@starci/hfs 4.7.38 → 4.7.40

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 4.7.40 - 2026-10-26
+- Fixed: the next release is derived within the candidate's own tag family, so legacy tags of other families no longer outrank the runtime line (`release cut` and the release-definition guard).
+
+## 4.7.39 - 2026-10-26
+- Added: R258 follows the active cron schedule and accepts a declared outbox (`sides.be.queueOutbox`), and the optional slot `app.scripts.integration` carries integration scripts.
+- Fixed: the lite scaffold templates, barrels and dev README follow the lite scaffold end-to-end fixes.
+
 ## 4.7.38 - 2026-10-26
 - Changed: the bundled canon pins select @starci/stylelint-canon 2.0.13, @starci/eslint-canon-be 3.4.46, @starci/eslint-canon-fe 9.1.1, the Grammar lint families 0.12.5 and @starci/grammar 0.12.5.
 - Fixed: the full and lite scaffold templates, skeletons and specs follow the scaffold end-to-end and repaint fixes made after 4.7.37.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.38",
+  "version": "4.7.40",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -23,35 +23,35 @@ pins:
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/grammar':
-    version: 0.12.5
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.46
+    version: 3.4.47
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.1
+    version: 9.1.2
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.5
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.5
+    version: 0.12.6
     group: starci
     install: registry
     side: fe
@@ -91,14 +91,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.38
+    version: 1.7.40
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.38
+    version: 4.7.40
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -4405,7 +4405,7 @@ rules:
     editionWhy: "owner:lite-backing-services makes Supabase lite's database backing and ruling:R212/case-10 moves the lite queue to Redis; the pgmq retirement and pg_cron ownership requirements apply to that backing."
     docs: [docs/microservices.md#r258]
     templateNa: "Queue declarations and enqueue-only cron commands depend on product-owned work and are authored in its Supabase migrations."
-    law: "DB_QUEUE_CRON: the queue is BullMQ on Redis (ruling:R212/case-10), so the active migrations leave no pgmq queue named by a queue constant under modules/queues; a pgmq queue a migration created for one is dropped by a later migration. Every pgmq queue the active migrations leave is an event-bus topic queue named by a literal *_TOPIC_QUEUE constant under platform/event-bus, every such constant has its pgmq queue, and pgmq objects are granted only to the application role while they exist. A uniquely named pg_cron job belongs to a migration and only enqueues: its command, directly or through one enqueue-only *_tick function, inserts one row of a literal queue constant into the queue outbox table of ruleParams.db.queueOutbox, writing only its declared columns (the relay hands it to BullMQ); it executes no business DML or HTTP request and shares no tick with an app scheduler. A pgmq.send validates only in the original body of a job an older migration scheduled while that queue existed; the live job and its current tick never enqueue that way. Removing a tick unschedules its job."
+    law: "DB_QUEUE_CRON: the queue is BullMQ on Redis (ruling:R212/case-10), so the active migrations leave no pgmq queue named by a queue constant under modules/queues; a pgmq queue a migration created for one is dropped by a later migration. Every pgmq queue the active migrations leave is an event-bus topic queue named by a literal *_TOPIC_QUEUE constant under platform/event-bus, every such constant has its pgmq queue, and pgmq objects are granted only to the application role while they exist. A pg_cron job belongs to a migration and only enqueues; its name is scheduled once while it is active, so a later migration schedules it again only after its own cron.unschedule of that name, and one tick function has one live job at a time. Its command, directly or through one enqueue-only *_tick function, inserts one row of a literal queue constant into the queue outbox table of ruleParams.db.queueOutbox, writing only its declared columns (the relay hands it to BullMQ). An app whose hfs.json sides.be.backing declares redis may declare its own outbox in sides.be.queueOutbox ({table, enqueue, queueParameter}); the command, or the tick, then calls the declared enqueue function with a literal queue constant for the declared parameter and pure other arguments, while the active definition of that function only inserts one row into the declared table with its queue column bound to that parameter (an ON CONFLICT DO NOTHING, a read of the declared table and pure expressions are the only other work). A direct insert into the app's outbox table, or any other function, stays refused. The job executes no business DML or HTTP request and shares no tick with an app scheduler. A pgmq.send validates only in the original body of a job an older migration scheduled while that queue existed; the live job and its current tick never enqueue that way. Removing a tick unschedules its job."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["DB_PGMQ_DECLARED", "DB_CRON_OWNED"]
@@ -4413,6 +4413,7 @@ rules:
       - {kind: hfs, id: db-queue-cron, at: scripts/hfs/rules/database-queues.mjs}
     proves:
       - {path: packages/hfs/src/hfs-database-queues.spec.mjs, edition: lite, codes: [DB_PGMQ_DECLARED, DB_CRON_OWNED]}
+      - {path: packages/hfs/src/hfs-queue-outbox-declaration.spec.mjs, edition: lite, codes: [DB_CRON_OWNED]}
     exemplifiedBy:
       - {path: packages/hfs/src/hfs-database-queues.spec.mjs, edition: lite, codes: [DB_PGMQ_DECLARED, DB_CRON_OWNED]}
     witness:

package/runtime/knowledge/hfs/slots.yaml

@@ -43,7 +43,7 @@ versioning:
 # journey (enabled with app.browser by `browser: true`).
 # 3.6.0 is a minor (alpha.30): it ADDS the opt-in be.feature.realtime.sse slot, the server-sent-events door of the realtime kind (owner decision
 # 2026-10-24: lite may serve SSE, and SSE is the default door for one-way push), and lets fe.modules.api hold the SSE stream operations (sse/).
-# 3.7.0 is a minor (alpha.31): it ADDS the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
+# 3.7.0 is a minor (alpha.31): it ADDS the optional app.scripts.integration slot (scripts/integration/*.mjs, the product test-support scripts that only the integration harness runs) and the optional fe.transport.stream slot, the fetch reader of server-sent-events streams (the stream half of the
 # transport client layer), and lets fe.hooks.swr hold the SWR subscription hooks (api/sse/subscriptions/useSubscribe<X>Swr.ts, one useSWRSubscription per stream operation).
 
 # Field meaning, per slot.
@@ -727,6 +727,24 @@ slots:
     rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
     exemplifiedBy:
       - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, edition: lite}
+  - id: app.scripts.integration
+    since: 3.7.0
+    profiles: [app]
+    editionWhy: "Lite and full share the slot: a product's integration proof that needs a throwaway, unmigrated database has the same need in both editions, and lite's generic scripts path is closed to anything but codegen and delivery tooling."
+    # Product test-support scripts, run only by the integration harness (the integration suites call them; no package script, workflow, hook
+    # or deploy step does). A proof that must create a throwaway database that no migration has touched and run DDL on it keeps that work here,
+    # because the back-end lint refuses runtime DDL and raw query text in test sources. The folder is `integration`, not `test`:
+    # R252's script scan skips test folders, and a support script that creates databases must stay inside it. A spec or test is not a script
+    # (BE_SPEC_PLACEMENT), a check or lint source has no place (HFS_REPO_LOCAL_CHECK), and a script that reaches a host other than the private
+    # test stack is refused by its own connection guard, which the integration spec of the product proves.
+    path: "scripts/integration/*.mjs"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
+    exemplifiedBy:
+      - {path: packages/hfs/src/hfs-slot-ownership.spec.mjs, editions: [lite, full]}
   - id: app.sides
     since: 3.1.0
     profiles: [app]

package/runtime/knowledge/patterns/be/queues.yaml

@@ -85,7 +85,7 @@ rules:
       A recurring task is a job scheduler (`upsertJobScheduler`) that the queue module declares in its `schedulers` list and
       `platform/queue` registers at boot, or, in an app on Supabase, a uniquely named pg_cron job of a migration whose command
       (directly or through one `*_tick` function) only inserts one row of a queue constant into the queue outbox table of
-      `ruleParams.db.queueOutbox` (`public.queue`), which the relay hands to BullMQ; a tick has exactly one of the two owners. Its job is processed by the same
+      `ruleParams.db.queueOutbox` (`public.queue`), which the relay hands to BullMQ, or by calling the enqueue function that the app declares with its own outbox table in `hfs.json` `sides.be.queueOutbox` (redis declared in `sides.be.backing`; the function's active definition only inserts into that table); a tick has exactly one of the two owners. A job name is scheduled once while it is active: a later migration that replaces a tick's command calls `cron.unschedule` of the name first. Its job is processed by the same
       `features/jobs/<job>/<job>.processor.ts` as any enqueued job. `@nestjs/schedule`, `@Cron`, `@Interval`, `@Timeout` and
       `setInterval` for work are not used anywhere.
     rationale: |-

