@starci/eslint-canon-fe 1.4.3 → 1.4.5

package/contract.mjs

@@ -152,11 +152,35 @@ export const isTestFile = (filename) => /\.(?:test|spec)\.(?:ts|tsx|js|jsx|mjs|c
 /** Product source lives under `src/`; tooling and config are out of scope. */
 export const isSourceFile = (filename) => normalizePath(filename).includes("/src/")
 
+/**
+ * True for a branch that draws content parsed from an authored document.
+ *
+ * WHY THE TABLE CANNOT HOLD THESE. An entry declares every slot inside it, by name - that is
+ * `CONTRACT-11`, and it is what makes an entry a constraint rather than a container. A markdown
+ * document has no such list: the children of one `ul` are whichever of a dozen node kinds the author
+ * typed, in whichever order, nested however deep. Any `children` record written for it would be a
+ * guess, and a guess in the table is worse than no entry at all, because the next reader takes it
+ * for a rule somebody checked.
+ *
+ * The same is true one level down, which is why the list has three members rather than one. A
+ * highlighted code region is a string of vendor HTML injected into the node; a rendered diagram is
+ * an SVG produced from authored source the same way. Neither has slots to name, and neither is a
+ * different case from the document that contains them.
+ *
+ * THIS IS A FOLDER EXEMPTION, exactly like the leaf one above, and it carries the same cost: anyone
+ * can escape these rules by filing a component here. What keeps a file out is a question a person
+ * asks - does this component receive its children as PARSED CONTENT rather than as a designed
+ * arrangement? A block that merely has many children is not this; it has a shape somebody chose, and
+ * a shape somebody chose is what the table is for.
+ */
+export const isAuthoredDocumentBranch = (filename) =>
+  /\/src\/components\/branches\/(?:Article|MarkdownCodeBlock|MermaidDiagram)\//.test(normalizePath(filename))
+
 /** Product source these rules govern: under `src/`, not a test, not a leaf, not the frame. */
 export const isGovernedFile = (filename) => {
   const file = normalizePath(filename)
   if (!isSourceFile(file) || isTestFile(file)) return false
-  return !isLeafFile(file) && !isContractFrameFile(file)
+  return !isLeafFile(file) && !isContractFrameFile(file) && !isAuthoredDocumentBranch(file)
 }
 
 // -- reading the table --------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin.",
   "type": "module",
   "license": "UNLICENSED",

package/vendor-boundary.mjs

@@ -1,549 +1,618 @@
-/**
- * The rule that holds `vendor-boundary.md`.
- *
- * IT IS CHECKED IN BOTH DIRECTIONS, and the second direction is the whole reason this is a policy
- * rather than a hole. Outward, a component that imports the library from the wrong folder is
- * misfiled - that half is obvious. Inward, a file sitting in a wrapper folder that imports nothing
- * is an ordinary component holding an exemption it does not need, and without that check the folder
- * becomes the place difficult things go. The first thing to opt in is always something that was
- * hard to place.
- *
- * THE GLYPH LIBRARY IS SOMEBODY ELSE'S RULE, deliberately. `icon.mjs` owns it, because a rule that
- * names one vendor protects one vendor - and the gap between two such rules is where a caret came
- * to be imported straight from a glyph package at a size that existed nowhere else, reported by
- * nothing.
- */
-
-/** Forward-slash form of a filename, so Windows paths compare like every other path. */
-const normalizePath = (filename) => String(filename || "").replace(/\\/g, "/")
-
-/** Dot form of a two-part JSX member name such as `Checkbox.Content`. */
-const memberName = (node) => {
-  if (node?.type !== "JSXMemberExpression") return null
-  if (node.object?.type !== "JSXIdentifier" || node.property?.type !== "JSXIdentifier") return null
-  return `${node.object.name}.${node.property.name}`
-}
-
-/** The component library this boundary owns. Its glyph counterpart belongs to `icon.mjs`. */
-const VENDOR_PACKAGE_PREFIX = "@heroui/"
-
-/** Named mechanics branches own the closed vendor interaction machines. */
-const MECHANICS_BRANCH = /\/src\/components\/branches\/(?:ModalBranch|DrawerBranch|DropdownBranch)\//
-const LEGACY_SHELL_DIR = "/src/components/shells/"
-
-/** Named surface branches may own the vendor wrapper they project a content contract into. */
-const SURFACE_BRANCH = /\/src\/components\/branches\/(?:SurfaceCard|SurfaceAccordionCard|SurfaceListCard|SurfaceFormCard)\//
-
-const isAllowedVendorOwner = (file) =>
-  file.includes("/src/components/leaves/") || MECHANICS_BRANCH.test(file) || SURFACE_BRANCH.test(file)
-
-/** True for a file inside the component tree, where the boundary applies. */
-const isComponentFile = (filename) => normalizePath(filename).includes("/src/components/")
-
-/** True when an import names the component library, subpaths included. */
-const isVendorImport = (source) => typeof source === "string" && source.startsWith(VENDOR_PACKAGE_PREFIX)
-
-/** Read a two-part JSX member such as `Modal.Body`. */
-const jsxMemberName = (node) => {
-  if (node?.type !== "JSXMemberExpression") return null
-  if (node.object?.type !== "JSXIdentifier" || node.property?.type !== "JSXIdentifier") return null
-  return `${node.object.name}.${node.property.name}`
-}
-
-// -- VENDOR-1 · VENDOR-2 ---------------------------------------------------------------------------
-
-/** The library belongs to two folders, and a wrapper folder that wraps nothing is misfiled. */
-export const vendorBoundary = {
-  meta: {
-    type: "problem",
-    docs: { description: "Vendor imports belong to leaves and named mechanics or surface branches." },
-    schema: [],
-    messages: {
-      outside:
-        "This component does not own a vendor primitive. Vendor imports belong to leaves, ModalBranch/DrawerBranch/DropdownBranch, and the named SurfaceCard family branches that project contracts into vendor bodies.",
-      emptyBranch:
-        "ModalBranch/DrawerBranch/DropdownBranch must wrap their vendor interaction primitive; otherwise this is an ordinary branch in a privileged mechanics path.",
-      legacyShell:
-        "`components/shells` is a deleted structural tier. Move vendor mechanics into the named Branch owner; framework route content closes outside the component tier into a named contract projection.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    // Outside the component tree, a provider standing the library up for the whole application is a
-    // different thing from a component pulling in a widget.
