@geonosis/doctor 1.4.0 → 2.1.0

package/dist/{chunk-R4OLFNI6.js → chunk-R2R2OYH3.js}

@@ -319,16 +319,34 @@ var checkDeployed = ({ root }) => {
   ];
 };
 
+// src/repo-corpus.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+var GEONOSIS_FILE = "geonosis.json";
+var repoCorpusOf = (root) => {
+  const path = join3(root, GEONOSIS_FILE);
+  if (!existsSync2(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const declared = parsed.doctor?.corpus;
+    return typeof declared === "string" && declared !== "" ? join3(root, declared) : void 0;
+  } catch {
+    return void 0;
+  }
+};
+
 // src/types.ts
 var CHECKS = [
   "loaded",
+  "group",
   "exercised",
   "baseline",
   "runner",
   "envelope",
   "drift",
   "observability",
-  "deployed"
+  "deployed",
+  "rails"
 ];
 var DoctorError = class extends Error {
   constructor(message) {
@@ -338,9 +356,9 @@ var DoctorError = class extends Error {
 };
 
 // src/resolve.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync } from "fs";
 import { createRequire } from "module";
-import { dirname, join as join3 } from "path";
+import { dirname, join as join4 } from "path";
 import { pathToFileURL } from "url";
 var packageNameOf = (specifier) => {
   const parts2 = specifier.split("/");
@@ -348,13 +366,13 @@ var packageNameOf = (specifier) => {
 };
 var resolveFrom = (dir, specifier) => {
   if (specifier.startsWith(".") || specifier.startsWith("/")) {
-    return createRequire(join3(dir, "noop.js")).resolve(specifier);
+    return createRequire(join4(dir, "noop.js")).resolve(specifier);
   }
   const name = packageNameOf(specifier);
   let at = dir;
   for (; ; ) {
-    if (existsSync2(join3(at, "node_modules", name, "package.json"))) {
-      return createRequire(join3(at, "noop.js")).resolve(specifier);
+    if (existsSync3(join4(at, "node_modules", name, "package.json"))) {
+      return createRequire(join4(at, "noop.js")).resolve(specifier);
     }
     const parent = dirname(at);
     if (parent === at) break;
@@ -367,10 +385,10 @@ var resolveFrom = (dir, specifier) => {
 var packageDirOf = (entry, name) => {
   let dir = dirname(entry);
   for (; ; ) {
-    const manifest = join3(dir, "package.json");
-    if (existsSync2(manifest)) {
+    const manifest = join4(dir, "package.json");
+    if (existsSync3(manifest)) {
       try {
-        const parsed = JSON.parse(readFileSync3(manifest, "utf8"));
+        const parsed = JSON.parse(readFileSync4(manifest, "utf8"));
         if (parsed.name === name) return dir;
       } catch {
       }
@@ -405,7 +423,21 @@ var probesOf = async (entry, plugin) => {
     })
   );
 };
-var corpusOfPlugin = (from, specifier) => join3(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
+var presumptionsOf = async (entry) => {
+  const loaded = await import(pathToFileURL(entry).href);
+  const namespace = loaded.default?.meta?.name;
+  return {
+    namespace: typeof namespace === "string" ? namespace : "",
+    presumed: Object.fromEntries(
+      Object.entries(loaded.default?.rules ?? {}).flatMap(([name, rule]) => {
+        const presumes = rule?.presumes;
+        const engine = presumes?.engine;
+        return typeof engine === "string" && Array.isArray(presumes?.packages) ? [[name, { engine, packages: presumes.packages }]] : [];
+      })
+    )
+  };
+};
+var corpusOfPlugin = (from, specifier) => join4(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
 var real = (path) => {
   try {
     return realpathSync(path);
@@ -415,10 +447,281 @@ var real = (path) => {
 };
 var relativeToRoot = (root, path) => relativePath(real(root), real(path));
 
+// src/group.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { join as join6 } from "path";
+
+// src/hooks.ts
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
+var HOOK_FILES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"];
+var HOOK_DIRS = [".husky", ".githooks"];
+var VERSION_MANAGED = /(?:^|[\s;&|(])(?<runner>pnpm|npx|bunx|yarn)\b(?:\s+(?:exec|run|dlx|x))?\s+(?<bin>geonosis(?:-[a-z-]+)?)\b/;
+var NAMES_A_BIN = /(?:^|[\s;&|(/])geonosis(?:-[a-z-]+)?\b/;
+var hookLines = (root) => {
+  const found = [];
+  const read = (path) => {
+    const at = relativePath(root, path);
+    for (const line of readFileSync5(path, "utf8").split("\n")) {
+      if (line.trim() !== "") found.push({ at, line });
+    }
+  };
+  for (const name of HOOK_FILES) {
+    const path = join5(root, name);
+    if (existsSync4(path)) read(path);
+  }
+  for (const name of HOOK_DIRS) {
+    const dir = join5(root, name);
+    if (!existsSync4(dir)) continue;
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      if (entry.isFile() && !entry.name.startsWith("_") && !entry.name.startsWith(".")) {
+        read(join5(dir, entry.name));
+      }
+    }
+  }
+  return found;
+};
+
+// src/group.ts
+var FIXED_GROUP = [
+  "@geonosis/cli",
+  "@geonosis/doctor",
+  "@geonosis/evals",
+  "@geonosis/integrations",
+  "@geonosis/ledger",
+  "@geonosis/lint-parity",
+  "@geonosis/mcp",
+  "@geonosis/observability",
+  "@geonosis/oxlint-plugin-biological-architecture",
+  "@geonosis/policy",
+  "@geonosis/rails",
+  "@geonosis/ratchet",
+  "@geonosis/release",
+  "@geonosis/review",
+  "@geonosis/testbed",
+  "@geonosis/themekit",
+  "@geonosis/verify",
+  "@geonosis/verify-arch",
+  "@geonosis/visual-diff",
+  "@geonosis/walk",
+  "create-geonosis",
+  "geonosis"
+];
+var KIT_GROUP = { name: "@geonosis fixed group", packages: FIXED_GROUP };
+var declaredGroupsOf = (root) => {
+  const path = join6(root, GEONOSIS_FILE);
+  if (!existsSync5(path)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const declared = parsed.doctor?.groups;
+  if (declared === void 0) return void 0;
+  if (!Array.isArray(declared) || declared.length === 0) {
+    throw new DoctorError(
+      `${GEONOSIS_FILE} declares doctor.groups and names no group in it \u2014 say which packages must move together, or remove the key and get the kit's own group`
+    );
+  }
+  return declared.map((one, at) => {
+    const group = one;
+    if (typeof group.name !== "string" || !Array.isArray(group.packages) || group.packages.length < 2) {
+      throw new DoctorError(
+        `${GEONOSIS_FILE} doctor.groups[${at}] needs a name and at least two packages \u2014 one package cannot disagree with itself`
+      );
+    }
+    return { name: group.name, packages: group.packages };
+  });
+};
+var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
+var versionOf = (dir, name) => {
+  let entry;
+  try {
+    entry = resolveFrom(dir, name);
+  } catch {
+    return { kind: "absent" };
+  }
+  try {
+    const manifest = JSON.parse(
+      readFileSync6(join6(packageDirOf(entry, name), "package.json"), "utf8")
+    );
+    return typeof manifest.version === "string" ? { kind: "read", version: manifest.version } : { kind: "unreadable", why: "its package.json declares no version" };
+  } catch (error) {
+    return { kind: "unreadable", why: String(error.message).split("\n")[0] ?? "" };
+  }
+};
+var finding3 = (subject, verdict, message) => ({
+  check: "group",
+  message,
+  subject,
+  verdict
+});
+var said = (versions) => [...versions.entries()].map(([version, from]) => `${version} (${from.join(", ")})`).join("; ");
+var repoWide = (name, found) => {
+  const versions = /* @__PURE__ */ new Map();
+  for (const one of found) versions.set(one.version, [...versions.get(one.version) ?? [], one.at]);
+  if (versions.size === 1) return void 0;
+  return finding3(
+    name,
+    "FAIL",
+    `${versions.size} versions in one tree \u2014 ${said(versions)}. They are published as one number, so a tree holding two is a tree where one workspace is running code another has already replaced; remove the nested copies and reinstall`
+  );
+};
+var perWorkspace = (group, at, found) => {
+  if (new Set(found.map((one) => one.version)).size === 1) return void 0;
+  const listed = found.map((one) => `${one.name} ${one.version}`).join(", ");
+  return finding3(
+    at,
+    "FAIL",
+    `${group.name} does not hold together here \u2014 ${listed}. Every member is cut on one version, so a workspace resolving two of them is a bump that landed halfway`
+  );
+};
+var DOORS = ["@geonosis/cli", "geonosis"];
+var manifestOf = (dir, name) => {
+  try {
+    return JSON.parse(
+      readFileSync6(join6(packageDirOf(resolveFrom(dir, name), name), "package.json"), "utf8")
+    );
+  } catch {
+    return void 0;
+  }
+};
+var binNamesOf = (manifest, name) => {
+  const declared = manifest?.bin;
+  return typeof declared === "string" ? [name.replace(/^@[^/]+\//, "")] : Object.keys(declared ?? {});
+};
+var declaredIn2 = (manifest) => [
+  ...new Set(
+    [
+      manifest.dependencies,
+      manifest.devDependencies,
+      manifest.optionalDependencies,
+      manifest.peerDependencies
+    ].flatMap((block) => Object.keys(block ?? {}))
+  )
+];
+var calls = (lines, bin) => new RegExp(`(?:^|[\\s;&|(/])${bin}(?:\\s|$)`).test(lines);
+var workspaceCaller = (workspaces, bins) => {
+  for (const workspace of workspaces) {
+    if (workspace.relative === "") continue;
+    for (const [script, line] of Object.entries(workspace.manifest.scripts ?? {})) {
+      if (bins.some((bin) => calls(line, bin))) return { at: workspace.relative, script };
+    }
+  }
+  return void 0;
+};
+var rootDeclarations = (root, workspaces) => {
+  const here = workspaces.find((one) => one.relative === "");
+  if (here === void 0) return [];
+  const declared = declaredIn2(here.manifest);
+  const door = DOORS.find((name) => declared.includes(name));
+  if (door === void 0) return [];
+  const owned = new Set(
+    [door, ...DOORS].flatMap((name) => {
+      const manifest = manifestOf(root, name);
+      return manifest === void 0 ? [] : Object.keys(manifest.dependencies ?? {});
+    })
+  );
+  const callers = [
+    ...Object.values(here.manifest.scripts ?? {}),
+    ...hookLines(root).map((one) => one.line)
+  ].join("\n");
+  const loadedHere = new Set(readConfig(join6(root, CONFIG_FILE), root).jsPlugins);
+  const spare = declared.filter(
+    (name) => !DOORS.includes(name) && owned.has(name) && !loadedHere.has(name) && !binNamesOf(manifestOf(root, name), name).some((bin) => calls(callers, bin))
+  );
+  if (spare.length === 0) {
+    return [
+      finding3(
+        "package.json",
+        "OK",
+        `every @geonosis package this root declares is ${door} or a bin its own scripts call by name`
+      )
+    ];
+  }
+  return spare.map((name) => {
+    const bins = binNamesOf(manifestOf(root, name), name);
+    const inWorkspace = workspaceCaller(workspaces, bins);
+    if (inWorkspace !== void 0) {
+      return finding3(
+        name,
+        "OK",
+        `no root script calls its bin, and ${inWorkspace.at}'s "${inWorkspace.script}" script does \u2014 under a hoisted linker the ROOT declaration is what makes that bin resolvable there, so this is the declaration doing its job`
+      );
+    }
+    return finding3(
+      name,
+      "WARN",
+      `the root declares it and no script in this repo calls its bin \u2014 ${door} already brings it, so this second declaration is a version that can disagree with the door's, and every tool that asks what is used here reads it as unused. Drop it from the root, or declare it in the workspace whose code imports it`
+    );
+  });
+};
+var checkGroup = ({
+  groups,
+  root,
+  workspaces
+}) => {
+  const findings = [...rootDeclarations(root, workspaces)];
+  for (const group of groups ?? [KIT_GROUP]) {
+    const found = [];
+    for (const workspace of workspaces) {
+      const at = labelOf(workspace);
+      const here = [];
+      for (const name of group.packages) {
+        const reading = versionOf(workspace.dir, name);
+        if (reading.kind === "read") here.push({ at, name, version: reading.version });
+        if (reading.kind === "unreadable") {
