@starci/eslint-canon-fe 8.2.13 → 8.2.15

package/runtime/knowledge/hfs/slots.yaml

@@ -1,16 +1,16 @@
 # HFS slot manifest (owner-approved 2026-09-29, decisions 1-10 in the owner decisions record).
 # The one place that says what may exist in a StarCi product repository and where. A product is ONE app repository
-# (hfs 4, manifest major 2): the app root holds the one package.json, lockfile and node_modules, the hfs.json of kind app,
+# (hfs 4, manifest major 3): the app root holds the one package.json, lockfile and node_modules, the hfs.json of kind app,
 # the CI, the hooks and .starciwork (slots of profile `app`); `be/` and `fe/` are its two sides, each laid out as a
 # standalone repository root (slots of profile be or fe, paths relative to the side folder). Every tracked path of every
 # repository must match exactly one slot. Checks, lint factories, the architecture machine, templates and the why
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
-schema: starci/hfs-slots@2
-version: 2.1.0
+schema: starci/hfs-slots@3
+version: 3.0.0
 
 versioning:
-  # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 2).
+  # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
   patch: wording, why text, examples; no check result can change.
   minor: >-
     add a slot (always presence optional or opt-in), add an app kind or protocol slot, add a rule at severity warn,
@@ -24,6 +24,13 @@ versioning:
 # 2.1.0 is such a minor: it ADDS the edition mechanism (the `editions` list, the per-slot `editions`, `litePresence`, `lite`
 # overlays and `provider`, and `sides.<side>.reads` of an app-root tree) and the lite slots; an app without `edition` in its
 # hfs.json is edition full and every answer for it is unchanged.
+# 2.2.0 adds the declaration-only fe.modules.types.ambient owner.
+# 3.0.0 is a major (owner decision 2026-10-13, R212 cases 1-2): lite is the full code structure deployed without self-hosted
+# infrastructure and without e2e, and the front end is one standard for both editions (knowledge/hfs/fe-stack.yaml). The
+# front-end database slots and the Supabase realtime feature slot are removed (Supabase on the front end is auth only, realtime
+# is the socket.io gateway in both editions), fe.route holds pages, layouts and the one health/live route handler, and the slots
+# marked `since: 3.0.0` are added: the Apollo, SWR, RHF, zustand and socket.io hooks, redux, modules/auth, modules/toast, the
+# providers, be.assets and the migration archive.
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -38,7 +45,6 @@ versioning:
 #   tier        node of the import direction matrix (tiers below); none = takes no part in import checks;
 #               inherit = the tier of the enclosing owner.
 #   owner       true when every directory matching the slot is an owner: the unit cross-owner imports and cycles use.
-#   anonymousActions  on a directory slot: the Server Action files (relative to it) that authenticate or end a session and so run for an anonymous principal (FE_AUTH_SESSION_TRUST exempts them from refusing it; they still parse their input).
 #   entries     on a directory slot that sits inside an owner (not an owner itself): the files, besides the owner's index.ts, an importer
 #               outside the owner may enter through (a client-safe entry of a module whose barrel is server-only). Each is a relative
 #               path the slot allows. Everything else of the owner is entered through index.ts only (ARCH_OWNER_EXPORT_BYPASS).
@@ -68,26 +74,37 @@ versioning:
 #   managedBy   the template directory starci app sync renders this slot's files from. The slot path then lists literal files
 #               only, and each is rendered from templates/<profile or common>/<managedBy>/<path, leading dots dropped>;
 #   liteManagedBy  the template directory starci app sync renders under edition lite (default: managedBy). A slot with only
-#               liteManagedBy is managed only in lite; its effective lite.path still lists literal files;
+#               liteManagedBy is managed only in lite; its effective lite.path still lists literal files.
 #               the managed file list lives here and nowhere in code. A difference is HFS_MANAGED_FILE_DRIFT (a
 #               back end's tsconfig.json: HFS_TS_STRICT when a flag or an option was added).
 #   rules       rule ids (the catalog lands with knowledge/hfs/rules.yaml).
 #   editions    the editions (below) the slot exists in; default all of them. A slot outside the declared edition owns
 #               no path - under lite, what full keeps absent is removed, and what lite forbids is a finding.
 #   litePresence  the presence under edition lite (default: presence): a bare value, or {be, fe} for a both-sides slot.
-#               A slot forbidden in lite is external there and must name its goesTo.
+#               A slot forbidden in lite is external there and must name its goesTo. Only infrastructure is forbidden in lite:
+#               the self-hosted stack (.starcistacks infra/, runtime/, seeds/), the e2e and contract test layers and their
+#               workflow, and the browser journey.
 #   lite        the fields the slot carries under lite only (path, requires, allows, forbids, minInstances,
-#               requiredInstances), each shaped as the same field in the slot body; every other field is the edition's.
-#               Under lite `tests` is none on every slot: a lite app has no test world.
+#               requiredInstances, why), each shaped as the same field in the slot body; every other field is the edition's.
+#               `why` under lite names the Supabase adapter behind the slot's ports (pgmq, Postgres locks, Supabase Realtime).
+#               `tests` is never overlaid: a lite slot owes exactly the unit specs its full slot owes.
 #   provider    the hfs.json connections[].provider that enables this opt-in slot (supabase); never an app kind.
 #   since       the manifest version that introduced the slot.
 presenceValues: [required, optional, opt-in, forbidden]
 trackedValues: [tracked, ignored, external]
 testValues: [unit-beside, e2e, none]
 
-# The editions a repository declares in hfs.json `edition` (absent means full). Lite is this same manifest filtered: a slot
-# whose `editions` lacks lite does not exist for a lite app, `litePresence` replaces presence and a `lite` map replaces the
-# fields it names. Upgrade lite -> full adds only (the forbidden test world becomes legal again); downgrade is not supported.
+# The editions a repository declares in hfs.json `edition` (absent means full). Owner ruling 2026-10-12 (R212 case-1): lite IS
+# the full architecture deployed without self-hosted infrastructure - the same monorepo, slots, CQRS shape and patterns (queue,
+# event bus, saga, reactors, projection, realtime, webhooks, fenced job), declared in hfs.json the same way, and the same unit
+# specs (unitRoles, logicRoles, 100 per file, @starci/jest-preset doubles, builders). What differs is ADAPTERS and DELIVERY, all
+# on Supabase: schema authority in supabase/migrations, the queue and event-bus ports on Supabase Queues (pgmq), realtime on
+# Supabase Realtime, cache and locks on Postgres, schedules on pg_cron (+ pg_net), storage and auth on Supabase. Integration specs
+# are optional and run only against the local Supabase CLI stack (`starci supabase start`); there is no e2e or contract world and no
+# self-hosted stack (.starcistacks holds env and secret custody only). The front end is the full front end (no tests, R97).
+# Lite is this same manifest filtered: a slot whose `editions` lacks lite does not exist for a lite app, `litePresence` replaces
+# presence and a `lite` map replaces the fields it names. Upgrade lite -> full adds only (swap the adapters, add the e2e and
+# contract world and the stack); downgrade is not supported.
 editions: [full, lite]
 
 # The two sides of an app: the folder of each is its profile name (be/, fe/). `reads` lists the only paths of the OTHER side a side
@@ -244,7 +261,7 @@ ruleParams:
     # R89 BE_SOURCE_FORM: the closed role-suffix vocabulary of a source file name (<kebab-name>.<suffix>.ts; BE-CONVENTION 1.15)
     # and the suffixes that are never a role. index.ts, main.ts, app.module.ts and the migrations of be.persistence are the
     # only names outside it.
-    suffixes: [module, module-definition, decorators, options, config, connection, service, command, query, handler, compensation, saga-state, saga-step, saga, contracts, port, resolver, controller, gateway, webhook, subscription, consumer, cli, event, queue, projection, projection-entity, processor, step, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
+    suffixes: [module, module-definition, decorators, options, config, connection, service, command, query, handler, templates, compensation, saga-state, saga-step, saga, contracts, port, resolver, controller, gateway, webhook, subscription, consumer, cli, event, queue, projection, projection-entity, processor, step, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
     # R47 BE_CONTRACT_UNGUARDED: the world's shape vocabulary. `helper` names the function a contract spec imports to erase the values of a JSON
     # payload (`shapeOf`); a contract spec proves a fake's fixtures by asserting helper(real) equals helper(fixture).
     contractShape: {helper: shapeOf}
@@ -301,10 +318,23 @@ ruleParams:
       api: {topic: api, variable: feature, trigger: api, patterns: [], needs: [service], defaults: {action: "@name"}}
       cli: {topic: cli, variable: group, trigger: cli, patterns: [], needs: [service], wire: {file: src/features/cli/cli.module.ts, import: "./@@group@@/@@group@@.module", symbol: "@@Group@@Module"}}
     bannedSuffixes: [use-case, repository, fixture, factory, store, worker, scheduler, cron, job, listener, dto, util, utils, helper, helpers, rules, types, constants, int-spec, harness-spec, test]
-    # Edition lite (ruleParams(manifest, 'be', 'lite') merges these keys over the base): the schema authority is the Supabase
-    # migration tree (supabase/migrations/*.sql, forward-only), so a lite back end holds no TypeORM migration or entity under
-    # be/ (R34/R35 read schemaAuthority; be.persistence's lite overlay allows neither).
