prizmkit 1.1.154 → 1.1.156

package/bundled/skills/app-planner/references/rules/database/template.md

@@ -1,158 +1,136 @@
 # Database Rules — {{ project_name }}
 
-> This document was generated by the `database-rules` skill on {{ generated_at }}
-> Audience: All project developers + DBAs + all AI coding assistants
->
-> **Usage**:
-> 1. All AI coding assistants must read this file before generating or modifying any database-related code
-> 2. This document takes precedence over "general best practices" in AI training data
-> 3. Operations conflicting with this document must not be executed
-
----
-
-## 0. TL;DR — Key Decisions at a Glance
-
-| Dimension | Decision |
-|-----------|----------|
-| Primary Database | {{ database }} |
-| Cache Layer | {{ cache }} |
-| Primary Key Strategy | {{ pk_strategy }} |
-| Soft Delete | {{ soft_delete }} |
-| Normalization Level | {{ normalization }} |
-| Migration Tool | {{ migration_tool }} |
-| Workload Type | {{ workload_type }} |
-| Data Scale | {{ data_scale }} |
-| Data Sensitivity | {{ data_sensitivity }} |
-| Audit Requirements | {{ audit }} |
-| Deployment Method | {{ deployment }} |
-| Backup Strategy | {{ backup }} |
-| High Availability | {{ ha }} |
-| AI DDL Permission | {{ ai_ddl_permission }} |
-| AI Safety Constraints | {{ ai_safety_constraint }} |
-
----
-
-## 1. Schema Design
+> Generated by app-planner Rules Configuration
+> Audience: project contributors, data operators, and AI coding assistants working on persistence
+
+This document applies invariant safety principles through the selected datastore and operational decisions. SQL and relational rules are not active for document or embedded stores unless explicitly selected.
+
+## 1. Decision Ledger
+
+| Domain | Selected Decision |
+|---|---|
+| Primary datastore | {{ database }} |
+| Cache | {{ cache }} |
+| Identifier strategy | {{ pk_strategy }} |
+| Soft deletion | {{ soft_delete }} |
+| Modeling/normalization | {{ normalization }} |
+| Migration mechanism | {{ migration_tool }} |
+| Workload | {{ workload_type }} |
+| Estimated scale | {{ data_scale }} |
+| Data sensitivity | {{ data_sensitivity }} |
+| Audit/CDC | {{ audit }} |
+| Deployment | {{ deployment }} |
+| Backup | {{ backup }} |
+| Availability | {{ ha }} |
+| AI structure-change permission | {{ ai_ddl_permission }} |
+| AI destructive-operation policy | {{ ai_safety_constraint }} |
+
+Deferred and not-applicable decisions remain explicit.
+
+## 2. Data Model and Types
+
+### 2.1 Model invariants
 
 {{ FIXED_RULES_SCHEMA }}
 
-{{ schema_rules }}
+### 2.2 Selected identifier and modeling rules
 
----
+{{ schema_rules }}
 
-## 2. Column Types
+### 2.3 Type invariants and datastore-specific rules
 
 {{ FIXED_RULES_TYPES }}
 
 {{ tech_rules }}
 
----
+## 3. Access, Atomicity, and Performance
 
-## 3. Index Strategy
+### 3.1 Access paths
 
 {{ FIXED_RULES_INDEX }}
 
----
-
-## 3b. Transaction Isolation
+### 3.2 Atomicity and concurrency
 
 {{ FIXED_RULES_TRANSACTION }}
 
----
+### 3.3 Workload and scale
 
-## 4. Migration Management
+{{ FIXED_RULES_PERFORMANCE }}
+
+{{ performance_rules }}
+
+### 3.4 Client and connection lifecycle
+
+{{ FIXED_RULES_CONNECTION }}
+
+## 4. Change Management
 
 {{ FIXED_RULES_MIGRATION }}
 
 {{ migration_rules }}
 
----
+Migration, rollback, and compatibility behavior follows the selected datastore and tool; no SQL-only rollback format is implied for other technologies.
 
-## 5. Query Standards
+## 5. Query and Mutation Safety
 
 {{ FIXED_RULES_QUERY }}
 
-> **Note**: For data access method rules (ORM/Query Builder/Raw SQL organization), refer to `backend-rules.md` §5 (Database). This document covers SQL-level query standards only.
+Data-access organization may also be described in `backend-rules.md`. Shared datastore and ORM decisions must agree before either file is written.
 
