@starci/hfs 4.7.44 → 4.7.45

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 4.7.45 - 2026-10-26
+
+- Changed: the alpha.31.1 round folded into alpha.31; the bundled canon pins and runtime copies follow the final package versions. No rule changes.
+
 ## 4.7.44 - 2026-10-26
 - Changed: the bundled canon pins follow the lint family bumps (canon-be 3.4.51, canon-fe 9.1.6, Grammar 0.12.10) and the bundled runtime copy carries the wave version. No rule changes.
 

package/lint/run.mjs

@@ -17,7 +17,7 @@
 // turbo `lint` task); the root `npm run lint` stays the whole app. There is no second linter: a workspace lint is this lint, scoped.
 import fs from 'node:fs';
 import path from 'node:path';
-import { createRequire, registerHooks } from 'node:module';
+import { createRequire } from 'node:module';
 import { spawn } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { linterReport, mergeReports, sonarReport, sourceRootsOf } from '../report/sonar.mjs';
@@ -168,17 +168,53 @@ export function canonScope(config) {
   };
 }
 
+/** The conditions the import below resolves with: `node` and `import`, plus `default` as exports' terminal fallback. */
+const IMPORT_CONDITIONS = new Set(['node', 'import', 'default']);
+
+/** The first import target of an exports entry: a string, a fallback array, or a conditions object matched in its own key order. */
+function exportsTarget(entry) {
+  if (typeof entry === 'string') return entry;
+  if (Array.isArray(entry)) {
+    for (const item of entry) {
+      const target = exportsTarget(item);
+      if (target !== null) return target;
+    }
+  } else if (entry !== null && typeof entry === 'object') {
+    for (const [condition, target] of Object.entries(entry)) {
+      if (IMPORT_CONDITIONS.has(condition)) {
+        const resolved = exportsTarget(target);
+        if (resolved !== null) return resolved;
+      }
+    }
+  }
+  return null;
+}
+
+/** The import entry of a package found by the app's own node_modules lookup (the folders require.resolve.paths lists from cwd). */
+export function importEntry(require, packageName) {
+  for (const dir of require.resolve.paths(packageName) ?? []) {
+    const manifest = path.join(dir, packageName, 'package.json');
+    if (!fs.existsSync(manifest)) continue;
+    const published = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+    if (published.exports === undefined) return path.join(dir, packageName, published.main ?? 'index.js');
+    const exports = published.exports;
+    const entry = exports !== null && typeof exports === 'object' && !Array.isArray(exports)
+      && Object.keys(exports).some((key) => key.startsWith('.')) ? exports['.'] : exports;
+    const target = exportsTarget(entry);
+    if (target === null) throw new Error(`no "exports" import target for "." in ${manifest}`);
+    const file = path.join(dir, packageName, target);
+    if (!fs.existsSync(file)) throw new Error(`the "exports" import target of ${manifest} does not exist: ${target}`);
+    return file;
+  }
+  throw new Error(`Cannot find package '${packageName}'`);
+}
+
 /** Resolve one canon from this app's install; a package from an enclosing repository cannot prove its lint contract. */
-function ownCanonEntry({ repoRoot, cwd }, packageName) {
+export function ownCanonEntry({ repoRoot, cwd }, packageName) {
   const require = createRequire(path.join(cwd, 'package.json'));
-  // The entry is imported below, so resolve with Node's import conditions even when a package publishes no require target.
-  // The synchronous hook exists only for this lookup; later package resolution keeps its own conditions.
-  const hook = registerHooks({ resolve: (specifier, context, nextResolve) => nextResolve(specifier, specifier === packageName
-    ? { ...context, conditions: [...new Set([...context.conditions.filter(condition => condition !== 'require'), 'import'])] }
-    : context) });
-  let entry;
-  try { entry = require.resolve(packageName); }
-  finally { hook.deregister(); }
+  // The entry is imported below, so the package's import condition applies; require.resolve cannot be told so on every
+  // supported Node (its registerHooks resolve hook skips require.resolve before Node 24), so "." is matched directly.
+  const entry = importEntry(require, packageName);
   // The canon must be the app's own install: resolved inside the app root, or inside the app's node_modules when that folder is a link to the install
   // (the runtime's examples lint in a sealed copy whose node_modules links the example's own install, scripts/hfs/example-secrets.mjs).
   const ownInstall = [repoRoot, path.join(repoRoot, 'node_modules')].filter((dir) => fs.existsSync(dir)).map((dir) => fs.realpathSync(dir));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.44",
+  "version": "4.7.45",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",
@@ -16,6 +16,8 @@
     "smol-toml": "1.9.0"
   },
   "devDependencies": {
+    "@typescript-eslint/eslint-plugin": "8.71.0",
+    "@typescript-eslint/parser": "8.71.0",
     "@graphql-codegen/cli": "7.4.6",
     "@graphql-codegen/client-preset": "6.2.3",
     "@nestjs/common": "11.2.5",
@@ -23,6 +25,7 @@
     "@nestjs/graphql": "13.4.5",
     "@nestjs/testing": "11.2.5",
     "class-validator": "0.15.1",
+    "eslint": "10.11.0",
     "graphql": "16.14.2",
     "prettier": "3.9.6",
     "reflect-metadata": "0.2.2",

