@starci/hfs 4.2.12 → 4.2.14

package/runtime/scripts/hfs/architecture/transport-owner.mjs

@@ -2,36 +2,44 @@ import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
 
 /**
- * R50 `transport-owner` (FE_TRANSPORT_OWNER), the machine half of the eslint rules `fetch-only-in-api-client` and
- * `client-fetch-has-signal`. ESLint judges one file at a time by the spelling of a call; the machine judges the repository by
- * what the checker resolves. A repository has exactly ONE transport client and ONE Outcome union, both named by slot (never
- * by a path spelled here): the api package's (`fe.package.api.client`, `fe.package.api.outcome`) when the repository shares
- * it, or the only app's (`fe.transport.client`, `fe.transport.outcome`) when the repository declares exactly one app. The
- * Outcome homes are the slots the manifest marks `outcomeHome` (the lite edition adds `fe.modules.db.outcome`), not a list kept here.
+ * R50 `transport-owner` (FE_TRANSPORT_OWNER), the machine half of the eslint transport rules. ESLint judges one file at a time by
+ * the spelling of a call; the machine judges the repository by what the checker resolves. The browser calls the back end through
+ * Apollo GraphQL and axios (owner ruling 2026-10-13, both editions). A repository has exactly ONE transport client folder (the auth
+ * and no-auth Apollo clients with their link chain) and ONE GraphQLResponse union, both named by slot (never by a path spelled here):
+ * the api package's (`fe.package.api.client`, `fe.package.api.outcome`) when several apps call the back end, or the app's own
+ * (`fe.transport.client`, `fe.transport.outcome`) when exactly one app does. An app calls the back end when it holds a file of the
+ * api owner (modules/api, its client and union) or imports the api package; an app that holds neither (a marketing landing) shares
+ * no transport and is not counted. The union homes are the slots the manifest marks `outcomeHome`, not a list kept here.
  *
- *   - two or more clients, or two or more Outcome unions, in the repository (two apps each keeping one, or a package one plus
- *     an app one) are findings on every copy;
- *   - an app client or app Outcome union in a repository that declares more than one app is a finding (it belongs to the package);
- *   - the client calls the global `fetch` (a client that never calls it has its transport somewhere else);
- *   - no other file references the global `fetch`: a call, `globalThis.fetch`, `window.fetch`, or a reference passed as a value
- *     (`useSWR(key, fetch)`, `const send = fetch`), all of which a spelling-based rule misses; with no client at all every such
- *     reference is a finding that says the repository has no client;
- *   - no file imports an HTTP library, by static import, `import()` or `require()`;
- *   - every server reader (`modules/api/<domain>/read-*.ts`) imports the client (or the api package that holds it), so a reader
- *     is a caller of the one transport and not a second one.
+ *   - two or more client folders, or two or more unions, in the repository (two apps each keeping one, or a package one plus an
+ *     app one) are findings on every copy;
+ *   - an app client or app union in a repository where more than one app calls the back end is a finding (it belongs to the package);
+ *   - no file outside the client folder references the global `fetch`: a call, `globalThis.fetch`, `window.fetch`, or a
+ *     reference passed as a value (`useSWR(key, fetch)`, `const send = fetch`), all of which a spelling-based rule misses; with no
+ *     client at all every such reference is a finding that says the repository has no client;
+ *   - axios is imported only by the api owner (modules/api, the api package) for its rest calls; every other HTTP library is a
+ *     second transport wherever it is imported, by static import, `import()` or `require()`;
+ *   - an `ApolloClient` is constructed only inside the client folder;
+ *   - every GraphQL operation (`graphql/queries/query-*.ts`, `graphql/mutations/mutation-*.ts`) imports the client (or the api
+ *     package that holds it), so an operation is a caller of the one transport and not a second one.
  */
 export const TRANSPORT_OWNER_RULE_IDS = ['FE_TRANSPORT_OWNER'];
 
 const RULE = 'FE_TRANSPORT_OWNER';
-/** Packages that send HTTP requests: a second transport when a file imports one. */
+/** Packages that send HTTP requests: a second transport when a file imports one (axios only outside the api owner). */
 const HTTP_LIBRARIES = new Set(['axios', 'ky', 'ky-universal', 'got', 'node-fetch', 'undici', 'cross-fetch', 'isomorphic-fetch', 'superagent', 'ofetch', 'whatwg-fetch']);
+const REST_LIBRARY = 'axios';
 const GLOBAL_OBJECTS = new Set(['globalThis', 'window', 'self', 'global']);
-const API_SLOT = 'fe.modules.api';
 const APP_CLIENT_SLOT = 'fe.transport.client';
 const APP_OUTCOME_SLOT = 'fe.transport.outcome';
 const PACKAGE_API_SLOT = 'fe.package.api';
 const CLIENT_SLOTS = new Set([APP_CLIENT_SLOT, 'fe.package.api.client']);
-const NO_CLIENT = "the repository has no transport client. Create the one client (packages/<family>-api/src/client.ts, or the only app's modules/api/client.ts) and call it.";
+/** The api owner: the slots whose files may import axios (the rest calls and the client's own links). */
+const API_OWNER_SLOTS = new Set(['fe.modules.api', PACKAGE_API_SLOT, ...CLIENT_SLOTS]);
+/** The slots that hold the GraphQL operations of an app or of the api package. */
+const OPERATION_SLOTS = new Set(['fe.modules.api', PACKAGE_API_SLOT]);
+const OPERATION_FILE = /^(?:query|mutation)-[^/]+\.ts$/u;
+const NO_CLIENT = "the repository has no transport client. Create the one Apollo client folder (packages/<family>-api/src/graphql/clients/, or the only app's modules/api/graphql/clients/) and call the back end through it.";
 
