@starci/hfs 4.7.44 → 4.7.46

package/runtime/knowledge/patterns/be/realtime.yaml

@@ -7,7 +7,7 @@ purpose: |-
   (`transport/sse/<channel>.controller.ts`), a socket gateway (`<channel>.gateway.ts`) or a GraphQL subscription
   (`<x>.subscription.ts`), that READS and PUSHES only. It never writes. The push is fed by a reactor: an event consumer in
   `features/reactors/` receives the domain event and publishes to a topic of the `RealtimeHub` of `platform/realtime` (an app
-  with no event bus lets the domain service that commits the change publish, after its commit); the door only subscribes the
+  with no event bus lets the domain service that commits the change publish with the hub's commit ordering, BE-REALTIME-7); the door only subscribes the
   client to a topic of that hub, scoped to the client's principal. SSE is the default door for one-way server-to-client push
   (job progress, a status that changes, streamed tokens), in lite and in full (owner decision 2026-10-24): it is plain HTTP
   behind the ingress, reconnects by itself and resumes from `Last-Event-ID`. The socket.io gateway stays for a channel that also
@@ -28,7 +28,8 @@ provenance:
     - owner decision 2026-10-24 (the lite edition may serve SSE, and SSE is the default door for one-way push; ruling:R212/case-5, amended by owner:lite-graphql-subscription-door and ruling:R212/case-7 for the GraphQL subscription door)
   limitations: |-
     Static checks prove the door's role, that the hub is the only thing injected and that a subscribed topic is built from the
-    principal. They do not prove the topic naming is collision free across channels, that an initial snapshot is consistent with
+    principal. They do not prove the publisher's membership read, that a non-Postgres publish follows the domain commit,
+    that the topic naming is collision free across channels, that an initial snapshot is consistent with
     the stream, or the behaviour of the socket under reconnects; the three `realtime/*` scenarios prove delivery, isolation and
     cleanup on the real stack. Nothing proves the ingress settings of an SSE channel (no compression, no buffering, HTTP/2, an
     idle timeout above the heartbeat): they are reviewed against the stack files and a real stream. The memory hub is
@@ -127,8 +128,8 @@ rules:
       needs is pushed by a reactor (or by the domain service that commits the change, in an app with no event bus); the socket
       library and the pub/sub engine (`socket.io`, `@socket.io/postgres-adapter`, `@socket.io/redis-adapter`, `graphql-subscriptions`, `graphql-ws`, `pg` for LISTEN and `ioredis`) are imported only by `platform/realtime`,
       and so is the heartbeat timer (`setInterval` is owned by `platform/realtime`, `infraOwners`). Because the door reads only the
-      hub, a snapshot cannot be sent on connect from the door: the client reads the current state through a query operation first
-      (or again on every open), and the stream carries the changes.
+      hub, a snapshot cannot be sent on connect from the door: the client reads the current state through a query operation that
+      checks resource membership first (or again on every open), and the stream carries the changes (BE-REALTIME-3).
     rationale: |-
       A door that can only touch the hub cannot change business state, so the biggest risk of a long-lived unauthenticated-looking
       connection, a write through it, is removed by type.
@@ -143,13 +144,26 @@ rules:
   - id: BE-REALTIME-3
     title: The topic is built from the principal
     kind: mandatory
-    hfsRules: [R186, R41]
+    hfsRules: [R186, R41, R89, R204]
     requirement: |-
       Every `@SubscribeMessage`, `@Subscription` and `@Sse` handler takes `@CurrentPrincipal()` of `domain/identity` and builds the topic it
       passes to `hub.subscribe` from the principal's id (plus a client-supplied id only inside that prefix) with the topic
-      builder of the owning domain contract, so one client cannot
-      listen to another's channel. The reactor that pushes uses the same topic builder from the owning domain contract, never a
-      hand-written string. The default-deny guards apply to the door like to any other; an SSE stream is never `@Public`. The
+      builder of the owning domain contract, so one client cannot listen to another's channel. A typed realtime topic builder is
+      a policy: it lives in `<name>.policy.ts` of slot `be.domain`, is exported through the capability's `index.ts`, and returns
+      `RealtimeTopic<Frame>` with the principal-prefixed `name` and the frame's narrowing `accepts` predicate. The named frame
+      contract lives in `*.contracts.ts`. The builder and predicate are pure functions of their inputs, with no injection, database
+      read or membership lookup; `policy` keeps the logic-role coverage of R204. The publisher and every door import this one
