@starci/eslint-canon-be 3.4.34 → 3.4.36

package/runtime/knowledge/hfs/rules.yaml

@@ -32,9 +32,9 @@ enforcerKinds:
   stylelint: a rule of the @starci/stylelint-canon package
   machine: a check of the architecture machine (scripts/hfs/architecture), which reads the import graph
   hfs: a check of the hfs CLI that reads the repository tree, configuration, contracts or catalogs
-  work-validate: a check of scripts/work/validate/work-validate.mjs over a .starciwork tree
+  work-validate: "a check of scripts/work/validate/work-validate.mjs over a .starciwork tree; runs only inside the runtime, so no package spec holds it (RUNTIME_ONLY_ENFORCERS in scripts/hfs/rule-catalog.mjs)"
   sonar: a condition of the Sonar quality gate
-  runtime: a rule module of the runtime check (scripts/hfs/runtime-check.mjs, scripts/hfs/runtime-rules/*) or an emitter whose findings it judges, over the runtime repository
+  runtime: "a rule module of the runtime check (scripts/hfs/runtime-check.mjs, scripts/hfs/runtime-rules/*) or an emitter whose findings it judges, over the runtime repository; runs only inside the runtime, so no package spec holds it and no example app is judged by it (RUNTIME_ONLY_ENFORCERS in scripts/hfs/rule-catalog.mjs; owner ruling no-runtime-specs: the package clean-test and the scaffold e2e are the runtime's tests)"
 rules:
   - id: R01
     code: "HFS_SLOT_UNDECLARED"
@@ -51,14 +51,18 @@ rules:
     editions: [lite, full]
     docs: [docs/architecture.md#r01]
     templateNa: "Slot ownership judges where a path sits in the tree, not what a file holds: the managed templates render files into the slots that own them, and no template exists for a path that no slot, two slots or a forbidden slot own."
-    proves:
-      - {path: packages/eslint/be/slot-ownership.spec.mjs, editions: [lite, full], codes: [HFS_SLOT_UNDECLARED, HFS_SLOT_AMBIGUOUS, HFS_SLOT_NOT_ENABLED]}
-      - {path: packages/eslint/fe/slot-ownership.spec.mjs, editions: [lite, full], codes: [HFS_SLOT_UNDECLARED, HFS_SLOT_AMBIGUOUS, HFS_SLOT_NOT_ENABLED]}
     exemplifiedBy:
       - {path: examples/lite-app/be/src/features/webhooks/calendar/transport/http/calendar.webhook.ts, edition: lite}
       - {path: examples/full-app/be/src/features/webhooks/sepay/transport/http/sepay.webhook.ts, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+      - {path: examples/ecommerce-app/be/src/features/webhooks/sepay/transport/http/sepay.webhook.ts, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-repository-tree-layout.spec.mjs, edition: lite, codes: [HFS_ROOT_ENTRY_FORBIDDEN, HFS_ROOT_MARKDOWN_FORBIDDEN, HFS_ROOT_SRC_FORBIDDEN_FE, HFS_SRC_LAYOUT_INVALID, HFS_MODULE_TIER_INVALID, HFS_WORK_IN_FE, HFS_STACKS_IN_SIDE]}
+      - {path: packages/hfs/src/hfs-repository-tree-layout.spec.mjs, edition: full, codes: [HFS_ROOT_ENTRY_FORBIDDEN, HFS_ROOT_MARKDOWN_FORBIDDEN, HFS_ROOT_SRC_FORBIDDEN_FE, HFS_SRC_LAYOUT_INVALID, HFS_MODULE_TIER_INVALID, HFS_WORK_IN_FE, HFS_STACKS_IN_SIDE]}
+    proves:
+      - {path: packages/eslint/be/slot-ownership.spec.mjs, editions: [lite, full], codes: [HFS_SLOT_UNDECLARED, HFS_SLOT_AMBIGUOUS, HFS_SLOT_NOT_ENABLED]}
+      - {path: packages/eslint/fe/slot-ownership.spec.mjs, editions: [lite, full], codes: [HFS_SLOT_UNDECLARED, HFS_SLOT_AMBIGUOUS, HFS_SLOT_NOT_ENABLED]}
+      - {path: packages/hfs/src/hfs-repository-tree-layout.spec.mjs, editions: [lite, full], codes: [HFS_ROOT_ENTRY_FORBIDDEN, HFS_ROOT_MARKDOWN_FORBIDDEN, HFS_ROOT_SRC_FORBIDDEN_FE, HFS_SRC_LAYOUT_INVALID, HFS_MODULE_TIER_INVALID, HFS_WORK_IN_FE, HFS_STACKS_IN_SIDE]}
+      - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, editions: [lite, full], codes: [HFS_SLOT_UNDECLARED, HFS_SLOT_AMBIGUOUS, HFS_SLOT_NOT_ENABLED, HFS_FORBIDDEN_PRESENT, HFS_TRACKED_MUST_BE_IGNORED]}
   - id: R02
     code: "HFS_SLOT_REQUIRED_MISSING"
     law: "A slot is missing a required file (feature `index.ts`, app `main.ts`, FE `global-error.tsx`), or the root README breaks its standard shape (title, description, standard sections in order, Work pointer, live badges only, no private URL)."
@@ -70,14 +74,11 @@ rules:
       - {kind: machine, id: required-files, at: scripts/hfs/architecture/required-files.mjs}
       - {kind: machine, id: repository-tree-required, at: scripts/hfs/architecture/hfs.mjs}
       - {kind: runtime, id: runtime-required, at: scripts/hfs/runtime-check.mjs}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
   - id: R03
     code: "HFS_UNTRACKED_ROOT_ENTRY"
     editions: [lite, full]
     docs: [docs/legacy-tree-rule-coverage.md#r03]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
     templateNa: "Untracked and empty directories are filesystem states, not scaffolded files."
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "No untracked or ignored entry outside an `ignored` slot."
     kinds: [check, codemod]
     gates: [land, ci, runtime]
@@ -85,36 +86,49 @@ rules:
     enforcers:
       - {kind: hfs, id: untracked-root-entry, at: scripts/hfs/check.mjs}
       - {kind: runtime, id: runtime-untracked, at: scripts/hfs/runtime-check.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-check-tree-slots.spec.mjs, editions: [lite, full], codes: [HFS_UNTRACKED_ROOT_ENTRY, HFS_EMPTY_DIR, HFS_GHOST_TREE]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-check-tree-slots.spec.mjs, editions: [lite, full], codes: [HFS_UNTRACKED_ROOT_ENTRY, HFS_EMPTY_DIR, HFS_GHOST_TREE]}
+    witness:
+      - {path: packages/hfs/src/hfs-check-tree-slots.spec.mjs, editions: [lite, full], codes: [HFS_UNTRACKED_ROOT_ENTRY, HFS_EMPTY_DIR, HFS_GHOST_TREE]}
   - id: R04
     code: "HFS_GITIGNORE_BLOCK_DRIFT"
     editions: [lite, full]
     docs: [docs/legacy-managed-rule-coverage.md#r04]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/gitignore-lite, edition: lite}
-      - {path: packages/hfs/templates/app/gitignore, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The managed `.gitignore` block equals its render."
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_GITIGNORE_BLOCK_DRIFT"]
     enforcers:
       - {kind: hfs, id: gitignore-block-drift, at: packages/hfs/sync/managed.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-gitignore-block-drift.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/gitignore-lite, edition: lite}
+      - {path: packages/hfs/templates/app/gitignore, edition: full}
+      - {path: packages/hfs/src/hfs-gitignore-block-drift.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-gitignore-block-drift.spec.mjs, edition: lite, codes: [HFS_GITIGNORE_BLOCK_DRIFT]}
+      - {path: packages/hfs/src/hfs-gitignore-block-drift.spec.mjs, edition: full, codes: [HFS_GITIGNORE_BLOCK_DRIFT]}
   - id: R05
     code: "HFS_MANAGED_FILE_DRIFT"
     editions: [lite, full]
     docs: [docs/legacy-managed-rule-coverage.md#r05]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/hooks/husky/pre-push, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A managed file equals its template render."
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_MANAGED_FILE_DRIFT"]
     enforcers:
       - {kind: hfs, id: managed-file-drift, at: packages/hfs/sync/managed.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-managed-file-drift.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/hooks/husky/pre-push, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-managed-file-drift.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-managed-file-drift.spec.mjs, edition: lite, codes: [HFS_MANAGED_FILE_DRIFT]}
+      - {path: packages/hfs/src/hfs-managed-file-drift.spec.mjs, edition: full, codes: [HFS_MANAGED_FILE_DRIFT]}
   - id: R06
     code: "HFS_PLAINTEXT_SECRET"
     law: "Secrets exist only as `.starcistacks/<env>/secrets/<slug>.enc`."
@@ -127,9 +141,11 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-managed-rule-coverage.md#r06-plaintext-secrets]
     templateNa: "Encrypted secrets are supplied by the app secret command; plaintext secret files are forbidden and are never scaffolded."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves: [packages/hfs/src/hfs-plaintext-secret.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-plaintext-secret.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-plaintext-secret.spec.mjs, editions: [lite, full], codes: [HFS_PLAINTEXT_SECRET]}
   - id: R07
     code: "HFS_AGENT_DATA_TRACKED"
     law: "`.starciwork` holds product records only."
@@ -138,7 +154,6 @@ rules:
     failureCodes: ["HFS_AGENT_DATA_TRACKED"]
     enforcers:
       - {kind: work-validate, id: agent-data-tracked, at: scripts/work/validate/check-example-work.mjs}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
   - id: R09
     code: "HFS_IDENTITY_CUSTODY"
     law: "An identity points its secret at `secrets/identity-<slug>.enc`; UAT chooses by role."
@@ -148,16 +163,10 @@ rules:
     enforcers:
       - {kind: work-validate, id: sealed-custody-location, at: scripts/work/validate/check-work-artifacts.mjs}
       - {kind: work-validate, id: identity-custody-role, at: scripts/work/validate/check-example-work.mjs}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
   - id: R10
     code: "HFS_STACKS_SHAPE"
     editions: [lite, full]
     docs: [docs/legacy-tree-rule-coverage.md#r10]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
-      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "`.starcistacks` has the edition-aware standard shape and the host Sonar owner; Swarm stacks have digest-pinned images, healthchecks, rollout, rollback and restart policies, versioned external secrets, ingress-only published ports and declared schedulers for replicated jobs. Recurring work is app-owned; host crontab installation is forbidden. Lite declares Supabase as managed backing and runs no duplicate backing-service component."
     kinds: [check, codemod]
     gates: [settle, land, ci]
@@ -168,42 +177,53 @@ rules:
       - {kind: hfs, id: stacks-evidence-runtime, at: scripts/hfs/stacks-gate.mjs}
       - {kind: hfs, id: starcistacks-runtime, at: scripts/hfs/starcistacks-runtime.mjs}
       - {kind: hfs, id: starcistacks-runtime-gate, at: scripts/gates/starcistacks.mjs}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: packages/hfs/src/hfs-stacks-shape.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-stacks-shape.spec.mjs, editions: [lite, full]}
+    proves:
+      - {path: packages/hfs/src/hfs-stacks-shape.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-stacks-runtime-shape.spec.mjs, editions: [lite, full]}
   - id: R11
     code: "HFS_SONAR_CONFIG"
     editions: [lite, full]
     docs: [docs/legacy-managed-rule-coverage.md#r11]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/quality-config/sonar-project.properties, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Sonar config is generated, with no host URL, importing the be lcov with the logic of be/src/modules (the coverage scope derived from the slot manifest) as the only coverage scope."
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_SONAR_CONFIG"]
     enforcers:
       - {kind: hfs, id: sonar-config, at: packages/hfs/sync/managed.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-sonar-config.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/quality-config/sonar-project.properties, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-sonar-config.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-sonar-config.spec.mjs, edition: lite, codes: [HFS_SONAR_CONFIG]}
+      - {path: packages/hfs/src/hfs-sonar-config.spec.mjs, edition: full, codes: [HFS_SONAR_CONFIG]}
   - id: R12
     code: "HFS_E2E_IN_AUTOMATIC_GATE"
     editions: [lite, full]
     docs: [docs/legacy-custody-e2e-coverage.md#r12-automatic-test-execution]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/hooks/husky/pre-push, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "e2e never joins husky, coverage or automatic CI."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["HFS_E2E_IN_AUTOMATIC_GATE"]
     enforcers:
       - {kind: machine, id: e2e-in-automatic-gate, at: scripts/hfs/architecture/hfs.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-e2e-automatic-gate.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/hooks/husky/pre-push, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-e2e-automatic-gate.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-e2e-automatic-gate.spec.mjs, editions: [lite, full]}
   - id: R13
     editions: [lite, full]
     docs: [docs/hfs-legacy-tooling.md#ci-and-hooks]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/ci-workflows-lite, edition: lite}
-      - {path: packages/hfs/templates/app/ci-workflows, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     code: "HFS_CI_MISSING_CANON"
     law: "CI runs the pinned `starci app lint` (`npm run lint`), a clone never redirects `core.hooksPath` away from husky, and the folder a set `core.hooksPath` names holds the installed hooks in every checkout (husky's dispatcher in `.husky/_`), so no commit lands without the pre-commit gate."
     kinds: [check, codemod]
@@ -212,44 +232,62 @@ rules:
     enforcers:
       - {kind: machine, id: hooks-path-not-redirected, at: scripts/hfs/architecture/hfs.mjs}
       - {kind: hfs, id: ci-missing-canon, at: scripts/hfs/rules/pipeline.mjs}
+    proves: [packages/hfs/src/hfs-pipeline-example.spec.mjs, packages/hfs/src/hfs-hooks-path-redirected.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/ci-workflows-lite, edition: lite}
+      - {path: packages/hfs/templates/app/ci-workflows, edition: full}
+      - {path: packages/hfs/src/hfs-pipeline-example.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-hooks-path-redirected.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-pipeline-example.spec.mjs, editions: [lite, full], codes: [HFS_CI_MISSING_CANON]}
+      - {path: packages/hfs/src/hfs-hooks-path-redirected.spec.mjs, editions: [lite, full], codes: [HFS_HOOKS_PATH_REDIRECTED]}
   - id: R14
     code: "HFS_DEP_VERSION_SKEW"
     law: "One version per dependency in the workspace, a root `overrides` pin included, and npm is the only package manager."
     editions: [lite, full]
     docs: [docs/hfs-legacy-tooling.md#dependency-consistency]
     templateNa: "Dependency versions, root overrides and the npm packageManager field are generated programmatically by pinnedSection and packageManifest in packages/hfs/scaffold/app.mjs rather than rendered from a managed dependency template."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_DEP_VERSION_SKEW", "HFS_PACKAGE_MANAGER_MIXED"]
     enforcers:
       - {kind: hfs, id: dep-version-skew, at: scripts/hfs/rules/deps.mjs}
       - {kind: machine, id: package-manager, at: scripts/hfs/architecture/hfs.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-dep-version-skew-coverage.spec.mjs, editions: [lite, full], codes: [HFS_DEP_VERSION_SKEW]}
+      - {path: packages/hfs/src/hfs-package-manager-mixed.spec.mjs, editions: [lite, full], codes: [HFS_PACKAGE_MANAGER_MIXED]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-dep-version-skew-coverage.spec.mjs, editions: [lite, full], codes: [HFS_DEP_VERSION_SKEW]}
+      - {path: packages/hfs/src/hfs-package-manager-mixed.spec.mjs, editions: [lite, full], codes: [HFS_PACKAGE_MANAGER_MIXED]}
+    witness:
+      - {path: packages/hfs/src/hfs-dep-version-skew-coverage.spec.mjs, edition: lite, codes: [HFS_DEP_VERSION_SKEW]}
+      - {path: packages/hfs/src/hfs-package-manager-mixed.spec.mjs, edition: lite, codes: [HFS_PACKAGE_MANAGER_MIXED]}
+      - {path: packages/hfs/src/hfs-dep-version-skew-coverage.spec.mjs, edition: full, codes: [HFS_DEP_VERSION_SKEW]}
+      - {path: packages/hfs/src/hfs-package-manager-mixed.spec.mjs, edition: full, codes: [HFS_PACKAGE_MANAGER_MIXED]}
   - id: R15
     code: "HFS_CANON_PIN_DRIFT"
     law: "Canon packages and frameworks match `canon-pins.yaml`."
     editions: [lite, full]
     docs: [docs/hfs-legacy-tooling.md#canon-package-pins]
     templateNa: "Dependency versions are generated programmatically by pinnedSection and packageManifest in packages/hfs/scaffold/app.mjs rather than rendered from a managed dependency template."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_CANON_PIN_DRIFT"]
     enforcers:
       - {kind: hfs, id: canon-pin-drift, at: scripts/hfs/check.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-canon-pin-drift-checker.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-canon-pin-drift.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-canon-pin-drift-checker.spec.mjs, edition: lite, codes: [HFS_CANON_PIN_DRIFT]}
+      - {path: packages/hfs/src/hfs-canon-pin-drift-checker.spec.mjs, edition: full, codes: [HFS_CANON_PIN_DRIFT]}
+    witness:
+      - {path: packages/hfs/src/hfs-canon-pin-drift-checker.spec.mjs, edition: lite, codes: [HFS_CANON_PIN_DRIFT]}
+      - {path: packages/hfs/src/hfs-canon-pin-drift-checker.spec.mjs, edition: full, codes: [HFS_CANON_PIN_DRIFT]}
   - id: R16
     code: "HFS_TOOL_CONFIG_LOCAL"
     editions: ["lite", "full"]
     docs: ["docs/managed-tooling-coverage.md#local-tool-configuration"]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: "packages/hfs/templates/be/tool-config/eslint.config.mjs", editions: ["lite", "full"]}
-      - {path: "packages/hfs/templates/fe/tool-config/eslint.config.mjs", editions: ["lite", "full"]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Configs only call the factories; no local rules."
     kinds: [check, codemod]
     gates: [land, ci]
@@ -257,22 +295,36 @@ rules:
     enforcers:
       - {kind: hfs, id: tool-config-local, at: packages/hfs/sync/managed.mjs}
       - {kind: hfs, id: tool-config-forbidden, at: scripts/hfs/check.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-tool-config-local.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-tool-config-forbidden.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: "packages/hfs/templates/be/tool-config/eslint.config.mjs", editions: ["lite", "full"]}
+      - {path: "packages/hfs/templates/fe/tool-config/eslint.config.mjs", editions: ["lite", "full"]}
+      - {path: packages/hfs/src/hfs-tool-config-local.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-tool-config-forbidden.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-tool-config-local.spec.mjs, editions: [lite, full], codes: [HFS_TOOL_CONFIG_LOCAL]}
+      - {path: packages/hfs/src/hfs-tool-config-forbidden.spec.mjs, editions: [lite, full], codes: [HFS_TOOL_CONFIG_LOCAL]}
   - id: R17
     code: "HFS_RULE_OFF_WITHOUT_REPLACEMENT"
     editions: ["lite", "full"]
     docs: ["docs/managed-tooling-coverage.md#rendered-lint-configurations"]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: "packages/hfs/templates/be/tool-config/eslint.config.mjs", editions: ["lite", "full"]}
-      - {path: "packages/hfs/templates/fe/tool-config/eslint.config.mjs", editions: ["lite", "full"]}
-      - {path: "packages/hfs/templates/fe/tool-config/stylelint.config.mjs", editions: ["lite", "full"]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The ESLint configuration (and a front end's stylelint configuration) is the rendered one-liner, so no rule is off, warned or redefined in a repository."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["HFS_RULE_OFF_WITHOUT_REPLACEMENT"]
     enforcers:
       - {kind: hfs, id: rule-off-without-replacement, at: packages/hfs/sync/managed.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-rule-off-without-replacement.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: "packages/hfs/templates/be/tool-config/eslint.config.mjs", editions: ["lite", "full"]}
+      - {path: "packages/hfs/templates/fe/tool-config/eslint.config.mjs", editions: ["lite", "full"]}
+      - {path: "packages/hfs/templates/fe/tool-config/stylelint.config.mjs", editions: ["lite", "full"]}
+      - {path: packages/hfs/src/hfs-rule-off-without-replacement.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-rule-off-without-replacement.spec.mjs, editions: [lite, full], codes: [HFS_RULE_OFF_WITHOUT_REPLACEMENT]}
   - id: R18
     code: "HFS_INLINE_SUPPRESSION"
     law: "No inline suppression of any kind."
@@ -287,17 +339,20 @@ rules:
     code: "HFS_FORMAT"
     editions: ["lite", "full"]
     docs: ["docs/managed-tooling-coverage.md#canonical-formatting"]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: "packages/hfs/templates/app/tool-config-lite/prettierrc", edition: "lite"}
-      - {path: "packages/hfs/templates/app/tool-config/prettierrc", edition: "full"}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Prettier is the only formatter."
     kinds: [codemod]
     gates: [land, ci]
     failureCodes: ["HFS_FORMAT"]
     enforcers:
       - {kind: hfs, id: format, at: packages/hfs/sync/format.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-format.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: "packages/hfs/templates/app/tool-config-lite/prettierrc", edition: "lite"}
+      - {path: "packages/hfs/templates/app/tool-config/prettierrc", edition: "full"}
+      - {path: packages/hfs/src/hfs-format.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-format.spec.mjs, editions: [lite, full], codes: [HFS_FORMAT]}
   - id: R20
     code: "HFS_SIZE_GROWTH"
     law: "Over-budget files do not grow; new files are inside budget."
@@ -309,7 +364,6 @@ rules:
       - {kind: eslint-fe, id: file-size-growth}
       - {kind: sonar, id: cognitive-complexity, at: knowledge/sonar-gate.yaml}
       - {kind: runtime, id: runtime-size, at: scripts/hfs/runtime-rules/size.mjs}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
   - id: R21
     code: "HFS_DUPLICATE_CODE"
     law: "No duplicated blocks or twice-defined helpers."
@@ -327,11 +381,6 @@ rules:
     code: "HFS_TS_STRICT"
     editions: ["lite", "full"]
     docs: ["docs/hfs-typescript-strict.md#r22-typescript"]
-    exemplifiedBy:
-      - {path: "packages/hfs/templates/be/tool-config/tsconfig.json", editions: ["lite", "full"]}
-      - {path: "packages/hfs/templates/fe/tool-config/tsconfig.json", editions: ["lite", "full"]}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "tsconfig extends `@starci/tsconfig` and lowers no flag; no assertion, `!` or `any` in product source."
     kinds: [codemod, design, lint]
     gates: [pre-commit, settle, land, ci]
@@ -342,46 +391,58 @@ rules:
       - {kind: eslint-fe, id: no-explicit-any}
       - {kind: hfs, id: ts-strict, at: packages/hfs/sync/ts-strict.mjs}
       - {kind: eslint-fe, id: no-double-cast}
+    proves:
+      - {path: packages/hfs/src/hfs-ts-strict.spec.mjs, editions: [lite, full], codes: [HFS_TS_STRICT]}
+      - {path: packages/eslint/fe/hfs-ts-strict-rule-tester.spec.mjs, editions: [lite, full], codes: [FE_TYPE_ESCAPE]}
+    exemplifiedBy:
+      - {path: "packages/hfs/templates/be/tool-config/tsconfig.json", editions: ["lite", "full"]}
+      - {path: "packages/hfs/templates/fe/tool-config/tsconfig.json", editions: ["lite", "full"]}
+      - {path: packages/hfs/src/hfs-ts-strict.spec.mjs, editions: [lite, full], codes: [HFS_TS_STRICT]}
+      - {path: packages/eslint/fe/hfs-ts-strict-rule-tester.spec.mjs, editions: [lite, full], codes: [FE_TYPE_ESCAPE]}
+    witness:
+      - {path: packages/hfs/src/hfs-ts-strict.spec.mjs, editions: [lite, full], codes: [HFS_TS_STRICT]}
+      - {path: packages/eslint/fe/hfs-ts-strict-rule-tester.spec.mjs, editions: [lite, full], codes: [FE_TYPE_ESCAPE]}
   - id: R23
     code: "HFS_CONTRACT_SNAPSHOT_DRIFT"
     editions: ["lite", "full"]
     docs: ["docs/hfs-contract-snapshots.md#committed-contract-snapshots"]
     templateNa: "Contract snapshots are generated from each app's composed schema and operation table, not from a scaffolded contract artifact."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The be side commits its contract snapshot and it equals the emit; the fe side reads it in place (be/contracts/)."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["HFS_CONTRACT_SNAPSHOT_DRIFT"]
     enforcers:
       - {kind: hfs, id: contract-snapshot-drift, at: scripts/hfs/rules/contract.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-contract-snapshot-drift-direct.spec.mjs, editions: [lite, full], codes: [HFS_CONTRACT_SNAPSHOT_DRIFT]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-contract-snapshot-drift-direct.spec.mjs, editions: [lite, full], codes: [HFS_CONTRACT_SNAPSHOT_DRIFT]}
+    witness:
+      - {path: packages/hfs/src/hfs-contract-snapshot-drift-direct.spec.mjs, edition: lite, codes: [HFS_CONTRACT_SNAPSHOT_DRIFT]}
+      - {path: packages/hfs/src/hfs-contract-snapshot-drift-direct.spec.mjs, edition: full, codes: [HFS_CONTRACT_SNAPSHOT_DRIFT]}
   - id: R24
     code: "HFS_ARCH_CONFIG_UNREAD"
     editions: ["lite", "full"]
     docs: ["docs/hfs-analysis-coverage.md#analysed-production-source"]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: "packages/hfs/templates/be/skeleton-lite/apps/api/src/main.ts", edition: "lite"}
-      - {path: "packages/hfs/templates/be/skeleton/apps/__app__/src/main.ts", edition: "full"}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The machine reads `hfs.json`; zero files analysed is red."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["HFS_ARCH_CONFIG_UNREAD"]
     enforcers:
       - {kind: machine, id: arch-config-unread, at: scripts/hfs/architecture/config-unread.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-arch-config-unread.spec.mjs, editions: [lite, full], codes: [HFS_ARCH_CONFIG_UNREAD]}
+    exemplifiedBy:
+      - {path: "packages/hfs/templates/be/skeleton-lite/apps/api/src/main.ts", edition: "lite"}
+      - {path: "packages/hfs/templates/be/skeleton/apps/__app__/src/main.ts", edition: "full"}
+      - {path: packages/hfs/src/hfs-arch-config-unread.spec.mjs, editions: [lite, full], codes: [HFS_ARCH_CONFIG_UNREAD]}
+    witness:
+      - {path: packages/hfs/src/hfs-arch-config-unread.spec.mjs, edition: lite, codes: [HFS_ARCH_CONFIG_UNREAD]}
+      - {path: packages/hfs/src/hfs-arch-config-unread.spec.mjs, edition: full, codes: [HFS_ARCH_CONFIG_UNREAD]}
   - id: R25
     code: "HFS_UNUSED_EXPORT"
     editions: ["lite", "full"]
     docs: ["docs/hfs-export-liveness.md#export-and-file-liveness"]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: "packages/hfs/templates/be/skeleton-lite/apps/api/src/main.ts", edition: "lite"}
-      - {path: "packages/hfs/templates/be/skeleton/apps/__app__/src/main.ts", edition: "full"}
-      - {path: "packages/hfs/templates/fe/skeleton-lite/apps/web/src/app/[locale]/page.tsx", edition: "lite"}
-      - {path: "packages/hfs/templates/fe/skeleton/apps/app/src/app/[locale]/page.tsx", edition: "full"}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "No public export without a consumer; no source file nothing reaches."
