@@ -1069,13 +1069,14 @@ jobs:
         working-directory: tests/ios-app-consumer
         run: MCPP="$MCPP" ./check-ios-plan.sh
 
-      # dist-web (#622 B3), end to end, worked around one engine defect --
-      # see `tests/web-consumer/check-web-plan.sh`'s own header for the
-      # measured cause (every `build.mcpp` fails to compile under `--target
-      # wasm32-emscripten` on this engine floor) and exactly what is real
-      # versus simulated in what follows. `mcpp toolchain install` first,
-      # because this job's `~/.mcpp` cache does not carry the emsdk payload
-      # the way the local sandbox this member was developed against does.
+      # dist-web (#622 B3), end to end, the real `mcpp pack --format web
+      # --target wasm32-emscripten` -- see `tests/web-consumer/
+      # check-web-plan.sh`'s own header for the host-toolchain defect this
+      # needed fixed first (mcpp commit 23974c5e, #622 e2e 657) and the
+      # MCPP_VERSION this step therefore needs at least. `mcpp toolchain
+      # install` first, because this job's `~/.mcpp` cache does not carry
+      # the emsdk payload the way the local sandbox this member was
+      # developed against does.
       - name: Install the emsdk payload for dist-web
         run: "$MCPP" toolchain install emsdk 6.0.9
 
 
@@ -22,6 +22,23 @@
 // no use for, and to write the one file neither the link nor `mcpp::deploy`
 // produces: a page that loads the script.
 //
+// A DEPLOY'D FILE'S RELATIVE PATH IS TAKEN FROM THE STAGED TREE, AND NOT
+// RECOMPUTED FROM `to`, ON PURPOSE. `mcpp::deploy(from, to)`'s `to` names a
+// DIRECTORY, executable-relative -- `types.cppm`'s own `DeployEntry` comment
+// ("a file placed in a directory relative to the executable") and the design
+// record's own criterion (`to = "myapp.resources/huxerui"` with `from =
+// ".../resources.bin"` lands at `bin/myapp.resources/huxerui/resources.bin`,
+// keeping `from`'s own basename) -- so a caller who passes a full destination
+// FILE path as `to` (as `tests/web-consumer/build.mcpp` once did, by mistake)
+// gets exactly that: the file deployed INTO a directory of that name,
+// nested under its own basename a second time. This member has no accessor
+// for a deploy directive's `to` and cannot see that mistake from here; what
+// it CAN do, and does, is mirror the staged tree's actual relative paths
+// faithfully rather than reconstructing them from a rule it would then have
+// to get right twice. A caller's `to` is therefore the whole of the
+// contract, and this member's own fixture is the worked example of getting
+// it right: `to = "assets"`, not `to = "assets/greeting.txt"`.
+//
 // REFUSED BY NAME ON EVERY OTHER TARGET, deliberately, and not merely
 // because no other row happens to produce a `.js` launcher: `--format web`
 // on an ELF or Mach-O row would otherwise silently ship a native binary
 
@@ -5,13 +5,22 @@ import mcpp.dist.web;
 int main() {
     // A file this build program itself produces, deployed beside the
     // launcher (#622 A4) so the fixture's own listing check has something
-    // past the stem family to find. `mcpp::deploy`'s `to` is
-    // executable-relative on every format; on this one that is `bin/`, and
-    // `mcpp.dist.web` maps it to the same relative path at the web
-    // directory's root (see dist/web.cppm's header comment).
+    // past the stem family to find. `mcpp::deploy`'s `to` NAMES A
+    // DIRECTORY, executable-relative -- the same rule `[[runtime.deploy]]`
+    // enforces (`types.cppm`'s own `DeployEntry` comment: "a file placed in
+    // a directory relative to the executable"), and the design record's own
+    // criterion for this directive: `to = "myapp.resources/huxerui"` with
+    // `from = ".../resources.bin"` lands at
+    // `bin/myapp.resources/huxerui/resources.bin`, keeping `from`'s own
+    // basename rather than being renamed to `to`'s last component. So `to`
+    // here is `"assets"`, not `"assets/greeting.txt"` -- the latter would
+    // deploy the file INTO a directory literally named `greeting.txt`,
+    // landing it at `bin/assets/greeting.txt/greeting.txt`, which is what an
+    // earlier revision of this fixture did and what first exposed the
+    // shape of this rule.
     std::string generated = std::string(mcpp::out_dir()) + "/greeting.txt";
     if (std::ofstream out(generated); out) out << "hello from build.mcpp\n";
-    mcpp::deploy(generated.c_str(), "assets/greeting.txt");
+    mcpp::deploy(generated.c_str(), "assets");
 
     mcpp::dist::web::options opt;
     opt.target = "web-consumer";
 