-    if (!isComponentFile(file)) return {}
-    const isLegacyShell = file.includes(LEGACY_SHELL_DIR)
-    const isMechanicsBranch = MECHANICS_BRANCH.test(file)
-    const isTestFile = /\.(?:test|spec)\.[jt]sx?$/.test(file)
-    const isAllowed = isAllowedVendorOwner(file)
-    let importsVendor = false
-    return {
-      ImportDeclaration(node) {
-        if (!isVendorImport(node.source && node.source.value)) return
-        importsVendor = true
-        if (isAllowed) return
-        context.report({ node, messageId: "outside" })
-      },
-      "Program:exit"(node) {
-        if (isTestFile) return
-        if (isLegacyShell) context.report({ node, messageId: "legacyShell" })
-        else if (isMechanicsBranch && !importsVendor) context.report({ node, messageId: "emptyBranch" })
-      },
-    }
-  },
-}
-
-// -- VENDOR-6 --------------------------------------------------------------------------------------
-
-/** The modal mechanics branch owns one zero-inset vendor body as the scroll region. */
-export const modalBranchOwnsScrollBody = {
-  meta: {
-    type: "problem",
-    docs: { description: "ModalBranch keeps one zero-inset Modal.Body as its scroll region." },
-    schema: [],
-    messages: {
-      missing:
-        "ModalBranch must keep one `Modal.Body` around its named content projection: that vendor body is the dialog's scroll region, not a second content surface.",
-      inset:
-        "ModalBranch's body must be `className=\"p-0\"`. The mounted contract owns layout; vendor body padding plus contract padding creates a doubled inset.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    if (!/\/src\/components\/branches\/ModalBranch\/index\.tsx$/.test(file)) return {}
-    let hasBody = false
-    return {
-      JSXOpeningElement(node) {
-        if (jsxMemberName(node.name) !== "Modal.Body") return
-        hasBody = true
-        const className = (node.attributes || []).find((attribute) =>
-          attribute.type === "JSXAttribute"
-          && attribute.name?.type === "JSXIdentifier"
-          && attribute.name.name === "className")
-        if (className?.value?.type === "Literal" && className.value.value === "p-0") return
-        context.report({ node, messageId: "inset" })
-      },
-      "Program:exit"(node) {
-        if (!hasBody) context.report({ node, messageId: "missing" })
-      },
-    }
-  },
-}
-
-// -- VENDOR-7 --------------------------------------------------------------------------------------
-
-/** The house Field fixes the vendor input variant used on bounded form surfaces. */
-export const fieldInputUsesSecondaryVariant = {
-  meta: {
-    type: "problem",
-    docs: { description: "The Field leaf uses HeroUI Input's secondary surface variant." },
-    schema: [],
-    messages: {
-      variant:
-        "The house Field sits inside a bounded form surface. Its HeroUI Input must use `variant=\"secondary\"`; the default variant draws a competing field surface.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    if (!/\/src\/components\/leaves\/Field\/index\.tsx$/.test(file)) return {}
-    const inputBindings = new Set()
-    return {
-      ImportDeclaration(node) {
-        if (node.source?.value !== "@heroui/react") return
-        for (const specifier of node.specifiers || []) {
-          if (specifier.imported?.name === "Input" && specifier.local?.name) inputBindings.add(specifier.local.name)
-        }
-      },
-      JSXOpeningElement(node) {
-        const name = node.name?.type === "JSXIdentifier" ? node.name.name : null
-        if (!name || !inputBindings.has(name)) return
-        const variant = (node.attributes || []).find((attribute) =>
-          attribute.type === "JSXAttribute"
-          && attribute.name?.type === "JSXIdentifier"
-          && attribute.name.name === "variant")
-        if (variant?.value?.type === "Literal" && variant.value.value === "secondary") return
-        context.report({ node, messageId: "variant" })
-      },
-    }
-  },
-}
-
-// -- VENDOR-9 --------------------------------------------------------------------------------------
-
-/** Field labels stay textual instead of inferring decorative glyphs from the input kind. */
-export const fieldLabelIsTextOnly = {
-  meta: {
-    type: "problem",
-    docs: { description: "The house Field label contains no inferred kind icon." },
-    schema: [],
-    messages: {
-      icon:
-        "Field labels are text-only in the source design. Do not infer a decorative icon from the input kind; an icon belongs only to a control with its own action, such as password visibility.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    if (!/\/src\/components\/leaves\/Field\/index\.tsx$/.test(file)) return {}
-    const iconBindings = new Set()
-    return {
-      ImportDeclaration(node) {
-        const source = normalizePath(node.source?.value)
-        if (!/\/components\/leaves\/Icon$/.test(source)) return
-        for (const specifier of node.specifiers || []) {
-          if (specifier.imported?.name === "Icon" && specifier.local?.name) iconBindings.add(specifier.local.name)
-        }
-      },
-      JSXOpeningElement(node) {
-        const name = node.name?.type === "JSXIdentifier" ? node.name.name : null
-        if (!name || !iconBindings.has(name)) return
-        let ancestor = node.parent
-        while (ancestor) {
-          if (
-            ancestor.type === "JSXElement"
-            && ancestor.openingElement?.name?.type === "JSXIdentifier"
-            && ancestor.openingElement.name.name === "label"
-          ) {
-            context.report({ node, messageId: "icon" })
-            return
-          }
-          ancestor = ancestor.parent
-        }
-      },
-    }
-  },
-}
-
-// -- VENDOR-8 --------------------------------------------------------------------------------------
-
-/** An overlay is already bounded and cannot directly mount a second named surface branch. */
-export const noSurfaceBranchInOverlay = {
-  meta: {
-    type: "problem",
-    docs: { description: "An overlay does not directly mount a named surface branch." },
-    schema: [],
-    messages: {
-      nested:
-        "This overlay is already the bounded surface. Do not mount `{{surface}}` inside it; use headings, spacing, rows and controls directly.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    if (!file.includes("/src/components/overlays/")) return {}
-    return {
-      ImportDeclaration(node) {
-        const source = normalizePath(node.source?.value)
-        const match = source.match(/\/components\/branches\/(SurfaceCard|SurfaceAccordionCard|SurfaceListCard|SurfaceFormCard)$/)
-        if (match) context.report({ node, messageId: "nested", data: { surface: match[1] } })
-      },
-    }
-  },
-}
-
-// -- VENDOR-10 -------------------------------------------------------------------------------------
-
-/** TextLink delegates link interaction and hover treatment to HeroUI Link. */
-export const textLinkUsesHeroLink = {
-  meta: {
-    type: "problem",
-    docs: { description: "TextLink wraps HeroUI Link instead of hand-drawing link behavior." },
-    schema: [],
-    messages: {
-      missing: "TextLink must import HeroUI `Link`. The vendor owns link hover, focus and interaction states.",
-      handmade: "Do not rebuild a HeroUI Link with a raw button or local className. Wrap HeroUI `Link` and pass `onPress`.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    if (!/\/src\/components\/leaves\/TextLink\/index\.tsx$/.test(file)) return {}
-    let hasHeroLink = false
-    return {
-      ImportDeclaration(node) {
-        if (node.source?.value !== "@heroui/react") return
-        hasHeroLink ||= (node.specifiers || []).some((specifier) => specifier.imported?.name === "Link")
-      },
-      JSXOpeningElement(node) {
-        if (node.name?.type === "JSXIdentifier" && node.name.name === "button") context.report({ node, messageId: "handmade" })
-        const className = (node.attributes || []).find(
-          (attribute) => attribute.type === "JSXAttribute" && attribute.name?.name === "className",
-        )
-        const classText = className?.value?.type === "Literal" ? String(className.value.value || "") : ""
-        if (/(?:hover:|underline)/.test(classText)) {
-          context.report({ node: className, messageId: "handmade" })
-        }
-      },
-      "Program:exit"(node) {
-        if (!hasHeroLink) context.report({ node, messageId: "missing" })
-      },
-    }
-  },
-}
-
-// -- VENDOR-11 -------------------------------------------------------------------------------------
-
-/** The account block owns the product choices; DropdownBranch alone owns HeroUI mechanics. */
-export const accountControlOwnsDropdown = {
-  meta: {
-    type: "problem",
-    docs: { description: "AccountMenu is a block over DropdownBranch; only the branch imports HeroUI Dropdown." },
-    schema: [],
-    messages: {
-      dropdown: "DropdownBranch must import HeroUI `Dropdown`; vendor mechanics belong to the branch.",
