diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index db21560de..a2df0cd05 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -138,6 +138,7 @@ jobs:
           e2e/preview-scheme.spec.ts
           e2e/preview-head-assets.spec.ts
           e2e/preview-injection-leak.spec.ts
+          e2e/preview-entry-script.spec.ts
 
       # Container suites, one worker: each Tier-2 case holds a live-preview
       # container, prod caps those at 5 *globally* (Sandbox max_instances), and
diff --git a/runner/docs/adr/0033-mcp-service-auth-for-headless-demo-creation.md b/runner/docs/adr/0033-mcp-service-auth-for-headless-demo-creation.md
index b2e480b2b..f36bde7d3 100644
--- a/runner/docs/adr/0033-mcp-service-auth-for-headless-demo-creation.md
+++ b/runner/docs/adr/0033-mcp-service-auth-for-headless-demo-creation.md
@@ -51,6 +51,13 @@ right price for a narrow feature.
   refused, `/package.json` required, and caps of 50 files / 256 KB. Offending payloads are
   **refused, not filtered** — quietly dropping files would build something the caller did
   not write.
+- **The payload has to be able to render**, not just to install. Two request-only gates
+  sit before the budget gate, so a doomed payload never costs a container boot: the
+  manifest must declare the binary its build command invokes (`validateBuildToolchain`,
+  Sentry DEMOS-31), and the framework's HTML entry must load a module
+  (`validateHtmlEntry`, DEV-2741). A document with no `<script>` builds and saves
+  perfectly well and then renders an empty page on `/share`, `/edit` and `/d/:id` alike,
+  because the Tier-1 bundler and `vite build` both derive the module graph from it.
 - **A description is required on this path**, though the editor treats it as optional. A
   demo created from a prompt is read by people who were not in that conversation.
 - **Ownership comparisons fold case; the broker's address is left alone.** `created_by` is
diff --git a/runner/e2e/preview-entry-script.spec.ts b/runner/e2e/preview-entry-script.spec.ts
new file mode 100644
index 000000000..fafdf3fae
--- /dev/null
+++ b/runner/e2e/preview-entry-script.spec.ts
@@ -0,0 +1,101 @@
+import { test, expect, type FrameLocator, type Page } from "@playwright/test";
+import { previewReady } from "./helpers";
+
+// Does a demo whose `index.html` carries no `<script>` still build its grid? (DEV-2741)
+//
+// Reported as a `/share/:id` regression after the DEV-2724 deploy; it was neither. Two
+// production demos — `/share/6n1lu5k2s3` (published the same morning) and
+// `/share/6ri5be5l28` (published the day *before* the deploy) — rendered a bare
+// `<div id="grid">` and nothing else, and their `/d/:id/` artifacts were markup with no
+// bundle in them. Both had been stored by `create_demo` with `/index.html` =
+// `<div id="grid" …></div>` alone.
+//
+// Nothing has a fallback for that. `resolveSandboxEntry` makes the HTML file the sandbox
+// entry for every parcel example, and the bundler's HTML transpiler derives the module
+// graph from its `<script src>` tags; `vite build` reads the same document on the `/d`
+// path. Measured inside the live preview frame: `window.__hotRunnerMonitor` and
+// `window.__hotRunnerScheme` were both undefined and `document.styleSheets.length` was
+// `0` — proof that the module entry, where `withInjections` also writes both receivers,
+// never executed at all.
+//
+// The write gate refuses that payload now (`validateHtmlEntry`) and stored demos are
+// repaired when their source is read (`repairEntryScript`). This spec is the oracle for
+// the visitor: given the reported document, the grid builds.
+//
+// Live — needs the real Sandpack bundler, so it is opt-in like the other render checks,
+// and `stubShell` is deliberately not used (it aborts the bundler hosts, which leaves no
+// preview to read):
+//
+//   E2E_LIVE=1 pnpm e2e e2e/preview-entry-script.spec.ts
+//
+// Note what is NOT asserted: `data-preview-status`. It read `ready` over every one of
+// the blank previews measured above — the status attribute is not an oracle for this.
+
+const PAYLOAD_ID = "q4m7v2x811";
+
+const TITLE = "Entry script repair";
+
+/** The reported shape, verbatim: no document scaffolding and no `<script>` at all. */
+const FRAGMENT_HTML = `<h3>${TITLE}</h3>\n<div id="grid" style="height: 300px; width: 500px;"></div>\n`;
+
+const DEMO_JS = `import Handsontable from 'handsontable';
+import 'handsontable/styles/handsontable.css';
+import 'handsontable/styles/ht-theme-main.css';
+
+new Handsontable(document.getElementById('grid'), {
+  data: [['Tesla', 2017], ['Nissan', 2018], ['Volvo', 2020]],
+  colHeaders: ['Car', 'Year'],
+  rowHeaders: true,
+  height: 300,
+  licenseKey: 'non-commercial-and-evaluation',
+});
+`;
+
+const PAYLOAD = {
+  framework: "javascript",
+  title: "Entry script demo",
+  files: {
+    "/index.html": FRAGMENT_HTML,
+    "/index.js": DEMO_JS,
+    "/package.json": JSON.stringify({ dependencies: { handsontable: "18.0.0" } }, null, 2),
+  },
+};
+
+const preview = (page: Page): FrameLocator => page.frameLocator("iframe").first();
+
+test.describe("a demo whose index.html loads no module still renders", () => {
+  test.skip(process.env.E2E_LIVE !== "1", "set E2E_LIVE=1 to run live-render checks");
+  // Same budget as the sibling live specs: a cold bundler spends more than the 60s
+  // config default inside `previewReady` alone, and a generic "Test timeout exceeded"
+  // would replace whatever this spec measured.
+  test.describe.configure({ timeout: 300_000 });
+
+  test("the grid builds from a script-less index.html", async ({ page }) => {
+    await page.route("**/api/versions", (route) =>
+      route.fulfill({ json: { latest: "18.0.0", next: "19.0.0-next.1", versions: ["18.0.0"] } }),
+    );
+    await page.route("**/broker/userinfo", (route) => route.fulfill({ status: 401, json: {} }));
+    await page.route(`**/api/payload/${PAYLOAD_ID}`, (route) => route.fulfill({ json: PAYLOAD }));
+
+    await page.goto(`/?payload=${PAYLOAD_ID}`);
+    await previewReady(page);
+
+    // The demo's own markup reaching the page proves only that the document was
+    // rendered — which it always was. The grid is the assertion.
+    await expect(preview(page).getByRole("heading", { name: TITLE })).toBeVisible({
+      timeout: 120_000,
+    });
+    await expect(preview(page).locator(".handsontable").first()).toBeVisible({
+      timeout: 120_000,
+    });
+
+    // The second oracle, and the one that fails unambiguously: both receivers are
+    // injected into the *module* entry, so either global being undefined means the
+    // module never ran — the exact measurement taken on the two broken production
+    // demos.
+    const ranTheModule = await preview(page)
+      .locator("#grid")
+      .evaluate(() => Boolean((window as unknown as { __hotRunnerScheme?: boolean }).__hotRunnerScheme));
+    expect(ranTheModule, "the entry module never executed").toBe(true);
+  });
+});
diff --git a/runner/e2e/preview-injection-leak.spec.ts b/runner/e2e/preview-injection-leak.spec.ts
index d390e0b4b..a39b0f728 100644
--- a/runner/e2e/preview-injection-leak.spec.ts
+++ b/runner/e2e/preview-injection-leak.spec.ts
@@ -32,9 +32,11 @@ const PAYLOAD_ID = "lk9x3d7q22";
 
 const TITLE = "beforeKeyDown returning false";
 
