@starci/hfs 4.7.44 → 4.7.46

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 4.7.46 - 2026-10-26
+
+- Changed: owner ruling push-main-after-scoped-check reaches product apps: the generated pre-push hook passes a fast-forward main push when the hooks pass and the secret scan is clean, a v* tag must be annotated, and app CI runs on pushes to main.
+- Changed: candidate-ci keeps only catalogued failure codes.
+
+## 4.7.45 - 2026-10-26
+
+- Changed: the alpha.31.1 round folded into alpha.31; the bundled canon pins and runtime copies follow the final package versions. No rule changes.
+
 ## 4.7.44 - 2026-10-26
 - Changed: the bundled canon pins follow the lint family bumps (canon-be 3.4.51, canon-fe 9.1.6, Grammar 0.12.10) and the bundled runtime copy carries the wave version. No rule changes.
 

package/lint/run.mjs

@@ -17,7 +17,7 @@
 // turbo `lint` task); the root `npm run lint` stays the whole app. There is no second linter: a workspace lint is this lint, scoped.
 import fs from 'node:fs';
 import path from 'node:path';
-import { createRequire, registerHooks } from 'node:module';
+import { createRequire } from 'node:module';
 import { spawn } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { linterReport, mergeReports, sonarReport, sourceRootsOf } from '../report/sonar.mjs';
@@ -168,17 +168,53 @@ export function canonScope(config) {
   };
 }
 
+/** The conditions the import below resolves with: `node` and `import`, plus `default` as exports' terminal fallback. */
+const IMPORT_CONDITIONS = new Set(['node', 'import', 'default']);
+
+/** The first import target of an exports entry: a string, a fallback array, or a conditions object matched in its own key order. */
+function exportsTarget(entry) {
+  if (typeof entry === 'string') return entry;
+  if (Array.isArray(entry)) {
+    for (const item of entry) {
+      const target = exportsTarget(item);
+      if (target !== null) return target;
+    }
+  } else if (entry !== null && typeof entry === 'object') {
+    for (const [condition, target] of Object.entries(entry)) {
+      if (IMPORT_CONDITIONS.has(condition)) {
+        const resolved = exportsTarget(target);
+        if (resolved !== null) return resolved;
+      }
+    }
+  }
+  return null;
+}
+
+/** The import entry of a package found by the app's own node_modules lookup (the folders require.resolve.paths lists from cwd). */
+function importEntry(require, packageName) {
+  for (const dir of require.resolve.paths(packageName) ?? []) {
+    const manifest = path.join(dir, packageName, 'package.json');
+    if (!fs.existsSync(manifest)) continue;
+    const published = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+    if (published.exports === undefined) return path.join(dir, packageName, published.main ?? 'index.js');
+    const exports = published.exports;
+    const entry = exports !== null && typeof exports === 'object' && !Array.isArray(exports)
+      && Object.keys(exports).some((key) => key.startsWith('.')) ? exports['.'] : exports;
+    const target = exportsTarget(entry);
+    if (target === null) throw new Error(`no "exports" import target for "." in ${manifest}`);
+    const file = path.join(dir, packageName, target);
+    if (!fs.existsSync(file)) throw new Error(`the "exports" import target of ${manifest} does not exist: ${target}`);
+    return file;
+  }
+  throw new Error(`Cannot find package '${packageName}'`);
+}
+
 /** Resolve one canon from this app's install; a package from an enclosing repository cannot prove its lint contract. */
-function ownCanonEntry({ repoRoot, cwd }, packageName) {
+export function ownCanonEntry({ repoRoot, cwd }, packageName) {
   const require = createRequire(path.join(cwd, 'package.json'));
-  // The entry is imported below, so resolve with Node's import conditions even when a package publishes no require target.
-  // The synchronous hook exists only for this lookup; later package resolution keeps its own conditions.
-  const hook = registerHooks({ resolve: (specifier, context, nextResolve) => nextResolve(specifier, specifier === packageName
-    ? { ...context, conditions: [...new Set([...context.conditions.filter(condition => condition !== 'require'), 'import'])] }
-    : context) });
-  let entry;
-  try { entry = require.resolve(packageName); }
-  finally { hook.deregister(); }
+  // The entry is imported below, so the package's import condition applies; require.resolve cannot be told so on every
+  // supported Node (its registerHooks resolve hook skips require.resolve before Node 24), so "." is matched directly.
+  const entry = importEntry(require, packageName);
   // The canon must be the app's own install: resolved inside the app root, or inside the app's node_modules when that folder is a link to the install
   // (the runtime's examples lint in a sealed copy whose node_modules links the example's own install, scripts/hfs/example-secrets.mjs).
   const ownInstall = [repoRoot, path.join(repoRoot, 'node_modules')].filter((dir) => fs.existsSync(dir)).map((dir) => fs.realpathSync(dir));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.44",
+  "version": "4.7.46",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",
@@ -16,6 +16,8 @@
     "smol-toml": "1.9.0"
   },
   "devDependencies": {
+    "@typescript-eslint/eslint-plugin": "8.71.0",
+    "@typescript-eslint/parser": "8.71.0",
     "@graphql-codegen/cli": "7.4.6",
     "@graphql-codegen/client-preset": "6.2.3",
     "@nestjs/common": "11.2.5",
@@ -23,6 +25,7 @@
     "@nestjs/graphql": "13.4.5",
     "@nestjs/testing": "11.2.5",
     "class-validator": "0.15.1",
+    "eslint": "10.11.0",
     "graphql": "16.14.2",
     "prettier": "3.9.6",
     "reflect-metadata": "0.2.2",