-      branch: "AccountMenu's pure block half must compose DropdownBranch instead of importing HeroUI directly.",
-      vendor: "AccountMenu is a product block. Import DropdownBranch; do not own HeroUI Dropdown here.",
-      menu: "ShellNav must render the AccountMenu block from `components/blocks/auth/AccountMenu`.",
-      direct: "The account IconButton may not carry an action in ShellNav. Guests open AccountMenu; its Sign in or Sign up choice opens the modal.",
-      pieces: "AccountMenu passes typed section data to DropdownBranch; it must not import Branch Section or Item pieces and rebuild vendor anatomy itself.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    const isDropdown = /\/src\/components\/branches\/DropdownBranch\/index\.tsx$/.test(file)
-    const isMenu = /\/src\/components\/blocks\/auth\/AccountMenu\/component\.tsx$/.test(file)
-    const isNav = /\/src\/components\/layouts\/ShellNav\/component\.tsx$/.test(file)
-    if (!isDropdown && !isMenu && !isNav) return {}
-    let hasOwner = false
-    return {
-      ExportNamedDeclaration(node) {
-        if (!isDropdown) return
-        const source = context.sourceCode || context.getSourceCode()
-          if (/\bDropdownBranch(?:Item|Section)\b/.test(source.getText(node))) {
-          context.report({ node, messageId: "pieces" })
-        }
-      },
-      ImportDeclaration(node) {
-        if (isDropdown && node.source?.value === "@heroui/react") {
-          hasOwner ||= (node.specifiers || []).some((specifier) => specifier.imported?.name === "Dropdown")
-        }
-        if (isMenu && node.source?.value === "@heroui/react") context.report({ node, messageId: "vendor" })
-        if (isMenu && /\/components\/branches\/DropdownBranch$/.test(normalizePath(node.source?.value))) {
-          hasOwner = true
-          if ((node.specifiers || []).some((specifier) =>
-            /^(?:DropdownBranchSection|DropdownBranchItem)/.test(specifier.imported?.name || ""))) {
-            context.report({ node, messageId: "pieces" })
-          }
-        }
-        if (isNav && /\/components\/blocks\/auth\/AccountMenu$/.test(normalizePath(node.source?.value))) hasOwner = true
-      },
-      JSXOpeningElement(node) {
-        if (!isNav || node.name?.type !== "JSXIdentifier" || node.name.name !== "IconButton") return
-        const props = (node.attributes || []).find((attribute) => attribute.type === "JSXAttribute" && attribute.name?.name === "props")
-        const expression = props?.value?.type === "JSXExpressionContainer" ? props.value.expression : null
-        const isAccount = expression?.type === "ObjectExpression" && expression.properties.some((property) =>
-          property.type === "Property" && property.key?.name === "icon" && property.value?.value === "account")
-        const hasAction = (node.attributes || []).some((attribute) => attribute.type === "JSXAttribute" && attribute.name?.name === "on")
-        if (isAccount && hasAction) context.report({ node, messageId: "direct" })
-      },
-      "Program:exit"(node) {
-        if (hasOwner) return
-        context.report({ node, messageId: isDropdown ? "dropdown" : isMenu ? "branch" : "menu" })
-      },
-    }
-  },
-}
-
-// -- VENDOR-13 -------------------------------------------------------------------------------------
-
-/** Checkbox.Content owns the control, indicator and label so every visible word toggles it. */
-export const checkboxKeepsCompoundAnatomy = {
-  meta: {
-    type: "problem",
-    docs: { description: "Keep the required HeroUI Checkbox nesting inside the house leaf." },
-    schema: [],
-    messages: {
-      anatomy:
-        "Checkbox must nest `HeroCheckbox.Control` (and its Indicator) inside `HeroCheckbox.Content`. Sibling Control and Content leave the visible label outside the checkbox's press target.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    if (!/\/src\/components\/leaves\/Checkbox\/index\.tsx$/.test(file)) return {}
-    let hasContent = false
-    let controlInsideContent = false
-    let indicatorInsideControl = false
-    const hasAncestor = (node, expected) => {
-      let ancestor = node.parent
-      while (ancestor) {
-        if (ancestor.type === "JSXElement" && memberName(ancestor.openingElement?.name) === expected) return true
-        ancestor = ancestor.parent
-      }
-      return false
-    }
-    return {
-      JSXOpeningElement(node) {
-        const name = memberName(node.name)
-        if (name === "HeroCheckbox.Content") hasContent = true
-        if (name === "HeroCheckbox.Control" && hasAncestor(node, "HeroCheckbox.Content")) controlInsideContent = true
-        if (name === "HeroCheckbox.Indicator" && hasAncestor(node, "HeroCheckbox.Control")) indicatorInsideControl = true
-      },
-      "Program:exit"(node) {
-        if (!hasContent || !controlInsideContent || !indicatorInsideControl) {
-          context.report({ node, messageId: "anatomy" })
-        }
-      },
-    }
-  },
-}
-
-// -- VENDOR-14 -------------------------------------------------------------------------------------
-
-/** Internal StarCi navigation is an action resolved by connected code, never an href. */
-export const noInternalStarciHref = {
-  meta: {
-    type: "problem",
-    docs: { description: "Route internal StarCi destinations through connected router.push actions." },
-    schema: [],
-    messages: {
-      internal:
-        "Internal StarCi navigation must not use `href`. Keep the destination in connected code, report an id/press from the pure component, and call `router.push` there.",
-      leaf:
-        "This internal-navigation leaf must not declare or render `href`; it reports `on.press` and leaves routing to its connected owner.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    if (!file.includes("/src/") || /\.(?:test|spec)\.[jt]sx?$/.test(file)) return {}
-    const internalOnlyLeaf = /\/src\/components\/leaves\/(?:Checkbox|NavLink|QuickActionRow|SeeMoreLink)\/index\.tsx$/.test(file)
-    const literalText = (node) => {
-      if (node?.type === "Literal" && typeof node.value === "string") return node.value
-      if (node?.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis[0]?.value?.cooked || ""
-      return null
-    }
-    const isInternal = (value) => value.startsWith("/") || /^https?:\/\/(?:www\.)?academy\.starci\.org(?:\/|$)/i.test(value)
-    return {
-      JSXAttribute(node) {
-        if (node.name?.name !== "href") return
-        if (internalOnlyLeaf) {
-          context.report({ node, messageId: "leaf" })
-          return
-        }
-        const value = node.value?.type === "JSXExpressionContainer" ? literalText(node.value.expression) : literalText(node.value)
-        if (value !== null && isInternal(value)) context.report({ node, messageId: "internal" })
-      },
-      Property(node) {
-        const key = node.key?.type === "Literal" ? node.key.value : node.key?.name
-        const value = literalText(node.value)
-        if ((key === "href" || key === "externalHref") && value !== null && isInternal(value)) {
-          context.report({ node, messageId: "internal" })
-        }
-      },
-      TSPropertySignature(node) {
-        if (!internalOnlyLeaf || node.key?.name !== "href") return
-        context.report({ node, messageId: "leaf" })
-      },
-    }
-  },
-}
-
-// -- VENDOR-12 -------------------------------------------------------------------------------------
-
-/** The auth overlay projects one already-owned column and adds no vertical inset of its own. */
-export const authOverlayOwnsSingleContentHost = {
-  meta: {
-    type: "problem",
-    docs: { description: "Authentication has one zero-inset content host inside ModalBranch or DrawerBranch." },
-    schema: [],
-    messages: {
-      duplicate: "SignInOverlay must project through one host only: do not open a second `Tree`/`ContractContent` inside a branch that already receives `contract`/`render` directly, and do not open `Tree` by hand instead of importing `ContractContent`.",
-      missing: "SignInOverlay must host its content either by importing `ContractContent` for its already-hosted projection, or by passing `contract` and `render` props directly to `ModalBranch`/`DrawerBranch`.",
-      inset: "`centred-page-column` must not add py/pt/pb. ModalBranch is zero-inset and the auth content touches that scroll region without a second vertical padding band.",
-    },
-  },
-  create(context) {
-    const file = normalizePath(context.filename || context.getFilename())
-    const isOverlay = /\/src\/components\/overlays\/auth\/SignInOverlay\/component\.tsx$/.test(file)
-    const isContracts = /\/src\/components\/contracts\/index\.ts$/.test(file)
-    if (!isOverlay && !isContracts) return {}
-    let hasContent = false
-
-    /*
-     * Two call shapes satisfy the same invariant - one contract-driven content host, zero extra
-     * vertical inset - and both are recognised here.
