@starci/hfs 4.10.0 → 4.11.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 4.11.0 - 2026-10-29
+
+Breaking for lite apps (rulings lite-official-postgres-image and lite-queue-bullmq; the move is contexts/project/lite.md "Moving an app off Supabase").
+
+- Changed: the lite db service runs the Docker Official `postgres` image. `starci app sync --write` writes the managed `db/Dockerfile` (slot `app.db.image`, templates/app/db-image): `FROM postgres:17.11@sha256:31ba9c94…b08f` (sync `DB_BASE_IMAGE`) plus `postgresql-17-pgvector=0.8.7-1.pgdg13+1` from PGDG (`PGVECTOR_PACKAGE`), nothing else. The managed db scripts gain `db:image` (`docker build --tag <project>-db:local db`) and `db:create` builds it first; the lite skeleton's stack runs `{{project}}/db` for its db component and service, deploys it as `deploy.images.db: {app: db}` (`starci app stack build` and the managed `images.yml` and `stack-deploy.yml` build `db/Dockerfile` for it, `db/image.mjs`); `starci app db drift` builds `db/Dockerfile` for its scratch database (`DB_DRIFT_NO_IMAGE` without one) instead of reading `components.db.image`. `DB_IMAGE` (supabase/postgres) is removed.
+- Changed: `db/bootstrap.sql` keeps the NOLOGIN browser roles and the auth and storage stubs and no longer creates the `extensions` schema or the `supabase_realtime` publication; it applies green, twice, on the official image.
+- Changed: R276 refuses every PostgreSQL or Mongo image in a lite stack (`isLiteDatabaseImage` is removed): the db component runs the app's own db image; `DB_EXTENSION_ALLOWED` (R259) defaults to pgcrypto, pg_trgm, vector, uuid-ossp, unaccent and btree_gist.
+- Added: the lite tick scheduler (R335, BE-JOBS-6). `starci app add job` in lite writes `platform/jobs/job-ticks.contracts.ts` (`JOB_TICKS`, empty), `job-tick.service.ts` (`JobTickService`: one `CronJob` per tick in `SchedulerRegistry`; each firing takes `advisoryXactLock(tx, "tick:<name>")`, claims the tick's UTC minute through `job_tick_claim` and only then writes the queue outbox) and its spec, a lite `jobs.module.ts` composing `ScheduleModule.forRoot()`, the `job_ticks` table and `job_tick_claim` function in the jobs migration, and pins `@nestjs/schedule` and `cron` in the app's package.json; `JobsLogEvent.TickFailed`; `job_tick_claim` joins the canon `ruleParams.be.dbFunctions`. The bundled lite pattern knowledge (queues, jobs, idempotency, realtime) names the tick instead of pg_cron, and the failure-code catalog carries `BE_JOBS_SCHEDULER_OWNER`.
+- Changed: the bundled slot manifest 3.11.0 adds the managed lite slot `app.db.image` (`db/Dockerfile`), narrows `ruleParams.db.extensions` to what the official postgres image plus pgvector carries (pgcrypto, pg_trgm, vector, uuid-ossp, unaccent, btree_gist; no pgmq, pg_cron, pg_net or supabase_vault) and gives `@nestjs/schedule` and `cron` one owner, `platform/jobs`, in `infraOwners`; the bundled rule catalog adds R335 `BE_JOBS_SCHEDULER_OWNER` and its R250 and R276 laws name the platform/jobs tick and the db image; the bundled canon pins name hfs 4.11.0, eslint-canon-be 3.8.0, eslint-canon-fe 9.5.2 and the Grammar family 0.15.13 and pin `@nestjs/schedule` 6.1.3 (CommonJS on the Nest 11 line) and `cron` 4.4.0.
+- Fixed: `starci app db baseline` judges the archive (`db/migrations/archive/`) as frozen history (R257): an archived file needs only its leading 14-digit stamp and an underscore, so a retired chain's snake_case names, impossible times (`20261014300000`) and shared stamps no longer refuse the cutover. The active chain keeps R213 in full (`<ts14>_<kebab>.sql` with a valid UTC stamp); R213 and R332 set no upper bound, so an active stamp after now is no breach. A file both active and archived is refused by name. The new version sorts after every archived and active file, and the baseline header names the last valid stamp, the boundary R257 judges.
+- Fixed: a refusal over the migration chain lists every offender as `<file>: <reason> (<rule>)`, all at once: a misnamed or invalid-time active file (`db baseline`, `db restamp`, `db plan`), and for `db baseline` the `--stamp` boundary file, the committed-history findings (R257), the queue and cron findings (R258) and each active migration a schema-only dump cannot rebuild. Spec: `src/hfs-database-baseline.spec.mjs`.
+
+
+## 4.10.1 - 2026-10-29
+
+- Changed: the bundled slot manifest 3.10.0 adds the lite slot `be.platform.database.entities`, the entity registry (slot fields `role: entity-registry` and `importedBy`, validated by the manifest shape); the bundled architecture machine reads it (`architecture/entity-registry.mjs`): `tier-direction` (R26 `BE_TIER_DIRECTION`) admits the registry's import of a domain or platform capability's `index.ts` that binds only that capability's `<c>Entities`, and `owner-export-bypass` (R30 `ARCH_OWNER_EXPORT_BYPASS`) admits a direct import of the registry from the files `importedBy` names (`apps/*/src/compose/*.ts`, `apps/*/src/app.module.ts`, `src/tests/world/**`); every other import of either shape stays refused, and full has no registry; the bundled canon pins name hfs 4.10.1, eslint-canon-be 3.7.1, eslint-canon-fe 9.5.1 and the Grammar family 0.15.12; the lite skeleton's `platform/database/entities.ts` names its importers (app composition and the test world).
+- Changed: the bundled architecture machine: the owner-cycle check (R27 `ARCH_OWNER_CYCLE`) counts the entity registry as a unit of its own, not part of `platform/database`, so naming every `<c>Entities` closes no cycle among capabilities while any other platform/database file importing a domain still does; the bundled rule catalog's R26 and R30 laws name the entity registry.
+
 ## 4.10.0 - 2026-10-29
 
 Breaking for lite apps (ruling lite-self-hosted-postgres-passport-minio; the migration note is contexts/project/lite.md "Moving an app off Supabase").

