@starci/eslint-canon-be 1.0.1 → 1.2.0

package/testing.mjs

@@ -10,6 +10,34 @@
  * whose every assertion is about a call rather than a result, and an end-to-end spec that never
  * reads any state back. Both were measured before being written: eight specs and one e2e file in
  * the source repository, which is why the second lands with a carve-out rather than at zero.
+ *
+ * Two more codes turned out to have a genuinely mechanical HALF, added later and kept narrow on
+ * purpose:
+ *
+ *   - TESTING-1. A filename cannot be checked against a business sentence - but the anti-pattern
+ *     the law names by example (`rewards-queries.e2e-spec.ts`) IS a closed, denylisted shape: a
+ *     filename whose last segment is an API noun rather than a business one. The rule refuses only
+ *     that shape; it does not claim to certify a good name, and it is the same requirement E2E-1 in
+ *     `e2e-flow.md` states on the same file, so one rule holds both codes rather than reporting the
+ *     same file twice under two names.
+ *   - TESTING-7. "A stub of a model returns a payload the production parser can actually parse" -
+ *     the rule cannot verify the payload parses, but it CAN refuse the one shape the law names by
+ *     example: a bare marker string (`"stubbed"`, `"ok"`, `"test"`) standing in for the whole
+ *     answer. An object literal, or a `JSON.stringify(...)` call, is out of the rule's reach on
+ *     purpose - that is where a false positive would start.
+ *
+ * TESTING-5 / TESTING-8 ("a configured lane either holds tests or does not exist") was drafted as a
+ * filesystem-reading rule and then WITHDRAWN. It reads correctly as JS to `@typescript-eslint/parser`
+ * (`{"rootDir": "..."}` parses as an `ExpressionStatement` over an `ObjectExpression` under this
+ * parser, no wrapping needed) and its own file-scoped RuleTester cases passed. It is left out anyway,
+ * because the question it would answer is not "does this repository's config have this shape" but
+ * "does the CONSUMING repository's `eslint.config.mjs` even point a linter at this file at all" - and
+ * in the measured reference repository it does not: `files` there is five TypeScript globs under
+ * `src`, `apps`, `libs`, `test` and `tests` - none of them `.json` - so `jest-e2e.json` and
+ * `jest-harness.json` sit outside every one of them. A rule that cannot be reached by the config
+ * that would run it is not a `warn`-with-a-count away from correct; it is dead code reporting a "0"
+ * that means "never asked", not "already true" - the one measurement this family refuses to publish
+ * as if it were the other.
  */
 
 /** Forward-slash form of a filename, so Windows paths compare like every other path. */
@@ -171,50 +199,6 @@ export const noModelCallInE2e = {
   },
 }
 
-// -- TESTING-3 -------------------------------------------------------------------------------------
-
-/** CQRS application buses are internal dispatchers, never production entry points. */
-const APPLICATION_BUSES = new Set(["CommandBus", "QueryBus", "EventBus"])
-
-/** Methods whose direct invocation skips the transport owned by production. */
-const INTERNAL_ENTRY_METHODS = new Set(["execute", "process"])
-
-/** An e2e enters through a production transport rather than an application object. */
-export const e2eUsesProductionTransport = {
-  meta: {
-    type: "problem",
-    docs: { description: "An e2e enters through GraphQL, HTTP, socket, broker or scheduler transport." },
-    schema: [],
-    messages: {
-      busImport:
-        "`{{name}}` is an application dispatcher, not a production transport. An e2e must enter through GraphQL, HTTP, a real socket, a broker message or the scheduler boundary so routing, guards, validation and serialization are part of the proof.",
-      direct:
-        "Direct `.{{method}}()` invocation skips the production transport and starts inside the application. Move this decision/wiring test to the integration lane, or drive the flow through GraphQL, HTTP, a real socket, broker or scheduler boundary.",
-    },
-  },
-  create(context) {
-    if (!isE2eSpec(context.filename || context.getFilename())) return {}
-    return {
-      ImportDeclaration(node) {
-        if (!node.source || node.source.value !== "@nestjs/cqrs") return
-        for (const specifier of node.specifiers) {
-          if (specifier.type !== "ImportSpecifier") continue
-          const imported = specifier.imported && (specifier.imported.name || specifier.imported.value)
-          if (!APPLICATION_BUSES.has(imported)) continue
-          context.report({ node: specifier, messageId: "busImport", data: { name: imported } })
-        }
-      },
-      CallExpression(node) {
-        const callee = node.callee
-        if (!callee || callee.type !== "MemberExpression" || callee.computed) return
-        const method = callee.property && callee.property.name
-        if (!INTERNAL_ENTRY_METHODS.has(method)) return
-        context.report({ node: callee.property, messageId: "direct", data: { method } })
-      },
-    }
-  },
-}
-
 // -- TESTING-10 ------------------------------------------------------------------------------------
 
