@starci/eslint-canon-fe 9.1.7 → 9.1.9

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 9.1.9 - 2026-10-26
+
+- Added: starci-fe/control-height (R320 FE_CONTROL_HEIGHT), selection-fill-no-check and no-grammar-internal-selector.
+- Changed: the bundled runtime copies carry the light push gate and the owner rulings of 2026-10-26.
+
+## 9.1.8 - 2026-10-26
+
+- Added: the `divider-full-bleed` rule (a Grammar `Divider` between full-bleed regions is itself full bleed), the SegmentedControl `size="control"` carve-out and the `@starci/event-stream` registration in the fe-stack concern.
+- Changed: the bundled canon pins follow the final package versions (Grammar 0.12.12 with the lint families).
+
 ## 9.1.7 - 2026-10-26
 
 - Changed: the alpha.31.1 round folded into alpha.31; the bundled canon pins and runtime copies follow the final package versions. No rule changes.

package/control-height.mjs

@@ -0,0 +1,77 @@
+/** CONTROL-HEIGHT-1: one control height; the app never picks a larger step or mixes steps in one row. */
+import { attributeValue, stringOf } from "./lib/ast.mjs"
+import { importOf } from "./lib/bindings.mjs"
+
+const GRAMMAR_ENTRY = /^@starci\/grammar(?:\/(?:common|core|heritage|offset-pop))?$/
+const CONTROLS = new Set(["Button", "IconButton", "Switch", "Input", "SearchField", "Select", "Tabs", "SegmentedControl", "Textarea", "NumberField", "ComboBox"])
+/** A marketing hero call to action on a landing page is the one place the 48px step is allowed. */
+const LANDING_PATH = /[\\/](?:landing|hero|marketing)[\\/]|(?:Landing|Hero)[^\\/]*[\\/]/
+/** The default size and its two spellings: the vendor `md` and Grammar's `control` are the same 40px height. */
+const DEFAULT_SIZE = new Set(["md", "control"])
+
+/** The Grammar control a JSX name resolves to; a shadowed or foreign component of the same name is not one. */
+const controlOf = (context, name) => {
+  let root = name
+  const parts = []
+  while (root.type === "JSXMemberExpression") {
+    parts.unshift(root.property.name)
+    root = root.object
+  }
+  if (root.type !== "JSXIdentifier") return null
+  const imported = importOf(context, root)
+  if (!imported || !GRAMMAR_ENTRY.test(imported.source)) return null
+  const role = imported.imported ?? parts.shift()
+  return role !== undefined && parts.length === 0 && CONTROLS.has(role) ? role : null
+}
+
+/** The statically authored size of a control: `control` when absent, null when it is dynamic. */
+const sizeOf = (opening) => {
+  const attribute = opening.attributes.find((entry) => entry.type === "JSXAttribute" && entry.name.name === "size")
+  if (!attribute) return "control"
+  const text = stringOf(attributeValue(attribute))
+  if (text === null) return null
+  return DEFAULT_SIZE.has(text) ? "control" : text
+}
+
+/** The Grammar controls a row holds directly, looking through fragments. */
+const rowControls = (context, element) => element.children.flatMap((child) => {
+  if (child.type === "JSXFragment") return rowControls(context, child)
+  if (child.type !== "JSXElement") return []
+  return controlOf(context, child.openingElement.name) === null ? [] : [child.openingElement]
+})
+
+const controlHeight = {
+  meta: { type: "problem", docs: { description: "CONTROL-HEIGHT-1: one 40px control height, no larger step outside a landing hero, no mixed sizes in one row." }, schema: [], messages: {
+    FE_CONTROL_HEIGHT: "FE_CONTROL_HEIGHT: {{detail}} Grammar draws every standalone control at one 40px height; omit size (sm is for a control nested in an item or a dense toolbar, lg only for a landing hero call to action).",
+  } },
+  create(context) {
+    const landing = LANDING_PATH.test(context.filename)
+    const reported = new Set()
+    const report = (node, detail) => {
+      if (reported.has(node)) return
+      reported.add(node)
+      context.report({ node, messageId: "FE_CONTROL_HEIGHT", data: { detail } })
+    }
+    return {
+      JSXOpeningElement(opening) {
+        const role = controlOf(context, opening.name)
+        if (role === null) return
+        const size = sizeOf(opening)
+        if (size === "xl" || (size === "lg" && !landing)) report(opening, `${role} size="${size}" is a larger control step than the app chrome allows.`)
+      },
+      "JSXElement, JSXFragment"(element) {
+        const controls = rowControls(context, element)
+        const sizes = controls.map(sizeOf)
+        if (sizes.includes(null) || new Set(sizes).size < 2) return
+        const index = sizes.findIndex((size) => size !== sizes[0])
+        report(controls[index], "this control sits in a row with controls of another size.")
+      },
+    }
+  },
+}
+
+/** The one rule of the law. */
+export const rules = { "control-height": controlHeight }
+
+/** The rule reaches consumers at error. */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))

package/docs/control-height.md

@@ -0,0 +1,12 @@
+# Control height (CONTROL-HEIGHT-1)
+
+Owner ruling `control-height-40` (2026-10-26). One control height, 40px (HeroUI's own `h-10`), is the default of every standalone Grammar control: Button, IconButton, Input, SearchField, Select, Tabs, SegmentedControl, Switch, the chrome Avatar, Textarea and the composer send button. Grammar draws it; an app never states it.
+
+| Rule | Finding code | Required behavior |
+| --- | --- | --- |
+| `starci-fe/control-height` | `FE_CONTROL_HEIGHT` | Omit `size` on a control (or pass `md`/`control`, the same 40px). `size="lg"` (48px) is only for a landing hero call to action; `xl` is never used. Controls that share one JSX row share one size, so a row never mixes `sm` with the default. `sm` (32px) is for a control nested in an item or a dense toolbar where every control of the row is `sm`. |
+
+```tsx
+<IconButton intent="dismiss" label="Notifications" source={bell} />
+<Switch label="Dark mode" size="control" />
+```

