genesis-stack 1.4.4 → 1.4.6

package/README.md

@@ -30,7 +30,11 @@ the established project operations.
 The package contains static Markdown declarations and a JSON starter catalogue,
 and has no framework dependencies. Genesis reads its manifest and Stack pieces; it never imports or
 executes catalog code. Framework pieces such as JSKIT and Vue link to their
-authoritative documentation in ordinary Stack guidance.
+authoritative documentation in ordinary Stack guidance. Each piece's
+"Sanity checks with <stack>" guidance says how to apply Genesis's
+stack-neutral sanity checks with that stack's own tools, such as its strict
+loading mode, query-count assertion and parallel test runner; it names a
+framework default only where official documentation confirms it.
 
 Genesis still supports optional Agent Skills generically. A Stack piece from
 any resolvable package may declare one when selecting that piece should install

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-stack",
-  "version": "1.4.4",
+  "version": "1.4.6",
   "description": "The optional curated technology Stack catalog for Genesis projects.",
   "type": "module",
   "repository": {

package/stacks/pieces/cpp.md

@@ -51,6 +51,12 @@ C and C++ translation-unit, header, callable, ownership, build, and test convent
   dependency's sources come from the connected checkout rather than a
   `_deps/*-src` download. The project owns the repository-to-dependency name
   mapping.
+- Sanity checks with C++. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with the
+  project's own build and test driver, as its official documentation describes
+  it: tests run in parallel, each with its own temporary directory and a
+  system-picked port, and the slowest tests are read after each run. CTest
+  runs tests one at a time unless given `--parallel <n>`.
 
 ## Adoption
 

package/stacks/pieces/csharp.md

@@ -47,6 +47,12 @@ C# namespace, public type, dependency, lifecycle, and test conventions.
   headers only from a loopback proxy, and read secrets from the environment.
   ASP.NET Core: call `UseForwardedHeaders` with the loopback addresses in
   `KnownProxies`, and take the listen URL from `ASPNETCORE_URLS` or `--urls`.
+- Sanity checks with C#. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with the
+  project's own test framework and data-access tools, as their official
+  documentation describes them: count a list's queries at a few rows and at a
+  realistic number, let independent test collections run in parallel with a
+  database each, and read the slowest tests after each run.
 
 ## Connected development
 

package/stacks/pieces/django-mysql.md

@@ -69,6 +69,8 @@ https://docs.djangoproject.com/en/stable/ref/databases/
 - When `TEST_DB_NAME` is supplied, set `DATABASES["default"]["TEST"]["NAME"]`
   to it and run tests with `--keepdb`; Django reuses the existing database.
   Without it, the user needs permission to create `test_<NAME>`.
+- Sanity checks with Django and MySQL: the django and mysql pieces' checks
+  apply.
 
 ## Adoption
 

package/stacks/pieces/django-postgresql.md

@@ -68,6 +68,8 @@ https://docs.djangoproject.com/en/stable/ref/databases/
   role needs `CREATEDB`.
 - Keep schema changes in Django migrations; avoid raw SQL schema edits
   outside `RunSQL` operations committed with the app.
+- Sanity checks with Django and PostgreSQL: the django and postgresql pieces'
+  checks apply.
 
 ## Adoption
 

package/stacks/pieces/django-sqlite.md

@@ -47,6 +47,8 @@ https://docs.djangoproject.com/en/stable/ref/databases/#sqlite-notes
 - SQLite allows one writer at a time. Keep Gunicorn to a small worker count
   and short transactions, and consider `"OPTIONS": {"transaction_mode": "IMMEDIATE"}`
   with a `timeout` when concurrent writes report "database is locked".
+- Sanity checks with Django and SQLite: the django and sqlite pieces' checks
+  apply.
 
