@starci/hfs 4.7.38 → 4.7.39

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 4.7.39 - 2026-10-26
+- Added: R258 follows the active cron schedule and accepts a declared outbox (`sides.be.queueOutbox`), and the optional slot `app.scripts.integration` carries integration scripts.
+- Fixed: the lite scaffold templates, barrels and dev README follow the lite scaffold end-to-end fixes.
+
 ## 4.7.38 - 2026-10-26
 - Changed: the bundled canon pins select @starci/stylelint-canon 2.0.13, @starci/eslint-canon-be 3.4.46, @starci/eslint-canon-fe 9.1.1, the Grammar lint families 0.12.5 and @starci/grammar 0.12.5.
 - Fixed: the full and lite scaffold templates, skeletons and specs follow the scaffold end-to-end and repaint fixes made after 4.7.37.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.38",
+  "version": "4.7.39",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -23,35 +23,35 @@ pins:
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/grammar':
-    version: 0.12.5
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.46
+    version: 3.4.47
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.1
+    version: 9.1.2
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.5
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.5
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
@@ -91,14 +91,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.38
+    version: 1.7.39
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.38
+    version: 4.7.39
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -4405,7 +4405,7 @@ rules:
     editionWhy: "owner:lite-backing-services makes Supabase lite's database backing and ruling:R212/case-10 moves the lite queue to Redis; the pgmq retirement and pg_cron ownership requirements apply to that backing."
     docs: [docs/microservices.md#r258]
     templateNa: "Queue declarations and enqueue-only cron commands depend on product-owned work and are authored in its Supabase migrations."
-    law: "DB_QUEUE_CRON: the queue is BullMQ on Redis (ruling:R212/case-10), so the active migrations leave no pgmq queue named by a queue constant under modules/queues; a pgmq queue a migration created for one is dropped by a later migration. Every pgmq queue the active migrations leave is an event-bus topic queue named by a literal *_TOPIC_QUEUE constant under platform/event-bus, every such constant has its pgmq queue, and pgmq objects are granted only to the application role while they exist. A uniquely named pg_cron job belongs to a migration and only enqueues: its command, directly or through one enqueue-only *_tick function, inserts one row of a literal queue constant into the queue outbox table of ruleParams.db.queueOutbox, writing only its declared columns (the relay hands it to BullMQ); it executes no business DML or HTTP request and shares no tick with an app scheduler. A pgmq.send validates only in the original body of a job an older migration scheduled while that queue existed; the live job and its current tick never enqueue that way. Removing a tick unschedules its job."
+    law: "DB_QUEUE_CRON: the queue is BullMQ on Redis (ruling:R212/case-10), so the active migrations leave no pgmq queue named by a queue constant under modules/queues; a pgmq queue a migration created for one is dropped by a later migration. Every pgmq queue the active migrations leave is an event-bus topic queue named by a literal *_TOPIC_QUEUE constant under platform/event-bus, every such constant has its pgmq queue, and pgmq objects are granted only to the application role while they exist. A pg_cron job belongs to a migration and only enqueues; its name is scheduled once while it is active, so a later migration schedules it again only after its own cron.unschedule of that name, and one tick function has one live job at a time. Its command, directly or through one enqueue-only *_tick function, inserts one row of a literal queue constant into the queue outbox table of ruleParams.db.queueOutbox, writing only its declared columns (the relay hands it to BullMQ). An app whose hfs.json sides.be.backing declares redis may declare its own outbox in sides.be.queueOutbox ({table, enqueue, queueParameter}); the command, or the tick, then calls the declared enqueue function with a literal queue constant for the declared parameter and pure other arguments, while the active definition of that function only inserts one row into the declared table with its queue column bound to that parameter (an ON CONFLICT DO NOTHING, a read of the declared table and pure expressions are the only other work). A direct insert into the app's outbox table, or any other function, stays refused. The job executes no business DML or HTTP request and shares no tick with an app scheduler. A pgmq.send validates only in the original body of a job an older migration scheduled while that queue existed; the live job and its current tick never enqueue that way. Removing a tick unschedules its job."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_PGMQ_DECLARED", "DB_CRON_OWNED"]
@@ -4413,6 +4413,7 @@ rules:
       - {kind: hfs, id: db-queue-cron, at: scripts/hfs/rules/database-queues.mjs}
     proves:
       - {path: packages/hfs/src/hfs-database-queues.spec.mjs, edition: lite, codes: [DB_PGMQ_DECLARED, DB_CRON_OWNED]}
+      - {path: packages/hfs/src/hfs-queue-outbox-declaration.spec.mjs, edition: lite, codes: [DB_CRON_OWNED]}
     exemplifiedBy:
       - {path: packages/hfs/src/hfs-database-queues.spec.mjs, edition: lite, codes: [DB_PGMQ_DECLARED, DB_CRON_OWNED]}
     witness:

