@geonosis/doctor 1.3.0 → 2.0.0

package/dist/{chunk-7BRGHYQR.js → chunk-SMCRXSH5.js}

@@ -322,12 +322,15 @@ var checkDeployed = ({ root }) => {
 // src/types.ts
 var CHECKS = [
   "loaded",
+  "group",
   "exercised",
   "baseline",
   "runner",
+  "envelope",
   "drift",
   "observability",
-  "deployed"
+  "deployed",
+  "rails"
 ];
 var DoctorError = class extends Error {
   constructor(message) {
@@ -404,6 +407,20 @@ var probesOf = async (entry, plugin) => {
     })
   );
 };
+var presumptionsOf = async (entry) => {
+  const loaded = await import(pathToFileURL(entry).href);
+  const namespace = loaded.default?.meta?.name;
+  return {
+    namespace: typeof namespace === "string" ? namespace : "",
+    presumed: Object.fromEntries(
+      Object.entries(loaded.default?.rules ?? {}).flatMap(([name, rule]) => {
+        const presumes = rule?.presumes;
+        const engine = presumes?.engine;
+        return typeof engine === "string" && Array.isArray(presumes?.packages) ? [[name, { engine, packages: presumes.packages }]] : [];
+      })
+    )
+  };
+};
 var corpusOfPlugin = (from, specifier) => join3(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
 var real = (path) => {
   try {
@@ -415,9 +432,40 @@ var real = (path) => {
 var relativeToRoot = (root, path) => relativePath(real(root), real(path));
 
 // src/drift.ts
-import { closeSync, existsSync as existsSync3, openSync, readdirSync as readdirSync2, readFileSync as readFileSync4, readSync } from "fs";
+import { closeSync, existsSync as existsSync4, openSync, readdirSync as readdirSync3, readFileSync as readFileSync5, readSync } from "fs";
 import { homedir } from "os";
-import { join as join4, sep as sep2 } from "path";
+import { join as join5, sep as sep2 } from "path";
+
+// src/hooks.ts
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join4 } from "path";
+var HOOK_FILES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"];
+var HOOK_DIRS = [".husky", ".githooks"];
+var VERSION_MANAGED = /(?:^|[\s;&|(])(?<runner>pnpm|npx|bunx|yarn)\b(?:\s+(?:exec|run|dlx|x))?\s+(?<bin>geonosis(?:-[a-z-]+)?)\b/;
+var NAMES_A_BIN = /(?:^|[\s;&|(/])geonosis(?:-[a-z-]+)?\b/;
+var hookLines = (root) => {
+  const found = [];
+  const read = (path) => {
+    const at = relativePath(root, path);
+    for (const line of readFileSync4(path, "utf8").split("\n")) {
+      if (line.trim() !== "") found.push({ at, line });
+    }
+  };
+  for (const name of HOOK_FILES) {
+    const path = join4(root, name);
+    if (existsSync3(path)) read(path);
+  }
+  for (const name of HOOK_DIRS) {
+    const dir = join4(root, name);
+    if (!existsSync3(dir)) continue;
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      if (entry.isFile() && !entry.name.startsWith("_") && !entry.name.startsWith(".")) {
+        read(join4(dir, entry.name));
+      }
+    }
+  }
+  return found;
+};
 
 // src/overrides.ts
 var SPECIAL = /* @__PURE__ */ new Set(["$", "(", ")", "+", ".", "/", "@", "\\", "^", "|"]);
@@ -501,29 +549,29 @@ var filesUnder = (dir, match) => {
   const walk2 = (at) => {
     let entries;
     try {
-      entries = readdirSync2(at, { withFileTypes: true });
+      entries = readdirSync3(at, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join4(at, entry.name));
+        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join5(at, entry.name));
         continue;
       }
-      if (entry.isFile() && match(entry.name)) found.push(join4(at, entry.name));
+      if (entry.isFile() && match(entry.name)) found.push(join5(at, entry.name));
     }
   };
   walk2(dir);
   return found;
 };
 var ci = (root) => {
-  const dir = join4(root, WORKFLOWS);
-  if (!existsSync3(dir)) {
+  const dir = join5(root, WORKFLOWS);
+  if (!existsSync4(dir)) {
     return [finding3(WORKFLOWS, "SKIP", "there are no workflows here to read")];
   }
   return filesUnder(dir, (name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((path) => {
     const at = relativePath(root, path);
-    return SWITCHED_OFF.test(readFileSync4(path, "utf8")) ? finding3(
+    return SWITCHED_OFF.test(readFileSync5(path, "utf8")) ? finding3(
       at,
       "FAIL",
       "a job or step here is switched off by a condition that can never be true \u2014 every gate downstream of it reports green having run nothing"
@@ -571,7 +619,7 @@ var pathsRunByScript = (script) => script.split(BETWEEN_COMMANDS).map(pathRunBy)
 var scriptPaths = (workspaces) => {
   const missing = workspaces.flatMap(
     (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
-      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync3(join4(one.dir, path))).map((path) => ({ name, path, workspace: one }))
+      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync4(join5(one.dir, path))).map((path) => ({ name, path, workspace: one }))
     )
   );
   if (missing.length === 0) {
@@ -607,7 +655,7 @@ var linkedBins = (root, workspaces) => {
   }
   const missing = workspaces.flatMap(
     (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
-      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter((name) => !existsSync3(join4(root, "node_modules/.bin", name))).map((name) => ({ name, script, workspace: one }))
+      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter((name) => !existsSync4(join5(root, "node_modules/.bin", name))).map((name) => ({ name, script, workspace: one }))
     )
   );
   if (missing.length === 0) {
@@ -678,11 +726,11 @@ var everythingRun = (root, workspaces) => {
   const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
   const counters = (readRatchet(root)?.counters ?? []).map((entry) => String(entry.command ?? ""));
   const workflows = filesUnder(
-    join4(root, WORKFLOWS),
+    join5(root, WORKFLOWS),
     (name) => name.endsWith(".yml") || name.endsWith(".yaml")
   ).map((path) => {
     try {
-      return readFileSync4(path, "utf8");
+      return readFileSync5(path, "utf8");
     } catch {
       return "";
     }
@@ -718,10 +766,10 @@ var generatedFiles = (root, workspaces) => {
   });
 };
 var readGeonosis = (root) => {
-  const path = join4(root, GEONOSIS);
-  if (!existsSync3(path)) return void 0;
+  const path = join5(root, GEONOSIS);
+  if (!existsSync4(path)) return void 0;
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -729,11 +777,11 @@ var readGeonosis = (root) => {
 var law = (root, config) => {
   const declared = config?.law ?? {};
   const file = typeof declared.file === "string" ? declared.file : LAW;
-  const path = join4(root, file);
-  if (!existsSync3(path)) {
+  const path = join5(root, file);
+  if (!existsSync4(path)) {
     return [finding3(file, "SKIP", "there is no law file here to measure")];
   }
-  const source = readFileSync4(path, "utf8");
+  const source = readFileSync5(path, "utf8");
   const lines = source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
   if (typeof declared.maxLines !== "number") {
     return [
@@ -755,9 +803,9 @@ var law = (root, config) => {
 };
 var KIT_PLUGIN = "geonosis";
 var enablesKit = (path) => {
-  if (!existsSync3(path)) return false;
+  if (!existsSync4(path)) return false;
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     const enabled = parsed.enabledPlugins;
     if (typeof enabled !== "object" || enabled === null) return false;
     return Object.entries(enabled).some(
@@ -768,7 +816,7 @@ var enablesKit = (path) => {
   }
 };
 var hooks = (root, userSettings) => {
-  const path = join4(root, SETTINGS);
+  const path = join5(root, SETTINGS);
   if (enablesKit(path)) {
     return [finding3(SETTINGS, "OK", `\`enabledPlugins\` here enables the kit\u2019s plugin`)];
   }
@@ -789,6 +837,160 @@ var hooks = (root, userSettings) => {
     )
   ];
 };
+var ALLOW_BUILDS_KEY = "allowBuilds";
+var allowedBuilds = (root) => {
+  const path = join5(root, WORKSPACE_YAML);
+  if (!existsSync4(path)) return void 0;
+  const lines = readFileSync5(path, "utf8").split("\n");
+  const at = lines.findIndex((line) => new RegExp(`^${ALLOW_BUILDS_KEY}\\s*:`).test(line));
+  if (at < 0) return void 0;
+  const names = [];
+  for (const line of lines.slice(at + 1)) {
+    if (/^\s*(?:#.*)?$/.test(line)) continue;
+    const entry = /^\s+(?<name>'[^']+'|"[^"]+"|[^:\s]+)\s*:/.exec(line);
+    const name = entry?.groups?.["name"];
+    if (name === void 0) break;
+    names.push(name.replace(/^['"]|['"]$/g, ""));
+  }
+  return names;
+};
+var PLATFORM = /(?:^|[-/])(?:darwin|linux|win32|windows|freebsd|openbsd|android|sunos)(?:[-.]|$)|(?:^|[-/])(?:arm64|x64|ia32|ppc64|s390x|riscv64)(?:[-.]|$)/;
+var familyOf = (name) => name.split("/").slice(0, -1).join("/") || name;
+var platformSplitBuilds = (root) => {
+  const names = allowedBuilds(root);
+  if (names === void 0 || names.length === 0) return [];
+  const families = /* @__PURE__ */ new Map();
+  for (const name of names.filter((one) => PLATFORM.test(one))) {
+    const family = familyOf(name);
+    families.set(family, [...families.get(family) ?? [], name]);
+  }
+  return [...families.entries()].flatMap(
+    ([family, allowed]) => allowed.length > 1 ? [] : [
+      finding3(
+        allowed[0] ?? family,
+        "WARN",
+        `this ${ALLOW_BUILDS_KEY} entry names one platform of ${family}, which publishes one package per platform \u2014 pnpm writes the entry for the machine that ran the install, so an install on any other platform refuses by the name that is missing, on somebody else's machine. List every platform ${family} publishes, or none of them`
+      )
+    ]
+  );
+};
+var LINTS_STAGED = /\b(?:oxlint|eslint|biome)\b[^\n]*(?:\{staged_files\}|\{files\}|\$\{?[@*]|"\$@")/;
+var TAKES_A_VALUE = /* @__PURE__ */ new Set([
+  "--config",
+  "--format",
+  "--ignore-path",
+  "--max-warnings",
+  "--reporter",
+  "--rulesdir",
+  "--tsconfig",
+  "-c"
+]);
