Name floating-ui and mcp-app in the vendored-bundle reproducibility rule

[leaf-agent]

scripts/CLAUDE.md tells a session that a clean git status after scripts/vendor.py <bundle> is the check that a bundle still matches the script, and that the check holds only where every fetched input is pinned. It then sorts the bundles into those two classes — and two of the seven are in neither, so a session rebuilding floating-ui or mcp-app has no answer for whether a diff it sees is drift to fix or an upstream patch to take.

Each belongs in a class the paragraph already describes:

• floating-ui reproduces. @floating-ui/dom, @floating-ui/core, and @floating-ui/utils are all in PINS, and that closure is complete: dom depends on core and utils, core on utils, utils on nothing. Rebuilding it left git status clean.
• mcp-app fetches an input PINS does not name. @modelcontextprotocol/ext-apps@1.7.5 declares @standard-schema/spec ^1.1.0, which npm's resolver picks, so the bundle sits with plot and pierre. It reproduced when I rebuilt it today — which is exactly the reading the paragraph exists to keep a session from relying on.

This is drift rather than a deliberate omission. The paragraph dates from c7b37062 (2026-08-30); mcp-app landed in #188 on 2026-09-01 and floating-ui in #537 last night, and #533 — the most recent commit to touch the paragraph — added jsdiff to it, so it is meant to be kept current.

The test follows the shape this repo already uses for instruction lists (#93, #105, #331, #496): it reads the bundle names out of vendor.py's BUILDS and COPIES rather than restating them, and asserts each is named in that one paragraph. On main it fails with unplaced in scripts/CLAUDE.md: ['floating-ui', 'mcp-app'].

What it deliberately does not check is which class a bundle is placed in — deciding that means resolving each package's dependency graph, which is a network call this suite should not make. A name in the wrong class still needs a reader to catch; a name that is absent no longer does.

Verification

• uv run pytest tests/test_interact_layer.py — 167 passed, 6 skipped.
• The new case alone, with scripts/CLAUDE.md reverted to main's text: AssertionError: unplaced in scripts/CLAUDE.md: ['floating-ui', 'mcp-app'].
• scripts/vendor.py floating-ui and scripts/vendor.py mcp-app each left git status clean.
• npm view @floating-ui/dom@1.8.0 dependencies → { '@floating-ui/core': '^1.8.0', '@floating-ui/utils': '^0.2.12' }; @floating-ui/core@1.8.0 → { '@floating-ui/utils': '^0.2.12' }; @floating-ui/utils@0.2.12 → none; @modelcontextprotocol/ext-apps@1.7.5 → { '@standard-schema/spec': '^1.1.0' }.