diff --git a/.quixos-subtree-source.json b/.quixos-subtree-source.json
index 726300e..926884e 100644
--- a/.quixos-subtree-source.json
+++ b/.quixos-subtree-source.json
@@ -1,7 +1,7 @@
 {
   "version": 1,
   "sourceRepo": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos",
-  "sourceCommit": "37a50c17063a41d23037b39785f7054992d7c708",
+  "sourceCommit": "6e51f796de7af0da8c053f770b89d243f74c5d61",
   "sourcePath": "quixos-protocol",
   "exportName": "quixos-protocol",
   "mirrorRemote": "https://gitea-external.egads.tutti.syntaxblitz.net/quixos/quixos-protocol.git"
diff --git a/flake.nix b/flake.nix
index 80677c9..3dce74b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -65,6 +65,7 @@
               esbuild dist/src/bindings/portable-client-cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-codegen-client.mjs
               esbuild dist/src/bindings/react-platform.js --bundle --platform=node --target=node24 --format=esm --outfile=react-platform.mjs
               esbuild dist/src/capability-language/tool-cli.js --bundle --platform=node --target=node24 --format=esm --outfile=quixos-qx.mjs
+              esbuild dist/src/capability-language/source-check-driver.js --bundle --platform=node --target=node24 --format=esm --outfile=source-check-driver.mjs
               runHook postBuild
             '';
             doCheck = true;
@@ -132,6 +133,7 @@
                           install -m644 client-codegen.mjs "$out/libexec/quixos-protocol/client-codegen.mjs"
                           install -m644 react-platform.mjs "$out/libexec/quixos-protocol/react-platform.mjs"
                           install -m644 quixos-codegen-ts.mjs quixos-qx.mjs "$out/libexec/quixos-protocol/"
+                          install -m644 source-check-driver.mjs "$out/libexec/quixos-protocol/"
                           install -m644 quixos-codegen-client.mjs "$out/libexec/quixos-protocol/"
                           install -m644 quixos-descriptor-check.mjs "$out/libexec/quixos-protocol/quixos-descriptor-check.mjs"
                           install -m644 quixos-capability-compile.mjs "$out/libexec/quixos-protocol/quixos-capability-compile.mjs"
diff --git a/src/capability-language/checked-build.ts b/src/capability-language/checked-build.ts
index 7e2e7fd..5fe2122 100644
--- a/src/capability-language/checked-build.ts
+++ b/src/capability-language/checked-build.ts
@@ -128,6 +128,7 @@ export async function buildImmutableCandidate(
     log.once("open", () => resolve());
     log.once("error", reject);
   });
+  let logBytes = 0;
   const run = async (executable: string, args: string[]) =>
     await new Promise<string>((resolve, reject) => {
       let output = "",
@@ -140,9 +141,18 @@ export async function buildImmutableCandidate(
       };
       log.on("error", failedLog);
       child.stdout.on("data", (chunk) => {
-        output += chunk;
+        if (failure) return;
+        if (Buffer.byteLength(output) + chunk.length > 65536)
+          failedLog(new Error("Candidate checker output exceeds 64 KiB"));
+        else output += chunk;
       });
       child.stderr.on("data", (chunk) => {
+        if (failure) return;
+        logBytes += chunk.length;
+        if (logBytes > 16 * 1024 * 1024) {
+          failedLog(new Error("Candidate checker log exceeds 16 MiB"));
+          return;
+        }
         log.write(chunk);
         tail = (tail + String(chunk)).slice(-6000);
       });
diff --git a/src/capability-language/source-check-driver.ts b/src/capability-language/source-check-driver.ts
new file mode 100644
index 0000000..36f6350
--- /dev/null
+++ b/src/capability-language/source-check-driver.ts
@@ -0,0 +1,8 @@
+import { buildImmutableCandidate } from "./checked-build.js";
+
+// Installed platform driver, run only inside the sealed checker's unprivileged
+// evaluator. Authored flakes never become the outer evaluator program.
