basalt-ui 1.26.0 → 1.28.0

package/configs/oxlint-plugin.js

@@ -104,11 +104,18 @@ export const KNOWN_RULE_IDS = new Set([
   'raw-scroll-container',
   'hand-rolled-filter',
   'control-outside-home',
+  'bound-control-outside-home',
   'control-size-literal',
   'page-bar-budget',
   'responsive-twin',
   'search-literal-link',
   'use-search-from-literal',
+  'provider-above-router',
+  'duplicate-notifications-mount',
+  'query-dual-import',
+  'query-fn-unwrap',
+  'deprecated-export',
+  'forms-field-key',
   // `in-body-page-title` is BOTH a plugin rule and a guard kind — one id, two lanes, so one
   // annotation waives both. It is listed once, below, with the guard kinds.
   'visx-boundary',
@@ -443,6 +450,16 @@ function isInStyleContext(context, node) {
   return false
 }
 
+/**
+ * No `/src/tokens/` exemption, and none is needed: both rules below only ever visit `JSXAttribute`/
+ * `Property` nodes, and `src/tokens/**` is pure data — `.ts`, never `.tsx`, zero React — so the
+ * visitor structurally cannot fire there. A path-based exemption used to sit here gated on
+ * `isBasaltScopedFile`, which tests "does the nearest package.json depend on basalt-ui", not
+ * "is this file basalt's own" — a consumer package that merely depends on basalt-ui could put raw
+ * literals under its own `src/tokens/` and silence both rules. Deleting the exemption is simpler
+ * than re-gating it on package identity: the simplest gate is no gate.
+ */
+// Ships: error
 const noRawFontSize = {
   meta: {
     type: 'suggestion',
@@ -452,7 +469,7 @@ const noRawFontSize = {
     schema: [],
   },
   create(context) {
-    if (getFilename(context).includes('/src/tokens/') || isTestFile(context)) return {}
+    if (isTestFile(context)) return {}
 
     return {
       JSXAttribute(node) {
@@ -496,16 +513,19 @@ const SIZE_ATTRS = new Set(['size', 'fz', 'fontSize'])
  * which is not always a font size — on `Text` it is, on `ThemeIcon`/`ActionIcon` it is a box
  * dimension — so one shared id would mean a consumer silencing the icon case also silences every
  * off-scale font size, the bundled-rule mistake the three boundary rules were split apart to avoid.
- * And a separate id can carry its own severity: this rule ships `warn` in the consumer preset for
- * one minor (the grace-minor doctrine in the package CLAUDE.md — it rejects code that previously
- * passed, and majors are banned here, so a consumer has no semver channel warning them). Widening
- * `no-raw-font-size` in place would have promoted it to `error` on upgrade with no such runway.
+ * And a separate id can carry its own severity: this rule ships `error` in the consumer preset —
+ * it is a NEW form the sibling rule never caught (a numeric-only check let every string form walk
+ * straight past it), not a narrowing of code that previously passed, so the grace-minor doctrine in
+ * the package CLAUDE.md does not apply to it. Widening `no-raw-font-size` in place would have meant
+ * the widened check inherited whatever level the sibling id already carried, with no way to give
+ * this specific form its own severity.
  *
  * Numeric `size={32}` is deliberately NOT flagged. It is the documented Mantine idiom for icon
  * dimensions and flagging it would fire on nearly every icon in an app for no design-system gain —
  * the token system has an opinion about type scale and spacing, not about how many pixels wide one
  * glyph box is.
  */
+// Ships: error
 const rawSizeLiteral = {
   meta: {
     type: 'suggestion',
@@ -515,7 +535,7 @@ const rawSizeLiteral = {
     schema: [],
   },
   create(context) {
-    if (getFilename(context).includes('/src/tokens/')) return {}
+    if (isTestFile(context)) return {}
 
     return {
       JSXAttribute(node) {
@@ -546,6 +566,7 @@ function attrValue(attr) {
   return unwrapExpressionContainer(attr.value)
 }
 
+// Ships: error
 const cardInset = {
   meta: {
     type: 'suggestion',
@@ -635,6 +656,7 @@ function subtreeHasChart(node) {
   return false
 }
 
+// Ships: error
 const chartInRawSurface = {
   meta: {
     type: 'suggestion',
@@ -720,6 +742,7 @@ function enclosingHomeOwner(node) {
  * code is small enough to fix rather than schedule. A consumer who disagrees turns the whole rule
  * down in their own config.
  */
+// Ships: error
 const rawScrollContainer = {
   meta: {
     type: 'suggestion',
@@ -854,6 +877,7 @@ function boundaryVisitor(reportFor) {
 // segment named `charts` is deliberately permissive, not restrictive — it only ever widens where
 // visx is allowed, never narrows where it's flagged elsewhere. "Your visx lives in a charts/ dir"
 // is the intended convention.
+// Ships: error
 const visxBoundary = {
   meta: {
     type: 'suggestion',
@@ -885,6 +909,7 @@ const visxBoundary = {
 // Rule 6 — visx-tooltip: @visx/tooltip banned everywhere, including inside charts. Fires ahead of
 // (and instead of) basalt/visx-boundary for that one specifier — basalt's own src/ never imports
 // @visx/tooltip, so no theme-allow-style exemption is needed here either.
+// Ships: error
 const visxTooltip = {
   meta: {
     type: 'suggestion',
@@ -908,6 +933,7 @@ const visxTooltip = {
 // @mantine/* installed (see the file-header comment for the cycle/fork + packaging rationale).
 // Repo-local only — never registered in the shipped consumer preset, since this governs basalt's
 // own internal layering/packaging, not a consumer contract.
+// Ships: repo-local only
 const tokenLayerBoundary = {
   meta: {
     type: 'suggestion',
@@ -969,6 +995,7 @@ function propertyKeyName(node) {
 
 // Deliberately NO `hasThemeAllow` escape — see basalt/visx-boundary's comment for why these
 // guards use their own token (`basalt-agent-allow`, see the file-header comment) instead.
+// Ships: error
 const agentResumeGuard = {
   meta: {
     type: 'problem',
@@ -1015,6 +1042,7 @@ const RAW_USE_CHAT_SOURCES = new Set(['@ai-sdk/react', 'ai/react'])
 const RAW_USE_CHAT_NAMES = new Set(['useChat', 'useCompletion'])
 
 // Deliberately NO `hasThemeAllow` escape — see the file-header comment.
+// Ships: error
 const agentNoRawUseChat = {
   meta: {
     type: 'problem',
@@ -1210,6 +1238,7 @@ function aiSdkMajorMessage(consumerMajor) {
 // version skew is still a fact about two package.json files, but a written, intentional
 // producer/consumer pair (see `doctor`'s `aiMajorSkewReason`) needs a way to say so at the import
 // site too, not just be permanently blocked.
+// Ships: error
 const aiSdkMajor = {
   meta: {
     type: 'problem',
@@ -1302,6 +1331,7 @@ const HAND_ROLLED_PLOT_MESSAGE =
   'the file. To waive just THIS node and stay policed on the rest, write `theme-allow ' +
   'hand-rolled-plot — <why>` on its own line above it. (basalt/hand-rolled-plot)'
 
+// Ships: error
 const handRolledPlot = {
   meta: {
     type: 'suggestion',
@@ -1412,6 +1442,7 @@ function isMapCall(node) {
   )
 }
 
+// Ships: error
 const chartLegendLiteral = {
   meta: {
     type: 'suggestion',
@@ -1588,6 +1619,65 @@ const SHADOW_ALIASES = {
   JoinedButtons: 'ControlGroup',
 }
 
+/**
+ * The basalt export NAMES a file imports, each mapped to the LOCAL bindings it arrived under —
+ * `StatCard → {StatCard}` for `import { StatCard }`, `StatCard → {BaseStatCard}` for
+ * `import { StatCard as BaseStatCard }`.
+ *
+ * The counterpart of {@link collectBasaltImports}, keyed the other way round: that one collects
+ * LOCAL names (is this `<Section>` basalt's?), this one is keyed by the CANONICAL export (does this
+ * file compose basalt's `StatCard` at all?). An alias is precisely the case that separates them —
+ * a wrapper importing `StatCard as BaseStatCard` composes `StatCard`, and a set of local names
+ * would answer `BaseStatCard`. The local half is carried alongside because an import alone is not
+ * composition: the caller has to check the binding is REFERENCED (see
+ * {@link isValueReferencePosition}).
+ *
+ * TYPE-ONLY specifiers are skipped, declaration-level and per-specifier, exactly as
+ * `agent-no-raw-usechat` skips them: `import type { StatCard }` is erased at compile time, so a fork
+ * copying the original's props through `ComponentProps<typeof StatCard>` composes nothing at all.
+ *
+ * Only the package name and its subpaths; no relative half, because `shadow-basalt-export` already
+ * returns early inside basalt's own source, where a relative import would be the dogfood lane.
+ */
+function collectBasaltImportedNames(node, into) {
+  const source = node.source?.value
+  if (typeof source !== 'string' || !BASALT_IMPORT_SOURCE.test(source)) return
+  if (node.importKind === 'type') return
+  for (const spec of node.specifiers ?? []) {
+    if (spec.importKind === 'type') continue
+    const imported = spec.imported?.name ?? spec.imported?.value
+    const local = spec.local?.name
+    if (typeof imported !== 'string' || typeof local !== 'string') continue
+    const locals = into.get(imported)
+    if (locals === undefined) into.set(imported, new Set([local]))
+    else locals.add(local)
+  }
+}
+
+/** The positions an `Identifier`/`JSXIdentifier` occupies WITHOUT referencing a value. */
+const NON_VALUE_IDENTIFIER_PARENTS = new Set([
+  // The binding's own declaration, not a use of it.
+  'ImportSpecifier',
+  'ImportDefaultSpecifier',
+  'ImportNamespaceSpecifier',
+  // A JSX attribute's NAME (`value={…}`), not its value.
+  'JSXAttribute',
+])
+
+/**
+ * Does this identifier REFERENCE a value, rather than declare or type-position it?
+ *
+ * The type half matters as much as the import half: `typeof StatCard` parses as a `TSTypeQuery`
+ * around a plain `Identifier`, so a value import used only in a type is indistinguishable from a
+ * rendered one without this test — and that shape (a fork copying the original's props) is the
+ * whole reason the composition check exists.
+ */
+function isValueReferencePosition(node) {
+  const parentType = node.parent?.type
+  if (typeof parentType !== 'string') return false
+  return !parentType.startsWith('TS') && !NON_VALUE_IDENTIFIER_PARENTS.has(parentType)
+}
+
 function shadowAliasMessage(name, canonical) {
   return (
     `Local component '${name}' is a renamed '${canonical}' — basalt ships that composite, and a ` +
@@ -1619,6 +1709,7 @@ function shadowBasaltExportMessage(name) {
  * tokens does not. `warn`, not `error`: a name collision is evidence, not proof, and a consumer
  * with a genuinely different `Composer` should be told once, not blocked.
  */
+// Ships: warn (advisory)
 const shadowBasaltExport = {
   meta: {
     type: 'suggestion',
@@ -1636,30 +1727,86 @@ const shadowBasaltExport = {
     // obsidian's React-free `obsidian-vault-core` took the report and had to waive it.
     if (filename.length === 0 || !isBasaltScopedFile(filename)) return {}
 
