@starci/eslint-canon-fe 8.2.18 → 8.3.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 8.3.0 - 2026-10-15
+- Changed: layouts may import overlays beside pages (tier edge `feature -> feature` from pages and layouts to overlays); a layout hosts the route-selected overlay through `components/branches/OverlayHost` while pages stay server components (pattern FE-BOUNDARY-5). Carries the runtime mirror of the manifest and pins, rebased onto alpha.13 (eslint-canon-fe 8.2.18).
+
+## 8.2.17 - 2026-10-14
+- Changed: `component-line-budget` gives a pure re-export `index.ts` the slot's `barrel` budget (400); `basePropsAtom` admits named `render*` callbacks in `props` of non-block pure halves for feature composition; the bundled machine carries the kind-scoped feature tier edge, canon-shape clone exclusions and in-segment i18n template reads.
+
+
+- Changed: carry the runtime mirror of HFS manifest 3.1.0 (the back-end app composition standard, R245 and R246) and the canon pins of eslint-canon-be 3.3.0, HFS 4.3.0 and CLI 1.2.16. ESLint rule implementations are unchanged.
+
 ## 8.2.18 - 2026-10-14
 
 - Changed: carry the canon pins of eslint-canon-be 3.2.19, HFS 4.2.17 and CLI 1.2.17 in the runtime mirror. ESLint rule implementations are unchanged.

package/README.md

@@ -45,13 +45,31 @@ class-name ownership. Reusable class names belong in a colocated `classNames.ts`
 be composed with HeroUI `cn` using one utility token per argument.
 
 The `drawing` law holds the split surfaces (blocks, pages, layouts, overlays under `components/`
-or `features/`): the pure `XBase` takes `{ state, props, on }` of atoms (`base-props-atom`), only its
+or `features/`): the pure `XBase` takes `{ state, props, on }` of atoms, with named `render`/`renderX`
+callbacks in feature `props` for block composition (`base-props-atom`), only its
 sibling `index.tsx` imports it and never re-exports it (`base-import-pair`), `XState` names drawn
 shapes and never a data status (`no-data-status-shape`), and a block renders each slot's
 loading/forbidden/error/empty through `SlotView` (`slot-status-through-slotview`). The law's name is
 the `drawing` slot role of `component.tsx`; a split-surface reference tree lives under
 `.claude/examples/`.
 
+Page and layout owners in `features/{pages,layouts}/<Name>/index.tsx` may compose overlay and block public entries. A server
+page may import and render a client overlay entry while remaining a server component: `FE_CLIENT_BOUNDARY` accepts the
+overlay entry, and `FE_CLIENT_SERVER_IMPORT` / `FE_CLIENT_REACHES_SERVER` reject server-only imports from its client closure.
+The only feature-to-feature edge is pages or layouts to overlays; layouts never import pages, overlays never import other
+overlays, components never import overlays, and blocks never import another block. For a client list, a server page mounts an overlay whose connected entry reads list
+identities and supplies a block renderer to its pure Base. A pure component or branch may render that keyed list by
+calling the supplied render prop; it imports no block and fetches no data. The supplied renderer composes blocks only,
+with no intrinsic markup or hook calls, and each connected item block still renders its exact sibling `XBase`.
+
+A layout-level overlay host passes rendered overlay candidates into a client `features/overlays/OverlayRouteHost` entry.
+Its hook under `hooks/overlays` reads `usePathname()` and `useSearchParams()` and supplies scalar selection to the pure
+`components/branches/OverlayHost` branch. The layout imports the candidate overlay entries; the host and branch only
+receive rendered nodes. No callback crosses the server-to-client boundary, and pages stay server components. This
+composition-only host renders an existing public pure branch without a forwarding private Base; connected blocks still
+require their exact sibling Base. The worked tree is in
+[`knowledge/patterns/fe/boundaries.yaml`](../../../knowledge/patterns/fe/boundaries.yaml), `FE-BOUNDARY-5`.
+
 The one locale pattern everywhere is `next-intl`, a `[locale]` segment, default `vi`,
 `localePrefix: "as-needed"`, and `proxy.ts` instead of `middleware.ts`.
 

package/docs/size-and-state-budget.md

@@ -2,31 +2,31 @@
 
 Law module: `size-and-state-budget.mjs`. Catalogue: R65 FE_SIZE_AND_STATE_BUDGET.
 