-    lite: {schemaAuthority: supabase, unitRoles: []}     # lite has no test world: no service or cli command owes a unit spec
+    # Edition lite (ruleParams(manifest, 'be', 'lite') merges these keys over the base; a map merges one level deep): the schema
+    # authority is the Supabase migration tree (supabase/migrations/*.sql, forward-only), so a lite back end holds no TypeORM
+    # migration or entity under be/ (R34/R35 read schemaAuthority; be.persistence's lite overlay allows neither). The unit roles,
+    # logic roles and spec doubles are full's (owner ruling 2026-10-12). infraOwners: the self-hosted libraries are owned nowhere -
+    # platform/queue and platform/event-bus run Supabase Queues (pgmq) through the shared EntityManager, cache and locks are
+    # Postgres (advisory locks or an unlogged table), and realtime is the same socket.io gateway as full, run inside the api
+    # process with no Redis adapter (owner ruling 2026-10-13).
+    lite:
+      schemaAuthority: supabase
+      infraOwners:
+        bullmq: []
+        "@nestjs/bullmq": []
+        kafkajs: []
+        redis: []
+        ioredis: []
+        graphql-subscriptions: []
+        graphql-ws: []
 
 slots:
 
@@ -407,9 +437,7 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    lite: {path: sonar-project.properties}
-    managedBy: quality-config
-    liteManagedBy: quality-config-lite
+    managedBy: quality-config     # lite renders the same files: the same coverage scope, Sonar import and Codecov flags as full
     rules: [HFS_SONAR_CONFIG, HFS_MANAGED_FILE_DRIFT]
   - id: app.hooks
     profiles: [app]
@@ -434,11 +462,11 @@ slots:
     profiles: [app]
     path: ".github/workflows/e2e.yml"
     presence: optional     # on: workflow_dispatch only
-    litePresence: forbidden     # a lite app has no e2e run
+    litePresence: forbidden     # a lite app has no e2e world (owner ruling 2026-10-12): unit specs run in ci.yml
     tracked: tracked
     tier: none
     tests: none
-    goesTo: "the full edition: a lite app has no e2e workflow (no tests, nothing to run)"
+    goesTo: "the full edition: a lite app has no e2e or contract world; its unit specs run in .github/workflows/ci.yml"
     managedBy: ci-workflows
     rules: [HFS_CI_E2E_AUTOMATIC, HFS_MANAGED_FILE_DRIFT]
   - id: app.ci-images
@@ -480,6 +508,8 @@ slots:
     # refusing any test or test tooling inside fe/). Declared by `browser: true` in hfs.json; the managed script `test:browser` exists only then.
     path: "browser/"
     presence: opt-in
+    litePresence: forbidden     # a browser journey runs against a provisioned stack: e2e, which lite does not have
+    goesTo: "the full edition: a lite app has no e2e world, so no browser journey"
     tracked: tracked
     tier: none
     tests: none
@@ -535,15 +565,15 @@ slots:
     rules: [HFS_AGENT_DATA_TRACKED, HFS_IDENTITY_CUSTODY]
   - id: app.starciwork.uat
     profiles: [app]
-    # The UAT records of the full edition: a lite app has no UAT (no tests, no record of one), so the trees are forbidden paths
-    # under lite only. In full this slot does not exist and .starciwork answers for them.
+    # The UAT records of the full edition: they are proven on the e2e world (identities, fixtures, br/ac evidence) that lite does
+    # not have, so the trees are forbidden paths under lite only. In full this slot does not exist and .starciwork answers for them.
     editions: [lite]
     path: ".starciwork/{_resources/identities,_resources/fixtures,features/<feature>/uat,features/<feature>/br}/"
     presence: forbidden
     tracked: external
     tier: none
     tests: none
-    goesTo: "the full edition: a lite app has no UAT records (no identities or fixtures resources, no br/ac evidence, no uat directories)"
+    goesTo: "the full edition: a lite app has no e2e world, so no UAT records (no identities or fixtures resources, no br/ac evidence, no uat directories)"
     since: 2.1.0
   - id: app.starcistacks
     profiles: [app]
@@ -557,8 +587,9 @@ slots:
     allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,k8s,terraform}/**", "<env>/infra/metadata.json",
              "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
     forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
-    # Lite runs one managed host: the reduced shape keeps the stack declaration, the environment descriptor and the sealed
-    # secrets; infra/, runtime/ and seeds/ are the full edition's.
+    # Lite has no self-hosted infrastructure (owner ruling 2026-10-12): .starcistacks holds env and secret custody only - the stack
+    # declaration, the environment descriptor and the sealed secrets; the stack's one backing service is the Supabase project (the
+    # local CLI stack or the cloud project). infra/ (compose, k8s, terraform), runtime/ and seeds/ are the full edition's.
     lite:
       requires: []
       allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep"]
@@ -650,6 +681,19 @@ slots:
     tier: none
     tests: none
     since: 2.1.0
+  - id: app.supabase.migrations.archive
+    profiles: [app]
+    # The migrations an existing app retired at its cutover (owner ruling 2026-10-13, migration baseline policy): the live schema is
+    # dumped into ONE baseline migration written to the current standard, marked applied on production without a re-run, and the
+    # older files move here. The Supabase CLI applies only supabase/migrations/<stamp>_<name>.sql, never this folder, and no
+    # migration rule (L02-L08) judges it; new migrations append after the baseline.
+    path: "supabase/migrations/_archive/"
+    presence: opt-in
+    provider: supabase
+    tracked: tracked
+    tier: none
+    tests: none
+    since: 3.0.0
   - id: app.supabase.seed
     profiles: [app]
     path: "supabase/seed.sql"
@@ -693,7 +737,7 @@ slots:
     tracked: external
     tier: none
     tests: none
-    goesTo: "a be feature: webhooks/<provider> for a third-party callback, api for an endpoint, a cli command on a schedule (pg_cron / pg_net)"
+    goesTo: "a be feature: webhooks/<provider> for a third-party callback, api for an endpoint, a job of a pgmq-backed queue or a cli command on a schedule (pg_cron / pg_net)"
     since: 2.1.0
 
   # ----- side root (both sides): what a standalone repository root holds, less the app-root files ----------
@@ -721,8 +765,7 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    # Lite: no test tsconfig (no test tree) and no jest configuration; both are forbidden paths there (repo.tests-forbidden).
-    lite: {path: "{tsconfig.json,tsconfig.build.json,eslint.config.mjs}"}
+    # Lite renders the same files (owner ruling 2026-10-12): the unit run and its coverage are full's.
     coverage: none
     managedBy: tool-config
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL, HFS_TS_STRICT]
@@ -864,21 +907,6 @@ slots:
     tests: none
     goesTo: ".starcistacks/<env>/secrets/<slug>.enc (at the app root); decrypted values only in memory or under %LOCALAPPDATA%/StarCi/secrets/<project>/<env>/ via *_FILE"
     rules: [HFS_PLAINTEXT_SECRET]
-  - id: repo.tests-forbidden
-    profiles: [be, fe]
-    # Edition lite has no test world, on either side: a spec file, a test directory or a test-tool configuration anywhere in
-    # a side is a forbidden path (a finding, not an ignored file). In full this slot does not exist and each test file is
-    # judged by its own slot (the be tests tree, FE_NO_TESTS on the fe side).
