@geonosis/doctor 2.1.0 → 2.3.0

package/README.md

@@ -1,5 +1,8 @@
 # @geonosis/doctor
 
+Through the front door: `geonosis doctor` — the metapackage pins this and every other kit tool at
+ONE version, and passes the exit code through unchanged.
+
 Seven questions a version bump is not finished until something has asked. The first four are ways
 enforcement has reported **green while measuring nothing** — in real repos, for weeks at a time.
 `drift` asks whether the gate is still there at all. The last two ask the same question one layer
@@ -24,9 +27,9 @@ geonosis-doctor [--root <dir>] [--json] [--strict] [--baseline-against [<ref>]]
 
 ## One check, asked alone
 
-`geonosis-doctor --only loaded` runs that check and no other, in well under a second: a manifest read and a resolution per config. It exists because the doctor subsumed a consumer's own declared-vs-loaded script that lived in a 2.5 s local gate, and eleven seconds for seven checks cannot live there — so the question that catches a stale nested copy earliest had fallen out of the gate that runs most often (measured in a consumer, 2026-08-30: a per-workspace `bun add` left one workspace loading 1.0.0 against configs written for 1.1.0, and the script about to be deleted caught it). `--only loaded,runner` takes a list; a name the doctor does not have is refused with the seven it does. A `loaded` FAIL now says the remedy: remove the nested copies and reinstall.
+`geonosis-doctor --only loaded` runs that check and no other, in well under a second: a manifest read and a resolution per config. It exists because the doctor subsumed a consumer's own declared-vs-loaded script that lived in a 2.5 s local gate, and eleven seconds for every check cannot live there — so the question that catches a stale nested copy earliest had fallen out of the gate that runs most often (measured in a consumer, 2026-08-30: a per-workspace `bun add` left one workspace loading 1.0.0 against configs written for 1.1.0, and the script about to be deleted caught it). `--only loaded,runner` takes a list; a name the doctor does not have is refused with the ones it does. A `loaded` FAIL now says the remedy: remove the nested copies and reinstall.
 
-## The seven checks
+## The eleven checks
 
 ### `loaded` — declared ≠ loaded
 
@@ -326,6 +329,26 @@ environments inherit nothing per binding) and `release.secrets`.
 It reads the file, and imports nothing of `@geonosis/release` — the same wall `observability` keeps,
 held by the kit's own `layer-walls` config, so a repo can install either package alone.
 
+### `exams` — a floor adopted and never examined
+
+A floor bump that breaks search is invisible to a tier that never runs the search exam. A verify
+tier declares COMMANDS, not globs, so "the exam runs in the fast tier" is not a claim anything can
+check — but whether a test file importing the exam exists at all is.
+
+For every `@geonosis/*` package a manifest in the tree declares, this reads the declarations that
+package ships and takes every export ending in `Conformance` as its exam. The exams are read off
+the installed floor, never off a list held here: a table in this package would be a second source
+for a fact the floors already state, and wrong the day a floor adds one.
+
+| | |
+|---|---|
+| no declared package ships an exam | **SKIP** — nothing here to ask about |
+| a test file imports one of the floor's exams | **OK**, naming the file and the exams it runs |
+| the floor is declared and no test file imports any of its exams | **WARN**, naming the floor and every exam it ships |
+
+It WARNs rather than FAILs: the check cannot tell a floor adopted last week from one whose exam
+somebody deleted, and a FAIL on every fresh install is the shape that teaches a reader to skim.
+
 ## What `--format=unix` does not tell you
 
 Measured on oxlint 1.80: a JS plugin rule that throws from `create()` is reported **once per file**,

package/dist/{chunk-R2R2OYH3.js → chunk-GWVSC7GZ.js}

@@ -149,10 +149,14 @@ var checkBaseline = ({ ref, root }) => {
       )
     ];
   }
-  const grew = Object.entries(there).filter(([key, was]) => (here[key] ?? was) > was).map(
-    ([key, was]) => finding(path, "FAIL", `${key} ${was} \u2192 ${here[key] ?? was} (grew against ${ref})`)
-  );
-  return grew.length > 0 ? grew : [
+  const regressed = Object.entries(there).flatMap(([key, was]) => {
+    const now = here[key];
+    if (now === void 0) {
+      return [finding(path, "FAIL", `${key} ${was} \u2192 gone (removed from ${path} against ${ref})`)];
+    }
+    return now > was ? [finding(path, "FAIL", `${key} ${was} \u2192 ${now} (grew against ${ref})`)] : [];
+  });
+  return regressed.length > 0 ? regressed : [
     finding(
       path,
       "OK",
@@ -346,7 +350,8 @@ var CHECKS = [
   "drift",
   "observability",
   "deployed",
-  "rails"
+  "rails",
+  "exams"
 ];
 var DoctorError = class extends Error {
   constructor(message) {
@@ -423,10 +428,28 @@ var probesOf = async (entry, plugin) => {
     })
   );
 };
+var grantsOf = async (entry) => {
+  const loaded = await import(pathToFileURL(entry).href);
+  const plugin = loaded.default?.meta?.name ?? "";
+  return Object.fromEntries(
+    Object.entries(loaded.default?.rules ?? {}).flatMap(([name, rule]) => {
+      const grants = rule?.meta?.grants;
+      return typeof grants?.modules === "string" && typeof grants.paths === "string" ? [[`${plugin}/${name}`, { modules: grants.modules, paths: grants.paths }]] : [];
+    })
+  );
+};
 var presumptionsOf = async (entry) => {
   const loaded = await import(pathToFileURL(entry).href);
   const namespace = loaded.default?.meta?.name;
   return {
+    // #290: a rule that names a pattern whose floor is not shipped is a requirement with nothing to
+    // install behind it — the second consumer hand-writes the floor to satisfy the lint.
+    floors: Object.fromEntries(
+      Object.entries(loaded.default?.rules ?? {}).flatMap(([name, rule]) => {
+        const floor = rule?.meta?.floor;
+        return typeof floor?.name === "string" && floor.pending === true ? [[name, { name: floor.name }]] : [];
+      })
+    ),
     namespace: typeof namespace === "string" ? namespace : "",
     presumed: Object.fromEntries(
       Object.entries(loaded.default?.rules ?? {}).flatMap(([name, rule]) => {
@@ -1217,6 +1240,10 @@ var COMPOSABLE = [
   }))
 ];
 var SOURCE_FILE = /\.[cm]?[jt]sx?$/;
+var QUOTE = "['\"`]";
+var imports = (body, name) => new RegExp(
+  `(?:from|import|require)\\s*\\(?\\s*${QUOTE}${name.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)}(?:/[^'"\`]*)?${QUOTE}`
+).test(body);
 var composedHere = (root, workspaces) => {
   const declared = declaredAnywhere(workspaces);
   const wanted = COMPOSABLE.filter((one) => declared.has(one.name));
@@ -1230,7 +1257,7 @@ var composedHere = (root, workspaces) => {
       continue;
     }
     for (const one of wanted) {
-      if (!importing.has(one.name) && body.includes(one.name)) importing.set(one.name, path);
+      if (!importing.has(one.name) && imports(body, one.name)) importing.set(one.name, path);
     }
     if (importing.size === wanted.length) break;
   }
@@ -1332,7 +1359,7 @@ var blocks = (root, config, readers, workspaces) => {
         finding4(
           name,
           "WARN",
-          `${name} is installed and geonosis.json has no "${block}" block \u2014 it runs on its defaults, whatever they are`
+          `${name} is installed and geonosis.json has no "${block}" block \u2014 it runs on its own defaults; \`geonosis explain ${name}\` prints them beside the files this repo has`
         )
       ];
     }
@@ -1895,10 +1922,154 @@ var checkEnvelopes = ({ root }) => {
   });
 };
 
