@starci/eslint-grammar-core 0.15.6 → 0.15.10

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.15.10 - 2026-10-29
+
+- Changed: `@starci/eslint-canon-fe` 9.4.9 is the peer dependency; the bundled slot manifest gives the model libraries their owners in `ruleParams.be.infraOwners` (`@starci/ai-router` to `integrations/ai-gateway`, `@langchain/*` to `integrations/ai`; `openai`, `langchain`, `@langchain/langgraph`, `@langchain/community` and the provider SDKs nowhere) and lists R326 and R327 on `be.integrations`; the bundled rule catalog carries R326 and R327; the bundled canon pins name hfs 4.9.11, eslint-canon-be 3.6.8, eslint-canon-fe 9.4.9, the Grammar family 0.15.10 (grammar, eslint-grammar-core, eslint-grammar-offset-pop), and pin `@langchain/core` 1.3.1 and `@langchain/openai` 1.8.0. No rule changed.
+
+## 0.15.9 - 2026-10-29
+
+- Changed: `@starci/eslint-canon-fe` 9.4.8 is the peer dependency; the bundled canon pins name hfs 4.9.10, eslint-canon-be 3.6.7, eslint-canon-fe 9.4.8, eslint-grammar-core 0.15.9 and eslint-grammar-offset-pop 0.15.9. No rule changed.
+
+## 0.15.8 - 2026-10-29
+
+- Changed: `starci-grammar/route-page-is-one-page` (R325) follows the owner ruling `page-frame` as rewritten: a route segment `layout` whose owner (`fe.feature`, kind `layouts`), its pure half or its one root block draws a `Page` whose `header` carries `tabs` is the one `Page` of every route under it. The rule finds the route `page` files that mount a page owner, walks up through the `layout` files of their segments and resolves each layout's owner one level deep. A page owner every route of which is so framed is not judged `missing`; one that draws a `Page` (or a root block that draws one) under such a layout is `twice`, and the message names the layout. A layout whose `Page` carries no `tabs` frames no segment.
+- Changed: R325 also judges layout owners (`fe.feature`, kind `layouts`): a `Page` they draw has nothing beside it (`sibling`; a `PageHeader` block beside the segment's `Page` belongs in its `header`), no `Page` inside another (`twice`), and no bare `PageHeader` or `PageContainer` (`part`). A layout owner that draws no `Page` is never `missing`.
+- Changed: `@starci/eslint-canon-fe` 9.4.7 is the peer dependency; versioned together with Grammar 0.15.8; the bundled canon pins name the Grammar family 0.15.8 (grammar, eslint-grammar-core, eslint-grammar-offset-pop), eslint-canon-fe 9.4.7 and eslint-canon-be 3.6.6.
+- Spec: `src/page.spec.ts`, `src/page-owners.spec.ts` (layout cases on the project fixture); docs: `docs/page.md`.
+
+## 0.15.7 - 2026-10-29
+
+- Changed: `starci-grammar/route-page-is-one-page` (R325) follows the owner ruling that a route draws exactly one `Page`, drawn by the page owner, its pure half (`./component`), or the one connected block (`fe.components`, kind `blocks`) the owner renders as its root, read one level deep (the block's connected half and its own pure half). A server page owner whose header needs client data renders that block and passes the page body as its children. An element that draws the `Page` with an element sibling stays `sibling`; a `Page` (or a block that draws one) inside another is the new finding `twice`.
+- Changed: R325 does not judge a page owner as `missing` when every route `page` file that imports it lies under the route group `(auth)` with its own `layout`: that layout draws the auth frame, the page frame of its sign-in, sign-up, password and callback pages. A page owner that draws no JSX (it only calls `redirect()` or `notFound()`, or returns null) stays unjudged. Workbench pages get no exemption.
+- Changed: `@starci/eslint-canon-fe` 9.4.6 is the peer dependency; versioned together with Grammar 0.15.7; the bundled canon pins name the Grammar family 0.15.7 (grammar, eslint-grammar-core, eslint-grammar-offset-pop) and eslint-canon-fe 9.4.6.
+- Spec: `src/page.spec.ts`, `src/page-owners.spec.ts` (new, cross-file); docs: `docs/page.md`.
+
 ## 0.15.6 - 2026-10-28
 
 - Changed: `starci-grammar/route-page-is-one-page` (R325) also refuses a page owner file that draws JSX but no `Page` and draws through no pure half of its own (an element imported from `./component`), with the message `missing` on its first element. The segment boundary owners of FE-BOUNDARY-1 (`*ErrorPage`, `*LoadingPage`, `*NotFoundPage`) are not judged for it; a file that draws a bare `PageHeader` or `PageContainer` is reported once, as `part`. Spec: `src/page.spec.ts`; docs: `docs/page.md`.

package/dist/lib/app-shell-owner-source.d.ts

@@ -7,5 +7,7 @@ export interface Owner {
 }
 /** An imported JSX owner, or null when its implementation cannot be proved from owned source. */
 export declare const importedHeader: (context: ReaderContext, opening: TSESTree.JSXOpeningElement) => Owner | null;
+/** A file of the app parsed on its own (a route `layout`), sharing the run's parse cache. */
+export declare const parsedSource: (context: ReaderContext, filename: string) => ParsedContext;
 /** The per-repository proof cache shares the same lifetime as parsed header source. */
 export declare const headerProofs: (context: ReaderContext) => Map<string, boolean>;

package/dist/lib/app-shell-owner-source.js

@@ -155,5 +155,7 @@ export const importedHeader = (context, opening) => {
     const exported = name.type === "JSXMemberExpression" ? name.property.name : imported.imported ?? "default";
     return target ? headerExport(target, exported) : null;
 };
+/** A file of the app parsed on its own (a route `layout`), sharing the run's parse cache. */
+export const parsedSource = (context, filename) => sourceContext(context, filename);
 /** The per-repository proof cache shares the same lifetime as parsed header source. */
 export const headerProofs = (context) => stateOf(context).proofs;

