@starci/eslint-canon-fe 9.1.8 → 9.1.10

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 9.1.10 - 2026-10-27
+
+- Changed: bundled canon pins move with hfs 4.7.47 and the Grammar 0.12.14 family.
+
+## 9.1.9 - 2026-10-26
+
+- Added: starci-fe/control-height (R320 FE_CONTROL_HEIGHT), selection-fill-no-check and no-grammar-internal-selector.
+- Changed: the bundled runtime copies carry the light push gate and the owner rulings of 2026-10-26.
+
 ## 9.1.8 - 2026-10-26
 
 - Added: the `divider-full-bleed` rule (a Grammar `Divider` between full-bleed regions is itself full bleed), the SegmentedControl `size="control"` carve-out and the `@starci/event-stream` registration in the fe-stack concern.

package/control-height.mjs

@@ -0,0 +1,77 @@
+/** CONTROL-HEIGHT-1: one control height; the app never picks a larger step or mixes steps in one row. */
+import { attributeValue, stringOf } from "./lib/ast.mjs"
+import { importOf } from "./lib/bindings.mjs"
+
+const GRAMMAR_ENTRY = /^@starci\/grammar(?:\/(?:common|core|heritage|offset-pop))?$/
+const CONTROLS = new Set(["Button", "IconButton", "Switch", "Input", "SearchField", "Select", "Tabs", "SegmentedControl", "Textarea", "NumberField", "ComboBox"])
+/** A marketing hero call to action on a landing page is the one place the 48px step is allowed. */
+const LANDING_PATH = /[\\/](?:landing|hero|marketing)[\\/]|(?:Landing|Hero)[^\\/]*[\\/]/
+/** The default size and its two spellings: the vendor `md` and Grammar's `control` are the same 40px height. */
+const DEFAULT_SIZE = new Set(["md", "control"])
+
+/** The Grammar control a JSX name resolves to; a shadowed or foreign component of the same name is not one. */
+const controlOf = (context, name) => {
+  let root = name
+  const parts = []
+  while (root.type === "JSXMemberExpression") {
+    parts.unshift(root.property.name)
+    root = root.object
+  }
+  if (root.type !== "JSXIdentifier") return null
+  const imported = importOf(context, root)
+  if (!imported || !GRAMMAR_ENTRY.test(imported.source)) return null
+  const role = imported.imported ?? parts.shift()
+  return role !== undefined && parts.length === 0 && CONTROLS.has(role) ? role : null
+}
+
+/** The statically authored size of a control: `control` when absent, null when it is dynamic. */
+const sizeOf = (opening) => {
+  const attribute = opening.attributes.find((entry) => entry.type === "JSXAttribute" && entry.name.name === "size")
+  if (!attribute) return "control"
+  const text = stringOf(attributeValue(attribute))
+  if (text === null) return null
+  return DEFAULT_SIZE.has(text) ? "control" : text
+}
+
+/** The Grammar controls a row holds directly, looking through fragments. */
+const rowControls = (context, element) => element.children.flatMap((child) => {
+  if (child.type === "JSXFragment") return rowControls(context, child)
+  if (child.type !== "JSXElement") return []
+  return controlOf(context, child.openingElement.name) === null ? [] : [child.openingElement]
+})
+
+const controlHeight = {
+  meta: { type: "problem", docs: { description: "CONTROL-HEIGHT-1: one 40px control height, no larger step outside a landing hero, no mixed sizes in one row." }, schema: [], messages: {
+    FE_CONTROL_HEIGHT: "FE_CONTROL_HEIGHT: {{detail}} Grammar draws every standalone control at one 40px height; omit size (sm is for a control nested in an item or a dense toolbar, lg only for a landing hero call to action).",
+  } },
+  create(context) {
+    const landing = LANDING_PATH.test(context.filename)
+    const reported = new Set()
+    const report = (node, detail) => {
+      if (reported.has(node)) return
+      reported.add(node)
+      context.report({ node, messageId: "FE_CONTROL_HEIGHT", data: { detail } })
+    }
+    return {
+      JSXOpeningElement(opening) {
+        const role = controlOf(context, opening.name)
+        if (role === null) return
+        const size = sizeOf(opening)
+        if (size === "xl" || (size === "lg" && !landing)) report(opening, `${role} size="${size}" is a larger control step than the app chrome allows.`)
+      },
+      "JSXElement, JSXFragment"(element) {
+        const controls = rowControls(context, element)
+        const sizes = controls.map(sizeOf)
+        if (sizes.includes(null) || new Set(sizes).size < 2) return
+        const index = sizes.findIndex((size) => size !== sizes[0])
+        report(controls[index], "this control sits in a row with controls of another size.")
+      },
+    }
+  },
+}
+
+/** The one rule of the law. */
+export const rules = { "control-height": controlHeight }
+
+/** The rule reaches consumers at error. */
+export const recommended = Object.fromEntries(Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]))

