@drkmttr/adhere 0.9.4 → 0.10.0

package/src/contradictions.ts

@@ -1,4 +1,5 @@
-import type { RuleEntry } from "#rules.ts";
+import type { Rule } from "#config.ts";
+import { judgesFile, type RuleEntry, shownId } from "#rules.ts";
 import { Jev, type Pair } from "#services/Jev.ts";
 import { Effect } from "effect";
 
@@ -17,6 +18,10 @@ const scopesOverlap = (a: string, b: string): boolean => {
   return first === second || first.startsWith(`${second}/`) || second.startsWith(`${first}/`);
 };
 
+/** Whether two rules judge any of the same kind of file: a rule on tests only shares none with one that skips them. */
+const judgeSameKind = (a: Rule, b: Rule): boolean =>
+  (judgesFile(a, true) && judgesFile(b, true)) || (judgesFile(a, false) && judgesFile(b, false));
+
 /**
  * Per rule, the rules that apply to some of the same files. A rule with the
  * same id is left out: a nested rule that shares an id shadows the other on
@@ -25,7 +30,10 @@ const scopesOverlap = (a: string, b: string): boolean => {
 const partnersOf = (entries: ReadonlyArray<RuleEntry>): ReadonlyArray<ReadonlyArray<number>> =>
   entries.map((first, index) =>
     entries.flatMap((second, other) =>
-      other !== index && first.id !== second.id && scopesOverlap(first.scope, second.scope)
+      other !== index &&
+      first.id !== second.id &&
+      scopesOverlap(first.scope, second.scope) &&
+      judgeSameKind(first.rule, second.rule)
         ? [other]
         : [],
     ),
@@ -69,7 +77,9 @@ export const findContradictions = Effect.fn("findContradictions")(function* (
   });
 });
 
-const locationOf = (entry: RuleEntry): string => `${entry.id} (${entry.file ?? entry.scope})`;
+/** Where a rule lives: a preset's names the preset in its id; the project's own rule names its file. */
+const locationOf = (entry: RuleEntry): string =>
+  entry.preset === undefined ? `${entry.id} (${entry.file ?? entry.scope})` : shownId(entry);
 
 export const formatContradictions = (contradictions: ReadonlyArray<Contradiction>): string => {
   if (contradictions.length === 0) {

package/src/excerpt.ts

@@ -16,7 +16,7 @@ const AROUND = 3;
 const WHOLE = 30;
 
 /** Lines of the code, first to last, counting from 1. */
-interface Range {
+export interface Range {
   readonly first: number;
   readonly last: number;
 }
@@ -209,6 +209,16 @@ const statementsAround = (
   ];
 };
 
+/**
+ * The statement that starts on `line`, such as a property, a function, or a
+ * call that opens there: the outermost statement around `line` whose first
+ * line it is. None when no statement starts on `line`.
+ */
+export const statementFrom = (lines: ReadonlyArray<string>, line: number): Range | undefined => {
+  const { pieces } = piecesOf(lines.join("\n"));
+  return statementsAround(pieces, closesOf(pieces), line).find((range) => range.first === line);
+};
+
 /**
  * The excerpt for a finding on `line`: the outermost statement around it
  * with at most `WHOLE` lines, such as the function it is in, and up to

package/src/index.ts

@@ -10,7 +10,7 @@ export {
   type RuleSource,
 } from "#config.ts";
 export { findContradictions, formatContradictions, type Contradiction } from "#contradictions.ts";
-export { initProject, type InitOptions, type InitResult } from "#init.ts";
+export { initProject, type InitOptions, type InitResult, type Install } from "#init.ts";
 export { parseRuleMarkdown } from "#markdown.ts";
 export { type PresetName, presetNames } from "#presets.ts";
 export {

package/src/init.ts

@@ -1,4 +1,5 @@
-import { access, mkdir, writeFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
 import { CONFIG_FILES } from "#config.ts";
 import { Effect } from "effect";
@@ -6,17 +7,45 @@ import { Effect } from "effect";
 export interface InitResult {
   readonly created: ReadonlyArray<string>;
   readonly skipped: ReadonlyArray<string>;
+  /** The package manager that added adhere, or why none did. */
+  readonly install: Install;
 }
 