----
-
-## 6. Security & Permissions
+## 6. Security and Sensitivity
 
 {{ FIXED_RULES_SECURITY }}
 
 {{ security_rules }}
 
----
-
-## 7. Backup & Recovery
+## 7. Audit and Change Streams
 
-{{ FIXED_RULES_BACKUP }}
-
-{{ ops_rules }}
+{{ audit_rules }}
 
----
+When audit and CDC are not selected, this section states that they are not applicable rather than inheriting enterprise defaults.
 
-## 8. Performance
+## 8. Backup, Availability, and Operations
 
-{{ FIXED_RULES_PERFORMANCE }}
+{{ FIXED_RULES_BACKUP }}
 
-{{ performance_rules }}
+{{ ops_rules }}
 
----
+The selected backup and availability decisions own this domain. Development-only choices must be labeled and must not silently become production guidance.
 
-## 8b. Connection Pooling
+## 9. Cache
 
-{{ FIXED_RULES_CONNECTION }}
+{{ cache_rules }}
 
----
+When no cache is selected, render an explicit no-cache decision and omit cache-specific operational requirements.
 
-## 9. AI Vibecoding Behavior Constraints
+## 10. AI Data-Change Permissions
 
-### 9.1 Baseline Constraints (project-agnostic, always active)
+### 10.1 Invariant safety
 
 {{ FIXED_RULES_AI_BASE }}
 
-### 9.2 Project-Specific Hard Constraints
-
-- **Database structure change permission**: {{ ai_ddl_rule }}
-- **Safety operation constraints**: {{ ai_safety_rule }}
-
-### 9.3 Mandatory Pre-Actions (before generating any SQL/Migration)
-
-AI must complete the following in order before performing any database-related operation:
+### 10.2 Selected permissions
 
-1. Read this file (`database-rules.md`)
-2. Read existing schema or migration files to confirm table structure
-3. Confirm the target database type and version
-4. If involving indexes/DDL, first assess EXPLAIN and estimated execution time
+- Structure-change permission: {{ ai_ddl_rule }}
+- Destructive-operation policy: {{ ai_safety_rule }}
 
----
+If these selected policies conflict, generation fails until the user chooses a coherent combination.
 
-## 10. Audit & Compliance
-
-{{ audit_rules }}
-
----
-
-## 11. Caching
-
-{{ cache_rules }}
-
----
-
-## Appendix A: Deny List (Quick Reference)
-
-> This appendix is auto-generated by AI in Phase 4 by extracting all forbidden entries from each section.
+## Appendix A: Active Deny List
 
 {{ deny_list_summary }}
 
-## Appendix B: Recommended Tools
+Include only prohibitions from active invariant and selected blocks.
 
-> This appendix is auto-generated by AI in Phase 4 to recommend supporting tools based on database selection.
+## Appendix B: Compatible Recommendations
 
 {{ recommended_libs }}
 
----
+Recommendations must match the selected datastore, deployment, and AI permission decisions.
+
+## Source Contract
 
-**Version**: v1.0 — Generated on {{ generated_at }}
-**Next review recommended**: before database upgrades or architecture changes
+- Owner: app-planner Rules Configuration
+- Resource family: `references/rules/database/`
+- Regenerate after a decision or source-contract change.
+- Generation metadata value: {{ generated_at }}

package/bundled/skills/app-planner/references/rules/frontend/derivation-rules.md

@@ -15,6 +15,11 @@
 
 ---
 
+## SEMANTIC_FALLBACK_POLICY
+
+Every confirmed option is valid input even when this file has no pre-authored block for it. For an unmatched option, render a concise rule that names the selected technology or practice, follows its current official and detected project conventions, preserves brownfield behavior unless migration was selected, and imports no rules from a recommended alternative. For `none`, `not required`, deferred, or conditionally skipped decisions, render an explicit not-applicable or deferred statement. Never leave a rule placeholder blank.
+
+Before output, compare all active blocks with the decision ledger. A selected decision owns its policy domain; incompatible blocks fail generation instead of being merged.
 