-    editions: [lite]
-    # No nested braces: braceVariants expands each inner group per outer option. `**/e2e/` also matches a root e2e/ but
-    # be.root-e2e wins that on specificity; both are forbidden.
-    path: "{**/*.spec.*,**/*.test.*,**/*-spec.*,src/tests/,**/__tests__/,**/e2e/,**/test-support/,**/__mocks__/,**/jest.*,**/vitest.*,**/playwright.*,**/cypress.config.*,**/tsconfig.e2e.json,**/e2e.yml,**/e2e.yaml}"
-    presence: forbidden
-    tracked: external
-    tier: none
-    tests: none
-    goesTo: "the full edition: a lite repository holds no spec, test directory or jest/vitest/playwright configuration"
-    since: 2.1.0
   - id: be.root-e2e
     profiles: [be]
     path: "e2e/"
@@ -913,25 +941,21 @@ slots:
     profiles: [be]
     path: "contracts/<app>/events.json"
     presence: opt-in
-    litePresence: forbidden         # lite has no event bus, so no async contract to emit
     tracked: tracked
     tier: none
     tests: none
     coverage: none
     why: the async contract of a service (`starci/event-contract@1`), emitted by `npm run contract:emit` (`starci app emit`, never written by hand) from the typed event classes of `src/modules/events/<service>/`; the consumers of its events rely on it (R166 HFS_EVENT_CONTRACT)
-    goesTo: "the full edition: a lite app has no event bus (no Kafka, no outbox), so no async contract exists to emit"
     rules: [HFS_EVENT_CONTRACT]
   - id: be.contract.events.pin
     profiles: [be]
     path: "contracts/<app>/events.pin.json"
     presence: opt-in
-    litePresence: forbidden
     tracked: tracked
     tier: none
     tests: none
     coverage: none
     why: the previously published event contract of a service, the same format as its events.json (copied over when the contract is published, never edited); the current events.json may only extend it additively, a breaking change is a new `<event>.v2` key (R177 BE_CONTRACT_BREAKING)
-    goesTo: "the full edition: a lite app has no event bus, so no published event contract to pin"
     rules: [BE_CONTRACT_BREAKING]
 
   # ----- BE: apps (one slot per app kind; a new kind = a new slot, minor bump) ---------------------------
@@ -955,14 +979,12 @@ slots:
     path: "apps/<app>/src/"
     appKind: worker               # composes transport/message modules and job processors only (an api app may compose them too: a worker app is for separate scaling)
     presence: opt-in
-    litePresence: forbidden       # lite has no queue or event bus to consume; background work is a cli command on a schedule
     tracked: tracked
     tier: app
     owner: true
     requires: [main.ts, app.module.ts]
     allows: [main.ts, app.module.ts, "<app>.options.ts"]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
-    goesTo: "the full edition: a lite app has no worker (scheduled work is a cli command invoked by pg_cron / pg_net or a platform cron)"
     coverage: none
     rules: [BE_APP_COMPOSITION_ONLY, BE_BACKGROUND_UNOWNED, BE_CONTEXT_OWNER]
   - id: be.app.cli
@@ -1007,7 +1029,6 @@ slots:
   - id: be.feature.application
     profiles: [be]
     path: "src/features/{api/,jobs/,reactors/,saga/}<feature>/application/"     # inside a trigger kind (jobs, reactors, saga) the feature folder is one level down
-    lite: {path: "src/features/api/<feature>/application/"}                    # lite has only the api kind; the other roots are forbidden slots
     presence: required
     tracked: tracked
     tier: feature
@@ -1021,7 +1042,6 @@ slots:
     path: "src/features/saga/<saga>/"
     pattern: saga                 # enabled by `patterns: ["saga"]` in hfs.json sides.be (R169 to R173); an undeclared saga folder is HFS_SLOT_NOT_ENABLED
     presence: opt-in              # a saga: the orchestrator of a business flow that crosses services, started and advanced only by events (knowledge/patterns/be/saga.yaml)
-    litePresence: forbidden
     trigger: saga
     tracked: tracked
     tier: feature
@@ -1029,7 +1049,6 @@ slots:
     requires: [index.ts, "<saga>.module.ts", "<saga>.saga.service.ts", "<saga>.saga-state.ts", steps/, compensations/, transport/]
     allows: [index.ts, "<saga>.module.ts", "<saga>.saga.service.ts", "<saga>.saga.service.spec.ts", "<saga>.saga-state.ts", "<saga>.saga.log-events.ts", application/, steps/, compensations/, transport/]   # the orchestrator is a `*.service.ts` because a handler injects only services; unit-tested beside it
     tests: unit-beside            # <saga>.saga.service.spec.ts beside the orchestrator; the state machine and its fence are platform/saga's service; each compensation path has an e2e spec
-    goesTo: "the full edition: a lite app has no saga (no event bus to advance it)"
     coverage: none
     rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED, BE_SAGA_STEP_COMPENSATION, BE_SAGA_STATE_VERSIONED, BE_SAGA_EVENT_CONTRACT, BE_SAGA_E2E_MISSING]
   - id: be.feature.saga.steps
@@ -1037,12 +1056,10 @@ slots:
     path: "src/features/saga/<saga>/steps/"
     pattern: saga
     presence: opt-in
-    litePresence: forbidden
     tracked: tracked
     tier: feature
     allows: ["<step>.saga-step.ts"]    # one step of the flow: its name and the event it puts on the wire (the contract); its work is done by the domain, not by the step
     tests: none
-    goesTo: "the full edition: a lite app has no saga"
     coverage: none
     rules: [BE_SAGA_STEP_COMPENSATION, BE_SAGA_EVENT_CONTRACT]
   - id: be.feature.saga.compensations
@@ -1050,18 +1067,15 @@ slots:
     path: "src/features/saga/<saga>/compensations/"
     pattern: saga
     presence: opt-in
-    litePresence: forbidden
     tracked: tracked
     tier: feature
     allows: ["<step>.compensation.ts"]   # REQUIRED for every step: the command that undoes it, naming the failure event that triggers it
     tests: none
-    goesTo: "the full edition: a lite app has no saga"
     coverage: none
     rules: [BE_SAGA_STEP_COMPENSATION, BE_SAGA_EVENT_CONTRACT, BE_SAGA_E2E_MISSING]
   - id: be.feature.application.support
     profiles: [be]
     path: "src/features/{api/,jobs/,reactors/,saga/}<feature>/application/support/"
-    lite: {path: "src/features/api/<feature>/application/support/"}
     presence: optional            # helpers and types local to ONE feature; same tier as application, never a shared home
     tracked: tracked
     tier: feature                 # feature tier: another feature cannot import it (features never import features)
@@ -1099,7 +1113,6 @@ slots:
     profiles: [be]
     path: "src/features/{api/,reactors/,saga/}<feature>/transport/message/"
     presence: opt-in              # queue consumer: composed by the service that owns it (an api app) or by a worker app scaled apart
-    litePresence: forbidden       # a consumer reads the event bus, which lite does not have
     pattern: event-bus            # a consumer reads the event bus; declaring the pattern enables the slot
     tracked: tracked
     tier: feature
@@ -1108,7 +1121,6 @@ slots:
     tests: none
     coverage: none
     composedBy: [api, worker]
-    goesTo: "the full edition: a lite app has no event bus, so no message transport (a third-party callback is a webhooks feature)"
     rules: [BE_BACKGROUND_UNOWNED, BE_SAGA_CONSUMER_DEDUPE]
   # ----- BE: feature kinds that are not an api: a webhook door and a realtime door. Each kind is a folder of src/features/ named by
   # the kind and holds one folder per provider or channel; a kind imports only modules/* (never another kind) and only an
@@ -1139,9 +1151,6 @@ slots:
     requires: ["<provider>-http.module.ts", "<provider>.webhook.ts", "<provider>.webhook.spec.ts"]
     allows: ["<provider>-http.module.ts", "<provider>.webhook.ts", "<provider>.webhook.spec.ts", dto/]
     tests: unit-beside            # the door's own spec (<provider>.webhook.spec.ts) beside the door: the one non-service unit spec of this kind
