@geonosis/doctor 2.0.0 → 2.1.0

package/dist/{chunk-SMCRXSH5.js → chunk-R2R2OYH3.js}

@@ -319,6 +319,22 @@ var checkDeployed = ({ root }) => {
   ];
 };
 
+// src/repo-corpus.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+var GEONOSIS_FILE = "geonosis.json";
+var repoCorpusOf = (root) => {
+  const path = join3(root, GEONOSIS_FILE);
+  if (!existsSync2(path)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const declared = parsed.doctor?.corpus;
+    return typeof declared === "string" && declared !== "" ? join3(root, declared) : void 0;
+  } catch {
+    return void 0;
+  }
+};
+
 // src/types.ts
 var CHECKS = [
   "loaded",
@@ -340,9 +356,9 @@ var DoctorError = class extends Error {
 };
 
 // src/resolve.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync } from "fs";
 import { createRequire } from "module";
-import { dirname, join as join3 } from "path";
+import { dirname, join as join4 } from "path";
 import { pathToFileURL } from "url";
 var packageNameOf = (specifier) => {
   const parts2 = specifier.split("/");
@@ -350,13 +366,13 @@ var packageNameOf = (specifier) => {
 };
 var resolveFrom = (dir, specifier) => {
   if (specifier.startsWith(".") || specifier.startsWith("/")) {
-    return createRequire(join3(dir, "noop.js")).resolve(specifier);
+    return createRequire(join4(dir, "noop.js")).resolve(specifier);
   }
   const name = packageNameOf(specifier);
   let at = dir;
   for (; ; ) {
-    if (existsSync2(join3(at, "node_modules", name, "package.json"))) {
-      return createRequire(join3(at, "noop.js")).resolve(specifier);
+    if (existsSync3(join4(at, "node_modules", name, "package.json"))) {
+      return createRequire(join4(at, "noop.js")).resolve(specifier);
     }
     const parent = dirname(at);
     if (parent === at) break;
@@ -369,10 +385,10 @@ var resolveFrom = (dir, specifier) => {
 var packageDirOf = (entry, name) => {
   let dir = dirname(entry);
   for (; ; ) {
-    const manifest = join3(dir, "package.json");
-    if (existsSync2(manifest)) {
+    const manifest = join4(dir, "package.json");
+    if (existsSync3(manifest)) {
       try {
-        const parsed = JSON.parse(readFileSync3(manifest, "utf8"));
+        const parsed = JSON.parse(readFileSync4(manifest, "utf8"));
         if (parsed.name === name) return dir;
       } catch {
       }
@@ -421,7 +437,7 @@ var presumptionsOf = async (entry) => {
     )
   };
 };
-var corpusOfPlugin = (from, specifier) => join3(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
+var corpusOfPlugin = (from, specifier) => join4(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
 var real = (path) => {
   try {
     return realpathSync(path);
@@ -431,14 +447,13 @@ var real = (path) => {
 };
 var relativeToRoot = (root, path) => relativePath(real(root), real(path));
 
-// src/drift.ts
-import { closeSync, existsSync as existsSync4, openSync, readdirSync as readdirSync3, readFileSync as readFileSync5, readSync } from "fs";
-import { homedir } from "os";
-import { join as join5, sep as sep2 } from "path";
+// src/group.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { join as join6 } from "path";
 
 // src/hooks.ts
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
 var HOOK_FILES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"];
 var HOOK_DIRS = [".husky", ".githooks"];
 var VERSION_MANAGED = /(?:^|[\s;&|(])(?<runner>pnpm|npx|bunx|yarn)\b(?:\s+(?:exec|run|dlx|x))?\s+(?<bin>geonosis(?:-[a-z-]+)?)\b/;
@@ -447,26 +462,267 @@ var hookLines = (root) => {
   const found = [];
   const read = (path) => {
     const at = relativePath(root, path);
-    for (const line of readFileSync4(path, "utf8").split("\n")) {
+    for (const line of readFileSync5(path, "utf8").split("\n")) {
       if (line.trim() !== "") found.push({ at, line });
     }
   };
   for (const name of HOOK_FILES) {
-    const path = join4(root, name);
-    if (existsSync3(path)) read(path);
+    const path = join5(root, name);
+    if (existsSync4(path)) read(path);
   }
   for (const name of HOOK_DIRS) {
-    const dir = join4(root, name);
-    if (!existsSync3(dir)) continue;
+    const dir = join5(root, name);
+    if (!existsSync4(dir)) continue;
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
       if (entry.isFile() && !entry.name.startsWith("_") && !entry.name.startsWith(".")) {
-        read(join4(dir, entry.name));
+        read(join5(dir, entry.name));
       }
     }
   }
   return found;
 };
 
+// src/group.ts
+var FIXED_GROUP = [
+  "@geonosis/cli",
+  "@geonosis/doctor",
+  "@geonosis/evals",
+  "@geonosis/integrations",
+  "@geonosis/ledger",
+  "@geonosis/lint-parity",
+  "@geonosis/mcp",
+  "@geonosis/observability",
+  "@geonosis/oxlint-plugin-biological-architecture",
+  "@geonosis/policy",
+  "@geonosis/rails",
+  "@geonosis/ratchet",
+  "@geonosis/release",
+  "@geonosis/review",
+  "@geonosis/testbed",
+  "@geonosis/themekit",
+  "@geonosis/verify",
+  "@geonosis/verify-arch",
+  "@geonosis/visual-diff",
+  "@geonosis/walk",
+  "create-geonosis",
+  "geonosis"
+];
+var KIT_GROUP = { name: "@geonosis fixed group", packages: FIXED_GROUP };
+var declaredGroupsOf = (root) => {
+  const path = join6(root, GEONOSIS_FILE);
+  if (!existsSync5(path)) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+  const declared = parsed.doctor?.groups;
+  if (declared === void 0) return void 0;
+  if (!Array.isArray(declared) || declared.length === 0) {
+    throw new DoctorError(
+      `${GEONOSIS_FILE} declares doctor.groups and names no group in it \u2014 say which packages must move together, or remove the key and get the kit's own group`
+    );
+  }
+  return declared.map((one, at) => {
+    const group = one;
+    if (typeof group.name !== "string" || !Array.isArray(group.packages) || group.packages.length < 2) {
+      throw new DoctorError(
+        `${GEONOSIS_FILE} doctor.groups[${at}] needs a name and at least two packages \u2014 one package cannot disagree with itself`
+      );
+    }
+    return { name: group.name, packages: group.packages };
+  });
+};
+var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
+var versionOf = (dir, name) => {
+  let entry;
+  try {
+    entry = resolveFrom(dir, name);
+  } catch {
+    return { kind: "absent" };
+  }
+  try {
+    const manifest = JSON.parse(
+      readFileSync6(join6(packageDirOf(entry, name), "package.json"), "utf8")
+    );
+    return typeof manifest.version === "string" ? { kind: "read", version: manifest.version } : { kind: "unreadable", why: "its package.json declares no version" };
+  } catch (error) {
+    return { kind: "unreadable", why: String(error.message).split("\n")[0] ?? "" };
+  }
+};
+var finding3 = (subject, verdict, message) => ({
+  check: "group",
+  message,
+  subject,
+  verdict
+});
+var said = (versions) => [...versions.entries()].map(([version, from]) => `${version} (${from.join(", ")})`).join("; ");
+var repoWide = (name, found) => {
+  const versions = /* @__PURE__ */ new Map();
+  for (const one of found) versions.set(one.version, [...versions.get(one.version) ?? [], one.at]);
+  if (versions.size === 1) return void 0;
+  return finding3(
+    name,
+    "FAIL",
+    `${versions.size} versions in one tree \u2014 ${said(versions)}. They are published as one number, so a tree holding two is a tree where one workspace is running code another has already replaced; remove the nested copies and reinstall`
+  );
+};
+var perWorkspace = (group, at, found) => {
+  if (new Set(found.map((one) => one.version)).size === 1) return void 0;
+  const listed = found.map((one) => `${one.name} ${one.version}`).join(", ");
+  return finding3(
+    at,
+    "FAIL",
+    `${group.name} does not hold together here \u2014 ${listed}. Every member is cut on one version, so a workspace resolving two of them is a bump that landed halfway`
+  );
+};
+var DOORS = ["@geonosis/cli", "geonosis"];
+var manifestOf = (dir, name) => {
+  try {
+    return JSON.parse(
+      readFileSync6(join6(packageDirOf(resolveFrom(dir, name), name), "package.json"), "utf8")
+    );
+  } catch {
+    return void 0;
+  }
+};
+var binNamesOf = (manifest, name) => {
+  const declared = manifest?.bin;
+  return typeof declared === "string" ? [name.replace(/^@[^/]+\//, "")] : Object.keys(declared ?? {});