package/index.mjs

@@ -13,6 +13,7 @@ import { join } from "node:path"
 import { pathToFileURL } from "node:url"
 import { recommended as brandValuesRecommended, rules as brandValuesRules } from "./brand-values.mjs"
 import { recommended as buttonIntentRecommended, rules as buttonIntentRules } from "./button-intent.mjs"
+import { recommended as controlHeightRecommended, rules as controlHeightRules } from "./control-height.mjs"
 import { recommended as clientBoundaryRecommended, rules as clientBoundaryRules } from "./client-boundary.mjs"
 import { recommended as commentsRecommended, rules as commentsRules } from "./comments.mjs"
 import { recommended as classNamesRecommended, rules as classNamesRules } from "./class-names.mjs"
@@ -44,12 +45,15 @@ import { recommended as projectGraphRecommended, rules as projectGraphRules } fr
 import { recommended as sonarParityRecommended, rules as sonarParityRules } from "./sonar-parity.mjs"
 import { buildFeConfig, buildPlainSourceConfig } from "./lib/config.mjs"
 import { why } from "./lib/why.mjs"
+import { recommended as uiRulingsRecommended, rules as uiRulingsRules } from "./ui-rulings.mjs"
 
 /** Each law's contribution, kept separate so a duplicate name is detectable rather than silent. */
 const CONTRIBUTIONS = [
+  { law: "ui-rulings", rules: uiRulingsRules, recommended: uiRulingsRecommended },
     { law: "project-graph", rules: projectGraphRules, recommended: projectGraphRecommended },
   { law: "brand-values", rules: brandValuesRules, recommended: brandValuesRecommended },
   { law: "button-intent", rules: buttonIntentRules, recommended: buttonIntentRecommended },
+  { law: "control-height", rules: controlHeightRules, recommended: controlHeightRecommended },
   { law: "client-boundary", rules: clientBoundaryRules, recommended: clientBoundaryRecommended },
   { law: "comments", rules: commentsRules, recommended: commentsRecommended },
   {

package/lib/config.mjs

@@ -98,7 +98,7 @@ export const SLOT_FREE_RULES = Object.freeze([
   "no-native-anchor", "no-inline-parameter-type", "no-hand-rolled-polling", "no-copy-in-call", "no-alert", "no-failure-collapse",
   "outcome-kinds-exhaustive", "no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import",
   "prefer-export-from", "no-unused-prop-types", "media-has-caption", "max-params",
-  "nested-control-variant", "no-list-panel-padding", "no-app-surface-paint",
+  "nested-control-variant", "no-list-panel-padding", "no-app-surface-paint", "divider-full-bleed", "control-height", "selection-fill-no-check",
   "button-intent-required", "button-no-variant", "destructive-confirm-in-dialog", "single-commit-per-render", "no-commit-in-collection-item",
 ])
 

package/lib/why.mjs

@@ -19,11 +19,31 @@
 
 /** @type {Record<string, Why>} */
 export const why = {
+  "selection-fill-no-check": {
+    code: "FE_NESTED_VARIANT",
+    en: "`<file>` adds a check indicator to a navigation-like single-select list.",
+    fix: 'Set selectionIndicator="none" and let the row fill carry selection.',
+  },
+  "no-grammar-internal-selector": {
+    code: "FE_GRAMMAR_LAYOUT_ONLY",
+    en: "`<file>` targets a Grammar internal class from application styles.",
+    fix: "Use the Grammar public props and slots; keep internal selectors inside Grammar.",
+  },
+  "divider-full-bleed": {
+    code: "FE_DIVIDER_FULL_BLEED",
+    en: "`<file>` insets a horizontal Grammar divider with wrapper padding.",
+    fix: "Move horizontal padding to the sibling content bands so the divider reaches both surface edges.",
+  },
   "button-intent-required": {
     code: "FE_BUTTON_INTENT_REQUIRED",
     en: "`<file>` renders a Button or IconButton without the command's intent.",
     fix: "Declare intent from the command's consequence and rank so Grammar supplies its variant.",
   },
+  "control-height": {
+    code: "FE_CONTROL_HEIGHT",
+    en: "`<file>` picks a larger control size or mixes control sizes in one row.",
+    fix: "Omit size so Grammar draws the one 40px control height; use sm only for every control of an item or dense toolbar row, and lg only for a landing hero call to action.",
+  },
   "button-no-variant": {
     code: "FE_BUTTON_NO_VARIANT",
     en: "`<file>` chooses a Button or IconButton variant directly.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.1.7",
+  "version": "9.1.9",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/config.example.yaml