+          findings.push(
+            finding3(
+              `${at} \u2192 ${name}`,
+              "UNJUDGED",
+              `it resolves from here and ${reading.why} \u2014 this copy could be any version, so the group cannot be said to hold or not to hold`
+            )
+          );
+        }
+      }
+      const split2 = here.length > 0 ? perWorkspace(group, at, here) : void 0;
+      if (split2 !== void 0) findings.push(split2);
+      found.push(...here);
+    }
+    if (found.length === 0) {
+      findings.push(
+        finding3(
+          group.name,
+          "SKIP",
+          `no workspace under ${root} resolves any of ${group.packages.join(", ")}, so nothing here versions together`
+        )
+      );
+      continue;
+    }
+    const names = [...new Set(found.map((one) => one.name))].toSorted();
+    const split = names.flatMap((name) => {
+      const line = repoWide(
+        name,
+        found.filter((one) => one.name === name)
+      );
+      return line === void 0 ? [] : [line];
+    });
+    findings.push(...split);
+    if (split.length === 0) {
+      const versions = [...new Set(found.map((one) => one.version))];
+      findings.push(
+        finding3(
+          group.name,
+          "OK",
+          `${names.length} of ${group.packages.length} installed, at ${versions.join(", ")}, one copy each across ${new Set(found.map((one) => one.at)).size} workspaces`
+        )
+      );
+    }
+  }
+  return findings;
+};
+
 // src/drift.ts
-import { closeSync, existsSync as existsSync3, openSync, readdirSync as readdirSync2, readFileSync as readFileSync4, readSync } from "fs";
+import { closeSync, existsSync as existsSync6, openSync, readdirSync as readdirSync3, readFileSync as readFileSync7, readSync } from "fs";
 import { homedir } from "os";
-import { join as join4, sep as sep2 } from "path";
+import { join as join7, sep as sep2 } from "path";
 
 // src/overrides.ts
 var SPECIAL = /* @__PURE__ */ new Set(["$", "(", ")", "+", ".", "/", "@", "\\", "^", "|"]);
@@ -490,7 +793,7 @@ var GEONOSIS = "geonosis.json";
 var LAW = "CLAUDE.md";
 var CEILING = 200;
 var SWITCHED_OFF = /^\s*if:\s*(?:\$\{\{\s*)?false\b/m;
-var finding3 = (subject, verdict, message) => ({
+var finding4 = (subject, verdict, message) => ({
   check: "drift",
   message,
   subject,
@@ -502,33 +805,33 @@ var filesUnder = (dir, match) => {
   const walk2 = (at) => {
     let entries;
     try {
-      entries = readdirSync2(at, { withFileTypes: true });
+      entries = readdirSync3(at, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join4(at, entry.name));
+        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join7(at, entry.name));
         continue;
       }
-      if (entry.isFile() && match(entry.name)) found.push(join4(at, entry.name));
+      if (entry.isFile() && match(entry.name)) found.push(join7(at, entry.name));
     }
   };
   walk2(dir);
   return found;
 };
 var ci = (root) => {
-  const dir = join4(root, WORKFLOWS);
-  if (!existsSync3(dir)) {
-    return [finding3(WORKFLOWS, "SKIP", "there are no workflows here to read")];
+  const dir = join7(root, WORKFLOWS);
+  if (!existsSync6(dir)) {
+    return [finding4(WORKFLOWS, "SKIP", "there are no workflows here to read")];
   }
   return filesUnder(dir, (name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((path) => {
     const at = relativePath(root, path);
-    return SWITCHED_OFF.test(readFileSync4(path, "utf8")) ? finding3(
+    return SWITCHED_OFF.test(readFileSync7(path, "utf8")) ? finding4(
       at,
       "FAIL",
       "a job or step here is switched off by a condition that can never be true \u2014 every gate downstream of it reports green having run nothing"
-    ) : finding3(at, "OK", "nothing in it is switched off");
+    ) : finding4(at, "OK", "nothing in it is switched off");
   });
 };
 var holds = (parent, child) => child === parent || child.startsWith(`${parent}${sep2}`);
@@ -544,10 +847,10 @@ var orphanTests = (root, workspaces) => {
     orphaned.set(at, [...orphaned.get(at) ?? [], relativePath(root, path)]);
   }
   if (orphaned.size === 0) {
-    return [finding3("test files", "OK", "every test file sits under a workspace that runs tests")];
+    return [finding4("test files", "OK", "every test file sits under a workspace that runs tests")];
   }
   return [...orphaned.entries()].map(
-    ([at, files]) => finding3(
+    ([at, files]) => finding4(
       at,
       "FAIL",
       `${files.length} test file(s) here and no test script to run them \u2014 ${files.slice(0, 3).join(", ")}`
@@ -572,16 +875,16 @@ var pathsRunByScript = (script) => script.split(BETWEEN_COMMANDS).map(pathRunBy)
 var scriptPaths = (workspaces) => {
   const missing = workspaces.flatMap(
     (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
-      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync3(join4(one.dir, path))).map((path) => ({ name, path, workspace: one }))
+      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync6(join7(one.dir, path))).map((path) => ({ name, path, workspace: one }))
     )
   );
   if (missing.length === 0) {
     return [
-      finding3("script paths", "OK", "every file a script hands to bun, node or tsx is on disk")
+      finding4("script paths", "OK", "every file a script hands to bun, node or tsx is on disk")
     ];
   }
   return missing.map(
-    ({ name, path, workspace }) => finding3(
+    ({ name, path, workspace }) => finding4(
       workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`,
       "FAIL",
       `the "${name}" script runs ${path} and there is no such file \u2014 this script fails at that command, and every gate that calls it has been running nothing since the file went`
@@ -604,16 +907,16 @@ var workspaceBins = (workspaces) => {
 var linkedBins = (root, workspaces) => {
   const bins = workspaceBins(workspaces);
   if (bins.size === 0) {
-    return [finding3("workspace bins", "SKIP", "no workspace here declares a bin")];
+    return [finding4("workspace bins", "SKIP", "no workspace here declares a bin")];
   }
   const missing = workspaces.flatMap(
     (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
-      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter((name) => !existsSync3(join4(root, "node_modules/.bin", name))).map((name) => ({ name, script, workspace: one }))
+      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter((name) => !existsSync6(join7(root, "node_modules/.bin", name))).map((name) => ({ name, script, workspace: one }))
     )
   );
   if (missing.length === 0) {
     return [
-      finding3(
+      finding4(
         "workspace bins",
         "OK",
         "every workspace bin a script names is linked under the root"
@@ -621,7 +924,7 @@ var linkedBins = (root, workspaces) => {
     ];
   }
   return missing.map(
-    ({ name, script, workspace }) => finding3(
+    ({ name, script, workspace }) => finding4(
       name,
       "FAIL",
       `the "${script}" script in ${workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`} calls it, ${bins.get(name)?.manifest.name ?? "a workspace"} declares it, and node_modules/.bin/${name} is not there \u2014 add that package as a dependency of the one whose script calls it, so the package manager links the bin`
@@ -643,7 +946,7 @@ var preloadAroundPnpm = (root, workspaces) => {
   const some = scripts.slice(0, 3).join(", ");
   const rest = scripts.length > 3 ? ` and ${scripts.length - 3} more` : "";
   return [
-    finding3(
+    finding4(
       "NODE_OPTIONS",
       "WARN",
       `${scripts.length} script(s) preload something through NODE_OPTIONS (${some}${rest}), and the "${named2}" counter(s) shell out to pnpm \u2014 a nested pnpm INHERITS the option and dies on it (a preloaded resolver patch sends it looking for a .pnpmfile.mjs that is not there). Run the ratchet outside those scripts, or unset NODE_OPTIONS for the nested call: env -u NODE_OPTIONS pnpm \u2026`
@@ -679,11 +982,11 @@ var everythingRun = (root, workspaces) => {
   const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
   const counters = (readRatchet(root)?.counters ?? []).map((entry) => String(entry.command ?? ""));
   const workflows = filesUnder(
-    join4(root, WORKFLOWS),
+    join7(root, WORKFLOWS),
     (name) => name.endsWith(".yml") || name.endsWith(".yaml")
   ).map((path) => {
     try {
-      return readFileSync4(path, "utf8");
+      return readFileSync7(path, "utf8");
     } catch {
       return "";
     }
@@ -694,7 +997,7 @@ var generatedFiles = (root, workspaces) => {
   const marked = filesUnder(root, (name) => CAN_CARRY_A_MARKER.test(name)).map((path) => ({ marker: markerIn(path), path })).filter((one) => one.marker !== void 0);
   if (marked.length === 0) {
     return [
-      finding3(
+      finding4(
         "generated files",
         "SKIP",
         "nothing here says it was generated, so there is no write half here to look for a read half of"
@@ -705,13 +1008,13 @@ var generatedFiles = (root, workspaces) => {
   return marked.map(({ marker, path }) => {
     const at = relativePath(root, path);
     if (!("gate" in marker)) {
-      return finding3(
+      return finding4(
         at,
         "FAIL",
         `generated by \`${marker.writer}\` and it names no gate that reads it back. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Re-run \`${marker.writer}\` on a version that writes the \`geonosis:gated-by:\` marker, and run the gate it names`
       );
     }
-    return run.includes(marker.gate) ? finding3(at, "OK", `generated, and \`${marker.gate}\` reads it back`) : finding3(
+    return run.includes(marker.gate) ? finding4(at, "OK", `generated, and \`${marker.gate}\` reads it back`) : finding4(
       at,
       "FAIL",
       `generated, and nothing here runs \`${marker.gate}\` \u2014 the gate it names. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Add \`${marker.gate}\` to a script, a counter or a workflow`
@@ -719,10 +1022,10 @@ var generatedFiles = (root, workspaces) => {
   });
 };
 var readGeonosis = (root) => {
-  const path = join4(root, GEONOSIS);
-  if (!existsSync3(path)) return void 0;
+  const path = join7(root, GEONOSIS);
+  if (!existsSync6(path)) return void 0;
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -730,15 +1033,15 @@ var readGeonosis = (root) => {
 var law = (root, config) => {
   const declared = config?.law ?? {};
   const file = typeof declared.file === "string" ? declared.file : LAW;
-  const path = join4(root, file);
-  if (!existsSync3(path)) {
-    return [finding3(file, "SKIP", "there is no law file here to measure")];
+  const path = join7(root, file);
+  if (!existsSync6(path)) {
+    return [finding4(file, "SKIP", "there is no law file here to measure")];
   }
-  const source = readFileSync4(path, "utf8");
+  const source = readFileSync7(path, "utf8");
   const lines = source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
   if (typeof declared.maxLines !== "number") {
     return [
-      finding3(
+      finding4(
         file,
         "SKIP",
         `${lines} lines, and no ceiling to measure them against \u2014 set law.maxLines in geonosis.json to have this asked (${CEILING} is what both source repos converged on)`
@@ -747,18 +1050,18 @@ var law = (root, config) => {
   }
   const ceiling = declared.maxLines;
   return [
-    lines > ceiling ? finding3(
+    lines > ceiling ? finding4(
       file,
       "WARN",
       `${lines} lines against a ceiling of ${ceiling} \u2014 depth belongs in the skills and in the rules, where it is read`
-    ) : finding3(file, "OK", `${lines} lines, under the ceiling of ${ceiling}`)
+    ) : finding4(file, "OK", `${lines} lines, under the ceiling of ${ceiling}`)
   ];
 };
 var KIT_PLUGIN = "geonosis";
 var enablesKit = (path) => {
-  if (!existsSync3(path)) return false;
