Preserve nonce-authorized SSR styles during hydration and failed runtime delivery

Start with packages/runtime/src/core.ts around the comparison and SSR-style replacement paths, then read packages/runtime/src/host.ts for style creation and nonce handling. Run the affected runtime and server tests under the stated CSP scenarios; done means authorized styles survive hydration and updates, failed delivery preserves the working style with a diagnostic, and explicit or reused nonces work across rendering paths.

Problem and classification

P1 in nonce-based CSP deployments · Required for the 2.0 freeze. Progressive hydration can remove a valid, authorized SSR stylesheet because its temporary comparison stylesheet has no nonce. The replacement stylesheet is also blocked, while the runtime reports that it is observing.

Parent: #445. Implementation detail of #451; completion evidence feeds #454. This is distinct from the existing global-runtime CSP test, which permits style-src 'unsafe-inline'.

Baseline: 70444b18c8102fa7a9d811ec51ef96902573792c. Reproduced on 2026-09-27 in Chromium and WebKit. This new case has not been run in Firefox.

Reproduction and observed behavior

1. Generate CSS and matching hydration data for hidden using the current preset and server/engine API.
2. Serve a document with a nonce-authorized style#master-css containing that CSS and an element with class hidden.
3. Use a nonce-only style policy. The local test policy was:

Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'nonce-review123'; connect-src 'self'

review123 is a fixed reproduction-fixture value, not a production nonce-generation recommendation. The probe used matching external hydration JSON and the built global runtime, with all required same-origin assets served.

4. Start the runtime and observe the document.

Both tested browsers produced:

Before runtime: display = none; SSR style is authorized and active
After hydration: display = block; replacement style nonce = ""; style.sheet = null
Runtime: observing = true; hydration.state = runtime
Failure reason: style#master-css does not match the Rust engine snapshot

Cause and source evidence

• core.ts:295 appends an unnonced comparison style; CSP rejection is misclassified as CSS mismatch.
• core.ts:266 removes the existing SSR style before establishing a usable replacement.
• host.ts:131 creates replacements without a nonce. Current runtime/server option types have no explicit nonce input.

This concerns the native CSP style-element contract, not Master CSS syntax or value support.

Public contract and implementation plan

• Add optional nonce?: string to runtime options and per-document server HTML rendering options. Thread it through one-shot rendering and reusable HTML render sessions. Keep it out of Manifest, hydration data, fingerprints and Rust semantics.
• Use an explicitly provided nonce for owned styles. When omitted, preserve/reuse the nonce of the existing Master-owned SSR style in the same root. Do not scrape unrelated style/script elements or guess a global nonce. Read the DOM .nonce property where nonce hiding applies.
• Apply the resolved nonce before attaching every Master-created style: initial rendering, comparison, fallback and refresh. Preserve existing server-rendered attributes unless explicitly overridden. Reused server renderers must not cache one request's nonce for another request.
• Stage and verify replacement styles before committing the switch. Keep the previous working SSR style if delivery fails; clean up failed temporary/candidate styles. Integrate the browser-attachment mapping from #462 rather than weakening hydration verification.
• Treat unavailable/blocked stylesheets as delivery failures, distinct from semantic mismatch and unsupported rule syntax. Return/throw a structured runtime diagnostic through the existing diagnostic mechanism, and do not leave a failed observation attempt reported as successful. Permit retry after configuration is corrected.
• Document the ESM and server API path, the existing-SSR-style path for the global runtime, and actual CSP/Wasm requirements. Do not claim automatic nonce creation, CSP bypass, or support for every framework's nonce propagation. Framework-owned nonce plumbing remains at the owning host boundary.
• Preserve static delivery: no new runtime injection or Wasm dependency for static users.

Acceptance and validation

• Nonce-authorized SSR CSS remains active through successful hydration and subsequent class updates in Chromium, WebKit and Firefox.
• Pure runtime with an explicit valid nonce works; comparison and replacement styles create no CSP violations.
• An existing Master SSR nonce works when no explicit option is supplied; explicit nonce precedence is tested.
• Missing/incorrect nonce or otherwise unavailable CSSOM yields a clear error and preserves any previously working SSR stylesheet. Recovery does not leave duplicate styles or observers.
• Test genuine hydration mismatch, rejected CSS nodes, refresh, disconnect/re-observe, Document, ShadowRoot and repeated components.
• Server one-shot, renderer and HTML-session paths escape/serialize nonce attributes correctly; sequential requests using one renderer retain their own nonce values.
• Keep existing injection-safety and hydration tampering regressions. Do not replace nonce coverage with an unsafe-inline policy.
• Run affected runtime/server tests, lint, type-check and builds. Measure hydration/replacement cost and runtime payload; remeasure and explain changes over 5%.

Boundaries and sequencing

Dependency: #462. Land the CSSOM attachment correction first because both issues touch hydration and fallback. Add this transport capability without changing class syntax, execution Manifest v1/languageVersion 3, or hydration semantics. No release, CI or package-manager changes are part of this issue. Record combined results under #451/#454 and preserve ongoing #445 work.