diff --git a/.llm/runs/release-0.0.6-features--orchestration/slices/implement-1459.md b/.llm/runs/release-0.0.6-features--orchestration/slices/implement-1459.md
new file mode 100644
index 0000000000..f9b94dacc5
--- /dev/null
+++ b/.llm/runs/release-0.0.6-features--orchestration/slices/implement-1459.md
@@ -0,0 +1,133 @@
+use harness
+
+# Slice brief — #1459 the deferred refresh coordinator is never hydrated
+
+**Codex · GPT-5.6 Sol · high** (`complex_implementation`). The plan **passed PLAN-EVAL** (run
+`31593309658`, verdict PASS in the body). Implement it; do not re-decide it.
+
+| Field | Value |
+| --- | --- |
+| Issue | #1459 (`priority:p1`) |
+| PR | **#1558** — already open as a draft at plan phase; commit onto its branch |
+| Worktree | `/home/codex/repos/ns006-1459` |
+| Branch | `fix/1459-defer-island-hydration` |
+| Base | `origin/main@59e435c5d` |
+
+**Read first, in order:**
+
+1. `slices/plan-1459.md` — read the **whole** file. It has three sections: the original plan, then
+   **`# Plan v2`** (the revision after `FAIL_PLAN`), then **`## PLAN-EVAL v2 result`** with
+   amendments **B1–B4**. **v2 and B1–B4 are binding**; where the original plan disagrees with v2, v2
+   wins.
+2. `slices/research-1459.md`.
+
+If they are not on your branch: `git show chore/release-0.0.6-runtime-reopen:<path>`.
+
+## SKILL
+
+- `deno-fresh` — Fresh 2.x islands, partials, client navigation, and the Vite plugin.
+- `netscript-doctrine` — `packages/fresh` is framework code.
+- `netscript-cli` — the scaffold template surface, if D1 touches it.
+- `netscript-tools`, `netscript-pr`, `netscript-harness`.
+
+## The defect — two inseparable halves
+
+1. **`DeferIsland.tsx` is not an island at all.** No island registration exists anywhere. It is a
+   *named* export (`DeferIsland.tsx:111`); the scaffold calls `fresh()` with **no options**
+   (`packages/cli/src/kernel/assets/app/vite.config.ts.template:41`); `createNetScriptVitePlugin` has
+   **zero** island logic. It is reached only through a server-render path, so it never enters the
+   client bundle.
+2. **`f-client-nav` is false in exactly the failing case.** `DeferIsland.tsx:222` sets
+   `f-client-nav={!(isPartialRequest && !hasCachedData)}` — that condition **is** `partial-miss`.
+   PLAN-EVAL verified against Fresh core that `client.ts:256` gates form submission on
+   `checkClientNavEnabled`, so with it false the `requestSubmit()` produces a **full document
+   navigation**, not a `/partials/**` request. It also confirmed the client refresh mechanism is
+   form/anchor interception only — **no background poll, no auto-refresh timer**, so nothing else
+   rescues a missed region.
+
+Fixing (1) without (2) leaves the reported symptom unfixed.
+
+## LOCKED decisions
+
+- **D1 — register the island via `islandSpecifiers`.** `@fresh/plugin-vite` exposes
+  `islandSpecifiers?: string[]`, documented as *"Treat these specifiers as island files. This is used
+  to declare islands from remote packages."*
+  **B1 (binding):** the scaffold pins **`jsr:@fresh/plugin-vite@^1.1.2`** — verify against **1.1.2**
+  (`utils.ts:59-63`; mechanism at `src/mod.ts:234-237`, `fConfig.islandSpecifiers.set(spec, name)`),
+  **not** 1.0.8. Copy-mode and a consumer-owned shim are **rejected**.
+- **B2 (binding) — the specifier must be created, not just referenced.** `packages/fresh/deno.json`
+  has **no** sub-export for the defer island today. You must **(a)** add the sub-export and **(b)**
+  name that specifier in `vite.config.ts.template`'s `fresh({ islandSpecifiers: [...] })`. Choose the
+  concrete specifier string and say why.
+- **D2 — fix `f-client-nav`** so `partial-miss` enables client nav. Semantics are already verified;
+  do not re-litigate them.
+- **D3 — move the coordinator form *inside* the region's `<Partial>`.** It currently renders as a
+  sibling outside it (`DeferPage.tsx:257-275`), so a region swap leaves stale DOM and a page swap
+  re-renders an inert form. **Fallback if that breaks the fallback-render contract:** stable `key` +
+  remount. `SlotRef` is not pursued. State which landed and why.
+- **D4 — do not change `decideDeferClientAction`'s policy logic** (`policy.ts:177-208`). It is correct
+  and unit-covered; it is simply never executed. If your fix requires changing it, **stop and report**.
+- **D5 — scope.** There is exactly **one** render site (`DeferPage.tsx:263`), and the streaming path
+  provably never renders it (`runtime/mod.tsx:178`, `!shouldStream && …`). Out of scope: the dead
+  `debug` prop (`DeferIsland.tsx:54`), and the #1457/#1548 surfaces (both already merged).
+- **B4 — migration.** `islandSpecifiers` is a `fresh()` option, so this is a **scaffold-template
+  change**: already-generated apps do **not** get the fix until regenerated. Carry either a
+  template-regeneration commit or a tracked follow-up issue, and **say which in the PR**.
+
+## Required tests
+
+1. **Client-bundle presence — B3 (binding).** Build the client bundle and assert the defer island is
+   in it. **You must commit to a fixture location and add it in this PR** — there is no `vite build`
+   fixture under `packages/fresh/tests/` today. Either a fixture under `packages/fresh/tests/fixtures/`
+   with a `Deno.test` wrapper, or a scaffolded-app fixture under `packages/cli/e2e/`. This attacks the
+   exact evidence the issue reports: *"the generated client bundle contains none of `DeferComponent`,
+   `decideDeferClientAction`, or `partial-miss`."*
+2. **`f-client-nav` across all four** `isPartialRequest` × `hasCachedData` combinations, pinning that
+   `partial-miss` **enables** client nav. This is the guard that would have caught defect (2).
+3. **Island marker in server output**, reusing the JSX-tree harness
+   (`define-page/tests/search-params.test.tsx:90-134`).
+4. **Partial-swap behaviour** for whichever D3 technique lands.
+
+Each must fail if its own defect returns. Where a shape matters more than a value, assert the shape —
+the #1548 slice in this lane proved that a behaviour-only suite stays green through a silent
+regression.
+
+## Gates — hardcoded, not conditional
+
+```bash
+deno run --allow-read --allow-run .llm/tools/run-deno-check.ts --root packages/fresh --ext ts,tsx
+deno run --allow-read --allow-run .llm/tools/run-deno-lint.ts  --root packages/fresh --ext ts,tsx
+deno run --allow-read --allow-run .llm/tools/run-deno-fmt.ts   --root packages/fresh --ext ts,tsx
+deno task --cwd packages/fresh test
+deno task doc:lint --root packages/fresh --pretty
+```
+
+`arch:check` (`deno.json:156`) **does not cover `packages/fresh`** (verified). Run `quality:gate`
+**and** an explicit target quality scan over `packages/fresh/src`, and state in the PR that the
+package-quality verdict rests on the explicit scan. If you touch the scaffold template, add the
+`packages/cli` scoped wrappers and expect `scaffold-static` to exercise it in CI.
+
+Never a bare `deno test <path>` — it omits `--allow-env` and exits 1 on `NotCapable`.
+
+## PR contract — read this carefully
+
+PR **#1558** exists. Its body already carries **`Refs #1459`, deliberately not a closing keyword**,
+because the client-bundle *navigation* criterion is split to **#1557**. **Do not change `Refs` to
+`Closes`.** If you believe your work fully resolves #1459 including browser-navigation proof, say so
+in your report and let the orchestrator decide — do not decide it in the body.
+
+Do **not** emit an `acceptance-evidence` block with an empty entry list; the mirror's parser throws
+on it (#1561). If there is nothing to map, omit the block and say why.
+
+Commit per slice, push by explicit refspec, post `[PHASE: IMPL]` with commit hash and **pasted real
+gate output**, and move the label from `status:plan-eval` to `status:impl`.
+
+## Reporting contract
+
+Report what changed and where; the concrete specifier you chose and the fixture location you
+committed to; the exact test names and what each catches; verbatim gate output; and **anything you
+could not do, could not verify, or that surprised you**. If a gate goes red, report the red with its
+output — do not work around it silently.
+
+Do **not** flip the PR to ready (that fires the automatic IMPL-EVAL, which is the orchestrator's
+trigger) and do **not** merge.
diff --git a/.llm/runs/release-0.0.6-features--orchestration/slices/plan-1459.md b/.llm/runs/release-0.0.6-features--orchestration/slices/plan-1459.md
new file mode 100644
index 0000000000..5cc3070d61
--- /dev/null
+++ b/.llm/runs/release-0.0.6-features--orchestration/slices/plan-1459.md
@@ -0,0 +1,258 @@
+# Plan — #1459 `DeferComponent` is not hydrated, so partial-miss regions never refresh
+
+Lane: 0.0.6 runtime reopen. Control PR #1555. Research: `slices/research-1459.md`.
+Branch: `fix/1459-defer-island-hydration`. **Goes to PLAN-EVAL before implementation** via the
+`openhands` + `status:plan-eval` label pair.
+
+## What the research changed
+
+The issue frames this as "the component is not hydrated". The actual finding is narrower and harder:
+**`DeferIsland.tsx` is not an island at all** — there is no island registration for it anywhere
+(`DeferIsland.tsx:111` is a *named* export; the scaffold calls `fresh()` with no options at
+`vite.config.ts.template:41`; `createNetScriptVitePlugin` has zero island logic across all 438 lines).
+Islands in this repo reach the client by **directory convention** or by being **copied into the
+consumer app** (`fresh-ui`), and the one JSR-shipped island that works — `QueryIsland` — works only
+because the *consumer's own* island file imports it (`query-island.tsx:26-36`).
+
+And a **second, independent defect** sits in the same component: `DeferIsland.tsx:222` sets
+`f-client-nav={!(isPartialRequest && !hasCachedData)}`, whose condition is **exactly** `partial-miss`.
+So in precisely the failing case, `f-client-nav` is `false` while `f-partial` is set (`:221`).
+Hydration alone may therefore still produce a full document navigation instead of the `/partials/**`
+request. These two are **technically inseparable**: fixing hydration without this leaves the issue's
+observable symptom unfixed.
+
+## Scope decision — split, and move one criterion with a written reason
+
+The issue's acceptance asks for a regression test that *"build[s] the Fresh client bundle, navigate[s]
+into a page with a cache-miss deferred layer, assert[s] the partial endpoint is requested, and
+assert[s] the named boundary swaps exactly once."*
+
+This repo has **no browser driver** (Playwright appears only in docs and in the CLI *scaffolding* for
+consumer projects) and **no gate that builds or inspects a client bundle**. That criterion therefore
+needs **net-new test capability**, which is its own piece of work.
+
+**Decision: it moves to a follow-up issue with a written reason (#1090 pattern), and this PR does not
+tick it.** A p1 runtime blocker — a documented pattern that paints a skeleton which never resolves —
+should not wait on net-new browser-test infrastructure. Per the honesty rule, the criterion travels
+with a reason rather than being ticked on weaker evidence.
+
+What this PR **does** prove is stated below and is deliberately not dressed up as the missing test.
+
+## Locked decisions
+
+- **D1 — the island must reach the client without depending on a consumer-owned file.** Preference
+  order, to be settled by the implementer against verified feasibility:
+  1. register the island from `createNetScriptVitePlugin` (the only option requiring no consumer
+     file) — **feasibility is unverified**; the research could not confirm `@fresh/plugin-vite`
+     supports registering an island from a JSR specifier, and proved only that *this repo passes no
+     such option*. **Verify this first.**
+  2. if (1) is not supported, the `fresh-ui` **copy-mode** precedent (`registry.generated.ts:334-340`).
+  A consumer-side shim that a consumer can delete — silently reintroducing the bug — is the **least**
+  preferred and must be argued for if chosen.
+- **D2 — fix `f-client-nav` (`DeferIsland.tsx:222`).** Its current condition disables client nav in
+  exactly the `partial-miss` case it needs to be enabled for. **Verify Fresh's actual
+  `f-client-nav`/`f-partial` form-interception semantics before changing it** — the research flagged
+  this as inference, not fact. If Fresh does intercept `f-partial` regardless of `f-client-nav`, say
+  so and leave the line alone with evidence.
