@starci/hfs 4.7.41 → 4.7.43

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 4.7.43 - 2026-10-26
+- Fixed: the ESLint launch of `starci app lint` is chunked by command-line size and a spawn error is reported as an eslint error.
+- Changed: R280 (unused symbols) reads one assignment-target index per run instead of scanning the tree per class member.
+- Changed: the bundled canon pins follow the lint family bumps (canon-be 3.4.50, canon-fe 9.1.5, Grammar 0.12.9).
+
+## 4.7.42 - 2026-10-26
+- Fixed: `HFS_BYPASS_MARKER` reads a skip/only index only (`describe["skip"]`), not a marker word inside an array literal.
+- Fixed: the BE SQL owner analysis bounds a FROM-less and an aggregate-only SELECT as one row.
+- Changed: the bundled canon pins follow the lint family bumps (canon-be 3.4.49, canon-fe 9.1.4, Grammar 0.12.8).
+
 ## 4.7.41 - 2026-10-26
 - Changed: the bundled canon pins follow the lint family bumps (canon-be 3.4.48, canon-fe 9.1.3, Grammar 0.12.7). No behavior change.
 

package/lint/chunk.mjs

@@ -0,0 +1,46 @@
+// chunk.mjs - split a long argument list under the command-line limit (Windows allows 32,767 characters) and run the parts with bounded concurrency.
+
+/** The command-line characters one argument costs: its length, a separating space and a pair of quotes. */
+const cost = (arg) => String(arg).length + 3;
+
+/**
+ * Split `items` into consecutive chunks whose summed command-line cost stays within `budget` characters. Order is kept. An item that alone
+ * exceeds the budget gets a chunk of its own (the spawn then fails visibly instead of being dropped).
+ */
+export function chunkByChars(items, budget = 24_000) {
+  const chunks = [];
+  let current = [], used = 0;
+  for (const item of items) {
+    const size = cost(item);
+    if (current.length && used + size > budget) { chunks.push(current); current = []; used = 0; }
+    current.push(item);
+    used += size;
+  }
+  if (current.length) chunks.push(current);
+  return chunks;
+}
+
+/** Run `task(chunk)` for every chunk with at most `limit` in flight. Results keep the chunk order; a thrown task becomes `{ error }`. */
+export async function mapBounded(chunks, task, limit = 3) {
+  const out = new Array(chunks.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < chunks.length) {
+      const at = next++;
+      try { out[at] = await task(chunks[at], at); } catch (error) { out[at] = { error: `could not start a lint child: ${String(error?.message ?? error)}` }; }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, chunks.length) }, worker));
+  return out;
+}
+
+/** Merge the `{ results, error }` records of the chunks, in chunk order: every result kept, every distinct error reported. */
+export function mergeRuns(runs) {
+  const results = [], errors = [];
+  let any = false;
+  for (const run of runs) {
+    if (run?.results) { results.push(...run.results); any = true; }
+    if (run?.error && !errors.includes(run.error)) errors.push(run.error);
+  }
+  return { ...(any ? { results } : {}), ...(errors.length ? { error: errors.join(' ; ') } : {}) };
+}

package/lint/run.mjs

@@ -22,6 +22,7 @@ import { spawn } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { linterReport, mergeReports, sonarReport, sourceRootsOf } from '../report/sonar.mjs';
 import { SIDES, appRelativeMessages, loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
+import { chunkByChars, mapBounded, mergeRuns } from './chunk.mjs';
 import { STYLE_GLOB } from '../sync/index.mjs';
 import { byCodeUnit } from '../report/order.mjs';
 import { braceVariants, globExpression } from '../runtime/scripts/lib/glob.mjs';
@@ -88,7 +89,9 @@ const linterBoundArgs = () => ['--require', fileURLToPath(new URL('./bound-sys.c
 /** The child `node` ran with `args` from `cwd`: its exit status, signal, spawn error and the text of both streams, once it closes. */
 function runNode(args, options) {
   return new Promise((resolve) => {
-    const child = spawn(process.execPath, args, { ...options, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    let child;
+    try { child = spawn(process.execPath, args, { ...options, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] }); }
+    catch (error) { resolve({ status: 2, signal: null, error, stdout: '', stderr: String(error?.message ?? error) }); return; }
     const out = [];
     const err = [];
     let failure;
@@ -245,6 +248,11 @@ function checkedEslintResults({ results, expected, cwd, scope, changed }) {
   return { results: valid, errors };
 }
 
+const ESLINT_ARGV_BUDGET = 24_000;
+const ESLINT_CONCURRENCY = 3;
+/** A launch that threw instead of returning a record is a tool error of the run (exit 2), not a crash of the CLI. */
+const spawnFailure = (error) => ({ error: `could not start eslint: ${String(error?.message ?? error)}` });
+
 /** Starts the ESLint child of every side that has work and returns one record per side: skipped, a scope error, or the running child. */
 async function launchEslint({ app, repoRoot, opts, changed, existing, workspace, onFe, run = runLinter }) {
   const launches = [];
@@ -256,7 +264,11 @@ async function launchEslint({ app, repoRoot, opts, changed, existing, workspace,
     let expected;
     try { expected = changed ? sources : await sourceFiles({ repoRoot, cwd, side, scope: onFe }); }
     catch (error) { launches.push({ side, scopeError: `eslint source scope is unavailable in ${side}/: ${String(error?.message ?? error)}` }); continue; }
-    launches.push({ side, cwd, expected, run: run({ cwd, pkg: 'eslint', bin: 'eslint', args: ['--format', 'json', ...(opts.fix ? ['--fix'] : []), ...(changed ? sources : [onFe ?? '.'])], bound: repoRoot }) });
+    const head = ['--format', 'json', ...(opts.fix ? ['--fix'] : [])];
+    const launch = (files) => Promise.resolve().then(() => run({ cwd, pkg: 'eslint', bin: 'eslint', args: [...head, ...files], bound: repoRoot }));
+    // A diff of hundreds of files exceeds the Windows command line: the sources go in chunks and the reports are merged.
+    const chunks = changed ? chunkByChars(sources, ESLINT_ARGV_BUDGET) : [[onFe ?? '.']];
+    launches.push({ side, cwd, expected, run: chunks.length === 1 ? launch(chunks[0]).catch(spawnFailure) : mapBounded(chunks, launch, ESLINT_CONCURRENCY).then(mergeRuns) });
   }
   return launches;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.41",
+  "version": "4.7.43",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -23,35 +23,35 @@ pins:
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/grammar':
-    version: 0.12.7
+    version: 0.12.9
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.48
+    version: 3.4.50
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.3
+    version: 9.1.5
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.7
+    version: 0.12.9
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.7
+    version: 0.12.9
     group: starci
     install: registry
     side: fe
@@ -91,14 +91,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.41
+    version: 1.7.43
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.41
+    version: 4.7.43
     group: starci
     install: registry
     side: both

