@geonosis/doctor 1.2.0 → 1.4.0

package/dist/{chunk-ZJCUTDQW.js → chunk-R4OLFNI6.js}

@@ -23,19 +23,28 @@ var walk = (dir, onFile) => {
   }
 };
 var parse = (path) => JSON.parse(readFileSync(path, "utf8"));
+var stringsOf = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
+var rulesOf = (value) => typeof value === "object" && value !== null ? value : {};
+var overridesOf = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "object" && one !== null).map((one) => ({ files: stringsOf(one.files), rules: rulesOf(one.rules) })) : [];
 var readConfig = (path, root) => {
   const dir = join(path, "..");
   const relative = relativePath(root, path);
   try {
     const config = parse(path);
-    const jsPlugins = Array.isArray(config.jsPlugins) ? config.jsPlugins.filter((one) => typeof one === "string") : [];
-    const rules = typeof config.rules === "object" && config.rules !== null ? config.rules : {};
-    return { dir, jsPlugins, path, relative, rules };
+    return {
+      dir,
+      jsPlugins: stringsOf(config.jsPlugins),
+      overrides: overridesOf(config.overrides),
+      path,
+      relative,
+      rules: rulesOf(config.rules)
+    };
   } catch (error) {
     return {
       dir,
       error: `could not read it: ${error.message}`,
       jsPlugins: [],
+      overrides: [],
       path,
       relative,
       rules: {}
@@ -63,6 +72,14 @@ var discoverWorkspaces = (root) => {
   });
   return found.toSorted((a, b) => a.relative.localeCompare(b.relative));
 };
+var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+var testFilesUnder = (dir) => {
+  const found = [];
+  walk(dir, (path, name) => {
+    if (TEST_FILE.test(name)) found.push(path);
+  });
+  return found;
+};
 var readRatchet = (root) => {
   const path = join(root, RATCHET_FILE);
   try {
@@ -308,6 +325,7 @@ var CHECKS = [
   "exercised",
   "baseline",
   "runner",
+  "envelope",
   "drift",
   "observability",
   "deployed"
@@ -324,7 +342,28 @@ import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync
 import { createRequire } from "module";
 import { dirname, join as join3 } from "path";
 import { pathToFileURL } from "url";
-var resolveFrom = (dir, specifier) => createRequire(join3(dir, "noop.js")).resolve(specifier);
+var packageNameOf = (specifier) => {
+  const parts2 = specifier.split("/");
+  return specifier.startsWith("@") ? parts2.slice(0, 2).join("/") : parts2[0] ?? specifier;
+};
+var resolveFrom = (dir, specifier) => {
+  if (specifier.startsWith(".") || specifier.startsWith("/")) {
+    return createRequire(join3(dir, "noop.js")).resolve(specifier);
+  }
+  const name = packageNameOf(specifier);
+  let at = dir;
+  for (; ; ) {
+    if (existsSync2(join3(at, "node_modules", name, "package.json"))) {
+      return createRequire(join3(at, "noop.js")).resolve(specifier);
+    }
+    const parent = dirname(at);
+    if (parent === at) break;
+    at = parent;
+  }
+  throw new DoctorError(
+    `${specifier} does not resolve from ${dir} \u2014 no node_modules on the way up carries ${name}`
+  );
+};
 var packageDirOf = (entry, name) => {
   let dir = dirname(entry);
   for (; ; ) {
@@ -353,13 +392,17 @@ var pluginVersionOf = async (entry) => {
   }
   return version;
 };
+var filesOf = (answer) => Array.isArray(answer.files) ? answer.files : [answer];
 var probesOf = async (entry, plugin) => {
   const loaded = await import(pathToFileURL(entry).href);
   return Object.fromEntries(
-    Object.entries(loaded.default?.rules ?? {}).filter(([, rule]) => typeof rule?.probe === "function").map(([name, rule]) => [
-      `${plugin}/${name}`,
-      rule.probe
-    ])
+    Object.entries(loaded.default?.rules ?? {}).filter(([, rule]) => typeof rule?.probe === "function").map(([name, rule]) => {
+      const declared = rule.probe;
+      return [
+        `${plugin}/${name}`,
+        (options) => filesOf(declared(options))
+      ];
+    })
   );
 };
 var corpusOfPlugin = (from, specifier) => join3(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
@@ -373,15 +416,80 @@ var real = (path) => {
 var relativeToRoot = (root, path) => relativePath(real(root), real(path));
 
 // src/drift.ts
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { closeSync, existsSync as existsSync3, openSync, readdirSync as readdirSync2, readFileSync as readFileSync4, readSync } from "fs";
+import { homedir } from "os";
 import { join as join4, sep as sep2 } from "path";
+
+// src/overrides.ts
+var SPECIAL = /* @__PURE__ */ new Set(["$", "(", ")", "+", ".", "/", "@", "\\", "^", "|"]);
+var globToRegExp = (glob) => {
+  let source = "";
+  for (let at = 0; at < glob.length; at += 1) {
+    const character = glob[at] ?? "";
+    if (character === "*") {
+      if (glob[at + 1] === "*") {
+        if (glob[at + 2] === "/") {
+          source += "(?:[^/]*/)*";
+          at += 2;
+        } else {
+          source += ".*";
+          at += 1;
+        }
+      } else {
+        source += "[^/]*";
+      }
+      continue;
+    }
+    if (character === "?") {
+      source += "[^/]";
+      continue;
+    }
+    if (character === "{") {
+      source += "(?:";
+      continue;
+    }
+    if (character === "}") {
+      source += ")";
+      continue;
+    }
+    if (character === ",") {
+      source += "|";
+      continue;
+    }
+    source += SPECIAL.has(character) ? `\\${character}` : character;
+  }
+  return new RegExp(`^${source}$`);
+};
+var matchesGlob = (glob, path) => {
+  const here = globToRegExp(glob);
+  const name = path.slice(path.lastIndexOf("/") + 1);
+  return here.test(path) || !glob.includes("/") && here.test(name);
+};
+var layersOf = (config, rule) => {
+  const layers = [];
+  if (rule in config.rules) layers.push({ files: [], level: config.rules[rule] });
+  for (const override of config.overrides ?? []) {
+    if (rule in override.rules) layers.push({ files: override.files, level: override.rules[rule] });
+  }
+  return layers;
+};
+var governing = (layers, path) => {
+  let found;
+  for (const layer of layers) {
+    if (layer.files.length === 0 || layer.files.some((glob) => matchesGlob(glob, path))) {
+      found = layer;
+    }
+  }
+  return found;
+};
+
+// src/drift.ts
 var WORKFLOWS = ".github/workflows";
 var SETTINGS = ".claude/settings.json";
 var GEONOSIS = "geonosis.json";
 var LAW = "CLAUDE.md";
 var CEILING = 200;
 var SWITCHED_OFF = /^\s*if:\s*(?:\$\{\{\s*)?false\b/m;
-var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var finding3 = (subject, verdict, message) => ({
   check: "drift",
   message,
@@ -427,7 +535,7 @@ var holds = (parent, child) => child === parent || child.startsWith(`${parent}${
 var ownersOf = (path, workspaces) => workspaces.filter((one) => holds(one.dir, path)).toSorted((a, b) => b.dir.length - a.dir.length);
 var orphanTests = (root, workspaces) => {
   const orphaned = /* @__PURE__ */ new Map();
-  for (const path of filesUnder(root, (name) => TEST_FILE.test(name))) {
+  for (const path of testFilesUnder(root)) {