package/db/drift.mjs

@@ -2,8 +2,8 @@
 // The migrations (db/migrations/*.sql, after db/bootstrap.sql when present) are the only DDL and `synchronize` is false, so an entity only
 // maps tables that already exist and can drift from them. The verb builds TypeORM's metadata from the app's entity list
 // (be/src/modules/platform/database/entities.ts, compiled in-process with the app's own typescript and loaded with the app's own typeorm) through a
-// DataSource that never connects, applies the migrations to a scratch database (a throwaway container of the image the app's
-// .starcistacks declares for its db component, or the empty database named by --url-env), reads that schema from
+// DataSource that never connects, applies the migrations to a scratch database (a throwaway container of the image the app's managed
+// db/Dockerfile builds, or the empty database named by --url-env), reads that schema from
 // information_schema.columns and pg_catalog, and reports every entity column whose table or column is missing, whose type differs (both
 // normalised to PostgreSQL's format_type names) or whose nullability differs, under BE_ENTITY_SCHEMA_DRIFT. Database columns no entity maps
 // are fine. Exit 0 is green, 1 is drift (or a migration that does not apply to an empty database), 2 is a refusal: no verdict, which is
@@ -12,10 +12,11 @@ import fs from 'node:fs';
 import path from 'node:path';
 import Module, { createRequire } from 'node:module';
 import { randomBytes } from 'node:crypto';
-import { runVerb, readDeclaration } from '../release/index.mjs';
+import { runVerb } from '../release/index.mjs';
 import { failure, refusal } from '../stack/errors.mjs';
 import { firstLine, tool } from '../stack/context.mjs';
 import { ENTITY_LIST, hasEntityList } from './entity-list.mjs';
+import { DB_DOCKERFILE } from './image.mjs';
 
 export const DRIFT_CODE = 'BE_ENTITY_SCHEMA_DRIFT';
 export const MIGRATIONS_DIR = 'db/migrations';
@@ -141,27 +142,27 @@ export function migrationFiles(root) {
   return [...(fs.existsSync(path.join(root, BOOTSTRAP_FILE)) ? [BOOTSTRAP_FILE] : []), ...migrations];
 }
 
-/** The image of the app's db component (.starcistacks/application-stacks.yaml components.db.image), the one the scratch container runs. */
-export function scratchImage(root) {
-  const image = readDeclaration(root)?.components?.db?.image;
-  if (typeof image !== 'string' || image.trim() === '') throw refusal('DB_DRIFT_NO_IMAGE', 'declare components.db.image in .starcistacks/application-stacks.yaml (the scratch database runs the app\'s own db image) or pass --url-env');
-  return image.trim();
-}
-
-/** Starts a throwaway container of `image` on a loopback port; returns { connection, stop }. Docker missing or failing is no verdict. */
-function startScratch(ctx, image) {
+/**
+ * Builds the app's db image from db/Dockerfile and starts a throwaway container of it on a loopback port; returns { connection, stop }.
+ * Docker missing or failing is no verdict; an app without db/Dockerfile is refused (sync writes it).
+ */
+function startScratch(ctx, root) {
+  if (!fs.existsSync(path.join(root, DB_DOCKERFILE))) throw refusal('DB_DRIFT_NO_IMAGE', `${DB_DOCKERFILE} is missing: run "npx starci app sync --write" (the scratch database runs the app's own db image) or pass --url-env`);
   const docker = (args, env) => tool(ctx, 'docker', args, { env: { ...ctx.env, ...env } });
   const probe = docker(['version', '--format', '{{.Server.Version}}']);
   if (probe.error || probe.status !== 0) throw needsDatabase('Docker is not available on this host; start it, or pass --url-env naming an empty database');
+  const build = docker(['build', '--quiet', '--file', path.join(root, DB_DOCKERFILE), path.join(root, 'db')]);
+  const image = /sha256:[a-f0-9]{64}/u.exec(String(build.stdout ?? ''))?.[0];
+  if (build.status !== 0 || !image) throw needsDatabase(`docker could not build ${DB_DOCKERFILE}: ${firstLine(build.stderr)}`);
   const password = randomBytes(18).toString('hex');
   const name = `starci-db-drift-${randomBytes(6).toString('hex')}`;
   const run = docker(['run', '-d', '--rm', '--name', name, '--label', 'starci.db-drift=1', '-e', 'POSTGRES_PASSWORD', '-p', '127.0.0.1::5432', image], { POSTGRES_PASSWORD: password });
   const stop = () => { docker(['rm', '-f', name]); };
-  if (run.status !== 0) { stop(); throw needsDatabase(`docker could not start ${image}: ${firstLine(run.stderr)}`); }
+  if (run.status !== 0) { stop(); throw needsDatabase(`docker could not start the image of ${DB_DOCKERFILE}: ${firstLine(run.stderr)}`); }
   const port = docker(['port', name, '5432/tcp']);
   const match = /:(\d+)\s*$/mu.exec(String(port.stdout ?? '').split('\n')[0]);
   if (port.status !== 0 || !match) { stop(); throw needsDatabase('docker published no port for the scratch database'); }
-  return { connection: { host: '127.0.0.1', port: Number(match[1]), user: 'postgres', password, database: 'postgres' }, stop, how: `scratch container of ${image}` };
+  return { connection: { host: '127.0.0.1', port: Number(match[1]), user: 'postgres', password, database: 'postgres' }, stop, how: `scratch container of the image ${DB_DOCKERFILE} builds` };
 }
 
 /** Connects with the app's pg, retrying while a fresh container is still initialising; gives up after READY_TIMEOUT_MS. */
@@ -200,7 +201,7 @@ export async function migratedSchema(ctx, appRoot, { urlEnv } = {}) {
     if (typeof value !== 'string' || !/^postgres(?:ql)?:\/\//u.test(value)) throw needsDatabase(`${urlEnv} holds no postgres connection URL`);
     secrets = [value];
     scratch = { connection: { connectionString: value }, stop: () => {}, how: `the database ${urlEnv} names` };
-  } else scratch = startScratch(ctx, scratchImage(root));
+  } else scratch = startScratch(ctx, root);
   const scrub = (text) => secrets.reduce((out, secret) => out.replaceAll(secret, '[value]'), String(text));
   let client;
   try {

package/db/image.mjs

@@ -0,0 +1,8 @@
+// image.mjs - the one name of a lite app's db image (slot app.db.image, ruling:lite-official-postgres-image): the managed db/Dockerfile
+// builds it, `deploy.images.db` of .starcistacks/application-stacks.yaml names it as app `db`, and the stack build, the images and
+// stack-deploy workflows, the local db container and the drift scratch database all build that one file.
+
+/** The image app name a deploy block gives the db service. */
+export const DB_IMAGE_APP = 'db';
+/** The managed Dockerfile of the db image, app-relative. */
+export const DB_DOCKERFILE = 'db/Dockerfile';

package/db/postgres.mjs

@@ -6,7 +6,7 @@ import { firstLine, tool } from '../stack/context.mjs';
 
