@canonical/pragma-cli 0.36.0 → 0.38.0

package/src/capabilities/doctor/doctor.test.ts

@@ -33,7 +33,10 @@ import {
   CANONICAL_TTL,
 } from "../../testing/fixtures/graph/canonical.js";
 import { bootFixtureRuntime } from "../../testing/helpers/fixtureGraph.js";
+import { storeProbe } from "../../testing/helpers/fsProbe.js";
 import { projectMcp } from "../../testing/helpers/projectMcp.js";
+import type { FsProbe } from "../setup/operations/writability.js";
+import { checkPackageRefs } from "./checks/checkPackageRefs.js";
 import { scopedChecks } from "./checks/targetHealth.js";
 import { doctorModule } from "./index.js";
 import { runChecks } from "./runChecks.js";
@@ -119,7 +122,15 @@ const byName = (data: DoctorData, name: string) =>
 
 describe("doctor — shape & spread", () => {
   it("returns the environment checks plus one row per scoped target", async () => {
-    const data = await runChecks(bootRuntime(FLAGS, tmp("pragma-proj-")));
+    // A fixture pack, not the distribution's own: the shape under test is the
+    // row table, and the store check booting the embedded snapshot cold costs
+    // three seconds on an idle machine (65,000 triples) and more than the
+    // five-second budget when every package's suite runs at once, which is how
+    // the release workflow runs them. What the embedded snapshot proves — that
+    // a first install's pack refs pass naming it — has its own case below,
+    // through the check that never boots the store.
+    const fixture = await bootFixtureRuntime({ ttl: CANONICAL_TTL });
+    const data = await runChecks(fixture.runtime);
     // Four unscoped environment checks, then the target table in both scopes
     // (all five targets are global, mcp and skills are also project) = 11,
     // plus the two `harnesses` inventory rows, one per scope = 13.
@@ -130,24 +141,6 @@ describe("doctor — shape & spread", () => {
     }
     // Deterministic under the isolated env.
     expect(byName(data, "Node version")?.status).toBe("pass");
-    // Nothing built, but the packs are the distribution's own — so the embedded
-    // snapshot answers reads and the check passes, naming what it is reading.
-    const pkgRefs = byName(data, "pack refs");
-    expect(pkgRefs?.status).toBe("pass");
-    expect(pkgRefs?.detail).toContain("shipped with the CLI");
-    expect(pkgRefs?.remedy).toBeUndefined();
-    // Provenance is one ITEM PER PACK, not a comma-joined string in the
-    // headline: four packs and two forty-character SHAs on one line was
-    // unreadable, and every other multi-part check here already uses items.
-    // The headline counts them; the items say which revision each one is.
-    expect(pkgRefs?.detail).toContain("packs");
-    expect((pkgRefs?.items?.length ?? 0) > 1).toBe(true);
-    for (const item of pkgRefs?.items ?? []) {
-      expect(item.label).not.toContain(",");
-      // A git hash is cut to seven — the length every other tool in this
-      // workflow prints, and short enough that four rows stay scannable.
-      expect(item.detail ?? "").not.toMatch(/[0-9a-f]{40}/);
-    }
 
     // The scoped rows carry the TARGET IDS verbatim — `mcp`, not "MCP
     // configured" — because the row name IS the fix command's argument. The
@@ -188,10 +181,37 @@ describe("doctor — shape & spread", () => {
     // No global config in the isolated XDG — an opt-in that is not set up yet.
     expect(byName(data, "config")?.status).toBe("available");
     expect(byName(data, "config")?.remedy).toBe("pragma setup config");
+    await fixture.dispose();
   });
 });
 
