@starci/hfs 4.11.20 → 4.11.22

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 4.11.22 - 2026-10-30
+
+- Changed: `starci app check` and `starci app lint` are green while fewer than 20 error findings remain and none is a hard blocker (owner ruling gate-threshold-20, contexts/harness/decisions.md; `runtime/scripts/hfs/gate-threshold.mjs` `gateVerdict`): a plaintext secret (HFS_PLAINTEXT_SECRET and its family), the boot proof (BE_APP_BOOT_PROOF_MISSING) or a migration finding (DB_MIGRATION_SHAPE, DB_MIGRATION_DESTRUCTIVE, LITE_DB_MIGRATION, BE_MIGRATION_REVERSIBLE) blocks at any count. Every finding is still printed and kept in the report (`gate` carries the verdict); typecheck, build and the tests are not judged by it. Specs: `src/gate-threshold.spec.mjs`; `src/check-eslint.spec.mjs` now expects green for one or two ordinary findings.
+- Changed: the bundled canon pins name eslint-canon-be 3.8.21, eslint-canon-fe 9.5.23 and the Grammar family 0.15.34.
+
+## 4.11.21 - 2026-10-30
+
+- Changed: an urgent release runs typecheck and the build only (owner ruling urgent-typecheck-build, contexts/harness/decisions.md): `URGENT_CHECKS` are the release gates `typecheck`, `build`, `build-be` and `build-fe` the app declares (`release/urgent.mjs`); app check, lint and the tests wait for the back-fill. `--lint-baseline` is retired with lint itself and refused (`RELEASE_URGENT_LINT_BASELINE_RETIRED`); `release/lint-baseline.mjs` is gone.
+- Added: the one-command urgent release. `starci app stack deploy --env <env> --urgent --reason "<text>" --execute` with no `--image` and no `--source-sha` releases HEAD (unless it already has a pushed urgent record; a tag already on HEAD is adopted), builds and pushes its images on this machine before the deploy's Docker transport reaches the server, and deploys their digests under the unchanged floor (`stack/urgent-release.mjs`, wired in `stack/cli.mjs`; `--reason` and `--remote` belong to it; `STACK_URGENT_REASON_MISSING`). A dry run plans the release and the build and stops. Specs: `src/stack-urgent-release.spec.mjs`, `src/release-urgent.spec.mjs`.
+- Changed: `deploy.remote.sealed` is one member name (`sealed: vps`: `vps.enc.yaml` holds VPS_HOST, VPS_USER, `privateKey` and `knownHosts`), read as the member of all three SSH roles (`stack-deploy-config.mjs`, schema `deployRemote.sealed`). The three-role object `{ ops, sshKey, knownHosts }` is refused (STACKS_DEPLOY_CONFIG_INVALID), its message naming `starci app secret migrate <env> <member> --to vps --into-existing` to fold a member per role into one (owner, 2026-10-30: one form only). Spec: `src/hfs-stacks-deploy-schema.spec.mjs`.
+- Changed: `secret audit` takes a grouped member as declared, not MIXED_PROVIDERS: the member `deploy.remote.sealed` names groups VPS_HOST, VPS_USER, privateKey and knownHosts, and a `secrets:` entry naming a member may list the keys it groups (`keys: [...]`, schema `secret.keys`) instead of an entry per key; the stacks gate refuses a listed key the envelope does not hold, and an entry with both `key` and `keys` (`secret-standard.mjs` `declaredGroup`, `stacks-gate.mjs`). Spec: `src/hfs-secret-standard.spec.mjs`.
+- Changed: the bundled canon pins name eslint-canon-be 3.8.20, eslint-canon-fe 9.5.22 and the Grammar family 0.15.33.
+
 ## 4.11.20 - 2026-10-30
 
 - Added: a slot may declare the files of its own that carry logic: `logic: [file, ...]` (owner ruling slot-declared-logic, contexts/decisions/rulings.yaml), valid only on a tracked be directory slot with `coverage: required` and `tests: unit-beside`, each a `<name>.<part>.ts` the slot requires or allows and not already a logic-role file (`manifest-shape.mjs` `slotLogicProblems`, `declaredLogicOf`). A declared file is measured at 100 per file like a logic role (`coverage-scope.mjs` `files` and `measuredBy`, `rules/coverage-below.mjs`, `sync/index.mjs` renders `files` into be/jest.config.js, Sonar no longer excludes it), and its colocated `.spec.ts` is admitted unlisted (`allows.mjs`). `be.integrations.passport` declares `passport.tokens.ts`, `passport.password.ts` and `passport.cookie.ts`; the lite skeleton ships their specs in the testing-module form (`passport.password.spec.ts` and `passport.cookie.spec.ts` are new), each file at 100. Specs: `src/slot-declared-logic.spec.mjs`; `codecov-scope` and `scaffold-template-canon-be` follow.

package/lint/run.mjs

@@ -27,6 +27,7 @@ import { STYLE_GLOB } from '../sync/index.mjs';
 import { byCodeUnit } from '../report/order.mjs';
 import { braceVariants, globExpression } from '../runtime/scripts/lib/glob.mjs';
 import { grammarLintFor } from '../runtime/scripts/lib/grammar-lint.mjs';
+import { gateVerdict } from '../runtime/scripts/hfs/gate-threshold.mjs';
 
 // --side judges only that side; root HFS findings belong to be, its Sonar report stays on that side.
 export const LINT_SCHEMA = 'starci/lint@1';
@@ -436,8 +437,10 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
     linterReport('eslint', raw.eslint, { root: repoRoot, sourceRoots, tracked }),
     linterReport('stylelint', raw.stylelint, { root: repoRoot, sourceRoots, tracked }),
   ]);
-  const report = { schema: LINT_SCHEMA, ok: findings.length === 0 && errors.length === 0, repoRoot, changed: changed ? [...changed].sort(byCodeUnit) : null, workspace, ...(opts.side === undefined ? {} : { side: opts.side }), counts: { error: findings.length }, engines, errors, findings };
-  return { report, sonar, exit: errors.length ? 2 : findings.length ? 1 : 0 };
+  // Green under the threshold (gate-threshold.mjs): every finding is still reported, only the verdict changes.
+  const gate = gateVerdict(findings);
+  const report = { schema: LINT_SCHEMA, ok: gate.pass && errors.length === 0, repoRoot, changed: changed ? [...changed].sort(byCodeUnit) : null, workspace, ...(opts.side === undefined ? {} : { side: opts.side }), counts: { error: findings.length }, engines, errors, findings, gate };
+  return { report, sonar, exit: errors.length ? 2 : gate.pass ? 0 : 1 };
 }
 
 export function printLintText(report, out) {
@@ -445,4 +448,5 @@ export function printLintText(report, out) {
   for (const e of report.errors) out(`ERROR ${e}\n`);
   const per = Object.keys(report.engines).map((engine) => `${engine} ${report.findings.filter((f) => f.engine === engine).length}`).join(', ');
   out(`\nstarci app lint: ${report.counts.error} finding${report.counts.error === 1 ? '' : 's'} (${per})${report.errors.length ? `, ${report.errors.length} tool error${report.errors.length === 1 ? '' : 's'}` : ''}\n`);
+  if (report.gate?.line) out(`${report.gate.line}\n`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.11.20",
+  "version": "4.11.22",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/index.mjs

