@starci/eslint-canon-fe 9.1.7 → 9.1.8

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 9.1.8 - 2026-10-26
+
+- Added: the `divider-full-bleed` rule (a Grammar `Divider` between full-bleed regions is itself full bleed), the SegmentedControl `size="control"` carve-out and the `@starci/event-stream` registration in the fe-stack concern.
+- Changed: the bundled canon pins follow the final package versions (Grammar 0.12.12 with the lint families).
+
 ## 9.1.7 - 2026-10-26
 
 - Changed: the alpha.31.1 round folded into alpha.31; the bundled canon pins and runtime copies follow the final package versions. No rule changes.

package/lib/config.mjs

@@ -98,7 +98,7 @@ export const SLOT_FREE_RULES = Object.freeze([
   "no-native-anchor", "no-inline-parameter-type", "no-hand-rolled-polling", "no-copy-in-call", "no-alert", "no-failure-collapse",
   "outcome-kinds-exhaustive", "no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import",
   "prefer-export-from", "no-unused-prop-types", "media-has-caption", "max-params",
-  "nested-control-variant", "no-list-panel-padding", "no-app-surface-paint",
+  "nested-control-variant", "no-list-panel-padding", "no-app-surface-paint", "divider-full-bleed",
   "button-intent-required", "button-no-variant", "destructive-confirm-in-dialog", "single-commit-per-render", "no-commit-in-collection-item",
 ])
 

package/lib/why.mjs

@@ -19,6 +19,11 @@
 
 /** @type {Record<string, Why>} */
 export const why = {
+  "divider-full-bleed": {
+    code: "FE_DIVIDER_FULL_BLEED",
+    en: "`<file>` insets a horizontal Grammar divider with wrapper padding.",
+    fix: "Move horizontal padding to the sibling content bands so the divider reaches both surface edges.",
+  },
   "button-intent-required": {
     code: "FE_BUTTON_INTENT_REQUIRED",
     en: "`<file>` renders a Button or IconButton without the command's intent.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.1.7",
+  "version": "9.1.8",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -22,36 +22,43 @@ pins:
     side: fe
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
+  '@starci/event-stream':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: fe
+    source: packages/event-stream/package.json
+    why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.12.10
+    version: 0.12.12
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.52
+    version: 3.4.54
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.7
+    version: 9.1.8
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.11
+    version: 0.12.12
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.11
+    version: 0.12.12
     group: starci
     install: registry
     side: fe

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -82,7 +82,18 @@ concerns:
     home: [fe.hooks.socketio]
     pattern: FE-REALTIME
     forbids: [subscriptions-transport-ws, '@supabase/realtime-js', pusher-js, ably]
-    why: one socket.io-client singleton per namespace and one side-effect component that dispatches to redux and SWR; both editions run the gateway in the be api process. A one-way channel served as server-sent events needs no package, only a stream reader in modules/api/sse/clients, a stream operation in modules/api/sse and a useSubscribe<Channel>Swr hook (FE-REALTIME).
+    why: one socket.io-client singleton per namespace and one side-effect component that dispatches to redux and SWR; both editions run the gateway in the be api process. A one-way channel served as server-sent events is the event-stream concern below (FE-REALTIME).
+  - id: event-stream
+    tier: opt
+    packages: ['@starci/event-stream']
+    home: [fe.transport.stream]
+    pattern: FE-REALTIME
+    forbids: ['@microsoft/fetch-event-source', eventsource, event-source-polyfill, eventsource-parser, reconnecting-eventsource, 'sse.js', 'fetch-sse', 'sse-ts']
+    why: >-
+      the one server-sent-events client (owner:event-stream-package): the app creates one instance in modules/api/sse/clients/event-stream.ts
+      with createEventStream (the bearer token source, one renewal on a 401, backoff, heartbeat timeout), each stream operation
+      (sse/<area>/stream-<channel>.ts) follows on it, and the useSubscribe<Channel>Swr hook reads that operation. No app keeps a
+      hand-written reader (read-event-stream.ts) and no second SSE library is installed.
   - id: auth
     tier: core
     packages: []

