used by [`BlobGame::move_dir`]
-/// and mirrored in the e2e-ui optimistic board sim.
-pub fn simulate_move(
-    map: &[Vec<u8>],
-    score: i64,
-    direction: Direction,
-) -> Result<MovePreview, BlobError> {
-    if map.is_empty() || map[0].is_empty() {
-        return Err(BlobError::NoActiveLevel);
-    }
-    let (r, c) = player_pos_in(map)?;
-    let (nr, nc) = match direction {
-        Direction::Up => {
-            if r == 0 {
-                return Err(BlobError::CannotMove("row already 0".into()));
-            }
-            (r - 1, c)
-        }
-        Direction::Down => {
-            if r + 1 >= map.len() {
-                return Err(BlobError::CannotMove("already at bottom edge".into()));
-            }
-            (r + 1, c)
-        }
-        Direction::Left => {
-            if c == 0 {
-                return Err(BlobError::CannotMove("column already 0".into()));
-            }
-            (r, c - 1)
-        }
-        Direction::Right => {
-            if c + 1 >= map[r].len() {
-                return Err(BlobError::CannotMove("already at right edge".into()));
-            }
-            (r, c + 1)
-        }
-    };
-
-    let mut next_map = map.to_vec();
-    let mut score = score;
-    let mut player_dead = false;
-    let mut level_complete = false;
-
-    next_map[r][c] = tile::VISITED;
-    match next_map[nr][nc] {
-        tile::HOLE => next_map[nr][nc] = tile::DEAD_BY_HOLE,
-        tile::VISITED => next_map[nr][nc] = tile::DEAD_BY_SUICIDE,
-        tile::UNVISITED | tile::PLAYER => {
-            score += 1;
-            next_map[nr][nc] = tile::PLAYER;
-        }
-        _ => next_map[nr][nc] = tile::DEAD_BY_SUICIDE,
-    }
-    for row in &next_map {
-        if row.contains(&tile::DEAD_BY_HOLE) || row.contains(&tile::DEAD_BY_SUICIDE) {
-            player_dead = true;
-            level_complete = false;
-            break;
-        }
-    }
-    if !player_dead {
-        let any_u = next_map.iter().any(|row| row.contains(&tile::UNVISITED));
-        level_complete = !any_u;
-    }
-
-    Ok(MovePreview {
-        map: next_map,
-        score,
-        player_dead,
-        level_complete,
-    })
-}
-
+#[cfg(test)]
 fn player_pos_in(map: &[Vec<u8>]) -> Result<(usize, usize), BlobError> {
     for (r, row) in map.iter().enumerate() {
         for (c, &t) in row.iter().enumerate() {
@@ -343,7 +263,7 @@ impl BlobGame {
         if self.current_level == 0 || self.map.is_empty() {
             return Err(BlobError::NoActiveLevel);
         }
-        let preview = simulate_move(&self.map, self.score, direction)?;
+        let preview = simulate_move(&self.map, self.score, direction).map_err(map_simulate_err)?;
         self.record_moved(
             preview.score,
             preview.player_dead,
diff --git a/tests/e2e-ui/crates/blob-domain/src/models/direction.rs b/tests/e2e-ui/crates/blob-domain/src/models/direction.rs
index c2f35d8c..59b863fc 100644
--- a/tests/e2e-ui/crates/blob-domain/src/models/direction.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/models/direction.rs
@@ -1,31 +1,3 @@
-use serde::{Deserialize, Serialize};
+//! Re-export pure direction from [`blob_core`].
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum Direction {
-    Up,
-    Down,
-    Left,
-    Right,
-}
-
-impl Direction {
-    pub fn parse(s: &str) -> Option<Self> {
-        match s.trim().to_ascii_lowercase().as_str() {
-            "up" => Some(Self::Up),
-            "down" => Some(Self::Down),
-            "left" => Some(Self::Left),
-            "right" => Some(Self::Right),
-            _ => None,
-        }
-    }
-
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Self::Up => "up",
-            Self::Down => "down",
-            Self::Left => "left",
-            Self::Right => "right",
-        }
-    }
-}
+pub use blob_core::Direction;
diff --git a/tests/e2e-ui/crates/blob-domain/src/models/tile.rs b/tests/e2e-ui/crates/blob-domain/src/models/tile.rs
index 5534c1cb..9841f12e 100644
--- a/tests/e2e-ui/crates/blob-domain/src/models/tile.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/models/tile.rs
@@ -1,8 +1,3 @@
-//! Canonical tile values (JS parity).
+//! Re-export pure tile constants from [`blob_core`].
 
-pub const HOLE: u8 = 0;
-pub const UNVISITED: u8 = 1;
-pub const VISITED: u8 = 2;
-pub const DEAD_BY_SUICIDE: u8 = 3;
-pub const DEAD_BY_HOLE: u8 = 4;
-pub const PLAYER: u8 = 9;
+pub use blob_core::tile::*;
diff --git a/tests/e2e-ui/crates/blob-wasm/Cargo.toml b/tests/e2e-ui/crates/blob-wasm/Cargo.toml
new file mode 100644
index 00000000..6b644cce
--- /dev/null
+++ b/tests/e2e-ui/crates/blob-wasm/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "blob-wasm"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+description = "WASM exports of blob-core pure board rules for client auto-optimism"
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[dependencies]
+blob-core = { path = "../blob-core" }
+serde = { workspace = true }
+serde_json = { workspace = true }
+wasm-bindgen = "0.2"
+
+[package.metadata.wasm-pack.profile.release]
+wasm-opt = false
diff --git a/tests/e2e-ui/crates/blob-wasm/src/lib.rs b/tests/e2e-ui/crates/blob-wasm/src/lib.rs
new file mode 100644
index 00000000..c672aada
--- /dev/null
+++ b/tests/e2e-ui/crates/blob-wasm/src/lib.rs
@@ -0,0 +1,33 @@
+//! Client WASM surface for blob pure reduces.
+//!
+//! JS calls [`blob_simulate_move`] with `map_json`, score, and direction; gets
+//! JSON fields for the optimistic patch (or null / undefined on fail-closed).
+
+use blob_core::{simulate_move, Direction};
+use wasm_bindgen::prelude::*;
+
+/// Apply one move for known-row optimism.
+///
+/// Returns a JSON object:
+/// `{ map_json, score, player_dead, current_level_completed, status }`
+/// or `undefined` when the move is impossible / input is invalid.
+#[wasm_bindgen(js_name = blobSimulateMove)]
+pub fn blob_simulate_move(map_json: &str, score: f64, direction: &str) -> Option<String> {
+    if !score.is_finite() {
+        return None;
+    }
+    // JS numbers are f64; board scores are small integers.
+    let score = score as i64;
+    let direction = Direction::parse(direction)?;
+    let map: Vec<Vec<u8>> = serde_json::from_str(map_json).ok()?;
+    let preview = simulate_move(&map, score, direction).ok()?;
+    let map_json = serde_json::to_string(&preview.map).ok()?;
+    let body = serde_json::json!({
+        "map_json": map_json,
+        "score": preview.score,
+        "player_dead": preview.player_dead,
+        "current_level_completed": preview.level_complete,
+        "status": preview.status(),
+    });
+    Some(body.to_string())
+}
diff --git a/tests/e2e-ui/crates/service/src/modules/blob.rs b/tests/e2e-ui/crates/service/src/modules/blob.rs
index b7318e54..376461c4 100644
--- a/tests/e2e-ui/crates/service/src/modules/blob.rs
+++ b/tests/e2e-ui/crates/service/src/modules/blob.rs
@@ -64,7 +64,7 @@ where
         >(blob_move::COMMAND)
         .field_name("blob_games_move")
         .roles(["user", "admin"].into_iter())
-        // Domain pure: blob_domain::simulate_move — client twin at $lib/blob/simulate-move.
+        // Domain pure: blob_core::simulate_move — client via blob-wasm ($lib/blob/simulate-move).
         .preview_reduce_known_record(
             CommandProjectionPureReduce::new(
                 "blob.simulate_move",
diff --git a/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts b/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
index 46a3cc10..757ec910 100644
--- a/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
+++ b/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
@@ -1,22 +1,13 @@
 /**
- * Pure post-move board snapshot — TypeScript twin of
- * `blob_domain::simulate_move`. Must stay byte-identical for tile rules so
- * auto-optimism paints the same board the Atomic response will seal.
+ * Client pure for `blob.simulate_move` — thin host over `blob-core` WASM.
  *
- * Registered as pure function `blob.simulate_move` on the command runtime.
+ * Board rules live once in Rust (`blob_core::simulate_move`). This module only
+ * loads the wasm package, adapts replica record/args, and fails closed when the
+ * module is not ready or the move is impossible.
+ *
+ * Build: `make wasm` (or `make ui-install`) → `./pkg` from wasm-pack.
  */
 
-const HOLE = 0;
-const UNVISITED = 1;
-const VISITED = 2;
-const DEAD_BY_SUICIDE = 3;
-const DEAD_BY_HOLE = 4;
-const PLAYER = 9;
-
-export type BlobMoveArgs = Readonly<{
-	direction: string;
-}>;
-
 export type BlobMoveResult = Readonly<{
 	map_json: string;
 	score: number;
@@ -25,27 +16,70 @@ export type BlobMoveResult = Readonly<{
 	status: string;
 }>;
 
+type WasmApi = {
+	default: (input?: unknown) => Promise<unknown>;
+	blobSimulateMove: (
+		map_json: string,
+		score: number,
+		direction: string
+	) => string | undefined;
+};
+
+let api: WasmApi | null = null;
+let initPromise: Promise<void> | null = null;
+
+function isBrowser(): boolean {
+	return typeof window !== 'undefined';
+}
+
 /**
- * Apply one direction to a known BlobGames row.
- * Returns null when the move is impossible (edge/no map) so optimism fails closed.
+ * Load and instantiate blob-core WASM. Safe to call multiple times.
+ * No-op on the server (SSR) — pure reduce fails closed until the client inits.
+ */
+export function ensureBlobWasm(): Promise<void> {
+	if (!isBrowser()) {
+		return Promise.resolve();
+	}
+	if (api) {
+		return Promise.resolve();
+	}
+	if (initPromise) {
+		return initPromise;
+	}
+	initPromise = (async () => {
+		const mod = (await import('./pkg/blob_wasm.js')) as WasmApi;
+		await mod.default();
+		api = mod;
+	})().catch((error) => {
+		initPromise = null;
+		api = null;
+		throw error;
+	});
+	return initPromise;
+}
+
+// Warm the module early on the client so the first move can pure-reduce.
+if (isBrowser()) {
+	void ensureBlobWasm().catch(() => {
+		// Fail closed later in simulateMove; do not break module load.
+	});
+}
+
+/**
+ * Apply one direction to a known BlobGames row (WASM pure).
+ * Returns null when not ready, invalid, or the move is impossible.
  */
 export function simulateMove(
 	record: Readonly<Record<string, unknown>>,
 	args: Readonly<Record<string, unknown>>
 ): BlobMoveResult | null {
+	if (!api) {
+		return null;
+	}
 	const direction = args.direction;
 	if (typeof direction !== 'string') return null;
 	const mapJson = record.map_json;
 	if (typeof mapJson !== 'string') return null;
-	let map: number[][];
-	try {
-		map = JSON.parse(mapJson) as number[][];
-	} catch {
-		return null;
-	}
-	if (!Array.isArray(map) || map.length === 0 || !Array.isArray(map[0]) || map[0]!.length === 0) {
-		return null;
-	}
 	const scoreRaw = record.score;
 	const score =
 		typeof scoreRaw === 'number'
@@ -57,84 +91,31 @@ export function simulateMove(
 					: NaN;
 	if (!Number.isFinite(score)) return null;
 
-	const pos = playerPos(map);
-	if (pos === null) return null;
-	const [r, c] = pos;
-	const next = step(r, c, direction, map);
-	if (next === null) return null;
-	const [nr, nc] = next;
-
-	const nextMap = map.map((row) => row.slice());
-	let nextScore = score;
-	let playerDead = false;
-	let levelComplete = false;
-
-	nextMap[r]![c] = VISITED;
-	const target = nextMap[nr]![nc]!;
-	if (target === HOLE) {
-		nextMap[nr]![nc] = DEAD_BY_HOLE;
-	} else if (target === VISITED) {
-		nextMap[nr]![nc] = DEAD_BY_SUICIDE;
-	} else if (target === UNVISITED || target === PLAYER) {
-		nextScore += 1;
-		nextMap[nr]![nc] = PLAYER;
-	} else {
-		nextMap[nr]![nc] = DEAD_BY_SUICIDE;
-	}
-
-	for (const row of nextMap) {
-		if (row.includes(DEAD_BY_HOLE) || row.includes(DEAD_BY_SUICIDE)) {
-			playerDead = true;
-			levelComplete = false;
-			break;
-		}
-	}
-	if (!playerDead) {
-		levelComplete = !nextMap.some((row) => row.includes(UNVISITED));
-	}
-
-	return Object.freeze({
-		map_json: JSON.stringify(nextMap),
-		score: nextScore,
-		player_dead: playerDead,
-		current_level_completed: levelComplete,
-		status: playerDead ? 'dead' : levelComplete ? 'level_complete' : 'active'
-	});
-}
-
-function playerPos(map: number[][]): [number, number] | null {
-	for (let r = 0; r < map.length; r += 1) {
-		const row = map[r]!;
-		for (let c = 0; c < row.length; c += 1) {
-			if (row[c] === PLAYER) return [r, c];
-		}
+	let json: string | undefined;
+	try {
+		json = api.blobSimulateMove(mapJson, score, direction);
+	} catch {
+		return null;
 	}
-	return null;
-}
-
-function step(
-	r: number,
-	c: number,
-	direction: string,
-	map: number[][]
-): [number, number] | null {
-	switch (direction) {
-		case 'up':
-			return r === 0 ? null : [r - 1, c];
-		case 'down':
-			return r + 1 >= map.length ? null : [r + 1, c];
-		case 'left':
-			return c === 0 ? null : [r, c - 1];
-		case 'right': {
-			const row = map[r]!;
-			return c + 1 >= row.length ? null : [r, c + 1];
-		}
-		default:
+	if (json === undefined || json === '') return null;
+	try {
+		const parsed = JSON.parse(json) as BlobMoveResult;
+		if (
+			typeof parsed.map_json !== 'string' ||
+			typeof parsed.score !== 'number' ||
+			typeof parsed.player_dead !== 'boolean' ||
+			typeof parsed.current_level_completed !== 'boolean' ||
+			typeof parsed.status !== 'string'
+		) {
 			return null;
+		}
+		return Object.freeze(parsed);
+	} catch {
+		return null;
 	}
 }
 
-/** Pure registry entry for the command runtime. */
+/** Pure registry entry for the command runtime (and generated pures.ts). */
 export const BLOB_PURE_FUNCTIONS = Object.freeze({
 	'blob.simulate_move': simulateMove
 });
diff --git a/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte b/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte
index 7414557d..ff30117d 100644
--- a/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte
+++ b/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte
@@ -4,14 +4,16 @@
 	 *
 	 * - URL (`/blob` | `/blob/{gameId}`) selects which game is active.
 	 * - Board and history derive from `BlobGames.use()`.
-	 * - Commands are Atomic: thin input (`game_id` + `direction`); board updates
-	 *   when the authoritative row seals on the response.
+	 * - Commands are Atomic: thin input (`game_id` + `direction`). Known-row pure
+	 *   optimism runs `blob.simulate_move` via blob-core WASM; Atomic seal is
+	 *   still server authority.
 	 */
 	import { onMount } from 'svelte';
 	import { goto } from '$app/navigation';
 	import { page } from '$app/state';
 	import { BlobGames, useCommands } from '$distributed';
 	import { parseBoard, TILE, type Direction } from '$lib/blob/board';
+	import { ensureBlobWasm } from '$lib/blob/simulate-move';
 	import { Button } from '$lib/components/shared/ui';
 	import { AppPage, InlineAlert, PageHeader } from '$lib/components/product';
 	import { HowItsBuilt } from '$lib/components/walkthrough';
@@ -189,6 +191,10 @@
 
 	onMount(() => {
 		hydrated = true;
+		// Ensure blob-core WASM is ready before pure-reduce optimism on move.
+		void ensureBlobWasm().catch(() => {
+			/* fail-closed pure until reload */
+		});
 		const testWindow = window as Window & {
 			__distributedBlobRefetch?: () => Promise<void>;
 		};
diff --git a/tests/e2e-ui/ui/vite.config.ts b/tests/e2e-ui/ui/vite.config.ts
index 9c4010a4..865e084f 100644
--- a/tests/e2e-ui/ui/vite.config.ts
+++ b/tests/e2e-ui/ui/vite.config.ts
@@ -12,9 +12,14 @@ const api = process.env.E2E_API_ORIGIN || process.env.E2E_BASE_URL || 'http://12
 export default defineConfig({
 	plugins: [distributedSvelteKit(distributedViteOptions), sveltekit()],
 	css: { devSourcemap: true },
+	// blob-core pure package (wasm-pack --target web)
+	assetsInclude: ['**/*.wasm'],
 	server: {
 		port: 5180,
 		// GraphQL-only public API (commands are mutations, not POST /todo.*).
 		proxy: distributedGraphqlProxy(api)
+	},
+	optimizeDeps: {
+		exclude: ['$lib/blob/pkg/blob_wasm.js']
 	}
 });

From 9a828a932d4e55679ddb994b28a738c68cfa9ce4 Mon Sep 17 00:00:00 2001
From: Patrick Lee Scott <pat@patscott.io>
Date: Tue, 4 Aug 2026 18:17:58 -0500
Subject: [PATCH 2/6] refactor(e2e-ui): single blob-domain crate with core +
 wasm features