 describe("doctor — the pack-refs check", () => {
+  it("a first install reads the distribution's own packs, and says so", async () => {
+    // Nothing built, but the packs are the distribution's own — so the embedded
+    // snapshot answers reads and the check passes, naming what it is reading.
+    // The check alone, not the whole doctor: pack refs never boot the store, and
+    // booting the embedded snapshot cold is the one expensive thing a doctor
+    // run does.
+    const pkgRefs = await checkPackageRefs(
+      bootRuntime(FLAGS, tmp("pragma-proj-")),
+    );
+    expect(pkgRefs.status).toBe("pass");
+    expect(pkgRefs.detail).toContain("shipped with the CLI");
+    expect(pkgRefs.remedy).toBeUndefined();
+    // Provenance is one ITEM PER PACK, not a comma-joined string in the
+    // headline: four packs and two forty-character SHAs on one line was
+    // unreadable, and every other multi-part check here already uses items.
+    // The headline counts them; the items say which revision each one is.
+    expect(pkgRefs.detail).toContain("packs");
+    expect((pkgRefs.items?.length ?? 0) > 1).toBe(true);
+    for (const item of pkgRefs.items ?? []) {
+      expect(item.label).not.toContain(",");
+      // A git hash is cut to seven — the length every other tool in this
+      // workflow prints, and short enough that four rows stay scannable.
+      expect(item.detail ?? "").not.toMatch(/[0-9a-f]{40}/);
+    }
+  });
+
   it("a project with its OWN packs and nothing built is an attributable fail", async () => {
     // The install that must never read healthy: `origins.packs` is "project",
     // so the embedded snapshot is a DIFFERENT graph and every read throws
@@ -249,17 +269,20 @@ describe("doctor — the store check", () => {
 
 describe("doctor — dispatch & MCP", () => {
   it("exits 0 even when checks fail (failures live in the envelope)", async () => {
-    const outcome = await executeVerb(
-      doctorVerb,
-      {},
-      NO_MUT,
-      bootRuntime(FLAGS, tmp("pragma-proj-")),
-    );
+    // On the fixture pack, for the same reason the shape case is: a whole doctor
+    // run boots the store, and the embedded snapshot is the expensive one.
+    const fixture = await bootFixtureRuntime({ ttl: CANONICAL_TTL });
+    const outcome = await executeVerb(doctorVerb, {}, NO_MUT, fixture.runtime);
     expect(outcome.exitCode).toBe(0);
+    await fixture.dispose();
   });
 
   it("MCP doctor is read-only and returns the checks envelope", async () => {
-    const mcp = await projectMcp([doctorModule], tmp("pragma-proj-"));
+    // The MCP boots its own runtime from the cwd; the fixture's cwd carries a
+    // config that points at the built fixture pack, so the embedded snapshot is
+    // never parsed here either.
+    const fixture = await bootFixtureRuntime({ ttl: CANONICAL_TTL });
+    const mcp = await projectMcp([doctorModule], fixture.cwd);
     const tools = await mcp.listTools();
     const doctorTool = tools.find((t) => t.name === "doctor");
     expect(
@@ -271,6 +294,7 @@ describe("doctor — dispatch & MCP", () => {
     await mcp.cleanup();
     expect(envelope.ok).toBe(true);
     expect((envelope.data as DoctorData).checks).toHaveLength(13);
+    await fixture.dispose();
   });
 });
 
@@ -334,10 +358,45 @@ describe("doctor — the harness inventory", () => {
     expect(project?.items?.[0]?.detail).toContain("detected, not registered");
     expect(project?.items?.[0]?.detail).toContain(".vscode/mcp.json");
 