+};
+var declaredIn2 = (manifest) => [
+  ...new Set(
+    [
+      manifest.dependencies,
+      manifest.devDependencies,
+      manifest.optionalDependencies,
+      manifest.peerDependencies
+    ].flatMap((block) => Object.keys(block ?? {}))
+  )
+];
+var calls = (lines, bin) => new RegExp(`(?:^|[\\s;&|(/])${bin}(?:\\s|$)`).test(lines);
+var workspaceCaller = (workspaces, bins) => {
+  for (const workspace of workspaces) {
+    if (workspace.relative === "") continue;
+    for (const [script, line] of Object.entries(workspace.manifest.scripts ?? {})) {
+      if (bins.some((bin) => calls(line, bin))) return { at: workspace.relative, script };
+    }
+  }
+  return void 0;
+};
+var rootDeclarations = (root, workspaces) => {
+  const here = workspaces.find((one) => one.relative === "");
+  if (here === void 0) return [];
+  const declared = declaredIn2(here.manifest);
+  const door = DOORS.find((name) => declared.includes(name));
+  if (door === void 0) return [];
+  const owned = new Set(
+    [door, ...DOORS].flatMap((name) => {
+      const manifest = manifestOf(root, name);
+      return manifest === void 0 ? [] : Object.keys(manifest.dependencies ?? {});
+    })
+  );
+  const callers = [
+    ...Object.values(here.manifest.scripts ?? {}),
+    ...hookLines(root).map((one) => one.line)
+  ].join("\n");
+  const loadedHere = new Set(readConfig(join6(root, CONFIG_FILE), root).jsPlugins);
+  const spare = declared.filter(
+    (name) => !DOORS.includes(name) && owned.has(name) && !loadedHere.has(name) && !binNamesOf(manifestOf(root, name), name).some((bin) => calls(callers, bin))
+  );
+  if (spare.length === 0) {
+    return [
+      finding3(
+        "package.json",
+        "OK",
+        `every @geonosis package this root declares is ${door} or a bin its own scripts call by name`
+      )
+    ];
+  }
+  return spare.map((name) => {
+    const bins = binNamesOf(manifestOf(root, name), name);
+    const inWorkspace = workspaceCaller(workspaces, bins);
+    if (inWorkspace !== void 0) {
+      return finding3(
+        name,
+        "OK",
+        `no root script calls its bin, and ${inWorkspace.at}'s "${inWorkspace.script}" script does \u2014 under a hoisted linker the ROOT declaration is what makes that bin resolvable there, so this is the declaration doing its job`
+      );
+    }
+    return finding3(
+      name,
+      "WARN",
+      `the root declares it and no script in this repo calls its bin \u2014 ${door} already brings it, so this second declaration is a version that can disagree with the door's, and every tool that asks what is used here reads it as unused. Drop it from the root, or declare it in the workspace whose code imports it`
+    );
+  });
+};
+var checkGroup = ({
+  groups,
+  root,
+  workspaces
+}) => {
+  const findings = [...rootDeclarations(root, workspaces)];
+  for (const group of groups ?? [KIT_GROUP]) {
+    const found = [];
+    for (const workspace of workspaces) {
+      const at = labelOf(workspace);
+      const here = [];
+      for (const name of group.packages) {
+        const reading = versionOf(workspace.dir, name);
+        if (reading.kind === "read") here.push({ at, name, version: reading.version });
+        if (reading.kind === "unreadable") {
+          findings.push(
+            finding3(
+              `${at} \u2192 ${name}`,
+              "UNJUDGED",
+              `it resolves from here and ${reading.why} \u2014 this copy could be any version, so the group cannot be said to hold or not to hold`
+            )
+          );
+        }
+      }
+      const split2 = here.length > 0 ? perWorkspace(group, at, here) : void 0;
+      if (split2 !== void 0) findings.push(split2);
+      found.push(...here);
+    }
+    if (found.length === 0) {
+      findings.push(
+        finding3(
+          group.name,
+          "SKIP",
+          `no workspace under ${root} resolves any of ${group.packages.join(", ")}, so nothing here versions together`
+        )
+      );
+      continue;
+    }
+    const names = [...new Set(found.map((one) => one.name))].toSorted();
+    const split = names.flatMap((name) => {
+      const line = repoWide(
+        name,
+        found.filter((one) => one.name === name)
+      );
+      return line === void 0 ? [] : [line];
+    });
+    findings.push(...split);
+    if (split.length === 0) {
+      const versions = [...new Set(found.map((one) => one.version))];
+      findings.push(
+        finding3(
+          group.name,
+          "OK",
+          `${names.length} of ${group.packages.length} installed, at ${versions.join(", ")}, one copy each across ${new Set(found.map((one) => one.at)).size} workspaces`
+        )
+      );
+    }
+  }
+  return findings;
+};
+
+// src/drift.ts
+import { closeSync, existsSync as existsSync6, openSync, readdirSync as readdirSync3, readFileSync as readFileSync7, readSync } from "fs";
+import { homedir } from "os";
+import { join as join7, sep as sep2 } from "path";
+
 // src/overrides.ts
 var SPECIAL = /* @__PURE__ */ new Set(["$", "(", ")", "+", ".", "/", "@", "\\", "^", "|"]);
 var globToRegExp = (glob) => {
@@ -537,7 +793,7 @@ var GEONOSIS = "geonosis.json";
 var LAW = "CLAUDE.md";
 var CEILING = 200;
 var SWITCHED_OFF = /^\s*if:\s*(?:\$\{\{\s*)?false\b/m;
-var finding3 = (subject, verdict, message) => ({
+var finding4 = (subject, verdict, message) => ({
   check: "drift",
   message,
   subject,
@@ -555,27 +811,27 @@ var filesUnder = (dir, match) => {
     }
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join5(at, entry.name));
+        if (!entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name)) walk2(join7(at, entry.name));
         continue;
       }
-      if (entry.isFile() && match(entry.name)) found.push(join5(at, entry.name));
+      if (entry.isFile() && match(entry.name)) found.push(join7(at, entry.name));
     }
   };
   walk2(dir);
   return found;
 };
 var ci = (root) => {
-  const dir = join5(root, WORKFLOWS);
-  if (!existsSync4(dir)) {
-    return [finding3(WORKFLOWS, "SKIP", "there are no workflows here to read")];
+  const dir = join7(root, WORKFLOWS);
+  if (!existsSync6(dir)) {
+    return [finding4(WORKFLOWS, "SKIP", "there are no workflows here to read")];
   }
   return filesUnder(dir, (name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((path) => {
     const at = relativePath(root, path);
-    return SWITCHED_OFF.test(readFileSync5(path, "utf8")) ? finding3(
+    return SWITCHED_OFF.test(readFileSync7(path, "utf8")) ? finding4(
       at,
       "FAIL",
       "a job or step here is switched off by a condition that can never be true \u2014 every gate downstream of it reports green having run nothing"
-    ) : finding3(at, "OK", "nothing in it is switched off");
+    ) : finding4(at, "OK", "nothing in it is switched off");
   });
 };
 var holds = (parent, child) => child === parent || child.startsWith(`${parent}${sep2}`);
@@ -591,10 +847,10 @@ var orphanTests = (root, workspaces) => {
     orphaned.set(at, [...orphaned.get(at) ?? [], relativePath(root, path)]);
   }
   if (orphaned.size === 0) {
-    return [finding3("test files", "OK", "every test file sits under a workspace that runs tests")];
+    return [finding4("test files", "OK", "every test file sits under a workspace that runs tests")];
   }
   return [...orphaned.entries()].map(
-    ([at, files]) => finding3(
+    ([at, files]) => finding4(
       at,
       "FAIL",
       `${files.length} test file(s) here and no test script to run them \u2014 ${files.slice(0, 3).join(", ")}`
@@ -619,16 +875,16 @@ var pathsRunByScript = (script) => script.split(BETWEEN_COMMANDS).map(pathRunBy)
 var scriptPaths = (workspaces) => {
   const missing = workspaces.flatMap(
     (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
-      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync4(join5(one.dir, path))).map((path) => ({ name, path, workspace: one }))
+      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync6(join7(one.dir, path))).map((path) => ({ name, path, workspace: one }))
     )
   );
   if (missing.length === 0) {
     return [
-      finding3("script paths", "OK", "every file a script hands to bun, node or tsx is on disk")