package/runtime/scripts/guards/release-definition.mjs

@@ -1,204 +1,204 @@
-// release-definition.mjs - what makes a commit of the runtime repository a RELEASE commit, the one definition shared by the
-// pre-push hook (scripts/guards/release-push-gate.mjs) and the release cut (scripts/supervisor/release-cut.mjs). The remote
-// main of the runtime moves exactly when a release is cut, so a push of main or of a v* tag is judged against this list:
-//   RELEASE_VERSION_UNCHANGED   package.json `version` at the pushed commit differs from the version at the remote main's head
-//   RELEASE_VERSION_NOT_NEXT    that version is the next release after the highest v* tag (scripts/lib/release-version.mjs, owner ruling release-waves):
-//                               the next wave alpha.N.M+1 of its line or the next line alpha.N+1, never the legacy -fix form
-//   RELEASE_TAG_VERSION         the release tag is v<version> of the pushed commit
-//   RELEASE_CHANGELOG_SECTION   CHANGELOG.md holds `## [<version>] - <date>` (a dated heading) with no unfinished marker (R222)
-//   RELEASE_TAG_MISSING         an ANNOTATED tag v<version> points at the pushed commit
-//   RELEASE_RECEIPT_MISSING     the L4 record of exactly this commit (scripts/guards/release-record.mjs, written by the cut) names this tag
-//   RELEASE_RECEIPT_INCOMPLETE  that record holds a green row for each of RECEIPT_STEPS (the package clean-test, the scaffold e2e and the checks) (RAN on this commit or reused from another with the identical input digest, the record's `reusedFrom` names it; owner ruling speed-flow, 2026-10-25)
-//   RELEASE_SUITE_MODE          the record says `suite: ci` (the Linux parity delegated to CI) while the checked-out config says `local`, or it lists no delegated linux-parity: a record never claims the mode by
-//                               itself (scripts/guards/release-suite-mode.mjs); both modes ask for the same root rows, the runtime has no spec suite to delegate (owner ruling no-runtime-specs)
-// Each finding names what is missing and the command that produces it. Pure over the git reads; no bypass.
-import { catFile } from '../api/git/cat-file.mjs';
-import { revParseQuery } from '../api/git/rev-parse-query.mjs';
-import { show } from '../api/git/show.mjs';
-import { tag as gitTag } from '../api/git/tag.mjs';
-import { mergeBaseQuery } from '../api/git/merge-base-query.mjs';
-import { pathKey, realPath } from '../lib/path-key.mjs';
-import { changelogSection, releaseNotesFindings } from '../hfs/runtime-rules/release-notes.mjs';
-import { nextReleases, releaseVersionRefusal, taggedVersions } from '../lib/release-version.mjs';
-import { readL4Record } from './release-record.mjs';
-import { suiteModeOf } from './release-suite-mode.mjs';
-
-/** The rows the L4 record must hold green, run on the commit or reused from an identical-digest row of another, in either suite mode: the package clean-test, the scaffold e2e and the checks (the runtime's real tests). */
-export const RECEIPT_STEPS = Object.freeze(['npm run test:packages', 'npm run test:e2e', 'npm run check']);
-const CUT_COMMAND = (tag) => `starci release cut --tag ${tag}`;
-const REGEX_SPECIALS = /[.*+?^$()|[\]{}\\]/g;
-const HEADING_HEAD = String.raw`^## \[`;
-const DATED_HEADING_TAIL = String.raw`\] — \d{4}-\d{2}-\d{2}\s*$`;
-const DATED_HEADING = (version) => new RegExp([HEADING_HEAD, version.replaceAll(REGEX_SPECIALS, String.raw`\$&`), DATED_HEADING_TAIL].join(''), 'mu');
-
-const finding = (code, missing, fix) => ({ code, missing, fix });
-const gitText = (verb, args, cwd) => {
-  const r = verb(args, { cwd, timeout: 60_000 });
-  return r.status === 0 ? String(r.stdout ?? '') : null;
-};
-
-/** The package.json version of `commit`, or null when the commit or its manifest cannot be read. */
-export function versionAt(cwd, commit) {
-  const text = gitText(show, [`${commit}:package.json`], cwd);
-  try { return text === null ? null : JSON.parse(text).version ?? null; } catch { return null; }
-}
-
-const releaseUnknown = (why) => ({ ok: false, status: 'unknown', why });
-const ineligibleRelease = (explicit, why) => explicit ? releaseUnknown(why) : { ok: true, candidate: null };
-
-/** A runtime Git root's nearest annotated, manifest-bound release; enclosing application history is inapplicable. */
-export function releaseTagOf({ repo, tag = null, excludeHead = false }) {
-  const history = runtimeGitHistory(repo);
-  if (!history.ok) return history;
-  const listed = tag === null ? gitText(gitTag, ['--merged', 'HEAD', '--list', 'v*'], repo) : tag;
-  if (listed === null) return releaseUnknown('release tags are unreadable');
-  const candidates = [];
-  for (const named of listed.split(/\r?\n/).filter(Boolean)) {
-    const result = releaseCandidate({ repo, named, current: history.head, explicit: tag !== null, excludeHead });
-    if (!result.ok) return result;
-    if (result.candidate) candidates.push(result.candidate);
-  }
-  return nearestRelease(repo, candidates);
-}
-
-/** Runtime history exists only at its own Git top-level with a readable HEAD and full ancestry. */
-function runtimeGitHistory(repo) {
-  const top = revParseQuery(['--show-toplevel'], { cwd: repo });
-  if (top.status !== 0) {
-    if (/not a git repository/i.test(String(top.stderr ?? ''))) return { ok: false, status: 'no-repository', why: 'release history requires a Git repository' };
-    return releaseUnknown('release repository identity is unreadable');
-  }
-  const gitRoot = String(top.stdout ?? '').trim();
-  if (!gitRoot) return releaseUnknown('release repository root is unreadable');
-  if (pathKey(realPath(gitRoot)) !== pathKey(realPath(repo))) return { ok: false, status: 'no-runtime-repository', why: 'the runtime copy is inside an enclosing Git repository; its history belongs to that repository' };
-  const head = gitText(revParseQuery, ['HEAD'], repo)?.trim();
-  if (!head) return releaseUnknown('release history HEAD is unreadable');
-  if (gitText(revParseQuery, ['--is-shallow-repository'], repo)?.trim() !== 'false') return releaseUnknown('release history is shallow or unreadable; fetch complete release history');
-  return { ok: true, head };
-}
-
-/** A candidate binds annotation, peeled commit, manifest spelling and ancestry; default discovery omits ineligible tags. */
-function releaseCandidate({ repo, named, current, explicit, excludeHead }) {
-  const kind = gitText(catFile, ['-t', `refs/tags/${named}`], repo)?.trim();
-  const head = gitText(revParseQuery, [`refs/tags/${named}^{commit}`], repo)?.trim();
-  if (!kind || !head) return releaseUnknown(`release tag ${named} is unreadable`);
-  if (kind !== 'tag') return ineligibleRelease(explicit, `release tag ${named} is not annotated`);
-  const version = versionAt(repo, head);
-  if (!version) return releaseUnknown(`release manifest of ${named} is unreadable`);
-  if (named !== `v${version}`) return ineligibleRelease(explicit, `release tag ${named} differs from its manifest version ${version}`);
-  const reachable = releaseAncestor(repo, head, current);
-  if (reachable === null) return releaseUnknown(`release ancestry of ${named} is unreadable`);
-  if (!reachable) return ineligibleRelease(explicit, `release tag ${named} is not merged in HEAD`);
-  if (excludeHead && head === current) return { ok: true, candidate: null };
-  return { ok: true, candidate: { tag: named, head } };
-}
-
-/** Only one unsuperseded release ancestor proves a boundary; incomparable releases hold. */
-function nearestRelease(repo, candidates) {
-  if (!candidates.length) return releaseUnknown('no eligible annotated, manifest-bound release tag is merged in HEAD');
-  const nearest = [];
-  for (const candidate of candidates) {
-    const superseded = candidateSuperseded(repo, candidate, candidates);
-    if (superseded === null) return releaseUnknown('release ancestry between tags is unreadable');
-    if (!superseded) nearest.push(candidate);
-  }
-  if (nearest.length !== 1) return releaseUnknown(`release history is ambiguous: ${nearest.map((entry) => entry.tag).join(', ')}`);
-  return { ok: true, ...nearest[0] };
-}
-
-/** A release loses its boundary only to a proven descendant release, never to a date or version sort. */
-function candidateSuperseded(repo, candidate, candidates) {
-  for (const other of candidates) {
-    if (candidate.head === other.head) continue;
-    const older = releaseAncestor(repo, candidate.head, other.head);
-    if (older === null) return null;
-    if (older) return true;
-  }
-  return false;
-}
-
-/** Missing Git proof is distinct from a proven non-ancestor. */
-function releaseAncestor(repo, before, after) {
-  const result = mergeBaseQuery(['--is-ancestor', before, after], { cwd: repo });
-  if (result.status === 0) return true;
-  if (result.status === 1) return false;
-  return null;
-}
-
-/** The next releases named from the released versions, for a fix text: "v<wave> or v<line>". */
-const nextNamed = (released, version = null) => {
-  const next = nextReleases(released, version);
-  return next ? `v${next.wave} or v${next.line}` : 'v<new version>';
-};
-
-function versionFindings({ cwd, remoteCommit, version, released }) {
-  if (!remoteCommit) return [];
-  const remoteVersion = versionAt(cwd, remoteCommit);
-  if (remoteVersion === null) return [finding('RELEASE_REMOTE_HEAD_UNKNOWN', `the remote main head ${remoteCommit.slice(0, 9)} is not in this repository, so its version cannot be compared`, 'git fetch origin main')];
-  if (remoteVersion === version) return [finding('RELEASE_VERSION_UNCHANGED', `package.json version ${version} is the version the remote main already carries`, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released, version))}`)];
-  return [];
-}
-
-/** The version must be the next release after the highest v* tag other than its own: a wave alpha.N.M is counted, never guessed. */
-function nextReleaseFindings({ version, released }) {