Collapse blob-core and blob-wasm into blob-domain: pure rules live in
src/core/, WASM exports in src/wasm.rs behind --features wasm, aggregate
host stays default --features domain. make wasm builds that one package.
---
 tests/e2e-ui/Cargo.toml                       |  2 --
 tests/e2e-ui/Makefile                         | 11 ++++----
 tests/e2e-ui/crates/blob-core/Cargo.toml      | 11 --------
 tests/e2e-ui/crates/blob-core/src/lib.rs      | 10 -------
 tests/e2e-ui/crates/blob-domain/Cargo.toml    | 19 ++++++++++---
 .../src => blob-domain/src/core}/direction.rs |  0
 .../e2e-ui/crates/blob-domain/src/core/mod.rs | 10 +++++++
 .../src => blob-domain/src/core}/simulate.rs  |  6 ++---
 .../src => blob-domain/src/core}/tile.rs      |  0
 tests/e2e-ui/crates/blob-domain/src/lib.rs    | 27 ++++++++++++++-----
 .../blob-domain/src/models/blob_game.rs       | 10 +++----
 .../blob-domain/src/models/direction.rs       |  4 +--
 .../crates/blob-domain/src/models/tile.rs     |  4 +--
 .../src/lib.rs => blob-domain/src/wasm.rs}    |  6 ++---
 tests/e2e-ui/crates/blob-wasm/Cargo.toml      | 19 -------------
 .../e2e-ui/crates/service/src/modules/blob.rs |  2 +-
 tests/e2e-ui/ui/src/lib/blob/simulate-move.ts | 13 ++++-----
 .../src/routes/blob/[[gameId]]/+page.svelte   |  2 +-
 tests/e2e-ui/ui/vite.config.ts                |  2 +-
 19 files changed, 76 insertions(+), 82 deletions(-)
 delete mode 100644 tests/e2e-ui/crates/blob-core/Cargo.toml
 delete mode 100644 tests/e2e-ui/crates/blob-core/src/lib.rs
 rename tests/e2e-ui/crates/{blob-core/src => blob-domain/src/core}/direction.rs (100%)
 create mode 100644 tests/e2e-ui/crates/blob-domain/src/core/mod.rs
 rename tests/e2e-ui/crates/{blob-core/src => blob-domain/src/core}/simulate.rs (98%)
 rename tests/e2e-ui/crates/{blob-core/src => blob-domain/src/core}/tile.rs (100%)
 rename tests/e2e-ui/crates/{blob-wasm/src/lib.rs => blob-domain/src/wasm.rs} (85%)
 delete mode 100644 tests/e2e-ui/crates/blob-wasm/Cargo.toml

diff --git a/tests/e2e-ui/Cargo.toml b/tests/e2e-ui/Cargo.toml
index 62879695..cd0e2a16 100644
--- a/tests/e2e-ui/Cargo.toml
+++ b/tests/e2e-ui/Cargo.toml
@@ -7,9 +7,7 @@ resolver = "2"
 members = [
     "crates/todo-domain",
     "crates/chat-domain",
-    "crates/blob-core",
     "crates/blob-domain",
-    "crates/blob-wasm",
     "crates/readmodels",
     "crates/projections",
     "crates/service",
diff --git a/tests/e2e-ui/Makefile b/tests/e2e-ui/Makefile
index 2f622f86..0427d580 100644
--- a/tests/e2e-ui/Makefile
+++ b/tests/e2e-ui/Makefile
@@ -118,7 +118,7 @@ ci-offline: ui-install
 	echo "OK — generated drift + offline Rust/UI suites"
 
 test-domain:
-	cargo test -p todo-domain -p chat-domain -p blob-core -p blob-domain $(CARGO_TEST_FLAGS)
+	cargo test -p todo-domain -p chat-domain -p blob-domain $(CARGO_TEST_FLAGS)
 
 test-suite:
 	cargo test -p e2e-suite --test behavioral $(CARGO_TEST_FLAGS)
@@ -140,12 +140,13 @@ js-install:
 js-build: js-install
 	cd $(JS_DIR) && $(NPM) run build
 
-## Pure blob board rules → ui/src/lib/blob/pkg (wasm-pack; requires wasm32-unknown-unknown).
+## blob-domain pure core → ui/src/lib/blob/pkg (wasm-pack; requires wasm32-unknown-unknown).
 wasm:
 	@command -v wasm-pack >/dev/null || { echo "wasm-pack required: cargo install wasm-pack"; exit 1; }
 	@rustup target list --installed | grep -q wasm32-unknown-unknown || rustup target add wasm32-unknown-unknown
 	@out="$(CURDIR)/ui/src/lib/blob/pkg"; \
-	  wasm-pack build crates/blob-wasm --target web --out-dir "$$out" --out-name blob_wasm
+	  wasm-pack build crates/blob-domain --target web --out-dir "$$out" --out-name blob_wasm \
+	    -- --no-default-features --features wasm
 
 ui-install: js-build wasm
 	cd ui && $(NPM) install
@@ -178,7 +179,7 @@ contracts-check:
 
 check: check-client
 	cargo check --workspace
-	cargo test -p todo-domain -p chat-domain -p blob-core -p blob-domain --no-run
+	cargo test -p todo-domain -p chat-domain -p blob-domain --no-run
 	cargo test -p e2e-suite --test behavioral --no-run
 
 clean: stop
@@ -192,7 +193,7 @@ help:
 	@echo "  make run        API + UI (source e2e-ui.env when present)"
 	@echo "  make test       offline suite + UI structural"
 	@echo "  make ci-offline CI drift + offline suites with safe pipeline overlap"
-	@echo "  make wasm            blob-core pure → ui/src/lib/blob/pkg (wasm-pack)"
+	@echo "  make wasm            blob-domain core → ui/src/lib/blob/pkg (wasm-pack)"
 	@echo "  make gen-client      typed Service → generated user/admin clients"
 	@echo "  make check-client    verify generated artifacts byte-for-byte"
 	@echo "  make down       docker compose down"
diff --git a/tests/e2e-ui/crates/blob-core/Cargo.toml b/tests/e2e-ui/crates/blob-core/Cargo.toml
deleted file mode 100644
index af41577f..00000000
--- a/tests/e2e-ui/crates/blob-core/Cargo.toml
+++ /dev/null
@@ -1,11 +0,0 @@
-[package]
-name = "blob-core"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-publish.workspace = true
-description = "Pure blob board rules (WASM-eligible; no distributed host)"
-
-[dependencies]
-serde = { workspace = true }
-serde_json = { workspace = true }
diff --git a/tests/e2e-ui/crates/blob-core/src/lib.rs b/tests/e2e-ui/crates/blob-core/src/lib.rs
deleted file mode 100644
index 9d2c5603..00000000
--- a/tests/e2e-ui/crates/blob-core/src/lib.rs
+++ /dev/null
@@ -1,10 +0,0 @@
-//! Pure blob board rules shared by the domain aggregate and client WASM.
-//!
-//! No I/O, no `distributed`, no ownership — only map + score + direction.
-
-mod direction;
-mod simulate;
-pub mod tile;
-
-pub use direction::Direction;
-pub use simulate::{simulate_move, MovePreview, SimulateError};
diff --git a/tests/e2e-ui/crates/blob-domain/Cargo.toml b/tests/e2e-ui/crates/blob-domain/Cargo.toml
index 44779cd3..d7ef74f5 100644
--- a/tests/e2e-ui/crates/blob-domain/Cargo.toml
+++ b/tests/e2e-ui/crates/blob-domain/Cargo.toml
@@ -4,14 +4,25 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 publish.workspace = true
+description = "Blob game domain: pure board core, aggregate host, optional WASM export"
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[features]
+default = ["domain"]
+# Aggregate + levels + distributed host (server / tests).
+domain = ["dep:distributed", "dep:thiserror", "dep:rand"]
+# Client pure export (wasm-pack / wasm32).
+wasm = ["dep:wasm-bindgen"]
 
 [dependencies]
-blob-core = { path = "../blob-core" }
-distributed = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-thiserror = { workspace = true }
-rand = { workspace = true }
+distributed = { workspace = true, optional = true }
+thiserror = { workspace = true, optional = true }
+rand = { workspace = true, optional = true }
+wasm-bindgen = { version = "0.2", optional = true }
 
 [dev-dependencies]
 serde_json = { workspace = true }
diff --git a/tests/e2e-ui/crates/blob-core/src/direction.rs b/tests/e2e-ui/crates/blob-domain/src/core/direction.rs
similarity index 100%
rename from tests/e2e-ui/crates/blob-core/src/direction.rs
rename to tests/e2e-ui/crates/blob-domain/src/core/direction.rs
diff --git a/tests/e2e-ui/crates/blob-domain/src/core/mod.rs b/tests/e2e-ui/crates/blob-domain/src/core/mod.rs
new file mode 100644
index 00000000..a2b14e63
--- /dev/null
+++ b/tests/e2e-ui/crates/blob-domain/src/core/mod.rs
@@ -0,0 +1,10 @@
+//! Pure board rules — no I/O, no `distributed`, WASM-eligible.
+//!
+//! Shared by the aggregate host (`models`) and the client WASM surface (`wasm`).
+
+mod direction;
+mod simulate;
+pub mod tile;
+
+pub use direction::Direction;
+pub use simulate::{simulate_move, MovePreview, SimulateError};
diff --git a/tests/e2e-ui/crates/blob-core/src/simulate.rs b/tests/e2e-ui/crates/blob-domain/src/core/simulate.rs
similarity index 98%
rename from tests/e2e-ui/crates/blob-core/src/simulate.rs
rename to tests/e2e-ui/crates/blob-domain/src/core/simulate.rs
index 382a34fc..240e8be9 100644
--- a/tests/e2e-ui/crates/blob-core/src/simulate.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/core/simulate.rs
@@ -1,7 +1,7 @@
 //! Pure post-move board snapshot.
 
-use crate::tile;
-use crate::Direction;
+use super::tile;
+use super::Direction;
 
 /// Pure post-move board snapshot (no ownership / aggregate checks).
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -117,7 +117,7 @@ fn player_pos_in(map: &[Vec<u8>]) -> Result<(usize, usize), SimulateError> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::tile::*;
+    use super::tile::*;
 
     fn tiny() -> Vec<Vec<u8>> {
         vec![
diff --git a/tests/e2e-ui/crates/blob-core/src/tile.rs b/tests/e2e-ui/crates/blob-domain/src/core/tile.rs
similarity index 100%
rename from tests/e2e-ui/crates/blob-core/src/tile.rs
rename to tests/e2e-ui/crates/blob-domain/src/core/tile.rs
diff --git a/tests/e2e-ui/crates/blob-domain/src/lib.rs b/tests/e2e-ui/crates/blob-domain/src/lib.rs
index 982b5f64..f71a4b4a 100644
--- a/tests/e2e-ui/crates/blob-domain/src/lib.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/lib.rs
@@ -1,15 +1,28 @@
-//! BlobGame aggregate — grid trail game (remake of ig-blob-game-model-service).
+//! Blob game domain — one crate, three faces:
 //!
-//! Pure board rules live in [`blob_core`] (WASM-eligible). Tile ints match the
-//! client board helpers (player=9, hole=0, unvisited=1, visited=2, …).
+//! - [`core`] — pure board rules (always available; WASM-eligible)
+//! - [`models`] / [`levels`] — aggregate host (`feature = "domain"`, default)
+//! - [`wasm`] — `blobSimulateMove` for the client (`feature = "wasm"`)
+//!
+//! Tile ints match the client board helpers (player=9, hole=0, unvisited=1, …).
+
+pub mod core;
 
+#[cfg(feature = "domain")]
 pub mod levels;
+#[cfg(feature = "domain")]
 pub mod models;
 
+#[cfg(feature = "wasm")]
+pub mod wasm;
+
+pub use core::{simulate_move, tile, Direction, MovePreview, SimulateError};
+
+#[cfg(feature = "domain")]
 pub use levels::{demo_map, generate_level, generate_level_with, is_hamiltonian_passable};
-pub use models::tile;
+#[cfg(feature = "domain")]
 pub use models::{
-    domain_commands, simulate_move, test_map_no_holes, test_map_with_hole, BlobError, BlobGame,
-    BlobGameState, BlobInitializedDomainEvent, BlobLevelStartedDomainEvent, BlobMovedDomainEvent,
-    BlobStartedDomainEvent, Direction, MovePreview,
+    domain_commands, test_map_no_holes, test_map_with_hole, BlobError, BlobGame, BlobGameState,
+    BlobInitializedDomainEvent, BlobLevelStartedDomainEvent, BlobMovedDomainEvent,
+    BlobStartedDomainEvent,
 };
diff --git a/tests/e2e-ui/crates/blob-domain/src/models/blob_game.rs b/tests/e2e-ui/crates/blob-domain/src/models/blob_game.rs
index e197f328..e15f1ae4 100644
--- a/tests/e2e-ui/crates/blob-domain/src/models/blob_game.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/models/blob_game.rs
@@ -63,13 +63,13 @@ fn status_of(player_dead: bool, level_complete: bool) -> String {
     }
 }
 
-// Pure post-move board snapshot — defined in `blob_core`, re-exported here.
-pub use blob_core::{simulate_move, MovePreview};
+// Pure post-move board snapshot — defined in `crate::core`, re-exported here.
+pub use crate::core::{simulate_move, MovePreview};
 
-fn map_simulate_err(err: blob_core::SimulateError) -> BlobError {
+fn map_simulate_err(err: crate::core::SimulateError) -> BlobError {
     match err {
-        blob_core::SimulateError::NoActiveLevel => BlobError::NoActiveLevel,
-        blob_core::SimulateError::CannotMove(msg) => BlobError::CannotMove(msg.into()),
+        crate::core::SimulateError::NoActiveLevel => BlobError::NoActiveLevel,
+        crate::core::SimulateError::CannotMove(msg) => BlobError::CannotMove(msg.into()),
     }
 }
 
diff --git a/tests/e2e-ui/crates/blob-domain/src/models/direction.rs b/tests/e2e-ui/crates/blob-domain/src/models/direction.rs
index 59b863fc..85323ef2 100644
--- a/tests/e2e-ui/crates/blob-domain/src/models/direction.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/models/direction.rs
@@ -1,3 +1,3 @@
-//! Re-export pure direction from [`blob_core`].
+//! Re-export pure direction from [`crate::core`].
 
-pub use blob_core::Direction;
+pub use crate::core::Direction;
diff --git a/tests/e2e-ui/crates/blob-domain/src/models/tile.rs b/tests/e2e-ui/crates/blob-domain/src/models/tile.rs
index 9841f12e..56a7ba46 100644
--- a/tests/e2e-ui/crates/blob-domain/src/models/tile.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/models/tile.rs
@@ -1,3 +1,3 @@
-//! Re-export pure tile constants from [`blob_core`].
+//! Re-export pure tile constants from [`crate::core`].
 
-pub use blob_core::tile::*;
+pub use crate::core::tile::*;
diff --git a/tests/e2e-ui/crates/blob-wasm/src/lib.rs b/tests/e2e-ui/crates/blob-domain/src/wasm.rs
similarity index 85%
rename from tests/e2e-ui/crates/blob-wasm/src/lib.rs
rename to tests/e2e-ui/crates/blob-domain/src/wasm.rs
index c672aada..8bdd7885 100644
--- a/tests/e2e-ui/crates/blob-wasm/src/lib.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/wasm.rs
@@ -1,9 +1,9 @@
-//! Client WASM surface for blob pure reduces.
+//! Client WASM surface for pure board rules (`--features wasm`).
 //!
 //! JS calls [`blob_simulate_move`] with `map_json`, score, and direction; gets
-//! JSON fields for the optimistic patch (or null / undefined on fail-closed).
+//! JSON fields for the optimistic patch (or undefined on fail-closed).
 
-use blob_core::{simulate_move, Direction};
+use crate::core::{simulate_move, Direction};
 use wasm_bindgen::prelude::*;
 
 /// Apply one move for known-row optimism.
diff --git a/tests/e2e-ui/crates/blob-wasm/Cargo.toml b/tests/e2e-ui/crates/blob-wasm/Cargo.toml
deleted file mode 100644
index 6b644cce..00000000
--- a/tests/e2e-ui/crates/blob-wasm/Cargo.toml
+++ /dev/null
@@ -1,19 +0,0 @@
-[package]
-name = "blob-wasm"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-publish.workspace = true
-description = "WASM exports of blob-core pure board rules for client auto-optimism"
-
-[lib]
-crate-type = ["cdylib", "rlib"]
-
-[dependencies]
-blob-core = { path = "../blob-core" }
-serde = { workspace = true }
-serde_json = { workspace = true }
-wasm-bindgen = "0.2"
-
-[package.metadata.wasm-pack.profile.release]
-wasm-opt = false
diff --git a/tests/e2e-ui/crates/service/src/modules/blob.rs b/tests/e2e-ui/crates/service/src/modules/blob.rs
index 376461c4..50705b66 100644
--- a/tests/e2e-ui/crates/service/src/modules/blob.rs
+++ b/tests/e2e-ui/crates/service/src/modules/blob.rs
@@ -64,7 +64,7 @@ where
         >(blob_move::COMMAND)
         .field_name("blob_games_move")
         .roles(["user", "admin"].into_iter())
-        // Domain pure: blob_core::simulate_move — client via blob-wasm ($lib/blob/simulate-move).
+        // Domain pure: blob_domain::core::simulate_move — client via WASM ($lib/blob/simulate-move).
         .preview_reduce_known_record(
             CommandProjectionPureReduce::new(
                 "blob.simulate_move",
diff --git a/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts b/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
index 757ec910..55cc3c23 100644
--- a/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
+++ b/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
@@ -1,11 +1,12 @@
 /**
- * Client pure for `blob.simulate_move` — thin host over `blob-core` WASM.
+ * Client pure for `blob.simulate_move` — thin host over `blob-domain` WASM.
  *
- * Board rules live once in Rust (`blob_core::simulate_move`). This module only
- * loads the wasm package, adapts replica record/args, and fails closed when the
- * module is not ready or the move is impossible.
+ * Board rules live once in Rust (`blob_domain::core::simulate_move`). This
+ * module only loads the wasm package, adapts replica record/args, and fails
+ * closed when the module is not ready or the move is impossible.
  *
- * Build: `make wasm` (or `make ui-install`) → `./pkg` from wasm-pack.
+ * Build: `make wasm` (or `make ui-install`) → `./pkg` from wasm-pack
+ * (`--features wasm --no-default-features` on blob-domain).
  */
 
 export type BlobMoveResult = Readonly<{
@@ -33,7 +34,7 @@ function isBrowser(): boolean {
 }
 