package/runtime/knowledge/hfs/slots.yaml

@@ -43,7 +43,7 @@ versioning:
 # journey (enabled with app.browser by `browser: true`).
 # 3.6.0 is a minor (alpha.30): it ADDS the opt-in be.feature.realtime.sse slot, the server-sent-events door of the realtime kind (owner decision
 # 2026-10-24: lite may serve SSE, and SSE is the default door for one-way push), and lets fe.modules.api hold the SSE stream operations (sse/).
-# 3.7.0 is a minor (alpha.31): it ADDS the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
+# 3.7.0 is a minor (alpha.31): it ADDS the optional app.scripts.integration slot (scripts/integration/*.mjs, the product test-support scripts that only the integration harness runs) and the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
 # transport client layer), and lets fe.hooks.swr hold the SWR subscription hooks (api/sse/subscriptions/useSubscribe<X>Swr.ts, one useSWRSubscription per stream operation).
 
 # Field meaning, per slot.
@@ -727,6 +727,24 @@ slots:
     rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
     exemplifiedBy:
       - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, edition: lite}
+  - id: app.scripts.integration
+    since: 3.7.0
+    profiles: [app]
+    editionWhy: "Lite and full share the slot: a product's integration proof that needs a throwaway, unmigrated database has the same need in both editions, and lite's generic scripts path is closed to anything but codegen and delivery tooling."
+    # Product test-support scripts, run only by the integration harness (the integration suites call them; no package script, workflow, hook
+    # or deploy step does). A proof that must create a throwaway database that no migration has touched and run DDL on it keeps that work here,
+    # because the back-end lint refuses runtime DDL and raw query text in test sources. The folder is `integration`, not `test`:
+    # R252's script scan skips test folders, and a support script that creates databases must stay inside it. A spec or test is not a script
+    # (BE_SPEC_PLACEMENT), a check or lint source has no place (HFS_REPO_LOCAL_CHECK), and a script that reaches a host other than the private
+    # test stack is refused by its own connection guard, which the integration spec of the product proves.
+    path: "scripts/integration/*.mjs"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, editions: [lite, full]}
   - id: app.sides
     since: 3.1.0
     profiles: [app]

package/runtime/knowledge/patterns/be/queues.yaml

@@ -85,7 +85,7 @@ rules:
       A recurring task is a job scheduler (`upsertJobScheduler`) that the queue module declares in its `schedulers` list and
       `platform/queue` registers at boot, or, in an app on Supabase, a uniquely named pg_cron job of a migration whose command
       (directly or through one `*_tick` function) only inserts one row of a queue constant into the queue outbox table of
-      `ruleParams.db.queueOutbox` (`public.queue`), which the relay hands to BullMQ; a tick has exactly one of the two owners. Its job is processed by the same
+      `ruleParams.db.queueOutbox` (`public.queue`), which the relay hands to BullMQ, or by calling the enqueue function that the app declares with its own outbox table in `hfs.json` `sides.be.queueOutbox` (redis declared in `sides.be.backing`; the function's active definition only inserts into that table); a tick has exactly one of the two owners. A job name is scheduled once while it is active: a later migration that replaces a tick's command calls `cron.unschedule` of the name first. Its job is processed by the same
       `features/jobs/<job>/<job>.processor.ts` as any enqueued job. `@nestjs/schedule`, `@Cron`, `@Interval`, `@Timeout` and
       `setInterval` for work are not used anywhere.
     rationale: |-