-    // Nothing detected in the global scope, and that is a skip — not a fault.
+    // The GLOBAL scope holds nothing. VS Code is dual-scope now, so the row
+    // CAN write a per-user file — but a committed `.vscode/` is evidence about
+    // this repository, not about this machine, and the global band has to be
+    // earned by a user-level signal. Without one there is no global location
+    // to report and nothing for `setup mcp` to do there.
     expect(global?.status).toBe("skip");
-    expect(global?.detail).toBe("no harnesses detected");
-    expect(global?.items).toBeUndefined();
+    expect(global?.items ?? []).toEqual([]);
+    const globalMcp = rows.find(
+      (r) => r.name === "mcp" && r.scope === "global",
+    );
+    expect(globalMcp?.status).toBe("skip");
+  });
+
+  it("holds the global hit once a USER-LEVEL signal has earned it", async () => {
+    // The same repository, on a machine that really has VS Code: its per-user
+    // directory exists, so the global band is earned and the row reports the
+    // per-user `mcp.json` it would write — detected, not registered — with the
+    // `mcp` row beside it naming the command that settles it.
+    const cwd = tmp("pragma-doctor-proj-");
+    mkdirSync(join(cwd, ".vscode"), { recursive: true });
+    mkdirSync(join(process.env.XDG_CONFIG_HOME as string, "Code", "User"), {
+      recursive: true,
+    });
+
+    const rows = await scopedChecks(bootRuntime(FLAGS, cwd), "pragma");
+    const { global } = inventory(rows);
+
+    expect(global?.status).toBe("pass");
+    expect(global?.detail).toBe("1 detected · 0 registered");
+    expect(global?.items?.map((i) => i.label)).toEqual(["VS Code"]);
+    expect(global?.items?.[0]?.status).toBe("available");
+    expect(global?.items?.[0]?.detail).toContain("detected, not registered");
+    expect(global?.items?.[0]?.detail).toContain("Code/User/mcp.json");
+
+    const globalMcp = rows.find(
+      (r) => r.name === "mcp" && r.scope === "global",
+    );
+    expect(globalMcp?.status).toBe("available");
+    expect(globalMcp?.remedy).toBe("pragma setup mcp");
   });
 
   it("--verbose lists every registry harness, undetected ones as a NON-failing skip", async () => {
@@ -348,9 +407,9 @@ describe("doctor — the harness inventory", () => {
     const { global, project } = inventory(rows);
 
     // Every harness the registry knows, in both scopes.
-    expect(project?.items).toHaveLength(13);
-    expect(global?.items).toHaveLength(13);
-    expect(project?.detail).toBe("1 detected · 0 registered · 13 known");
+    expect(project?.items).toHaveLength(16);
+    expect(global?.items).toHaveLength(16);
+    expect(project?.detail).toBe("1 detected · 0 registered · 16 known");
 
     // `types.ts` forbids inflating the failure count: a machine that simply
     // does not have Cursor is not a broken machine.
@@ -368,11 +427,15 @@ describe("doctor — the harness inventory", () => {
   });
 
   it("says where a harness DOES keep its config, rather than omitting it", async () => {
-    // `vscode` is `scope: "project"`, so it can NEVER carry a global entry. A
+    // `roo-code` is `scope: "project"`, so it can NEVER carry a global entry. A
     // verbose global listing that silently dropped it would read as a bug in
     // the listing; the row says why instead. The mirror case is Windsurf, which
     // is `scope: "global"` and keeps nothing per project.
     //
+    // VS Code used to be this example and stopped being one when its per-user
+    // `mcp.json` was added: it is `scope: "both"` now, and asserting otherwise
+    // would pin a fact the registry no longer holds.
+    //
     // The sentence states the FACT, not the partition: `no Global band` named
     // an internal word for the answer instead of giving it.
     const rows = await scopedChecks(
@@ -381,11 +444,11 @@ describe("doctor — the harness inventory", () => {
     );
     const { global, project } = inventory(rows);
 
-    const vscodeGlobal = global?.items?.find((i) => i.label === "VS Code");
-    expect(vscodeGlobal?.detail).toBe(
+    const rooGlobal = global?.items?.find((i) => i.label === "Roo Code");
+    expect(rooGlobal?.detail).toBe(
       "keeps no global config — it is per-project only",
     );
-    expect(vscodeGlobal?.status).toBe("skip");
+    expect(rooGlobal?.status).toBe("skip");
 