+var pathsLintedBy = (script, dir) => {
+  const words = script.split(/\s+/).filter((word) => word !== "");
+  const named2 = [];
+  for (const [at, word] of words.entries()) {
+    if (word.startsWith("-")) continue;
+    const before = words[at - 1] ?? "";
+    if (TAKES_A_VALUE.has(before)) continue;
+    if (existsSync4(join5(dir, word))) named2.push(word.replace(/^\.\//, "").replace(/\/$/, ""));
+  }
+  return named2;
+};
+var LINTABLE = /\.[cm]?[jt]sx?$/;
+var sourceDirsIn = (dir) => {
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter(
+    (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name) && filesUnder(join5(dir, entry.name), (name) => LINTABLE.test(name)).length > 0
+  ).map((entry) => entry.name);
+};
+var lintScopes = (root, workspaces) => {
+  if (!hookLines(root).some((one) => LINTS_STAGED.test(one.line))) {
+    return [
+      finding3(
+        "lint scope",
+        "SKIP",
+        "no committed hook lints staged files here, so there is no second file set for a lint script to be narrower than"
+      )
+    ];
+  }
+  return workspaces.flatMap((workspace) => {
+    const script = workspace.manifest.scripts?.lint;
+    if (typeof script !== "string" || script.trim() === "") return [];
+    const at = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
+    const covered = pathsLintedBy(script, workspace.dir);
+    if (covered.length === 0 || covered.includes(".")) {
+      return [finding3(at, "OK", `"${script}" covers everything the hook could stage here`)];
+    }
+    const uncovered = sourceDirsIn(workspace.dir).filter(
+      (name) => !covered.some((path) => name === path || path.startsWith(`${name}/`))
+    );
+    if (uncovered.length === 0) {
+      return [finding3(at, "OK", `"${script}" covers every source directory under this workspace`)];
+    }
+    return [
+      finding3(
+        at,
+        "WARN",
+        `the "lint" script covers ${covered.join(", ")} and the pre-commit hook lints whatever is staged, so ${uncovered.map((name) => `${name}/**`).join(", ")} is linted by the hook alone \u2014 the package gate has never read those files, and the drift stays invisible until one moves across it. Widen the script, or say in it which globs are deliberately outside`
+      )
+    ];
+  });
+};
+var OBSERVABILITY = "@geonosis/observability";
+var COMPOSITION_ROOT = "src/platform.ts";
+var FLOOR_PACKAGES = [
+  "@geonosis/conformance",
+  "@geonosis/db",
+  "@geonosis/events",
+  "@geonosis/search",
+  "@geonosis/workflows"
+];
+var COMPOSABLE = [
+  {
+    name: OBSERVABILITY,
+    uncomposed: `a sink nobody composes at the composition root sends production errors nowhere, and from outside the process that reads exactly like a project with nothing to report. Build one where the app is wired (the recipe is in ${OBSERVABILITY}'s README, \xA74) and hand it the port`
+  },
+  ...FLOOR_PACKAGES.map((name) => ({
+    name,
+    uncomposed: `a battery nothing composes is behaviour no request path can reach, and an install that does nothing reads from outside exactly like one that works. Compose it in the app\u2019s ${COMPOSITION_ROOT} \u2014 the composition root \`create-geonosis --domains\` writes \u2014 where the tenant session is opened before any store is built`
+  }))
+];
+var SOURCE_FILE = /\.[cm]?[jt]sx?$/;
+var composedHere = (root, workspaces) => {
+  const declared = declaredAnywhere(workspaces);
+  const wanted = COMPOSABLE.filter((one) => declared.has(one.name));
+  if (wanted.length === 0) return [];
+  const importing = /* @__PURE__ */ new Map();
+  for (const path of filesUnder(root, (name) => SOURCE_FILE.test(name))) {
+    let body;
+    try {
+      body = readFileSync5(path, "utf8");
+    } catch {
+      continue;
+    }
+    for (const one of wanted) {
+      if (!importing.has(one.name) && body.includes(one.name)) importing.set(one.name, path);
+    }
+    if (importing.size === wanted.length) break;
+  }
+  return wanted.map((one) => {
+    const at = importing.get(one.name);
+    return at === void 0 ? finding3(
+      one.name,
+      "WARN",
+      `it is declared here and no source file imports it \u2014 ${one.uncomposed}`
+    ) : finding3(
+      one.name,
+      "OK",
+      `composed in ${relativePath(root, at)} \u2014 something here builds what it reports through`
+    );
+  });
+};
 var READERS = {
   ledger: "@geonosis/ledger",
   review: "@geonosis/review",
@@ -881,8 +1083,8 @@ var pluginDirsOf = (level) => {
   return { manifests: options.manifests ?? ["index.ts"], registry, roots: options.roots };
 };
 var pluginDirLayers = (root) => {
-  const path = join4(root, ".oxlintrc.json");
-  if (!existsSync3(path)) return [];
+  const path = join5(root, ".oxlintrc.json");
+  if (!existsSync4(path)) return [];
   const layers = [];
   for (const layer of layersOf(readConfig(path, root), PLUGIN_DIR_RULE)) {
     const dirs = pluginDirsOf(layer.level);
@@ -891,8 +1093,8 @@ var pluginDirLayers = (root) => {
   return layers;
 };
 var layerOver = (layers, root, relative) => {
-  const at = join4(root, relative);
-  const inside = readdirSync2(at, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => `${relative}/${entry.name}`);
+  const at = join5(root, relative);
+  const inside = readdirSync3(at, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => `${relative}/${entry.name}`);
   const paths = inside.length === 0 ? [relative] : inside;
   const wrapped = layers.map((layer) => ({ files: layer.files, level: layer.dirs }));
   for (const path of paths) {
@@ -913,7 +1115,7 @@ var pluginDirs = (root) => {
     ];
   }
   const missing = [...new Set(layers.flatMap((layer) => layer.dirs.registry))].filter(
-    (registry) => !existsSync3(join4(root, registry))
+    (registry) => !existsSync4(join5(root, registry))
   );
   if (missing.length > 0) {
     return missing.map(
@@ -923,17 +1125,17 @@ var pluginDirs = (root) => {
   const source = /* @__PURE__ */ new Map();
   const unreachable = /* @__PURE__ */ new Map();
   for (const rootDir of new Set(layers.flatMap((layer) => layer.dirs.roots))) {
-    const at = join4(root, rootDir);
-    if (!existsSync3(at)) continue;
-    for (const entry of readdirSync2(at, { withFileTypes: true })) {
+    const at = join5(root, rootDir);
+    if (!existsSync4(at)) continue;
+    for (const entry of readdirSync3(at, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const relative = `${rootDir}/${entry.name}`;
       const governs = layerOver(layers, root, relative);
       if (governs === void 0) continue;
       const key = governs.registry.join(", ");
-      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync4(join4(root, half), "utf8")).join("\n");
+      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync5(join5(root, half), "utf8")).join("\n");
       source.set(key, registry);
-      const hasManifest = governs.manifests.some((name) => existsSync3(join4(at, entry.name, name)));
+      const hasManifest = governs.manifests.some((name) => existsSync4(join5(at, entry.name, name)));
       if (!hasManifest || registry.includes(entry.name)) continue;
       unreachable.set(key, [...unreachable.get(key) ?? [], relative]);
     }
@@ -951,9 +1153,9 @@ var WORKSPACE_YAML = "pnpm-workspace.yaml";
 var HOIST_KEY = "publicHoistPattern";
 var HOIST_REPAIR = "rm -rf node_modules/.modules.yaml node_modules/.pnpm-workspace-state-v1.json && pnpm install";
 var hoistPatterns = (root) => {
-  const path = join4(root, WORKSPACE_YAML);
-  if (!existsSync3(path)) return void 0;
-  const lines = readFileSync4(path, "utf8").split("\n");
+  const path = join5(root, WORKSPACE_YAML);
+  if (!existsSync4(path)) return void 0;
+  const lines = readFileSync5(path, "utf8").split("\n");
   const at = lines.findIndex((line) => new RegExp(`^${HOIST_KEY}\\s*:`).test(line));
   if (at < 0) return void 0;
   const patterns = [];
@@ -990,7 +1192,7 @@ var publicHoists = (root, workspaces) => {
         `this ${HOIST_KEY} matches no workspace package here, so what it should have linked at the root is a question this cannot answer`
       );
     }
-    const pruned = hoisted.filter((name) => !existsSync3(join4(root, "node_modules", name)));
+    const pruned = hoisted.filter((name) => !existsSync4(join5(root, "node_modules", name)));
     if (pruned.length === 0) {
       return finding3(
         pattern,
@@ -1005,71 +1207,10 @@ var publicHoists = (root, workspaces) => {
     );
   });
 };
-var HOOK_FILES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"];
-var HOOK_DIRS = [".husky", ".githooks"];
-var VERSION_MANAGED = /(?:^|[\s;&|(])(?<runner>pnpm|npx|bunx|yarn)\b(?:\s+(?:exec|run|dlx|x))?\s+(?<bin>geonosis(?:-[a-z-]+)?)\b/;
-var NAMES_A_BIN = /(?:^|[\s;&|(/])geonosis(?:-[a-z-]+)?\b/;
-var hookLines = (root) => {
-  const found = [];
-  const read = (path) => {
-    const at = relativePath(root, path);
-    for (const line of readFileSync4(path, "utf8").split("\n")) {
-      if (line.trim() !== "") found.push({ at, line });
-    }
-  };
-  for (const name of HOOK_FILES) {
-    const path = join4(root, name);
-    if (existsSync3(path)) read(path);
-  }
-  for (const name of HOOK_DIRS) {
-    const dir = join4(root, name);
-    if (!existsSync3(dir)) continue;
-    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      if (entry.isFile() && !entry.name.startsWith("_") && !entry.name.startsWith(".")) {
-        read(join4(dir, entry.name));
-      }
-    }
-  }
-  return found;
-};
-var gitHooks = (root) => {
-  const lines = hookLines(root);
-  if (lines.length === 0) {
-    return [finding3("git hooks", "SKIP", "no lefthook, husky or .githooks file here to read")];
-  }
-  const files = [...new Set(lines.map((one) => one.at))].toSorted();
-  return files.flatMap((at) => {
-    const here = lines.filter((one) => one.at === at);
