@starci/hfs 4.7.35 → 4.7.37

package/runtime/knowledge/hfs/rules.yaml

@@ -5598,3 +5598,33 @@ rules:
         source: owner
         quote: "apps on Grammar write layout-only CSS; every visual element lives in @starci/grammar"
         ruling: "ANATOMY-2 owns contextual field defaults, PADDING-0 owns panel list alignment, and COLLECTION-3 owns composite member avatars for conversation and group identity. Grammar supplies these capabilities; the FE canon rejects static field variants on either layer, primary Tabs inside painted surfaces, raw app surface paint and stacked horizontal list-wrapper padding inside painted surfaces."
+
+  - id: R319
+    code: "FE_BUTTON_INTENT"
+    law: "An app Button or IconButton declares an intent and never a variant; Grammar resolves the variant from intent and placement (CTA-6). A destructive confirm lives in a confirmation dialog, a render holds at most one commit, and a collection item holds none."
+    kinds: [codemod, lint, design]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["FE_BUTTON_INTENT", "FE_BUTTON_INTENT_REQUIRED", "FE_BUTTON_NO_VARIANT", "FE_DESTRUCTIVE_CONFIRM_IN_DIALOG", "FE_SINGLE_COMMIT_PER_RENDER", "FE_NO_COMMIT_IN_COLLECTION_ITEM"]
+    enforcers:
+      - {kind: eslint-fe, id: button-intent-required}
+      - {kind: eslint-fe, id: button-no-variant}
+      - {kind: eslint-fe, id: destructive-confirm-in-dialog}
+      - {kind: eslint-fe, id: single-commit-per-render}
+      - {kind: eslint-fe, id: no-commit-in-collection-item}
+    editions: [lite, full]
+    docs:
+      - knowledge/ui/composition/cta.yaml
+      - docs/code-pattern-enforcement.md#r319-button-intent
+    proves:
+      - {path: packages/eslint/fe/button-intent.spec.mjs, editions: [lite, full], codes: [FE_BUTTON_INTENT, FE_BUTTON_INTENT_REQUIRED, FE_BUTTON_NO_VARIANT, FE_DESTRUCTIVE_CONFIRM_IN_DIALOG, FE_SINGLE_COMMIT_PER_RENDER, FE_NO_COMMIT_IN_COLLECTION_ITEM]}
+    exemplifiedBy:
+      - {path: packages/eslint/fe/button-intent.spec.mjs, editions: [lite, full], codes: [FE_BUTTON_INTENT, FE_BUTTON_INTENT_REQUIRED, FE_BUTTON_NO_VARIANT, FE_DESTRUCTIVE_CONFIRM_IN_DIALOG, FE_SINGLE_COMMIT_PER_RENDER, FE_NO_COMMIT_IN_COLLECTION_ITEM]}
+    witness:
+      - {path: packages/eslint/fe/button-intent.spec.mjs, editions: [lite, full], codes: [FE_BUTTON_INTENT, FE_BUTTON_INTENT_REQUIRED, FE_BUTTON_NO_VARIANT, FE_DESTRUCTIVE_CONFIRM_IN_DIALOG, FE_SINGLE_COMMIT_PER_RENDER, FE_NO_COMMIT_IN_COLLECTION_ITEM]}
+    templateNa: "The intent of an action comes from the product decision in the .starciwork specification; a template cannot choose it."
+    cases:
+      - id: case-1
+        date: "2026-10-25"
+        source: owner
+        quote: "Critique this carefully so the button choice is a system and not a feeling, understand? Update .claude."
+        ruling: "The button variant follows the declared intent (owner ruling button-variant-follows-intent): the app passes intent and step, Grammar derives the variant from them and from the placement it reads from React context. The semantics are HeroUI's, so the lint is universal in the FE canon."