package/dist/lib/page-frame.d.ts

@@ -0,0 +1,29 @@
+import type { TSESTree } from "@typescript-eslint/types";
+import type { ReaderContext } from "./types.js";
+/** The pure half of a unit: the module its connected half draws through. */
+export declare const PURE_HALF: RegExp;
+/**
+ * True when the element is one of the app's connected blocks (`fe.components`, kind `blocks`) and that block draws a
+ * `Page`, in its connected half or in the pure half it draws through (`./component`). One level only: what the block
+ * hands to other blocks is not followed.
+ */
+export declare const blockDrawsPage: (context: ReaderContext, opening: TSESTree.JSXOpeningElement) => boolean;
+/** The route group whose layout frames sign-in, sign-up, password and auth callback pages. */
+export declare const AUTH_GROUP = "(auth)";
+/**
+ * True when every route page that mounts this page owner lies under the app's auth route group (`app/**\/(auth)/`) with
+ * its own layout: that layout draws the auth frame, which is the page frame of the sign-in, sign-up, password and
+ * callback pages in it. An owner no route mounts, or one mounted anywhere else too, is not an auth page.
+ */
+export declare const mountedOnlyUnderAuthGroup: (context: ReaderContext) => boolean;
+/** Which of the routes that mount a page owner lie under a segment layout that draws their one `Page`. */
+export interface SegmentFrame {
+    /** At least one mounting route is framed: the owner draws body content only, and a `Page` of its own is a second one. */
+    readonly some: boolean;
+    /** Every mounting route is framed (and at least one mounts it): the owner needs no `Page`. */
+    readonly every: boolean;
+    /** The nearest such `layout`, relative to the app folder, for the finding. */
+    readonly layout: string | null;
+}
+/** Whether the routes that mount this page owner sit under a segment `layout` that draws their one `Page`. */
+export declare const segmentFrame: (context: ReaderContext) => SegmentFrame;