+      finding4("script paths", "OK", "every file a script hands to bun, node or tsx is on disk")
     ];
   }
   return missing.map(
-    ({ name, path, workspace }) => finding3(
+    ({ name, path, workspace }) => finding4(
       workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`,
       "FAIL",
       `the "${name}" script runs ${path} and there is no such file \u2014 this script fails at that command, and every gate that calls it has been running nothing since the file went`
@@ -651,16 +907,16 @@ var workspaceBins = (workspaces) => {
 var linkedBins = (root, workspaces) => {
   const bins = workspaceBins(workspaces);
   if (bins.size === 0) {
-    return [finding3("workspace bins", "SKIP", "no workspace here declares a bin")];
+    return [finding4("workspace bins", "SKIP", "no workspace here declares a bin")];
   }
   const missing = workspaces.flatMap(
     (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
-      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter((name) => !existsSync4(join5(root, "node_modules/.bin", name))).map((name) => ({ name, script, workspace: one }))
+      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter((name) => !existsSync6(join7(root, "node_modules/.bin", name))).map((name) => ({ name, script, workspace: one }))
     )
   );
   if (missing.length === 0) {
     return [
-      finding3(
+      finding4(
         "workspace bins",
         "OK",
         "every workspace bin a script names is linked under the root"
@@ -668,7 +924,7 @@ var linkedBins = (root, workspaces) => {
     ];
   }
   return missing.map(
-    ({ name, script, workspace }) => finding3(
+    ({ name, script, workspace }) => finding4(
       name,
       "FAIL",
       `the "${script}" script in ${workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`} calls it, ${bins.get(name)?.manifest.name ?? "a workspace"} declares it, and node_modules/.bin/${name} is not there \u2014 add that package as a dependency of the one whose script calls it, so the package manager links the bin`
@@ -690,7 +946,7 @@ var preloadAroundPnpm = (root, workspaces) => {
   const some = scripts.slice(0, 3).join(", ");
   const rest = scripts.length > 3 ? ` and ${scripts.length - 3} more` : "";
   return [
-    finding3(
+    finding4(
       "NODE_OPTIONS",
       "WARN",
       `${scripts.length} script(s) preload something through NODE_OPTIONS (${some}${rest}), and the "${named2}" counter(s) shell out to pnpm \u2014 a nested pnpm INHERITS the option and dies on it (a preloaded resolver patch sends it looking for a .pnpmfile.mjs that is not there). Run the ratchet outside those scripts, or unset NODE_OPTIONS for the nested call: env -u NODE_OPTIONS pnpm \u2026`
@@ -726,11 +982,11 @@ var everythingRun = (root, workspaces) => {
   const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
   const counters = (readRatchet(root)?.counters ?? []).map((entry) => String(entry.command ?? ""));
   const workflows = filesUnder(
-    join5(root, WORKFLOWS),
+    join7(root, WORKFLOWS),
     (name) => name.endsWith(".yml") || name.endsWith(".yaml")
   ).map((path) => {
     try {
-      return readFileSync5(path, "utf8");
+      return readFileSync7(path, "utf8");
     } catch {
       return "";
     }
@@ -741,7 +997,7 @@ var generatedFiles = (root, workspaces) => {
   const marked = filesUnder(root, (name) => CAN_CARRY_A_MARKER.test(name)).map((path) => ({ marker: markerIn(path), path })).filter((one) => one.marker !== void 0);
   if (marked.length === 0) {
     return [
-      finding3(
+      finding4(
         "generated files",
         "SKIP",
         "nothing here says it was generated, so there is no write half here to look for a read half of"
@@ -752,13 +1008,13 @@ var generatedFiles = (root, workspaces) => {
   return marked.map(({ marker, path }) => {
     const at = relativePath(root, path);
     if (!("gate" in marker)) {
-      return finding3(
+      return finding4(
         at,
         "FAIL",
         `generated by \`${marker.writer}\` and it names no gate that reads it back. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Re-run \`${marker.writer}\` on a version that writes the \`geonosis:gated-by:\` marker, and run the gate it names`
       );
     }
-    return run.includes(marker.gate) ? finding3(at, "OK", `generated, and \`${marker.gate}\` reads it back`) : finding3(
+    return run.includes(marker.gate) ? finding4(at, "OK", `generated, and \`${marker.gate}\` reads it back`) : finding4(
       at,
       "FAIL",
       `generated, and nothing here runs \`${marker.gate}\` \u2014 the gate it names. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Add \`${marker.gate}\` to a script, a counter or a workflow`
@@ -766,10 +1022,10 @@ var generatedFiles = (root, workspaces) => {
   });
 };
 var readGeonosis = (root) => {
-  const path = join5(root, GEONOSIS);
-  if (!existsSync4(path)) return void 0;
+  const path = join7(root, GEONOSIS);
+  if (!existsSync6(path)) return void 0;
   try {
-    return JSON.parse(readFileSync5(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -777,15 +1033,15 @@ var readGeonosis = (root) => {
 var law = (root, config) => {
   const declared = config?.law ?? {};
   const file = typeof declared.file === "string" ? declared.file : LAW;
-  const path = join5(root, file);
-  if (!existsSync4(path)) {
-    return [finding3(file, "SKIP", "there is no law file here to measure")];
+  const path = join7(root, file);
+  if (!existsSync6(path)) {
+    return [finding4(file, "SKIP", "there is no law file here to measure")];
   }
-  const source = readFileSync5(path, "utf8");
+  const source = readFileSync7(path, "utf8");
   const lines = source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
   if (typeof declared.maxLines !== "number") {
     return [
-      finding3(
+      finding4(
         file,
         "SKIP",
         `${lines} lines, and no ceiling to measure them against \u2014 set law.maxLines in geonosis.json to have this asked (${CEILING} is what both source repos converged on)`
@@ -794,18 +1050,18 @@ var law = (root, config) => {
   }
   const ceiling = declared.maxLines;
   return [
-    lines > ceiling ? finding3(
+    lines > ceiling ? finding4(
       file,
       "WARN",
       `${lines} lines against a ceiling of ${ceiling} \u2014 depth belongs in the skills and in the rules, where it is read`
-    ) : finding3(file, "OK", `${lines} lines, under the ceiling of ${ceiling}`)
+    ) : finding4(file, "OK", `${lines} lines, under the ceiling of ${ceiling}`)
   ];
 };
 var KIT_PLUGIN = "geonosis";
 var enablesKit = (path) => {
-  if (!existsSync4(path)) return false;
+  if (!existsSync6(path)) return false;
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf8"));
     const enabled = parsed.enabledPlugins;
     if (typeof enabled !== "object" || enabled === null) return false;
     return Object.entries(enabled).some(
@@ -816,13 +1072,13 @@ var enablesKit = (path) => {
   }
 };
 var hooks = (root, userSettings) => {
-  const path = join5(root, SETTINGS);
+  const path = join7(root, SETTINGS);
   if (enablesKit(path)) {
-    return [finding3(SETTINGS, "OK", `\`enabledPlugins\` here enables the kit\u2019s plugin`)];
+    return [finding4(SETTINGS, "OK", `\`enabledPlugins\` here enables the kit\u2019s plugin`)];
   }
   if (enablesKit(userSettings)) {
     return [
-      finding3(
+      finding4(
         SETTINGS,
         "OK",
         `installed elsewhere \u2014 not this repo\u2019s to declare: \`enabledPlugins\` in ${userSettings} enables it for every repo on this machine`
@@ -830,7 +1086,7 @@ var hooks = (root, userSettings) => {
     ];
   }
   return [
-    finding3(
+    finding4(
       SETTINGS,
       "WARN",
       `nothing enables the kit\u2019s plugin, so none of the hooks, agents or skills reach this repo \u2014 the gates run, the method does not. What satisfies this: a "geonosis@<marketplace>" entry under \`enabledPlugins\` in ${SETTINGS} here, or the same in the user-scope ${userSettings}`
@@ -839,9 +1095,9 @@ var hooks = (root, userSettings) => {
 };
 var ALLOW_BUILDS_KEY = "allowBuilds";
 var allowedBuilds = (root) => {
-  const path = join5(root, WORKSPACE_YAML);