     kinds: [lint, codemod]
     gates: [settle, land, ci]
@@ -389,6 +450,17 @@ rules:
     enforcers:
       - {kind: eslint-be, id: dead-exports}
       - {kind: eslint-fe, id: dead-exports}
+    proves:
+      - {path: packages/eslint/be/hfs-unused-export.spec.mjs, editions: [lite, full], codes: [HFS_UNUSED_EXPORT, HFS_UNUSED_FILE]}
+    exemplifiedBy:
+      - {path: "packages/hfs/templates/be/skeleton-lite/apps/api/src/main.ts", edition: "lite"}
+      - {path: "packages/hfs/templates/be/skeleton/apps/__app__/src/main.ts", edition: "full"}
+      - {path: "packages/hfs/templates/fe/skeleton-lite/apps/web/src/app/[locale]/page.tsx", edition: "lite"}
+      - {path: "packages/hfs/templates/fe/skeleton/apps/app/src/app/[locale]/page.tsx", edition: "full"}
+      - {path: packages/eslint/be/hfs-unused-export.spec.mjs, editions: [lite, full], codes: [HFS_UNUSED_EXPORT, HFS_UNUSED_FILE]}
+    witness:
+      - {path: packages/eslint/be/hfs-unused-export.spec.mjs, edition: lite, codes: [HFS_UNUSED_EXPORT, HFS_UNUSED_FILE]}
+      - {path: packages/eslint/be/hfs-unused-export.spec.mjs, edition: full, codes: [HFS_UNUSED_EXPORT, HFS_UNUSED_FILE]}
   - id: R26
     code: "BE_TIER_DIRECTION"
     editions: [lite, full]
@@ -413,12 +485,6 @@ rules:
     code: "ARCH_OWNER_CYCLE"
     editions: [lite, full]
     docs: [docs/a16-r26-r28.md#r27]
-    proves:
-      - {path: packages/eslint/be/legacy-owner-graph.a16.spec.mjs, editions: [lite, full]}
-    exemplifiedBy:
-      - {path: packages/eslint/be/legacy-owner-graph.a16.spec.mjs, editions: [lite, full]}
-    witness:
-      - {path: packages/eslint/be/legacy-owner-graph.a16.spec.mjs, editions: [lite, full]}
     templateNa: "Owner cycles concern relations between separately generated owners, including the runtime; no cyclic or acyclic graph scaffold is generated."
     law: "No owner cycles, type-only included."
     kinds: [lint, design]
@@ -428,7 +494,12 @@ rules:
       - {kind: eslint-be, id: owner-cycle}
       - {kind: eslint-fe, id: owner-cycle}
       - {kind: runtime, id: runtime-cycles, at: scripts/hfs/runtime-rules/tier-direction.mjs}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+    proves:
+      - {path: packages/eslint/be/legacy-owner-graph.a16.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/eslint/be/legacy-owner-graph.a16.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/eslint/be/legacy-owner-graph.a16.spec.mjs, editions: [lite, full]}
   - id: R28
     code: "BE_FEATURE_IMPORTS_FEATURE"
     editions: [lite, full]
@@ -451,10 +522,6 @@ rules:
     law: "Feature root is `index.ts`, module, `application/`, `transport/<protocol>/`; `application/` never imports `transport/` or a protocol framework."
     editions: [lite, full]
     docs: [docs/a16-r29-r31.md#r29-feature-shape]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/patterns/api/feature.module.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check, codemod, design, lint]
     gates: [settle, land, ci]
     failureCodes: ["BE_FEATURE_SHAPE", "BE_FEATURE_LAYOUT_INVALID", "BE_APPLICATION_IMPORTS_TRANSPORT", "BE_APPLICATION_TRANSPORT_FRAMEWORK"]
@@ -462,6 +529,14 @@ rules:
       - {kind: machine, id: feature-shape, at: scripts/hfs/architecture/feature-shape.mjs}
       - {kind: eslint-be, id: feature-layout}
       - {kind: eslint-be, id: application-never-imports-transport}
+    proves:
+      - {path: packages/eslint/be/a16-r29-r31.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/patterns/api/feature.module.ts.tpl, editions: [lite, full]}
+      - {path: packages/eslint/be/a16-r29-r31.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/eslint/be/a16-r29-r31.spec.mjs, edition: lite}
+      - {path: packages/eslint/be/a16-r29-r31.spec.mjs, edition: full}
   - id: R30
     code: "BE_PUBLIC_SURFACE"
     law: "Every owner has one `index.ts`; cross-owner imports use it, same-owner imports are relative and never go through it; it holds only named `export { }` lines, no `export *`, no alias re-export (`export { X as Y }`, `export const Y = X`, `export type Y = X`, `export interface Y extends X {}`: one declaration has one name), within the owner slot's `indexExports` budget (60 for domain and feature owners, 80 for `be.integrations` provider entries); cross-package imports use the package name and a declared export."
@@ -841,11 +916,6 @@ rules:
     code: "BE_TEST_TOPOLOGY"
     editions: [lite, full]
     docs: [docs/quality-bar.md#r47-test-topology]
-    proves:
-      - {path: packages/eslint/be/r47-topology-coverage.spec.mjs, editions: [lite, full], codes: ["BE_TEST_TOPOLOGY"]}
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/inbox/service.spec.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "One jest config, projects `unit`, `integration`, `e2e` and `contract`, live by folder, `diagnostics: false`; unit specs are `<name>.<role>.spec.ts` beside the file they test: required for the roles of `ruleParams.be.unitRoles` (`<name>.service.spec.ts` beside a `<name>.service.ts`, `<name>.cli.spec.ts` beside a cli command `<name>.cli.ts` of `src/features/cli`), optional for any other logic role (`ruleParams.be.logicRoles`) inside a slot whose `coverage` is required, except that the commit adding a measured logic file stages its `<name>.<role>.spec.ts` beside it (owner 2026-10-20, judged by `starci app hygiene` in the pre-commit hook), and nowhere else but beside a webhook or realtime door that has no service of its own (`<provider>.webhook.spec.ts`, `<channel>.gateway.spec.ts`, `<x>.subscription.spec.ts`) (every unit-tested subject has exactly one; any other `*.spec.ts` outside `be/src/tests/{world,integration,e2e,contract}` is a finding, including specs in apps), and the unit project collects coverage from the logic roles of the measured roots only (the scope derived from the slot manifest, R204) with a per-file threshold of 100 on lines, branches, functions and statements (`test` runs `--coverage`; `importHelpers` and `tslib`); `be/src/tests/world/` is the ONLY test infrastructure: `global-setup.ts` starts the app's own stack (`.starcistacks/<env>`, named by `stack` in `test-world.config.ts`, the declaration of the test-world library in its one named form `export const { useTestWorld, useSandbox } = defineTestWorld({...})` (a default export is not read): every service it declares runs REAL, behind toxiproxy, images and versions read from the stack at run time, never spelled in test source) or attaches to a warm one that answers, and runs the migrations once over the cli app's connections (the runner of the cli migrate command); `global-teardown.ts` stops only what its setup started; `use-test-world.ts` exports `useTestWorld({ apps } | { modules })` (`world.apps.<name>.api`, `world.db.<connection>`, `world.infra.<service>` with `latency(ms)`, `cut()` and `restore()` on the real service, `world.fake.<provider>`, `world.waitFor`) and `fakes/<provider>/` holds the network-edge fakes (`failNext`, `replayWebhook`, `delay`, payload fixtures) of external SaaS the team does not operate ONLY: a fake of a service the stack declares is refused, except stateless compute that needs special hardware or an external model (GPU inference, a self-hosted embedding model), whose `stacks` entry in `test-world.config.ts` declares `{ fakedBy: <fake>, reason }` with a non-empty `reason` (a stateful service, or one with a persistent volume, is never accepted); it alone owns containers, DataSource, migrations and `process.env`; nothing under `be/src/tests` overrides a provider or DI token; `be/src/tests/integration/<capability>/*.integration-spec.ts` (`{ modules }`, with the real peer apps its client calls beside them as `apps`; real infrastructure, no HTTP door of ours), `be/src/tests/e2e/<area>/*.e2e-spec.ts` (`{ apps }`) and `be/src/tests/contract/<provider>/*.contract-spec.ts` (provider sandboxes, skipped without sandbox config, run only by `test:contract`, never by `test` or `test:e2e`) agree folder with suffix; an integration or e2e spec passes `useTestWorld` one object literal with plain keys (no variable, spread or computed key) and calls it; the contract layer has no skip either: a contract spec writes `sandbox.describe(...)` from the test-world library's `useSandbox(...)`, and when the sandbox config is absent that describe registers one failing test naming the missing keys (the body never runs), and every `fakes/<provider>/` that serves payload fixtures (`payloads/*.json`) has a `contract/<provider>/*.contract-spec.ts` that references those fixtures and asserts `shapeOf(real)` equals `shapeOf(fixture)` (the helper `shapeOf` is named by `ruleParams.be.contractShape` of the slot manifest; fakes the test-world library provides are guarded by the library); no `.test.ts`, `int-spec` or `harness-spec`, no `live/` and no `be/src/tests/e2e/world`."
     kinds: [check, codemod, lint]
     gates: [land, ci]
@@ -860,7 +930,15 @@ rules:
       - {kind: eslint-be, id: tests-infra-only-in-world}
       - {kind: eslint-be, id: tests-no-override}
       - {kind: eslint-be, id: test-world-shape}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/inbox/service.spec.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/r47-test-topology-coverage.spec.mjs, editions: [lite, full], codes: [BE_TEST_TOPOLOGY, BE_CONTRACT_UNGUARDED]}
+    witness:
+      - {path: packages/hfs/src/r47-test-topology-coverage.spec.mjs, edition: lite, codes: [BE_TEST_TOPOLOGY, BE_CONTRACT_UNGUARDED]}
+      - {path: packages/hfs/src/r47-test-topology-coverage.spec.mjs, edition: full, codes: [BE_TEST_TOPOLOGY, BE_CONTRACT_UNGUARDED]}
+    proves:
+      - {path: packages/eslint/be/r47-topology-coverage.spec.mjs, editions: [lite, full], codes: ["BE_TEST_TOPOLOGY"]}
+      - {path: packages/hfs/src/r47-test-topology-coverage.spec.mjs, editions: [lite, full], codes: [BE_TEST_TOPOLOGY, BE_CONTRACT_UNGUARDED, BE_UNIT_SPEC_NOT_STAGED]}
   - id: R48
     code: "BE_SPEC_QUALITY"
     editions: [lite, full]
@@ -978,10 +1056,6 @@ rules:
     code: "FE_WIRE_GENERATED"
     editions: [lite, full]
     docs: [docs/code-pattern-enforcement.md#r52]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/fe/table/graphql/query.types.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Wire types are generated by graphql-codegen from `be/contracts/<app>/schema.graphql`, read in place and never copied, into `modules/api/graphql/__generated__`; an operation's request and response types re-export the generated ones and are never typed by hand."
     kinds: [lint, check, design]
     gates: [settle, land, ci]
@@ -989,15 +1063,18 @@ rules:
     enforcers:
       - {kind: eslint-fe, id: no-hand-typed-wire}
       - {kind: hfs, id: wire-generated, at: scripts/hfs/rules/frontend-tree.mjs}
+    proves:
+      - {path: packages/eslint/fe/r52-wire-generated.spec.mjs, editions: [lite, full], codes: [FE_WIRE_GENERATED]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/fe/table/graphql/query.types.ts.tpl, editions: [lite, full]}
+      - {path: packages/eslint/fe/r52-wire-generated.spec.mjs, editions: [lite, full], codes: [FE_WIRE_GENERATED]}
+    witness:
+      - {path: packages/eslint/fe/r52-wire-generated.spec.mjs, edition: lite, codes: [FE_WIRE_GENERATED]}
+      - {path: packages/eslint/fe/r52-wire-generated.spec.mjs, edition: full, codes: [FE_WIRE_GENERATED]}
   - id: R53
     code: "FE_ERROR_BOUNDARY_MISSING"
     editions: [lite, full]
     docs: [docs/code-pattern-enforcement.md#r53]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/app/global-error.tsx, edition: lite}
-      - {path: packages/hfs/templates/fe/skeleton/apps/app/src/app/global-error.tsx, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Global, locale error, not-found and loading boundaries exist."
     kinds: [check, codemod, lint]
     gates: [settle, land, ci]
@@ -1005,6 +1082,15 @@ rules:
     enforcers:
       - {kind: eslint-fe, id: no-null-suspense-fallback}
       - {kind: machine, id: error-boundary-missing, at: scripts/hfs/architecture/required-files.mjs}
+    proves:
+      - {path: packages/eslint/fe/r53-error-boundaries.spec.mjs, editions: [lite, full], codes: [FE_ERROR_BOUNDARY_MISSING, FE_SUSPENSE_NULL_FALLBACK]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/app/global-error.tsx, edition: lite}
+      - {path: packages/hfs/templates/fe/skeleton/apps/app/src/app/global-error.tsx, edition: full}
+      - {path: packages/eslint/fe/r53-error-boundaries.spec.mjs, editions: [lite, full], codes: [FE_ERROR_BOUNDARY_MISSING, FE_SUSPENSE_NULL_FALLBACK]}
+    witness:
+      - {path: packages/eslint/fe/r53-error-boundaries.spec.mjs, edition: lite, codes: [FE_ERROR_BOUNDARY_MISSING, FE_SUSPENSE_NULL_FALLBACK]}
+      - {path: packages/eslint/fe/r53-error-boundaries.spec.mjs, edition: full, codes: [FE_ERROR_BOUNDARY_MISSING, FE_SUSPENSE_NULL_FALLBACK]}
   - id: R54
     code: "FE_ROUTE_FILES_THIN"
     law: "Route files mount one owner; Next conventions (`proxy.ts`, metadata)."
@@ -1122,14 +1208,6 @@ rules:
     code: "FE_I18N_PLACEMENT"
     editions: [lite, full]
     docs: [docs/architecture.md#r59]
-    proves:
-      - {path: packages/eslint/fe/i18n-placement-coverage.spec.mjs, editions: [lite, full]}
-    exemplifiedBy:
-      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/modules/i18n, edition: lite}
-      - {path: packages/hfs/templates/fe/skeleton/packages/__project__-i18n/src, edition: full}
-      - {path: packages/eslint/fe/i18n-placement-coverage.spec.mjs, editions: [lite, full]}
-    witness:
-      - {path: packages/eslint/fe/i18n-placement-coverage.spec.mjs, editions: [lite, full]}
     law: "`next-intl` with `[locale]`; the next-intl stack is written once per front end: `fe/packages/<family>-i18n` (`createAppI18n`) called by each app's `modules/i18n/index.ts`, or the only app's `modules/i18n/`."
     kinds: [check, codemod, lint]
     gates: [settle, land, ci]
@@ -1142,24 +1220,35 @@ rules:
       - {kind: eslint-fe, id: no-native-anchor}
       - {kind: eslint-fe, id: use-intl-formatter}
       - {kind: hfs, id: i18n-placement, at: scripts/hfs/rules/frontend-tree.mjs}
-
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+    proves:
+      - {path: packages/eslint/fe/i18n-placement-coverage.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-i18n-placement-coverage.spec.mjs, editions: [lite, full], codes: [FE_I18N_PLACEMENT]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/modules/i18n, edition: lite}
+      - {path: packages/hfs/templates/fe/skeleton/packages/__project__-i18n/src, edition: full}
+      - {path: packages/eslint/fe/i18n-placement-coverage.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-i18n-placement-coverage.spec.mjs, editions: [lite, full], codes: [FE_I18N_PLACEMENT]}
+    witness:
+      - {path: packages/eslint/fe/i18n-placement-coverage.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-i18n-placement-coverage.spec.mjs, editions: [lite, full], codes: [FE_I18N_PLACEMENT]}
   - id: R60
     code: "FE_I18N_CATALOG"
     editions: [lite, full]
     docs: [docs/architecture.md#r60]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/modules/i18n/messages, edition: lite}
-      - {path: packages/hfs/templates/fe/skeleton/apps/app/src/modules/i18n/messages, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Same keys in every catalog, `pick` for clients."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["FE_I18N_CATALOG"]
     enforcers:
       - {kind: hfs, id: i18n-catalog, at: scripts/hfs/rules/frontend-tree.mjs}
-
+    proves:
+      - {path: packages/hfs/src/hfs-i18n-catalog-coverage.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/modules/i18n/messages, edition: lite}
+      - {path: packages/hfs/templates/fe/skeleton/apps/app/src/modules/i18n/messages, edition: full}
+      - {path: packages/hfs/src/hfs-i18n-catalog-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-i18n-catalog-coverage.spec.mjs, editions: [lite, full]}
   - id: R61
     code: "FE_STYLE_TOKEN_ONLY"
     law: "Token-only CSS; colour only in `brand.css`; every `@source` resolves (sub-check `FE_STYLE_SOURCE_UNRESOLVED`). Status colours follow HeroUI soft pairs: every status tone has `--<tone>-soft` and `--<tone>-soft-foreground` in light and dark, the soft foreground reaches 3:1 on its tint and on `--background`, body text 4.5:1, a solid tone is never text below 4.5:1, and text and icons take the soft foreground, never the solid tone."
@@ -1215,15 +1304,19 @@ rules:
     editions: [lite, full]
     docs: [docs/architecture.md#r63]
     templateNa: "Shared package manifests are authored by the app; the frontend scaffold creates app workspaces rather than shared package owners."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Packages build to `dist` with explicit exports and no dead unit."
     kinds: [check, design]
     gates: [land, ci]
     failureCodes: ["FE_PACKAGE_SHAPE"]
     enforcers:
       - {kind: machine, id: package-shape, at: scripts/hfs/architecture/package-shape.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/architecture-package-shape-coverage.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/architecture-package-shape-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/architecture-package-shape-coverage.spec.mjs, edition: lite, codes: [FE_PACKAGE_SHAPE]}
+      - {path: packages/hfs/src/architecture-package-shape-coverage.spec.mjs, edition: full, codes: [FE_PACKAGE_SHAPE]}
   - id: R64
     code: "FE_APP_ISOLATION"
     law: "Apps never import apps; ui-screen declares `app`."
@@ -1685,10 +1778,16 @@ rules:
       - {kind: eslint-be, id: public-contract-form}
     editions: ["lite","full"]
     docs: ["docs/be-shape-coverage.md#r89"]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy: [{"path":"packages/hfs/templates/be/patterns/api/graphql.input.ts.tpl","editions":["lite","full"]}]
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     gates: ["pre-commit","settle","land","ci"]
+    proves:
+      - {path: packages/eslint/be/be-r89-source-form-coverage.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/be-r89-source-suffix.spec.mjs, editions: [lite, full], codes: [BE_SOURCE_FORM]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/patterns/api/graphql.input.ts.tpl, editions: [lite, full]}
+      - {path: packages/eslint/be/be-r89-source-form-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/eslint/be/be-r89-source-form-coverage.spec.mjs, edition: lite, codes: [BE_SOURCE_FORM, BE_PUBLIC_CONTRACT_FORM]}
+      - {path: packages/eslint/be/be-r89-source-form-coverage.spec.mjs, edition: full, codes: [BE_SOURCE_FORM, BE_PUBLIC_CONTRACT_FORM]}
   - id: R90
     code: "BE_INFRA_OWNER"
     law: "Each raw infrastructure library (HTTP, cache, queue, scheduler, logger, date, config, events) is imported or referenced only by its one owning platform or integration capability, and the `HttpClient` port of `platform/http` is called only by an `integrations` capability."
@@ -1790,14 +1889,16 @@ rules:
       - {kind: machine, id: grammar, at: scripts/hfs/architecture/frontend-grammar.mjs}
     editions: [lite, full]
     docs: ["docs/code-pattern-enforcement.md#r93-vendor-and-grammar-ownership"]
+    templateNa: "Vendor boundary violations and installed Grammar package contracts are checked against consumer ownership; no managed template scaffolds a vendor install or a forbidden import."
     proves:
       - packages/eslint/fe/r93-vendor-coverage.spec.mjs
-    templateNa: "Vendor boundary violations and installed Grammar package contracts are checked against consumer ownership; no managed template scaffolds a vendor install or a forbidden import."
+      - packages/eslint/fe/r93-grammar-ownership.spec.mjs
     exemplifiedBy:
       - {path: packages/eslint/fe/r93-vendor-coverage.spec.mjs, editions: [lite, full]}
+      - {path: packages/eslint/fe/r93-grammar-ownership.spec.mjs, editions: [lite, full]}
     witness:
       - {path: packages/eslint/fe/r93-vendor-coverage.spec.mjs, editions: [lite, full], codes: [FE_VENDOR_BOUNDARY]}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+      - {path: packages/eslint/fe/r93-grammar-ownership.spec.mjs, editions: [lite, full], codes: [ARCH_GRAMMAR_CONTRACT_INVALID, ARCH_GRAMMAR_EXPORT_BYPASS]}
   - id: R94
     code: "FE_SLOT_FILE_ROLE"
     law: "A front-end file is owned by a slot and named by it: a slot that owns a directory (route, feature, components, hooks, api module) holds only the files its `allows` list names, and holds them inside a folder of its own."
@@ -1808,9 +1909,13 @@ rules:
       - {kind: machine, id: fe-slot-allows, at: scripts/hfs/architecture/fe-slot-allows.mjs}
     editions: ["lite","full"]
     docs: ["docs/hfs-authored-file-boundaries.md#r94-slot-file-roles"]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy: [{"path":"packages/hfs/templates/fe/skeleton-lite/apps/web/src/app/[locale]/page.tsx","edition":"lite"},{"path":"packages/hfs/templates/fe/skeleton/apps/app/src/app/[locale]/page.tsx","edition":"full"}]
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+    proves: [packages/hfs/src/r94-r96-r97-coverage.spec.mjs]
+    exemplifiedBy:
+      - {path: "packages/hfs/templates/fe/skeleton-lite/apps/web/src/app/[locale]/page.tsx", edition: lite}
+      - {path: "packages/hfs/templates/fe/skeleton/apps/app/src/app/[locale]/page.tsx", edition: full}
+      - {path: packages/hfs/src/r94-r96-r97-coverage.spec.mjs, editions: [lite, full], codes: [FE_SLOT_FILE_ROLE]}
+    witness:
+      - {path: packages/hfs/src/r94-r96-r97-coverage.spec.mjs, editions: [lite, full], codes: [FE_SLOT_FILE_ROLE]}
   - id: R95
     code: "BE_OPERATION_CONTRACT"
     law: "A versioned operation is declared once in the app's typed operation table (`OperationContract<Input, Output, RefusalCode>` registered by `defineOperations`): its input and output are closed types (never `any`, `unknown` or `Record<string, unknown>`), its refusal codes a closed union of string literals, and the route that serves the table takes `OperationRequest<Table>` and answers `Promise<OperationReply<Table>>` of that one table."
@@ -1837,9 +1942,11 @@ rules:
     editions: ["lite","full"]
     docs: ["docs/hfs-authored-file-boundaries.md#r96-document-language"]
     templateNa: "Language validation judges authored document content rather than a scaffolded file role; edition-specific spec fixtures exercise English documents and localized data."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves: [packages/hfs/src/r94-r96-r97-coverage.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/src/r94-r96-r97-coverage.spec.mjs, editions: [lite, full], codes: [HFS_DOC_NOT_ENGLISH]}
+    witness:
+      - {path: packages/hfs/src/r94-r96-r97-coverage.spec.mjs, editions: [lite, full], codes: [HFS_DOC_NOT_ENGLISH]}
   - id: R97
     code: "FE_NO_TESTS"
     law: "The front end (`fe/`) has no tests by standard: no `*.spec.*`, `*.test.*` or `*-spec.*` file, no `e2e/`, `__tests__/`, `__mocks__/` or `test-support/` directory, no vitest, Playwright, jest or Cypress configuration or setup file, no test script, and no test-runner, test-environment, testing-library or axe dependency in any `package.json`; there is no exception, `scripts/` included."
@@ -1850,10 +1957,12 @@ rules:
     editions: ["lite","full"]
     docs: ["docs/hfs-authored-file-boundaries.md#r97-front-end-test-exclusion"]
     templateNa: "Front-end test files and test tooling are forbidden and are therefore not scaffolded; spec fixtures show permitted production files and manifests without test tooling."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     gates: ["settle","land","ci"]
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves: [packages/hfs/src/r94-r96-r97-coverage.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/src/r94-r96-r97-coverage.spec.mjs, editions: [lite, full], codes: [FE_NO_TESTS]}
+    witness:
+      - {path: packages/hfs/src/r94-r96-r97-coverage.spec.mjs, editions: [lite, full], codes: [FE_NO_TESTS]}
   - id: R98
     code: "BE_TEST_BUILDER_HOME"
     law: "A test data builder lives only in `be/src/tests/fixtures/builders/<area>.builder.ts` (slot `be.tests.fixtures.builders`, its SQL text in `<area>.sql.ts` beside it): a `*.repository.ts`, `*.factory.ts` or `*.fixture.ts` under `be/src/tests` and a `*.builder.ts` elsewhere are BE_SOURCE_FORM findings, and any other module of the test tree that exports a function creating persisted rows through an EntityManager, DataSource or QueryRunner is a builder in the wrong place."
@@ -1923,28 +2032,29 @@ rules:
     code: "BE_SPEC_PLACEMENT"
     editions: [lite, full]
     docs: [docs/legacy-repo-rule-coverage.md#r102]
+    law: "A back-end spec or test file lives in one of the four test layers and nowhere else: a unit spec of a unit-tested role (`ruleParams.be.unitRoles`: `<name>.service.spec.ts` beside its service, `<name>.cli.spec.ts` beside its cli command), or an integration, e2e or contract spec under `be/src/tests/{integration,e2e,contract}`; a `*.spec.*`, `*.test.*` or `*-spec.*` file anywhere else, `scripts/` and `tools/` included, is a finding."