 /** The default environment variable that names the app's database. */
 export const DEFAULT_DB_URL_ENV = 'DATABASE_URL';
-/** The history table `starci app db migrate` records applied migrations in (the layout the supabase/postgres image already ships). */
+/** The history table `starci app db migrate` records applied migrations in (Supabase's layout, so a history restored from a hosted Supabase carries over; migrate creates it on an empty database). */
 export const HISTORY_TABLE = 'supabase_migrations.schema_migrations';
 
 const KEY = /^[A-Z][A-Z0-9_]*$/u;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.10.0",
+  "version": "4.11.0",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.11
+    version: 0.15.13
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.7.0
+    version: 3.8.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.5.0
+    version: 9.5.2
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.11
+    version: 0.15.13
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.11
+    version: 0.15.13
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.10.0
+    version: 4.11.0
     group: starci
     install: registry
     side: both
@@ -600,6 +600,16 @@ pins:
     group: framework
     side: be
     why: 'PassportStrategy of integrations/passport; 11.0.5 is CommonJS on the Nest 11 line (12.0.0 is ESM-only and breaks Nest 11 jest under the CommonJS transform of @starci/jest-preset), as nivo-lite runs it.'
+  '@nestjs/schedule':
+    version: 6.1.3
+    group: framework
+    side: be
+    why: 'the tick scheduler of platform/jobs, the one owner that imports it (R335, ruling lite-official-postgres-image); 6.1.3 is CommonJS on the Nest 11 line (12.x is ESM-only and breaks Nest 11 jest under the CommonJS transform of @starci/jest-preset).'
+  cron:
+    version: 4.4.0
+    group: framework
+    side: be
+    why: 'CronJob of the platform/jobs tick scheduler; the exact version @nestjs/schedule 6.1.3 depends on, so one cron is installed.'
   passport:
     version: 0.7.0
     group: framework

