@starci/eslint-canon-be 3.2.19 → 3.3.0

package/runtime/knowledge/hfs/rules.yaml

@@ -17,7 +17,7 @@
 # modules/kernel/allowlist.yaml, held by RT_ALLOWLIST_SPRAWL. Codes are quoted: the failure-code
 # scanner reads this file as an emitter of every code it names.
 schema: starci/hfs-rules@3
-version: 3.0.0
+version: 3.1.0
 gates:
   pre-commit: the managed .husky/pre-commit at the app root - starci app hygiene (staged .starciwork and .starcistacks paths, secrets guard), typecheck, ESLint per side and stylelint on the staged files, prettier --check, the unit specs the staged files touch
   pre-push: typecheck, lint (starci app lint), format:check and the unit specs affected since origin/main; runs every pre-commit rule again
@@ -112,12 +112,16 @@ rules:
       - {kind: work-validate, id: identity-custody-role, at: scripts/work/validate/check-example-work.mjs}
   - id: R10
     code: "HFS_STACKS_SHAPE"
-    law: "`.starcistacks` has the standard shape and the host Sonar owner."
+    law: "`.starcistacks` has the edition-aware standard shape and the host Sonar owner; Swarm stacks have digest-pinned images, healthchecks, rollout, rollback and restart policies, versioned external secrets, ingress-only published ports and declared schedulers for replicated jobs. Recurring work is app-owned; host crontab installation is forbidden. Lite declares Supabase as managed backing and runs no duplicate backing-service component."
     kinds: [check, codemod]
     gates: [settle, land, ci]
     failureCodes: ["HFS_STACKS_SHAPE"]
     enforcers:
       - {kind: hfs, id: stacks-shape, at: scripts/hfs/rules/stacks.mjs}
+      - {kind: hfs, id: stacks-runtime, at: scripts/hfs/rules/stacks-runtime.mjs}
+      - {kind: hfs, id: stacks-evidence-runtime, at: scripts/gates/stacks-gate.mjs}
+      - {kind: hfs, id: starcistacks-runtime, at: scripts/gates/starcistacks-runtime.mjs}
+      - {kind: hfs, id: starcistacks-runtime-gate, at: scripts/gates/starcistacks.mjs}
   - id: R11
     code: "HFS_SONAR_CONFIG"
     law: "Sonar config is generated, with no host URL, importing the be lcov with the logic of be/src/modules (the coverage scope derived from the slot manifest) as the only coverage scope."
@@ -258,7 +262,7 @@ rules:
       - {kind: eslint-fe, id: dead-exports}
   - id: R26
     code: "BE_TIER_DIRECTION"
-    law: "The tier direction matrix; a shared package never imports an app."
+    law: "The tier direction matrix; a shared package never imports an app. Front-end page and layout owners may import overlay entries; every other cross-owner feature-to-feature edge is forbidden, including layout-to-page and overlay-to-overlay. Components never import overlays."
     kinds: [lint, design]
     gates: [pre-push, settle, land, ci]
     failureCodes: ["BE_TIER_DIRECTION", "FE_TIER_DIRECTION", "ARCH_PACKAGE_IMPORTS_APP"]
@@ -297,7 +301,7 @@ rules:
       - {kind: eslint-be, id: application-never-imports-transport}
   - id: R30
     code: "BE_PUBLIC_SURFACE"
-    law: "Every owner has one `index.ts`; cross-owner imports use it, same-owner imports are relative and never go through it; it holds only named `export { }` lines, no `export *`, no alias re-export (`export { X as Y }`, `export const Y = X`, `export type Y = X`, `export interface Y extends X {}`: one declaration has one name), at most 60 exports; cross-package imports use the package name and a declared export."
+    law: "Every owner has one `index.ts`; cross-owner imports use it, same-owner imports are relative and never go through it; it holds only named `export { }` lines, no `export *`, no alias re-export (`export { X as Y }`, `export const Y = X`, `export type Y = X`, `export interface Y extends X {}`: one declaration has one name), within the owner slot's `indexExports` budget (60 for domain and feature owners, 80 for `be.integrations` provider entries); cross-package imports use the package name and a declared export."
     kinds: [lint, codemod]
     gates: [pre-push, settle, land, ci]
     failureCodes: ["BE_PUBLIC_SURFACE", "ARCH_OWNER_EXPORT_BYPASS", "ARCH_OWNER_EXPORT_STAR", "HFS_ALIAS_REEXPORT", "ARCH_PACKAGE_EXPORT_BYPASS"]
@@ -423,7 +427,7 @@ rules:
       - {kind: eslint-be, id: auth-door-strict-rate-tier}
   - id: R43
     code: "BE_CONFIG_OWNER"
-    law: "Only `platform/config` reads `process.env`; config per capability."
+    law: "Only the `EnvSource` declaration of `platform/config`, app `main.ts`, the matching `<app>.env.ts` and the test world read `process.env`; app environment reads through `EnvSource` and capability config helpers live in `main.ts` or the matching `<app>.env.ts`; options files and composition groups receive typed options."
     kinds: [lint, design]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_CONFIG_OWNER"]
@@ -804,7 +808,7 @@ rules:
       - {kind: eslint-be, id: no-ambient-clock}
   - id: R80
     code: "BE_INBOX_DEDUPE_MISSING"
-    law: "Every service method that takes a delivery (a public method of a `*.service.ts` whose first parameter has an `eventId`) makes `claim(source, eventId)` on the `Inbox` port its first awaited expression and returns early when the claim answers `false`; consumers and `SignedWebhook` controllers stay thin doors (R88) and dispatch to the handler whose service claims."