@@ -38,8 +38,9 @@ parallel: {gear: 1}
 # kernel (docs/supervisor.md) also takes, optional, defaults in home.mjs DEFAULTS:
 #   kernel: {agent, model, effort}   its agent pin (default: the kernel pin below)
 #   workers: {base, max}             the adaptive [Worker] cap, 0 to 10 (0 = the Supervisor runs no fix worker)
-#   landGate: {mode: shared}         shared lets running lanes commit directly; exclusive = gate only. A land
-#                                    fast-forwards LOCAL main only: the remote main moves with a release (starci release cut)
+#   landGate: {mode: shared, push: true}  shared lets running lanes commit directly; exclusive = gate only. A land
+#                                    fast-forwards LOCAL main; main reaches the remote right after a green scoped check through
+#                                    `starci release push` (push: true, the default; false locks the remote). CI is the critic.
 supervisor:
   # mode: chat (default) - the owner's desktop chat session is the Supervisor: it owns channel 'main'
   #   and reads Decision Items; nothing starts a [Supervisor] kernel. kernel - the optional [Supervisor]
@@ -49,7 +50,7 @@ supervisor:
   pollIntervalMs: null
   repos: []
   # frozenMinutes: <n>   # Host seat check: a busy frame unchanged this long is frozen, not busy
-  # landGate: {mode: shared|exclusive}
+  # landGate: {mode: shared|exclusive, push: true|false}
 # delegation — while the owner is away, a named delegate (e.g. the supervisor chat) may
 # answer owner asks until the given time; excluded classes stay owner-only. null = none.
 #   delegation: {asks: supervisor, until: 2026-09-23T09:00:00+07:00,
@@ -185,11 +186,9 @@ sonar: {organization: null}
 #   minFreeRamPct  free-RAM percentage below which no new heavy op starts
 # set them only in the gitignored config.yaml copy, e.g.
 #   resources: {minFreeDiskGb: 5, minFreeDiskPct: 1, minFreeRamPct: 10}
-# release - where the Linux parity of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
-#   suite: local   the shipped default: `starci release cut` runs the root rows (npm run test:packages, npm run test:e2e, npm run check) and the Linux parity container before it pushes,
-#                  and the pre-push gate asks for the green root rows
-#   suite: ci      the owner's recorded choice (2026-10-09): no local Linux container; the GitHub ci workflow runs the Linux parity (and SonarCloud) AFTER the push.
-#                  The cut still runs the same root rows and the example apps; the record lists linux-parity as delegated, never green.
-#                  A release can reach GitHub and its tag before the Linux parity has run; a red CI is fixed forward with the next pre-release (starci release ci-status).
-# "none" is refused: the Linux parity does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
+# release - where the full suite of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
+#   suite: local   the shipped default: `starci release cut` also runs the L4 rows on this host (root rows, example apps, Sonar proofs, Linux parity container) before it tags; it never gates a push
+#   suite: ci      the owner's recorded choice (2026-10-09, widened 2026-10-26 by push-main-after-scoped-check): EVERY row is judged by the GitHub workflows (ci, examples, sonar) on each push to main;
+#                  the cut runs none and lists each row as delegated, never green. A red CI opens the next alpha.N.M and never blocks the next push (starci release ci-status).
+# "none" is refused: the suite does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
 release: {suite: local}

package/runtime/engine/config.mjs

@@ -294,13 +294,13 @@ const validateSupervisorBlock=(supervisor,profile)=>{
     throw new Error('Invalid config.yaml: supervisor.mode must be chat or kernel, or null.');
   // The [Supervisor] kernel seat (scripts/machine/home.mjs supervisorSettings): kernel {agent?, model?, effort?}
   // pins its agent (default: the kernel pin), workers {base?, max?} its adaptive [Worker] cap (0 to 10; the shipped default is 0 fix workers),
-  // landGate {mode?: shared|exclusive} the land gate (scripts/supervisor/land.mjs).
+  // landGate {mode?: shared|exclusive, push?: boolean} the land gate (scripts/supervisor/land.mjs); push (default true, owner ruling push-main-after-scoped-check) lets `starci release push` send main to the remote after a green scoped check, false is the owner's lock on the remote.
   const seat=supervisor.kernel,workers=supervisor.workers,gate=supervisor.landGate;
   if(seat!==undefined&&seat!==null)validateAgentSeat(seat,'supervisor.kernel',profile);
   if(!(workers===undefined||workers===null||(plain(workers)&&Object.keys(workers).every(key=>['base','max'].includes(key)&&Number.isInteger(workers[key])&&workers[key]>=0&&workers[key]<=10))))
     throw new Error('Invalid config.yaml: supervisor.workers must be {base?, max?} integers from 0 to 10, or null.');
-  if(!(gate===undefined||gate===null||(plain(gate)&&Object.keys(gate).every(key=>key==='mode'&&['shared','exclusive'].includes(gate.mode)))))
-    throw new Error('Invalid config.yaml: supervisor.landGate must be {mode?: shared|exclusive}, or null.');
+  if(!(gate===undefined||gate===null||(plain(gate)&&Object.keys(gate).every(key=>(key==='mode'&&['shared','exclusive'].includes(gate.mode))||(key==='push'&&typeof gate.push==='boolean')))))
+    throw new Error('Invalid config.yaml: supervisor.landGate must be {mode?: shared|exclusive, push?: boolean}, or null.');
   // stallMinutes: scripts/supervisor/stall.mjs calls a running workflow STALLED after this many minutes with no progress.
   // frozenMinutes: scripts/supervisor/supervisor-watchdog.mjs reads a busy seat frame with no turn progress for this long as frozen.
   const frozen=supervisor.frozenMinutes;

package/runtime/engine/release-config.mjs

@@ -3,14 +3,14 @@ import {invalid} from './invalid-config.mjs';
 
 /** The keys of the release block. */
 export const RELEASE_KEYS=Object.freeze(['suite']);
-/** Where the full test suite of a release is judged: `local` (the release cut runs it, the shipped default) or `ci` (the GitHub workflow runs it after the push; the cut runs only the affected specs of the release and the rows CI cannot run). */
+/** Where the full test suite of a release is judged: `local` (the release cut also runs the L4 rows before it tags, the shipped default) or `ci` (the GitHub workflows judge EVERY row on each push to main; the cut runs none). */
 export const SUITE_MODES=Object.freeze(['local','ci']);
-export const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
+const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
 