 /** True when `node` names the global fetch: no import, and no declaration outside a lib declaration file. */
 function isGlobalObjectFetch(ts, node) {
@@ -59,12 +67,14 @@ function isGlobalFetch(ts, kit, checker, node) {
   return declarations.every(declaration => declaration.getSourceFile().isDeclarationFile);
 }
 
-function reportMultiplicity(items, noun, nextApps, report, list) {
-  for (const file of items) {
+/** Findings on every copy when there are several, and on an app's own copy in a repository where several apps call the back end. */
+function reportMultiplicity(items, noun, callingApps, report) {
+  const list = items.map(item => item.root).join(', ');
+  for (const item of items) {
     if (items.length > 1) {
-      report(file, file.sourceFile, `The repository has ${items.length} ${noun}s (${list(items)}); it has exactly one: the api package's (packages/<family>-api/src/) when the apps share it, or the only app's. Keep one and delete the others.`);
-    } else if ((file.slot === APP_CLIENT_SLOT || file.slot === APP_OUTCOME_SLOT) && nextApps.length > 1) {
-      report(file, file.sourceFile, `${file.rel} is an app's ${noun} in a repository of ${nextApps.length} apps; a repository with several apps keeps its one ${noun} in the api package (packages/<family>-api/src/).`);
+      report(item, item.sourceFile, `The repository has ${items.length} ${noun}s (${list}); it has exactly one: the api package's (packages/<family>-api/src/graphql/) when the apps share it, or the only app's. Keep one and delete the others.`);
+    } else if ((item.slot === APP_CLIENT_SLOT || item.slot === APP_OUTCOME_SLOT) && callingApps.length > 1) {
+      report(item, item.sourceFile, `${item.root} is an app's ${noun} in a repository of ${callingApps.length} apps that call the back end (${callingApps.join(', ')}); a repository where several apps call the back end keeps its one ${noun} in the api package (packages/<family>-api/src/graphql/).`);
     }
   }
 }
@@ -81,40 +91,80 @@ function moduleSpecifierOf(ts, node) {
   return null;
 }
 
-function inspectTransportNode({ ts, kit, checker, file, node, isClient, clientCalls, clients, owned, report }) {
+function isApolloClientConstruction(ts, kit, checker, node) {
+  if (!ts.isNewExpression(node)) return false;
+  const binding = kit.importBinding(checker, node.expression);
+  return Boolean(binding && binding.name === 'ApolloClient' && binding.module.startsWith('@apollo/client'));
+}
+
+function inspectLibraryImport({ ts, file, node, transport, report }) {
+  const specifier = moduleSpecifierOf(ts, node);
+  if (!specifier || !ts.isStringLiteralLike(specifier)) return;
+  const library = specifier.text.split('/')[0];
+  if (!HTTP_LIBRARIES.has(library) || (library === REST_LIBRARY && API_OWNER_SLOTS.has(file.slot))) return;
+  const where = library === REST_LIBRARY
+    ? 'axios belongs to the api owner only (modules/api/rest, the api package): call its rest functions'
+    : `the transport is Apollo GraphQL (${transport}) with axios for the rest calls of modules/api/rest`;
+  report(file, node, `${specifier.text} is a second HTTP transport in ${file.rel}; ${where}.`, { library: specifier.text });
+}
+
+function inspectTransportNode(scope, node) {
+  const { ts, kit, checker, file, isClient, owned, report } = scope;
   const fetchUse = globalFetchUse(ts, kit, checker, node);
   if (fetchUse !== null) {
-    if (isClient) clientCalls.value += 1;
-    else if (fetchUse === 'property') report(file, node, `${node.getText(file.sourceFile)} reaches the global fetch outside the transport client; ${owned}`);
+    if (isClient) return false;
+    if (fetchUse === 'property') report(file, node, `${node.getText(file.sourceFile)} reaches the global fetch outside the transport client; ${owned}`);
     else report(file, node, `fetch is used outside the transport client (called, aliased or passed as a value); ${owned}`);
     return false;
   }
-  const specifier = moduleSpecifierOf(ts, node);
-  if (specifier && ts.isStringLiteralLike(specifier) && HTTP_LIBRARIES.has(specifier.text.split('/')[0])) {
-    report(file, node, `${specifier.text} is a second HTTP transport; the repository's one transport is built on fetch (${clients.length ? clients.map(item => item.rel).join(', ') : 'no client exists yet'}). Use the client.`, { library: specifier.text });
-  }
+  if (!isClient && isApolloClientConstruction(ts, kit, checker, node)) report(file, node, `${file.rel} constructs an ApolloClient outside the transport client folder; ${owned}`);
+  inspectLibraryImport({ ...scope, node });
   return true;
 }
 
