@starci/hfs 4.7.45 → 4.7.47

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 4.7.47 - 2026-10-27
+
+- Fixed: the rendered stack escapes every literal dollar once more, so a secret-reading command or healthcheck survives the second interpolation of docker stack deploy.
+
+## 4.7.46 - 2026-10-26
+
+- Changed: owner ruling push-main-after-scoped-check reaches product apps: the generated pre-push hook passes a fast-forward main push when the hooks pass and the secret scan is clean, a v* tag must be annotated, and app CI runs on pushes to main.
+- Changed: candidate-ci keeps only catalogued failure codes.
+
 ## 4.7.45 - 2026-10-26
 
 - Changed: the alpha.31.1 round folded into alpha.31; the bundled canon pins and runtime copies follow the final package versions. No rule changes.

package/lint/run.mjs

@@ -191,7 +191,7 @@ function exportsTarget(entry) {
 }
 
 /** The import entry of a package found by the app's own node_modules lookup (the folders require.resolve.paths lists from cwd). */
-export function importEntry(require, packageName) {
+function importEntry(require, packageName) {
   for (const dir of require.resolve.paths(packageName) ?? []) {
     const manifest = path.join(dir, packageName, 'package.json');
     if (!fs.existsSync(manifest)) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.45",
+  "version": "4.7.47",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/candidate-ci.mjs

@@ -2,9 +2,9 @@
 // red, with the owner confirming afterwards"). The push sends the exact release sha to refs/heads/release/candidate-<version> first (the managed ci.yml triggers on
 // release/candidate-*), waits for the ci.yml run of THAT sha, and moves the default branch and the tag only when it is green:
 //   green     the newest non-cancelled run of the sha concluded success and none of its jobs was skipped
-//   red       RELEASE_CANDIDATE_CI_RED (a run or a job that concluded skipped is red, never a pass: owner ruling 2026-10-22, a skip is a loosening) with the run URL and the failing jobs and steps; nothing reaches the default branch. The candidate ref stays for diagnosis
-//   timeout   RELEASE_CANDIDATE_CI_TIMEOUT: no run listed within the grace (a queued run is listed), or it did not end within the wait
-//   unknown   RELEASE_CI_UNKNOWN: GitHub could not be read to the end; a release never proceeds blind
+//   red       "candidate CI red" (a run or a job that concluded skipped is red, never a pass: owner ruling 2026-10-22, a skip is a loosening) with the run URL and the failing jobs and steps; nothing reaches the default branch. The candidate ref stays for diagnosis
+//   timeout   "candidate CI timeout": no run listed within the grace (a queued run is listed), or it did not end within the wait
+//   unknown   candidate CI unknown: GitHub could not be read to the end; a release never proceeds blind
 // There is no override: a red candidate never passes (owner ruling 2026-10-22: a loosening is always red).
 // Every process goes through ctx.spawn (git, gh); the wait through ctx.sleep and ctx.now.
 
@@ -95,9 +95,9 @@ export async function candidateStep(ctx, { head, tag, prefix, remote, wait = CAN
   if (seen.state === 'red') {
     const failing = failingJobs(ctx, seen.run);
     const detail = failing.length ? failing.join('; ') : 'the failing jobs could not be read';
-    return { ok: false, lines: [...lines, `RELEASE_CANDIDATE_CI_RED: the ci.yml run of ${head.slice(0, 10)} on ${ref} is red${url}; failing: ${detail}. Nothing reached the default branch; the candidate ref stays for diagnosis`], data: { ref, state: 'red', run: seen.run, failing } };
+    return { ok: false, lines: [...lines, `candidate CI red: the ci.yml run of ${head.slice(0, 10)} on ${ref} is red${url}; failing: ${detail}. Nothing reached the default branch; the candidate ref stays for diagnosis`], data: { ref, state: 'red', run: seen.run, failing } };
   }
-  if (seen.state === 'unstarted') return { ok: false, lines: [...lines, `RELEASE_CANDIDATE_CI_TIMEOUT: no ci.yml run started for ${head.slice(0, 10)} on ${ref} within ${wait.graceMinutes} minutes (does .github/workflows/ci.yml trigger on release/candidate-*? run starci app sync)`], data: { ref, state: 'unstarted' } };
-  if (seen.state === 'timeout') return { ok: false, lines: [...lines, `RELEASE_CANDIDATE_CI_TIMEOUT: the ci.yml run of ${head.slice(0, 10)} did not end within ${wait.waitMinutes} minutes${url}`], data: { ref, state: 'timeout', run: seen.run } };
-  return { ok: false, lines: [...lines, `RELEASE_CI_UNKNOWN: GitHub could not be read for the candidate ${head.slice(0, 10)} on ${ref}; a release never proceeds blind`], data: { ref, state: 'unknown' } };
+  if (seen.state === 'unstarted') return { ok: false, lines: [...lines, `candidate CI timeout: no ci.yml run started for ${head.slice(0, 10)} on ${ref} within ${wait.graceMinutes} minutes (does .github/workflows/ci.yml trigger on release/candidate-*? run starci app sync)`], data: { ref, state: 'unstarted' } };
+  if (seen.state === 'timeout') return { ok: false, lines: [...lines, `candidate CI timeout: the ci.yml run of ${head.slice(0, 10)} did not end within ${wait.waitMinutes} minutes${url}`], data: { ref, state: 'timeout', run: seen.run } };
+  return { ok: false, lines: [...lines, `candidate CI unknown: GitHub could not be read for the candidate ${head.slice(0, 10)} on ${ref}; a release never proceeds blind`], data: { ref, state: 'unknown' } };
 }