     const owners = ownersOf(path, workspaces);
     if (owners.some((one) => typeof one.manifest.scripts?.test === "string")) continue;
     const owner = owners[0];
@@ -446,6 +554,170 @@ var orphanTests = (root, workspaces) => {
     )
   );
 };
+var RUNS_A_FILE = /* @__PURE__ */ new Set(["bun", "node", "tsx"]);
+var BETWEEN_COMMANDS = /(?:&&|\|\||[;|&()])/;
+var NAMES_A_FILE = /\.[cm]?[jt]sx?$/;
+var SHELL_WOULD_REWRITE = /[$*?{}]/;
+var pathRunBy = (segment) => {
+  const words = segment.trim().split(/\s+/).filter((word) => word !== "");
+  for (const [index, word] of words.entries()) {
+    if (!RUNS_A_FILE.has(word)) continue;
+    const argument = words.slice(index + 1).find((one) => !one.startsWith("-"));
+    if (argument === void 0 || SHELL_WOULD_REWRITE.test(argument)) continue;
+    if (NAMES_A_FILE.test(argument)) return argument;
+  }
+  return void 0;
+};
+var pathsRunByScript = (script) => script.split(BETWEEN_COMMANDS).map(pathRunBy).filter((one) => one !== void 0);
+var scriptPaths = (workspaces) => {
+  const missing = workspaces.flatMap(
+    (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
+      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync3(join4(one.dir, path))).map((path) => ({ name, path, workspace: one }))
+    )
+  );
+  if (missing.length === 0) {
+    return [
+      finding3("script paths", "OK", "every file a script hands to bun, node or tsx is on disk")
+    ];
+  }
+  return missing.map(
+    ({ name, path, workspace }) => finding3(
+      workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`,
+      "FAIL",
+      `the "${name}" script runs ${path} and there is no such file \u2014 this script fails at that command, and every gate that calls it has been running nothing since the file went`
+    )
+  );
+};
+var workspaceBins = (workspaces) => {
+  const found = /* @__PURE__ */ new Map();
+  for (const one of workspaces) {
+    const declared = one.manifest.bin;
+    if (typeof declared === "string") {
+      const name = one.manifest.name;
+      if (name !== void 0) found.set(name.replace(/^@[^/]+\//, ""), one);
+      continue;
+    }
+    for (const name of Object.keys(declared ?? {})) found.set(name, one);
+  }
+  return found;
+};
+var linkedBins = (root, workspaces) => {
+  const bins = workspaceBins(workspaces);
+  if (bins.size === 0) {
+    return [finding3("workspace bins", "SKIP", "no workspace here declares a bin")];
+  }
+  const missing = workspaces.flatMap(
+    (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
+      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter((name) => !existsSync3(join4(root, "node_modules/.bin", name))).map((name) => ({ name, script, workspace: one }))
+    )
+  );
+  if (missing.length === 0) {
+    return [
+      finding3(
+        "workspace bins",
+        "OK",
+        "every workspace bin a script names is linked under the root"
+      )
+    ];
+  }
+  return missing.map(
+    ({ name, script, workspace }) => finding3(
+      name,
+      "FAIL",
+      `the "${script}" script in ${workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`} calls it, ${bins.get(name)?.manifest.name ?? "a workspace"} declares it, and node_modules/.bin/${name} is not there \u2014 add that package as a dependency of the one whose script calls it, so the package manager links the bin`
+    )
+  );
+};
+var SHELLS_TO_PNPM = /(?:^|[\s;&|(])pnpm(?:\s|$)/;
+var NODE_OPTIONS = /(?:^|[\s;&|(])NODE_OPTIONS=/;
+var preloadAroundPnpm = (root, workspaces) => {
+  const counters = (readRatchet(root)?.counters ?? []).filter(
+    (entry) => typeof entry.command === "string" && SHELLS_TO_PNPM.test(entry.command)
+  );
+  if (counters.length === 0) return [];
+  const scripts = workspaces.flatMap(
+    (one) => Object.entries(one.manifest.scripts ?? {}).filter(([, body]) => NODE_OPTIONS.test(body)).map(([name]) => one.relative === "" ? name : `${one.relative}:${name}`)
+  );
+  if (scripts.length === 0) return [];
+  const named2 = counters.map((entry) => typeof entry.key === "string" ? entry.key : String(entry.counter)).join(", ");
+  const some = scripts.slice(0, 3).join(", ");
+  const rest = scripts.length > 3 ? ` and ${scripts.length - 3} more` : "";
+  return [
+    finding3(
+      "NODE_OPTIONS",
+      "WARN",
+      `${scripts.length} script(s) preload something through NODE_OPTIONS (${some}${rest}), and the "${named2}" counter(s) shell out to pnpm \u2014 a nested pnpm INHERITS the option and dies on it (a preloaded resolver patch sends it looking for a .pnpmfile.mjs that is not there). Run the ratchet outside those scripts, or unset NODE_OPTIONS for the nested call: env -u NODE_OPTIONS pnpm \u2026`
+    )
+  ];
+};
+var GATED_BY = /geonosis:gated-by:\s*(.+?)\s*(?:-->|\*\/|$)/m;
+var GENERATED_BY = /Generated by\s+`([^`]+)`/m;
+var CAN_CARRY_A_MARKER = /\.(?:mdc?|markdown|ya?ml|toml|[cm]?[jt]sx?|json[c5]?|txt|sh|mjs|cjs)$/i;
+var HEAD_BYTES = 4096;
+var markerIn = (path) => {
+  let handle;
+  try {
+    handle = openSync(path, "r");
+  } catch {
+    return void 0;
+  }
+  try {
+    const buffer = Buffer.alloc(HEAD_BYTES);
+    const read = readSync(handle, buffer, 0, HEAD_BYTES, 0);
+    const head = buffer.toString("utf8", 0, read);
+    const gate = GATED_BY.exec(head)?.[1];
+    if (gate !== void 0) return { gate };
+    const writer = GENERATED_BY.exec(head)?.[1];
+    return writer === void 0 ? void 0 : { writer };
+  } catch {
+    return void 0;
+  } finally {
+    closeSync(handle);
+  }
+};
+var everythingRun = (root, workspaces) => {
+  const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
+  const counters = (readRatchet(root)?.counters ?? []).map((entry) => String(entry.command ?? ""));
+  const workflows = filesUnder(
+    join4(root, WORKFLOWS),
+    (name) => name.endsWith(".yml") || name.endsWith(".yaml")
+  ).map((path) => {
+    try {
+      return readFileSync4(path, "utf8");
+    } catch {
+      return "";
+    }
+  });
+  return [...scripts, ...counters, ...workflows].join("\n");
+};
+var generatedFiles = (root, workspaces) => {
+  const marked = filesUnder(root, (name) => CAN_CARRY_A_MARKER.test(name)).map((path) => ({ marker: markerIn(path), path })).filter((one) => one.marker !== void 0);
+  if (marked.length === 0) {
+    return [
+      finding3(
+        "generated files",
+        "SKIP",
+        "nothing here says it was generated, so there is no write half here to look for a read half of"
+      )
+    ];
+  }
+  const run = everythingRun(root, workspaces);
+  return marked.map(({ marker, path }) => {
+    const at = relativePath(root, path);
+    if (!("gate" in marker)) {
+      return finding3(
+        at,
+        "FAIL",
+        `generated by \`${marker.writer}\` and it names no gate that reads it back. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Re-run \`${marker.writer}\` on a version that writes the \`geonosis:gated-by:\` marker, and run the gate it names`
+      );
+    }
