@starci/hfs 5.0.3 → 5.0.5

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 5.0.5
+
+- Changed: Govern each app-check linter, compiler, test discovery and coverage, contract emitter and boot child through the CLI execution port with actual worker limits and complete output capture. Preserve cache identities, closure, flush behavior and coverage thresholds. Record source-proven native Page body layouts with their contextual constraints.
+
+## 5.0.4
+
+- Changed: Record the existing shared Page semantic role in the selected canonical Grammar component contract, so universal composition proof does not infer concrete API names or accept an app-controlled switch.
+- Fixed: Run the package export proof's normal pack lifecycle in a private source copy, so prepack never rewrites emit modules that concurrent worker proofs import.
+
 ## 5.0.3
 
 - Changed: Bundled canon pins name the builder-provenance BE canon release and its coherent dependency cohort. This package changes no runtime behavior or rule severity.

package/cache/app-families.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type CheckFinding } from '../runtime/scripts/hfs/check.mjs';
 import { type TestFamilyResult } from './test-family.mjs';
 import { type TypesFamilyResult, type TypesProgram } from './types-family.mjs';
@@ -6,24 +7,26 @@ import type { CheckSession } from './types.mjs';
 /** The tsc programs of the app: the back end and each front-end workspace, from the tracked tsconfigs. */
 export declare function programsOf(tracked: readonly string[]): TypesProgram[];
 /** `--types`: `tsc --noEmit` per workspace program through the app's TypeScript, reused by program key. */
-export declare function runTypesForApp(session: CheckSession, { repoRoot, tracked, env }: {
+export declare function runTypesForApp(session: CheckSession, { repoRoot, tracked, env, execute }: {
     repoRoot: string;
     tracked: readonly string[];
     env: NodeJS.ProcessEnv;
-}): {
+    execute?: HeavyNodeRun | undefined;
+}): Promise<{
     result: TypesFamilyResult;
     findings: CheckFinding[];
-};
+}>;
 /** `--test`: the unit specs of the back end through the app's own Jest, reused by closure key; the merged total is judged by `@starci/hfs` (the coverage proof). */
-export declare function runTestForApp(session: CheckSession, { repoRoot, tracked }: {
+export declare function runTestForApp(session: CheckSession, { repoRoot, tracked, execute }: {
     repoRoot: string;
     tracked: readonly string[];
+    execute?: HeavyNodeRun | undefined;
 }): Promise<{
     result: TestFamilyResult | null;
     findings: CheckFinding[];
 }>;
 /** `--test --full --shard i/n`: one shard of the full unit run in the shape the shard merge reads; nothing is recorded. */
-export declare function runTestShard(repoRoot: string, index: number, total: number): number;
+export declare function runTestShard(repoRoot: string, index: number, total: number, execute?: HeavyNodeRun): Promise<number>;
 /** `--sonar`: the Sonar and Codecov baselines and the predictions from the merged coverage records; they never pass or fail a run. */
 export declare function runSonarForApp(session: CheckSession, { repoRoot }: {
     repoRoot: string;

package/cache/app-families.mjs

@@ -5,7 +5,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { spawnSync } from 'node:child_process';
+import { completedNode, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import { skillRoot } from '../runtime/engine/runtime-root.mjs';
 import { coverageFrom } from '../runtime/scripts/hfs/coverage-from.mjs';
 import { readWhy } from '../runtime/scripts/hfs/check.mjs';
@@ -30,11 +30,11 @@ export function programsOf(tracked) {
     return programs.sort((a, b) => (a.name < b.name ? -1 : 1));
 }
 /** `--types`: `tsc --noEmit` per workspace program through the app's TypeScript, reused by program key. */
-export function runTypesForApp(session, { repoRoot, tracked, env }) {
+export async function runTypesForApp(session, { repoRoot, tracked, env, execute }) {
     const programs = programsOf(tracked);
     const trackedSet = new Set(tracked);
-    const result = runTypesFamily({
-        session, programs, run: createTscRunner({ appRoot: repoRoot }), toolCacheDir: toolCacheDir(repoRoot, env),
+    const result = await runTypesFamily({
+        session, programs, run: createTscRunner({ appRoot: repoRoot, execute }), toolCacheDir: toolCacheDir(repoRoot, env),
         inputsOf: (program) => {
             const side = program.name.startsWith('be') ? 'be' : 'fe';
             const prefix = `${program.reads?.[0] ?? side}/`;
@@ -45,12 +45,12 @@ export function runTypesForApp(session, { repoRoot, tracked, env }) {
     return { result, findings: result.findings.map((found) => asFinding(found, 'TS_DIAGNOSTIC', 'error', 'tsc')) };
 }
 /** `--test`: the unit specs of the back end through the app's own Jest, reused by closure key; the merged total is judged by `@starci/hfs` (the coverage proof). */
-export async function runTestForApp(session, { repoRoot, tracked }) {
+export async function runTestForApp(session, { repoRoot, tracked, execute }) {
     if (!tracked.includes('be/package.json') && !tracked.some((file) => file.startsWith('be/')))
         return { result: null, findings: [] };
-    const jest = await createJestEnvironment({ appRoot: repoRoot, side: 'be' });
+    const jest = await createJestEnvironment({ appRoot: repoRoot, side: 'be', execute });
     let judged = [];
-    const result = runTestFamily({
+    const result = await runTestFamily({
         session, jest, side: 'be', merge: installedSpecMerge(repoRoot),
         judge: (lcovPath) => {
             const report = coverageFrom({ repoRoot, lcov: fs.readFileSync(lcovPath, 'utf8'), files: [...tracked] });
@@ -64,10 +64,12 @@ export async function runTestForApp(session, { repoRoot, tracked }) {
     return { result, findings };
 }
 /** `--test --full --shard i/n`: one shard of the full unit run in the shape the shard merge reads; nothing is recorded. */
-export function runTestShard(repoRoot, index, total) {
+export async function runTestShard(repoRoot, index, total, execute) {
     const shard = shardArgs(index, total);
     const jestBin = createRequire(path.join(repoRoot, 'be', 'package.json')).resolve('jest/bin/jest');
-    const run = spawnSync(process.execPath, [jestBin, ...shard.args], { cwd: path.join(repoRoot, 'be'), stdio: 'inherit', env: { ...process.env, ...shard.env } });
+    const run = completedNode(await runHeavyNode(execute, { kind: 'test', label: `app check jest shard ${index}/${total}`, args: [jestBin, ...shard.args], cwd: path.join(repoRoot, 'be'), env: { ...process.env, ...shard.env }, maxBuffer: 256 * 1024 * 1024 }), 'jest shard');
+    process.stdout.write(run.stdout);
+    process.stderr.write(run.stderr);
     return run.status ?? 1;
 }
 /** `--sonar`: the Sonar and Codecov baselines and the predictions from the merged coverage records; they never pass or fail a run. */

package/cache/hfs-family.d.mts

@@ -1,3 +1,4 @@
+import type { HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type MachineFn, type RepositoryResult } from '../runtime/scripts/hfs/check.mjs';
 import type { Presets } from '../sync/index.mjs';
 import type { CheckSession, FamilyReport } from './types.mjs';
@@ -20,6 +21,7 @@ export interface PassResult {
 }
 export interface PassInput {
     readonly repoRoot: string;
+    readonly execute?: HeavyNodeRun | undefined;
     readonly harness?: {
         version?: string;
     } | undefined;

package/cache/hfs-family.mjs

@@ -7,9 +7,9 @@ import { checkRepo, checkRepository, trackedFiles } from '../runtime/scripts/hfs
 import { checkArchitecture } from '../runtime/scripts/hfs/architecture/index.mjs';
 import { withoutBootProof } from '../runtime/scripts/hfs/rules/boot-proof.mjs';
 import { withUnusedSymbolMemo } from '../runtime/scripts/hfs/rules/unused-symbol.mjs';
-import { contractEmitFindings } from '../runtime/scripts/hfs/rules/contract.mjs';
+import { contractEmitFindingsAsync } from '../runtime/scripts/hfs/rules/contract.mjs';
 import { loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
-import { emitContracts } from '../emit/contracts.mjs';
+import { emitContractsAsync } from '../emit/contracts.mjs';
 import { summarize } from '../runtime/scripts/hfs/check-results.mjs';
 import { managedFindings } from '../sync/managed.mjs';
 import { RecordSet, scopedStep } from './records.mjs';
@@ -61,9 +61,9 @@ export async function runStructurePass(session, input) {
         const key = keys.get('be');
         const emit = await scopedStep(session, records, {
             path: 'be', step: 'contract-emit', key: key?.key ?? 'none', reuse, inputs: key?.inputs ?? [],
-            compute: () => {
+            compute: async () => {
                 const files = tracked.filter((file) => file.startsWith(bePrefix)).map((file) => file.slice(bePrefix.length));
-                const emitted = contractEmitFindings({ repoRoot: path.join(repoRoot, 'be'), files, repo: be, emit: emitContracts });
+                const emitted = await contractEmitFindingsAsync({ repoRoot: path.join(repoRoot, 'be'), files, repo: be, emit: (request) => emitContractsAsync({ ...request, execute: input.execute }) });
                 return JSON.parse(JSON.stringify({ findings: emitted.findings, apps: emitted.apps }));
             },
             compact: (value) => (value.findings).map(compact),

