@brighterly/lib-fe-codestyle 0.3.0 → 0.5.1

package/README.md

@@ -5,6 +5,10 @@ cs-app, app-tutor, app-admin.
 
 It holds the **mechanisms**. Domain rules stay in each app.
 
+**New here?** [docs/how-it-works.md](docs/how-it-works.md) — how a check reads real
+code, what the gate can and cannot cover, what is already enforced, how to extend it,
+and how to run it.
+
 ## Subpaths
 
 | Import | What it is |
@@ -53,9 +57,9 @@ exported as data.
 
 | Rule | Level | Checks |
 |---|---|---|
-| `core/R1` | error | bare `localStorage` / `sessionStorage` — the accessor itself throws on Safari ITP and in-app webviews |
+| `core/R1` | warn* | bare `localStorage` / `sessionStorage` — the accessor itself throws on Safari ITP and in-app webviews |
 | `core/R2` | error | SCSS rules inline in a Vue `<style>` block instead of a referenced `.scss` file |
-| `core/R3` | error | `JSON.parse` with no enclosing `try`/`catch` — a corrupt entry breaks that path permanently |
+| `core/R3` | warn* | `JSON.parse` with no enclosing `try`/`catch` — a corrupt entry breaks that path permanently |
 | `core/R4` | error | `@font-face` declaring a font *stack* — an invalid descriptor, so the browser drops the face silently |
 | `core/C1` | warn | hand-rolled browser API with a VueUse equivalent |
 | `core/C2` | warn | a component duplicating an existing UI-kit component name |
@@ -65,10 +69,12 @@ exported as data.
 | `core/C6` | warn | a raw `font-family` / `font-size` / `font-weight` declaration instead of the app's typography source |
 | `core/C7` | warn | `<script>` attribute order differing from the app's canonical (`setup lang` vs `lang setup`) |
 
-Level discipline: `error` is reserved for crash-class rules (`core/R*` — a visitor-facing
-throw or silent production breakage); `warn` is for conventions and style choices
-(`core/C*`). A consumer's `levels` ceiling on an `core/R*` rule is NOT the tool for an existing
-backlog — fix the call sites or allowlist the reviewed exceptions with reasons.
+Level discipline: `error` is for crash-class rules (`core/R*`); `warn` is for
+conventions (`core/C*`). `core/R1`/`core/R3` (marked *) ship at `warn` **as an interim
+state** (2026-09-25): their fleet backlog is real code nobody has bandwidth to migrate
+and re-verify right now. Their target level is `error` — promote once the backlog
+clears (a breaking-style bump). `core/R2`/`core/R4` stay `error`. A consumer's `levels`
+ceiling is still never the tool for a backlog on an `error` rule — fix or allowlist.
 Underscore-prefixed SCSS partials (`_extends.scss`, `_colors-*.scss`, …) are declaration
 files by convention in every Brighterly app and are exempt from `core/C3`/`core/C6` wholesale.
 
@@ -108,6 +114,7 @@ export const settings = {
   typesRoot:         'app/types',                              // core/C5 (default shown)
   typographySource:  'the font() mixin from @scss/_mixins.scss', // core/C6 — cs-app points this at its AppText component instead
   scriptAttrOrder:   'setup-first',                            // core/C7 — or 'lang-first' (default 'setup-first')
+  selfTestFile:      'invariants/self-test.mts',               // its ignore-strings are fixture DATA — skipped by IG0/IG1
 }
 ```
 

package/dist/invariants/ast.d.ts

@@ -32,6 +32,43 @@ export declare const findStaticImports: (file: string, source: string) => Promis
     specifier: string;
     line: number;
 }[]>;
+export interface InlineLiteral {
+    line: number;
+    /** What the literal was fed to — the rule picks the fix per kind. */
+    kind: 'copy' | 'test-id' | 'option' | 'tag';
+    /** Source text of the literal, for the message. */
+    text: string;
+    /** The sink method (copy / test-id), `method.key` for an option, `tag` for a tag. */
+    via: string;
+}
+/**
+ * Every place a file addresses the app through an inline literal instead of the
+ * contract: a string, no-substitution template or RegExp literal fed to a
+ * copy sink, a test-id sink, a copy-carrying option (`getByRole` `name`,
+ * `filter` / `locator` `hasText` / `hasNotText`), or a test `tag`. Array
+ * arguments (`toHaveText(['a', 'b'])`, `tag: [...]`) are unwrapped. An
+ * identifier, a member expression (`copy.x`, `StepName.Grade`) and a template
+ * WITH an interpolation are the allowed forms. Facts only — the rule phrases the
+ * finding. Regex cannot do this honestly: the literal may sit inside nested
+ * parentheses or a multi-line options object, and a commented-out call must
+ * stay silent.