package/runtime/knowledge/hfs/rules.yaml

@@ -474,7 +474,7 @@ rules:
     witness:
       - {path: packages/eslint/be/legacy-owner-graph.a16.spec.mjs, editions: [lite, full]}
     templateNa: "Tier and package direction are constraints on cross-owner import graphs; no dedicated cross-owner graph scaffold is generated."
-    law: "The tier direction matrix; a shared package never imports an app. Front-end page and layout owners may import overlay entries; every other cross-owner feature-to-feature edge is forbidden, including layout-to-page and overlay-to-overlay. Components never import overlays."
+    law: "The tier direction matrix; a shared package never imports an app. Front-end page and layout owners may import overlay entries; every other cross-owner feature-to-feature edge is forbidden, including layout-to-page and overlay-to-overlay. Components never import overlays. The one platform-to-domain edge is the lite entity registry (be.platform.database.entities) importing a capability's `<c>Entities` alone from its `index.ts`."
     kinds: [lint, design]
     gates: [settle, land, ci]
     failureCodes: ["BE_TIER_DIRECTION", "FE_TIER_DIRECTION", "ARCH_PACKAGE_IMPORTS_APP"]
@@ -541,7 +541,7 @@ rules:
       - {path: packages/eslint/be/a16-r29-r31.spec.mjs, edition: full}
   - id: R30
     code: "BE_PUBLIC_SURFACE"
-    law: "Every owner has one `index.ts`; cross-owner imports use it, same-owner imports are relative and never go through it; it holds only named `export { }` lines, no `export *`, no alias re-export (`export { X as Y }`, `export const Y = X`, `export type Y = X`, `export interface Y extends X {}`: one declaration has one name), within the owner slot's `indexExports` budget (60 for domain and feature owners, 80 for `be.integrations` provider entries); cross-package imports use the package name and a declared export."
+    law: "Every owner has one `index.ts`; cross-owner imports use it, except the lite entity registry, reached by deep path only from the files its slot's `importedBy` names; same-owner imports are relative and never go through it; it holds only named `export { }` lines, no `export *`, no alias re-export (`export { X as Y }`, `export const Y = X`, `export type Y = X`, `export interface Y extends X {}`: one declaration has one name), within the owner slot's `indexExports` budget (60 for domain and feature owners, 80 for `be.integrations` provider entries); cross-package imports use the package name and a declared export."
     kinds: [lint, codemod]
     gates: [settle, land, ci]
     failureCodes: ["BE_PUBLIC_SURFACE", "ARCH_OWNER_EXPORT_BYPASS", "ARCH_OWNER_EXPORT_STAR", "HFS_ALIAS_REEXPORT", "ARCH_PACKAGE_EXPORT_BYPASS"]
@@ -4176,7 +4176,7 @@ rules:
     editions: [lite, full]
     docs:
       - {path: docs/application-stacks.md#r250-deploy-scan, editions: [lite, full]}
-    law: "In lite and full apps, scheduled work belongs to the back-end queue scheduler, a pg_cron tick that enqueues through the queue outbox or a declared replicated-job. Deployment files, scripts, workflows, compose files and Dockerfiles install no host crontab, cron.d entry, systemd timer, @reboot job or at job; a workflow does not schedule app work. Docker compose up, down and pull run only against an explicitly dev environment. Deploy shell scripts delegate to docker, starci or the app CLI, and contain no node -e, psql, inline SQL or downloaded shell logic."
+    law: "In lite and full apps, scheduled work belongs to the back-end queue scheduler, a platform/jobs tick (R335) that enqueues through the queue outbox or a declared replicated-job. Deployment files, scripts, workflows, compose files and Dockerfiles install no host crontab, cron.d entry, systemd timer, @reboot job or at job; a workflow does not schedule app work. Docker compose up, down and pull run only against an explicitly dev environment. Deploy shell scripts delegate to docker, starci or the app CLI, and contain no node -e, psql, inline SQL or downloaded shell logic."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_HOST_CRON", "HFS_DEPLOY_NO_LOGIC", "HFS_DEPLOY_COMPOSE_ON_VPS", "HFS_DEPLOY_SCHEDULER"]
@@ -4701,7 +4701,7 @@ rules:
       - {path: packages/hfs/src/hfs-stacks-full-fixtures.spec.mjs, edition: full}
   - id: R276
     code: "STACKS_LITE_SELFHOSTED_DB"
-    law: "Lite runs exactly one database, its db component of image supabase/postgres (pinned by digest) with pgvector for vector search, and no other PostgreSQL, MongoDB or Qdrant backing image, even when declared (owner:lite-vector-is-pgvector, ruling:lite-self-hosted-postgres-passport-minio). A Redis image runs only when hfs.json sides.be.backing declares redis (ruling:R212/case-10), as one minimal instance; a declared Redis runs as exactly one stack service, with AOF persistence (`appendonly yes`, `appendfsync everysec` or `always`, never `no`) on a writable named volume so queue jobs survive a restart and with no maxmemory-policy but noeviction so none is evicted. A queue job Redis loses inside the at most one second `everysec` leaves unwritten is not lost work: every job is born from a Postgres outbox row, and the relay marks that row sent only after Redis confirms the job is in its append-only file (WAITAOF) and still holds it, so a job Redis did not persist leaves its row waiting and the relay adds it again (examples/lite-app queue-relay.service.spec.ts and bullmq-queue-transport.client.spec.ts). A sidecar keeps its own SQLite on a named persistent volume declared by its component and mounted in the rendered model, and never uses the app's declared Redis, which serves the back-end app services only; a sidecar requiring another database, that Redis included, is refused. Full retains its declared backing topology."
+    law: "Lite runs exactly one database, its db component of the image its managed db/Dockerfile builds (the digest-pinned official postgres image plus pgvector, ruling:lite-official-postgres-image) for vector search too, and no other PostgreSQL, MongoDB or Qdrant backing image, even when declared (owner:lite-vector-is-pgvector, ruling:lite-self-hosted-postgres-passport-minio). A Redis image runs only when hfs.json sides.be.backing declares redis (ruling:R212/case-10), as one minimal instance; a declared Redis runs as exactly one stack service, with AOF persistence (`appendonly yes`, `appendfsync everysec` or `always`, never `no`) on a writable named volume so queue jobs survive a restart and with no maxmemory-policy but noeviction so none is evicted. A queue job Redis loses inside the at most one second `everysec` leaves unwritten is not lost work: every job is born from a Postgres outbox row, and the relay marks that row sent only after Redis confirms the job is in its append-only file (WAITAOF) and still holds it, so a job Redis did not persist leaves its row waiting and the relay adds it again (examples/lite-app queue-relay.service.spec.ts and bullmq-queue-transport.client.spec.ts). A sidecar keeps its own SQLite on a named persistent volume declared by its component and mounted in the rendered model, and never uses the app's declared Redis, which serves the back-end app services only; a sidecar requiring another database, that Redis included, is refused. Full retains its declared backing topology."
     kinds: [check]
     gates: ["settle","land","ci"]
     failureCodes: ["STACKS_LITE_SELFHOSTED_DB", "STACKS_SIDECAR_VOLUME_UNDECLARED", "STACKS_SIDECAR_DB_UNSUPPORTED", "STACKS_LITE_REDIS_PERSISTENCE"]
@@ -5849,3 +5849,27 @@ rules:
         source: owner
         quote: "big refactor đi … không viết raw sql như thế theo starci-academy-be"
         ruling: "Lite persistence moves to TypeORM entities on the EntityManager, the shape of full and starci-academy-be (ruling lite-persistence-typeorm-entities)."
+  - id: R335
+    code: "BE_JOBS_SCHEDULER_OWNER"
+    law: "Recurring work is a tick of platform/jobs (ruling lite-official-postgres-image): JOB_TICKS of job-ticks.contracts.ts lists the ticks as data, and only job-tick.service.ts (JobTickService, which registers one CronJob per tick in SchedulerRegistry) and jobs.module.ts (which composes ScheduleModule.forRoot()) import @nestjs/schedule or cron; no file uses the Cron, Interval or Timeout decorator. JobTickService takes advisoryXactLock(tx, \"tick:<name>\") and claims the tick's UTC minute through callDbFunction(tx, \"job_tick_claim\", ...) in the transaction that writes the queue outbox row, so of the replicas that fire a tick exactly one enqueues it once per minute."
+    kinds: [lint]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["BE_JOBS_SCHEDULER_OWNER"]
+    enforcers:
+      - {kind: eslint-be, id: jobs-scheduler-owner}
+    editions: [lite, full]
+    docs: [contexts/code/be/jobs.md]
+    proves:
+      - packages/eslint-canon-be/src/jobs-scheduler.spec.ts
+    exemplifiedBy:
+      - {path: packages/hfs/templates/be/patterns/jobs/platform-lite/job-tick.service.ts.tpl, edition: lite}
+      - {path: packages/eslint-canon-be/src/jobs-scheduler.spec.ts, editions: [lite, full], codes: [BE_JOBS_SCHEDULER_OWNER]}
+    witness:
+      - {path: packages/eslint-canon-be/src/jobs-scheduler.spec.ts, edition: lite, codes: [BE_JOBS_SCHEDULER_OWNER]}
+      - {path: packages/eslint-canon-be/src/jobs-scheduler.spec.ts, edition: full, codes: [BE_JOBS_SCHEDULER_OWNER]}
+    cases:
+      - id: case-1
+        date: "2026-10-29"
+        source: owner
+        quote: "chạy postgresql thuần image chính chủ nhé ko phải supebase"
+        ruling: "The lite db image carries no pg_cron, so recurring work moves to a Nest schedule tick of platform/jobs under an advisory lock and a minute claim (ruling lite-official-postgres-image)."

