@starci/hfs 4.0.7 → 4.0.9

package/runtime/knowledge/hfs/slots.yaml

@@ -4,10 +4,10 @@
 # the CI, the hooks and .starciwork (slots of profile `app`); `be/` and `fe/` are its two sides, each laid out as the old
 # standalone repository root (slots of profile be or fe, paths relative to the side folder). Every tracked path of every
 # repository must match exactly one slot. Checks, lint factories, the architecture machine, templates and the why
-# catalog READ this file through scripts/lib/hfs-slots.mjs; none of them hardcodes a path.
+# catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@2
-version: 2.0.0
+version: 2.1.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 2).
@@ -24,6 +24,9 @@ versioning:
     a slot is never edited in place; it gets retiredIn (a major) and a successor slot id. After that major a
     path matching a retired slot is HFS_SLOT_RETIRED (error).
   pins: knowledge/hfs/canon-pins.yaml carries the exact versions of every @starci/* package and framework this MAJOR supports.
+# 2.1.0 is such a minor: it ADDS the edition mechanism (the `editions` list, the per-slot `editions`, `litePresence`, `lite`
+# overlays and `provider`, and `sides.<side>.reads` of an app-root tree) and the lite slots; an app without `edition` in its
+# hfs.json is edition full and every answer for it is unchanged.
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -38,6 +41,13 @@ versioning:
 #   tier        node of the import direction matrix (tiers below); none = takes no part in import checks;
 #               inherit = the tier of the enclosing owner.
 #   owner       true when every directory matching the slot is an owner: the unit cross-owner imports and cycles use.
+#   anonymousActions  on a directory slot: the Server Action files (relative to it) that authenticate or end a session and so run for an anonymous principal (FE_AUTH_SESSION_TRUST exempts them from refusing it; they still parse their input).
+#   entries     on a directory slot that sits inside an owner (not an owner itself): the files, besides the owner's index.ts, an importer
+#               outside the owner may enter through (a client-safe entry of a module whose barrel is server-only). Each is a relative
+#               path the slot allows. Everything else of the owner is entered through index.ts only (ARCH_OWNER_EXPORT_BYPASS).
+#   outcomeHome true on a file slot: the one file that declares the repository's Outcome union. A repository holds exactly one such
+#               file (modules/api/outcome.ts, the api package's outcome.ts, or modules/db/outcome.ts of a lite app),
+#               and no other file declares an Outcome union (one-outcome-union, FE_TRANSPORT_OWNER).
 #   requires    files or directories that must exist inside each instance; <var> is replaced by the bound name,
 #               a leading / means repository root; a trailing / means directory.
 #   requiredInstances  variable -> names that must exist as instances (config, logging ... of platform).
@@ -45,42 +55,89 @@ versioning:
 #   requiredWhen       connections: required only when hfs.json declares a database connection.
 #   allows / forbids   names inside the instance; the loader exposes them, slot-check enforces them.
 #   tests       unit-beside | e2e | none.
-#   composedBy  the app kinds allowed to compose a transport slot (an app of another kind imports none of its modules).
+#   coverage    required | none, on every tracked slot of profile be. A required slot's subtree is measured at 100 per file on every
+#               ruleParams.be.logicRoles file (lines, branches, functions, statements); a none slot's subtree is never measured and
+#               is excluded from Sonar's coverage. scripts/hfs/coverage-scope.mjs derives the jest per-file thresholds, Sonar's
+#               sonar.coverage.exclusions and the Codecov paths and components from this field and nowhere else (R204).
+#               Orthogonal to the lite `editions`: an edition never changes what a slot measures.
+#   composedBy the app kinds allowed to compose a transport slot (an app of another kind imports none of its modules); on an
+#               owner slot (be.cli) the app kinds that list its root module, every folder of the root holding one static module.
 #   budget      size budgets (lines per file, files per slot, exports).
+#   trigger     the trigger kind (triggerKinds) of a feature-tier slot: api, webhooks, realtime, saga, reactors, jobs or cli. A feature of one kind
+#               never imports a feature of another (BE_KIND_ISOLATION); the two meet only through the event bus.
+#   pattern     the design pattern whose declaration (hfs.json sides.<side>.patterns) enables this opt-in slot; a path in the slot of an
+#               undeclared pattern is HFS_SLOT_NOT_ENABLED, and a declared pattern's proof scenarios are ruleParams.be.patternScenarios.
 #   appKind     the app kind of hfs.json apps[].kind whose directory this slot describes.
-#   managedBy   the template directory hfs sync renders this slot's files from. The slot path then lists literal files
+#   managedBy   the template directory starci app sync renders this slot's files from. The slot path then lists literal files
 #               only, and each is rendered from templates/<profile or common>/<managedBy>/<path, leading dots dropped>;
+#   liteManagedBy  the template directory starci app sync renders under edition lite (default: managedBy). A slot with only
+#               liteManagedBy is managed only in lite; its effective lite.path still lists literal files;
 #               the managed file list lives here and nowhere in code. A difference is HFS_MANAGED_FILE_DRIFT (a
 #               back end's tsconfig.json: HFS_TS_STRICT when a flag or an option was added).
 #   rules       rule ids (the catalog lands with knowledge/hfs/rules.yaml).
+#   editions    the editions (below) the slot exists in; default all of them. A slot outside the declared edition owns
+#               no path - under lite, what full keeps absent is removed, and what lite forbids is a finding.
+#   litePresence  the presence under edition lite (default: presence): a bare value, or {be, fe} for a both-sides slot.
+#               A slot forbidden in lite is external there and must name its goesTo.
+#   lite        the fields the slot carries under lite only (path, requires, allows, forbids, minInstances,
+#               requiredInstances), each shaped as the same field in the slot body; every other field is the edition's.
+#               Under lite `tests` is none on every slot: a lite app has no test world.
+#   provider    the hfs.json connections[].provider that enables this opt-in slot (supabase); never an app kind.
 #   since / retiredIn / successor   lifecycle.
 presenceValues: [required, optional, opt-in, forbidden]
 trackedValues: [tracked, ignored, external]
 testValues: [unit-beside, e2e, none]
 
+# The editions a repository declares in hfs.json `edition` (absent means full). Lite is this same manifest filtered: a slot
+# whose `editions` lacks lite does not exist for a lite app, `litePresence` replaces presence and a `lite` map replaces the
+# fields it names. Upgrade lite -> full adds only (the forbidden test world becomes legal again); downgrade is not supported.
+editions: [full, lite]
+
 # The two sides of an app: the folder of each is its profile name (be/, fe/). `reads` lists the only paths of the OTHER side a side
-# may read (hfs.json sides.<side>.reads names a subset); nothing else crosses sides.
+# may read (hfs.json sides.<side>.reads names a subset), or a tree an app-root slot owns (supabase/types/); nothing else crosses sides.
 sides:
-  be: {reads: []}
-  fe: {reads: [be/contracts/]}     # the back end's committed contract snapshots, the input of the front end's codegen
+  be: {reads: [supabase/types/]}   # the generated Database types of a Supabase connection (server code types its PostgREST calls)
+  fe: {reads: [be/contracts/, supabase/types/]}     # be/contracts/: the committed contract snapshots, the input of the front end's codegen; supabase/types/: the same generated types
+
+# The trigger kinds of the back end's features: what starts the work of a feature. A feature slot names its kind in `trigger`; no kind imports another
+# (BE_KIND_ISOLATION), every cross-kind call is an event on the bus, and only be/apps/* compose features.
+triggerKinds: [api, webhooks, realtime, saga, reactors, jobs, cli]
 
 appKinds:
-  be: [api, worker, migrate, cli]
+  be: [api, worker, cli]
   fe: [next]
 
+# RT_SLOT_ID_SHAPE — the slot-id grammar and the suffix vocabulary law, stated once (scripts/checks/check-slot-id-shape.mjs
+# reads this block): an id is dot-separated lowercase kebab segments whose first segment is one of `prefixes`;
+# `<side>.app.<kind>` names a kind of appKinds.<side>; any other deeper id extends a declared slot id (its `parent`)
+# or names `parent` explicitly. The role-suffix vocabulary never shares a word with bannedSuffixes and holds no
+# synonym pair beyond `sameConceptPairs` — the one owner-approved pair (step + saga-step: `.saga-step.ts` stays).
+# Every pair in `refusedPairs` may never both be live suffixes.
+# `glossary` (S9-02): the five names for "handles an incoming thing" are five distinct kinds, not synonyms —
+# consumer answers an event, subscription serves realtime, webhook is its own kind, processor runs a job, handler
+# is CQRS. That is why appKinds may say worker while bannedSuffixes refuses the worker/job file suffixes.
+naming:
+  prefixes: [app, be, fe, repo]
+  sameConceptPairs: [[step, saga-step]]
+  refusedPairs: [[use-case, handler], [listener, subscription], [job, processor], [worker, processor], [dto, input], [repository, mapper]]
+  glossary: {consumer: event, subscription: realtime, webhook: webhook, processor: job, handler: cqrs}
+
 # ---------------------------------------------------------------------------------------------------------
 # Tiers and the dependency direction matrix (owner granularity; type-only imports count; no cycles anywhere)
 # mayImport lists the tiers a file of that tier may import. Importing inside the same owner is always allowed.
 # ---------------------------------------------------------------------------------------------------------
 tiers:
   be:
-    app:          {mayImport: [feature, domain, platform, integrations, package]}
-    feature:      {mayImport: [domain, platform, integrations, package]}          # never another feature
-    domain:       {mayImport: [domain, platform, integrations, package], acyclic: true}
+    app:          {mayImport: [feature, domain, events, queues, projections, platform, integrations, package]}
+    feature:      {mayImport: [domain, events, queues, projections, platform, integrations, package]}          # never another feature
+    domain:       {mayImport: [domain, events, queues, platform, integrations, package], acyclic: true}      # a domain service writes the outbox: it publishes events and enqueues queue jobs inside its own transaction
+    events:       {mayImport: [events, platform, package], acyclic: true}          # modules/events/<service>: typed event classes (pattern event-bus)
+    queues:       {mayImport: [queues, events, platform, package], acyclic: true}  # modules/queues/<queue>: typed producers and schedulers (pattern queue)
+    projections:  {mayImport: [projections, domain, events, platform, integrations, package], acyclic: true}   # modules/projections/<name>: read models (pattern projection)
     integrations: {mayImport: [platform, package]}
     platform:     {mayImport: [platform, package], acyclic: true}
-    e2e:          {mayImport: [e2e, app, feature, domain, platform, integrations, fixtures, package]}
-    fixtures:     {mayImport: [domain, platform, integrations, package]}          # public contracts only
+    e2e:          {mayImport: [e2e, app, feature, domain, events, queues, projections, platform, integrations, fixtures, package]}
+    fixtures:     {mayImport: [domain, events, queues, projections, platform, integrations, package]}          # public contracts only
     package:      {mayImport: [package]}
   fe:
     route:        {mayImport: [feature, foundation, modules, transport, package]} # app/** adapters
@@ -97,14 +154,17 @@ tiers:
 crossOwner: every import across owners targets the owner's public entry (index.ts or index.tsx); never export *.
 crossApp: apps never import each other; shared code is a packages/<pkg> slot.
 