-    lite:                         # a lite app has no test world: the door and its module only
-      requires: ["<provider>-http.module.ts", "<provider>.webhook.ts"]
-      allows: ["<provider>-http.module.ts", "<provider>.webhook.ts", dto/]
     coverage: none
     composedBy: [api]
     rules: [BE_WEBHOOK_SHAPE, BE_WEBHOOK_UNVERIFIED, BE_DEFAULT_DENY, BE_INPUT_BOUNDED]
@@ -1163,7 +1172,6 @@ slots:
     profiles: [be]
     path: "src/features/realtime/<channel>/"
     presence: opt-in              # a push channel: reads and pushes only (a socket gateway or a GraphQL subscription), no domain write
-    litePresence: forbidden       # under lite realtime is Supabase Realtime (the client subscribes to channels; nothing serves them in be/)
     pattern: realtime             # declaring the pattern (hfs.json sides.be.patterns) enables the kind (knowledge/patterns/be/realtime.yaml)
     trigger: realtime
     tracked: tracked
@@ -1172,7 +1180,11 @@ slots:
     requires: [index.ts, transport/]
     allows: [index.ts, transport/]
     tests: none
-    goesTo: "the full edition: under lite realtime is Supabase Realtime (RLS-governed), not a be kind"
+    lite:
+      why: >-
+        a push channel on the same socket.io gateway as full (owner ruling 2026-10-13): lite runs the gateway inside the be api
+        process, one instance and no Redis adapter; the front end listens through hooks/socketio
+        (knowledge/patterns/be/realtime.yaml, liteAdapter)
     coverage: none
     rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
     since: 1.0.0
@@ -1180,11 +1192,11 @@ slots:
     profiles: [be]
     path: "src/features/realtime/<channel>/transport/graphql/"
     presence: opt-in              # a GraphQL subscription over graphql-ws
-    litePresence: forbidden
+    litePresence: forbidden       # a graphql-ws server is self-hosted push infrastructure: lite pushes through Supabase Realtime
     pattern: realtime
     tracked: tracked
     tier: feature
-    goesTo: "the full edition: under lite realtime is Supabase Realtime, not a be kind"
+    goesTo: "src/features/realtime/<channel>/transport/websocket/ (be.feature.realtime.websocket): both editions push through the socket.io gateway; lite runs it in the api process"
     requires: ["<channel>-graphql.module.ts", "<channel>.subscription.ts", "<channel>.subscription.spec.ts"]
     allows: ["<channel>-graphql.module.ts", "<channel>.subscription.ts", "<channel>.subscription.spec.ts", dto/]
     tests: unit-beside            # the door's own spec beside the door (a subscription has no service of its own)
@@ -1196,11 +1208,11 @@ slots:
     profiles: [be]
     path: "src/features/realtime/<channel>/transport/graphql/dto/"
     presence: opt-in
-    litePresence: forbidden
+    litePresence: forbidden       # the dto of the graphql door, which lite does not serve
     pattern: realtime
     tracked: tracked
     tier: feature
-    goesTo: "the full edition: under lite realtime is Supabase Realtime, not a be kind"
+    goesTo: "src/features/realtime/<channel>/transport/websocket/ (be.feature.realtime.websocket): both editions push through the socket.io gateway; lite runs it in the api process"
     allows: ["<name>.{input,type,args}.ts"]
     tests: none
     coverage: none
@@ -1210,12 +1222,10 @@ slots:
   - id: be.feature.realtime.websocket
     profiles: [be]
     path: "src/features/realtime/<channel>/transport/websocket/"
-    presence: opt-in              # a socket gateway
-    litePresence: forbidden
+    presence: opt-in              # a socket.io gateway; lite runs it in the api process (owner ruling 2026-10-13)
     pattern: realtime
     tracked: tracked
     tier: feature
-    goesTo: "the full edition: under lite realtime is Supabase Realtime, not a be kind"
     requires: ["<channel>-websocket.module.ts", "<channel>.gateway.ts", "<channel>.gateway.spec.ts"]
     allows: ["<channel>-websocket.module.ts", "<channel>.gateway.ts", "<channel>.gateway.spec.ts"]
     tests: unit-beside            # the door's own spec beside the door (a gateway has no service of its own)
@@ -1246,6 +1256,18 @@ slots:
     coverage: none
     rules: [BE_CLI_COMMAND_SHAPE, BE_CLI_OWNER, BE_CLI_REQUIRED, BE_MODULE_SHAPE, BE_SCHEMA_AUTHORITY]
 
+  - id: be.assets
+    profiles: [be]
+    # Small binary assets bundled with the build (fonts a renderer embeds, a watermark): one folder per kind (owner ruling
+    # 2026-10-13, HFS assets policy). Large or user media (music, video, uploads) live in object storage and are fetched at runtime;
+    # templates and copy are TS constants in the owning capability (*.templates.ts). There is no be/resources/.
+    path: "src/assets/<kind>/"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    coverage: none
+    since: 3.0.0
   # ----- BE: modules (three tiers, closed set) -----------------------------------------------------------
   - id: be.domain
     profiles: [be]
@@ -1255,7 +1277,9 @@ slots:
     tier: domain
     owner: true
     requires: [index.ts]
-    allows: ["<capability>.module.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts"]
+    # <name>.templates.ts holds the capability's static templates, copy and presets as TS constants (owner ruling 2026-10-13);
+    # user-editable ones are seed rows, large or user media live in object storage.
+    allows: ["<capability>.module.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts"]
     forbids: [testing/, exceptions/, utils/, helpers/, shared/]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
     coverage: required
@@ -1340,12 +1364,16 @@ slots:
     profiles: [be]
     path: "src/modules/platform/event-bus/"
     presence: opt-in
-    litePresence: forbidden       # Kafka is exactly the footprint lite removes
     pattern: event-bus            # the ONE durable event transport: transactional outbox, relay, Kafka, inbox, retry and dead letter (knowledge/patterns/be/event-bus.yaml)
     tracked: tracked
     tier: platform
     owner: true
-    goesTo: "the full edition: a lite app has no event bus (no Kafka, no outbox)"
+    lite:
+      why: >-
+        the same EventPublisher and EventConsumer ports on Supabase Queues (pgmq): the outbox relay sends each committed row to the
+        pgmq queue of every consumer group of its topic through the shared EntityManager, a consumer reads with a visibility
+        timeout, retries by letting it lapse and archives the message on dead letter (read_ct over the budget); a single api may
+        deliver in process. No Kafka (knowledge/patterns/be/supabase-queues.yaml)
     requires: [index.ts, event-bus.module.ts, event-bus.port.ts, event-bus.contracts.ts, event-bus.service.ts, event-bus.service.spec.ts]
     tests: unit-beside
     coverage: required
@@ -1355,12 +1383,16 @@ slots:
     profiles: [be]
     path: "src/modules/platform/queue/"
     presence: opt-in
-    litePresence: forbidden       # BullMQ/Redis is exactly the footprint lite removes
     pattern: queue                # the ONE BullMQ owner: the outbox relay into queues (jobId = outbox id) and job schedulers (knowledge/patterns/be/queues.yaml)
     tracked: tracked
     tier: platform
     owner: true
-    goesTo: "the full edition: a lite app has no job queue (a scheduled action is a cli command; pg_cron / pg_net fires it)"
+    lite:
+      why: >-
+        the same QueueOutbox and QueueWorkerRegistry ports on Supabase Queues (pgmq): the relay sends each committed outbox row with
+        pgmq.send (the outbox id travels in the message, so a second send is a no-op at the processor's inbox), processors read
+        with a visibility timeout, back off by extending it, and pgmq.archive a message whose read_ct exceeds the budget (the dead