package/docs/control-height.md

@@ -0,0 +1,12 @@
+# Control height (CONTROL-HEIGHT-1)
+
+Owner ruling `control-height-40` (2026-10-26). One control height, 40px (HeroUI's own `h-10`), is the default of every standalone Grammar control: Button, IconButton, Input, SearchField, Select, Tabs, SegmentedControl, Switch, the chrome Avatar, Textarea and the composer send button. Grammar draws it; an app never states it.
+
+| Rule | Finding code | Required behavior |
+| --- | --- | --- |
+| `starci-fe/control-height` | `FE_CONTROL_HEIGHT` | Omit `size` on a control (or pass `md`/`control`, the same 40px). `size="lg"` (48px) is only for a landing hero call to action; `xl` is never used. Controls that share one JSX row share one size, so a row never mixes `sm` with the default. `sm` (32px) is for a control nested in an item or a dense toolbar where every control of the row is `sm`. |
+
+```tsx
+<IconButton intent="dismiss" label="Notifications" source={bell} />
+<Switch label="Dark mode" size="control" />
+```

package/index.mjs

@@ -13,6 +13,7 @@ import { join } from "node:path"
 import { pathToFileURL } from "node:url"
 import { recommended as brandValuesRecommended, rules as brandValuesRules } from "./brand-values.mjs"
 import { recommended as buttonIntentRecommended, rules as buttonIntentRules } from "./button-intent.mjs"
+import { recommended as controlHeightRecommended, rules as controlHeightRules } from "./control-height.mjs"
 import { recommended as clientBoundaryRecommended, rules as clientBoundaryRules } from "./client-boundary.mjs"
 import { recommended as commentsRecommended, rules as commentsRules } from "./comments.mjs"
 import { recommended as classNamesRecommended, rules as classNamesRules } from "./class-names.mjs"
@@ -44,12 +45,15 @@ import { recommended as projectGraphRecommended, rules as projectGraphRules } fr
 import { recommended as sonarParityRecommended, rules as sonarParityRules } from "./sonar-parity.mjs"
 import { buildFeConfig, buildPlainSourceConfig } from "./lib/config.mjs"
 import { why } from "./lib/why.mjs"
+import { recommended as uiRulingsRecommended, rules as uiRulingsRules } from "./ui-rulings.mjs"
 
 /** Each law's contribution, kept separate so a duplicate name is detectable rather than silent. */
 const CONTRIBUTIONS = [
+  { law: "ui-rulings", rules: uiRulingsRules, recommended: uiRulingsRecommended },
     { law: "project-graph", rules: projectGraphRules, recommended: projectGraphRecommended },
   { law: "brand-values", rules: brandValuesRules, recommended: brandValuesRecommended },
   { law: "button-intent", rules: buttonIntentRules, recommended: buttonIntentRecommended },
+  { law: "control-height", rules: controlHeightRules, recommended: controlHeightRecommended },
   { law: "client-boundary", rules: clientBoundaryRules, recommended: clientBoundaryRecommended },
   { law: "comments", rules: commentsRules, recommended: commentsRecommended },
   {

package/lib/config.mjs

@@ -98,7 +98,7 @@ export const SLOT_FREE_RULES = Object.freeze([
   "no-native-anchor", "no-inline-parameter-type", "no-hand-rolled-polling", "no-copy-in-call", "no-alert", "no-failure-collapse",
   "outcome-kinds-exhaustive", "no-await-in-loop", "prefer-code-point", "prefer-string-raw", "no-nested-conditional", "no-void-operator", "no-unused-import",
   "prefer-export-from", "no-unused-prop-types", "media-has-caption", "max-params",
-  "nested-control-variant", "no-list-panel-padding", "no-app-surface-paint", "divider-full-bleed",
+  "nested-control-variant", "no-list-panel-padding", "no-app-surface-paint", "divider-full-bleed", "control-height", "selection-fill-no-check",
   "button-intent-required", "button-no-variant", "destructive-confirm-in-dialog", "single-commit-per-render", "no-commit-in-collection-item",
 ])
 

