@starci/hfs 4.0.8 → 4.0.10

package/runtime/scripts/hfs/coverage-scope.mjs

@@ -0,0 +1,162 @@
+// coverage-scope.mjs - THE derivation of what a back end measures (R204 HFS_COVERAGE_SCOPE_DRIFT).
+//
+// One input: the slot manifest. Every tracked slot of the be profile declares `coverage: required | none`, and
+// `ruleParams.be.logicRoles` names the roles that carry logic. A file `<name>.<role>.ts` of a logic role inside a required slot is
+// measured at 100 per file; every other file of the back end is not. Three consumers read this module and nothing else:
+//   - the jest preset: `jestCoverage` (roots x roles, and the none subtrees inside a root) becomes the per-file thresholds and
+//     collectCoverageFrom of the rendered be/jest.config.js;
+//   - Sonar: `sonarCoverageExclusions` are the complement (SonarQube has no inclusions and no negation), rendered into
+//     sonar.coverage.exclusions;
+//   - Codecov: `codecovPaths` are the measured roots, and `coverageComponents` one component per service app plus platform,
+//     each 100% and red below it, rendered into codecov.yml.
+// starci app sync renders the three for an app, scripts/checks/check-examples-ci.mjs for the example apps of the runtime repository,
+// and `starci app check` compares the files with this derivation. Nothing here lists a path of a product: it all comes from slots.yaml.
+import { braceVariants, globExpression } from '../lib/glob.mjs';
+import { logicRolesOf } from './manifest-shape.mjs';
+
+/** The component that holds the shared infrastructure: the platform tier and every capability more than one service app composes. */
+export const PLATFORM_COMPONENT = 'platform';
+const SERVICE_APP_KINDS = new Set(['api', 'worker']);
+const star = (text) => String(text).replace(/<[^>]+>/g, '*');
+const segments = (dir) => dir.replace(/\/+$/, '').split('/').filter(Boolean);
+const isDir = (path) => path.endsWith('/');
+
+/** True when directory pattern `inner` lies inside `outer` (an outer `*` segment matches any one inner segment) or is the same. */
+function nested(inner, outer) {
+  const a = segments(inner);
+  const b = segments(outer);
+  return a.length >= b.length && b.every((segment, index) => segment === '*' ? true : segment === a[index]);
+}
+
+/** The directory patterns (be-relative, placeholders as `*`, trailing slash) of a slot's path variants; a file pattern keeps its name. */
+const variantsOf = (slot) => braceVariants(slot.path).map(star);
+
+/**
+ * The tracked slots of the be profile, in manifest order. A slot gated by a connection provider (be.integrations.supabase) holds files only in an
+ * app whose connection declares that provider (`providers`), so it takes no part in the scope of any other app.
+ */
+const beSlots = (manifest, providers) => manifest.slots.filter((slot) => slot.profiles.includes('be') && slot.tracked === 'tracked' && (slot.provider === undefined || providers.includes(slot.provider)));
+
+/** The directory a path pattern lives in (itself when it is one). */
+const dirOf = (path) => (isDir(path) ? path : path.slice(0, path.lastIndexOf('/') + 1));
+
+/** The unique directory patterns not nested inside another one. */
+const minimal = (patterns) => {
+  const unique = [...new Set(patterns)];
+  return unique.filter((pattern) => !unique.some((other) => other !== pattern && nested(pattern, other)));
+};
+
+/**
+ * The scope of an app's back end, derived from the manifest: { roles, roots, excludes, none, sonar, codecovPaths }.
+ *   roles     ruleParams.be.logicRoles;
+ *   roots     the minimal required directories (be-relative, `*` for a placeholder, trailing slash), sorted;
+ *   excludes  the none directories inside a root (never measured though their root is);
+ *   none      the minimal none paths of the whole back end (a directory ends in a slash), sorted;
+ *   sonar     sonar.coverage.exclusions, repository-relative from the app root, sorted;
+ *   codecovPaths  the measured roots as `be/<root>**`.
+ */
+export function coverageScope(manifest, providers = []) {
+  const roles = [...logicRolesOf(manifest)];
+  const slots = beSlots(manifest, providers);
+  const required = slots.filter((slot) => slot.coverage === 'required');
+  const none = slots.filter((slot) => slot.coverage === 'none');
+  const requiredDirs = required.flatMap((slot) => variantsOf(slot).map((dir) => {
+    if (!isDir(dir)) throw new Error(`slot ${slot.id} is coverage: required but its path ${slot.path} is not a directory`);
+    return dir;
+  }));
+  const roots = minimal(requiredDirs).sort();
+  const nonePaths = none.flatMap((slot) => variantsOf(slot));
+  for (const dir of nonePaths.filter(isDir)) if (requiredDirs.some((other) => nested(other, dir))) throw new Error(`a coverage: none directory ${dir} contains a coverage: required slot`);
+  const noneUnique = [...new Set(nonePaths)];
+  const noneMinimal = noneUnique.filter((path) => !noneUnique.some((other) => other !== path && isDir(other) && nested(dirOf(path), other)));
+  const excludes = noneMinimal.filter((path) => isDir(path) && roots.some((root) => nested(path, root))).sort();
+  const suffixes = manifest.ruleParams.be.suffixes;
+  const isRole = new RegExp(`\\.(?:${suffixes.map((s) => s.replace(/-/g, '\\-')).join('|')})\\.ts$`);
+  const sonar = new Set(noneMinimal.map((path) => `be/${path}${isDir(path) ? '**' : ''}`));