+        letter); a schedule is a pg_cron job that enqueues. No BullMQ or Redis (knowledge/patterns/be/supabase-queues.yaml)
     requires: [index.ts, queue.module.ts, queue.port.ts, queue.contracts.ts, queue-outbox.service.ts, queue-outbox.service.spec.ts]
     tests: unit-beside
     coverage: required
@@ -1370,12 +1402,10 @@ slots:
     profiles: [be]
     path: "src/modules/events/<service>/"
     presence: opt-in
-    litePresence: forbidden       # no event bus, so no typed events
     pattern: event-bus            # typed event classes of one service; each equals an entry of be/contracts/<service>/events.json
     tracked: tracked
     tier: events
     owner: true
-    goesTo: "the full edition: a lite app has no event bus, so no modules/events"
     requires: [index.ts]
     allows: ["<event>.event.ts", index.ts]
     tests: none
@@ -1385,12 +1415,10 @@ slots:
     profiles: [be]
     path: "src/modules/queues/<queue>/"
     presence: opt-in
-    litePresence: forbidden       # no queue, so no typed producers
     pattern: queue                # a typed producer of one queue: enqueueX(payload, tx) writes the outbox; its schedulers live beside it
     tracked: tracked
     tier: queues
     owner: true
-    goesTo: "the full edition: a lite app has no job queue, so no modules/queues"
     requires: [index.ts, "<queue>.queue.ts"]   # the module exists when a domain module imports the producer; a scheduler-only queue has none
     allows: ["<queue>.queue.ts", "<queue>.module.ts", "<queue>.contracts.ts", index.ts]
     tests: none
@@ -1400,7 +1428,6 @@ slots:
     profiles: [be]
     path: "src/features/reactors/<reactor>/"
     presence: opt-in
-    litePresence: forbidden       # no event bus, so nothing reacts to a domain event
     pattern: event-bus            # a reactor consumes events of another context and keeps a local copy or triggers a projection
     trigger: reactors
     tracked: tracked
@@ -1409,14 +1436,12 @@ slots:
     requires: [index.ts, "<reactor>.module.ts", transport/]
     allows: [index.ts, "<reactor>.module.ts", application/, transport/]
     tests: none
-    goesTo: "the full edition: a lite app has no event bus, so no reactors (a third-party callback is a webhooks feature)"
     coverage: none
     rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
   - id: be.feature.jobs
     profiles: [be]
     path: "src/features/jobs/<job>/"
     presence: opt-in
-    litePresence: forbidden       # no fenced-job platform, so no job tree
     pattern: fenced-job           # a background job: a processor with a fenced claim, steps and the application it dispatches to
     trigger: jobs
     tracked: tracked
@@ -1425,14 +1450,12 @@ slots:
     requires: [index.ts, "<job>.module.ts", steps/, transport/]
     allows: [index.ts, "<job>.module.ts", application/, steps/, transport/]
     tests: none
-    goesTo: "the full edition: a lite app has no job queue (a scheduled action is a cli command; pg_cron / pg_net fires it)"
     coverage: none
     rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
   - id: be.feature.jobs.queue
     profiles: [be]
     path: "src/features/jobs/<job>/transport/queue/"
     presence: opt-in              # the queue transport of the job: its module and the processor the job runner hands the fenced claim to
-    litePresence: forbidden
     pattern: fenced-job
     tracked: tracked
     tier: feature
@@ -1441,31 +1464,26 @@ slots:
     tests: none
     coverage: none
     composedBy: [api, worker]
-    goesTo: "the full edition: a lite app has no job queue"
     rules: [BE_BACKGROUND_UNOWNED]
   - id: be.feature.jobs.steps
     profiles: [be]
     path: "src/features/jobs/<job>/steps/"
     presence: opt-in
-    litePresence: forbidden
     pattern: fenced-job           # one external effect per step; it takes the claimed job and writes through the guarded methods
     tracked: tracked
     tier: feature
     allows: ["<step>.step.ts"]
     tests: none
-    goesTo: "the full edition: a lite app has no job queue"
     coverage: none
     rules: [BE_JOB_SHAPE, BE_JOB_RUN_KEY]
   - id: be.platform.jobs
     profiles: [be]
     path: "src/modules/platform/jobs/"
     presence: opt-in
-    litePresence: forbidden       # no fenced-job primitive without a queue
     pattern: fenced-job           # the ONE fencing primitive: the job entity, the claim that bumps the token, guarded writes (knowledge/patterns/be/jobs.yaml)
     tracked: tracked
     tier: platform
     owner: true
-    goesTo: "the full edition: a lite app has no job queue (a scheduled action is a cli command)"
     requires: [index.ts, jobs.module.ts, jobs.port.ts, jobs.contracts.ts, job-claim.service.ts, job-claim.service.spec.ts, fenced.processor.ts]
     tests: unit-beside
     coverage: required
@@ -1475,14 +1493,15 @@ slots:
     profiles: [be]
     path: "src/modules/projections/<name>/"
     presence: opt-in
-    litePresence: forbidden       # a read model replayed off an event stream needs the event bus lite does not have
     pattern: projection           # a read model: only its projection writes its table; recompute is idempotent and replayable; readers use get*
     tracked: tracked
     tier: projections
     owner: true
-    goesTo: "the full edition: a lite app has no event stream to project; a read shape is a view or a read-* in fe modules/db"
     requires: [index.ts, "<name>.module.ts", "<name>.projection.ts", "<name>.projection-entity.ts"]
     allows: [index.ts, "<name>.module.ts", "<name>.module-definition.ts", "<name>.options.ts", "<name>.projection.ts", "<name>.projection-entity.ts", "<name>.contracts.ts", persistence/]
+    lite:                         # the read model's table is a supabase migration with its rows type (lite's schema authority): no TypeORM projection entity
+      requires: [index.ts, "<name>.module.ts", "<name>.projection.ts"]
+      allows: [index.ts, "<name>.module.ts", "<name>.module-definition.ts", "<name>.options.ts", "<name>.projection.ts", "<name>.contracts.ts", persistence/]
     tests: unit-beside            # a measured slot: <name>.projection.spec.ts beside its projection is legal (the file owes 100 per file; a spec of its own is optional)
     coverage: required
     rules: [BE_PROJECTION_WRITE_OWNER, BE_PROJECTION_SHAPE, BE_TIER_DIRECTION, BE_CONTEXT_COUPLING]
@@ -1533,10 +1552,15 @@ slots:
     profiles: [be]
     path: "src/tests/world/"
     presence: optional
-    litePresence: forbidden       # a lite app has no test world
     tracked: tracked
     tier: e2e
-    goesTo: "the full edition: a lite app has no test world (no containers, fakes or useTestWorld)"
+    lite:
+      why: >-
+        the world of the optional integration specs of a lite app: global-setup.ts connects to the local Supabase CLI stack
+        (`starci supabase start`, with the migrations applied by the local stack) and starts no container, no toxiproxy and no stack of its
+        own; use-test-world.ts exports useTestWorld({ modules: [...] }) -> world.db.<connection> (the shared EntityManager) and
+        world.fake.<provider> (a network-edge fake of an external SaaS). There is no world.apps (no e2e) and no world.infra
+        (no self-hosted service to cut)
     allows: [global-setup.ts, global-teardown.ts, use-test-world.ts, "fakes/<provider>/server.ts", fakes/]   # jest globalSetup/globalTeardown default-export (Jest API); fakes/<provider>/server.ts is the fake server of a provider, a literal file name BE_SOURCE_FORM reads as its role; plus root files with a role suffix (test-world-files, R47)
     tests: none
     coverage: none
@@ -1553,10 +1577,8 @@ slots:
     profiles: [be]
     path: "src/tests/world/kit/"
     presence: optional
-    litePresence: forbidden
     tracked: tracked
     tier: e2e