+      builder from the owning domain contract, never a hand-written topic string.
+
+      Resource membership is enforced on the publish side. The domain service that owns the change, or the domain service called
+      by a reactor's command, reads the current entitled members and fans out to one principal-prefixed topic per member. A client-supplied room
+      or conversation id stays inside that principal's prefix: a non-member can open only its own idle topic, which no publisher
+      targets. A removed member's already-open stream stays open but receives no newly published frames from the next publish onward, because
+      the refreshed member list no longer targets it. Frames already delivered or retained in its own topic are not revoked;
+      replay remains subject to the hub's bounds. Snapshot and history queries independently check current membership before
+      returning rows; the door injects only the hub (BE-REALTIME-2), never a membership-reading service or guard.
+
+      The default-deny guards apply to the door like to any other; an SSE stream is never `@Public`. The
       browser `EventSource` cannot send an `Authorization` header, so the front end reads the stream with `fetch` and the bearer
       access token (an operation of modules/api/sse read by a useSubscribe<Channel>Swr hook); a token in the URL is refused because it ends up in logs. The `Last-Event-ID` header is client
       input like any other: it is passed as `{ after }` to `hub.subscribe` and only picks where the replay resumes inside the
@@ -160,12 +174,26 @@ rules:
       - id: case-1
         when: Subscribing to one order's status
         write: 'hub.subscribe(orderStatusTopic(principal.id, orderId)); the reactor publishes to orderStatusTopic(buyerId, orderId) of the order owner, so a different principal receives nothing.'
+      - id: case-2
+        when: A room or conversation has several members and membership can change
+        write: |-
+          The owning domain exports roomMessageTopic(memberId, roomId) from its room-message.policy.ts, returning
+          { name: `room-message:${memberId}:${roomId}`, accepts: isRoomMessageFrame } with the declared return type RealtimeTopic<RoomMessageFrame>.
+          The SSE door calls hub.stream(roomMessageTopic(principal.id, roomId), { after: lastEventId }) and injects only the hub.
+          The publisher reads the current members and publishes a frame to roomMessageTopic(member.id, roomId) for each of them,
+          following the hub's commit ordering (BE-REALTIME-7). A non-member's topic receives nothing; removing a member leaves its
+          stream open and excludes it from subsequent fan-out. The snapshot query checks membership in its own read.
     verification:
       automated:
         - BE_REALTIME_TOPIC_SCOPE
         - BE_DEFAULT_DENY
+        - BE_SOURCE_FORM
+        - BE_PUBLIC_CONTRACT_FORM
+        - HFS_COVERAGE_SCOPE_DRIFT
       manual:
-        - Review that the topic builder shared with the reactor lives in the domain contract and is used by both sides.
+        - Review that the pure topic policy is exported by the owning domain and used by both the publisher and door.
+        - Prove the publisher targets exactly the current member list, including the next publish after removing a member; the non-member's stream receives no frame.
+        - Prove snapshot and history queries reject a caller whose membership is absent or removed.
     relatedExamples: [realtime]
   - id: BE-REALTIME-4
     title: Three behaviours are proven on the test world
@@ -301,7 +329,7 @@ rules:
     hfsRules: [R90, R266, R155]
     requirement: |-
       Both editions run N api replicas. `platform/realtime` keeps ONE port, `RealtimeHub` (`publish(topic, frame, within?): Promise<void>`
-      called by a reactor, or by the domain service that owns the state change and passes its own transaction as `within`,
+      called by a reactor, or by the domain service that owns the state change with the commit ordering below,
       `subscribe(topic, { after })` for GraphQL and socket doors, `stream(topic, { after })` for the SSE door), so a door never
       changes between a single replica and N replicas: only the hub binding does. Three adapters implement the port:
       `MemoryRealtimeHub` (non-scale: one process, tests and a single-replica dev run, replay from an in-process ring buffer),
@@ -318,8 +346,16 @@ rules:
       replay reads the stream with XRANGE and resumes after the newest entry carrying the id; when the subscriber connection comes
       back the hub reloads each followed topic after the minimum last stream id of its open subscriptions, with the same per-subscription
       duplicate suppression and paused retry policy as Postgres; ioredis, every key and channel carries the