+- **D3 — address the partial-swap case.** The coordinator form renders as a **sibling outside** the
+  `<Partial>` (`DeferPage.tsx:257-275`), so a region swap leaves the form's DOM in place while a
+  page-level swap re-renders an inert form. The acceptance explicitly requires the coordinator to work
+  *after a page partial swap*; a fix that only works on first paint does not satisfy it.
+- **D4 — no change to `decideDeferClientAction`'s policy logic** (`policy.ts:177-208`). It is correct
+  and already unit-covered; it is simply never executed. If the fix requires changing it, stop and
+  report.
+- **D5 — out of scope:** the `streams`/`shouldStream` sibling path (`runtime/mod.tsx:178`), the dead
+  `debug` prop (`DeferIsland.tsx:54`), and #1457/#1548's surfaces.
+
+## Tests — what this PR can honestly prove
+
+1. **Island marker in server output.** Reuse the existing JSX-tree harness
+   (`define-page/tests/search-params.test.tsx:93-99,115-134`) to assert the rendered tree carries
+   whatever marker the chosen D1 mechanism produces. Fails if registration regresses.
+2. **`f-client-nav` condition** (D2) asserted directly for the four combinations of
+   `isPartialRequest` × `hasCachedData`, pinning that `partial-miss` enables client nav. This is the
+   guard that would have caught the second defect.
+3. **`buildDeferFormState` / decision plumbing** extended so `partial-miss → submit` is exercised
+   with the real inputs `DeferPage` passes (`DeferPage.tsx:267-268`), not synthetic ones.
+4. If D1 lands via the Vite plugin, a unit test that the plugin **emits the island registration**.
+
+**None of these prove the client bundle contains the island or that a browser issues the partial
+request.** That is the moved criterion. Say so plainly in the PR body; do not let tests 1–4 be read as
+satisfying it.
+
+## Gates
+
+Scoped check/lint/fmt over `packages/fresh`, `deno task quality:gate` (**verify it covers
+`packages/fresh`; it demonstrably omits several packages — #1542**), `deno task --cwd packages/fresh
+test`, `deno task doc:lint`. If D1 changes the CLI registry or scaffold template, add the
+`packages/cli` scoped wrappers and expect `scaffold-static` to exercise it in CI.
+
+## Risks
+
+- **R1** — D1's preferred option has **unverified feasibility**. If it fails, the fallback changes the
+  distribution model (copy-mode), which is a materially different PR. That branch point is why this
+  plan goes to PLAN-EVAL.
+- **R2** — the `f-client-nav` claim is inference. Acting on it without verifying Fresh's semantics
+  risks changing a correct line.
+- **R3** — copy-mode (D1.2) means framework fixes stop reaching already-generated apps; that is a
+  doctrine-relevant trade, not just an implementation detail.
+
+## Acceptance mapping (#1459)
+
+| Criterion | This PR | Evidence |
+| --- | --- | --- |
+| Coordinator registered/hydrated as a real Fresh island, including after a partial swap | **yes** (D1 + D3) | server-output marker test; plugin-emission test |
+| A cache miss triggers the configured partial request and the region settles | **partially** — mechanism fixed (D2), not observed in a browser | `f-client-nav` condition tests |
+| Regression test builds the client bundle, navigates, asserts the partial request and a single swap | **no — moved to a follow-up with a written reason** | needs net-new browser/bundle capability this repo lacks |
+
+---
+
+# Plan v2 — revised after PLAN-EVAL `FAIL_PLAN`
+
+The evaluator verified the second defect **against Fresh core source** rather than leaving it as my
+inference: `client.ts:256` gates form submission on `checkClientNavEnabled(el)`, and `shared.ts`
+confirms `CLIENT_NAV_ATTR = "f-client-nav"`. So `f-client-nav={false}` in the `partial-miss` case
+**does** suppress the interception — the second defect is now **fact, not inference**, and R2 is
+closed. It also confirmed the client refresh mechanism is form/anchor interception only: **no
+background poll, no auto-refresh timer.** Nothing else will save a missed region.
+
+Amendments, in the order the verdict raised them.
+
+## A1 — D1 feasibility is RESOLVED, not punted
+
+I read `@fresh/plugin-vite` v1.0.8 from the JSR cache. It exposes a public config option whose
+documented purpose is exactly this case:
+
+```ts
+/**
+ * Treat these specifiers as island files. This is used to declare
+ * islands from remote packages.
+ */
+islandSpecifiers?: string[];
+```
+
+(`https://jsr.io/@fresh/plugin-vite/1.0.8/src/utils.ts`, cached; consumed in the plugin's `options()`
+hook, which adds each specifier to `islands` and, in non-dev builds, emits a
+`fresh-island::<name>` input entry.)
+
+**D1 is therefore LOCKED to the specifier route** — no copy-mode, no consumer-owned shim. The
+scaffold's `vite.config.ts.template:41` currently calls `fresh()` with **no options**; it must pass
+`islandSpecifiers` naming the defer island's specifier.
+
+**A1a — migration is real and must be named (verdict item 6).** Because `islandSpecifiers` is a
+`fresh()` option and not a Vite-level setting, `createNetScriptVitePlugin` cannot inject it by
+merging Vite config. It is a **scaffold-template change**, so **already-generated apps do not get the
+fix until regenerated**. The PR must state this plainly and either carry a CLI-registry/template
+commit or file a tracked migration follow-up. It must not be left implicit.
+
+## A2 — D3 picks a technique
+
+**Locked: move the coordinator form *inside* the region's `<Partial>`** (`DeferPage.tsx:257-275`
+currently renders it as a sibling outside). That makes a region swap re-render the form, which is the
+behaviour the acceptance requires, and it is the minimal structural change.
+
+**Fallback if that breaks the fallback-render contract:** give the form a stable `key` and force a
+remount. `SlotRef` is not pursued. Whichever lands must be stated in the PR with the reason.
+
+## A3 — D5 call sites enumerated, not assumed
+
+Every non-test reference to `DeferComponent` in `packages/`:
+
+- `DeferIsland.tsx:21,111,122` — its own declaration.
+- `DeferPage.tsx:8` (import) and `:263` (the **only** render site).
+
+There is exactly **one** render site. `DeferPage` is reached only from
+`builders/define-page/runtime/mod.tsx`, where `shouldDefer = !shouldStream && !!descriptor.config.partial
+&& (descriptor.config.delivery ?? 'defer') === 'defer'` (`runtime/mod.tsx:178`). So the streaming path
+provably never renders `DeferComponent`, and D5's exclusion is **verified rather than asserted**.
+
+## A4 — the test commitment, and a correction to the verdict
+
+The verdict proposed `probe-project-boundary-dev.ts:43` + `FetchHttpAdapter` as an
+already-available, non-net-new way to drive the partial request end-to-end. **I checked it, and it
+does not do that.** That probe boots a Fresh dev server and issues
+`fetch('http://127.0.0.1:${port}/')` in a liveness loop (`:41-52`). There is no browser and no JS
+execution, so it can prove the partial **endpoint answers** but cannot prove the **client issues the
+request** — and "the client never issues the request" is the entire defect. A server-side fetch
+firing the request would be evidence of nothing.
+
+**What this PR commits to instead**, which is stronger than v1's server-only tests and cheaper than a
+browser:
+
+- **Build the client bundle and assert the defer island is present in it.** With D1 locked to
+  `islandSpecifiers`, the non-dev build emits a `fresh-island::<name>` entry, so this is directly
+  checkable. It is modest net-new capability (a `vite build` plus an assertion — **not** a browser
+  driver), and it attacks the exact evidence the issue reports: *"the generated client bundle
+  contains none of `DeferComponent`, `decideDeferClientAction`, or `partial-miss`."*
+- Plus the v1 tests: `f-client-nav` condition across all four `isPartialRequest` × `hasCachedData`
+  combinations, and the island-marker assertion in server output.
+
+**Still moved to #1557:** browser-driven navigation asserting the `/partials/**` request fires and the
+boundary swaps exactly once. That needs a real browser and stays out.
+
+## A5 — closing keyword (verdict item 5): already corrected
+
+PR #1558's body carried `Closes #1459` while this plan moves one of that issue's criteria — a
+self-contradiction, and the #1092 precedent. **Fixed:** the body now reads `Refs #1459` with the
+reason stated. The closing keyword goes on whichever PR truthfully completes the issue.
+
+## A6 — gate commands hardcoded (verdict item 7)
+
+`arch:check` (`deno.json:156`) does not cover every package, so the gate list is fixed rather than
+conditional: run `deno task --cwd packages/fresh test`, the scoped check/lint/fmt wrappers over
+`packages/fresh`, **and** an explicit target quality scan over `packages/fresh/src`. If the D1
+template change lands, add the `packages/cli` scoped wrappers and expect `scaffold-static` to
+exercise it.
+
+## Revised acceptance mapping (#1459)
+
+| Criterion | This PR | Evidence |
+| --- | --- | --- |
+| Coordinator registered/hydrated as a real Fresh island, incl. after a partial swap | **yes** | `islandSpecifiers` registration + client-bundle presence assertion + form moved inside the `<Partial>` |
+| A cache miss triggers the configured partial request and the region settles | **mechanism proven, not observed in a browser** | `f-client-nav` corrected against verified Fresh semantics (`client.ts:256`) |
+| Regression test builds the client bundle, navigates, asserts the request and a single swap | **bundle half yes; navigation half moved to #1557** | stated in the PR body without overclaiming |
+
+---
+
+## PLAN-EVAL v2 result — PASS (recorded with an extraction discrepancy)
+
+Run `31593309658`, MiniMax M3, on plan v2 commit `63ae41bb4`.
+
+**The verdict is PASS.** The summary body states `Verdict: **PASS**` and ends with
+`## OPENHANDS_VERDICT: PASS`. The machine marker nevertheless recorded
+`"verdict":"NONE","verdict_source":"none"` — the token was emitted as a **markdown heading**, so the
+extractor did not match it. Filed as **#1563**.
+
+**Not re-run.** Re-dispatching an evaluator purely to obtain a parseable token would be duplicate
+spend of exactly the kind the phase-eval policy forbids, to work around a formatting bug rather than
+an evaluation failure. The body verdict is accepted and the discrepancy is recorded instead.
+
+### What it independently verified
+
+- A1's mechanism, the streaming exclusion (A3), the sibling-form structure (A2), the `f-client-nav`
+  condition, and the `arch:check` omission of `packages/fresh` — all confirmed against the head SHA.
+- PR #1558 correctly carries `Refs #1459`, not a closing keyword.
+
+### Amendments to fold into implementation
+
+**B1 — version citation corrected (my error).** Plan v2 cited `@fresh/plugin-vite@1.0.8`, read from
+the local Deno cache. The scaffold actually pins **`jsr:@fresh/plugin-vite@^1.1.2`**. The evaluator
+verified `islandSpecifiers?: string[]` exists in **1.1.2** with identical JSDoc
+(`https://jsr.io/@fresh/plugin-vite/1.1.2/src/utils.ts:59-63`) and confirmed the mechanism at
+`src/mod.ts:234-237` (`fConfig.islandSpecifiers.set(spec, name)`). **The D1 conclusion stands; the
+citation was to the wrong version.** The implementer must check any 1.0.8-specific assumption against
+1.1.2.
+
+**B2 — the specifier must be created, not just named.** `packages/fresh/deno.json` has **no**
+sub-export for the defer island today. A1 therefore requires **(a)** adding the sub-export and
+**(b)** naming that specifier in `vite.config.ts.template`'s `fresh({ islandSpecifiers: [...] })`.
+This is an implementer decision, but it is a required step, not an optional detail.
+
+**B3 — the bundle fixture needs a committed location.** A4 says "build the client bundle and assert
+the island is present" without saying where the fixture lives. There is **no `vite build` fixture
+under `packages/fresh/tests/` today**. The implementer must commit to a location — a fixture under
+`packages/fresh/tests/fixtures/` with a `Deno.test` wrapper, or a scaffolded-app fixture under
+`packages/cli/e2e/` — and add it **in the same PR**, not defer it.
+
+**B4 — migration accepted as scoped.** Already-generated apps do not auto-migrate; carrying either a
+template-regeneration commit or a tracked migration issue is acceptable.
diff --git a/.llm/runs/release-0.0.6-features--orchestration/slices/research-1459.md b/.llm/runs/release-0.0.6-features--orchestration/slices/research-1459.md
new file mode 100644
index 0000000000..8379c20733
--- /dev/null
+++ b/.llm/runs/release-0.0.6-features--orchestration/slices/research-1459.md
@@ -0,0 +1,121 @@
+# Research — #1459 `DeferComponent` is not hydrated
+
+Delegated read-only sub-agent (Claude · Opus 5, `drift.md` D-1), bounded brief — 27 tool calls,
+~3 min, within budget. Static analysis only; nothing built, run, or reproduced.