package/cache/run.d.mts

@@ -1,3 +1,4 @@
+import type { HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type CheckFinding, type RepositoryResult } from '../runtime/scripts/hfs/check.mjs';
 import type { Presets } from '../sync/index.mjs';
 import type { Prettier } from '../sync/format.mjs';
@@ -6,6 +7,7 @@ import { type CheckSession, type FamilyId, type FamilyReport } from './types.mjs
 export declare const DEFAULT_FAMILIES: readonly FamilyId[];
 export interface AppRunInput {
     readonly repoRoot: string;
+    readonly execute?: HeavyNodeRun | undefined;
     readonly tracked: readonly string[];
     readonly session: CheckSession;
     readonly selected: ReadonlySet<FamilyId>;

package/cache/run.mjs

@@ -1,6 +1,3 @@
-// run.mts - one `starci app check` / `starci app lint` pass over the selected families, against one session. It owns the order of the families,
-// the judging of their findings (edition and the Vietnamese why of every code) and the merge into the one result the verb prints and the gate
-// judges, so the two verbs never hold two answers for one tree.
 import { skillRoot } from '../runtime/engine/runtime-root.mjs';
 import { readWhy } from '../runtime/scripts/hfs/check.mjs';
 import { judgedFindings, summarize, withWhy } from '../runtime/scripts/hfs/check-results.mjs';
@@ -23,7 +20,7 @@ export async function runAppFamilies(input) {
     const track = (report) => void (report && reports.push(report));
     const structure = selected.has('hfs') || selected.has('secrets');
     const pass = structure
-        ? await runStructurePass(session, { repoRoot, harness: input.harness, presets: input.presets, tracked: input.tracked, hfs: selected.has('hfs'), secrets: selected.has('secrets') })
+        ? await runStructurePass(session, { repoRoot, harness: input.harness, presets: input.presets, tracked: input.tracked, hfs: selected.has('hfs'), secrets: selected.has('secrets'), execute: input.execute })
         : null;
     if (pass) {
         track(pass.report);
@@ -43,7 +40,7 @@ export async function runAppFamilies(input) {
     }
     let wiring;
     if (selected.has('wiring')) {
-        const proved = await runWiringFamily(session, { repoRoot, edition: input.edition, files: input.tracked });
+        const proved = await runWiringFamily(session, { repoRoot, edition: input.edition, files: input.tracked, execute: input.execute });
         track(proved.report);
         wiring = { status: proved.wiring.status, apps: proved.wiring.apps, findings: proved.wiring.findings };
         extra.push(...proved.wiring.findings);

package/cache/test-family.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import type { CacheRecord, CheckSession, FamilyReport, JsonValue } from './types.mjs';
 /** The folder of the session that holds the records of this family. */
 export declare const TEST_FOLDER = "test-coverage";
@@ -33,7 +34,7 @@ export interface JestEnvironment {
     /** The digest of the unit project's configuration, free of host paths. */
     readonly configHash: string;
     /** Runs `specs` (all of them when `specs` is every spec) writing the per-spec coverage into `coverageDir`. */
-    run(specs: readonly string[], coverageDir: string): RunOutcome;
+    run(specs: readonly string[], coverageDir: string): RunOutcome | Promise<RunOutcome>;
     /** Reads what the reporter wrote into `coverageDir`. */
     readCoverage(coverageDir: string): readonly SpecCoverageOutput[];
 }
@@ -94,7 +95,7 @@ export declare function sourcesOf(record: CacheRecord): Record<string, SourceIte
  * Runs the unit specs against the cache. Diff mode runs the specs with no current record, full mode all of them; a passing spec's coverage is stored under its key,
  * a failing one's is not, and the folder is replaced with exactly the current specs' records. The merged total is written to `<side>/coverage/lcov.info` and judged.
  */
-export declare function runTestFamily(options: TestFamilyOptions): TestFamilyResult;
+export declare function runTestFamily(options: TestFamilyOptions): Promise<TestFamilyResult>;
 /** The part of a Jest project config the closure needs. */
 interface ProjectConfigLike {
     readonly rootDir: string;
@@ -111,11 +112,12 @@ export declare function projectConfigHash(config: ProjectConfigLike): string;
  * The app's own Jest, resolved from `jestFrom` (a package.json or folder inside the app's install): its unit project's configuration, its haste map and resolver
  * (so `moduleNameMapper`, `jest.mock` targets and setup files count as Jest sees them), and its binary to run specs. `side` is the Jest root, app-relative.
  */
-export declare function createJestEnvironment({ appRoot, side, jestFrom, project }: {
+export declare function createJestEnvironment({ appRoot, side, jestFrom, project, execute }: {
     appRoot: string;
     side: string;
     jestFrom?: string;
     project?: string;
+    execute?: HeavyNodeRun | undefined;
 }): Promise<JestEnvironment>;
 /** The installed preset's union merge (resolved like the shard merge of `app coverage`): the records in, the lcov and coverage-final.json out. */
 export declare function installedSpecMerge(appRoot: string, from?: string): MergeSpecRecords;

package/cache/test-family.mjs

@@ -8,7 +8,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { spawnSync } from 'node:child_process';
+import { completedNode, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import { combineHashes, hashFile } from './hash.mjs';
 import { canonicalJson } from './jsonl.mjs';
 /** The folder of the session that holds the records of this family. */
@@ -57,7 +57,7 @@ function recordOf(spec, key, sources, side) {
  * Runs the unit specs against the cache. Diff mode runs the specs with no current record, full mode all of them; a passing spec's coverage is stored under its key,
  * a failing one's is not, and the folder is replaced with exactly the current specs' records. The merged total is written to `<side>/coverage/lcov.info` and judged.
  */
-export function runTestFamily(options) {
+export async function runTestFamily(options) {
     const { session, jest, side, merge, judge } = options;
     const decision = session.decide('test');
     const hashOf = (file) => session.index.hashOf(file) ?? hashFile(path.join(session.root, file));
@@ -79,7 +79,7 @@ export function runTestFamily(options) {
         try {
             fs.rmSync(scratch, { recursive: true, force: true });
             fs.mkdirSync(scratch, { recursive: true });
-            output = jest.run(toRun, scratch).output;
+            output = (await jest.run(toRun, scratch)).output;
             const reported = new Map(jest.readCoverage(scratch).map((file) => [file.spec, file]));
             for (const spec of toRun) {
                 const file = reported.get(posix(path.relative(path.join(session.root, side), path.join(session.root, spec))));
@@ -144,7 +144,7 @@ export function projectConfigHash(config) {
  * The app's own Jest, resolved from `jestFrom` (a package.json or folder inside the app's install): its unit project's configuration, its haste map and resolver
  * (so `moduleNameMapper`, `jest.mock` targets and setup files count as Jest sees them), and its binary to run specs. `side` is the Jest root, app-relative.
  */
-export async function createJestEnvironment({ appRoot, side, jestFrom, project = 'unit' }) {
+export async function createJestEnvironment({ appRoot, side, jestFrom, project = 'unit', execute }) {
     const root = path.resolve(appRoot, side);
     const fromApp = createRequire(jestFrom ?? path.join(root, 'package.json'));
     const jestPackage = fromApp.resolve('jest/package.json');
@@ -189,7 +189,7 @@ export async function createJestEnvironment({ appRoot, side, jestFrom, project =
     const relative = (file) => posix(path.relative(appRoot, file));
     const setup = (name) => [...(config[name] ?? [])];
     const setupClosure = closureFrom([...setup('setupFiles'), ...setup('setupFilesAfterEnv')]).map(relative);
-    const listed = spawnSync(process.execPath, [jestBin, '--selectProjects', project, '--listTests'], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    const listed = completedNode(await runHeavyNode(execute, { kind: 'test', label: `app check jest ${project} discovery`, args: [jestBin, '--selectProjects', project, '--listTests'], cwd: root, maxBuffer: 64 * 1024 * 1024 }), 'jest discovery');
     if (listed.status !== 0)
         throw new Error(`jest --listTests failed under ${side}: ${(listed.stderr || listed.stdout).split('\n')[0]}`);
     const specs = listed.stdout.split(/\r?\n/u).map((line) => line.trim()).filter((line) => path.isAbsolute(line)).map((line) => relative(path.resolve(line))).sort();
@@ -206,7 +206,7 @@ export async function createJestEnvironment({ appRoot, side, jestFrom, project =
             closures.set(spec, closure);
             return closure;
         },
-        run(toRun, coverageDir) {
+        async run(toRun, coverageDir) {
             const base = [jestBin, '--selectProjects', project, '--coverage', '--ci'];
             const everything = toRun.length === specs.length;
             const sideRelative = toRun.map((spec) => posix(path.relative(root, path.resolve(appRoot, spec))));
@@ -223,7 +223,7 @@ export async function createJestEnvironment({ appRoot, side, jestFrom, project =
             let output = '';
             for (const chunk of chunks) {
                 const args = chunk.length > 0 ? [...base, '--runTestsByPath', ...chunk] : base;
-                const result = spawnSync(process.execPath, args, { cwd: root, encoding: 'utf8', env: { ...process.env, STARCI_SPEC_COVERAGE_DIR: coverageDir }, maxBuffer: 256 * 1024 * 1024 });
+                const result = completedNode(await runHeavyNode(execute, { kind: 'test', label: `app check jest ${project} coverage`, args, cwd: root, env: { ...process.env, STARCI_SPEC_COVERAGE_DIR: coverageDir }, maxBuffer: 256 * 1024 * 1024 }), 'jest coverage');
                 status = status || (result.status ?? 1);
                 output += `${result.stdout}${result.stderr}`;
             }