-    const report = (node, name) => {
+    // Candidates are BUFFERED and judged at `Program:exit`, the same shape the chart and control
+    // rules use: the alias exemption below needs the file's whole import list AND every reference in
+    // the file, and a declaration hoisted above its imports would otherwise be judged against an
+    // empty one.
+    /** Canonical basalt export → the local bindings it was imported under (value imports only). */
+    const basaltImportedNames = new Map()
+    /** Every local name the file REFERENCES as a value — the composition half of the exemption. */
+    const referencedLocals = new Set()
+    const candidates = []
+
+    /** Does the file compose basalt's `canonical` — imported as a value AND referenced? */
+    const composes = (canonical) => {
+      const locals = basaltImportedNames.get(canonical)
+      if (locals === undefined) return false
+      for (const local of locals) {
+        if (referencedLocals.has(local)) return true
+      }
+      return false
+    }
+
+    const noteReference = (node) => {
+      if (typeof node.name !== 'string' || !isValueReferencePosition(node)) return
+      referencedLocals.add(node.name)
+    }
+
+    const note = (node, name) => {
       if (typeof name !== 'string') return
       const alias = Object.hasOwn(SHADOW_ALIASES, name) ? SHADOW_ALIASES[name] : undefined
       if (!BASALT_EXPORTS.has(name) && alias === undefined) return
-      if (hasThemeAllow(context, node, 'shadow-basalt-export')) return
-      const message =
-        alias === undefined ? shadowBasaltExportMessage(name) : shadowAliasMessage(name, alias)
-      context.report({ node, message })
+      candidates.push({ node, name, alias })
     }
 
     return {
+      ImportDeclaration(node) {
+        collectBasaltImportedNames(node, basaltImportedNames)
+      },
+      // Both halves are needed and neither subsumes the other: a JSX tag is a `JSXIdentifier`
+      // (`<Base/>`), while every other use of the same binding is an `Identifier`
+      // (`component={Base}`, `createElement(Base)`, `memo(Base)`).
+      Identifier(node) {
+        noteReference(node)
+      },
+      JSXIdentifier(node) {
+        noteReference(node)
+      },
       FunctionDeclaration(node) {
-        report(node, node.id?.name)
+        note(node, node.id?.name)
       },
       VariableDeclarator(node) {
         if (!isComponentInit(node.init)) return
-        report(node, node.id?.name)
+        note(node, node.id?.name)
       },
       // A class only counts when it EXTENDS something — a legacy class component. basalt ships no
       // class components, so a standalone `class X {}` sharing a name with one of its exports is a
       // collision between two unrelated things, not a fork.
       ClassDeclaration(node) {
         if (node.superClass === null || node.superClass === undefined) return
-        report(node, node.id?.name)
+        note(node, node.id?.name)
+      },
+      'Program:exit'() {
+        for (const { node, name, alias } of candidates) {
+          // A file that COMPOSES the export it renames is a wrapper, not a fork, and the advice
+          // ("import StatCard instead of re-rolling it") is already followed — argo's three hero
+          // cards each imported `StatCard` and wrapped it, and each took a warn for it.
+          //
+          // COMPOSES, not "imports": an import the file never references is not composition, and the
+          // two shapes that reach here silently are the ones a fork actually writes — a type-only
+          // `import type { StatCard }` feeding `ComponentProps<typeof StatCard>` (props copied,
+          // nothing rendered) and a dead import left behind after the body was re-rolled. Both used
+          // to exempt the whole file.
+          //
+          // The collision half is deliberately NOT exempted either way: a local `StatCard` beside an
+          // `import { StatCard as Base }` is a fork that kept the name AND kept a piece of the
+          // original, which is the shape this rule most wants to see.
+          if (alias !== undefined && composes(alias)) continue
+          if (hasThemeAllow(context, node, 'shadow-basalt-export')) continue
+          const message =
+            alias === undefined ? shadowBasaltExportMessage(name) : shadowAliasMessage(name, alias)
+          context.report({ node, message })
+        }
       },
     }
   },
@@ -1691,6 +1838,7 @@ const HAND_ROLLED_SHELL_MESSAGE =
  * it. The module that DEFINES `BasaltShell` is exempt by declaration, not by path — a rule saying
  * "compose X" cannot fire inside X.
  */
+// Ships: error
 const handRolledShell = {
   meta: {
     type: 'suggestion',
@@ -1803,6 +1951,7 @@ const BOUND_TAGS = new Set([
   'CompareFilter',
   'SelectFilter',
   'MultiSelectFilter',
+  'NumberFilter',
   'SearchFilter',
   'ToggleFilter',
   'ViewTabs',
@@ -1812,11 +1961,26 @@ const BOUND_TAGS = new Set([
  * The names whose DECLARATION means this file defines a basalt control rather than consuming one —
  * the owner exemption, the same shape as `hand-rolled-plot`'s `notesOwnerDefinition`: a rule that
  * says "use a bound control" cannot fire inside the module that IS the bound control.
+ *
+ * **The declaration alone is not enough, and the second half is what makes the set safe to widen.**
+ * `PanelRow`, `EnumFilter` and `SliderControl` are ordinary names a consumer writes for their own
+ * helpers, and a bare-name match let one local `function PanelRow(…)` switch `control-outside-home`,
+ * `bound-control-outside-home` and `responsive-twin` off for that WHOLE file. So the exemption also
+ * requires the file to import NOTHING from `basalt-ui*`: basalt's own control sources import each
+ * other RELATIVELY, while a consumer of basalt always names the package. A file that consumes
+ * basalt is not the module that defines its controls, whatever it calls its helpers.
  */
 const CONTROL_OWNER_NAMES = new Set([
   ...BOUND_TAGS,
   'FilterSet',
   'FilterPill',
+  // The INTERNAL control modules, listed for the same reason the public names are: `EnumFilter` is
+  // the shared body behind SelectFilter/CompareFilter/NumberFilter, and `PanelRow`/`SliderControl`
+  // are the aside's row primitives (`docs/ASIDE-SPEC.md` §3). A module that IS a bound control
+  // cannot be told to use one. This is a RELAXATION, so it needs no grace entry (C16).
+  'EnumFilter',
+  'PanelRow',
+  'SliderControl',
   'SyncButton',
   'ActionGroup',
   'OverflowMenu',
@@ -1824,19 +1988,25 @@ const CONTROL_OWNER_NAMES = new Set([
 ])
 
 /**
- * Where a raw selection control legitimately lives outside a TIERED home: a settings row, an
- * overlay, a composer. Every one of these is a place the tier does not apply, so the advice ("move
- * it into a home slot") would be wrong rather than merely unwelcome.
+ * Where a raw selection control legitimately lives outside a TIERED home: a settings row, a form
+ * row, an overlay, a composer. Every one of these is a place the tier does not apply, so the advice
+ * ("move it into a home slot") would be wrong rather than merely unwelcome.
  *
  * `SettingsRow` is the form row — law C1's third home, not an exception to C1 — so
  * `control-outside-home` treating it as a home is the whole of the enforcement a settings page
  * gets, and the two tier rules deliberately do not reach inside it (see {@link SLOT_ATTRS}).
+ * `FormRow`/`FormGroup` (`basalt-ui/forms`, `src/forms/form-layout.tsx`) are the SAME home written
+ * for a `<form>` rather than a settings page — a `TextInput` bound to a field is read and typed
+ * into at Mantine's own tier, not a 30px chrome affordance — so they are added here rather than
+ * given a second walk.
  *
  * Declared with the shared slot walk rather than beside `control-outside-home` because three rules
  * read it: that rule's ancestry exemption, and {@link hostedInsideSlot} for the two tier rules.
  */
 const CONTROL_HOST_TAGS = new Set([
   'SettingsRow',
+  'FormRow',
+  'FormGroup',
   'Modal',
   'Drawer',
   'Popover.Dropdown',
@@ -1844,6 +2014,69 @@ const CONTROL_HOST_TAGS = new Set([
   'Composer',
 ])
 
+/**
+ * The basalt elements whose CHILDREN are a home — the SUBTREE homes, where the body IS the surface
+ * (`docs/ASIDE-SPEC.md` §3). `FilterSet` mounts the pill surface, `PageAside` the panel surface,
+ * `PanelRow` the row itself (its `end` prop resolves here too: the attribute hangs off `PanelRow`'s
+ * own opening element, so the ancestry walk reaches the element).
+ *
+ * Read by BOTH C1 rules, because the two must not disagree about what a home IS — before this set
+ * existed `bound-control-outside-home` treated all three as homes and `control-outside-home` knew
+ * none of them, so a raw `<Select>` inside a `<PageAside><PanelRow>` reported while the bound
+ * control beside it did not.
+ *
+ * Unlike {@link CONTROL_HOST_TAGS} these are PROVENANCE-gated, the same test
+ * {@link SLOT_OWNER_TAGS} applies and for the same reason: `PanelRow` is an ordinary name for a
+ * consumer's own layout helper, and reading one as a basalt home would exempt a genuinely homeless
+ * control. The overlay hosts stay name-matched because `Modal`/`Drawer` are Mantine's, not basalt's.
+ */
+const BASALT_HOST_TAGS = new Set(['FilterSet', 'PageAside', 'PanelRow'])
+
+/**
+ * A file whose NAME declares it is an overlay's or a form's own body — the cross-file half of
+ * {@link CONTROL_HOST_TAGS}, and the one exemption here that is a CONVENTION rather than a fact
+ * about the AST.
+ *
+ * It exists because law C1's cross-file case is explicitly advisory (`docs/CONTROLS-SPEC.md` §6,
+ * "Honest coverage") and `control-outside-home` was paying for it in false positives: argo's
+ * wave-7 run left 9 warns, all of them a `Select`/`SegmentedControl` inside a `*-modal.tsx` or
+ * `*-form.tsx` whose `<Modal>` is rendered by the PARENT route. Nothing in the flagged file can see
+ * the overlay, so no ancestry walk — however deep — will ever reach it, and the alternative is 9
+ * `theme-allow-file` comments that say what the filename already says.
+ *
+ * The trade is stated plainly: this exempts a whole file on a naming convention, so a `Select` that
+ * genuinely belongs in a page bar goes unreported if it is written in `filters-panel.tsx`. That is
+ * the same bargain `@mantine/form` already buys and a strictly smaller one than promoting the rule
+ * with 9 known false positives. `-panel.tsx` is the loosest member and the one to reconsider first
+ * if the set ever needs narrowing.
+ *
+ * TWO dialects, because a repo picks one file-naming law and the convention has to survive either:
+ * `edit-session-modal.tsx` (kebab) and `CbbiPanel.tsx` (PascalCase — what a repo mandating
+ * `PascalCase.tsx` for component files writes, basalt's own root `CLAUDE.md` included). The kebab
+ * form alone could never match a component file in such a repo, which is exactly how the CBBI panel
+ * — a `PageAside` child whose `<PageAside>` is in the PARENT page — collected four warns that no
+ * ancestry walk in that file could ever have avoided.
+ *
+ * Both dialects require the leading SUBJECT: `Panel.tsx` and `modal.tsx` are page modules in every
+ * consumer that has one, and a bare-noun exemption would switch the rules off wholesale.
+ *
+ * Basename only — a `modal/` DIRECTORY is not the convention, because a directory of modals holds
+ * the page pieces around them too.
+ */
+const OVERLAY_CONVENTION_KEBAB = /^[^/]*-(?:modal|drawer|popover|panel|form)\.[jt]sx$/
+const OVERLAY_CONVENTION_PASCAL = /^[A-Z]\w*(?:Modal|Drawer|Popover|Panel|Form)\.[jt]sx$/
+
+/**
+ * The single predicate both `control-outside-home` and `bound-control-outside-home` ask — see
+ * {@link OVERLAY_CONVENTION_KEBAB} for the whole trade. One function, so the two rules can never
+ * disagree about what the convention IS; `src/guard/index.ts` carries the text-lane copy of the
+ * same two dialects (`raw-selection-control`), pinned by both test files.
+ */
+function isOverlayConventionFile(filename) {
+  const basename = filename.slice(filename.lastIndexOf('/') + 1)
+  return OVERLAY_CONVENTION_KEBAB.test(basename) || OVERLAY_CONVENTION_PASCAL.test(basename)
+}
+
 /** How far an ancestry walk climbs before giving up — a JSX tree this deep is not a slot value. */
 const ANCESTRY_MAX_DEPTH = 60
 