-    goesTo: "the full edition: a lite app has no test world"
     allows: ["<name>.ts"]    # plain kebab names, like platform/primitives (BE-CONVENTION 1.11 names primitives/time.ts): the world's inlined test helpers (poll, free-ports)
     tests: none
     coverage: none
@@ -1565,10 +1587,8 @@ slots:
     profiles: [be]
     path: "src/tests/fixtures/"
     presence: optional
-    litePresence: forbidden
     tracked: tracked
     tier: fixtures
-    goesTo: "the full edition: a lite app has no test fixtures"
     allows: [i18n/]   # i18n/ is the one folder that may carry localized text
     tests: none
     coverage: none
@@ -1577,10 +1597,8 @@ slots:
     profiles: [be]
     path: "src/tests/fixtures/builders/*.builder.ts"
     presence: optional
-    litePresence: forbidden
     tracked: tracked
     tier: fixtures
-    goesTo: "the full edition: a lite app has no test fixtures"
     tests: none
     coverage: none
     why: >-
@@ -1593,10 +1611,8 @@ slots:
     profiles: [be]
     path: "src/tests/fixtures/i18n/"
     presence: optional
-    litePresence: forbidden
     tracked: tracked
     tier: fixtures
-    goesTo: "the full edition: a lite app has no test fixtures"
     allows: ["<name>.<role>.ts"]   # data files that deliberately carry localized text (a real Vietnamese string a parser or formatter must accept); no specs here
     tests: none
     coverage: none
@@ -1605,23 +1621,25 @@ slots:
     profiles: [be]
     path: "src/tests/integration/<capability>/*.integration-spec.ts"
     presence: optional
-    litePresence: forbidden
     tracked: tracked
     tier: e2e
     tests: e2e
-    goesTo: "the full edition: a lite app has no test tree"
     coverage: none
+    lite:
+      why: >-
+        optional under lite: one capability module through useTestWorld({ modules }) against the local Supabase CLI stack
+        (`starci supabase start`), run by test:integration; no container, no toxiproxy and no outage through the world (R112 is full's)
     why: one capability module through useTestWorld({ modules }), no HTTP door of ours (SQL, transactions, concurrency, inbox claims on the real database; and every integration client, `<capability>` being its provider folder, against our real infra, a real peer app or the library fake at the network edge, with its success, its ErrorCode refusal mapping and an outage through the world, R112); run by test:integration
     rules: [BE_TEST_TOPOLOGY, BE_INTEGRATION_SPEC_MISSING]
   - id: be.tests.e2e
     profiles: [be]
     path: "src/tests/e2e/<area>/*.e2e-spec.ts"
     presence: optional
-    litePresence: forbidden
+    litePresence: forbidden       # owner ruling 2026-10-12: a lite app has no e2e world
     tracked: tracked
     tier: e2e
     tests: e2e
-    goesTo: "the full edition: a lite app has no test tree"
+    goesTo: "the full edition: a lite app has no e2e world; its logic is proven by unit specs and its database by optional integration specs on `starci supabase start`"
     coverage: none
     why: flow e2e through useTestWorld({ apps }); external services are the world's network fakes; run by test:e2e
     rules: [HFS_CI_E2E_AUTOMATIC, BE_TEST_TOPOLOGY, BE_E2E_FLOW]
@@ -1629,11 +1647,11 @@ slots:
     profiles: [be]
     path: "src/tests/contract/<provider>/*.contract-spec.ts"
     presence: optional
-    litePresence: forbidden
+    litePresence: forbidden       # owner ruling 2026-10-12: a lite app has no contract world
     tracked: tracked
     tier: e2e
     tests: e2e
-    goesTo: "the full edition: a lite app has no test tree"
+    goesTo: "the full edition: a lite app has no contract world (provider sandbox specs)"
     coverage: none
     why: provider sandbox contracts, skipped without sandbox config; run only by test:contract, never part of test or test:e2e
     rules: [BE_TEST_TOPOLOGY]
@@ -1674,22 +1692,25 @@ slots:
     presence: required
     tracked: tracked
     tier: route
-    allows: ["[locale]/**/{page,layout,template,loading,error,not-found,default}.tsx", "[locale]/**/route.ts", "[locale]/providers.tsx",
+    # Owner ruling 2026-10-13 (R212 case-2, lite = full): routes are thin and the front end serves no API - health/live is the one
+    # route handler of this slot, the Supabase auth callback is fe.route.callback, and no file holds a Server Action
+    # (FE_ROUTE_HANDLER_FORBIDDEN, FE_SERVER_ACTION_FORBIDDEN).
+    allows: ["[locale]/**/{page,layout,template,loading,error,not-found,default}.tsx", "[locale]/providers.tsx",
              global-error.tsx, page.tsx,   # the root page.tsx only redirects (FE_ROUTE_FILES_THIN)
              not-found.tsx, layout.tsx,    # next-intl: a request outside every locale renders the root not-found inside a root layout
-             "health/{live,ready}/route.ts", "api/**/route.ts", "_*/**", providers.tsx, globals.css,
+             health/live/route.ts, "_*/**", providers.tsx, globals.css,
              "{icon,favicon,apple-icon,opengraph-image,twitter-image}.*", robots.ts, sitemap.ts, manifest.ts]
     # providers.tsx (root or [locale]) is the client wrapper the server layout renders around its children to host context providers.
     roles: {page: page.tsx, layout: layout.tsx, template: template.tsx, loading: loading.tsx, error: error.tsx, not-found: not-found.tsx, default: default.tsx, route: route.ts, global-error: global-error.tsx, providers: providers.tsx}
     tests: none
-    rules: [FE_ROUTE_FILES_THIN, FE_CLIENT_BOUNDARY, FE_OWNER_REACHABLE]
+    rules: [FE_ROUTE_FILES_THIN, FE_CLIENT_BOUNDARY, FE_OWNER_REACHABLE, FE_ROUTE_HANDLER_FORBIDDEN, FE_SERVER_ACTION_FORBIDDEN]
   - id: fe.source-root-pinned
     profiles: [fe]
-    path: "apps/<app>/src/{proxy.ts,instrumentation.ts,instrumentation-client.ts}"
+    path: "apps/<app>/src/{proxy.ts,instrumentation.ts,instrumentation-client.ts,sentry.server.config.ts,sentry.edge.config.ts}"
     presence: optional
     tracked: tracked
     tier: route
-    roles: {proxy: proxy.ts, instrumentation: instrumentation.ts, instrumentation-client: instrumentation-client.ts}
+    roles: {proxy: proxy.ts, instrumentation: instrumentation.ts, instrumentation-client: instrumentation-client.ts, sentry: "sentry.*.config.ts"}
     tests: none
     rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16 (fe.source-root-middleware)
   - id: fe.source-root-middleware
@@ -1703,9 +1724,9 @@ slots:
     rules: [FE_NEXT_CONVENTIONS]
   - id: fe.route.callback
     profiles: [fe]
-    # The auth callback of a Supabase session (the PKCE code exchange): the one non-health route handler of an app with a Supabase
-    # connection, in either edition (an upgrade lite -> full leaves it as it is, fe/** is never touched); an app without one has no
-    # route handler in fe/ (L15).
+    # The auth callback of a Supabase session (the PKCE code exchange), kept only when the auth flow truly needs a server exchange
+    # (prefer the client-side PKCE exchange in fe.modules.auth): the one non-health route handler of an app with a Supabase
+    # connection; an app without one has no route handler in fe/ (L15).
     path: "apps/<app>/src/app/auth/callback/route.ts"
     presence: opt-in
     provider: supabase
@@ -1741,6 +1762,22 @@ slots:
     tests: none
     budget: {component.tsx: 300, index.tsx: 200, dataHooks: 6, useState: 6}
     rules: [FE_CONNECTED_BLOCK_RENDER_PAIR, FE_I18N_LITERAL, FE_NATIVE_FORM_CONTROL, FE_CLIENT_BOUNDARY]
+  - id: fe.components.providers
+    profiles: [fe]
+    # The client providers the root layout mounts once (owner ruling 2026-10-13, fe-stack theme/state-global/data): the redux store,
+    # the SWR configuration, the theme (next-themes), the HeroUI toast region and the side-effect components (SwrSideEffects,
+    # SocketIoSideEffects). A provider wires state, so it sits at the feature tier, above components.