-# Parameters the lint factories and checks read per profile (through ruleParams(profile) in scripts/lib/hfs-slots.mjs).
+# Parameters the lint factories and checks read per profile (through ruleParams(profile) in scripts/hfs/slots.mjs, which
+# merges common under the profile: a side restates a common key only to override it).
 ruleParams:
-  be:
-    # HFS_SIZE_GROWTH: a file above soft may not grow against its parent commit; a new file stays within soft.
+  common:
+    # HFS_SIZE_GROWTH: a file above soft may not grow against its parent commit; a new file stays within soft. Slot
+    # budgets (component.tsx 300, hooks 200, modules 400) are stricter than this cap where they apply.
     fileLines: {soft: 500, hardGrowth: true}
-    # R21 HFS_DUPLICATE_CODE: the ONE threshold of duplicate code (the architecture machine reads it here; no other file states it):
-    # a token-normalised block of at least `lines` source lines and `tokens` tokens that appears twice.
+    # R21 HFS_DUPLICATE_CODE: the one threshold of duplicate code of both sides (the architecture machine reads it here;
+    # no other file states it): a token-normalised block of at least `lines` source lines and `tokens` tokens that appears twice.
     duplicateBlock: {lines: 8, tokens: 60}
+  be:
     # R90 BE_INFRA_OWNER: raw infrastructure library (a module specifier or a global reference) -> the platform or
     # integration capabilities allowed to import it; [] means nowhere in a back end. A specifier also covers its subpaths.
     infraOwners:
@@ -120,14 +180,15 @@ ruleParams:
       "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability (retired local rule must-use-cache-service)
       redis: [integrations/cache, integrations/redis]
       ioredis: [integrations/cache, integrations/redis]
-      bullmq: [platform/messaging]
-      "@nestjs/bullmq": [platform/messaging]
-      kafkajs: [platform/messaging]
-      "@nestjs/schedule": [platform/scheduling, platform/retry, platform/messaging, platform/http]
-      setInterval: [platform/scheduling, platform/retry, platform/messaging, platform/http]
-      setTimeout: [platform/scheduling, platform/retry, platform/messaging, platform/http]
-      "node:timers": [platform/scheduling, platform/retry, platform/messaging, platform/http]
-      "node:timers/promises": [platform/scheduling, platform/retry, platform/messaging, platform/http]
+      bullmq: [platform/queue]               # pattern queue: BullMQ jobs and job schedulers (the relay of the outbox into queues)
+      "@nestjs/bullmq": [platform/queue]
+      kafkajs: [platform/event-bus]          # pattern event-bus: Kafka is the only event transport
+      "@nestjs/schedule": []                 # no @Cron / @Interval / @Timeout anywhere: a schedule is a BullMQ job scheduler of a queue
+      eventemitter2: []
+      setInterval: [platform/retry, platform/event-bus, platform/queue, platform/http]
+      setTimeout: [platform/retry, platform/event-bus, platform/queue, platform/http]
+      "node:timers": [platform/retry, platform/event-bus, platform/queue, platform/http]
+      "node:timers/promises": [platform/retry, platform/event-bus, platform/queue, platform/http]
       winston: [platform/logging]
       dayjs: [platform/clock, platform/primitives]
       moment: [platform/clock, platform/primitives]
@@ -135,6 +196,22 @@ ruleParams:
       "@nestjs/config": []
       dotenv: []
       "@nestjs/event-emitter": []
+      "@nestjs/platform-socket.io": [platform/realtime]
+      socket.io: [platform/realtime]
+      graphql-subscriptions: [platform/realtime]
+      graphql-ws: [platform/realtime]
+    # R87 BE_CQRS_SHAPE no-event-bus: the in-process event vocabulary the rule refuses. `imports` maps a module
+    # specifier to the member names that are an in-process event; `[]` flags the package itself (its emitter packages
+    # are the `[]` owners of infraOwners above). `classes` maps a module specifier to the class names that are an
+    # in-process bus when constructed or extended.
+    eventBus:
+      imports:
+        "@nestjs/cqrs": [EventBus, EventsHandler, IEventHandler]
+        "@nestjs/event-emitter": []
+      classes:
+        events: [EventEmitter]
+        "node:events": [EventEmitter]
+        rxjs: [Subject, BehaviorSubject, ReplaySubject, AsyncSubject]
     # R48 BE_SPEC_QUALITY spec-infra-double-from-kit: in a `<name>.service.spec.ts` a provider `{ provide: TOKEN, useValue: X }` takes X from
     # the kit named here (the package root of `kit`). The token name is normalised to UPPER_SNAKE (`EntityManager` -> ENTITY_MANAGER), the
     # FIRST entry whose `token` regex matches decides, and `fallback` decides for every other token. `forms` say what X may be:
@@ -147,23 +224,90 @@ ruleParams:
         - {token: "(?:^|_)ENTITY_MANAGER$", double: mockEntityManager, forms: [call]}
         - {token: "(?:^|_)TRANSACTION(?:_RUNNER)?$", double: fakeTransaction, forms: [call]}
         - {token: "(?:^|_)CLOCK$", double: FakeClock, forms: [new]}
-        - {token: "(?:^|_)OUTBOX(?:_|$)", double: recordingOutbox, forms: [call]}
+        - {token: "(?:^|_)EVENT_BUS$", double: recordingEventBus, forms: [call]}
+        - {token: "(?:^|_)QUEUE_OUTBOX$", double: recordingQueueOutbox, forms: [call]}
+        - {token: "(?:^|_)INBOX(?:_|$)", double: fakeInbox, forms: [call]}
         - {token: "(?:^|_)CACHE(?:_|$)", double: fakeCache, forms: [call]}
         - {token: "(?:^|_)(?:LOCK|LEASE|FENCE|HOLD)(?:_|$)", double: fakeLock, forms: [call]}
         - {token: "(?:^|_)(?:IDS|ID_GENERATOR|ID_FACTORY)$", double: fakeIds, forms: [call]}
       fallback: {double: mock, forms: [call, primitive, array]}
+    # R85 BE_RAW_INJECT injected-param-name: the names of the ports every class injects the same way (BE-CONVENTION 1.6: the parameter name
+    # is the camelCase of the port). An entry matches a constructor parameter that carries an injector and is annotated with a type
+    # declared outside the owner (a package, platform/* or integrations/*): `type` is the exact declared name, `typeSuffix` the end of
+    # it. The parameter is named one of `names`, or ends in `nameSuffix` when the entry has one (`orderEntityManager` for a class that
+    # injects two connections, `paymentOptions` beside `options`). A type no entry names is free to be named for what it is.
+    paramNames:
+      - {type: Clock, names: [clock]}
+      - {type: Logger, names: [logger]}
+      - {type: Cache, names: [cache]}
+      - {type: CommandBus, names: [commandBus]}
+      - {type: QueryBus, names: [queryBus]}
+      - {type: EntityManager, names: [entityManager], nameSuffix: EntityManager}
+      - {typeSuffix: Options, names: [options], nameSuffix: Options}
     # R89 BE_SOURCE_FORM: the closed role-suffix vocabulary of a source file name (<kebab-name>.<suffix>.ts; BE-CONVENTION 1.15)
     # and the suffixes that are never a role. index.ts, main.ts, app.module.ts and the migrations of be.persistence are the
     # only names outside it.
-    suffixes: [module, module-definition, decorators, options, config, connection, service, command, query, handler, contracts, port, resolver, controller, gateway, consumer, job, cli, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
+    suffixes: [module, module-definition, decorators, options, config, connection, service, command, query, handler, compensation, saga-state, saga-step, saga, contracts, port, resolver, controller, gateway, webhook, subscription, consumer, cli, event, queue, projection, projection-entity, processor, step, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
     # R47 BE_CONTRACT_UNGUARDED: the world's shape vocabulary. `helper` names the function a contract spec imports to erase the values of a JSON
     # payload (`shapeOf`); a contract spec proves a fake's fixtures by asserting helper(real) equals helper(fixture).
     contractShape: {helper: shapeOf}
-    bannedSuffixes: [use-case, repository, fixture, factory, store, worker, scheduler, cron, listener, dto, util, utils, helper, helpers, rules, types, constants, int-spec, harness-spec, test]
-  fe:
-    # Slot budgets (component.tsx 300, hooks 200, modules 400) are stricter than this cap where they apply.
-    fileLines: {soft: 500, hardGrowth: true}
-    duplicateBlock: {lines: 8, tokens: 60}
+    # THE list of unit-tested roles of a back end whose spec is REQUIRED (the ONE source every consumer reads: the eslint unit-test rules, hfs
+    # spec-placement and the cli spec check, the architecture machine's unit-spec checks and the unit-run gate). A role's subject is
+    # `<name>.<role>.ts` (inside `slot` when one is named) and its unit spec `<name>.<spec>.ts` beside it. What the unit run MEASURES is not
+    # listed here: it is `logicRoles` over the slots whose `coverage` is required (scripts/hfs/coverage-scope.mjs). `exempt` lists the rules
+    # the role is exempt from: a cli command is an action runner, not a thin transport (R149). A lane that adds a spec-required role adds
+    # its entry here and nowhere else.
+    unitRoles:
+      - {role: service, spec: service.spec}
+      - {role: cli, spec: cli.spec, slot: be.cli, exempt: [BE_TRANSPORT_SHAPE]}
+    # R204 HFS_COVERAGE_SCOPE_DRIFT. THE roles that carry logic: a file `<name>.<role>.ts` of one of these roles
+    # inside a slot whose `coverage` is required is measured at 100 per file on lines, branches, functions and statements (the three
+    # generated consumers: jest thresholds, sonar.coverage.exclusions, codecov.yml). A role that is not listed here (module, module-definition,
+    # options, config, command, query, contracts, port, event, queue, entity, sql, rows, messages, log-events, error, decorators, cache-keys,
+    # projection-entity, connection, and every file with no role: index.ts, main.ts, migrations) is declaration or composition and is never measured.
+    # A unit spec beside such a file (`<name>.<role>.spec.ts`) is legal but not required: the file owes 100, not a spec of its own.
+    logicRoles: [service, policy, projection, guard, mapper, client, filter, interceptor, processor, step, saga, saga-step, compensation, consumer, webhook]
+    # R203 BE_FEATURE_THIN. THE roles a feature-tier file is judged thin by: a file `<name>.<role>.ts` of one of these roles inside a slot of tier
+    # feature maps parameters and makes ONE delegating call into modules/ (a service, the command or query bus, the event bus, a queue producer): no
+    # branch, loop, ternary, try or throw, no computation; orchestration (step order, compensation, claim, fencing, retry) lives in platform/*.
+    thinRoles: [handler, resolver, controller, consumer, processor, step, saga, saga-step, compensation, webhook, gateway, subscription, cli, mapper, service]
+    # BE_PATTERN_SPEC_MISSING: a declared pattern (hfs.json sides.be.patterns) is proven on the test world. Each id below needs a test titled
+    # "<pattern>/<id>: ..." in an e2e or integration spec (be/src/tests/e2e, be/src/tests/integration).
+    patternScenarios:
+      event-bus: [atomic-with-transaction, relay-only-after-commit, redelivery-then-dead-letter, duplicate-delivery-is-a-noop]
+      queue: [enqueue-atomic-with-transaction, relay-job-id-is-outbox-id, scheduler-fires-once]
+      webhooks: [bad-signature-is-refused, replay-is-refused, accepted-delivery-publishes-once]
+      realtime: [subscriber-receives-push, foreign-topic-is-isolated, disconnect-releases-subscription]
+      fenced-job: [claim-bumps-token, zombie-fenced-out, redispatch-isolated]
+      projection: [recompute-is-idempotent, replay-rebuilds]
+    # BE_KIND_DECLARATION: the patterns an app that uses a trigger kind declares in hfs.json sides.be.patterns; the platform capabilities of those
+    # patterns (the slots of tier platform that name the pattern) must exist.
+    kindPatterns:
+      api: []
+      webhooks: []
+      realtime: []
+      saga: [saga]
+      reactors: [event-bus]
+      jobs: [fenced-job, queue]
+      cli: []
+    # starci app add <noun> <name>: the pattern topic (knowledge/patterns/be/<topic>.yaml) whose files tree is generated, the path variable of the
+    # instance, what it registers in hfs.json, the options it needs (--<option>), the other nouns generated with it under the same name (a job is
+# the consumer of its queue, so `also: [queue]`) and the defaults of the other variables ("@name" = the name).
+    addKinds:
+      job: {topic: jobs, variable: job, trigger: jobs, patterns: [fenced-job, queue], also: [queue], defaults: {step: "@name"}}
+      reactor: {topic: reactors, variable: reactor, trigger: reactors, patterns: [event-bus], needs: [event, from, service], defaults: {action: "@name"}}
+      queue: {topic: queues, variable: queue, patterns: [queue]}
+      webhook: {topic: webhooks, variable: provider, trigger: webhooks, patterns: [webhooks], needs: [service], defaults: {event: "@name"}}
+      realtime: {topic: realtime, variable: channel, trigger: realtime, patterns: [realtime], needs: [service]}
+      saga: {topic: saga, variable: saga, trigger: saga, patterns: [saga], needs: [owner, from, failed, done, service], defaults: {step: "@name"}}
+      projection: {topic: projections, variable: name, patterns: [projection], needs: [connection]}
+      api: {topic: api, variable: feature, trigger: api, patterns: [], needs: [service], defaults: {action: "@name"}}
+      cli: {topic: cli, variable: group, trigger: cli, patterns: [], needs: [service], wire: {file: src/features/cli/cli.module.ts, import: "./@@group@@/@@group@@.module", symbol: "@@Group@@Module"}}
+    bannedSuffixes: [use-case, repository, fixture, factory, store, worker, scheduler, cron, job, listener, dto, util, utils, helper, helpers, rules, types, constants, int-spec, harness-spec, test]
+    # Edition lite (ruleParams(manifest, 'be', 'lite') merges these keys over the base): the schema authority is the Supabase
+    # migration tree (supabase/migrations/*.sql, forward-only), so a lite back end holds no TypeORM migration or entity under
+    # be/ (R34/R35 read schemaAuthority; be.persistence's lite overlay allows neither).
+    lite: {schemaAuthority: supabase, unitRoles: []}     # lite has no test world: no service or cli command owes a unit spec
 
 slots:
 