-     *
-     * (a) THE OLD SHAPE: the overlay imports `ContractContent` and mounts it itself as the branch's
-     * children. `ContractContent` IS the checked host, so importing it is enough to credit the
-     * overlay with owning one.
-     *
-     * (b) THE NEW SHAPE: `ModalBranch`/`DrawerBranch` were migrated to take `{contract, render}`
-     * directly and build `<Tree contract render />` internally (SLOTS-4). An overlay that hands both
-     * props straight to the branch has delegated the same host to the branch itself; there is
-     * nothing left for the overlay to import.
-     *
-     * Matched by JSX ATTRIBUTE NAME, not by where `ModalBranch`/`DrawerBranch` resolve from - same
-     * reasoning VENDOR-12 already applies to `ContractContent`/`Tree` below: canon vocabulary means
-     * the same thing wherever it is imported from.
-     */
-    const MECHANICS_BRANCH_NAMES = new Set(["ModalBranch", "DrawerBranch"])
-    const hasJsxAttribute = (attributes, attrName) =>
-      (attributes || []).some((attribute) =>
-        attribute.type === "JSXAttribute"
-        && attribute.name?.type === "JSXIdentifier"
-        && attribute.name.name === attrName)
-    const jsxChildName = (child) => {
-      if (child?.type !== "JSXElement") return null
-      const name = child.openingElement?.name
-      return name?.type === "JSXIdentifier" ? name.name : null
-    }
-
-    return {
-      ImportDeclaration(node) {
-        if (!isOverlay) return
-        /*
-         * Matched by the NAME imported, not by where it came from - see the comment above.
-         */
-        for (const specifier of node.specifiers || []) {
-          if (specifier.imported?.name === "ContractContent") hasContent = true
-          // Opening `Tree` by hand is the one thing neither shape ever does: both shapes close the
-          // host either inside ContractContent or inside the mechanics branch itself.
-          if (specifier.imported?.name === "Tree") context.report({ node: specifier, messageId: "duplicate" })
-        }
-      },
-      JSXElement(node) {
-        if (!isOverlay) return
-        const name = node.openingElement?.name
-        if (name?.type !== "JSXIdentifier" || !MECHANICS_BRANCH_NAMES.has(name.name)) return
-        const attributes = node.openingElement.attributes
-        if (!hasJsxAttribute(attributes, "contract") || !hasJsxAttribute(attributes, "render")) return
-        // The branch itself now owns the host: shape (b).
-        hasContent = true
-        // A second content host nested as children, when the branch already receives contract/render
-        // directly, duplicates the host the branch already opened.
-        const nestedHost = (node.children || []).some((child) =>
-          jsxChildName(child) === "Tree" || jsxChildName(child) === "ContractContent")
-        if (nestedHost) context.report({ node, messageId: "duplicate" })
-      },
-      Property(node) {
-        if (!isContracts) return
-        const key = node.key?.type === "Literal" ? node.key.value : node.key?.name
-        if (key !== "centred-page-column") return
-        const source = context.sourceCode || context.getSourceCode()
-        if (/["'`](?:py|pt|pb)-/.test(source.getText(node))) context.report({ node, messageId: "inset" })
-      },
-      "Program:exit"(node) {
-        if (isOverlay && !hasContent) context.report({ node, messageId: "missing" })
-      },
-    }
-  },
-}
-
-/** The rules this law contributes to the plugin. */
-export const rules = {
-  "vendor-boundary": vendorBoundary,
-  "modal-branch-owns-scroll-body": modalBranchOwnsScrollBody,
-  "field-input-uses-secondary-variant": fieldInputUsesSecondaryVariant,
-  "field-label-is-text-only": fieldLabelIsTextOnly,
-  "no-surface-branch-in-overlay": noSurfaceBranchInOverlay,
-  "text-link-uses-hero-link": textLinkUsesHeroLink,
-  "account-control-owns-dropdown": accountControlOwnsDropdown,
-  "auth-overlay-owns-single-content-host": authOverlayOwnsSingleContentHost,
-  "checkbox-keeps-compound-anatomy": checkboxKeepsCompoundAnatomy,
-  "no-internal-starci-href": noInternalStarciHref,
-}
-
-/**
- * The level this law asks for, as the plugin's own opinion.
- *
- * A repository adopting this with history should expect the outward half to report and the inward
- * half to be silent until named mechanics branches exist. Creating those owners is the migration;
- * no anonymous wrapper tier is introduced.
- */
-export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))
+/**
+ * The rule that holds `vendor-boundary.md`.
+ *
+ * IT IS CHECKED IN BOTH DIRECTIONS, and the second direction is the whole reason this is a policy
+ * rather than a hole. Outward, a component that imports the library from the wrong folder is
+ * misfiled - that half is obvious. Inward, a file sitting in a wrapper folder that imports nothing
+ * is an ordinary component holding an exemption it does not need, and without that check the folder
+ * becomes the place difficult things go. The first thing to opt in is always something that was
+ * hard to place.