+export type Install =
+  | { readonly status: "installed"; readonly packageManager: PackageManager }
+  | { readonly status: "listed" }
+  | { readonly status: "no-package-json" };
+
 export interface InitOptions {
   readonly force?: boolean;
 }
 
-const CONFIG = `import type { Config } from "@drkmttr/adhere";
+// adhere-ignore-file rules/import-written-files -- src/index.ts exports initProject, so a Bun text import here breaks loading the package on Node and in Vitest (checked 2026-09-26), and the compiled executable has no files beside it to read.
+const CONFIG = `import { defineConfig } from "@drkmttr/adhere";
 
-export default {
+export default defineConfig({
   threshold: 0.8,
-} satisfies Config;
+});
+`;
+
+/**
+ * A project for the config alone. A tsconfig's globs skip dot directories, so
+ * without it the editor opens `.adhere/config.ts` outside any project, where
+ * it cannot resolve `@drkmttr/adhere`, whose types only `bundler`, `node16`,
+ * and `nodenext` resolution reach.
+ */
+const TSCONFIG = `{
+  "compilerOptions": {
+    "target": "esnext",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "allowImportingTsExtensions": true
+  },
+  "include": ["config.ts"]
+}
 `;
 
 const SMALL_FILES = `---
@@ -24,16 +53,20 @@ description: A file should be small and focused, with one primary responsibility
 threshold: 0.8
 ---
 
-A guideline, so its description and its code say should and should not. A
+A guideline, so its description and its headings say should and should not. A
 rule that must hold says must and never instead, as name-domain-actions does.
 Use this rule as a template for repository-specific conventions.
 
-\`\`\`ts should
+## Should
+
+\`\`\`ts
 export const parsePort = (value: string) =>
   Port.make(Number.parseInt(value, 10));
 \`\`\`
 
-\`\`\`ts should not
+## Should not
+
+\`\`\`ts
 export const parsePort = (value: string) => Port.make(Number.parseInt(value, 10));
 export const sendWelcomeEmail = (to: Email) => Mailer.send(to, welcomeTemplate);
 export const renderInvoice = (invoice: Invoice) => Html.table(invoice.lines);
@@ -45,17 +78,21 @@ description: A function must be named after the domain action it performs, never
 threshold: 0.8
 ---
 
-\`\`\`ts must
+## Must
+
+\`\`\`ts
 export const loadCustomerProfile = (customerId: CustomerId) =>
   Effect.gen(function* () {
     return yield* CustomerStore.find(customerId);
   });
 \`\`\`
 
-A fence tagged \`never\` shows what a violation looks like. It is optional, and
-a rule can have one without the block above.
+## Never
 
-\`\`\`ts never
+The code under Never shows what a violation looks like. It is optional, and a
+rule can have it without the code under Must.
+
+\`\`\`ts
 export const handle = (id: string) =>
   Effect.gen(function* () {
     return yield* CustomerStore.find(id);
@@ -65,8 +102,12 @@ export const handle = (id: string) =>
 
 const CONFIG_PATH = CONFIG_FILES[0];
 
+/** The config's own project, which only a config at `.adhere/config.ts` needs. */
+const CONFIG_PROJECT = ".adhere/tsconfig.json";
+
 const files = [
   [CONFIG_PATH, CONFIG],
+  [CONFIG_PROJECT, TSCONFIG],
   [".adhere/style/prefer-small-files.md", SMALL_FILES],
   [".adhere/style/name-domain-actions.md", NAME_EFFECTS],
 ] as const;
@@ -102,6 +143,69 @@ const writeScaffoldFile = (root: string, path: string, contents: string, options
       ),
   });
 