 /**
- * Load and instantiate blob-core WASM. Safe to call multiple times.
+ * Load and instantiate blob-domain pure WASM. Safe to call multiple times.
  * No-op on the server (SSR) — pure reduce fails closed until the client inits.
  */
 export function ensureBlobWasm(): Promise<void> {
diff --git a/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte b/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte
index ff30117d..9ad32344 100644
--- a/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte
+++ b/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte
@@ -191,7 +191,7 @@
 
 	onMount(() => {
 		hydrated = true;
-		// Ensure blob-core WASM is ready before pure-reduce optimism on move.
+		// Ensure blob-domain pure WASM is ready before pure-reduce optimism on move.
 		void ensureBlobWasm().catch(() => {
 			/* fail-closed pure until reload */
 		});
diff --git a/tests/e2e-ui/ui/vite.config.ts b/tests/e2e-ui/ui/vite.config.ts
index 865e084f..c71fdbab 100644
--- a/tests/e2e-ui/ui/vite.config.ts
+++ b/tests/e2e-ui/ui/vite.config.ts
@@ -12,7 +12,7 @@ const api = process.env.E2E_API_ORIGIN || process.env.E2E_BASE_URL || 'http://12
 export default defineConfig({
 	plugins: [distributedSvelteKit(distributedViteOptions), sveltekit()],
 	css: { devSourcemap: true },
-	// blob-core pure package (wasm-pack --target web)
+	// blob-domain pure package (wasm-pack --features wasm)
 	assetsInclude: ['**/*.wasm'],
 	server: {
 		port: 5180,

From 57562328c31d4459ba26da1c1ee31cb538f92593 Mon Sep 17 00:00:00 2001
From: Patrick Lee Scott <pat@patscott.io>
Date: Tue, 4 Aug 2026 19:58:57 -0500
Subject: [PATCH 3/6] =?UTF-8?q?docs(e2e-ui):=20refresh=20How-it=E2=80=99s-?=
 =?UTF-8?q?built=20for=20pure/WASM=20and=20service=20modules?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update blob walkthrough for known-row pure reduce + blob-domain WASM,
session guards/principal in command mounts and handlers, and add a
Service module tab on every demo (MODULE_ID, routes, compose).
---
 .../components/walkthrough/HowItsBuilt.svelte |   2 +-
 tests/e2e-ui/ui/src/lib/walkthrough/demos.ts  | 382 +++++++++++++-----
 2 files changed, 285 insertions(+), 99 deletions(-)

diff --git a/tests/e2e-ui/ui/src/lib/components/walkthrough/HowItsBuilt.svelte b/tests/e2e-ui/ui/src/lib/components/walkthrough/HowItsBuilt.svelte
index 68a6d86d..b074d6f9 100644
--- a/tests/e2e-ui/ui/src/lib/components/walkthrough/HowItsBuilt.svelte
+++ b/tests/e2e-ui/ui/src/lib/components/walkthrough/HowItsBuilt.svelte
@@ -68,7 +68,7 @@
 			<h2 id="hib-title-{demo.id}" class="hib-title">How it’s built</h2>
 			<p class="hib-summary">{demo.summary}</p>
 			<p class="hib-path" aria-hidden="true">
-				Browser query → commands / cache → handlers → domain → events
+				Browser query → commands → service module → handlers → domain → events
 			</p>
 		</div>
 		<button type="button" class="hib-close" onclick={closePanel} aria-label="Close">
diff --git a/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts b/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
index 47e685db..64ac8530 100644
--- a/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
+++ b/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
@@ -3,10 +3,11 @@ import type { DemoWalkthrough } from './types';
 /**
  * Tab order is browser-first teaching order for every demo:
  * 1. Query / live subscription (+ ReadModel shape + read RBAC)
- * 2. Commands (optimistic cache vs Atomic) (+ write RBAC)
- * 3. Command handlers (repo → aggregate → commit)
- * 4. Domain model (plain Rust + macros)
- * 5. Domain events + projections
+ * 2. Commands (optimistic cache vs Atomic / pure reduce) (+ write RBAC)
+ * 3. Service module (e2e-service: MODULE_ID, routes(), compose into Service)
+ * 4. Command handlers (principal → repo → aggregate → commit)
+ * 5. Domain model (plain Rust + macros; blob pure core)
+ * 6. Domain events + projections
  *
  * Samples should be real, pasteable shapes from the fixture — not comment-only stubs.
  * Query tabs should include the read model definition (#[derive(ReadModel)] struct), not only
@@ -17,7 +18,8 @@ import type { DemoWalkthrough } from './types';
  *   auto-optimism previews until obligations complete (no response row).
  * - Atomic (Direct placement + Atomic command): command handler applies IR
  *   same-tx → wait and return the row; confirm before await settles.
- *   Atomic blob move uses thin input; the sealed response row updates the board.
+ * - Known-record pure (blob move): client runs domain pure (WASM) for paint;
+ *   Atomic seal remains server authority.
  */
 
 export const todosWalkthrough: DemoWalkthrough = {
@@ -105,7 +107,7 @@ await commands.todo.complete({ todo_id });`
 				},
 				{
 					file: 'modules/todo.rs · todos_create',
-					caption: 'Write RBAC on the inventory; emit set from domain transition; owner claim is auto-optimism.',
+					caption: 'Write RBAC + session guard; emit set from domain transition; owner claim is auto-optimism.',
 					code: `.command_transition::<
   domain_commands::Create,
   TodoCreateInput,
@@ -117,11 +119,11 @@ await commands.todo.complete({ todo_id });`
   input: TodoCreateInput;
   default input.todo_id = uuid_v7();
 })
-.handle(todo_create::handle)`
+.guarded(causal_has_user, todo_create::handle)`
 				},
 				{
 					file: 'modules/todo.rs · todos_force_archive',
-					caption: 'Elevated mutation: admin only; not on the user client tree.',
+					caption: 'Elevated mutation: admin role on surface + causal_is_admin guard; not on the user client tree.',
 					code: `.command_transition::<
   domain_commands::ForceArchive,
   TodoForceArchiveInput,
@@ -129,24 +131,65 @@ await commands.todo.complete({ todo_id });`
 >(todo_force_archive::COMMAND)
 .field_name("todos_force_archive")
 .roles(["admin"])
-.handle(todo_force_archive::handle)`
+.guarded(causal_is_admin, todo_force_archive::handle)`
+				}
+			]
+		},
+		{
+			id: 'service',
+			label: '3 · Service module',
+			lede: 'e2e-service is the application crate. The todo module is one bounded-context slice: MODULE_ID, Routes::for_aggregate, command mounts, and the modeled projector. Domain rules stay in todo-domain; GraphQL surfaces and runners live elsewhere.',
+			principle: 'Bounded contexts show up as modules on one Service.',
+			samples: [
+				{
+					file: 'modules/todo.rs · MODULE_ID + routes()',
+					caption: 'One module = Todo aggregate inventory + projector attach point.',
+					code: `pub const MODULE_ID: &str = "todo";
+
+pub fn routes<R, L, S>(
+  repo: R,
+  locks: L,
+  read_models: S,
+  todo_projector: SurfaceProjector,
+) -> TodoRoutes<R, L, S> {
+  Routes::for_aggregate::<R, L, Todo, S>(repo, locks, read_models)
+    .command_transition::</* Create */>(todo_create::COMMAND)
+    // … rename, complete, reopen, archive, force_archive, purge …
+    .modeled_projector(todo_projector)
+    .handle(handlers::events::project_todos::handle)
+}`
+				},
+				{
+					file: 'modules/compose.rs · build_service',
+					caption: 'compose lists modules; host/runner starts the binary.',
+					code: `let todos = todo::routes(repo.clone(), locks.clone(), read_models.clone(), projections.todo);
+let chat = chat::routes(/* … */);
+let blob = blob::routes(/* … */);
+
+Service::new()
+  .named("e2e-ui")
+  .without_http_command_routes()
+  .routes(todos)
+  .routes(chat)
+  .routes(blob)`
 				}
 			]
 		},
 		{
 			id: 'handlers',
-			label: '3 · Handlers',
-			lede: 'Command handlers use the repository pattern: get or create the aggregate, call a domain method, commit. Todos choose eventual consistency (Eventual + projector).',
+			label: '4 · Handlers',
+			lede: 'Command handlers use the repository pattern: bind principal (after the mount guard), get or create the aggregate, call a domain method, commit. Todos choose eventual consistency (Eventual + projector).',
 			principle: 'Commands change the world; tables are for reading.',
 			samples: [
 				{
 					file: 'handlers/commands/todo_create.rs',
-					caption: 'repo → create → domain → publish_events → causal',
+					caption: 'principal → create → domain → publish_events → eventual',
 					code: `pub async fn handle(
   ctx: &CausalCommandContext<'_, Todo>,
   input: TodoCreateInput,
 ) -> Result<PreparedCommand<Eventual<TodoCreatePayload>>, HandlerError> {
-  let owner = ctx.user_id()?.to_string();
+  // Session admission already ran on .guarded(causal_has_user, …).
+  let owner = principal(ctx)?;
   let repo = ctx.repo();
   let mut todo = repo.create();
   todo.create(&input.todo_id, &owner, &input.title)
@@ -162,7 +205,8 @@ await commands.todo.complete({ todo_id });`
 				},
 				{
 					file: 'handlers/commands/todo_complete.rs',
-					code: `let mut todo = repo
+					code: `let owner = principal(ctx)?;
+let mut todo = repo
   .get(&input.todo_id)
   .await?
   .ok_or_else(|| HandlerError::NotFound(input.todo_id.clone()))?;
@@ -177,7 +221,7 @@ repo.publish_events().commit(todo)?.eventual(TodoStatusPayload {
 		},
 		{
 			id: 'domain',
-			label: '4 · Domain',
+			label: '5 · Domain',
 			lede: 'The write model is a plain Rust aggregate — fields are the consistency boundary. Public methods enforce rules; private #[event] helpers record history. Unit-testable with no HTTP or SQL.',
 			principle: 'Start with the domain, not the database.',
 			samples: [
@@ -227,7 +271,7 @@ fn record_completed(&mut self) {
 		},
 		{
 			id: 'events',
-			label: '5 · Events',
+			label: '6 · Events',
 			lede: 'Domain methods emit events. Projections map those events onto syntax-only GraphQL mutations that become MutationProgram IR — upsert or delete read-model rows. The UI never dual-writes the todos table.',
 			principle: 'Know which side of the fence you are on.',
 			samples: [
@@ -386,7 +430,7 @@ if (receipt.projected !== undefined) {
 				},
 				{
 					file: 'modules/chat.rs · chat_messages_post',
-					caption: 'Write RBAC: user + admin only. Emit set from domain_commands::Post. Public client has zero commands.',
+					caption: 'Write RBAC + session guard. Emit set from domain_commands::Post. Public client has zero commands.',
 					code: `.command_transition::<
   domain_commands::Post,
   ChatPostInput,
@@ -394,7 +438,7 @@ if (receipt.projected !== undefined) {
 >(chat_post::COMMAND)
 .field_name("chat_messages_post")
 .roles(["user", "admin"])
-.handle(chat_post::handle)`
+.guarded(causal_has_user, chat_post::handle)`
 				},
 				{
 					file: 'generated/public/commands.ts',
@@ -404,10 +448,46 @@ export type GeneratedCommands = Readonly<Record<never, never>>;`
 				}
 			]
 		},
+		{
+			id: 'service',
+			label: '3 · Service module',
+			lede: 'The chat module in e2e-service mounts lobby commands and also hosts identity ingress (Zitadel Action + scrape) plus chat/auth projectors. One module file is the review surface for “how chat joins the Service.”',
+			principle: 'Bounded contexts show up as modules on one Service.',
+			samples: [
+				{
+					file: 'modules/chat.rs · routes()',
+					caption: 'ChatMessage commands + Zitadel extension commands + projectors.',
+					code: `pub const MODULE_ID: &str = "chat";
+
+pub fn routes<R, L, S>(...) -> ChatRoutes<R, L, S> {
+  Routes::for_aggregate::<R, L, ChatMessage, S>(repo, locks, read_models)
+    .command_transition::</* Post */>(chat_post::COMMAND)
+    .guarded(causal_has_user, chat_post::handle)
+    // Zitadel Action ingress + on-demand scrape (non-GraphQL).
+    .command(zitadel::COMMAND)
+    .guarded(zitadel::guard, zitadel::handle)
+    .modeled_projector(chat_projector)
+    .handle(project_chat_messages::handle)
+    .events(project_auth_user::EVENTS)
+    .guarded(project_auth_user::guard, project_auth_user::handle)
+}`
+				},
+				{
+					file: 'modules/compose.rs · MODULE_IDS',
+					caption: 'Inventory is explicit — todo, chat, blob, identity.',
+					code: `pub const MODULE_IDS: &[&str] = &[
+  todo::MODULE_ID,
+  chat::MODULE_ID,
+  blob::MODULE_ID,
+  "identity",
+];`
+				}
+			]
+		},
 		{
 			id: 'handlers',
-			label: '3 · Handlers',
-			lede: 'Handler creates the chat aggregate through the repository, applies the domain post, commits Eventual (projector path). Author is always the session principal.',
+			label: '4 · Handlers',
+			lede: 'Handler creates the chat aggregate through the repository, applies the domain post, commits Eventual (projector path). Author is the session principal after the mount guard.',
 			principle: 'Trust the signed-in person, not the request body.',
 			samples: [
 				{
@@ -416,7 +496,7 @@ export type GeneratedCommands = Readonly<Record<never, never>>;`
   ctx: &CausalCommandContext<'_, ChatMessage>,
   input: ChatPostInput,
 ) -> Result<PreparedCommand<Eventual<ChatPostPayload>>, HandlerError> {
-  let author = ctx.user_id()?.to_string();
+  let author = principal(ctx)?;
   let created_at = canonical_near_unix_millis(&input.created_at)?;
   let repo = ctx.repo();
 