package/release/supabase-bucket.mjs

@@ -0,0 +1,8 @@
+// supabase-bucket.mjs - select storage configuration from a local stack's migrated bucket ids.
+
+/** Returns no bucket variable for no ids, selects the sole id, and refuses ambiguous storage with every id listed. */
+export function storageBucketEnv(ids) {
+  if (ids.length === 0) return {};
+  if (ids.length === 1) return { STORAGE_S3_BUCKET: ids[0] };
+  throw new Error(`Local Supabase storage has multiple buckets: ${ids.map((id) => JSON.stringify(id)).join(', ')}; app configuration must name which bucket to use`);
+}

package/runtime/knowledge/grammars/starci/playbook.yaml

@@ -187,7 +187,17 @@ shapes:
         compose: |
           Every bar control uses `size="control"`, the 2.75rem shared height. Icon uses the family
           size-5 token (20px) throughout the region. SearchField or its trigger shows Ctrl K and opens
-          on Ctrl/Cmd+K; inside a surface its variant resolves through the nesting context.
+          on Ctrl/Cmd+K; inside a surface its variant resolves through the nesting context. A compact
+          language switch in a bar is SegmentedControl size="control" (the HeroUI lg group held to
+          2.75rem); md and lg keep HeroUI's own sizes.
+      - id: site-chrome-bar
+        implements: [FE-APP-SHELL-3]
+        compose: |
+          A public site composes its bar inside the flow shell, in one module (the scaffold SiteShell):
+          WorkspaceShell viewport="flow" header={TopBar brand navigation actions}. navigation is a
+          NavLandmark layout="bar" of TextAction links; actions is the language SegmentedControl
+          size="control", then the sign-in Button intent="neutral" and the call-to-action Button, all
+          size="control". The app right cluster (menu, theme Switch, bell, account) is for the app shell only.
       - id: workspace-identity
         implements: [FE-APP-SHELL-2]
         compose: |