-// src/loaded.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { join as join10, sep as sep3 } from "path";
+// src/exams.ts
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
+import { dirname as dirname3, join as join10 } from "path";
 var SCOPE = "@geonosis/";
+var EXAM = /(?:^|[^$\w])([$\w]*Conformance)\b/g;
+var finding7 = (subject, verdict, message) => ({
+  check: "exams",
+  message,
+  subject,
+  verdict
+});
+var declaredBy = (workspaces) => {
+  const found = /* @__PURE__ */ new Map();
+  const provided = new Set(
+    workspaces.map((one) => one.manifest.name).filter((one) => typeof one === "string")
+  );
+  for (const workspace of workspaces) {
+    const manifest = workspace.manifest;
+    for (const block of ["dependencies", "devDependencies", "peerDependencies"]) {
+      const declared = manifest[block];
+      if (typeof declared !== "object" || declared === null) continue;
+      for (const name of Object.keys(declared)) {
+        if (name.startsWith(SCOPE) && !found.has(name) && !provided.has(name)) {
+          found.set(name, workspace.dir);
+        }
+      }
+    }
+  }
+  return [...found].map(([name, from]) => ({ from, name })).toSorted((a, b) => a.name.localeCompare(b.name));
+};
+var declarationsOf = (dir) => {
+  const at = join10(dir, "package.json");
+  if (!existsSync9(at)) return "";
+  const manifest = JSON.parse(readFileSync10(at, "utf8"));
+  const entries = [];
+  const walk2 = (value) => {
+    if (typeof value === "string" && value.endsWith(".d.ts")) entries.push(value);
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+      for (const one of Object.values(value)) walk2(one);
+    }
+  };
+  walk2({ exports: manifest["exports"], types: manifest["types"] });
+  return [...new Set(entries)].map((entry) => {
+    try {
+      return readFileSync10(join10(dir, entry), "utf8");
+    } catch {
+      return "";
+    }
+  }).join("\n");
+};
+var installedAt = (from, name) => {
+  let at = from;
+  for (; ; ) {
+    const dir = join10(at, "node_modules", name);
+    if (existsSync9(join10(dir, "package.json"))) return dir;
+    const up = dirname3(at);
+    if (up === at) return void 0;
+    at = up;
+  }
+};
+var examsShippedBy = (from, name) => {
+  const dir = installedAt(from, name);
+  if (dir === void 0) return [];
+  return [...new Set([...declarationsOf(dir).matchAll(EXAM)].map((one) => one[1]))];
+};
+var checkExams = ({
+  root,
+  workspaces
+}) => {
+  const tests = testFilesUnder(root).map((path) => ({ path, source: readFileSync10(path, "utf8") }));
+  const found = [];
+  for (const { from, name } of declaredBy(workspaces)) {
+    const exams = examsShippedBy(from, name);
+    if (exams.length === 0) continue;
+    const importing = tests.find(
+      (one) => one.source.includes(name) && exams.some((exam) => one.source.includes(exam))
+    );
+    found.push(
+      importing === void 0 ? finding7(
+        name,
+        "WARN",
+        `this tree declares ${name} and no test file imports its exam \u2014 ${exams.join(", ")}. A floor bump that broke it would read exactly like a green tier: the exam is the only thing that asks.`
+      ) : finding7(
+        name,
+        "OK",
+        `${relativePath(root, importing.path)} runs its exam (${exams.filter((exam) => importing.source.includes(exam)).join(", ")})`
+      )
+    );
+  }
+  return found.length > 0 ? found : [
+    finding7(
+      "package.json",
+      "SKIP",
+      `no floor with an exam is declared here \u2014 nothing to ask about, and nothing this can pass`
+    )
+  ];
+};
+
+// src/claude-plugin.ts
+import { existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join11 } from "path";
+var INSTALLED_PLUGINS = ".claude/plugins/installed_plugins.json";
+var PLUGIN_NAME = "geonosis";
+var installedPluginVersions = (home, name) => {
+  const at = join11(home, INSTALLED_PLUGINS);
+  if (!existsSync10(at)) return [];
+  let record;
+  try {
+    record = JSON.parse(readFileSync11(at, "utf8"));
+  } catch {
+    return [];
+  }
+  return Object.entries(record.plugins ?? {}).filter(([key]) => (key.split("@")[0] ?? key) === name).flatMap(([, value]) => Array.isArray(value) ? value : []).flatMap((one) => typeof one.version === "string" ? [one.version] : []);
+};
+var checkClaudePlugin = ({
+  home = homedir2(),
+  name = PLUGIN_NAME,
+  train
+}) => {
+  if (train === void 0) return [];
+  const installed = installedPluginVersions(home, name);
+  if (installed.length === 0) {
+    return [
+      {
+        check: "loaded",
+        message: `this machine has no "${name}" plugin installed, so none of this release's hooks, agents or skills is loaded in any session here \u2014 a bump moved the packages and nothing moved them. Install it, or say out loud that this repo runs without the plugin`,
+        subject: `${name} (Claude plugin)`,
+        verdict: "WARN"
+      }
+    ];
+  }
+  const drifted = installed.filter((one) => one !== train);
+  if (drifted.length === 0) return [];
+  return [
+    {
+      check: "loaded",
+      message: `the installed plugin is ${drifted.join(", ")} and the packages here are ${train} \u2014 the plugin carries the hooks, the agents and the skills, and it moves on \`claude plugin update\`, never on an install. Every session in this repo is running the older ones`,
+      subject: `${name} (Claude plugin)`,
+      verdict: "WARN"
+    }
+  ];
+};
+
+// src/loaded.ts
+import { readFileSync as readFileSync12 } from "fs";
+import { join as join12, sep as sep3 } from "path";
+var SCOPE2 = "@geonosis/";
 var NOT_THE_SCOPE_DIRECTORY = "Deleting only the scope directory inside that node_modules is a repair no pnpm install undoes \u2014 the tree is then missing the package and every install stays green.";
 var BLOCKS = [
   "dependencies",
@@ -1968,7 +2139,7 @@ var declaredFor = ({
   }
   return void 0;
 };
-var finding7 = (subject, verdict, message) => ({
+var finding8 = (subject, verdict, message) => ({
   check: "loaded",
   message,
   subject,
@@ -1985,7 +2156,7 @@ var oneConfig = async ({
   specifier,
   workspaces
 }) => {
-  const said2 = (verdict, message) => finding7(config.relative, verdict, `${specifier}: ${message}`);
+  const said2 = (verdict, message) => finding8(config.relative, verdict, `${specifier}: ${message}`);
   let loaded;
   try {
     loaded = await versionAt(resolveFrom(config.dir, specifier), specifier, root);
@@ -2037,10 +2208,10 @@ var copiesOf = async ({
     found.set(at, { from: [labelOf2(workspace)], version: await pluginVersionOf(entry) });
   }
   if (found.size === 0) {
-    return finding7(specifier, "FAIL", "no workspace in this tree can resolve it at all");
+    return finding8(specifier, "FAIL", "no workspace in this tree can resolve it at all");
   }
   const listed = [...found.entries()].map(([at, one]) => `${at} ${one.version} (${one.from.join(", ")})`).join("; ");
-  return found.size === 1 ? finding7(specifier, "OK", `1 copy \u2014 ${listed}`) : finding7(
+  return found.size === 1 ? finding8(specifier, "OK", `1 copy \u2014 ${listed}`) : finding8(
     specifier,
     "WARN",
     `${found.size} copies \u2014 ${listed}. Which one oxlint runs depends on which directory its config sits in.`
@@ -2050,7 +2221,7 @@ var shipperOf = (root, bin) => {
   const name = bin === "geonosis" ? "@geonosis/cli" : `@geonosis/${bin.replace(/^geonosis-/, "")}`;
   try {
     const manifest = JSON.parse(
-      readFileSync10(join10(packageDirOf(resolveFrom(root, name), name), "package.json"), "utf8")
+      readFileSync12(join12(packageDirOf(resolveFrom(root, name), name), "package.json"), "utf8")
     );
     const declared = manifest.bin;
     return typeof declared === "object" && !Object.hasOwn(declared, bin) ? "" : name;
@@ -2065,14 +2236,14 @@ var knipNote = (root, bin) => {
 var gitHooks = (root) => {
   const lines = hookLines(root);
   if (lines.length === 0) {
-    return [finding7("git hooks", "SKIP", "no lefthook, husky or .githooks file here to read")];
+    return [finding8("git hooks", "SKIP", "no lefthook, husky or .githooks file here to read")];
   }
   const files = [...new Set(lines.map((one) => one.at))].toSorted();
   return files.flatMap((at) => {
     const here = lines.filter((one) => one.at === at);
     const named2 = here.filter((one) => NAMES_A_BIN.test(one.line));
     if (named2.length === 0) {
-      return [finding7(at, "SKIP", "it names no geonosis bin, so there is nothing here to start")];
+      return [finding8(at, "SKIP", "it names no geonosis bin, so there is nothing here to start")];
     }
     const wrong = named2.flatMap((one) => {
       const found = VERSION_MANAGED.exec(one.line)?.groups;
@@ -2080,7 +2251,7 @@ var gitHooks = (root) => {
     });
     if (wrong.length === 0) {
       return [
-        finding7(
+        finding8(
           at,
           "OK",
           `${named2.length} geonosis bin(s) here, every one called directly rather than through a runner`
@@ -2088,7 +2259,7 @@ var gitHooks = (root) => {
       ];
     }
     return wrong.map(
-      ({ bin, runner }) => finding7(
+      ({ bin, runner }) => finding8(
         at,
         "FAIL",
         `it runs ${bin} through ${runner} \u2014 a git hook's PATH is not the shell's and carries no version-manager shim, so ${runner} fails to START and what the author reads is its message, not this gate's. Call it directly: node_modules/.bin/${bin}${knipNote(root, bin)}`
@@ -2098,6 +2269,7 @@ var gitHooks = (root) => {
 };
 var checkLoaded = async ({
   configs,
+  home,
   root,
   workspaces
 }) => {
@@ -2105,10 +2277,10 @@ var checkLoaded = async ({
   const specifiers = /* @__PURE__ */ new Set();
   for (const config of configs) {
     if (config.error !== void 0) {
-      findings.push(finding7(config.relative, "FAIL", config.error));
+      findings.push(finding8(config.relative, "FAIL", config.error));
       continue;
     }
-    for (const specifier of config.jsPlugins.filter((name) => name.startsWith(SCOPE))) {
+    for (const specifier of config.jsPlugins.filter((name) => name.startsWith(SCOPE2))) {
       specifiers.add(specifier);
       findings.push(await oneConfig({ config, root, specifier, workspaces }));
     }
@@ -2116,17 +2288,28 @@ var checkLoaded = async ({
   for (const specifier of [...specifiers].toSorted()) {
     findings.push(await copiesOf({ root, specifier, workspaces }));
   }
+  findings.push(...checkClaudePlugin({ home, train: await trainVersion(root, [...specifiers]) }));
   return findings;
 };
+var trainVersion = async (root, specifiers) => {
+  for (const specifier of specifiers.toSorted()) {
+    try {
+      return await pluginVersionOf(resolveFrom(root, specifier));
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+};
 