 /** Official provider clients that a harness may call without a house routing layer. */
@@ -321,13 +305,118 @@ export const harnessCallsProviderDirectly = {
   },
 }
 
+// -- TESTING-1 (and E2E-1 in e2e-flow.md, the same requirement on the same file) -------------------
+
+/** Nouns that name an API shape rather than a business promise. `rewards-queries` is the anchor. */
+const API_SHAPED_FILENAME_NOUNS = new Set([
+  "queries", "query", "mutations", "mutation",
+  "resolvers", "resolver", "endpoints", "endpoint",
+  "controllers", "controller", "handlers", "handler",
+  "modules", "module", "apis", "api",
+])
+
+/** The hyphen-separated words of an e2e filename, with the lane suffix stripped. */
+const e2eFilenameSegments = (filename) => {
+  const base = normalizePath(filename).split("/").pop() || ""
+  return base.replace(/\.e2e-spec\.ts$/, "").split("-").filter(Boolean)
+}
+
+/** An e2e file is one business flow; the filename may not be an API-shape noun wearing its clothes. */
+export const noApiShapedE2eFilename = {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "An e2e filename reads as a business sentence (TESTING-1; E2E-1 in e2e-flow.md), not a resolver/endpoint/module group.",
+    },
+    schema: [],
+    messages: {
+      apiShaped:
+        "`{{segment}}` names an API shape - a resolver group, an endpoint, a module - not a business promise. TESTING-1 / E2E-1: one e2e file is one business flow and the filename IS that flow; `rewards-queries.e2e-spec.ts` is exactly the shape this refuses. Name the file for the sentence it proves (`course-purchase.e2e-spec.ts`), not the API surface it happens to hit.",
+    },
+  },
+  create(context) {
+    const filename = context.filename || context.getFilename()
+    if (!isE2eSpec(filename)) return {}
+    const segments = e2eFilenameSegments(filename)
+    if (segments.length === 0) return {}
+    const last = segments[segments.length - 1].toLowerCase()
+    if (!API_SHAPED_FILENAME_NOUNS.has(last)) return {}
+    return {
+      Program(node) {
+        context.report({ node, messageId: "apiShaped", data: { segment: last } })
+      },
+    }
+  },
+}
+
+// -- TESTING-7 -------------------------------------------------------------------------------------
+
+/** Test-infra helpers, where the shared model stub this code governs actually lives. */
+const isTestHelperFile = (filename) => /\/tests\/helpers\//.test(normalizePath(filename))
+
+/** Bare markers a stub returns when nobody gave it a real answer to stand in for. */
+const MARKER_STRINGS = new Set(["stubbed", "stub", "ok", "test", "mock", "fake", "todo", "tbd", "n/a", "pending", ""])
+
+/** A string literal that is nothing but a marker - not an object, not a `JSON.stringify(...)` call. */
+const isMarkerLiteral = (node) => Boolean(
+  node && node.type === "Literal" && typeof node.value === "string" && MARKER_STRINGS.has(node.value.trim().toLowerCase()),
+)
+
+/** The world's default model stub returns a payload the production parser can actually parse. */
+export const noMarkerModelStub = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "A model stub in test infra returns a parseable payload (TESTING-7), never a bare marker string.",
+    },
+    schema: [],
+    messages: {
+      marker:
+        "This stub resolves to `{{value}}`, a marker rather than an answer. TESTING-7: a stub of a model returns a payload the production parser can actually parse - a marker string means the strict-JSON parser the real flow depends on never runs, so the most fragile seam in the flow is never exercised. Return the shape the production parser expects (an object, or a `JSON.stringify(...)` of one), the way `DEFAULT_MODEL_ANSWER` does.",
+    },
+  },
+  create(context) {
+    if (!isTestHelperFile(context.filename || context.getFilename())) return {}
+    return {
+      CallExpression(node) {
+        const callee = node.callee
+        if (!callee || callee.type !== "MemberExpression" || callee.computed) return
+        const method = callee.property.name
+        if (method === "mockResolvedValue" || method === "mockReturnValue") {
+          const argument = node.arguments[0]
+          if (isMarkerLiteral(argument)) {
+            context.report({ node: argument, messageId: "marker", data: { value: JSON.stringify(argument.value) } })
+          }
+          return
+        }
+        if (method !== "mockImplementation") return
+        const fn = node.arguments[0]
+        if (!fn || (fn.type !== "ArrowFunctionExpression" && fn.type !== "FunctionExpression")) return
+        if (fn.body.type !== "BlockStatement") {
+          if (isMarkerLiteral(fn.body)) {
+            context.report({ node: fn.body, messageId: "marker", data: { value: JSON.stringify(fn.body.value) } })
+          }
+          return
+        }
+        for (const statement of fn.body.body) {
+          if (statement.type === "ReturnStatement" && isMarkerLiteral(statement.argument)) {
+            context.report({ node: statement.argument, messageId: "marker", data: { value: JSON.stringify(statement.argument.value) } })
+          }
+        }
+      },
+    }
+  },
+}
+
 /** The rules this law contributes to the plugin. */
 export const rules = {
   "no-call-only-spec": noCallOnlySpec,
   "e2e-asserts-persisted-state": e2eAssertsPersistedState,
   "no-model-call-in-e2e": noModelCallInE2e,
-  "e2e-uses-production-transport": e2eUsesProductionTransport,
   "harness-calls-provider-directly": harnessCallsProviderDirectly,
+  "no-api-shaped-e2e-filename": noApiShapedE2eFilename,
+  "no-marker-model-stub": noMarkerModelStub,
 }
 