+ *
+ * Deliberately broad on `tag:` — it fires in ANY object literal, so
+ * `const opts = { tag: '@x' }; test('t', opts, …)` is caught; a non-Playwright
+ * `{ tag: 'h1' }` inside a test tree is the accepted rare false positive.
+ */
+export declare const findInlineLiterals: (file: string, source: string) => Promise<InlineLiteral[]>;
+/**
+ * `let` / `var` declarations that outlive a single test — at module scope or inside a
+ * `describe` callback. A declaration inside a test body, a `test.step` callback or
+ * a helper function is per-test and ignored; `const` and `using` are ignored everywhere.
+ */
+export declare const findSharedMutables: (file: string, source: string) => Promise<{
+    line: number;
+    kind: "let" | "var";
+    name: string;
+    scope: "module" | "describe";
+}[]>;
 /** One attribute or binding, normalised so a rule need not know the node types. */
 export interface TemplateAttr {
     /** Attribute name without the `:` / `v-bind:` prefix — `data-qa`, `class`, `title`. */
@@ -70,3 +107,48 @@ export declare const elementsByTag: (roots: TemplateEl[], tag: string) => Templa
 export declare const allElements: (roots: TemplateEl[]) => TemplateEl[];
 /** An element's attribute by name, static or bound. */
 export declare const attrOf: (el: TemplateEl, name: string) => TemplateAttr | undefined;
+export interface OptionLiteral {
+    /** The `id` property's line, or the object's when it has none. */
+    line: number;
+    /** The `value` label when it is a literal — for the message. */
+    value: string | null;
+    /** `missing`: no `id`; `computed`: an `id` that is not a string literal; `literal` otherwise. */
+    kind: 'missing' | 'computed' | 'literal';
+    /** The literal's cooked value, or the expression's source when computed. */
+    id: string | null;
+}
+/**
+ * Every object literal shaped like a `SelectOption` — it has both a `value` and a `selected`
+ * property — with what its `id` is, so a rule can judge the id without re-parsing the file. An
+ * object built from a spread is skipped: its id may well come from the spread, and reporting it
+ * would be a guess.
+ */
+export declare const findOptionLiterals: (file: string, source: string) => Promise<OptionLiteral[]>;
+/**
+ * Module- or describe-scope `const` holding a mutable container — `{}`, `[]`, `new Map()` … — that
+ * nothing freezes: the `let` of shared state under a different keyword. `as const` and
+ * `Object.freeze(…)` clear it.
+ */
+export declare const findSharedContainers: (file: string, source: string) => Promise<{
+    line: number;
+    name: string;
+    scope: "module" | "describe";
+}[]>;
+/**
+ * Calls to the callees `accept` names whose promise is not taken up where it is made: not under
+ * `await`, not returned, not the expression body of an arrow (which hands it to whoever calls the
+ * arrow — `booking.submitted(() => funnel.bookFirstSlot(…))` relies on exactly that). A bare
+ * statement drops it; an assignment or an argument parks it for a later that usually never comes.
+ */
+export declare const findUnawaitedCalls: (file: string, source: string, accept: (callee: string) => boolean) => Promise<{
+    line: number;
+    callee: string;
+    how: "dropped" | "assigned" | "passed";
+}[]>;
+/**
+ * `test(…)` calls (also `.only` / `.fixme`) declared inside a loop or a `forEach` / `map` callback:
+ * generated tests, which a textual count of `test(` sees as one.
+ */
+export declare const findGeneratedTests: (file: string, source: string) => Promise<{
+    line: number;
+}[]>;

package/dist/invariants/ast.js

@@ -107,6 +107,119 @@ export const findStaticImports = async (file, source) => {
     }
     return out;
 };
+/** Locator / matcher methods whose first argument is user-visible copy. */
+const COPY_SINKS = new Set(['getByText', 'getByLabel', 'getByPlaceholder', 'getByTitle', 'getByAltText', 'toHaveText', 'toContainText', 'toHaveTitle', 'toHaveAccessibleName', 'toHaveAccessibleDescription', 'toHaveAccessibleErrorMessage']);
+/** Methods whose first argument is a test id — a different fix (the enum / qa name), so a different kind. */
+const ID_SINKS = new Set(['getByTestId']);
+/**
+ * Option keys that carry copy, per method. A Map, not an object: a plain object
+ * resolves prototype members, so `toLocaleString(locale, { timeZone })` would
+ * look up a Function as its key list and crash the whole run.