-      app prefix `REALTIME_REDIS_PREFIX`). The app selects the hub with `REALTIME_HUB=memory|postgres|redis`, parsed once by
-      `parseRealtimeConfig` and validated at boot; unset, the parser defaults to `redis` when `REALTIME_REDIS_URL` is declared (lite
+      app prefix `REALTIME_REDIS_PREFIX`). Only the Postgres hub can publish inside the domain transaction: pass that
+      transaction as `within` when the domain write and realtime table use the same database. Redis and memory push immediately,
+      even if a caller passes `within`; they do not defer delivery until commit. With either hub the domain service awaits its
+      successful transaction before calling `hub.publish(topic, frame)` without `within`. A rollback therefore publishes nothing;
+      a publish failure after commit cannot roll back the domain write, and the client resyncs through its membership-checked
+      snapshot query. A service whose hub binding can vary uses this after-commit sequence unless it is bound to Postgres.
+      The app selects the hub with `REALTIME_HUB=memory|postgres|redis`, parsed once by
+      `parseRealtimeConfig` in `platform/realtime/realtime-config.mapper.ts` (the unit-tested mapping role of BE-NAMING-1),
+      with its unit spec in `realtime-config.mapper.spec.ts`, and validated at boot; unset, the parser defaults to `redis`
+      when `REALTIME_REDIS_URL` is declared (lite
       and full), `postgres` when lite declares no Redis, and never `memory`, so a scaled deploy cannot fall back to the in-process
       hub unseen. All three
       adapters are legal in both editions; select `redis` when Redis is declared (lite with Redis, and full), `postgres` when it is
@@ -381,6 +417,18 @@ rules:
           RealtimeModule.register({ isGlobal: true, ...withConnection(options.realtime, ORDER_ENTITY_MANAGER, options.database.url) })
           // REALTIME_HUB=redis, the secret REALTIME_REDIS_URL, REALTIME_REDIS_DB (and REALTIME_REDIS_PREFIX when the server is shared);
           // Redis 7 or later for the sharded socket.io adapter.
+      - id: case-9
+        when: A domain service changes state with the Redis or memory hub, or a selectable hub binding
+        write: |-
+          Collect the frame and entitled recipients while committing the change; publish only after the awaited transaction
+          resolves. No publish runs inside its callback, so a rollback sends no frame:
+          const push = await this.entityManager.transaction(async (tx) => {
+            // Read current membership and write the domain change through tx; return its topic/frame pairs.
+            return pendingPushes
+          })
+          for (const { topic, frame } of push) await this.hub.publish(topic, frame)
+          Passing tx to the Redis or memory hub does not make its immediate push transactional. Postgres alone may use
+          hub.publish(topic, frame, tx) inside that transaction (case-2).
       - id: case-4
         when: GraphQL subscription, non-scale
         write: |-
@@ -449,8 +497,14 @@ rules:
       manual:
         - Confirm the ingress holds no sticky-session declaration for the api, and that polling is off in the socket.io client configuration.
         - Confirm a Postgres hub connects through a session-mode URL and that the realtime tables are migrations of the app.
+        - Prove a domain rollback publishes nothing; with Redis or memory, verify publish follows the awaited commit and a publish failure leaves the committed change intact.
     relatedExamples: [realtime]
 files:
+  - path: src/modules/domain/<capability>/<name>.policy.ts
+    slot: be.domain
+    role: The pure typed topic builder and frame predicate of BE-REALTIME-3, exported by the domain contract for publisher and door.
+    spec: src/modules/domain/<capability>/<name>.policy.spec.ts
+    optional: true
   - path: src/features/realtime/<channel>/index.ts
     slot: be.feature.realtime
     template: realtime/channel.index.ts.tpl
@@ -544,6 +598,12 @@ files:
     slot: be.platform
     role: RealtimeHub, the one port of the realtime kind (publish, subscribe, stream) and the typed topic; its three adapters are the files below.
     optional: true
+  - path: src/modules/platform/realtime/realtime-config.mapper.ts
+    slot: be.platform
+    template: realtime/realtime-config.mapper.ts.tpl
+    role: parseRealtimeConfig maps EnvSource to the hub options at boot; hub-selection logic is a covered mapper role.
+    spec: src/modules/platform/realtime/realtime-config.mapper.spec.ts
+    optional: true
   - path: src/modules/platform/realtime/memory-realtime-hub.service.ts
     slot: be.platform
     role: "MemoryRealtimeHub, the non-scale adapter: one process, tests and a single-replica dev run, replay from an in-process ring buffer."

