@starci/hfs 1.0.1 → 2.0.0

package/runtime/knowledge/hfs/slots.yaml

@@ -42,9 +42,13 @@ versioning:
 #   requiredWhen       connections: required only when hfs.json declares a database connection.
 #   allows / forbids   names inside the instance; the loader exposes them, slot-check enforces them.
 #   tests       unit-beside | e2e | none.
+#   composedBy  the app kinds allowed to compose a transport slot (an app of another kind imports none of its modules).
 #   budget      size budgets (lines per file, files per slot, exports).
 #   appKind     the app kind of hfs.json apps[].kind whose directory this slot describes.
-#   managedBy   template id that hfs sync renders; a difference is HFS_MANAGED_FILE_DRIFT.
+#   managedBy   the template directory hfs sync renders this slot's files from. The slot path then lists literal files
+#               only, and each is rendered from templates/<profile or common>/<managedBy>/<path, leading dots dropped>;
+#               the managed file list lives here and nowhere in code. A difference is HFS_MANAGED_FILE_DRIFT (a
+#               back end's tsconfig.json: HFS_TS_STRICT when a flag or an option was added).
 #   rules       rule ids (the catalog lands with knowledge/hfs/rules.yaml).
 #   since / retiredIn / successor   lifecycle.
 presenceValues: [required, optional, opt-in, forbidden]
@@ -80,7 +84,6 @@ tiers:
     foundation:   {mayImport: [foundation, package], acyclic: true}               # modules/{config,i18n,routes,types}
     modules:      {mayImport: [foundation, modules, transport, package], acyclic: true}
     transport:    {mayImport: [foundation, modules, package]}                     # modules/api: the one fetch
-    e2e:          {mayImport: [e2e, package]}                                     # black box: no app source
     package:      {mayImport: [package]}
 crossOwner: every import across owners targets the owner's public entry (index.ts or index.tsx); never export *.
 crossApp: apps never import each other; shared code is a packages/<pkg> slot.
@@ -88,18 +91,69 @@ crossApp: apps never import each other; shared code is a packages/<pkg> slot.
 # Parameters the lint factories and checks read per profile (through ruleParams(profile) in scripts/lib/hfs-slots.mjs).
 ruleParams:
   be:
-    # BE_MODULE_SHAPE: the only modules that may be @Global(); directories under src/modules/platform/.
-    globalModules: [src/modules/platform/config/, src/modules/platform/logging/, src/modules/platform/database/]
     # HFS_SIZE_GROWTH: a file above soft may not grow against its parent commit; a new file stays within soft.
     fileLines: {soft: 500, hardGrowth: true}
     # R21 HFS_DUPLICATE_CODE: the ONE threshold of duplicate code (the architecture machine reads it here; no other file states it):
     # a token-normalised block of at least `lines` source lines and `tokens` tokens that appears twice.
     duplicateBlock: {lines: 8, tokens: 60}
+    # R90 BE_INFRA_OWNER: raw infrastructure library (a module specifier or a global reference) -> the platform or
+    # integration capabilities allowed to import it; [] means nowhere in a back end. A specifier also covers its subpaths.
+    infraOwners:
+      fetch: [platform/http]
+      axios: [platform/http]
+      got: [platform/http]
+      undici: [platform/http]
+      "node:http": [platform/http]
+      "node:https": [platform/http]
+      http: [platform/http]
+      https: [platform/http]
+      cache-manager: [integrations/cache, integrations/redis]
+      "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability (retired local rule must-use-cache-service)
+      redis: [integrations/cache, integrations/redis]
+      ioredis: [integrations/cache, integrations/redis]
+      bullmq: [platform/messaging]
+      "@nestjs/bullmq": [platform/messaging]
+      kafkajs: [platform/messaging]
+      "@nestjs/schedule": [platform/scheduling, platform/retry, platform/messaging, platform/http]
+      setInterval: [platform/scheduling, platform/retry, platform/messaging, platform/http]
+      setTimeout: [platform/scheduling, platform/retry, platform/messaging, platform/http]
+      "node:timers": [platform/scheduling, platform/retry, platform/messaging, platform/http]
+      "node:timers/promises": [platform/scheduling, platform/retry, platform/messaging, platform/http]
+      winston: [platform/logging]
+      dayjs: [platform/clock, platform/primitives]
+      moment: [platform/clock, platform/primitives]
+      date-fns-tz: [platform/clock, platform/primitives]
+      "@nestjs/config": []
+      dotenv: []
+      "@nestjs/event-emitter": []
+    # R48 BE_SPEC_QUALITY spec-infra-double-from-kit: in a `<name>.service.spec.ts` a provider `{ provide: TOKEN, useValue: X }` takes X from
+    # the kit named here (the package root of `kit`). The token name is normalised to UPPER_SNAKE (`EntityManager` -> ENTITY_MANAGER), the
+    # FIRST entry whose `token` regex matches decides, and `fallback` decides for every other token. `forms` say what X may be:
+    # call = `double(...)`, new = `new Double(...)`, curried = `double(...)(...)`, object = a plain object literal (REAL values),
+    # primitive = a string/number/boolean literal, array = an array literal (multi-providers of doubles). A const bound to such a value counts.
+    specDoubles:
+      kit: "@starci/jest-preset"
+      doubles:
+        - {token: "(?:^|_)OPTIONS$", double: builder, forms: [curried, object]}
+        - {token: "(?:^|_)ENTITY_MANAGER$", double: mockEntityManager, forms: [call]}
+        - {token: "(?:^|_)TRANSACTION(?:_RUNNER)?$", double: fakeTransaction, forms: [call]}
+        - {token: "(?:^|_)CLOCK$", double: FakeClock, forms: [new]}
+        - {token: "(?:^|_)OUTBOX(?:_|$)", double: recordingOutbox, forms: [call]}
+        - {token: "(?:^|_)CACHE(?:_|$)", double: fakeCache, forms: [call]}
+        - {token: "(?:^|_)(?:LOCK|LEASE|FENCE|HOLD)(?:_|$)", double: fakeLock, forms: [call]}
+        - {token: "(?:^|_)(?:IDS|ID_GENERATOR|ID_FACTORY)$", double: fakeIds, forms: [call]}
+      fallback: {double: mock, forms: [call, primitive, array]}
+    # R89 BE_SOURCE_FORM: the closed role-suffix vocabulary of a source file name (<kebab-name>.<suffix>.ts; BE-CONVENTION 1.15)
+    # and the suffixes that are never a role. index.ts, main.ts, app.module.ts and the migrations of be.persistence are the
+    # only names outside it.