@@ -1945,6 +2178,27 @@ function collectBasaltImports(node, into, ownTree) {
   }
 }
 
+/**
+ * {@link collectBasaltImports} as a local→EXPORTED map — the same provenance test, keyed so a caller
+ * can ask WHICH home it found rather than only whether it found one.
+ *
+ * `control-size-literal` needs the distinction: `ChartCard` is the one slot owner whose slot cannot
+ * mount the tier theme, and `import { ChartCard as Card }` is a normal thing to write, so a
+ * membership Set (which answers `Card`) could not express the exemption at all.
+ */
+function collectBasaltImportMap(node, into, ownTree) {
+  const source = node.source?.value
+  if (typeof source !== 'string') return
+  if (!BASALT_IMPORT_SOURCE.test(source) && !(ownTree && RELATIVE_IMPORT_SOURCE.test(source))) {
+    return
+  }
+  for (const spec of node.specifiers ?? []) {
+    const local = spec.local?.name
+    if (typeof local !== 'string') continue
+    into.set(local, spec.imported?.name ?? spec.imported?.value ?? local)
+  }
+}
+
 /**
  * The BINDING a home's slot prop hangs off — `PageBar` for `<PageBar filters={…}>` — or undefined
  * when `attr` is not a slot-shaped prop on a home-shaped tag.
@@ -2030,6 +2284,34 @@ function hasAncestorTag(node, tags) {
   return false
 }
 
+/**
+ * The BINDINGS of every JSX ancestor of `node`, nearest first — {@link hasAncestorTag} for a
+ * PROVENANCE-gated set. It returns names rather than a boolean for the same reason
+ * {@link slotOwnerBinding} does: whether that `PanelRow` is basalt's is answered by the import list,
+ * which is only complete at `Program:exit`, while the ancestry is only walkable during the visit.
+ *
+ * `tags` is OPTIONAL, and omitting it is the second real use rather than a convenience: a rule
+ * whose ancestor set is not known until the import list is complete cannot filter by tag NAME at
+ * all (`RouterProvider as Router` is an ordinary thing to write), so it takes every binding and
+ * resolves them at exit. `provider-above-router` is that caller.
+ */
+function ancestorTagBindings(node, tags) {
+  const found = []
+  let current = node.parent
+  for (let depth = 0; current !== null && current !== undefined; depth++) {
+    if (depth > ANCESTRY_MAX_DEPTH || current.type === 'Program') break
+    if (
+      current.type === 'JSXElement' &&
+      (tags === undefined || tags.has(jsxTagName(current.openingElement?.name) ?? ''))
+    ) {
+      const root = jsxRootName(current.openingElement?.name)
+      if (root !== undefined) found.push(root)
+    }
+    current = current.parent
+  }
+  return found
+}
+
 /** Identifiers a slot attribute's value resolves through — `filters={pills}`, `actions={[a, b]}`. */
 function collectSlotValueIdentifiers(node, into, depth = 0) {
   if (node === null || node === undefined || depth > 8) return
@@ -2067,14 +2349,30 @@ function collectSlotValueIdentifiers(node, into, depth = 0) {
  * complete at exit.
  */
 function createSlotContext(context) {
-  const homes = new Set()
+  /** Local binding → the basalt export it was imported under. Membership IS the home test. */
+  const homes = new Map()
   const ownTree = isBasaltOwnSource(getFilename(context))
-  /** Hoisted identifier → the owner BINDING of the slot it was handed to. */
+  /**
+   * Hoisted identifier → EVERY owner BINDING whose slot it was handed to.
+   *
+   * A Set, not one binding: `const acts = <Button size="xs"/>` handed to both `<Section actions>` and
+   * `<ChartCard actions>` is inside two slots at once, and a last-writer-wins map made the verdict
+   * depend on which attribute came later in the file — the same code went silent or reported
+   * depending on JSX order.
+   */
   const slotBoundIdentifiers = new Map()
+  /**
+   * Hoisted identifier → every SUBTREE-home BINDING whose children it was rendered as.
+   *
+   * The same hop `slotBoundIdentifiers` makes, one home shape over: `const rows = <SelectFilter/>`
+   * handed to `<PageAside>{rows}</PageAside>` is inside that aside, and the ancestry walk cannot
+   * see it because at the `const` there is no `PageAside` above the node at all.
+   */
+  const subtreeHostedIdentifiers = new Map()
   return {
     /** Feed every ImportDeclaration here — this is where the owner provenance comes from. */
     noteImport(node) {
-      collectBasaltImports(node, homes, ownTree)
+      collectBasaltImportMap(node, homes, ownTree)
     },
     /** Feed every JSXAttribute here — a slot attribute contributes its value's identifiers. */
     note(attr) {
@@ -2082,7 +2380,30 @@ function createSlotContext(context) {
       if (owner === undefined) return
       const identifiers = new Set()
       collectSlotValueIdentifiers(unwrapExpressionContainer(attr.value), identifiers)
-      for (const id of identifiers) slotBoundIdentifiers.set(id, owner)
+      for (const id of identifiers) {
+        const owners = slotBoundIdentifiers.get(id)
+        if (owners === undefined) slotBoundIdentifiers.set(id, new Set([owner]))
+        else owners.add(owner)
+      }
+    },
+    /**
+     * Feed every JSXExpressionContainer here — a `{expr}` CHILD of a subtree home
+     * ({@link BASALT_HOST_TAGS}) hosts the identifiers that expression resolves through.
+     */
+    noteChild(node) {
+      const parent = node.parent
+      if (parent === null || parent === undefined || parent.type !== 'JSXElement') return
+      const name = parent.openingElement?.name
+      if (!BASALT_HOST_TAGS.has(jsxTagName(name) ?? '')) return
+      const owner = jsxRootName(name)
+      if (owner === undefined) return
+      const identifiers = new Set()
+      collectSlotValueIdentifiers(node.expression, identifiers)
+      for (const id of identifiers) {
+        const owners = subtreeHostedIdentifiers.get(id)
+        if (owners === undefined) subtreeHostedIdentifiers.set(id, new Set([owner]))
+        else owners.add(owner)
+      }
     },
     /** Snapshot `node`'s ancestry while it is walkable — the owner NAME, resolved later. */
     capture(node) {
@@ -2090,30 +2411,81 @@ function createSlotContext(context) {
       return {
         directOwner: attr === undefined ? undefined : slotOwnerBinding(attr),
         declaratorName: enclosingDeclaratorName(node),
+        subtreeHosts: ancestorTagBindings(node, BASALT_HOST_TAGS),
       }
     },
     /** Is a captured node inside a BASALT home slot — directly, or via a hoisted binding? */
     resolve(captured) {
       if (captured.directOwner !== undefined) return homes.has(captured.directOwner)
       if (captured.declaratorName === undefined) return false
-      const hoistedOwner = slotBoundIdentifiers.get(captured.declaratorName)
-      return hoistedOwner !== undefined && homes.has(hoistedOwner)
+      const hoistedOwners = slotBoundIdentifiers.get(captured.declaratorName)
+      if (hoistedOwners === undefined) return false
+      // ANY basalt owner puts the binding in a home: a node handed to one basalt slot and one
+      // consumer component still renders inside the basalt slot.
+      for (const owner of hoistedOwners) {
+        if (homes.has(owner)) return true
+      }
+      return false
     },
     /** Does `name` resolve to a basalt home component in this file? */
     isHome(name) {
       return name !== undefined && homes.has(name)
     },
+    /**
+     * Is a captured node inside a basalt SUBTREE home — directly by ancestry, or via a hoisted
+     * binding rendered as one's `{expr}` child? Both halves resolve the binding through `homes`,
+     * so a consumer's own `PanelRow` is not one.
+     */
+    inSubtreeHome(captured) {
+      for (const binding of captured.subtreeHosts) {
+        if (homes.has(binding)) return true
+      }
+      if (captured.declaratorName === undefined) return false
+      for (const owner of subtreeHostedIdentifiers.get(captured.declaratorName) ?? []) {
+        if (homes.has(owner)) return true
+      }
+      return false
+    },
+    /**
+     * EVERY basalt EXPORT whose slot a captured node sits in — `['ChartCard']` for
+     * `<ChartCard actions={…}>` and for `<Card actions={…}>` under an alias, `[]` when the node is in
+     * no basalt slot. Resolves through the same hoisted-binding hop `resolve` does.
+     *
+     * A LIST, because one hoisted binding can be handed to several slots, and an exemption keyed on
+     * the owner is only sound when it holds for all of them — a `size="xs"` shared between
+     * `<ChartCard actions>` and `<Section actions>` really does render inside the Section's tiered
+     * slot. Non-basalt owners are dropped: they are not homes, so they carry no tier either way.
+     */
+    ownerExports(captured) {
+      const bindings =
+        captured.directOwner !== undefined
+          ? [captured.directOwner]
+          : captured.declaratorName === undefined
+            ? []
+            : [...(slotBoundIdentifiers.get(captured.declaratorName) ?? [])]
+      return bindings.filter((binding) => homes.has(binding)).map((binding) => homes.get(binding))
+    },
   }
 }
 