+  if (!existsSync6(path)) return false;
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
     const enabled = parsed.enabledPlugins;
     if (typeof enabled !== "object" || enabled === null) return false;
     return Object.entries(enabled).some(
@@ -769,13 +1072,13 @@ var enablesKit = (path) => {
   }
 };
 var hooks = (root, userSettings) => {
-  const path = join4(root, SETTINGS);
+  const path = join7(root, SETTINGS);
   if (enablesKit(path)) {
-    return [finding3(SETTINGS, "OK", `\`enabledPlugins\` here enables the kit\u2019s plugin`)];
+    return [finding4(SETTINGS, "OK", `\`enabledPlugins\` here enables the kit\u2019s plugin`)];
   }
   if (enablesKit(userSettings)) {
     return [
-      finding3(
+      finding4(
         SETTINGS,
         "OK",
         `installed elsewhere \u2014 not this repo\u2019s to declare: \`enabledPlugins\` in ${userSettings} enables it for every repo on this machine`
@@ -783,13 +1086,167 @@ var hooks = (root, userSettings) => {
     ];
   }
   return [
-    finding3(
+    finding4(
       SETTINGS,
       "WARN",
       `nothing enables the kit\u2019s plugin, so none of the hooks, agents or skills reach this repo \u2014 the gates run, the method does not. What satisfies this: a "geonosis@<marketplace>" entry under \`enabledPlugins\` in ${SETTINGS} here, or the same in the user-scope ${userSettings}`
     )
   ];
 };
+var ALLOW_BUILDS_KEY = "allowBuilds";
+var allowedBuilds = (root) => {
+  const path = join7(root, WORKSPACE_YAML);
+  if (!existsSync6(path)) return void 0;
+  const lines = readFileSync7(path, "utf8").split("\n");
+  const at = lines.findIndex((line) => new RegExp(`^${ALLOW_BUILDS_KEY}\\s*:`).test(line));
+  if (at < 0) return void 0;
+  const names = [];
+  for (const line of lines.slice(at + 1)) {
+    if (/^\s*(?:#.*)?$/.test(line)) continue;
+    const entry = /^\s+(?<name>'[^']+'|"[^"]+"|[^:\s]+)\s*:/.exec(line);
+    const name = entry?.groups?.["name"];
+    if (name === void 0) break;
+    names.push(name.replace(/^['"]|['"]$/g, ""));
+  }
+  return names;
+};
+var PLATFORM = /(?:^|[-/])(?:darwin|linux|win32|windows|freebsd|openbsd|android|sunos)(?:[-.]|$)|(?:^|[-/])(?:arm64|x64|ia32|ppc64|s390x|riscv64)(?:[-.]|$)/;
+var familyOf = (name) => name.split("/").slice(0, -1).join("/") || name;
+var platformSplitBuilds = (root) => {
+  const names = allowedBuilds(root);
+  if (names === void 0 || names.length === 0) return [];
+  const families = /* @__PURE__ */ new Map();
+  for (const name of names.filter((one) => PLATFORM.test(one))) {
+    const family = familyOf(name);
+    families.set(family, [...families.get(family) ?? [], name]);
+  }
+  return [...families.entries()].flatMap(
+    ([family, allowed]) => allowed.length > 1 ? [] : [
+      finding4(
+        allowed[0] ?? family,
+        "WARN",
+        `this ${ALLOW_BUILDS_KEY} entry names one platform of ${family}, which publishes one package per platform \u2014 pnpm writes the entry for the machine that ran the install, so an install on any other platform refuses by the name that is missing, on somebody else's machine. List every platform ${family} publishes, or none of them`
+      )
+    ]
+  );
+};
+var LINTS_STAGED = /\b(?:oxlint|eslint|biome)\b[^\n]*(?:\{staged_files\}|\{files\}|\$\{?[@*]|"\$@")/;
+var TAKES_A_VALUE = /* @__PURE__ */ new Set([
+  "--config",
+  "--format",
+  "--ignore-path",
+  "--max-warnings",
+  "--reporter",
+  "--rulesdir",
+  "--tsconfig",
+  "-c"
+]);
+var pathsLintedBy = (script, dir) => {
+  const words = script.split(/\s+/).filter((word) => word !== "");
+  const named2 = [];
+  for (const [at, word] of words.entries()) {
+    if (word.startsWith("-")) continue;
+    const before = words[at - 1] ?? "";
+    if (TAKES_A_VALUE.has(before)) continue;
+    if (existsSync6(join7(dir, word))) named2.push(word.replace(/^\.\//, "").replace(/\/$/, ""));
+  }
+  return named2;
+};
+var LINTABLE = /\.[cm]?[jt]sx?$/;
+var sourceDirsIn = (dir) => {
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter(
+    (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name) && filesUnder(join7(dir, entry.name), (name) => LINTABLE.test(name)).length > 0
+  ).map((entry) => entry.name);
+};
+var lintScopes = (root, workspaces) => {
+  if (!hookLines(root).some((one) => LINTS_STAGED.test(one.line))) {
+    return [
+      finding4(
+        "lint scope",
+        "SKIP",
+        "no committed hook lints staged files here, so there is no second file set for a lint script to be narrower than"
+      )
+    ];
+  }
+  return workspaces.flatMap((workspace) => {
+    const script = workspace.manifest.scripts?.lint;
+    if (typeof script !== "string" || script.trim() === "") return [];
+    const at = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
+    const covered = pathsLintedBy(script, workspace.dir);
+    if (covered.length === 0 || covered.includes(".")) {
+      return [finding4(at, "OK", `"${script}" covers everything the hook could stage here`)];
+    }
+    const uncovered = sourceDirsIn(workspace.dir).filter(
+      (name) => !covered.some((path) => name === path || path.startsWith(`${name}/`))
+    );
+    if (uncovered.length === 0) {
+      return [finding4(at, "OK", `"${script}" covers every source directory under this workspace`)];
+    }
+    return [
+      finding4(
+        at,
+        "WARN",
+        `the "lint" script covers ${covered.join(", ")} and the pre-commit hook lints whatever is staged, so ${uncovered.map((name) => `${name}/**`).join(", ")} is linted by the hook alone \u2014 the package gate has never read those files, and the drift stays invisible until one moves across it. Widen the script, or say in it which globs are deliberately outside`
+      )
+    ];
+  });
+};
+var OBSERVABILITY = "@geonosis/observability";
+var COMPOSITION_ROOT = "src/platform.ts";
+var FLOOR_PACKAGES = [
+  "@geonosis/conformance",
+  "@geonosis/db",
+  "@geonosis/events",
+  "@geonosis/search",
+  "@geonosis/workflows"
+];
+var COMPOSABLE = [
+  {
+    name: OBSERVABILITY,
+    uncomposed: `a sink nobody composes at the composition root sends production errors nowhere, and from outside the process that reads exactly like a project with nothing to report. Build one where the app is wired (the recipe is in ${OBSERVABILITY}'s README, \xA74) and hand it the port`
+  },
+  ...FLOOR_PACKAGES.map((name) => ({
+    name,
+    uncomposed: `a battery nothing composes is behaviour no request path can reach, and an install that does nothing reads from outside exactly like one that works. Compose it in the app\u2019s ${COMPOSITION_ROOT} \u2014 the composition root \`create-geonosis --domains\` writes \u2014 where the tenant session is opened before any store is built`
+  }))
+];
+var SOURCE_FILE = /\.[cm]?[jt]sx?$/;
+var composedHere = (root, workspaces) => {
+  const declared = declaredAnywhere(workspaces);
+  const wanted = COMPOSABLE.filter((one) => declared.has(one.name));
+  if (wanted.length === 0) return [];
+  const importing = /* @__PURE__ */ new Map();
+  for (const path of filesUnder(root, (name) => SOURCE_FILE.test(name))) {
+    let body;
+    try {
+      body = readFileSync7(path, "utf8");
+    } catch {
+      continue;
+    }
+    for (const one of wanted) {
+      if (!importing.has(one.name) && body.includes(one.name)) importing.set(one.name, path);
+    }
+    if (importing.size === wanted.length) break;
+  }
+  return wanted.map((one) => {
+    const at = importing.get(one.name);
+    return at === void 0 ? finding4(
+      one.name,
+      "WARN",
+      `it is declared here and no source file imports it \u2014 ${one.uncomposed}`
+    ) : finding4(
+      one.name,
+      "OK",
+      `composed in ${relativePath(root, at)} \u2014 something here builds what it reports through`
+    );
+  });
+};
 var READERS = {
   ledger: "@geonosis/ledger",
   review: "@geonosis/review",
@@ -797,6 +1254,18 @@ var READERS = {
   verify: "@geonosis/verify",
   walk: "@geonosis/walk"
 };
+var doorBringing = (root, name, declared) => DOORS.filter((door) => declared.has(door)).find(
+  (door) => Object.hasOwn(dependenciesOf(root, door), name)
+);
+var dependenciesOf = (root, name) => {
+  try {
+    return JSON.parse(
+      readFileSync7(join7(packageDirOf(resolveFrom(root, name), name), "package.json"), "utf8")
+    ).dependencies ?? {};
+  } catch {
+    return {};
+  }
+};
 var resolves = (root, name) => {
   try {
     resolveFrom(root, name);
@@ -818,7 +1287,7 @@ var declaredAnywhere = (workspaces) => new Set(
 var blocks = (root, config, readers, workspaces) => {
   if (config === void 0) {
     return [
-      finding3(
+      finding4(
         GEONOSIS,
         "SKIP",
         "there is no geonosis.json here, so no block says what this repo asks the kit to do"
@@ -828,11 +1297,21 @@ var blocks = (root, config, readers, workspaces) => {
   const declaredPackages = declaredAnywhere(workspaces);
   return Object.entries(readers).flatMap(([block, name]) => {
     const declared = config[block] !== void 0;
+    const door = doorBringing(root, name, declaredPackages);
     const chosen = declaredPackages.has(name);
     const installed = resolves(root, name);
+    if (declared && !chosen && door !== void 0) {
+      return [
+        finding4(
+          name,
+          "OK",
+          `a "${block}" block, and ${door} brings ${name} to read it \u2014 #177: the root declares the door, not what the door owns`
+        )
+      ];
+    }
     if (declared && !chosen) {
       return [
-        finding3(
+        finding4(
           name,
           "WARN",
           `geonosis.json has a "${block}" block and no manifest here declares ${name} \u2014 nothing reads it${installed ? ", and the copy still under node_modules is what a stale install left behind" : ""}`
@@ -841,7 +1320,7 @@ var blocks = (root, config, readers, workspaces) => {
     }
     if (declared && !installed) {
       return [
-        finding3(
+        finding4(
           name,
           "WARN",
           `geonosis.json has a "${block}" block, a manifest declares ${name}, and it does not resolve here \u2014 run the install`
@@ -850,7 +1329,7 @@ var blocks = (root, config, readers, workspaces) => {
     }
     if (!declared && chosen && installed) {
       return [
-        finding3(
+        finding4(
           name,
           "WARN",
           `${name} is installed and geonosis.json has no "${block}" block \u2014 it runs on its defaults, whatever they are`
@@ -859,14 +1338,14 @@ var blocks = (root, config, readers, workspaces) => {
     }
     if (!declared && installed) {
       return [
-        finding3(
+        finding4(
           name,
           "OK",
           `${name} is here but no manifest declares it \u2014 a transitive dependency this repo did not choose, so it wants no "${block}" block`
         )
       ];
     }
-    return declared ? [finding3(name, "OK", `a "${block}" block, and ${name} to read it`)] : [];
+    return declared ? [finding4(name, "OK", `a "${block}" block, and ${name} to read it`)] : [];
   });
 };
 var PLUGIN_DIR_RULE = "biological-architecture/no-unregistered-plugin-dir";
@@ -882,8 +1361,8 @@ var pluginDirsOf = (level) => {
   return { manifests: options.manifests ?? ["index.ts"], registry, roots: options.roots };
 };
 var pluginDirLayers = (root) => {
-  const path = join4(root, ".oxlintrc.json");
-  if (!existsSync3(path)) return [];
+  const path = join7(root, ".oxlintrc.json");
+  if (!existsSync6(path)) return [];
   const layers = [];
   for (const layer of layersOf(readConfig(path, root), PLUGIN_DIR_RULE)) {
     const dirs = pluginDirsOf(layer.level);
@@ -892,8 +1371,8 @@ var pluginDirLayers = (root) => {
   return layers;
 };
 var layerOver = (layers, root, relative) => {
-  const at = join4(root, relative);
-  const inside = readdirSync2(at, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => `${relative}/${entry.name}`);
