@geonosis/doctor 2.10.0 → 2.11.1

package/dist/{chunk-2ZVCJG5R.js → chunk-VWMNCBDP.js}

@@ -1,6 +1,91 @@
+// src/types.ts
+var CHECKS = [
+  "loaded",
+  "group",
+  "exercised",
+  "baseline",
+  "runner",
+  "envelope",
+  "drift",
+  "observability",
+  "deployed",
+  "rails",
+  "exams",
+  "seams",
+  "formatter"
+];
+var findingMaker = (check) => (subject, verdict, message) => ({
+  check,
+  message,
+  subject,
+  verdict
+});
+var DoctorError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DoctorError";
+  }
+};
+var dependencyNamesOf = (manifest) => new Set(
+  [
+    manifest.dependencies,
+    manifest.devDependencies,
+    manifest.optionalDependencies,
+    manifest.peerDependencies
+  ].flatMap((block) => Object.keys(block ?? {}))
+);
+
+// src/geonosis-file.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var GEONOSIS_FILE = "geonosis.json";
+var readGeonosisFile = (root) => {
+  const path = join(root, GEONOSIS_FILE);
+  if (!existsSync(path)) return { kind: "absent" };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return { error: "the top level is not an object", kind: "unreadable" };
+    }
+    return { config: parsed, kind: "present" };
+  } catch (error) {
+    return { error: error.message, kind: "unreadable" };
+  }
+};
+var unreadableGeonosis = (check, error) => findingMaker(check)(
+  GEONOSIS_FILE,
+  "FAIL",
+  `${GEONOSIS_FILE} could not be parsed: ${error}. A config nobody can read has not been read, and every question this check would answer is answered from a default nobody chose.`
+);
+
+// src/apparatus.ts
+import { realpathSync } from "fs";
+import { join as join2, sep } from "path";
+var APPARATUS_KEY = "apparatus";
+var real = (path) => {
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
+  }
+};
+var holds = (parent, child) => child === parent || child.startsWith(`${parent}${sep}`);
+var declaredApparatusOf = (root) => {
+  const read = readGeonosisFile(root);
+  if (read.kind !== "present") return [];
+  const doctor = read.config.doctor;
+  if (typeof doctor !== "object" || doctor === null) return [];
+  const declared = doctor[APPARATUS_KEY];
+  return Array.isArray(declared) ? declared.filter((one) => typeof one === "string" && one !== "").map((one) => join2(root, one)) : [];
+};
+var evidenceHolding = (config, evidence) => {
+  const dir = real(config.dir);
+  return evidence.find((one) => holds(real(one), dir));
+};
+
 // src/discover.ts
-import { readdirSync, readFileSync, statSync } from "fs";
-import { join, relative as relativeTo, sep } from "path";
+import { readdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import { join as join3, relative as relativeTo, sep as sep2 } from "path";
 var CONFIG_FILE = ".oxlintrc.json";
 var MANIFEST_FILE = "package.json";
 var RATCHET_FILE = "geonosis.ratchet.json";
@@ -12,7 +97,7 @@ var NEVER_WALKED = /* @__PURE__ */ new Set([
   "storybook-static"
 ]);
 var skipped = (name) => name.startsWith(".") || NEVER_WALKED.has(name);
-var relativePath = (root, path) => relativeTo(root, path).split(sep).join("/");
+var relativePath = (root, path) => relativeTo(root, path).split(sep2).join("/");
 var walk = (dir, onFile) => {
   let entries;
   try {
@@ -22,18 +107,18 @@ var walk = (dir, onFile) => {
   }
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      if (!skipped(entry.name)) walk(join(dir, entry.name), onFile);
+      if (!skipped(entry.name)) walk(join3(dir, entry.name), onFile);
       continue;
     }
-    if (entry.isFile()) onFile(join(dir, entry.name), entry.name);
+    if (entry.isFile()) onFile(join3(dir, entry.name), entry.name);
   }
 };
-var parse = (path) => JSON.parse(readFileSync(path, "utf8"));
