diff --git a/internal/fix-sri.mjs b/internal/fix-sri.mjs
new file mode 100644
index 000000000..7ed08e5d8
--- /dev/null
+++ b/internal/fix-sri.mjs
@@ -0,0 +1,276 @@
+#!/usr/bin/env node
+/**
+ * fix-sri.mjs — rewrite every baked SRI hash in an ALREADY-BUILT tree, and nothing else.
+ *
+ * ★ WHY THIS EXISTS, and the premise it CORRECTS.
+ *   The dispatch that asked for this said: "`bun run tree` regenerates manifest.json + leaf pages
+ *   but NOT the baked SRI hashes, so `bun run check:sri` fails." MEASURED 2026-09-23, that is
+ *   FALSE — generate-tree.mjs hashes each bundle (its `integrity` local, ~line 1054) and threads
+ *   the value into every page it writes. Proven by poisoning one leaf's integrity
+ *   (check:sri -> exit 1), running `bun run tree`, and re-checking (exit 0).
+ *
+ *   So the cheap path was never missing. What was missing is the SIGNPOST and the SIZE:
+ *
+ *   1. THE SIGNPOST. check:sri's own failure text said "FIX: run a full `bun run build`". An agent
+ *      that trusts the gate it just ran is then sent straight at the destructive path — whose first
+ *      step deletes public/doxa-maps/ and tears the tree out from under every concurrent reader
+ *      (measured 3+ times: a 461-file phantom deletion, several false "element did not mount"
+ *      diagnoses). The gate was TEACHING the failure mode the build-lock guard exists to prevent.
+ *      That message now names this script. A gate that diagnoses correctly and prescribes the
+ *      dangerous remedy is worse than one that says nothing, because it is obeyed.
+ *
+ *   2. THE SIZE. `bun run tree` is cheap only next to a full build. MEASURED on this box: 2.7-4.5s,
+ *      and it WRITES 1234 files under public/ (450 under public/doxa-maps) every single run,
+ *      because it re-copies 401 runtime assets and re-emits all 48 pages. That churn is not free
+ *      to your neighbours: internal/settled-tree-gate.mjs fails a tree with ANY write in the last
+ *      45s, so one `bun run tree` blinds every other agent's check:settled for three quarters of a
+ *      minute, and those agents are told "do NOT measure or publish this tree."
+ *
+ *      Worse, on a SHARED BRANCH `tree` regenerates pages FROM SOURCE — so it silently bakes a
+ *      neighbour's in-flight .vue edits into leaf pages under YOUR change. Same family as the
+ *      measured hazard of committing a built bundle on a shared branch.
+ *
+ *      This script writes ONLY the pages whose hash actually disagrees. In the normal case that is
+ *      one file, and when the tree is already consistent it is ZERO files — nothing to churn,
+ *      nothing to un-settle, no source re-read at all.
+ *
+ * ★ WHAT IT DOES NOT DO — and this limit is the point, not an omission.
+ *   It makes the HASHES AGREE. It does not make the BUNDLE CORRECT. If public/doxa-maps/x/x.js was
+ *   built from stale source, this bakes a matching hash for stale code and check:sri goes green.
+ *   That is equally true of `bun run tree`, and it is why this is a REPAIR verb, not a build verb:
+ *   build the bundle first (`BUNDLE=x bun x vite build`), then run this to re-agree the leaves.
+ *   Bundle FRESHNESS is a different question with its own gate — `bun run check:composite`.
+ *   It also asserts nothing about how many leaves SHOULD exist; a tree gutted by a partial build
+ *   is still unpublishable after this passes. That is settled-tree-gate.mjs's signal 4.
+ *   The publish runbook still runs BOTH: `bun run check:settled && bun run check:sri`.