package/runtime/knowledge/hfs/slots.yaml

@@ -305,7 +305,7 @@ ruleParams:
       - {typeSuffix: Options, names: [options], nameSuffix: Options}
     # R89 BE_SOURCE_FORM: the closed role-suffix vocabulary of a source file name (<kebab-name>.<suffix>.ts; BE-CONVENTION 1.15)
     # and the suffixes that are never a role. index.ts, main.ts, app.module.ts and the migrations of be.persistence are the
-    # only names outside it.
+    # only names outside it. Typed realtime topic builders use the existing policy role (BE-REALTIME-3 of knowledge/patterns/be/realtime.yaml).
     suffixes: [module, module-definition, decorators, options, config, connection, service, schema, command, query, handler, templates, compensation, saga-state, saga-step, saga, contracts, port, resolver, controller, gateway, webhook, subscription, consumer, cli, event, queue, projection, projection-entity, processor, step, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, adapter, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
     # R47 BE_CONTRACT_UNGUARDED: the world's shape vocabulary. `helper` names the function a contract spec imports to erase the values of a JSON
     # payload (`shapeOf`); a contract spec proves a fake's fixtures by asserting helper(real) equals helper(fixture).
@@ -1617,7 +1617,7 @@ slots:
     requires: [index.ts]
     # <name>.templates.ts holds the capability's static templates, copy and presets as TS constants (owner ruling 2026-10-13);
     # user-editable ones are seed rows, large or user media live in object storage.
-    allows: ["<capability>.module.ts", "<capability>.module-definition.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts", "*.schema.ts", "*.schema.spec.ts"]
+    allows: ["<capability>.module.ts", "<capability>.module-definition.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts", "*.schema.ts", "*.schema.spec.ts", "*.policy.ts", "*.policy.spec.ts"]
     forbids: [testing/, exceptions/, utils/, helpers/, shared/]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
     coverage: required
@@ -2336,8 +2336,8 @@ slots:
     # The browser's calls to the back end (owner ruling 2026-10-13, fe-stack graphql/rest/codegen, FE-API-GRAPHQL): the auth and
     # no-auth Apollo clients with their link chain (graphql/clients), one file per operation (graphql/queries/query-<x>.ts,
     # graphql/mutations/mutation-<x>.ts and graphql/subscriptions/subscription-<x>.ts, each with its gql document map and typed request/response in types/), the generated wire types
-    # (graphql/__generated__), the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints and the fetch readers of
-    # server-sent-events streams (sse/<area>/stream-<channel>.ts, one operation per stream, run on the stream reader of sse/clients). A repository has
+    # (graphql/__generated__), the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints and the
+    # server-sent-events streams (sse/<area>/stream-<channel>.ts, one operation per stream, run on the app's @starci/event-stream instance in sse/clients). A repository has
     # exactly ONE client folder and ONE GraphQLResponse union: the app's (fe.transport.client/outcome) when one app calls the back end,
     # or the api package's (fe.package.api.client/outcome) when several do (FE_TRANSPORT_OWNER, machine).
     requires: [index.ts]
@@ -2381,7 +2381,7 @@ slots:
     tier: transport
     allows: ["*.ts"]
     tests: none
-    why: "the fetch reader of server-sent-events streams of the one app that calls the back end, the stream half of the transport client layer (FE-REALTIME): it opens the stream with the bearer access token, parses the events and reopens it with Last-Event-ID after a capped, doubling wait; a stream operation (sse/<area>/stream-<channel>.ts) runs on it and a useSubscribe hook of hooks/swr reads that operation; a fetch here asks for text/event-stream and only a stream operation imports the reader (FE_TRANSPORT_OWNER); a repository where several apps stream keeps one reader in each of them"
+    why: "the event-stream client of the one app that calls the back end, the stream half of the transport client layer (FE-REALTIME): event-stream.ts creates the app's one @starci/event-stream instance (createEventStream with the bearer access token source, which opens the stream with fetch, parses the events and reopens it with Last-Event-ID after a capped, doubling wait); a stream operation (sse/<area>/stream-<channel>.ts) follows on it and a useSubscribe hook of hooks/swr reads that operation; no hand-written reader lives here (owner:event-stream-package) and only a stream operation imports this folder (FE_TRANSPORT_OWNER); a repository where several apps stream keeps one instance in each of them"
     rules: [FE_TRANSPORT_OWNER]
     exemplifiedBy:
       - {path: packages/eslint/fe/r50-transport-owner-coverage.spec.mjs, editions: [lite, full]}