 ## Phase 2 Normalized Semantic Fill Table
 
@@ -218,7 +223,7 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 **Trigger**: Q2 = Next.js | **Inject into**: `{{ tech_stack_rules }}`
 
 - Images must use `next/image`. Forbid `<img>` (unless SVG inline).
-- Fonts must use `next/font`. Forbid external CDN font links.
+- Apply the selected Q4b font strategy consistently. When `next/font` is compatible with that strategy, prefer it for framework integration; do not override a confirmed self-hosted, CDN, system-font, or deferred decision.
 - Links must use `next/link`. Forbid using `<a>` for internal navigation.
 
 ### D-NUXT-01
@@ -238,9 +243,9 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 ### D-PNPM-01
 **Trigger**: Q3 = pnpm | **Inject into**: `{{ tech_stack_rules }}`
 
-- Package manager locked to pnpm. Commit `pnpm-lock.yaml` to the repository root. Forbid committing `package-lock.json` / `yarn.lock`.
-- `package.json` declares `"packageManager": "pnpm@x.y.z"`. CI validates.
-- Monorepo uses `pnpm workspace`. Forbid global dependencies.
+- Use pnpm as selected and preserve one authoritative `pnpm-lock.yaml` according to repository policy.
+- Record the resolved pnpm version in package metadata/tooling when the project uses that mechanism; never emit an `x.y.z` placeholder.
+- Use pnpm workspaces only when the repository is a selected/detected monorepo; do not invent a workspace from the package-manager choice.
 
 ### D-TAILWIND-01
 **Trigger**: Q4 = Tailwind | **Inject into**: `{{ style_specific_rules }}`
@@ -433,9 +438,8 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 ### D-DARK-NONE-01
 **Trigger**: Q10 = No dark mode | **Inject into**: `{{ dark_mode_rules }}`
 
-- Dark mode not supported at the current stage.
-- But Semantic Tokens must be defined using CSS variables to reserve expansion space for future switching.
-- Forbid hardcoding colors in components. All colors must go through Semantic Tokens.
+- Dark mode is not supported in the current scope; do not emit theme-switching controls, alternate-value requirements, or expansion infrastructure.
+- Continue to follow the separately selected token-layering and styling decisions.
 
 ### D-RESP-MF-01
 **Trigger**: Q11 = Mobile-first | **Inject into**: `{{ breakpoint_rules }}`
@@ -476,19 +480,15 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 ### D-I18N-01
 **Trigger**: Q13 = Multi-language | **Inject into**: `{{ i18n_rules }}`
 
-- i18n solution: React projects use `react-i18next` or `next-intl`. Vue projects use `vue-i18n`.
-- **Forbid hardcoding any user-visible text in JSX/templates**. Must use i18n keys.
-- Key naming convention: `<page>.<section>.<element>` three-segment format.
-  - Example: `login.form.submitButton`, `order.detail.priceLabel`.
-- Translation files split by language: `locales/zh-CN.json`, `locales/en-US.json`.
-- Plurals, dates, and currency use ICU MessageFormat. Forbid string concatenation.
-- Missing keys must cause CI errors. Translation files sorted by key for easy diffing.
+- Use the confirmed existing or dependency-authorized i18n framework compatible with Q1/Q2; do not add a React/Vue library to another stack.
+- Centralize user-visible text under one documented key and locale-file convention and include the explicitly selected locales.
+- Use locale-aware plural, date, number, and currency formatting and define missing-key behavior appropriate to build/runtime risk.
 
 ### D-I18N-NONE-01
 **Trigger**: Q13 = Single-language, centralized | **Inject into**: `{{ i18n_rules }}`
 
-- The current project does not need multi-language support, but user-visible text must still be **centrally managed** in `src/i18n/<lang>.ts`.
-- Forbid hardcoding text in JSX/templates to prepare for future i18n adoption.
+- Keep the selected single language centralized through the project's confirmed text catalog boundary.
+- Record the actual stable catalog path; do not invent `src/i18n/<lang>.ts` or install a full runtime framework unless separately authorized.
 