-function inspectTransportFiles({ files, graph, kit, ts, clientRels, clients, owned, report }) {
+/** True when the operation imports the client folder, or (from an app) the api package that holds it. */
+function reachesClient(graph, file, clientRels) {
+  return graph.edges.some(edge => {
+    if (edge.from !== file.rel || !edge.runtime) return false;
+    if (clientRels.has(edge.to)) return true;
+    return file.slot !== PACKAGE_API_SLOT && (graph.files.get(edge.to)?.slot ?? '').startsWith(PACKAGE_API_SLOT);
+  });
+}
+
+function inspectTransportFiles({ files, graph, kit, ts, clientRels, transport, owned, report }) {
   const appsWithFiles = new Set();
-  let readers = 0;
+  let operations = 0;
   for (const file of files) {
-    const bindings = kit.resolver.classifyPath(file.rel).bindings;
-    if (bindings?.app) appsWithFiles.add(bindings.app);
-    const checker = kit.checkerOf(file.sourceFile);
-    const isClient = clientRels.has(file.rel);
-    const clientCalls = { value: 0 };
-    kit.walk(file.sourceFile, node => inspectTransportNode({ ts, kit, checker, file, node, isClient, clientCalls, clients, owned, report }));
-    if (isClient && clientCalls.value === 0) report(file, file.sourceFile, `${file.rel} never calls the global fetch; the client is the one module that owns fetch, with its timeout and abort signal.`);
-    if (file.slot === API_SLOT && bindings?.app && path.posix.basename(file.rel).startsWith('read-')) {
-      readers += 1;
-      const reachesClient = graph.edges.some(edge => edge.from === file.rel && edge.runtime
-        && (clientRels.has(edge.to) || graph.files.get(edge.to)?.slot === PACKAGE_API_SLOT));
-      if (!reachesClient) report(file, file.sourceFile, `${file.rel} is a server reader that does not import the transport client; a reader fetches through the repository's one client, never through its own transport.`);
+    if (file.bindings?.app) appsWithFiles.add(file.bindings.app);
+    const scope = { ts, kit, checker: kit.checkerOf(file.sourceFile), file, isClient: clientRels.has(file.rel), transport, owned, report };
+    kit.walk(file.sourceFile, node => inspectTransportNode(scope, node));
+    if (OPERATION_SLOTS.has(file.slot) && OPERATION_FILE.test(path.posix.basename(file.rel))) {
+      operations += 1;
+      if (!reachesClient(graph, file, clientRels)) report(file, file.sourceFile, `${file.rel} is a GraphQL operation that does not import the transport client; an operation runs through the repository's one Apollo client, never through its own transport.`);
     }
   }
-  return { appsWithFiles, readers };
+  return { appsWithFiles, operations };
+}
+
+/**
+ * The declared Next apps that call the back end: those holding a file of an api owner slot (modules/api, the app client, the app
+ * union) or importing a file of the api package. An app with neither shares no transport.
+ */
+function transportApps(nextApps, files, graph) {
+  const byRel = new Map(files.map(file => [file.rel, file]));
+  const calling = new Set(files.filter(file => API_OWNER_SLOTS.has(file.slot) && file.slot !== PACKAGE_API_SLOT).map(file => file.bindings?.app));
+  for (const edge of graph.edges) {
+    const app = byRel.get(edge.from)?.bindings?.app;
+    if (app && (byRel.get(edge.to)?.slot ?? '').startsWith(PACKAGE_API_SLOT)) calling.add(app);
+  }
+  return nextApps.map(item => item.name).filter(name => calling.has(name));
+}
+
+/** One instance per client folder (its slot root), carried by the folder's first file. */
+function clientInstances(clients) {
+  const byRoot = new Map();
+  for (const file of [...clients].sort((a, b) => a.rel.localeCompare(b.rel))) if (!byRoot.has(file.root)) byRoot.set(file.root, file);
+  return [...byRoot.values()];
 }
 
 export function checkTransportOwner(input) {
@@ -124,16 +174,22 @@ export function checkTransportOwner(input) {
   const violations = [];
   const report = (file, node, message, extra = {}) => violations.push({ ruleId: RULE, path: file.rel, ...kit.at(file.rel, file.sourceFile, node), message, ...extra });
   const nextApps = resolver.repo.apps.filter(item => item.kind === 'next');
-  const files = [...graph.files.values()].filter(file => file.slot && file.tier !== 'e2e');
+  const files = [...graph.files.values()].filter(file => file.slot && file.tier !== 'e2e').map(file => {
+    const classified = resolver.classifyPath(file.rel);
+    return { ...file, root: classified.root ?? file.rel, bindings: classified.bindings };
+  });
   const clients = files.filter(file => CLIENT_SLOTS.has(file.slot));
-  const outcomes = files.filter(file => resolver.slot(file.slot)?.outcomeHome === true);
+  const instances = clientInstances(clients);
+  const outcomes = files.filter(file => resolver.slot(file.slot)?.outcomeHome === true).map(file => ({ ...file, root: file.rel }));
   const clientRels = new Set(clients.map(file => file.rel));
-  const list = items => items.map(item => item.rel).join(', ');
-  const owned = clients.length ? `the repository has one transport (${list(clients)}). Call the client and take its Outcome.` : NO_CLIENT;
+  const transport = instances.length ? instances.map(item => item.root).join(', ') : 'no client exists yet';
+  const owned = instances.length ? `the repository has one transport (${transport}). Call the back end through a modules/api operation and take its GraphQLResponse.` : NO_CLIENT;
 