-A component file is at most 300 lines; a connected unit holds at most 6 `useState` and reads at most 6 data hooks; there is no hand-written polling loop. `HFS_SIZE_GROWTH` (no growth against the parent commit) is the architecture machine's; these are the absolute file-local limits.
+A drawing file is at most 300 lines, a connected `index.tsx` at most 200, and a hook implementation at most 200. A pure re-export `index.ts` has a separate 400-line budget. A connected unit holds at most 6 `useState` and reads at most 6 data hooks; there is no hand-written polling loop. `HFS_SIZE_GROWTH` (no growth against the parent commit) is the architecture machine's; these are the absolute file-local limits.
 
 Every rule below is an error in `starciFeConfig`; none can be switched off or suppressed inline.
 
 ## `starci-fe/component-line-budget`
 
-A component file has at most 300 lines.
+A file stays within the budget of its HFS slot: `component.tsx` 300 lines, connected `index.tsx` 200, hook implementation 200, module 400. Where the slot states `budget.barrel`, an `index.ts` containing only `export ... from` statements uses that separate 400-line limit. Named, type-only, star and namespace re-exports qualify, including multiline statements and comments. Imports, declarations, local exports, directives and empty statements keep the ordinary limit, as does an empty statement body. Another basename or `index.tsx` keeps its ordinary limit. The rule reads every limit from `knowledge/hfs/slots.yaml`; a trailing newline does not add a line.
 
 **Invalid** (`src/components/blocks/Feed/index.tsx`)
 
 ```ts
-// a 301-line component file
+// a 201-line connected entry
 ```
 
 **Valid** (`src/components/blocks/Feed/index.tsx`)
 
 ```ts
-// 300 lines or fewer
+// 200 lines or fewer
 ```
 
 **Finding code:** `FE_SIZE_AND_STATE_BUDGET`
 
-**Why:** `<file>` is `<n>` lines long, over the 300-line limit for a component.
+**Why:** `<file>` is `<n>` lines long, over the limit its slot states for the file's role or its pure re-export barrel.
 
-**Fix:** Separate rendering from data and split each region into its own unit.
+**Fix:** Split an oversized implementation by responsibility; narrow a barrel's public surface to the exports its owner needs.
 
 ## `starci-fe/unit-hook-budget`
 

package/drawing.mjs

@@ -8,8 +8,8 @@
  *
  * THE PURE HALF TAKES ATOMS. `component.tsx` receives `{ state, props, on }`: `props` is data
  * (strings, numbers, booleans, arrays, plain objects), `on` is actions whose arguments are data,
- * and the children it renders are written inside it, never handed in. A layout alone also takes
- * `children`, because the router puts the page there.
+ * and feature composition may also take named `render` callbacks inside `props` to render supplied
+ * blocks. A layout alone also takes `children`, because the router puts the page there.
  *
  * ONLY ITS OWN INDEX MAY IMPORT IT. Other tiers use the connected export, so the pure half stays a
  * private drawing surface that audit can render from a fixture.
@@ -38,6 +38,10 @@ const pureHalf = (context) =>
 /** Type names that carry a rendered tree rather than data. */
 const NON_ATOM_TYPE = /^(?:ReactNode|ReactElement|ReactPortal|JSX\.Element|Element|ComponentType|FC|FunctionComponent|ElementType|ComponentProps|RenderFunction)$/
 
+/** Feature composition's render callbacks return a rendered value and take only data. */
+const RENDER_RESULT_TYPE = /^(?:ReactNode|ReactElement|JSX\.Element)$/
+const RENDER_PROP_NAME = /^render(?:[A-Z][A-Za-z0-9]*)?$/
+
 /** The printed name of a type reference, qualified names included. */
 const typeNameOf = (node) => {
   const name = node?.typeName
@@ -79,17 +83,17 @@ const keyOf = (member) => (member.key?.type === "Identifier" ? member.key.name :
 