package/release/push.mjs

@@ -1,8 +1,8 @@
 // push.mjs - `starci app release push`: sends the default branch and the release tag to the remote in ONE atomic push through the repository's own
-// pre-push hook (never --no-verify). It requires what the hook requires: an annotated release tag on HEAD and the L4 record of the gate for that
+// pre-push hook (never --no-verify). The explicit release command requires an annotated release tag on HEAD and the L4 record of the gate for that
 // head and tag. `git push --dry-run --atomic` always runs first (the hook's verdict is the proof) and any failure refuses the push.
 // With --execute the exact sha first goes to its candidate ref refs/heads/release/candidate-<version> and the push waits for the ci.yml run of that sha
-// (candidate-ci.mjs, OWNER RULING candidate-ci 2026-10-18): only a green candidate (or the owner's sha-bound override record) moves the branch and the tag.
+// (candidate-ci.mjs, OWNER RULING candidate-ci 2026-10-18): only a green candidate moves the branch and the tag.
 // That wait runs only for an app that sets release.requireCi: true; the default false (owner ruling release-require-ci-per-project) pushes after the
 // local gate and the dry run alone and says so. The tag, the L4 record and the dry run are never skipped.
 import fs from 'node:fs';
@@ -21,7 +21,7 @@ function readRecord(file) {
 const greenRecord = (record, head, tag) => record?.head === head && record?.tag === tag
   && Array.isArray(record.gates) && record.gates.length > 0 && record.gates.every((gate) => gate?.pass === true);
 
-/** The release gate as the hook reads it: the annotated tag on HEAD whose L4 record names head and tag. Returns { tag } or { reason }. */
+/** The explicit release command gate: the annotated tag on HEAD whose L4 record names head and tag. Returns { tag } or { reason }. */
 function gateState(ctx, head, prefix, expected) {
   const tags = annotatedOnHead(ctx, prefix);
   if (!tags.includes(expected)) return { reason: `no ANNOTATED tag ${expected} (the package.json version) on HEAD${tags.length > 0 ? `, which carries ${tags.join(', ')}` : ''}: run starci app release gate --execute first` };

package/runtime/config.example.yaml

@@ -38,8 +38,9 @@ parallel: {gear: 1}
 # kernel (docs/supervisor.md) also takes, optional, defaults in home.mjs DEFAULTS:
 #   kernel: {agent, model, effort}   its agent pin (default: the kernel pin below)
 #   workers: {base, max}             the adaptive [Worker] cap, 0 to 10 (0 = the Supervisor runs no fix worker)
-#   landGate: {mode: shared}         shared lets running lanes commit directly; exclusive = gate only. A land
-#                                    fast-forwards LOCAL main only: the remote main moves with a release (starci release cut)
+#   landGate: {mode: shared, push: true}  shared lets running lanes commit directly; exclusive = gate only. A land
+#                                    fast-forwards LOCAL main; main reaches the remote right after a green scoped check through
+#                                    `starci release push` (push: true, the default; false locks the remote). CI is the critic.
 supervisor:
   # mode: chat (default) - the owner's desktop chat session is the Supervisor: it owns channel 'main'
   #   and reads Decision Items; nothing starts a [Supervisor] kernel. kernel - the optional [Supervisor]
@@ -49,7 +50,7 @@ supervisor:
   pollIntervalMs: null
   repos: []
   # frozenMinutes: <n>   # Host seat check: a busy frame unchanged this long is frozen, not busy
-  # landGate: {mode: shared|exclusive}
+  # landGate: {mode: shared|exclusive, push: true|false}
 # delegation — while the owner is away, a named delegate (e.g. the supervisor chat) may
 # answer owner asks until the given time; excluded classes stay owner-only. null = none.
 #   delegation: {asks: supervisor, until: 2026-09-23T09:00:00+07:00,
@@ -185,11 +186,9 @@ sonar: {organization: null}
 #   minFreeRamPct  free-RAM percentage below which no new heavy op starts
 # set them only in the gitignored config.yaml copy, e.g.
 #   resources: {minFreeDiskGb: 5, minFreeDiskPct: 1, minFreeRamPct: 10}
-# release - where the Linux parity of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
-#   suite: local   the shipped default: `starci release cut` runs the root rows (npm run test:packages, npm run test:e2e, npm run check) and the Linux parity container before it pushes,
-#                  and the pre-push gate asks for the green root rows
-#   suite: ci      the owner's recorded choice (2026-10-09): no local Linux container; the GitHub ci workflow runs the Linux parity (and SonarCloud) AFTER the push.
-#                  The cut still runs the same root rows and the example apps; the record lists linux-parity as delegated, never green.
-#                  A release can reach GitHub and its tag before the Linux parity has run; a red CI is fixed forward with the next pre-release (starci release ci-status).
-# "none" is refused: the Linux parity does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
+# release - where the full suite of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
+#   suite: local   the shipped default: `starci release cut` also runs the L4 rows on this host (root rows, example apps, Sonar proofs, Linux parity container) before it tags; it never gates a push
+#   suite: ci      the owner's recorded choice (2026-10-09, widened 2026-10-26 by push-main-after-scoped-check): EVERY row is judged by the GitHub workflows (ci, examples, sonar) on each push to main;
+#                  the cut runs none and lists each row as delegated, never green. A red CI opens the next alpha.N.M and never blocks the next push (starci release ci-status).
+# "none" is refused: the suite does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
 release: {suite: local}