 /**
- * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped
- * default: `starci release cut` runs the root suite and the Linux parity container before it pushes. `ci` is the owner's recorded choice (2026-10-09) that
- * the full suite runs on GitHub only: the cut runs no root suite and no Linux container, and the CI workflow's verdict is read afterwards (`starci release ci-status`).
+ * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped default: `starci release cut` also runs the
+ * L4 rows on this host before it tags. `ci` is the owner's recorded choice (2026-10-09, widened 2026-10-26 by push-main-after-scoped-check): the full suite runs on GitHub only, on every push
+ * to main; the cut runs no row and the verdict is read with `starci release ci-status`. The push of main needs neither mode: it needs a green scoped check.
  * `none` is refused: the suite does not vanish, it moves to CI, and the value says so.
  */
 export function validateRelease(release){

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -22,36 +22,43 @@ pins:
     side: fe
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
+  '@starci/event-stream':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: fe
+    source: packages/event-stream/package.json
+    why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.12.10
+    version: 0.12.13
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.52
+    version: 3.4.55
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.7
+    version: 9.1.9
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.11
+    version: 0.12.13
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.11
+    version: 0.12.13
     group: starci
     install: registry
     side: fe
@@ -91,14 +98,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.45
+    version: 1.7.46
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.45
+    version: 4.7.46
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -82,7 +82,18 @@ concerns:
     home: [fe.hooks.socketio]
     pattern: FE-REALTIME
     forbids: [subscriptions-transport-ws, '@supabase/realtime-js', pusher-js, ably]
-    why: one socket.io-client singleton per namespace and one side-effect component that dispatches to redux and SWR; both editions run the gateway in the be api process. A one-way channel served as server-sent events needs no package, only a stream reader in modules/api/sse/clients, a stream operation in modules/api/sse and a useSubscribe<Channel>Swr hook (FE-REALTIME).
+    why: one socket.io-client singleton per namespace and one side-effect component that dispatches to redux and SWR; both editions run the gateway in the be api process. A one-way channel served as server-sent events is the event-stream concern below (FE-REALTIME).
+  - id: event-stream
+    tier: opt
+    packages: ['@starci/event-stream']
+    home: [fe.transport.stream]
+    pattern: FE-REALTIME
+    forbids: ['@microsoft/fetch-event-source', eventsource, event-source-polyfill, eventsource-parser, reconnecting-eventsource, 'sse.js', 'fetch-sse', 'sse-ts']
+    why: >-
+      the one server-sent-events client (owner:event-stream-package): the app creates one instance in modules/api/sse/clients/event-stream.ts
+      with createEventStream (the bearer token source, one renewal on a 401, backoff, heartbeat timeout), each stream operation
+      (sse/<area>/stream-<channel>.ts) follows on it, and the useSubscribe<Channel>Swr hook reads that operation. No app keeps a
+      hand-written reader (read-event-stream.ts) and no second SSE library is installed.
   - id: auth
     tier: core
     packages: []

package/runtime/knowledge/hfs/slots.yaml

@@ -305,7 +305,7 @@ ruleParams:
       - {typeSuffix: Options, names: [options], nameSuffix: Options}
     # R89 BE_SOURCE_FORM: the closed role-suffix vocabulary of a source file name (<kebab-name>.<suffix>.ts; BE-CONVENTION 1.15)
     # and the suffixes that are never a role. index.ts, main.ts, app.module.ts and the migrations of be.persistence are the
-    # only names outside it.
+    # only names outside it. Typed realtime topic builders use the existing policy role (BE-REALTIME-3 of knowledge/patterns/be/realtime.yaml).
     suffixes: [module, module-definition, decorators, options, config, connection, service, schema, command, query, handler, templates, compensation, saga-state, saga-step, saga, contracts, port, resolver, controller, gateway, webhook, subscription, consumer, cli, event, queue, projection, projection-entity, processor, step, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, adapter, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
     # R47 BE_CONTRACT_UNGUARDED: the world's shape vocabulary. `helper` names the function a contract spec imports to erase the values of a JSON
     # payload (`shapeOf`); a contract spec proves a fake's fixtures by asserting helper(real) equals helper(fixture).
@@ -1617,7 +1617,7 @@ slots:
     requires: [index.ts]
     # <name>.templates.ts holds the capability's static templates, copy and presets as TS constants (owner ruling 2026-10-13);
     # user-editable ones are seed rows, large or user media live in object storage.
-    allows: ["<capability>.module.ts", "<capability>.module-definition.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts", "*.schema.ts", "*.schema.spec.ts"]
+    allows: ["<capability>.module.ts", "<capability>.module-definition.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts", "*.schema.ts", "*.schema.spec.ts", "*.policy.ts", "*.policy.spec.ts"]
     forbids: [testing/, exceptions/, utils/, helpers/, shared/]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
     coverage: required
@@ -2336,8 +2336,8 @@ slots:
     # The browser's calls to the back end (owner ruling 2026-10-13, fe-stack graphql/rest/codegen, FE-API-GRAPHQL): the auth and
     # no-auth Apollo clients with their link chain (graphql/clients), one file per operation (graphql/queries/query-<x>.ts,
     # graphql/mutations/mutation-<x>.ts and graphql/subscriptions/subscription-<x>.ts, each with its gql document map and typed request/response in types/), the generated wire types
-    # (graphql/__generated__), the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints and the fetch readers of
-    # server-sent-events streams (sse/<area>/stream-<channel>.ts, one operation per stream, run on the stream reader of sse/clients). A repository has
+    # (graphql/__generated__), the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints and the
+    # server-sent-events streams (sse/<area>/stream-<channel>.ts, one operation per stream, run on the app's @starci/event-stream instance in sse/clients). A repository has
     # exactly ONE client folder and ONE GraphQLResponse union: the app's (fe.transport.client/outcome) when one app calls the back end,
     # or the api package's (fe.package.api.client/outcome) when several do (FE_TRANSPORT_OWNER, machine).
     requires: [index.ts]
@@ -2381,7 +2381,7 @@ slots:
     tier: transport
     allows: ["*.ts"]
     tests: none
-    why: "the fetch reader of server-sent-events streams of the one app that calls the back end, the stream half of the transport client layer (FE-REALTIME): it opens the stream with the bearer access token, parses the events and reopens it with Last-Event-ID after a capped, doubling wait; a stream operation (sse/<area>/stream-<channel>.ts) runs on it and a useSubscribe hook of hooks/swr reads that operation; a fetch here asks for text/event-stream and only a stream operation imports the reader (FE_TRANSPORT_OWNER); a repository where several apps stream keeps one reader in each of them"
+    why: "the event-stream client of the one app that calls the back end, the stream half of the transport client layer (FE-REALTIME): event-stream.ts creates the app's one @starci/event-stream instance (createEventStream with the bearer access token source, which opens the stream with fetch, parses the events and reopens it with Last-Event-ID after a capped, doubling wait); a stream operation (sse/<area>/stream-<channel>.ts) follows on it and a useSubscribe hook of hooks/swr reads that operation; no hand-written reader lives here (owner:event-stream-package) and only a stream operation imports this folder (FE_TRANSPORT_OWNER); a repository where several apps stream keeps one instance in each of them"
     rules: [FE_TRANSPORT_OWNER]
     exemplifiedBy:
       - {path: packages/eslint/fe/r50-transport-owner-coverage.spec.mjs, editions: [lite, full]}

