@starci/eslint-canon-be 3.4.29 → 3.4.31

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 3.4.31 - 2026-10-23
+- Changed: the `spec-no-skip` rule text says nothing skips, the contract layer included: a missing sandbox is a failing test of `sandbox.describe` from `@starci/test-world` 1.2.3.
+- Changed: the bundled canon pins select @starci/hfs 4.7.24 and @starci/cli 1.7.24.
+- Changed: no Sonar way rule is left to the server (owner ruling 2026-10-22, no loosening): S3403 `different-types-comparison`, S3800 `function-return-type`, S3782 `argument-type` and S6582 `@typescript-eslint/prefer-optional-chain` run at error, `unicorn/consistent-function-scoping` runs with its default options (arrow functions included). S7785 (top-level await) is recorded as not applicable to a CommonJS back end (`SONAR_WAY_NOT_APPLICABLE`).
+- Added: the `@typescript-eslint/no-unsafe-assignment`, `-member-access`, `-call`, `-return` and `-argument` rules at error.
+
+## 3.4.30 - 2026-10-22
+- Changed: the bundled canon pins select @starci/hfs 4.7.23 and @starci/cli 1.7.23.
+
 ## 3.4.29 - 2026-10-22
 - Changed: the bundled canon pins select @starci/hfs 4.7.21 and @starci/cli 1.7.21.
 

package/lib/config.mjs

@@ -47,6 +47,11 @@ export const BORROWED = Object.freeze({
     "@typescript-eslint/no-deprecated": "error",
     "@typescript-eslint/no-base-to-string": "error",
     "@typescript-eslint/require-await": "error",
+    "@typescript-eslint/no-unsafe-assignment": "error",
+    "@typescript-eslint/no-unsafe-member-access": "error",
+    "@typescript-eslint/no-unsafe-call": "error",
+    "@typescript-eslint/no-unsafe-return": "error",
+    "@typescript-eslint/no-unsafe-argument": "error",
     "no-console": "error",
 })
 
@@ -90,6 +95,6 @@ export const buildBeConfig = async ({ hfs, plugin, recommended }) => {
             rules: { ...rules, ...BORROWED },
         },
         // Sonar way: what the scan raises is refused while the code is written; a spec is outside the scan, so outside this block.
-        { files: [...SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs, unicorn }, rules: sonarWayRules(sonarjs).rules },
+        { files: [...SOURCE_FILES], ignores: [...OUTSIDE_THE_SCAN_FILES], plugins: { sonarjs, unicorn }, rules: sonarWayRules(sonarjs, "be").rules },
     ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-be",
-  "version": "3.4.29",
+  "version": "3.4.31",
   "description": "The StarCi back-end lint canon: every rule its laws publish, gathered as one flat-config plugin.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.29
+    version: 3.4.31
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.28
+    version: 8.4.30
     group: starci
     install: registry
     side: fe
@@ -50,40 +50,40 @@ pins:
     source: packages/stylelint/package.json
     why: 'the front-end stylelint canon: no-class-selector refuses a compound class selector (`div.card`); the brand layer accepts `--font-sans` and `--font-mono`; status-contrast measures the HeroUI soft pairs per theme; brand-layer-shape reads the shared :root,.light,.dark block and the info soft pair; appTokens come from loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.5
+    version: 2.0.7
     group: starci
     install: registry
     side: both
     source: packages/tsconfig/package.json
   '@starci/prettier-config':
-    version: 1.0.3
+    version: 1.0.4
     group: starci
     install: registry
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.3.4
+    version: 2.3.5
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
     why: 'the Jest preset of a back end: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: it pairs exactly with @starci/test-world, and any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. The unit run writes the lcov Sonar and Codecov import (services only); the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; it ships the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
-    version: 1.2.2
+    version: 1.2.3
     group: starci
     install: registry
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.21
+    version: 1.7.24
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.21
+    version: 4.7.24
     group: starci
     install: registry
     side: both
@@ -465,7 +465,7 @@ pins:
     version: 13.4.5
     group: framework
     side: be
-    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the ecommerce-app resolution on 2026-10-13. Stays on 13.x for alpha.18: the npm-audit advisory fixed by 14.0.3 (semver major) is a documented accepted exception, upgrade deferred to alpha.19 (owner ruling graphql-13-advisory-accepted-until-a19, 2026-10-16).'
+    why: 'the GraphQL transport of every back end (be.transport.graphql) that the front end calls; the full-app resolution on 2026-10-13. Stays on 13.x for alpha.18: the npm-audit advisory fixed by 14.0.3 (semver major) is a documented accepted exception, upgrade deferred to alpha.19 (owner ruling graphql-13-advisory-accepted-until-a19, 2026-10-16).'
   '@graphql-tools/utils':
     version: 12.1.0
     group: framework
@@ -475,12 +475,12 @@ pins:
     version: 13.4.5
     group: framework
     side: be
-    why: 'the Apollo driver of @nestjs/graphql; the ecommerce-app resolution on 2026-10-13. Stays on 13.x with @nestjs/graphql (accepted advisory, major deferred to alpha.19).'
+    why: 'the Apollo driver of @nestjs/graphql; the full-app resolution on 2026-10-13. Stays on 13.x with @nestjs/graphql (accepted advisory, major deferred to alpha.19).'
   '@apollo/server':
     version: 5.5.1
     group: framework
     side: be
-    why: 'the Apollo server behind @nestjs/apollo; the ecommerce-app resolution on 2026-10-13.'
+    why: 'the Apollo server behind @nestjs/apollo; the full-app resolution on 2026-10-13.'
   '@nestjs/websockets':
     version: 11.2.5
     group: framework