+ */
+const COPY_OPTION_KEYS = new Map([
+    ['getByRole', ['name']],
+    ['filter', ['hasText', 'hasNotText']],
+    ['locator', ['hasText', 'hasNotText']],
+]);
+/**
+ * Every place a file addresses the app through an inline literal instead of the
+ * contract: a string, no-substitution template or RegExp literal fed to a
+ * copy sink, a test-id sink, a copy-carrying option (`getByRole` `name`,
+ * `filter` / `locator` `hasText` / `hasNotText`), or a test `tag`. Array
+ * arguments (`toHaveText(['a', 'b'])`, `tag: [...]`) are unwrapped. An
+ * identifier, a member expression (`copy.x`, `StepName.Grade`) and a template
+ * WITH an interpolation are the allowed forms. Facts only — the rule phrases the
+ * finding. Regex cannot do this honestly: the literal may sit inside nested
+ * parentheses or a multi-line options object, and a commented-out call must
+ * stay silent.
+ *
+ * Deliberately broad on `tag:` — it fires in ANY object literal, so
+ * `const opts = { tag: '@x' }; test('t', opts, …)` is caught; a non-Playwright
+ * `{ tag: 'h1' }` inside a test tree is the accepted rare false positive.
+ */
+export const findInlineLiterals = async (file, source) => {
+    const t = await ts();
+    const out = [];
+    for (const script of scriptsOf(file, source)) {
+        const sf = t.createSourceFile(file, script.code, t.ScriptTarget.Latest, true);
+        const lineAt = (node) => sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1 + script.lineOffset;
+        const isLiteral = (n) => t.isStringLiteral(n) || t.isNoSubstitutionTemplateLiteral(n) || t.isRegularExpressionLiteral(n);
+        // `name`, `'name'` and `"name"` are the same key; `getText` would keep the quotes.
+        const keyOf = (n) => (t.isIdentifier(n) || t.isStringLiteral(n) ? n.text : n.getText(sf));
+        const unwrap = (n) => (t.isArrayLiteralExpression(n) ? [...n.elements] : [n]);
+        const visit = (node) => {
+            if (t.isCallExpression(node) && t.isPropertyAccessExpression(node.expression)) {
+                const method = node.expression.name.text;
+                const [first] = node.arguments;
+                const sinkKind = COPY_SINKS.has(method) ? 'copy' : ID_SINKS.has(method) ? 'test-id' : null;
+                if (sinkKind && first) {
+                    for (const v of unwrap(first))
+                        if (isLiteral(v))
+                            out.push({ line: lineAt(v), kind: sinkKind, text: v.getText(sf), via: method });
+                }
+                const keys = COPY_OPTION_KEYS.get(method);
+                if (keys) {
+                    for (const arg of node.arguments) {
+                        if (!t.isObjectLiteralExpression(arg))
+                            continue;
+                        for (const p of arg.properties) {
+                            if (t.isPropertyAssignment(p) && keys.includes(keyOf(p.name)) && isLiteral(p.initializer)) {
+                                out.push({ line: lineAt(p.initializer), kind: 'option', text: p.initializer.getText(sf), via: `${method}.${keyOf(p.name)}` });
+                            }
+                        }
+                    }
+                }
+            }
+            if (t.isPropertyAssignment(node) && keyOf(node.name) === 'tag') {
+                for (const v of unwrap(node.initializer)) {
+                    // `.text` is the cooked value: '@smoke', "@smoke" and `@smoke` all pass; /@smoke/ does not.
+                    if (isLiteral(v) && v.text !== '@smoke')
+                        out.push({ line: lineAt(v), kind: 'tag', text: v.getText(sf), via: 'tag' });
+                }
+            }
+            t.forEachChild(node, visit);
+        };
+        visit(sf);
+    }
+    return out;
+};
+/**
+ * `let` / `var` declarations that outlive a single test — at module scope or inside a
+ * `describe` callback. A declaration inside a test body, a `test.step` callback or
+ * a helper function is per-test and ignored; `const` and `using` are ignored everywhere.