+  const at = join7(root, relative);
+  const inside = readdirSync3(at, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => `${relative}/${entry.name}`);
   const paths = inside.length === 0 ? [relative] : inside;
   const wrapped = layers.map((layer) => ({ files: layer.files, level: layer.dirs }));
   for (const path of paths) {
@@ -906,7 +1385,7 @@ var pluginDirs = (root) => {
   const layers = pluginDirLayers(root);
   if (layers.length === 0) {
     return [
-      finding3(
+      finding4(
         "plugin directories",
         "SKIP",
         "no-unregistered-plugin-dir is not configured here, so this repo has not said where its integrations live"
@@ -914,34 +1393,34 @@ var pluginDirs = (root) => {
     ];
   }
   const missing = [...new Set(layers.flatMap((layer) => layer.dirs.registry))].filter(
-    (registry) => !existsSync3(join4(root, registry))
+    (registry) => !existsSync6(join7(root, registry))
   );
   if (missing.length > 0) {
     return missing.map(
-      (registry) => finding3(registry, "FAIL", "the registry the rule names is not there")
+      (registry) => finding4(registry, "FAIL", "the registry the rule names is not there")
     );
   }
   const source = /* @__PURE__ */ new Map();
   const unreachable = /* @__PURE__ */ new Map();
   for (const rootDir of new Set(layers.flatMap((layer) => layer.dirs.roots))) {
-    const at = join4(root, rootDir);
-    if (!existsSync3(at)) continue;
-    for (const entry of readdirSync2(at, { withFileTypes: true })) {
+    const at = join7(root, rootDir);
+    if (!existsSync6(at)) continue;
+    for (const entry of readdirSync3(at, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const relative = `${rootDir}/${entry.name}`;
       const governs = layerOver(layers, root, relative);
       if (governs === void 0) continue;
       const key = governs.registry.join(", ");
-      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync4(join4(root, half), "utf8")).join("\n");
+      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync7(join7(root, half), "utf8")).join("\n");
       source.set(key, registry);
-      const hasManifest = governs.manifests.some((name) => existsSync3(join4(at, entry.name, name)));
+      const hasManifest = governs.manifests.some((name) => existsSync6(join7(at, entry.name, name)));
       if (!hasManifest || registry.includes(entry.name)) continue;
       unreachable.set(key, [...unreachable.get(key) ?? [], relative]);
     }
   }
   return [...source.keys()].toSorted().map((registry) => {
     const named2 = unreachable.get(registry) ?? [];
-    return named2.length === 0 ? finding3(registry, "OK", "every directory under the declared roots is named by it") : finding3(
+    return named2.length === 0 ? finding4(registry, "OK", "every directory under the declared roots is named by it") : finding4(
       registry,
       "FAIL",
       `${named2.length} directory(ies) it never names: ${named2.join(", ")}`
@@ -952,9 +1431,9 @@ var WORKSPACE_YAML = "pnpm-workspace.yaml";
 var HOIST_KEY = "publicHoistPattern";
 var HOIST_REPAIR = "rm -rf node_modules/.modules.yaml node_modules/.pnpm-workspace-state-v1.json && pnpm install";
 var hoistPatterns = (root) => {
-  const path = join4(root, WORKSPACE_YAML);
-  if (!existsSync3(path)) return void 0;
-  const lines = readFileSync4(path, "utf8").split("\n");
+  const path = join7(root, WORKSPACE_YAML);
+  if (!existsSync6(path)) return void 0;
+  const lines = readFileSync7(path, "utf8").split("\n");
   const at = lines.findIndex((line) => new RegExp(`^${HOIST_KEY}\\s*:`).test(line));
   if (at < 0) return void 0;
   const patterns = [];
@@ -971,7 +1450,7 @@ var publicHoists = (root, workspaces) => {
   const patterns = hoistPatterns(root);
   if (patterns === void 0) {
     return [
-      finding3(
+      finding4(
         WORKSPACE_YAML,
         "SKIP",
         `no ${HOIST_KEY} is declared here, so nothing claims a package should be linked at the root`
@@ -985,92 +1464,31 @@ var publicHoists = (root, workspaces) => {
     const shape = matching(pattern);
     const hoisted = named2.filter((name) => shape.test(name));
     if (hoisted.length === 0) {
-      return finding3(
+      return finding4(
         pattern,
         "SKIP",
         `this ${HOIST_KEY} matches no workspace package here, so what it should have linked at the root is a question this cannot answer`
       );
     }
-    const pruned = hoisted.filter((name) => !existsSync3(join4(root, "node_modules", name)));
+    const pruned = hoisted.filter((name) => !existsSync6(join7(root, "node_modules", name)));
     if (pruned.length === 0) {
-      return finding3(
+      return finding4(
         pattern,
         "OK",
         `every workspace package this ${HOIST_KEY} matches is linked at the root`
       );
     }
-    return finding3(
+    return finding4(
       pattern,
       "FAIL",
       `the ${HOIST_KEY} \`${pattern}\` has no root link for ${pruned.map((name) => `node_modules/${name}`).join(", ")} \u2014 pnpm prunes one during an unrelated add and then answers "Already up to date" over a clean git status forever. Repair: ${HOIST_REPAIR}`
     );
   });
 };
-var HOOK_FILES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"];
-var HOOK_DIRS = [".husky", ".githooks"];
-var VERSION_MANAGED = /(?:^|[\s;&|(])(?<runner>pnpm|npx|bunx|yarn)\b(?:\s+(?:exec|run|dlx|x))?\s+(?<bin>geonosis(?:-[a-z-]+)?)\b/;
-var NAMES_A_BIN = /(?:^|[\s;&|(/])geonosis(?:-[a-z-]+)?\b/;
-var hookLines = (root) => {
-  const found = [];
-  const read = (path) => {
-    const at = relativePath(root, path);
-    for (const line of readFileSync4(path, "utf8").split("\n")) {
-      if (line.trim() !== "") found.push({ at, line });
-    }
-  };
-  for (const name of HOOK_FILES) {
-    const path = join4(root, name);
-    if (existsSync3(path)) read(path);
-  }
-  for (const name of HOOK_DIRS) {
-    const dir = join4(root, name);
-    if (!existsSync3(dir)) continue;
-    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      if (entry.isFile() && !entry.name.startsWith("_") && !entry.name.startsWith(".")) {
-        read(join4(dir, entry.name));
-      }
-    }
-  }
-  return found;
-};
-var gitHooks = (root) => {
-  const lines = hookLines(root);
-  if (lines.length === 0) {
-    return [finding3("git hooks", "SKIP", "no lefthook, husky or .githooks file here to read")];
-  }
-  const files = [...new Set(lines.map((one) => one.at))].toSorted();
-  return files.flatMap((at) => {
-    const here = lines.filter((one) => one.at === at);
-    const named2 = here.filter((one) => NAMES_A_BIN.test(one.line));
-    if (named2.length === 0) {
-      return [finding3(at, "SKIP", "it names no geonosis bin, so there is nothing here to start")];
-    }
-    const wrong = named2.flatMap((one) => {
-      const found = VERSION_MANAGED.exec(one.line)?.groups;
-      return found === void 0 ? [] : [{ bin: found["bin"] ?? "", runner: found["runner"] ?? "" }];
-    });
-    if (wrong.length === 0) {
-      return [
-        finding3(
-          at,
-          "OK",
-          `${named2.length} geonosis bin(s) here, every one called directly rather than through a runner`
-        )
-      ];
-    }
-    return wrong.map(
-      ({ bin, runner }) => finding3(
-        at,
-        "FAIL",
-        `it runs ${bin} through ${runner} \u2014 a git hook's PATH is not the shell's and carries no version-manager shim, so ${runner} fails to START and what the author reads is its message, not this gate's. Call it directly: node_modules/.bin/${bin}`
-      )
-    );
-  });
-};
 var checkDrift = ({
   readers = READERS,
   root,
-  userSettings = join4(homedir(), SETTINGS),
+  userSettings = join7(homedir(), SETTINGS),
   workspaces
 }) => {
   const config = readGeonosis(root);
@@ -1083,103 +1501,28 @@ var checkDrift = ({
     ...generatedFiles(root, workspaces),
     ...pluginDirs(root),
     ...publicHoists(root, workspaces),
-    ...gitHooks(root),
+    ...composedHere(root, workspaces),
+    ...lintScopes(root, workspaces),
+    ...platformSplitBuilds(root),
     ...law(root, config),
     ...hooks(root, userSettings),
     ...blocks(root, config, readers, workspaces)
   ];
 };
 
-// src/envelope.ts
-import { existsSync as existsSync4, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
-import { join as join5 } from "path";
-var ENVELOPES_DIR = ".geonosis/envelopes";
-var NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one";
-var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var finding4 = (verdict, subject, message) => ({
-  check: "envelope",
-  message,
-  subject,
-  verdict
-});
-var lengthOf = (value) => Array.isArray(value) ? value.length : void 0;
-var NEXT = "Next: re-run the tool that wrote it and read the numbers it prints \u2014 a run that has lost count of its own inputs is a bug in that tool, not in this tree";
-var judge = (subject, name, parsed) => {
-  if (!isRecord2(parsed)) return finding4("FAIL", subject, `is not an object. ${NEXT}`);
-  const tool = parsed["tool"];
-  if (typeof tool !== "string" || tool.trim() === "") {
-    return finding4(
-      "FAIL",
-      subject,
-      `names no tool, so nothing here says which run it is about. ${NEXT}`
-    );
-  }
-  if (tool !== name) {
-    return finding4(
-      "FAIL",
-      subject,
-      `is written by "${tool}", not "${name}" \u2014 a tool writing another tool's envelope leaves both of their numbers unattributable. ${NEXT}`
-    );
-  }
-  const version = parsed["version"];
-  if (typeof version !== "string" || version.trim() === "") {
-    return finding4(
-      "FAIL",
-      subject,
-      `${tool}: names no version, so nothing dates this run and a stale envelope reads exactly like a fresh one. ${NEXT}`
-    );
-  }
-  const considered = parsed["considered"];
-  const read = parsed["read"];
-  const refused = lengthOf(parsed["refused"]);
-  const excused = lengthOf(parsed["excused"]);
-  if (typeof considered !== "number" || typeof read !== "number" || refused === void 0 || excused === void 0) {
-    return finding4(
-      "FAIL",
-      subject,
-      `${tool}: has no considered/read/refused/excused to check \u2014 the four numbers ARE the envelope, and a file without them measures nothing. ${NEXT}`
-    );
-  }
-  const accounted = read + refused + excused;
-  return considered === accounted ? finding4(
-    "OK",
-    subject,
-    `${tool} considered ${considered} and accounts for all of them \u2014 ${read} read + ${refused} refused + ${excused} excused`
-  ) : finding4(
-    "FAIL",
-    subject,
-    `${tool}: considered ${considered} but accounts for ${accounted} \u2014 ${read} read + ${refused} refused + ${excused} excused. It reported on fewer things than it was handed, and every verdict it printed is over the smaller number. ${NEXT}`
-  );
-};
-var checkEnvelopes = ({ root }) => {
-  const dir = join5(root, ENVELOPES_DIR);
-  const files = existsSync4(dir) ? readdirSync3(dir).filter((name) => name.endsWith(".json")).toSorted() : [];
-  if (files.length === 0) return [finding4("SKIP", ENVELOPES_DIR, NO_ENVELOPES)];
-  return files.map((name) => {
-    const subject = `${ENVELOPES_DIR}/${name}`;
-    let parsed;
-    try {
-      parsed = JSON.parse(readFileSync5(join5(dir, name), "utf8"));
-    } catch (error) {
-      return finding4("FAIL", subject, `is not readable JSON: ${error.message}. ${NEXT}`);
-    }
-    return judge(subject, name.replace(/\.json$/, ""), parsed);
-  });
-};
-
 // src/exercised.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import {
   cpSync,
-  existsSync as existsSync5,
+  existsSync as existsSync7,
   mkdirSync,
   mkdtempSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync8,
   rmSync,
   writeFileSync
 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join6, resolve } from "path";