@@ -451,7 +531,7 @@ export type GeneratedCommands = Readonly<Record<never, never>>;`
 		},
 		{
 			id: 'domain',
-			label: '4 · Domain',
+			label: '5 · Domain',
 			lede: 'Chat domain is a plain Rust aggregate — one message is one consistency boundary. Public methods enforce rules; private #[event] helpers record history. No GraphQL in the model.',
 			principle: 'Start with the domain, not the database.',
 			samples: [
@@ -528,7 +608,7 @@ fn record_posted(
 		},
 		{
 			id: 'events',
-			label: '5 · Events',
+			label: '6 · Events',
 			lede: 'Domain events drive the chat_messages projection via a named GraphQL mutation program. ChangeHub wakes @live subscribers when rows land.',
 			principle: 'Commands change the world; tables are for reading.',
 			samples: [
@@ -565,9 +645,9 @@ export const blobWalkthrough: DemoWalkthrough = {
 	id: 'blob',
 	href: '/blob',
 	title: 'Blob game',
-	kicker: 'Browser → Atomic · no lag',
+	kicker: 'Browser → pure optimism → Atomic seal',
 	summary:
-		'Still start in the browser: one @load query owns the board. Moves are Atomic — same save_blob_game mutation IR as eventual, applied in the command handler so the response row can update the replica before await resolves.',
+		'One @load query owns the board. Moves are Atomic with thin input. Known-row pure reduce runs blob-domain board rules in WASM so the cache can paint immediately; the handler still runs the same pure, stages the row, and the sealed response remains authority.',
 	tabs: [
 		{
 			id: 'query',
@@ -634,21 +714,24 @@ const games = $derived(
 		{
 			id: 'commands',
 			label: '2 · Commands',
-			lede: 'Moves are Atomic: send only game_id + direction. The handler runs domain rules, stages the row, and the sealed response updates the replica. No client twin of game logic.',
-			principle: 'The domain owns outcomes; the client does not reimplement them.',
+			lede: 'Moves are Atomic: send only game_id + direction. The service declares a pure reduce over the known BlobGames row so the client can paint the next board without inventing a second ruleset. Session admission is a mount guard; the sealed Atomic row remains authority.',
+			principle: 'One pure for board rules — server and client share the domain core.',
 			samples: [
 				{
 					file: 'routes/blob/[[gameId]]/+page.svelte',
-					caption: 'Thin input — board comes from the Atomic row.',
-					code: `await commands.blob.move({
-  game_id,
-  direction,
+					caption: 'Thin input; ensure WASM is warm for pure-reduce optimism.',
+					code: `onMount(() => {
+  void ensureBlobWasm();
+  /* … */
 });
-// replica updates when the sealed BlobGames row arrives`
+
+await commands.blob.move({ game_id, direction });
+// pure may patch map_json/score/… immediately from known row;
+// Atomic seal confirms or corrects`
 				},
 				{
 					file: 'modules/blob.rs · blob.move',
-					caption: 'Emit set from domain_commands::MoveDir; apply site is the handler (Atomic).',
+					caption: 'Atomic + pure reduce + session guard. No hand-written TS board twin.',
 					code: `.command_transition::<
   domain_commands::MoveDir,
   BlobMoveInput,
@@ -656,14 +739,73 @@ const games = $derived(
 >(blob_move::COMMAND)
 .field_name("blob_games_move")
 .roles(["user", "admin"])
-.handle(blob_move::handle)`
+.preview_reduce_known_record(
+  CommandProjectionPureReduce::new(
+    "blob.simulate_move",
+    "blob/simulate-move",
+    "simulateMove",
+    "BlobGames",
+  )
+  .key_input("game_id", ["game_id"])
+  .arg_input("direction", ["direction"])
+  .assign(["map_json", "score", "player_dead",
+           "current_level_completed", "status"]),
+)
+.guarded(causal_has_user, blob_move::handle)`
+				},
+				{
+					file: 'ui/src/lib/blob/simulate-move.ts',
+					caption: 'Thin WASM host — rules live in blob_domain::core.',
+					code: `export function simulateMove(record, args) {
+  if (!api) return null; // fail closed until ensureBlobWasm()
+  const json = api.blobSimulateMove(
+    record.map_json, Number(record.score), args.direction
+  );
+  return json ? Object.freeze(JSON.parse(json)) : null;
+}`
+				}
+			]
+		},
+		{
+			id: 'service',
+			label: '3 · Service module',
+			lede: 'The blob module in e2e-service is only Atomic command mounts for BlobGame — no projector loop for the board (direct placement seals in the handler). compose() still lists MODULE_ID next to todo and chat.',
+			principle: 'Bounded contexts show up as modules on one Service.',
+			samples: [
+				{
+					file: 'modules/blob.rs · MODULE_ID + routes()',
+					caption: 'start / move / start_level — all Atomic, all guarded.',
+					code: `pub const MODULE_ID: &str = "blob";
+
+pub fn routes<R, L, S>(...) -> BlobRoutes<R, L, S> {
+  Routes::for_aggregate::<R, L, BlobGame, S>(repo, locks, read_models)
+    .command_transition::</* StartWithMap */>(blob_start::COMMAND)
+    .guarded(causal_has_user, blob_start::handle)
+    .command_transition::</* MoveDir */>(blob_move::COMMAND)
+    .preview_reduce_known_record(/* blob.simulate_move */)
+    .guarded(causal_has_user, blob_move::handle)
+    .command_transition::</* StartLevel */>(blob_start_level::COMMAND)
+    .guarded(causal_has_user, blob_start_level::handle)
+}`
+				},
+				{
+					file: 'modules/compose.rs · blob routes',
+					caption: 'Same Service composition as todos/chat.',
+					code: `let blob = blob::routes(repo, locks, read_models, projections.blob);
+
+Service::new()
+  .named("e2e-ui")
+  .without_http_command_routes()
+  .routes(todos)
+  .routes(chat)
+  .routes(blob)`
 				}
 			]
 		},
 		{
 			id: 'handlers',
-			label: '3 · Handlers',
-			lede: 'Get aggregate, domain move, stage the mutation-derived row, commit Atomic — one transaction for aggregate, ledger, and query row. Because we are still in the command handler we can wait and return that row; an event handler cannot.',
+			label: '4 · Handlers',
+			lede: 'Get aggregate, domain move (which calls the same pure as WASM), stage the mutation-derived row, commit Atomic — one transaction for aggregate, ledger, and query row. Input parse stays here; session admission already ran on the guard.',
 			principle: 'Commands change the world; tables are for reading.',
 			samples: [
 				{
@@ -672,7 +814,7 @@ const games = $derived(
   ctx: &CausalCommandContext<'_, BlobGame>,
   input: BlobMoveInput,
 ) -> Result<PreparedCommand<Atomic<BlobGames>>, HandlerError> {
-  let owner = ctx.user_id()?.to_string();
+  let owner = principal(ctx)?;
   let dir = Direction::parse(&input.direction).ok_or_else(|| {
     HandlerError::Rejected(format!(
       "invalid direction \`{}\` (use up|down|left|right)",
@@ -700,68 +842,54 @@ const games = $derived(
 		},
 		{
 			id: 'domain',
-			label: '4 · Domain',
-			lede: 'The game is a plain Rust aggregate — score, map, and level live on the write model. Public methods enforce rules; private #[event] helpers record history.',
+			label: '5 · Domain',
+			lede: 'One blob-domain crate: core is pure board rules (WASM-eligible); models is the sourced aggregate (feature domain). move_dir calls core::simulate_move — the same function the client WASM exports.',
 			principle: 'Start with the domain, not the database.',
 			samples: [
 				{
-					file: 'blob-domain · BlobGame',
-					caption: 'Aggregate shape — the consistency boundary.',
-					code: `#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-pub struct BlobGame {
-  pub entity: Entity,
-  pub game_id: String,
-  pub owner_id: String,
-  pub score: i64,
-  pub player_dead: bool,
-  /// 0 = no level yet; 1+ = active level index.
-  pub current_level: i64,
-  pub current_level_completed: bool,
-  /// Current level map only.
-  pub map: Vec<Vec<u8>>,
-}
-
-#[sourced(
-  entity,
-  events = "BlobGameEvent",
-  aggregate_type = "blob",
-  domain_state = BlobGameState,
-)]
-impl BlobGame { /* start, move_dir, … */ }`
+					file: 'blob-domain/src/core · simulate_move',
+					caption: 'Pure map + score + direction → next board. No Entity, no ownership.',
+					code: `pub fn simulate_move(
+  map: &[Vec<u8>],
+  score: i64,
+  direction: Direction,
+) -> Result<MovePreview, SimulateError> {
+  // step player, mark visited, hole/suicide/score, level complete…
+  Ok(MovePreview { map, score, player_dead, level_complete })
+}`
 				},
 				{
-					file: 'blob-domain · BlobGame::move_dir (event)',
-					caption: 'After rules and tile sim, the move is one domain event.',
-					code: `// … ensure_owner, bounds, tile simulation → score / dead / map …
-
-self.record_moved(
-  score,
-  player_dead,
-  level_complete,
-  next_map,
-  direction.as_str().to_string(),
-)?;
-
-#[event("blob.moved", version = 1, domain)]
-fn record_moved(
-  &mut self,
-  score: i64,
-  player_dead: bool,
-  current_level_completed: bool,
-  map: Vec<Vec<u8>>,
-  _direction: String,
-) {
-  self.score = score;
-  self.player_dead = player_dead;
-  self.current_level_completed = current_level_completed;
-  self.map = map;
+					file: 'blob-domain · BlobGame::move_dir',
+					caption: 'Aggregate wraps pure + ownership + domain event.',
+					code: `pub fn move_dir(&mut self, owner_id: &str, direction: Direction)
+  -> Result<(), BlobError>
+{
+  self.ensure_owner(owner_id)?;
+  if self.player_dead { return Err(BlobError::PlayerDead); }
+  let preview = simulate_move(&self.map, self.score, direction)
+    .map_err(map_simulate_err)?;
+  self.record_moved(
+    preview.score,
+    preview.player_dead,
+    preview.level_complete,
+    preview.map,
+    direction.as_str().to_string(),
+  )?;
+  Ok(())
 }`
+				},
+				{
+					file: 'blob-domain · features',
+					caption: 'Server uses domain; client pure uses wasm.',
+					code: `// Cargo.toml
+// default = ["domain"]  → aggregate + levels + distributed
+// wasm                 → blobSimulateMove export (make wasm)`
 				}
 			]
 		},
 		{
 			id: 'events',
-			label: '5 · Events',
+			label: '6 · Events',
 			lede: 'Domain events still exist for history. For blob, the same save_blob_game mutation program runs direct in the command handler (same commit as the event) — so the response can carry the row. Eventual placement would run that IR in an event handler instead, with no response channel to the waiting client.',
 			principle: 'Know which side of the fence you are on.',
 			samples: [
@@ -795,7 +923,7 @@ mutation SaveBlobGame {
 }`
 				},
 				{
-					file: 'service.rs · projection binding',
+					file: 'service · projection binding',
 					code: `let blob_binding = ProjectionBinding::materialize_direct(
   BLOB_GAMES.direct(),
   source(),
@@ -889,7 +1017,7 @@ pub struct Todos {
 				},
 				{
 					file: 'modules/todo.rs · todos_force_archive',
-					caption: 'Write RBAC: admin only; absent from user client inventory.',
+					caption: 'Write RBAC: admin only + causal_is_admin guard; absent from user client inventory.',
 					code: `.command_transition::<
   domain_commands::ForceArchive,
   TodoForceArchiveInput,
@@ -897,7 +1025,7 @@ pub struct Todos {
 >(todo_force_archive::COMMAND)
 .field_name("todos_force_archive")
 .roles(["admin"])
-.handle(todo_force_archive::handle)`
+.guarded(causal_is_admin, todo_force_archive::handle)`
 				},
 				{
 					file: 'routes/admin/+layout.server.ts',
@@ -912,10 +1040,40 @@ pub struct Todos {
 				}
 			]
 		},
+		{
+			id: 'service',
+			label: '3 · Service module',
+			lede: 'Admin is not a second service binary — it is a second GraphQL surface (e2e-ui-admin) over the same e2e-service. Force-archive is mounted once in modules/todo.rs; only the admin client inventory includes it.',
+			principle: 'Roles and surfaces are real; modules stay shared.',
+			samples: [
+				{
+					file: 'modules/todo.rs · force_archive mount',
+					caption: 'Same module that serves /todos — elevated field on the same Routes inventory.',
+					code: `.command_transition::<
+  domain_commands::ForceArchive,
+  /* … */,
+>(todo_force_archive::COMMAND)
+.field_name("todos_force_archive")
+.roles(["admin"])
+.guarded(causal_is_admin, todo_force_archive::handle)`
+				},
+				{
+					file: 'modules/graphql.rs · dual surfaces',
+					caption: 'Service crate opens user + admin + public application surfaces.',
+					code: `.client_application_surface_with_schema_roles(
+  "e2e-ui",
+  ["admin", "user"],
+  ["user"],
+)
+.client_application_surface("e2e-ui-admin", ["admin"])
+.client_application_surface("e2e-ui-public", ["anonymous"])`
+				}
+			]
+		},
 		{
 			id: 'handlers',
-			label: '3 · Handlers',
-			lede: 'Handler still uses repo.get → domain force_archive → Eventual commit. Authorization is role + surface, not a special HTTP path.',
+			label: '4 · Handlers',
+			lede: 'Handler still uses repo.get → domain force_archive → Eventual commit. Authorization is role + surface + mount guard, not a special HTTP path.',
 			principle: 'Trust the signed-in person, not the request body.',
 			samples: [
 				{
@@ -924,7 +1082,7 @@ pub struct Todos {
   ctx: &CausalCommandContext<'_, Todo>,
   input: TodoForceArchiveInput,
 ) -> Result<PreparedCommand<Eventual<TodoForceArchivePayload>>, HandlerError> {
-  let admin = ctx.user_id()?.to_string();
+  let admin = principal(ctx)?;
   let repo = ctx.repo();
   let mut todo = repo
     .get(&input.todo_id)
@@ -947,7 +1105,7 @@ pub struct Todos {
 		},
 		{
 			id: 'domain',
-			label: '4 · Domain',
+			label: '5 · Domain',
 			lede: 'Same Todo aggregate as /todos — elevated methods live on the domain type, not in the GraphQL layer. One write model, many surfaces.',
 			principle: 'Start with the domain, not the database.',
 			samples: [
@@ -996,7 +1154,7 @@ fn record_force_archived(&mut self) {
 		},
 		{
 			id: 'events',
-			label: '5 · Events',
+			label: '6 · Events',
 			lede: 'Force-archive emits TodoForceArchivedDomainEvent into the same todos projection path (and same save_todo mutation) as owner archive — every surface’s replica converges on one query model.',
 			principle: 'Register once, ship everywhere.',
 			samples: [
@@ -1166,7 +1324,7 @@ IdentityConfig::oidc_bearer(oidc)`
 			]
 		},
 		{
-			id: 'domain',
+			id: 'claims',
 			label: '4 · Claims',
 			lede: 'Groups from the IdP map to engine roles in the browser and again in claim mapping. No domain aggregate for “session” — identity is transport.',
 			principle: 'Simplest DX is the goal.',
@@ -1184,9 +1342,37 @@ IdentityConfig::oidc_bearer(oidc)`
 				}
 			]
 		},
+		{
+			id: 'service',
+			label: '5 · Service module',
+			lede: 'Identity is not a domain aggregate in e2e-service — it is service-crate wiring: OIDC/dev headers, claim maps, and the chat module’s Zitadel ingress that fills AuthUsers. MODULE_IDS still lists "identity" next to todo/chat/blob.',
+			principle: 'Transport identity, compose modules, keep domains pure.',
+			samples: [
+				{
+					file: 'modules/compose.rs · MODULE_IDS',
+					caption: 'Identity is an inventory slot; command mounts live on chat/todo/blob.',
+					code: `pub const MODULE_IDS: &[&str] = &[
+  todo::MODULE_ID,
+  chat::MODULE_ID,
+  blob::MODULE_ID,
+  "identity",
+];`
+				},
+				{
+					file: 'modules/chat.rs · Zitadel ingress',
+					caption: 'Service-crate extension commands (not GraphQL user mutations).',
+					code: `.command(handlers::ingestors::zitadel::COMMAND)
+.guarded(zitadel::guard, zitadel::handle)
+.command(handlers::ingestors::zitadel_scrape::COMMAND)
+.guarded(zitadel_scrape::guard, zitadel_scrape::handle)
+.events(project_auth_user::EVENTS)
+.guarded(project_auth_user::guard, project_auth_user::handle)`
+				}
+			]
+		},
 		{
 			id: 'events',
-			label: '5 · Directory',
+			label: '6 · Directory',
 			lede: 'People still appear as AuthUsers via Zitadel ingest/scrape domain events — joins for chat author and blob owner, not a second display-name source.',
 			principle: 'Know which side of the fence you are on.',
 			samples: [

From 19b74ca51747d0de6c6b84ff75e2ac4a732c504a Mon Sep 17 00:00:00 2001
From: Patrick Lee Scott <pat@patscott.io>
Date: Tue, 4 Aug 2026 20:56:07 -0500
Subject: [PATCH 4/6] refactor: framework WASM pure host; validation in domain
 pure

Add createWasmJsonPure for load/JSON/fail-closed hosting. blobSimulateMove
now takes record+args JSON and validates inside blob-domain wasm. App
simulate-move.ts is a short pure registration only.
---
 js/src/replica/index.ts                       |   6 +-
 js/src/replica/projection-delta/index.ts      |   6 +
 js/src/replica/projection-delta/wasm-pure.ts  | 109 ++++++++++++++++
 tests/e2e-ui/crates/blob-domain/src/wasm.rs   |  59 ++++++---
 tests/e2e-ui/ui/src/lib/blob/simulate-move.ts | 122 ++----------------
 tests/e2e-ui/ui/src/lib/walkthrough/demos.ts  |  15 +--
 6 files changed, 178 insertions(+), 139 deletions(-)
 create mode 100644 js/src/replica/projection-delta/wasm-pure.ts

diff --git a/js/src/replica/index.ts b/js/src/replica/index.ts
index bb2282c4..4637414e 100644
--- a/js/src/replica/index.ts
+++ b/js/src/replica/index.ts
@@ -113,10 +113,14 @@ export type {
 	ReplicaPreparedEffectKey,
 	ReplicaReceiptVerification
 } from './commands.js';
+export { createWasmJsonPure } from './projection-delta/index.js';
 export type {
+	CreateWasmJsonPureOptions,
 	PreparedCommandProjection,
 	PreparedProjectionOperation,
-	ReplicaCommandProjection
+	ReplicaCommandProjection,
+	WasmJsonModule,
+	WasmJsonPureHost
 } from './projection-delta/index.js';
 export {
 	compareReplicaOrder,
diff --git a/js/src/replica/projection-delta/index.ts b/js/src/replica/projection-delta/index.ts
index a5b77fc8..d2280138 100644
--- a/js/src/replica/projection-delta/index.ts
+++ b/js/src/replica/projection-delta/index.ts
@@ -12,6 +12,12 @@ export {
 	operationsFromProjectionDelta,
 	prepareCommandProjection
 } from './resolve.js';
+export { createWasmJsonPure } from './wasm-pure.js';
+export type {
+	CreateWasmJsonPureOptions,
+	WasmJsonModule,
+	WasmJsonPureHost
+} from './wasm-pure.js';
 export type {
 	AppliedProjectionDelta,
 	CommandProjectionMetadata,
diff --git a/js/src/replica/projection-delta/wasm-pure.ts b/js/src/replica/projection-delta/wasm-pure.ts
new file mode 100644
index 00000000..b472c7c1
--- /dev/null
+++ b/js/src/replica/projection-delta/wasm-pure.ts
@@ -0,0 +1,109 @@
+/**
+ * Framework host for pure reduces backed by a wasm-bindgen module.
+ *
+ * Domain pures validate record/args and return assign fields (or null).
+ * This helper only: lazy-load, JSON bridge, fail-closed on any host error.
+ */
+
+import type { ReplicaValue } from '../types.js';
+import type { ReplicaPureFunction } from './types.js';
+
+/** Minimal wasm-bindgen module shape used by {@link createWasmJsonPure}. */
+export type WasmJsonModule = {
+	default: (input?: unknown) => Promise<unknown>;
+	[exportName: string]: unknown;
+};
+
+export type CreateWasmJsonPureOptions = Readonly<{
+	/** Dynamic import of the wasm-pack module (e.g. `() => import('./pkg/x.js')`). */
+	load: () => Promise<WasmJsonModule>;
+	/**
+	 * Named export that accepts `(recordJson: string, argsJson: string)` and
+	 * returns a JSON object string of assign fields, or undefined/null to skip.
+	 */
+	exportName: string;
+	/** When true (default in browsers), start loading immediately. */
+	warm?: boolean;
+}>;
+
+export type WasmJsonPureHost = Readonly<{
+	/** Resolve when the module is instantiated (no-op on non-browser). */
+	ensureReady: () => Promise<void>;
+	/** Sync pure for `pureFunctions` / pureReduces. */
+	pure: ReplicaPureFunction;
+}>;
+
+function isBrowser(): boolean {
+	return typeof globalThis !== 'undefined' && 'window' in globalThis;
+}
+
+/**
+ * Build a {@link ReplicaPureFunction} that JSON-roundtrips through a WASM export.
+ *
+ * All field validation belongs in the WASM/domain pure. The host never inspects
+ * individual record/arg keys — missing module or throw → null (fail closed).
+ */
+export function createWasmJsonPure(
+	options: CreateWasmJsonPureOptions
+): WasmJsonPureHost {
+	let module: WasmJsonModule | null = null;
+	let initPromise: Promise<void> | null = null;
+
+	const ensureReady = (): Promise<void> => {
+		if (!isBrowser()) {
+			return Promise.resolve();
+		}
+		if (module) {
+			return Promise.resolve();
+		}
+		if (initPromise) {
+			return initPromise;
+		}
+		initPromise = options
+			.load()
+			.then(async (loaded) => {
+				await loaded.default();
+				module = loaded;
+			})
+			.catch((error) => {
+				initPromise = null;
+				module = null;
+				throw error;
+			});
+		return initPromise;
+	};
+
+	if (options.warm !== false && isBrowser()) {
+		void ensureReady().catch(() => {
+			/* fail closed on first pure call */
+		});
+	}
+
+	const pure: ReplicaPureFunction = (record, args) => {
+		if (!module) {
+			return null;
+		}
+		const fn = module[options.exportName];
+		if (typeof fn !== 'function') {
+			return null;
+		}
+		try {
+			const out = (fn as (r: string, a: string) => string | undefined | null)(
+				JSON.stringify(record),
+				JSON.stringify(args)
+			);
+			if (out === undefined || out === null || out === '') {
+				return null;
+			}
+			const parsed = JSON.parse(out) as unknown;
+			if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+				return null;
+			}
+			return Object.freeze(parsed as Readonly<Record<string, ReplicaValue>>);
+		} catch {
+			return null;
+		}
+	};
+
+	return Object.freeze({ ensureReady, pure });
+}
diff --git a/tests/e2e-ui/crates/blob-domain/src/wasm.rs b/tests/e2e-ui/crates/blob-domain/src/wasm.rs
index 8bdd7885..c8936ad9 100644
--- a/tests/e2e-ui/crates/blob-domain/src/wasm.rs
+++ b/tests/e2e-ui/crates/blob-domain/src/wasm.rs
@@ -1,33 +1,50 @@
 //! Client WASM surface for pure board rules (`--features wasm`).
 //!
-//! JS calls [`blob_simulate_move`] with `map_json`, score, and direction; gets
-//! JSON fields for the optimistic patch (or undefined on fail-closed).
+//! One export: JSON record + JSON args → JSON assign fields (or undefined).
+//! All validation lives here so the TS host stays a thin framework bridge.
 