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.9.0
+version: 3.11.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -50,6 +50,11 @@ versioning:
 # transport client layer), and lets fe.hooks.swr hold the SWR subscription hooks (api/sse/subscriptions/useSubscribe<X>Swr.ts, one useSWRSubscription per stream operation).
 # 3.8.0 is a minor (urgent release, 2026-10-29): it ADDS the optional fe.dev-server-generated slot (apps/*/AGENTS.md, which `next dev` rewrites) and the
 # slot field rewrittenBy, so the release gate's clean-tree check passes over an untracked file a declared dev server writes, and over nothing else.
+# 3.10.0 is a minor (2026-10-29): it ADDS the lite be.platform.database.entities slot, the entity registry (slot fields role and importedBy), so the
+# tier matrix and the public-entry rules admit exactly its <c>Entities imports and its deep importers (persistence.md BE-PERSISTENCE-3).
+# 3.11.0 (ruling:lite-official-postgres-image, 2026-10-29) is, like 3.9.0, a change for lite only: it ADDS the managed app.db.image slot
+# (db/Dockerfile, written by `starci app sync --write`), narrows ruleParams.db.extensions to the extensions that image carries, and gives
+# @nestjs/schedule and cron one owner, platform/jobs (R335).
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -72,6 +77,10 @@ versioning:
 #   outcomeHome true on a file slot: the one file that declares the repository's Outcome union. A repository holds exactly one such
 #               file (modules/api/outcome.ts, the api package's outcome.ts, or modules/db/outcome.ts of a lite app),
 #               and no other file declares an Outcome union (one-outcome-union, FE_TRANSPORT_OWNER).
+#   role        on a file slot: the one part it plays that a rule reads. entity-registry = the lite PRIMARY_ENTITIES list
+#               (be.platform.database.entities): the one platform file that imports capability <c>Entities, imported by deep path
+#               only from the files importedBy names (architecture/entity-registry.mjs).
+#   importedBy  on a slot with a role: the side-relative path patterns of the only files that import its file by deep path.
 #   requires    files or directories that must exist inside each instance; <var> is replaced by the bound name,
 #               a leading / means repository root; a trailing / means directory.
 #   requiredInstances  variable -> names that must exist as instances (config, logging ... of platform).
@@ -121,8 +130,8 @@ testValues: [unit-beside, e2e, none]
 # specs (unitRoles, logicRoles, 100 per file, @starci/jest-preset doubles, builders). What differs is ADAPTERS and DELIVERY
 # (ruling:R212/case-10): schema authority in db/migrations, the queue port on BullMQ over the Redis hfs.json
 # sides.be.backing declares (as in full, fed by the Postgres outbox), event-bus ports on pgmq-backed topics or in-process
-# delivery, cache and locks on Postgres or the declared Redis, schedules on pg_cron (+ pg_net) enqueueing through the queue
-# outbox, storage on S3-compatible MinIO (integrations/object-storage) and auth through integrations/passport. Realtime uses SSE or the socket.io gateway
+# delivery, cache and locks on Postgres or the declared Redis, schedules as platform/jobs ticks enqueueing through the queue
+# outbox (R335), storage on S3-compatible MinIO (integrations/object-storage) and auth through integrations/passport. Realtime uses SSE or the socket.io gateway
 # in the api process, which scales horizontally and stateless (memory hub for one replica or tests; the Redis hub and @socket.io/redis-adapter when Redis is declared, else the Postgres hub and @socket.io/postgres-adapter, for N replicas; websocket only, no sticky sessions). Integration and provider sandbox contract specs are optional;
 # declared patterns owe their integration proofs (R284). Lite has no e2e world. Production uses declared docker-swarm under
 # .starcistacks/production/infra/swarm/ (owner ruling 2026-10-14); lite runs its PostgreSQL as the db service of its
@@ -199,8 +208,9 @@ crossApp: apps never import each other; shared code is a packages/<pkg> slot.
 ruleParams:
   db:
     # R259: btree_gist supplies UUID equality for the booking interval exclusion constraint.
-    # R259: unaccent ships in the supabase/postgres image of the db service, used by Vietnamese-content search functions.
-    extensions: [pgmq, pg_cron, pgcrypto, pg_trgm, vector, uuid-ossp, pg_net, supabase_vault, unaccent, btree_gist]
+    # R259: the extensions the db image carries (ruling:lite-official-postgres-image): the official postgres image's contrib set and pgvector
+    # from PGDG; unaccent serves Vietnamese-content search functions. No pg_cron, pg_net, pgmq or supabase_vault.
+    extensions: [pgcrypto, pg_trgm, vector, uuid-ossp, unaccent, btree_gist]
     # R258 DB_CRON_OWNED: THE queue outbox of a lite schema (the relay hands its unsent rows to BullMQ, ruling:R212/case-10). A pg_cron
     # job enqueues only by inserting one row into this table, writing only these columns, one of which is `queue`.
     queueOutbox: {table: public.queue, columns: [queue, payload, created_at, correlation_id]}
@@ -249,7 +259,8 @@ ruleParams:
       bull: [platform/queue]
       "@nestjs/bull": [platform/queue]
       kafkajs: [platform/event-bus]          # pattern event-bus: Kafka is the only event transport
-      "@nestjs/schedule": []                 # no @Cron / @Interval / @Timeout anywhere: a schedule is a BullMQ job scheduler of a queue
+      "@nestjs/schedule": [platform/jobs]    # R335: only the tick scheduler of platform/jobs (jobs.scheduler.ts); elsewhere a schedule is a BullMQ job scheduler of a queue
+      cron: [platform/jobs]                  # R335: CronJob of the tick scheduler
       eventemitter2: []
       setInterval: [platform/retry, platform/event-bus, platform/queue, platform/http, platform/realtime]
       setTimeout: [platform/retry, platform/event-bus, platform/queue, platform/http]
@@ -432,6 +443,7 @@ ruleParams:
       - {name: job_advance, reason: "platform/jobs (add job, lite): the token-guarded step write of jobs.sql"}
       - {name: job_complete, reason: "platform/jobs (add job, lite): the token-guarded completion of jobs.sql"}
       - {name: job_fail, reason: "platform/jobs (add job, lite): the token-guarded failure of jobs.sql"}
+      - {name: job_tick_claim, reason: "platform/jobs (add job, lite): the once-per-minute claim of a scheduler tick, jobs.sql (R335)"}
       - {name: queue_write, reason: "platform/queue (add queue, lite): the outbox insert of queue-outbox.sql"}
       - {name: queue_waiting, reason: "platform/queue (add queue, lite): the relay read FOR UPDATE SKIP LOCKED of queue-outbox.sql"}
       - {name: queue_mark_sent, reason: "platform/queue (add queue, lite): the relay mark of queue-outbox.sql"}
@@ -855,7 +867,7 @@ slots:
              "<env>/runtime/{config,env}/**", "<env>/runtime/env/KEYS.md", "<env>/secrets/<slug>.enc", "<env>/secrets/.gitkeep", "<env>/seeds/**"]
     forbids: ["<env>/runtime/files/**", "**/*.enc outside <env>/secrets/", DESIGN.md, deployment.json, "k8s/ at root"]
     # Owner ruling 2026-10-14: lite declares docker-swarm production, app runtime config, sealed custody and seed data.
-    # The db service supplies the database and broker (pgmq, pg_cron); production has no Compose or host cron.
+    # The db service supplies the database; schedules are platform/jobs ticks (R335); production has no Compose or host cron.
     lite:
       requires: [application-stacks.yaml]
       allows: [application-stacks.yaml, "<env>/README.md", "<env>/environment.json", "<env>/infra/swarm/**", "<env>/infra/metadata.json",
@@ -919,7 +931,7 @@ slots:
     rules: [HFS_PLAINTEXT_SECRET]
 