package/runtime/scripts/guards/release-definition.mjs

@@ -1,204 +1,204 @@
-// release-definition.mjs - what makes a commit of the runtime repository a RELEASE commit, the one definition shared by the
-// pre-push hook (scripts/guards/release-push-gate.mjs) and the release cut (scripts/supervisor/release-cut.mjs). The remote
-// main of the runtime moves exactly when a release is cut, so a push of main or of a v* tag is judged against this list:
-//   RELEASE_VERSION_UNCHANGED   package.json `version` at the pushed commit differs from the version at the remote main's head
-//   RELEASE_VERSION_NOT_NEXT    that version is the next release after the highest v* tag (scripts/lib/release-version.mjs, owner ruling release-waves):
-//                               the next wave alpha.N.M+1 of its line or the next line alpha.N+1, never the legacy -fix form
-//   RELEASE_TAG_VERSION         the release tag is v<version> of the pushed commit
-//   RELEASE_CHANGELOG_SECTION   CHANGELOG.md holds `## [<version>] - <date>` (a dated heading) with no unfinished marker (R222)
-//   RELEASE_TAG_MISSING         an ANNOTATED tag v<version> points at the pushed commit
-//   RELEASE_RECEIPT_MISSING     the L4 record of exactly this commit (scripts/guards/release-record.mjs, written by the cut) names this tag
-//   RELEASE_RECEIPT_INCOMPLETE  that record holds a green row for each of RECEIPT_STEPS (the package clean-test, the scaffold e2e and the checks) (RAN on this commit or reused from another with the identical input digest, the record's `reusedFrom` names it; owner ruling speed-flow, 2026-10-25)
-//   RELEASE_SUITE_MODE          the record says `suite: ci` (the Linux parity delegated to CI) while the checked-out config says `local`, or it lists no delegated linux-parity: a record never claims the mode by
-//                               itself (scripts/guards/release-suite-mode.mjs); both modes ask for the same root rows, the runtime has no spec suite to delegate (owner ruling no-runtime-specs)
-// Each finding names what is missing and the command that produces it. Pure over the git reads; no bypass.
-import { catFile } from '../api/git/cat-file.mjs';
-import { revParseQuery } from '../api/git/rev-parse-query.mjs';
-import { show } from '../api/git/show.mjs';
-import { tag as gitTag } from '../api/git/tag.mjs';
-import { mergeBaseQuery } from '../api/git/merge-base-query.mjs';
-import { pathKey, realPath } from '../lib/path-key.mjs';
-import { changelogSection, releaseNotesFindings } from '../hfs/runtime-rules/release-notes.mjs';
-import { nextReleases, releaseVersionRefusal, taggedVersions } from '../lib/release-version.mjs';
-import { readL4Record } from './release-record.mjs';
-import { suiteModeOf } from './release-suite-mode.mjs';
-
-/** The rows the L4 record must hold green, run on the commit or reused from an identical-digest row of another, in either suite mode: the package clean-test, the scaffold e2e and the checks (the runtime's real tests). */
-export const RECEIPT_STEPS = Object.freeze(['npm run test:packages', 'npm run test:e2e', 'npm run check']);
-const CUT_COMMAND = (tag) => `starci release cut --tag ${tag}`;
-const REGEX_SPECIALS = /[.*+?^$()|[\]{}\\]/g;
-const HEADING_HEAD = String.raw`^## \[`;
-const DATED_HEADING_TAIL = String.raw`\] — \d{4}-\d{2}-\d{2}\s*$`;
-const DATED_HEADING = (version) => new RegExp([HEADING_HEAD, version.replaceAll(REGEX_SPECIALS, String.raw`\$&`), DATED_HEADING_TAIL].join(''), 'mu');
-
-const finding = (code, missing, fix) => ({ code, missing, fix });
-const gitText = (verb, args, cwd) => {
-  const r = verb(args, { cwd, timeout: 60_000 });
-  return r.status === 0 ? String(r.stdout ?? '') : null;
-};
-
-/** The package.json version of `commit`, or null when the commit or its manifest cannot be read. */
-export function versionAt(cwd, commit) {
-  const text = gitText(show, [`${commit}:package.json`], cwd);
-  try { return text === null ? null : JSON.parse(text).version ?? null; } catch { return null; }
-}
-
-const releaseUnknown = (why) => ({ ok: false, status: 'unknown', why });
-const ineligibleRelease = (explicit, why) => explicit ? releaseUnknown(why) : { ok: true, candidate: null };
-
-/** A runtime Git root's nearest annotated, manifest-bound release; enclosing application history is inapplicable. */
-export function releaseTagOf({ repo, tag = null, excludeHead = false }) {
-  const history = runtimeGitHistory(repo);
-  if (!history.ok) return history;
-  const listed = tag === null ? gitText(gitTag, ['--merged', 'HEAD', '--list', 'v*'], repo) : tag;
-  if (listed === null) return releaseUnknown('release tags are unreadable');
-  const candidates = [];
-  for (const named of listed.split(/\r?\n/).filter(Boolean)) {
-    const result = releaseCandidate({ repo, named, current: history.head, explicit: tag !== null, excludeHead });
-    if (!result.ok) return result;
-    if (result.candidate) candidates.push(result.candidate);
-  }
-  return nearestRelease(repo, candidates);
-}
-
-/** Runtime history exists only at its own Git top-level with a readable HEAD and full ancestry. */
-function runtimeGitHistory(repo) {
-  const top = revParseQuery(['--show-toplevel'], { cwd: repo });
-  if (top.status !== 0) {
-    if (/not a git repository/i.test(String(top.stderr ?? ''))) return { ok: false, status: 'no-repository', why: 'release history requires a Git repository' };
-    return releaseUnknown('release repository identity is unreadable');
-  }
-  const gitRoot = String(top.stdout ?? '').trim();
-  if (!gitRoot) return releaseUnknown('release repository root is unreadable');
-  if (pathKey(realPath(gitRoot)) !== pathKey(realPath(repo))) return { ok: false, status: 'no-runtime-repository', why: 'the runtime copy is inside an enclosing Git repository; its history belongs to that repository' };
-  const head = gitText(revParseQuery, ['HEAD'], repo)?.trim();
-  if (!head) return releaseUnknown('release history HEAD is unreadable');
-  if (gitText(revParseQuery, ['--is-shallow-repository'], repo)?.trim() !== 'false') return releaseUnknown('release history is shallow or unreadable; fetch complete release history');
-  return { ok: true, head };
-}
-
-/** A candidate binds annotation, peeled commit, manifest spelling and ancestry; default discovery omits ineligible tags. */
-function releaseCandidate({ repo, named, current, explicit, excludeHead }) {
-  const kind = gitText(catFile, ['-t', `refs/tags/${named}`], repo)?.trim();
-  const head = gitText(revParseQuery, [`refs/tags/${named}^{commit}`], repo)?.trim();
-  if (!kind || !head) return releaseUnknown(`release tag ${named} is unreadable`);
-  if (kind !== 'tag') return ineligibleRelease(explicit, `release tag ${named} is not annotated`);
-  const version = versionAt(repo, head);
-  if (!version) return releaseUnknown(`release manifest of ${named} is unreadable`);
-  if (named !== `v${version}`) return ineligibleRelease(explicit, `release tag ${named} differs from its manifest version ${version}`);
-  const reachable = releaseAncestor(repo, head, current);
-  if (reachable === null) return releaseUnknown(`release ancestry of ${named} is unreadable`);
-  if (!reachable) return ineligibleRelease(explicit, `release tag ${named} is not merged in HEAD`);
-  if (excludeHead && head === current) return { ok: true, candidate: null };
-  return { ok: true, candidate: { tag: named, head } };
-}
-
-/** Only one unsuperseded release ancestor proves a boundary; incomparable releases hold. */
-function nearestRelease(repo, candidates) {
-  if (!candidates.length) return releaseUnknown('no eligible annotated, manifest-bound release tag is merged in HEAD');
-  const nearest = [];
-  for (const candidate of candidates) {
-    const superseded = candidateSuperseded(repo, candidate, candidates);
-    if (superseded === null) return releaseUnknown('release ancestry between tags is unreadable');
-    if (!superseded) nearest.push(candidate);
-  }
-  if (nearest.length !== 1) return releaseUnknown(`release history is ambiguous: ${nearest.map((entry) => entry.tag).join(', ')}`);
-  return { ok: true, ...nearest[0] };
-}
-
-/** A release loses its boundary only to a proven descendant release, never to a date or version sort. */
-function candidateSuperseded(repo, candidate, candidates) {
-  for (const other of candidates) {
-    if (candidate.head === other.head) continue;
-    const older = releaseAncestor(repo, candidate.head, other.head);
-    if (older === null) return null;
-    if (older) return true;
-  }
-  return false;
-}
-
-/** Missing Git proof is distinct from a proven non-ancestor. */
-function releaseAncestor(repo, before, after) {
-  const result = mergeBaseQuery(['--is-ancestor', before, after], { cwd: repo });
-  if (result.status === 0) return true;
-  if (result.status === 1) return false;
-  return null;
-}
-
-/** The next releases named from the released versions, for a fix text: "v<wave> or v<line>". */
-const nextNamed = (released) => {
-  const next = nextReleases(released);
-  return next ? `v${next.wave} or v${next.line}` : 'v<new version>';
-};
-
-function versionFindings({ cwd, remoteCommit, version, released }) {
-  if (!remoteCommit) return [];
-  const remoteVersion = versionAt(cwd, remoteCommit);
-  if (remoteVersion === null) return [finding('RELEASE_REMOTE_HEAD_UNKNOWN', `the remote main head ${remoteCommit.slice(0, 9)} is not in this repository, so its version cannot be compared`, 'git fetch origin main')];
-  if (remoteVersion === version) return [finding('RELEASE_VERSION_UNCHANGED', `package.json version ${version} is the version the remote main already carries`, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released))}`)];
-  return [];
-}
-
-/** The version must be the next release after the highest v* tag other than its own: a wave alpha.N.M is counted, never guessed. */
-function nextReleaseFindings({ version, released }) {