 ### D-I18N-HARDCODE-01
 **Trigger**: Q13 = Single-language, hardcoding | **Inject into**: `{{ i18n_rules }}`
@@ -507,30 +507,21 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 
 ### D-TEST-01 (Dynamically Assembled)
 **Trigger**: Q15 + Q16 + Q17 combination | **Inject into**: `{{ test_rules }}`
-**Generation rule**: Dynamically assemble based on user selection. Omit the corresponding framework line when not asked (Q16 is only asked for Q15=A/B; Q17 is only asked for Q15=A/C).
+**Generation rule**: Dynamically assemble based on user selection. When Q15 selects `Not required yet`, render only an explicit deferred-testing statement and inject no framework or coverage requirements. Otherwise omit the corresponding framework line when not asked (Q16 is only asked for Q15=A/B; Q17 is only asked for Q15=A/C).
 
 - Testing strategy: {{ Q15 description }}
-- Unit test framework: {{ Q16 choice }} (only if Q15=A or B; if Vitest: supplement with "use `vitest` + `@testing-library/{{ framework }}` + `@testing-library/jest-dom`")
-- E2E framework: {{ Q17 choice }} (only if Q15=A or C; if Playwright: supplement with "E2E cases in `e2e/` directory, named `*.spec.ts`, run headless in CI, `--ui` for local debugging")
-- Coverage targets: shared components ≥ 80%, business components ≥ 50%, utility functions ≥ 90%.
-- Unit test principles:
-  - Test behavior, not implementation.
-  - Prefer `getByRole` / `getByLabelText`, then `getByText`. Avoid `getByTestId` (unless no semantics available).
-  - Async assertions use `findBy*` or `waitFor`. Forbid `setTimeout`.
-- E2E principles (if enabled):
-  - Cases cover critical business paths (login, checkout, payment, etc.).
-  - Data isolation. Each case has independent setup/teardown.
-  - Screenshot comparison only for core visual components.
+- Unit test framework: {{ Q16 choice }} (only if Q15=A or B; use its compatible project-native component/DOM testing boundary without silently adding dependencies)
+- E2E framework: {{ Q17 choice }} (only if Q15=A or C; execute headlessly in CI through the repository's selected layout/configuration)
+- Do not invent numeric coverage thresholds. Add them only when explicitly confirmed outside the tier choice.
+- Unit tests assert behavior and accessible semantics, isolate unstable dependencies, and use deterministic async assertions.
+- E2E tests cover product-defined critical flows rather than generic login/checkout/payment examples, with isolated data and deterministic setup/teardown.
 
 ### D-AI-DEP-STRICT-01
 **Trigger**: Q19 = No, forbid self-initiated | **Inject into**: `{{ ai_dependency_rule }}`
 
-- AI **must not modify** `dependencies` / `devDependencies` in `package.json` on its own.
-- If a new dependency is truly needed, AI must:
-  1. List in the PR description: package name, version, purpose, alternative comparison.
-  2. Await human review approval.
-  3. After approval, human executes `pnpm add`.
-- Exception: lockfile updates (`pnpm-lock.yaml`) may be modified by AI.
+- AI must not modify dependency declarations or lockfiles without the explicit review/approval required by this selected option.
+- A proposal states package, version/range, purpose, alternatives, security/license, and size/runtime impact.
+- After approval, use the Q3-selected package manager; never hardcode `pnpm` or exempt one lockfile.
 
 ### D-AI-DEP-ANNOUNCE-01
 **Trigger**: Q19 = Yes, with declaration | **Inject into**: `{{ ai_dependency_rule }}`
@@ -554,10 +545,7 @@ Appendix placeholders are auto-generated by AI in Phase 4:
   1. Full-text search for callers in the repository (grep / IDE reference finder).
   2. List **all affected files** in the change description.
   3. Assess whether existing usage is broken (API signature, behavior).
-- If it is a breaking change, must:
-  - Provide a codemod or migration guide.
-  - Prefix the PR title with `[BREAKING]`.
-  - Bump the major version number.
+- If it is a breaking change, provide the repository's selected consumer migration or compatibility plan and follow its existing version/release conventions.
 