+    suffixes: [module, module-definition, decorators, options, config, connection, service, command, query, handler, contracts, port, resolver, controller, gateway, consumer, job, cli, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
+    # R47 BE_CONTRACT_UNGUARDED: the world's shape vocabulary. `helper` names the function a contract spec imports to erase the values of a JSON
+    # payload (`shapeOf`); a contract spec proves a fake's fixtures by asserting helper(real) equals helper(fixture).
+    contractShape: {helper: shapeOf}
+    bannedSuffixes: [use-case, repository, fixture, factory, store, worker, scheduler, cron, listener, dto, util, utils, helper, helpers, rules, types, constants, int-spec, harness-spec, test]
   fe:
     # Slot budgets (component.tsx 300, hooks 200, modules 400) are stricter than this cap where they apply.
     fileLines: {soft: 500, hardGrowth: true}
-    # FE_TRANSPORT_OWNER: the one module per app that may call fetch.
-    clientModule: "apps/<app>/src/modules/api/client.ts"
     duplicateBlock: {lines: 8, tokens: 60}
 
 slots:
@@ -121,14 +175,40 @@ slots:
     tier: none
     tests: none
     rules: [HFS_ARCH_CONFIG_UNREAD]
-  - id: repo.package-manifest
-    profiles: [be, fe]
-    path: "{package.json,package-lock.json}"
+  - id: fe.package-manifest
+    profiles: [fe]
+    path: package.json
+    presence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: package-scripts     # the `scripts` block only; the rest of the file is the repository's
+    rules: [HFS_PACKAGE_MANAGER_MIXED, HFS_DEP_VERSION_SKEW, HFS_CANON_PIN_DRIFT, HFS_MANAGED_FILE_DRIFT]
+  - id: fe.lockfile
+    profiles: [fe]
+    path: package-lock.json
+    presence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PACKAGE_MANAGER_MIXED, HFS_DEP_VERSION_SKEW]
+  - id: be.package-manifest
+    profiles: [be]
+    path: package.json
     presence: required
     tracked: tracked
     tier: none
     tests: none
-    rules: [HFS_PACKAGE_MANAGER_MIXED, HFS_DEP_VERSION_SKEW, HFS_CANON_PIN_DRIFT]
+    managedBy: package-scripts     # the `scripts` block only; the rest of the file is the repository's
+    rules: [HFS_PACKAGE_MANAGER_MIXED, HFS_DEP_VERSION_SKEW, HFS_CANON_PIN_DRIFT, HFS_MANAGED_FILE_DRIFT]
+  - id: be.lockfile
+    profiles: [be]
+    path: package-lock.json
+    presence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PACKAGE_MANAGER_MIXED, HFS_DEP_VERSION_SKEW]
   - id: repo.git-meta
     profiles: [be, fe]
     path: "{.gitignore,.gitattributes}"
@@ -136,47 +216,89 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    managedBy: gitignore-base
-    rules: [HFS_GITIGNORE_BLOCK_DRIFT]
+    rules: [HFS_GITIGNORE_BLOCK_DRIFT]     # the marked block of .gitignore is rendered by hfs sync (templates/<profile>/gitignore)
   - id: repo.tool-config
     profiles: [be, fe]
-    path: "{tsconfig.json,eslint.config.mjs,.editorconfig,.nvmrc,.prettierignore}"
-    presence: required     # each file is a thin extends of a canon package
+    path: "{.editorconfig,.nvmrc}"
+    presence: required     # plain dotfiles, the repository's own
     tracked: tracked
     tier: none
     tests: none
-    managedBy: tool-config
-    rules: [HFS_TOOL_CONFIG_LOCAL, HFS_MANAGED_FILE_DRIFT, HFS_TS_STRICT]
   - id: repo.tool-config-optional
     profiles: [be, fe]
-    path: "{tsconfig.build.json,tsconfig.e2e.json,.npmrc,jest.config.e2e.js}"
+    path: .npmrc
     presence: optional
     tracked: tracked
     tier: none
     tests: none
-    managedBy: tool-config
-    rules: [HFS_TOOL_CONFIG_LOCAL, HFS_MANAGED_FILE_DRIFT]
   - id: be.tool-config
     profiles: [be]
-    path: "{nest-cli.json,jest.config.js}"
+    # Managed files (hfs sync renders them, hfs check compares them): the whole tool configuration of a back end. Each is
+    # a reference to a canon package, never a configuration: tsconfig.json extends @starci/tsconfig/be.json and adds the
+    # three path aliases and excludes the world, integration, e2e and contract trees (fixtures stay in the root program: unit
+    # specs import them); tsconfig.build.json puts an overlay preset after it and adds only the path-relative options a
+    # preset cannot hold; the tests' own src/tests/tsconfig.json (the nearest config of a world, integration, e2e or contract
+    # file, so typed lint and typecheck:tests both find it) extends it with the e2e preset; eslint.config.mjs is the
+    # one-line starciBeConfig call; jest.config.js calls the @starci/jest-preset factory; .prettierrc names
+    # @starci/prettier-config; .prettierignore is the template.
+    path: "{tsconfig.json,tsconfig.build.json,src/tests/tsconfig.json,eslint.config.mjs,jest.config.js,.prettierrc,.prettierignore}"
     presence: required
     tracked: tracked
     tier: none
     tests: none
     managedBy: tool-config
-    rules: [HFS_TOOL_CONFIG_LOCAL, HFS_MANAGED_FILE_DRIFT]
+    rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL, HFS_TS_STRICT]
+  - id: be.nest-cli
+    profiles: [be]
+    path: nest-cli.json
+    presence: required
+    tracked: tracked
+    tier: none
+    tests: none
+  - id: be.tool-config-local
+    profiles: [be]
+    path: "{.eslintrc,.eslintrc.*,.eslintignore,eslint.config.js,eslint.config.cjs,eslint.config.ts,eslint.config.mts,eslint.config.cts,.prettierrc.*,prettier.config.*,jest.config.ts,jest.config.mjs,jest.config.cjs,jest.config.json,jest.config.e2e.js}"
+    presence: forbidden
+    tracked: external
+    tier: none
+    tests: none
+    goesTo: "nowhere: a back end has exactly the managed tool configuration (be.tool-config); a change to a rule or a flag is proposed in the .claude runtime"
+    rules: [HFS_TOOL_CONFIG_LOCAL]
   - id: fe.tool-config
     profiles: [fe]
-    path: "{vitest.config.ts,vitest.setup.ts,playwright.config.ts,turbo.json}"
-    presence: optional
+    # Managed files (hfs sync renders them, hfs check compares them): the tool configuration of a front end. Each is a
+    # reference to a canon package, never a configuration: tsconfig.json extends @starci/tsconfig/next.json and only
+    # names the preset and nothing else (each app's own tsconfig.json, in fe.app.next, carries its aliases and include; there is
+    # no test tsconfig: a front end has no tests, FE_NO_TESTS); eslint.config.mjs is the one-line starciFeConfig call;
+    # stylelint.config.mjs is the one-line starciStylelintConfig call; .prettierrc names @starci/prettier-config;
+    # .prettierignore is the template. A front end has no test configuration at all (FE_NO_TESTS).
