@starci/hfs 4.1.0 → 4.2.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 4.2.0 - 2026-10-09
+
+- Changed: the lint runner (`lint/run.mjs`) and the bundled runtime copies follow the runtime of 1.0.0-alpha.9. Version 4.1.0 on the registry carries the copies of an earlier runtime.
+
 ## 4.1.0 - 2026-10-08
 
 - Breaking (runtime alpha.4 CLI unification): remove the `hfs` bin and expose `main(argv, io)` for the sole `starci app ...` grammar; the app flags `--repo` and `--root` are replaced by the global `--cwd` flag.

package/lint/run.mjs

@@ -18,7 +18,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { spawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { linterReport, mergeReports, sonarReport, sourceRootsOf } from '../report/sonar.mjs';
 import { SIDES, appRelativeMessages, loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
@@ -66,8 +66,22 @@ export function parseLintArgs(argv) {
 export const BOUND_ENV = 'STARCI_LINT_BOUND';
 export const linterBoundArgs = () => ['--require', fileURLToPath(new URL('./bound-sys.cjs', import.meta.url))];
 
-/** A linter's json results through the app's own install, run from `cwd` (a side folder): `{ results }` or `{ error }`. */
-function runLinter({ cwd, pkg, bin, args, bound = null }) {
+/** The child `node` ran with `args` from `cwd`: its exit status, signal, spawn error and the text of both streams, once it closes. */
+function runNode(args, options) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, args, { ...options, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    const out = [];
+    const err = [];
+    let failure;
+    child.stdout.on('data', (chunk) => out.push(chunk));
+    child.stderr.on('data', (chunk) => err.push(chunk));
+    child.on('error', (error) => { failure = error; });
+    child.on('close', (status, signal) => resolve({ status, signal, error: failure, stdout: Buffer.concat(out).toString('utf8'), stderr: Buffer.concat(err).toString('utf8') }));
+  });
+}
+
+/** A linter's json results through the app's own install, run from `cwd` (a side folder): `{ results }` or `{ error }`. The child runs while the caller goes on. */
+async function runLinter({ cwd, pkg, bin, args, bound = null }) {
   let entry;
   try {
     const manifest = createRequire(path.join(cwd, 'package.json')).resolve(`${pkg}/package.json`);
@@ -76,7 +90,7 @@ function runLinter({ cwd, pkg, bin, args, bound = null }) {
   } catch {
     return { error: `${pkg} is not installed for ${cwd}` };
   }
-  const run = spawnSync(process.execPath, [...(bound ? linterBoundArgs() : []), entry, ...args], { cwd, encoding: 'utf8', maxBuffer: 512 * 1024 * 1024, ...(bound ? { env: { ...process.env, [BOUND_ENV]: bound } } : {}) });
+  const run = await runNode([...(bound ? linterBoundArgs() : []), entry, ...args], { cwd, ...(bound ? { env: { ...process.env, [BOUND_ENV]: bound } } : {}) });
   // ESLint prints its report on stdout; stylelint uses stderr. JSON does not prove a completed child: only exits 0/1
   // without a spawn error or signal are measurable, and exit 1 must carry findings.
   let results;
@@ -165,6 +179,29 @@ function checkedEslintResults({ results, expected, cwd, scope, changed }) {
   return { results: valid, errors };
 }
 
+/** Starts the ESLint child of every side that has work and returns one record per side: skipped, a scope error, or the running child. */
+async function launchEslint({ app, repoRoot, opts, changed, existing, workspace, onFe }) {
+  const launches = [];
+  for (const side of app ? SIDES : []) {
+    if (workspace !== null && side !== STYLE_SIDE) { launches.push({ side, skipped: `outside --workspace ${workspace}` }); continue; }
+    const sources = onSide(existing, side).filter((file) => /\.(?:[cm]?[jt]sx?)$/.test(file));
+    if (changed !== null && !sources.length) { launches.push({ side, skipped: 'no changed source file' }); continue; }
+    const cwd = path.join(repoRoot, side);
+    let expected;
+    try { expected = changed ? sources : await sourceFiles({ repoRoot, cwd, side, scope: onFe }); }
+    catch (error) { launches.push({ side, scopeError: `eslint source scope is unavailable in ${side}/: ${String(error?.message ?? error)}` }); continue; }
+    launches.push({ side, cwd, expected, run: runLinter({ cwd, pkg: 'eslint', bin: 'eslint', args: ['--format', 'json', ...(opts.fix ? ['--fix'] : []), ...(changed ? sources : [onFe ?? '.'])], bound: repoRoot }) });
+  }
+  return launches;
+}
+
+/** Starts stylelint over the fe stylesheets (the running child), or returns null when no stylesheet is in scope. */
+function launchStylelint({ repoRoot, opts, changed, existing, onFe }) {
+  const styles = onSide(existing, STYLE_SIDE).filter((file) => file.endsWith('.css'));
+  if (changed !== null && !styles.length) return null;
+  return runLinter({ cwd: path.join(repoRoot, STYLE_SIDE), pkg: 'stylelint', bin: 'stylelint', args: [...(changed ? styles : [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json', ...(opts.fix ? ['--fix'] : [])] });
+}
+
 /**
  * Run the whole lint of the app at `repoRoot`. `hfsCheck(repoRoot)` returns the `starci app check` result (`{ findings, tracked }`); the CLI
  * injects it. Returns `{ report, sonar, exit }`; `sonar` is the merged Generic Issue Import document.
@@ -191,22 +228,24 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
   /** The workspace folder relative to the fe side folder (apps/<app> or packages/<pkg>). */
   const onFe = workspace === null ? null : workspace.slice(STYLE_SIDE.length + 1);
 