-  // Exactly one client and one Outcome union per repository.
-  for (const [items, noun] of [[clients, 'transport client'], [outcomes, 'Outcome union']]) reportMultiplicity(items, noun, nextApps, report, list);
+  // Exactly one client folder and one GraphQLResponse union per repository.
+  const calling = transportApps(nextApps, files, graph);
+  reportMultiplicity(instances, 'transport client', calling, report);
+  reportMultiplicity(outcomes, 'GraphQLResponse union', calling, report);
 
-  const { appsWithFiles, readers } = inspectTransportFiles({ files, graph, kit, ts, clientRels, clients, owned, report });
-  return { violations, coverage: { status: 'checked', apps: appsWithFiles.size, readers, clients: clients.length, outcomes: outcomes.length } };
+  const { appsWithFiles, operations } = inspectTransportFiles({ files, graph, kit, ts, clientRels, transport, owned, report });
+  return { violations, coverage: { status: 'checked', apps: appsWithFiles.size, operations, clients: instances.length, outcomes: outcomes.length } };
 }

package/runtime/scripts/hfs/architecture/type-context.mjs

@@ -156,7 +156,10 @@ function unresolvedReferenceFinding(reference, sourceFile, project, config, work
   const codeLike = !helpers.assetExtension.test(reference.specifier);
   const workspaceImport = [...workspaceNames].some(name => helpers.sameOrUnder(reference.specifier, name));
   const internal = reference.specifier.startsWith('.') || helpers.pathAliasMatches(reference.specifier, project.options.paths) || workspaceImport;
-  if (codeLike && internal) errors.push({
+  // A __generated__/ folder is the gitignored output of the app's codegen step (the GraphQL wire types, fe-stack codegen): it
+  // exists after `npm run codegen`, which lint, typecheck and build run first, and the compiler proves those imports there.
+  const generated = /(?:^|\/)__generated__(?:\/|$)/.test(reference.specifier);
+  if (codeLike && internal && !generated) errors.push({
     ruleId: 'ARCH_INTERNAL_IMPORT_UNRESOLVED',
     project: project.relative,
     path: helpers.relativePath(config.root, sourceFile.fileName),

package/runtime/scripts/hfs/check.mjs

@@ -22,9 +22,11 @@
 //   HFS_CONTRACT_SNAPSHOT_DRIFT   (R23, rules/contract.mjs) an uncommitted back-end snapshot, or a front-end copy that differs from it
 //   BE_TEST_TOPOLOGY              (R47, rules/test-topology.mjs) a `.test` file, a testing/ folder, a second jest configuration
 //   FE_NO_TESTS                   (R97, rules/fe-no-tests.mjs) a front end holds a spec, e2e or test-tool file, a test script or a test dependency; no exception
+//   FE_STACK_FORBIDDEN            (rules/fe-stack.mjs) a front-end manifest (the fe side's, or the app root's minus the back end's own libraries)
+//                                 declares a package knowledge/hfs/fe-stack.yaml forbids
 //   HFS_LITE_SECRET_CUSTODY       (R220, rules/supabase-secrets.mjs) under edition lite: secret material or a forbidden custody path; the R06 scan itself runs for every edition
-//   HFS_EDITION_FORBIDDEN_PRESENT (R212, rules/edition.mjs) under edition lite: a test script, dependency or tool config in a
-//                                 package.json or the tree, or a declared worker app, event pattern or trigger kind lite does not have
+//   HFS_EDITION_FORBIDDEN_PRESENT (R212, rules/edition.mjs) under edition lite: an e2e, contract, stack or browser script, or a
+//                                 dependency of self-hosted infrastructure (test containers, fault proxy, BullMQ, Kafka, Redis)
 //   DB_MIGRATION_SHAPE ... DB_TYPES_DRIFT (R213-R216, rules/database.mjs, async: passed in as extraFindings) the Supabase migrations, policies, definer functions, buckets, config.toml and generated types
 //   BE_SPEC_PLACEMENT             (R102, rules/spec-placement.mjs) a spec or test file outside the four test layers, scripts/ and tools/ included
 //   HFS_REPO_LOCAL_CHECK          (R103, rules/repo-local-checks.mjs) a local eslint rule or plugin, a `check-*` script, a relative import in eslint.config
@@ -78,6 +80,7 @@ import { checkAppRoot, trackedTreeView } from './architecture/hfs.mjs';
 import { testTopologyFindings } from './rules/test-topology.mjs';
 import { feNoTestsFindings } from './rules/fe-no-tests.mjs';
 import { editionFindings } from './rules/edition.mjs';
+import { feStackFindings } from './rules/fe-stack.mjs';
 import { byCodeUnit } from '../lib/list.mjs';
 import { pinFindings } from './pin-findings.mjs';
 // The database rules (R213-R216) read SQL through a WASM parser, so they are async: `starci app check` calls them beside the other emitters and passes the findings in as `extraFindings`.
@@ -100,7 +103,7 @@ export const CHECK_CODES = Object.freeze([
   'HFS_MANAGED_FILE_DRIFT', 'HFS_TOOL_CONFIG_LOCAL', 'HFS_RULE_OFF_WITHOUT_REPLACEMENT', 'HFS_TS_STRICT',
   'HFS_PLAINTEXT_SECRET', 'HFS_STACKS_SHAPE', 'HFS_CI_MISSING_CANON', 'HFS_DEP_VERSION_SKEW', 'HFS_CONTRACT_SNAPSHOT_DRIFT',
   'BE_TEST_TOPOLOGY', 'BE_SPEC_PLACEMENT', 'HFS_REPO_LOCAL_CHECK', 'HFS_LINT_SUPPRESSION_FILE', 'HFS_PROOF_COMMAND_FILE_MISSING', 'HFS_PEER_INTEGRATION_MISSING', 'BE_INTEGRATION_SPEC_MISSING', 'FE_GRAPHQL_CONTRACT', 'FE_NO_TESTS', 'HFS_MONO_WORKSPACES', 'HFS_MONO_FE_WORKSPACE', 'HFS_MONO_NEST_PROJECTS', 'HFS_MONO_WORKSPACE_DEP', 'BE_CLI_REQUIRED', 'FE_WIRE_GENERATED', 'FE_I18N_PLACEMENT', 'FE_I18N_CATALOG', 'HFS_SERVICE_PLACEMENT', 'HFS_IMAGE_UNPINNED', 'HFS_SERVICE_STACK_DECLARATION', 'HFS_EVENT_CONTRACT', 'BE_ASYNC_SPEC_MISSING', 'BE_SAGA_STEP_COMPENSATION', 'BE_SAGA_STATE_VERSIONED', 'BE_SAGA_EVENT_CONTRACT', 'BE_SAGA_CONSUMER_DEDUPE', 'BE_EVENT_CLASS_CONTRACT', 'BE_PATTERN_SPEC_MISSING', 'BE_CONTRACT_BREAKING', 'BE_KIND_DECLARATION', 'BE_KIND_EMPTY', 'HFS_DOCKER_BUILD_CONTEXT', 'HFS_DOCKER_STAGES', 'HFS_DOCKER_ENTRY', 'HFS_DOCKER_BASE_PIN', 'HFS_DOCKER_SECRETS', 'BE_SAGA_E2E_MISSING',
-  'HFS_EDITION_FORBIDDEN_PRESENT', 'HFS_LITE_SECRET_CUSTODY',
+  'FE_STACK_FORBIDDEN', 'HFS_EDITION_FORBIDDEN_PRESENT', 'HFS_LITE_SECRET_CUSTODY',
   'DB_MIGRATION_SHAPE', 'DB_RLS_REQUIRED', 'DB_DYNAMIC_DDL', 'DB_POLICY_SHAPE', 'DB_DEFINER_SAFE', 'DB_STORAGE_POLICY', 'DB_CONFIG_POLICY', 'DB_TYPES_DRIFT',
   'HFS_GITIGNORE_BLOCK_DRIFT', 'HFS_SONAR_CONFIG', 'HFS_COVERAGE_SCOPE_DRIFT', 'HFS_FORMAT',
   'HFS_EMPTY_DIR', 'HFS_GHOST_TREE', 'HFS_UNTRACKED_ROOT_ENTRY',
@@ -242,11 +245,12 @@ function minimumInstanceFindings(resolver, required, instances) {
   return findings;
 }
 