 ## Adoption
 

package/stacks/pieces/django.md

@@ -98,6 +98,33 @@ https://docs.djangoproject.com/
   sections with that tool's equivalent.
 - Select `django-postgresql`, `django-mysql` or `django-sqlite` for the
   database settings; it owns the engine and environment names.
+- Sanity checks with Django. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with Django's
+  own tools:
+  - Related rows load only when asked: `select_related()` for foreign keys and
+    one-to-one relations, `prefetch_related()` for many.
+  - On Django 6.1+, a queryset or manager chooses its fetch mode with
+    `fetch_mode()`; no project-wide setting is documented. Make the managers
+    that lists read use `models.FETCH_RAISE` under tests, so a lazy fetch
+    raises there. The production mode is the app's choice: `FETCH_ONE` (the
+    default) or `FETCH_PEERS`, which batches a lazy fetch across the loaded
+    rows.
+  - `assertNumQueries` asserts a given number. Use it to compare a few rows
+    with a realistic number, never as a fixed ceiling.
+  - Django runs tests one at a time unless asked: run
+    `manage.py test --parallel auto`, which clones the test database once per
+    process, so the database user needs permission to create databases. Add
+    `--durations 10` (Python 3.12+) to list the slowest tests, `--timing` for
+    database setup time and `--shuffle` to prove order independence. Keep
+    `--failfast` for diagnosis runs.
+  - Tests build the database by running migrations. Locally, `--keepdb` keeps
+    the migrated test database between runs; `"TEST": {"MIGRATE": False}`
+    builds it from the models instead, skipping data migrations, so the full
+    migration run stays as its own check. `TestCase` wraps each test in a
+    transaction.
+  - `startproject` writes `DEBUG = True`; this piece reads `DJANGO_DEBUG` and
+    defaults it off. `SECURE_HSTS_SECONDS` defaults to `0`, so HSTS is off until
+    set.
 
 ## Adoption
 

package/stacks/pieces/express.md

@@ -103,6 +103,10 @@ documentation: https://expressjs.com/
   same environment variables. A command started without that environment loads
   the ignored dotenv the host generates with `process.loadEnvFile()` rather than
   falling back to a different database file or connection.
+- Sanity checks with Express. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with the
+  `nodejs` piece's test tools, and read a production build's response headers
+  and mode as the "Production settings" section describes.
 
 ## Adoption
 

package/stacks/pieces/go.md

@@ -45,6 +45,18 @@ Go package, exported callable, interface, concurrency, resource, and test conven
   headers only from a loopback proxy, and read secrets from the environment.
   Take the listen address from an argument or environment variable rather than
   hard-coding it.
+- Sanity checks with Go. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with Go's own
+  tools:
+  - `go test ./...` runs packages in parallel (`-p` defaults to GOMAXPROCS),
+    but a package's tests run one at a time unless they call `t.Parallel()`.
+    Mark independent slow tests parallel; a test that uses `t.Setenv` cannot
+    be.
+  - Release what a test starts with `t.Cleanup` and `t.TempDir`, which run when
+    the test and its subtests complete, and listen on `127.0.0.1:0`.
+  - `-timeout` (10 minutes per test binary by default) bounds a hang; never
+    raise it to make slow tests pass. `-shuffle=on` proves order independence
+    and is off by default. Keep `-failfast` for diagnosis runs.
 
 ## Connected development
 

package/stacks/pieces/java.md

@@ -47,6 +47,13 @@ Java package, public type, dependency, lifecycle, and test conventions.
 - Running a web process: bind the supplied listen host and port, trust forwarded
   headers only from a loopback proxy, and read secrets from the environment.
   For Spring Boot select `spring-boot`; its piece owns the framework traps.
+- Sanity checks with Java. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with the
+  project's own build, test runner and data-access tools, as their official
+  documentation describes them: count a list's queries at a few rows and at a
+  realistic number, run test classes in parallel, and read the slowest tests
+  after each run. JUnit Jupiter runs tests in one thread until
+  `junit.jupiter.execution.parallel.enabled` is `true`.
 
