@starci/eslint-canon-fe 8.2.18 → 8.4.0

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.0.0
+version: 3.3.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -25,12 +25,19 @@ versioning:
 # overlays and `provider`, and `sides.<side>.reads` of an app-root tree) and the lite slots; an app without `edition` in its
 # hfs.json is edition full and every answer for it is unchanged.
 # 2.2.0 adds the declaration-only fe.modules.types.ambient owner.
-# 3.0.0 is a major (owner decision 2026-10-13, R212 cases 1-2): lite is the full code structure deployed without self-hosted
-# infrastructure and without e2e, and the front end is one standard for both editions (knowledge/hfs/fe-stack.yaml). The
+# 3.0.0 is a major (ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4)): lite is the full code structure deployed with Supabase backing services
+# and without e2e, and the front end is one standard for both editions (knowledge/hfs/fe-stack.yaml). The
 # front-end database slots and the Supabase realtime feature slot are removed (Supabase on the front end is auth only, realtime
 # is the socket.io gateway in both editions), fe.route holds pages, layouts and the one health/live route handler, and the slots
 # marked `since: 3.0.0` are added: the Apollo, SWR, RHF, zustand and socket.io hooks, redux, modules/auth, modules/toast, the
 # providers, be.assets and the migration archive.
+# 3.1.0 is a minor (owner ruling 2026-10-14, R245 and R246): every be.app.* slot allows `<app>.env.ts` and the composition groups
+# `compose/<area>.ts` and budgets its app files (`app.module.ts` 250, `<app>.options.ts` 200, `<app>.env.ts` 150,
+# `compose/<area>.ts` 120, `main.ts` 80); `<app>.env.ts` exports interface <App>Env and read<App>Env(env: EnvSource): <App>Env
+# for fail-fast env parsing only, and `<app>.options.ts` holds env-derived options and port bindings only, with no parsing
+# or environment reads (BE_APP_OPTIONS_COMPOSITION). Secrets use EnvSource.secret(): <NAME>_FILE first, plain <NAME> only
+# when the file key is absent; .starcistacks owns custody. Capability <capability>.config.ts roles stay unchanged.
+# 3.3.0 is a minor (alpha.16): it ADDS the optional app.ci-stack-deploy slot, the managed workflow of the starci app stack verbs.
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -77,16 +84,16 @@ versioning:
 #               liteManagedBy is managed only in lite; its effective lite.path still lists literal files.
 #               the managed file list lives here and nowhere in code. A difference is HFS_MANAGED_FILE_DRIFT (a
 #               back end's tsconfig.json: HFS_TS_STRICT when a flag or an option was added).
-#   rules       rule ids (the catalog lands with knowledge/hfs/rules.yaml).
+#   rules       rule codes from knowledge/hfs/rules.yaml.
 #   editions    the editions (below) the slot exists in; default all of them. A slot outside the declared edition owns
 #               no path - under lite, what full keeps absent is removed, and what lite forbids is a finding.
 #   litePresence  the presence under edition lite (default: presence): a bare value, or {be, fe} for a both-sides slot.
 #               A slot forbidden in lite is external there and must name its goesTo. Only infrastructure is forbidden in lite:
-#               the self-hosted stack (.starcistacks infra/, runtime/, seeds/), the e2e and contract test layers and their
-#               workflow, and the browser journey.
+#               database/broker services, the e2e layer and its workflow, and the browser journey. Lite may have contract specs.
+#   editionWhy  why the slot's presence, shape or adapter differs between lite and full, with the owning ruling citation.
 #   lite        the fields the slot carries under lite only (path, requires, allows, forbids, minInstances,
 #               requiredInstances, why), each shaped as the same field in the slot body; every other field is the edition's.
-#               `why` under lite names the Supabase adapter behind the slot's ports (pgmq, Postgres locks, Supabase Realtime).
+#               `why` under lite names the adapter behind the slot's ports (pgmq, Postgres locks, in-process socket.io).
 #               `tests` is never overlaid: a lite slot owes exactly the unit specs its full slot owes.
 #   provider    the hfs.json connections[].provider that enables this opt-in slot (supabase); never an app kind.
 #   since       the manifest version that introduced the slot.
@@ -94,17 +101,18 @@ presenceValues: [required, optional, opt-in, forbidden]
 trackedValues: [tracked, ignored, external]
 testValues: [unit-beside, e2e, none]
 
-# The editions a repository declares in hfs.json `edition` (absent means full). Owner ruling 2026-10-12 (R212 case-1): lite IS
-# the full architecture deployed without self-hosted infrastructure - the same monorepo, slots, CQRS shape and patterns (queue,
+# The editions a repository declares in hfs.json `edition` (absent means full). ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite IS
+# the full architecture with Supabase backing services - the same monorepo, slots, CQRS shape and patterns (queue,
 # event bus, saga, reactors, projection, realtime, webhooks, fenced job), declared in hfs.json the same way, and the same unit
 # specs (unitRoles, logicRoles, 100 per file, @starci/jest-preset doubles, builders). What differs is ADAPTERS and DELIVERY, all
-# on Supabase: schema authority in supabase/migrations, the queue and event-bus ports on Supabase Queues (pgmq), realtime on
-# Supabase Realtime, cache and locks on Postgres, schedules on pg_cron (+ pg_net), storage and auth on Supabase. Integration specs
-# are optional and run only against the local Supabase CLI stack (`starci supabase start`); there is no e2e or contract world and no
-# self-hosted stack (.starcistacks holds env and secret custody only). The front end is the full front end (no tests, R97).
+# on Supabase except realtime: schema authority in supabase/migrations, queue and event-bus ports on Supabase Queues (pgmq),
+# cache and locks on Postgres, schedules on pg_cron (+ pg_net), storage and auth on Supabase. Realtime uses the socket.io gateway
+# in the api process, one instance and no Redis adapter. Integration and provider sandbox contract specs are optional;
+# declared patterns owe their integration proofs (R284). Lite has no e2e world. Production uses declared docker-swarm under
+# .starcistacks/production/infra/swarm/ (owner ruling 2026-10-14); no self-hosted database or broker. The front end is full's (R97).
 # Lite is this same manifest filtered: a slot whose `editions` lacks lite does not exist for a lite app, `litePresence` replaces
 # presence and a `lite` map replaces the fields it names. Upgrade lite -> full adds only (swap the adapters, add the e2e and
-# contract world and the stack); downgrade is not supported.
+# self-hosted backing services); downgrade is not supported. Lite contracts are allowed (owner decision 2026-10-14).
 editions: [full, lite]
 
 # The two sides of an app: the folder of each is its profile name (be/, fe/). `reads` lists the only paths of the OTHER side a side
@@ -139,6 +147,7 @@ naming:
 # ---------------------------------------------------------------------------------------------------------
 # Tiers and the dependency direction matrix (owner granularity; type-only imports count; no cycles anywhere)
 # mayImport lists the tiers a file of that tier may import. Importing inside the same owner is always allowed.
+# mayImportKinds narrows a permitted tier edge to its named from/to folder kinds; other kind pairs remain forbidden.
 # ---------------------------------------------------------------------------------------------------------
 tiers:
   be:
@@ -155,12 +164,12 @@ tiers:
     package:      {mayImport: [package]}
   fe:
     route:        {mayImport: [feature, foundation, modules, transport, package]} # app/** adapters
-    feature:      {mayImport: [components, hooks, foundation, modules, transport, package]}
+    feature:      {mayImport: [feature, components, hooks, foundation, modules, package], mayImportKinds: {feature: {from: [pages, layouts], to: [overlays]}}} # pages and layouts compose overlays and blocks; data goes through hooks/swr
     # A component never reaches data: config, routes, i18n and types are foundation; every other module and the api
     # transport are reached through a hook (owner decision 2026-09-29).
     components:   {mayImport: [components, hooks, foundation, package], lowerLayerOnly: true} # blocks, composites, branches, leaves
     # Across domains a hook is imported only through the other domain's public index (hooks/<domain>/index.ts), never deep.
-    hooks:        {mayImport: [hooks, foundation, modules, transport, package]}
+    hooks:        {mayImport: [hooks, foundation, modules, transport, package], mayImportSlots: {transport: {from: [fe.hooks.swr]}}} # only hooks/swr imports an operation
     foundation:   {mayImport: [foundation, package], acyclic: true}               # modules/{config,i18n,routes,types}
     modules:      {mayImport: [foundation, modules, transport, package], acyclic: true}
     transport:    {mayImport: [foundation, modules, package]}                     # modules/api: the one fetch
@@ -171,10 +180,16 @@ crossApp: apps never import each other; shared code is a packages/<pkg> slot.
 # Parameters the lint factories and checks read per profile (through ruleParams(profile) in scripts/hfs/slots.mjs, which
 # merges common under the profile: a side restates a common key only to override it).
 ruleParams:
+  db:
+    # R259: btree_gist supplies UUID equality for the booking interval exclusion constraint.
+    # R259: unaccent is a first-party Supabase extension used by Vietnamese-content search functions.
+    extensions: [pgmq, pg_cron, pgcrypto, pg_trgm, vector, uuid-ossp, pg_net, supabase_vault, unaccent, btree_gist]
   common:
     # HFS_SIZE_GROWTH: a file above soft may not grow against its parent commit; a new file stays within soft. Slot
     # budgets (component.tsx 300, hooks 200, modules 400) are stricter than this cap where they apply.
     fileLines: {soft: 500, hardGrowth: true}
+    functionLines: 80
+    featureFiles: 250
     # R21 HFS_DUPLICATE_CODE: the one threshold of duplicate code of both sides (the architecture machine reads it here;
     # no other file states it): a token-normalised block of at least `lines` source lines and `tokens` tokens that appears twice.
     duplicateBlock: {lines: 8, tokens: 60}
@@ -321,7 +336,7 @@ ruleParams:
     # Edition lite (ruleParams(manifest, 'be', 'lite') merges these keys over the base; a map merges one level deep): the schema
     # authority is the Supabase migration tree (supabase/migrations/*.sql, forward-only), so a lite back end holds no TypeORM
     # migration or entity under be/ (R34/R35 read schemaAuthority; be.persistence's lite overlay allows neither). The unit roles,
-    # logic roles and spec doubles are full's (owner ruling 2026-10-12). infraOwners: the self-hosted libraries are owned nowhere -
+    # logic roles and spec doubles are full's (owner ruling 2026-10-12 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4). infraOwners: the self-hosted libraries are owned nowhere -
     # platform/queue and platform/event-bus run Supabase Queues (pgmq) through the shared EntityManager, cache and locks are
     # Postgres (advisory locks or an unlogged table), and realtime is the same socket.io gateway as full, run inside the api
     # process with no Redis adapter (owner ruling 2026-10-13).
@@ -340,6 +355,7 @@ slots:
 
   # ----- app root (profile app: the one repository of a product) --------------------------------------------
   - id: app.declaration
+    since: 3.1.0
     profiles: [app]
     path: hfs.json
     presence: required
@@ -348,6 +364,7 @@ slots:
     tests: none
     rules: [HFS_ARCH_CONFIG_UNREAD]
   - id: app.readme
+    since: 3.1.0
     profiles: [app]
     path: README.md
     presence: required
@@ -356,7 +373,9 @@ slots:
     tests: none
     rules: [HFS_README_*]
   - id: app.package-manifest
+    since: 3.1.0
     profiles: [app]
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite manages Supabase and wiring scripts; full also manages e2e and stack test scripts. Both may run optional contracts."