-    const named2 = here.filter((one) => NAMES_A_BIN.test(one.line));
-    if (named2.length === 0) {
-      return [finding3(at, "SKIP", "it names no geonosis bin, so there is nothing here to start")];
-    }
-    const wrong = named2.flatMap((one) => {
-      const found = VERSION_MANAGED.exec(one.line)?.groups;
-      return found === void 0 ? [] : [{ bin: found["bin"] ?? "", runner: found["runner"] ?? "" }];
-    });
-    if (wrong.length === 0) {
-      return [
-        finding3(
-          at,
-          "OK",
-          `${named2.length} geonosis bin(s) here, every one called directly rather than through a runner`
-        )
-      ];
-    }
-    return wrong.map(
-      ({ bin, runner }) => finding3(
-        at,
-        "FAIL",
-        `it runs ${bin} through ${runner} \u2014 a git hook's PATH is not the shell's and carries no version-manager shim, so ${runner} fails to START and what the author reads is its message, not this gate's. Call it directly: node_modules/.bin/${bin}`
-      )
-    );
-  });
-};
 var checkDrift = ({
   readers = READERS,
   root,
-  userSettings = join4(homedir(), SETTINGS),
+  userSettings = join5(homedir(), SETTINGS),
   workspaces
 }) => {
   const config = readGeonosis(root);
@@ -1082,7 +1223,9 @@ var checkDrift = ({
     ...generatedFiles(root, workspaces),
     ...pluginDirs(root),
     ...publicHoists(root, workspaces),
-    ...gitHooks(root),
+    ...composedHere(root, workspaces),
+    ...lintScopes(root, workspaces),
+    ...platformSplitBuilds(root),
     ...law(root, config),
     ...hooks(root, userSettings),
     ...blocks(root, config, readers, workspaces)
@@ -1091,9 +1234,17 @@ var checkDrift = ({
 
 // src/exercised.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { cpSync, existsSync as existsSync4, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import {
+  cpSync,
+  existsSync as existsSync5,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync as readFileSync6,
+  rmSync,
+  writeFileSync
+} from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join6, resolve } from "path";
 import { corpusOf, readManifest } from "@geonosis/lint-parity";
 var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
 var severityOf = (level) => Array.isArray(level) ? level[0] : level;
@@ -1107,21 +1258,21 @@ var finding4 = (subject, verdict, message) => ({
 });
 var LIMIT = 800;
 var refusal = (error) => {
-  const said = String(error.message).trim();
-  return said.length > LIMIT ? `${said.slice(0, LIMIT)}\u2026` : said;
+  const said2 = String(error.message).trim();
+  return said2.length > LIMIT ? `${said2.slice(0, LIMIT)}\u2026` : said2;
 };
 var reasonFrom = (config, oxlint) => {
-  const dir = mkdtempSync(join5(tmpdir(), "geonosis-doctor-why-"));
+  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-why-"));
   try {
-    const probe = join5(dir, "probe.tsx");
+    const probe = join6(dir, "probe.tsx");
     writeFileSync(probe, "export const probe = 1\n");
     const run = spawnSync2(
       oxlint,
       ["--no-ignore", "--disable-nested-config", "--config", config, probe],
       { encoding: "utf8", env: { ...process.env, NO_COLOR: "1" }, maxBuffer: 8 * 1024 * 1024 }
     );
-    const said = `${run.stdout ?? ""}${run.stderr ?? ""}`;
-    return /Error:\s*([^]+?)(?=\s+at\s+\S+\s+\(|\n|$)/.exec(said)?.[1];
+    const said2 = `${run.stdout ?? ""}${run.stderr ?? ""}`;
+    return /[A-Z]\w*:\s*([^]+?)(?=\s+at\s+\S+\s+\(|\n|$)/.exec(said2)?.[1];
   } catch {
     return void 0;
   } finally {
@@ -1180,6 +1331,20 @@ var enabledHere = (config, plugin) => [
     ...config.overrides.flatMap((one) => enabledRulesOf(one.rules, plugin))
   ])
 ].toSorted();
+var concreteDirOf = (glob) => {
+  const segments = glob.split("/");
+  const out = [];
+  for (const segment of segments.slice(0, -1)) {
+    if (segment === "**") continue;
+    if (segment === "*") {
+      out.push("geonosis");
+      continue;
+    }
+    if (segment.includes("*") || segment.includes("{")) return void 0;
+    out.push(segment);
+  }
+  return out.join("/");
+};
 var throughProbes = ({
   config,
   corpus,
@@ -1189,8 +1354,8 @@ var throughProbes = ({
 }) => {
   const refused = /* @__PURE__ */ new Map();
   const placed = /* @__PURE__ */ new Set();
-  const dir = mkdtempSync(join5(tmpdir(), "geonosis-doctor-probe-"));
-  const here = join5(dir, "corpus");
+  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-probe-"));
+  const here = join6(dir, "corpus");
   try {
     cpSync(corpus, here, { recursive: true });
     for (const rule of silent) {
@@ -1204,18 +1369,34 @@ var throughProbes = ({
           const files = write(layer.options);
           if (files.length === 0) throw new Error("its probe declares no file at all");
           const claims = layer.files.length === 0 || files.some((file) => layer.files.some((glob) => matchesGlob(glob, file.path)));
+          let mounted = files;
           if (!claims) {
-            unclaimed.push(
-              `its probe lands at ${files[0]?.path ?? ""}, which the entry enabling it claims none of: ${layer.files.join(", ")}`
-            );
-            continue;
+            const rehomed = layer.files.map((glob) => {
+              const home = concreteDirOf(glob);
+              if (home === void 0) return void 0;
+              const extension = /^\*(\.[\w.]+)$/.exec(glob.split("/").at(-1) ?? "")?.[1];
+              const moved = files.map((file) => {
+                const base = file.path.split("/").at(-1) ?? file.path;
+                const adapted = extension === void 0 || base.endsWith(extension) ? base : base.replace(/\.[^.]+$/, extension);
+                const kept = layer.files.some((one) => matchesGlob(one, `${home}/${base}`));
+                return { ...file, path: `${home}/${kept ? base : adapted}` };
+              });
+              return moved.every((file) => layer.files.some((one) => matchesGlob(one, file.path))) ? moved : void 0;
+            }).find((moved) => moved !== void 0);
+            if (rehomed === void 0) {
+              unclaimed.push(
+                `its probe lands at ${files[0]?.path ?? ""}, which the entry enabling it claims none of (and no claimed path could be synthesized): ${layer.files.join(", ")}`
+              );
+              continue;
+            }
+            mounted = rehomed;
           }
-          for (const file of files) {
-            const at = join5(here, file.path);
-            if (placed.has(at)) continue;
-            placed.add(at);
-            mkdirSync(dirname2(at), { recursive: true });
-            writeFileSync(at, file.source);
+          for (const file of mounted) {
+            const at2 = join6(here, file.path);
+            if (placed.has(at2)) continue;
+            placed.add(at2);
+            mkdirSync(dirname2(at2), { recursive: true });
+            writeFileSync(at2, file.source);
           }
           anyPlaced = true;
         }
@@ -1224,17 +1405,33 @@ var throughProbes = ({
         refused.set(rule, String(error.message));
       }
     }
-    const reach = corpusOf({
-      configA: config.path,
-      configB: config.path,
-      corpus: here,
-      oxlint
-    }).reach;
-    return { fired: new Set(reach.filter((one) => one.firedInA).map((one) => one.rule)), refused };
+    const probeConfig = JSON.parse(readFileSync6(config.path, "utf8"));
+    const configDir = dirname2(config.path);
+    probeConfig.jsPlugins = (probeConfig.jsPlugins ?? []).map(
+      (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve(configDir, spec) : packageDirOf(resolveFrom(configDir, spec), spec)
+    );
+    const at = join6(here, ".oxlintrc-geonosis-probe.json");
+    writeFileSync(at, JSON.stringify(probeConfig, null, 2));
+    const run = spawnSync2(
+      oxlint,
+      ["-c", at, "--format", "json", "--no-ignore", "--disable-nested-config", here],
+      { cwd: dir, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
+    );
+    const fired = /* @__PURE__ */ new Set();
+    try {
+      const parsed = JSON.parse(run.stdout || "{}");
+      for (const one of parsed.diagnostics ?? []) {
+        const renamed = /^([\w@./-]+)\((.+)\)$/.exec(one.code ?? "");
+        if (renamed !== null) fired.add(`${renamed[1]}/${renamed[2]}`);
+      }
+    } catch {
+    }
+    return { fired, refused };
   } finally {
     rmSync(dir, { force: true, recursive: true });
   }
 };
+var BASE = "fired in the corpus and the probes, which says nothing about this tree \u2014 a rule can be exercised there and reach nothing a workspace here actually writes";
 var checkExercised = async ({
   config,
   corpus,
@@ -1243,15 +1440,15 @@ var checkExercised = async ({
   repoCorpus,
   root
 }) => {
-  const said = (verdict, message) => finding4(config.relative, verdict, message);
-  if (repoCorpus !== void 0 && !existsSync4(repoCorpus)) {
-    return said(
+  const said2 = (verdict, message) => finding4(config.relative, verdict, message);
+  if (repoCorpus !== void 0 && !existsSync5(repoCorpus)) {
+    return said2(
       "FAIL",
       `geonosis.json declares a reach corpus at ${relativeToRoot(root, repoCorpus)} and there is nothing there \u2014 a corpus that cannot be read is a claim, not evidence`
     );
   }
-  if (!existsSync4(corpus)) {
-    return said(
+  if (!existsSync5(corpus)) {
+    return said2(
       "SKIP",
       `the plugin loaded from here ships no corpus at ${relativeToRoot(root, corpus)} \u2014 nothing declares which rules it can be evidence about`
     );
@@ -1260,15 +1457,15 @@ var checkExercised = async ({
   try {
     manifest = readManifest(corpus);
   } catch (error) {
-    return said("SKIP", refusal(error));
+    return said2("SKIP", refusal(error));
   }
   const enabled = enabledHere(config, manifest.plugin);