+    path: "{tsconfig.json,eslint.config.mjs,stylelint.config.mjs,.prettierrc,.prettierignore}"
+    presence: required
     tracked: tracked
     tier: none
     tests: none
     managedBy: tool-config
-    rules: [HFS_TOOL_CONFIG_LOCAL, HFS_MANAGED_FILE_DRIFT]
+    rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL, HFS_RULE_OFF_WITHOUT_REPLACEMENT, HFS_TS_STRICT]
+  - id: fe.tool-config-repo
+    profiles: [fe]
+    # The one tool file a preset cannot render because it carries the repository's own facts: turbo.json (its task graph).
+    path: turbo.json
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+  - id: fe.tool-config-local
+    profiles: [fe]
+    path: "{.eslintrc,.eslintrc.*,.eslintignore,eslint.config.js,eslint.config.cjs,eslint.config.ts,eslint.config.mts,eslint.config.cts,.stylelintrc,.stylelintrc.*,.stylelintignore,stylelint.config.js,stylelint.config.cjs,stylelint.config.ts,stylelint.config.json,prettier.config.*,.prettierrc.*,lint-staged.config.*,.lintstagedrc*}"
+    presence: forbidden
+    tracked: external
+    tier: none
+    tests: none
+    goesTo: "nowhere: a front end has exactly the managed tool configuration (fe.tool-config); a change to a rule or a flag is proposed in the .claude runtime"
+    rules: [HFS_TOOL_CONFIG_LOCAL]
   - id: repo.quality-config
     profiles: [be, fe]
-    path: "{sonar-project.properties,codecov.yml}"
+    path: sonar-project.properties
     presence: required
     tracked: tracked
     tier: none
@@ -190,7 +312,7 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    managedBy: husky
+    managedBy: hooks
     rules: [HFS_CI_E2E_AUTOMATIC, HFS_MANAGED_FILE_DRIFT]
   - id: repo.ci
     profiles: [be, fe]
@@ -202,7 +324,7 @@ slots:
     managedBy: ci-workflows
     rules: [HFS_CI_E2E_AUTOMATIC, HFS_CI_MISSING_CANON, HFS_MANAGED_FILE_DRIFT]
   - id: repo.ci-e2e
-    profiles: [be, fe]
+    profiles: [be]
     path: ".github/workflows/e2e.yml"
     presence: optional     # on: workflow_dispatch only
     tracked: tracked
@@ -219,12 +341,15 @@ slots:
     tests: none
   - id: repo.scripts
     profiles: [be, fe]
-    path: "scripts/<name>.mjs"
+    # The repository's operational scripts only (`*.mjs`, `*.cjs`, `*.ps1`, `*.sh`), or nothing: an empty folder is `scripts/.gitkeep`, which hfs sync --init writes
+    # when the folder is missing. A spec or a test (BE_SPEC_PLACEMENT, FE_NO_TESTS), a check or lint source (`check-*`, `eslint-local-rules*`, a local eslint
+    # plugin: HFS_REPO_LOCAL_CHECK) and anything that re-implements a canon check is not an operational script and has no place here.
+    path: "scripts/{.gitkeep,*.mjs,*.cjs,*.ps1,*.sh}"
     presence: optional
     tracked: tracked
     tier: none
     tests: none
-    rules: [HFS_SCRIPT_ONE_OFF]     # one-off codemods and fix-* scripts are agent output, not tooling
+    rules: [HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]     # one-off codemods and fix-* scripts are agent output, not tooling
   - id: repo.docs
     profiles: [be, fe]
     path: "docs/{adr,runbooks,guides}/**/*.md"
@@ -269,7 +394,7 @@ slots:
   # ----- never tracked: build output the tools need in place ---------------------------------------------
   - id: repo.build-output
     profiles: [be, fe]
-    path: "{**/node_modules/,dist/,apps/*/dist/,packages/*/dist/,.next/,apps/*/.next/,coverage/,test-results/,playwright-report/,**/next-env.d.ts,**/*.tsbuildinfo}"
+    path: "{**/node_modules/,dist/,apps/*/dist/,packages/*/dist/,.next/,apps/*/.next/,coverage/,reports/,test-results/,**/next-env.d.ts,**/*.tsbuildinfo}"
     presence: optional
     tracked: ignored
     tier: none
@@ -335,7 +460,7 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    why: emitted by `npm run contract:emit`; CI fails when the emitted file differs (a contract, not a build artefact)
+    why: emitted by `npm run contract:emit` (`hfs emit-contracts`, never written by hand); CI fails when the emitted file differs (a contract, not a build artefact)
     rules: [HFS_CONTRACT_SNAPSHOT_DRIFT]
   - id: be.contract.openapi
     profiles: [be]
@@ -344,6 +469,7 @@ slots:
     tracked: tracked
     tier: none
     tests: none
+    why: emitted by `npm run contract:emit` (`hfs emit-contracts`, never written by hand) from the app's typed operation table `apps/<app>/src/operations.ts` (canon BE-OPERATIONS-1); CI fails when the emitted file differs
     rules: [HFS_CONTRACT_SNAPSHOT_DRIFT]
   - id: fe.contract.copy
     profiles: [fe]
@@ -365,9 +491,9 @@ slots:
     tier: app
     owner: true
     minInstances: 1
-    requires: [main.ts, app.module.ts, "<app>.composition.spec.ts"]
-    allows: [main.ts, app.module.ts, "<app>.composition.spec.ts", "<app>.options.ts"]
-    tests: unit-beside            # the composition spec boots the REAL AppModule with stubbed options
+    requires: [main.ts, app.module.ts]
+    allows: [main.ts, app.module.ts, "<app>.options.ts", operations.ts]
+    tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
     budget: {app.module.ts: 250, main.ts: 80}
     rules: [BE_APP_COMPOSITION_ONLY, BE_APP_BUSINESS_ROLE, BE_DEFAULT_DENY, BE_ERROR_MASKED, BE_FEATURE_NOT_COMPOSED]
   - id: be.app.worker
@@ -378,8 +504,9 @@ slots:
     tracked: tracked
     tier: app
     owner: true
-    requires: [main.ts, app.module.ts, "<app>.composition.spec.ts"]
-    tests: unit-beside
+    requires: [main.ts, app.module.ts]
+    allows: [main.ts, app.module.ts, "<app>.options.ts"]