@@ -186,14 +330,28 @@ slots:
     rules: [HFS_README_*]
   - id: app.package-manifest
     profiles: [app]
-    # The one package.json of the app: every dependency of both sides and every script; npm workspaces only for fe/packages/*.
+    # The one package.json of the app, at the app root: be's dependencies and every tool, and every script; npm workspaces are
+    # exactly fe/apps/* and fe/packages/* (HFS_MONO_WORKSPACES), each with its own package.json. be has no package.json of its own.
     path: package.json
     presence: required
     tracked: tracked
     tier: none
     tests: none
     managedBy: package-scripts     # the `scripts` block only; the rest of the file is the repository's
-    rules: [HFS_PACKAGE_MANAGER_MIXED, HFS_DEP_VERSION_SKEW, HFS_CANON_PIN_DRIFT, HFS_MANAGED_FILE_DRIFT]
+    liteManagedBy: package-scripts-lite
+    rules: [HFS_PACKAGE_MANAGER_MIXED, HFS_DEP_VERSION_SKEW, HFS_CANON_PIN_DRIFT, HFS_MANAGED_FILE_DRIFT, HFS_MONO_WORKSPACES, HFS_MONO_WORKSPACE_DEP]
+  - id: app.task-graph
+    profiles: [app]
+    # The turbo task graph of the app (build, dev, lint, typecheck over the fe workspaces; build depends on ^build and caches
+    # .next and dist): rendered by starci app sync from templates/app/task-graph/turbo.json, judged for drift by starci app check. turbo needs
+    # it beside the root package.json and lockfile.
+    path: turbo.json
+    presence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: task-graph
+    rules: [HFS_MANAGED_FILE_DRIFT, HFS_MONO_WORKSPACES]
   - id: app.lockfile
     profiles: [app]
     path: package-lock.json
@@ -209,7 +367,7 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    rules: [HFS_GITIGNORE_BLOCK_DRIFT]     # the marked block of .gitignore is rendered by hfs sync (templates/app/gitignore)
+    rules: [HFS_GITIGNORE_BLOCK_DRIFT]     # the marked block of .gitignore is rendered by starci app sync (templates/app/gitignore)
   - id: app.tool-config
     profiles: [app]
     path: "{.editorconfig,.nvmrc}"
@@ -227,6 +385,7 @@ slots:
     tier: none
     tests: none
     managedBy: tool-config
+    liteManagedBy: tool-config-lite     # the same files plus the generated supabase/types, which the Supabase CLI writes unformatted
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL]
   - id: app.tool-config-optional
     profiles: [app]
@@ -251,7 +410,9 @@ slots:
     tracked: tracked
     tier: none
     tests: none
+    lite: {path: sonar-project.properties}
     managedBy: quality-config
+    liteManagedBy: quality-config-lite
     rules: [HFS_SONAR_CONFIG, HFS_MANAGED_FILE_DRIFT]
   - id: app.hooks
     profiles: [app]
@@ -270,16 +431,63 @@ slots:
     tier: none
     tests: none
     managedBy: ci-workflows
+    liteManagedBy: ci-workflows-lite
     rules: [HFS_CI_E2E_AUTOMATIC, HFS_CI_MISSING_CANON, HFS_MANAGED_FILE_DRIFT]
   - id: app.ci-e2e
     profiles: [app]
     path: ".github/workflows/e2e.yml"
     presence: optional     # on: workflow_dispatch only
+    litePresence: forbidden     # a lite app has no e2e run
     tracked: tracked
     tier: none
     tests: none
+    goesTo: "the full edition: a lite app has no e2e workflow (no tests, nothing to run)"
     managedBy: ci-workflows
     rules: [HFS_CI_E2E_AUTOMATIC, HFS_MANAGED_FILE_DRIFT]
+  - id: app.ci-images
+    profiles: [app]
+    # Builds every image of the app (one matrix entry per declared app, path-filtered), never pushes: rendered by starci app sync.
+    path: ".github/workflows/images.yml"
+    presence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: ci-workflows
+    liteManagedBy: ci-workflows-lite
+    rules: [HFS_MANAGED_FILE_DRIFT]
+  - id: app.ci-db
+    profiles: [app]
+    # The database deploy workflow: workflow_dispatch only (like app.ci-e2e); starci app sync renders it under the managed ci group.
+    path: ".github/workflows/db-deploy.yml"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    liteManagedBy: ci-workflows-lite
+    rules: [HFS_MANAGED_FILE_DRIFT]
+    since: 2.1.0
+  - id: app.dockerignore
+    profiles: [app]
+    # The one build-context filter of every image (the context is the app root): rendered by starci app sync; it keeps secrets and build output out.
+    path: .dockerignore
+    presence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: docker-ignore
+    rules: [HFS_MANAGED_FILE_DRIFT]
+  - id: app.browser
+    profiles: [app]
+    # The browser journey of the product (Playwright, owner ruling: one minimal journey per example app, run manually): the config, its
+    # journeys and the script that provisions the stack it runs against. It is the product's, never the front end's (FE_NO_TESTS keeps
+    # refusing any test or test tooling inside fe/). Declared by `browser: true` in hfs.json; the managed script `test:browser` exists only then.
+    path: "browser/"
+    presence: opt-in
+    tracked: tracked
+    tier: none
+    tests: none
+    requires: [playwright.config.ts, journeys/]
+    allows: [playwright.config.ts, stack.mjs, "journeys/*.ts"]
   - id: app.github-meta
     profiles: [app]
     path: ".github/{CODEOWNERS,pull_request_template.md,ISSUE_TEMPLATE/**,dependabot.yml}"
@@ -290,13 +498,16 @@ slots:
   - id: app.scripts
     profiles: [app]
     # The app's operational scripts only (`*.mjs`, `*.cjs`, `*.ps1`, `*.sh`), or nothing: an empty folder is `scripts/.gitkeep`, which
-    # `hfs scaffold app` writes. A spec or a test (BE_SPEC_PLACEMENT, FE_NO_TESTS), a check or lint source (`check-*`, `eslint-local-rules*`,
+    # `starci app scaffold` writes. A spec or a test (BE_SPEC_PLACEMENT, FE_NO_TESTS), a check or lint source (`check-*`, `eslint-local-rules*`,
     # a local eslint plugin: HFS_REPO_LOCAL_CHECK) and anything that re-implements a canon check is not an operational script and has no place here.
     path: "scripts/{.gitkeep,*.mjs,*.cjs,*.ps1,*.sh}"
     presence: optional
     tracked: tracked
     tier: none
     tests: none
+    lite:
+      path: scripts/codegen.mjs
+    liteManagedBy: codegen-lite
     rules: [HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]     # one-off codemods and fix-* scripts are agent output, not tooling
   - id: app.sides
     profiles: [app]
@@ -314,13 +525,29 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    requires: [.gitignore, workspace.yaml, features/index.yaml]
-    allows: [workspace.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml",
+    requires: [.gitignore, workspace.yaml, index.yaml]
+    allows: [workspace.yaml, index.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml",
              "features/<feature>/<family>/<name>/index.yaml", "features/<feature>/br/<rule>/ac/<name>/index.yaml",
              "features/<feature>/ui/<name>/assets/<approved-file>", "features/<feature>/uat/<name>/{index,accounts,fixtures}.yaml",
              "features/<feature>/uat/<name>/{seed,cleanup}.sql", "_resources/{identities,environments,fixtures}/<slug>/resource.yaml"]
     forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/, "work/node records"]
+    # Lite keeps the product catalog, feature overviews, grammar and brand drawing records; UAT records belong to the forbidden slot below.
+    lite:
+      requires: [.gitignore, workspace.yaml, index.yaml]
+      allows: [workspace.yaml, index.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml", "features/<feature>/ui/<name>/index.yaml", "features/<feature>/ui/<name>/assets/<approved-file>"]
     rules: [HFS_AGENT_DATA_TRACKED, HFS_WORK_NODE_RETIRED, HFS_IDENTITY_CUSTODY]
+  - id: app.starciwork.uat
+    profiles: [app]
+    # The UAT records of the full edition: a lite app has no UAT (no tests, no record of one), so the trees are forbidden paths
+    # under lite only. In full this slot does not exist and .starciwork answers for them.
+    editions: [lite]
+    path: ".starciwork/{_resources/identities,_resources/fixtures,features/<feature>/uat,features/<feature>/br}/"
+    presence: forbidden
+    tracked: external
+    tier: none
+    tests: none
+    goesTo: "the full edition: a lite app has no UAT records (no identities or fixtures resources, no br/ac evidence, no uat directories)"
+    since: 2.1.0
   - id: app.starcistacks
     profiles: [app]
     # The stack declarations and the sealed custody of the app, at the app root beside be/, fe/ and .starciwork (never under a side).
@@ -331,8 +558,14 @@ slots:
     tests: none
     requires: [application-stacks.yaml]
     allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/{compose,k8s,terraform}/**", "<env>/infra/metadata.json",
-             "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/seeds/**"]
+             "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
     forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
+    # Lite runs one managed host: the reduced shape keeps the stack declaration, the environment descriptor and the sealed
+    # secrets; infra/, runtime/ and seeds/ are the full edition's.
+    lite:
+      requires: []
+      allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep"]
+      forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
     rules: [HFS_STACKS_SHAPE, HFS_STACKS_IN_SIDE, HFS_PLAINTEXT_SECRET, HFS_IDENTITY_CUSTODY]
   - id: app.sops
     profiles: [app]
@@ -359,7 +592,7 @@ slots:
     goesTo: "${STARCI_CACHE_HOME:-%LOCALAPPDATA%/StarCi/cache}/<repo>/<tool>/ (the canon presets set eslint --cache-location, jest cacheDirectory, turbo cacheDir, sonar.working.directory)"
   - id: app.agent-output
     profiles: [app]
-    path: "{report*.json,*.tmp.json,%*%,nul,.qwen*,.artifacts/,.tmp-*,*-lint.json,lf.json,lt.json,*.log,design-plans/,.gitmounts/,.dat,vi-flat.txt}"
+    path: "{report*.json,*.tmp.json,%*%,nul,.artifacts/,.tmp-*,*-lint.json,lf.json,lt.json,*.log,design-plans/,.gitmounts/,.dat,vi-flat.txt}"
     presence: forbidden
     tracked: external
     tier: none
@@ -373,7 +606,7 @@ slots:
     tracked: external
     tier: none
     tests: none
-    goesTo: "D:/starci-lanes/<project>/<lane>/ (outside every repository) for a lane; a Kernel workflow's worktree is created and owned by Orca outside the app checkout, never tracked, and removed by the runtime's host-side controller once the workflow's finish marked it release-pending"
+    goesTo: "<lanes root>/<project>/<lane>/ (outside every repository) for a lane; a Kernel workflow's worktree is created and owned by Orca outside the app checkout, never tracked, and removed by the runtime's host-side controller once the workflow's finish marked it release-pending"
   - id: app.plaintext-env
     profiles: [app]
     path: "{.env,.env.*,.secrets/,**/*.pem,**/*.key}"
@@ -384,10 +617,92 @@ slots:
     goesTo: ".starcistacks/<env>/secrets/<slug>.enc (at the app root); decrypted values only in memory or under %LOCALAPPDATA%/StarCi/secrets/<project>/<env>/ via *_FILE"
     rules: [HFS_PLAINTEXT_SECRET]
 