package/cache/types-family.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import type { CheckSession, FamilyReport, Finding } from './types.mjs';
 /** The folder of the session that holds the records of this family. */
 export declare const TYPES_FOLDER = "check/types";
@@ -29,7 +30,7 @@ export interface TypesFamilyOptions {
     readonly session: CheckSession;
     readonly programs: readonly TypesProgram[];
     /** Runs one program's `tsc`; `buildInfo` is where its `.tsbuildinfo` goes (the untracked tool cache). */
-    readonly run: (program: TypesProgram, buildInfo: string) => TscOutcome;
+    readonly run: (program: TypesProgram, buildInfo: string) => TscOutcome | Promise<TscOutcome>;
     /** The untracked tool cache of slot `app.tool-cache` (`<STARCI_CACHE_HOME>/<repo>/app-check`). */
     readonly toolCacheDir: string;
     readonly inputsOf?: (program: TypesProgram) => ProgramInputs;
@@ -63,12 +64,13 @@ export declare function parseTscOutput(output: string, appRoot: string, fallback
  * Runs the type check of every program against the cache. A program whose key is unchanged takes its recorded diagnostics; a changed one runs in full (all of them
  * under `--full`). A run that produced no diagnostics and failed (tsc itself could not complete) stores nothing, and so does a program whose files changed while it ran.
  */
-export declare function runTypesFamily(options: TypesFamilyOptions): TypesFamilyResult;
+export declare function runTypesFamily(options: TypesFamilyOptions): Promise<TypesFamilyResult>;
 /**
  * The real `tsc` of an app: the program's own TypeScript (resolved from its folder, so the version the lockfile pins), `--noEmit` with an incremental build info in the
  * tool cache, run from the app root so paths in the output are app-relative.
  */
-export declare function createTscRunner({ appRoot, typescriptFrom }: {
+export declare function createTscRunner({ appRoot, typescriptFrom, execute }: {
     appRoot: string;
     typescriptFrom?: string;
+    execute?: HeavyNodeRun | undefined;
 }): TypesFamilyOptions['run'];

package/cache/types-family.mjs

@@ -6,7 +6,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { spawnSync } from 'node:child_process';
+import { completedNode, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import { CACHE_DIR } from './types.mjs';
 import { combineHashes, hashFile } from './hash.mjs';
 import { sortFindings } from './jsonl.mjs';
@@ -84,7 +84,7 @@ const identity = (finding) => `${finding.path}\0${finding.rule}\0${finding.messa
  * Runs the type check of every program against the cache. A program whose key is unchanged takes its recorded diagnostics; a changed one runs in full (all of them
  * under `--full`). A run that produced no diagnostics and failed (tsc itself could not complete) stores nothing, and so does a program whose files changed while it ran.
  */
-export function runTypesFamily(options) {
+export async function runTypesFamily(options) {
     const { session, programs, run, toolCacheDir } = options;
     const decision = session.decide('types');
     const previous = new Map(session.records(TYPES_FOLDER).filter((record) => record.step === TSC_STEP).map((record) => [record.path, record]));
@@ -108,7 +108,7 @@ export function runTypesFamily(options) {
             reused.push(program.name);
         }
         else {
-            const outcome = run(program, tsBuildInfoPath(toolCacheDir, session.root, program));
+            const outcome = await run(program, tsBuildInfoPath(toolCacheDir, session.root, program));
             ran.push(program.name);
             current = parseTscOutput(outcome.output, session.root, program.tsconfig);
             if (current.length === 0 && outcome.status !== 0)
@@ -141,14 +141,15 @@ export function runTypesFamily(options) {
  * The real `tsc` of an app: the program's own TypeScript (resolved from its folder, so the version the lockfile pins), `--noEmit` with an incremental build info in the
  * tool cache, run from the app root so paths in the output are app-relative.
  */
-export function createTscRunner({ appRoot, typescriptFrom }) {
-    return (program, buildInfo) => {
+export function createTscRunner({ appRoot, typescriptFrom, execute }) {
+    return async (program, buildInfo) => {
         const folder = path.resolve(appRoot, path.posix.dirname(program.tsconfig));
         const tsc = path.join(path.dirname(createRequire(typescriptFrom ?? path.join(folder, 'package.json')).resolve('typescript/package.json')), 'bin', 'tsc');
         fs.mkdirSync(path.dirname(buildInfo), { recursive: true });
-        const result = spawnSync(process.execPath, [tsc, '-p', posix(path.relative(appRoot, path.resolve(appRoot, program.tsconfig))), '--noEmit', '--incremental', '--tsBuildInfoFile', buildInfo, '--pretty', 'false'], {
-            cwd: appRoot, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024,
-        });
+        const result = completedNode(await runHeavyNode(execute, {
+            kind: 'tsc', label: `app check tsc ${program.name}`, args: [tsc, '-p', posix(path.relative(appRoot, path.resolve(appRoot, program.tsconfig))), '--noEmit', '--incremental', '--tsBuildInfoFile', buildInfo, '--pretty', 'false'],
+            cwd: appRoot, maxBuffer: 256 * 1024 * 1024,
+        }), 'tsc');
         return { status: result.status ?? 1, output: `${result.stdout}${result.stderr}` };
     };
 }

package/cache/wiring-family.d.mts

@@ -1,3 +1,4 @@
+import type { HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type WiringResult } from '../runtime/scripts/hfs/app-wiring.mjs';
 import type { CheckSession, FamilyReport } from './types.mjs';
 export declare const WIRING_FOLDER = "check/wiring";
@@ -6,9 +7,10 @@ export interface WiringFamilyResult {
     readonly report: FamilyReport;
 }
 /** The boot proof family. `explicit` is the whole-tree proof of `--wiring`; without it a missing install leaves the compile unjudged, as the content finder does. */
-export declare function runWiringFamily(session: CheckSession, { repoRoot, edition, files, run }: {
+export declare function runWiringFamily(session: CheckSession, { repoRoot, edition, files, run, execute }: {
     repoRoot: string;
     edition?: string | undefined;
     files?: readonly string[] | undefined;
-    run?: ((repoRoot: string) => WiringResult) | undefined;
+    run?: ((repoRoot: string) => WiringResult | Promise<WiringResult>) | undefined;
+    execute?: HeavyNodeRun | undefined;
 }): Promise<WiringFamilyResult>;

package/cache/wiring-family.mjs

@@ -2,7 +2,7 @@
 // back-end side key is unchanged. A timeout reached no verdict and is never stored.
 import fs from 'node:fs';
 import path from 'node:path';
-import { appWiring, BOOT_PROOF_TIMEOUT } from '../runtime/scripts/hfs/app-wiring.mjs';
+import { appWiringAsync, BOOT_PROOF_TIMEOUT } from '../runtime/scripts/hfs/app-wiring.mjs';
 import { loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
 import { trackedFiles } from '../runtime/scripts/hfs/check.mjs';
 import { RecordSet, scopedStep } from './records.mjs';
@@ -11,16 +11,16 @@ import { sideKey } from './side-key.mjs';
 export const WIRING_FOLDER = 'check/wiring';
 const compact = (finding) => ({ path: finding.path, line: 0, column: 0, rule: finding.code, message: finding.message });
 /** The boot proof family. `explicit` is the whole-tree proof of `--wiring`; without it a missing install leaves the compile unjudged, as the content finder does. */
-export async function runWiringFamily(session, { repoRoot, edition, files, run }) {
+export async function runWiringFamily(session, { repoRoot, edition, files, run, execute }) {
     const decision = session.decide('wiring');
     const records = new RecordSet(session.records(WIRING_FOLDER));
     const key = sideKey(repoRoot, session.index, 'be');
-    const prove = () => {
+    const prove = async () => {
         if (run)
             return run(repoRoot);
         const declared = readRepoDeclaration(loadSlotManifest(), repoRoot);
         const repo = { ...declared, edition: edition ?? declared.edition };
-        const proof = appWiring({ repoRoot, repo: repo, files: [...(files ?? trackedFiles(repoRoot))] });
+        const proof = await appWiringAsync({ repoRoot, repo: repo, files: [...(files ?? trackedFiles(repoRoot))], execute });
         const installed = fs.existsSync(path.join(repoRoot, 'node_modules')) || fs.existsSync(path.join(repoRoot, 'be', 'node_modules'));
         const findings = proof.findings.filter((finding) => installed || finding.reason !== 'module or proof could not be compiled');
         return { ...proof, findings, ok: findings.length === 0 };
@@ -28,7 +28,7 @@ export async function runWiringFamily(session, { repoRoot, edition, files, run }
     const step = session.progress.step('wiring', 'boot proof', Math.max(1, key.inputs.length));
     const { value, reused } = await scopedStep(session, records, {
         path: 'be', step: 'boot-proof', key: key.key, reuse: decision.mode === 'diff', inputs: key.inputs,
-        compute: () => JSON.parse(JSON.stringify(prove())),
+        compute: async () => JSON.parse(JSON.stringify(await prove())),
         compact: (found) => found.findings.map(compact),
         store: (found) => !found.findings.some((finding) => finding.code === BOOT_PROOF_TIMEOUT),
     });