+ *
+ * WHAT IT REWRITES
+ *   - every `<script src="<local>.js" integrity="...">` on every index.html in the tree
+ *   - manifest.json's `bundles[].integrity` (what check:catalog-identity compares the LIVE bytes
+ *     against — leaving this stale would trade one broken gate for another)
+ *   - manifest.json's `bundles[].profiles[].embed.script` snippet, which carries its own integrity
+ *     and is pasted VERBATIM by partners (deployment method 2)
+ *   A tag with no integrity at all gets one, in generate-tree's exact emitted shape
+ *   (`integrity="..." crossorigin="anonymous"`), because a leaf shipped without SRI is a silent
+ *   downgrade of a protection this repo deliberately added, and check:sri cannot see it: that gate
+ *   only compares the hashes that are PRESENT.
+ *
+ * USAGE
+ *   node internal/fix-sri.mjs [treeDir ...]   # default public/doxa-maps
+ *   node internal/fix-sri.mjs --dry-run       # report what would change, write nothing
+ *   node internal/fix-sri.mjs --self-test     # NEGATIVE test, see below
+ * Exit 0 = tree consistent. 1 = a referenced script DOES NOT EXIST (torn tree; cannot be
+ * repaired by rehashing — that needs the bundle built). 2 = tree not found.
+ *
+ * NEGATIVE-TESTED via `--self-test`: builds a synthetic tree in a temp dir carrying (a) a leaf with
+ * a WRONG integrity, (b) a leaf with NO integrity, (c) a manifest with a wrong bundle hash and a
+ * wrong embed snippet; requires sri-consistency-check to go RED on it FIRST (a fixer whose check
+ * could not fail proves nothing), then requires green, then requires a second run to write zero
+ * files. Temp dir only — a crash can never leave the real tree edited.
+ */
+import {
+  readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync, rmSync,
+} from 'node:fs'
+import { join, dirname, resolve } from 'node:path'
+import { createHash } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const CHECKER = join(HERE, 'sri-consistency-check.mjs')
+
+const argv = process.argv.slice(2)
+const SELF_TEST = argv.includes('--self-test')
+const DRY = argv.includes('--dry-run')
+const TREES = argv.filter((a) => !a.startsWith('--'))
+
+// One bundle .js is referenced by up to 5 leaves plus the manifest, and these are ~400KB IIFEs,
+// so hashing per REFERENCE instead of per FILE made a 100-reference tree read 100 files. Cache by
+// absolute path: a single run is one pass over an unchanging tree, and the caller is expected to
+// build BEFORE repairing (see the header) — so a mid-run change to a .js is out of contract.
+const HASHES = new Map()
+function sri(file) {
+  let h = HASHES.get(file)
+  if (h === undefined) {
+    h = 'sha384-' + createHash('sha384').update(readFileSync(file)).digest('base64')
+    HASHES.set(file, h)
+  }
+  return h
+}
+
+function leafPages(dir, out = []) {
+  for (const e of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, e.name)
+    if (e.isDirectory()) leafPages(p, out)
+    else if (e.name === 'index.html') out.push(p)
+  }
+  return out
+}
+
+/**
+ * Re-agree every local <script src> tag in `html` with the bytes on disk.
+ * `resolveSrc` maps an href to an absolute path (pages resolve against themselves; the manifest's
+ * embed snippets resolve against the tree root). Third-party (mapbox CDN) srcs are left alone —
+ * we cannot hash what we do not serve.
+ */
+function rewriteTags(html, resolveSrc, st) {
+  return html.replace(/<script\b[^>]*>/g, (tag) => {
+    const src = (tag.match(/\bsrc="([^"]+)"/) || [])[1]
+    if (!src || /^https?:|^\/\//.test(src)) return tag
+    const file = resolveSrc(src)
+    if (!file || !existsSync(file)) { st.missing.push(src); return tag }
+    const want = sri(file)
+    const have = (tag.match(/\bintegrity="(sha384-[^"]+)"/) || [])[1]
+    if (have === want) { st.agreed++; return tag }
+    if (have) {
+      st.rehashed++
+      return tag.replace(/\bintegrity="sha384-[^"]*"/, 'integrity="' + want + '"')
+    }
+    st.added++
+    // Preserve whatever trailing whitespace / self-closing slash the tag had.
