diff --git a/.quixos-subtree-source.json b/.quixos-subtree-source.json
index 7e442cb..2c2a36b 100644
--- a/.quixos-subtree-source.json
+++ b/.quixos-subtree-source.json
@@ -1,7 +1,7 @@
 {
   "version": 1,
   "sourceRepo": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos",
-  "sourceCommit": "286ada5419c4fc2184b387cea4715fae1a74bde5",
+  "sourceCommit": "358e649a7d70828db2ef96d5fed18931e48bc498",
   "sourcePath": "quixos-instance/quixos-nix-helpers",
   "exportName": "quixos-nix-helpers",
   "mirrorRemote": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-nix-helpers.git"
diff --git a/PORTABLE_ARTIFACTS.md b/PORTABLE_ARTIFACTS.md
index 12fa668..7348087 100644
--- a/PORTABLE_ARTIFACTS.md
+++ b/PORTABLE_ARTIFACTS.md
@@ -61,6 +61,25 @@ with their own versions. Authored source symlinks and non-bundled portable impor
 other than the SDK and server Node builtins are rejected. This is build closure
 checking, not a purity proof or security sandbox.
 
+`mkCaminoYarnDependencies` installs the locked dependency recipe and exports its
+installed Node dependency tree, including native package results and executable
+links. Generated Yarn install/linker state stays outside runtime outputs. Yarn
+describes its install-state file as an optimization cache in its
+[configuration reference](https://yarnpkg.com/configuration/yarnrc#installStatePath).
+This helper output is a dependency directory for a build, not a standalone
+Package or a runnable Yarn project. Its `devShell` supplies freestanding Yarn for
+editable projects; do not run Yarn against the readonly dependency output.
+
+Use the shared `installDependencies` assembly for consumers: authored libraries
+are copied into the consumer's `node_modules`, where Node can find their
+transitive dependencies, while selected SDK links retain their canonical type
+identity. Reserved SDK substitutions fail checks. Web Studio uses this same
+assembly rather than retaining a full Yarn project just to resolve UI libraries.
+Its dependency inputs contain manifests, lock and Yarn configuration/plugin
+recipe; ordinary Studio source edits do not enter that dependency derivation.
+Recipes with local/workspace dependencies must still include their needed source.
+This is language-specific build machinery; it adds no core Package file contract.
+
 The core/Automerge bundle and Replicache bundle are built once. Browser modules
 import the core through a content-addressed gateway URL, independent of package
 identity. Each manifest covers the shared bytes it uses. The gateway retains its
diff --git a/yarn-dependencies.nix b/yarn-dependencies.nix
index b444174..6ea4567 100644
--- a/yarn-dependencies.nix
+++ b/yarn-dependencies.nix
@@ -13,6 +13,9 @@ let
         test -d node_modules
         mkdir -p "$out"
         cp -a node_modules/. "$out/"
+        # Node resolves installed packages directly. This generated index is for
+        # Yarn's linker, not a runtime input; do not export build-session state.
+        rm -f "$out/.yarn-state.yml"
         runHook postInstall
       '';
     };