+    return run.includes(marker.gate) ? finding3(at, "OK", `generated, and \`${marker.gate}\` reads it back`) : finding3(
+      at,
+      "FAIL",
+      `generated, and nothing here runs \`${marker.gate}\` \u2014 the gate it names. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Add \`${marker.gate}\` to a script, a counter or a workflow`
+    );
+  });
+};
 var readGeonosis = (root) => {
   const path = join4(root, GEONOSIS);
   if (!existsSync3(path)) return void 0;
@@ -458,13 +730,22 @@ var readGeonosis = (root) => {
 var law = (root, config) => {
   const declared = config?.law ?? {};
   const file = typeof declared.file === "string" ? declared.file : LAW;
-  const ceiling = typeof declared.maxLines === "number" ? declared.maxLines : CEILING;
   const path = join4(root, file);
   if (!existsSync3(path)) {
     return [finding3(file, "SKIP", "there is no law file here to measure")];
   }
   const source = readFileSync4(path, "utf8");
   const lines = source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
+  if (typeof declared.maxLines !== "number") {
+    return [
+      finding3(
+        file,
+        "SKIP",
+        `${lines} lines, and no ceiling to measure them against \u2014 set law.maxLines in geonosis.json to have this asked (${CEILING} is what both source repos converged on)`
+      )
+    ];
+  }
+  const ceiling = declared.maxLines;
   return [
     lines > ceiling ? finding3(
       file,
@@ -473,20 +754,40 @@ var law = (root, config) => {
     ) : finding3(file, "OK", `${lines} lines, under the ceiling of ${ceiling}`)
   ];
 };
-var hooks = (root) => {
+var KIT_PLUGIN = "geonosis";
+var enablesKit = (path) => {
+  if (!existsSync3(path)) return false;
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const enabled = parsed.enabledPlugins;
+    if (typeof enabled !== "object" || enabled === null) return false;
+    return Object.entries(enabled).some(
+      ([id, on]) => on !== false && id.split("@")[0] === KIT_PLUGIN
+    );
+  } catch {
+    return false;
+  }
+};
+var hooks = (root, userSettings) => {
   const path = join4(root, SETTINGS);
-  if (!existsSync3(path)) {
+  if (enablesKit(path)) {
+    return [finding3(SETTINGS, "OK", `\`enabledPlugins\` here enables the kit\u2019s plugin`)];
+  }
+  if (enablesKit(userSettings)) {
     return [
       finding3(
         SETTINGS,
-        "WARN",
-        "nothing here installs the kit\u2019s plugin, so none of the hooks, agents or skills reach this repo \u2014 the gates run, the method does not"
+        "OK",
+        `installed elsewhere \u2014 not this repo\u2019s to declare: \`enabledPlugins\` in ${userSettings} enables it for every repo on this machine`
       )
     ];
   }
-  const source = readFileSync4(path, "utf8");
   return [
-    source.includes("geonosis") ? finding3(SETTINGS, "OK", "it installs the kit\u2019s plugin") : finding3(SETTINGS, "WARN", "it names no geonosis plugin or marketplace")
+    finding3(
+      SETTINGS,
+      "WARN",
+      `nothing enables the kit\u2019s plugin, so none of the hooks, agents or skills reach this repo \u2014 the gates run, the method does not. What satisfies this: a "geonosis@<marketplace>" entry under \`enabledPlugins\` in ${SETTINGS} here, or the same in the user-scope ${userSettings}`
+    )
   ];
 };
 var READERS = {
@@ -504,7 +805,17 @@ var resolves = (root, name) => {
     return false;
   }
 };
-var blocks = (root, config, readers) => {
+var declaredAnywhere = (workspaces) => new Set(
+  workspaces.flatMap(
+    (one) => [
+      one.manifest.dependencies,
+      one.manifest.devDependencies,
+      one.manifest.optionalDependencies,
+      one.manifest.peerDependencies
+    ].flatMap((field) => Object.keys(field ?? {}))
+  )
+);
+var blocks = (root, config, readers, workspaces) => {
   if (config === void 0) {
     return [
       finding3(
@@ -514,19 +825,30 @@ var blocks = (root, config, readers) => {
       )
     ];
   }
+  const declaredPackages = declaredAnywhere(workspaces);
   return Object.entries(readers).flatMap(([block, name]) => {
     const declared = config[block] !== void 0;
+    const chosen = declaredPackages.has(name);
     const installed = resolves(root, name);
+    if (declared && !chosen) {
+      return [
+        finding3(
+          name,
+          "WARN",
+          `geonosis.json has a "${block}" block and no manifest here declares ${name} \u2014 nothing reads it${installed ? ", and the copy still under node_modules is what a stale install left behind" : ""}`
+        )
+      ];
+    }
     if (declared && !installed) {
       return [
         finding3(
           name,
           "WARN",
-          `geonosis.json has a "${block}" block and ${name} is not installed here \u2014 nothing reads it`
+          `geonosis.json has a "${block}" block, a manifest declares ${name}, and it does not resolve here \u2014 run the install`
         )
       ];
     }
-    if (!declared && installed) {
+    if (!declared && chosen && installed) {
       return [
         finding3(
           name,
@@ -535,29 +857,54 @@ var blocks = (root, config, readers) => {
         )
       ];
     }
+    if (!declared && installed) {
+      return [
+        finding3(
+          name,
+          "OK",
+          `${name} is here but no manifest declares it \u2014 a transitive dependency this repo did not choose, so it wants no "${block}" block`
+        )
+      ];
+    }
     return declared ? [finding3(name, "OK", `a "${block}" block, and ${name} to read it`)] : [];
   });
 };
-var pluginDirsConfigured = (root) => {
+var PLUGIN_DIR_RULE = "biological-architecture/no-unregistered-plugin-dir";
+var registryList = (value) => {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value) && value.every((one) => typeof one === "string")) return value;
+  return void 0;
+};
+var pluginDirsOf = (level) => {
+  const options = Array.isArray(level) ? level[1] : void 0;
+  const registry = registryList(options?.registry);
+  if (options?.roots === void 0 || registry === void 0) return void 0;
+  return { manifests: options.manifests ?? ["index.ts"], registry, roots: options.roots };
+};
+var pluginDirLayers = (root) => {
   const path = join4(root, ".oxlintrc.json");
-  if (!existsSync3(path)) return void 0;
-  try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
-    const rule = parsed.rules?.["biological-architecture/no-unregistered-plugin-dir"];
-    const options = Array.isArray(rule) ? rule[1] : void 0;
-    if (options?.roots === void 0 || typeof options.registry !== "string") return void 0;
-    return {
-      manifests: options.manifests ?? ["index.ts"],
-      registry: options.registry,
-      roots: options.roots
-    };
-  } catch {
-    return void 0;
+  if (!existsSync3(path)) return [];
+  const layers = [];
+  for (const layer of layersOf(readConfig(path, root), PLUGIN_DIR_RULE)) {
+    const dirs = pluginDirsOf(layer.level);
+    if (dirs !== void 0) layers.push({ dirs, files: layer.files });
   }
+  return layers;
+};
+var layerOver = (layers, root, relative) => {