+  for (const role of suffixes.filter((suffix) => !roles.includes(suffix))) sonar.add(`be/**/*.${role}.ts`);
+  for (const slot of required) {
+    for (const entry of [...(slot.requires ?? []), ...(slot.allows ?? [])]) {
+      if (!/\.ts$/.test(entry) || entry.includes('<role>')) continue;
+      for (const name of braceVariants(entry)) {
+        if (isRole.test(star(name).replace(/\*/g, 'x'))) continue;
+        for (const dir of variantsOf(slot)) sonar.add(`be/${dir}${star(name)}`.replace(/\/\/+/g, '/'));
+      }
+    }
+  }
+  sonar.add('fe/**');
+  return { roles, roots, excludes, none: noneMinimal.sort(), sonar: [...sonar].sort(), codecovPaths: roots.map((root) => `be/${root}**`) };
+}
+
+/** The glob a root measures: every file of a logic role below it (`src/modules/domain/*\/**\/*.{service,policy}.ts`). */
+export const rootGlob = (root, roles) => `${root}**/*.${roles.length === 1 ? roles[0] : `{${roles.join(',')}}`}.ts`;
+
+/** The jest coverage options of the rendered be/jest.config.js: { roots, roles, excludes }. */
+export function jestCoverage(manifest, providers = []) {
+  const { roots, roles, excludes } = coverageScope(manifest, providers);
+  return { roots, roles, excludes: excludes.map((dir) => `${dir}**`) };
+}
+
+/** Sonar's sonar.coverage.exclusions of an app: the complement of the measured files, repository-relative from the app root. */
+export const sonarCoverageExclusions = (manifest, providers = []) => coverageScope(manifest, providers).sonar;
+
+/** The Codecov paths of an app: the measured roots, repository-relative from the app root. */
+export const codecovPaths = (manifest, providers = []) => coverageScope(manifest, providers).codecovPaths;
+
+/**
+ * The capability a be-relative file belongs to inside a root, or null: the folder the root's last `*` stands for
+ * (`src/modules/domain/*\/` and `src/modules/domain/order/order.service.ts` give `order`).
+ */
+function capabilityOf(root, file) {
+  const parts = segments(root);
+  const at = parts.length - 1;
+  if (parts[at] !== '*') return null;
+  const own = file.split('/');
+  return parts.slice(0, at).every((part, index) => part === own[index]) && own.length > at + 1 ? own[at] : null;
+}
+
+/**
+ * The Codecov components of an app, [{ id, name, paths }] (paths repository-relative from the app root): one per service app (api or worker)
+ * that composes the capabilities nothing else composes, then `platform`. A capability of a root whose last segment is a placeholder
+ * (`src/modules/domain/<capability>/`, projections, integrations) belongs to the one service app whose composition root
+ * (`apps/<app>/`) imports `@modules/<tier>/<capability>`; when several import it, the service app named like the capability (the
+ * `identity` service and the `identity` capability) owns it; one that nothing singles out belongs to platform, as does the whole platform tier. The measured roots of the tier `platform` are never split.
+ *
+ * @param {object} manifest the slot manifest
+ * @param {{ files: string[], read: (file: string) => string, apps: Array<{name: string, kind: string}> }} source be-relative source files, a reader, the declared be apps
+ */
+export function coverageComponents(manifest, { files, read, apps, providers = [] }) {
+  const { roots } = coverageScope(manifest, providers);
+  const services = apps.filter((app) => SERVICE_APP_KINDS.has(app.kind));
+  const imports = new Map(services.map((app) => [app.name, files.filter((file) => file.startsWith(`apps/${app.name}/`) && /\.[cm]?ts$/.test(file)).map((file) => read(file)).join('\n')]));
+  const platformPaths = [];
+  const ownedBy = new Map(services.map((app) => [app.name, []]));
+  for (const root of roots) {
+    const module = /^src\/modules\/(.+)\/\*\/$/.exec(root)?.[1] ?? null;
+    const capabilities = [...new Set(files.map((file) => capabilityOf(root, file)).filter(Boolean))].sort();
+    const base = root.slice(0, -2);
+    if (module === null || module === 'platform' || !capabilities.length) {
+      platformPaths.push(`be/${root}**`);
+      continue;
+    }
+    for (const capability of capabilities) {
+      const spec = new RegExp(`from\\s+["']@modules/${module.replace(/[/.]/g, '\\$&')}/${capability.replace(/[/.]/g, '\\$&')}["']`);
+      const importers = services.filter((app) => spec.test(imports.get(app.name)));
+      const owners = importers.length === 1 ? importers : importers.filter((app) => app.name === capability);
+      if (owners.length === 1) ownedBy.get(owners[0].name).push(`be/${base}${capability}/**`);
+      else platformPaths.push(`be/${base}${capability}/**`);
+    }
+  }
+  return [
+    ...services.filter((app) => ownedBy.get(app.name).length).map((app) => ({ id: app.name, name: app.name, paths: ownedBy.get(app.name).sort() })),
+    ...(platformPaths.length ? [{ id: PLATFORM_COMPONENT, name: PLATFORM_COMPONENT, paths: platformPaths.sort() }] : []),
+  ];
+}
+
+/** True when the be-relative `file` is measured: it is `<name>.<role>.ts` of a logic role below a measured root and inside no none directory of it. */
+export function isMeasured(manifest, file) {
+  const { roots, roles, excludes } = coverageScope(manifest);
+  const role = /\.([a-z][a-z0-9-]*)\.ts$/.exec(file)?.[1];
+  if (!role || !roles.includes(role)) return false;
+  const inside = (dir) => globExpression(`${dir}**`).test(file);
+  return roots.some(inside) && !excludes.some(inside);
+}