+var parse = (path) => JSON.parse(readFileSync2(path, "utf8"));
 var stringsOf = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
 var rulesOf = (value) => typeof value === "object" && value !== null ? value : {};
 var overridesOf = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "object" && one !== null).map((one) => ({ files: stringsOf(one.files), rules: rulesOf(one.rules) })) : [];
 var readConfig = (path, root) => {
-  const dir = join(path, "..");
+  const dir = join3(path, "..");
   const relative = relativePath(root, path);
   try {
     const config = parse(path);
@@ -62,7 +147,7 @@ var discoverConfigs = (root) => {
   walk(root, (path, name) => {
     if (name === CONFIG_FILE) found.push(readConfig(path, root));
   });
-  return found.toSorted((a, b) => a.relative.localeCompare(b.relative));
+  return found.toSorted((a, b) => a.relative.localeCompare(b.relative, "en-US"));
 };
 var discoverWorkspaces = (root) => {
   const found = [];
@@ -74,9 +159,9 @@ var discoverWorkspaces = (root) => {
     } catch {
       return;
     }
-    found.push({ dir: join(path, ".."), manifest, relative: relativePath(root, join(path, "..")) });
+    found.push({ dir: join3(path, ".."), manifest, relative: relativePath(root, join3(path, "..")) });
   });
-  return found.toSorted((a, b) => a.relative.localeCompare(b.relative));
+  return found.toSorted((a, b) => a.relative.localeCompare(b.relative, "en-US"));
 };
 var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var testFilesUnder = (dir) => filesUnder(dir, (name) => TEST_FILE.test(name));
@@ -88,7 +173,7 @@ var filesUnder = (dir, match) => {
   return found;
 };
 var readRatchet = (root) => {
-  const path = join(root, RATCHET_FILE);
+  const path = join3(root, RATCHET_FILE);
   try {
     statSync(path);
   } catch {
@@ -101,40 +186,12 @@ var readRatchet = (root) => {
   };
 };
 
-// src/types.ts
-var CHECKS = [
-  "loaded",
-  "group",
-  "exercised",
-  "baseline",
-  "runner",
-  "envelope",
-  "drift",
-  "observability",
-  "deployed",
-  "rails",
-  "exams",
-  "seams"
-];
-var findingMaker = (check) => (subject, verdict, message) => ({
-  check,
-  message,
-  subject,
-  verdict
-});
-var DoctorError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "DoctorError";
-  }
-};
-
 // src/baseline.ts
 import { spawnSync } from "child_process";
 var DEFAULT_REF = "origin/main";
 var git = (root, args) => {
-  const run = spawnSync("git", args, { cwd: root, encoding: "utf8" });
-  return { code: run.status ?? -1, output: `${run.stdout ?? ""}${run.stderr ?? ""}` };
+  const run = spawnSync("git", args, { maxBuffer: Infinity, cwd: root, encoding: "utf8" });
+  return { code: run.status ?? -1, stdout: run.stdout ?? "" };
 };
 var defaultRef = (root) => git(root, ["rev-parse", "--verify", "--quiet", DEFAULT_REF]).code === 0 ? DEFAULT_REF : void 0;
 var numbersAt = (root, ref, path) => {
@@ -142,7 +199,7 @@ var numbersAt = (root, ref, path) => {
   if (shown.code !== 0) return void 0;
   let parsed;
   try {
-    parsed = JSON.parse(shown.output);
+    parsed = JSON.parse(shown.stdout);
   } catch {
     return void 0;
   }
@@ -196,8 +253,8 @@ var checkBaseline = ({ ref, root }) => {
 };
 
 // src/deployed.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
 var DEPLOYED_FILE = ".geonosis/deployed.json";
 var NOT_WRITTEN = "no .geonosis/deployed.json \u2014 it is written by the pipeline after promote, and its absence is not a pass";
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -283,19 +340,11 @@ var differences = (kind, declared, deployed) => {
     ...extra.length === 0 ? [] : [`deployed but not declared ${kind}: ${extra.join(", ")}`]
   ];
 };