-/** The reported shape, and what `create_demo` emits: no `<head>`, and `<body>` alone
- *  on its line. A starter's `index.html` has a `<head>`, which is why every starter
- *  looked fine while a published demo did not. */
+/** The reported shape: no `<head>`, and `<body>` alone on its line. A starter's
+ *  `index.html` has a `<head>`, which is why every starter looked fine while a published
+ *  demo did not. One of two shapes `create_demo` emitted — the other is a bare fragment
+ *  with no `<script>` at all, which rendered nothing anywhere (DEV-2741,
+ *  `preview-entry-script.spec.ts`). */
 const HEADLESS_HTML = `<!doctype html>
 <html>
   <body>
diff --git a/runner/packages/runtime/package.json b/runner/packages/runtime/package.json
index 306dc6cab..86f048b93 100644
--- a/runner/packages/runtime/package.json
+++ b/runner/packages/runtime/package.json
@@ -29,6 +29,10 @@
     "./scheme": {
       "types": "./dist/scheme.d.ts",
       "default": "./dist/scheme.js"
+    },
+    "./entry-script": {
+      "types": "./dist/entry-script.d.ts",
+      "default": "./dist/entry-script.js"
     }
   },
   "scripts": {
diff --git a/runner/packages/runtime/src/entry-script.ts b/runner/packages/runtime/src/entry-script.ts
new file mode 100644
index 000000000..6c47172aa
--- /dev/null
+++ b/runner/packages/runtime/src/entry-script.ts
@@ -0,0 +1,136 @@
+// Does a demo's HTML entry actually load a module? (DEV-2741)
+//
+// A demo saved with `index.html` = `<div id="grid"></div>` and nothing else renders
+// exactly that: an empty div, everywhere. Both consumers of the HTML entry derive the
+// module graph from its `<script>` tags and neither has a fallback —
+//
+//   - Tier 1: `resolveSandboxEntry` makes the HTML file the sandbox entry for every
+//     `parcel`/`static` example (sandbox-entry.ts), and the bundler's HTML transpiler
+//     walks its `<script src>` tags. No tag, no module, no grid — and no error either,
+//     because the compile succeeds. `withInjections` writes the monitor and the scheme
+//     receiver into the JS entry as well, so a preview where `window.__hotRunnerScheme`
+//     is undefined is the tell that the module never ran at all.
+//   - `/d/:id`: `vite build` reads the same document. Its `dist/` comes out holding the
+//     authored HTML and no bundle, which `runBuild`'s only output check — "did it emit
+//     *any* file?" — accepts as a successful build.
+//
+// The same failure class as DEV-2130 ("compiles fine, executes nothing, no banner"),
+// which its entry-exists guard cannot see: `/index.html` is present, it is just inert.
+//
+// The rule here is deliberately the weak one — *some* script, not *the catalog's* entry.
+// A demo whose document loads `/src/main.js` while the catalog's `entry` says
+// `/index.js` builds and renders fine on both paths, and refusing it would be a false
+// rejection of working work. What never renders is a document with no script at all, or
+// one whose only local scripts point at files that were not sent.
+
+import { toFilesKey } from "./html-urls.js";
+
+/** `<script …>`, open tag only. Two copies rather than one shared `/g`: `test()` on a
+ *  global regex advances `lastIndex` and would make the next call answer differently. */
+const SCRIPT_TAG_ALL = /<script\b[^>]*>/gi;
+const SCRIPT_TAG = /<script\b[^>]*>/i;
+
+/**
+ * The `src` of a `<script>` open tag, single- double- or unquoted.
+ *
+ * Anchored on the whitespace that separates HTML attributes rather than on `\b`, which
+ * also fires between the `-` and the `s` of `data-src` — reading a lazy-loading idiom's
+ * `data-src` as the script's real source, and refusing a document that renders fine.
+ */
+const SRC_ATTRIBUTE = /\ssrc\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s">]+))/i;
+
+/** `<!-- … -->`, including one that never closes (the parser discards the rest too). */
+const HTML_COMMENT = /<!--[\s\S]*?(?:-->|$)/g;
+
+/**
+ * The document with its comments removed, which is what both scans below run over.
+ *
+ * A commented-out `<script>` is the likeliest way a working demo loses its entry — an
+ * author disables the tag rather than deleting it — and it is the one input where
+ * getting this wrong is silent in both directions: counted as a script, the repair
+ * no-ops and the preview goes blank with no error; counted as a *live* src, a document
+ * whose real tag sits below the comment reads as dangling and is refused.
+ */
+function stripComments(html: string): string {
+  return html.indexOf("<!--") === -1 ? html : html.replace(HTML_COMMENT, "");
+}
+
+/**
+ * An HTML `src` reduced to the file it names: query and fragment dropped first.
+ *
+ * `src="/index.js?v=2"` is a real thing to write and resolves to `/index.js` for every
+ * bundler that reads this document. `toFilesKey` alone would hand back `/index.js?v=2`,
+ * which is in no file map — and this decides a hard refusal, not (as at `toFilesKey`'s
+ * two other call sites) whether to re-create a `<link>`.
+ */
+function scriptTarget(value: string): string | null {
+  return toFilesKey(value.replace(/[?#].*$/, ""));
+}
+
+export type EntryScriptProblem =
+  /** The document holds no `<script>` at all. */
+  | { kind: "no-script" }
+  /** Every local `<script src>` points at a file that is not in the map. */
+  | { kind: "dangling"; targets: string[] };
+
+/** Every `src` in the document that names a file rather than a URL the browser fetches. */
+export function localScriptTargets(html: string): string[] {
+  const out: string[] = [];
+  for (const tag of stripComments(html).match(SCRIPT_TAG_ALL) ?? []) {
+    const src = SRC_ATTRIBUTE.exec(tag);
+    if (!src) continue;
+    const value = src[1] ?? src[2] ?? src[3] ?? "";
+    const key = scriptTarget(value);
+    if (key !== null) out.push(key);
+  }
+  return out;
+}
+
+/** True when the document carries at least one live `<script>` tag of any kind. */
+export function hasAnyScript(html: string): boolean {
+  return SCRIPT_TAG.test(stripComments(html));
+}
+
+/**
+ * Why this HTML entry will render nothing, or `null` when it will run something.
+ *
+ * A document with an external or inline script is left alone: it may well be a CDN demo,
+ * and this cannot tell the difference between one and a mistake.
+ */
+export function entryScriptProblem(
+  html: string,
+  files: Record<string, string>,
+): EntryScriptProblem | null {
+  if (!hasAnyScript(html)) return { kind: "no-script" };
+  const targets = localScriptTargets(html);
+  if (targets.length === 0) return null; // inline and/or external only — not ours to judge
+  if (targets.some((path) => files[path] !== undefined)) return null;
+  return { kind: "dangling", targets };
+}
+
+/** The tag the starters emit, and the one a repair adds. */
+export function entryScriptTag(entry: string): string {
+  return `<script type="module" src="${entry}"></script>`;
+}
+
+/**
+ * Add the missing entry `<script>` to an HTML entry that has none.
+ *
+ * Before `</body>` when the document has one, appended otherwise — position is not load-
+ * bearing (both bundlers resolve the tag by `src`, not by document order), so a fragment
+ * simply gains the tag at the end. Returns `html` unchanged whenever the document already
+ * has a script of any kind, so it is safe to run on every read and idempotent on its own
+ * output.
+ */
+export function ensureEntryScript(html: string, entry: string): string {
+  if (hasAnyScript(html)) return html;
+  const tag = entryScriptTag(entry);
+  // The captured run of whitespace is reused so the tag lands on its own line at the
+  // body's own indentation instead of being wedged against `</body>`.
+  const close = /(\n[ \t]*)?<\/body\s*>/i.exec(html);
+  if (close) {
+    const gap = close[1] ?? "\n";
+    return html.slice(0, close.index) + gap + tag + html.slice(close.index);
+  }
+  return html.endsWith("\n") ? `${html}${tag}\n` : `${html}${tag}`;
+}
diff --git a/runner/packages/runtime/src/sandpack.ts b/runner/packages/runtime/src/sandpack.ts
index b2d5ed526..0d8a17ec3 100644
--- a/runner/packages/runtime/src/sandpack.ts
+++ b/runner/packages/runtime/src/sandpack.ts
@@ -19,7 +19,7 @@ import type {
 } from "./types.js";
 import { isCompilerUnavailable, transpileFilesForParcel } from "./transpile.js";
 import { applyDepShims } from "./dep-shims.js";
-import { resolveSandboxEntry, toParcelEntry } from "./sandbox-entry.js";
+import { HTML_ENTRY_ENVS, resolveSandboxEntry, toParcelEntry } from "./sandbox-entry.js";
 import {
   MONITOR_COMPILE_MESSAGE_MAX,
   REPORTER_MODULE_LINE,
@@ -28,6 +28,7 @@ import {
   truncateMessage,
 } from "./monitor.js";
 import { injectSchemeReceiver } from "./scheme.js";
+import { ensureEntryScript } from "./entry-script.js";
 import { injectHeadAssets, stripInjectedHeadAssets } from "./head-assets.js";
 import { applyHandsontableCss, applyHandsontableVersion } from "./version.js";
 
@@ -412,7 +413,18 @@ export class SandpackRuntime implements DemoRuntime {
     }
     const moduleEntry = this.env === "parcel" ? toParcelEntry(this.entry.entry) : this.entry.entry;
     if (!targets.includes(moduleEntry)) targets.push(moduleEntry);
-    const withScheme = targets.reduce((acc, path) => injectSchemeReceiver(acc, path), files);
+    // Before anything is injected: a document that loads no module at all runs nothing,
+    // and this tier is the one where that is invisible — the HTML file *is* the sandbox
+    // entry, the bundler builds its graph from the document's `<script src>` tags, and a
+    // compile with nothing in it still succeeds (DEV-2741). The API refuses that shape on
+    // the way in and repairs stored demos on the way out; this covers what neither sees —
+    // an ad-hoc `?payload=` boot, and an edit that deletes the tag mid-session.
+    //
+    // On the derived map only, like every other injection here: the authored file is what
+    // Download-zip and the exports read, and it is not this code's to rewrite. The tag
+    // names `moduleEntry`, which is the compiled name in the parcel view.
+    const repaired = this.ensureEntryScript(files, moduleEntry);
+    const withScheme = targets.reduce((acc, path) => injectSchemeReceiver(acc, path), repaired);
     const withMonitor = this.opts.monitor
       ? targets.reduce((acc, path) => injectReporter(acc, path), withScheme)
       : withScheme;
@@ -439,6 +451,21 @@ export class SandpackRuntime implements DemoRuntime {
     }
   }
 