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -0,0 +1,62 @@
+// declaration-shape.mjs - the dependency-free hfs.json shape validation used by the HFS slot loader. Semantic checks
+// against a loaded manifest remain in slots.mjs; this module mirrors modules/schemas/hfs-repo.schema.yaml only.
+import { isPlainObject } from '../../engine/plain-object.mjs';
+import { APP_KIND, connectionShapeProblems, NAME, RUNTIME_KIND, SLOT_ID } from './manifest-shape.mjs';
+import { kindShapeProblems, patternShapeProblems } from './declaration-slots.mjs';
+
+/** Shape problems of the optional hfs.json `supabase` block whose auth posture DB_CONFIG_POLICY checks. */
+function supabaseBlockProblems(block) {
+  if (block === undefined) return [];
+  if (!isPlainObject(block)) return ['supabase must be an object'];
+  const bad = [];
+  for (const key of Object.keys(block)) if (!['enableSignup', 'jwtExpiry', 'siteUrl', 'redirectUrls', 'forceRls'].includes(key)) bad.push(`supabase has unknown key ${key}`);
+  if (block.enableSignup !== undefined && typeof block.enableSignup !== 'boolean') bad.push('supabase.enableSignup must be true or false');
+  if (block.jwtExpiry !== undefined && !(Number.isInteger(block.jwtExpiry) && block.jwtExpiry > 0 && block.jwtExpiry <= 3600)) bad.push('supabase.jwtExpiry must be an integer of seconds, 3600 at most');
+  if (block.siteUrl !== undefined && (typeof block.siteUrl !== 'string' || !block.siteUrl.trim())) bad.push('supabase.siteUrl must be a URL string');
+  for (const key of ['redirectUrls', 'forceRls']) if (block[key] !== undefined && !(Array.isArray(block[key]) && block[key].every((value) => typeof value === 'string' && value.trim()))) bad.push(`supabase.${key} must be a list of strings`);
+  return bad;
+}
+
+/** Shape problems of a parsed hfs.json, in the words of modules/schemas/hfs-repo.schema.yaml. */
+export function declarationShapeProblems(declaration, profiles) {
+  const bad = [];
+  if (!isPlainObject(declaration)) return ['hfs.json is not an object'];
+  if (!(Number.isInteger(declaration.hfs) && declaration.hfs >= 1)) bad.push('hfs must be the pinned manifest major (an integer, 1 or more)');
+  if (!NAME.test(String(declaration.project))) bad.push('project must be a project name');
+  if (declaration.kind === RUNTIME_KIND) {
+    for (const key of Object.keys(declaration)) if (!['hfs', 'kind', 'project'].includes(key)) bad.push(`unknown key ${key} (a runtime declaration is {hfs, kind, project})`);
+    return bad;
+  }
+  for (const key of Object.keys(declaration)) if (!['hfs', 'kind', 'project', 'edition', 'supabase', 'sides', 'browser'].includes(key)) bad.push(`unknown key ${key}`);
+  bad.push(...supabaseBlockProblems(declaration.supabase));
+  if (declaration.browser !== undefined && declaration.browser !== true) bad.push('browser is `true` when the app has a browser journey (slot app.browser), and is left out otherwise');
+  if (declaration.kind !== APP_KIND) bad.push(`kind must be ${APP_KIND} (a product is one app repository with a be and an fe side) or ${RUNTIME_KIND} (the StarCi runtime repository)`);
+  if (!isPlainObject(declaration.sides) || Object.keys(declaration.sides).sort().join() !== profiles.join()) { bad.push('sides must declare exactly be and fe'); return bad; }
+  const names = new Map();
+  for (const side of profiles) {
+    const value = declaration.sides[side];
+    const at = `sides.${side}`;
+    if (!isPlainObject(value)) { bad.push(`${at} must be an object`); continue; }
+    for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+    if (!Array.isArray(value.apps) || !value.apps.length) bad.push(`${at}.apps must list every ${side}/apps/<name> with its kind`);
+    else value.apps.forEach((app, index) => {
+      if (!isPlainObject(app) || !NAME.test(String(app.name)) || !NAME.test(String(app.kind)) || Object.keys(app).some((key) => key !== 'name' && key !== 'kind')) bad.push(`${at}.apps[${index}] must be {name, kind}`);
+      else if (names.has(app.name)) bad.push(`app ${app.name} is declared twice (${names.get(app.name)} and ${side})`);
+      else names.set(app.name, side);
+    });
+    if (value.optionalSlots !== undefined && (!Array.isArray(value.optionalSlots) || !value.optionalSlots.every((slot) => SLOT_ID.test(String(slot))) || new Set(value.optionalSlots).size !== value.optionalSlots.length)) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
+    bad.push(...patternShapeProblems(value, at, NAME), ...kindShapeProblems(value, at, NAME));
+    if (value.reads !== undefined && (!Array.isArray(value.reads) || !value.reads.every((read) => typeof read === 'string' && read.length > 0) || new Set(value.reads).size !== value.reads.length)) bad.push(`${at}.reads must be a unique list of paths`);
+    if (value.connections !== undefined) {
+      if (side !== 'be') { bad.push('connections belong to the be side'); continue; }
+      const list = Array.isArray(value.connections) ? value.connections : null;
+      const shape = connectionShapeProblems(list, value.apps);
+      if (shape.length) bad.push(...shape);
+      else {
+        if (new Set(list.map((connection) => connection.name)).size !== list.length) bad.push('connections names must be unique');
+        for (const a of list) for (const b of list) if (a !== b && `${b.envPrefix}_`.startsWith(`${a.envPrefix}_`)) bad.push(`connections ${a.name} and ${b.name} share env keys (${a.envPrefix}_ covers ${b.envPrefix}_)`);
+      }
+    }
+  }
+  return bad;
+}