 // -- DRAWING-1 ----------------------------------------------------------------------------------
 
-/** The pure half takes `{ state, props, on }` of atoms; only a layout also takes `children`. */
+/** The pure half takes atom data and actions; feature composition may receive named render callbacks. */
 export const basePropsAtom = {
   meta: {
     type: "problem",
-    docs: { description: "A pure `XBase` takes `state`, atom `props` and `on` actions; no component or tree crosses in." },
+    docs: { description: "A pure `XBase` takes `state`, atom `props` and `on` actions; feature composition may receive named render callbacks in `props`." },
     schema: [],
     messages: {
       tree:
         "`{{path}}` hands a rendered tree (`{{type}}`) into the pure half. Write the child inside `component.tsx` and pass it atoms (ids, strings, flags); a tree handed in cannot be drawn, audited or reused.",
       action:
-        "`{{path}}` is a function inside `props`. Actions live in `on`, so `props` stays pure data that a fixture can hold.",
+        "`{{path}}` is a function inside `props`. Actions live in `on`; feature composition may receive named `render` callbacks that take atoms and return rendered blocks.",
       onData:
         "`on.{{key}}` is not an action. `on` holds functions only; data belongs in `props`.",
       member:
@@ -101,45 +105,78 @@ export const basePropsAtom = {
     if (!tier) return {}
     let types = new Map()
 
