fix: discover review boundaries in generated applications

[HomenShum]

Summary

A generated NodeKit application already exposes an explicit proposal review boundary, but NodeProof's setup scan missed it because it did not scan apps/public or recognize data-nodekit-review-boundary. Add those roots and that specific marker namespace to existing discovery, while preserving the 800-file budget and dependency/build exclusions. Ordinary IDs and dynamic artifact attributes remain excluded.

Add an adoption guide for an actual application with a pinned local package, real gate commands, persisted failure and fresh-process recovery. Doctor remains configuration discovery, not browser or CI certification.

Validation

• Independent normal install/build and 265 tests across 28 suites pass; all 60 generated dist files match the reviewed source export.
• Eight additional scanner scenarios cover existing namespaces, ordinary-ID exclusion, repeated scans, removal/restoration and the 805-file boundary.
• The installed package's 106 files match the reviewed tarball/source. A real NodeKit 53348d6 consumer passes its documented install/compile/demo/gate sequence, retains an intentional failed check across cached reads and resume, and recovers after exact restoration.
• Actual 390/1440 browser journeys prove the discovered marker is visible and rejection/approval preserve and advance the displayed artifact version respectively. This is not a complete UI grade.

The separate NodeKit consumer still lacks its promised machine-readable artifact identity fields and displays an empty error strip after success. Those inherited template requirements are recorded for upstream repair; this PR does not certify complete consumer interoperability, host activation or production operation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
proofloop	Ready	Preview	Sep 5, 2026 3:11am UTC