-/** Collects an owner-definition flag for the control layer — see {@link CONTROL_OWNER_NAMES}. */
+/** Collects the owner-definition verdict for the control layer — see {@link CONTROL_OWNER_NAMES}. */
 function createControlOwnerProbe() {
-  const state = { definesControl: false }
+  const state = { definesControl: false, importsBasalt: false }
   const note = (name) => {
     if (typeof name === 'string' && CONTROL_OWNER_NAMES.has(name)) state.definesControl = true
   }
   return {
-    state,
+    /** Feed every ImportDeclaration here — a `basalt-ui*` import disqualifies the exemption. */
+    noteImport(node) {
+      const source = node.source?.value
+      if (typeof source === 'string' && BASALT_IMPORT_SOURCE.test(source)) {
+        state.importsBasalt = true
+      }
+    },
+    /** Does this file DEFINE a basalt control rather than consume one? Both halves are required. */
+    isOwner() {
+      return state.definesControl && !state.importsBasalt
+    },
     visitors: {
       FunctionDeclaration(node) {
         note(node.id?.name)
@@ -2146,6 +2518,7 @@ const HAND_ROLLED_FILTER_MESSAGE =
  * `SettingsRow.control`, the form-row home — see {@link SLOT_ATTRS} for why a raw input is right
  * there.
  */
+// Ships: error
 const handRolledFilter = {
   meta: {
     type: 'problem',
@@ -2195,9 +2568,9 @@ const handRolledFilter = {
 const CONTROL_OUTSIDE_HOME_MESSAGE =
   'Raw Mantine selection control with no home — a filter, tab or action belongs in exactly one of ' +
   'the three homes (a PageBar / Section / WidgetHeader slot, or a form row), and a home is entered ' +
-  'through a slot prop (law C1). A settings row, an overlay (Modal/Drawer/Popover/Menu) and a ' +
-  'form (@mantine/form) are the declared non-homes and never report. ' +
-  '(basalt/control-outside-home)'
+  'through a slot prop (law C1). A settings row, a form row (FormRow/FormGroup), an overlay ' +
+  '(Modal/Drawer/Popover/Menu) and a form (@mantine/form) are the declared non-homes and never ' +
+  'report. (basalt/control-outside-home)'
 
 /**
  * The cross-file half of C1, and the one rule here that is openly a HEURISTIC: "this control has
@@ -2205,10 +2578,13 @@ const CONTROL_OUTSIDE_HOME_MESSAGE =
  * and stays warn until the playground and the five consumer repos run it with ≤3 waivers
  * (docs/CONTROLS-SPEC.md §9 wave 7).
  *
- * Three exemptions carry the false-positive load: an overlay/settings-row ancestor, a file that
- * imports `@mantine/form` (a form is the third home and its inputs are not filters), and the owner
+ * Four exemptions carry the false-positive load: an overlay/settings-row/form-row ancestor
+ * ({@link CONTROL_HOST_TAGS}, `FormRow`/`FormGroup` included), an {@link isOverlayConventionFile}
+ * basename (the CROSS-FILE case — the `<Modal>` lives in the parent), a file that imports
+ * `@mantine/form` (a form is the third home and its inputs are not filters), and the owner
  * exemption — a file DEFINING a basalt control cannot be told to use one.
  */
+// Ships: warn (grace → 1.30.0)
 const controlOutsideHome = {
   meta: {
     type: 'suggestion',
@@ -2217,6 +2593,7 @@ const controlOutsideHome = {
   },
   create(context) {
     if (isTestFile(context)) return {}
+    if (isOverlayConventionFile(getFilename(context))) return {}
     const slots = createSlotContext(context)
     const owner = createControlOwnerProbe()
     const mantineImports = new Map()
@@ -2228,11 +2605,15 @@ const controlOutsideHome = {
       ImportDeclaration(node) {
         collectMantineImports(node, mantineImports)
         slots.noteImport(node)
+        owner.noteImport(node)
         if ((node.source?.value ?? '') === '@mantine/form') importsMantineForm = true
       },
       JSXAttribute(node) {
         slots.note(node)
       },
+      JSXExpressionContainer(node) {
+        slots.noteChild(node)
+      },
       JSXOpeningElement(node) {
         // Cheap pre-filter: the tag as WRITTEN, or any Mantine binding (an alias resolves at exit).
         const root = jsxRootName(node.name)
@@ -2245,11 +2626,11 @@ const controlOutsideHome = {
         })
       },
       'Program:exit'() {
-        if (importsMantineForm || owner.state.definesControl) return
+        if (importsMantineForm || owner.isOwner()) return
         for (const { node, name, captured, hosted } of candidates) {
           const tag = resolveMantineTag(name, mantineImports)
           if (tag === undefined || !RAW_FILTER_TAGS.has(tag)) continue
-          if (hosted || slots.resolve(captured)) continue
+          if (hosted || slots.resolve(captured) || slots.inSubtreeHome(captured)) continue
           if (hasThemeAllow(context, node, 'control-outside-home')) continue
           context.report({ node, message: CONTROL_OUTSIDE_HOME_MESSAGE })
         }
@@ -2319,6 +2700,25 @@ export const CTL_THEME_TAGS = new Set([
  * {@link CTL_THEME_TAGS} member, and skipped under an overlay ({@link hostedInsideSlot}) — see
  * `CTL_THEME_TAGS` for what firing on everything in the slot cost.
  */
+/**
+ * The home whose slot cannot mount the tier theme, so the CONTROL there has to state its own size.
+ *
+ * `ChartCard` lives inside the Mantine-free chart layer (`src/charts/primitives/`), which means it
+ * cannot render a `MantineThemeProvider` at all — it writes `data-basalt-tier="widget"` by hand and
+ * nothing else (`../CLAUDE.md`, "A home sizes its own SLOT"; `docs/CONTROLS-SPEC.md` §5). So this
+ * rule's whole message — "the HOME sets the tier, drop the prop" — is FALSE in exactly one slot: a
+ * `Switch` in `ChartCard.actions` with no `size` renders at Mantine's default, not at `ctl`.
+ *
+ * It has to be an exemption rather than a waiver because the rule fires on the `size` ATTRIBUTE and
+ * cannot tell a correct `size="ctl"` from the `size="xs"` it exists to catch. The playground carried
+ * exactly one waiver for this and it was the honest kind — the rule was wrong, not the code.
+ *
+ * `hand-rolled-filter` is deliberately NOT exempted here: a raw `Select` in `ChartCard.actions` is
+ * still a filter that should take a `field`, and the tier is not what makes that true.
+ */
+const TIERLESS_SLOT_OWNERS = new Set(['ChartCard'])
+
+// Ships: error
 const controlSizeLiteral = {
   meta: {
     type: 'suggestion',
@@ -2358,6 +2758,12 @@ const controlSizeLiteral = {
             CTL_THEME_TAGS.has(resolveMantineTag(name, mantineImports) ?? '')
           if (!tiered || hosted) continue
           if (!slots.resolve(captured)) continue
+          // EVERY home the node was handed to has to be tierless. One hoisted `const acts =
+          // <Button size="xs"/>` given to both `<ChartCard actions>` and `<Section actions>` renders
+          // in a tiered slot too, and the prop is redundant there — so the exemption does not apply.
+          const owners = slots.ownerExports(captured)
+          if (owners.length > 0 && owners.every((owner) => TIERLESS_SLOT_OWNERS.has(owner)))
+            continue
           if (hasThemeAllow(context, node, 'control-size-literal')) continue
           context.report({ node, message: CONTROL_SIZE_LITERAL_MESSAGE })
         }
@@ -2432,6 +2838,7 @@ function actionsAttributeValue(node) {
  * The four countable halves of C6. `error` from the start: every one of them is arithmetic over a
  * literal the file wrote down, with no heuristic and no layout intent to guess at.
  */
+// Ships: error
 const pageBarBudget = {
   meta: {
     type: 'problem',
@@ -2547,6 +2954,7 @@ function titleOrderOf(node) {
  * lanes on purpose, so one `theme-allow in-body-page-title — <why>` waives both rather than
  * needing a different word per enforcement surface.
  */
+// Ships: error
 const inBodyPageTitle = {
   meta: {
     type: 'suggestion',
@@ -2619,6 +3027,7 @@ function subtreeControlTags(node, into = new Set(), depth = 0) {
  * subtrees both render the same control tag. A file that DEFINES a basalt control is exempt — the
  * one legitimate double mount is the CSS swap inside the control itself.
  */
+// Ships: error
 const responsiveTwin = {
   meta: {
     type: 'suggestion',
@@ -2655,10 +3064,13 @@ const responsiveTwin = {
 
     return {
       ...owner.visitors,
+      ImportDeclaration(node) {
+        owner.noteImport(node)
+      },
       JSXElement: inspectChildren,
       JSXFragment: inspectChildren,
       'Program:exit'() {
-        if (owner.state.definesControl) return
+        if (owner.isOwner()) return
         for (const node of twins) {
           if (hasThemeAllow(context, node, 'responsive-twin')) continue
           context.report({ node, message: RESPONSIVE_TWIN_MESSAGE })
@@ -2697,6 +3109,7 @@ function insideNavDefinition(node) {
   return false
 }
 
+// Ships: error
 const searchLiteralLink = {
   meta: {
     type: 'suggestion',
@@ -2730,6 +3143,7 @@ const USE_SEARCH_FROM_LITERAL_MESSAGE =
   '(law C10) — take the value as a prop, or read it through the store field. ' +
   '(basalt/use-search-from-literal)'
 
+// Ships: error
 const useSearchFromLiteral = {
   meta: {
     type: 'suggestion',
@@ -2756,6 +3170,750 @@ const useSearchFromLiteral = {
   },
 }
 