package/runtime/knowledge/ui/presentation/padding.yaml

@@ -50,10 +50,11 @@ rules:
       - id: case-3
         when: A list sits inside a panel or its rows own their own inset
         owner: The list component
-        render: "Owner ruling 2026-10-25 (ruling:R318/case-1): row content, section captions and headers align with the
-          panel content edge while row backgrounds may extend into the panel gutter. Compose without padding
-          wrappers. The selected Grammar supplies the panel-alignment API; the universal FE canon reports
-          stacked padding as FE_LIST_PANEL_PADDING."
+        render: "Owner ruling 2026-10-25 (owner:panel-list-box-edge): the row box aligns with the panel content
+          edge, like the search field and tabs boxes. Content retains the vendor item inset and rounded
+          interaction background inside that box; the list keeps its vendor inset without negative-margin
+          bleed. Compose without padding wrappers. The selected Grammar supplies the panel-alignment API;
+          the universal FE canon reports stacked padding as FE_LIST_PANEL_PADDING."
     notThisRule: The boundary protecting readable content keeps its one owned inset from the selected Grammar scale.
   - id: PADDING-1
     title: Minimal clearance

package/runtime/modules/kernel/failure-codes.yaml

@@ -2155,6 +2155,38 @@ FE_BLOCK_PRODUCT_HOOK_DEFINITION:
   owner: other-op:interface.implement
   kind: check-finding
 
+FE_BUTTON_INTENT:
+  title: "Button variant is chosen by hand instead of by intent"
+  title_vi: "Variant của nút được chọn thủ công thay vì theo intent"
+  meaning_vi: "Button hoặc IconButton của ứng dụng thiếu intent, truyền variant, đặt nút xác nhận xoá ngoài hộp thoại xác nhận, có nhiều hơn một nút commit trong một lần render, hoặc đặt nút commit trong từng phần tử của danh sách."
+  causes_vi:
+    - "Truyền variant thay vì intent cho Button hoặc IconButton"
+    - "Đặt intent destructive với step confirm ngoài AlertDialog hoặc ConfirmDialog"
+    - "Đặt hai nút commit trong cùng một lần render hoặc một nút commit trong mỗi thẻ của danh sách"
+  nextStep_vi: "Khai báo intent (và step cho destructive) theo hệ quả của hành động, bỏ variant để Grammar tự suy ra, và chạy codemod button-intent cho các nút cũ."
+  owner: "op-retry"
+  kind: "check-finding"
+
+FE_BUTTON_INTENT_REQUIRED:
+  title: "A button has no declared intent"
+  title_vi: "Nút chưa khai báo intent"
+  meaning_vi: "Button hoặc IconButton tại <file> chưa nêu ý định của lệnh."
+  causes_vi:
+    - "Bỏ intent nên Grammar không có dữ kiện để chọn variant."
+  nextStep_vi: "Khai báo intent theo hệ quả và thứ hạng của lệnh trong quyết định (CTA-6)."
+  owner: op-retry
+  kind: check-finding
+
+FE_BUTTON_NO_VARIANT:
+  title: "An app button chooses a visual variant"
+  title_vi: "Nút ứng dụng tự chọn variant"
+  meaning_vi: "Button hoặc IconButton tại <file> truyền variant thay vì để Grammar suy ra từ intent và vị trí."
+  causes_vi:
+    - "Ứng dụng truyền variant trực tiếp hoặc qua props spread."
+  nextStep_vi: "Thay variant bằng intent theo hệ quả của lệnh (CTA-6)."
+  owner: op-retry
+  kind: check-finding
+
 FE_CALLBACK_SHAPE:
   title: "An auth callback performs more than code exchange and redirect"
   title_vi: "Callback xác thực làm thêm việc ngoài đổi mã và chuyển hướng"
@@ -2306,6 +2338,16 @@ FE_DANGEROUS_HTML:
   owner: op-retry
   kind: check-finding
 
+FE_DESTRUCTIVE_CONFIRM_IN_DIALOG:
+  title: "A destructive confirm is outside its confirmation dialog"
+  title_vi: "Lệnh xác nhận phá hủy nằm ngoài hộp thoại xác nhận"
+  meaning_vi: "Nút destructive confirm tại <file> không nằm trong nội dung AlertDialog hoặc ConfirmDialog cùng tệp."
+  causes_vi:
+    - "Đặt lần nhấn cuối ngoài hộp thoại hoặc trên trigger."
+  nextStep_vi: "Đặt confirm trong nội dung hộp thoại cùng tệp; trigger dùng step entry (CTA-6)."
+  owner: op-retry
+  kind: check-finding
+
 FE_EFFECT_CLEANUP:
   title: "What an effect starts, its cleanup releases"
   title_vi: "Effect khởi động thứ không được dọn"
@@ -2576,6 +2618,16 @@ FE_NO_ALERT:
   owner: op-retry
   kind: check-finding
 