+  // The linters and the app check are independent: every child starts first, the app check runs while they work, and the results are read in a fixed order.
+  const eslintLaunches = await launchEslint({ app, repoRoot, opts, changed, existing, workspace, onFe });
+  const styleLaunch = app ? launchStylelint({ repoRoot, opts, changed, existing, onFe }) : null;
+  const checkRun = app ? Promise.resolve().then(() => hfsCheck(repoRoot)).then((value) => ({ value }), (error) => ({ error })) : null;
+
   // 1. ESLint, once per side, from the side folder with that side's config.
   engines.eslint = { sides: {} };
-  for (const side of app ? SIDES : []) {
-    if (workspace !== null && side !== STYLE_SIDE) { engines.eslint.sides[side] = { files: 0, skipped: `outside --workspace ${workspace}` }; continue; }
-    const sources = onSide(existing, side).filter((file) => /\.(?:[cm]?[jt]sx?)$/.test(file));
-    if (changed !== null && !sources.length) { engines.eslint.sides[side] = { files: 0, skipped: 'no changed source file' }; continue; }
-    const cwd = path.join(repoRoot, side);
-    let expected;
-    try { expected = changed ? sources : await sourceFiles({ repoRoot, cwd, side, scope: onFe }); }
-    catch (error) { errors.push(`eslint source scope is unavailable in ${side}/: ${String(error?.message ?? error)}`); engines.eslint.sides[side] = { files: 0 }; continue; }
-    const linted = runLinter({ cwd, pkg: 'eslint', bin: 'eslint', args: ['--format', 'json', ...(opts.fix ? ['--fix'] : []), ...(changed ? sources : [onFe ?? '.'])], bound: repoRoot });
+  const eslintRuns = await Promise.all(eslintLaunches.map((launch) => launch.run ?? null));
+  eslintLaunches.forEach((launch, at) => {
+    const { side } = launch;
+    if (launch.skipped) { engines.eslint.sides[side] = { files: 0, skipped: launch.skipped }; return; }
+    if (launch.scopeError) { errors.push(launch.scopeError); engines.eslint.sides[side] = { files: 0 }; return; }
+    const linted = eslintRuns[at];
     if (linted.error) errors.push(linted.error);
     if (linted.results) {
-      const checked = checkedEslintResults({ results: linted.results, expected, cwd, scope: onFe, changed: changed !== null });
-      errors.push(...checked.errors);
-      linted.results = checked.results;
+      const checkedResults = checkedEslintResults({ results: linted.results, expected: launch.expected, cwd: launch.cwd, scope: onFe, changed: changed !== null });
+      errors.push(...checkedResults.errors);
+      linted.results = checkedResults.results;
       // The side canon names side-relative paths in its messages; the report names every path from the app root.
       const appRelative = appRelativeMessages(side, path.join(repoRoot, side));
       for (const result of linted.results) for (const message of result.messages ?? []) message.message = appRelative(message.message);
@@ -214,13 +253,12 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
       findings.push(...eslintFindings(linted.results, repoRoot));
     }
     engines.eslint.sides[side] = { files: linted.results?.length ?? 0 };
-  }
+  });
 
   // 3. stylelint over the fe side's stylesheets.
   if (app) {
-    const styles = onSide(existing, STYLE_SIDE).filter((file) => file.endsWith('.css'));
-    if (changed === null || styles.length) {
-      const linted = runLinter({ cwd: path.join(repoRoot, STYLE_SIDE), pkg: 'stylelint', bin: 'stylelint', args: [...(changed ? styles : [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json', ...(opts.fix ? ['--fix'] : [])] });
+    if (styleLaunch) {
+      const linted = await styleLaunch;
       if (linted.error) errors.push(linted.error);
       if (linted.results) {
         const appRelative = appRelativeMessages(STYLE_SIDE, path.join(repoRoot, STYLE_SIDE));
@@ -234,8 +272,10 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
 
   // 2. The app check: root and sides.
   let checked = { findings: [] };
-  if (app) {
-    try { checked = await hfsCheck(repoRoot); } catch (error) { errors.push(`starci app check could not run: ${String(error?.message ?? error)}`); }
+  if (checkRun) {
+    const settled = await checkRun;
+    if (settled.error) errors.push(`starci app check could not run: ${String(settled.error?.message ?? settled.error)}`);
+    else checked = settled.value;
   }
   const repoErrors = checked.findings.filter((finding) => finding.level === 'error');
   // A workspace lint keeps only the app findings inside the workspace; the rest belong to the root lint of the whole app.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/config.example.yaml

@@ -185,3 +185,10 @@ sonar: {organization: null}
 #   minFreeRamPct  free-RAM percentage below which no new heavy op starts
 # set them only in the gitignored config.yaml copy, e.g.
 #   resources: {minFreeDiskGb: 5, minFreeDiskPct: 1, minFreeRamPct: 10}
+# release — where the full test suite of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
+#   suite: local   the shipped default: `starci release cut` runs the root suite and the Linux parity container before it pushes, and the pre-push gate asks for their green rows
+#   suite: ci      the owner's recorded choice (2026-10-09): no local full suite and no Linux container; the GitHub ci workflow runs the suite (with coverage, Codecov, SonarCloud) AFTER the push.
+#                  The cut still runs npm run check, npm run test:packages, the specs affected by the release, the live Orca smokes and the example apps; the record lists the root suite as
+#                  delegated, never green. A release can reach GitHub and its tag before the suite has run; a red CI is fixed forward with the next pre-release (starci release ci-status).
+# "none" is refused: the suite does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
+release: {suite: local}

package/runtime/engine/config.mjs

@@ -6,6 +6,7 @@ import {parseYaml} from './yaml.mjs';
 import {isPlainObject as plain} from './plain-object.mjs';
 import {invalid,validateRoots,ROOT_KEYS} from './invalid-config.mjs';
 import {validateSonar} from './sonar-config.mjs';
+import {validateRelease,RELEASE_KEYS} from './release-config.mjs';
 import {validateOrca,ORCA_KEYS} from './orca-config.mjs';
 import {validateResources,RESOURCE_KEYS} from './resources-config.mjs';
 import {ENV_NAME,secretEnv,connectorSecret} from './secrets.mjs';
@@ -242,7 +243,7 @@ export function uatSettings(config=loadConfig()){
 const GRANT=/^([a-z0-9][a-z0-9.-]*)=(\d+)@([a-z]+(?:\+[a-z]+)*)$/;
 /** One grant string `<pool>=<slots>@<role>+<role>` as {pool, slots, roles}, or null when it is not that shape. */
 /** The closed set of top-level config.yaml blocks: the validator accepts these and refuses every other key. */
-export const CONFIG_BLOCKS=Object.freeze(['language','model','effort','models','allocation','kernel','budgets','supervisor','parallel','delegation','connectors','asks','uat','specs','reconciler','debugLoop','orca','roots','resources','sonar','launchTrust','retention']);
+export const CONFIG_BLOCKS=Object.freeze(['language','model','effort','models','allocation','kernel','budgets','supervisor','parallel','delegation','connectors','asks','uat','specs','reconciler','debugLoop','orca','roots','resources','sonar','release','launchTrust','retention']);
 export function parseAllocationGrant(text){
   const m=typeof text==='string'?GRANT.exec(text.trim()):null;
   return m?{pool:m[1],slots:Number(m[2]),roles:m[3].split('+')}:null;
@@ -323,7 +324,7 @@ const validateEarlyConfigBlocks=(config)=>{
   if(config?.launchTrust!==undefined){launchTrustSettings(config);} if(config?.retention!==undefined){workflowPurgeSettings(config);}
   if(config?.connectors!==undefined){validateConnectors(config.connectors);} if(config?.asks!==undefined){validateAsks(config.asks);}
   if(config?.uat!==undefined){validateUat(config.uat);} if(config?.debugLoop!==undefined){validateDebugLoop(config.debugLoop);}
-  if(config?.orca!==undefined){validateOrca(config.orca);} if(config?.roots!==undefined){validateRoots(config.roots);} if(config?.resources!==undefined){validateResources(config.resources);} if(config?.sonar!==undefined){validateSonar(config.sonar);}
+  if(config?.orca!==undefined){validateOrca(config.orca);} if(config?.roots!==undefined){validateRoots(config.roots);} if(config?.resources!==undefined){validateResources(config.resources);} if(config?.sonar!==undefined){validateSonar(config.sonar);} if(config?.release!==undefined){validateRelease(config.release);}
 };
 const validateConfigBlocks=(config,knownProviders,runtimes,profile)=>{
   // specs (owner 2026-09-28): {harness?, unit?, e2e?} booleans - each family a boolean; absent = its default (SPEC_DEFAULTS: harness off, unit on, e2e off; specsSettings).
@@ -416,7 +417,7 @@ export const CONFIG_KEY_TREE=Object.freeze({
   supervisor:Object.freeze(['mode','pollIntervalMs','repos','stallMinutes','kernel','workers','landGate','frozenMinutes']),
   delegation:Object.freeze(['asks','until','excludes','note']),asks:Object.freeze(['autoAcceptRecommended','excludes']),uat:Object.freeze(['maxConcurrent']),
   specs:SPEC_FAMILIES,reconciler:Object.freeze(['enabled','profile','controllers']),debugLoop:Object.freeze(['interval','worktreeLimit']),
-  orca:ORCA_KEYS,roots:ROOT_KEYS,resources:RESOURCE_KEYS,
+  orca:ORCA_KEYS,roots:ROOT_KEYS,resources:RESOURCE_KEYS,release:RELEASE_KEYS,
 });
 export const SPEC_DEFAULTS=Object.freeze({harness:false,unit:true,e2e:false});
 export function specsSettings(config){const specs=plain(config?.specs)?config.specs:{};return Object.fromEntries(SPEC_FAMILIES.map(key=>[key,typeof specs[key]==='boolean'?specs[key]:SPEC_DEFAULTS[key]]));}

