@starci/hfs 4.7.23 → 4.7.24

package/runtime/knowledge/patterns/be/saga.yaml

@@ -20,7 +20,7 @@ provenance:
     - knowledge/hfs/slots.yaml
     - knowledge/hfs/rules.yaml
     - knowledge/patterns/be/services.yaml
-    - examples/ecommerce-app
+    - examples/full-app
   limitations: |-
     The checks read the folder tree, the step and compensation event names, the contracts, the consumers' use of the delivery id
     and the e2e specs. They cannot see that a compensation really undoes its step, that a step is idempotent, or that the

package/runtime/knowledge/sonar-gate.yaml

@@ -8,7 +8,7 @@ purpose: |
   conditions and selects it for the project, and (2) judges an op's slice - the lines it changed - against
   the same numbers. Code-writing ops cannot settle done while the slice is red
   (scripts/kernel/sonar-settle.mjs). Changing a number here changes every repository on the next scan.
-  The gate has two parts: `newCode` (the recent work: coverage, duplication, blocker/critical issues, hotspots) and
+  The gate has two parts: `newCode` (the recent work: coverage, duplication, issues of every severity, hotspots) and
   `overall` (the whole code: coverage, no imported HFS, ESLint or stylelint finding, no bug, code smell or
   vulnerability, every hotspot reviewed, no duplicated-lines excess, no cognitive-complexity issue). The one Sonar
   mechanism of the HFS canon is packages/hfs/README.md section "Sonar".
@@ -26,15 +26,15 @@ newCode:
   coverage:
     metric: new_coverage
     minPercent: 100
-  # SonarQube's ignoreSmallChanges: fewer changed lines than this are not held to duplication.
-  ignoreBelowChangedLines: 20
+  # SonarQube's ignoreSmallChanges floor: 0, so a change of any size is held to duplication.
+  ignoreBelowChangedLines: 0
   duplication:
     metric: new_duplicated_lines_density
     maxPercent: 3
   issues:
-    # An open issue of these severities on a changed line fails the slice; lesser ones are listed, never blocking.
-    blockingSeverities: [BLOCKER, CRITICAL]
-    metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations}
+    # An open issue of any severity on a changed line fails the slice: there is no lesser severity that is only listed.
+    blockingSeverities: [BLOCKER, CRITICAL, MAJOR, MINOR, INFO]
+    metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations, MAJOR: new_major_violations, MINOR: new_minor_violations, INFO: new_info_violations}
     max: 0
   hotspots:
     metric: new_security_hotspots_reviewed
@@ -92,13 +92,13 @@ lite:
     coverage:
       metric: new_coverage
       minPercent: 100
-    ignoreBelowChangedLines: 20
+    ignoreBelowChangedLines: 0
     duplication:
       metric: new_duplicated_lines_density
       maxPercent: 3
     issues:
-      blockingSeverities: [BLOCKER, CRITICAL]
-      metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations}
+      blockingSeverities: [BLOCKER, CRITICAL, MAJOR, MINOR, INFO]
+      metrics: {BLOCKER: new_blocker_violations, CRITICAL: new_critical_violations, MAJOR: new_major_violations, MINOR: new_minor_violations, INFO: new_info_violations}
       max: 0
     hotspots:
       metric: new_security_hotspots_reviewed
@@ -139,9 +139,9 @@ reasoning: |
   lives there, the feature tier is thin (R203) and proven by integration and e2e, and the front end has no unit tests.
   duplication 3: the Sonar way value; the worst project today is 2.1, so 3 rejects a real copy-paste block and
   passes ordinary work.
-  blocker/critical 0: the two severities that are defects, not style. main carries old debt of both kinds
-  (one product repository carries 3 blocker and 137 critical), so the SLICE verdict reads only changed lines and never main's backlog;
-  major and lower are reported on the summary and never fail a slice.
+  issues 0 at every severity (blocker, critical, major, minor, info), owner ruling 2026-10-22 (no loosening): a lesser severity is not a
+  lesser finding. The SLICE verdict reads only changed lines and never main's backlog; the overall condition holds the whole project.
+  A change of any size is held to duplication (ignoreBelowChangedLines 0).
   overall issues 0 and overall duplication 3: the server gate is also the owner's definition of done for the HFS canon:
   a repository that carries any open ESLint, stylelint or HFS finding is not green, whatever the age of the line. The
   op slice keeps judging changed lines (an op cannot fix a repository's whole backlog); the dashboard and CI show the