package/release/candidate-ci.mjs

@@ -2,9 +2,9 @@
 // red, with the owner confirming afterwards"). The push sends the exact release sha to refs/heads/release/candidate-<version> first (the managed ci.yml triggers on
 // release/candidate-*), waits for the ci.yml run of THAT sha, and moves the default branch and the tag only when it is green:
 //   green     the newest non-cancelled run of the sha concluded success and none of its jobs was skipped
-//   red       RELEASE_CANDIDATE_CI_RED (a run or a job that concluded skipped is red, never a pass: owner ruling 2026-10-22, a skip is a loosening) with the run URL and the failing jobs and steps; nothing reaches the default branch. The candidate ref stays for diagnosis
-//   timeout   RELEASE_CANDIDATE_CI_TIMEOUT: no run listed within the grace (a queued run is listed), or it did not end within the wait
-//   unknown   RELEASE_CI_UNKNOWN: GitHub could not be read to the end; a release never proceeds blind
+//   red       "candidate CI red" (a run or a job that concluded skipped is red, never a pass: owner ruling 2026-10-22, a skip is a loosening) with the run URL and the failing jobs and steps; nothing reaches the default branch. The candidate ref stays for diagnosis
+//   timeout   "candidate CI timeout": no run listed within the grace (a queued run is listed), or it did not end within the wait
+//   unknown   candidate CI unknown: GitHub could not be read to the end; a release never proceeds blind
 // There is no override: a red candidate never passes (owner ruling 2026-10-22: a loosening is always red).
 // Every process goes through ctx.spawn (git, gh); the wait through ctx.sleep and ctx.now.
 
@@ -95,9 +95,9 @@ export async function candidateStep(ctx, { head, tag, prefix, remote, wait = CAN
   if (seen.state === 'red') {
     const failing = failingJobs(ctx, seen.run);
     const detail = failing.length ? failing.join('; ') : 'the failing jobs could not be read';
-    return { ok: false, lines: [...lines, `RELEASE_CANDIDATE_CI_RED: the ci.yml run of ${head.slice(0, 10)} on ${ref} is red${url}; failing: ${detail}. Nothing reached the default branch; the candidate ref stays for diagnosis`], data: { ref, state: 'red', run: seen.run, failing } };
+    return { ok: false, lines: [...lines, `candidate CI red: the ci.yml run of ${head.slice(0, 10)} on ${ref} is red${url}; failing: ${detail}. Nothing reached the default branch; the candidate ref stays for diagnosis`], data: { ref, state: 'red', run: seen.run, failing } };
   }
-  if (seen.state === 'unstarted') return { ok: false, lines: [...lines, `RELEASE_CANDIDATE_CI_TIMEOUT: no ci.yml run started for ${head.slice(0, 10)} on ${ref} within ${wait.graceMinutes} minutes (does .github/workflows/ci.yml trigger on release/candidate-*? run starci app sync)`], data: { ref, state: 'unstarted' } };
-  if (seen.state === 'timeout') return { ok: false, lines: [...lines, `RELEASE_CANDIDATE_CI_TIMEOUT: the ci.yml run of ${head.slice(0, 10)} did not end within ${wait.waitMinutes} minutes${url}`], data: { ref, state: 'timeout', run: seen.run } };
-  return { ok: false, lines: [...lines, `RELEASE_CI_UNKNOWN: GitHub could not be read for the candidate ${head.slice(0, 10)} on ${ref}; a release never proceeds blind`], data: { ref, state: 'unknown' } };
+  if (seen.state === 'unstarted') return { ok: false, lines: [...lines, `candidate CI timeout: no ci.yml run started for ${head.slice(0, 10)} on ${ref} within ${wait.graceMinutes} minutes (does .github/workflows/ci.yml trigger on release/candidate-*? run starci app sync)`], data: { ref, state: 'unstarted' } };
+  if (seen.state === 'timeout') return { ok: false, lines: [...lines, `candidate CI timeout: the ci.yml run of ${head.slice(0, 10)} did not end within ${wait.waitMinutes} minutes${url}`], data: { ref, state: 'timeout', run: seen.run } };
+  return { ok: false, lines: [...lines, `candidate CI unknown: GitHub could not be read for the candidate ${head.slice(0, 10)} on ${ref}; a release never proceeds blind`], data: { ref, state: 'unknown' } };
 }