+  const at = join4(root, relative);
+  const inside = readdirSync2(at, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => `${relative}/${entry.name}`);
+  const paths = inside.length === 0 ? [relative] : inside;
+  const wrapped = layers.map((layer) => ({ files: layer.files, level: layer.dirs }));
+  for (const path of paths) {
+    const found = governing(wrapped, path);
+    if (found !== void 0) return found.level;
+  }
+  return void 0;
 };
 var pluginDirs = (root) => {
-  const configured = pluginDirsConfigured(root);
-  if (configured === void 0) {
+  const layers = pluginDirLayers(root);
+  if (layers.length === 0) {
     return [
       finding3(
         "plugin directories",
@@ -566,64 +913,279 @@ var pluginDirs = (root) => {
       )
     ];
   }
-  const registryPath = join4(root, configured.registry);
-  if (!existsSync3(registryPath)) {
-    return [finding3(configured.registry, "FAIL", "the registry the rule names is not there")];
+  const missing = [...new Set(layers.flatMap((layer) => layer.dirs.registry))].filter(
+    (registry) => !existsSync3(join4(root, registry))
+  );
+  if (missing.length > 0) {
+    return missing.map(
+      (registry) => finding3(registry, "FAIL", "the registry the rule names is not there")
+    );
   }
-  const registry = readFileSync4(registryPath, "utf8");
-  const unreachable = [];
-  for (const rootDir of configured.roots) {
+  const source = /* @__PURE__ */ new Map();
+  const unreachable = /* @__PURE__ */ new Map();
+  for (const rootDir of new Set(layers.flatMap((layer) => layer.dirs.roots))) {
     const at = join4(root, rootDir);
     if (!existsSync3(at)) continue;
     for (const entry of readdirSync2(at, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      const hasManifest = configured.manifests.some(
-        (name) => existsSync3(join4(at, entry.name, name))
+      const relative = `${rootDir}/${entry.name}`;
+      const governs = layerOver(layers, root, relative);
+      if (governs === void 0) continue;
+      const key = governs.registry.join(", ");
+      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync4(join4(root, half), "utf8")).join("\n");
+      source.set(key, registry);
+      const hasManifest = governs.manifests.some((name) => existsSync3(join4(at, entry.name, name)));
+      if (!hasManifest || registry.includes(entry.name)) continue;
+      unreachable.set(key, [...unreachable.get(key) ?? [], relative]);
+    }
+  }
+  return [...source.keys()].toSorted().map((registry) => {
+    const named2 = unreachable.get(registry) ?? [];
+    return named2.length === 0 ? finding3(registry, "OK", "every directory under the declared roots is named by it") : finding3(
+      registry,
+      "FAIL",
+      `${named2.length} directory(ies) it never names: ${named2.join(", ")}`
+    );
+  });
+};
+var WORKSPACE_YAML = "pnpm-workspace.yaml";
+var HOIST_KEY = "publicHoistPattern";
+var HOIST_REPAIR = "rm -rf node_modules/.modules.yaml node_modules/.pnpm-workspace-state-v1.json && pnpm install";
+var hoistPatterns = (root) => {
+  const path = join4(root, WORKSPACE_YAML);
+  if (!existsSync3(path)) return void 0;
+  const lines = readFileSync4(path, "utf8").split("\n");
+  const at = lines.findIndex((line) => new RegExp(`^${HOIST_KEY}\\s*:`).test(line));
+  if (at < 0) return void 0;
+  const patterns = [];
+  for (const line of lines.slice(at + 1)) {
+    if (/^\s*(?:#.*)?$/.test(line)) continue;
+    const item = /^\s+-\s*(.+?)\s*$/.exec(line);
+    if (item?.[1] === void 0) break;
+    patterns.push(item[1].replace(/^['"]|['"]$/g, ""));
+  }
+  return patterns;
+};
+var matching = (pattern) => new RegExp(`^${pattern.replaceAll(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*")}$`);
+var publicHoists = (root, workspaces) => {
+  const patterns = hoistPatterns(root);
+  if (patterns === void 0) {
+    return [
+      finding3(
+        WORKSPACE_YAML,
+        "SKIP",
+        `no ${HOIST_KEY} is declared here, so nothing claims a package should be linked at the root`
+      )
+    ];
+  }
+  const named2 = workspaces.flatMap(
+    (one) => one.dir === root || one.manifest.name === void 0 ? [] : [one.manifest.name]
+  );
+  return patterns.map((pattern) => {
+    const shape = matching(pattern);
+    const hoisted = named2.filter((name) => shape.test(name));
+    if (hoisted.length === 0) {
+      return finding3(
+        pattern,
+        "SKIP",
+        `this ${HOIST_KEY} matches no workspace package here, so what it should have linked at the root is a question this cannot answer`
       );
-      if (hasManifest && !registry.includes(entry.name)) {
-        unreachable.push(`${rootDir}/${entry.name}`);
+    }
+    const pruned = hoisted.filter((name) => !existsSync3(join4(root, "node_modules", name)));
+    if (pruned.length === 0) {
+      return finding3(
+        pattern,
+        "OK",
+        `every workspace package this ${HOIST_KEY} matches is linked at the root`
+      );
+    }
+    return finding3(
+      pattern,
+      "FAIL",
+      `the ${HOIST_KEY} \`${pattern}\` has no root link for ${pruned.map((name) => `node_modules/${name}`).join(", ")} \u2014 pnpm prunes one during an unrelated add and then answers "Already up to date" over a clean git status forever. Repair: ${HOIST_REPAIR}`
+    );
+  });
+};
+var HOOK_FILES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"];
+var HOOK_DIRS = [".husky", ".githooks"];
+var VERSION_MANAGED = /(?:^|[\s;&|(])(?<runner>pnpm|npx|bunx|yarn)\b(?:\s+(?:exec|run|dlx|x))?\s+(?<bin>geonosis(?:-[a-z-]+)?)\b/;
+var NAMES_A_BIN = /(?:^|[\s;&|(/])geonosis(?:-[a-z-]+)?\b/;
+var hookLines = (root) => {
+  const found = [];
+  const read = (path) => {
+    const at = relativePath(root, path);
+    for (const line of readFileSync4(path, "utf8").split("\n")) {
+      if (line.trim() !== "") found.push({ at, line });
+    }
+  };
+  for (const name of HOOK_FILES) {
+    const path = join4(root, name);
+    if (existsSync3(path)) read(path);
+  }
+  for (const name of HOOK_DIRS) {
+    const dir = join4(root, name);
+    if (!existsSync3(dir)) continue;
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      if (entry.isFile() && !entry.name.startsWith("_") && !entry.name.startsWith(".")) {
+        read(join4(dir, entry.name));
       }
     }
   }
-  return [
-    unreachable.length === 0 ? finding3(
-      configured.registry,
-      "OK",
-      "every directory under the declared roots is named by it"
-    ) : finding3(
-      configured.registry,
-      "FAIL",
-      `${unreachable.length} directory(ies) it never names: ${unreachable.join(", ")}`
-    )
-  ];
+  return found;
+};
+var gitHooks = (root) => {
+  const lines = hookLines(root);
+  if (lines.length === 0) {
+    return [finding3("git hooks", "SKIP", "no lefthook, husky or .githooks file here to read")];
+  }
+  const files = [...new Set(lines.map((one) => one.at))].toSorted();
+  return files.flatMap((at) => {
+    const here = lines.filter((one) => one.at === at);