package/runtime/modules/kernel/failure-codes.yaml

@@ -4712,13 +4712,13 @@ RT_FACT_FALSE:
   kind: check-finding
 
 RT_GATE_LOOSENING:
-  title: "A change loosens a gate without the owner's approval"
-  title_vi: "Một thay đổi nới lỏng cổng kiểm mà chưa có chủ phê duyệt"
-  meaning_vi: "Bỏ một kiểm tra khỏi danh sách của cổng, hạ ngưỡng, thêm một mục vào allowlist, xoá hoặc làm yếu một spec cùng lúc với mã sản phẩm là việc của chủ dự án; commit hoặc lần land đó chỉ qua khi cây gốc đã có mục owner-rulings gate-loosening-<dấu vân> của đúng thay đổi này."
+  title: "A change loosens a gate"
+  title_vi: "Một thay đổi nới lỏng cổng kiểm"
+  meaning_vi: "Bỏ một kiểm tra khỏi danh sách của cổng, hạ ngưỡng, thêm một mục vào allowlist, xoá hoặc làm yếu một spec cùng lúc với mã sản phẩm luôn bị chặn; không có phê duyệt nào cho nới lỏng đi qua, kể cả của chủ (owner ruling loosening-always-red, 2026-10-22)."
   causes_vi:
     - "Một lane gỡ kiểm tra hoặc hạ ngưỡng để cho workflow chạy qua"
     - "Một spec bị xoá hoặc bớt khẳng định trong cùng thay đổi với mã sản phẩm"
-  nextStep_vi: "Khôi phục cổng; nếu chủ thật sự duyệt, chủ thêm mục owner-rulings gate-loosening-<dấu vân> trước, rồi mới land thay đổi."
+  nextStep_vi: "Khôi phục mọi cổng được liệt kê rồi land lại; không có đường duyệt cho nới lỏng."
   owner: owner
   kind: check-finding
 

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -151,9 +151,6 @@ $defs:
       target: {type: number, minimum: 0, maximum: 100}
       components: {enum: [auto]}
       required: {type: boolean}
-      optional:
-        description: Skip an unreachable quality provider with a notice; SonarQube defaults true, SonarCloud and Codecov false.
-        type: boolean
       badgeToken:
         description: >-
           codecov and sonar only: a read-only, public-safe badge token (Codecov graphing token, Sonar project badge token)