+    tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
     rules: [BE_APP_COMPOSITION_ONLY, BE_BACKGROUND_UNOWNED]
   - id: be.app.migrate
     profiles: [be]
@@ -390,8 +517,9 @@ slots:
     tracked: tracked
     tier: app
     owner: true
-    requires: [main.ts, "<app>.composition.spec.ts"]
-    tests: unit-beside
+    requires: [main.ts]
+    allows: [main.ts, "<app>.options.ts"]
+    tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
     rules: [BE_SCHEMA_AUTHORITY, BE_ENTRYPOINT_ONLY_IN_APPS]
   - id: be.app.cli
     profiles: [be]
@@ -401,8 +529,9 @@ slots:
     tracked: tracked
     tier: app
     owner: true
-    requires: [main.ts, app.module.ts, "<app>.composition.spec.ts"]
-    tests: unit-beside
+    requires: [main.ts, app.module.ts]
+    allows: [main.ts, app.module.ts, "<app>.options.ts"]
+    tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
 
   # ----- BE: features ------------------------------------------------------------------------------------
   - id: be.feature
@@ -415,7 +544,7 @@ slots:
     minInstances: 1
     requires: [index.ts, "<feature>.module.ts", application/]
     allows: [index.ts, "<feature>.module.ts", application/, transport/, messages/]   # nothing else at feature root
-    tests: unit-beside
+    tests: none
     budget: {files: 250, indexExports: 60}   # a feature above 250 source files must be split by product capability
     rules: [BE_FEATURE_SHAPE, BE_FEATURE_IMPORTS_FEATURE, BE_PUBLIC_SURFACE, BE_FEATURE_NOT_COMPOSED]
   - id: be.feature.application
@@ -424,19 +553,19 @@ slots:
     presence: required
     tracked: tracked
     tier: feature
-    allows: ["<action>.use-case.ts", "<action>.contracts.ts", "<action>.{command,query,handler}.ts", "*.spec.ts"]
+    allows: ["<action>.{command,query,handler,contracts}.ts"]
     forbids: [graphql/, http/, message/, schedule/, transport/]   # no protocol names under application/
-    tests: unit-beside
-    rules: [BE_APPLICATION_IMPORTS_TRANSPORT, BE_APPLICATION_TRANSPORT_FRAMEWORK, BE_ENTITY_IN_CONTRACT]
+    tests: none
+    rules: [BE_APPLICATION_IMPORTS_TRANSPORT, BE_APPLICATION_TRANSPORT_FRAMEWORK, BE_ENTITY_IN_CONTRACT, BE_CQRS_SHAPE]
   - id: be.feature.application.support
     profiles: [be]
     path: "src/features/<feature>/application/support/"
     presence: optional            # helpers and types local to ONE feature; same tier as application, never a shared home
     tracked: tracked
     tier: feature                 # feature tier: another feature cannot import it (features never import features)
-    allows: ["<name>.ts", "<name>.types.ts", "*.spec.ts"]
+    allows: ["<name>.<role>.ts"]     # <role> from ruleParams.be.suffixes; no <name>.types.ts
     forbids: [graphql/, http/, message/, schedule/, transport/]
-    tests: unit-beside            # a <name>.spec.ts beside every <name>.ts
+    tests: none
     rules: [BE_APPLICATION_IMPORTS_TRANSPORT, BE_APPLICATION_TRANSPORT_FRAMEWORK, BE_FEATURE_IMPORTS_FEATURE]
     since: 1.0.0
   - id: be.transport.http
@@ -446,9 +575,10 @@ slots:
     tracked: tracked
     tier: feature
     requires: ["<feature>-http.module.ts"]
-    allows: ["<action>.controller.ts", "dto/<action>.{request,response}.ts", "<action>.mapper.ts", "*.spec.ts"]
-    tests: unit-beside
-    rules: [BE_DEFAULT_DENY, BE_INPUT_BOUNDED]
+    allows: ["<action>.controller.ts", "dto/<action>.{request,response}.ts", "<action>.mapper.ts"]
+    tests: none
+    composedBy: [api]
+    rules: [BE_DEFAULT_DENY, BE_INPUT_BOUNDED, BE_TRANSPORT_SHAPE]
   - id: be.transport.graphql
     profiles: [be]
     path: "src/features/<feature>/transport/graphql/"
@@ -456,9 +586,10 @@ slots:
     tracked: tracked
     tier: feature
     requires: ["<feature>-graphql.module.ts"]
-    allows: ["<action>.resolver.ts", "dto/<action>.{input,type,args}.ts", "<action>.mapper.ts", "*.spec.ts"]
-    tests: unit-beside
-    rules: [BE_DEFAULT_DENY, BE_INPUT_BOUNDED]
+    allows: ["<action>.resolver.ts", "dto/<action>.{input,type,args}.ts", "<action>.mapper.ts"]
+    tests: none
+    composedBy: [api]
+    rules: [BE_DEFAULT_DENY, BE_INPUT_BOUNDED, BE_TRANSPORT_SHAPE]
   - id: be.transport.message
     profiles: [be]
     path: "src/features/<feature>/transport/message/"
@@ -466,8 +597,9 @@ slots:
     tracked: tracked
     tier: feature
     requires: ["<feature>-message.module.ts"]
-    allows: ["<event>.consumer.ts", "<event>.message.ts", "*.spec.ts"]
-    tests: unit-beside
+    allows: ["<event>.consumer.ts"]     # BE-CONVENTION 1.6: transport/message holds only consumers; a .message.ts is outside the closed suffix list
+    tests: none
+    composedBy: [worker]
     rules: [BE_BACKGROUND_UNOWNED]
   - id: be.transport.schedule
     profiles: [be]
@@ -476,8 +608,9 @@ slots:
     tracked: tracked
     tier: feature
     requires: ["<feature>-schedule.module.ts"]
-    allows: ["<job>.job.ts", "*.spec.ts"]
-    tests: unit-beside
+    allows: ["<job>.job.ts"]
+    tests: none
+    composedBy: [worker]
     rules: [BE_BACKGROUND_UNOWNED]
   - id: be.transport.websocket
     profiles: [be]
@@ -486,18 +619,20 @@ slots:
     tracked: tracked
     tier: feature
     requires: ["<feature>-websocket.module.ts"]
-    allows: ["<channel>.gateway.ts", "dto/*.ts", "*.spec.ts"]
-    tests: unit-beside
+    allows: ["<channel>.gateway.ts", "dto/*.ts"]
+    tests: none
+    composedBy: [api]
     since: 1.0.0
   - id: be.feature.transport.cli
     profiles: [be]
     path: "src/features/<feature>/transport/cli/"