package/emit/contracts.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 /** The parts of the parsed hfs.json this module reads. */
 export interface HfsDeclaration {
     readonly apps?: ReadonlyArray<{
@@ -18,18 +19,20 @@ export declare function aliasesOf(paths: Readonly<Record<string, readonly string
 export declare function aliasTarget(aliases: readonly PathAlias[], specifier: string): string | null;
 /** The text written to a snapshot file: the printed schema and one final newline. Pure. */
 export declare const snapshotText: (printed: string) => string;
-/**
- * Writes the snapshots of every api app: `contracts/<app>/schema.graphql` when it serves GraphQL and `contracts/<app>/openapi.json`
- * when it has an operation table. Answers `{ written: [paths], skipped: [apps], standIns: { app: [lines] } }`, `skipped`
- * being the apps with neither. `declaration` is the parsed hfs.json. `outDir` (absolute) redirects the snapshots to another
- * root, keeping their relative paths.
- */
-export declare function emitContracts({ repoRoot, declaration, outDir }: {
+interface EmitInput {
     repoRoot: string;
     declaration: HfsDeclaration;
     outDir?: string;
-}): {
+}
+interface EmitResult {
     written: string[];
     skipped: string[];
     standIns: Record<string, string[]>;
-};
+}
+/** Existing synchronous emitter for source finders and their worker proofs. */
+export declare function emitContracts(input: EmitInput): EmitResult;
+/** App-check/emit execution: each actual compiler worker is admitted separately, with the original isolated environment. */
+export declare function emitContractsAsync(input: EmitInput & {
+    execute?: HeavyNodeRun | undefined;
+}): Promise<EmitResult>;
+export {};

package/emit/contracts.mjs

@@ -21,6 +21,7 @@
  * * artifact, so a redirected `outDir` (the R23 check mode, which emits into a scratch root) does not get them.
  */
 import { spawnSync } from 'node:child_process';
+import { completedNode, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -50,9 +51,8 @@ export function aliasTarget(aliases, specifier) {
 const apiApps = (declaration) => (declaration.apps ?? []).filter((app) => app.kind === 'api').map((app) => app.name);
 /** The text written to a snapshot file: the printed schema and one final newline. Pure. */
 export const snapshotText = (printed) => `${printed.replace(/\n+$/, '')}\n`;
-/** Runs one worker of one app; answers its stdout, or null when the app has nothing of that kind (exit 3). */
-function runWorker(worker, repoRoot, app) {
-    const result = spawnSync(process.execPath, [worker, repoRoot, app], { encoding: 'utf8', cwd: repoRoot, env: { PATH: readEnv('PATH') ?? '' }, maxBuffer: 256 * 1024 * 1024 });
+/** Both transports judge the same native worker status and exact text. Exit 3 means the app serves no such contract. */
+function workerOutput(result, app) {
     if (result.status === 3)
         return { text: null, lines: [] };
     const lines = (result.stderr ?? '').split(/\r?\n/).filter(Boolean);
@@ -60,24 +60,20 @@ function runWorker(worker, repoRoot, app) {
         throw new Error(`starci app emit: ${app} failed (exit ${result.status}): ${(lines.join('\n') || result.stdout).trim()}`);
     return { text: result.stdout, lines: lines.filter((line) => line.startsWith(STAND_IN)) };
 }
-/** Emits the GraphQL schema and the operations of one app: `{ graphql, openapi, standIns }`, each text or null. */
-function emitApp(repoRoot, app) {
-    const graphql = runWorker(WORKER, repoRoot, app);
-    const operations = runWorker(OPERATIONS_WORKER, repoRoot, app);
-    return { graphql: graphql.text, openapi: operations.text, standIns: [...graphql.lines, ...operations.lines] };
-}
 /**
  * Writes the snapshots of every api app: `contracts/<app>/schema.graphql` when it serves GraphQL and `contracts/<app>/openapi.json`
  * when it has an operation table. Answers `{ written: [paths], skipped: [apps], standIns: { app: [lines] } }`, `skipped`
  * being the apps with neither. `declaration` is the parsed hfs.json. `outDir` (absolute) redirects the snapshots to another
  * root, keeping their relative paths.
  */
-export function emitContracts({ repoRoot, declaration, outDir = repoRoot }) {
+function* emissionProgram({ repoRoot, declaration, outDir = repoRoot }) {
     const written = [];
     const skipped = [];
     const standIns = {};
     for (const app of apiApps(declaration)) {
-        const emitted = emitApp(repoRoot, app);
+        const graphql = yield { worker: WORKER, repoRoot, app };
+        const operations = yield { worker: OPERATIONS_WORKER, repoRoot, app };
+        const emitted = { graphql: graphql.text, openapi: operations.text, standIns: [...graphql.lines, ...operations.lines] };
         if (emitted.graphql === null && emitted.openapi === null) {
             skipped.push(app);
             continue;
@@ -106,3 +102,25 @@ export function emitContracts({ repoRoot, declaration, outDir = repoRoot }) {
     }
     return { written, skipped, standIns };
 }
+/** Existing synchronous emitter for source finders and their worker proofs. */
+export function emitContracts(input) {
+    const program = emissionProgram(input);
+    let step = program.next();
+    while (!step.done) {
+        const { worker, repoRoot, app } = step.value;
+        const result = spawnSync(process.execPath, [worker, repoRoot, app], { encoding: 'utf8', cwd: repoRoot, env: { PATH: readEnv('PATH') ?? '' }, maxBuffer: 256 * 1024 * 1024 });
+        step = program.next(workerOutput(result, app));
+    }
+    return step.value;
+}
+/** App-check/emit execution: each actual compiler worker is admitted separately, with the original isolated environment. */
+export async function emitContractsAsync(input) {
+    const program = emissionProgram(input);
+    let step = program.next();
+    while (!step.done) {
+        const { worker, repoRoot, app } = step.value;
+        const result = completedNode(await runHeavyNode(input.execute, { kind: 'tsc', label: `app emit ${app} ${path.basename(worker)}`, args: [worker, repoRoot, app], cwd: repoRoot, env: { PATH: readEnv('PATH') ?? '' }, maxBuffer: 256 * 1024 * 1024 }), 'contract compiler');
+        step = program.next(workerOutput(result, app));
+    }
+    return step.value;
+}

package/lint/chunk.mjs

@@ -1,4 +1,5 @@
 // chunk.mjs - split a long argument list under the command-line limit (Windows allows 32,767 characters) and run the parts with bounded concurrency.
+import { isHostHeld, isNodeExecutionRefusal } from '../runtime/scripts/api/node/run-node.mjs';
 /** The command-line characters one argument costs: its length, a separating space and a pair of quotes. */
 const cost = (arg) => String(arg).length + 3;
 /**
@@ -26,18 +27,26 @@ export function chunkByChars(items, budget = 24_000) {
 export async function mapBounded(chunks, task, limit = 3) {
     const out = new Array(chunks.length);
     let next = 0;
+    let held;
     const worker = async () => {
-        while (next < chunks.length) {
+        while (next < chunks.length && held === undefined) {
             const at = next++;
             try {
                 out[at] = await task(chunks[at], at);
             }
             catch (error) {
-                out[at] = { error: `could not start a lint child: ${String(error?.message ?? error)}` };
+                if (isNodeExecutionRefusal(error)) {
+                    if (held === undefined || isHostHeld(error))
+                        held = error;
+                }
+                else
+                    out[at] = { error: `could not start a lint child: ${String(error?.message ?? error)}` };
             }
         }
     };
     await Promise.all(Array.from({ length: Math.min(limit, chunks.length) }, worker));
+    if (held !== undefined)
+        throw held;
     return out;
 }
 /** Merge the `{ results, error }` records of the chunks, in chunk order: every result kept, every distinct error reported. */

package/lint/run.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type CanonDeclarations, type LintSideStats } from '../cache/lint-family.mjs';
 import type { CheckSession } from '../cache/types.mjs';
 type Dynamic = any;
@@ -62,7 +63,7 @@ export declare function runLinter({ cwd, pkg, bin, args, bound }: {
     bin: string;
     args: string[];
     bound?: string | null;
-}): Promise<LinterRun>;
+}, execute?: HeavyNodeRun): Promise<LinterRun>;
 /**
  * The lint scope a flat config declares: `ignored(file)` for its global ignores (a block holding only `ignores` and `name`), which prune
  * the walk, and `source(file)` for a file some block's `files` select while that block's own `ignores` do not (standard flat-config