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -22,36 +22,43 @@ pins:
     side: fe
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
+  '@starci/event-stream':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: fe
+    source: packages/event-stream/package.json
+    why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.12.10
+    version: 0.12.12
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.51
+    version: 3.4.54
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.6
+    version: 9.1.8
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.10
+    version: 0.12.12
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.10
+    version: 0.12.12
     group: starci
     install: registry
     side: fe
@@ -91,14 +98,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.44
+    version: 1.7.45
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.44
+    version: 4.7.45
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -82,7 +82,18 @@ concerns:
     home: [fe.hooks.socketio]
     pattern: FE-REALTIME
     forbids: [subscriptions-transport-ws, '@supabase/realtime-js', pusher-js, ably]
-    why: one socket.io-client singleton per namespace and one side-effect component that dispatches to redux and SWR; both editions run the gateway in the be api process. A one-way channel served as server-sent events needs no package, only a stream reader in modules/api/sse/clients, a stream operation in modules/api/sse and a useSubscribe<Channel>Swr hook (FE-REALTIME).
+    why: one socket.io-client singleton per namespace and one side-effect component that dispatches to redux and SWR; both editions run the gateway in the be api process. A one-way channel served as server-sent events is the event-stream concern below (FE-REALTIME).
+  - id: event-stream
+    tier: opt
+    packages: ['@starci/event-stream']
+    home: [fe.transport.stream]
+    pattern: FE-REALTIME
+    forbids: ['@microsoft/fetch-event-source', eventsource, event-source-polyfill, eventsource-parser, reconnecting-eventsource, 'sse.js', 'fetch-sse', 'sse-ts']
+    why: >-
+      the one server-sent-events client (owner:event-stream-package): the app creates one instance in modules/api/sse/clients/event-stream.ts
+      with createEventStream (the bearer token source, one renewal on a 401, backoff, heartbeat timeout), each stream operation
+      (sse/<area>/stream-<channel>.ts) follows on it, and the useSubscribe<Channel>Swr hook reads that operation. No app keeps a
+      hand-written reader (read-event-stream.ts) and no second SSE library is installed.
   - id: auth
     tier: core
     packages: []

package/runtime/knowledge/hfs/rules.yaml

@@ -5576,22 +5576,26 @@ rules:
     templateNa: "The app composes its shell from product destinations and identity; full and lite example shells provide the reference."
   - id: R318
     code: "FE_NESTED_VARIANT"
-    law: "Apps compose Grammar with layout-only CSS; paint utilities, arbitrary paint properties and inline style paint belong to Grammar. Grammar context owns all layer-aware field variants, nested Tabs defaults and the content edge of panel lists; apps omit static field variants, do not force primary Tabs inside a painted surface, do not paint raw surfaces, and add no horizontal list-wrapper padding within the nearest painted Grammar surface."
+    law: "Apps compose Grammar with layout-only CSS; paint utilities, arbitrary paint properties and inline style paint belong to Grammar. Grammar context owns all layer-aware field variants, nested Tabs defaults and the content edge of panel lists; apps omit static field variants, do not force primary Tabs inside a painted surface, do not paint raw surfaces, and add no horizontal list-wrapper padding within the nearest painted Grammar surface. BOUNDARY-1 case-5 owns Divider full-bleed composition."
     kinds: [lint, design]
     gates: [pre-commit, settle, land, ci]
-    failureCodes: ["FE_NESTED_VARIANT", "FE_LIST_PANEL_PADDING", "FE_GRAMMAR_LAYOUT_ONLY"]
+    failureCodes: ["FE_NESTED_VARIANT", "FE_LIST_PANEL_PADDING", "FE_GRAMMAR_LAYOUT_ONLY", "FE_DIVIDER_FULL_BLEED"]
     enforcers:
       - {kind: eslint-fe, id: nested-control-variant}
       - {kind: eslint-fe, id: no-list-panel-padding}
       - {kind: eslint-fe, id: no-app-surface-paint}
+      - {kind: eslint-fe, id: divider-full-bleed}
     editions: [lite, full]
     docs: ["docs/code-pattern-enforcement.md#r318-app-grammar-composition"]
     templateNa: "Product composition is proved by the FE canon's Grammar import and surface fixtures; a template cannot choose product slots or lists."
     proves:
+      - {path: packages/eslint/fe/divider-full-bleed.spec.mjs, editions: [lite, full], codes: [FE_DIVIDER_FULL_BLEED]}
       - {path: packages/eslint/fe/surface-rules.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_LIST_PANEL_PADDING, FE_GRAMMAR_LAYOUT_ONLY]}
     exemplifiedBy:
+      - {path: packages/eslint/fe/divider-full-bleed.spec.mjs, editions: [lite, full], codes: [FE_DIVIDER_FULL_BLEED]}
       - {path: packages/eslint/fe/surface-rules.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_LIST_PANEL_PADDING, FE_GRAMMAR_LAYOUT_ONLY]}
     witness:
+      - {path: packages/eslint/fe/divider-full-bleed.spec.mjs, editions: [lite, full], codes: [FE_DIVIDER_FULL_BLEED]}
       - {path: packages/eslint/fe/surface-rules.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_LIST_PANEL_PADDING, FE_GRAMMAR_LAYOUT_ONLY]}
     cases:
       - id: case-1