-  if (enabled.length === 0) return said("SKIP", `no ${manifest.plugin} rule is enabled here`);
+  if (enabled.length === 0) return said2("SKIP", `no ${manifest.plugin} rule is enabled here`);
   let reach;
   try {
     reach = corpusOf({ configA: config.path, configB: config.path, corpus, oxlint }).reach;
   } catch (error) {
-    return said(
+    return said2(
       "FAIL",
       `oxlint refused to run this config over the corpus, so nothing here fired at all \u2014 ${reasonFrom(config.path, oxlint) ?? refusal(error)}`
     );
@@ -1276,7 +1473,7 @@ var checkExercised = async ({
   const fired = new Set(reach.filter((one) => one.firedInA).map((one) => one.rule));
   const unknown = enabled.filter((rule) => !manifest.rules.includes(rule));
   if (unknown.length > 0) {
-    return said(
+    return said2(
       "FAIL",
       `${countOf(unknown, "name")} the loaded plugin does not export: ${named(unknown)}`
     );
@@ -1286,12 +1483,12 @@ var checkExercised = async ({
     try {
       own = ownReach({ config, oxlint, repoCorpus });
     } catch (error) {
-      return said("FAIL", `this repo's own corpus could not be run \u2014 ${refusal(error)}`);
+      return said2("FAIL", `this repo's own corpus could not be run \u2014 ${refusal(error)}`);
     }
   }
   const empty = own.claimed.filter((rule) => !own.fired.has(rule));
   if (empty.length > 0) {
-    return said(
+    return said2(
       "FAIL",
       `${countOf(empty, "fire")} nowhere in this repo's own corpus, which names them: ${named(empty)}`
     );
@@ -1299,9 +1496,10 @@ var checkExercised = async ({
   const silent = enabled.filter((rule) => !fired.has(rule) && !own.fired.has(rule));
   const where = own.claimed.length === 0 ? "" : ` (${own.fired.size} by this repo's own corpus)`;
   if (silent.length === 0) {
-    return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where}`);
+    return said2("OK", `${enabled.length} enabled, ${enabled.length} exercised${where} \u2014 ${BASE}`);
   }
-  const probes = entry === void 0 ? {} : await probesOf(entry, manifest.plugin).catch(() => ({}));
+  const loadedProbes = entry === void 0 ? null : await probesOf(entry, manifest.plugin).catch(() => null);
+  const probes = loadedProbes ?? {};
   const declared = silent.filter((rule) => probes[rule] !== void 0);
   const unprobed = silent.filter((rule) => probes[rule] === void 0);
   let probed = { fired: /* @__PURE__ */ new Set(), refused: /* @__PURE__ */ new Map() };
@@ -1309,31 +1507,353 @@ var checkExercised = async ({
     try {
       probed = throughProbes({ config, corpus, oxlint, probes, silent: declared });
     } catch (error) {
-      return said("FAIL", `the declared probes could not be run \u2014 ${refusal(error)}`);
+      return said2("FAIL", `the declared probes could not be run \u2014 ${refusal(error)}`);
     }
   }
   const exercised = declared.filter((rule) => probed.fired.has(rule));
   const inert = declared.filter((rule) => !probed.fired.has(rule));
   const placed = inert.filter((rule) => !probed.refused.has(rule));
   if (placed.length > 0) {
-    return said(
+    return said2(
       "FAIL",
       `${countOf(placed, "fire")} nowhere in the corpus and nothing through the probe each declares either: ${named(placed.map((rule) => under(config, rule)))}`
     );
   }
-  const unplaceable = [
-    ...unprobed.map(
-      (rule) => `${rule} declares no probe, so ${optionSetsOf(config, rule).every((options) => options.length === 0) ? "its scope" : under(config, rule)} does not reach the corpus`
-    ),
-    ...inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`)
-  ];
-  if (unplaceable.length > 0) return said("UNJUDGED", named(unplaceable));
+  const unplaceable = inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`);
+  const kitNote = unprobed.length === 0 || loadedProbes === null ? "" : `the loaded plugin ships no probe for ${unprobed.length === 1 ? "this enabled rule" : `${unprobed.length} enabled rules`} \u2014 the kit's omission, not this repo's (geonosis #131): ${unprobed.join(", ")}`;
+  const unknowable = loadedProbes === null ? unprobed.map(
+    (rule) => `${rule} declares no probe, so ${optionSetsOf(config, rule).every((options) => options.length === 0) ? "its scope" : under(config, rule)} does not reach the corpus`
+  ) : [];
+  if (unplaceable.length > 0 || unknowable.length > 0) {
+    return said2(
+      "UNJUDGED",
+      named([...unknowable, ...unplaceable]) + (kitNote === "" ? "" : ` \u2014 and ${kitNote}`)
+    );
+  }
+  if (kitNote !== "") return said2("WARN", kitNote);
   const through = exercised.length === 1 ? "1 through its declared probe under this repo\u2019s options" : `${exercised.length} through their declared probes under this repo\u2019s options`;
-  return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where} \u2014 ${through}`);
+  return said2(
+    "OK",
+    `${enabled.length} enabled, ${enabled.length} exercised${where} \u2014 ${through}. ${BASE}`
+  );
+};
+
+// src/envelope.ts
+import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync7 } from "fs";
+import { join as join7 } from "path";
+var ENVELOPES_DIR = ".geonosis/envelopes";
+var NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one";
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var finding5 = (verdict, subject, message) => ({
+  check: "envelope",
+  message,
+  subject,
+  verdict
+});
+var lengthOf = (value) => Array.isArray(value) ? value.length : void 0;
+var NEXT = "Next: re-run the tool that wrote it and read the numbers it prints \u2014 a run that has lost count of its own inputs is a bug in that tool, not in this tree";
+var judge = (subject, name, parsed) => {
+  if (!isRecord2(parsed)) return finding5("FAIL", subject, `is not an object. ${NEXT}`);
+  const tool = parsed["tool"];
+  if (typeof tool !== "string" || tool.trim() === "") {
+    return finding5(
+      "FAIL",
+      subject,
+      `names no tool, so nothing here says which run it is about. ${NEXT}`
+    );
+  }
+  if (tool !== name) {
+    return finding5(
+      "FAIL",
+      subject,
+      `is written by "${tool}", not "${name}" \u2014 a tool writing another tool's envelope leaves both of their numbers unattributable. ${NEXT}`
+    );
+  }
+  const version = parsed["version"];
+  if (typeof version !== "string" || version.trim() === "") {
+    return finding5(
+      "FAIL",
+      subject,
+      `${tool}: names no version, so nothing dates this run and a stale envelope reads exactly like a fresh one. ${NEXT}`
+    );
+  }
+  const considered = parsed["considered"];
+  const read = parsed["read"];
+  const refused = lengthOf(parsed["refused"]);
+  const excused = lengthOf(parsed["excused"]);
+  if (typeof considered !== "number" || typeof read !== "number" || refused === void 0 || excused === void 0) {
+    return finding5(
+      "FAIL",
+      subject,
+      `${tool}: has no considered/read/refused/excused to check \u2014 the four numbers ARE the envelope, and a file without them measures nothing. ${NEXT}`
+    );
+  }
+  const accounted = read + refused + excused;
+  return considered === accounted ? finding5(
+    "OK",
+    subject,
+    `${tool} considered ${considered} and accounts for all of them \u2014 ${read} read + ${refused} refused + ${excused} excused`
+  ) : finding5(
+    "FAIL",
+    subject,
+    `${tool}: considered ${considered} but accounts for ${accounted} \u2014 ${read} read + ${refused} refused + ${excused} excused. It reported on fewer things than it was handed, and every verdict it printed is over the smaller number. ${NEXT}`
+  );
+};
+var checkEnvelopes = ({ root }) => {
+  const dir = join7(root, ENVELOPES_DIR);
+  const files = existsSync6(dir) ? readdirSync4(dir).filter((name) => name.endsWith(".json")).toSorted() : [];
+  if (files.length === 0) return [finding5("SKIP", ENVELOPES_DIR, NO_ENVELOPES)];
+  return files.map((name) => {
+    const subject = `${ENVELOPES_DIR}/${name}`;
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync7(join7(dir, name), "utf8"));
+    } catch (error) {
+      return finding5("FAIL", subject, `is not readable JSON: ${error.message}. ${NEXT}`);
+    }
+    return judge(subject, name.replace(/\.json$/, ""), parsed);
+  });
+};
+
+// src/repo-corpus.ts
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { join as join8 } from "path";
+var GEONOSIS_FILE = "geonosis.json";
+var repoCorpusOf = (root) => {
+  const path = join8(root, GEONOSIS_FILE);
+  if (!existsSync7(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync8(path, "utf8"));
+    const declared = parsed.doctor?.corpus;
+    return typeof declared === "string" && declared !== "" ? join8(root, declared) : void 0;
+  } catch {
+    return void 0;
+  }
+};
+
+// src/group.ts
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
+import { join as join9 } from "path";
+var FIXED_GROUP = [
+  "@geonosis/cli",
+  "@geonosis/doctor",
+  "@geonosis/evals",
+  "@geonosis/integrations",
+  "@geonosis/ledger",
+  "@geonosis/lint-parity",
+  "@geonosis/mcp",
+  "@geonosis/observability",
+  "@geonosis/oxlint-plugin-biological-architecture",
+  "@geonosis/policy",
+  "@geonosis/rails",
+  "@geonosis/ratchet",
+  "@geonosis/release",
+  "@geonosis/review",
+  "@geonosis/testbed",
+  "@geonosis/themekit",
+  "@geonosis/verify",
+  "@geonosis/verify-arch",
+  "@geonosis/visual-diff",
+  "@geonosis/walk",
+  "create-geonosis",
+  "geonosis"
+];
+var KIT_GROUP = { name: "@geonosis fixed group", packages: FIXED_GROUP };
+var declaredGroupsOf = (root) => {
+  const path = join9(root, GEONOSIS_FILE);
+  if (!existsSync8(path)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync9(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const declared = parsed.doctor?.groups;
+  if (declared === void 0) return void 0;
+  if (!Array.isArray(declared) || declared.length === 0) {
