feat(runtime): reject incompatible runtime image reuse

.changeset/external-runtime-minimum-contract.md

@@ -0,0 +1,5 @@
+---
+'@module-federation/inject-external-runtime-core-plugin': patch
+---
+
+Keep legacy providers compatible with older runtime cores and report a minimum-contract error before publishing or reusing runtime-image metadata when the core cannot check image compatibility.

.changeset/quiet-node-payload.md

@@ -0,0 +1,5 @@
+---
+'@module-federation/runtime-core': patch
+---
+
+Reject malformed image-backed Node entry exports instead of falling back to a mutable global container from another evaluator.

.changeset/rfc5036-entry-evaluator-isolation.md

@@ -0,0 +1,5 @@
+---
+'@module-federation/runtime-core': patch
+---
+
+Isolate image-backed remote entry caches for host-specific evaluators and URL transforms while preserving default loader deduplication and legacy reuse.

.changeset/runtime-image-compatibility.md

@@ -0,0 +1,16 @@
+---
+'@module-federation/enhanced': minor
+'@module-federation/runtime': minor
+'@module-federation/runtime-core': minor
+'@module-federation/inject-external-runtime-core-plugin': patch
+---
+
+Carry runtime-image metadata on runtime instances, the external runtime-core
+provider, and remote-entry cache entries. When both sides carry metadata, a
+known family, target, capability, or entry-loader mismatch fails before the
+instance runs plugins, before the external core is reused, and before a cached
+remote entry is reused.
+
+Every check is inert without metadata. Builds that do not use
+`module-federation:*` conditions keep today's behavior, and the remote-entry
+cache key stays `name` plus `entry`.

packages/enhanced/src/lib/container/runtime/FederationRuntimePlugin.ts

@@ -14,6 +14,7 @@ import {
   normalizeRuntimeInitOptionsWithOutShared,
   createHash,
   normalizeToPosixPath,
+  type NormalizedRuntimeInitOptionsWithOutShared,
 } from './utils';
 import {
   expectedEntry,
@@ -118,6 +119,7 @@ class FederationRuntimePlugin {
   bundlerRuntimePath: string;
   runtimePath: string;
   runtimeToolsPath: string;
+  runtimeInitOptions?: NormalizedRuntimeInitOptionsWithOutShared;
   federationRuntimeDependency?: FederationRuntimeDependency; // Add this line
 
   constructor(options?: moduleFederationPlugin.ModuleFederationPluginOptions) {
@@ -345,6 +347,7 @@ class FederationRuntimePlugin {
     const initOptionsWithoutShared = normalizeRuntimeInitOptionsWithOutShared(
       this.options,
     );
+    this.runtimeInitOptions = initOptionsWithoutShared;
     const federationGlobal = getFederationGlobalScope(
       RuntimeGlobals || ({} as typeof RuntimeGlobals),
     );
@@ -422,6 +425,33 @@ class FederationRuntimePlugin {
     this.runtimeToolsPath =
       expectedEntry(image, '@module-federation/runtime-tools$') ??
       image.family.members['runtime-tools'].entry;
+    if (
+      image.mode === 'conditions' &&
+      selection.profile &&
+      this.runtimeInitOptions
+    ) {
+      const capabilities = [
+        'remote',
+        'shared',
+        'snapshotPlugins',
+        'containerEntry',
+      ] as const;
+      this.runtimeInitOptions.runtimeImage = {
+        contract: 1,
+        compatibilityId: image.family.compatibilityId,
+        required: capabilities.filter(
+          (capability) => selection.profile?.[capability] === 'required',
+        ),
+        forbidden: capabilities.filter(
+          (capability) => selection.profile?.[capability] === 'forbidden',
+        ),
+        available: capabilities.filter(
+          (capability) => selection.profile?.[capability] !== 'forbidden',
+        ),
+        target: selection.profile.target,
+        entryLoadingIdentity: image.entryLoadingIdentity,
+      };
+    }
     this.setRuntimeAlias(compiler);
     this.entryFilePath = this.getFilePath(compiler);
   }

packages/enhanced/src/lib/container/runtime/utils.ts

@@ -17,6 +17,15 @@ export interface NormalizedRuntimeInitOptionsWithOutShared {
   remotes: Array<
     Remotes[0] & { externalType: moduleFederationPlugin.ExternalsType }
   >;
+  runtimeImage?: {
+    contract: 1;
+    compatibilityId: string;
+    required: string[];
+    forbidden: string[];
+    available: string[];
+    target: string;
+    entryLoadingIdentity: string;
+  };
 }
 
 const extractUrlAndGlobal = require(