+const PACKAGE = "@drkmttr/adhere";
+
+type PackageManager = "bun" | "pnpm" | "yarn" | "npm";
+
+/** The first lockfile at the root names the package manager; npm when there is none. */
+const lockfiles: ReadonlyArray<readonly [string, PackageManager]> = [
+  ["bun.lock", "bun"],
+  ["bun.lockb", "bun"],
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["package-lock.json", "npm"],
+];
+
+const packageManagerAt = async (root: string): Promise<PackageManager> => {
+  for (const [file, manager] of lockfiles) {
+    if (await exists(join(root, file))) return manager;
+  }
+  return "npm";
+};
+
+/**
+ * pnpm refuses to add to a workspace root without a flag. `-w` fails outside a
+ * workspace, so the first one, which works in both, stands in for it. pnpm 11
+ * also fails on msgpackr-extract's unapproved build script. It comes with
+ * effect, and adhere never calls msgpackr, so the second flag lets pnpm skip
+ * the build with a warning.
+ */
+const addFlags: Record<PackageManager, ReadonlyArray<string>> = {
+  bun: [],
+  pnpm: ["--ignore-workspace-root-check", "--config.strict-dep-builds=false"],
+  yarn: [],
+  npm: [],
+};
+
+/** Adds adhere to devDependencies, so the config's `import type` resolves. */
+const installAdhere = (root: string) =>
+  Effect.tryPromise({
+    try: async (): Promise<Install> => {
+      const manifest = await readFile(join(root, "package.json"), "utf8").catch(() => undefined);
+      if (manifest === undefined) return { status: "no-package-json" };
+      const { dependencies, devDependencies } = JSON.parse(manifest);
+      if (dependencies?.[PACKAGE] !== undefined || devDependencies?.[PACKAGE] !== undefined) {
+        return { status: "listed" };
+      }
+      const packageManager = await packageManagerAt(root);
+      await new Promise<void>((resolve, reject) => {
+        spawn(packageManager, ["add", "-D", PACKAGE, ...addFlags[packageManager]], {
+          cwd: root,
+          stdio: "inherit",
+        })
+          .on("error", reject)
+          .on("exit", (code) =>
+            code === 0 ? resolve() : reject(new Error(`${packageManager} exited with ${code}`)),
+          );
+      });
+      return { status: "installed", packageManager };
+    },
+    catch: (cause) =>
+      new Error(
+        `Could not add ${PACKAGE} to package.json: ${cause instanceof Error ? cause.message : String(cause)}`,
+      ),
+  });
+
 export const initProject = (
   root: string,
   options: InitOptions = {},
@@ -115,6 +219,8 @@ export const initProject = (
         skipped.push(existing);
         continue;
       }
+      // A config at another path is in the project's own tsconfig, or not ours to place.
+      if (path === CONFIG_PROJECT && existing !== undefined) continue;
       const status = yield* writeScaffoldFile(root, path, contents, options);
       if (status === "created") {
         created.push(relative(root, join(root, path)));
@@ -122,5 +228,6 @@ export const initProject = (
         skipped.push(relative(root, join(root, path)));
       }
     }
-    return { created, skipped };
+    const install = yield* installAdhere(root);
+    return { created, skipped, install };
   });

package/src/main.ts

@@ -49,7 +49,6 @@ const report = (cause: Cause.Cause<unknown>): Effect.Effect<void> => {
 
 Command.run(cli, { version }).pipe(
   Effect.tapCause(report),
-  // oxlint-disable-next-line effecttsgo/strict-effect-provide -- this executable entrypoint supplies Bun's process services and the logger.
   Effect.provide(Layer.merge(BunServices.layer, logger)),
   (program) => BunRuntime.runMain(program, { disableErrorReporting: true }),
 );