+    kinds: [check, lint]
+    gates: [land, ci]
+    failureCodes: ["BE_SPEC_PLACEMENT"]
+    enforcers:
+      - {kind: hfs, id: spec-placement, at: scripts/hfs/rules/spec-placement.mjs}
+      - {kind: eslint-be, id: spec-placement}
     proves:
       - {path: packages/eslint/be/spec-placement-coverage.spec.mjs, editions: [lite, full], codes: [BE_SPEC_PLACEMENT]}
+      - {path: packages/hfs/src/hfs-spec-placement-coverage.spec.mjs, editions: [lite, full], codes: [BE_SPEC_PLACEMENT]}
     exemplifiedBy:
       - {path: packages/hfs/templates/be/patterns/cli/group.cli.spec.ts.tpl, editions: [lite, full]}
       - {path: packages/eslint/be/spec-placement-coverage.spec.mjs, editions: [lite, full], codes: [BE_SPEC_PLACEMENT]}
+      - {path: packages/hfs/src/hfs-spec-placement-coverage.spec.mjs, editions: [lite, full], codes: [BE_SPEC_PLACEMENT]}
     witness:
       - {path: packages/eslint/be/spec-placement-coverage.spec.mjs, edition: lite, codes: [BE_SPEC_PLACEMENT]}
       - {path: packages/eslint/be/spec-placement-coverage.spec.mjs, edition: full, codes: [BE_SPEC_PLACEMENT]}
-    law: "A back-end spec or test file lives in one of the four test layers and nowhere else: a unit spec of a unit-tested role (`ruleParams.be.unitRoles`: `<name>.service.spec.ts` beside its service, `<name>.cli.spec.ts` beside its cli command), or an integration, e2e or contract spec under `be/src/tests/{integration,e2e,contract}`; a `*.spec.*`, `*.test.*` or `*-spec.*` file anywhere else, `scripts/` and `tools/` included, is a finding."
-    kinds: [check, lint]
-    gates: [land, ci]
-    failureCodes: ["BE_SPEC_PLACEMENT"]
-    enforcers:
-      - {kind: hfs, id: spec-placement, at: scripts/hfs/rules/spec-placement.mjs}
-      - {kind: eslint-be, id: spec-placement}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+      - {path: packages/hfs/src/hfs-spec-placement-coverage.spec.mjs, edition: lite, codes: [BE_SPEC_PLACEMENT]}
+      - {path: packages/hfs/src/hfs-spec-placement-coverage.spec.mjs, edition: full, codes: [BE_SPEC_PLACEMENT]}
   - id: R103
     code: "HFS_REPO_LOCAL_CHECK"
     editions: [lite, full]
     docs: [docs/legacy-repo-rule-coverage.md#r103]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     templateNa: "Repository-local checks and lint plugins are forbidden artifacts and have no managed scaffold."
     law: "A repository keeps no check, lint rule or lint plugin of its own: no `check-*` file in `scripts/` or `tools/`, no `eslint-local-rules*` or local eslint plugin, no script that runs one; every check lives in the `.claude` runtime and the canons."
     kinds: [check]
@@ -1952,13 +2062,17 @@ rules:
     failureCodes: ["HFS_REPO_LOCAL_CHECK"]
     enforcers:
       - {kind: hfs, id: repo-local-check, at: scripts/hfs/rules/repo-local-checks.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-repository-hygiene-coverage.spec.mjs, editions: [lite, full], codes: [HFS_REPO_LOCAL_CHECK]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-repository-hygiene-coverage.spec.mjs, editions: [lite, full], codes: [HFS_REPO_LOCAL_CHECK]}
+    witness:
+      - {path: packages/hfs/src/hfs-repository-hygiene-coverage.spec.mjs, edition: lite, codes: [HFS_REPO_LOCAL_CHECK]}
+      - {path: packages/hfs/src/hfs-repository-hygiene-coverage.spec.mjs, edition: full, codes: [HFS_REPO_LOCAL_CHECK]}
   - id: R104
     code: "HFS_LINT_SUPPRESSION_FILE"
     editions: [lite, full]
     docs: [docs/legacy-repo-rule-coverage.md#r104]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     templateNa: "Lint-suppression files and options are prohibited, so no suppression artifact is scaffolded."
     law: "A repository keeps no lint-suppression file, script or option: no `eslint.suppressions*`, no `lint:suppressions` script, no eslint `--suppress-all` or `--suppressions-location` flag and no suppressions configuration passed to eslint; a finding is fixed in the code."
     kinds: [check]
@@ -1966,21 +2080,31 @@ rules:
     failureCodes: ["HFS_LINT_SUPPRESSION_FILE"]
     enforcers:
       - {kind: hfs, id: lint-suppression, at: scripts/hfs/rules/lint-suppression.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-repository-hygiene-coverage.spec.mjs, editions: [lite, full], codes: [HFS_LINT_SUPPRESSION_FILE]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-repository-hygiene-coverage.spec.mjs, editions: [lite, full], codes: [HFS_LINT_SUPPRESSION_FILE]}
+    witness:
+      - {path: packages/hfs/src/hfs-repository-hygiene-coverage.spec.mjs, edition: lite, codes: [HFS_LINT_SUPPRESSION_FILE]}
+      - {path: packages/hfs/src/hfs-repository-hygiene-coverage.spec.mjs, edition: full, codes: [HFS_LINT_SUPPRESSION_FILE]}
   - id: R105
     code: "HFS_PROOF_COMMAND_FILE_MISSING"
     editions: [lite, full]
     docs: [docs/legacy-repo-rule-coverage.md#r105]
     templateNa: "Proof plans name project-specific files in authored Work records; managed app scaffolds do not supply those commands or their target scripts."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A proof command of a `.starciwork` record (`requiresProof.<kind>.command`) is runnable as written: every repository file it names exists."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["HFS_PROOF_COMMAND_FILE_MISSING"]
     enforcers:
       - {kind: hfs, id: proof-command-files, at: scripts/hfs/rules/proof-commands.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-proof-command-file-missing.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-proof-command-file-missing.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-proof-command-file-missing.spec.mjs, edition: lite, codes: [HFS_PROOF_COMMAND_FILE_MISSING]}
+      - {path: packages/hfs/src/hfs-proof-command-file-missing.spec.mjs, edition: full, codes: [HFS_PROOF_COMMAND_FILE_MISSING]}
   - id: R106
     code: "FE_I18N_KEYS"
     law: "The catalogs of a front-end app and its source agree both ways: a literal key read through `next-intl` (`useTranslations`, `getTranslations`, `t`, `t.rich`, `t.raw`, `t.markup`) exists in every locale, and a catalog key that no string of the app's or the shared packages' source can be reading is deleted."
@@ -2079,8 +2203,6 @@ rules:
     code: "HFS_PEER_INTEGRATION_MISSING"
     editions: [lite, full]
     docs: [docs/legacy-contract-rule-coverage.md#r111]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     templateNa: "Optional integration dependency pairs and their runtime peers are application-specific package.json dependencies, not a managed scaffold surface."
     law: "An app declares the runtime peer every driver integration it uses needs: when the app root package.json depends on every package of a pair of knowledge/hfs/peer-integrations.yaml (at the named major), it declares the pair's `requires` in its dependencies (`@nestjs/apollo` on `@nestjs/platform-express` 11, Express 5, needs `@as-integrations/express5`)."
     kinds: [check]
@@ -2088,14 +2210,17 @@ rules:
     failureCodes: ["HFS_PEER_INTEGRATION_MISSING"]
     enforcers:
       - {kind: hfs, id: peer-integrations, at: scripts/hfs/rules/peer-integrations.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-peer-integrations-coverage.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-peer-integrations-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-peer-integrations-coverage.spec.mjs, editions: [lite, full], codes: [HFS_PEER_INTEGRATION_MISSING]}
   - id: R112
     code: "BE_INTEGRATION_SPEC_MISSING"
     editionWhy: "ruling:R212/case-3 keeps lite outside the full test world; ruling:lite-production-swarm amends hosting and ruling:lite-contract-specs permits contract specs while preserving that e2e boundary. R284 owns lite's integration proof lane; this rule judges provider module, error-code and outage proofs through the full world."
     docs: [docs/quality-bar.md#r112]
     templateNa: "Provider-specific module registration, refusal mapping and outage scenarios must be authored for each integration; the app scaffold has no provider-specific integration proof to generate."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every integration of a back end (`src/modules/integrations/<provider>/` holding `<provider>.config.ts`) has at least one `src/tests/integration/<provider>/*.integration-spec.ts` that, read as a syntax tree, calls `useTestWorld({ modules })` with a factory registering the integration's own module (`<Provider>Module.register`, imported from the integration folder; an inline array, a local const or an exported const of another file), references the ErrorCode enum the integration exports, and drives an outage through the world (`world.infra.<service>.cut|latency|during|connection`, `world.fake.<name>.failNext`, `world.apps.<peer>.during`, `world.interruptDatabase`); the finding sits on the integration folder."
     kinds: [check]
     gates: [land, ci]
@@ -2103,21 +2228,29 @@ rules:
     editions: [full]
     enforcers:
       - {kind: hfs, id: integration-specs, at: scripts/hfs/rules/integration-specs.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-repo-scripts-rules.spec.mjs, editions: [full], codes: [BE_INTEGRATION_SPEC_MISSING]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-repo-scripts-rules.spec.mjs, editions: [full], codes: [BE_INTEGRATION_SPEC_MISSING]}
+    witness:
+      - {path: packages/hfs/src/hfs-repo-scripts-rules.spec.mjs, editions: [full], codes: [BE_INTEGRATION_SPEC_MISSING]}
   - id: R113
     code: "FE_GRAPHQL_CONTRACT"
     editions: [lite, full]
     docs: [docs/legacy-contract-rule-coverage.md#r113]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/fe/table/graphql/query.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every GraphQL operation a front end keeps in a `.graphql` file under `fe/` is one its back end serves: it is judged against the contract snapshot (`be/contracts/<service>/schema.graphql`) whose root type declares its first root field, and every selected field, argument and input field must be declared there, every required argument and required input field given, every variable passed with the argument's named type, every leaf selected without and every object with a selection, and every declared variable used; a root field no contract declares is a finding too."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["FE_GRAPHQL_CONTRACT"]
     enforcers:
       - {kind: hfs, id: fe-contract-documents, at: scripts/hfs/rules/fe-contract-documents.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-fe-contract-documents-coverage.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/fe/table/graphql/query.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-fe-contract-documents-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-fe-contract-documents-coverage.spec.mjs, editions: [lite, full], codes: [FE_GRAPHQL_CONTRACT]}
   - id: R114
     code: "RT_EXTERNAL_OWNER"
     law: "In the runtime repository a process, the network, SQLite or an external binary is reached only by its owner in ruleParams.runtime.infraOwners of knowledge/hfs/runtime-slots.yaml: an owned module specifier, global or spawned program word is used only by the files of scripts/api/<system> or engine/db that the map names."
@@ -2130,9 +2263,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-shape.md#external-owner]
     templateNa: "Runtime repository source ownership and layout are not scaffolded by managed application templates."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R115
     code: "RT_TIER_DIRECTION"
     law: "Every relative import between two runtime owners goes from a tier to a tier its mayImport lists in tiers.runtime of knowledge/hfs/runtime-slots.yaml; owner cycles are ARCH_OWNER_CYCLE."
@@ -2145,9 +2275,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-shape.md#tier-direction]
     templateNa: "Runtime repository source ownership and layout are not scaffolded by managed application templates."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R116
     code: "RT_BASE_IMPURE"
     law: "The runtime base tier (the engine foundation and scripts/lib) never writes the filesystem and reads process.env only in a declared seam of ruleParams.runtime.baseEnvSeams."
@@ -2160,9 +2287,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-shape.md#base-purity]
     templateNa: "Runtime repository source ownership and layout are not scaffolded by managed application templates."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R117
     code: "RT_API_SHAPE"
     law: "A call file of scripts/api/<system>/ exports exactly one function named in camelCase after the file; only the files of its own system import its lib.mjs; no api system imports another; a system with a calls contract has a call file only for a call id the contract declares."
@@ -2175,9 +2299,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-shape.md#api-shape]
     templateNa: "Runtime repository source ownership and layout are not scaffolded by managed application templates."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R118
     code: "RT_SPEC_PLACEMENT"
     law: "No runtime tests in .claude (owner ruling no-runtime-specs, 2026-10-17): a spec or test file is allowed only beside its package source as <name>.spec.* (never .test.), under examples/, or as a declared file of the scaffold e2e (slot runtime.e2e); any other tracked spec, tests/** included, is refused."
@@ -2190,9 +2311,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-shape.md#spec-placement]
     templateNa: "Runtime repository source ownership and layout are not scaffolded by managed application templates."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R119
     code: "RT_SOURCE_NAME"
     law: "A runtime source file is named <kebab-name>.mjs, never a one-off of ruleParams.runtime.oneOffNames (_*, tmp-*, fix-*, *-backfill, migrate-*, *-old, *.bak*), and its basename is unique inside its tier except lib.mjs and index.mjs."
@@ -2205,15 +2323,10 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-shape.md#source-name]
     templateNa: "Runtime repository source ownership and layout are not scaffolded by managed application templates."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R121
     editions: [lite, full]
     docs: [docs/legacy-runtime-state.md#generated-runtime-output]
     templateNa: "Generated runtime copies and the tracked runtime repository are not application scaffold surfaces."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     code: "RT_GENERATED_DRIFT"
     law: "A generated root of ruleParams.runtime.generated is git-ignored output of its declared generatedBy: the repo's check regenerates every root, the runtime copies (packages/hfs/runtime, packages/eslint/be/runtime, packages/eslint/fe/runtime) are judged equal to what scripts/hfs/sync-runtime.mjs writes from the single source, and no git-tracked path lies under a generated root."
     scope: runtime
@@ -2223,7 +2336,6 @@ rules:
     enforcers:
       - {kind: runtime, id: generated-drift, at: scripts/hfs/sync-runtime.mjs}
       - {kind: runtime, id: generated-untracked, at: scripts/hfs/runtime-rules/generated-untracked.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R122
     code: "RT_CITED_PATH_MISSING"
     law: "A runtime path cited by live prose or contracts (modules, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; history (a changelog, a benchmark file) is not read."
@@ -2236,9 +2348,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-state.md#cited-runtime-paths]
     templateNa: "Runtime repository integrity is authored in the runtime manifest and source tree; application scaffolds do not contain this surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R124
     code: "RT_PINNED_PATH_MOVED"
     law: "A pinned path of ruleParams.runtime.pinned (persisted outside git) exists."
@@ -2251,9 +2360,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-state.md#pinned-runtime-paths]
     templateNa: "Runtime repository integrity is authored in the runtime manifest and source tree; application scaffolds do not contain this surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R125
     code: "RT_NODE_MODULES_LINK"
     law: "No runtime source creates a junction or a symlink for a node_modules folder, through node:fs (symlink, symlinkSync, directly or through a local wrapper) or a spawned link command (mklink /J or /D, New-Item -ItemType Junction or SymbolicLink, ln -s): every checkout installs its own dependencies with a real npm ci from the cache."
@@ -2266,9 +2372,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-state.md#dependency-directories]
     templateNa: "Runtime repository integrity is authored in the runtime manifest and source tree; application scaffolds do not contain this surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R126
     code: "RT_CONTROL_CHARACTER"
     law: "Tracked text source of the runtime (*.mjs, *.cjs, *.js, *.ts, *.tsx, *.yaml, *.yml, *.md, *.json outside the generated copies) holds no raw control character (U+0000 to U+001F except tab, LF and CR, and U+007F); the character is written as its escape."
@@ -2281,9 +2384,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-paths.md#r126]
     templateNa: "Runtime tracked-source hygiene is checked in the runtime repository; application scaffolds do not generate this surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R127
     code: "RT_ABSOLUTE_PATH"
     law: "No tracked file of the runtime holds a hard-coded absolute host path: a drive-letter path, a user-profile path (/Users/<name>/, /home/<name>/) or an expanded AppData path. Paths resolve from the runtime root, os.tmpdir(), the config or a state-root helper, and a spec builds every path and prompt fixture from its temp dir; %LOCALAPPDATA% as an unexpanded name is clean. In source the rule reads string and template literals and comments through the syntax tree (a URL and a generic drive-pattern regular expression are not paths); in yaml, json and md it reads line text."
@@ -2296,9 +2396,6 @@ rules:
     editions: [lite, full]
     docs: [docs/legacy-runtime-paths.md#r127]
     templateNa: "Runtime tracked-source hygiene is checked in the runtime repository; application scaffolds do not generate this surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R141
     code: "BE_COOKIE_ATTRIBUTES"
     law: "A cookie a back-end door writes through the response of Express or Fastify (`cookie`, `setCookie`) states `httpOnly: true`, `secure: true` and `sameSite` `lax` or `strict` in options typed with those literals, and `Set-Cookie` is never written as a header (`setHeader`, `append`, `header`); the call is recognised by where its signature is declared, never by the receiver's name."
@@ -2319,8 +2416,7 @@ rules:
       - {path: packages/eslint/be/cookies-coverage.spec.mjs, edition: full, codes: ["BE_COOKIE_ATTRIBUTES"]}
   - id: R142
     code: "BE_AMBIENT_ID"
-    law: "`randomUUID` of Node's crypto (named, namespace or global), the `v1`, `v4`, `v6` and `v7` generators of `uuid`, `nanoid` and `ulid` are used only inside `platform/ids`, specs included, with one exception: the test world (slot `be.tests.world`), the composition root of tests that names real resources; code asks the injected `Ids` port (`ids.next()`) and specs use `fakeIds()`."
-    amendedBy: [owner:ambient-id-test-world-exemption]
+    law: "`randomUUID` of Node's crypto (named, namespace or global), the `v1`, `v4`, `v6` and `v7` generators of `uuid`, `nanoid` and `ulid` are used only inside `platform/ids`, specs and the test world included; code asks the injected `Ids` port (`ids.next()`) and specs use `fakeIds()`."
     kinds: [lint, codemod]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["BE_AMBIENT_ID"]
@@ -2328,7 +2424,7 @@ rules:
       - {kind: eslint-be, id: no-ambient-id}
     editions: [lite, full]
     docs: [docs/quality-bar.md#r142]
-    templateNa: "Ambient identifier sources are a negative lint constraint; the spec exercises owned, test-world and injected identifiers rather than a scaffolded surface."
+    templateNa: "Ambient identifier sources are a negative lint constraint; the spec exercises owned and injected identifiers rather than a scaffolded surface."
     proves: [packages/eslint/be/ambient-id.spec.mjs]
     exemplifiedBy:
       - {path: packages/eslint/be/ambient-id.spec.mjs, editions: [lite, full], codes: [BE_AMBIENT_ID]}
@@ -2345,10 +2441,14 @@ rules:
       - {kind: hfs, id: monorepo, at: scripts/hfs/rules/monorepo.mjs}
     editions: [lite, full]
     docs: [docs/legacy-monorepo-rules.md#r143-root-workspace-manifest]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    proves:
+      - {path: packages/hfs/src/legacy-monorepo-coverage.spec.mjs, editions: [lite, full], codes: [HFS_MONO_WORKSPACES]}
     exemplifiedBy:
       - {path: packages/hfs/templates/app/task-graph/turbo.json, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+      - {path: packages/hfs/src/legacy-monorepo-coverage.spec.mjs, editions: [lite, full], codes: [HFS_MONO_WORKSPACES]}
+    witness:
+      - {path: packages/hfs/src/legacy-monorepo-coverage.spec.mjs, edition: lite, codes: [HFS_MONO_WORKSPACES]}
+      - {path: packages/hfs/src/legacy-monorepo-coverage.spec.mjs, edition: full, codes: [HFS_MONO_WORKSPACES]}
   - id: R144
     code: "HFS_MONO_FE_WORKSPACE"
     law: "Every fe app `fe/apps/<app>` is an npm workspace: its `package.json` is named `@<project>/<app>`, is private, declares its own runtime dependencies and has exactly the scripts `build: next build`, `dev: next dev`, `lint: starci app lint --workspace .`, `start: next start` and `typecheck: tsc --noEmit`; every fe package `fe/packages/<pkg>` is private with `build`, `typecheck` and the same workspace `lint` script."
@@ -2359,52 +2459,68 @@ rules:
       - {kind: hfs, id: monorepo, at: scripts/hfs/rules/monorepo.mjs}
     editions: [lite, full]
     docs: [docs/legacy-monorepo-rules.md#r144-front-end-workspace-manifests]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    proves:
+      - {path: packages/hfs/src/legacy-monorepo-coverage.spec.mjs, editions: [lite, full], codes: [HFS_MONO_FE_WORKSPACE]}
     exemplifiedBy:
       - {path: packages/hfs/templates/fe/app/package.json.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+      - {path: packages/hfs/src/legacy-monorepo-coverage.spec.mjs, editions: [lite, full], codes: [HFS_MONO_FE_WORKSPACE]}
+    witness:
+      - {path: packages/hfs/src/legacy-monorepo-coverage.spec.mjs, edition: lite, codes: [HFS_MONO_FE_WORKSPACE]}
+      - {path: packages/hfs/src/legacy-monorepo-coverage.spec.mjs, edition: full, codes: [HFS_MONO_FE_WORKSPACE]}
   - id: R145
     code: "HFS_MONO_NEST_PROJECTS"
     editions: [lite, full]
     docs: [docs/legacy-monorepo-rules.md#r145-nest-monorepo-projects]
     templateNa: "be/nest-cli.json is generated programmatically by nestCli(app) in packages/hfs/scaffold/app.mjs, rather than from a managed template file."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The back end is a Nest monorepo of `be/apps/<app>`, even with one service: `be/nest-cli.json` is `\"monorepo\": true`, its default project (`root`, `sourceRoot`) is an api app, and its `projects` are exactly the be apps hfs.json declares, each `{\"type\": \"application\", \"root\": \"apps/<app>\", \"sourceRoot\": \"apps/<app>/src\"}`."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_MONO_NEST_PROJECTS"]
     enforcers:
       - {kind: hfs, id: monorepo, at: scripts/hfs/rules/monorepo.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-mono-nest-projects-coverage.spec.mjs, editions: [lite, full], codes: [HFS_MONO_NEST_PROJECTS]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-mono-nest-projects-coverage.spec.mjs, editions: [lite, full], codes: [HFS_MONO_NEST_PROJECTS]}
+    witness:
+      - {path: packages/hfs/src/hfs-mono-nest-projects-coverage.spec.mjs, edition: lite, codes: [HFS_MONO_NEST_PROJECTS]}
+      - {path: packages/hfs/src/hfs-mono-nest-projects-coverage.spec.mjs, edition: full, codes: [HFS_MONO_NEST_PROJECTS]}
   - id: R146
     code: "HFS_MONO_WORKSPACE_DEP"
     editions: [lite, full]
     docs: [docs/architecture.md#workspace-dependency-declarations]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
     templateNa: "Sibling workspace dependencies depend on the product's imports; no scaffold can declare that product-specific dependency graph."
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "An fe workspace declares every package its files import (read with TypeScript's import pre-processor, its tsconfig path aliases excluded) in its own `package.json`, a sibling workspace package at `\"*\"`; the app root `package.json` never declares a workspace package."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_MONO_WORKSPACE_DEP"]
     enforcers:
       - {kind: hfs, id: monorepo, at: scripts/hfs/rules/monorepo.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/r146-workspace-version-coverage.spec.mjs, editions: [lite, full], codes: [HFS_MONO_WORKSPACE_DEP]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/r146-workspace-version-coverage.spec.mjs, editions: [lite, full], codes: [HFS_MONO_WORKSPACE_DEP]}
+    witness:
+      - {path: packages/hfs/src/r146-workspace-version-coverage.spec.mjs, edition: lite, codes: [HFS_MONO_WORKSPACE_DEP]}
+      - {path: packages/hfs/src/r146-workspace-version-coverage.spec.mjs, edition: full, codes: [HFS_MONO_WORKSPACE_DEP]}
   - id: R147
     code: "BE_CLI_REQUIRED"
     editions: [lite, full]
     docs: [docs/backend-cli.md#back-end-cli-rules]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every one-off action of a back end lives in ONE app, `be/apps/cli` (kind cli, named cli): a back end that declares a connection (its migrations run as `cli migrate run`) or tracks a command under `src/features/cli/` declares exactly that app, and tracks its image `be/apps/cli/Dockerfile` (one image, run as `cli <group> <command>`)."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["BE_CLI_REQUIRED"]
     enforcers:
       - {kind: hfs, id: cli, at: scripts/hfs/rules/cli.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-cli-coverage.spec.mjs, editions: [lite, full], codes: [BE_CLI_REQUIRED]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-cli-coverage.spec.mjs, editions: [lite, full], codes: [BE_CLI_REQUIRED]}
+    witness:
+      - {path: packages/hfs/src/hfs-cli-coverage.spec.mjs, edition: lite, codes: [BE_CLI_REQUIRED]}
+      - {path: packages/hfs/src/hfs-cli-coverage.spec.mjs, edition: full, codes: [BE_CLI_REQUIRED]}
   - id: R148
     code: "BE_CLI_BOOTSTRAP"
     editions: [lite, full]
@@ -2466,21 +2582,25 @@ rules:
     code: "BE_EVENT_CLASS_CONTRACT"
     editions: [lite, full]
     docs: [docs/code-pattern-enforcement.md#backend-event-bus-rules]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/inbox/delivery-recorded.event.ts.tpl, editions: [lite, full]}
-      - {path: packages/hfs/templates/be/inbox/events.json.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every typed event class `be/src/modules/events/<service>/<event>.event.ts` (one class with literal `static readonly eventName` and `version`, in a file named after its event: dots become dashes) equals an entry of the vendored contract `be/contracts/<service>/events.json` at the same name and version, and every entry of a vendored contract has its class; a class the contract does not list, a version mismatch, a contract entry with no class or a misnamed file is a finding (pattern event-bus)."
     kinds: [check, codemod]
     gates: [settle, land, ci]
     failureCodes: ["BE_EVENT_CLASS_CONTRACT"]
     enforcers:
       - {kind: hfs, id: event-class-contract, at: scripts/hfs/rules/event-bus.mjs}
-  - id: R152
-    code: "BE_OUTBOX_WRITE_TX"
-    editions: [lite, full]
-    docs: [docs/code-pattern-enforcement.md#backend-event-bus-rules]
+    proves:
+      - {path: packages/hfs/src/hfs-event-class-coverage.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/inbox/delivery-recorded.event.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/templates/be/inbox/events.json.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-event-class-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-event-class-coverage.spec.mjs, edition: lite, codes: [BE_EVENT_CLASS_CONTRACT]}
+      - {path: packages/hfs/src/hfs-event-class-coverage.spec.mjs, edition: full, codes: [BE_EVENT_CLASS_CONTRACT]}
+  - id: R152
+    code: "BE_OUTBOX_WRITE_TX"
+    editions: [lite, full]
+    docs: [docs/code-pattern-enforcement.md#backend-event-bus-rules]
     proves:
       - {path: packages/eslint/be/event-bus-coverage.spec.mjs, editions: [lite, full], codes: [BE_OUTBOX_WRITE_TX]}
     exemplifiedBy:
@@ -2543,16 +2663,20 @@ rules:
     editionWhy: "each enforcer judges the edition it emits for (pattern-spec-missing returns no findings for lite, lite-proof-lane is lite's emitter), so the split adds lite's emitter and drops no finding; ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4) gives lite its integration proof lane while full retains e2e or integration proofs."