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -73,6 +73,18 @@ function extraPackageProblems(side, entries) {
   return [];
 }
 
+/** `sides.be.queueOutbox`: the app's own queue outbox ({table, enqueue, queueParameter}), which a pg_cron tick may enqueue through (R258); it needs the redis backing the relay hands rows to. */
+function queueOutboxProblems(side, value) {
+  const declared = value.queueOutbox;
+  if (declared === undefined) return [];
+  if (side !== 'be') return ['queueOutbox belongs to the be side'];
+  const name = (item) => typeof item === 'string' && /^[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*$/.test(item);
+  const bad = [];
+  if (!isPlainObject(declared) || Object.keys(declared).sort().join() !== 'enqueue,queueParameter,table' || !name(declared.table) || !name(declared.enqueue) || !/^[a-z_][a-z0-9_]*$/.test(String(declared.queueParameter))) bad.push('sides.be.queueOutbox must be {table: <schema>.<table>, enqueue: <schema>.<function>, queueParameter: <parameter name>}');
+  if (!(value.backing ?? []).includes('redis')) bad.push('sides.be.queueOutbox needs sides.be.backing to declare redis, which the relay hands its rows to');
+  return bad;
+}
+
 function grammarProblems(side, grammar) {
   if (grammar === undefined) return [];
   if (side !== 'fe') return ['grammar belongs to the fe side'];
@@ -83,7 +95,7 @@ function declarationSideProblems(side, value, names) {
   const bad = [];
   const at = `sides.${side}`;
   if (!isPlainObject(value)) return [`${at} must be an object`];
-  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing', 'queueOutbox'].includes(key)) bad.push(`${at} has unknown key ${key}`);
   bad.push(...appShapeProblems(value.apps, at, side, names));
   if (isBadUniqueList(value.optionalSlots, (slot) => SLOT_ID.test(String(slot)))) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
   if (value.backing !== undefined && side !== 'be') bad.push('backing belongs to the be side');
@@ -91,7 +103,7 @@ function declarationSideProblems(side, value, names) {
   bad.push(...patternShapeProblems(value, at, NAME), ...kindShapeProblems(value, at, NAME));
   if (isBadUniqueList(value.reads, (read) => typeof read === 'string' && read.length > 0)) bad.push(`${at}.reads must be a unique list of paths`);
   if (value.connections !== undefined) bad.push(...connectionProblems(side, value));
-  bad.push(...extraPackageProblems(side, value.extraPackages), ...grammarProblems(side, value.grammar));
+  bad.push(...extraPackageProblems(side, value.extraPackages), ...grammarProblems(side, value.grammar), ...queueOutboxProblems(side, value));
   return bad;
 }
 