-    presence: opt-in              # a command line entry: calls application use cases only, composed by an app of kind cli
+    presence: opt-in              # a command line entry: dispatches one command or query, composed by an app of kind cli
     tracked: tracked
     tier: feature
     requires: ["<feature>-cli.module.ts"]
-    allows: ["<command>.command.ts", "dto/*.ts", "*.spec.ts"]
-    tests: unit-beside
+    allows: ["<name>.cli.ts", "dto/*.ts"]     # .cli.ts: .command.ts is a CQRS message (HFS delta 3)
+    tests: none
+    composedBy: [cli]
     rules: [BE_APPLICATION_IMPORTS_TRANSPORT, BE_FEATURE_NOT_COMPOSED, BE_ENTRYPOINT_ONLY_IN_APPS]
     since: 1.0.0
 
@@ -510,9 +645,9 @@ slots:
     tier: domain
     owner: true
     requires: [index.ts]
-    allows: ["<capability>.module.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.contracts.ts", "*.spec.ts"]
+    allows: ["<capability>.module.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts"]
     forbids: [testing/, exceptions/, utils/, helpers/, shared/]
-    tests: unit-beside
+    tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_PUBLIC_SURFACE, BE_ERROR_HOME, BE_CONFIG_OWNER]
   - id: be.errors
@@ -521,18 +656,17 @@ slots:
     presence: optional
     tracked: tracked
     tier: inherit
-    allows: ["<capability>.error.ts", "<name>.error.ts", "*.spec.ts"]   # one family per capability, extends platform/errors DomainError
-    tests: unit-beside
+    allows: ["<capability>.error.ts", "<name>.error.ts"]   # one family per capability, extends platform/errors DomainError
+    tests: none
     rules: [BE_ERROR_HOME]
   - id: be.domain.messages
     profiles: [be]
-    path: "src/modules/{domain,integrations}/<capability>/messages/"
-    presence: optional            # a capability that raises no user-facing text carries none
+    path: "src/modules/{domain,platform,integrations}/<capability>/messages/"
+    presence: optional            # a capability (any tier) that raises no user-facing text carries none
     tracked: tracked
     tier: inherit
-    requires: [index.ts]
-    allows: ["<capability>.messages.ts", "*.spec.ts"]   # one keyed catalog per capability, vi and en, read through the platform/i18n MessageCatalog port
-    tests: unit-beside
+    allows: ["<capability>.messages.ts"]   # one keyed catalog per capability, vi and en, read through the platform/i18n MessageCatalog port
+    tests: none
     rules: [BE_USER_COPY_LITERAL]
     since: 1.0.0
   - id: be.feature.messages
@@ -541,9 +675,8 @@ slots:
     presence: optional
     tracked: tracked
     tier: feature
-    requires: [index.ts]
-    allows: ["<feature>.messages.ts", "*.spec.ts"]   # one keyed catalog per feature, vi and en, read through the platform/i18n MessageCatalog port
-    tests: unit-beside
+    allows: ["<feature>.messages.ts"]   # one keyed catalog per feature, vi and en, read through the platform/i18n MessageCatalog port
+    tests: none
     rules: [BE_USER_COPY_LITERAL]
     since: 1.0.0
   - id: be.persistence
@@ -552,10 +685,11 @@ slots:
     presence: optional
     tracked: tracked
     tier: inherit
-    requires: [connection.ts]     # export const CONNECTION = "<name from hfs.json connections>"
-    allows: ["entities/<table>.entity.ts", "migrations/<yyyyMMddHHmmss>-<kebab-name>.ts", "<name>.repository.ts", index.ts, "*.spec.ts"]
-    tests: unit-beside
-    rules: [BE_SCHEMA_OWNER, BE_SCHEMA_AUTHORITY, BE_SQL_OUTSIDE_REPOSITORY]
+    requires: [connection.ts]     # the capability's <c>Entities / <c>Migrations arrays (the owner index re-exports the two arrays by name); no CONNECTION alias: the connection is the one the apps register the arrays on
+    allows: ["entities/<table>.entity.ts", "migrations/<epochMs13>-<kebab-name>.ts", "<name>.sql.ts", "<name>.rows.ts", connection.ts]
+    forbids: [index.ts, "<name>.repository.ts"]
+    tests: none
+    rules: [BE_SCHEMA_OWNER, BE_SCHEMA_AUTHORITY, BE_SQL_OUTSIDE_PERSISTENCE]
   - id: be.platform
     profiles: [be]
     path: "src/modules/platform/<capability>/"
@@ -573,7 +707,8 @@ slots:
     requiredInstances: {capability: [config, logging, errors, primitives, clock, i18n]}
     requires: [index.ts]
     forbids: [common/, utils/, shared/, testing/]   # primitives live in platform/primitives
-    tests: unit-beside
+    tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
+    budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE]
   - id: be.integrations
     profiles: [be]
@@ -583,7 +718,8 @@ slots:
     tier: integrations
     owner: true
     requires: [index.ts, "<provider>.config.ts"]
-    tests: unit-beside
+    tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
+    budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT]
   - id: be.integrations.model
     profiles: [be]
@@ -591,42 +727,104 @@ slots:
     presence: opt-in
     tracked: tracked
     tier: integrations
-    tests: unit-beside
+    tests: none
     why: an ML or LLM model client is an integration; weights and datasets are never in git
 
-  # ----- BE: tests ---------------------------------------------------------------------------------------
-  - id: be.tests.e2e
+  # ----- BE: tests (owner test layout 2026-09-30). Unit specs are <name>.service.spec.ts beside their service and nothing else; everything else
+  # lives under src/tests/, one folder per kind, and the folder and the file suffix always agree (a file whose suffix does
+  # not match its folder matches no slot: HFS_SLOT_UNDECLARED).