package/runtime/modules/kernel/command-policy.yaml

@@ -80,7 +80,7 @@ op:
 release:
   verbs: [cut, publish]
   scripts: [release:cut, release:publish]
-  use: starci release cut is owner-approved and moves main plus its tag; starci release publish publishes packages from that release; starci release notes prints or writes a tag CHANGELOG section and is not owner-gated
+  use: starci release cut is owner-approved and tags a commit already pushed; starci release publish publishes a finished package at once; starci release push sends main and is not owner-gated; starci release notes prints or writes a tag CHANGELOG section and is not owner-gated
 # Programs that cannot change state, with any arguments.
 read: [ls, dir, cat, type, head, tail, wc, uniq, cut, tr, diff, cmp, comm, rg, grep, egrep, fgrep, echo, printf, pwd, cd, pushd, popd, which, where, whoami, hostname,
   stat, file, realpath, readlink, dirname, basename, date, true, false, test, '[', expr, sleep, seq, basename, md5sum, sha1sum, sha256sum, shasum, cksum, od, xxd, hexdump,
@@ -123,7 +123,7 @@ git:
     add: {code: RIGHTS_GIT_COMMIT, use: starci git commit}
     rm: {code: RIGHTS_GIT_COMMIT, use: starci git commit}
     mv: {code: RIGHTS_GIT_COMMIT, use: starci git commit}
-    push: {code: RIGHTS_GIT_PUSH, use: 'starci git backup (refs/backup/* only); main and its tag move only through starci release cut'}
+    push: {code: RIGHTS_GIT_PUSH, use: 'starci git backup (refs/backup/* only); main moves only through starci release push and a release tag through starci release cut'}
     tag: {code: RIGHTS_GIT_TAG, use: starci release cut (the only tag maker; housekeeping marks are refs/backup/* or refs/salvage/*, never tags)}
     merge: {code: RIGHTS_GIT_SYNC, use: starci git sync (merge main into the lane) or starci git land (coordinator)}
     rebase: {code: RIGHTS_GIT_SYNC, use: starci git sync}
@@ -154,7 +154,7 @@ npm:
   programs: [npm, pnpm, yarn, bun]
   read: [view, v, info, show, ls, list, la, ll, outdated, explain, why, root, prefix, bin, help, search, whoami, ping, '-v', '--version', 'config get', 'config list', pack-dry]
   deny:
-    publish: {code: RIGHTS_NPM_PUBLISH, use: starci release cut authorizes the release; starci release publish publishes its packages once}
+    publish: {code: RIGHTS_NPM_PUBLISH, use: starci release publish is the package-publication path and runs as soon as a package branch is done}
     unpublish: {code: RIGHTS_NPM_PUBLISH, use: starci release publish is the only package-publication path; unpublishing is owner-only}
     deprecate: {code: RIGHTS_NPM_PUBLISH, use: starci release publish is the only package-publication path; deprecation is owner-only}
     dist-tag: {code: RIGHTS_NPM_PUBLISH, use: starci release publish is the only package-publication path; dist-tag mutation is owner-only}
@@ -165,8 +165,8 @@ npm:
     add: {code: RIGHTS_RAW_TOOL, use: starci npm install adds exact-pinned dependencies and is limited to lead or owner}
     update: {code: RIGHTS_RAW_TOOL, use: starci npm install is the owner-controlled dependency-change path using canon pins}
     uninstall: {code: RIGHTS_RAW_TOOL, use: starci npm install is the owner-controlled dependency-change path using canon pins}
-    test: {code: RIGHTS_RAW_TOOL, use: starci runtime verify in the runtime (the check, package clean-test and scaffold e2e; the full proof is the release cut) or starci gate unit --root <app> in an app}
-    t: {code: RIGHTS_RAW_TOOL, use: starci runtime verify in the runtime (the check, package clean-test and scaffold e2e; the full proof is the release cut) or starci gate unit --root <app> in an app}
+    test: {code: RIGHTS_RAW_TOOL, use: starci runtime verify in the runtime (the check, package clean-test and scaffold e2e; the full proof is CI) or starci gate unit --root <app> in an app}
+    t: {code: RIGHTS_RAW_TOOL, use: starci runtime verify in the runtime (the check, package clean-test and scaffold e2e; the full proof is CI) or starci gate unit --root <app> in an app}
     run: {code: RIGHTS_RAW_TOOL, use: 'starci runtime verify proves a runtime change; starci work layout-render serves the app for a layout capture; use starci release sync-runtime for package runtime copies and grammar preparation, or starci check run, starci lint run, starci typecheck run, starci app stack, or starci gate run for other scripts'}
     run-script: {code: RIGHTS_RAW_TOOL, use: 'starci runtime verify proves a runtime change; use starci check run, starci lint run, starci typecheck run, starci app stack, or starci gate run for other scripts'}
     start: {code: RIGHTS_RAW_TOOL, use: 'starci app stack'}