package/runtime/scripts/hfs/rules/database-queue-outbox.mjs

@@ -0,0 +1,102 @@
+// R258: an app whose queue is BullMQ on a declared Redis may keep its own outbox beside the canon `ruleParams.db.queueOutbox` table. The
+// app declares it in hfs.json `sides.be.queueOutbox` ({table, enqueue, queueParameter}), and a pg_cron tick enqueues through the declared
+// `enqueue` function only while that function's active definition does nothing but write the declared table with its queue column bound
+// to the declared parameter. The checker reads the declaration and the function body; it names no app table or function.
+import pg from 'libpg-query';
+import { sqlStringParts as strings, walkSqlAst as walk, sqlParser } from '../../lib/sql-ast.mjs';
+
+await pg.loadModule();
+
+const sqlTree = sqlParser(pg);
+const STATEMENTS = new Set(['PLpgSQL_stmt_block', 'PLpgSQL_stmt_execsql', 'PLpgSQL_stmt_if', 'PLpgSQL_stmt_assign', 'PLpgSQL_stmt_return']);
+const OTHER_DML = ['UpdateStmt', 'DeleteStmt', 'MergeStmt'];
+const qualified = (name) => name.includes('.') ? name : `public.${name}`;
+
+/** The outbox an app declares, or null: it counts only while the back end declares the redis backing the relay hands rows to. */
+export function queueOutboxDeclaration(declaration) {
+  const be = declaration?.sides?.be;
+  const declared = be?.queueOutbox;
+  if (!declared || !(be.backing ?? []).includes('redis')) return null;
+  return { table: qualified(declared.table), enqueue: qualified(declared.enqueue), parameter: declared.queueParameter };
+}
+
+function plpgsqlStatements(fn, body) {
+  const parameters = (fn.parameters ?? []).map((item) => item.FunctionParameter?.name).filter(Boolean).map((name) => `"${name.replaceAll('"', '""')}" text`).join(',');
+  let tag = '$hfs_outbox$';
+  while (body.includes(tag)) tag = `${tag.slice(0, -1)}_$`;
+  let tree;
+  try { tree = pg.parsePlPgSQLSync(`create function hfs_probe(${parameters}) returns text language plpgsql as ${tag}${body}${tag};`); } catch { return null; }
+  const trees = [];
+  let safe = true;
+  walk(tree, (node) => {
+    for (const key of Object.keys(node)) if (key.startsWith('PLpgSQL_stmt_') && !STATEMENTS.has(key)) safe = false;
+    const expr = node.PLpgSQL_expr;
+    if (expr) trees.push(sqlTree(expr.parseMode === 0 ? expr.query : `select ${expr.query}`));
+  });
+  return safe ? trees : null;
+}
+
+function bodyStatements(fn) {
+  const option = (name) => (fn.options ?? []).find((item) => item.DefElem?.defname === name)?.DefElem?.arg;
+  const language = option('language')?.String?.sval ?? 'sql';
+  const body = strings(option('as')?.List?.items).join('');
+  if (language === 'plpgsql') return plpgsqlStatements(fn, body);
+  if (language !== 'sql') return null;
+  if (fn.sql_body) return (fn.sql_body.List ? fn.sql_body.List.items : [fn.sql_body]).map((stmt) => ({ stmts: [{ stmt }] }));
+  return sqlTree(body)?.stmts?.map((entry) => ({ stmts: [entry] })) ?? null;
+}
+
+/** True when the nodes hold no sub-select or other statement and call only functions `pureCall` admits. */
+function pureNodes(nodes, pureCall) {
+  let ok = true;
+  walk(nodes, (node) => {
+    if (node.SubLink || node.SelectStmt || node.InsertStmt || OTHER_DML.some((key) => node[key])) ok = false;
+    if (node.FuncCall && !pureCall(node.FuncCall)) ok = false;
+  });
+  return ok;
+}
+
+/** `insert into <table> (..., queue, ...) values (..., <parameter>, ...) [on conflict .. do nothing] [returning ..]` with pure other values. */
+function insertOk(declared, insert, pureCall) {
+  if (insert.withClause || `${insert.relation?.schemaname || 'public'}.${insert.relation?.relname}` !== declared.table) return false;
+  if (insert.onConflictClause && insert.onConflictClause.action !== 'ONCONFLICT_NOTHING') return false;
+  const columns = (insert.cols ?? []).map((item) => item.ResTarget?.name);
+  const rows = insert.selectStmt?.SelectStmt?.valuesLists ?? [];
+  const values = rows.length === 1 ? rows[0].List?.items ?? [] : [];
+  const at = columns.indexOf('queue');
+  if (at < 0 || new Set(columns).size !== columns.length || values.length !== columns.length) return false;
+  const bound = values[at].ColumnRef?.fields;
+  if (!bound || strings(bound).join('.') !== declared.parameter || bound.length !== 1) return false;
+  return pureNodes(values.filter((_, index) => index !== at), pureCall);
+}
+
+/** A read of the declared table with pure expressions, or an expression over variables alone. */
+function readOk(declared, tree, pureCall) {
+  let ok = true;
+  walk(tree, (node) => {
+    if (OTHER_DML.some((key) => node[key]) || node.InsertStmt || node.SelectStmt?.intoClause) ok = false;
+    if (node.FuncCall && !pureCall(node.FuncCall)) ok = false;
+    if (node.RangeVar && `${node.RangeVar.schemaname || 'public'}.${node.RangeVar.relname}` !== declared.table) ok = false;
+  });
+  return ok;
+}
+
+function statementOk(declared, tree, pureCall) {
+  const stmt = tree?.stmts?.length === 1 ? tree.stmts[0].stmt : null;
+  if (stmt?.InsertStmt) return insertOk(declared, stmt.InsertStmt, pureCall);
+  return Boolean(stmt?.SelectStmt) && readOk(declared, tree, pureCall);
+}
+
+/**
+ * The position of the queue parameter when the active definition of the declared enqueue function only writes the declared outbox
+ * (inserts, reads of that table and pure expressions), or -1. `pureCall` admits a function call that does no work.
+ */
+export function outboxEnqueueQueueIndex(declared, entry, pureCall) {
+  const fn = entry?.node;
+  if (!fn) return -1;
+  const index = (fn.parameters ?? []).findIndex((item) => item.FunctionParameter?.name === declared.parameter);
+  const trees = bodyStatements(fn);
+  if (index < 0 || !trees?.length || !trees.every((tree) => statementOk(declared, tree, pureCall))) return -1;
+  const inserts = trees.filter((tree) => tree?.stmts?.[0]?.stmt?.InsertStmt).length;
+  return inserts === 1 ? index : -1;
+}