-var releaseOf = (root) => {
-  const path = join2(root, "geonosis.json");
-  if (!existsSync(path)) return void 0;
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return isRecord(parsed) && isRecord(parsed["release"]) ? parsed["release"] : {};
-  } catch {
-    return {};
-  }
-};
 var checkDeployed = ({ root }) => {
-  const release = releaseOf(root);
-  if (release === void 0) return [];
+  const read = readGeonosisFile(root);
+  if (read.kind === "absent") return [];
+  if (read.kind === "unreadable") return [unreadableGeonosis("deployed", read.error)];
+  const release = isRecord(read.config["release"]) ? read.config["release"] : {};
   const configs = listOf(release["wrangler"]);
   const secrets = listOf(release["secrets"]);
   if (configs.length === 0 && secrets.length === 0) {
@@ -312,7 +361,7 @@ var checkDeployed = ({ root }) => {
   for (const relative of configs) {
     let parsed;
     try {
-      parsed = parseJsonc(readFileSync2(join2(root, relative), "utf8"));
+      parsed = parseJsonc(readFileSync3(join4(root, relative), "utf8"));
     } catch (error) {
       return [finding2("FAIL", relative, `could not be read: ${error.message}`)];
     }
@@ -324,11 +373,11 @@ var checkDeployed = ({ root }) => {
     declared.crons.push(...one.crons);
     declared.routes.push(...one.routes);
   }
-  const path = join2(root, DEPLOYED_FILE);
-  if (!existsSync(path)) return [finding2("SKIP", DEPLOYED_FILE, NOT_WRITTEN)];
+  const path = join4(root, DEPLOYED_FILE);
+  if (!existsSync2(path)) return [finding2("SKIP", DEPLOYED_FILE, NOT_WRITTEN)];
   let reported;
   try {
-    reported = JSON.parse(readFileSync2(path, "utf8"));
+    reported = JSON.parse(readFileSync3(path, "utf8"));
   } catch (error) {
     return [finding2("FAIL", DEPLOYED_FILE, `is not readable JSON: ${error.message}`)];
   }
@@ -349,26 +398,10 @@ var checkDeployed = ({ root }) => {
   ];
 };
 
-// src/repo-corpus.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join3 } from "path";
-var GEONOSIS_FILE = "geonosis.json";
-var repoCorpusOf = (root) => {
-  const path = join3(root, GEONOSIS_FILE);
-  if (!existsSync2(path)) return void 0;
-  try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
-    const declared = parsed.doctor?.corpus;
-    return typeof declared === "string" && declared !== "" ? join3(root, declared) : void 0;
-  } catch {
-    return void 0;
-  }
-};
-
 // src/resolve.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync4, realpathSync as realpathSync2 } from "fs";
 import { createRequire } from "module";
-import { dirname, join as join4 } from "path";
+import { dirname, join as join5 } from "path";
 import { pathToFileURL } from "url";
 var packageNameOf = (specifier) => {
   const parts2 = specifier.split("/");
@@ -386,8 +419,8 @@ var aboveRootMessage = (specifier, foundAt) => `${specifier} is not installed he
 var aboveRoot = (root, name) => {
   let at = dirname(root);
   for (; ; ) {
-    const dir = join4(at, "node_modules", name);
-    if (existsSync3(join4(dir, "package.json"))) return dir;
+    const dir = join5(at, "node_modules", name);
+    if (existsSync3(join5(dir, "package.json"))) return dir;
     const parent = dirname(at);
     if (parent === at) return void 0;
     at = parent;
@@ -395,14 +428,14 @@ var aboveRoot = (root, name) => {
 };
 var resolveFrom = (dir, specifier, root) => {
   if (specifier.startsWith(".") || specifier.startsWith("/")) {
-    return createRequire(join4(dir, "noop.js")).resolve(specifier);
+    return createRequire(join5(dir, "noop.js")).resolve(specifier);
   }
   const name = packageNameOf(specifier);
   let at = dir;
   let reachedRoot = false;
   for (; ; ) {
