@@ -72,8 +72,19 @@ the selected `.py` files sequentially to the current board directory.**
    surface shows every exact remote path and exact board target path. It
    rejects empty/dot names, separators, NUL, duplicate targets, paths outside
    the captured directory, and targets over PBLE/1's 128-byte UTF-8 path
-   ceiling. Preserving a remote hierarchy is a future, separately specified
-   extension.
+   ceiling. The action also captures the board-reported `fs_root` and mirrors
+   PBLE/1's protected top-level names: when the captured directory equals that
+   root, a target beginning with lowercase `pyble` or `pble`, or named exactly
+   `boot.py` or `_boot.py`, is blocked before a board listing, Git blob fetch,
+   or PUT. The surface warns whenever the captured destination is the board
+   root. A path-specific localized failure names a selected protected target
+   and instructs the user to close Import, create and enter a child directory
+   such as `/examples` in Files, and then reopen Import so the new destination
+   is captured. The same basename remains valid below a child directory.
+   Ordinary non-protected basenames remain valid at the board root; this is
+   targeted preflight, not a blanket root-import ban or confirm-to-continue
+   warning.
+   Preserving a remote hierarchy is a future, separately specified extension.
 
 5. **Overwrite is always an informed choice.** Review lists the captured board
    directory and marks exact target names already present. Existing
@@ -150,11 +161,13 @@ the selected `.py` files sequentially to the current board directory.**
 
 11. **The delivery remains test-driven and clean-room.** Unit tests cover URL
     and host rejection, ref-to-SHA pinning, lazy traversal, entry filtering,
-    safe target derivation, UTF-8/NUL/size bounds, rate/error mapping, operation
+    safe target derivation (including protected-root rejection and nested-path
+    acceptance), UTF-8/NUL/size bounds, rate/error mapping, operation
     generations, and result accounting. Widget tests use an injected fake
-    GitHub client and `FakeConnection` to prove overwrite consent, all-fetches-
-    before-first-PUT, sequential order, session changes, cancellation, partial
-    truth, refresh, and zero open/run/mkdir calls. Goldens cover compact and
+    GitHub client and `FakeConnection` to prove actionable protected-root
+    guidance, overwrite consent, all-fetches-before-first-PUT, sequential
+    order, session changes, cancellation, partial truth, refresh, and zero
+    open/run/mkdir calls. Goldens cover compact and
     wide layouts, portrait/landscape, loading/error/review/partial states, 2×
     text, high contrast, and keyboard inset. An integration/HIL row imports a
     small public pinned fixture into a disposable board directory and verifies
 
@@ -906,7 +906,17 @@ target = joinBoardPath(capturedCwd, basename(entry.remotePath))
 No remote ancestor is preserved and no `mkdir` is called. Path derivation is a
 pure, tested function. It rejects empty, `.`/`..`, slash/backslash, NUL,
 duplicate target, non-canonical escape, and any complete board path over
-PBLE/1's 128-byte UTF-8 ceiling. The review view renders exact remote → board
+PBLE/1's 128-byte UTF-8 ceiling. The action captures the board-reported
+`fsRoot` alongside `capturedCwd`; presentation shows localized root-destination
+guidance whenever those canonical paths are equal. Target derivation also
+mirrors the PBLE/1 filesystem jail's protected top-level names. At the captured
+root, a basename beginning with lowercase `pyble` or `pble`, or exactly equal
+to `boot.py` or `_boot.py`, raises a sanitized `protectedRootTarget` failure
+before the board listing, Git blob fetch, or PUT. The same basename below any
+child directory remains valid. The localized error names only the safe target
+path and explains that the user must close Import, create and enter a child
+folder such as `/examples` in Files, and reopen Import because `capturedCwd`
+is immutable for that action. The review view renders exact remote → board
 path pairs before a network content fetch or PUT.
 