+    path: "apps/<app>/src/components/providers/<name>/"
+    presence: optional
+    tracked: tracked
+    tier: feature
+    owner: true
+    requires: [index.tsx]
+    allows: [index.tsx]
+    roles: {entry: index.tsx}
+    tests: none
+    since: 3.0.0
+    rules: [FE_CLIENT_BOUNDARY]
   - id: fe.hooks
     profiles: [fe]
     path: "apps/<app>/src/hooks/<domain>/"
@@ -1754,6 +1791,116 @@ slots:
     tests: none
     budget: {file: 200, dataHooks: 6, useState: 6}
     rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
+  - id: fe.hooks.swr
+    profiles: [fe]
+    # The data hooks (fe-stack data, FE-DATA-SWR): one useSWR / useSWRMutation wrapper per modules/api operation, keyed
+    # QUERY_<X>_SWR_KEY / MUTATE_<X>_SWR_KEY plus the identity of the request; SwrSideEffects.tsx runs the app-wide hooks once.
+    path: "apps/<app>/src/hooks/swr/"
+    presence: optional
+    tracked: tracked
+    tier: hooks
+    owner: true
+    requires: [index.ts]
+    allows: [index.ts, SwrSideEffects.tsx, api/index.ts, "api/{graphql,rest}/index.ts", "api/{graphql,rest}/{queries,mutations}/index.ts",
+             "api/graphql/queries/useQuery*Swr.ts", "api/graphql/mutations/useMutate*Swr.ts",
+             "api/rest/queries/useGet*Swr.ts", "api/rest/mutations/use{Post,Put,Patch,Delete}*Swr.ts"]
+    roles: {entry: index.ts, effects: SwrSideEffects.tsx}
+    tests: none
+    budget: {file: 200}
+    since: 3.0.0
+    rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
+  - id: fe.hooks.rhf
+    profiles: [fe]
+    # The forms (fe-stack forms, FE-FORM): react-hook-form with the zod resolver; the schema carries next-intl messages and the
+    # submit runs an SWR mutation through modules/toast.
+    path: "apps/<app>/src/hooks/rhf/"
+    presence: optional
+    tracked: tracked
+    tier: hooks
+    owner: true
+    requires: [index.ts]
+    allows: [index.ts, "use*Form.ts"]
+    roles: {entry: index.ts}
+    tests: none
+    budget: {file: 200}
+    since: 3.0.0
+    rules: [FE_HOOKS_ARE_HOOKS]
+  - id: fe.hooks.zustand
+    profiles: [fe]
+    # Feature-local client state (fe-stack state-local, FE-STATE-ZUSTAND): one store per folder.
+    path: "apps/<app>/src/hooks/zustand/<store>/"
+    presence: optional
+    tracked: tracked
+    tier: hooks
+    owner: true
+    requires: [index.ts, store.ts]
+    allows: [index.ts, store.ts, "use*.ts"]
+    roles: {entry: index.ts, store: store.ts}
+    tests: none
+    budget: {file: 200}
+    since: 3.0.0
+    rules: [FE_HOOKS_ARE_HOOKS]
+  - id: fe.hooks.socketio
+    profiles: [fe]
+    # Realtime (fe-stack realtime, FE-REALTIME): one socket.io-client singleton per namespace in sockets.ts and one side-effect
+    # component that wires the listeners to redux and SWR.
+    path: "apps/<app>/src/hooks/socketio/"
+    presence: optional
+    tracked: tracked
+    tier: hooks
+    owner: true
+    requires: [index.ts, sockets.ts, SocketIoSideEffects.tsx]
+    allows: [index.ts, sockets.ts, SocketIoSideEffects.tsx, connectionStore.ts, "enums/*.ts", "types/*.ts", "use*.ts"]
+    roles: {entry: index.ts, effects: SocketIoSideEffects.tsx}
+    tests: none
+    budget: {file: 200}
+    since: 3.0.0
+    rules: [FE_HOOKS_ARE_HOOKS]
+  - id: fe.hooks.effects
+    profiles: [fe]
+    # App-wide side effects (route params synced into redux, the auth bootstrap): use<X>.ts hooks and the <X>SideEffect(s).tsx
+    # components that run them once; a provider in components/providers mounts those components (a route never imports hooks).
+    path: "apps/<app>/src/hooks/effects/"
+    presence: optional
+    tracked: tracked
+    tier: hooks
+    owner: true
+    requires: [index.ts]
+    allows: [index.ts, "use*.ts", "*SideEffect.tsx", "*SideEffects.tsx"]
+    roles: {entry: index.ts, effects: "*SideEffect.tsx"}
+    tests: none
+    budget: {file: 200}
+    since: 3.0.0
+    rules: [FE_HOOKS_ARE_HOOKS]
+  - id: fe.hooks.reuseables
+    profiles: [fe]
+    # Reusable generic hooks (fe-stack utils): no domain, no data.
+    path: "apps/<app>/src/hooks/reuseables/"
+    presence: optional
+    tracked: tracked
+    tier: hooks
+    owner: true
+    requires: [index.ts]
+    allows: [index.ts, "use*.ts"]
+    roles: {entry: index.ts}
+    tests: none
+    budget: {file: 200}
+    since: 3.0.0
+    rules: [FE_HOOKS_ARE_HOOKS]
+  - id: fe.redux
+    profiles: [fe]
+    # App-wide shared state (fe-stack state-global, FE-STATE-REDUX): the store, its typed hooks, the provider and one file per slice.
+    path: "apps/<app>/src/redux/"
+    presence: optional
+    tracked: tracked
+    tier: modules
+    owner: true
+    requires: [index.ts, store.ts, hooks.ts]
+    allows: [index.ts, store.ts, hooks.ts, ReduxProvider.tsx, "slices/*.ts"]
+    roles: {entry: index.ts, store: store.ts, hooks: hooks.ts}   # hooks.ts: the typed useAppDispatch/useAppSelector of the store
+    tests: none
+    budget: {file: 400}
+    since: 3.0.0
   - id: fe.modules
     profiles: [fe]
     path: "apps/<app>/src/modules/<capability>/"
@@ -1772,32 +1919,38 @@ slots:
     presence: optional
     tracked: tracked
     tier: transport
-    # The app's reads of the one client. A repository has exactly ONE transport client and ONE Outcome union: the app's
-    # client.ts/outcome.ts (fe.transport.client/outcome) in a one-app repository, or the api package's
-    # (fe.package.api.client/outcome) when the repository shares it (FE_TRANSPORT_OWNER, machine).
+    # The browser's calls to the back end (owner ruling 2026-10-13, fe-stack graphql/rest/codegen, FE-API-GRAPHQL): the auth and
+    # no-auth Apollo clients with their link chain (graphql/clients), one file per operation (graphql/queries/query-<x>.ts,
+    # graphql/mutations/mutation-<x>.ts with its gql document map and typed request/response in types/), the generated wire types
+    # (graphql/__generated__) and the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints. A repository has
+    # exactly ONE client folder and ONE GraphQLResponse union: the app's (fe.transport.client/outcome) when one app calls the back end,
+    # or the api package's (fe.package.api.client/outcome) when several do (FE_TRANSPORT_OWNER, machine).
     requires: [index.ts]
-    allows: [index.ts, client.ts, outcome.ts, "<domain>/read-*.ts", "<domain>/*.graphql", "<domain>/<domain>.mapper.ts", __generated__/]
-    roles: {entry: index.ts, reader: "read-*.ts"}   # a reader is a server module (FE_CLIENT_REACHES_SERVER)
+    allows: [index.ts, graphql/index.ts, graphql/types.ts, "graphql/clients/**", "graphql/queries/query-*.ts", "graphql/queries/types/*.ts",
+             "graphql/mutations/mutation-*.ts", "graphql/mutations/types/*.ts", "graphql/__generated__/**", "rest/index.ts", "rest/<area>/*.ts"]
+    roles: {entry: index.ts, query: "query-*.ts", mutation: "mutation-*.ts"}
+    # A hook imports its one operation file directly (one file per operation, FE-API-GRAPHQL), never through a barrel of every operation.