-function contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, editionDeclaration }) {
+function contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, editionDeclaration, manifest }) {
   const findings = [
     ...pinFindings({ repoRoot, files, profile: repo.profile, pins, only: scoped }),
     ...supabaseSecretFindings({ repoRoot, files: files.filter((file) => inScope(file)), resolver, repo }),
-    ...editionFindings({ repoRoot, files: files.filter((file) => inScope(file)), repo, resolver, withDeclaration: editionDeclaration }),
+    ...editionFindings({ repoRoot, files: files.filter((file) => inScope(file)), repo, resolver, manifest, withDeclaration: editionDeclaration }),
+    ...feStackFindings({ repoRoot, files: files.filter((file) => inScope(file)), repo, manifest }),
     ...repoLocalCheckFindings({ repoRoot, files }),
     ...lintSuppressionFindings({ repoRoot, files }),
   ];
@@ -295,7 +299,7 @@ function scopeFindings({ repoRoot, root, repo, resolver, files, all = files, sco
   if (repo.kind === RUNTIME_KIND) return findings;
 
   const pins = readPins(root);
-  findings.push(...contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, editionDeclaration }));
+  findings.push(...contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, editionDeclaration, manifest }));
   if (!isRoot) findings.push(...sizeSoftFindings({ repoRoot, resolver, files, inScope }));
   return findings;
 }

package/runtime/scripts/hfs/edition-slots.mjs

@@ -1,5 +1,7 @@
 // edition.mjs - the one edition filter shared by the HFS slot resolver, declaration validation, rule catalog and
 // edition-specific rule parameters. Full is the default; lite changes data views, never the checks that consume them.
+// Lite is the full architecture deployed without self-hosted infrastructure (owner ruling 2026-10-12): its overlays swap
+// adapters and remove the infra and e2e world, and every slot keeps its own `tests`.
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { EDITIONS } from './manifest-shape.mjs';
 
@@ -15,7 +17,7 @@ export function slotInEdition(manifest, slot, edition) {
   return (slot.editions ?? manifest.editions ?? EDITIONS).includes(edition);
 }
 