package/lib/why.mjs

@@ -19,6 +19,16 @@
 
 /** @type {Record<string, Why>} */
 export const why = {
+  "selection-fill-no-check": {
+    code: "FE_NESTED_VARIANT",
+    en: "`<file>` adds a check indicator to a navigation-like single-select list.",
+    fix: 'Set selectionIndicator="none" and let the row fill carry selection.',
+  },
+  "no-grammar-internal-selector": {
+    code: "FE_GRAMMAR_LAYOUT_ONLY",
+    en: "`<file>` targets a Grammar internal class from application styles.",
+    fix: "Use the Grammar public props and slots; keep internal selectors inside Grammar.",
+  },
   "divider-full-bleed": {
     code: "FE_DIVIDER_FULL_BLEED",
     en: "`<file>` insets a horizontal Grammar divider with wrapper padding.",
@@ -29,6 +39,11 @@ export const why = {
     en: "`<file>` renders a Button or IconButton without the command's intent.",
     fix: "Declare intent from the command's consequence and rank so Grammar supplies its variant.",
   },
+  "control-height": {
+    code: "FE_CONTROL_HEIGHT",
+    en: "`<file>` picks a larger control size or mixes control sizes in one row.",
+    fix: "Omit size so Grammar draws the one 40px control height; use sm only for every control of an item or dense toolbar row, and lg only for a landing hero call to action.",
+  },
   "button-no-variant": {
     code: "FE_BUTTON_NO_VARIANT",
     en: "`<file>` chooses a Button or IconButton variant directly.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "9.1.8",
+  "version": "9.1.10",
   "description": "Universal front-end lint laws for TypeScript and Next.js, independent of the selected Grammar family.",
   "type": "module",
   "license": "MIT",

package/runtime/config.example.yaml

@@ -38,8 +38,9 @@ parallel: {gear: 1}
 # kernel (docs/supervisor.md) also takes, optional, defaults in home.mjs DEFAULTS:
 #   kernel: {agent, model, effort}   its agent pin (default: the kernel pin below)
 #   workers: {base, max}             the adaptive [Worker] cap, 0 to 10 (0 = the Supervisor runs no fix worker)
-#   landGate: {mode: shared}         shared lets running lanes commit directly; exclusive = gate only. A land
-#                                    fast-forwards LOCAL main only: the remote main moves with a release (starci release cut)
+#   landGate: {mode: shared, push: true}  shared lets running lanes commit directly; exclusive = gate only. A land
+#                                    fast-forwards LOCAL main; main reaches the remote right after a green scoped check through
+#                                    `starci release push` (push: true, the default; false locks the remote). CI is the critic.
 supervisor:
   # mode: chat (default) - the owner's desktop chat session is the Supervisor: it owns channel 'main'
   #   and reads Decision Items; nothing starts a [Supervisor] kernel. kernel - the optional [Supervisor]
@@ -49,7 +50,7 @@ supervisor:
   pollIntervalMs: null
   repos: []
   # frozenMinutes: <n>   # Host seat check: a busy frame unchanged this long is frozen, not busy
-  # landGate: {mode: shared|exclusive}
+  # landGate: {mode: shared|exclusive, push: true|false}
 # delegation — while the owner is away, a named delegate (e.g. the supervisor chat) may
 # answer owner asks until the given time; excluded classes stay owner-only. null = none.
 #   delegation: {asks: supervisor, until: 2026-09-23T09:00:00+07:00,
@@ -185,11 +186,9 @@ sonar: {organization: null}
 #   minFreeRamPct  free-RAM percentage below which no new heavy op starts
 # set them only in the gitignored config.yaml copy, e.g.
 #   resources: {minFreeDiskGb: 5, minFreeDiskPct: 1, minFreeRamPct: 10}
-# release - where the Linux parity of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
-#   suite: local   the shipped default: `starci release cut` runs the root rows (npm run test:packages, npm run test:e2e, npm run check) and the Linux parity container before it pushes,
-#                  and the pre-push gate asks for the green root rows
-#   suite: ci      the owner's recorded choice (2026-10-09): no local Linux container; the GitHub ci workflow runs the Linux parity (and SonarCloud) AFTER the push.
-#                  The cut still runs the same root rows and the example apps; the record lists linux-parity as delegated, never green.
-#                  A release can reach GitHub and its tag before the Linux parity has run; a red CI is fixed forward with the next pre-release (starci release ci-status).
-# "none" is refused: the Linux parity does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
+# release - where the full suite of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
+#   suite: local   the shipped default: `starci release cut` also runs the L4 rows on this host (root rows, example apps, Sonar proofs, Linux parity container) before it tags; it never gates a push
+#   suite: ci      the owner's recorded choice (2026-10-09, widened 2026-10-26 by push-main-after-scoped-check): EVERY row is judged by the GitHub workflows (ci, examples, sonar) on each push to main;
+#                  the cut runs none and lists each row as delegated, never green. A red CI opens the next alpha.N.M and never blocks the next push (starci release ci-status).
+# "none" is refused: the suite does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
 release: {suite: local}