@@ -1,7 +1,7 @@
 // index.mjs - `starci app release <gate|push>` and the plumbing the release and database verbs share: the context built from the app's IO, strict flag
 // parsing, the optional `release:` / `database:` blocks of .starcistacks/application-stacks.yaml, text and --json output and the exit-code mapping.
 //   starci app release gate [--execute] [--sonar] [--source <ref>] [--tag-prefix <prefix>] [--backfill <tag>] [--json]
-//   starci app release push [--execute] [--remote <name>] [--urgent --reason <text> [--lint-baseline <tag>]] [--json]
+//   starci app release push [--execute] [--remote <name>] [--urgent --reason <text>] [--json]
 // `harness` of the app IO ({ version, role, openTicket }) is what the starci CLI hands in: the caller's role an urgent record names and the ticket
 // queue a red back-fill files into.
 // Every action is a dry run unless --execute is given. A refusal is a StackError (exit 2); a failed step returns ok false (exit 1).
@@ -58,7 +58,7 @@ function readPackage(root) {
 }
 
 /** The normalised `release:` block (tolerant of absence) with the package version: { root, version, gates, tagPrefix, defaultBranch, requireCi }. */
-function loadReleaseConfig(root) {
+export function loadReleaseConfig(root) {
   const pkg = readPackage(root);
   if (typeof pkg.version !== 'string' || !VERSION.test(pkg.version)) throw refusal(RELEASE_CODE, 'package.json needs a version like 1.2.3 (the release tag derives from it)');
   const declaration = readDeclaration(root);

package/release/urgent.mjs

@@ -1,5 +1,5 @@
 // urgent.mjs - `starci app release push --urgent --reason "<text>"`, the sanctioned urgent path (owner ruling urgent-release, 2026-10-29: an urgent
-// deploy needs no CI). It runs only the fast local checks (app check, typecheck, lint of the files changed since the previous release tag, unit), or
+// deploy needs no CI). It runs only the fast local checks (typecheck and the build: owner ruling urgent-typecheck-build, 2026-10-30), or
 // reuses a green row the gate already recorded for HEAD with the same command and an unchanged log; tags HEAD (annotated) and pushes the default
 // branch and the tag in ONE atomic push through the repository's hook (never --no-verify, `git push --dry-run --atomic` first); then writes the
 // URGENT record <git common dir>/starci-release/<HEAD>.urgent.json naming who (the caller's role), why (the reason), each check with its verdict and the
@@ -11,15 +11,14 @@ import { firstLine } from '../stack/context.mjs';
 import { failure, refusal } from '../stack/errors.mjs';
 import { assertUnmoved, git, inspect, releaseDir, runGate, summaryOf } from './gate.mjs';
 import { assertNames, branchRefs, probe, tagRefs } from './push.mjs';
-import { baselineLint } from './lint-baseline.mjs';
 import { URGENT_RULING, URGENT_SCHEMA, greenRow, recordRow, writeUrgent } from './records.mjs';
 
-/** The fast local checks of an urgent release, by gate name, in the order they run. */
-export const URGENT_CHECKS = Object.freeze(['app-check', 'typecheck', 'lint', 'test']);
+/**
+ * The fast local checks of an urgent release, by gate name, in the order they run: what can break production, the types and the build
+ * (owner ruling urgent-typecheck-build, 2026-10-30). App check, lint and the tests wait for the back-fill (`release gate --backfill`).
+ */
+export const URGENT_CHECKS = Object.freeze(['typecheck', 'build', 'build-be', 'build-fe']);
 const REASON_MAX = 500;
-const CHANGED_MAX = 200;
-const PATH_WORD = /^[A-Za-z0-9_@%+=:,./\\-]+$/u;
-const MANAGED_LINT = 'npm run lint';
 
 /** The reason, one line of plain text; an urgent release without one is refused. */
 function reasonOf(value) {
@@ -29,37 +28,11 @@ function reasonOf(value) {
   return reason;
 }
 
-/** The newest release tag reachable from HEAD's parent, or null on a first release. */
-function previousTag(ctx, prefix) {
-  const found = git(ctx, ['describe', '--tags', '--abbrev=0', '--match', `${prefix}[0-9]*`, 'HEAD^'], { allowFail: true });
-  return found.code === 0 && found.stdout !== '' ? found.stdout : null;
-}
-
-/** The lint row of an urgent release: the managed whole-app lint narrowed to the source files changed since the previous release tag. */
-function changedLint(ctx, gate, prefix) {
-  if (gate.command.join(' ') !== MANAGED_LINT) return { gate, note: null };
-  const since = previousTag(ctx, prefix);
-  if (!since) return { gate, note: 'no previous release tag: the whole app is linted' };
-  const files = git(ctx, ['diff', '--name-only', '--diff-filter=d', `${since}..HEAD`]).stdout.split('\n').map((file) => file.trim())
-    .filter((file) => /\.(?:[cm]?[jt]sx?|css)$/u.test(file));
-  if (files.length === 0) return { gate: null, note: `no source file changed since ${since}` };
-  if (files.length > CHANGED_MAX || !files.every((file) => PATH_WORD.test(file))) return { gate, note: `${files.length} changed file(s) since ${since}: the whole app is linted` };
-  return { gate: { ...gate, command: ['npx', 'starci', 'app', 'lint', '--changed', ...files] }, note: `${files.length} file(s) changed since ${since}` };
-}
-
-/**
- * The urgent checks this app declares, from its release gates; a lint row is narrowed to the changed files, or, with `lintBaseline` (a release
- * tag), judged whole against that tag's findings (lint-baseline.mjs), which only the managed lint can be.
- */
-function urgentGates(ctx, config, prefix, lintBaseline) {
+/** The urgent checks this app declares, from its release gates, in URGENT_CHECKS order. */
+function urgentGates(config) {
   const declared = URGENT_CHECKS.map((name) => config.gates.find((gate) => gate.name === name)).filter(Boolean);
   if (declared.length === 0) throw refusal('RELEASE_URGENT_NO_CHECKS', `the release gates declare none of ${URGENT_CHECKS.join(', ')}: an urgent release still runs its fast local checks`);
-  return declared.map((gate) => {
-    if (gate.name !== 'lint') return { name: gate.name, gate, note: null };
-    if (lintBaseline === undefined) return { name: gate.name, ...changedLint(ctx, gate, prefix) };
-    if (gate.command.join(' ') !== MANAGED_LINT) throw refusal('RELEASE_URGENT_LINT_BASELINE_UNMANAGED', `--lint-baseline judges the managed lint (${MANAGED_LINT}), and this app's lint gate runs ${gate.command.join(' ')}`);
-    return { name: gate.name, gate, baseline: lintBaseline, note: `the whole app, judged against ${lintBaseline}: only a finding new since it is red (owner ruling urgent-lint-baseline)` };
-  });
+  return declared.map((gate) => ({ name: gate.name, gate, note: null }));
 }
 