+import { dirname as dirname2, join as join8, resolve } from "path";
 import { corpusOf, readManifest } from "@geonosis/lint-parity";
 var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
 var severityOf = (level) => Array.isArray(level) ? level[0] : level;
@@ -1193,21 +1536,21 @@ var finding5 = (subject, verdict, message) => ({
 });
 var LIMIT = 800;
 var refusal = (error) => {
-  const said = String(error.message).trim();
-  return said.length > LIMIT ? `${said.slice(0, LIMIT)}\u2026` : said;
+  const said2 = String(error.message).trim();
+  return said2.length > LIMIT ? `${said2.slice(0, LIMIT)}\u2026` : said2;
 };
 var reasonFrom = (config, oxlint) => {
-  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-why-"));
+  const dir = mkdtempSync(join8(tmpdir(), "geonosis-doctor-why-"));
   try {
-    const probe = join6(dir, "probe.tsx");
+    const probe = join8(dir, "probe.tsx");
     writeFileSync(probe, "export const probe = 1\n");
     const run = spawnSync2(
       oxlint,
       ["--no-ignore", "--disable-nested-config", "--config", config, probe],
       { encoding: "utf8", env: { ...process.env, NO_COLOR: "1" }, maxBuffer: 8 * 1024 * 1024 }
     );
-    const said = `${run.stdout ?? ""}${run.stderr ?? ""}`;
-    return /Error:\s*([^]+?)(?=\s+at\s+\S+\s+\(|\n|$)/.exec(said)?.[1];
+    const said2 = `${run.stdout ?? ""}${run.stderr ?? ""}`;
+    return /[A-Z]\w*:\s*([^]+?)(?=\s+at\s+\S+\s+\(|\n|$)/.exec(said2)?.[1];
   } catch {
     return void 0;
   } finally {
@@ -1289,8 +1632,8 @@ var throughProbes = ({
 }) => {
   const refused = /* @__PURE__ */ new Map();
   const placed = /* @__PURE__ */ new Set();
-  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-probe-"));
-  const here = join6(dir, "corpus");
+  const dir = mkdtempSync(join8(tmpdir(), "geonosis-doctor-probe-"));
+  const here = join8(dir, "corpus");
   try {
     cpSync(corpus, here, { recursive: true });
     for (const rule of silent) {
@@ -1327,7 +1670,7 @@ var throughProbes = ({
             mounted = rehomed;
           }
           for (const file of mounted) {
-            const at2 = join6(here, file.path);
+            const at2 = join8(here, file.path);
             if (placed.has(at2)) continue;
             placed.add(at2);
             mkdirSync(dirname2(at2), { recursive: true });
@@ -1340,12 +1683,12 @@ var throughProbes = ({
         refused.set(rule, String(error.message));
       }
     }
-    const probeConfig = JSON.parse(readFileSync6(config.path, "utf8"));
+    const probeConfig = JSON.parse(readFileSync8(config.path, "utf8"));
     const configDir = dirname2(config.path);
     probeConfig.jsPlugins = (probeConfig.jsPlugins ?? []).map(
       (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve(configDir, spec) : packageDirOf(resolveFrom(configDir, spec), spec)
     );
-    const at = join6(here, ".oxlintrc-geonosis-probe.json");
+    const at = join8(here, ".oxlintrc-geonosis-probe.json");
     writeFileSync(at, JSON.stringify(probeConfig, null, 2));
     const run = spawnSync2(
       oxlint,
@@ -1366,6 +1709,7 @@ var throughProbes = ({
     rmSync(dir, { force: true, recursive: true });
   }
 };
+var BASE = "fired in the corpus and the probes, which says nothing about this tree \u2014 a rule can be exercised there and reach nothing a workspace here actually writes";
 var checkExercised = async ({
   config,
   corpus,
@@ -1374,15 +1718,15 @@ var checkExercised = async ({
   repoCorpus,
   root
 }) => {
-  const said = (verdict, message) => finding5(config.relative, verdict, message);
-  if (repoCorpus !== void 0 && !existsSync5(repoCorpus)) {
-    return said(
+  const said2 = (verdict, message) => finding5(config.relative, verdict, message);
+  if (repoCorpus !== void 0 && !existsSync7(repoCorpus)) {
+    return said2(
       "FAIL",
       `geonosis.json declares a reach corpus at ${relativeToRoot(root, repoCorpus)} and there is nothing there \u2014 a corpus that cannot be read is a claim, not evidence`
     );
   }
-  if (!existsSync5(corpus)) {
-    return said(
+  if (!existsSync7(corpus)) {
+    return said2(
       "SKIP",
       `the plugin loaded from here ships no corpus at ${relativeToRoot(root, corpus)} \u2014 nothing declares which rules it can be evidence about`
     );
@@ -1391,15 +1735,15 @@ var checkExercised = async ({
   try {
     manifest = readManifest(corpus);
   } catch (error) {
-    return said("SKIP", refusal(error));
+    return said2("SKIP", refusal(error));
   }
   const enabled = enabledHere(config, manifest.plugin);
-  if (enabled.length === 0) return said("SKIP", `no ${manifest.plugin} rule is enabled here`);
+  if (enabled.length === 0) return said2("SKIP", `no ${manifest.plugin} rule is enabled here`);
   let reach;
   try {
     reach = corpusOf({ configA: config.path, configB: config.path, corpus, oxlint }).reach;
   } catch (error) {
-    return said(
+    return said2(
       "FAIL",
       `oxlint refused to run this config over the corpus, so nothing here fired at all \u2014 ${reasonFrom(config.path, oxlint) ?? refusal(error)}`
     );
@@ -1407,7 +1751,7 @@ var checkExercised = async ({
   const fired = new Set(reach.filter((one) => one.firedInA).map((one) => one.rule));
   const unknown = enabled.filter((rule) => !manifest.rules.includes(rule));
   if (unknown.length > 0) {
-    return said(
+    return said2(
       "FAIL",
       `${countOf(unknown, "name")} the loaded plugin does not export: ${named(unknown)}`
     );
@@ -1417,12 +1761,12 @@ var checkExercised = async ({
     try {
       own = ownReach({ config, oxlint, repoCorpus });
     } catch (error) {
-      return said("FAIL", `this repo's own corpus could not be run \u2014 ${refusal(error)}`);
+      return said2("FAIL", `this repo's own corpus could not be run \u2014 ${refusal(error)}`);
     }
   }
   const empty = own.claimed.filter((rule) => !own.fired.has(rule));
   if (empty.length > 0) {
-    return said(
+    return said2(
       "FAIL",
       `${countOf(empty, "fire")} nowhere in this repo's own corpus, which names them: ${named(empty)}`
     );
@@ -1430,7 +1774,7 @@ var checkExercised = async ({
   const silent = enabled.filter((rule) => !fired.has(rule) && !own.fired.has(rule));
   const where = own.claimed.length === 0 ? "" : ` (${own.fired.size} by this repo's own corpus)`;
   if (silent.length === 0) {
-    return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where}`);
+    return said2("OK", `${enabled.length} enabled, ${enabled.length} exercised${where} \u2014 ${BASE}`);
   }
   const loadedProbes = entry === void 0 ? null : await probesOf(entry, manifest.plugin).catch(() => null);
   const probes = loadedProbes ?? {};
@@ -1441,37 +1785,121 @@ var checkExercised = async ({
     try {
       probed = throughProbes({ config, corpus, oxlint, probes, silent: declared });
     } catch (error) {
-      return said("FAIL", `the declared probes could not be run \u2014 ${refusal(error)}`);
+      return said2("FAIL", `the declared probes could not be run \u2014 ${refusal(error)}`);
     }
   }
   const exercised = declared.filter((rule) => probed.fired.has(rule));
   const inert = declared.filter((rule) => !probed.fired.has(rule));
   const placed = inert.filter((rule) => !probed.refused.has(rule));
   if (placed.length > 0) {
-    return said(
+    return said2(
       "FAIL",
       `${countOf(placed, "fire")} nowhere in the corpus and nothing through the probe each declares either: ${named(placed.map((rule) => under(config, rule)))}`
     );
   }
   const unplaceable = inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`);
-  const kitNote = unprobed.length === 0 || loadedProbes === null ? "" : `the loaded plugin ships no probe for ${unprobed.length === 1 ? "this enabled rule" : `${unprobed.length} enabled rules`} \u2014 the kit's omission, not this repo's (geonosis #131): ${unprobed.join(", ")}`;
+  const kitNote = unprobed.length === 0 || loadedProbes === null ? "" : `the loaded plugin ships no probe for ${unprobed.length === 1 ? "this enabled rule" : `${unprobed.length} enabled rules`}, so the question cannot be asked here at all \u2014 the kit's omission, not this repo's, and nothing in this tree is the fix (geonosis #131): ${unprobed.join(", ")}`;
   const unknowable = loadedProbes === null ? unprobed.map(
     (rule) => `${rule} declares no probe, so ${optionSetsOf(config, rule).every((options) => options.length === 0) ? "its scope" : under(config, rule)} does not reach the corpus`
   ) : [];
   if (unplaceable.length > 0 || unknowable.length > 0) {
-    return said(
+    return said2(
       "UNJUDGED",
       named([...unknowable, ...unplaceable]) + (kitNote === "" ? "" : ` \u2014 and ${kitNote}`)
     );
   }
-  if (kitNote !== "") return said("WARN", kitNote);
+  if (kitNote !== "") return said2("SKIP", kitNote);
   const through = exercised.length === 1 ? "1 through its declared probe under this repo\u2019s options" : `${exercised.length} through their declared probes under this repo\u2019s options`;
-  return said("OK", `${enabled.length} enabled, ${enabled.length} exercised${where} \u2014 ${through}`);
+  return said2(
+    "OK",
+    `${enabled.length} enabled, ${enabled.length} exercised${where} \u2014 ${through}. ${BASE}`
+  );
+};
+
+// src/envelope.ts
+import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "fs";
+import { join as join9 } from "path";
+var ENVELOPES_DIR = ".geonosis/envelopes";
+var THIS_TOOL = "doctor";
+var OWN = `${THIS_TOOL}.json`;
+var NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one (this run\u2019s own doctor.json is not one of them: it is written after these checks, and balanced at write time)";
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var finding6 = (verdict, subject, message) => ({
+  check: "envelope",
+  message,
+  subject,
+  verdict
+});
+var lengthOf = (value) => Array.isArray(value) ? value.length : void 0;
+var NEXT = "Next: re-run the tool that wrote it and read the numbers it prints \u2014 a run that has lost count of its own inputs is a bug in that tool, not in this tree";
+var judge = (subject, name, parsed) => {
+  if (!isRecord2(parsed)) return finding6("FAIL", subject, `is not an object. ${NEXT}`);
+  const tool = parsed["tool"];
+  if (typeof tool !== "string" || tool.trim() === "") {
+    return finding6(
+      "FAIL",
+      subject,
+      `names no tool, so nothing here says which run it is about. ${NEXT}`
+    );
+  }
+  if (tool !== name) {
+    return finding6(
+      "FAIL",
+      subject,
+      `is written by "${tool}", not "${name}" \u2014 a tool writing another tool's envelope leaves both of their numbers unattributable. ${NEXT}`
+    );
+  }
+  const version = parsed["version"];
+  if (typeof version !== "string" || version.trim() === "") {
+    return finding6(
+      "FAIL",
+      subject,
+      `${tool}: names no version, so nothing dates this run and a stale envelope reads exactly like a fresh one. ${NEXT}`
+    );
+  }
+  const considered = parsed["considered"];
+  const read = parsed["read"];
+  const refused = lengthOf(parsed["refused"]);
+  const excused = lengthOf(parsed["excused"]);
+  if (typeof considered !== "number" || typeof read !== "number" || refused === void 0 || excused === void 0) {
+    return finding6(
+      "FAIL",
+      subject,
+      `${tool}: has no considered/read/refused/excused to check \u2014 the four numbers ARE the envelope, and a file without them measures nothing. ${NEXT}`
+    );
+  }
+  const accounted = read + refused + excused;
+  return considered === accounted ? finding6(
+    "OK",
+    subject,
+    `${tool} considered ${considered} and accounts for all of them \u2014 ${read} read + ${refused} refused + ${excused} excused`
+  ) : finding6(
+    "FAIL",
+    subject,