 ## Connected development
 

package/stacks/pieces/jskit-mysql.md

@@ -70,6 +70,8 @@ JSKIT MySQL runtime, live-schema CRUD generation, and persistence conventions.
   existing migration and transaction owner. Test scoped uniqueness, duplicate
   webhooks and concurrent credit debits on this driver before claiming database
   correctness; provider calls and app authorization remain outside the database.
+- Sanity checks with JSKIT and MySQL: the jskit and mysql pieces' checks
+  apply.
 
 ## Deslop
 

package/stacks/pieces/jskit-postgresql.md

@@ -66,6 +66,8 @@ JSKIT PostgreSQL runtime, live-schema CRUD generation, and persistence conventio
   existing migration and transaction owner. Test scoped uniqueness, duplicate
   webhooks and concurrent credit debits on this driver before claiming database
   correctness; provider calls and app authorization remain outside the database.
+- Sanity checks with JSKIT and PostgreSQL: the jskit and postgresql pieces'
+  checks apply.
 
 ## Deslop
 

package/stacks/pieces/jskit.md

@@ -43,7 +43,8 @@ https://mobily-enterprises.github.io/jskit-ai/
   surfaces are public or login-required and expose
   `AUTH_LOCAL_SESSION_SECRET` as a required environment name in the project's
   established environment contract and committed environment example. Never
-  commit or invent its value.
+  commit or invent its value; the proposed Deployment lists it as a generated
+  secret, so the deployment consumer supplies its production value.
 - An application with accounts always has the host's browser-preview login,
   without waiting to be asked: when adding authentication, add the
   `auth/auth-surface` pattern's executable `tools/preview-identity` and copy its
@@ -82,6 +83,17 @@ https://mobily-enterprises.github.io/jskit-ai/
   pending migrations and resets fixtures deterministically; it does not drop or
   rebuild the database or run a production frontend build per check. Keep
   fresh-schema migration checks separate.
+- Sanity checks with JSKIT. Apply the engineering baseline's checks and
+  `.agents/skills/genesis-project/references/sanity-checks.md` with JSKIT's
+  mechanics, described at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/sanity-checks`.
+  Integration tests restore `TEST_DB_NAME` from a stored schema snapshot keyed
+  by a digest of the migration sources, as
+  `https://mobily-enterprises.github.io/jskit-ai/guide/app-setup/database-layer#integration-test-databases`
+  describes; list, batch and write paths compare their query counts at
+  realistic sizes, as
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/typed-features#query-counts-at-realistic-sizes`
+  describes.
 
 - When application integrations are requested or `integrations.json` exists,
   treat that file as the application-owned configuration used by both editor
@@ -144,9 +156,13 @@ https://mobily-enterprises.github.io/jskit-ai/
   application has been running in development mode. Add it only when the
   production environment already holds every value the application's source
   requires in production mode (for example real email, payment or storage
-  providers instead of simulated ones, and `AUTH_LOCAL_SESSION_SECRET`); the
-  next deployment then starts in production mode, and a missing value stops
-  it from starting.
+  providers instead of simulated ones, and `AUTH_LOCAL_SESSION_SECRET` unless
+  the Deployment generates it); the next deployment then starts in production
+  mode, and a missing value stops it from starting.
+- When an established Deployment lacks the proposal's
+  ``- Generated secrets: `AUTH_LOCAL_SESSION_SECRET` `` entry, add it (keeping
+  any names it already lists), so the deployment consumer supplies the
+  production session secret the application never commits.
 - Inspect existing setup and database preparation for both migration discovery
   and an app-owned idempotent seed. Never infer `db:prepare` from the selected
   component when the script or preparation file does not exist.
@@ -253,6 +269,7 @@ https://mobily-enterprises.github.io/jskit-ai/
 
 - Runtimes: `nodejs`
 - Recreate on restore: `node_modules`
+- Generated secrets: `AUTH_LOCAL_SESSION_SECRET`
 - Ready when: `GET` `/api/health` returns `200`
 - Prepare `Install dependencies`: `npm` `ci`
 - Build `Build`: `npm` `run` `build`
@@ -289,6 +306,22 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Remove pass-through wrappers and abandoned scaffold code only when doing so
   preserves routes, placements, baseline tests, and observable behavior.
 