package/runtime/scripts/hfs/declaration-slots.mjs

@@ -0,0 +1,75 @@
+// declaration-slots.mjs - how an app declaration (hfs.json) switches on the opt-in slots of a side: by name (`optionalSlots`), by app kind
+// (a slot with `appKind`) and by declared pattern (a slot with `pattern: <name>` is enabled by `sides.<side>.patterns: [<name>]`, one
+// mechanism for every pattern: saga, event-bus, fenced-job, ...). slots.mjs asks this file to judge a side's lists and to say whether a
+// slot is enabled for a repository.
+
+/** The problems of a side's `optionalSlots` and `patterns` against the manifest. */
+export function optionalSlotProblems(manifest, side, s) {
+  const bad = [];
+  for (const id of s.optionalSlots ?? []) {
+    const slot = manifest.slots.find((candidate) => candidate.id === id);
+    if (!slot || !slot.profiles.includes(side)) bad.push(`sides.${side}.optionalSlots names ${id}, which is not a ${side} slot`);
+    else if (slot.presence !== 'opt-in') bad.push(`sides.${side}.optionalSlots names ${id}, which is ${slot.presence}, not opt-in`);
+    else if (slot.appKind !== undefined) bad.push(`sides.${side}.optionalSlots names ${id}; an app of kind ${slot.appKind} enables it`);
+  }
+  for (const name of s.patterns ?? []) {
+    if (!manifest.slots.some((slot) => slot.profiles.includes(side) && slot.pattern === name)) bad.push(`sides.${side}.patterns names ${name}, which no ${side} slot declares as its pattern`);
+  }
+  if (s.kinds !== undefined && side !== 'be') bad.push(`sides.${side}.kinds belongs to the be side`);
+  for (const kind of s.kinds ?? []) {
+    if (!(manifest.triggerKinds ?? []).includes(kind)) bad.push(`sides.${side}.kinds names ${kind}, which is not one of triggerKinds (${(manifest.triggerKinds ?? []).join(', ')})`);
+  }
+  return bad;
+}
+
+/** The problems of the shape of a side's `patterns` list (a unique list of pattern names). */
+export function patternShapeProblems(s, at, namePattern) {
+  const list = s.patterns;
+  if (list === undefined) return [];
+  return Array.isArray(list) && list.every((value) => namePattern.test(String(value))) && new Set(list).size === list.length ? [] : [`${at}.patterns must be a unique list of pattern names`];
+}
+
+/** The problems of the shape of a side's `kinds` list (a unique list of trigger kind names). */
+export function kindShapeProblems(s, at, namePattern) {
+  const list = s.kinds;
+  if (list === undefined) return [];
+  return Array.isArray(list) && list.every((value) => namePattern.test(String(value))) && new Set(list).size === list.length ? [] : [`${at}.kinds must be a unique list of trigger kind names`];
+}
+
+/** The problems of `ruleParams.be.kindPatterns` (trigger kind -> patterns) and `ruleParams.be.addKinds` (starci app add noun -> {topic, variable, patterns, trigger?, needs?, also?, defaults?, wire?}). */
+export function kindParamProblems(be, triggerKinds) {
+  const kebab = /^[a-z][a-z0-9-]*$/;
+  const names = (list) => Array.isArray(list) && list.every((value) => kebab.test(String(value))) && new Set(list).size === list.length;
+  const bad = [];
+  const patterns = be.kindPatterns;
+  if (patterns === null || typeof patterns !== 'object' || Array.isArray(patterns) || !Object.entries(patterns).every(([kind, list]) => (triggerKinds ?? []).includes(kind) && names(list))) bad.push('ruleParams.be.kindPatterns must map a trigger kind to a unique list of pattern names');
+  const nouns = be.addKinds;
+  const nounOk = (spec) => spec !== null && typeof spec === 'object' && kebab.test(String(spec.topic)) && kebab.test(String(spec.variable)) && names(spec.patterns) && (spec.trigger === undefined || kebab.test(String(spec.trigger))) && (spec.needs === undefined || names(spec.needs)) && (spec.also === undefined || names(spec.also)) && (spec.defaults === undefined || (typeof spec.defaults === 'object' && !Array.isArray(spec.defaults))) && (spec.wire === undefined || (spec.wire !== null && typeof spec.wire === 'object' && ['file', 'import', 'symbol'].every((key) => typeof spec.wire[key] === 'string' && spec.wire[key] !== '')));
+  if (nouns === null || typeof nouns !== 'object' || Array.isArray(nouns) || !Object.entries(nouns).every(([noun, spec]) => kebab.test(noun) && nounOk(spec))) bad.push('ruleParams.be.addKinds must map a noun to {topic, variable, patterns, trigger?, needs?, also?, defaults?}');
+  return bad;
+}
+
+/** The problems of `ruleParams.be.patternScenarios`: a pattern name to a non-empty list of unique kebab-case scenario ids. */
+export function scenarioProblem(scenarios) {
+  const kebab = /^[a-z][a-z0-9-]*$/;
+  const ok = scenarios !== null && typeof scenarios === 'object' && !Array.isArray(scenarios) && Object.entries(scenarios).every(([name, list]) => kebab.test(name) && Array.isArray(list) && list.length > 0 && list.every((id) => kebab.test(String(id))) && new Set(list).size === list.length);
+  return ok ? [] : ['ruleParams.be.patternScenarios must map a pattern name to a non-empty list of unique kebab-case scenario ids'];
+}
+
+/** The problems of the `trigger` of a slot against the manifest's `triggerKinds`: a known kind, on a feature-tier slot only. */
+export function triggerProblems(slot, triggerKinds) {
+  if (slot.trigger === undefined) return [];
+  const bad = [];
+  if (!(triggerKinds ?? []).includes(slot.trigger)) bad.push(`slot ${slot.id}: trigger ${slot.trigger} is not one of triggerKinds`);
+  if (slot.tier !== 'feature') bad.push(`slot ${slot.id}: a trigger belongs to a feature-tier slot`);
+  return bad;
+}
+
+/** Whether an opt-in slot is enabled for the repository: by its app kind, by a connection's provider, by name in optionalSlots, or by its declared pattern. */
+export function declaredSlotEnabled(slot, repo) {
+  if (slot.appKind !== undefined) return repo.apps.some((app) => app.kind === slot.appKind);
+  // A provider declared on any connection (be owns them all today) enables the provider slots of every profile: repo.providers
+  // is the app-wide union the declaration resolver computed; a hand-built repo falls back to its own connections.
+  if (slot.provider !== undefined) return (repo.providers ?? (repo.connections ?? []).map((connection) => connection.provider)).includes(slot.provider);
+  return repo.optionalSlots.includes(slot.id) || (slot.pattern !== undefined && (repo.patterns ?? []).includes(slot.pattern));
+}

package/runtime/scripts/hfs/edition-slots.mjs

@@ -0,0 +1,66 @@
+// edition.mjs - the one edition filter shared by the HFS slot resolver, declaration validation, rule catalog and
+// edition-specific rule parameters. Full is the default; lite changes data views, never the checks that consume them.
+import { isPlainObject } from '../../engine/plain-object.mjs';
+import { EDITIONS } from './manifest-shape.mjs';
+
+/** The presence of `slot` under edition lite for `profile`: `litePresence`, else the slot's own presence. */
+export function litePresenceOf(slot, profile) {
+  const lp = slot.litePresence;
+  if (lp === undefined) return slot.presence;
+  return isPlainObject(lp) ? (lp[profile] ?? slot.presence) : lp;
+}
+
+/** Whether `slot` exists under `edition` of `manifest` (default: the manifest's own editions). */
+export function slotInEdition(manifest, slot, edition) {
+  return (slot.editions ?? manifest.editions ?? EDITIONS).includes(edition);
+}
+
+/** The slot as `edition` sees it: lite overlays its data, presence and tracking while forbidding every test world. */
+export function effectiveSlot(slot, profile, edition) {
+  if (edition !== 'lite') return slot;
+  const { lite, litePresence, ...base } = slot;
+  const presence = litePresenceOf(slot, profile);
+  const tracked = presence === 'forbidden' ? 'external' : (slot.tracked === 'external' ? 'tracked' : slot.tracked);
+  return { ...base, ...(lite ?? {}), presence, tracked, tests: 'none' };
+}
+
+/** The template group starci app sync renders `slot` from under `edition`: `liteManagedBy` (else `managedBy`) in lite, `managedBy` otherwise; undefined when unmanaged. */
+export function managedGroupOf(slot, edition) {
+  return edition === 'lite' ? (slot.liteManagedBy ?? slot.managedBy) : slot.managedBy;
+}
+
+/** The declared edition and the vocabulary against which it is validated. */
+export function declarationEdition(manifest, declaration) {
+  const edition = declaration.edition === undefined ? 'full' : declaration.edition;
+  const known = manifest.editions ?? EDITIONS;
+  return { edition, known, valid: known.includes(edition) };
+}
+
+/** Problems of an optional rule-catalog `editions` list, in the catalog schema's words. */
+export function ruleEditionProblems(rule, label) {
+  if (rule.editions === undefined) return [];
+  const bad = [];
+  if (!Array.isArray(rule.editions) || !rule.editions.length) return [`${label}.editions must be a non-empty list`];
+  for (const value of rule.editions) if (!EDITIONS.includes(value)) bad.push(`${label}.editions has ${JSON.stringify(value)}, not one of ${EDITIONS.join(', ')}`);
+  if (new Set(rule.editions).size !== rule.editions.length) bad.push(`${label}.editions repeats a value`);
+  return bad;
+}
+
+/** Whether a catalogued rule owner judges its finding under `edition`; uncatalogued codes always remain judged. */
+export function judgedInEdition(owner, edition = 'full') {
+  return !owner?.editions || owner.editions.includes(edition);
+}
+
+/** Whether the enforcer `kind:id` of the catalog `rules` runs under `edition`: every rule listing it is judged there, and the enforcer row's own `editions` (a rule with several enforcers where only one is full-only) agrees. A lint rule no rule lists runs everywhere. */
+export function enforcerJudgedInEdition(rules, kind, id, edition = 'full') {
+  const owners = rules.filter((rule) => rule.enforcers.some((enforcer) => enforcer.kind === kind && enforcer.id === id));
+  return owners.every((rule) => judgedInEdition(rule, edition) && rule.enforcers.filter((enforcer) => enforcer.kind === kind && enforcer.id === id).every((enforcer) => judgedInEdition(enforcer, edition)));
+}
+
+/** A frozen copy of one profile's parameters, with its lite overrides applied only in the lite edition. */
+export function editionRuleParams(params, edition) {
+  const { lite, ...base } = params;
+  const merged = edition === 'lite' && lite ? { ...base, ...lite } : base;
+  const deepFreeze = (value) => { if (value && typeof value === 'object') Object.values(value).forEach(deepFreeze); return Object.freeze(value); };
+  return deepFreeze(structuredClone(merged));
+}

