diff --git a/.oxlintrc.json b/.oxlintrc.json
index 9a09414..93467e0 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -2,6 +2,26 @@
     "$schema": "./node_modules/oxlint/configuration_schema.json",
     "plugins": ["typescript", "unicorn", "oxc"],
     "categories": {"correctness": "error"},
-    "rules": {},
+    "rules": {
+        // Library-territory selective adoption from war-room canonical template (commit 321da5f).
+        // Per CLAUDE.md §Lint Rules, library posture is Correctness-only, opt-in per-rule for anything else.
+        // Each rule below is library-relevant correctness, security, or type-aware quality.
+        "no-implied-eval": "error",
+        "prefer-regex-literals": "error",
+        "getter-return": "error",
+        "typescript/no-unnecessary-type-conversion": "error",
+        "typescript/no-unnecessary-type-parameters": "warn",
+        "unicorn/no-useless-iterator-to-array": "warn",
+        "unicorn/import-style": "warn"
+        // Library-territory skips (per CLAUDE.md §Lint Rules Correctness-only posture):
+        //   vue/* — no SFCs in fs-packages source; published Vue-aware packages expose factories/composables only.
+        //   jsx-a11y/* — no JSX in this monorepo.
+        //   typescript/no-unsafe-* and related type-aware bulk rules — library API surface intentionally exposes `unknown`/`any` at adapter boundaries (e.g., fs-adapter-store generic constraints).
+        //   unicorn/prefer-import-meta-properties — dual ESM+CJS build target via tsdown; import.meta in CJS bundles cascades into build errors.
+        //   no-useless-assignment — library code intentionally pre-declares values for type inference.
+        //   vitest/* test-override additions (valid-expect-in-promise, prefer-strict-boolean-matchers) — test gates already enforce strict matcher discipline via Stryker mutation testing at 90% threshold.
+        //   Vue 2→3 deprecation guards, Composition-API safety, Options-API correctness — no Options API or template-API features used.
+        //   complexity / max-* limits — library APIs are intentionally tight; existing Stryker + coverage gates govern complexity at the test-discipline layer.
+    },
     "env": {"builtin": true}
 }
diff --git a/scripts/lint-pkg.mjs b/scripts/lint-pkg.mjs
index 1c1339f..897bb6e 100644
--- a/scripts/lint-pkg.mjs
+++ b/scripts/lint-pkg.mjs
@@ -22,7 +22,7 @@
 
 import {spawnSync} from 'node:child_process';
 import {readdirSync, readFileSync, statSync} from 'node:fs';
-import {join} from 'node:path';
+import path from 'node:path';
 
 const PACKAGES_DIR = 'packages';
 const ROOT_MANIFEST = 'package.json';
@@ -30,10 +30,10 @@ const PUBLINT_BLOCK_RE = /^(Suggestions|Warnings|Errors):$/m;
 
 function listPackageDirs() {
     return readdirSync(PACKAGES_DIR)
-        .map((name) => join(PACKAGES_DIR, name))
+        .map((name) => path.join(PACKAGES_DIR, name))
         .filter((dir) => {
             try {
-                return statSync(dir).isDirectory() && statSync(join(dir, 'package.json')).isFile();
+                return statSync(dir).isDirectory() && statSync(path.join(dir, 'package.json')).isFile();
             } catch {
                 return false;
             }
@@ -46,7 +46,7 @@ function readManifest(manifestPath) {
 }
 
 function packageName(dir) {
-    return readManifest(join(dir, 'package.json')).name ?? dir;
+    return readManifest(path.join(dir, 'package.json')).name ?? dir;
 }
 
 function checkEnginesNode(manifestPath, label) {
@@ -89,7 +89,7 @@ function main() {
         const name = packageName(dir);
         process.stdout.write(`\n--- lint:pkg ${name} (${dir}) ---\n`);
 
-        const enginesFailure = checkEnginesNode(join(dir, 'package.json'), name);
+        const enginesFailure = checkEnginesNode(path.join(dir, 'package.json'), name);
         if (enginesFailure) {
             failures.push(enginesFailure);
             process.stderr.write(`  ${enginesFailure}\n`);