 /**
@@ -343,11 +432,23 @@ export const rules = {
  * config never loaded. Count only the reports carrying this rule's own id.
  *
  * Both land at `warn` with the count, get burned down, and flip to `error` at zero.
+ *
+ * The two later rules were measured the same way, against the same repository:
+ *
+ *   - `no-api-shaped-e2e-filename` found TWO of 77 - `installment-plan-queries.e2e-spec.ts` and
+ *     `rewards-queries.e2e-spec.ts`, the exact anchor example the law names. Real, pre-existing debt
+ *     this task does not fix, so it lands at `warn` rather than claiming a burn-down that has not
+ *     happened.
+ *   - `no-marker-model-stub` found ZERO of the world's own stub in `tests/helpers/flow-world.ts`:
+ *     the default answer is `JSON.stringify({ answer: "..." })`, which is a `CallExpression`, not a
+ *     `Literal`, so the rule does not even see it as a candidate. It ships at `error` as a
+ *     regression guard on a shape that is already correct.
  */
 export const recommended = {
   "starci-be/no-call-only-spec": "error", // no=0 of 182 - burned down from 1
   "starci-be/e2e-asserts-persisted-state": "error", // no=0 of 47 - burned down from 1
   "starci-be/no-model-call-in-e2e": "error", // no=0 of 47
-  "starci-be/e2e-uses-production-transport": "error",
   "starci-be/harness-calls-provider-directly": "error",
+  "starci-be/no-api-shaped-e2e-filename": "warn", // no=2 of 77 - pre-existing, not burned down here
+  "starci-be/no-marker-model-stub": "error", // no=0 - the world's stub already returns JSON.stringify(...)
 }