 use crate::core::{simulate_move, Direction};
+use serde_json::{Map, Value};
 use wasm_bindgen::prelude::*;
 
-/// Apply one move for known-row optimism.
+/// Known-row pure reduce for `blob.simulate_move`.
 ///
-/// Returns a JSON object:
+/// * `record_json` — known `BlobGames` row (needs `map_json`, `score`)
+/// * `args_json` — command args (needs `direction`)
+///
+/// Returns assign payload:
 /// `{ map_json, score, player_dead, current_level_completed, status }`
-/// or `undefined` when the move is impossible / input is invalid.
+/// or `undefined` when invalid / impossible (fail closed).
 #[wasm_bindgen(js_name = blobSimulateMove)]
-pub fn blob_simulate_move(map_json: &str, score: f64, direction: &str) -> Option<String> {
-    if !score.is_finite() {
-        return None;
-    }
-    // JS numbers are f64; board scores are small integers.
-    let score = score as i64;
-    let direction = Direction::parse(direction)?;
+pub fn blob_simulate_move(record_json: &str, args_json: &str) -> Option<String> {
+    let record: Value = serde_json::from_str(record_json).ok()?;
+    let args: Value = serde_json::from_str(args_json).ok()?;
+    let map_json = record.get("map_json")?.as_str()?;
+    let score = json_i64(record.get("score")?)?;
+    let direction = args.get("direction")?.as_str().and_then(Direction::parse)?;
     let map: Vec<Vec<u8>> = serde_json::from_str(map_json).ok()?;
     let preview = simulate_move(&map, score, direction).ok()?;
-    let map_json = serde_json::to_string(&preview.map).ok()?;
-    let body = serde_json::json!({
-        "map_json": map_json,
-        "score": preview.score,
-        "player_dead": preview.player_dead,
-        "current_level_completed": preview.level_complete,
-        "status": preview.status(),
-    });
-    Some(body.to_string())
+    let next_map_json = serde_json::to_string(&preview.map).ok()?;
+
+    let mut out = Map::new();
+    out.insert("map_json".into(), Value::String(next_map_json));
+    out.insert("score".into(), Value::from(preview.score));
+    out.insert("player_dead".into(), Value::Bool(preview.player_dead));
+    out.insert(
+        "current_level_completed".into(),
+        Value::Bool(preview.level_complete),
+    );
+    out.insert("status".into(), Value::String(preview.status()));
+    serde_json::to_string(&Value::Object(out)).ok()
+}
+
+fn json_i64(value: &Value) -> Option<i64> {
+    match value {
+        Value::Number(n) => n
+            .as_i64()
+            .or_else(|| n.as_u64().and_then(|u| i64::try_from(u).ok()))
+            .or_else(|| n.as_f64().filter(|f| f.is_finite()).map(|f| f as i64)),
+        Value::String(s) => s.parse().ok(),
+        _ => None,
+    }
 }
diff --git a/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts b/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
index 55cc3c23..6298b170 100644
--- a/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
+++ b/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
@@ -1,120 +1,24 @@
 /**
- * Client pure for `blob.simulate_move` — thin host over `blob-domain` WASM.
+ * Client pure for `blob.simulate_move` — framework WASM host + domain pure.
  *
- * Board rules live once in Rust (`blob_domain::core::simulate_move`). This
- * module only loads the wasm package, adapts replica record/args, and fails
- * closed when the module is not ready or the move is impossible.
+ * Rules + validation live in `blob_domain::core` (exported as WASM).
+ * This file only wires the module path for gen-client / pureFunctions.
  *
- * Build: `make wasm` (or `make ui-install`) → `./pkg` from wasm-pack
- * (`--features wasm --no-default-features` on blob-domain).
+ * Build: `make wasm` → `./pkg` (`blob-domain --features wasm`).
  */
 
-export type BlobMoveResult = Readonly<{
-	map_json: string;
-	score: number;
-	player_dead: boolean;
-	current_level_completed: boolean;
-	status: string;
-}>;
+import { createWasmJsonPure } from '@hops-ops/distributed/replica';
 
-type WasmApi = {
-	default: (input?: unknown) => Promise<unknown>;
-	blobSimulateMove: (
-		map_json: string,
-		score: number,
-		direction: string
-	) => string | undefined;
-};
-
-let api: WasmApi | null = null;
-let initPromise: Promise<void> | null = null;
-
-function isBrowser(): boolean {
-	return typeof window !== 'undefined';
-}
-
-/**
- * Load and instantiate blob-domain pure WASM. Safe to call multiple times.
- * No-op on the server (SSR) — pure reduce fails closed until the client inits.
- */
-export function ensureBlobWasm(): Promise<void> {
-	if (!isBrowser()) {
-		return Promise.resolve();
-	}
-	if (api) {
-		return Promise.resolve();
-	}
-	if (initPromise) {
-		return initPromise;
-	}
-	initPromise = (async () => {
-		const mod = (await import('./pkg/blob_wasm.js')) as WasmApi;
-		await mod.default();
-		api = mod;
-	})().catch((error) => {
-		initPromise = null;
-		api = null;
-		throw error;
-	});
-	return initPromise;
-}
-
-// Warm the module early on the client so the first move can pure-reduce.
-if (isBrowser()) {
-	void ensureBlobWasm().catch(() => {
-		// Fail closed later in simulateMove; do not break module load.
-	});
-}
+const host = createWasmJsonPure({
+	load: () => import('./pkg/blob_wasm.js'),
+	exportName: 'blobSimulateMove'
+});
 
-/**
- * Apply one direction to a known BlobGames row (WASM pure).
- * Returns null when not ready, invalid, or the move is impossible.
- */
-export function simulateMove(
-	record: Readonly<Record<string, unknown>>,
-	args: Readonly<Record<string, unknown>>
-): BlobMoveResult | null {
-	if (!api) {
-		return null;
-	}
-	const direction = args.direction;
-	if (typeof direction !== 'string') return null;
-	const mapJson = record.map_json;
-	if (typeof mapJson !== 'string') return null;
-	const scoreRaw = record.score;
-	const score =
-		typeof scoreRaw === 'number'
-			? scoreRaw
-			: typeof scoreRaw === 'bigint'
-				? Number(scoreRaw)
-				: typeof scoreRaw === 'string'
-					? Number(scoreRaw)
-					: NaN;
-	if (!Number.isFinite(score)) return null;
+/** Load WASM before first move so pure-reduce can paint (SSR is a no-op). */
+export const ensureBlobWasm = host.ensureReady;
 
-	let json: string | undefined;
-	try {
-		json = api.blobSimulateMove(mapJson, score, direction);
-	} catch {
-		return null;
-	}
-	if (json === undefined || json === '') return null;
-	try {
-		const parsed = JSON.parse(json) as BlobMoveResult;
-		if (
-			typeof parsed.map_json !== 'string' ||
-			typeof parsed.score !== 'number' ||
-			typeof parsed.player_dead !== 'boolean' ||
-			typeof parsed.current_level_completed !== 'boolean' ||
-			typeof parsed.status !== 'string'
-		) {
-			return null;
-		}
-		return Object.freeze(parsed);
-	} catch {
-		return null;
-	}
-}
+/** Replica pure: known BlobGames row + `{ direction }` → assign fields | null. */
+export const simulateMove = host.pure;
 
 /** Pure registry entry for the command runtime (and generated pures.ts). */
 export const BLOB_PURE_FUNCTIONS = Object.freeze({
diff --git a/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts b/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
index 64ac8530..603b3f10 100644
--- a/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
+++ b/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
@@ -755,14 +755,13 @@ await commands.blob.move({ game_id, direction });
 				},
 				{
 					file: 'ui/src/lib/blob/simulate-move.ts',
-					caption: 'Thin WASM host — rules live in blob_domain::core.',
-					code: `export function simulateMove(record, args) {
-  if (!api) return null; // fail closed until ensureBlobWasm()
-  const json = api.blobSimulateMove(
-    record.map_json, Number(record.score), args.direction
-  );
-  return json ? Object.freeze(JSON.parse(json)) : null;
-}`
+					caption: 'Framework WASM host — validation + rules in domain pure.',
+					code: `const host = createWasmJsonPure({
+  load: () => import('./pkg/blob_wasm.js'),
+  exportName: 'blobSimulateMove', // (recordJson, argsJson) → assign JSON
+});
+export const ensureBlobWasm = host.ensureReady;
+export const simulateMove = host.pure;`
 				}
 			]
 		},

From e3e3c3adff6632b59525b167667384363203e4ad Mon Sep 17 00:00:00 2001
From: Patrick Lee Scott <pat@patscott.io>
Date: Thu, 6 Aug 2026 13:03:45 -0500
Subject: [PATCH 5/6] =?UTF-8?q?feat:=20gen-client=20hosts=20WASM=20pures?=
 =?UTF-8?q?=20=E2=80=94=20no=20app=20simulate-move.ts?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Declare CommandProjectionPureReduce::wasm(package, export); render_pures
emits createWasmJsonPure hosts and ensurePureFunctionsReady. Blob move
registers blob/pkg/blob_wasm; delete hand pure host. board.ts stays as
UI presentation helpers (tiles/parse), not domain pure.
---
 .../src/client_compiler/manifest/types.rs     |   6 +
 .../src/client_compiler/render/commands.rs    | 106 ++++++++++++++----
 .../src/client_compiler/render/project.rs     |  11 +-
 src/graphql/client_manifest/projections.rs    |   2 +
 src/graphql/client_manifest/types.rs          |   6 +
 src/graphql/command_contract/projections.rs   |  85 ++++++++++++--
 .../e2e-ui/crates/service/src/modules/blob.rs |   8 +-
 tests/e2e-ui/ui/src/lib/blob/simulate-move.ts |  26 -----
 .../ui/src/lib/generated/admin/commands.ts    |  22 ++--
 .../ui/src/lib/generated/admin/index.ts       |   1 +
 .../ui/src/lib/generated/admin/manifest.json  |   2 +-
 .../admin/operations/admin-all-todos.ts       |   2 +-
 .../ui/src/lib/generated/admin/protocol.ts    |   4 +-
 .../ui/src/lib/generated/admin/pures.ts       |  14 ++-
 .../ui/src/lib/generated/user/commands.ts     |  20 ++--
 .../e2e-ui/ui/src/lib/generated/user/index.ts |   1 +
 .../ui/src/lib/generated/user/manifest.json   |   2 +-
 .../generated/user/operations/blob-games.ts   |   2 +-
 .../user/operations/chat-messages.ts          |   2 +-
 .../lib/generated/user/operations/todos.ts    |   2 +-
 .../ui/src/lib/generated/user/protocol.ts     |   4 +-
 .../e2e-ui/ui/src/lib/generated/user/pures.ts |  14 ++-
 tests/e2e-ui/ui/src/lib/walkthrough/demos.ts  |  26 +++--
 .../src/routes/blob/[[gameId]]/+page.svelte   |   9 +-
 24 files changed, 258 insertions(+), 119 deletions(-)
 delete mode 100644 tests/e2e-ui/ui/src/lib/blob/simulate-move.ts

diff --git a/distributed_cli/src/client_compiler/manifest/types.rs b/distributed_cli/src/client_compiler/manifest/types.rs
index 2ca442ae..14e901a6 100644
--- a/distributed_cli/src/client_compiler/manifest/types.rs
+++ b/distributed_cli/src/client_compiler/manifest/types.rs
@@ -1083,8 +1083,14 @@ pub(crate) struct ManifestCommandProjection {
 #[serde(deny_unknown_fields)]
 pub(crate) struct ManifestCommandPureReduce {
     pub(crate) fn_name: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
     pub(crate) client_module: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
     pub(crate) client_export: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub(crate) wasm_package: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub(crate) wasm_export: String,
     pub(crate) model: String,
     pub(crate) key: Vec<ManifestCommandPureArg>,
     pub(crate) args: Vec<ManifestCommandPureArg>,
diff --git a/distributed_cli/src/client_compiler/render/commands.rs b/distributed_cli/src/client_compiler/render/commands.rs
index e0af0beb..d927b911 100644
--- a/distributed_cli/src/client_compiler/render/commands.rs
+++ b/distributed_cli/src/client_compiler/render/commands.rs
@@ -22,7 +22,7 @@ pub(super) fn render_commands(manifest: &ClientManifest) -> Result<String, Clien
         )
     })?;
     let mut sections = vec!["/** GENERATED by distributed client. Do not edit. */".to_string()];
-    let pure_inventory = pure_function_inventory(manifest);
+    let pure_inventory = pure_function_inventory(manifest)?;
     if !manifest.commands.is_empty() {
         sections.push(
             "import {\n  createReplicaCommandRuntime,\n  prepareReplicaCommand\n} from '@hops-ops/distributed/replica';"
@@ -103,10 +103,19 @@ pub(super) fn render_commands(manifest: &ClientManifest) -> Result<String, Clien
     Ok(format!("{}\n", sections.join("\n\n")))
 }
 
+/// How a pure is delivered to the generated client.
+#[derive(Clone, Debug, PartialEq, Eq)]
+enum PureDelivery {
+    /// Hand-written `$lib/<module>` named export.
+    ClientModule { module: String, export: String },
+    /// wasm-pack package under `$lib`; host is generated in pures.ts.
+    WasmPackage { package: String, export: String },
+}
+
 /// Collect unique pure functions from command projection extensions.
 fn pure_function_inventory(
     manifest: &ClientManifest,
-) -> Vec<(String, String, String)> {
+) -> Result<Vec<(String, PureDelivery)>, ClientCompileError> {
     let mut seen = BTreeSet::new();
     let mut out = Vec::new();
     for command in &manifest.commands {
@@ -114,41 +123,90 @@ fn pure_function_inventory(
             continue;
         };
         for reduce in &projection.pure_reduces {
-            if seen.insert(reduce.fn_name.clone()) {
-                out.push((
-                    reduce.fn_name.clone(),
-                    reduce.client_module.clone(),
-                    reduce.client_export.clone(),
-                ));
+            if !seen.insert(reduce.fn_name.clone()) {
+                continue;
             }
+            let hand = !reduce.client_module.is_empty() || !reduce.client_export.is_empty();
+            let wasm = !reduce.wasm_package.is_empty() || !reduce.wasm_export.is_empty();
+            let delivery = if hand && !wasm {
+                PureDelivery::ClientModule {
+                    module: reduce.client_module.clone(),
+                    export: reduce.client_export.clone(),
+                }
+            } else if wasm && !hand {
+                PureDelivery::WasmPackage {
+                    package: reduce.wasm_package.clone(),
+                    export: reduce.wasm_export.clone(),
+                }
+            } else {
+                return Err(ClientCompileError::manifest(
+                    "client.projection_pure_reduce",
+                    format!(
+                        "pure `{}` must declare either client_module+client_export or wasm_package+wasm_export",
+                        reduce.fn_name
+                    ),
+                ));
+            };
+            out.push((reduce.fn_name.clone(), delivery));
         }
     }
     out.sort_by(|a, b| a.0.cmp(&b.0));
-    out
+    Ok(out)
 }
 
-/// Generate `pures.ts` mapping pure fn ids to client module exports.
+/// Generate `pures.ts` mapping pure fn ids to hosts / hand imports.
 pub(super) fn render_pures(manifest: &ClientManifest) -> Result<Option<String>, ClientCompileError> {
-    let inventory = pure_function_inventory(manifest);
+    let inventory = pure_function_inventory(manifest)?;
     if inventory.is_empty() {
         return Ok(None);
     }
-    let mut imports = Vec::new();
+    let mut sections = vec![
+        "/** GENERATED by distributed client. Pure functions for projection.pureReduces. */"
+            .to_string(),
+    ];
+    let needs_wasm = inventory
+        .iter()
+        .any(|(_, d)| matches!(d, PureDelivery::WasmPackage { .. }));
+    if needs_wasm {
+        sections.push(
+            "import { createWasmJsonPure } from '@hops-ops/distributed/replica';".into(),
+        );
+    }
     let mut entries = Vec::new();
-    for (index, (fn_name, module, export)) in inventory.iter().enumerate() {
-        let alias = format!("pure_{index}");
-        // From generated/<surface>/ to $lib/<module>
-        let rel = format!("../../{module}.js");
-        imports.push(format!(
-            "import {{ {export} as {alias} }} from '{rel}';"
-        ));
-        entries.push(format!("  {}: {alias}", quoted_property(fn_name)));
+    let mut ready_calls = Vec::new();
+    for (index, (fn_name, delivery)) in inventory.iter().enumerate() {
+        match delivery {
+            PureDelivery::ClientModule { module, export } => {
+                let alias = format!("pure_{index}");
+                // From generated/<surface>/ to $lib/<module>
+                let rel = format!("../../{module}.js");
+                sections.push(format!("import {{ {export} as {alias} }} from '{rel}';"));
+                entries.push(format!("  {}: {alias}", quoted_property(fn_name)));
+            }
+            PureDelivery::WasmPackage { package, export } => {
+                let host = format!("pureHost_{index}");
+                // From generated/<surface>/ to $lib/<package>.js (wasm-pack entry)
+                let rel = format!("../../{package}.js");
+                sections.push(format!(
+                    "const {host} = createWasmJsonPure({{\n  load: () => import('{rel}'),\n  exportName: {export_lit}\n}});",
+                    export_lit = serde_json::to_string(export).unwrap_or_else(|_| "\"\"".into()),
+                ));
+                entries.push(format!("  {}: {host}.pure", quoted_property(fn_name)));
+                ready_calls.push(format!("  await {host}.ensureReady();"));
+            }
+        }
     }
-    Ok(Some(format!(
-        "/** GENERATED by distributed client. Pure functions for projection.pureReduces. */\n\n{}\n\nexport const PURE_FUNCTIONS = {{\n{}\n}} as const;\n",
-        imports.join("\n"),
+    sections.push(format!(
+        "export const PURE_FUNCTIONS = {{\n{}\n}} as const;",
         entries.join(",\n")
-    )))
+    ));
+    if !ready_calls.is_empty() {
+        sections.push(format!(
+            "/** Instantiate WASM pure hosts (no-op when none / already ready). */\nexport async function ensurePureFunctionsReady(): Promise<void> {{\n{}\n}}",
+            ready_calls.join("\n")
+        ));
+    }
+    Ok(Some(format!("{}\n", sections.join("\n\n"))))
 }
 
 fn validate_command_namespaces(commands: &[ManifestCommand]) -> Result<(), ClientCompileError> {
diff --git a/distributed_cli/src/client_compiler/render/project.rs b/distributed_cli/src/client_compiler/render/project.rs
index 81f4b1c9..c527152c 100644
--- a/distributed_cli/src/client_compiler/render/project.rs
+++ b/distributed_cli/src/client_compiler/render/project.rs
@@ -46,7 +46,9 @@ pub(crate) fn render_project(
         path: "commands.ts".into(),
         contents: render_commands(manifest)?,
     });
-    if let Some(pures) = super::commands::render_pures(manifest)? {
+    let pures = super::commands::render_pures(manifest)?;
+    let has_pures = pures.is_some();
+    if let Some(pures) = pures {
         files.push(GeneratedClientFile {
             path: "pures.ts".into(),
             contents: pures,
@@ -66,7 +68,7 @@ pub(crate) fn render_project(
     });
     files.push(GeneratedClientFile {
         path: "index.ts".into(),
-        contents: render_index(&operations),
+        contents: render_index(&operations, has_pures),
     });
     files.push(GeneratedClientFile {
         path: "manifest.json".into(),
@@ -257,13 +259,16 @@ fn render_routes(
     ))
 }
 