-/** The slot as `edition` sees it: lite overlays its data, presence and tracking while forbidding every test world. */
+/** The slot as `edition` sees it: lite overlays its data, presence and tracking; `tests` stays the slot's own (lite keeps the unit specs). */
 export function effectiveSlot(slot, profile, edition) {
   if (edition !== 'lite') return slot;
   const { lite, litePresence, ...base } = slot;
@@ -23,7 +25,7 @@ export function effectiveSlot(slot, profile, edition) {
   let tracked = slot.tracked;
   if (presence === 'forbidden') tracked = 'external';
   else if (tracked === 'external') tracked = 'tracked';
-  return { ...base, ...lite, presence, tracked, tests: 'none' };
+  return { ...base, ...lite, presence, tracked };
 }
 
 /** The template group starci app sync renders `slot` from under `edition`: `liteManagedBy` (else `managedBy`) in lite, `managedBy` otherwise; undefined when unmanaged. */
@@ -59,10 +61,17 @@ export function enforcerJudgedInEdition(rules, kind, id, edition = 'full') {
   return owners.every((rule) => judgedInEdition(rule, edition) && rule.enforcers.filter((enforcer) => enforcer.kind === kind && enforcer.id === id).every((enforcer) => judgedInEdition(enforcer, edition)));
 }
 
-/** A frozen copy of one profile's parameters, with its lite overrides applied only in the lite edition. */
+/**
+ * A frozen copy of one profile's parameters, with its lite overrides applied only in the lite edition. A lite key whose base
+ * value and override are both maps merges one level deep (lite.infraOwners restates only the specifiers whose owner changes);
+ * any other value replaces the base.
+ */
 export function editionRuleParams(params, edition) {
   const { lite, ...base } = params;
-  const merged = edition === 'lite' && lite ? { ...base, ...lite } : base;
+  const merged = edition === 'lite' && lite ? { ...base } : base;
+  if (edition === 'lite' && lite) {
+    for (const [key, value] of Object.entries(lite)) merged[key] = isPlainObject(value) && isPlainObject(base[key]) ? { ...base[key], ...value } : value;
+  }
   const deepFreeze = (value) => { if (value && typeof value === 'object') { Object.values(value).forEach(deepFreeze); } return Object.freeze(value); };
   return deepFreeze(structuredClone(merged));
 }

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -86,9 +86,9 @@ export const MANIFEST_KINDS = [APP_KIND, RUNTIME_KIND];
 export const manifestKind = (m) => (isPlainObject(m) && m.kind !== undefined ? m.kind : APP_KIND);
 const strList = (v) => stringList(v);
 
-const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'anonymousActions'];
+const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome'];
 /** The fields a slot's `lite` overlay may hold: the same keys it would carry in the slot body, resolved under edition lite. */
-const LITE_OVERLAY_KEYS = ['path', 'requires', 'allows', 'forbids', 'minInstances', 'requiredInstances'];
+const LITE_OVERLAY_KEYS = ['path', 'requires', 'allows', 'forbids', 'minInstances', 'requiredInstances', 'why'];
 /** A runtime slot has no app kind, side composition, layer or managed template; it may name the generator of a generated copy. */
 const RUNTIME_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'minInstances', 'requires', 'allows', 'forbids', 'budget', 'rules', 'goesTo', 'why', 'since', 'generatedBy', 'parent', 'coverage'];
 
@@ -197,6 +197,7 @@ function slotLiteOverlayProblems(slot, at) {
   if (slot.lite === undefined) return [];
   const ok = isPlainObject(slot.lite) && Object.keys(slot.lite).length && Object.keys(slot.lite).every((key) => LITE_OVERLAY_KEYS.includes(key))
     && (slot.lite.path === undefined || (typeof slot.lite.path === 'string' && slot.lite.path))
+    && (slot.lite.why === undefined || (typeof slot.lite.why === 'string' && slot.lite.why.trim()))
     && ['requires', 'allows', 'forbids'].every((key) => slot.lite[key] === undefined || strList(slot.lite[key]))
     && (slot.lite.minInstances === undefined || (Number.isInteger(slot.lite.minInstances) && slot.lite.minInstances >= 1))
     && (slot.lite.requiredInstances === undefined || (isPlainObject(slot.lite.requiredInstances) && Object.values(slot.lite.requiredInstances).every((v) => strList(v) && v.length)));
@@ -211,7 +212,6 @@ function slotEntryProblems(slot, at) {
     else if (typeof slot.path !== 'string' || !slot.path.endsWith('/') || slot.owner === true) bad.push(`${at}: entries belong to a directory slot that is not an owner (they name extra public entries of the owner that holds it)`);
     else if (Array.isArray(slot.allows) && slot.entries.some((entry) => !slot.allows.includes(entry))) bad.push(`${at}: every entry must be one of the names the slot allows`);
   }
-  if (slot.anonymousActions !== undefined && !(strList(slot.anonymousActions) && slot.anonymousActions.length > 0 && new Set(slot.anonymousActions).size === slot.anonymousActions.length && slot.anonymousActions.every(relPath) && typeof slot.path === 'string' && slot.path.endsWith('/'))) bad.push(`${at}: anonymousActions must be a non-empty list of unique relative file paths of a directory slot`);
   if (slot.outcomeHome !== undefined && !(slot.outcomeHome === true && typeof slot.path === 'string' && slot.path && !slot.path.endsWith('/'))) bad.push(`${at}: outcomeHome is true and belongs to a file slot (the one file that declares the repository's Outcome union)`);
   return bad;
 }