package/release/push.mjs

@@ -1,8 +1,8 @@
 // push.mjs - `starci app release push`: sends the default branch and the release tag to the remote in ONE atomic push through the repository's own
-// pre-push hook (never --no-verify). It requires what the hook requires: an annotated release tag on HEAD and the L4 record of the gate for that
+// pre-push hook (never --no-verify). The explicit release command requires an annotated release tag on HEAD and the L4 record of the gate for that
 // head and tag. `git push --dry-run --atomic` always runs first (the hook's verdict is the proof) and any failure refuses the push.
 // With --execute the exact sha first goes to its candidate ref refs/heads/release/candidate-<version> and the push waits for the ci.yml run of that sha
-// (candidate-ci.mjs, OWNER RULING candidate-ci 2026-10-18): only a green candidate (or the owner's sha-bound override record) moves the branch and the tag.
+// (candidate-ci.mjs, OWNER RULING candidate-ci 2026-10-18): only a green candidate moves the branch and the tag.
 // That wait runs only for an app that sets release.requireCi: true; the default false (owner ruling release-require-ci-per-project) pushes after the
 // local gate and the dry run alone and says so. The tag, the L4 record and the dry run are never skipped.
 import fs from 'node:fs';
@@ -21,7 +21,7 @@ function readRecord(file) {
 const greenRecord = (record, head, tag) => record?.head === head && record?.tag === tag
   && Array.isArray(record.gates) && record.gates.length > 0 && record.gates.every((gate) => gate?.pass === true);
 
-/** The release gate as the hook reads it: the annotated tag on HEAD whose L4 record names head and tag. Returns { tag } or { reason }. */
+/** The explicit release command gate: the annotated tag on HEAD whose L4 record names head and tag. Returns { tag } or { reason }. */
 function gateState(ctx, head, prefix, expected) {
   const tags = annotatedOnHead(ctx, prefix);
   if (!tags.includes(expected)) return { reason: `no ANNOTATED tag ${expected} (the package.json version) on HEAD${tags.length > 0 ? `, which carries ${tags.join(', ')}` : ''}: run starci app release gate --execute first` };

package/runtime/config.example.yaml

@@ -38,8 +38,9 @@ parallel: {gear: 1}
 # kernel (docs/supervisor.md) also takes, optional, defaults in home.mjs DEFAULTS:
 #   kernel: {agent, model, effort}   its agent pin (default: the kernel pin below)
 #   workers: {base, max}             the adaptive [Worker] cap, 0 to 10 (0 = the Supervisor runs no fix worker)
-#   landGate: {mode: shared}         shared lets running lanes commit directly; exclusive = gate only. A land
-#                                    fast-forwards LOCAL main only: the remote main moves with a release (starci release cut)
+#   landGate: {mode: shared, push: true}  shared lets running lanes commit directly; exclusive = gate only. A land
+#                                    fast-forwards LOCAL main; main reaches the remote right after a green scoped check through
+#                                    `starci release push` (push: true, the default; false locks the remote). CI is the critic.
 supervisor:
   # mode: chat (default) - the owner's desktop chat session is the Supervisor: it owns channel 'main'
   #   and reads Decision Items; nothing starts a [Supervisor] kernel. kernel - the optional [Supervisor]
@@ -49,7 +50,7 @@ supervisor:
   pollIntervalMs: null
   repos: []
   # frozenMinutes: <n>   # Host seat check: a busy frame unchanged this long is frozen, not busy
-  # landGate: {mode: shared|exclusive}
+  # landGate: {mode: shared|exclusive, push: true|false}
 # delegation — while the owner is away, a named delegate (e.g. the supervisor chat) may
 # answer owner asks until the given time; excluded classes stay owner-only. null = none.
 #   delegation: {asks: supervisor, until: 2026-09-23T09:00:00+07:00,
@@ -185,11 +186,9 @@ sonar: {organization: null}
 #   minFreeRamPct  free-RAM percentage below which no new heavy op starts
 # set them only in the gitignored config.yaml copy, e.g.
 #   resources: {minFreeDiskGb: 5, minFreeDiskPct: 1, minFreeRamPct: 10}
-# release - where the Linux parity of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
-#   suite: local   the shipped default: `starci release cut` runs the root rows (npm run test:packages, npm run test:e2e, npm run check) and the Linux parity container before it pushes,
-#                  and the pre-push gate asks for the green root rows
-#   suite: ci      the owner's recorded choice (2026-10-09): no local Linux container; the GitHub ci workflow runs the Linux parity (and SonarCloud) AFTER the push.
-#                  The cut still runs the same root rows and the example apps; the record lists linux-parity as delegated, never green.
-#                  A release can reach GitHub and its tag before the Linux parity has run; a red CI is fixed forward with the next pre-release (starci release ci-status).
-# "none" is refused: the Linux parity does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
+# release - where the full suite of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
+#   suite: local   the shipped default: `starci release cut` also runs the L4 rows on this host (root rows, example apps, Sonar proofs, Linux parity container) before it tags; it never gates a push
+#   suite: ci      the owner's recorded choice (2026-10-09, widened 2026-10-26 by push-main-after-scoped-check): EVERY row is judged by the GitHub workflows (ci, examples, sonar) on each push to main;
+#                  the cut runs none and lists each row as delegated, never green. A red CI opens the next alpha.N.M and never blocks the next push (starci release ci-status).
+# "none" is refused: the suite does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
 release: {suite: local}