package/runtime/scripts/hfs/rules/database-queues.mjs

@@ -11,10 +11,11 @@ import { queueSourceFacts, queueSchedulers, queueProblem as problem } from './da
 import { readJson, readText } from './read.mjs';
 import { DB_CRON_OWNED, DB_PGMQ_DECLARED, isActiveMigration } from './database-constants.mjs';
 import { loadSlotManifest } from '../slots.mjs';
+import { queueOutboxDeclaration, outboxEnqueueQueueIndex } from './database-queue-outbox.mjs';
 
 await pg.loadModule();
 
-const PURE_CALLS = new Set(['jsonb_build_object', 'json_build_object', 'jsonb_build_array', 'json_build_array', 'to_jsonb', 'now', 'clock_timestamp']);
+const PURE_CALLS = new Set(['jsonb_build_object', 'json_build_object', 'jsonb_build_array', 'json_build_array', 'to_jsonb', 'now', 'clock_timestamp', 'date_trunc']);
 const TABLE_PRIVILEGES = ['select', 'insert', 'update', 'delete', 'truncate', 'references', 'trigger', 'maintain'];
 const sqlName = (nodes) => strings(nodes).join('.');
 const callName = (call) => sqlName(call.funcname);
@@ -54,9 +55,11 @@ function inspectQueueCall(state, call, file, migration) {
 }
 
 function recordSchedule(state, call, file) {
-  const entry = { call, file, created: new Map(state.created), functions: new Map(state.functions) };
-  state.schedules.push(entry);
   const job = sqlLiteral(argument(call, 0, ['job_name']));
+  // The names scheduled and not unscheduled since, in migration order: a name is a duplicate only while it is still scheduled.
+  const entry = { call, file, created: new Map(state.created), functions: new Map(state.functions), active: new Set(state.scheduledNames) };
+  state.schedules.push(entry);
+  if (job !== null) state.scheduledNames.add(job);
   const schedule = sqlLiteral(argument(call, 1, ['schedule']));
   const command = sqlLiteral(argument(call, 2, ['command']));
   if (job !== null && schedule !== null && command !== null) {
@@ -77,6 +80,7 @@ function inspectCronCall(state, call, file, migration) {
   if (job !== null) {
     state.unschedules.push({ name: job, file });
     state.activeCron.delete(job);
+    state.scheduledNames.delete(job);
     state.liveSchedules.delete(job);
   }
   else problem(state, DB_CRON_OWNED, file, 'cron.unschedule must identify the migration-owned job by literal name');
@@ -205,12 +209,16 @@ function enqueue(state, call) {
   return queue !== null && state.created.has(queue) && safe ? queue : null;
 }
 