+    const m = tag.match(/^([\s\S]*?)(\s*\/?)>$/)
+    return m[1] + ' integrity="' + want + '" crossorigin="anonymous"' + m[2] + '>'
+  })
+}
+
+function fixTree(root) {
+  const st = { agreed: 0, rehashed: 0, added: 0, missing: [], filesWritten: [] }
+  if (!existsSync(root)) {
+    console.error('FIX-SRI: tree not found: ' + root)
+    process.exit(2)
+  }
+
+  for (const page of leafPages(root)) {
+    const before = readFileSync(page, 'utf8')
+    const after = rewriteTags(before, (src) => resolve(dirname(page), src), st)
+    if (after !== before) {
+      if (!DRY) writeFileSync(page, after)
+      st.filesWritten.push(page)
+    }
+  }
+
+  const mf = join(root, 'manifest.json')
+  if (existsSync(mf)) {
+    const before = readFileSync(mf, 'utf8')
+    const m = JSON.parse(before)
+    for (const b of (m.bundles || [])) {
+      if (b.scriptUrl && !/^https?:|^\/\//.test(b.scriptUrl)) {
+        const js = resolve(root, b.scriptUrl)
+        if (existsSync(js)) {
+          const want = sri(js)
+          if (b.integrity !== want) { b.integrity = want; st.rehashed++ } else st.agreed++
+        } else st.missing.push(b.scriptUrl)
+      }
+      for (const p of (b.profiles || [])) {
+        if (!p.embed || typeof p.embed.script !== 'string') continue
+        p.embed.script = rewriteTags(p.embed.script, (src) => resolve(root, src), st)
+      }
+    }
+    // Same serialization generate-tree.mjs uses, so a repair produces no formatting diff.
+    const after = JSON.stringify(m, null, 2) + '\n'
+    if (after !== before) {
+      if (!DRY) writeFileSync(mf, after)
+      st.filesWritten.push(mf)
+    }
+  }
+  return st
+}
+
+function report(root, st) {
+  const verb = DRY ? 'WOULD rewrite' : 'rewrote'
+  console.log(
+    'FIX-SRI[' + root + ']: ' + st.agreed + ' already agreed, ' + verb + ' ' + st.rehashed +
+    ' stale hash(es), added ' + st.added + ' missing one(s), ' +
+    (DRY ? 'would write ' : 'wrote ') + st.filesWritten.length + ' file(s).'
+  )
+  for (const f of st.filesWritten) console.log('  ' + (DRY ? '~ ' : '+ ') + f)
+  if (st.missing.length) {
+    const uniq = [...new Set(st.missing)]
+    console.error('\nFIX-SRI: ' + uniq.length + ' referenced script(s) DO NOT EXIST — rehashing cannot')
+    console.error('         repair this; the bundle has to be BUILT. Run, for each one:')
+    console.error('           BUNDLE=<name> bun x vite build   # then re-run this script')
+    for (const s of uniq.slice(0, 10)) console.error('  missing: ' + s)
+    return 1
+  }
+  return 0
+}
+
+// ── NEGATIVE TEST ────────────────────────────────────────────────────────────────────────────────
+function selfTest() {
+  const dir = join(tmpdir(), 'fix-sri-selftest-' + process.pid)
+  const fails = []
+  const ok = (cond, msg) => { if (!cond) fails.push(msg); else console.log('  ok — ' + msg) }
+  try {
+    rmSync(dir, { recursive: true, force: true })
+    mkdirSync(join(dir, 'b', 'p'), { recursive: true })
+    mkdirSync(join(dir, 'b', 'q'), { recursive: true })
+    writeFileSync(join(dir, 'b', 'b.js'), 'console.log("b")\n')
+    const REAL = sri(join(dir, 'b', 'b.js'))
+    const WRONG = 'sha384-' + 'A'.repeat(64)
+
+    // (a) a leaf whose baked hash is WRONG — the case check:sri exists to catch
+    writeFileSync(join(dir, 'b', 'p', 'index.html'),
+      '<!doctype html><script src="../b.js" integrity="' + WRONG + '" crossorigin="anonymous"></script>\n')
+    // (b) a leaf with NO integrity at all — invisible to check:sri, still a real downgrade
+    writeFileSync(join(dir, 'b', 'q', 'index.html'),
+      '<!doctype html><script src="../b.js"></script>\n')
+    // (c) a manifest with a wrong bundle hash AND a wrong paste-verbatim embed snippet
+    writeFileSync(join(dir, 'manifest.json'), JSON.stringify({
+      schema: 'self-test', bundles: [{
+        bundle: 'b', scriptUrl: './b/b.js', integrity: WRONG,
+        profiles: [{ profile: 'p', embed: { script: '<script src="./b/b.js" integrity="' + WRONG + '"></script>' } }],
+      }],
+    }, null, 2) + '\n')
+
+    // 1. THE CONTROL MUST BE ABLE TO GO RED. A fixer validated by a check that has only ever
+    //    printed PASS proves nothing at all.