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "4018e220cb9abde27d6d8cd79cd502c4d0c64a5312d7549c8e631553a22cb878",
+  "hash": "5bec1a5a568a8294dd40e3e09b7b97693660b8a7c273fcd35594aea87196257a",
   "global": [
     {
       "name": "json",
@@ -1232,18 +1232,18 @@ export const CATALOG = {
           ],
           "impl": null,
           "conventions": [
-            "the gate list is release.gates of application-stacks.yaml (argument arrays), else app-check, audit, then the managed package scripts",
+            "the gate list is release.gates of application-stacks.yaml (argument arrays), else app-check, audit, then every row the managed CI runs",
             "audit runs npm audit --omit=dev --audit-level=high by default; services.audit.level and omitDev configure it,",
             "and an explicit audit.in without release-gate omits it;",
             "declared release.gates gets audit appended if missing",
-            "--sonar appends @sonar/scan@4.3.0 against services.sonar.host (host.public for a host mapping), plus organization for sonarcloud;",
+            "a declared services.sonar is a row (as --sonar): @sonar/scan@4.3.0 against its host (host.public for a mapping), plus organization for sonarcloud;",
             "disabled or unavailable Sonar or an unset token refuses RELEASE_SONAR_UNAVAILABLE",
             "a scanner exit 0 is not a pass: the row polls api/ce/task until the analysis ends, then reads api/qualitygates/project_status with the same token",
             "OK passes; ERROR is red as RELEASE_SONAR_GATE_FAILED naming each failed condition, as is a FAILED or CANCELED task",
             "a task still running after 600 s is RELEASE_SONAR_GATE_TIMEOUT; no report-task, an HTTP 4xx or no gate is RELEASE_SONAR_GATE_UNREADABLE",
             "a network error or HTTP 5xx is retried up to 5 times with backoff inside the 600 s; still failing, it is RELEASE_SONAR_GATE_UNREADABLE",
             "OWNER RULING candidate-ci (2026-10-18): the gate no longer reads the default-branch CI; the verdict is the candidate run of the sha",
-            "release.requireCi (default false, owner ruling release-require-ci-per-project) decides whether push waits for CI; the local gate is never skipped",
+            "release.requireCi (default false, owner ruling release-require-ci-per-project) decides whether push waits for CI; every local gate row runs either way",
             "requireCi false: push needs the tag and the green L4 record, runs the dry run, pushes atomically and states CI was not required",
             "requireCi true: push --execute sends HEAD to refs/heads/release/candidate-<version> first and waits for its ci.yml run",
             "green moves the branch and the tag in one atomic push; red refuses RELEASE_CANDIDATE_CI_RED naming the failing jobs",
@@ -12764,6 +12764,69 @@ export const CATALOG = {
           },
           "runtimeSide": "host"
         },
+        "record": {
+          "summary": "walk one UAT flow in a recorded browser outside a Kernel and file the run as its evidence",
+          "owner": "runtime",
+          "positional": [
+            {
+              "name": "command",
+              "required": true,
+              "variadic": true
+            }
+          ],
+          "flags": [
+            {
+              "name": "work",
+              "type": "string",
+              "required": true,
+              "summary": "the .starciwork root holding the flow"
+            },
+            {
+              "name": "flow",
+              "type": "string",
+              "required": true,
+              "summary": "the work/uat-flow@1 record id to walk"
+            },
+            {
+              "name": "cwd",
+              "type": "string",
+              "summary": "directory the Playwright command runs in (default: the Work root's parent)"
+            },
+            {
+              "name": "environment",
+              "type": "string",
+              "summary": "environment label of the evidence (default: local)"
+            },
+            {
+              "name": "base-url",
+              "type": "string",
+              "summary": "the origin the walk drove, named in the evidence provenance"
+            }
+          ],
+          "exit": {
+            "0": "the walk passed and its evidence is filed",
+            "1": "the walk was recorded and filed but did not pass",
+            "2": "refused: the flow, the run folder or a file is invalid, and nothing is written"
+          },
+          "json": "always",
+          "examples": [
+            "starci uat record --work <app>/.starciwork --flow uat.checkout.place-order --cwd <app> -- npx playwright test -c browser/playwright.config.ts uat-place-order.ts"
+          ],
+          "editions": [
+            "full"
+          ],
+          "impl": {
+            "script": "scripts/uat/uat-record.mjs"
+          },
+          "conventions": [
+            "the command holds one UAT slot and runs through the browser recorder, as a uat.verify step does (video, trace, screenshots)",
+            "it writes manifest.yaml, result.md and screens/*.png into UAT_RUN_DIR; the recorder adds videos/<flow>.webm",
+            "every run file becomes a blob; an example's Work also gets the same verified bytes in examples/.runtimes/<app>/artifacts",
+            "evidence.yaml is written with actor uat-record; the outcome is pass only when the command exits 0 and its manifest says pass",
+            "the flow record's own index.yaml is never edited: state, proves and blockedBy are a person's or a Kernel operation's act"
+          ],
+          "runtimeSide": "host"
+        },
         "slots": {
           "summary": "inspect UAT slots, end the ones whose lessee is gone, or run a command while holding one",
           "owner": "runtime",