+function pureCall(call) {
+  return uuidConstructor(call) || PURE_CALLS.has(callName(call).replace(/^pg_catalog\./, ''));
+}
+
 function pureArguments(call) {
   return pureExpressions(call.args);
 }
 
 function pureExpressions(nodes) {
-  let safe = callsOf(nodes).every((nested) => uuidConstructor(nested) || PURE_CALLS.has(callName(nested).replace(/^pg_catalog\./, '')));
+  let safe = callsOf(nodes).every(pureCall);
   walk(nodes, (node) => {
     if (['SubLink', 'SelectStmt', 'InsertStmt', 'UpdateStmt', 'DeleteStmt', 'MergeStmt'].some((key) => node[key])) safe = false;
   });
@@ -223,6 +231,15 @@ function queueOutbox(manifest) {
   return declared ? { table: declared.table, columns: new Set(declared.columns) } : null;
 }
 
+/** The queue constant a call of the app's declared outbox enqueue function enqueues (hfs.json sides.be.queueOutbox), or null. */
+function declaredEnqueue(state, call) {
+  const declared = state.declaredOutbox;
+  if (!declared || qualified(callName(call)) !== declared.enqueue) return null;
+  const index = outboxEnqueueQueueIndex(declared, state.functions.get(declared.enqueue), pureCall);
+  const queue = index < 0 ? null : sqlLiteral(argument(call, index, [declared.parameter]));
+  return queue !== null && state.constants.has(queue) && pureArguments(call) ? queue : null;
+}
+
 /** The queue constant one outbox row enqueues: `insert into <outbox> (queue, ...) values ('<queue constant>', ...)` with pure values. */
 function outboxEnqueue(state, insert) {
   if (!state.outbox || insert.returningClause || insert.returningList || insert.onConflictClause || insert.withClause) return null;
@@ -242,7 +259,8 @@ function singleEnqueue(state, tree, legacy) {
   const insert = tree?.stmts?.length === 1 ? tree.stmts[0].stmt?.InsertStmt : undefined;
   if (insert) return outboxEnqueue(state, insert);
   const call = singleCall(tree);
-  return legacy && call ? enqueue(state, call) : null;
+  if (!call) return null;
+  return declaredEnqueue(state, call) ?? (legacy ? enqueue(state, call) : null);
 }
 
 /** PostgreSQL's catalog-owned scalar UUID constructor adds an envelope identity without doing work in the tick. */
@@ -311,7 +329,7 @@ function scheduleTarget(state, command, legacy) {
   const tree = sqlTree(command);
   const target = singleCall(tree);
   if (!target) return { tick: null, queues: singleEnqueue(state, tree, legacy) };
-  if (!callName(target).endsWith('_tick')) return { tick: null, queues: legacy ? enqueue(state, target) : null };
+  if (!callName(target).endsWith('_tick')) return { tick: null, queues: declaredEnqueue(state, target) ?? (legacy ? enqueue(state, target) : null) };
   const tick = qualified(callName(target));
   const fn = state.functions.get(tick);
   const queues = fn && pureArguments(target) && tickQueues(state, fn, legacy);
@@ -325,7 +343,7 @@ function tickRemoval(state, tick, name) {
   }
 }
 
-function scheduleCheck(state, schedule, names, schedulers, ticks) {
+function scheduleCheck(state, schedule, schedulers, ticks) {
   const { call, file } = schedule;
   const name = sqlLiteral(argument(call, 0, ['job_name']));
   const command = sqlLiteral(argument(call, 2, ['command']));
@@ -333,22 +351,23 @@ function scheduleCheck(state, schedule, names, schedulers, ticks) {
     problem(state, DB_CRON_OWNED, file, 'cron.schedule requires literal job name, cadence and command for migration ownership');
     return;
   }
-  if (names.has(name)) problem(state, DB_CRON_OWNED, file, 'cron job names must be unique across active migrations');
-  names.add(name);
+  if (schedule.active.has(name)) problem(state, DB_CRON_OWNED, file, 'a cron job name is scheduled once while it is active: cron.unschedule it before a later migration schedules it again');
   const historical = { ...state, created: schedule.created, functions: schedule.functions };
   const { tick, queues } = scheduleTarget(historical, command, true);
   if (!queues) problem(state, DB_CRON_OWNED, file, 'a cron command inserts one row of a queue constant into the queue outbox, directly or through one existing *_tick function that only does that; business DML, dynamic SQL and network calls are refused');
   if (state.liveSchedules.get(name) === schedule && !scheduleTarget(state, command, false).queues) problem(state, DB_CRON_OWNED, file, 'the live cron job must insert one outbox row of a queue constant (ruling:R212/case-10): it targets a missing queue or tick, still enqueues with pgmq.send, or its current tick no longer only does that');
-  tickOwner(state, tick, file, ticks);
+  tickOwner(state, tick, name, schedule, ticks);
   const owners = [name, ...(tick ? [tick, tick.split('.').at(-1)] : []), ...[queues ?? []].flat()];
   if (owners.some((owner) => schedulers.has(owner))) problem(state, DB_CRON_OWNED, file, 'the tick is also declared in an application scheduler list; give it one owner');
   tickRemoval(state, tick, name);
 }
 