+## UI pass
+
+- Read JSKIT's Material 3 rules at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/material-3`
+  and its UI pass method at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/ui-pass`
+  completely, then follow the method for the resolved scope: the changes, a
+  section, or the whole app.
+- Navigation and Up are must-fix at every scope (#241): plain
+  `npx jskit check`, which `npm run verify` runs, fails on every `nav/*` rule.
+- Run `npx jskit check m3` on the scope (the changed UI files, the section's
+  directory, or no paths for the whole app) until it reports nothing, and
+  `npx jskit check` until it passes.
+- The checks cannot see layout, spacing or contrast; look at every screenshot
+  for those.
+
 ## Verification
 
 - Verify `application`: `npm` `run` `verify`

package/stacks/pieces/kotlin.md

@@ -46,6 +46,13 @@ Kotlin package, public callable, coroutine, nullability, build, and test convent
   headers only from a loopback proxy, and read secrets from the environment.
   Spring Boot: set `server.address`/`server.port` from the supplied values and
   `server.forward-headers-strategy=framework`.
+- Sanity checks with Kotlin. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with the
+  project's own build, test runner and data-access tools, as their official
+  documentation describes them: count a list's queries at a few rows and at a
+  realistic number, run test classes in parallel, and read the slowest tests
+  after each run. Gradle runs one test process unless `maxParallelForks` is
+  raised. For Spring Boot, its piece adds the framework's view.
 
 ## Connected development
 

package/stacks/pieces/laravel-mysql.md

@@ -63,6 +63,10 @@ Laravel MySQL connection, migration, Eloquent, and database environment conventi
   existing migration and transaction owner. Test scoped uniqueness, duplicate
   webhooks and concurrent credit debits on this driver before claiming database
   correctness; provider calls and app authorization remain outside the database.
+- Sanity checks with Laravel and MySQL: the laravel and mysql pieces' checks
+  apply. Run `php artisan schema:dump` for the MySQL testing connection as
+  well, so test preparation loads the dumped schema instead of replaying every
+  migration.
 
 ## Adoption
 

package/stacks/pieces/laravel-postgresql.md

@@ -63,6 +63,10 @@ Laravel PostgreSQL connection, migration, Eloquent, and database environment con
   existing migration and transaction owner. Test scoped uniqueness, duplicate
   webhooks and concurrent credit debits on this driver before claiming database
   correctness; provider calls and app authorization remain outside the database.
+- Sanity checks with Laravel and PostgreSQL: the laravel and postgresql
+  pieces' checks apply. Run `php artisan schema:dump` for the PostgreSQL
+  testing connection as well, so test preparation loads the dumped schema
+  instead of replaying every migration.
 
 ## Adoption
 

package/stacks/pieces/laravel-sqlite.md

@@ -52,6 +52,10 @@ Laravel SQLite connection, migration, and database filename conventions.
   (see laravel); do not regenerate keys as routine preparation.
 - Consult the installed Laravel version's SQLite configuration documentation at
   `https://laravel.com/docs/database#sqlite-configuration`.
+- Sanity checks with Laravel and SQLite: the laravel and sqlite pieces' checks
+  apply. Run `php artisan schema:dump` for the SQLite testing connection as
+  well, so test preparation loads the dumped schema instead of replaying every
+  migration.
 