package/runtime/scripts/hfs/architecture/automatic-gates.mjs

@@ -10,7 +10,7 @@ const E2E_COMMAND = new RegExp([
   String.raw`src\/tests\/(?:world|integration|e2e|contract)\b|`,
   String.raw`jest[^\n|&;]*(?:e2e|integration|contract)`,
 ].join(''), 'u');
-const UNIT_RUN_SCRIPTS = ['test', 'test:unit', 'test:ci', 'test:affected', 'test:coverage', 'test:cov'];
+const UNIT_RUN_SCRIPTS = ['test', 'test:unit', 'test:ci', 'test:coverage', 'test:cov'];
 
 const runsE2e = text => E2E_COMMAND.test(String(text).replace(/--ignore-pattern[= ]+(?:"[^"]*"|'[^']*'|\S+)/gu, ''));
 const withoutComments = text => text.split('\n').filter(line => !/^\s*#/u.test(line)).join('\n');

package/runtime/scripts/hfs/ci-declaration.mjs

@@ -42,13 +42,13 @@ export function qualityServices(doc, { example = false } = {}) {
   const dependabot = services.dependabot ?? {}, audit = services.audit ?? {};
   return {
     sonar: !sonar || sonar.mode === 'disabled' ? null : {
-      provider: sonar.provider, mode: sonar.mode, optional: sonar.optional ?? sonar.provider === 'sonarqube', host: sonar.host?.public || sonar.host?.local || null,
+      provider: sonar.provider, mode: sonar.mode, host: sonar.host?.public || sonar.host?.local || null,
       organization: sonar.organization ?? null,
       organizationVar: sonar.ci?.organizationVar ?? (sonar.provider === 'sonarcloud' && (example || list(sonar.runtimeSecrets).length > 0) && !list(sonar.credentials).length ? 'SONAR_ORGANIZATION' : null), projectKey: sonar.projects?.[0]?.key ?? null,
       qualityGate: sonar.qualityGate ?? (example ? 'starci-quality-lite' : 'starci-quality'), wiring: sonar.ci?.wiring ?? 'required',
       token: sonar.ci?.token || nameOf(sonar.ci?.secrets?.[0]) || 'SONAR_TOKEN', hostVar: sonar.ci?.hostVar || 'SONAR_HOST_URL',
     },
-    codecov: { optional: codecov.optional ?? false, enabled: codecov.mode !== 'disabled', auth: codecov.auth ?? 'oidc', token: codecov.ci?.token ?? null,
+    codecov: { enabled: codecov.mode !== 'disabled', auth: codecov.auth ?? 'oidc', token: codecov.ci?.token ?? null,
       flag: codecov.flag ?? null, target: codecov.target ?? 100, components: codecov.components ?? 'auto', required: codecov.required ?? true, wiring: codecov.ci?.wiring ?? 'required' },
     dependabot: { ecosystems: [...(dependabot.ecosystems ?? ['npm', 'github-actions', 'docker'])],
       schedule: { interval: 'weekly', ...dependabot.schedule }, groups: { minorPatch: 'grouped', major: 'per-package', ...dependabot.groups },