-  if (released === null) return [finding('RELEASE_VERSION_NOT_NEXT', 'the v* tags are unreadable, so the next release cannot be derived', 'git fetch --tags')];
-  const refusal = releaseVersionRefusal(version, released);
-  return refusal ? [finding('RELEASE_VERSION_NOT_NEXT', refusal, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released.filter((entry) => entry !== version), version))}`)] : [];
-}
-
-function changelogFindings({ cwd, commit, version, tag }) {
-  const changelog = gitText(show, [`${commit}:CHANGELOG.md`], cwd);
-  if (changelog === null) return [finding('RELEASE_CHANGELOG_SECTION', 'CHANGELOG.md is not readable at the pushed commit', 'restore CHANGELOG.md')];
-  const notes = releaseNotesFindings({ tags: [tag], changelog });
-  if (notes.length) return notes.map((n) => finding('RELEASE_CHANGELOG_SECTION', n.message, 'finish the CHANGELOG section of the release (no in-preparation mark, no open marker), commit'));
-  if (!changelogSection(changelog, version).found || !DATED_HEADING(version).test(changelog)) return [finding('RELEASE_CHANGELOG_SECTION', `CHANGELOG.md has no dated heading "## [${version}] — YYYY-MM-DD"`, `date the heading of the ${version} section, commit`)];
-  return [];
-}
-
-function tagFindings({ cwd, commit, tag }) {
-  const kind = gitText(catFile, ['-t', `refs/tags/${tag}`], cwd)?.trim();
-  const target = gitText(revParseQuery, [`refs/tags/${tag}^{commit}`], cwd)?.trim();
-  if (kind === 'tag' && target === commit) return [];
-  return [finding('RELEASE_TAG_MISSING', `no annotated tag ${tag} points at ${commit.slice(0, 9)}`, CUT_COMMAND(tag))];
-}
-
-/** The finding of a record that claims the delegated mode without the checked-out config saying so (or without naming the delegated linux-parity row), else null. */
-function suiteModeFinding({ record, cwd, commit, tag }) {
-  if (record.suite !== 'ci') return null;
-  if (suiteModeOf(cwd) !== 'ci') return finding('RELEASE_SUITE_MODE', `the release record of ${commit.slice(0, 9)} says suite: ci, but this checkout's config.yaml release.suite is not ci: a record does not choose the mode`, `set release.suite: ci in config.yaml (the owner's choice), or ${CUT_COMMAND(tag)} under suite: local`);
-  if (!(record.delegated ?? []).some((row) => row?.name === 'linux-parity')) return finding('RELEASE_SUITE_MODE', `the suite: ci record of ${commit.slice(0, 9)} does not list linux-parity as delegated`, CUT_COMMAND(tag));
-  return null;
-}
-
-function receiptFindings({ cwd, commit, tag }) {
-  const record = readL4Record({ repo: cwd, head: commit, tag });
-  if (!record) return [finding('RELEASE_RECEIPT_MISSING', `no release record for exactly ${commit.slice(0, 9)} and ${tag}: the package clean-test, the scaffold e2e and the check did not run green on this commit`, CUT_COMMAND(tag))];
-  const mode = suiteModeFinding({ record, cwd, commit, tag });
-  if (mode) return [mode];
-  // A row reused from another commit (reusedFrom) counts: the cut reuses a row only when its input digest is identical (owner ruling speed-flow, 2026-10-25), and the record names the commit it came from.
-  const green = new Set((record.logs ?? []).filter((row) => row?.ok === true).map((row) => row.name));
-  const absent = RECEIPT_STEPS.filter((name) => !green.has(name));
-  return absent.length ? [finding('RELEASE_RECEIPT_INCOMPLETE', `the release record of ${commit.slice(0, 9)} has no green row for: ${absent.join(', ')}`, CUT_COMMAND(tag))] : [];
-}
-
-/**
- * The findings that keep `commit` from being a release commit of the repository at `cwd`: [{code, missing, fix}], [] when it is one.
- * `remoteCommit` is the remote main's head being replaced (null for a tag push or a first push); `tag` the release tag (default v<version>);
- * `needTag` / `needReceipt` are false only for the cut's early look, before it has created the tag and run the suite.
- */
-export function releaseFindings({ cwd, commit, remoteCommit = null, tag = null, needTag = true, needReceipt = true }) {
-  const version = versionAt(cwd, commit);
-  if (!version) return [finding('RELEASE_VERSION_UNREADABLE', `package.json at ${commit.slice(0, 9)} has no readable version`, 'restore package.json')];
-  const expected = `v${version}`;
-  const named = tag ?? expected;
-  if (named !== expected) return [finding('RELEASE_TAG_VERSION', `the tag ${named} is not v${version}, the version of ${commit.slice(0, 9)}`, `tag v${version}, or set package.json version to ${named.replace(/^v/, '')}`)];
-  const listed = gitText(gitTag, ['--list', 'v*'], cwd);
-  const released = listed === null ? null : taggedVersions(listed);
-  return [
-    ...versionFindings({ cwd, remoteCommit, version, released: released ?? [] }),
-    ...nextReleaseFindings({ version, released }),
-    ...changelogFindings({ cwd, commit, version, tag: named }),
-    ...(needTag ? tagFindings({ cwd, commit, tag: named }) : []),
-    ...(needReceipt ? receiptFindings({ cwd, commit, tag: named }) : []),
-  ];
-}
+// release-definition.mjs - what makes a commit of the runtime repository a RELEASE commit, the one definition shared by the
+// pre-push hook (scripts/guards/release-push-gate.mjs) and the release cut (scripts/supervisor/release-cut.mjs). The remote
+// main of the runtime moves exactly when a release is cut, so a push of main or of a v* tag is judged against this list:
+//   RELEASE_VERSION_UNCHANGED   package.json `version` at the pushed commit differs from the version at the remote main's head
+//   RELEASE_VERSION_NOT_NEXT    that version is the next release after the highest v* tag (scripts/lib/release-version.mjs, owner ruling release-waves):
+//                               the next wave alpha.N.M+1 of its line or the next line alpha.N+1, never the legacy -fix form
+//   RELEASE_TAG_VERSION         the release tag is v<version> of the pushed commit
+//   RELEASE_CHANGELOG_SECTION   CHANGELOG.md holds `## [<version>] - <date>` (a dated heading) with no unfinished marker (R222)
+//   RELEASE_TAG_MISSING         an ANNOTATED tag v<version> points at the pushed commit
+//   RELEASE_RECEIPT_MISSING     the L4 record of exactly this commit (scripts/guards/release-record.mjs, written by the cut) names this tag
+//   RELEASE_RECEIPT_INCOMPLETE  that record holds a green row for each of RECEIPT_STEPS (the package clean-test, the scaffold e2e and the checks) (RAN on this commit or reused from another with the identical input digest, the record's `reusedFrom` names it; owner ruling speed-flow, 2026-10-25)
+//   RELEASE_SUITE_MODE          the record says `suite: ci` (the Linux parity delegated to CI) while the checked-out config says `local`, or it lists no delegated linux-parity: a record never claims the mode by
+//                               itself (scripts/guards/release-suite-mode.mjs); both modes ask for the same root rows, the runtime has no spec suite to delegate (owner ruling no-runtime-specs)
+// Each finding names what is missing and the command that produces it. Pure over the git reads; no bypass.
+import { catFile } from '../api/git/cat-file.mjs';
+import { revParseQuery } from '../api/git/rev-parse-query.mjs';
+import { show } from '../api/git/show.mjs';
+import { tag as gitTag } from '../api/git/tag.mjs';
+import { mergeBaseQuery } from '../api/git/merge-base-query.mjs';
+import { pathKey, realPath } from '../lib/path-key.mjs';
+import { changelogSection, releaseNotesFindings } from '../hfs/runtime-rules/release-notes.mjs';
+import { nextReleases, releaseVersionRefusal, taggedVersions } from '../lib/release-version.mjs';
+import { readL4Record } from './release-record.mjs';
+import { suiteModeOf } from './release-suite-mode.mjs';
+
+/** The rows the L4 record must hold green, run on the commit or reused from an identical-digest row of another, in either suite mode: the package clean-test, the scaffold e2e and the checks (the runtime's real tests). */
+export const RECEIPT_STEPS = Object.freeze(['npm run test:packages', 'npm run test:e2e', 'npm run check']);
+const CUT_COMMAND = (tag) => `starci release cut --tag ${tag}`;
+const REGEX_SPECIALS = /[.*+?^$()|[\]{}\\]/g;
+const HEADING_HEAD = String.raw`^## \[`;
+const DATED_HEADING_TAIL = String.raw`\] — \d{4}-\d{2}-\d{2}\s*$`;
+const DATED_HEADING = (version) => new RegExp([HEADING_HEAD, version.replaceAll(REGEX_SPECIALS, String.raw`\$&`), DATED_HEADING_TAIL].join(''), 'mu');
+
+const finding = (code, missing, fix) => ({ code, missing, fix });
+const gitText = (verb, args, cwd) => {
+  const r = verb(args, { cwd, timeout: 60_000 });
+  return r.status === 0 ? String(r.stdout ?? '') : null;
+};
+
+/** The package.json version of `commit`, or null when the commit or its manifest cannot be read. */
+export function versionAt(cwd, commit) {
+  const text = gitText(show, [`${commit}:package.json`], cwd);
+  try { return text === null ? null : JSON.parse(text).version ?? null; } catch { return null; }
+}
+
+const releaseUnknown = (why) => ({ ok: false, status: 'unknown', why });
+const ineligibleRelease = (explicit, why) => explicit ? releaseUnknown(why) : { ok: true, candidate: null };
+
+/** A runtime Git root's nearest annotated, manifest-bound release; enclosing application history is inapplicable. */
+export function releaseTagOf({ repo, tag = null, excludeHead = false }) {
+  const history = runtimeGitHistory(repo);
+  if (!history.ok) return history;
+  const listed = tag === null ? gitText(gitTag, ['--merged', 'HEAD', '--list', 'v*'], repo) : tag;
+  if (listed === null) return releaseUnknown('release tags are unreadable');
+  const candidates = [];
+  for (const named of listed.split(/\r?\n/).filter(Boolean)) {
+    const result = releaseCandidate({ repo, named, current: history.head, explicit: tag !== null, excludeHead });
+    if (!result.ok) return result;
+    if (result.candidate) candidates.push(result.candidate);
+  }
+  return nearestRelease(repo, candidates);
+}
+