+ */
+export const findSharedMutables = async (file, source) => {
+    const t = await ts();
+    const out = [];
+    for (const script of scriptsOf(file, source)) {
+        const sf = t.createSourceFile(file, script.code, t.ScriptTarget.Latest, true);
+        const isFn = (n) => t.isArrowFunction(n) || t.isFunctionExpression(n) || t.isFunctionDeclaration(n) || t.isMethodDeclaration(n);
+        /** 'module' when no function encloses the statement, 'describe' when the nearest one is a describe callback, else null. */
+        const sharedScope = (st) => {
+            let p = st.parent;
+            while (p && !isFn(p))
+                p = p.parent;
+            if (!p)
+                return 'module';
+            const call = p.parent;
+            return call && t.isCallExpression(call) && /\bdescribe\b/.test(call.expression.getText(sf)) ? 'describe' : null;
+        };
+        const visit = (node) => {
+            if (t.isVariableStatement(node) && !(node.declarationList.flags & (t.NodeFlags.Const | t.NodeFlags.Using))) {
+                const scope = sharedScope(node);
+                if (scope) {
+                    const kind = node.declarationList.flags & t.NodeFlags.Let ? 'let' : 'var';
+                    for (const d of node.declarationList.declarations) {
+                        out.push({ line: sf.getLineAndCharacterOfPosition(d.getStart(sf)).line + 1 + script.lineOffset, kind, name: d.name.getText(sf), scope });
+                    }
+                }
+            }
+            t.forEachChild(node, visit);
+        };
+        visit(sf);
+    }
+    return out;
+};
 // ── Vue template AST ───────────────────────────────────────────────────────
 let sfcModule = null;
 const sfc = async () => {
@@ -193,3 +306,160 @@ export const allElements = (roots) => {
 };
 /** An element's attribute by name, static or bound. */
 export const attrOf = (el, name) => el.attrs.find(a => a.name === name);
+/**
+ * Every object literal shaped like a `SelectOption` — it has both a `value` and a `selected`
+ * property — with what its `id` is, so a rule can judge the id without re-parsing the file. An
+ * object built from a spread is skipped: its id may well come from the spread, and reporting it
+ * would be a guess.
+ */
+export const findOptionLiterals = async (file, source) => {
+    const t = await ts();
+    const out = [];
+    for (const script of scriptsOf(file, source)) {
+        const sf = t.createSourceFile(file, script.code, t.ScriptTarget.Latest, true);
+        const lineAt = (node) => sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1 + script.lineOffset;
+        const keyOf = (n) => (t.isIdentifier(n) || t.isStringLiteral(n) ? n.text : null);
+        const isText = (n) => t.isStringLiteral(n) || t.isNoSubstitutionTemplateLiteral(n);
+        const visit = (node) => {
+            if (t.isObjectLiteralExpression(node) && !node.properties.some(p => t.isSpreadAssignment(p))) {
+                const named = new Map();
+                for (const p of node.properties) {
+                    const key = t.isPropertyAssignment(p) || t.isShorthandPropertyAssignment(p) ? keyOf(p.name) : null;
+                    if (key !== null)
+                        named.set(key, p);
+                }
+                if (named.has('value') && named.has('selected')) {
+                    const valueProp = named.get('value');
+                    const value = valueProp && t.isPropertyAssignment(valueProp) && isText(valueProp.initializer) ? valueProp.initializer.text : null;
+                    const idProp = named.get('id');
+                    if (!idProp)
+                        out.push({ line: lineAt(node), value, kind: 'missing', id: null });
+                    else if (t.isPropertyAssignment(idProp) && isText(idProp.initializer))
+                        out.push({ line: lineAt(idProp), value, kind: 'literal', id: idProp.initializer.text });
+                    else
+                        out.push({ line: lineAt(idProp), value, kind: 'computed', id: idProp.getText(sf) });
+                }
+            }
+            t.forEachChild(node, visit);
+        };
+        visit(sf);
+    }
+    return out;
+};
+/**
+ * Module- or describe-scope `const` holding a mutable container — `{}`, `[]`, `new Map()` … — that
+ * nothing freezes: the `let` of shared state under a different keyword. `as const` and
+ * `Object.freeze(…)` clear it.