     # The one package.json of the app, at the app root: be's dependencies and every tool, and every script; npm workspaces are
     # exactly fe/apps/* and fe/packages/* (HFS_MONO_WORKSPACES), each with its own package.json. be has no package.json of its own.
     path: package.json
@@ -368,6 +387,7 @@ slots:
     liteManagedBy: package-scripts-lite
     rules: [HFS_PACKAGE_MANAGER_MIXED, HFS_DEP_VERSION_SKEW, HFS_CANON_PIN_DRIFT, HFS_MANAGED_FILE_DRIFT, HFS_MONO_WORKSPACES, HFS_MONO_WORKSPACE_DEP]
   - id: app.task-graph
+    since: 3.1.0
     profiles: [app]
     # The turbo task graph of the app (build, dev, lint, typecheck over the fe workspaces; build depends on ^build and caches
     # .next and dist): rendered by starci app sync from templates/app/task-graph/turbo.json, judged for drift by starci app check. turbo needs
@@ -380,6 +400,7 @@ slots:
     managedBy: task-graph
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_MONO_WORKSPACES]
   - id: app.lockfile
+    since: 3.1.0
     profiles: [app]
     path: package-lock.json
     presence: required
@@ -388,22 +409,42 @@ slots:
     tests: none
     rules: [HFS_PACKAGE_MANAGER_MIXED, HFS_DEP_VERSION_SKEW]
   - id: app.git-meta
+    since: 3.1.0
     profiles: [app]
-    path: "{.gitignore,.gitattributes}"
+    path: .gitignore
     presence: required
     tracked: tracked
     tier: none
     tests: none
     rules: [HFS_GITIGNORE_BLOCK_DRIFT]     # the marked block of .gitignore is rendered by starci app sync (templates/app/gitignore)
+  - id: app.gitattributes
+    since: 3.2.0
+    profiles: [app]
+    path: .gitattributes
+    presence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: skeleton
+    liteManagedBy: skeleton-lite
+    editionWhy: "Lite renders the same managed file from skeleton-lite because the editions share one code structure while their adapters differ (ruling:R212/case-2, with Work amended by ruling:R212/case-4 and hosting by owner:lite-production-swarm)."
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.tool-config
+    since: 3.1.0
     profiles: [app]
     path: "{.editorconfig,.nvmrc}"
-    presence: required     # plain dotfiles, the repository's own
+    presence: required
     tracked: tracked
     tier: none
     tests: none
+    managedBy: skeleton
+    liteManagedBy: skeleton-lite
+    editionWhy: "Lite renders the same managed files from skeleton-lite because the editions share one code structure while their adapters differ (ruling:R212/case-2, with Work amended by ruling:R212/case-4 and hosting by owner:lite-production-swarm)."
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.format-config
+    since: 3.1.0
     profiles: [app]
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite additionally ignores Supabase-generated row types when formatting; full has its TypeORM schema authority."
     # The one formatter configuration of the app (prettier walks up from every file of both sides to it): .prettierrc names
     # @starci/prettier-config, .prettierignore is the template.
     path: "{.prettierrc,.prettierignore}"
@@ -415,6 +456,7 @@ slots:
     liteManagedBy: tool-config-lite     # the same files plus the generated supabase/types, which the Supabase CLI writes unformatted
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL]
   - id: app.tool-config-optional
+    since: 3.1.0
     profiles: [app]
     path: "{.npmrc,.npmignore}"     # .npmignore: npm reads the nearest ignore file instead of the root files negations, so an app that ships inside another package keeps its sealed credentials out of the tarball here
     presence: optional
@@ -422,6 +464,7 @@ slots:
     tier: none
     tests: none
   - id: app.tool-config-local
+    since: 3.1.0
     profiles: [app]
     path: "{tsconfig.json,.eslintrc,.eslintrc.*,.eslintignore,eslint.config.*,.stylelintrc,.stylelintrc.*,.stylelintignore,stylelint.config.*,.prettierrc.*,prettier.config.*,jest.config.*,lint-staged.config.*,.lintstagedrc*}"
     presence: forbidden
@@ -431,6 +474,7 @@ slots:
     goesTo: "nowhere at the app root: each side holds exactly its managed tool configuration (be.tool-config, fe.tool-config) and the root only the formatter (app.format-config)"
     rules: [HFS_TOOL_CONFIG_LOCAL]
   - id: app.quality-config
+    since: 3.1.0
     profiles: [app]
     path: "{sonar-project.properties,codecov.yml}"
     presence: required
@@ -440,6 +484,7 @@ slots:
     managedBy: quality-config     # lite renders the same files: the same coverage scope, Sonar import and Codecov flags as full
     rules: [HFS_SONAR_CONFIG, HFS_MANAGED_FILE_DRIFT]
   - id: app.hooks
+    since: 3.1.0
     profiles: [app]
     path: ".husky/{pre-commit,pre-push}"
     presence: required
@@ -449,7 +494,9 @@ slots:
     managedBy: hooks
     rules: [HFS_CI_E2E_AUTOMATIC, HFS_MANAGED_FILE_DRIFT]
   - id: app.ci
+    since: 3.1.0
     profiles: [app]
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite CI proves boot through R272 wiring and checks Supabase artifacts; full also provides its e2e lane."
     path: ".github/workflows/ci.yml"
     presence: required
     tracked: tracked
@@ -459,18 +506,22 @@ slots:
     liteManagedBy: ci-workflows-lite
     rules: [HFS_CI_E2E_AUTOMATIC, HFS_CI_MISSING_CANON, HFS_MANAGED_FILE_DRIFT]
   - id: app.ci-e2e
+    since: 3.1.0
     profiles: [app]
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite has no e2e world; R272 supplies its wiring proof, while optional contracts run separately."
     path: ".github/workflows/e2e.yml"
     presence: optional     # on: workflow_dispatch only
-    litePresence: forbidden     # a lite app has no e2e world (owner ruling 2026-10-12): unit specs run in ci.yml
+    litePresence: forbidden     # ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite has no e2e world; unit specs and R272 wiring run in ci.yml
     tracked: tracked
     tier: none
     tests: none
-    goesTo: "the full edition: a lite app has no e2e or contract world; its unit specs run in .github/workflows/ci.yml"
+    goesTo: "the full edition: a lite app has no e2e world; its unit specs and wiring proof run in .github/workflows/ci.yml; contract specs use test:contract"
     managedBy: ci-workflows
     rules: [HFS_CI_E2E_AUTOMATIC, HFS_MANAGED_FILE_DRIFT]
   - id: app.ci-images
+    since: 3.1.0
     profiles: [app]
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite renders its Supabase-backed image workflow; full renders images for its separately deployed services."
     # Builds every image of the app (one matrix entry per declared app, path-filtered), never pushes: rendered by starci app sync.
     path: ".github/workflows/images.yml"
     presence: required
@@ -482,6 +533,10 @@ slots:
     rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.ci-db
     profiles: [app]
+    exemplifiedBy:
+      - packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml
+      - {path: tests/fixtures/hfs-callback-full/.github/workflows/db-deploy.yml, edition: full}
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite manages its Supabase database deploy workflow; full owns an optional provider-specific workflow."
     # The database deploy workflow: workflow_dispatch only (like app.ci-e2e); starci app sync renders it under the managed ci group.
     path: ".github/workflows/db-deploy.yml"
     presence: optional
@@ -491,7 +546,21 @@ slots:
     liteManagedBy: ci-workflows-lite
     rules: [HFS_MANAGED_FILE_DRIFT]
     since: 2.1.0
+  - id: app.ci-stack-deploy
+    since: 3.3.0
+    profiles: [app]
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): both editions deploy their images to a Docker Swarm stack through the same starci stack verbs; the workflow lists the images the app declares."
+    # The Swarm stack deploy workflow: workflow_dispatch only (like app.ci-db); a thin file that calls `starci app stack`, rendered by starci app sync.
+    path: ".github/workflows/stack-deploy.yml"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: ci-workflows
+    liteManagedBy: ci-workflows-lite
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.dockerignore
+    since: 3.1.0
     profiles: [app]
     # The one build-context filter of every image (the context is the app root): rendered by starci app sync; it keeps secrets and build output out.
     path: .dockerignore
@@ -501,8 +570,40 @@ slots:
     tests: none
     managedBy: docker-ignore
     rules: [HFS_MANAGED_FILE_DRIFT]
+  - id: app.deploy
+    since: 3.1.0
+    profiles: [app]
+    # Production delivery tooling for the app's own processes: compose files, Caddyfile, *.env.example and ops shell scripts.
+    # Lite still keeps its backing services on Supabase and its encrypted custody in app.starcistacks; R06 scans every file here.
+    path: "deploy/"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET]
+  - id: app.ci-deploy
+    since: 3.1.0
+    profiles: [app]
+    # Product-owned delivery workflows; the literal app.ci-db path remains the managed database workflow's more specific slot.
+    path: ".github/workflows/<app>-deploy.yml"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET]
+  - id: app.ci-authorize-deploy-key
+    since: 3.1.0
+    profiles: [app]
+    path: ".github/workflows/authorize-deploy-key.yml"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET]
   - id: app.browser
+    since: 3.1.0
     profiles: [app]
+    editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): browser journeys belong to full; lite proves app boot through R272 wiring."
     # The browser journey of the product (Playwright, owner ruling: one minimal journey per example app, run manually): the config, its
     # journeys and the script that provisions the stack it runs against. It is the product's, never the front end's (FE_NO_TESTS keeps
     # refusing any test or test tooling inside fe/). Declared by `browser: true` in hfs.json; the managed script `test:browser` exists only then.
@@ -516,14 +617,31 @@ slots:
     requires: [playwright.config.ts, journeys/]
     allows: [playwright.config.ts, stack.mjs, "journeys/*.ts"]
   - id: app.github-meta
+    since: 3.1.0
     profiles: [app]
-    path: ".github/{CODEOWNERS,pull_request_template.md,ISSUE_TEMPLATE/**,dependabot.yml}"
+    path: ".github/{CODEOWNERS,pull_request_template.md,ISSUE_TEMPLATE/**}"
     presence: optional
     tracked: tracked
     tier: none
     tests: none
+  - id: app.dependabot
+    since: 3.2.0
+    profiles: [app]
+    path: .github/dependabot.yml
+    presence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: skeleton
+    liteManagedBy: skeleton-lite
+    editionWhy: "Lite renders the same managed file from skeleton-lite because the editions share one code structure while their adapters differ (ruling:R212/case-2, with Work amended by ruling:R212/case-4 and hosting by owner:lite-production-swarm)."
+    rules: [HFS_MANAGED_FILE_DRIFT, HFS_DEPENDABOT_MISSING]
   - id: app.scripts
+    since: 3.1.0
     profiles: [app]
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton/scripts/codegen.mjs, edition: full}
+    editionWhy: "Lite manages its Supabase codegen script; full owns operational scripts through the generic path (ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4))."
     # The app's operational scripts only (`*.mjs`, `*.cjs`, `*.ps1`, `*.sh`), or nothing: an empty folder is `scripts/.gitkeep`, which
     # `starci app scaffold` writes. A spec or a test (BE_SPEC_PLACEMENT, FE_NO_TESTS), a check or lint source (`check-*`, `eslint-local-rules*`,
     # a local eslint plugin: HFS_REPO_LOCAL_CHECK) and anything that re-implements a canon check is not an operational script and has no place here.
@@ -536,7 +654,23 @@ slots:
       path: scripts/codegen.mjs
     liteManagedBy: codegen-lite
     rules: [HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]     # one-off codemods and fix-* scripts are agent output, not tooling
+  - id: app.scripts.delivery
+    since: 3.1.0
+    profiles: [app]
+    exemplifiedBy:
+      - {path: tests/fixtures/hfs-delivery-lite/scripts/build-frontend.mjs, edition: lite}
+    editionWhy: "Lite splits product delivery tooling from managed codegen; full owns the same files through app.scripts (ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4))."