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -131,12 +131,6 @@ removed:
     use: '`starci debug digest` (read-only) and `starci debug run <probe>`'
     since: 1.0.0-alpha.6
     match: '(?<![\w-])debug pass\b'
-  - id: config-supervisor-landgate-push
-    kind: config-key
-    name: supervisor.landGate.push
-    use: 'a land fast-forwards local main only and never pushes; the remote main of the runtime moves once per release, through starci release cut'
-    since: 1.0.0-alpha.7
-    match: 'landGate\.push\b'
   - id: flag-land-no-push
     kind: flag
     name: --no-push
@@ -355,7 +349,7 @@ removed:
   - id: verb-test-run
     kind: verb
     name: starci test run
-    use: 'the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, `starci release cut` runs the release rows'
+    use: 'the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, CI runs the release rows'
     since: 1.0.0-alpha.19
     match: '\bstarci test run\b'
   - id: verb-gate-runtime-coverage
@@ -430,3 +424,35 @@ removed:
     use: 'DropdownMenuItem.tone uses neutral or danger; destructive commands use danger'
     since: 1.0.0-alpha.31
     match: 'DropdownMenuItem(?:Tone|\.tone)[^\r\n]*["'']negative["'']'
+
+  - id: code-release-receipt-missing
+    kind: code
+    name: RELEASE_RECEIPT_MISSING
+    use: 'the push of main asks for a fast-forward and a clean secret scan; a release tag asks for no receipt'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-receipt-incomplete
+    kind: code
+    name: RELEASE_RECEIPT_INCOMPLETE
+    use: 'the push of main asks for a fast-forward and a clean secret scan; CI judges the full suite'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-suite-mode
+    kind: code
+    name: RELEASE_SUITE_MODE
+    use: 'release.suite chooses whether the cut also runs the L4 rows; no record or gate reads the mode'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-version-unchanged
+    kind: code
+    name: RELEASE_VERSION_UNCHANGED
+    use: 'main is pushed without a version move; RELEASE_VERSION_NOT_NEXT judges the version of a tag against the v* tags'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-remote-head-unknown
+    kind: code
+    name: RELEASE_REMOTE_HEAD_UNKNOWN
+    use: 'a release tag is judged against the v* tags, not against the remote main head'
+    since: 1.0.0-alpha.31.1
+  - id: config-release-candidate-blocking
+    kind: config-key
+    name: candidate.blocking
+    use: 'the runtime cut has no candidate step; the ci, examples and sonar workflows judge each push to main (suite.ci.workflows)'
+    since: 1.0.0-alpha.31.1
+    match: 'candidate\.blocking\b'

package/runtime/scripts/hfs/architecture/index.mjs

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { canonical, loadArchitectureConfig } from './config.mjs';
 import { sameOrUnder } from '../../lib/path-key.mjs';
 import { buildTypeScriptContext, relativePath } from './typescript.mjs';
+import { withTypeScriptProgramRun } from '../typescript-programs.mjs';
 import { checkBackend } from './backend.mjs';
 import { checkBackendContracts, PUBLIC_CONTRACT_RULE_ID, READONLY_BOUNDARY_RULE_ID } from './contracts.mjs';
 import { checkFrontend } from './frontend.mjs';
@@ -324,7 +325,7 @@ function scopeFindings({ config, context, violations, paths, surface }) {
  * that read the whole repository to answer (clones, dead exports, repository-wide symbols); the pre-push check of the changed owners uses it.
  */
 export function checkArchitecture(options = {}) {
-  return withTreeCache(() => checkArchitectureOnce(options));
+  return withTypeScriptProgramRun(() => withTreeCache(() => checkArchitectureOnce(options)));
 }
 
 function checkArchitectureOnce({ repositoryRoot, injectedTypeScript, paths = [], base, fast = false, hfs: openedHfs, surface = 'all' }) {

package/runtime/scripts/hfs/architecture/type-context.mjs

@@ -103,36 +103,35 @@ function createProjects(config, paths, state, selection, ts, helpers) {
   return projects;
 }
 