package/runtime/knowledge/hfs/rules.yaml

@@ -56,7 +56,7 @@ rules:
       - {path: packages/eslint/fe/slot-ownership.spec.mjs, editions: [lite, full], codes: [HFS_SLOT_UNDECLARED, HFS_SLOT_AMBIGUOUS, HFS_SLOT_NOT_ENABLED]}
     exemplifiedBy:
       - {path: examples/lite-app/be/src/features/webhooks/calendar/transport/http/calendar.webhook.ts, edition: lite}
-      - {path: examples/ecommerce-app/be/src/features/webhooks/sepay/transport/http/sepay.webhook.ts, edition: full}
+      - {path: examples/full-app/be/src/features/webhooks/sepay/transport/http/sepay.webhook.ts, edition: full}
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
   - id: R02
@@ -846,7 +846,7 @@ rules:
     exemplifiedBy:
       - {path: packages/hfs/templates/be/inbox/service.spec.ts.tpl, editions: [lite, full]}
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    law: "One jest config, projects `unit`, `integration`, `e2e` and `contract`, live by folder, `diagnostics: false`; unit specs are `<name>.<role>.spec.ts` beside the file they test: required for the roles of `ruleParams.be.unitRoles` (`<name>.service.spec.ts` beside a `<name>.service.ts`, `<name>.cli.spec.ts` beside a cli command `<name>.cli.ts` of `src/features/cli`), optional for any other logic role (`ruleParams.be.logicRoles`) inside a slot whose `coverage` is required, except that the commit adding a measured logic file stages its `<name>.<role>.spec.ts` beside it (owner 2026-10-20, judged by `starci app hygiene` in the pre-commit hook), and nowhere else but beside a webhook or realtime door that has no service of its own (`<provider>.webhook.spec.ts`, `<channel>.gateway.spec.ts`, `<x>.subscription.spec.ts`) (every unit-tested subject has exactly one; any other `*.spec.ts` outside `be/src/tests/{world,integration,e2e,contract}` is a finding, including specs in apps), and the unit project collects coverage from the logic roles of the measured roots only (the scope derived from the slot manifest, R204) with a per-file threshold of 100 on lines, branches, functions and statements (`test` runs `--coverage`; `importHelpers` and `tslib`); `be/src/tests/world/` is the ONLY test infrastructure: `global-setup.ts` starts the app's own stack (`.starcistacks/<env>`, named by `stack` in `test-world.config.ts`, the declaration of the test-world library in its one named form `export const { useTestWorld, useSandbox } = defineTestWorld({...})` (a default export is not read): every service it declares runs REAL, behind toxiproxy, images and versions read from the stack at run time, never spelled in test source) or attaches to a warm one that answers, and runs the migrations once over the cli app's connections (the runner of the cli migrate command); `global-teardown.ts` stops only what its setup started; `use-test-world.ts` exports `useTestWorld({ apps } | { modules })` (`world.apps.<name>.api`, `world.db.<connection>`, `world.infra.<service>` with `latency(ms)`, `cut()` and `restore()` on the real service, `world.fake.<provider>`, `world.waitFor`) and `fakes/<provider>/` holds the network-edge fakes (`failNext`, `replayWebhook`, `delay`, payload fixtures) of external SaaS the team does not operate ONLY: a fake of a service the stack declares is refused, except stateless compute that needs special hardware or an external model (GPU inference, a self-hosted embedding model), whose `stacks` entry in `test-world.config.ts` declares `{ fakedBy: <fake>, reason }` with a non-empty `reason` (a stateful service, or one with a persistent volume, is never accepted); it alone owns containers, DataSource, migrations and `process.env`; nothing under `be/src/tests` overrides a provider or DI token; `be/src/tests/integration/<capability>/*.integration-spec.ts` (`{ modules }`, with the real peer apps its client calls beside them as `apps`; real infrastructure, no HTTP door of ours), `be/src/tests/e2e/<area>/*.e2e-spec.ts` (`{ apps }`) and `be/src/tests/contract/<provider>/*.contract-spec.ts` (provider sandboxes, skipped without sandbox config, run only by `test:contract`, never by `test` or `test:e2e`) agree folder with suffix; an integration or e2e spec passes `useTestWorld` one object literal with plain keys (no variable, spread or computed key) and calls it; the contract layer skips only through the test-world library's `useSandbox(...)` when the sandbox config is absent (`sandbox.describe(...)`), and every `fakes/<provider>/` that serves payload fixtures (`payloads/*.json`) has a `contract/<provider>/*.contract-spec.ts` that references those fixtures and asserts `shapeOf(real)` equals `shapeOf(fixture)` (the helper `shapeOf` is named by `ruleParams.be.contractShape` of the slot manifest; fakes the test-world library provides are guarded by the library); no `.test.ts`, `int-spec` or `harness-spec`, no `live/` and no `be/src/tests/e2e/world`."
+    law: "One jest config, projects `unit`, `integration`, `e2e` and `contract`, live by folder, `diagnostics: false`; unit specs are `<name>.<role>.spec.ts` beside the file they test: required for the roles of `ruleParams.be.unitRoles` (`<name>.service.spec.ts` beside a `<name>.service.ts`, `<name>.cli.spec.ts` beside a cli command `<name>.cli.ts` of `src/features/cli`), optional for any other logic role (`ruleParams.be.logicRoles`) inside a slot whose `coverage` is required, except that the commit adding a measured logic file stages its `<name>.<role>.spec.ts` beside it (owner 2026-10-20, judged by `starci app hygiene` in the pre-commit hook), and nowhere else but beside a webhook or realtime door that has no service of its own (`<provider>.webhook.spec.ts`, `<channel>.gateway.spec.ts`, `<x>.subscription.spec.ts`) (every unit-tested subject has exactly one; any other `*.spec.ts` outside `be/src/tests/{world,integration,e2e,contract}` is a finding, including specs in apps), and the unit project collects coverage from the logic roles of the measured roots only (the scope derived from the slot manifest, R204) with a per-file threshold of 100 on lines, branches, functions and statements (`test` runs `--coverage`; `importHelpers` and `tslib`); `be/src/tests/world/` is the ONLY test infrastructure: `global-setup.ts` starts the app's own stack (`.starcistacks/<env>`, named by `stack` in `test-world.config.ts`, the declaration of the test-world library in its one named form `export const { useTestWorld, useSandbox } = defineTestWorld({...})` (a default export is not read): every service it declares runs REAL, behind toxiproxy, images and versions read from the stack at run time, never spelled in test source) or attaches to a warm one that answers, and runs the migrations once over the cli app's connections (the runner of the cli migrate command); `global-teardown.ts` stops only what its setup started; `use-test-world.ts` exports `useTestWorld({ apps } | { modules })` (`world.apps.<name>.api`, `world.db.<connection>`, `world.infra.<service>` with `latency(ms)`, `cut()` and `restore()` on the real service, `world.fake.<provider>`, `world.waitFor`) and `fakes/<provider>/` holds the network-edge fakes (`failNext`, `replayWebhook`, `delay`, payload fixtures) of external SaaS the team does not operate ONLY: a fake of a service the stack declares is refused, except stateless compute that needs special hardware or an external model (GPU inference, a self-hosted embedding model), whose `stacks` entry in `test-world.config.ts` declares `{ fakedBy: <fake>, reason }` with a non-empty `reason` (a stateful service, or one with a persistent volume, is never accepted); it alone owns containers, DataSource, migrations and `process.env`; nothing under `be/src/tests` overrides a provider or DI token; `be/src/tests/integration/<capability>/*.integration-spec.ts` (`{ modules }`, with the real peer apps its client calls beside them as `apps`; real infrastructure, no HTTP door of ours), `be/src/tests/e2e/<area>/*.e2e-spec.ts` (`{ apps }`) and `be/src/tests/contract/<provider>/*.contract-spec.ts` (provider sandboxes, skipped without sandbox config, run only by `test:contract`, never by `test` or `test:e2e`) agree folder with suffix; an integration or e2e spec passes `useTestWorld` one object literal with plain keys (no variable, spread or computed key) and calls it; the contract layer has no skip either: a contract spec writes `sandbox.describe(...)` from the test-world library's `useSandbox(...)`, and when the sandbox config is absent that describe registers one failing test naming the missing keys (the body never runs), and every `fakes/<provider>/` that serves payload fixtures (`payloads/*.json`) has a `contract/<provider>/*.contract-spec.ts` that references those fixtures and asserts `shapeOf(real)` equals `shapeOf(fixture)` (the helper `shapeOf` is named by `ruleParams.be.contractShape` of the slot manifest; fakes the test-world library provides are guarded by the library); no `.test.ts`, `int-spec` or `harness-spec`, no `live/` and no `be/src/tests/e2e/world`."
     kinds: [check, codemod, lint]
     gates: [land, ci]
     failureCodes: ["BE_TEST_TOPOLOGY", "BE_CONTRACT_UNGUARDED", "BE_UNIT_SPEC_NOT_STAGED"]
@@ -2540,7 +2540,7 @@ rules:
     enforcers:
       - {kind: hfs, id: pattern-spec-missing, at: scripts/hfs/rules/event-bus.mjs, editions: [full]}
       - {kind: hfs, id: lite-proof-lane, at: scripts/hfs/rules/lite-proof-lane.mjs, editions: [lite]}
-    editionWhy: "owner:gate-loosening-e77ca91cded7 approves the per-edition enforcer split; ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4) gives lite its integration proof lane while full retains e2e or integration proofs."