 /** Runs (or reuses) each check in order and stops at the first red one. Returns the rows of the record. */
@@ -71,12 +44,6 @@ function runChecks(ctx, checks, { common, head, dir, platform }) {
       rows.push({ name: check.name, command: null, pass: true, reused: false, detail: check.note, log: null, logSha256: null });
       continue;
     }
-    if (check.baseline !== undefined) {
-      const row = baselineLint(ctx, check.gate, { tag: check.baseline, dir, platform });
-      rows.push({ ...row, reused: false, note: check.note });
-      if (!row.pass) break;
-      continue;
-    }
     const command = check.gate.command.join(' ');
     const reused = greenRow(common, head, check.name, command);
     if (reused) {
@@ -104,6 +71,7 @@ function planOf(checks) {
  */
 export async function releaseUrgentPush(ctx, config, options = {}) {
   const reason = reasonOf(options.reason);
+  if (options.lintBaseline !== undefined) throw refusal('RELEASE_URGENT_LINT_BASELINE_RETIRED', 'an urgent release no longer lints (owner ruling urgent-typecheck-build): lint runs in the back-fill, so --lint-baseline has nothing to judge');
   const role = options.role ?? 'unset';
   const remote = options.remote ?? 'origin';
   const branch = config.defaultBranch;
@@ -112,7 +80,7 @@ export async function releaseUrgentPush(ctx, config, options = {}) {
   const { head, chosen } = facts;
   const common = releaseDir(ctx);
   const dir = path.join(common, head.slice(0, 12));
-  const checks = urgentGates(ctx, config, config.tagPrefix, options.lintBaseline);
+  const checks = urgentGates(config);
   const out = [...facts.out, `urgent         ${URGENT_RULING}`, `reason         ${reason}`, `role           ${role}`, ...planOf(checks)];
   const data = { head, tag: chosen.tag, remote, branch, urgent: true, reason, role, checks: [], pushed: false };
   if (facts.red.length > 0) return { ok: false, lines: [...out, ...facts.red.map((item) => `RED: ${item}`), 'nothing run, nothing pushed.'], data: { ...data, red: facts.red } };

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.32
+    version: 0.15.34
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.8.19
+    version: 3.8.21
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.5.21
+    version: 9.5.23
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.32
+    version: 0.15.34
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.32
+    version: 0.15.34
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.11.20
+    version: 4.11.22
     group: starci
     install: registry
     side: both

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -650,14 +650,8 @@ $defs:
         pattern: '^[A-Za-z0-9][A-Za-z0-9._-]*$'
       releasesBase: {$ref: '#/$defs/deployAbsolutePath'}
       sealed:
-        description: 'Owner-machine session for prepare and doctor: members of .starcistacks/<environment>/secrets.'
-        type: object
-        additionalProperties: false
-        required: [ops, sshKey, knownHosts]
-        properties:
-          ops: {$ref: '#/$defs/deployName'}
-          sshKey: {$ref: '#/$defs/deployName'}
-          knownHosts: {$ref: '#/$defs/deployName'}
+        description: 'Owner-machine session for prepare, doctor and deploy: the one member of .starcistacks/<environment>/secrets holding VPS_HOST, VPS_USER, privateKey and knownHosts.'
+        $ref: '#/$defs/deployName'
       serverRecipient:
         description: The deploy server's public age recipient, recorded by starci app secret server-key <env> --execute.
         type: string
@@ -865,5 +859,11 @@ $defs:
       where: {type: string, minLength: 1}
       member: {type: string, pattern: '^[a-z0-9][a-z0-9-]*$', description: "The provider member holding this key (`secrets/<member>`, the slug of where); with key, the entry declares one key of it."}
       key: {type: string, pattern: '^[A-Z][A-Z0-9_]*$', description: "The one key of the member this entry declares; materialized as its own file, read by the app as <KEY>_FILE."}
+      keys:
+        description: The keys a member groups on purpose (several providers in one member), declared in one entry instead of an entry per key; every one must be in the member's envelope.
+        type: array
+        minItems: 1
+        uniqueItems: true
+        items: {type: string, pattern: '^[A-Za-z][A-Za-z0-9_]*$'}
       recipientPolicy: {type: string, minLength: 1, description: "Which age recipients the envelope is encrypted to: its environment's rule of the app's managed .sops.yaml."}
       keyCustody: {type: string, minLength: 1, description: "Where the shared decrypting identity is held; docs/host-secrets.md owns host custody and its execution prerequisites."}

