# Hotfix10 / Build Fix 44 Trusted Runtime Template Packaging Correction

- Release: **R14.28.20 Build Fix 44 / Hotfix10**
- Date: 2026-08-23

## Production failure reproduced

Build Fix 43 passed dependency installation, custom validation, strict TypeScript, Biome, BusyTeX provisioning, the complete static release audit and the production Vite build. Activation then failed when `texise.service` started the staged trusted runtime:

`ERR_MODULE_NOT_FOUND: .../texise-data/runtime/current/scripts/generate-template-manifest.mjs`

`server/template-library.mjs` imported a build-tree script using `../scripts/...`, but trusted runtime activation deliberately staged only `server/` plus its pinned runtime dependencies.

## Correction

Build Fix 44 makes the template manifest implementation part of the trusted server module graph:

- reusable template manifest logic now lives in `server/template-manifest.mjs`;
- `scripts/generate-template-manifest.mjs` is a thin build/CLI wrapper and re-export surface;
- `server/template-library.mjs` imports only `./template-manifest.mjs`, so the staged `server/` snapshot is self-contained;
- deployment executes `scripts/check-staged-trusted-runtime.mjs` against the exact staged server tree before activation;
- release metadata carries the canonical template source and live catalog paths into the service environment;
- Admin filesystem operations use `/var/www/texise.com/public_html/texise-templates` while Assets Sync publishes the live catalog into `/var/www/texise.com/public_html/dist/texise-templates`;
- systemd grants the `texise` service account write access only to those two template paths in addition to its existing data/media paths;
- deployment normalizes ownership/modes so Admin template edits and sync can operate under the unprivileged service account;
- deployment health performs a write/read/delete probe under a `ProtectSystem=strict` sandbox for both template paths.

## Stronger source protection

The previous asset-sync implementation mirrored the complete template source tree into the browser public directory and relied on Apache denial rules. BF44 narrows the public catalog further: Assets Sync publishes only `templates.json`, `institutions.json`, and `redirects.json`. The authoritative `free/` and `pro/` source trees are no longer copied into the browser build at all.

This preserves the filesystem-first Admin workflow while reducing the public attack surface.

## Verification contract

BF44 adds regression coverage that:

1. stages the exact `server/` runtime without a sibling `scripts/` directory and imports `template-library.mjs` successfully;
2. confirms staged runtime defaults resolve to deployment-provided source/live catalog paths;
3. proves Assets Sync publishes only safe catalog JSON;
4. verifies installer/upgrade prepare template runtime permissions;
5. verifies the systemd sandbox permits only the required template write paths;
6. verifies production-dist validation rejects accidental `free/` or `pro/` source-tree publication.