+    editionWhy: "each enforcer judges the edition it emits for (pattern-spec-missing returns no findings for lite, lite-proof-lane is lite's emitter), so the split adds lite's emitter and drops no finding; ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4) gives lite its integration proof lane while full retains e2e or integration proofs."
     docs: [docs/quality-bar.md#r155]
     templateNa: "Pattern scenarios depend on application behavior and providers; no universal runnable scenario proof is scaffolded."
     specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
@@ -3282,7 +3282,7 @@ rules:
       - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
       - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    law: "A coverage upload of a CI workflow never skips or fails silently: every step that uses codecov/codecov-action, in a root workflow, an example workflow or a template workflow of packages/hfs, authenticates by OIDC (`use_oidc: true`, with `permissions: id-token: write` on the job or the workflow), sets `fail_ci_if_error: true`, has no `continue-on-error`, and has no `if` that reads a secret or CODECOV_TOKEN, so a missing token can never turn the upload into a skipped step."
+    law: "A coverage upload of a CI workflow never skips or fails silently: every step that uses codecov/codecov-action, in a root workflow, an example workflow or a template workflow of packages/hfs, authenticates by OIDC (`use_oidc: true`, with `permissions: id-token: write` on the job or the workflow), sets `fail_ci_if_error: true`, has no `continue-on-error`, and has no `if` that reads a secret or CODECOV_TOKEN, so a missing token can never turn the upload into a skipped step. Every step that uses SonarSource/* has no `if` that reads a secret or SONAR_TOKEN (a missing token fails the job), and no step or job of a workflow sets `continue-on-error`."
     scope: runtime
     kinds: [check]
     gates: [runtime]
@@ -3754,7 +3754,7 @@ rules:
       - {path: packages/eslint/be/sonar-parity-editions.spec.mjs, edition: full}
       - {path: packages/eslint/fe/sonar-parity-editions.spec.mjs, edition: lite}
       - {path: packages/eslint/fe/sonar-parity-editions.spec.mjs, edition: full}
-    law: "Code carries none of the smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (S9382; an endless loop is spared), no `charCodeAt`/`fromCharCode` (S7758), no string that only escapes backslashes (S7780; a Next `matcher` is spared, it is read statically), no nested conditional expression (S3358), no `void` on anything but a call (S3735), no unused import (S1128), no import that is only handed on instead of `export ... from` (S7763), no prop of a component's props type the component never reads (S6767, front end), no `<video>` or `<audio>` without a captions track unless muted (S4084, front end), and, through typescript-eslint with type information, no deprecated API (S1874), no object turned into text (S6551) and no `async` function that never awaits and returns no promise (S7503). No function takes more than seven parameters (S107), except the constructor of an injectable class, whose parameters are its injected dependencies. Every other rule of the Sonar way TypeScript profile with an ESLint equivalent that reports what the server reports on the same source (scripts/lib/sonar-way.mjs: eslint-plugin-sonarjs' Sonar way set and the core and unicorn rules it builds on) is on at error in both canons; a port that does not match the server is left to the server. The files a unit or an end-to-end spec names are outside the scan, so outside these rules."
+    law: "Code carries none of the smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (S9382; an endless loop is spared), no `charCodeAt`/`fromCharCode` (S7758), no string that only escapes backslashes (S7780; a Next `matcher` is spared, it is read statically), no nested conditional expression (S3358), no `void` on anything but a call (S3735), no unused import (S1128), no import that is only handed on instead of `export ... from` (S7763), no prop of a component's props type the component never reads (S6767, front end), no `<video>` or `<audio>` without a captions track unless muted (S4084, front end), and, through typescript-eslint with type information, no deprecated API (S1874), no object turned into text (S6551) and no `async` function that never awaits and returns no promise (S7503). No function takes more than seven parameters (S107), except the constructor of an injectable class, whose parameters are its injected dependencies. Every other rule of the Sonar way TypeScript profile with an ESLint equivalent that reports what the server reports on the same source (scripts/lib/sonar-way.mjs: eslint-plugin-sonarjs' Sonar way set and the core and unicorn rules it builds on) is on at error in both canons (S7785, top-level await, runs in the front end only: a back end compiles to CommonJS); a port that disagrees with the server is fixed in the source it reports, never left out. The files a unit or an end-to-end spec names are outside the scan, so outside these rules."
     kinds: [lint, codemod]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["SCAN_SMELL"]
@@ -3781,10 +3781,10 @@ rules:
     code: "RT_GATE_LOOSENING"
     editions: [lite, full]
     docs: [docs/debugging.md#r236]
-    templateNa: "Runtime release-history approval is checked against committed gates and owner rulings; product scaffolding has no runtime release history to generate."
+    templateNa: "Runtime release history is judged against the committed gates of the last release; product scaffolding has no runtime release history to generate."
     specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    law: "A change that loosens a gate or check is owner-class: a check removed from a gate file's list, a floor lowered or a ceiling raised there, an allowlist entry added, a spec deleted or weakened or skipped together with product code (modules/kernel/gate-loosening.yaml). It lands, and passes the check, only when the tree it is judged against already holds the owner's approval of exactly that loosening, an owner-rulings entry gate-loosening-<fingerprint>."
+    law: "A change that loosens a gate or check is always red: a check removed from a gate file's list, a floor lowered or a ceiling raised there, an allowlist entry added, a spec deleted or weakened or skipped together with product code (modules/kernel/gate-loosening.yaml). It never lands and never passes the check; there is no approval route, the owner's included (owner:loosening-always-red), and the fix is to restore the gate. An entry that only moves with a git rename of the paths it names is no loosening."
     scope: runtime
     kinds: [check]
     gates: [runtime]
@@ -4254,7 +4254,7 @@ rules:
       - {"path":"packages/hfs/templates/be/inbox/webhook-door.ts.tpl","editions":["lite","full"]}
       - {"path":"packages/hfs/templates/be/inbox/service.ts.tpl","editions":["lite","full"]}
       - {"path":"examples/lite-app/be/src/features/webhooks/calendar/transport/http/calendar.webhook.ts","edition":"lite"}
-      - {"path":"examples/ecommerce-app/be/src/features/webhooks/sepay/transport/http/sepay.webhook.ts","edition":"full"}
+      - {"path":"examples/full-app/be/src/features/webhooks/sepay/transport/http/sepay.webhook.ts","edition":"full"}
       - {"path":"packages/eslint/be/webhook-handoff-inbox.spec.mjs","editions":["lite","full"],"codes":["BE_WEBHOOK_INBOX_KEY"]}
     proves:
       - {"path":"packages/eslint/be/webhook-handoff-scope.spec.mjs","editions":["lite","full"],"codes":["BE_WEBHOOK_SCOPE"]}
@@ -4279,7 +4279,7 @@ rules:
     exemplifiedBy:
       - {"path":"packages/hfs/templates/be/skeleton/src/features/api/system-health/application/check-liveness.contracts.ts","editions":["lite","full"]}
       - {"path":"examples/lite-app/be/src/features/api/bookings/application/create-booking.contracts.ts","edition":"lite"}
-      - {"path":"examples/ecommerce-app/be/src/features/api/health/application/check-health.contracts.ts","edition":"full"}
+      - {"path":"examples/full-app/be/src/features/api/health/application/check-health.contracts.ts","edition":"full"}
     proves:
       - {"path":"packages/eslint/be/feature-thin.spec.mjs","editions":["lite","full"],"codes":["HFS_FEATURE_LOGIC_ROLE"]}
     witness:
@@ -4301,7 +4301,7 @@ rules:
       - {"path":"packages/hfs/templates/be/skeleton-lite/apps/api/src/compose/platform.ts","edition":"lite"}
       - {"path":"packages/hfs/templates/be/skeleton/apps/__app__/src/compose/platform.ts","edition":"full"}
       - {"path":"examples/lite-app/be/apps/api/src/compose/platform.ts","edition":"lite"}
-      - {"path":"examples/ecommerce-app/be/apps/order/src/compose/platform.ts","edition":"full"}
+      - {"path":"examples/full-app/be/apps/order/src/compose/platform.ts","edition":"full"}
     proves:
       - {"path":"packages/eslint/be/app-composition.spec.mjs","editions":["lite","full"],"codes":["BE_COMPOSITION_UNTYPED"]}
     witness:
@@ -4453,7 +4453,7 @@ rules:
     exemplifiedBy:
       - {"path":"packages/hfs/templates/be/tool-config/jest.config.js","editions":["lite","full"]}
       - {"path":"examples/lite-app/be/jest.config.js","edition":"lite"}
-      - {"path":"examples/ecommerce-app/be/jest.config.js","edition":"full"}
+      - {"path":"examples/full-app/be/jest.config.js","edition":"full"}
     specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
 