+
+## The reported defect is confirmed, and its cause is simpler than "hydration is broken"
+
+**`DeferIsland.tsx` is not an island at all.** There is no island registration for it anywhere in the
+repo.
+
+- It is a **named** export, not a default export
+  (`packages/fresh/src/application/defer/DeferIsland.tsx:111`), re-exported as an ordinary module
+  symbol (`defer/mod.ts:12`, reachable as `@netscript/fresh/defer`).
+- **The mechanism in this repo is directory convention**, resolved by the stock Fresh Vite plugin.
+  The scaffold calls `fresh()` with **no options**
+  (`packages/cli/src/kernel/assets/app/vite.config.ts.template:41`), and `createNetScriptVitePlugin`
+  contains **zero** island logic — no `islands` match across all 438 lines of
+  `packages/fresh/src/application/vite/vite.ts`. `define-fresh-app.ts:121-135` registers fs-routes
+  only and never passes a `loadIsland`.
+- Every island that actually works in a scaffolded app lives in a **scanned directory**: the app
+  template's `(_islands)/` folders, and `@netscript/fresh-ui` islands, which are **copied into the
+  consumer app** (`packages/fresh-ui/registry/islands/`, registered as copy templates at
+  `registry.generated.ts:334-340`) rather than imported from the package.
+- The contrast that proves the pattern: `QueryIsland`
+  (`packages/fresh/src/application/query/query-island.tsx:39`) ships from the same JSR package and
+  **does** reach the client — because its documented contract is that the **consumer's own** island
+  file imports it (`:26-36`), giving it a scanned entry point. `DeferComponent` has no such entry.
+
+So the component is reached **only** through a server-render path
+(`DeferPage.tsx:8` ← `builders/define-page/runtime/mod.tsx:4`), and nothing in a scanned directory
+transitively imports it. Both candidate causes hold and compound.
+
+## A second, independent defect inside the same issue
+
+`DeferIsland.tsx:222` sets:
+
+```tsx
+f-client-nav={!(isPartialRequest && !hasCachedData)}
+```
+
+`isPartialRequest && !hasCachedData` **is exactly the `partial-miss` condition**. So in precisely the
+case this issue is about, `f-client-nav` is `false` while `f-partial` is set (`:221`). If Fresh only
+intercepts `f-partial` on forms under active client navigation, `requestSubmit()` would trigger a
+**full document navigation**, not the `/partials/**` request the issue requires.
+
+**This is not verified** — Fresh core's form/partial interception was not read, so it is inference
+from the attribute values. But it means **hydration alone may not fix the issue**, and any fix must
+test this line rather than assume it.
+
+## Why no existing test catches this
+
+`decideDeferClientAction` (`policy.ts:177`, `partial-miss` branch at `:178-182`) has **exactly one
+caller** — the client effect at `DeferIsland.tsx:188`. There is no server-side caller. In the shipped
+product it is therefore **never executed at runtime on either side**; its unit coverage is the only
+thing exercising it.
+
+The input plumbing is correct end-to-end (`runtime/mod.tsx:220` → `DeferPage.tsx:170,267-268`), which
+is why this looks healthy from the server side. `DeferIsland.test.ts:1` imports only
+`buildDeferFormState` and `sanitizeDeferSearchParams` and never renders the component.
+
+## Partial-swap behaviour
+
+From `DeferPage.tsx:257-275`: the coordinator form is rendered **as a sibling outside** the
+`<Partial>` — `<div><Partial name={name}>…</Partial><DeferComponent …/></div>`.
+
+- A swap of the region's own partial replaces the content but **leaves the form's DOM node in
+  place**, so even a working island would not naturally re-run its effect (deps at `:201-214` are all
+  props).
+- A **page-level** partial swap re-renders the whole `<div>` including a freshly server-rendered,
+  inert form — with no island marker, Fresh has nothing to hydrate into it.
+
+Nothing in the defer code addresses island persistence or re-hydration across `<Partial>` swaps: no
+`key`, no persistence attribute, no remount handling. The docs describe the transport and make no
+persistence claim (`docs/site/web-layer/defer-streaming-ui.md:238-245`).
+
+## The regression test the issue asks for requires net-new capability
+
+The issue's acceptance says a test should *"build the Fresh client bundle, navigate into a page with
+a cache-miss deferred layer, assert the partial endpoint is requested, and assert the named boundary
+swaps exactly once."*
+
+What exists:
+
+- Pure-function unit tests (`DeferIsland.test.ts`) — never render the component.
+- JSX-tree prop assertions (`define-page/tests/search-params.test.tsx:93-99,115-134`) — could assert
+  an island marker in **server** output, but cannot prove a client bundle.
+- A live Fresh dev server over HTTP (`probe-project-boundary-dev.ts:43` with `FetchHttpAdapter`) —
+  the closest existing "drive a real app".
+
+What does **not** exist:
+
+- **No browser driver.** Playwright appears only in docs and in the CLI *scaffolding* Playwright
+  config for consumer projects (`init-agent.ts`) — not test infra this repo runs.
+- **No gate builds or inspects a client bundle** anywhere in `packages/cli/e2e`.
+
+So the acceptance's regression test needs net-new capability at whichever level it targets.
+
+## Options (research made no recommendation)
+
+| Option | Trade-off |
+| --- | --- |
+| Consumer-side island shim from the scaffold (`routes/(_islands)/DeferIsland.tsx` re-exporting `DeferComponent`) | matches the `QueryIsland`/`fresh-ui` precedent, but every existing scaffolded app needs regeneration, and a consumer who deletes the file silently reintroduces the bug |
+| Copy-mode distribution like `fresh-ui` (`registry.generated.ts`) | consistent with `ui:add`, but forks the island per project so framework fixes stop reaching existing apps |
+| Declare the island from `createNetScriptVitePlugin` | the only option needing no consumer file — but **feasibility unconfirmed**, depends on a `@fresh/plugin-vite` capability not verified |
+| Drop the island; resolve server-side on `ctx.isPartial && !component` | removes the hydration dependency and the `f-client-nav` hazard, but collapses the defer model — the policy branches (`policy.ts:184-208`) have no server equivalent |
+| Inline `<script>` beside the form | cheapest and immune to island-scan mechanics, but forfeits typed policy logic, likely trips CSP, and is doctrine-hostile for `packages/` |
+
+**Every option must additionally resolve the `f-client-nav` question**, or hydration alone produces a
+document navigation instead of the partial request.
+
+## Explicitly not verified
+
+- Whether `@fresh/plugin-vite` exposes any mechanism to register an island from a JSR/npm specifier.
+  The Deno-cache grep was inconclusive; **only "this repo passes no such option" is proven.**
+- Fresh's actual `f-client-nav` / `f-partial` form interception semantics — so the
+  document-navigation claim is inference, not fact.
+- No reproduction: nothing built, no browser, no gates.
+- The `streams`/`shouldStream` sibling path (`runtime/mod.tsx:178`) — deferral only applies when
+  `!shouldStream`, and whether streaming delivery has the same gap is unexamined.
+
+Minor: the `debug` prop is declared (`DeferIsland.tsx:54`) but never destructured (`:111-122`) — dead.
diff --git a/.llm/runs/release-0.0.6-features--orchestration/slices/worklog-1459.md b/.llm/runs/release-0.0.6-features--orchestration/slices/worklog-1459.md
new file mode 100644
index 0000000000..3b11c73a79
--- /dev/null
+++ b/.llm/runs/release-0.0.6-features--orchestration/slices/worklog-1459.md
@@ -0,0 +1,143 @@
+# Worklog — #1459 deferred refresh coordinator hydration
+
+Implementation lane: Codex · GPT-5.6 Sol · high (`complex_implementation`).
+Branch: `fix/1459-defer-island-hydration`.
+Baseline: `origin/main@59e435c5d`.
+
+## Design
+
+- **Profile:** `@netscript/fresh` remains Archetype 4 with the frontend overlay. This slice adds a
+  narrow package subpath and changes the browser behavior materialized by the existing page DSL.
+- **Public surface:** add `@netscript/fresh/defer/island`, backed by
+  `src/application/defer/island.ts`. The entry re-exports only `DeferComponent`, so Fresh 1.1.2 does
+  not mistake the helper functions in `DeferIsland.tsx` for additional islands.
+- **Scaffold contract:** generated app import maps resolve that same specifier in JSR and local
+  source modes, and the Vite template passes it to `fresh({ islandSpecifiers: [...] })`.
+- **Client navigation:** preserve the three already-enabled request/cache combinations and enable
+  the missing fourth (`partial-miss`) by rendering `f-client-nav` unconditionally. The locked
+  `decideDeferClientAction` policy remains unchanged.
+- **Partial lifecycle:** move the existing coordinator vnode inside the named `<Partial>`. A
+  miss-to-hit region swap therefore replaces the coordinator with current props and gives Fresh the
+  registered component identity to hydrate again. The stable-key fallback is unnecessary.
+- **Bundle fixture:** `packages/fresh/tests/fixtures/defer-island-client/`, driven by
+  `packages/fresh/tests/defer-island-client-bundle_test.ts`, builds with the pinned
+  `@fresh/plugin-vite@1.1.2` and inspects the production client manifest and island chunk.
+- **Commit slice:** one implementation slice covers D1–D3 because hydration and client navigation
+  are inseparable. Its gates are the four required regression tests, scoped Fresh/CLI wrappers,
+  package tests, doc lint, `quality:gate`, and the explicit `packages/fresh/src` quality scan.
+- **Migration:** regenerate and commit the embedded CLI template asset. Already-generated apps do
+  not receive the new `fresh()` option; they must regenerate their app scaffold.
+- **Deferred scope:** browser-driven navigation and exact swap-count proof remain in #1557; the
+  dead `debug` prop, streaming delivery, and #1457/#1548 surfaces remain untouched.
+
+## Implementation
+
+- Added the published `./defer/island` export. Its runtime surface contains only
+  `DeferComponent`; the component props and their policy dependencies are type-only exports so
+  Fresh cannot register the helper functions in `DeferIsland.tsx` as islands.
+- Added `@netscript/fresh/defer/island` to the kernel, maintainer-local, and public-JSR resolvers;
+  generated app manifests now carry the literal import-map key in both source modes.
+- Updated the Fresh-init fallback from its stale `@fresh/plugin-vite@^1.0.8` literal to the
+  canonical `SCAFFOLD_APP_CATALOG.FRESH_PLUGIN_VITE` (`^1.1.2`).
+- Regenerated `embedded.generated.ts` and `agent-docs.generated.ts`. The lock change is the
+  `packages/fresh` dependency edge for `jsr:@fresh/plugin-vite@^1.1.2` plus that plugin's resolved
+  Fresh/Vite/Babel graph; no cache or unrelated source dependency churn is present. The graph is
+  required so root `deno ci` sees the new package dependency rather than a dirty or incomplete lock.
+- The bundle fixture aliases only `@opentelemetry/api` to a no-op fixture module. This avoids an
+  unrelated workspace-only telemetry-resolution failure while compiling the real defer island,
+  real policy, and Fresh 1.1.2 client entry.
+
+## Regression tests
+
+- `vite build emits the registered defer island in the client bundle` — builds the committed Vite
+  fixture, asserts exactly one `fresh-island__*` manifest entry, and verifies its emitted chunk
+  contains `partial-miss`.
+- `DeferComponent enables f-client-nav for every request and cache combination` — checks all four
+  `isPartialRequest` × `hasCachedData` combinations, including the formerly-disabled partial miss.
+- `DeferPage server tree carries the registered defer island component identity` — uses the
+  precompiled JSX-tree shape and requires the exact function identity exported by the island
+  subpath.
+- `DeferPage keeps the coordinator inside the named partial across miss-to-hit swaps` — proves the
+  named `<Partial>` is the only outer dynamic child and that both miss and hit trees contain a
+  coordinator with current request/cache props.
+- `published manifest declares every catalog-backed Fresh runtime dependency` now also pins the
+  `./defer/island` export shape. CLI generator/resolver and embedded-template tests cover the JSR,
+  local-source, Fresh-init fallback, and regenerated asset paths.
+
+## Validation
+
+All final commands exited 0. Verbatim terminal output or terminal excerpts follow; the full
+package-test run reported `227 passed | 0 failed`, and the targeted CLI run reported
+`10 passed (23 steps) | 0 failed`.