+/** Runtime history exists only at its own Git top-level with a readable HEAD and full ancestry. */
+function runtimeGitHistory(repo) {
+  const top = revParseQuery(['--show-toplevel'], { cwd: repo });
+  if (top.status !== 0) {
+    if (/not a git repository/i.test(String(top.stderr ?? ''))) return { ok: false, status: 'no-repository', why: 'release history requires a Git repository' };
+    return releaseUnknown('release repository identity is unreadable');
+  }
+  const gitRoot = String(top.stdout ?? '').trim();
+  if (!gitRoot) return releaseUnknown('release repository root is unreadable');
+  if (pathKey(realPath(gitRoot)) !== pathKey(realPath(repo))) return { ok: false, status: 'no-runtime-repository', why: 'the runtime copy is inside an enclosing Git repository; its history belongs to that repository' };
+  const head = gitText(revParseQuery, ['HEAD'], repo)?.trim();
+  if (!head) return releaseUnknown('release history HEAD is unreadable');
+  if (gitText(revParseQuery, ['--is-shallow-repository'], repo)?.trim() !== 'false') return releaseUnknown('release history is shallow or unreadable; fetch complete release history');
+  return { ok: true, head };
+}
+
+/** A candidate binds annotation, peeled commit, manifest spelling and ancestry; default discovery omits ineligible tags. */
+function releaseCandidate({ repo, named, current, explicit, excludeHead }) {
+  const kind = gitText(catFile, ['-t', `refs/tags/${named}`], repo)?.trim();
+  const head = gitText(revParseQuery, [`refs/tags/${named}^{commit}`], repo)?.trim();
+  if (!kind || !head) return releaseUnknown(`release tag ${named} is unreadable`);
+  if (kind !== 'tag') return ineligibleRelease(explicit, `release tag ${named} is not annotated`);
+  const version = versionAt(repo, head);
+  if (!version) return releaseUnknown(`release manifest of ${named} is unreadable`);
+  if (named !== `v${version}`) return ineligibleRelease(explicit, `release tag ${named} differs from its manifest version ${version}`);
+  const reachable = releaseAncestor(repo, head, current);
+  if (reachable === null) return releaseUnknown(`release ancestry of ${named} is unreadable`);
+  if (!reachable) return ineligibleRelease(explicit, `release tag ${named} is not merged in HEAD`);
+  if (excludeHead && head === current) return { ok: true, candidate: null };
+  return { ok: true, candidate: { tag: named, head } };
+}
+
+/** Only one unsuperseded release ancestor proves a boundary; incomparable releases hold. */
+function nearestRelease(repo, candidates) {
+  if (!candidates.length) return releaseUnknown('no eligible annotated, manifest-bound release tag is merged in HEAD');
+  const nearest = [];
+  for (const candidate of candidates) {
+    const superseded = candidateSuperseded(repo, candidate, candidates);
+    if (superseded === null) return releaseUnknown('release ancestry between tags is unreadable');
+    if (!superseded) nearest.push(candidate);
+  }
+  if (nearest.length !== 1) return releaseUnknown(`release history is ambiguous: ${nearest.map((entry) => entry.tag).join(', ')}`);
+  return { ok: true, ...nearest[0] };
+}
+
+/** A release loses its boundary only to a proven descendant release, never to a date or version sort. */
+function candidateSuperseded(repo, candidate, candidates) {
+  for (const other of candidates) {
+    if (candidate.head === other.head) continue;
+    const older = releaseAncestor(repo, candidate.head, other.head);
+    if (older === null) return null;
+    if (older) return true;
+  }
+  return false;
+}
+
+/** Missing Git proof is distinct from a proven non-ancestor. */
+function releaseAncestor(repo, before, after) {
+  const result = mergeBaseQuery(['--is-ancestor', before, after], { cwd: repo });
+  if (result.status === 0) return true;
+  if (result.status === 1) return false;
+  return null;
+}
+
+/** The next releases named from the released versions, for a fix text: "v<wave> or v<line>". */
+const nextNamed = (released, version = null) => {
+  const next = nextReleases(released, version);
+  return next ? `v${next.wave} or v${next.line}` : 'v<new version>';
+};
+
+function versionFindings({ cwd, remoteCommit, version, released }) {
+  if (!remoteCommit) return [];
+  const remoteVersion = versionAt(cwd, remoteCommit);
+  if (remoteVersion === null) return [finding('RELEASE_REMOTE_HEAD_UNKNOWN', `the remote main head ${remoteCommit.slice(0, 9)} is not in this repository, so its version cannot be compared`, 'git fetch origin main')];
+  if (remoteVersion === version) return [finding('RELEASE_VERSION_UNCHANGED', `package.json version ${version} is the version the remote main already carries`, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released, version))}`)];
+  return [];
+}
+
+/** The version must be the next release after the highest v* tag other than its own: a wave alpha.N.M is counted, never guessed. */
+function nextReleaseFindings({ version, released }) {
+  if (released === null) return [finding('RELEASE_VERSION_NOT_NEXT', 'the v* tags are unreadable, so the next release cannot be derived', 'git fetch --tags')];
+  const refusal = releaseVersionRefusal(version, released);
+  return refusal ? [finding('RELEASE_VERSION_NOT_NEXT', refusal, `set package.json version to the next release, move the CHANGELOG section to it, commit, then ${CUT_COMMAND(nextNamed(released.filter((entry) => entry !== version), version))}`)] : [];
+}
+
+function changelogFindings({ cwd, commit, version, tag }) {
+  const changelog = gitText(show, [`${commit}:CHANGELOG.md`], cwd);
+  if (changelog === null) return [finding('RELEASE_CHANGELOG_SECTION', 'CHANGELOG.md is not readable at the pushed commit', 'restore CHANGELOG.md')];
+  const notes = releaseNotesFindings({ tags: [tag], changelog });
+  if (notes.length) return notes.map((n) => finding('RELEASE_CHANGELOG_SECTION', n.message, 'finish the CHANGELOG section of the release (no in-preparation mark, no open marker), commit'));
+  if (!changelogSection(changelog, version).found || !DATED_HEADING(version).test(changelog)) return [finding('RELEASE_CHANGELOG_SECTION', `CHANGELOG.md has no dated heading "## [${version}] — YYYY-MM-DD"`, `date the heading of the ${version} section, commit`)];
+  return [];
+}
+
+function tagFindings({ cwd, commit, tag }) {
+  const kind = gitText(catFile, ['-t', `refs/tags/${tag}`], cwd)?.trim();
+  const target = gitText(revParseQuery, [`refs/tags/${tag}^{commit}`], cwd)?.trim();
+  if (kind === 'tag' && target === commit) return [];
+  return [finding('RELEASE_TAG_MISSING', `no annotated tag ${tag} points at ${commit.slice(0, 9)}`, CUT_COMMAND(tag))];
+}
+
+/** The finding of a record that claims the delegated mode without the checked-out config saying so (or without naming the delegated linux-parity row), else null. */
+function suiteModeFinding({ record, cwd, commit, tag }) {
+  if (record.suite !== 'ci') return null;
+  if (suiteModeOf(cwd) !== 'ci') return finding('RELEASE_SUITE_MODE', `the release record of ${commit.slice(0, 9)} says suite: ci, but this checkout's config.yaml release.suite is not ci: a record does not choose the mode`, `set release.suite: ci in config.yaml (the owner's choice), or ${CUT_COMMAND(tag)} under suite: local`);
+  if (!(record.delegated ?? []).some((row) => row?.name === 'linux-parity')) return finding('RELEASE_SUITE_MODE', `the suite: ci record of ${commit.slice(0, 9)} does not list linux-parity as delegated`, CUT_COMMAND(tag));
+  return null;
+}
+
+function receiptFindings({ cwd, commit, tag }) {
+  const record = readL4Record({ repo: cwd, head: commit, tag });
+  if (!record) return [finding('RELEASE_RECEIPT_MISSING', `no release record for exactly ${commit.slice(0, 9)} and ${tag}: the package clean-test, the scaffold e2e and the check did not run green on this commit`, CUT_COMMAND(tag))];
+  const mode = suiteModeFinding({ record, cwd, commit, tag });
+  if (mode) return [mode];
+  // A row reused from another commit (reusedFrom) counts: the cut reuses a row only when its input digest is identical (owner ruling speed-flow, 2026-10-25), and the record names the commit it came from.
+  const green = new Set((record.logs ?? []).filter((row) => row?.ok === true).map((row) => row.name));
+  const absent = RECEIPT_STEPS.filter((name) => !green.has(name));
+  return absent.length ? [finding('RELEASE_RECEIPT_INCOMPLETE', `the release record of ${commit.slice(0, 9)} has no green row for: ${absent.join(', ')}`, CUT_COMMAND(tag))] : [];
+}
+
+/**
+ * The findings that keep `commit` from being a release commit of the repository at `cwd`: [{code, missing, fix}], [] when it is one.
+ * `remoteCommit` is the remote main's head being replaced (null for a tag push or a first push); `tag` the release tag (default v<version>);
+ * `needTag` / `needReceipt` are false only for the cut's early look, before it has created the tag and run the suite.
+ */
+export function releaseFindings({ cwd, commit, remoteCommit = null, tag = null, needTag = true, needReceipt = true }) {
+  const version = versionAt(cwd, commit);
+  if (!version) return [finding('RELEASE_VERSION_UNREADABLE', `package.json at ${commit.slice(0, 9)} has no readable version`, 'restore package.json')];
+  const expected = `v${version}`;
+  const named = tag ?? expected;
+  if (named !== expected) return [finding('RELEASE_TAG_VERSION', `the tag ${named} is not v${version}, the version of ${commit.slice(0, 9)}`, `tag v${version}, or set package.json version to ${named.replace(/^v/, '')}`)];
+  const listed = gitText(gitTag, ['--list', 'v*'], cwd);
+  const released = listed === null ? null : taggedVersions(listed);
+  return [
+    ...versionFindings({ cwd, remoteCommit, version, released: released ?? [] }),
+    ...nextReleaseFindings({ version, released }),
+    ...changelogFindings({ cwd, commit, version, tag: named }),
+    ...(needTag ? tagFindings({ cwd, commit, tag: named }) : []),
+    ...(needReceipt ? receiptFindings({ cwd, commit, tag: named }) : []),
+  ];
+}