-fn render_index(operations: &[CompiledOperation]) -> String {
+fn render_index(operations: &[CompiledOperation], has_pures: bool) -> String {
     let mut lines = vec![
         "/** GENERATED public entrypoint. */".to_string(),
         "export * from './commands.js';".into(),
         "export * from './protocol.js';".into(),
         "export * from './routes.js';".into(),
     ];
+    if has_pures {
+        lines.push("export * from './pures.js';".into());
+    }
     for operation in operations {
         let module = operation
             .module_path
diff --git a/src/graphql/client_manifest/projections.rs b/src/graphql/client_manifest/projections.rs
index 80fb46d9..ada863f7 100644
--- a/src/graphql/client_manifest/projections.rs
+++ b/src/graphql/client_manifest/projections.rs
@@ -289,6 +289,8 @@ pub(super) fn command_projection_extension(
                 fn_name: reduce.fn_name.clone(),
                 client_module: reduce.client_module.clone(),
                 client_export: reduce.client_export.clone(),
+                wasm_package: reduce.wasm_package.clone(),
+                wasm_export: reduce.wasm_export.clone(),
                 model: reduce.model.clone(),
                 key: reduce
                     .key
diff --git a/src/graphql/client_manifest/types.rs b/src/graphql/client_manifest/types.rs
index a0741e94..04d2b542 100644
--- a/src/graphql/client_manifest/types.rs
+++ b/src/graphql/client_manifest/types.rs
@@ -854,8 +854,14 @@ pub struct CommandProjectionExtension {
 #[serde(deny_unknown_fields)]
 pub struct ClientCommandPureReduce {
     pub fn_name: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
     pub client_module: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
     pub client_export: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub wasm_package: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    pub wasm_export: String,
     pub model: String,
     pub key: Vec<ClientCommandPureArg>,
     pub args: Vec<ClientCommandPureArg>,
diff --git a/src/graphql/command_contract/projections.rs b/src/graphql/command_contract/projections.rs
index 76dee3af..ca70a3d7 100644
--- a/src/graphql/command_contract/projections.rs
+++ b/src/graphql/command_contract/projections.rs
@@ -156,17 +156,23 @@ pub(crate) struct CommandProjectionEventPreview {
 
 /// Pure reducer over a known cache row for client auto-optimism.
 ///
-/// The server/domain owns the pure semantics (e.g. `blob_domain::simulate_move`);
-/// the client module/export is the shipped TypeScript twin invoked by the
-/// replica when applying `projection.pureReduces`.
+/// Domain owns pure semantics. Client delivery is either:
+/// - **WASM** ([`Self::wasm`]): gen-client emits a `createWasmJsonPure` host in
+///   `pures.ts` — no app TypeScript pure file required.
+/// - **Hand module** ([`Self::client_module`]): gen-client imports a named export
+///   from `$lib/<module>` (escape hatch).
 #[derive(Clone, Debug, PartialEq, Eq, Serialize)]
 pub struct CommandProjectionPureReduce {
     /// Stable pure id, e.g. `blob.simulate_move`.
     pub fn_name: String,
-    /// Path under app `$lib` without extension, e.g. `blob/simulate-move`.
+    /// Path under app `$lib` without extension for a hand-written pure (empty if WASM).
     pub client_module: String,
-    /// Named export in that module, e.g. `simulateMove`.
+    /// Named export in that hand module (empty if WASM).
     pub client_export: String,
+    /// wasm-pack package under `$lib` without extension, e.g. `blob/pkg/blob_wasm`.
+    pub wasm_package: String,
+    /// Named WASM export `(recordJson, argsJson) -> assignJson | undefined`.
+    pub wasm_export: String,
     /// Projection model id (e.g. `BlobGames`).
     pub model: String,
     /// Record key fields: `name` is the model field; `source` is input/default/preset.
@@ -185,7 +191,8 @@ pub struct CommandProjectionPureArg {
 }
 
 impl CommandProjectionPureReduce {
-    pub fn new(
+    /// Hand-written pure under `$lib/<module>` exporting `client_export`.
+    pub fn client_module(
         fn_name: impl Into<String>,
         client_module: impl Into<String>,
         client_export: impl Into<String>,
@@ -195,6 +202,8 @@ impl CommandProjectionPureReduce {
             fn_name: fn_name.into(),
             client_module: client_module.into(),
             client_export: client_export.into(),
+            wasm_package: String::new(),
+            wasm_export: String::new(),
             model: model.into(),
             key: Vec::new(),
             args: Vec::new(),
@@ -202,6 +211,37 @@ impl CommandProjectionPureReduce {
         }
     }
 
+    /// Domain pure shipped as wasm-pack under `$lib/<package>`; gen-client hosts it.
+    pub fn wasm(
+        fn_name: impl Into<String>,
+        wasm_package: impl Into<String>,
+        wasm_export: impl Into<String>,
+        model: impl Into<String>,
+    ) -> Self {
+        Self {
+            fn_name: fn_name.into(),
+            client_module: String::new(),
+            client_export: String::new(),
+            wasm_package: wasm_package.into(),
+            wasm_export: wasm_export.into(),
+            model: model.into(),
+            key: Vec::new(),
+            args: Vec::new(),
+            assign: Vec::new(),
+        }
+    }
+
+    /// Deprecated alias for [`Self::client_module`].
+    #[deprecated(note = "use client_module() or wasm()")]
+    pub fn new(
+        fn_name: impl Into<String>,
+        client_module: impl Into<String>,
+        client_export: impl Into<String>,
+        model: impl Into<String>,
+    ) -> Self {
+        Self::client_module(fn_name, client_module, client_export, model)
+    }
+
     #[must_use]
     pub fn key_input(
         mut self,
@@ -358,13 +398,36 @@ impl CommandProjectionEvents {
             }
         }
         for reduce in &mut self.pure_reduces {
-            if reduce.fn_name.trim().is_empty()
-                || reduce.client_module.trim().is_empty()
-                || reduce.client_export.trim().is_empty()
-                || reduce.model.trim().is_empty()
+            if reduce.fn_name.trim().is_empty() || reduce.model.trim().is_empty() {
+                return Err(format!(
+                    "typed command `{command}` pure reduce requires non-empty fn and model"
+                ));
+            }
+            let hand = !reduce.client_module.trim().is_empty()
+                || !reduce.client_export.trim().is_empty();
+            let wasm =
+                !reduce.wasm_package.trim().is_empty() || !reduce.wasm_export.trim().is_empty();
+            if hand == wasm {
+                return Err(format!(
+                    "typed command `{command}` pure reduce `{}` must declare either client_module+client_export or wasm_package+wasm_export (not both, not neither)",
+                    reduce.fn_name
+                ));
+            }
+            if hand
+                && (reduce.client_module.trim().is_empty()
+                    || reduce.client_export.trim().is_empty())
+            {
+                return Err(format!(
+                    "typed command `{command}` pure reduce `{}` client module requires non-empty client_module and client_export",
+                    reduce.fn_name
+                ));
+            }
+            if wasm
+                && (reduce.wasm_package.trim().is_empty() || reduce.wasm_export.trim().is_empty())
             {
                 return Err(format!(
-                    "typed command `{command}` pure reduce requires non-empty fn, client_module, client_export, and model"
+                    "typed command `{command}` pure reduce `{}` wasm package requires non-empty wasm_package and wasm_export",
+                    reduce.fn_name
                 ));
             }
             if reduce.key.is_empty() {
diff --git a/tests/e2e-ui/crates/service/src/modules/blob.rs b/tests/e2e-ui/crates/service/src/modules/blob.rs
index 50705b66..02105165 100644
--- a/tests/e2e-ui/crates/service/src/modules/blob.rs
+++ b/tests/e2e-ui/crates/service/src/modules/blob.rs
@@ -64,12 +64,12 @@ where
         >(blob_move::COMMAND)
         .field_name("blob_games_move")
         .roles(["user", "admin"].into_iter())
-        // Domain pure: blob_domain::core::simulate_move — client via WASM ($lib/blob/simulate-move).
+        // Domain pure: blob_domain::core — WASM package under $lib; gen-client hosts it.
         .preview_reduce_known_record(
-            CommandProjectionPureReduce::new(
+            CommandProjectionPureReduce::wasm(
                 "blob.simulate_move",
-                "blob/simulate-move",
-                "simulateMove",
+                "blob/pkg/blob_wasm",
+                "blobSimulateMove",
                 "BlobGames",
             )
             .key_input("game_id", ["game_id"])
diff --git a/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts b/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
deleted file mode 100644
index 6298b170..00000000
--- a/tests/e2e-ui/ui/src/lib/blob/simulate-move.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-/**
- * Client pure for `blob.simulate_move` — framework WASM host + domain pure.
- *
- * Rules + validation live in `blob_domain::core` (exported as WASM).
- * This file only wires the module path for gen-client / pureFunctions.
- *
- * Build: `make wasm` → `./pkg` (`blob-domain --features wasm`).
- */
-
-import { createWasmJsonPure } from '@hops-ops/distributed/replica';
-
-const host = createWasmJsonPure({
-	load: () => import('./pkg/blob_wasm.js'),
-	exportName: 'blobSimulateMove'
-});
-
-/** Load WASM before first move so pure-reduce can paint (SSR is a no-op). */
-export const ensureBlobWasm = host.ensureReady;
-
-/** Replica pure: known BlobGames row + `{ direction }` → assign fields | null. */
-export const simulateMove = host.pure;
-
-/** Pure registry entry for the command runtime (and generated pures.ts). */
-export const BLOB_PURE_FUNCTIONS = Object.freeze({
-	'blob.simulate_move': simulateMove
-});
diff --git a/tests/e2e-ui/ui/src/lib/generated/admin/commands.ts b/tests/e2e-ui/ui/src/lib/generated/admin/commands.ts
index 2bbb525e..c2716fe7 100644
--- a/tests/e2e-ui/ui/src/lib/generated/admin/commands.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/admin/commands.ts
@@ -317,7 +317,7 @@ export const Command_blob_games_move: ReplicaCommandArtifact<Command_blob_games_
   "protocol": {
     "operation": "sha256:6e3c6c00474e126a3fce6b671cd8a06eed988546f161793d39a08cc784ae49c7",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -595,7 +595,7 @@ export const Command_blob_games_start: ReplicaCommandArtifact<Command_blob_games
   "protocol": {
     "operation": "sha256:4b7ab56a38aec41d21809801ecefc5d7039a09e53a350187152c72a305de1567",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -873,7 +873,7 @@ export const Command_blob_games_start_level: ReplicaCommandArtifact<Command_blob
   "protocol": {
     "operation": "sha256:37c108a568f62e7391a03728555d7013bb717f14d1957a5c3527151fd70093bf",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -1191,7 +1191,7 @@ export const Command_chat_messages_post: ReplicaCommandArtifact<Command_chat_mes
   "protocol": {
     "operation": "sha256:838e5ccb79daebb523ea3c634bea27077bcea191feabb86e45923470a7b9373d",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -1397,7 +1397,7 @@ export const Command_todos_archive: ReplicaCommandArtifact<Command_todos_archive
   "protocol": {
     "operation": "sha256:fb2d3a14933841a966836ced65263a9ba2413d5aed8c582d31165aaee6e632ab",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -1603,7 +1603,7 @@ export const Command_todos_complete: ReplicaCommandArtifact<Command_todos_comple
   "protocol": {
     "operation": "sha256:9b8185c835d3308bda308593486767731acaf4b084a7962b4b17e3e2e319922c",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -1887,7 +1887,7 @@ export const Command_todos_create: ReplicaCommandArtifact<Command_todos_create_I
   "protocol": {
     "operation": "sha256:187e72cd747aaa13ac0362942d73085a5166401f8cc3a188badeb3e7fa50cacb",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -2111,7 +2111,7 @@ export const Command_todos_force_archive: ReplicaCommandArtifact<Command_todos_f
   "protocol": {
     "operation": "sha256:50d0d05ce63148fd7c4041478b57656e927f500f938798df61bf7ade6b53ccbf",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -2311,7 +2311,7 @@ export const Command_todos_purge: ReplicaCommandArtifact<Command_todos_purge_Inp
   "protocol": {
     "operation": "sha256:01875defc418ccf0e607f316baa30d2f9cf8305602976cc5b1ce30cc5078c15e",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -2575,7 +2575,7 @@ export const Command_todos_rename: ReplicaCommandArtifact<Command_todos_rename_I
   "protocol": {
     "operation": "sha256:a3e8a5ceae1a0f2c33863a4f2bf377a95b79da2157a619eb7823aa845ef681c3",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
@@ -2781,7 +2781,7 @@ export const Command_todos_reopen: ReplicaCommandArtifact<Command_todos_reopen_I
   "protocol": {
     "operation": "sha256:04531ace98fd3ee5e652761abbcb6ebd745d5ff6ed0ad100030f935335c5a35e",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
diff --git a/tests/e2e-ui/ui/src/lib/generated/admin/index.ts b/tests/e2e-ui/ui/src/lib/generated/admin/index.ts
index 9668ec33..9b75cf78 100644
--- a/tests/e2e-ui/ui/src/lib/generated/admin/index.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/admin/index.ts
@@ -2,4 +2,5 @@
 export * from './commands.js';
 export * from './protocol.js';
 export * from './routes.js';
+export * from './pures.js';
 export * from './operations/admin-all-todos.js';
diff --git a/tests/e2e-ui/ui/src/lib/generated/admin/manifest.json b/tests/e2e-ui/ui/src/lib/generated/admin/manifest.json
index 317a35b0..ec6e110a 100644
--- a/tests/e2e-ui/ui/src/lib/generated/admin/manifest.json
+++ b/tests/e2e-ui/ui/src/lib/generated/admin/manifest.json
@@ -13,7 +13,7 @@
       "admin"
     ]
   },
-  "schema_fingerprint": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+  "schema_fingerprint": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
   "protocol_fingerprint": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
   "scalar_codecs": {
     "BigInt": "json_number_precision_limited",
diff --git a/tests/e2e-ui/ui/src/lib/generated/admin/operations/admin-all-todos.ts b/tests/e2e-ui/ui/src/lib/generated/admin/operations/admin-all-todos.ts
index 05fff4f4..3a30db54 100644
--- a/tests/e2e-ui/ui/src/lib/generated/admin/operations/admin-all-todos.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/admin/operations/admin-all-todos.ts
@@ -308,7 +308,7 @@ export const Operation_AdminAllTodos: ReplicaOperationArtifact<Operation_AdminAl
   ],
   "protocol": {
     "version": 1,
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "kind": "application",
       "name": "e2e-ui-admin",
diff --git a/tests/e2e-ui/ui/src/lib/generated/admin/protocol.ts b/tests/e2e-ui/ui/src/lib/generated/admin/protocol.ts
index 9cf16a56..0f8f4a7a 100644
--- a/tests/e2e-ui/ui/src/lib/generated/admin/protocol.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/admin/protocol.ts
@@ -5,7 +5,7 @@ import type { ReplicaCommandStatusArtifact } from '@hops-ops/distributed/replica
 export const CLIENT_PROTOCOL = {
 	version: 1,
 	serviceId: "e2e-ui",
-	schemaHash: "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+	schemaHash: "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
 	protocolHash: "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
 	surface: {"kind":"application","name":"e2e-ui-admin","eligible_roles":["admin"],"schema_roles":["admin"]},
 	trustedPresets: [],
@@ -27,7 +27,7 @@ export const COMMAND_STATUS: ReplicaCommandStatusArtifact = {
   "protocol": {
     "operation": "sha256:eb3ce6a8b306d935fc9f3d6f071804ce3ec415d209594c04015fa35b080282ef",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:a5d4e7e594e97a806b2e26d23551a7030696949723e9ff4dc140bf9149a37fe1",
+    "schemaHash": "sha256:56397fca439ae39d9c34aa26f7253938c007f94507f4ca3ba9c01cdaa55814ff",
     "surface": {
       "eligible_roles": [
         "admin"
diff --git a/tests/e2e-ui/ui/src/lib/generated/admin/pures.ts b/tests/e2e-ui/ui/src/lib/generated/admin/pures.ts
index 9e1eb34d..5b5fecfb 100644
--- a/tests/e2e-ui/ui/src/lib/generated/admin/pures.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/admin/pures.ts
@@ -1,7 +1,17 @@
 /** GENERATED by distributed client. Pure functions for projection.pureReduces. */
 