+    law: "Every service method that takes a delivery (a public method of a `*.service.ts` whose first parameter has an `eventId`) makes `claim(source, eventId)` on the `Inbox` port its first awaited expression and returns early when the claim answers `false`; consumers stay thin doors (R88) and dispatch one command to the handler whose service claims. SignedWebhook controllers verify first and call one domain recording intake directly (R182, R183); a reactor or job dispatches the processing command after the inbox receipt commits."
     kinds: [lint, design]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_INBOX_DEDUPE_MISSING"]
@@ -961,7 +965,7 @@ rules:
       - {kind: eslint-fe, id: frontend-source-layout}
   - id: R92
     code: "FE_COMPONENT_API"
-    law: "A component exposes the canon surface: typed named props and slots, a presentational twin for every connected block, status through the slot view, no className or CSS doors, no resting twin or placeholder prop, class names in the colocated file; a pure component reaches no hook, router, locale or API."
+    law: "A component exposes the canon surface: typed named props and slots, an exact sibling XBase presentational twin for every connected block, status through the slot view, no className or CSS doors, no resting twin or placeholder prop, class names in the colocated file; a pure component reaches no hook, router, locale or API, but may render a list of blocks supplied through render props without importing blocks or owning their data."
     kinds: [lint, design]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["FE_COMPONENT_API", "FE_COMPONENT_WORLD_OWNERSHIP", "FE_WORLD_OWNER_RENDER_BOUNDARY", "FE_CONNECTED_BLOCK_RENDER_PAIR", "FE_PURE_REACHES_DATA", "FE_PURE_WORLD_HOOK", "FE_PURE_WORLD_IMPORT"]
@@ -1606,7 +1610,7 @@ rules:
       - {kind: eslint-be, id: sql-returning}
   - id: R182
     code: "BE_WEBHOOK_SHAPE"
-    law: "A provider webhook door (`src/features/webhooks/<provider>/transport/http/<provider>.webhook.ts`) is one `@Controller` with one `@Post` handler declared `@Public({ reason: PublicReason.SignedWebhook })`; it injects only the `WebhookSignatureService` of `platform/http-security` and services of `modules/domain`, and its handler holds no branch, loop or `try`, calls only `verify` on the signature service and exactly one method of a domain service (the intake that records the delivery and publishes the event in its own transaction), and returns nothing."
+    law: "A provider webhook door (`src/features/webhooks/<provider>/transport/http/<provider>.webhook.ts`) is one `@Controller` with exactly one `@Post` handler and optionally one `@Get` subscription challenge handler, each declared `@Public({ reason: PublicReason.SignedWebhook })`. It injects only the `WebhookSignatureService` of `platform/http-security` and services of `modules/domain`, holds no branch, loop or `try`, and its POST calls proof then exactly one domain intake that durably records the inbox receipt and outbox event in its transaction. A combined domain proof and intake call is allowed. POST returns nothing or exactly the own-feature exported PROVIDER_ACK, a literal object or string declared with `as const` or a readonly literal type; computed values, inline return objects and cross-feature constants are refused. GET starts with a declared domain verifier call and returns exactly that result, with no intake. The door and its HTTP module import or inject no CommandBus, QueryBus of @nestjs/cqrs or feature command handler; the resolved called intake dispatches no command/query bus or feature handler. A reactor or job consumes the durable receipt and dispatches after commit; unresolved helpers and dynamic receivers require semantic review."
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_WEBHOOK_SHAPE"]
@@ -1614,7 +1618,7 @@ rules:
       - {kind: eslint-be, id: webhook-shape}
   - id: R183
     code: "BE_WEBHOOK_UNVERIFIED"
-    law: "The first statement of a webhook handler is the unconditional `verify` call of the `WebhookSignatureService` (signature and replay window): a delivery that fails the proof throws before any other code runs, so no path reaches the domain intake unproven."
+    law: "The first statement of a webhook POST is an unconditional verification call to `WebhookSignatureService.verify` or a domain verifier, awaited when async, with no data access or other call before proof. A domain verifier is a method on a domain service whose declared class name ends in `Verifier` or `verify`, or a domain service method declared by symbol in the adjacent HTTP module's exported `webhookVerifiers` array. A domain method may verify with per-connection secrets before intake in the same call; invalid proof throws before intake. A fixed PROVIDER_ACK never replaces proof. The optional GET challenge handler starts with a declared domain verifier call (directly returned or bound to a const and then returned), awaited when async, and echoes only its exact result."
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_WEBHOOK_UNVERIFIED"]
@@ -1776,7 +1780,7 @@ rules:
       - {kind: runtime, id: ci-upload, at: scripts/hfs/runtime-rules/ci-upload.mjs}
   - id: R203
     code: "BE_FEATURE_THIN"
-    law: "A feature file (a role of ruleParams.be.thinRoles inside a slot of tier feature: handler, resolver, controller, consumer, processor, step, saga, saga-step, compensation, webhook, gateway, subscription, cli, mapper, the saga orchestrator service) maps its parameters and makes ONE delegating call into modules/ (a service, the command or query bus, the event bus, a queue producer): no branch, loop, ternary, try or throw and no computation. Business logic lives in modules/**, where every logic file owes 100 per file; orchestration (step order, compensation, claim, fencing, retry) lives in platform/*; the feature layer is proven by integration and e2e. The gate calls a kind requires are not delegation: a webhook's `verify` and a job step's `JobClaims` fence (`advance`, `runKey`); a logger call, a pure mapper function and a modules function in argument position are free too; a mapper may map a collection item by item (`map`) and write a date as text (`toISOString`), and a cli group command shows its help."