package/runtime/scripts/hfs/gate-threshold.mjs

@@ -0,0 +1,36 @@
+// gate-threshold.mjs - the verdict of `starci app check` and `starci app lint` (owner ruling gate-threshold-20, 2026-10-30): green
+// while fewer than GATE_ERROR_LIMIT error findings remain and none of them is a hard blocker, so a release is not held back finding
+// by finding (5, 4, 3, ...) by the last few structural nits. A plaintext secret, a failed boot proof and a broken migration block at
+// any count. Every finding is still printed; only the exit code changes. Typecheck, build and the tests are not judged here.
+
+export const GATE_ERROR_LIMIT = 20;
+
+/** The limit in force: policy/quality.yaml `gate.errorLimit`, handed in by the harness CLI as STARCI_GATE_ERROR_LIMIT, else 20. */
+export function gateErrorLimit(env = process.env) {
+  const value = Number(env.STARCI_GATE_ERROR_LIMIT);
+  return Number.isInteger(value) && value > 0 ? value : GATE_ERROR_LIMIT;
+}
+export const GATE_THRESHOLD_RULING = 'owner ruling gate-threshold-20 2026-10-30: app check and lint pass under 20 error findings with no plaintext secret, boot proof or migration finding';
+
+/** The codes that block at any count: plaintext secrets, the boot proof, the migrations. */
+export const HARD_BLOCKERS = Object.freeze(new Set([
+  'HFS_PLAINTEXT_SECRET', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'RT_SECRET_TRACKED',
+  'STACKS_SECRET_ENV_LITERAL', 'APP_SECRET_IN_CI', 'BE_LOG_SECRET',
+  'BE_APP_BOOT_PROOF_MISSING',
+  'DB_MIGRATION_SHAPE', 'DB_MIGRATION_DESTRUCTIVE', 'LITE_DB_MIGRATION', 'BE_MIGRATION_REVERSIBLE',
+]));
+
+/**
+ * The verdict over the error findings (each with `code`): { pass, count, hard, line }. `pass` is true when no hard blocker is
+ * among them and there are fewer than GATE_ERROR_LIMIT; `line` says which, for the report.
+ */
+export function gateVerdict(errors, limit = gateErrorLimit()) {
+  const hard = [...new Set(errors.map((finding) => finding.code).filter((code) => HARD_BLOCKERS.has(code)))].sort();
+  const count = errors.length;
+  const pass = hard.length === 0 && count < limit;
+  const line = count === 0 ? null
+    : hard.length > 0 ? `gate: red, ${hard.join(', ')} block${hard.length === 1 ? 's' : ''} at any count (${count} error finding(s))`
+      : pass ? `gate: green under the threshold, ${count} error finding(s) < ${limit} and no hard blocker (owner ruling gate-threshold-20); they stay listed above`
+        : `gate: red, ${count} error finding(s), the threshold is fewer than ${limit}`;
+  return { pass, count, hard, line };
+}

package/runtime/scripts/hfs/secret-standard.mjs

@@ -20,21 +20,31 @@ export const providerOf = (key) => key.split("_")[0].toLowerCase();
 const sameSet = (left, right) => left.length === right.length && left.every((item) => right.includes(item));
 const keyList = (keys) => keys.join(", ");
 
+/** The member a `secrets:` entry names: `member`, else the slug of `where`, else its `name`. */
+const memberOfEntry = (entry) => entry?.member ?? /^secrets\/([a-z0-9-]+)/u.exec(entry?.where ?? "")?.[1] ?? entry?.name;
+
 /** The keys an environment's `secrets:` declares for `member`: an entry naming `key` with that `member`, or a whole-member entry. */
 function declaredKeys(spec, member, keys) {
   const entries = Array.isArray(spec?.secrets) ? spec.secrets : [];
-  const memberOfEntry = (entry) => entry?.member ?? /^secrets\/([a-z0-9-]+)/u.exec(entry?.where ?? "")?.[1] ?? entry?.name;
   if (entries.some((entry) => entry?.key === undefined && memberOfEntry(entry) === member)) return keys;
   return entries.filter((entry) => entry?.key !== undefined && memberOfEntry(entry) === member).map((entry) => entry.key);
 }
 
+/** The keys of the one sealed SSH member `deploy.remote.sealed` names (stack/remote.mjs): the deploy transport reads exactly these. */
+const SSH_GROUP = Object.freeze(["VPS_HOST", "VPS_USER", "privateKey", "knownHosts"]);
+
 /**
- * True when the stack groups `member` on purpose: the environment's `secrets:` declares every key of it per key, naming this member.
- * A member the owner groups (an app's own keys, the keys one service reads) holds keys of several first words by design.
+ * True when the stack groups `member` on purpose: every key of it is declared in the environment's `secrets:`, per key (`key` with
+ * `member: <member>`) or in the `keys` list of an entry naming the member, or is a key of the sealed SSH member the deploy names.
+ * A member the owner groups (an app's own keys, the keys one service reads, the VPS session) holds keys of several first words by design.
  */
 function declaredGroup(spec, member, keys) {
   const entries = Array.isArray(spec?.secrets) ? spec.secrets : [];
-  return keys.length > 0 && keys.every((key) => entries.some((entry) => entry?.key === key && entry?.member === member));
+  const sealed = spec?.deploy?.remote?.sealed;
+  const ssh = (typeof sealed === "string" ? [sealed] : Object.values(sealed ?? {})).includes(member) ? SSH_GROUP : [];
+  const declared = (key) => ssh.includes(key) || entries.some((entry) => memberOfEntry(entry) === member
+    && (entry?.key === key || (Array.isArray(entry?.keys) && entry.keys.includes(key))));
+  return keys.length > 0 && keys.every(declared);
 }
 
 /** The tracked member file names of one environment, or null outside a git work tree. */
@@ -75,7 +85,7 @@ export function auditSecrets(repoRoot, environment = null) {
       const providers = [...new Set(envelope.keys.map(providerOf))];
       if (isLegacyName(name)) add("LEGACY_MEMBER", `is a dotenv .enc member; move it: starci app secret migrate ${env} ${member} [--to <provider>] --execute`);
       if (providers.length > 1 && !declaredGroup(spec, member, envelope.keys))
-        add("MIXED_PROVIDERS", `holds keys of ${providers.length} providers by their first word (${providers.join(", ")}) that the stack does not group in it; split it (starci app secret split ${env} ${member} [--group KEY=member] --execute) or declare each key with member: ${member} in environments.${env}.secrets`);
+        add("MIXED_PROVIDERS", `holds keys of ${providers.length} providers by their first word (${providers.join(", ")}) that the stack does not group in it; split it (starci app secret split ${env} ${member} [--group KEY=member] --execute) or declare its keys in environments.${env}.secrets (an entry naming ${member} with keys: [...])`);
       const wanted = recipientsFor(repoRoot, path.join(directory, `${member}${MEMBER_SUFFIX}`));
       if (!isLegacyName(name) && wanted.length && !sameSet(wanted, envelope.recipients))
         add("RECIPIENT_DRIFT", `is sealed to ${keyList(envelope.recipients)}, its environment's rule names ${keyList(wanted)}; seal it again: starci app secret migrate ${env} ${member} --execute`);