 // src/observability.ts
-import { readFileSync as readFileSync11 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync13 } from "fs";
+import { join as join13 } from "path";
 var GEONOSIS_FILE2 = "geonosis.json";
 var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
 var DEFAULT_MAX_AGE_SECONDS = 3600;
 var HEAD_TIMEOUT_MS = 3e3;
-var finding8 = (verdict, subject, message) => ({
+var finding9 = (verdict, subject, message) => ({
   check: "observability",
   message,
   subject,
@@ -2135,7 +2318,7 @@ var finding8 = (verdict, subject, message) => ({
 var readGeonosis2 = (root) => {
   let text;
   try {
-    text = readFileSync11(join11(root, GEONOSIS_FILE2), "utf8");
+    text = readFileSync13(join13(root, GEONOSIS_FILE2), "utf8");
   } catch {
     return { present: false };
   }
@@ -2153,25 +2336,25 @@ var readGeonosis2 = (root) => {
 var exporterFinding = (config) => {
   const sink = config.sink;
   if (typeof sink !== "string" || sink.trim() === "") {
-    return finding8(
+    return finding9(
       "FAIL",
       GEONOSIS_FILE2,
       "observability.sink is not set, so nothing here says where errors are supposed to go \u2014 and a repo that cannot name its exporter has not got one"
     );
   }
   if (REACHES_NOTHING.has(sink.toLowerCase())) {
-    return finding8(
+    return finding9(
       "WARN",
       GEONOSIS_FILE2,
       `the configured sink is "${sink}", which answers ok and reaches nothing. Correct in a dev tree; in a deployed one it is the instrument that cannot fail.`
     );
   }
-  return finding8("OK", GEONOSIS_FILE2, `the configured sink is "${sink}"`);
+  return finding9("OK", GEONOSIS_FILE2, `the configured sink is "${sink}"`);
 };
 var reachableFinding = async (config) => {
   const endpoint = config.endpoint;
   if (typeof endpoint !== "string" || endpoint.trim() === "") {
-    return finding8(
+    return finding9(
       "SKIP",
       GEONOSIS_FILE2,
       "no observability.endpoint was named, so whether the exporter is reachable was not asked"
@@ -2181,13 +2364,13 @@ var reachableFinding = async (config) => {
   const timer = setTimeout(() => controller.abort(), HEAD_TIMEOUT_MS);
   try {
     const response = await fetch(endpoint, { method: "HEAD", signal: controller.signal });
-    return finding8(
+    return finding9(
       "OK",
       GEONOSIS_FILE2,
       `${endpoint} is reachable \u2014 it answered ${response.status} to a HEAD`
     );
   } catch (error) {
-    return finding8(
+    return finding9(
       "FAIL",
       GEONOSIS_FILE2,
       `${endpoint} is not reachable from here: ${error.message}. Every report this repo sends is going into that.`
@@ -2199,7 +2382,7 @@ var reachableFinding = async (config) => {
 var ageFinding = (config, root, now) => {
   const file = config.lastEventFile;
   if (typeof file !== "string" || file.trim() === "") {
-    return finding8(
+    return finding9(
       "SKIP",
       GEONOSIS_FILE2,
       "no observability.lastEventFile was configured, so when the last event arrived is not a question anything here can answer. Have the sink write { at, id, sink } on every capture and name the file."
@@ -2208,27 +2391,27 @@ var ageFinding = (config, root, now) => {
   const maxAgeSeconds = typeof config.maxAgeSeconds === "number" && config.maxAgeSeconds > 0 ? config.maxAgeSeconds : DEFAULT_MAX_AGE_SECONDS;
   let record;
   try {
-    record = JSON.parse(readFileSync11(join11(root, file), "utf8"));
+    record = JSON.parse(readFileSync13(join13(root, file), "utf8"));
   } catch (error) {
-    return finding8(
+    return finding9(
       "FAIL",
       file,
       `the last event file could not be read: ${error.message}. A sink that has never written one has never captured anything.`
     );
   }
   if (typeof record.at !== "number" || !Number.isFinite(record.at)) {
-    return finding8(
+    return finding9(
       "FAIL",
       file,
       'the last event record has no numeric "at", so its age cannot be read \u2014 and an age nobody can read is not an age inside the window'
     );
   }
   const ageSeconds = Math.round((now - record.at) / 1e3);
-  return ageSeconds > maxAgeSeconds ? finding8(
+  return ageSeconds > maxAgeSeconds ? finding9(
     "FAIL",
     file,
     `the last event arrived ${ageSeconds}s ago, past the ${maxAgeSeconds}s window. An exporter that stopped, a key that was rotated and a sink that has been dropping since Tuesday all look exactly like this, and all of them leave a green build.`
-  ) : finding8(
+  ) : finding9(
     "OK",
     file,
     `the last event arrived ${ageSeconds}s ago, inside the ${maxAgeSeconds}s window`
@@ -2237,16 +2420,16 @@ var ageFinding = (config, root, now) => {
 var probeFinding = (config) => {
   const probe = config.probe;
   if (typeof probe === "string" && probe.trim() !== "") {
-    return finding8("OK", GEONOSIS_FILE2, `the probe that proves this exporter is "${probe}"`);
+    return finding9("OK", GEONOSIS_FILE2, `the probe that proves this exporter is "${probe}"`);
   }
   if (typeof config.lastEventFile === "string" && config.lastEventFile.trim() !== "") {
-    return finding8(
+    return finding9(
       "OK",
       GEONOSIS_FILE2,
       "no probe command, but a last event file is read above, so something does look at this exporter"
     );
   }
-  return finding8(
+  return finding9(
     "WARN",
     GEONOSIS_FILE2,
     "neither observability.probe nor observability.lastEventFile is configured, so nothing in this repo has ever established that a report reaches the sink. Name a probe command \u2014 the doctor reports it, your gate runs it."
@@ -2259,7 +2442,7 @@ var checkObservability = async ({
   const read = readGeonosis2(root);
   if (read.error !== void 0) {
     return [
-      finding8(
+      finding9(
         "FAIL",
         GEONOSIS_FILE2,
         `${GEONOSIS_FILE2} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
@@ -2268,7 +2451,7 @@ var checkObservability = async ({
   }
   if (!read.present || read.config === void 0) {
     return [
-      finding8(
+      finding9(
         "SKIP",
         GEONOSIS_FILE2,
         `no observability block in ${GEONOSIS_FILE2}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
@@ -2285,13 +2468,28 @@ var checkObservability = async ({
 };
 