+const [repository, commit, log] = process.argv.slice(2);
+if (!repository || !commit || !log || process.argv.length !== 5)
+  throw Error("source-check-driver REPOSITORY COMMIT LOG");
+process.stdout.write((await buildImmutableCandidate({ repository, commit }, "workspace", log)) + "\n");
diff --git a/src/execution-world/index.ts b/src/execution-world/index.ts
index 1f1af96..a8e0b00 100644
--- a/src/execution-world/index.ts
+++ b/src/execution-world/index.ts
@@ -25,3 +25,4 @@ export * from "./public-reflection.js";
 export * from "./graph-execution.js";
 
 export * from "./build-contract.js";
+export * from "./placement.js";
diff --git a/src/execution-world/placement.ts b/src/execution-world/placement.ts
new file mode 100644
index 0000000..468e191
--- /dev/null
+++ b/src/execution-world/placement.ts
@@ -0,0 +1,290 @@
+import { parse } from "@babel/parser";
+import { builtinModules } from "node:module";
+import { ExecutionPlanError, hexDigest, type ExecutionPlan } from "./plan.js";
+import type { ExecutionInstallation } from "./installation.js";
+import type { ArtifactImplementation, ArtifactReader } from "./artifacts.js";
+
+export interface PlacementBlocker {
+  readonly code: string;
+  readonly path: readonly string[];
+  readonly detail: string;
+}
+export interface PlacementEntry {
+  readonly operation: string;
+  readonly effect: string;
+  readonly availableTargets: readonly string[];
+  readonly requiresVM: boolean;
+  readonly nativeBindings: readonly string[];
+  readonly cycles: readonly (readonly string[])[];
+  readonly blockers: readonly PlacementBlocker[];
+}
+export interface ImportFinding {
+  readonly code: string;
+  readonly detail: string;
+  readonly line: number | null;
+}
+const nativeImports = new Set(builtinModules.flatMap((name) => [name, name.replace(/^node:/, "")]));
+const ambient = new Set([
+  "process",
+  "global",
+  "globalThis",
+  "fetch",
+  "WebSocket",
+  "XMLHttpRequest",
+  "Deno",
+  "Bun",
+  "eval",
+  "Function",
+  "SharedArrayBuffer",
+  "Atomics",
+]);
+
+/** Diagnostic scan of compiled JavaScript, never a certificate of purity. A
+ * shadowed name can conservatively produce a finding; computed access/aliases
+ * cannot be proven safe here. No findings still require a qualified loader and
+ * runtime before this artifact can enter restricted execution. */
+export function inspectJavaScriptSurface(source: string, checkedSDKImports: readonly string[] = []): ImportFinding[] {
+  if (Buffer.byteLength(source) > 1024 * 1024)
+    return [{ code: "ANALYSIS_LIMIT", detail: "JavaScript exceeds the 1 MiB inspection budget", line: null }];
+  let ast;
+  try {
+    ast = parse(source, { sourceType: "module", createImportExpressions: true });
+  } catch {
+    return [
+      {
+        code: "UNCLASSIFIED_SYNTAX",
+        detail: "Compiled source cannot be classified by the selected parser",
+        line: null,
+      },
+    ];
+  }
+  const findings: ImportFinding[] = [],
+    seen = new Set<string>(),
+    sdk = new Set(checkedSDKImports);
+  const add = (code: string, detail: string, node: any) => {
+    const key = JSON.stringify([code, detail]);
+    if (seen.has(key)) return;
+    seen.add(key);
+    if (findings.length < 63) findings.push({ code, detail, line: node?.loc?.start.line ?? null });
+  };
+  const imported = (node: any, at: any) => {
+    if (node?.type !== "StringLiteral") {
+      add("COMPUTED_MODULE_LOADING", "Module name is computed", at);
+      return;
+    }
+    const name: string = node.value;
+    if (sdk.has(name)) return;
+    add(
+      name.startsWith("node:") || nativeImports.has(name) ? "NATIVE_IMPORT" : "UNCLASSIFIED_IMPORT",
+      name.slice(0, 256),
+      at,
+    );
+  };
+  const pending: { node: any; parent?: any; key?: string }[] = [{ node: ast }];
+  let visited = 0;
+  while (pending.length) {
+    if (++visited > 100000) {
+      add("ANALYSIS_LIMIT", "JavaScript exceeds the syntax-node inspection budget", null);
+      break;
+    }
+    const { node, parent, key } = pending.pop()!;