-  if (!existsSync4(path)) return void 0;
-  const lines = readFileSync5(path, "utf8").split("\n");
+  const path = join7(root, WORKSPACE_YAML);
+  if (!existsSync6(path)) return void 0;
+  const lines = readFileSync7(path, "utf8").split("\n");
   const at = lines.findIndex((line) => new RegExp(`^${ALLOW_BUILDS_KEY}\\s*:`).test(line));
   if (at < 0) return void 0;
   const names = [];
@@ -866,7 +1122,7 @@ var platformSplitBuilds = (root) => {
   }
   return [...families.entries()].flatMap(
     ([family, allowed]) => allowed.length > 1 ? [] : [
-      finding3(
+      finding4(
         allowed[0] ?? family,
         "WARN",
         `this ${ALLOW_BUILDS_KEY} entry names one platform of ${family}, which publishes one package per platform \u2014 pnpm writes the entry for the machine that ran the install, so an install on any other platform refuses by the name that is missing, on somebody else's machine. List every platform ${family} publishes, or none of them`
@@ -892,7 +1148,7 @@ var pathsLintedBy = (script, dir) => {
     if (word.startsWith("-")) continue;
     const before = words[at - 1] ?? "";
     if (TAKES_A_VALUE.has(before)) continue;
-    if (existsSync4(join5(dir, word))) named2.push(word.replace(/^\.\//, "").replace(/\/$/, ""));
+    if (existsSync6(join7(dir, word))) named2.push(word.replace(/^\.\//, "").replace(/\/$/, ""));
   }
   return named2;
 };
@@ -905,13 +1161,13 @@ var sourceDirsIn = (dir) => {
     return [];
   }
   return entries.filter(
-    (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name) && filesUnder(join5(dir, entry.name), (name) => LINTABLE.test(name)).length > 0
+    (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NEVER_WALKED2.has(entry.name) && filesUnder(join7(dir, entry.name), (name) => LINTABLE.test(name)).length > 0
   ).map((entry) => entry.name);
 };
 var lintScopes = (root, workspaces) => {
   if (!hookLines(root).some((one) => LINTS_STAGED.test(one.line))) {
     return [
-      finding3(
+      finding4(
         "lint scope",
         "SKIP",
         "no committed hook lints staged files here, so there is no second file set for a lint script to be narrower than"
@@ -924,16 +1180,16 @@ var lintScopes = (root, workspaces) => {
     const at = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
     const covered = pathsLintedBy(script, workspace.dir);
     if (covered.length === 0 || covered.includes(".")) {
-      return [finding3(at, "OK", `"${script}" covers everything the hook could stage here`)];
+      return [finding4(at, "OK", `"${script}" covers everything the hook could stage here`)];
     }
     const uncovered = sourceDirsIn(workspace.dir).filter(
       (name) => !covered.some((path) => name === path || path.startsWith(`${name}/`))
     );
     if (uncovered.length === 0) {
-      return [finding3(at, "OK", `"${script}" covers every source directory under this workspace`)];
+      return [finding4(at, "OK", `"${script}" covers every source directory under this workspace`)];
     }
     return [
-      finding3(
+      finding4(
         at,
         "WARN",
         `the "lint" script covers ${covered.join(", ")} and the pre-commit hook lints whatever is staged, so ${uncovered.map((name) => `${name}/**`).join(", ")} is linted by the hook alone \u2014 the package gate has never read those files, and the drift stays invisible until one moves across it. Widen the script, or say in it which globs are deliberately outside`
@@ -969,7 +1225,7 @@ var composedHere = (root, workspaces) => {
   for (const path of filesUnder(root, (name) => SOURCE_FILE.test(name))) {
     let body;
     try {
-      body = readFileSync5(path, "utf8");
+      body = readFileSync7(path, "utf8");
     } catch {
       continue;
     }
@@ -980,11 +1236,11 @@ var composedHere = (root, workspaces) => {
   }
   return wanted.map((one) => {
     const at = importing.get(one.name);
-    return at === void 0 ? finding3(
+    return at === void 0 ? finding4(
       one.name,
       "WARN",
       `it is declared here and no source file imports it \u2014 ${one.uncomposed}`
-    ) : finding3(
+    ) : finding4(
       one.name,
       "OK",
       `composed in ${relativePath(root, at)} \u2014 something here builds what it reports through`
@@ -998,6 +1254,18 @@ var READERS = {
   verify: "@geonosis/verify",
   walk: "@geonosis/walk"
 };
+var doorBringing = (root, name, declared) => DOORS.filter((door) => declared.has(door)).find(
+  (door) => Object.hasOwn(dependenciesOf(root, door), name)
+);
+var dependenciesOf = (root, name) => {
+  try {
+    return JSON.parse(
+      readFileSync7(join7(packageDirOf(resolveFrom(root, name), name), "package.json"), "utf8")
+    ).dependencies ?? {};
+  } catch {
+    return {};
+  }
+};
 var resolves = (root, name) => {
   try {
     resolveFrom(root, name);
@@ -1019,7 +1287,7 @@ var declaredAnywhere = (workspaces) => new Set(
 var blocks = (root, config, readers, workspaces) => {
   if (config === void 0) {
     return [
-      finding3(
+      finding4(
         GEONOSIS,
         "SKIP",
         "there is no geonosis.json here, so no block says what this repo asks the kit to do"
@@ -1029,11 +1297,21 @@ var blocks = (root, config, readers, workspaces) => {
   const declaredPackages = declaredAnywhere(workspaces);
   return Object.entries(readers).flatMap(([block, name]) => {
     const declared = config[block] !== void 0;
+    const door = doorBringing(root, name, declaredPackages);
     const chosen = declaredPackages.has(name);
     const installed = resolves(root, name);
+    if (declared && !chosen && door !== void 0) {
+      return [
+        finding4(
+          name,
+          "OK",
+          `a "${block}" block, and ${door} brings ${name} to read it \u2014 #177: the root declares the door, not what the door owns`
+        )
+      ];
+    }
     if (declared && !chosen) {
       return [
-        finding3(
+        finding4(
           name,
           "WARN",
           `geonosis.json has a "${block}" block and no manifest here declares ${name} \u2014 nothing reads it${installed ? ", and the copy still under node_modules is what a stale install left behind" : ""}`
@@ -1042,7 +1320,7 @@ var blocks = (root, config, readers, workspaces) => {
     }
     if (declared && !installed) {
       return [
-        finding3(
+        finding4(
           name,
           "WARN",
           `geonosis.json has a "${block}" block, a manifest declares ${name}, and it does not resolve here \u2014 run the install`
@@ -1051,7 +1329,7 @@ var blocks = (root, config, readers, workspaces) => {
     }
     if (!declared && chosen && installed) {
       return [
-        finding3(
+        finding4(
           name,
           "WARN",
           `${name} is installed and geonosis.json has no "${block}" block \u2014 it runs on its defaults, whatever they are`
@@ -1060,14 +1338,14 @@ var blocks = (root, config, readers, workspaces) => {
     }
     if (!declared && installed) {
       return [
-        finding3(
+        finding4(
           name,
           "OK",
           `${name} is here but no manifest declares it \u2014 a transitive dependency this repo did not choose, so it wants no "${block}" block`
         )
       ];
     }
-    return declared ? [finding3(name, "OK", `a "${block}" block, and ${name} to read it`)] : [];
+    return declared ? [finding4(name, "OK", `a "${block}" block, and ${name} to read it`)] : [];
   });
 };
 var PLUGIN_DIR_RULE = "biological-architecture/no-unregistered-plugin-dir";
@@ -1083,8 +1361,8 @@ var pluginDirsOf = (level) => {
   return { manifests: options.manifests ?? ["index.ts"], registry, roots: options.roots };
 };
 var pluginDirLayers = (root) => {
-  const path = join5(root, ".oxlintrc.json");
-  if (!existsSync4(path)) return [];
+  const path = join7(root, ".oxlintrc.json");
+  if (!existsSync6(path)) return [];
   const layers = [];
   for (const layer of layersOf(readConfig(path, root), PLUGIN_DIR_RULE)) {
     const dirs = pluginDirsOf(layer.level);
@@ -1093,7 +1371,7 @@ var pluginDirLayers = (root) => {
   return layers;
 };
 var layerOver = (layers, root, relative) => {
-  const at = join5(root, relative);
+  const at = join7(root, relative);