+  /** The HTML entry with an entry `<script>` added when it has none (DEV-2741). Returns
+   *  the same object when there is nothing to do, which is the overwhelming majority. */
+  private ensureEntryScript(files: FilesMap, moduleEntry: string): FilesMap {
+    const htmlPath = this.entry.htmlEntry;
+    // Only where the document *is* the sandbox entry, so the bundler reads its
+    // `<script src>` tags for the module graph. On `vue-cli` the entry is the module and
+    // the document is along for the ride; a tag there would buy nothing and could load
+    // the entry twice.
+    if (!htmlPath || !this.env || !HTML_ENTRY_ENVS.has(this.env)) return files;
+    const html = files[htmlPath];
+    if (html === undefined || files[moduleEntry] === undefined) return files;
+    const repaired = ensureEntryScript(html, moduleEntry);
+    return repaired === html ? files : { ...files, [htmlPath]: repaired };
+  }
+
   private setupFrom(files: FilesMap): SandboxSetup {
     const sandpackFiles: Record<string, { code: string }> = {};
     for (const [path, code] of Object.entries(files)) {
diff --git a/runner/pipeline/demo-routes-version.test.mjs b/runner/pipeline/demo-routes-version.test.mjs
index 638a98ff1..d1add1c80 100644
--- a/runner/pipeline/demo-routes-version.test.mjs
+++ b/runner/pipeline/demo-routes-version.test.mjs
@@ -277,3 +277,114 @@ test("a browser rebuild falls back to the row's previous concrete ref when the p
   assert.ok(update, "the rebuild must update the demos row");
   assert.equal(update.binds[0], "16.0.2", "the demo stays on the core it was built against");
 });
+
+// DEV-2741. A demo stored with an `index.html` that loads no module renders as an empty
+// page everywhere. The write gate refuses that payload now; these are the demos already
+// in the bucket, repaired the first time their source is read.
+//
+// Measured in production before the fix: `/api/demos/6n1lu5k2s3/source` returned
+// `/index.html` = `<div id="grid" style="height: 460px; width: 100%;"></div>\n`, and the
+// Tier-1 preview frame reported `window.__hotRunnerScheme === undefined` — the module
+// entry, where that receiver is also injected, never ran at all.
+
+const BLANK_HTML = '<div id="grid" style="height: 460px; width: 100%;"></div>\n';
+
+const blankSource = (framework = "javascript") => ({
+  "demos/abc123/__source.json": JSON.stringify({
+    framework,
+    files: {
+      "/package.json": JSON.stringify({ dependencies: { handsontable: "18.1.0" } }),
+      "/index.js": "console.log(1)",
+      "/index.html": BLANK_HTML,
+    },
+  }),
+});
+
+const sourceRequest = (id) =>
+  new Request(`https://demos.handsontable.com/api/demos/${id}/source`);
+
+test("a stored demo whose index.html loads no module is repaired on read", async () => {
+  const { env } = makeEnv([demoRow({ framework: "javascript" })], [], blankSource());
+  const res = await worker.fetch(sourceRequest("abc123"), env, ctx);
+  assert.equal(res.status, 200);
+  const body = await res.json();
+  assert.equal(
+    body.files["/index.html"],
+    `${BLANK_HTML}<script type="module" src="/index.js"></script>\n`,
+  );
+  // Everything else is handed back untouched.
+  assert.equal(body.files["/index.js"], "console.log(1)");
+});
+
+test("the repair is written back, so the next read does not redo it", async () => {
+  const { env, artifacts } = makeEnv([demoRow({ framework: "javascript" })], [], blankSource());
+  await worker.fetch(sourceRequest("abc123"), env, ctx);
+  const stored = artifacts.puts.filter((p) => p.key === "demos/abc123/__source.json");
+  assert.equal(stored.length, 1, "the repair is persisted once");
+  assert.match(JSON.parse(stored[0].value).files["/index.html"], /<script type="module"/);
+
+  const second = await worker.fetch(sourceRequest("abc123"), env, ctx);
+  assert.equal((await second.json()).files["/index.html"], JSON.parse(stored[0].value).files["/index.html"]);
+  assert.equal(
+    artifacts.puts.filter((p) => p.key === "demos/abc123/__source.json").length,
+    1,
+    "a source that already loads its module is not rewritten again",
+  );
+});
+
+test("a demo that already loads its module is served byte-identical and not rewritten", async () => {
+  const html = '<body><div id="grid"></div><script type="module" src="/index.js"></script></body>';
+  const { env, artifacts } = makeEnv([demoRow({ framework: "javascript" })], [], {
+    "demos/abc123/__source.json": JSON.stringify({
+      framework: "javascript",
+      files: { "/package.json": "{}", "/index.js": "x", "/index.html": html },
+    }),
+  });
+  const res = await worker.fetch(sourceRequest("abc123"), env, ctx);
+  assert.equal((await res.json()).files["/index.html"], html);
+  assert.deepEqual(artifacts.puts, [], "nothing is written for a demo that is already fine");
+});
+
+test("a browser Save of a script-less document stores the repaired index.html", async () => {
+  // The counterpart to the MCP routes' 400 (DEV-2741). A person's Save is repaired
+  // rather than refused: their preview already ran the demo — Tier 1 adds the tag to
+  // the bundler's view of the files — so failing the Save would refuse work that was
+  // visibly working, and the artifact would be built from a document with no bundle.
+  const { env, artifacts } = makeEnv();
+  const res = await worker.fetch(
+    createRequest({
+      framework: "javascript",
+      title: "Grid",
+      files: {
+        "/package.json": JSON.stringify({ dependencies: { handsontable: "18.1.0" } }),
+        "/index.js": "console.log(1)",
+        "/index.html": '<div id="grid"></div>\n',
+      },
+    }),
+    env,
+    ctx,
+  );
+  assert.equal(res.status, 201);
+  const stored = sourceSnapshot(artifacts, (await res.json()).id);
+  assert.equal(
+    stored.files["/index.html"],
+    '<div id="grid"></div>\n<script type="module" src="/index.js"></script>\n',
+  );
+});
+
+test("an Angular demo's script-less index.html is served and stored untouched", () => {
+  // The write side of the same exemption: repairing Angular would persist a
+  // `<script src="/src/main.ts">` into documents that were always correct.
+  const html = "<!doctype html><html><body><app-root></app-root></body></html>";
+  return (async () => {
+    const { env, artifacts } = makeEnv([demoRow({ framework: "angular" })], [], {
+      "demos/abc123/__source.json": JSON.stringify({
+        framework: "angular",
+        files: { "/package.json": "{}", "/src/main.ts": "export {};", "/src/index.html": html },
+      }),
+    });
+    const res = await worker.fetch(sourceRequest("abc123"), env, ctx);
+    assert.equal((await res.json()).files["/src/index.html"], html);
+    assert.deepEqual(artifacts.puts, [], "nothing may be written for an Angular demo");
+  })();
+});
diff --git a/runner/pipeline/entry-script.test.mjs b/runner/pipeline/entry-script.test.mjs
new file mode 100644
index 000000000..3da8e9fde
--- /dev/null
+++ b/runner/pipeline/entry-script.test.mjs
@@ -0,0 +1,145 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  ensureEntryScript,
+  entryScriptProblem,
+  entryScriptTag,
+  hasAnyScript,
+  localScriptTargets,
+} from "../packages/runtime/dist/entry-script.js";
+
+// DEV-2741. `create_demo` published demos whose `/index.html` is a bare
+// `<div id="grid"></div>` — no `<script>`, so neither the Tier-1 parcel bundler (whose
+// entry *is* the HTML file) nor `vite build` on the `/d/:id` path has a module to run.
+// Both produced a page holding the div and nothing else, and neither reported an error.
+//
+// The shape below is the one measured in production on `/share/6n1lu5k2s3` and
+// `/share/6ri5be5l28`.
+
+const FRAGMENT = '<div id="grid" style="height: 460px; width: 100%;"></div>\n';
+
+const DOCUMENT = `<!doctype html>
+<html>
+  <body>
+    <div id="grid"></div>
+    <script type="module" src="/index.js"></script>
+  </body>
+</html>
+`;
+
+const FILES = { "/index.js": "console.log(1);", "/package.json": "{}" };
+
+test("the reported fragment is diagnosed as having no script", () => {
+  assert.deepEqual(entryScriptProblem(FRAGMENT, FILES), { kind: "no-script" });
+});
+
+test("a document that already loads its entry is left alone", () => {
+  assert.equal(entryScriptProblem(DOCUMENT, FILES), null);
+  assert.equal(ensureEntryScript(DOCUMENT, "/index.js"), DOCUMENT);
+});
+
+test("every spelling of a local src counts as loading the module", () => {
+  for (const src of ["/index.js", "./index.js", "index.js"]) {
+    const html = `<div id="grid"></div><script type="module" src="${src}"></script>`;
+    assert.deepEqual(localScriptTargets(html), ["/index.js"], src);
+    assert.equal(entryScriptProblem(html, FILES), null, src);
+  }
+});
+
+test("single-quoted and unquoted src are read too", () => {
+  assert.deepEqual(localScriptTargets(`<script src='/a.js'></script>`), ["/a.js"]);
+  assert.deepEqual(localScriptTargets(`<script src=/b.js></script>`), ["/b.js"]);
+});
+
+test("a local script pointing at a file that was never sent is a dangling entry", () => {
+  const html = `<div id="grid"></div><script type="module" src="/main.js"></script>`;
+  assert.deepEqual(entryScriptProblem(html, FILES), { kind: "dangling", targets: ["/main.js"] });
+});
+
+test("an inline or external script is not ours to judge", () => {
+  assert.equal(entryScriptProblem(`<script>hi()</script><div id="grid"></div>`, FILES), null);
+  assert.equal(
+    entryScriptProblem(`<script src="https://cdn.example/x.js"></script>`, FILES),
+    null,
+  );
+});
+
+test("a demo that loads a module other than the catalog's entry is accepted", () => {
+  // `/src/main.js` builds and renders on both paths; refusing it would be a false
+  // rejection, which is why the rule is "some module", not "the catalog's entry".
+  const html = `<div id="grid"></div><script type="module" src="/src/main.js"></script>`;
+  assert.equal(entryScriptProblem(html, { "/src/main.js": "" }), null);
+});
+
+test("repairing the fragment appends the entry tag", () => {
+  assert.equal(
+    ensureEntryScript(FRAGMENT, "/index.js"),
+    '<div id="grid" style="height: 460px; width: 100%;"></div>\n' +
+      '<script type="module" src="/index.js"></script>\n',
+  );
+});
+
+test("repairing a document puts the tag before </body>", () => {
+  const html = `<!doctype html>\n<html>\n  <body>\n    <div id="grid"></div>\n  </body>\n</html>\n`;
+  assert.equal(
+    ensureEntryScript(html, "/index.ts"),
+    `<!doctype html>\n<html>\n  <body>\n    <div id="grid"></div>\n  ` +
+      `<script type="module" src="/index.ts"></script>\n  </body>\n</html>\n`,
+  );
+});
+
+test("the repair is idempotent on its own output", () => {
+  const once = ensureEntryScript(FRAGMENT, "/index.js");
+  assert.equal(ensureEntryScript(once, "/index.js"), once);
+  assert.equal(entryScriptProblem(once, FILES), null);
+});
+
+test("the repaired tag is the one the starters emit", () => {
+  assert.equal(entryScriptTag("/index.js"), '<script type="module" src="/index.js"></script>');
+  assert.equal(hasAnyScript(FRAGMENT), false);
+  assert.equal(hasAnyScript(DOCUMENT), true);
+});
+
+// Review findings on PR #301. Each of these is a document that renders — or fails to —
+// differently from what a naive `<script`/`src=` scan concludes.
+
+test("a commented-out entry tag does not count as loading the module", () => {
+  // The likeliest way a working demo loses its entry: the author disables the tag
+  // instead of deleting it. Counted as a script, the repair no-ops and the preview goes
+  // blank with no error anywhere.
+  const html = '<div id="grid"></div>\n<!-- <script type="module" src="/index.js"></script> -->\n';
+  assert.deepEqual(entryScriptProblem(html, FILES), { kind: "no-script" });
+  assert.equal(hasAnyScript(html), false);
+  assert.deepEqual(localScriptTargets(html), []);
+  assert.equal(
+    ensureEntryScript(html, "/index.js"),
+    `${html}<script type="module" src="/index.js"></script>\n`,
+  );
+});
+
+test("a live tag below a commented-out one is still seen", () => {
+  const html =
+    '<!-- <script src="/old.js"></script> -->\n<script type="module" src="/index.js"></script>';
+  assert.deepEqual(localScriptTargets(html), ["/index.js"]);
+  assert.equal(entryScriptProblem(html, FILES), null);
+});
+
+test("an unterminated comment swallows the rest, the way a parser does", () => {
+  const html = '<div id="grid"></div><!-- <script src="/index.js"></script>';