+  # ----- app root: the Supabase project of an app whose connection declares provider: supabase (every lite app) -------
+  - id: app.supabase
+    profiles: [app]
+    # The one Supabase project directory, at the app root beside be/, fe/ and .starcistacks (never under a side).
+    path: "supabase/"
+    presence: opt-in              # enabled by a connection with provider: supabase; required under edition lite
+    provider: supabase
+    litePresence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    since: 2.1.0
+  - id: app.supabase.config
+    profiles: [app]
+    # The project configuration: auth keys are env(NAME) references, never literals (L08 judges its policy keys).
+    path: "supabase/config.toml"
+    presence: opt-in
+    provider: supabase
+    litePresence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    since: 2.1.0
+  - id: app.supabase.migrations
+    profiles: [app]
+    # The schema authority of an app on Supabase: forward-only SQL migrations named <timestamp14>_<kebab-name>.sql,
+    # one file per change, immutable once on origin/main (L02-L08 judge them).
+    path: "supabase/migrations/<stamp>_<name>.sql"
+    presence: opt-in
+    provider: supabase
+    litePresence: required
+    lite: {minInstances: 1}
+    tracked: tracked
+    tier: none
+    tests: none
+    since: 2.1.0
+  - id: app.supabase.seed
+    profiles: [app]
+    path: "supabase/seed.sql"
+    presence: optional            # synthetic dev data only; a lite app seeds nothing it cannot regenerate
+    tracked: tracked
+    tier: none
+    tests: none
+    since: 2.1.0
+  - id: app.supabase.types
+    profiles: [app]
+    # The generated Database types (database.types.ts) contract:emit writes from the migrations; both sides read it
+    # (sides.<side>.reads supabase/types/); drift against regeneration is L09.
+    path: "supabase/types/database.types.ts"
+    presence: opt-in
+    provider: supabase
+    litePresence: required
+    tracked: tracked
+    tier: none
+    tests: none
+    since: 2.1.0
+  - id: app.supabase.templates
+    profiles: [app]
+    path: "supabase/templates/*.html"
+    presence: optional            # the auth e-mail templates Supabase serves
+    tracked: tracked
+    tier: none
+    tests: none
+    since: 2.1.0
+  - id: app.supabase.local-state
+    profiles: [app]
+    path: "supabase/{.temp,.branches}/"
+    presence: optional
+    tracked: ignored              # the local CLI's working state: exists, never committed
+    tier: none
+    tests: none
+    since: 2.1.0
+  - id: app.supabase.functions
+    profiles: [app]
+    path: "supabase/functions/"
+    presence: forbidden           # a Deno runtime is a second language runtime outside the lint canon and the slot machine (lite v1)
+    tracked: external
+    tier: none
+    tests: none
+    goesTo: "a be feature: webhooks/<provider> for a third-party callback, api for an endpoint, a cli command on a schedule (pg_cron / pg_net)"
+    since: 2.1.0
+
   # ----- side root (both sides): what the old standalone repository root held, less the app-root files ----------
   - id: repo.side-root-forbidden
     profiles: [be, fe]
-    path: "{package.json,package-lock.json,hfs.json,README.md,.gitignore,.gitattributes,.husky/,.github/,.starciwork/,.starcistacks/,.sops.yaml,sonar-project.properties,codecov.yml,.prettierrc,.prettierignore,scripts/}"
+    path: "{package.json,package-lock.json,hfs.json,README.md,.gitignore,.gitattributes,.husky/,.github/,.starciwork/,.starcistacks/,supabase/,.sops.yaml,sonar-project.properties,codecov.yml,.prettierrc,.prettierignore,scripts/}"
     presence: forbidden
     tracked: external
     tier: none
@@ -395,7 +710,7 @@ slots:
     goesTo: "the app root: one package.json, lockfile, hfs.json, README, git and CI files, hooks, formatter, Sonar and Codecov configuration, scripts/, .starciwork, .starcistacks and .sops.yaml per app"
   - id: be.tool-config
     profiles: [be]
-    # Managed files (hfs sync renders them, hfs check compares them): the whole tool configuration of a back end. Each is
+    # Managed files (starci app sync renders them, starci app check compares them): the whole tool configuration of a back end. Each is
     # a reference to a canon package, never a configuration: tsconfig.json extends @starci/tsconfig/be.json and adds the
     # three path aliases and excludes the world, integration, e2e and contract trees (fixtures stay in the root program: unit
     # specs import them); tsconfig.build.json puts an overlay preset after it and adds only the path-relative options a
@@ -409,15 +724,21 @@ slots:
     tracked: tracked
     tier: none
     tests: none
+    # Lite: no test tsconfig (no test tree) and no jest configuration; both are forbidden paths there (repo.tests-forbidden).
+    lite: {path: "{tsconfig.json,tsconfig.build.json,eslint.config.mjs}"}
+    coverage: none
     managedBy: tool-config
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL, HFS_TS_STRICT]
   - id: be.nest-cli
     profiles: [be]
+    # The Nest monorepo of the back end: `monorepo: true` and one project per declared be app (apps/<app>, even for one service).
     path: nest-cli.json
     presence: required
     tracked: tracked
     tier: none
     tests: none
+    coverage: none
+    rules: [HFS_MONO_NEST_PROJECTS]
   - id: be.tool-config-local
     profiles: [be]
     path: "{.eslintrc,.eslintrc.*,.eslintignore,eslint.config.js,eslint.config.cjs,eslint.config.ts,eslint.config.mts,eslint.config.cts,.prettierrc.*,prettier.config.*,jest.config.ts,jest.config.mjs,jest.config.cjs,jest.config.json,jest.config.e2e.js}"
@@ -429,7 +750,7 @@ slots:
     rules: [HFS_TOOL_CONFIG_LOCAL]
   - id: fe.tool-config
     profiles: [fe]
-    # Managed files (hfs sync renders them, hfs check compares them): the tool configuration of a front end. Each is a
+    # Managed files (starci app sync renders them, starci app check compares them): the tool configuration of a front end. Each is a
     # reference to a canon package, never a configuration: tsconfig.json extends @starci/tsconfig/next.json and only
     # names the preset and nothing else (each app's own tsconfig.json, in fe.app.next, carries its aliases and include; there is
     # no test tsconfig: a front end has no tests, FE_NO_TESTS); eslint.config.mjs is the one-line starciFeConfig call;
@@ -442,22 +763,14 @@ slots:
     tests: none
     managedBy: tool-config
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL, HFS_RULE_OFF_WITHOUT_REPLACEMENT, HFS_TS_STRICT]
-  - id: fe.tool-config-repo
-    profiles: [fe]
-    # The one tool file a preset cannot render because it carries the repository's own facts: turbo.json (its task graph).
-    path: turbo.json
-    presence: optional
-    tracked: tracked
-    tier: none
-    tests: none
   - id: fe.tool-config-local
     profiles: [fe]
-    path: "{.eslintrc,.eslintrc.*,.eslintignore,eslint.config.js,eslint.config.cjs,eslint.config.ts,eslint.config.mts,eslint.config.cts,.stylelintrc,.stylelintrc.*,.stylelintignore,stylelint.config.js,stylelint.config.cjs,stylelint.config.ts,stylelint.config.json,prettier.config.*,.prettierrc.*,lint-staged.config.*,.lintstagedrc*}"
+    path: "{.eslintrc,.eslintrc.*,.eslintignore,eslint.config.js,eslint.config.cjs,eslint.config.ts,eslint.config.mts,eslint.config.cts,.stylelintrc,.stylelintrc.*,.stylelintignore,stylelint.config.js,stylelint.config.cjs,stylelint.config.ts,stylelint.config.json,prettier.config.*,.prettierrc.*,lint-staged.config.*,.lintstagedrc*,turbo.json}"
     presence: forbidden
     tracked: external
     tier: none
     tests: none
-    goesTo: "nowhere: a front end has exactly the managed tool configuration (fe.tool-config); a change to a rule or a flag is proposed in the .claude runtime"
+    goesTo: "nowhere: a front end has exactly the managed tool configuration (fe.tool-config); the task graph is the app root's turbo.json (app.task-graph); a change to a rule or a flag is proposed in the .claude runtime"
     rules: [HFS_TOOL_CONFIG_LOCAL]
   - id: repo.docs
     profiles: [be, fe]
@@ -466,6 +779,7 @@ slots:
     tracked: tracked
     tier: none
     tests: none
+    coverage: none
     rules: [HFS_ROOT_MARKDOWN_FORBIDDEN]
   - id: repo.docs-media
     profiles: [be, fe]
@@ -474,6 +788,7 @@ slots:
     tracked: tracked
     tier: none
     tests: none
+    coverage: none
     budget: {bytes: 512000}
   - id: repo.packages
     profiles: [be, fe]
@@ -484,21 +799,21 @@ slots:
     owner: true
     requires: [package.json, src/index.ts, tsconfig.json]
     tests: unit-beside
+    coverage: none
     rules: [FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT]
   - id: repo.app-image
     profiles: [be, fe]
+    # One image per app: every declared app has its own Dockerfile (apps/<app>/Dockerfile), built from the APP ROOT (the folder with
+    # the one package.json). It is app-owned (starci app scaffold writes it once from templates/<side>/image) and judged by the docker rules.
+    # A Dockerfile anywhere else is owned by no slot.
     path: "apps/<app>/Dockerfile"
-    presence: optional
-    tracked: tracked
-    tier: none
-    tests: none
-  - id: repo.dockerignore
-    profiles: [be, fe]
-    path: .dockerignore
-    presence: optional
+    presence: required
+    litePresence: {fe: optional}     # lite: a Next app may be built by its host (Netlify, Vercel); a be image stays required
     tracked: tracked
     tier: none
     tests: none
+    coverage: none
+    rules: [HFS_DOCKER_BUILD_CONTEXT, HFS_DOCKER_STAGES, HFS_DOCKER_ENTRY, HFS_DOCKER_BASE_PIN, HFS_DOCKER_SECRETS]
 
   # ----- never tracked: build output the tools need in place ---------------------------------------------
   - id: repo.build-output
@@ -528,7 +843,7 @@ slots:
     goesTo: "${STARCI_CACHE_HOME:-%LOCALAPPDATA%/StarCi/cache}/<repo>/<tool>/ (the canon presets set eslint --cache-location, jest cacheDirectory, turbo cacheDir, sonar.working.directory)"
   - id: repo.agent-output
     profiles: [be, fe]
-    path: "{report*.json,*.tmp.json,%*%,nul,.qwen*,.artifacts/,.tmp-*,*-lint.json,lf.json,lt.json,*.log,design-plans/,.gitmounts/,.dat,vi-flat.txt}"
+    path: "{report*.json,*.tmp.json,%*%,nul,.artifacts/,.tmp-*,*-lint.json,lf.json,lt.json,*.log,design-plans/,.gitmounts/,.dat,vi-flat.txt}"
     presence: forbidden
     tracked: external
     tier: none
@@ -542,7 +857,7 @@ slots:
     tracked: external
     tier: none
     tests: none
-    goesTo: "D:/starci-lanes/<project>/<lane>/ (outside every repository)"
+    goesTo: "<lanes root>/<project>/<lane>/ (outside every repository)"
   - id: repo.plaintext-env
     profiles: [be, fe]
     path: "{.env,.env.*,.secrets/,**/*.pem,**/*.key}"
@@ -552,6 +867,21 @@ slots:
     tests: none
     goesTo: ".starcistacks/<env>/secrets/<slug>.enc (at the app root); decrypted values only in memory or under %LOCALAPPDATA%/StarCi/secrets/<project>/<env>/ via *_FILE"
     rules: [HFS_PLAINTEXT_SECRET]
+  - id: repo.tests-forbidden
+    profiles: [be, fe]
+    # Edition lite has no test world, on either side: a spec file, a test directory or a test-tool configuration anywhere in
+    # a side is a forbidden path (a finding, not an ignored file). In full this slot does not exist and each test file is
+    # judged by its own slot (the be tests tree, FE_NO_TESTS on the fe side).
+    editions: [lite]
+    # No nested braces: braceVariants expands each inner group per outer option. `**/e2e/` also matches a root e2e/ but
+    # be.root-e2e wins that on specificity; both are forbidden.
+    path: "{**/*.spec.*,**/*.test.*,**/*-spec.*,src/tests/,**/__tests__/,**/e2e/,**/test-support/,**/__mocks__/,**/jest.*,**/vitest.*,**/playwright.*,**/cypress.config.*,**/tsconfig.e2e.json,**/e2e.yml,**/e2e.yaml}"
+    presence: forbidden
+    tracked: external
+    tier: none
+    tests: none
+    goesTo: "the full edition: a lite repository holds no spec, test directory or jest/vitest/playwright configuration"
+    since: 2.1.0
   - id: be.root-e2e
     profiles: [be]
     path: "e2e/"
@@ -569,7 +899,8 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    why: emitted by `npm run contract:emit` (`hfs emit-contracts`, never written by hand); CI fails when the emitted file differs (a contract, not a build artefact)
+    coverage: none
+    why: emitted by `npm run contract:emit` (`starci app emit`, never written by hand); CI fails when the emitted file differs (a contract, not a build artefact)
     rules: [HFS_CONTRACT_SNAPSHOT_DRIFT]
   - id: be.contract.openapi
     profiles: [be]
@@ -578,8 +909,33 @@ slots:
     tracked: tracked
     tier: none
     tests: none
-    why: emitted by `npm run contract:emit` (`hfs emit-contracts`, never written by hand) from the app's typed operation table `apps/<app>/src/operations.ts` (canon BE-OPERATIONS-1); CI fails when the emitted file differs
+    coverage: none
+    why: emitted by `npm run contract:emit` (`starci app emit`, never written by hand) from the app's typed operation table `apps/<app>/src/operations.ts` (canon BE-OPERATIONS-1); CI fails when the emitted file differs
     rules: [HFS_CONTRACT_SNAPSHOT_DRIFT]
+  - id: be.contract.events
+    profiles: [be]
+    path: "contracts/<app>/events.json"
+    presence: opt-in
+    litePresence: forbidden         # lite has no event bus, so no async contract to emit
+    tracked: tracked
+    tier: none
+    tests: none
+    coverage: none
+    why: the async contract of a service (`starci/event-contract@1`), emitted by `npm run contract:emit` (`starci app emit`, never written by hand) from the typed event classes of `src/modules/events/<service>/`; the consumers of its events rely on it (R166 HFS_EVENT_CONTRACT)
+    goesTo: "the full edition: a lite app has no event bus (no Kafka, no outbox), so no async contract exists to emit"
+    rules: [HFS_EVENT_CONTRACT]
+  - id: be.contract.events.pin
+    profiles: [be]
+    path: "contracts/<app>/events.pin.json"
+    presence: opt-in
+    litePresence: forbidden
+    tracked: tracked
+    tier: none
+    tests: none
+    coverage: none
+    why: the previously published event contract of a service, the same format as its events.json (copied over when the contract is published, never edited); the current events.json may only extend it additively, a breaking change is a new `<event>.v2` key (R177 BE_CONTRACT_BREAKING)
+    goesTo: "the full edition: a lite app has no event bus, so no published event contract to pin"
+    rules: [BE_CONTRACT_BREAKING]
 