package/runtime/scripts/hfs/architecture/index.mjs

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { canonical, loadArchitectureConfig } from './config.mjs';
 import { sameOrUnder } from '../../lib/path-key.mjs';
 import { buildTypeScriptContext, relativePath } from './typescript.mjs';
+import { withTypeScriptProgramRun } from '../typescript-programs.mjs';
 import { checkBackend } from './backend.mjs';
 import { checkBackendContracts, PUBLIC_CONTRACT_RULE_ID, READONLY_BOUNDARY_RULE_ID } from './contracts.mjs';
 import { checkFrontend } from './frontend.mjs';
@@ -324,7 +325,7 @@ function scopeFindings({ config, context, violations, paths, surface }) {
  * that read the whole repository to answer (clones, dead exports, repository-wide symbols); the pre-push check of the changed owners uses it.
  */
 export function checkArchitecture(options = {}) {
-  return withTreeCache(() => checkArchitectureOnce(options));
+  return withTypeScriptProgramRun(() => withTreeCache(() => checkArchitectureOnce(options)));
 }
 
 function checkArchitectureOnce({ repositoryRoot, injectedTypeScript, paths = [], base, fast = false, hfs: openedHfs, surface = 'all' }) {

package/runtime/scripts/hfs/architecture/type-context.mjs

@@ -103,36 +103,35 @@ function createProjects(config, paths, state, selection, ts, helpers) {
   return projects;
 }
 
+function ownershipRank(config, project, file, helpers) {
+  return helpers.isInside(path.dirname(path.join(config.root, ...project.relative.split('/'))), file)
+    ? project.relative.split('/').length : -1;
+}
+
 function collectProjectFiles(config, projects, helpers) {
-  const occurrences = new Map();
-  const sourceIn = new Map();
+  const fileMap = new Map();
+  const ownerByFile = new Map();
+  // Retain only the winning source occurrence while visiting each project. Equal ranks keep the first project,
+  // as does a file outside every project directory; the deepest enclosing tsconfig otherwise owns its checker.
+  // Within that project the last realpath alias supplies the source, matching the compiler's occurrence order.
   for (const project of projects) {
-    for (const sourceFile of project.program.getSourceFiles().filter(file => helpers.isProductionSource(config.root, file))) {
+    for (const sourceFile of project.program.getSourceFiles()) {
+      if (!helpers.isProductionSource(config.root, sourceFile)) continue;
       const name = helpers.canonical(sourceFile.fileName);
-      if (!occurrences.has(name)) occurrences.set(name, []);
-      occurrences.get(name).push(project);
-      sourceIn.set(`${project.relative}|${name}`, sourceFile);
+      const owner = ownerByFile.get(name);
+      if (owner === project) { fileMap.set(name, sourceFile); continue; }
+      if (owner && ownershipRank(config, owner, name, helpers) >= ownershipRank(config, project, name, helpers)) continue;
+      ownerByFile.set(name, project);
+      fileMap.set(name, sourceFile);
     }
   }
-  return { occurrences, sourceIn };
-}
-
-function owningProject(config, candidates, file, helpers) {
-  return candidates.filter(item => helpers.isInside(path.dirname(path.join(config.root, ...item.relative.split('/'))), file))
-    .sort((x, y) => y.relative.split('/').length - x.relative.split('/').length)[0] ?? candidates[0];
+  return { fileMap, ownerByFile };
 }
 
 function makeFileGraph(config, projects, helpers) {
-  const { occurrences, sourceIn } = collectProjectFiles(config, projects, helpers);
-  const fileMap = new Map();
+  const { fileMap, ownerByFile } = collectProjectFiles(config, projects, helpers);
   const checkerByFile = new Map();
-  const ownerByFile = new Map();
-  for (const [name, candidates] of occurrences) {
-    const owner = owningProject(config, candidates, name, helpers);
-    ownerByFile.set(name, owner);
-    fileMap.set(name, sourceIn.get(`${owner.relative}|${name}`));
-    checkerByFile.set(name, owner.program.getTypeChecker());
-  }
+  for (const [name, owner] of ownerByFile) checkerByFile.set(name, owner.program.getTypeChecker());
   const files = [...fileMap.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, file]) => file);
   const edges = new Map([...fileMap.keys()].map(file => [file, []]));
   for (const [file, sourceFile] of fileMap) {
@@ -142,6 +141,21 @@ function makeFileGraph(config, projects, helpers) {
   return { fileMap, checkerByFile, ownerByFile, files, edges };
 }
 