+ */
+export const findSharedContainers = async (file, source) => {
+    const t = await ts();
+    const out = [];
+    for (const script of scriptsOf(file, source)) {
+        const sf = t.createSourceFile(file, script.code, t.ScriptTarget.Latest, true);
+        const lineAt = (node) => sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1 + script.lineOffset;
+        const isDescribeCall = (n) => n !== undefined && t.isCallExpression(n) && /(?:^|\.)describe$/.test(n.expression.getText(sf));
+        const scopeOf = (statement) => {
+            const parent = statement.parent;
+            if (t.isSourceFile(parent))
+                return 'module';
+            const fn = t.isBlock(parent) ? parent.parent : undefined;
+            if (fn !== undefined && (t.isArrowFunction(fn) || t.isFunctionExpression(fn)) && isDescribeCall(fn.parent))
+                return 'describe';
+            return null;
+        };
+        const isContainer = (init) => {
+            if (t.isObjectLiteralExpression(init) || t.isArrayLiteralExpression(init))
+                return true;
+            return t.isNewExpression(init) && /^(?:Map|Set|WeakMap|WeakSet|Array)$/.test(init.expression.getText(sf));
+        };
+        const isAsConst = (n) => t.isAsExpression(n) && t.isTypeReferenceNode(n.type) && n.type.typeName.getText(sf) === 'const';
+        const isFrozen = (init) => isAsConst(init) || (t.isCallExpression(init) && init.expression.getText(sf) === 'Object.freeze');
+        /** `[] as string[]`, `({}) satisfies X`, `<T>[]` — the wrapper changes the type, not the mutability. */
+        const unwrap = (init) => {
+            let e = init;
+            for (;;) {
+                if (t.isParenthesizedExpression(e) || t.isSatisfiesExpression(e) || t.isTypeAssertionExpression(e) || (t.isAsExpression(e) && !isAsConst(e)))
+                    e = e.expression;
+                else
+                    return e;
+            }
+        };
+        const visit = (node) => {
+            if (t.isVariableStatement(node) && (node.declarationList.flags & t.NodeFlags.Const) !== 0) {
+                const scope = scopeOf(node);
+                if (scope !== null) {
+                    for (const decl of node.declarationList.declarations) {
+                        const init = decl.initializer;
+                        if (init !== undefined && !isFrozen(init) && isContainer(unwrap(init)))
+                            out.push({ line: lineAt(decl), name: decl.name.getText(sf), scope });
+                    }
+                }
+            }
+            t.forEachChild(node, visit);
+        };
+        visit(sf);
+    }
+    return out;
+};
+/**
+ * Calls to the callees `accept` names whose promise is not taken up where it is made: not under
+ * `await`, not returned, not the expression body of an arrow (which hands it to whoever calls the
+ * arrow — `booking.submitted(() => funnel.bookFirstSlot(…))` relies on exactly that). A bare
+ * statement drops it; an assignment or an argument parks it for a later that usually never comes.
+ */
+export const findUnawaitedCalls = async (file, source, accept) => {
+    const t = await ts();
+    const out = [];
+    for (const script of scriptsOf(file, source)) {
+        const sf = t.createSourceFile(file, script.code, t.ScriptTarget.Latest, true);
+        const lineAt = (node) => sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1 + script.lineOffset;
+        const visit = (node) => {
+            if (t.isCallExpression(node) && accept(node.expression.getText(sf))) {
+                let outer = node;
+                while (t.isParenthesizedExpression(outer.parent))
+                    outer = outer.parent;
+                const parent = outer.parent;
+                const takenUp = t.isAwaitExpression(parent) || t.isReturnStatement(parent) || (t.isArrowFunction(parent) && parent.body === outer);
+                if (!takenUp) {
+                    const how = t.isExpressionStatement(parent) || t.isVoidExpression(parent)
+                        ? 'dropped'
+                        : t.isVariableDeclaration(parent) || (t.isBinaryExpression(parent) && parent.operatorToken.kind === t.SyntaxKind.EqualsToken)
+                            ? 'assigned'
+                            : 'passed';
+                    out.push({ line: lineAt(node), callee: node.expression.getText(sf), how });
+                }
+            }
+            t.forEachChild(node, visit);
+        };
+        visit(sf);
+    }
+    return out;
+};
+/**
+ * `test(…)` calls (also `.only` / `.fixme`) declared inside a loop or a `forEach` / `map` callback:
+ * generated tests, which a textual count of `test(` sees as one.