   # ----- app root: the database of a lite app (ruling:lite-self-hosted-postgres-passport-minio): a self-hosted PostgreSQL in the app's
-  # stack (the `db` service, image supabase/postgres for pg_cron, pg_net, pgmq, vector, unaccent and pgcrypto), migrated by
+  # stack (the `db` service, built from the managed db/Dockerfile: the official postgres image plus pgvector, ruling:lite-official-postgres-image), migrated by
   # `starci app db migrate --url-env <NAME>`. A full app keeps its TypeORM migrations under be/ and has no such folder.
   - id: app.db
     profiles: [app]
@@ -969,12 +981,26 @@ slots:
     tier: none
     tests: none
     since: 3.9.0
+  - id: app.db.image
+    profiles: [app]
+    editions: [lite]
+    # The managed image of the db service (templates/app/db-image, ruling:lite-official-postgres-image): FROM the digest-pinned official
+    # postgres image plus postgresql-17-pgvector from PGDG. The stack's db service, the local db container and the scratch database
+    # of `starci app db drift` all build it.
+    path: "db/Dockerfile"
+    presence: required
+    tracked: tracked
+    managedBy: db-image
+    tier: none
+    tests: none
+    since: 3.11.0
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.db.bootstrap
     profiles: [app]
     editions: [lite]
-    # The managed pre-migration bootstrap (templates/app/db-bootstrap): the auth, storage and extensions schemas, auth.users with the
-    # GoTrue column set, auth.uid/role/jwt stubs, the NOLOGIN browser roles and the realtime publication, so migrations written for a
-    # hosted Supabase apply to the self-hosted db service. `starci app db migrate` applies it before the first migration of an empty database.
+    # The managed pre-migration bootstrap (templates/app/db-bootstrap): the auth and storage schemas, auth.users with the GoTrue column
+    # set, auth.uid/role/jwt stubs and the NOLOGIN browser roles, so migrations written for a hosted Supabase apply to the db service's
+    # official postgres image (nothing else of Supabase: no supabase_admin, extensions schema or realtime publication). `starci app db migrate` applies it before the first migration of an empty database.
     path: "db/bootstrap.sql"
     presence: required
     tracked: tracked
@@ -1725,6 +1751,21 @@ slots:
     coverage: required
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE]
+  - id: be.platform.database.entities
+    since: 3.10.0
+    profiles: [be]
+    editions: [lite]
+    editionWhy: "lite registers the one PRIMARY_ENTITIES list on its single primary connection; full registers each capability's <c>Entities per connection from persistence/connection.ts."
+    path: "src/modules/platform/database/entities.ts"
+    presence: optional
+    tracked: tracked
+    tier: inherit
+    role: entity-registry
+    importedBy: ["apps/*/src/compose/*.ts", "apps/*/src/app.module.ts", "src/tests/world/**"]
+    tests: none
+    coverage: none
+    why: "the entity registry (persistence.md BE-PERSISTENCE-3): it lists every capability's <c>Entities array by name, no glob, as PRIMARY_ENTITIES, the one list the primary connection maps, and exports nothing else. It is the one platform file that imports domain and platform capabilities, each import naming only that capability's <c>Entities from its index.ts (BE_TIER_DIRECTION, ARCH_OWNER_EXPORT_BYPASS); DatabaseModule and the platform/database index never import it, and only the files importedBy names (app composition and the test world) import it, by the deep path @modules/platform/database/entities (BE_PUBLIC_SURFACE), since database.module, this list and the capability indexes would otherwise form a cycle that fails at boot"
+    rules: [BE_TIER_DIRECTION, BE_PUBLIC_SURFACE, BE_SCHEMA_OWNER]
   - id: be.platform.logging
     since: 3.5.0
     profiles: [be]
@@ -1779,7 +1820,7 @@ slots:
         the same QueueOutbox and QueueWorkerRegistry ports and full's BullMQ adapter on the declared Redis (backing: [redis]): the
         relay adds each committed outbox row with the outbox id as the job id, workers retry with exponential backoff and keep a
         job that exhausts its attempts as failed (the dead letter); the outbox table comes from a db migration, and a
-        schedule is a BullMQ job scheduler or a pg_cron tick that inserts one outbox row (knowledge/patterns/be/queues.yaml liteAdapter)
+        schedule is a BullMQ job scheduler or a platform/jobs tick that writes one outbox row, R335 (knowledge/patterns/be/queues.yaml liteAdapter)
     requires: [index.ts, queue.module.ts, queue.port.ts, queue.contracts.ts, queue-outbox.service.ts, queue-outbox.service.spec.ts]
     tests: unit-beside
     coverage: required

package/runtime/knowledge/patterns/be/idempotency.yaml

@@ -258,7 +258,7 @@ liteAdapter:
     idempotency pattern with its required proof scenarios.
   ports:
     - {port: Inbox, adapter: PostgresInbox through the caller's active EntityManager transaction}
-    - {port: receipt retention, adapter: a fenced job delivered by the BullMQ queue on the declared Redis and scheduled by a pg_cron tick that enqueues through the queue outbox}
+    - {port: receipt retention, adapter: a fenced job delivered by the BullMQ queue on the declared Redis and scheduled by a platform/jobs tick (R335) that enqueues through the queue outbox}
   proof: >-
     The same inbox and fingerprint unit specs apply; declaring idempotency requires both client receipt scenarios in
     lite's local db integration lane.