+function ownershipRank(config, project, file, helpers) {
+  return helpers.isInside(path.dirname(path.join(config.root, ...project.relative.split('/'))), file)
+    ? project.relative.split('/').length : -1;
+}
+
 function collectProjectFiles(config, projects, helpers) {
-  const occurrences = new Map();
-  const sourceIn = new Map();
+  const fileMap = new Map();
+  const ownerByFile = new Map();
+  // Retain only the winning source occurrence while visiting each project. Equal ranks keep the first project,
+  // as does a file outside every project directory; the deepest enclosing tsconfig otherwise owns its checker.
+  // Within that project the last realpath alias supplies the source, matching the compiler's occurrence order.
   for (const project of projects) {
-    for (const sourceFile of project.program.getSourceFiles().filter(file => helpers.isProductionSource(config.root, file))) {
+    for (const sourceFile of project.program.getSourceFiles()) {
+      if (!helpers.isProductionSource(config.root, sourceFile)) continue;
       const name = helpers.canonical(sourceFile.fileName);
-      if (!occurrences.has(name)) occurrences.set(name, []);
-      occurrences.get(name).push(project);
-      sourceIn.set(`${project.relative}|${name}`, sourceFile);
+      const owner = ownerByFile.get(name);
+      if (owner === project) { fileMap.set(name, sourceFile); continue; }
+      if (owner && ownershipRank(config, owner, name, helpers) >= ownershipRank(config, project, name, helpers)) continue;
+      ownerByFile.set(name, project);
+      fileMap.set(name, sourceFile);
     }
   }
-  return { occurrences, sourceIn };
-}
-
-function owningProject(config, candidates, file, helpers) {
-  return candidates.filter(item => helpers.isInside(path.dirname(path.join(config.root, ...item.relative.split('/'))), file))
-    .sort((x, y) => y.relative.split('/').length - x.relative.split('/').length)[0] ?? candidates[0];
+  return { fileMap, ownerByFile };
 }
 
 function makeFileGraph(config, projects, helpers) {
-  const { occurrences, sourceIn } = collectProjectFiles(config, projects, helpers);
-  const fileMap = new Map();
+  const { fileMap, ownerByFile } = collectProjectFiles(config, projects, helpers);
   const checkerByFile = new Map();
-  const ownerByFile = new Map();
-  for (const [name, candidates] of occurrences) {
-    const owner = owningProject(config, candidates, name, helpers);
-    ownerByFile.set(name, owner);
-    fileMap.set(name, sourceIn.get(`${owner.relative}|${name}`));
-    checkerByFile.set(name, owner.program.getTypeChecker());
-  }
+  for (const [name, owner] of ownerByFile) checkerByFile.set(name, owner.program.getTypeChecker());
   const files = [...fileMap.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, file]) => file);
   const edges = new Map([...fileMap.keys()].map(file => [file, []]));
   for (const [file, sourceFile] of fileMap) {
@@ -142,6 +141,21 @@ function makeFileGraph(config, projects, helpers) {
   return { fileMap, checkerByFile, ownerByFile, files, edges };
 }
 
+// Resolution entries contain failed lookup paths as well as hits. Keep only one bounded batch for the current project;
+// graph edges retain the resolved targets, so rotating this scratch cache changes neither coverage nor findings.
+const RESOLUTION_BATCH_SIZE = 1024;
+
+function resolutionCache(state, project) {
+  if (state.resolutionProject !== project || state.resolutionCount === RESOLUTION_BATCH_SIZE) {
+    state.resolutionProject = project;
+    state.resolutionCount = 0;
+    state.resolutionCache = state.ts.createModuleResolutionCache(state.config.root,
+      file => state.ts.sys.useCaseSensitiveFileNames ? file : file.toLowerCase(), project.options);
+  }
+  state.resolutionCount += 1;
+  return state.resolutionCache;
+}
+
 function addUnprovenFindings(sourceFile, project, references, errors, config, helpers) {
   for (const item of references.unproven) errors.push({
     ruleId: 'ARCH_DYNAMIC_DEPENDENCY_UNPROVEN',
@@ -229,7 +243,7 @@ function processReference(from, sourceFile, project, owningWorkspace, reference,
   const { config, ts, workspaceNames, workspaces, host, errors, helpers } = state;
   // A workspace package is read at its source, never at its build: the same import resolves whether or not dist exists.
   const workspaceTarget = workspaces.filter(item => item.root !== helpers.canonical(config.root)).map(item => helpers.workspaceSourceEntry(ts, item, reference.specifier)).find(Boolean);
-  const resolvedName = workspaceTarget ?? helpers.resolveTypeScriptModule(ts, reference.specifier, sourceFile.fileName, project.options, host);
+  const resolvedName = workspaceTarget ?? helpers.resolveTypeScriptModule(ts, reference.specifier, sourceFile.fileName, project.options, host, resolutionCache(state, project));
   if (!resolvedName) {
     unresolvedReferenceFinding(reference, sourceFile, project, config, workspaceNames, errors, helpers);
     return;
@@ -279,7 +293,8 @@ export function contextFromProjects(config, loaded, paths, helpers) {
   const fileGraph = makeFileGraph(config, projects, helpers);
   const { edges, workspaces } = dependencyGraph(config, loaded, fileGraph, fileGraph.ownerByFile, errors, helpers);
   if (projects.length && fileGraph.files.length === 0) errors.push({ ruleId: 'ARCH_NO_SOURCE', message: 'The configured TypeScript projects contain no production TypeScript or JavaScript source.' });
+  const { checkerByFile } = fileGraph;
   return { loaded, errors, files: fileGraph.files, edges, programs: projects.map(item => item.program), program: projects[0]?.program ?? null, projects, ts, workspaces,
-    checkerFor: file => fileGraph.checkerByFile.get(helpers.canonical(file)) ?? null,
+    checkerFor: file => checkerByFile.get(helpers.canonical(file)) ?? null,
     workspaceOf: file => helpers.workspaceOf(workspaces, helpers.canonical(file)) };
 }

package/runtime/scripts/hfs/typescript-programs.mjs

@@ -9,6 +9,11 @@ import { byCodeUnit } from '../lib/list.mjs';
 // builds afresh.
 const runs = new AsyncLocalStorage();
 