 // src/runner.ts
-import { existsSync as existsSync9, readdirSync as readdirSync5, readFileSync as readFileSync12 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync11, readdirSync as readdirSync5, readFileSync as readFileSync14 } from "fs";
+import { join as join14, resolve as resolve2 } from "path";
 var TEST_FAILURES = "testFailures";
 var RUNS_A_RUNNER = /(?:^|[\s;&|(])(?:npx\s+|bunx\s+|pnpm\s+(?:exec\s+)?)?(?:vitest|bun\s+test)(?:\s|$)/;
 var RUNS_BUN_TEST = /(?:^|[\s;&|(])(?:bunx\s+)?bun\s+test(?:\s|$)/;
-var WRITES_A_REPORT = /--reporter[= ]\S*json|--outputFile/i;
-var finding9 = (subject, verdict, message) => ({
+var OUTPUT_FILE = /--outputFile[= ](\S+)/i;
+var A_SCRIPT_FILE = /\.(?:[cm]?[jt]sx?|sh|bash)$/;
+var wrapperNamedBy = (script, dir) => {
+  for (const token of script.split(/[\s'"]+/)) {
+    if (!A_SCRIPT_FILE.test(token)) continue;
+    try {
+      return { source: readFileSync14(resolve2(dir, token), "utf8"), where: token };
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+};
+var asCommand = (source) => source.replaceAll(/['"`,[\]()]/gu, " ");
+var ASKS_FOR_A_REPORT = /--outputFile|--reporter[= ]\S*json/i;
+var PARSES_A_REPORT = /JSON\.parse|numFailedTests/;
+var finding10 = (subject, verdict, message) => ({
   check: "runner",
   message,
   subject,
@@ -2309,20 +2507,21 @@ var reportingCounters = (ratchet) => (ratchet?.counters ?? []).filter(
   (entry) => entry.counter === TEST_FAILURES && stringOf(entry.report) !== ""
 );
 var keyOf = (entry) => stringOf(entry.key) === "" ? TEST_FAILURES : stringOf(entry.key);
+var namesReport = (entry, path) => stringOf(entry.reportPath) === path || stringOf(entry.command).includes(path);
 var PROVES = /--prove\b/;
 var everythingRun2 = (root, workspaces) => {
   const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
-  const dir = join12(root, ".github/workflows");
-  const workflows = (existsSync9(dir) ? readdirSync5(dir) : []).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((name) => {
+  const dir = join14(root, ".github/workflows");
+  const workflows = (existsSync11(dir) ? readdirSync5(dir) : []).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((name) => {
     try {
-      return readFileSync12(join12(dir, name), "utf8");
+      return readFileSync14(join14(dir, name), "utf8");
     } catch {
       return "";
     }
   });
   let tiers = {};
   try {
-    const config = JSON.parse(readFileSync12(join12(root, "geonosis.json"), "utf8"));
+    const config = JSON.parse(readFileSync14(join14(root, "geonosis.json"), "utf8"));
     tiers = config.verify ?? {};
   } catch {
   }
@@ -2340,7 +2539,7 @@ var proveIsWired = ({
   const { run, tiers } = everythingRun2(root, workspaces);
   if (PROVES.test(run)) {
     return [
-      finding9(
+      finding10(
         RATCHET_FILE,
         "OK",
         `${ratchet.counters.length} counter(s), and something here runs geonosis-ratchet --prove`
@@ -2349,7 +2548,7 @@ var proveIsWired = ({
   }
   const where = tiers.at(-1) ?? "full";
   return [
-    finding9(
+    finding10(
       RATCHET_FILE,
       "WARN",
       `${ratchet.counters.length} counter(s) and nothing here ever runs geonosis-ratchet --prove \u2014 not a verify tier, not a script, not a workflow. A counter that has never been seen reading its own planted finding has not been shown to measure anything, and it reads exactly like a clean tree. Add \`geonosis-ratchet --prove\` to the "${where}" tier in geonosis.json, or to the workflow that runs it`
@@ -2367,44 +2566,61 @@ var checkRunner = ({
     if (script === "") return [];
     const subject = workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
     const said2 = (verdict, message) => [
-      finding9(subject, verdict, message)
+      finding10(subject, verdict, message)
     ];
-    if (!RUNS_A_RUNNER.test(script)) {
+    const wrapper = RUNS_A_RUNNER.test(script) ? void 0 : wrapperNamedBy(script, workspace.dir);
+    const judged = wrapper === void 0 ? script : asCommand(wrapper.source);
+    const read = wrapper === void 0 ? `"${script}"` : `"${script}", read one level into ${wrapper.where},`;
+    if (!RUNS_A_RUNNER.test(judged)) {
       return said2(
         "OK",
-        `"${script}" runs neither vitest nor bun test \u2014 this check has nothing to say about it`
+        `${read} runs neither vitest nor bun test \u2014 this check has nothing to say about it`
       );
     }
     if (testFilesUnder(workspace.dir).length === 0) {
       return said2(
         "SKIP",
-        `"${script}" runs a test runner and there is no test file under this workspace \u2014 nothing here for its exit code to be wrong about`
+        `${read} runs a test runner and there is no test file under this workspace \u2014 nothing here for its exit code to be wrong about`
       );
     }
-    if (WRITES_A_REPORT.test(script)) {
-      return said2("OK", "the script asks the runner for its own JSON report, not for a status code");
+    if (wrapper !== void 0 && ASKS_FOR_A_REPORT.test(wrapper.source) && PARSES_A_REPORT.test(wrapper.source)) {
+      return said2(
+        "OK",
+        `${wrapper.where} spawns the runner, asks it for a JSON report and parses that report \u2014 the exit code is not the verdict here`
+      );
     }
+    const written = OUTPUT_FILE.exec(judged)?.[1];
     const counter = reading.find((entry) => covers(stringOf(entry.command), workspace, workspaces));
     if (counter !== void 0) {
-      return said2("OK", `read by the ratchet's "${keyOf(counter)}" counter in report mode`);
+      const named2 = written !== void 0 && namesReport(counter, written);
+      return said2(
+        "OK",
+        named2 ? `the script writes its JSON report to ${written} and the ratchet's "${keyOf(counter)}" counter reads that path` : `read by the ratchet's "${keyOf(counter)}" counter in report mode`
+      );
     }
-    if (RUNS_BUN_TEST.test(script)) {
+    if (RUNS_BUN_TEST.test(judged)) {
       return said2(
         "OK",
-        `"${script}" is judged by its exit code, and bun test's exit code is a verdict: a planted failure exits 1, measured on bun 1.4.0 (2026-08-30). Nothing further is required here.`
+        `${read} is judged by its exit code, and bun test's exit code is a verdict: a planted failure exits 1, measured on bun 1.4.0 (2026-08-30). Nothing further is required here.`
+      );
+    }
+    if (written !== void 0) {
+      return said2(
+        "WARN",
+        `${read} writes the runner's JSON report to ${written} and nothing reads it \u2014 written, read by nothing, which leaves the exit code as the only verdict again. Give the ratchet a ${TEST_FAILURES} counter in report mode whose "reportPath" or command names ${written}.`
       );
     }
     return said2(
       "WARN",
-      `"${script}" runs vitest, whose exit code is the only verdict here; @cloudflare/vitest-pool-workers exited 0 on failing tests for weeks in a consumer. Give the ratchet a ${TEST_FAILURES} counter in report mode covering this workspace, or have the script write a JSON report.`
+      `${read} runs vitest, whose exit code is the only verdict here; @cloudflare/vitest-pool-workers exited 0 on failing tests for weeks in a consumer. Give the ratchet a ${TEST_FAILURES} counter in report mode covering this workspace, or have the script write a JSON report something reads.`
     );
   });
   return [...proveIsWired({ ratchet, root, workspaces }), ...perWorkspace2];
 };
 