   # ----- BE: apps (one slot per app kind; a new kind = a new slot, minor bump) ---------------------------
   - id: be.app.api
@@ -594,50 +950,53 @@ slots:
     requires: [main.ts, app.module.ts]
     allows: [main.ts, app.module.ts, "<app>.options.ts", operations.ts]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
+    coverage: none
     budget: {app.module.ts: 250, main.ts: 80}
-    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_BUSINESS_ROLE, BE_DEFAULT_DENY, BE_ERROR_MASKED, BE_FEATURE_NOT_COMPOSED]
+    rules: [BE_APP_COMPOSITION_ONLY, BE_APP_BUSINESS_ROLE, BE_DEFAULT_DENY, BE_ERROR_MASKED, BE_FEATURE_NOT_COMPOSED, BE_CONTEXT_OWNER]
   - id: be.app.worker
     profiles: [be]
     path: "apps/<app>/src/"
-    appKind: worker               # composes transport/schedule and transport/message modules only
+    appKind: worker               # composes transport/message modules and job processors only (an api app may compose them too: a worker app is for separate scaling)
     presence: opt-in
+    litePresence: forbidden       # lite has no queue or event bus to consume; background work is a cli command on a schedule
     tracked: tracked
     tier: app
     owner: true
     requires: [main.ts, app.module.ts]
     allows: [main.ts, app.module.ts, "<app>.options.ts"]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
-    rules: [BE_APP_COMPOSITION_ONLY, BE_BACKGROUND_UNOWNED]
-  - id: be.app.migrate
-    profiles: [be]
-    path: "apps/<app>/src/"
-    appKind: migrate              # the ONLY process that runs migrations (one run per connection, before api/worker start)
-    presence: required
-    requiredWhen: connections     # required as soon as hfs.json declares a connection
-    tracked: tracked
-    tier: app
-    owner: true
-    requires: [main.ts]
-    allows: [main.ts, "<app>.options.ts"]
-    tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
-    rules: [BE_SCHEMA_AUTHORITY, BE_ENTRYPOINT_ONLY_IN_APPS]
+    goesTo: "the full edition: a lite app has no worker (scheduled work is a cli command invoked by pg_cron / pg_net or a platform cron)"
+    coverage: none
+    rules: [BE_APP_COMPOSITION_ONLY, BE_BACKGROUND_UNOWNED, BE_CONTEXT_OWNER]
   - id: be.app.cli
     profiles: [be]
+    # The ONE app of every one-off action (migrate, seed, sync, backup, any operator command): be/apps/cli, on nest-commander.
+    # main.ts boots with CommandFactory.run (BE_CLI_BOOTSTRAP); app.module.ts composes the platform and the cli feature root
+    # (src/features/cli/cli.module.ts); cli.options.ts carries what it needs from the environment, the connections it migrates
+    # among them (the test world migrates through the same list). It is required as soon as the back end declares a connection
+    # or tracks a command, with its image apps/cli/Dockerfile (BE_CLI_REQUIRED): one image, run as `cli <group> <command>`.
     path: "apps/<app>/src/"
     appKind: cli
     presence: opt-in
+    litePresence: optional        # lite: schema migration is the Supabase CLI's job; a cli app exists only when the app declares one
     tracked: tracked
     tier: app
     owner: true
     requires: [main.ts, app.module.ts]
     allows: [main.ts, app.module.ts, "<app>.options.ts"]
     tests: none                   # an app is proven by the e2e world (useTestWorld({ apps })), never by a unit spec
+    coverage: none
+    rules: [BE_CLI_REQUIRED, BE_CLI_BOOTSTRAP, BE_CLI_OWNER, BE_SCHEMA_AUTHORITY]
 