 `GithubBoardImporter.review()` first requires the captured session stamp to be
@@ -1999,7 +2009,7 @@ This is where the Technical Design meets **Test-Driven Development** ([§0](#0-n
 | `lib/connect/` | saved-board store | scan list (label/PyBLE-XXXX + RSSI), diagnostics, unsupported-version prompt, rename privacy-warn + length bound, Identify shown iff has_identify, configure-LED prompt when identify_led null, EUNSUPPORTED surfaced | — | — | scan→connect→HELLO→DeviceInfo; setLabel/setIdentifyLed/identify round-trips | permission rationale, rename warning |
 | `lib/blocks/` | bridge decode/limits, host epochs, fresh-snapshot correlation, action lock, restore state; GPIO/Time/NeoPixel/TFT definitions, codegen, validation, imports, and name safety; catalog schema/IDs/distinct-role materialization; production-generation of all eight fixtures (no pin/default/profile or device gate); target adoption/path derivation/128-byte preflight, sidecar v1 codec/CRC/exact-source and scratch-round-trip validation; bounded tokenizer/parser/model precedence, imports, names, numeric/range/function/NeoPixel/TFT/resource limits, supported/rejected grammar, all-or-nothing and semantic reparse equality | focused layout, sole Run ownership, off-canvas notices, inspector threshold, console expansion; shared adaptive example/import chooser; Preview non-mutation; empty Create; confirmed/cancelled/failed Replace with workspace+target rollback and host-acknowledged success; duplicate-role/diagnostic/stale-document errors; non-destructive optional/invalid toolbox IDs; no implicit board action; keyboard/semantics | wide landscape with inspector; narrower landscape without; stacked portrait; empty Examples state; exact-reopen/import diagnostics, target paths, and source preview; compact bottom sheet, wider dialog, constrained action overflow, large text, and keyboard inset | source-first/sidecar-last write ordering, no-PUT overlength preflight, local-session stamp lifecycle, board-swap/disconnect refusal before the next sidecar/Run verb, and CRC anchor reuse | every catalog workspace restore→generate; exact pair reopen preserving serialization/target; composed bound-document Python subset→workspace→generate→semantic reparse; torn-pair failures; GPIO/NeoPixel/TFT workspace pair Save→Run on iPadOS + Android | all Blocks/example/import/actions/wiring/diagnostic/validation/semantics labels |
 | `lib/plots/` | SeriesParser | plot render | plot golden | — | live plot from console | — |
-| `lib/github_import/` | canonical URL/host parser; default/explicit ref→full-SHA pin; lazy response models and regular-`.py` filter; safe basename target derivation; strict UTF-8/NUL and 256 KiB/file + 1 MiB/batch bounds; rate/error mapping; operation generations; result accounting | fake-GitHub + FakeConnection resolve/browse/select/review; exact target preview; overwrite consent/recheck; all fetches before first PUT; stable sequential PUT order; pre/during-commit cancellation; session swap; partial truth + refresh; no mkdir/open/run; keyboard/focus/semantics | compact sheet + wide dialog in portrait/landscape; loading, empty, validation, rate-limit, review, overwrite, upload, partial, and complete states; 2× text, high contrast, keyboard inset | — | deterministic mock-HTTP→FakeConnection flow; pinned public fixture→disposable board directory with exact bytes and no execution (HIL) | every field/action/loading/error/rate/overwrite/progress/result/semantics label |
+| `lib/github_import/` | canonical URL/host parser; default/explicit ref→full-SHA pin; lazy response models and regular-`.py` filter; safe basename target derivation with protected-root rejection; strict UTF-8/NUL and 256 KiB/file + 1 MiB/batch bounds; rate/error mapping; operation generations; result accounting | fake-GitHub + FakeConnection resolve/browse/select/review; exact target preview; actionable protected-root guidance with zero board I/O; overwrite consent/recheck; all fetches before first PUT; stable sequential PUT order; pre/during-commit cancellation; session swap; partial truth + refresh; no mkdir/open/run; keyboard/focus/semantics | compact sheet + wide dialog in portrait/landscape; loading, empty, validation, rate-limit, review, overwrite, upload, partial, and complete states; 2× text, high contrast, keyboard inset | — | deterministic mock-HTTP→FakeConnection flow; pinned public fixture→disposable child directory with exact bytes and no execution (HIL) | every field/action/loading/error/rate/overwrite/progress/result/semantics label |
 | `lib/localization/` | key registry | — | — | — | — | parity gate (en vs locale) |
 | `lib/app/` About | runtime build-info adapter + blank/failure formatting | global disconnected/connected entry, full-route/back preservation, offline `LicenseRegistry` navigation, semantics, zero `Connection` calls | phone + iPadOS/Android portrait/landscape, 2× text/high contrast | — | installed version/build smoke on iPadOS + Android | every About/action/privacy/version string |
 