package/runtime/scripts/hfs/stack-deploy-config.mjs

@@ -65,9 +65,12 @@ function remote(c, block) {
   if (block.releasesBase !== undefined && (!REMOTE_BASE.test(String(block.releasesBase)) || String(block.releasesBase).includes('..')))
     c.problem('deploy.remote.releasesBase', 'must be an absolute path without ..');
   let sealed = null;
-  if (block.sealed !== undefined && closedFields(c, 'deploy.remote.sealed', block.sealed, FIELDS.sealed)) {
-    for (const key of FIELDS.sealed) nameField(c, `deploy.remote.sealed.${key}`, block.sealed[key]);
-    sealed = { ...block.sealed };
+  // One member holds VPS_HOST, VPS_USER, privateKey and knownHosts (`sealed: vps`); it plays all three SSH roles of the transport.
+  if (typeof block.sealed === 'string') {
+    nameField(c, 'deploy.remote.sealed', block.sealed);
+    sealed = Object.fromEntries(FIELDS.sealed.map((key) => [key, block.sealed]));
+  } else if (block.sealed !== undefined) {
+    c.problem('deploy.remote.sealed', 'names one member holding VPS_HOST, VPS_USER, privateKey and knownHosts (sealed: vps); fold a member per role into it with starci app secret migrate <env> <member> --to vps --into-existing');
   }
   return { host: block.host ?? 'vps', releasesBase: block.releasesBase ?? null, sealed, serverRecipient: block.serverRecipient ?? null };
 }

package/runtime/scripts/hfs/stacks-gate.mjs

@@ -264,6 +264,12 @@ const checkSecret=(secret,at,{envDir,environment,root,tracked,secretNames,add})=
     add('encrypted-ref-invalid',`${at}.where`,'secret must resolve to <where>.enc.yaml (or a legacy <where>.enc) as a recognizable SOPS envelope, an existing regular file below the environment directory');
   else if(nonempty(secret.key)&&!envelopeOf(fs.readFileSync(enc,'utf8')).keys.includes(secret.key))
     add('encrypted-ref-invalid',`${at}.key`,`the member at ${secret.where} holds no ${secret.key}`);
+  else if(Array.isArray(secret.keys)){
+    // A grouped member declares its keys in one entry; each must be in the envelope, and one entry declares one key or a group, not both.
+    if(nonempty(secret.key))add('encrypted-ref-invalid',`${at}.keys`,'an entry declares one key (key) or a group (keys), not both');
+    const held=envelopeOf(fs.readFileSync(enc,'utf8')).keys;
+    for(const key of secret.keys.filter(key=>!held.includes(key)))add('encrypted-ref-invalid',`${at}.keys`,`the member at ${secret.where} holds no ${key}`);
+  }
   if(nonempty(secret.where)&&!plain)
     add('materialized-path-invalid',`${at}.where`,'secret plaintext path and its existing ancestors must remain below the environment directory without symlinks');
   if(!String(secret.recipientPolicy??'').trim()||!String(secret.keyCustody??'').trim())

package/src/main.mjs

@@ -73,6 +73,7 @@ import { dbBaselineMain } from '../runtime/scripts/hfs/db-baseline-verb.mjs';
 import { dbRestampMain } from '../runtime/scripts/hfs/db-restamp-verb.mjs';
 import { dbPlanMain } from '../runtime/scripts/hfs/db-plan-verb.mjs';
 import { formatCoverageReport } from '../runtime/scripts/hfs/coverage-from.mjs';
+import { gateVerdict } from '../runtime/scripts/hfs/gate-threshold.mjs';
 import { HFS_DECLARATION_FILE, HfsSlotsError, loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
 import { formatFindings } from '../sync/format.mjs';
 import { main as syncMain } from '../sync/cli.mjs';
@@ -116,11 +117,11 @@ starci app db migrate [--execute] [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app db drift [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app release gate [--execute] [--source <ref>] [--tag-prefix <prefix>] [--backfill <tag>] [--json] [--cwd <dir>]
-starci app release push [--execute] [--remote <name>] [--urgent --reason <text> [--lint-baseline <tag>]] [--json] [--cwd <dir>]
+starci app release push [--execute] [--remote <name>] [--urgent --reason <text>] [--json] [--cwd <dir>]
 starci app upgrade [--plan] [--cwd <dir>]
 starci app stack <up|down|status> [--stack <dir>] [--services <list>] [--k3d] [--force] [--json] [--cwd <dir>]
 starci app stack <prepare|doctor|connect|disconnect|build-args|render|deploy|converge|verify|rollback|prune|backup|jobs> --env <env> [--execute] [--json] [--cwd <dir>]
-starci app stack deploy --env <env> --source-sha <sha> --urgent [--db-url-env <NAME>] [--backup-out <dir>] [--first-start --db-service <service>] [--execute] [--json] [--cwd <dir>]
+starci app stack deploy --env <env> --urgent (--reason <text> [--remote <name>] | --source-sha <sha> --image <service>=<ref>) [--db-url-env <NAME>] [--backup-out <dir>] [--first-start --db-service <service>] [--execute] [--json] [--cwd <dir>]
 starci app explain <path> [--cwd <dir>] [--json]
 starci app emit [--cwd <dir>]
 starci app new service <dir> <name> [--inject <binding>...] [--cwd <dir>]
@@ -363,9 +364,11 @@ async function checkMain(opts, { cwd: repoRoot, harness, edition, stdout: out, p
   const existing = changed ? changed.filter(file => fs.existsSync(path.join(repoRoot, file))) : [];
   const eslint = await eslintRepository({ repoRoot, changed, existing, run: runLinter });
   const findings = [...proof.findings, ...eslint.findings.map(finding => ({ ...finding, code: finding.code ?? finding.rule, level: 'error' }))];
-  const result = { ...proof, findings, counts: { ...proof.counts, error: proof.counts.error + eslint.findings.length }, eslint: { ...eslint.engine, errors: eslint.errors }, ok: proof.ok && eslint.findings.length === 0 && eslint.errors.length === 0 };
+  // Green under the threshold (gate-threshold.mjs): every finding is still listed, only the verdict changes.
+  const verdict = gateVerdict(findings.filter(finding => finding.level === 'error'));
+  const result = { ...proof, findings, counts: { ...proof.counts, error: proof.counts.error + eslint.findings.length }, eslint: { ...eslint.engine, errors: eslint.errors }, ok: verdict.pass && eslint.errors.length === 0, gate: verdict };
   if (opts.json) out(`${JSON.stringify(result, null, 2)}\n`);
-  else { printCheck(result, out); printCheckProofs(result, out); }
+  else { printCheck(result, out); printCheckProofs(result, out); if (verdict.line) out(`${verdict.line}\n`); }
   return eslint.errors.length ? 2 : result.ok ? 0 : 1;
 }
 