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
@@ -4794,7 +4794,7 @@ rules:
       - {path: packages/eslint/fe/function-budget.spec.mjs, editions: [lite, full], codes: [HFS_FUNCTION_BUDGET]}
       - {path: packages/hfs/templates/be/patterns/api/graphql.resolver.ts.tpl, editions: [lite, full]}
       - {path: examples/lite-app/be/src/features/api/bookings/application/create-booking.handler.ts, editions: [lite]}
-      - {path: examples/ecommerce-app/be/src/features/api/checkout/application/add-cart-item.handler.ts, editions: [full]}
+      - {path: examples/full-app/be/src/features/api/checkout/application/add-cart-item.handler.ts, editions: [full]}
     proves:
       - {path: packages/eslint/be/function-budget.spec.mjs, editions: [lite, full], codes: [HFS_FUNCTION_BUDGET]}
       - {path: packages/eslint/fe/function-budget.spec.mjs, editions: [lite, full], codes: [HFS_FUNCTION_BUDGET]}
@@ -4815,7 +4815,7 @@ rules:
     exemplifiedBy:
       - {path: packages/hfs/templates/be/patterns/api, editions: [lite, full]}
       - {path: examples/lite-app/be/src/features/api/bookings, editions: [lite]}
-      - {path: examples/ecommerce-app/be/src/features/api/checkout, editions: [full]}
+      - {path: examples/full-app/be/src/features/api/checkout, editions: [full]}
     specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
 