+FE_NO_COMMIT_IN_COLLECTION_ITEM:
+  title: "A collection item repeats a commit"
+  title_vi: "Phần tử danh sách lặp lại lệnh commit"
+  meaning_vi: "Một phần tử collection hoặc callback map tại <file> hiển thị nút commit."
+  causes_vi:
+    - "Mỗi hàng giành vai trò hành động chính của toàn màn hình."
+  nextStep_vi: "Dùng alternative cho hành động tiếp theo của hàng và giữ commit ở quyết định của màn hình (CTA-6)."
+  owner: op-retry
+  kind: check-finding
+
 FE_NO_TESTS:
   title: "Front end holds a test file, test tooling or a test dependency"
   title_vi: "Front end có tệp test, công cụ test hoặc thư viện test"
@@ -2811,6 +2863,16 @@ FE_SERVICE_ROLE_FORBIDDEN:
   owner: op-retry
   kind: check-finding
 
+FE_SINGLE_COMMIT_PER_RENDER:
+  title: "A component renders more than one commit"
+  title_vi: "Component hiển thị nhiều hơn một lệnh commit"
+  meaning_vi: "Một đường render của component tại <file> có nhiều nút commit cùng lúc."
+  causes_vi:
+    - "Nhiều lệnh cùng nhận thứ hạng hành động tiếp theo."
+  nextStep_vi: "Giữ một lệnh tiếp theo là commit và phân loại các lệnh còn lại theo hệ quả (CTA-6)."
+  owner: op-retry
+  kind: check-finding
+
 FE_SIZE_AND_STATE_BUDGET:
   title: "Hook and state budgets; no hand-written poll loop"
   title_vi: "Vượt ngân sách hook và state"

package/runtime/modules/kernel/roles.yaml

@@ -84,7 +84,7 @@ rulings:
   critic-coverage: "Who judges each op's product is declared once, in the required judge field of its contract (modules/kernel/op-judges.yaml): machine, critic, owner or next-leg, never nobody. An independent Critic of another provider, on the frontier tier, runs for drawing (inside the op) and, run by the runtime at settle, for scope.define, business.decide and architecture.decide (modules/kernel/critic.yaml coverage); the op-judge check holds that table and the contracts to each other."
   debug-is-time-boxed: "Debug is a time-boxed auditor of role conformance for the stabilisation phase, bound to a chat session; the runtime is self-sufficient, every edge case Debug meets becomes a rule plus an edge-case entry, and the loop is set up no more once the end condition of the debug role holds."
   updating-the-runtime: "The runtime tree can be updated while workflows run, and no running workflow conflicts with the update. What a change asks of each role is declared once in modules/kernel/revision-scope.yaml and checked against the tree. A change that concerns no role costs no seat anything. A live seat is updated in place by default: woken once per revision change, even with an empty menu, with exactly the changed files that concern it, it reads and attests them (one wake, never a second for the same revision; several commits deployed together are one change). A seat is replaced by a fresh one that boots from the stores only when a rule of its contract was removed or reversed (a line deleted or modified in its declared contract files; a commit may declare an edit wording-only, and the declaration holds only for a file that keeps its structure), when the files its launch prompt is built from changed, or when it is already due for rotation (the revision change folds into that replacement). A replacement happens at the seat's next yield, never in the middle of a decision. An Op is neither updated nor restarted inside an attempt: it keeps the rules of its admission, the next try and the next Critic run are admitted under the new rules, and only guards bite at once. The engine restarts only for the files its process loaded, derived from its import graph; every other command is a new process that reads the tree."
-  debug-fix-lanes: "A runtime defect Debug catches is fixed at once, never queued behind another: Debug splits it by independent cause and opens one fix lane per cause in the same turn, each in its own clone with the files it may touch named, so the lanes run in parallel; each lane's fix reaches the host as soon as `starci runtime verify` prints `verified <sha>` for it (the check, the package clean-test and the scaffold e2e on one commit; the line of `npm run check` alone runs no test and is never the report), through `starci runtime deploy --from <clone>` (one verified revision change; never a hand fast-forward of the live checkout followed by a hand restart). Nothing a lane found is left listed as later: it is fixed in that round or handed to another lane opened then. The fixes of a day are consolidated into one release cut at the end of that day."
+  debug-fix-lanes: "A runtime defect Debug catches is fixed at once, never queued behind another: Debug splits it by independent cause and opens one fix lane per cause in the same turn, each in its own clone with the files it may touch named, so the lanes run in parallel; each lane's fix reaches the host as soon as `starci runtime verify` prints `verified <sha>` for it (the check, the package clean-test and the scaffold e2e on one commit; the line of `npm run check` alone runs no test and is never the report), through `starci runtime deploy --from <clone>` (one verified revision change; never a hand fast-forward of the live checkout followed by a hand restart). Nothing a lane found is left listed as later: it is fixed in that round or handed to another lane opened then. A verified fix ships as its own release wave, the next alpha.N.M, as soon as it is green (owner ruling release-waves)."
   debug-replay-before-done: "A fix for a defect found on a live host is done when the runtime change that handles it (the contract, prompt, policy row, gate, guard or code) and its edge-case entry (found: live, the rule that now handles it) land on one commit and starci runtime verify is green on that commit. The runtime has no specs of its own (owner ruling no-runtime-specs): no runtime spec or replay spec is written; an entry may name a package spec or the scaffold e2e that already covers it."
   debug-channels: "Debug speaks only through runtime channels (starci supervisor tell; a durable ruling to a Kernel through the Supervisor's notify), never by typing into a seat's terminal, and never to an Op or a Critic."
 