-import { simulateMove as pure_0 } from '../../blob/simulate-move.js';
+import { createWasmJsonPure } from '@hops-ops/distributed/replica';
+
+const pureHost_0 = createWasmJsonPure({
+  load: () => import('../../blob/pkg/blob_wasm.js'),
+  exportName: "blobSimulateMove"
+});
 
 export const PURE_FUNCTIONS = {
-  "blob.simulate_move": pure_0
+  "blob.simulate_move": pureHost_0.pure
 } as const;
+
+/** Instantiate WASM pure hosts (no-op when none / already ready). */
+export async function ensurePureFunctionsReady(): Promise<void> {
+  await pureHost_0.ensureReady();
+}
diff --git a/tests/e2e-ui/ui/src/lib/generated/user/commands.ts b/tests/e2e-ui/ui/src/lib/generated/user/commands.ts
index 760d515a..01cb6429 100644
--- a/tests/e2e-ui/ui/src/lib/generated/user/commands.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/user/commands.ts
@@ -356,7 +356,7 @@ export const Command_blob_games_move: ReplicaCommandArtifact<Command_blob_games_
   "protocol": {
     "operation": "sha256:6e3c6c00474e126a3fce6b671cd8a06eed988546f161793d39a08cc784ae49c7",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
@@ -685,7 +685,7 @@ export const Command_blob_games_start: ReplicaCommandArtifact<Command_blob_games
   "protocol": {
     "operation": "sha256:4b7ab56a38aec41d21809801ecefc5d7039a09e53a350187152c72a305de1567",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
@@ -1014,7 +1014,7 @@ export const Command_blob_games_start_level: ReplicaCommandArtifact<Command_blob
   "protocol": {
     "operation": "sha256:37c108a568f62e7391a03728555d7013bb717f14d1957a5c3527151fd70093bf",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
@@ -1344,7 +1344,7 @@ export const Command_chat_messages_post: ReplicaCommandArtifact<Command_chat_mes
   "protocol": {
     "operation": "sha256:838e5ccb79daebb523ea3c634bea27077bcea191feabb86e45923470a7b9373d",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
@@ -1595,7 +1595,7 @@ export const Command_todos_archive: ReplicaCommandArtifact<Command_todos_archive
   "protocol": {
     "operation": "sha256:fb2d3a14933841a966836ced65263a9ba2413d5aed8c582d31165aaee6e632ab",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
@@ -1852,7 +1852,7 @@ export const Command_todos_complete: ReplicaCommandArtifact<Command_todos_comple
   "protocol": {
     "operation": "sha256:9b8185c835d3308bda308593486767731acaf4b084a7962b4b17e3e2e319922c",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
@@ -2156,7 +2156,7 @@ export const Command_todos_create: ReplicaCommandArtifact<Command_todos_create_I
   "protocol": {
     "operation": "sha256:187e72cd747aaa13ac0362942d73085a5166401f8cc3a188badeb3e7fa50cacb",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
@@ -2368,7 +2368,7 @@ export const Command_todos_purge: ReplicaCommandArtifact<Command_todos_purge_Inp
   "protocol": {
     "operation": "sha256:01875defc418ccf0e607f316baa30d2f9cf8305602976cc5b1ce30cc5078c15e",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
@@ -2646,7 +2646,7 @@ export const Command_todos_rename: ReplicaCommandArtifact<Command_todos_rename_I
   "protocol": {
     "operation": "sha256:a3e8a5ceae1a0f2c33863a4f2bf377a95b79da2157a619eb7823aa845ef681c3",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
@@ -2903,7 +2903,7 @@ export const Command_todos_reopen: ReplicaCommandArtifact<Command_todos_reopen_I
   "protocol": {
     "operation": "sha256:04531ace98fd3ee5e652761abbcb6ebd745d5ff6ed0ad100030f935335c5a35e",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
diff --git a/tests/e2e-ui/ui/src/lib/generated/user/index.ts b/tests/e2e-ui/ui/src/lib/generated/user/index.ts
index d57c86b6..4795ec98 100644
--- a/tests/e2e-ui/ui/src/lib/generated/user/index.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/user/index.ts
@@ -2,6 +2,7 @@
 export * from './commands.js';
 export * from './protocol.js';
 export * from './routes.js';
+export * from './pures.js';
 export * from './operations/blob-games.js';
 export * from './operations/chat-messages.js';
 export * from './operations/todos.js';
diff --git a/tests/e2e-ui/ui/src/lib/generated/user/manifest.json b/tests/e2e-ui/ui/src/lib/generated/user/manifest.json
index 808702d0..81207059 100644
--- a/tests/e2e-ui/ui/src/lib/generated/user/manifest.json
+++ b/tests/e2e-ui/ui/src/lib/generated/user/manifest.json
@@ -14,7 +14,7 @@
       "user"
     ]
   },
-  "schema_fingerprint": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+  "schema_fingerprint": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
   "protocol_fingerprint": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
   "scalar_codecs": {
     "BigInt": "json_number_precision_limited",
diff --git a/tests/e2e-ui/ui/src/lib/generated/user/operations/blob-games.ts b/tests/e2e-ui/ui/src/lib/generated/user/operations/blob-games.ts
index 525a2f04..addd00db 100644
--- a/tests/e2e-ui/ui/src/lib/generated/user/operations/blob-games.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/user/operations/blob-games.ts
@@ -492,7 +492,7 @@ export const Operation_BlobGames: ReplicaOperationArtifact<Operation_BlobGames_D
   ],
   "protocol": {
     "version": 1,
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "kind": "application",
       "name": "e2e-ui",
diff --git a/tests/e2e-ui/ui/src/lib/generated/user/operations/chat-messages.ts b/tests/e2e-ui/ui/src/lib/generated/user/operations/chat-messages.ts
index 2f712ac0..d4e26ce2 100644
--- a/tests/e2e-ui/ui/src/lib/generated/user/operations/chat-messages.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/user/operations/chat-messages.ts
@@ -420,7 +420,7 @@ export const Operation_ChatMessages: ReplicaOperationArtifact<Operation_ChatMess
   ],
   "protocol": {
     "version": 1,
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "kind": "application",
       "name": "e2e-ui",
diff --git a/tests/e2e-ui/ui/src/lib/generated/user/operations/todos.ts b/tests/e2e-ui/ui/src/lib/generated/user/operations/todos.ts
index d2d5da88..4688a5b7 100644
--- a/tests/e2e-ui/ui/src/lib/generated/user/operations/todos.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/user/operations/todos.ts
@@ -311,7 +311,7 @@ export const Operation_Todos: ReplicaOperationArtifact<Operation_Todos_Data, Ope
   ],
   "protocol": {
     "version": 1,
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "kind": "application",
       "name": "e2e-ui",
diff --git a/tests/e2e-ui/ui/src/lib/generated/user/protocol.ts b/tests/e2e-ui/ui/src/lib/generated/user/protocol.ts
index 1a3f2146..7de19985 100644
--- a/tests/e2e-ui/ui/src/lib/generated/user/protocol.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/user/protocol.ts
@@ -5,7 +5,7 @@ import type { ReplicaCommandStatusArtifact } from '@hops-ops/distributed/replica
 export const CLIENT_PROTOCOL = {
 	version: 1,
 	serviceId: "e2e-ui",
-	schemaHash: "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+	schemaHash: "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
 	protocolHash: "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
 	surface: {"kind":"application","name":"e2e-ui","eligible_roles":["admin","user"],"schema_roles":["user"]},
 	trustedPresets: [
@@ -32,7 +32,7 @@ export const COMMAND_STATUS: ReplicaCommandStatusArtifact = {
   "protocol": {
     "operation": "sha256:eb3ce6a8b306d935fc9f3d6f071804ce3ec415d209594c04015fa35b080282ef",
     "protocolHash": "sha256:00fb342f3acb4dc1c1716a43cc3001c748d5f6c500ff831690d820e9e43e2782",
-    "schemaHash": "sha256:40f8b08fb8905bfdf5981a23819fa2c4bfd5df06c0f293fee68acc2050ce2f54",
+    "schemaHash": "sha256:30dee4b8d80a1714b3a97815578f04585cf2c53b115a972a062e0c0a5117f3f1",
     "surface": {
       "eligible_roles": [
         "admin",
diff --git a/tests/e2e-ui/ui/src/lib/generated/user/pures.ts b/tests/e2e-ui/ui/src/lib/generated/user/pures.ts
index 9e1eb34d..5b5fecfb 100644
--- a/tests/e2e-ui/ui/src/lib/generated/user/pures.ts
+++ b/tests/e2e-ui/ui/src/lib/generated/user/pures.ts
@@ -1,7 +1,17 @@
 /** GENERATED by distributed client. Pure functions for projection.pureReduces. */
 
-import { simulateMove as pure_0 } from '../../blob/simulate-move.js';
+import { createWasmJsonPure } from '@hops-ops/distributed/replica';
+
+const pureHost_0 = createWasmJsonPure({
+  load: () => import('../../blob/pkg/blob_wasm.js'),
+  exportName: "blobSimulateMove"
+});
 
 export const PURE_FUNCTIONS = {
-  "blob.simulate_move": pure_0
+  "blob.simulate_move": pureHost_0.pure
 } as const;
+
+/** Instantiate WASM pure hosts (no-op when none / already ready). */
+export async function ensurePureFunctionsReady(): Promise<void> {
+  await pureHost_0.ensureReady();
+}
diff --git a/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts b/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
index 603b3f10..d4ccfea2 100644
--- a/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
+++ b/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
@@ -721,7 +721,7 @@ const games = $derived(
 					file: 'routes/blob/[[gameId]]/+page.svelte',
 					caption: 'Thin input; ensure WASM is warm for pure-reduce optimism.',
 					code: `onMount(() => {
-  void ensureBlobWasm();
+  void ensurePureFunctionsReady();
   /* … */
 });
 
@@ -740,10 +740,10 @@ await commands.blob.move({ game_id, direction });
 .field_name("blob_games_move")
 .roles(["user", "admin"])
 .preview_reduce_known_record(
-  CommandProjectionPureReduce::new(
+  CommandProjectionPureReduce::wasm(
     "blob.simulate_move",
-    "blob/simulate-move",
-    "simulateMove",
+    "blob/pkg/blob_wasm",
+    "blobSimulateMove",
     "BlobGames",
   )
   .key_input("game_id", ["game_id"])
@@ -754,14 +754,18 @@ await commands.blob.move({ game_id, direction });
 .guarded(causal_has_user, blob_move::handle)`
 				},
 				{
-					file: 'ui/src/lib/blob/simulate-move.ts',
-					caption: 'Framework WASM host — validation + rules in domain pure.',
-					code: `const host = createWasmJsonPure({
-  load: () => import('./pkg/blob_wasm.js'),
-  exportName: 'blobSimulateMove', // (recordJson, argsJson) → assign JSON
+					file: 'generated/user/pures.ts',
+					caption: 'gen-client hosts WASM — no app TypeScript pure file.',
+					code: `const pureHost_0 = createWasmJsonPure({
+  load: () => import('../../blob/pkg/blob_wasm.js'),
+  exportName: 'blobSimulateMove',
 });
-export const ensureBlobWasm = host.ensureReady;
-export const simulateMove = host.pure;`
+export const PURE_FUNCTIONS = {
+  'blob.simulate_move': pureHost_0.pure,
+} as const;
+export async function ensurePureFunctionsReady() {
+  await pureHost_0.ensureReady();
+}`
 				}
 			]
 		},
diff --git a/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte b/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte
index 9ad32344..2c1e40b2 100644
--- a/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte
+++ b/tests/e2e-ui/ui/src/routes/blob/[[gameId]]/+page.svelte
@@ -5,15 +5,14 @@
 	 * - URL (`/blob` | `/blob/{gameId}`) selects which game is active.
 	 * - Board and history derive from `BlobGames.use()`.
 	 * - Commands are Atomic: thin input (`game_id` + `direction`). Known-row pure
-	 *   optimism runs `blob.simulate_move` via blob-core WASM; Atomic seal is
+	 *   optimism runs `blob.simulate_move` via blob-domain WASM; Atomic seal is
 	 *   still server authority.
 	 */
 	import { onMount } from 'svelte';
 	import { goto } from '$app/navigation';
 	import { page } from '$app/state';
-	import { BlobGames, useCommands } from '$distributed';
+	import { BlobGames, ensurePureFunctionsReady, useCommands } from '$distributed';
 	import { parseBoard, TILE, type Direction } from '$lib/blob/board';
-	import { ensureBlobWasm } from '$lib/blob/simulate-move';
 	import { Button } from '$lib/components/shared/ui';
 	import { AppPage, InlineAlert, PageHeader } from '$lib/components/product';
 	import { HowItsBuilt } from '$lib/components/walkthrough';
@@ -191,8 +190,8 @@
 
 	onMount(() => {
 		hydrated = true;
-		// Ensure blob-domain pure WASM is ready before pure-reduce optimism on move.
-		void ensureBlobWasm().catch(() => {
+		// Warm generated WASM pure hosts (blob.simulate_move) before pure-reduce optimism.
+		void ensurePureFunctionsReady().catch(() => {
 			/* fail-closed pure until reload */
 		});
 		const testWindow = window as Window & {

From 3854b8141589c319ea3af203a6fa951dd121376f Mon Sep 17 00:00:00 2001
From: Patrick Lee Scott <pat@patscott.io>
Date: Thu, 6 Aug 2026 13:47:35 -0500
Subject: [PATCH 6/6] docs(e2e-ui): walkthrough service/host/runner + blob pure
 deep dive

Expand every Service tab with compose, host.run_e2e_host, and e2e-runner
main. Blob commands tab explains pure-reduce reasoning, benefits, gen-client
WASM host, and fail-closed authority; domain tab covers core vs wasm faces.
---
 .../components/walkthrough/HowItsBuilt.svelte |   2 +-
 tests/e2e-ui/ui/src/lib/walkthrough/demos.ts  | 231 +++++++++++++-----
 2 files changed, 169 insertions(+), 64 deletions(-)

diff --git a/tests/e2e-ui/ui/src/lib/components/walkthrough/HowItsBuilt.svelte b/tests/e2e-ui/ui/src/lib/components/walkthrough/HowItsBuilt.svelte
index b074d6f9..2775100e 100644
--- a/tests/e2e-ui/ui/src/lib/components/walkthrough/HowItsBuilt.svelte
+++ b/tests/e2e-ui/ui/src/lib/components/walkthrough/HowItsBuilt.svelte
@@ -68,7 +68,7 @@
 			<h2 id="hib-title-{demo.id}" class="hib-title">How it’s built</h2>
 			<p class="hib-summary">{demo.summary}</p>
 			<p class="hib-path" aria-hidden="true">
-				Browser query → commands → service module → handlers → domain → events
+				Browser query → commands → service / host / runner → handlers → domain → events
 			</p>
 		</div>
 		<button type="button" class="hib-close" onclick={closePanel} aria-label="Close">
diff --git a/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts b/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
index d4ccfea2..4de89a69 100644
--- a/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
+++ b/tests/e2e-ui/ui/src/lib/walkthrough/demos.ts
@@ -1,10 +1,10 @@
-import type { DemoWalkthrough } from './types';
+import type { DemoWalkthrough, WalkthroughSample } from './types';
 
 /**
  * Tab order is browser-first teaching order for every demo:
  * 1. Query / live subscription (+ ReadModel shape + read RBAC)
  * 2. Commands (optimistic cache vs Atomic / pure reduce) (+ write RBAC)
- * 3. Service module (e2e-service: MODULE_ID, routes(), compose into Service)
+ * 3. Service + host + runner (e2e-service modules/compose/host; e2e-runner bin)
  * 4. Command handlers (principal → repo → aggregate → commit)
  * 5. Domain model (plain Rust + macros; blob pure core)
  * 6. Domain events + projections
@@ -13,6 +13,12 @@ import type { DemoWalkthrough } from './types';
  * Query tabs should include the read model definition (#[derive(ReadModel)] struct), not only
  * permissions snippets or GraphQL selection.
  *
+ * Service tab should always show:
+ * - this demo’s modules/*.rs slice (MODULE_ID + routes)
+ * - compose.build_service (how modules join one Service)
+ * - host.run_e2e_host (dialect, bus, workers, GraphQL serve)
+ * - runner main (thin env → host)
+ *
  * Consistency teaching (same mutation IR; apply site differs):
  * - Eventual (placement + command): event handler applies IR async → client
  *   auto-optimism previews until obligations complete (no response row).
@@ -22,6 +28,49 @@ import type { DemoWalkthrough } from './types';
  *   Atomic seal remains server authority.
  */
 
+/** Shared host/runner samples — same process story on every demo’s Service tab. */
+const hostAndRunnerSamples: WalkthroughSample[] = [
+	{
+		file: 'e2e-service · host.rs · run_e2e_host',
+		caption: 'Service crate owns process bootstrap: DB dialect, bus, outbox/consumer workers, GraphQL + OIDC serve.',
+		code: `// host.rs — library API used by the runner binary
+pub async fn run_e2e_host(
+  database_url: &str,
+  options: HostOptions, // bind + IdentityConfig
+) -> Result<(), Box<dyn Error + Send + Sync>> {
+  // connect SQLite or Postgres, bootstrap tables, open bus
+  let service = build_service(repo, locks, read_models).with_bus(bus);
+  let gql = build_graphql_engine(&repo, &service, identity, Some(change_rx))?;
+  let service = Arc::new(service.try_with_graphql(gql)?);
+
+  spawn_outbox_publish_loop(/* … */);
+  spawn_service_consumer_loop(|| build_service(/* … */).with_bus(bus));
+  // optional Zitadel scrape loop
+
+  serve_with_oidc(service, identity, &options.bind).await
+}`
+	},
+	{
+		file: 'e2e-runner · main.rs',
+		caption: 'Runner is intentionally thin: env → HostOptions → run_e2e_host. No domain, no modules.',
+		code: `// crates/runner — bin e2e-ui
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
+  let database_url = env::var("DATABASE_URL")
+    .unwrap_or_else(|_| "sqlite:./e2e-ui.db?mode=rwc".into());
+  let bind = env::var("BIND").unwrap_or_else(|_| "127.0.0.1:8791".into());
+  run_e2e_host(
+    &database_url,
+    HostOptions {
+      bind,
+      identity: identity_from_env(), // OidcBearer or DevHeaders
+    },
+  )
+  .await
+}`
+	}
+];
+
 export const todosWalkthrough: DemoWalkthrough = {
 	id: 'todos',
 	href: '/todos',
@@ -137,23 +186,19 @@ await commands.todo.complete({ todo_id });`
 		},
 		{
 			id: 'service',
-			label: '3 · Service module',
-			lede: 'e2e-service is the application crate. The todo module is one bounded-context slice: MODULE_ID, Routes::for_aggregate, command mounts, and the modeled projector. Domain rules stay in todo-domain; GraphQL surfaces and runners live elsewhere.',
-			principle: 'Bounded contexts show up as modules on one Service.',
+			label: '3 · Service + host',
+			lede: 'e2e-service is the application crate: modules mount commands, compose builds one Service, host boots dialect/bus/workers/GraphQL. e2e-runner is a thin binary that only reads env and calls run_e2e_host. Domain stays in todo-domain.',
+			principle: 'Modules compose; host runs the process; runner stays thin.',
 			samples: [
 				{
 					file: 'modules/todo.rs · MODULE_ID + routes()',
-					caption: 'One module = Todo aggregate inventory + projector attach point.',
+					caption: 'This demo’s slice: Todo aggregate inventory + Eventual projector.',
 					code: `pub const MODULE_ID: &str = "todo";
 