   const inside = readdirSync3(at, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => `${relative}/${entry.name}`);
   const paths = inside.length === 0 ? [relative] : inside;
   const wrapped = layers.map((layer) => ({ files: layer.files, level: layer.dirs }));
@@ -1107,7 +1385,7 @@ var pluginDirs = (root) => {
   const layers = pluginDirLayers(root);
   if (layers.length === 0) {
     return [
-      finding3(
+      finding4(
         "plugin directories",
         "SKIP",
         "no-unregistered-plugin-dir is not configured here, so this repo has not said where its integrations live"
@@ -1115,34 +1393,34 @@ var pluginDirs = (root) => {
     ];
   }
   const missing = [...new Set(layers.flatMap((layer) => layer.dirs.registry))].filter(
-    (registry) => !existsSync4(join5(root, registry))
+    (registry) => !existsSync6(join7(root, registry))
   );
   if (missing.length > 0) {
     return missing.map(
-      (registry) => finding3(registry, "FAIL", "the registry the rule names is not there")
+      (registry) => finding4(registry, "FAIL", "the registry the rule names is not there")
     );
   }
   const source = /* @__PURE__ */ new Map();
   const unreachable = /* @__PURE__ */ new Map();
   for (const rootDir of new Set(layers.flatMap((layer) => layer.dirs.roots))) {
-    const at = join5(root, rootDir);
-    if (!existsSync4(at)) continue;
+    const at = join7(root, rootDir);
+    if (!existsSync6(at)) continue;
     for (const entry of readdirSync3(at, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const relative = `${rootDir}/${entry.name}`;
       const governs = layerOver(layers, root, relative);
       if (governs === void 0) continue;
       const key = governs.registry.join(", ");
-      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync5(join5(root, half), "utf8")).join("\n");
+      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync7(join7(root, half), "utf8")).join("\n");
       source.set(key, registry);
-      const hasManifest = governs.manifests.some((name) => existsSync4(join5(at, entry.name, name)));
+      const hasManifest = governs.manifests.some((name) => existsSync6(join7(at, entry.name, name)));
       if (!hasManifest || registry.includes(entry.name)) continue;
       unreachable.set(key, [...unreachable.get(key) ?? [], relative]);
     }
   }
   return [...source.keys()].toSorted().map((registry) => {
     const named2 = unreachable.get(registry) ?? [];
-    return named2.length === 0 ? finding3(registry, "OK", "every directory under the declared roots is named by it") : finding3(
+    return named2.length === 0 ? finding4(registry, "OK", "every directory under the declared roots is named by it") : finding4(
       registry,
       "FAIL",
       `${named2.length} directory(ies) it never names: ${named2.join(", ")}`
@@ -1153,9 +1431,9 @@ var WORKSPACE_YAML = "pnpm-workspace.yaml";
 var HOIST_KEY = "publicHoistPattern";
 var HOIST_REPAIR = "rm -rf node_modules/.modules.yaml node_modules/.pnpm-workspace-state-v1.json && pnpm install";
 var hoistPatterns = (root) => {
-  const path = join5(root, WORKSPACE_YAML);
-  if (!existsSync4(path)) return void 0;
-  const lines = readFileSync5(path, "utf8").split("\n");
+  const path = join7(root, WORKSPACE_YAML);
+  if (!existsSync6(path)) return void 0;
+  const lines = readFileSync7(path, "utf8").split("\n");
   const at = lines.findIndex((line) => new RegExp(`^${HOIST_KEY}\\s*:`).test(line));
   if (at < 0) return void 0;
   const patterns = [];
@@ -1172,7 +1450,7 @@ var publicHoists = (root, workspaces) => {
   const patterns = hoistPatterns(root);
   if (patterns === void 0) {
     return [
-      finding3(
+      finding4(
         WORKSPACE_YAML,
         "SKIP",
         `no ${HOIST_KEY} is declared here, so nothing claims a package should be linked at the root`
@@ -1186,21 +1464,21 @@ var publicHoists = (root, workspaces) => {
     const shape = matching(pattern);
     const hoisted = named2.filter((name) => shape.test(name));
     if (hoisted.length === 0) {
-      return finding3(
+      return finding4(
         pattern,
         "SKIP",
         `this ${HOIST_KEY} matches no workspace package here, so what it should have linked at the root is a question this cannot answer`
       );
     }
-    const pruned = hoisted.filter((name) => !existsSync4(join5(root, "node_modules", name)));
+    const pruned = hoisted.filter((name) => !existsSync6(join7(root, "node_modules", name)));
     if (pruned.length === 0) {
-      return finding3(
+      return finding4(
         pattern,
         "OK",
         `every workspace package this ${HOIST_KEY} matches is linked at the root`
       );
     }
-    return finding3(
+    return finding4(
       pattern,
       "FAIL",
       `the ${HOIST_KEY} \`${pattern}\` has no root link for ${pruned.map((name) => `node_modules/${name}`).join(", ")} \u2014 pnpm prunes one during an unrelated add and then answers "Already up to date" over a clean git status forever. Repair: ${HOIST_REPAIR}`
@@ -1210,7 +1488,7 @@ var publicHoists = (root, workspaces) => {
 var checkDrift = ({
   readers = READERS,
   root,
-  userSettings = join5(homedir(), SETTINGS),
+  userSettings = join7(homedir(), SETTINGS),
   workspaces
 }) => {
   const config = readGeonosis(root);
@@ -1236,21 +1514,21 @@ var checkDrift = ({
 import { spawnSync as spawnSync2 } from "child_process";
 import {
   cpSync,
-  existsSync as existsSync5,
+  existsSync as existsSync7,
   mkdirSync,
   mkdtempSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync8,
   rmSync,
   writeFileSync
 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join6, resolve } from "path";
+import { dirname as dirname2, join as join8, resolve } from "path";
 import { corpusOf, readManifest } from "@geonosis/lint-parity";
 var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
 var severityOf = (level) => Array.isArray(level) ? level[0] : level;
 var enabledRulesOf = (rules, plugin) => Object.keys(rules).filter((id) => id.startsWith(`${plugin}/`) && !OFF.has(severityOf(rules[id]))).toSorted();
 var passes = (findings) => !findings.some((one) => one.verdict === "FAIL" || one.verdict === "UNJUDGED");
-var finding4 = (subject, verdict, message) => ({
+var finding5 = (subject, verdict, message) => ({
   check: "exercised",
   message,
   subject,
@@ -1262,9 +1540,9 @@ var refusal = (error) => {
   return said2.length > LIMIT ? `${said2.slice(0, LIMIT)}\u2026` : said2;
 };
 var reasonFrom = (config, oxlint) => {
-  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-why-"));
+  const dir = mkdtempSync(join8(tmpdir(), "geonosis-doctor-why-"));
   try {
-    const probe = join6(dir, "probe.tsx");
+    const probe = join8(dir, "probe.tsx");
     writeFileSync(probe, "export const probe = 1\n");
     const run = spawnSync2(
       oxlint,
@@ -1354,8 +1632,8 @@ var throughProbes = ({
 }) => {
   const refused = /* @__PURE__ */ new Map();
   const placed = /* @__PURE__ */ new Set();
-  const dir = mkdtempSync(join6(tmpdir(), "geonosis-doctor-probe-"));
-  const here = join6(dir, "corpus");
+  const dir = mkdtempSync(join8(tmpdir(), "geonosis-doctor-probe-"));
+  const here = join8(dir, "corpus");
   try {
     cpSync(corpus, here, { recursive: true });
     for (const rule of silent) {
@@ -1392,7 +1670,7 @@ var throughProbes = ({
             mounted = rehomed;
           }
           for (const file of mounted) {
-            const at2 = join6(here, file.path);
+            const at2 = join8(here, file.path);
             if (placed.has(at2)) continue;
             placed.add(at2);
             mkdirSync(dirname2(at2), { recursive: true });
@@ -1405,12 +1683,12 @@ var throughProbes = ({
         refused.set(rule, String(error.message));
       }
     }
-    const probeConfig = JSON.parse(readFileSync6(config.path, "utf8"));
+    const probeConfig = JSON.parse(readFileSync8(config.path, "utf8"));
     const configDir = dirname2(config.path);
     probeConfig.jsPlugins = (probeConfig.jsPlugins ?? []).map(
       (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve(configDir, spec) : packageDirOf(resolveFrom(configDir, spec), spec)
     );
-    const at = join6(here, ".oxlintrc-geonosis-probe.json");
+    const at = join8(here, ".oxlintrc-geonosis-probe.json");