-  if (released === null) return [finding('RELEASE_VERSION_NOT_NEXT', 'the v* tags are unreadable, so the next release cannot be derived', 'git fetch --tags')];
-  const refusal = releaseVersionRefusal(version, released);
-  return refusal ? [finding('RELEASE_VERSION_NOT_NEXT', refusal, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released.filter((entry) => entry !== version)))}`)] : [];
-}
-
-function changelogFindings({ cwd, commit, version, tag }) {
-  const changelog = gitText(show, [`${commit}:CHANGELOG.md`], cwd);
-  if (changelog === null) return [finding('RELEASE_CHANGELOG_SECTION', 'CHANGELOG.md is not readable at the pushed commit', 'restore CHANGELOG.md')];
-  const notes = releaseNotesFindings({ tags: [tag], changelog });
-  if (notes.length) return notes.map((n) => finding('RELEASE_CHANGELOG_SECTION', n.message, 'finish the CHANGELOG section of the release (no in-preparation mark, no open marker), commit'));
-  if (!changelogSection(changelog, version).found || !DATED_HEADING(version).test(changelog)) return [finding('RELEASE_CHANGELOG_SECTION', `CHANGELOG.md has no dated heading "## [${version}] — YYYY-MM-DD"`, `date the heading of the ${version} section, commit`)];
-  return [];
-}
-
-function tagFindings({ cwd, commit, tag }) {
-  const kind = gitText(catFile, ['-t', `refs/tags/${tag}`], cwd)?.trim();
-  const target = gitText(revParseQuery, [`refs/tags/${tag}^{commit}`], cwd)?.trim();
-  if (kind === 'tag' && target === commit) return [];
-  return [finding('RELEASE_TAG_MISSING', `no annotated tag ${tag} points at ${commit.slice(0, 9)}`, CUT_COMMAND(tag))];
-}
-
-/** The finding of a record that claims the delegated mode without the checked-out config saying so (or without naming the delegated linux-parity row), else null. */
-function suiteModeFinding({ record, cwd, commit, tag }) {
-  if (record.suite !== 'ci') return null;
-  if (suiteModeOf(cwd) !== 'ci') return finding('RELEASE_SUITE_MODE', `the release record of ${commit.slice(0, 9)} says suite: ci, but this checkout's config.yaml release.suite is not ci: a record does not choose the mode`, `set release.suite: ci in config.yaml (the owner's choice), or ${CUT_COMMAND(tag)} under suite: local`);
-  if (!(record.delegated ?? []).some((row) => row?.name === 'linux-parity')) return finding('RELEASE_SUITE_MODE', `the suite: ci record of ${commit.slice(0, 9)} does not list linux-parity as delegated`, CUT_COMMAND(tag));
-  return null;
-}
-
-function receiptFindings({ cwd, commit, tag }) {
-  const record = readL4Record({ repo: cwd, head: commit, tag });
-  if (!record) return [finding('RELEASE_RECEIPT_MISSING', `no release record for exactly ${commit.slice(0, 9)} and ${tag}: the package clean-test, the scaffold e2e and the check did not run green on this commit`, CUT_COMMAND(tag))];
-  const mode = suiteModeFinding({ record, cwd, commit, tag });
-  if (mode) return [mode];
-  // A row reused from another commit (reusedFrom) counts: the cut reuses a row only when its input digest is identical (owner ruling speed-flow, 2026-10-25), and the record names the commit it came from.
-  const green = new Set((record.logs ?? []).filter((row) => row?.ok === true).map((row) => row.name));
-  const absent = RECEIPT_STEPS.filter((name) => !green.has(name));
-  return absent.length ? [finding('RELEASE_RECEIPT_INCOMPLETE', `the release record of ${commit.slice(0, 9)} has no green row for: ${absent.join(', ')}`, CUT_COMMAND(tag))] : [];
-}
-
-/**
- * The findings that keep `commit` from being a release commit of the repository at `cwd`: [{code, missing, fix}], [] when it is one.
- * `remoteCommit` is the remote main's head being replaced (null for a tag push or a first push); `tag` the release tag (default v<version>);
- * `needTag` / `needReceipt` are false only for the cut's early look, before it has created the tag and run the suite.
- */
-export function releaseFindings({ cwd, commit, remoteCommit = null, tag = null, needTag = true, needReceipt = true }) {
-  const version = versionAt(cwd, commit);
-  if (!version) return [finding('RELEASE_VERSION_UNREADABLE', `package.json at ${commit.slice(0, 9)} has no readable version`, 'restore package.json')];
-  const expected = `v${version}`;
-  const named = tag ?? expected;
-  if (named !== expected) return [finding('RELEASE_TAG_VERSION', `the tag ${named} is not v${version}, the version of ${commit.slice(0, 9)}`, `tag v${version}, or set package.json version to ${named.replace(/^v/, '')}`)];
-  const listed = gitText(gitTag, ['--list', 'v*'], cwd);
-  const released = listed === null ? null : taggedVersions(listed);
-  return [
-    ...versionFindings({ cwd, remoteCommit, version, released: released ?? [] }),
-    ...nextReleaseFindings({ version, released }),
-    ...changelogFindings({ cwd, commit, version, tag: named }),
-    ...(needTag ? tagFindings({ cwd, commit, tag: named }) : []),
-    ...(needReceipt ? receiptFindings({ cwd, commit, tag: named }) : []),
-  ];
-}
+// release-definition.mjs - what makes a commit of the runtime repository a RELEASE commit, the one definition shared by the
+// pre-push hook (scripts/guards/release-push-gate.mjs) and the release cut (scripts/supervisor/release-cut.mjs). The remote
+// main of the runtime moves exactly when a release is cut, so a push of main or of a v* tag is judged against this list:
+//   RELEASE_VERSION_UNCHANGED   package.json `version` at the pushed commit differs from the version at the remote main's head
+//   RELEASE_VERSION_NOT_NEXT    that version is the next release after the highest v* tag (scripts/lib/release-version.mjs, owner ruling release-waves):
+//                               the next wave alpha.N.M+1 of its line or the next line alpha.N+1, never the legacy -fix form
+//   RELEASE_TAG_VERSION         the release tag is v<version> of the pushed commit
+//   RELEASE_CHANGELOG_SECTION   CHANGELOG.md holds `## [<version>] - <date>` (a dated heading) with no unfinished marker (R222)
+//   RELEASE_TAG_MISSING         an ANNOTATED tag v<version> points at the pushed commit
+//   RELEASE_RECEIPT_MISSING     the L4 record of exactly this commit (scripts/guards/release-record.mjs, written by the cut) names this tag
+//   RELEASE_RECEIPT_INCOMPLETE  that record holds a green row for each of RECEIPT_STEPS (the package clean-test, the scaffold e2e and the checks) (RAN on this commit or reused from another with the identical input digest, the record's `reusedFrom` names it; owner ruling speed-flow, 2026-10-25)
+//   RELEASE_SUITE_MODE          the record says `suite: ci` (the Linux parity delegated to CI) while the checked-out config says `local`, or it lists no delegated linux-parity: a record never claims the mode by
+//                               itself (scripts/guards/release-suite-mode.mjs); both modes ask for the same root rows, the runtime has no spec suite to delegate (owner ruling no-runtime-specs)
+// Each finding names what is missing and the command that produces it. Pure over the git reads; no bypass.
+import { catFile } from '../api/git/cat-file.mjs';
+import { revParseQuery } from '../api/git/rev-parse-query.mjs';
+import { show } from '../api/git/show.mjs';
+import { tag as gitTag } from '../api/git/tag.mjs';
+import { mergeBaseQuery } from '../api/git/merge-base-query.mjs';
+import { pathKey, realPath } from '../lib/path-key.mjs';
+import { changelogSection, releaseNotesFindings } from '../hfs/runtime-rules/release-notes.mjs';
+import { nextReleases, releaseVersionRefusal, taggedVersions } from '../lib/release-version.mjs';
+import { readL4Record } from './release-record.mjs';
+import { suiteModeOf } from './release-suite-mode.mjs';
+
+/** The rows the L4 record must hold green, run on the commit or reused from an identical-digest row of another, in either suite mode: the package clean-test, the scaffold e2e and the checks (the runtime's real tests). */
+export const RECEIPT_STEPS = Object.freeze(['npm run test:packages', 'npm run test:e2e', 'npm run check']);
+const CUT_COMMAND = (tag) => `starci release cut --tag ${tag}`;
+const REGEX_SPECIALS = /[.*+?^$()|[\]{}\\]/g;
+const HEADING_HEAD = String.raw`^## \[`;
+const DATED_HEADING_TAIL = String.raw`\] — \d{4}-\d{2}-\d{2}\s*$`;
+const DATED_HEADING = (version) => new RegExp([HEADING_HEAD, version.replaceAll(REGEX_SPECIALS, String.raw`\$&`), DATED_HEADING_TAIL].join(''), 'mu');
+
+const finding = (code, missing, fix) => ({ code, missing, fix });
+const gitText = (verb, args, cwd) => {
+  const r = verb(args, { cwd, timeout: 60_000 });
+  return r.status === 0 ? String(r.stdout ?? '') : null;
+};
+
+/** The package.json version of `commit`, or null when the commit or its manifest cannot be read. */
+export function versionAt(cwd, commit) {
+  const text = gitText(show, [`${commit}:package.json`], cwd);
+  try { return text === null ? null : JSON.parse(text).version ?? null; } catch { return null; }
+}
+
+const releaseUnknown = (why) => ({ ok: false, status: 'unknown', why });
+const ineligibleRelease = (explicit, why) => explicit ? releaseUnknown(why) : { ok: true, candidate: null };
+
+/** A runtime Git root's nearest annotated, manifest-bound release; enclosing application history is inapplicable. */
+export function releaseTagOf({ repo, tag = null, excludeHead = false }) {
+  const history = runtimeGitHistory(repo);
+  if (!history.ok) return history;
+  const listed = tag === null ? gitText(gitTag, ['--merged', 'HEAD', '--list', 'v*'], repo) : tag;
+  if (listed === null) return releaseUnknown('release tags are unreadable');
+  const candidates = [];
+  for (const named of listed.split(/\r?\n/).filter(Boolean)) {
+    const result = releaseCandidate({ repo, named, current: history.head, explicit: tag !== null, excludeHead });
+    if (!result.ok) return result;
+    if (result.candidate) candidates.push(result.candidate);
+  }
+  return nearestRelease(repo, candidates);
+}
+
