@@ -193,9 +193,9 @@ describe("every library manifest fact is resolved against the thing it claims",
     // pattern that silently stops matching would make every containment check above
     // vacuously true, which is the way a gate of this shape stops gating.
     expect(Object.keys(EMBEDS).sort(), "a port with no embed mapping").toEqual([...SERVER_LANGS].sort());
-    // De-duplicated: the right-hand side comes from a Set, so a ref legitimately declared
-    // by two layers of one library would otherwise fail every port on a set the embeds
-    // carry correctly.
+    // De-duplicated: this is the side built from manifests, and it is compared against a
+    // set extracted from each embed — so a ref legitimately declared by two layers of one
+    // library would otherwise fail every port against embeds that are correct.
     const allRefs = [...new Set(NAMES.flatMap(declaredRefs))].sort();
     expect(allRefs.length, "no library declares any ref").toBeGreaterThan(0);
 
 
@@ -1,22 +1,29 @@
-// Gate — every exports-map subpath must resolve under `tsconfig.scripts.json`'s `paths`.
+// Gate — every exports-map subpath must resolve, under `tsconfig.scripts.json`'s `paths`,
+// to THE SAME MODULE the package declares.
 //
 // That file maps `@metaobjectsdev/<pkg>/*` to `<pkg>/src/*` so the repo-root `scripts/`
-// typecheck reads workspace SOURCE rather than build output. The substitution resolves a
-// subpath the way TypeScript resolves any module: `src/<name>.ts`, or `src/<name>/index.ts`
-// if `<name>` is a directory. A subpath whose `package.json` entry points somewhere else —
-// `./src/core/vocabulary-rewrite-yaml.ts`, say, which is a directory deeper than the
-// substitution can reach — has nothing to land on.
+// typecheck reads workspace SOURCE rather than build output. The `*` matches across `/`,
+// so nesting is fine — `./templates/entity-file` substitutes to
+// `src/templates/entity-file.ts` and is correct. The rule is narrower than "no nesting":
+// the subpath NAME must mirror the layout under `src/`. `./vocabulary-rewrite-yaml` whose
+// source sits at `src/core/vocabulary-rewrite-yaml.ts` breaks it, because the substitution
+// yields `src/vocabulary-rewrite-yaml` and that is not where the module is.
 //
 // Missing is not the same as failing. tsc falls through to `node_modules`, finds the
 // package's own `dist/**/*.d.ts`, and compiles clean — on a machine that has built. The
 // `gates` lane runs `bun install` and never builds, so `dist/` is absent there and the same
 // specifier is `TS2307`. Green locally, red on CI, and only for whoever imports it first.
+// `./library` shipped in exactly that state and took the lane down after the FR-043 merge.
 //
-// That is not hypothetical: `./library` shipped in exactly this state and took the lane
-// down after the FR-043 merge. This gate is the general form of that fix, because the same
-// mistake is available to every subpath added from here on.
+// Resolving to SOMETHING is not enough, which is the second half. If `paths` lands on one
+// module and the `bun` condition names another, tsc and the runtime disagree silently —
+// the type-level form of the cross-package identity defect `tsconfig.scripts.json`'s own
+// rationale is written against. Following `src/library/index.ts`'s instruction to
+// re-export new modules there, while `bun` still pointed at `library-sources.ts`, would
+// typecheck clean and be `undefined` at runtime. So both are asserted: the substitution
+// must land, and it must land on the declared file.
 import { describe, test, expect } from "bun:test";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 function findRepoRoot(start: string): string {
@@ -30,14 +37,38 @@ function findRepoRoot(start: string): string {
 }
 
 const ROOT = findRepoRoot(import.meta.dir);
+const MODULE_EXTS = [".ts", ".tsx", ".d.ts", ".js", ".jsx"] as const;
 
-/** What TypeScript will try for a `paths` substitution that lands on `candidate`. */
-function resolvesAsModule(candidate: string): boolean {
-  const asFile = [".ts", ".tsx", ".d.ts", ".js", ".jsx"].some((ext) => existsSync(candidate + ext));
-  const asDir = [".ts", ".tsx", ".d.ts", ".js", ".jsx"].some((ext) =>
-    existsSync(join(candidate, `index${ext}`)),
-  );
-  return asFile || asDir;
+/** Where TypeScript lands for a `paths` substitution of `candidate`, or undefined. */
+function resolveModule(candidate: string): string | undefined {
+  for (const ext of MODULE_EXTS) if (existsSync(candidate + ext)) return candidate + ext;
+  for (const ext of MODULE_EXTS) {
+    const idx = join(candidate, `index${ext}`);
+    if (existsSync(idx)) return idx;
+  }
+  return undefined;
+}
+
+type ExportTarget = string | Record<string, unknown>;
+
+/**
+ * The TypeScript SOURCE a subpath declares, by this repo's convention that the `bun`
+ * condition names it. Undefined for an export that is not TypeScript source at all — an
+ * asset like `./form.css`, whose target is the stylesheet and which a bundler resolves and
+ * tsc never does.
+ *
+ * A conditions object that declares no `bun` is NOT silently skipped; it comes back as
+ * `null` so the caller can fail it. Swallowing that is how a broken TS subpath would
+ * escape a gate written to catch broken TS subpaths.
+ */
+function declaredSource(target: ExportTarget): string | undefined | null {
+  if (typeof target === "string") return /\.tsx?$/.test(target) ? target : undefined;
+  const bun = target["bun"];
+  if (typeof bun === "string") return /\.tsx?$/.test(bun) ? bun : undefined;
+  // No `bun` condition. If nothing here looks like a module at all, treat it as an asset;
+  // otherwise it is a TS export the scripts typecheck cannot reach through source.
+  const anyModule = JSON.stringify(target).includes(".js") || JSON.stringify(target).includes(".ts");
+  return anyModule ? null : undefined;
 }
 