+    /** Resolve render results locally; an optional empty result does not make data a render prop. */
+    const isRenderResult = (node, seen = new Set()) => {
+      if (!node) return false
+      if (node.type === "TSUnionType") {
+        const empty = (part) => ["TSNullKeyword", "TSUndefinedKeyword"].includes(part.type)
+          || part.type === "TSLiteralType" && part.literal.value === null
+        return node.types.some((part) => isRenderResult(part, new Set(seen)))
+          && node.types.every((part) => empty(part) || isRenderResult(part, new Set(seen)))
+      }
+      if (node.type !== "TSTypeReference") return false
+      const name = typeNameOf(node)
+      if (RENDER_RESULT_TYPE.test(name.replace(/^React\./, ""))) return true
+      if (!types.has(name) || seen.has(name)) return false
+      return isRenderResult(types.get(name), new Set(seen).add(name))
+    }
+
+    const checkRenderCallback = (node, path, allowed) => {
+      if (!allowed || !isRenderResult(node.returnType?.typeAnnotation)) return false
+      for (const parameter of node.params ?? node.parameters ?? []) {
+        checkData(parameter.typeAnnotation?.typeAnnotation, `${path}(${parameter.name ?? "arg"})`, new Set(), false, true)
+      }
+      return true
+    }
+
+    const checkDataReference = (node, path, seen, renderProp, renderParameter) => {
+      const name = typeNameOf(node)
+      if (NON_ATOM_TYPE.test(renderParameter ? name.replace(/^React\./, "") : name)) {
+        context.report({ node, messageId: "tree", data: { path, type: name } })
+        return
+      }
+      for (const argument of node.typeArguments?.params ?? node.typeParameters?.params ?? []) checkData(argument, path, seen, false, renderParameter)
+      if (types.has(name) && !seen.has(name)) {
+        const nextSeen = renderProp || renderParameter ? new Set(seen) : seen
+        nextSeen.add(name)
+        checkData(types.get(name), path, nextSeen, renderProp, renderParameter)
+      }
+    }
+
+    const checkDataMember = (member, path, seen, renderParameter) => {
+      const memberPath = `${path}.${keyOf(member)}`
+      const allowsRender = tier !== "blocks" && path === "props" && RENDER_PROP_NAME.test(keyOf(member))
+      if (member.type === "TSMethodSignature") {
+        if (!checkRenderCallback(member, memberPath, allowsRender)) context.report({ node: member, messageId: "action", data: { path: memberPath } })
+      } else if (member.type === "TSPropertySignature") {
+        checkData(member.typeAnnotation?.typeAnnotation, memberPath, seen, allowsRender, renderParameter)
+      }
+    }
+
     /** Walk a data type: report trees and functions anywhere inside it. */
-    const checkData = (node, path, seen) => {
+    const checkData = (node, path, seen, renderProp = false, renderParameter = false) => {
       if (!node) return
       switch (node.type) {
         case "TSFunctionType":
+          if (checkRenderCallback(node, path, renderProp)) return
           context.report({ node, messageId: "action", data: { path } })
           return
-        case "TSTypeReference": {
-          const name = typeNameOf(node)
-          if (NON_ATOM_TYPE.test(name)) {
-            context.report({ node, messageId: "tree", data: { path, type: name } })
-            return
-          }
-          for (const argument of node.typeArguments?.params ?? node.typeParameters?.params ?? []) checkData(argument, path, seen)
-          if (types.has(name) && !seen.has(name)) {
-            seen.add(name)
-            checkData(types.get(name), path, seen)
-          }
+        case "TSTypeReference":
+          checkDataReference(node, path, seen, renderProp, renderParameter)
           return
-        }
         case "TSUnionType":
         case "TSIntersectionType":
-          for (const part of node.types) checkData(part, path, seen)
+          for (const part of node.types) checkData(part, path, seen, renderProp, renderParameter)
           return
         case "TSArrayType":
-          checkData(node.elementType, path, seen)
+          checkData(node.elementType, path, seen, false, renderParameter)
           return
         case "TSTypeOperator":
-          checkData(node.typeAnnotation, path, seen)
+          checkData(node.typeAnnotation, path, seen, false, renderParameter)
           return
         case "TSTypeLiteral":
         case "TSInterfaceBody":
-          for (const member of node.members ?? node.body) {
-            if (member.type === "TSMethodSignature") {
-              context.report({ node: member, messageId: "action", data: { path: `${path}.${keyOf(member)}` } })
-            } else if (member.type === "TSPropertySignature") {
-              checkData(member.typeAnnotation?.typeAnnotation, `${path}.${keyOf(member)}`, seen)
-            }
-          }
+          for (const member of node.members ?? node.body) checkDataMember(member, path, seen, renderParameter)
           return
         default:
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "8.2.18",
+  "version": "8.3.0",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.2.19
+    version: 3.3.1
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.2.18
+    version: 8.3.0
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.2.17
+    version: 1.3.0
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.2.17
+    version: 4.3.0
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.0.0
+version: 3.1.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -31,6 +31,12 @@ versioning:
 # is the socket.io gateway in both editions), fe.route holds pages, layouts and the one health/live route handler, and the slots
 # marked `since: 3.0.0` are added: the Apollo, SWR, RHF, zustand and socket.io hooks, redux, modules/auth, modules/toast, the
 # providers, be.assets and the migration archive.
+# 3.1.0 is a minor (owner ruling 2026-10-14, R245 and R246): every be.app.* slot allows `<app>.env.ts` and the composition groups
+# `compose/<area>.ts` and budgets its app files (`app.module.ts` 250, `<app>.options.ts` 200, `<app>.env.ts` 150,
+# `compose/<area>.ts` 120, `main.ts` 80); `<app>.env.ts` exports interface <App>Env and read<App>Env(env: EnvSource): <App>Env
+# for fail-fast env parsing only, and `<app>.options.ts` holds env-derived options and port bindings only, with no parsing
+# or environment reads (BE_APP_OPTIONS_COMPOSITION). Secrets use EnvSource.secret(): <NAME>_FILE first, plain <NAME> only
+# when the file key is absent; .starcistacks owns custody. Capability <capability>.config.ts roles stay unchanged.
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -139,6 +145,7 @@ naming:
 # ---------------------------------------------------------------------------------------------------------
 # Tiers and the dependency direction matrix (owner granularity; type-only imports count; no cycles anywhere)
 # mayImport lists the tiers a file of that tier may import. Importing inside the same owner is always allowed.
+# mayImportKinds narrows a permitted tier edge to its named from/to folder kinds; other kind pairs remain forbidden.
 # ---------------------------------------------------------------------------------------------------------
 tiers:
   be:
@@ -155,7 +162,7 @@ tiers:
     package:      {mayImport: [package]}