+    const named2 = here.filter((one) => NAMES_A_BIN.test(one.line));
+    if (named2.length === 0) {
+      return [finding3(at, "SKIP", "it names no geonosis bin, so there is nothing here to start")];
+    }
+    const wrong = named2.flatMap((one) => {
+      const found = VERSION_MANAGED.exec(one.line)?.groups;
+      return found === void 0 ? [] : [{ bin: found["bin"] ?? "", runner: found["runner"] ?? "" }];
+    });
+    if (wrong.length === 0) {
+      return [
+        finding3(
+          at,
+          "OK",
+          `${named2.length} geonosis bin(s) here, every one called directly rather than through a runner`
+        )
+      ];
+    }
+    return wrong.map(
+      ({ bin, runner }) => finding3(
+        at,
+        "FAIL",
+        `it runs ${bin} through ${runner} \u2014 a git hook's PATH is not the shell's and carries no version-manager shim, so ${runner} fails to START and what the author reads is its message, not this gate's. Call it directly: node_modules/.bin/${bin}`
+      )
+    );
+  });
 };
 var checkDrift = ({
   readers = READERS,
   root,
+  userSettings = join4(homedir(), SETTINGS),
   workspaces
 }) => {
   const config = readGeonosis(root);
   return [
     ...ci(root),
     ...orphanTests(root, workspaces),
+    ...scriptPaths(workspaces),
+    ...linkedBins(root, workspaces),
+    ...preloadAroundPnpm(root, workspaces),
+    ...generatedFiles(root, workspaces),
     ...pluginDirs(root),
+    ...publicHoists(root, workspaces),
+    ...gitHooks(root),
     ...law(root, config),
-    ...hooks(root),
-    ...blocks(root, config, readers)
+    ...hooks(root, userSettings),
+    ...blocks(root, config, readers, workspaces)
   ];
 };
 
+// src/envelope.ts
+import { existsSync as existsSync4, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
+var ENVELOPES_DIR = ".geonosis/envelopes";
+var NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one";
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var finding4 = (verdict, subject, message) => ({
+  check: "envelope",
+  message,
+  subject,
+  verdict
+});
+var lengthOf = (value) => Array.isArray(value) ? value.length : void 0;
+var NEXT = "Next: re-run the tool that wrote it and read the numbers it prints \u2014 a run that has lost count of its own inputs is a bug in that tool, not in this tree";
+var judge = (subject, name, parsed) => {
+  if (!isRecord2(parsed)) return finding4("FAIL", subject, `is not an object. ${NEXT}`);
+  const tool = parsed["tool"];
+  if (typeof tool !== "string" || tool.trim() === "") {
+    return finding4(
+      "FAIL",
+      subject,
+      `names no tool, so nothing here says which run it is about. ${NEXT}`
+    );
+  }
+  if (tool !== name) {
+    return finding4(
+      "FAIL",
+      subject,
+      `is written by "${tool}", not "${name}" \u2014 a tool writing another tool's envelope leaves both of their numbers unattributable. ${NEXT}`
+    );
+  }
+  const version = parsed["version"];
+  if (typeof version !== "string" || version.trim() === "") {
+    return finding4(
+      "FAIL",
+      subject,
+      `${tool}: names no version, so nothing dates this run and a stale envelope reads exactly like a fresh one. ${NEXT}`
+    );
+  }
+  const considered = parsed["considered"];
+  const read = parsed["read"];
+  const refused = lengthOf(parsed["refused"]);
+  const excused = lengthOf(parsed["excused"]);
+  if (typeof considered !== "number" || typeof read !== "number" || refused === void 0 || excused === void 0) {
+    return finding4(
+      "FAIL",
+      subject,
+      `${tool}: has no considered/read/refused/excused to check \u2014 the four numbers ARE the envelope, and a file without them measures nothing. ${NEXT}`
+    );
+  }
+  const accounted = read + refused + excused;
+  return considered === accounted ? finding4(
+    "OK",
+    subject,
+    `${tool} considered ${considered} and accounts for all of them \u2014 ${read} read + ${refused} refused + ${excused} excused`
+  ) : finding4(
+    "FAIL",
+    subject,
+    `${tool}: considered ${considered} but accounts for ${accounted} \u2014 ${read} read + ${refused} refused + ${excused} excused. It reported on fewer things than it was handed, and every verdict it printed is over the smaller number. ${NEXT}`
+  );
+};
+var checkEnvelopes = ({ root }) => {
+  const dir = join5(root, ENVELOPES_DIR);
+  const files = existsSync4(dir) ? readdirSync3(dir).filter((name) => name.endsWith(".json")).toSorted() : [];
+  if (files.length === 0) return [finding4("SKIP", ENVELOPES_DIR, NO_ENVELOPES)];
+  return files.map((name) => {
+    const subject = `${ENVELOPES_DIR}/${name}`;
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync5(join5(dir, name), "utf8"));
+    } catch (error) {
+      return finding4("FAIL", subject, `is not readable JSON: ${error.message}. ${NEXT}`);
+    }
+    return judge(subject, name.replace(/\.json$/, ""), parsed);
+  });
+};
+
 // src/exercised.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { cpSync, existsSync as existsSync4, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import {
+  cpSync,
+  existsSync as existsSync5,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync as readFileSync6,
+  rmSync,
+  writeFileSync
+} from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join6, resolve } from "path";
 import { corpusOf, readManifest } from "@geonosis/lint-parity";
 var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
 var severityOf = (level) => Array.isArray(level) ? level[0] : level;
 var enabledRulesOf = (rules, plugin) => Object.keys(rules).filter((id) => id.startsWith(`${plugin}/`) && !OFF.has(severityOf(rules[id]))).toSorted();
 var passes = (findings) => !findings.some((one) => one.verdict === "FAIL" || one.verdict === "UNJUDGED");
-var finding4 = (subject, verdict, message) => ({
+var finding5 = (subject, verdict, message) => ({
   check: "exercised",
   message,
   subject,
@@ -635,9 +1197,9 @@ var refusal = (error) => {
   return said.length > LIMIT ? `${said.slice(0, LIMIT)}\u2026` : said;
 };
 var reasonFrom = (config, oxlint) => {
-  const dir = mkdtempSync(join5(tmpdir(), "geonosis-doctor-why-"));
+  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-why-"));
   try {
-    const probe = join5(dir, "probe.tsx");
+    const probe = join6(dir, "probe.tsx");
     writeFileSync(probe, "export const probe = 1\n");
     const run = spawnSync2(
       oxlint,
@@ -672,7 +1234,52 @@ var ownReach = ({
   };
 };
 var optionsOf = (level) => Array.isArray(level) ? level.slice(1) : [];
-var under = (config, rule) => `${rule} under ${JSON.stringify(optionsOf(config.rules[rule]))}`;
+var optionSetsOf = (config, rule) => {
+  const seen = /* @__PURE__ */ new Set();
+  const sets = [];
+  for (const layer of layersOf(config, rule)) {
+    const options = [...optionsOf(layer.level)];
+    const key = JSON.stringify(options);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    sets.push(options);
+  }
+  return sets;
+};
+var enablingLayersOf = (config, rule) => {