package/transport.mjs

@@ -92,12 +92,77 @@ export const doorLivesInFeatures = {
   },
 }
 
+/** An import specifier's alias prefix for a door. */
+const FEATURES_ALIAS = "@features/"
+
+/** A relative or deep specifier climbing into `features/`, once the alias form is ruled out. */
+const FEATURES_SEGMENT = /(^|\/)features\//
+
+/** Whether an import specifier reaches into `features/`, by alias or by path. */
+const reachesFeatures = (specifier) => {
+  if (typeof specifier !== "string") return false
+  if (specifier.startsWith(FEATURES_ALIAS)) return true
+  return FEATURES_SEGMENT.test(specifier)
+}
+
+/**
+ * Rule 6: "A capability stays under `modules/` and is called by a door, never reached directly."
+ * A door under `features/` importing a capability under `modules/` is the entire shape TRANSPORT-3
+ * sets up, and this rule is not that edge - it fires only the other way: a file living under
+ * `modules/` reaching back into `features/`. That reversal makes the capability the caller and the
+ * door the thing being reached, which is backwards from what a capability is - it is CALLED, and it
+ * stays ignorant of who calls it. One capability importing another capability under `modules/` is
+ * untouched here; this rule polices one edge, not the whole graph.
+ */
+export const noCapabilityImportsFeatures = {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "TRANSPORT Rule 6: a capability under modules/ never imports from features/ - a door calls into a capability, never the other way round.",
+    },
+    schema: [],
+    messages: {
+      reversed:
+        "`{{specifier}}` reaches from a capability under modules/ into features/, where doors live. A capability is CALLED by a door and stays ignorant of who calls it; importing back into features/ makes the capability the caller, which is the exact edge this law forbids. Move the shared code under modules/, or invert the call so the door reaches in.",
+    },
+  },
+  create(context) {
+    const path = normalize(context.filename || context.getFilename())
+    if (!/\/src\/modules\//.test(path)) return {}
+    const check = (node, specifier) => {
+      if (reachesFeatures(specifier)) context.report({ node, messageId: "reversed", data: { specifier } })
+    }
+    return {
+      ImportDeclaration(node) {
+        check(node.source, node.source.value)
+      },
+      ExportNamedDeclaration(node) {
+        if (node.source) check(node.source, node.source.value)
+      },
+      ExportAllDeclaration(node) {
+        if (node.source) check(node.source, node.source.value)
+      },
+    }
+  },
+}
+
 export const rules = {
   "rest-door-needs-a-reason": restDoorNeedsAReason,
   "door-lives-in-features": doorLivesInFeatures,
+  "no-capability-imports-features": noCapabilityImportsFeatures,
 }
 
+/**
+ * `no-capability-imports-features` measures at 9 offenders across 6 files in the reference
+ * repository (`src/**`, probed against source directly since the published package predates this
+ * rule) -- every one a capability under `modules/bussiness/**` importing a single shared helper
+ * published under `@features/api/processors/ai/shared/xp/write-coin-history`. That is standing debt,
+ * not zero, so it ships at `warn` with the count on record, matching this module's own Exceptions
+ * section: measured debt arrives at `warn` and flips to `error` once it reaches zero.
+ */
 export const recommended = {
   "starci-be/rest-door-needs-a-reason": "error",
   "starci-be/door-lives-in-features": "error",
+  "starci-be/no-capability-imports-features": "warn",
 }

package/type-safety.mjs

@@ -1,18 +1,23 @@
 /**
  * The rules that hold `type-safety.md`.
  *
- * Three house rules plus two standard ones, and the split is worth knowing. `no-explicit-any` and
+ * Five house rules plus two standard ones, and the split is worth knowing. `no-explicit-any` and
  * the array-type spelling already exist in the TypeScript plugin and are named in `recommended`
  * rather than reimplemented -- a second implementation of a rule everybody has is a maintenance
- * cost with no gain.
+ * cost with no gain. Rule 1 (`any` in a declaration, cast target or generic argument) is exactly
+ * that rule; a house-written twin of `no-explicit-any` would be the two-homes-for-one-law failure
+ * this canon exists to prevent, so rule 1 is deliberately not reimplemented here.
  *
- * What is house-written is what the standard set does not cover: the double cast (TYPE-2), the
- * inline parameter type (TYPE-3) and the const enum (TYPE-4). Each is a way of switching the
- * compiler off that looks locally reasonable, which is exactly the class a rule is for.
+ * What is house-written is what the standard set does not cover: the double cast (TYPE-2, rule 3),
+ * the inline parameter type (TYPE-3, rule 4), the const enum (TYPE-4, rule 5), the unguarded cast
+ * off an `unknown` value (TYPE-1's second half, rule 2), and the per-line suppression standing in
+ * for a lane (TYPE-6, rule 7). Each is a way of switching the compiler off -- or of leaving it
+ * turned further down than the law asks -- that looks locally reasonable, which is exactly the
+ * class a rule is for.
  *
- * TYPE-5 is not enforced. Whether a set of booleans describes ONE situation or several genuinely
- * independent ones needs to know what the code means, and a rule that guessed would fire on every
- * struct with two flags in it.
+ * TYPE-5 (rule 6, the boolean-flag product) is NOT among them, and that absence was tested rather
+ * than assumed. See the comment where TYPE-5 would sit, below, for what was tried and why it was
+ * withdrawn after being measured against the reference backend.
  */
 