@@ -1,134 +1,43 @@
 #!/usr/bin/env bash
-# End-to-end check for `dist-web` (#622 B3), worked around one engine defect.
+# End-to-end check for `dist-web` (#622 B3): the one-command form.
 #
-# THE INTENDED FORM IS ONE COMMAND, AND IT IS NOT WHAT THIS SCRIPT RUNS:
+#   mcpp pack --format web --target wasm32-emscripten
 #
-#   mcpp pack --target wasm32-emscripten --format web
+# An earlier revision of this script worked around a host-toolchain defect
+# that made every `build.mcpp` -- not only this member's -- fail to compile
+# under `--target wasm32-emscripten` (prepare.cppm's `host_tc_for_build_program`
+# resolved the row's own default pin as if it were a host-native compiler).
+# That is fixed (mcpp commit 23974c5e, "a build program under a target row's
+# pin resolves the host's compiler, not the row's", #622 e2e 657), so this
+# script now runs the real command directly and asserts its real output.
 #
-# On the engine this member was developed and reviewed against
-# (mcpp 2026.9.12.2, built from `feat/622-ui-framework-on-three-rows`),
-# EVERY `build.mcpp` -- not only this member's -- fails to compile under
-# `--target wasm32-emscripten`:
-#
-#   error: build.mcpp failed to compile (exit 1):
-#   ... AssertionError (emcc.py, compile_source_file, phase_compile_inputs)
-#
-# Measured cause: `prepare.cppm`'s `host_tc_for_build_program` resolves the
-# HOST toolchain for `build.mcpp` from the closure-captured `tcSpec`, read
-# LAZILY at the point a `build.mcpp` is found to exist -- but the row's own
-# default toolchain pin (`tcSpec = targetPinCandidate;`, prepare.cppm
-# around line 7233, the same assignment the "target default for
-# wasm32-emscripten, replacing your gcc@16.1.0" message reports) has ALREADY
-# overwritten that variable by the time this runs, for every target whose
-# row carries one. `em++` cannot compile a host-native binary under any
-# invocation, so `build.mcpp` is asked to compile itself with a compiler
-# that structurally cannot produce a program the host can run: this is not
-# specific to `dist-web`, `mcpp.plugins`, or this fixture -- a project whose
-# ENTIRE `build.mcpp` is `import std; int main(){}` fails identically.
-# `riscv64`/Android rows are not obviously affected, because their default
-# pins are cross-CONFIGURATIONS of a compiler family (gcc, clang) that also
-# has a native mode; `emsdk`'s em++ has none. Reported rather than worked
-# around in the engine: see this task's final report for the full
-# repro and the suggested fix site.
-#
-# WHAT THIS SCRIPT MEASURES INSTEAD, split across the one seam the defect
-# does not reach:
-#
-#   1. A REAL wasm32-emscripten build, of the SAME `src/main.cpp`, through a
-#      throwaway package with NO `build.mcpp` at all -- unaffected, because
-#      the defect is specific to a build.mcpp existing. `mcpp pack --format
-#      dir` stages the real `.js`/`.wasm` pair the emsdk payload produced.
-#   2. This fixture's OWN `build.mcpp`, compiled for the HOST (an ordinary
-#      `mcpp build`, no `--target`) -- also unaffected, because the defect
-#      is specific to a CROSS target. This compiles to an ordinary ELF at
-#      `target/.build-mcpp/build.mcpp.bin`.
-#   3. That compiled binary, run DIRECTLY (bypassing mcpp's own
-#      orchestration) with the environment contract `--target
-#      wasm32-emscripten --format web` would have set -- `mcpp::target_os()`
-#      and its siblings are `std::getenv` and nothing else
-#      (`hostprogram.cppm`), so this exercises exactly the code `plan_for`
-#      and `submit` run, against the REAL staged tree from step 1 plus one
-#      hand-placed file standing in for `mcpp::deploy` (which, like every
-#      `build.mcpp` directive, needs the orchestrator this defect removes).
-#   4. Every `mcpp:action=` line step 3 printed, parsed with `jq` and
-#      EXECUTED by this script -- standing in for ninja, which never ran.
-#
-# The resulting `target/web/` directory, and the fact that `node` runs the
-# `.js` inside it and prints `1-2-3`, are real; only the orchestration that
-# would normally produce them is simulated here.
-#
-# Usage: MCPP=<fresh mcpp> ./check-web-plan.sh   (run from this directory)
+# Usage: MCPP=<mcpp with the 23974c5e fix> ./check-web-plan.sh   (run from
+# this directory)
 set -e
 