+  assert.equal(hasAnyScript(html), false);
+});
+
+test("data-src is not the script's src", () => {
+  // `\b` fires between the `-` and the `s`, so a lazy-loading idiom's `data-src` read as
+  // the real source turns an inline script into a dangling refusal.
+  const html = '<script type="module" data-src="lazy.js">boot()</script>';
+  assert.deepEqual(localScriptTargets(html), []);
+  assert.equal(entryScriptProblem(html, FILES), null);
+});
+
+test("a cache-busting query or fragment resolves to the file it names", () => {
+  for (const src of ["/index.js?v=2", "/index.js#main", "./index.js?t=1"]) {
+    assert.deepEqual(localScriptTargets(`<script src="${src}"></script>`), ["/index.js"], src);
+    assert.equal(entryScriptProblem(`<script src="${src}"></script>`, FILES), null, src);
+  }
+});
diff --git a/runner/pipeline/fixtures/worker-harness.mjs b/runner/pipeline/fixtures/worker-harness.mjs
index ca842866d..963144870 100644
--- a/runner/pipeline/fixtures/worker-harness.mjs
+++ b/runner/pipeline/fixtures/worker-harness.mjs
@@ -171,15 +171,23 @@ export function fakeKV() {
  * listing), so asserting on put *keys* alone could not tell a pinned file map
  * from the raw submitted one.
  */
-export function fakeR2() {
+export function fakeR2(seed = {}) {
   const puts = [];
+  // Seeded objects make the read paths reachable (a stored `__source.json`, DEV-2741).
+  // A put lands here too, so a route that repairs what it read can be asserted on the
+  // second read. With no seed, `get` answers null exactly as it always did.
+  const store = new Map(Object.entries(seed));
   return {
     puts,
+    store,
     async put(key, value) {
       puts.push({ key, value });
+      store.set(key, String(value));
     },
-    async get() {
-      return null;
+    async get(key) {
+      const value = store.get(key);
+      if (value === undefined) return null;
+      return { body: value, async text() { return value; } };
     },
     async list() {
       return { objects: [] };
@@ -195,9 +203,9 @@ export const AUTHOR = "dev@handsontable.com";
  * layered by the caller; none are set here so the broker path stays the one
  * under test on the browser routes.
  */
-export function makeEnv(seedRows = [], seedTokens = []) {
+export function makeEnv(seedRows = [], seedTokens = [], seedArtifacts = {}) {
   const { db, writes, demos, tokens } = fakeD1(seedRows, seedTokens);
-  const artifacts = fakeR2();
+  const artifacts = fakeR2(seedArtifacts);
   const env = {
     Sandbox: {},
     SANDBOX_BUILDER: {},
diff --git a/runner/pipeline/frameworks-generated.test.mjs b/runner/pipeline/frameworks-generated.test.mjs
index a5a899955..4eba00cef 100644
--- a/runner/pipeline/frameworks-generated.test.mjs
+++ b/runner/pipeline/frameworks-generated.test.mjs
@@ -61,6 +61,10 @@ test("BUILD_CONFIG matches catalog.json field for field", async () => {
         buildCommand: e.buildCommand,
         outputDir: e.outputDir,
         outputGlob: e.outputGlob ?? null,
+        // Carried for the worker's HTML-entry gate (DEV-2741) — same source of truth,
+        // so the drift check covers them too.
+        entry: e.entry,
+        htmlEntry: e.htmlEntry ?? null,
       },
       `${e.framework}: drifted from catalog.json — rerun scripts/prepare-container.mjs`,
     );
diff --git a/runner/pipeline/head-assets.test.mjs b/runner/pipeline/head-assets.test.mjs
index 1bfc698a6..be5b4cd7b 100644
--- a/runner/pipeline/head-assets.test.mjs
+++ b/runner/pipeline/head-assets.test.mjs
@@ -668,3 +668,37 @@ test("an empty head still receives every asset, in order", () => {
   assert.equal(appended[0].attrs.href, CDN_CORE);
   assert.equal(appended.at(-1).attrs.href, "data:text/css,%3Aroot%7B--e2e-data-sentinel%3A%209px%7D");
 });
+
+// DEV-2741. The tier where a script-less document is invisible: the HTML file is the
+// sandbox entry, the bundler derives its module graph from that document's
+// `<script src>` tags, and a compile with nothing in it still reports success. Measured
+// on `/share/6n1lu5k2s3`: `window.__hotRunnerScheme` undefined inside the preview frame,
+// because the module the receiver is injected into never ran.
+
+test("a script-less HTML entry gains the entry tag in the map the bundler sees", async () => {
+  const { runtime } = published(entryFor(), {
+    ...filesWith(),
+    "/index.html": '<div id="grid"></div>\n',
+  });
+  const derived = await runtime.sandboxFiles();
+  assert.match(derived["/index.html"], /<script type="module" src="\/index\.js"><\/script>/);
+});
+
+test("the authored map keeps the document the author wrote", async () => {
+  // The same rule as every other injection here: Download-zip, fork and the
+  // StackBlitz/CodeSandbox exports read `runtime.files`.
+  const authored = '<div id="grid"></div>\n';
+  const { runtime } = published(entryFor(), { ...filesWith(), "/index.html": authored });
+  await runtime.sandboxFiles();
+  assert.equal(runtime.files["/index.html"], authored);
+});
+
+test("a document that already loads a module gains no second entry tag", async () => {
+  // The receivers are still injected into the document (that is their own contract), so
+  // the oracle is the entry tag itself: exactly the one the author wrote.
+  const html = '<body><div id="grid"></div><script type="module" src="/index.js"></script></body>';
+  const { runtime } = published(entryFor(), { ...filesWith(), "/index.html": html });
+  const derived = await runtime.sandboxFiles();
+  const tags = derived["/index.html"].match(/<script type="module" src="\/index\.js"><\/script>/g);
+  assert.deepEqual(tags, ['<script type="module" src="/index.js"></script>']);
+});
diff --git a/runner/pipeline/mcp-create.test.mjs b/runner/pipeline/mcp-create.test.mjs
index 20279f0a9..d38a539fa 100644
--- a/runner/pipeline/mcp-create.test.mjs
+++ b/runner/pipeline/mcp-create.test.mjs
@@ -25,6 +25,7 @@ const {
   isTeamEmail,
   validateMcpFiles,
   validateBuildToolchain,
+  validateHtmlEntry,
 } = await import("../workers/api/src/mcp-create.ts");
 const { authenticateService, normalizeEmail, sameOwner } = await import("../workers/api/src/auth.ts");
 const { demoListQuery } = await import("../workers/api/src/demos-list.ts");
@@ -294,3 +295,125 @@ test("BUILD_TOOL_PACKAGE covers every framework in BUILD_CONFIG", () => {
     );
   }
 });
+
+// DEV-2741. The other way an agent payload builds into nothing: an HTML entry that
+// loads no module. Measured in production on `/share/6n1lu5k2s3` — the demo's
+// `/index.html` was `<div id="grid" ...></div>` and nothing else, so the Tier-1
+// bundler (whose entry *is* that document) and `vite build` both had no module to run,
+// and the page came out as an empty div on every surface with no error anywhere.
+
+const JS_CFG = BUILD_CONFIG["javascript"];
+
+test("BUILD_CONFIG carries the two entry paths the HTML gate needs", () => {
+  // Generated from catalog.json by scripts/prepare-container.mjs; without them the
+  // gate below silently passes everything.
+  assert.equal(JS_CFG.entry, "/index.js");
+  assert.equal(JS_CFG.htmlEntry, "/index.html");
+  for (const [framework, cfg] of Object.entries(BUILD_CONFIG)) {
+    assert.equal(typeof cfg.entry, "string", `${framework} has no entry`);
+    assert.ok(cfg.htmlEntry === null || typeof cfg.htmlEntry === "string", framework);
+  }
+});
+
+test("the reported shape — an index.html with no script — is refused", () => {
+  const result = validateHtmlEntry(
+    { "/package.json": "{}", "/index.js": "x", "/index.html": '<div id="grid"></div>\n' },
+    JS_CFG,
+  );
+  assert.ok(isMcpValidationError(result));
+  // The message has to carry the fix: the caller is a model, and "invalid" teaches it
+  // nothing it can act on.
+  assert.match(result.error, /<script type="module" src="\/index\.js"><\/script>/);
+});
+
+test("a document that loads its entry passes", () => {
+  const result = validateHtmlEntry(
+    {
+      "/package.json": "{}",
+      "/index.js": "x",
+      "/index.html": '<body><div id="grid"></div><script type="module" src="/index.js"></script></body>',
+    },
+    JS_CFG,
+  );
+  assert.equal(result, null);
+});
+
+test("a document loading a module other than the catalog entry is not a refusal", () => {
+  // It builds and renders on both paths; refusing it would be a false rejection.
+  const result = validateHtmlEntry(
+    {
+      "/package.json": "{}",
+      "/src/main.js": "x",
+      "/index.html": '<script type="module" src="/src/main.js"></script>',
+    },
+    JS_CFG,
+  );
+  assert.equal(result, null);
+});
+
+test("a script pointing at a file that was never sent is refused, naming the file", () => {
+  const result = validateHtmlEntry(
+    { "/package.json": "{}", "/index.js": "x", "/index.html": '<script src="/main.js"></script>' },
+    JS_CFG,
+  );
+  assert.ok(isMcpValidationError(result));
+  assert.match(result.error, /\/main\.js/);
+});
+
+test("a missing HTML entry is refused by name", () => {
+  const result = validateHtmlEntry({ "/package.json": "{}", "/index.js": "x" }, JS_CFG);
+  assert.ok(isMcpValidationError(result));
+  assert.match(result.error, /\/index\.html/);
+});
+
+test("a framework with no HTML entry is out of scope for the gate", () => {
+  assert.equal(validateHtmlEntry({ "/package.json": "{}" }, { entry: "/x.js", htmlEntry: null }), null);
+});
+
+test("an inline or CDN script is left alone", () => {
+  for (const html of ['<script>boot()</script>', '<script src="https://cdn.example/x.js"></script>']) {
+    assert.equal(
+      validateHtmlEntry({ "/package.json": "{}", "/index.js": "x", "/index.html": html }, JS_CFG),
+      null,
+      html,
+    );
+  }
+});
+
+// Angular's `/src/index.html` has no `<script>` and is correct: `ng build` injects the
+// bundles listed in angular.json. Only a vite HTML entry names its own module, so the
+// gate answers to the build command — otherwise it refuses every Angular demo the MCP
+// publishes (found by Bugbot on PR #301).
+
+test("Angular's script-less HTML entry is not a refusal", () => {
+  const cfg = BUILD_CONFIG["angular"];
+  assert.equal(cfg.htmlEntry, "/src/index.html", "the row this test is about");
+  const result = validateHtmlEntry(
+    {
+      "/package.json": "{}",
+      "/src/main.ts": "export {};",
+      "/src/index.html": "<!doctype html><html><body><app-root></app-root></body></html>",
+    },
+    cfg,
+  );
+  assert.equal(result, null);
+});
+
+test("only a vite HTML entry is gated — enumerated over the whole catalog", () => {
+  // The discriminating list, not a spot check: every framework whose build command is
+  // not `vite build` must be exempt no matter what its document holds.
+  const gated = [];
+  for (const [framework, cfg] of Object.entries(BUILD_CONFIG)) {
+    const files = { "/package.json": "{}", [cfg.entry]: "export {};" };
+    if (cfg.htmlEntry) files[cfg.htmlEntry] = '<div id="grid"></div>';
+    if (isMcpValidationError(validateHtmlEntry(files, cfg))) gated.push(framework);
+  }
+  assert.deepEqual(
+    gated.sort(),
+    [
+      "ant-design", "base-web", "blank", "blank-react", "blank-ts", "example1",
+      "fluent-ui", "javascript", "mui", "react", "react-js", "typescript", "vue",
+    ],
+    "the tier-1 vite starters, and nothing else",
+  );
+});
diff --git a/runner/pipeline/mcp-routes.test.mjs b/runner/pipeline/mcp-routes.test.mjs
index 657db329a..17768a98d 100644
--- a/runner/pipeline/mcp-routes.test.mjs
+++ b/runner/pipeline/mcp-routes.test.mjs
@@ -42,9 +42,19 @@ const { demoListQuery } = await import("../workers/api/src/demos-list.ts");
 // devDependencies.vite satisfies the toolchain gate (validateBuildToolchain):
 // every framework these fixtures build with (react, and demoRow()'s "react")
 // runs `vite build` as the last step of its buildCommand.
+//
+// `/index.html` loads `/src/index.tsx` because the HTML gate (validateHtmlEntry,
+// DEV-2741) refuses a document that runs no module, and "react" — the framework these
+// fixtures build with — declares `/index.html` as its HTML entry.
+const INDEX_HTML =
+  '<!doctype html><html><body><div id="root"></div>'
+  + '<script type="module" src="/src/index.tsx"></script></body></html>';
+
 const FILES = {
   "/package.json": JSON.stringify({ name: "demo", devDependencies: { vite: "^5.4.0" } }),
   "/index.js": "console.log(1)",
+  "/index.html": INDEX_HTML,
+  "/src/index.tsx": "export {};",
 };
 
