@starci/hfs 4.7.31 → 4.7.33

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -8,6 +8,8 @@ import { stringList, byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
 
 export const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
 export const NAME = /^[a-z][a-z0-9-]*$/;
+/** An npm package name, scoped or not. */
+export const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
 const ENV_PREFIX =/^[A-Z][A-Z0-9]*(_[A-Z0-9]+)*$/;
 /** How a bounded context (a connection) is isolated: its own logical database, or its own schema of a shared one. */
 const CONTEXT_ISOLATIONS = Object.freeze(["database", "schema"]);
@@ -66,14 +68,15 @@ export function unitRolesProblems(be) {
   return [];
 }
 
-/** Shape problems of ruleParams.be.logicRoles and thinRoles: each a non-empty list of unique roles of the suffix vocabulary; every unit role is a logic role. */
+/** Shape problems of ruleParams.be.logicRoles, valueRoles and thinRoles: each a non-empty list of unique roles of the suffix vocabulary; every unit role is a logic role. */
 export function roleListProblems(be) {
   const bad = [];
-  for (const key of ['logicRoles', 'thinRoles']) {
+  for (const key of ['logicRoles', 'valueRoles', 'thinRoles']) {
     const list = be[key];
     if (!strList(list) || !list.length || new Set(list).size !== list.length || !list.every((role) => NAME.test(role))) bad.push(`ruleParams.be.${key} must be a non-empty list of unique kebab-case roles`);
     else if (Array.isArray(be.suffixes) && list.some((role) => !be.suffixes.includes(role))) bad.push(`ruleParams.be.${key} names a role that is not in ruleParams.be.suffixes`);
   }
+  if (strList(be.valueRoles) && strList(be.logicRoles) && be.valueRoles.some((role) => !be.logicRoles.includes(role))) bad.push('every ruleParams.be.valueRoles role is a logic role (ruleParams.be.logicRoles)');
   if (strList(be.logicRoles) && Array.isArray(be.unitRoles) && be.unitRoles.some((r) => r?.slot === undefined && !be.logicRoles.includes(r?.role))) bad.push('every ruleParams.be.unitRoles role that is not tied to a slot is a logic role (ruleParams.be.logicRoles)');
   return bad;
 }
@@ -359,13 +362,14 @@ function runtimeParamProblems(rp) {
 const folderKindsValid = list => strList(list) && list.length > 0 && new Set(list).size === list.length && list.every(kind => NAME.test(kind));
 const kindPairValid = pair => isPlainObject(pair) && Object.keys(pair).sort(byCodeUnit).join() === 'from,to'
   && ['from', 'to'].every(side => folderKindsValid(pair[side]));
-const kindRestrictionValid = kinds => isPlainObject(kinds) && Object.keys(kinds).length > 0
-  && Object.entries(kinds).every(([target, pair]) => NAME.test(target) && kindPairValid(pair));
+/** A non-empty map whose every key is a name and every value satisfies `valid`. */
+export const namedMapValid = (map, valid) => isPlainObject(map) && Object.keys(map).length > 0
+  && Object.entries(map).every(([name, entry]) => NAME.test(name) && valid(entry));
+const kindRestrictionValid = kinds => namedMapValid(kinds, kindPairValid);
 const slotIdsValid = list => strList(list) && list.length > 0 && new Set(list).size === list.length
   && list.every(id => SLOT_ID.test(id) || RUNTIME_SLOT_ID.test(id));
 const slotRestrictionPairValid = pair => isPlainObject(pair) && Object.keys(pair).join() === 'from' && slotIdsValid(pair.from);
-const slotRestrictionValid = slots => isPlainObject(slots) && Object.keys(slots).length > 0
-  && Object.entries(slots).every(([target, pair]) => NAME.test(target) && slotRestrictionPairValid(pair));
+const slotRestrictionValid = slots => namedMapValid(slots, slotRestrictionPairValid);
 
 function tierDefinitionProblems(profile, tier, def) {
   const bad = [];

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -4,11 +4,17 @@
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { paramNamesOk } from './param-names.mjs';
 import { kindParamProblems, scenarioProblem } from './declaration-slots.mjs';
-import { NAME, roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
+import { NAME, namedMapValid, PACKAGE_NAME, roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
 import { byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
+import { ruleEditionProblems } from './edition-slots.mjs';
 
 const PROFILES = ['be', 'fe'];
-const BE_OWN = ['infraOwners', 'eventBus', 'specDoubles', 'paramNames', 'suffixes', 'bannedSuffixes', 'contractShape', 'unitRoles', 'logicRoles', 'thinRoles', 'patternScenarios', 'kindPatterns', 'addKinds'];
+const BE_OWN = ['infraOwners', 'eventBus', 'specDoubles', 'paramNames', 'suffixes', 'bannedSuffixes', 'contractShape', 'unitRoles', 'logicRoles', 'valueRoles', 'thinRoles', 'patternScenarios', 'kindPatterns', 'addKinds', 'backing'];
+const backingEntryOk = (entry) => isPlainObject(entry) && Object.keys(entry).every((key) => ['clients', 'images', 'patterns', 'editions'].includes(key))
+  && nonemptyUniqueList(entry.clients, (name) => PACKAGE_NAME.test(String(name)))
+  && Array.isArray(entry.patterns) && entry.patterns.every((name) => NAME.test(String(name))) && new Set(entry.patterns).size === entry.patterns.length
+  && nonemptyUniqueList(entry.images, (name) => PACKAGE_NAME.test(String(name)))
+  && ruleEditionProblems(entry, 'backing service').length === 0;
 const FORM_NAMES = new Set(['call', 'new', 'curried', 'object', 'primitive', 'array']);
 const blockOk = (v) => isPlainObject(v) && Number.isInteger(v.lines) && v.lines >= 2 && Number.isInteger(v.tokens) && v.tokens >= 1 && Object.keys(v).length === 2;
 const fileLinesOk = (v) => isPlainObject(v) && Number.isInteger(v.soft) && v.soft >= 1 && typeof v.hardGrowth === 'boolean' && Object.keys(v).length === 2;
@@ -30,7 +36,12 @@ const formsOk = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => FORM_N
 const doubleOk = (v) => isPlainObject(v) && /^[A-Za-z][A-Za-z0-9]*$/.test(String(v.double)) && formsOk(v.forms);
 const regexOk = (v) => { try { return typeof v === 'string' && v.length > 0 && Boolean(new RegExp(v)); } catch { return false; } };
 const dbExtensionsOk = (value) => Array.isArray(value) && value.every((name) => typeof name === 'string' && name.length > 0) && new Set(value).size === value.length;
-const dbParamsOk = (db) => db === undefined || (isPlainObject(db) && Object.entries(db).every(([key, value]) => key === 'extensions' && dbExtensionsOk(value)));
+const SQL_NAME = /^[a-z_][a-z0-9_]*$/;
+const queueOutboxOk = (value) => isPlainObject(value) && Object.keys(value).sort(byCodeUnit).join() === 'columns,table'
+  && typeof value.table === 'string' && value.table.split('.').length === 2 && value.table.split('.').every((part) => SQL_NAME.test(part))
+  && nonemptyUniqueList(value.columns, (column) => SQL_NAME.test(String(column))) && value.columns.includes('queue');
+const DB_PARAMS = { extensions: dbExtensionsOk, queueOutbox: queueOutboxOk };
+const dbParamsOk = (db) => db === undefined || (isPlainObject(db) && Object.entries(db).every(([key, value]) => Object.hasOwn(DB_PARAMS, key) && DB_PARAMS[key](value)));
 
 function beSpecificProblems(be, manifest) {
   const bad = [];
@@ -42,11 +53,12 @@ function beSpecificProblems(be, manifest) {
   const eventBus = be.eventBus;
   if (!isPlainObject(eventBus) || Object.keys(eventBus).sort(byCodeUnit).join() !== 'classes,imports' || !memberMap(eventBus.imports, true) || !memberMap(eventBus.classes, false)) bad.push('ruleParams.be.eventBus must be {imports: {<module>: [unique PascalCase members]}, classes: {<module>: [non-empty unique PascalCase classes]}}');
   if (!paramNamesOk(be.paramNames)) bad.push('ruleParams.be.paramNames must be a non-empty list of unique {type | typeSuffix, names, nameSuffix?} entries');
+  if (!namedMapValid(be.backing, backingEntryOk)) bad.push('ruleParams.be.backing must map a backing service name to {clients: [unique package names], patterns: [unique pattern names], images: [unique image repositories], editions?: [unique known editions]}');
   if (!roleList(be.suffixes)) bad.push('ruleParams.be.suffixes must be a non-empty list of unique kebab-case role suffixes');
   if (!roleList(be.bannedSuffixes)) bad.push('ruleParams.be.bannedSuffixes must be a non-empty list of unique kebab-case suffixes');
   else if (roleList(be.suffixes) && be.suffixes.some((x) => be.bannedSuffixes.includes(x))) bad.push('ruleParams.be.suffixes and bannedSuffixes must be disjoint');
   const sd = be.specDoubles;
-  if (!isPlainObject(sd) || Object.keys(sd).sort(byCodeUnit).join() !== 'doubles,fallback,kit' || typeof sd.kit !== 'string' || !sd.kit || !Array.isArray(sd.doubles) || !sd.doubles.length || !sd.doubles.every((e) => doubleOk(e) && regexOk(e.token) && Object.keys(e).length === 3) || !doubleOk(sd.fallback) || Object.keys(sd.fallback).length !== 2) bad.push('ruleParams.be.specDoubles must be {kit, doubles: [{token: regex, double, forms}], fallback: {double, forms}} with forms drawn from call, new, curried, object, primitive, array');
+  if (!isPlainObject(sd) || Object.keys(sd).sort(byCodeUnit).join() !== 'doubles,fallback,kit' || typeof sd.kit !== 'string' || !sd.kit || !Array.isArray(sd.doubles) || !sd.doubles.length || !sd.doubles.every((e) => doubleOk(e) && regexOk(e.token) && (e.from === undefined || regexOk(e.from)) && Object.keys(e).length === (e.from === undefined ? 3 : 4)) || !doubleOk(sd.fallback) || Object.keys(sd.fallback).length !== 2) bad.push('ruleParams.be.specDoubles must be {kit, doubles: [{token: regex, double, forms}], fallback: {double, forms}} with forms drawn from call, new, curried, object, primitive, array');
   return bad;
 }
 
@@ -59,10 +71,10 @@ export function ruleParamsProblems(m) {
     // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
     // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
     if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
-    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns and addKinds (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
+    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns, addKinds and backing (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
     bad.push(...beSpecificProblems(rp.be, m));
     if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS))) bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
-    if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions: a list of unique non-empty extension names');
+    if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions (a list of unique non-empty extension names) and queueOutbox ({table: <schema>.<table>, columns: [unique column names including queue]})');
   }
   return bad;
 }

package/runtime/scripts/hfs/rules/a15-findings.mjs

@@ -5,6 +5,7 @@
 // finders-import-begin
 import { featureFileFindings } from './feature-files.mjs';
 import { lexiconFindings } from './lexicon.mjs';
+import { textIntegrityFindings } from './text-integrity.mjs';
 import { assetsFindings } from './assets.mjs';
 import { unusedSymbolFindings } from './unused-symbol.mjs';
 import { databaseBaselineFindings } from './database-baseline.mjs';
@@ -41,11 +42,12 @@ import { feBuildArgsFindings } from './fe-build-args.mjs';
 /** The failure codes the finders above emit, so `starci app check` ships their labels (check.mjs adds them to CHECK_CODES). Append-only; the coordinator regenerates it at merge time. */
 export const A15_CODES = [
   // codes-begin
+  'HFS_TEXT_CORRUPT',
   'FE_PUBLIC_BUILD_ARG_MISSING',
   'HFS_WORKFLOW_CONTEXT',
   'CI_STANDARD',
   'CI_SECRET_SEALED', 'APP_SECRET_IN_CI', 'CI_DECLARATION_DRIFT',
-  'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_API_EXPOSED', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_CRON_OWNED', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_SERVICE_ROLE_SCOPE', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
+  'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_API_EXPOSED', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_CRON_OWNED', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_SERVICE_ROLE_SCOPE', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_REDIS_PERSISTENCE', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
   // codes-end
 ];
 
@@ -56,6 +58,7 @@ export const FINDERS = [
   ciStandardAppFindings,
   featureFileFindings,
   lexiconFindings,
+  textIntegrityFindings,
   assetsFindings,
   unusedSymbolFindings,
   databaseBaselineFindings,

package/runtime/scripts/hfs/rules/bypass-markers.mjs

@@ -4,21 +4,36 @@
 //     ts-nocheck directives), a Sonar exclusion comment, an istanbul / c8 / v8 coverage ignore;
 //   - a skipped, focused or todo test, or a skip option (a front end has no specs, but its source is still judged for the inline disables);
 //   - a failure swallowed in a hook, a script or a workflow: `|| true`, `continue-on-error`, `set +e`, `HUSKY=0`, `--no-verify`,
-//     `fail_ci_if_error: false`.
-// The text is read from the tracked tree here, and from the index by `starci app hygiene` (the pre-commit hook), which uses the same table
-// (scripts/lib/bypass-markers.mjs). A managed config edited to loosen is the managed-file drift's (HFS_MANAGED_FILE_DRIFT).
+//     `fail_ci_if_error: false`, `--passWithNoTests`;
+//   - a gate configuration relaxed: a coverage target or threshold below the canon, a relaxing switch, a disabled ESLint rule, a strictness option
+//     turned off, an exception file the design-truths manifest does not list.
+// The tree is read as it stands, by the library of the runtime's own loosening check (scripts/lib/loosening-state.mjs, knowledge/hfs/design-truths.yaml);
+// `starci app hygiene` (the pre-commit hook) reads the staged bypass markers with the same table (scripts/lib/bypass-markers.mjs). The ignore and
+// exclude lists of a managed config are the managed-file drift's (HFS_MANAGED_FILE_DRIFT).
+import fs from 'node:fs';
+import { parseYaml } from '../../../engine/yaml.mjs';
 import { found, readText } from './read.mjs';
 import { bypassesIn } from '../../lib/bypass-markers.mjs';
+import { findingLine, stateFindings } from '../../lib/loosening-state.mjs';
 
 export const HFS_BYPASS_MARKER = 'HFS_BYPASS_MARKER';
+const TRUTHS_FILE = new URL('../../../knowledge/hfs/design-truths.yaml', import.meta.url);
 
 /** The finding message of one marker of `file`. */
 export const bypassMessage = (file, hit) => `${file}:${hit.line} spells ${hit.label} (${hit.text.slice(0, 80)}); a check is satisfied, never bypassed: fix the cause and delete the marker`;
 
+const markerFindings = ({ repoRoot, files }) => files.flatMap((file) => {
+  const text = readText(repoRoot, file);
+  return text === null ? [] : bypassesIn(file, text).map((hit) => found(HFS_BYPASS_MARKER, file, bypassMessage(file, hit), { line: hit.line }));
+});
+
+/** The relaxed gate configuration of `files`: the library's findings other than the markers and the lists. */
+const configFindings = ({ repoRoot, files }) => stateFindings({ files, read: (file) => readText(repoRoot, file), truths: parseYaml(fs.readFileSync(TRUTHS_FILE, 'utf8')), lists: false })
+  .filter((entry) => entry.kind !== 'bypass' && entry.kind !== 'truths')
+  .map((entry) => found(HFS_BYPASS_MARKER, entry.file, `${entry.file}:${entry.line} relaxes a gate (${findingLine(entry)}); a check is satisfied, never relaxed: restore the canon value`, { line: entry.line }));
+
 /** The findings of R303 over the tracked paths `files` of the repository at `repoRoot`. */
 export function bypassMarkerFindings({ repoRoot, files }) {
-  return files.flatMap((file) => {
-    const text = readText(repoRoot, file);
-    return text === null ? [] : bypassesIn(file, text).map((hit) => found(HFS_BYPASS_MARKER, file, bypassMessage(file, hit), { line: hit.line }));
-  });
+  const markers = markerFindings({ repoRoot, files });
+  return markers.concat(configFindings({ repoRoot, files }));
 }

package/runtime/scripts/hfs/rules/database-migrations.mjs

@@ -11,6 +11,8 @@ import { DB_MIGRATION_DESTRUCTIVE, DB_MIGRATION_SHAPE, isActiveMigration, MIGRAT
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { loadTypescript } from '../../lib/package-at.mjs';
+import { isConstVariable } from '../../lib/ts-ast.mjs';
+import { lexicalChecker, unwrapExpression } from '../../lib/ts-analysis.mjs';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const MIGRATION_PLAIN = /[a-z0-9]+(?:-[a-z0-9]+)*/;
@@ -332,10 +334,11 @@ function alteredColumn(table, column, line) {
 
 function tableActionObject(body, index, table, line) {
   if (sqlWord(body[index], 'drop')) {
+    const constraint = sqlWord(body[index + 1], 'constraint');
     const at = skipWords(body, index + 1, ['column', 'constraint', 'if', 'exists']);
     if (sqlWord(body[at], 'default') || sqlWord(body[at], 'not')) return null;
     const column = nameAt(body, at);
-    return column ? alteredColumn(table, column, line) : null;
+    return column ? { ...alteredColumn(table, column, line), kind: constraint ? 'constraint' : 'column' } : null;
   }
   if (sqlWord(body[index], 'rename')) {
     const column = sqlWord(body[index + 1], 'column') ? nameAt(body, index + 2) : null;
@@ -378,29 +381,81 @@ function destructiveObjects(statement) {
   return objects;
 }
 
-function sourceNames(ts, text, file) {
-  const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+/** Keep the static parts of one SQL expression together across interpolation and string concatenation. */
+function sourceSqlText(ts, expression, checker, visiting = new Set()) {
+  const node = unwrapExpression(ts, expression);
+  if (ts.isStringLiteralLike(node)) return node.text;
+  if (ts.isTaggedTemplateExpression(node)) return sourceSqlText(ts, node.template, checker, visiting);
+  if (ts.isIdentifier(node)) {
+    const declaration = checker.getSymbolAtLocation(node)?.valueDeclaration;
+    if (!declaration || !ts.isVariableDeclaration(declaration) || !isConstVariable(ts, declaration)
+      || !declaration.initializer || visiting.has(declaration)) return null;
+    return sourceSqlText(ts, declaration.initializer, checker, new Set([...visiting, declaration]));
+  }
+  if (ts.isTemplateExpression(node)) return node.head.text + node.templateSpans.map((span) =>
+    `${sourceSqlText(ts, span.expression, checker, visiting) ?? ' '}${span.literal.text}`).join('');
+  if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+    return `${sourceSqlText(ts, node.left, checker, visiting) ?? ' '}${sourceSqlText(ts, node.right, checker, visiting) ?? ' '}`;
+  }
+  return null;
+}
+
+/** SET CONSTRAINTS names have no table qualifier; every matching table's constraint is affected. */
+function globalConstraintNames(statement) {
   const names = new Set();
-  const addSql = (sql) => { for (const token of databaseSqlTokens(sql)) if (sqlName(token) !== null) names.add(token.v); };
+  for (let index = 0; index < statement.length; index += 1) {
+    if (!sqlWord(statement[index], 'set') || !sqlWord(statement[index + 1], 'constraints')) continue;
+    let at = index + 2;
+    while (at < statement.length && !sqlWord(statement[at], 'all')) {
+      const constraint = nameAt(statement, at);
+      if (!constraint) break;
+      names.add(constraint.leaf);
+      if (statement[constraint.next]?.v !== ',') break;
+      at = constraint.next + 1;
+    }
+  }
+  return names;
+}
+
+function sourceNameScopes(ts, text, file) {
+  const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+  const checker = lexicalChecker(ts, source);
+  const scopes = [];
+  const entityNames = /\.entity\.[cm]?tsx?$/.test(file) ? new Set() : null;
+  const addSql = (sql) => {
+    for (const statement of databaseSqlStatements(databaseSqlTokens(sql))) {
+      const names = new Set(statement.filter((token) => sqlName(token) !== null).map((token) => token.v));
+      if (entityNames) for (const name of names) entityNames.add(name);
+      else {
+        const constraints = new Set(statement.flatMap((token, index) =>
+          sqlWord(token, 'constraint') && sqlName(statement[index + 1]) !== null ? [statement[index + 1].v] : []));
+        scopes.push({ names, constraints, globalConstraints: globalConstraintNames(statement) });
+      }
+    }
+  };
   const visit = (node) => {
-    if (ts.isStringLiteralLike(node)) addSql(node.text);
-    if (ts.isTemplateExpression(node)) { addSql(node.head.text); for (const span of node.templateSpans) addSql(span.literal.text); }
-    if (/\.entity\.[cm]?tsx?$/.test(file) && ts.isIdentifier(node)) names.add(node.text);
+    const sql = sourceSqlText(ts, node, checker);
+    if (sql !== null) addSql(sql);
+    if (entityNames && ts.isIdentifier(node)) entityNames.add(node.text);
     ts.forEachChild(node, visit);
   };
   visit(source);
-  return names;
+  return entityNames ? [{ names: entityNames, constraints: entityNames, globalConstraints: new Set() }] : scopes;
 }
 
 /**
  * Whether a be/src source references a destroyed object. A column (`<schema>.<table>.<column>`) is referenced only by a source that
- * names both its table and the column, so a same-named column of another table is not a reference; the check stays conservative,
- * since any mention of the table beside the column counts. Every other object kind is referenced by its leaf name.
+ * names both its table and the column in one SQL statement or entity, so separate queries cannot supply each other's names.
+ * SQL constraints require explicit constraint names, while entities retain their table/decorator association.
+ * Other object kinds match their leaf name conservatively.
  */
-const referencesObject = (names, object) => names.has(object.leaf) && (object.kind !== 'column' || !object.table || names.has(object.table));
+const referencesObject = (scopes, object) => scopes.some(({ names, constraints, globalConstraints }) =>
+  (object.kind === 'constraint' && globalConstraints.has(object.leaf))
+  || ((object.kind === 'constraint' ? constraints : names).has(object.leaf)
+    && (!['column', 'constraint'].includes(object.kind) || !object.table || names.has(object.table))));
 
 function destructiveObjectFinding(file, object, contract, references) {
-  const reference = references.find(({ names }) => referencesObject(names, object));
+  const reference = references.find(({ scopes }) => referencesObject(scopes, object));
   if (contract && !reference) return null;
   const reason = reference && contract ? `${reference.file} still references this object; remove the reference before the contract migration`
     : 'use a *_contract_* migration after the application stops using this object';
@@ -413,7 +468,7 @@ function destructiveFileFindings(file, text, references) {
   const seen = new Set();
   const objects = databaseSqlStatements(databaseExecutableTokens(text)).flatMap(destructiveObjects);
   return objects.flatMap((object) => {
-    const key = `${object.line}:${object.name}`;
+    const key = `${object.line}:${object.kind}:${object.name}`;
     if (seen.has(key)) return [];
     seen.add(key);
     const finding = destructiveObjectFinding(file, object, contract, references);
@@ -426,7 +481,7 @@ export function destructiveMigrationFindings({ repoRoot, migrations, files }) {
   const sources = files.filter((file) => /^be\/src\/.+\.(?:sql|entity)\.[cm]?tsx?$/.test(file));
   const ts = sources.length ? loadTypescript(repoRoot, HERE) : null;
   if (sources.length && !ts) return [found(DB_MIGRATION_DESTRUCTIVE, 'hfs.json', 'destructive migration checks require the TypeScript parser to read be/src references')];
-  const references = sources.map((file) => ({ file, names: sourceNames(ts, readText(repoRoot, file) ?? '', file) }));
+  const references = sources.map((file) => ({ file, scopes: sourceNameScopes(ts, readText(repoRoot, file) ?? '', file) }));
   return migrations.flatMap((file) => {
     const text = readText(repoRoot, file);
     return text === null ? [] : destructiveFileFindings(file, text, references);

package/runtime/scripts/hfs/rules/database-queue-sources.mjs

@@ -1,4 +1,4 @@
-// TypeScript queue constants and scheduler references for migration parity.
+// TypeScript queue constants, event-bus topic queue constants and scheduler references for migration parity.
 import pg from 'libpg-query';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -10,6 +10,7 @@ import { DB_PGMQ_DECLARED } from './database-constants.mjs';
 await pg.loadModule();
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const QUEUE_FILE = /^(?:be\/)?src\/modules\/queues\/.*\.ts$/;
+const TOPIC_FILE = /^(?:be\/)?src\/modules\/platform\/event-bus\/.*\.ts$/;
 const SOURCE_FILE = /^(?:be\/)?(?:src|apps)\/.*\.[cm]?[jt]s$/;
 const TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]s$|\/(?:tests|__tests__)\//;
 const sqlTree = sqlParser(pg);
@@ -64,7 +65,7 @@ export function queueSourceFacts(state, files, inspectSql) {
   const ts = loadTypescript(state.repoRoot, HERE);
   const sources = new Map();
   if (!ts) {
-    if (files.some((file) => QUEUE_FILE.test(file))) queueProblem(state, DB_PGMQ_DECLARED, 'hfs.json', 'queue declarations require the TypeScript parser');
+    if (files.some((file) => QUEUE_FILE.test(file) || TOPIC_FILE.test(file))) queueProblem(state, DB_PGMQ_DECLARED, 'hfs.json', 'queue declarations require the TypeScript parser');
     return { ts, sources };
   }
   for (const file of files.filter((item) => SOURCE_FILE.test(item) && !TEST_FILE.test(item))) {
@@ -72,18 +73,19 @@ export function queueSourceFacts(state, files, inspectSql) {
     if (text === null) continue;
     const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
     sources.set(file, sourceBindings(ts, source));
-    if (QUEUE_FILE.test(file)) addQueueConstants(state, ts, source, file);
+    if (QUEUE_FILE.test(file)) addLiteralConstants(state, state.constants, ts, source, file, /(?:^QUEUE$|_QUEUE(?:_NAME)?$|^QUEUE_)/, 'queue names');
+    if (TOPIC_FILE.test(file)) addLiteralConstants(state, state.topics, ts, source, file, /_TOPIC_QUEUE$/, 'event-bus topic queue names');
     addSourceSql(state, ts, source, file, inspectSql);
   }
   return { ts, sources };
 }
 
-function addQueueConstants(state, ts, source, file) {
+function addLiteralConstants(state, into, ts, source, file, name, what) {
   const visit = (node) => {
-    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && /(?:^QUEUE$|_QUEUE(?:_NAME)?$|^QUEUE_)/.test(node.name.text)) {
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && name.test(node.name.text)) {
       const value = sourceValue(ts, node.initializer);
-      if (value && ts.isStringLiteralLike(value)) state.constants.set(value.text, file);
-      else queueProblem(state, DB_PGMQ_DECLARED, file, 'queue names must be literal constants so migration parity can be checked');
+      if (value && ts.isStringLiteralLike(value)) into.set(value.text, file);
+      else queueProblem(state, DB_PGMQ_DECLARED, file, `${what} must be literal constants so the migrations can be checked against them`);
     }
     ts.forEachChild(node, visit);
   };

package/runtime/scripts/hfs/rules/database-queues.mjs

@@ -1,4 +1,8 @@
-// R258: queue declarations and pg_cron ticks have one migration owner in either edition.
+// R258: the queue is BullMQ on Redis (ruling:R212/case-10), so the active migrations leave no pgmq queue for a queue constant, and
+// every pgmq queue they leave is an event-bus topic queue named by a literal *_TOPIC_QUEUE constant under platform/event-bus. A
+// pg_cron tick has one migration owner and only enqueues: it inserts one row of a queue constant into the queue outbox table of
+// ruleParams.db.queueOutbox. A pgmq.send to a queue that existed when the job was scheduled is the historical form an older
+// migration may still hold; the live job never enqueues that way.
 // Initialize PostgreSQL's WASM parser at module load; the exported finder itself is synchronous.
 // SQL and TypeScript ASTs keep comments, quoted identifiers and inert string literals out of the inventory.
 import pg from 'libpg-query';
@@ -6,6 +10,7 @@ import { sqlStringParts as strings, walkSqlAst as walk, sqlParser, sqlCallArgume
 import { queueSourceFacts, queueSchedulers, queueProblem as problem } from './database-queue-sources.mjs';
 import { readJson, readText } from './read.mjs';
 import { DB_CRON_OWNED, DB_PGMQ_DECLARED, isActiveMigration } from './database-constants.mjs';
+import { loadSlotManifest } from '../slots.mjs';
 
 await pg.loadModule();
 
@@ -192,6 +197,7 @@ function singleCall(tree) {
   return select.targetList[0].ResTarget?.val?.FuncCall ?? null;
 }
 
+/** The historical pgmq.send of an existing queue; only a job's original body may hold it. */
 function enqueue(state, call) {
   if (callName(call) !== 'pgmq.send') return null;
   const queue = sqlLiteral(argument(call, 0, ['queue_name']));
@@ -200,13 +206,52 @@ function enqueue(state, call) {
 }
 
 function pureArguments(call) {
-  let safe = callsOf(call).every((nested) => PURE_CALLS.has(callName(nested).replace(/^pg_catalog\./, '')));
-  walk(call.args, (node) => {
+  return pureExpressions(call.args);
+}
+
+function pureExpressions(nodes) {
+  let safe = callsOf(nodes).every((nested) => uuidConstructor(nested) || PURE_CALLS.has(callName(nested).replace(/^pg_catalog\./, '')));
+  walk(nodes, (node) => {
     if (['SubLink', 'SelectStmt', 'InsertStmt', 'UpdateStmt', 'DeleteStmt', 'MergeStmt'].some((key) => node[key])) safe = false;
   });
   return safe;
 }
 
+/** The queue outbox table and the columns an enqueue may write, from ruleParams.db.queueOutbox; null refuses every outbox enqueue. */
+function queueOutbox(manifest) {
+  const declared = manifest?.ruleParams?.db?.queueOutbox;
+  return declared ? { table: declared.table, columns: new Set(declared.columns) } : null;
+}
+
+/** The queue constant one outbox row enqueues: `insert into <outbox> (queue, ...) values ('<queue constant>', ...)` with pure values. */
+function outboxEnqueue(state, insert) {
+  if (!state.outbox || insert.returningClause || insert.returningList || insert.onConflictClause || insert.withClause) return null;
+  if (`${insert.relation?.schemaname || 'public'}.${insert.relation?.relname}` !== state.outbox.table) return null;
+  const columns = (insert.cols ?? []).map((item) => item.ResTarget?.name);
+  if (new Set(columns).size !== columns.length || columns.some((column) => !state.outbox.columns.has(column))) return null;
+  const rows = insert.selectStmt?.SelectStmt?.valuesLists ?? [];
+  const values = rows.length === 1 ? rows[0].List?.items ?? [] : [];
+  const at = columns.indexOf('queue');
+  if (at < 0 || values.length !== columns.length) return null;
+  const queue = sqlLiteral(values[at]);
+  return queue !== null && state.constants.has(queue) && pureExpressions(values) ? queue : null;
+}
+
+/** The queue one statement enqueues to (an outbox row of a queue constant; a pgmq.send only when `legacy`), or null. */
+function singleEnqueue(state, tree, legacy) {
+  const insert = tree?.stmts?.length === 1 ? tree.stmts[0].stmt?.InsertStmt : undefined;
+  if (insert) return outboxEnqueue(state, insert);
+  const call = singleCall(tree);
+  return legacy && call ? enqueue(state, call) : null;
+}
+
+/** PostgreSQL's catalog-owned scalar UUID constructor adds an envelope identity without doing work in the tick. */
+function uuidConstructor(call) {
+  return callName(call) === 'pg_catalog.gen_random_uuid' && (call.args?.length ?? 0) === 0
+    && (call.agg_order?.length ?? 0) === 0 && !call.agg_filter && !call.over && !call.agg_star
+    && !call.agg_distinct && !call.agg_within_group && !call.func_variadic;
+}
+
 function functionBody(fn) {
   const option = (name) => (fn.options ?? []).find((item) => item.DefElem?.defname === name)?.DefElem?.arg;
   return { body: strings(option('as')?.List?.items).join(''), language: option('language')?.String?.sval ?? 'sql' };
@@ -239,7 +284,7 @@ function plpgsqlTickTrees(fn, body) {
   let safe = true;
   walk(tree, (item) => {
     for (const key of Object.keys(item)) {
-      if (key.startsWith('PLpgSQL_stmt_') && !['PLpgSQL_stmt_block', 'PLpgSQL_stmt_perform', 'PLpgSQL_stmt_return'].includes(key)) safe = false;
+      if (key.startsWith('PLpgSQL_stmt_') && !['PLpgSQL_stmt_block', 'PLpgSQL_stmt_perform', 'PLpgSQL_stmt_execsql', 'PLpgSQL_stmt_return'].includes(key)) safe = false;
       if (key === 'PLpgSQL_expr') trees.push(sqlTree(item[key].query));
     }
   });
@@ -254,20 +299,22 @@ function tickTrees(fn) {
   return sqlTree(body)?.stmts?.map((entry) => ({ stmts: [entry] })) ?? null;
 }
 
-function tickQueues(state, fn) {
+function tickQueues(state, fn, legacy) {
   const trees = tickTrees(fn.node);
   if (!trees) return null;
-  const queues = trees.map((tree) => singleCall(tree)).map((call) => call && enqueue(state, call));
+  const queues = trees.map((tree) => singleEnqueue(state, tree, legacy));
   return queues.length && queues.every(Boolean) ? queues : null;
 }
 
-function scheduleTarget(state, command) {
-  const target = singleCall(sqlTree(command));
-  if (!target) return { tick: null, queues: null };
-  if (!callName(target).endsWith('_tick')) return { tick: null, queues: enqueue(state, target) };
+/** What a cron command enqueues; `legacy` judges a job's original body, which may still pgmq.send to a queue that existed then. */
+function scheduleTarget(state, command, legacy) {
+  const tree = sqlTree(command);
+  const target = singleCall(tree);
+  if (!target) return { tick: null, queues: singleEnqueue(state, tree, legacy) };
+  if (!callName(target).endsWith('_tick')) return { tick: null, queues: legacy ? enqueue(state, target) : null };
   const tick = qualified(callName(target));
   const fn = state.functions.get(tick);
-  const queues = fn && pureArguments(target) && tickQueues(state, fn);
+  const queues = fn && pureArguments(target) && tickQueues(state, fn, legacy);
   return { tick, queues };
 }
 
@@ -289,9 +336,9 @@ function scheduleCheck(state, schedule, names, schedulers, ticks) {
   if (names.has(name)) problem(state, DB_CRON_OWNED, file, 'cron job names must be unique across active migrations');
   names.add(name);
   const historical = { ...state, created: schedule.created, functions: schedule.functions };
-  const { tick, queues } = scheduleTarget(historical, command);
-  if (!queues) problem(state, DB_CRON_OWNED, file, 'a cron command is one pgmq.send to an existing queue or one existing *_tick function that only enqueues; business DML, dynamic SQL and network calls are refused');
-  if (state.liveSchedules.get(name) === schedule && !scheduleTarget(state, command).queues) problem(state, DB_CRON_OWNED, file, 'the live cron job targets a missing queue or tick, or its current tick no longer only enqueues');
+  const { tick, queues } = scheduleTarget(historical, command, true);
+  if (!queues) problem(state, DB_CRON_OWNED, file, 'a cron command inserts one row of a queue constant into the queue outbox, directly or through one existing *_tick function that only does that; business DML, dynamic SQL and network calls are refused');
+  if (state.liveSchedules.get(name) === schedule && !scheduleTarget(state, command, false).queues) problem(state, DB_CRON_OWNED, file, 'the live cron job must insert one outbox row of a queue constant (ruling:R212/case-10): it targets a missing queue or tick, still enqueues with pgmq.send, or its current tick no longer only does that');
   tickOwner(state, tick, file, ticks);
   const owners = [name, ...(tick ? [tick, tick.split('.').at(-1)] : []), ...[queues ?? []].flat()];
   if (owners.some((owner) => schedulers.has(owner))) problem(state, DB_CRON_OWNED, file, 'the tick is also declared in an application scheduler list; give it one owner');
@@ -304,20 +351,23 @@ function tickOwner(state, tick, file, ticks) {
   ticks.add(tick);
 }
 
-function queueState({ repoRoot, files = [], all = files, repo = {} }) {
+function queueState({ repoRoot, files = [], all = files, repo = {}, manifest }) {
   const paths = [...new Set(all)];
   const declaration = readJson(repoRoot, 'hfs.json') ?? repo;
   const connected = ['be', 'fe'].some((side) => (declaration.sides?.[side]?.connections ?? []).some((item) => item.provider === 'supabase'));
   if (repo.edition !== 'lite' && declaration.edition !== 'lite' && !declaration.supabase && !connected && !paths.some((file) => file.startsWith('supabase/'))) return null;
-  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], constants: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
+  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
   state.sources = queueSourceFacts(state, paths, inspectCalls);
   migrationFacts(state, paths);
   return state;
 }
 
 function validateQueues(state, inScope) {
-  for (const [queue, file] of state.constants) if (!state.created.has(queue)) problem(state, DB_PGMQ_DECLARED, file, 'a queue constant has no pgmq.create in an active migration');
-  for (const [queue, file] of state.created) if (!state.constants.has(queue)) problem(state, DB_PGMQ_DECLARED, file, 'pgmq.create has no corresponding queue constant under modules/queues');
+  for (const [queue, file] of state.created) {
+    if (state.constants.has(queue)) problem(state, DB_PGMQ_DECLARED, file, `pgmq queue ${queue} is the queue constant of ${state.constants.get(queue)}, and the queue is BullMQ on Redis (ruling:R212/case-10): drop it with pgmq.drop_queue in a later migration`);
+    else if (!state.topics.has(queue)) problem(state, DB_PGMQ_DECLARED, file, `pgmq queue ${queue} has no event-bus owner: name it in a literal *_TOPIC_QUEUE constant under platform/event-bus, or drop it with pgmq.drop_queue in a later migration`);
+  }
+  for (const [topic, file] of state.topics) if (!state.created.has(topic)) problem(state, DB_PGMQ_DECLARED, file, `event-bus topic queue ${topic} has no pgmq.create in an active migration`);
   for (const { node, file, created, executed } of state.grants) grantCheck({ ...state, created: executed ? created : state.created }, node, file);
   const names = new Set();
   const ticks = new Set();