package/runtime/scripts/hfs/rules/ci-standard.mjs

@@ -4,8 +4,8 @@
 //   full-history-base-ref  every actions/checkout fetches the full history; a job that lints writes STARCI_BASE_REF before it lints
 //   heap-per-step          every heavy step (heap.steps) declares NODE_OPTIONS --max-old-space-size >= heap.minMiB on the step
 //   sonar-lint-per-side    a lint with --sonar names --side
-//   optional-providers     an optional (continue-on-error) Codecov or Sonar step follows its availability probe in the same job
-//   test-sharding          the test job is a shard matrix; each shard runs --shard=i/N without the per-file threshold; the coverage job merges, then proves
+//   required-providers      no continue-on-error; Codecov fail_ci_if_error true; no availability probe, no secret-gated Codecov or Sonar step
+//   test-sharding          the test job is a shard matrix; each shard runs --shard=i/N with STARCI_COVERAGE_SHARD and no threshold or pass-empty flag; the coverage job merges, then proves
 //   lint-parallel          the lint job is a matrix over side [be, fe]
 //   cache-saved-always     no cache keyed by the commit sha; actions/cache/save runs under if: always()
 //   timeouts               every job declares timeout-minutes
@@ -79,7 +79,7 @@ function testSharding(doc, say) {
   if (unit && !total) out.push(say('test-sharding', 'the unit run must pass --shard=${{ matrix.shard }}/<N>'));
   if (total && Array.isArray(shards) && Number(total[1]) !== shards.length) out.push(say('test-sharding', `the unit run's shard total ${total[1]} must equal the ${shards.length} matrix shards`));
   if (unit && String(unit.env?.STARCI_COVERAGE_SHARD ?? '') !== '1') out.push(say('test-sharding', 'a shard runs the unit step with STARCI_COVERAGE_SHARD: "1": it measures only the files it loads and writes the istanbul JSON the coverage job merges'));
-  if (unit && !runOf(unit).includes('--coverageThreshold={}')) out.push(say('test-sharding', 'a shard measures without the per-file threshold (--coverageThreshold={}); the coverage job proves it on the merged report'));
+  if (unit && /--passWithNoTests|--coverageThreshold/.test(runOf(unit))) out.push(say('test-sharding', 'a shard passes neither --passWithNoTests nor --coverageThreshold: the preset owns shard mode (no per-file threshold; the coverage job proves it on the merged report) and the shard count never exceeds what the unit specs fill'));
   const coverage = record(doc.jobs?.coverage) ? stepsOf(doc.jobs.coverage) : [];
   const merge = coverage.findIndex((step) => /app coverage merge\b/.test(runOf(step)));
   const proof = coverage.findIndex((step) => COVERAGE_PROOF.test(runOf(step)));
@@ -146,20 +146,30 @@ function sonarLintPerSide(doc, say) {
   return out;
 }
 
-function optionalProviders(doc, say) {
+const PROVIDER_STEP = /^(?:codecov\/codecov-action|SonarSource\/)/;
+const PROVIDER_SECRET_GATE = /\bsecrets\.|\bCODECOV_TOKEN\b|\bSONAR_TOKEN\b/;
+const PROBE_IDS =new Set(['codecov-availability', 'sonar-availability']);
+const truthy = (value) => value === true || String(value).toLowerCase() === 'true';
+
+/** The findings of one step: it continues on error, it is a probe, or it is a Codecov or Sonar step that a secret gates or that tolerates a failed upload. */
+function providerStepFindings(id, step, say) {
+  const name = step.name ?? usesOf(step) ?? step.id;
   const out = [];
-  const probes = [['codecov/codecov-action@', 'codecov-availability'], ['SonarSource/sonarqube-scan-action@', 'sonar-availability']];
-  for (const [id, job] of jobsOf(doc)) {
-    const steps = stepsOf(job);
-    steps.forEach((step, index) => {
-      const probe = probes.find(([prefix]) => usesOf(step).startsWith(prefix));
-      if (!probe || step['continue-on-error'] !== true) return;
-      if (!steps.slice(0, index).some((earlier) => earlier.id === probe[1])) out.push(say('optional-providers', `job ${id}: the optional ${usesOf(step).split('@')[0]} step must follow its availability probe (id ${probe[1]})`));
-    });
-  }
+  if (truthy(step['continue-on-error'])) out.push(say('required-providers', `job ${id}, step ${name}: continue-on-error lets a red step pass`));
+  if (PROBE_IDS.has(step.id)) out.push(say('required-providers', `job ${id}: ${step.id} probes a required provider to skip it; an unreachable provider is red`));
+  if (!PROVIDER_STEP.test(usesOf(step))) return out;
+  if (PROVIDER_SECRET_GATE.test(String(step.if ?? ''))) out.push(say('required-providers', `job ${id}, step ${name}: gated on a secret, so a missing token skips it instead of failing the job`));
+  if (usesOf(step).startsWith('codecov/codecov-action@') && !truthy(step.with?.fail_ci_if_error)) out.push(say('required-providers', `job ${id}, step ${name}: the upload must set fail_ci_if_error: true`));
   return out;
 }
 