-    if (existsSync3(join4(at, "node_modules", name, "package.json"))) {
-      return createRequire(join4(at, "noop.js")).resolve(specifier);
+    if (existsSync3(join5(at, "node_modules", name, "package.json"))) {
+      return createRequire(join5(at, "noop.js")).resolve(specifier);
     }
     if (at === root) {
       reachedRoot = true;
@@ -424,7 +457,7 @@ var resolveFrom = (dir, specifier, root) => {
 var packageDirOf = (entry, name) => {
   let dir = dirname(entry);
   for (; ; ) {
-    const manifest = join4(dir, "package.json");
+    const manifest = join5(dir, "package.json");
     if (existsSync3(manifest)) {
       try {
         const parsed = JSON.parse(readFileSync4(manifest, "utf8"));
@@ -500,23 +533,92 @@ var presumptionsOf = async (entry) => {
     )
   };
 };
-var corpusOfPlugin = (from, specifier, root) => join4(packageDirOf(resolveFrom(from, specifier, root), specifier), "corpus");
-var real = (path) => {
+var corpusOfPlugin = (from, specifier, root) => join5(packageDirOf(resolveFrom(from, specifier, root), specifier), "corpus");
+var real2 = (path) => {
   try {
-    return realpathSync(path);
+    return realpathSync2(path);
   } catch {
     return path;
   }
 };
-var relativeToRoot = (root, path) => relativePath(real(root), real(path));
+var relativeToRoot = (root, path) => relativePath(real2(root), real2(path));
 
 // src/group.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 
-// src/hooks.ts
+// src/callers.ts
 import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
-import { join as join5 } from "path";
+import { join as join6, resolve } from "path";
+var WORKFLOWS = ".github/workflows";
+var A_WORKFLOW = (name) => name.endsWith(".yml") || name.endsWith(".yaml");
+var readOr = (path) => {
+  try {
+    return readFileSync5(path, "utf8");
+  } catch {
+    return "";
+  }
+};
+var workflowSources = (root) => {
+  const dir = join6(root, WORKFLOWS);
+  if (!existsSync4(dir)) return [];
+  return readdirSync2(dir).filter(A_WORKFLOW).map((name) => readOr(join6(dir, name)));
+};
+var commandsOf = (step) => {
+  if (typeof step === "string") return [step];
+  if (typeof step !== "object" || step === null) return [];
+  const shape = step;
+  if (typeof shape.command === "string") return [shape.command];
+  if (Array.isArray(shape.parallel)) return shape.parallel.flatMap(commandsOf);
+  return [];
+};
+var declaredTiers = (root) => {
+  const read = readGeonosisFile(root);
+  if (read.kind !== "present") return { commands: [], names: [] };
+  const verify = read.config.verify;
+  if (typeof verify !== "object" || verify === null || Array.isArray(verify)) {
+    return { commands: [], names: [] };
+  }
+  const tiers = verify;
+  return {
+    commands: Object.values(tiers).flatMap(
+      (steps) => Array.isArray(steps) ? steps.flatMap(commandsOf) : []
+    ),
+    names: Object.keys(tiers)
+  };
+};
+var everythingRun = (root, workspaces) => {
+  const tiers = declaredTiers(root);
+  return {
+    run: [
+      ...tiers.commands,
+      ...workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {})),
+      ...(readRatchet(root)?.counters ?? []).map((entry) => String(entry.command ?? "")),
+      ...workflowSources(root)
+    ].join("\n"),
+    tiers: tiers.names
+  };
+};
+var A_SCRIPT_FILE = /\.(?:[cm]?[jt]sx?|sh|bash)$/;
+var scriptFilesNamedBy = (root, lines) => {
+  const seen = /* @__PURE__ */ new Set();
+  const found = [];
+  for (const line of lines) {
+    for (const token of line.split(/[\s'"`]+/)) {
+      if (!A_SCRIPT_FILE.test(token) || seen.has(token)) continue;
+      seen.add(token);
+      const path = resolve(root, token);
+      if (!path.startsWith(root) || !existsSync4(path)) continue;