package/runtime/scripts/hfs/architecture/sql-tokens.mjs

@@ -307,19 +307,48 @@ function singleFromRelation(tokens, level, from) {
   return true;
 }
 
-/** Plain known aggregate calls are scalar; other calls, including wrappers around aggregates, may return sets. */
+// Functions that return a set of rows when they stand in a select list. A select list holding one multiplies the rows.
+const SET_RETURNING = new Set(`GENERATE_SERIES GENERATE_SUBSCRIPTS UNNEST REGEXP_MATCHES REGEXP_SPLIT_TO_TABLE STRING_TO_TABLE
+JSON_EACH JSONB_EACH JSON_EACH_TEXT JSONB_EACH_TEXT JSON_ARRAY_ELEMENTS JSONB_ARRAY_ELEMENTS JSON_ARRAY_ELEMENTS_TEXT JSONB_ARRAY_ELEMENTS_TEXT
+JSON_OBJECT_KEYS JSONB_OBJECT_KEYS JSON_TO_RECORDSET JSONB_TO_RECORDSET JSON_POPULATE_RECORDSET JSONB_POPULATE_RECORDSET
+JSONB_PATH_QUERY JSONB_PATH_QUERY_TZ JSON_TABLE PG_LS_DIR PG_LS_WALDIR PG_LS_LOGDIR PG_LISTENING_CHANNELS PG_SHOW_ALL_SETTINGS PG_GET_KEYWORDS ACLEXPLODE TS_STAT TS_DEBUG`.split(/\s+/u));
+// Scalar builtins and operator-like words that are no row-multiplying call; the aggregate-only shape accepts these around its aggregates.
+const SCALAR_CALLS = new Set(`COALESCE NULLIF GREATEST LEAST ROUND CEIL CEILING FLOOR ABS TRUNC EXTRACT DATE_PART DATE_TRUNC TO_CHAR LOWER UPPER LENGTH CONCAT
+JSONB_BUILD_OBJECT JSONB_BUILD_ARRAY JSON_BUILD_OBJECT JSON_BUILD_ARRAY TO_JSONB TO_JSON`.split(/\s+/u));
+const NOT_A_CALL = new Set(['IN', 'ANY', 'ALL', 'SOME', 'AND', 'OR', 'NOT', 'FILTER', 'EXISTS', 'CASE', 'WHEN', 'THEN', 'ELSE', 'AS', 'ON', 'DISTINCT', 'BETWEEN', 'LIKE', 'ILIKE', 'IS', 'WITHIN', 'FROM']);
+
+const callAt = (tokens, index) => isName(tokens[index]) && tokens[index + 1]?.v === '(' && !(tokens[index].t === 'word' && (NOT_A_CALL.has(tokens[index].up) || CLAUSE_WORDS.has(tokens[index].up)));
+
+/** A call to a set-returning function anywhere in the statement (conservative: nested positions count). */
+const hasSetReturningCall = tokens => tokens.some((token, index) => callAt(tokens, index) && token.t === 'word' && SET_RETURNING.has(token.up));
+
+const hasWindow = tokens => tokens.some(token => isWord(token, 'OVER'));
+
+/** Plain known aggregate calls and known scalar builtins are scalar; other calls, including wrappers around aggregates, may return sets. */
 function unprovenProjectionCall(tokens, level, select, from) {
   const end = from < 0 ? tokens.length : from;
   for (let index = select + 1; index < end; index += 1) {
     const token = tokens[index];
     if (level[index] === 0 && (isWord(token, 'WHERE') || (token.t === 'word' && WHERE_END.has(token.up)))) break;
-    if (!isName(token) || tokens[index + 1]?.v !== '(') continue;
+    if (!callAt(tokens, index)) continue;
     if (scalarCastAt(tokens, index)) continue;
-    if (token.t !== 'word' || !AGGREGATES.has(token.up) || tokens[index - 1]?.v === '.') return true;
+    const known = token.t === 'word' && tokens[index - 1]?.v !== '.' && (AGGREGATES.has(token.up) || SCALAR_CALLS.has(token.up));
+    if (!known) return true;
   }
   return false;
 }
 