+    editions: [lite]
+    # Product-owned environment, secret and build tooling, kept apart from lite's managed codegen script.
+    # Full already owns these files through app.scripts; its generic *.mjs pattern must not compete with build-*.mjs.
+    path: "scripts/{env-sync.mjs,with-secrets.mjs,set-secrets.ps1,build-*.mjs}"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
   - id: app.sides
+    since: 3.1.0
     profiles: [app]
     # The two sides. Everything below be/ and fe/ is judged by the side's own slots (profiles be and fe) with the side folder as its root;
     # this slot answers only for the side folders themselves.
@@ -546,7 +680,12 @@ slots:
     tier: none
     tests: none
   - id: app.starciwork
+    since: 3.1.0
     profiles: [app]
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton/.starciwork/, edition: full}
+      - {path: packages/hfs/templates/app/skeleton-lite/.starciwork/, edition: lite}
+    editionWhy: "ruling:R212/case-4: lite optionally keeps .gitignore, workspace.yaml and brand records; full keeps the Work catalog and product summaries."
     path: ".starciwork/"
     presence: required
     tracked: tracked
@@ -556,27 +695,23 @@ slots:
     allows: [workspace.yaml, index.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml",
              "features/<feature>/<family>/<name>/index.yaml", "features/<feature>/br/<rule>/ac/<name>/index.yaml",
              "features/<feature>/ui/<name>/assets/<approved-file>", "features/<feature>/uat/<name>/{index,accounts,fixtures}.yaml",
-             "features/<feature>/uat/<name>/{seed,cleanup}.sql", "_resources/{identities,environments,fixtures}/<slug>/resource.yaml"]
-    forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/]
-    # Lite keeps the product catalog, feature overviews, grammar and brand drawing records; UAT records belong to the forbidden slot below.
+             "features/<feature>/uat/<name>/{seed,cleanup}.sql", "_resources/{identities,environments,fixtures}/<slug>/resource.yaml",
+             "_derived/{index.yaml,frontier.md,critique.yaml,critique.md}"]
+    forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*"]
+    # ruling:R212/case-4: lite keeps workspace.yaml for project identity and repo roles, plus brand drawing records,
+    # references and assets. No brand means no Work tree is needed; workspace.yaml is legal but optional.
+    litePresence: optional
     lite:
-      requires: [.gitignore, workspace.yaml, index.yaml]
-      allows: [workspace.yaml, index.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml", "features/<feature>/ui/<name>/index.yaml", "features/<feature>/ui/<name>/assets/<approved-file>"]
+      requires: [.gitignore]
+      allows: [workspace.yaml, "brand/**"]
     rules: [HFS_AGENT_DATA_TRACKED, HFS_IDENTITY_CUSTODY]
-  - id: app.starciwork.uat
-    profiles: [app]
-    # The UAT records of the full edition: they are proven on the e2e world (identities, fixtures, br/ac evidence) that lite does
-    # not have, so the trees are forbidden paths under lite only. In full this slot does not exist and .starciwork answers for them.
-    editions: [lite]
-    path: ".starciwork/{_resources/identities,_resources/fixtures,features/<feature>/uat,features/<feature>/br}/"
-    presence: forbidden
-    tracked: external
-    tier: none
-    tests: none
-    goesTo: "the full edition: a lite app has no e2e world, so no UAT records (no identities or fixtures resources, no br/ac evidence, no uat directories)"
-    since: 2.1.0
   - id: app.starcistacks
+    since: 3.1.0
     profiles: [app]
+    editionWhy: "owner:lite-production-swarm: lite requires declared docker-swarm production with Supabase backing; full also admits Compose development, Kubernetes and Terraform."
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks/, edition: full}
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/, edition: lite}
     # The stack declarations and the sealed custody of the app, at the app root beside be/, fe/ and .starciwork (never under a side).
     path: ".starcistacks/"
     presence: required
@@ -584,18 +719,19 @@ slots:
     tier: none
     tests: none
     requires: [application-stacks.yaml]
-    allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,k8s,terraform}/**", "<env>/infra/metadata.json",
+    allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,swarm,k8s,terraform}/**", "<env>/infra/metadata.json",
              "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
     forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
-    # Lite has no self-hosted infrastructure (owner ruling 2026-10-12): .starcistacks holds env and secret custody only - the stack
-    # declaration, the environment descriptor and the sealed secrets; the stack's one backing service is the Supabase project (the
-    # local CLI stack or the cloud project). infra/ (compose, k8s, terraform), runtime/ and seeds/ are the full edition's.
+    # Owner ruling 2026-10-14: lite declares docker-swarm production, app runtime config, sealed custody and seed data.
+    # Supabase supplies the database and broker; production has no Compose or host cron.
     lite:
-      requires: []
-      allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep"]
+      requires: [application-stacks.yaml]
+      allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/swarm/**", "<env>/infra/metadata.json",
+               "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
       forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
     rules: [HFS_STACKS_SHAPE, HFS_STACKS_IN_SIDE, HFS_PLAINTEXT_SECRET, HFS_IDENTITY_CUSTODY]
   - id: app.sops
+    since: 3.1.0
     profiles: [app]
     # The sops custody rule of .starcistacks/<env>/secrets/*.enc, at the app root beside the tree it seals.
     path: .sops.yaml
@@ -604,6 +740,7 @@ slots:
     tier: none
     tests: none
   - id: app.build-output
+    since: 3.1.0
     profiles: [app]
     path: "{**/node_modules/,coverage/,reports/,test-results/,**/*.tsbuildinfo}"
     presence: optional
@@ -611,6 +748,7 @@ slots:
     tier: none
     tests: none
   - id: app.tool-cache
+    since: 3.1.0
     profiles: [app]
     path: "{.eslintcache,.turbo/,.scannerwork/,.sonar/,.jest-cache/,.cache/,.tools/}"
     presence: forbidden
@@ -619,6 +757,7 @@ slots:
     tests: none
     goesTo: "${STARCI_CACHE_HOME:-%LOCALAPPDATA%/StarCi/cache}/<repo>/<tool>/ (the canon presets set eslint --cache-location, jest cacheDirectory, turbo cacheDir, sonar.working.directory)"
   - id: app.agent-output
+    since: 3.1.0
     profiles: [app]
     path: "{report*.json,*.tmp.json,%*%,nul,.artifacts/,.tmp-*,*-lint.json,lf.json,lt.json,*.log,design-plans/,.gitmounts/,.dat,vi-flat.txt}"
     presence: forbidden
@@ -628,6 +767,7 @@ slots:
     goesTo: "agent scratchpad or the StarCi blob store (%LOCALAPPDATA%/StarCi/blobs), cited by {name, sha256}"
     rules: [HFS_UNTRACKED_ROOT_ENTRY, HFS_AGENT_DATA_TRACKED]
   - id: app.worktrees
+    since: 3.1.0
     profiles: [app]
     path: "{.worktrees/,worktrees/,.starciwork/worktrees/}"
     presence: forbidden
@@ -636,8 +776,9 @@ slots:
     tests: none
     goesTo: "<lanes root>/<project>/<lane>/ (outside every repository) for a lane; a Kernel workflow's worktree is created and owned by Orca outside the app checkout, never tracked, and removed by the runtime's host-side controller once the workflow's finish marked it release-pending"
   - id: app.plaintext-env
+    since: 3.1.0
     profiles: [app]
-    path: "{.env,.env.*,.secrets/,**/*.pem,**/*.key}"
+    path: "{.env,.env.*,secrets.env,.secrets/,**/*.pem,**/*.key}"
     presence: forbidden
     tracked: external
     tier: none
@@ -648,6 +789,10 @@ slots:
   # ----- app root: the Supabase project of an app whose connection declares provider: supabase (every lite app) -------
   - id: app.supabase
     profiles: [app]
+    exemplifiedBy:
+      - packages/hfs/templates/app/skeleton-lite/supabase/
+      - {path: tests/fixtures/hfs-callback-full/supabase/, edition: full}
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): Supabase is required in lite; full enables it only through a declared connection."
     # The one Supabase project directory, at the app root beside be/, fe/ and .starcistacks (never under a side).
     path: "supabase/"
     presence: opt-in              # enabled by a connection with provider: supabase; required under edition lite
@@ -659,6 +804,10 @@ slots:
     since: 2.1.0
   - id: app.supabase.config
     profiles: [app]
+    exemplifiedBy:
+      - packages/hfs/templates/app/skeleton-lite/supabase/config.toml
+      - {path: tests/fixtures/hfs-callback-full/supabase/config.toml, edition: full}
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite requires Supabase configuration; full requires it only when Supabase is declared."
     # The project configuration: auth keys are env(NAME) references, never literals (L08 judges its policy keys).
     path: "supabase/config.toml"
     presence: opt-in
@@ -670,6 +819,10 @@ slots:
     since: 2.1.0
   - id: app.supabase.migrations
     profiles: [app]
+    exemplifiedBy:
+      - packages/hfs/templates/app/skeleton-lite/supabase/migrations/__timestamp___baseline.sql
+      - {path: tests/fixtures/hfs-callback-full/supabase/migrations/20261014100000_baseline.sql, edition: full}
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite uses Supabase schema authority and requires a migration; full opts into that provider."
     # The schema authority of an app on Supabase: forward-only SQL migrations named <timestamp14>_<kebab-name>.sql,
     # one file per change, immutable once on origin/main (L02-L08 judge them).
     path: "supabase/migrations/<stamp>_<name>.sql"
@@ -704,6 +857,10 @@ slots:
     since: 2.1.0
   - id: app.supabase.types
     profiles: [app]
+    templateNa: "Database row types are generated from the app's Supabase schema by contract:emit; a hand-authored scaffold template would invent the schema contract."
+    exemplifiedBy:
+      - {path: tests/fixtures/hfs-callback-full/supabase/types/database.types.ts, edition: full}
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite requires generated Supabase row types; full enables them with the provider."
     # The generated Database types (database.types.ts) contract:emit writes from the migrations; both sides read it
     # (sides.<side>.reads supabase/types/); drift against regeneration is L09.
     path: "supabase/types/database.types.ts"
@@ -742,6 +899,7 @@ slots:
 
   # ----- side root (both sides): what a standalone repository root holds, less the app-root files ----------
   - id: repo.side-root-forbidden
+    since: 3.1.0
     profiles: [be, fe]
     path: "{package.json,package-lock.json,hfs.json,README.md,.gitignore,.gitattributes,.husky/,.github/,.starciwork/,.starcistacks/,supabase/,.sops.yaml,sonar-project.properties,codecov.yml,.prettierrc,.prettierignore,scripts/}"
     presence: forbidden
@@ -750,6 +908,7 @@ slots:
     tests: none
     goesTo: "the app root: one package.json, lockfile, hfs.json, README, git and CI files, hooks, formatter, Sonar and Codecov configuration, scripts/, .starciwork, .starcistacks and .sops.yaml per app"
   - id: be.tool-config
+    since: 3.1.0
     profiles: [be]
     # Managed files (starci app sync renders them, starci app check compares them): the whole tool configuration of a back end. Each is
     # a reference to a canon package, never a configuration: tsconfig.json extends @starci/tsconfig/be.json and adds the
@@ -765,11 +924,12 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    # Lite renders the same files (owner ruling 2026-10-12): the unit run and its coverage are full's.