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "4ab7076e241f09f78dcd0009085eb283a16132f623b508015e0ef805f2f6845b",
+  "hash": "3ac967b6f4bb2136cbc7b29a8da5d28994140c84c3543ef0748a379e4667c443",
   "global": [
     {
       "name": "json",
@@ -789,6 +789,58 @@ export const CATALOG = {
           ],
           "runtimeSide": "host"
         },
+        "codemod": {
+          "summary": "migrate front-end button variants to declared intent and report cases requiring a human decision",
+          "owner": "@starci/hfs",
+          "positional": [
+            {
+              "name": "migration",
+              "enum": [
+                "button-intent"
+              ],
+              "required": true,
+              "variadic": false
+            }
+          ],
+          "flags": [
+            {
+              "name": "write",
+              "type": "boolean",
+              "summary": "apply safe source edits; otherwise preview without changing source"
+            },
+            {
+              "name": "format",
+              "type": "enum",
+              "enum": [
+                "json",
+                "markdown"
+              ],
+              "default": "markdown",
+              "summary": "migration report format"
+            },
+            {
+              "name": "report",
+              "type": "string",
+              "summary": "also save the complete report to a .json or .md file"
+            }
+          ],
+          "exit": {
+            "0": "migration has no unresolved cases",
+            "1": "unresolved cases require a human decision",
+            "2": "refusal or bad usage"
+          },
+          "json": "flag",
+          "examples": [
+            "starci app codemod button-intent",
+            "starci app codemod button-intent --write --format json --report button-intent.json"
+          ],
+          "editions": [
+            "full",
+            "lite"
+          ],
+          "impl": null,
+          "runtimeSide": "host"
+        },
         "coverage": {
           "summary": "merge the sharded unit coverage into one lcov report, or prove that report at 100 per file",
           "owner": "@starci/hfs",
@@ -8617,13 +8669,14 @@ export const CATALOG = {
           ],
           "exit": {
             "0": "the candidate CI of the release sha was green, then main plus its tag were pushed atomically, or --plan found nothing missing",
-            "1": "refused (RELEASE_CANDIDATE_CI_RED, RELEASE_CANDIDATE_CI_TIMEOUT, RELEASE_CI_UNKNOWN, dirty tree, no or wrong tag, release notes incomplete, version not moved past the remote main, suite red, main moved, secret scan) and nothing was pushed",
+            "1": "refused (RELEASE_CANDIDATE_CI_RED, RELEASE_CANDIDATE_CI_TIMEOUT, RELEASE_CI_UNKNOWN, dirty tree, no or wrong tag, release notes incomplete, version not moved past the remote main, RELEASE_VERSION_NOT_NEXT, suite red, main moved, secret scan) and nothing was pushed",
             "2": "bad usage"
           },
           "json": "flag",
           "examples": [
             "starci release cut",
             "starci release cut --plan --tag v1.0.0-alpha.9",
+            "starci release cut --tag v1.0.0-alpha.31.1",
             "starci release cut --tag v1.0.0-alpha.9 --rows \"npm run test:e2e,linux-parity\"",
             "starci release cut --repo <path> --tag v1.0.0-alpha.9 --json"
           ],
@@ -8634,6 +8687,9 @@ export const CATALOG = {
             "script": "scripts/supervisor/release-cut-cli.mjs"
           },
           "conventions": [
+            "Naming (owner ruling release-waves): the next release is alpha.N.M+1 of the highest v* tag (a wave or a fix) or the next line alpha.N+1,",
+            "derived from the v* tags, never guessed (RELEASE_VERSION_NOT_NEXT); without --tag the refusal names both.",