+// ── Rule 24 — bound-control-outside-home ────────────────────────────────────────────────────────
+
+/**
+ * A bound basalt control with no home — the pill-shaped controls, and `SliderControl` is
+ * deliberately NOT among them: it has no pill form at all. It always renders a `PanelRow`
+ * (`docs/ASIDE-SPEC.md` §3), so a `<Section>` body or a plain page stack is a legitimate place to
+ * write one and "this renders as a stray pill" would be false there. {@link BOUND_TAGS} is the
+ * whole set; every member is a `FieldHandle`-bound `basalt-ui/controls` export, so unlike
+ * {@link RAW_FILTER_TAGS} there is no question of what it is FOR — only of where it was written.
+ */
+const BOUND_CONTROL_OUTSIDE_HOME_MESSAGE =
+  'Bound basalt control with no home — a SelectFilter / ToggleFilter / RangeFilter / ' +
+  'MultiSelectFilter / NumberFilter / SearchFilter / ViewTabs renders as a stray pill when it is ' +
+  'written into a Section body or a page stack. It belongs in a home slot (`filters` / `tabs` / ' +
+  '`filtersEnd` / `actions` / `sync` / `control`), inside a <FilterSet>, or inside a <PageAside> ' +
+  '— where the panel surface renders it as a row instead (law C1, docs/ASIDE-SPEC.md §3). ' +
+  'SliderControl is not policed: it renders its own PanelRow and has no pill form. An overlay ' +
+  '(Modal/Drawer/Popover/Menu), a settings row and a form row (FormRow/FormGroup) are the ' +
+  'declared non-homes and never report. (basalt/bound-control-outside-home)'
+
+/**
+ * A BOUND basalt control that is in no home at all — ledger G5 (`docs/ASIDE-SPEC.md` §2), the half
+ * of law C1 that had no guard: `control-outside-home` matches raw Mantine tags only, so a
+ * `<SelectFilter field={…}/>` dropped into a `Section` body passed silently and shipped as a stray
+ * pill.
+ *
+ * A NEW id rather than a widening of `control-outside-home`, per C16: a level is per-id, so
+ * widening that rule would have landed this form at whatever level it holds, with no grace of its
+ * own — and widening it in a minor would restart its grace besides.
+ *
+ * Provenance is the tag's basalt IMPORT ({@link collectBasaltImportMap}), never its bare name: a
+ * consumer's own `SelectFilter` is not this one. The exemptions are the sibling rule's minus the
+ * `@mantine/form` one — a form input is a raw input, and a `FieldHandle`-bound filter in a form
+ * module is homeless there exactly as it is anywhere else.
+ *
+ * **There is deliberately NO text-lane twin in `src/guard`.** `raw-selection-control` can key on a
+ * bare Mantine tag name because that name is Mantine's whatever the file does with it; a bound
+ * control's name says nothing without the import graph and the ancestry, and a regex over a
+ * 12-line window has neither. A text heuristic here would report a consumer's own `SelectFilter` in
+ * its own `filters` slot — signal the plugin already has, noise the guard would add.
+ */
+// Ships: warn (grace → 1.30.0)
+const boundControlOutsideHome = {
+  meta: {
+    type: 'suggestion',
+    docs: { description: 'Warn on a bound basalt control that is in no basalt home.' },
+    schema: [],
+  },
+  create(context) {
+    if (isTestFile(context)) return {}
+    if (isOverlayConventionFile(getFilename(context))) return {}
+    const slots = createSlotContext(context)
+    const owner = createControlOwnerProbe()
+    const controls = new Map()
+    const ownTree = isBasaltOwnSource(getFilename(context))
+    const candidates = []
+
+    return {
+      ...owner.visitors,
+      ImportDeclaration(node) {
+        collectBasaltImportMap(node, controls, ownTree)
+        slots.noteImport(node)
+        owner.noteImport(node)
+      },
+      JSXAttribute(node) {
+        slots.note(node)
+      },
+      JSXExpressionContainer(node) {
+        slots.noteChild(node)
+      },
+      JSXOpeningElement(node) {
+        // Cheap pre-filter on the tag as WRITTEN; an alias resolves through `controls` at exit.
+        const root = jsxRootName(node.name)
+        if (root === undefined) return
+        if (!BOUND_TAGS.has(jsxTagName(node.name) ?? '') && !controls.has(root)) return
+        candidates.push({
+          node,
+          root,
+          captured: slots.capture(node),
+          hosted: hasAncestorTag(node, CONTROL_HOST_TAGS),
+        })
+      },
+      'Program:exit'() {
+        if (owner.isOwner()) return
+        for (const { node, root, captured, hosted } of candidates) {
+          const exported = controls.get(root)
+          if (exported === undefined || !BOUND_TAGS.has(exported)) continue
+          if (hosted || slots.resolve(captured) || slots.inSubtreeHome(captured)) continue
+          if (hasThemeAllow(context, node, 'bound-control-outside-home')) continue
+          context.report({ node, message: BOUND_CONTROL_OUTSIDE_HOME_MESSAGE })
+        }
+      },
+    }
+  },
+}
+
+// ── Rule 25 — provider-above-router ─────────────────────────────────────────────────────────────
+
+/** `@tanstack/react-router` and its subpaths — never `@tanstack/react-router-devtools`. */
+const TANSTACK_ROUTER_SOURCE = /^@tanstack\/react-router(?:\/|$)/
+
+const PROVIDER_ABOVE_ROUTER_MESSAGE =
+  '<BasaltProvider> is rendered INSIDE <RouterProvider> — invert them. Mantine context has to ' +
+  'exist before any route renders, so the mount order is BasaltProvider → the data layer → ' +
+  'RouterProvider (agent/rules/basalt-mantine.md). A route that renders a themed component ' +
+  'before the provider mounts reads Mantine defaults, not the basalt theme. ' +
+  '(basalt/provider-above-router)'
+
+/**
+ * `BasaltProvider` mounted BELOW a TanStack `RouterProvider` — F5, the first of the three
+ * `basalt-mantine.md` laws that shipped under a `not guarded: —` banner.
+ *
+ * Both tags are provenance-gated: `BasaltProvider` through {@link collectBasaltImportMap} (so a
+ * consumer's own component of that name is not this one) and `RouterProvider` through an
+ * `@tanstack/react-router` import, by its LOCAL binding rather than its written name. The inverse
+ * nesting — the correct one — is not a finding, and neither is either tag alone.
+ *
+ * **STATIC JSX ancestry only, and that is the whole heuristic.** The two providers have to be
+ * written in one JSX tree in one file for this to see anything. The common real shape (`main.tsx`
+ * renders `<BasaltProvider><App/></BasaltProvider>` and `App` renders `<RouterProvider/>`) is
+ * INVERTED cross-file and correct; the inverted-and-wrong cross-file shape is equally invisible.
+ * A rule that followed the composition would need the module graph, which an oxlint rule does not
+ * have — so this catches the one-file case and the law stays advisory for the rest. That is why it
+ * lands at `warn`.
+ */
+// Ships: warn (grace → 1.30.0)
+const providerAboveRouter = {
+  meta: {
+    type: 'suggestion',
+    docs: { description: 'Warn on a BasaltProvider rendered inside a TanStack RouterProvider.' },
+    schema: [],
+  },
+  create(context) {
+    if (isTestFile(context)) return {}
+    const ownTree = isBasaltOwnSource(getFilename(context))
+    const basalt = new Map()
+    const routers = new Set()
+    const candidates = []
+
+    return {
+      ImportDeclaration(node) {
+        collectBasaltImportMap(node, basalt, ownTree)
+        const source = node.source?.value
+        if (typeof source !== 'string' || !TANSTACK_ROUTER_SOURCE.test(source)) return
+        for (const spec of node.specifiers ?? []) {
+          const imported = spec.imported?.name ?? spec.imported?.value
+          if (imported === 'RouterProvider' && typeof spec.local?.name === 'string') {
+            routers.add(spec.local.name)
+          }
+        }
+      },
+      JSXOpeningElement(node) {
+        const root = jsxRootName(node.name)
+        if (root === undefined || !basalt.has(root)) return
+        candidates.push({ node, root, ancestors: ancestorTagBindings(node) })
+      },
+      'Program:exit'() {
+        for (const { node, root, ancestors } of candidates) {
+          if (basalt.get(root) !== 'BasaltProvider') continue
+          if (!ancestors.some((name) => routers.has(name))) continue
+          if (hasThemeAllow(context, node, 'provider-above-router')) continue
+          context.report({ node, message: PROVIDER_ABOVE_ROUTER_MESSAGE })
+        }
+      },
+    }
+  },
+}
+
+// ── Rule 26 — duplicate-notifications-mount ─────────────────────────────────────────────────────
+
+const DUPLICATE_NOTIFICATIONS_MOUNT_MESSAGE =
+  '<BasaltNotifications /> mounted alongside <BasaltOverlays notifications> — the two double-mount ' +
+  "Mantine's <Notifications>, so a single notify() renders twice. BasaltOverlays already composes " +
+  'the notifications layer; drop the standalone mount, or pass `notifications={false}` to ' +
+  'BasaltOverlays if the standalone one is the mount you want. ' +
+  '(basalt/duplicate-notifications-mount)'
+
+/**
+ * The ancestor chain from `node` up to its `Program`, OUTERMOST first — captured during the visit,
+ * because `node.parent` is only walkable then, and compared at `Program:exit`. Unlike
+ * {@link ancestorTagBindings} it keeps the NODES, which is what makes a nearest-common-ancestor
+ * question answerable at all.
+ */
+function ancestorChain(node) {
+  const chain = []
+  let current = node
+  for (let depth = 0; current !== null && current !== undefined; depth++) {
+    if (depth > ANCESTRY_MAX_DEPTH) break
+    chain.push(current)
+    if (current.type === 'Program') break
+    current = current.parent
+  }
+  return chain.toReversed()
+}
+
+/**
+ * True when two nodes sit in DIFFERENT branches of ONE conditional — `a ? <X/> : <Y/>`, or the two
+ * operands of one `&&`/`||`. Exactly one of the pair ever renders, so a double-mount rule firing on
+ * them would be reporting a mount that cannot happen.
+ *
+ * Deliberately the NEAREST common ancestor only, and deliberately expression-level: two separate
+ * `cond && <X/>` expressions under one parent are NOT exclusive (both conditions can hold), and an
+ * `if`/`return` split across statements is a control-flow question this does not pretend to answer.
+ * The runtime guard in `src/commands/overlays-mount.tsx` is the lane that counts real mounts.
+ */
+function mutuallyExclusive(chainA, chainB) {
+  let i = 0
+  while (i < chainA.length && i < chainB.length && chainA[i] === chainB[i]) i++
+  const ancestor = chainA[i - 1]
+  const branchA = chainA[i]
+  const branchB = chainB[i]
+  if (ancestor === undefined || branchA === undefined || branchB === undefined) return false
+  const [first, second] =
+    ancestor.type === 'ConditionalExpression'
+      ? [ancestor.consequent, ancestor.alternate]
+      : ancestor.type === 'LogicalExpression'
+        ? [ancestor.left, ancestor.right]
+        : [undefined, undefined]
+  if (first === undefined || second === undefined) return false
+  return (branchA === first && branchB === second) || (branchA === second && branchB === first)
+}
+
+/**
+ * `<BasaltOverlays notifications>` and `<BasaltNotifications />` in ONE file — F5, the second
+ * `basalt-mantine.md` law with no guard, and the static half of a warning that already exists at
+ * runtime (`src/commands/overlays-mount.tsx` warns in dev when both mount).
+ *
+ * A pair split across the two branches of one conditional is EXEMPT: `a ? <BasaltNotifications/> :
+ * <BasaltOverlays/>` is a file with two mounts written and one mount rendered, and reporting it
+ * taught a consumer to reach for a waiver over code that was already right.
+ *
+ * `notifications` DEFAULTS to true on `BasaltOverlays`, so the absence of the attribute counts as
+ * enabled and only an explicit `notifications={false}` clears it — the same polarity the component
+ * itself reads. Both tags are provenance-gated through {@link collectBasaltImportMap}.
+ *
+ * Same-FILE only, and deliberately so: the runtime warning is the lane that sees a cross-file
+ * double mount, because it counts real mounts rather than JSX. This is the cheap half that catches
+ * it before the app runs, which is the whole reason a static twin is worth having.
+ */
+// Ships: warn (grace → 1.30.0)
+const duplicateNotificationsMount = {
+  meta: {
+    type: 'suggestion',
+    docs: {
+      description: 'Warn when BasaltOverlays and a standalone BasaltNotifications both mount.',
+    },
+    schema: [],
+  },
+  create(context) {
+    if (isTestFile(context)) return {}
+    const ownTree = isBasaltOwnSource(getFilename(context))
+    const basalt = new Map()
+    const mounts = []
+
+    return {
+      ImportDeclaration(node) {
+        collectBasaltImportMap(node, basalt, ownTree)
+      },
+      JSXOpeningElement(node) {
+        const root = jsxRootName(node.name)
+        if (root === undefined || !basalt.has(root)) return
+        // `notifications` DEFAULTS to true, so only an explicit `={false}` clears the layer.
+        const disabled = (node.attributes ?? []).some(
+          (attr) =>
+            attr.type === 'JSXAttribute' &&
+            attr.name?.name === 'notifications' &&
+            unwrapExpressionContainer(attr.value)?.value === false,
+        )
+        mounts.push({ node, root, disabled, chain: ancestorChain(node) })
+      },
+      'Program:exit'() {
+        const overlays = mounts.filter(
+          ({ root, disabled }) => basalt.get(root) === 'BasaltOverlays' && !disabled,
+        )
+        if (overlays.length === 0) return
+        for (const { node, root, chain } of mounts) {
+          if (basalt.get(root) !== 'BasaltNotifications') continue
+          // Every enabled overlays mount on the other branch of one conditional → nothing to report.
+          if (overlays.every((overlay) => mutuallyExclusive(overlay.chain, chain))) continue
+          if (hasThemeAllow(context, node, 'duplicate-notifications-mount')) continue
+          context.report({ node, message: DUPLICATE_NOTIFICATIONS_MOUNT_MESSAGE })
+        }
+      },
+    }
+  },
+}
+
+// ── Rule 27 — query-dual-import ─────────────────────────────────────────────────────────────────
+
+/** `@tanstack/react-query` and its subpaths — never `@tanstack/react-query-devtools`. */
+const TANSTACK_QUERY_SOURCE = /^@tanstack\/react-query(?:\/|$)/
+
+/** The `basalt-ui/query` subpath, exactly — the seam the hooks are supposed to arrive through. */
+const BASALT_QUERY_SOURCE = 'basalt-ui/query'
+
+/** The root barrel — where `QueryState` and the dashboard composites live. */
+const BASALT_ROOT_SOURCE = 'basalt-ui'
+
+const QUERY_DUAL_IMPORT_MESSAGE =
+  'Dual query import — this file imports from @tanstack/react-query AND from basalt-ui/query. ' +
+  'Take the hooks, the client factory and `unwrap` from basalt-ui/query only: two entry points to ' +
+  'one library is how a second QueryClient, a second devtools bundle and a duplicated ' +
+  '`toErrorMessage` reach an app (agent/rules/basalt-batteries.md). ' +
+  '(basalt/query-dual-import)'
+
+const QUERY_ROOT_IMPORT_MESSAGE =
+  'Raw @tanstack/react-query import in a basalt file — the hooks come through basalt-ui/query, ' +
+  'which re-exports them beside `createBasaltQueryClient`, `unwrap`, `toErrorMessage` and the lazy ' +
+  'devtools (agent/rules/basalt-batteries.md). Import from basalt-ui/query instead. ' +
+  '(basalt/query-dual-import)'
+
+/**
+ * The `basalt-batteries.md` law "import query hooks from `basalt-ui/query`, never dual-import
+ * `@tanstack/react-query`" — F5, and one of the two `./query` surfaces that shipped advisory.
+ *
+ * TWO forms, one id, because they are one law read at two strengths. The DUAL form (both
+ * specifiers present) is the law verbatim. The softer form — a raw `@tanstack/react-query` import
+ * in a file that also imports the basalt root barrel — is a heuristic: it says "this file is
+ * already a basalt file, so the query seam is right there", and it is the form that actually
+ * catches the drift, since a file that has never heard of `basalt-ui/query` cannot dual-import.
+ * The softer form is why the whole rule lands at `warn` rather than `error`.
+ *
+ * Gated on the LITERAL specifier, never on `ownTree` relative resolution: basalt's own
+ * `src/query/**` and `src/dashboard/query-state.tsx` import `@tanstack/react-query` because they
+ * ARE the seam, and they reach their siblings relatively. A file that writes `basalt-ui/query` is
+ * by definition a consumer of the published surface.
+ */
+// Ships: warn (grace → 1.30.0)
+const queryDualImport = {
+  meta: {
+    type: 'suggestion',
+    docs: { description: 'Warn on a raw @tanstack/react-query import beside a basalt import.' },
+    schema: [],
+  },
+  create(context) {
+    if (isTestFile(context)) return {}
+    const raw = []
+    let basaltQuery = false
+    let basaltRoot = false
+
+    return {
+      ImportDeclaration(node) {
+        const source = node.source?.value
+        if (typeof source !== 'string') return
+        if (source === BASALT_QUERY_SOURCE) basaltQuery = true
+        else if (source === BASALT_ROOT_SOURCE) basaltRoot = true
+        // `import type { UseQueryResult } from '@tanstack/react-query'` is erased at compile time
+        // — there is no runtime import to route through the seam, and typing against the library's
+        // own result type is exactly what `QueryStateLike` documents as legitimate. Same skip
+        // `agent-no-raw-usechat` and `ai-sdk-major` take.
+        else if (TANSTACK_QUERY_SOURCE.test(source) && node.importKind !== 'type') raw.push(node)
+      },
+      'Program:exit'() {
+        if (!basaltQuery && !basaltRoot) return
+        const message = basaltQuery ? QUERY_DUAL_IMPORT_MESSAGE : QUERY_ROOT_IMPORT_MESSAGE
+        for (const node of raw) {
+          if (hasThemeAllow(context, node, 'query-dual-import')) continue