+  - id: be.tests.world
     profiles: [be]
-    path: "src/tests/e2e/<area>/*.e2e-spec.ts"
+    path: "src/tests/world/"
     presence: optional
     tracked: tracked
     tier: e2e
-    tests: e2e
-    rules: [HFS_CI_E2E_AUTOMATIC, BE_TEST_TOPOLOGY, BE_E2E_FLOW]
-  - id: be.tests.e2e-live
-    profiles: [be]
-    path: "src/tests/e2e/live/<area>/*.e2e-spec.ts"
-    presence: opt-in
-    tracked: tracked
-    tier: e2e
-    tests: e2e
-    why: run only by test:e2e:live (E2E_LIVE=1); excluded from plain test:e2e by folder, never by file name
-  - id: be.tests.e2e-setup
+    allows: [global-setup.ts, global-teardown.ts, use-test-world.ts, fakes/]   # jest globalSetup/globalTeardown default-export (Jest API); plus root files with a role suffix (test-world-files, R47)
+    tests: none
+    why: >-
+      the ONLY test infrastructure location, shared by integration and e2e: global-setup.ts starts the shared
+      infrastructure (containers) and runs apps/migrate's exported bootstrap once; use-test-world.ts exports
+      useTestWorld({ apps: { <name>: { module, listen? } } } | { modules: [...] }) -> world.apps.<name>.api,
+      world.db.<connection> (the shared EntityManager), world.infra.<service> (latency/cut/restore on a REAL service of the repository's
+      own stack, `.starcistacks/<env>`, each behind toxiproxy), world.fake.<provider> (a network-edge fake of an external SaaS started by the world, with
+      failNext/replayWebhook/delay), world.waitFor; fakes/<provider>/ holds the fake servers and payload fixtures, kit/ the inlined test helpers, and the world root may hold role-suffixed helpers (<name>.client.ts, <name>.contracts.ts, ...). Nothing is
+      overridden in the DI container. It is the only test location that may import typeorm's DataSource or testcontainers,
+      call migrate/runMigrations/synchronize, or write process.env.
+  - id: be.tests.world.kit
     profiles: [be]
-    path: "src/tests/e2e/setup/"
+    path: "src/tests/world/kit/"
     presence: optional
     tracked: tracked
     tier: e2e
+    allows: ["<name>.ts"]    # plain kebab names, like platform/primitives (BE-CONVENTION 1.11 names primitives/time.ts): the world's inlined test helpers (poll, free-ports)
     tests: none
-    why: boots the REAL AppModule and overrides providers; no per-lane hand-assembled modules
+    why: the helpers the test world needs (polling, free ports, transports), inlined so the world imports no other repository; a bare <name>.ts entry in allows is what admits a plain name in BE_SOURCE_FORM
   - id: be.tests.fixtures
     profiles: [be]
     path: "src/tests/fixtures/"
     presence: optional
     tracked: tracked
     tier: fixtures
-    tests: unit-beside
-    why: typed data builders and typed mock<T>() doubles; importable by unit specs and e2e; never imports a feature
+    allows: [i18n/]   # i18n/ is the one folder that may carry localized text
+    tests: none
+    why: payload fixtures with a role suffix (the doubles come from @starci/jest-preset, not from here); the test data builders live in its builders/ slot; importable by unit specs, integration and e2e; never imports a feature
+  - id: be.tests.fixtures.builders
+    profiles: [be]
+    path: "src/tests/fixtures/builders/*.builder.ts"
+    presence: optional
+    tracked: tracked
+    tier: fixtures
+    tests: none
+    why: >-
+      the ONLY home of test data builders, one <area>.builder.ts per area, shared by every spec of that area: pure object builders
+      (commissionRow(overrides), accrueInput(overrides)) for unit specs and persisting builders (orderBuilder(world.db.primary).pending().build(overrides))
+      for integration and e2e; arrange only, constraints on, deterministic defaults. A .builder.ts anywhere else, and a *.repository.ts,
+      *.fixture.ts or *.factory.ts anywhere, is a BE_SOURCE_FORM finding
+    rules: [BE_SOURCE_FORM]
+  - id: be.tests.fixtures.i18n
+    profiles: [be]
+    path: "src/tests/fixtures/i18n/"
+    presence: optional
+    tracked: tracked
+    tier: fixtures
+    allows: ["<name>.<role>.ts"]   # data files that deliberately carry localized text (a real Vietnamese string a parser or formatter must accept); no specs here
+    tests: none
+    why: the ONLY test-fixture location where Vietnamese or another language may appear in source (LANG_NOT_ENGLISH); placement is the marker, there is no comment pragma
+  - id: be.tests.integration
+    profiles: [be]
+    path: "src/tests/integration/<capability>/*.integration-spec.ts"
+    presence: optional
+    tracked: tracked
+    tier: e2e
+    tests: e2e
+    why: one capability module on the real database, no HTTP (SQL, transactions, concurrency, inbox claims) through useTestWorld({ modules }); run by test:integration
+    rules: [BE_TEST_TOPOLOGY]
+  - id: be.tests.e2e
+    profiles: [be]
+    path: "src/tests/e2e/<area>/*.e2e-spec.ts"
+    presence: optional
+    tracked: tracked
+    tier: e2e
+    tests: e2e
+    why: flow e2e through useTestWorld({ apps }); external services are the world's network fakes; run by test:e2e
+    rules: [HFS_CI_E2E_AUTOMATIC, BE_TEST_TOPOLOGY, BE_E2E_FLOW]
+  - id: be.tests.contract
+    profiles: [be]
+    path: "src/tests/contract/<provider>/*.contract-spec.ts"
+    presence: optional
+    tracked: tracked
+    tier: e2e
+    tests: e2e
+    why: provider sandbox contracts, skipped without sandbox config; run only by test:contract, never part of test or test:e2e
+    rules: [BE_TEST_TOPOLOGY]
+  - id: be.tests.e2e-world-retired
+    profiles: [be]
+    path: "src/tests/e2e/world/"
+    presence: forbidden
+    tracked: external
+    tier: none
+    tests: none
+    goesTo: "src/tests/world/ (the only test infrastructure location; e2e/<area>/ holds only *.e2e-spec.ts)"
 
   # ----- BE: work and stacks -----------------------------------------------------------------------------
   - id: be.starciwork
@@ -651,7 +849,7 @@ slots:
     tier: none
     tests: none
     requires: [application-stacks.yaml]
-    allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,k8s,terraform}/**",
+    allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,k8s,terraform}/**", "<env>/infra/metadata.json",
              "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/seeds/**"]
     forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
     rules: [HFS_STACKS_SHAPE, HFS_PLAINTEXT_SECRET, HFS_IDENTITY_CUSTODY]
@@ -662,7 +860,6 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    managedBy: sops-policy
 
   # ----- FE: apps ----------------------------------------------------------------------------------------
   - id: fe.app.next
@@ -673,13 +870,13 @@ slots:
     tracked: tracked
     tier: none
     minInstances: 1
-    requires: [package.json, next.config.ts, tsconfig.json, postcss.config.mjs, src/app/, src/modules/i18n/, src/modules/api/,
+    requires: [package.json, next.config.ts, tsconfig.json, postcss.config.mjs, src/app/, src/modules/i18n/,
                "src/app/global-error.tsx", "src/app/[locale]/layout.tsx", "src/app/[locale]/error.tsx", "src/app/[locale]/not-found.tsx", "src/app/[locale]/loading.tsx"]
     tests: none
     rules: [FE_APP_ISOLATION, FE_ERROR_BOUNDARY_MISSING, FE_NEXT_CONVENTIONS]
   - id: fe.app-optional
     profiles: [fe]
-    path: "apps/<app>/{vitest.config.ts,public/}"
+    path: "apps/<app>/public/"
     presence: optional
     tracked: tracked
     tier: none
@@ -690,8 +887,13 @@ slots:
     presence: required
     tracked: tracked
     tier: route
-    allows: ["[locale]/**/{page,layout,template,loading,error,not-found}.tsx", "[locale]/**/route.ts", global-error.tsx, "page.tsx (redirect only)",
-             "health/{live,ready}/route.ts", globals.css, "icon.*", robots.ts, sitemap.ts]
+    allows: ["[locale]/**/{page,layout,template,loading,error,not-found,default}.tsx", "[locale]/**/route.ts", "[locale]/providers.tsx",
+             global-error.tsx, page.tsx,   # the root page.tsx only redirects (FE_ROUTE_FILES_THIN)
+             not-found.tsx, layout.tsx,    # next-intl: a request outside every locale renders the root not-found inside a root layout
+             "health/{live,ready}/route.ts", "api/**/route.ts", "_*/**", providers.tsx, globals.css,
+             "{icon,favicon,apple-icon,opengraph-image,twitter-image}.*", robots.ts, sitemap.ts, manifest.ts]
+    # providers.tsx (root or [locale]) is the client wrapper the server layout renders around its children to host context providers.