+            "The legacy -fix form is read and never cut.",
             "OWNER RULING candidate-ci (2026-10-18): never again have main receive a release whose CI is red, with the owner confirming afterwards.",
             "Before the suite, including --plan, the workflows the candidate CI waits for (release-cut.yaml candidate.workflows) must be readable,",
             "else RELEASE_CI_UNKNOWN. The latest run on main is no longer read: a red main needs no owner override before the next release.",
@@ -8884,6 +8940,7 @@ export const CATALOG = {
             "runtime-package refuses changed inputs or registry state after its cold proof and never performs rebind or example writes",
             "runtime-package plans the upload channel and release-declared npm dist-tags, repairs stale tags without republishing, and reads every target back",
             "runtime-package refuses an older release on its line and preserves tags pointing to newer releases on other lines",
+            "every alpha.N and wave alpha.N.M share the one alpha line, so a wave never moves a dist-tag behind a later wave or line",
             "publication never commits, pushes or creates Git tags; release cut owns those effects"
           ],
           "runtimeSide": "tree"
@@ -14289,6 +14346,44 @@ export const CATALOG = {
           },
           "runtimeSide": "host"
         },
+        "export-repaints": {
+          "summary": "export strict Grammar vendor findings as CSS repair assignments",
+          "owner": "runtime",
+          "flags": [
+            {
+              "name": "out-dir",
+              "type": "string",
+              "required": true,
+              "summary": "directory for the repaint exports"
+            },
+            {
+              "name": "root",
+              "type": "string",
+              "summary": "runtime root whose Grammar sources and vendor reference are judged"
+            },
+            {
+              "name": "check",
+              "type": "boolean",
+              "summary": "report export drift without writing"
+            }
+          ],
+          "exit": {
+            "0": "exports written or verified",
+            "1": "export drift or unreadable judge inputs",
+            "2": "bad usage"
+          },
+          "json": "none",
+          "examples": [
+            "starci work export-repaints --out-dir <directory>"
+          ],
+          "editions": [
+            "full"
+          ],
+          "impl": {
+            "script": "scripts/work/ui/export-repaints.mjs"
+          },
+          "runtimeSide": "host"
+        },
         "grammar-geometry": {
           "summary": "emit grammar geometry guidance or check captured geometry",
           "owner": "runtime",
@@ -14345,7 +14440,22 @@ export const CATALOG = {
             {
               "name": "write",
               "type": "boolean",
-              "summary": "rewrite the grammar DNA from the package; without it only compares"
+              "summary": "rewrite selected generated output; mutually exclusive with --check"
+            },
+            {
+              "name": "check",
+              "type": "boolean",
+              "summary": "compare selected generated output without writing (the default); mutually exclusive with --write"
+            },
+            {
+              "name": "intent-only",
+              "type": "boolean",
+              "summary": "scope generated output to DNA intent mapping blocks; may combine with --catalog-only"
+            },
+            {
+              "name": "catalog-only",
+              "type": "boolean",
+              "summary": "scope generated output to the Button and IconButton intent props catalog; may combine with --intent-only"
             }
           ],
           "exit": {