 // src/doctor.ts
-import { homedir as homedir2 } from "os";
-import { join as join14 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join17 } from "path";
 import { resolveOxlint } from "@geonosis/lint-parity";
 
 // src/engine.ts
@@ -2432,16 +2648,32 @@ var checkEngines = async ({
   workspaces
 }) => {
   const plugin = await presumptionsOf(entry).catch(() => void 0);
-  if (plugin === void 0 || plugin.namespace === "" || Object.keys(plugin.presumed).length === 0) {
+  if (plugin === void 0 || plugin.namespace === "" || Object.keys(plugin.presumed).length === 0 && Object.keys(plugin.floors).length === 0) {
     return [];
   }
+  const pending = (rule) => {
+    const floor = plugin.floors[rule.slice(plugin.namespace.length + 1)];
+    if (floor === void 0) return [];
+    return [
+      {
+        check: "exercised",
+        message: `it names a pattern the kit does not ship yet (${floor.name}) \u2014 the rule is the requirement and there is nothing to install behind it, so a repo enabling it hand-writes the floor to satisfy the lint. Wait for the floor, or keep the pattern of your own and know that is what it is`,
+        subject: `${config.relative} \u2192 ${rule}`,
+        verdict: "WARN"
+      }
+    ];
+  };
   const governed = governedBy(config.dir, workspaces);
   const declared = new Set(governed.flatMap((one) => [...declaredIn3(one.manifest)]));
   const asked = governed.map(labelOf3).join(", ");
   return enabledHere2(config, plugin.namespace).flatMap((rule) => {
+    const floorless = pending(rule);
     const presumes = plugin.presumed[rule.slice(plugin.namespace.length + 1)];
-    if (presumes === void 0 || presumes.packages.some((name) => declared.has(name))) return [];
+    if (presumes === void 0 || presumes.packages.some((name) => declared.has(name))) {
+      return floorless;
+    }
     return [
+      ...floorless,
       {
         check: "exercised",
         message: `it presumes ${presumes.engine}, and none of the manifests this config governs (${asked}) declares ${presumes.packages.join(" or ")} \u2014 enabled here it has no possible finding, which reads exactly like a clean tree. Drop it from this config, or say which package brings the engine`,
@@ -2452,15 +2684,80 @@ var checkEngines = async ({
   });
 };
 