package/runtime/knowledge/hfs/slots.yaml

@@ -305,7 +305,7 @@ ruleParams:
       - {typeSuffix: Options, names: [options], nameSuffix: Options}
     # R89 BE_SOURCE_FORM: the closed role-suffix vocabulary of a source file name (<kebab-name>.<suffix>.ts; BE-CONVENTION 1.15)
     # and the suffixes that are never a role. index.ts, main.ts, app.module.ts and the migrations of be.persistence are the
-    # only names outside it.
+    # only names outside it. Typed realtime topic builders use the existing policy role (BE-REALTIME-3 of knowledge/patterns/be/realtime.yaml).
     suffixes: [module, module-definition, decorators, options, config, connection, service, schema, command, query, handler, templates, compensation, saga-state, saga-step, saga, contracts, port, resolver, controller, gateway, webhook, subscription, consumer, cli, event, queue, projection, projection-entity, processor, step, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, adapter, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
     # R47 BE_CONTRACT_UNGUARDED: the world's shape vocabulary. `helper` names the function a contract spec imports to erase the values of a JSON
     # payload (`shapeOf`); a contract spec proves a fake's fixtures by asserting helper(real) equals helper(fixture).
@@ -1617,7 +1617,7 @@ slots:
     requires: [index.ts]
     # <name>.templates.ts holds the capability's static templates, copy and presets as TS constants (owner ruling 2026-10-13);
     # user-editable ones are seed rows, large or user media live in object storage.
-    allows: ["<capability>.module.ts", "<capability>.module-definition.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts", "*.schema.ts", "*.schema.spec.ts"]
+    allows: ["<capability>.module.ts", "<capability>.module-definition.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts", "*.schema.ts", "*.schema.spec.ts", "*.policy.ts", "*.policy.spec.ts"]
     forbids: [testing/, exceptions/, utils/, helpers/, shared/]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
     coverage: required
@@ -2336,8 +2336,8 @@ slots:
     # The browser's calls to the back end (owner ruling 2026-10-13, fe-stack graphql/rest/codegen, FE-API-GRAPHQL): the auth and
     # no-auth Apollo clients with their link chain (graphql/clients), one file per operation (graphql/queries/query-<x>.ts,
     # graphql/mutations/mutation-<x>.ts and graphql/subscriptions/subscription-<x>.ts, each with its gql document map and typed request/response in types/), the generated wire types
-    # (graphql/__generated__), the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints and the fetch readers of
-    # server-sent-events streams (sse/<area>/stream-<channel>.ts, one operation per stream, run on the stream reader of sse/clients). A repository has
+    # (graphql/__generated__), the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints and the
+    # server-sent-events streams (sse/<area>/stream-<channel>.ts, one operation per stream, run on the app's @starci/event-stream instance in sse/clients). A repository has
     # exactly ONE client folder and ONE GraphQLResponse union: the app's (fe.transport.client/outcome) when one app calls the back end,
     # or the api package's (fe.package.api.client/outcome) when several do (FE_TRANSPORT_OWNER, machine).
     requires: [index.ts]
@@ -2381,7 +2381,7 @@ slots:
     tier: transport
     allows: ["*.ts"]
     tests: none
-    why: "the fetch reader of server-sent-events streams of the one app that calls the back end, the stream half of the transport client layer (FE-REALTIME): it opens the stream with the bearer access token, parses the events and reopens it with Last-Event-ID after a capped, doubling wait; a stream operation (sse/<area>/stream-<channel>.ts) runs on it and a useSubscribe hook of hooks/swr reads that operation; a fetch here asks for text/event-stream and only a stream operation imports the reader (FE_TRANSPORT_OWNER); a repository where several apps stream keeps one reader in each of them"
+    why: "the event-stream client of the one app that calls the back end, the stream half of the transport client layer (FE-REALTIME): event-stream.ts creates the app's one @starci/event-stream instance (createEventStream with the bearer access token source, which opens the stream with fetch, parses the events and reopens it with Last-Event-ID after a capped, doubling wait); a stream operation (sse/<area>/stream-<channel>.ts) follows on it and a useSubscribe hook of hooks/swr reads that operation; no hand-written reader lives here (owner:event-stream-package) and only a stream operation imports this folder (FE_TRANSPORT_OWNER); a repository where several apps stream keeps one instance in each of them"
     rules: [FE_TRANSPORT_OWNER]
     exemplifiedBy:
       - {path: packages/eslint/fe/r50-transport-owner-coverage.spec.mjs, editions: [lite, full]}