     docs: [docs/quality-bar.md#r155]
     templateNa: "Pattern scenarios depend on application behavior and providers; no universal runnable scenario proof is scaffolded."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-pattern-spec-missing.spec.mjs, editions: [full], codes: [BE_PATTERN_SPEC_MISSING]}
+      - {path: packages/hfs/src/hfs-lite-proof-lane.spec.mjs, editions: [lite], codes: [BE_PATTERN_SPEC_MISSING]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-pattern-spec-missing.spec.mjs, editions: [full], codes: [BE_PATTERN_SPEC_MISSING]}
+      - {path: packages/hfs/src/hfs-lite-proof-lane.spec.mjs, editions: [lite], codes: [BE_PATTERN_SPEC_MISSING]}
+    witness:
+      - {path: packages/hfs/src/hfs-pattern-spec-missing.spec.mjs, edition: full, codes: [BE_PATTERN_SPEC_MISSING]}
+      - {path: packages/hfs/src/hfs-lite-proof-lane.spec.mjs, edition: lite, codes: [BE_PATTERN_SPEC_MISSING]}
   - id: R156
     code: "BE_KIND_ISOLATION"
     editions: [lite, full]
     docs: [docs/code-pattern-enforcement.md#r156-kind-isolation]
     templateNa: "Cross-kind imports are a negative architecture constraint; the spec supplies actual owner graphs in both editions."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "No trigger kind imports another: a feature whose owner slot names one `trigger` (api, webhooks, realtime, saga, reactors, jobs, cli) never imports (static, dynamic, re-export or type-only) a feature of another kind; each kind imports only `modules/*` and only be/apps/* compose features. The kinds meet through the event bus: a domain service publishes `eventBus.publish(event, tx)` and the other kind consumes it. The importing and imported owners are read from the slot view (slot field `trigger`), never from a folder name; the finding replaces BE_FEATURE_IMPORTS_FEATURE when both features name different kinds."
     kinds: [lint, design]
     gates: [settle, land, ci]
@@ -2560,7 +2684,11 @@ rules:
     enforcers:
       - {kind: eslint-be, id: kind-isolation}
       - {kind: machine, id: tiers, at: scripts/hfs/architecture/tiers.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves: [packages/eslint/be/architecture-kind-isolation-coverage.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/eslint/be/architecture-kind-isolation-coverage.spec.mjs, editions: [lite, full], codes: [BE_KIND_ISOLATION]}
+    witness:
+      - {path: packages/eslint/be/architecture-kind-isolation-coverage.spec.mjs, editions: [lite, full], codes: [BE_KIND_ISOLATION]}
   - id: R157
     code: "BE_JOB_WRITE_OUTSIDE_OWNER"
     editions: [lite, full]
@@ -2676,68 +2804,81 @@ rules:
     code: "HFS_SERVICE_PLACEMENT"
     editions: [lite, full]
     docs: [docs/microservices.md#r163]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/skeleton-lite/apps/api/Dockerfile, edition: lite}
-      - {path: packages/hfs/templates/be/image/api/Dockerfile, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A back-end service lives only at `be/apps/<service>/`: a folder with a `Dockerfile` of its own, or with a `package.json` other than the app root's and those of the fe workspaces (`fe/apps/<app>`, `fe/packages/<pkg>`), outside `be/apps/<service>/` (and outside a front end's `fe/apps/<app>/Dockerfile`) is a second service root and a finding; a service is a Nest app of the one repository that shares the `be/src` libraries and the one package.json, and its image is built from its own Dockerfile."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["HFS_SERVICE_PLACEMENT"]
     enforcers:
       - {kind: hfs, id: services-placement, at: scripts/hfs/rules/services.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/skeleton-lite/apps/api/Dockerfile, edition: lite}
+      - {path: packages/hfs/templates/be/image/api/Dockerfile, edition: full}
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, edition: lite, codes: [HFS_SERVICE_PLACEMENT]}
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, edition: full, codes: [HFS_SERVICE_PLACEMENT]}
   - id: R164
     code: "HFS_IMAGE_UNPINNED"
     editions: [lite, full]
     docs: [docs/microservices.md#r164]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
-      - {path: packages/hfs/templates/app/upgrade-full/.starcistacks/application-stacks.yaml, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "In a product with more than one service (two or more be apps of kind api or worker) every component `image` of `.starcistacks/application-stacks.yaml` is pinned: a digest (`@sha256:<64 hex>`) or an exact version tag (`x.y.z`, optionally with a suffix); no tag, `latest`, a branch word or a major or minor-only tag is a finding. An own service image is `<repo>/<service>:<x.y.z>`, built from `be/apps/<service>/Dockerfile`; a service the product does not own stays a pinned third-party image."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["HFS_IMAGE_UNPINNED"]
     enforcers:
       - {kind: hfs, id: services-image-pins, at: scripts/hfs/rules/services.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: packages/hfs/templates/app/upgrade-full/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, edition: lite, codes: [HFS_IMAGE_UNPINNED]}
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, edition: full, codes: [HFS_IMAGE_UNPINNED]}
   - id: R165
     code: "HFS_SERVICE_STACK_DECLARATION"
     editions: [lite, full]
     docs: [docs/microservices.md#r165]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
-      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every api or worker app `be/apps/<service>` of a product with more than one service is a `role: service` component in `.starcistacks/application-stacks.yaml`: the component of the same name, or one whose `environments.<env>.deploy.images.<component>.app` names the app."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["HFS_SERVICE_STACK_DECLARATION"]
     enforcers:
       - {kind: hfs, id: services-stack-declaration, at: scripts/hfs/rules/services.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, edition: lite, codes: [HFS_SERVICE_STACK_DECLARATION]}
+      - {path: packages/hfs/src/hfs-services-legacy-coverage.spec.mjs, edition: full, codes: [HFS_SERVICE_STACK_DECLARATION]}
   - id: R166
     code: "HFS_EVENT_CONTRACT"
     editions: [lite, full]
     docs: [docs/microservices.md#r166]
     templateNa: "Provider EVENTS and consumer CONSUMES tables are product-specific contracts; the app scaffold has no literal service event table to generate."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The async contract between services is vendored under `be/contracts/<service>/events.json` (`starci/event-contract@1`, emitted by `starci app emit` from the literal `EVENTS` table of `be/apps/<service>/src/events.ts`, never written by hand) and equals that table; an event that undoes the step of another declares `compensates: \"<event>\"` and the named event must exist in a contract; a consumer declares what it reads in the literal `CONSUMES` table of `be/apps/<app>/src/consumes.ts` (service, event, version), every entry must exist in the provider's vendored snapshot at the same version, and a missing or stale snapshot, an unknown event or a version mismatch is a finding."
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_EVENT_CONTRACT"]
     enforcers:
       - {kind: hfs, id: services-event-contract, at: scripts/hfs/rules/services.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-event-table-contract.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-event-table-contract.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-event-table-contract.spec.mjs, editions: [lite, full], codes: [HFS_EVENT_CONTRACT]}
   - id: R167
     code: "BE_ASYNC_SPEC_MISSING"
     editionWhy: "ruling:lite-contract-specs preserves the full-only e2e boundary. R284 owns lite's integration proof lane; this rule requires consumed-event scenarios through the full test world."
     docs: [docs/microservices.md#r167]
     templateNa: "Consumed-event and compensation scenarios depend on the product's event contracts and effects; the app scaffold has no product-specific asynchronous e2e scenario to generate."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every event an app consumes (an entry of its `consumes.ts`) is named by an e2e spec, a file `be/src/tests/e2e/<area>/*.e2e-spec.ts` that boots the apps through `useTestWorld` (it publishes the event, reads the effect back and redelivers it); when the contract of the event declares `compensates: \"<event>\"` it is a saga step, and a spec naming it also names the compensated event, so the spec drives the whole flow: the step, the failure, then the compensated state."
     kinds: [check]
     gates: [land, ci]
@@ -2745,7 +2886,12 @@ rules:
     editions: [full]
     enforcers:
       - {kind: hfs, id: services-async-specs, at: scripts/hfs/rules/services.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-microservice-rules.spec.mjs, edition: full}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-microservice-rules.spec.mjs, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-microservice-rules.spec.mjs, edition: full}
   - id: R168
     code: "BE_SERVICE_ISOLATION"
     editions: [lite, full]
@@ -2768,69 +2914,82 @@ rules:
     code: "BE_SAGA_STEP_COMPENSATION"
     editions: [lite, full]
     docs: [docs/microservices.md#r169]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/patterns/saga/saga.service.ts.tpl, editions: [lite, full]}
-      - {path: packages/hfs/templates/be/patterns/saga/saga.step.ts.tpl, editions: [lite, full]}
-      - {path: packages/hfs/templates/be/patterns/saga/saga.compensation.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "In a product that declares the `saga` pattern (`patterns: [\"saga\"]` in hfs.json sides.be) a saga is the folder `be/src/features/saga/<saga>/` (`<saga>.saga.ts` the orchestrator, `steps/<step>.step.ts`, `compensations/<step>.compensation.ts`): every step has a compensation of the same name and every compensation a step, the orchestrator imports every step and every compensation of its folder, and a folder of steps or compensations has an orchestrator; the folders themselves are slots enabled only by the declared pattern, so an undeclared saga is `HFS_SLOT_NOT_ENABLED`."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["BE_SAGA_STEP_COMPENSATION"]
     enforcers:
       - {kind: hfs, id: saga-step-compensation, at: scripts/hfs/rules/saga.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, editions: [lite, full], codes: [BE_SAGA_STEP_COMPENSATION]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/patterns/saga/saga.service.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/templates/be/patterns/saga/saga.step.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/templates/be/patterns/saga/saga.compensation.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, editions: [lite, full], codes: [BE_SAGA_STEP_COMPENSATION]}
+    witness:
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, edition: lite, codes: [BE_SAGA_STEP_COMPENSATION]}
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, edition: full, codes: [BE_SAGA_STEP_COMPENSATION]}
   - id: R170
     code: "BE_SAGA_STATE_VERSIONED"
     editions: [lite, full]
     docs: [docs/microservices.md#r170]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/patterns/saga/saga.service.ts.tpl, editions: [lite, full]}
-      - {path: packages/hfs/templates/be/patterns/saga/saga.state.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every saga orchestrator has `<saga>.saga-state.ts` beside it, whose exported state type declares `status` and `version: number`, and imports the fenced store of `platform/saga`: the persisted state of a run moves only through the store, every transition naming the version it read, so a zombie delivery cannot move a run twice."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["BE_SAGA_STATE_VERSIONED"]
     enforcers:
       - {kind: hfs, id: saga-state-versioned, at: scripts/hfs/rules/saga.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, editions: [lite, full], codes: [BE_SAGA_STATE_VERSIONED]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/patterns/saga/saga.service.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/templates/be/patterns/saga/saga.state.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, editions: [lite, full], codes: [BE_SAGA_STATE_VERSIONED]}
+    witness:
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, edition: lite, codes: [BE_SAGA_STATE_VERSIONED]}
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, edition: full, codes: [BE_SAGA_STATE_VERSIONED]}
   - id: R171
     code: "BE_SAGA_EVENT_CONTRACT"
     editions: [lite, full]
     docs: [docs/microservices.md#r171]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/patterns/saga/saga.step.ts.tpl, editions: [lite, full]}
-      - {path: packages/hfs/templates/be/patterns/saga/saga.compensation.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A saga step and a saga compensation each name their event (`readonly event = \"<name>\"`), both events are declared in a vendored contract (`be/contracts/<service>/events.json`), and the contract of the compensation's event declares `compensates: \"<event of the step of the same name>\"`."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["BE_SAGA_EVENT_CONTRACT"]
     enforcers:
       - {kind: hfs, id: saga-event-contract, at: scripts/hfs/rules/saga.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, editions: [lite, full], codes: [BE_SAGA_EVENT_CONTRACT]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/patterns/saga/saga.step.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/templates/be/patterns/saga/saga.compensation.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, editions: [lite, full], codes: [BE_SAGA_EVENT_CONTRACT]}
+    witness:
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, edition: lite, codes: [BE_SAGA_EVENT_CONTRACT]}
+      - {path: packages/hfs/src/hfs-saga-coverage.spec.mjs, edition: full, codes: [BE_SAGA_EVENT_CONTRACT]}
   - id: R172
     code: "BE_SAGA_CONSUMER_DEDUPE"
     editions: [lite, full]
     docs: [docs/microservices.md#r172]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/patterns/saga/saga.done.consumer.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A consumer of a saga (`be/src/features/saga/<saga>/transport/message/<event>.consumer.ts`) passes the id of the delivery on (`message.eventId`) to the command it dispatches: the saga takes every event through the inbox (R80), so the consumer must hand it the dedupe key."
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["BE_SAGA_CONSUMER_DEDUPE"]
     enforcers:
       - {kind: hfs, id: saga-consumer-dedupe, at: scripts/hfs/rules/saga.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-saga-consumer-dedupe.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/patterns/saga/saga.done.consumer.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-saga-consumer-dedupe.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-saga-consumer-dedupe.spec.mjs, editions: [lite, full], codes: [BE_SAGA_CONSUMER_DEDUPE]}
   - id: R173
     code: "BE_SAGA_E2E_MISSING"
     editionWhy: "ruling:lite-contract-specs preserves the full-only e2e boundary. R284 owns lite's integration proof lane; this rule requires compensation fault scenarios through the full test world."
     docs: [docs/microservices.md#r173]
     templateNa: "Compensation events and injected-fault scenarios depend on the product's saga; the app scaffold has no product-specific compensation e2e scenario to generate."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every compensation path of a saga has an e2e spec (`be/src/tests/e2e/<area>/*.e2e-spec.ts` through `useTestWorld`) that names the event of the compensation and injects a failure through the world (an outage of an infra service or an app with `during`, `cut` or `latency`, a fake's `failNext`, `interruptDatabase`): the compensation is proven under a fault, not only on the happy flow."
     kinds: [check]
     gates: [land, ci]
@@ -2838,7 +2997,12 @@ rules:
     editions: [full]
     enforcers:
       - {kind: hfs, id: saga-e2e, at: scripts/hfs/rules/saga.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-saga-rules.spec.mjs, edition: full}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-saga-rules.spec.mjs, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-saga-rules.spec.mjs, edition: full}
   - id: R174
     code: "BE_CONTEXT_OWNER"
     editions: [lite, full]
@@ -2899,8 +3063,6 @@ rules:
     code: "BE_CONTRACT_BREAKING"
     editions: [lite, full]
     docs: [docs/microservices.md#r177]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     templateNa: "Published event-contract pins are service-owned release snapshots, not scaffolded files."
     law: "An event contract evolves only additively: `be/contracts/<service>/events.json` against its pinned previous copy `events.pin.json` keeps every event, stream, version, payload field and type, adds only optional fields, and a breaking change is a new `<event>.v2` key."
     kinds: [check]
@@ -2908,7 +3070,13 @@ rules:
     failureCodes: ["BE_CONTRACT_BREAKING"]
     enforcers:
       - {kind: hfs, id: contract-compat, at: scripts/hfs/rules/contract-compat.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-contract-compat-coverage.spec.mjs, editions: [lite, full], codes: [BE_CONTRACT_BREAKING]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-contract-compat-coverage.spec.mjs, editions: [lite, full], codes: [BE_CONTRACT_BREAKING]}
+    witness:
+      - {path: packages/hfs/src/hfs-contract-compat-coverage.spec.mjs, edition: lite, codes: [BE_CONTRACT_BREAKING]}
+      - {path: packages/hfs/src/hfs-contract-compat-coverage.spec.mjs, edition: full, codes: [BE_CONTRACT_BREAKING]}
   - id: R178
     code: "BE_CONTEXT_PLATFORM_TABLES"
     editions: [lite, full]
@@ -2931,30 +3099,38 @@ rules:
     code: "BE_KIND_DECLARATION"
     editions: [lite, full]
     docs: [docs/microservices.md#r179]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/patterns/jobs/job.processor.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "`hfs.json` `sides.be.kinds` lists exactly the trigger kinds (api, webhooks, realtime, saga, reactors, jobs, cli) the back end uses: a kind in use that is not declared, a declared kind with no feature, a declared kind whose patterns (`ruleParams.be.kindPatterns`, e.g. jobs needs fenced-job and queue) are missing from `sides.be.patterns`, and a declared kind whose platform capabilities (the tier-platform slots naming those patterns) are not tracked are each a finding. A kind is declared only when it is used; `starci app add <noun> <name>` creates the first member, the platform capabilities it needs and the registration."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["BE_KIND_DECLARATION"]
     enforcers:
       - {kind: hfs, id: kind-declaration, at: scripts/hfs/rules/kinds.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-kind-coverage.spec.mjs, editions: [lite, full], codes: [BE_KIND_DECLARATION]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/patterns/jobs/job.processor.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-kind-coverage.spec.mjs, editions: [lite, full], codes: [BE_KIND_DECLARATION]}
+    witness:
+      - {path: packages/hfs/src/hfs-kind-coverage.spec.mjs, edition: lite, codes: [BE_KIND_DECLARATION]}
+      - {path: packages/hfs/src/hfs-kind-coverage.spec.mjs, edition: full, codes: [BE_KIND_DECLARATION]}
   - id: R180
     code: "BE_KIND_EMPTY"
     editions: [lite, full]
     docs: [docs/microservices.md#r180]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/patterns/jobs/job.processor.ts.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A kind folder `be/src/features/<kind>/` holds only instance folders `<kind>/<name>/`, and each instance holds TypeScript source: a file directly in the kind folder (a feature named like a kind, a `.gitkeep`) and an instance with no TypeScript file are findings; an empty kind folder is never kept."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["BE_KIND_EMPTY"]
     enforcers:
       - {kind: hfs, id: kind-empty, at: scripts/hfs/rules/kinds.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-kind-coverage.spec.mjs, editions: [lite, full], codes: [BE_KIND_EMPTY]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/patterns/jobs/job.processor.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-kind-coverage.spec.mjs, editions: [lite, full], codes: [BE_KIND_EMPTY]}
+    witness:
+      - {path: packages/hfs/src/hfs-kind-coverage.spec.mjs, edition: lite, codes: [BE_KIND_EMPTY]}
+      - {path: packages/hfs/src/hfs-kind-coverage.spec.mjs, edition: full, codes: [BE_KIND_EMPTY]}
   - id: R181
     code: "BE_SQL_RETURNING_SHAPE"
     editions: [lite, full]
@@ -3067,77 +3243,92 @@ rules:
     code: "HFS_DOCKER_BUILD_CONTEXT"
     editions: [lite, full]
     docs: [docs/application-stacks.md#r187]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
-      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every app image is built from the app root: the header comment of an app's Dockerfile states `starci docker build <app>` for its own path, and no COPY or ADD source leaves the build context (a `..` segment or an absolute path)."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DOCKER_BUILD_CONTEXT"]
     enforcers:
       - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+    proves: [packages/hfs/src/docker-legacy-coverage.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: lite, codes: [HFS_DOCKER_BUILD_CONTEXT]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: full, codes: [HFS_DOCKER_BUILD_CONTEXT]}
   - id: R188
     code: "HFS_DOCKER_STAGES"
     editions: [lite, full]
     docs: [docs/application-stacks.md#r188]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
-      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "An app Dockerfile is multi-stage: a stage named `build` and a last stage named `runtime`; the runtime stage ends as `USER node` and runs no build (`npm run build*`, tsc, next, turbo, nest); every install is `npm ci`, never `npm install`; a back-end runtime runs `npm ci --omit=dev --ignore-scripts` and a front-end runtime installs nothing."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DOCKER_STAGES"]
     enforcers:
       - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+    proves: [packages/hfs/src/docker-legacy-coverage.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: lite, codes: [HFS_DOCKER_STAGES]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: full, codes: [HFS_DOCKER_STAGES]}
   - id: R189
     code: "HFS_DOCKER_ENTRY"
     editions: [lite, full]
     docs: [docs/application-stacks.md#r189]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
-      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The runtime stage starts the app's own built entry in exec form (be `node be/dist/apps/<app>/src/main.js`, fe `node` on the standalone `server.js` of the app); an api or Next app sets `ENV PORT` and EXPOSEs the same port and carries a HEALTHCHECK, a worker carries a process HEALTHCHECK and exposes nothing, a cli app says `HEALTHCHECK NONE` and exposes nothing; a Next app's build stage runs `turbo run build --filter=@<project>/<app>` and its `next.config.ts` sets `output: \"standalone\"`."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DOCKER_ENTRY"]
     enforcers:
       - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+    proves: [packages/hfs/src/docker-legacy-coverage.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: lite, codes: [HFS_DOCKER_ENTRY]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: full, codes: [HFS_DOCKER_ENTRY]}
   - id: R190
     code: "HFS_DOCKER_BASE_PIN"
     editions: [lite, full]
     docs: [docs/application-stacks.md#r190]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
-      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every FROM of an app Dockerfile is a prior stage, the one node base image of the canon (an exact node version on an exact alpine release, `NODE_IMAGE` in scripts/hfs/rules/docker.mjs), or an image pinned by `@sha256` digest; never a moving tag, never an unresolved build argument."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DOCKER_BASE_PIN"]
     enforcers:
       - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+    proves: [packages/hfs/src/docker-legacy-coverage.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: lite, codes: [HFS_DOCKER_BASE_PIN]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: full, codes: [HFS_DOCKER_BASE_PIN]}
   - id: R191
     code: "HFS_DOCKER_SECRETS"
     editions: [lite, full]
     docs: [docs/application-stacks.md#r191]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
-      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "No secret enters an image: no COPY or ADD of an `.env*` file (except `.env.example`) or of a path under `.starcistacks`, `.secrets`, `.volume`, a key, certificate or kubeconfig; no ADD of a URL; no ARG or ENV whose name is a credential (PASSWORD, SECRET, TOKEN, KEY, CREDENTIAL, PRIVATE), `NEXT_PUBLIC_*` excepted because it is published by design."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DOCKER_SECRETS"]
     enforcers:
       - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+    proves: [packages/hfs/src/docker-legacy-coverage.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/image/cli/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/templates/fe/image/next/Dockerfile, editions: [lite, full]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: lite, codes: [HFS_DOCKER_SECRETS]}
+      - {path: packages/hfs/src/docker-legacy-coverage.spec.mjs, edition: full, codes: [HFS_DOCKER_SECRETS]}
   - id: R192
     code: "RT_FACT_FALSE"
     law: "Every claim of knowledge/hfs/facts.yaml holds against knowledge/hfs/slots.yaml (the one source of the product shape), and no prose of knowledge/**, docs/** or a README states the opposite of a fact (for example that an fe app lacks its own package.json, which fe.app.next requires); prose quotes a fact id or a slot id and never restates the claim."
@@ -3145,14 +3336,11 @@ rules:
     editions: [lite, full]
     docs: [docs/knowledge-yaml.md#runtime-knowledge-evidence]
     templateNa: "Runtime facts are authored knowledge checks; app scaffolds do not contain this runtime surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_FACT_FALSE"]
     enforcers:
       - {kind: runtime, id: facts, at: scripts/hfs/runtime-rules/facts.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R193
     code: "RT_RULE_ID_UNKNOWN"
     law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and rule ids are unique and well-formed (a gap between two ids is fine), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). History paths (changelogs, benchmark findings, .starciwork records), specs and generated copies are not read."
@@ -3160,14 +3348,11 @@ rules:
     editions: [lite, full]
     docs: [docs/knowledge-yaml.md#runtime-knowledge-evidence]
     templateNa: "Rule references and pattern citations belong to authored runtime knowledge, not scaffolded app files."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_RULE_ID_UNKNOWN", "RT_RULE_UNCITED"]
     enforcers:
       - {kind: runtime, id: rule-ids, at: scripts/hfs/runtime-rules/rule-ids.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R194
     code: "RT_GENERATED_BLOCK_STALE"
     law: "The app map (section 4), the back-end source tree (5.1), the tier matrix (5.2), the front-end source tree (6.1) and the rule catalog (12) of knowledge/hfs/README.md are generated blocks, rendered by scripts/hfs/readme-blocks.mjs from knowledge/hfs/slots.yaml and rules.yaml between hfs:generated markers and equal to the render byte for byte; the README never restates them by hand. Likewise the `verification.automated` list of a pattern rule is the failure codes of the rules its `hfsRules` names, the `slot` of a `files:` entry is the slot that owns its path, and the `code` of a why-map entry is the code of the catalog rule that lists the lint rule: scripts/hfs/derived-fields.mjs writes them and they equal the derivation byte for byte."
@@ -3175,21 +3360,16 @@ rules:
     editions: [lite, full]
     docs: [docs/knowledge-yaml.md#runtime-knowledge-evidence]
     templateNa: "Generated runtime knowledge and its derivations are maintained from the catalogs, not app scaffolds."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_GENERATED_BLOCK_STALE"]
     enforcers:
       - {kind: runtime, id: generated-block, at: scripts/hfs/runtime-rules/generated-block.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R195
     code: "RT_PROSE_PATH_NO_SLOT"
     editions: [lite, full]
     docs: [docs/knowledge-yaml.md#r195]
     templateNa: "This rule judges authored runtime prose against slot catalogs and shipped example declarations; app templates do not scaffold this runtime surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every product path the knowledge, the docs and the READMEs name (a be/ or fe/ path, whole or with placeholders, globs and braces) is owned by a slot of knowledge/hfs/slots.yaml or is a folder above one; a path no slot owns is prose that invented a place or kept one a slot no longer has. App names are free: a literal app name is one a shipped examples/*/hfs.json declares, a placeholder stands for any; a ** glob and a topic file of the knowledge are not paths."
     scope: runtime
     kinds: [check]
@@ -3197,7 +3377,6 @@ rules:
     failureCodes: ["RT_PROSE_PATH_NO_SLOT"]
     enforcers:
       - {kind: runtime, id: prose-path, at: scripts/hfs/runtime-rules/prose-path.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R196
     code: "RT_PROSE_RESTATES_SLOTS"
     law: "Knowledge, docs and READMEs never restate knowledge/hfs/slots.yaml: no fenced block or line names three or more product paths a slot owns, and no sentence lists three or more of the root or side file names the slots declare; a slot is referenced by its id, and the only allowed copy is a generated block between hfs:generated markers. The slot and rule catalogs, the example READMEs and the templates are sources or snapshots, not prose."
@@ -3205,21 +3384,16 @@ rules:
     editions: [lite, full]
     docs: [docs/knowledge-yaml.md#runtime-knowledge-evidence]
     templateNa: "This checker judges prose about the runtime slot catalogs; app templates are snapshots rather than this authored prose."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_PROSE_RESTATES_SLOTS"]
     enforcers:
       - {kind: runtime, id: prose-restates, at: scripts/hfs/runtime-rules/prose-restates.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R198
     code: "RT_CLI_CATALOG_DRIFT"
     editions: [lite, full]
     docs: [docs/installation.md#r198-cli-catalog-drift]
     templateNa: "The host CLI catalog generator is runtime source governance, not an app scaffold surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every generated output of the unified CLI catalog (packages/cli/src/catalog.generated.mjs, docs/cli.md, packages/cli/completions/*) equals what scripts/cli/gen-catalog.mjs writes from modules/cli/commands."
     scope: runtime
     kinds: [check]
@@ -3227,14 +3401,11 @@ rules:
     failureCodes: ["RT_CLI_CATALOG_DRIFT"]
     enforcers:
       - {kind: runtime, id: cli-catalog-drift, at: scripts/cli/gen-catalog.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R199
     code: "RT_CLI_VERB_PARITY"
     editions: [lite, full]
     docs: [docs/installation.md#cli-catalog-parity]
     templateNa: "CLI catalog and implementation parity is runtime source governance, not an app scaffold surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The CLI catalog of modules/cli/commands and the implementation agree: every catalog verb has a handler and a doc, every kernel verb module and cli.mjs dispatch case has a catalog file, and every --flag a verb module names (usage, required, api-boolean-flags.txt) is a catalog flag."
     scope: runtime
     kinds: [check]
@@ -3242,15 +3413,10 @@ rules:
     failureCodes: ["RT_CLI_VERB_PARITY"]
     enforcers:
       - {kind: runtime, id: cli-parity, at: scripts/checks/check-cli-parity.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R200
     code: "RT_CLI_APP_ONLY_TEMPLATES"
     editions: [lite, full]
     docs: [docs/installation.md#managed-app-command-boundary]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/hooks/husky/pre-commit, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Managed app templates and their generated runtime copies invoke product actions only through `starci app <verb>`; any other starci group is forbidden there."
     scope: runtime
     kinds: [check]
@@ -3258,13 +3424,13 @@ rules:
     failureCodes: ["RT_CLI_APP_ONLY_TEMPLATES"]
     enforcers:
       - {kind: runtime, id: cli-app-only-templates, at: scripts/hfs/runtime-rules/app-cli-templates.mjs}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/hooks/husky/pre-commit, editions: [lite, full]}
   - id: R201
     code: "CLI_ONLY_ENTRY"
     editions: [lite, full]
     docs: [docs/installation.md#catalog-entry-boundary]
     templateNa: "The runtime tracked-action scanner governs catalog entry use; its implementation is not scaffolded into apps."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every action enters runtime code through `starci <group> <verb>`: tracked prompts, docs, skills, knowledge files, configs, CI files, hooks and scheduled-task registrations do not bypass the catalog through direct runtime scripts or package-script wrappers; the dispatcher and the specs' own spawn helpers are the declared exceptions."
     scope: runtime
     kinds: [check]
@@ -3272,16 +3438,10 @@ rules:
     failureCodes: ["CLI_ONLY_ENTRY"]
     enforcers:
       - {kind: runtime, id: cli-only-entry, at: scripts/checks/check-cli-only-entry.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R202
     code: "CI_UPLOAD_NOT_SILENT"
     editions: [lite, full]
     docs: [docs/releasing.md#r202]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
-      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A coverage upload of a CI workflow never skips or fails silently: every step that uses codecov/codecov-action, in a root workflow, an example workflow or a template workflow of packages/hfs, authenticates by OIDC (`use_oidc: true`, with `permissions: id-token: write` on the job or the workflow), sets `fail_ci_if_error: true`, has no `continue-on-error`, and has no `if` that reads a secret or CODECOV_TOKEN, so a missing token can never turn the upload into a skipped step. Every step that uses SonarSource/* has no `if` that reads a secret or SONAR_TOKEN (a missing token fails the job), and no step or job of a workflow sets `continue-on-error`."
     scope: runtime
     kinds: [check]
@@ -3289,6 +3449,9 @@ rules:
     failureCodes: ["CI_UPLOAD_NOT_SILENT"]
     enforcers:
       - {kind: runtime, id: ci-upload, at: scripts/hfs/runtime-rules/ci-upload.mjs}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
+      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
   - id: R203
     code: "BE_FEATURE_THIN"
     editions: [lite, full]
@@ -3311,23 +3474,25 @@ rules:
     code: "HFS_COVERAGE_SCOPE_DRIFT"
     editions: [lite, full]
     docs: [docs/quality-bar.md#r204-coverage-scope]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/quality-config/codecov.yml, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "What a back end measures at 100 per file is derived once from the slot manifest (the `coverage: required|none` field of every be slot and ruleParams.be.logicRoles, scripts/hfs/coverage-scope.mjs), and the three files that state it are its render: be/jest.config.js (thresholds), the `sonar.coverage.exclusions` line of sonar-project.properties, and codecov.yml (paths and one component per service app plus platform, each at 100). A difference is drift; the scope is never edited by hand."
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_COVERAGE_SCOPE_DRIFT"]
     enforcers:
       - {kind: hfs, id: coverage-scope-drift, at: packages/hfs/sync/managed.mjs}
+    proves:
+      - {path: packages/hfs/src/coverage-scope-evidence.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/quality-config/codecov.yml, editions: [lite, full]}
+      - {path: packages/hfs/src/coverage-scope-evidence.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/coverage-scope-evidence.spec.mjs, edition: lite, codes: [HFS_COVERAGE_SCOPE_DRIFT]}
+      - {path: packages/hfs/src/coverage-scope-evidence.spec.mjs, edition: full, codes: [HFS_COVERAGE_SCOPE_DRIFT]}
   - id: R205
     code: "RT_DOC_NO_OWNER"
     editions: [lite, full]
     docs: [docs/architecture.md#r205]
     templateNa: "Runtime documentation ownership is checked in the authored runtime repository; application scaffolds do not generate runtime docs/*.md."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every tracked docs/*.md declares exactly one ownership header on its first line — \"Owner: <knowledge/ or modules/ path that exists>\" when the document explains a machine-owned source, \"Task: <one task>\" for a how-to — no two documents carry the same task, and two documents whose titles share two or more topic words while at least 30% of the shorter one's sentences appear in the other are one document merged, not two."
     scope: runtime
     kinds: [check]
@@ -3335,15 +3500,10 @@ rules:
     failureCodes: ["RT_DOC_NO_OWNER"]
     enforcers:
       - {kind: runtime, id: doc-owner, at: scripts/checks/check-doc-owner.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R206
     code: "RT_EXAMPLE_COUPLING"
     editions: [lite, full]
     docs: [docs/architecture.md#r206]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/hooks/husky/pre-commit, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Runtime source never couples to a product or its example: no tracked file under scripts/, engine/, packages/, ui/src or ui/api - and no managed template under packages/hfs/templates/ - spells a literal examples/<name>, one of the product names this runtime shipped against (the closed PRODUCT_NAMES list of scripts/lib/example-refs.mjs), an inc-<hash> a product name prefixes, or a host drive path. Specs, tests, the generated runtime copies, changelogs and .starciwork records are out of scope; a read the runtime genuinely makes at run time is declared once in scripts/lib/example-refs.mjs and every consumer names that constant."
     scope: runtime
     kinds: [check]
@@ -3351,6 +3511,8 @@ rules:
     failureCodes: ["RT_EXAMPLE_COUPLING", "RT_PRODUCT_NAME_IN_SOURCE", "RT_HOST_PATH_IN_TEMPLATE"]
     enforcers:
       - {kind: runtime, id: example-coupling, at: scripts/checks/check-example-coupling.mjs}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/hooks/husky/pre-commit, editions: [lite, full]}
   - id: R208
     code: "RT_PORT_RESTATED"
     law: "Every port literal of the runtime is spelled once, by its owner, and every other file references the owner: the harness UI ports live in modules/models/runtimes.yaml statusApp.port/devPort read through ui/ports.mjs, the local SonarQube host in scripts/gates/sonar-local.mjs DEFAULT_HOST. No in-scope file that is not the owner spells an owned literal in a port position (a scheme://host:NNNN or host:NNNN authority, a *port*/PORT assignment, a listen(NNNN) call), and an unowned literal in a port position of two or more runtime source files gets one owning exported constant the rest reference. Specs, tests, node_modules, the generated runtime copies, changelogs, .starciwork and the product stack declarations (.starcistacks, starcistacks-services - a product owns the ports of the services it runs) are out of scope."
@@ -3363,9 +3525,6 @@ rules:
     editions: [lite, full]
     docs: [docs/source-process.md#r208]
     templateNa: "Runtime port ownership is repository infrastructure; app scaffolds do not contain its owner files or readers."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R209
     code: "RT_CONFIG_DEFAULT_TWICE"
     law: "Every documented configuration default is stated once, by its owner, and read through it: a camelCase leaf or lowercase key of config.example.yaml, or a value an owner declares - scripts/machine/home.mjs DEFAULTS (supervisor workers, the land gate, frozenMinutes, pollIntervalMs), engine/config.mjs (connector, ask, UAT, spec and allocation defaults, and DEFAULT_OWNER_LANGUAGE which scripts/machine/home.mjs re-exports), engine/orca-config.mjs (worker depth), scripts/reconciler/state.mjs (the controller mode) - is never restated as a literal fallback (?? or ||, a parameter default, or a language ternary) in any other runtime source file; the reader calls the owner accessor (supervisorSettings(), configuredMode(), ownerLanguage(), ...). Specs, tests, the generated runtime copies, stories and the HFS templates are out of scope, and a bare identifier or a computed value is a read, not a restatement."
@@ -3378,9 +3537,6 @@ rules:
     editions: [lite, full]
     docs: [docs/source-process.md#r209]
     templateNa: "Runtime configuration defaults belong to harness owners and readers; HFS product templates are outside this check's scope."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R210
     code: "RT_VERSION_RESTATED"
     law: "knowledge/hfs/canon-pins.yaml spells the version of every @starci package and every canon-pinned dependency once; a package.json is the declared install site and a lockfile its resolution. Anywhere else a semver literal equal to a pin - or a name@x.y.z specifier naming one - restates it, except on the declared binding keys a refresher owns and rewrites in place (canon.version of the code-pattern bindings held by check-canon-pins.mjs, provenance.version and identity.version of the grammar snapshots rewritten by scripts/work/ui/grammar-knowledge.mjs). Package manifests, lockfiles, changelogs, specs, tests, the generated runtime copies and .starciwork are out of scope; a restatement is fixed by naming the pin, never the literal."
@@ -3393,9 +3549,6 @@ rules:
     editions: [lite, full]
     docs: [docs/source-process.md#r210]
     templateNa: "This runtime check scans tracked references to the canon pin catalog; product package install declarations are excluded and no app scaffold owns this runtime surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R211
     code: "RT_SLOT_ID_SHAPE"
     law: "A slot id follows the grammar its manifest declares, read from the manifest not from a list: dot-separated lowercase kebab segments, a first segment of naming.prefixes in knowledge/hfs/slots.yaml (profiles in knowledge/hfs/runtime-slots.yaml), <side>.app.<kind> naming a kind of appKinds.<side>, and every deeper id extending a declared id - an explicit parent field, or a family at least two slots share; a lone deep orphan invents a family. The role-suffix vocabulary holds no synonym pairs: a profile's suffixes never share a word with bannedSuffixes, no naming.refusedPairs pair is live in suffixes on both sides, and naming.sameConceptPairs is the one declared exception (step + saga-step), live on both sides or dropped; naming.glossary binds the five incoming-thing names (consumer, subscription, webhook, processor, handler) to their distinct kinds."
@@ -3408,17 +3561,12 @@ rules:
     editions: [lite, full]
     docs: [docs/source-process.md#r211]
     templateNa: "The authored app and runtime slot manifests are canon catalogs, not files scaffolded into apps."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R212
     editions: [lite, full]
     codeEditions: {HFS_EDITION_FORBIDDEN_PRESENT: [lite], HFS_STARCIWORK_LITE_FORBIDDEN: [lite]}
     editionWhy: "R212/case-3 and R212/case-4 (owner:lite-production-swarm) preserve full Work and limit the lite infrastructure and Work surfaces."
     docs: [docs/lite-edition.md#edition-validation]
     templateNa: "The hfs.json edition declaration is generated programmatically by packages/hfs/scaffold/app.mjs; no managed declaration template exists. Forbidden paths are rejected rather than scaffolded."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     code: "HFS_EDITION_INVALID"
     law: "hfs.json names an edition the manifest knows (full, or lite; absent means full). Lite follows the 2026-10-13 ruling: the same monorepo, code structure, slots, patterns and back-end unit specs, with only backing infrastructure swapped for managed Supabase (Postgres, Auth, Storage, Supabase Queues/pgmq for queue and event bus, Postgres locks, pg_cron); the api and sidecars run on docker-swarm on a VPS. The realtime pattern uses the same socket.io gateway inside the be api process (one instance, no Redis adapter), and both editions share knowledge/hfs/fe-stack.yaml. Lite requires application-stacks.yaml and permits environment metadata, runbooks, infra/swarm and encrypted-secret custody, while refusing infra/compose, infra/k8s, infra/terraform and components duplicating Supabase backing services (runtime/{config,env}, seeds and the sealed secrets of its environments are allowed). Contract specs and `test:contract` are allowed (owner 2026-10-14); it has no e2e spec, `test:e2e`, `test:stack` or `test:browser` script, e2e workflow, browser journey, Work catalog, shell, features, resources, UAT or br records, test container, toxiproxy, browser-runner, BullMQ, Kafka, Redis or graphql-ws dependency, or supabase/functions. Its .starciwork is optional and admits only .gitignore, workspace.yaml and brand/**; workspace.yaml is optional and carries project identity and repo roles for the Work tools."
     kinds: [check]
@@ -3450,60 +3598,86 @@ rules:
         source: owner
         quote: "In a lite app, .starciwork keeps only the brand records."
         ruling: "Amended by the owner on 2026-10-14: under lite, .starciwork is optional when the app has no brand records and admits only .gitignore, workspace.yaml and brand/** in the existing brand tooling layout, including drawing records, references and assets. workspace.yaml is optional and keeps the project id and repo roles so Work root detection and render-proof role mapping can tie brand records to the front end. index.yaml, shell/, features/, _resources/, uat and br remain forbidden. Lite readers read workspace.yaml normally and skip the full-edition catalog, shell and feature metadata; lite scaffolding creates .gitignore and workspace.yaml, with brand/ only when present. Full edition is unchanged."
-
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves: [packages/hfs/src/hfs-edition-invalid.spec.mjs, packages/hfs/src/hfs-edition-forbidden-present.spec.mjs, packages/hfs/src/hfs-starciwork-lite-forbidden.spec.mjs]
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-edition-invalid.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-edition-forbidden-present.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-starciwork-lite-forbidden.spec.mjs, edition: lite}
+    witness:
+      - {path: packages/hfs/src/hfs-edition-invalid.spec.mjs, editions: [lite, full], codes: [HFS_EDITION_INVALID]}
+      - {path: packages/hfs/src/hfs-edition-forbidden-present.spec.mjs, edition: lite, codes: [HFS_EDITION_FORBIDDEN_PRESENT]}
+      - {path: packages/hfs/src/hfs-starciwork-lite-forbidden.spec.mjs, edition: lite, codes: [HFS_STARCIWORK_LITE_FORBIDDEN]}
   - id: R213
     code: "DB_MIGRATION_SHAPE"
     editions: [lite, full]
     docs: [docs/architecture.md#r213]
     templateNa: "Full apps opt into Supabase without a managed Supabase migration scaffold; their migration sequence and Git history are product-authored."
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/skeleton-lite/supabase/migrations/__timestamp___baseline.sql, edition: lite}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A migration is `supabase/migrations/<ts14>_<kebab>.sql`; the stamp is a valid UTC instant, active stamps are unique, and a new migration sorts strictly after the committed active migrations in HEAD. Repository history includes the archive: moving an active migration to the archive retires it from ordering, so a replacement baseline may predate archived stamps and later migrations append after the baseline. Wall-clock time, commit time and remote-branch stamps do not set the ordering boundary. A migration already on the base is immutable (a diff or an unarchived removal is a finding); a file that does not parse as PostgreSQL is a shape failure."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_MIGRATION_SHAPE"]
     enforcers:
       - {kind: hfs, id: db-migration-shape, at: scripts/hfs/rules/database.mjs}
+    proves:
+      - {path: packages/hfs/src/db-migration-shape.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/supabase/migrations/__timestamp___baseline.sql, edition: lite}
+      - {path: packages/hfs/src/db-migration-shape.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/db-migration-shape.spec.mjs, editions: [lite, full], codes: [DB_MIGRATION_SHAPE]}
   - id: R214
     code: "DB_RLS_REQUIRED"
     editions: [lite, full]
     docs: [docs/lite-edition.md#r214]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/table/migration.sql.tpl, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Row level security is code a parser can read: every `create table` (or `create table as`) in an exposed schema (`public` plus the config.toml `[api] schemas`) is followed, in the same migration, by `alter table <t> enable row level security` (and `force` for a table hfs.json `supabase.forceRls` declares); no `DO` block or function runs dynamic SQL that builds DDL or grants; a write or `for all` policy never uses `(true)`, `to anon`/`to public` is legal only on a `for select` policy named `*_public_read`, every policy is named `<table>_<role>_<action>`, and `service_role` is never granted."
     kinds: [check, codemod]
     gates: [settle, land, ci]
     failureCodes: ["DB_RLS_REQUIRED", "DB_DYNAMIC_DDL", "DB_POLICY_SHAPE"]
     enforcers:
       - {kind: hfs, id: db-rls, at: scripts/hfs/rules/database.mjs}
+    proves:
+      - {path: packages/hfs/src/db-rls-required.spec.mjs, editions: [lite, full], codes: [DB_RLS_REQUIRED]}
+      - {path: packages/hfs/src/db-dynamic-ddl.spec.mjs, editions: [lite, full], codes: [DB_DYNAMIC_DDL]}
+      - {path: packages/hfs/src/db-policy-shape.spec.mjs, editions: [lite, full], codes: [DB_POLICY_SHAPE]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/table/migration.sql.tpl, editions: [lite, full]}
+      - {path: packages/hfs/src/db-rls-required.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/db-dynamic-ddl.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/db-policy-shape.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/db-rls-required.spec.mjs, edition: lite, codes: [DB_RLS_REQUIRED]}
+      - {path: packages/hfs/src/db-dynamic-ddl.spec.mjs, edition: lite, codes: [DB_DYNAMIC_DDL]}
+      - {path: packages/hfs/src/db-policy-shape.spec.mjs, edition: lite, codes: [DB_POLICY_SHAPE]}
+      - {path: packages/hfs/src/db-rls-required.spec.mjs, edition: full, codes: [DB_RLS_REQUIRED]}
+      - {path: packages/hfs/src/db-dynamic-ddl.spec.mjs, edition: full, codes: [DB_DYNAMIC_DDL]}
+      - {path: packages/hfs/src/db-policy-shape.spec.mjs, edition: full, codes: [DB_POLICY_SHAPE]}
   - id: R215
     code: "DB_DEFINER_SAFE"
     editions: [lite, full]
     docs: [docs/lite-edition.md#r215]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
     templateNa: "Security-definer functions and storage buckets are app-owned SQL objects; neither edition scaffolds them."
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Privileged database objects are declared safely: a `security definer` function pins `search_path` (never `from current`), lives outside the exposed schemas or is `revoke execute ... from public` in the same migration, declares a return type and interpolates parameters into dynamic SQL only through `format('%I/%L')`; a bucket inserted into `storage.buckets` declares `public = false` (true only for an id ending `_public`), `file_size_limit` and `allowed_mime_types`, and has a `storage.objects` policy naming its `bucket_id` in the same migration."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_DEFINER_SAFE", "DB_STORAGE_POLICY"]
     enforcers:
       - {kind: hfs, id: db-privileged-objects, at: scripts/hfs/rules/database.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/db-definer-safe.spec.mjs, editions: [lite, full], codes: [DB_DEFINER_SAFE]}
+      - {path: packages/hfs/src/db-storage-policy.spec.mjs, editions: [lite, full], codes: [DB_STORAGE_POLICY]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/db-definer-safe.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/db-storage-policy.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/db-definer-safe.spec.mjs, edition: lite, codes: [DB_DEFINER_SAFE]}
+      - {path: packages/hfs/src/db-storage-policy.spec.mjs, edition: lite, codes: [DB_STORAGE_POLICY]}
+      - {path: packages/hfs/src/db-definer-safe.spec.mjs, edition: full, codes: [DB_DEFINER_SAFE]}
+      - {path: packages/hfs/src/db-storage-policy.spec.mjs, edition: full, codes: [DB_STORAGE_POLICY]}
   - id: R216
     code: "DB_CONFIG_POLICY"
     editions: [lite, full]
     docs: [docs/lite-edition.md#r216]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/skeleton-lite/supabase/config.toml, edition: lite}
     templateNa: "Database types are generated from each app migration set, not static templates; full-edition Supabase configuration is app-owned."
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The database configuration and its types are checked facts: `supabase/config.toml` carries no literal value under a credential key (the value is `env(NAME)`), `auth.jwt_expiry` is at most 3600, and signup, site url and redirect urls equal the Supabase block of hfs.json where it declares them; `supabase/types/database.types.ts` is committed and equals the text `contract:emit` regenerates from the migrations. Type emission refuses HFS_EMIT_DB_TYPES_STALE unless the complete applied migration version set equals the SQL filename stamps; lint and check report drift without writing types."
     kinds: [check]
     gates: [land, ci]
@@ -3511,15 +3685,25 @@ rules:
     enforcers:
       - {kind: hfs, id: db-config-types, at: scripts/hfs/rules/database.mjs}
       - {kind: hfs, id: db-types-emit, at: packages/hfs/emit/db-types.mjs}
+    proves:
+      - {path: packages/hfs/src/db-types-returned-collector.spec.mjs, editions: [lite, full], codes: [DB_TYPES_DRIFT]}
+      - {path: packages/hfs/src/db-config-policy.spec.mjs, editions: [lite, full], codes: [DB_CONFIG_POLICY]}
+      - {path: packages/hfs/src/db-types-emit-stale.spec.mjs, editions: [lite, full], codes: [HFS_EMIT_DB_TYPES_STALE]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/supabase/config.toml, edition: lite}
+      - {path: packages/hfs/src/db-types-returned-collector.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/db-config-policy.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/db-types-emit-stale.spec.mjs, editions: [lite, full], codes: [HFS_EMIT_DB_TYPES_STALE]}
+    witness:
+      - {path: packages/hfs/src/db-types-returned-collector.spec.mjs, edition: lite, codes: [DB_TYPES_DRIFT]}
+      - {path: packages/hfs/src/db-types-returned-collector.spec.mjs, edition: full, codes: [DB_TYPES_DRIFT]}
+      - {path: packages/hfs/src/db-config-policy.spec.mjs, edition: lite, codes: [DB_CONFIG_POLICY]}
+      - {path: packages/hfs/src/db-config-policy.spec.mjs, edition: full, codes: [DB_CONFIG_POLICY]}
+      - {path: packages/hfs/src/db-types-emit-stale.spec.mjs, editions: [lite, full], codes: [HFS_EMIT_DB_TYPES_STALE]}
   - id: R217
     code: "FE_SUPABASE_CLIENT_OWNER"
     editions: [lite, full]
     docs: [docs/lite-edition.md#r217]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/fe/auth/supabase-client.ts.tpl, editions: [lite, full]}
-      - {path: packages/hfs/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.client.ts, edition: lite}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Supabase has one door per side: on the front end `@supabase/supabase-js` and `@supabase/ssr` are imported only by `fe.modules.auth` and only their auth API is called (sign-in, sign-out, session, access token; never `.from`, `.rpc`, `.storage` or `.channel`, so the front end reads and writes no data through Supabase), and on the back end only `be.integrations.supabase` imports them, every back-end client carrying the committed `Database` type; the front end holds no credential: `fe/` names no service-role or `*_SECRET`, `*_PRIVATE`, `*_TOKEN`, `*_PASSWORD` value (public configuration is read once by `modules/config`)."
     kinds: [check, design]
     gates: [settle, land, ci]
@@ -3527,52 +3711,74 @@ rules:
     enforcers:
       - {kind: machine, id: supabase-client-owner, at: scripts/hfs/architecture/supabase.mjs}
       - {kind: machine, id: supabase-service-role, at: scripts/hfs/architecture/supabase.mjs}
+    proves:
+      - {path: packages/hfs/src/fe-supabase-client-owner.spec.mjs, editions: [lite, full], codes: [FE_SUPABASE_CLIENT_OWNER]}
+      - {path: packages/hfs/src/r217-backend-client-owner.spec.mjs, editions: [lite, full], codes: [BE_SUPABASE_CLIENT_OWNER]}
+      - {path: packages/hfs/src/fe-service-role-forbidden.spec.mjs, editions: [lite, full], codes: [FE_SERVICE_ROLE_FORBIDDEN]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/fe/auth/supabase-client.ts.tpl, editions: [lite, full]}
+      - {path: packages/hfs/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.client.ts, edition: lite}
+      - {path: packages/hfs/src/fe-supabase-client-owner.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/r217-backend-client-owner.spec.mjs, editions: [lite, full]}
+      - {path: packages/hfs/src/fe-service-role-forbidden.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/fe-supabase-client-owner.spec.mjs, edition: lite, codes: [FE_SUPABASE_CLIENT_OWNER]}
+      - {path: packages/hfs/src/r217-backend-client-owner.spec.mjs, edition: lite, codes: [BE_SUPABASE_CLIENT_OWNER]}
+      - {path: packages/hfs/src/fe-service-role-forbidden.spec.mjs, edition: lite, codes: [FE_SERVICE_ROLE_FORBIDDEN]}
+      - {path: packages/hfs/src/fe-supabase-client-owner.spec.mjs, edition: full, codes: [FE_SUPABASE_CLIENT_OWNER]}
+      - {path: packages/hfs/src/r217-backend-client-owner.spec.mjs, edition: full, codes: [BE_SUPABASE_CLIENT_OWNER]}
+      - {path: packages/hfs/src/fe-service-role-forbidden.spec.mjs, edition: full, codes: [FE_SERVICE_ROLE_FORBIDDEN]}
   - id: R219
     code: "BE_SUPABASE_JWT_VERIFIED"
     editions: [lite, full]
     docs: [docs/lite-edition.md#r219]
     templateNa: "Full-edition Supabase verification is an optional integration with no managed verifier scaffold; lite has the referenced integration template."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.jwks.ts, edition: lite}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The principal is verified, never trusted: a back-end principal comes only from a Supabase access token verified against the project JWKS (signature, issuer, audience, expiry, pinned algorithm), never decoded unverified and never from the request body."
     kinds: [check, design]
     gates: [settle, land, ci]
     failureCodes: ["BE_SUPABASE_JWT_VERIFIED"]
     enforcers:
       - {kind: machine, id: supabase-principal, at: scripts/hfs/architecture/supabase.mjs}
+    proves:
+      - {path: packages/hfs/src/be-supabase-jwt-verified.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.jwks.ts, edition: lite}
+      - {path: packages/hfs/src/be-supabase-jwt-verified.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/be-supabase-jwt-verified.spec.mjs, edition: lite, codes: [BE_SUPABASE_JWT_VERIFIED]}
+      - {path: packages/hfs/src/be-supabase-jwt-verified.spec.mjs, edition: full, codes: [BE_SUPABASE_JWT_VERIFIED]}
   - id: R220
     code: "HFS_LITE_SECRET_CUSTODY"
     editions: [lite]
     editionWhy: "ruling:lite-backing-services assigns Supabase backing to lite; R220 adds lite's reduced custody tree and Supabase/FE literal scan, while R06 governs plaintext secret material in both editions."
     docs: [docs/host-secrets.md#application-secret-rules]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/skeleton-lite/.sops.yaml, edition: lite}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A lite app holds no secret material in the tree: root `.env*`, `secrets.env`, `.secrets/` and an `.enc` file outside `.starcistacks/<env>/secrets` are forbidden, and `fe/` and `supabase/` hold no Supabase token, JWT or connection string with a password; the one custody is the sealed `.starcistacks/<env>/secrets/<slug>.enc`."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_LITE_SECRET_CUSTODY"]
     enforcers:
       - {kind: hfs, id: lite-secret-custody, at: scripts/hfs/rules/supabase-secrets.mjs}
+    proves:
+      - {path: packages/hfs/src/hfs-supabase-secrets.spec.mjs, edition: lite}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.sops.yaml, edition: lite}
+      - {path: packages/hfs/src/hfs-supabase-secrets.spec.mjs, edition: lite}
+    witness:
+      - {path: packages/hfs/src/hfs-supabase-secrets.spec.mjs, edition: lite}
   - id: R221
     code: "CI_TRIGGERS_RELEASE_ONLY"
     law: "The only workflow triggers are a push of release tags, a push of release candidate branches `release/candidate-*`, a person dispatching it and, in the runtime's own workflows (`.github/workflows/` at the root), a push to `main`: every tracked workflow declares an `on` that holds only `push` filtered to `tags: ['v*']` and/or `branches` naming only `release/candidate-*` (and, in the runtime's own workflows, `main`; no paths or ignore filter beside them) and `workflow_dispatch`. Every `ci.yml`, and the runtime's `examples.yml`, must name `release/candidate-*`: `starci release cut` and `starci app release push` push the exact release sha there and move main and the tag only when that run is green (owner ruling candidate-ci, 2026-10-18). A push to any other branch, a pull_request, a schedule, a workflow_call or any other event refuses the workflow."
     scope: runtime
     editions: [lite, full]
     docs: [docs/git-governance.md#r221]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
-      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["CI_TRIGGERS_RELEASE_ONLY"]
     enforcers:
       - {kind: runtime, id: git-triggers, at: scripts/hfs/runtime-rules/git-triggers.mjs}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
+      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
   - id: R222
     code: "RELEASE_NOTES"
     law: "A release tag `v<version>` on HEAD has its CHANGELOG.md section `## [<version>]` with no TODO, PENDING or TBD left in it and no `in preparation` mark: the tag message and the GitHub Release are that section, so a tag is never cut over an unfinished or missing section."
@@ -3580,14 +3786,11 @@ rules:
     editions: [lite, full]
     docs: [docs/git-governance.md#r222]
     templateNa: "Release tags at HEAD and their finished changelog sections are authored release evidence, not app scaffold output."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RELEASE_NOTES"]
     enforcers:
       - {kind: runtime, id: release-notes, at: scripts/hfs/runtime-rules/release-notes.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R223
     code: "RIGHTS_ROLE_DENIED"
     law: "By the caller's role, the command guard refuses git push, git tag, raw git commit/add/rm/mv, raw git synchronization writes, npm publish, a whole-suite run outside the release cut and unit.verify/e2e.verify, npm ci without the host lock, a release cut, and raw side-effecting tools; modules/kernel/command-policy.yaml is the one rule table read by both the PreToolUse guard and the PATH shim."
@@ -3597,7 +3800,6 @@ rules:
     failureCodes: ["RIGHTS_ROLE_DENIED", "RIGHTS_GIT_PUSH", "RIGHTS_GIT_TAG", "RIGHTS_GIT_COMMIT", "RIGHTS_GIT_SYNC", "RIGHTS_NPM_PUBLISH", "RIGHTS_NPM_CI_UNLOCKED", "RIGHTS_SUITE_RUN", "RIGHTS_RELEASE_CUT", "RIGHTS_RAW_TOOL"]
     enforcers:
       - {kind: runtime, id: role-rights, at: scripts/hfs/runtime-rules/rights-policy.mjs}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
   - id: R224
     code: "RIGHTS_PROTECTED_ZONE"
     law: "The protected zone declared once in modules/kernel/protected-zone.yaml is edited only by the owner path; a supervisor self-upgrade files an owner proposal, and an op never writes the .claude runtime checkout."
@@ -3607,7 +3809,6 @@ rules:
     failureCodes: ["RIGHTS_PROTECTED_ZONE", "RIGHTS_OP_RUNTIME_WRITE"]
     enforcers:
       - {kind: runtime, id: protected-zone, at: scripts/hfs/runtime-rules/rights-policy.mjs}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
   - id: R225
     code: "RT_HOOK_SHAPE"
     law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags; the runtime's own hook is scripts/guards/release-push-gate.mjs, which judges main and v* tags against the release definition and lets every other ref through) and runs no npm test, jest, typecheck or lint."
@@ -3617,14 +3818,11 @@ rules:
     failureCodes: ["RT_HOOK_SHAPE", "RIGHTS_PUSH_NOT_RELEASE"]
     enforcers:
       - {kind: runtime, id: hook-shape, at: scripts/hfs/runtime-rules/hook-shape.mjs}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
   - id: R227
     code: "RT_SYNTAX_INVALID"
     editions: [lite, full]
     docs: [docs/source-process.md#r227]
     templateNa: "The runtime syntax check judges tracked authored JavaScript, not a scaffolded application surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Every git-tracked .mjs, .cjs and .js file parses as JavaScript, including tests and package sources; node_modules, generated roots of ruleParams.runtime.generated and vendored build output are outside the authored-source scope. The runtime folder's Node-exact syntax pass remains in place, while this batched in-process pass extends coverage to the whole tracked repository and reports every parser diagnostic at its file and line."
     scope: runtime
     kinds: [check]
@@ -3632,7 +3830,6 @@ rules:
     failureCodes: ["RT_SYNTAX_INVALID"]
     enforcers:
       - {kind: runtime, id: syntax, at: scripts/hfs/runtime-rules/syntax.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R228
     code: "RT_IDENTIFIER_UNDECLARED"
     law: "Every identifier a runtime ES module (scripts/, engine/ without the vendored yaml bundle, ui/api/, packages/cli/bin and src) reads or writes resolves, by scope analysis over its TypeScript syntax tree, to a declaration, import, parameter or Node global of an enclosing scope. A re-export (export {x} from './y.mjs') binds x in no local scope; require, module, exports and __dirname are not globals of a module; browser globals resolve only inside a function that a module hands to page.evaluate, here or through an import. A name a refactor left behind is refused before the line that reads it runs."
@@ -3645,9 +3842,6 @@ rules:
     editions: [lite, full]
     docs: [docs/source-process.md#r228]
     templateNa: "This check scans authored runtime ES modules; app scaffolds do not contain these harness modules."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R229
     code: "RT_REMOVED_VOCABULARY"
     law: "No text an agent or the owner reads teaches a spelling the runtime refuses. The refused names - config keys, routing-bias fields, verbs, flags, codes and vocabulary - are the one list modules/kernel/removed-vocabulary.yaml, each with its replacement and the release that removed it; the config and routing-bias refusals read the same list. Every tracked file of skills/, docs/, README.md, CONTEXT.md, CONTRIBUTING.md, modules/ and knowledge/ (Markdown and yaml) is scanned line by line, and a line that spells a listed name is a finding naming file:line, the name and its replacement unless the file is the list, CHANGELOG.md, or the line or block carries the [removed-list] marker (a marker alone on a comment line covers the lines up to the next blank one). Removing or renaming a key, flag, verb, field or code adds its entry to the list in the same commit."
@@ -3660,9 +3854,6 @@ rules:
     editions: [lite, full]
     docs: [docs/source-process.md#r229]
     templateNa: "The removed-name catalog and authored runtime instructions are maintained repository surfaces, not app scaffold output."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R230
     code: "RT_PROSE_COMMAND_UNKNOWN"
     law: "A command an instruction shows exists as written. Every `starci <group> <verb>` in a backticked span, fenced code line or yaml example item of skills/, docs/, README.md, CONTEXT.md, CONTRIBUTING.md and modules/ names a verb of the CLI catalog (modules/cli/commands) in a catalogued group, and every --flag on it is a flag of that verb or a global flag; the text after a lone -- belongs to another program and a [removed-list] marked line is exempt. The catalog is generated into the valid set, never typed twice."
@@ -3670,14 +3861,11 @@ rules:
     editions: [lite, full]
     docs: [docs/debugging.md#r230-instruction-commands]
     templateNa: "Runtime instruction and contract self-checks judge authored runtime surfaces; application scaffolds do not contain this surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_PROSE_COMMAND_UNKNOWN"]
     enforcers:
       - {kind: runtime, id: prose-commands, at: scripts/checks/check-prose-commands.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R231
     code: "RT_DOCUMENTED_DEFAULT_DRIFT"
     law: "A default a document states equals the value the code reads. A document states a default by citing its key - default <value> = `<key>` - where the key is a config.yaml path (resolved through the validator's settings reader, so an absent block yields its code default) or <yaml file under modules/>:<dotted path>; the check resolves the key and compares, and a key that resolves to nothing is a finding. docs/, README.md, CONTEXT.md, config.example.yaml and modules/ prose and yaml are scanned; a bare number stated as a default without its key is not judged, so the owner of a default is cited, never retyped."
@@ -3685,14 +3873,11 @@ rules:
     editions: [lite, full]
     docs: [docs/debugging.md#r231-documented-defaults]
     templateNa: "Runtime instruction and contract self-checks judge authored runtime surfaces; application scaffolds do not contain this surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_DOCUMENTED_DEFAULT_DRIFT"]
     enforcers:
       - {kind: runtime, id: documented-defaults, at: scripts/checks/check-documented-defaults.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R232
     code: "RT_ROLES_CONTRACT_DRIFT"
     law: "A role is described once. modules/kernel/roles.yaml holds, per role, its scope, what it does, what it must clean up, what it never does, whom it reports to and who oversees it; a Markdown surface of the role carries the block generated from it, a yaml or script surface cites modules/kernel/roles.yaml#<role>, and no surface teaches a spelling the role's contradicts list names."
@@ -3700,14 +3885,11 @@ rules:
     editions: [lite, full]
     docs: [docs/debugging.md#r232-generated-role-contracts]
     templateNa: "Runtime instruction and contract self-checks judge authored runtime surfaces; application scaffolds do not contain this surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_ROLES_CONTRACT_DRIFT"]
     enforcers:
       - {kind: runtime, id: roles-contract, at: scripts/checks/check-roles-contract.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R233
     code: "RT_EDGE_CASE_REGISTRY"
     law: "Every edge case met is a declared entry of modules/reconciler/edge-cases.yaml with its family, its real occurrence and a status of covered or open; a covered entry names the rule that handles it and that file exists, a named spec is a package spec or the scaffold e2e that exists (never a runtime test, owner ruling no-runtime-specs), and an open entry says why."
@@ -3715,21 +3897,16 @@ rules:
     editions: [lite, full]
     docs: [docs/debugging.md#r233-edge-case-evidence]
     templateNa: "Runtime instruction and contract self-checks judge authored runtime surfaces; application scaffolds do not contain this surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_EDGE_CASE_REGISTRY"]
     enforcers:
       - {kind: runtime, id: edge-case-registry, at: scripts/checks/check-edge-case-registry.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R234
     code: "RT_SECRET_TRACKED"
     editions: [lite, full]
     docs: [docs/application-stacks.md#where-a-secret-may-live]
     templateNa: "The public runtime repository secret policy judges Git-tracked custody paths; application scaffolds do not contain runtime host secrets."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The runtime repository is public and tracks no secret material, not even ciphertext: no tracked *.enc member and no tracked secret.env or .env file, except the paths ruleParams.runtime.heldSecrets names with their reason (a list that only shrinks). Every secret the host needs lives in the one untracked .claude/secret.env, read only through engine/secrets.mjs, its names listed in the tracked secret.env.example; a product repository keeps its own custody in its own repository. Two Sonar servers, no overlap: SonarCloud serves everything that lives in the runtime repository (the runtime and the example apps, token SONAR_TOKEN), the self-hosted ext/sonar serves product repositories only."
     scope: runtime
     kinds: [check]
@@ -3737,7 +3914,6 @@ rules:
     failureCodes: ["RT_SECRET_TRACKED"]
     enforcers:
       - {kind: runtime, id: secret-tracked, at: scripts/hfs/runtime-rules/secret-tracked.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R235
     code: "SCAN_SMELL"
     editions: [lite, full]
@@ -3782,8 +3958,6 @@ rules:
     editions: [lite, full]
     docs: [docs/debugging.md#r236]
     templateNa: "Runtime release history is judged against the committed gates of the last release; product scaffolding has no runtime release history to generate."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A change that loosens a gate or check is always red: a check removed from a gate file's list, a floor lowered or a ceiling raised there, an allowlist entry added, a spec deleted or weakened or skipped together with product code (modules/kernel/gate-loosening.yaml). It never lands and never passes the check; there is no approval route, the owner's included (owner:loosening-always-red), and the fix is to restore the gate. An entry that only moves with a git rename of the paths it names is no loosening."
     scope: runtime
     kinds: [check]
@@ -3791,14 +3965,11 @@ rules:
     failureCodes: ["RT_GATE_LOOSENING"]
     enforcers:
       - {kind: runtime, id: gate-loosening, at: scripts/checks/check-gate-loosening.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R237
     code: "RT_REVISION_SCOPE"
     editions: [lite, full]
     docs: [docs/debugging.md#r237]
     templateNa: "The runtime revision-scope table and derived engine import graph are runtime authoring surfaces, not generated application files."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "What a change of the runtime tree asks of each role is declared once, in modules/kernel/revision-scope.yaml: every tracked path matches a row, the engine-loaded files are derived from the import graph of the engine's entries and never hand-listed, the files each seat's launch prompt is built from are the files its generator reads, and a wording-only declaration holds only for an edit that keeps the file's structure."
     scope: runtime
     kinds: [check]
@@ -3806,7 +3977,6 @@ rules:
     failureCodes: ["RT_REVISION_SCOPE"]
     enforcers:
       - {kind: runtime, id: revision-scope, at: scripts/checks/check-revision-scope.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R238
     code: "RT_EVENT_SPILL_BYPASS"
     law: "A ledger event payload that grows with its input (a file list, a manifest, a digest, a report, a critique, a menu) goes to the blob store through the one path of appendEvent: engine/db/event-compact.mjs eventPayloadRecord keeps a bounded inline view of at most 16 KiB and the whole payload behind events.payload_sha, and readers resolve it through engine/db/event-payload.mjs. No runtime source file other than engine/db/ledger.mjs and engine/db/event-compact.mjs passes a payloadSha to a write, catches the payload-too-large refusal to spill by hand, or inserts into the events table directly. Specs, tests, node_modules, the generated runtime copies and packages are out of scope."
@@ -3814,14 +3984,11 @@ rules:
     editions: [lite, full]
     docs: [docs/ledger-db.md#the-storage-convention-owner-ruling-2026-10-09]
     templateNa: "These runtime checker inputs are maintained in the runtime repository, not scaffolded in a product app."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_EVENT_SPILL_BYPASS"]
     enforcers:
       - {kind: runtime, id: event-spill, at: scripts/checks/check-event-spill.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R239
     code: "RT_STORAGE_UNDECLARED"
     law: "Content lives as a file in the content-addressed blob store under the runtime state dir (<runtime root>/.runtime/artifacts, engine/db/blob.mjs) and a database row holds only the reference (the sha) plus the small scalars it is queried by (owner ruling 2026-10-09). Always content, whatever its size: a report, a critique or verdict, a prompt or dispatch contract, a read manifest, a list of files, a log or command output, a menu or digest snapshot, an image or render, a diff. What may stay inline: ids, states, timestamps, counts, short codes and one-line reasons up to 256 bytes; any other free text up to 1024 bytes; a payload of any size is class spill (appendEvent and supEvent keep the whole payload behind the sha and a small inline form). Every text column of the product ledger and of machine.sqlite is declared in modules/schemas/storage-convention.yaml with its class (scalar, bounded, reference, spill, migrate), so a new table or column cannot appear without one; a column that holds content inline today is class migrate with its measured size, and the migration to a reference is a proposed runtime step, idempotent and journalled, never a hand rewrite of a live store."
@@ -3829,14 +3996,11 @@ rules:
     editions: [lite, full]
     docs: [docs/ledger-db.md#the-storage-convention-owner-ruling-2026-10-09]
     templateNa: "These runtime checker inputs are maintained in the runtime repository, not scaffolded in a product app."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_STORAGE_UNDECLARED"]
     enforcers:
       - {kind: runtime, id: storage-convention, at: scripts/checks/check-storage-convention.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R240
     code: "RT_ROOT_ADHOC"
     law: "Which directory a component reads or writes is decided in one module, scripts/lib/roots.mjs: the runtime tree, its state directory, the temp root, the invocation directory, the Work directory name, the order in which two trees that can hold the same record are tried (the tree the work happens in first, then the product's main checkout: workDirHolding, workRecordPath) and the order a tool is looked up (the tree the work happens in, then the project, the runtime's own install last: toolSearchDirs). A runtime source file does not resolve a root by itself: it neither spells process.cwd() nor the Work directory name as a literal outside that module more often than the tree the check landed on held it: a file keeps the count it had and only loses it as it is converted, and a new file starts at none. Four times in two days a component read or wrote the wrong tree because it resolved the directory itself."
@@ -3844,14 +4008,11 @@ rules:
     editions: [lite, full]
     docs: [docs/architecture.md#r240]
     templateNa: "These runtime checker inputs are maintained in the runtime repository, not scaffolded in a product app."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_ROOT_ADHOC"]
     enforcers:
       - {kind: runtime, id: root-adhoc, at: scripts/checks/check-root-adhoc.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R241
     code: "RT_HELD_UNSURFACED"
     law: "A failure code the catalogue gives to the Supervisor or the owner as a runtime fault is a state that role must be able to learn of; a stop that nobody is told of stands for hours until someone reads source. Each such entry of modules/kernel/failure-codes.yaml names the house mechanism that reaches its owner (surfacedBy: decision-item, sla-clock, incident, digest, notifier, caller or open) with surfacedAs (the item kind, clock code, incident kind, digest problem line or urgent class) and surfacedAt (the file that does it), and the check proves the mechanism exists and is wired in that file: the kind is a Decision Item kind and the file opens items naming it, the code is an SLA code with an owner and the file sets its clock, the problem line is a departure of the operating standard, a caller is a verb the owning role ran itself and never a reconciler file (a loop is no owner). An entry nothing reaches is surfacedBy open and names an open edge-case registry entry with the exact reason; it is never exempted silently."
@@ -3859,14 +4020,11 @@ rules:
     editions: [lite, full]
     docs: [docs/debugging.md#r241]
     templateNa: "These runtime checker inputs are maintained in the runtime repository, not scaffolded in a product app."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_HELD_UNSURFACED"]
     enforcers:
       - {kind: runtime, id: held-surfacing, at: scripts/checks/check-held-surfacing.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R242
     code: "RT_OP_JUDGE_UNDECLARED"
     law: "Every op declares who judges its product (principle P2: the maker never judges its own work). The contract of each op (modules/ops/ops/<op>.yaml) carries the required field `judge`, a list of at least one entry, each with a one-line why: machine (independent measures the runtime owns or re-runs at settle, named from modules/kernel/op-judges.yaml, and the contract proofs they rely on; a test file the same attempt wrote is never one by itself), critic (the independent Critic and its rubric, declared exactly for the op kinds that modules/kernel/critic.yaml coverage marks covered), owner (only where modules/kernel/op-judges.yaml ownerGates holds an owner gate) and next-leg (a registered reviewing leg whose contract is to review this product). Nobody cannot be declared. The registry and the contracts are checked against the runtime's own tables (op-gate and sonar-gate enforcedOps, opProofs, proof media, the Critic coverage), so the declarations and what the runtime does cannot drift apart. Surfaced in the full status text of a leg and in the op prompt."
@@ -3874,24 +4032,15 @@ rules:
     editions: [lite, full]
     docs: [docs/ops.md#r242]
     templateNa: "These runtime checker inputs are maintained in the runtime repository, not scaffolded in a product app."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_OP_JUDGE_UNDECLARED"]
     enforcers:
       - {kind: runtime, id: op-judge, at: scripts/checks/check-op-judge.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R243
     code: "FE_SERVER_ACTION_FORBIDDEN"
     editions: [lite, full]
     docs: [docs/code-pattern-enforcement.md#r243]
-    proves:
-      - {path: packages/eslint/fe/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_SERVER_ACTION_FORBIDDEN]}
-    exemplifiedBy:
-      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/app/health/live/route.ts, edition: lite}
-      - {path: packages/hfs/templates/fe/skeleton/apps/app/src/app/health/live/route.ts, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The front end serves no API, in every app and edition (R212 case-2 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4): no file under `fe/` carries a `\"use server\"` directive (module or function level), and the only route handlers are `app/health/live/route.ts` and the auth callback of the `fe.route.callback` slot; reads and writes reach the back end through `modules/api` and the SWR hooks, and a webhook, cron, public API or third-party callback is a back-end feature."
     kinds: [check, lint]
     gates: [pre-commit, settle, land, ci]
@@ -3899,17 +4048,19 @@ rules:
     enforcers:
       - {kind: machine, id: server-action-forbidden, at: scripts/hfs/architecture/server-action.mjs}
       - {kind: eslint-fe, id: no-server-action}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+    proves:
+      - {path: packages/eslint/fe/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_SERVER_ACTION_FORBIDDEN]}
+      - {path: packages/hfs/src/frontend-boundary-coverage.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/app/health/live/route.ts, edition: lite}
+      - {path: packages/hfs/templates/fe/skeleton/apps/app/src/app/health/live/route.ts, edition: full}
+      - {path: packages/hfs/src/frontend-boundary-coverage.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_SERVER_ACTION_FORBIDDEN, FE_ROUTE_HANDLER_FORBIDDEN]}
   - id: R244
     code: "FE_STACK_FORBIDDEN"
     editions: [lite, full]
     docs: [docs/code-pattern-enforcement.md#r244]
-    proves:
-      - {path: packages/eslint/fe/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_STACK_FORBIDDEN]}
-    exemplifiedBy:
-      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/proxy.ts, edition: lite}
-      - {path: packages/hfs/templates/fe/skeleton/apps/app/src/proxy.ts, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A front end uses the one canonical library of each concern of knowledge/hfs/fe-stack.yaml: no front-end package.json (an app or a `fe/packages/*` package) depends on, and no source file under `fe/` imports, a package that the catalog lists under a concern's `forbids`; a missing concern is added to the catalog (with its pin in canon-pins.yaml), never installed beside it."
     kinds: [check, lint]
     gates: [pre-commit, settle, land, ci]
@@ -3917,7 +4068,15 @@ rules:
     enforcers:
       - {kind: hfs, id: fe-stack, at: scripts/hfs/rules/fe-stack.mjs}
       - {kind: eslint-fe, id: fe-stack-import}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+    proves:
+      - {path: packages/eslint/fe/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_STACK_FORBIDDEN]}
+      - {path: packages/hfs/src/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_STACK_FORBIDDEN]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/fe/skeleton-lite/apps/web/src/proxy.ts, edition: lite}
+      - {path: packages/hfs/templates/fe/skeleton/apps/app/src/proxy.ts, edition: full}
+      - {path: packages/hfs/src/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_STACK_FORBIDDEN]}
+    witness:
+      - {path: packages/hfs/src/frontend-boundary-coverage.spec.mjs, editions: [lite, full], codes: [FE_STACK_FORBIDDEN]}
   - id: R245
     code: "BE_APP_OPTIONS_COMPOSITION"
     amendedBy: R289
@@ -3962,74 +4121,71 @@ rules:
     editions: [lite, full]
     docs: [docs/quality-bar.md#coverage-matrix]
     templateNa: "The runtime coverage checker judges authored catalogs and proof metadata; app scaffolds do not contain this runtime surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     kinds: [check]
     gates: [runtime]
     failureCodes: ["RT_COVERAGE_MATRIX", "RT_COVERAGE_NO_ENFORCER", "RT_COVERAGE_NO_SPEC", "RT_COVERAGE_NO_WITNESS", "RT_COVERAGE_NO_DOC", "RT_COVERAGE_NO_TEMPLATE", "RT_COVERAGE_NO_EXAMPLE", "RT_COVERAGE_EDITION_ASYMMETRY", "RT_COVERAGE_SCHEMA_NO_RECORD", "RT_COVERAGE_GATE_LIE", "RT_COVERAGE_SUPERSEDED_CITE", "RT_COVERAGE_SURFACE_UNMAPPED", "RT_COVERAGE_REQUIREMENT_UNLEDGERED", "RT_COVERAGE_PROOF_VACUOUS", "RT_COVERAGE_CODE_UNROUTED"]
     enforcers:
       - {kind: runtime, id: hfs-coverage, at: scripts/checks/check-hfs-coverage.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R248
     code: "ENV_REQUIRED_UNSET"
     editions: [lite, full]
     docs: [docs/host-secrets.md#r248]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/skeleton-lite/apps/api/src/api.env.ts, edition: lite}
-      - {path: packages/hfs/templates/be/skeleton/apps/__app__/src/__app__.env.ts, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The environment keys a back end reads through its typed `EnvSource` (`<app>.env.ts` and the capability `*.config.ts` parse helpers, resolved by a static TypeScript walk that substitutes the literal arguments of a reader's call sites into a template key such as `${prefix}_WEBHOOK_SECRET`), the key names sealed in `.starcistacks/<env>/secrets/*.enc` and the keys the stack declares or passes (`KEYS.md`, `environment:`/`env:` entries, `runtimeSecrets`, `vars[].name`) are one set, compared by name only in both editions: a required read is sealed or declared (ENV_REQUIRED_UNSET), a sealed key is read or has a declared consumer (ENV_SEALED_UNREAD), one key lives in one member (ENV_DUPLICATE), no `NEXT_PUBLIC_*` key is sealed (ENV_PUBLIC_SEALED) and every `*.env.example` key is read (ENV_EXAMPLE_DRIFT)."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["ENV_REQUIRED_UNSET", "ENV_SEALED_UNREAD", "ENV_DUPLICATE", "ENV_PUBLIC_SEALED", "ENV_EXAMPLE_DRIFT"]
     enforcers:
       - {kind: hfs, id: env-parity, at: scripts/hfs/rules/env-parity.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-env-parity.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/skeleton-lite/apps/api/src/api.env.ts, edition: lite}
+      - {path: packages/hfs/templates/be/skeleton/apps/__app__/src/__app__.env.ts, edition: full}
+      - {path: packages/hfs/src/hfs-env-parity.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-env-parity.spec.mjs, editions: [lite, full]}
   - id: R249
     code: "ENV_VALUE_SHAPE"
     editions: [lite, full]
     docs: [docs/host-secrets.md#r249]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/skeleton-lite/apps/api/src/api.env.ts, edition: lite}
-      - {path: packages/hfs/templates/be/skeleton/apps/__app__/src/__app__.env.ts, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "A stored environment value parses as the type its `EnvSource` reader declares (an integer, `true`/`false`, an absolute URL, a duration `250`/`30s`/`5m`/`2h`, a member of the declared enum, a nonempty string or secret): `starci app secret verify <env>` decrypts every member in memory and reports each key and its violated shape, never a value, and a concrete (non-placeholder) value of a `*.env.example` parses the same way."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["ENV_VALUE_SHAPE"]
     enforcers:
       - {kind: hfs, id: env-value-shape, at: scripts/hfs/rules/env-value-shape.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
-
+    proves:
+      - {path: packages/hfs/src/hfs-env-parity.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/skeleton-lite/apps/api/src/api.env.ts, edition: lite}
+      - {path: packages/hfs/templates/be/skeleton/apps/__app__/src/__app__.env.ts, edition: full}
+      - {path: packages/hfs/src/hfs-env-parity.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-env-parity.spec.mjs, editions: [lite, full]}
   - id: R250
     code: "HFS_HOST_CRON"
     editions: [lite, full]
     docs:
       - {path: docs/application-stacks.md#r250-deploy-scan, editions: [lite, full]}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
-      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "In lite and full apps, scheduled work belongs to the back-end scheduler, pgmq/pg_cron or a declared replicated-job. Deployment files, scripts, workflows, compose files and Dockerfiles install no host crontab, cron.d entry, systemd timer, @reboot job or at job; a workflow does not schedule app work. Docker compose up, down and pull run only against an explicitly dev environment. Deploy shell scripts delegate to docker, starci or the app CLI, and contain no node -e, psql, inline SQL or downloaded shell logic."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_HOST_CRON", "HFS_DEPLOY_NO_LOGIC", "HFS_DEPLOY_COMPOSE_ON_VPS", "HFS_DEPLOY_SCHEDULER"]
     enforcers:
       - {kind: hfs, id: deploy-scan, at: scripts/hfs/rules/deploy-scan.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-deploy-scan.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
+      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
+      - {path: packages/hfs/src/hfs-deploy-scan.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-deploy-scan.spec.mjs, editions: [lite, full]}
   - id: R251
     code: "HFS_DEPLOY_WORKFLOW"
     editions: [lite, full]
     docs:
       - {path: docs/application-stacks.md#r251-deploy-workflow, editions: [lite, full]}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml, edition: lite}
-      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*], the release candidate branches release/candidate-* (required in ci.yml: starci app release push waits for that run, owner ruling candidate-ci 2026-10-18) or workflow_dispatch, never on another branch push."
     kinds: [check]
     gates: [settle, land, ci]
@@ -4037,34 +4193,37 @@ rules:
     enforcers:
       - {kind: hfs, id: deploy-workflow, at: scripts/hfs/rules/deploy-workflow.mjs}
       - {kind: hfs, id: supply-chain, at: scripts/hfs/rules/supply-chain.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-deploy-workflow.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml, edition: lite}
+      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
+      - {path: packages/hfs/src/hfs-deploy-workflow.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-deploy-workflow.spec.mjs, editions: [lite, full]}
   - id: R252
     code: "HFS_SCRIPT_PLAINTEXT_LOAD"
     editions: [lite, full]
     docs:
       - {path: docs/application-stacks.md#r252-script-hygiene, editions: [lite, full]}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml, edition: lite}
-      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "In lite and full apps, executable scripts and workflow commands never load plaintext secrets.env, secret.env, .env secret files or a home-directory credential file, enable shell xtrace or request --reveal. Service-role references belong only to the back-end Supabase integration; deployment scripts and source outside that integration never use the service role. Scanners inspect source references and report paths without reading secret files or printing their values."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_SCRIPT_PLAINTEXT_LOAD", "HFS_SCRIPT_XTRACE", "HFS_SERVICE_ROLE_SCOPE"]
     enforcers:
       - {kind: hfs, id: script-hygiene, at: scripts/hfs/rules/script-hygiene.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-script-hygiene.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml, edition: lite}
+      - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
+      - {path: packages/hfs/src/hfs-script-hygiene.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-script-hygiene.spec.mjs, editions: [lite, full]}
   - id: R253
     code: "HFS_AGE_KEY_CUSTODY"
     editions: [lite, full]
     docs: [docs/host-secrets.md#application-secret-rules]
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    exemplifiedBy:
-      - {path: packages/hfs/templates/be/skeleton/src/modules/platform/config/env-source.config.ts, editions: [lite, full]}
-      - {path: packages/hfs/templates/be/skeleton/src/modules/platform/http-security/origin.guard.ts, editions: [lite, full]}
-      - {path: packages/hfs/templates/be/skeleton/src/modules/platform/http-security/webhook-signature.service.ts, editions: [lite, full]}
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The age identity that seals and opens an app's `.starcistacks/<env>/secrets/*.enc` is host-local custody only: it lives in the untracked `.claude/secret.env` (as `SOPS_AGE_KEY`, which wins over the legacy `keys.txt` and is handed to sops through the `SOPS_AGE_KEY` child environment, never as an argument and never printed) or in the sops config dir's `keys.txt`; a tracked `.claude/secret.env`, `keys.txt` or `*.agekey` is the identity committed. The three files the secret custody depends on - `src/modules/platform/config/env-source.config.ts`, `src/modules/platform/http-security/origin.guard.ts` and `src/modules/platform/http-security/webhook-signature.service.ts` - are hash-sensitive canon, not files to edit: their bytes equal the `be/skeleton` template they were scaffolded from, judged by sha256."
     kinds: [check]
     gates: [settle, land, ci]
@@ -4072,45 +4231,57 @@ rules:
     enforcers:
       - {kind: hfs, id: secret-age-key-custody, at: scripts/hfs/rules/secrets.mjs}
       - {kind: hfs, id: canon-copy-drift, at: scripts/hfs/rules/canon-copy-drift.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-secret-custody.spec.mjs, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/skeleton/src/modules/platform/config/env-source.config.ts, editions: [lite, full]}
+      - {path: packages/hfs/templates/be/skeleton/src/modules/platform/http-security/origin.guard.ts, editions: [lite, full]}
+      - {path: packages/hfs/templates/be/skeleton/src/modules/platform/http-security/webhook-signature.service.ts, editions: [lite, full]}
+      - {path: packages/hfs/src/hfs-secret-custody.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-secret-custody.spec.mjs, editions: [lite, full]}
   - id: R254
     code: "DB_BE_ONLY_ACCESS"
     editions: [lite]
     editionWhy: "owner:lite-backing-services makes Supabase lite's database backing; these SQL access requirements apply to that backing."
     docs: [docs/microservices.md#r254]
     templateNa: "Browser grants, policies and publication membership belong to product-authored Supabase migrations, rather than a scaffolded SQL surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "In lite and full, browser data access stays closed on exposed schemas: authenticated receives neither table or sequence privileges nor data policies, and anon reads only through a select policy named *_public_read. A table listed in hfs.json supabase.directAccess is an explicit exception. A table joins supabase_realtime only when that direct access is declared. The front end uses Supabase for Auth and reaches product data through the back end."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_BE_ONLY_ACCESS", "DB_REALTIME_UNLISTED"]
     enforcers:
       - {kind: hfs, id: db-be-only-access, at: scripts/hfs/rules/database-access.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: lite, codes: [DB_BE_ONLY_ACCESS, DB_REALTIME_UNLISTED]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: lite, codes: [DB_BE_ONLY_ACCESS, DB_REALTIME_UNLISTED]}
+    witness:
+      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: lite, codes: [DB_BE_ONLY_ACCESS, DB_REALTIME_UNLISTED]}
   - id: R255
     code: "DB_APP_ROLE"
     editions: [lite]
     editionWhy: "owner:lite-backing-services makes Supabase lite's database backing; application-role and forced-RLS requirements apply to that backing."
     docs: [docs/microservices.md#r255]
     templateNa: "Application roles and table ownership are product-authored Supabase migration content, rather than a scaffolded SQL surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "The declared back-end database role (hfs.json supabase.appRole, app_be by default) has only the privileges it needs: role declarations refuse superuser and bypassrls, require noinherit and nobypassrls, and never grant all schema or table privileges. Tables owned by that role enable and force row level security by default; a forceRls exemption identifies the table and carries a nonempty reason. This applies to every edition that declares Supabase."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_APP_ROLE", "DB_FORCE_RLS_DEFAULT"]
     enforcers:
       - {kind: hfs, id: db-app-role, at: scripts/hfs/rules/database-access.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: lite, codes: [DB_APP_ROLE, DB_FORCE_RLS_DEFAULT]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: lite, codes: [DB_APP_ROLE, DB_FORCE_RLS_DEFAULT]}
+    witness:
+      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: lite, codes: [DB_APP_ROLE, DB_FORCE_RLS_DEFAULT]}
   - id: R256
     code: "DB_POLICY_TAUTOLOGY"
     editions: [lite]
     editionWhy: "owner:lite-backing-services makes Supabase lite's database backing; access-policy, view, definer and storage SQL requirements apply to that backing."
     docs: [docs/microservices.md#r256]
     templateNa: "Access policies, views, definers and storage policies belong to product-authored Supabase migrations, rather than a scaffolded SQL surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "Exposed database objects keep their access boundaries in lite and full. Policies refuse tautological true, is-not-null and self-equality predicates; policies for browser roles prove a principal predicate. An exposed view or materialized view uses security_invoker or the migration set ends with access revoked from anon and authenticated. Disabling RLS or moving a table into an exposed schema preserves the R214 RLS obligation. A security definer declaration, including alter function, preserves R215 safety checks and the migration set ends with execute revoked from authenticated when exposed, in addition to R215's public and anon revocation. A storage.objects policy scopes an ownership prefix to the principal unless its bucket id ends _public."
     kinds: [check]
     gates: [settle, land, ci]
@@ -4118,46 +4289,57 @@ rules:
     enforcers:
       - {kind: hfs, id: db-policy-hardening, at: scripts/hfs/rules/database-access.mjs}
       - {kind: hfs, id: db-definer-revoke, at: scripts/hfs/rules/database-plpgsql.mjs}
-
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: lite, codes: [DB_POLICY_TAUTOLOGY, DB_VIEW_UNSAFE, DB_STORAGE_PREFIX]}
+      - {path: packages/hfs/src/hfs-database-rules.spec.mjs, edition: lite, codes: [DB_DEFINER_REVOKE]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: lite, codes: [DB_POLICY_TAUTOLOGY, DB_VIEW_UNSAFE, DB_STORAGE_PREFIX]}
+      - {path: packages/hfs/src/hfs-database-rules.spec.mjs, edition: lite, codes: [DB_DEFINER_REVOKE]}
+    witness:
+      - {path: packages/hfs/src/hfs-database-access.spec.mjs, edition: lite, codes: [DB_POLICY_TAUTOLOGY, DB_VIEW_UNSAFE, DB_STORAGE_PREFIX]}
+      - {path: packages/hfs/src/hfs-database-rules.spec.mjs, edition: lite, codes: [DB_DEFINER_REVOKE]}
   - id: R257
     code: "DB_BASELINE_SHAPE"
     editions: [lite]
     editionWhy: "owner:lite-backing-services makes Supabase lite's database backing; baseline and archive requirements apply to its migration history."
     docs: [docs/microservices.md#r257]
     templateNa: "A baseline is derived from a product's existing Supabase migration history and cannot be supplied by a scaffold template."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "An archived migration chain has exactly one active baseline marked -- starci:baseline <archived-last-stamp>, with a later valid stamp or an explicit restamp. Archived files only need the digits-stamp_name.sql shape, whatever the stamp value (they are immutable history and never applied); the baseline and active migrations keep the real-instant stamp check. Archive contents are immutable against repository history; an active migration enters the archive unchanged only in the same diff that adds the replacement baseline. The app db baseline, restamp and plan verbs are read-only unless --apply is explicit."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_BASELINE_SHAPE", "DB_ARCHIVE_MUTATED"]
     enforcers:
       - {kind: hfs, id: db-baseline-shape, at: scripts/hfs/rules/database-baseline.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-database-baseline.spec.mjs, edition: lite, codes: [DB_BASELINE_SHAPE, DB_ARCHIVE_MUTATED]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-database-baseline.spec.mjs, edition: lite, codes: [DB_BASELINE_SHAPE, DB_ARCHIVE_MUTATED]}
+    witness:
+      - {path: packages/hfs/src/hfs-database-baseline.spec.mjs, edition: lite, codes: [DB_BASELINE_SHAPE, DB_ARCHIVE_MUTATED]}
   - id: R258
     code: "DB_PGMQ_DECLARED"
     editions: [lite]
     editionWhy: "owner:lite-backing-services makes Supabase lite's database backing; pgmq and pg_cron ownership requirements apply to that backing."
     docs: [docs/microservices.md#r258]
     templateNa: "Queue declarations and enqueue-only cron commands depend on product-owned work and are authored in its Supabase migrations."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "DB_QUEUE_CRON: every pgmq queue constant has an active migration creating the queue and every created queue has a constant. Queue objects are granted only to the application role. A uniquely named pg_cron job belongs to a migration and only enqueues to an existing queue directly or through one enqueue-only *_tick function; it executes no business DML or HTTP request and shares no tick with an app scheduler. Removing a tick unschedules its job."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_PGMQ_DECLARED", "DB_CRON_OWNED"]
     enforcers:
       - {kind: hfs, id: db-queue-cron, at: scripts/hfs/rules/database-queues.mjs}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-database-queues.spec.mjs, edition: lite, codes: [DB_PGMQ_DECLARED, DB_CRON_OWNED]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-database-queues.spec.mjs, edition: lite, codes: [DB_PGMQ_DECLARED, DB_CRON_OWNED]}
+    witness:
+      - {path: packages/hfs/src/hfs-database-queues.spec.mjs, edition: lite, codes: [DB_PGMQ_DECLARED, DB_CRON_OWNED]}
   - id: R259
     code: "DB_EXTENSION_ALLOWED"
     editions: [lite]
     editionWhy: "owner:lite-backing-services makes Supabase lite's database backing; database configuration, extension, migration and seed requirements apply to that backing."
     docs: [docs/microservices.md#r259]
     templateNa: "Extension use, contract migrations, vault operations and seed literals are product-authored Supabase content, rather than a scaffolded SQL surface."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
     law: "DB_CONFIG_EXT: extensions belong to the database allowlist, vault writes and migration role passwords are refused, pgmq schemas are never exposed through the API, and lite API access is closed except for explicit public-read policies. R216 DB_CONFIG_POLICY also checks API schema allowlisting, existing seed paths, anonymous sign-ins, disabled edge runtime, bounded storage uploads and the database major-version pin. Destructive DDL belongs only to *_contract_* migrations whose targets are no longer referenced by back-end SQL or entities. Seeds contain no real email or phone literals."
     kinds: [check]
     gates: [settle, land, ci]
@@ -4165,8 +4347,12 @@ rules:
     enforcers:
       - {kind: hfs, id: db-config-ext, at: scripts/hfs/rules/database-config.mjs}
       - {kind: hfs, id: db-migration-destructive, at: scripts/hfs/rules/database-migrations.mjs}
-
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-database-config.spec.mjs, editions: [lite], codes: [DB_EXTENSION_ALLOWED, DB_API_EXPOSED, DB_MIGRATION_DESTRUCTIVE, HFS_SEED_PII, DB_VAULT_WRITE]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-database-config.spec.mjs, editions: [lite], codes: [DB_EXTENSION_ALLOWED, DB_API_EXPOSED, DB_MIGRATION_DESTRUCTIVE, HFS_SEED_PII, DB_VAULT_WRITE]}
+    witness:
+      - {path: packages/hfs/src/hfs-database-config.spec.mjs, editions: [lite], codes: [DB_EXTENSION_ALLOWED, DB_API_EXPOSED, DB_MIGRATION_DESTRUCTIVE, HFS_SEED_PII, DB_VAULT_WRITE]}
   - id: R260
     code: "BE_JWT_ALG_PINNED"
     law: "A back-end JWT verifier pins a nonempty literal subset of ES256, RS256 and EdDSA and obtains its issuer from configuration. A Supabase principal is built only after verification and rejection of every role other than authenticated, in lite and full."
@@ -4180,15 +4366,16 @@ rules:
     templateNa: "Full identity providers are product-owned integrations with no scaffolded JWT verifier; the lite Supabase verifier is templated and both editions are exercised by the verifier specs."
     docs:
       - "docs/microservices.md#r260"
+    proves:
+      - "packages/eslint/be/jwt-alg.spec.mjs"
+      - packages/hfs/src/architecture-jwt-policy.spec.mjs
     exemplifiedBy:
       - {"path":"packages/hfs/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.jwks.ts","edition":"lite"}
       - {"path":"examples/lite-app/be/src/modules/integrations/supabase/supabase.jwks.ts","edition":"lite"}
       - {"path":"packages/eslint/be/jwt-alg.spec.mjs","edition":"full","codes":["BE_JWT_ALG_PINNED"]}
-    proves:
-      - "packages/eslint/be/jwt-alg.spec.mjs"
     witness:
       - {"path":"packages/eslint/be/jwt-alg.spec.mjs","editions":["lite","full"],"codes":["BE_JWT_ALG_PINNED"]}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+      - {path: packages/hfs/src/architecture-jwt-policy.spec.mjs, editions: [lite, full], codes: [BE_JWT_ALG_PINNED]}
   - id: R261
     code: "BE_CORS_ALLOWLIST"
     law: "Every back-end API declares an exact browser origin allowlist, applies the platform/http-security response middleware, disables x-powered-by and states a nonnegative integer trust proxy hop count. Wildcard or missing CORS and blanket proxy trust are refused in lite and full."
@@ -4225,17 +4412,19 @@ rules:
     editions: ["lite","full"]
     docs:
       - "docs/microservices.md#r262"
+    proves:
+      - {"path":"packages/eslint/be/health-ready.spec.mjs","editions":["lite","full"],"codes":["BE_READY_REAL","BE_HEALTH_SIGNALS"]}
+      - {path: packages/hfs/src/be-docker-health.spec.mjs, editions: [lite, full], codes: [HFS_DOCKER_HEALTHCHECK_FAKE]}
     exemplifiedBy:
       - {"path":"packages/hfs/templates/be/skeleton/src/features/api/system-health/transport/http/ready.controller.ts","editions":["lite","full"]}
       - {"path":"packages/hfs/templates/be/skeleton/src/modules/platform/http-security/readiness.service.ts","editions":["lite","full"]}
       - {"path":"packages/hfs/templates/be/image/api/Dockerfile","editions":["lite","full"]}
       - {"path":"packages/eslint/be/health-ready.spec.mjs","editions":["lite","full"],"codes":["BE_READY_REAL","BE_HEALTH_SIGNALS"]}
-    proves:
-      - {"path":"packages/eslint/be/health-ready.spec.mjs","editions":["lite","full"],"codes":["BE_READY_REAL","BE_HEALTH_SIGNALS"]}
+      - {path: packages/hfs/src/be-docker-health.spec.mjs, editions: [lite, full], codes: [HFS_DOCKER_HEALTHCHECK_FAKE]}
     witness:
       - {"path":"packages/eslint/be/health-ready.spec.mjs","editions":["lite","full"],"codes":["BE_READY_REAL","BE_HEALTH_SIGNALS"]}
 
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+      - {path: packages/hfs/src/be-docker-health.spec.mjs, editions: [lite, full], codes: [HFS_DOCKER_HEALTHCHECK_FAKE]}
   - id: R263
     code: "BE_WEBHOOK_SCOPE"
     amendedBy: [owner:oauth-redirect-not-webhook, owner:webhook-receipt-port]
@@ -4320,13 +4509,16 @@ rules:
     codeEditions: {"STACKS_REALTIME_SCALED":["lite"]}
     docs:
       - "docs/application-stacks.md#r266"
+    proves:
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
+      - {path: packages/hfs/src/hfs-stacks-ingress.spec.mjs}
+      - {path: packages/hfs/src/hfs-stacks-swarm.spec.mjs, editions: [lite, full]}
     exemplifiedBy:
       - {"path":"packages/hfs/templates/app/skeleton-lite/.starcistacks","edition":"lite"}
       - {"path":"packages/hfs/templates/app/skeleton/.starcistacks","edition":"full"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-stacks-swarm.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-stacks-swarm.spec.mjs, editions: [lite, full]}
   - id: R267
     code: "STACKS_RELEASE_UNDECLARED"
     law: "Each Swarm environment declares an immutable images lock, active and previous release pointers and nonempty health assertions. Every stateful component and declared managed backing dependency declares backup target, retention and owner with a tracked restore proof. The rendered deployment model must be available and valid; an unavailable model is a finding, never a skipped check."
@@ -4338,13 +4530,17 @@ rules:
     editions: ["lite","full"]
     docs:
       - "docs/application-stacks.md#r267"
+    proves:
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
+      - packages/hfs/src/hfs-stacks-release.spec.mjs
     exemplifiedBy:
       - {"path":"packages/hfs/templates/app/skeleton-lite/.starcistacks","edition":"lite"}
       - {"path":"packages/hfs/templates/app/skeleton/.starcistacks","edition":"full"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-stacks-release.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-stacks-release.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
   - id: R268
     code: "HFS_SCHEDULE_UNDECLARED"
     law: "Every app scheduler, active pg_cron schedule, selected scheduled component and rendered replicated-job has a matching top-level jobs declaration with its schedule and invocation of a named back-end CLI action. A rendered replicated-job uses the same declared CLI invocation; inline JavaScript and shell chaining are refused. Scheduling is app-owned; a manifest entry never grants host crontab or deployment business logic."
@@ -4356,13 +4552,17 @@ rules:
     editions: ["lite","full"]
     docs:
       - "docs/application-stacks.md#r268"
+    proves:
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
+      - packages/hfs/src/hfs-stacks-release.spec.mjs
     exemplifiedBy:
       - {"path":"packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml","edition":"lite"}
       - {"path":"packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml","edition":"full"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-stacks-release.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-stacks-release.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
   - id: R269
     code: "HFS_DEPENDABOT_MISSING"
     law: "In lite and full apps, .github/dependabot.yml declares scheduled npm, github-actions and docker updates. Every npm entry declares a minor-and-patch version group and a security-updates group; every group explicitly restricts update-types to minor and patch, leaving majors per package, and npm entries ignore @starci/* without version or update-type restrictions. The CI workflow runs npm audit --omit=dev as an enabled gate whose failure stops the job. The images workflow generates an SBOM and provenance for release images; a disabled step, comment or label is not evidence."
@@ -4374,6 +4574,8 @@ rules:
     editions: ["lite","full"]
     docs:
       - "docs/application-stacks.md#r269"
+    proves:
+      - {path: packages/hfs/src/hfs-supply-chain.spec.mjs, editions: [lite, full]}
     exemplifiedBy:
       - {"path":"packages/hfs/templates/app/skeleton-lite/.github/dependabot.yml","edition":"lite"}
       - {"path":"packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml","edition":"lite"}
@@ -4381,10 +4583,11 @@ rules:
       - {"path":"packages/hfs/templates/app/skeleton/.github/dependabot.yml","edition":"full"}
       - {"path":"packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml","edition":"full"}
       - {"path":"packages/hfs/templates/app/ci-workflows/github/workflows/images.yml","edition":"full"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-supply-chain.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-supply-chain.spec.mjs, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-supply-chain.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-supply-chain.spec.mjs, edition: full}
   - id: R270
     code: "HFS_DOC_PATH_MISSING"
     law: "In lite and full products, READMEs, docs and stack READMEs cite existing repository paths, npm scripts, starci app verbs, environment keys declared by typed readers or KEYS.md, and rule ids from the HFS catalog. Documentation changes with the product it describes."
@@ -4396,12 +4599,16 @@ rules:
     editions: ["lite","full"]
     docs:
       - "docs/quality-bar.md#r270"
+    proves:
+      - {path: packages/hfs/src/hfs-doc-fresh.spec.mjs, editions: [lite, full]}
     exemplifiedBy:
       - {"path":"packages/hfs/templates/app/skeleton-lite/README.md","edition":"lite"}
       - {"path":"packages/hfs/templates/app/skeleton/README.md","edition":"full"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-doc-fresh.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-doc-fresh.spec.mjs, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-doc-fresh.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-doc-fresh.spec.mjs, edition: full}
   - id: R271
     code: "HFS_RELEASE_TAG_MISMATCH"
     law: "A lite or full product release uses a v-prefixed semantic version tag equal to package.json version; images.yml publishes images under that release tag, and every database deployment refuses a non-tag ref before migration."
@@ -4413,14 +4620,17 @@ rules:
     editions: ["lite","full"]
     docs:
       - "docs/application-stacks.md#r271"
+    proves:
+      - {path: packages/hfs/src/hfs-release-provenance.spec.mjs, editions: [lite, full]}
     exemplifiedBy:
       - {"path":"packages/hfs/templates/app/ci-workflows-lite/github/workflows/images.yml","edition":"lite"}
       - {"path":"packages/hfs/templates/app/ci-workflows/github/workflows/images.yml","edition":"full"}
       - {"path":"packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml","edition":"lite"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-release-provenance.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-release-provenance.spec.mjs, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-release-provenance.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-release-provenance.spec.mjs, edition: full}
   - id: R272
     code: "BE_APP_BOOT_PROOF_MISSING"
     law: "Every lite back-end app proves its real Nest AppModule composition by compiling the dependency graph with explicit fixture options and infrastructure doubles; unresolved providers, circular dependencies and a missing or failed proof are refused. The app check wiring verb uses the same proof. Full retains its existing e2e boot proof."
@@ -4433,12 +4643,14 @@ rules:
     editionWhy: "ruling:R272 requires the lite Nest wiring proof; full retains its existing e2e boot proof and the boot-proof finder skips full."
     docs:
       - "docs/quality-bar.md#r272"
+    proves:
+      - {path: packages/hfs/src/hfs-boot-proof.spec.mjs, editions: [lite]}
     exemplifiedBy:
       - {"path":"packages/hfs/templates/be/skeleton-lite/src/tests/fixtures/builders/api.builder.ts","edition":"lite"}
       - {"path":"examples/lite-app/be/src/tests/fixtures/builders/api.builder.ts","edition":"lite"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-boot-proof.spec.mjs, edition: lite}
+    witness:
+      - {path: packages/hfs/src/hfs-boot-proof.spec.mjs, edition: lite}
   - id: R273
     code: "HFS_COVERAGE_BELOW"
     law: "An app check supplied with a coverage-from lcov report proves 100 percent lines, functions and branches per tracked back-end logic file in the edition's slot-derived measured scope; a missing source record or unavailable metric is refused. The unit runner also enforces statement coverage. Reports list the measured scope and the source files outside it, including features, cli and webhooks."
@@ -4450,13 +4662,18 @@ rules:
     editions: ["lite","full"]
     docs:
       - "docs/quality-bar.md#r273"
+    proves:
+      - {path: packages/hfs/src/hfs-coverage-below.spec.mjs, editions: [lite, full]}
     exemplifiedBy:
       - {"path":"packages/hfs/templates/be/tool-config/jest.config.js","editions":["lite","full"]}
       - {"path":"examples/lite-app/be/jest.config.js","edition":"lite"}
       - {"path":"examples/full-app/be/jest.config.js","edition":"full"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+      - {path: packages/hfs/src/hfs-coverage-below.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-coverage-below.spec.mjs, edition: full}
+      - {path: examples/ecommerce-app/be/jest.config.js, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-coverage-below.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-coverage-below.spec.mjs, edition: full}
   - id: R274
     code: "RT_RULING_STALE_CITE"
     law: "Live prose, source comments and spec titles cite current owner rulings using ruling:R212/case-4 or a stable owner id. A superseded or amended ruling needs its live successor in the same paragraph; staleWhen statements outside historical case text and CHANGELOGs are refused, and a bare owner ruling date must match a catalog case or owner ruling."
@@ -4470,10 +4687,6 @@ rules:
     templateNa: "Runtime owner-ruling citation metadata has no product scaffold surface; passing and stale authored-source fixtures live in the ruling-cites spec."
     docs:
       - "docs/quality-bar.md#r274"
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R275
     code: "STACKS_INGRESS_UNDECLARED"
     law: "Every Swarm environment declares its one ingress component and hosts. The named component has role ingress and a digest-pinned supported ingress image; Traefik and Caddy are both accepted without a preferred product. An absent declaration, unknown component or unsupported image is refused."
@@ -4485,13 +4698,17 @@ rules:
     editions: ["lite","full"]
     docs:
       - "docs/application-stacks.md#r275"
+    proves:
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
+      - packages/hfs/src/hfs-stacks-ingress.spec.mjs
     exemplifiedBy:
       - {"path":"packages/hfs/templates/app/skeleton-lite/.starcistacks","edition":"lite"}
       - {"path":"packages/hfs/templates/app/skeleton/.starcistacks","edition":"full"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-stacks-ingress.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
+    witness:
+      - {path: packages/hfs/src/hfs-stacks-ingress.spec.mjs, edition: lite}
+      - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
   - id: R276
     code: "STACKS_LITE_SELFHOSTED_DB"
     law: "Lite uses managed Supabase and runs no PostgreSQL, Redis or MongoDB backing image. A sidecar that needs a database uses SQLite on a named persistent volume declared by its component and mounted in the rendered model; a sidecar requiring another database is refused. Full retains its declared backing topology."
@@ -4504,12 +4721,12 @@ rules:
     editionWhy: "ruling:R276 records owner ruling 4: lite uses managed Supabase, refuses self-hosted backing images and permits database-dependent sidecars only with SQLite on declared persistent volumes; full keeps its declared backing topology."
     docs:
       - "docs/application-stacks.md#r276"
+    proves: [packages/hfs/src/hfs-stacks-lite-backing.spec.mjs]
     exemplifiedBy:
       - {"path":"packages/hfs/templates/app/skeleton-lite/.starcistacks","edition":"lite"}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-stacks-lite-backing.spec.mjs, edition: lite}
+    witness:
+      - {path: packages/hfs/src/hfs-stacks-lite-backing.spec.mjs, edition: lite}
   - id: R277
     code: "HFS_SECRET_PLAINTEXT_FILE"
     law: "In every edition the only custody a tracked secret may take is a sops envelope at `.starcistacks/<env>/secrets/**.enc`. A tracked plaintext secret file is refused by being: `secrets.env` or `.secret(s).env` at any depth, a non-dot `*.env` or `*.env.<profile>` holding secret keys (deploy-side dotenv included), and a plaintext member of a `secrets/` directory; a sealed `.enc` outside the one sealed home is refused too (for lite it is already `HFS_LITE_SECRET_CUSTODY`)."
@@ -4522,10 +4739,15 @@ rules:
     codeEditions: {HFS_SECRET_OUTSIDE_ENC: [full]}
     docs: [docs/host-secrets.md#r277]
     templateNa: "Sealed secret members are owner-created through starci app secret set after custody initialization; the scaffolder does not generate committed secret material."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-secret-custody.spec.mjs, editions: [lite, full], codes: [HFS_SECRET_PLAINTEXT_FILE]}
+      - {path: packages/hfs/src/hfs-secret-custody.spec.mjs, editions: [full], codes: [HFS_SECRET_OUTSIDE_ENC]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-secret-custody.spec.mjs, editions: [lite, full], codes: [HFS_SECRET_PLAINTEXT_FILE]}
+      - {path: packages/hfs/src/hfs-secret-custody.spec.mjs, editions: [full], codes: [HFS_SECRET_OUTSIDE_ENC]}
+    witness:
+      - {path: packages/hfs/src/hfs-secret-custody.spec.mjs, editions: [lite, full], codes: [HFS_SECRET_PLAINTEXT_FILE]}
+      - {path: packages/hfs/src/hfs-secret-custody.spec.mjs, editions: [full], codes: [HFS_SECRET_OUTSIDE_ENC]}
   - id: R278
     code: "BE_REST_DOOR_EVIDENCE"
     amendedBy: [owner:credential-guarded-rest-door]
@@ -4581,10 +4803,11 @@ rules:
     exemplifiedBy:
       - {path: packages/hfs/templates/be/skeleton/src/modules/domain/identity/errors/identity.error.ts, editions: [lite, full]}
       - {path: packages/hfs/templates/be/skeleton/src/modules/domain/identity/admission.policy.ts, editions: [lite, full]}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-unused-symbol-ledger.spec.mjs, editions: [lite, full], codes: [HFS_UNUSED_SYMBOL]}
+    proves:
+      - {path: packages/hfs/src/hfs-unused-symbol-ledger.spec.mjs, editions: [lite, full], codes: [HFS_UNUSED_SYMBOL]}
+    witness:
+      - {path: packages/hfs/src/hfs-unused-symbol-ledger.spec.mjs, editions: [lite, full], codes: [HFS_UNUSED_SYMBOL]}
   - id: R281
     code: "BE_SPEC_FORM_ALL_ROLES"
     law: "Unit spec form applies to every declared logic role, including policies, mappers, guards and integration clients. A spec obtains its subject from a compiled Nest testing module with explicit providers, never constructs the subject or mocks an own module or third-party library, and asserts behavior or state rather than only toBeDefined existence checks."
@@ -4620,10 +4843,12 @@ rules:
     editions: [lite, full]
     docs: [docs/quality-bar.md#r282]
     templateNa: "Build assets are supplied by each application; the scaffolder does not generate binary assets, model weights or datasets."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-assets.spec.mjs, editions: [lite, full], codes: [HFS_ASSET_OVERSIZE, HFS_ASSET_KIND]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-assets.spec.mjs, editions: [lite, full], codes: [HFS_ASSET_OVERSIZE, HFS_ASSET_KIND]}
+    witness:
+      - {path: packages/hfs/src/hfs-assets.spec.mjs, editions: [lite, full], codes: [HFS_ASSET_OVERSIZE, HFS_ASSET_KIND]}
   - id: R283
     code: "HFS_APP_LEXICON"
     law: "An app's source and documentation use the current product vocabulary: a word declared in hfs.json lexicon.removed is refused as a whole word or identifier segment, in both editions."
@@ -4635,10 +4860,12 @@ rules:
     editions: [lite, full]
     docs: [docs/quality-bar.md#r283]
     templateNa: "Removed product vocabulary is application-specific hfs.json content; there is no canonical product lexicon to scaffold."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-lexicon.spec.mjs, editions: [lite, full], codes: [HFS_APP_LEXICON]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-lexicon.spec.mjs, editions: [lite, full], codes: [HFS_APP_LEXICON]}
+    witness:
+      - {path: packages/hfs/src/hfs-lexicon.spec.mjs, editions: [lite, full], codes: [HFS_APP_LEXICON]}
   - id: R284
     code: "BE_LITE_PROOF_LANE_MISSING"
     law: "A lite back end declaring event-bus, queue, webhooks, realtime, fenced-job, projection or saga proves each declared pattern through integration specs under src/tests/integration: runnable tests carry titles `<pattern>/<scenario>: ...` for every required scenario of that pattern. A missing integration lane is refused; missing scenario proofs use R155's BE_PATTERN_SPEC_MISSING. Full-edition pattern proof behavior is unchanged."
@@ -4651,10 +4878,12 @@ rules:
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite has no e2e world and proves declared patterns in its integration lane; R284 owns only the lite lane code while full retains its existing pattern-proof rules."
     docs: [docs/quality-bar.md#r284]
     templateNa: "Integration scenarios depend on the application patterns and providers; no universal runnable scenario lane is scaffolded."
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+    proves:
+      - {path: packages/hfs/src/hfs-lite-proof-lane.spec.mjs, editions: [lite], codes: [BE_LITE_PROOF_LANE_MISSING]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-lite-proof-lane.spec.mjs, editions: [lite], codes: [BE_LITE_PROOF_LANE_MISSING]}
+    witness:
+      - {path: packages/hfs/src/hfs-lite-proof-lane.spec.mjs, editions: [lite], codes: [BE_LITE_PROOF_LANE_MISSING]}
   - id: R285
     code: "FE_SWR_OUTSIDE_FAMILY"
     law: "SWR runtime calls belong to the declared SWR hook family. A component, feature or domain hook consumes its wrapper hook instead of importing an API operation or calling SWR itself; each back-end operation is imported and invoked only by its SWR wrapper under hooks/swr, regardless of whether the tier matrix still permits a direct transport edge."
@@ -4728,12 +4957,13 @@ rules:
       - {kind: hfs, id: fe-stack-allowlist, at: scripts/hfs/rules/fe-stack.mjs}
     editions: [lite, full]
     docs: [docs/quality-bar.md#r288]
+    proves:
+      - {path: packages/hfs/src/hfs-fe-stack.spec.mjs, editions: [lite, full], codes: [FE_STACK_UNLISTED, FE_STACK_CORE_MISSING]}
     exemplifiedBy:
       - {path: packages/hfs/templates/fe/app/package.json.tpl, editions: [lite, full]}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
+      - {path: packages/hfs/src/hfs-fe-stack.spec.mjs, editions: [lite, full], codes: [FE_STACK_UNLISTED, FE_STACK_CORE_MISSING]}
+    witness:
+      - {path: packages/hfs/src/hfs-fe-stack.spec.mjs, editions: [lite, full], codes: [FE_STACK_UNLISTED, FE_STACK_CORE_MISSING]}
   - id: R289
     code: "BE_APP_ENV_REQUIRED"
     law: "Every declared back-end app owns a tracked apps/<app>/src/<app>.env.ts exporting its typed environment interface and read<App>Env(env: EnvSource). main.ts constructs EnvSource once and delegates its reads to that reader, with no inline parsing. app.module.ts composes module lists only by spreading compose/<area>.ts groups; its own providers are limited to app-wide guards and filters."
@@ -4746,18 +4976,20 @@ rules:
       - {kind: eslint-be, id: app-module-list-inline}
     editions: [lite, full]
     docs: [docs/microservices.md#r289]
+    proves:
+      - {path: packages/eslint/be/app-composition.spec.mjs, editions: [lite, full], codes: [BE_APP_ENV_REQUIRED, BE_APP_MODULE_LIST_INLINE]}
+      - {path: packages/hfs/src/hfs-app-env-required.spec.mjs, editions: [lite, full], codes: [BE_APP_ENV_REQUIRED]}
     exemplifiedBy:
       - {path: packages/eslint/be/app-composition.spec.mjs, editions: [lite, full], codes: [BE_APP_ENV_REQUIRED, BE_APP_MODULE_LIST_INLINE]}
       - {path: packages/hfs/templates/be/skeleton/apps/__app__/src/__app__.env.ts, editions: [full]}
       - {path: packages/hfs/templates/be/skeleton/apps/__app__/src/app.module.ts, editions: [full]}
       - {path: packages/hfs/templates/be/skeleton-lite/apps/api/src/api.env.ts, editions: [lite]}
       - {path: packages/hfs/templates/be/skeleton-lite/apps/api/src/app.module.ts, editions: [lite]}
-    proves:
-      - {path: packages/eslint/be/app-composition.spec.mjs, editions: [lite, full], codes: [BE_APP_ENV_REQUIRED, BE_APP_MODULE_LIST_INLINE]}
+      - {path: packages/hfs/src/hfs-app-env-required.spec.mjs, editions: [lite, full], codes: [BE_APP_ENV_REQUIRED]}
     witness:
       - {path: packages/eslint/be/app-composition.spec.mjs, editions: [lite, full], codes: [BE_APP_ENV_REQUIRED, BE_APP_MODULE_LIST_INLINE]}
 
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the package specs named in proves keep proving the lint enforcers, the runtime-code enforcers lost their deleted runtime spec"
+      - {path: packages/hfs/src/hfs-app-env-required.spec.mjs, editions: [lite, full], codes: [BE_APP_ENV_REQUIRED]}
   - id: R290
     code: "BE_PUBLIC_REASON_CLOSED"
     amendedBy: [owner:credential-guarded-rest-door]
@@ -4812,13 +5044,16 @@ rules:
       - {kind: hfs, id: feature-files, at: scripts/hfs/rules/feature-files.mjs}
     editions: [lite, full]
     docs: [docs/quality-bar.md#r292]
+    proves:
+      - {path: packages/hfs/src/hfs-feature-files.spec.mjs, editions: [lite, full], codes: [HFS_FEATURE_FILE_BUDGET]}
     exemplifiedBy:
       - {path: packages/hfs/templates/be/patterns/api, editions: [lite, full]}
       - {path: examples/lite-app/be/src/features/api/bookings, editions: [lite]}
       - {path: examples/full-app/be/src/features/api/checkout, editions: [full]}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+      - {path: packages/hfs/src/hfs-feature-files.spec.mjs, editions: [lite, full], codes: [HFS_FEATURE_FILE_BUDGET]}
+      - {path: examples/ecommerce-app/be/src/features/api/checkout, editions: [full]}
+    witness:
+      - {path: packages/hfs/src/hfs-feature-files.spec.mjs, editions: [lite, full], codes: [HFS_FEATURE_FILE_BUDGET]}
   - id: R293
     code: "STACK_TOOLING_REIMPLEMENTED"
     law: "In lite and full apps, an app does not re-implement the Swarm deploy tooling the canon ships as `starci app stack <verb>`. Tracked deploy sources (files under deploy/ and scripts/, the scripts of package.json and every workflow except the managed stack-deploy.yml) never call a docker command a verb owns (docker stack deploy and config, docker secret and config create and rm, docker service ls, ps, inspect and update, docker swarm init, docker volume create, docker node ls), and deploy/ holds no render, provision, converge, verify, prune, rollback, release, backup, prepare, doctor, jobs or public script. A finding names the file and the replacing verb, never a snippet; docker stack rm, ls, ps and services, docker compose, docker run, exec, ps and logs, comments, documents and `starci app stack ...` command lines are not judged."
@@ -4830,15 +5065,14 @@ rules:
     editions: [lite, full]
     docs:
       - {path: docs/application-stacks.md#r293, editions: [lite, full]}
+    proves:
+      - {path: packages/hfs/src/hfs-stack-tooling.spec.mjs, editions: [lite, full]}
     exemplifiedBy:
       - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/stack-deploy.yml, edition: lite}
       - {path: packages/hfs/templates/app/ci-workflows/github/workflows/stack-deploy.yml, edition: full}
       - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
       - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
       - {path: examples/lite-app/.github/workflows/stack-deploy.yml, edition: lite}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
   - id: R294
     code: "STACKS_DEPLOY_CONFIG_INVALID"
     law: "In lite and full apps, every docker-swarm environment of .starcistacks/application-stacks.yaml that declares environments.<env>.deploy declares a coherent block: it is judged by the same normalizeDeploy the `starci app stack` verbs use, against the real tree. Unknown fields are refused, names, keys, volumes, hosts, URLs and commands match their patterns, the config and public environment files exist below .starcistacks/<env>/, every service names a service of the first stack source, every sealed member has a secrets/<member>.enc file, verify entries and configs are well formed with unique config names, and the backup helper image is pinned by a real sha256 digest (no placeholder). Each problem is one finding at environments.<env>.<field>; an environment without a deploy block is not a finding."
@@ -4851,12 +5085,14 @@ rules:
     docs:
       - {path: docs/application-stacks.md#r294, editions: [lite, full]}
       - {path: docs/application-stacks.md#r294-edge, editions: [lite, full]}
+    proves:
+      - {path: packages/hfs/src/hfs-stacks-deploy.spec.mjs, editions: [lite, full]}
     exemplifiedBy:
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
       - {path: packages/hfs/templates/app/skeleton/.starcistacks, edition: full}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+      - {path: packages/hfs/src/hfs-stacks-deploy.spec.mjs, editions: [lite, full]}
+    witness:
+      - {path: packages/hfs/src/hfs-stacks-deploy.spec.mjs, editions: [lite, full]}
   - id: R295
     code: "BE_MODULE_DEFINITION_MISSING"
     law: "Every NestJS module of the product has a module definition (owner ruling 2026-10-15, owner:module-definition-everywhere): capability modules, sub-modules, features, transport modules and cli groups alike. For a module `<x>` the folder holds `<x>.module-definition.ts` (`export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE } = new ConfigurableModuleBuilder<XOptions>().setClassMethodName(\"register\").build()`; the representative module of a capability keeps `.setExtras({ isGlobal: false }, ...)`), `<x>.options.ts` (`export type XOptions`, `Record<string, never>` with a one-line doc when it takes nothing yet) and `<x>.module.ts` (`@Module({...}) export class XModule extends ConfigurableModuleClass {}`, no `register` override except the capability representative's). A module appears in an `imports` array or in an app composition group only as `XModule.register({...})`, never as a bare class. The `AppModule` of an app root and the test world are composition roots and are not judged."
@@ -4899,8 +5135,11 @@ rules:
       - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
       - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+      - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [CI_SECRET_SEALED]}
+    proves:
+      - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [CI_SECRET_SEALED]}
+    witness:
+      - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [CI_SECRET_SEALED]}
   - id: R297
     code: "APP_SECRET_IN_CI"
     law: "A sealed member key granted to an app container by a deploy grant never appears in ci.secrets or ci.vars. The grant environment, member and selected key determine app custody; online GitHub custody is verified by starci app ci verify."
@@ -4918,8 +5157,11 @@ rules:
       - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
       - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+      - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [APP_SECRET_IN_CI]}
+    proves:
+      - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [APP_SECRET_IN_CI]}
+    witness:
+      - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [APP_SECRET_IN_CI]}
   - id: R298
     code: "CI_DECLARATION_DRIFT"
     law: "Workflow secrets and vars references are declared in their matching top-level ci class, except automatic GITHUB_TOKEN. Non-optional Actions declarations are consumed by a workflow; Dependabot secrets need no Actions read. Service token and variable bindings name declarations in the matching class. Missing declarations produce migration findings; a tree with neither ci declarations nor references stays quiet."
@@ -4937,8 +5179,11 @@ rules:
       - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
       - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+      - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [CI_DECLARATION_DRIFT]}
+    proves:
+      - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [CI_DECLARATION_DRIFT]}
+    witness:
+      - {path: packages/hfs/src/ci-custody.spec.mjs, editions: [lite, full], codes: [CI_DECLARATION_DRIFT]}
   - id: R299
     code: "HFS_WORKFLOW_CONTEXT"
     law: "GitHub Actions expressions use only contexts available at their workflow key. Job env cannot read runner, job, steps or env; runner-local data paths belong to step env or shell RUNNER_TEMP. Every tracked workflow is checked in both app editions."
@@ -4953,8 +5198,11 @@ rules:
     exemplifiedBy:
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
       - {path: packages/hfs/templates/app/skeleton/.starcistacks, edition: full}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): no runtime spec retained", date: "2026-10-17"}
+      - {path: packages/hfs/src/workflow-contexts.spec.mjs, editions: [lite, full], codes: [HFS_WORKFLOW_CONTEXT]}
+    proves:
+      - {path: packages/hfs/src/workflow-contexts.spec.mjs, editions: [lite, full], codes: [HFS_WORKFLOW_CONTEXT]}
+    witness:
+      - {path: packages/hfs/src/workflow-contexts.spec.mjs, editions: [lite, full], codes: [HFS_WORKFLOW_CONTEXT]}
   - id: R300
     code: "FE_PUBLIC_BUILD_ARG_MISSING"
     law: "Every front-end app with a Dockerfile supplies each required NEXT_PUBLIC_* source/config/schema name through a Dockerfile ARG default or through that image's buildArgs.values/buildArgs.sealed.keys in every environment deploying the image. Source reads with literal string ?? or || fallbacks are optional. The finding names missing keys and environments at the Dockerfile; sealed values are never opened. CI release images use the same starci app stack build-args verb and environment as deployment."
@@ -4969,8 +5217,11 @@ rules:
     exemplifiedBy:
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
       - {path: packages/hfs/templates/app/skeleton/.starcistacks, edition: full}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): external smoke fixtures", date: "2026-10-17"}
+      - {path: packages/hfs/src/fe-build-args.spec.mjs, editions: [lite, full], codes: [FE_PUBLIC_BUILD_ARG_MISSING]}
+    proves:
+      - {path: packages/hfs/src/fe-build-args.spec.mjs, editions: [lite, full], codes: [FE_PUBLIC_BUILD_ARG_MISSING]}
+    witness:
+      - {path: packages/hfs/src/fe-build-args.spec.mjs, editions: [lite, full], codes: [FE_PUBLIC_BUILD_ARG_MISSING]}
   - id: R301
     code: "CI_STANDARD"
     law: "The managed app CI, the example apps (the reference) and the runtime repository's own workflows follow the ONE CI standard of knowledge/hfs/ci-standard.yaml (owner ruling ci-standard, 2026-10-18): the job shape fast/test/build(/sonar) with the unit run and the Codecov upload in test alone, full history with STARCI_BASE_REF written before the lint, NODE_OPTIONS --max-old-space-size=6144 on every heavy step, the Sonar lint per side, optional providers probed before they skip, a timeout on every job and every action pinned to a commit sha; the other items (candidate trigger R221, per-fe-app build env, prettier-stable renders, R299 contexts) are owned by the rules the standard names. Apps get the standard only through starci app sync."
@@ -4986,8 +5237,11 @@ rules:
     exemplifiedBy:
       - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/ci.yml, edition: lite}
       - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
-    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; the scaffold e2e (e2e/hfs-scaffold-app.spec.mjs: a fresh scaffold has no finding) and the example apps prove it"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the runtime has no spec fixtures", date: "2026-10-18"}
+      - {path: packages/hfs/src/ci-standard.spec.mjs, editions: [lite, full], codes: [CI_STANDARD]}
+    proves:
+      - {path: packages/hfs/src/ci-standard.spec.mjs, editions: [lite, full], codes: [CI_STANDARD]}
+    witness:
+      - {path: packages/hfs/src/ci-standard.spec.mjs, editions: [lite, full], codes: [CI_STANDARD]}
   - id: R302
     code: "HFS_MCP_TOOLS_SNAPSHOT"
     law: "An app that commits the MCP tool catalog of its server keeps it at `be/contracts/<app>/<contract>.tools.json` (slot be.contract.mcp-tools, opt-in), `<contract>` being `<server>@<major>`, as the server's `tools/list` result: `{ contract, server: { name, version }, tools }` where the contract equals the file name and the server name, and every tool has a unique name, a description and an object `inputSchema`."
@@ -5000,6 +5254,28 @@ rules:
     docs:
       - {path: docs/hfs-contract-snapshots.md#r302, editions: [lite, full]}
     templateNa: "The canon emits no MCP catalog: the app commits its server's tools/list result, so there is no scaffolded snapshot."
-    exampleNa: "owner:mcp-tools-snapshot-no-example (2026-10-21): no example app serves an MCP server; the package spec judges a passing and a violating catalog"
-    specNa: "owner:no-runtime-specs (2026-10-17): the enforcer is runtime code with no spec of its own; the @starci/hfs package spec packages/hfs/src/mcp-tools-snapshot.spec.mjs runs it from the bundled copy"
-    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the runtime has no spec fixtures; the package spec proves the rule", date: "2026-10-21"}
+    proves:
+      - {path: packages/hfs/src/mcp-tools-snapshot.spec.mjs, editions: [lite, full], codes: [HFS_MCP_TOOLS_SNAPSHOT]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/mcp-tools-snapshot.spec.mjs, editions: [lite, full], codes: [HFS_MCP_TOOLS_SNAPSHOT]}
+    witness:
+      - {path: packages/hfs/src/mcp-tools-snapshot.spec.mjs, editions: [lite, full], codes: [HFS_MCP_TOOLS_SNAPSHOT]}
+  - id: R303
+    code: "HFS_BYPASS_MARKER"
+    law: "A product repository holds no bypass of a check (owner ruling loosening-always-red): no inline disable of any tool (eslint, stylelint, tslint, prettier, biome), no ts-ignore, ts-expect-error or ts-nocheck directive, no Sonar exclusion comment, no istanbul, c8 or v8 coverage ignore, no skipped, focused or todo test or skip option, and no failure swallowed in a hook, script or workflow (`|| true`, `continue-on-error`, `set +e`, `HUSKY=0`, `--no-verify`, `fail_ci_if_error: false`). A front end has no specs, but its source is still judged for the inline disables. `starci app check` reads the tracked tree and `starci app hygiene` (the managed pre-commit hook) the staged files from the index, so the bypass fails at the commit."
+    kinds: [check]
+    gates: [pre-commit, land, ci]
+    failureCodes: ["HFS_BYPASS_MARKER"]
+    enforcers:
+      - {kind: hfs, id: bypass-markers, at: scripts/hfs/rules/bypass-markers.mjs}
+      - {kind: hfs, id: bypass-guard, at: packages/hfs/sync/hygiene.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/hfs-authored-file-boundaries.md#r303, editions: [lite, full]}
+    templateNa: "A bypass is prohibited, so no template scaffolds one."
+    proves:
+      - {path: packages/hfs/src/bypass-detector.spec.mjs, editions: [lite, full], codes: [HFS_BYPASS_MARKER]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/bypass-detector.spec.mjs, editions: [lite, full], codes: [HFS_BYPASS_MARKER]}
+    witness:
+      - {path: packages/hfs/src/bypass-detector.spec.mjs, editions: [lite, full], codes: [HFS_BYPASS_MARKER]}