 const PR_URL = "https://pkg.pr.new/handsontable@13106";
@@ -57,6 +67,8 @@ const filesWith = (dep) => ({
     devDependencies: { vite: "^5.4.0" },
   }),
   "/index.js": "console.log(1)",
+  "/index.html": INDEX_HTML,
+  "/src/index.tsx": "export {};",
 });
 
 const mcpHeaders = {
@@ -298,3 +310,48 @@ test("an MCP rebuild refuses an invalid explicit ref with the validator's messag
   assert.deepEqual(writes, [], "a refused rebuild must not write");
   assert.deepEqual(artifacts.puts, [], "a refused rebuild must not store artifacts");
 });
+
+test("a create whose index.html loads no module is refused before it is built", async () => {
+  // DEV-2741, at the route. The demo this reproduces was published, built and served
+  // as an empty `<div id="grid">` on /share, /edit and /d/:id alike, because nothing
+  // between the request and the artifact asks whether the entry document runs anything.
+  const { env, writes, artifacts } = makeEnv();
+  const res = await worker.fetch(
+    createRequest({
+      framework: "react",
+      title: "Grid",
+      description: "A sortable grid",
+      files: {
+        "/package.json": JSON.stringify({ name: "demo", devDependencies: { vite: "^5.4.0" } }),
+        "/src/index.tsx": "export {};",
+        "/index.html": '<div id="grid" style="height: 460px"></div>\n',
+      },
+    }),
+    env,
+    ctx,
+  );
+  assert.equal(res.status, 400);
+  // The message has to carry the fix — the caller is a model.
+  assert.match((await res.json()).error, /<script type="module" src="\/src\/index\.tsx"><\/script>/);
+  assert.deepEqual(writes, [], "no D1 write for a payload that renders nothing");
+  assert.deepEqual(artifacts.puts, [], "no artifact stored for a payload that renders nothing");
+});
+
+test("a rebuild that drops the entry script is refused and writes nothing", async () => {
+  const { env, writes, artifacts } = makeEnv([demoRow()]);
+  const res = await worker.fetch(
+    patchRequest("abc123", {
+      files: {
+        "/package.json": JSON.stringify({ name: "demo", devDependencies: { vite: "^5.4.0" } }),
+        "/src/index.tsx": "export {};",
+        "/index.html": '<div id="grid"></div>',
+      },
+    }),
+    env,
+    ctx,
+  );
+  assert.equal(res.status, 400);
+  assert.match((await res.json()).error, /renders as an empty page/);
+  assert.deepEqual(writes, [], "a refused rebuild must not write");
+  assert.deepEqual(artifacts.puts, [], "a refused rebuild must not store artifacts");
+});
diff --git a/runner/pipeline/snapshot-build.test.mjs b/runner/pipeline/snapshot-build.test.mjs
index 2d0afc319..46b5ea8ed 100644
--- a/runner/pipeline/snapshot-build.test.mjs
+++ b/runner/pipeline/snapshot-build.test.mjs
@@ -238,3 +238,148 @@ test("an install failure carries the same build context", async () => {
     setSandboxFactory(null);
   }
 });
+
+// DEV-2741. The other blank-demo shape, and the one the emptiness check above cannot
+// see: `vite build` reads the entry document, and a document that loads no module gives
+// it nothing to bundle. It exits 0, `dist/` holds the HTML, and the artifact is stored
+// as a successful build — which is how `/d/6n1lu5k2s3/` came to be 2.5 KB of markup with
+// no script in it.
+
+const VITE_ENTRY = {
+  framework: "javascript",
+  tier: 1,
+  installCommand: "pnpm install --frozen-lockfile",
+  buildCommand: "vite build",
+  outputDir: "dist",
+  outputGlob: null,
+  entry: "/index.js",
+  htmlEntry: "/index.html",
+};
+
+/** A sandbox whose install and build both succeed and whose `dist/` holds `emitted`. */
+function buildEmitting(emitted) {
+  return () => ({
+    mkdir: async () => {},
+    writeFile: async () => {},
+    readFile: async () => "",
+    destroy: async () => {},
+    async exec(cmd) {
+      if (cmd.includes("find . -type f")) {
+        return { success: true, exitCode: 0, stdout: emitted.map((r) => `./${r}`).join("\n") };
+      }
+      return { success: true, exitCode: 0, stdout: "", stderr: "" };
+    },
+  });
+}
+
+test("a vite build that emits HTML and no JavaScript is a failed build, not a stored artifact", async () => {
+  setSandboxFactory(buildEmitting(["index.html"]));
+  try {
+    const err = await runBuild(ENV, VITE_ENTRY, { "/package.json": "{}" }).then(() => null, (e) => e);
+    assert.ok(err, "a bundle-less build must not resolve");
+    assert.match(err.message, /no JavaScript/);
+    // Names the file the author has to fix, not just the symptom.
+    assert.match(err.message, /\/index\.html/);
+  } finally {
+    setSandboxFactory(null);
+  }
+});
+
+test("a vite build that emits a bundle is accepted", async () => {
+  setSandboxFactory(buildEmitting(["index.html", "assets/index-a1b2c3.js"]));
+  try {
+    const out = await runBuild(ENV, VITE_ENTRY, { "/package.json": "{}" });
+    assert.deepEqual(Object.keys(out).sort(), ["assets/index-a1b2c3.js", "index.html"]);
+  } finally {
+    setSandboxFactory(null);
+  }
+});
+
+test("a bundle named .mjs or .cjs is JavaScript", async () => {
+  // `endsWith(".js")` is false for both, and a demo is free to ship a vite.config that
+  // renames the entry chunk — `validateMcpFiles` has no opinion about that file.
+  for (const emitted of ["assets/index-a1b2c3.mjs", "assets/index-a1b2c3.cjs"]) {
+    setSandboxFactory(buildEmitting(["index.html", emitted]));
+    try {
+      const out = await runBuild(ENV, VITE_ENTRY, { "/package.json": "{}" });
+      assert.deepEqual(Object.keys(out).sort(), [emitted, "index.html"].sort(), emitted);
+    } finally {
+      setSandboxFactory(null);
+    }
+  }
+});
+
+test("a CDN- or inline-script demo emits no bundle by design and is not rejected", async () => {
+  // `validateHtmlEntry` lets these through on purpose — it cannot tell a CDN demo from
+  // a mistake — so failing them here would reject on Save, after a billed container
+  // boot, a preview that already runs (found by Bugbot on PR #301).
+  for (const html of [
+    '<div id="grid"></div><script src="https://cdn.example/handsontable.js"></script>',
+    '<div id="grid"></div><script>boot()</script>',
+  ]) {
+    setSandboxFactory(buildEmitting(["index.html"]));
+    try {
+      const out = await runBuild(ENV, VITE_ENTRY, { "/package.json": "{}", "/index.html": html });
+      assert.deepEqual(Object.keys(out), ["index.html"], html);
+    } finally {
+      setSandboxFactory(null);
+    }
+  }
+});
+
+test("a document that does name a local module is still held to emitting one", async () => {
+  // The exemption is "nothing to bundle", not "no bundle" — a document pointing at a
+  // file in the map and a dist with no JavaScript in it is the defect, not a CDN demo.
+  setSandboxFactory(buildEmitting(["index.html"]));
+  try {
+    const err = await runBuild(ENV, VITE_ENTRY, {
+      "/package.json": "{}",
+      "/index.js": "export {};",
+      "/index.html": '<div id="grid"></div><script type="module" src="/index.js"></script>',
+    }).then(() => null, (e) => e);
+    assert.ok(err, "a bundle-less build of a real module must not resolve");
+    assert.match(err.message, /no JavaScript/);
+  } finally {
+    setSandboxFactory(null);
+  }
+});
+
+test("the gate reads the build command, not only the tier", async () => {
+  // Every tier-1 row in today's catalog runs `vite build`, so the tier check alone
+  // explains the case below and the buildCommand half would go unexercised. This entry
+  // is tier 1 with a builder that injects its own bundle — the Angular shape.
+  setSandboxFactory(buildEmitting(["index.html"]));
+  try {
+    const out = await runBuild(
+      ENV,
+      { ...VITE_ENTRY, buildCommand: "ng build", htmlEntry: "/src/index.html" },
+      { "/package.json": "{}" },
+    );
+    assert.deepEqual(Object.keys(out), ["index.html"]);
+  } finally {
+    setSandboxFactory(null);
+  }
+});
+
+test("the no-JavaScript check does not touch a framework whose output shape it was never verified against", async () => {
+  // Next/Nuxt/Astro/Angular each emit differently (`out/`, `.output/public`,
+  // `dist/*/browser`, plus patchTurbopackRuntime); a false rejection here would break
+  // saving for a framework this check was never about.
+  const nextEntry = {
+    framework: "next.js",
+    tier: 2,
+    installCommand: "pnpm install --frozen-lockfile",
+    buildCommand: "next build",
+    outputDir: "out",
+    outputGlob: null,
+    entry: "/app/page.tsx",
+    htmlEntry: null,
+  };
+  setSandboxFactory(buildEmitting(["index.html"]));
+  try {
+    const out = await runBuild(ENV, nextEntry, { "/package.json": "{}" });
+    assert.deepEqual(Object.keys(out), ["index.html"]);
+  } finally {
+    setSandboxFactory(null);
+  }
+});
diff --git a/runner/scripts/prepare-container.mjs b/runner/scripts/prepare-container.mjs
index d2ee70751..dc8d1b9c9 100644
--- a/runner/scripts/prepare-container.mjs
+++ b/runner/scripts/prepare-container.mjs
@@ -251,7 +251,7 @@ function writeGenerated() {
     return `  ${JSON.stringify(framework)}: { cmd: ${JSON.stringify(d.cmd)}, port: ${d.port}, defaultBakedKey: ${JSON.stringify(seedKey)}, contexts: [${contexts.join(", ")}] },`;
   });
   const buildRows = catalog.examples.map((e) =>
-    `  ${JSON.stringify(e.framework)}: { tier: ${e.tier}, installCommand: ${JSON.stringify(e.installCommand)}, buildCommand: ${JSON.stringify(e.buildCommand)}, outputDir: ${JSON.stringify(e.outputDir)}, outputGlob: ${e.outputGlob ? JSON.stringify(e.outputGlob) : "null"} },`,
+    `  ${JSON.stringify(e.framework)}: { tier: ${e.tier}, installCommand: ${JSON.stringify(e.installCommand)}, buildCommand: ${JSON.stringify(e.buildCommand)}, outputDir: ${JSON.stringify(e.outputDir)}, outputGlob: ${e.outputGlob ? JSON.stringify(e.outputGlob) : "null"}, entry: ${JSON.stringify(e.entry)}, htmlEntry: ${e.htmlEntry ? JSON.stringify(e.htmlEntry) : "null"} },`,
   );
 