package/runtime/engine/release-config.mjs

@@ -0,0 +1,28 @@
+import {isPlainObject as plain} from './plain-object.mjs';
+import {invalid} from './invalid-config.mjs';
+
+/** The keys of the release block. */
+export const RELEASE_KEYS=Object.freeze(['suite']);
+/** Where the full test suite of a release is judged: `local` (the release cut runs it, the shipped default) or `ci` (the GitHub workflow runs it after the push; the cut runs only the affected specs of the release and the rows CI cannot run). */
+export const SUITE_MODES=Object.freeze(['local','ci']);
+export const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
+
+/**
+ * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped
+ * default: `starci release cut` runs the root suite and the Linux parity container before it pushes. `ci` is the owner's recorded choice (2026-10-09) that
+ * the full suite runs on GitHub only: the cut runs no root suite and no Linux container, and the CI workflow's verdict is read afterwards (`starci release ci-status`).
+ * `none` is refused: the suite does not vanish, it moves to CI, and the value says so.
+ */
+export function validateRelease(release){
+  if(release===null)return;
+  const bad=invalid('release');
+  if(!plain(release))bad(` must be {suite?: ${SUITE_MODES.join(' | ')}} or null.`);
+  for(const key of Object.keys(release))if(!RELEASE_KEYS.includes(key))bad(` has unknown key ${key} (allowed: ${RELEASE_KEYS.join(', ')}).`);
+  const value=release.suite;
+  if(value===undefined||value===null)return;
+  if(value==='none')bad('.suite: "none" is not a mode: write "ci" (no local full suite, CI judges) or "local".');
+  if(!SUITE_MODES.includes(value))bad(`.suite must be ${SUITE_MODES.join(' or ')}, or null.`);
+}
+
+/** The suite mode a validated owner config names; an absent block or key is the shipped default. */
+export const releaseSuiteMode=config=>config?.release?.suite??RELEASE_DEFAULTS.suite;