+    law: "A feature file (a role of ruleParams.be.thinRoles inside a slot of tier feature: handler, resolver, controller, consumer, processor, step, saga, saga-step, compensation, webhook, gateway, subscription, cli, mapper, the saga orchestrator service) maps its parameters and makes ONE delegating call into modules/ (a service, the command or query bus, the event bus, a queue producer): no branch, loop, ternary, try or throw and no computation. Business logic lives in modules/**, where every logic file owes 100 per file; orchestration (step order, compensation, claim, fencing, retry) lives in platform/*; the feature layer is proven by integration and e2e. The gate calls a kind requires are not delegation: a webhook's first verification call of R183 when followed by one separate intake, and a job step's `JobClaims` fence (`advance`, `runKey`); a combined domain verification and intake call counts as the delegation. A logger call, a pure mapper function and a modules function in argument position are free too; a mapper may map a collection item by item (`map`) and write a date as text (`toISOString`), and a cli group command shows its help. A webhook POST may return the declared literal PROVIDER_ACK and its optional GET may echo only its first domain verifier result; neither is an extra delegation. A webhook door and its HTTP module import or inject no CommandBus, QueryBus of @nestjs/cqrs or feature command handler: the inbox recording intake is the handoff, and a reactor or job dispatches after commit."
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_FEATURE_THIN"]
@@ -1846,12 +1850,14 @@ rules:
       - {kind: runtime, id: slot-id-shape, at: scripts/checks/check-slot-id-shape.mjs}
   - id: R212
     code: "HFS_EDITION_INVALID"
-    law: "hfs.json names an edition the manifest knows (full, or lite; absent means full). Lite = full minus self-hosted infrastructure: the same monorepo, code structure, slots, patterns and back-end unit specs, every pattern port implemented on Supabase (Postgres, Auth, Storage, Supabase Queues/pgmq for queue and event bus, Postgres locks, pg_cron), the realtime pattern on the same socket.io gateway run inside the be api process (one instance, no Redis adapter), and one front-end standard for both editions (knowledge/hfs/fe-stack.yaml); a lite app holds none of the infrastructure lite does not run: no e2e or contract spec, no `test:e2e`, `test:contract`, `test:stack` or `test:browser` script, no e2e workflow or browser journey, no UAT record, no test container, toxiproxy or browser-runner dependency, no BullMQ, Kafka, Redis or graphql-ws dependency (the libraries lite infraOwners own nowhere), no .starcistacks infra/runtime/seeds tree and no supabase/functions."
+    law: "hfs.json names an edition the manifest knows (full, or lite; absent means full). Lite follows the 2026-10-13 ruling: the same monorepo, code structure, slots, patterns and back-end unit specs, with only backing infrastructure swapped for managed Supabase (Postgres, Auth, Storage, Supabase Queues/pgmq for queue and event bus, Postgres locks, pg_cron); the api and sidecars run on docker-swarm on a VPS. The realtime pattern uses the same socket.io gateway inside the be api process (one instance, no Redis adapter), and both editions share knowledge/hfs/fe-stack.yaml. Lite requires application-stacks.yaml and permits environment metadata, runbooks, infra/swarm and encrypted-secret custody, while refusing infra/compose, infra/k8s, infra/terraform, runtime, seeds and components duplicating Supabase backing services. It has no e2e or contract spec, `test:e2e`, `test:contract`, `test:stack` or `test:browser` script, e2e workflow, browser journey, Work catalog, shell, features, resources, UAT or br records, test container, toxiproxy, browser-runner, BullMQ, Kafka, Redis or graphql-ws dependency, or supabase/functions. Its .starciwork is optional and admits only .gitignore, workspace.yaml and brand/**; workspace.yaml is optional and carries project identity and repo roles for the Work tools."
     kinds: [check]
     gates: [pre-push, settle, land, ci]
-    failureCodes: ["HFS_EDITION_INVALID", "HFS_EDITION_FORBIDDEN_PRESENT"]
+    failureCodes: ["HFS_EDITION_INVALID", "HFS_EDITION_FORBIDDEN_PRESENT", "HFS_STARCIWORK_LITE_FORBIDDEN"]
     enforcers:
       - {kind: hfs, id: edition, at: scripts/hfs/rules/edition.mjs}
+      - {kind: hfs, id: lite-brand-work, at: scripts/hfs/path-findings.mjs}
+      - {kind: work-validate, id: lite-brand-work, at: scripts/work/validate/work-boundary-check.mjs}
     cases:
       - id: case-1
         date: "2026-10-12"
@@ -1869,9 +1875,15 @@ rules:
         quote: "As the student proposes. (translated from Vietnamese; the owner adopted the proposed HFS standard for front end and back end, lite = full)"
         ruling: "One HFS tree for both editions: the repository root, be/ (apps, contracts, features, modules, tests) and fe/apps/<app>/src have the same shape in lite and full, and code above the platform/integrations seam is the same. The editions differ only behind that seam: the database and its migration authority (lite supabase/migrations; full TypeORM entities and migrations in be.persistence), the auth provider (lite Supabase Auth through fe.modules.auth and a JWKS-verified back end; full the app's identity provider), object storage (lite Supabase Storage; full S3-compatible storage), queue and jobs (lite pgmq and pg_cron; full BullMQ) behind platform/queue, realtime (lite the socket.io gateway in the api process, one instance; full socket.io scaled with a Redis adapter), the event-bus adapter (lite outbox and pgmq; full outbox and Kafka) and hosting; lite has no e2e. Migration baseline at the cutover of an existing app: the live schema is dumped into one baseline migration written to the current standard and marked applied on production without a re-run, the older migrations move to app.supabase.migrations.archive (supabase/migrations/_archive/, never applied and never judged), and new migrations append after the baseline. Assets: static templates, copy and presets are TS constants in the owning domain capability (<x>.templates.ts) and user-editable ones are seed rows; small build-time binaries such as fonts live in be.assets (be/src/assets/<kind>/); large and user media live in object storage and are fetched at runtime; there is no be/resources/."
 
+      - id: case-4
+        date: "2026-10-14"
+        source: owner
+        quote: "In a lite app, .starciwork keeps only the brand records."