+
+```text
+$ deno run --allow-read --allow-run .llm/tools/run-deno-check.ts --root packages/fresh --ext ts,tsx
+{"source":{"mode":"selection","cwd":"/home/codex/repos/ns006-1459"},"command":"deno check --unstable-kv <files>","selection":{"filesSelected":188,"batches":2,"failedBatches":0},"summary":{"totalOccurrences":0,"uniqueOccurrences":0,"uniqueCodes":0,"uniquePaths":0},"groups":[]}
+
+$ deno run --allow-read --allow-run .llm/tools/run-deno-lint.ts --root packages/fresh --ext ts,tsx
+{"source":{"mode":"command","cwd":"/home/codex/repos/ns006-1459","exitCode":0},"selection":{"filesSelected":188,"batches":1},"summary":{"totalOccurrences":0,"uniqueOccurrences":0,"uniqueRules":0,"uniquePaths":0},"groups":[]}
+
+$ deno run --allow-read --allow-run .llm/tools/run-deno-fmt.ts --root packages/fresh --ext ts,tsx
+{"command":"deno fmt --check","cwd":"/home/codex/repos/ns006-1459","mode":"check","summary":{"filesSelected":188,"batches":1,"failedBatches":0,"findings":0,"ignoredFindings":0},"findings":[]}
+
+$ deno task --cwd packages/fresh test
+ok | 227 passed | 0 failed (8s)
+
+$ deno task doc:lint --root packages/fresh --pretty
+"summary": {
+  "totalPackages": 1,
+  "totalErrors": 44,
+  "totalPrivateTypeRef": 27,
+  "totalMissingJSDoc": 17,
+  "totalOther": 0
+}
+...
+{
+  "path": "./src/application/defer/island.ts",
+  "privateTypeRef": 0,
+  "missingJSDoc": 0,
+  "other": 0,
+  "total": 0
+}
+
+$ deno run --allow-read --allow-run .llm/tools/run-deno-check.ts --root packages/cli --ext ts,tsx
+{"source":{"mode":"selection","cwd":"/home/codex/repos/ns006-1459"},"command":"deno check --unstable-kv <files>","selection":{"filesSelected":861,"batches":8,"failedBatches":0},"summary":{"totalOccurrences":0,"uniqueOccurrences":0,"uniqueCodes":0,"uniquePaths":0},"groups":[]}
+
+$ deno run --allow-read --allow-run .llm/tools/run-deno-lint.ts --root packages/cli --ext ts,tsx
+{"source":{"mode":"command","cwd":"/home/codex/repos/ns006-1459","exitCode":0},"selection":{"filesSelected":861,"batches":5},"summary":{"totalOccurrences":0,"uniqueOccurrences":0,"uniqueRules":0,"uniquePaths":0},"groups":[]}
+
+$ deno run --allow-read --allow-run .llm/tools/run-deno-fmt.ts --root packages/cli --ext ts,tsx
+{"command":"deno fmt --check","cwd":"/home/codex/repos/ns006-1459","mode":"check","summary":{"filesSelected":861,"batches":5,"failedBatches":0,"findings":0,"ignoredFindings":0},"findings":[]}
+
+$ deno run --allow-read .llm/tools/quality/scan-code-quality.ts --root packages/fresh/src
+{"ok":true,"mode":"repository","scanned":["packages/fresh/src"],"findings":[],"allowCount":1,"allowances":[{"file":"packages/fresh/src/application/builders/define-page/builder/route-support.ts","line":96,"reason":"DefinePageWithRouteContract preserves prior path/search output when either optional schema is omitted, but BoundRouteContract maps an omitted schema to EmptyRecord; TypeScript cannot equate those conditional states without presence-specific legacy builder overloads"}]}
+
+$ deno task quality:gate
+Task quality:gate deno task quality:scan && deno task arch:check
+Task quality:scan deno run --allow-read .llm/tools/quality/scan-code-quality.ts
+{"ok":true,"mode":"repository","scanned":["packages/cli/src","plugins"],"findings":[],"allowCount":7,"allowances":[...]}
+Task arch:check deno task deps:check && deno run --allow-read .llm/tools/fitness/check-doctrine.ts ...
+```
+
+The package-quality verdict for `packages/fresh` rests on the explicit target scan above because
+root `arch:check` does not include this package.
+
+Two required gates were red during implementation and were corrected rather than bypassed:
+
+```text
+$ deno run --allow-read --allow-run .llm/tools/run-deno-check.ts --root packages/fresh --ext ts,tsx
+{"source":{"mode":"selection","cwd":"/home/codex/repos/ns006-1459"},"command":"deno check --unstable-kv <files>","selection":{"filesSelected":188,"batches":2,"failedBatches":1},"summary":{"totalOccurrences":2,"uniqueOccurrences":2,"uniqueCodes":2,"uniquePaths":1},"groups":[{"code":"TS9036","message":"Move the expression in default export to a variable and add a type annotation to it.","count":1,"paths":[{"path":"/home/codex/repos/ns006-1459/packages/fresh/tests/fixtures/defer-island-client/vite.config.ts","count":1,"locations":[{"line":5,"column":1}]}]},{"code":"TS9037","message":"Default exports can't be inferred with --isolatedDeclarations.","count":1,"paths":[{"path":"/home/codex/repos/ns006-1459/packages/fresh/tests/fixtures/defer-island-client/vite.config.ts","count":1,"locations":[{"line":5,"column":16}]}]}]}
+
+$ deno run --allow-read --allow-run .llm/tools/run-deno-fmt.ts --root packages/fresh --ext ts,tsx
+{"command":"deno fmt --check","cwd":"/home/codex/repos/ns006-1459","mode":"check","summary":{"filesSelected":188,"batches":1,"failedBatches":1,"findings":1,"ignoredFindings":0},"findings":[{"path":"/home/codex/repos/ns006-1459/packages/fresh/src/application/defer/island.ts","reason":"-export type {"}]}
+```
+
+The first was fixed by assigning an explicitly typed `UserConfig` before default export; the
+second by formatting the type-only exports. Both green reruns are included above.
+
+## Not verified in this lane
+
+- No browser-driven navigation or exact one-swap assertion was run; #1557 owns that criterion.
+- `scaffold-static` was not run locally; the scoped CLI wrappers, targeted generator/registry
+  tests, and regenerated embedded asset are green, and CI is expected to exercise that suite.
+- The PR remains draft and no IMPL-EVAL was triggered.
diff --git a/deno.lock b/deno.lock
index a541d40880..c0f8f88866 100644
--- a/deno.lock
+++ b/deno.lock
@@ -3841,6 +3841,7 @@
       "packages/fresh": {
         "dependencies": [
           "jsr:@fresh/core@^2.3.3",
+          "jsr:@fresh/plugin-vite@^1.1.2",
           "jsr:@netscript/ai@0.0.5",
           "jsr:@netscript/plugin-streams-core@0.0.5",
           "jsr:@netscript/sdk@0.0.5",
diff --git a/packages/cli/src/kernel/adapters/scaffold/fresh-adapter.ts b/packages/cli/src/kernel/adapters/scaffold/fresh-adapter.ts
index 155d7ab398..3d40094e6c 100644
--- a/packages/cli/src/kernel/adapters/scaffold/fresh-adapter.ts
+++ b/packages/cli/src/kernel/adapters/scaffold/fresh-adapter.ts
@@ -11,6 +11,7 @@
 import type { FileSystemPort } from '../../ports/file-system-port.ts';
 import type { ScaffoldResult } from '../../domain/core-types.ts';
 import type { PackageSourceMode } from '../../domain/scaffold/scaffold-options.ts';
+import { SCAFFOLD_APP_CATALOG } from '../../constants/scaffold/scaffold-app-catalog.ts';
 
 // ============================================================================
 // TYPES
@@ -142,7 +143,7 @@ export async function normalizeFreshOutput(
 
       // Ensure Vite and Fresh plugin imports exist
       config.imports ??= {};
-      config.imports['@fresh/plugin-vite'] ??= 'jsr:@fresh/plugin-vite@^1.0.8';
+      config.imports['@fresh/plugin-vite'] ??= SCAFFOLD_APP_CATALOG.FRESH_PLUGIN_VITE;
       config.imports['vite'] ??= 'npm:vite@^7.2.2';
 
       await fs.writeFile(denoJsonPath, JSON.stringify(config, null, 2) + '\n');
diff --git a/packages/cli/src/kernel/adapters/scaffold/import-resolver.ts b/packages/cli/src/kernel/adapters/scaffold/import-resolver.ts
index d380eced8f..88f067054d 100644
--- a/packages/cli/src/kernel/adapters/scaffold/import-resolver.ts
+++ b/packages/cli/src/kernel/adapters/scaffold/import-resolver.ts
@@ -105,6 +105,7 @@ const PACKAGE_TO_JSR: Record<string, string> = {
   [SCAFFOLD_PACKAGES.NETSCRIPT_PRISMA_ADAPTER_MYSQL]: JSR_SPECIFIERS['prisma-adapter-mysql'],
   [SCAFFOLD_PACKAGES.NETSCRIPT_ASPIRE]: JSR_SPECIFIERS.aspire,
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH]: JSR_SPECIFIERS.fresh,
+  [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_DEFER_ISLAND]: `${JSR_SPECIFIERS.fresh}/defer/island`,
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_BUILDERS]: `${JSR_SPECIFIERS.fresh}/builders`,
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_QUERY]: `${JSR_SPECIFIERS.fresh}/query`,
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_ROUTE]: `${JSR_SPECIFIERS.fresh}/route`,
@@ -182,6 +183,8 @@ const PACKAGE_TO_LOCAL_PATH: Readonly<Record<string, string>> = {
   [SCAFFOLD_PACKAGES.NETSCRIPT_PRISMA_ADAPTER_MYSQL]: 'packages/prisma-adapter-mysql/src/mod.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_ASPIRE]: 'packages/aspire/mod.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH]: 'packages/fresh/mod.ts',
+  [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_DEFER_ISLAND]:
+    'packages/fresh/src/application/defer/island.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_BUILDERS]: 'packages/fresh/src/application/builders/mod.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_QUERY]: 'packages/fresh/src/application/query/mod.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_ROUTE]: 'packages/fresh/src/application/route/mod.ts',
diff --git a/packages/cli/src/kernel/adapters/scaffold/tests/fresh-adapter_test.ts b/packages/cli/src/kernel/adapters/scaffold/tests/fresh-adapter_test.ts
index 139d331c1a..c6179afff1 100644
--- a/packages/cli/src/kernel/adapters/scaffold/tests/fresh-adapter_test.ts
+++ b/packages/cli/src/kernel/adapters/scaffold/tests/fresh-adapter_test.ts
@@ -95,7 +95,10 @@ describe('normalizeFreshOutput', () => {
     assertEquals(config.tasks.build, 'deno run -A npm:vite build');
     assertEquals(config.tasks.serve, 'deno run -A npm:vite preview');
     // Vite and Fresh plugin imports should be added
-    assert(config.imports['@fresh/plugin-vite']);
+    assertEquals(
+      config.imports['@fresh/plugin-vite'],
+      'jsr:@fresh/plugin-vite@^1.1.2',
+    );
     assert(config.imports['vite']);
   });
 
diff --git a/packages/cli/src/kernel/adapters/templates/app/generate-app-deno-json.ts b/packages/cli/src/kernel/adapters/templates/app/generate-app-deno-json.ts
index 2d4ebc0ee5..b8337b7719 100644
--- a/packages/cli/src/kernel/adapters/templates/app/generate-app-deno-json.ts
+++ b/packages/cli/src/kernel/adapters/templates/app/generate-app-deno-json.ts
@@ -46,6 +46,7 @@ export function generateAppDenoJson(options: AppDenoJsonOptions): string {
   const resolvedImports = options.importMode === 'jsr' && options.jsrResolver
     ? options.jsrResolver.resolveImports([
       SCAFFOLD_PACKAGES.NETSCRIPT_FRESH,
+      SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_DEFER_ISLAND,
       SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_BUILDERS,
       SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_QUERY,
       SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_ROUTE,
@@ -64,6 +65,9 @@ export function generateAppDenoJson(options: AppDenoJsonOptions): string {
   };
   const directNetScriptImports = {
     [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH]: resolvedImports[SCAFFOLD_PACKAGES.NETSCRIPT_FRESH],
+    [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_DEFER_ISLAND]: resolvedImports[
+      SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_DEFER_ISLAND
+    ],
     [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_UI]: resolvedImports[
       SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_UI
     ],