+/** Runtime history exists only at its own Git top-level with a readable HEAD and full ancestry. */
+function runtimeGitHistory(repo) {
+  const top = revParseQuery(['--show-toplevel'], { cwd: repo });
+  if (top.status !== 0) {
+    if (/not a git repository/i.test(String(top.stderr ?? ''))) return { ok: false, status: 'no-repository', why: 'release history requires a Git repository' };
+    return releaseUnknown('release repository identity is unreadable');
+  }
+  const gitRoot = String(top.stdout ?? '').trim();
+  if (!gitRoot) return releaseUnknown('release repository root is unreadable');
+  if (pathKey(realPath(gitRoot)) !== pathKey(realPath(repo))) return { ok: false, status: 'no-runtime-repository', why: 'the runtime copy is inside an enclosing Git repository; its history belongs to that repository' };
+  const head = gitText(revParseQuery, ['HEAD'], repo)?.trim();
+  if (!head) return releaseUnknown('release history HEAD is unreadable');
+  if (gitText(revParseQuery, ['--is-shallow-repository'], repo)?.trim() !== 'false') return releaseUnknown('release history is shallow or unreadable; fetch complete release history');
+  return { ok: true, head };
+}
+
+/** A candidate binds annotation, peeled commit, manifest spelling and ancestry; default discovery omits ineligible tags. */
+function releaseCandidate({ repo, named, current, explicit, excludeHead }) {
+  const kind = gitText(catFile, ['-t', `refs/tags/${named}`], repo)?.trim();
+  const head = gitText(revParseQuery, [`refs/tags/${named}^{commit}`], repo)?.trim();
+  if (!kind || !head) return releaseUnknown(`release tag ${named} is unreadable`);
+  if (kind !== 'tag') return ineligibleRelease(explicit, `release tag ${named} is not annotated`);
+  const version = versionAt(repo, head);
+  if (!version) return releaseUnknown(`release manifest of ${named} is unreadable`);
+  if (named !== `v${version}`) return ineligibleRelease(explicit, `release tag ${named} differs from its manifest version ${version}`);
+  const reachable = releaseAncestor(repo, head, current);
+  if (reachable === null) return releaseUnknown(`release ancestry of ${named} is unreadable`);
+  if (!reachable) return ineligibleRelease(explicit, `release tag ${named} is not merged in HEAD`);
+  if (excludeHead && head === current) return { ok: true, candidate: null };
+  return { ok: true, candidate: { tag: named, head } };
+}
+
+/** Only one unsuperseded release ancestor proves a boundary; incomparable releases hold. */
+function nearestRelease(repo, candidates) {
+  if (!candidates.length) return releaseUnknown('no eligible annotated, manifest-bound release tag is merged in HEAD');
+  const nearest = [];
+  for (const candidate of candidates) {
+    const superseded = candidateSuperseded(repo, candidate, candidates);
+    if (superseded === null) return releaseUnknown('release ancestry between tags is unreadable');
+    if (!superseded) nearest.push(candidate);
+  }
+  if (nearest.length !== 1) return releaseUnknown(`release history is ambiguous: ${nearest.map((entry) => entry.tag).join(', ')}`);
+  return { ok: true, ...nearest[0] };
+}
+
+/** A release loses its boundary only to a proven descendant release, never to a date or version sort. */
+function candidateSuperseded(repo, candidate, candidates) {
+  for (const other of candidates) {
+    if (candidate.head === other.head) continue;
+    const older = releaseAncestor(repo, candidate.head, other.head);
+    if (older === null) return null;
+    if (older) return true;
+  }
+  return false;
+}
+
+/** Missing Git proof is distinct from a proven non-ancestor. */
+function releaseAncestor(repo, before, after) {
+  const result = mergeBaseQuery(['--is-ancestor', before, after], { cwd: repo });
+  if (result.status === 0) return true;
+  if (result.status === 1) return false;
+  return null;
+}
+
+/** The next releases named from the released versions, for a fix text: "v<wave> or v<line>". */
+const nextNamed = (released, version = null) => {
+  const next = nextReleases(released, version);
+  return next ? `v${next.wave} or v${next.line}` : 'v<new version>';
+};
+
+function versionFindings({ cwd, remoteCommit, version, released }) {
+  if (!remoteCommit) return [];
+  const remoteVersion = versionAt(cwd, remoteCommit);
+  if (remoteVersion === null) return [finding('RELEASE_REMOTE_HEAD_UNKNOWN', `the remote main head ${remoteCommit.slice(0, 9)} is not in this repository, so its version cannot be compared`, 'git fetch origin main')];
+  if (remoteVersion === version) return [finding('RELEASE_VERSION_UNCHANGED', `package.json version ${version} is the version the remote main already carries`, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released, version))}`)];
+  return [];
+}
+
+/** The version must be the next release after the highest v* tag other than its own: a wave alpha.N.M is counted, never guessed. */
+function nextReleaseFindings({ version, released }) {
+  if (released === null) return [finding('RELEASE_VERSION_NOT_NEXT', 'the v* tags are unreadable, so the next release cannot be derived', 'git fetch --tags')];
+  const refusal = releaseVersionRefusal(version, released);
+  return refusal ? [finding('RELEASE_VERSION_NOT_NEXT', refusal, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released.filter((entry) => entry !== version), version))}`)] : [];
+}
+
+function changelogFindings({ cwd, commit, version, tag }) {
+  const changelog = gitText(show, [`${commit}:CHANGELOG.md`], cwd);
+  if (changelog === null) return [finding('RELEASE_CHANGELOG_SECTION', 'CHANGELOG.md is not readable at the pushed commit', 'restore CHANGELOG.md')];
+  const notes = releaseNotesFindings({ tags: [tag], changelog });
+  if (notes.length) return notes.map((n) => finding('RELEASE_CHANGELOG_SECTION', n.message, 'finish the CHANGELOG section of the release (no in-preparation mark, no open marker), commit'));
+  if (!changelogSection(changelog, version).found || !DATED_HEADING(version).test(changelog)) return [finding('RELEASE_CHANGELOG_SECTION', `CHANGELOG.md has no dated heading "## [${version}] — YYYY-MM-DD"`, `date the heading of the ${version} section, commit`)];
+  return [];
+}
+
+function tagFindings({ cwd, commit, tag }) {
+  const kind = gitText(catFile, ['-t', `refs/tags/${tag}`], cwd)?.trim();
+  const target = gitText(revParseQuery, [`refs/tags/${tag}^{commit}`], cwd)?.trim();
+  if (kind === 'tag' && target === commit) return [];
+  return [finding('RELEASE_TAG_MISSING', `no annotated tag ${tag} points at ${commit.slice(0, 9)}`, CUT_COMMAND(tag))];
+}
+
+/** The finding of a record that claims the delegated mode without the checked-out config saying so (or without naming the delegated linux-parity row), else null. */
+function suiteModeFinding({ record, cwd, commit, tag }) {
+  if (record.suite !== 'ci') return null;
+  if (suiteModeOf(cwd) !== 'ci') return finding('RELEASE_SUITE_MODE', `the release record of ${commit.slice(0, 9)} says suite: ci, but this checkout's config.yaml release.suite is not ci: a record does not choose the mode`, `set release.suite: ci in config.yaml (the owner's choice), or ${CUT_COMMAND(tag)} under suite: local`);
+  if (!(record.delegated ?? []).some((row) => row?.name === 'linux-parity')) return finding('RELEASE_SUITE_MODE', `the suite: ci record of ${commit.slice(0, 9)} does not list linux-parity as delegated`, CUT_COMMAND(tag));
+  return null;
+}
+
+function receiptFindings({ cwd, commit, tag }) {
+  const record = readL4Record({ repo: cwd, head: commit, tag });
+  if (!record) return [finding('RELEASE_RECEIPT_MISSING', `no release record for exactly ${commit.slice(0, 9)} and ${tag}: the package clean-test, the scaffold e2e and the check did not run green on this commit`, CUT_COMMAND(tag))];
+  const mode = suiteModeFinding({ record, cwd, commit, tag });
+  if (mode) return [mode];
+  // A row reused from another commit (reusedFrom) counts: the cut reuses a row only when its input digest is identical (owner ruling speed-flow, 2026-10-25), and the record names the commit it came from.
+  const green = new Set((record.logs ?? []).filter((row) => row?.ok === true).map((row) => row.name));
+  const absent = RECEIPT_STEPS.filter((name) => !green.has(name));
+  return absent.length ? [finding('RELEASE_RECEIPT_INCOMPLETE', `the release record of ${commit.slice(0, 9)} has no green row for: ${absent.join(', ')}`, CUT_COMMAND(tag))] : [];
+}
+
+/**
+ * The findings that keep `commit` from being a release commit of the repository at `cwd`: [{code, missing, fix}], [] when it is one.
+ * `remoteCommit` is the remote main's head being replaced (null for a tag push or a first push); `tag` the release tag (default v<version>);
+ * `needTag` / `needReceipt` are false only for the cut's early look, before it has created the tag and run the suite.
+ */
+export function releaseFindings({ cwd, commit, remoteCommit = null, tag = null, needTag = true, needReceipt = true }) {
+  const version = versionAt(cwd, commit);
+  if (!version) return [finding('RELEASE_VERSION_UNREADABLE', `package.json at ${commit.slice(0, 9)} has no readable version`, 'restore package.json')];
+  const expected = `v${version}`;
+  const named = tag ?? expected;
+  if (named !== expected) return [finding('RELEASE_TAG_VERSION', `the tag ${named} is not v${version}, the version of ${commit.slice(0, 9)}`, `tag v${version}, or set package.json version to ${named.replace(/^v/, '')}`)];
+  const listed = gitText(gitTag, ['--list', 'v*'], cwd);
+  const released = listed === null ? null : taggedVersions(listed);
+  return [
+    ...versionFindings({ cwd, remoteCommit, version, released: released ?? [] }),
+    ...nextReleaseFindings({ version, released }),
+    ...changelogFindings({ cwd, commit, version, tag: named }),
+    ...(needTag ? tagFindings({ cwd, commit, tag: named }) : []),
+    ...(needReceipt ? receiptFindings({ cwd, commit, tag: named }) : []),
+  ];
+}