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind and the IconButton disclosure props. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.1.0
+    version: 3.2.0
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.1.0
+    version: 8.2.0
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.1.0
+    version: 1.2.0
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.1.0
+    version: 4.2.0
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -2090,3 +2090,66 @@ rules:
       - {kind: eslint-fe, id: no-unused-import}
       - {kind: eslint-fe, id: prefer-export-from}
       - {kind: eslint-fe, id: no-unused-prop-types}
+  - id: R236
+    code: "RT_GATE_LOOSENING"
+    law: "A change that loosens a gate or check is owner-class: a check removed from a gate file's list, a floor lowered or a ceiling raised there, an allowlist entry added, a spec deleted or weakened or skipped together with product code (modules/kernel/gate-loosening.yaml). It lands, and passes the check, only when the tree it is judged against already holds the owner's approval of exactly that loosening, an owner-rulings entry gate-loosening-<fingerprint>."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_GATE_LOOSENING"]
+    enforcers:
+      - {kind: runtime, id: gate-loosening, at: scripts/checks/check-gate-loosening.mjs}
+  - id: R237
+    code: "RT_REVISION_SCOPE"
+    law: "What a change of the runtime tree asks of each role is declared once, in modules/kernel/revision-scope.yaml: every tracked path matches a row, the engine-loaded files are derived from the import graph of the engine's entries and never hand-listed, the files each seat's launch prompt is built from are the files its generator reads, and a wording-only declaration holds only for an edit that keeps the file's structure."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_REVISION_SCOPE"]
+    enforcers:
+      - {kind: runtime, id: revision-scope, at: scripts/checks/check-revision-scope.mjs}
+  - id: R238
+    code: "RT_EVENT_SPILL_BYPASS"
+    law: "A ledger event payload that grows with its input (a file list, a manifest, a digest, a report, a critique, a menu) goes to the blob store through the one path of appendEvent: engine/db/event-compact.mjs eventPayloadRecord keeps a bounded inline view of at most 16 KiB and the whole payload behind events.payload_sha, and readers resolve it through engine/db/event-payload.mjs. No runtime source file other than engine/db/ledger.mjs and engine/db/event-compact.mjs passes a payloadSha to a write, catches the payload-too-large refusal to spill by hand, or inserts into the events table directly. Specs, tests, node_modules, the generated runtime copies and packages are out of scope."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_EVENT_SPILL_BYPASS"]
+    enforcers:
+      - {kind: runtime, id: event-spill, at: scripts/checks/check-event-spill.mjs}
+  - id: R239
+    code: "RT_STORAGE_UNDECLARED"
+    law: "Content lives as a file in the content-addressed blob store under the runtime state dir (<runtime root>/.runtime/artifacts, engine/db/blob.mjs) and a database row holds only the reference (the sha) plus the small scalars it is queried by (owner ruling 2026-10-09). Always content, whatever its size: a report, a critique or verdict, a prompt or dispatch contract, a read manifest, a list of files, a log or command output, a menu or digest snapshot, an image or render, a diff. What may stay inline: ids, states, timestamps, counts, short codes and one-line reasons up to 256 bytes; any other free text up to 1024 bytes; a payload of any size is class spill (appendEvent and supEvent keep the whole payload behind the sha and a small inline form). Every text column of the product ledger and of machine.sqlite is declared in modules/schemas/storage-convention.yaml with its class (scalar, bounded, reference, spill, migrate), so a new table or column cannot appear without one; a column that holds content inline today is class migrate with its measured size, and the migration to a reference is a proposed runtime step, idempotent and journalled, never a hand rewrite of a live store."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_STORAGE_UNDECLARED"]
+    enforcers:
+      - {kind: runtime, id: storage-convention, at: scripts/checks/check-storage-convention.mjs}
+  - id: R240
+    code: "RT_ROOT_ADHOC"
+    law: "Which directory a component reads or writes is decided in one module, scripts/lib/roots.mjs: the runtime tree, its state directory, the temp root, the invocation directory, the Work directory name, the order in which two trees that can hold the same record are tried (the tree the work happens in first, then the product's main checkout: workDirHolding, workRecordPath) and the order a tool is looked up (the tree the work happens in, then the project, the runtime's own install last: toolSearchDirs). A runtime source file does not resolve a root by itself: it neither spells process.cwd() nor the Work directory name as a literal outside that module more often than the tree the check landed on held it: a file keeps the count it had and only loses it as it is converted, and a new file starts at none. Four times in two days a component read or wrote the wrong tree because it resolved the directory itself."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_ROOT_ADHOC"]
+    enforcers:
+      - {kind: runtime, id: root-adhoc, at: scripts/checks/check-root-adhoc.mjs}
+  - id: R241
+    code: "RT_HELD_UNSURFACED"
+    law: "A failure code the catalogue gives to the Supervisor or the owner as a runtime fault is a state that role must be able to learn of; a stop that nobody is told of stands for hours until someone reads source. Each such entry of modules/kernel/failure-codes.yaml names the house mechanism that reaches its owner (surfacedBy: decision-item, sla-clock, incident, digest, notifier, caller or open) with surfacedAs (the item kind, clock code, incident kind, digest problem line or urgent class) and surfacedAt (the file that does it), and the check proves the mechanism exists and is wired in that file: the kind is a Decision Item kind and the file opens items naming it, the code is an SLA code with an owner and the file sets its clock, the problem line is a departure of the operating standard, a caller is a verb the owning role ran itself and never a reconciler file (a loop is no owner). An entry nothing reaches is surfacedBy open and names an open edge-case registry entry with the exact reason; it is never exempted silently."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_HELD_UNSURFACED"]
+    enforcers:
+      - {kind: runtime, id: held-surfacing, at: scripts/checks/check-held-surfacing.mjs}
+  - id: R242
+    code: "RT_OP_JUDGE_UNDECLARED"
+    law: "Every op declares who judges its product (principle P2: the maker never judges its own work). The contract of each op (modules/ops/ops/<op>.yaml) carries the required field `judge`, a list of at least one entry, each with a one-line why: machine (independent measures the runtime owns or re-runs at settle, named from modules/kernel/op-judges.yaml, and the contract proofs they rely on; a test file the same attempt wrote is never one by itself), critic (the independent Critic and its rubric, declared exactly for the op kinds that modules/kernel/critic.yaml coverage marks covered), owner (only where modules/kernel/op-judges.yaml ownerGates holds an owner gate) and next-leg (a registered reviewing leg whose contract is to review this product). Nobody cannot be declared. The registry and the contracts are checked against the runtime's own tables (op-gate and sonar-gate enforcedOps, opProofs, proof media, the Critic coverage), so the declarations and what the runtime does cannot drift apart. Surfaced in the full status text of a leg and in the op prompt."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_OP_JUDGE_UNDECLARED"]
+    enforcers:
+      - {kind: runtime, id: op-judge, at: scripts/checks/check-op-judge.mjs}