package/runtime/knowledge/patterns/be/realtime.yaml

@@ -7,7 +7,7 @@ purpose: |-
   (`transport/sse/<channel>.controller.ts`), a socket gateway (`<channel>.gateway.ts`) or a GraphQL subscription
   (`<x>.subscription.ts`), that READS and PUSHES only. It never writes. The push is fed by a reactor: an event consumer in
   `features/reactors/` receives the domain event and publishes to a topic of the `RealtimeHub` of `platform/realtime` (an app
-  with no event bus lets the domain service that commits the change publish, after its commit); the door only subscribes the
+  with no event bus lets the domain service that commits the change publish with the hub's commit ordering, BE-REALTIME-7); the door only subscribes the
   client to a topic of that hub, scoped to the client's principal. SSE is the default door for one-way server-to-client push
   (job progress, a status that changes, streamed tokens), in lite and in full (owner decision 2026-10-24): it is plain HTTP
   behind the ingress, reconnects by itself and resumes from `Last-Event-ID`. The socket.io gateway stays for a channel that also
@@ -28,7 +28,8 @@ provenance:
     - owner decision 2026-10-24 (the lite edition may serve SSE, and SSE is the default door for one-way push; ruling:R212/case-5, amended by owner:lite-graphql-subscription-door and ruling:R212/case-7 for the GraphQL subscription door)
   limitations: |-
     Static checks prove the door's role, that the hub is the only thing injected and that a subscribed topic is built from the
-    principal. They do not prove the topic naming is collision free across channels, that an initial snapshot is consistent with
+    principal. They do not prove the publisher's membership read, that a non-Postgres publish follows the domain commit,
+    that the topic naming is collision free across channels, that an initial snapshot is consistent with
     the stream, or the behaviour of the socket under reconnects; the three `realtime/*` scenarios prove delivery, isolation and
     cleanup on the real stack. Nothing proves the ingress settings of an SSE channel (no compression, no buffering, HTTP/2, an
     idle timeout above the heartbeat): they are reviewed against the stack files and a real stream. The memory hub is
@@ -127,8 +128,8 @@ rules:
       needs is pushed by a reactor (or by the domain service that commits the change, in an app with no event bus); the socket
       library and the pub/sub engine (`socket.io`, `@socket.io/postgres-adapter`, `@socket.io/redis-adapter`, `graphql-subscriptions`, `graphql-ws`, `pg` for LISTEN and `ioredis`) are imported only by `platform/realtime`,
       and so is the heartbeat timer (`setInterval` is owned by `platform/realtime`, `infraOwners`). Because the door reads only the
-      hub, a snapshot cannot be sent on connect from the door: the client reads the current state through a query operation first
-      (or again on every open), and the stream carries the changes.
+      hub, a snapshot cannot be sent on connect from the door: the client reads the current state through a query operation that
+      checks resource membership first (or again on every open), and the stream carries the changes (BE-REALTIME-3).
     rationale: |-
       A door that can only touch the hub cannot change business state, so the biggest risk of a long-lived unauthenticated-looking
       connection, a write through it, is removed by type.
@@ -143,13 +144,26 @@ rules:
   - id: BE-REALTIME-3
     title: The topic is built from the principal
     kind: mandatory
-    hfsRules: [R186, R41]
+    hfsRules: [R186, R41, R89, R204]
     requirement: |-
       Every `@SubscribeMessage`, `@Subscription` and `@Sse` handler takes `@CurrentPrincipal()` of `domain/identity` and builds the topic it
       passes to `hub.subscribe` from the principal's id (plus a client-supplied id only inside that prefix) with the topic
-      builder of the owning domain contract, so one client cannot
-      listen to another's channel. The reactor that pushes uses the same topic builder from the owning domain contract, never a
-      hand-written string. The default-deny guards apply to the door like to any other; an SSE stream is never `@Public`. The
+      builder of the owning domain contract, so one client cannot listen to another's channel. A typed realtime topic builder is
+      a policy: it lives in `<name>.policy.ts` of slot `be.domain`, is exported through the capability's `index.ts`, and returns
+      `RealtimeTopic<Frame>` with the principal-prefixed `name` and the frame's narrowing `accepts` predicate. The named frame
+      contract lives in `*.contracts.ts`. The builder and predicate are pure functions of their inputs, with no injection, database
+      read or membership lookup; `policy` keeps the logic-role coverage of R204. The publisher and every door import this one