package/dist/lib/page-frame.js

@@ -0,0 +1,179 @@
+/**
+ * What R325 reads beyond the owner's own file: whether the one connected block an owner renders draws the `Page`, whether
+ * a page owner is mounted only under an auth route group whose layout is its page frame, and whether a route segment
+ * `layout` above it already draws the one `Page` of its tabbed segment.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { walk } from "@starci/eslint-canon-fe/lib/ast.mjs";
+import { hfsOf } from "@starci/eslint-canon-fe/lib/hfs.mjs";
+import { importedHeader, parsedSource } from "./app-shell-owner-source.js";
+/** The pure half of a unit: the module its connected half draws through. */
+export const PURE_HALF = /^\.\/component(?:\.[cm]?[jt]sx?)?$/;
+/** The name a JSX element is drawn by (`Page`, or `Grammar.Page` as `Page`), or null. */
+const openingName = (opening) => {
+    const name = opening.name;
+    if (name.type === "JSXIdentifier")
+        return name.name;
+    if (name.type === "JSXMemberExpression")
+        return name.property.name;
+    return null;
+};
+/** The JSX elements of one parsed file. */
+const elementsOf = (context) => {
+    const found = [];
+    walk(context.sourceCode, context.program, (node) => {
+        if (node.type === "JSXElement")
+            found.push(node);
+    });
+    return found;
+};
+/** The names a parsed file imports from its own pure half (`./component`). */
+const pureHalfNames = (context) => {
+    const names = new Set();
+    for (const statement of context.program.body) {
+        if (statement.type !== "ImportDeclaration" || !PURE_HALF.test(String(statement.source.value)))
+            continue;
+        for (const specifier of statement.specifiers)
+            names.add(specifier.local.name);
+    }
+    return names;
+};
+/** A unit's file and the pure halves it draws through (`./component`): the files that together draw what the unit draws. */
+const withHalves = (context) => {
+    const halves = pureHalfNames(context);
+    const files = [context];
+    for (const element of elementsOf(context)) {
+        const name = element.openingElement.name;
+        if (name.type !== "JSXIdentifier" || !halves.has(name.name))
+            continue;
+        const half = importedHeader(context, element.openingElement);
+        if (half !== null && !files.includes(half.context))
+            files.push(half.context);
+    }
+    return files;
+};
+/** The `Page` elements a parsed file draws itself. */
+const pagesIn = (context) => elementsOf(context).filter((element) => openingName(element.openingElement) === "Page");
+/** The object literal a `header={...}` attribute passes: written in place, or a `const` of the same file. */
+const headerObject = (context, opening) => {
+    const attribute = opening.attributes.find((entry) => entry.type === "JSXAttribute" && entry.name.name === "header");
+    const value = attribute?.value?.type === "JSXExpressionContainer" ? attribute.value.expression : null;
+    if (value?.type === "ObjectExpression")
+        return value;
+    if (value?.type !== "Identifier")
+        return null;
+    let found = null;
+    walk(context.sourceCode, context.program, (node) => {
+        if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.id.name === value.name && node.init?.type === "ObjectExpression")
+            found = node.init;
+    });
+    return found;
+};
+/** True when a `Page` element's `header` carries `tabs`: the page heads a segment whose routes are its tabs. */
+const headsTabbedSegment = (context, opening) => headerObject(context, opening)?.properties.some((property) => property.type === "Property" && property.key.type === "Identifier" && property.key.name === "tabs") === true;
+/** The files of an app block (`fe.components`, kind `blocks`) an element draws, with its pure half; null for anything else. */
+const blockFiles = (context, opening) => {
+    const owner = importedHeader(context, opening);
+    if (owner === null)
+        return null;
+    const found = hfsOf(context).classify(owner.context.filename);
+    if (found.slot !== "fe.components" || found.kind !== "blocks")
+        return null;
+    return withHalves(owner.context);
+};
+/**
+ * True when the element is one of the app's connected blocks (`fe.components`, kind `blocks`) and that block draws a
+ * `Page`, in its connected half or in the pure half it draws through (`./component`). One level only: what the block
+ * hands to other blocks is not followed.
+ */
+export const blockDrawsPage = (context, opening) => blockFiles(context, opening)?.some((file) => pagesIn(file).length > 0) === true;
+/**
+ * True when a unit (a layout owner) draws a `Page` whose header carries `tabs`: itself, through its pure half, or through
+ * the one connected block either renders, read one level deep as for a page owner.
+ */
+const unitDrawsTabbedPage = (context) => withHalves(context).some((file) => {
+    const tabbed = (target) => pagesIn(target).some((page) => headsTabbedSegment(target, page.openingElement));
+    if (tabbed(file))
+        return true;
+    return elementsOf(file).some((element) => blockFiles(file, element.openingElement)?.some(tabbed) === true);
+});
+/** The route group whose layout frames sign-in, sign-up, password and auth callback pages. */
+export const AUTH_GROUP = "(auth)";
+const PAGE_OWNER = /^(.*\/src)\/features\/pages\/([^/]+)\//;
+const ROUTE_PAGE = /(?:^|[\\/])page\.[cm]?[jt]sx?$/;
+const ROUTE_LAYOUT = /^layout\.[cm]?[jt]sx?$/;
+/**
+ * True when a route file imports a value of the page owner `owner` (`@/features/pages/<owner>`, or a relative path to it):
+ * a default, named or namespace import. A type import, or a re-export such as `export { metadata } from` the owner, mounts
+ * nothing: a route that only borrows the owner's metadata renders another page.
+ */
+const mountsOwner = (text, owner) => new RegExp(String.raw `\bimport\s+(?!type\s)(?:[\w$]+\s*,?\s*)?(?:\{[^}]*\}|\*\s*as\s+[\w$]+)?\s*from\s+["'][^"']*\/features\/pages\/${owner}(?:\/index)?["']`).test(text);
+/** The app's `app/` folder and the route `page` files that mount this page owner; null outside a page owner. */
+const mountingRoutes = (context) => {
+    const match = PAGE_OWNER.exec(context.filename.replaceAll("\\", "/"));
+    if (match === null)
+        return null;
+    const [, source = "", owner = ""] = match;
+    const appDirectory = path.normalize(path.join(source, "app"));
+    if (!fs.existsSync(appDirectory))
+        return null;
+    const routes = fs.readdirSync(appDirectory, { recursive: true, encoding: "utf8" })
+        .filter((relative) => ROUTE_PAGE.test(relative))
+        .map((relative) => path.join(appDirectory, relative))
+        .filter((route) => mountsOwner(fs.readFileSync(route, "utf8"), owner));
+    return { appDirectory, routes };
+};
+/** The `layout` files of the segments that wrap a route page, nearest first, up to the app folder. */
+const layoutsAbove = (route, appDirectory) => {
+    const layouts = [];
+    for (let directory = path.dirname(route); directory.length >= appDirectory.length; directory = path.dirname(directory)) {
+        for (const name of fs.readdirSync(directory))
+            if (ROUTE_LAYOUT.test(name))
+                layouts.push(path.join(directory, name));
+        if (directory === appDirectory)
+            break;
+    }
+    return layouts;
+};
+/** True when a route file lies under an auth route group that has its own `layout`, the frame of every page in it. */
+const underAuthGroup = (route, appDirectory) => layoutsAbove(route, appDirectory).some((layout) => path.basename(path.dirname(layout)) === AUTH_GROUP);
+/**
+ * True when every route page that mounts this page owner lies under the app's auth route group (`app/**\/(auth)/`) with
+ * its own layout: that layout draws the auth frame, which is the page frame of the sign-in, sign-up, password and
+ * callback pages in it. An owner no route mounts, or one mounted anywhere else too, is not an auth page.
+ */
+export const mountedOnlyUnderAuthGroup = (context) => {
+    const found = mountingRoutes(context);
+    return found !== null && found.routes.length > 0 && found.routes.every((route) => underAuthGroup(route, found.appDirectory));
+};
+/**
+ * True when a route segment `layout` draws the one `Page` of its tabbed segment: the layout file, or a layout owner it
+ * renders (`fe.feature`, kind `layouts`) through itself, its pure half or the one connected block it renders as its root,
+ * draws a `Page` whose `header` carries `tabs`.
+ */
+const layoutDrawsSegmentPage = (context, layout) => {
+    const file = parsedSource(context, layout);
+    if (pagesIn(file).some((page) => headsTabbedSegment(file, page.openingElement)))
+        return true;
+    return elementsOf(file).some((element) => {
+        const owner = importedHeader(file, element.openingElement);
+        if (owner === null)
+            return false;
+        const found = hfsOf(context).classify(owner.context.filename);
+        return found.slot === "fe.feature" && found.kind === "layouts" && unitDrawsTabbedPage(owner.context);
+    });
+};
+/** Whether the routes that mount this page owner sit under a segment `layout` that draws their one `Page`. */
+export const segmentFrame = (context) => {
+    const found = mountingRoutes(context);
+    if (found === null || found.routes.length === 0)
+        return { some: false, every: false, layout: null };
+    const framing = found.routes.map((route) => layoutsAbove(route, found.appDirectory).find((layout) => layoutDrawsSegmentPage(context, layout)) ?? null);
+    const first = framing.find((layout) => layout !== null) ?? null;
+    return {
+        some: first !== null,
+        every: framing.every((layout) => layout !== null),
+        layout: first === null ? null : path.relative(found.appDirectory, first).replaceAll("\\", "/"),
+    };
+};

package/dist/lib/why.js

@@ -41,8 +41,8 @@ export const why = {
     },
     "route-page-is-one-page": {
         code: "FE_ROUTE_PAGE_OUTSIDE_PAGE",
-        en: "The page owner `<file>` draws something beside its Page, a bare PageHeader or PageContainer, or no Page at all.",
-        fix: "Draw one Page: the band as its header, everything else in its body, the measure as its measure.",
+        en: "The page or layout owner `<file>` draws something beside its Page, a Page inside another (or inside the Page its tabbed segment's layout draws), a bare PageHeader or PageContainer, or no Page at all (itself, through its pure half, or through the one connected block it renders as its root).",
+        fix: "Draw one Page: the band as its header, everything else in its body, the measure as its measure. When client data builds the header, render as the root the one connected block that draws the Page and pass the body as its children. Under a segment layout whose Page carries header.tabs, a page draws its body only; that layout's Page has nothing beside it, its head in its header. A page mounted only under the (auth) route group is framed by that group's layout.",
     },
     "no-shell-bottom-tabs": {
         code: "FE_APP_SHELL_BOTTOM_TABS",