     const windsurfProject = project?.items?.find((i) => i.label === "Windsurf");
     expect(windsurfProject?.detail).toBe(
@@ -537,3 +600,231 @@ describe("doctor — an unconfigured opt-in integration is available, not a faul
     expect(check?.remedy).toBe("pragma setup mcp");
   });
 });
+
+/**
+ * The `lsp` row's per-editor provenance, and the rows that say a step was
+ * skipped rather than failing at it.
+ *
+ * Per the owner, 2026-09-16: doctor says per editor HOW it was found and WHY a
+ * step was skipped. A colleague whose macOS run reported no editor had VS Code
+ * installed the whole time, and a one-line row could not tell them whether
+ * pragma had missed the editor or found it and could not act.
+ *
+ * The blocked arms read a filesystem no CI host has, so they are driven over
+ * `scopedChecks`'s own probe seam — the same entry point `doctor` runs, with
+ * the filesystem answer injected, rather than the row bodies opened up as
+ * exports nothing in production would call.
+ */
+describe("doctor — the lsp row's per-editor provenance", () => {
+  /** The `lsp` row of a report, optionally over an injected filesystem. */
+  const lspRow = async (probe?: FsProbe) => {
+    const rows = await scopedChecks(
+      bootRuntime(FLAGS, tmp("pragma-doctor-proj-")),
+      "pragma",
+      probe,
+    );
+    return rows.find((r) => r.name === "lsp");
+  };
+
+  it("names one item per editor, with `via PATH` and its standing", async () => {
+    const stubDir = tmp("pragma-doctor-editors-");
+    writeFileSync(join(stubDir, "codium"), "");
+    process.env.PATH = stubDir;
+
+    const lsp = await lspRow();
+    // Nothing installed yet, so the row is the optional integration it is —
+    // and its derived fix keeps the "every available row has a remedy" rule.
+    expect(lsp?.status).toBe("available");
+    expect(lsp?.remedy).toBe("pragma setup lsp");
+    expect(lsp?.items?.map((i) => i.label)).toEqual(["VSCodium"]);
+    expect(lsp?.items?.[0]?.status).toBe("available");
+    expect(lsp?.items?.[0]?.detail).toContain("via PATH");
+    expect(lsp?.items?.[0]?.detail).toContain(join(stubDir, "codium"));
+    expect(lsp?.items?.[0]?.detail).toContain("not installed");
+  });
+
+  it("reports an editor found only by its user directory as a skipped item", async () => {
+    // Installed, and nothing to install WITH. The item says both.
+    mkdirSync(join(process.env.XDG_CONFIG_HOME as string, "Code", "User"), {
+      recursive: true,
+    });
+
+    const lsp = await lspRow();
+    expect(lsp?.status).toBe("skip");
+    expect(lsp?.detail).toContain("no command-line launcher");
+    expect(lsp?.items?.[0]?.label).toBe("VS Code");
+    expect(lsp?.items?.[0]?.status).toBe("skip");
+    expect(lsp?.items?.[0]?.detail).toContain("via user directory");
+    // The remedy is the editor's own palette command — NOT the derived
+    // `pragma setup lsp`, which would only reproduce the skip.
+    expect(lsp?.remedy).toContain("Install 'code' command in PATH");
+    expect(lsp?.remedy).not.toContain("\n");
+  });
+
+  it("a store-managed extensions folder is a skip carrying the Nix declaration", async () => {
+    const stubDir = tmp("pragma-doctor-nix-path-");
+    writeFileSync(join(stubDir, "codium"), "");
+    process.env.PATH = stubDir;
+    const extensions = join(
+      process.env.HOME as string,