+    `${tool}: considered ${considered} but accounts for ${accounted} \u2014 ${read} read + ${refused} refused + ${excused} excused. It reported on fewer things than it was handed, and every verdict it printed is over the smaller number. ${NEXT}`
+  );
+};
+var checkEnvelopes = ({ root }) => {
+  const dir = join9(root, ENVELOPES_DIR);
+  const files = existsSync8(dir) ? readdirSync4(dir).filter((name) => name.endsWith(".json") && name !== OWN).toSorted() : [];
+  if (files.length === 0) return [finding6("SKIP", ENVELOPES_DIR, NO_ENVELOPES)];
+  return files.map((name) => {
+    const subject = `${ENVELOPES_DIR}/${name}`;
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync9(join9(dir, name), "utf8"));
+    } catch (error) {
+      return finding6("FAIL", subject, `is not readable JSON: ${error.message}. ${NEXT}`);
+    }
+    return judge(subject, name.replace(/\.json$/, ""), parsed);
+  });
 };
 
 // src/loaded.ts
-import { sep as sep3 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join10, sep as sep3 } from "path";
 var SCOPE = "@geonosis/";
+var NOT_THE_SCOPE_DIRECTORY = "Deleting only the scope directory inside that node_modules is a repair no pnpm install undoes \u2014 the tree is then missing the package and every install stays green.";
 var BLOCKS = [
   "dependencies",
   "devDependencies",
@@ -1483,11 +1911,11 @@ var PINNED = /^[=v]?(\d+\.\d+\.\d+(?:[-+][\w.-]+)?)$/;
 var RANGE = /^(\^|~|>=)\s*v?(\d+)\.(\d+)\.(\d+)$/;
 var LINKED = /^(?:file|link|portal|workspace):/;
 var ANY = /* @__PURE__ */ new Set(["", "*", "latest", "x"]);
-var versionOf = (found, at) => Number(found[at] ?? Number.NaN);
+var versionOf2 = (found, at) => Number(found[at] ?? Number.NaN);
 var parts = (found) => [
-  versionOf(found, 1),
-  versionOf(found, 2),
-  versionOf(found, 3)
+  versionOf2(found, 1),
+  versionOf2(found, 2),
+  versionOf2(found, 3)
 ];
 var below = (here, bound) => {
   for (const [at, one] of here.entries()) {
@@ -1508,9 +1936,9 @@ var satisfies = (version, spec) => {
   if (here === null) return void 0;
   const at = parts(here);
   const bound = [
-    versionOf(range, 2),
-    versionOf(range, 3),
-    versionOf(range, 4)
+    versionOf2(range, 2),
+    versionOf2(range, 3),
+    versionOf2(range, 4)
   ];
   if (below(at, bound)) return false;
   if (range[1] === ">=") return true;
@@ -1540,7 +1968,7 @@ var declaredFor = ({
   }
   return void 0;
 };
-var finding6 = (subject, verdict, message) => ({
+var finding7 = (subject, verdict, message) => ({
   check: "loaded",
   message,
   subject,
@@ -1557,36 +1985,36 @@ var oneConfig = async ({
   specifier,
   workspaces
 }) => {
-  const said = (verdict, message) => finding6(config.relative, verdict, `${specifier}: ${message}`);
+  const said2 = (verdict, message) => finding7(config.relative, verdict, `${specifier}: ${message}`);
   let loaded;
   try {
     loaded = await versionAt(resolveFrom(config.dir, specifier), specifier, root);
   } catch (error) {
-    return said(
+    return said2(
       "FAIL",
       `could not resolve it from this config's directory, and oxlint resolves it from exactly there \u2014 ${firstLine(error)}`
     );
   }
   const declared = declaredFor({ dir: config.dir, specifier, workspaces });
   if (declared === void 0) {
-    return said(
+    return said2(
       "FAIL",
       `loaded ${loaded.version} from ${loaded.at}, and no package.json from here up to the root declares it \u2014 nothing says which version this was meant to be`
     );
   }
   const held = satisfies(loaded.version, declared.spec);
   if (held === void 0) {
-    return said(
+    return said2(
       "FAIL",
       `loaded ${loaded.version}, and ${declared.at} declares "${declared.spec}" \u2014 a range this check cannot read, so it will not call the version right`
     );
   }
-  return held ? said("OK", `loaded ${loaded.version} = declared ${declared.spec} (${declared.at})`) : said(
+  return held ? said2("OK", `loaded ${loaded.version} = declared ${declared.spec} (${declared.at})`) : said2(
     "FAIL",
-    `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}. Remove the nested copies (rm -rf <workspace>/node_modules/@geonosis) and reinstall; the linter is not running what the tree declares until then`
+    `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}. Run \`geonosis update --to ${declared.spec}\`: it removes the WHOLE node_modules of every non-root workspace carrying one, never the root's, and reinstalls. ${NOT_THE_SCOPE_DIRECTORY} The linter is not running what the tree declares until then`
   );
 };
-var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
+var labelOf2 = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
 var copiesOf = async ({
   root,
   specifier,
@@ -1603,31 +2031,81 @@ var copiesOf = async ({
     const at = relativeToRoot(root, packageDirOf(entry, specifier));
     const already = found.get(at);
     if (already !== void 0) {
-      already.from.push(labelOf(workspace));
+      already.from.push(labelOf2(workspace));
       continue;
     }
-    found.set(at, { from: [labelOf(workspace)], version: await pluginVersionOf(entry) });
+    found.set(at, { from: [labelOf2(workspace)], version: await pluginVersionOf(entry) });
   }
   if (found.size === 0) {
-    return finding6(specifier, "FAIL", "no workspace in this tree can resolve it at all");
+    return finding7(specifier, "FAIL", "no workspace in this tree can resolve it at all");
   }
   const listed = [...found.entries()].map(([at, one]) => `${at} ${one.version} (${one.from.join(", ")})`).join("; ");
-  return found.size === 1 ? finding6(specifier, "OK", `1 copy \u2014 ${listed}`) : finding6(
+  return found.size === 1 ? finding7(specifier, "OK", `1 copy \u2014 ${listed}`) : finding7(
     specifier,
     "WARN",
     `${found.size} copies \u2014 ${listed}. Which one oxlint runs depends on which directory its config sits in.`
   );
 };
+var shipperOf = (root, bin) => {
+  const name = bin === "geonosis" ? "@geonosis/cli" : `@geonosis/${bin.replace(/^geonosis-/, "")}`;
+  try {
+    const manifest = JSON.parse(
+      readFileSync10(join10(packageDirOf(resolveFrom(root, name), name), "package.json"), "utf8")
+    );
+    const declared = manifest.bin;
+    return typeof declared === "object" && !Object.hasOwn(declared, bin) ? "" : name;
+  } catch {
+    return name;
+  }
+};
+var knipNote = (root, bin) => {
+  const shipper = shipperOf(root, bin);
+  return shipper === "" ? "" : `. knip resolves no dependency out of that path, so add ignoreDependencies: ["${shipper}"] to its config in the same commit`;
+};
+var gitHooks = (root) => {
+  const lines = hookLines(root);
+  if (lines.length === 0) {
+    return [finding7("git hooks", "SKIP", "no lefthook, husky or .githooks file here to read")];
+  }
+  const files = [...new Set(lines.map((one) => one.at))].toSorted();
+  return files.flatMap((at) => {
+    const here = lines.filter((one) => one.at === at);
+    const named2 = here.filter((one) => NAMES_A_BIN.test(one.line));
+    if (named2.length === 0) {
+      return [finding7(at, "SKIP", "it names no geonosis bin, so there is nothing here to start")];
+    }
+    const wrong = named2.flatMap((one) => {
+      const found = VERSION_MANAGED.exec(one.line)?.groups;
+      return found === void 0 ? [] : [{ bin: found["bin"] ?? "", runner: found["runner"] ?? "" }];
+    });
+    if (wrong.length === 0) {
+      return [
+        finding7(
+          at,
+          "OK",
+          `${named2.length} geonosis bin(s) here, every one called directly rather than through a runner`
+        )
+      ];
+    }
+    return wrong.map(
+      ({ bin, runner }) => finding7(
+        at,
+        "FAIL",
+        `it runs ${bin} through ${runner} \u2014 a git hook's PATH is not the shell's and carries no version-manager shim, so ${runner} fails to START and what the author reads is its message, not this gate's. Call it directly: node_modules/.bin/${bin}${knipNote(root, bin)}`
+      )
+    );
+  });
+};
 var checkLoaded = async ({
   configs,
   root,
   workspaces
 }) => {
-  const findings = [];
+  const findings = [...gitHooks(root)];
   const specifiers = /* @__PURE__ */ new Set();
   for (const config of configs) {
     if (config.error !== void 0) {
-      findings.push(finding6(config.relative, "FAIL", config.error));
+      findings.push(finding7(config.relative, "FAIL", config.error));
       continue;
     }
     for (const specifier of config.jsPlugins.filter((name) => name.startsWith(SCOPE))) {
@@ -1642,13 +2120,13 @@ var checkLoaded = async ({
 };
 
 // src/observability.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join7 } from "path";
-var GEONOSIS_FILE = "geonosis.json";
+import { readFileSync as readFileSync11 } from "fs";
+import { join as join11 } from "path";
+var GEONOSIS_FILE2 = "geonosis.json";
 var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
 var DEFAULT_MAX_AGE_SECONDS = 3600;
 var HEAD_TIMEOUT_MS = 3e3;
-var finding7 = (verdict, subject, message) => ({
+var finding8 = (verdict, subject, message) => ({
   check: "observability",
   message,
   subject,
@@ -1657,7 +2135,7 @@ var finding7 = (verdict, subject, message) => ({
 var readGeonosis2 = (root) => {
   let text;
   try {
-    text = readFileSync7(join7(root, GEONOSIS_FILE), "utf8");
+    text = readFileSync11(join11(root, GEONOSIS_FILE2), "utf8");
   } catch {
     return { present: false };
   }
@@ -1675,27 +2153,27 @@ var readGeonosis2 = (root) => {
 var exporterFinding = (config) => {
   const sink = config.sink;
   if (typeof sink !== "string" || sink.trim() === "") {
-    return finding7(
+    return finding8(
       "FAIL",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       "observability.sink is not set, so nothing here says where errors are supposed to go \u2014 and a repo that cannot name its exporter has not got one"
     );
   }
   if (REACHES_NOTHING.has(sink.toLowerCase())) {
-    return finding7(
+    return finding8(
       "WARN",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       `the configured sink is "${sink}", which answers ok and reaches nothing. Correct in a dev tree; in a deployed one it is the instrument that cannot fail.`
     );
   }
-  return finding7("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
+  return finding8("OK", GEONOSIS_FILE2, `the configured sink is "${sink}"`);
 };
 var reachableFinding = async (config) => {
   const endpoint = config.endpoint;
   if (typeof endpoint !== "string" || endpoint.trim() === "") {
-    return finding7(
+    return finding8(
       "SKIP",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       "no observability.endpoint was named, so whether the exporter is reachable was not asked"
     );
   }
@@ -1703,15 +2181,15 @@ var reachableFinding = async (config) => {
   const timer = setTimeout(() => controller.abort(), HEAD_TIMEOUT_MS);
   try {
     const response = await fetch(endpoint, { method: "HEAD", signal: controller.signal });
-    return finding7(
+    return finding8(
       "OK",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       `${endpoint} is reachable \u2014 it answered ${response.status} to a HEAD`
     );
   } catch (error) {
-    return finding7(
+    return finding8(
       "FAIL",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       `${endpoint} is not reachable from here: ${error.message}. Every report this repo sends is going into that.`
     );
   } finally {
@@ -1721,36 +2199,36 @@ var reachableFinding = async (config) => {
 var ageFinding = (config, root, now) => {
   const file = config.lastEventFile;
   if (typeof file !== "string" || file.trim() === "") {
-    return finding7(
+    return finding8(
       "SKIP",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       "no observability.lastEventFile was configured, so when the last event arrived is not a question anything here can answer. Have the sink write { at, id, sink } on every capture and name the file."