package/dist/page.d.ts

@@ -4,7 +4,10 @@ import type { TSESTree } from "@typescript-eslint/types";
 export declare const tabsOutsideHeader: (parent: TSESTree.JSXElement | TSESTree.JSXFragment) => TSESTree.JSXElement | null;
 /** Page tabs are the header's `tabs`, never a `Tabs` at the top of the body or beside a `PageHeader`. */
 export declare const pageTabsInHeader: Rule.RuleModule;
-/** A page owner draws one `Page` and nothing beside it; `PageHeader` and `PageContainer` are Page's own parts. */
+/**
+ * A route draws exactly one `Page` and nothing beside it: the page owner draws it, its pure half does, or the one connected
+ * block it renders as its root does. `PageHeader` and `PageContainer` are Page's own parts.
+ */
 export declare const routePageIsOnePage: Rule.RuleModule;
 /** The rules these laws contribute to the plugin. */
 export declare const rules: Record<string, Rule.RuleModule>;

package/dist/page.js

@@ -1,4 +1,5 @@
 import { inSlot, isProductSource, kindOfFile } from "@starci/eslint-canon-fe/lib/scope.mjs";
+import { PURE_HALF, blockDrawsPage, mountedOnlyUnderAuthGroup, segmentFrame } from "./lib/page-frame.js";
 import { defineFamilyRules, defineRule } from "./lib/rule-contract.js";
 /**
  * The rules that hold the page frame laws: Grammar's `Page` is the one owner of a route page's header band, its inset
@@ -7,15 +8,25 @@ import { defineFamilyRules, defineRule } from "./lib/rule-contract.js";
  * - R324 (`FE_PAGE_TABS_OUTSIDE_HEADER`): page tabs are the header's tabs. A `Tabs` that is the first element child of a
  *   `Page` (the top of the body, right under the band), or the next element sibling of a `PageHeader`, is a page tab bar
  *   drawn outside the band: it misses the separator it stands on and takes the body's inset and gap.
- * - R325 (`FE_ROUTE_PAGE_OUTSIDE_PAGE`): a page owner (`fe.feature`, kind `pages`) draws one `Page` and nothing beside it.
- *   A `Page` with an element sibling, or a bare `PageHeader` or `PageContainer` in the page owner, re-decides the inset
- *   and the rhythm `Page` owns. A page owner file that draws JSX but no `Page`, and hands drawing to no pure half of its
- *   own (an element imported from `./component`), has no page frame at all.
+ * - R325 (`FE_ROUTE_PAGE_OUTSIDE_PAGE`): a route draws exactly one `Page` and nothing beside it. The page owner
+ *   (`fe.feature`, kind `pages`) draws it itself, through its pure half (`./component`), or through the one connected
+ *   block it renders as its root, where client data builds the header a server owner cannot build. A route segment
+ *   `layout` whose owner (`fe.feature`, kind `layouts`) draws, in the same ways, a `Page` whose `header` carries `tabs` is
+ *   the one `Page` of every route under it: those page owners draw body content only, so a `Page` they draw is a second
+ *   one, and they need none. A `Page` (or a block that draws one) with an element sibling, a `Page` inside another, or a
+ *   bare `PageHeader` or `PageContainer` in a page or layout owner re-decides the inset and the rhythm `Page` owns. A page
+ *   owner file that draws JSX but no `Page` in one of those ways has no page frame at all, unless a segment layout frames
+ *   every route that mounts it, or every such route lies under the auth route group `(auth)` with its own layout: that
+ *   layout draws the auth frame, the page frame of its sign-in, sign-up, password and callback pages.
  *
  * WHAT IT READS. Element names (`Page`, or `Grammar.Page` as `Page`), the element children of one JSX parent, and the
- * names a file imports from a relative module; whitespace text and JSX comments are not children. A `Tabs` lower in the
- * body, a `Page` wrapped alone in a provider, and files outside a page owner (for R325) are not judged. The segment
- * boundary owners of FE-BOUNDARY-1 (`*ErrorPage`, `*LoadingPage`, `*NotFoundPage`) are not judged for a missing `Page`:
+ * names a file imports from a relative module; whitespace text and JSX comments are not children. For R325 it also reads,
+ * one level deep, the source of each app block (`fe.components`, kind `blocks`) the owner draws with that block's pure
+ * half, the app's route `page` files that import the owner, and the route `layout` files of the segments above them with
+ * the layout owners they render (the same one level). A page owner that draws no JSX (its body only calls
+ * `redirect()` or `notFound()`, or returns null) draws no UI and is not judged, nor is a layout owner for a missing
+ * `Page`. A `Tabs` lower in the body, a `Page` wrapped alone in a provider, and files outside a page or layout owner (for
+ * R325) are not judged. The segment boundary owners of FE-BOUNDARY-1 (`*ErrorPage`, `*LoadingPage`, `*NotFoundPage`) are not judged for a missing `Page`:
  * an app-level boundary stands in for whichever page failed or waits and draws its notice.
  */
 /** The element name of a JSX child (`Tabs`, or `Grammar.Tabs` as `Tabs`), or null for text and expressions. */
@@ -75,39 +86,74 @@ export const pageTabsInHeader = defineRule({
     },
 });
 const PAGE_PARTS = new Set(["PageHeader", "PageContainer"]);
-/** True for a page owner's file: `fe.feature`, kind `pages`. */
-const isPageOwner = (context) => inSlot(context, "fe.feature") && kindOfFile(context) === "pages";
+/** The owner kind a file belongs to: a page owner or a layout owner (`fe.feature`, kind `pages` or `layouts`), or null. */
+const ownerKind = (context) => {
+    if (!inSlot(context, "fe.feature"))
+        return null;
+    const kind = kindOfFile(context);
+    return kind === "pages" || kind === "layouts" ? kind : null;
+};
 /** The segment boundary owners of FE-BOUNDARY-1: an error, loading or not-found page, which may draw a notice. */
 const BOUNDARY_OWNER = /\/features\/pages\/[^/]*(?:ErrorPage|LoadingPage|NotFoundPage)\//;
 /** True when the file is a boundary owner's, judged by its owner folder. */
 const isBoundaryOwner = (context) => BOUNDARY_OWNER.test(context.filename.replaceAll("\\", "/"));
-/** The pure half of a page owner: the module its connected half draws through. */
-const PURE_HALF = /^\.\/component(?:\.[cm]?[jt]sx?)?$/;
-/** A page owner draws one `Page` and nothing beside it; `PageHeader` and `PageContainer` are Page's own parts. */
+/** An import of the app's own source (`@/...` or a relative path), where its blocks come from. */
+const APP_SOURCE = /^(?:@\/|\.\.?\/)/;
+/** The nearest JSX element that encloses a node, or null. */
+const enclosingElement = (node) => {
+    for (let parent = node.parent; parent; parent = parent.parent)
+        if (parent.type === "JSXElement")
+            return parent;
+    return null;
+};
+/**
+ * A route draws exactly one `Page` and nothing beside it: the page owner draws it, its pure half does, or the one connected
+ * block it renders as its root does. `PageHeader` and `PageContainer` are Page's own parts.