+    # Lite renders the same files (owner ruling 2026-10-12 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4): the unit run and its coverage are full's.
     coverage: none
     managedBy: tool-config
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL, HFS_TS_STRICT]
   - id: be.nest-cli
+    since: 3.1.0
     profiles: [be]
     # The Nest monorepo of the back end: `monorepo: true` and one project per declared be app (apps/<app>, even for one service).
     path: nest-cli.json
@@ -780,6 +940,7 @@ slots:
     coverage: none
     rules: [HFS_MONO_NEST_PROJECTS]
   - id: be.tool-config-local
+    since: 3.1.0
     profiles: [be]
     path: "{.eslintrc,.eslintrc.*,.eslintignore,eslint.config.js,eslint.config.cjs,eslint.config.ts,eslint.config.mts,eslint.config.cts,.prettierrc.*,prettier.config.*,jest.config.ts,jest.config.mjs,jest.config.cjs,jest.config.json,jest.config.e2e.js}"
     presence: forbidden
@@ -789,6 +950,7 @@ slots:
     goesTo: "nowhere: a back end has exactly the managed tool configuration (be.tool-config); a change to a rule or a flag is proposed in the .claude runtime"
     rules: [HFS_TOOL_CONFIG_LOCAL]
   - id: fe.tool-config
+    since: 3.1.0
     profiles: [fe]
     # Managed files (starci app sync renders them, starci app check compares them): the tool configuration of a front end. Each is a
     # reference to a canon package, never a configuration: tsconfig.json extends @starci/tsconfig/next.json and only
@@ -804,6 +966,7 @@ slots:
     managedBy: tool-config
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL, HFS_RULE_OFF_WITHOUT_REPLACEMENT, HFS_TS_STRICT]
   - id: fe.tool-config-local
+    since: 3.1.0
     profiles: [fe]
     path: "{.eslintrc,.eslintrc.*,.eslintignore,eslint.config.js,eslint.config.cjs,eslint.config.ts,eslint.config.mts,eslint.config.cts,.stylelintrc,.stylelintrc.*,.stylelintignore,stylelint.config.js,stylelint.config.cjs,stylelint.config.ts,stylelint.config.json,prettier.config.*,.prettierrc.*,lint-staged.config.*,.lintstagedrc*,turbo.json}"
     presence: forbidden
@@ -813,6 +976,7 @@ slots:
     goesTo: "nowhere: a front end has exactly the managed tool configuration (fe.tool-config); the task graph is the app root's turbo.json (app.task-graph); a change to a rule or a flag is proposed in the .claude runtime"
     rules: [HFS_TOOL_CONFIG_LOCAL]
   - id: repo.docs
+    since: 3.1.0
     profiles: [be, fe]
     path: "docs/{adr,runbooks,guides}/**/*.md"
     presence: opt-in
@@ -822,6 +986,7 @@ slots:
     coverage: none
     rules: [HFS_ROOT_MARKDOWN_FORBIDDEN]
   - id: repo.docs-media
+    since: 3.1.0
     profiles: [be, fe]
     path: "docs/**/*.{png,svg,webp}"
     presence: opt-in
@@ -830,7 +995,23 @@ slots:
     tests: none
     coverage: none
     budget: {bytes: 512000}
+  - id: repo.i18n-dynamic-keys
+    since: 3.3.0
+    profiles: [be, fe]
+    # The side's authored ledger of catalog keys the R280 detector cannot see (fe/i18n-dynamic-keys.yaml, be/i18n-dynamic-keys.yaml:
+    # each side owns its own catalogs). A key it names counts as read; an entry matching no catalog key, or a malformed file, is itself an R280 finding.
+    path: i18n-dynamic-keys.yaml
+    presence: opt-in
+    tracked: tracked
+    tier: none
+    tests: none
+    coverage: none
+    exemplifiedBy:
+      - {path: tests/fixtures/hfs-i18n-ledger/fe/i18n-dynamic-keys.yaml, editions: [lite, full]}
+      - {path: tests/fixtures/hfs-i18n-ledger/be/i18n-dynamic-keys.yaml, editions: [lite, full]}
+    rules: [HFS_UNUSED_SYMBOL]
   - id: repo.packages
+    since: 3.1.0
     profiles: [be, fe]
     path: "packages/<pkg>/"
     presence: opt-in
@@ -842,7 +1023,14 @@ slots:
     coverage: none
     rules: [FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT]
   - id: repo.app-image
+    since: 3.1.0
     profiles: [be, fe]
+    exemplifiedBy:
+      - packages/hfs/templates/be/image/api/Dockerfile
+      - packages/hfs/templates/be/image/cli/Dockerfile
+      - {path: packages/hfs/templates/be/image/worker/Dockerfile, edition: full}
+      - packages/hfs/templates/fe/image/next/Dockerfile
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite may host Next without its own image; back-end images stay required in both editions."
     # One image per app: every declared app has its own Dockerfile (apps/<app>/Dockerfile), built from the APP ROOT (the folder with
     # the one package.json). It is app-owned (starci app scaffold writes it once from templates/<side>/image) and judged by the docker rules.
     # A Dockerfile anywhere else is owned by no slot.
@@ -857,6 +1045,7 @@ slots:
 
   # ----- never tracked: build output the tools need in place ---------------------------------------------
   - id: repo.build-output
+    since: 3.1.0
     profiles: [be, fe]
     path: "{**/node_modules/,dist/,apps/*/dist/,packages/*/dist/,.next/,apps/*/.next/,coverage/,reports/,test-results/,**/next-env.d.ts,**/*.tsbuildinfo}"
     presence: optional
@@ -864,6 +1053,7 @@ slots:
     tier: none
     tests: none
   - id: repo.generated
+    since: 3.1.0
     profiles: [be, fe]
     path: "{**/__generated__/,apps/*/src/schema.gql}"
     presence: optional
@@ -874,6 +1064,7 @@ slots:
 
   # ----- never in the working tree: caches, scratch, agent output ----------------------------------------
   - id: repo.tool-cache
+    since: 3.1.0
     profiles: [be, fe]
     path: "{.eslintcache,.turbo/,.scannerwork/,.sonar/,.jest-cache/,.cache/,.tools/}"
     presence: forbidden
@@ -882,6 +1073,7 @@ slots:
     tests: none
     goesTo: "${STARCI_CACHE_HOME:-%LOCALAPPDATA%/StarCi/cache}/<repo>/<tool>/ (the canon presets set eslint --cache-location, jest cacheDirectory, turbo cacheDir, sonar.working.directory)"
   - id: repo.agent-output
+    since: 3.1.0
     profiles: [be, fe]
     path: "{report*.json,*.tmp.json,%*%,nul,.artifacts/,.tmp-*,*-lint.json,lf.json,lt.json,*.log,design-plans/,.gitmounts/,.dat,vi-flat.txt}"
     presence: forbidden
@@ -891,6 +1083,7 @@ slots:
     goesTo: "agent scratchpad or the StarCi blob store (%LOCALAPPDATA%/StarCi/blobs), cited by {name, sha256}"
     rules: [HFS_UNTRACKED_ROOT_ENTRY, HFS_AGENT_DATA_TRACKED]
   - id: repo.worktrees
+    since: 3.1.0
     profiles: [be, fe]
     path: "{.worktrees/,worktrees/,.starciwork/worktrees/}"
     presence: forbidden
@@ -899,6 +1092,7 @@ slots:
     tests: none
     goesTo: "<lanes root>/<project>/<lane>/ (outside every repository)"
   - id: repo.plaintext-env
+    since: 3.1.0
     profiles: [be, fe]
     path: "{.env,.env.*,.secrets/,**/*.pem,**/*.key}"
     presence: forbidden
@@ -908,6 +1102,7 @@ slots:
     goesTo: ".starcistacks/<env>/secrets/<slug>.enc (at the app root); decrypted values only in memory or under %LOCALAPPDATA%/StarCi/secrets/<project>/<env>/ via *_FILE"
     rules: [HFS_PLAINTEXT_SECRET]
   - id: be.root-e2e
+    since: 3.1.0
     profiles: [be]
     path: "e2e/"
     presence: forbidden
@@ -918,6 +1113,7 @@ slots:
 
   # ----- contract snapshots (the committed machine-emitted files, because they are a cross-repo interface) --
   - id: be.contract.graphql
+    since: 3.1.0
     profiles: [be]
     path: "contracts/<app>/schema.graphql"
     presence: opt-in
@@ -928,6 +1124,7 @@ slots:
     why: emitted by `npm run contract:emit` (`starci app emit`, never written by hand); CI fails when the emitted file differs (a contract, not a build artefact)
     rules: [HFS_CONTRACT_SNAPSHOT_DRIFT]
   - id: be.contract.openapi
+    since: 3.1.0
     profiles: [be]
     path: "contracts/<app>/openapi.json"
     presence: opt-in
@@ -938,6 +1135,7 @@ slots:
     why: emitted by `npm run contract:emit` (`starci app emit`, never written by hand) from the app's typed operation table `apps/<app>/src/operations.ts` (canon BE-OPERATIONS-1); CI fails when the emitted file differs
     rules: [HFS_CONTRACT_SNAPSHOT_DRIFT]
   - id: be.contract.events
+    since: 3.1.0
     profiles: [be]
     path: "contracts/<app>/events.json"
     presence: opt-in
@@ -948,6 +1146,7 @@ slots:
     why: the async contract of a service (`starci/event-contract@1`), emitted by `npm run contract:emit` (`starci app emit`, never written by hand) from the typed event classes of `src/modules/events/<service>/`; the consumers of its events rely on it (R166 HFS_EVENT_CONTRACT)
     rules: [HFS_EVENT_CONTRACT]
   - id: be.contract.events.pin
+    since: 3.1.0
     profiles: [be]
     path: "contracts/<app>/events.pin.json"
     presence: opt-in
@@ -959,7 +1158,25 @@ slots:
     rules: [BE_CONTRACT_BREAKING]
 
   # ----- BE: apps (one slot per app kind; a new kind = a new slot, minor bump) ---------------------------
+  # The files of every app (owner ruling 2026-10-14, R245 and R246, since 3.1.0), each with a line budget that
+  # BE_APP_COMPOSITION_BUDGET holds absolutely (not a ratchet):
+  #   main.ts            the entry: builds EnvSource once, imports and calls read<App>Env from <app>.env.ts, builds options and boots.
+  #   <app>.env.ts       exports interface <App>Env and read<App>Env(env: EnvSource): <App>Env (for example ApiEnv/readApiEnv);
+  #                      fail-fast environment parsing only, via EnvSource and unchanged capability parse helpers; no localhost
+  #                      or default host fallback, logic, module composition, business code or feature imports. Only main.ts
+  #                      and this app file may read process.env or EnvSource. The interface declares its own readonly parsed
+  #                      members with parser-derived types, structurally compatible with the app's options;
+  #                      the role name stays <app>.env.ts, never env.ts. Secrets use EnvSource.secret(): <NAME>_FILE first
+  #                      for .starcistacks custody, plain <NAME> only when the file key is absent. A declared file supplies
+  #                      exact contents; an empty or unreadable path stops boot without fallback.
+  #   <app>.options.ts   the options: env-derived options plus port bindings (provider maps such as { approvalGate: X }) only;
+  #                      no environment parsing or process.env/EnvSource reads; module, queue or scheduler composition here or in <app>.env.ts is
+  #                      BE_APP_OPTIONS_COMPOSITION.
+  #   compose/<area>.ts  a composition group: exports the module list of one area (an imports array, and the providers of the
+  #                      area's global ports when it has any); composition only, no business logic or process.env/EnvSource read.
+  #   app.module.ts      the composition root: imports the groups and spreads them, binds the app-wide guards and filter.