package/src/markdown.ts

@@ -10,27 +10,40 @@ import { Effect, Schema } from "effect";
  *     ---
  *     Any prose, rendered on GitHub and ignored by adhere.
  *
- *     ```ts must
+ *     ## Must
+ *
+ *     ```ts
  *     const written = "code that must be written this way"
  *     ```
  *
- *     ```ts never
+ *     ## Never
+ *
+ *     ```ts
  *     const avoided = "code that must never be written this way"
  *     ```
  *
- * A fence's info string names its code with RFC 2119's words: `must` and
- * `never` for a requirement, `should` and `should not` for a guideline. The
- * first fence under each word is that example, and a rule has either or both.
- * An untagged fence is the code to write, and without a fence the whole body
- * is. `avoid`, the word before 0.7, means `never`. `threshold` is optional.
+ * A heading names the code in its section with RFC 2119's words: `must` and
+ * `never` for a requirement, `should` and `should not` for a guideline. So
+ * does a fence's info string, as in `ts never`, which GitHub does not show; a
+ * fence's own word wins over its heading's. The first fence under each word is
+ * that example, and a rule has either or both. An untagged fence outside those
+ * sections is the code to write, and without a fence the whole body is.
+ * `avoid`, the word before 0.7, means `never`. `threshold` is optional, and
+ * so is `tests`: `only` for a rule about test files, which rules otherwise
+ * skip, and `include` for a rule that judges them too. So is `level`:
+ * `warning` reports the rule's findings as warnings, which do not fail a run.
  */
 const FrontMatter = Schema.Struct({
   description: Schema.String,
   threshold: Schema.optionalKey(Schema.FiniteFromString),
+  tests: Schema.optionalKey(Schema.Literals(["only", "include"])),
+  level: Schema.optionalKey(Schema.Literals(["error", "warning"])),
 });
 
 const FRONT_MATTER = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
 const FENCE = /^ {0,3}(`{3,}|~{3,})([^\n]*)\n([\s\S]*?)\n {0,3}\1[ \t]*$/gm;
+/** An ATX heading: its level as `#`s, then its text, without a closing run of `#`s. */
+const HEADING = /^ {0,3}(#{1,6})(?:[ \t]+(.*?))?(?:[ \t]+#+)?[ \t]*$/gm;
 
 const unquote = (value: string): string => {
   const trimmed = value.trim();
@@ -54,11 +67,17 @@ const parseFrontMatter = (block: string): Record<string, string> => {
 type Word = Example["word"];
 
 interface Fence {
-  /** The word the info string names the code with; none for an untagged fence. */
+  /** The word its info string, or else its heading, names the code with; none for untagged code. */
   readonly word: Word | undefined;
   readonly code: string;
 }
 
+interface Heading {
+  readonly level: number;
+  /** The word the heading names its section's code with; none for any other heading. */
+  readonly word: Word | undefined;
+}
+
 /** `must not`, like `never` and the older `avoid`, names code never to write. */
 const wordOf = (info: string): Word | undefined => {
   const words = info.trim().toLowerCase().split(/\s+/);
@@ -69,11 +88,55 @@ const wordOf = (info: string): Word | undefined => {
   return undefined;
 };
 
-const fencesOf = (body: string): ReadonlyArray<Fence> =>
-  Array.from(body.matchAll(FENCE), (match) => ({
-    word: wordOf(match[2] ?? ""),
-    code: (match[3] ?? "").trim(),
-  }));
+const HEADING_WORDS: ReadonlySet<string> = new Set([
+  "must",
+  "must not",
+  "never",
+  "avoid",
+  "should",
+  "should not",
+]);
+
+/**
+ * A heading names a word only when it is the word alone, in any case and with
+ * or without a colon: `## Never` does, `## Why never` does not.
+ */
+const headingWordOf = (text: string): Word | undefined => {
+  const phrase = text.trim().replace(/:$/, "").trim().toLowerCase().split(/\s+/).join(" ");
+  return HEADING_WORDS.has(phrase) ? wordOf(phrase) : undefined;
+};
+
+/**
+ * The headings open after `text`, outermost first, given those open before
+ * it. A heading closes the sections at its level and deeper, so a deeper
+ * heading stays inside the section above it.
+ */
+const openAfter = (open: ReadonlyArray<Heading>, text: string): ReadonlyArray<Heading> =>
+  Array.from(text.matchAll(HEADING)).reduce<ReadonlyArray<Heading>>((headings, match) => {
+    const level = (match[1] ?? "#").length;
+    return [
+      ...headings.filter((heading) => heading.level < level),
+      { level, word: headingWordOf(match[2] ?? "") },
+    ];
+  }, open);
+
+/**
+ * Each fence, under the word its info string names or, without one, the word
+ * of the innermost heading over it that names one.
+ */
+const fencesOf = (body: string): ReadonlyArray<Fence> => {
+  const fences: Array<Fence> = [];
+  let open: ReadonlyArray<Heading> = [];
+  let read = 0;
+  for (const match of body.matchAll(FENCE)) {
+    // Only headings between fences count: a `#` line inside one is code.
+    open = openAfter(open, body.slice(read, match.index));
+    read = match.index + match[0].length;
+    const section = open.findLast((heading) => heading.word !== undefined)?.word;
+    fences.push({ word: wordOf(match[2] ?? "") ?? section, code: (match[3] ?? "").trim() });
+  }
+  return fences;
+};
 
