docs(requirements): split workout release scope

Split oversized examples/006 into command-surface, generated-helper, and mobile-boundary requirements.

req: examples/006

req: examples/010

req: examples/011

AGENTS.md

@@ -54,7 +54,7 @@ Keep it stable. Prefer pointers to canonical sources over copied structure, file
 - Stable commands: `cargo run -p hemx-xtask -- test`, `cargo run -p hemx-xtask -- html-examples-smoke`, `cargo check --workspace`, `redgate health --strict`. Use the xtask runner for full verification so jobs are capped from local CPU and memory; use the html_examples smoke for focused browser verification of the HTML pattern gallery. req: test/004 req: test/006
 - Example behavior tests should prefer `hemx_test` generated-resource assertions over raw slot constants or raw effect/payload matching. req: test/008
 - Run the workout product exemplar with `cargo run -p hemx-xtask -- workout dev` and open `http://127.0.0.1:3028`; set `HEMX_WORKOUT_ADDR=127.0.0.1:3030` if the default port is busy. Its durable visual direction and recovery expectations live in `examples/workout/DESIGN.md`. req: examples/008
-- Use the same Workout command surface for tests, production build, and mobile release: `cargo run -p hemx-xtask -- workout test`, `cargo run -p hemx-xtask -- workout build`, `HEMX_WORKOUT_ORIGIN=https://workout.example.com cargo run -p hemx-xtask -- workout mobile-release`, and `HEMX_WORKOUT_ORIGIN=https://workout.example.com cargo run -p hemx-xtask -- workout mobile-verify`; Android/iOS SDKs, store submission targets, and signing remain external blockers, not repo-owned secrets. req: examples/006
+- Use the same Workout command surface for tests, production build, and mobile release: `cargo run -p hemx-xtask -- workout test`, `cargo run -p hemx-xtask -- workout build`, `HEMX_WORKOUT_ORIGIN=https://workout.example.com cargo run -p hemx-xtask -- workout mobile-release`, and `HEMX_WORKOUT_ORIGIN=https://workout.example.com cargo run -p hemx-xtask -- workout mobile-verify`; Android/iOS SDKs, store submission targets, and signing remain external blockers, not repo-owned secrets. req: examples/006 req: examples/011
 - hemx core stays small: effects, typed ids, registries, and wire schema only.
 - Routing, auth, sessions, transport, transitions, sync, and storage belong in integration/user crates.
 - Public examples and beginner APIs should use generated resources and `IntoEffect`, not raw ids or runtime opcodes.

README.md

@@ -109,7 +109,7 @@ and integrate at explicit boundaries. req: laws/002 req: auth/001
   integrations around handlers, routes, runtime assets, and mobile shells. Core
   hemx must not vendor providers or add framework-specific magic. See
   `docs/recipes/observability-flags.md`, `docs/recipes/deploy-versioning.md`,
-  and `docs/recipes/mobile-release.md`. req: examples/006
+  and `docs/recipes/mobile-release.md`. req: examples/011
 - **Mobile starter:** create the phone-first path with `cargo run -p
   hemx-xtask -- app new --mobile PATH`. The starter carries a real app flow,
   typed host capabilities, command/event/projection recovery truth, and

REQUIREMENTS.md

@@ -879,7 +879,13 @@ what a valid business email is.
 005	Canonical examples must not contain user-authored browser JavaScript. They may load the shared hemx runtime (`/hemx.js`) and may use declarative `data-hemx-*` attributes; inline `<script>`, `on*=` event handlers, and `javascript:` URLs are forbidden outside opaque leaf-widget examples.
 
 ### req: examples/006
-006	The Workout exemplar must have one boring command surface for local development, product tests, production server build, Android/iOS mobile release metadata, and mobile verification. The common path must use generated helpers instead of manual registry conversion. The mobile commands must make app identity, version, production origin, runtime asset policy, cache/offline state policy, environment/secrets boundary, rollback expectation, and external store-signing/submission blockers explicit without adding a broad `hemx-mobile` framework.
+006	The Workout exemplar must have one boring command surface for local development, product tests, production server build, Android/iOS mobile release metadata, and mobile verification. [north_star]
+
+### req: examples/010
+010	The Workout common path uses generated helpers instead of manual registry conversion. [north_star]
+
+### req: examples/011
+011	Workout mobile commands make app identity, version, production origin, runtime asset policy, cache/offline policy, environment/secrets boundary, rollback expectation, and external store-signing/submission blockers explicit without adding a broad `hemx-mobile` framework. [north_star]
 
 ---
 

docs/recipes/mobile-release.md

@@ -3,7 +3,7 @@
 The Workout exemplar is the production-shaped mobile path for hemx. It stays
 boring on purpose: hemx builds the server app and writes mobile shell metadata;
 Android/iOS SDKs, store signing, provisioning, and submission remain external
-vendor work. req: examples/006
+vendor work. req: examples/011
 
 ## Command surface
 
@@ -26,7 +26,7 @@ host recovery from app-owned command/event/projection truth, and a few explicit
 host capabilities such as share, haptics, clipboard, notifications, or file
 picking. The payoff is fewer moving parts: no client component runtime, no native
 UI abstraction, no plugin marketplace, and no hidden mobile state graph. req:
-ceremony/006 req: examples/006
+ceremony/006 req: examples/011
 
 Do not use hemx mobile as a replacement for apps whose product center is heavy
 native UI, games, deep OS integration, camera-heavy capture/editing, complex

hemx-xtask/src/main.rs

@@ -1626,7 +1626,7 @@ mod tests {
 
     #[test]
     fn workout_mobile_verify_fails_closed_on_non_https_origin() {
-        // req: examples/006
+        // req: examples/011
         let config = workout_mobile_config_at(
             "http://workout.example.com",
             "target/test-workout-mobile-non-https",
@@ -1645,7 +1645,7 @@ mod tests {
 
     #[test]
     fn workout_mobile_verify_accepts_generated_release_kit() {
-        // req: examples/006
+        // req: examples/011
         let config = workout_mobile_config_at(
             "https://workout.example.com",
             "target/test-workout-mobile-accepts",
@@ -1661,7 +1661,7 @@ mod tests {
 
     #[test]
     fn workout_mobile_verify_rejects_unacknowledged_external_blockers() {
-        // req: examples/006
+        // req: examples/011
         let config = workout_mobile_config_at(
             "https://workout.example.com",
             "target/test-workout-mobile-unacknowledged-blockers",
@@ -1688,7 +1688,7 @@ mod tests {
 
     #[test]
     fn workout_mobile_verify_rejects_missing_release_kit() {
-        // req: examples/006
+        // req: examples/011
         let config = workout_mobile_config_at(
             "https://workout.example.com",
             "target/test-workout-mobile-missing",