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -1,31 +1,96 @@
 // manifest-shape.mjs - the shape rules of an HFS slot manifest that both manifest kinds share, and the whole shape of a
-// manifest of kind runtime (knowledge/hfs/runtime-slots.yaml): the slot fields, the tier map, ruleParams.runtime and the
-// `pending` allowlist. scripts/hfs/slots.mjs (loadSlotManifest) is the only reader; it adds the app kind's own rules
+// manifest of kind runtime (knowledge/hfs/runtime-slots.yaml): the slot fields, the tier map and ruleParams.runtime.
+// scripts/hfs/slots.mjs (loadSlotManifest) is the only reader; it adds the app kind's own rules
 // (sides, app kinds) and refuses a manifest whole on any problem (HFS_MANIFEST_INVALID). Pure: every function takes a
 // parsed manifest or slot and returns a list of problems in the words of modules/schemas/hfs-slots.schema.yaml.
 import { isPlainObject } from '../../engine/plain-object.mjs';
+import { stringList } from '../lib/list.mjs';
 
 export const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
 export const NAME = /^[a-z][a-z0-9-]*$/;
 export const ENV_PREFIX = /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$/;
+/** How a bounded context (a connection) is isolated: its own logical database, or its own schema of a shared one. */
+const CONTEXT_ISOLATIONS = Object.freeze(["database", "schema"]);
+/** The app kinds that may own a context: the services, never the migrate or cli apps that only run migrations. */
+const CONTEXT_OWNER_KINDS = Object.freeze(["api", "worker"]);
+/** The database engines a connection may run on: a self-described Postgres, or the Postgres of a Supabase project. */
+const CONNECTION_PROVIDERS = Object.freeze(["postgres", "supabase"]);
+/** The editions an app repository may declare in hfs.json (`full` when absent): the filter slots.mjs applies. */
+export const EDITIONS = Object.freeze(["full", "lite"]);
+/** What decides where schema changes live (ruleParams.<side>.schemaAuthority): TypeORM migrations under persistence/, or the Supabase migration tree. */
+export const SCHEMA_AUTHORITIES = Object.freeze(["typeorm", "supabase"]);
+/**
+ * The shape problems of the `connections` of one side: a list of {name, envPrefix, owner, isolation}, the owner an api or worker app
+ * of the same side (a connection is a bounded context and one service owns it), isolation `database` or `schema`.
+ *
+ * @param {unknown} list - The declared connections (null when it is not an array).
+ * @param {unknown} apps - The declared apps of the same side.
+ * @returns {string[]} The problems, none when the shape is right.
+ */
+export function connectionShapeProblems(list, apps) {
+  const keys = (c) => isPlainObject(c) && NAME.test(String(c.name)) && ENV_PREFIX.test(String(c.envPrefix)) && NAME.test(String(c.owner)) && CONTEXT_ISOLATIONS.includes(c.isolation)
+    && (c.provider === undefined || CONNECTION_PROVIDERS.includes(c.provider))
+    && Object.keys(c).every((k) => ['name', 'envPrefix', 'owner', 'isolation', 'provider'].includes(k)) && ['name', 'envPrefix', 'owner', 'isolation'].every((k) => k in c);
+  if (!list || !list.every(keys)) return [`connections must be a list of {name: kebab-case context name, envPrefix: UPPER_SNAKE prefix of its env keys, owner: the service app that owns the context, isolation: ${CONTEXT_ISOLATIONS.join(' | ')}, provider?: ${CONNECTION_PROVIDERS.join(' | ')}}`];
+  const owns = (c) => Array.isArray(apps) && apps.some((app) => isPlainObject(app) && app.name === c.owner && CONTEXT_OWNER_KINDS.includes(app.kind));
+  return list.filter((c) => !owns(c)).map((c) => `connections ${c.name} is owned by ${c.owner}, which is not a ${CONTEXT_OWNER_KINDS.join(' or ')} app declared in the same side`);
+}
 export const SLOT_ID = /^(app|repo|be|fe)\.[a-z0-9-]+(\.[a-z0-9-]+)*$/;
-export const RUNTIME_SLOT_ID = /^runtime\.[a-z0-9-]+(\.[a-z0-9-]+)*$/;
+const RUNTIME_SLOT_ID = /^runtime\.[a-z0-9-]+(\.[a-z0-9-]+)*$/;
 export const PRESENCE = ['required', 'optional', 'opt-in', 'forbidden'];
 export const TRACKED = ['tracked', 'ignored', 'external'];
 /** A runtime manifest adds `generated`: tracked, written only by the slot's generatedBy, judged by drift (RT_GENERATED_DRIFT). */
-export const RUNTIME_TRACKED = [...TRACKED, 'generated'];
+const RUNTIME_TRACKED = [...TRACKED, 'generated'];
 export const TESTS = ['unit-beside', 'e2e', 'none'];
+/** The coverage mode of a tracked slot of the be profile (scripts/hfs/coverage-scope.mjs derives the three coverage consumers from it). */
+export const COVERAGE = ['required', 'none'];
 export const APP_KIND = 'app';
+
+/**
+ * The unit-tested roles of a back end whose spec is required (ruleParams.be.unitRoles of the slot manifest): [{ role, spec, slot?, exempt? }].
+ * THE one list: every check that asks "is this file unit-tested, and where is its spec" asks it here. What the unit run MEASURES is
+ * logicRoles over the coverage-required slots (coverage-scope.mjs), not this list.
+ */
+export const unitRolesOf = (manifest) => manifest.ruleParams.be.unitRoles;
+
+/** The roles that carry logic (ruleParams.be.logicRoles): measured at 100 per file inside a coverage-required slot. */
+export const logicRolesOf = (manifest) => manifest.ruleParams.be.logicRoles;
+
+/** The roles a feature-tier file is judged thin by (ruleParams.be.thinRoles, R203 BE_FEATURE_THIN). */
+export const thinRolesOf = (manifest) => manifest.ruleParams.be.thinRoles;
+
+/** Shape problems of ruleParams.be.unitRoles: unique roles of the suffix vocabulary, each spec `<role>.spec`. */
+export function unitRolesProblems(be) {
+  const roles = be.unitRoles;
+  const roleOk = (r) => r !== null && typeof r === 'object' && !Array.isArray(r) && Object.keys(r).every((k) => ['role', 'spec', 'slot', 'exempt'].includes(k)) && NAME.test(String(r.role)) && String(r.spec) === `${r.role}.spec` && (r.slot === undefined || /^be.[a-z0-9.-]+$/.test(String(r.slot))) && (r.exempt === undefined || (Array.isArray(r.exempt) && r.exempt.every((c) => /^[A-Z][A-Z0-9_]+$/.test(String(c)))));
+  if (!Array.isArray(roles) || !roles.length || !roles.every(roleOk) || new Set(roles.map((r) => r.role)).size !== roles.length) return ['ruleParams.be.unitRoles must be a non-empty list of unique {role, spec: <role>.spec, slot?, exempt?: [rule codes]}'];
+  if (Array.isArray(be.suffixes) && roles.some((r) => !be.suffixes.includes(r.role))) return ['ruleParams.be.unitRoles names a role that is not in ruleParams.be.suffixes'];
+  return [];
+}
+
+/** Shape problems of ruleParams.be.logicRoles and thinRoles: each a non-empty list of unique roles of the suffix vocabulary; every unit role is a logic role. */
+export function roleListProblems(be) {
+  const bad = [];
+  for (const key of ['logicRoles', 'thinRoles']) {
+    const list = be[key];
+    if (!strList(list) || !list.length || new Set(list).size !== list.length || !list.every((role) => NAME.test(role))) bad.push(`ruleParams.be.${key} must be a non-empty list of unique kebab-case roles`);
+    else if (Array.isArray(be.suffixes) && list.some((role) => !be.suffixes.includes(role))) bad.push(`ruleParams.be.${key} names a role that is not in ruleParams.be.suffixes`);
+  }
+  if (strList(be.logicRoles) && Array.isArray(be.unitRoles) && be.unitRoles.some((r) => r?.slot === undefined && !be.logicRoles.includes(r?.role))) bad.push('every ruleParams.be.unitRoles role that is not tied to a slot is a logic role (ruleParams.be.logicRoles)');
+  return bad;
+}
 /** The kind of a manifest and of a declaration that describes the StarCi runtime repository; also its one profile. */
 export const RUNTIME_KIND = 'runtime';
 export const MANIFEST_KINDS = [APP_KIND, RUNTIME_KIND];
 /** The kind of a parsed manifest: `kind`, or app when absent (knowledge/hfs/slots.yaml carries none). */
 export const manifestKind = (m) => (isPlainObject(m) && m.kind !== undefined ? m.kind : APP_KIND);
-export const strList = (v) => Array.isArray(v) && v.every((s) => typeof s === 'string' && s.length > 0);
+const strList = (v) => stringList(v);
 