package/runtime/engine/config.mjs

@@ -294,13 +294,13 @@ const validateSupervisorBlock=(supervisor,profile)=>{
     throw new Error('Invalid config.yaml: supervisor.mode must be chat or kernel, or null.');
   // The [Supervisor] kernel seat (scripts/machine/home.mjs supervisorSettings): kernel {agent?, model?, effort?}
   // pins its agent (default: the kernel pin), workers {base?, max?} its adaptive [Worker] cap (0 to 10; the shipped default is 0 fix workers),
-  // landGate {mode?: shared|exclusive} the land gate (scripts/supervisor/land.mjs).
+  // landGate {mode?: shared|exclusive, push?: boolean} the land gate (scripts/supervisor/land.mjs); push (default true, owner ruling push-main-after-scoped-check) lets `starci release push` send main to the remote after a green scoped check, false is the owner's lock on the remote.
   const seat=supervisor.kernel,workers=supervisor.workers,gate=supervisor.landGate;
   if(seat!==undefined&&seat!==null)validateAgentSeat(seat,'supervisor.kernel',profile);
   if(!(workers===undefined||workers===null||(plain(workers)&&Object.keys(workers).every(key=>['base','max'].includes(key)&&Number.isInteger(workers[key])&&workers[key]>=0&&workers[key]<=10))))
     throw new Error('Invalid config.yaml: supervisor.workers must be {base?, max?} integers from 0 to 10, or null.');
-  if(!(gate===undefined||gate===null||(plain(gate)&&Object.keys(gate).every(key=>key==='mode'&&['shared','exclusive'].includes(gate.mode)))))
-    throw new Error('Invalid config.yaml: supervisor.landGate must be {mode?: shared|exclusive}, or null.');
+  if(!(gate===undefined||gate===null||(plain(gate)&&Object.keys(gate).every(key=>(key==='mode'&&['shared','exclusive'].includes(gate.mode))||(key==='push'&&typeof gate.push==='boolean')))))
+    throw new Error('Invalid config.yaml: supervisor.landGate must be {mode?: shared|exclusive, push?: boolean}, or null.');
   // stallMinutes: scripts/supervisor/stall.mjs calls a running workflow STALLED after this many minutes with no progress.
   // frozenMinutes: scripts/supervisor/supervisor-watchdog.mjs reads a busy seat frame with no turn progress for this long as frozen.
   const frozen=supervisor.frozenMinutes;

package/runtime/engine/release-config.mjs

@@ -3,14 +3,14 @@ import {invalid} from './invalid-config.mjs';
 
 /** The keys of the release block. */
 export const RELEASE_KEYS=Object.freeze(['suite']);
-/** Where the full test suite of a release is judged: `local` (the release cut runs it, the shipped default) or `ci` (the GitHub workflow runs it after the push; the cut runs only the affected specs of the release and the rows CI cannot run). */
+/** Where the full test suite of a release is judged: `local` (the release cut also runs the L4 rows before it tags, the shipped default) or `ci` (the GitHub workflows judge EVERY row on each push to main; the cut runs none). */
 export const SUITE_MODES=Object.freeze(['local','ci']);
-export const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
+const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
 
 /**
- * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped
- * default: `starci release cut` runs the root suite and the Linux parity container before it pushes. `ci` is the owner's recorded choice (2026-10-09) that
- * the full suite runs on GitHub only: the cut runs no root suite and no Linux container, and the CI workflow's verdict is read afterwards (`starci release ci-status`).
+ * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped default: `starci release cut` also runs the
+ * L4 rows on this host before it tags. `ci` is the owner's recorded choice (2026-10-09, widened 2026-10-26 by push-main-after-scoped-check): the full suite runs on GitHub only, on every push
+ * to main; the cut runs no row and the verdict is read with `starci release ci-status`. The push of main needs neither mode: it needs a green scoped check.
  * `none` is refused: the suite does not vanish, it moves to CI, and the value says so.
  */
 export function validateRelease(release){

package/runtime/knowledge/grammars/offset-pop/playbook.yaml

@@ -253,7 +253,7 @@ guidance:
       a family where selection, current and focus share the same pink.
   - id: big-touch-targets
     requirement: |
-      Keep the published sizes: Common's 44px floor for controls, the Subnav toggle and the TopBar
+      Keep the published sizes: Common's 40px control height for controls, the Subnav toggle and the TopBar
       trigger, and `size="control"` throughout the navbar. Do not shrink them with app classes,
       and put answer choices in RadioGroup/CheckboxGroup/SegmentedControl rather than small
       custom chips.