+/**
+ * A SELECT that returns at most one row by construction: it has no FROM (one row, unless a set-returning function multiplies it),
+ * or it selects only aggregates (plain or inside known scalar calls and casts) with no GROUP BY, window or set-returning function.
+ */
+function singleRowBound(tokens, level, select, from, grouped) {
+  if (hasSetReturningCall(tokens) || hasWindow(tokens)) return null;
+  if (from < 0) return grouped ? null : { bounded: true, basis: 'no from' };
+  if (!grouped && !unprovenProjectionCall(tokens, level, select, from) && aggregateSelectItems(tokens, level, select, from).every(isAggregateItem)) return { bounded: true, basis: 'aggregate' };
+  return null;
+}
+
 function selectBound(tokens, level, uniqueSetsOf, cte) {
   if (findTopWord(tokens, level, 'LIMIT') >= 0 || findTopWord(tokens, level, 'FETCH') >= 0) return { bounded: true, basis: 'limit' };
   const select = findTopWord(tokens, level, 'SELECT');
@@ -328,10 +357,10 @@ function selectBound(tokens, level, uniqueSetsOf, cte) {
   const unbounded = { bounded: false, basis: 'unbounded', table: primary?.table ?? null };
   const grouped = hasTopGroupBy(tokens, level);
   if (tokens.some((token, index) => level[index] === 0 && (isWord(token, 'UNION') || isWord(token, 'INTERSECT') || isWord(token, 'EXCEPT')))) return unbounded;
-  if (unprovenProjectionCall(tokens, level, select, from)) return unbounded;
-  if (from < 0) return grouped ? unbounded : { bounded: true, basis: 'no from' };
-  if (!grouped && aggregateSelectItems(tokens, level, select, from).every(isAggregateItem)) return { bounded: true, basis: 'aggregate' };
-  if (grouped || !primary || primary.dynamic || cte.has(primary.table) || !singleFromRelation(tokens, level, from)) return unbounded;
+  const single = singleRowBound(tokens, level, select, from, grouped);
+  if (single) return single;
+  if (unprovenProjectionCall(tokens, level, select, from) || hasSetReturningCall(tokens)) return unbounded;
+  if (grouped || from < 0 || !primary || primary.dynamic || cte.has(primary.table) || !singleFromRelation(tokens, level, from)) return unbounded;
   if (isUniqueBounded(tokens, level, from, primary, uniqueSetsOf(primary.table, primary.schema))) return { bounded: true, basis: 'unique' };
   return unbounded;
 }

package/runtime/scripts/hfs/rules/unused-symbol-flow.mjs

@@ -2,7 +2,7 @@
 // followed through variables, parameters (state.arguments), array callbacks, for-of and literal tables.
 import { nameText as nameOf } from '../../lib/ts-ast.mjs';
 import { unwrapCatalogExpression as unwrap } from '../../lib/ts-analysis.mjs';
-import { excludesNull, ownerProperty, propertiesOf, propertyValues, writesTarget } from './unused-symbol-properties.mjs';
+import { assignmentTarget, excludesNull, ownerProperty, propertiesOf, propertyValues, writesTarget } from './unused-symbol-properties.mjs';
 
 const ARRAY_CALLBACK = /^(?:map|flatMap|forEach|filter|find|some|every)$/u;
 
@@ -17,16 +17,50 @@ export const symbolAt = (state, node) => {
   return symbol?.flags === state.ts.SymbolFlags.Alias ? state.checker.getAliasedSymbol(symbol) : symbol;
 };
 
+/**
+ * Every declaration a source assigns to (`=`, compound assignment, `++`/`--`, for-in/of, destructuring targets): one walk per source,
+ * so a member's "is it ever written" is a lookup instead of a scan of the whole tree.
+ */
+export function writtenDeclarations(state, sources) {
+  const { ts } = state;
+  const written = new Set();
+  const record = target => {
+    const declaration = symbolAt(state, target)?.valueDeclaration;
+    if (declaration) written.add(declaration);
+    return false;
+  };
+  const visit = own => {
+    const assignment = ts.isBinaryExpression(own) && own.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && own.operatorToken.kind <= ts.SyntaxKind.LastAssignment;
+    const unary = (ts.isPrefixUnaryExpression(own) || ts.isPostfixUnaryExpression(own)) && [ts.SyntaxKind.PlusPlusToken, ts.SyntaxKind.MinusMinusToken].includes(own.operator);
+    if (assignment) assignmentTarget(state, own.left, record);
+    else if (unary) assignmentTarget(state, own.operand, record);
+    else if (ts.isForOfStatement(own) || ts.isForInStatement(own)) assignmentTarget(state, own.initializer, record);
+    ts.forEachChild(own, visit);
+  };
+  for (const source of sources) visit(source);
+  return written;
+}
+
+/** Whether any analysed source assigns to the declaration; the index is built once per analysed source set. */
+function isWritten(state, declaration) {
+  const sources = state.flowSources ? [...state.flowSources.values()] : null;
+  if (sources) {
+    if (state.writeIndexFor !== state.flowSources) { state.writeIndex = writtenDeclarations(state, sources); state.writeIndexFor = state.flowSources; }
+    return state.writeIndex.has(declaration);
+  }
+  const files = state.writeIndexByFile ??= new Map();
+  const file = declaration.getSourceFile();
+  if (!files.has(file)) files.set(file, writtenDeclarations(state, [file]));
+  return files.get(file).has(declaration);
+}
+
 /** Only a declared, unmodified class method or readonly field supplies instance-member provenance. */
 function classMemberValue(state, declaration) {
   const { ts } = state;
   if (!declaration || !ts.isClassLike(declaration.parent)) return null;
   const field = ts.isPropertyDeclaration(declaration);
   if (!ts.isMethodDeclaration(declaration) && (!field || !declaration.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.ReadonlyKeyword))) return null;
-  const mutations = state.memberMutations ??= new Map();
-  if (!mutations.has(declaration)) mutations.set(declaration, [...(state.flowSources?.values() ?? [declaration.getSourceFile()])]
-    .some(source => writesTarget(state, source, target => symbolAt(state, target)?.valueDeclaration === declaration)));
-  if (mutations.get(declaration)) return null;
+  if (isWritten(state, declaration)) return null;
   return field ? unwrap(ts, declaration.initializer) : declaration;
 }
 

package/runtime/scripts/hfs/rules/unused-symbol-properties.mjs

@@ -86,7 +86,7 @@ function immutableReference(state, expression) {
   return Boolean(declaration && ts.isVariableDeclaration(declaration) && (declaration.parent.flags & ts.NodeFlags.Const));
 }
 
-function assignmentTarget(state, expression, matches) {
+export function assignmentTarget(state, expression, matches) {
   const { ts } = state;
   const node = unwrap(ts, expression);
   if (!node) return false;

package/runtime/scripts/lib/bypass-markers.mjs

@@ -230,8 +230,20 @@ function skipsHooks(piece, code, strings) {
   return around !== null && strings.some((other) => other.at > around[0] && other.at < around[1] && GIT_VERBS.has(other.text));
 }
 
-/** A test marker spelled as an index (`describe['skip']`): a string equal to a marker right after a `[`. */
-const indexedMarker = (piece, code) => TEST_KEYS.has(piece.text) && code.slice(0, piece.at).trimEnd().endsWith('[');
+/** Words after which a `[` opens an array literal, not a member access. */
+const BEFORE_ARRAY_LITERAL = /(?:^|[^\w$.])(?:return|typeof|in|of|case|yield|await|void|new|delete|else|do|throw|default|extends)$/;
+
+/**
+ * A test marker spelled as an index (`describe['skip']`): a string equal to a marker that is the whole key of a member access,
+ * `[` before it after an expression and `]` right after it. An array element (`["skip", "idea"]`, `const kinds = ['only']`) is data.
+ */
+function indexedMarker(piece, code) {
+  if (!TEST_KEYS.has(piece.text)) return false;
+  const before = code.slice(0, piece.at).trimEnd();
+  if (!before.endsWith('[') || !code.slice(piece.at + piece.text.length).trimStart().startsWith(']')) return false;
+  const subject = before.slice(0, -1).trimEnd();
+  return /[\w$)\]]$/.test(subject) && !BEFORE_ARRAY_LITERAL.test(subject);
+}
 