 /** Forward-slash form of a filename, so Windows paths compare like every other path. */
@@ -55,6 +60,161 @@ export const noDoubleCast = {
   },
 }
 
+// -- TYPE-1, second half (rule 2) -------------------------------------------------------------------
+
+/** typeof/instanceof/in/null-equality/Array.isArray are the sanctioned ways to narrow an `unknown`. */
+const isNullOrUndefinedLiteral = (node) =>
+  (node.type === "Literal" && node.value === null) || (node.type === "Identifier" && node.name === "undefined")
+
+/** The nearest enclosing function, so narrowing found in one function never covers another. */
+const enclosingFunction = (node) => {
+  let current = node.parent
+  while (current) {
+    if (
+      current.type === "FunctionDeclaration"
+      || current.type === "FunctionExpression"
+      || current.type === "ArrowFunctionExpression"
+    ) {
+      return current
+    }
+    current = current.parent
+  }
+  return null
+}
+
+/** Whether a parameter or variable is explicitly declared `: unknown` at the point it enters. */
+const isUnknownAnnotation = (typeAnnotation) =>
+  !!typeAnnotation && !!typeAnnotation.typeAnnotation && typeAnnotation.typeAnnotation.type === "TSUnknownKeyword"
+
+/**
+ * A value declared `unknown` is cast straight to a concrete type with no visible check first.
+ *
+ * `unknown` refuses every operation until narrowed -- except a cast, which TypeScript allows
+ * FREELY from `unknown` to anything, no guard required. `no-double-cast` catches the pair that
+ * launders a wrong type through `unknown`; it does not catch a single cast that starts already
+ * `unknown` and asserts straight past the type system with nothing behind it. That gap is TYPE-1's
+ * second half: the law asks for "unknown, narrowed exactly once, visibly", and a bare cast narrows
+ * nothing -- it only claims to.
+ *
+ * Scoped to identifiers explicitly annotated `unknown` (a parameter or a `const x: unknown`), and
+ * to narrowing found anywhere earlier in the SAME enclosing function -- not a full control-flow
+ * proof, because this plugin carries no type information to build one. The forms it accepts as
+ * narrowing are `typeof`, `instanceof`, `in`, a null/undefined equality check, and -- deliberately
+ * loose -- passing the value into ANY function call, because the law names "a predicate" beside
+ * `typeof`/`instanceof` and a custom guard is exactly that predicate; this rule cannot read what
+ * is inside the call, so it trusts that a call taking the value is a check on it. That looseness
+ * trades missed gaps for avoided false positives on purpose. The test lanes are exempt for the
+ * same reason `no-double-cast` exempts them: a harness helper that hands a caller-supplied
+ * generic type back unchecked (`nextMessage<TPayload>`) is deliberate, not a gap. Measured against
+ * the reference backend, this rule still stays at `warn` -- the debt is real and small enough to
+ * burn down, not yet zero.
+ */
+export const noUnguardedUnknownCast = {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "A value declared `unknown` is narrowed by a visible check before it is cast to a concrete type (TYPE-1, law 2).",
+    },
+    schema: [],
+    messages: {
+      unguarded:
+        "`{{name}}` entered as `unknown` and is cast straight to `{{target}}` with no `typeof`, `instanceof`, `in` or null check on `{{name}}` anywhere earlier in this function. A cast out of `unknown` is unrestricted by design -- TypeScript will not stop you -- so the check has to be the thing that stops you. Add one before the cast: `typeof {{name}} === \"...\"`, `{{name}} instanceof ...`, or `{{name}} !== null`.",
+    },
+  },
+  create(context) {
+    // the harness lane builds generic pass-through helpers on purpose (`nextMessage<TPayload>`
+    // handing back whatever the event bus produced as the caller's declared type) -- the same