+    const red = spawnSync(process.execPath, [CHECKER, dir], { encoding: 'utf8' })
+    ok(red.status === 1, 'check:sri goes RED on the poisoned tree (exit ' + red.status + ', expected 1)')
+    ok(/b\/p\/index\.html/.test(red.stderr + red.stdout),
+      'it goes red for the RIGHT page (b/p/index.html named in the output)')
+
+    // 2. repair
+    const st = fixTree(dir)
+    ok(st.rehashed >= 2, 'rehashed the stale leaf AND the stale manifest bundle (rehashed=' + st.rehashed + ', expected >=2)')
+    ok(st.added === 1, 'added the ONE missing integrity (added=' + st.added + ')')
+    ok(st.missing.length === 0, 'no unresolvable script refs (missing=' + st.missing.length + ')')
+
+    // 3. GREEN AFTER — and not vacuously green: it must have had something to check.
+    const green = spawnSync(process.execPath, [CHECKER, dir], { encoding: 'utf8' })
+    ok(green.status === 0, 'check:sri goes GREEN after the repair (exit ' + green.status + ')')
+    const checked = Number((green.stdout.match(/checked (\d+) script reference/) || [])[1] || 0)
+    ok(checked >= 2, 'the green run actually MEASURED both leaves (checked=' + checked + ', expected >=2) — a tree with nothing to compare also prints PASS')
+
+    // 4. the manifest, which check:sri never reads, is repaired too
+    const m = JSON.parse(readFileSync(join(dir, 'manifest.json'), 'utf8'))
+    ok(m.bundles[0].integrity === REAL, 'manifest bundles[].integrity now matches the bytes')
+    ok(m.bundles[0].profiles[0].embed.script.includes(REAL), 'the paste-verbatim embed snippet now matches the bytes')
+    ok(readFileSync(join(dir, 'b', 'q', 'index.html'), 'utf8').includes('integrity="' + REAL + '" crossorigin="anonymous"'),
+      'the integrity-less leaf gained one, in generate-tree\'s emitted shape')
+
+    // 5. IDEMPOTENT — the whole point is that a consistent tree costs ZERO writes, so running
+    //    this never un-settles the tree for a neighbouring agent.
+    const again = fixTree(dir)
+    ok(again.filesWritten.length === 0, 'a second run writes 0 file(s) (wrote ' + again.filesWritten.length + ')')
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+
+  if (fails.length) {
+    console.error('\nFIX-SRI SELF-TEST: FAIL — ' + fails.length + ' assertion(s):')
+    for (const f of fails) console.error('  ✗ ' + f)
+    process.exit(1)
+  }
+  console.log('\nFIX-SRI SELF-TEST: PASS — the repair is proven against a check that was first proven to fail.')
+}
+
+if (SELF_TEST) {
+  selfTest()
+} else {
+  let code = 0
+  for (const root of (TREES.length ? TREES : ['public/doxa-maps'])) {
+    code = report(root, fixTree(root)) || code
+  }
+  process.exit(code)
+}
diff --git a/internal/sri-consistency-check.mjs b/internal/sri-consistency-check.mjs
index f75807ce7..b52a03fdb 100644
--- a/internal/sri-consistency-check.mjs
+++ b/internal/sri-consistency-check.mjs
@@ -10,8 +10,12 @@
  *   THE MECHANISM (know this before you "just rebuild one bundle"):
  *     `BUNDLE=x bun x vite build`  rewrites  public/doxa-maps/x/x.js
  *     but the leaf page  public/doxa-maps/x/x/index.html  carries a BAKED
- *     integrity="sha384-..." that is only regenerated by `bun run tree`
- *     (internal/generate-tree.mjs), which runs ONLY in the full build.