+ *
+ * THE GLYPH LIBRARY IS SOMEBODY ELSE'S RULE, deliberately. `icon.mjs` owns it, because a rule that
+ * names one vendor protects one vendor - and the gap between two such rules is where a caret came
+ * to be imported straight from a glyph package at a size that existed nowhere else, reported by
+ * nothing.
+ */
+
+/** Forward-slash form of a filename, so Windows paths compare like every other path. */
+const normalizePath = (filename) => String(filename || "").replace(/\\/g, "/")
+
+/** Dot form of a two-part JSX member name such as `Checkbox.Content`. */
+const memberName = (node) => {
+  if (node?.type !== "JSXMemberExpression") return null
+  if (node.object?.type !== "JSXIdentifier" || node.property?.type !== "JSXIdentifier") return null
+  return `${node.object.name}.${node.property.name}`
+}
+
+/** The component library this boundary owns. Its glyph counterpart belongs to `icon.mjs`. */
+const VENDOR_PACKAGE_PREFIX = "@heroui/"
+
+/** Named mechanics branches own the closed vendor interaction machines. */
+const MECHANICS_BRANCH = /\/src\/components\/branches\/(?:ModalBranch|DrawerBranch|DropdownBranch)\//
+const LEGACY_SHELL_DIR = "/src/components/shells/"
+
+/** Named surface branches may own the vendor wrapper they project a content contract into. */
+const SURFACE_BRANCH = /\/src\/components\/branches\/(?:SurfaceCard|SurfaceAccordionCard|SurfaceListCard|SurfaceFormCard)\//
+
+/**
+ * `TableBranch` owns the vendor table, and it is a BRANCH because a leaf could not hold it.
+ *
+ * A leaf's `props` must satisfy `ComponentData`, which is JSON to the bottom. A table cell carries
+ * inline content - a link mid-phrase, a path set in code - and none of that survives a JSON slot, so
+ * a leaf could only accept cells already flattened to text. Flattening is the loss the table exists
+ * to prevent, which is why the owner sits here beside the surface family rather than in `leaves/`.
+ */
+const TABLE_BRANCH = /\/src\/components\/branches\/TableBranch\//
+
+const isAllowedVendorOwner = (file) =>
+  file.includes("/src/components/leaves/")
+  || MECHANICS_BRANCH.test(file)
+  || SURFACE_BRANCH.test(file)
+  || TABLE_BRANCH.test(file)
+
+/** True for a file inside the component tree, where the boundary applies. */
+const isComponentFile = (filename) => normalizePath(filename).includes("/src/components/")
+
+/** True when an import names the component library, subpaths included. */
+const isVendorImport = (source) => typeof source === "string" && source.startsWith(VENDOR_PACKAGE_PREFIX)
+
+/** Read a two-part JSX member such as `Modal.Body`. */
+const jsxMemberName = (node) => {
+  if (node?.type !== "JSXMemberExpression") return null
+  if (node.object?.type !== "JSXIdentifier" || node.property?.type !== "JSXIdentifier") return null
+  return `${node.object.name}.${node.property.name}`
+}
+
+// -- VENDOR-1 · VENDOR-2 ---------------------------------------------------------------------------
+
+/** The library belongs to two folders, and a wrapper folder that wraps nothing is misfiled. */
+export const vendorBoundary = {
+  meta: {
+    type: "problem",
+    docs: { description: "Vendor imports belong to leaves and named mechanics or surface branches." },
+    schema: [],
+    messages: {
+      outside:
+        "This component does not own a vendor primitive. Vendor imports belong to leaves, ModalBranch/DrawerBranch/DropdownBranch, TableBranch, and the named SurfaceCard family branches that project contracts into vendor bodies.",
+      emptyBranch:
+        "ModalBranch/DrawerBranch/DropdownBranch must wrap their vendor interaction primitive; otherwise this is an ordinary branch in a privileged mechanics path.",
+      legacyShell:
+        "`components/shells` is a deleted structural tier. Move vendor mechanics into the named Branch owner; framework route content closes outside the component tier into a named contract projection.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    // Outside the component tree, a provider standing the library up for the whole application is a
+    // different thing from a component pulling in a widget.
+    if (!isComponentFile(file)) return {}
+    const isLegacyShell = file.includes(LEGACY_SHELL_DIR)
+    const isMechanicsBranch = MECHANICS_BRANCH.test(file)
+    const isTestFile = /\.(?:test|spec)\.[jt]sx?$/.test(file)
+    const isAllowed = isAllowedVendorOwner(file)
+    let importsVendor = false
+    return {
+      ImportDeclaration(node) {
+        if (!isVendorImport(node.source && node.source.value)) return
+        importsVendor = true
+        if (isAllowed) return
+        context.report({ node, messageId: "outside" })
+      },
+      "Program:exit"(node) {
+        if (isTestFile) return
+        if (isLegacyShell) context.report({ node, messageId: "legacyShell" })
+        else if (isMechanicsBranch && !importsVendor) context.report({ node, messageId: "emptyBranch" })
+      },
+    }
+  },
+}
+
+// -- VENDOR-6 --------------------------------------------------------------------------------------
+
+/** The modal mechanics branch owns one zero-inset vendor body as the scroll region. */
+export const modalBranchOwnsScrollBody = {
+  meta: {
+    type: "problem",
+    docs: { description: "ModalBranch keeps one zero-inset Modal.Body as its scroll region." },
+    schema: [],
+    messages: {
+      missing:
+        "ModalBranch must keep one `Modal.Body` around its named content projection: that vendor body is the dialog's scroll region, not a second content surface.",
+      inset:
+        "ModalBranch's body must be `className=\"p-0\"`. The mounted contract owns layout; vendor body padding plus contract padding creates a doubled inset.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    if (!/\/src\/components\/branches\/ModalBranch\/index\.tsx$/.test(file)) return {}
+    let hasBody = false
+    return {
+      JSXOpeningElement(node) {
+        if (jsxMemberName(node.name) !== "Modal.Body") return
+        hasBody = true
+        const className = (node.attributes || []).find((attribute) =>
+          attribute.type === "JSXAttribute"
+          && attribute.name?.type === "JSXIdentifier"
+          && attribute.name.name === "className")
+        if (className?.value?.type === "Literal" && className.value.value === "p-0") return
+        context.report({ node, messageId: "inset" })
+      },
+      "Program:exit"(node) {
+        if (!hasBody) context.report({ node, messageId: "missing" })
+      },
+    }
+  },
+}
+
+// -- VENDOR-7 --------------------------------------------------------------------------------------
+
+/** The house Field fixes the vendor input variant used on bounded form surfaces. */
+export const fieldInputUsesSecondaryVariant = {
+  meta: {
+    type: "problem",
+    docs: { description: "The Field leaf uses HeroUI Input's secondary surface variant." },
+    schema: [],
+    messages: {
+      variant:
+        "The house Field sits inside a bounded form surface. Its HeroUI Input must use `variant=\"secondary\"`; the default variant draws a competing field surface.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    if (!/\/src\/components\/leaves\/Field\/index\.tsx$/.test(file)) return {}
+    const inputBindings = new Set()
+    return {
+      ImportDeclaration(node) {
+        if (node.source?.value !== "@heroui/react") return
+        for (const specifier of node.specifiers || []) {
+          if (specifier.imported?.name === "Input" && specifier.local?.name) inputBindings.add(specifier.local.name)
+        }