package/runtime/engine/config.mjs

@@ -294,13 +294,13 @@ const validateSupervisorBlock=(supervisor,profile)=>{
     throw new Error('Invalid config.yaml: supervisor.mode must be chat or kernel, or null.');
   // The [Supervisor] kernel seat (scripts/machine/home.mjs supervisorSettings): kernel {agent?, model?, effort?}
   // pins its agent (default: the kernel pin), workers {base?, max?} its adaptive [Worker] cap (0 to 10; the shipped default is 0 fix workers),
-  // landGate {mode?: shared|exclusive} the land gate (scripts/supervisor/land.mjs).
+  // landGate {mode?: shared|exclusive, push?: boolean} the land gate (scripts/supervisor/land.mjs); push (default true, owner ruling push-main-after-scoped-check) lets `starci release push` send main to the remote after a green scoped check, false is the owner's lock on the remote.
   const seat=supervisor.kernel,workers=supervisor.workers,gate=supervisor.landGate;
   if(seat!==undefined&&seat!==null)validateAgentSeat(seat,'supervisor.kernel',profile);
   if(!(workers===undefined||workers===null||(plain(workers)&&Object.keys(workers).every(key=>['base','max'].includes(key)&&Number.isInteger(workers[key])&&workers[key]>=0&&workers[key]<=10))))
     throw new Error('Invalid config.yaml: supervisor.workers must be {base?, max?} integers from 0 to 10, or null.');
-  if(!(gate===undefined||gate===null||(plain(gate)&&Object.keys(gate).every(key=>key==='mode'&&['shared','exclusive'].includes(gate.mode)))))
-    throw new Error('Invalid config.yaml: supervisor.landGate must be {mode?: shared|exclusive}, or null.');
+  if(!(gate===undefined||gate===null||(plain(gate)&&Object.keys(gate).every(key=>(key==='mode'&&['shared','exclusive'].includes(gate.mode))||(key==='push'&&typeof gate.push==='boolean')))))
+    throw new Error('Invalid config.yaml: supervisor.landGate must be {mode?: shared|exclusive, push?: boolean}, or null.');
   // stallMinutes: scripts/supervisor/stall.mjs calls a running workflow STALLED after this many minutes with no progress.
   // frozenMinutes: scripts/supervisor/supervisor-watchdog.mjs reads a busy seat frame with no turn progress for this long as frozen.
   const frozen=supervisor.frozenMinutes;

package/runtime/engine/release-config.mjs

@@ -3,14 +3,14 @@ import {invalid} from './invalid-config.mjs';
 
 /** The keys of the release block. */
 export const RELEASE_KEYS=Object.freeze(['suite']);
-/** Where the full test suite of a release is judged: `local` (the release cut runs it, the shipped default) or `ci` (the GitHub workflow runs it after the push; the cut runs only the affected specs of the release and the rows CI cannot run). */
+/** Where the full test suite of a release is judged: `local` (the release cut also runs the L4 rows before it tags, the shipped default) or `ci` (the GitHub workflows judge EVERY row on each push to main; the cut runs none). */
 export const SUITE_MODES=Object.freeze(['local','ci']);
-export const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
+const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
 