package/runtime/modules/kernel/failure-codes.yaml

@@ -1770,13 +1770,13 @@ CI_STANDARD:
   kind: check-finding
 
 CI_TRIGGERS_RELEASE_ONLY:
-  title: "Workflow trigger other than a release tag, a person or the runtime's main"
-  title_vi: "Workflow có trigger không phải tag phát hành, người chạy tay hay main của runtime"
-  meaning_vi: "Một workflow CI (gốc, ví dụ hoặc template của packages/hfs) khai báo trigger ngoài các loại được phép: push của tag v*, workflow_dispatch và, chỉ ở workflow gốc của runtime, push của nhánh main (không kèm paths hay bộ lọc ignore). Push nhánh khác, push main trong ví dụ hoặc template, pull_request, schedule hay workflow_call làm CI chạy sai thời điểm, và mọi app scaffold từ template sẽ thừa hưởng lỗi đó."
+  title: "Workflow trigger outside R221"
+  title_vi: "Workflow có trigger ngoài R221"
+  meaning_vi: "Workflow khai báo trigger ngoài R221: main được phép trong workflow runtime và ci.yml của app; các nhánh, sự kiện và bộ lọc khác phải theo R221."
   causes_vi:
-    - "Giữ trigger push hoặc pull_request của mô hình CI cũ"
-    - "Thêm bộ lọc branches khác [main], hoặc paths, vào push; hoặc thêm push main vào ví dụ hoặc template của app"
-  nextStep_vi: "Người giám sát đặt on của workflow gốc thành push với tags: ['v*'] và/hoặc branches: [main] cùng workflow_dispatch; ví dụ và template trong packages/hfs/templates/app/ci-workflows chỉ giữ tags: ['v*'] và workflow_dispatch (render lại ví dụ bằng starci app sync --write); không thêm trigger khác (docs/git-governance.md)."
+    - "Khai báo nhánh, sự kiện hoặc bộ lọc không thuộc R221"
+    - "Khai báo nhánh, sự kiện hoặc bộ lọc không thuộc R221"
+  nextStep_vi: "Sửa on theo R221 rồi chạy starci app sync --write để tạo lại workflow ứng dụng."
   owner: supervisor
   kind: check-finding
 
@@ -2284,6 +2284,17 @@ FE_CONSOLE_CALL:
   owner: op-retry
   kind: check-finding
 