     );
   }
   const maxAgeSeconds = typeof config.maxAgeSeconds === "number" && config.maxAgeSeconds > 0 ? config.maxAgeSeconds : DEFAULT_MAX_AGE_SECONDS;
   let record;
   try {
-    record = JSON.parse(readFileSync7(join7(root, file), "utf8"));
+    record = JSON.parse(readFileSync11(join11(root, file), "utf8"));
   } catch (error) {
-    return finding7(
+    return finding8(
       "FAIL",
       file,
       `the last event file could not be read: ${error.message}. A sink that has never written one has never captured anything.`
     );
   }
   if (typeof record.at !== "number" || !Number.isFinite(record.at)) {
-    return finding7(
+    return finding8(
       "FAIL",
       file,
       'the last event record has no numeric "at", so its age cannot be read \u2014 and an age nobody can read is not an age inside the window'
     );
   }
   const ageSeconds = Math.round((now - record.at) / 1e3);
-  return ageSeconds > maxAgeSeconds ? finding7(
+  return ageSeconds > maxAgeSeconds ? finding8(
     "FAIL",
     file,
     `the last event arrived ${ageSeconds}s ago, past the ${maxAgeSeconds}s window. An exporter that stopped, a key that was rotated and a sink that has been dropping since Tuesday all look exactly like this, and all of them leave a green build.`
-  ) : finding7(
+  ) : finding8(
     "OK",
     file,
     `the last event arrived ${ageSeconds}s ago, inside the ${maxAgeSeconds}s window`
@@ -1759,18 +2237,18 @@ var ageFinding = (config, root, now) => {
 var probeFinding = (config) => {
   const probe = config.probe;
   if (typeof probe === "string" && probe.trim() !== "") {
-    return finding7("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
+    return finding8("OK", GEONOSIS_FILE2, `the probe that proves this exporter is "${probe}"`);
   }
   if (typeof config.lastEventFile === "string" && config.lastEventFile.trim() !== "") {
-    return finding7(
+    return finding8(
       "OK",
-      GEONOSIS_FILE,
+      GEONOSIS_FILE2,
       "no probe command, but a last event file is read above, so something does look at this exporter"
     );
   }
-  return finding7(
+  return finding8(
     "WARN",
-    GEONOSIS_FILE,
+    GEONOSIS_FILE2,
     "neither observability.probe nor observability.lastEventFile is configured, so nothing in this repo has ever established that a report reaches the sink. Name a probe command \u2014 the doctor reports it, your gate runs it."
   );
 };
@@ -1781,19 +2259,19 @@ var checkObservability = async ({
   const read = readGeonosis2(root);
   if (read.error !== void 0) {
     return [
-      finding7(
+      finding8(
         "FAIL",
-        GEONOSIS_FILE,
-        `${GEONOSIS_FILE} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
+        GEONOSIS_FILE2,
+        `${GEONOSIS_FILE2} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
       )
     ];
   }
   if (!read.present || read.config === void 0) {
     return [
-      finding7(
+      finding8(
         "SKIP",
-        GEONOSIS_FILE,
-        `no observability block in ${GEONOSIS_FILE}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
+        GEONOSIS_FILE2,
+        `no observability block in ${GEONOSIS_FILE2}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
       )
     ];
   }
@@ -1806,28 +2284,14 @@ var checkObservability = async ({
   ];
 };
 
-// src/repo-corpus.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
-import { join as join8 } from "path";
-var GEONOSIS_FILE2 = "geonosis.json";
-var repoCorpusOf = (root) => {
-  const path = join8(root, GEONOSIS_FILE2);
-  if (!existsSync6(path)) return void 0;
-  try {
-    const parsed = JSON.parse(readFileSync8(path, "utf8"));
-    const declared = parsed.doctor?.corpus;
-    return typeof declared === "string" && declared !== "" ? join8(root, declared) : void 0;
-  } catch {
-    return void 0;
-  }
-};
-
 // src/runner.ts
+import { existsSync as existsSync9, readdirSync as readdirSync5, readFileSync as readFileSync12 } from "fs";
+import { join as join12 } from "path";
 var TEST_FAILURES = "testFailures";
 var RUNS_A_RUNNER = /(?:^|[\s;&|(])(?:npx\s+|bunx\s+|pnpm\s+(?:exec\s+)?)?(?:vitest|bun\s+test)(?:\s|$)/;
 var RUNS_BUN_TEST = /(?:^|[\s;&|(])(?:bunx\s+)?bun\s+test(?:\s|$)/;
 var WRITES_A_REPORT = /--reporter[= ]\S*json|--outputFile/i;
-var finding8 = (subject, verdict, message) => ({
+var finding9 = (subject, verdict, message) => ({
   check: "runner",
   message,
   subject,
@@ -1845,57 +2309,355 @@ var reportingCounters = (ratchet) => (ratchet?.counters ?? []).filter(
   (entry) => entry.counter === TEST_FAILURES && stringOf(entry.report) !== ""
 );
 var keyOf = (entry) => stringOf(entry.key) === "" ? TEST_FAILURES : stringOf(entry.key);
+var PROVES = /--prove\b/;
+var everythingRun2 = (root, workspaces) => {
+  const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
+  const dir = join12(root, ".github/workflows");
+  const workflows = (existsSync9(dir) ? readdirSync5(dir) : []).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((name) => {
+    try {
+      return readFileSync12(join12(dir, name), "utf8");
+    } catch {
+      return "";
+    }
+  });
+  let tiers = {};
+  try {
+    const config = JSON.parse(readFileSync12(join12(root, "geonosis.json"), "utf8"));
+    tiers = config.verify ?? {};
+  } catch {
+  }
+  return {
+    run: [...Object.values(tiers).flat(), ...scripts, ...workflows].join("\n"),
+    tiers: Object.keys(tiers)
+  };
+};
+var proveIsWired = ({
+  ratchet,
+  root,
+  workspaces
+}) => {
+  if (ratchet === void 0 || ratchet.counters.length === 0) return [];
+  const { run, tiers } = everythingRun2(root, workspaces);
+  if (PROVES.test(run)) {
+    return [
+      finding9(
+        RATCHET_FILE,
+        "OK",
+        `${ratchet.counters.length} counter(s), and something here runs geonosis-ratchet --prove`
+      )
+    ];
+  }
+  const where = tiers.at(-1) ?? "full";
+  return [
+    finding9(
+      RATCHET_FILE,
+      "WARN",
+      `${ratchet.counters.length} counter(s) and nothing here ever runs geonosis-ratchet --prove \u2014 not a verify tier, not a script, not a workflow. A counter that has never been seen reading its own planted finding has not been shown to measure anything, and it reads exactly like a clean tree. Add \`geonosis-ratchet --prove\` to the "${where}" tier in geonosis.json, or to the workflow that runs it`
+    )
+  ];
+};
 var checkRunner = ({
   ratchet,
+  root,
   workspaces
 }) => {
   const reading = reportingCounters(ratchet);
-  return workspaces.flatMap((workspace) => {
+  const perWorkspace2 = workspaces.flatMap((workspace) => {
     const script = stringOf(workspace.manifest.scripts?.test);
     if (script === "") return [];
     const subject = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
-    const said = (verdict, message) => [
-      finding8(subject, verdict, message)
+    const said2 = (verdict, message) => [
+      finding9(subject, verdict, message)
     ];
     if (!RUNS_A_RUNNER.test(script)) {
-      return said(
+      return said2(
         "OK",
         `"${script}" runs neither vitest nor bun test \u2014 this check has nothing to say about it`
       );
     }
     if (testFilesUnder(workspace.dir).length === 0) {
-      return said(
+      return said2(
         "SKIP",
         `"${script}" runs a test runner and there is no test file under this workspace \u2014 nothing here for its exit code to be wrong about`
       );
     }
     if (WRITES_A_REPORT.test(script)) {
-      return said("OK", "the script asks the runner for its own JSON report, not for a status code");
+      return said2("OK", "the script asks the runner for its own JSON report, not for a status code");
     }
     const counter = reading.find((entry) => covers(stringOf(entry.command), workspace, workspaces));
     if (counter !== void 0) {
-      return said("OK", `read by the ratchet's "${keyOf(counter)}" counter in report mode`);
+      return said2("OK", `read by the ratchet's "${keyOf(counter)}" counter in report mode`);
     }
     if (RUNS_BUN_TEST.test(script)) {
-      return said(
+      return said2(
         "OK",
         `"${script}" is judged by its exit code, and bun test's exit code is a verdict: a planted failure exits 1, measured on bun 1.4.0 (2026-08-30). Nothing further is required here.`
       );
     }
-    return said(
+    return said2(
       "WARN",
       `"${script}" runs vitest, whose exit code is the only verdict here; @cloudflare/vitest-pool-workers exited 0 on failing tests for weeks in a consumer. Give the ratchet a ${TEST_FAILURES} counter in report mode covering this workspace, or have the script write a JSON report.`
     );
   });
+  return [...proveIsWired({ ratchet, root, workspaces }), ...perWorkspace2];
 };
 
 // src/doctor.ts
+import { homedir as homedir2 } from "os";
+import { join as join14 } from "path";
 import { resolveOxlint } from "@geonosis/lint-parity";
+
+// src/engine.ts
+import { sep as sep4 } from "path";
+var declaredIn3 = (manifest) => new Set(
+  [
+    manifest.dependencies,
+    manifest.devDependencies,
+    manifest.optionalDependencies,
+    manifest.peerDependencies
+  ].flatMap((block) => Object.keys(block ?? {}))
+);
+var holds3 = (parent, child) => child === parent || child.startsWith(`${parent}${sep4}`);
+var labelOf3 = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
+var governedBy = (dir, workspaces) => workspaces.filter((one) => holds3(one.dir, dir) || holds3(dir, one.dir));
+var enabledHere2 = (config, plugin) => [
+  .../* @__PURE__ */ new Set([
+    ...enabledRulesOf(config.rules, plugin),
+    ...config.overrides.flatMap((one) => enabledRulesOf(one.rules, plugin))
+  ])
+];
+var checkEngines = async ({
+  config,
+  entry,
+  workspaces
+}) => {
+  const plugin = await presumptionsOf(entry).catch(() => void 0);
+  if (plugin === void 0 || plugin.namespace === "" || Object.keys(plugin.presumed).length === 0) {
+    return [];
+  }
+  const governed = governedBy(config.dir, workspaces);
+  const declared = new Set(governed.flatMap((one) => [...declaredIn3(one.manifest)]));
+  const asked = governed.map(labelOf3).join(", ");
+  return enabledHere2(config, plugin.namespace).flatMap((rule) => {
+    const presumes = plugin.presumed[rule.slice(plugin.namespace.length + 1)];
+    if (presumes === void 0 || presumes.packages.some((name) => declared.has(name))) return [];
+    return [
+      {
+        check: "exercised",
+        message: `it presumes ${presumes.engine}, and none of the manifests this config governs (${asked}) declares ${presumes.packages.join(" or ")} \u2014 enabled here it has no possible finding, which reads exactly like a clean tree. Drop it from this config, or say which package brings the engine`,
+        subject: `${config.relative} \u2192 ${rule}`,
+        verdict: "WARN"
+      }
+    ];
+  });
+};
+
+// src/rails.ts
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
+import { join as join13 } from "path";
+var GEONOSIS2 = "geonosis.json";
+var PROJECT = ".claude/settings.json";
+var LOCAL = ".claude/settings.local.json";
+var RUN_RECORD = ".geonosis/rails-run.json";
+var managedSettingsPath = (platform = process.platform) => platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json" : "/etc/claude-code/managed-settings.json";
+var finding10 = (subject, verdict, message) => ({
+  check: "rails",
+  message,
+  subject,
+  verdict
+});
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var networkIn = (parsed) => {
+  if (!isRecord3(parsed)) return void 0;
+  const sandbox = parsed["sandbox"];
+  if (!isRecord3(sandbox)) return void 0;
+  const network = sandbox["network"];
+  if (!isRecord3(network)) return void 0;
+  const allowed = network["allowedDomains"];
+  return {
+    allowedDomains: Array.isArray(allowed) ? allowed.filter((one) => typeof one === "string") : [],
+    ...network["allowManagedDomainsOnly"] === true ? { allowManagedDomainsOnly: true } : {}
+  };
+};
+var sourceAt = (path, label) => {
+  if (!existsSync10(path)) return { network: void 0, path: label, unreadable: false };
+  try {
+    return {
+      network: networkIn(JSON.parse(readFileSync13(path, "utf8"))),
+      path: label,
+      unreadable: false
+    };
+  } catch {