   const out = `// Generated by scripts/prepare-container.mjs — do not edit by hand.
@@ -279,12 +279,19 @@ ${devRows.join("\n")}
 };
 
 // Build config for the share snapshotter (all examples).
+//
+// "entry" and "htmlEntry" are the same two paths the catalog hands the browser, carried
+// here so the worker can tell whether an agent-supplied index.html actually loads a
+// module (DEV-2741). They are the demo's *authored* names — Tier 1 renames TS/JSX on
+// its own (toParcelEntry), which is no concern of the build path.
 export interface BuildConfig {
   tier: number;
   installCommand: string;
   buildCommand: string;
   outputDir: string;
   outputGlob: string | null;
+  entry: string;
+  htmlEntry: string | null;
 }
 
 export const BUILD_CONFIG: Record<string, BuildConfig> = {
diff --git a/runner/workers/api/src/build-command.ts b/runner/workers/api/src/build-command.ts
index 7316c9a9f..278c73801 100644
--- a/runner/workers/api/src/build-command.ts
+++ b/runner/workers/api/src/build-command.ts
@@ -8,3 +8,24 @@
 export function snapshotBuildCommand(buildCommand: string): string {
   return buildCommand.replace(/^\s*(tsc(\s+-b)?|vue-tsc[^&]*)\s*&&\s*/i, "");
 }
+
+/**
+ * Does this framework's HTML entry declare the module that boots the demo? (DEV-2741)
+ *
+ * Vite's contract for an HTML entry is exactly that: the document is the entry, and the
+ * module graph is whatever its `<script type="module" src>` tags name. Nothing else in
+ * the catalog works that way — Angular's `/src/index.html` has no `<script>` at all and
+ * is correct, because `ng build` injects the bundles it lists in `angular.json`, and
+ * Next, Astro, Nuxt and Remix declare no HTML entry to begin with.
+ *
+ * So the entry-script gate answers to the build command, not to the mere presence of an
+ * `htmlEntry`. Getting this wrong is not a near-miss: it refuses every Angular demo the
+ * MCP publishes, and — worse — writes a `<script src="/src/main.ts">` into stored
+ * Angular documents that were always fine.
+ */
+export function htmlEntryLoadsModule(cfg: {
+  buildCommand: string;
+  htmlEntry: string | null;
+}): boolean {
+  return cfg.htmlEntry !== null && snapshotBuildCommand(cfg.buildCommand).trim() === "vite build";
+}
diff --git a/runner/workers/api/src/frameworks.generated.ts b/runner/workers/api/src/frameworks.generated.ts
index 64ccf5d15..327a7288e 100644
--- a/runner/workers/api/src/frameworks.generated.ts
+++ b/runner/workers/api/src/frameworks.generated.ts
@@ -34,32 +34,39 @@ export const FRAMEWORK_DEV: Record<string, FrameworkDev> = {
 };
 
 // Build config for the share snapshotter (all examples).
+//
+// "entry" and "htmlEntry" are the same two paths the catalog hands the browser, carried
+// here so the worker can tell whether an agent-supplied index.html actually loads a
+// module (DEV-2741). They are the demo's *authored* names — Tier 1 renames TS/JSX on
+// its own (toParcelEntry), which is no concern of the build path.
 export interface BuildConfig {
   tier: number;
   installCommand: string;
   buildCommand: string;
   outputDir: string;
   outputGlob: string | null;
+  entry: string;
+  htmlEntry: string | null;
 }
 