+ */
 export const routePageIsOnePage = defineRule({
     meta: {
         type: "problem",
-        docs: { description: "R325: a page owner draws one Page with nothing beside it, never a bare PageHeader or PageContainer, and never no Page at all." },
+        docs: { description: "R325: a route draws one Page (in its page owner, its pure half or its one root block, or in the layout of its tabbed segment) with nothing beside it, never a bare PageHeader or PageContainer, and never no Page at all." },
         schema: [],
         messages: {
-            sibling: "This `Page` has a sibling: a route page is one `Page`, and whatever sits beside it escapes the header band, the measure and the rhythm `Page` owns. Move the sibling into the `Page` body, or into `header` when it heads the page.",
-            part: "`{{name}}` is drawn by `Page`: a page owner composes `Page` (`header` for the band, `measure` for the body), so the inset and the rhythm have one owner. Replace it with `Page`.",
-            missing: "This page owner draws no `Page`: a route page is one Grammar `Page`, which owns the header band, the measure and the rhythm, so without it the page has no heading band and its body sits on no inset. Wrap what it draws in a `Page` whose `header.title` is the page heading (never a `Heading` of its own), or draw it through the owner's pure half in `./component`.",
+            sibling: "This `{{name}}` draws the route's `Page` and has a sibling: a route page is one `Page`, and whatever sits beside it escapes the header band, the measure and the rhythm `Page` owns. Move the sibling into the `Page` body (as the block's children when a block draws the `Page`), or into `header` when it heads the page.",
+            twice: "This `{{name}}` draws a second `Page` inside the route's `Page`{{framer}}: a route page is exactly one `Page`, so the band, the measure and the rhythm would be decided twice. Draw its content as the body of the one `Page`.",
+            part: "`{{name}}` is drawn by `Page`: a page or layout owner composes `Page` (`header` for the band, `measure` for the body), so the inset and the rhythm have one owner. Replace it with `Page`.",
+            missing: "This page owner draws no `Page`: a route page is one Grammar `Page`, which owns the header band, the measure and the rhythm, so without it the page has no heading band and its body sits on no inset. Wrap what it draws in a `Page` whose `header.title` is the page heading (never a `Heading` of its own), draw it through the owner's pure half in `./component`, or render as the root the one connected block that draws the `Page` from client data.",
         },
     },
     create(context) {
-        if (!isProductSource(context) || !isPageOwner(context))
+        const kind = isProductSource(context) ? ownerKind(context) : null;
+        if (kind === null)
             return {};
-        const judgeMissing = !isBoundaryOwner(context);
+        // A layout owner may draw no Page (a pure frame); a boundary owner draws its notice.
+        const judgeMissing = kind === "pages" && !isBoundaryOwner(context);
+        let segment = null;
+        /** The segment layout above the page owner's routes, read once and only when a finding needs it. */
+        const framedBy = () => {
+            segment ??= kind === "pages" ? segmentFrame(context) : { some: false, every: false, layout: null };
+            return segment;
+        };
         const pureHalf = new Set();
+        const appImports = new Set();
+        const frames = new Set();
         let first = null;
         let drawsPage = false;
+        /** True when the element draws the route's `Page`: a `Page`, or an app block whose source draws one. */
+        const drawsFrame = (element, name) => {
+            if (name === "Page")
+                return true;
+            const opening = element.openingElement.name;
+            return opening.type === "JSXIdentifier" && appImports.has(opening.name) && blockDrawsPage(context, element.openingElement);
+        };
         return {
             ImportDeclaration(declaration) {
-                if (!PURE_HALF.test(String(declaration.source.value)))
+                const source = String(declaration.source.value);
+                const into = PURE_HALF.test(source) ? pureHalf : APP_SOURCE.test(source) ? appImports : null;
+                if (into === null || declaration.importKind === "type")
                     return;
                 for (const specifier of declaration.specifiers)
-                    pureHalf.add(specifier.local.name);
+                    into.add(specifier.local.name);
             },
             JSXElement(element) {
                 first ??= element;
@@ -121,17 +167,33 @@ export const routePageIsOnePage = defineRule({
                     context.report({ node: element, messageId: "part", data: { name } });
                     return;
                 }
-                if (name !== "Page")
+                if (!drawsFrame(element, name))
                     return;
                 drawsPage = true;
+                frames.add(element);
+                const label = name ?? "Page";
+                const framer = framedBy();
+                if (framer.some) {
+                    const layout = framer.layout ?? "layout";
+                    context.report({ node: element, messageId: "twice", data: { name: label, framer: ` (the segment layout \`${layout}\` draws it; a page under it draws its body only)` } });
+                    return;
+                }
+                for (let outer = enclosingElement(element); outer; outer = enclosingElement(outer)) {
+                    if (!frames.has(outer))
+                        continue;
+                    context.report({ node: element, messageId: "twice", data: { name: label, framer: "" } });
+                    return;
+                }
                 const parent = element.parent;
                 if (parent.type !== "JSXElement" && parent.type !== "JSXFragment")
                     return;
                 if (renderedChildren(parent.children).length > 1)
-                    context.report({ node: element, messageId: "sibling" });
+                    context.report({ node: element, messageId: "sibling", data: { name: label } });
             },
             "Program:exit"() {
-                if (judgeMissing && first !== null && !drawsPage)
+                if (!judgeMissing || first === null || drawsPage || framedBy().every)
+                    return;
+                if (!mountedOnlyUnderAuthGroup(context))
                     context.report({ node: first, messageId: "missing" });
             },
         };

package/docs/page.md

@@ -2,7 +2,7 @@
 
 Law module: `page.ts`. Catalogue: R324 FE_PAGE_TABS_OUTSIDE_HEADER, R325 FE_ROUTE_PAGE_OUTSIDE_PAGE.
 