+    throw new DoctorError(
+      `${GEONOSIS_FILE} declares doctor.groups and names no group in it \u2014 say which packages must move together, or remove the key and get the kit's own group`
+    );
+  }
+  return declared.map((one, at) => {
+    const group = one;
+    if (typeof group.name !== "string" || !Array.isArray(group.packages) || group.packages.length < 2) {
+      throw new DoctorError(
+        `${GEONOSIS_FILE} doctor.groups[${at}] needs a name and at least two packages \u2014 one package cannot disagree with itself`
+      );
+    }
+    return { name: group.name, packages: group.packages };
+  });
+};
+var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
+var versionOf = (dir, name) => {
+  let entry;
+  try {
+    entry = resolveFrom(dir, name);
+  } catch {
+    return { kind: "absent" };
+  }
+  try {
+    const manifest = JSON.parse(
+      readFileSync9(join9(packageDirOf(entry, name), "package.json"), "utf8")
+    );
+    return typeof manifest.version === "string" ? { kind: "read", version: manifest.version } : { kind: "unreadable", why: "its package.json declares no version" };
+  } catch (error) {
+    return { kind: "unreadable", why: String(error.message).split("\n")[0] ?? "" };
+  }
+};
+var finding6 = (subject, verdict, message) => ({
+  check: "group",
+  message,
+  subject,
+  verdict
+});
+var said = (versions) => [...versions.entries()].map(([version, from]) => `${version} (${from.join(", ")})`).join("; ");
+var repoWide = (name, found) => {
+  const versions = /* @__PURE__ */ new Map();
+  for (const one of found) versions.set(one.version, [...versions.get(one.version) ?? [], one.at]);
+  if (versions.size === 1) return void 0;
+  return finding6(
+    name,
+    "FAIL",
+    `${versions.size} versions in one tree \u2014 ${said(versions)}. They are published as one number, so a tree holding two is a tree where one workspace is running code another has already replaced; remove the nested copies and reinstall`
+  );
+};
+var perWorkspace = (group, at, found) => {
+  if (new Set(found.map((one) => one.version)).size === 1) return void 0;
+  const listed = found.map((one) => `${one.name} ${one.version}`).join(", ");
+  return finding6(
+    at,
+    "FAIL",
+    `${group.name} does not hold together here \u2014 ${listed}. Every member is cut on one version, so a workspace resolving two of them is a bump that landed halfway`
+  );
+};
+var DOORS = ["@geonosis/cli", "geonosis"];
+var manifestOf = (dir, name) => {
+  try {
+    return JSON.parse(
+      readFileSync9(join9(packageDirOf(resolveFrom(dir, name), name), "package.json"), "utf8")
+    );
+  } catch {
+    return void 0;
+  }
+};
+var binNamesOf = (manifest, name) => {
+  const declared = manifest?.bin;
+  return typeof declared === "string" ? [name.replace(/^@[^/]+\//, "")] : Object.keys(declared ?? {});
+};
+var declaredIn2 = (manifest) => [
+  ...new Set(
+    [
+      manifest.dependencies,
+      manifest.devDependencies,
+      manifest.optionalDependencies,
+      manifest.peerDependencies
+    ].flatMap((block) => Object.keys(block ?? {}))
+  )
+];
+var rootDeclarations = (root, workspaces) => {
+  const here = workspaces.find((one) => one.relative === "");
+  if (here === void 0) return [];
+  const declared = declaredIn2(here.manifest);
+  const door = DOORS.find((name) => declared.includes(name));
+  if (door === void 0) return [];
+  const owned = new Set(
+    [door, ...DOORS].flatMap((name) => {
+      const manifest = manifestOf(root, name);
+      return manifest === void 0 ? [] : Object.keys(manifest.dependencies ?? {});
+    })
+  );
+  const callers = [
+    ...Object.values(here.manifest.scripts ?? {}),
+    ...hookLines(root).map((one) => one.line)
+  ].join("\n");
+  const spare = declared.filter(
+    (name) => !DOORS.includes(name) && owned.has(name) && !binNamesOf(manifestOf(root, name), name).some(
+      (bin) => new RegExp(`(?:^|[\\s;&|(/])${bin}(?:\\s|$)`).test(callers)
+    )
+  );
+  if (spare.length === 0) {
+    return [
+      finding6(
+        "package.json",
+        "OK",
+        `every @geonosis package this root declares is ${door} or a bin its own scripts call by name`
+      )
+    ];
+  }
+  return spare.map(
+    (name) => finding6(
+      name,
+      "WARN",
+      `the root declares it and no root script calls its bin \u2014 ${door} already brings it, so this second declaration is a version that can disagree with the door's, and every tool that asks what is used here reads it as unused. Drop it from the root, or declare it in the workspace whose code imports it`
+    )
+  );
+};
+var checkGroup = ({
+  groups,
+  root,
+  workspaces
+}) => {
+  const findings = [...rootDeclarations(root, workspaces)];
+  for (const group of groups ?? [KIT_GROUP]) {
+    const found = [];
+    for (const workspace of workspaces) {
+      const at = labelOf(workspace);
+      const here = [];
+      for (const name of group.packages) {
+        const reading = versionOf(workspace.dir, name);
+        if (reading.kind === "read") here.push({ at, name, version: reading.version });
+        if (reading.kind === "unreadable") {
+          findings.push(
+            finding6(
+              `${at} \u2192 ${name}`,
+              "UNJUDGED",
+              `it resolves from here and ${reading.why} \u2014 this copy could be any version, so the group cannot be said to hold or not to hold`
+            )
+          );
+        }
+      }
+      const split2 = here.length > 0 ? perWorkspace(group, at, here) : void 0;
+      if (split2 !== void 0) findings.push(split2);
+      found.push(...here);
+    }
+    if (found.length === 0) {
+      findings.push(
+        finding6(
+          group.name,
+          "SKIP",
+          `no workspace under ${root} resolves any of ${group.packages.join(", ")}, so nothing here versions together`
+        )
+      );
+      continue;
+    }
+    const names = [...new Set(found.map((one) => one.name))].toSorted();
+    const split = names.flatMap((name) => {
+      const line = repoWide(
+        name,
+        found.filter((one) => one.name === name)
+      );
+      return line === void 0 ? [] : [line];
+    });
+    findings.push(...split);
+    if (split.length === 0) {
+      const versions = [...new Set(found.map((one) => one.version))];
+      findings.push(
+        finding6(
+          group.name,
+          "OK",
+          `${names.length} of ${group.packages.length} installed, at ${versions.join(", ")}, one copy each across ${new Set(found.map((one) => one.at)).size} workspaces`
+        )
+      );
+    }
+  }
+  return findings;
 };
 
 // src/loaded.ts
-import { sep as sep3 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join10, sep as sep3 } from "path";
 var SCOPE = "@geonosis/";
 var BLOCKS = [
   "dependencies",
@@ -1346,11 +1866,11 @@ var PINNED = /^[=v]?(\d+\.\d+\.\d+(?:[-+][\w.-]+)?)$/;
 var RANGE = /^(\^|~|>=)\s*v?(\d+)\.(\d+)\.(\d+)$/;
 var LINKED = /^(?:file|link|portal|workspace):/;
 var ANY = /* @__PURE__ */ new Set(["", "*", "latest", "x"]);
-var versionOf = (found, at) => Number(found[at] ?? Number.NaN);
+var versionOf2 = (found, at) => Number(found[at] ?? Number.NaN);
 var parts = (found) => [
-  versionOf(found, 1),
-  versionOf(found, 2),
-  versionOf(found, 3)
+  versionOf2(found, 1),
+  versionOf2(found, 2),
+  versionOf2(found, 3)
 ];
 var below = (here, bound) => {
   for (const [at, one] of here.entries()) {
@@ -1371,9 +1891,9 @@ var satisfies = (version, spec) => {
   if (here === null) return void 0;
   const at = parts(here);
   const bound = [
-    versionOf(range, 2),
-    versionOf(range, 3),
-    versionOf(range, 4)
+    versionOf2(range, 2),
+    versionOf2(range, 3),
+    versionOf2(range, 4)
   ];
   if (below(at, bound)) return false;
   if (range[1] === ">=") return true;
@@ -1403,7 +1923,7 @@ var declaredFor = ({
   }
   return void 0;
 };
-var finding5 = (subject, verdict, message) => ({
+var finding7 = (subject, verdict, message) => ({
   check: "loaded",
   message,
   subject,
@@ -1420,36 +1940,36 @@ var oneConfig = async ({
   specifier,
   workspaces
 }) => {
-  const said = (verdict, message) => finding5(config.relative, verdict, `${specifier}: ${message}`);
+  const said2 = (verdict, message) => finding7(config.relative, verdict, `${specifier}: ${message}`);
   let loaded;
   try {
     loaded = await versionAt(resolveFrom(config.dir, specifier), specifier, root);
   } catch (error) {
-    return said(
+    return said2(
       "FAIL",
       `could not resolve it from this config's directory, and oxlint resolves it from exactly there \u2014 ${firstLine(error)}`
     );
   }
   const declared = declaredFor({ dir: config.dir, specifier, workspaces });
   if (declared === void 0) {
-    return said(
+    return said2(
       "FAIL",
       `loaded ${loaded.version} from ${loaded.at}, and no package.json from here up to the root declares it \u2014 nothing says which version this was meant to be`
     );
   }
   const held = satisfies(loaded.version, declared.spec);
   if (held === void 0) {
-    return said(
+    return said2(
       "FAIL",
       `loaded ${loaded.version}, and ${declared.at} declares "${declared.spec}" \u2014 a range this check cannot read, so it will not call the version right`
     );
   }
-  return held ? said("OK", `loaded ${loaded.version} = declared ${declared.spec} (${declared.at})`) : said(
+  return held ? said2("OK", `loaded ${loaded.version} = declared ${declared.spec} (${declared.at})`) : said2(
     "FAIL",
     `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}. Remove the nested copies (rm -rf <workspace>/node_modules/@geonosis) and reinstall; the linter is not running what the tree declares until then`
   );
 };
-var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