+ */
+export const findGeneratedTests = async (file, source) => {
+    const t = await ts();
+    const out = [];
+    for (const script of scriptsOf(file, source)) {
+        const sf = t.createSourceFile(file, script.code, t.ScriptTarget.Latest, true);
+        const lineAt = (node) => sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1 + script.lineOffset;
+        const isLoop = (n) => t.isForStatement(n) || t.isForOfStatement(n) || t.isForInStatement(n) || t.isWhileStatement(n) || t.isDoStatement(n);
+        const isIteratorCallback = (n) => (t.isArrowFunction(n) || t.isFunctionExpression(n)) && t.isCallExpression(n.parent) && t.isPropertyAccessExpression(n.parent.expression) && /^(?:forEach|map|flatMap|each)$/.test(n.parent.expression.name.text);
+        const generated = (call) => {
+            for (let p = call.parent; p !== undefined && !t.isSourceFile(p); p = p.parent) {
+                if (isLoop(p) || isIteratorCallback(p))
+                    return true;
+            }
+            return false;
+        };
+        const visit = (node) => {
+            if (t.isCallExpression(node) && /^test(?:\.(?:only|fixme))?$/.test(node.expression.getText(sf)) && generated(node))
+                out.push({ line: lineAt(node) });
+            t.forEachChild(node, visit);
+        };
+        visit(sf);
+    }
+    return out;
+};

package/dist/invariants/rules/index.d.ts

@@ -28,11 +28,11 @@ export declare const commonRules: Rule[];
  * instead. A test pins this map to `commonRules`, so it cannot drift.
  */
 export declare const sharedRuleIds: {
-    /** `error` — bare `localStorage`/`sessionStorage` access. The accessor itself throws SecurityError on Safari ITP, Firefox strict mode and in-app webviews; `if (localStorage)` guards throw too. Fix: the app's safe storage wrapper (`settings.safeStorageModule`). */
+    /** `warn` (target `error`, interim 2026-09-25) — bare `localStorage`/`sessionStorage` access. The accessor itself throws SecurityError on Safari ITP, Firefox strict mode and in-app webviews; `if (localStorage)` guards throw too. Fix: the app's safe storage wrapper (`settings.safeStorageModule`). */
     readonly 'core/R1': "core/R1";
     /** `error` — SCSS rules written inline in a Vue `<style>` block. Inline styles drift from the design tokens invisibly. Fix: a dedicated `.scss` file referenced via `<style scoped lang="scss" src="…" />`. */
     readonly 'core/R2': "core/R2";
-    /** `error` — `JSON.parse` with no enclosing `try`/`catch`. A corrupt stored value crashes that code path permanently for the visitor. Fix: the app's guarded parse helper (`settings.safeJsonParse`) or try/catch. */
+    /** `warn` (target `error`, interim 2026-09-25) — `JSON.parse` with no enclosing `try`/`catch`. A corrupt stored value crashes that code path permanently for the visitor. Fix: the app's guarded parse helper (`settings.safeJsonParse`) or try/catch. */
     readonly 'core/R3': "core/R3";
     /** `error` — `@font-face` declaring a font *stack*. Inside `@font-face`, `font-family` names the face being defined; a comma-separated stack is invalid and the browser drops the face silently. Fix: single family name inside, the stack on the selectors that use it. */
     readonly 'core/R4': "core/R4";

package/dist/invariants/rules/index.js

@@ -28,11 +28,11 @@ export const commonRules = [...rRules, ...cRules];
  * instead. A test pins this map to `commonRules`, so it cannot drift.