   # ----- BE: features ------------------------------------------------------------------------------------
+  # src/features/ is grouped by TRIGGER KIND (owner decision 2026-10-02): features/api/<feature>/ (a request: application/ and
+  # transport/<protocol>/, composed by the api apps), features/cli/ (a one-off action: the cli feature root, compiled only into
+  # apps/cli). Every kind imports only downward into modules/*; no kind imports another.
   - id: be.feature
     profiles: [be]
-    path: "src/features/<feature>/"
+    path: "src/features/api/<feature>/"
     presence: required
+    trigger: api                  # a request-driven feature (graphql, http); the other trigger kinds have their own roots below
     tracked: tracked
     tier: feature
     owner: true
@@ -645,96 +1004,250 @@ slots:
     requires: [index.ts, "<feature>.module.ts", application/]
     allows: [index.ts, "<feature>.module.ts", application/, transport/, messages/]   # nothing else at feature root
     tests: none
+    coverage: none
     budget: {files: 250, indexExports: 60}   # a feature above 250 source files must be split by product capability
     rules: [BE_FEATURE_SHAPE, BE_FEATURE_IMPORTS_FEATURE, BE_PUBLIC_SURFACE, BE_FEATURE_NOT_COMPOSED]
   - id: be.feature.application
     profiles: [be]
-    path: "src/features/<feature>/application/"
+    path: "src/features/{api/,jobs/,reactors/,saga/}<feature>/application/"     # inside a trigger kind (jobs, reactors, saga) the feature folder is one level down
+    lite: {path: "src/features/api/<feature>/application/"}                    # lite has only the api kind; the other roots are forbidden slots
     presence: required
     tracked: tracked
     tier: feature
     allows: ["<action>.{command,query,handler,contracts}.ts"]
     forbids: [graphql/, http/, message/, schedule/, transport/]   # no protocol names under application/
     tests: none
+    coverage: none
     rules: [BE_APPLICATION_IMPORTS_TRANSPORT, BE_APPLICATION_TRANSPORT_FRAMEWORK, BE_ENTITY_IN_CONTRACT, BE_CQRS_SHAPE]
+  - id: be.feature.saga
+    profiles: [be]
+    path: "src/features/saga/<saga>/"
+    pattern: saga                 # enabled by `patterns: ["saga"]` in hfs.json sides.be (R169 to R173); an undeclared saga folder is HFS_SLOT_NOT_ENABLED
+    presence: opt-in              # a saga: the orchestrator of a business flow that crosses services, started and advanced only by events (knowledge/patterns/be/saga.yaml)
+    litePresence: forbidden
+    trigger: saga
+    tracked: tracked
+    tier: feature
+    owner: true
+    requires: [index.ts, "<saga>.module.ts", "<saga>.saga.service.ts", "<saga>.saga-state.ts", steps/, compensations/, transport/]
+    allows: [index.ts, "<saga>.module.ts", "<saga>.saga.service.ts", "<saga>.saga.service.spec.ts", "<saga>.saga-state.ts", "<saga>.saga.log-events.ts", application/, steps/, compensations/, transport/]   # the orchestrator is a `*.service.ts` because a handler injects only services; unit-tested beside it
+    tests: unit-beside            # <saga>.saga.service.spec.ts beside the orchestrator; the state machine and its fence are platform/saga's service; each compensation path has an e2e spec
+    goesTo: "the full edition: a lite app has no saga (no event bus to advance it)"
+    coverage: none
+    rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED, BE_SAGA_STEP_COMPENSATION, BE_SAGA_STATE_VERSIONED, BE_SAGA_EVENT_CONTRACT, BE_SAGA_E2E_MISSING]
+  - id: be.feature.saga.steps
+    profiles: [be]
+    path: "src/features/saga/<saga>/steps/"
+    pattern: saga
+    presence: opt-in
+    litePresence: forbidden
+    tracked: tracked
+    tier: feature
+    allows: ["<step>.saga-step.ts"]    # one step of the flow: its name and the event it puts on the wire (the contract); its work is done by the domain, not by the step
+    tests: none
+    goesTo: "the full edition: a lite app has no saga"
+    coverage: none
+    rules: [BE_SAGA_STEP_COMPENSATION, BE_SAGA_EVENT_CONTRACT]
+  - id: be.feature.saga.compensations
+    profiles: [be]
+    path: "src/features/saga/<saga>/compensations/"
+    pattern: saga
+    presence: opt-in
+    litePresence: forbidden
+    tracked: tracked
+    tier: feature
+    allows: ["<step>.compensation.ts"]   # REQUIRED for every step: the command that undoes it, naming the failure event that triggers it
+    tests: none
+    goesTo: "the full edition: a lite app has no saga"
+    coverage: none
+    rules: [BE_SAGA_STEP_COMPENSATION, BE_SAGA_EVENT_CONTRACT, BE_SAGA_E2E_MISSING]
   - id: be.feature.application.support
     profiles: [be]
-    path: "src/features/<feature>/application/support/"
+    path: "src/features/{api/,jobs/,reactors/,saga/}<feature>/application/support/"
+    lite: {path: "src/features/api/<feature>/application/support/"}
     presence: optional            # helpers and types local to ONE feature; same tier as application, never a shared home
     tracked: tracked
     tier: feature                 # feature tier: another feature cannot import it (features never import features)
     allows: ["<name>.<role>.ts"]     # <role> from ruleParams.be.suffixes; no <name>.types.ts
     forbids: [graphql/, http/, message/, schedule/, transport/]
     tests: none
+    coverage: none
     rules: [BE_APPLICATION_IMPORTS_TRANSPORT, BE_APPLICATION_TRANSPORT_FRAMEWORK, BE_FEATURE_IMPORTS_FEATURE]
     since: 1.0.0
   - id: be.transport.http
     profiles: [be]
-    path: "src/features/<feature>/transport/http/"
+    path: "src/features/api/<feature>/transport/http/"
     presence: optional
     tracked: tracked
     tier: feature
     requires: ["<feature>-http.module.ts"]
     allows: ["<action>.controller.ts", "dto/<action>.{request,response}.ts", "<action>.mapper.ts"]
     tests: none
+    coverage: none
     composedBy: [api]
     rules: [BE_DEFAULT_DENY, BE_INPUT_BOUNDED, BE_TRANSPORT_SHAPE]
   - id: be.transport.graphql
     profiles: [be]
-    path: "src/features/<feature>/transport/graphql/"
+    path: "src/features/api/<feature>/transport/graphql/"
     presence: optional
     tracked: tracked
     tier: feature
     requires: ["<feature>-graphql.module.ts"]
     allows: ["<action>.resolver.ts", "dto/<action>.{input,type,args}.ts", "<action>.mapper.ts"]
     tests: none
+    coverage: none
     composedBy: [api]
     rules: [BE_DEFAULT_DENY, BE_INPUT_BOUNDED, BE_TRANSPORT_SHAPE]
   - id: be.transport.message
     profiles: [be]
-    path: "src/features/<feature>/transport/message/"
-    presence: opt-in              # queue worker: consumed only by a worker app
+    path: "src/features/{api/,reactors/,saga/}<feature>/transport/message/"
+    presence: opt-in              # queue consumer: composed by the service that owns it (an api app) or by a worker app scaled apart
+    litePresence: forbidden       # a consumer reads the event bus, which lite does not have
+    pattern: event-bus            # a consumer reads the event bus; declaring the pattern enables the slot
     tracked: tracked
     tier: feature
     requires: ["<feature>-message.module.ts"]
     allows: ["<event>.consumer.ts"]     # BE-CONVENTION 1.6: transport/message holds only consumers; a .message.ts is outside the closed suffix list
     tests: none
-    composedBy: [worker]
-    rules: [BE_BACKGROUND_UNOWNED]
-  - id: be.transport.schedule
+    coverage: none
+    composedBy: [api, worker]
+    goesTo: "the full edition: a lite app has no event bus, so no message transport (a third-party callback is a webhooks feature)"
+    rules: [BE_BACKGROUND_UNOWNED, BE_SAGA_CONSUMER_DEDUPE]
+  # ----- BE: feature kinds that are not an api: a webhook door and a realtime door. Each kind is a folder of src/features/ named by
+  # the kind and holds one folder per provider or channel; a kind imports only modules/* (never another kind) and only an
+  # api-kind app composes it. Their doors answer to the same door laws as every transport (default deny, bounded input,
+  # no envelope), plus the kind laws of knowledge/patterns/be/webhooks.yaml and realtime.yaml.
+  - id: be.feature.webhooks
     profiles: [be]
-    path: "src/features/<feature>/transport/schedule/"
-    presence: opt-in              # cron job, sweep or outbox publisher: consumed only by a worker app
+    path: "src/features/webhooks/<provider>/"
+    presence: opt-in              # a provider webhook intake: verifies the signature and replay window, then hands the delivery to ONE domain intake method
+    pattern: webhooks             # declaring the pattern (hfs.json sides.be.patterns) enables the kind (knowledge/patterns/be/webhooks.yaml)
+    trigger: webhooks
     tracked: tracked
     tier: feature
-    requires: ["<feature>-schedule.module.ts"]
-    allows: ["<job>.job.ts"]
+    owner: true
+    requires: [index.ts, transport/]
+    allows: [index.ts, transport/]
     tests: none
-    composedBy: [worker]
-    rules: [BE_BACKGROUND_UNOWNED]
-  - id: be.transport.websocket
+    coverage: none
+    rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
+    since: 1.0.0
+  - id: be.feature.webhooks.http
+    profiles: [be]
+    path: "src/features/webhooks/<provider>/transport/http/"
+    presence: opt-in              # the one door of the provider: its module, the signed webhook and the door's own spec
+    pattern: webhooks
+    tracked: tracked
+    tier: feature
+    requires: ["<provider>-http.module.ts", "<provider>.webhook.ts", "<provider>.webhook.spec.ts"]
+    allows: ["<provider>-http.module.ts", "<provider>.webhook.ts", "<provider>.webhook.spec.ts", dto/]
+    tests: unit-beside            # the door's own spec (<provider>.webhook.spec.ts) beside the door: the one non-service unit spec of this kind
+    lite:                         # a lite app has no test world: the door and its module only
+      requires: ["<provider>-http.module.ts", "<provider>.webhook.ts"]
+      allows: ["<provider>-http.module.ts", "<provider>.webhook.ts", dto/]
+    coverage: none
+    composedBy: [api]
+    rules: [BE_WEBHOOK_SHAPE, BE_WEBHOOK_UNVERIFIED, BE_DEFAULT_DENY, BE_INPUT_BOUNDED]
+    since: 1.0.0
+  - id: be.feature.webhooks.dto
     profiles: [be]
-    path: "src/features/<feature>/transport/websocket/"
+    path: "src/features/webhooks/<provider>/transport/http/dto/"
     presence: opt-in
+    pattern: webhooks
     tracked: tracked
     tier: feature
-    requires: ["<feature>-websocket.module.ts"]
-    allows: ["<channel>.gateway.ts", "dto/*.ts"]
+    allows: ["<event>.request.ts"]   # the typed provider payload, validated and bounded (BE_INPUT_BOUNDED)
     tests: none
+    coverage: none
     composedBy: [api]
+    rules: [BE_INPUT_BOUNDED]
     since: 1.0.0
-  - id: be.feature.transport.cli
+  - id: be.feature.realtime
     profiles: [be]
-    path: "src/features/<feature>/transport/cli/"
-    presence: opt-in              # a command line entry: dispatches one command or query, composed by an app of kind cli
+    path: "src/features/realtime/<channel>/"
+    presence: opt-in              # a push channel: reads and pushes only (a socket gateway or a GraphQL subscription), no domain write
+    litePresence: forbidden       # under lite realtime is Supabase Realtime (the client subscribes to channels; nothing serves them in be/)
+    pattern: realtime             # declaring the pattern (hfs.json sides.be.patterns) enables the kind (knowledge/patterns/be/realtime.yaml)
+    trigger: realtime
     tracked: tracked
     tier: feature
-    requires: ["<feature>-cli.module.ts"]
-    allows: ["<name>.cli.ts", "dto/*.ts"]     # .cli.ts: .command.ts is a CQRS message (HFS delta 3)
+    owner: true
+    requires: [index.ts, transport/]
+    allows: [index.ts, transport/]
     tests: none
-    composedBy: [cli]
-    rules: [BE_APPLICATION_IMPORTS_TRANSPORT, BE_FEATURE_NOT_COMPOSED, BE_ENTRYPOINT_ONLY_IN_APPS]
+    goesTo: "the full edition: under lite realtime is Supabase Realtime (RLS-governed), not a be kind"
+    coverage: none
+    rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
+    since: 1.0.0
+  - id: be.feature.realtime.graphql
+    profiles: [be]
+    path: "src/features/realtime/<channel>/transport/graphql/"
+    presence: opt-in              # a GraphQL subscription over graphql-ws
+    litePresence: forbidden
+    pattern: realtime
+    tracked: tracked
+    tier: feature
+    goesTo: "the full edition: under lite realtime is Supabase Realtime, not a be kind"
+    requires: ["<channel>-graphql.module.ts", "<channel>.subscription.ts", "<channel>.subscription.spec.ts"]
+    allows: ["<channel>-graphql.module.ts", "<channel>.subscription.ts", "<channel>.subscription.spec.ts", dto/]
+    tests: unit-beside            # the door's own spec beside the door (a subscription has no service of its own)
+    coverage: none
+    composedBy: [api]
+    rules: [BE_REALTIME_SHAPE, BE_REALTIME_WRITES, BE_REALTIME_TOPIC_SCOPE, BE_DEFAULT_DENY]
+    since: 1.0.0
+  - id: be.feature.realtime.dto
+    profiles: [be]
+    path: "src/features/realtime/<channel>/transport/graphql/dto/"
+    presence: opt-in
+    litePresence: forbidden
+    pattern: realtime
+    tracked: tracked
+    tier: feature
+    goesTo: "the full edition: under lite realtime is Supabase Realtime, not a be kind"
+    allows: ["<name>.{input,type,args}.ts"]
+    tests: none
+    coverage: none
+    composedBy: [api]
+    rules: [BE_INPUT_BOUNDED]
+    since: 1.0.0
+  - id: be.feature.realtime.websocket
+    profiles: [be]
+    path: "src/features/realtime/<channel>/transport/websocket/"
+    presence: opt-in              # a socket gateway
+    litePresence: forbidden
+    pattern: realtime
+    tracked: tracked
+    tier: feature
+    goesTo: "the full edition: under lite realtime is Supabase Realtime, not a be kind"
+    requires: ["<channel>-websocket.module.ts", "<channel>.gateway.ts", "<channel>.gateway.spec.ts"]
+    allows: ["<channel>-websocket.module.ts", "<channel>.gateway.ts", "<channel>.gateway.spec.ts"]
+    tests: unit-beside            # the door's own spec beside the door (a gateway has no service of its own)
+    coverage: none
+    composedBy: [api]
+    rules: [BE_REALTIME_SHAPE, BE_REALTIME_WRITES, BE_REALTIME_TOPIC_SCOPE, BE_DEFAULT_DENY]
     since: 1.0.0
+  - id: be.cli
+    profiles: [be]
+    # The cli feature root: every one-off action of the back end, compiled only into apps/cli. A group is a nest-commander
+    # @Command (<group>/<group>.cli.ts) whose sub-commands are @SubCommand classes extending CommandRunner
+    # (<group>/subs/<name>.cli.ts), each with its unit spec beside it (<name>.cli.spec.ts): a command is an action runner, not a
+    # thin transport (BE_CLI_COMMAND_SHAPE). `.cli.ts` because `.command.ts` is the CQRS message (HFS delta 3). Every module of
+    # the root is a static @Module (a feature holds no module definition): cli.module.ts imports each group module, a group
+    # module provides its commands, and a command takes its inputs from a platform capability (the connections and their opener
+    # from platform/database) or from a command-line @Option.
+    path: "src/features/cli/"
+    presence: optional
+    trigger: cli                  # the one cli feature root: a one-off action never imports a feature of another kind (BE_KIND_ISOLATION)
+    tracked: tracked
+    tier: feature
+    owner: true
+    requires: [index.ts, cli.module.ts]
+    # A composed root: an app of kind cli lists cli.module.ts, never a group module (BE_MODULE_SHAPE).
+    composedBy: [cli]
+    allows: [index.ts, cli.module.ts, "<group>/<group>.cli.ts", "<group>/<group>.cli.spec.ts", "<group>/<group>.module.ts", "<group>/subs/<name>.cli.ts", "<group>/subs/<name>.cli.spec.ts"]
+    tests: unit-beside
+    coverage: none
+    rules: [BE_CLI_COMMAND_SHAPE, BE_CLI_OWNER, BE_CLI_REQUIRED, BE_MODULE_SHAPE, BE_SCHEMA_AUTHORITY]
 