package/runtime/engine/config.mjs

@@ -294,13 +294,13 @@ const validateSupervisorBlock=(supervisor,profile)=>{
     throw new Error('Invalid config.yaml: supervisor.mode must be chat or kernel, or null.');
   // The [Supervisor] kernel seat (scripts/machine/home.mjs supervisorSettings): kernel {agent?, model?, effort?}
   // pins its agent (default: the kernel pin), workers {base?, max?} its adaptive [Worker] cap (0 to 10; the shipped default is 0 fix workers),
-  // landGate {mode?: shared|exclusive} the land gate (scripts/supervisor/land.mjs).
+  // landGate {mode?: shared|exclusive, push?: boolean} the land gate (scripts/supervisor/land.mjs); push (default true, owner ruling push-main-after-scoped-check) lets `starci release push` send main to the remote after a green scoped check, false is the owner's lock on the remote.
   const seat=supervisor.kernel,workers=supervisor.workers,gate=supervisor.landGate;
   if(seat!==undefined&&seat!==null)validateAgentSeat(seat,'supervisor.kernel',profile);
   if(!(workers===undefined||workers===null||(plain(workers)&&Object.keys(workers).every(key=>['base','max'].includes(key)&&Number.isInteger(workers[key])&&workers[key]>=0&&workers[key]<=10))))
     throw new Error('Invalid config.yaml: supervisor.workers must be {base?, max?} integers from 0 to 10, or null.');
-  if(!(gate===undefined||gate===null||(plain(gate)&&Object.keys(gate).every(key=>key==='mode'&&['shared','exclusive'].includes(gate.mode)))))
-    throw new Error('Invalid config.yaml: supervisor.landGate must be {mode?: shared|exclusive}, or null.');
+  if(!(gate===undefined||gate===null||(plain(gate)&&Object.keys(gate).every(key=>(key==='mode'&&['shared','exclusive'].includes(gate.mode))||(key==='push'&&typeof gate.push==='boolean')))))
+    throw new Error('Invalid config.yaml: supervisor.landGate must be {mode?: shared|exclusive, push?: boolean}, or null.');
   // stallMinutes: scripts/supervisor/stall.mjs calls a running workflow STALLED after this many minutes with no progress.
   // frozenMinutes: scripts/supervisor/supervisor-watchdog.mjs reads a busy seat frame with no turn progress for this long as frozen.
   const frozen=supervisor.frozenMinutes;

package/runtime/engine/release-config.mjs

@@ -3,14 +3,14 @@ import {invalid} from './invalid-config.mjs';
 
 /** The keys of the release block. */
 export const RELEASE_KEYS=Object.freeze(['suite']);
-/** Where the full test suite of a release is judged: `local` (the release cut runs it, the shipped default) or `ci` (the GitHub workflow runs it after the push; the cut runs only the affected specs of the release and the rows CI cannot run). */
+/** Where the full test suite of a release is judged: `local` (the release cut also runs the L4 rows before it tags, the shipped default) or `ci` (the GitHub workflows judge EVERY row on each push to main; the cut runs none). */
 export const SUITE_MODES=Object.freeze(['local','ci']);
-export const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
+const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
 
 /**
- * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped
- * default: `starci release cut` runs the root suite and the Linux parity container before it pushes. `ci` is the owner's recorded choice (2026-10-09) that
- * the full suite runs on GitHub only: the cut runs no root suite and no Linux container, and the CI workflow's verdict is read afterwards (`starci release ci-status`).
+ * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped default: `starci release cut` also runs the
+ * L4 rows on this host before it tags. `ci` is the owner's recorded choice (2026-10-09, widened 2026-10-26 by push-main-after-scoped-check): the full suite runs on GitHub only, on every push
+ * to main; the cut runs no row and the verdict is read with `starci release ci-status`. The push of main needs neither mode: it needs a green scoped check.
  * `none` is refused: the suite does not vanish, it moves to CI, and the value says so.
  */
 export function validateRelease(release){

package/runtime/knowledge/grammars/offset-pop/playbook.yaml

@@ -253,7 +253,7 @@ guidance:
       a family where selection, current and focus share the same pink.
   - id: big-touch-targets
     requirement: |
-      Keep the published sizes: Common's 44px floor for controls, the Subnav toggle and the TopBar
+      Keep the published sizes: Common's 40px control height for controls, the Subnav toggle and the TopBar
       trigger, and `size="control"` throughout the navbar. Do not shrink them with app classes,
       and put answer choices in RadioGroup/CheckboxGroup/SegmentedControl rather than small
       custom chips.

package/runtime/knowledge/grammars/starci/playbook.yaml

@@ -185,7 +185,7 @@ shapes:
       - id: navbar-controls
         implements: [FE-APP-SHELL-2]
         compose: |
-          Every bar control uses `size="control"`, the 2.75rem shared height. Icon uses the family
+          Every bar control uses `size="control"`, the 2.5rem (40px) shared height. Icon uses the family
           size-5 token (20px) throughout the region. SearchField or its trigger shows Ctrl K and opens
           on Ctrl/Cmd+K; inside a surface its variant resolves through the nesting context. A compact
           language switch in a bar is SegmentedControl size="control" (the HeroUI lg group held to
@@ -250,7 +250,7 @@ shapes:
           scrolls independently. Groups use translated headings such as Main, Operations and Settings
           from modules/i18n/messages/app-shell.yaml. The expanded item has a size-5 icon, label and
           Grammar current-page treatment. A keyboard-accessible toggle collapses it into icon-only
-          destinations with size-5 icons in 2.75rem targets, current-page highlighting, count badges
+          destinations with size-5 icons in 2.5rem targets, current-page highlighting, count badges
           and hover/focus tooltips. Group order is stable, spacing replaces group headings and
           settings-type groups stay at the end. The application persists collapse state per user.
       - id: conversation-panel
@@ -333,6 +333,20 @@ imageryClarification:
     library-edit scope. Historical image notes are design references, not decisions for the current
     product.
 guidance:
+  - id: owner-ui-rulings-alpha-31
+    ownership: FE-RULE-OWNERSHIP
+    implements: [COLLECTION-1, LAYOUT-1, SURFACE-1, ACTION-3, CTA-6]
+    requirement: |
+      The canonical cases own the rule bodies; this entry only points to them. COLLECTION-1 case-9
+      (owner:selection-fill-no-check): navigation-like single selection uses ListBox
+      selectionIndicator="none", with the selectedKeys and accessibility contract unchanged.
+      LAYOUT-1 case-10 (owner:joined-multi-pane): the selected family realizes one touching pane
+      surface with vertical Dividers. SURFACE-1 case-4 (owner:scroll-region-background-tone):
+      VerticalScrollRegion tone="background" under messages and log entries, with the header and
+      composer on the surface. ACTION-3 case-5 (owner:hover-actions-floating-toolbar): ChatBubble's
+      public floating toolbar owns the IconButtons and tooltips beside the text; apps do not target
+      starci-core internals. CTA-6 case-4 (owner:button-variant-follows-intent): ordinary repeated
+      item commands are neutral and render ghost.
   - id: nested-controls-and-panel-lists
     ownership: FE-RULE-OWNERSHIP
     implements: [ANATOMY-2, PADDING-0]