+      ".vscode-oss",
+      "extensions",
+    );
+    mkdirSync(extensions, { recursive: true });
+
+    const lsp = await lspRow(storeProbe(extensions, "9z8y7x-vscodium"));
+    expect(lsp?.status).toBe("skip");
+    expect(lsp?.detail).toContain("managed by Nix");
+    expect(lsp?.items?.[0]?.status).toBe("skip");
+    expect(lsp?.items?.[0]?.detail).toContain("via PATH");
+    expect(lsp?.items?.[0]?.detail).toContain("managed by Nix");
+    // There is no marketplace listing, so the line gives both halves a
+    // home-manager user needs: where the VSIX comes from, and how to declare it.
+    expect(lsp?.remedy).toContain("buildVscodeExtension");
+    expect(lsp?.remedy).toContain("terrazzo-lsp.vsix");
+    expect(lsp?.remedy).not.toContain("\n");
+  });
+
+  it("a blocked editor beside an installable one keeps the row available", async () => {
+    // The invariant the row must not break: any editor that CAN be installed
+    // into makes the row `available`, whose derived fix is the setup command.
+    // A blocked sibling is reported as its own skipped item, not as the row's
+    // verdict.
+    const stubDir = tmp("pragma-doctor-mixed-path-");
+    writeFileSync(join(stubDir, "code"), "");
+    writeFileSync(join(stubDir, "codium"), "");
+    process.env.PATH = stubDir;
+    const extensions = join(
+      process.env.HOME as string,
+      ".vscode-oss",
+      "extensions",
+    );
+    mkdirSync(extensions, { recursive: true });
+
+    const lsp = await lspRow(storeProbe(extensions, "9z8y7x-vscodium"));
+    expect(lsp?.status).toBe("available");
+    expect(lsp?.detail).toBe("not installed in VS Code");
+    expect(lsp?.items?.map((i) => [i.label, i.status])).toEqual([
+      ["VS Code", "available"],
+      ["VSCodium", "skip"],
+    ]);
+    // The derived fix stands, because there is still something to install.
+    expect(lsp?.remedy).toBe("pragma setup lsp");
+  });
+
+  it("reports an installed editor as a pass, provenance included", async () => {
+    const stubDir = tmp("pragma-doctor-installed-path-");
+    writeFileSync(join(stubDir, "codium"), "");
+    process.env.PATH = stubDir;
+    mkdirSync(
+      join(
+        process.env.HOME as string,
+        ".vscode-oss",
+        "extensions",
+        "canonical.terrazzo-lsp-extension-1.2.3",
+      ),
+      { recursive: true },
+    );
+
+    const lsp = await lspRow();
+    expect(lsp?.status).toBe("pass");
+    expect(lsp?.detail).toBe("installed in VSCodium");
+    expect(lsp?.items?.[0]?.status).toBe("pass");
+    expect(lsp?.items?.[0]?.detail).toContain("via PATH");
+    expect(lsp?.items?.[0]?.detail).toContain("· installed");
+  });
+
+  it("an INSTALLED editor in a blocked folder is a pass, not a skip", async () => {
+    // A site-managed (or Nix-managed) extensions folder that ALREADY holds the
+    // extension is a working machine. Reporting a skip there told its owner to
+    // chmod the folder and install an extension they already have, and made
+    // the row a permanent `○ lsp` nothing could clear.
+    const stubDir = tmp("pragma-doctor-blocked-installed-");
+    writeFileSync(join(stubDir, "codium"), "");
+    process.env.PATH = stubDir;
+    const extensions = join(
+      process.env.HOME as string,
+      ".vscode-oss",
+      "extensions",
+    );