+    if (!node || typeof node !== "object") continue;
+    if (["ImportDeclaration", "ExportAllDeclaration", "ExportNamedDeclaration"].includes(node.type) && node.source)
+      imported(node.source, node);
+    if (node.type === "ImportExpression") imported(node.source, node);
+    if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "require")
+      imported(node.arguments[0], node);
+    const propertyName = key === "property" && parent?.type === "MemberExpression" && !parent.computed;
+    const recordKey =
+      key === "key" &&
+      ["ObjectProperty", "ObjectMethod"].includes(parent?.type) &&
+      !parent.computed &&
+      !parent.shorthand;
+    if (node.type === "Identifier" && ambient.has(node.name) && !propertyName && !recordKey)
+      add("AMBIENT_HOST_ACCESS", node.name, node);
+    if (
+      node.type === "MemberExpression" &&
+      node.object?.type === "Identifier" &&
+      node.object.name === "Math" &&
+      (node.computed || node.property?.name === "random")
+    )
+      add("AMBIENT_RANDOMNESS", "Use captured input or a frame-scoped seed", node);
+    if (
+      (node.type === "CallExpression" || node.type === "NewExpression") &&
+      node.callee?.type === "Identifier" &&
+      node.callee.name === "Date" &&
+      node.arguments.length === 0
+    )
+      add("AMBIENT_CLOCK", "Use captured time; date parsing is allowed", node);
+    if (
+      node.type === "MemberExpression" &&
+      node.object?.type === "Identifier" &&
+      node.object.name === "Date" &&
+      (node.computed || node.property?.name === "now")
+    )
+      add("AMBIENT_CLOCK", "Use captured time; date parsing is allowed", node);
+    for (const [childKey, child] of Object.entries(node)) {
+      if (["loc", "start", "end", "extra", "comments", "tokens"].includes(childKey)) continue;
+      if (Array.isArray(child)) {
+        for (const value of child)
+          if (value && typeof value === "object") pending.push({ node: value, parent: node, key: childKey });
+      } else if (child && typeof child === "object") pending.push({ node: child, parent: node, key: childKey });
+    }
+  }
+  if (seen.size > findings.length)
+    findings.push({ code: "ANALYSIS_LIMIT", detail: "Additional findings omitted", line: null });
+  return findings;
+}
+
+/** Derived metadata only. Browser/server portability and available targets say
+ * nothing about sandbox eligibility. No existing package artifact has a
+ * qualified restricted runtime, so it conservatively requires its VM. */
+export async function reportExecutionPlacement(
+  plan: ExecutionPlan,
+  installation: ExecutionInstallation,
+  read: ArtifactReader,
+) {
+  if (installation.plan !== plan.digest || hexDigest(plan.definition) !== plan.digest)
+    throw new ExecutionPlanError(
+      "PLACEMENT_PLAN_MISMATCH",
+      plan.digest,
+      "Expected the selected checked plan and installation",
+    );
+  const operations = new Map(plan.definition.operations.map((entry) => [entry.key, entry]));
+  const queries = new Map(plan.definition.queries.map((entry) => [entry.id, entry]));
+  const packages = await Promise.all(
+    installation.packages.map(async (pkg) => {
+      const implementations: { id: string; digest: string; compatibility: string; findings: ImportFinding[] }[] = [];
+      for (const implementation of [pkg.service, pkg.module].filter(
+        (entry): entry is ArtifactImplementation => !!entry,
+      )) {
+        let findings: ImportFinding[];
+        if (implementation.compatibility === "quixos-js-module-v1") {
+          const file = implementation.files.find((file) => file.path === implementation.path)!;
+          if (!file || file.bytes > 1024 * 1024)
+            findings = [
+              { code: "ANALYSIS_LIMIT", detail: "Entry source unavailable within the inspection budget", line: null },
+            ];
+          else {
+            const sdk = implementation.files.filter((file) => file.path.endsWith("/core.mjs"));