 /** An empty block counts as no block. */
 const nonEmpty = (code: string | undefined): string | undefined =>
@@ -134,7 +197,7 @@ export const parseRuleMarkdown = (
     }
     if (!requirement && !guideline) {
       return yield* ConfigUnavailable.make({
-        message: `${file}: the body needs code, in a fence tagged must, never, should, or should not, or untagged`,
+        message: `${file}: the body needs code, in a fence under a Must, Never, Should, or Should not heading, or untagged`,
       });
     }
     return { ...front, ...code };

package/src/mechanical.ts

@@ -1,5 +1,5 @@
 import type { Rule } from "#config.ts";
-import type { RuleEntry } from "#rules.ts";
+import { type RuleEntry, shownId } from "#rules.ts";
 import { AuditCache, sha256, type Tally } from "#services/AuditCache.ts";
 import { linterQuestion } from "#services/Jev.ts";
 import { Effect } from "effect";
@@ -76,7 +76,7 @@ export const formatLinterCheck = (
       : [
           `${flagged.length} ${flagged.length === 1 ? "rule" : "rules"} flagged by the linter check:`,
           ...flagged.flatMap((one) => [
-            `  ${one.entry.id}${one.entry.file === undefined ? "" : ` (${displayPath(one.entry.file, root)})`}`,
+            `  ${shownId(one.entry)}${one.entry.file === undefined ? "" : ` (${displayPath(one.entry.file, root)})`}`,
             `    ${adviceOf(one)}`,
           ]),
         ]),

package/src/models/Audit.ts

@@ -3,6 +3,8 @@ import { Schema } from "effect";
 export interface ScannedFile {
   readonly path: string;
   readonly lines: ReadonlyArray<string>;
+  /** A test file, which only the rules that say `tests` judge. */
+  readonly test?: boolean;
 }
 
 /** A source walker's refusal: the tree it was asked to read is not readable. */

package/src/presets.ts

@@ -4,10 +4,13 @@ import type { Preset } from "#config.ts";
  * `presets/` sits next to `src/` in a checkout. In a compiled executable
  * (`bun build --compile --asset ./presets`) Bun embeds it under the bundle's
  * own directory instead, hence the fork on `Bun.isStandaloneExecutable`, which
- * is the check Bun's docs give for this. Measured on Bun 1.4. The `typeof`
- * guard is for Vitest, which imports this module on Node.
+ * is the check Bun's docs give for this. Measured on Bun 1.4. It is read off
+ * `globalThis` for Vitest, which imports this module on Node, and for a
+ * project that type-checks this package's source without Bun's types.
  */
-const isStandaloneExecutable = typeof Bun !== "undefined" && Bun.isStandaloneExecutable;
+const isStandaloneExecutable =
+  (globalThis as { readonly Bun?: { readonly isStandaloneExecutable?: boolean } }).Bun
+    ?.isStandaloneExecutable === true;
 
 const presetsRoot = isStandaloneExecutable
   ? new URL("./presets/", import.meta.url)
@@ -57,4 +60,7 @@ export const presets: Readonly<Record<WholePreset, BuiltInPreset>> = {
 };
 
 /** The directory each whole preset reads, for checking `topics` against it. */
+/** The whole preset a name belongs to: effect, for effect and for effect/basics alike. */
+export const wholePresetOf = (name: PresetName): string => name.split("/")[0] ?? name;
+
 export const topicsOf = (preset: WholePreset): ReadonlyArray<string> => topics[preset];