+var labelOf2 = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
 var copiesOf = async ({
   root,
   specifier,
@@ -1466,31 +1986,81 @@ var copiesOf = async ({
     const at = relativeToRoot(root, packageDirOf(entry, specifier));
     const already = found.get(at);
     if (already !== void 0) {
-      already.from.push(labelOf(workspace));
+      already.from.push(labelOf2(workspace));
       continue;
     }
-    found.set(at, { from: [labelOf(workspace)], version: await pluginVersionOf(entry) });
+    found.set(at, { from: [labelOf2(workspace)], version: await pluginVersionOf(entry) });
   }
   if (found.size === 0) {
-    return finding5(specifier, "FAIL", "no workspace in this tree can resolve it at all");
+    return finding7(specifier, "FAIL", "no workspace in this tree can resolve it at all");
   }
   const listed = [...found.entries()].map(([at, one]) => `${at} ${one.version} (${one.from.join(", ")})`).join("; ");
-  return found.size === 1 ? finding5(specifier, "OK", `1 copy \u2014 ${listed}`) : finding5(
+  return found.size === 1 ? finding7(specifier, "OK", `1 copy \u2014 ${listed}`) : finding7(
     specifier,
     "WARN",
     `${found.size} copies \u2014 ${listed}. Which one oxlint runs depends on which directory its config sits in.`
   );
 };
+var shipperOf = (root, bin) => {
+  const name = bin === "geonosis" ? "@geonosis/cli" : `@geonosis/${bin.replace(/^geonosis-/, "")}`;
+  try {
+    const manifest = JSON.parse(
+      readFileSync10(join10(packageDirOf(resolveFrom(root, name), name), "package.json"), "utf8")
+    );
+    const declared = manifest.bin;
+    return typeof declared === "object" && !Object.hasOwn(declared, bin) ? "" : name;
+  } catch {
+    return name;
+  }
+};
+var knipNote = (root, bin) => {
+  const shipper = shipperOf(root, bin);
+  return shipper === "" ? "" : `. knip resolves no dependency out of that path, so add ignoreDependencies: ["${shipper}"] to its config in the same commit`;
+};
+var gitHooks = (root) => {
+  const lines = hookLines(root);
+  if (lines.length === 0) {
+    return [finding7("git hooks", "SKIP", "no lefthook, husky or .githooks file here to read")];
+  }
+  const files = [...new Set(lines.map((one) => one.at))].toSorted();
+  return files.flatMap((at) => {
+    const here = lines.filter((one) => one.at === at);
+    const named2 = here.filter((one) => NAMES_A_BIN.test(one.line));
+    if (named2.length === 0) {
+      return [finding7(at, "SKIP", "it names no geonosis bin, so there is nothing here to start")];
+    }
+    const wrong = named2.flatMap((one) => {
+      const found = VERSION_MANAGED.exec(one.line)?.groups;
+      return found === void 0 ? [] : [{ bin: found["bin"] ?? "", runner: found["runner"] ?? "" }];
+    });
+    if (wrong.length === 0) {
+      return [
+        finding7(
+          at,
+          "OK",
+          `${named2.length} geonosis bin(s) here, every one called directly rather than through a runner`
+        )
+      ];
+    }
+    return wrong.map(
+      ({ bin, runner }) => finding7(
+        at,
+        "FAIL",
+        `it runs ${bin} through ${runner} \u2014 a git hook's PATH is not the shell's and carries no version-manager shim, so ${runner} fails to START and what the author reads is its message, not this gate's. Call it directly: node_modules/.bin/${bin}${knipNote(root, bin)}`
+      )
+    );
+  });
+};
 var checkLoaded = async ({
   configs,
   root,
   workspaces
 }) => {
-  const findings = [];
+  const findings = [...gitHooks(root)];
   const specifiers = /* @__PURE__ */ new Set();
   for (const config of configs) {
     if (config.error !== void 0) {
-      findings.push(finding5(config.relative, "FAIL", config.error));
+      findings.push(finding7(config.relative, "FAIL", config.error));
       continue;
     }
     for (const specifier of config.jsPlugins.filter((name) => name.startsWith(SCOPE))) {
@@ -1505,13 +2075,13 @@ var checkLoaded = async ({
 };
 
 // src/observability.ts
-import { readFileSync as readFileSync5 } from "fs";
-import { join as join6 } from "path";
-var GEONOSIS_FILE = "geonosis.json";
+import { readFileSync as readFileSync11 } from "fs";
+import { join as join11 } from "path";
+var GEONOSIS_FILE2 = "geonosis.json";
 var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
 var DEFAULT_MAX_AGE_SECONDS = 3600;
 var HEAD_TIMEOUT_MS = 3e3;
-var finding6 = (verdict, subject, message) => ({
+var finding8 = (verdict, subject, message) => ({
   check: "observability",
   message,
   subject,
@@ -1520,7 +2090,7 @@ var finding6 = (verdict, subject, message) => ({
 var readGeonosis2 = (root) => {
   let text;
   try {
-    text = readFileSync5(join6(root, GEONOSIS_FILE), "utf8");
+    text = readFileSync11(join11(root, GEONOSIS_FILE2), "utf8");
   } catch {
     return { present: false };
   }
@@ -1538,27 +2108,27 @@ var readGeonosis2 = (root) => {
 var exporterFinding = (config) => {
   const sink = config.sink;
   if (typeof sink !== "string" || sink.trim() === "") {
-    return finding6(
+    return finding8(
       "FAIL",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       "observability.sink is not set, so nothing here says where errors are supposed to go \u2014 and a repo that cannot name its exporter has not got one"
     );
   }
   if (REACHES_NOTHING.has(sink.toLowerCase())) {
-    return finding6(
+    return finding8(
       "WARN",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       `the configured sink is "${sink}", which answers ok and reaches nothing. Correct in a dev tree; in a deployed one it is the instrument that cannot fail.`
     );
   }
-  return finding6("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
+  return finding8("OK", GEONOSIS_FILE2, `the configured sink is "${sink}"`);
 };
 var reachableFinding = async (config) => {
   const endpoint = config.endpoint;
   if (typeof endpoint !== "string" || endpoint.trim() === "") {
-    return finding6(
+    return finding8(
       "SKIP",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       "no observability.endpoint was named, so whether the exporter is reachable was not asked"
     );
   }
@@ -1566,15 +2136,15 @@ var reachableFinding = async (config) => {
   const timer = setTimeout(() => controller.abort(), HEAD_TIMEOUT_MS);
   try {
     const response = await fetch(endpoint, { method: "HEAD", signal: controller.signal });
-    return finding6(
+    return finding8(
       "OK",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       `${endpoint} is reachable \u2014 it answered ${response.status} to a HEAD`
     );
   } catch (error) {
-    return finding6(
+    return finding8(
       "FAIL",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       `${endpoint} is not reachable from here: ${error.message}. Every report this repo sends is going into that.`
     );
   } finally {
@@ -1584,36 +2154,36 @@ var reachableFinding = async (config) => {
 var ageFinding = (config, root, now) => {
   const file = config.lastEventFile;
   if (typeof file !== "string" || file.trim() === "") {
-    return finding6(
+    return finding8(
       "SKIP",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       "no observability.lastEventFile was configured, so when the last event arrived is not a question anything here can answer. Have the sink write { at, id, sink } on every capture and name the file."
     );
   }
   const maxAgeSeconds = typeof config.maxAgeSeconds === "number" && config.maxAgeSeconds > 0 ? config.maxAgeSeconds : DEFAULT_MAX_AGE_SECONDS;
   let record;
   try {
-    record = JSON.parse(readFileSync5(join6(root, file), "utf8"));
+    record = JSON.parse(readFileSync11(join11(root, file), "utf8"));
   } catch (error) {
-    return finding6(
+    return finding8(
       "FAIL",
       file,
       `the last event file could not be read: ${error.message}. A sink that has never written one has never captured anything.`
     );
   }
   if (typeof record.at !== "number" || !Number.isFinite(record.at)) {
-    return finding6(
+    return finding8(
       "FAIL",
       file,
       'the last event record has no numeric "at", so its age cannot be read \u2014 and an age nobody can read is not an age inside the window'
     );
   }
   const ageSeconds = Math.round((now - record.at) / 1e3);
-  return ageSeconds > maxAgeSeconds ? finding6(
+  return ageSeconds > maxAgeSeconds ? finding8(
     "FAIL",
     file,
     `the last event arrived ${ageSeconds}s ago, past the ${maxAgeSeconds}s window. An exporter that stopped, a key that was rotated and a sink that has been dropping since Tuesday all look exactly like this, and all of them leave a green build.`
-  ) : finding6(
+  ) : finding8(
     "OK",
     file,
     `the last event arrived ${ageSeconds}s ago, inside the ${maxAgeSeconds}s window`
@@ -1622,18 +2192,18 @@ var ageFinding = (config, root, now) => {
 var probeFinding = (config) => {
   const probe = config.probe;
   if (typeof probe === "string" && probe.trim() !== "") {
-    return finding6("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
+    return finding8("OK", GEONOSIS_FILE2, `the probe that proves this exporter is "${probe}"`);
   }
   if (typeof config.lastEventFile === "string" && config.lastEventFile.trim() !== "") {
-    return finding6(
+    return finding8(
       "OK",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       "no probe command, but a last event file is read above, so something does look at this exporter"
     );
   }
-  return finding6(
+  return finding8(
     "WARN",
-    GEONOSIS_FILE,
+    GEONOSIS_FILE2,
     "neither observability.probe nor observability.lastEventFile is configured, so nothing in this repo has ever established that a report reaches the sink. Name a probe command \u2014 the doctor reports it, your gate runs it."