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -154,6 +154,58 @@ removed:
     use: 'skills/starci/references/host-startup.md'
     since: 1.0.0-alpha.6
     match: '(?<![\w-])host-maintenance\b'
+  - id: config-drawloop-critic
+    kind: config-key
+    name: allocation.drawLoop.critic
+    use: 'the Critic is picked from its tier (modules/models/tiers.yaml seats.critic, modules/kernel/critic.yaml) with provider independence as a hard filter; its wall bound is allocation.drawLoop.criticTimeoutMs'
+    since: 1.0.0-alpha.9
+    match: 'allocation\.drawLoop\.critic(?![A-Za-z])'
+  - id: config-drawloop-criticwhendrawer
+    kind: config-key
+    name: allocation.drawLoop.criticWhenDrawer
+    use: 'the Critic tier holds a member of every provider and the picker removes the provider of the maker; there is no per-drawer table'
+    since: 1.0.0-alpha.9
+    match: 'criticWhenDrawer'
+  - id: registry-critic-coverage-define-architecture
+    kind: vocabulary
+    name: critic-coverage-define-architecture
+    use: 'the edge-case registry entry is critic-coverage-decision-legs'
+    since: 1.0.0-alpha.9
+  - id: supervisor-grammar-release
+    kind: vocabulary
+    name: grammarRelease
+    use: 'the owner publishes @starci/grammar through starci release publish; the Supervisor changes no runtime code'
+    since: 1.0.0-alpha.9
+  - id: supervise-yaml-worker-land-blocks
+    kind: vocabulary
+    name: supervise.yaml workers
+    use: 'the Supervisor spawns no fix workers and lands nothing: it answers its menu (starci supervisor status) and records runtime defects for Debug'
+    since: 1.0.0-alpha.9
+    match: 'supervise\.yaml\s+(?:workers|landGate)\b|supervise\.yaml\s+kernelSeat/workers'
+  - id: supervisor-fixes-through-lanes
+    kind: vocabulary
+    name: the Supervisor fixes through lanes
+    use: 'the Supervisor records a runtime defect (starci supervisor actions record --item runtime-defect:<cause>) and Debug changes .claude'
+    since: 1.0.0-alpha.9
+    match: 'Supervisor[^\n.]{0,60}\bfix(?:es)?\s+through\s+(?:its\s+own\s+)?(?:staged\s+)?lanes?\b'
+  - id: kernel-ranked-actions
+    kind: vocabulary
+    name: ranked actions
+    use: "the Kernel's menu: the Decide section of starci kernel status, answered with starci kernel decide"
+    since: 1.0.0-alpha.9
+    match: '[Ww]ork the ranked actions|[Ff]irst rca\.actions entry'
+  - id: kernel-run-next-actions
+    kind: vocabulary
+    name: run nextActions
+    use: "the Kernel answers the items of its menu; the runtime performs the mechanical next actions"
+    since: 1.0.0-alpha.9
+    match: 'run nextActions|run each\s+in order and never choose'
+  - id: event-op-reported
+    kind: vocabulary
+    name: op-reported
+    use: 'the event a filed report records is report-filed; no event named op-reported was ever emitted'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])op-reported(?![\w-])'
   - id: file-sonar-secrets-keys
     kind: file
     name: KEYS.md
@@ -166,3 +218,51 @@ removed:
     use: 'the examples are analysed on SonarCloud with the SONAR_TOKEN of the runtime secret.env (runtimeSecrets in their services.sonar declaration)'
     since: 1.0.0-alpha.7
     match: 'sonarqube-(?:lite-app|shape-slot|starci-ecommerce-app)-token'
+  - id: vocab-menu-kinds-moved-to-controllers
+    kind: vocabulary
+    name: the menu kinds of the origins the controllers now move
+    use: 'the Job controller enqueues a red node, a stale proof or attempt, the asset leg and the credential ask itself (scripts/kernel/next-moves.mjs); the Kernel menu keeps leg-ready, draw-redraw, seam-duty and move-unbuilt'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:node-rework|stale-redispatch|enqueue-asset-leg|enqueue-credential-ask|rework-node)(?![\w-])'
+  - id: vocab-sonar-stack-sealed-members
+    kind: vocabulary
+    name: ext/sonar secrets custody
+    use: 'the stack secrets are the secret.env variables SONARQUBE_DB_PASSWORD, SONARQUBE_ADMIN_PASSWORD, SONARQUBE_ADMIN_TOKEN and CLOUDFLARE_TUNNEL_TOKEN, passed by starci gate sonar up; ext/sonar tracks no sealed member'
+    since: 1.0.0-alpha.9
+    match: 'ext/sonar/secrets/(?:sonarqube-(?:db|admin|analysis)-(?:password|token)|cloudflare-starci-local-services-tunnel-token)'
+  - id: vocab-ecommerce-sealed-demo-secrets
+    kind: vocabulary
+    name: ecommerce sealed demo secrets
+    use: 'the ecommerce example carries demo-only defaults in its compose files and declares no sealed secret (secrets: [])'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:keycloak|minio)-env(?:\.enc)?(?![\w-])'
+  - id: vocab-handover-step-mechanical-pending
+    kind: vocabulary
+    name: the handover-step menu mode mechanical-pending and its choice rerun-handover-review
+    use: 'the Job controller enqueues handover.review itself when the handover is due or its ask was answered approve or question (next action handover-review, scripts/kernel/handover-move.mjs); the handover-step item holds only the typed routing of a reported defect'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:mechanical-pending|rerun-handover-review)(?![\w-])'
+  - id: vocab-card-delivery-bound
+    kind: vocabulary
+    name: the agent card delivery keys maxInlineChars, fileName and fileDirectory
+    use: 'one bound, one directory and one cleanup serve every card: allocation.promptFile in modules/models/runtimes.yaml (scripts/agent/prompt-file.mjs); a card keeps delivery.mode and delivery.prompt'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:maxInlineChars|fileDirectory)(?![\w-])'
+  - id: vocab-backoff-factor-keys
+    kind: vocabulary
+    name: the growth factor of allocation.dispatchRefusal and of the backoff of modules/reconciler/host.yaml
+    use: 'every backoff is the one retry budget (scripts/lib/retry-budget.mjs), which doubles its interval up to a cap: declare baseMs/capMs or minMs/maxMs only'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:dispatchRefusal|backoff):\s*\{[^}\n]*\bfactor\b'
+  - id: vocab-wake-terminal-bound
+    kind: vocabulary
+    name: the independent wake character bound
+    use: 'allocation.promptFile.maxChars is the terminal bound owned by scripts/agent/prompt-file.mjs'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:allocation\.)?wake\.maxChars|\bwake:\s*\{\s*maxChars\b'
+  - id: vocab-draft-probe-mutations
+    kind: vocabulary
+    name: draft probe mutation fields
+    use: 'probeDraft reads only and returns verdict, draft and sends; a foreign draft receives no keys'
+    since: 1.0.0-alpha.9
+    match: '\b(?:draftProbe|probeDraft)\.(?:restore|restored|removed|after)\b'