   - id: be.app.api
+    since: 3.1.0
     profiles: [be]
     path: "apps/<app>/src/"
     appKind: api
@@ -968,13 +1185,14 @@ slots:
     tier: app
     owner: true
     minInstances: 1
-    requires: [main.ts, app.module.ts]
-    allows: [main.ts, app.module.ts, "<app>.options.ts", operations.ts]
-    tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
+    requires: [main.ts, app.module.ts, "<app>.env.ts"]
+    allows: [main.ts, app.module.ts, "<app>.env.ts", "<app>.options.ts", "compose/<area>.ts", operations.ts]
+    tests: none                   # full app boot is proven by useTestWorld({ apps }); lite by starci app check --wiring (R272)
     coverage: none
-    budget: {app.module.ts: 250, main.ts: 80}
-    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_BUSINESS_ROLE, BE_DEFAULT_DENY, BE_ERROR_MASKED, BE_FEATURE_NOT_COMPOSED, BE_CONTEXT_OWNER]
+    budget: {app.module.ts: 250, main.ts: 80, "<app>.env.ts": 150, "<app>.options.ts": 200, "compose/<area>.ts": 120}
+    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_BUSINESS_ROLE, BE_APP_OPTIONS_COMPOSITION, BE_APP_COMPOSITION_BUDGET, BE_DEFAULT_DENY, BE_ERROR_MASKED, BE_FEATURE_NOT_COMPOSED, BE_CONTEXT_OWNER, BE_APP_ENV_REQUIRED]
   - id: be.app.worker
+    since: 3.1.0
     profiles: [be]
     path: "apps/<app>/src/"
     appKind: worker               # composes transport/message modules and job processors only (an api app may compose them too: a worker app is for separate scaling)
@@ -982,18 +1200,22 @@ slots:
     tracked: tracked
     tier: app
     owner: true
-    requires: [main.ts, app.module.ts]
-    allows: [main.ts, app.module.ts, "<app>.options.ts"]
-    tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
+    requires: [main.ts, app.module.ts, "<app>.env.ts"]
+    allows: [main.ts, app.module.ts, "<app>.env.ts", "<app>.options.ts", "compose/<area>.ts"]
+    tests: none                   # full app boot is proven by useTestWorld({ apps }); lite by starci app check --wiring (R272)
     coverage: none
-    rules: [BE_APP_COMPOSITION_ONLY, BE_BACKGROUND_UNOWNED, BE_CONTEXT_OWNER]
+    budget: {app.module.ts: 250, main.ts: 80, "<app>.env.ts": 150, "<app>.options.ts": 200, "compose/<area>.ts": 120}
+    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_OPTIONS_COMPOSITION, BE_APP_COMPOSITION_BUDGET, BE_BACKGROUND_UNOWNED, BE_CONTEXT_OWNER, BE_APP_ENV_REQUIRED]
   - id: be.app.cli
+    since: 3.1.0
     profiles: [be]
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): Supabase CLI owns lite migrations; a lite cli app is optional for declared operator commands."
     # The ONE app of every one-off action (migrate, seed, sync, backup, any operator command): be/apps/cli, on nest-commander.
     # main.ts boots with CommandFactory.run (BE_CLI_BOOTSTRAP); app.module.ts composes the platform and the cli feature root
-    # (src/features/cli/cli.module.ts); cli.options.ts carries what it needs from the environment, the connections it migrates
-    # among them (the test world migrates through the same list). It is required as soon as the back end declares a connection
-    # or tracks a command, with its image apps/cli/Dockerfile (BE_CLI_REQUIRED): one image, run as `cli <group> <command>`.
+    # (src/features/cli/cli.module.ts); cli.env.ts exports CliEnv and readCliEnv(env: EnvSource): CliEnv, and cli.options.ts carries the env-derived values,
+    # the connections it migrates among them (the test world migrates through the same list). It is required as soon as the
+    # back end declares a connection or tracks a command, with its image apps/cli/Dockerfile (BE_CLI_REQUIRED): one image,
+    # run as `cli <group> <command>`.
     path: "apps/<app>/src/"
     appKind: cli
     presence: opt-in
@@ -1001,17 +1223,19 @@ slots:
     tracked: tracked
     tier: app
     owner: true
-    requires: [main.ts, app.module.ts]
-    allows: [main.ts, app.module.ts, "<app>.options.ts"]
-    tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
+    requires: [main.ts, app.module.ts, "<app>.env.ts"]
+    allows: [main.ts, app.module.ts, "<app>.env.ts", "<app>.options.ts", "compose/<area>.ts"]
+    tests: none                   # full app boot is proven by useTestWorld({ apps }); lite by starci app check --wiring (R272)
     coverage: none
-    rules: [BE_CLI_REQUIRED, BE_CLI_BOOTSTRAP, BE_CLI_OWNER, BE_SCHEMA_AUTHORITY]
+    budget: {app.module.ts: 250, main.ts: 80, "<app>.env.ts": 150, "<app>.options.ts": 200, "compose/<area>.ts": 120}
+    rules: [BE_CLI_REQUIRED, BE_CLI_BOOTSTRAP, BE_CLI_OWNER, BE_SCHEMA_AUTHORITY, BE_APP_OPTIONS_COMPOSITION, BE_APP_COMPOSITION_BUDGET, BE_APP_ENV_REQUIRED]
 
   # ----- BE: features ------------------------------------------------------------------------------------
   # src/features/ is grouped by TRIGGER KIND (owner decision 2026-10-02): features/api/<feature>/ (a request: application/ and
   # transport/<protocol>/, composed by the api apps), features/cli/ (a one-off action: the cli feature root, compiled only into
   # apps/cli). Every kind imports only downward into modules/*; no kind imports another.
   - id: be.feature
+    since: 3.1.0
     profiles: [be]
     path: "src/features/api/<feature>/"
     presence: required
@@ -1021,12 +1245,13 @@ slots:
     owner: true
     minInstances: 1
     requires: [index.ts, "<feature>.module.ts", application/]
-    allows: [index.ts, "<feature>.module.ts", application/, transport/, messages/]   # nothing else at feature root
+    allows: [index.ts, "<feature>.module.ts", "<feature>.module-definition.ts", "<feature>.options.ts", application/, transport/, messages/]   # nothing else at feature root
     tests: none
     coverage: none
     budget: {files: 250, indexExports: 60}   # a feature above 250 source files must be split by product capability
     rules: [BE_FEATURE_SHAPE, BE_FEATURE_IMPORTS_FEATURE, BE_PUBLIC_SURFACE, BE_FEATURE_NOT_COMPOSED]
   - id: be.feature.application
+    since: 3.1.0
     profiles: [be]
     path: "src/features/{api/,jobs/,reactors/,saga/}<feature>/application/"     # inside a trigger kind (jobs, reactors, saga) the feature folder is one level down
     presence: required
@@ -1038,6 +1263,7 @@ slots:
     coverage: none
     rules: [BE_APPLICATION_IMPORTS_TRANSPORT, BE_APPLICATION_TRANSPORT_FRAMEWORK, BE_ENTITY_IN_CONTRACT, BE_CQRS_SHAPE]
   - id: be.feature.saga
+    since: 3.1.0
     profiles: [be]
     path: "src/features/saga/<saga>/"
     pattern: saga                 # enabled by `patterns: ["saga"]` in hfs.json sides.be (R169 to R173); an undeclared saga folder is HFS_SLOT_NOT_ENABLED
@@ -1047,11 +1273,12 @@ slots:
     tier: feature
     owner: true
     requires: [index.ts, "<saga>.module.ts", "<saga>.saga.service.ts", "<saga>.saga-state.ts", steps/, compensations/, transport/]
-    allows: [index.ts, "<saga>.module.ts", "<saga>.saga.service.ts", "<saga>.saga.service.spec.ts", "<saga>.saga-state.ts", "<saga>.saga.log-events.ts", application/, steps/, compensations/, transport/]   # the orchestrator is a `*.service.ts` because a handler injects only services; unit-tested beside it
+    allows: [index.ts, "<saga>.module.ts", "<saga>.module-definition.ts", "<saga>.options.ts", "<saga>.saga.service.ts", "<saga>.saga.service.spec.ts", "<saga>.saga-state.ts", "<saga>.saga.log-events.ts", application/, steps/, compensations/, transport/]   # the orchestrator is a `*.service.ts` because a handler injects only services; unit-tested beside it
     tests: unit-beside            # <saga>.saga.service.spec.ts beside the orchestrator; the state machine and its fence are platform/saga's service; each compensation path has an e2e spec
     coverage: none
     rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED, BE_SAGA_STEP_COMPENSATION, BE_SAGA_STATE_VERSIONED, BE_SAGA_EVENT_CONTRACT, BE_SAGA_E2E_MISSING]
   - id: be.feature.saga.steps
+    since: 3.1.0
     profiles: [be]
     path: "src/features/saga/<saga>/steps/"
     pattern: saga
@@ -1063,6 +1290,7 @@ slots:
     coverage: none
     rules: [BE_SAGA_STEP_COMPENSATION, BE_SAGA_EVENT_CONTRACT]
   - id: be.feature.saga.compensations
+    since: 3.1.0
     profiles: [be]
     path: "src/features/saga/<saga>/compensations/"
     pattern: saga
@@ -1086,30 +1314,33 @@ slots:
     rules: [BE_APPLICATION_IMPORTS_TRANSPORT, BE_APPLICATION_TRANSPORT_FRAMEWORK, BE_FEATURE_IMPORTS_FEATURE]
     since: 1.0.0
   - id: be.transport.http
+    since: 3.1.0
     profiles: [be]
     path: "src/features/api/<feature>/transport/http/"
     presence: optional
     tracked: tracked
     tier: feature
     requires: ["<feature>-http.module.ts"]
-    allows: ["<action>.controller.ts", "dto/<action>.{request,response}.ts", "<action>.mapper.ts"]
+    allows: ["<action>.controller.ts", "dto/<action>.{request,response}.ts", "<action>.mapper.ts", "<feature>-http.module-definition.ts", "<feature>-http.options.ts"]
     tests: none
     coverage: none
     composedBy: [api]
     rules: [BE_DEFAULT_DENY, BE_INPUT_BOUNDED, BE_TRANSPORT_SHAPE]
   - id: be.transport.graphql
+    since: 3.1.0
     profiles: [be]
     path: "src/features/api/<feature>/transport/graphql/"
     presence: optional
     tracked: tracked
     tier: feature
     requires: ["<feature>-graphql.module.ts"]
-    allows: ["<action>.resolver.ts", "dto/<action>.{input,type,args}.ts", "<action>.mapper.ts"]
+    allows: ["<action>.resolver.ts", "dto/<action>.{input,type,args}.ts", "<action>.mapper.ts", "<feature>-graphql.module-definition.ts", "<feature>-graphql.options.ts"]
     tests: none
     coverage: none
     composedBy: [api]
     rules: [BE_DEFAULT_DENY, BE_INPUT_BOUNDED, BE_TRANSPORT_SHAPE]
   - id: be.transport.message
+    since: 3.1.0
     profiles: [be]
     path: "src/features/{api/,reactors/,saga/}<feature>/transport/message/"
     presence: opt-in              # queue consumer: composed by the service that owns it (an api app) or by a worker app scaled apart
@@ -1117,7 +1348,7 @@ slots:
     tracked: tracked
     tier: feature
     requires: ["<feature>-message.module.ts"]
-    allows: ["<event>.consumer.ts"]     # BE-CONVENTION 1.6: transport/message holds only consumers; a .message.ts is outside the closed suffix list
+    allows: ["<event>.consumer.ts", "<feature>-message.module-definition.ts", "<feature>-message.options.ts"]     # BE-CONVENTION 1.6: transport/message holds only consumers; a .message.ts is outside the closed suffix list
     tests: none
     coverage: none
     composedBy: [api, worker]
@@ -1149,7 +1380,7 @@ slots:
     tracked: tracked
     tier: feature
     requires: ["<provider>-http.module.ts", "<provider>.webhook.ts", "<provider>.webhook.spec.ts"]
-    allows: ["<provider>-http.module.ts", "<provider>.webhook.ts", "<provider>.webhook.spec.ts", dto/]
+    allows: ["<provider>-http.module.ts", "<provider>-http.module-definition.ts", "<provider>-http.options.ts", "<provider>.webhook.ts", "<provider>.webhook.spec.ts", dto/]
     tests: unit-beside            # the door's own spec (<provider>.webhook.spec.ts) beside the door: the one non-service unit spec of this kind
     coverage: none
     composedBy: [api]
@@ -1170,6 +1401,9 @@ slots:
     since: 1.0.0
   - id: be.feature.realtime
     profiles: [be]
+    exemplifiedBy:
+      - {path: tests/fixtures/hfs-lite-slots/be/src/features/realtime/order-status/, edition: lite}
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite runs socket.io in the api process, one instance without Redis; full may scale its gateway."