+    return { network: void 0, path: label, unreadable: true };
+  }
+};
+var declaredEgress = (root) => {
+  const at = join13(root, GEONOSIS2);
+  if (!existsSync10(at)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync13(at, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const egress = parsed?.rails?.egress;
+  if (!isRecord3(egress)) return void 0;
+  const allow = egress["allow"];
+  return {
+    allow: Array.isArray(allow) ? allow.filter((one) => typeof one === "string") : []
+  };
+};
+var deniedEgress = (root) => {
+  const at = join13(root, RUN_RECORD);
+  if (!existsSync10(at)) {
+    return [
+      finding10(
+        "deniedEgress",
+        "SKIP",
+        `there is no ${RUN_RECORD} here, so no run has been recorded for this to be a gate over`
+      )
+    ];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync13(at, "utf8"));
+  } catch (error) {
+    return [
+      finding10(
+        "deniedEgress",
+        "FAIL",
+        `${RUN_RECORD} is not readable JSON (${error.message}) \u2014 a record nobody can read is not a record of zero denied attempts`
+      )
+    ];
+  }
+  const denied = isRecord3(parsed) && Array.isArray(parsed["deniedEgress"]) ? parsed["deniedEgress"] : [];
+  if (denied.length === 0) {
+    return [finding10("deniedEgress", "OK", "no run recorded a denied egress attempt")];
+  }
+  const hosts = denied.map((one) => isRecord3(one) && typeof one["host"] === "string" ? one["host"] : "(unnamed)").join(", ");
+  return [
+    finding10(
+      "deniedEgress",
+      "FAIL",
+      `${denied.length} denied egress attempt(s) in this run's record \u2014 ${hosts}. This is a gate at ZERO and never a counter to hold flat: a run that reached for a host this repo does not allow is a run somebody reads, whatever the number was yesterday`
+    )
+  ];
+};
+var checkRails = ({
+  managedSettings = managedSettingsPath(),
+  root,
+  userSettings
+}) => {
+  const declared = declaredEgress(root);
+  if (declared === void 0 || declared.allow.length === 0) {
+    return [
+      finding10(
+        `${GEONOSIS2} \u2192 rails.egress`,
+        "SKIP",
+        "this repo declares no egress allowlist, so there is no rendered setting for this to read back"
+      )
+    ];
+  }
+  const sources = [
+    sourceAt(managedSettings, managedSettings),
+    sourceAt(userSettings, userSettings),
+    sourceAt(join13(root, PROJECT), PROJECT),
+    sourceAt(join13(root, LOCAL), LOCAL)
+  ];
+  const unreadable = sources.filter((one) => one.unreadable).map(
+    (one) => finding10(
+      one.path,
+      "FAIL",
+      "is not readable JSON, and Claude Code SILENTLY ignores a settings file that fails validation \u2014 every setting rendered into this file loads as nothing, with no error anywhere. Fix the file, then render the allowlist again"
+    )
+  );
+  const managedNetwork = sources[0]?.network;
+  const onlyManaged = managedNetwork?.allowManagedDomainsOnly === true;
+  const effective = new Set(
+    (onlyManaged ? [sources[0]] : sources).flatMap((one) => one?.network?.allowedDomains ?? [])
+  );
+  const why = onlyManaged ? ` Managed settings set sandbox.network.allowManagedDomainsOnly, so only ${managedSettings} allow rules load and every project, user and local domain is ignored \u2014 this one has to be added THERE` : ` Render it with \`geonosis-rails egress --write\`, into ${PROJECT} or the user scope`;
+  return [
+    ...unreadable,
+    ...declared.allow.map(
+      (domain) => effective.has(domain) ? finding10(domain, "OK", "declared, and in the settings that actually load") : finding10(
+        domain,
+        "FAIL",
+        `declared in ${GEONOSIS2} \u2192 rails.egress and absent from every settings file that loads, so the run has no allowance for it.${why}`
+      )
+    ),
+    ...deniedEgress(root)
+  ];
+};
+
+// src/required-options.ts
+import { pathToFileURL as pathToFileURL2 } from "url";
+var HEADER = /requires option `([^`]+)`/;
+var optionsOf2 = (level) => Array.isArray(level) ? level.slice(1) : [];
+var missingOption = (error) => {
+  const named2 = error.option;
+  return typeof named2 === "string" ? named2 : HEADER.exec(String(error.message))?.[1];
+};
+var refusesBare = (rule) => {
+  try {
+    rule.create({ options: [], report: () => {
+    } });
+    return false;
+  } catch (error) {
+    return missingOption(error) !== void 0;
+  }
+};
+var configured = (config, namespace) => [config.rules, ...config.overrides.map((one) => one.rules)].flatMap(
+  (rules) => enabledRulesOf(rules, namespace).map((id) => [id, optionsOf2(rules[id])])
+);
+var checkRequiredOptions = async ({
+  config,
+  entry
+}) => {
+  const loaded = await import(pathToFileURL2(entry).href).catch(() => void 0);
+  const namespace = loaded?.default?.meta?.name;
+  const rules = loaded?.default?.rules;
+  if (typeof namespace !== "string" || namespace === "" || rules === void 0) return [];
+  const enabled = configured(config, namespace);
+  if (enabled.length === 0) return [];
+  const missing = [];
+  let gated = 0;
+  for (const [id, options] of enabled) {
+    const rule = rules[id.slice(namespace.length + 1)];
+    if (rule === void 0) continue;
+    if (refusesBare(rule)) gated += 1;
+    try {
+      rule.create({ options, report: () => {
+      } });
+    } catch (error) {
+      const option = missingOption(error);
+      if (option === void 0) continue;
+      missing.push({
+        check: "loaded",
+        message: `it is enabled here with no \`${option}\`, and the rule refuses to be constructed without one \u2014 oxlint stops the whole run at load, linting nothing. Configure \`${option}\`, or turn the rule off`,
+        subject: `${config.relative} \u2192 ${id}`,
+        verdict: "FAIL"
+      });
+    }
+  }
+  if (missing.length > 0) return missing;
+  return [
+    {
+      check: "loaded",
+      message: `${gated} rules require options, ${gated} carry them`,
+      subject: config.relative,
+      verdict: "OK"
+    }
+  ];
+};
+
+// src/doctor.ts
 var exercisedOf = ({
   configs,
   oxlint,
   repoCorpus,
-  root
+  root,
+  workspaces
 }) => Promise.all(
   configs.flatMap(
     (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE)).map(async (specifier) => {
@@ -1905,25 +2667,49 @@ var exercisedOf = ({
         corpus = corpusOfPlugin(config.dir, specifier);
         entry = resolveFrom(config.dir, specifier);
       } catch (error) {
-        return {
-          check: "exercised",
-          message: `${specifier}: ${String(error.message)}`,
-          subject: config.relative,
-          verdict: "SKIP"
-        };
+        return [
+          {
+            check: "exercised",
+            message: `${specifier}: ${String(error.message)}`,
+            subject: config.relative,
+            verdict: "SKIP"
+          }
+        ];
       }
       const own = repoCorpus !== void 0 && config.relative === CONFIG_FILE ? repoCorpus : void 0;
-      return checkExercised({
-        config,
-        corpus,
-        entry,
-        oxlint,
-        ...own === void 0 ? {} : { repoCorpus: own },
-        root
-      });
+      const [reach, engines] = await Promise.all([
+        checkExercised({
+          config,
+          corpus,
+          entry,
+          oxlint,
+          ...own === void 0 ? {} : { repoCorpus: own },
+          root
+        }),
+        // #159: the rules whose engine this tree has not got. Beside the reach line rather than
+        // inside it — one is about the corpus, the other about this repo's own manifests.
+        checkEngines({ config, entry, workspaces })
+      ]);
+      return [reach, ...engines];
     })
   )
 );
+var requiredOptionsOf = async (configs) => {
+  const found = await Promise.all(
+    configs.flatMap(
+      (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE)).map(async (specifier) => {
+        let entry;
+        try {
+          entry = resolveFrom(config.dir, specifier);
+        } catch {
+          return [];
+        }
+        return checkRequiredOptions({ config, entry });
+      })
+    )
+  );
+  return found.flat();
+};
 var skip = (message) => [
   { check: "baseline", message, subject: RATCHET_FILE, verdict: "SKIP" }
 ];
@@ -1939,6 +2725,7 @@ var baselineOf = ({
   const ref = baseline.ref ?? defaultRef(root);
   return ref === void 0 ? skip("no ref was named and this repo has no origin/main to fall back on") : checkBaseline({ ref, root });
 };
+var USER_SETTINGS = ".claude/settings.json";
 var ordered = (findings) => CHECKS.flatMap((check) => findings.filter((one) => one.check === check));
 var EMPTY = { FAIL: 0, OK: 0, SKIP: 0, UNJUDGED: 0, WARN: 0 };
 var countsOf = (findings) => findings.reduce((counts, one) => ({ ...counts, [one.verdict]: counts[one.verdict] + 1 }), {
@@ -1960,7 +2747,24 @@ var runDoctor = async ({
   }
   const asked = (check) => only === void 0 || only.includes(check);
   const runs = [
-    ["loaded", () => checkLoaded({ configs, root, workspaces })],
+    [
+      "loaded",
+      async () => [
+        ...await checkLoaded({ configs, root, workspaces }),
+        ...await requiredOptionsOf(configs)
+      ]
+    ],
+    [
+      "group",
+      () => {
+        const declared = declaredGroupsOf(root);
+        return checkGroup({
+          ...declared === void 0 ? {} : { groups: declared },
+          root,
+          workspaces
+        });
+      }
+    ],
     [
       "exercised",
       () => {
@@ -1969,25 +2773,33 @@ var runDoctor = async ({
           configs,
           oxlint: oxlint ?? resolveOxlint(root),
           ...repoCorpus === void 0 ? {} : { repoCorpus },
-          root
-        });
+          root,
+          workspaces
+        }).then((found2) => found2.flat());
       }
     ],
     ["baseline", () => baselineOf({ baseline, root })],
-    ["runner", () => checkRunner({ ratchet: readRatchet(root), workspaces })],
+    ["runner", () => checkRunner({ ratchet: readRatchet(root), root, workspaces })],
     ["envelope", () => checkEnvelopes({ root })],
     ["observability", () => checkObservability({ now: Date.now(), root })],
     ["drift", () => checkDrift({ root, workspaces })],
-    ["deployed", () => checkDeployed({ root })]
+    ["deployed", () => checkDeployed({ root })],
+    ["rails", () => checkRails({ root, userSettings: join14(homedir2(), USER_SETTINGS) })]
   ];
   const collected = [];
-  for (const [check, run] of runs) if (asked(check)) collected.push(...await run());
+  const ran = [];
+  for (const [check, run] of runs) {
+    if (!asked(check)) continue;
+    ran.push(check);
+    collected.push(...await run());
+  }
   const found = ordered(collected);
   const findings = strict ? found.map((one) => one.verdict === "WARN" ? { ...one, verdict: "FAIL" } : one) : found;
   return {
     counts: countsOf(findings),
     findings,
     ok: passes(findings),
+    ran,
     root
   };
 };
@@ -1999,8 +2811,10 @@ var ABOUT = {
   drift: "the gates that were set up and are no longer running",
   envelope: "every gate read as many things as it was handed",
   exercised: "every enabled rule fires on at least one corpus file",
+  group: "the packages published on one version resolve to one version",
   loaded: "the plugin oxlint would load is the one the manifest pins",
   observability: "an exporter is configured, reachable, and something arrived through it lately",
+  rails: "the egress a run is bounded by is in the settings that actually load",
   runner: "something reads the test runner\u2019s own report, not its exit code"
 };
 var WIDTH = 8;
@@ -2042,6 +2856,8 @@ export {
   DEPLOYED_FILE,
   NOT_WRITTEN,
   checkDeployed,
+  GEONOSIS_FILE,
+  repoCorpusOf,
   CHECKS,
   DoctorError,
   resolveFrom,
@@ -2049,20 +2865,24 @@ export {
   pluginVersionOf,
   corpusOfPlugin,
   relativeToRoot,
+  FIXED_GROUP,
+  KIT_GROUP,
+  declaredGroupsOf,
+  checkGroup,
+  COMPOSITION_ROOT,
+  FLOOR_PACKAGES,
   READERS,
   checkDrift,
+  enabledRulesOf,
+  checkExercised,
   ENVELOPES_DIR,
   NO_ENVELOPES,
   checkEnvelopes,
-  enabledRulesOf,
-  checkExercised,
   SCOPE,
   satisfies,
   declaredFor,
   checkLoaded,
   checkObservability,
-  GEONOSIS_FILE2 as GEONOSIS_FILE,
-  repoCorpusOf,
   checkRunner,
   runDoctor,
   formatDoctor,