@@ -435,8 +438,8 @@ function declaredEdition(cwd) {
  * `starci app stack`: the deploy actions (prepare, doctor, render, deploy, converge, verify, rollback, prune, backup, jobs, ...) are the Swarm
  * tooling of stack/cli.mjs; up, down and status are the full edition's test-world infrastructure.
  */
-async function stackAppMain(argv, { cwd, edition, stackMain, stdout: out, stderr: err, env, sops, hostIdentity, stackIo }) {
-  if (STACK_ACTIONS.includes(argv[0])) return deployStackMain(argv, { ...stackIo, cwd, stdout: out, stderr: err, env, hostIdentity, ...(sops ? { sops } : {}) });
+async function stackAppMain(argv, { cwd, edition, stackMain, stdout: out, stderr: err, env, sops, hostIdentity, stackIo, harness }) {
+  if (STACK_ACTIONS.includes(argv[0])) return deployStackMain(argv, { ...stackIo, cwd, stdout: out, stderr: err, env, hostIdentity, harness, ...(sops ? { sops } : {}) });
   if ((edition ?? declaredEdition(cwd)) === 'lite') throw new Error('starci app stack up|down|status manage the local test world of the full edition; a lite app starts its local database with npm run db:start');
   const run = stackMain ?? await installedStackMain(cwd);
   return run(argv, { cwd, out, err });

package/stack/cli.mjs

@@ -8,6 +8,7 @@ import { loadDeployConfig } from './config.mjs';
 import { withDockerTransport } from './docker-transport.mjs';
 import { StackError, EXIT, refusal } from './errors.mjs';
 import { parseTargetBinding, bindStackTarget, nativeToolEnvironment } from './target-binding.mjs';
+import { oneCommand, prepareUrgentRelease } from './urgent-release.mjs';
 
 /** The actions that drive the docker CLI of the operator machine (pointed at the manager by docker-transport.mjs when the key is sealed). */
 const DOCKER_ACTIONS = new Set(['deploy', 'accept', 'converge', 'verify', 'rollback', 'prune']);
@@ -15,7 +16,7 @@ const DOCKER_ACTIONS = new Set(['deploy', 'accept', 'converge', 'verify', 'rollb
 export const ACTIONS = Object.freeze(['prepare', 'doctor', 'connect', 'disconnect', 'build-args', 'render', 'deploy', 'converge', 'verify', 'rollback', 'prune', 'backup', 'jobs', 'task', 'ingress', 'retire', 'build', 'accept']);
 
 const BOOLEAN = new Set(['--execute', '--json', '--swarm-state', '--init-swarm', '--owner-approved', '--fix-live-restore', '--skip-public', '--skip-internal', '--allow-unpinned', '--push', '--urgent', '--first-start']);
-const VALUE = new Set(['--env', '--image', '--source-sha', '--previous', '--out', '--release', '--since', '--timeout', '--retry', '--keep', '--app', '--ssh-cmd', '--extra-compose', '--project', '--target-binding', '--db-url-env', '--backup-out', '--db-service']);
+const VALUE = new Set(['--env', '--image', '--source-sha', '--previous', '--out', '--release', '--since', '--timeout', '--retry', '--keep', '--app', '--ssh-cmd', '--extra-compose', '--project', '--target-binding', '--db-url-env', '--backup-out', '--db-service', '--reason', '--remote']);
 const REPEAT = new Set(['--image', '--keep', '--extra-compose', '--project']);
 
 /** Splits argv into { flags, positional }; an unknown flag or a flag without its value is a refusal. */
@@ -72,7 +73,7 @@ const OPTIONS = {
     images: parseImages(flags.image), sourceSha: flags['source-sha'], execute: flags.execute === true,
     out: flags.out ? path.resolve(cwd, flags.out) : null, timeoutSeconds: number(flags, 'timeout'), retrySeconds: number(flags, 'retry'), skipPublic: flags['skip-public'] === true,
     urgent: flags.urgent === true, dbUrlEnv: flags['db-url-env'], backupOut: flags['backup-out'] ? path.resolve(cwd, flags['backup-out']) : undefined,
-    firstStart: flags['first-start'] === true, dbService: flags['db-service'],
+    firstStart: flags['first-start'] === true, dbService: flags['db-service'], reason: flags.reason, remote: flags.remote,
   }),
   converge: ({ flags }) => ({ since: flags.since, timeoutSeconds: number(flags, 'timeout') }),
   verify: ({ flags }) => ({ retrySeconds: number(flags, 'retry'), skipPublic: flags['skip-public'] === true, skipInternal: flags['skip-internal'] === true }),
@@ -127,15 +128,27 @@ export async function stackMain(argv, io = {}) {
     if (binding && (!['deploy', 'verify'].includes(action) || flags['ssh-cmd'] || flags['skip-public'] || flags['skip-internal']))
       throw refusal('STACK_USAGE', 'the bound native consumer supports only complete deploy or verify');
     const config = bindStackTarget(ctx, loadDeployConfig({ repoRoot: ctx.cwd, env: flags.env ?? 'production' }), binding);
-    if (action !== 'deploy' && (flags.urgent || flags['db-url-env'] || flags['backup-out'] || flags['first-start'] || flags['db-service'])) throw refusal('STACK_USAGE', '--urgent, --db-url-env, --backup-out, --first-start and --db-service belong to deploy');
+    if (action !== 'deploy' && (flags.urgent || flags['db-url-env'] || flags['backup-out'] || flags['first-start'] || flags['db-service'] || flags.reason || flags.remote)) throw refusal('STACK_USAGE', '--urgent, --db-url-env, --backup-out, --first-start, --db-service, --reason and --remote belong to deploy');
+    if (!flags.urgent && (flags.reason || flags.remote)) throw refusal('STACK_USAGE', '--reason and --remote release HEAD in the one-command urgent deploy: add --urgent');
     if (!flags.urgent && (flags['first-start'] || flags['db-service'])) throw refusal('STACK_USAGE', '--first-start and --db-service are the first start of an empty database under the urgent floor: add --urgent');
     if (action === 'deploy' && !flags.urgent && (flags['db-url-env'] || flags['backup-out'])) throw refusal('STACK_USAGE', '--db-url-env and --backup-out choose the urgent floor\'s database and backup folder: add --urgent');
-    const options = OPTIONS[action]({ flags, positional, cwd: ctx.cwd });
+    let options = OPTIONS[action]({ flags, positional, cwd: ctx.cwd });
+    // The one-command urgent deploy releases HEAD and builds its images here, before the Docker transport reaches the server.
+    let prepared = null;
+    if (action === 'deploy' && oneCommand(options)) {
+      prepared = await prepareUrgentRelease(ctx, config, { ...options, role: io.harness?.role ?? ctx.env.STARCI_ROLE });
+      if (!prepared.images) {
+        print(ctx, action, flags, prepared);
+        return prepared.ok ? EXIT.ok : EXIT.failed;
+      }
+      options = { ...options, images: prepared.images, sourceSha: prepared.sourceSha };
+    }
     const handler = await handlerOf(action, io.importer ?? ((file) => import(file)));
     const sshCmd = flags['ssh-cmd'] ?? null;
     const call = (context) => handler(context, config, { ...options, sshCmd });
     const toolContext = nativeToolContext(ctx, binding);
-    const result = DOCKER_ACTIONS.has(action) ? await withDockerTransport(toolContext, config, { sshCmd }, call) : await call(toolContext);
+    const ran = DOCKER_ACTIONS.has(action) ? await withDockerTransport(toolContext, config, { sshCmd }, call) : await call(toolContext);
+    const result = prepared ? { ...ran, lines: [...prepared.lines, ...(ran.lines ?? [])] } : ran;
     print(ctx, action, flags, result);
     // A floor step of an urgent deploy that failed is a refusal with its own code (urgent-floor.mjs), printed after the lines that led to it.
     if (result.refused) {