   fe:
     route:        {mayImport: [feature, foundation, modules, transport, package]} # app/** adapters
-    feature:      {mayImport: [components, hooks, foundation, modules, transport, package]}
+    feature:      {mayImport: [feature, components, hooks, foundation, modules, transport, package], mayImportKinds: {feature: {from: [pages, layouts], to: [overlays]}}} # pages and layouts compose overlays and blocks; other feature-to-feature edges stay forbidden
     # A component never reaches data: config, routes, i18n and types are foundation; every other module and the api
     # transport are reached through a hook (owner decision 2026-09-29).
     components:   {mayImport: [components, hooks, foundation, package], lowerLayerOnly: true} # blocks, composites, branches, leaves
@@ -501,6 +508,33 @@ slots:
     tests: none
     managedBy: docker-ignore
     rules: [HFS_MANAGED_FILE_DRIFT]
+  - id: app.deploy
+    profiles: [app]
+    # Production delivery tooling for the app's own processes: compose files, Caddyfile, *.env.example and ops shell scripts.
+    # Lite still keeps its backing services on Supabase and its encrypted custody in app.starcistacks; R06 scans every file here.
+    path: "deploy/"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET]
+  - id: app.ci-deploy
+    profiles: [app]
+    # Product-owned delivery workflows; the literal app.ci-db path remains the managed database workflow's more specific slot.
+    path: ".github/workflows/<app>-deploy.yml"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET]
+  - id: app.ci-authorize-deploy-key
+    profiles: [app]
+    path: ".github/workflows/authorize-deploy-key.yml"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET]
   - id: app.browser
     profiles: [app]
     # The browser journey of the product (Playwright, owner ruling: one minimal journey per example app, run manually): the config, its
@@ -536,6 +570,17 @@ slots:
       path: scripts/codegen.mjs
     liteManagedBy: codegen-lite
     rules: [HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]     # one-off codemods and fix-* scripts are agent output, not tooling
+  - id: app.scripts.delivery
+    profiles: [app]
+    editions: [lite]
+    # Product-owned environment, secret and build tooling, kept apart from lite's managed codegen script.
+    # Full already owns these files through app.scripts; its generic *.mjs pattern must not compete with build-*.mjs.
+    path: "scripts/{env-sync.mjs,with-secrets.mjs,set-secrets.ps1,build-*.mjs}"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
   - id: app.sides
     profiles: [app]
     # The two sides. Everything below be/ and fe/ is judged by the side's own slots (profiles be and fe) with the side folder as its root;
@@ -558,23 +603,13 @@ slots:
              "features/<feature>/ui/<name>/assets/<approved-file>", "features/<feature>/uat/<name>/{index,accounts,fixtures}.yaml",
              "features/<feature>/uat/<name>/{seed,cleanup}.sql", "_resources/{identities,environments,fixtures}/<slug>/resource.yaml"]
     forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/]
-    # Lite keeps the product catalog, feature overviews, grammar and brand drawing records; UAT records belong to the forbidden slot below.
+    # Owner amendment 2026-10-14: lite keeps workspace.yaml for project identity and repo roles, plus brand drawing records,
+    # references and assets. No brand means no Work tree is needed; workspace.yaml is legal but optional.
+    litePresence: optional
     lite:
-      requires: [.gitignore, workspace.yaml, index.yaml]
-      allows: [workspace.yaml, index.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml", "features/<feature>/ui/<name>/index.yaml", "features/<feature>/ui/<name>/assets/<approved-file>"]
+      requires: [.gitignore]
+      allows: [workspace.yaml, "brand/**"]
     rules: [HFS_AGENT_DATA_TRACKED, HFS_IDENTITY_CUSTODY]
-  - id: app.starciwork.uat
-    profiles: [app]
-    # The UAT records of the full edition: they are proven on the e2e world (identities, fixtures, br/ac evidence) that lite does
-    # not have, so the trees are forbidden paths under lite only. In full this slot does not exist and .starciwork answers for them.
-    editions: [lite]
-    path: ".starciwork/{_resources/identities,_resources/fixtures,features/<feature>/uat,features/<feature>/br}/"
-    presence: forbidden
-    tracked: external
-    tier: none
-    tests: none
-    goesTo: "the full edition: a lite app has no e2e world, so no UAT records (no identities or fixtures resources, no br/ac evidence, no uat directories)"
-    since: 2.1.0
   - id: app.starcistacks
     profiles: [app]
     # The stack declarations and the sealed custody of the app, at the app root beside be/, fe/ and .starciwork (never under a side).
@@ -584,16 +619,16 @@ slots:
     tier: none
     tests: none
     requires: [application-stacks.yaml]
-    allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,k8s,terraform}/**", "<env>/infra/metadata.json",
+    allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,k8s,terraform,swarm}/**", "<env>/infra/metadata.json",
              "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
     forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
-    # Lite has no self-hosted infrastructure (owner ruling 2026-10-12): .starcistacks holds env and secret custody only - the stack
-    # declaration, the environment descriptor and the sealed secrets; the stack's one backing service is the Supabase project (the
-    # local CLI stack or the cloud project). infra/ (compose, k8s, terraform), runtime/ and seeds/ are the full edition's.
+    # Lite keeps full's code structure with backing infrastructure replaced by Supabase (owner ruling 2026-10-13). The api and
+    # sidecars run on docker-swarm; its value-free stack belongs in <env>/infra/swarm/. The checker also refuses components whose
+    # images duplicate Supabase services: postgres, redis, kafka, keycloak, minio, rabbitmq, mysql and mongo.
     lite:
-      requires: []
-      allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep"]
-      forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
+      requires: [application-stacks.yaml]
+      allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/swarm/**", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep"]
+      forbids: ["<env>/infra/{compose,k8s,terraform}/**", "<env>/runtime/**", "<env>/seeds/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
     rules: [HFS_STACKS_SHAPE, HFS_STACKS_IN_SIDE, HFS_PLAINTEXT_SECRET, HFS_IDENTITY_CUSTODY]
   - id: app.sops
     profiles: [app]
@@ -637,7 +672,7 @@ slots:
     goesTo: "<lanes root>/<project>/<lane>/ (outside every repository) for a lane; a Kernel workflow's worktree is created and owned by Orca outside the app checkout, never tracked, and removed by the runtime's host-side controller once the workflow's finish marked it release-pending"
   - id: app.plaintext-env
     profiles: [app]
-    path: "{.env,.env.*,.secrets/,**/*.pem,**/*.key}"
+    path: "{.env,.env.*,secrets.env,.secrets/,**/*.pem,**/*.key}"
     presence: forbidden
     tracked: external
     tier: none
@@ -959,6 +994,23 @@ slots:
     rules: [BE_CONTRACT_BREAKING]
 