+    mkdirSync(join(extensions, "canonical.terrazzo-lsp-extension-1.2.3"), {
+      recursive: true,
+    });
+
+    const lsp = await lspRow(storeProbe(extensions, "9z8y7x-vscodium"));
+    expect(lsp?.status).toBe("pass");
+    expect(lsp?.detail).toBe("installed in VSCodium");
+    expect(lsp?.items?.[0]?.status).toBe("pass");
+    expect(lsp?.items?.[0]?.detail).toContain("· installed");
+    expect(lsp?.remedy).toBeUndefined();
+  });
+
+  it("no editor anywhere is a skip naming every place that was looked", async () => {
+    process.env.PATH = tmp("pragma-doctor-empty-path-");
+    const lsp = await lspRow();
+    expect(lsp?.status).toBe("skip");
+    expect(lsp?.detail).toContain("no VS Code-family editor found");
+    expect(lsp?.detail).toContain("under /Applications or ~/Applications");
+    expect(lsp?.detail).toContain("by its user directory");
+    expect(lsp?.remedy).toContain("no action is possible on this machine");
+  });
+});
+
+/**
+ * The `mcp` row over a location pragma must not write. It used to be an
+ * `available` row whose `fix:` would have failed the moment it ran.
+ */
+describe("doctor — an unwritable MCP location", () => {
+  it("reports a store-managed file as a skip whose remedy IS the entry", async () => {
+    const cwd = tmp("pragma-doctor-proj-");
+    mkdirSync(join(cwd, ".vscode"), { recursive: true });
+
+    const rows = await scopedChecks(
+      bootRuntime(FLAGS, cwd),
+      "pragma",
+      storeProbe(cwd, "4b5c6d-project"),
+    );
+    const mcp = rows.find((r) => r.name === "mcp" && r.scope === "project");
+
+    expect(mcp?.status).toBe("skip");
+    expect(mcp?.detail).toContain("managed by Nix");
+    expect(mcp?.items?.every((i) => i.status === "skip")).toBe(true);
+    // The exact entry a write would have emitted, so what the user declares
+    // classifies as registered next time rather than as drift.
+    expect(mcp?.remedy).toContain('"servers"');
+    expect(mcp?.remedy).toContain('"pragma"');
+    expect(mcp?.remedy).not.toContain("\n");
+  });
+
+  it("counts only the WRITABLE files in the row's denominator", async () => {
+    // Two locations, one of them managed: "registered in 1 of 1" is the honest
+    // headline, not "1 of 2" over a file this command will never write.
+    const cwd = tmp("pragma-doctor-proj-");
+    // A `pragma` on PATH, so the registered entry reads `pass` rather than
+    // "registered, but `pragma` is not on PATH" — this case is about the
+    // DENOMINATOR, and a failing sibling would decide the row instead.
+    const binDir = tmp("pragma-doctor-bin-");
+    writeFileSync(join(binDir, "pragma"), "");
+    process.env.PATH = binDir;
+    mkdirSync(join(cwd, ".vscode"), { recursive: true });
+    mkdirSync(join(cwd, ".roo"), { recursive: true });
+    writeFileSync(
+      join(cwd, ".roo", "mcp.json"),
+      JSON.stringify({
+        mcpServers: {
+          pragma: { command: "pragma", args: ["mcp", "serve"], cwd },
+        },
+      }),
+    );
+
+    const rows = await scopedChecks(
+      bootRuntime(FLAGS, cwd),
+      "pragma",
+      storeProbe(join(cwd, ".vscode"), "7e8f9a-vscode"),
+    );
+    const mcp = rows.find((r) => r.name === "mcp" && r.scope === "project");
+
+    expect(mcp?.detail).toBe("registered in 1 of 1 config files");
+    expect(mcp?.items?.filter((i) => i.status === "skip")).toHaveLength(1);
+  });
+});