+      builder from the owning domain contract, never a hand-written topic string.
+
+      Resource membership is enforced on the publish side. The domain service that owns the change, or the domain service called
+      by a reactor's command, reads the current entitled members and fans out to one principal-prefixed topic per member. A client-supplied room
+      or conversation id stays inside that principal's prefix: a non-member can open only its own idle topic, which no publisher
+      targets. A removed member's already-open stream stays open but receives no newly published frames from the next publish onward, because
+      the refreshed member list no longer targets it. Frames already delivered or retained in its own topic are not revoked;
+      replay remains subject to the hub's bounds. Snapshot and history queries independently check current membership before
+      returning rows; the door injects only the hub (BE-REALTIME-2), never a membership-reading service or guard.
+
+      The default-deny guards apply to the door like to any other; an SSE stream is never `@Public`. The
       browser `EventSource` cannot send an `Authorization` header, so the front end reads the stream with `fetch` and the bearer
       access token (an operation of modules/api/sse read by a useSubscribe<Channel>Swr hook); a token in the URL is refused because it ends up in logs. The `Last-Event-ID` header is client
       input like any other: it is passed as `{ after }` to `hub.subscribe` and only picks where the replay resumes inside the
@@ -160,12 +174,25 @@ rules:
       - id: case-1
         when: Subscribing to one order's status
         write: 'hub.subscribe(orderStatusTopic(principal.id, orderId)); the reactor publishes to orderStatusTopic(buyerId, orderId) of the order owner, so a different principal receives nothing.'
+      - id: case-2
+        when: A room or conversation has several members and membership can change
+        write: |-
+          The owning domain exports roomMessageTopic(memberId, roomId) from its room-message.policy.ts, returning
+          { name: `room-message:${memberId}:${roomId}`, accepts: isRoomMessageFrame } with the declared return type RealtimeTopic<RoomMessageFrame>.
+          The SSE door calls hub.stream(roomMessageTopic(principal.id, roomId), { after: lastEventId }) and injects only the hub.
+          The publisher reads the current members and publishes a frame to roomMessageTopic(member.id, roomId) for each of them,
+          following the hub's commit ordering (BE-REALTIME-7). A non-member's topic receives nothing; removing a member leaves its
+          stream open and excludes it from subsequent fan-out. The snapshot query checks membership in its own read.
     verification:
       automated:
         - BE_REALTIME_TOPIC_SCOPE
         - BE_DEFAULT_DENY
+        - BE_SOURCE_FORM
+        - HFS_COVERAGE_SCOPE_DRIFT
       manual:
-        - Review that the topic builder shared with the reactor lives in the domain contract and is used by both sides.
+        - Review that the pure topic policy is exported by the owning domain and used by both the publisher and door.
+        - Prove the publisher targets exactly the current member list, including the next publish after removing a member; the non-member's stream receives no frame.
+        - Prove snapshot and history queries reject a caller whose membership is absent or removed.
     relatedExamples: [realtime]
   - id: BE-REALTIME-4
     title: Three behaviours are proven on the test world
@@ -301,7 +328,7 @@ rules:
     hfsRules: [R90, R266, R155]
     requirement: |-
       Both editions run N api replicas. `platform/realtime` keeps ONE port, `RealtimeHub` (`publish(topic, frame, within?): Promise<void>`
-      called by a reactor, or by the domain service that owns the state change and passes its own transaction as `within`,
+      called by a reactor, or by the domain service that owns the state change with the commit ordering below,
       `subscribe(topic, { after })` for GraphQL and socket doors, `stream(topic, { after })` for the SSE door), so a door never
       changes between a single replica and N replicas: only the hub binding does. Three adapters implement the port:
       `MemoryRealtimeHub` (non-scale: one process, tests and a single-replica dev run, replay from an in-process ring buffer),
@@ -318,8 +345,16 @@ rules:
       replay reads the stream with XRANGE and resumes after the newest entry carrying the id; when the subscriber connection comes
       back the hub reloads each followed topic after the minimum last stream id of its open subscriptions, with the same per-subscription
       duplicate suppression and paused retry policy as Postgres; ioredis, every key and channel carries the