 ## Adoption
 

package/stacks/pieces/laravel.md

@@ -87,6 +87,44 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
   `COMPOSER=<derived manifest> composer update <connected packages>`. The
   tracked `composer.json` and `composer.lock` stay unchanged. Verify checks
   `InstalledVersions::getInstallPath()` against each source root.
+- Sanity checks with Laravel. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with Laravel's
+  own tools:
+  - Outside production, make Eloquent strict in `AppServiceProvider::boot()`:
+    `Model::shouldBeStrict(! app()->isProduction());`. Strict mode is off by
+    default; it makes a lazy load, a silently discarded attribute and a
+    missing attribute fail instead of passing in silence. A lazy load then
+    throws `LazyLoadingViolationException`: fix the read with `with()` or
+    `load()`.
+  - `Model::automaticallyEagerLoadRelationships()` batches lazy loads behind
+    the code's back. It hides an N+1 instead of exposing it, so it never
+    replaces counting a list's queries at a few rows and at a realistic number.
+  - `expectsDatabaseQueryCount()` asserts an exact number. Use it to compare a
+    small size with a realistic one, never as a fixed ceiling.
+  - `get()` and `all()` return every row. `paginate()` returns one page, with
+    `total` and `next_page_url` in its JSON, and never stands for every row.
+    Batches iterate with `chunkById()` or `lazyById()`.
+  - Laravel runs tests one at a time in one process. Add `brianium/paratest`
+    as a development dependency and run `php artisan test --parallel`: each
+    process gets its own `<database>_test_<token>` database, which Laravel
+    creates, so the database user needs permission to create databases, and
+    `ParallelTesting::token()` names per-process ports and directories. After a
+    run, read `php artisan test --profile` (the ten slowest tests). Keep
+    `--stop-on-failure` for diagnosis runs.
+  - Feature tests use `RefreshDatabase`, which migrates only when the schema is
+    stale and wraps each test in a transaction. Keep preparation from replaying
+    the whole history: run `php artisan schema:dump`, for the testing
+    connection too, and commit `database/schema/`. `WithCachedConfig` loads
+    configuration once per run.
+  - Tests never use `.env`'s database: `phpunit.xml` and `.env.testing` name a
+    test database for `APP_ENV=testing`.
+  - Keep `config/app.php`'s fail-closed defaults (`APP_ENV` falls back to
+    `production`, `APP_DEBUG` to `false`), and never deploy `APP_DEBUG=true`.
+  - Authorization runs only where it is called: `Gate::authorize`, the `can`
+    middleware or `$user->can`. Policy discovery only finds the policy class.
+    Test each action with a user who must be refused.
+  - The starter kits throttle sign-in. A hand-written sign-in adds a rate
+    limiter and a test that expects 429.
 
 ## Adoption
 

package/stacks/pieces/mysql.md

@@ -22,6 +22,12 @@ MySQL persistence and migration conventions.
 - Provider calls, signature verification and authorization belong to the app's
   runtime. Database configuration alone does not implement a provider, and the
   editor does not acquire ownership of application billing records.
+- Sanity checks with MySQL. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` at the server:
+  read `EXPLAIN` and the statement size of access-policy SQL, keep
+  `information_schema` reads off request paths and time schema helpers on a
+  server holding many databases, and have each test run drop the databases it
+  created.
 
 ## Adoption
 

package/stacks/pieces/nextjs.md

@@ -114,6 +114,11 @@ framework documentation: https://nextjs.org/docs
   generates and discards the native project, so never commit `android/`,
   `capacitor.config.*` or signing keys. A server-rendered app is not yet
   supported as a phone app: it needs a separate static client first.
+- Sanity checks with Next.js. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with the
+  `nodejs` piece's test tools, and read each route's first-load bytes and
+  request count in a production build as the "Screens in use" section
+  describes.
 