   # ----- BE: apps (one slot per app kind; a new kind = a new slot, minor bump) ---------------------------
+  # The files of every app (owner ruling 2026-10-14, R245 and R246, since 3.1.0), each with a line budget that
+  # BE_APP_COMPOSITION_BUDGET holds absolutely (not a ratchet):
+  #   main.ts            the entry: builds EnvSource once, imports and calls read<App>Env from <app>.env.ts, builds options and boots.
+  #   <app>.env.ts       exports interface <App>Env and read<App>Env(env: EnvSource): <App>Env (for example ApiEnv/readApiEnv);
+  #                      fail-fast environment parsing only, via EnvSource and unchanged capability parse helpers; no localhost
+  #                      or default host fallback, logic, module composition, business code or feature imports. Only main.ts
+  #                      and this app file may read process.env or EnvSource. The interface declares its own readonly parsed
+  #                      members with parser-derived types, structurally compatible with the app's options;
+  #                      the role name stays <app>.env.ts, never env.ts. Secrets use EnvSource.secret(): <NAME>_FILE first
+  #                      for .starcistacks custody, plain <NAME> only when the file key is absent. A declared file supplies
+  #                      exact contents; an empty or unreadable path stops boot without fallback.
+  #   <app>.options.ts   the options: env-derived options plus port bindings (provider maps such as { approvalGate: X }) only;
+  #                      no environment parsing or process.env/EnvSource reads; module, queue or scheduler composition here or in <app>.env.ts is
+  #                      BE_APP_OPTIONS_COMPOSITION.
+  #   compose/<area>.ts  a composition group: exports the module list of one area (an imports array, and the providers of the
+  #                      area's global ports when it has any); composition only, no business logic or process.env/EnvSource read.
+  #   app.module.ts      the composition root: imports the groups and spreads them, binds the app-wide guards and filter.
   - id: be.app.api
     profiles: [be]
     path: "apps/<app>/src/"
@@ -969,11 +1021,11 @@ slots:
     owner: true
     minInstances: 1
     requires: [main.ts, app.module.ts]
-    allows: [main.ts, app.module.ts, "<app>.options.ts", operations.ts]
+    allows: [main.ts, app.module.ts, "<app>.env.ts", "<app>.options.ts", "compose/<area>.ts", operations.ts]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
     coverage: none
-    budget: {app.module.ts: 250, main.ts: 80}
-    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_BUSINESS_ROLE, BE_DEFAULT_DENY, BE_ERROR_MASKED, BE_FEATURE_NOT_COMPOSED, BE_CONTEXT_OWNER]
+    budget: {app.module.ts: 250, main.ts: 80, "<app>.env.ts": 150, "<app>.options.ts": 200, "compose/<area>.ts": 120}
+    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_BUSINESS_ROLE, BE_APP_OPTIONS_COMPOSITION, BE_APP_COMPOSITION_BUDGET, BE_DEFAULT_DENY, BE_ERROR_MASKED, BE_FEATURE_NOT_COMPOSED, BE_CONTEXT_OWNER]
   - id: be.app.worker
     profiles: [be]
     path: "apps/<app>/src/"
@@ -983,17 +1035,19 @@ slots:
     tier: app
     owner: true
     requires: [main.ts, app.module.ts]
-    allows: [main.ts, app.module.ts, "<app>.options.ts"]
+    allows: [main.ts, app.module.ts, "<app>.env.ts", "<app>.options.ts", "compose/<area>.ts"]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
     coverage: none
-    rules: [BE_APP_COMPOSITION_ONLY, BE_BACKGROUND_UNOWNED, BE_CONTEXT_OWNER]
+    budget: {app.module.ts: 250, main.ts: 80, "<app>.env.ts": 150, "<app>.options.ts": 200, "compose/<area>.ts": 120}
+    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_OPTIONS_COMPOSITION, BE_APP_COMPOSITION_BUDGET, BE_BACKGROUND_UNOWNED, BE_CONTEXT_OWNER]
   - id: be.app.cli
     profiles: [be]
     # The ONE app of every one-off action (migrate, seed, sync, backup, any operator command): be/apps/cli, on nest-commander.
     # main.ts boots with CommandFactory.run (BE_CLI_BOOTSTRAP); app.module.ts composes the platform and the cli feature root
-    # (src/features/cli/cli.module.ts); cli.options.ts carries what it needs from the environment, the connections it migrates
-    # among them (the test world migrates through the same list). It is required as soon as the back end declares a connection
-    # or tracks a command, with its image apps/cli/Dockerfile (BE_CLI_REQUIRED): one image, run as `cli <group> <command>`.
+    # (src/features/cli/cli.module.ts); cli.env.ts exports CliEnv and readCliEnv(env: EnvSource): CliEnv, and cli.options.ts carries the env-derived values,
+    # the connections it migrates among them (the test world migrates through the same list). It is required as soon as the
+    # back end declares a connection or tracks a command, with its image apps/cli/Dockerfile (BE_CLI_REQUIRED): one image,
+    # run as `cli <group> <command>`.
     path: "apps/<app>/src/"
     appKind: cli
     presence: opt-in
@@ -1002,10 +1056,11 @@ slots:
     tier: app
     owner: true
     requires: [main.ts, app.module.ts]
-    allows: [main.ts, app.module.ts, "<app>.options.ts"]
+    allows: [main.ts, app.module.ts, "<app>.env.ts", "<app>.options.ts", "compose/<area>.ts"]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
     coverage: none
-    rules: [BE_CLI_REQUIRED, BE_CLI_BOOTSTRAP, BE_CLI_OWNER, BE_SCHEMA_AUTHORITY]
+    budget: {app.module.ts: 250, main.ts: 80, "<app>.env.ts": 150, "<app>.options.ts": 200, "compose/<area>.ts": 120}
+    rules: [BE_CLI_REQUIRED, BE_CLI_BOOTSTRAP, BE_CLI_OWNER, BE_SCHEMA_AUTHORITY, BE_APP_OPTIONS_COMPOSITION, BE_APP_COMPOSITION_BUDGET]
 