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -73,6 +73,18 @@ function extraPackageProblems(side, entries) {
   return [];
 }
 
+/** `sides.be.queueOutbox`: the app's own queue outbox ({table, enqueue, queueParameter}), which a pg_cron tick may enqueue through (R258); it needs the redis backing the relay hands rows to. */
+function queueOutboxProblems(side, value) {
+  const declared = value.queueOutbox;
+  if (declared === undefined) return [];
+  if (side !== 'be') return ['queueOutbox belongs to the be side'];
+  const name = (item) => typeof item === 'string' && /^[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*$/.test(item);
+  const bad = [];
+  if (!isPlainObject(declared) || Object.keys(declared).sort().join() !== 'enqueue,queueParameter,table' || !name(declared.table) || !name(declared.enqueue) || !/^[a-z_][a-z0-9_]*$/.test(String(declared.queueParameter))) bad.push('sides.be.queueOutbox must be {table: <schema>.<table>, enqueue: <schema>.<function>, queueParameter: <parameter name>}');
+  if (!(value.backing ?? []).includes('redis')) bad.push('sides.be.queueOutbox needs sides.be.backing to declare redis, which the relay hands its rows to');
+  return bad;
+}
+
 function grammarProblems(side, grammar) {
   if (grammar === undefined) return [];
   if (side !== 'fe') return ['grammar belongs to the fe side'];
@@ -83,7 +95,7 @@ function declarationSideProblems(side, value, names) {
   const bad = [];
   const at = `sides.${side}`;
   if (!isPlainObject(value)) return [`${at} must be an object`];
-  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages', 'grammar', 'backing', 'queueOutbox'].includes(key)) bad.push(`${at} has unknown key ${key}`);
   bad.push(...appShapeProblems(value.apps, at, side, names));
   if (isBadUniqueList(value.optionalSlots, (slot) => SLOT_ID.test(String(slot)))) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
   if (value.backing !== undefined && side !== 'be') bad.push('backing belongs to the be side');
@@ -91,7 +103,7 @@ function declarationSideProblems(side, value, names) {
   bad.push(...patternShapeProblems(value, at, NAME), ...kindShapeProblems(value, at, NAME));
   if (isBadUniqueList(value.reads, (read) => typeof read === 'string' && read.length > 0)) bad.push(`${at}.reads must be a unique list of paths`);
   if (value.connections !== undefined) bad.push(...connectionProblems(side, value));
-  bad.push(...extraPackageProblems(side, value.extraPackages), ...grammarProblems(side, value.grammar));
+  bad.push(...extraPackageProblems(side, value.extraPackages), ...grammarProblems(side, value.grammar), ...queueOutboxProblems(side, value));
   return bad;
 }
 

package/runtime/scripts/hfs/rules/database-queue-outbox.mjs

@@ -0,0 +1,102 @@
+// R258: an app whose queue is BullMQ on a declared Redis may keep its own outbox beside the canon `ruleParams.db.queueOutbox` table. The
+// app declares it in hfs.json `sides.be.queueOutbox` ({table, enqueue, queueParameter}), and a pg_cron tick enqueues through the declared
+// `enqueue` function only while that function's active definition does nothing but write the declared table with its queue column bound
+// to the declared parameter. The checker reads the declaration and the function body; it names no app table or function.
+import pg from 'libpg-query';
+import { sqlStringParts as strings, walkSqlAst as walk, sqlParser } from '../../lib/sql-ast.mjs';
+
+await pg.loadModule();
+
+const sqlTree = sqlParser(pg);
+const STATEMENTS = new Set(['PLpgSQL_stmt_block', 'PLpgSQL_stmt_execsql', 'PLpgSQL_stmt_if', 'PLpgSQL_stmt_assign', 'PLpgSQL_stmt_return']);
+const OTHER_DML = ['UpdateStmt', 'DeleteStmt', 'MergeStmt'];
+const qualified = (name) => name.includes('.') ? name : `public.${name}`;
+
+/** The outbox an app declares, or null: it counts only while the back end declares the redis backing the relay hands rows to. */
+export function queueOutboxDeclaration(declaration) {
+  const be = declaration?.sides?.be;
+  const declared = be?.queueOutbox;
+  if (!declared || !(be.backing ?? []).includes('redis')) return null;
+  return { table: qualified(declared.table), enqueue: qualified(declared.enqueue), parameter: declared.queueParameter };
+}
+
+function plpgsqlStatements(fn, body) {
+  const parameters = (fn.parameters ?? []).map((item) => item.FunctionParameter?.name).filter(Boolean).map((name) => `"${name.replaceAll('"', '""')}" text`).join(',');
+  let tag = '$hfs_outbox$';
+  while (body.includes(tag)) tag = `${tag.slice(0, -1)}_$`;
+  let tree;
+  try { tree = pg.parsePlPgSQLSync(`create function hfs_probe(${parameters}) returns text language plpgsql as ${tag}${body}${tag};`); } catch { return null; }
+  const trees = [];
+  let safe = true;
+  walk(tree, (node) => {
+    for (const key of Object.keys(node)) if (key.startsWith('PLpgSQL_stmt_') && !STATEMENTS.has(key)) safe = false;
+    const expr = node.PLpgSQL_expr;
+    if (expr) trees.push(sqlTree(expr.parseMode === 0 ? expr.query : `select ${expr.query}`));
+  });
+  return safe ? trees : null;
+}
+
+function bodyStatements(fn) {
+  const option = (name) => (fn.options ?? []).find((item) => item.DefElem?.defname === name)?.DefElem?.arg;
+  const language = option('language')?.String?.sval ?? 'sql';
+  const body = strings(option('as')?.List?.items).join('');
+  if (language === 'plpgsql') return plpgsqlStatements(fn, body);
+  if (language !== 'sql') return null;
+  if (fn.sql_body) return (fn.sql_body.List ? fn.sql_body.List.items : [fn.sql_body]).map((stmt) => ({ stmts: [{ stmt }] }));
+  return sqlTree(body)?.stmts?.map((entry) => ({ stmts: [entry] })) ?? null;
+}
+
+/** True when the nodes hold no sub-select or other statement and call only functions `pureCall` admits. */
+function pureNodes(nodes, pureCall) {
+  let ok = true;
+  walk(nodes, (node) => {
+    if (node.SubLink || node.SelectStmt || node.InsertStmt || OTHER_DML.some((key) => node[key])) ok = false;
+    if (node.FuncCall && !pureCall(node.FuncCall)) ok = false;
+  });
+  return ok;
+}
+
+/** `insert into <table> (..., queue, ...) values (..., <parameter>, ...) [on conflict .. do nothing] [returning ..]` with pure other values. */
+function insertOk(declared, insert, pureCall) {
+  if (insert.withClause || `${insert.relation?.schemaname || 'public'}.${insert.relation?.relname}` !== declared.table) return false;
+  if (insert.onConflictClause && insert.onConflictClause.action !== 'ONCONFLICT_NOTHING') return false;
+  const columns = (insert.cols ?? []).map((item) => item.ResTarget?.name);
+  const rows = insert.selectStmt?.SelectStmt?.valuesLists ?? [];
+  const values = rows.length === 1 ? rows[0].List?.items ?? [] : [];
+  const at = columns.indexOf('queue');
+  if (at < 0 || new Set(columns).size !== columns.length || values.length !== columns.length) return false;
+  const bound = values[at].ColumnRef?.fields;
+  if (!bound || strings(bound).join('.') !== declared.parameter || bound.length !== 1) return false;
+  return pureNodes(values.filter((_, index) => index !== at), pureCall);
+}
+
+/** A read of the declared table with pure expressions, or an expression over variables alone. */
+function readOk(declared, tree, pureCall) {
+  let ok = true;
+  walk(tree, (node) => {
+    if (OTHER_DML.some((key) => node[key]) || node.InsertStmt || node.SelectStmt?.intoClause) ok = false;
+    if (node.FuncCall && !pureCall(node.FuncCall)) ok = false;
+    if (node.RangeVar && `${node.RangeVar.schemaname || 'public'}.${node.RangeVar.relname}` !== declared.table) ok = false;
+  });
+  return ok;
+}
+
+function statementOk(declared, tree, pureCall) {
+  const stmt = tree?.stmts?.length === 1 ? tree.stmts[0].stmt : null;
+  if (stmt?.InsertStmt) return insertOk(declared, stmt.InsertStmt, pureCall);
+  return Boolean(stmt?.SelectStmt) && readOk(declared, tree, pureCall);
+}
+
+/**
+ * The position of the queue parameter when the active definition of the declared enqueue function only writes the declared outbox
+ * (inserts, reads of that table and pure expressions), or -1. `pureCall` admits a function call that does no work.
+ */
+export function outboxEnqueueQueueIndex(declared, entry, pureCall) {
+  const fn = entry?.node;
+  if (!fn) return -1;
+  const index = (fn.parameters ?? []).findIndex((item) => item.FunctionParameter?.name === declared.parameter);
+  const trees = bodyStatements(fn);
+  if (index < 0 || !trees?.length || !trees.every((tree) => statementOk(declared, tree, pureCall))) return -1;
+  const inserts = trees.filter((tree) => tree?.stmts?.[0]?.stmt?.InsertStmt).length;
+  return inserts === 1 ? index : -1;
+}

package/runtime/scripts/hfs/rules/database-queues.mjs

@@ -11,10 +11,11 @@ import { queueSourceFacts, queueSchedulers, queueProblem as problem } from './da
 import { readJson, readText } from './read.mjs';
 import { DB_CRON_OWNED, DB_PGMQ_DECLARED, isActiveMigration } from './database-constants.mjs';
 import { loadSlotManifest } from '../slots.mjs';
+import { queueOutboxDeclaration, outboxEnqueueQueueIndex } from './database-queue-outbox.mjs';
 
 await pg.loadModule();
 