package/src/pricing.ts

@@ -0,0 +1,14 @@
+/**
+ * Jev's price for input tokens, in dollars per million, by the name a config
+ * sends as its model. Output tokens are free. From TypeSafe AI's models page,
+ * https://docs.typesafe.ai/models, on 2026-09-25, when jev-latest and
+ * jev-preview both pointed to jev-1.13.0.
+ */
+const DOLLARS_PER_MILLION: Readonly<Record<string, number>> = {
+  "jev-1.13.0": 0.042,
+  "jev-latest": 0.042,
+  "jev-preview": 0.042,
+};
+
+/** The model's price per million input tokens, when adhere knows it. */
+export const priceOf = (model: string): number | undefined => DOLLARS_PER_MILLION[model];

package/src/rules.ts

@@ -1,5 +1,6 @@
 import {
   ConfigUnavailable,
+  type Override,
   type Rule,
   type RuleId,
   type RuleSource,
@@ -20,10 +21,21 @@ export interface RuleEntry {
   readonly rule: Rule;
   readonly scope: string;
   readonly file?: string;
-  /** The built-in rule set the rule came from, when it is not the project's own. */
+  /** The built-in preset the rule came from, by its whole name (effect for effect/basics), when it is not the project's own. */
   readonly preset?: string;
 }
 
+/**
+ * A rule's id as output shows it: a preset's rule with the preset's name
+ * first, as in effect/basics/external-calls-are-resilient, so a report that
+ * mixes presets with the project's own rules says where each came from. The
+ * project's own rules show their `.adhere/` ids as they are.
+ */
+export const shownId = (entry: {
+  readonly id: RuleId;
+  readonly preset?: string | undefined;
+}): string => (entry.preset === undefined ? entry.id : `${entry.preset}/${entry.id}`);
+
 export type RuleSet = ReadonlyArray<RuleEntry>;
 
 const ADHERE_SEGMENT = ".adhere";
@@ -161,6 +173,36 @@ export const materializeRules = Effect.fn("materializeRules")(function* (
 export const globalRuleSet = (rules: Readonly<Record<RuleId, Rule>>, root: string) =>
   Object.entries(rules).map(([id, rule]): RuleEntry => ({ id, rule, scope: root }));
 
+/**
+ * The rules as a config's overrides leave them, each found by the id a report
+ * names it with: a rule set `off` gone, and any other with the level and
+ * threshold its override gives, over its own.
+ */
+export const withOverrides = (
+  entries: RuleSet,
+  overrides: Readonly<Record<string, Override>>,
+): RuleSet =>
+  entries.flatMap((entry) => {
+    const override = overrides[shownId(entry)];
+    if (override === undefined) return [entry];
+    const { level, threshold }: Exclude<Override, string> =
+      typeof override === "string" ? { level: override } : override;
+    if (level === "off") return [];
+    const rule: Rule = {
+      ...entry.rule,
+      ...(level === undefined ? {} : { level }),
+      ...(threshold === undefined ? {} : { threshold }),
+    };
+    return [{ ...entry, rule }];
+  });
+
+/**
+ * Whether a rule judges a file: a test file only when the rule says `tests`,
+ * and any other file unless it says `tests: only`.
+ */
+export const judgesFile = (rule: Rule, test: boolean): boolean =>
+  test ? rule.tests !== undefined : rule.tests !== "only";
+
 /**
  * The flat rule map for one source file. Root rules apply everywhere. When a
  * nested `.adhere/` defines the same id, the deepest matching scope wins.

package/src/services/AdhereConfig.ts

@@ -1,23 +1,25 @@
 import {
   ADHERE_DIRECTORY,
-  type AdhereConfig as Decoded,
+  AdhereConfig as AdhereConfigSchema,
   CONFIG_FILES,
   ConfigUnavailable,
   decodeConfig,
   type Loaded,
-  type Overrides,
+  type Flags,
   type Preset,
   presetsOf,
   type ResolvedConfig,
   resolveConfig,
 } from "#config.ts";
-import { type PresetName, presetOf } from "#presets.ts";
+import { type PresetName, presetOf, presets, wholePresetOf } from "#presets.ts";
 import {
   applicableRules,
   globalRuleSet,
   loadAdhereRuleSet,
   materializeRules,
   type RuleSet,
+  shownId,
+  withOverrides,
 } from "#rules.ts";
 import { Context, Effect, FileSystem, Layer, Path, Record } from "effect";
 