+FE_CONTROL_HEIGHT:
+  title: "A control picks a larger size or mixes sizes in one row"
+  title_vi: "Điều khiển chọn cỡ lớn hơn hoặc trộn nhiều cỡ trong một hàng"
+  meaning_vi: "Điều khiển Grammar tại <file> truyền size lớn hơn chiều cao chuẩn 40px, hoặc đứng cạnh điều khiển khác cỡ trong cùng một hàng."
+  causes_vi:
+    - "Truyền size lg hoặc xl cho nút, công tắc, ô nhập ngoài khu hero của trang landing."
+    - "Trộn size sm với cỡ mặc định trong cùng một thanh công cụ hoặc hàng."
+  nextStep_vi: "Bỏ size để Grammar vẽ đúng một chiều cao điều khiển 40px (quy định control-height-40)."
+  owner: op-retry
+  kind: check-finding
+
 FE_COOKIE_ATTRIBUTES:
   title: "A written cookie leaves its attributes to the defaults"
   title_vi: "Cookie được ghi mà không nêu rõ thuộc tính"
@@ -2348,6 +2359,16 @@ FE_DESTRUCTIVE_CONFIRM_IN_DIALOG:
   owner: op-retry
   kind: check-finding
 
+FE_DIVIDER_FULL_BLEED:
+  title: "Horizontal Grammar divider is inset by wrapper padding"
+  title_vi: "Divider bị padding ngang của wrapper làm thụt vào"
+  meaning_vi: "Divider ngang của Grammar phải dài full và sát viền surface."
+  causes_vi:
+    - "Wrapper chứa Divider có padding ngang"
+  nextStep_vi: "Chuyển padding vào các band nội dung cạnh Divider."
+  owner: "op-retry"
+  kind: "check-finding"
+
 FE_EFFECT_CLEANUP:
   title: "What an effect starts, its cleanup releases"
   title_vi: "Effect khởi động thứ không được dọn"
@@ -3209,12 +3230,12 @@ HFS_APP_LEXICON:
   kind: check-finding
 
 HFS_APP_WORKFLOW_TRIGGER:
-  title: "App workflows start on release tags or manual dispatch"
+  title: "App workflow trigger outside R251"
   title_vi: "Workflow ứng dụng có sự kiện khởi chạy không hợp lệ"
-  meaning_vi: "Workflow tại <path> chạy theo push nhánh hoặc sự kiện khác; ứng dụng chỉ chạy CI theo release tag v* hoặc workflow_dispatch."
+  meaning_vi: "Workflow ứng dụng khai báo trigger ngoài R251; ci.yml được chạy trên main và nhánh release candidate, các workflow khác giữ phạm vi trigger của R251."
   causes_vi:
-    - "Vi phạm R251: áp dụng ngoại lệ push main của runtime cho workflow ứng dụng."
-  nextStep_vi: "Đặt on.push.tags thành [v*] và dùng workflow_dispatch khi cần chạy thủ công; bỏ nhánh và sự kiện khác."
+    - "Khai báo trigger không thuộc R251"
+  nextStep_vi: "Sửa trigger theo R251 và chạy starci app sync --write."
   owner: op-retry
   kind: check-finding
 
@@ -4522,7 +4543,7 @@ RIGHTS_GIT_PUSH:
   causes_vi:
     - "Agent định đẩy main, một nhánh thường, mọi thẻ hoặc một refspec quá rộng"
     - "Coordinator hoặc Supervisor đẩy bản sao lưu nhưng đích không nằm trong refs/backup/* hoặc không có refspec tường minh"
-  nextStep_vi: "Lệnh bị từ chối; để thay đổi đi qua starci release cut, hoặc nếu là coordinator hay Supervisor thì dùng starci git backup với đích refs/backup/* tường minh."
+  nextStep_vi: "Lệnh bị từ chối; để thay đổi đi qua starci release push, hoặc nếu là coordinator hay Supervisor thì dùng starci git backup với đích refs/backup/* tường minh."
   owner: op-retry
   kind: verb-refusal
 