diff --git a/packages/cli/src/kernel/assets/agent-docs.generated.ts b/packages/cli/src/kernel/assets/agent-docs.generated.ts
index cd38e91433..cd9a3f0686 100644
--- a/packages/cli/src/kernel/assets/agent-docs.generated.ts
+++ b/packages/cli/src/kernel/assets/agent-docs.generated.ts
@@ -254,6 +254,7 @@ export const EMBEDDED_AGENT_DOCS_PACKAGE_EXPORTS: Readonly<Record<string, readon
     './ai/sandbox',
     './builders',
     './defer',
+    './defer/island',
     './desktop',
     './error',
     './form',
diff --git a/packages/cli/src/kernel/assets/app/vite.config.ts.template b/packages/cli/src/kernel/assets/app/vite.config.ts.template
index 8d59feba52..12935451e9 100644
--- a/packages/cli/src/kernel/assets/app/vite.config.ts.template
+++ b/packages/cli/src/kernel/assets/app/vite.config.ts.template
@@ -37,7 +37,7 @@ export default defineConfig(({ mode }) => {
       host: env.NETSCRIPT_VITE_HOST ?? '0.0.0.0',
     },
     plugins: [
-      fresh(),
+      fresh({ islandSpecifiers: ['@netscript/fresh/defer/island'] }),
       tailwindCSS(),
       createNetScriptVitePlugin({
         appRoot,
diff --git a/packages/cli/src/kernel/assets/embedded.generated.ts b/packages/cli/src/kernel/assets/embedded.generated.ts
index ffcbfa437a..2e99222fcd 100644
--- a/packages/cli/src/kernel/assets/embedded.generated.ts
+++ b/packages/cli/src/kernel/assets/embedded.generated.ts
@@ -110,7 +110,7 @@ const template_051 =
 const template_052 =
   "import { createDefine } from 'fresh';\nimport { definePage as createDefinePage } from '@netscript/fresh/builders';\n\nexport type State = Record<string, never>;\n\nexport const define = createDefine<State>();\n\nexport function definePage() {\n  return createDefinePage<State>();\n}\n";
 const template_053 =
-  "import { fresh } from '@fresh/plugin-vite';\nimport tailwindCSS from '@tailwindcss/vite';\nimport { resolve } from 'node:path';\nimport process from 'node:process';\nimport { createNetScriptVitePlugin } from '@netscript/fresh/vite';\nimport { defineConfig, loadEnv } from 'vite';\n\nconst appRoot = resolve(import.meta.dirname!, '.');\nconst workspaceRoot = resolve(import.meta.dirname!, '../..');\n\nexport default defineConfig(({ mode }) => {\n  const env = loadEnv(mode, appRoot, '');\n  const aliasEntries = [\n    { find: '@app/assets', replacement: resolve(appRoot, 'assets') },\n    { find: '@app/components', replacement: resolve(appRoot, 'components') },\n    { find: '@app/islands', replacement: resolve(appRoot, 'islands') },\n    { find: '@app/lib', replacement: resolve(appRoot, 'lib') },\n    { find: '@app/routes', replacement: resolve(appRoot, 'routes') },\n    { find: '@app', replacement: appRoot },\n    {\n      find: '@plugins/workers/streams',\n      replacement: resolve(workspaceRoot, 'plugins/workers/streams/mod.ts'),\n    },\n    {\n      find: '@plugins/sagas/streams',\n      replacement: resolve(workspaceRoot, 'plugins/sagas/streams/mod.ts'),\n    },\n    {\n      find: '@plugins/triggers/streams',\n      replacement: resolve(workspaceRoot, 'plugins/triggers/streams/mod.ts'),\n    },\n  ];\n\n  return {\n    server: {\n      port: Number.parseInt(env.NETSCRIPT_VITE_PORT ?? process.env.PORT ?? '5173', 10),\n      host: env.NETSCRIPT_VITE_HOST ?? '0.0.0.0',\n    },\n    plugins: [\n      fresh(),\n      tailwindCSS(),\n      createNetScriptVitePlugin({\n        appRoot,\n        workspaceRoot,\n        aliasEntries,\n        watchPaths: [\n          resolve(workspaceRoot, 'packages'),\n          resolve(workspaceRoot, 'contracts'),\n          resolve(workspaceRoot, 'plugins'),\n        ],\n        routeManifest: {},\n      }),\n    ],\n    build: {\n      rollupOptions: {\n        output: {\n          entryFileNames: `[name].mjs`,\n          chunkFileNames: `[name].mjs`,\n        },\n      },\n    },\n  };\n});\n";
+  "import { fresh } from '@fresh/plugin-vite';\nimport tailwindCSS from '@tailwindcss/vite';\nimport { resolve } from 'node:path';\nimport process from 'node:process';\nimport { createNetScriptVitePlugin } from '@netscript/fresh/vite';\nimport { defineConfig, loadEnv } from 'vite';\n\nconst appRoot = resolve(import.meta.dirname!, '.');\nconst workspaceRoot = resolve(import.meta.dirname!, '../..');\n\nexport default defineConfig(({ mode }) => {\n  const env = loadEnv(mode, appRoot, '');\n  const aliasEntries = [\n    { find: '@app/assets', replacement: resolve(appRoot, 'assets') },\n    { find: '@app/components', replacement: resolve(appRoot, 'components') },\n    { find: '@app/islands', replacement: resolve(appRoot, 'islands') },\n    { find: '@app/lib', replacement: resolve(appRoot, 'lib') },\n    { find: '@app/routes', replacement: resolve(appRoot, 'routes') },\n    { find: '@app', replacement: appRoot },\n    {\n      find: '@plugins/workers/streams',\n      replacement: resolve(workspaceRoot, 'plugins/workers/streams/mod.ts'),\n    },\n    {\n      find: '@plugins/sagas/streams',\n      replacement: resolve(workspaceRoot, 'plugins/sagas/streams/mod.ts'),\n    },\n    {\n      find: '@plugins/triggers/streams',\n      replacement: resolve(workspaceRoot, 'plugins/triggers/streams/mod.ts'),\n    },\n  ];\n\n  return {\n    server: {\n      port: Number.parseInt(env.NETSCRIPT_VITE_PORT ?? process.env.PORT ?? '5173', 10),\n      host: env.NETSCRIPT_VITE_HOST ?? '0.0.0.0',\n    },\n    plugins: [\n      fresh({ islandSpecifiers: ['@netscript/fresh/defer/island'] }),\n      tailwindCSS(),\n      createNetScriptVitePlugin({\n        appRoot,\n        workspaceRoot,\n        aliasEntries,\n        watchPaths: [\n          resolve(workspaceRoot, 'packages'),\n          resolve(workspaceRoot, 'contracts'),\n          resolve(workspaceRoot, 'plugins'),\n        ],\n        routeManifest: {},\n      }),\n    ],\n    build: {\n      rollupOptions: {\n        output: {\n          entryFileNames: `[name].mjs`,\n          chunkFileNames: `[name].mjs`,\n        },\n      },\n    },\n  };\n});\n";
 const template_054 =
   "// _aspire-compat.mts — GENERATED BY @netscript/cli. DO NOT EDIT.\n// D-7 workaround: Node.js-compatible copies of @netscript/aspire helpers.\n// Remove when Aspire 13.3 adds Deno runtime support (aspire#15812).\n\nimport { join, resolve } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { execFileSync } from 'node:child_process';\nimport process from 'node:process';\nimport { z } from 'zod';\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface NetScriptConfig {\n  readonly Name: string;\n  readonly Version: string;\n  readonly Otel: { readonly HttpEndpoint: string; readonly Protocol: string };\n  readonly Defaults: {\n    readonly Deno: {\n      readonly Permissions: readonly string[];\n      readonly WatchMode: boolean;\n    };\n  };\n  readonly Databases: Record<string, NetScriptResourceEntry>;\n  readonly Cache: Record<string, NetScriptResourceEntry>;\n  readonly Services: Record<string, NetScriptResourceEntry>;\n  readonly Plugins: Record<string, NetScriptResourceEntry>;\n  readonly BackgroundProcessors: Record<string, NetScriptResourceEntry>;\n  readonly Apps: Record<string, NetScriptResourceEntry>;\n  readonly Tools: Record<string, NetScriptResourceEntry>;\n  readonly PrimaryDatabase?: string;\n  readonly PrimaryCache?: string;\n}\n\nexport interface NetScriptResourceEntry {\n  readonly [key: string]: unknown;\n  readonly DatabaseName?: string;\n  readonly Enabled?: boolean;\n  readonly Engine?: string;\n  readonly PluginReferences?: readonly string[];\n  readonly RequiresDb?: boolean;\n  readonly RequiresKv?: boolean;\n  readonly ServiceReferences?: readonly string[];\n}\n\nexport interface ResourceDependencies {\n  readonly requiresDb: boolean;\n  readonly requiresKv: boolean;\n}\n\nexport type OtelMode = 'denoApp' | 'denoTask' | 'executable';\n\n// Project-specific config generation extends these schemas to preserve literal\n// resource names without importing Deno-owned framework modules into AppHost.\nconst ResourceEntrySchema = z.looseObject({});\nexport const AppEntrySchema = ResourceEntrySchema;\nexport const BackgroundProcessorEntrySchema = ResourceEntrySchema;\nexport const CacheEntrySchema = ResourceEntrySchema;\nexport const DatabaseEntrySchema = ResourceEntrySchema;\nexport const PluginEntrySchema = ResourceEntrySchema;\nexport const ServiceEntrySchema = ResourceEntrySchema;\nexport const ToolEntrySchema = ResourceEntrySchema;\nexport const NetScriptConfigSchema = z.looseObject({\n  Name: z.string(),\n  Version: z.string().default('1.0.0'),\n  Otel: z.looseObject({\n    HttpEndpoint: z.string(),\n    Protocol: z.string(),\n  }),\n  Defaults: z.looseObject({\n    Deno: z.looseObject({\n      Permissions: z.array(z.string()),\n      WatchMode: z.boolean(),\n    }),\n  }),\n  Databases: z.record(z.string(), DatabaseEntrySchema).default({}),\n  Cache: z.record(z.string(), CacheEntrySchema).default({}),\n  Services: z.record(z.string(), ServiceEntrySchema).default({}),\n  Plugins: z.record(z.string(), PluginEntrySchema).default({}),\n  BackgroundProcessors: z.record(z.string(), BackgroundProcessorEntrySchema).default({}),\n  Apps: z.record(z.string(), AppEntrySchema).default({}),\n  Tools: z.record(z.string(), ToolEntrySchema).default({}),\n  PrimaryDatabase: z.string().optional(),\n  PrimaryCache: z.string().optional(),\n});\n\n// ============================================================================\n// Constants\n// ============================================================================\n\nexport const OTEL_ENV_VARS = {\n  OTEL_DENO: 'OTEL_DENO',\n  OTEL_EXPORTER_OTLP_ENDPOINT: 'OTEL_EXPORTER_OTLP_ENDPOINT',\n  OTEL_EXPORTER_OTLP_PROTOCOL: 'OTEL_EXPORTER_OTLP_PROTOCOL',\n  OTEL_SERVICE_NAME: 'OTEL_SERVICE_NAME',\n  OTEL_RESOURCE_ATTRIBUTES: 'OTEL_RESOURCE_ATTRIBUTES',\n  OTEL_TRACES_SAMPLER: 'OTEL_TRACES_SAMPLER',\n  OTEL_BSP_SCHEDULE_DELAY: 'OTEL_BSP_SCHEDULE_DELAY',\n  OTEL_BLRP_SCHEDULE_DELAY: 'OTEL_BLRP_SCHEDULE_DELAY',\n  OTEL_METRIC_EXPORT_INTERVAL: 'OTEL_METRIC_EXPORT_INTERVAL',\n  OTEL_METRICS_EXEMPLAR_FILTER: 'OTEL_METRICS_EXEMPLAR_FILTER',\n} as const;\n\nexport const OTEL_DEFAULTS = {\n  PROTOCOL: 'http/protobuf',\n  ENDPOINT: 'http://localhost:4318',\n  SAMPLER: 'always_on',\n  EXPORT_INTERVAL: '1000',\n  EXEMPLAR_FILTER: 'trace_based',\n  DEFAULT_VERSION: '1.0.0',\n} as const;\n\nexport const DASHBOARD_ENV_VARS = {\n  OTLP_HTTP_ENDPOINT: 'ASPIRE_DASHBOARD_OTLP_HTTP_ENDPOINT_URL',\n  ALLOW_UNSECURED_TRANSPORT: 'ASPIRE_ALLOW_UNSECURED_TRANSPORT',\n  UNSECURED_ALLOW_ANONYMOUS: 'ASPIRE_DASHBOARD_UNSECURED_ALLOW_ANONYMOUS',\n} as const;\n\nexport const DEFAULT_PERMISSIONS: readonly string[] = [\n  '--allow-net',\n  '--allow-env',\n  '--allow-read',\n  '--allow-sys',\n] as const;\n\nexport const RESOURCE_DEFAULTS = {\n  Runtime: 'deno',\n  ServiceEntrypoint: 'src/main.ts',\n  AppEntrypoint: 'main.ts',\n  WatchHmrFlag: '--watch-hmr',\n  WatchFlag: '--watch',\n  NodeModulesDirNoneFlag: '--node-modules-dir=none',\n  UnstableWorkerOptionsFlag: '--unstable-worker-options',\n  PortEnvVar: 'PORT',\n  HttpEndpointName: 'http',\n} as const;\n\nconst GARNET_TOOL_RESTORE_TIMEOUT_MS = 10_000;\n\n// ============================================================================\n// Path helpers\n// ============================================================================\n\nexport function resolveWorkspacePath(\n  appHostDir: string,\n  relativePath: string,\n): string {\n  return resolve(appHostDir, relativePath);\n}\n\nexport function resolveDataPath(\n  appHostDir: string,\n  dataPath: string | undefined,\n  resourceName: string,\n): string {\n  const relativePath = dataPath ?? join('.data', resourceName);\n  return resolveWorkspacePath(appHostDir, relativePath);\n}\n\n/**\n * Returns one project-scoped database password for the resident AppHost graph.