   # ----- BE: features ------------------------------------------------------------------------------------
   # src/features/ is grouped by TRIGGER KIND (owner decision 2026-10-02): features/api/<feature>/ (a request: application/ and
@@ -1515,7 +1570,7 @@ slots:
     requires: [index.ts, "<provider>.config.ts"]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts; plus src/tests/integration/<provider>/ (R112)
     coverage: required
-    budget: {indexExports: 60}
+    budget: {indexExports: 80}   # a provider's port surface includes clients, config, options, tokens and errors
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INTEGRATION_SPEC_MISSING]
   - id: be.integrations.model
     profiles: [be]
@@ -1789,7 +1844,7 @@ slots:
     allows: [index.ts, "use<name>.ts", "<domain>.shared.ts"]   # React hooks only; <domain>.shared.ts = sanctioned non-hook helpers
     roles: {entry: index.ts, shared: "<domain>.shared.ts"}
     tests: none
-    budget: {file: 200, dataHooks: 6, useState: 6}
+    budget: {file: 200, barrel: 400, dataHooks: 6, useState: 6}   # barrel: index.ts containing only export ... from statements
     rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
   - id: fe.hooks.swr
     profiles: [fe]
@@ -1806,7 +1861,7 @@ slots:
              "api/rest/queries/useGet*Swr.ts", "api/rest/mutations/use{Post,Put,Patch,Delete}*Swr.ts"]
     roles: {entry: index.ts, effects: SwrSideEffects.tsx}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
   - id: fe.hooks.rhf
@@ -1822,7 +1877,7 @@ slots:
     allows: [index.ts, "use*Form.ts"]
     roles: {entry: index.ts}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.zustand
@@ -1837,7 +1892,7 @@ slots:
     allows: [index.ts, store.ts, "use*.ts"]
     roles: {entry: index.ts, store: store.ts}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.socketio
@@ -1853,7 +1908,7 @@ slots:
     allows: [index.ts, sockets.ts, SocketIoSideEffects.tsx, connectionStore.ts, "enums/*.ts", "types/*.ts", "use*.ts"]
     roles: {entry: index.ts, effects: SocketIoSideEffects.tsx}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.effects
@@ -1869,7 +1924,7 @@ slots:
     allows: [index.ts, "use*.ts", "*SideEffect.tsx", "*SideEffects.tsx"]
     roles: {entry: index.ts, effects: "*SideEffect.tsx"}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.reuseables
@@ -1884,7 +1939,7 @@ slots:
     allows: [index.ts, "use*.ts"]
     roles: {entry: index.ts}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.redux
@@ -1909,6 +1964,7 @@ slots:
     tier: modules
     owner: true
     requiredInstances: {capability: [config, i18n, routes]}
+    # A populated fe.modules instance with no .ts or .tsx files (CSS/assets only) needs no index.ts.
     requires: [index.ts]
     tests: none
     budget: {file: 400}