 export const BUILD_CONFIG: Record<string, BuildConfig> = {
-  "blank": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null },
-  "blank-ts": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null },
-  "blank-react": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null },
-  "example1": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc && vite build", outputDir: "dist", outputGlob: null },
-  "javascript": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null },
-  "typescript": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc && vite build", outputDir: "dist", outputGlob: null },
-  "react": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc -b && vite build", outputDir: "dist", outputGlob: null },
-  "react-js": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null },
-  "ant-design": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null },
-  "mui": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc -b && vite build", outputDir: "dist", outputGlob: null },
-  "base-web": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc -b && vite build", outputDir: "dist", outputGlob: null },
-  "fluent-ui": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc -b && vite build", outputDir: "dist", outputGlob: null },
-  "vue": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vue-tsc --build --force && vite build", outputDir: "dist", outputGlob: null },
-  "angular": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "ng build", outputDir: "dist", outputGlob: "dist/*/browser" },
-  "next.js": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "next build", outputDir: "out", outputGlob: null },
-  "next-shadcn.js": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "next build", outputDir: "out", outputGlob: null },
-  "astro": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "astro build", outputDir: "dist", outputGlob: null },
-  "nuxt": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "nuxt generate", outputDir: ".output/public", outputGlob: null },
-  "remix": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "remix vite:build", outputDir: "build/client", outputGlob: null },
+  "blank": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null, entry: "/index.js", htmlEntry: "/index.html" },
+  "blank-ts": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null, entry: "/index.ts", htmlEntry: "/index.html" },
+  "blank-react": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null, entry: "/src/index.tsx", htmlEntry: "/index.html" },
+  "example1": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc && vite build", outputDir: "dist", outputGlob: null, entry: "/index.ts", htmlEntry: "/index.html" },
+  "javascript": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null, entry: "/index.js", htmlEntry: "/index.html" },
+  "typescript": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc && vite build", outputDir: "dist", outputGlob: null, entry: "/index.ts", htmlEntry: "/index.html" },
+  "react": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc -b && vite build", outputDir: "dist", outputGlob: null, entry: "/src/index.tsx", htmlEntry: "/index.html" },
+  "react-js": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null, entry: "/src/index.jsx", htmlEntry: "/index.html" },
+  "ant-design": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vite build", outputDir: "dist", outputGlob: null, entry: "/src/index.jsx", htmlEntry: "/index.html" },
+  "mui": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc -b && vite build", outputDir: "dist", outputGlob: null, entry: "/src/index.tsx", htmlEntry: "/index.html" },
+  "base-web": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc -b && vite build", outputDir: "dist", outputGlob: null, entry: "/src/index.tsx", htmlEntry: "/index.html" },
+  "fluent-ui": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "tsc -b && vite build", outputDir: "dist", outputGlob: null, entry: "/src/index.tsx", htmlEntry: "/index.html" },
+  "vue": { tier: 1, installCommand: "pnpm install --frozen-lockfile", buildCommand: "vue-tsc --build --force && vite build", outputDir: "dist", outputGlob: null, entry: "/src/main.ts", htmlEntry: "/index.html" },
+  "angular": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "ng build", outputDir: "dist", outputGlob: "dist/*/browser", entry: "/src/main.ts", htmlEntry: "/src/index.html" },
+  "next.js": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "next build", outputDir: "out", outputGlob: null, entry: "/app/page.tsx", htmlEntry: null },
+  "next-shadcn.js": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "next build", outputDir: "out", outputGlob: null, entry: "/app/page.tsx", htmlEntry: null },
+  "astro": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "astro build", outputDir: "dist", outputGlob: null, entry: "/src/pages/index.astro", htmlEntry: null },
+  "nuxt": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "nuxt generate", outputDir: ".output/public", outputGlob: null, entry: "/app.vue", htmlEntry: null },
+  "remix": { tier: 2, installCommand: "pnpm install --frozen-lockfile", buildCommand: "remix vite:build", outputDir: "build/client", outputGlob: null, entry: "/app/routes/_index.tsx", htmlEntry: null },
 };
diff --git a/runner/workers/api/src/index.ts b/runner/workers/api/src/index.ts
index bf29e700f..94ffcdef7 100644
--- a/runner/workers/api/src/index.ts
+++ b/runner/workers/api/src/index.ts
@@ -24,7 +24,7 @@ import { authenticate, authenticateService, isTokenIdentity, presentsToken, same
 import { hashToken, mintToken, normalizeTokenName } from "./token.js";
 import { createToken, listTokens, revokeToken } from "./token-store.js";
 import { MAX_TITLE, isValidationError, validateDescription, validateTitle } from "./demo-info.js";
-import { isMcpCreated, isMcpValidationError, validateBuildToolchain, validateMcpFiles } from "./mcp-create.js";
+import { isMcpCreated, isMcpValidationError, validateBuildToolchain, validateHtmlEntry, validateMcpFiles } from "./mcp-create.js";
 import { editorVersionRef, fetchVersionCatalog, resolveHandsontableVersion } from "./ht-version.js";
 import { demoListQuery, parseDemoScope } from "./demos-list.js";
 import { errorPageResponse, wantsHtmlError } from "./error-page.js";
@@ -41,7 +41,7 @@ import {
 } from "./session-lifecycle.js";
 import { refAmbiguousMessage, refUnknownMessage } from "./session-listing.js";
 import { ImportError, MAX_PAYLOAD_CHARS, importFromUrl, validatePayloadFiles } from "./import-url.js";
-import { BuildFailure, buildFailureTags, createDemo, getDemo, getDemoSource, invalidateDemo, serveDemoAsset, shortId, updateDemo, type DemoRow } from "./share.js";
+import { BuildFailure, buildFailureTags, createDemo, getDemo, getDemoSource, invalidateDemo, serveDemoAsset, shortId, updateDemo, withEntryScript, type DemoRow } from "./share.js";
 import {
   budgetPausedMessage,
   countEgress,
@@ -1057,6 +1057,11 @@ export default Sentry.withSentry(sentryOptions, {
         // costing a container boot on a doomed install (Sentry DEMOS-31).
         const toolchain = validateBuildToolchain(files, cfg.buildCommand);
         if (toolchain) return json(toolchain, 400);
+        // Same reasoning again, for the other way a payload builds into nothing: an
+        // HTML entry that loads no module compiles, builds and saves, then renders an
+        // empty page on every surface (DEV-2741).
+        const htmlEntry = validateHtmlEntry(files, cfg);
+        if (htmlEntry) return json(htmlEntry, 400);
         // Before the budget gate: an unusable version is a 400, not a container
         // boot spent on an install that cannot succeed (DEV-2565).
         // `trustDistTag`: a tag from this path is the model's own request, not a
@@ -1123,7 +1128,13 @@ export default Sentry.withSentry(sentryOptions, {
         const description = validateDescription(body.description);
         if (isValidationError(description)) return json(description, 400);
         if (!body.files || !body.files["/package.json"]) return json({ error: "files must include /package.json" }, 400);
-        const version = await resolveHandsontableVersion(env, { htVersion: body.htVersion, files: body.files });
+        // Repaired, not refused, on the browser paths (DEV-2741). The MCP routes 400 a
+        // document that loads no module because their caller is a program that can be
+        // told what to send; a person mid-edit gets the tag added instead, which is
+        // already what their preview ran — Tier 1 adds it to the bundler's view of the
+        // files too, so refusing here would fail a Save on a demo that was rendering.
+        const saveFiles = withEntryScript(body.framework, body.files);
+        const version = await resolveHandsontableVersion(env, { htVersion: body.htVersion, files: saveFiles });
         if (!version.ok) return json({ error: version.message }, version.status);
 
         // A build is a container boot too, so it answers to the same ceiling.
@@ -1202,6 +1213,10 @@ export default Sentry.withSentry(sentryOptions, {
           // create — see the create handler above (Sentry DEMOS-31).
           const toolchain = validateBuildToolchain(files, cfg.buildCommand);
           if (toolchain) return json(toolchain, 400);
+          // See the create handler (DEV-2741): a patch may be the edit that drops the
+          // entry script, and the rebuilt artifact would be an empty page.
+          const htmlEntry = validateHtmlEntry(files, cfg);
+          if (htmlEntry) return json(htmlEntry, 400);
           // `row.ht_version` is a candidate, not an authority: rows created before
           // DEV-2565 hold the "latest" sentinel, which no consumer can use.
           const version = await resolveHandsontableVersion(env, {
@@ -1328,9 +1343,10 @@ export default Sentry.withSentry(sentryOptions, {
           // are the ones it loaded — nothing re-pins them client-side on a version
           // change (App.tsx:1554 / :1700). Pinning here is what keeps the rebuilt
           // artifact and the stored ref describing the same core (DEV-2565).
+          // See the create handler: repaired, not refused, on a person's Save (DEV-2741).
           const version = await resolveHandsontableVersion(env, {
             htVersion: patch.htVersion,
-            files: patch.files,
+            files: withEntryScript(row.framework, patch.files),
             previousRef: row.ht_version,
           });
           if (!version.ok) return json({ error: version.message }, version.status);
diff --git a/runner/workers/api/src/mcp-create.ts b/runner/workers/api/src/mcp-create.ts
index 80d75bee4..13360521b 100644
--- a/runner/workers/api/src/mcp-create.ts
+++ b/runner/workers/api/src/mcp-create.ts
@@ -8,7 +8,8 @@
 // The first runtime import this file has ever had: a spec that imports it must
 // now register the .js->.ts hook (pipeline/fixtures/worker-hooks.mjs) and import
 // it dynamically — see guide-tracks.test.mjs / ht-version-resolve.test.mjs.
-import { snapshotBuildCommand } from "./build-command.js";
+import { htmlEntryLoadsModule, snapshotBuildCommand } from "./build-command.js";
+import { entryScriptProblem, entryScriptTag } from "@handsontable/demo-runtime/entry-script";
 
 /** A rejected payload. Same shape as `demo-info.ts` so the route can reply uniformly. */
 export interface McpValidationError {
@@ -158,6 +159,56 @@ export function validateBuildToolchain(
   return { error: `/package.json must declare "${pkg}": this demo is built with \`${bin}\`` };
 }
 