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
@@ -4876,7 +4876,7 @@ rules:
       - {path: packages/hfs/templates/be/patterns/api/feature.module-definition.ts.tpl, edition: lite}
       - {path: packages/hfs/templates/be/patterns/api/graphql.module-definition.ts.tpl, edition: lite}
       - {path: examples/lite-app/be/src/features/api/bookings/transport/graphql/bookings-graphql.module-definition.ts, edition: lite}
-      - {path: examples/ecommerce-app/be/src/features/api/checkout/checkout.module-definition.ts, edition: full}
+      - {path: examples/full-app/be/src/features/api/checkout/checkout.module-definition.ts, edition: full}
       - {path: packages/eslint/be/module-shape.spec.mjs, editions: [lite, full]}
     proves:
       - {path: packages/eslint/be/module-shape.spec.mjs, editions: [lite, full], codes: [BE_MODULE_DEFINITION_MISSING]}
@@ -4895,7 +4895,7 @@ rules:
       - {path: docs/application-stacks.md#r296, editions: [lite, full]}
     exemplifiedBy:
       - {path: examples/lite-app/.starcistacks/application-stacks.yaml, edition: lite}
-      - {path: examples/ecommerce-app/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: examples/full-app/.starcistacks/application-stacks.yaml, edition: full}
       - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
       - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
@@ -4914,7 +4914,7 @@ rules:
       - {path: docs/application-stacks.md#r297, editions: [lite, full]}
     exemplifiedBy:
       - {path: examples/lite-app/.starcistacks/application-stacks.yaml, edition: lite}
-      - {path: examples/ecommerce-app/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: examples/full-app/.starcistacks/application-stacks.yaml, edition: full}
       - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
       - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
@@ -4933,7 +4933,7 @@ rules:
       - {path: docs/application-stacks.md#r298, editions: [lite, full]}
     exemplifiedBy:
       - {path: examples/lite-app/.starcistacks/application-stacks.yaml, edition: lite}
-      - {path: examples/ecommerce-app/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: examples/full-app/.starcistacks/application-stacks.yaml, edition: full}
       - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
       - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.4.0
+version: 3.5.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -39,6 +39,8 @@ versioning:
 # when the file key is absent; .starcistacks owns custody. Capability <capability>.config.ts roles stay unchanged.
 # 3.3.0 is a minor (alpha.16): it ADDS the optional app.ci-stack-deploy slot, the managed workflow of the starci app stack verbs.
 # 3.4.0 is a minor (alpha.25): it ADDS the opt-in be.contract.mcp-tools slot, the committed MCP tool-catalog snapshot of an app.
+# 3.5.0 is a minor (alpha.27): it ADDS the opt-in app.browser-config slot, the managed browser/tsconfig.json that type-checks the browser
+# journey (enabled with app.browser by `browser: true`).
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -617,6 +619,23 @@ slots:
     tests: none
     requires: [playwright.config.ts, journeys/]
     allows: [playwright.config.ts, stack.mjs, "journeys/*.ts"]
+  - id: app.browser-config
+    since: 3.5.0
+    profiles: [app]
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): browser journeys belong to full; lite proves app boot through R272 wiring."
+    # The program that type-checks the browser journey: Playwright only transpiles the config and the journeys, so without it nothing
+    # type-checks them and the op gate finds no tsconfig.json owning a changed journey (GATE_TSC_CONFIG_MISSING). It is managed (rendered
+    # by starci app sync from templates/app/browser-config, extending @starci/tsconfig/e2e.json), never authored, and enabled with
+    # app.browser by `browser: true` in hfs.json.
+    path: browser/tsconfig.json
+    presence: opt-in
+    litePresence: forbidden
+    goesTo: "the full edition: a lite app has no browser journey to type-check"
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: browser-config
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.github-meta
     since: 3.1.0
     profiles: [app]