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -30,35 +30,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.12.12
+    version: 0.12.14
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.54
+    version: 3.4.56
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.8
+    version: 9.1.10
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-starci':
-    version: 0.12.12
+    version: 0.12.14
     group: starci
     install: registry
     side: fe
     source: packages/eslint/grammar-starci/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.12
+    version: 0.12.14
     group: starci
     install: registry
     side: fe
@@ -98,14 +98,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.7.45
+    version: 1.7.47
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.7.45
+    version: 4.7.47
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/ci-standard.yaml

@@ -34,7 +34,7 @@ heap:
 items:
   - id: candidate-trigger
     title: the release CI runs on the release candidate ref
-    requires: "ci.yml runs on push of branches ['release/candidate-*'] and tags ['v*'] (and workflow_dispatch); the release flows wait for the run of the release sha there"
+    requires: "ci.yml runs on push of branches ['main', 'release/candidate-*'] and tags ['v*'] (and workflow_dispatch); the release flows wait for the run of the release sha there"
     covers: [app-ci, runtime]
     by: [R221 CI_TRIGGERS_RELEASE_ONLY, R251 HFS_APP_WORKFLOW_TRIGGER]
   - id: job-shape

package/runtime/knowledge/hfs/rules.yaml

@@ -20,7 +20,7 @@ schema: starci/hfs-rules@3
 version: 3.1.0
 gates:
   pre-commit: the managed L0 hook runs app hygiene, managed-file drift, ESLint per side and stylelint on staged source, and prettier on staged files; typecheck and targeted specs belong to the op gate under R225
-  pre-push: the managed app hook validates an annotated release tag and the recorded L4 evidence for HEAD, permitting the release refs and backup namespace under R225; it starts no source check, build or test
+  pre-push: the managed app hook invokes the bundled push policy under R225; it starts no source check, build or test
   settle: the op gate `starci gate run` over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
   land: the workflow's finish, the only time main is touched - gate.mjs over the whole workflow branch against its merge-base with main, the merge guard, review.verify of the exact head that lands, the branch rebased onto main, then main fast-forwarded and pushed
   ci: GitHub Actions runs the same pinned starci app lint, format:check, typecheck, unit with the per-file coverage threshold, build:be and build:fe, then the Sonar scan and gate
@@ -3850,7 +3850,7 @@ rules:
       - {path: packages/hfs/src/hfs-supabase-secrets.spec.mjs, edition: lite}
   - id: R221
     code: "CI_TRIGGERS_RELEASE_ONLY"
-    law: "The only workflow triggers are a push of release tags, a push of release candidate branches `release/candidate-*`, a person dispatching it and, in the runtime's own workflows (`.github/workflows/` at the root), a push to `main`: every tracked workflow declares an `on` that holds only `push` filtered to `tags: ['v*']` and/or `branches` naming only `release/candidate-*` (and, in the runtime's own workflows, `main`; no paths or ignore filter beside them) and `workflow_dispatch`. Every `ci.yml`, and the runtime's `examples.yml`, must name `release/candidate-*`: `starci release cut` and `starci app release push` push the exact release sha there and move main and the tag only when that run is green (owner ruling candidate-ci, 2026-10-18). A push to any other branch, a pull_request, a schedule, a workflow_call or any other event refuses the workflow."
+    law: "Workflow triggers are push filtered to v* tags or release/candidate-* branches, and workflow_dispatch. Runtime workflows and app ci.yml also admit main. App ci.yml includes the candidate branch filter for starci app release push. Other branches, events, path filters and ignore filters are refused."
     scope: runtime
     editions: [lite, full]
     docs: [docs/git-governance.md#r221]
@@ -3894,7 +3894,7 @@ rules:
       - {kind: runtime, id: protected-zone, at: scripts/hfs/runtime-rules/rights-policy.mjs}
   - id: R225
     code: "RT_HOOK_SHAPE"
-    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags; the runtime's own hook is scripts/guards/release-push-gate.mjs, which judges main and v* tags against the release definition and lets every other ref through) and runs no npm test, jest, typecheck or lint."
+    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck or test run); pre-push invokes the bundled scripts/guards/release-push-gate.mjs policy for fast-forward main, a clean outgoing secret scan and annotated v* tags. It runs no build, test, typecheck or lint."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -4269,7 +4269,7 @@ rules:
     editions: [lite, full]
     docs:
       - {path: docs/application-stacks.md#r251-deploy-workflow, editions: [lite, full]}
-    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*], the release candidate branches release/candidate-* (required in ci.yml: starci app release push waits for that run, owner ruling candidate-ci 2026-10-18) or workflow_dispatch, never on another branch push."
+    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*], the release candidate branches release/candidate-* (required in ci.yml: starci app release push waits for that run, owner ruling candidate-ci 2026-10-18) or workflow_dispatch; ci.yml also runs on main, and other branch pushes are refused."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DEPLOY_WORKFLOW", "HFS_WORKFLOW_PIN", "HFS_CI_TOOL_INSTALL", "HFS_APP_WORKFLOW_TRIGGER"]