package/runtime/knowledge/patterns/fe/folder.yaml

@@ -174,6 +174,9 @@ rules:
       component.tsx. Pure blocks, composites, branches and leaves use index.tsx only and never gain an
       empty twin. classNames.ts is present only when the unit owns class strings. Budgets: component.tsx 300 lines,
       connected index.tsx 200 lines, at most 6 data hooks and 6 useState per connected unit.
+      A composition-only feature may render an existing public pure component owner directly instead of creating a
+      forwarding component.tsx. The route-state overlay host of FE-BOUNDARY-5 renders components/branches/OverlayHost;
+      a connected block still requires its exact private Base twin.
     rationale: |
       Stable basenames make class names and the connected and presentational split discoverable without forwarding
       twins, and budgets keep a unit reviewable.

package/runtime/scripts/api/git/cat-file.mjs

@@ -0,0 +1,5 @@
+// cat-file.mjs — `git cat-file <args>`: the type, size or content of repository objects (-e, -p, --batch).
+import { runGit } from './lib.mjs';
+
+/** The spawn result {status, stdout, stderr, error} of `git cat-file ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
+export const catFile = (args = [], options = {}) => runGit(['cat-file', ...args], options);

package/runtime/scripts/api/git/diff.mjs

@@ -0,0 +1,5 @@
+// diff.mjs — `git diff <args>`: the changes between commits, the index and the working tree.
+import { runGit } from './lib.mjs';
+
+/** The spawn result {status, stdout, stderr, error} of `git diff ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
+export const diff = (args = [], options = {}) => runGit(['diff', ...args], options);