+      },
+      JSXOpeningElement(node) {
+        const name = node.name?.type === "JSXIdentifier" ? node.name.name : null
+        if (!name || !inputBindings.has(name)) return
+        const variant = (node.attributes || []).find((attribute) =>
+          attribute.type === "JSXAttribute"
+          && attribute.name?.type === "JSXIdentifier"
+          && attribute.name.name === "variant")
+        if (variant?.value?.type === "Literal" && variant.value.value === "secondary") return
+        context.report({ node, messageId: "variant" })
+      },
+    }
+  },
+}
+
+// -- VENDOR-9 --------------------------------------------------------------------------------------
+
+/** Field labels stay textual instead of inferring decorative glyphs from the input kind. */
+export const fieldLabelIsTextOnly = {
+  meta: {
+    type: "problem",
+    docs: { description: "The house Field label contains no inferred kind icon." },
+    schema: [],
+    messages: {
+      icon:
+        "Field labels are text-only in the source design. Do not infer a decorative icon from the input kind; an icon belongs only to a control with its own action, such as password visibility.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    if (!/\/src\/components\/leaves\/Field\/index\.tsx$/.test(file)) return {}
+    const iconBindings = new Set()
+    return {
+      ImportDeclaration(node) {
+        const source = normalizePath(node.source?.value)
+        if (!/\/components\/leaves\/Icon$/.test(source)) return
+        for (const specifier of node.specifiers || []) {
+          if (specifier.imported?.name === "Icon" && specifier.local?.name) iconBindings.add(specifier.local.name)
+        }
+      },
+      JSXOpeningElement(node) {
+        const name = node.name?.type === "JSXIdentifier" ? node.name.name : null
+        if (!name || !iconBindings.has(name)) return
+        let ancestor = node.parent
+        while (ancestor) {
+          if (
+            ancestor.type === "JSXElement"
+            && ancestor.openingElement?.name?.type === "JSXIdentifier"
+            && ancestor.openingElement.name.name === "label"
+          ) {
+            context.report({ node, messageId: "icon" })
+            return
+          }
+          ancestor = ancestor.parent
+        }
+      },
+    }
+  },
+}
+
+// -- VENDOR-8 --------------------------------------------------------------------------------------
+
+/** An overlay is already bounded and cannot directly mount a second named surface branch. */
+export const noSurfaceBranchInOverlay = {
+  meta: {
+    type: "problem",
+    docs: { description: "An overlay does not directly mount a named surface branch." },
+    schema: [],
+    messages: {
+      nested:
+        "This overlay is already the bounded surface. Do not mount `{{surface}}` inside it; use headings, spacing, rows and controls directly.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    if (!file.includes("/src/components/overlays/")) return {}
+    return {
+      ImportDeclaration(node) {
+        const source = normalizePath(node.source?.value)
+        const match = source.match(/\/components\/branches\/(SurfaceCard|SurfaceAccordionCard|SurfaceListCard|SurfaceFormCard)$/)
+        if (match) context.report({ node, messageId: "nested", data: { surface: match[1] } })
+      },
+    }
+  },
+}
+
+// -- VENDOR-10 -------------------------------------------------------------------------------------
+
+/** TextLink delegates link interaction and hover treatment to HeroUI Link. */
+export const textLinkUsesHeroLink = {
+  meta: {
+    type: "problem",
+    docs: { description: "TextLink wraps HeroUI Link instead of hand-drawing link behavior." },
+    schema: [],
+    messages: {
+      missing: "TextLink must import HeroUI `Link`. The vendor owns link hover, focus and interaction states.",
+      handmade: "Do not rebuild a HeroUI Link with a raw button or local className. Wrap HeroUI `Link` and pass `onPress`.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    if (!/\/src\/components\/leaves\/TextLink\/index\.tsx$/.test(file)) return {}
+    let hasHeroLink = false
+    return {
+      ImportDeclaration(node) {
+        if (node.source?.value !== "@heroui/react") return
+        hasHeroLink ||= (node.specifiers || []).some((specifier) => specifier.imported?.name === "Link")
+      },
+      JSXOpeningElement(node) {
+        if (node.name?.type === "JSXIdentifier" && node.name.name === "button") context.report({ node, messageId: "handmade" })
+        const className = (node.attributes || []).find(
+          (attribute) => attribute.type === "JSXAttribute" && attribute.name?.name === "className",
+        )
+        const classText = className?.value?.type === "Literal" ? String(className.value.value || "") : ""
+        if (/(?:hover:|underline)/.test(classText)) {
+          context.report({ node: className, messageId: "handmade" })
+        }
+      },
+      "Program:exit"(node) {
+        if (!hasHeroLink) context.report({ node, messageId: "missing" })
+      },
+    }
+  },
+}
+
+// -- VENDOR-11 -------------------------------------------------------------------------------------
+
+/** The account block owns the product choices; DropdownBranch alone owns HeroUI mechanics. */
+export const accountControlOwnsDropdown = {
+  meta: {
+    type: "problem",
+    docs: { description: "AccountMenu is a block over DropdownBranch; only the branch imports HeroUI Dropdown." },
+    schema: [],
+    messages: {
+      dropdown: "DropdownBranch must import HeroUI `Dropdown`; vendor mechanics belong to the branch.",
+      branch: "AccountMenu's pure block half must compose DropdownBranch instead of importing HeroUI directly.",
+      vendor: "AccountMenu is a product block. Import DropdownBranch; do not own HeroUI Dropdown here.",
+      menu: "ShellNav must render the AccountMenu block from `components/blocks/auth/AccountMenu`.",
+      direct: "The account IconButton may not carry an action in ShellNav. Guests open AccountMenu; its Sign in or Sign up choice opens the modal.",
+      pieces: "AccountMenu passes typed section data to DropdownBranch; it must not import Branch Section or Item pieces and rebuild vendor anatomy itself.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    const isDropdown = /\/src\/components\/branches\/DropdownBranch\/index\.tsx$/.test(file)
+    const isMenu = /\/src\/components\/blocks\/auth\/AccountMenu\/component\.tsx$/.test(file)
+    const isNav = /\/src\/components\/layouts\/ShellNav\/component\.tsx$/.test(file)
+    if (!isDropdown && !isMenu && !isNav) return {}
+    let hasOwner = false
+    return {
+      ExportNamedDeclaration(node) {
+        if (!isDropdown) return
+        const source = context.sourceCode || context.getSourceCode()
+          if (/\bDropdownBranch(?:Item|Section)\b/.test(source.getText(node))) {
+          context.report({ node, messageId: "pieces" })
+        }
+      },
+      ImportDeclaration(node) {
+        if (isDropdown && node.source?.value === "@heroui/react") {
+          hasOwner ||= (node.specifiers || []).some((specifier) => specifier.imported?.name === "Dropdown")
+        }
+        if (isMenu && node.source?.value === "@heroui/react") context.report({ node, messageId: "vendor" })
+        if (isMenu && /\/components\/branches\/DropdownBranch$/.test(normalizePath(node.source?.value))) {
+          hasOwner = true
+          if ((node.specifiers || []).some((specifier) =>
+            /^(?:DropdownBranchSection|DropdownBranchItem)/.test(specifier.imported?.name || ""))) {