+// src/path-grants.ts
+import { readdirSync as readdirSync6 } from "fs";
+import { join as join15 } from "path";
+var OFF2 = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
+var severityOf2 = (level) => Array.isArray(level) ? level[0] : level;
+var NEVER_WALKED3 = /* @__PURE__ */ new Set([".git", "coverage", "dist", "node_modules"]);
+var LINTABLE2 = /\.[cm]?[jt]sx?$/;
+var filesUnder2 = (root, at = "") => {
+  let entries;
+  try {
+    entries = readdirSync6(join15(root, at), { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.flatMap((entry) => {
+    const here = at === "" ? entry.name : `${at}/${entry.name}`;
+    if (entry.isDirectory()) {
+      return NEVER_WALKED3.has(entry.name) ? [] : filesUnder2(root, here);
+    }
+    return LINTABLE2.test(entry.name) ? [here] : [];
+  });
+};
+var stringsOf2 = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
+var bagOf = (level) => {
+  if (!Array.isArray(level)) return {};
+  const [, options] = level;
+  return typeof options === "object" && options !== null && !Array.isArray(options) ? options : {};
+};
+var matches = (patterns, file) => patterns.some((pattern) => {
+  if (file.includes(pattern)) return true;
+  try {
+    return new RegExp(pattern).test(file);
+  } catch {
+    return false;
+  }
+});
+var checkPathGrants = ({
+  config,
+  grants,
+  root
+}) => {
+  const declared = Object.entries(grants);
+  if (declared.length === 0) return [];
+  const files = filesUnder2(root);
+  const found = [];
+  for (const [id, grant] of declared) {
+    for (const layer of layersOf(config, id)) {
+      if (OFF2.has(severityOf2(layer.level))) continue;
+      const options = bagOf(layer.level);
+      const patterns = stringsOf2(options[grant.paths]);
+      if (patterns.length === 0) continue;
+      const enumerated = stringsOf2(options[grant.modules]);
+      const exempted = files.filter((file) => matches(patterns, file));
+      if (exempted.length <= enumerated.length) continue;
+      found.push({
+        check: "exercised",
+        message: `${id} exempts ${exempted.length} file${exempted.length === 1 ? "" : "s"} in this tree by \`${grant.paths}\` (${patterns.join(", ")}) and enumerates ${enumerated.length} in \`${grant.modules}\`: a pattern grants its exemption to wherever it stops, so nothing counts what accumulates on the far side. Name them \u2014 ${exempted.slice(0, 5).join(", ")}${exempted.length > 5 ? ", \u2026" : ""} \u2014 in \`${grant.modules}\`.`,
+        subject: config.relative,
+        verdict: "WARN"
+      });
+    }
+  }
+  return found;
+};
+
 // src/rails.ts
-import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
+import { join as join16 } from "path";
 var GEONOSIS2 = "geonosis.json";
 var PROJECT = ".claude/settings.json";
 var LOCAL = ".claude/settings.local.json";
 var RUN_RECORD = ".geonosis/rails-run.json";
 var managedSettingsPath = (platform = process.platform) => platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json" : "/etc/claude-code/managed-settings.json";
-var finding10 = (subject, verdict, message) => ({
+var finding11 = (subject, verdict, message) => ({
   check: "rails",
   message,
   subject,
@@ -2480,10 +2777,10 @@ var networkIn = (parsed) => {
   };
 };
 var sourceAt = (path, label) => {
-  if (!existsSync10(path)) return { network: void 0, path: label, unreadable: false };
+  if (!existsSync12(path)) return { network: void 0, path: label, unreadable: false };
   try {
     return {
-      network: networkIn(JSON.parse(readFileSync13(path, "utf8"))),
+      network: networkIn(JSON.parse(readFileSync15(path, "utf8"))),
       path: label,
       unreadable: false
     };
@@ -2492,11 +2789,11 @@ var sourceAt = (path, label) => {
   }
 };
 var declaredEgress = (root) => {
-  const at = join13(root, GEONOSIS2);
-  if (!existsSync10(at)) return void 0;
+  const at = join16(root, GEONOSIS2);
+  if (!existsSync12(at)) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync13(at, "utf8"));
+    parsed = JSON.parse(readFileSync15(at, "utf8"));
   } catch {
     return void 0;
   }
@@ -2508,10 +2805,10 @@ var declaredEgress = (root) => {
   };
 };
 var deniedEgress = (root) => {
-  const at = join13(root, RUN_RECORD);
-  if (!existsSync10(at)) {
+  const at = join16(root, RUN_RECORD);
+  if (!existsSync12(at)) {
     return [
-      finding10(
+      finding11(
         "deniedEgress",
         "SKIP",
         `there is no ${RUN_RECORD} here, so no run has been recorded for this to be a gate over`
@@ -2520,10 +2817,10 @@ var deniedEgress = (root) => {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync13(at, "utf8"));
+    parsed = JSON.parse(readFileSync15(at, "utf8"));
   } catch (error) {
     return [
-      finding10(
+      finding11(
         "deniedEgress",
         "FAIL",
         `${RUN_RECORD} is not readable JSON (${error.message}) \u2014 a record nobody can read is not a record of zero denied attempts`
@@ -2532,11 +2829,11 @@ var deniedEgress = (root) => {
   }
   const denied = isRecord3(parsed) && Array.isArray(parsed["deniedEgress"]) ? parsed["deniedEgress"] : [];
   if (denied.length === 0) {
-    return [finding10("deniedEgress", "OK", "no run recorded a denied egress attempt")];
+    return [finding11("deniedEgress", "OK", "no run recorded a denied egress attempt")];
   }
   const hosts = denied.map((one) => isRecord3(one) && typeof one["host"] === "string" ? one["host"] : "(unnamed)").join(", ");
   return [
-    finding10(
+    finding11(
       "deniedEgress",
       "FAIL",
       `${denied.length} denied egress attempt(s) in this run's record \u2014 ${hosts}. This is a gate at ZERO and never a counter to hold flat: a run that reached for a host this repo does not allow is a run somebody reads, whatever the number was yesterday`
@@ -2551,7 +2848,7 @@ var checkRails = ({
   const declared = declaredEgress(root);
   if (declared === void 0 || declared.allow.length === 0) {
     return [
-      finding10(
+      finding11(
         `${GEONOSIS2} \u2192 rails.egress`,
         "SKIP",
         "this repo declares no egress allowlist, so there is no rendered setting for this to read back"
@@ -2561,11 +2858,11 @@ var checkRails = ({
   const sources = [
     sourceAt(managedSettings, managedSettings),
     sourceAt(userSettings, userSettings),
-    sourceAt(join13(root, PROJECT), PROJECT),
-    sourceAt(join13(root, LOCAL), LOCAL)
+    sourceAt(join16(root, PROJECT), PROJECT),
+    sourceAt(join16(root, LOCAL), LOCAL)
   ];
   const unreadable = sources.filter((one) => one.unreadable).map(
-    (one) => finding10(
+    (one) => finding11(
       one.path,
       "FAIL",
       "is not readable JSON, and Claude Code SILENTLY ignores a settings file that fails validation \u2014 every setting rendered into this file loads as nothing, with no error anywhere. Fix the file, then render the allowlist again"
@@ -2580,7 +2877,7 @@ var checkRails = ({
   return [
     ...unreadable,
     ...declared.allow.map(
-      (domain) => effective.has(domain) ? finding10(domain, "OK", "declared, and in the settings that actually load") : finding10(
+      (domain) => effective.has(domain) ? finding11(domain, "OK", "declared, and in the settings that actually load") : finding11(
         domain,
         "FAIL",
         `declared in ${GEONOSIS2} \u2192 rails.egress and absent from every settings file that loads, so the run has no allowance for it.${why}`
@@ -2660,7 +2957,7 @@ var exercisedOf = ({
   workspaces
 }) => Promise.all(
   configs.flatMap(
-    (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE)).map(async (specifier) => {
+    (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE2)).map(async (specifier) => {
       let corpus;
       let entry;
       try {
@@ -2677,6 +2974,7 @@ var exercisedOf = ({
         ];
       }
       const own = repoCorpus !== void 0 && config.relative === CONFIG_FILE ? repoCorpus : void 0;
+      const grants = await grantsOf(entry).catch(() => ({}));
       const [reach, engines] = await Promise.all([
         checkExercised({
           config,
@@ -2690,14 +2988,14 @@ var exercisedOf = ({
         // inside it — one is about the corpus, the other about this repo's own manifests.
         checkEngines({ config, entry, workspaces })
       ]);
-      return [reach, ...engines];
+      return [reach, ...engines, ...checkPathGrants({ config, grants, root })];
     })
   )
 );
 var requiredOptionsOf = async (configs) => {
   const found = await Promise.all(
     configs.flatMap(
-      (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE)).map(async (specifier) => {
+      (config) => config.jsPlugins.filter((name) => name.startsWith(SCOPE2)).map(async (specifier) => {
         let entry;
         try {
           entry = resolveFrom(config.dir, specifier);
@@ -2733,6 +3031,7 @@ var countsOf = (findings) => findings.reduce((counts, one) => ({ ...counts, [one
 });
 var runDoctor = async ({
   baseline,
+  home = homedir3(),
   only,
   oxlint,
   root,
@@ -2750,7 +3049,7 @@ var runDoctor = async ({
     [
       "loaded",
       async () => [
-        ...await checkLoaded({ configs, root, workspaces }),
+        ...await checkLoaded({ configs, home, root, workspaces }),
         ...await requiredOptionsOf(configs)
       ]
     ],
@@ -2784,7 +3083,8 @@ var runDoctor = async ({
     ["observability", () => checkObservability({ now: Date.now(), root })],
     ["drift", () => checkDrift({ root, workspaces })],
     ["deployed", () => checkDeployed({ root })],
-    ["rails", () => checkRails({ root, userSettings: join14(homedir2(), USER_SETTINGS) })]
+    ["rails", () => checkRails({ root, userSettings: join17(home, USER_SETTINGS) })],
+    ["exams", () => checkExams({ root, workspaces })]
   ];
   const collected = [];
   const ran = [];
@@ -2810,6 +3110,7 @@ var ABOUT = {
   deployed: "what the pipeline reported deploying is what the tree declares",
   drift: "the gates that were set up and are no longer running",
   envelope: "every gate read as many things as it was handed",
+  exams: "every adopted floor has a test file that runs its exam",
   exercised: "every enabled rule fires on at least one corpus file",
   group: "the packages published on one version resolve to one version",
   loaded: "the plugin oxlint would load is the one the manifest pins",
@@ -2878,7 +3179,12 @@ export {
   ENVELOPES_DIR,
   NO_ENVELOPES,
   checkEnvelopes,
-  SCOPE,
+  checkExams,
+  INSTALLED_PLUGINS,
+  PLUGIN_NAME,
+  installedPluginVersions,
+  checkClaudePlugin,
+  SCOPE2 as SCOPE,
   satisfies,
   declaredFor,
   checkLoaded,

package/dist/doctor-cli.js

@@ -4,15 +4,15 @@ import {
   formatDoctor,
   formatJson,
   runDoctor
-} from "./chunk-R2R2OYH3.js";
+} from "./chunk-GWVSC7GZ.js";
 