package/runtime/knowledge/patterns/be/jobs.yaml

@@ -287,8 +287,11 @@ liteAdapter:
   ports:
     - {port: job claim (platform/jobs), adapter: "the claim and guarded writes as the job_claim, job_advance, job_complete and job_fail functions of the jobs migration in db/migrations, called through callDbFunction of platform/database (R334)"}
     - {port: processor delivery, adapter: "full's BullMQ worker (attempts and exponential backoff from the queue policy, failed jobs kept as the dead letter)"}
+    - {port: tick scheduler (platform/jobs), adapter: "JOB_TICKS of job-ticks.contracts.ts as data and JobTickService (job-tick.service.ts, composed with ScheduleModule.forRoot() by the lite jobs.module.ts): one CronJob per tick in SchedulerRegistry, each firing taking advisoryXactLock and claiming the tick's UTC minute through the job_tick_claim function of the jobs migration before it writes the queue outbox (R335, contexts/code/be/jobs.md BE-JOBS-6)"}
   proof: >-
     Unit specs as full (job-claim.service.spec.ts); declaring fenced-job requires integration specs titled
     `fenced-job/<scenario>: ...` for every declared scenario on the local db service (R284, which runs no container of its
     own): the claim, the fencing token and the guarded writes are Postgres facts, driven there by the real runner without BullMQ.
+    The tick scheduler's unit spec (job-tick.service.spec.ts) proves the lock, the minute claim and that a replica that comes
+    second enqueues nothing.
   see: [knowledge/patterns/be/queues.yaml]

package/runtime/knowledge/patterns/be/queues.yaml

@@ -78,18 +78,19 @@ rules:
       manual: []
     relatedExamples: [queue]
   - id: BE-QUEUES-3
-    title: A schedule is a BullMQ job scheduler declared with its queue, or a pg_cron tick that writes the outbox
+    title: A schedule is a BullMQ job scheduler declared with its queue, or a platform/jobs tick that writes the outbox
     kind: mandatory
-    hfsRules: [R90, R258]
+    hfsRules: [R90, R335]
     requirement: |-
       A recurring task is a job scheduler (`upsertJobScheduler`) that the queue module declares in its `schedulers` list and
-      `platform/queue` registers at boot, or, in a lite app, a uniquely named pg_cron job of a migration whose command
-      (directly or through one `*_tick` function) only inserts one row of a queue constant into the queue outbox table of
-      `ruleParams.db.queueOutbox` (`public.queue`), which the relay hands to BullMQ, or by calling the enqueue function that the app declares with its own outbox table in `hfs.json` `sides.be.queueOutbox` (redis declared in `sides.be.backing`; the function's active definition only inserts into that table); a tick has exactly one of the two owners. A job name is scheduled once while it is active: a later migration that replaces a tick's command calls `cron.unschedule` of the name first. Its job is processed by the same
-      `features/jobs/<job>/<job>.processor.ts` as any enqueued job. `@nestjs/schedule`, `@Cron`, `@Interval`, `@Timeout` and
-      `setInterval` for work are not used anywhere.
+      `platform/queue` registers at boot, or, in a lite app, a tick of `platform/jobs` (BE-JOBS-6, R335): `JOB_TICKS` of
+      `job-ticks.contracts.ts` lists it as data and `JobTickService` fires it on every replica, where each firing takes
+      `advisoryXactLock(tx, "tick:<name>")`, claims the tick's UTC minute through `job_tick_claim` and only then writes one row of
+      the tick's queue into the queue outbox, which the relay hands to BullMQ. Its job is processed by the same
+      `features/jobs/<job>/<job>.processor.ts` as any enqueued job. `@nestjs/schedule` and `cron` are imported only by that
+      scheduler, and `@Cron`, `@Interval`, `@Timeout` and `setInterval` for work are not used anywhere.
     rationale: |-
-      One scheduler in Redis, or one pg_cron job in the database, fires once for the whole deployment, where cron in a replicated
+      One scheduler in Redis, or one minute claim in the database, fires once for the whole deployment, where cron in a replicated
       process fires once per replica.
     cases:
       - id: case-1
@@ -283,12 +284,12 @@ liteAdapter:
     - {port: queue transport (queue-transport.port.ts), adapter: "full's bullmq-queue-transport.client.ts over the declared Redis (host, port, db and the password read from its sealed secret file), plus persist(jobs): WAITAOF 1 0 on each queue's connection, then each job's state, refusing with QUEUE_NOT_PERSISTED or QUEUE_JOB_LOST (errors/queue.error.ts)"}
     - {port: outbox relay (queue-relay.service.ts), adapter: "full's relay, which calls persist after the adds and before it marks the rows sent, so a refusal rolls the mark back and the next pass adds the rows again"}
     - {port: QueueWorkerRegistry (platform/queue), adapter: "full's BullMQ worker per queue: attempts and exponential backoff from queue.policy.ts, failed jobs kept as the dead letter"}
-    - {port: schedulers, adapter: "a BullMQ job scheduler declared with its queue, as full, or a pg_cron job in a db migration whose tick inserts one row of the queue constant into the queue outbox"}
-  forbids: [kafkajs, "@nestjs/schedule"]
+    - {port: schedulers, adapter: "a BullMQ job scheduler declared with its queue, as full, or a platform/jobs tick (JobTickService, R335) that writes one row of the tick's queue into the queue outbox under its lock and minute claim"}
+  forbids: [kafkajs]
   proof: >-
     Unit specs as full (queue-outbox, relay and worker services, the BullMQ client against a mocked factory); declaring queue
     requires integration specs titled `queue/<scenario>: ...` for every declared scenario on the local db service (R284,
-    which runs no container of its own): the outbox, its commit boundary, the relay identity and the pg_cron tick are Postgres
+    which runs no container of its own): the outbox, its commit boundary, the relay identity and the tick's minute claim are Postgres
     facts proved there with the real outbox writer and relay, and the queue transport records what the relay hands to BullMQ
     (the job id is the outbox id). BullMQ itself is covered by the unit spec of the BullMQ client, which also proves the
     persist refusals; the relay's unit spec proves a refused persist leaves the rows waiting.