@@ -5576,7 +5576,7 @@ rules:
     templateNa: "The app composes its shell from product destinations and identity; full and lite example shells provide the reference."
   - id: R318
     code: "FE_NESTED_VARIANT"
-    law: "Apps compose Grammar with layout-only CSS; paint utilities, arbitrary paint properties and inline style paint belong to Grammar. Grammar context owns all layer-aware field variants, nested Tabs defaults and the content edge of panel lists; apps omit static field variants, do not force primary Tabs inside a painted surface, do not paint raw surfaces, and add no horizontal list-wrapper padding within the nearest painted Grammar surface. BOUNDARY-1 case-5 owns Divider full-bleed composition."
+    law: "Apps compose Grammar with layout-only CSS; paint utilities, arbitrary paint properties and inline style paint belong to Grammar. Grammar context owns all layer-aware field variants, nested Tabs defaults and the content edge of panel lists; apps omit static field variants, do not force primary Tabs inside a painted surface, do not paint raw surfaces, and add no horizontal list-wrapper padding within the nearest painted Grammar surface. BOUNDARY-1 case-5 owns Divider full-bleed composition. Navigation-like single-select lists use fill without checks (COLLECTION-1 case-9); application styles never target Grammar internal classes (ACTION-3 case-5)."
     kinds: [lint, design]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["FE_NESTED_VARIANT", "FE_LIST_PANEL_PADDING", "FE_GRAMMAR_LAYOUT_ONLY", "FE_DIVIDER_FULL_BLEED"]
@@ -5585,18 +5585,23 @@ rules:
       - {kind: eslint-fe, id: no-list-panel-padding}
       - {kind: eslint-fe, id: no-app-surface-paint}
       - {kind: eslint-fe, id: divider-full-bleed}
+      - {kind: eslint-fe, id: selection-fill-no-check}
+      - {kind: eslint-fe, id: no-grammar-internal-selector}
     editions: [lite, full]
     docs: ["docs/code-pattern-enforcement.md#r318-app-grammar-composition"]
     templateNa: "Product composition is proved by the FE canon's Grammar import and surface fixtures; a template cannot choose product slots or lists."
     proves:
       - {path: packages/eslint/fe/divider-full-bleed.spec.mjs, editions: [lite, full], codes: [FE_DIVIDER_FULL_BLEED]}
       - {path: packages/eslint/fe/surface-rules.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_LIST_PANEL_PADDING, FE_GRAMMAR_LAYOUT_ONLY]}
+      - {path: packages/eslint/fe/ui-rulings.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_GRAMMAR_LAYOUT_ONLY]}
     exemplifiedBy:
       - {path: packages/eslint/fe/divider-full-bleed.spec.mjs, editions: [lite, full], codes: [FE_DIVIDER_FULL_BLEED]}
       - {path: packages/eslint/fe/surface-rules.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_LIST_PANEL_PADDING, FE_GRAMMAR_LAYOUT_ONLY]}
+      - {path: packages/eslint/fe/ui-rulings.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_GRAMMAR_LAYOUT_ONLY]}
     witness:
       - {path: packages/eslint/fe/divider-full-bleed.spec.mjs, editions: [lite, full], codes: [FE_DIVIDER_FULL_BLEED]}
       - {path: packages/eslint/fe/surface-rules.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_LIST_PANEL_PADDING, FE_GRAMMAR_LAYOUT_ONLY]}
+      - {path: packages/eslint/fe/ui-rulings.spec.mjs, editions: [lite, full], codes: [FE_NESTED_VARIANT, FE_GRAMMAR_LAYOUT_ONLY]}
     cases:
       - id: case-1
         date: "2026-10-25"
@@ -5633,3 +5638,29 @@ rules:
         source: owner
         quote: "Critique this carefully so the button choice is a system and not a feeling, understand? Update .claude."
         ruling: "The button variant follows the declared intent (owner ruling button-variant-follows-intent): the app passes intent and step, Grammar derives the variant from them and from the placement it reads from React context. The semantics are HeroUI's, so the lint is universal in the FE canon."
+
+  - id: R320
+    code: "FE_CONTROL_HEIGHT"
+    law: "One 40px control height is the default of every standalone control (CONTROL-HEIGHT-1): an app never picks a larger size than the default outside a landing hero call to action, and controls of one row share one size."
+    kinds: [lint, design]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["FE_CONTROL_HEIGHT"]
+    enforcers:
+      - {kind: eslint-fe, id: control-height}
+    editions: [lite, full]
+    docs:
+      - packages/eslint/fe/docs/control-height.md
+      - docs/code-pattern-enforcement.md#r320-control-height
+    proves:
+      - {path: packages/eslint/fe/control-height.spec.mjs, editions: [lite, full], codes: [FE_CONTROL_HEIGHT]}
+    exemplifiedBy:
+      - {path: packages/eslint/fe/control-height.spec.mjs, editions: [lite, full], codes: [FE_CONTROL_HEIGHT]}
+    witness:
+      - {path: packages/eslint/fe/control-height.spec.mjs, editions: [lite, full], codes: [FE_CONTROL_HEIGHT]}
+    templateNa: "The control height is Grammar's own value; a template states no size."
+    cases:
+      - id: case-1
+        date: "2026-10-26"
+        source: owner
+        quote: "The size of the buttons and controls is uneven; the teacher thinks height = 40px (h-10) should be fixed for every button, switch, input, tabs and so on, what do you think? (translated from Vietnamese)"
+        ruling: "One 40px control height is the default of every standalone control (owner ruling control-height-40): Grammar draws it, an app omits size, sm is for a nested item or dense toolbar row, lg only for a landing hero call to action, and controls of one row share one size."