+          context.report({ node, message })
+        }
+      },
+    }
+  },
+}
+
+// ── Rule 28 — query-fn-unwrap ───────────────────────────────────────────────────────────────────
+
+const QUERY_FN_UNWRAP_MESSAGE =
+  'queryFn fetches without unwrap() — `unwrap` throws on the error branch AND on a null data with ' +
+  'no error (a 204, a silent transport failure), and both are caller bugs that have to surface as ' +
+  'a rejected query rather than as `data: null` rendered through the success branch ' +
+  '(agent/rules/basalt-batteries.md). Wrap the call: `queryFn: () => unwrap(client.thing.get())`. ' +
+  '(basalt/query-fn-unwrap)'
+
+/** A bare `fetch(` / `unwrap(` call, as written — the two halves of this rule's text heuristic. */
+const FETCH_CALL = /\bfetch\s*\(/
+const UNWRAP_CALL = /\bunwrap\s*\(/
+
+/**
+ * A `queryFn` that fetches and never `unwrap`s it — F5, the second unguarded `./query` law.
+ *
+ * **The heuristic is deliberately one sentence long, and it is a TEXT test inside a SYNTACTIC
+ * range**: the rule takes the source span of the `queryFn` property's own function value and fires
+ * only when `fetch(` appears in it and `unwrap(` does not. Nothing resolves, nothing follows a
+ * helper out of the span.
+ *
+ * What that buys and what it costs, both stated so neither is a surprise. It sees the two shapes
+ * the doctrine is actually written against — `queryFn: () => fetch(url)` and
+ * `queryFn: async () => (await fetch(url)).json()`. It does NOT see a `queryFn: fetchThing`
+ * reference, an Eden/Treaty call (`client.thing.get()` contains no `fetch(`), or an `unwrap`
+ * applied one frame out; and it counts an `unwrap(` anywhere in the span, including one applied to
+ * something else. A stricter version would need the call graph. The narrow version fires on the
+ * form a consumer writes by reflex on day one, which is the one the law exists for.
+ *
+ * Scoped to files importing `basalt-ui/query` literally, for the reason {@link queryDualImport}
+ * gives: without that gate it is an opinion about `fetch`, which basalt does not have.
+ */
+// Ships: warn (grace → 1.30.0)
+const queryFnUnwrap = {
+  meta: {
+    type: 'suggestion',
+    docs: { description: 'Warn on a queryFn that fetches without wrapping the call in unwrap().' },
+    schema: [],
+  },
+  create(context) {
+    if (isTestFile(context)) return {}
+    const candidates = []
+    let basaltQuery = false
+
+    return {
+      ImportDeclaration(node) {
+        if (node.source?.value === BASALT_QUERY_SOURCE) basaltQuery = true
+      },
+      Property(node) {
+        if (propertyKeyName(node) !== 'queryFn') return
+        const value = node.value
+        if (value?.type !== 'ArrowFunctionExpression' && value?.type !== 'FunctionExpression') {
+          return
+        }
+        candidates.push({ node, value })
+      },
+      'Program:exit'() {
+        if (!basaltQuery) return
+        const text = context.sourceCode?.text ?? ''
+        for (const { node, value } of candidates) {
+          const [start, end] = value.range ?? []
+          if (typeof start !== 'number' || typeof end !== 'number') continue
+          const body = text.slice(start, end)
+          if (!FETCH_CALL.test(body) || UNWRAP_CALL.test(body)) continue
+          if (hasThemeAllow(context, node, 'query-fn-unwrap')) continue
+          context.report({ node, message: QUERY_FN_UNWRAP_MESSAGE })
+        }
+      },
+    }
+  },
+}
+
+// ── Rule 29 — deprecated-export ─────────────────────────────────────────────────────────────────
+
+/**
+ * @typedef {{
+ *   subpath: string
+ *   name: string
+ *   prop?: string
+ *   replacement: string
+ *   removeIn: string
+ *   fix?: false
+ * }} DeprecatedExport
+ */
+
+/**
+ * The deprecation ledger — every export that is `@deprecated` but still SHIPPED, with what to
+ * write instead and the minor it goes away in. B4: majors are banned here, so a rename cannot be
+ * signalled by a version number; the lifecycle is instead "ship the alias, lint the old name, write
+ * the MIGRATING row, remove it a minor later" (`../CLAUDE.md`, "Deprecation lifecycle").
+ *
+ * A row without `prop` is a NAMED IMPORT from `subpath` — reported on the specifier, with an
+ * autofix that rewrites it to `{ <replacement> as <local> }` so no call site has to move in the
+ * same edit. **That autofix is the row's contract**: only a DROP-IN rename belongs here. A
+ * deprecation whose replacement takes a different shape (`createSearchParamStore` →
+ * `createSearchStore` + a `fields` object) would need the fix suppressed before it could be a row,
+ * and until then it lives in `MIGRATING.md` alone. A row WITH `prop` is a JSX ATTRIBUTE on the component `name`, imported from `subpath`
+ * — no autofix, because the three connectivity props collapse into ONE object prop and a
+ * per-attribute rewrite would produce three `connectivity=` attributes on one tag.
+ *
+ * **Adding a row is the whole job.** Deprecate the export in its JSDoc, add the row here with a
+ * `removeIn` at least one minor out, add the `MIGRATING.md` row, and this rule starts nudging.
+ * `oxlint-plugin.test.ts` scans every `src/**\/index.ts(x)` barrel for a JSDoc `@deprecated` and
+ * fails when one has no row here, so the barrel half cannot be forgotten. Removing the export is a
+ * separate commit that deletes the row in the same change.
+ *
+ * @type {readonly DeprecatedExport[]}
+ */
+export const DEPRECATED_EXPORTS = [
+  {
+    subpath: 'basalt-ui/forms',
+    name: 'field',
+    replacement: 'inputProps',
+    removeIn: '1.29.0',
+    // Not a drop-in: `inputProps` no longer returns `key`, so a rename alone would silently drop
+    // the reconciler key. The nudge stays; the rewrite is `basalt/forms-field-key`'s job.
+    fix: false,
+  },
+  {
+    subpath: 'basalt-ui',
+    name: 'BasaltProvider',
+    prop: 'sseUrl',
+    replacement: 'connectivity={{ sseUrl }}',
+    removeIn: '1.29.0',
+  },
+  {
+    subpath: 'basalt-ui',
+    name: 'BasaltProvider',
+    prop: 'healthUrl',
+    replacement: 'connectivity={{ healthUrl }}',
+    removeIn: '1.29.0',
+  },
+  {
+    subpath: 'basalt-ui',
+    name: 'BasaltProvider',
+    prop: 'healthIntervalMs',
+    replacement: 'connectivity={{ healthIntervalMs }}',
+    removeIn: '1.29.0',
+  },
+]
+
+function deprecatedExportMessage(row) {
+  const what =
+    row.prop === undefined
+      ? `\`${row.name}\` from ${row.subpath}`
+      : `\`${row.prop}\` on <${row.name}>`
+  return (
+    `Deprecated basalt export — ${what} is superseded by \`${row.replacement}\` and is removed in ` +
+    `${row.removeIn}. It still resolves today, so nothing is broken yet; migrate before that minor ` +
+    '(packages/basalt-ui/MIGRATING.md carries the row). ' +
+    '(basalt/deprecated-export)'
+  )
+}
+
+/**
+ * A shipped-but-`@deprecated` export still being imported or written — B4, the sunset half of the
+ * lifecycle whose absence the blueprint audit found (§8): the grace mechanism covers a rule getting
+ * STRICTER, and nothing covered an export going away.
+ *
+ * Permanently `warn` ({@link PLUGIN_RULE_ADVISORY}), for the same reason `shadow-basalt-export` is:
+ * a deprecation is a schedule, not a defect. The code compiles and runs; promoting this to `error`
+ * would break a consumer's build for something that still works, which is the one thing the
+ * no-majors doctrine exists to avoid. The `removeIn` minor is where it becomes an error — by the
+ * export ceasing to exist.
+ */
+// Ships: warn (advisory)
+const deprecatedExport = {
+  meta: {
+    type: 'suggestion',
+    docs: { description: 'Warn on an import or prop that basalt has deprecated but still ships.' },
+    schema: [],
+    fixable: 'code',
+  },
+  create(context) {
+    if (isTestFile(context)) return {}
+    if (isBasaltOwnSource(getFilename(context))) return {}
+    const importRows = DEPRECATED_EXPORTS.filter((row) => row.prop === undefined)
+    const propRows = DEPRECATED_EXPORTS.filter((row) => row.prop !== undefined)
+    const components = new Map()
+    const candidates = []
+
+    return {
+      ImportDeclaration(node) {
+        const source = node.source?.value
+        if (typeof source !== 'string') return
+        for (const spec of node.specifiers ?? []) {
+          const imported = spec.imported?.name ?? spec.imported?.value
+          const local = spec.local?.name
+          if (typeof imported !== 'string' || typeof local !== 'string') continue
+          for (const row of propRows) {
+            if (source === row.subpath && imported === row.name) components.set(local, row.name)
+          }
+          const row = importRows.find((r) => r.subpath === source && r.name === imported)
+          if (row === undefined) continue
+          if (hasThemeAllow(context, spec, 'deprecated-export')) continue
+          context.report({
+            node: spec,
+            message: deprecatedExportMessage(row),
+            ...(row.fix === false
+              ? {}
+              : { fix: (fixer) => fixer.replaceText(spec, `${row.replacement} as ${local}`) }),
+          })
+        }
+      },
+      JSXAttribute(node) {
+        const name = node.name?.name
+        if (typeof name !== 'string') return
+        const owner = node.parent
+        if (owner === null || owner === undefined || owner.type !== 'JSXOpeningElement') return
+        const root = jsxRootName(owner.name)
+        if (root === undefined) return
+        candidates.push({ node, root, name })
+      },
+      'Program:exit'() {
+        for (const { node, root, name } of candidates) {
+          const component = components.get(root)
+          if (component === undefined) continue
+          const row = propRows.find((r) => r.name === component && r.prop === name)
+          if (row === undefined) continue
+          if (hasThemeAllow(context, node, 'deprecated-export')) continue
+          context.report({ node, message: deprecatedExportMessage(row) })
+        }
+      },
+    }
+  },
+}
+
+// ── Rule 30 — forms-field-key ───────────────────────────────────────────────────────────────────
+
+/** The subpath the forms idiom is imported from — the only provenance this rule accepts. */
+const FORMS_IMPORT_SOURCE = 'basalt-ui/forms'
+
+/** The three names this rule resolves through the local→imported map. */
+const FORMS_SPREAD_NAMES = new Set(['inputProps', 'field'])
+
+const FORMS_FIELD_KEY_MESSAGES = {
+  missing:
+    'A spread `inputProps(…)` with no sibling `key`. The field loses its reconciler key, so an ' +
+    'uncontrolled input keeps its old text through `form.reset()`, `form.setValues()` and a ' +
+    'removed list row — nothing throws and nothing type-checks differently. Write ' +
+    '`key={fieldKey(form, path)} {...inputProps(form, path)}`: `inputProps` stopped returning ' +
+    '`key` because a spread `key` is a React 19 warning, and a call site that merely kept the ' +
+    'spread compiles unchanged and silently stops resetting. ' +
+    '(basalt/forms-field-key)',
+  deprecatedAlias:
+    'A spread `field(…)`. That is the @deprecated 1.27 alias and it still bundles `key` INTO the ' +
+    'returned object, so it still logs React 19\'s `A props object containing a "key" prop is ' +
+    'being spread into JSX` on every render — kept byte-identical on purpose, because a ' +
+    'deprecation is a schedule and not a silent behaviour change. Migrate to ' +
+    '`key={fieldKey(form, path)} {...inputProps(form, path)}` (packages/basalt-ui/MIGRATING.md ' +
+    'carries the row); the alias itself is removed in 1.29.0. ' +
+    '(basalt/forms-field-key)',
+}
+
+/** The `key` attribute among a JSXOpeningElement's attributes, if it has one written literally. */
+function hasKeyAttribute(opening) {
+  for (const attr of opening?.attributes ?? []) {
+    if (attr?.type === 'JSXAttribute' && attr.name?.name === 'key') return true
+  }
+  return false
+}
+
+/**
+ * A field spread that lost its reconciler key — the guard for the one change in the 1.28.0 forms
+ * minor that a consumer's compiler cannot see.
+ *
+ * `inputProps` used to return `getInputProps(path)` AND `key` in one object, so
+ * `<TextInput {...inputProps(form, 'x')} />` covered both. It no longer returns `key` (a spread
+ * `key` is a React 19 warning), and that exact call site still type-checks, still renders and still
+ * validates — it just stops resetting. There is no compile error, no throw and no console line to
+ * find it by, which is precisely the profile a lint rule exists for.
+ *
+ * TWO forms under this one id, because they are one law read from either end:
+ *
+ * - `{...inputProps(…)}` with no sibling `key` — the post-migration mistake. Autofixed: the `key`
+ *   attribute is inserted with the SAME arguments, and `fieldKey` is added to the existing
+ *   `basalt-ui/forms` import when it is not already there, so `--fix` produces working code rather
+ *   than an unresolved identifier.
+ * - `{...field(…)}` — the pre-migration call site. Reported ALWAYS, key or no key, and deliberately
+ *   NOT autofixed: `field` still returns the bundle, so inserting a second `key` would be wrong,
+ *   and the honest remedy is the rename `basalt/deprecated-export` already nudges. This arm is a
+ *   pointer at the migration, one lane over from that rule's import-level nudge.
+ *
+ * Provenance is the `basalt-ui/forms` specifier (plus a relative import inside basalt's own `src/`,
+ * or the dogfood surface goes silent — the same gate `collectBasaltImports` uses), read through the
+ * local→imported map so `import { inputProps as f }` is covered. `inputProps` is an ordinary enough
+ * name that firing on an unimported one would be an opinion about a consumer's own helper.
+ */
+// Ships: warn (grace → 1.30.0)
+const formsFieldKey = {
+  meta: {
+    type: 'suggestion',
+    docs: { description: 'Warn on a spread field object that lost (or still bundles) its key.' },
+    schema: [],
+    fixable: 'code',
+  },
+  create(context) {
+    if (isTestFile(context)) return {}
+    const ownTree = isBasaltOwnSource(getFilename(context))
+    /** local name → the name it was imported as, for the three forms names. */
+    const imported = new Map()
+    /** The forms ImportDeclaration the `fieldKey` specifier is added to, if one exists. */
+    let formsImport
+    const candidates = []
+
+    return {
+      ImportDeclaration(node) {
+        const source = node.source?.value
+        if (typeof source !== 'string') return
+        if (source !== FORMS_IMPORT_SOURCE && !(ownTree && RELATIVE_IMPORT_SOURCE.test(source))) {
+          return
+        }
+        for (const spec of node.specifiers ?? []) {
+          const local = spec.local?.name
+          const name = spec.imported?.name ?? spec.imported?.value
+          if (typeof local !== 'string' || typeof name !== 'string') continue
+          if (name === 'fieldKey' || FORMS_SPREAD_NAMES.has(name)) {
+            imported.set(local, name)
+            if (source === FORMS_IMPORT_SOURCE) formsImport = node
+          }
+        }
+      },
+      JSXSpreadAttribute(node) {
+        const call = node.argument
+        if (call?.type !== 'CallExpression' || call.callee?.type !== 'Identifier') return
+        const opening = node.parent
+        if (opening === null || opening === undefined || opening.type !== 'JSXOpeningElement')
+          return
+        candidates.push({ node, call, local: call.callee.name, opening })
+      },
+      'Program:exit'() {
+        const text = context.sourceCode?.text ?? ''
+        const hasFieldKey = [...imported.values()].includes('fieldKey')
+        let importFixed = false
+
+        for (const { node, call, local, opening } of candidates) {
+          const name = imported.get(local)
+          if (name === undefined) continue
+          if (hasThemeAllow(context, node, 'forms-field-key')) continue
+
+          if (name === 'field') {
+            context.report({ node, message: FORMS_FIELD_KEY_MESSAGES.deprecatedAlias })
+            continue
+          }
+          if (hasKeyAttribute(opening)) continue
+
+          const args = call.arguments ?? []
+          const first = args[0]?.range
+          const last = args[args.length - 1]?.range
+          // No arguments to copy means no honest `fieldKey(…)` to write — report without a fix
+          // rather than emit one that does not compile.
+          if (first === undefined || last === undefined) {
+            context.report({ node, message: FORMS_FIELD_KEY_MESSAGES.missing })
+            continue
+          }
+          const argsText = text.slice(first[0], last[1])
+          // The import specifier is added by the FIRST fixed occurrence only: three fields in one
+          // file would otherwise emit three overlapping edits to one import, and an overlapping
+          // fix is dropped rather than merged.
+          const needsImport = !hasFieldKey && !importFixed && formsImport !== undefined
+          const lastSpec = needsImport
+            ? formsImport.specifiers?.[(formsImport.specifiers?.length ?? 0) - 1]
+            : undefined
+          if (needsImport && lastSpec !== undefined) importFixed = true
+
+          context.report({
+            node,
+            message: FORMS_FIELD_KEY_MESSAGES.missing,
+            fix: (fixer) => {
+              const fixes = [fixer.insertTextBefore(node, `key={fieldKey(${argsText})} `)]
+              if (lastSpec !== undefined) fixes.push(fixer.insertTextAfter(lastSpec, ', fieldKey'))
+              return fixes
+            },
+          })
+        }
+      },
+    }
+  },
+}
+
 // ── Grace ledger ────────────────────────────────────────────────────────────────────────────────
 