     path: "src/features/realtime/<channel>/"
     presence: opt-in              # a push channel: reads and pushes only (a socket gateway or a GraphQL subscription), no domain write
     pattern: realtime             # declaring the pattern (hfs.json sides.be.patterns) enables the kind (knowledge/patterns/be/realtime.yaml)
@@ -1190,15 +1424,16 @@ slots:
     since: 1.0.0
   - id: be.feature.realtime.graphql
     profiles: [be]
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite uses only the in-process socket.io gateway; the GraphQL subscription door remains full-only."
     path: "src/features/realtime/<channel>/transport/graphql/"
     presence: opt-in              # a GraphQL subscription over graphql-ws
-    litePresence: forbidden       # a graphql-ws server is self-hosted push infrastructure: lite pushes through Supabase Realtime
+    litePresence: forbidden       # ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite pushes through the api's in-process socket.io gateway
     pattern: realtime
     tracked: tracked
     tier: feature
     goesTo: "src/features/realtime/<channel>/transport/websocket/ (be.feature.realtime.websocket): both editions push through the socket.io gateway; lite runs it in the api process"
     requires: ["<channel>-graphql.module.ts", "<channel>.subscription.ts", "<channel>.subscription.spec.ts"]
-    allows: ["<channel>-graphql.module.ts", "<channel>.subscription.ts", "<channel>.subscription.spec.ts", dto/]
+    allows: ["<channel>-graphql.module.ts", "<channel>-graphql.module-definition.ts", "<channel>-graphql.options.ts", "<channel>.subscription.ts", "<channel>.subscription.spec.ts", dto/]
     tests: unit-beside            # the door's own spec beside the door (a subscription has no service of its own)
     coverage: none
     composedBy: [api]
@@ -1206,6 +1441,7 @@ slots:
     since: 1.0.0
   - id: be.feature.realtime.dto
     profiles: [be]
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): GraphQL subscription DTOs exist only with the full subscription door; lite uses socket.io contracts."
     path: "src/features/realtime/<channel>/transport/graphql/dto/"
     presence: opt-in
     litePresence: forbidden       # the dto of the graphql door, which lite does not serve
@@ -1227,20 +1463,21 @@ slots:
     tracked: tracked
     tier: feature
     requires: ["<channel>-websocket.module.ts", "<channel>.gateway.ts", "<channel>.gateway.spec.ts"]
-    allows: ["<channel>-websocket.module.ts", "<channel>.gateway.ts", "<channel>.gateway.spec.ts"]
+    allows: ["<channel>-websocket.module.ts", "<channel>-websocket.module-definition.ts", "<channel>-websocket.options.ts", "<channel>.gateway.ts", "<channel>.gateway.spec.ts"]
     tests: unit-beside            # the door's own spec beside the door (a gateway has no service of its own)
     coverage: none
     composedBy: [api]
     rules: [BE_REALTIME_SHAPE, BE_REALTIME_WRITES, BE_REALTIME_TOPIC_SCOPE, BE_DEFAULT_DENY]
     since: 1.0.0
   - id: be.cli
+    since: 3.1.0
     profiles: [be]
     # The cli feature root: every one-off action of the back end, compiled only into apps/cli. A group is a nest-commander
     # @Command (<group>/<group>.cli.ts) whose sub-commands are @SubCommand classes extending CommandRunner
     # (<group>/subs/<name>.cli.ts), each with its unit spec beside it (<name>.cli.spec.ts): a command is an action runner, not a
     # thin transport (BE_CLI_COMMAND_SHAPE). `.cli.ts` because `.command.ts` is the CQRS message (HFS delta 3). Every module of
-    # the root is a static @Module (a feature holds no module definition): cli.module.ts imports each group module, a group
-    # module provides its commands, and a command takes its inputs from a platform capability (the connections and their opener
+    # the root has a module definition beside it (ruling:module-definition-everywhere) and no register override: cli.module.ts imports each
+    # group module as <Group>Module.register({}), a group module provides its commands, and a command takes its inputs from a platform capability (the connections and their opener
     # from platform/database) or from a command-line @Option.
     path: "src/features/cli/"
     presence: optional
@@ -1251,7 +1488,7 @@ slots:
     requires: [index.ts, cli.module.ts]
     # A composed root: an app of kind cli lists cli.module.ts, never a group module (BE_MODULE_SHAPE).
     composedBy: [cli]
-    allows: [index.ts, cli.module.ts, "<group>/<group>.cli.ts", "<group>/<group>.cli.spec.ts", "<group>/<group>.module.ts", "<group>/subs/<name>.cli.ts", "<group>/subs/<name>.cli.spec.ts"]
+    allows: [index.ts, cli.module.ts, "cli.module-definition.ts", "cli.options.ts", "<group>/<group>.cli.ts", "<group>/<group>.cli.spec.ts", "<group>/<group>.module.ts", "<group>/<group>.module-definition.ts", "<group>/<group>.options.ts", "<group>/subs/<name>.cli.ts", "<group>/subs/<name>.cli.spec.ts"]
     tests: unit-beside
     coverage: none
     rules: [BE_CLI_COMMAND_SHAPE, BE_CLI_OWNER, BE_CLI_REQUIRED, BE_MODULE_SHAPE, BE_SCHEMA_AUTHORITY]
@@ -1268,8 +1505,11 @@ slots:
     tests: none
     coverage: none
     since: 3.0.0
+    rules: [HFS_ASSET_OVERSIZE, HFS_ASSET_KIND]
+
   # ----- BE: modules (three tiers, closed set) -----------------------------------------------------------
   - id: be.domain
+    since: 3.1.0
     profiles: [be]
     path: "src/modules/domain/<capability>/"
     presence: optional
@@ -1279,13 +1519,14 @@ slots:
     requires: [index.ts]
     # <name>.templates.ts holds the capability's static templates, copy and presets as TS constants (owner ruling 2026-10-13);
     # user-editable ones are seed rows, large or user media live in object storage.
-    allows: ["<capability>.module.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts"]
+    allows: ["<capability>.module.ts", "<capability>.module-definition.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts"]
     forbids: [testing/, exceptions/, utils/, helpers/, shared/]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
     coverage: required
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_PUBLIC_SURFACE, BE_ERROR_HOME, BE_CONFIG_OWNER, BE_CONTEXT_COUPLING, BE_CONTEXT_TRANSACTION]
   - id: be.errors
+    since: 3.1.0
     profiles: [be]
     path: "src/modules/{domain,integrations}/<capability>/errors/"
     presence: optional
@@ -1318,7 +1559,9 @@ slots:
     rules: [BE_USER_COPY_LITERAL]
     since: 1.0.0
   - id: be.persistence
+    since: 3.1.0
     profiles: [be]
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): Supabase migrations own lite tables, with SQL and row types here; full keeps TypeORM entities and migrations here."
     path: "src/modules/{domain,platform,projections}/<capability>/persistence/"
     # R178: the platform capabilities whose tables exist on EVERY connection that uses them (the event-bus outbox, the inbox of every service, the job table); their arrays may be
     # registered on several declared connections. Any other capability registers its arrays on exactly one (BE_SCHEMA_OWNER).
@@ -1339,6 +1582,7 @@ slots:
     coverage: none
     rules: [BE_SCHEMA_OWNER, BE_SCHEMA_AUTHORITY, BE_SQL_OUTSIDE_PERSISTENCE, BE_SQL_TABLE_OWNER, BE_SQL_RETURNING_SHAPE, BE_CONTEXT_COUPLING, BE_CONTEXT_PLATFORM_TABLES]
   - id: be.platform
+    since: 3.1.0
     profiles: [be]
     path: "src/modules/platform/<capability>/"
     presence: required
@@ -1361,7 +1605,11 @@ slots:
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE]
   # ----- BE: pattern slots (opt-in; enabled by hfs.json sides.be.patterns). A path under one is HFS_SLOT_NOT_ENABLED unless its pattern is declared.
   - id: be.platform.event-bus
+    since: 3.1.0
     profiles: [be]
+    exemplifiedBy:
+      - {path: tests/fixtures/hfs-lite-slots/be/src/modules/platform/event-bus/, edition: lite}
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite implements the event ports with outbox and pgmq; full uses its Kafka adapter."
     path: "src/modules/platform/event-bus/"
     presence: opt-in
     pattern: event-bus            # the ONE durable event transport: transactional outbox, relay, Kafka, inbox, retry and dead letter (knowledge/patterns/be/event-bus.yaml)
@@ -1380,7 +1628,9 @@ slots:
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE, BE_INFRA_OWNER]
   - id: be.platform.queue
+    since: 3.1.0
     profiles: [be]
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite implements queue ports with pgmq and pg_cron; full uses BullMQ and Redis."