+  const seen = /* @__PURE__ */ new Set();
+  const layers = [];
+  for (const layer of layersOf(config, rule)) {
+    if (OFF.has(severityOf(layer.level))) continue;
+    const options = [...optionsOf(layer.level)];
+    const key = JSON.stringify([layer.files, options]);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    layers.push({ files: layer.files, options });
+  }
+  return layers;
+};
+var under = (config, rule) => `${rule} under ${optionSetsOf(config, rule).map((options) => JSON.stringify(options)).join(" / ")}`;
+var enabledHere = (config, plugin) => [
+  .../* @__PURE__ */ new Set([
+    ...enabledRulesOf(config.rules, plugin),
+    ...config.overrides.flatMap((one) => enabledRulesOf(one.rules, plugin))
+  ])
+].toSorted();
+var concreteDirOf = (glob) => {
+  const segments = glob.split("/");
+  const out = [];
+  for (const segment of segments.slice(0, -1)) {
+    if (segment === "**") continue;
+    if (segment === "*") {
+      out.push("geonosis");
+      continue;
+    }
+    if (segment.includes("*") || segment.includes("{")) return void 0;
+    out.push(segment);
+  }
+  return out.join("/");
+};
 var throughProbes = ({
   config,
   corpus,
@@ -681,29 +1288,80 @@ var throughProbes = ({
   silent
 }) => {
   const refused = /* @__PURE__ */ new Map();
-  const dir = mkdtempSync(join5(tmpdir(), "geonosis-doctor-probe-"));
-  const here = join5(dir, "corpus");
+  const placed = /* @__PURE__ */ new Set();
+  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-probe-"));
+  const here = join6(dir, "corpus");
   try {
     cpSync(corpus, here, { recursive: true });
     for (const rule of silent) {
       const write = probes[rule];
       if (write === void 0) continue;
       try {
-        const probe = write(optionsOf(config.rules[rule]));
-        const at = join5(here, probe.path);
-        mkdirSync(dirname2(at), { recursive: true });
-        writeFileSync(at, probe.source);
+        const layers = enablingLayersOf(config, rule);
+        const unclaimed = [];
+        let anyPlaced = false;
+        for (const layer of layers) {
+          const files = write(layer.options);
+          if (files.length === 0) throw new Error("its probe declares no file at all");
+          const claims = layer.files.length === 0 || files.some((file) => layer.files.some((glob) => matchesGlob(glob, file.path)));
+          let mounted = files;
+          if (!claims) {
+            const rehomed = layer.files.map((glob) => {
+              const home = concreteDirOf(glob);
+              if (home === void 0) return void 0;
+              const extension = /^\*(\.[\w.]+)$/.exec(glob.split("/").at(-1) ?? "")?.[1];
+              const moved = files.map((file) => {
+                const base = file.path.split("/").at(-1) ?? file.path;
+                const adapted = extension === void 0 || base.endsWith(extension) ? base : base.replace(/\.[^.]+$/, extension);
+                const kept = layer.files.some((one) => matchesGlob(one, `${home}/${base}`));
+                return { ...file, path: `${home}/${kept ? base : adapted}` };
+              });
+              return moved.every((file) => layer.files.some((one) => matchesGlob(one, file.path))) ? moved : void 0;
+            }).find((moved) => moved !== void 0);
+            if (rehomed === void 0) {
+              unclaimed.push(
+                `its probe lands at ${files[0]?.path ?? ""}, which the entry enabling it claims none of (and no claimed path could be synthesized): ${layer.files.join(", ")}`
+              );
+              continue;
+            }
+            mounted = rehomed;
+          }
+          for (const file of mounted) {
+            const at2 = join6(here, file.path);
+            if (placed.has(at2)) continue;
+            placed.add(at2);
+            mkdirSync(dirname2(at2), { recursive: true });
+            writeFileSync(at2, file.source);
+          }
+          anyPlaced = true;
+        }
+        if (!anyPlaced) throw new Error(unclaimed.join(" \xB7 "));
       } catch (error) {
         refused.set(rule, String(error.message));
       }
     }
-    const reach = corpusOf({
-      configA: config.path,
-      configB: config.path,
-      corpus: here,
-      oxlint
-    }).reach;
-    return { fired: new Set(reach.filter((one) => one.firedInA).map((one) => one.rule)), refused };
+    const probeConfig = JSON.parse(readFileSync6(config.path, "utf8"));
+    const configDir = dirname2(config.path);
+    probeConfig.jsPlugins = (probeConfig.jsPlugins ?? []).map(
+      (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve(configDir, spec) : packageDirOf(resolveFrom(configDir, spec), spec)
+    );
+    const at = join6(here, ".oxlintrc-geonosis-probe.json");
+    writeFileSync(at, JSON.stringify(probeConfig, null, 2));
+    const run = spawnSync2(
+      oxlint,
+      ["-c", at, "--format", "json", "--no-ignore", "--disable-nested-config", here],
+      { cwd: dir, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
+    );
+    const fired = /* @__PURE__ */ new Set();
+    try {
+      const parsed = JSON.parse(run.stdout || "{}");
+      for (const one of parsed.diagnostics ?? []) {
+        const renamed = /^([\w@./-]+)\((.+)\)$/.exec(one.code ?? "");
+        if (renamed !== null) fired.add(`${renamed[1]}/${renamed[2]}`);
+      }
+    } catch {
+    }
+    return { fired, refused };
   } finally {
     rmSync(dir, { force: true, recursive: true });
   }
@@ -716,14 +1374,14 @@ var checkExercised = async ({
   repoCorpus,
   root
 }) => {
-  const said = (verdict, message) => finding4(config.relative, verdict, message);
-  if (repoCorpus !== void 0 && !existsSync4(repoCorpus)) {
+  const said = (verdict, message) => finding5(config.relative, verdict, message);
+  if (repoCorpus !== void 0 && !existsSync5(repoCorpus)) {
     return said(
       "FAIL",
       `geonosis.json declares a reach corpus at ${relativeToRoot(root, repoCorpus)} and there is nothing there \u2014 a corpus that cannot be read is a claim, not evidence`
     );
   }
-  if (!existsSync4(corpus)) {
+  if (!existsSync5(corpus)) {
     return said(
       "SKIP",
       `the plugin loaded from here ships no corpus at ${relativeToRoot(root, corpus)} \u2014 nothing declares which rules it can be evidence about`
@@ -735,7 +1393,7 @@ var checkExercised = async ({
   } catch (error) {
     return said("SKIP", refusal(error));
   }
-  const enabled = enabledRulesOf(config.rules, manifest.plugin);
+  const enabled = enabledHere(config, manifest.plugin);
   if (enabled.length === 0) return said("SKIP", `no ${manifest.plugin} rule is enabled here`);
   let reach;
   try {
@@ -774,7 +1432,8 @@ var checkExercised = async ({
   if (silent.length === 0) {
     return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where}`);
   }
-  const probes = entry === void 0 ? {} : await probesOf(entry, manifest.plugin).catch(() => ({}));
+  const loadedProbes = entry === void 0 ? null : await probesOf(entry, manifest.plugin).catch(() => null);