+        ruling: "Amended by the owner on 2026-10-14: under lite, .starciwork is optional when the app has no brand records and admits only .gitignore, workspace.yaml and brand/** in the existing brand tooling layout, including drawing records, references and assets. workspace.yaml is optional and keeps the project id and repo roles so Work root detection and render-proof role mapping can tie brand records to the front end. index.yaml, shell/, features/, _resources/, uat and br remain forbidden. Lite readers read workspace.yaml normally and skip the full-edition catalog, shell and feature metadata; lite scaffolding creates .gitignore and workspace.yaml, with brand/ only when present. Full edition is unchanged."
+
   - id: R213
     code: "DB_MIGRATION_SHAPE"
-    law: "A migration is `supabase/migrations/<ts14>_<kebab>.sql`; the stamp is a valid UTC instant not in the future, new migrations sort strictly after every migration on the base branch, and a migration already on the base is immutable (a diff or a removal is a finding); a file that does not parse as PostgreSQL is a shape failure."
+    law: "A migration is `supabase/migrations/<ts14>_<kebab>.sql`; the stamp is a valid UTC instant, active stamps are unique, and a new migration sorts strictly after the committed active migrations in HEAD. Repository history includes the archive: moving an active migration to the archive retires it from ordering, so a replacement baseline may predate archived stamps and later migrations append after the baseline. Wall-clock time, commit time and remote-branch stamps do not set the ordering boundary. A migration already on the base is immutable (a diff or an unarchived removal is a finding); a file that does not parse as PostgreSQL is a shape failure."
     kinds: [check]
     gates: [pre-push, settle, land, ci]
     failureCodes: ["DB_MIGRATION_SHAPE"]
@@ -2156,3 +2168,19 @@ rules:
     enforcers:
       - {kind: hfs, id: fe-stack, at: scripts/hfs/rules/fe-stack.mjs}
       - {kind: eslint-fe, id: fe-stack-import}
+  - id: R245
+    code: "BE_APP_OPTIONS_COMPOSITION"
+    law: "An app's `src/` holds five app roles (owner ruling 2026-10-14): `main.ts` builds `EnvSource` once, parses inline or imports `<app>.env.ts`, builds options and boots; `<app>.env.ts` holds typed, fail-fast environment parsing only, via `EnvSource` and capability parse helpers, with no logic, module composition, business code or feature imports; only `main.ts` and `<app>.env.ts` may read the app's environment; `<app>.options.ts` holds env-derived options plus port bindings (provider maps such as `{ approvalGate: X }`) only, with no parsing; neither the env nor options file holds an array listing `*Module` classes, module or queue registrations (`register`, `forRoot`, `registerQueue`) or scheduler entries, or an `imports`, `modules`, `schedulers` or `processors` list; the env file also refuses standalone module or queue registration calls; `compose/<area>.ts` exports the module list of one area (and the providers of its global ports when it has any), composition only, with no business logic and no environment read; `app.module.ts` imports the groups and spreads them and binds the app-wide guards and filter."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_APP_OPTIONS_COMPOSITION"]
+    enforcers:
+      - {kind: eslint-be, id: app-options-composition-free}
+  - id: R246
+    code: "BE_APP_COMPOSITION_BUDGET"
+    law: "Each app file stays within the line budget its `be.app.*` slot names (`budget`, keyed by the slot entry the file matches): `main.ts` 80, `<app>.env.ts` 150, `<app>.options.ts` 200, `compose/<area>.ts` 120, `app.module.ts` 250. The budget is absolute, not a ratchet: an entrypoint that outgrows it moves typed, fail-fast parsing into `<app>.env.ts`; an app root that outgrows it moves an area into a new `compose/<area>.ts` group, never into the env or options file."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_APP_COMPOSITION_BUDGET"]
+    enforcers:
+      - {kind: eslint-be, id: app-file-budget}

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.0.0
+version: 3.1.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -31,6 +31,12 @@ versioning:
 # is the socket.io gateway in both editions), fe.route holds pages, layouts and the one health/live route handler, and the slots
 # marked `since: 3.0.0` are added: the Apollo, SWR, RHF, zustand and socket.io hooks, redux, modules/auth, modules/toast, the
 # providers, be.assets and the migration archive.
+# 3.1.0 is a minor (owner ruling 2026-10-14, R245 and R246): every be.app.* slot allows `<app>.env.ts` and the composition groups
+# `compose/<area>.ts` and budgets its app files (`app.module.ts` 250, `<app>.options.ts` 200, `<app>.env.ts` 150,
+# `compose/<area>.ts` 120, `main.ts` 80); `<app>.env.ts` exports interface <App>Env and read<App>Env(env: EnvSource): <App>Env
+# for fail-fast env parsing only, and `<app>.options.ts` holds env-derived options and port bindings only, with no parsing
+# or environment reads (BE_APP_OPTIONS_COMPOSITION). Secrets use EnvSource.secret(): <NAME>_FILE first, plain <NAME> only
+# when the file key is absent; .starcistacks owns custody. Capability <capability>.config.ts roles stay unchanged.
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -139,6 +145,7 @@ naming:
 # ---------------------------------------------------------------------------------------------------------
 # Tiers and the dependency direction matrix (owner granularity; type-only imports count; no cycles anywhere)
 # mayImport lists the tiers a file of that tier may import. Importing inside the same owner is always allowed.
+# mayImportKinds narrows a permitted tier edge to its named from/to folder kinds; other kind pairs remain forbidden.