+    // "deliberately unchecked on purpose" property TYPE-2 already carves the test lanes out for
+    if (isTestFile(context.filename || context.getFilename())) return {}
+    const sourceCode = context.sourceCode || context.getSourceCode()
+    const trackedByScope = new Map()
+    const narrowedByScope = new Map()
+    const scopeKey = (node) => enclosingFunction(node) || "module"
+
+    const track = (name, scope) => {
+      if (!trackedByScope.has(scope)) trackedByScope.set(scope, new Set())
+      trackedByScope.get(scope).add(name)
+    }
+    const markNarrowed = (name, scope) => {
+      if (!narrowedByScope.has(scope)) narrowedByScope.set(scope, new Set())
+      narrowedByScope.get(scope).add(name)
+    }
+
+    const checkParams = (fnNode) => {
+      for (const raw of fnNode.params) {
+        const param = unwrapParam(raw)
+        if (param.type === "Identifier" && isUnknownAnnotation(param.typeAnnotation)) {
+          track(param.name, fnNode)
+        }
+      }
+    }
+
+    return {
+      FunctionDeclaration(node) {
+        checkParams(node)
+      },
+      FunctionExpression(node) {
+        checkParams(node)
+      },
+      ArrowFunctionExpression(node) {
+        checkParams(node)
+      },
+      VariableDeclarator(node) {
+        if (node.id.type === "Identifier" && isUnknownAnnotation(node.id.typeAnnotation)) {
+          track(node.id.name, scopeKey(node))
+        }
+      },
+      UnaryExpression(node) {
+        if (node.operator !== "typeof") return
+        if (node.argument.type !== "Identifier") return
+        markNarrowed(node.argument.name, scopeKey(node))
+      },
+      BinaryExpression(node) {
+        if (node.operator === "instanceof") {
+          if (node.left.type === "Identifier") markNarrowed(node.left.name, scopeKey(node))
+          return
+        }
+        if (node.operator === "in") {
+          if (node.right.type === "Identifier") markNarrowed(node.right.name, scopeKey(node))
+          return
+        }
+        if (!["===", "!==", "==", "!="].includes(node.operator)) return
+        if (node.left.type === "Identifier" && isNullOrUndefinedLiteral(node.right)) {
+          markNarrowed(node.left.name, scopeKey(node))
+        }
+        if (node.right.type === "Identifier" && isNullOrUndefinedLiteral(node.left)) {
+          markNarrowed(node.right.name, scopeKey(node))
+        }
+      },
+      CallExpression(node) {
+        // any predicate call that TAKES the value narrows it, the same way `typeof` does -- the
+        // law names "a predicate" beside `typeof`/`instanceof` on purpose, and a custom guard
+        // (`this.isPlainObject(current)`, `Array.isArray(value)`) is exactly that predicate. This
+        // side is deliberately loose: the cost of missing a real gap here is smaller than the cost
+        // of flagging a guard this rule cannot read the inside of.
+        for (const arg of node.arguments) {
+          if (arg.type === "Identifier") markNarrowed(arg.name, scopeKey(node))
+        }
+      },
+      TSAsExpression(node) {
+        if (node.expression.type !== "Identifier") return
+        const name = node.expression.name
+        const scope = scopeKey(node)
+        if (!trackedByScope.get(scope) || !trackedByScope.get(scope).has(name)) return
+        const target = node.typeAnnotation
+        if (target && target.type === "TSUnknownKeyword") return
+        if (narrowedByScope.get(scope) && narrowedByScope.get(scope).has(name)) return
+        context.report({
+          node,
+          messageId: "unguarded",
+          data: { name, target: sourceCode.getText(target) },
+        })
+      },
+    }
+  },
+}
+
 // -- TYPE-3 ----------------------------------------------------------------------------------------
 
 /** A destructured parameter's type is named, so a second caller can reference it. */
@@ -116,11 +276,83 @@ export const noConstEnum = {
   },
 }
 