   # ----- BE: modules (three tiers, closed set) -----------------------------------------------------------
   - id: be.domain
@@ -748,8 +1261,9 @@ slots:
     allows: ["<capability>.module.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts"]
     forbids: [testing/, exceptions/, utils/, helpers/, shared/]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
+    coverage: required
     budget: {indexExports: 60}
-    rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_PUBLIC_SURFACE, BE_ERROR_HOME, BE_CONFIG_OWNER]
+    rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_PUBLIC_SURFACE, BE_ERROR_HOME, BE_CONFIG_OWNER, BE_CONTEXT_COUPLING, BE_CONTEXT_TRANSACTION]
   - id: be.errors
     profiles: [be]
     path: "src/modules/{domain,integrations}/<capability>/errors/"
@@ -758,6 +1272,7 @@ slots:
     tier: inherit
     allows: ["<capability>.error.ts", "<name>.error.ts"]   # one family per capability, extends platform/errors DomainError
     tests: none
+    coverage: none
     rules: [BE_ERROR_HOME]
   - id: be.domain.messages
     profiles: [be]
@@ -767,29 +1282,41 @@ slots:
     tier: inherit
     allows: ["<capability>.messages.ts"]   # one keyed catalog per capability, vi and en, read through the platform/i18n MessageCatalog port
     tests: none
+    coverage: none
     rules: [BE_USER_COPY_LITERAL]
     since: 1.0.0
   - id: be.feature.messages
     profiles: [be]
-    path: "src/features/<feature>/messages/"
+    path: "src/features/api/<feature>/messages/"
     presence: optional
     tracked: tracked
     tier: feature
     allows: ["<feature>.messages.ts"]   # one keyed catalog per feature, vi and en, read through the platform/i18n MessageCatalog port
     tests: none
+    coverage: none
     rules: [BE_USER_COPY_LITERAL]
     since: 1.0.0
   - id: be.persistence
     profiles: [be]
-    path: "src/modules/{domain,platform}/<capability>/persistence/"
+    path: "src/modules/{domain,platform,projections}/<capability>/persistence/"
+    # R178: the platform capabilities whose tables exist on EVERY connection that uses them (the event-bus outbox, the inbox of every service, the job table); their arrays may be
+    # registered on several declared connections. Any other capability registers its arrays on exactly one (BE_SCHEMA_OWNER).
+    perConnection: [event-bus, inbox, jobs]
     presence: optional
     tracked: tracked
     tier: inherit
     requires: [connection.ts]     # the capability's <c>Entities / <c>Migrations arrays (the owner index re-exports the two arrays by name); no CONNECTION alias: the connection is the one the apps register the arrays on
     allows: ["entities/<table>.entity.ts", "migrations/<epochMs13>-<kebab-name>.ts", "<name>.sql.ts", "<name>.rows.ts", connection.ts]
     forbids: [index.ts, "<name>.repository.ts"]
-    tests: none
-    rules: [BE_SCHEMA_OWNER, BE_SCHEMA_AUTHORITY, BE_SQL_OUTSIDE_PERSISTENCE]
+    # Lite keeps the shared-EntityManager persistence (raw SqlText + rows types over the generated Database row types) but the
+    # schema authority is supabase/migrations (ruleParams.be.lite.schemaAuthority): no TypeORM entity and no be migration.
+    lite:
+      requires: []                 # no TypeORM arrays to re-export: the persistence of a lite capability is its sql and rows files
+      allows: ["<name>.sql.ts", "<name>.rows.ts", connection.ts]
+      forbids: [index.ts, "<name>.repository.ts", entities/, migrations/]
+    tests: none
+    coverage: none
+    rules: [BE_SCHEMA_OWNER, BE_SCHEMA_AUTHORITY, BE_SQL_OUTSIDE_PERSISTENCE, BE_SQL_TABLE_OWNER, BE_SQL_RETURNING_SHAPE, BE_CONTEXT_COUPLING, BE_CONTEXT_PLATFORM_TABLES]
   - id: be.platform
     profiles: [be]
     path: "src/modules/platform/<capability>/"
@@ -808,8 +1335,160 @@ slots:
     requires: [index.ts]
     forbids: [common/, utils/, shared/, testing/]   # primitives live in platform/primitives
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
+    coverage: required
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE]
+  # ----- BE: pattern slots (opt-in; enabled by hfs.json sides.be.patterns). A path under one is HFS_SLOT_NOT_ENABLED unless its pattern is declared.
+  - id: be.platform.event-bus
+    profiles: [be]
+    path: "src/modules/platform/event-bus/"
+    presence: opt-in
+    litePresence: forbidden       # Kafka is exactly the footprint lite removes
+    pattern: event-bus            # the ONE durable event transport: transactional outbox, relay, Kafka, inbox, retry and dead letter (knowledge/patterns/be/event-bus.yaml)
+    tracked: tracked
+    tier: platform
+    owner: true
+    goesTo: "the full edition: a lite app has no event bus (no Kafka, no outbox)"
+    requires: [index.ts, event-bus.module.ts, event-bus.port.ts, event-bus.contracts.ts, event-bus.service.ts, event-bus.service.spec.ts]
+    tests: unit-beside
+    coverage: required
+    budget: {indexExports: 60}
+    rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE, BE_INFRA_OWNER]
+  - id: be.platform.queue
+    profiles: [be]
+    path: "src/modules/platform/queue/"
+    presence: opt-in
+    litePresence: forbidden       # BullMQ/Redis is exactly the footprint lite removes
+    pattern: queue                # the ONE BullMQ owner: the outbox relay into queues (jobId = outbox id) and job schedulers (knowledge/patterns/be/queues.yaml)
+    tracked: tracked
+    tier: platform
+    owner: true
+    goesTo: "the full edition: a lite app has no job queue (a scheduled action is a cli command; pg_cron / pg_net fires it)"
+    requires: [index.ts, queue.module.ts, queue.port.ts, queue.contracts.ts, queue-outbox.service.ts, queue-outbox.service.spec.ts]
+    tests: unit-beside
+    coverage: required
+    budget: {indexExports: 60}
+    rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE, BE_INFRA_OWNER]
+  - id: be.events
+    profiles: [be]
+    path: "src/modules/events/<service>/"
+    presence: opt-in
+    litePresence: forbidden       # no event bus, so no typed events
+    pattern: event-bus            # typed event classes of one service; each equals an entry of be/contracts/<service>/events.json
+    tracked: tracked
+    tier: events
+    owner: true
+    goesTo: "the full edition: a lite app has no event bus, so no modules/events"
+    requires: [index.ts]
+    allows: ["<event>.event.ts", index.ts]
+    tests: none
+    coverage: none
+    rules: [BE_EVENT_CLASS_CONTRACT, BE_TIER_DIRECTION]
+  - id: be.queues
+    profiles: [be]
+    path: "src/modules/queues/<queue>/"
+    presence: opt-in
+    litePresence: forbidden       # no queue, so no typed producers
+    pattern: queue                # a typed producer of one queue: enqueueX(payload, tx) writes the outbox; its schedulers live beside it
+    tracked: tracked
+    tier: queues
+    owner: true
+    goesTo: "the full edition: a lite app has no job queue, so no modules/queues"
+    requires: [index.ts, "<queue>.queue.ts"]   # the module exists when a domain module imports the producer; a scheduler-only queue has none
+    allows: ["<queue>.queue.ts", "<queue>.module.ts", "<queue>.contracts.ts", index.ts]
+    tests: none
+    coverage: none
+    rules: [BE_OUTBOX_WRITE_TX, BE_TIER_DIRECTION]
+  - id: be.feature.reactors
+    profiles: [be]
+    path: "src/features/reactors/<reactor>/"
+    presence: opt-in
+    litePresence: forbidden       # no event bus, so nothing reacts to a domain event
+    pattern: event-bus            # a reactor consumes events of another context and keeps a local copy or triggers a projection
+    trigger: reactors
+    tracked: tracked
+    tier: feature
+    owner: true
+    requires: [index.ts, "<reactor>.module.ts", transport/]
+    allows: [index.ts, "<reactor>.module.ts", application/, transport/]
+    tests: none
+    goesTo: "the full edition: a lite app has no event bus, so no reactors (a third-party callback is a webhooks feature)"
+    coverage: none
+    rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
+  - id: be.feature.jobs
+    profiles: [be]
+    path: "src/features/jobs/<job>/"
+    presence: opt-in
+    litePresence: forbidden       # no fenced-job platform, so no job tree
+    pattern: fenced-job           # a background job: a processor with a fenced claim, steps and the application it dispatches to
+    trigger: jobs
+    tracked: tracked
+    tier: feature
+    owner: true
+    requires: [index.ts, "<job>.module.ts", steps/, transport/]
+    allows: [index.ts, "<job>.module.ts", application/, steps/, transport/]
+    tests: none
+    goesTo: "the full edition: a lite app has no job queue (a scheduled action is a cli command; pg_cron / pg_net fires it)"
+    coverage: none
+    rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
+  - id: be.feature.jobs.queue
+    profiles: [be]
+    path: "src/features/jobs/<job>/transport/queue/"
+    presence: opt-in              # the queue transport of the job: its module and the processor the job runner hands the fenced claim to
+    litePresence: forbidden
+    pattern: fenced-job
+    tracked: tracked
+    tier: feature
+    requires: ["<job>-queue.module.ts", "<job>.processor.ts"]
+    allows: ["<job>-queue.module.ts", "<job>.processor.ts"]
+    tests: none
+    coverage: none
+    composedBy: [api, worker]
+    goesTo: "the full edition: a lite app has no job queue"
+    rules: [BE_BACKGROUND_UNOWNED]
+  - id: be.feature.jobs.steps
+    profiles: [be]
+    path: "src/features/jobs/<job>/steps/"
+    presence: opt-in
+    litePresence: forbidden
+    pattern: fenced-job           # one external effect per step; it takes the claimed job and writes through the guarded methods
+    tracked: tracked
+    tier: feature
+    allows: ["<step>.step.ts"]
+    tests: none
+    goesTo: "the full edition: a lite app has no job queue"
+    coverage: none
+    rules: [BE_JOB_SHAPE, BE_JOB_RUN_KEY]
+  - id: be.platform.jobs
+    profiles: [be]
+    path: "src/modules/platform/jobs/"
+    presence: opt-in
+    litePresence: forbidden       # no fenced-job primitive without a queue
+    pattern: fenced-job           # the ONE fencing primitive: the job entity, the claim that bumps the token, guarded writes (knowledge/patterns/be/jobs.yaml)
+    tracked: tracked
+    tier: platform
+    owner: true
+    goesTo: "the full edition: a lite app has no job queue (a scheduled action is a cli command)"
+    requires: [index.ts, jobs.module.ts, jobs.port.ts, jobs.contracts.ts, job-claim.service.ts, job-claim.service.spec.ts, fenced.processor.ts]
+    tests: unit-beside
+    coverage: required
+    budget: {indexExports: 60}
+    rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE, BE_JOB_WRITE_OUTSIDE_OWNER, BE_JOB_FENCE_REQUIRED]
+  - id: be.projections
+    profiles: [be]
+    path: "src/modules/projections/<name>/"
+    presence: opt-in
+    litePresence: forbidden       # a read model replayed off an event stream needs the event bus lite does not have
+    pattern: projection           # a read model: only its projection writes its table; recompute is idempotent and replayable; readers use get*
+    tracked: tracked
+    tier: projections
+    owner: true
+    goesTo: "the full edition: a lite app has no event stream to project; a read shape is a view or a read-* in fe modules/db"
+    requires: [index.ts, "<name>.module.ts", "<name>.projection.ts", "<name>.projection-entity.ts"]
+    allows: [index.ts, "<name>.module.ts", "<name>.module-definition.ts", "<name>.options.ts", "<name>.projection.ts", "<name>.projection-entity.ts", "<name>.contracts.ts", persistence/]
+    tests: unit-beside            # a measured slot: <name>.projection.spec.ts beside its projection is legal (the file owes 100 per file; a spec of its own is optional)
+    coverage: required
+    rules: [BE_PROJECTION_WRITE_OWNER, BE_PROJECTION_SHAPE, BE_TIER_DIRECTION, BE_CONTEXT_COUPLING]
   - id: be.integrations
     profiles: [be]
     path: "src/modules/integrations/<provider>/"
@@ -819,6 +1498,7 @@ slots:
     owner: true
     requires: [index.ts, "<provider>.config.ts"]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts; plus src/tests/integration/<provider>/ (R112)
+    coverage: required
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INTEGRATION_SPEC_MISSING]
   - id: be.integrations.model
@@ -828,7 +1508,26 @@ slots:
     tracked: tracked
     tier: integrations
     tests: none
+    coverage: required
     why: an ML or LLM model client is an integration; weights and datasets are never in git
+  - id: be.integrations.supabase
+    profiles: [be]
+    # The only be import of @supabase/* (L10): the Auth admin and Storage admin client, plus the JWKS-based verification of
+    # the Supabase access token the guard chain reads (L16). The connection itself is ordinary Postgres (the shared
+    # EntityManager of the declared connection); what lives here are the service calls no database role covers.
+    path: "src/modules/integrations/supabase/"
+    presence: opt-in              # enabled by a connection with provider: supabase; required under edition lite
+    provider: supabase
+    litePresence: required
+    tracked: tracked
+    tier: integrations
+    owner: true
+    requires: [index.ts, supabase.config.ts, supabase.options.ts, supabase.decorators.ts, supabase.client.ts, supabase.jwks.ts]   # Secrets, no defaults (R44); the options and the named injector (R83); the admin client; the token verification
+    allows: [index.ts, supabase.config.ts, supabase.options.ts, supabase.decorators.ts, supabase.client.ts, supabase.jwks.ts, errors/]
+    tests: unit-beside
+    rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT]
+    coverage: required
+    since: 2.1.0
 