package/src/capabilities/emptyRecovery.test.ts

@@ -15,6 +15,7 @@
 
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { compilePack } from "../kernel/packs/compile.js";
+import { DEFAULT_LIST_LIMIT } from "../kernel/packs/paging.js";
 import type { PackDefinition } from "../kernel/packs/types.js";
 import { distributionSource } from "../kernel/packs/types.js";
 import { verbKey } from "../kernel/packs/uniqueness.js";
@@ -41,28 +42,82 @@ const PREFIXES = {
   owl: "http://www.w3.org/2002/07/owl#",
   rdfs: "http://www.w3.org/2000/01/rdf-schema#",
   xsd: "http://www.w3.org/2001/XMLSchema#",
+  dt: "https://dt.canonical.com/",
+  "dt-web": "https://dt.canonical.com/platform/web/",
+  "w3c-tokens": "https://dt.canonical.com/w3c-tokens/",
+  anatomy: "https://anatomy.canonical.com/",
+  sh: "http://www.w3.org/ns/shacl#",
+  rdf: "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
 };
 
 // The ontology (TBox) with NO individuals — a booted-but-empty store.
 const TTL = `
 @prefix ds: <https://ds.canonical.com/> .
 @prefix cs: <https://ds.canonical.com/code-standards/> .
+@prefix dt: <https://dt.canonical.com/> .
+@prefix dt-web: <https://dt.canonical.com/platform/web/> .
+@prefix w3c-tokens: <https://dt.canonical.com/w3c-tokens/> .
+@prefix anatomy: <https://anatomy.canonical.com/> .
+@prefix sh: <http://www.w3.org/ns/shacl#> .
 @prefix owl: <http://www.w3.org/2002/07/owl#> .
 @prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
 @prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
 ds:ModifierFamily a owl:Class .
 ds:Modifier a owl:Class .
-ds:Token a owl:Class .
-ds:TokenType a owl:Class .
 cs:CodeStandard a owl:Class .
 cs:Category a owl:Class .
 ds:name a owl:DatatypeProperty ; rdfs:domain ds:ModifierFamily ; rdfs:range xsd:string .
 ds:hasModifier a owl:ObjectProperty ; rdfs:domain ds:ModifierFamily ; rdfs:range ds:Modifier .
 ds:modifierFamily a owl:ObjectProperty ; rdfs:domain ds:Modifier ; rdfs:range ds:ModifierFamily .
-ds:tokenId a owl:DatatypeProperty ; rdfs:domain ds:Token ; rdfs:range xsd:string .
-ds:tokenType a owl:ObjectProperty ; rdfs:domain ds:Token ; rdfs:range ds:TokenType .
 cs:description a owl:DatatypeProperty ; rdfs:domain cs:CodeStandard ; rdfs:range xsd:string .
 cs:slug a owl:DatatypeProperty ; rdfs:domain cs:Category ; rdfs:range xsd:string .
+# The token strata's TBox, which replaces the retired ds:Token declarations: the
+# story reads dt: and w3c-tokens: now, and a booted-but-empty store has to BIND
+# the terms a declared read names or the read fails as an unbuilt store instead
+# of answering the empty list this suite is about. Declarations only — no
+# individuals — which is the whole point of the fixture.
+dt:TokenSymbol a owl:Class .
+dt:ResolvedValue a owl:Class .
+dt:Variable a owl:Class .
+dt:Declaration a owl:Class .
+dt:Coordinate a owl:Class .
+dt:Tier a owl:Class .
+dt:Visibility a owl:Class .
+w3c-tokens:Token a owl:Class .
+w3c-tokens:TokenType a owl:Class .
+dt:channelOf a owl:ObjectProperty ; rdfs:range dt:TokenSymbol .
+dt:symbol a owl:ObjectProperty ; rdfs:range dt:TokenSymbol .
+dt:tokenType a owl:ObjectProperty ; rdfs:range w3c-tokens:TokenType .
+dt:covers a owl:ObjectProperty ; rdfs:range dt:TokenSymbol .
+dt:forSymbol a owl:ObjectProperty ; rdfs:range dt:TokenSymbol .
+dt:coordinate a owl:ObjectProperty ; rdfs:range dt:Coordinate .
+dt:derivedFrom a owl:ObjectProperty ; rdfs:range dt:TokenSymbol .
+dt:resolutionChain a owl:ObjectProperty .
+dt:resolvesTo a owl:DatatypeProperty ; rdfs:range xsd:string .
+dt:ofSymbol a owl:ObjectProperty ; rdfs:range dt:TokenSymbol .
+dt:tier a owl:ObjectProperty ; rdfs:range dt:Tier .
+dt:visibility a owl:ObjectProperty ; rdfs:range dt:Visibility .
+dt:declaredAt a owl:ObjectProperty ; rdfs:range dt:Declaration .
+dt:under a owl:ObjectProperty .
+dt:emits a owl:DatatypeProperty ; rdfs:range xsd:string .
+dt:at a owl:DatatypeProperty ; rdfs:range xsd:string .
+dt:alsoAt a owl:ObjectProperty ; rdfs:range dt:Coordinate .
+dt:derives a owl:ObjectProperty .
+dt:references a owl:ObjectProperty .
+dt:selectsCoordinate a owl:ObjectProperty ; rdfs:range dt:Coordinate .
+dt-web:selector a owl:DatatypeProperty ; rdfs:range xsd:string .
+dt-web:inAtRule a owl:ObjectProperty .
+w3c-tokens:description a owl:DatatypeProperty ; rdfs:range xsd:string .
+w3c-tokens:inFile a owl:ObjectProperty .
+w3c-tokens:path a owl:DatatypeProperty ; rdfs:range xsd:string .
+anatomy:StyleKey a owl:Class .
+anatomy:styleKey a owl:DatatypeProperty ; rdfs:range xsd:string .
+anatomy:styleState a owl:DatatypeProperty ; rdfs:range xsd:string .
+ds:hasTokenBinding a owl:ObjectProperty .
+ds:consumesSymbol a owl:ObjectProperty ; rdfs:range dt:TokenSymbol .
+ds:rank a owl:DatatypeProperty .
+ds:node a owl:DatatypeProperty .
+ds:viaBlock a owl:ObjectProperty .
 `;
 