+      const source = readOr(path);
+      if (source !== "") found.push({ at: token, source });
+    }
+  }
+  return found;
+};
+
+// src/hooks.ts
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
+import { join as join7 } from "path";
 var HOOK_FILES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"];
 var HOOK_DIRS = [".husky", ".githooks"];
 var VERSION_MANAGED = /(?:^|[\s;&|(])(?<runner>pnpm|npx|bunx|yarn)\b(?:\s+(?:exec|run|dlx|x))?\s+(?<bin>geonosis(?:-[a-z-]+)?)\b/;
@@ -525,20 +627,20 @@ var hookLines = (root) => {
   const found = [];
   const read = (path) => {
     const at = relativePath(root, path);
-    for (const line of readFileSync5(path, "utf8").split("\n")) {
+    for (const line of readFileSync6(path, "utf8").split("\n")) {
       if (line.trim() !== "") found.push({ at, line });
     }
   };
   for (const name of HOOK_FILES) {
-    const path = join5(root, name);
-    if (existsSync4(path)) read(path);
+    const path = join7(root, name);
+    if (existsSync5(path)) read(path);
   }
   for (const name of HOOK_DIRS) {
-    const dir = join5(root, name);
-    if (!existsSync4(dir)) continue;
-    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+    const dir = join7(root, name);
+    if (!existsSync5(dir)) continue;
+    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
       if (entry.isFile() && !entry.name.startsWith("_") && !entry.name.startsWith(".")) {
-        read(join5(dir, entry.name));
+        read(join7(dir, entry.name));
       }
     }
   }
@@ -571,16 +673,8 @@ var FIXED_GROUP = [
   "geonosis"
 ];
 var KIT_GROUP = { name: "@geonosis fixed group", packages: FIXED_GROUP };
-var declaredGroupsOf = (root) => {
-  const path = join6(root, GEONOSIS_FILE);
-  if (!existsSync5(path)) return void 0;
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync6(path, "utf8"));
-  } catch {
-    return void 0;
-  }
-  const declared = parsed.doctor?.groups;
+var groupsFrom = (config) => {
+  const declared = config.doctor?.groups;
   if (declared === void 0) return void 0;
   if (!Array.isArray(declared) || declared.length === 0) {
     throw new DoctorError(
@@ -597,6 +691,13 @@ var declaredGroupsOf = (root) => {
     return { name: group.name, packages: group.packages };
   });
 };
+var declaredGroupsOf = (root) => {
+  const read = readGeonosisFile(root);
+  if (read.kind === "unreadable") {
+    throw new DoctorError(`${GEONOSIS_FILE} could not be parsed: ${read.error}`);
+  }
+  return read.kind === "present" ? groupsFrom(read.config) : void 0;
+};
 var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
 var versionOf = (dir, name, root) => {
   let entry;
@@ -607,7 +708,7 @@ var versionOf = (dir, name, root) => {
   }
   try {
     const manifest = JSON.parse(
-      readFileSync6(join6(packageDirOf(entry, name), "package.json"), "utf8")
+      readFileSync7(join8(packageDirOf(entry, name), "package.json"), "utf8")
     );
     return typeof manifest.version === "string" ? { kind: "read", version: manifest.version } : { kind: "unreadable", why: "its package.json declares no version" };
   } catch (error) {
@@ -639,7 +740,7 @@ var DOORS = ["@geonosis/cli", "geonosis"];
 var manifestOf = (root, name) => {
   try {
     return JSON.parse(
-      readFileSync6(join6(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
+      readFileSync7(join8(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
     );
   } catch {
     return void 0;
@@ -649,17 +750,8 @@ var binNamesOf = (manifest, name) => {
   const declared = manifest?.bin;
   return typeof declared === "string" ? [name.replace(/^@[^/]+\//, "")] : Object.keys(declared ?? {});
 };
-var declaredIn2 = (manifest) => [