+// Resolution entries contain failed lookup paths as well as hits. Keep only one bounded batch for the current project;
+// graph edges retain the resolved targets, so rotating this scratch cache changes neither coverage nor findings.
+const RESOLUTION_BATCH_SIZE = 1024;
+
+function resolutionCache(state, project) {
+  if (state.resolutionProject !== project || state.resolutionCount === RESOLUTION_BATCH_SIZE) {
+    state.resolutionProject = project;
+    state.resolutionCount = 0;
+    state.resolutionCache = state.ts.createModuleResolutionCache(state.config.root,
+      file => state.ts.sys.useCaseSensitiveFileNames ? file : file.toLowerCase(), project.options);
+  }
+  state.resolutionCount += 1;
+  return state.resolutionCache;
+}
+
 function addUnprovenFindings(sourceFile, project, references, errors, config, helpers) {
   for (const item of references.unproven) errors.push({
     ruleId: 'ARCH_DYNAMIC_DEPENDENCY_UNPROVEN',
@@ -229,7 +243,7 @@ function processReference(from, sourceFile, project, owningWorkspace, reference,
   const { config, ts, workspaceNames, workspaces, host, errors, helpers } = state;
   // A workspace package is read at its source, never at its build: the same import resolves whether or not dist exists.
   const workspaceTarget = workspaces.filter(item => item.root !== helpers.canonical(config.root)).map(item => helpers.workspaceSourceEntry(ts, item, reference.specifier)).find(Boolean);
-  const resolvedName = workspaceTarget ?? helpers.resolveTypeScriptModule(ts, reference.specifier, sourceFile.fileName, project.options, host);
+  const resolvedName = workspaceTarget ?? helpers.resolveTypeScriptModule(ts, reference.specifier, sourceFile.fileName, project.options, host, resolutionCache(state, project));
   if (!resolvedName) {
     unresolvedReferenceFinding(reference, sourceFile, project, config, workspaceNames, errors, helpers);
     return;
@@ -279,7 +293,8 @@ export function contextFromProjects(config, loaded, paths, helpers) {
   const fileGraph = makeFileGraph(config, projects, helpers);
   const { edges, workspaces } = dependencyGraph(config, loaded, fileGraph, fileGraph.ownerByFile, errors, helpers);
   if (projects.length && fileGraph.files.length === 0) errors.push({ ruleId: 'ARCH_NO_SOURCE', message: 'The configured TypeScript projects contain no production TypeScript or JavaScript source.' });
+  const { checkerByFile } = fileGraph;
   return { loaded, errors, files: fileGraph.files, edges, programs: projects.map(item => item.program), program: projects[0]?.program ?? null, projects, ts, workspaces,
-    checkerFor: file => fileGraph.checkerByFile.get(helpers.canonical(file)) ?? null,
+    checkerFor: file => checkerByFile.get(helpers.canonical(file)) ?? null,
     workspaceOf: file => helpers.workspaceOf(workspaces, helpers.canonical(file)) };
 }

package/runtime/scripts/hfs/typescript-programs.mjs

@@ -9,6 +9,11 @@ import { byCodeUnit } from '../lib/list.mjs';
 // builds afresh.
 const runs = new AsyncLocalStorage();
 
+/** Share compiler inputs only until this check finishes; nested callers join the same run. */
+export function withTypeScriptProgramRun(run) {
+  return runs.getStore() ? run() : runs.run(new Map(), run);
+}
+
 
 function keyOf(value) {
   if (value === undefined) return 'u';
@@ -48,7 +53,28 @@ export function sharedInProgramRun(kind, ts, input, build) {
 /** ts.createProgram, shared inside a program run. */
 export function createTypeScriptProgram(ts, { rootNames, options, projectReferences }) {
   return sharedInProgramRun('program', ts, { rootNames, options, projectReferences },
-    () => ts.createProgram({ rootNames, options, projectReferences }));
+    () => ts.createProgram({ rootNames, options, projectReferences, host: sharedSourceHost(ts, options) }));
+}
+
+function sharedSourceHost(ts, options) {
+  if (!runs.getStore()) return undefined;
+  const registry = sharedInProgramRun('documents', ts, null,
+    () => ts.createDocumentRegistry(ts.sys.useCaseSensitiveFileNames, ts.sys.getCurrentDirectory()));
+  const host = ts.createCompilerHost(options);
+  const readSource = host.getSourceFile;
+  // TypeScript's registry separates parse-affecting settings and Node module formats. Sharing syntax trees leaves
+  // module resolution and symbol/type caches with each program, including projects with different path aliases.
+  host.getSourceFile = (file, sourceOptions, onError, fresh) => {
+    if (fresh) return readSource(file, sourceOptions, onError, fresh);
+    let text;
+    try { text = host.readFile(file); } catch (error) {
+      onError?.(String(error.message ?? error));
+      text = '';
+    }
+    if (text === undefined) return undefined;
+    return registry.acquireDocument(file, options, ts.ScriptSnapshot.fromString(text), '0', undefined, sourceOptions);
+  };
+  return host;
 }
 