+/**
+ * Will this demo's HTML entry actually run anything? (DEV-2741)
+ *
+ * `create_demo` published demos whose `/index.html` was a bare
+ * `<div id="grid"></div>` — no `<script>` at all. Nothing downstream notices: the
+ * Tier-1 bundler makes the HTML file the sandbox entry and walks its `<script src>`
+ * tags, `vite build` reads the same document, and `runBuild` only asks whether the
+ * build emitted *any* file. So the demo compiled, built, saved and served — as an
+ * empty div, on `/share`, `/edit` and `/d/:id` alike, with no error anywhere.
+ *
+ * Refused rather than repaired, for the reason the file rules above are: a payload
+ * silently turned into something the caller did not write is worse than an error the
+ * caller can act on. Demos already stored in the broken shape are a different problem
+ * and are repaired on read.
+ *
+ * The rule is "some module", not "the catalog's entry": a document loading
+ * `/src/main.js` while the catalog says `/index.js` renders perfectly well, and
+ * refusing it would be a false rejection. What cannot render is a document with no
+ * script, or one whose only local scripts name files that were never sent.
+ *
+ * Decided from the request alone, so like the toolchain check it costs nothing and
+ * runs before the budget gate.
+ */
+export function validateHtmlEntry(
+  files: Record<string, string>,
+  cfg: { entry: string; htmlEntry: string | null; buildCommand: string },
+): McpValidationError | null {
+  // Angular's HTML entry legitimately has no script — `ng build` injects the bundle —
+  // and only a vite HTML entry names its own module. See `htmlEntryLoadsModule`.
+  if (!htmlEntryLoadsModule(cfg) || !cfg.htmlEntry) return null;
+  const html = files[cfg.htmlEntry];
+  if (html === undefined) {
+    return { error: `files must include ${cfg.htmlEntry}: it is this framework's HTML entry` };
+  }
+  const problem = entryScriptProblem(html, files);
+  if (!problem) return null;
+  if (problem.kind === "dangling") {
+    return {
+      error:
+        `${cfg.htmlEntry} loads ${problem.targets.join(", ")}, which ${problem.targets.length > 1 ? "are" : "is"} not in files: ` +
+        `send the file, or point the script at ${cfg.entry}`,
+    };
+  }
+  return {
+    error:
+      `${cfg.htmlEntry} must load the entry module, or the demo renders as an empty page: ` +
+      `add ${entryScriptTag(cfg.entry)}`,
+  };
+}
+
 /**
  * The author a service call asserts. Kept next to the file rules because it is the
  * other half of trusting this request: the shared secret says *a* trusted service is
diff --git a/runner/workers/api/src/share.ts b/runner/workers/api/src/share.ts
index c7ba555db..792db429d 100644
--- a/runner/workers/api/src/share.ts
+++ b/runner/workers/api/src/share.ts
@@ -10,10 +10,12 @@ import { getSandbox } from "@cloudflare/sandbox";
 import { injectSchemeIntoHtml } from "@handsontable/demo-runtime/scheme";
 import { execFailureDetail } from "@handsontable/demo-runtime/failure-log";
 import { handsontableDependencyRef } from "@handsontable/demo-runtime";
+import { ensureEntryScript, hasAnyScript, localScriptTargets } from "@handsontable/demo-runtime/entry-script";
+import { BUILD_CONFIG } from "./frameworks.generated.js";
 import type { Env } from "./env.js";
 import { errorPageResponse, wantsHtmlError } from "./error-page.js";
 import { recordContainerUsage, SESSION_INSTANCE_TYPE } from "./budget.js";
-import { snapshotBuildCommand } from "./build-command.js";
+import { htmlEntryLoadsModule, snapshotBuildCommand } from "./build-command.js";
 
 type SandboxLike = {
   mkdir(path: string, opts?: { recursive?: boolean }): Promise<unknown>;
@@ -45,7 +47,9 @@ export interface DemoRow {
   revoked_at: string | null;
 }
 
-/** Minimal catalog entry shape needed for building. */
+/** Minimal catalog entry shape needed for building. Every construction site spreads a
+ *  `BUILD_CONFIG` row, so the two entry paths ride along; only the no-JavaScript check
+ *  reads them, and only to name the file in its message. */
 export interface BuildEntry {
   framework: string;
   tier: number;
@@ -53,6 +57,8 @@ export interface BuildEntry {
   buildCommand: string;
   outputDir: string;
   outputGlob: string | null;
+  entry?: string;
+  htmlEntry?: string | null;
 }
 
 /** Bump whenever the build pipeline changes what artifacts contain (runtime
@@ -219,6 +225,27 @@ function execFailed(r: { success?: boolean; exitCode?: number }): boolean {
   return r.success === false || (typeof r.exitCode === "number" && r.exitCode !== 0);
 }
 
+/**
+ * Is this entry document expected to produce no bundle at all? (DEV-2741)
+ *
+ * True only when it carries a script and none of them names a local file — an inline
+ * boot, or a CDN `<script src>`. A document with no script whatsoever is *not* exempt:
+ * that is the defect, and by the time a build runs it has already been refused (MCP) or
+ * repaired (browser Save), so reaching the builder in that state means something
+ * upstream let it through and the loud failure is the point.
+ */
+function nothingToBundle(entry: BuildEntry, files: Record<string, string>): boolean {
+  const html = entry.htmlEntry ? files[entry.htmlEntry] : undefined;
+  if (html === undefined) return false;
+  return hasAnyScript(html) && localScriptTargets(html).length === 0;
+}
+
+/** The build shape the no-JavaScript check below is verified against: a tier-1 example
+ *  bundled by `vite build` into a flat `dist/`. */
+function isViteTier1(entry: BuildEntry): boolean {
+  return entry.tier === 1 && snapshotBuildCommand(entry.buildCommand).trim() === "vite build";
+}
+
 /** Run the framework build in a builder container; return { relPath -> contents }. */
 export async function runBuild(
   env: Env,
@@ -282,6 +309,30 @@ export async function runBuild(
     const rels = (list.stdout ?? "")
       .split("\n").map((s) => s.replace(/^\.\//, "").trim()).filter(Boolean);
     if (!rels.length) throw new Error(`build produced no files in ${outDir}`);
+    // A build that emits HTML and no JS is the other way a demo comes out blank
+    // (DEV-2741): `vite build` reads the entry document, and a document that loads no
+    // module gives it nothing to bundle. It exits 0, `dist/` is non-empty, and the
+    // artifact is stored as a success — the shape the emptiness check above cannot see.
+    //
+    // Scoped to the vite tier-1 builds whose output shape is known here. Next (`out/`,
+    // with its own runtime patch below), Nuxt (`.output/public`), Astro and Angular
+    // (`dist/*/browser`) each emit differently, and a false rejection would break
+    // saving for a framework this check was never about.
+    // `.mjs`/`.cjs` count: a demo is free to ship a `vite.config` that renames the entry
+    // chunk, and `validateMcpFiles` has no opinion about that file.
+    //
+    // And a document whose only scripts are inline or on a CDN is exempt, because it is
+    // *expected* to emit no bundle: `validateHtmlEntry` lets that shape through on
+    // purpose (it cannot tell a CDN demo from a mistake), so failing it here would
+    // reject on Save — after a billed container boot — a preview that already runs, with
+    // a message claiming the page loads no module when it plainly does.
+    if (isViteTier1(entry) && !rels.some((rel) => /\.[cm]?js$/i.test(rel)) && !nothingToBundle(entry, files)) {
+      throw new Error(
+        `build produced no JavaScript in ${outDir}: ${entry.htmlEntry ?? "the HTML entry"} `
+        + `loads no module, so the demo would render as an empty page`
+        + (entry.entry ? ` — add <script type="module" src="${entry.entry}"></script>` : ""),
+      );
+    }
 
     const out: Record<string, ArtifactContents> = {};
     for (const rel of rels) {
@@ -448,16 +499,76 @@ export async function invalidateDemo(env: Env, id: string): Promise<void> {
   await env.CACHE.delete(`demo:${id}`);
 }
 
+export interface DemoSource {
+  framework: string;
+  files: Record<string, string>;
+}
+
+/**
+ * Repair a *stored* snapshot whose HTML entry loads no module at all (DEV-2741).
+ *
+ * `create_demo` published demos whose `/index.html` was a bare `<div id="grid"></div>`.
+ * Nothing between the request and the artifact noticed, so they were saved, built and
+ * served as an empty page — the Tier-1 bundler takes the HTML file as the sandbox entry
+ * and walks its `<script src>` tags, and `vite build` reads the same document. The write
+ * gate now refuses that payload (`validateHtmlEntry`), which does nothing for the demos
+ * already stored, so they are repaired the first time their source is read.
+ *
+ * Repairing on read rather than in a migration costs nothing for the demos that are
+ * already fine, and needs no list of the ones that are not.
+ *
+ * The `/d/:id` artifact is not repaired here — it has no bundle for the tag to point at,
+ * so it needs a real rebuild, which the next Save (or `update_demo`) performs against
+ * these repaired files.
+ */
+/**
+ * The file map with an entry `<script>` added to the HTML entry when it has none
+ * (DEV-2741) — the same object back when there is nothing to do, which is every demo
+ * that was authored correctly.
+ *
+ * `ensureEntryScript` fires only for a document with *no* script of any kind, which is
+ * never a shape that renders: the Tier-1 bundler takes the HTML file as the sandbox
+ * entry and builds its module graph from that document's `<script src>` tags, and
+ * `vite build` reads the same document on the `/d/:id` path. A demo booting some other
+ * module, or from an inline or CDN script, is returned untouched.
+ */
+export function withEntryScript(
+  framework: string,
+  files: Record<string, string>,
+): Record<string, string> {
+  const cfg = BUILD_CONFIG[framework];
+  // Only a vite HTML entry declares its own module; Angular's does not, and writing a
+  // tag into it would break a document that was always correct (`htmlEntryLoadsModule`).
+  if (!cfg || !cfg.htmlEntry || !htmlEntryLoadsModule(cfg)) return files;
+  const html = files[cfg.htmlEntry];
+  // No HTML entry, or no module to point the tag at: not something to guess at.
+  if (html === undefined || files[cfg.entry] === undefined) return files;
+  const repaired = ensureEntryScript(html, cfg.entry);
+  return repaired === html ? files : { ...files, [cfg.htmlEntry]: repaired };
+}
+
+async function repairEntryScript(env: Env, row: DemoRow, src: DemoSource): Promise<DemoSource> {
+  const files = withEntryScript(src.framework, src.files);
+  if (files === src.files) return src;
+  const next: DemoSource = { ...src, files };
+  try {
+    await env.ARTIFACTS.put(`${row.r2_prefix}__source.json`, JSON.stringify(next), {
+      httpMetadata: { contentType: "application/json" },
+    });
+  } catch {
+    // Serving a demo that renders matters more than persisting the repair; the next
+    // read tries again.
+  }
+  return next;
+}
+
 /** Source snapshot for forking a saved demo: { framework, files }. */
-export async function getDemoSource(
-  env: Env,
-  id: string,
-): Promise<{ framework: string; files: Record<string, string> } | null> {
+export async function getDemoSource(env: Env, id: string): Promise<DemoSource | null> {
   const row = await getDemo(env, id);
   if (!row || row.revoked) return null;
   const obj = await env.ARTIFACTS.get(`${row.r2_prefix}__source.json`);
   if (!obj) return null;
-  return JSON.parse(await obj.text()) as { framework: string; files: Record<string, string> };
+  return repairEntryScript(env, row, JSON.parse(await obj.text()) as DemoSource);
 }
 
 /** Serve a built static asset for /d/:id/* (or /embed/:id/*). */