-const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'rules', 'goesTo', 'why', 'since', 'retiredIn', 'successor'];
+const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'retiredIn', 'successor', 'perConnection', 'parent', 'editions', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'anonymousActions'];
+/** The fields a slot's `lite` overlay may hold: the same keys it would carry in the slot body, resolved under edition lite. */
+const LITE_OVERLAY_KEYS = ['path', 'requires', 'allows', 'forbids', 'minInstances', 'requiredInstances'];
 /** A runtime slot has no app kind, side composition, layer or managed template; it may name the generator of a generated copy. */
-const RUNTIME_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'minInstances', 'requires', 'allows', 'forbids', 'budget', 'rules', 'goesTo', 'why', 'since', 'retiredIn', 'successor', 'generatedBy'];
+const RUNTIME_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'minInstances', 'requires', 'allows', 'forbids', 'budget', 'rules', 'goesTo', 'why', 'since', 'retiredIn', 'successor', 'generatedBy', 'parent'];
 
 /** Shape problems of one slot of a manifest of `kind` (app or runtime). */
 export function slotProblems(slot, index, kind, { appScope = 'app', scopes = [] } = {}) {
@@ -47,14 +112,23 @@ export function slotProblems(slot, index, kind, { appScope = 'app', scopes = []
     else if ((slot.profiles[0] === appScope) !== String(slot.id).startsWith(`${appScope}.`)) bad.push(`${at}: an app-root slot has profiles [app] and an id app.<name>, and only it`);
   }
   if (typeof slot.path !== 'string' || !slot.path) bad.push(`${at}: path is required`);
+  if (slot.parent !== undefined && !/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/.test(String(slot.parent))) bad.push(`${at}: parent must be a slot id`);
   if (!PRESENCE.includes(slot.presence)) bad.push(`${at}: presence must be one of ${PRESENCE.join(', ')}`);
   if (!tracked.includes(slot.tracked)) bad.push(`${at}: tracked must be one of ${tracked.join(', ')}`);
   if (!NAME.test(String(slot.tier))) bad.push(`${at}: tier must be a tier name, none or inherit`);
   if (!TESTS.includes(slot.tests)) bad.push(`${at}: tests must be one of ${TESTS.join(', ')}`);
   if (slot.owner !== undefined && typeof slot.owner !== 'boolean') bad.push(`${at}: owner must be a boolean`);
+  if (!runtime) {
+    const measured = Array.isArray(slot.profiles) && slot.profiles.includes('be') && slot.tracked === 'tracked';
+    if (measured && !COVERAGE.includes(slot.coverage)) bad.push(`${at}: coverage must be one of ${COVERAGE.join(', ')} (every tracked slot of the be profile declares it)`);
+    if (!measured && slot.coverage !== undefined) bad.push(`${at}: coverage belongs to a tracked slot of the be profile only`);
+  }
   if (slot.appKind !== undefined && !NAME.test(String(slot.appKind))) bad.push(`${at}: appKind must be a name`);
+  if (slot.trigger !== undefined && !NAME.test(String(slot.trigger))) bad.push(`${at}: trigger must be a trigger kind name`);
+  if (slot.pattern !== undefined && !NAME.test(String(slot.pattern))) bad.push(`${at}: pattern must be a pattern name`);
   if (slot.minInstances !== undefined && !(Number.isInteger(slot.minInstances) && slot.minInstances >= 1)) bad.push(`${at}: minInstances must be a positive integer`);
   if (slot.requiredWhen !== undefined && slot.requiredWhen !== 'connections') bad.push(`${at}: requiredWhen may only be connections`);
+  if (slot.pattern !== undefined && !/^[a-z][a-z0-9-]*$/.test(String(slot.pattern))) bad.push(`${at}: pattern must be a kebab-case pattern name`);
   if (slot.requiredInstances !== undefined && !(isPlainObject(slot.requiredInstances) && Object.values(slot.requiredInstances).every((v) => strList(v) && v.length))) bad.push(`${at}: requiredInstances must map a variable to a non-empty list of names`);
   for (const key of ['requires', 'allows', 'forbids', 'layers', 'kinds']) if (slot[key] !== undefined && !strList(slot[key])) bad.push(`${at}: ${key} must be a list of strings`);
   if (slot.kinds !== undefined && strList(slot.kinds) && (!slot.kinds.length || new Set(slot.kinds).size !== slot.kinds.length || slot.kinds.some((k) => !NAME.test(k) || (slot.layers ?? []).includes(k)))) bad.push(`${at}: kinds must be a non-empty list of unique folder names that are not layers`);
@@ -62,7 +136,33 @@ export function slotProblems(slot, index, kind, { appScope = 'app', scopes = []
   if (slot.composedBy !== undefined && !(strList(slot.composedBy) && slot.composedBy.length && new Set(slot.composedBy).size === slot.composedBy.length)) bad.push(`${at}: composedBy must be a non-empty list of unique app kinds`);
   if (slot.budget !== undefined && !(isPlainObject(slot.budget) && Object.keys(slot.budget).length && Object.values(slot.budget).every((v) => Number.isInteger(v) && v >= 1))) bad.push(`${at}: budget must map names to positive integers`);
   if (slot.managedBy !== undefined && !NAME.test(String(slot.managedBy))) bad.push(`${at}: managedBy must be a template id`);
+  if (slot.liteManagedBy !== undefined && !NAME.test(String(slot.liteManagedBy))) bad.push(`${at}: liteManagedBy must be a template id`);
+  if (!runtime) {