package/runtime/knowledge/grammars/starci/playbook.yaml

@@ -185,9 +185,19 @@ shapes:
       - id: navbar-controls
         implements: [FE-APP-SHELL-2]
         compose: |
-          Every bar control uses `size="control"`, the 2.75rem shared height. Icon uses the family
+          Every bar control uses `size="control"`, the 2.5rem (40px) shared height. Icon uses the family
           size-5 token (20px) throughout the region. SearchField or its trigger shows Ctrl K and opens
-          on Ctrl/Cmd+K; inside a surface its variant resolves through the nesting context.
+          on Ctrl/Cmd+K; inside a surface its variant resolves through the nesting context. A compact
+          language switch in a bar is SegmentedControl size="control" (the HeroUI lg group held to
+          2.75rem); md and lg keep HeroUI's own sizes.
+      - id: site-chrome-bar
+        implements: [FE-APP-SHELL-3]
+        compose: |
+          A public site composes its bar inside the flow shell, in one module (the scaffold SiteShell):
+          WorkspaceShell viewport="flow" header={TopBar brand navigation actions}. navigation is a
+          NavLandmark layout="bar" of TextAction links; actions is the language SegmentedControl
+          size="control", then the sign-in Button intent="neutral" and the call-to-action Button, all
+          size="control". The app right cluster (menu, theme Switch, bell, account) is for the app shell only.
       - id: workspace-identity
         implements: [FE-APP-SHELL-2]
         compose: |
@@ -240,7 +250,7 @@ shapes:
           scrolls independently. Groups use translated headings such as Main, Operations and Settings
           from modules/i18n/messages/app-shell.yaml. The expanded item has a size-5 icon, label and
           Grammar current-page treatment. A keyboard-accessible toggle collapses it into icon-only
-          destinations with size-5 icons in 2.75rem targets, current-page highlighting, count badges
+          destinations with size-5 icons in 2.5rem targets, current-page highlighting, count badges
           and hover/focus tooltips. Group order is stable, spacing replaces group headings and
           settings-type groups stay at the end. The application persists collapse state per user.
       - id: conversation-panel
@@ -323,6 +333,20 @@ imageryClarification:
     library-edit scope. Historical image notes are design references, not decisions for the current
     product.
 guidance:
+  - id: owner-ui-rulings-alpha-31
+    ownership: FE-RULE-OWNERSHIP
+    implements: [COLLECTION-1, LAYOUT-1, SURFACE-1, ACTION-3, CTA-6]
+    requirement: |
+      The canonical cases own the rule bodies; this entry only points to them. COLLECTION-1 case-9
+      (owner:selection-fill-no-check): navigation-like single selection uses ListBox
+      selectionIndicator="none", with the selectedKeys and accessibility contract unchanged.
+      LAYOUT-1 case-10 (owner:joined-multi-pane): the selected family realizes one touching pane
+      surface with vertical Dividers. SURFACE-1 case-4 (owner:scroll-region-background-tone):
+      VerticalScrollRegion tone="background" under messages and log entries, with the header and
+      composer on the surface. ACTION-3 case-5 (owner:hover-actions-floating-toolbar): ChatBubble's
+      public floating toolbar owns the IconButtons and tooltips beside the text; apps do not target
+      starci-core internals. CTA-6 case-4 (owner:button-variant-follows-intent): ordinary repeated
+      item commands are neutral and render ghost.
   - id: nested-controls-and-panel-lists
     ownership: FE-RULE-OWNERSHIP
     implements: [ANATOMY-2, PADDING-0]

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -22,36 +22,43 @@ pins:
     side: fe
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
+  '@starci/event-stream':
+    version: 0.1.0
+    group: starci
+    install: registry
+    side: fe
+    source: packages/event-stream/package.json
+    why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.12.10
+    version: 0.12.13
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.51
+    version: 3.4.55
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.6
+    version: 9.1.9
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.10
+    version: 0.12.13
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.10
+    version: 0.12.13
     group: starci
     install: registry
     side: fe
@@ -91,14 +98,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.44
+    version: 1.7.46
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.44
+    version: 4.7.46
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/ci-standard.yaml

@@ -34,7 +34,7 @@ heap:
 items:
   - id: candidate-trigger
     title: the release CI runs on the release candidate ref
-    requires: "ci.yml runs on push of branches ['release/candidate-*'] and tags ['v*'] (and workflow_dispatch); the release flows wait for the run of the release sha there"
+    requires: "ci.yml runs on push of branches ['main', 'release/candidate-*'] and tags ['v*'] (and workflow_dispatch); the release flows wait for the run of the release sha there"
     covers: [app-ci, runtime]
     by: [R221 CI_TRIGGERS_RELEASE_ONLY, R251 HFS_APP_WORKFLOW_TRIGGER]
   - id: job-shape

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -82,7 +82,18 @@ concerns:
     home: [fe.hooks.socketio]
     pattern: FE-REALTIME
     forbids: [subscriptions-transport-ws, '@supabase/realtime-js', pusher-js, ably]
-    why: one socket.io-client singleton per namespace and one side-effect component that dispatches to redux and SWR; both editions run the gateway in the be api process. A one-way channel served as server-sent events needs no package, only a stream reader in modules/api/sse/clients, a stream operation in modules/api/sse and a useSubscribe<Channel>Swr hook (FE-REALTIME).
+    why: one socket.io-client singleton per namespace and one side-effect component that dispatches to redux and SWR; both editions run the gateway in the be api process. A one-way channel served as server-sent events is the event-stream concern below (FE-REALTIME).
+  - id: event-stream
+    tier: opt
+    packages: ['@starci/event-stream']
+    home: [fe.transport.stream]
+    pattern: FE-REALTIME
+    forbids: ['@microsoft/fetch-event-source', eventsource, event-source-polyfill, eventsource-parser, reconnecting-eventsource, 'sse.js', 'fetch-sse', 'sse-ts']
+    why: >-
+      the one server-sent-events client (owner:event-stream-package): the app creates one instance in modules/api/sse/clients/event-stream.ts
+      with createEventStream (the bearer token source, one renewal on a 401, backoff, heartbeat timeout), each stream operation
+      (sse/<area>/stream-<channel>.ts) follows on it, and the useSubscribe<Channel>Swr hook reads that operation. No app keeps a
+      hand-written reader (read-event-stream.ts) and no second SSE library is installed.
   - id: auth
     tier: core
     packages: []