 
@@ -253,9 +253,18 @@ to `[red]` before implementation:
   `join(capturedCwd, basename(remotePath))`. This subset MUST NOT preserve the
   remote parent hierarchy or call `mkdir`. Empty/dot names, separators, NUL,
   duplicate/escaping targets, and targets exceeding PBLE/1's 128-byte UTF-8
-  path ceiling MUST fail before download. Existing regular files MUST be named
-  in a separate explicit overwrite confirmation; an existing directory or
-  other non-regular conflict MUST block import. The board-listing seam MUST
+  path ceiling MUST fail before download. The action MUST capture the
+  board-reported `fs_root` with `capturedCwd` and visibly warn when the two are
+  equal. At that root, a target whose top-level name begins with lowercase
+  `pyble` or `pble`, or is exactly `boot.py` or `_boot.py`, MUST be blocked
+  before the first board listing, Git blob fetch, or PUT. The localized failure
+  MUST name the protected target and instruct the user to close Import, create
+  and enter a child folder such as `/examples` in Files, and reopen Import; the
+  same basename MUST remain valid below a child folder, and an ordinary
+  non-protected basename MUST remain valid at the board root without a separate
+  confirmation. Existing regular files MUST be named in a separate explicit
+  overwrite confirmation; an existing directory or other non-regular conflict
+  MUST block import. The board-listing seam MUST
   preserve PBLE/1's completeness bit, and `FILE_LIST more=1` (or a test double
   that cannot prove completeness) MUST block import rather than treating omitted
   names as absent. The directory MUST be listed again immediately before the
@@ -308,12 +317,15 @@ to `[red]` before implementation:
   invoking Files action on dismissal; important error/final-result
   announcements MUST occur once. MUST
 - **A33-SUB-AC-10 (verification)** — Unit coverage MUST prove URL/host parsing,
-  ref-to-SHA pinning, lazy traversal, filtering, target safety, byte bounds,
+  ref-to-SHA pinning, lazy traversal, filtering, target safety including
+  protected-root rejection and nested-path acceptance, byte bounds,
   strict UTF-8/NUL rejection, rate/error mapping, stale-operation suppression,
   and result accounting. Fake-client/`FakeConnection` widget tests MUST prove
-  overwrite consent, all fetches before the first PUT, sequential order,
-  cancellation/session boundaries, partial truth, refresh, and zero
-  mkdir/open/run calls. Goldens MUST cover compact/wide responsive states,
+  visible root-destination guidance, path-specific protected-root refusal with
+  zero board I/O, nested acceptance, overwrite consent, all fetches before the
+  first PUT, sequential order, cancellation/session boundaries, partial truth,
+  refresh, and zero mkdir/open/run calls. Goldens MUST cover compact/wide
+  responsive states,
   loading/error/review/partial outcomes, portrait/landscape, 2× text, high
   contrast, and keyboard inset. Integration/HIL MUST verify exact imported
   bytes in a disposable board directory and no automatic execution. MUST
 
@@ -476,7 +476,7 @@ before wrap, so the quiescence seam cannot reintroduce ABA.
 
 **Resume on reconnect (F-10):** a link drop mid-`PUT` resets the in-RAM transfer state, but the jailed `<dest>.pbltmp` + its watermark persist on flash. On reconnect a `FILE_PUT_BEGIN` for the same dest returns `resume_offset` = the existing temp length (the contiguous prefix the board itself wrote; the worker re-CRCs `temp[0,len)` to re-seed the running whole-file CRC and set the watermark). `temp_len > total_size` → truncate to 0 (`resume_offset = 0`). The app resumes `FILE_PUT_DATA` from `resume_offset`; the whole-file CRC at `FILE_PUT_END` stays the only correctness gate — a bad/foreign prefix → `ECRC`, temp deleted, **old file kept byte-for-byte** (never a silent corruption or restart-from-zero).
 
-**Workspace jail (F-17):** every path is canonicalized against `fs_root` at a **single chokepoint** before any vfs op; traversal (`../`) / absolute escapes outside `fs_root`, the reserved `.pbltmp` suffix, and reserved agent prefixes → `EACCES` (SEC-4). **`.py` / data only** — the agent never requires, generates, or accepts `.mpy` / `.pyc` transfer artifacts; no server-side compilation.
+**Workspace jail (F-17):** every path is canonicalized against `fs_root` at a **single chokepoint** before any vfs op; traversal (`../`) / absolute escapes outside `fs_root`, the reserved `.pbltmp` suffix, and protected top-level names → `EACCES` (SEC-4). The protected-name predicate is case-sensitive and applies only to the first canonical component relative to `fs_root`: names beginning with lowercase `pyble` or `pble`, plus exact `boot.py` and `_boot.py`, are protected. The same basename below a child directory is allowed, and ordinary root names such as `main.py` remain allowed. **`.py` / data only** — the agent never requires, generates, or accepts `.mpy` / `.pyc` transfer artifacts; no server-side compilation.
 
 ## 6. Run / Stop / Console