-pub fn routes<R, L, S>(
-  repo: R,
-  locks: L,
-  read_models: S,
-  todo_projector: SurfaceProjector,
-) -> TodoRoutes<R, L, S> {
+pub fn routes<R, L, S>(...) -> TodoRoutes<R, L, S> {
   Routes::for_aggregate::<R, L, Todo, S>(repo, locks, read_models)
     .command_transition::</* Create */>(todo_create::COMMAND)
+    .guarded(causal_has_user, todo_create::handle)
     // … rename, complete, reopen, archive, force_archive, purge …
     .modeled_projector(todo_projector)
     .handle(handlers::events::project_todos::handle)
@@ -161,7 +206,7 @@ pub fn routes<R, L, S>(
 				},
 				{
 					file: 'modules/compose.rs · build_service',
-					caption: 'compose lists modules; host/runner starts the binary.',
+					caption: 'Review-visible composition: list modules, do not invent infrastructure.',
 					code: `let todos = todo::routes(repo.clone(), locks.clone(), read_models.clone(), projections.todo);
 let chat = chat::routes(/* … */);
 let blob = blob::routes(/* … */);
@@ -172,7 +217,15 @@ Service::new()
   .routes(todos)
   .routes(chat)
   .routes(blob)`
-				}
+				},
+				{
+					file: 'application.rs · inventory',
+					caption: 'Surface names + module inventory live at the service composition root.',
+					code: `pub const E2E_UI_APPLICATION: &str = "e2e-ui";
+pub const E2E_UI_MODULE_IDS: &[&str] = compose::MODULE_IDS;
+// todo | chat | blob | identity`
+				},
+				...hostAndRunnerSamples
 			]
 		},
 		{
@@ -450,13 +503,13 @@ export type GeneratedCommands = Readonly<Record<never, never>>;`
 		},
 		{
 			id: 'service',
-			label: '3 · Service module',
-			lede: 'The chat module in e2e-service mounts lobby commands and also hosts identity ingress (Zitadel Action + scrape) plus chat/auth projectors. One module file is the review surface for “how chat joins the Service.”',
-			principle: 'Bounded contexts show up as modules on one Service.',
+			label: '3 · Service + host',
+			lede: 'The chat module mounts lobby posts and identity ingress (Zitadel Action + scrape) plus chat/auth projectors. compose folds that Routes inventory into one Service; host boots the process; runner only wires env.',
+			principle: 'Modules compose; host runs the process; runner stays thin.',
 			samples: [
 				{
 					file: 'modules/chat.rs · routes()',
-					caption: 'ChatMessage commands + Zitadel extension commands + projectors.',
+					caption: 'This demo’s slice: ChatMessage commands + Zitadel extensions + projectors.',
 					code: `pub const MODULE_ID: &str = "chat";
 
 pub fn routes<R, L, S>(...) -> ChatRoutes<R, L, S> {
@@ -473,15 +526,20 @@ pub fn routes<R, L, S>(...) -> ChatRoutes<R, L, S> {
 }`
 				},
 				{
-					file: 'modules/compose.rs · MODULE_IDS',
+					file: 'modules/compose.rs · MODULE_IDS + build_service',
 					caption: 'Inventory is explicit — todo, chat, blob, identity.',
 					code: `pub const MODULE_IDS: &[&str] = &[
-  todo::MODULE_ID,
-  chat::MODULE_ID,
-  blob::MODULE_ID,
-  "identity",
-];`
-				}
+  todo::MODULE_ID, chat::MODULE_ID, blob::MODULE_ID, "identity",
+];
+
+Service::new()
+  .named("e2e-ui")
+  .without_http_command_routes()
+  .routes(todo::routes(/* … */))
+  .routes(chat::routes(/* … */))  // ← this module
+  .routes(blob::routes(/* … */))`
+				},
+				...hostAndRunnerSamples
 			]
 		},
 		{
@@ -647,7 +705,7 @@ export const blobWalkthrough: DemoWalkthrough = {
 	title: 'Blob game',
 	kicker: 'Browser → pure optimism → Atomic seal',
 	summary:
-		'One @load query owns the board. Moves are Atomic with thin input. Known-row pure reduce runs blob-domain board rules in WASM so the cache can paint immediately; the handler still runs the same pure, stages the row, and the sealed response remains authority.',
+		'One @load query owns the board. Moves are Atomic with thin input (game_id + direction). Because the next board is a pure function of the known row + direction, the service declares a pure reduce: the client runs blob-domain rules in WASM to paint immediately, then the handler runs the same pure, stages the row, and Atomic seals authority. No hand-written TypeScript rules; gen-client hosts the WASM pure.',
 	tabs: [
 		{
 			id: 'query',
@@ -713,25 +771,33 @@ const games = $derived(
 		},
 		{
 			id: 'commands',
-			label: '2 · Commands',
-			lede: 'Moves are Atomic: send only game_id + direction. The service declares a pure reduce over the known BlobGames row so the client can paint the next board without inventing a second ruleset. Session admission is a mount guard; the sealed Atomic row remains authority.',
-			principle: 'One pure for board rules — server and client share the domain core.',
+			label: '2 · Commands + pure',
+			lede: 'Why a pure? Auto-optimism from input alone cannot invent the next map — that needs the known board. A pure reduce is the contract for “given this cached row + direction, compute assign fields.” Benefits: one ruleset (domain core), no TS twin to drift, fail-closed paint (null → keep old board), and Atomic still seals truth. Costs: need the row in cache and WASM warm; wrong pure would thrash — so WASM is the same Rust pure the aggregate uses.',
+			principle: 'Predict from known truth with the same pure the server runs — never invent authority.',
 			samples: [
+				{
+					file: 'Why pure reduce (not only Atomic seal)',
+					caption: 'Input-only optimism cannot compute map_json. Known-row pure can.',
+					code: `// Without pure: UI waits for Atomic body → feels laggy / blank.
+// With pure:  known BlobGames row + direction → simulate_move → patch
+//             map_json, score, player_dead, status immediately.
+// On seal:    Atomic response overwrites with server row (same pure path).
+// On miss:    pure returns null → no invent (fail closed).`
+				},
 				{
 					file: 'routes/blob/[[gameId]]/+page.svelte',
-					caption: 'Thin input; ensure WASM is warm for pure-reduce optimism.',
+					caption: 'Thin input; warm generated pure hosts before first move.',
 					code: `onMount(() => {
-  void ensurePureFunctionsReady();
-  /* … */
+  void ensurePureFunctionsReady(); // generated/user/pures.ts
 });
 
 await commands.blob.move({ game_id, direction });
-// pure may patch map_json/score/… immediately from known row;
+// pure may patch map_json/score/… from known row;
 // Atomic seal confirms or corrects`
 				},
 				{
-					file: 'modules/blob.rs · blob.move',
-					caption: 'Atomic + pure reduce + session guard. No hand-written TS board twin.',
+					file: 'modules/blob.rs · declare the pure',
+					caption: 'Service contract: which pure, WASM package, keys/args/assign.',
 					code: `.command_transition::<
   domain_commands::MoveDir,
   BlobMoveInput,
@@ -741,9 +807,9 @@ await commands.blob.move({ game_id, direction });
 .roles(["user", "admin"])
 .preview_reduce_known_record(
   CommandProjectionPureReduce::wasm(
-    "blob.simulate_move",
-    "blob/pkg/blob_wasm",
-    "blobSimulateMove",
+    "blob.simulate_move",       // pure id → pureFunctions key
+    "blob/pkg/blob_wasm",       // $lib wasm-pack package
+    "blobSimulateMove",         // WASM export (recordJson, argsJson)
     "BlobGames",
   )
   .key_input("game_id", ["game_id"])
@@ -755,7 +821,7 @@ await commands.blob.move({ game_id, direction });
 				},
 				{
 					file: 'generated/user/pures.ts',
-					caption: 'gen-client hosts WASM — no app TypeScript pure file.',
+					caption: 'gen-client hosts WASM — no app TypeScript pure/sim file.',
 					code: `const pureHost_0 = createWasmJsonPure({
   load: () => import('../../blob/pkg/blob_wasm.js'),
   exportName: 'blobSimulateMove',
@@ -766,18 +832,29 @@ export const PURE_FUNCTIONS = {
 export async function ensurePureFunctionsReady() {
   await pureHost_0.ensureReady();
 }`
+				},
+				{
+					file: 'Runtime shape (framework)',
+					caption: 'Replica pure is always (record, args) → assign fields | null.',
+					code: `// createWasmJsonPure JSON-roundtrips to WASM:
+//   pure(record, args) {
+//     return JSON.parse(wasm.blobSimulateMove(
+//       JSON.stringify(record), JSON.stringify(args)
+//     )) ?? null;
+//   }
+// Validation (direction, map parse, edge) lives in the domain pure.`
 				}
 			]
 		},
 		{
 			id: 'service',
-			label: '3 · Service module',
-			lede: 'The blob module in e2e-service is only Atomic command mounts for BlobGame — no projector loop for the board (direct placement seals in the handler). compose() still lists MODULE_ID next to todo and chat.',
-			principle: 'Bounded contexts show up as modules on one Service.',
+			label: '3 · Service + host',
+			lede: 'The blob module only mounts Atomic BlobGame commands (direct seal in the handler — no async board projector). compose adds that Routes inventory to the same Service as todos/chat; host runs the process; runner is env-only.',
+			principle: 'Modules compose; host runs the process; runner stays thin.',
 			samples: [
 				{
 					file: 'modules/blob.rs · MODULE_ID + routes()',
-					caption: 'start / move / start_level — all Atomic, all guarded.',
+					caption: 'This demo’s slice: start / move / start_level — Atomic, guarded, pure on move.',
 					code: `pub const MODULE_ID: &str = "blob";
 
 pub fn routes<R, L, S>(...) -> BlobRoutes<R, L, S> {
@@ -785,7 +862,7 @@ pub fn routes<R, L, S>(...) -> BlobRoutes<R, L, S> {
     .command_transition::</* StartWithMap */>(blob_start::COMMAND)
     .guarded(causal_has_user, blob_start::handle)
     .command_transition::</* MoveDir */>(blob_move::COMMAND)
-    .preview_reduce_known_record(/* blob.simulate_move */)
+    .preview_reduce_known_record(/* wasm pure blob.simulate_move */)
     .guarded(causal_has_user, blob_move::handle)
     .command_transition::</* StartLevel */>(blob_start_level::COMMAND)
     .guarded(causal_has_user, blob_start_level::handle)
@@ -801,14 +878,15 @@ Service::new()
   .without_http_command_routes()
   .routes(todos)
   .routes(chat)
-  .routes(blob)`
-				}
+  .routes(blob)  // ← this module`
+				},
+				...hostAndRunnerSamples
 			]
 		},
 		{
 			id: 'handlers',
 			label: '4 · Handlers',
-			lede: 'Get aggregate, domain move (which calls the same pure as WASM), stage the mutation-derived row, commit Atomic — one transaction for aggregate, ledger, and query row. Input parse stays here; session admission already ran on the guard.',
+			lede: 'Get aggregate, domain move (same pure as WASM under the hood), stage the mutation-derived row, commit Atomic — one transaction for aggregate, ledger, and query row. Input parse stays here; session admission already ran on the guard. The pure does not replace this path — it only predicts the row for the UI.',
 			principle: 'Commands change the world; tables are for reading.',
 			samples: [
 				{
@@ -830,6 +908,7 @@ Service::new()
     .get(&input.game_id)
     .await?
     .ok_or_else(|| HandlerError::NotFound(input.game_id.clone()))?;
+  // move_dir → core::simulate_move (same pure as client WASM)
   game.move_dir(&owner, dir).map_err(rejected)?;
 
   let row = save_blob_game()
@@ -838,20 +917,20 @@ Service::new()
   repo.readmodel(row)
     .publish_events()
     .commit(game)?
-    .atomic()
+    .atomic()  // sealed row → replica authority
 }`
 				}
 			]
 		},
 		{
 			id: 'domain',
-			label: '5 · Domain',
-			lede: 'One blob-domain crate: core is pure board rules (WASM-eligible); models is the sourced aggregate (feature domain). move_dir calls core::simulate_move — the same function the client WASM exports.',
-			principle: 'Start with the domain, not the database.',
+			label: '5 · Domain + pure core',
+			lede: 'One blob-domain crate, two faces: core (pure board rules, WASM-eligible) and models (sourced aggregate, feature domain). The pure is intentionally free of ownership and Entity — those stay on the aggregate. Client and server share core so optimism cannot drift from seal.',
+			principle: 'Start with the domain, not the database — and share the pure, not a twin.',
 			samples: [
 				{
 					file: 'blob-domain/src/core · simulate_move',
-					caption: 'Pure map + score + direction → next board. No Entity, no ownership.',
+					caption: 'Pure map + score + direction → next board. No Entity, no ownership, no I/O.',
 					code: `pub fn simulate_move(
   map: &[Vec<u8>],
   score: i64,
@@ -882,11 +961,22 @@ Service::new()
 }`
 				},
 				{
-					file: 'blob-domain · features',
-					caption: 'Server uses domain; client pure uses wasm.',
+					file: 'blob-domain · wasm export',
+					caption: 'WASM adapter: record+args JSON in, assign JSON out (validation inside).',
+					code: `#[wasm_bindgen(js_name = blobSimulateMove)]
+pub fn blob_simulate_move(record_json: &str, args_json: &str)
+  -> Option<String>
+{
+  // parse map_json / score / direction → simulate_move → assign fields
+  // None = fail closed (illegal move or bad input)
+}`
+				},
+				{
+					file: 'blob-domain · features + make wasm',
+					caption: 'Server: default domain. Client pure: --features wasm.',
 					code: `// Cargo.toml
 // default = ["domain"]  → aggregate + levels + distributed
-// wasm                 → blobSimulateMove export (make wasm)`
+// wasm                 → blobSimulateMove (make wasm → $lib/blob/pkg)`
 				}
 			]
 		},
@@ -1045,13 +1135,13 @@ pub struct Todos {
 		},
 		{
 			id: 'service',
-			label: '3 · Service module',
-			lede: 'Admin is not a second service binary — it is a second GraphQL surface (e2e-ui-admin) over the same e2e-service. Force-archive is mounted once in modules/todo.rs; only the admin client inventory includes it.',
-			principle: 'Roles and surfaces are real; modules stay shared.',
+			label: '3 · Service + host',
+			lede: 'Admin is not a second binary — it is a second GraphQL surface (e2e-ui-admin) over the same e2e-service host/runner. Force-archive is mounted once in modules/todo.rs; only the admin client inventory includes it. Same compose, host, and runner as user demos.',
+			principle: 'Roles and surfaces are real; modules and host stay shared.',
 			samples: [
 				{
 					file: 'modules/todo.rs · force_archive mount',
-					caption: 'Same module that serves /todos — elevated field on the same Routes inventory.',
+					caption: 'Same todo module that serves /todos — elevated field on the same Routes inventory.',
 					code: `.command_transition::<
   domain_commands::ForceArchive,
   /* … */,
@@ -1070,7 +1160,15 @@ pub struct Todos {
 )
 .client_application_surface("e2e-ui-admin", ["admin"])
 .client_application_surface("e2e-ui-public", ["anonymous"])`
-				}
+				},
+				{
+					file: 'application.rs · surface constants',
+					caption: 'Stable surface names used by gen-client and host identity.',
+					code: `pub const DISTRIBUTED_CLIENT_SURFACE: &str = "e2e-ui";
+pub const DISTRIBUTED_ADMIN_CLIENT_SURFACE: &str = "e2e-ui-admin";
+pub const DISTRIBUTED_PUBLIC_CLIENT_SURFACE: &str = "e2e-ui-public";`
+				},
+				...hostAndRunnerSamples
 			]
 		},
 		{
@@ -1347,8 +1445,8 @@ IdentityConfig::oidc_bearer(oidc)`
 		},
 		{
 			id: 'service',
-			label: '5 · Service module',
-			lede: 'Identity is not a domain aggregate in e2e-service — it is service-crate wiring: OIDC/dev headers, claim maps, and the chat module’s Zitadel ingress that fills AuthUsers. MODULE_IDS still lists "identity" next to todo/chat/blob.',
+			label: '5 · Service + host',
+			lede: 'Identity is not a domain aggregate — it is service-crate wiring: OIDC/dev headers, claim maps, and the chat module’s Zitadel ingress that fills AuthUsers. The host boots that Service and starts scrape/outbox/consumer loops; the runner only supplies DATABASE_URL / BIND / OIDC env.',
 			principle: 'Transport identity, compose modules, keep domains pure.',
 			samples: [
 				{
@@ -1370,7 +1468,14 @@ IdentityConfig::oidc_bearer(oidc)`
 .guarded(zitadel_scrape::guard, zitadel_scrape::handle)
 .events(project_auth_user::EVENTS)
 .guarded(project_auth_user::guard, project_auth_user::handle)`
-				}
+				},
+				{
+					file: 'modules/graphql.rs · identity_from_env',
+					caption: 'Host picks OidcBearer vs DevHeaders from env — same binary either way.',
+					code: `// identity_from_env() → OIDC_ISSUER/AUDIENCE/JWKS or DevHeaders
+// serve_with_oidc(service, identity, bind)`
+				},
+				...hostAndRunnerSamples
 			]
 		},
 		{