\n */\nexport function ensureDatabasePassword(appHostDir: string, resourceName: string): string {\n  const secretsDir = resolveWorkspacePath(appHostDir, join('.data', 'aspire-secrets'));\n  const passwordPath = join(secretsDir, `${resourceName}.password`);\n  mkdirSync(secretsDir, { recursive: true, mode: 0o700 });\n\n  if (!existsSync(passwordPath)) {\n    const password = crypto.randomUUID().replaceAll('-', '');\n    try {\n      writeFileSync(passwordPath, password, { encoding: 'utf8', flag: 'wx', mode: 0o600 });\n    } catch (error) {\n      if (!(error instanceof Error) || !('code' in error) || error.code !== 'EEXIST') throw error;\n    }\n  }\n\n  const password = readFileSync(passwordPath, 'utf8').trim();\n  if (!password) throw new Error(`Database password file is empty: ${passwordPath}`);\n  return password;\n}\n\n// ============================================================================\n// Database environment helpers\n// ============================================================================\n\nexport function buildDatabaseUriEnvKey(\n  config: Pick<NetScriptConfig, 'PrimaryDatabase'>,\n): string | null {\n  if (!config.PrimaryDatabase) {\n    return null;\n  }\n\n  const prefix = config.PrimaryDatabase\n    .replace(/[^a-z0-9]+/gi, '_')\n    .replace(/^_+|_+$/g, '')\n    .toUpperCase();\n  return prefix ? `${prefix}_URI` : null;\n}\n\nexport function buildDatabaseProviderEnvVars(\n  config: Pick<NetScriptConfig, 'PrimaryDatabase'>,\n): Record<string, string> {\n  if (!config.PrimaryDatabase) return {};\n  return {\n    DB_PROVIDER: config.PrimaryDatabase,\n    DATABASE_PROVIDER: config.PrimaryDatabase,\n  };\n}\n\nexport function buildSqliteDatabaseUrl(\n  appHostDir: string,\n  databaseKey: string,\n  databaseName: string,\n): string {\n  return pathToFileURL(\n    resolveWorkspacePath(appHostDir, join('database', databaseKey, databaseName)),\n  ).href;\n}\n\n// ============================================================================\n// Permission resolution\n// ============================================================================\n\nexport function resolvePermissions(\n  entryPermissions: readonly string[] | undefined,\n  defaultPermissions: readonly string[],\n  watchMode: boolean = false,\n  watchFlag: string = RESOURCE_DEFAULTS.WatchHmrFlag,\n): string[] {\n  const base = entryPermissions ? [...entryPermissions] : [...defaultPermissions];\n  if (watchMode) {\n    base.push(watchFlag);\n  }\n  return base;\n}\n\n// ============================================================================\n// VITE environment variables\n// ============================================================================\n\nexport interface ViteEnvVarNames {\n  readonly full: string;\n  readonly shorthand: string;\n}\n\nexport function buildViteEnvVarName(\n  resourceName: string,\n  endpointName: string = RESOURCE_DEFAULTS.HttpEndpointName,\n): ViteEnvVarNames {\n  const normalisedResource = normalizeViteIdentifierSegment(resourceName);\n  const normalisedEndpoint = normalizeViteIdentifierSegment(endpointName);\n  const full = `VITE_services__${normalisedResource}__${normalisedEndpoint}__0`;\n  const shorthand = `VITE_${normalisedResource.toUpperCase()}_URL`;\n\n  return { full, shorthand };\n}\n\nfunction normalizeViteIdentifierSegment(value: string): string {\n  return value.replace(/[^a-zA-Z0-9_]/g, '_');\n}\n\n// ============================================================================\n// OTEL environment variables\n// ============================================================================\n\nexport function buildOtelEnvVars(\n  serviceName: string,\n  serviceVersion: string,\n  mode: OtelMode,\n  otlpEndpoint?: string,\n): Record<string, string> {\n  const coreVars: Record<string, string> = {\n    [OTEL_ENV_VARS.OTEL_DENO]: 'true',\n    [OTEL_ENV_VARS.OTEL_SERVICE_NAME]: serviceName,\n    [OTEL_ENV_VARS.OTEL_RESOURCE_ATTRIBUTES]: `service.version=${serviceVersion}`,\n  };\n\n  if (mode === 'denoApp') {\n    return coreVars;\n  }\n\n  const exporterVars: Record<string, string> = otlpEndpoint\n    ? {\n      [OTEL_ENV_VARS.OTEL_EXPORTER_OTLP_ENDPOINT]: otlpEndpoint,\n      [OTEL_ENV_VARS.OTEL_EXPORTER_OTLP_PROTOCOL]: OTEL_DEFAULTS.PROTOCOL,\n    }\n    : {};\n\n  return {\n    ...coreVars,\n    ...exporterVars,\n    [OTEL_ENV_VARS.OTEL_TRACES_SAMPLER]: OTEL_DEFAULTS.SAMPLER,\n    [OTEL_ENV_VARS.OTEL_BSP_SCHEDULE_DELAY]: OTEL_DEFAULTS.EXPORT_INTERVAL,\n    [OTEL_ENV_VARS.OTEL_BLRP_SCHEDULE_DELAY]: OTEL_DEFAULTS.EXPORT_INTERVAL,\n    [OTEL_ENV_VARS.OTEL_METRIC_EXPORT_INTERVAL]: OTEL_DEFAULTS.EXPORT_INTERVAL,\n    [OTEL_ENV_VARS.OTEL_METRICS_EXEMPLAR_FILTER]: OTEL_DEFAULTS.EXEMPLAR_FILTER,\n  };\n}\n\n// ============================================================================\n// Reference extraction\n// ============================================================================\n\nexport function extractServiceReferences(\n  entry: {\n    readonly ServiceReferences?: readonly string[];\n  },\n): string[] {\n  const refs = new Set<string>();\n  if (entry.ServiceReferences) {\n    for (const ref of entry.ServiceReferences) refs.add(ref);\n  }\n  return [...refs];\n}\n\nexport function extractPluginReferences(\n  entry: { readonly PluginReferences?: readonly string[] },\n): string[] {\n  return entry.PluginReferences ? [...entry.PluginReferences] : [];\n}\n\nexport function extractDependencies(\n  entry: { readonly RequiresDb?: boolean; readonly RequiresKv?: boolean },\n): ResourceDependencies {\n  return {\n    requiresDb: entry.RequiresDb ?? false,\n    requiresKv: entry.RequiresKv ?? false,\n  };\n}\n\n// ============================================================================\n// Cache wiring (shared-cache consumer injection seam)\n// ============================================================================\n\n/**\n * Describes how a consumer resource attaches to the primary shared cache.\n * Built once in register-infrastructure and reused by every consumer so a\n * future apphost-compose weave layers over one call site.\n */\nexport interface CacheWiring {\n  /** Cache resource to await readiness on (null for Local/in-process). */\n  readonly resource: unknown;\n  /** Passed to withReference — an endpoint reference or the resource (null for Local). */\n  readonly reference: unknown;\n  /** Explicit env pairs consumers receive (access token, provider, host:port refs). */\n  readonly env: Record<string, unknown>;\n  /** Local mode (DenoKv in-process): consumers inject nothing. */\n  readonly local: boolean;\n}\n\ninterface CacheConsumerBuilder {\n  withEnvironment(key: string, value: unknown): unknown;\n  withReference(reference: unknown): unknown;\n  waitFor(resource: unknown): unknown;\n}\n\n/**\n * Generates a crypto-random base64 access token for the DenoKv Connect\n * container (15 random bytes → base64), matching the historical AddDenoKv port.\n */\nexport function generateAccessToken(): string {\n  const bytes = new Uint8Array(15);\n  crypto.getRandomValues(bytes);\n  let binary = '';\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary);\n}\n\n/**\n * Probes whether a live container runtime is reachable (Docker/Podman daemon\n * up), used by the `Auto` cache arm to pick the container backend. Runs\n * `docker info` with a short timeout; any failure (missing binary, daemon down)\n * reports unavailable so the apphost falls back to the Docker-less Garnet\n * executable. IO stays in the runtime edge (A7/A11).\n */\nexport function isDockerAvailable(): boolean {\n  try {\n    execFileSync('docker', ['info'], { stdio: 'ignore', timeout: 3000 });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Resolves the environment-aware cache backend for the `Auto` mode: honors the\n * explicit `NETSCRIPT_CACHE_MODE` escape hatch (`Container` | `Executable`),\n * otherwise probes the container runtime. Returns true for the container\n * (DenoKv Connect) backend, false for the Docker-less Garnet executable.\n */\nexport function shouldUseContainerCache(): boolean {\n  const override = process.env.NETSCRIPT_CACHE_MODE;\n  if (override === 'Container') return true;\n  if (override === 'Executable') return false;\n  return isDockerAvailable();\n}\n\n/**\n * Ensures the apphost carries a local `garnet-server` dotnet tool manifest and\n * that the tool is restored, then returns the working directory to run it from.\n *\n * This backs the Docker-less Garnet executable arm (#372): the generated\n * apphost runs `dotnet tool run garnet-server` as an Aspire executable resource,\n * which requires a `.config/dotnet-tools.json` manifest listing the pinned tool.\n * The manifest is created (or merged) idempotently and `dotnet tool restore` is\n * invoked best-effort so a fresh clone self-provisions Garnet with no Docker.\n *\n * IO lives here (runtime edge), never in the generator (A7/A11).\n */\nexport function ensureGarnetToolManifest(\n  appHostDir: string,\n  version: string,\n): string {\n  const configDir = join(appHostDir, '.config');\n  const manifestPath = join(configDir, 'dotnet-tools.json');\n\n  let manifest: {\n    version: number;\n    isRoot: boolean;\n    tools: Record<string, { version: string; commands: string[] }>;\n  };\n  if (existsSync(manifestPath)) {\n    try {\n      manifest = JSON.parse(readFileSync(manifestPath, 'utf-8'));\n      if (!manifest.tools) manifest.tools = {};\n    } catch {\n      manifest = { version: 1, isRoot: true, tools: {} };\n    }\n  } else {\n    manifest = { version: 1, isRoot: true, tools: {} };\n  }\n\n  if (!manifest.tools['garnet-server']) {\n    manifest.tools['garnet-server'] = {\n      version,\n      commands: ['garnet-server'],\n    };\n    mkdirSync(configDir, { recursive: true });\n    writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\\n', 'utf-8');\n  }\n\n  // Best-effort restore so `dotnet tool run` resolves offline after first run.\n  try {\n    execFileSync('dotnet', ['tool', 'restore'], {\n      cwd: appHostDir,\n      stdio: 'ignore',\n      timeout: GARNET_TOOL_RESTORE_TIMEOUT_MS,\n    });\n  } catch {\n    // Restore failures surface when the executable resource starts; the\n    // apphost log makes the missing tool actionable rather than silent.\n  }\n\n  return appHostDir;\n}\n\n/**\n * Wires a shared-cache dependency into a consumer builder through a single\n * seam: withReference (endpoint or resource), explicit env vars, then waitFor.\n * Local mode (DenoKv in-process) is a no-op.