+  const probes = loadedProbes ?? {};
   const declared = silent.filter((rule) => probes[rule] !== void 0);
   const unprobed = silent.filter((rule) => probes[rule] === void 0);
   let probed = { fired: /* @__PURE__ */ new Set(), refused: /* @__PURE__ */ new Map() };
@@ -794,13 +1453,18 @@ var checkExercised = async ({
       `${countOf(placed, "fire")} nowhere in the corpus and nothing through the probe each declares either: ${named(placed.map((rule) => under(config, rule)))}`
     );
   }
-  const unplaceable = [
-    ...unprobed.map(
-      (rule) => `${rule} declares no probe, so ${optionsOf(config.rules[rule]).length === 0 ? "its scope" : JSON.stringify(optionsOf(config.rules[rule]))} does not reach the corpus`
-    ),
-    ...inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`)
-  ];
-  if (unplaceable.length > 0) return said("UNJUDGED", named(unplaceable));
+  const unplaceable = inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`);
+  const kitNote = unprobed.length === 0 || loadedProbes === null ? "" : `the loaded plugin ships no probe for ${unprobed.length === 1 ? "this enabled rule" : `${unprobed.length} enabled rules`} \u2014 the kit's omission, not this repo's (geonosis #131): ${unprobed.join(", ")}`;
+  const unknowable = loadedProbes === null ? unprobed.map(
+    (rule) => `${rule} declares no probe, so ${optionSetsOf(config, rule).every((options) => options.length === 0) ? "its scope" : under(config, rule)} does not reach the corpus`
+  ) : [];
+  if (unplaceable.length > 0 || unknowable.length > 0) {
+    return said(
+      "UNJUDGED",
+      named([...unknowable, ...unplaceable]) + (kitNote === "" ? "" : ` \u2014 and ${kitNote}`)
+    );
+  }
+  if (kitNote !== "") return said("WARN", kitNote);
   const through = exercised.length === 1 ? "1 through its declared probe under this repo\u2019s options" : `${exercised.length} through their declared probes under this repo\u2019s options`;
   return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where} \u2014 ${through}`);
 };
@@ -876,7 +1540,7 @@ var declaredFor = ({
   }
   return void 0;
 };
-var finding5 = (subject, verdict, message) => ({
+var finding6 = (subject, verdict, message) => ({
   check: "loaded",
   message,
   subject,
@@ -893,7 +1557,7 @@ var oneConfig = async ({
   specifier,
   workspaces
 }) => {
-  const said = (verdict, message) => finding5(config.relative, verdict, `${specifier}: ${message}`);
+  const said = (verdict, message) => finding6(config.relative, verdict, `${specifier}: ${message}`);
   let loaded;
   try {
     loaded = await versionAt(resolveFrom(config.dir, specifier), specifier, root);
@@ -945,10 +1609,10 @@ var copiesOf = async ({
     found.set(at, { from: [labelOf(workspace)], version: await pluginVersionOf(entry) });
   }
   if (found.size === 0) {
-    return finding5(specifier, "FAIL", "no workspace in this tree can resolve it at all");
+    return finding6(specifier, "FAIL", "no workspace in this tree can resolve it at all");
   }
   const listed = [...found.entries()].map(([at, one]) => `${at} ${one.version} (${one.from.join(", ")})`).join("; ");
-  return found.size === 1 ? finding5(specifier, "OK", `1 copy \u2014 ${listed}`) : finding5(
+  return found.size === 1 ? finding6(specifier, "OK", `1 copy \u2014 ${listed}`) : finding6(
     specifier,
     "WARN",
     `${found.size} copies \u2014 ${listed}. Which one oxlint runs depends on which directory its config sits in.`
@@ -963,7 +1627,7 @@ var checkLoaded = async ({
   const specifiers = /* @__PURE__ */ new Set();
   for (const config of configs) {
     if (config.error !== void 0) {
-      findings.push(finding5(config.relative, "FAIL", config.error));
+      findings.push(finding6(config.relative, "FAIL", config.error));
       continue;
     }
     for (const specifier of config.jsPlugins.filter((name) => name.startsWith(SCOPE))) {
@@ -978,13 +1642,13 @@ var checkLoaded = async ({
 };
 
 // src/observability.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join7 } from "path";
 var GEONOSIS_FILE = "geonosis.json";
 var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
 var DEFAULT_MAX_AGE_SECONDS = 3600;
 var HEAD_TIMEOUT_MS = 3e3;
-var finding6 = (verdict, subject, message) => ({
+var finding7 = (verdict, subject, message) => ({
   check: "observability",
   message,
   subject,
@@ -993,7 +1657,7 @@ var finding6 = (verdict, subject, message) => ({
 var readGeonosis2 = (root) => {
   let text;
   try {
-    text = readFileSync5(join6(root, GEONOSIS_FILE), "utf8");
+    text = readFileSync7(join7(root, GEONOSIS_FILE), "utf8");
   } catch {
     return { present: false };
   }
@@ -1011,25 +1675,25 @@ var readGeonosis2 = (root) => {
 var exporterFinding = (config) => {
   const sink = config.sink;
   if (typeof sink !== "string" || sink.trim() === "") {
-    return finding6(
+    return finding7(
       "FAIL",
       GEONOSIS_FILE,
       "observability.sink is not set, so nothing here says where errors are supposed to go \u2014 and a repo that cannot name its exporter has not got one"
     );
   }
   if (REACHES_NOTHING.has(sink.toLowerCase())) {
-    return finding6(
+    return finding7(
       "WARN",
       GEONOSIS_FILE,
       `the configured sink is "${sink}", which answers ok and reaches nothing. Correct in a dev tree; in a deployed one it is the instrument that cannot fail.`
     );
   }
-  return finding6("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
+  return finding7("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
 };
 var reachableFinding = async (config) => {
   const endpoint = config.endpoint;
   if (typeof endpoint !== "string" || endpoint.trim() === "") {
-    return finding6(
+    return finding7(
       "SKIP",
       GEONOSIS_FILE,
       "no observability.endpoint was named, so whether the exporter is reachable was not asked"
@@ -1039,13 +1703,13 @@ var reachableFinding = async (config) => {
   const timer = setTimeout(() => controller.abort(), HEAD_TIMEOUT_MS);
   try {
     const response = await fetch(endpoint, { method: "HEAD", signal: controller.signal });
-    return finding6(
+    return finding7(
       "OK",
       GEONOSIS_FILE,
       `${endpoint} is reachable \u2014 it answered ${response.status} to a HEAD`
     );
   } catch (error) {
-    return finding6(
+    return finding7(
       "FAIL",
       GEONOSIS_FILE,
       `${endpoint} is not reachable from here: ${error.message}. Every report this repo sends is going into that.`
@@ -1057,7 +1721,7 @@ var reachableFinding = async (config) => {
 var ageFinding = (config, root, now) => {
   const file = config.lastEventFile;
   if (typeof file !== "string" || file.trim() === "") {
-    return finding6(
+    return finding7(
       "SKIP",
       GEONOSIS_FILE,
       "no observability.lastEventFile was configured, so when the last event arrived is not a question anything here can answer. Have the sink write { at, id, sink } on every capture and name the file."