+    if (slot.editions !== undefined && !(Array.isArray(slot.editions) && slot.editions.length && slot.editions.every((e) => EDITIONS.includes(e)) && new Set(slot.editions).size === slot.editions.length)) bad.push(`${at}: editions must be a non-empty subset of ${EDITIONS.join(', ')}`);
+    if (slot.litePresence !== undefined && !(PRESENCE.includes(slot.litePresence) || (isPlainObject(slot.litePresence) && Object.keys(slot.litePresence).length && Object.entries(slot.litePresence).every(([side, value]) => ['be', 'fe'].includes(side) && PRESENCE.includes(value))))) bad.push(`${at}: litePresence must be a presence value or map sides to presence values`);
+    if (slot.provider !== undefined) {
+      if (!CONNECTION_PROVIDERS.includes(slot.provider)) bad.push(`${at}: provider must be one of ${CONNECTION_PROVIDERS.join(' | ')}`);
+      else if (slot.presence !== 'opt-in' || slot.appKind !== undefined) bad.push(`${at}: provider belongs to an opt-in slot that is not an app kind (a connection with that provider enables it)`);
+    }
+    if (slot.lite !== undefined) {
+      const ok = isPlainObject(slot.lite) && Object.keys(slot.lite).length && Object.keys(slot.lite).every((key) => LITE_OVERLAY_KEYS.includes(key))
+        && (slot.lite.path === undefined || (typeof slot.lite.path === 'string' && slot.lite.path))
+        && ['requires', 'allows', 'forbids'].every((key) => slot.lite[key] === undefined || strList(slot.lite[key]))
+        && (slot.lite.minInstances === undefined || (Number.isInteger(slot.lite.minInstances) && slot.lite.minInstances >= 1))
+        && (slot.lite.requiredInstances === undefined || (isPlainObject(slot.lite.requiredInstances) && Object.values(slot.lite.requiredInstances).every((v) => strList(v) && v.length)));
+      if (!ok) bad.push(`${at}: lite may hold only ${LITE_OVERLAY_KEYS.join(', ')}, each shaped as in the slot body`);
+    }
+  }
+  if (slot.entries !== undefined) {
+    const listed = strList(slot.entries) && slot.entries.length > 0 && new Set(slot.entries).size === slot.entries.length && slot.entries.every(relPath);
+    if (!listed) bad.push(`${at}: entries must be a non-empty list of unique relative file paths`);
+    else if (typeof slot.path !== 'string' || !slot.path.endsWith('/') || slot.owner === true) bad.push(`${at}: entries belong to a directory slot that is not an owner (they name extra public entries of the owner that holds it)`);
+    else if (Array.isArray(slot.allows) && slot.entries.some((entry) => !slot.allows.includes(entry))) bad.push(`${at}: every entry must be one of the names the slot allows`);
+  }
+  if (slot.anonymousActions !== undefined && !(strList(slot.anonymousActions) && slot.anonymousActions.length > 0 && new Set(slot.anonymousActions).size === slot.anonymousActions.length && slot.anonymousActions.every(relPath) && typeof slot.path === 'string' && slot.path.endsWith('/'))) bad.push(`${at}: anonymousActions must be a non-empty list of unique relative file paths of a directory slot`);
+  if (slot.outcomeHome !== undefined && !(slot.outcomeHome === true && typeof slot.path === 'string' && slot.path && !slot.path.endsWith('/'))) bad.push(`${at}: outcomeHome is true and belongs to a file slot (the one file that declares the repository's Outcome union)`);
   if (slot.rules !== undefined && !(Array.isArray(slot.rules) && slot.rules.every((r) => /^[A-Z][A-Z0-9_]*\*?$/.test(String(r))) && new Set(slot.rules).size === slot.rules.length)) bad.push(`${at}: rules must be unique rule ids`);
+  if (slot.perConnection !== undefined && !(slot.id === 'be.persistence' && strList(slot.perConnection) && slot.perConnection.length && new Set(slot.perConnection).size === slot.perConnection.length && slot.perConnection.every((name) => NAME.test(name)))) bad.push(`${at}: perConnection is a unique list of capability names, only on be.persistence (the platform capabilities whose tables exist on every connection that uses them)`);
   if (slot.since !== undefined && !SEMVER.test(String(slot.since))) bad.push(`${at}: since must be a version`);
   if (slot.retiredIn !== undefined && !(Number.isInteger(slot.retiredIn) && slot.retiredIn >= 2)) bad.push(`${at}: retiredIn must be a major`);
   if (slot.retiredIn !== undefined && typeof slot.successor !== 'string') bad.push(`${at}: a retired slot names its successor`);
@@ -74,16 +174,12 @@ export function slotProblems(slot, index, kind, { appScope = 'app', scopes = []
 /** The owners of an external call in a runtime manifest: an api system folder (`api/<system>`, `api/*` any system) or the DB tier. */
 const INFRA_OWNER = /^(?:api\/(?:\*|[a-z][a-z0-9-]*)|engine\/db)$/;
 const RUNTIME_PARAM_KEYS = ['fileLines', 'sourceRoots', 'infraOwners', 'baseWriteMembers', 'baseEnvSeams', 'apiContracts', 'sourceName', 'oneOffNames', 'sharedBasenames', 'generated', 'pinned', 'selfChecks'];
-const PENDING_KEYS = ['path', 'rule', 'lane', 'since', 'reason'];
-/** The chunk of the runtime migration that deletes a pending entry (C1..C8, a split chunk C2a/C2b). */
-const PENDING_LANE = /^C[1-8][ab]?$/;
-const DATE = /^\d{4}-\d{2}-\d{2}$/;
 const relPath = (v) => typeof v === 'string' && v.length > 0 && !v.startsWith('/') && !v.includes('..') && !v.includes('\\');
 