\n */\nexport async function withCacheReference<T>(\n  builder: T,\n  wiring: CacheWiring | undefined | null,\n): Promise<T> {\n  if (!wiring || wiring.local) {\n    return builder;\n  }\n  const target = builder as unknown as CacheConsumerBuilder;\n  if (wiring.reference) {\n    await target.withReference(wiring.reference);\n  }\n  for (const key of Object.keys(wiring.env)) {\n    await target.withEnvironment(key, wiring.env[key]);\n  }\n  if (wiring.resource) {\n    await target.waitFor(wiring.resource);\n  }\n  return builder;\n}\n\n// ============================================================================\n// Config parsing (Node.js-compatible replacement for parseAppSettings)\n// ============================================================================\n\n/**\n * Parses appsettings.json and returns the NetScript config.\n * Node.js-compatible replacement for @netscript/aspire's parseAppSettings\n * which uses Deno.readTextFile.\n */\nexport function parseAppSettings(\n  filePath: string,\n): { config: NetScriptConfig; warnings: string[] } {\n  const text = readFileSync(filePath, 'utf-8');\n  const json = JSON.parse(text);\n  const netscript = json.NetScript;\n\n  // Apply defaults matching the Zod schema defaults\n  const config: NetScriptConfig = {\n    Name: netscript.Name,\n    Version: netscript.Version ?? '1.0.0',\n    Otel: netscript.Otel ?? { HttpEndpoint: 'http://localhost:4318', Protocol: 'http/protobuf' },\n    Defaults: netscript.Defaults ?? {\n      Deno: {\n        Permissions: ['--allow-net', '--allow-env', '--allow-read', '--allow-sys'],\n        WatchMode: false,\n      },\n    },\n    Databases: netscript.Databases ?? {},\n    Cache: netscript.Cache ?? {},\n    Services: netscript.Services ?? {},\n    Plugins: netscript.Plugins ?? {},\n    BackgroundProcessors: netscript.BackgroundProcessors ?? {},\n    Apps: netscript.Apps ?? {},\n    Tools: netscript.Tools ?? {},\n    PrimaryDatabase: netscript.PrimaryDatabase,\n    PrimaryCache: netscript.PrimaryCache,\n  };\n\n  return { config, warnings: [] };\n}\n";
 const template_055 =
diff --git a/packages/cli/src/kernel/constants/scaffold/scaffold-packages.ts b/packages/cli/src/kernel/constants/scaffold/scaffold-packages.ts
index b4443fb7af..a9531286cd 100644
--- a/packages/cli/src/kernel/constants/scaffold/scaffold-packages.ts
+++ b/packages/cli/src/kernel/constants/scaffold/scaffold-packages.ts
@@ -51,6 +51,7 @@ export const SCAFFOLD_PACKAGES = {
   STD_ASSERT: '@std/assert',
   NETSCRIPT_ASPIRE: '@netscript/aspire',
   NETSCRIPT_FRESH: '@netscript/fresh',
+  NETSCRIPT_FRESH_DEFER_ISLAND: '@netscript/fresh/defer/island',
   NETSCRIPT_FRESH_BUILDERS: '@netscript/fresh/builders',
   NETSCRIPT_FRESH_QUERY: '@netscript/fresh/query',
   NETSCRIPT_FRESH_ROUTE: '@netscript/fresh/route',
diff --git a/packages/cli/src/kernel/templates/app/generators-config_test.ts b/packages/cli/src/kernel/templates/app/generators-config_test.ts
index f6c6f1c396..845123de3c 100644
--- a/packages/cli/src/kernel/templates/app/generators-config_test.ts
+++ b/packages/cli/src/kernel/templates/app/generators-config_test.ts
@@ -88,6 +88,7 @@ describe('generateAppDenoJson', () => {
       importMode: 'jsr',
     }));
     assert(config.imports['@netscript/fresh']);
+    assert(config.imports['@netscript/fresh/defer/island']);
     assert(config.imports['@netscript/fresh-ui']);
     assert(config.imports['@test/contracts']);
     assert(config.imports['@netscript/sdk']);
@@ -132,10 +133,11 @@ describe('generateAppDenoJson', () => {
       'update',
     ]);
     assertEquals(config.exclude, ['**/_fresh/*']);
-    assertEquals(Object.keys(config.imports).slice(0, 6), [
+    assertEquals(Object.keys(config.imports).slice(0, 7), [
       '@app/',
       '@my-project/contracts',
       '@netscript/fresh',
+      '@netscript/fresh/defer/island',
       '@netscript/fresh-ui',
       '@netscript/sdk',
       'fresh',
@@ -155,6 +157,10 @@ describe('generateAppDenoJson', () => {
       importMode: 'local',
       localBase: '../..',
     }));
+    assertEquals(
+      config.imports['@netscript/fresh/defer/island'],
+      '../../packages/fresh/src/application/defer/island.ts',
+    );
     assertEquals(
       config.imports['@netscript/fresh/vite'],
       '../../packages/fresh/src/application/vite/vite.ts',
@@ -245,6 +251,10 @@ describe('generateAppViteConfig', () => {
       appPort: 50_123,
     });
     assertStringIncludes(output, 'createNetScriptVitePlugin');
+    assertStringIncludes(
+      output,
+      "fresh({ islandSpecifiers: ['@netscript/fresh/defer/island'] })",
+    );
     assertStringIncludes(output, "resolve(workspaceRoot, 'packages')");
     assertStringIncludes(output, "resolve(workspaceRoot, 'contracts')");
     assertStringIncludes(output, "resolve(workspaceRoot, 'plugins')");
@@ -279,7 +289,8 @@ describe('generateAppViteConfig', () => {
           output.indexOf("{ find: '@app/routes'"),
     );
     assert(
-      output.indexOf('fresh(),') < output.indexOf('tailwindCSS(),') &&
+      output.indexOf("fresh({ islandSpecifiers: ['@netscript/fresh/defer/island'] }),") <
+          output.indexOf('tailwindCSS(),') &&
         output.indexOf('tailwindCSS(),') <
           output.indexOf('createNetScriptVitePlugin({'),
     );
diff --git a/packages/cli/src/maintainer/adapters/local-import-resolver.ts b/packages/cli/src/maintainer/adapters/local-import-resolver.ts
index 16b6d1f5b7..6987017eb4 100644
--- a/packages/cli/src/maintainer/adapters/local-import-resolver.ts
+++ b/packages/cli/src/maintainer/adapters/local-import-resolver.ts
@@ -42,6 +42,8 @@ const PACKAGE_TO_LOCAL_PATH: Readonly<Record<string, string>> = {
   [SCAFFOLD_PACKAGES.NETSCRIPT_PRISMA_ADAPTER_MYSQL]: 'packages/prisma-adapter-mysql/src/mod.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_ASPIRE]: 'packages/aspire/mod.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH]: 'packages/fresh/mod.ts',
+  [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_DEFER_ISLAND]:
+    'packages/fresh/src/application/defer/island.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_BUILDERS]: 'packages/fresh/src/application/builders/mod.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_QUERY]: 'packages/fresh/src/application/query/mod.ts',
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_ROUTE]: 'packages/fresh/src/application/route/mod.ts',
diff --git a/packages/cli/src/public/adapters/jsr-import-resolver.ts b/packages/cli/src/public/adapters/jsr-import-resolver.ts
index e0d811d88d..d1bf4c6b34 100644
--- a/packages/cli/src/public/adapters/jsr-import-resolver.ts
+++ b/packages/cli/src/public/adapters/jsr-import-resolver.ts
@@ -76,6 +76,7 @@ const REGISTRY_SPECIFIERS: Readonly<Record<string, string>> = {
   [SCAFFOLD_PACKAGES.NETSCRIPT_PRISMA_ADAPTER_MYSQL]: JSR_SPECIFIERS['prisma-adapter-mysql'],
   [SCAFFOLD_PACKAGES.NETSCRIPT_ASPIRE]: JSR_SPECIFIERS.aspire,
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH]: JSR_SPECIFIERS.fresh,
+  [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_DEFER_ISLAND]: `${JSR_SPECIFIERS.fresh}/defer/island`,
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_BUILDERS]: `${JSR_SPECIFIERS.fresh}/builders`,
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_QUERY]: `${JSR_SPECIFIERS.fresh}/query`,
   [SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_ROUTE]: `${JSR_SPECIFIERS.fresh}/route`,
diff --git a/packages/cli/src/public/adapters/jsr-import-resolver_test.ts b/packages/cli/src/public/adapters/jsr-import-resolver_test.ts
index 846b5fea32..04e0b84dde 100644
--- a/packages/cli/src/public/adapters/jsr-import-resolver_test.ts
+++ b/packages/cli/src/public/adapters/jsr-import-resolver_test.ts
@@ -16,6 +16,10 @@ describe('JsrImportResolver', () => {
       resolver.resolveImport(SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_VITE),
       netscriptJsrSpecifier('fresh', '/vite'),
     );
+    assertEquals(
+      resolver.resolveImport(SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_DEFER_ISLAND),
+      netscriptJsrSpecifier('fresh', '/defer/island'),
+    );
     assertEquals(
       resolver.resolveImport(SCAFFOLD_PACKAGES.NETSCRIPT_FRESH_UI_INTERACTIVE),
       netscriptJsrSpecifier('fresh-ui', '/interactive'),
diff --git a/packages/fresh/deno.json b/packages/fresh/deno.json
index 99824e3fa0..0fe3bdc2a3 100644
--- a/packages/fresh/deno.json
+++ b/packages/fresh/deno.json
@@ -10,6 +10,7 @@
     "./builders": "./src/application/builders/mod.ts",
     "./route": "./src/application/route/mod.ts",
     "./defer": "./src/application/defer/mod.ts",
+    "./defer/island": "./src/application/defer/island.ts",
     "./form": "./src/application/form/mod.ts",
     "./error": "./src/diagnostics/error/mod.ts",
     "./streams": "./src/runtime/streams/mod.ts",
@@ -31,6 +32,7 @@
     "publish:dry-run": "deno publish --dry-run --allow-dirty"
   },
   "imports": {
+    "@fresh/plugin-vite": "jsr:@fresh/plugin-vite@^1.1.2",
     "@std/assert": "jsr:@std/assert@^1",
     "@std/http": "jsr:@std/http@^1",
     "@std/path": "jsr:@std/path@^1",
diff --git a/packages/fresh/src/application/defer/DeferIsland.test.ts b/packages/fresh/src/application/defer/DeferIsland.test.ts
index 4dafea3e51..f95d6ba11c 100644
--- a/packages/fresh/src/application/defer/DeferIsland.test.ts
+++ b/packages/fresh/src/application/defer/DeferIsland.test.ts
@@ -1,9 +1,65 @@
-import { buildDeferFormState, sanitizeDeferSearchParams } from './DeferIsland.tsx';
+import { assert, assertEquals, assertStringIncludes } from '@std/assert';
+import { h } from 'preact';
+import { render as renderToString } from 'preact-render-to-string';
+import { Partial } from 'fresh/runtime';
+import {
+  buildDeferFormState,
+  type DeferComponentProps,
+  sanitizeDeferSearchParams,
+} from './DeferIsland.tsx';
+import { DeferComponent } from './island.ts';
+import { DeferPage, type DeferPageProps } from './DeferPage.tsx';
 
-function assertEquals<T>(actual: T, expected: T, message: string) {
-  if (actual !== expected) {
-    throw new Error(`${message}. Expected ${String(expected)}, received ${String(actual)}`);
-  }
+interface VNodeLike {
+  readonly type: unknown;
+  readonly props: Record<string, unknown>;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
+function assertVNode(value: unknown, message: string): asserts value is VNodeLike {
+  assert(isRecord(value), message);
+  assert('type' in value, message);
+  assert('props' in value && isRecord(value.props), message);
+}
+
+function childVNodes(value: unknown): VNodeLike[] {
+  const children = Array.isArray(value) ? value : [value];
+  return children.filter((child): child is VNodeLike => {
+    return isRecord(child) && 'type' in child && 'props' in child && isRecord(child.props);
+  });
+}
+
+function renderDeferPage(
+  overrides: Pick<DeferPageProps, 'component'> & { readonly isPartialRequest: boolean },
+): VNodeLike {
+  const url = new URL('http://localhost/dashboard?tab=activity');
+  const tree = DeferPage({
+    action: '/dashboard',
+    partial: '/partials/dashboard/panel',
+    name: 'panel',
+    fallback: 'loading panel',
+    component: overrides.component,
+    ctx: {
+      url,
+      req: new Request(url, { headers: { 'X-Defer-Prewarm': '1' } }),
+      isPartial: overrides.isPartialRequest,
+    },
+  });
+  assertVNode(tree, 'Expected DeferPage to return a vnode');
+  return tree;
+}
+
+function partialChild(tree: VNodeLike): VNodeLike {
+  // Preact's precompiled JSX stores dynamic children in `exprs` rather than
+  // `children`; support both shapes so this pins the emitted server tree.