@@ -4595,12 +4616,13 @@ RIGHTS_PROTECTED_ZONE:
 RIGHTS_PUSH_NOT_RELEASE:
   title: "Pre-push gate refused the push"
   title_vi: "Cổng pre-push từ chối lần đẩy"
-  meaning_vi: "Hook pre-push đã chặn một lần đẩy main hoặc thẻ v* của runtime vì commit được đẩy chưa phải commit phát hành: phiên bản chưa vượt phiên bản ở main trên remote, thiếu thẻ annotated v<version>, thiếu tiêu đề CHANGELOG có ngày, hoặc thiếu bản ghi L4 của đúng commit đó với suite gốc, suite các package và check đều xanh."
+  meaning_vi: "Hook pre-push đã chặn một lần đẩy main hoặc thẻ v* của runtime hoặc app: main không phải fast-forward hoặc vùng đẩy có ứng viên bí mật; thẻ v* không phải thẻ annotated."
   causes_vi:
     - "Thao tác xóa main hoặc xóa thẻ phát hành"
     - "Đẩy main không phải fast-forward của main trên remote (force push, rewind hoặc nhánh rẽ)"
-    - "Commit được đẩy không phải commit phát hành: version trùng version ở main remote, thiếu thẻ annotated v<version>, CHANGELOG chưa có tiêu đề có ngày, hoặc bản ghi starci-release của đúng commit đó thiếu hay có dòng đỏ"
-  nextStep_vi: "Không đẩy main giữa hai bản phát hành; chạy starci release cut --tag v<version> (thêm --plan để xem trước) đã được owner duyệt, lệnh này ghi bản ghi L4 rồi đẩy main và thẻ v* cùng nhau."
+    - "Vùng đẩy chứa ứng viên bí mật (tên tệp, dòng và mẫu, không bao giờ giá trị)"
+    - "Đẩy thẻ v* không phải thẻ annotated"
+  nextStep_vi: "Gỡ hoặc mã hóa ứng viên bí mật, fetch main rồi đẩy lại bằng starci release push; thẻ thì tạo bằng starci release cut --tag v<version> (thêm --plan để xem trước)."
   owner: supervisor
   kind: verb-refusal
 
@@ -4618,11 +4640,11 @@ RIGHTS_RAW_TOOL:
 RIGHTS_RELEASE_CUT:
   title: "Release cut refused"
   title_vi: "Từ chối cắt bản phát hành"
-  meaning_vi: "Release cut là quyết định phát hành của owner và chạy toàn bộ cổng L4 một lần; worker, lead, Supervisor và coordinator không được tự khởi động nó."
+  meaning_vi: "Release cut gắn thẻ bản phát hành cho một commit đã đẩy và publish gói là quyết định phát hành của owner; worker, lead, Supervisor và coordinator không được tự khởi động chúng."
   causes_vi:
     - "Agent gọi starci release cut hoặc đường script tương đương"
     - "Agent định publish bản phát hành mà chưa có phê duyệt của owner"
-  nextStep_vi: "Lệnh bị từ chối; báo lane đã sẵn sàng để owner phê duyệt và khởi động starci release cut."
+  nextStep_vi: "Lệnh bị từ chối; đẩy main bằng starci release push, và báo để owner phê duyệt starci release cut hoặc publish."
   owner: op-retry
   kind: verb-refusal
 