     writeFileSync(at, JSON.stringify(probeConfig, null, 2));
     const run = spawnSync2(
       oxlint,
@@ -1440,14 +1718,14 @@ var checkExercised = async ({
   repoCorpus,
   root
 }) => {
-  const said2 = (verdict, message) => finding4(config.relative, verdict, message);
-  if (repoCorpus !== void 0 && !existsSync5(repoCorpus)) {
+  const said2 = (verdict, message) => finding5(config.relative, verdict, message);
+  if (repoCorpus !== void 0 && !existsSync7(repoCorpus)) {
     return said2(
       "FAIL",
       `geonosis.json declares a reach corpus at ${relativeToRoot(root, repoCorpus)} and there is nothing there \u2014 a corpus that cannot be read is a claim, not evidence`
     );
   }
-  if (!existsSync5(corpus)) {
+  if (!existsSync7(corpus)) {
     return said2(
       "SKIP",
       `the plugin loaded from here ships no corpus at ${relativeToRoot(root, corpus)} \u2014 nothing declares which rules it can be evidence about`
@@ -1520,7 +1798,7 @@ var checkExercised = async ({
     );
   }
   const unplaceable = inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`);
-  const kitNote = unprobed.length === 0 || loadedProbes === null ? "" : `the loaded plugin ships no probe for ${unprobed.length === 1 ? "this enabled rule" : `${unprobed.length} enabled rules`} \u2014 the kit's omission, not this repo's (geonosis #131): ${unprobed.join(", ")}`;
+  const kitNote = unprobed.length === 0 || loadedProbes === null ? "" : `the loaded plugin ships no probe for ${unprobed.length === 1 ? "this enabled rule" : `${unprobed.length} enabled rules`}, so the question cannot be asked here at all \u2014 the kit's omission, not this repo's, and nothing in this tree is the fix (geonosis #131): ${unprobed.join(", ")}`;
   const unknowable = loadedProbes === null ? unprobed.map(
     (rule) => `${rule} declares no probe, so ${optionSetsOf(config, rule).every((options) => options.length === 0) ? "its scope" : under(config, rule)} does not reach the corpus`
   ) : [];
@@ -1530,7 +1808,7 @@ var checkExercised = async ({
       named([...unknowable, ...unplaceable]) + (kitNote === "" ? "" : ` \u2014 and ${kitNote}`)
     );
   }
-  if (kitNote !== "") return said2("WARN", kitNote);
+  if (kitNote !== "") return said2("SKIP", kitNote);
   const through = exercised.length === 1 ? "1 through its declared probe under this repo\u2019s options" : `${exercised.length} through their declared probes under this repo\u2019s options`;
   return said2(
     "OK",
@@ -1539,12 +1817,14 @@ var checkExercised = async ({
 };
 
 // src/envelope.ts
-import { existsSync as existsSync6, readdirSync as readdirSync4, readFileSync as readFileSync7 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "fs";
+import { join as join9 } from "path";
 var ENVELOPES_DIR = ".geonosis/envelopes";
-var NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one";
+var THIS_TOOL = "doctor";
+var OWN = `${THIS_TOOL}.json`;
+var NO_ENVELOPES = "no .geonosis/envelopes/*.json \u2014 the tools write one per run, so an absent envelope is a run nobody has made here yet, and it is not a balanced one (this run\u2019s own doctor.json is not one of them: it is written after these checks, and balanced at write time)";
 var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var finding5 = (verdict, subject, message) => ({
+var finding6 = (verdict, subject, message) => ({
   check: "envelope",
   message,
   subject,
@@ -1553,17 +1833,17 @@ var finding5 = (verdict, subject, message) => ({
 var lengthOf = (value) => Array.isArray(value) ? value.length : void 0;
 var NEXT = "Next: re-run the tool that wrote it and read the numbers it prints \u2014 a run that has lost count of its own inputs is a bug in that tool, not in this tree";
 var judge = (subject, name, parsed) => {
-  if (!isRecord2(parsed)) return finding5("FAIL", subject, `is not an object. ${NEXT}`);
+  if (!isRecord2(parsed)) return finding6("FAIL", subject, `is not an object. ${NEXT}`);
   const tool = parsed["tool"];
   if (typeof tool !== "string" || tool.trim() === "") {
-    return finding5(
+    return finding6(
       "FAIL",
       subject,
       `names no tool, so nothing here says which run it is about. ${NEXT}`
     );
   }
   if (tool !== name) {
-    return finding5(
+    return finding6(
       "FAIL",
       subject,
       `is written by "${tool}", not "${name}" \u2014 a tool writing another tool's envelope leaves both of their numbers unattributable. ${NEXT}`
@@ -1571,7 +1851,7 @@ var judge = (subject, name, parsed) => {
   }
   const version = parsed["version"];
   if (typeof version !== "string" || version.trim() === "") {
-    return finding5(
+    return finding6(
       "FAIL",
       subject,
       `${tool}: names no version, so nothing dates this run and a stale envelope reads exactly like a fresh one. ${NEXT}`
@@ -1582,279 +1862,44 @@ var judge = (subject, name, parsed) => {
   const refused = lengthOf(parsed["refused"]);
   const excused = lengthOf(parsed["excused"]);
   if (typeof considered !== "number" || typeof read !== "number" || refused === void 0 || excused === void 0) {
-    return finding5(
+    return finding6(
       "FAIL",
       subject,
       `${tool}: has no considered/read/refused/excused to check \u2014 the four numbers ARE the envelope, and a file without them measures nothing. ${NEXT}`
     );
   }
   const accounted = read + refused + excused;
-  return considered === accounted ? finding5(
+  return considered === accounted ? finding6(
     "OK",
     subject,
     `${tool} considered ${considered} and accounts for all of them \u2014 ${read} read + ${refused} refused + ${excused} excused`
-  ) : finding5(
+  ) : finding6(
     "FAIL",
     subject,
     `${tool}: considered ${considered} but accounts for ${accounted} \u2014 ${read} read + ${refused} refused + ${excused} excused. It reported on fewer things than it was handed, and every verdict it printed is over the smaller number. ${NEXT}`
   );
 };
 var checkEnvelopes = ({ root }) => {
-  const dir = join7(root, ENVELOPES_DIR);
-  const files = existsSync6(dir) ? readdirSync4(dir).filter((name) => name.endsWith(".json")).toSorted() : [];
-  if (files.length === 0) return [finding5("SKIP", ENVELOPES_DIR, NO_ENVELOPES)];
+  const dir = join9(root, ENVELOPES_DIR);
+  const files = existsSync8(dir) ? readdirSync4(dir).filter((name) => name.endsWith(".json") && name !== OWN).toSorted() : [];
+  if (files.length === 0) return [finding6("SKIP", ENVELOPES_DIR, NO_ENVELOPES)];
   return files.map((name) => {
     const subject = `${ENVELOPES_DIR}/${name}`;
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync7(join7(dir, name), "utf8"));
+      parsed = JSON.parse(readFileSync9(join9(dir, name), "utf8"));
     } catch (error) {
-      return finding5("FAIL", subject, `is not readable JSON: ${error.message}. ${NEXT}`);
+      return finding6("FAIL", subject, `is not readable JSON: ${error.message}. ${NEXT}`);
     }
     return judge(subject, name.replace(/\.json$/, ""), parsed);
   });
 };
 
-// src/repo-corpus.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
-import { join as join8 } from "path";
-var GEONOSIS_FILE = "geonosis.json";
-var repoCorpusOf = (root) => {
-  const path = join8(root, GEONOSIS_FILE);
-  if (!existsSync7(path)) return void 0;
-  try {
-    const parsed = JSON.parse(readFileSync8(path, "utf8"));
-    const declared = parsed.doctor?.corpus;
-    return typeof declared === "string" && declared !== "" ? join8(root, declared) : void 0;
-  } catch {
-    return void 0;
-  }
-};
-
-// src/group.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
-import { join as join9 } from "path";
-var FIXED_GROUP = [
-  "@geonosis/cli",
-  "@geonosis/doctor",
-  "@geonosis/evals",
-  "@geonosis/integrations",
-  "@geonosis/ledger",
-  "@geonosis/lint-parity",
-  "@geonosis/mcp",
-  "@geonosis/observability",
-  "@geonosis/oxlint-plugin-biological-architecture",
-  "@geonosis/policy",
-  "@geonosis/rails",
-  "@geonosis/ratchet",
-  "@geonosis/release",
-  "@geonosis/review",
-  "@geonosis/testbed",
-  "@geonosis/themekit",
-  "@geonosis/verify",
-  "@geonosis/verify-arch",
-  "@geonosis/visual-diff",
-  "@geonosis/walk",
-  "create-geonosis",
-  "geonosis"