package/runtime/knowledge/hfs/rules.yaml

@@ -20,7 +20,7 @@ schema: starci/hfs-rules@3
 version: 3.1.0
 gates:
   pre-commit: the managed L0 hook runs app hygiene, managed-file drift, ESLint per side and stylelint on staged source, and prettier on staged files; typecheck and targeted specs belong to the op gate under R225
-  pre-push: the managed app hook validates an annotated release tag and the recorded L4 evidence for HEAD, permitting the release refs and backup namespace under R225; it starts no source check, build or test
+  pre-push: the managed app hook invokes the bundled push policy under R225; it starts no source check, build or test
   settle: the op gate `starci gate run` over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
   land: the workflow's finish, the only time main is touched - gate.mjs over the whole workflow branch against its merge-base with main, the merge guard, review.verify of the exact head that lands, the branch rebased onto main, then main fast-forwarded and pushed
   ci: GitHub Actions runs the same pinned starci app lint, format:check, typecheck, unit with the per-file coverage threshold, build:be and build:fe, then the Sonar scan and gate
@@ -3850,7 +3850,7 @@ rules:
       - {path: packages/hfs/src/hfs-supabase-secrets.spec.mjs, edition: lite}
   - id: R221
     code: "CI_TRIGGERS_RELEASE_ONLY"
-    law: "The only workflow triggers are a push of release tags, a push of release candidate branches `release/candidate-*`, a person dispatching it and, in the runtime's own workflows (`.github/workflows/` at the root), a push to `main`: every tracked workflow declares an `on` that holds only `push` filtered to `tags: ['v*']` and/or `branches` naming only `release/candidate-*` (and, in the runtime's own workflows, `main`; no paths or ignore filter beside them) and `workflow_dispatch`. Every `ci.yml`, and the runtime's `examples.yml`, must name `release/candidate-*`: `starci release cut` and `starci app release push` push the exact release sha there and move main and the tag only when that run is green (owner ruling candidate-ci, 2026-10-18). A push to any other branch, a pull_request, a schedule, a workflow_call or any other event refuses the workflow."
+    law: "Workflow triggers are push filtered to v* tags or release/candidate-* branches, and workflow_dispatch. Runtime workflows and app ci.yml also admit main. App ci.yml includes the candidate branch filter for starci app release push. Other branches, events, path filters and ignore filters are refused."
     scope: runtime
     editions: [lite, full]
     docs: [docs/git-governance.md#r221]
@@ -3894,7 +3894,7 @@ rules:
       - {kind: runtime, id: protected-zone, at: scripts/hfs/runtime-rules/rights-policy.mjs}
   - id: R225
     code: "RT_HOOK_SHAPE"
-    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags; the runtime's own hook is scripts/guards/release-push-gate.mjs, which judges main and v* tags against the release definition and lets every other ref through) and runs no npm test, jest, typecheck or lint."
+    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck or test run); pre-push invokes the bundled scripts/guards/release-push-gate.mjs policy for fast-forward main, a clean outgoing secret scan and annotated v* tags. It runs no build, test, typecheck or lint."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -4269,7 +4269,7 @@ rules:
     editions: [lite, full]
     docs:
       - {path: docs/application-stacks.md#r251-deploy-workflow, editions: [lite, full]}
-    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*], the release candidate branches release/candidate-* (required in ci.yml: starci app release push waits for that run, owner ruling candidate-ci 2026-10-18) or workflow_dispatch, never on another branch push."
+    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*], the release candidate branches release/candidate-* (required in ci.yml: starci app release push waits for that run, owner ruling candidate-ci 2026-10-18) or workflow_dispatch; ci.yml also runs on main, and other branch pushes are refused."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DEPLOY_WORKFLOW", "HFS_WORKFLOW_PIN", "HFS_CI_TOOL_INSTALL", "HFS_APP_WORKFLOW_TRIGGER"]
@@ -5576,23 +5576,32 @@ rules:
     templateNa: "The app composes its shell from product destinations and identity; full and lite example shells provide the reference."
   - id: R318
     code: "FE_NESTED_VARIANT"
-    law: "Apps compose Grammar with layout-only CSS; paint utilities, arbitrary paint properties and inline style paint belong to Grammar. Grammar context owns all layer-aware field variants, nested Tabs defaults and the content edge of panel lists; apps omit static field variants, do not force primary Tabs inside a painted surface, do not paint raw surfaces, and add no horizontal list-wrapper padding within the nearest painted Grammar surface."