 interface Wildcard {
@@ -76,46 +107,95 @@ describe("every exports-map subpath resolves under the scripts typecheck's paths
     expect(entries.length, "no @metaobjectsdev/*/* wildcard entries found").toBeGreaterThan(10);
   });
 
-  test("no declared subpath falls through to node_modules", () => {
+  test("every mapped package's manifest is findable", () => {
+    // `pkgDir` assumes the target is `<pkgRoot>/src/*`. A target a segment deeper would
+    // point this at a directory with no `package.json`, and skipping it quietly would drop
+    // that package from the gate with no signal — so it fails here instead.
+    const unfindable = entries
+      .filter(({ pkgDir }) => !existsSync(join(ROOT, pkgDir, "package.json")))
+      .map(({ pkg, pkgDir }) => `${pkg} — no package.json at ${pkgDir}`);
+    expect(unfindable, "a paths entry whose package root could not be derived").toEqual([]);
+  });
+
+  test("each subpath lands, and lands on the module the package declares", () => {
     const misses: string[] = [];
+    const diverged: string[] = [];
+    const unreachable: string[] = [];
     let checked = 0;
 
     for (const { pkg, srcDir, pkgDir } of entries) {
       const manifestPath = join(ROOT, pkgDir, "package.json");
-      if (!existsSync(manifestPath)) continue; // a mapping with no package is its own problem
+      if (!existsSync(manifestPath)) continue; // reported by the test above
       const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as {
-        exports?: Record<string, string | Record<string, string>>;
+        exports?: Record<string, ExportTarget>;
       };
+
       for (const [sub, target] of Object.entries(manifest.exports ?? {})) {
         // `.` is the root entry, which `paths` maps separately (without the `/*`).
         // `./package.json` is resolved by `require.resolve`, never as a type-level import.
         if (sub === "." || sub === "./package.json") continue;
-        // Only TypeScript modules are subject to this. An ASSET export — `./form.css`,
-        // whose target is the stylesheet itself — is resolved by a bundler, never by tsc,
-        // so `paths` having nothing to offer it is correct rather than a defect.
-        const source = typeof target === "string" ? target : (target.bun ?? target.types ?? "");
-        if (!/\.tsx?$/.test(source)) continue;
+        // A subpath PATTERN stands for many modules, so "does it resolve" has no single
+        // answer; whatever it expands to is covered by the files themselves.
+        if (sub.includes("*")) continue;
+
+        const source = declaredSource(target);
+        if (source === undefined) continue; // asset export — not tsc's to resolve
+        if (source === null) {
+          unreachable.push(`${pkg}${sub.slice(1)} — declares no \`bun\` condition naming source`);
+          continue;
+        }
+
         checked++;
-        if (!resolvesAsModule(join(ROOT, srcDir, sub.slice(2)))) {
+        const viaPaths = resolveModule(join(ROOT, srcDir, sub.slice(2)));
+        if (viaPaths === undefined) {
           misses.push(
             `${pkg}${sub.slice(1)} — paths yields "${join(srcDir, sub.slice(2))}", ` +
-              `and neither that file nor an index.ts under it exists`,
+              `and neither that file nor an index under it exists`,
+          );
+          continue;
+        }
+        const declaredAbs = join(ROOT, pkgDir, source.replace(/^\.\//, ""));
+        if (!existsSync(declaredAbs)) {
+          misses.push(`${pkg}${sub.slice(1)} — declared source "${source}" does not exist`);
+          continue;
+        }
+        if (realpathSync(viaPaths) !== realpathSync(declaredAbs)) {
+          diverged.push(
+            `${pkg}${sub.slice(1)} — paths reads "${viaPaths.slice(ROOT.length + 1)}" ` +
+              `but \`bun\` declares "${source}"`,
           );
         }
       }
     }
 