-const PURE_CALLS = new Set(['jsonb_build_object', 'json_build_object', 'jsonb_build_array', 'json_build_array', 'to_jsonb', 'now', 'clock_timestamp']);
+const PURE_CALLS = new Set(['jsonb_build_object', 'json_build_object', 'jsonb_build_array', 'json_build_array', 'to_jsonb', 'now', 'clock_timestamp', 'date_trunc']);
 const TABLE_PRIVILEGES = ['select', 'insert', 'update', 'delete', 'truncate', 'references', 'trigger', 'maintain'];
 const sqlName = (nodes) => strings(nodes).join('.');
 const callName = (call) => sqlName(call.funcname);
@@ -54,9 +55,11 @@ function inspectQueueCall(state, call, file, migration) {
 }
 
 function recordSchedule(state, call, file) {
-  const entry = { call, file, created: new Map(state.created), functions: new Map(state.functions) };
-  state.schedules.push(entry);
   const job = sqlLiteral(argument(call, 0, ['job_name']));
+  // The names scheduled and not unscheduled since, in migration order: a name is a duplicate only while it is still scheduled.
+  const entry = { call, file, created: new Map(state.created), functions: new Map(state.functions), active: new Set(state.scheduledNames) };
+  state.schedules.push(entry);
+  if (job !== null) state.scheduledNames.add(job);
   const schedule = sqlLiteral(argument(call, 1, ['schedule']));
   const command = sqlLiteral(argument(call, 2, ['command']));
   if (job !== null && schedule !== null && command !== null) {
@@ -77,6 +80,7 @@ function inspectCronCall(state, call, file, migration) {
   if (job !== null) {
     state.unschedules.push({ name: job, file });
     state.activeCron.delete(job);
+    state.scheduledNames.delete(job);
     state.liveSchedules.delete(job);
   }
   else problem(state, DB_CRON_OWNED, file, 'cron.unschedule must identify the migration-owned job by literal name');
@@ -205,12 +209,16 @@ function enqueue(state, call) {
   return queue !== null && state.created.has(queue) && safe ? queue : null;
 }
 
+function pureCall(call) {
+  return uuidConstructor(call) || PURE_CALLS.has(callName(call).replace(/^pg_catalog\./, ''));
+}
+
 function pureArguments(call) {
   return pureExpressions(call.args);
 }
 
 function pureExpressions(nodes) {
-  let safe = callsOf(nodes).every((nested) => uuidConstructor(nested) || PURE_CALLS.has(callName(nested).replace(/^pg_catalog\./, '')));
+  let safe = callsOf(nodes).every(pureCall);
   walk(nodes, (node) => {
     if (['SubLink', 'SelectStmt', 'InsertStmt', 'UpdateStmt', 'DeleteStmt', 'MergeStmt'].some((key) => node[key])) safe = false;
   });
@@ -223,6 +231,15 @@ function queueOutbox(manifest) {
   return declared ? { table: declared.table, columns: new Set(declared.columns) } : null;
 }
 
+/** The queue constant a call of the app's declared outbox enqueue function enqueues (hfs.json sides.be.queueOutbox), or null. */
+function declaredEnqueue(state, call) {
+  const declared = state.declaredOutbox;
+  if (!declared || qualified(callName(call)) !== declared.enqueue) return null;
+  const index = outboxEnqueueQueueIndex(declared, state.functions.get(declared.enqueue), pureCall);
+  const queue = index < 0 ? null : sqlLiteral(argument(call, index, [declared.parameter]));
+  return queue !== null && state.constants.has(queue) && pureArguments(call) ? queue : null;
+}
+
 /** The queue constant one outbox row enqueues: `insert into <outbox> (queue, ...) values ('<queue constant>', ...)` with pure values. */
 function outboxEnqueue(state, insert) {
   if (!state.outbox || insert.returningClause || insert.returningList || insert.onConflictClause || insert.withClause) return null;
@@ -242,7 +259,8 @@ function singleEnqueue(state, tree, legacy) {
   const insert = tree?.stmts?.length === 1 ? tree.stmts[0].stmt?.InsertStmt : undefined;
   if (insert) return outboxEnqueue(state, insert);
   const call = singleCall(tree);
-  return legacy && call ? enqueue(state, call) : null;
+  if (!call) return null;
+  return declaredEnqueue(state, call) ?? (legacy ? enqueue(state, call) : null);
 }
 
 /** PostgreSQL's catalog-owned scalar UUID constructor adds an envelope identity without doing work in the tick. */
@@ -311,7 +329,7 @@ function scheduleTarget(state, command, legacy) {
   const tree = sqlTree(command);
   const target = singleCall(tree);
   if (!target) return { tick: null, queues: singleEnqueue(state, tree, legacy) };
-  if (!callName(target).endsWith('_tick')) return { tick: null, queues: legacy ? enqueue(state, target) : null };
+  if (!callName(target).endsWith('_tick')) return { tick: null, queues: declaredEnqueue(state, target) ?? (legacy ? enqueue(state, target) : null) };
   const tick = qualified(callName(target));
   const fn = state.functions.get(tick);
   const queues = fn && pureArguments(target) && tickQueues(state, fn, legacy);
@@ -325,7 +343,7 @@ function tickRemoval(state, tick, name) {
   }
 }
 
-function scheduleCheck(state, schedule, names, schedulers, ticks) {
+function scheduleCheck(state, schedule, schedulers, ticks) {
   const { call, file } = schedule;
   const name = sqlLiteral(argument(call, 0, ['job_name']));
   const command = sqlLiteral(argument(call, 2, ['command']));
@@ -333,22 +351,23 @@ function scheduleCheck(state, schedule, names, schedulers, ticks) {
     problem(state, DB_CRON_OWNED, file, 'cron.schedule requires literal job name, cadence and command for migration ownership');
     return;
   }
-  if (names.has(name)) problem(state, DB_CRON_OWNED, file, 'cron job names must be unique across active migrations');
-  names.add(name);
+  if (schedule.active.has(name)) problem(state, DB_CRON_OWNED, file, 'a cron job name is scheduled once while it is active: cron.unschedule it before a later migration schedules it again');
   const historical = { ...state, created: schedule.created, functions: schedule.functions };
   const { tick, queues } = scheduleTarget(historical, command, true);
   if (!queues) problem(state, DB_CRON_OWNED, file, 'a cron command inserts one row of a queue constant into the queue outbox, directly or through one existing *_tick function that only does that; business DML, dynamic SQL and network calls are refused');
   if (state.liveSchedules.get(name) === schedule && !scheduleTarget(state, command, false).queues) problem(state, DB_CRON_OWNED, file, 'the live cron job must insert one outbox row of a queue constant (ruling:R212/case-10): it targets a missing queue or tick, still enqueues with pgmq.send, or its current tick no longer only does that');
-  tickOwner(state, tick, file, ticks);
+  tickOwner(state, tick, name, schedule, ticks);
   const owners = [name, ...(tick ? [tick, tick.split('.').at(-1)] : []), ...[queues ?? []].flat()];
   if (owners.some((owner) => schedulers.has(owner))) problem(state, DB_CRON_OWNED, file, 'the tick is also declared in an application scheduler list; give it one owner');
   tickRemoval(state, tick, name);
 }
 
-function tickOwner(state, tick, file, ticks) {
+/** One tick function has one cron owner at a time: an earlier job of the tick that is still scheduled is a second owner. */
+function tickOwner(state, tick, name, schedule, ticks) {
   if (!tick) return;
-  if (ticks.has(tick)) problem(state, DB_CRON_OWNED, file, 'a tick function has more than one cron owner');
-  ticks.add(tick);
+  const owners = ticks.get(tick) ?? [];
+  if (owners.some((owner) => schedule.active.has(owner))) problem(state, DB_CRON_OWNED, schedule.file, 'a tick function has more than one cron owner');
+  ticks.set(tick, [...owners, name]);
 }
 
 function queueState({ repoRoot, files = [], all = files, repo = {}, manifest }) {
@@ -356,7 +375,7 @@ function queueState({ repoRoot, files = [], all = files, repo = {}, manifest })
   const declaration = readJson(repoRoot, 'hfs.json') ?? repo;
   const connected = ['be', 'fe'].some((side) => (declaration.sides?.[side]?.connections ?? []).some((item) => item.provider === 'supabase'));
   if (repo.edition !== 'lite' && declaration.edition !== 'lite' && !declaration.supabase && !connected && !paths.some((file) => file.startsWith('supabase/'))) return null;
-  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
+  const state = { repoRoot, appRole: declaration.supabase?.appRole ?? 'app_be', findings: [], outbox: queueOutbox(manifest ?? loadSlotManifest()), declaredOutbox: queueOutboxDeclaration(declaration), scheduledNames: new Set(), constants: new Map(), topics: new Map(), created: new Map(), functions: new Map(), schedules: [], activeCron: new Map(), liveSchedules: new Map(), unschedules: [], drops: [], grants: [], queueAcls: new Map() };
   state.sources = queueSourceFacts(state, paths, inspectCalls);
   migrationFacts(state, paths);
   return state;
@@ -369,10 +388,9 @@ function validateQueues(state, inScope) {
   }
   for (const [topic, file] of state.topics) if (!state.created.has(topic)) problem(state, DB_PGMQ_DECLARED, file, `event-bus topic queue ${topic} has no pgmq.create in an active migration`);
   for (const { node, file, created, executed } of state.grants) grantCheck({ ...state, created: executed ? created : state.created }, node, file);
-  const names = new Set();
-  const ticks = new Set();
+  const ticks = new Map();
   const schedulers = queueSchedulers(state.sources);
-  for (const schedule of state.schedules) scheduleCheck(state, schedule, names, schedulers, ticks);
+  for (const schedule of state.schedules) scheduleCheck(state, schedule, schedulers, ticks);
   return state.findings.filter((finding) => inScope(finding.path));
 }
 