  */
 export const sharedRuleIds = {
-    /** `error` — bare `localStorage`/`sessionStorage` access. The accessor itself throws SecurityError on Safari ITP, Firefox strict mode and in-app webviews; `if (localStorage)` guards throw too. Fix: the app's safe storage wrapper (`settings.safeStorageModule`). */
+    /** `warn` (target `error`, interim 2026-09-25) — bare `localStorage`/`sessionStorage` access. The accessor itself throws SecurityError on Safari ITP, Firefox strict mode and in-app webviews; `if (localStorage)` guards throw too. Fix: the app's safe storage wrapper (`settings.safeStorageModule`). */
     'core/R1': 'core/R1',
     /** `error` — SCSS rules written inline in a Vue `<style>` block. Inline styles drift from the design tokens invisibly. Fix: a dedicated `.scss` file referenced via `<style scoped lang="scss" src="…" />`. */
     'core/R2': 'core/R2',
-    /** `error` — `JSON.parse` with no enclosing `try`/`catch`. A corrupt stored value crashes that code path permanently for the visitor. Fix: the app's guarded parse helper (`settings.safeJsonParse`) or try/catch. */
+    /** `warn` (target `error`, interim 2026-09-25) — `JSON.parse` with no enclosing `try`/`catch`. A corrupt stored value crashes that code path permanently for the visitor. Fix: the app's guarded parse helper (`settings.safeJsonParse`) or try/catch. */
     'core/R3': 'core/R3',
     /** `error` — `@font-face` declaring a font *stack*. Inside `@font-face`, `font-family` names the face being defined; a comma-separated stack is invalid and the browser drops the face silently. Fix: single family name inside, the stack on the selectors that use it. */
     'core/R4': 'core/R4',

package/dist/invariants/rules/regression.js

@@ -14,7 +14,11 @@ import { eachLine, setting } from './shared.js';
 const bareStorage = {
     id: 'core/R1',
     title: 'bare localStorage / sessionStorage access',
-    level: 'error',
+    // Target level is `error` (crash-class). Shipped at `warn` since 2026-09-25: the fleet
+    // backlog (cs-app ~42 sites, main-app ~28) is real code the team has no bandwidth to
+    // migrate and re-verify right now, and a rushed storage migration is its own risk.
+    // Promote back to `error` once the backlog is cleared — that is a major-style bump.
+    level: 'warn',
     why: 'the bare API throws SecurityError on Safari ITP, Firefox strict mode and in-app webviews (Instagram/Facebook/TikTok) — the `if (localStorage)` guard does not help, the property accessor itself throws',
     fix: 'use the app\'s safe storage wrapper instead of the bare API',
     scope: ['app/**/*.{ts,vue}'],
@@ -43,6 +47,9 @@ const scssInStyleBlock = {
     why: 'inline style blocks drift from the design tokens and are invisible to the SCSS build — the component stops sharing the system without anything failing',
     fix: 'move the rules to a dedicated .scss file and reference it with <style scoped lang="scss" src="…" />',
     scope: ['app/**/*.vue'],
+    // Dev harness pages are dev tooling, not product surfaces — every app that has them
+    // (tutor room-preview, cs-app preview) was allowlisting the same thing (2026-09-25).
+    exclude: ['app/pages/dev/**'],
     check: ({ file, source }) => {
         const out = [];
         const re = /<style\b[^>]*>([\s\S]*?)<\/style>/g;
@@ -68,7 +75,8 @@ const scssInStyleBlock = {
 const unguardedJsonParse = {
     id: 'core/R3',
     title: 'unguarded JSON.parse',
-    level: 'error',
+    // Target level is `error` — see core/R1 above; same interim decision (2026-09-25).
+    level: 'warn',
     async: true,
     why: 'a truncated write or a hand-edited storage entry makes JSON.parse throw on every re-entry to that code path, until the visitor clears storage — the failure is permanent for them, not transient',
     fix: 'parse through the app\'s guarded helper, or wrap the call in try/catch',

package/dist/invariants/run.d.ts

@@ -13,6 +13,7 @@
  *   2 — the validator itself failed
  */
 import type { Allowlists, Levels, LinterOwnedRule, RetiredRules, Rule, Unmaintained } from './types.js';
+import type { Fixture } from './self-test.js';
 export interface RunOptions {
     /** Repo root. Passed, never derived — import.meta.url here resolves into node_modules. */
     root: string;
@@ -39,11 +40,7 @@ export interface RunOptions {
     /** Config file a dangling allowlist/levels key is reported against. */
     configFile?: string;
     /** Fixtures for --self-test, keyed by rule id. Omit to skip the self-test entirely. */
-    fixtures?: Record<string, {
-        file: string;
-        bad: string;
-        good: string;
-    }>;
+    fixtures?: Record<string, Fixture>;
     /** Repo-specific self-test assertions; each returns failure messages. */
     extraChecks?: (() => string[] | Promise<string[]>)[];
     /** Rule ids exempt from the fixture requirement — registry rules a fixture cannot express. */