     expect(checked, "no subpaths were checked at all").toBeGreaterThan(0);
+
     expect(
       misses,
       "A declared subpath that `tsconfig.scripts.json` cannot resolve to source.\n" +
-        "tsc will fall through to node_modules and read the package's built `dist/`, so this\n" +
-        "compiles on a machine that has built and is TS2307 on a fresh CI checkout, where the\n" +
+        "tsc falls through to node_modules and reads the package's built `dist/`, so this\n" +
+        "compiles where someone has built and is TS2307 on a fresh CI checkout, where the\n" +
         "`gates` lane runs `bun install` and never builds.\n" +
-        "Fix the package: point the subpath at `src/<name>.ts` or `src/<name>/index.ts`.\n" +
-        "Do NOT add a per-subpath entry to `tsconfig.scripts.json` — the mapping is the\n" +
-        "contract, and widening it per package is how it stops being one.\n  " +
+        "Fix the package: the subpath NAME must mirror the layout under `src/` (nesting is\n" +
+        "fine — the `*` matches across `/`). Do NOT add a per-subpath entry to\n" +
+        "`tsconfig.scripts.json`; the mapping is the contract.\n  " +
         misses.join("\n  "),
     ).toEqual([]);
+
+    expect(
+      diverged,
+      "A subpath where tsc and the runtime read DIFFERENT modules. Types would be taken\n" +
+        "from one file and values from another — an export added to only one of them\n" +
+        "typechecks clean and is `undefined` at runtime.\n  " +
+        diverged.join("\n  "),
+    ).toEqual([]);
+
+    expect(
+      unreachable,
+      "A TypeScript subpath with no `bun` condition. This repo's convention is that `bun`\n" +
+        "names the source file; without it the scripts typecheck has only `dist/` to read,\n" +
+        "which is the failure this gate exists to prevent.\n  " +
+        unreachable.join("\n  "),
+    ).toEqual([]);
   });
 });
@@ -1,9 +1,11 @@
 // @metaobjectsdev/metadata/library — the shipped-library surface (FR-043).
 //
 // The invariant is not "every subpath has an index" — `./constants` is a plain
-// `src/constants.ts` and is fine. It is that the subpath must land on something the
-// `paths` substitution can reach. This one pointed at `library-sources.ts` under a
-// directory, so it reached nothing, and that was not cosmetic: the repo-root
+// `src/constants.ts` and is fine — nor is it "no nesting", since the `paths` `*` matches
+// across `/`. It is that the subpath NAME must mirror the layout under `src/`. A subpath
+// named `library` substitutes to `src/library`, so the module has to be `src/library.ts`
+// or `src/library/index.ts`; it was `src/library/library-sources.ts`, which the
+// substitution never reaches. That was not cosmetic: the repo-root
 // `tsconfig.scripts.json` maps `@metaobjectsdev/metadata/*` to
 // `packages/metadata/src/*` so that `scripts/` typechecks against workspace
 // SOURCE rather than a build output. With no `index.ts` here that mapping had
 
@@ -1,14 +1,21 @@
 // @metaobjectsdev/metadata/vocabulary-rewrite-yaml — the YAML arm of `meta upgrade`.
 //
 // The implementation stays under `core/`, beside the canonical-JSON rewriter it mirrors.
-// This file exists so the SUBPATH has something to resolve to: `tsconfig.scripts.json`
-// maps `@metaobjectsdev/metadata/*` to `src/*`, and a subpath declared as
-// `src/core/vocabulary-rewrite-yaml.ts` is a directory deeper than that substitution can
-// reach. Without an entry here, tsc misses, falls through to `node_modules`, and reads
-// `dist/` — which exists on a machine that has built and not on a fresh CI checkout, where
-// the `gates` lane runs `bun install` and never builds.
+// This file exists so the SUBPATH NAME mirrors the layout under `src/`, which is what
+// `tsconfig.scripts.json`'s `@metaobjectsdev/metadata/*` → `src/*` mapping requires.
 //
-// `./library` shipped in exactly that state and took the lane down; this one had not been
-// imported from anywhere `scripts/` typechecks yet, so it was latent rather than red.
+// Nesting is NOT the problem — the `*` matches across `/`, which is why
+// `@metaobjectsdev/codegen-ts/templates/entity-file` resolves to
+// `src/templates/entity-file.ts` perfectly well. The problem was a subpath NAMED
+// `vocabulary-rewrite-yaml` whose source sat at `src/core/vocabulary-rewrite-yaml.ts`:
+// the substitution yields `src/vocabulary-rewrite-yaml`, and that is not where the module
+// is. Renaming the export to `./core/vocabulary-rewrite-yaml` would also have satisfied
+// the rule and was the cheaper edit, but this package is published and that subpath is
+// public API, so the name stays and the layout moves to meet it.
+//
+// When the mapping misses, tsc falls through to `node_modules` and reads `dist/` — present
+// for anyone who has built, absent on a fresh CI checkout where the `gates` lane runs
+// `bun install` and never builds. `./library` shipped that way and took the lane down;
+// this one had not been imported from anywhere `scripts/` typechecks, so it was latent.
 // `cli/test/subpath-resolves-under-scripts-paths.test.ts` now gates the class.
 export { rewriteYamlDocument, type YamlRewriteResult } from "./core/vocabulary-rewrite-yaml.js";