package/lint/run.mjs

@@ -30,7 +30,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { spawn } from 'node:child_process';
+import { completedNode, isHostHeld, isNodeExecutionRefusal, runHeavyNode } from '../runtime/scripts/api/node/run-node.mjs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { linterReport, mergeReports, sonarReport, sourceRootsOf } from '../report/sonar.mjs';
 import { SIDES, appRelativeMessages, loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
@@ -119,28 +119,8 @@ export function eslintHeapArgs(env = process.env) {
     const mb = Number(env[ESLINT_HEAP_ENV]);
     return Number.isInteger(mb) && mb > 0 ? [`--max-old-space-size=${mb}`] : [];
 }
-/** The child `node` ran with `args` from `cwd`: its exit status, signal, spawn error and the text of both streams, once it closes. */
-function runNode(args, options) {
-    return new Promise((resolve) => {
-        let child;
-        try {
-            child = spawn(process.execPath, args, { ...options, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
-        }
-        catch (error) {
-            resolve({ status: 2, signal: null, error: error, stdout: '', stderr: String(error?.message ?? error) });
-            return;
-        }
-        const out = [];
-        const err = [];
-        let failure;
-        child.stdout.on('data', (chunk) => out.push(chunk));
-        child.stderr.on('data', (chunk) => err.push(chunk));
-        child.on('error', (error) => { failure = error; });
-        child.on('close', (status, signal) => resolve({ status, signal, error: failure, stdout: Buffer.concat(out).toString('utf8'), stderr: Buffer.concat(err).toString('utf8') }));
-    });
-}
 /** A linter's json results through the app's own install, run from `cwd` (a side folder): `{ results }` or `{ error }`. The child runs while the caller goes on. */
-export async function runLinter({ cwd, pkg, bin, args, bound = null }) {
+export async function runLinter({ cwd, pkg, bin, args, bound = null }, execute) {
     let entry;
     try {
         const manifest = createRequire(path.join(cwd, 'package.json')).resolve(`${pkg}/package.json`);
@@ -151,7 +131,7 @@ export async function runLinter({ cwd, pkg, bin, args, bound = null }) {
         return { error: `${pkg} is not installed for ${cwd}` };
     }
     const heap = pkg === 'eslint' ? eslintHeapArgs() : [];
-    const run = await runNode([...heap, ...(bound ? linterBoundArgs() : []), entry, ...args], { cwd, ...(bound ? { env: { ...process.env, [BOUND_ENV]: bound } } : {}) });
+    const run = completedNode(await runHeavyNode(execute, { kind: 'eslint', label: `app lint ${pkg} ${path.basename(cwd)}`, args: [...heap, ...(bound ? linterBoundArgs() : []), entry, ...args], cwd, maxBuffer: 64 * 1024 * 1024, ...(bound ? { env: { ...process.env, [BOUND_ENV]: bound } } : {}) }), pkg);
     // ESLint prints its report on stdout; stylelint uses stderr. JSON does not prove a completed child: only exits 0/1
     // without a spawn error or signal are measurable, and exit 1 must carry findings.
     let results;
@@ -348,7 +328,11 @@ function checkedEslintResults({ results, expected, cwd, scope, changed }) {
 const ESLINT_ARGV_BUDGET = 24_000;
 const ESLINT_CONCURRENCY = 3;
 /** A launch that threw instead of returning a record is a tool error of the run (exit 2), not a crash of the CLI. */
-const spawnFailure = (error) => ({ error: `could not start eslint: ${String(error?.message ?? error)}` });
+const spawnFailure = (error) => {
+    if (isNodeExecutionRefusal(error))
+        throw error;
+    return { error: `could not start eslint: ${String(error?.message ?? error)}` };
+};
 /** Starts the ESLint child of every side that has work and returns one record per side: skipped, a scope error, or the running child. */
 async function launchEslint({ app, repoRoot, opts, changed, existing, workspace, onFe, run = runLinter }) {
     const launches = [];
@@ -386,7 +370,12 @@ export async function eslintRepository({ repoRoot, app = readRepoDeclaration(loa
     if (!app.sides)
         throw new Error('ESLint runs at the app root, the folder of hfs.json');
     const launches = await launchEslint({ app, repoRoot, opts, changed, existing, workspace, onFe, run });
-    const runs = await Promise.all(launches.map(launch => launch.run ?? null));
+    const settled = await Promise.allSettled(launches.map(launch => launch.run ?? null));
+    const rejected = settled.filter((run) => run.status === 'rejected');
+    const failed = rejected.find(run => isHostHeld(run.reason)) ?? rejected[0];
+    if (failed !== undefined)
+        throw failed.reason;
+    const runs = settled.map(run => run.status === 'fulfilled' ? run.value : null);
     launches.forEach((launch, at) => {
         const { side } = launch;
         if (launch.skipped) {
@@ -528,7 +517,7 @@ export async function cachedLinters({ repoRoot, app, opts, workspace, onFe, run,
                 return { results: sub.raw, errors: sub.errors };
             },
             stylelint: styled ? async (files) => {
-                const linted = await runLinter({ cwd, pkg: 'stylelint', bin: 'stylelint', args: [...(files ?? [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json'] });
+                const linted = await (run ?? runLinter)({ cwd, pkg: 'stylelint', bin: 'stylelint', args: [...(files ?? [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json'] });
                 const appRelative = appRelativeMessages(STYLE_SIDE, cwd);
                 for (const result of linted.results ?? [])
                     for (const warning of result.warnings ?? [])
@@ -551,13 +540,13 @@ export async function cachedLinters({ repoRoot, app, opts, workspace, onFe, run,
     return { eslint, stylelint: style, sides };
 }
 /** Starts stylelint over the fe stylesheets (the running child), or returns null when no stylesheet is in scope. */
-function launchStylelint({ repoRoot, opts, changed, existing, onFe }) {
+function launchStylelint({ repoRoot, opts, changed, existing, onFe, run }) {
     if (opts.side === 'be')
         return null;
     const styles = onSide(existing, STYLE_SIDE).filter((file) => file.endsWith('.css'));
     if (changed !== null && !styles.length)
         return null;
-    return runLinter({ cwd: path.join(repoRoot, STYLE_SIDE), pkg: 'stylelint', bin: 'stylelint', args: [...(changed ? styles : [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json', ...(opts.fix ? ['--fix'] : [])] });
+    return (run ?? runLinter)({ cwd: path.join(repoRoot, STYLE_SIDE), pkg: 'stylelint', bin: 'stylelint', args: [...(changed ? styles : [onFe ? `${onFe}/src/**/*.css` : STYLE_GLOB]), '--formatter', 'json', ...(opts.fix ? ['--fix'] : [])] });
 }
 /**
  * Run the whole lint of the app at `repoRoot`. `hfsCheck(repoRoot)` returns the `starci app check` result (`{ findings, tracked }`); the CLI
@@ -613,8 +602,14 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
     const cached = cache !== undefined && changed === null && !opts.fix ? cache : null;
     const cachedRun = app && cached ? cachedLinters({ app, repoRoot, opts, workspace, onFe, run: linter, cache: cached }) : null;
     const eslintRun = app ? (cachedRun ? cachedRun.then((answer) => answer.eslint) : eslintRepository({ app, repoRoot, opts, changed: changed ? [...changed] : null, existing, workspace, onFe, run: linter })) : null;
-    const styleLaunch = app && !cachedRun ? launchStylelint({ repoRoot, opts, changed, existing, onFe }) : null;
+    const styleLaunch = app && !cachedRun ? launchStylelint({ repoRoot, opts, changed, existing, onFe, run: linter }) : null;
     const checkRun = app ? Promise.resolve().then(() => hfsCheck(repoRoot)).then((value) => ({ value, error: undefined }), (error) => ({ value: undefined, error })) : null;
+    // A transport refusal does not abandon a sibling child or let its rejection escape unobserved.
+    const completed = await Promise.allSettled([eslintRun, styleLaunch, checkRun]);
+    const refused = completed.filter((run) => run.status === 'rejected');
+    const failure = refused.find(run => isHostHeld(run.reason)) ?? refused[0];
+    if (failure !== undefined)
+        throw failure.reason;
     // 1. ESLint, once per side, from the side folder with that side's config.
     const eslint = eslintRun ? await eslintRun : { engine: { sides: {} }, errors: [], raw: [], findings: [] };
     engines.eslint = eslint.engine;
@@ -649,6 +644,8 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
     let checked = { findings: [] };
     if (checkRun) {
         const settled = await checkRun;
+        if (isNodeExecutionRefusal(settled.error))
+            throw settled.error;
         if (settled.error)
             errors.push(`starci app check could not run: ${String(settled.error?.message ?? settled.error)}`);
         else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "5.0.3",
+  "version": "5.0.5",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/grammars/index.yaml

@@ -68,6 +68,18 @@ families:
       package: '@starci/grammar'
       entry: '@starci/grammar/common'
       styleEntry: '@starci/grammar/common.css'
+      semanticRoles:
+        page:
+          export: Page
+          entries: ['@starci/grammar/common', '@starci/grammar/<family>']
+          segment: { attribute: header, member: tabs }
+          bodyContainers: [PaneGrid, Pane, Stack, PaneSection, Section]
+          # Native body transparency follows the renderer's exact context, status and intrinsic-element API.
+          bodyContainerConstraints:
+            Pane: { providesContext: pane }
+            Stack: { literalProps: { as: [div, header, footer] } }
+            PaneSection: { requiresContext: pane, absentProps: [error], literalProps: { as: [div, header, footer] } }
+            Section: { absentProps: [error], literalProps: { kind: [region] } }
       peers: [react, '@heroui/react', '@xyflow/react', react-aria-components]
     packageSnapshot: common/DNA.yaml
     scope: |