+    roles: {page: page.tsx, layout: layout.tsx, template: template.tsx, loading: loading.tsx, error: error.tsx, not-found: not-found.tsx, default: default.tsx, route: route.ts, global-error: global-error.tsx, providers: providers.tsx}
     tests: none
     rules: [FE_ROUTE_FILES_THIN, FE_CLIENT_BOUNDARY, FE_OWNER_REACHABLE]
   - id: fe.source-root-pinned
@@ -700,8 +902,18 @@ slots:
     presence: optional
     tracked: tracked
     tier: route
+    roles: {proxy: proxy.ts, instrumentation: instrumentation.ts, instrumentation-client: instrumentation-client.ts}
+    tests: none
+    rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16 (fe.source-root-retired)
+  - id: fe.source-root-retired
+    profiles: [fe]
+    path: "apps/<app>/src/{middleware.ts,middleware.js}"
+    presence: forbidden
+    tracked: external
+    tier: none
     tests: none
-    rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16
+    goesTo: "apps/<app>/src/proxy.ts: Next >= 16 renamed middleware to proxy and refuses the old name"
+    rules: [FE_NEXT_CONVENTIONS]
   - id: fe.feature
     profiles: [fe]
     path: "apps/<app>/src/features/{pages,layouts,overlays}/<name>/"
@@ -709,10 +921,12 @@ slots:
     tracked: tracked
     tier: feature
     owner: true
+    kinds: [pages, layouts, overlays]
     requires: [index.tsx]
-    allows: [index.tsx, component.tsx, classNames.ts, "*.spec.tsx", "*.spec.ts"]
-    tests: unit-beside
-    budget: {component.tsx: 300, index.tsx: 200}
+    allows: [index.tsx, component.tsx, classNames.ts]
+    roles: {entry: index.tsx, drawing: component.tsx, styles: classNames.ts}   # the connected entry, the pure drawing half and the styling declarations of a component owner
+    tests: none
+    budget: {component.tsx: 300, index.tsx: 200, dataHooks: 6, useState: 6}
     rules: [FE_SIZE_BUDGET, FE_OWNER_REACHABLE, FE_I18N_LITERAL]
   - id: fe.components
     profiles: [fe]
@@ -723,8 +937,9 @@ slots:
     owner: true
     layers: [blocks, composites, branches, leaves]   # a layer imports only the layers after it
     requires: [index.tsx]
-    allows: [index.tsx, component.tsx, classNames.ts, "*.spec.tsx", "*.spec.ts"]
-    tests: unit-beside
+    allows: [index.tsx, component.tsx, classNames.ts]
+    roles: {entry: index.tsx, drawing: component.tsx, styles: classNames.ts}   # the connected entry, the pure drawing half and the styling declarations of a component owner
+    tests: none
     budget: {component.tsx: 300, index.tsx: 200, dataHooks: 6, useState: 6}
     rules: [FE_CONNECTED_BLOCK_RENDER_PAIR, FE_I18N_LITERAL, FE_NATIVE_FORM_CONTROL, FE_CLIENT_BOUNDARY]
   - id: fe.hooks
@@ -735,9 +950,10 @@ slots:
     tier: hooks
     owner: true                   # a domain is an owner: other domains import it through index.ts only
     requires: [index.ts]
-    allows: [index.ts, "use<name>.ts", "<domain>.shared.ts", "*.spec.ts"]   # React hooks only; <domain>.shared.ts = sanctioned non-hook helpers
-    tests: unit-beside
-    budget: {file: 200}
+    allows: [index.ts, "use<name>.ts", "<domain>.shared.ts"]   # React hooks only; <domain>.shared.ts = sanctioned non-hook helpers
+    roles: {entry: index.ts, shared: "<domain>.shared.ts"}
+    tests: none
+    budget: {file: 200, dataHooks: 6, useState: 6}
     rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
   - id: fe.modules
     profiles: [fe]
@@ -746,28 +962,50 @@ slots:
     tracked: tracked
     tier: modules
     owner: true
-    requiredInstances: {capability: [api, config, i18n, routes]}
+    requiredInstances: {capability: [config, i18n, routes]}
     requires: [index.ts]
-    tests: unit-beside
+    tests: none
     budget: {file: 400}
     rules: [FE_ENV_OWNER, FE_TRANSPORT_OWNER]
   - id: fe.modules.api
     profiles: [fe]
     path: "apps/<app>/src/modules/api/"
-    presence: required
+    presence: optional
     tracked: tracked
     tier: transport
-    requires: [index.ts, client.ts, outcome.ts]      # client.ts is the only fetch; outcome.ts the only result vocabulary
-    allows: [client.ts, outcome.ts, "<domain>/read-*.ts", "<domain>/*.graphql", "<domain>/<domain>.mapper.ts", contract/, __generated__/, "*.spec.ts"]
-    tests: unit-beside
+    # The app's reads of the one client. A repository has exactly ONE transport client and ONE Outcome union: the app's
+    # client.ts/outcome.ts (fe.transport.client/outcome) in a one-app repository, or the api package's
+    # (fe.package.api.client/outcome) when the repository shares it (FE_TRANSPORT_OWNER, machine).