package/runtime/modules/models/runtimes.yaml

@@ -93,9 +93,20 @@ allocation:
   # the decision doorbell; still the same turn turnInterruptGraceMs later, the seat is replaced (KERNEL_TURN_OVERDUE,
   # scripts/reconciler/controllers/host.mjs turnStep). A busy turn defers every doorbell and notice (kernel-busy).
   liveness: {activeUnclassifiedMs: 120000, activeStaleMs: 600000, quietMs: 1200000, launchGraceMs: 90000,
-    kernelTurnBudgetMs: 1200000, supervisorTurnBudgetMs: 1800000, turnInterruptGraceMs: 300000}
+    kernelTurnBudgetMs: 1200000, supervisorTurnBudgetMs: 1800000, turnInterruptGraceMs: 300000,
+    # The watchdog's replacement of a Kernel seat runs start-workflow (worktree check, install, Orca launch, attestation): bounded here, under the Host controller's
+    # seats.kernel.timeoutMs that kills the whole watchdog pass. A start that outlives it is killed and recorded kernel-start-failed (start-timeout), never lost silently.
+    kernelStartTimeoutMs: 600000}
   # one local git read over a job's owned paths (scripts/kernel/owned-path-effects.mjs ownedPathEffects, job-artifacts.mjs).
   settleGit: {commandMs: 15000}
+  # prompt-file.mjs owns terminal delivery, wake bounds, file placement and cleanup.
+  promptFile: {maxChars: 2000, ttlMs: 86400000}
+  # opVerbs: the bound of the "your verbs" block of an [Op] prompt (scripts/kernel/op-prompt-verbs.mjs): the starci calls the op's contract names,
+  # each with the flags the contract uses and the required ones, one line per verb. A worker that has the exact call never runs --help
+  # (a measured op spent 15 of its 135 turns on it). `standing` verbs are printed in full by the prompt's own reporting and logging blocks;
+  # `omitGroups` are the verbs of the Kernel and above, which an op's contract names only to say who runs them.
+  opVerbs: {maxVerbs: 20, maxChars: 3000, lineChars: 190, standing: ["kernel report", "kernel log", "kernel op-contract"],
+    omitGroups: [kernel, supervisor, workflow, reconciler]}
   # Typed logs (scripts/kernel/typed-logs.mjs, the ledger's logs table): perJobCap rows a job's own writes
   # may store before one log.truncated row closes them (derived event rows are never capped); dataMaxBytes bounds
   # one row's data after redaction. diff: the caps of a job patch's pre-structured <patch>.json
@@ -187,6 +198,13 @@ allocation:
   # replacement takes over the loop's lock within handoverMs or is stopped. The reconciler engine checks every checkMs; an engine whose
   # revision still differs from the live one that long past minIntervalMs + checkMs + handoverMs is a drift row (scripts/reconciler/drift.mjs).
   selfReload: {minIntervalMs: 300000, handoverMs: 30000, checkMs: 60000, driftGraceMs: 120000}
+  # deploy (scripts/reconciler/runtime-deploy.mjs): a deploy waits up to waitMs, polling every pollMs, for the settles, Critic runs and prepared
+  # decisions in flight to finish; after the engine restart it waits up to verifyMs for the new leader's fresh heartbeat on the new revision. The affected-spec child
+  # may run its declared budget (modules/supervisor/affected-tests.yaml) plus affectedMarginMs before the deploy stops it.
+  deploy: {waitMs: 1800000, pollMs: 5000, verifyMs: 120000, affectedMarginMs: 300000}
+  # dispatchRefusal (scripts/kernel/dispatch-refusal-memo.mjs): a ready job whose dispatch is refused for the same cause is tried again after baseMs, then twice as long each time (the one retry budget), up to capMs; a change of
+  # the cause's fingerprint (runtime revision, a ruling, a resource the refusal names) tries it at once.
+  dispatchRefusal: {baseMs: 60000, capMs: 900000}
   # footprint (scripts/guards/footprint-scan.mjs): one host-wide scan at most every everyMs; a crashed
   # tick's claim lock is cleared after lockStaleMs.
   footprint: {everyMs: 600000, lockStaleMs: 60000}
@@ -194,12 +212,15 @@ allocation:
   jobGuard: {ttlMs: 604800000}
   # landGate (scripts/supervisor/land.mjs): a land waits waitMs for its turn at the gate; its spec run may take
   # specsBaseMs plus perSpecMs for every spec it runs, specConcurrency spec files at a time.
-  landGate: {waitMs: 1800000, specsBaseMs: 600000, perSpecMs: 60000, specConcurrency: 6}
+  landGate: {waitMs: 1800000, specsBaseMs: 600000, perSpecMs: 60000, specConcurrency: 6, cliVerbs: 12}
   # workerClose (scripts/machine/worker-close.mjs; owner rule: a finished worker is closed COMPLETELY): after worker-release and the terminal
   # close the runtime waits verifyMs for every process of that terminal's shell tree to end (polled every pollMs); a survivor proven to belong
   # to the tree is stopped and given stopVerifyMs to end before the finding is raised.
   # A finished [Worker] job whose terminal has no recorded closure is closed again by the Job controller's worker sweep (scripts/supervisor/supervisor-watchdog.mjs):
   # every leftoverRetryMs (doubling to leftoverRetryMaxMs) for at most leftoverRetryAttempts attempts, each failure recorded with its reason on the job.
+  # uatSlot (scripts/uat/slot-collect.mjs, slot-lessee.mjs): a held UAT run checks its lessee (its attempt, the process that launched it) every watchMs and ends with it;
+  # the Host pass ends a slot whose lessee is gone, and a slot that recorded no lessee at all once it has been held unknownHoldMs (3 hours: a UAT run is minutes).
+  uatSlot: {watchMs: 5000, unknownHoldMs: 10800000}
   workerClose: {verifyMs: 10000, pollMs: 1000, stopVerifyMs: 5000, leftoverRetryMs: 60000, leftoverRetryMaxMs: 900000, leftoverRetryAttempts: 12}
   # providerReservation (scripts/machine/provider-reservation-reap.mjs): an admission whose receipt stayed `reserved` this long never reached
   # worker-start (the consume moves it to `launching` first), so its launcher died and the slot is released. A receipt with no terminal handle and no
@@ -238,20 +259,26 @@ allocation:
   quitAgent: {waitMs: 6000}
   # drawRender (scripts/work/draw-render.mjs): a capture waits settleMs after document.fonts.ready.
   drawRender: {settleMs: 500}
+  # layoutRender (scripts/work/layout-render.mjs): the runtime serves the product app for one capture; readyMs is how long the dev server may take to answer
+  # its first request (a cold Next compile), navigateMs the page load, settleMs the wait after fonts are ready, stopMs the grace before a still-running server is killed.
+  # publicOriginKeys are the scaffold's public-origin variables (its README: the product app's own address and the product app the landing hands over to); each gets the render's origin.
+  layoutRender: {readyMs: 180000, navigateMs: 90000, settleMs: 500, stopMs: 5000, publicOriginKeys: [NEXT_PUBLIC_SITE_URL, NEXT_PUBLIC_APP_URL]}
   # drawLoop (scripts/work/draw-loop.mjs, scripts/work/draw/draw-taste.mjs; owner rulings 2026-09-27): interface.draw
   # draws -> shoots -> evaluates -> fixes in rounds. A loop stops when every machine metric passes and the
   # independent critic's beauty is at least beautyMin, after maxRounds, or after stallRounds rounds in a row that
   # neither cut the failures nor raised the beauty; the best round is kept. Taste thresholds: accentBudget is the
   # largest share of the render the accent colour may fill (the brand art band excluded), bandsPerCardMax the most
   # hairline bands one card splits into, badgesPerEntityMax the most badges one entity carries. critic is the fresh,
-  # context-free Orca worker that scores beauty and hierarchy against the product's brand.direction rubric: started
+  # context-free Orca worker that scores beauty and hierarchy against the product's brand.direction rubric: picked through
+  # the tier picker from the Critic tier (modules/models/tiers.yaml seats.critic, modules/kernel/critic.yaml) with the
+  # independence rule as a hard filter, then started
   # through orchestration worker-start --agent <provider> --model --effort (scripts/agent/lib.mjs startAgent) on a
   # runtime worktree detached at the empty tree (draw-critic.mjs criticWorkspace; Orca refuses a bare temp dir) holding only the PNGs, the HTML and the rubric; it writes verdict.json and reports worker_done; a
-  # critic with no worker_done within timeoutMs is stopped and released (outcome timeout, no beauty). The critic is a DIFFERENT model from the drawer: a Codex drawer (the high tier's second member)
-  # is judged by criticWhenDrawer.codex; for any other drawer the critic is Codex. The images a drawer asks of the imagegen call
-  # (starci work imagegen) do not make the call's model the drawer. When the drawer (the op's provider, bound to its
-  # terminal - scripts/guards/op-context.mjs - or draw-loop.mjs round --drawer) is the critic's provider the round is
-  # judged by criticWhenDrawer.<drawer> instead, and a round with no independent critic has no beauty. directionPrerequisite: interface.draw needs an ACCEPTED brand.direction
+  # critic with no worker_done within criticTimeoutMs is stopped and released (outcome timeout, no beauty). The critic is a member of ANOTHER PROVIDER than
+  # the drawer: the members of its tier of that provider are removed before the pick, and a tier with no other provider's member refuses the critique with
+  # CRITIC_NO_INDEPENDENT_MEMBER (the drawer never judges itself). The images a drawer asks of the imagegen call
+  # (starci work imagegen) do not make the call's model the drawer. The drawer is the op's provider, bound to its
+  # terminal (scripts/guards/op-context.mjs) or named by draw-loop.mjs round --drawer; a round with no independent critic has no beauty. directionPrerequisite: interface.draw needs an ACCEPTED brand.direction
   # archetype for its ui record's ui.archetype - brand.mjs checkDirection evidence.ready, the owner's receipt
   # (scripts/kernel/prerequisites.mjs direction-unaccepted; the Kernel enqueues brand.decide --param
   # directionArchetype=<archetype> first). false switches the gate off.
@@ -262,9 +289,7 @@ allocation:
     accentBudget: 0.10
     bandsPerCardMax: 3
     badgesPerEntityMax: 2
-    critic: {provider: codex, model: gpt-6.1-sol, effort: high, timeoutMs: 900000}
-    criticWhenDrawer:
-      codex: {provider: claude, model: claude-opus-5-5, effort: high, timeoutMs: 900000}
+    criticTimeoutMs: 900000
     directionPrerequisite: true
     # How long the workflow that claimed foundation `shell` (the layout chain an interface.draw draws) may hold it before a
     # waiting draw opens a Supervisor Decision Item (scripts/kernel/shell-foundation.mjs; owner ruling 2026-09-29 draw-from-todo).
@@ -303,8 +328,8 @@ allocation:
   # reportWindowMs.
   workerJobs: {leaseTtlMs: 604800000, reportWindowMs: 604800000}
   # draft (scripts/kernel/clear-draft.mjs): the beat between one Ctrl+U and the re-read that judges
-  # the input box's answer - a TUI repaints a beat later. clearDraft and probeDraft default to it and
-  # the wake-delivery draft probe caps its own interval at it.
+  # the input box's answer - a TUI repaints a beat later. clearDraft defaults to it and
+  # wake-delivery caps its runtime-owned draft clear interval at it.
   draft: {intervalMs: 300}
   # housekeeping (scripts/housekeeping/housekeeping.mjs): every retention window and root the host
   # cleanup reads - no literal may live in the script. tmp: top-level %TEMP% entries whose name starts