 MCPP="${MCPP:-mcpp}"
-HERE="$PWD"
 fail() { echo "FAIL: $1"; shift; for f in "$@"; do echo "--- $f ---"; cat "$f" 2>/dev/null; done; exit 1; }
 
-command -v jq >/dev/null || fail "jq is required to parse the planned mcpp:action= lines" /dev/null
 command -v node >/dev/null || fail "node is required to run the produced launcher" /dev/null
 
-echo "== step 1: a real wasm32-emscripten build, with no build.mcpp =="
-REALDIR=$(mktemp -d)
-mkdir -p "$REALDIR/src"
-cat > "$REALDIR/mcpp.toml" <<EOF
-[package]
-name    = "web-consumer"
-version = "0.1.0"
-
-[targets.web-consumer]
-kind = "bin"
-main = "src/main.cpp"
-EOF
-cp src/main.cpp "$REALDIR/src/main.cpp"
-( cd "$REALDIR" && "$MCPP" pack --target wasm32-emscripten --format dir > pack.log 2>&1 ) \
-    || fail "the real wasm32-emscripten build failed" "$REALDIR/pack.log"
-STAGE=$(find "$REALDIR/target/dist" -maxdepth 1 -type d -name 'web-consumer-*-wasm32-emscripten')
-[ -n "$STAGE" ] || fail "no staged directory from the real build" "$REALDIR/pack.log"
-[ -f "$STAGE/bin/web-consumer.js" ]   || fail "the real build produced no bin/web-consumer.js"
-[ -f "$STAGE/bin/web-consumer.wasm" ] || fail "the real build produced no bin/web-consumer.wasm"
-echo "ok: real bin/web-consumer.js and bin/web-consumer.wasm, from the emsdk payload"
-
-# Stand in for `mcpp::deploy(generated, "assets/greeting.txt")`, which
-# build.mcpp.bin below calls but which nothing here can act on, per this
-# script's header comment.
-mkdir -p "$STAGE/bin/assets"
-printf 'hello from build.mcpp\n' > "$STAGE/bin/assets/greeting.txt"
-
-echo "== step 2: this fixture's build.mcpp, compiled for the HOST =="
 rm -rf target
-"$MCPP" build > build.log 2>&1 || fail "the host build of this fixture failed" build.log
-BIN=target/.build-mcpp/build.mcpp.bin
-[ -x "$BIN" ] || fail "no compiled build.mcpp.bin at $BIN" build.log
-echo "ok: build.mcpp compiled to $BIN"
 
-echo "== step 3: run it directly under the wasm32-emscripten + --format web contract =="
-OUT=$(mktemp -d)
-PLANLOG=$(mktemp)
-env -i PATH="$PATH" \
-    MCPP_PACK_FORMAT=web \
-    MCPP_TARGET_OS=emscripten \
-    MCPP_PACK_STAGE_DIR="$STAGE" \
-    MCPP_PKG_NAME=web-consumer \
-    MCPP_PKG_VERSION=0.1.0 \
-    MCPP_MANIFEST_DIR="$HERE" \
-    MCPP_OUT_DIR="$OUT" \
-    "$BIN" > "$PLANLOG" 2>&1
-grep -q '"id":"mcpp.dist.web.index"' "$PLANLOG" || fail "no index.html action was planned" "$PLANLOG"
-n=$(grep -c '"id":"mcpp.dist.web.file"' "$PLANLOG")
-[ "$n" -eq 3 ] || fail "expected 3 file actions (js, wasm, the deployed asset), got $n" "$PLANLOG"
-echo "ok: 3 file actions and 1 index.html action planned"
+echo "== a plain build has no distribution edge =="
+"$MCPP" build --target wasm32-emscripten > build.log 2>&1 \
+    || fail "mcpp build --target wasm32-emscripten failed" build.log
+if find target -type d -name web | grep -q .; then
+    echo "FAIL: a plain build produced a web/ directory"; exit 1
+fi
+echo "ok: no web/ directory before packaging"
 