package/runtime/knowledge/sonar-gate.yaml

@@ -8,7 +8,7 @@ purpose: |
   conditions and selects it for the project, and (2) judges an op's slice - the lines it changed - against
   the same numbers. Code-writing ops cannot settle done while the slice is red
   (scripts/kernel/sonar-settle.mjs). Changing a number here changes every repository on the next scan.
-  The gate has two parts: `newCode` (the recent work: coverage, duplication, blocker/critical issues, hotspots) and
+  The gate has two parts: `newCode` (the recent work: coverage, duplication, issues of every severity, hotspots) and
   `overall` (the whole code: coverage, no imported HFS, ESLint or stylelint finding, no bug, code smell or
   vulnerability, every hotspot reviewed, no duplicated-lines excess, no cognitive-complexity issue). The one Sonar
   mechanism of the HFS canon is packages/hfs/README.md section "Sonar".
@@ -26,15 +26,15 @@ newCode:
   coverage:
     metric: new_coverage
     minPercent: 100
-  # SonarQube's ignoreSmallChanges: fewer changed lines than this are not held to duplication.
-  ignoreBelowChangedLines: 20
+  # SonarQube's ignoreSmallChanges floor: 0, so a change of any size is held to duplication.
+  ignoreBelowChangedLines: 0
   duplication:
     metric: new_duplicated_lines_density
     maxPercent: 3
   issues:
-    # An open issue of these severities on a changed line fails the slice; lesser ones are listed, never blocking.
-    blockingSeverities: [BLOCKER, CRITICAL]
-    metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations}
+    # An open issue of any severity on a changed line fails the slice: there is no lesser severity that is only listed.
+    blockingSeverities: [BLOCKER, CRITICAL, MAJOR, MINOR, INFO]
+    metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations, MAJOR: new_major_violations, MINOR: new_minor_violations, INFO: new_info_violations}
     max: 0
   hotspots:
     metric: new_security_hotspots_reviewed
@@ -92,13 +92,13 @@ lite:
     coverage:
       metric: new_coverage
       minPercent: 100
-    ignoreBelowChangedLines: 20
+    ignoreBelowChangedLines: 0
     duplication:
       metric: new_duplicated_lines_density
       maxPercent: 3
     issues:
-      blockingSeverities: [BLOCKER, CRITICAL]
-      metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations}
+      blockingSeverities: [BLOCKER, CRITICAL, MAJOR, MINOR, INFO]
+      metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations, MAJOR: new_major_violations, MINOR: new_minor_violations, INFO: new_info_violations}
       max: 0
     hotspots:
       metric: new_security_hotspots_reviewed
@@ -139,9 +139,9 @@ reasoning: |
   lives there, the feature tier is thin (R203) and proven by integration and e2e, and the front end has no unit tests.
   duplication 3: the Sonar way value; the worst project today is 2.1, so 3 rejects a real copy-paste block and
   passes ordinary work.
-  blocker/critical 0: the two severities that are defects, not style. main carries old debt of both kinds
-  (one product repository carries 3 blocker and 137 critical), so the SLICE verdict reads only changed lines and never main's backlog;
-  major and lower are reported on the summary and never fail a slice.
+  issues 0 at every severity (blocker, critical, major, minor, info), owner ruling 2026-10-22 (no loosening): a lesser severity is not a
+  lesser finding. The SLICE verdict reads only changed lines and never main's backlog; the overall condition holds the whole project.
+  A change of any size is held to duplication (ignoreBelowChangedLines 0).
   overall issues 0 and overall duplication 3: the server gate is also the owner's definition of done for the HFS canon:
   a repository that carries any open ESLint, stylelint or HFS finding is not green, whatever the age of the line. The
   op slice keeps judging changed lines (an op cannot fix a repository's whole backlog); the dashboard and CI show the

package/runtime/packages/hfs/templates/app/package-scripts/package.json

@@ -5,7 +5,6 @@
 {{> app/package-scripts/core.json}}
     "typecheck:tests": "tsc -p be/src/tests/tsconfig.json",
     "test": "cd be && jest --selectProjects unit --coverage",
-    "test:affected": "cd be && jest --selectProjects unit --passWithNoTests",
     "test:integration": "npm run typecheck:tests && cd be && jest --selectProjects integration",
     "test:e2e": "npm run typecheck:tests && cd be && jest --selectProjects e2e",
     "test:contract": "npm run typecheck:tests && cd be && jest --selectProjects contract",

package/runtime/scripts/hfs/architecture/automatic-gates.mjs

@@ -10,7 +10,7 @@ const E2E_COMMAND = new RegExp([
   String.raw`src\/tests\/(?:world|integration|e2e|contract)\b|`,
   String.raw`jest[^\n|&;]*(?:e2e|integration|contract)`,
 ].join(''), 'u');
-const UNIT_RUN_SCRIPTS = ['test', 'test:unit', 'test:ci', 'test:affected', 'test:coverage', 'test:cov'];
+const UNIT_RUN_SCRIPTS = ['test', 'test:unit', 'test:ci', 'test:coverage', 'test:cov'];
 
 const runsE2e = text => E2E_COMMAND.test(String(text).replace(/--ignore-pattern[= ]+(?:"[^"]*"|'[^']*'|\S+)/gu, ''));
 const withoutComments = text => text.split('\n').filter(line => !/^\s*#/u.test(line)).join('\n');