-function tickOwner(state, tick, file, ticks) {
+/** One tick function has one cron owner at a time: an earlier job of the tick that is still scheduled is a second owner. */
+function tickOwner(state, tick, name, schedule, ticks) {
   if (!tick) return;
-  if (ticks.has(tick)) problem(state, DB_CRON_OWNED, file, 'a tick function has more than one cron owner');
-  ticks.add(tick);
+  const owners = ticks.get(tick) ?? [];
+  if (owners.some((owner) => schedule.active.has(owner))) problem(state, DB_CRON_OWNED, schedule.file, 'a tick function has more than one cron owner');
+  ticks.set(tick, [...owners, name]);
 }
 
 function queueState({ repoRoot, files = [], all = files, repo = {}, manifest }) {
@@ -356,7 +375,7 @@ function queueState({ repoRoot, files = [], all = files, repo = {}, manifest })
   const declaration = readJson(repoRoot, 'hfs.json') ?? repo;
   const connected = ['be', 'fe'].some((side) => (declaration.sides?.[side]?.connections ?? []).some((item) => item.provider === 'supabase'));
   if (repo.edition !== 'lite' && declaration.edition !== 'lite' && !declaration.supabase && !connected && !paths.some((file) => file.startsWith('supabase/'))) return null;
-  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
+  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), declaredOutbox: queueOutboxDeclaration(declaration), scheduledNames: new Set(), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
   state.sources = queueSourceFacts(state, paths, inspectCalls);
   migrationFacts(state, paths);
   return state;
@@ -369,10 +388,9 @@ function validateQueues(state, inScope) {
   }
   for (const [topic, file] of state.topics) if (!state.created.has(topic)) problem(state, DB_PGMQ_DECLARED, file, `event-bus topic queue ${topic} has no pgmq.create in an active migration`);
   for (const { node, file, created, executed } of state.grants) grantCheck({ ...state, created: executed ? created : state.created }, node, file);
-  const names = new Set();
-  const ticks = new Set();
+  const ticks = new Map();
   const schedulers = queueSchedulers(state.sources);
-  for (const schedule of state.schedules) scheduleCheck(state, schedule, names, schedulers, ticks);
+  for (const schedule of state.schedules) scheduleCheck(state, schedule, schedulers, ticks);
   return state.findings.filter((finding) => inScope(finding.path));
 }
 

package/scaffold/add-queue-lite.mjs

@@ -65,9 +65,11 @@ const DATABASE_ERROR = 'be/src/modules/platform/database/errors/database.error.t
 /** Skeleton files the lite starter leaves out and the queue capabilities use, each from its skeleton template. */
 const SKELETON_FILES = Object.freeze([
   ['be/src/modules/platform/database/database.sql.ts', 'skeleton-lite/src/modules/platform/database/database.sql.ts'],
+  ['be/src/modules/platform/primitives/sequence.policy.ts', 'skeleton/src/modules/platform/primitives/sequence.policy.ts'],
+  ['be/src/modules/platform/primitives/sequence.policy.spec.ts', 'skeleton/src/modules/platform/primitives/sequence.policy.spec.ts'],
 ]);
 