 ### D-AI-BREAK-LOOSE-01
 **Trigger**: Q20 = No | **Inject into**: `{{ ai_breaking_change_rule }}`
@@ -567,18 +555,16 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 ### D-AI-INDEX-STRICT-01
 **Trigger**: Q18 = Enforce index sync | **Inject into**: `{{ ai_index_rule }}`
 
-- After adding any new shared component, it must be added to `src/components/index.ts` in the same commit.
-- Index file maintained in alphabetical order. New entries must include a JSDoc comment (one-line description of the component's purpose).
-- When deleting a component, it must be removed from the index synchronously, and all callers must be searched.
-- Before creating a new component, AI **must** first read `components/index.ts` to confirm there is no reusable component already.
-- CI should have a script to validate: all `*.tsx` files under `components/` must appear in `index.ts` exports (orphan files treated as build failure).
+- Record the detected/confirmed authoritative component export-registry path as part of this selected decision.
+- Synchronize additions, removals, and renames with that registry and follow its existing ordering/comment conventions.
+- Search the registry and component ownership area before creating a duplicate.
+- Add registry validation only when existing tooling supports it or the dependency/config permission authorizes the change.
 
 ### D-AI-INDEX-LOOSE-01
 **Trigger**: Q18 = Not required | **Inject into**: `{{ ai_index_rule }}`
 
-- New components may temporarily not be written to `components/index.ts`, but it is recommended to list new component additions in the PR description.
-- Before creating a new component, AI should still **search the `src/components/` directory** to avoid duplicating work.
-- The team should periodically (recommended: each milestone) organize `components/index.ts` and archive stable components.
+- No central component registry is required. Update direct exports and affected consumers through the repository's existing structure.
+- Search the relevant component ownership areas before creating a duplicate; do not invent or periodically maintain an unselected index file.
 
 ### D-AI-LINES-01
 **Trigger**: Q22 = N | **Inject into**: `{{ ai_max_lines }}`
@@ -587,39 +573,29 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 ### D-PERF-25-01
 **Trigger**: Q23 = LCP < 2.5s | **Inject into**: `{{ performance_rules }}`
 
-- First screen LCP (Largest Contentful Paint) target < 2.5s (real 4G / mid-range device).
-- INP (Interaction to Next Paint) target < 200ms.
-- CLS (Cumulative Layout Shift) target < 0.1.
-- Critical path optimization:
-  - Critical CSS inlined. Non-critical CSS loaded asynchronously.
-  - First screen images `loading="eager"`. Others `loading="lazy"`.
-  - Fonts use `font-display: swap`. Preload critical fonts (`<link rel="preload">`).
-- CI integrates Lighthouse validation. PRs blocked if performance regresses by > 10%.
+- Measure first-screen LCP against the selected <2.5s target under a documented device/network/cache scenario.
+- Diagnose render, asset, font, server, and JavaScript contributors before selecting a compatible optimization.
+- Add CI measurement or regression thresholds only when the environment is stable and configuration/dependency permission allows it; do not inject unselected INP/CLS targets.
 
 ### D-PERF-15-01
 **Trigger**: Q23 = LCP < 1.5s | **Inject into**: `{{ performance_rules }}`
 
-- Extreme performance requirements. On top of D-PERF-25-01, additionally:
-  - LCP < 1.5s.
-  - First screen JS bundle < 100KB gzipped.
-  - Must use SSR / SSG pre-rendering.
-  - Images must use AVIF/WebP and have LQIP placeholders.
-  - CDN enables HTTP/3, Brotli compression.
+- Measure first-screen LCP against the selected <1.5s target under a documented scenario.
+- Select optimizations compatible with Q2, deployment, image/browser support, and Q4b. Do not force SSR/SSG, a CDN protocol, image format, or an extra bundle target from the LCP choice alone.
+- If the selected architecture cannot meet the target with acceptable evidence, fail the conflict/feasibility gate and return to clarification.
 
 ### D-CHUNK-300-01
 **Trigger**: Q24 = chunk < 300KB | **Inject into**: `{{ performance_rules }}`
 
-- Single chunk gzipped size < 300KB. Beyond this, must code-split (`React.lazy` / dynamic `import()`).
-- Route-level lazy loading is the default requirement.
-- CI integrates `rollup-plugin-visualizer` / `vite-bundle-visualizer` for bundle size analysis.
-- Large dependencies (chart libraries, rich text editors, map SDKs) must be loaded on demand.
+- Enforce the selected single-chunk target: <300KB uncompressed and <100KB compressed under the recorded measurement tool.
+- Split only boundaries that exceed or materially threaten the target, using the selected framework's compatible lazy-loading mechanism.
+- Reuse existing bundle analysis tooling or request authorization before adding/configuring a visualizer dependency.
 