package/runtime/knowledge/patterns/be/realtime.yaml

@@ -188,6 +188,7 @@ rules:
         - BE_REALTIME_TOPIC_SCOPE
         - BE_DEFAULT_DENY
         - BE_SOURCE_FORM
+        - BE_PUBLIC_CONTRACT_FORM
         - HFS_COVERAGE_SCOPE_DRIFT
       manual:
         - Review that the pure topic policy is exported by the owning domain and used by both the publisher and door.

package/runtime/modules/kernel/command-policy.yaml

@@ -80,7 +80,7 @@ op:
 release:
   verbs: [cut, publish]
   scripts: [release:cut, release:publish]
-  use: starci release cut is owner-approved and moves main plus its tag; starci release publish publishes packages from that release; starci release notes prints or writes a tag CHANGELOG section and is not owner-gated
+  use: starci release cut is owner-approved and tags a commit already pushed; starci release publish publishes a finished package at once; starci release push sends main and is not owner-gated; starci release notes prints or writes a tag CHANGELOG section and is not owner-gated
 # Programs that cannot change state, with any arguments.
 read: [ls, dir, cat, type, head, tail, wc, uniq, cut, tr, diff, cmp, comm, rg, grep, egrep, fgrep, echo, printf, pwd, cd, pushd, popd, which, where, whoami, hostname,
   stat, file, realpath, readlink, dirname, basename, date, true, false, test, '[', expr, sleep, seq, basename, md5sum, sha1sum, sha256sum, shasum, cksum, od, xxd, hexdump,
@@ -123,7 +123,7 @@ git:
     add: {code: RIGHTS_GIT_COMMIT, use: starci git commit}
     rm: {code: RIGHTS_GIT_COMMIT, use: starci git commit}
     mv: {code: RIGHTS_GIT_COMMIT, use: starci git commit}
-    push: {code: RIGHTS_GIT_PUSH, use: 'starci git backup (refs/backup/* only); main and its tag move only through starci release cut'}
+    push: {code: RIGHTS_GIT_PUSH, use: 'starci git backup (refs/backup/* only); main moves only through starci release push and a release tag through starci release cut'}
     tag: {code: RIGHTS_GIT_TAG, use: starci release cut (the only tag maker; housekeeping marks are refs/backup/* or refs/salvage/*, never tags)}
     merge: {code: RIGHTS_GIT_SYNC, use: starci git sync (merge main into the lane) or starci git land (coordinator)}
     rebase: {code: RIGHTS_GIT_SYNC, use: starci git sync}
@@ -154,7 +154,7 @@ npm:
   programs: [npm, pnpm, yarn, bun]
   read: [view, v, info, show, ls, list, la, ll, outdated, explain, why, root, prefix, bin, help, search, whoami, ping, '-v', '--version', 'config get', 'config list', pack-dry]
   deny:
-    publish: {code: RIGHTS_NPM_PUBLISH, use: starci release cut authorizes the release; starci release publish publishes its packages once}
+    publish: {code: RIGHTS_NPM_PUBLISH, use: starci release publish is the package-publication path and runs as soon as a package branch is done}
     unpublish: {code: RIGHTS_NPM_PUBLISH, use: starci release publish is the only package-publication path; unpublishing is owner-only}
     deprecate: {code: RIGHTS_NPM_PUBLISH, use: starci release publish is the only package-publication path; deprecation is owner-only}
     dist-tag: {code: RIGHTS_NPM_PUBLISH, use: starci release publish is the only package-publication path; dist-tag mutation is owner-only}
@@ -165,8 +165,8 @@ npm:
     add: {code: RIGHTS_RAW_TOOL, use: starci npm install adds exact-pinned dependencies and is limited to lead or owner}
     update: {code: RIGHTS_RAW_TOOL, use: starci npm install is the owner-controlled dependency-change path using canon pins}
     uninstall: {code: RIGHTS_RAW_TOOL, use: starci npm install is the owner-controlled dependency-change path using canon pins}
-    test: {code: RIGHTS_RAW_TOOL, use: starci runtime verify in the runtime (the check, package clean-test and scaffold e2e; the full proof is the release cut) or starci gate unit --root <app> in an app}
-    t: {code: RIGHTS_RAW_TOOL, use: starci runtime verify in the runtime (the check, package clean-test and scaffold e2e; the full proof is the release cut) or starci gate unit --root <app> in an app}
+    test: {code: RIGHTS_RAW_TOOL, use: starci runtime verify in the runtime (the check, package clean-test and scaffold e2e; the full proof is CI) or starci gate unit --root <app> in an app}
+    t: {code: RIGHTS_RAW_TOOL, use: starci runtime verify in the runtime (the check, package clean-test and scaffold e2e; the full proof is CI) or starci gate unit --root <app> in an app}
     run: {code: RIGHTS_RAW_TOOL, use: 'starci runtime verify proves a runtime change; starci work layout-render serves the app for a layout capture; use starci release sync-runtime for package runtime copies and grammar preparation, or starci check run, starci lint run, starci typecheck run, starci app stack, or starci gate run for other scripts'}
     run-script: {code: RIGHTS_RAW_TOOL, use: 'starci runtime verify proves a runtime change; use starci check run, starci lint run, starci typecheck run, starci app stack, or starci gate run for other scripts'}
     start: {code: RIGHTS_RAW_TOOL, use: 'starci app stack'}