+// -- TYPE-5 (rule 6) -- ATTEMPTED, NOT SHIPPED ------------------------------------------------------
+//
+// A rule was written here: two-or-more `is`/`has`-prefixed booleans sharing a type literal with a
+// field that is optional and not itself boolean. It was measured against the reference backend
+// before shipping, per this canon's own standard -- and both of its two real firings were wrong.
+// `GlobalSearchItem` (`isEnrolled` / `isFree` / `isPremium` beside an unrelated optional
+// `parentPath`) and `AdvertisementSeedItem` (`isHouseAd` / `isActive` beside an unrelated optional
+// `ctaText`) are both genuinely independent facts about one entity, not a product of states -- the
+// exact "transport type" and "independent booleans" exceptions `type-safety.md` already names. A
+// rule reporting a defect on 2 of its 2 real firings is not a rule with debt to burn down; it is
+// wrong, and shipping it at any level would teach a reader to distrust the machine rather than the
+// code. TYPE-5 stays `documented`, exactly as the law's own `Layer held` table already says: seeing
+// past a transport DTO to whether its flags are truly one situation needs the meaning of the code,
+// which is a reader's job, not a decidable question of syntax.
+
+// -- TYPE-6 (rule 7) ----------------------------------------------------------------------------------
+
+/** This law's own published rule names -- the only ones this rule polices. */
+const TYPE_SAFETY_RULE_NAMES = [
+  "no-double-cast",
+  "no-inline-param-type",
+  "no-const-enum",
+  "no-unguarded-unknown-cast",
+]
+
+const DISABLE_DIRECTIVE = /^eslint-disable(?:-next-line|-line)?\b/
+
+/**
+ * A sanctioned exit is declared at the lane, once -- not suppressed per line.
+ *
+ * `no-double-cast`'s test-lane exemption already lives in `isTestFile`, consulted once, so every
+ * place the exit is in force is derivable from that one function. A per-line `eslint-disable` for
+ * any rule this law publishes is therefore never the lane speaking -- it is either redundant (the
+ * lane already covers the file) or an undeclared second exit (the file needed one and reached for
+ * a comment instead of a lane). Either way `type-safety.md` names this exact failure: "a per-line
+ * suppression standing in for a lane-wide exit".
+ *
+ * Deliberately scoped to only the five rule names this law publishes -- a rule that policed every
+ * `eslint-disable` in the repository would be reaching into every other family's lane, which is
+ * outside this file's boundary.
+ */
+export const noLineSuppression = {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "No inline `eslint-disable` for a type-safety rule; the lane is the only sanctioned exit (TYPE-6, law 7).",
+    },
+    schema: [],
+    messages: {
+      suppression:
+        "This comment disables `starci-be/{{name}}` on one line. That rule's only sanctioned exit is declared once, at the lane, inside the rule itself -- a per-line suppression is never that declaration, it is a stand-in for one. Delete the comment; if the file genuinely needs the exemption, it belongs in the lane the rule already recognizes.",
+    },
+  },
+  create(context) {
+    const sourceCode = context.sourceCode || context.getSourceCode()
+    return {
+      "Program:exit"(node) {
+        for (const comment of sourceCode.getAllComments()) {
+          const text = comment.value.trim()
+          if (!DISABLE_DIRECTIVE.test(text)) continue
+          const named = TYPE_SAFETY_RULE_NAMES.find((name) => text.includes(`starci-be/${name}`))
+          if (!named) continue
+          context.report({ node: comment ?? node, messageId: "suppression", data: { name: named } })
+        }
+      },
+    }
+  },
+}
+
 /** The rules this law contributes to the plugin. */
 export const rules = {
   "no-double-cast": noDoubleCast,
   "no-inline-param-type": noInlineParamType,
   "no-const-enum": noConstEnum,
+  "no-unguarded-unknown-cast": noUnguardedUnknownCast,
+  "no-line-suppression": noLineSuppression,
 }
 
 /**
@@ -138,6 +370,8 @@ export const recommended = {
   "starci-be/no-double-cast": "error",
   "starci-be/no-inline-param-type": "error",
   "starci-be/no-const-enum": "error",
+  "starci-be/no-unguarded-unknown-cast": "warn", // no=3 -- see type-safety.mjs's doc comment
+  "starci-be/no-line-suppression": "error",
   "@typescript-eslint/no-explicit-any": "error",
   "@typescript-eslint/array-type": ["error", {
     default: "generic",