package/runtime/modules/models/tiers.yaml

@@ -28,6 +28,7 @@ seats:
   kernelManager: frontier
   kernel: high
   worker: high
+  critic: frontier
 # The kernel's own model calls (selection.yaml kernelFunctionKinds) take the tier of their seat.
 kindSeats:
   model.assessGoal: planner

package/runtime/scripts/hfs/architecture/index.mjs

@@ -14,7 +14,7 @@ import { buildHfsGraph } from './hfs-graph.mjs';
 import { checkTiers, TIER_RULE_IDS } from './tiers.mjs';
 import { checkReachability, REACHABILITY_RULE_IDS } from './reachability.mjs';
 import { checkDeadExports, DEAD_EXPORT_RULE_IDS } from './dead-exports.mjs';
-import { checkRequiredFiles, REQUIRED_FILE_RULE_IDS } from './required-files.mjs';
+import { checkRequiredFiles, REQUIRED_FILE_RULE_IDS, withTreeCache } from './required-files.mjs';
 import { checkClones, CLONE_RULE_IDS } from './clones.mjs';
 import { checkSymbols, SYMBOL_RULE_IDS } from './symbols.mjs';
 import { checkConnectionMap, CONNECTION_RULE_IDS } from './connection-map.mjs';
@@ -321,7 +321,11 @@ function scopeFindings({ config, context, violations, paths, surface }) {
  * Check a target repository. injectedTypeScript exists only for hermetic rule fixtures. `fast` leaves out the checks
  * that read the whole repository to answer (clones, dead exports, repository-wide symbols); the pre-push check of the changed owners uses it.
  */
-export function checkArchitecture({ repositoryRoot, injectedTypeScript, paths = [], base, fast = false, hfs: openedHfs, surface = 'all' } = {}) {
+export function checkArchitecture(options = {}) {
+  return withTreeCache(() => checkArchitectureOnce(options));
+}
+
+function checkArchitectureOnce({ repositoryRoot, injectedTypeScript, paths = [], base, fast = false, hfs: openedHfs, surface = 'all' }) {
   if (!['all', 'lint', 'check'].includes(surface)) throw new Error(`unknown surface ${surface}`);
   let config;
   try {

package/runtime/scripts/hfs/architecture/required-files.mjs

@@ -49,8 +49,20 @@ function diskFiles(root, relative = '') {
   return out;
 }
 
-/** The repository tree as file and directory sets over posix relatives. */
-export function treeOf(root) {
+let runTrees = null;
+
+/** Runs `run` with one tree read per root: every checker of one machine run shares the repository listing instead of spawning git again. */
+export function withTreeCache(run) {
+  const outer = runTrees;
+  runTrees = outer ?? new Map();
+  try {
+    return run();
+  } finally {
+    runTrees = outer;
+  }
+}
+
+function readTree(root) {
   const list = gitFiles(root) ?? diskFiles(root);
   const files = new Set(list);
   const directories = new Set();
@@ -61,6 +73,13 @@ export function treeOf(root) {
   return { files, directories };
 }
 
+/** The repository tree as file and directory sets over posix relatives. */
+export function treeOf(root) {
+  if (!runTrees) return readTree(root);
+  if (!runTrees.has(root)) runTrees.set(root, readTree(root));
+  return runTrees.get(root);
+}
+
 /**
  * The prelude every tree-walking architecture checker shares: the input's config/graph/context, the compiler,
  * the slot resolver and the tracked repository tree.

package/runtime/scripts/hfs/catalog-once.mjs

@@ -0,0 +1,15 @@
+import fs from 'node:fs';
+import { parseYaml } from '../../engine/yaml.mjs';
+
+const parsed = new Map();
+
+/** The parsed YAML catalog at `file`; the megabyte of text is parsed once per file state (path, size, mtime), not once per check. */
+export function readCatalogOnce(file) {
+  const { size, mtimeMs } = fs.statSync(file);
+  const key = `${file}|${size}|${mtimeMs}`;
+  if (!parsed.has(key)) {
+    parsed.clear();
+    parsed.set(key, parseYaml(fs.readFileSync(file, 'utf8')));
+  }
+  return parsed.get(key);
+}

package/runtime/scripts/hfs/check.mjs

@@ -57,6 +57,7 @@ import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
 import { ARCHITECTURE_RULE_IDS, checkArchitecture } from './architecture/index.mjs';
 import { parseYaml } from '../../engine/yaml.mjs';
+import { readCatalogOnce } from './catalog-once.mjs';
 import { APP_SCOPE, HFS_DECLARATION_FILE, appRelativeMessages, HfsSlotsError, SIDES, createSlotResolver, loadRuleCatalog, loadSlotManifest, readRepoDeclaration, resolveRepoDeclaration } from './slots.mjs';
 import { RUNTIME_KIND } from './manifest-shape.mjs';
 import { lsFiles } from '../api/git/ls-files.mjs';
@@ -114,7 +115,7 @@ const refuse = (code, message, details = {}) => { throw new HfsSlotsError(code,
 
 /** {code: {title, title_vi, meaning_vi, nextStep_vi}} for the codes asked for, read from the failure-code catalog under `root`. */
 export function readWhy(root = skillRoot, codes = CHECK_CODES) {
-  const catalog = parseYaml(fs.readFileSync(path.join(root, FAILURE_CODES_FILE), 'utf8'));
+  const catalog = readCatalogOnce(path.join(root, FAILURE_CODES_FILE));
   const why = {};
   for (const code of codes) {
     const entry = catalog?.[code];

package/runtime/scripts/hfs/repo-identity.mjs

@@ -14,14 +14,28 @@ const real = (p) => { try { return fs.realpathSync(p); } catch { return path.res
 const GIT_SUFFIX_SOURCE = String.raw`\.git$`;
 const GIT_SUFFIX = new RegExp(GIT_SUFFIX_SOURCE, 'iu');
 