 // src/doctor-cli.ts
 import { fstatSync, statSync } from "fs";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 
 // src/envelope-write.ts
 import { mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
+import { dirname, join, resolve } from "path";
 import { fileURLToPath } from "url";
 var envelopePath = (root, tool) => join(root, ENVELOPES_DIR, `${tool}.json`);
 var UnbalancedEnvelope = class extends Error {
@@ -23,6 +23,14 @@ var UnbalancedEnvelope = class extends Error {
 };
 var isCount = (value) => Number.isSafeInteger(value) && value >= 0;
 var unbalancedMessage = (envelope, next) => `${envelope.tool}: considered ${envelope.considered} but accounts for ${envelope.read + envelope.refused.length + envelope.excused.length} \u2014 ${envelope.read} read + ${envelope.refused.length} refused + ${envelope.excused.length} excused. A run that has lost count of its own inputs cannot say what it measured, so no verdict was rendered and no envelope was written. Next: ${next}`;
+var FORBIDDEN_ROOT = "GEONOSIS_ENVELOPES_FORBIDDEN_ROOT";
+var refuseForbiddenRoot = (root) => {
+  const forbidden = process.env[FORBIDDEN_ROOT];
+  if (forbidden === void 0 || resolve(forbidden) !== resolve(root)) return;
+  throw new UnbalancedEnvelope(
+    `${root} is off limits to envelope writers in this process (${FORBIDDEN_ROOT}) \u2014 a run that writes one into a shared root races every other run reading it, and leaves a file the next one takes for real. Point this at a scratch root of its own: tooling/scratch-dir.ts.`
+  );
+};
 var writeEnvelope = ({
   envelope,
   next,
@@ -46,6 +54,7 @@ var writeEnvelope = ({
   if (envelope.considered !== envelope.read + envelope.refused.length + envelope.excused.length) {
     throw new UnbalancedEnvelope(unbalancedMessage(envelope, next));
   }
+  refuseForbiddenRoot(root);
   const at = envelopePath(root, envelope.tool);
   mkdirSync(dirname(at), { recursive: true });
   writeFileSync(at, `${JSON.stringify(envelope, void 0, 2)}
@@ -120,6 +129,12 @@ var ABOUT = {
               parity run over a tree the second config ignored. Each published a numerator and no
               denominator. Reads the files and imports nothing of the tools that wrote them; no
               envelopes at all is a SKIP with the sentence.`,
+  exams: `Every @geonosis/* floor a manifest here declares, against the test files in this tree: a
+              floor whose exam nothing imports is a floor whose break the tier cannot see, and a
+              bump that broke it would read exactly like a green run. The exams are read off the
+              installed floor's own declarations \u2014 every export ending in Conformance \u2014 never off a
+              list held here. WARNs, because a floor adopted last week and one whose exam somebody
+              deleted look the same from outside.`,
   exercised: `Every rule a config enables, against the corpus the loaded plugin ships. A rule at
               "error" that can never fire is indistinguishable from a clean tree. The line says what
               its number is evidence ABOUT \u2014 the corpus and the probes, never this tree \u2014 and a rule
@@ -181,7 +196,7 @@ plugin-route-namespaced on its package root, while the shipped corpus says acme
 
   --print-config-shape   every file this reads, and the keys it reads out of each
 
-Every run writes .geonosis/envelopes/doctor.json: the ten checks CONSIDERED against the ones this
+Every run writes .geonosis/envelopes/doctor.json: the eleven checks CONSIDERED against the ones this
 run read, with the rest excused by name, so a --only run can never read as a verdict about the whole
 tree. The envelope check SKIPs that one file \u2014 this run is the one writing it.
 
@@ -225,8 +240,8 @@ var parseDoctorArgs = (argv, cwd) => {
     ...baseline === void 0 ? {} : { baseline },
     json,
     ...only === void 0 || only.length === 0 ? {} : { only },
-    ...read["--oxlint"] === void 0 ? {} : { oxlint: resolve(cwd, read["--oxlint"]) },
-    root: resolve(cwd, read["--root"] ?? cwd),
+    ...read["--oxlint"] === void 0 ? {} : { oxlint: resolve2(cwd, read["--oxlint"]) },
+    root: resolve2(cwd, read["--root"] ?? cwd),
     strict
   };
 };

package/dist/index.d.ts

@@ -11,7 +11,7 @@ type Overrides = {
  * question one layer out — whether what was reported is what happened; `rails` asks it of the
  * settings an unattended run is bounded by, where a rendered file is not a loaded setting.
  */
-declare const CHECKS: readonly ["loaded", "group", "exercised", "baseline", "runner", "envelope", "drift", "observability", "deployed", "rails"];
+declare const CHECKS: readonly ["loaded", "group", "exercised", "baseline", "runner", "envelope", "drift", "observability", "deployed", "rails", "exams"];
 type CheckName = (typeof CHECKS)[number];
 /**
  * `SKIP` is a first-class answer and is printed like any other: a check whose line is missing reads
@@ -66,6 +66,8 @@ type RatchetConfig = {
     counters: Record<string, unknown>[];
 };
 type DoctorOptions = {
+    /** Where `~/.claude` lives — the plugin registry and the user settings the doctor reads; the home directory unless a caller says otherwise. */
+    home?: string;
     /**
      * Present only when a baseline comparison was asked for, because making one is the one part of
      * this tool that runs git — and the release check runs the doctor inside repos other sessions
@@ -138,7 +140,7 @@ declare const discoverConfigs: (root: string) => DiscoveredConfig[];
 declare const discoverWorkspaces: (root: string) => Workspace[];
 declare const readRatchet: (root: string) => RatchetConfig | undefined;
 
-declare const runDoctor: ({ baseline, only, oxlint, root, strict, }: DoctorOptions) => Promise<DoctorReport>;
+declare const runDoctor: ({ baseline, home, only, oxlint, root, strict, }: DoctorOptions) => Promise<DoctorReport>;
 
 /** The file `create-geonosis --domains` writes, held against the scaffold's own name by a test. */
 declare const COMPOSITION_ROOT = "src/platform.ts";
@@ -265,6 +267,39 @@ declare const checkGroup: ({ groups, root, workspaces, }: {
     workspaces: Workspace[];
 }) => Finding[];
 