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.21.7
+    version: 0.21.9
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.11.14
+    version: 3.11.16
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.9.7
+    version: 9.9.9
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.21.7
+    version: 0.21.9
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.21.7
+    version: 0.21.9
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 5.0.3
+    version: 5.0.5
     group: starci
     install: registry
     side: both

package/runtime/scripts/api/node/run-node.d.mts

@@ -1,3 +1,32 @@
 import type { SpawnSyncOptions, SpawnSyncReturns } from 'node:child_process';
+/** A concrete Node child whose admission belongs to the CLI's machine-wide governor. */
+export interface HeavyNodeRequest {
+    readonly kind: 'tsc' | 'eslint' | 'test';
+    readonly label: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+    /** When supplied, this is the entire child environment, not an overlay. */
+    readonly env?: NodeJS.ProcessEnv | undefined;
+    readonly timeoutMs?: number | undefined;
+    readonly maxBuffer: number;
+}
+/** Normal red exits are measurements; an interrupted child is not one. */
+export interface HeavyNodeResult {
+    readonly status: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly error?: NodeJS.ErrnoException | undefined;
+}
+/** The CLI admits and captures each actual child, never the composite app command. */
+export type HeavyNodeRun = (request: HeavyNodeRequest) => Promise<HeavyNodeResult>;
+/** A real governor hold reached no verdict; transports preserve its CLI exit instead of treating it as linter output. */
+export declare const isHostHeld: (error: unknown) => boolean;
+/** Execution infrastructure reached no complete measurement; the contract finder cannot turn it into a cacheable source finding. */
+export declare const isNodeExecutionRefusal: (error: unknown) => boolean;
+/** Keeps the runtime's mutation fence and temporary-directory custody before crossing the CLI execution port. */
+export declare function runHeavyNode(run: HeavyNodeRun | undefined, request: HeavyNodeRequest): Promise<HeavyNodeResult>;
+/** A partial compiler/test report cannot be interpreted or stored as a completed measurement. */
+export declare function completedNode(result: HeavyNodeResult, label: string): HeavyNodeResult;
 /** Runs `node <args>`; options (cwd, env, timeout, input, maxBuffer, stdio) pass through. */
 export declare const runNode: (args: readonly string[], options?: SpawnSyncOptions) => SpawnSyncReturns<string>;

package/runtime/scripts/api/node/run-node.mjs

@@ -1,3 +1,22 @@
 import { nodeSpawn } from './lib.mjs';
+import { assertMutationFence } from '../../lib/mutation-fence.mjs';
+import { withTempEnv } from '../../../engine/temp-root.mjs';
+/** A real governor hold reached no verdict; transports preserve its CLI exit instead of treating it as linter output. */
+export const isHostHeld = (error) => error instanceof Error && 'code' in error && error.code === 'HOST_HELD' && 'exitCode' in error && error.exitCode === 75;
+/** Execution infrastructure reached no complete measurement; the contract finder cannot turn it into a cacheable source finding. */
+export const isNodeExecutionRefusal = (error) => error instanceof Error && 'code' in error && typeof error.code === 'string' && ['HOST_HELD', 'HEAVY_DEFERRED', 'CLI_TOOL_INCOMPLETE', 'CLI_TOOL_MISSING', 'CLI_TOOL_NOT_STARTED', 'HFS_NODE_GOVERNOR_MISSING', 'HFS_NODE_INCOMPLETE'].includes(error.code);
+/** Keeps the runtime's mutation fence and temporary-directory custody before crossing the CLI execution port. */
+export async function runHeavyNode(run, request) {
+    if (run === undefined)
+        throw Object.assign(new Error('HFS_NODE_GOVERNOR_MISSING: run this check through starci-harness'), { code: 'HFS_NODE_GOVERNOR_MISSING' });
+    assertMutationFence({ kind: 'node-effect', args: request.args });
+    return run({ ...request, env: withTempEnv({ env: request.env ?? process.env }).env });
+}
+/** A partial compiler/test report cannot be interpreted or stored as a completed measurement. */
+export function completedNode(result, label) {
+    if (result.error !== undefined || result.signal !== null || result.status === null)
+        throw Object.assign(new Error(`${label} did not complete`), { code: 'HFS_NODE_INCOMPLETE' });
+    return result;
+}
 /** Runs `node <args>`; options (cwd, env, timeout, input, maxBuffer, stdio) pass through. */
 export const runNode = (args, options = {}) => nodeSpawn(args, options);

package/runtime/scripts/hfs/app-wiring.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun, type HeavyNodeResult } from '../api/node/run-node.mjs';
 export declare const BOOT_PROOF_CODE = "BE_APP_BOOT_PROOF_MISSING";
 export declare const BOOT_PROOF_TIMEOUT = "BOOT_PROOF_TIMEOUT";
 export declare const BOOT_PROOF_TIMEOUT_ENV = "STARCI_BOOT_PROOF_TIMEOUT_MS";
@@ -6,7 +7,7 @@ export declare const wiringFixturePath: (app: string) => string;
 export type WorkerResult = {
     status?: number | null;
     signal?: string | null;
-    error?: NodeJS.ErrnoException;
+    error?: HeavyNodeResult['error'];
     stdout?: string;
 } | null | undefined;
 /** The injectable spawn seam of the worker. */
@@ -62,7 +63,12 @@ export interface AppWiringInput {
     timeout?: number;
     run?: WorkerRun;
 }
-export declare function appWiring({ repoRoot, repo, files, fixtures, timeout, run }: AppWiringInput): WiringResult;
+/** The synchronous finder and its existing worker doubles drive the same proof program as app check. */
+export declare function appWiring(input: AppWiringInput): WiringResult;
+/** The cache's asynchronous execution seam admits each boot attempt, with the same validation, timeout retry and result judgement. */
+export declare function appWiringAsync(input: Omit<AppWiringInput, 'run'> & {
+    execute?: HeavyNodeRun | undefined;
+}): Promise<WiringResult>;
 /** Optional standalone entry; coordinator connects the same seam to app check --gate wiring. */
 export interface AppWiringMainIo {
     cwd?: string;

package/runtime/scripts/hfs/app-wiring.mjs

@@ -8,7 +8,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { createRequire } from 'node:module';
-import { runNode } from '../api/node/run-node.mjs';
+import { runNode, runHeavyNode } from '../api/node/run-node.mjs';
 import { fileURLToPath } from 'node:url';
 import { invocationDir } from '../lib/roots.mjs';
 import { isMain } from '../lib/is-main.mjs';
@@ -174,7 +174,7 @@ function wiringApps(repo, files, prefix) {
     });
     return [...new Set([...declared, ...observed])];
 }
-function appWiringFinding({ repoRoot, beRoot, prefix, app, files, fixtures, timeout, run }) {
+function* appWiringFinding({ repoRoot, beRoot, prefix, app, files, fixtures, timeout }) {
     const file = `${prefix}${modulePath(app)}`;
     if (!/^[a-z][a-z0-9-]*$/.test(app) || !fs.existsSync(path.join(repoRoot, file)) || (files && !files.includes(file))) {
         return refusal(file, 'app module is missing');
@@ -184,10 +184,9 @@ function appWiringFinding({ repoRoot, beRoot, prefix, app, files, fixtures, time
     const args = [WORKER, '--worker', JSON.stringify({ repoRoot: beRoot, app, fixture: fixtureExists ? fixture : null, timeout })];
     const budget = workerBudget(timeout);
     const options = { cwd: beRoot, encoding: 'utf8', env: {}, windowsHide: true, timeout: budget, maxBuffer: 1024 * 1024 };
-    const spawnWorker = () => (run ? run(process.execPath, args, options) : runNode(args, options));
-    let result = spawnWorker();
+    let result = yield { args, options };
     if (isTimeout(result))
-        result = spawnWorker();
+        result = yield { args, options };
     if (isTimeout(result))
         return timedOut(file, budget);
     let proof;
@@ -199,7 +198,7 @@ function appWiringFinding({ repoRoot, beRoot, prefix, app, files, fixtures, time
         return refusal(file, SAFE_REASONS.has(proof?.reason) ? proof?.reason : WORKER_FAILURE);
     return null;
 }
-export function appWiring({ repoRoot, repo = readJson(repoRoot, 'hfs.json'), files, fixtures = {}, timeout = DEFAULT_TIMEOUT, run }) {
+function* wiringProgram({ repoRoot, repo = readJson(repoRoot, 'hfs.json'), files, fixtures = {}, timeout = DEFAULT_TIMEOUT }) {
     if (repo?.edition !== 'lite' || repo?.profile === 'fe' || repo?.kind === 'fe')
         return { ok: true, status: 'skipped', findings: [], apps: [] };
     const appRoot = Boolean(repo.sides);
@@ -208,12 +207,33 @@ export function appWiring({ repoRoot, repo = readJson(repoRoot, 'hfs.json'), fil
     const apps = wiringApps(repo, files, prefix);
     const findings = [];
     for (const app of apps) {
-        const finding = appWiringFinding({ repoRoot, beRoot, prefix, app, files, fixtures, timeout, run });
+        const finding = yield* appWiringFinding({ repoRoot, beRoot, prefix, app, files, fixtures, timeout });
         if (finding)
             findings.push(finding);
     }
     return { ok: findings.length === 0, status: 'checked', apps, findings };
 }
+/** The synchronous finder and its existing worker doubles drive the same proof program as app check. */
+export function appWiring(input) {
+    const program = wiringProgram(input);
+    let step = program.next();
+    while (!step.done) {
+        const { args, options } = step.value;
+        step = program.next(input.run ? input.run(process.execPath, args, options) : runNode(args, options));
+    }
+    return step.value;
+}
+/** The cache's asynchronous execution seam admits each boot attempt, with the same validation, timeout retry and result judgement. */
+export async function appWiringAsync(input) {
+    const program = wiringProgram(input);
+    let step = program.next();
+    while (!step.done) {
+        const { args, options } = step.value;
+        const result = await runHeavyNode(input.execute, { kind: 'test', label: 'app check wiring boot proof', args, cwd: options.cwd, env: options.env, timeoutMs: options.timeout, maxBuffer: options.maxBuffer });
+        step = program.next(result);
+    }
+    return step.value;
+}
 export function appWiringMain(argv, { cwd = invocationDir(), stdout = (text) => process.stdout.write(text), stderr = (text) => process.stderr.write(text) } = {}) {
     let directory = cwd, json = false;
     for (let at = 0; at < argv.length; at += 1) {