package/runtime/scripts/guards/release-definition.mjs

@@ -2,6 +2,8 @@
 // pre-push hook (scripts/guards/release-push-gate.mjs) and the release cut (scripts/supervisor/release-cut.mjs). The remote
 // main of the runtime moves exactly when a release is cut, so a push of main or of a v* tag is judged against this list:
 //   RELEASE_VERSION_UNCHANGED   package.json `version` at the pushed commit differs from the version at the remote main's head
+//   RELEASE_VERSION_NOT_NEXT    that version is the next release after the highest v* tag (scripts/lib/release-version.mjs, owner ruling release-waves):
+//                               the next wave alpha.N.M+1 of its line or the next line alpha.N+1, never the legacy -fix form
 //   RELEASE_TAG_VERSION         the release tag is v<version> of the pushed commit
 //   RELEASE_CHANGELOG_SECTION   CHANGELOG.md holds `## [<version>] - <date>` (a dated heading) with no unfinished marker (R222)
 //   RELEASE_TAG_MISSING         an ANNOTATED tag v<version> points at the pushed commit
@@ -17,6 +19,7 @@ import { tag as gitTag } from '../api/git/tag.mjs';
 import { mergeBaseQuery } from '../api/git/merge-base-query.mjs';
 import { pathKey, realPath } from '../lib/path-key.mjs';
 import { changelogSection, releaseNotesFindings } from '../hfs/runtime-rules/release-notes.mjs';
+import { nextReleases, releaseVersionRefusal, taggedVersions } from '../lib/release-version.mjs';
 import { readL4Record } from './release-record.mjs';
 import { suiteModeOf } from './release-suite-mode.mjs';
 
@@ -122,14 +125,27 @@ function releaseAncestor(repo, before, after) {
   return null;
 }
 
-function versionFindings({ cwd, commit, remoteCommit, version }) {
+/** The next releases named from the released versions, for a fix text: "v<wave> or v<line>". */
+const nextNamed = (released) => {
+  const next = nextReleases(released);
+  return next ? `v${next.wave} or v${next.line}` : 'v<new version>';
+};
+
+function versionFindings({ cwd, remoteCommit, version, released }) {
   if (!remoteCommit) return [];
   const remoteVersion = versionAt(cwd, remoteCommit);
   if (remoteVersion === null) return [finding('RELEASE_REMOTE_HEAD_UNKNOWN', `the remote main head ${remoteCommit.slice(0, 9)} is not in this repository, so its version cannot be compared`, 'git fetch origin main')];
-  if (remoteVersion === version) return [finding('RELEASE_VERSION_UNCHANGED', `package.json version ${version} is the version the remote main already carries`, `bump package.json version, move the CHANGELOG section to the new version, commit, then ${CUT_COMMAND('v<new version>')}`)];
+  if (remoteVersion === version) return [finding('RELEASE_VERSION_UNCHANGED', `package.json version ${version} is the version the remote main already carries`, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released))}`)];
   return [];
 }
 