package/runtime/scripts/hfs/rule-catalog.mjs

@@ -15,7 +15,9 @@ const RULE_KINDS = Object.freeze(['codemod', 'lint', 'check', 'design']);
 const FINDING_CODE = /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/;
 const ENFORCER_ID = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const FILE_ENFORCERS = new Set(['machine', 'hfs', 'work-validate', 'sonar', 'runtime']);
-const RULE_KEYS = new Set(['id', 'code', 'law', 'scope', 'kinds', 'gates', 'failureCodes', 'editions', 'enforcers']);
+const RULE_KEYS = new Set(['id', 'code', 'law', 'scope', 'kinds', 'gates', 'failureCodes', 'editions', 'enforcers', 'cases']);
+const CASE_KEYS = new Set(['id', 'date', 'source', 'ruling', 'quote']);
+const CASE_DATE = /^\d{4}-\d{2}-\d{2}$/;
 const ENFORCER_KEYS = new Set(['kind', 'id', 'status', 'at', 'editions']);
 
 function vocabularyProblems(catalog, key, names, bad) {
@@ -59,6 +61,23 @@ function checkRuleText(rule, label, bad) {
   if (rule.scope !== undefined && rule.scope !== 'runtime') bad.push(`${label}.scope is absent or runtime`);
 }
 
+/** The dated owner cases of a rule: each {id case-N, date, source owner, ruling, quote?}, ids unique (an owner ruling recorded where the law lives). */
+function checkRuleCases(rule, label, bad) {
+  if (rule.cases === undefined) return;
+  if (!Array.isArray(rule.cases) || !rule.cases.length) { bad.push(`${label}.cases must be a non-empty list`); return; }
+  const ids = new Set();
+  rule.cases.forEach((item, index) => {
+    const at = `${label}.cases[${index}]`;
+    if (!isPlainObject(item)) { bad.push(`${at} is not a map`); return; }
+    for (const key of Object.keys(item)) if (!CASE_KEYS.has(key)) bad.push(`${at} has unknown key ${key}`);
+    if (typeof item.id !== 'string' || !/^case-[1-9][0-9]*$/.test(item.id) || ids.has(item.id)) bad.push(`${at}.id must be a unique case-N`);
+    ids.add(item.id);
+    if (typeof item.date !== 'string' || !CASE_DATE.test(item.date)) bad.push(`${at}.date must be YYYY-MM-DD`);
+    if (item.source !== 'owner') bad.push(`${at}.source must be owner`);
+    for (const key of ['ruling', ...(item.quote === undefined ? [] : ['quote'])]) if (typeof item[key] !== 'string' || !item[key].trim()) bad.push(`${at}.${key} must be text`);
+  });
+}
+
 function checkRuleGates(label, gates, bad) {
   if (!gates.length) return;
   if (!gates.includes('land')) bad.push(`${label} must run at the land gate (every rule does)`);
@@ -120,6 +139,7 @@ function checkRule(rule, index, catalog, codeOwner, bad) {
   }
   checkRuleIdentity(rule, index, catalog, at, label, bad);
   checkRuleText(rule, label, bad);
+  checkRuleCases(rule, label, bad);
   enumListProblems(rule, label, 'kinds', RULE_KINDS, bad);
   bad.push(...ruleEditionProblems(rule, label));
   const gates = enumListProblems(rule, label, 'gates', RULE_GATES, bad);

package/runtime/scripts/hfs/rules/database-constants.mjs

@@ -9,5 +9,9 @@ export const DB_CONFIG_POLICY = 'DB_CONFIG_POLICY';
 export const DB_TYPES_DRIFT = 'DB_TYPES_DRIFT';
 
 export const MIGRATIONS_DIR = 'supabase/migrations';
+/** The migrations retired at a baseline cutover (slot app.supabase.migrations.archive): never applied, never judged by L02-L08. */
+export const MIGRATIONS_ARCHIVE_DIR = `${MIGRATIONS_DIR}/_archive`;
+/** True for a migration the Supabase CLI applies: a path under supabase/migrations/ outside the archive. */
+export const isActiveMigration = (file) => file.startsWith(`${MIGRATIONS_DIR}/`) && !file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`);
 export const CONFIG_FILE = 'supabase/config.toml';
 export const TYPES_FILE = 'supabase/types/database.types.ts';

package/runtime/scripts/hfs/rules/database-migrations.mjs

@@ -8,7 +8,7 @@ import { withoutGitLocalEnv } from '../../lib/git.mjs';
 import { eachInOrder, findInOrder } from '../../lib/in-order.mjs';
 import { sameText } from '../../lib/same-text.mjs';
 import { found, readText } from './read.mjs';
-import { DB_MIGRATION_SHAPE, MIGRATIONS_DIR } from './database-constants.mjs';
+import { DB_MIGRATION_SHAPE, isActiveMigration, MIGRATIONS_ARCHIVE_DIR, MIGRATIONS_DIR } from './database-constants.mjs';
 const MIGRATION_NAME = /^(\d{14})_([a-z0-9]+(?:-[a-z0-9]+)*)\.sql$/;
 