 /** Read and expand a tsconfig with the caller's TypeScript compiler and optional tracked file reader. */
@@ -66,6 +92,7 @@ export function typeScriptProjectReferencePath(ts, reference) {
 }
 
 /** Resolve an import using the selected project's compiler options. */
-export function resolveTypeScriptModule(ts, specifier, from, options, host = ts.sys) {
-  return ts.resolveModuleName(specifier, from, options, host).resolvedModule?.resolvedFileName;
+export function resolveTypeScriptModule(ts, specifier, from, options, host, cache) {
+  const resolverHost = host === undefined ? ts.sys : host;
+  return ts.resolveModuleName(specifier, from, options, resolverHost, cache).resolvedModule?.resolvedFileName;
 }

package/surface-rules.mjs

@@ -1,6 +1,6 @@
 /** Grammar owns surface nesting and the single content edge of a panel list (ANATOMY-2, PADDING-0). */
-import { attributeValue, stringOf } from "./lib/ast.mjs"
-import { importOf, isFn, patternPath, unwrap, variableOf } from "./lib/bindings.mjs"
+import { attributeValue, stringOf, walk } from "./lib/ast.mjs"
+import { functionOf, importOf, isFn, patternPath, unwrap, variableOf } from "./lib/bindings.mjs"
 import { typedClassStrings, typedPropertyStrings } from "./lib/typed-class-values.mjs"
 import { reactHookOf } from "./lib/react.mjs"
 
@@ -356,8 +356,88 @@ export const noListPanelPadding = {
   },
 }
 
+/** BOUNDARY-1 case-5: only content bands carry inset; horizontal separators reach the surface edges. */
+export const dividerFullBleed = {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "BOUNDARY-1 case-5: horizontal Grammar dividers are full-bleed.",
+    },
+    schema: [],
+    messages: {
+      padding:
+        "FE_DIVIDER_FULL_BLEED: horizontal padding on this wrapper insets a Grammar Divider/Separator. Move padding to the sibling content bands so the divider reaches both surface edges.",
+    },
+  },
+  create(context) {
+    // Follow rendered same-file components, helper calls and JSX constants, with cycle protection.
+    const containsDivider = (root, seen = new Set()) => {
+      if (!root || seen.has(root)) return false
+      seen.add(root)
+      let found = false
+      const follow = (node) => {
+        found = containsDivider(node, seen) || found
+      }
+      walk(context.sourceCode, root, (node) => {
+        if (found) return false
+        if (isFn(node)) return false
+        if (node.type === "JSXOpeningElement") {
+          const name = grammarName(context, node.name)
+          if (
+            name?.length === 1 &&
+            ["Divider", "Separator"].includes(name[0])
+          ) {
+            const orientations = node.attributes.flatMap((entry) =>
+              propStrings(context, entry, "orientation", "variant"),
+            )
+            if (
+              !orientations.length ||
+              orientations.some((entry) => entry.text !== "vertical")
+            )
+              found = true
+          } else if (node.name.type === "JSXIdentifier") {
+            for (const definition of variableOf(context, node.name)?.defs ??
+              []) {
+              if (definition.type === "FunctionName")
+                follow(definition.node.body)
+              if (definition.type === "Variable")
+                follow(functionOf(context, definition.node.init)?.body)
+            }
+          }
+        }
+        if (node.type === "CallExpression") {
+          follow(functionOf(context, node.callee)?.body)
+          for (const argument of node.arguments)
+            if (isFn(argument)) follow(argument.body)
+        }
+        if (
+          node.type === "Identifier" &&
+          node.parent?.type === "JSXExpressionContainer"
+        ) {
+          for (const value of bindingValues(context, node)) follow(value)
+        }
+        return undefined
+      })
+      return found
+    }
+    return {
+      JSXOpeningElement(node) {
+        const padding = node.attributes.find((entry) =>
+          propStrings(context, entry, "className").some((value) =>
+            classTokens(value.text).some(horizontalPadding),
+          ),
+        )
+        if (!padding) return
+        if (node.parent.children.some((child) => containsDivider(child)))
+          context.report({ node: padding, messageId: "padding" })
+      },
+    }
+  },
+}
+
 /** The surface laws ship at error in every composing source tree. */
-export const rules = { "nested-control-variant": nestedControlVariant, "no-list-panel-padding": noListPanelPadding, "no-app-surface-paint": noAppSurfacePaint }
+export const rules = { "divider-full-bleed": dividerFullBleed, "nested-control-variant": nestedControlVariant, "no-list-panel-padding": noListPanelPadding, "no-app-surface-paint": noAppSurfacePaint }
 
 /** No app can lower or omit a surface law. */
 export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))