 # ---------------------------------------------------------------------------------------------------------
 tiers:
   be:
@@ -155,7 +162,7 @@ tiers:
     package:      {mayImport: [package]}
   fe:
     route:        {mayImport: [feature, foundation, modules, transport, package]} # app/** adapters
-    feature:      {mayImport: [components, hooks, foundation, modules, transport, package]}
+    feature:      {mayImport: [feature, components, hooks, foundation, modules, transport, package], mayImportKinds: {feature: {from: [pages, layouts], to: [overlays]}}} # pages and layouts compose overlays and blocks; other feature-to-feature edges stay forbidden
     # A component never reaches data: config, routes, i18n and types are foundation; every other module and the api
     # transport are reached through a hook (owner decision 2026-09-29).
     components:   {mayImport: [components, hooks, foundation, package], lowerLayerOnly: true} # blocks, composites, branches, leaves
@@ -501,6 +508,33 @@ slots:
     tests: none
     managedBy: docker-ignore
     rules: [HFS_MANAGED_FILE_DRIFT]
+  - id: app.deploy
+    profiles: [app]
+    # Production delivery tooling for the app's own processes: compose files, Caddyfile, *.env.example and ops shell scripts.
+    # Lite still keeps its backing services on Supabase and its encrypted custody in app.starcistacks; R06 scans every file here.
+    path: "deploy/"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET]
+  - id: app.ci-deploy
+    profiles: [app]
+    # Product-owned delivery workflows; the literal app.ci-db path remains the managed database workflow's more specific slot.
+    path: ".github/workflows/<app>-deploy.yml"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET]
+  - id: app.ci-authorize-deploy-key
+    profiles: [app]
+    path: ".github/workflows/authorize-deploy-key.yml"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET]
   - id: app.browser
     profiles: [app]
     # The browser journey of the product (Playwright, owner ruling: one minimal journey per example app, run manually): the config, its
@@ -536,6 +570,17 @@ slots:
       path: scripts/codegen.mjs
     liteManagedBy: codegen-lite
     rules: [HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]     # one-off codemods and fix-* scripts are agent output, not tooling
+  - id: app.scripts.delivery
+    profiles: [app]
+    editions: [lite]
+    # Product-owned environment, secret and build tooling, kept apart from lite's managed codegen script.
+    # Full already owns these files through app.scripts; its generic *.mjs pattern must not compete with build-*.mjs.
+    path: "scripts/{env-sync.mjs,with-secrets.mjs,set-secrets.ps1,build-*.mjs}"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
   - id: app.sides
     profiles: [app]
     # The two sides. Everything below be/ and fe/ is judged by the side's own slots (profiles be and fe) with the side folder as its root;
@@ -558,23 +603,13 @@ slots:
              "features/<feature>/ui/<name>/assets/<approved-file>", "features/<feature>/uat/<name>/{index,accounts,fixtures}.yaml",
              "features/<feature>/uat/<name>/{seed,cleanup}.sql", "_resources/{identities,environments,fixtures}/<slug>/resource.yaml"]
     forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/]
-    # Lite keeps the product catalog, feature overviews, grammar and brand drawing records; UAT records belong to the forbidden slot below.
+    # Owner amendment 2026-10-14: lite keeps workspace.yaml for project identity and repo roles, plus brand drawing records,
+    # references and assets. No brand means no Work tree is needed; workspace.yaml is legal but optional.
+    litePresence: optional
     lite:
-      requires: [.gitignore, workspace.yaml, index.yaml]
-      allows: [workspace.yaml, index.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml", "features/<feature>/ui/<name>/index.yaml", "features/<feature>/ui/<name>/assets/<approved-file>"]
+      requires: [.gitignore]
+      allows: [workspace.yaml, "brand/**"]
     rules: [HFS_AGENT_DATA_TRACKED, HFS_IDENTITY_CUSTODY]
-  - id: app.starciwork.uat
-    profiles: [app]
-    # The UAT records of the full edition: they are proven on the e2e world (identities, fixtures, br/ac evidence) that lite does
-    # not have, so the trees are forbidden paths under lite only. In full this slot does not exist and .starciwork answers for them.
-    editions: [lite]
-    path: ".starciwork/{_resources/identities,_resources/fixtures,features/<feature>/uat,features/<feature>/br}/"
-    presence: forbidden
-    tracked: external
-    tier: none
-    tests: none
-    goesTo: "the full edition: a lite app has no e2e world, so no UAT records (no identities or fixtures resources, no br/ac evidence, no uat directories)"
-    since: 2.1.0
   - id: app.starcistacks
     profiles: [app]
     # The stack declarations and the sealed custody of the app, at the app root beside be/, fe/ and .starciwork (never under a side).
@@ -584,16 +619,16 @@ slots:
     tier: none
     tests: none
     requires: [application-stacks.yaml]
-    allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,k8s,terraform}/**", "<env>/infra/metadata.json",
+    allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,k8s,terraform,swarm}/**", "<env>/infra/metadata.json",
              "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
     forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
-    # Lite has no self-hosted infrastructure (owner ruling 2026-10-12): .starcistacks holds env and secret custody only - the stack
-    # declaration, the environment descriptor and the sealed secrets; the stack's one backing service is the Supabase project (the
-    # local CLI stack or the cloud project). infra/ (compose, k8s, terraform), runtime/ and seeds/ are the full edition's.
+    # Lite keeps full's code structure with backing infrastructure replaced by Supabase (owner ruling 2026-10-13). The api and
+    # sidecars run on docker-swarm; its value-free stack belongs in <env>/infra/swarm/. The checker also refuses components whose
+    # images duplicate Supabase services: postgres, redis, kafka, keycloak, minio, rabbitmq, mysql and mongo.