-      app prefix `REALTIME_REDIS_PREFIX`). The app selects the hub with `REALTIME_HUB=memory|postgres|redis`, parsed once by
-      `parseRealtimeConfig` and validated at boot; unset, the parser defaults to `redis` when `REALTIME_REDIS_URL` is declared (lite
+      app prefix `REALTIME_REDIS_PREFIX`). Only the Postgres hub can publish inside the domain transaction: pass that
+      transaction as `within` when the domain write and realtime table use the same database. Redis and memory push immediately,
+      even if a caller passes `within`; they do not defer delivery until commit. With either hub the domain service awaits its
+      successful transaction before calling `hub.publish(topic, frame)` without `within`. A rollback therefore publishes nothing;
+      a publish failure after commit cannot roll back the domain write, and the client resyncs through its membership-checked
+      snapshot query. A service whose hub binding can vary uses this after-commit sequence unless it is bound to Postgres.
+      The app selects the hub with `REALTIME_HUB=memory|postgres|redis`, parsed once by
+      `parseRealtimeConfig` in `platform/realtime/realtime-config.mapper.ts` (the unit-tested mapping role of BE-NAMING-1),
+      with its unit spec in `realtime-config.mapper.spec.ts`, and validated at boot; unset, the parser defaults to `redis`
+      when `REALTIME_REDIS_URL` is declared (lite
       and full), `postgres` when lite declares no Redis, and never `memory`, so a scaled deploy cannot fall back to the in-process
       hub unseen. All three
       adapters are legal in both editions; select `redis` when Redis is declared (lite with Redis, and full), `postgres` when it is
@@ -381,6 +416,18 @@ rules:
           RealtimeModule.register({ isGlobal: true, ...withConnection(options.realtime, ORDER_ENTITY_MANAGER, options.database.url) })
           // REALTIME_HUB=redis, the secret REALTIME_REDIS_URL, REALTIME_REDIS_DB (and REALTIME_REDIS_PREFIX when the server is shared);
           // Redis 7 or later for the sharded socket.io adapter.
+      - id: case-9
+        when: A domain service changes state with the Redis or memory hub, or a selectable hub binding
+        write: |-
+          Collect the frame and entitled recipients while committing the change; publish only after the awaited transaction
+          resolves. No publish runs inside its callback, so a rollback sends no frame:
+          const push = await this.entityManager.transaction(async (tx) => {
+            // Read current membership and write the domain change through tx; return its topic/frame pairs.
+            return pendingPushes
+          })
+          for (const { topic, frame } of push) await this.hub.publish(topic, frame)
+          Passing tx to the Redis or memory hub does not make its immediate push transactional. Postgres alone may use
+          hub.publish(topic, frame, tx) inside that transaction (case-2).
       - id: case-4
         when: GraphQL subscription, non-scale
         write: |-
@@ -449,8 +496,14 @@ rules:
       manual:
         - Confirm the ingress holds no sticky-session declaration for the api, and that polling is off in the socket.io client configuration.
         - Confirm a Postgres hub connects through a session-mode URL and that the realtime tables are migrations of the app.
+        - Prove a domain rollback publishes nothing; with Redis or memory, verify publish follows the awaited commit and a publish failure leaves the committed change intact.
     relatedExamples: [realtime]
 files:
+  - path: src/modules/domain/<capability>/<name>.policy.ts
+    slot: be.domain
+    role: The pure typed topic builder and frame predicate of BE-REALTIME-3, exported by the domain contract for publisher and door.
+    spec: src/modules/domain/<capability>/<name>.policy.spec.ts
+    optional: true
   - path: src/features/realtime/<channel>/index.ts
     slot: be.feature.realtime
     template: realtime/channel.index.ts.tpl
@@ -544,6 +597,12 @@ files:
     slot: be.platform
     role: RealtimeHub, the one port of the realtime kind (publish, subscribe, stream) and the typed topic; its three adapters are the files below.
     optional: true
+  - path: src/modules/platform/realtime/realtime-config.mapper.ts
+    slot: be.platform
+    template: realtime/realtime-config.mapper.ts.tpl
+    role: parseRealtimeConfig maps EnvSource to the hub options at boot; hub-selection logic is a covered mapper role.
+    spec: src/modules/platform/realtime/realtime-config.mapper.spec.ts
+    optional: true
   - path: src/modules/platform/realtime/memory-realtime-hub.service.ts
     slot: be.platform
     role: "MemoryRealtimeHub, the non-scale adapter: one process, tests and a single-replica dev run, replay from an in-process ring buffer."