package/runtime/scripts/hfs/slots.mjs

@@ -153,9 +153,10 @@ export function resolveRepoDeclaration(manifest, declaration, { file = HFS_DECLA
     edition,
     side: null,
     profile: APP_SCOPE,
-    // The root declares no app or connection of its own (each side does); its one opt-in slot is the browser journey (`browser: true`).
+    // The root declares no app or connection of its own (each side does); its opt-in slots are the browser journey and the managed
+    // tsconfig.json that type-checks it, both switched on by `browser: true`.
     apps: Object.freeze([]),
-    optionalSlots: Object.freeze(declaration.browser === true ? ['app.browser'] : []),
+    optionalSlots: Object.freeze(declaration.browser === true ? ['app.browser', 'app.browser-config'] : []),
     connections: Object.freeze([]),
     providers,
     reads: Object.freeze([]),

package/runtime/scripts/lib/sonar-way.mjs

@@ -2,7 +2,8 @@
 // the one mapping both lint canons (@starci/eslint-canon-be and -fe) publish, so `starci app lint` in the op loop refuses what the scan would
 // raise while the code is written. The base is eslint-plugin-sonarjs's recommended config, SonarSource's own port of Sonar way (each rule's
 // docs url names its S-id); its rules the canons already publish in another form stay with that owner (SONAR_WAY_OWNED), and the Sonar way
-// rules SonarSource builds on other ESLint rules are SONAR_WAY_EXTRA. Every rule is `error`. A unit or end-to-end spec is outside the scan,
+// rules SonarSource builds on other ESLint rules are SONAR_WAY_EXTRA. Every rule is `error`; no rule is left to the server because its port
+// disagrees with it (a port that disagrees is fixed in the source it reports, never switched off). A unit or end-to-end spec is outside the scan,
 // so outside these rules: the canons give this block the ignores of sonar-syntax-rules.mjs OUTSIDE_THE_SCAN_FILES. The runtime's own
 // `sonar-rules` gate reads the two limits below.
 
@@ -11,31 +12,36 @@ export const COGNITIVE_COMPLEXITY_LIMIT = 15;
 export const MAX_PARAMETERS = 7;
 
 /**
- * sonarjs rules of Sonar way the local lint does not run: another canon owner reports the same Sonar id, or the port does not match what the
- * server reports on the same source and is left to the server. Parity is measured, not assumed: a product scan with 0 issues on the server
- * (Sonar way, 2026-10-21) while these ports reported 130 findings on it; a rule that cannot match the server is not a lint error.
+ * sonarjs rules of Sonar way the local lint does not run under their sonarjs name because another owner enforces the same Sonar id at error:
+ * a canon syntax rule, a borrowed typescript-eslint rule or the TypeScript compiler. Each owner is asserted in packages/eslint/be/sonar-way.spec.mjs and packages/eslint/fe/config.spec.mjs.
  */
 const SONAR_WAY_OWNED = Object.freeze({
   'sonarjs/no-nested-conditional': 'S3358, the canon syntax rule no-nested-conditional',
   'sonarjs/unused-import': 'S1128, the canon syntax rule no-unused-import',
   'sonarjs/void-use': 'S3735, the canon syntax rule no-void-operator',
   'sonarjs/deprecation': 'S1874, the borrowed @typescript-eslint/no-deprecated',
-  'sonarjs/no-unused-vars': 'S1481, the TypeScript compiler (noUnusedLocals in @starci/tsconfig); the port also reports a rest-sibling omit the server accepts',
-  'sonarjs/different-types-comparison': 'S3403, the server: the port reads control-flow-narrowed types (`x !== null` after an aliased guard) the server does not report',
-  'sonarjs/function-return-type': 'S3800, the server: the port reports nullable and union returns the server accepts',
-  'sonarjs/argument-type': 'S3782, the server: the port reports optional arguments the server accepts',
+  'sonarjs/no-unused-vars': 'S1481, the TypeScript compiler (noUnusedLocals and noUnusedParameters in @starci/tsconfig)',
+});
+
+/**
+ * Sonar way rules with no ESLint form that applies to the module format of a side. S7785 prefers top-level await, which a CommonJS output
+ * (the back end: `module: nodenext` without `type: module`) cannot contain; the front end is ESM and runs the rule.
+ */
+export const SONAR_WAY_NOT_APPLICABLE = Object.freeze({
+  be: Object.freeze({ S7785: 'top-level await does not exist in the CommonJS output of a back end' }),
+  fe: Object.freeze({}),
 });
 
 /**
  * The Sonar way rules SonarSource implements on an ESLint rule outside eslint-plugin-sonarjs: `{ sonar, rule, options? }`. The canon syntax
  * rules carry S107 (`max-params`, which spares the constructor of an injectable class as the server does) and S4084 (`media-has-caption`,
- * front end). Left out: S7785 (top-level await; an app's TypeScript compiles to CommonJS, `module: nodenext` without `type: module`) and
- * S6582 (typescript-eslint's optional-chain rule reports guards whose optional chain would change the value's type, which the server accepts).
+ * front end); S6582 is typescript-eslint's `prefer-optional-chain`, which needs the type information the canons' typed block provides.
  */
 export const SONAR_WAY_EXTRA = Object.freeze([
   { sonar: 'S3863', rule: 'no-duplicate-imports', options: [{ allowSeparateTypeImports: true }] },
+  { sonar: 'S6582', rule: '@typescript-eslint/prefer-optional-chain' },
   { sonar: 'S4138', rule: 'unicorn/no-for-loop' },
-  { sonar: 'S7721', rule: 'unicorn/consistent-function-scoping', options: [{ checkArrowFunctions: false }] },
+  { sonar: 'S7721', rule: 'unicorn/consistent-function-scoping' },
   { sonar: 'S7732', rule: 'unicorn/no-instanceof-builtins' },
   { sonar: 'S7740', rule: 'unicorn/no-this-assignment' },
   { sonar: 'S7744', rule: 'unicorn/no-useless-fallback-in-spread' },
@@ -50,14 +56,20 @@ export const SONAR_WAY_EXTRA = Object.freeze([
   { sonar: 'S7784', rule: 'unicorn/prefer-structured-clone' },
 ]);
 