+/** The version must be the next release after the highest v* tag other than its own: a wave alpha.N.M is counted, never guessed. */
+function nextReleaseFindings({ version, released }) {
+  if (released === null) return [finding('RELEASE_VERSION_NOT_NEXT', 'the v* tags are unreadable, so the next release cannot be derived', 'git fetch --tags')];
+  const refusal = releaseVersionRefusal(version, released);
+  return refusal ? [finding('RELEASE_VERSION_NOT_NEXT', refusal, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released.filter((entry) => entry !== version)))}`)] : [];
+}
+
 function changelogFindings({ cwd, commit, version, tag }) {
   const changelog = gitText(show, [`${commit}:CHANGELOG.md`], cwd);
   if (changelog === null) return [finding('RELEASE_CHANGELOG_SECTION', 'CHANGELOG.md is not readable at the pushed commit', 'restore CHANGELOG.md')];
@@ -176,8 +192,11 @@ export function releaseFindings({ cwd, commit, remoteCommit = null, tag = null,
   const expected = `v${version}`;
   const named = tag ?? expected;
   if (named !== expected) return [finding('RELEASE_TAG_VERSION', `the tag ${named} is not v${version}, the version of ${commit.slice(0, 9)}`, `tag v${version}, or set package.json version to ${named.replace(/^v/, '')}`)];
+  const listed = gitText(gitTag, ['--list', 'v*'], cwd);
+  const released = listed === null ? null : taggedVersions(listed);
   return [
-    ...versionFindings({ cwd, commit, remoteCommit, version }),
+    ...versionFindings({ cwd, remoteCommit, version, released: released ?? [] }),
+    ...nextReleaseFindings({ version, released }),
     ...changelogFindings({ cwd, commit, version, tag: named }),
     ...(needTag ? tagFindings({ cwd, commit, tag: named }) : []),
     ...(needReceipt ? receiptFindings({ cwd, commit, tag: named }) : []),

package/runtime/scripts/lib/css-rules.mjs

@@ -218,3 +218,21 @@ export function utilityFamilies(utility) {
 export function ruleFamilies(rule) {
   return [...new Set([...rule.apply.flatMap(utilityFamilies), ...rule.declarations.map((entry) => propertyFamily(entry.property)).filter(Boolean)])].sort(byCodeUnit);
 }
+
+// Container composition is layout even when the vendor sets a default for it. Keep this separate from
+// ruleFamilies: the vendor census records every declaration, while the strict judge measures paint.
+const LAYOUT_FAMILIES = new Set([
+  'gap', 'inline-size', 'display', 'order',
+  'flex', 'flex-basis', 'flex-direction', 'flex-flow', 'flex-grow', 'flex-shrink', 'flex-wrap',
+  'align-content', 'align-items', 'align-self',
+  'justify-content', 'justify-items', 'justify-self',
+  'place-content', 'place-items', 'place-self',
+  'grid', 'grid-template', 'grid-template-areas', 'grid-template-columns', 'grid-template-rows',
+  'grid-auto-columns', 'grid-auto-flow', 'grid-auto-rows', 'grid-area',
+  'grid-column', 'grid-column-start', 'grid-column-end', 'grid-row', 'grid-row-start', 'grid-row-end',
+]);
+
+/** The paint families a strict Grammar may only change through a declared vendor override. */
+export function repaintFamilies(rule) {
+  return ruleFamilies(rule).filter((family) => !LAYOUT_FAMILIES.has(family));
+}

package/runtime/scripts/lib/{grammar-vendor-source.mjs → grammar-vendor-parity-jsx.mjs}

@@ -1,13 +1,6 @@
-// grammar-vendor-source.mjs - pure JSX and expression readers for Grammar vendor-parity judgments.
-// The caller supplies source text, import aliases and measured role declarations; this module performs no I/O.
-// Kept separate from the parity rules so parsing and vendor render-prop custody have one owner.
-
+// JSX and static role-expression readers shared by the Grammar vendor judge.
 const lineOf = (text, index) => text.slice(0, index).split('\n').length;
 
-// ---------------------------------------------------------------------------
-// Reading JSX without a parser: the opening tags of the aliases a file imports from @heroui/react.
-// ---------------------------------------------------------------------------
-
 /** The index after the quoted string that starts at `start`. */
 function skipQuoted(text, start) {
   const quote = text[start];
@@ -84,14 +77,23 @@ function readAttributes(text, from) {
 