 /**
@@ -2789,58 +3947,96 @@ const useSearchFromLiteral = {
 export const PLUGIN_RULE_GRACE = {
   'control-outside-home': {
     since: '1.26.0',
-    promote: '1.27.0',
+    promote: '1.30.0',
     why:
       'the wave-6 control guards (docs/CONTROLS-SPEC.md §6). The one openly HEURISTIC rule of the ' +
       'set — "this control has no home" is a claim about layout intent, so its false-positive load ' +
-      'is carried by three exemptions (overlay/settings-row ancestor, @mantine/form, owner ' +
-      'definition) rather than by certainty. Promotion is additionally gated on running the ' +
-      'shipped preset over argo, linewatch, image-share, rb, image-gen and the playground with ≤3 ' +
-      'total waivers (§9 wave 7).',
+      'is carried by four exemptions (overlay/settings-row ancestor, the overlay FILENAME ' +
+      'convention below, @mantine/form, owner definition) rather than by certainty. The other five ' +
+      'wave-6 rules promoted at 1.27.0; this one did not, and the reason is measured rather than ' +
+      'cautious: the wave-7 run found 9 remaining warns in argo, every one of them a control in a ' +
+      'modal/form module whose `<Modal>` is rendered by the PARENT — the cross-file case law C1 is ' +
+      'explicitly advisory about, which no ancestry walk inside one file can ever see. ' +
+      '{@link isOverlayConventionFile} exempts that declared naming convention, in BOTH the kebab ' +
+      '(`edit-session-modal.tsx`) and the PascalCase (`CbbiPanel.tsx`) dialect. Re-dated ' +
+      '2026-08-28 — the argo wave-7 migration has not run; the PascalCase overlay convention (this ' +
+      'change) is expected to clear most of the 9. 1.30.0 is when the remainder is re-measured. A ' +
+      "file outside the convention that is still an overlay's own body declares it with " +
+      '`theme-allow-file control-outside-home — overlay`.',
   },
-  'control-size-literal': {
-    since: '1.26.0',
-    promote: '1.27.0',
+  'bound-control-outside-home': {
+    since: '1.28.0',
+    promote: '1.30.0',
     why:
-      'the wave-6 control guards (docs/CONTROLS-SPEC.md §6). Rejects a prop that was correct one ' +
-      'minor ago — every `size="xs"` written into a bar before the tier existed — so it takes the ' +
-      'grace minor the doctrine exists for. Every wave ships in ONE minor (1.26.0), so the whole ' +
-      'set promotes together in 1.27.0 — one runway, not one per wave.',
+      'ASIDE-SPEC G5 — a bound control in a section body rendered as a stray pill and nothing saw ' +
+      'it. `control-outside-home` matches raw Mantine tags only, so the whole basalt half of law ' +
+      'C1 was unguarded: `<SelectFilter field={…}/>` written into a `Section` body or a bare page ' +
+      'stack passed every lane. A NEW id rather than a widening (C16 — a level is per-id), landing ' +
+      'warn because it inherits the sibling rule\'s heuristic: "this control has no home" is a ' +
+      'claim about layout intent, and the ancestry it reads now spans four subtree homes ' +
+      '(FilterSet / PageAside / PanelRow / the overlay hosts) that only shipped in 1.27.0. 1.30.0 ' +
+      'is when the incumbent count across argo, linewatch, image-share, rb, image-gen and the ' +
+      'playground is re-measured.',
   },
-  'in-body-page-title': {
-    since: '1.26.0',
-    promote: '1.27.0',
+  'provider-above-router': {
+    since: '1.28.0',
+    promote: '1.30.0',
     why:
-      'the wave-6 control guards (docs/CONTROLS-SPEC.md §6, law C8). Its text-level twin is the ' +
-      'guard kind of the SAME id, which carries the same dates in GRACE_PERIOD_KINDS — one law, ' +
-      'two lanes, one promotion. Warn because an in-body h1/h2 is a judgement about which name ' +
-      'the page already has, and the fix is a route/breadcrumb change rather than a prop edit.',
+      'F5 — one of the three basalt-mantine.md laws that shipped under a `not guarded: —` banner. ' +
+      'It reads STATIC JSX ancestry inside one file, which is a genuine fraction of the law: the ' +
+      'usual real shape composes the two providers across modules, where no oxlint rule can see ' +
+      'the nesting at all. Landing it at `error` would state a certainty the implementation does ' +
+      'not have. 1.30.0 is when the incumbent count across argo, linewatch, image-share, rb, ' +
+      'image-gen and the playground is measured — every one of them mounts a router, so the ' +
+      'false-positive question has a real sample.',
   },
-  'responsive-twin': {
-    since: '1.26.0',
-    promote: '1.27.0',
+  'duplicate-notifications-mount': {
+    since: '1.28.0',
+    promote: '1.30.0',
     why:
-      'the wave-6 control guards (docs/CONTROLS-SPEC.md §6, law C9 — linewatch shipped three ' +
-      'doubled controls). Warn for one minor because the fix is a real edit (delete one mount, ' +
-      'move the swap into the control), not a prop removal, and the pair test is a heuristic over ' +
-      'sibling structure.',
+      'F5 — the static half of a double-mount the runtime already warns about in dev ' +
+      '(`src/commands/overlays-mount.tsx`). Same-file only, so like its sibling it guards a ' +
+      'fraction of the law and cannot claim `error`. It also reads a prop DEFAULT (`notifications` ' +
+      'is true when unwritten), which is the kind of polarity a consumer disagrees with exactly ' +
+      'once before it is worth knowing about — a minor at `warn` is how that disagreement arrives ' +
+      'as feedback rather than as a broken build.',
   },
-  'search-literal-link': {
-    since: '1.26.0',
-    promote: '1.27.0',
+  'query-dual-import': {
+    since: '1.28.0',
+    promote: '1.30.0',
     why:
-      'the wave-6 control guards (docs/CONTROLS-SPEC.md §6, law C10 — argo nav.tsx:132 pinned the ' +
-      'fallback on every click, which is why its reader had zero call sites). Warn for one minor ' +
-      'because the fix needs a store to exist at the call site, which is a wave-2 dependency for ' +
-      'consumers still on the old enum-only pair.',
+      'F5 — the basalt-batteries.md law with no guard. TWO forms under one id: the dual import ' +
+      '(both `@tanstack/react-query` and `basalt-ui/query` in one file) is the law verbatim, and ' +
+      'the softer form — a raw `@tanstack/react-query` import in a file that also imports the ' +
+      'basalt root barrel — is the heuristic that actually catches the drift, since a file that ' +
+      'never names `basalt-ui/query` cannot dual-import. The soft form is what holds the whole ' +
+      'rule at `warn`: "this file is already a basalt file" is a claim about intent. 1.30.0 is ' +
+      'when the consumer count is measured and the soft form is either kept or split off.',
   },
-  'use-search-from-literal': {
-    since: '1.26.0',
-    promote: '1.27.0',
+  'forms-field-key': {
+    since: '1.28.0',
+    promote: '1.30.0',
+    why:
+      "the 1.28.0 forms minor took `key` out of `inputProps`' return, and the OLD call site " +
+      "(`<TextInput {...inputProps(form, 'x')} />`) survives that change with no compile error, " +
+      'no throw and no console line — it just stops resetting. This rule is the only thing that ' +
+      'reports it, which is an argument for `error`, not `warn`; it lands at `warn` anyway ' +
+      'because it fires on code every consumer is CURRENTLY shipping, and the grace minor is what ' +
+      'turns "your build is broken by the upgrade" into "your editor lists the eleven lines". ' +
+      'The `field(` arm is the same law read from the pre-migration end, and that alias is removed ' +
+      'in 1.29.0 anyway. 1.30.0 is when argo, linewatch, image-share, rb, image-gen and the ' +
+      'playground have all been through the autofix and the remainder is measured.',
+  },
+  'query-fn-unwrap': {
+    since: '1.28.0',
+    promote: '1.30.0',
     why:
-      'the wave-6 control guards (docs/CONTROLS-SPEC.md §6, law C10). Same runway as ' +
-      'search-literal-link and for the same reason: the remedy is `createSearchStore` + a prop, ' +
-      'so a consumer needs the wave-2 store before the finding is actionable.',
+      'F5 — the second unguarded ./query law. Openly a TEXT heuristic inside a syntactic range: ' +
+      '`fetch(` present in the queryFn span and `unwrap(` absent. It cannot see a `queryFn: ' +
+      'fetchThing` reference, an Eden/Treaty call, or an unwrap one frame out, and it counts an ' +
+      '`unwrap(` applied to anything. That is a deliberate floor rather than a first draft, and a ' +
+      'rule whose stated reach is this narrow has no business failing a build. 1.30.0 is when the ' +
+      'measured false-positive load decides whether it promotes or stays advisory.',
   },
 }
 