 /** An `exit` handler of the process that resets the exit code or swallows the failure. */
 function exitHandler(piece, code) {

package/runtime/scripts/lib/release-version.mjs

@@ -1,134 +1,134 @@
-// release-version.mjs - the one reading of a release version (owner ruling release-waves). A prerelease `<label>.N` opens the release
-// line N and `<label>.N.M` is the M-th release after it, a wave or a fix alike, so alpha.31 < alpha.31.1 < alpha.31.2 < alpha.32 in
-// SemVer order. The next release is derived from the highest one already released, never guessed. The legacy `<label>.N-fix.K` still
-// reads as release K after `<label>.N` and is never produced again. Pure: the callers read the tags and the registry.
-
-const NUMERIC = /^(?:0|[1-9]\d*)$/;
-const POSITIVE = /^[1-9]\d*$/;
-const IDENTIFIERS = /^[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*$/;
-const LEGACY_FIX = '-fix.';
-
-/** {base, wave, legacy}: the release a version counts its waves from, and its wave M (0 for the release that opens the line). */
-export function waveOf(version) {
-  const text = String(version ?? '').split('+')[0];
-  const fix = text.lastIndexOf(LEGACY_FIX);
-  const legacyWave = fix > 0 ? text.slice(fix + LEGACY_FIX.length) : '';
-  if (POSITIVE.test(legacyWave)) return { base: text.slice(0, fix), wave: Number(legacyWave), legacy: true };
-  const ids = text.split('.');
-  const counted = ids.length > 3 && POSITIVE.test(ids.at(-1)) && (text.includes('-') ? NUMERIC.test(ids.at(-2)) : ids.length === 4);
-  return counted ? { base: ids.slice(0, -1).join('.'), wave: Number(ids.at(-1)), legacy: false } : { base: text, wave: 0, legacy: false };
-}
-
-/** Parsed SemVer identifiers {core, pre} of `version`; an unreadable version throws. */
-export function versionParts(version) {
-  const parts = typeof version === 'string' ? version.split('+') : [];
-  if (!parts.length || parts.length > 2 || (parts.length === 2 && !IDENTIFIERS.test(parts[1]))) throw new Error(`unreadable release version ${version}`);
-  const boundary = parts[0].indexOf('-');
-  const core = (boundary < 0 ? parts[0] : parts[0].slice(0, boundary)).split('.');
-  const prerelease = boundary < 0 ? null : parts[0].slice(boundary + 1);
-  if (core.length !== 3 || core.some((part) => !NUMERIC.test(part)) || (prerelease !== null && !IDENTIFIERS.test(prerelease))) throw new Error(`unreadable release version ${version}`);
-  const pre = prerelease?.split('.') ?? [];
-  if (pre.some((part) => /^0\d+$/.test(part))) throw new Error(`invalid numeric prerelease identifier in ${version}`);
-  return { core: core.map(BigInt), pre };
-}
-
-const readable = (version) => {
-  try {
-    versionParts(version);
-    return true;
-  } catch {
-    return false;
-  }
-};
-
-/** The SemVer spelling a version is ordered by: a legacy `-fix.K` orders as wave K of its line. */
-const ordered = (version) => {
-  const { base, wave, legacy } = waveOf(version);
-  return legacy ? `${base}.${wave}` : version;
-};
-
-const compareIdentifier = (a, b) => {
-  const numericA = /^\d+$/.test(a), numericB = /^\d+$/.test(b);
-  if (numericA && numericB) return BigInt(a) < BigInt(b) ? -1 : Number(BigInt(a) > BigInt(b));
-  if (numericA !== numericB) return numericA ? -1 : 1;
-  return a < b ? -1 : Number(a > b);
-};
-
-/** SemVer precedence, numeric prerelease identifiers included; build metadata has no precedence. */
-export function compareVersions(a, b) {
-  const left = versionParts(ordered(a)), right = versionParts(ordered(b));
-  for (const i of left.core.keys()) {
-    if (left.core[i] !== right.core[i]) return left.core[i] < right.core[i] ? -1 : 1;
-  }
-  if (!left.pre.length || !right.pre.length) return Number(!left.pre.length) - Number(!right.pre.length);
-  for (let i = 0; i < Math.max(left.pre.length, right.pre.length); i += 1) {
-    if (left.pre[i] === undefined) return -1;
-    if (right.pre[i] === undefined) return 1;
-    const compared = compareIdentifier(left.pre[i], right.pre[i]);
-    if (compared) return compared;
-  }
-  return 0;
-}
-
-/** The release line of `version`: a prerelease's core and the identifiers before its first number (every alpha.N and alpha.N.M share one), a stable release's major and minor. */
-export function releaseLine(version) {
-  const { core, pre } = versionParts(ordered(version));
-  if (!pre.length) return `${core.slice(0, 2).join('.')}-stable`;
-  const first = pre.findIndex((id) => /^\d+$/.test(id));
-  return `${core.join('.')}-${(first < 0 ? pre : pre.slice(0, first)).join('.')}`;
-}
-
-/** {family, line} of a release that opens a line (`<x.y.z>-<label>.N`), or null for any other shape. */
-function lineStart(base) {
-  if (!readable(base)) return null;
-  const { core, pre } = versionParts(base);
-  return pre.length === 2 && !/^\d+$/.test(pre[0]) && NUMERIC.test(pre[1]) ? { family: `${core.join('.')}-${pre[0]}`, line: Number(pre[1]) } : null;
-}
-
-/** The next wave after `version`: its base with M one past the highest wave of that base among `version` and `known`. */
-export function nextWave(version, known = []) {
-  const { base } = waveOf(version);
-  const waves = [version, ...known].map(waveOf).filter((entry) => entry.base === base).map((entry) => entry.wave);
-  return `${base}.${Math.max(0, ...waves) + 1}`;
-}
-
-/** The family of a version: its core and label up to `-<label>` (`1.0.0-alpha`), or null for a stable or unlabelled version. */
-export function familyOf(version) {
-  if (!readable(version)) return null;
-  const { core, pre } = versionParts(ordered(version));
-  return pre.length && !/^\d+$/.test(pre[0]) ? `${core.join('.')}-${pre[0]}` : null;
-}
-
-/**
- * What may follow the highest line-shaped release of `versions`: {highest, family, wave, line}, or null when none has that shape.
- * With a `candidate`, a family that already has released tags is judged alone (another family's tags, such as legacy 2.0.1-alpha.N,
- * never outrank the candidate's own line); a family without a tag falls back to the highest release overall.
- */
-export function nextReleases(versions, candidate = null) {
-  const shaped = versions.filter((version) => readable(version) && lineStart(waveOf(version).base));
-  const family = candidate === null ? null : familyOf(candidate);
-  const own = family === null ? [] : shaped.filter((version) => lineStart(waveOf(version).base).family === family);
-  const pool = own.length ? own : shaped;
-  if (!pool.length) return null;
-  const highest = pool.reduce((top, version) => (compareVersions(version, top) > 0 ? version : top));
-  const start = lineStart(waveOf(highest).base);
-  return { highest, family: start.family, wave: nextWave(highest, pool), line: `${start.family}.${start.line + 1}` };
-}
-
-/**
- * Why `version` cannot be released after `released` (the versions already tagged), or null when it can: the next wave of the highest
- * release of its own family, the first release of the next line, or (when its family has no tag) a later release of another label or
- * core than the highest. The legacy `-fix` form is always refused.
- */
-export function releaseVersionRefusal(version, released) {
-  const next = nextReleases(released.filter((entry) => entry !== version), version);
-  const named = next ? `; the next release is ${next.wave} (the next wave or fix after ${next.highest}) or ${next.line} (the next line)` : '';
-  if (waveOf(version).legacy) return `${version} is the legacy -fix form, which is read and never released again${named}`;
-  if (!next || version === next.wave || version === next.line) return null;
-  if (!readable(version)) return `${version} is not a SemVer version${named}`;
-  if (lineStart(waveOf(version).base)?.family !== next.family && compareVersions(version, next.highest) > 0) return null;
-  return `${version} does not follow ${next.highest}${named}`;
-}
-
-/** The versions of the release tags `v<version>` in the output of `git tag --list`. */