-/** The sql tag of the outbox and claim statements (with its identifier error) and the in-order relay of lite's starter platform. */
+/** The sql tag of the outbox and claim statements (with its identifier error) and the in-order relay the queue adapters walk their rows with. */
 function skeletonFiles(repoRoot) {
   const created = SKELETON_FILES.filter(([relative]) => !fs.existsSync(path.join(repoRoot, ...relative.split('/'))))
     .map(([relative, source]) => ({ relative, text: render(template(`be/${source}`), {}) }));

package/scaffold/app.mjs

@@ -412,6 +412,7 @@ const LITE_DEFERRED_GENERATOR_FILES = new Set([
   'src/modules/platform/database/database.sql.ts',
   'src/modules/platform/database/migration-runner.service.ts',
   'src/modules/platform/database/seed-runner.service.ts',
+  'src/modules/platform/primitives/sequence.policy.ts',
 ]);
 const liteBaseSource = (rel) => !rel.startsWith('apps/cli/')
     && !rel.startsWith('src/features/cli/')

package/scaffold/lite-exports.mjs

@@ -36,9 +36,15 @@ const REGISTRATIONS = Object.freeze({
       names: ["InjectPrimaryEntityManager", "PRIMARY_ENTITY_MANAGER"],
     },
   ],
-  // The queue and jobs capabilities state their outbox and claim statements with the sql tag (the lite starter already carries the
-  // in-order relay and the record guard the BullMQ client reads stored jobs with).
+  // The queue and jobs capabilities state their outbox and claim statements with the sql tag and walk rows with the in-order relay
+  // (the lite starter already carries the record guard the BullMQ client reads stored jobs with).
   queue: [
+    {
+      file: "be/src/modules/platform/primitives/index.ts",
+      source: "./sequence.policy",
+      names: ["eachInOrder"],
+      beforeSource: "./record.policy",
+    },
     {
       file: "be/src/modules/platform/database/index.ts",
       source: "./database.sql",

package/templates/app/skeleton-lite/.starcistacks/dev/README.md

@@ -7,7 +7,7 @@ The runtime template tracks no encrypted members. Scaffolding generates the two
 
 | Command | Operation |
 | --- | --- |
-| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. For a declared Redis, run `npm run redis:create` once, then `npm run redis:start` when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
+| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. For a declared Redis (its `redis:create`, `redis:start` and `redis:stop` scripts arrive in package.json with the first queue or job), run the create script once, then the start script when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
 | doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local Supabase availability. |
 | up | Run `docker stack deploy -c infra/swarm/stack.yaml {{project}}-dev` from this directory after preparation. |
 | status | Run `docker stack services {{project}}-dev`. |

package/templates/be/skeleton-lite/src/modules/platform/logging/index.ts

@@ -1,17 +1,6 @@
 export { createJsonLogger } from "./json-logger.service"
-export {
-    InjectLogger,
-    LOGGER,
-    CORRELATION_IDS,
-    CORRELATION_RUNNER,
-    InjectCorrelationIds,
-    InjectCorrelationRunner,
-} from "./logging.decorators"
-export { applyCorrelation, correlationMiddleware } from "./correlation-request.policy"
-export type { CorrelationIds, CorrelationRunner } from "./correlation.port"
-export type { CorrelationHeaders, CorrelationRequest } from "./correlation.contracts"
-export { createCorrelationRunner } from "./correlation.service"
-export { isCorrelationId } from "./correlation.policy"
+export { InjectLogger, LOGGER } from "./logging.decorators"
+export { applyCorrelation } from "./correlation-request.policy"
 export { LoggingLogEvent } from "./logging.log-events"
 export { LoggingModule } from "./logging.module"
 export type { Logger } from "./logging.port"

package/templates/be/skeleton-lite/src/modules/platform/primitives/index.ts

@@ -1,4 +1,3 @@
 export type { Outcome } from "./outcome.contracts"
 export { ok, refused, unwrapOutcome } from "./outcome.mapper"
-export { eachInOrder } from "./sequence.policy"
 export { isRecord } from "./record.policy"