   );
 };
@@ -1644,19 +2214,19 @@ var checkObservability = async ({
   const read = readGeonosis2(root);
   if (read.error !== void 0) {
     return [
-      finding6(
+      finding8(
         "FAIL",
-        GEONOSIS_FILE,
-        `${GEONOSIS_FILE} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
+        GEONOSIS_FILE2,
+        `${GEONOSIS_FILE2} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
       )
     ];
   }
   if (!read.present || read.config === void 0) {
     return [
-      finding6(
+      finding8(
         "SKIP",
-        GEONOSIS_FILE,
-        `no observability block in ${GEONOSIS_FILE}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
+        GEONOSIS_FILE2,
+        `no observability block in ${GEONOSIS_FILE2}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
       )
     ];
   }
@@ -1669,28 +2239,14 @@ var checkObservability = async ({
   ];
 };
 
-// src/repo-corpus.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
-import { join as join7 } from "path";
-var GEONOSIS_FILE2 = "geonosis.json";
-var repoCorpusOf = (root) => {
-  const path = join7(root, GEONOSIS_FILE2);
-  if (!existsSync5(path)) return void 0;
-  try {
-    const parsed = JSON.parse(readFileSync6(path, "utf8"));
-    const declared = parsed.doctor?.corpus;
-    return typeof declared === "string" && declared !== "" ? join7(root, declared) : void 0;
-  } catch {
-    return void 0;
-  }
-};
-
 // src/runner.ts
+import { existsSync as existsSync9, readdirSync as readdirSync5, readFileSync as readFileSync12 } from "fs";
+import { join as join12 } from "path";
 var TEST_FAILURES = "testFailures";
 var RUNS_A_RUNNER = /(?:^|[\s;&|(])(?:npx\s+|bunx\s+|pnpm\s+(?:exec\s+)?)?(?:vitest|bun\s+test)(?:\s|$)/;
 var RUNS_BUN_TEST = /(?:^|[\s;&|(])(?:bunx\s+)?bun\s+test(?:\s|$)/;
 var WRITES_A_REPORT = /--reporter[= ]\S*json|--outputFile/i;
-var finding7 = (subject, verdict, message) => ({
+var finding9 = (subject, verdict, message) => ({
   check: "runner",
   message,
   subject,
@@ -1708,57 +2264,334 @@ var reportingCounters = (ratchet) => (ratchet?.counters ?? []).filter(
   (entry) => entry.counter === TEST_FAILURES && stringOf(entry.report) !== ""
 );
 var keyOf = (entry) => stringOf(entry.key) === "" ? TEST_FAILURES : stringOf(entry.key);
+var PROVES = /--prove\b/;
+var everythingRun2 = (root, workspaces) => {
+  const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
+  const dir = join12(root, ".github/workflows");
+  const workflows = (existsSync9(dir) ? readdirSync5(dir) : []).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((name) => {
+    try {
+      return readFileSync12(join12(dir, name), "utf8");
+    } catch {
+      return "";
+    }
+  });
+  let tiers = {};
+  try {
+    const config = JSON.parse(readFileSync12(join12(root, "geonosis.json"), "utf8"));
+    tiers = config.verify ?? {};
+  } catch {
+  }
+  return {
+    run: [...Object.values(tiers).flat(), ...scripts, ...workflows].join("\n"),
+    tiers: Object.keys(tiers)
+  };
+};
+var proveIsWired = ({
+  ratchet,
+  root,
+  workspaces
+}) => {
+  if (ratchet === void 0 || ratchet.counters.length === 0) return [];
+  const { run, tiers } = everythingRun2(root, workspaces);
+  if (PROVES.test(run)) {
+    return [
+      finding9(
+        RATCHET_FILE,
+        "OK",
+        `${ratchet.counters.length} counter(s), and something here runs geonosis-ratchet --prove`
+      )
+    ];
+  }
+  const where = tiers.at(-1) ?? "full";
+  return [
+    finding9(
+      RATCHET_FILE,
+      "WARN",
+      `${ratchet.counters.length} counter(s) and nothing here ever runs geonosis-ratchet --prove \u2014 not a verify tier, not a script, not a workflow. A counter that has never been seen reading its own planted finding has not been shown to measure anything, and it reads exactly like a clean tree. Add \`geonosis-ratchet --prove\` to the "${where}" tier in geonosis.json, or to the workflow that runs it`
+    )
+  ];
+};
 var checkRunner = ({
   ratchet,
+  root,
   workspaces
 }) => {
   const reading = reportingCounters(ratchet);
-  return workspaces.flatMap((workspace) => {
+  const perWorkspace2 = workspaces.flatMap((workspace) => {
     const script = stringOf(workspace.manifest.scripts?.test);
     if (script === "") return [];
     const subject = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
-    const said = (verdict, message) => [
-      finding7(subject, verdict, message)
+    const said2 = (verdict, message) => [
+      finding9(subject, verdict, message)
     ];
     if (!RUNS_A_RUNNER.test(script)) {
-      return said(
+      return said2(
         "OK",
         `"${script}" runs neither vitest nor bun test \u2014 this check has nothing to say about it`
       );
     }
     if (testFilesUnder(workspace.dir).length === 0) {
-      return said(
+      return said2(
         "SKIP",
         `"${script}" runs a test runner and there is no test file under this workspace \u2014 nothing here for its exit code to be wrong about`
       );
     }
     if (WRITES_A_REPORT.test(script)) {
-      return said("OK", "the script asks the runner for its own JSON report, not for a status code");
+      return said2("OK", "the script asks the runner for its own JSON report, not for a status code");
     }
     const counter = reading.find((entry) => covers(stringOf(entry.command), workspace, workspaces));
     if (counter !== void 0) {
-      return said("OK", `read by the ratchet's "${keyOf(counter)}" counter in report mode`);
+      return said2("OK", `read by the ratchet's "${keyOf(counter)}" counter in report mode`);
     }
     if (RUNS_BUN_TEST.test(script)) {
-      return said(
+      return said2(
         "OK",
         `"${script}" is judged by its exit code, and bun test's exit code is a verdict: a planted failure exits 1, measured on bun 1.4.0 (2026-08-30). Nothing further is required here.`
       );
     }
-    return said(
+    return said2(
       "WARN",
       `"${script}" runs vitest, whose exit code is the only verdict here; @cloudflare/vitest-pool-workers exited 0 on failing tests for weeks in a consumer. Give the ratchet a ${TEST_FAILURES} counter in report mode covering this workspace, or have the script write a JSON report.`
     );
   });
+  return [...proveIsWired({ ratchet, root, workspaces }), ...perWorkspace2];
 };
 
 // src/doctor.ts
+import { homedir as homedir2 } from "os";
+import { join as join14 } from "path";
 import { resolveOxlint } from "@geonosis/lint-parity";
+
+// src/engine.ts
+import { sep as sep4 } from "path";
+var declaredIn3 = (manifest) => new Set(
+  [
+    manifest.dependencies,
+    manifest.devDependencies,
+    manifest.optionalDependencies,
+    manifest.peerDependencies
+  ].flatMap((block) => Object.keys(block ?? {}))
+);
+var holds3 = (parent, child) => child === parent || child.startsWith(`${parent}${sep4}`);
+var reachableFrom = (dir, workspaces) => new Set(
+  workspaces.filter((one) => holds3(one.dir, dir)).flatMap((one) => [...declaredIn3(one.manifest)])
+);
+var enabledHere2 = (config, plugin) => [
+  .../* @__PURE__ */ new Set([
+    ...enabledRulesOf(config.rules, plugin),
+    ...config.overrides.flatMap((one) => enabledRulesOf(one.rules, plugin))
+  ])
+];
+var checkEngines = async ({
+  config,
+  entry,
+  workspaces
+}) => {
+  const read = await presumptionsOf(entry).catch(() => void 0);
+  if (read === void 0 || read.namespace === "" || Object.keys(read.presumed).length === 0) {
+    return [];
+  }
+  const declared = reachableFrom(config.dir, workspaces);
+  return enabledHere2(config, read.namespace).flatMap((rule) => {
+    const presumes = read.presumed[rule.slice(read.namespace.length + 1)];
+    if (presumes === void 0 || presumes.packages.some((name) => declared.has(name))) return [];
+    return [
+      {
+        check: "exercised",
+        message: `it presumes ${presumes.engine}, and no manifest from this config up to the root declares ${presumes.packages.join(" or ")} \u2014 enabled here it has no possible finding, which reads exactly like a clean tree. Drop it from this config, or say which package brings the engine`,
+        subject: `${config.relative} \u2192 ${rule}`,
+        verdict: "WARN"
+      }
+    ];
+  });
+};
+
+// src/rails.ts
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
+import { join as join13 } from "path";
+var GEONOSIS2 = "geonosis.json";
+var PROJECT = ".claude/settings.json";
+var LOCAL = ".claude/settings.local.json";
+var RUN_RECORD = ".geonosis/rails-run.json";
+var managedSettingsPath = (platform = process.platform) => platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json" : "/etc/claude-code/managed-settings.json";
+var finding10 = (subject, verdict, message) => ({
+  check: "rails",
+  message,
+  subject,
+  verdict
+});
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var networkIn = (parsed) => {
+  if (!isRecord3(parsed)) return void 0;
+  const sandbox = parsed["sandbox"];
+  if (!isRecord3(sandbox)) return void 0;
+  const network = sandbox["network"];
+  if (!isRecord3(network)) return void 0;
+  const allowed = network["allowedDomains"];
+  return {
+    allowedDomains: Array.isArray(allowed) ? allowed.filter((one) => typeof one === "string") : [],
+    ...network["allowManagedDomainsOnly"] === true ? { allowManagedDomainsOnly: true } : {}
+  };
+};
+var sourceAt = (path, label) => {
+  if (!existsSync10(path)) return { network: void 0, path: label, unreadable: false };
+  try {
+    return {
+      network: networkIn(JSON.parse(readFileSync13(path, "utf8"))),
+      path: label,
+      unreadable: false
+    };
+  } catch {
+    return { network: void 0, path: label, unreadable: true };
+  }
+};
+var declaredEgress = (root) => {
+  const at = join13(root, GEONOSIS2);
+  if (!existsSync10(at)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync13(at, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const egress = parsed?.rails?.egress;
+  if (!isRecord3(egress)) return void 0;
+  const allow = egress["allow"];
+  return {
+    allow: Array.isArray(allow) ? allow.filter((one) => typeof one === "string") : []
+  };
+};
+var deniedEgress = (root) => {
+  const at = join13(root, RUN_RECORD);