     path: "src/modules/platform/queue/"
     presence: opt-in
     pattern: queue                # the ONE BullMQ owner: the outbox relay into queues (jobId = outbox id) and job schedulers (knowledge/patterns/be/queues.yaml)
@@ -1399,6 +1649,7 @@ slots:
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE, BE_INFRA_OWNER]
   - id: be.events
+    since: 3.1.0
     profiles: [be]
     path: "src/modules/events/<service>/"
     presence: opt-in
@@ -1412,6 +1663,7 @@ slots:
     coverage: none
     rules: [BE_EVENT_CLASS_CONTRACT, BE_TIER_DIRECTION]
   - id: be.queues
+    since: 3.1.0
     profiles: [be]
     path: "src/modules/queues/<queue>/"
     presence: opt-in
@@ -1420,11 +1672,12 @@ slots:
     tier: queues
     owner: true
     requires: [index.ts, "<queue>.queue.ts"]   # the module exists when a domain module imports the producer; a scheduler-only queue has none
-    allows: ["<queue>.queue.ts", "<queue>.module.ts", "<queue>.contracts.ts", index.ts]
+    allows: ["<queue>.queue.ts", "<queue>.module.ts", "<queue>.module-definition.ts", "<queue>.options.ts", "<queue>.contracts.ts", index.ts]
     tests: none
     coverage: none
     rules: [BE_OUTBOX_WRITE_TX, BE_TIER_DIRECTION]
   - id: be.feature.reactors
+    since: 3.1.0
     profiles: [be]
     path: "src/features/reactors/<reactor>/"
     presence: opt-in
@@ -1434,11 +1687,12 @@ slots:
     tier: feature
     owner: true
     requires: [index.ts, "<reactor>.module.ts", transport/]
-    allows: [index.ts, "<reactor>.module.ts", application/, transport/]
+    allows: [index.ts, "<reactor>.module.ts", "<reactor>.module-definition.ts", "<reactor>.options.ts", application/, transport/]
     tests: none
     coverage: none
     rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
   - id: be.feature.jobs
+    since: 3.1.0
     profiles: [be]
     path: "src/features/jobs/<job>/"
     presence: opt-in
@@ -1448,11 +1702,12 @@ slots:
     tier: feature
     owner: true
     requires: [index.ts, "<job>.module.ts", steps/, transport/]
-    allows: [index.ts, "<job>.module.ts", application/, steps/, transport/]
+    allows: [index.ts, "<job>.module.ts", "<job>.module-definition.ts", "<job>.options.ts", application/, steps/, transport/]
     tests: none
     coverage: none
     rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
   - id: be.feature.jobs.queue
+    since: 3.1.0
     profiles: [be]
     path: "src/features/jobs/<job>/transport/queue/"
     presence: opt-in              # the queue transport of the job: its module and the processor the job runner hands the fenced claim to
@@ -1460,12 +1715,13 @@ slots:
     tracked: tracked
     tier: feature
     requires: ["<job>-queue.module.ts", "<job>.processor.ts"]
-    allows: ["<job>-queue.module.ts", "<job>.processor.ts"]
+    allows: ["<job>-queue.module.ts", "<job>-queue.module-definition.ts", "<job>-queue.options.ts", "<job>.processor.ts"]
     tests: none
     coverage: none
     composedBy: [api, worker]
     rules: [BE_BACKGROUND_UNOWNED]
   - id: be.feature.jobs.steps
+    since: 3.1.0
     profiles: [be]
     path: "src/features/jobs/<job>/steps/"
     presence: opt-in
@@ -1477,7 +1733,9 @@ slots:
     coverage: none
     rules: [BE_JOB_SHAPE, BE_JOB_RUN_KEY]
   - id: be.platform.jobs
+    since: 3.1.0
     profiles: [be]
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite persists fenced claims in Supabase migrations and dispatches through pgmq; full uses TypeORM schema authority and its queue adapter."
     path: "src/modules/platform/jobs/"
     presence: opt-in
     pattern: fenced-job           # the ONE fencing primitive: the job entity, the claim that bumps the token, guarded writes (knowledge/patterns/be/jobs.yaml)
@@ -1490,7 +1748,11 @@ slots:
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE, BE_JOB_WRITE_OUTSIDE_OWNER, BE_JOB_FENCE_REQUIRED]
   - id: be.projections
+    since: 3.1.0
     profiles: [be]
+    exemplifiedBy:
+      - {path: tests/fixtures/hfs-lite-slots/be/src/modules/projections/order-summary/, edition: lite}
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite projection tables live in Supabase migrations; full keeps the TypeORM projection entity beside its projection."
     path: "src/modules/projections/<name>/"
     presence: opt-in
     pattern: projection           # a read model: only its projection writes its table; recompute is idempotent and replayable; readers use get*
@@ -1506,6 +1768,7 @@ slots:
     coverage: required
     rules: [BE_PROJECTION_WRITE_OWNER, BE_PROJECTION_SHAPE, BE_TIER_DIRECTION, BE_CONTEXT_COUPLING]
   - id: be.integrations
+    since: 3.1.0
     profiles: [be]
     path: "src/modules/integrations/<provider>/"
     presence: optional
@@ -1515,9 +1778,10 @@ slots:
     requires: [index.ts, "<provider>.config.ts"]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts; plus src/tests/integration/<provider>/ (R112)
     coverage: required
-    budget: {indexExports: 60}
+    budget: {indexExports: 80}   # a provider's port surface includes clients, config, options, tokens and errors
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INTEGRATION_SPEC_MISSING]
   - id: be.integrations.model
+    since: 3.1.0
     profiles: [be]
     path: "src/modules/integrations/<provider>/model/"
     presence: opt-in
@@ -1526,8 +1790,14 @@ slots:
     tests: none
     coverage: required
     why: an ML or LLM model client is an integration; weights and datasets are never in git
+    rules: [BE_TIER_DIRECTION, BE_INFRA_OWNER, BE_INTEGRATION_SPEC_MISSING]
+
   - id: be.integrations.supabase
     profiles: [be]
+    exemplifiedBy:
+      - packages/hfs/templates/be/skeleton-lite/src/modules/integrations/supabase/
+      - {path: tests/fixtures/hfs-callback-full/be/src/modules/integrations/supabase/, edition: full}
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite requires the Supabase Auth and Storage integration; full opts in through a connection."
     # The only be import of @supabase/* (L10): the Auth admin and Storage admin client, plus the JWKS-based verification of
     # the Supabase access token the guard chain reads (L16). The connection itself is ordinary Postgres (the shared
     # EntityManager of the declared connection); what lives here are the service calls no database role covers.
@@ -1549,7 +1819,11 @@ slots:
   # lives under src/tests/, one folder per kind, and the folder and the file suffix always agree (a file whose suffix does
   # not match its folder matches no slot: HFS_SLOT_UNDECLARED).
   - id: be.tests.world
+    since: 3.1.0
     profiles: [be]
+    exemplifiedBy:
+      - {path: tests/fixtures/hfs-lite-slots/be/src/tests/world/, edition: lite}
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite integration proofs use the local Supabase stack and network fakes; full also boots apps and self-hosted services."
     path: "src/tests/world/"
     presence: optional
     tracked: tracked
@@ -1573,7 +1847,10 @@ slots:
       failNext/replayWebhook/delay), world.waitFor; fakes/<provider>/ holds the fake servers and payload fixtures, kit/ the inlined test helpers, and the world root may hold role-suffixed helpers (<name>.client.ts, <name>.contracts.ts, ...). Nothing is
       overridden in the DI container. It is the only test location that may import typeorm's DataSource or testcontainers,
       call migrate/runMigrations/synchronize, or write process.env.
+    rules: [BE_TEST_TOPOLOGY, BE_TEST_CONSTRAINTS_ON]
+
   - id: be.tests.world.kit
+    since: 3.1.0
     profiles: [be]
     path: "src/tests/world/kit/"
     presence: optional
@@ -1584,6 +1861,7 @@ slots:
     coverage: none
     why: the helpers the test world needs (polling, free ports, transports), inlined so the world imports no other repository; a bare <name>.ts entry in allows is what admits a plain name in BE_SOURCE_FORM
   - id: be.tests.fixtures
+    since: 3.1.0
     profiles: [be]
     path: "src/tests/fixtures/"
     presence: optional
@@ -1594,6 +1872,7 @@ slots:
     coverage: none
     why: payload fixtures with a role suffix (the doubles come from @starci/jest-preset, not from here); the test data builders live in its builders/ slot; importable by unit specs, integration and e2e; never imports a feature
   - id: be.tests.fixtures.builders
+    since: 3.1.0
     profiles: [be]
     path: "src/tests/fixtures/builders/*.builder.ts"
     presence: optional
@@ -1608,6 +1887,7 @@ slots:
       *.fixture.ts or *.factory.ts anywhere, is a BE_SOURCE_FORM finding
     rules: [BE_SOURCE_FORM]
   - id: be.tests.fixtures.i18n
+    since: 3.1.0
     profiles: [be]
     path: "src/tests/fixtures/i18n/"
     presence: optional
@@ -1618,7 +1898,9 @@ slots:
     coverage: none
     why: the ONLY test-fixture location where Vietnamese or another language may appear in source (LANG_NOT_ENGLISH); placement is the marker, there is no comment pragma
   - id: be.tests.integration
+    since: 3.1.0
     profiles: [be]
+    editionWhy: "Lite integration specs use the local Supabase CLI stack without containers or toxiproxy (ruling:R212/case-1, amended by ruling:R212/case-2 (owner:lite-production-swarm) and ruling:R212/case-4, with contracts allowed by owner:lite-contract-specs); R284 requires declared-pattern proofs there. Full additionally proves infrastructure outages through its world (R112)."
     path: "src/tests/integration/<capability>/*.integration-spec.ts"
     presence: optional
     tracked: tracked
@@ -1632,10 +1914,12 @@ slots:
     why: one capability module through useTestWorld({ modules }), no HTTP door of ours (SQL, transactions, concurrency, inbox claims on the real database; and every integration client, `<capability>` being its provider folder, against our real infra, a real peer app or the library fake at the network edge, with its success, its ErrorCode refusal mapping and an outage through the world, R112); run by test:integration
     rules: [BE_TEST_TOPOLOGY, BE_INTEGRATION_SPEC_MISSING]
   - id: be.tests.e2e
+    since: 3.1.0
     profiles: [be]
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): full proves app flows through its e2e world; lite uses the R272 wiring proof and unit/integration specs."
     path: "src/tests/e2e/<area>/*.e2e-spec.ts"
     presence: optional
-    litePresence: forbidden       # owner ruling 2026-10-12: a lite app has no e2e world
+    litePresence: forbidden       # ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite has no e2e world
     tracked: tracked
     tier: e2e
     tests: e2e
@@ -1644,18 +1928,20 @@ slots:
     why: flow e2e through useTestWorld({ apps }); external services are the world's network fakes; run by test:e2e
     rules: [HFS_CI_E2E_AUTOMATIC, BE_TEST_TOPOLOGY, BE_E2E_FLOW]
   - id: be.tests.contract
+    since: 3.1.0
     profiles: [be]
     path: "src/tests/contract/<provider>/*.contract-spec.ts"
     presence: optional
-    litePresence: forbidden       # owner ruling 2026-10-12: a lite app has no contract world
+    litePresence: optional        # owner decision 2026-10-14: lite may run provider sandbox contracts
     tracked: tracked
     tier: e2e
     tests: e2e
-    goesTo: "the full edition: a lite app has no contract world (provider sandbox specs)"
+    goesTo: "src/tests/contract/<provider>/*.contract-spec.ts in either edition: optional provider sandbox specs via test:contract; e2e stays full-only"
     coverage: none
     why: provider sandbox contracts, skipped without sandbox config; run only by test:contract, never part of test or test:e2e
     rules: [BE_TEST_TOPOLOGY]
   - id: be.tests.e2e-world-dir
+    since: 3.1.0
     profiles: [be]
     path: "src/tests/e2e/world/"
     presence: forbidden
@@ -1666,6 +1952,7 @@ slots:
 
   # ----- FE: apps ----------------------------------------------------------------------------------------
   - id: fe.app.next
+    since: 3.1.0
     profiles: [fe]