-Grammar's `Page` is a route page: the header band full width, then the body inside the page measure and gutter one region step below it. It is the single owner of the page inset and the page rhythm, so the page tabs belong to its header and nothing of the page sits beside it.
+Grammar's `Page` is a route page: the header band full width, then the body inside the page measure and gutter one region step below it (or, with `chrome="bleed"`, an app surface whose body fills the region). It is the single owner of the page inset and the page rhythm, so the page tabs belong to its header and nothing of the page sits beside it.
 
 Every rule below is an error in `coreGrammarConfig`; none can be switched off or suppressed inline.
 
@@ -31,7 +31,25 @@ A `Tabs` element that is the first element child of a `Page`, or the next elemen
 
 ## `starci-grammar/route-page-is-one-page`
 
-In a page owner (`fe.feature`, kind `pages`), a `Page` with an element sibling in its parent is a finding, and so is any `PageHeader` or `PageContainer`: both are Page's own parts. A page owner file that draws JSX but no `Page`, and draws no element imported from its own pure half (`./component`), is a finding too, reported on its first element: the page has no frame at all. A `Page` alone in a fragment or a provider, and one `Page` per branch of a conditional, are legal. Files outside a page owner are not judged, and the segment boundary owners of FE-BOUNDARY-1 (`*ErrorPage`, `*LoadingPage`, `*NotFoundPage`) are not judged for a missing `Page`: an app-level boundary stands in for whichever page failed or waits and draws its notice.
+A route draws exactly one `Page`. In a page owner (`fe.feature`, kind `pages`) or a layout owner (`fe.feature`, kind `layouts`) the element that draws it is a `Page`, or an element of one of the app's connected blocks (`fe.components`, kind `blocks`, imported from `@/` or a relative path) whose source draws a `Page` in its connected half or in the pure half it draws through (`./component`). The rule reads that block one level deep: a block the block relays to is not followed. This is how a server owner gets a header built from client data: it renders that block as its root and passes the page's content as the block's children.
+
+A tabbed segment has its `Page` in its layout. A route segment `layout` file (`src/app/**/layout.tsx`) frames every route `page` below it; when it, or a layout owner it renders (through that owner, its pure half or its one root block, as above), draws a `Page` whose `header` carries `tabs` (an object literal written in place or held in a `const` of the same file), that `Page` is the one `Page` of every route under the segment. For a page owner the rule finds the route `page` files that import it, walks up from each through the `layout` files of the segments above it to the app folder, and resolves each layout's owner. A layout whose `Page` carries no `tabs` frames no segment: the pages under it draw their own.
+
+Findings, each reported on the element:
+
+- `sibling`: an element that draws the `Page` has an element sibling in its parent, in a page owner or a layout owner.
+- `twice`: an element that draws a `Page` sits inside another one (a `Page` in a `Page`, or a block that draws one inside a `Page` or inside the root block), or sits in a page owner mounted by a route under a segment layout that draws the `Page`; the finding names that layout.
+- `part`: any `PageHeader` or `PageContainer` in a page or layout owner: both are Page's own parts.
+- `missing`: a page owner file draws JSX but nothing that draws the `Page`, and draws no element imported from its own pure half, reported on its first element: the page has no frame at all.
+
+A `Page` (or the root block) alone in a fragment or a provider, and one per branch of a conditional, are legal; the root block's children are the page body. Not judged for `missing`:
+
+- files outside a page owner, a layout owner (a pure frame draws no `Page`), and a page owner that draws no JSX: its body only calls `redirect()` or `notFound()`, or returns null, so it draws no UI;
+- a page owner every route of which lies under a segment layout that draws the `Page`: it draws body content only;
+- the segment boundary owners of FE-BOUNDARY-1 (`*ErrorPage`, `*LoadingPage`, `*NotFoundPage`): an app-level boundary stands in for whichever page failed or waits and draws its notice;
+- an auth page: every route `page` file of the app (`src/app/**/page.tsx`) that imports the owner (`@/features/pages/<Owner>`) lies under the route group `(auth)`, and that group has its own `layout`. The Grammar ships no auth frame; the app's `(auth)` layout draws it, and it is the page frame of the sign-in, sign-up, password and callback pages it holds. An owner no route mounts, one also mounted outside the group, or a group without a layout gets no exemption.
+
+A workbench page is an ordinary page: it draws its `Page` like any other, usually through its root block.
 
 **Invalid** (`src/features/pages/ConnectionPage/component.tsx`)
 
@@ -51,6 +69,15 @@ In a page owner (`fe.feature`, kind `pages`), a `Page` with an element sibling i
 </>
 ```
 
+**Invalid** (`src/features/pages/DecisionsPage/component.tsx`, `DecisionsBoard` draws the `Page`)
+
+```tsx
+<>
+  <Banner />
+  <DecisionsBoard />
+</>
+```
+
 **Valid**
 