package/runtime/scripts/hfs/architecture/canon-jsx-clones.d.mts

@@ -1,5 +1,7 @@
 /** Imported JSX components receive repeated data contracts; executable prop values remain compared. */
 import type { Node, SourceFile } from 'typescript';
 import type { TypeScriptApi } from './config.mjs';
+/** The one app status-owner binding of FE-ERROR-1, shared by clone and body-flow proofs. */
+export declare function canonicalStatusOwnerBinding(module: string | null, name: string | null): boolean;
 /** Canon data prop objects qualify through an imported component binding, never its chosen name or file path. */
 export declare function canonJsxCloneNodes(ts: TypeScriptApi, sourceFile: SourceFile): Set<Node>;

package/runtime/scripts/hfs/architecture/canon-jsx-clones.mjs

@@ -152,12 +152,16 @@ function nestedDataObjects(ts, expression, bindingOf, excluded) {
                 nestedDataObjects(ts, element, bindingOf, excluded);
     }
 }
+/** The one app status-owner binding of FE-ERROR-1, shared by clone and body-flow proofs. */
+export function canonicalStatusOwnerBinding(module, name) {
+    return name === 'SlotView' && module !== null && /(?:^|\/)components\/composites\/SlotView(?:\/index)?(?:\.[cm]?tsx?)?$/.test(module);
+}
 /** Resolve the canonical status owner through its import binding, including aliases and namespaces. */
 function statusOwner(ts, tag, bindingOf) {
     const binding = ts.isIdentifier(tag) ? bindingOf(tag) : ts.isPropertyAccessExpression(tag) && ts.isIdentifier(tag.expression) ? bindingOf(tag.expression) : null;
     const module = binding?.kind === 'component' || binding?.kind === 'namespace' ? binding.module : null;
     const name = binding?.kind === 'component' ? binding.name : ts.isPropertyAccessExpression(tag) ? tag.name.text : null;
-    return name === 'SlotView' && module !== null && /(?:^|\/)components\/composites\/SlotView(?:\/index)?(?:\.[cm]?tsx?)?$/.test(module);
+    return canonicalStatusOwnerBinding(module, name);
 }
 /** The mandated status wiring breaks clone windows; its render body remains ordinary compared code. */
 function statusRecipe(ts, opening, bindingOf, excluded) {

package/runtime/scripts/hfs/rules/contract.d.mts

@@ -15,12 +15,20 @@ export declare function contractFindings({ repoRoot, files, repo, resolver }: {
  * `openapi.json` and `status` one of `fresh`, `stale`, `not-committed`, `none` (nothing emitted, nothing committed; GraphQL only),
  * `left-behind` (committed, nothing emitted) or `emit-failed`.
  */
-export declare function contractEmitFindings({ repoRoot, files, repo, emit }: {
+interface ContractEmitInput {
     repoRoot: string;
     files: string[];
     repo: Repo;
     emit: Parsed;
-}): {
+}
+/** The synchronous source finder and asynchronous app cache share every emission comparison and failure rule. */
+export declare function contractEmitFindings(input: ContractEmitInput): {
     findings: Finding[];
-    apps: any[];
+    apps: Parsed[];
 };
+/** Awaits actual governed compiler children before the existing drift proof can be recorded. */
+export declare function contractEmitFindingsAsync(input: ContractEmitInput): Promise<{
+    findings: Finding[];
+    apps: Parsed[];
+}>;
+export {};

package/runtime/scripts/hfs/rules/contract.mjs

@@ -6,6 +6,7 @@
 // resolvers the app root composes, and the OpenAPI 3.1 document of the typed operation table `apps/<app>/src/operations.ts`.
 // That the committed snapshot equals what the app emits now is contractEmitFindings (full pass only, never --fast): it emits every
 // api app into a temp directory through the injected `emit` (packages/hfs/emit) and compares hashes; an emit that cannot run is a finding.
+import { isNodeExecutionRefusal } from '../../api/node/run-node.mjs';
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -145,16 +146,7 @@ function artifactFindings({ repoRoot, tracked, scratch, app, artifact, what, emi
         findings.push(found(CONTRACT_SNAPSHOT_DRIFT, snapshot, `${snapshot} (${committed.slice(0, 12)}) differs from what ${app.name} emits now (${String(fresh).slice(0, 12)}); run \`npm run contract:emit\` and commit the result`, { app: app.name, drift: 'stale' }));
     }
 }
-/**
- * R23, full pass: each committed `contracts/<app>/schema.graphql` and `contracts/<app>/openapi.json` equals what `emit` writes for
- * the app now. `emit({ repoRoot, declaration, outDir })` is `emitContracts` of packages/hfs/emit and answers `{ written, skipped }`;
- * it is injected because the runtime scripts do not import the hfs package. Every api app is emitted on its own into a temp
- * directory, so one app that cannot emit does not hide the others; an uncommitted emitted snapshot is a finding here too. Answers
- * `{ findings, apps }`, `apps` being what was judged: `[{ app, artifact, status }]`, `artifact` being `schema.graphql` or
- * `openapi.json` and `status` one of `fresh`, `stale`, `not-committed`, `none` (nothing emitted, nothing committed; GraphQL only),
- * `left-behind` (committed, nothing emitted) or `emit-failed`.
- */
-export function contractEmitFindings({ repoRoot, files, repo, emit }) {
+function* contractProgram({ repoRoot, files, repo }) {
     const findings = [];
     const apps = [];
     if (repo.profile !== 'be')
@@ -166,9 +158,14 @@ export function contractEmitFindings({ repoRoot, files, repo, emit }) {
             const artifacts = [{ artifact: SNAPSHOT_OF.graphql, what: 'serves no GraphQL any more' }, { artifact: SNAPSHOT_OF.json, what: 'declares no operations any more' }];
             let emitted;
             try {
-                emitted = emit({ repoRoot, declaration: { apps: [app] }, outDir: scratch });
+                const response = yield { repoRoot, declaration: { apps: [app] }, outDir: scratch };
+                if ('error' in response)
+                    throw response.error;
+                emitted = response.value;
             }
             catch (error) {
+                if (isNodeExecutionRefusal(error))
+                    throw error;
                 emitFailure(app, artifacts, error, apps, findings);
                 continue;
             }
@@ -183,3 +180,45 @@ export function contractEmitFindings({ repoRoot, files, repo, emit }) {
     }
     return { findings, apps };
 }
+/** The synchronous source finder and asynchronous app cache share every emission comparison and failure rule. */
+export function contractEmitFindings(input) {
+    const program = contractProgram(input);
+    let step = program.next();
+    try {
+        while (!step.done) {
+            let response;
+            try {
+                response = { value: input.emit(step.value) };
+            }
+            catch (error) {
+                response = { error };
+            }
+            step = program.next(response);
+        }
+        return step.value;
+    }
+    finally {
+        program.return({ findings: [], apps: [] });
+    }
+}
+/** Awaits actual governed compiler children before the existing drift proof can be recorded. */
+export async function contractEmitFindingsAsync(input) {
+    const program = contractProgram(input);
+    let step = program.next();
+    try {
+        while (!step.done) {
+            let response;
+            try {
+                response = { value: await input.emit(step.value) };
+            }
+            catch (error) {
+                response = { error };
+            }
+            step = program.next(response);
+        }
+        return step.value;
+    }
+    finally {
+        program.return({ findings: [], apps: [] });
+    }
+}