     # Each fe app is an npm workspace: its package.json is @<project>/<app> with its own runtime dependencies and the fixed
     # workspace scripts (HFS_MONO_FE_WORKSPACE); turbo runs them.
@@ -1680,6 +1967,7 @@ slots:
     tests: none
     rules: [FE_APP_ISOLATION, FE_ERROR_BOUNDARY_MISSING, FE_NEXT_CONVENTIONS, HFS_MONO_FE_WORKSPACE, HFS_MONO_WORKSPACE_DEP]
   - id: fe.app-optional
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/public/"
     presence: optional
@@ -1687,12 +1975,13 @@ slots:
     tier: none
     tests: none
   - id: fe.route
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/app/"
     presence: required
     tracked: tracked
     tier: route
-    # Owner ruling 2026-10-13 (R212 case-2, lite = full): routes are thin and the front end serves no API - health/live is the one
+    # ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4) (lite = full): routes are thin and the front end serves no API - health/live is the one
     # route handler of this slot, the Supabase auth callback is fe.route.callback, and no file holds a Server Action
     # (FE_ROUTE_HANDLER_FORBIDDEN, FE_SERVER_ACTION_FORBIDDEN).
     allows: ["[locale]/**/{page,layout,template,loading,error,not-found,default}.tsx", "[locale]/providers.tsx",
@@ -1705,6 +1994,7 @@ slots:
     tests: none
     rules: [FE_ROUTE_FILES_THIN, FE_CLIENT_BOUNDARY, FE_OWNER_REACHABLE, FE_ROUTE_HANDLER_FORBIDDEN, FE_SERVER_ACTION_FORBIDDEN]
   - id: fe.source-root-pinned
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/{proxy.ts,instrumentation.ts,instrumentation-client.ts,sentry.server.config.ts,sentry.edge.config.ts}"
     presence: optional
@@ -1714,6 +2004,7 @@ slots:
     tests: none
     rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16 (fe.source-root-middleware)
   - id: fe.source-root-middleware
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/{middleware.ts,middleware.js}"
     presence: forbidden
@@ -1724,6 +2015,8 @@ slots:
     rules: [FE_NEXT_CONVENTIONS]
   - id: fe.route.callback
     profiles: [fe]
+    exemplifiedBy:
+      - {path: tests/fixtures/hfs-callback-full/fe/apps/web/src/app/auth/callback/route.ts, edition: full}
     # The auth callback of a Supabase session (the PKCE code exchange), kept only when the auth flow truly needs a server exchange
     # (prefer the client-side PKCE exchange in fe.modules.auth): the one non-health route handler of an app with a Supabase
     # connection; an app without one has no route handler in fe/ (L15).
@@ -1734,7 +2027,10 @@ slots:
     tier: route
     tests: none
     since: 2.1.0
+    rules: [FE_ROUTE_HANDLER_FORBIDDEN, FE_CALLBACK_SHAPE, FE_SUPABASE_CLIENT_OWNER, FE_SERVICE_ROLE_FORBIDDEN]
+
   - id: fe.feature
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/features/{pages,layouts,overlays}/<name>/"
     presence: required
@@ -1749,6 +2045,7 @@ slots:
     budget: {component.tsx: 300, index.tsx: 200, dataHooks: 6, useState: 6}
     rules: [FE_SIZE_BUDGET, FE_OWNER_REACHABLE, FE_I18N_LITERAL]
   - id: fe.components
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/components/{blocks,composites,branches,leaves}/<name>/"
     presence: optional
@@ -1779,6 +2076,7 @@ slots:
     since: 3.0.0
     rules: [FE_CLIENT_BOUNDARY]
   - id: fe.hooks
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/hooks/<domain>/"
     presence: optional
@@ -1789,7 +2087,7 @@ slots:
     allows: [index.ts, "use<name>.ts", "<domain>.shared.ts"]   # React hooks only; <domain>.shared.ts = sanctioned non-hook helpers
     roles: {entry: index.ts, shared: "<domain>.shared.ts"}
     tests: none
-    budget: {file: 200, dataHooks: 6, useState: 6}
+    budget: {file: 200, barrel: 400, dataHooks: 6, useState: 6}   # barrel: index.ts containing only export ... from statements
     rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
   - id: fe.hooks.swr
     profiles: [fe]
@@ -1806,7 +2104,7 @@ slots:
              "api/rest/queries/useGet*Swr.ts", "api/rest/mutations/use{Post,Put,Patch,Delete}*Swr.ts"]
     roles: {entry: index.ts, effects: SwrSideEffects.tsx}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
   - id: fe.hooks.rhf
@@ -1822,7 +2120,7 @@ slots:
     allows: [index.ts, "use*Form.ts"]
     roles: {entry: index.ts}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.zustand
@@ -1837,7 +2135,7 @@ slots:
     allows: [index.ts, store.ts, "use*.ts"]
     roles: {entry: index.ts, store: store.ts}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.socketio
@@ -1853,7 +2151,7 @@ slots:
     allows: [index.ts, sockets.ts, SocketIoSideEffects.tsx, connectionStore.ts, "enums/*.ts", "types/*.ts", "use*.ts"]
     roles: {entry: index.ts, effects: SocketIoSideEffects.tsx}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.effects
@@ -1869,7 +2167,7 @@ slots:
     allows: [index.ts, "use*.ts", "*SideEffect.tsx", "*SideEffects.tsx"]
     roles: {entry: index.ts, effects: "*SideEffect.tsx"}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.hooks.reuseables
@@ -1884,7 +2182,7 @@ slots:
     allows: [index.ts, "use*.ts"]
     roles: {entry: index.ts}
     tests: none
-    budget: {file: 200}
+    budget: {file: 200, barrel: 400}
     since: 3.0.0
     rules: [FE_HOOKS_ARE_HOOKS]
   - id: fe.redux
@@ -1901,7 +2199,10 @@ slots:
     tests: none
     budget: {file: 400}
     since: 3.0.0
+    rules: [FE_SOURCE_FORM, FE_HOOKS_ARE_HOOKS, FE_OWNER_REACHABLE]
+
   - id: fe.modules
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/modules/<capability>/"
     presence: required
@@ -1909,11 +2210,13 @@ slots:
     tier: modules
     owner: true
     requiredInstances: {capability: [config, i18n, routes]}
+    # A populated fe.modules instance with no .ts or .tsx files (CSS/assets only) needs no index.ts.
     requires: [index.ts]
     tests: none
     budget: {file: 400}
     rules: [FE_ENV_OWNER, FE_TRANSPORT_OWNER]
   - id: fe.modules.api
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/modules/api/"
     presence: optional
@@ -1933,7 +2236,20 @@ slots:
     entries: ["graphql/queries/query-*.ts", "graphql/queries/types/*.ts", "graphql/mutations/mutation-*.ts", "graphql/mutations/types/*.ts"]
     tests: none
     rules: [FE_TRANSPORT_OWNER, FE_HTTP_STATUS_COLLAPSE, FE_WIRE_GENERATED]
+  - id: fe.transport.generated
+    since: 3.2.0
+    profiles: [fe]
+    path: "apps/<app>/src/modules/api/graphql/__generated__/"
+    presence: optional
+    tracked: ignored
+    tier: transport
+    tests: none
+    why: the canonical GraphQL client output of codegen is local and never committed; this specific slot overrides the tracked API parent
+    rules: [FE_WIRE_GENERATED]
+    exemplifiedBy:
+      - {path: tests/fixtures/hfs-generated-wire/fe/apps/web/src/modules/api/graphql/__generated__/graphql.ts, editions: [lite, full]}
   - id: fe.transport.client
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/modules/api/graphql/clients/"
     presence: optional
@@ -1943,6 +2259,7 @@ slots:
     why: the auth and no-auth Apollo clients and their link chain (retry, error, timeout, token refresh, attach access token, http) of the one app that calls the back end; when several apps do, the shared client is fe.package.api.client
     rules: [FE_TRANSPORT_OWNER]
   - id: fe.transport.outcome
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/modules/api/graphql/types.ts"
     presence: optional
@@ -1953,6 +2270,7 @@ slots:
     why: the one GraphQLResponse union ({success, message, error, data}) of the one app that calls the back end; when several apps do, the shared union is fe.package.api.outcome
     rules: [FE_HTTP_STATUS_COLLAPSE]
   - id: fe.modules.config
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/modules/config/"
     presence: required
@@ -1960,7 +2278,10 @@ slots:
     tier: foundation
     tests: none
     why: the only reader of process.env and NEXT_PUBLIC_*; fails fast, no localhost fallback
+    rules: [FE_ENV_OWNER]
+
   - id: fe.modules.i18n
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/modules/i18n/"
     presence: required
@@ -1973,6 +2294,7 @@ slots:
     tests: none
     rules: [FE_I18N_PLACEMENT, FE_I18N_CATALOG]
   - id: fe.modules.brand
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/modules/brand/brand.css"
     presence: optional
@@ -1982,6 +2304,7 @@ slots:
     why: the ONLY app file that may hold colour values; sets grammar brand tokens only, light and dark
     rules: [FE_STYLE_TOKEN_ONLY]
   - id: fe.modules.routes
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/modules/routes/"
     presence: required
@@ -1989,7 +2312,10 @@ slots:
     tier: foundation
     tests: none
     why: every href builder; FE_HREF_RESOLVES checks each against app/
+    rules: [FE_HREF_RESOLVES, FE_ROUTE_HARDCODED]
+
   - id: fe.modules.types
+    since: 3.1.0
     profiles: [fe]
     path: "apps/<app>/src/modules/types/"
     presence: optional
@@ -1997,6 +2323,8 @@ slots:
     tier: foundation
     tests: none
     why: shared types with no runtime behaviour; a component may import them
+    rules: [FE_TYPE_ESCAPE, HFS_TS_STRICT]
+
   - id: fe.modules.types.ambient
     parent: fe.modules.types
     profiles: [fe]
@@ -2009,6 +2337,8 @@ slots:
     tests: none
     since: 2.2.0
     why: global ambient declarations loaded by the app compiler; this owner exposes no runtime API
+    rules: [FE_TYPE_ESCAPE, HFS_TS_STRICT]
+
   - id: fe.modules.auth
     profiles: [fe]
     # The identity-provider client (fe-stack auth, FE-AUTH): the session, the access token the Apollo link attaches and the
@@ -2020,6 +2350,7 @@ slots:
     tier: modules
     owner: true
     requires: [index.ts]
+    entries: [server.ts]   # the server-only PKCE exchange API used by the opted-in callback route
     tests: none
     since: 3.0.0
     rules: [FE_SUPABASE_CLIENT_OWNER, FE_SERVICE_ROLE_FORBIDDEN]
@@ -2037,7 +2368,10 @@ slots:
     roles: {entry: index.ts, hooks: hooks.ts}   # hooks.ts: the use*WithToast hooks of the toast module
     tests: none
     since: 3.0.0
+    rules: [FE_I18N_LITERAL, FE_HOOKS_ARE_HOOKS, FE_HTTP_STATUS_COLLAPSE]
+
   - id: fe.package.ui
+    since: 3.1.0
     profiles: [fe]
     path: "packages/<family>-ui/"
     presence: opt-in
@@ -2052,6 +2386,7 @@ slots:
     why: built to dist with explicit named exports; only composites, branches and leaves; no unused export; no colour literal
     rules: [FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT, FE_STYLE_TOKEN_ONLY]
   - id: fe.package.api
+    since: 3.1.0
     profiles: [fe]
     path: "packages/<family>-api/"
     presence: opt-in
@@ -2063,6 +2398,7 @@ slots:
     why: the one transport client and the one Outcome union shared by every app of the repository; no app keeps its own
     rules: [FE_TRANSPORT_OWNER, FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT]
   - id: fe.package.api.client
+    since: 3.1.0
     profiles: [fe]
     path: "packages/<family>-api/src/graphql/clients/"
     presence: optional     # enabled with its package (fe.package.api is the opt-in)
@@ -2072,6 +2408,7 @@ slots:
     why: the repository's one pair of Apollo clients and their link chain
     rules: [FE_TRANSPORT_OWNER]
   - id: fe.package.api.outcome
+    since: 3.1.0
     profiles: [fe]
     path: "packages/<family>-api/src/graphql/types.ts"
     presence: optional     # enabled with its package (fe.package.api is the opt-in)
@@ -2082,6 +2419,7 @@ slots:
     why: the repository's one GraphQLResponse union
     rules: [FE_HTTP_STATUS_COLLAPSE]
   - id: fe.package.i18n
+    since: 3.1.0
     profiles: [fe]
     path: "packages/<family>-i18n/"
     presence: opt-in