-echo "== step 4: execute the planned actions (standing in for ninja) =="
-grep '^mcpp:action=' "$PLANLOG" | sed 's/^mcpp:action=//' | while read -r line; do
-    mapfile -t argv < <(echo "$line" | jq -r '.command[]')
-    for i in "${!argv[@]}"; do
-        argv[$i]="${argv[$i]//\$\{mcpp.stage_dir\}/$STAGE}"
-    done
-    "${argv[@]}"
-done
+echo "== mcpp pack --format web --target wasm32-emscripten =="
+"$MCPP" pack --format web --target wasm32-emscripten > pack.log 2>&1 \
+    || fail "mcpp pack --format web --target wasm32-emscripten failed" pack.log
+WEB=$(find target -type d -name web | head -1)
+[ -n "$WEB" ] || fail "no web/ directory was produced" pack.log
+echo "ok: $WEB"
 
-echo "== assertions on target/web/ =="
-WEB="$OUT/web"
+echo "== the file list is exactly the stem family, the deployed asset, and index.html =="
 mapfile -t files < <(cd "$WEB" && find . -type f | sed 's#^\./##' | sort)
 want=(assets/greeting.txt index.html web-consumer.js web-consumer.wasm)
 [ "${files[*]}" = "${want[*]}" ] || {
@@ -138,15 +47,31 @@ want=(assets/greeting.txt index.html web-consumer.js web-consumer.wasm)
     exit 1; }
 echo "ok: exactly js, wasm, the deployed asset and index.html -- nothing else"
 
+# THE DEPLOYED ASSET LANDS AT ITS STAGED PATH, NOT NESTED UNDER ITSELF.
+# `mcpp::deploy`'s `to` names a DIRECTORY (`assets`), and the file keeps its
+# own basename (`greeting.txt`) -- the same rule `[[runtime.deploy]]` and
+# `types.cppm`'s `DeployEntry` document. A `to` that names the full
+# destination path instead (`"assets/greeting.txt"`) deploys the file INTO a
+# directory of that name, landing it at `bin/assets/greeting.txt/greeting.txt`
+# -- a directory named after itself, holding the real file. Measured on this
+# fixture before `build.mcpp`'s deploy call was corrected. This step asserts
+# both directions: the file is a regular file at exactly its intended
+# relative path, and no such wrapper directory exists.
+[ -f "$WEB/assets/greeting.txt" ] \
+    || fail "assets/greeting.txt is not a regular file at its staged path" pack.log
+[ -d "$WEB/assets/greeting.txt" ] \
+    && fail "assets/greeting.txt is a directory -- the file landed inside a directory named after itself"
+grep -q 'hello from build.mcpp' "$WEB/assets/greeting.txt" \
+    || fail "the deployed asset's content did not survive the copy" "$WEB/assets/greeting.txt"
+echo "ok: assets/greeting.txt is the file, at exactly its staged relative path"
+
 grep -q 'web-consumer.js' "$WEB/index.html" || fail "index.html does not load the launcher" "$WEB/index.html"
 grep -q '<title>web-consumer</title>' "$WEB/index.html" || fail "index.html's title is not the package name" "$WEB/index.html"
 echo "ok: index.html loads the launcher and titles the page from [package] name"
 
-grep -q 'hello from build.mcpp' "$WEB/assets/greeting.txt" || fail "the deployed asset's content did not survive the copy" "$WEB/assets/greeting.txt"
-
 out=$(node "$WEB/web-consumer.js")
 [ "$out" = "1-2-3" ] || fail "node did not print 1-2-3 (got: $out)"
 echo "ok: node $WEB/web-consumer.js prints 1-2-3"
 
-rm -rf "$REALDIR" "$OUT" "$PLANLOG"
+rm -f build.log pack.log
 echo "PASS: dist-web produces a static directory, node runs it, 1-2-3"