-  ...new Set(
-    [
-      manifest.dependencies,
-      manifest.devDependencies,
-      manifest.optionalDependencies,
-      manifest.peerDependencies
-    ].flatMap((block) => Object.keys(block ?? {}))
-  )
-];
-var calls = (lines, bin) => new RegExp(`(?:^|[\\s;&|(/])${bin}(?:\\s|$)`).test(lines);
+var declaredIn2 = (manifest) => [...dependencyNamesOf(manifest)];
+var calls = (lines, bin) => new RegExp(`(?:^|[\\s;&|(/'"\`])${bin}(?:[\\s;&|)'"\`,\\]]|$)`).test(lines);
 var workspaceCaller = (workspaces, bins) => {
   for (const workspace of workspaces) {
     if (workspace.relative === "") continue;
@@ -681,20 +773,25 @@ var rootDeclarations = (root, workspaces) => {
       return manifest === void 0 ? [] : Object.keys(manifest.dependencies ?? {});
     })
   );
-  const callers = [
+  const lines = [
     ...Object.values(here.manifest.scripts ?? {}),
-    ...hookLines(root).map((one) => one.line)
-  ].join("\n");
-  const loadedHere = new Set(readConfig(join6(root, CONFIG_FILE), root).jsPlugins);
-  const spare = declared.filter(
-    (name) => !DOORS.includes(name) && owned.has(name) && !loadedHere.has(name) && !binNamesOf(manifestOf(root, name), name).some((bin) => calls(callers, bin))
-  );
+    ...hookLines(root).map((one) => one.line),
+    ...workflowSources(root),
+    ...declaredTiers(root).commands
+  ];
+  const callers = [...lines, ...scriptFilesNamedBy(root, lines).map((one) => one.source)].join("\n");
+  const loadedHere = new Set(readConfig(join8(root, CONFIG_FILE), root).jsPlugins);
+  const spare = declared.filter((name) => {
+    if (DOORS.includes(name) || !owned.has(name) || loadedHere.has(name)) return false;
+    const bins = binNamesOf(manifestOf(root, name), name);
+    return bins.length > 0 && !bins.some((bin) => calls(callers, bin));
+  });
   if (spare.length === 0) {
     return [
       finding3(
         "package.json",
         "OK",
-        `every @geonosis package this root declares is ${door} or a bin its own scripts call by name`
+        `every @geonosis package this root declares is ${door} or a bin something here calls by name \u2014 a script, a hook, a script file they run, a workflow or a tier`
       )
     ];
   }
@@ -711,7 +808,7 @@ var rootDeclarations = (root, workspaces) => {
     return finding3(
       name,
       "WARN",
-      `the root declares it and no script in this repo calls its bin \u2014 ${door} already brings it, so this second declaration is a version that can disagree with the door's, and every tool that asks what is used here reads it as unused. Drop it from the root, or declare it in the workspace whose code imports it`
+      `the root declares it and nothing in this repo calls its bin \u2014 no root or workspace script, no committed hook, no script file those name, no CI workflow, no geonosis.json tier. ${door} already brings it, so this second declaration is a version that can disagree with the door's, and every tool that asks what is used here reads it as unused. Drop it from the root, or declare it in the workspace whose code imports it \u2014 and if something this check cannot see does call the bin, keep the declaration: under an isolated linker it is what links the bin into node_modules/.bin`
     );
   });
 };
@@ -721,8 +818,15 @@ var checkGroup = ({
   workspaces
 }) => {
   const findings = [...rootDeclarations(root, workspaces)];
-  for (const group of groups ?? [KIT_GROUP]) {
+  let resolved = groups;
+  if (resolved === void 0) {
+    const read = readGeonosisFile(root);
+    if (read.kind === "unreadable") return [...findings, unreadableGeonosis("group", read.error)];
+    resolved = read.kind === "present" ? declaredGroupsOf(root) : void 0;