package/runtime/scripts/lib/release-version.mjs

@@ -1,119 +1,134 @@
-// release-version.mjs - the one reading of a release version (owner ruling release-waves). A prerelease `<label>.N` opens the release
-// line N and `<label>.N.M` is the M-th release after it, a wave or a fix alike, so alpha.31 < alpha.31.1 < alpha.31.2 < alpha.32 in
-// SemVer order. The next release is derived from the highest one already released, never guessed. The legacy `<label>.N-fix.K` still
-// reads as release K after `<label>.N` and is never produced again. Pure: the callers read the tags and the registry.
-
-const NUMERIC = /^(?:0|[1-9]\d*)$/;
-const POSITIVE = /^[1-9]\d*$/;
-const IDENTIFIERS = /^[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*$/;
-const LEGACY_FIX = '-fix.';
-
-/** {base, wave, legacy}: the release a version counts its waves from, and its wave M (0 for the release that opens the line). */
-export function waveOf(version) {
-  const text = String(version ?? '').split('+')[0];
-  const fix = text.lastIndexOf(LEGACY_FIX);
-  const legacyWave = fix > 0 ? text.slice(fix + LEGACY_FIX.length) : '';
-  if (POSITIVE.test(legacyWave)) return { base: text.slice(0, fix), wave: Number(legacyWave), legacy: true };
-  const ids = text.split('.');
-  const counted = ids.length > 3 && POSITIVE.test(ids.at(-1)) && (text.includes('-') ? NUMERIC.test(ids.at(-2)) : ids.length === 4);
-  return counted ? { base: ids.slice(0, -1).join('.'), wave: Number(ids.at(-1)), legacy: false } : { base: text, wave: 0, legacy: false };
-}
-
-/** Parsed SemVer identifiers {core, pre} of `version`; an unreadable version throws. */
-export function versionParts(version) {
-  const parts = typeof version === 'string' ? version.split('+') : [];
-  if (!parts.length || parts.length > 2 || (parts.length === 2 && !IDENTIFIERS.test(parts[1]))) throw new Error(`unreadable release version ${version}`);
-  const boundary = parts[0].indexOf('-');
-  const core = (boundary < 0 ? parts[0] : parts[0].slice(0, boundary)).split('.');
-  const prerelease = boundary < 0 ? null : parts[0].slice(boundary + 1);
-  if (core.length !== 3 || core.some((part) => !NUMERIC.test(part)) || (prerelease !== null && !IDENTIFIERS.test(prerelease))) throw new Error(`unreadable release version ${version}`);
-  const pre = prerelease?.split('.') ?? [];
-  if (pre.some((part) => /^0\d+$/.test(part))) throw new Error(`invalid numeric prerelease identifier in ${version}`);
-  return { core: core.map(BigInt), pre };
-}
-
-const readable = (version) => {
-  try {
-    versionParts(version);
-    return true;
-  } catch {
-    return false;
-  }
-};
-
-/** The SemVer spelling a version is ordered by: a legacy `-fix.K` orders as wave K of its line. */
-const ordered = (version) => {
-  const { base, wave, legacy } = waveOf(version);
-  return legacy ? `${base}.${wave}` : version;
-};
-
-const compareIdentifier = (a, b) => {
-  const numericA = /^\d+$/.test(a), numericB = /^\d+$/.test(b);
-  if (numericA && numericB) return BigInt(a) < BigInt(b) ? -1 : Number(BigInt(a) > BigInt(b));
-  if (numericA !== numericB) return numericA ? -1 : 1;
-  return a < b ? -1 : Number(a > b);
-};
-
-/** SemVer precedence, numeric prerelease identifiers included; build metadata has no precedence. */
-export function compareVersions(a, b) {
-  const left = versionParts(ordered(a)), right = versionParts(ordered(b));
-  for (const i of left.core.keys()) {
-    if (left.core[i] !== right.core[i]) return left.core[i] < right.core[i] ? -1 : 1;
-  }
-  if (!left.pre.length || !right.pre.length) return Number(!left.pre.length) - Number(!right.pre.length);
-  for (let i = 0; i < Math.max(left.pre.length, right.pre.length); i += 1) {
-    if (left.pre[i] === undefined) return -1;
-    if (right.pre[i] === undefined) return 1;
-    const compared = compareIdentifier(left.pre[i], right.pre[i]);
-    if (compared) return compared;
-  }
-  return 0;
-}
-
-/** The release line of `version`: a prerelease's core and the identifiers before its first number (every alpha.N and alpha.N.M share one), a stable release's major and minor. */
-export function releaseLine(version) {
-  const { core, pre } = versionParts(ordered(version));
-  if (!pre.length) return `${core.slice(0, 2).join('.')}-stable`;
-  const first = pre.findIndex((id) => /^\d+$/.test(id));
-  return `${core.join('.')}-${(first < 0 ? pre : pre.slice(0, first)).join('.')}`;
-}
-
-/** {family, line} of a release that opens a line (`<x.y.z>-<label>.N`), or null for any other shape. */
-function lineStart(base) {
-  if (!readable(base)) return null;
-  const { core, pre } = versionParts(base);
-  return pre.length === 2 && !/^\d+$/.test(pre[0]) && NUMERIC.test(pre[1]) ? { family: `${core.join('.')}-${pre[0]}`, line: Number(pre[1]) } : null;
-}
-
-/** The next wave after `version`: its base with M one past the highest wave of that base among `version` and `known`. */
-export function nextWave(version, known = []) {
-  const { base } = waveOf(version);
-  const waves = [version, ...known].map(waveOf).filter((entry) => entry.base === base).map((entry) => entry.wave);
-  return `${base}.${Math.max(0, ...waves) + 1}`;
-}
-
-/** What may follow the highest line-shaped release of `versions`: {highest, family, wave, line}, or null when none has that shape. */
-export function nextReleases(versions) {
-  const shaped = versions.filter((version) => readable(version) && lineStart(waveOf(version).base));
-  if (!shaped.length) return null;
-  const highest = shaped.reduce((top, version) => (compareVersions(version, top) > 0 ? version : top));
-  const { family, line } = lineStart(waveOf(highest).base);
-  return { highest, family, wave: nextWave(highest, shaped), line: `${family}.${line + 1}` };
-}
-
-/**
- * Why `version` cannot be released after `released` (the versions already tagged), or null when it can: the next wave of the highest
- * release, the first release of the next line, or a later release of another label or core. The legacy `-fix` form is always refused.
- */
-export function releaseVersionRefusal(version, released) {
-  const next = nextReleases(released.filter((entry) => entry !== version));
-  const named = next ? `; the next release is ${next.wave} (the next wave or fix after ${next.highest}) or ${next.line} (the next line)` : '';
-  if (waveOf(version).legacy) return `${version} is the legacy -fix form, which is read and never released again${named}`;
-  if (!next || version === next.wave || version === next.line) return null;
-  if (!readable(version)) return `${version} is not a SemVer version${named}`;
-  if (lineStart(waveOf(version).base)?.family !== next.family && compareVersions(version, next.highest) > 0) return null;
-  return `${version} does not follow ${next.highest}${named}`;
-}
-
-/** The versions of the release tags `v<version>` in the output of `git tag --list`. */
-export const taggedVersions = (listing) => String(listing ?? '').split(/\r?\n/).map((name) => name.trim()).filter((name) => /^v\d/.test(name)).map((name) => name.slice(1));
+// release-version.mjs - the one reading of a release version (owner ruling release-waves). A prerelease `<label>.N` opens the release
+// line N and `<label>.N.M` is the M-th release after it, a wave or a fix alike, so alpha.31 < alpha.31.1 < alpha.31.2 < alpha.32 in
+// SemVer order. The next release is derived from the highest one already released, never guessed. The legacy `<label>.N-fix.K` still
+// reads as release K after `<label>.N` and is never produced again. Pure: the callers read the tags and the registry.
+
+const NUMERIC = /^(?:0|[1-9]\d*)$/;
+const POSITIVE = /^[1-9]\d*$/;
+const IDENTIFIERS = /^[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*$/;
+const LEGACY_FIX = '-fix.';
+
+/** {base, wave, legacy}: the release a version counts its waves from, and its wave M (0 for the release that opens the line). */
+export function waveOf(version) {
+  const text = String(version ?? '').split('+')[0];
+  const fix = text.lastIndexOf(LEGACY_FIX);
+  const legacyWave = fix > 0 ? text.slice(fix + LEGACY_FIX.length) : '';
+  if (POSITIVE.test(legacyWave)) return { base: text.slice(0, fix), wave: Number(legacyWave), legacy: true };
+  const ids = text.split('.');
+  const counted = ids.length > 3 && POSITIVE.test(ids.at(-1)) && (text.includes('-') ? NUMERIC.test(ids.at(-2)) : ids.length === 4);
+  return counted ? { base: ids.slice(0, -1).join('.'), wave: Number(ids.at(-1)), legacy: false } : { base: text, wave: 0, legacy: false };
+}
+
+/** Parsed SemVer identifiers {core, pre} of `version`; an unreadable version throws. */
+export function versionParts(version) {
+  const parts = typeof version === 'string' ? version.split('+') : [];
+  if (!parts.length || parts.length > 2 || (parts.length === 2 && !IDENTIFIERS.test(parts[1]))) throw new Error(`unreadable release version ${version}`);
+  const boundary = parts[0].indexOf('-');
+  const core = (boundary < 0 ? parts[0] : parts[0].slice(0, boundary)).split('.');
+  const prerelease = boundary < 0 ? null : parts[0].slice(boundary + 1);
+  if (core.length !== 3 || core.some((part) => !NUMERIC.test(part)) || (prerelease !== null && !IDENTIFIERS.test(prerelease))) throw new Error(`unreadable release version ${version}`);
+  const pre = prerelease?.split('.') ?? [];
+  if (pre.some((part) => /^0\d+$/.test(part))) throw new Error(`invalid numeric prerelease identifier in ${version}`);
+  return { core: core.map(BigInt), pre };
+}
+
+const readable = (version) => {
+  try {
+    versionParts(version);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+/** The SemVer spelling a version is ordered by: a legacy `-fix.K` orders as wave K of its line. */
+const ordered = (version) => {
+  const { base, wave, legacy } = waveOf(version);
+  return legacy ? `${base}.${wave}` : version;
+};
+
+const compareIdentifier = (a, b) => {
+  const numericA = /^\d+$/.test(a), numericB = /^\d+$/.test(b);
+  if (numericA && numericB) return BigInt(a) < BigInt(b) ? -1 : Number(BigInt(a) > BigInt(b));
+  if (numericA !== numericB) return numericA ? -1 : 1;
+  return a < b ? -1 : Number(a > b);
+};
+
+/** SemVer precedence, numeric prerelease identifiers included; build metadata has no precedence. */
+export function compareVersions(a, b) {
+  const left = versionParts(ordered(a)), right = versionParts(ordered(b));
+  for (const i of left.core.keys()) {
+    if (left.core[i] !== right.core[i]) return left.core[i] < right.core[i] ? -1 : 1;
+  }
+  if (!left.pre.length || !right.pre.length) return Number(!left.pre.length) - Number(!right.pre.length);
+  for (let i = 0; i < Math.max(left.pre.length, right.pre.length); i += 1) {
+    if (left.pre[i] === undefined) return -1;
+    if (right.pre[i] === undefined) return 1;
+    const compared = compareIdentifier(left.pre[i], right.pre[i]);
+    if (compared) return compared;
+  }
+  return 0;
+}
+
+/** The release line of `version`: a prerelease's core and the identifiers before its first number (every alpha.N and alpha.N.M share one), a stable release's major and minor. */
+export function releaseLine(version) {
+  const { core, pre } = versionParts(ordered(version));
+  if (!pre.length) return `${core.slice(0, 2).join('.')}-stable`;
+  const first = pre.findIndex((id) => /^\d+$/.test(id));
+  return `${core.join('.')}-${(first < 0 ? pre : pre.slice(0, first)).join('.')}`;
+}
+
+/** {family, line} of a release that opens a line (`<x.y.z>-<label>.N`), or null for any other shape. */
+function lineStart(base) {
+  if (!readable(base)) return null;
+  const { core, pre } = versionParts(base);
+  return pre.length === 2 && !/^\d+$/.test(pre[0]) && NUMERIC.test(pre[1]) ? { family: `${core.join('.')}-${pre[0]}`, line: Number(pre[1]) } : null;
+}
+
+/** The next wave after `version`: its base with M one past the highest wave of that base among `version` and `known`. */
+export function nextWave(version, known = []) {
+  const { base } = waveOf(version);
+  const waves = [version, ...known].map(waveOf).filter((entry) => entry.base === base).map((entry) => entry.wave);
+  return `${base}.${Math.max(0, ...waves) + 1}`;
+}
+
+/** The family of a version: its core and label up to `-<label>` (`1.0.0-alpha`), or null for a stable or unlabelled version. */
+export function familyOf(version) {
+  if (!readable(version)) return null;
+  const { core, pre } = versionParts(ordered(version));
+  return pre.length && !/^\d+$/.test(pre[0]) ? `${core.join('.')}-${pre[0]}` : null;
+}
+
+/**
+ * What may follow the highest line-shaped release of `versions`: {highest, family, wave, line}, or null when none has that shape.
+ * With a `candidate`, a family that already has released tags is judged alone (another family's tags, such as legacy 2.0.1-alpha.N,
+ * never outrank the candidate's own line); a family without a tag falls back to the highest release overall.
+ */
+export function nextReleases(versions, candidate = null) {
+  const shaped = versions.filter((version) => readable(version) && lineStart(waveOf(version).base));
+  const family = candidate === null ? null : familyOf(candidate);
+  const own = family === null ? [] : shaped.filter((version) => lineStart(waveOf(version).base).family === family);
+  const pool = own.length ? own : shaped;
+  if (!pool.length) return null;
+  const highest = pool.reduce((top, version) => (compareVersions(version, top) > 0 ? version : top));
+  const start = lineStart(waveOf(highest).base);
+  return { highest, family: start.family, wave: nextWave(highest, pool), line: `${start.family}.${start.line + 1}` };
+}
+
+/**
+ * Why `version` cannot be released after `released` (the versions already tagged), or null when it can: the next wave of the highest
+ * release of its own family, the first release of the next line, or (when its family has no tag) a later release of another label or
+ * core than the highest. The legacy `-fix` form is always refused.
+ */
+export function releaseVersionRefusal(version, released) {
+  const next = nextReleases(released.filter((entry) => entry !== version), version);
+  const named = next ? `; the next release is ${next.wave} (the next wave or fix after ${next.highest}) or ${next.line} (the next line)` : '';
+  if (waveOf(version).legacy) return `${version} is the legacy -fix form, which is read and never released again${named}`;
+  if (!next || version === next.wave || version === next.line) return null;
+  if (!readable(version)) return `${version} is not a SemVer version${named}`;
+  if (lineStart(waveOf(version).base)?.family !== next.family && compareVersions(version, next.highest) > 0) return null;
+  return `${version} does not follow ${next.highest}${named}`;
+}
+
+/** The versions of the release tags `v<version>` in the output of `git tag --list`. */
+export const taggedVersions = (listing) => String(listing ?? '').split(/\r?\n/).map((name) => name.trim()).filter((name) => /^v\d/.test(name)).map((name) => name.slice(1));