package/runtime/modules/kernel/failure-codes.yaml

@@ -1770,13 +1770,13 @@ CI_STANDARD:
   kind: check-finding
 
 CI_TRIGGERS_RELEASE_ONLY:
-  title: "Workflow trigger other than a release tag, a person or the runtime's main"
-  title_vi: "Workflow có trigger không phải tag phát hành, người chạy tay hay main của runtime"
-  meaning_vi: "Một workflow CI (gốc, ví dụ hoặc template của packages/hfs) khai báo trigger ngoài các loại được phép: push của tag v*, workflow_dispatch và, chỉ ở workflow gốc của runtime, push của nhánh main (không kèm paths hay bộ lọc ignore). Push nhánh khác, push main trong ví dụ hoặc template, pull_request, schedule hay workflow_call làm CI chạy sai thời điểm, và mọi app scaffold từ template sẽ thừa hưởng lỗi đó."
+  title: "Workflow trigger outside R221"
+  title_vi: "Workflow có trigger ngoài R221"
+  meaning_vi: "Workflow khai báo trigger ngoài R221: main được phép trong workflow runtime và ci.yml của app; các nhánh, sự kiện và bộ lọc khác phải theo R221."
   causes_vi:
-    - "Giữ trigger push hoặc pull_request của mô hình CI cũ"
-    - "Thêm bộ lọc branches khác [main], hoặc paths, vào push; hoặc thêm push main vào ví dụ hoặc template của app"
-  nextStep_vi: "Người giám sát đặt on của workflow gốc thành push với tags: ['v*'] và/hoặc branches: [main] cùng workflow_dispatch; ví dụ và template trong packages/hfs/templates/app/ci-workflows chỉ giữ tags: ['v*'] và workflow_dispatch (render lại ví dụ bằng starci app sync --write); không thêm trigger khác (docs/git-governance.md)."
+    - "Khai báo nhánh, sự kiện hoặc bộ lọc không thuộc R221"
+    - "Khai báo nhánh, sự kiện hoặc bộ lọc không thuộc R221"
+  nextStep_vi: "Sửa on theo R221 rồi chạy starci app sync --write để tạo lại workflow ứng dụng."
   owner: supervisor
   kind: check-finding
 
@@ -2284,6 +2284,17 @@ FE_CONSOLE_CALL:
   owner: op-retry
   kind: check-finding
 
+FE_CONTROL_HEIGHT:
+  title: "A control picks a larger size or mixes sizes in one row"
+  title_vi: "Điều khiển chọn cỡ lớn hơn hoặc trộn nhiều cỡ trong một hàng"
+  meaning_vi: "Điều khiển Grammar tại <file> truyền size lớn hơn chiều cao chuẩn 40px, hoặc đứng cạnh điều khiển khác cỡ trong cùng một hàng."
+  causes_vi:
+    - "Truyền size lg hoặc xl cho nút, công tắc, ô nhập ngoài khu hero của trang landing."
+    - "Trộn size sm với cỡ mặc định trong cùng một thanh công cụ hoặc hàng."
+  nextStep_vi: "Bỏ size để Grammar vẽ đúng một chiều cao điều khiển 40px (quy định control-height-40)."
+  owner: op-retry
+  kind: check-finding
+
 FE_COOKIE_ATTRIBUTES:
   title: "A written cookie leaves its attributes to the defaults"
   title_vi: "Cookie được ghi mà không nêu rõ thuộc tính"
@@ -3219,12 +3230,12 @@ HFS_APP_LEXICON:
   kind: check-finding
 
 HFS_APP_WORKFLOW_TRIGGER:
-  title: "App workflows start on release tags or manual dispatch"
+  title: "App workflow trigger outside R251"
   title_vi: "Workflow ứng dụng có sự kiện khởi chạy không hợp lệ"
-  meaning_vi: "Workflow tại <path> chạy theo push nhánh hoặc sự kiện khác; ứng dụng chỉ chạy CI theo release tag v* hoặc workflow_dispatch."
+  meaning_vi: "Workflow ứng dụng khai báo trigger ngoài R251; ci.yml được chạy trên main và nhánh release candidate, các workflow khác giữ phạm vi trigger của R251."
   causes_vi:
-    - "Vi phạm R251: áp dụng ngoại lệ push main của runtime cho workflow ứng dụng."
-  nextStep_vi: "Đặt on.push.tags thành [v*] và dùng workflow_dispatch khi cần chạy thủ công; bỏ nhánh và sự kiện khác."
+    - "Khai báo trigger không thuộc R251"
+  nextStep_vi: "Sửa trigger theo R251 và chạy starci app sync --write."
   owner: op-retry
   kind: check-finding
 
@@ -4532,7 +4543,7 @@ RIGHTS_GIT_PUSH:
   causes_vi:
     - "Agent định đẩy main, một nhánh thường, mọi thẻ hoặc một refspec quá rộng"
     - "Coordinator hoặc Supervisor đẩy bản sao lưu nhưng đích không nằm trong refs/backup/* hoặc không có refspec tường minh"
-  nextStep_vi: "Lệnh bị từ chối; để thay đổi đi qua starci release cut, hoặc nếu là coordinator hay Supervisor thì dùng starci git backup với đích refs/backup/* tường minh."
+  nextStep_vi: "Lệnh bị từ chối; để thay đổi đi qua starci release push, hoặc nếu là coordinator hay Supervisor thì dùng starci git backup với đích refs/backup/* tường minh."
   owner: op-retry
   kind: verb-refusal
 