+/** Share compiler inputs only until this check finishes; nested callers join the same run. */
+export function withTypeScriptProgramRun(run) {
+  return runs.getStore() ? run() : runs.run(new Map(), run);
+}
+
 
 function keyOf(value) {
   if (value === undefined) return 'u';
@@ -48,7 +53,28 @@ export function sharedInProgramRun(kind, ts, input, build) {
 /** ts.createProgram, shared inside a program run. */
 export function createTypeScriptProgram(ts, { rootNames, options, projectReferences }) {
   return sharedInProgramRun('program', ts, { rootNames, options, projectReferences },
-    () => ts.createProgram({ rootNames, options, projectReferences }));
+    () => ts.createProgram({ rootNames, options, projectReferences, host: sharedSourceHost(ts, options) }));
+}
+
+function sharedSourceHost(ts, options) {
+  if (!runs.getStore()) return undefined;
+  const registry = sharedInProgramRun('documents', ts, null,
+    () => ts.createDocumentRegistry(ts.sys.useCaseSensitiveFileNames, ts.sys.getCurrentDirectory()));
+  const host = ts.createCompilerHost(options);
+  const readSource = host.getSourceFile;
+  // TypeScript's registry separates parse-affecting settings and Node module formats. Sharing syntax trees leaves
+  // module resolution and symbol/type caches with each program, including projects with different path aliases.
+  host.getSourceFile = (file, sourceOptions, onError, fresh) => {
+    if (fresh) return readSource(file, sourceOptions, onError, fresh);
+    let text;
+    try { text = host.readFile(file); } catch (error) {
+      onError?.(String(error.message ?? error));
+      text = '';
+    }
+    if (text === undefined) return undefined;
+    return registry.acquireDocument(file, options, ts.ScriptSnapshot.fromString(text), '0', undefined, sourceOptions);
+  };
+  return host;
 }
 
 /** Read and expand a tsconfig with the caller's TypeScript compiler and optional tracked file reader. */
@@ -66,6 +92,7 @@ export function typeScriptProjectReferencePath(ts, reference) {
 }
 
 /** Resolve an import using the selected project's compiler options. */
-export function resolveTypeScriptModule(ts, specifier, from, options, host = ts.sys) {
-  return ts.resolveModuleName(specifier, from, options, host).resolvedModule?.resolvedFileName;
+export function resolveTypeScriptModule(ts, specifier, from, options, host, cache) {
+  const resolverHost = host === undefined ? ts.sys : host;
+  return ts.resolveModuleName(specifier, from, options, resolverHost, cache).resolvedModule?.resolvedFileName;
 }

package/surface-rules.mjs

@@ -1,6 +1,6 @@
 /** Grammar owns surface nesting and the single content edge of a panel list (ANATOMY-2, PADDING-0). */
-import { attributeValue, stringOf } from "./lib/ast.mjs"
-import { importOf, isFn, patternPath, unwrap, variableOf } from "./lib/bindings.mjs"
+import { attributeValue, stringOf, walk } from "./lib/ast.mjs"
+import { functionOf, importOf, isFn, patternPath, unwrap, variableOf } from "./lib/bindings.mjs"
 import { typedClassStrings, typedPropertyStrings } from "./lib/typed-class-values.mjs"
 import { reactHookOf } from "./lib/react.mjs"
 
@@ -356,8 +356,88 @@ export const noListPanelPadding = {
   },
 }
 
+/** BOUNDARY-1 case-5: only content bands carry inset; horizontal separators reach the surface edges. */
+export const dividerFullBleed = {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "BOUNDARY-1 case-5: horizontal Grammar dividers are full-bleed.",
+    },
+    schema: [],
+    messages: {
+      padding:
+        "FE_DIVIDER_FULL_BLEED: horizontal padding on this wrapper insets a Grammar Divider/Separator. Move padding to the sibling content bands so the divider reaches both surface edges.",
+    },
+  },
+  create(context) {
+    // Follow rendered same-file components, helper calls and JSX constants, with cycle protection.
+    const containsDivider = (root, seen = new Set()) => {
+      if (!root || seen.has(root)) return false
+      seen.add(root)
+      let found = false
+      const follow = (node) => {
+        found = containsDivider(node, seen) || found
+      }
+      walk(context.sourceCode, root, (node) => {
+        if (found) return false
+        if (isFn(node)) return false
+        if (node.type === "JSXOpeningElement") {
+          const name = grammarName(context, node.name)
+          if (
+            name?.length === 1 &&
+            ["Divider", "Separator"].includes(name[0])
+          ) {
+            const orientations = node.attributes.flatMap((entry) =>
+              propStrings(context, entry, "orientation", "variant"),
+            )
+            if (
+              !orientations.length ||
+              orientations.some((entry) => entry.text !== "vertical")
+            )
+              found = true
+          } else if (node.name.type === "JSXIdentifier") {
+            for (const definition of variableOf(context, node.name)?.defs ??
+              []) {
+              if (definition.type === "FunctionName")
+                follow(definition.node.body)
+              if (definition.type === "Variable")
+                follow(functionOf(context, definition.node.init)?.body)
+            }
+          }
+        }
+        if (node.type === "CallExpression") {
+          follow(functionOf(context, node.callee)?.body)
+          for (const argument of node.arguments)
+            if (isFn(argument)) follow(argument.body)
+        }
+        if (
+          node.type === "Identifier" &&
+          node.parent?.type === "JSXExpressionContainer"
+        ) {
+          for (const value of bindingValues(context, node)) follow(value)
+        }
+        return undefined
+      })
+      return found
+    }
+    return {
+      JSXOpeningElement(node) {
+        const padding = node.attributes.find((entry) =>
+          propStrings(context, entry, "className").some((value) =>
+            classTokens(value.text).some(horizontalPadding),
+          ),
+        )
+        if (!padding) return
+        if (node.parent.children.some((child) => containsDivider(child)))
+          context.report({ node: padding, messageId: "padding" })
+      },
+    }
+  },
+}
+
 /** The surface laws ship at error in every composing source tree. */
-export const rules = { "nested-control-variant": nestedControlVariant, "no-list-panel-padding": noListPanelPadding, "no-app-surface-paint": noAppSurfacePaint }
+export const rules = { "divider-full-bleed": dividerFullBleed, "nested-control-variant": nestedControlVariant, "no-list-panel-padding": noListPanelPadding, "no-app-surface-paint": noAppSurfacePaint }
 