+  if (!existsSync10(at)) {
+    return [
+      finding10(
+        "deniedEgress",
+        "SKIP",
+        `there is no ${RUN_RECORD} here, so no run has been recorded for this to be a gate over`
+      )
+    ];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync13(at, "utf8"));
+  } catch (error) {
+    return [
+      finding10(
+        "deniedEgress",
+        "FAIL",
+        `${RUN_RECORD} is not readable JSON (${error.message}) \u2014 a record nobody can read is not a record of zero denied attempts`
+      )
+    ];
+  }
+  const denied = isRecord3(parsed) && Array.isArray(parsed["deniedEgress"]) ? parsed["deniedEgress"] : [];
+  if (denied.length === 0) {
+    return [finding10("deniedEgress", "OK", "no run recorded a denied egress attempt")];
+  }
+  const hosts = denied.map((one) => isRecord3(one) && typeof one["host"] === "string" ? one["host"] : "(unnamed)").join(", ");
+  return [
+    finding10(
+      "deniedEgress",
+      "FAIL",
+      `${denied.length} denied egress attempt(s) in this run's record \u2014 ${hosts}. This is a gate at ZERO and never a counter to hold flat: a run that reached for a host this repo does not allow is a run somebody reads, whatever the number was yesterday`
+    )
+  ];
+};
+var checkRails = ({
+  managedSettings = managedSettingsPath(),
+  root,
+  userSettings
+}) => {
+  const declared = declaredEgress(root);
+  if (declared === void 0 || declared.allow.length === 0) {
+    return [
+      finding10(
+        `${GEONOSIS2} \u2192 rails.egress`,
+        "SKIP",
+        "this repo declares no egress allowlist, so there is no rendered setting for this to read back"
+      )
+    ];
+  }
+  const sources = [
+    sourceAt(managedSettings, managedSettings),
+    sourceAt(userSettings, userSettings),
+    sourceAt(join13(root, PROJECT), PROJECT),
+    sourceAt(join13(root, LOCAL), LOCAL)
+  ];
+  const unreadable = sources.filter((one) => one.unreadable).map(
+    (one) => finding10(
+      one.path,
+      "FAIL",
+      "is not readable JSON, and Claude Code SILENTLY ignores a settings file that fails validation \u2014 every setting rendered into this file loads as nothing, with no error anywhere. Fix the file, then render the allowlist again"
+    )
+  );
+  const managedNetwork = sources[0]?.network;
+  const onlyManaged = managedNetwork?.allowManagedDomainsOnly === true;
+  const effective = new Set(
+    (onlyManaged ? [sources[0]] : sources).flatMap((one) => one?.network?.allowedDomains ?? [])
+  );
+  const why = onlyManaged ? ` Managed settings set sandbox.network.allowManagedDomainsOnly, so only ${managedSettings} allow rules load and every project, user and local domain is ignored \u2014 this one has to be added THERE` : ` Render it with \`geonosis-rails egress --write\`, into ${PROJECT} or the user scope`;
+  return [
+    ...unreadable,
+    ...declared.allow.map(
+      (domain) => effective.has(domain) ? finding10(domain, "OK", "declared, and in the settings that actually load") : finding10(
+        domain,
+        "FAIL",
+        `declared in ${GEONOSIS2} \u2192 rails.egress and absent from every settings file that loads, so the run has no allowance for it.${why}`
+      )
+    ),
+    ...deniedEgress(root)
+  ];
+};
+
+// src/required-options.ts
+import { pathToFileURL as pathToFileURL2 } from "url";
+var HEADER = /requires option `([^`]+)`/;
+var optionsOf2 = (level) => Array.isArray(level) ? level.slice(1) : [];
+var missingOption = (error) => {
+  const named2 = error.option;
+  return typeof named2 === "string" ? named2 : HEADER.exec(String(error.message))?.[1];
+};
+var configured = (config, namespace) => [config.rules, ...config.overrides.map((one) => one.rules)].flatMap(
+  (rules) => enabledRulesOf(rules, namespace).map((id) => [id, optionsOf2(rules[id])])
+);
+var checkRequiredOptions = async ({
+  config,
+  entry
+}) => {
+  const loaded = await import(pathToFileURL2(entry).href).catch(() => void 0);
+  const namespace = loaded?.default?.meta?.name;
+  const rules = loaded?.default?.rules;
+  if (typeof namespace !== "string" || namespace === "" || rules === void 0) return [];
+  return configured(config, namespace).flatMap(([id, options]) => {
+    const rule = rules[id.slice(namespace.length + 1)];
+    if (rule === void 0) return [];
+    try {
+      rule.create({ options, report: () => {
+      } });
+      return [];
+    } catch (error) {
+      const option = missingOption(error);
+      if (option === void 0) return [];
+      return [
+        {
+          check: "loaded",
+          message: `it is enabled here with no \`${option}\`, and the rule refuses to be constructed without one \u2014 oxlint stops the whole run at load, linting nothing. Configure \`${option}\`, or turn the rule off`,
+          subject: `${config.relative} \u2192 ${id}`,
+          verdict: "FAIL"
+        }
+      ];
+    }
+  });
+};
+
+// src/doctor.ts
 var exercisedOf = ({
   configs,
   oxlint,
   repoCorpus,
-  root
+  root,
+  workspaces
 }) => Promise.all(
   configs.flatMap(
     (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE)).map(async (specifier) => {
@@ -1768,22 +2601,33 @@ var exercisedOf = ({
         corpus = corpusOfPlugin(config.dir, specifier);
         entry = resolveFrom(config.dir, specifier);
       } catch (error) {
-        return {
-          check: "exercised",
-          message: `${specifier}: ${String(error.message)}`,
-          subject: config.relative,
-          verdict: "SKIP"
-        };
+        return [
+          {
+            check: "exercised",
+            message: `${specifier}: ${String(error.message)}`,
+            subject: config.relative,
+            verdict: "SKIP"
+          }
+        ];
       }
       const own = repoCorpus !== void 0 && config.relative === CONFIG_FILE ? repoCorpus : void 0;
-      return checkExercised({
-        config,
-        corpus,
-        entry,
-        oxlint,
-        ...own === void 0 ? {} : { repoCorpus: own },
-        root
-      });
+      const [reach, engines, options] = await Promise.all([
+        checkExercised({
+          config,
+          corpus,
+          entry,
+          oxlint,
+          ...own === void 0 ? {} : { repoCorpus: own },
+          root
+        }),
+        // #159: the rules whose engine this tree has not got. Beside the reach line rather than
+        // inside it — one is about the corpus, the other about this repo's own manifests.
+        checkEngines({ config, entry, workspaces }),
+        // #202: and the rules this config enables without an option they require, which the
+        // lint can only report as a run it could not make.
+        checkRequiredOptions({ config, entry })
+      ]);
+      return [reach, ...engines, ...options];
     })
   )
 );
@@ -1802,6 +2646,7 @@ var baselineOf = ({
   const ref = baseline.ref ?? defaultRef(root);
   return ref === void 0 ? skip("no ref was named and this repo has no origin/main to fall back on") : checkBaseline({ ref, root });
 };
+var USER_SETTINGS = ".claude/settings.json";
 var ordered = (findings) => CHECKS.flatMap((check) => findings.filter((one) => one.check === check));
 var EMPTY = { FAIL: 0, OK: 0, SKIP: 0, UNJUDGED: 0, WARN: 0 };
 var countsOf = (findings) => findings.reduce((counts, one) => ({ ...counts, [one.verdict]: counts[one.verdict] + 1 }), {
@@ -1824,6 +2669,17 @@ var runDoctor = async ({
   const asked = (check) => only === void 0 || only.includes(check);
   const runs = [
     ["loaded", () => checkLoaded({ configs, root, workspaces })],
+    [
+      "group",
+      () => {
+        const declared = declaredGroupsOf(root);
+        return checkGroup({
+          ...declared === void 0 ? {} : { groups: declared },
+          root,
+          workspaces
+        });
+      }
+    ],
     [
       "exercised",
       () => {
@@ -1832,15 +2688,18 @@ var runDoctor = async ({
           configs,
           oxlint: oxlint ?? resolveOxlint(root),
           ...repoCorpus === void 0 ? {} : { repoCorpus },
-          root
-        });
+          root,
+          workspaces
+        }).then((found2) => found2.flat());
       }
     ],
     ["baseline", () => baselineOf({ baseline, root })],
-    ["runner", () => checkRunner({ ratchet: readRatchet(root), workspaces })],
+    ["runner", () => checkRunner({ ratchet: readRatchet(root), root, workspaces })],
+    ["envelope", () => checkEnvelopes({ root })],
     ["observability", () => checkObservability({ now: Date.now(), root })],
     ["drift", () => checkDrift({ root, workspaces })],
-    ["deployed", () => checkDeployed({ root })]
+    ["deployed", () => checkDeployed({ root })],
+    ["rails", () => checkRails({ root, userSettings: join14(homedir2(), USER_SETTINGS) })]
   ];
   const collected = [];
   for (const [check, run] of runs) if (asked(check)) collected.push(...await run());
@@ -1859,9 +2718,12 @@ var ABOUT = {
   baseline: "a number that may only shrink, against another ref",
   deployed: "what the pipeline reported deploying is what the tree declares",
   drift: "the gates that were set up and are no longer running",
+  envelope: "every gate read as many things as it was handed",
   exercised: "every enabled rule fires on at least one corpus file",
+  group: "the packages published on one version resolve to one version",
   loaded: "the plugin oxlint would load is the one the manifest pins",
   observability: "an exporter is configured, reachable, and something arrived through it lately",
+  rails: "the egress a run is bounded by is in the settings that actually load",
   runner: "something reads the test runner\u2019s own report, not its exit code"
 };
 var WIDTH = 8;
@@ -1910,17 +2772,26 @@ export {
   pluginVersionOf,
   corpusOfPlugin,
   relativeToRoot,
+  COMPOSITION_ROOT,
+  FLOOR_PACKAGES,
   READERS,
   checkDrift,
   enabledRulesOf,
   checkExercised,
+  ENVELOPES_DIR,
+  NO_ENVELOPES,
+  checkEnvelopes,
+  GEONOSIS_FILE,
+  repoCorpusOf,
+  FIXED_GROUP,
+  KIT_GROUP,
+  declaredGroupsOf,
+  checkGroup,
   SCOPE,
   satisfies,
   declaredFor,
   checkLoaded,
   checkObservability,
-  GEONOSIS_FILE2 as GEONOSIS_FILE,
-  repoCorpusOf,
   checkRunner,
   runDoctor,
   formatDoctor,