+            const allowed = sdk.flatMap((file) => [
+              `${pkg.root}/${file.path}`,
+              `/__quixos/artifacts/content/${file.digest}/core.mjs`,
+            ]);
+            findings = inspectJavaScriptSurface(
+              Buffer.from(await read(pkg.revision, file.path, file.bytes)).toString("utf8"),
+              allowed,
+            );
+          }
+        } else
+          findings = [
+            { code: "NATIVE_SERVICE", detail: "Native/persistent service stays in VM execution", line: null },
+          ];
+        implementations.push({
+          id: implementation.id,
+          digest: implementation.contentDigest,
+          compatibility: implementation.compatibility,
+          findings,
+        });
+      }
+      return {
+        revision: pkg.revision,
+        requiresVM: implementations.length > 0,
+        restrictedEligible: false as const,
+        reason: "NO_QUALIFIED_RESTRICTED_RUNTIME",
+        implementations,
+      };
+    }),
+  );
+  const entries: PlacementEntry[] = plan.definition.operations.map((root) => {
+    const native = new Set<string>(),
+      visited = new Set<string>(),
+      cycles: string[][] = [],
+      blockers: PlacementBlocker[] = [];
+    const pending = [{ key: root.key, path: [root.key] }];
+    let limited = false;
+    const block = (code: string, path: string[], detail: string) => {
+      if (blockers.length < 63) blockers.push({ code, path, detail });
+      else limited = true;
+    };
+    while (pending.length) {
+      if (visited.size >= 512) {
+        limited = true;
+        break;
+      }
+      const { key, path } = pending.pop()!;
+      const repeated = path.slice(0, -1).indexOf(key);
+      if (repeated >= 0) {
+        if (cycles.length < 16) cycles.push(path.slice(repeated));
+        else limited = true;
+        continue;
+      }
+      if (visited.has(key)) continue;
+      if (path.length > 128) {
+        limited = true;
+        continue;
+      }
+      visited.add(key);
+      const node = operations.get(key);
+      if (!node) {
+        block("UNCLASSIFIED_DEPENDENCY", path, "Operation is absent from the checked closure");
+        continue;
+      }
+      if (node.execution.kind === "remote")
+        block("REMOTE_EFFECT", path, "Remote effects require VM or separately approved effect authority");
+      if (node.binding.kind === "package")
+        block(
+          "UNQUALIFIED_PACKAGE",
+          path,
+          `${node.binding.packageRevisionId}/${node.binding.exportId}: no qualified restricted implementation`,
+        );
+      else if (["state", "edge", "journal", "subscription", "lifecycle"].includes(node.binding.kind))
+        native.add(node.binding.kind);
+      else block("UNCLASSIFIED_NATIVE", path, node.binding.kind);
+      for (const dependency of node.dependencies) {
+        if (dependency.kind === "operation")
+          pending.push({ key: dependency.operation, path: [...path, dependency.port, dependency.operation] });
+        if (dependency.kind === "query") {
+          const query = queries.get(dependency.query);
+          if (!query) block("UNCLASSIFIED_QUERY", [...path, dependency.port], dependency.query);
+          else
+            for (const operation of new Set([...query.operations, ...query.admittedOperations]))
+              pending.push({ key: operation, path: [...path, dependency.port, dependency.query, operation] });
+        }
+      }
+    }
+    if (limited)
+      blockers.push({
+        code: "ANALYSIS_LIMIT",
+        path: [root.key],
+        detail: "Dependency closure exceeds the bounded report; keep VM placement",
+      });
+    return {
+      operation: root.key,
+      effect: root.execution.kind,
+      availableTargets: [...root.availableTargets],
+      requiresVM: blockers.length > 0,
+      nativeBindings: [...native].sort(),
+      cycles,
+      blockers,
+    };
+  });
+  const background = plan.definition.packages.flatMap((pkg) =>
+    (pkg.controllers ?? []).map((controller) => ({