 /**
- * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped
- * default: `starci release cut` runs the root suite and the Linux parity container before it pushes. `ci` is the owner's recorded choice (2026-10-09) that
- * the full suite runs on GitHub only: the cut runs no root suite and no Linux container, and the CI workflow's verdict is read afterwards (`starci release ci-status`).
+ * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped default: `starci release cut` also runs the
+ * L4 rows on this host before it tags. `ci` is the owner's recorded choice (2026-10-09, widened 2026-10-26 by push-main-after-scoped-check): the full suite runs on GitHub only, on every push
+ * to main; the cut runs no row and the verdict is read with `starci release ci-status`. The push of main needs neither mode: it needs a green scoped check.
  * `none` is refused: the suite does not vanish, it moves to CI, and the value says so.
  */
 export function validateRelease(release){

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -30,35 +30,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.12.12
+    version: 0.12.14
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.54
+    version: 3.4.56
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.8
+    version: 9.1.10
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.12
+    version: 0.12.14
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.12
+    version: 0.12.14
     group: starci
     install: registry
     side: fe
@@ -98,14 +98,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.45
+    version: 1.7.47
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.45
+    version: 4.7.47
     group: starci
     install: registry
     side: both

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -131,12 +131,6 @@ removed:
     use: '`starci debug digest` (read-only) and `starci debug run <probe>`'
     since: 1.0.0-alpha.6
     match: '(?<![\w-])debug pass\b'
-  - id: config-supervisor-landgate-push
-    kind: config-key
-    name: supervisor.landGate.push
-    use: 'a land fast-forwards local main only and never pushes; the remote main of the runtime moves once per release, through starci release cut'
-    since: 1.0.0-alpha.7
-    match: 'landGate\.push\b'
   - id: flag-land-no-push
     kind: flag
     name: --no-push
@@ -355,7 +349,7 @@ removed:
   - id: verb-test-run
     kind: verb
     name: starci test run
-    use: 'the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, `starci release cut` runs the release rows'
+    use: 'the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, CI runs the release rows'
     since: 1.0.0-alpha.19
     match: '\bstarci test run\b'
   - id: verb-gate-runtime-coverage
@@ -430,3 +424,35 @@ removed:
     use: 'DropdownMenuItem.tone uses neutral or danger; destructive commands use danger'
     since: 1.0.0-alpha.31
     match: 'DropdownMenuItem(?:Tone|\.tone)[^\r\n]*["'']negative["'']'
+
+  - id: code-release-receipt-missing
+    kind: code
+    name: RELEASE_RECEIPT_MISSING
+    use: 'the push of main asks for a fast-forward and a clean secret scan; a release tag asks for no receipt'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-receipt-incomplete
+    kind: code
+    name: RELEASE_RECEIPT_INCOMPLETE
+    use: 'the push of main asks for a fast-forward and a clean secret scan; CI judges the full suite'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-suite-mode
+    kind: code
+    name: RELEASE_SUITE_MODE
+    use: 'release.suite chooses whether the cut also runs the L4 rows; no record or gate reads the mode'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-version-unchanged
+    kind: code
+    name: RELEASE_VERSION_UNCHANGED
+    use: 'main is pushed without a version move; RELEASE_VERSION_NOT_NEXT judges the version of a tag against the v* tags'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-remote-head-unknown
+    kind: code
+    name: RELEASE_REMOTE_HEAD_UNKNOWN
+    use: 'a release tag is judged against the v* tags, not against the remote main head'
+    since: 1.0.0-alpha.31.1
+  - id: config-release-candidate-blocking
+    kind: config-key
+    name: candidate.blocking
+    use: 'the runtime cut has no candidate step; the ci, examples and sonar workflows judge each push to main (suite.ci.workflows)'
+    since: 1.0.0-alpha.31.1
+    match: 'candidate\.blocking\b'