package/scaffold/add-queue-lite.mjs

@@ -65,9 +65,11 @@ const DATABASE_ERROR = 'be/src/modules/platform/database/errors/database.error.t
 /** Skeleton files the lite starter leaves out and the queue capabilities use, each from its skeleton template. */
 const SKELETON_FILES = Object.freeze([
   ['be/src/modules/platform/database/database.sql.ts', 'skeleton-lite/src/modules/platform/database/database.sql.ts'],
+  ['be/src/modules/platform/primitives/sequence.policy.ts', 'skeleton/src/modules/platform/primitives/sequence.policy.ts'],
+  ['be/src/modules/platform/primitives/sequence.policy.spec.ts', 'skeleton/src/modules/platform/primitives/sequence.policy.spec.ts'],
 ]);
 
-/** The sql tag of the outbox and claim statements (with its identifier error) and the in-order relay of lite's starter platform. */
+/** The sql tag of the outbox and claim statements (with its identifier error) and the in-order relay the queue adapters walk their rows with. */
 function skeletonFiles(repoRoot) {
   const created = SKELETON_FILES.filter(([relative]) => !fs.existsSync(path.join(repoRoot, ...relative.split('/'))))
     .map(([relative, source]) => ({ relative, text: render(template(`be/${source}`), {}) }));

package/scaffold/app.mjs

@@ -412,6 +412,7 @@ const LITE_DEFERRED_GENERATOR_FILES = new Set([
   'src/modules/platform/database/database.sql.ts',
   'src/modules/platform/database/migration-runner.service.ts',
   'src/modules/platform/database/seed-runner.service.ts',
+  'src/modules/platform/primitives/sequence.policy.ts',
 ]);
 const liteBaseSource = (rel) => !rel.startsWith('apps/cli/')
     && !rel.startsWith('src/features/cli/')

package/scaffold/lite-exports.mjs

@@ -36,9 +36,15 @@ const REGISTRATIONS = Object.freeze({
       names: ["InjectPrimaryEntityManager", "PRIMARY_ENTITY_MANAGER"],
     },
   ],
-  // The queue and jobs capabilities state their outbox and claim statements with the sql tag (the lite starter already carries the
-  // in-order relay and the record guard the BullMQ client reads stored jobs with).
+  // The queue and jobs capabilities state their outbox and claim statements with the sql tag and walk rows with the in-order relay
+  // (the lite starter already carries the record guard the BullMQ client reads stored jobs with).
   queue: [
+    {
+      file: "be/src/modules/platform/primitives/index.ts",
+      source: "./sequence.policy",
+      names: ["eachInOrder"],
+      beforeSource: "./record.policy",
+    },
     {
       file: "be/src/modules/platform/database/index.ts",
       source: "./database.sql",

package/templates/app/skeleton-lite/.starcistacks/dev/README.md

@@ -7,7 +7,7 @@ The runtime template tracks no encrypted members. Scaffolding generates the two
 
 | Command | Operation |
 | --- | --- |
-| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. For a declared Redis, run `npm run redis:create` once, then `npm run redis:start` when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
+| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. For a declared Redis (its `redis:create`, `redis:start` and `redis:stop` scripts arrive in package.json with the first queue or job), run the create script once, then the start script when using the native app profile. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes; the model starts its declared Redis with the app. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
 | doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local Supabase availability. |
 | up | Run `docker stack deploy -c infra/swarm/stack.yaml {{project}}-dev` from this directory after preparation. |
 | status | Run `docker stack services {{project}}-dev`. |

package/templates/be/skeleton-lite/src/modules/platform/logging/index.ts

@@ -1,17 +1,6 @@
 export { createJsonLogger } from "./json-logger.service"
-export {
-    InjectLogger,
-    LOGGER,
-    CORRELATION_IDS,
-    CORRELATION_RUNNER,
-    InjectCorrelationIds,
-    InjectCorrelationRunner,
-} from "./logging.decorators"
-export { applyCorrelation, correlationMiddleware } from "./correlation-request.policy"
-export type { CorrelationIds, CorrelationRunner } from "./correlation.port"
-export type { CorrelationHeaders, CorrelationRequest } from "./correlation.contracts"
-export { createCorrelationRunner } from "./correlation.service"
-export { isCorrelationId } from "./correlation.policy"
+export { InjectLogger, LOGGER } from "./logging.decorators"
+export { applyCorrelation } from "./correlation-request.policy"
 export { LoggingLogEvent } from "./logging.log-events"
 export { LoggingModule } from "./logging.module"
 export type { Logger } from "./logging.port"

package/templates/be/skeleton-lite/src/modules/platform/primitives/index.ts

@@ -1,4 +1,3 @@
 export type { Outcome } from "./outcome.contracts"
 export { ok, refused, unwrapOutcome } from "./outcome.mapper"
-export { eachInOrder } from "./sequence.policy"
 export { isRecord } from "./record.policy"