+      package: pkg.revision,
+      id: controller.id,
+      requiresVM: true,
+      reason: "PERSISTENT_CONTROLLER_EXECUTION",
+    })),
+  );
+  return {
+    codec: "quixos-execution-placement-v1" as const,
+    workspace: plan.definition.workspace.workspaceId,
+    plan: plan.digest,
+    requiresVM:
+      packages.some((pkg) => pkg.requiresVM) || entries.some((entry) => entry.requiresVM) || background.length > 0,
+    operations: entries,
+    packages,
+    background,
+  };
+}
diff --git a/test/emit-controllers.ts b/test/emit-controllers.ts
index c342f6e..4b69628 100644
--- a/test/emit-controllers.ts
+++ b/test/emit-controllers.ts
@@ -3,6 +3,8 @@ import { readFile, mkdir, writeFile } from "node:fs/promises";
 import { compileCapabilityResourceSource, compileCapabilitySource } from "../src/capability-language/index.js";
 import { compileQuery } from "../src/query/compile.js";
 import { parseControllerCatalog } from "../src/capability-model/controllers.js";
+import { presentationDeclarations, preparationArtifact } from "../src/react-build/declarations.js";
+import { compileQueryComposition } from "../src/query/composition.js";
 import {
   compileExecutionPlan,
   generateInterfaceClientBindings,
@@ -59,6 +61,15 @@ const viewerPackage = viewer.resource.revision;
 viewerPackage.checkedQueries = await Promise.all(
   viewerPackage.queries!.map((query) => compileQuery(query, [iface], read)),
 );
+const preparation = presentationDeclarations(
+  await read("quixos.react.json"),
+  viewerPackage,
+  environment.interfaceClosure,
+);
+viewerPackage.buildArtifacts = { [preparationArtifact]: preparation.artifact };
+viewerPackage.queryCompositions = preparation.compositions.map((entry) =>
+  compileQueryComposition(entry, new Map(viewerPackage.checkedQueries!.map((query) => [query.declaration.id, query]))),
+);
 for (const variant of ["controller", "controller-next"]) {
   const extra = variant.endsWith("next")
     ? 'atom Dashboard id "dashboard"; import package DeviceViewer; presentation DeviceStatus id "device:status" for Device using DeviceViewer.Status;'
diff --git a/test/fixtures/controller-device/quixos.react.json b/test/fixtures/controller-device/quixos.react.json
new file mode 100644
index 0000000..c5499ac
--- /dev/null
+++ b/test/fixtures/controller-device/quixos.react.json
@@ -0,0 +1,14 @@
+{
+  "modules": {
+    "Status": {
+      "inputs": [
+        {
+          "name": "view",
+          "query": "View",
+          "root": { "from": "input", "path": ["subject"] },
+          "arguments": { "record": {} }
+        }
+      ]
+    }
+  }
+}
diff --git a/test/placement.test.ts b/test/placement.test.ts
new file mode 100644
index 0000000..01bd8bc
--- /dev/null
+++ b/test/placement.test.ts
@@ -0,0 +1,114 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { loadReaderWorkspace } from "./reader-fixture.js";
+import { buildArtifactFixture } from "./artifact-fixture.js";
+import {
+  compileExecutionPlan,
+  hexDigest,
+  inspectJavaScriptSurface,
+  reportExecutionPlacement,
+  type ExecutionInstallation,
+} from "../src/execution-world/index.js";
+
+test("compiled-source inspection finds authority imports and ambient facilities without executing code", () => {
+  const surface = inspectJavaScriptSurface(
+    `
+    import sdk from "/checked/core.mjs";
+    export * from "node:fs";
+    import path from "path";
+    import unknown from "./another.mjs";
+    const load = () => import(moduleName);
+    const req = () => require("node:net");
+    const n = Math.random(); const t = Date.now(); const next = new Date();
+    const call = () => fetch("https://example.test/");
+    const globalValue = globalThis["hidden"];
+    throw Error("INSPECTION_MUST_NOT_EXECUTE");
+  `,
+    ["/checked/core.mjs"],
+  );
+  assert.equal(
+    surface.some((f) => f.detail === "/checked/core.mjs"),
+    false,
+  );
+  for (const name of ["node:fs", "path", "node:net"])
+    assert.ok(surface.some((f) => f.code === "NATIVE_IMPORT" && f.detail === name));
+  for (const code of [