+  const children = childVNodes(tree.props.children ?? tree.props.exprs);
+  assertEquals(children.length, 1, 'Expected the region Partial to be the only outer child');
+  const partial = children[0];
+  assert(partial.type === Partial, 'Expected the outer child to be the named Fresh Partial');
+  return partial;
 }
 
 Deno.test('sanitizeDeferSearchParams preserves real route state', () => {
@@ -62,3 +118,68 @@ Deno.test('buildDeferFormState keeps page-state params as GET inputs and only pa
     'Expected the partial URL to keep only partial-specific params',
   );
 });
+
+Deno.test('DeferComponent enables f-client-nav for every request and cache combination', () => {
+  const combinations = [
+    { isPartialRequest: false, hasCachedData: false },
+    { isPartialRequest: false, hasCachedData: true },
+    { isPartialRequest: true, hasCachedData: false },
+    { isPartialRequest: true, hasCachedData: true },
+  ] as const satisfies readonly Pick<
+    DeferComponentProps,
+    'isPartialRequest' | 'hasCachedData'
+  >[];
+
+  for (const combination of combinations) {
+    const html = renderToString(h(DeferComponent, {
+      action: '/dashboard',
+      partial: '/partials/dashboard/panel',
+      ...combination,
+    }));
+
+    assertStringIncludes(
+      html,
+      ' f-client-nav',
+      `Expected client navigation for ${JSON.stringify(combination)}`,
+    );
+  }
+});
+
+Deno.test('DeferPage server tree carries the registered defer island component identity', () => {
+  const partial = partialChild(
+    renderDeferPage({ component: undefined, isPartialRequest: false }),
+  );
+  const coordinator = childVNodes(partial.props.children).find((child) =>
+    child.type === DeferComponent
+  );
+
+  assert(
+    coordinator !== undefined,
+    'Expected server output to carry the exact component exported by the defer island subpath',
+  );
+});
+
+Deno.test('DeferPage keeps the coordinator inside the named partial across miss-to-hit swaps', () => {
+  const states = [
+    renderDeferPage({ component: undefined, isPartialRequest: false }),
+    renderDeferPage({ component: 'loaded panel', isPartialRequest: true }),
+  ];
+
+  for (const [index, tree] of states.entries()) {
+    const partial = partialChild(tree);
+    const partialChildren = childVNodes(partial.props.children);
+    const coordinator = partialChildren.find((child) => child.type === DeferComponent);
+
+    assert(coordinator !== undefined, `Expected swap state ${index} to include the coordinator`);
+    assertEquals(
+      coordinator.props.hasCachedData,
+      index === 1,
+      `Expected swap state ${index} to carry current cache state`,
+    );
+    assertEquals(
+      coordinator.props.isPartialRequest,
+      index === 1,
+      `Expected swap state ${index} to carry current partial-request state`,
+    );
+  }
+});
diff --git a/packages/fresh/src/application/defer/DeferIsland.tsx b/packages/fresh/src/application/defer/DeferIsland.tsx
index 8fb7904e7f..1db2dd475a 100644
--- a/packages/fresh/src/application/defer/DeferIsland.tsx
+++ b/packages/fresh/src/application/defer/DeferIsland.tsx
@@ -219,7 +219,7 @@ export function DeferComponent({
       method='GET'
       action={action}
       f-partial={`${partial}${partialSearchParamsString}`}
-      f-client-nav={!(isPartialRequest && !hasCachedData)}
+      f-client-nav
       style={{ display: 'none' }}
       aria-hidden='true'
     >
diff --git a/packages/fresh/src/application/defer/DeferPage.tsx b/packages/fresh/src/application/defer/DeferPage.tsx
index bfe208c46d..f500f333d2 100644
--- a/packages/fresh/src/application/defer/DeferPage.tsx
+++ b/packages/fresh/src/application/defer/DeferPage.tsx
@@ -258,20 +258,19 @@ export function DeferPage({
     <div>
       <Partial name={name}>
         {hasCachedData ? component : fallback || null}
+        <DeferComponent
+          action={action}
+          partial={partial}
+          partialSearchParams={partialSearchParams}
+          isPartialRequest={isPartialRequest}
+          hasCachedData={hasCachedData}
+          cachedAt={cachedAt}
+          staleTime={resolvedPolicy.staleTimeMs}
+          serverRevalidating={!isPrewarmRequest && (shouldPrewarmStale || shouldPrewarmMiss)}
+          searchParams={searchParams}
+          policy={resolvedPolicy}
+        />
       </Partial>
-
-      <DeferComponent
-        action={action}
-        partial={partial}
-        partialSearchParams={partialSearchParams}
-        isPartialRequest={isPartialRequest}
-        hasCachedData={hasCachedData}
-        cachedAt={cachedAt}
-        staleTime={resolvedPolicy.staleTimeMs}
-        serverRevalidating={!isPrewarmRequest && (shouldPrewarmStale || shouldPrewarmMiss)}
-        searchParams={searchParams}
-        policy={resolvedPolicy}
-      />
     </div>
   );
 }
diff --git a/packages/fresh/src/application/defer/island.ts b/packages/fresh/src/application/defer/island.ts
new file mode 100644
index 0000000000..d2bc5be3f1
--- /dev/null
+++ b/packages/fresh/src/application/defer/island.ts
@@ -0,0 +1,8 @@
+/**
+ * Fresh island entry for the deferred refresh coordinator.
+ *
+ * @module
+ */
+
+export { DeferComponent, type DeferComponentProps } from './DeferIsland.tsx';
+export type { DeferPolicyInput, DeferPolicyProfile, DeferPolicyResolved } from './policy.ts';
diff --git a/packages/fresh/tests/defer-island-client-bundle_test.ts b/packages/fresh/tests/defer-island-client-bundle_test.ts
new file mode 100644
index 0000000000..62f82454ac
--- /dev/null
+++ b/packages/fresh/tests/defer-island-client-bundle_test.ts
@@ -0,0 +1,64 @@
+import { assert, assertEquals, assertStringIncludes } from '@std/assert';
+import { fromFileUrl, join } from '@std/path';
+
+interface ViteManifestEntry {
+  readonly file: string;
+  readonly isEntry?: boolean;
+  readonly name?: string;
+  readonly src?: string;
+}
+
+const FIXTURE_ROOT = fromFileUrl(
+  new URL('./fixtures/defer-island-client/', import.meta.url),
+);
+
+Deno.test('vite build emits the registered defer island in the client bundle', async () => {
+  const outputDir = await Deno.makeTempDir({ prefix: 'netscript-defer-island-' });
+
+  try {
+    const output = await new Deno.Command(Deno.execPath(), {
+      args: [
+        'run',
+        '--no-lock',
+        '-A',
+        'npm:vite@7.2.2',
+        'build',
+        '--config',
+        'vite.config.ts',
+        '--outDir',
+        outputDir,
+      ],
+      cwd: FIXTURE_ROOT,
+      stdout: 'piped',
+      stderr: 'piped',
+    }).output();
+
+    const stderr = new TextDecoder().decode(output.stderr);
+    assertEquals(output.code, 0, `Vite fixture build failed:\n${stderr}`);
+
+    const manifest = JSON.parse(
+      await Deno.readTextFile(join(outputDir, 'client', '.vite', 'manifest.json')),
+    ) as Record<string, ViteManifestEntry>;
+    const islandEntries = Object.values(manifest).filter((entry) =>
+      entry.name?.startsWith('fresh-island__')
+    );
+
+    assertEquals(islandEntries.length, 1, 'Expected exactly one registered island client entry');
+    const islandEntry = islandEntries[0];
+    assert(islandEntry.isEntry, 'Expected the defer island chunk to be a client entry');
+    assertStringIncludes(
+      `${islandEntry.name ?? ''} ${islandEntry.src ?? ''}`,
+      'defer',
+      'Expected the emitted island entry metadata to identify the defer island',
+    );
+
+    const islandBundle = await Deno.readTextFile(join(outputDir, 'client', islandEntry.file));
+    assertStringIncludes(
+      islandBundle,
+      'partial-miss',
+      'Expected the defer client policy to be present in the emitted island bundle',
+    );
+  } finally {
+    await Deno.remove(outputDir, { recursive: true });
+  }
+});
diff --git a/packages/fresh/tests/fixtures/defer-island-client/client.ts b/packages/fresh/tests/fixtures/defer-island-client/client.ts
new file mode 100644
index 0000000000..cb0ff5c3b5
--- /dev/null
+++ b/packages/fresh/tests/fixtures/defer-island-client/client.ts
@@ -0,0 +1 @@
+export {};
diff --git a/packages/fresh/tests/fixtures/defer-island-client/main.ts b/packages/fresh/tests/fixtures/defer-island-client/main.ts
new file mode 100644
index 0000000000..65bc813870
--- /dev/null
+++ b/packages/fresh/tests/fixtures/defer-island-client/main.ts
@@ -0,0 +1,5 @@
+import { App } from 'fresh';
+
+export const app: App<unknown> = new App();
+
+export default app;
diff --git a/packages/fresh/tests/fixtures/defer-island-client/otel-api.ts b/packages/fresh/tests/fixtures/defer-island-client/otel-api.ts
new file mode 100644
index 0000000000..6c7d615c8f
--- /dev/null
+++ b/packages/fresh/tests/fixtures/defer-island-client/otel-api.ts
@@ -0,0 +1,50 @@
+type SpanCallback<T> = () => T;
+
+interface FixtureSpan {
+  addEvent(): void;
+  end(): void;
+  recordException(): void;
+  setAttributes(): void;
+  setStatus(): void;
+}
+
+const span: FixtureSpan = {
+  addEvent() {},
+  end() {},
+  recordException() {},
+  setAttributes() {},
+  setStatus() {},
+};
+
+/** Minimal OpenTelemetry context surface required by the client bundle fixture. */
+export const context: {
+  active(): object;
+  with<T>(value: object, callback: SpanCallback<T>): T;
+} = {
+  active: () => ({}),
+  with: (_value, callback) => callback(),
+};
+
+/** Minimal propagation surface retained by the telemetry facade exports. */
+export const propagation: {
+  extract(value: object): object;
+  inject(value: object): void;
+} = {
+  extract: (value) => value,
+  inject: () => {},
+};
+
+/** Minimal OpenTelemetry trace surface required by the client bundle fixture. */
+export const trace: {
+  getActiveSpan(): undefined;
+  getSpanContext(): undefined;
+  getTracer(): { startSpan(): FixtureSpan };
+  setSpan(value: object, activeSpan: FixtureSpan): object;
+  setSpanContext(value: object): object;
+} = {
+  getActiveSpan: () => undefined,
+  getSpanContext: () => undefined,
+  getTracer: () => ({ startSpan: () => span }),
+  setSpan: (value) => value,
+  setSpanContext: (value) => value,
+};
diff --git a/packages/fresh/tests/fixtures/defer-island-client/vite.config.ts b/packages/fresh/tests/fixtures/defer-island-client/vite.config.ts
new file mode 100644
index 0000000000..c6263daa41
--- /dev/null
+++ b/packages/fresh/tests/fixtures/defer-island-client/vite.config.ts
@@ -0,0 +1,17 @@
+import { fresh } from 'jsr:@fresh/plugin-vite@1.1.2';
+import { resolve } from 'node:path';
+import type { UserConfig } from 'vite';
+
+const config: UserConfig = {
+  root: import.meta.dirname,
+  resolve: {
+    alias: {
+      '@opentelemetry/api': resolve(import.meta.dirname!, 'otel-api.ts'),
+    },
+  },
+  plugins: [
+    fresh({ islandSpecifiers: ['@netscript/fresh/defer/island'] }),
+  ],
+};
+
+export default config;
diff --git a/packages/fresh/tests/package-manifest_test.ts b/packages/fresh/tests/package-manifest_test.ts
index 0831ed7d83..037794d0d0 100644
--- a/packages/fresh/tests/package-manifest_test.ts
+++ b/packages/fresh/tests/package-manifest_test.ts
@@ -4,7 +4,13 @@ import { runtimeCatalogDependencies } from './runtime-catalog-dependencies.ts';
 Deno.test('published manifest declares every catalog-backed Fresh runtime dependency', async () => {
   const manifest = JSON.parse(
     await Deno.readTextFile(new URL('../deno.json', import.meta.url)),
-  ) as { imports?: Record<string, string> };
+  ) as { exports?: Record<string, string>; imports?: Record<string, string> };
+
+  assertEquals(
+    manifest.exports?.['./defer/island'],
+    './src/application/defer/island.ts',
+    'The defer island must remain available through its narrow package subpath',
+  );
 
   // JSR publishes deno.json, not package.json. A dependency present only in the workspace
   // catalog works with a warm contributor cache but fails in clean Vite SSR with