@@ -4643,7 +4665,7 @@ RIGHTS_SUITE_RUN:
   meaning_vi: "Toàn bộ suite chỉ chạy một lần trong mỗi release hoặc theo yêu cầu trong unit.verify hay e2e.verify; một worker chỉ chạy tệp spec vừa thay đổi hoặc để op gate chọn phạm vi."
   causes_vi:
     - "Agent gọi npm test, một script test toàn bộ hoặc node --test trên cả cây tests"
-    - "Agent chạy suite ngoài release cut và ngoài op verify được yêu cầu"
+    - "Agent chạy suite ngoài CI và ngoài op verify được yêu cầu"
   nextStep_vi: "Lệnh bị từ chối; chạy riêng tệp spec đã thay đổi, để op gate chọn spec liên quan, hoặc dùng unit.verify/e2e.verify khi owner hay mục tiêu yêu cầu."
   owner: op-retry
   kind: verb-refusal
@@ -5008,11 +5030,11 @@ RT_HELD_UNSURFACED:
 RT_HOOK_SHAPE:
   title: "App hook template breaks the gate model"
   title_vi: "Template hook của app phá vỡ mô hình cổng"
-  meaning_vi: "Template hook husky của app (packages/hfs/templates/app/hooks/husky) không đúng mô hình: pre-commit chỉ được chạy mức L0 (work-hygiene, eslint, stylelint, prettier trên tệp staged), không typecheck và không chạy test; pre-push chỉ kiểm cổng phát hành (bản ghi L4 trong starci-release, không gian refs/backup/, mẫu thẻ v[0-9]*), không chạy npm test, jest, typecheck hay lint."
+  meaning_vi: "Template hook của app không đúng R225: pre-commit chạy L0; pre-push gọi chính sách push dùng chung trong gói, không chạy build, test, typecheck hay lint."
   causes_vi:
     - "Thêm lại npm run typecheck hoặc test:affected vào pre-commit"
-    - "Đưa typecheck, lint hay test vào pre-push, hoặc xóa các dấu mốc cổng phát hành khỏi pre-push"
-  nextStep_vi: "Người giám sát trả template về đúng mô hình (pre-commit L0, pre-push chỉ kiểm cổng phát hành) rồi render lại hook các ví dụ bằng starci app sync --write, qua một lane đã land."
+    - "Đưa build, typecheck, lint hay test vào pre-push hoặc bỏ lời gọi chính sách push dùng chung"
+  nextStep_vi: "Khôi phục template theo R225 rồi chạy starci app sync --write để tạo lại hook."
   owner: supervisor
   kind: check-finding
 

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -131,12 +131,6 @@ removed:
     use: '`starci debug digest` (read-only) and `starci debug run <probe>`'
     since: 1.0.0-alpha.6
     match: '(?<![\w-])debug pass\b'
-  - id: config-supervisor-landgate-push
-    kind: config-key
-    name: supervisor.landGate.push
-    use: 'a land fast-forwards local main only and never pushes; the remote main of the runtime moves once per release, through starci release cut'
-    since: 1.0.0-alpha.7
-    match: 'landGate\.push\b'
   - id: flag-land-no-push
     kind: flag
     name: --no-push
@@ -355,7 +349,7 @@ removed:
   - id: verb-test-run
     kind: verb
     name: starci test run
-    use: 'the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, `starci release cut` runs the release rows'
+    use: 'the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, CI runs the release rows'
     since: 1.0.0-alpha.19
     match: '\bstarci test run\b'
   - id: verb-gate-runtime-coverage
@@ -430,3 +424,35 @@ removed:
     use: 'DropdownMenuItem.tone uses neutral or danger; destructive commands use danger'
     since: 1.0.0-alpha.31
     match: 'DropdownMenuItem(?:Tone|\.tone)[^\r\n]*["'']negative["'']'
+
+  - id: code-release-receipt-missing
+    kind: code
+    name: RELEASE_RECEIPT_MISSING
+    use: 'the push of main asks for a fast-forward and a clean secret scan; a release tag asks for no receipt'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-receipt-incomplete
+    kind: code
+    name: RELEASE_RECEIPT_INCOMPLETE
+    use: 'the push of main asks for a fast-forward and a clean secret scan; CI judges the full suite'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-suite-mode
+    kind: code
+    name: RELEASE_SUITE_MODE
+    use: 'release.suite chooses whether the cut also runs the L4 rows; no record or gate reads the mode'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-version-unchanged
+    kind: code
+    name: RELEASE_VERSION_UNCHANGED
+    use: 'main is pushed without a version move; RELEASE_VERSION_NOT_NEXT judges the version of a tag against the v* tags'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-remote-head-unknown
+    kind: code
+    name: RELEASE_REMOTE_HEAD_UNKNOWN
+    use: 'a release tag is judged against the v* tags, not against the remote main head'
+    since: 1.0.0-alpha.31.1
+  - id: config-release-candidate-blocking
+    kind: config-key
+    name: candidate.blocking
+    use: 'the runtime cut has no candidate step; the ci, examples and sonar workflows judge each push to main (suite.ci.workflows)'
+    since: 1.0.0-alpha.31.1
+    match: 'candidate\.blocking\b'