 ### D-CHUNK-500-01
 **Trigger**: Q24 = chunk < 500KB | **Inject into**: `{{ performance_rules }}`
 
-- Single chunk gzipped size < 500KB.
-- Route-level lazy loading recommended.
-- CI integrates bundle size analysis.
+- Enforce the selected single-chunk target of <500KB using a recorded compressed/uncompressed interpretation.
+- Introduce compatible lazy-loading boundaries where evidence requires them and add CI analysis only under selected config/dependency permissions.
 
 ### D-BEM-01
 **Trigger**: Q4 = Plain CSS + BEM | **Inject into**: `{{ style_specific_rules }}`
@@ -653,10 +629,9 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 ### D-CUSTOM-FETCH-01
 **Trigger**: Q6 = Custom fetch hook wrapper | **Inject into**: `{{ server_state_rules }}`
 
-- Custom fetch hooks must be in `src/hooks/api/`.
-- Each hook must return `{ data, error, loading, refetch }`.
-- Forbid fetch calls directly in components.
-- Request cancellation via AbortController on unmount.
+- Put custom data access behind one documented project boundary rather than inventing a universal `src/hooks/api/` path.
+- Define its data, pending, error, refresh/revalidation, and cancellation contract from consumer needs.
+- Keep raw transport calls out of presentation code except at an explicitly selected framework data boundary.
 
 ### D-TYPES-MANUAL-01
 **Trigger**: Q7 = Hand-written .d.ts | **Inject into**: `{{ server_state_rules }}`
@@ -668,9 +643,8 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 ### D-TYPES-MONOREPO-01
 **Trigger**: Q7 = Shared monorepo type package | **Inject into**: `{{ server_state_rules }}`
 
-- Types imported from shared monorepo package `@project/shared-types`.
-- Forbid local re-declaration of shared types.
-- Type package version bumps must be coordinated.
+- Import contracts from the confirmed stable shared-package path; do not invent `@project/shared-types`.
+- Avoid divergent local redeclarations and coordinate compatibility/version changes with backend consumers.
 
 ### D-RESP-DESKTOP-ONLY-01
 **Trigger**: Q11 = Desktop only | **Inject into**: `{{ breakpoint_rules }}`
@@ -708,27 +682,26 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 ### D-SPA-01
 **Trigger**: Q2 = Plain SPA (Vite) | **Inject into**: `{{ tech_stack_rules }}`
 
-- Plain SPA with Vite. No SSR/SSG.
-- Routing via react-router-dom or equivalent.
-- All rendering client-side.
+- Use the selected plain Vite SPA boundary with client-side rendering.
+- Add a routing library only when navigation requirements and dependency permission authorize it; otherwise use the existing project router/boundary.
 
 ### D-NPM-01
 **Trigger**: Q3 = npm | **Inject into**: `{{ tech_stack_rules }}`
 
-- Package manager locked to npm. Commit `package-lock.json` to the repository root. Forbid committing `yarn.lock` / `pnpm-lock.yaml`.
-- `package.json` declares `"packageManager": "npm@x.y.z"`. CI validates.
+- Use npm as selected and preserve one authoritative npm lockfile according to repository policy.
+- Record the resolved npm version in package metadata/tooling when the project uses that mechanism; never emit an `x.y.z` placeholder.
 
 ### D-YARN-01
 **Trigger**: Q3 = yarn | **Inject into**: `{{ tech_stack_rules }}`
 
-- Package manager locked to yarn. Commit `yarn.lock` to the repository root. Forbid committing `package-lock.json` / `pnpm-lock.yaml`.
-- `package.json` declares `"packageManager": "yarn@x.y.z"`. CI validates.
+- Use Yarn as selected and preserve one authoritative Yarn lockfile according to repository policy.
+- Record the resolved Yarn version in package metadata/tooling when the project uses that mechanism; never emit an unresolved version placeholder.
 
 ### D-BUN-01
 **Trigger**: Q3 = bun | **Inject into**: `{{ tech_stack_rules }}`
 
-- Package manager locked to bun. Commit `bun.lockb` to the repository root. Forbid committing `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml`.
-- `package.json` declares `"packageManager": "bun@x.y.z"`. CI validates.
+- Use Bun as selected and preserve its authoritative lockfile format for the resolved Bun version according to repository policy.
+- Record the resolved version when the project uses package-manager metadata; never emit an unresolved version placeholder.
 