package/src/main.d.mts

@@ -1,3 +1,4 @@
+import { type HeavyNodeRun } from '../runtime/scripts/api/node/run-node.mjs';
 import { type LockResult } from '../scaffold/app.mjs';
 import type { GhSpawn } from '../ci/github.mjs';
 import type { Prompt } from '../runtime/scripts/hfs/secret-prompt.mjs';
@@ -39,6 +40,7 @@ interface AppIo {
     stackIo?: Record<string, unknown> | undefined;
     runLinter?: LinterRunner | undefined;
     checkApp?: ((args: Dynamic) => Dynamic) | undefined;
+    runHeavyNode?: HeavyNodeRun | undefined;
     /** --quiet: no progress on stderr (the diagnosis stays). */
     quiet?: boolean | undefined;
     stderrIsTty?: boolean | undefined;
@@ -57,5 +59,5 @@ export declare function appRootAbove(dir: string): string;
  * the HFS check and `stackIo` Swarm tools; production defaults execute every check. `hostIdentity` ({ label, read }) is the
  * harness CLI's own secret.env SOPS_AGE_KEY, which every verb that opens a sealed member (secret, stack, release, db) reads last for the age identity (decryptionIdentity); `prompt` replaces its masked prompt.
  */
-export declare function main(argv: string[], { cwd: baseCwd, harness, stdout, stderr, presets, prettier, lock, run, stackMain, env, stdin, prompt, hostIdentity, sops, tools, platform, stackIo, runLinter, checkApp, stderrIsTty, }?: MainOptions): Promise<number>;
+export declare function main(argv: string[], { cwd: baseCwd, harness, stdout, stderr, presets, prettier, lock, run, stackMain, env, stdin, prompt, hostIdentity, sops, tools, platform, stackIo, runLinter, runHeavyNode, checkApp, stderrIsTty, }?: MainOptions): Promise<number>;
 export {};

package/src/main.mjs

@@ -83,6 +83,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 // Every finding names a why code and carries its Vietnamese text. check, lint and slot read the app, never write to it. Exit codes:
 // 0 clean, 1 error findings, 2 a refusal or bad usage.
 import fs from 'node:fs';
+import { isHostHeld } from '../runtime/scripts/api/node/run-node.mjs';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -99,13 +100,13 @@ import { HFS_DECLARATION_FILE, HfsSlotsError, loadSlotManifest, readRepoDeclarat
 import { main as syncMain } from '../sync/cli.mjs';
 import { runWorkHygiene } from '../sync/hygiene.mjs';
 import { SyncError, bundledPresets } from '../sync/index.mjs';
-import { emitContracts } from '../emit/contracts.mjs';
+import { emitContractsAsync } from '../emit/contracts.mjs';
 import { ScaffoldError, newService, newSpec } from '../scaffold/service.mjs';
 import { EditionRefusal } from '../scaffold/edition-gate.mjs';
 import { addKind } from '../scaffold/add.mjs';
 import { scaffoldApp } from '../scaffold/app.mjs';
 import { newImages } from '../scaffold/image.mjs';
-import { cachedLinters, eslintRepository, lintRepository, parseLintArgs, printLintText } from '../lint/run.mjs';
+import { cachedLinters, eslintRepository, lintRepository, parseLintArgs, printLintText, runLinter as nativeLinter } from '../lint/run.mjs';
 import { runSonarForApp, runTestForApp, runTestShard, runTypesForApp } from '../cache/app-families.mjs';
 import { CACHE_ENV, createDiskSession } from '../cache/session.mjs';
 import { DEFAULT_FAMILIES, runAppFamilies } from '../cache/run.mjs';
@@ -359,7 +360,7 @@ function openSession({ repoRoot, tracked, io, full, use, planned }) {
 async function appPass({ repoRoot, harness, only, presets, prettier, io, selected, full, use = 'normal', session: given }) {
     const tracked = trackedFiles(repoRoot);
     const session = given ?? openSession({ repoRoot, tracked, io, full, use: only === undefined ? use : 'bypass', planned: tracked.length * Math.max(1, selected.size) });
-    const result = await runAppFamilies({ repoRoot, tracked, session, selected, harness, presets, prettier, only, edition: undefined });
+    const result = await runAppFamilies({ repoRoot, tracked, session, selected, harness, presets, prettier, only, edition: undefined, execute: io.runHeavyNode });
     if (given !== undefined)
         return result;
     const flushed = session.flush();
@@ -529,9 +530,9 @@ async function checkRun({ io, selected, full, use, coverageFrom }) {
             eslint = await eslintRepository({ repoRoot, changed: null, existing: [], run: runLinter });
     }
     if (session !== undefined && selected.has('types'))
-        extra.push(...runTypesForApp(session, { repoRoot, tracked, env: io.env }).findings);
+        extra.push(...(await runTypesForApp(session, { repoRoot, tracked, env: io.env, execute: io.runHeavyNode })).findings);
     if (session !== undefined && selected.has('test')) {
-        const tests = await runTestForApp(session, { repoRoot, tracked });
+        const tests = await runTestForApp(session, { repoRoot, tracked, execute: io.runHeavyNode });
         extra.push(...tests.findings);
     }
     if (session !== undefined && selected.has('sonar'))
@@ -589,7 +590,7 @@ async function checkMain(opts, io) {
         const total = Number(match?.[2]);
         if (match === null || !Number.isSafeInteger(index) || !Number.isSafeInteger(total) || index < 1 || total < index)
             throw new Error('--shard needs <i>/<n> with 1 <= i <= n');
-        return runTestShard(repoRoot, index, total);
+        return runTestShard(repoRoot, index, total, io.runHeavyNode);
     }
     // A coverage report judged on its own (the merge job of a sharded run) runs no family; with selectors it comes on top of them.
     const selected = explicit.size > 0 ? explicit : coverageFrom === undefined ? new Set(DEFAULT_FAMILIES) : new Set();
@@ -609,13 +610,13 @@ async function checkMain(opts, io) {
     writeRunLog(repoRoot, { command: `check${[...new Set(listFlag(opts, 'gate') ?? [])].map((gate) => ` --gate ${gate}`).join('')}${opts['no-cache'] === true ? ' --no-cache' : ''}${coverageFrom === undefined ? '' : ` --coverage-from ${JSON.stringify(coverageFrom)}`}`, seconds, exit, families: result.families.map((report) => ({ ...report, seconds: 0 })) }, io.env);
     return exit;
 }
-function emitMain(opts, { cwd: repoRoot, stdout: out }) {
+async function emitMain(opts, { cwd: repoRoot, stdout: out, runHeavyNode }) {
     if (opts.positional.length)
         throw new Error('starci app emit takes no path');
     const be = readRepoDeclaration(loadSlotManifest(), repoRoot).sides?.be;
     if (!be)
         throw new Error('starci app emit runs at the app root (the folder of hfs.json)');
-    const { written, skipped, standIns } = emitContracts({ repoRoot: path.join(repoRoot, 'be'), declaration: be });
+    const { written, skipped, standIns } = await emitContractsAsync({ repoRoot: path.join(repoRoot, 'be'), declaration: be, execute: runHeavyNode });
     for (const file of written)
         out(`wrote be/${file}\n`);
     const skipSummary = skipped.length ? `, ${skipped.join(', ')} serve no GraphQL` : '';
@@ -737,7 +738,7 @@ function errorMessage(error) {
  * the HFS check and `stackIo` Swarm tools; production defaults execute every check. `hostIdentity` ({ label, read }) is the
  * harness CLI's own secret.env SOPS_AGE_KEY, which every verb that opens a sealed member (secret, stack, release, db) reads last for the age identity (decryptionIdentity); `prompt` replaces its masked prompt.
  */
-export async function main(argv, { cwd: baseCwd = process.cwd(), harness, stdout = (s) => process.stdout.write(s), stderr = (s) => process.stderr.write(s), presets, prettier, lock, run, stackMain, env = process.env, stdin, prompt, hostIdentity, sops, tools, platform, stackIo, runLinter, checkApp, stderrIsTty = process.stderr.isTTY === true, } = {}) {
+export async function main(argv, { cwd: baseCwd = process.cwd(), harness, stdout = (s) => process.stdout.write(s), stderr = (s) => process.stderr.write(s), presets, prettier, lock, run, stackMain, env = process.env, stdin, prompt, hostIdentity, sops, tools, platform, stackIo, runLinter, runHeavyNode, checkApp, stderrIsTty = process.stderr.isTTY === true, } = {}) {
     try {
         const global = globalOptions(argv, path.resolve(baseCwd));
         const [verb, ...given] = global.argv;
@@ -752,10 +753,12 @@ export async function main(argv, { cwd: baseCwd = process.cwd(), harness, stdout
             return 2;
         }
         const { edition, argv: rest } = editionOption(verb, given);
-        return await dispatchMain(verb, rest, { cwd: global.cwd, harness, edition, quiet: global.quiet, stderrIsTty, stdout: out, stderr, presets, prettier, lock, run, stackMain, env, stdin, prompt, hostIdentity, sops, tools, platform, stackIo, runLinter, checkApp });
+        return await dispatchMain(verb, rest, { cwd: global.cwd, harness, edition, quiet: global.quiet, stderrIsTty, stdout: out, stderr, presets, prettier, lock, run, stackMain, env, stdin, prompt, hostIdentity, sops, tools, platform, stackIo, runHeavyNode, runLinter: runLinter ?? ((spec) => nativeLinter(spec, runHeavyNode)), checkApp });
     }
     catch (error) {
         stderr(errorMessage(error));
+        if (isHostHeld(error))
+            return 75;
         return 2;
     }
 }