@@ -4605,12 +4616,13 @@ RIGHTS_PROTECTED_ZONE:
 RIGHTS_PUSH_NOT_RELEASE:
   title: "Pre-push gate refused the push"
   title_vi: "Cổng pre-push từ chối lần đẩy"
-  meaning_vi: "Hook pre-push đã chặn một lần đẩy main hoặc thẻ v* của runtime vì commit được đẩy chưa phải commit phát hành: phiên bản chưa vượt phiên bản ở main trên remote, thiếu thẻ annotated v<version>, thiếu tiêu đề CHANGELOG có ngày, hoặc thiếu bản ghi L4 của đúng commit đó với suite gốc, suite các package và check đều xanh."
+  meaning_vi: "Hook pre-push đã chặn một lần đẩy main hoặc thẻ v* của runtime hoặc app: main không phải fast-forward hoặc vùng đẩy có ứng viên bí mật; thẻ v* không phải thẻ annotated."
   causes_vi:
     - "Thao tác xóa main hoặc xóa thẻ phát hành"
     - "Đẩy main không phải fast-forward của main trên remote (force push, rewind hoặc nhánh rẽ)"
-    - "Commit được đẩy không phải commit phát hành: version trùng version ở main remote, thiếu thẻ annotated v<version>, CHANGELOG chưa có tiêu đề có ngày, hoặc bản ghi starci-release của đúng commit đó thiếu hay có dòng đỏ"
-  nextStep_vi: "Không đẩy main giữa hai bản phát hành; chạy starci release cut --tag v<version> (thêm --plan để xem trước) đã được owner duyệt, lệnh này ghi bản ghi L4 rồi đẩy main và thẻ v* cùng nhau."
+    - "Vùng đẩy chứa ứng viên bí mật (tên tệp, dòng và mẫu, không bao giờ giá trị)"
+    - "Đẩy thẻ v* không phải thẻ annotated"
+  nextStep_vi: "Gỡ hoặc mã hóa ứng viên bí mật, fetch main rồi đẩy lại bằng starci release push; thẻ thì tạo bằng starci release cut --tag v<version> (thêm --plan để xem trước)."
   owner: supervisor
   kind: verb-refusal
 
@@ -4628,11 +4640,11 @@ RIGHTS_RAW_TOOL:
 RIGHTS_RELEASE_CUT:
   title: "Release cut refused"
   title_vi: "Từ chối cắt bản phát hành"
-  meaning_vi: "Release cut là quyết định phát hành của owner và chạy toàn bộ cổng L4 một lần; worker, lead, Supervisor và coordinator không được tự khởi động nó."
+  meaning_vi: "Release cut gắn thẻ bản phát hành cho một commit đã đẩy và publish gói là quyết định phát hành của owner; worker, lead, Supervisor và coordinator không được tự khởi động chúng."
   causes_vi:
     - "Agent gọi starci release cut hoặc đường script tương đương"
     - "Agent định publish bản phát hành mà chưa có phê duyệt của owner"
-  nextStep_vi: "Lệnh bị từ chối; báo lane đã sẵn sàng để owner phê duyệt và khởi động starci release cut."
+  nextStep_vi: "Lệnh bị từ chối; đẩy main bằng starci release push, và báo để owner phê duyệt starci release cut hoặc publish."
   owner: op-retry
   kind: verb-refusal
 
@@ -4653,7 +4665,7 @@ RIGHTS_SUITE_RUN:
   meaning_vi: "Toàn bộ suite chỉ chạy một lần trong mỗi release hoặc theo yêu cầu trong unit.verify hay e2e.verify; một worker chỉ chạy tệp spec vừa thay đổi hoặc để op gate chọn phạm vi."
   causes_vi:
     - "Agent gọi npm test, một script test toàn bộ hoặc node --test trên cả cây tests"
-    - "Agent chạy suite ngoài release cut và ngoài op verify được yêu cầu"
+    - "Agent chạy suite ngoài CI và ngoài op verify được yêu cầu"
   nextStep_vi: "Lệnh bị từ chối; chạy riêng tệp spec đã thay đổi, để op gate chọn spec liên quan, hoặc dùng unit.verify/e2e.verify khi owner hay mục tiêu yêu cầu."
   owner: op-retry
   kind: verb-refusal
@@ -5018,11 +5030,11 @@ RT_HELD_UNSURFACED:
 RT_HOOK_SHAPE:
   title: "App hook template breaks the gate model"
   title_vi: "Template hook của app phá vỡ mô hình cổng"
-  meaning_vi: "Template hook husky của app (packages/hfs/templates/app/hooks/husky) không đúng mô hình: pre-commit chỉ được chạy mức L0 (work-hygiene, eslint, stylelint, prettier trên tệp staged), không typecheck và không chạy test; pre-push chỉ kiểm cổng phát hành (bản ghi L4 trong starci-release, không gian refs/backup/, mẫu thẻ v[0-9]*), không chạy npm test, jest, typecheck hay lint."
+  meaning_vi: "Template hook của app không đúng R225: pre-commit chạy L0; pre-push gọi chính sách push dùng chung trong gói, không chạy build, test, typecheck hay lint."
   causes_vi:
     - "Thêm lại npm run typecheck hoặc test:affected vào pre-commit"
-    - "Đưa typecheck, lint hay test vào pre-push, hoặc xóa các dấu mốc cổng phát hành khỏi pre-push"
-  nextStep_vi: "Người giám sát trả template về đúng mô hình (pre-commit L0, pre-push chỉ kiểm cổng phát hành) rồi render lại hook các ví dụ bằng starci app sync --write, qua một lane đã land."
+    - "Đưa build, typecheck, lint hay test vào pre-push hoặc bỏ lời gọi chính sách push dùng chung"
+  nextStep_vi: "Khôi phục template theo R225 rồi chạy starci app sync --write để tạo lại hook."
   owner: supervisor
   kind: check-finding