+function requiredProviders(doc, say) {
+  return jobsOf(doc).flatMap(([id, job]) => [
+    ...(truthy(job['continue-on-error']) ? [say('required-providers', `job ${id}: continue-on-error lets a red job pass`)] : []),
+    ...stepsOf(job).flatMap((step) => providerStepFindings(id, step, say)),
+  ]);
+}
+
 function timeouts(doc, say) {
   return jobsOf(doc).filter(([, job]) => !Number.isFinite(Number(job['timeout-minutes'])) || job['timeout-minutes'] === null || job['timeout-minutes'] === '')
     .filter(([, job]) => job.uses === undefined).map(([id]) => say('timeouts', `job ${id} must declare timeout-minutes`));
@@ -188,7 +198,7 @@ export function ciStandardFindings({ doc, file, scope, edition = 'full', standar
     'full-history-base-ref': () => fullHistory(doc, say),
     'heap-per-step': () => heapPerStep(doc, standard, say),
     'sonar-lint-per-side': () => sonarLintPerSide(doc, say),
-    'optional-providers': () => optionalProviders(doc, say),
+    'required-providers': () => requiredProviders(doc, say),
     'test-sharding': () => testSharding(doc, say),
     'lint-parallel': () => lintParallel(doc, say),
     'cache-saved-always': () => cacheSavedAlways(doc, say),

package/runtime/scripts/hfs/rules/unused-symbol-flow.mjs

@@ -2,7 +2,7 @@
 // followed through variables, parameters (state.arguments), array callbacks, for-of and literal tables.
 import { nameText as nameOf } from '../../lib/ts-ast.mjs';
 import { unwrapCatalogExpression as unwrap } from '../../lib/ts-analysis.mjs';
-import { excludesNull, propertiesOf, propertyValues, writesTarget } from './unused-symbol-properties.mjs';
+import { excludesNull, ownerProperty, propertiesOf, propertyValues, writesTarget } from './unused-symbol-properties.mjs';
 
 const ARRAY_CALLBACK = /^(?:map|flatMap|forEach|filter|find|some|every)$/u;
 
@@ -142,6 +142,64 @@ function callValues(state, node, seen) {
     ? resolveAll(state, returnedExpressions(ts, fn), seen) : [node];
 }
 