+// The identity of a folder that has its own .git entry holds while that entry is the same file system object (same inode, same modification time), so a
+// process asks Git once per such folder state instead of at every check. A folder with no .git entry of its own is asked every time.
+const known = new Map();
+const stateOf = (root) => { try { const stat = fs.statSync(path.join(root, '.git')); return `${real(root)}|${stat.ino}|${stat.mtimeMs}`; } catch { return null; } };
+
 /** { repositoryRoot, inWorkTree, home } for `root`: home is the main checkout folder when root is a repository top level. */
 function identityOf(root) {
+  const state = stateOf(root);
+  if (state === null) return askGit(root);
+  if (!known.has(state)) known.set(state, askGit(root));
+  return known.get(state);
+}
+
+function askGit(root) {
   let inWorkTree = false, repositoryRoot = false, home = null;
   try {
     // Identity comes from Git only when root IS a repository (or worktree) top level, never a folder inside one.
-    repositoryRoot = real(git(revParseQuery, root, ['--show-toplevel'])) === real(root);
+    // One git call answers both questions: the top level on the first line, the common git dir on the second.
+    const [top, commonDir] = git(revParseQuery, root, ['--show-toplevel', '--git-common-dir']).split(String.fromCodePoint(10)).map((line) => line.trim());
+    repositoryRoot = real(top) === real(root);
     inWorkTree = true;
-    const common = path.resolve(root, git(revParseQuery, root, ['--git-common-dir']));
+    const common = path.resolve(root, commonDir);
     if (repositoryRoot && path.basename(common) === '.git') home = path.dirname(common);
   } catch { /* Not a Git work tree; the caller falls back to the folder and package name. */ }
   return { inWorkTree, repositoryRoot, home };

package/runtime/scripts/hfs/rule-catalog.mjs

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
-import { parseYaml } from '../../engine/yaml.mjs';
+import { parseYamlCached } from '../lib/yaml-cached.mjs';
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { SEMVER } from './manifest-shape.mjs';
 import { enforcerJudgedInEdition, judgedInEdition, ruleEditionProblems } from './edition-slots.mjs';
@@ -153,7 +153,7 @@ const deepFreeze = (value) => { if (value && typeof value === 'object') { Object
  */
 export function loadRuleCatalog({ root = skillRoot, file = path.join(root, HFS_RULES_FILE), text, manifest } = {}) {
   let doc;
-  try { doc = parseYaml(text ?? fs.readFileSync(file, 'utf8')); } catch (error) { fail('HFS_RULES_INVALID', `the rule catalog cannot be read (${String(error?.message ?? error).split('\n')[0]})`, { file }); }
+  try { doc = parseYamlCached(text ?? fs.readFileSync(file, 'utf8')); } catch (error) { fail('HFS_RULES_INVALID', `the rule catalog cannot be read (${String(error?.message ?? error).split('\n')[0]})`, { file }); }
   const problems = ruleCatalogProblems(doc);
   if (problems.length) { fail('HFS_RULES_INVALID', `the rule catalog breaks its schema: ${problems.slice(0, 5).join('; ')}${problems.length > 5 ? '; and ' + (problems.length - 5) + ' more' : ''}`, { file, problems }); }
   const [major, minor, patch] = doc.version.split('.').map(Number);

package/runtime/scripts/hfs/slots.mjs

@@ -21,7 +21,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
-import { parseYaml } from '../../engine/yaml.mjs';
+import { parseYamlCached } from '../lib/yaml-cached.mjs';
 import { braceVariants } from '../lib/glob.mjs';
 import { APP_KIND, RUNTIME_KIND, manifestKind } from './manifest-shape.mjs';
 import { APP_SCOPE, manifestShapeProblems, PROFILES } from './slot-manifest-shape.mjs';
@@ -73,7 +73,7 @@ export function appRelativeMessages(side, sideRoot) {
  */
 export function loadSlotManifest({ root = skillRoot, file = path.join(root, HFS_MANIFEST_FILE), text } = {}) {
   let doc;
-  try { doc = parseYaml(text ?? fs.readFileSync(file, 'utf8')); } catch (error) { fail('HFS_MANIFEST_INVALID', `the slot manifest cannot be read (${String(error?.message ?? error).split('\n')[0]})`, { file }); }
+  try { doc = parseYamlCached(text ?? fs.readFileSync(file, 'utf8')); } catch (error) { fail('HFS_MANIFEST_INVALID', `the slot manifest cannot be read (${String(error?.message ?? error).split('\n')[0]})`, { file }); }
   const problems = manifestShapeProblems(doc);
   if (!problems.length) problems.push(...manifestSemanticProblems(doc, { varsOf, braceVariants, compileVariant }));
   if (problems.length) fail('HFS_MANIFEST_INVALID', `the slot manifest breaks its schema: ${problems.slice(0, 5).join('; ')}${problems.length > 5 ? '; and ' + (problems.length - 5) + ' more' : ''}`, { file, problems });

package/runtime/scripts/lib/env.mjs

@@ -8,3 +8,13 @@ export const readEnv = (name, env = process.env) => env[name];
 
 /** True when `env` (default: the process environment) belongs to a spec run (`node --test` marks its children with NODE_TEST_CONTEXT). */
 export const isSpecRun = (env = process.env) => Boolean(env.NODE_TEST_CONTEXT);
+
+/**
+ * The environment for a child that is itself a test runner: `env` without the mark of an enclosing spec run. A `node --test` that inherits NODE_TEST_CONTEXT believes it is a
+ * subtest of that run: it reports to its parent and exits 0 whatever its tests did, so a verb that runs specs as a child (starci test affected, the land gate, the release cut, the
+ * suite) would pass red specs from inside a test process. The runner marks the spec files it starts itself, so isSpecRun stays true inside them.
+ */
+export function withoutTestRunner(env = process.env) {
+  const { NODE_TEST_CONTEXT: _enclosing, ...rest } = env;
+  return rest;
+}

package/runtime/scripts/lib/yaml-cached.mjs

@@ -0,0 +1,14 @@
+// yaml-cached.mjs - parse a YAML text once per distinct text in a process.
+//
+// The HFS slot manifest and rule catalog are large documents that one process asks for again at every check, every render and every fixture. Their
+// bytes do not change between those asks, so the parse (the dominant cost of a load) is keyed by the text itself; each caller gets its own copy of the
+// parsed document, so nothing a caller does to it reaches the next one. A changed file is a different text and parses again.
+import { parseYaml } from '../../engine/yaml.mjs';
+
+const parsed = new Map();
+
+/** The parsed document of `text`: parsed on the first ask for this text, a structured copy afterwards. Throws what parseYaml throws, every time. */
+export function parseYamlCached(text) {
+  if (!parsed.has(text)) parsed.set(text, parseYaml(text));
+  return structuredClone(parsed.get(text));
+}