 /** No app can lower or omit a surface law. */
 export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))

package/ui-rulings.mjs

@@ -0,0 +1,134 @@
+/** Owner UI rulings: selection uses fill, and applications respect Grammar styling ownership. */
+import { attribute, attributeValue, staticText } from "./lib/ast.mjs";
+import { importOf } from "./lib/bindings.mjs";
+import { isProductSource } from "./lib/scope.mjs";
+import { typedClassStrings } from "./lib/typed-class-values.mjs";
+
+/** Resolve a named or namespace import at its use, preserving lexical shadowing. */
+const grammarComponent = (context, opening, expected) => {
+  const name = opening.name;
+  const root = name.type === "JSXMemberExpression" ? name.object : name;
+  if (root.type !== "JSXIdentifier") return false;
+  const binding = importOf(context, root);
+  if (
+    !binding ||
+    !/^@starci\/grammar(?:\/(?:common|core|heritage|offset-pop))?$/.test(
+      binding.source,
+    )
+  )
+    return false;
+  return name.type === "JSXMemberExpression"
+    ? binding.imported === null && name.property.name === expected
+    : binding.imported === expected;
+};
+
+/** Only a final explicit attribute is proof when an opaque spread could override a value. */
+const propText = (opening, key) => {
+  let value = null;
+  for (const entry of opening.attributes) {
+    if (entry.type === "JSXSpreadAttribute") value = null;
+    else if (entry.name.name === key) value = staticText(entry.value);
+  }
+  return value;
+};
+
+/** Navigation and rail/list placement are structurally identifiable without guessing from product names. */
+const navigationList = (context, opening) => {
+  for (let node = opening.parent; node; node = node.parent) {
+    if (node.type !== "JSXElement") continue;
+    const parent = node.openingElement;
+    if (
+      ["nav", "ul", "ol"].includes(parent.name.name) ||
+      ["navigation", "list"].includes(propText(parent, "role"))
+    )
+      return true;
+    if (
+      ["Rail", "Sidebar"].some((role) =>
+        grammarComponent(context, parent, role),
+      )
+    )
+      return true;
+  }
+  return false;
+};
+
+/** Navigation-like single selection uses the row fill instead of a second check indicator. */
+export const selectionFillNoCheck = {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "Navigation-like single-select ListBox rows use selectionIndicator=none.",
+    },
+    schema: [],
+    messages: {
+      indicator:
+        'Use selectionIndicator="none" on this navigation-like single-select ListBox; the row fill carries selection.',
+    },
+  },
+  create(context) {
+    return {
+      JSXOpeningElement(node) {
+        if (
+          !grammarComponent(context, node, "ListBox") ||
+          !navigationList(context, node)
+        )
+          return;
+        if (["none", "multiple"].includes(propText(node, "selectionMode")))
+          return;
+        if (propText(node, "selectionIndicator") !== "none")
+          context.report({ node, messageId: "indicator" });
+      },
+    };
+  },
+};
+
+/** Grammar internal selectors belong to Grammar, including selectors in colocated class declarations. */
+export const noGrammarInternalSelector = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Application styles cannot target starci-core internals.",
+    },
+    schema: [],
+    messages: {
+      internal:
+        "Remove this starci-core- selector. Compose the Grammar public API; message actions belong in the ChatBubble floating toolbar.",
+    },
+  },
+  create(context) {
+    if (!isProductSource(context)) return {};
+    const selector = /(?:\.|_|\[class[^\]]*)starci-core-/;
+    const report = (node, text) => {
+      if (text && selector.test(text))
+        context.report({ node, messageId: "internal" });
+    };
+    return {
+      Literal(node) {
+        if (typeof node.value === "string") report(node, node.value);
+      },
+      TemplateElement(node) {
+        report(node, node.value.cooked);
+      },
+      JSXAttribute(node) {
+        if (node.name.name !== "className") return;
+        const value = attributeValue(attribute(node.parent, "className"));
+        if (value?.type !== "Identifier" && value?.type !== "MemberExpression")
+          return;
+        const strings = typedClassStrings(context, value, "classes");
+        if (strings.some((entry) => selector.test(entry.text)))
+          context.report({ node, messageId: "internal" });
+      },
+    };
+  },
+};
+
+export const rules = {
+  "selection-fill-no-check": selectionFillNoCheck,
+  "no-grammar-internal-selector": noGrammarInternalSelector,
+};
+
+/** Both owner rulings are universal errors in the frontend canon. */
+export const recommended = Object.fromEntries(
+  Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]),
+);