-];
-var KIT_GROUP = { name: "@geonosis fixed group", packages: FIXED_GROUP };
-var declaredGroupsOf = (root) => {
-  const path = join9(root, GEONOSIS_FILE);
-  if (!existsSync8(path)) return void 0;
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync9(path, "utf8"));
-  } catch {
-    return void 0;
-  }
-  const declared = parsed.doctor?.groups;
-  if (declared === void 0) return void 0;
-  if (!Array.isArray(declared) || declared.length === 0) {
-    throw new DoctorError(
-      `${GEONOSIS_FILE} declares doctor.groups and names no group in it \u2014 say which packages must move together, or remove the key and get the kit's own group`
-    );
-  }
-  return declared.map((one, at) => {
-    const group = one;
-    if (typeof group.name !== "string" || !Array.isArray(group.packages) || group.packages.length < 2) {
-      throw new DoctorError(
-        `${GEONOSIS_FILE} doctor.groups[${at}] needs a name and at least two packages \u2014 one package cannot disagree with itself`
-      );
-    }
-    return { name: group.name, packages: group.packages };
-  });
-};
-var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
-var versionOf = (dir, name) => {
-  let entry;
-  try {
-    entry = resolveFrom(dir, name);
-  } catch {
-    return { kind: "absent" };
-  }
-  try {
-    const manifest = JSON.parse(
-      readFileSync9(join9(packageDirOf(entry, name), "package.json"), "utf8")
-    );
-    return typeof manifest.version === "string" ? { kind: "read", version: manifest.version } : { kind: "unreadable", why: "its package.json declares no version" };
-  } catch (error) {
-    return { kind: "unreadable", why: String(error.message).split("\n")[0] ?? "" };
-  }
-};
-var finding6 = (subject, verdict, message) => ({
-  check: "group",
-  message,
-  subject,
-  verdict
-});
-var said = (versions) => [...versions.entries()].map(([version, from]) => `${version} (${from.join(", ")})`).join("; ");
-var repoWide = (name, found) => {
-  const versions = /* @__PURE__ */ new Map();
-  for (const one of found) versions.set(one.version, [...versions.get(one.version) ?? [], one.at]);
-  if (versions.size === 1) return void 0;
-  return finding6(
-    name,
-    "FAIL",
-    `${versions.size} versions in one tree \u2014 ${said(versions)}. They are published as one number, so a tree holding two is a tree where one workspace is running code another has already replaced; remove the nested copies and reinstall`
-  );
-};
-var perWorkspace = (group, at, found) => {
-  if (new Set(found.map((one) => one.version)).size === 1) return void 0;
-  const listed = found.map((one) => `${one.name} ${one.version}`).join(", ");
-  return finding6(
-    at,
-    "FAIL",
-    `${group.name} does not hold together here \u2014 ${listed}. Every member is cut on one version, so a workspace resolving two of them is a bump that landed halfway`
-  );
-};
-var DOORS = ["@geonosis/cli", "geonosis"];
-var manifestOf = (dir, name) => {
-  try {
-    return JSON.parse(
-      readFileSync9(join9(packageDirOf(resolveFrom(dir, name), name), "package.json"), "utf8")
-    );
-  } catch {
-    return void 0;
-  }
-};
-var binNamesOf = (manifest, name) => {
-  const declared = manifest?.bin;
-  return typeof declared === "string" ? [name.replace(/^@[^/]+\//, "")] : Object.keys(declared ?? {});
-};
-var declaredIn2 = (manifest) => [
-  ...new Set(
-    [
-      manifest.dependencies,
-      manifest.devDependencies,
-      manifest.optionalDependencies,
-      manifest.peerDependencies
-    ].flatMap((block) => Object.keys(block ?? {}))
-  )
-];
-var rootDeclarations = (root, workspaces) => {
-  const here = workspaces.find((one) => one.relative === "");
-  if (here === void 0) return [];
-  const declared = declaredIn2(here.manifest);
-  const door = DOORS.find((name) => declared.includes(name));
-  if (door === void 0) return [];
-  const owned = new Set(
-    [door, ...DOORS].flatMap((name) => {
-      const manifest = manifestOf(root, name);
-      return manifest === void 0 ? [] : Object.keys(manifest.dependencies ?? {});
-    })
-  );
-  const callers = [
-    ...Object.values(here.manifest.scripts ?? {}),
-    ...hookLines(root).map((one) => one.line)
-  ].join("\n");
-  const spare = declared.filter(
-    (name) => !DOORS.includes(name) && owned.has(name) && !binNamesOf(manifestOf(root, name), name).some(
-      (bin) => new RegExp(`(?:^|[\\s;&|(/])${bin}(?:\\s|$)`).test(callers)
-    )
-  );
-  if (spare.length === 0) {
-    return [
-      finding6(
-        "package.json",
-        "OK",
-        `every @geonosis package this root declares is ${door} or a bin its own scripts call by name`
-      )
-    ];
-  }
-  return spare.map(
-    (name) => finding6(
-      name,
-      "WARN",
-      `the root declares it and no root script calls its bin \u2014 ${door} already brings it, so this second declaration is a version that can disagree with the door's, and every tool that asks what is used here reads it as unused. Drop it from the root, or declare it in the workspace whose code imports it`
-    )
-  );
-};
-var checkGroup = ({
-  groups,
-  root,
-  workspaces
-}) => {
-  const findings = [...rootDeclarations(root, workspaces)];
-  for (const group of groups ?? [KIT_GROUP]) {
-    const found = [];
-    for (const workspace of workspaces) {
-      const at = labelOf(workspace);
-      const here = [];
-      for (const name of group.packages) {
-        const reading = versionOf(workspace.dir, name);
-        if (reading.kind === "read") here.push({ at, name, version: reading.version });
-        if (reading.kind === "unreadable") {
-          findings.push(
-            finding6(
-              `${at} \u2192 ${name}`,
-              "UNJUDGED",
-              `it resolves from here and ${reading.why} \u2014 this copy could be any version, so the group cannot be said to hold or not to hold`
-            )
-          );
-        }
-      }
-      const split2 = here.length > 0 ? perWorkspace(group, at, here) : void 0;
-      if (split2 !== void 0) findings.push(split2);
-      found.push(...here);
-    }
-    if (found.length === 0) {
-      findings.push(
-        finding6(
-          group.name,
-          "SKIP",
-          `no workspace under ${root} resolves any of ${group.packages.join(", ")}, so nothing here versions together`
-        )
-      );
-      continue;
-    }
-    const names = [...new Set(found.map((one) => one.name))].toSorted();
-    const split = names.flatMap((name) => {
-      const line = repoWide(
-        name,
-        found.filter((one) => one.name === name)
-      );
-      return line === void 0 ? [] : [line];
-    });
-    findings.push(...split);
-    if (split.length === 0) {
-      const versions = [...new Set(found.map((one) => one.version))];
-      findings.push(
-        finding6(
-          group.name,
-          "OK",
-          `${names.length} of ${group.packages.length} installed, at ${versions.join(", ")}, one copy each across ${new Set(found.map((one) => one.at)).size} workspaces`
-        )
-      );
-    }
-  }
-  return findings;
-};
-
 // src/loaded.ts
 import { readFileSync as readFileSync10 } from "fs";
 import { join as join10, sep as sep3 } from "path";
 var SCOPE = "@geonosis/";
+var NOT_THE_SCOPE_DIRECTORY = "Deleting only the scope directory inside that node_modules is a repair no pnpm install undoes \u2014 the tree is then missing the package and every install stays green.";
 var BLOCKS = [
   "dependencies",
   "devDependencies",
@@ -1966,7 +2011,7 @@ var oneConfig = async ({
   }
   return held ? said2("OK", `loaded ${loaded.version} = declared ${declared.spec} (${declared.at})`) : said2(
     "FAIL",
-    `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}. Remove the nested copies (rm -rf <workspace>/node_modules/@geonosis) and reinstall; the linter is not running what the tree declares until then`
+    `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}. Run \`geonosis update --to ${declared.spec}\`: it removes the WHOLE node_modules of every non-root workspace carrying one, never the root's, and reinstalls. ${NOT_THE_SCOPE_DIRECTORY} The linter is not running what the tree declares until then`
   );
 };
 var labelOf2 = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