 ```tsx
@@ -59,6 +86,54 @@ In a page owner (`fe.feature`, kind `pages`), a `Page` with an element sibling i
 </Page>
 ```
 
+**Valid** (`src/features/pages/AgentProfilePage/component.tsx`, the connected block `AgentProfileHead` draws the `Page` from client data)
+
+```tsx
+<AgentProfileHead agentId={agentId}>
+  <AgentProfileOwner agentId={agentId} />
+  <AgentProfileRecent agentId={agentId} />
+</AgentProfileHead>
+```
+
+**Valid** (`src/features/pages/ChatPage/component.tsx`'s root block `AgentChat` draws an app surface under the trail alone)
+
+```tsx
+<Page chrome="bleed" header={{ breadcrumbs }}>
+  <FillViewport minHeight="md" bottomInset="page">
+    <SurfaceCard ariaLabel={label} composition="joined" height="fill">{rail}{thread}</SurfaceCard>
+  </FillViewport>
+</Page>
+```
+
+**Valid** (`src/features/layouts/InstanceLayout/component.tsx` frames the segment `app/**/[instance]/layout.tsx`; its root block `InstanceFrame` draws `<Page header={{ title, tabs: { label, items } }}>{children}</Page>`, items with `href`)
+
+```tsx
+<InstanceFrame instanceId={instanceId}>{children}</InstanceFrame>
+```
+
+and a page owner under it draws its body only:
+
+```tsx
+<SettingsGrid instanceId={instanceId} />
+```
+
+**Invalid** (`src/features/layouts/InstanceLayout/component.tsx`: the head drawn beside the segment's `Page`)
+
+```tsx
+<>
+  <InstanceHeader instanceId={instanceId} />
+  <Page>{children}</Page>
+</>
+```
+
+**Invalid** (`src/features/pages/SettingsPage/component.tsx` under that segment: a second `Page`)
+
+```tsx
+<Page header={{ title: "Settings" }}>
+  <SettingsGrid instanceId={instanceId} />
+</Page>
+```
+
 **Finding code:** `FE_ROUTE_PAGE_OUTSIDE_PAGE`
 
 Rule ownership: [FE-RULE-OWNERSHIP](../../../contexts/code/fe/README.md#the-placement-test-fe-rule-ownership).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-grammar-core",
-  "version": "0.15.6",
+  "version": "0.15.10",
   "description": "ESLint rules for the core Grammar's component, token and composition contracts.",
   "keywords": [
     "eslint",
@@ -41,7 +41,7 @@
     "node": ">=22"
   },
   "peerDependencies": {
-    "@starci/eslint-canon-fe": "9.4.5",
+    "@starci/eslint-canon-fe": "9.4.9",
     "eslint": ">=9",
     "typescript": ">=5.9"
   },

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.6
+    version: 0.15.10
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.6.4
+    version: 3.6.8
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.4.5
+    version: 9.4.9
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.6
+    version: 0.15.10
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.6
+    version: 0.15.10
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.9.8
+    version: 4.9.11
     group: starci
     install: registry
     side: both
@@ -241,6 +241,16 @@ pins:
     group: framework
     side: be
     why: readiness probes with dependency indicators use Terminus (the liveness route of the scaffolded skeleton does not, being a thin door over the liveness service); every measured product back end resolves 11.1.1.
+  '@langchain/core':
+    version: 1.3.1
+    group: framework
+    side: be
+    why: 'the LangChain core of the one AI integration (BE-AI-3): prompt templates, output parsers, runnables and BaseRetriever; @langchain/openai takes it as its peer. The registry latest on 2026-10-29.'
+  '@langchain/openai':
+    version: 1.8.0
+    group: framework
+    side: be
+    why: 'ChatOpenAI and OpenAIEmbeddings of the one AI integration, pointed at the ai-router gateway with a virtual key (BE-AI-1, BE-AI-3, R327); peer @langchain/core ^1.3.1. The registry latest on 2026-10-29.'
   '@nestjs/cqrs':
     version: 11.0.3
     group: framework

package/runtime/knowledge/hfs/rules.yaml

@@ -1820,7 +1820,7 @@ rules:
       - {path: packages/eslint/be/be-r89-source-form-coverage.spec.mjs, edition: full, codes: [BE_SOURCE_FORM, BE_PUBLIC_CONTRACT_FORM]}
   - id: R90
     code: "BE_INFRA_OWNER"
-    law: "Each raw infrastructure library (HTTP, cache, queue, scheduler, logger, date, config, events) is imported or referenced only by its one owning platform or integration capability, and the `HttpClient` port of `platform/http` is called only by an `integrations` capability."
+    law: "Each raw infrastructure library (HTTP, cache, queue, scheduler, logger, date, config, events, model SDKs) is imported or referenced only by its one owning platform or integration capability, and the `HttpClient` port of `platform/http` is called only by an `integrations` capability."
     kinds: [lint, codemod]
     failureCodes: ["BE_INFRA_OWNER"]
     enforcers:
@@ -5756,3 +5756,74 @@ rules:
         source: owner
         quote: "ok trò"
         ruling: "A route page is one Grammar Page (owner ruling page-frame): the single owner of the page inset and rhythm; the lint refuses a sibling beside the Page and a bare PageHeader or PageContainer in a page owner."
+  - id: R326
+    code: "BE_AI_KEY_CUSTODY"
+    law: "An upstream model provider key variable (OPENROUTER_API_KEY, OPENAI_API_KEY and the rest of the canon's one list) is named only inside the ai-router gateway's custody owner integrations/ai-gateway, in a literal, a member or a destructured property; every other file reaches a model through the gateway with a virtual key."
+    kinds: [lint]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["BE_AI_KEY_CUSTODY"]
+    enforcers:
+      - {kind: eslint-be, id: provider-key-custody}
+    editions: [lite, full]
+    docs: [contexts/code/be/ai.md]
+    templateNa: "The skeleton scaffolds no model call; an app adds the ai and ai-gateway integrations when it calls a model."
+    proves:
+      - packages/eslint-canon-be/src/ai-gateway.spec.ts
+    exemplifiedBy:
+      - {path: packages/eslint-canon-be/src/ai-gateway.spec.ts, editions: [lite, full], codes: [BE_AI_KEY_CUSTODY]}
+    witness:
+      - {path: packages/eslint-canon-be/src/ai-gateway.spec.ts, editions: [lite, full], codes: [BE_AI_KEY_CUSTODY]}
+    cases:
+      - id: case-1
+        date: "2026-10-29"
+        source: owner
+        quote: "nhớ làm langchain nhé update .claude lun là call thẳng từ code phải dùng langchain với embeded context"
+        ruling: "A model call made straight from code uses LangChain with retrieved context, through the ai-router gateway (owner ruling be-ai-langchain-gateway): only the gateway's custody owner reads a provider key."
+  - id: R327
+    code: "BE_AI_GATEWAY_CLIENT"
+    law: "Code builds only the ChatOpenAI and OpenAIEmbeddings clients of @langchain/openai, each from an inline options object with no spread, its configuration.baseURL read from a <c>.options.ts type and its apiKey the reveal() of a platform/config Secret, so every model call goes through the ai-router gateway with a virtual key."