     lite:
-      requires: []
-      allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep"]
-      forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
+      requires: [application-stacks.yaml]
+      allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/swarm/**", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep"]
+      forbids: ["<env>/infra/{compose,k8s,terraform}/**", "<env>/runtime/**", "<env>/seeds/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
     rules: [HFS_STACKS_SHAPE, HFS_STACKS_IN_SIDE, HFS_PLAINTEXT_SECRET, HFS_IDENTITY_CUSTODY]
   - id: app.sops
     profiles: [app]
@@ -637,7 +672,7 @@ slots:
     goesTo: "<lanes root>/<project>/<lane>/ (outside every repository) for a lane; a Kernel workflow's worktree is created and owned by Orca outside the app checkout, never tracked, and removed by the runtime's host-side controller once the workflow's finish marked it release-pending"
   - id: app.plaintext-env
     profiles: [app]
-    path: "{.env,.env.*,.secrets/,**/*.pem,**/*.key}"
+    path: "{.env,.env.*,secrets.env,.secrets/,**/*.pem,**/*.key}"
     presence: forbidden
     tracked: external
     tier: none
@@ -959,6 +994,23 @@ slots:
     rules: [BE_CONTRACT_BREAKING]
 
   # ----- BE: apps (one slot per app kind; a new kind = a new slot, minor bump) ---------------------------
+  # The files of every app (owner ruling 2026-10-14, R245 and R246, since 3.1.0), each with a line budget that
+  # BE_APP_COMPOSITION_BUDGET holds absolutely (not a ratchet):
+  #   main.ts            the entry: builds EnvSource once, imports and calls read<App>Env from <app>.env.ts, builds options and boots.
+  #   <app>.env.ts       exports interface <App>Env and read<App>Env(env: EnvSource): <App>Env (for example ApiEnv/readApiEnv);
+  #                      fail-fast environment parsing only, via EnvSource and unchanged capability parse helpers; no localhost
+  #                      or default host fallback, logic, module composition, business code or feature imports. Only main.ts
+  #                      and this app file may read process.env or EnvSource. The interface declares its own readonly parsed
+  #                      members with parser-derived types, structurally compatible with the app's options;
+  #                      the role name stays <app>.env.ts, never env.ts. Secrets use EnvSource.secret(): <NAME>_FILE first
+  #                      for .starcistacks custody, plain <NAME> only when the file key is absent. A declared file supplies
+  #                      exact contents; an empty or unreadable path stops boot without fallback.
+  #   <app>.options.ts   the options: env-derived options plus port bindings (provider maps such as { approvalGate: X }) only;
+  #                      no environment parsing or process.env/EnvSource reads; module, queue or scheduler composition here or in <app>.env.ts is
+  #                      BE_APP_OPTIONS_COMPOSITION.
+  #   compose/<area>.ts  a composition group: exports the module list of one area (an imports array, and the providers of the
+  #                      area's global ports when it has any); composition only, no business logic or process.env/EnvSource read.
+  #   app.module.ts      the composition root: imports the groups and spreads them, binds the app-wide guards and filter.
   - id: be.app.api
     profiles: [be]
     path: "apps/<app>/src/"
@@ -969,11 +1021,11 @@ slots:
     owner: true
     minInstances: 1
     requires: [main.ts, app.module.ts]
-    allows: [main.ts, app.module.ts, "<app>.options.ts", operations.ts]
+    allows: [main.ts, app.module.ts, "<app>.env.ts", "<app>.options.ts", "compose/<area>.ts", operations.ts]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
     coverage: none
-    budget: {app.module.ts: 250, main.ts: 80}
-    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_BUSINESS_ROLE, BE_DEFAULT_DENY, BE_ERROR_MASKED, BE_FEATURE_NOT_COMPOSED, BE_CONTEXT_OWNER]
+    budget: {app.module.ts: 250, main.ts: 80, "<app>.env.ts": 150, "<app>.options.ts": 200, "compose/<area>.ts": 120}
+    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_BUSINESS_ROLE, BE_APP_OPTIONS_COMPOSITION, BE_APP_COMPOSITION_BUDGET, BE_DEFAULT_DENY, BE_ERROR_MASKED, BE_FEATURE_NOT_COMPOSED, BE_CONTEXT_OWNER]
   - id: be.app.worker
     profiles: [be]
     path: "apps/<app>/src/"
@@ -983,17 +1035,19 @@ slots:
     tier: app
     owner: true
     requires: [main.ts, app.module.ts]
-    allows: [main.ts, app.module.ts, "<app>.options.ts"]
+    allows: [main.ts, app.module.ts, "<app>.env.ts", "<app>.options.ts", "compose/<area>.ts"]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
     coverage: none
-    rules: [BE_APP_COMPOSITION_ONLY, BE_BACKGROUND_UNOWNED, BE_CONTEXT_OWNER]
+    budget: {app.module.ts: 250, main.ts: 80, "<app>.env.ts": 150, "<app>.options.ts": 200, "compose/<area>.ts": 120}
+    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_OPTIONS_COMPOSITION, BE_APP_COMPOSITION_BUDGET, BE_BACKGROUND_UNOWNED, BE_CONTEXT_OWNER]
   - id: be.app.cli
     profiles: [be]
     # The ONE app of every one-off action (migrate, seed, sync, backup, any operator command): be/apps/cli, on nest-commander.
     # main.ts boots with CommandFactory.run (BE_CLI_BOOTSTRAP); app.module.ts composes the platform and the cli feature root
-    # (src/features/cli/cli.module.ts); cli.options.ts carries what it needs from the environment, the connections it migrates
-    # among them (the test world migrates through the same list). It is required as soon as the back end declares a connection
-    # or tracks a command, with its image apps/cli/Dockerfile (BE_CLI_REQUIRED): one image, run as `cli <group> <command>`.