 ## Adoption
 

package/stacks/pieces/nodejs.md

@@ -56,6 +56,23 @@ Node.js package, command, module, dependency, and test conventions.
   or the environment rather than hard-coding them, and fail if the port is
   taken instead of silently choosing another. For Express or Next.js select
   `express` or `nextjs`; that piece owns the framework traps.
+- Sanity checks with Node.js. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with Node's and
+  Playwright's own tools:
+  - `node --test` runs test files in parallel: `--test-concurrency` defaults to
+    `os.availableParallelism() - 1`, and a shared machine passes its budget as
+    `--test-concurrency=<n>`. Never force `--test-concurrency=1` to hide a
+    collision between files; fix their isolation. A file that truly cannot run
+    beside others runs in its own command, which states why.
+  - The default `--test-timeout` is `Infinity`, so a hung file never fails: set
+    one. `--test-force-exit` hides what keeps a file alive; find and release it
+    instead.
+  - Playwright runs test files in parallel on half the logical cores, and a
+    file's tests in order unless `fullyParallel` is set. Never set `workers: 1`
+    to hide a collision. Its default test timeout is 30 seconds, and
+    `maxFailures` defaults to 0, no cap: set a low cap only on a diagnosis run.
+  - Count a list's queries at a few rows and at a realistic number through the
+    database client's query event or log.
 
 ## Adoption
 

package/stacks/pieces/php.md

@@ -45,6 +45,11 @@ PHP package, namespace, callable, dependency, and test conventions.
 - Running a web process: bind the supplied listen host and port, trust forwarded
   headers only from a loopback proxy, and read secrets from the environment. The
   built-in server is `php -S <host>:<port> -t public` for development only.
+- Sanity checks with PHP. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with PHP's own
+  tools: PHPUnit runs tests in one process, and `brianium/paratest` runs them in
+  parallel. Keep `--stop-on-failure` for diagnosis runs. For Laravel, its piece
+  names the framework's switches.
 
 ## Connected development
 

package/stacks/pieces/postgresql.md

@@ -22,6 +22,14 @@ PostgreSQL persistence and migration conventions.
 - Provider calls, signature verification and authorization belong to the app's
   runtime. Database configuration alone does not implement a provider, and the
   editor does not acquire ownership of application billing records.
+- Sanity checks with PostgreSQL. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` at the server:
+  read `EXPLAIN` and the statement size of access-policy SQL, keep
+  schema-metadata reads (`information_schema`, `pg_catalog`) off request
+  paths, and have each test run drop the databases it created. A database per
+  test worker can be copied from one prepared database with
+  `CREATE DATABASE <name> TEMPLATE <prepared>`, which needs no other session
+  connected to the template.
 
 ## Adoption
 

package/stacks/pieces/python.md

@@ -62,6 +62,12 @@ Python package, module, callable, dependency, and test conventions.
   For Django select `django`; its piece owns the framework traps. Flask uses
   Werkzeug's `ProxyFix`; Uvicorn uses `--proxy-headers --forwarded-allow-ips
   127.0.0.1`.
+- Sanity checks with Python. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with Python's
+  own tools: pytest runs tests one at a time, and the `pytest-xdist` plugin's
+  `-n auto` runs one worker per CPU, so give each worker its own database and
+  temporary directory. `--durations=10` lists the slowest tests. For Django,
+  its piece names the test runner's flags.
 
 ## Connected development
 

package/stacks/pieces/rails-mysql.md

@@ -72,6 +72,7 @@ Rails MySQL connection, Active Record migration, and database environment conven
   integration and payment records in this database through Active Record
   migrations and transactions; test uniqueness and concurrent updates on MySQL
   itself.
+- Sanity checks with Rails and MySQL: the rails and mysql pieces' checks apply.
 
 ## Adoption
 

package/stacks/pieces/rails-postgresql.md

@@ -77,6 +77,8 @@ Rails PostgreSQL connection, Active Record migration, and database environment c
   integration and payment records in this database through Active Record
   migrations and transactions; test uniqueness and concurrent updates on
   PostgreSQL itself.
+- Sanity checks with Rails and PostgreSQL: the rails and postgresql pieces'
+  checks apply.
 