+/**
+ * Where Claude Code records what it has installed.
+ *
+ * MEASURED 2026-09-02 (`~/.claude/plugins/installed_plugins.json`, `version: 2`): a map keyed
+ * `<plugin>@<marketplace>`, each value a list of installations carrying `version`, `installPath`
+ * and the commit it came from. This is the file `claude plugin list` answers from.
+ */
+declare const INSTALLED_PLUGINS = ".claude/plugins/installed_plugins.json";
+/** The plugin this kit publishes. Its own name, the way `FIXED_GROUP` is its own group. */
+declare const PLUGIN_NAME = "geonosis";
+/**
+ * Every version of one plugin this machine has installed, in the order the record lists them.
+ *
+ * A name can be installed from more than one marketplace and at more than one scope, so this
+ * answers with a list rather than picking one: a session loads what it loads, and a doctor that
+ * chose for the reader would be reporting about an installation nobody has.
+ */
+declare const installedPluginVersions: (home: string, name: string) => string[];
+/**
+ * #133: a consumer's npm bump does not move the CLAUDE PLUGIN.
+ *
+ * The hooks, the agents and the skills live in the plugin, and it updates on `claude plugin update`
+ * and never on an install — so a repo can be on this release's packages while every session in it
+ * runs the hooks of the one before, and a refusal added this release cannot fire. That is the
+ * declared-versus-loaded question one surface out, and it is this check's to ask.
+ */
+declare const checkClaudePlugin: ({ home, name, train, }: {
+    home?: string;
+    name?: string;
+    /** The version the package train is on here, or nothing when this tree declares none. */
+    train: string | undefined;
+}) => Finding[];
+
 /** The scope this tool asks about. A config's other plugins are somebody else's release to check. */
 declare const SCOPE = "@geonosis/";
 /**
@@ -286,8 +321,9 @@ declare const declaredFor: ({ dir, specifier, workspaces, }: {
     at: string;
     spec: string;
 } | undefined;
-declare const checkLoaded: ({ configs, root, workspaces, }: {
+declare const checkLoaded: ({ configs, home, root, workspaces, }: {
     configs: DiscoveredConfig[];
+    home?: string;
     root: string;
     workspaces: Workspace[];
 }) => Promise<Finding[]>;
@@ -353,6 +389,23 @@ declare const corpusOfPlugin: (from: string, specifier: string) => string;
  */
 declare const relativeToRoot: (root: string, path: string) => string;
 
+/**
+ * Whether an adopted floor is exercised by a test file at all.
+ *
+ * A verify tier declares COMMANDS, not globs, so "the exam runs in the fast tier" is not a claim
+ * anything can check. What is checkable is whether a test file importing the exam exists: a floor a
+ * consumer adopted and never exams is a floor whose break their gate cannot see, and a floor bump
+ * that broke it would read exactly like a green tier (#293).
+ *
+ * It WARNs rather than FAILs. The check cannot tell a floor adopted last week from one whose exam
+ * somebody deleted, and a FAIL on every fresh install is the shape that teaches a reader to skim
+ * the section — the lesson the `runner` check already learned about warning the wrong runner.
+ */
+declare const checkExams: ({ root, workspaces, }: {
+    root: string;
+    workspaces: Workspace[];
+}) => Finding[];
+
 /**
  * Whether a test runner's exit code is a verdict — asked of the runner the script actually names,
  * not of runners in general.
@@ -370,4 +423,4 @@ declare const checkRunner: ({ ratchet, root, workspaces, }: {
     workspaces: Workspace[];
 }) => Finding[];
 
-export { CHECKS, COMPOSITION_ROOT, CONFIG_FILE, type CheckName, DEPLOYED_FILE, type DiscoveredConfig, DoctorError, type DoctorOptions, type DoctorReport, ENVELOPES_DIR, FIXED_GROUP, FLOOR_PACKAGES, type Finding, GEONOSIS_FILE, type HeldTogether, KIT_GROUP, type LastEventRecord, MANIFEST_FILE, type Manifest, NOT_WRITTEN, NO_ENVELOPES, type ObservabilityConfig, RATCHET_FILE, READERS, type RatchetConfig, SCOPE, type Verdict, type Workspace, checkBaseline, checkDeployed, checkDrift, checkEnvelopes, checkExercised, checkGroup, checkLoaded, checkObservability, checkRunner, corpusOfPlugin, declaredFor, declaredGroupsOf, defaultRef, discoverConfigs, discoverWorkspaces, enabledRulesOf, formatDoctor, formatJson, packageDirOf, pluginVersionOf, readConfig, readRatchet, relativePath, relativeToRoot, repoCorpusOf, resolveFrom, runDoctor, satisfies };
+export { CHECKS, COMPOSITION_ROOT, CONFIG_FILE, type CheckName, DEPLOYED_FILE, type DiscoveredConfig, DoctorError, type DoctorOptions, type DoctorReport, ENVELOPES_DIR, FIXED_GROUP, FLOOR_PACKAGES, type Finding, GEONOSIS_FILE, type HeldTogether, INSTALLED_PLUGINS, KIT_GROUP, type LastEventRecord, MANIFEST_FILE, type Manifest, NOT_WRITTEN, NO_ENVELOPES, type ObservabilityConfig, PLUGIN_NAME, RATCHET_FILE, READERS, type RatchetConfig, SCOPE, type Verdict, type Workspace, checkBaseline, checkClaudePlugin, checkDeployed, checkDrift, checkEnvelopes, checkExams, checkExercised, checkGroup, checkLoaded, checkObservability, checkRunner, corpusOfPlugin, declaredFor, declaredGroupsOf, defaultRef, discoverConfigs, discoverWorkspaces, enabledRulesOf, formatDoctor, formatJson, installedPluginVersions, packageDirOf, pluginVersionOf, readConfig, readRatchet, relativePath, relativeToRoot, repoCorpusOf, resolveFrom, runDoctor, satisfies };

package/dist/index.js

@@ -8,17 +8,21 @@ import {
   FIXED_GROUP,
   FLOOR_PACKAGES,
   GEONOSIS_FILE,
+  INSTALLED_PLUGINS,
   KIT_GROUP,
   MANIFEST_FILE,
   NOT_WRITTEN,
   NO_ENVELOPES,
+  PLUGIN_NAME,
   RATCHET_FILE,
   READERS,
   SCOPE,
   checkBaseline,
+  checkClaudePlugin,
   checkDeployed,
   checkDrift,
   checkEnvelopes,
+  checkExams,
   checkExercised,
   checkGroup,
   checkLoaded,
@@ -33,6 +37,7 @@ import {
   enabledRulesOf,
   formatDoctor,
   formatJson,
+  installedPluginVersions,
   packageDirOf,
   pluginVersionOf,
   readConfig,
@@ -43,7 +48,7 @@ import {
   resolveFrom,
   runDoctor,
   satisfies
-} from "./chunk-R2R2OYH3.js";
+} from "./chunk-GWVSC7GZ.js";
 export {
   CHECKS,
   COMPOSITION_ROOT,
@@ -54,17 +59,21 @@ export {
   FIXED_GROUP,
   FLOOR_PACKAGES,
   GEONOSIS_FILE,
+  INSTALLED_PLUGINS,
   KIT_GROUP,
   MANIFEST_FILE,
   NOT_WRITTEN,
   NO_ENVELOPES,
+  PLUGIN_NAME,
   RATCHET_FILE,
   READERS,
   SCOPE,
   checkBaseline,
+  checkClaudePlugin,
   checkDeployed,
   checkDrift,
   checkEnvelopes,
+  checkExams,
   checkExercised,
   checkGroup,
   checkLoaded,
@@ -79,6 +88,7 @@ export {
   enabledRulesOf,
   formatDoctor,
   formatJson,
+  installedPluginVersions,
   packageDirOf,
   pluginVersionOf,
   readConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/doctor",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "types": "./dist/index.d.ts",
   "description": "The adoption doctor — declared ≠ loaded, enabled ≠ exercised, a baseline that grew, a runner whose exit code is the only verdict.",
   "keywords": [
@@ -35,10 +35,10 @@
     "dist"
   ],
   "dependencies": {
-    "@geonosis/lint-parity": "2.1.0"
+    "@geonosis/lint-parity": "2.3.0"
   },
   "devDependencies": {
-    "@geonosis/ratchet": "2.1.0"
+    "@geonosis/ratchet": "2.3.0"
   },
   "peerDependencies": {
     "oxlint": ">=1.77"