+const unionMembers = type => {
+  if (!type) return [];
+  return type.isUnion() ? type.types : [type];
+};
+
+/** The object literals the program builds for a declared object type: those the checker types by that interface or alias. */
+function literalsByType(state) {
+  const { ts, checker } = state;
+  if (state.typedLiterals) return state.typedLiterals;
+  const index = new Map();
+  const visit = node => {
+    if (ts.isObjectLiteralExpression(node)) {
+      const type = checker.getContextualType(node);
+      const owners = unionMembers(type);
+      for (const owner of owners) {
+        const symbol = owner.aliasSymbol ?? owner.symbol;
+        if (symbol) index.set(symbol, [...index.get(symbol) ?? [], node]);
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  for (const source of state.flowSources?.values() ?? []) visit(source);
+  state.typedLiterals = index;
+  return index;
+}
+
+/** A property declared `readonly` on an interface or type literal cannot be reassigned, so only the object literals typed by it write it. */
+const readonlyDeclaration = (ts, symbol, name) => {
+  const member = symbol.members?.get(name) ?? symbol.declarations?.flatMap(declaration => ts.isTypeAliasDeclaration(declaration) ? [declaration.type] : [])
+    .find(type => ts.isTypeLiteralNode(type))?.symbol?.members?.get(name);
+  return Boolean(member?.declarations?.length) && member.declarations.every(declaration => ts.getCombinedModifierFlags(declaration) & ts.ModifierFlags.Readonly);
+};
+
+/**
+ * What a read of `owner.name` can hold when the owner is a value of a declared object type and the property is `readonly`: the initializers
+ * of that property in every object literal the program types by that declaration, in a typed table of constants. Any owner type that is not
+ * such a declaration, or a literal whose property comes from an unknown source, leaves the read unresolved.
+ */
+function typedPropertyValues(state, node) {
+  const { ts, checker } = state;
+  const owner = checker.getNonNullableType(checker.getTypeAtLocation(node.expression));
+  const owners = owner.isUnion() ? owner.types : [owner];
+  const values = [];
+  for (const type of owners) {
+    const symbol = type.aliasSymbol ?? type.symbol;
+    const literals = symbol ? literalsByType(state).get(symbol) : null;
+    if (!literals?.length || !readonlyDeclaration(ts, symbol, node.name.text)) return [];
+    for (const literal of literals) {
+      const property = ownerProperty(state, literal, node.name.text, new Set(), valuesOf);
+      if (property === null) return [];
+      values.push(...property.values);
+    }
+  }
+  return values;
+}
+
+const isNullish = (ts, node) => node.kind === ts.SyntaxKind.NullKeyword || ts.isIdentifier(node) && node.text === 'undefined';
+
 /** Leaf expressions `expression` may evaluate to. A translator variable and any unresolvable expression is its own leaf. */
 export function valuesOf(state, expression, visited = new Set()) {
   const { ts } = state;
@@ -152,12 +210,20 @@ export function valuesOf(state, expression, visited = new Set()) {
   const orLeaf = values => values.length ? values : [node];
   const narrowed = values => orLeaf(excludesNull(state, node) ? values.filter(value => value.kind !== ts.SyntaxKind.NullKeyword) : values);
   if (ts.isConditionalExpression(node)) return [...valuesOf(state, node.whenTrue, seen), ...valuesOf(state, node.whenFalse, seen)];
+  // `a ?? b` and `a || b` hold either operand.
+  if (ts.isBinaryExpression(node) && [ts.SyntaxKind.QuestionQuestionToken, ts.SyntaxKind.BarBarToken].includes(node.operatorToken.kind))
+    return [...valuesOf(state, node.left, seen), ...valuesOf(state, node.right, seen)];
   if (ts.isCallExpression(node)) return orLeaf(callValues(state, node, seen));
   if (ts.isPropertyAccessExpression(node)) {
     const member = classMemberValue(state, symbolAt(state, node)?.valueDeclaration);
     if (member) return [member];
   }
-  if (ts.isPropertyAccessExpression(node)) return narrowed(resolveAll(state, propertiesOf(state, valuesOf(state, node.expression, seen), node.name.text, seen, valuesOf), seen));
+  if (ts.isPropertyAccessExpression(node)) {
+    // Reading a property of null or undefined throws, so a nullish branch of the owner holds no value of the property.
+    const owners = valuesOf(state, node.expression, seen).filter(owner => !isNullish(ts, owner));
+    const known = resolveAll(state, propertiesOf(state, owners, node.name.text, seen, valuesOf), seen);
+    return narrowed(known.length ? known : resolveAll(state, typedPropertyValues(state, node), seen));
+  }
   if (ts.isElementAccessExpression(node)) return orLeaf(resolveAll(state, tableValues(state, node, seen), seen));
   if (!ts.isIdentifier(node)) return [node];
   const symbol = symbolAt(state, node);

package/runtime/scripts/hfs/rules/unused-symbol-properties.mjs

@@ -35,7 +35,7 @@ function entryProperty(state, entry, name, seen, resolve) {
 }
 
 /** Fold writes in source order, with branch-local cycle detection and explicit absence. */
-function ownerProperty(state, owner, name, visited, resolve) {
+export function ownerProperty(state, owner, name, visited, resolve) {
   if ((!state.ts.isObjectLiteralExpression(owner) && !state.ts.isJsxAttributes(owner)) || visited.has(owner)) return null;
   const seen = new Set([...visited, owner]);
   return owner.properties.reduce((before, entry) => mergeProperty(before, entryProperty(state, entry, name, seen, resolve)), ABSENT_PROPERTY);

package/runtime/scripts/hfs/rules/unused-symbol.mjs

@@ -57,16 +57,32 @@ function projectOptions(ts, repoRoot, files) {
   return projects.sort((a, b) => b.directory.length - a.directory.length);
 }
 