 /** Shape problems of a parsed manifest of kind runtime (knowledge/hfs/runtime-slots.yaml), in the words of modules/schemas/hfs-slots.schema.yaml. */
 export function runtimeShapeProblems(m) {
   const bad = [];
-  const allowed = new Set(['schema', 'kind', 'version', 'versioning', 'presenceValues', 'trackedValues', 'testValues', 'profiles', 'tiers', 'ruleParams', 'crossOwner', 'crossSystem', 'slots', 'pending', 'consumers']);
+  const allowed = new Set(['schema', 'kind', 'version', 'versioning', 'presenceValues', 'trackedValues', 'testValues', 'profiles', 'tiers', 'ruleParams', 'crossOwner', 'crossSystem', 'slots', 'consumers']);
   for (const key of Object.keys(m)) if (!allowed.has(key)) bad.push(`unknown top-level key ${key}`);
   if (!/^starci\/runtime-slots@\d+$/.test(String(m.schema))) bad.push('schema must be starci/runtime-slots@<major>');
   if (!SEMVER.test(String(m.version))) bad.push('version must be MAJOR.MINOR.PATCH');
@@ -100,19 +196,6 @@ export function runtimeShapeProblems(m) {
   else bad.push(...runtimeParamProblems(rp.runtime));
   if (!Array.isArray(m.slots) || !m.slots.length) bad.push('slots must be a non-empty list');
   else m.slots.forEach((slot, index) => bad.push(...slotProblems(slot, index, RUNTIME_KIND)));
-  if (m.pending !== undefined) {
-    if (!Array.isArray(m.pending)) bad.push('pending must be a list');
-    else m.pending.forEach((entry, index) => {
-      const at = `pending[${index}]`;
-      if (!isPlainObject(entry)) { bad.push(`${at} is not a map`); return; }
-      for (const key of Object.keys(entry)) if (!PENDING_KEYS.includes(key)) bad.push(`${at}: unknown field ${key}`);
-      if (!relPath(entry.path)) bad.push(`${at}: path must be a repository-relative glob`);
-      if (!/^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/.test(String(entry.rule))) bad.push(`${at}: rule must be a finding code`);
-      if (!PENDING_LANE.test(String(entry.lane))) bad.push(`${at}: lane must be the chunk that removes it (C1..C8, C2a, C2b)`);
-      if (!DATE.test(String(entry.since))) bad.push(`${at}: since must be a date YYYY-MM-DD`);
-      if (typeof entry.reason !== 'string' || !entry.reason.trim()) bad.push(`${at}: reason is required`);
-    });
-  }
   if (m.consumers !== undefined && !strList(m.consumers)) bad.push('consumers must be a list of paths');
   return bad;
 }
@@ -151,19 +234,13 @@ export function tierMapProblems(profile, tiers) {
   return bad;
 }
 
-/** The semantic rules of a runtime manifest beyond the slot rules both kinds share: tier names, the schema major, unique pending entries. */
+/** The semantic rules of a runtime manifest beyond the slot rules both kinds share: tier names and the schema major. */
 export function runtimeSemanticProblems(m) {
   const bad = [];
   const tiers = m.tiers.runtime;
   for (const [tier, def] of Object.entries(tiers)) {
     for (const target of def.mayImport) if (!(target in tiers)) bad.push(`tiers.runtime.${tier}.mayImport names ${target}, which is not a runtime tier`);
   }
-  const seen = new Set();
-  for (const entry of m.pending ?? []) {
-    const key = `${entry.path}\0${entry.rule}`;
-    if (seen.has(key)) bad.push(`pending names ${entry.path} for ${entry.rule} twice`);
-    seen.add(key);
-  }
   const major = Number(m.version.split('.')[0]);
   if (String(m.schema) !== `starci/runtime-slots@${major}`) bad.push(`schema ${m.schema} does not carry the major of version ${m.version}`);
   return bad;

package/runtime/scripts/hfs/param-names.mjs

@@ -0,0 +1,18 @@
+// param-names.mjs - the one shape of `ruleParams.be.paramNames` of knowledge/hfs/slots.yaml (R85 injected-param-name): a non-empty list of unique
+// entries `{type | typeSuffix, names, nameSuffix?}`. The loader of scripts/hfs/slots.mjs calls it; the schema (modules/schemas/hfs-slots.schema.yaml)
+// states the same shape and tests/hfs/hfs-slots.spec.mjs proves the two agree.
+import { isPlainObject } from '../../engine/plain-object.mjs';
+
+const UPPER = /^[A-Z][A-Za-z0-9]*$/u;
+const LOWER = /^[a-z][A-Za-z0-9]*$/u;
+
+const entryOk = (e) => isPlainObject(e) && ((e.type === undefined) !== (e.typeSuffix === undefined)) && UPPER.test(String(e.type ?? e.typeSuffix))
+  && Array.isArray(e.names) && e.names.length > 0 && new Set(e.names).size === e.names.length && e.names.every((n) => LOWER.test(String(n)))
+  && (e.nameSuffix === undefined || UPPER.test(String(e.nameSuffix))) && Object.keys(e).every((k) => ['type', 'typeSuffix', 'names', 'nameSuffix'].includes(k));
+
+/** True when `list` is a well-formed paramNames table. */
+export function paramNamesOk(list) {
+  if (!Array.isArray(list) || list.length === 0 || !list.every(entryOk)) return false;
+  const keys = list.map((e) => (e.type !== undefined ? `type:${e.type}` : `typeSuffix:${e.typeSuffix}`));
+  return new Set(keys).size === keys.length;
+}