package/stack/urgent-release.mjs

@@ -0,0 +1,45 @@
+// urgent-release.mjs - the one-command urgent release (owner ruling urgent-typecheck-build, 2026-10-30):
+//   starci app stack deploy --env <env> --urgent --reason "<text>" [--execute]
+// with no --image and no --source-sha takes HEAD from the laptop to the server in one command, CI not involved:
+//   1. the urgent release of HEAD (release/urgent.mjs: typecheck and the build, tag, one atomic push, the urgent record), skipped when HEAD
+//      already has a pushed urgent record;
+//   2. the images of that tag built and pushed on THIS machine's Docker (stack/build.mjs), which yields their digests;
+//   3. the urgent deploy of those digests (stack/urgent-floor.mjs): backup, migrate preview then execute, deploy, verify, rollback on red.
+// Steps 1 and 2 run before the deploy's Docker transport reaches the server, so nothing is ever built on the server. A dry run prints the
+// urgent release plan and the build plan and stops: the deploy plan needs the digests the build makes.
+import { buildImages } from './build.mjs';
+import { refusal } from './errors.mjs';
+import { git, releaseDir } from '../release/gate.mjs';
+import { loadReleaseConfig } from '../release/index.mjs';
+import { readUrgent } from '../release/records.mjs';
+import { releaseUrgentPush } from '../release/urgent.mjs';
+
+/** True when an urgent deploy names neither images nor a source commit: the one-command form. */
+export const oneCommand = (options) => options.urgent === true && !options.sourceSha && Object.keys(options.images ?? {}).length === 0;
+
+/**
+ * Steps 1 and 2 on the local machine. options: { execute, reason, role, remote }. Returns { ok, lines, data } to print when it stops (a dry run,
+ * a red step), or { ok: true, lines, images, sourceSha } for the deploy to continue with.
+ */
+export async function prepareUrgentRelease(ctx, config, options, deps = {}) {
+  const d = { buildImages, loadReleaseConfig, releaseUrgentPush, ...deps };
+  const head = git(ctx, ['rev-parse', 'HEAD']).stdout;
+  const lines = [`one-command urgent release of ${head.slice(0, 12)} (owner ruling urgent-typecheck-build): urgent release, local build and push, urgent deploy`];
+  const record = readUrgent(releaseDir(ctx), head);
+  if (record?.pushed === true) lines.push(`urgent release ${record.tag} of ${head.slice(0, 10)} already pushed: reused`);
+  else {
+    if (options.reason === undefined) throw refusal('STACK_URGENT_REASON_MISSING', 'the one-command urgent deploy releases HEAD first and says why: --reason "<text>"');
+    const pushed = await d.releaseUrgentPush(ctx, d.loadReleaseConfig(ctx.cwd), { execute: options.execute, reason: options.reason, role: options.role, remote: options.remote });
+    lines.push(...pushed.lines);
+    if (!pushed.ok) return { ok: false, lines, data: { head, step: 'release', ...pushed.data } };
+    if (options.execute !== true) {
+      lines.push('then: the images of that tag are built and pushed on this machine (stack build --push), then the urgent deploy runs the floor on their digests.');
+      return { ok: true, lines: [...lines, 'dry run: nothing tagged, built or deployed.'], data: { head, step: 'release', executed: false } };
+    }
+  }
+  const built = await d.buildImages(ctx, config, { push: true, execute: options.execute === true });
+  lines.push(...built.lines);
+  if (!built.ok) return { ok: false, lines, data: { head, step: 'build', ...built.data } };
+  if (options.execute !== true) return { ok: true, lines: [...lines, 'then: the urgent deploy runs the floor on the pushed digests.', 'dry run: nothing built or deployed.'], data: { head, step: 'build', executed: false } };
+  return { ok: true, lines, images: built.data.images, sourceSha: built.data.sha };
+}