+    "UNCLASSIFIED_IMPORT",
+    "COMPUTED_MODULE_LOADING",
+    "AMBIENT_CLOCK",
+    "AMBIENT_RANDOMNESS",
+    "AMBIENT_HOST_ACCESS",
+  ])
+    assert.ok(
+      surface.some((f) => f.code === code),
+      code,
+    );
+  assert.ok(surface.some((f) => f.detail === "fetch"));
+  assert.ok(surface.some((f) => f.detail === "globalThis"));
+  assert.ok(surface.every((f) => typeof f.line === "number"));
+  assert.deepEqual(
+    inspectJavaScriptSurface(
+      'const d = new Date("2026-01-01"); const properties = { fetch: 1 }; properties.fetch; Math.floor(3.1);',
+    ),
+    [],
+  );
+  assert.equal(inspectJavaScriptSurface("const ???")[0]!.code, "UNCLASSIFIED_SYNTAX");
+  assert.equal(inspectJavaScriptSurface(" ".repeat(1024 * 1024 + 1))[0]!.code, "ANALYSIS_LIMIT");
+  const many = Array.from({ length: 100 }, (_, i) => `import x${i} from "unknown-${i}";`).join("\n");
+  const bounded = inspectJavaScriptSurface(many);
+  assert.equal(bounded.length, 64);
+  assert.equal(bounded.at(-1)!.code, "ANALYSIS_LIMIT");
+});
+
+const fixture = async () => {
+  const plan = compileExecutionPlan(await loadReaderWorkspace());
+  const artifacts = plan.definition.packages.map((pkg) => buildArtifactFixture(plan, pkg.revision));
+  const installation: ExecutionInstallation = {
+    codec: "camino-execution-installation-v1",
+    plan: plan.digest,
+    world: "a".repeat(64),
+    routes: {},
+    components: [],
+    packages: artifacts.map((f) => ({
+      revision: f.manifest.packageRevisionId,
+      root: "/fixture",
+      service: f.manifest.implementations[0]!,
+      module: f.manifest.implementations[1]!,
+    })),
+  };
+  return { plan, installation, read: artifacts[0]!.read };
+};
+
+test("placement separates native bindings, target portability, package eligibility and transitive blockers", async () => {
+  const { plan, installation, read } = await fixture();
+  const report = await reportExecutionPlacement(plan, installation, read);
+  const native = plan.definition.operations.find((op) => op.binding.kind === "state")!;
+  assert.equal(report.operations.find((op) => op.operation === native.key)!.requiresVM, false);
+  const consumer = plan.definition.operations.find(
+    (op) => op.binding.kind === "package" && op.dependencies.some((dep) => dep.kind === "operation"),
+  )!;
+  const before = structuredClone(consumer);
+  const entry = report.operations.find((op) => op.operation === consumer.key)!;
+  assert.equal(entry.requiresVM, true);
+  assert.deepEqual(entry.availableTargets, consumer.availableTargets);
+  assert.ok(entry.blockers.some((blocker) => blocker.code === "UNQUALIFIED_PACKAGE"));
+  assert.ok(entry.nativeBindings.includes("state"));
+  assert.ok(report.packages.every((pkg) => pkg.restrictedEligible === false));
+  assert.deepEqual(consumer, before, "Analysis cannot alter public contracts or placement");
+
+  // Add a dependency that disqualifies the consumer while preserving its interface.
+  const target = plan.definition.operations.find((op) => op.key !== consumer.key && op.binding.kind === "package")!;
+  consumer.dependencies.push({ kind: "operation", port: "unsafe-provider", operation: target.key });
+  target.execution = { kind: "remote" };
+  target.dependencies.push({ kind: "operation", port: "return-to-caller", operation: consumer.key });
+  plan.digest = hexDigest(plan.definition);
+  const after = await reportExecutionPlacement(plan, { ...installation, plan: plan.digest }, read);
+  const changed = after.operations.find((op) => op.operation === consumer.key)!;
+  assert.ok(
+    changed.blockers.some((blocker) => blocker.code === "REMOTE_EFFECT" && blocker.path.includes("unsafe-provider")),
+  );
+  assert.ok(changed.cycles.some((cycle) => cycle[0] === consumer.key && cycle.at(-1) === consumer.key));
+  assert.deepEqual(consumer.input, before.input);
+  assert.deepEqual(consumer.output, before.output);
+  await assert.rejects(reportExecutionPlacement(plan, installation, read), { code: "PLACEMENT_PLAN_MISMATCH" });
+});