 let rt: PragmaRuntime;
@@ -99,31 +154,32 @@ const PACK_LISTS: readonly { pack: PackDefinition; hint: RegExp }[] = [
 const REAL = { dryRun: false, undo: false, yes: false };
 
 describe("pack list empty-state (U5, PROTECTED)", () => {
-  it.each(
-    PACK_LISTS,
-  )("$pack.noun list on an empty store returns [] — never throws", async ({
-    pack,
-  }) => {
-    await expect(listVerb(pack).run({}, rt)).resolves.toEqual([]);
-  });
+  it.each(PACK_LISTS)(
+    "$pack.noun list on an empty store returns [] — never throws",
+    async ({ pack }) => {
+      await expect(listVerb(pack).run({}, rt)).resolves.toEqual({
+        rows: [],
+        limit: DEFAULT_LIST_LIMIT,
+      });
+    },
+  );
 
-  it.each(
-    PACK_LISTS,
-  )("$pack.noun list declares a non-blank empty notice (+ hint), JSON stays []", ({
-    pack,
-    hint,
-  }) => {
-    const { formatters } = listVerb(pack).output;
-    // The message + runnable hint live on the empty-state seam — the
-    // dispatcher routes them to stderr, keeping plain stdout pure data.
-    const notice = formatters.notice?.([]);
-    expect(notice).toContain(`No ${pack.noun} entries found.`);
-    expect(notice).toMatch(hint);
-    // JSON is the uniform empty array — unchanged by the message.
-    expect(formatters.json([])).toBe("[]");
-    // The llm view stays non-blank too (the `(0)` heading plus the message).
-    expect(formatters.llm([]).trim().length).toBeGreaterThan(0);
-  });
+  it.each(PACK_LISTS)(
+    "$pack.noun list declares a non-blank empty notice (+ hint), JSON stays []",
+    ({ pack, hint }) => {
+      const { formatters } = listVerb(pack).output;
+      // The message + runnable hint live on the empty-state seam — the
+      // dispatcher routes them to stderr, keeping plain stdout pure data.
+      const empty = { rows: [], limit: DEFAULT_LIST_LIMIT };
+      const notice = formatters.notice?.(empty);
+      expect(notice).toContain(`No ${pack.noun} entries found.`);
+      expect(notice).toMatch(hint);
+      // JSON is the uniform empty array — unchanged by the message.
+      expect(formatters.json(empty)).toBe("[]");
+      // The llm view stays non-blank too (the `(0)` heading plus the message).
+      expect(formatters.llm(empty).trim().length).toBeGreaterThan(0);
+    },
+  );
 
   it("dispatch routes the empty message to stderr and exits 0 (end-to-end)", async () => {
     const outcome = await executeVerb(