+ *     integrity="sha384-..." that the per-bundle build does not touch.
+ *   Two things re-bake it. `bun run fix:sri` (internal/fix-sri.mjs) rewrites the hashes and
+ *   NOTHING else. `bun run tree` (internal/generate-tree.mjs) re-bakes them as a side effect of
+ *   regenerating every page from source. NEITHER needs the full build — an earlier version of
+ *   this comment said generate-tree "runs ONLY in the full build", which is false (it is its own
+ *   script) and is exactly why agents kept reaching for the destructive rebuild.
  *   So a single-bundle build leaves the bundle NEWER than its leaf. Publish that pair and
  *   the browser refuses to execute the script:
  *     "Failed to find a valid digest in the 'integrity' attribute for resource ..."
@@ -109,8 +113,22 @@ if (bad.length) {
     console.error('      bundle is : ' + b.got + '...')
   }
   console.error('\n  CAUSE: a single-bundle `BUNDLE=x bun x vite build` rewrote the .js without')
-  console.error('         regenerating the leaf (only the FULL `bun run build` runs `bun run tree`).')
-  console.error('  FIX  : run a full `bun run build` on a SETTLED tree, then re-check. Do NOT publish.')
+  console.error('         re-baking the hash into the leaf that loads it.')
+  console.error('  FIX  : bun run fix:sri        # rewrites ONLY the disagreeing hashes (~0.4s, writes')
+  console.error('                               # only the offending pages, leaves the tree settled)')
+  console.error('         …then re-run this check. Do NOT publish until it passes.')
+  console.error('')
+  console.error('  ★ DO NOT reach for `bun run build` here. This message used to prescribe exactly')
+  console.error('    that, and it is the destructive remedy: its first step DELETES public/doxa-maps/,')
+  console.error('    tearing the tree out from under every other agent reading it (measured 3+ times,')
+  console.error('    incl. a 461-file phantom deletion and several false "element did not mount"')
+  console.error('    diagnoses). A full rebuild cannot fix anything here that rehashing does not —')
+  console.error('    the bundles are already built; only the recorded hashes disagree.')
+  console.error('    `bun run tree` also re-bakes them correctly, but it rewrites 1234 files under')
+  console.error('    public/ every run (measured), which fails your neighbours\' check:settled for 45s')
+  console.error('    and re-reads .vue SOURCE — so on a shared branch it bakes in whatever another')
+  console.error('    agent has half-finished. Prefer fix:sri; use tree when you actually want the')
+  console.error('    pages regenerated from source.')
   process.exit(1)
 }
 
diff --git a/package.json b/package.json
index af4578fec..161082c25 100644
--- a/package.json
+++ b/package.json
@@ -58,6 +58,7 @@
     "check:template-literal": "node internal/template-literal-check.mjs",
     "verify:map-paint": "node internal/verify-map-paint.mjs",
     "check:sri": "node internal/sri-consistency-check.mjs",
+    "fix:sri": "node internal/fix-sri.mjs",
     "check:composite": "node internal/check-composite-freshness.mjs   # a COMPOSITE is a COPY taken at its own build time: fails if a nested child's source is newer than the parent's bundle. NOT in build:unlocked on purpose — there everything was just built, so it could never catch the real case (a PARTIAL build). Run it before PUBLISH.",
     "check:shots": "node internal/check-shot-freshness.mjs   # a README screenshot that predates the bundle it shows is a picture telling a lie — and it looks IDENTICAL to a current one. Compares each shot's PNG against the BUILT BUNDLE it renders (not raw sources: an unbuilt edit is not yet in any leaf). Fix: node internal/readme-shots.mjs",
     "check:library-index": "node internal/check-library-index.mjs   # the DERIVED library menu must not fall behind library/. Compares the index against the newest library SOURCE (not a bundle — this generator scans library/ directly, with no build step between). Fix: bun run library-index",