 ## Adoption
 

package/stacks/pieces/rails-sqlite.md

@@ -51,6 +51,8 @@ Rails SQLite connection, Active Record migration, and database filename conventi
 - The `sqlite3` gem normally installs a precompiled native gem; a source build
   needs the SQLite headers. Use the inherited Rails migration and seed
   guidance and test concurrent writes on SQLite itself.
+- Sanity checks with Rails and SQLite: the rails and sqlite pieces' checks
+  apply.
 
 ## Adoption
 

package/stacks/pieces/rails.md

@@ -120,6 +120,29 @@ Authoritative framework documentation: https://guides.rubyonrails.org/
   `jsbundling-rails`, `cssbundling-rails` or another `package.json` build, add
   `nodejs` to its Runtimes and a Prepare `npm ci` step before
   `assets:precompile`.
+- Sanity checks with Rails. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with Rails's
+  own tools:
+  - In `config/environments/development.rb` and `test.rb`, set
+    `config.active_record.strict_loading_by_default = true` (it defaults to
+    `false`), or `config.active_record.strict_loading_mode = :n_plus_one_only`
+    for N+1 loads only. A violation raises by default. The Bullet gem is an
+    opt-in alternative.
+  - `assert_queries_count` asserts an exact count. Use it to compare a few rows
+    with a realistic number, never as a fixed ceiling.
+  - `Model.all` has no `LIMIT`; batches iterate with `find_each`, 1,000 rows at
+    a time.
+  - Keep the generated `parallelize(workers: :number_of_processors)` in
+    `test/test_helper.rb`. Rails parallelizes from 50 tests up and creates a
+    database for each worker, so the database user needs permission to create
+    databases; never drop to one worker to hide a collision.
+  - Keep `db/schema.rb` (or `structure.sql`) committed: tests load it instead of
+    migrating (`maintain_test_schema` defaults to `true`), and each test runs
+    in a transaction.
+  - Never edit a migration that has run anywhere; add a new one.
+  - Keep the authentication generator's `rate_limit to: 10, within: 3.minutes`
+    on sign-in and test the refusal. Default security headers are on; the
+    Content Security Policy initializer is the app's to configure.
 
 ## Adoption
 

package/stacks/pieces/ruby.md

@@ -46,6 +46,12 @@ Ruby module, class, callable, dependency, lifecycle, and test conventions.
 - Running a web process: bind the supplied listen host and port, trust forwarded
   headers only from a loopback proxy, and read secrets from the environment.
   For Rails select `rails`; its piece owns the framework traps.
+- Sanity checks with Ruby. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with the
+  project's own test runner, as its official documentation describes it: run
+  test files in parallel with a database and temporary directory each, and
+  read the slowest tests after each run. For Rails, its piece names the
+  framework's switches.
 
 ## Connected development
 

package/stacks/pieces/rust.md

@@ -46,6 +46,12 @@ Rust module, public item, ownership, error, async, Cargo, and test conventions.
   headers only from a loopback proxy, and read secrets from the environment.
   Take the listen address from an argument or environment variable rather than
   hard-coding it.
+- Sanity checks with Rust. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with Cargo's
+  test runner and the project's data-access tools, as their official
+  documentation describes them: tests run beside each other, so each gets its
+  own temporary directory and a system-picked port, and a list's queries are
+  counted at a few rows and at a realistic number.
 
 ## Connected development
 

package/stacks/pieces/shell.md

@@ -33,6 +33,11 @@ Shell script function, process, environment, portability, and test conventions.
   explicit `custom` type with a project-defined script. When a project selects
   several languages, its own complete `## Connected development` section
   chooses the one default.
+- Sanity checks with shell. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` to test and
+  preparation scripts: a script reports failure through its exit status, a
+  preparation step that fails stops the run instead of letting the tests run
+  on, and each script's own time and output size are read after a run.
 