+    law: "Apps compose Grammar with layout-only CSS; paint utilities, arbitrary paint properties and inline style paint belong to Grammar. Grammar context owns all layer-aware field variants, nested Tabs defaults and the content edge of panel lists; apps omit static field variants, do not force primary Tabs inside a painted surface, do not paint raw surfaces, and add no horizontal list-wrapper padding within the nearest painted Grammar surface. BOUNDARY-1 case-5 owns Divider full-bleed composition. Navigation-like single-select lists use fill without checks (COLLECTION-1 case-9); application styles never target Grammar internal classes (ACTION-3 case-5)."
     kinds: [lint, design]
     gates: [pre-commit, settle, land, ci]
-    failureCodes: ["FE_NESTED_VARIANT", "FE_LIST_PANEL_PADDING", "FE_GRAMMAR_LAYOUT_ONLY"]
+    failureCodes: ["FE_NESTED_VARIANT", "FE_LIST_PANEL_PADDING", "FE_GRAMMAR_LAYOUT_ONLY", "FE_DIVIDER_FULL_BLEED"]
     enforcers:
       - {kind: eslint-fe, id: nested-control-variant}
       - {kind: eslint-fe, id: no-list-panel-padding}
       - {kind: eslint-fe, id: no-app-surface-paint}
+      - {kind: eslint-fe, id: divider-full-bleed}
+      - {kind: eslint-fe, id: selection-fill-no-check}
+      - {kind: eslint-fe, id: no-grammar-internal-selector}
     editions: [lite, full]
     docs: ["docs/code-pattern-enforcement.md#r318-app-grammar-composition"]
     templateNa: "Product composition is proved by the FE canon's Grammar import and surface fixtures; a template cannot choose product slots or lists."
     proves:
+      - {path: packages/eslint/fe/divider-full-bleed.spec.mjs, editions: [lite, full], codes: [FE_DIVIDER_FULL_BLEED]}
       - {path: packages/eslint/fe/surface-rules.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_LIST_PANEL_PADDING, FE_GRAMMAR_LAYOUT_ONLY]}
+      - {path: packages/eslint/fe/ui-rulings.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_GRAMMAR_LAYOUT_ONLY]}
     exemplifiedBy:
+      - {path: packages/eslint/fe/divider-full-bleed.spec.mjs, editions: [lite, full], codes: [FE_DIVIDER_FULL_BLEED]}
       - {path: packages/eslint/fe/surface-rules.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_LIST_PANEL_PADDING, FE_GRAMMAR_LAYOUT_ONLY]}
+      - {path: packages/eslint/fe/ui-rulings.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_GRAMMAR_LAYOUT_ONLY]}
     witness:
+      - {path: packages/eslint/fe/divider-full-bleed.spec.mjs, editions: [lite, full], codes: [FE_DIVIDER_FULL_BLEED]}
       - {path: packages/eslint/fe/surface-rules.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_LIST_PANEL_PADDING, FE_GRAMMAR_LAYOUT_ONLY]}
+      - {path: packages/eslint/fe/ui-rulings.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_GRAMMAR_LAYOUT_ONLY]}
     cases:
       - id: case-1
         date: "2026-10-25"
@@ -5629,3 +5638,29 @@ rules:
         source: owner
         quote: "Critique this carefully so the button choice is a system and not a feeling, understand? Update .claude."
         ruling: "The button variant follows the declared intent (owner ruling button-variant-follows-intent): the app passes intent and step, Grammar derives the variant from them and from the placement it reads from React context. The semantics are HeroUI's, so the lint is universal in the FE canon."
+
+  - id: R320
+    code: "FE_CONTROL_HEIGHT"
+    law: "One 40px control height is the default of every standalone control (CONTROL-HEIGHT-1): an app never picks a larger size than the default outside a landing hero call to action, and controls of one row share one size."
+    kinds: [lint, design]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["FE_CONTROL_HEIGHT"]
+    enforcers:
+      - {kind: eslint-fe, id: control-height}
+    editions: [lite, full]
+    docs:
+      - packages/eslint/fe/docs/control-height.md
+      - docs/code-pattern-enforcement.md#r320-control-height
+    proves:
+      - {path: packages/eslint/fe/control-height.spec.mjs, editions: [lite, full], codes: [FE_CONTROL_HEIGHT]}
+    exemplifiedBy:
+      - {path: packages/eslint/fe/control-height.spec.mjs, editions: [lite, full], codes: [FE_CONTROL_HEIGHT]}
+    witness:
+      - {path: packages/eslint/fe/control-height.spec.mjs, editions: [lite, full], codes: [FE_CONTROL_HEIGHT]}
+    templateNa: "The control height is Grammar's own value; a template states no size."
+    cases:
+      - id: case-1
+        date: "2026-10-26"
+        source: owner
+        quote: "The size of the buttons and controls is uneven; the teacher thinks height = 40px (h-10) should be fixed for every button, switch, input, tabs and so on, what do you think? (translated from Vietnamese)"
+        ruling: "One 40px control height is the default of every standalone control (owner ruling control-height-40): Grammar draws it, an app omits size, sm is for a nested item or dense toolbar row, lg only for a landing hero call to action, and controls of one row share one size."