+            context.report({ node, messageId: "pieces" })
+          }
+        }
+        if (isNav && /\/components\/blocks\/auth\/AccountMenu$/.test(normalizePath(node.source?.value))) hasOwner = true
+      },
+      JSXOpeningElement(node) {
+        if (!isNav || node.name?.type !== "JSXIdentifier" || node.name.name !== "IconButton") return
+        const props = (node.attributes || []).find((attribute) => attribute.type === "JSXAttribute" && attribute.name?.name === "props")
+        const expression = props?.value?.type === "JSXExpressionContainer" ? props.value.expression : null
+        const isAccount = expression?.type === "ObjectExpression" && expression.properties.some((property) =>
+          property.type === "Property" && property.key?.name === "icon" && property.value?.value === "account")
+        const hasAction = (node.attributes || []).some((attribute) => attribute.type === "JSXAttribute" && attribute.name?.name === "on")
+        if (isAccount && hasAction) context.report({ node, messageId: "direct" })
+      },
+      "Program:exit"(node) {
+        if (hasOwner) return
+        context.report({ node, messageId: isDropdown ? "dropdown" : isMenu ? "branch" : "menu" })
+      },
+    }
+  },
+}
+
+// -- VENDOR-13 -------------------------------------------------------------------------------------
+
+/** Checkbox.Content owns the control, indicator and label so every visible word toggles it. */
+export const checkboxKeepsCompoundAnatomy = {
+  meta: {
+    type: "problem",
+    docs: { description: "Keep the required HeroUI Checkbox nesting inside the house leaf." },
+    schema: [],
+    messages: {
+      anatomy:
+        "Checkbox must nest `HeroCheckbox.Control` (and its Indicator) inside `HeroCheckbox.Content`. Sibling Control and Content leave the visible label outside the checkbox's press target.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    if (!/\/src\/components\/leaves\/Checkbox\/index\.tsx$/.test(file)) return {}
+    let hasContent = false
+    let controlInsideContent = false
+    let indicatorInsideControl = false
+    const hasAncestor = (node, expected) => {
+      let ancestor = node.parent
+      while (ancestor) {
+        if (ancestor.type === "JSXElement" && memberName(ancestor.openingElement?.name) === expected) return true
+        ancestor = ancestor.parent
+      }
+      return false
+    }
+    return {
+      JSXOpeningElement(node) {
+        const name = memberName(node.name)
+        if (name === "HeroCheckbox.Content") hasContent = true
+        if (name === "HeroCheckbox.Control" && hasAncestor(node, "HeroCheckbox.Content")) controlInsideContent = true
+        if (name === "HeroCheckbox.Indicator" && hasAncestor(node, "HeroCheckbox.Control")) indicatorInsideControl = true
+      },
+      "Program:exit"(node) {
+        if (!hasContent || !controlInsideContent || !indicatorInsideControl) {
+          context.report({ node, messageId: "anatomy" })
+        }
+      },
+    }
+  },
+}
+
+// -- VENDOR-14 -------------------------------------------------------------------------------------
+
+/** Internal StarCi navigation is an action resolved by connected code, never an href. */
+export const noInternalStarciHref = {
+  meta: {
+    type: "problem",
+    docs: { description: "Route internal StarCi destinations through connected router.push actions." },
+    schema: [],
+    messages: {
+      internal:
+        "Internal StarCi navigation must not use `href`. Keep the destination in connected code, report an id/press from the pure component, and call `router.push` there.",
+      leaf:
+        "This internal-navigation leaf must not declare or render `href`; it reports `on.press` and leaves routing to its connected owner.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    if (!file.includes("/src/") || /\.(?:test|spec)\.[jt]sx?$/.test(file)) return {}
+    const internalOnlyLeaf = /\/src\/components\/leaves\/(?:Checkbox|NavLink|QuickActionRow|SeeMoreLink)\/index\.tsx$/.test(file)
+    const literalText = (node) => {
+      if (node?.type === "Literal" && typeof node.value === "string") return node.value
+      if (node?.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis[0]?.value?.cooked || ""
+      return null
+    }
+    const isInternal = (value) => value.startsWith("/") || /^https?:\/\/(?:www\.)?academy\.starci\.org(?:\/|$)/i.test(value)
+    return {
+      JSXAttribute(node) {
+        if (node.name?.name !== "href") return
+        if (internalOnlyLeaf) {
+          context.report({ node, messageId: "leaf" })
+          return
+        }
+        const value = node.value?.type === "JSXExpressionContainer" ? literalText(node.value.expression) : literalText(node.value)
+        if (value !== null && isInternal(value)) context.report({ node, messageId: "internal" })
+      },
+      Property(node) {
+        const key = node.key?.type === "Literal" ? node.key.value : node.key?.name
+        const value = literalText(node.value)
+        if ((key === "href" || key === "externalHref") && value !== null && isInternal(value)) {
+          context.report({ node, messageId: "internal" })
+        }
+      },
+      TSPropertySignature(node) {
+        if (!internalOnlyLeaf || node.key?.name !== "href") return
+        context.report({ node, messageId: "leaf" })
+      },
+    }
+  },
+}
+
+// -- VENDOR-12 -------------------------------------------------------------------------------------
+
+/** The auth overlay projects one already-owned column and adds no vertical inset of its own. */
+export const authOverlayOwnsSingleContentHost = {
+  meta: {
+    type: "problem",
+    docs: { description: "Authentication has one zero-inset content host inside ModalBranch or DrawerBranch." },
+    schema: [],
+    messages: {
+      duplicate: "SignInOverlay must project through one host only: do not open a second `Tree`/`ContractContent` inside a branch that already receives `contract`/`render` directly, and do not open `Tree` by hand instead of importing `ContractContent`.",
+      missing: "SignInOverlay must host its content either by importing `ContractContent` for its already-hosted projection, or by passing `contract` and `render` props directly to `ModalBranch`/`DrawerBranch`.",
+      inset: "`centred-page-column` must not add py/pt/pb. ModalBranch is zero-inset and the auth content touches that scroll region without a second vertical padding band.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename())
+    const isOverlay = /\/src\/components\/overlays\/auth\/SignInOverlay\/component\.tsx$/.test(file)
+    const isContracts = /\/src\/components\/contracts\/index\.ts$/.test(file)
+    if (!isOverlay && !isContracts) return {}
+    let hasContent = false
+
+    /*
+     * Two call shapes satisfy the same invariant - one contract-driven content host, zero extra
+     * vertical inset - and both are recognised here.
+     *
+     * (a) THE OLD SHAPE: the overlay imports `ContractContent` and mounts it itself as the branch's
+     * children. `ContractContent` IS the checked host, so importing it is enough to credit the
+     * overlay with owning one.
+     *
+     * (b) THE NEW SHAPE: `ModalBranch`/`DrawerBranch` were migrated to take `{contract, render}`
+     * directly and build `<Tree contract render />` internally (SLOTS-4). An overlay that hands both
+     * props straight to the branch has delegated the same host to the branch itself; there is
+     * nothing left for the overlay to import.