+    kinds: [lint]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["BE_AI_GATEWAY_CLIENT"]
+    enforcers:
+      - {kind: eslint-be, id: ai-client-through-gateway}
+    editions: [lite, full]
+    docs: [contexts/code/be/ai.md]
+    templateNa: "The skeleton scaffolds no model call; an app adds the ai and ai-gateway integrations when it calls a model."
+    proves:
+      - packages/eslint-canon-be/src/ai-gateway.spec.ts
+    exemplifiedBy:
+      - {path: packages/eslint-canon-be/src/ai-gateway.spec.ts, editions: [lite, full], codes: [BE_AI_GATEWAY_CLIENT]}
+    witness:
+      - {path: packages/eslint-canon-be/src/ai-gateway.spec.ts, editions: [lite, full], codes: [BE_AI_GATEWAY_CLIENT]}
+    cases:
+      - id: case-1
+        date: "2026-10-29"
+        source: owner
+        quote: "nhớ làm langchain nhé update .claude lun là call thẳng từ code phải dùng langchain với embeded context"
+        ruling: "A model call made straight from code uses LangChain with retrieved context, through the ai-router gateway (owner ruling be-ai-langchain-gateway): the LangChain clients point at the gateway's base URL with its virtual key."
+  - id: R333
+    code: "BE_ENTITY_SCHEMA_DRIFT"
+    law: "Every TypeORM entity column of an app's entity list (be/src/platform/database/entities.ts) matches the schema its SQL migrations build: `starci app db drift` applies db/bootstrap.sql and every active db/migrations/*.sql to a scratch database (a container of the app's db image, or the empty database --url-env names), reads information_schema.columns and pg_catalog, and refuses a missing table, a missing column, a type that differs once both are normalised to PostgreSQL's format_type names (an enum by its type name), and a nullability that differs. A database column no entity maps is fine. A host that cannot provide the scratch database gets no verdict (exit 2, needs a database), never a green."
+    kinds: [check]
+    gates: [ci]
+    failureCodes: ["BE_ENTITY_SCHEMA_DRIFT"]
+    enforcers:
+      - {kind: hfs, id: db-drift, at: packages/hfs/db/drift.mjs}
+    editions: [lite]
+    editionWhy: "The owner ruling of 2026-10-29 maps lite tables with TypeORM entities while db/migrations/*.sql stays the only DDL and synchronize is false, so only lite entities can drift from a schema they do not create; full entities ship with their own TypeORM migrations."
+    docs: [contexts/code/be/persistence.md]
+    templateNa: "The entities and the migrations are the product's tables; the check judges whichever an app writes, and a template scaffolds no table."
+    proves:
+      - {path: packages/hfs/src/db-drift.spec.mjs, edition: lite, codes: [BE_ENTITY_SCHEMA_DRIFT]}
+      - {path: packages/hfs/src/db-drift-docker.spec.mjs, edition: lite, codes: [BE_ENTITY_SCHEMA_DRIFT]}
+    exemplifiedBy:
+      - {path: packages/hfs/src/db-drift.spec.mjs, edition: lite, codes: [BE_ENTITY_SCHEMA_DRIFT]}
+    witness:
+      - {path: packages/hfs/src/db-drift.spec.mjs, edition: lite, codes: [BE_ENTITY_SCHEMA_DRIFT]}
+    cases:
+      - id: case-1
+        date: "2026-10-29"
+        source: owner
+        quote: "lite persistence moves to TypeORM entities while db/migrations/*.sql stays the only DDL and synchronize is false"
+        ruling: "Lite entities only map tables the migrations create, so each entity column is checked against the migrated schema by starci app db drift, which CI runs in the build job and the release gate runs as its db-drift row."

package/runtime/knowledge/hfs/slots.yaml

@@ -254,6 +254,25 @@ ruleParams:
       "@socket.io/postgres-adapter": [platform/realtime]   # the stateless socket.io adapter of a scaled lite back end without Redis
       "@socket.io/redis-adapter": [platform/realtime]      # the sharded socket.io adapter of a scaled back end on the declared Redis
       pg: [platform/realtime]                              # the LISTEN connection of the Postgres hub; every other query goes through TypeORM
+      # BE-AI-1, BE-AI-3: every model call goes through the ai-router gateway. Its custody owner registers @starci/ai-router with the
+      # provider keys; the one LangChain integration owns @langchain/*; no provider SDK, openai client or agent framework is imported.
+      "@starci/ai-router": [integrations/ai-gateway]
+      "@starci/ai-router/testing": [integrations/ai-gateway, integrations/ai]   # the fake provider a spec of either side boots the gateway with
+      "@langchain": [integrations/ai]       # a scope key: every @langchain/* package
+      "@langchain/langgraph": []            # an agent loop runs in the agent runtime, never in code
+      "@langchain/community": []            # retrieval reads the app's own persistence through its owner
+      langchain: []                          # createAgent is an agent loop
+      openai: []                             # code calls models through @langchain/openai
+      "@anthropic-ai/sdk": []
+      "@google/genai": []
+      "@google/generative-ai": []
+      "@mistralai/mistralai": []
+      "@openrouter/ai-sdk-provider": []
+      "@ai-sdk": []
+      ai: []
+      cohere-ai: []
+      groq-sdk: []
+      ollama: []
     # R87 BE_CQRS_SHAPE no-event-bus: the in-process event vocabulary the rule refuses. `imports` maps a module
     # specifier to the member names that are an in-process event; `[]` flags the package itself (its emitter packages
     # are the `[]` owners of infraOwners above). `classes` maps a module specifier to the class names that are an
@@ -1892,7 +1911,7 @@ slots:
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts; plus src/tests/integration/<provider>/ (R112)
     coverage: required
     budget: {indexExports: 80}   # a provider's port surface includes clients, config, options, tokens and errors
-    rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INTEGRATION_SPEC_MISSING]
+    rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INTEGRATION_SPEC_MISSING, BE_AI_KEY_CUSTODY, BE_AI_GATEWAY_CLIENT]
   - id: be.integrations.model
     since: 3.1.0
     profiles: [be]
@@ -1902,7 +1921,7 @@ slots:
     tier: integrations
     tests: none
     coverage: required
-    why: an ML or LLM model client is an integration; weights and datasets are never in git
+    why: a self-hosted ML model client is an integration; weights and datasets are never in git, and a language model is called through the ai-router gateway by the integrations/ai LangChain client (BE-AI-1, BE-AI-3)
     rules: [BE_TIER_DIRECTION, BE_INFRA_OWNER, BE_INTEGRATION_SPEC_MISSING]
 
   - id: be.integrations.supabase