+/** The ESM-only Sonar way rules: S7785 prefers top-level await (see SONAR_WAY_NOT_APPLICABLE). */
+const SONAR_WAY_ESM = Object.freeze([{ sonar: 'S7785', rule: 'unicorn/prefer-top-level-await' }]);
+
 /** The Sonar id a sonarjs rule documents (its docs url ends in `#/rspec/S<id>/javascript`), or null. */
 const sonarIdOf = (rule) => /\/rspec\/#\/rspec\/(S\d+)\//u.exec(rule?.meta?.docs?.url ?? '')?.[1] ?? null;
 
 /**
  * The Sonar way rules, `{ rules, mapped }`: `rules` the flat-config rule levels (sonarjs' recommended rules at error minus the owned ones,
- * with S3776's limit, then SONAR_WAY_EXTRA), `mapped` every `{ sonar, rule }` row.
+ * with S3776's limit, then SONAR_WAY_EXTRA, then the ESM-only rules unless `side` is `be`), `mapped` every `{ sonar, rule }` row.
+ *
+ * @param {object} sonarjs - The eslint-plugin-sonarjs plugin.
+ * @param {'be' | 'fe'} [side] - The side the rules lint; the back end compiles to CommonJS.
  */
-export function sonarWayRules(sonarjs) {
+export function sonarWayRules(sonarjs, side = 'fe') {
   const mapped = [];
   const rules = {};
   for (const [name, setting] of Object.entries(sonarjs.configs.recommended.rules)) {
@@ -67,7 +79,7 @@ export function sonarWayRules(sonarjs) {
     rules[name] = ['error', ...options];
     mapped.push({ sonar: sonarIdOf(sonarjs.rules[name.slice('sonarjs/'.length)]), rule: name });
   }
-  for (const entry of SONAR_WAY_EXTRA) {
+  for (const entry of [...SONAR_WAY_EXTRA, ...SONAR_WAY_ESM.filter(row => !SONAR_WAY_NOT_APPLICABLE[side][row.sonar])]) {
     rules[entry.rule] = ['error', ...(entry.options ?? [])];
     mapped.push({ sonar: entry.sonar, rule: entry.rule });
   }

package/spec-no-skip.mjs

@@ -2,10 +2,11 @@
  * The rule that keeps every back-end spec running (catalog R48 `BE_SPEC_QUALITY`, owner test policy 2026-09-30).
  *
  * A unit, integration, e2e or contract spec never skips, focuses, marks as todo or picks its own runner: a test that does
- * not run is a claim nobody checks. The ONE legitimate skip is the contract layer's own, and it lives in the test-world
- * library: `useSandbox(...)` of `@starci/test-world` skips itself when the provider sandbox is not configured and hands
- * the spec `sandbox.describe(...)`. No file of the repository writes a skip: the rule judges every spec AND every file
- * of the test tree (`be.tests.*` slots: world, fixtures, kit), so a repo-local helper cannot become a second skip path.
+ * not run is a claim nobody checks. There is no legitimate skip, the contract layer included: a contract spec writes
+ * `sandbox.describe(...)` from `useSandbox(...)` of `@starci/test-world`, and when the provider sandbox is not configured
+ * that describe registers one FAILING test naming the missing keys (the body never runs). No file of the repository writes a
+ * skip: the rule judges every spec AND every file of the test tree (`be.tests.*` slots: world, fixtures, kit), so a
+ * repo-local helper cannot become a skip path.
  *
  * Refused in a spec: `it|test|describe` followed by `.skip`, `.skipIf`, `.runIf`, `.todo` or `.only`; `xit`, `xtest`,
  * `xdescribe`, `fit`, `ftest`, `fdescribe`; and a runner used as a value (a conditional `(cond ? describe : describe.skip)`,
@@ -34,11 +35,11 @@ const resolve = (scope, name) => {
 export const specNoSkip = {
     meta: {
         type: "problem",
-        docs: { description: "No spec or test-tree file skips, focuses, marks todo or selects its runner conditionally; only the test-world library's `useSandbox` skips." },
+        docs: { description: "No spec or test-tree file skips, focuses, marks todo or selects its runner conditionally; a contract spec's missing sandbox is a failing test of the test-world library's `sandbox.describe`, never a skip." },
         schema: [],
         messages: {
-            skip: "`{{what}}` keeps a test from running. A spec runs every test it declares: delete it or write it. The only skip is the test-world library's own: a contract spec calls `useSandbox(...)` of `@starci/test-world` and writes `sandbox.describe(...)`.",
-            select: "A test runner (`{{what}}`) is used as a value here, so the spec picks or hides what runs. Call `describe`/`it`/`test` directly; a contract spec writes `sandbox.describe(...)` from `useSandbox(...)` of `@starci/test-world`, which decides the skip.",
+            skip: "`{{what}}` keeps a test from running. A spec runs every test it declares: delete it or write it. Nothing skips: a contract spec calls `useSandbox(...)` of `@starci/test-world` and writes `sandbox.describe(...)`, which fails naming the missing keys when the sandbox is not configured.",
+            select: "A test runner (`{{what}}`) is used as a value here, so the spec picks or hides what runs. Call `describe`/`it`/`test` directly; a contract spec writes `sandbox.describe(...)` from `useSandbox(...)` of `@starci/test-world`, which fails naming the missing keys when the sandbox is not configured.",
         },
     },
     create(context) {