package/ui-rulings.mjs

@@ -0,0 +1,134 @@
+/** Owner UI rulings: selection uses fill, and applications respect Grammar styling ownership. */
+import { attribute, attributeValue, staticText } from "./lib/ast.mjs";
+import { importOf } from "./lib/bindings.mjs";
+import { isProductSource } from "./lib/scope.mjs";
+import { typedClassStrings } from "./lib/typed-class-values.mjs";
+
+/** Resolve a named or namespace import at its use, preserving lexical shadowing. */
+const grammarComponent = (context, opening, expected) => {
+  const name = opening.name;
+  const root = name.type === "JSXMemberExpression" ? name.object : name;
+  if (root.type !== "JSXIdentifier") return false;
+  const binding = importOf(context, root);
+  if (
+    !binding ||
+    !/^@starci\/grammar(?:\/(?:common|core|heritage|offset-pop))?$/.test(
+      binding.source,
+    )
+  )
+    return false;
+  return name.type === "JSXMemberExpression"
+    ? binding.imported === null && name.property.name === expected
+    : binding.imported === expected;
+};
+
+/** Only a final explicit attribute is proof when an opaque spread could override a value. */
+const propText = (opening, key) => {
+  let value = null;
+  for (const entry of opening.attributes) {
+    if (entry.type === "JSXSpreadAttribute") value = null;
+    else if (entry.name.name === key) value = staticText(entry.value);
+  }
+  return value;
+};
+
+/** Navigation and rail/list placement are structurally identifiable without guessing from product names. */
+const navigationList = (context, opening) => {
+  for (let node = opening.parent; node; node = node.parent) {
+    if (node.type !== "JSXElement") continue;
+    const parent = node.openingElement;
+    if (
+      ["nav", "ul", "ol"].includes(parent.name.name) ||
+      ["navigation", "list"].includes(propText(parent, "role"))
+    )
+      return true;
+    if (
+      ["Rail", "Sidebar"].some((role) =>
+        grammarComponent(context, parent, role),
+      )
+    )
+      return true;
+  }
+  return false;
+};
+
+/** Navigation-like single selection uses the row fill instead of a second check indicator. */
+export const selectionFillNoCheck = {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "Navigation-like single-select ListBox rows use selectionIndicator=none.",
+    },
+    schema: [],
+    messages: {
+      indicator:
+        'Use selectionIndicator="none" on this navigation-like single-select ListBox; the row fill carries selection.',
+    },
+  },
+  create(context) {
+    return {
+      JSXOpeningElement(node) {
+        if (
+          !grammarComponent(context, node, "ListBox") ||
+          !navigationList(context, node)
+        )
+          return;
+        if (["none", "multiple"].includes(propText(node, "selectionMode")))
+          return;
+        if (propText(node, "selectionIndicator") !== "none")
+          context.report({ node, messageId: "indicator" });
+      },
+    };
+  },
+};
+
+/** Grammar internal selectors belong to Grammar, including selectors in colocated class declarations. */
+export const noGrammarInternalSelector = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Application styles cannot target starci-core internals.",
+    },
+    schema: [],
+    messages: {
+      internal:
+        "Remove this starci-core- selector. Compose the Grammar public API; message actions belong in the ChatBubble floating toolbar.",
+    },
+  },
+  create(context) {
+    if (!isProductSource(context)) return {};
+    const selector = /(?:\.|_|\[class[^\]]*)starci-core-/;
+    const report = (node, text) => {
+      if (text && selector.test(text))
+        context.report({ node, messageId: "internal" });
+    };
+    return {
+      Literal(node) {
+        if (typeof node.value === "string") report(node, node.value);
+      },
+      TemplateElement(node) {
+        report(node, node.value.cooked);
+      },
+      JSXAttribute(node) {
+        if (node.name.name !== "className") return;
+        const value = attributeValue(attribute(node.parent, "className"));
+        if (value?.type !== "Identifier" && value?.type !== "MemberExpression")
+          return;
+        const strings = typedClassStrings(context, value, "classes");
+        if (strings.some((entry) => selector.test(entry.text)))
+          context.report({ node, messageId: "internal" });
+      },
+    };
+  },
+};
+
+export const rules = {
+  "selection-fill-no-check": selectionFillNoCheck,
+  "no-grammar-internal-selector": noGrammarInternalSelector,
+};
+
+/** Both owner rulings are universal errors in the frontend canon. */
+export const recommended = Object.fromEntries(
+  Object.keys(rules).map((name) => [`starci-fe/${name}`, "error"]),
+);