@@ -50,13 +52,23 @@ const loadPreset = Effect.fn("AdhereConfig.loadPreset")(function* (name: PresetN
   return [name, { ...preset, rules } satisfies Loaded<Preset>] as const;
 });
 
+/** Every rule of every built-in preset, by the id a report names it with. */
+const everyPresetRule = Effect.fn("AdhereConfig.everyPresetRule")(function* (base: string) {
+  const loaded = yield* Effect.forEach(Object.entries(presets), ([name, preset]) =>
+    Effect.map(materializeRules(preset.rules, base), (rules) =>
+      Object.keys(rules).map((id) => `${name}/${id}`),
+    ),
+  );
+  return new Set(loaded.flat());
+});
+
 /**
  * The config file in the working directory (one of `CONFIG_FILES`) with the
- * command-line overrides applied. The file is optional when `.adhere/` holds
+ * command-line flags applied. The file is optional when `.adhere/` holds
  * rules or a preset is named. Rule directories resolve against the working
  * directory.
  */
-export const AdhereConfigLive = (overrides: Overrides) =>
+export const AdhereConfigLive = (flags: Flags) =>
   Layer.effect(AdhereConfig)(
     Effect.gen(function* () {
       const path = yield* Path.Path;
@@ -73,8 +85,8 @@ export const AdhereConfigLive = (overrides: Overrides) =>
         });
       }
       const configFile = found[0];
-      const hasPreset = overrides.presets !== undefined && overrides.presets.length > 0;
-      const config: Decoded =
+      const hasPreset = flags.presets !== undefined && flags.presets.length > 0;
+      const config: typeof AdhereConfigSchema.Type =
         configFile === undefined
           ? yield* decodeConfig({})
           : yield* loadConfigFile(path.join(cwd, configFile));
@@ -90,19 +102,33 @@ export const AdhereConfigLive = (overrides: Overrides) =>
           ? discoveredEntries
           : globalRuleSet(yield* materializeRules(config.rules ?? {}, cwd), cwd);
       const rules = applicableRules(cwd, projectEntries);
-      const registry = yield* Effect.forEach(presetsOf(config, overrides), (name) =>
+      const registry = yield* Effect.forEach(presetsOf(config, flags), (name) =>
         loadPreset(name, cwd),
       ).pipe(Effect.map(Record.fromEntries));
-      const resolved = resolveConfig({ ...config, rules }, overrides, registry);
+      const resolved = resolveConfig({ ...config, rules }, flags, registry);
       const presetEntries = Object.entries(registry).flatMap(([name, preset]) =>
-        globalRuleSet(preset.rules, cwd).map((entry) => ({ ...entry, preset: name })),
+        globalRuleSet(preset.rules, cwd).map((entry) => ({
+          ...entry,
+          preset: wholePresetOf(name as PresetName),
+        })),
       );
       yield* Effect.logDebug(
         `config: ${configFile ?? "no config file"}; presets ${Object.keys(registry).join(", ") || "none"}; ${presetEntries.length} preset and ${projectEntries.length} project rules; model ${resolved.model}, threshold ${resolved.threshold}${resolved.rpm === undefined ? "" : `, at most ${resolved.rpm} requests a minute`}`,
       );
-      return AdhereConfig.of({
-        ...resolved,
-        scopedRules: [...presetEntries, ...projectEntries],
-      });
+      const entries = [...presetEntries, ...projectEntries];
+      const overrides = config.overrides ?? {};
+      const loaded = new Set(entries.map(shownId));
+      const elsewhere = Object.keys(overrides).filter((id) => !loaded.has(id));
+      if (elsewhere.length > 0) {
+        // A rule of a preset this run leaves out may be overridden; one no rule has is a typo.
+        const every = yield* everyPresetRule(cwd);
+        const unknown = elsewhere.filter((id) => !every.has(id));
+        if (unknown.length > 0) {
+          return yield* ConfigUnavailable.make({
+            message: `overrides names ${unknown.join(", ")}, which is no preset or project rule. A preset's rule is named with its preset first, as in alchemy/providers/idempotent-delete.`,
+          });
+        }
+      }
+      return AdhereConfig.of({ ...resolved, scopedRules: withOverrides(entries, overrides) });
     }),
   );