+     *
+     * Matched by JSX ATTRIBUTE NAME, not by where `ModalBranch`/`DrawerBranch` resolve from - same
+     * reasoning VENDOR-12 already applies to `ContractContent`/`Tree` below: canon vocabulary means
+     * the same thing wherever it is imported from.
+     */
+    const MECHANICS_BRANCH_NAMES = new Set(["ModalBranch", "DrawerBranch"])
+    const hasJsxAttribute = (attributes, attrName) =>
+      (attributes || []).some((attribute) =>
+        attribute.type === "JSXAttribute"
+        && attribute.name?.type === "JSXIdentifier"
+        && attribute.name.name === attrName)
+    const jsxChildName = (child) => {
+      if (child?.type !== "JSXElement") return null
+      const name = child.openingElement?.name
+      return name?.type === "JSXIdentifier" ? name.name : null
+    }
+
+    return {
+      ImportDeclaration(node) {
+        if (!isOverlay) return
+        /*
+         * Matched by the NAME imported, not by where it came from - see the comment above.
+         */
+        for (const specifier of node.specifiers || []) {
+          if (specifier.imported?.name === "ContractContent") hasContent = true
+          // Opening `Tree` by hand is the one thing neither shape ever does: both shapes close the
+          // host either inside ContractContent or inside the mechanics branch itself.
+          if (specifier.imported?.name === "Tree") context.report({ node: specifier, messageId: "duplicate" })
+        }
+      },
+      JSXElement(node) {
+        if (!isOverlay) return
+        const name = node.openingElement?.name
+        if (name?.type !== "JSXIdentifier" || !MECHANICS_BRANCH_NAMES.has(name.name)) return
+        const attributes = node.openingElement.attributes
+        if (!hasJsxAttribute(attributes, "contract") || !hasJsxAttribute(attributes, "render")) return
+        // The branch itself now owns the host: shape (b).
+        hasContent = true
+        // A second content host nested as children, when the branch already receives contract/render
+        // directly, duplicates the host the branch already opened.
+        const nestedHost = (node.children || []).some((child) =>
+          jsxChildName(child) === "Tree" || jsxChildName(child) === "ContractContent")
+        if (nestedHost) context.report({ node, messageId: "duplicate" })
+      },
+      Property(node) {
+        if (!isContracts) return
+        const key = node.key?.type === "Literal" ? node.key.value : node.key?.name
+        if (key !== "centred-page-column") return
+        const source = context.sourceCode || context.getSourceCode()
+        if (/["'`](?:py|pt|pb)-/.test(source.getText(node))) context.report({ node, messageId: "inset" })
+      },
+      "Program:exit"(node) {
+        if (isOverlay && !hasContent) context.report({ node, messageId: "missing" })
+      },
+    }
+  },
+}
+
+/**
+ * `VENDOR-15` - a table is written through `TableBranch` or it is not written.
+ *
+ * WHY THIS RULE EXISTS BESIDE `vendor-boundary`. That rule refuses a vendor IMPORT written in the
+ * wrong file, so it can only see boundaries that were crossed by importing something. A table built
+ * by hand imports nothing at all: it is `<table>` and `<tr>` and a column of borders, and the vendor
+ * it stands in for is never named anywhere in the file. That is the quieter failure and the one this
+ * rule is for - it refuses the ABSENCE, where its neighbour refuses the presence.
+ *
+ * WHAT IT READS. The tag names of the table family, and the ARIA roles that build a table without
+ * them. Reading both matters because the two substitutes look nothing alike in source: one is a
+ * semantic `<table>` somebody thought was harmless, the other is a grid of `div`s wearing
+ * `role="row"`. Neither is refused inside `TableBranch`, which is the one file that may draw them.
+ *
+ * WHAT IT CANNOT SEE. A grid of plain `div`s carrying no role at all, an element name resolved at
+ * runtime, and a table reached through a re-export under another name. It reads what is written; a
+ * hand-built grid that declares neither tag nor role is invisible to it, which is the same blind
+ * spot every anatomy rule in this file carries.
+ */
+const TABLE_TAGS = new Set(["table", "thead", "tbody", "tfoot", "tr", "th", "td"])
+const TABLE_ROLES = new Set(["table", "grid", "row", "rowgroup", "columnheader", "rowheader", "gridcell"])
+
+export const tablesGoThroughTableBranch = {
+  meta: {
+    type: "problem",
+    docs: { description: "Rows and columns are drawn by TableBranch, never rebuilt by hand." },
+    schema: [],
+    messages: {
+      tag: "`<{{name}}>` is table anatomy written by hand. `TableBranch` owns HeroUI `Table` and its compound parts; pass it cells and let it rebuild the header, the row-header column and the scroll container.",
+      role: "`role=\"{{name}}\"` builds a table out of neutral elements. `TableBranch` owns the vendor that already reports these roles; a hand-built grid loses its keyboard model and its accessible name.",
+    },
+  },
+  create(context) {
+    const file = normalizePath(context.filename || context.getFilename?.() || "")
+    // The owner may draw what it owns. Everything else in the component tier may not.
+    if (!isComponentFile(file) || TABLE_BRANCH.test(file)) return {}
+    return {
+      JSXOpeningElement(node) {
+        const name = node.name
+        if (name?.type === "JSXIdentifier" && TABLE_TAGS.has(name.name)) {
+          context.report({ node: name, messageId: "tag", data: { name: name.name } })
+          return
+        }
+        for (const attribute of node.attributes || []) {
+          if (attribute.type !== "JSXAttribute" || attribute.name?.name !== "role") continue
+          const value = attribute.value
+          if (value?.type !== "Literal" || typeof value.value !== "string") continue
+          if (!TABLE_ROLES.has(value.value)) continue
+          context.report({ node: attribute, messageId: "role", data: { name: value.value } })
+        }
+      },
+    }
+  },
+}
+
+/** The rules this law contributes to the plugin. */
+export const rules = {
+  "vendor-boundary": vendorBoundary,
+  "modal-branch-owns-scroll-body": modalBranchOwnsScrollBody,
+  "field-input-uses-secondary-variant": fieldInputUsesSecondaryVariant,
+  "field-label-is-text-only": fieldLabelIsTextOnly,
+  "no-surface-branch-in-overlay": noSurfaceBranchInOverlay,
+  "text-link-uses-hero-link": textLinkUsesHeroLink,
+  "account-control-owns-dropdown": accountControlOwnsDropdown,
+  "auth-overlay-owns-single-content-host": authOverlayOwnsSingleContentHost,
+  "checkbox-keeps-compound-anatomy": checkboxKeepsCompoundAnatomy,
+  "no-internal-starci-href": noInternalStarciHref,
+  "tables-go-through-table-branch": tablesGoThroughTableBranch,
+}
+
+/**
+ * The level this law asks for, as the plugin's own opinion.
+ *
+ * A repository adopting this with history should expect the outward half to report and the inward
+ * half to be silent until named mechanics branches exist. Creating those owners is the migration;
+ * no anonymous wrapper tier is introduced.
+ */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))