 /** The opening tags of the given import aliases: `{alias, part, attrs, line}` (`part` is `Root` for the bare alias). */
 export function heroTags(text, aliases) {
-  if (!aliases.length) return [];
-  const pattern = new RegExp(String.raw`<(${aliases.join('|')})(?:\.(\w+))?(?=[\s/>])`, 'g');
-  return [...text.matchAll(pattern)].map((match) => ({
-    alias: match[1],
-    part: match[2] ?? 'Root',
-    attrs: readAttributes(text, match.index + match[0].length),
-    line: lineOf(text, match.index),
-  }));
+  const known = new Set(aliases);
+  return jsxTags(text).filter((tag) => known.has(tag.alias)).map(({ index, ...tag }) => ({ ...tag, line: lineOf(text, index) }));
+}
+
+/** The string literals of an expression, without their quotes. */
+export const stringLiterals = (raw) => (String(raw).match(/"[^"\n]*"|'[^'\n]*'|`[^`$]*`/g) ?? []).map((literal) => literal.slice(1, -1));
+
+/** The class tokens an element carries: the literals of its className, with a bare constant resolved one level in the file. */
+export function classTokens(text, attrs) {
+  const raw = attrs.find((attr) => attr.name === 'className')?.raw;
+  if (raw === undefined) return [];
+  const names = String(raw).match(/\b[A-Za-z_]\w*\b/g) ?? [];
+  const resolved = names.flatMap((name) => {
+    const declaration = new RegExp(String.raw`\bconst\s+${name}\s*=\s*([^\n]*(?:\n[^\n;]*)?)`).exec(text);
+    return declaration ? stringLiterals(declaration[1]) : [];
+  });
+  return [...stringLiterals(raw), ...resolved].flatMap((value) => value.split(/\s+/)).filter(Boolean);
 }
 
 /** The vendor imports of a source: alias -> vendor component name. */
@@ -143,7 +145,7 @@ function jsxOpening(text, index) {
 }
 
 /** Opening JSX tags, excluding JavaScript strings and comments; attribute expressions remain intact. */
-export function jsxTags(text) {
+function jsxTags(text) {
   const tags = [];
   let index = 0;
   while (index < text.length) {
@@ -291,7 +293,7 @@ function memberExpressionStrings(text, member, seen) {
 }
 
 /** Result literals of a JSX expression, including local constants; condition literals are not result values. */
-export function expressionStrings(text, raw, seen = new Set()) {
+function expressionStrings(text, raw, seen = new Set()) {
   raw = raw.trim();
   if (enclosesExpression(raw)) return expressionStrings(text, raw.slice(1, -1), seen);
   if (/^(?:"[^"\n]*"|'[^'\n]*'|`[^`$]*`)$/.test(raw)) return [raw.slice(1, -1)];
@@ -339,7 +341,20 @@ function vendorRenderRoot(text, callback, declarations) {
 }
 
 /** The local render callbacks supplied to vendor roots keep the vendor's state, semantics and prop custody. */
-export function vendorRenderRoots(text, aliases, declarations) {
+function vendorRenderRoots(text, aliases, declarations) {
   const callbacks = heroTags(text, [...aliases.keys()]).flatMap((tag) => tag.attrs.filter((attr) => attr.name === 'render').map((attr) => ({ raw: attr.raw.trim(), offset: attr.offset, owner: aliases.get(tag.alias) })));
   return callbacks.flatMap((callback) => vendorRenderRoot(text, callback, declarations));
 }
+
+/** The JSX roles a file writes by hand that the measured vendor references expose. */
+export function roleFindings({ file, text, allowed, vendorRoles, roleDeclarations, finding }) {
+  const vendorAliases = importAliases(text);
+  const vendorRenders = vendorRenderRoots(text, vendorAliases, roleDeclarations);
+  const vendorOwnsRole = (tag, role) => {
+    const owner = vendorAliases.get(tag.alias);
+    const declaration = roleDeclarations[role];
+    return owner !== undefined && (declaration?.contracts.includes(`${owner}.${tag.part}`) || (tag.part === 'Root' && declaration?.publicApi === owner));
+  };
+  const roles = jsxTags(text).flatMap((tag) => tag.attrs.filter((attr) => attr.name === 'role').flatMap((attr) => expressionStrings(text, attr.raw)).filter((role) => !vendorOwnsRole(tag, role) && !vendorRenders.some((root) => tag.index === root.index && root.roles.includes(role)))).filter((role) => vendorRoles.has(role));
+  return [...new Set(roles)].filter((role) => !allowed('role', `${file}:${role}`)).map((role) => finding('role', file, 0, `hand-rolls role="${role}", which HeroUI has a component for: use it (override target role:${file}:${role})`));
+}