@@ -2373,9 +2418,8 @@ var declaredIn3 = (manifest) => new Set(
   ].flatMap((block) => Object.keys(block ?? {}))
 );
 var holds3 = (parent, child) => child === parent || child.startsWith(`${parent}${sep4}`);
-var reachableFrom = (dir, workspaces) => new Set(
-  workspaces.filter((one) => holds3(one.dir, dir)).flatMap((one) => [...declaredIn3(one.manifest)])
-);
+var labelOf3 = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
+var governedBy = (dir, workspaces) => workspaces.filter((one) => holds3(one.dir, dir) || holds3(dir, one.dir));
 var enabledHere2 = (config, plugin) => [
   .../* @__PURE__ */ new Set([
     ...enabledRulesOf(config.rules, plugin),
@@ -2387,18 +2431,20 @@ var checkEngines = async ({
   entry,
   workspaces
 }) => {
-  const read = await presumptionsOf(entry).catch(() => void 0);
-  if (read === void 0 || read.namespace === "" || Object.keys(read.presumed).length === 0) {
+  const plugin = await presumptionsOf(entry).catch(() => void 0);
+  if (plugin === void 0 || plugin.namespace === "" || Object.keys(plugin.presumed).length === 0) {
     return [];
   }
-  const declared = reachableFrom(config.dir, workspaces);
-  return enabledHere2(config, read.namespace).flatMap((rule) => {
-    const presumes = read.presumed[rule.slice(read.namespace.length + 1)];
+  const governed = governedBy(config.dir, workspaces);
+  const declared = new Set(governed.flatMap((one) => [...declaredIn3(one.manifest)]));
+  const asked = governed.map(labelOf3).join(", ");
+  return enabledHere2(config, plugin.namespace).flatMap((rule) => {
+    const presumes = plugin.presumed[rule.slice(plugin.namespace.length + 1)];
     if (presumes === void 0 || presumes.packages.some((name) => declared.has(name))) return [];
     return [
       {
         check: "exercised",
-        message: `it presumes ${presumes.engine}, and no manifest from this config up to the root declares ${presumes.packages.join(" or ")} \u2014 enabled here it has no possible finding, which reads exactly like a clean tree. Drop it from this config, or say which package brings the engine`,
+        message: `it presumes ${presumes.engine}, and none of the manifests this config governs (${asked}) declares ${presumes.packages.join(" or ")} \u2014 enabled here it has no possible finding, which reads exactly like a clean tree. Drop it from this config, or say which package brings the engine`,
         subject: `${config.relative} \u2192 ${rule}`,
         verdict: "WARN"
       }
@@ -2552,6 +2598,15 @@ var missingOption = (error) => {
   const named2 = error.option;
   return typeof named2 === "string" ? named2 : HEADER.exec(String(error.message))?.[1];
 };
+var refusesBare = (rule) => {
+  try {
+    rule.create({ options: [], report: () => {
+    } });
+    return false;
+  } catch (error) {
+    return missingOption(error) !== void 0;
+  }
+};
 var configured = (config, namespace) => [config.rules, ...config.overrides.map((one) => one.rules)].flatMap(
   (rules) => enabledRulesOf(rules, namespace).map((id) => [id, optionsOf2(rules[id])])
 );
@@ -2563,26 +2618,37 @@ var checkRequiredOptions = async ({
   const namespace = loaded?.default?.meta?.name;
   const rules = loaded?.default?.rules;
   if (typeof namespace !== "string" || namespace === "" || rules === void 0) return [];
-  return configured(config, namespace).flatMap(([id, options]) => {
+  const enabled = configured(config, namespace);
+  if (enabled.length === 0) return [];
+  const missing = [];
+  let gated = 0;
+  for (const [id, options] of enabled) {
     const rule = rules[id.slice(namespace.length + 1)];
-    if (rule === void 0) return [];
+    if (rule === void 0) continue;
+    if (refusesBare(rule)) gated += 1;
     try {
       rule.create({ options, report: () => {
       } });
-      return [];
     } catch (error) {
       const option = missingOption(error);
-      if (option === void 0) return [];
-      return [
-        {
-          check: "loaded",
-          message: `it is enabled here with no \`${option}\`, and the rule refuses to be constructed without one \u2014 oxlint stops the whole run at load, linting nothing. Configure \`${option}\`, or turn the rule off`,
-          subject: `${config.relative} \u2192 ${id}`,
-          verdict: "FAIL"
-        }
-      ];
+      if (option === void 0) continue;
+      missing.push({
+        check: "loaded",
+        message: `it is enabled here with no \`${option}\`, and the rule refuses to be constructed without one \u2014 oxlint stops the whole run at load, linting nothing. Configure \`${option}\`, or turn the rule off`,
+        subject: `${config.relative} \u2192 ${id}`,
+        verdict: "FAIL"
+      });
     }
-  });
+  }
+  if (missing.length > 0) return missing;
+  return [
+    {
+      check: "loaded",
+      message: `${gated} rules require options, ${gated} carry them`,
+      subject: config.relative,
+      verdict: "OK"
+    }
+  ];
 };
 
 // src/doctor.ts
@@ -2611,7 +2677,7 @@ var exercisedOf = ({
         ];
       }
       const own = repoCorpus !== void 0 && config.relative === CONFIG_FILE ? repoCorpus : void 0;
-      const [reach, engines, options] = await Promise.all([
+      const [reach, engines] = await Promise.all([
         checkExercised({
           config,
           corpus,
@@ -2622,15 +2688,28 @@ var exercisedOf = ({
         }),
         // #159: the rules whose engine this tree has not got. Beside the reach line rather than
         // inside it — one is about the corpus, the other about this repo's own manifests.
-        checkEngines({ config, entry, workspaces }),
-        // #202: and the rules this config enables without an option they require, which the
-        // lint can only report as a run it could not make.
-        checkRequiredOptions({ config, entry })
+        checkEngines({ config, entry, workspaces })
       ]);
-      return [reach, ...engines, ...options];
+      return [reach, ...engines];
     })
   )
 );
+var requiredOptionsOf = async (configs) => {
+  const found = await Promise.all(
+    configs.flatMap(
+      (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE)).map(async (specifier) => {
+        let entry;
+        try {
+          entry = resolveFrom(config.dir, specifier);
+        } catch {
+          return [];
+        }
+        return checkRequiredOptions({ config, entry });
+      })
+    )
+  );
+  return found.flat();
+};
 var skip = (message) => [
   { check: "baseline", message, subject: RATCHET_FILE, verdict: "SKIP" }
 ];
@@ -2668,7 +2747,13 @@ var runDoctor = async ({
   }
   const asked = (check) => only === void 0 || only.includes(check);
   const runs = [
-    ["loaded", () => checkLoaded({ configs, root, workspaces })],
+    [
+      "loaded",
+      async () => [
+        ...await checkLoaded({ configs, root, workspaces }),
+        ...await requiredOptionsOf(configs)
+      ]
+    ],
     [
       "group",
       () => {
@@ -2702,13 +2787,19 @@ var runDoctor = async ({
     ["rails", () => checkRails({ root, userSettings: join14(homedir2(), USER_SETTINGS) })]
   ];
   const collected = [];
-  for (const [check, run] of runs) if (asked(check)) collected.push(...await run());
+  const ran = [];
+  for (const [check, run] of runs) {
+    if (!asked(check)) continue;
+    ran.push(check);
+    collected.push(...await run());
+  }
   const found = ordered(collected);
   const findings = strict ? found.map((one) => one.verdict === "WARN" ? { ...one, verdict: "FAIL" } : one) : found;
   return {
     counts: countsOf(findings),
     findings,
     ok: passes(findings),
+    ran,
     root
   };
 };
@@ -2765,6 +2856,8 @@ export {
   DEPLOYED_FILE,
   NOT_WRITTEN,
   checkDeployed,
+  GEONOSIS_FILE,
+  repoCorpusOf,
   CHECKS,
   DoctorError,
   resolveFrom,
@@ -2772,6 +2865,10 @@ export {
   pluginVersionOf,
   corpusOfPlugin,
   relativeToRoot,
+  FIXED_GROUP,
+  KIT_GROUP,
+  declaredGroupsOf,
+  checkGroup,
   COMPOSITION_ROOT,
   FLOOR_PACKAGES,
   READERS,
@@ -2781,12 +2878,6 @@ export {
   ENVELOPES_DIR,
   NO_ENVELOPES,
   checkEnvelopes,
-  GEONOSIS_FILE,
-  repoCorpusOf,
-  FIXED_GROUP,
-  KIT_GROUP,
-  declaredGroupsOf,
-  checkGroup,
   SCOPE,
   satisfies,
   declaredFor,