 ## Deslop
 

package/stacks/pieces/spring-boot-mysql.md

@@ -65,6 +65,8 @@ environment conventions.
   `spring.datasource.url` to the same JDBC URL with `${TEST_DB_NAME}` in place
   of `${DB_NAME}`. Flyway migrates that existing database; the database user
   may lack permission to create databases. Never point tests at `DB_NAME`.
+- Sanity checks with Spring Boot and MySQL: the spring-boot and mysql pieces'
+  checks apply.
 
 ## Adoption
 

package/stacks/pieces/spring-boot-postgresql.md

@@ -60,6 +60,8 @@ environment conventions.
   `spring.datasource.url` to the same JDBC URL with `${TEST_DB_NAME}` in place
   of `${DB_NAME}`. Flyway migrates that existing database; the database role
   may lack permission to create databases. Never point tests at `DB_NAME`.
+- Sanity checks with Spring Boot and PostgreSQL: the spring-boot and
+  postgresql pieces' checks apply.
 
 ## Adoption
 

package/stacks/pieces/spring-boot.md

@@ -97,6 +97,12 @@ https://docs.spring.io/spring-boot/
   `./gradlew` `bootRun` `--args=--server.address={host} --server.port={port}`,
   `./gradlew` `test`, and `./gradlew` `bootJar` with
   `bootJar { archiveFileName = 'app.jar' }` serving `build/libs/app.jar`.
+- Sanity checks with Spring Boot. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with Spring's
+  and the persistence layer's own tools, as their official documentation
+  describes them: count a list's statements at a few rows and at a realistic
+  number, run test classes in parallel with a database each, and prepare test
+  databases without replaying every migration per test class.
 
 ## Adoption
 

package/stacks/pieces/sqlite.md

@@ -39,6 +39,10 @@ SQLite file-backed persistence, migrations, and backup conventions.
   removing the original. See `https://www.sqlite.org/backup.html`.
 - Keep test databases separate from development and production. In-memory
   databases are useful for tests but are not persistent application resources.
+- Sanity checks with SQLite. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with one
+  database file per test worker, prepared once per run rather than migrated
+  per file.
 
 ## Adoption
 

package/stacks/pieces/vue.md

@@ -35,6 +35,16 @@ conventions. Authoritative framework documentation: https://vuejs.org/
   HMR client connects through the page's own origin. Do not set
   `allowedHosts: true` or hard-code `server.hmr.host`, `clientPort` or `origin`
   unless that proxy requires it.
+- Sanity checks with Vue. Apply the checks in
+  `.agents/skills/genesis-project/references/sanity-checks.md` with Vue's and
+  Vite's own tools:
+  - Vitest runs test files in parallel (`fileParallelism` defaults to `true`).
+    Never set `fileParallelism: false` to hide a collision between files.
+  - Change a screen's props, slots, route and loaded data and see what it
+    shows follow. In development, Vue warns about recursive updates; a
+    production build has no such check, so repeat the changes there and look
+    for a frozen tab or blank region. Count the DOM nodes a long list renders
+    with realistic data.
 
 ### Reactive state hydration
 
@@ -44,6 +54,20 @@ conventions. Authoritative framework documentation: https://vuejs.org/
 - Persist user-selected filters and screen context in the URL when they must survive navigation.
 - Test stateful screens by navigating away and back with a warm query cache, including browser back/forward navigation.
 
+## UI pass
+
+- In a JSKIT application the `jskit` component's UI pass guidance governs.
+- For a Vue application on Vuetify, follow JSKIT's Material 3 rules at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/material-3`
+  and the scopes of its UI pass method at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/ui-pass`, as far
+  as they apply outside JSKIT: the Material 3 foundation, exact sizes, colour,
+  lists, records and forms, adaptive layout, and one Up arrow without
+  history-based back links. JSKIT's shell, navigation and `jskit check` apply
+  only to JSKIT applications.
+- With another component library, keep that library and the project's design
+  system, and apply the same scopes and evidence.
+
 ## Adoption
 
 - Identify the real client entrypoint, router, build tool, development command,