package/runtime/knowledge/hfs/slots.yaml

@@ -305,7 +305,7 @@ ruleParams:
       - {typeSuffix: Options, names: [options], nameSuffix: Options}
     # R89 BE_SOURCE_FORM: the closed role-suffix vocabulary of a source file name (<kebab-name>.<suffix>.ts; BE-CONVENTION 1.15)
     # and the suffixes that are never a role. index.ts, main.ts, app.module.ts and the migrations of be.persistence are the
-    # only names outside it.
+    # only names outside it. Typed realtime topic builders use the existing policy role (BE-REALTIME-3 of knowledge/patterns/be/realtime.yaml).
     suffixes: [module, module-definition, decorators, options, config, connection, service, schema, command, query, handler, templates, compensation, saga-state, saga-step, saga, contracts, port, resolver, controller, gateway, webhook, subscription, consumer, cli, event, queue, projection, projection-entity, processor, step, input, type, args, request, response, mapper, policy, entity, sql, rows, error, messages, log-events, cache-keys, guard, interceptor, filter, client, adapter, spec, integration-spec, e2e-spec, contract-spec, global-setup, builder]
     # R47 BE_CONTRACT_UNGUARDED: the world's shape vocabulary. `helper` names the function a contract spec imports to erase the values of a JSON
     # payload (`shapeOf`); a contract spec proves a fake's fixtures by asserting helper(real) equals helper(fixture).
@@ -1617,7 +1617,7 @@ slots:
     requires: [index.ts]
     # <name>.templates.ts holds the capability's static templates, copy and presets as TS constants (owner ruling 2026-10-13);
     # user-editable ones are seed rows, large or user media live in object storage.
-    allows: ["<capability>.module.ts", "<capability>.module-definition.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts", "*.schema.ts", "*.schema.spec.ts"]
+    allows: ["<capability>.module.ts", "<capability>.module-definition.ts", "<capability>.config.ts", "<capability>.options.ts", errors/, messages/, persistence/, policies/, "*.service.ts", "*.service.spec.ts", "*.contracts.ts", "*.templates.ts", "*.schema.ts", "*.schema.spec.ts", "*.policy.ts", "*.policy.spec.ts"]
     forbids: [testing/, exceptions/, utils/, helpers/, shared/]
     tests: unit-beside            # <name>.service.spec.ts beside each <name>.service.ts, nothing else
     coverage: required
@@ -2336,8 +2336,8 @@ slots:
     # The browser's calls to the back end (owner ruling 2026-10-13, fe-stack graphql/rest/codegen, FE-API-GRAPHQL): the auth and
     # no-auth Apollo clients with their link chain (graphql/clients), one file per operation (graphql/queries/query-<x>.ts,
     # graphql/mutations/mutation-<x>.ts and graphql/subscriptions/subscription-<x>.ts, each with its gql document map and typed request/response in types/), the generated wire types
-    # (graphql/__generated__), the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints and the fetch readers of
-    # server-sent-events streams (sse/<area>/stream-<channel>.ts, one operation per stream, run on the stream reader of sse/clients). A repository has
+    # (graphql/__generated__), the axios calls (rest/<area>/*.ts) for uploads, presigned URLs and auth endpoints and the
+    # server-sent-events streams (sse/<area>/stream-<channel>.ts, one operation per stream, run on the app's @starci/event-stream instance in sse/clients). A repository has
     # exactly ONE client folder and ONE GraphQLResponse union: the app's (fe.transport.client/outcome) when one app calls the back end,
     # or the api package's (fe.package.api.client/outcome) when several do (FE_TRANSPORT_OWNER, machine).
     requires: [index.ts]
@@ -2381,7 +2381,7 @@ slots:
     tier: transport
     allows: ["*.ts"]
     tests: none
-    why: "the fetch reader of server-sent-events streams of the one app that calls the back end, the stream half of the transport client layer (FE-REALTIME): it opens the stream with the bearer access token, parses the events and reopens it with Last-Event-ID after a capped, doubling wait; a stream operation (sse/<area>/stream-<channel>.ts) runs on it and a useSubscribe hook of hooks/swr reads that operation; a fetch here asks for text/event-stream and only a stream operation imports the reader (FE_TRANSPORT_OWNER); a repository where several apps stream keeps one reader in each of them"
+    why: "the event-stream client of the one app that calls the back end, the stream half of the transport client layer (FE-REALTIME): event-stream.ts creates the app's one @starci/event-stream instance (createEventStream with the bearer access token source, which opens the stream with fetch, parses the events and reopens it with Last-Event-ID after a capped, doubling wait); a stream operation (sse/<area>/stream-<channel>.ts) follows on it and a useSubscribe hook of hooks/swr reads that operation; no hand-written reader lives here (owner:event-stream-package) and only a stream operation imports this folder (FE_TRANSPORT_OWNER); a repository where several apps stream keeps one instance in each of them"
     rules: [FE_TRANSPORT_OWNER]
     exemplifiedBy:
       - {path: packages/eslint/fe/r50-transport-owner-coverage.spec.mjs, editions: [lite, full]}