 ### D-A11Y-AA-01
 **Trigger**: Q14 = WCAG 2.1 AA | **Inject into**: `{{ a11y_extra_rules }}`
@@ -760,7 +733,7 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 
 ## Template Placeholder Coverage Self-Check Table (Mandatory Check Before Phase 4 Rendering)
 
-> This table lists **all** placeholders from [frontend-rules.template.md](../templates/frontend-rules.template.md) with their fill sources. The AI must check each item before Phase 4 rendering: every placeholder must hit at least one source. Otherwise, it's treated as an alignment failure.
+> This table documents placeholder fill sources for `template.md`. The deterministic `scripts/validate-rules-configuration.py` check is authoritative for placeholder-set alignment; every placeholder must still resolve to active invariant, selected, fallback, not-applicable, auto-generated, or metadata content before rendering.
 
 | Placeholder | Fill Source | Source Type |
 |-------------|------------|-------------|
@@ -803,17 +776,17 @@ Appendix placeholders are auto-generated by AI in Phase 4:
 | `{{ ai_breaking_change_rule }}` | D-AI-BREAK-{STRICT/LOOSE}-01 | Derivation |
 | `{{ ai_config_rule }}` | D-AI-CONFIG-FRONTEND-{STRICT/LOOSE}-01 | Derivation |
 | `{{ ai_index_rule }}` | D-AI-INDEX-{STRICT/LOOSE}-01 | Derivation |
-| `{{ FIXED_RULES_COMPONENT_CONTRACT }}` | fixed-rules.md F3.1 | Fixed injection |
-| `{{ FIXED_RULES_I18N_BASELINE }}` | fixed-rules.md F4 | Fixed injection |
-| `{{ FIXED_RULES_ERROR_HANDLING }}` | fixed-rules.md F5 | Fixed injection |
-| `{{ FIXED_RULES_DENY_LIST }}` | fixed-rules.md F2 full body | Fixed injection |
-| `{{ FIXED_RULES_TYPESCRIPT }}` | fixed-rules.md F1.1 full body | Fixed injection |
-| `{{ FIXED_RULES_NAMING }}` | fixed-rules.md F1.3 full body | Fixed injection |
-| `{{ FIXED_RULES_A11Y }}` | fixed-rules.md F6 full body | Fixed injection |
-| `{{ FIXED_RULES_PERFORMANCE }}` | fixed-rules.md F10 full body | Fixed injection |
-| `{{ FIXED_RULES_AI_BASE }}` | fixed-rules.md F9 full body | Fixed injection |
-| `{{ FIXED_RULES_GIT }}` | fixed-rules.md F7 full body | Fixed injection |
-| `{{ FIXED_RULES_SECURITY }}` | fixed-rules.md F8 full body | Fixed injection |
+| `{{ FIXED_RULES_COMPONENT_CONTRACT }}` | fixed-rules.md I4 | Invariant injection |
+| `{{ FIXED_RULES_I18N_BASELINE }}` | fixed-rules.md I5 | Invariant injection |
+| `{{ FIXED_RULES_ERROR_HANDLING }}` | fixed-rules.md I6 | Invariant injection |
+| `{{ FIXED_RULES_DENY_LIST }}` | fixed-rules.md I3 | Invariant injection |
+| `{{ FIXED_RULES_TYPESCRIPT }}` | fixed-rules.md I1 | Invariant injection |
+| `{{ FIXED_RULES_NAMING }}` | fixed-rules.md I2 | Invariant injection |
+| `{{ FIXED_RULES_A11Y }}` | fixed-rules.md I7 | Invariant injection |
+| `{{ FIXED_RULES_PERFORMANCE }}` | fixed-rules.md I8 | Invariant injection |
+| `{{ FIXED_RULES_AI_BASE }}` | fixed-rules.md I9 | Invariant injection |
+| `{{ FIXED_RULES_GIT }}` | fixed-rules.md I10 | Invariant injection |
+| `{{ FIXED_RULES_SECURITY }}` | fixed-rules.md I11 | Invariant injection |
 | `{{ deny_list_summary }}` | Phase 4 auto-extract all ❌ entries from §1.5/§3/§7.4/§9 | Auto-generated |
 | `{{ recommended_libs }}` | Phase 4 recommend based on framework + style_solution + state_lib | Auto-generated |