package/release/lint-baseline.mjs

@@ -1,123 +0,0 @@
-// lint-baseline.mjs - the lint row of an urgent release judged against a baseline release tag (`release push --urgent --lint-baseline <tag>`,
-// owner ruling urgent-lint-baseline 2026-10-29: an app whose lint backlog predates the release ships when the release adds no finding of its own).
-// The managed lint (`npm run lint`, which ends in `starci app lint`) runs twice, each writing its findings as a Sonar Generic Issue Import file
-// (`-- --sonar <file>`): at HEAD, and at the baseline tag in a throwaway `git worktree` that borrows HEAD's installs (each node_modules folder is
-// linked in as a directory junction, unlinked before the worktree is removed, never deleted through). A finding is the same finding when its
-// engine, rule, file and message match (lines move); a finding left over is then matched on engine, rule and message alone (a file that moved).
-// What HEAD holds beyond the baseline is new: zero new findings is green, any is red, and a lint that could not run on either side is red. The
-// row names both counts and both reports with their sha256, and the new findings go to lint-new.json beside the record, so the back-fill's full
-// gate (which this changes nothing in) still sees the whole backlog.
-import { createHash, randomBytes } from 'node:crypto';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { refusal } from '../stack/errors.mjs';
-import { git, runGate } from './gate.mjs';
-
-/** The owner's ruling a baseline-judged lint row cites. */
-export const LINT_BASELINE_RULING = 'owner ruling urgent-lint-baseline 2026-10-29: an urgent release whose lint is red only with findings its baseline tag already had ships; a new finding is red';
-const LINK_DEPTH = 3;
-const NEW_SHOWN = 50;
-
-const sha256 = (file) => createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-
-/** The findings of a Sonar Generic Issue Import file as { engine, rule, file, line, message }, or null when it is missing or unreadable. */
-export function sonarFindings(file) {
-  let doc;
-  try { doc = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
-  if (!doc || !Array.isArray(doc.issues)) return null;
-  return doc.issues.map((issue) => ({
-    engine: String(issue.engineId ?? ''), rule: String(issue.ruleId ?? ''), file: String(issue.primaryLocation?.filePath ?? ''),
-    line: issue.primaryLocation?.textRange?.startLine ?? null, message: String(issue.primaryLocation?.message ?? ''),
-  }));
-}
-
-/** The findings of `head` the `baseline` does not hold: matched on engine, rule, file and message, then the rest on engine, rule and message. */
-export function newFindings(head, baseline) {
-  const take = (pool, key) => { const left = pool.get(key) ?? 0; if (left === 0) return false; pool.set(key, left - 1); return true; };
-  const exact = (finding) => `${finding.engine}\u0000${finding.rule}\u0000${finding.file}\u0000${finding.message}`;
-  const loose = (finding) => `${finding.engine}\u0000${finding.rule}\u0000${finding.message}`;
-  const exactPool = new Map();
-  for (const finding of baseline) exactPool.set(exact(finding), (exactPool.get(exact(finding)) ?? 0) + 1);
-  const unmatched = head.filter((finding) => !take(exactPool, exact(finding)));
-  const loosePool = new Map();
-  for (const finding of baseline) {
-    const left = exactPool.get(exact(finding)) ?? 0;
-    if (left > 0) { exactPool.set(exact(finding), left - 1); loosePool.set(loose(finding), (loosePool.get(loose(finding)) ?? 0) + 1); }
-  }
-  return unmatched.filter((finding) => !take(loosePool, loose(finding)));
-}
-
-/** Every node_modules folder of `root` within LINK_DEPTH levels (never inside one), app-relative. */
-function installFolders(root) {
-  const found = [];
-  const walk = (rel, depth) => {
-    let entries;
-    try { entries = fs.readdirSync(path.join(root, rel), { withFileTypes: true }); } catch { return; }
-    for (const entry of entries) {
-      if (!entry.isDirectory() || entry.name === '.git') continue;
-      const child = rel ? path.join(rel, entry.name) : entry.name;
-      if (entry.name === 'node_modules') found.push(child);
-      else if (depth < LINK_DEPTH) walk(child, depth + 1);
-    }
-  };
-  walk('', 0);
-  return found;
-}
-
-/** Removes a link made by this module: the link alone, never what it points at. */
-function unlink(link) {
-  try { fs.unlinkSync(link); } catch { try { fs.rmdirSync(link); } catch { /* already gone */ } }
-}
-
-/** The lint of `gate` with its findings written to `report`: { row, findings } (findings null when the lint could not run). */
-function lintTo(ctx, gate, { name, report, dir, platform }) {
-  fs.rmSync(report, { force: true });
-  const row = runGate(ctx, { ...gate, name, command: [...gate.command, '--', '--sonar', report] }, { dir, platform, credentialNames: [] });
-  const ran = row.pass || row.detail === 'exit 1';
-  return { row, findings: ran ? sonarFindings(report) : null };
-}
-
-/**
- * The lint row of an urgent release against `tag`: { name, command, pass, detail, log, logSha256, baseline }. Refuses a tag that is not a
- * commit. `dir` is the record folder of HEAD, where both reports, both logs and lint-new.json are written.
- */
-export function baselineLint(ctx, gate, { tag, dir, platform }) {
-  const commit = git(ctx, ['rev-parse', '--verify', '--quiet', `${tag}^{commit}`], { allowFail: true });
-  if (commit.code !== 0 || commit.stdout === '') throw refusal('RELEASE_URGENT_LINT_BASELINE_TAG', `--lint-baseline ${tag} names no commit`);
-  fs.mkdirSync(dir, { recursive: true });
-  const headReport = path.join(dir, 'lint-head.sonar.json');
-  const head = lintTo(ctx, gate, { name: 'lint', report: headReport, dir, platform });
-  const row = (pass, detail, baseline = null) => ({ ...head.row, pass, detail, baseline: baseline && { tag, commit: commit.stdout, ruling: LINT_BASELINE_RULING, ...baseline } });
-  if (head.findings === null) return row(false, `the lint at HEAD could not run (${head.row.detail})`);
-  if (head.findings.length === 0) return row(true, 'no finding at HEAD', { findings: 0, headFindings: 0, newFindings: 0 });
-  const tree = path.join(os.tmpdir(), `starci-lint-baseline-${randomBytes(4).toString('hex')}`);
-  const links = [];
-  const added = git(ctx, ['worktree', 'add', '--detach', tree, commit.stdout], { allowFail: true });
-  if (added.code !== 0) return row(false, `the baseline worktree of ${tag} could not be made`);
-  try {
-    for (const rel of installFolders(ctx.cwd)) {
-      const link = path.join(tree, rel);
-      if (fs.existsSync(link) || !fs.existsSync(path.dirname(link))) continue;
-      fs.symlinkSync(path.join(ctx.cwd, rel), link, 'junction');
-      links.push(link);
-    }
-    const baseReport = path.join(dir, 'lint-baseline.sonar.json');
-    const base = lintTo(Object.create(ctx, { cwd: { value: tree } }), gate, { name: 'lint-baseline', report: baseReport, dir, platform });
-    if (base.findings === null) return row(false, `the lint at the baseline ${tag} could not run (${base.row.detail}; log ${base.row.log})`);
-    const fresh = newFindings(head.findings, base.findings);
-    fs.writeFileSync(path.join(dir, 'lint-new.json'), `${JSON.stringify(fresh, null, 2)}\n`);
-    const counts = {
-      findings: base.findings.length, headFindings: head.findings.length, newFindings: fresh.length,
-      headReport, headReportSha256: sha256(headReport), baselineReport: baseReport, baselineReportSha256: sha256(baseReport), baselineLog: base.row.log,
-      newShown: fresh.slice(0, NEW_SHOWN).map((finding) => `${finding.file}:${finding.line ?? '-'} ${finding.rule} ${finding.message}`),
-    };
-    const detail = `${head.findings.length} finding(s) at HEAD, ${base.findings.length} at ${tag}, ${fresh.length} new${fresh.length > 0 ? ` (${path.join(dir, 'lint-new.json')})` : ''}`;
-    return row(fresh.length === 0, detail, counts);
-  } finally {
-    links.reverse().forEach(unlink);
-    // A link still present would let the removal delete through it into HEAD's installs: the worktree then stays for a person to unlink.
-    if (links.every((link) => !fs.existsSync(link))) git(ctx, ['worktree', 'remove', '--force', tree], { allowFail: true });
-    else ctx.stderr?.(`lint baseline: ${tree} keeps a linked node_modules; unlink it (cmd /c rmdir <link>) before removing the worktree\n`);
-  }
-}