-export const taggedVersions = (listing) => String(listing ?? '').split(/\r?\n/).map((name) => name.trim()).filter((name) => /^v\d/.test(name)).map((name) => name.slice(1));
+// release-version.mjs - the one reading of a release version (owner ruling release-waves). A prerelease `<label>.N` opens the release
+// line N and `<label>.N.M` is the M-th release after it, a wave or a fix alike, so alpha.31 < alpha.31.1 < alpha.31.2 < alpha.32 in
+// SemVer order. The next release is derived from the highest one already released, never guessed. The legacy `<label>.N-fix.K` still
+// reads as release K after `<label>.N` and is never produced again. Pure: the callers read the tags and the registry.
+
+const NUMERIC = /^(?:0|[1-9]\d*)$/;
+const POSITIVE = /^[1-9]\d*$/;
+const IDENTIFIERS = /^[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*$/;
+const LEGACY_FIX = '-fix.';
+
+/** {base, wave, legacy}: the release a version counts its waves from, and its wave M (0 for the release that opens the line). */
+export function waveOf(version) {
+  const text = String(version ?? '').split('+')[0];
+  const fix = text.lastIndexOf(LEGACY_FIX);
+  const legacyWave = fix > 0 ? text.slice(fix + LEGACY_FIX.length) : '';
+  if (POSITIVE.test(legacyWave)) return { base: text.slice(0, fix), wave: Number(legacyWave), legacy: true };
+  const ids = text.split('.');
+  const counted = ids.length > 3 && POSITIVE.test(ids.at(-1)) && (text.includes('-') ? NUMERIC.test(ids.at(-2)) : ids.length === 4);
+  return counted ? { base: ids.slice(0, -1).join('.'), wave: Number(ids.at(-1)), legacy: false } : { base: text, wave: 0, legacy: false };
+}
+
+/** Parsed SemVer identifiers {core, pre} of `version`; an unreadable version throws. */
+export function versionParts(version) {
+  const parts = typeof version === 'string' ? version.split('+') : [];
+  if (!parts.length || parts.length > 2 || (parts.length === 2 && !IDENTIFIERS.test(parts[1]))) throw new Error(`unreadable release version ${version}`);
+  const boundary = parts[0].indexOf('-');
+  const core = (boundary < 0 ? parts[0] : parts[0].slice(0, boundary)).split('.');
+  const prerelease = boundary < 0 ? null : parts[0].slice(boundary + 1);
+  if (core.length !== 3 || core.some((part) => !NUMERIC.test(part)) || (prerelease !== null && !IDENTIFIERS.test(prerelease))) throw new Error(`unreadable release version ${version}`);
+  const pre = prerelease?.split('.') ?? [];
+  if (pre.some((part) => /^0\d+$/.test(part))) throw new Error(`invalid numeric prerelease identifier in ${version}`);
+  return { core: core.map(BigInt), pre };
+}
+
+const readable = (version) => {
+  try {
+    versionParts(version);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+/** The SemVer spelling a version is ordered by: a legacy `-fix.K` orders as wave K of its line. */
+const ordered = (version) => {
+  const { base, wave, legacy } = waveOf(version);
+  return legacy ? `${base}.${wave}` : version;
+};
+
+const compareIdentifier = (a, b) => {
+  const numericA = /^\d+$/.test(a), numericB = /^\d+$/.test(b);
+  if (numericA && numericB) return BigInt(a) < BigInt(b) ? -1 : Number(BigInt(a) > BigInt(b));
+  if (numericA !== numericB) return numericA ? -1 : 1;
+  return a < b ? -1 : Number(a > b);
+};
+
+/** SemVer precedence, numeric prerelease identifiers included; build metadata has no precedence. */
+export function compareVersions(a, b) {
+  const left = versionParts(ordered(a)), right = versionParts(ordered(b));
+  for (const i of left.core.keys()) {
+    if (left.core[i] !== right.core[i]) return left.core[i] < right.core[i] ? -1 : 1;
+  }
+  if (!left.pre.length || !right.pre.length) return Number(!left.pre.length) - Number(!right.pre.length);
+  for (let i = 0; i < Math.max(left.pre.length, right.pre.length); i += 1) {
+    if (left.pre[i] === undefined) return -1;
+    if (right.pre[i] === undefined) return 1;
+    const compared = compareIdentifier(left.pre[i], right.pre[i]);
+    if (compared) return compared;
+  }
+  return 0;
+}
+
+/** The release line of `version`: a prerelease's core and the identifiers before its first number (every alpha.N and alpha.N.M share one), a stable release's major and minor. */
+export function releaseLine(version) {
+  const { core, pre } = versionParts(ordered(version));
+  if (!pre.length) return `${core.slice(0, 2).join('.')}-stable`;
+  const first = pre.findIndex((id) => /^\d+$/.test(id));
+  return `${core.join('.')}-${(first < 0 ? pre : pre.slice(0, first)).join('.')}`;
+}
+
+/** {family, line} of a release that opens a line (`<x.y.z>-<label>.N`), or null for any other shape. */
+function lineStart(base) {
+  if (!readable(base)) return null;
+  const { core, pre } = versionParts(base);
+  return pre.length === 2 && !/^\d+$/.test(pre[0]) && NUMERIC.test(pre[1]) ? { family: `${core.join('.')}-${pre[0]}`, line: Number(pre[1]) } : null;
+}
+
+/** The next wave after `version`: its base with M one past the highest wave of that base among `version` and `known`. */
+export function nextWave(version, known = []) {
+  const { base } = waveOf(version);
+  const waves = [version, ...known].map(waveOf).filter((entry) => entry.base === base).map((entry) => entry.wave);
+  return `${base}.${Math.max(0, ...waves) + 1}`;
+}
+
+/** The family of a version: its core and label up to `-<label>` (`1.0.0-alpha`), or null for a stable or unlabelled version. */
+export function familyOf(version) {
+  if (!readable(version)) return null;
+  const { core, pre } = versionParts(ordered(version));
+  return pre.length && !/^\d+$/.test(pre[0]) ? `${core.join('.')}-${pre[0]}` : null;
+}
+
+/**
+ * What may follow the highest line-shaped release of `versions`: {highest, family, wave, line}, or null when none has that shape.
+ * With a `candidate`, a family that already has released tags is judged alone (another family's tags, such as legacy 2.0.1-alpha.N,
+ * never outrank the candidate's own line); a family without a tag falls back to the highest release overall.
+ */
+export function nextReleases(versions, candidate = null) {
+  const shaped = versions.filter((version) => readable(version) && lineStart(waveOf(version).base));
+  const family = candidate === null ? null : familyOf(candidate);
+  const own = family === null ? [] : shaped.filter((version) => lineStart(waveOf(version).base).family === family);
+  const pool = own.length ? own : shaped;
+  if (!pool.length) return null;
+  const highest = pool.reduce((top, version) => (compareVersions(version, top) > 0 ? version : top));
+  const start = lineStart(waveOf(highest).base);
+  return { highest, family: start.family, wave: nextWave(highest, pool), line: `${start.family}.${start.line + 1}` };
+}
+
+/**
+ * Why `version` cannot be released after `released` (the versions already tagged), or null when it can: the next wave of the highest
+ * release of its own family, the first release of the next line, or (when its family has no tag) a later release of another label or
+ * core than the highest. The legacy `-fix` form is always refused.
+ */
+export function releaseVersionRefusal(version, released) {
+  const next = nextReleases(released.filter((entry) => entry !== version), version);
+  const named = next ? `; the next release is ${next.wave} (the next wave or fix after ${next.highest}) or ${next.line} (the next line)` : '';
+  if (waveOf(version).legacy) return `${version} is the legacy -fix form, which is read and never released again${named}`;
+  if (!next || version === next.wave || version === next.line) return null;
+  if (!readable(version)) return `${version} is not a SemVer version${named}`;
+  if (lineStart(waveOf(version).base)?.family !== next.family && compareVersions(version, next.highest) > 0) return null;
+  return `${version} does not follow ${next.highest}${named}`;
+}
+
+/** The versions of the release tags `v<version>` in the output of `git tag --list`. */
+export const taggedVersions = (listing) => String(listing ?? '').split(/\r?\n/).map((name) => name.trim()).filter((name) => /^v\d/.test(name)).map((name) => name.slice(1));