 /** `<ts14>` -> the UTC instant it names, or null when the digits are no real time (month 13, day 32, ...). */
@@ -49,7 +49,7 @@ async function baseMigrationNames(git, repoRoot, sha) {
   const result = await runGit(git, repoRoot, ['ls-tree', '-r', '--name-only', '-z', sha, '--', MIGRATIONS_DIR]);
   if (!result.ok) return [];
   const prefix = `${MIGRATIONS_DIR}/`;
-  return result.stdout.split('\0').filter(Boolean).map((entry) => (entry.startsWith(prefix) ? entry.slice(prefix.length) : entry));
+  return result.stdout.split('\0').filter(Boolean).filter(isActiveMigration).map((entry) => entry.slice(prefix.length));
 }
 
 async function baseFileText(git, repoRoot, sha, file) {
@@ -102,16 +102,20 @@ async function baseMigrationEntryFindings(entry, repoRoot, git, baseSha, onBase,
   return [];
 }
 
-function removedMigrationFindings(local, baseNames, baseSha) {
+function removedMigrationFindings(local, retired, baseNames, baseSha) {
   const findings = [];
   for (const name of baseNames) {
-    if (!local.some((entry) => entry.name === name)) findings.push(found(DB_MIGRATION_SHAPE, `${MIGRATIONS_DIR}/${name}`, `${MIGRATIONS_DIR}/${name} exists on ${baseSha.ref} but is gone here; a migration on the base branch is immutable - restore it`, { base: baseSha.ref }));
+    if (!local.some((entry) => entry.name === name) && !retired.has(name)) findings.push(found(DB_MIGRATION_SHAPE, `${MIGRATIONS_DIR}/${name}`, `${MIGRATIONS_DIR}/${name} exists on ${baseSha.ref} but is gone here; a migration on the base branch is immutable - restore it`, { base: baseSha.ref }));
   }
   return findings;
 }
 
-/** L02 findings for names, stamps, ordering and immutability of supabase/migrations/*.sql. */
-export async function migrationShapeFindings({ repoRoot, migrations, git, base, now }) {
+/**
+ * L02 findings for names, stamps, ordering and immutability of supabase/migrations/*.sql. `archived` are the files of
+ * supabase/migrations/_archive/ (app.supabase.migrations.archive): never judged, and a base migration moved there at a baseline
+ * cutover is retired, not removed.
+ */
+export async function migrationShapeFindings({ repoRoot, migrations, archived = [], git, base, now }) {
   const prefix = `${MIGRATIONS_DIR}/`;
   const local = migrations.map((file) => {
     const name = file.startsWith(prefix) ? file.slice(prefix.length) : file;
@@ -127,6 +131,7 @@ export async function migrationShapeFindings({ repoRoot, migrations, git, base,
   await eachInOrder(local, async (entry) => {
     findings.push(...await baseMigrationEntryFindings(entry, repoRoot, git, baseSha, onBase, baseMax));
   });
-  findings.push(...removedMigrationFindings(local, baseNames, baseSha));
+  const retired = new Set(archived.map((file) => file.slice(MIGRATIONS_ARCHIVE_DIR.length + 1)));
+  findings.push(...removedMigrationFindings(local, retired, baseNames, baseSha));
   return findings;
 }

package/runtime/scripts/hfs/rules/database.mjs

@@ -4,7 +4,7 @@ import { found, readJson, readText } from './read.mjs';
 import { configFindings, parseToml, typesFindings } from './database-config.mjs';
 import { defaultGit, migrationShapeFindings } from './database-migrations.mjs';
 import { migrationSetPolicyFindings, sqlAnalysis } from './database-sql.mjs';
-import { CONFIG_FILE, DB_CONFIG_POLICY, DB_MIGRATION_SHAPE, MIGRATIONS_DIR, TYPES_FILE } from './database-constants.mjs';
+import { CONFIG_FILE, DB_CONFIG_POLICY, DB_MIGRATION_SHAPE, isActiveMigration, MIGRATIONS_ARCHIVE_DIR, TYPES_FILE } from './database-constants.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 import { eachInOrder } from '../../lib/in-order.mjs';
 
@@ -53,7 +53,8 @@ async function migrationAnalyses({ repoRoot, migrations, exposed, forceRls, find
  */
 export async function checkDatabase({ repoRoot, files, base, git, edition, supabase, emitTypes, now = () => Date.now() } = {}) {
   const findings = [];
-  const migrations = files.filter((file) => file.startsWith(`${MIGRATIONS_DIR}/`)).sort(byCodeUnit);
+  const migrations = files.filter(isActiveMigration).sort(byCodeUnit);
+  const archived = files.filter((file) => file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`));
   const declaration = readJson(repoRoot, 'hfs.json');
   const declared = supabase === undefined ? declaration?.supabase : supabase;
   const hasConfig = files.includes(CONFIG_FILE);
@@ -70,7 +71,7 @@ export async function checkDatabase({ repoRoot, files, base, git, edition, supab
   const apiSchemas = (config?.api?.schemas ?? []).filter((schema) => typeof schema === 'string');
   const exposed = new Set(['public', ...apiSchemas]);
   const forceRls = new Set((declared?.forceRls ?? []).map((name) => (name.includes('.') ? name : `public.${name}`)));
-  findings.push(...await migrationShapeFindings({ repoRoot, migrations, git: git ?? defaultGit, base, now }));
+  findings.push(...await migrationShapeFindings({ repoRoot, migrations, archived, git: git ?? defaultGit, base, now }));
 
   const analyses = await migrationAnalyses({ repoRoot, migrations, exposed, forceRls, findings });
   findings.push(