@@ -2865,6 +4061,16 @@ export const PLUGIN_RULE_ADVISORY = {
       'strong evidence and not proof, and renaming defeats it outright, so this stays a permanent ' +
       'warn rather than a grace entry with no honest promote date.',
   },
+  'deprecated-export': {
+    since: '1.28.0',
+    why:
+      'B4, the sunset half of the deprecation lifecycle (`../CLAUDE.md`). A deprecation is a ' +
+      'SCHEDULE, not a defect: the code compiles, runs and is correct until the `removeIn` minor, ' +
+      'so promoting this to `error` would fail a consumer build over something that still works — ' +
+      'the one outcome the no-majors doctrine exists to avoid. There is no version at which that ' +
+      'stops being true, which is what makes it advisory rather than a grace entry: enforcement ' +
+      'arrives by the export ceasing to exist, not by this rule changing level.',
+  },
 }
 
 // ── Plugin export ───────────────────────────────────────────────────────────────────────────────
@@ -2883,12 +4089,19 @@ export default {
     'raw-scroll-container': rawScrollContainer,
     'hand-rolled-filter': handRolledFilter,
     'control-outside-home': controlOutsideHome,
+    'bound-control-outside-home': boundControlOutsideHome,
     'control-size-literal': controlSizeLiteral,
     'page-bar-budget': pageBarBudget,
     'in-body-page-title': inBodyPageTitle,
     'responsive-twin': responsiveTwin,
     'search-literal-link': searchLiteralLink,
     'use-search-from-literal': useSearchFromLiteral,
+    'provider-above-router': providerAboveRouter,
+    'duplicate-notifications-mount': duplicateNotificationsMount,
+    'query-dual-import': queryDualImport,
+    'query-fn-unwrap': queryFnUnwrap,
+    'deprecated-export': deprecatedExport,
+    'forms-field-key': formsFieldKey,
     'visx-boundary': visxBoundary,
     'visx-tooltip': visxTooltip,
     'token-layer-boundary': tokenLayerBoundary,