+    # (src/features/cli/cli.module.ts); cli.env.ts exports CliEnv and readCliEnv(env: EnvSource): CliEnv, and cli.options.ts carries the env-derived values,
+    # the connections it migrates among them (the test world migrates through the same list). It is required as soon as the
+    # back end declares a connection or tracks a command, with its image apps/cli/Dockerfile (BE_CLI_REQUIRED): one image,
+    # run as `cli <group> <command>`.
     path: "apps/<app>/src/"
     appKind: cli
     presence: opt-in
@@ -1002,10 +1056,11 @@ slots:
     tier: app
     owner: true
     requires: [main.ts, app.module.ts]
-    allows: [main.ts, app.module.ts, "<app>.options.ts"]
+    allows: [main.ts, app.module.ts, "<app>.env.ts", "<app>.options.ts", "compose/<area>.ts"]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
     coverage: none
-    rules: [BE_CLI_REQUIRED, BE_CLI_BOOTSTRAP, BE_CLI_OWNER, BE_SCHEMA_AUTHORITY]
+    budget: {app.module.ts: 250, main.ts: 80, "<app>.env.ts": 150, "<app>.options.ts": 200, "compose/<area>.ts": 120}
+    rules: [BE_CLI_REQUIRED, BE_CLI_BOOTSTRAP, BE_CLI_OWNER, BE_SCHEMA_AUTHORITY, BE_APP_OPTIONS_COMPOSITION, BE_APP_COMPOSITION_BUDGET]
 
   # ----- BE: features ------------------------------------------------------------------------------------
   # src/features/ is grouped by TRIGGER KIND (owner decision 2026-10-02): features/api/<feature>/ (a request: application/ and
@@ -1515,7 +1570,7 @@ slots:
     requires: [index.ts, "<provider>.config.ts"]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts; plus src/tests/integration/<provider>/ (R112)
     coverage: required
-    budget: {indexExports: 60}
+    budget: {indexExports: 80}   # a provider's port surface includes clients, config, options, tokens and errors
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INTEGRATION_SPEC_MISSING]
   - id: be.integrations.model
     profiles: [be]
@@ -1789,7 +1844,7 @@ slots:
     allows: [index.ts, "use<name>.ts", "<domain>.shared.ts"]   # React hooks only; <domain>.shared.ts = sanctioned non-hook helpers
     roles: {entry: index.ts, shared: "<domain>.shared.ts"}
     tests: none
-    budget: {file: 200, dataHooks: 6, useState: 6}
+    budget: {file: 200, barrel: 400, dataHooks: 6, useState: 6}   # barrel: index.ts containing only export ... from statements
     rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
   - id: fe.hooks.swr
     profiles: [fe]
@@ -1806,7 +1861,7 @@ slots:
              "api/rest/queries/useGet*Swr.ts", "api/rest/mutations/use{Post,Put,Patch,Delete}*Swr.ts"]
     roles: {entry: index.ts, effects: SwrSideEffects.tsx}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
   - id: fe.hooks.rhf
@@ -1822,7 +1877,7 @@ slots:
     allows: [index.ts, "use*Form.ts"]
     roles: {entry: index.ts}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.zustand
@@ -1837,7 +1892,7 @@ slots:
     allows: [index.ts, store.ts, "use*.ts"]
     roles: {entry: index.ts, store: store.ts}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.socketio
@@ -1853,7 +1908,7 @@ slots:
     allows: [index.ts, sockets.ts, SocketIoSideEffects.tsx, connectionStore.ts, "enums/*.ts", "types/*.ts", "use*.ts"]
     roles: {entry: index.ts, effects: SocketIoSideEffects.tsx}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.effects
@@ -1869,7 +1924,7 @@ slots:
     allows: [index.ts, "use*.ts", "*SideEffect.tsx", "*SideEffects.tsx"]
     roles: {entry: index.ts, effects: "*SideEffect.tsx"}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.reuseables
@@ -1884,7 +1939,7 @@ slots:
     allows: [index.ts, "use*.ts"]
     roles: {entry: index.ts}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.redux
@@ -1909,6 +1964,7 @@ slots:
     tier: modules
     owner: true
     requiredInstances: {capability: [config, i18n, routes]}
+    # A populated fe.modules instance with no .ts or .tsx files (CSS/assets only) needs no index.ts.
     requires: [index.ts]
     tests: none
     budget: {file: 400}

package/runtime/knowledge/patterns/fe/folder.yaml

@@ -174,6 +174,9 @@ rules:
       component.tsx. Pure blocks, composites, branches and leaves use index.tsx only and never gain an
       empty twin. classNames.ts is present only when the unit owns class strings. Budgets: component.tsx 300 lines,
       connected index.tsx 200 lines, at most 6 data hooks and 6 useState per connected unit.
+      A composition-only feature may render an existing public pure component owner directly instead of creating a
+      forwarding component.tsx. The route-state overlay host of FE-BOUNDARY-5 renders components/branches/OverlayHost;
+      a connected block still requires its exact private Base twin.
     rationale: |
       Stable basenames make class names and the connected and presentational split discoverable without forwarding
       twins, and budgets keep a unit reviewable.

package/runtime/scripts/api/git/cat-file.mjs

@@ -0,0 +1,5 @@
+// cat-file.mjs — `git cat-file <args>`: the type, size or content of repository objects (-e, -p, --batch).
+import { runGit } from './lib.mjs';
+
+/** The spawn result {status, stdout, stderr, error} of `git cat-file ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
+export const catFile = (args = [], options = {}) => runGit(['cat-file', ...args], options);

package/runtime/scripts/api/git/diff.mjs

@@ -0,0 +1,5 @@
+// diff.mjs — `git diff <args>`: the changes between commits, the index and the working tree.