+/**
+ * The standard library the type checker reads. Without it `Array`, `ReadonlyArray` and `Promise` are unresolved, so the callback
+ * parameter of `rows.filter(...).map((row) => t(row.label))` has no type and a key typed as a union of literals cannot be read.
+ */
+const LIB_FILE = 'lib.es2023.d.ts';
+const libraryFiles = new Map();
+const isLibraryFile = (ts, file) => /(?:^|[/\\])lib\.[\w.-]+\.d\.ts$/u.test(file) && slash(file).startsWith(slash(path.dirname(ts.getDefaultLibFilePath({}))));
+function libraryFile(ts, file) {
+  if (!isLibraryFile(ts, file)) return undefined;
+  if (!libraryFiles.has(file)) {
+    const text = ts.sys.readFile(file);
+    libraryFiles.set(file, text === undefined ? undefined : ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true));
+  }
+  return libraryFiles.get(file);
+}
+
 function trackedProgram(ts, repoRoot, files, sources) {
-  const options = { noLib: true, types: [], allowJs: true, resolveJsonModule: true, jsx: ts.JsxEmit.Preserve, target: ts.ScriptTarget.Latest, module: ts.ModuleKind.ESNext, moduleResolution: ts.ModuleResolutionKind.Bundler };
+  const options = { lib: [LIB_FILE], types: [], allowJs: true, resolveJsonModule: true, jsx: ts.JsxEmit.Preserve, target: ts.ScriptTarget.Latest, module: ts.ModuleKind.ESNext, moduleResolution: ts.ModuleResolutionKind.Bundler };
   const projects = projectOptions(ts, repoRoot, files);
   const catalogs = new Set(files.filter(file => JSON_CATALOG.test(file)).map(file => slash(path.resolve(repoRoot, file))));
   const host = {
-    getSourceFile: file => sources.get(slash(path.resolve(file))),
-    getDefaultLibFileName: () => '', writeFile: () => {},
+    getSourceFile: file => sources.get(slash(path.resolve(file))) ?? libraryFile(ts, file),
+    getDefaultLibFileName: libOptions => ts.getDefaultLibFilePath(libOptions), writeFile: () => {},
     getCurrentDirectory: () => repoRoot, getDirectories: () => [],
-    fileExists: file => sources.has(slash(path.resolve(file))) || catalogs.has(slash(path.resolve(file))),
-    readFile: file => sources.get(slash(path.resolve(file)))?.text,
+    fileExists: file => sources.has(slash(path.resolve(file))) || catalogs.has(slash(path.resolve(file))) || isLibraryFile(ts, file),
+    readFile: file => sources.get(slash(path.resolve(file)))?.text ?? (isLibraryFile(ts, file) ? ts.sys.readFile(file) : undefined),
     getCanonicalFileName: slash, useCaseSensitiveFileNames: () => true,
     getNewLine: () => '\n',
   };

package/runtime/scripts/hfs/slots.mjs

@@ -153,9 +153,10 @@ export function resolveRepoDeclaration(manifest, declaration, { file = HFS_DECLA
     edition,
     side: null,
     profile: APP_SCOPE,
-    // The root declares no app or connection of its own (each side does); its one opt-in slot is the browser journey (`browser: true`).
+    // The root declares no app or connection of its own (each side does); its opt-in slots are the browser journey and the managed
+    // tsconfig.json that type-checks it, both switched on by `browser: true`.
     apps: Object.freeze([]),
-    optionalSlots: Object.freeze(declaration.browser === true ? ['app.browser'] : []),
+    optionalSlots: Object.freeze(declaration.browser === true ? ['app.browser', 'app.browser-config'] : []),
     connections: Object.freeze([]),
     providers,
     reads: Object.freeze([]),