+    requires: [index.ts]
+    allows: [index.ts, client.ts, outcome.ts, "<domain>/read-*.ts", "<domain>/*.graphql", "<domain>/<domain>.mapper.ts", contract/, __generated__/]
+    roles: {entry: index.ts, reader: "read-*.ts"}   # a reader is a server module (FE_CLIENT_REACHES_SERVER)
+    tests: none
     rules: [FE_TRANSPORT_OWNER, FE_HTTP_STATUS_COLLAPSE, FE_WIRE_GENERATED]
+  - id: fe.transport.client
+    profiles: [fe]
+    path: "apps/<app>/src/modules/api/client.ts"
+    presence: optional
+    tracked: tracked
+    tier: transport
+    tests: none
+    why: the one fetch of a one-app repository (timeout, abort, 401/403 -> refused); a shared client is fe.package.api.client
+    rules: [FE_TRANSPORT_OWNER]
+  - id: fe.transport.outcome
+    profiles: [fe]
+    path: "apps/<app>/src/modules/api/outcome.ts"
+    presence: optional
+    tracked: tracked
+    tier: transport
+    tests: none
+    why: the one Outcome union of a one-app repository; a shared union is fe.package.api.outcome
+    rules: [FE_HTTP_STATUS_COLLAPSE]
   - id: fe.modules.config
     profiles: [fe]
     path: "apps/<app>/src/modules/config/"
     presence: required
     tracked: tracked
     tier: foundation
-    tests: unit-beside
+    tests: none
     why: the only reader of process.env and NEXT_PUBLIC_*; fails fast, no localhost fallback
   - id: fe.modules.i18n
     profiles: [fe]
@@ -775,8 +1013,11 @@ slots:
     presence: required
     tracked: tracked
     tier: foundation
-    requires: [config.ts, routing.ts, navigation.ts, request.ts, messages/]
-    tests: unit-beside
+    # The app's i18n module: its catalogs and the one call of the repository's i18n factory. The next-intl stack (routing,
+    # navigation, request config) is written once per repository: in the i18n package (fe.package.i18n, `createAppI18n`)
+    # when the repository has one, else in the only app's module.
+    requires: [index.ts]
+    tests: none
     rules: [FE_I18N_PLACEMENT, FE_I18N_CATALOG]
   - id: fe.modules.brand
     profiles: [fe]
@@ -793,7 +1034,7 @@ slots:
     presence: required
     tracked: tracked
     tier: foundation
-    tests: unit-beside
+    tests: none
     why: every href builder; FE_HREF_RESOLVES checks each against app/
   - id: fe.modules.types
     profiles: [fe]
@@ -801,7 +1042,7 @@ slots:
     presence: optional
     tracked: tracked
     tier: foundation
-    tests: unit-beside
+    tests: none
     why: shared types with no runtime behaviour; a component may import them
   - id: fe.package.ui
     profiles: [fe]
@@ -810,26 +1051,53 @@ slots:
     tracked: tracked
     tier: package
     owner: true
+    kinds: [composites, branches, leaves]   # the layer folders under src/ (a package owns no blocks)
+    roles: {entry: index.tsx, drawing: component.tsx, styles: classNames.ts}
     requires: [package.json, src/index.ts, tsconfig.json]
-    tests: unit-beside
+    tests: none
+    budget: {component.tsx: 300, index.tsx: 200, dataHooks: 6, useState: 6}
     why: built to dist with explicit named exports; only composites, branches and leaves; no unused export; no colour literal
     rules: [FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT, FE_STYLE_TOKEN_ONLY]
-  - id: fe.e2e
+  - id: fe.package.api
     profiles: [fe]
-    path: "e2e/<area>/*.e2e-spec.ts"
-    presence: optional
+    path: "packages/<family>-api/"
+    presence: opt-in
     tracked: tracked
-    tier: e2e
-    tests: e2e
-    requires: [/playwright.config.ts, /tsconfig.e2e.json]
-    rules: [FE_E2E_SHAPE, HFS_CI_E2E_AUTOMATIC]
-  - id: fe.e2e-support
+    tier: package
+    owner: true
+    requires: [package.json, src/index.ts, src/client.ts, src/outcome.ts, tsconfig.json]
+    tests: none
+    why: the one transport client and the one Outcome union shared by every app of the repository; no app keeps its own
+    rules: [FE_TRANSPORT_OWNER, FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT]
+  - id: fe.package.api.client
     profiles: [fe]
-    path: "e2e/{support,fixtures}/"
-    presence: optional
+    path: "packages/<family>-api/src/client.ts"
+    presence: optional     # enabled with its package (fe.package.api is the opt-in)
     tracked: tracked
-    tier: e2e
+    tier: package
+    tests: none
+    why: the repository's one fetch (timeout, abort, 401/403 -> refused)
+    rules: [FE_TRANSPORT_OWNER]
+  - id: fe.package.api.outcome
+    profiles: [fe]
+    path: "packages/<family>-api/src/outcome.ts"
+    presence: optional     # enabled with its package (fe.package.api is the opt-in)
+    tracked: tracked
+    tier: package
+    tests: none
+    why: the repository's one Outcome union
+    rules: [FE_HTTP_STATUS_COLLAPSE]
+  - id: fe.package.i18n
+    profiles: [fe]
+    path: "packages/<family>-i18n/"
+    presence: opt-in
+    tracked: tracked
+    tier: package
+    owner: true
+    requires: [package.json, src/index.ts, tsconfig.json]
     tests: none
+    why: the next-intl stack (routing, navigation, request config) written once, exported as the createAppI18n factory every app calls
+    rules: [FE_I18N_PLACEMENT, FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT]
 
 # Checks that read this manifest (all ship from .claude; none keeps its own path list)
 consumers:
@@ -839,5 +1107,5 @@ consumers:
   - packages/eslint/be starciBeConfig({hfs})   # file globs for rules come from slots
   - packages/eslint/fe starciFeConfig({hfs})
   - packages/stylelint-canon                   # colour and brand allowances from fe.modules.brand
-  - scripts/hfs/sync.mjs                       # renders managedBy templates
+  - packages/hfs/sync                          # renders managedBy templates (hfs sync) and judges them (hfs check)
   - modules/kernel/failure-codes.yaml          # every rule id listed above has a Vietnamese why