   # ----- BE: tests (owner test layout 2026-09-30). Unit specs are <name>.service.spec.ts beside their service and nothing else; everything else
   # lives under src/tests/, one folder per kind, and the folder and the file suffix always agree (a file whose suffix does
@@ -837,13 +1536,16 @@ slots:
     profiles: [be]
     path: "src/tests/world/"
     presence: optional
+    litePresence: forbidden       # a lite app has no test world
     tracked: tracked
     tier: e2e
+    goesTo: "the full edition: a lite app has no test world (no containers, fakes or useTestWorld)"
     allows: [global-setup.ts, global-teardown.ts, use-test-world.ts, "fakes/<provider>/server.ts", fakes/]   # jest globalSetup/globalTeardown default-export (Jest API); fakes/<provider>/server.ts is the fake server of a provider, a literal file name BE_SOURCE_FORM reads as its role; plus root files with a role suffix (test-world-files, R47)
     tests: none
+    coverage: none
     why: >-
       the ONLY test infrastructure location, shared by integration and e2e: global-setup.ts starts the shared
-      infrastructure (containers) and runs apps/migrate's exported bootstrap once; use-test-world.ts exports
+      infrastructure (containers) and runs the migrations once over the cli app's connections; use-test-world.ts exports
       useTestWorld({ apps: { <name>: { module, listen? } } } | { modules: [...] }) -> world.apps.<name>.api,
       world.db.<connection> (the shared EntityManager), world.infra.<service> (latency/cut/restore on a REAL service of the repository's
       own stack, the app root's `.starcistacks/<env>`, each behind toxiproxy), world.fake.<provider> (a network-edge fake of an external SaaS started by the world, with
@@ -854,27 +1556,36 @@ slots:
     profiles: [be]
     path: "src/tests/world/kit/"
     presence: optional
+    litePresence: forbidden
     tracked: tracked
     tier: e2e
+    goesTo: "the full edition: a lite app has no test world"
     allows: ["<name>.ts"]    # plain kebab names, like platform/primitives (BE-CONVENTION 1.11 names primitives/time.ts): the world's inlined test helpers (poll, free-ports)
     tests: none
+    coverage: none
     why: the helpers the test world needs (polling, free ports, transports), inlined so the world imports no other repository; a bare <name>.ts entry in allows is what admits a plain name in BE_SOURCE_FORM
   - id: be.tests.fixtures
     profiles: [be]
     path: "src/tests/fixtures/"
     presence: optional
+    litePresence: forbidden
     tracked: tracked
     tier: fixtures
+    goesTo: "the full edition: a lite app has no test fixtures"
     allows: [i18n/]   # i18n/ is the one folder that may carry localized text
     tests: none
+    coverage: none
     why: payload fixtures with a role suffix (the doubles come from @starci/jest-preset, not from here); the test data builders live in its builders/ slot; importable by unit specs, integration and e2e; never imports a feature
   - id: be.tests.fixtures.builders
     profiles: [be]
     path: "src/tests/fixtures/builders/*.builder.ts"
     presence: optional
+    litePresence: forbidden
     tracked: tracked
     tier: fixtures
+    goesTo: "the full edition: a lite app has no test fixtures"
     tests: none
+    coverage: none
     why: >-
       the ONLY home of test data builders, one <area>.builder.ts per area, shared by every spec of that area: pure object builders
       (commissionRow(overrides), accrueInput(overrides)) for unit specs and persisting builders (orderBuilder(world.db.primary).pending().build(overrides))
@@ -885,36 +1596,48 @@ slots:
     profiles: [be]
     path: "src/tests/fixtures/i18n/"
     presence: optional
+    litePresence: forbidden
     tracked: tracked
     tier: fixtures
+    goesTo: "the full edition: a lite app has no test fixtures"
     allows: ["<name>.<role>.ts"]   # data files that deliberately carry localized text (a real Vietnamese string a parser or formatter must accept); no specs here
     tests: none
+    coverage: none
     why: the ONLY test-fixture location where Vietnamese or another language may appear in source (LANG_NOT_ENGLISH); placement is the marker, there is no comment pragma
   - id: be.tests.integration
     profiles: [be]
     path: "src/tests/integration/<capability>/*.integration-spec.ts"
     presence: optional
+    litePresence: forbidden
     tracked: tracked
     tier: e2e
     tests: e2e
+    goesTo: "the full edition: a lite app has no test tree"
+    coverage: none
     why: one capability module through useTestWorld({ modules }), no HTTP door of ours (SQL, transactions, concurrency, inbox claims on the real database; and every integration client, `<capability>` being its provider folder, against our real infra, a real peer app or the library fake at the network edge, with its success, its ErrorCode refusal mapping and an outage through the world, R112); run by test:integration
     rules: [BE_TEST_TOPOLOGY, BE_INTEGRATION_SPEC_MISSING]
   - id: be.tests.e2e
     profiles: [be]
     path: "src/tests/e2e/<area>/*.e2e-spec.ts"
     presence: optional
+    litePresence: forbidden
     tracked: tracked
     tier: e2e
     tests: e2e
+    goesTo: "the full edition: a lite app has no test tree"
+    coverage: none
     why: flow e2e through useTestWorld({ apps }); external services are the world's network fakes; run by test:e2e
     rules: [HFS_CI_E2E_AUTOMATIC, BE_TEST_TOPOLOGY, BE_E2E_FLOW]
   - id: be.tests.contract
     profiles: [be]
     path: "src/tests/contract/<provider>/*.contract-spec.ts"
     presence: optional
+    litePresence: forbidden
     tracked: tracked
     tier: e2e
     tests: e2e
+    goesTo: "the full edition: a lite app has no test tree"
+    coverage: none
     why: provider sandbox contracts, skipped without sandbox config; run only by test:contract, never part of test or test:e2e
     rules: [BE_TEST_TOPOLOGY]
   - id: be.tests.e2e-world-retired
@@ -929,16 +1652,18 @@ slots:
   # ----- FE: apps ----------------------------------------------------------------------------------------
   - id: fe.app.next
     profiles: [fe]
-    path: "apps/<app>/{next.config.ts,tsconfig.json,postcss.config.mjs}"
+    # Each fe app is an npm workspace: its package.json is @<project>/<app> with its own runtime dependencies and the fixed
+    # workspace scripts (HFS_MONO_FE_WORKSPACE); turbo runs them.
+    path: "apps/<app>/{package.json,next.config.ts,tsconfig.json,postcss.config.mjs}"
     appKind: next
     presence: required
     tracked: tracked
     tier: none
     minInstances: 1
-    requires: [next.config.ts, tsconfig.json, postcss.config.mjs, src/app/, src/modules/i18n/,
+    requires: [package.json, next.config.ts, tsconfig.json, postcss.config.mjs, src/app/, src/modules/i18n/,
                "src/app/global-error.tsx", "src/app/[locale]/layout.tsx", "src/app/[locale]/error.tsx", "src/app/[locale]/not-found.tsx", "src/app/[locale]/loading.tsx"]
     tests: none
-    rules: [FE_APP_ISOLATION, FE_ERROR_BOUNDARY_MISSING, FE_NEXT_CONVENTIONS]
+    rules: [FE_APP_ISOLATION, FE_ERROR_BOUNDARY_MISSING, FE_NEXT_CONVENTIONS, HFS_MONO_FE_WORKSPACE, HFS_MONO_WORKSPACE_DEP]
   - id: fe.app-optional
     profiles: [fe]
     path: "apps/<app>/public/"
@@ -979,6 +1704,18 @@ slots:
     tests: none
     goesTo: "apps/<app>/src/proxy.ts: Next >= 16 renamed middleware to proxy and refuses the old name"
     rules: [FE_NEXT_CONVENTIONS]
+  - id: fe.route.callback
+    profiles: [fe]
+    # The auth callback of a Supabase session (the PKCE code exchange): the one non-health route handler of an app with a Supabase
+    # connection, in either edition (an upgrade lite -> full leaves it as it is, fe/** is never touched); an app without one has no
+    # route handler in fe/ (L15).
+    path: "apps/<app>/src/app/auth/callback/route.ts"
+    presence: opt-in
+    provider: supabase
+    tracked: tracked
+    tier: route
+    tests: none
+    since: 2.1.0
   - id: fe.feature
     profiles: [fe]
     path: "apps/<app>/src/features/{pages,layouts,overlays}/<name>/"
@@ -1061,6 +1798,7 @@ slots:
     presence: optional
     tracked: tracked
     tier: transport
+    outcomeHome: true
     tests: none
     why: the one Outcome union of a one-app repository; a shared union is fe.package.api.outcome
     rules: [FE_HTTP_STATUS_COLLAPSE]
@@ -1109,10 +1847,47 @@ slots:
     tier: foundation
     tests: none
     why: shared types with no runtime behaviour; a component may import them
+  - id: fe.modules.db
+    profiles: [fe]
+    # The db transport of an app on Supabase (the ONLY place that imports @supabase/ssr or @supabase/supabase-js, L10): the
+    # server client factory (cookies, anon key, RLS applies), the browser client factory, getPrincipal() (React cache,
+    # auth.getClaims()) and toOutcome() mapping {data, error} into the same Outcome vocabulary modules/api uses. Readers
+    # live in <domain>/read-*.ts, Server Actions (schema-parsed input) in <domain>/write-*.ts; the row types come from
+    # supabase/types/database.types.ts (sides.fe.reads). The barrel index.ts is server-only (it re-exports server code), so
+    # browser.ts, the browser client factory a client hook imports, is a second public entry of the owner (`entries`).
+    path: "apps/<app>/src/modules/db/"
+    presence: opt-in              # enabled by a connection with provider: supabase; required under edition lite
+    provider: supabase
+    litePresence: required
+    tracked: tracked
+    tier: transport
+    requires: [index.ts, server.ts, browser.ts, principal.ts]
+    allows: [index.ts, server.ts, browser.ts, principal.ts, outcome.ts, "<domain>/read-*.ts", "<domain>/write-*.ts", "<domain>/<domain>.mapper.ts"]
+    entries: [browser.ts]
+    anonymousActions: [auth/write-sign-in.ts, auth/write-sign-out.ts]     # the Server Actions that run for an anonymous principal by design (FE_AUTH_SESSION_TRUST)
+    tests: none
+    since: 2.1.0
+  - id: fe.modules.db.outcome
+    profiles: [fe]
+    # A lite app has no modules/api: its db transport is the transport, so the one Outcome union lives here (toOutcome maps
+    # {data, error} into it). Under full the union stays fe.transport.outcome / fe.package.api.outcome.
+    editions: [lite]
+    path: "apps/<app>/src/modules/db/outcome.ts"
+    presence: opt-in
+    provider: supabase
+    litePresence: optional
+    tracked: tracked
+    tier: transport
+    outcomeHome: true
+    tests: none
+    why: the one Outcome union of a lite app; its db owner is the transport
+    rules: [FE_HTTP_STATUS_COLLAPSE]
+    since: 2.1.0
   - id: fe.package.ui
     profiles: [fe]
     path: "packages/<family>-ui/"
     presence: opt-in
+    litePresence: optional        # a lite app scaffolds no packages; one appears by need, without an optionalSlots entry
     tracked: tracked
     tier: package
     owner: true
@@ -1127,6 +1902,7 @@ slots:
     profiles: [fe]
     path: "packages/<family>-api/"
     presence: opt-in
+    litePresence: optional
     tracked: tracked
     tier: package
     owner: true
@@ -1149,6 +1925,7 @@ slots:
     presence: optional     # enabled with its package (fe.package.api is the opt-in)
     tracked: tracked
     tier: package
+    outcomeHome: true
     tests: none
     why: the repository's one Outcome union
     rules: [FE_HTTP_STATUS_COLLAPSE]
@@ -1156,6 +1933,7 @@ slots:
     profiles: [fe]
     path: "packages/<family>-i18n/"
     presence: opt-in
+    litePresence: optional
     tracked: tracked
     tier: package
     owner: true
@@ -1163,14 +1941,28 @@ slots:
     tests: none
     why: the next-intl stack (routing, navigation, request config) written once, exported as the createAppI18n factory every app calls
     rules: [FE_I18N_PLACEMENT, FE_PACKAGE_SHAPE, HFS_UNUSED_EXPORT]
+  - id: fe.package.db
+    profiles: [fe]
+    # The shared Supabase client factories once a second fe app needs them (server, browser, principal, toOutcome) -
+    # mirroring fe.transport.client vs fe.package.api.client; the one Outcome union is re-exported from
+    # fe.package.api.outcome when the api package exists.
+    path: "packages/<family>-db/"
+    presence: opt-in
+    provider: supabase
+    tracked: tracked
+    tier: package
+    owner: true
+    requires: [package.json, src/index.ts, tsconfig.json]
+    tests: none
+    since: 2.1.0
 
 # Checks that read this manifest (all ship from .claude; none keeps its own path list)
 consumers:
-  - scripts/lib/hfs-slots.mjs                  # the loader every consumer below goes through
-  - scripts/lib/hfs-check.mjs                  # hfs check: HFS_SLOT_* / tracked / external, the side view per side
-  - scripts/checks/architecture.mjs            # tiers, direction matrix, cycles, reachability
+  - scripts/hfs/slots.mjs                  # the loader every consumer below goes through
+  - scripts/hfs/check.mjs                  # starci app check: HFS_SLOT_* / tracked / external, the side view per side
+  - scripts/hfs/architecture.mjs            # tiers, direction matrix, cycles, reachability
   - packages/eslint/be starciBeConfig({hfs})   # file globs for rules come from slots
   - packages/eslint/fe starciFeConfig({hfs})
   - packages/stylelint                         # @starci/stylelint-canon: colour and brand allowances from fe.modules.brand
-  - packages/hfs/sync                          # renders managedBy templates (hfs sync) and judges them (hfs check)
+  - packages/hfs/sync                          # renders managedBy templates (starci app sync) and judges them (starci app check)
   - modules/kernel/failure-codes.yaml          # every rule id listed above has a Vietnamese why