From eaa5479b42858402a78cd85bb514fcba2f82d108 Mon Sep 17 00:00:00 2001
From: slhx agent <slhx@users.noreply.github.com>
Date: Mon, 1 Jun 2026 23:55:31 +0200
Subject: [PATCH] test(examples): forbid low-level resource plumbing

Lock canonical examples to generated resource APIs instead of raw ids, OUT_DIR includes, global exports, or low-level runtime/plumbing types.

req: dx/002

req: ceremony/002

req: ceremony/004

req: examples/003
---
 slhx-test/tests/examples_contract.rs | 45 ++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/slhx-test/tests/examples_contract.rs b/slhx-test/tests/examples_contract.rs
index 13dae46..e356bf0 100644
--- a/slhx-test/tests/examples_contract.rs
+++ b/slhx-test/tests/examples_contract.rs
@@ -39,6 +39,51 @@ fn canonical_examples_do_not_author_browser_javascript() {
     assert!(failures.is_empty(), "{}", failures.join("\n"));
 }
 
+#[test]
+fn canonical_examples_do_not_author_low_level_resource_plumbing() {
+    // req: dx/002 req: ceremony/002 req: ceremony/004 req: examples/003
+    let root = Path::new(env!("CARGO_MANIFEST_DIR")).parent().unwrap();
+    let examples = root.join("examples");
+    let forbidden = [
+        "ResourceId::new",
+        ".id().id",
+        "include!(concat!",
+        "OUT_DIR",
+        "global_exports(",
+        "EffectWriter",
+        "RuntimeOpcode",
+        "data-hid",
+        "data-sid",
+        "data-fid",
+        "data-aid",
+        "data-handle-id",
+        "data-slot-id",
+        "data-form-id",
+        "data-atom-id",
+    ];
+    let mut failures = Vec::new();
+    scan_examples(&examples, &mut |path, text| {
+        if path.components().any(|part| part.as_os_str() == "tests") {
+            return;
+        }
+        if path.extension().and_then(|ext| ext.to_str()) != Some("rs") {
+            return;
+        }
+        let runtime_source = text.split("#[cfg(test)]").next().unwrap_or(text);
+        for (line_no, line) in runtime_source.lines().enumerate() {
+            if let Some(token) = forbidden.iter().find(|token| line.contains(*token)) {
+                failures.push(format!(
+                    "{}:{}: example runtime code must use generated resources, not `{token}`",
+                    path.display(),
+                    line_no + 1
+                ));
+            }
+        }
+    });
+
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}
+
 #[test]
 fn browser_e2e_does_not_shortcut_product_interactions() {
     // req: examples/005