package/runtime/modules/kernel/failure-codes.yaml

@@ -2348,6 +2348,16 @@ FE_DESTRUCTIVE_CONFIRM_IN_DIALOG:
   owner: op-retry
   kind: check-finding
 
+FE_DIVIDER_FULL_BLEED:
+  title: "Horizontal Grammar divider is inset by wrapper padding"
+  title_vi: "Divider bị padding ngang của wrapper làm thụt vào"
+  meaning_vi: "Divider ngang của Grammar phải dài full và sát viền surface."
+  causes_vi:
+    - "Wrapper chứa Divider có padding ngang"
+  nextStep_vi: "Chuyển padding vào các band nội dung cạnh Divider."
+  owner: "op-retry"
+  kind: "check-finding"
+
 FE_EFFECT_CLEANUP:
   title: "What an effect starts, its cleanup releases"
   title_vi: "Effect khởi động thứ không được dọn"

package/runtime/scripts/api/git/commit-tree.mjs

@@ -0,0 +1,5 @@
+// commit-tree.mjs — `git commit-tree <args>`: a commit object written from a tree (its sha on stdout).
+import { runGit } from './lib.mjs';
+
+/** The spawn result {status, stdout, stderr, error} of `git commit-tree ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
+export const commitTree = (args = [], options = {}) => runGit(['commit-tree', ...args], options);

package/runtime/scripts/api/git/update-ref.mjs

@@ -0,0 +1,8 @@
+// update-ref.mjs — `git update-ref [-m <message>] <ref> <sha> [<old>]`: point a ref at a commit (a preserved worktree's
+// refs/heads/preserved/<name>); with `old`, a compare-and-swap that fails when the ref no longer names `old`.
+import { gitRunner } from './lib.mjs';
+
+/** {ok, stdout, stderr}. message: the reflog line; old: the sha the ref must still name. git: the caller's runner or null. */
+export function updateRef(repoRoot, ref, sha, { message = null, old = null, git = null } = {}) {
+  return gitRunner(git)(['update-ref', ...(message ? ['-m', message] : []), ref, sha, ...(old ? [old] : [])], { cwd: repoRoot });
+}

package/runtime/scripts/api/git/write-tree.mjs

@@ -0,0 +1,5 @@
+// write-tree.mjs — `git write-tree <args>`: a tree object written from the index (its sha on stdout).
+import { runGit } from './lib.mjs';
+
+/** The spawn result {status, stdout, stderr, error} of `git write-tree ...args`; options are runGit's (cwd or dir, config, timeout, maxBuffer, input, encoding, env, git). */
+export const writeTree = (args = [], options = {}) => runGit(['write-tree', ...args], options);