package/runtime/knowledge/patterns/be/realtime.yaml

@@ -670,7 +670,7 @@ files:
     optional: true
   - path: db/migrations/<timestamp>_realtime-events.sql
     slot: repo.side-root-forbidden
-    role: Lite edition migration (created with `npm run db:new`) of the same two tables, forced row level security for app_be, and the pg_cron tick of the retention queue.
+    role: Lite edition migration (created with `npm run db:new`) of the same two tables, forced row level security for app_be; the retention queue is fired by a platform/jobs tick (R335).
     optional: true
   - path: src/features/reactors/<name>/transport/message/<event>.consumer.ts
     slot: be.transport.message

package/runtime/modules/kernel/failure-codes.yaml

@@ -3732,7 +3732,7 @@ HFS_HOST_CRON:
   meaning_vi: "Tệp triển khai hoặc script tại <path> khai báo crontab, cron.d, systemd timer, @reboot hoặc at; lịch chạy phải do ứng dụng sở hữu."
   causes_vi:
     - "Vi phạm R250: cài lịch chạy ngoài scheduler của ứng dụng hoặc replicated-job đã khai báo."
-  nextStep_vi: "Chuyển tác vụ sang scheduler hàng đợi của back end, một tick pg_cron enqueue qua outbox hàng đợi hoặc replicated-job đã khai báo và gọi lệnh CLI của ứng dụng."
+  nextStep_vi: "Chuyển tác vụ sang scheduler hàng đợi của back end, một tick của platform/jobs (R335) enqueue qua outbox hàng đợi hoặc replicated-job đã khai báo và gọi lệnh CLI của ứng dụng."
   owner: op-retry
   kind: check-finding
 
@@ -5600,3 +5600,13 @@ BE_PERSISTENCE_NO_RAW_SQL:
   nextStep_vi: "Khai entity ở persistence/entities/<table>.entity.ts và đọc/ghi bằng EntityManager hoặc createQueryBuilder với tham số có tên; hàm pg/SECURITY DEFINER không diễn đạt được thì khai vào rawSqlFunctions kèm lý do."
   owner: op-retry
   kind: check-finding
+
+BE_JOBS_SCHEDULER_OWNER:
+  title: "A schedule outside the platform/jobs tick scheduler"
+  title_vi: "Lịch chạy định kỳ nằm ngoài bộ lập lịch tick của platform/jobs"
+  meaning_vi: "File `<path>` import @nestjs/schedule hoặc cron ngoài job-tick.service.ts và jobs.module.ts của platform/jobs, dùng decorator Cron/Interval/Timeout, hoặc JobTickService không giữ advisoryXactLock và job_tick_claim trước khi ghi outbox."
+  causes_vi:
+    - "Vi phạm R335: việc định kỳ là tick của platform/jobs (JOB_TICKS), mỗi phút chỉ một replica enqueue nhờ khoá advisory và claim phút trong DB."
+  nextStep_vi: "Khai tick vào JOB_TICKS của platform/jobs/job-ticks.contracts.ts (name, cron, timeZone UTC, queue, payload) và xoá lịch tự viết; giữ advisoryXactLock và job_tick_claim trong JobTickService."
+  owner: op-retry
+  kind: check-finding

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -85,7 +85,7 @@ properties:
         command: {type: string, minLength: 1}
   backing:
     description: >-
-      The self-hosted database of a lite app: its db component (image supabase/postgres), a Docker container in
+      The self-hosted database of a lite app: its db component (the image its managed db/Dockerfile builds), a Docker container in
       development and a Swarm service in production. Every other dependency is a Docker component too.
     type: object
     additionalProperties:

package/runtime/scripts/hfs/architecture/entity-registry.mjs

@@ -0,0 +1,53 @@
+import { braceVariants, globExpression } from '../../lib/glob.mjs';
+
+/**
+ * The entity registry (persistence.md BE-PERSISTENCE-3): the one file whose slot plays `role: entity-registry`
+ * (`be.platform.database.entities`, lite's `src/modules/platform/database/entities.ts`). It lists every capability's `<c>Entities`
+ * array as `PRIMARY_ENTITIES`, so it is the one platform file that imports domain and platform capability barrels, and only for
+ * that name; and it is imported by deep path only from the files its slot's `importedBy` names (app composition and the test world).
+ * The tier matrix (tiers.mjs), the public-entry check (owners.mjs) and the lint rule `import-owner-entry` read it here.
+ */
+export const ENTITY_REGISTRY_ROLE = 'entity-registry';
+
+/** The tiers whose capabilities contribute an entity list to the registry. */
+const CONTRIBUTING_TIERS = new Set(['domain', 'platform']);
+
+/** The entity list a capability exports: `<c>Entities`, `<c>` its folder name in camelCase. */
+export const entityListName = capability => `${capability.replace(/-([a-z0-9])/g, (_, next) => next.toUpperCase())}Entities`;
+
+/** The slot of `file` (side-relative or absolute) when it plays the entity-registry role, else null. */
+export function registrySlot(resolver, file) {
+  const slot = resolver?.slotOf?.(file);
+  return slot?.role === ENTITY_REGISTRY_ROLE ? slot : null;
+}
+
+/**
+ * Whether `file` is one of the importers the registry slot admits by deep path (`importedBy`, side-relative patterns); an app-wide
+ * resolver answers for a side-prefixed path (`be/apps/...`), which is read without its side folder.
+ */
+export function registryImporter(resolver, slot, file) {
+  const side = resolver?.sideOf?.(file);
+  const rel = side ? file.slice(side.length + 1) : file;
+  return (slot.importedBy ?? []).some(pattern => braceVariants(pattern).some(variant => globExpression(variant).test(rel)));
+}
+
+/** The names an import declaration binds by name; null for a default, namespace or side-effect import and for any re-export. */
+function namedImports(declaration) {
+  const clause = declaration?.importClause;
+  if (!clause || clause.name || !Array.isArray(clause.namedBindings?.elements) || !clause.namedBindings.elements.length) return null;
+  return clause.namedBindings.elements.map(element => (element.propertyName ?? element.name).text);
+}
+
+/**
+ * Whether an owner-graph edge (side-relative `from` and `to`, `edge.declaration` the TypeScript statement) is the registry naming a
+ * capability's entity list: it leaves the registry, imports the public entry (`index.ts`) of a domain or platform capability, and
+ * binds that capability's `<c>Entities` and nothing else.
+ */
+export function registryListImport(resolver, edge) {
+  if (!registrySlot(resolver, edge.from)) return false;
+  const owner = resolver.ownerOf(edge.to);
+  if (!owner || !CONTRIBUTING_TIERS.has(resolver.slot(owner.slot)?.tier) || edge.to !== `${owner.root}/index.ts`) return false;
+  const names = namedImports(edge.edge?.declaration ?? edge.declaration);
+  const listName = entityListName(owner.root.split('/').at(-1));
+  return names !== null && names.every(name => name === listName);
+}