+import { runGit } from './lib.mjs';
+
+/** The spawn result {status, stdout, stderr, error} of `git diff ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
+export const diff = (args = [], options = {}) => runGit(['diff', ...args], options);

package/runtime/scripts/hfs/architecture/backend-app-files.mjs

@@ -0,0 +1,110 @@
+import path from 'node:path';
+import { allowsFile } from '../allows.mjs';
+import { relativePath, unwrapExpression } from './typescript.mjs';
+import { sourceLocation } from '../../lib/ts-ast.mjs';
+
+const PROCESS_MODULES = new Set(['process', 'node:process']);
+const PROCESS_GLOBAL = new Set(['process']);
+const GLOBAL_HOLDERS = new Set(['globalThis', 'global']);
+const REFLECT_GLOBAL = new Set(['Reflect']);
+
+/** A static property name, including `object['env']` and `object[`env`]`. */
+export function accessName(ts, node) {
+  if (ts.isPropertyAccessExpression(node)) return node.name.text;
+  if (ts.isElementAccessExpression(node) && ts.isStringLiteralLike(node.argumentExpression)) return node.argumentExpression.text;
+  return null;
+}
+
+function bindingName(ts, element) {
+  const name = element.propertyName ?? element.name;
+  if (ts.isIdentifier(name) || ts.isStringLiteralLike(name)) return name.text;
+  return ts.isComputedPropertyName(name) && ts.isStringLiteralLike(name.expression) ? name.expression.text : null;
+}
+
+/** A global name is not a same-named local variable or parameter. */
+function isGlobalName(ts, checker, node, names) {
+  if (!ts.isIdentifier(node) || !names.has(node.text)) return false;
+  const declarations = checker?.getSymbolAtLocation(node)?.getDeclarations() ?? [];
+  return declarations.every(declaration => declaration.getSourceFile().isDeclarationFile);
+}
+
+function recordProcessBindings(ts, clause, add, report) {
+  if (clause?.name) add(clause.name);
+  const bindings = clause?.namedBindings;
+  if (bindings && ts.isNamespaceImport(bindings)) add(bindings.name);
+  if (!bindings || !ts.isNamedImports(bindings)) return;
+  for (const element of bindings.elements) {
+    const name = (element.propertyName ?? element.name).text;
+    if (name === 'env') report(element);
+    else if (name === 'default') add(element.name);
+  }
+}
+
+function processImportSymbols(ts, checker, sourceFile, report) {
+  const imports = new Set();
+  const add = name => {
+    const symbol = checker.getSymbolAtLocation(name);
+    if (symbol) imports.add(symbol);
+  };
+  for (const statement of sourceFile.statements) {
+    if (!ts.isImportDeclaration(statement) || !ts.isStringLiteralLike(statement.moduleSpecifier)
+      || !PROCESS_MODULES.has(statement.moduleSpecifier.text)) continue;
+    recordProcessBindings(ts, statement.importClause, add, report);
+  }
+  return imports;
+}
+
+/** Process bindings are resolved by symbol, so a nested parameter cannot masquerade as an imported process. */
+function processAccess(ts, checker, sourceFile, report) {
+  const imports = processImportSymbols(ts, checker, sourceFile, report);
+  const isProcess = expression => {
+    const node = unwrapExpression(ts, expression);
+    if (!node) return false;
+    if (ts.isIdentifier(node)) return imports.has(checker.getSymbolAtLocation(node))
+      || isGlobalName(ts, checker, node, PROCESS_GLOBAL);
+    return accessName(ts, node) === 'process'
+      && isGlobalName(ts, checker, node.expression, GLOBAL_HOLDERS);
+  };
+  return node => {
+    if (accessName(ts, node) === 'env' && isProcess(node.expression)) report(node);
+    if (ts.isVariableDeclaration(node) && node.initializer && isProcess(node.initializer) && ts.isObjectBindingPattern(node.name)
+      && node.name.elements.some(element => bindingName(ts, element) === 'env')) report(node);
+    if (ts.isCallExpression(node) && accessName(ts, node.expression) === 'get'
+      && isGlobalName(ts, checker, node.expression.expression, REFLECT_GLOBAL)
+      && isProcess(node.arguments[0]) && node.arguments[1] && ts.isStringLiteralLike(node.arguments[1]) && node.arguments[1].text === 'env') report(node);
+  };
+}
+
+/** The declaration, rather than the caller's name, identifies EnvSource readers and configuration helpers. */
+function appEnvironmentCall(config, ts, checker, call) {
+  const declaration = checker.getResolvedSignature(call)?.declaration;
+  if (!declaration) return false;
+  const relative = relativePath(config.root, declaration.getSourceFile().fileName);
+  if (ts.isMethodDeclaration(declaration) && ts.isClassDeclaration(declaration.parent) && declaration.parent.name?.text === 'EnvSource') {
+    return config.hfs.tierOf(relative) === 'platform' && path.posix.basename(config.hfs.ownerOf(relative)?.root ?? '') === 'config';
+  }
+  if (!ts.isFunctionDeclaration(declaration) && !ts.isArrowFunction(declaration) && !ts.isFunctionExpression(declaration)) return false;
+  return allowsFile(config.hfs, relative)?.entry === '<app>.env.ts'
+    || (path.posix.basename(relative).endsWith('.config.ts') && config.hfs.slotOf(relative) !== null);
+}
+
+/** Composition groups and options consume parsed options; only the app's matching env role and main read them. */
+export function checkApplicationEnvironment(config, context, sourceFile, fileName, violations) {
+  const role = allowsFile(config.hfs, relativePath(config.root, fileName));
+  if (role?.allowed && (role.entry === 'main.ts' || role.entry === '<app>.env.ts')) return;
+  const { ts } = context;
+  const checker = context.checkerFor(fileName);
+  const report = node => violations.push({
+    ruleId: 'BE_APP_COMPOSITION_ONLY',
+    path: relativePath(config.root, fileName),
+    ...sourceLocation(sourceFile, node),
+    message: "Application environment reads live in main.ts or the matching <app>.env.ts. Options files and compose/<area>.ts receive the typed result of read<App>Env(env: EnvSource).",
+  });
+  const checkProcess = processAccess(ts, checker, sourceFile, report);
+  const visit = node => {
+    checkProcess(node);
+    if (ts.isCallExpression(node) && appEnvironmentCall(config, ts, checker, node)) report(node);
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+}