@@ -1066,27 +1730,27 @@ var ageFinding = (config, root, now) => {
   const maxAgeSeconds = typeof config.maxAgeSeconds === "number" && config.maxAgeSeconds > 0 ? config.maxAgeSeconds : DEFAULT_MAX_AGE_SECONDS;
   let record;
   try {
-    record = JSON.parse(readFileSync5(join6(root, file), "utf8"));
+    record = JSON.parse(readFileSync7(join7(root, file), "utf8"));
   } catch (error) {
-    return finding6(
+    return finding7(
       "FAIL",
       file,
       `the last event file could not be read: ${error.message}. A sink that has never written one has never captured anything.`
     );
   }
   if (typeof record.at !== "number" || !Number.isFinite(record.at)) {
-    return finding6(
+    return finding7(
       "FAIL",
       file,
       'the last event record has no numeric "at", so its age cannot be read \u2014 and an age nobody can read is not an age inside the window'
     );
   }
   const ageSeconds = Math.round((now - record.at) / 1e3);
-  return ageSeconds > maxAgeSeconds ? finding6(
+  return ageSeconds > maxAgeSeconds ? finding7(
     "FAIL",
     file,
     `the last event arrived ${ageSeconds}s ago, past the ${maxAgeSeconds}s window. An exporter that stopped, a key that was rotated and a sink that has been dropping since Tuesday all look exactly like this, and all of them leave a green build.`
-  ) : finding6(
+  ) : finding7(
     "OK",
     file,
     `the last event arrived ${ageSeconds}s ago, inside the ${maxAgeSeconds}s window`
@@ -1095,16 +1759,16 @@ var ageFinding = (config, root, now) => {
 var probeFinding = (config) => {
   const probe = config.probe;
   if (typeof probe === "string" && probe.trim() !== "") {
-    return finding6("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
+    return finding7("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
   }
   if (typeof config.lastEventFile === "string" && config.lastEventFile.trim() !== "") {
-    return finding6(
+    return finding7(
       "OK",
       GEONOSIS_FILE,
       "no probe command, but a last event file is read above, so something does look at this exporter"
     );
   }
-  return finding6(
+  return finding7(
     "WARN",
     GEONOSIS_FILE,
     "neither observability.probe nor observability.lastEventFile is configured, so nothing in this repo has ever established that a report reaches the sink. Name a probe command \u2014 the doctor reports it, your gate runs it."
@@ -1117,7 +1781,7 @@ var checkObservability = async ({
   const read = readGeonosis2(root);
   if (read.error !== void 0) {
     return [
-      finding6(
+      finding7(
         "FAIL",
         GEONOSIS_FILE,
         `${GEONOSIS_FILE} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
@@ -1126,7 +1790,7 @@ var checkObservability = async ({
   }
   if (!read.present || read.config === void 0) {
     return [
-      finding6(
+      finding7(
         "SKIP",
         GEONOSIS_FILE,
         `no observability block in ${GEONOSIS_FILE}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
@@ -1143,16 +1807,16 @@ var checkObservability = async ({
 };
 
 // src/repo-corpus.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
+import { join as join8 } from "path";
 var GEONOSIS_FILE2 = "geonosis.json";
 var repoCorpusOf = (root) => {
-  const path = join7(root, GEONOSIS_FILE2);
-  if (!existsSync5(path)) return void 0;
+  const path = join8(root, GEONOSIS_FILE2);
+  if (!existsSync6(path)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync6(path, "utf8"));
+    const parsed = JSON.parse(readFileSync8(path, "utf8"));
     const declared = parsed.doctor?.corpus;
-    return typeof declared === "string" && declared !== "" ? join7(root, declared) : void 0;
+    return typeof declared === "string" && declared !== "" ? join8(root, declared) : void 0;
   } catch {
     return void 0;
   }
@@ -1163,7 +1827,7 @@ var TEST_FAILURES = "testFailures";
 var RUNS_A_RUNNER = /(?:^|[\s;&|(])(?:npx\s+|bunx\s+|pnpm\s+(?:exec\s+)?)?(?:vitest|bun\s+test)(?:\s|$)/;
 var RUNS_BUN_TEST = /(?:^|[\s;&|(])(?:bunx\s+)?bun\s+test(?:\s|$)/;
 var WRITES_A_REPORT = /--reporter[= ]\S*json|--outputFile/i;
-var finding7 = (subject, verdict, message) => ({
+var finding8 = (subject, verdict, message) => ({
   check: "runner",
   message,
   subject,
@@ -1191,7 +1855,7 @@ var checkRunner = ({
     if (script === "") return [];
     const subject = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
     const said = (verdict, message) => [
-      finding7(subject, verdict, message)
+      finding8(subject, verdict, message)
     ];
     if (!RUNS_A_RUNNER.test(script)) {
       return said(
@@ -1199,6 +1863,12 @@ var checkRunner = ({
         `"${script}" runs neither vitest nor bun test \u2014 this check has nothing to say about it`
       );
     }
+    if (testFilesUnder(workspace.dir).length === 0) {
+      return said(
+        "SKIP",
+        `"${script}" runs a test runner and there is no test file under this workspace \u2014 nothing here for its exit code to be wrong about`
+      );
+    }
     if (WRITES_A_REPORT.test(script)) {
       return said("OK", "the script asks the runner for its own JSON report, not for a status code");
     }
@@ -1283,6 +1953,11 @@ var runDoctor = async ({
 }) => {
   const configs = discoverConfigs(root);
   const workspaces = discoverWorkspaces(root);
+  if (workspaces.length === 0 && configs.length === 0) {
+    throw new DoctorError(
+      `nothing here to examine \u2014 no package.json and no ${CONFIG_FILE} anywhere under ${root}. Every line this would print is about a gate that is not here, and a page of SKIPs is not a pass.`
+    );
+  }
   const asked = (check) => only === void 0 || only.includes(check);
   const runs = [
     ["loaded", () => checkLoaded({ configs, root, workspaces })],
@@ -1300,6 +1975,7 @@ var runDoctor = async ({
     ],
     ["baseline", () => baselineOf({ baseline, root })],
     ["runner", () => checkRunner({ ratchet: readRatchet(root), workspaces })],
+    ["envelope", () => checkEnvelopes({ root })],
     ["observability", () => checkObservability({ now: Date.now(), root })],
     ["drift", () => checkDrift({ root, workspaces })],
     ["deployed", () => checkDeployed({ root })]
@@ -1321,6 +1997,7 @@ var ABOUT = {
   baseline: "a number that may only shrink, against another ref",
   deployed: "what the pipeline reported deploying is what the tree declares",
   drift: "the gates that were set up and are no longer running",
+  envelope: "every gate read as many things as it was handed",
   exercised: "every enabled rule fires on at least one corpus file",
   loaded: "the plugin oxlint would load is the one the manifest pins",
   observability: "an exporter is configured, reachable, and something arrived through it lately",
@@ -1374,6 +2051,9 @@ export {
   relativeToRoot,
   READERS,
   checkDrift,
+  ENVELOPES_DIR,
+  NO_ENVELOPES,
+  checkEnvelopes,
   enabledRulesOf,
   checkExercised,
   SCOPE,