+    entries: ["graphql/queries/query-*.ts", "graphql/queries/types/*.ts", "graphql/mutations/mutation-*.ts", "graphql/mutations/types/*.ts"]
     tests: none
     rules: [FE_TRANSPORT_OWNER, FE_HTTP_STATUS_COLLAPSE, FE_WIRE_GENERATED]
   - id: fe.transport.client
     profiles: [fe]
-    path: "apps/<app>/src/modules/api/client.ts"
+    path: "apps/<app>/src/modules/api/graphql/clients/"
     presence: optional
     tracked: tracked
     tier: transport
     tests: none
-    why: the one fetch of a one-app repository (timeout, abort, 401/403 -> refused); a shared client is fe.package.api.client
+    why: the auth and no-auth Apollo clients and their link chain (retry, error, timeout, token refresh, attach access token, http) of the one app that calls the back end; when several apps do, the shared client is fe.package.api.client
     rules: [FE_TRANSPORT_OWNER]
   - id: fe.transport.outcome
     profiles: [fe]
-    path: "apps/<app>/src/modules/api/outcome.ts"
+    path: "apps/<app>/src/modules/api/graphql/types.ts"
     presence: optional
     tracked: tracked
     tier: transport
     outcomeHome: true
     tests: none
-    why: the one Outcome union of a one-app repository; a shared union is fe.package.api.outcome
+    why: the one GraphQLResponse union ({success, message, error, data}) of the one app that calls the back end; when several apps do, the shared union is fe.package.api.outcome
     rules: [FE_HTTP_STATUS_COLLAPSE]
   - id: fe.modules.config
     profiles: [fe]
@@ -1844,47 +1997,50 @@ slots:
     tier: foundation
     tests: none
     why: shared types with no runtime behaviour; a component may import them
-  - id: fe.modules.db
+  - id: fe.modules.types.ambient
+    parent: fe.modules.types
     profiles: [fe]
-    # The db transport of an app on Supabase (the ONLY place that imports @supabase/ssr or @supabase/supabase-js, L10): the
-    # server client factory (cookies, anon key, RLS applies), the browser client factory, getPrincipal() (React cache,
-    # auth.getClaims()) and toOutcome() mapping {data, error} into the same Outcome vocabulary modules/api uses. Readers
-    # live in <domain>/read-*.ts, Server Actions (schema-parsed input) in <domain>/write-*.ts; the row types come from
-    # supabase/types/database.types.ts (sides.fe.reads). The barrel index.ts is server-only (it re-exports server code), so
-    # browser.ts, the browser client factory a client hook imports, is a second public entry of the owner (`entries`).
-    path: "apps/<app>/src/modules/db/"
-    presence: opt-in              # enabled by a connection with provider: supabase; required under edition lite
-    provider: supabase
-    litePresence: required
+    path: "apps/<app>/src/modules/types/ambient/"
+    presence: optional
     tracked: tracked
-    tier: transport
-    requires: [index.ts, server.ts, browser.ts, principal.ts]
-    allows: [index.ts, server.ts, browser.ts, principal.ts, outcome.ts, "<domain>/read-*.ts", "<domain>/write-*.ts", "<domain>/<domain>.mapper.ts"]
-    entries: [browser.ts]
-    anonymousActions: [auth/write-sign-in.ts, auth/write-sign-out.ts]     # the Server Actions that run for an anonymous principal by design (FE_AUTH_SESSION_TRUST)
+    tier: foundation
+    owner: true
+    allows: ["*.d.ts"]
     tests: none
-    since: 2.1.0
-  - id: fe.modules.db.outcome
+    since: 2.2.0
+    why: global ambient declarations loaded by the app compiler; this owner exposes no runtime API
+  - id: fe.modules.auth
     profiles: [fe]
-    # A lite app has no modules/api: its db transport is the transport, so the one Outcome union lives here (toOutcome maps
-    # {data, error} into it). Under full the union stays fe.transport.outcome / fe.package.api.outcome.
-    editions: [lite]
-    path: "apps/<app>/src/modules/db/outcome.ts"
-    presence: opt-in
-    provider: supabase
-    litePresence: optional
+    # The identity-provider client (fe-stack auth, FE-AUTH): the session, the access token the Apollo link attaches and the
+    # sign-in/sign-out calls. With a Supabase connection it is the ONLY fe importer of @supabase/supabase-js and uses its auth API
+    # only; Supabase on the front end never reads or writes data (owner ruling 2026-10-13).
+    path: "apps/<app>/src/modules/auth/"
+    presence: optional
     tracked: tracked
-    tier: transport
-    outcomeHome: true
+    tier: modules
+    owner: true
+    requires: [index.ts]
     tests: none
-    why: the one Outcome union of a lite app; its db owner is the transport
-    rules: [FE_HTTP_STATUS_COLLAPSE]
-    since: 2.1.0
+    since: 3.0.0
+    rules: [FE_SUPABASE_CLIENT_OWNER, FE_SERVICE_ROLE_FORBIDDEN]
+  - id: fe.modules.toast
+    profiles: [fe]
+    # Mutation feedback (fe-stack toast, FE-TOAST): the HeroUI toast wrapper, showGraphQLToast over a GraphQLResponse and the
+    # use*WithToast hooks with next-intl labels.
+    path: "apps/<app>/src/modules/toast/"
+    presence: optional
+    tracked: tracked
+    tier: modules
+    owner: true
+    requires: [index.ts, toast.tsx, api.ts, hooks.ts]
+    allows: [index.ts, toast.tsx, api.ts, hooks.ts]
+    roles: {entry: index.ts, hooks: hooks.ts}   # hooks.ts: the use*WithToast hooks of the toast module
+    tests: none
+    since: 3.0.0
   - id: fe.package.ui
     profiles: [fe]
     path: "packages/<family>-ui/"
     presence: opt-in
-    litePresence: optional        # a lite app scaffolds no packages; one appears by need, without an optionalSlots entry
     tracked: tracked
     tier: package
     owner: true
@@ -1899,38 +2055,36 @@ slots:
     profiles: [fe]
     path: "packages/<family>-api/"
     presence: opt-in
-    litePresence: optional
     tracked: tracked
     tier: package
     owner: true
-    requires: [package.json, src/index.ts, src/client.ts, src/outcome.ts, tsconfig.json]
+    requires: [package.json, src/index.ts, src/graphql/clients/index.ts, src/graphql/types.ts, tsconfig.json]
     tests: none
     why: the one transport client and the one Outcome union shared by every app of the repository; no app keeps its own
     rules: [FE_TRANSPORT_OWNER, FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT]
   - id: fe.package.api.client
     profiles: [fe]
-    path: "packages/<family>-api/src/client.ts"
+    path: "packages/<family>-api/src/graphql/clients/"
     presence: optional     # enabled with its package (fe.package.api is the opt-in)
     tracked: tracked
     tier: package
     tests: none
-    why: the repository's one fetch (timeout, abort, 401/403 -> refused)
+    why: the repository's one pair of Apollo clients and their link chain
     rules: [FE_TRANSPORT_OWNER]
   - id: fe.package.api.outcome
     profiles: [fe]
-    path: "packages/<family>-api/src/outcome.ts"
+    path: "packages/<family>-api/src/graphql/types.ts"
     presence: optional     # enabled with its package (fe.package.api is the opt-in)
     tracked: tracked
     tier: package
     outcomeHome: true
     tests: none
-    why: the repository's one Outcome union
+    why: the repository's one GraphQLResponse union
     rules: [FE_HTTP_STATUS_COLLAPSE]
   - id: fe.package.i18n
     profiles: [fe]
     path: "packages/<family>-i18n/"
     presence: opt-in
-    litePresence: optional
     tracked: tracked
     tier: package
     owner: true
@@ -1938,20 +2092,6 @@ slots:
     tests: none
     why: the next-intl stack (routing, navigation, request config) written once, exported as the createAppI18n factory every app calls
     rules: [FE_I18N_PLACEMENT, FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT]
-  - id: fe.package.db
-    profiles: [fe]
-    # The shared Supabase client factories once a second fe app needs them (server, browser, principal, toOutcome) -
-    # mirroring fe.transport.client vs fe.package.api.client; the one Outcome union is re-exported from
-    # fe.package.api.outcome when the api package exists.
-    path: "packages/<family>-db/"
-    presence: opt-in
-    provider: supabase
-    tracked: tracked
-    tier: package
-    owner: true
-    requires: [package.json, src/index.ts, tsconfig.json]
-    tests: none
-    since: 2.1.0
 
 # Checks that read this manifest (all ship from .claude; none keeps its own path list)
 consumers: