@starci/hfs 4.7.32 → 4.7.34

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.6.0
+version: 3.7.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -42,7 +42,9 @@ versioning:
 # 3.5.0 is a minor (alpha.27): it ADDS the opt-in app.browser-config slot, the managed browser/tsconfig.json that type-checks the browser
 # journey (enabled with app.browser by `browser: true`).
 # 3.6.0 is a minor (alpha.30): it ADDS the opt-in be.feature.realtime.sse slot, the server-sent-events door of the realtime kind (owner decision
-# 2026-10-24: lite may serve SSE, and SSE is the default door for one-way push), and lets fe.modules.api hold the SSE stream readers (sse/).
+# 2026-10-24: lite may serve SSE, and SSE is the default door for one-way push), and lets fe.modules.api hold the SSE stream operations (sse/).
+# 3.7.0 is a minor (alpha.31): it ADDS the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
+# transport client layer), and lets fe.hooks.swr hold the SWR subscription hooks (api/sse/subscriptions/useSubscribe<X>Swr.ts, one useSWRSubscription per stream operation).
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -109,15 +111,18 @@ testValues: [unit-beside, e2e, none]
 # The editions a repository declares in hfs.json `edition` (absent means full). ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite IS
 # the full architecture with Supabase backing services - the same monorepo, slots, CQRS shape and patterns (queue,
 # event bus, saga, reactors, projection, realtime, webhooks, fenced job), declared in hfs.json the same way, and the same unit
-# specs (unitRoles, logicRoles, 100 per file, @starci/jest-preset doubles, builders). What differs is ADAPTERS and DELIVERY, all
-# on Supabase except realtime: schema authority in supabase/migrations, queue and event-bus ports on Supabase Queues (pgmq),
-# cache and locks on Postgres, schedules on pg_cron (+ pg_net), storage and auth on Supabase. Realtime uses the socket.io gateway
-# in the api process, one instance and no Redis adapter. Integration and provider sandbox contract specs are optional;
+# specs (unitRoles, logicRoles, 100 per file, @starci/jest-preset doubles, builders). What differs is ADAPTERS and DELIVERY
+# (ruling:R212/case-10): schema authority in supabase/migrations, the queue port on BullMQ over the Redis hfs.json
+# sides.be.backing declares (as in full, fed by the Postgres outbox), event-bus ports on pgmq-backed topics or in-process
+# delivery, cache and locks on Postgres or the declared Redis, schedules on pg_cron (+ pg_net) enqueueing through the queue
+# outbox, storage and auth on Supabase. Realtime uses SSE or the socket.io gateway
+# in the api process, which scales horizontally and stateless (memory hub for one replica or tests; the Redis hub and @socket.io/redis-adapter when Redis is declared, else the Postgres hub and @socket.io/postgres-adapter, for N replicas; websocket only, no sticky sessions). Integration and provider sandbox contract specs are optional;
 # declared patterns owe their integration proofs (R284). Lite has no e2e world. Production uses declared docker-swarm under
-# .starcistacks/production/infra/swarm/ (owner ruling 2026-10-14); no self-hosted database or broker. The front end is full's (R97).
+# .starcistacks/production/infra/swarm/ (owner ruling 2026-10-14); lite runs no self-hosted database, and runs only the backing
+# services sides.be.backing declares. The front end is full's (R97).
 # Lite is this same manifest filtered: a slot whose `editions` lacks lite does not exist for a lite app, `litePresence` replaces
-# presence and a `lite` map replaces the fields it names. Upgrade lite -> full adds only (swap the adapters, add the e2e and
-# self-hosted backing services); downgrade is not supported. Lite contracts are allowed (owner decision 2026-10-14).
+# presence and a `lite` map replaces the fields it names. The edition is chosen once at scaffold; there is no upgrade
+# or downgrade between lite and full. Lite contracts are allowed (owner decision 2026-10-14).
 editions: [full, lite]
 
 # The two sides of an app: the folder of each is its profile name (be/, fe/). `reads` lists the only paths of the OTHER side a side
@@ -189,6 +194,9 @@ ruleParams:
     # R259: btree_gist supplies UUID equality for the booking interval exclusion constraint.
     # R259: unaccent is a first-party Supabase extension used by Vietnamese-content search functions.
     extensions: [pgmq, pg_cron, pgcrypto, pg_trgm, vector, uuid-ossp, pg_net, supabase_vault, unaccent, btree_gist]
+    # R258 DB_CRON_OWNED: THE queue outbox of a Supabase schema (the relay hands its unsent rows to BullMQ, ruling:R212/case-10). A pg_cron
+    # job enqueues only by inserting one row into this table, writing only these columns, one of which is `queue`.
+    queueOutbox: {table: public.queue, columns: [queue, payload, created_at, correlation_id]}
   common:
     # HFS_SIZE_GROWTH: a file above soft may not grow against its parent commit; a new file stays within soft. Slot
     # budgets (component.tsx 300, hooks 200, modules 400) are stricter than this cap where they apply.
@@ -210,12 +218,19 @@ ruleParams:
       "node:https": [platform/http]
       http: [platform/http]
       https: [platform/http]
+      "@aws-sdk/client-s3": [integrations/object-storage]       # the ObjectStorage port: one S3 adapter for MinIO, S3, Spaces and Supabase Storage
+      "@aws-sdk/s3-request-presigner": [integrations/object-storage]
       cache-manager: [integrations/cache, integrations/redis]
       "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability
       redis: [integrations/cache, integrations/redis]
-      ioredis: [integrations/cache, integrations/redis]
+      ioredis: [integrations/cache, integrations/redis, platform/realtime]
+      "@keyv/redis": [integrations/cache, integrations/redis]
+      cache-manager-redis-yet: [integrations/cache, integrations/redis]
+      cache-manager-ioredis-yet: [integrations/cache, integrations/redis]   # the Redis hub and the sharded socket.io adapter of platform/realtime
       bullmq: [platform/queue]               # pattern queue: BullMQ jobs and job schedulers (the relay of the outbox into queues)
       "@nestjs/bullmq": [platform/queue]
+      bull: [platform/queue]
+      "@nestjs/bull": [platform/queue]
       kafkajs: [platform/event-bus]          # pattern event-bus: Kafka is the only event transport
       "@nestjs/schedule": []                 # no @Cron / @Interval / @Timeout anywhere: a schedule is a BullMQ job scheduler of a queue
       eventemitter2: []
@@ -224,6 +239,8 @@ ruleParams:
       "node:timers": [platform/retry, platform/event-bus, platform/queue, platform/http]
       "node:timers/promises": [platform/retry, platform/event-bus, platform/queue, platform/http]
       winston: [platform/logging]
+      "node:async_hooks": [platform/logging]
+      nestjs-cls: []
       dayjs: [platform/clock, platform/primitives]
       moment: [platform/clock, platform/primitives]
       date-fns-tz: [platform/clock, platform/primitives]
@@ -234,6 +251,9 @@ ruleParams:
       socket.io: [platform/realtime]
       graphql-subscriptions: [platform/realtime]
       graphql-ws: [platform/realtime]
+      "@socket.io/postgres-adapter": [platform/realtime]   # the stateless socket.io adapter of a scaled lite back end without Redis
+      "@socket.io/redis-adapter": [platform/realtime]      # the sharded socket.io adapter of a scaled back end on the declared Redis
+      pg: [platform/realtime]                              # the LISTEN connection of the Postgres hub; every other query goes through TypeORM
     # R87 BE_CQRS_SHAPE no-event-bus: the in-process event vocabulary the rule refuses. `imports` maps a module
     # specifier to the member names that are an in-process event; `[]` flags the package itself (its emitter packages
     # are the `[]` owners of infraOwners above). `classes` maps a module specifier to the class names that are an
@@ -249,8 +269,13 @@ ruleParams:
     # R48 BE_SPEC_QUALITY spec-infra-double-from-kit: in a `<name>.service.spec.ts` a provider `{ provide: TOKEN, useValue: X }` takes X from
     # the kit named here (the package root of `kit`). The token name is normalised to UPPER_SNAKE (`EntityManager` -> ENTITY_MANAGER), the
     # FIRST entry whose `token` regex matches decides, and `fallback` decides for every other token. `forms` say what X may be:
+    # Inbox-like names resolve their token declaration first: genuine platform/inbox aliases keep fakeInbox, while a business service
+    # or queue producer containing Inbox keeps its collaborator double. An unresolved origin retains the lexical table choice.
     # call = `double(...)`, new = `new Double(...)`, curried = `double(...)(...)`, object = a plain object literal (REAL values),
     # primitive = a string/number/boolean literal, array = an array literal (multi-providers of doubles). A const bound to such a value counts.
+    # An entry may add `from`, a regex over the path of the file that DECLARES its port's token: the declaration decides, not the import written
+    # in the spec. A token declared in another module that ends alike is a different port (`CORRELATION_IDS` of logging is not `IDS` of ids), and
+    # the owner's token stays that port however it is re-exported or renamed. A token that cannot be resolved is judged by its spelling.
     specDoubles:
       kit: "@starci/jest-preset"
       doubles:
@@ -263,7 +288,7 @@ ruleParams:
         - {token: "(?:^|_)INBOX(?:_|$)", double: fakeInbox, forms: [call]}
         - {token: "(?:^|_)CACHE(?:_|$)", double: fakeCache, forms: [call]}
         - {token: "(?:^|_)(?:LOCK|LEASE|FENCE|HOLD)(?:_|$)", double: fakeLock, forms: [call]}
-        - {token: "(?:^|_)(?:IDS|ID_GENERATOR|ID_FACTORY)$", double: fakeIds, forms: [call]}
+        - {token: "(?:^|_)(?:IDS|ID_GENERATOR|ID_FACTORY)$", from: "/src/modules/platform/ids/", double: fakeIds, forms: [call]}
       fallback: {double: mock, forms: [call, primitive, array]}
     # R85 BE_RAW_INJECT injected-param-name: the names of the ports every class injects the same way (BE-CONVENTION 1.6: the parameter name
     # is the camelCase of the port). An entry matches a constructor parameter that carries an injector and is annotated with a type
@@ -281,7 +306,7 @@ ruleParams:
     # R89 BE_SOURCE_FORM: the closed role-suffix vocabulary of a source file name (<kebab-name>.<suffix>.ts; BE-CONVENTION 1.15)
     # and the suffixes that are never a role. index.ts, main.ts, app.module.ts and the migrations of be.persistence are the
     # only names outside it.
-    suffixes: [module, module-definition, decorators, options, config, connection, service, schema, command, query, handler, templates, compensation, saga-state, saga-step, saga, contracts, port, resolver, controller, gateway, webhook, subscription, consumer, cli, event, queue, projection, projection-entity, processor, step, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
+    suffixes: [module, module-definition, decorators, options, config, connection, service, schema, command, query, handler, templates, compensation, saga-state, saga-step, saga, contracts, port, resolver, controller, gateway, webhook, subscription, consumer, cli, event, queue, projection, projection-entity, processor, step, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, adapter, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
     # R47 BE_CONTRACT_UNGUARDED: the world's shape vocabulary. `helper` names the function a contract spec imports to erase the values of a JSON
     # payload (`shapeOf`); a contract spec proves a fake's fixtures by asserting helper(real) equals helper(fixture).
     contractShape: {helper: shapeOf}
@@ -300,7 +325,10 @@ ruleParams:
     # options, config, command, query, contracts, port, event, queue, entity, sql, rows, messages, log-events, error, decorators, cache-keys,
     # projection-entity, connection, and every file with no role: index.ts, main.ts, migrations) is declaration or composition and is never measured.
     # A unit spec beside such a file (`<name>.<role>.spec.ts`) is legal but not required: the file owes 100, not a spec of its own.
-    logicRoles: [service, schema, policy, projection, guard, mapper, client, filter, interceptor, processor, step, saga, saga-step, compensation, consumer, webhook]
+    logicRoles: [service, schema, policy, projection, guard, mapper, client, adapter, filter, interceptor, processor, step, saga, saga-step, compensation, consumer, webhook]
+    # R281 BE_SPEC_FORM_ALL_ROLES. THE logic roles whose file declares values Nest never constructs (a zod schema): its spec parses the declared
+    # value directly and builds no testing module; every other logic role is built through `Test.createTestingModule`.
+    valueRoles: [schema]
     # R203 BE_FEATURE_THIN. THE roles a feature-tier file is judged thin by: a file `<name>.<role>.ts` of one of these roles inside a slot of tier
     # feature maps parameters and makes ONE delegating call into modules/ (a service, the command or query bus, the event bus, a queue producer): no
     # branch, loop, ternary, try or throw, no computation; orchestration (step order, compensation, claim, fencing, retry) lives in platform/*.
@@ -308,12 +336,14 @@ ruleParams:
     # BE_PATTERN_SPEC_MISSING: a declared pattern (hfs.json sides.be.patterns) is proven on the test world. Each id below needs a test titled
     # "<pattern>/<id>: ..." in an e2e or integration spec (be/src/tests/e2e, be/src/tests/integration).
     patternScenarios:
+      logging: [correlation-survives-queue]
       event-bus: [atomic-with-transaction, relay-only-after-commit, redelivery-then-dead-letter, duplicate-delivery-is-a-noop]
       queue: [enqueue-atomic-with-transaction, relay-job-id-is-outbox-id, scheduler-fires-once]
       webhooks: [bad-signature-is-refused, replay-is-refused, accepted-delivery-publishes-once]
-      realtime: [subscriber-receives-push, foreign-topic-is-isolated, disconnect-releases-subscription]
+      realtime: [subscriber-receives-push, foreign-topic-is-isolated, disconnect-releases-subscription, push-crosses-replicas, resume-after-reconnect]
       fenced-job: [claim-bumps-token, zombie-fenced-out, redispatch-isolated]
       projection: [recompute-is-idempotent, replay-rebuilds]
+      idempotency: [repeat-returns-same-outcome, reused-key-other-body-is-refused]
     # BE_KIND_DECLARATION: the patterns an app that uses a trigger kind declares in hfs.json sides.be.patterns; the platform capabilities of those
     # patterns (the slots of tier platform that name the pattern) must exist.
     kindPatterns:
@@ -338,23 +368,29 @@ ruleParams:
       api: {topic: api, variable: feature, trigger: api, patterns: [], needs: [service], defaults: {action: "@name"}}
       cli: {topic: cli, variable: group, trigger: cli, patterns: [], needs: [service], wire: {file: src/features/cli/cli.module.ts, import: "./@@group@@/@@group@@.module", symbol: "@@Group@@Module"}}
     bannedSuffixes: [use-case, repository, fixture, factory, store, worker, scheduler, cron, job, listener, dto, util, utils, helper, helpers, rules, types, constants, int-spec, harness-spec, test]
+    # ruling:R212/case-10 (R212 HFS_BACKING_UNDECLARED / HFS_BACKING_UNUSED, R276 STACKS_LITE_SELFHOSTED_DB): THE backing services a back
+    # end may declare in hfs.json sides.be.backing. `clients` are the libraries that consume the service: one of them as a dependency
+    # is its consumer, and under lite none of them may be a dependency while the service is undeclared. `patterns` are the declared
+    # patterns that need the service. `images` are the image repositories (the last path segment) a stack runs it from.
+    # `editions` limits admission: owner:lite-vector-is-pgvector keeps vector search on Supabase pgvector in lite.
+    backing:
+      redis: {clients: [bullmq, "@nestjs/bullmq", bull, "@nestjs/bull", ioredis, redis, "@keyv/redis", cache-manager-redis-yet, cache-manager-ioredis-yet, "@socket.io/redis-adapter"], patterns: [queue, fenced-job], images: [redis, redis-stack, redis-stack-server]}
+      qdrant: {clients: ["@qdrant/js-client-rest", "@qdrant/qdrant-js"], patterns: [], images: [qdrant], editions: [full]}
     # Edition lite (ruleParams(manifest, 'be', 'lite') merges these keys over the base; a map merges one level deep): the schema
     # authority is the Supabase migration tree (supabase/migrations/*.sql, forward-only), so a lite back end holds no TypeORM
     # migration or entity under be/ (R34/R35 read schemaAuthority; be.persistence's lite overlay allows neither). The unit roles,
-    # logic roles and spec doubles are full's (owner ruling 2026-10-12 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4). infraOwners: the self-hosted libraries are owned nowhere -
-    # platform/queue and platform/event-bus run Supabase Queues (pgmq) through the shared EntityManager, cache and locks are
-    # Postgres (advisory locks or an unlogged table), and realtime is the same socket.io gateway as full, run inside the api
-    # process with no Redis adapter (owner ruling 2026-10-13).
+    # logic roles and spec doubles are full's (owner ruling 2026-10-12 (owner:lite-production-swarm), with the Work boundary amended by ruling:R212/case-4). infraOwners: full's owners,
+    # bullmq in platform/queue and ioredis/redis in integrations/cache and integrations/redis (ruling:R212/case-10: the queue is
+    # Redis in both editions; a backing library is legal only when hfs.json sides.be.backing declares its service, which
+    # HFS_BACKING_UNDECLARED checks), except Kafka, which is owned nowhere (platform/event-bus runs Supabase Queues (pgmq) through
+    # the shared EntityManager); realtime is the same socket.io gateway as full, run inside the api process, scaled horizontally and stateless (hub redis when
+    # Redis is declared, else hub postgres with @socket.io/postgres-adapter; no sticky sessions).
     lite:
       schemaAuthority: supabase
       infraOwners:
-        bullmq: []
-        "@nestjs/bullmq": []
         kafkajs: []
-        redis: []
-        ioredis: []
-        graphql-subscriptions: []
-        graphql-ws: []
+        "@qdrant/js-client-rest": []
+        "@qdrant/qdrant-js": []
 
 slots:
 
@@ -730,7 +766,7 @@ slots:
   - id: app.starcistacks
     since: 3.1.0
     profiles: [app]
-    editionWhy: "owner:lite-production-swarm: lite requires declared docker-swarm production with Supabase backing; full also admits Compose development, Kubernetes and Terraform."
+    editionWhy: "owner:lite-production-swarm: lite requires declared docker-swarm production with Supabase backing; owner:dev-docker-prod-swarm keeps dependencies in Docker Linux containers in dev and the app and dependencies on Swarm in prod except hosted Supabase."
     exemplifiedBy:
       - {path: packages/hfs/templates/app/skeleton/.starcistacks/, edition: full}
       - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/, edition: lite}
@@ -916,7 +952,7 @@ slots:
     tracked: external
     tier: none
     tests: none
-    goesTo: "a be feature: webhooks/<provider> for a third-party callback, api for an endpoint, a job of a pgmq-backed queue or a cli command on a schedule (pg_cron / pg_net)"
+    goesTo: "a be feature: webhooks/<provider> for a third-party callback, api for an endpoint, a job of a queue (BullMQ on the declared Redis, its tick enqueued through the queue outbox) or a cli command on a schedule (pg_cron / pg_net)"
     since: 2.1.0
 
   # ----- side root (both sides): what a standalone repository root holds, less the app-root files ----------
@@ -1436,7 +1472,7 @@ slots:
     since: 1.0.0
   - id: be.feature.realtime
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4) and ruling:R212/case-5 (owner decision 2026-10-24): lite serves server-sent events (the default door for one-way push) or runs socket.io in the api process, one instance without Redis; full may scale its gateway."
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4) and ruling:R212/case-5 (owner decision 2026-10-24): both editions serve server-sent events (the default door for one-way push), the socket.io gateway (two-way) and the restricted GraphQL subscription (ruling:R212/case-7) from the api process (owner:lite-graphql-subscription-door), and scale on the hub of their declared infrastructure (BE-REALTIME-7)."
     path: "src/features/realtime/<channel>/"
     presence: opt-in              # a push channel: reads and pushes only (an SSE controller, a socket gateway or a GraphQL subscription), no domain write
     pattern: realtime             # declaring the pattern (hfs.json sides.be.patterns) enables the kind (knowledge/patterns/be/realtime.yaml)
@@ -1449,9 +1485,8 @@ slots:
     tests: none
     lite:
       why: >-
-        a push channel: the server-sent-events door (be.feature.realtime.sse, the default for one-way push, owner decision 2026-10-24)
-        or the same socket.io gateway as full (owner ruling 2026-10-13), both run inside the be api process, one instance and no
-        Redis adapter; the front end listens through a use<Channel>Stream hook over modules/api/sse, or hooks/socketio (knowledge/patterns/be/realtime.yaml, liteAdapter)
+        a push channel with the three doors of both editions: server-sent events (be.feature.realtime.sse, the default for one-way push, owner decision 2026-10-24), the socket.io gateway (two-way, owner ruling 2026-10-13) and the restricted GraphQL subscription (ruling:R212/case-7); all run inside the be api process, which scales horizontally and stateless
+        on the hub of its declared infrastructure; the front end listens through a useSubscribe<Channel>Swr hook over modules/api/sse, or hooks/socketio (knowledge/patterns/be/realtime.yaml, liteAdapter)
     coverage: none
     rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
     since: 1.0.0
@@ -1459,14 +1494,11 @@ slots:
       - {path: packages/hfs/src/hfs-stacks-swarm.spec.mjs, edition: lite}
   - id: be.feature.realtime.graphql
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite pushes through the SSE door or the in-process socket.io gateway; the GraphQL subscription door remains full-only."
     path: "src/features/realtime/<channel>/transport/graphql/"
-    presence: opt-in              # a GraphQL subscription over graphql-ws
-    litePresence: forbidden       # ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite pushes through the api's SSE door or its in-process socket.io gateway
+    presence: opt-in              # a GraphQL subscription over graphql-ws, served in both editions (ruling:R212/case-7) and restricted: only when the client already uses GraphQL and needs the typed schema payload (knowledge/patterns/be/realtime.yaml)
     pattern: realtime
     tracked: tracked
     tier: feature
-    goesTo: "src/features/realtime/<channel>/transport/sse/ (be.feature.realtime.sse, the default for one-way push) or transport/websocket/ (be.feature.realtime.websocket): lite runs either door in the api process"
     requires: ["<channel>-graphql.module.ts", "<channel>.subscription.ts", "<channel>.subscription.spec.ts"]
     allows: ["<channel>-graphql.module.ts", "<channel>-graphql.module-definition.ts", "<channel>-graphql.options.ts", "<channel>.subscription.ts", "<channel>.subscription.spec.ts", dto/]
     tests: unit-beside            # the door's own spec beside the door (a subscription has no service of its own)
@@ -1476,14 +1508,11 @@ slots:
     since: 1.0.0
   - id: be.feature.realtime.dto
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): GraphQL subscription DTOs exist only with the full subscription door; lite uses SSE or socket.io contracts."
     path: "src/features/realtime/<channel>/transport/graphql/dto/"
     presence: opt-in
-    litePresence: forbidden       # the dto of the graphql door, which lite does not serve
     pattern: realtime
     tracked: tracked
     tier: feature
-    goesTo: "src/features/realtime/<channel>/transport/sse/ (be.feature.realtime.sse, the default for one-way push) or transport/websocket/ (be.feature.realtime.websocket): lite runs either door in the api process"
     allows: ["<name>.{input,type,args}.ts"]
     tests: none
     coverage: none
@@ -1647,13 +1676,28 @@ slots:
     # resolved through the RequestLocale provider (request: stored user preference, else Accept-Language, else
     # vi; non-request: recipient's stored preference, else vi - see knowledge/patterns/be/messages.yaml);
     # database when a connection exists.
-    requiredInstances: {capability: [config, logging, errors, primitives, clock, i18n]}
+    requiredInstances: {capability: [config, errors, primitives, clock, i18n]}
     requires: [index.ts]
     forbids: [common/, utils/, shared/, testing/]   # primitives live in platform/primitives
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
     coverage: required
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE]
+  - id: be.platform.logging
+    since: 3.5.0
+    profiles: [be]
+    path: "src/modules/platform/logging/"
+    presence: required
+    pattern: logging
+    tracked: tracked
+    tier: platform
+    owner: true
+    requires: [index.ts]
+    forbids: [common/, utils/, shared/, testing/]
+    tests: unit-beside
+    coverage: required
+    budget: {indexExports: 60}
+    rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE]
   # ----- BE: pattern slots (opt-in; enabled by hfs.json sides.be.patterns). A path under one is HFS_SLOT_NOT_ENABLED unless its pattern is declared.
   - id: be.platform.event-bus
     since: 3.1.0
@@ -1670,7 +1714,7 @@ slots:
         the same EventPublisher and EventConsumer ports on Supabase Queues (pgmq): the outbox relay sends each committed row to the
         pgmq queue of every consumer group of its topic through the shared EntityManager, a consumer reads with a visibility
         timeout, retries by letting it lapse and archives the message on dead letter (read_ct over the budget); a single api may
-        deliver in process. No Kafka (knowledge/patterns/be/supabase-queues.yaml)
+        deliver in process. No Kafka (knowledge/patterns/be/event-bus.yaml liteAdapter)
     requires: [index.ts, event-bus.module.ts, event-bus.port.ts, event-bus.contracts.ts, event-bus.service.ts, event-bus.service.spec.ts]
     tests: unit-beside
     coverage: required
@@ -1681,7 +1725,7 @@ slots:
   - id: be.platform.queue
     since: 3.1.0
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite implements queue ports with pgmq and pg_cron; full uses BullMQ and Redis."
+    editionWhy: "ruling:R212/case-10: both editions implement the queue ports with BullMQ on Redis; lite declares its Redis in hfs.json sides.be.backing and keeps the outbox table in a supabase migration."
     path: "src/modules/platform/queue/"
     presence: opt-in
     pattern: queue                # the ONE BullMQ owner: the outbox relay into queues (jobId = outbox id) and job schedulers (knowledge/patterns/be/queues.yaml)
@@ -1690,10 +1734,10 @@ slots:
     owner: true
     lite:
       why: >-
-        the same QueueOutbox and QueueWorkerRegistry ports on Supabase Queues (pgmq): the relay sends each committed outbox row with
-        pgmq.send (the outbox id travels in the message, so a second send is a no-op at the processor's inbox), processors read
-        with a visibility timeout, back off by extending it, and pgmq.archive a message whose read_ct exceeds the budget (the dead
-        letter); a schedule is a pg_cron job that enqueues. No BullMQ or Redis (knowledge/patterns/be/supabase-queues.yaml)
+        the same QueueOutbox and QueueWorkerRegistry ports and full's BullMQ adapter on the declared Redis (backing: [redis]): the
+        relay adds each committed outbox row with the outbox id as the job id, workers retry with exponential backoff and keep a
+        job that exhausts its attempts as failed (the dead letter); the outbox table comes from a supabase migration, and a
+        schedule is a BullMQ job scheduler or a pg_cron tick that inserts one outbox row (knowledge/patterns/be/queues.yaml liteAdapter)
     requires: [index.ts, queue.module.ts, queue.port.ts, queue.contracts.ts, queue-outbox.service.ts, queue-outbox.service.spec.ts]
     tests: unit-beside
     coverage: required
@@ -1786,7 +1830,7 @@ slots:
   - id: be.platform.jobs
     since: 3.1.0
     profiles: [be]
-    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite persists fenced claims in Supabase migrations and dispatches through pgmq; full uses TypeORM schema authority and its queue adapter."
+    editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite persists fenced claims in Supabase migrations and dispatches through the BullMQ queue on its declared Redis (ruling:R212/case-10); full uses TypeORM schema authority and the same queue adapter."
     path: "src/modules/platform/jobs/"
     presence: opt-in
     pattern: fenced-job           # the ONE fencing primitive: the job entity, the claim that bumps the token, guarded writes (knowledge/patterns/be/jobs.yaml)
@@ -2138,8 +2182,8 @@ slots:
     rules: [FE_HOOKS_ARE_HOOKS, FE_DATA_FRESHNESS]
   - id: fe.hooks.swr
     profiles: [fe]
-    # The data hooks (fe-stack data, FE-DATA-SWR): one useSWR / useSWRMutation wrapper per modules/api operation, keyed
-    # QUERY_<X>_SWR_KEY / MUTATE_<X>_SWR_KEY plus the identity of the request; SwrSideEffects.tsx runs the app-wide hooks once.
+    # The data hooks (fe-stack data, FE-DATA-SWR): one useSWR / useSWRMutation / useSWRSubscription wrapper per modules/api operation, keyed
+    # QUERY_<X>_SWR_KEY / MUTATE_<X>_SWR_KEY / SUBSCRIBE_<X>_SWR_KEY plus the identity of the request; SwrSideEffects.tsx runs the app-wide hooks once.
     path: "apps/<app>/src/hooks/swr/"
     presence: optional
     tracked: tracked
@@ -2148,7 +2192,9 @@ slots:
     requires: [index.ts]
     allows: [index.ts, SwrSideEffects.tsx, api/index.ts, "api/{graphql,rest}/index.ts", "api/{graphql,rest}/{queries,mutations}/index.ts",
              "api/graphql/queries/useQuery*Swr.ts", "api/graphql/mutations/useMutate*Swr.ts",
-             "api/rest/queries/useGet*Swr.ts", "api/rest/mutations/use{Post,Put,Patch,Delete}*Swr.ts"]
+             "api/rest/queries/useGet*Swr.ts", "api/rest/mutations/use{Post,Put,Patch,Delete}*Swr.ts",
+             "api/graphql/subscriptions/index.ts", "api/graphql/subscriptions/useSubscribe*Swr.ts",
+             "api/sse/index.ts", "api/sse/subscriptions/index.ts", "api/sse/subscriptions/useSubscribe*Swr.ts"]
     roles: {entry: index.ts, effects: SwrSideEffects.tsx}
     tests: none
     budget: {file: 200, barrel: 400}
@@ -2271,18 +2317,19 @@ slots:
     tier: transport
     # The browser's calls to the back end (owner ruling 2026-10-13, fe-stack graphql/rest/codegen, FE-API-GRAPHQL): the auth and
     # no-auth Apollo clients with their link chain (graphql/clients), one file per operation (graphql/queries/query-<x>.ts,
-    # graphql/mutations/mutation-<x>.ts with its gql document map and typed request/response in types/), the generated wire types
+    # graphql/mutations/mutation-<x>.ts and graphql/subscriptions/subscription-<x>.ts, each with its gql document map and typed request/response in types/), the generated wire types
     # (graphql/__generated__), the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints and the fetch readers of
-    # server-sent-events streams (sse/<area>/*.ts, one file per stream, the bearer token from modules/auth). A repository has
+    # server-sent-events streams (sse/<area>/stream-<channel>.ts, one operation per stream, run on the stream reader of sse/clients). A repository has
     # exactly ONE client folder and ONE GraphQLResponse union: the app's (fe.transport.client/outcome) when one app calls the back end,
     # or the api package's (fe.package.api.client/outcome) when several do (FE_TRANSPORT_OWNER, machine).
     requires: [index.ts]
     allows: [index.ts, graphql/index.ts, graphql/types.ts, "graphql/clients/**", "graphql/queries/query-*.ts", "graphql/queries/types/*.ts",
-             "graphql/mutations/mutation-*.ts", "graphql/mutations/types/*.ts", "graphql/__generated__/**", "rest/index.ts", "rest/<area>/*.ts",
-             "sse/index.ts", "sse/<area>/*.ts"]
+             "graphql/mutations/mutation-*.ts", "graphql/mutations/types/*.ts", "graphql/subscriptions/subscription-*.ts", "graphql/subscriptions/types/*.ts",
+             "graphql/__generated__/**", "rest/index.ts", "rest/<area>/*.ts",
+             "sse/clients/**", "sse/*/stream-*.ts"]
     roles: {entry: index.ts, query: "query-*.ts", mutation: "mutation-*.ts"}
     # A hook imports its one operation file directly (one file per operation, FE-API-GRAPHQL), never through a barrel of every operation.
-    entries: ["graphql/queries/query-*.ts", "graphql/queries/types/*.ts", "graphql/mutations/mutation-*.ts", "graphql/mutations/types/*.ts", "sse/<area>/*.ts"]
+    entries: ["graphql/queries/query-*.ts", "graphql/queries/types/*.ts", "graphql/mutations/mutation-*.ts", "graphql/mutations/types/*.ts", "graphql/subscriptions/subscription-*.ts", "graphql/subscriptions/types/*.ts", "sse/*/stream-*.ts"]
     tests: none
     rules: [FE_TRANSPORT_OWNER, FE_HTTP_STATUS_COLLAPSE, FE_WIRE_GENERATED]
   - id: fe.transport.generated
@@ -2307,6 +2354,19 @@ slots:
     tests: none
     why: the auth and no-auth Apollo clients and their link chain (retry, error, timeout, token refresh, attach access token, http) of the one app that calls the back end; when several apps do, the shared client is fe.package.api.client
     rules: [FE_TRANSPORT_OWNER]
+  - id: fe.transport.stream
+    since: 3.7.0
+    profiles: [fe]
+    path: "apps/<app>/src/modules/api/sse/clients/"
+    presence: optional
+    tracked: tracked
+    tier: transport
+    allows: ["*.ts"]
+    tests: none
+    why: "the fetch reader of server-sent-events streams of the one app that calls the back end, the stream half of the transport client layer (FE-REALTIME): it opens the stream with the bearer access token, parses the events and reopens it with Last-Event-ID after a capped, doubling wait; a stream operation (sse/<area>/stream-<channel>.ts) runs on it and a useSubscribe hook of hooks/swr reads that operation; a fetch here asks for text/event-stream and only a stream operation imports the reader (FE_TRANSPORT_OWNER); a repository where several apps stream keeps one reader in each of them"
+    rules: [FE_TRANSPORT_OWNER]
+    exemplifiedBy:
+      - {path: packages/eslint/fe/r50-transport-owner-coverage.spec.mjs, editions: [lite, full]}
   - id: fe.transport.outcome
     since: 3.1.0
     profiles: [fe]

package/runtime/knowledge/patterns/be/api.yaml

@@ -318,7 +318,7 @@ rules:
   - id: BE-OPERATIONS-1
     title: A versioned operation is declared once in the app's typed operation table
     kind: mandatory
-    hfsRules: [R95, R88, R23, R278]
+    hfsRules: [R95, R88, R23, R278, R304, R305]
     requirement: |-
       A versioned operation `<name>@<version>` (for example `sales.policy@1`) that an app serves over one operation route is
       declared once, in the app's operation table, which `be/apps/<app>/src/operations.ts` exports as `OPERATIONS`. A feature cannot
@@ -326,38 +326,63 @@ rules:
       domain capability that owns the operations, and the app file re-exports it from the capability's public surface. The table is made by
       `defineOperations` of the platform capability `operations` (`be/src/modules/platform/operations/`, which declares
       `OperationContract<Input, Output, RefusalCode>`, `query`, `mutation`, `defineOperations`, `OperationRequest<Table>` and
-      `OperationReply<Table>`). `Input` and `Output` are named, closed types: never `any`, `unknown`, `Record<string, unknown>`,
-      `object`, an unbound generic, a function or `Date`. `RefusalCode` is a closed union of string literals, or omitted for an
-      operation that never refuses. The one route of the app takes `@Body() request: OperationRequest<Table>` and answers
+      `OperationReply<Table>`) and the `OperationValidationPolicy` pipe. Every entry supplies `query({ input, output, refusal? })` or
+      `mutation({ input, output, refusal? })`: input and output are named zod schema exports from bounded `*.schema.ts` files
+      in a domain, platform or integrations owner (R304/R305). The schemas infer the closed input and output types; never
+      `any`, `unknown`, `Record<string, unknown>`, `object`, an unbound generic, a function or `Date`. `refusal` is a readonly
+      list of literal codes, or omitted for an operation that never refuses. The one route of the app takes
+      `@Body(new OperationValidationPolicy(OPERATIONS)) request: OperationRequest<Table>` and answers
       `Promise<OperationReply<Table>>` of the same table; the wire is `{ operation, requestId, input }` in and `{ operation, requestId,
       outcome }` out, `outcome` being the canon Outcome `{ kind: "ok", value }` or `{ kind: "refused", code }`. `starci app emit`
-      derives `be/contracts/<app>/openapi.json` (OpenAPI 3.1, `x-operation: "<name>@<version>"`, a oneOf over the operations) from the
-      table with the type checker, and the full `starci app check` fails when the committed file is stale.
+      derives `be/contracts/<app>/openapi.json` (OpenAPI 3.1, `x-operation: "<name>@<version>"`, a oneOf over the operations) with
+      `z.toJSONSchema`: input uses the schema's input representation and output its output representation. Refusal codes
+      remain a closed union checked by TypeScript. `OperationRequest<Table>` describes parsed input, inferred from the input
+      schema's output type; defaults and transforms must agree with what the handler receives. Parsed input and output remain
+      closed JSON types, including after a transform: `any`, `unknown` and `Date` are still refused independently of the wire
+      schema. Root `undefined` and `void` cannot fill the request input or reply value; optional object fields remain valid.
+      Emission evaluates only the schema declarations, whose runtime imports are
+      zod or other `*.schema.ts` modules; bound constants belong in those declaration modules too. Type-only imports are
+      erased. Emission never runs app boot or table module side effects and refuses open schemas (a non-strict `z.object`; use `z.strictObject`) or Zod-unrepresentable
+      values, and publishes a fixed-format string such as `z.uuid()` with its real maximum length. String, array and dictionary bounds must survive conversion as `maxLength`, `maxItems` and `maxProperties`;
+      a custom count refinement that Zod drops is refused rather than emitted as an unbounded dictionary. Prefer finite
+      object fields for operation dictionaries. Custom refinements do not automatically become JSON Schema constraints.
+      Enable `be.contract.openapi` in `hfs.json` under `sides.be.optionalSlots` to own the emitted snapshot. The full `starci app check` fails
+      when the committed file is stale.
+      `OperationRequest<Table>` is erased at runtime and does not give ValidationPipe a DTO to validate. The platform-owned
+      operation pipe validates the envelope, the registered operation name and the selected input schema before dispatch,
+      passes the parsed input onward, and maps malformed requests to `OPERATIONS_INVALID_REQUEST`, an invalid AbstractException
+      answered as HTTP 400 with `{ code, kind, message, params }` by the canon error filter. A plain generic annotation or a
+      pipe for another table proves no validation. Keep zod imports in the schema
+      declaration files; the platform pipe bounds both envelope identifiers, `operation` and `requestId`, to 1..128 characters, the value the emitted contract states. Do not import zod in the transport. Specs validate successful
+      operation output against the declared output schema and cover refused input and declared outcomes; all logic-role files
+      have 100% coverage. The emitted contract is the FE boundary; FE never imports BE schemas and has no specs.
       A public REST operation in either edition belongs to this nonempty table, and its route decorator supplies its own
       versioned-operation evidence; a class-level reference does not justify a route absent from the table.
-      The body of the route is typed by an alias, which leaves no class at run time, so the global pipe validates nothing there.
-      The route therefore binds the body to `OperationValidationService` of `platform/http-security`, given a request class that
-      mirrors the envelope (`@IsIn` on `operation`, a bounded `requestId`, a `@ValidateNested()` input class with the bounds of
-      BE-AUTH-5), and the owning domain service still refuses an input outside its own bounds.
     rationale: |-
       The operation set of an app is a contract the front end (`fe/`, through the root codegen) and other consumers generate a client from. A name-to-string registry with `unknown`
       bodies and results forces every client to hand-type the wire; one typed table gives the client generator, the route and the
-      handlers the same types.
+      handlers the same types. Runtime schema parsing closes the generic ValidationPipe gap and carries actual bounds into
+      the emitted contract instead of losing them when TypeScript erases the declaration.
     cases:
       - id: case-1
-        when: A query with two refusals and a mutation with none
+        when: A versioned query served through the schema-validated table
         write: |-
-          // modules/domain/sales/sales-operations.contracts.ts
+          // modules/domain/order/order-list.schema.ts (R304/R305)
+          export const OrdersListInputSchema = z.strictObject({
+              first: z.number().int().min(1).max(100),
+              after: z.string().max(512).nullish(),
+          })
+          export const OrdersListOutputSchema = z.strictObject({ items: z.array(OrderSummarySchema).max(100).readonly(), ... })
+          // modules/domain/order/order-operations.contracts.ts
           export const OPERATIONS = defineOperations({
-              "sales.policy@1": query<SalesPolicyAsk, SalesPolicyView, "DENIED" | "INVALID">(),
-              "sales.close@1": mutation<SalesCloseAsk, SalesOpportunityView>(),
+              "orders.list@1": query({ input: OrdersListInputSchema, output: OrdersListOutputSchema, refusal: [OrderErrorCode.PageSizeInvalid] }),
           })
-          // be/apps/core/src/operations.ts
-          export { OPERATIONS } from "@modules/domain/sales"
-          // features/api/sales/transport/http/operations.controller.ts
+          // be/apps/order/src/operations.ts
+          export { OPERATIONS } from "@modules/domain/order"
+          // features/api/checkout/transport/http/operations.controller.ts
           @Post("operations")
           async invoke(
-              @Body(new OperationValidationService(SalesPolicyRequest)) request: OperationRequest<typeof OPERATIONS>,
+              @Body(new OperationValidationPolicy(OPERATIONS)) request: OperationRequest<typeof OPERATIONS>,
           ): Promise<OperationReply<typeof OPERATIONS>> { ... }
     verification:
       automated:
@@ -366,9 +391,10 @@ rules:
         - HFS_CONTRACT_SNAPSHOT_DRIFT
         - BE_REST_DOOR_EVIDENCE
         - BE_REST_ROUTE_UNDECLARED
+        - BE_SCHEMA_PLACE
+        - BE_SCHEMA_BOUNDED
       manual:
         - Confirm each refusal code is one the operation's owner can actually answer.
-        - Confirm that the request class mirrors the envelope and the input bounds of the table.
     relatedExamples: [operations]
 files:
   - path: src/features/api/<feature>/index.ts