+  }
+  for (const group of resolved ?? [KIT_GROUP]) {
     const found = [];
+    let halfway = false;
     for (const workspace of workspaces) {
       const at = labelOf(workspace);
       const here = [];
@@ -749,7 +853,10 @@ var checkGroup = ({
         }
       }
       const split2 = here.length > 0 ? perWorkspace(group, at, here) : void 0;
-      if (split2 !== void 0) findings.push(split2);
+      if (split2 !== void 0) {
+        findings.push(split2);
+        halfway = true;
+      }
       found.push(...here);
     }
     if (found.length === 0) {
@@ -771,7 +878,7 @@ var checkGroup = ({
       return line === void 0 ? [] : [line];
     });
     findings.push(...split);
-    if (split.length === 0) {
+    if (split.length === 0 && !halfway) {
       const versions = [...new Set(found.map((one) => one.version))];
       findings.push(
         finding3(
@@ -786,14 +893,15 @@ var checkGroup = ({
 };
 
 // src/drift.ts
-import { closeSync, existsSync as existsSync6, openSync, readdirSync as readdirSync3, readFileSync as readFileSync7, readSync } from "fs";
+import { closeSync, existsSync as existsSync6, openSync, readdirSync as readdirSync4, readFileSync as readFileSync8, readSync } from "fs";
 import { homedir } from "os";
-import { join as join7, sep as sep2 } from "path";
+import { join as join9, sep as sep3 } from "path";
 
 // src/overrides.ts
 var SPECIAL = /* @__PURE__ */ new Set(["$", "(", ")", "+", ".", "/", "@", "\\", "^", "|"]);
 var globToRegExp = (glob) => {
   let source = "";
+  let braces = 0;
   for (let at = 0; at < glob.length; at += 1) {
     const character = glob[at] ?? "";
     if (character === "*") {
@@ -816,13 +924,15 @@ var globToRegExp = (glob) => {
     }
     if (character === "{") {
       source += "(?:";
+      braces += 1;
       continue;
     }
-    if (character === "}") {
+    if (character === "}" && braces > 0) {
       source += ")";
+      braces -= 1;
       continue;
     }
-    if (character === ",") {
+    if (character === "," && braces > 0) {
       source += "|";
       continue;
     }
@@ -854,29 +964,27 @@ var governing = (layers, path) => {
 };
 
 // src/drift.ts
-var WORKFLOWS = ".github/workflows";
 var SETTINGS = ".claude/settings.json";
-var GEONOSIS = "geonosis.json";
 var LAW = "CLAUDE.md";
 var CEILING = 200;
 var SWITCHED_OFF = /^\s*if:\s*(?:\$\{\{\s*)?false\b/m;
 var finding4 = findingMaker("drift");
 var ci = (root) => {
-  const dir = join7(root, WORKFLOWS);
+  const dir = join9(root, WORKFLOWS);
   if (!existsSync6(dir)) {
     return [finding4(WORKFLOWS, "SKIP", "there are no workflows here to read")];
   }
   return filesUnder(dir, (name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((path) => {
     const at = relativePath(root, path);
-    return SWITCHED_OFF.test(readFileSync7(path, "utf8")) ? finding4(
+    return SWITCHED_OFF.test(readFileSync8(path, "utf8")) ? finding4(
       at,
       "FAIL",
       "a job or step here is switched off by a condition that can never be true \u2014 every gate downstream of it reports green having run nothing"
     ) : finding4(at, "OK", "nothing in it is switched off");
   });
 };
-var holds = (parent, child) => child === parent || child.startsWith(`${parent}${sep2}`);
-var ownersOf = (path, workspaces) => workspaces.filter((one) => holds(one.dir, path)).toSorted((a, b) => b.dir.length - a.dir.length);
+var holds2 = (parent, child) => child === parent || child.startsWith(`${parent}${sep3}`);
+var ownersOf = (path, workspaces) => workspaces.filter((one) => holds2(one.dir, path)).toSorted((a, b) => b.dir.length - a.dir.length);
 var orphanTests = (root, workspaces) => {
   const orphaned = /* @__PURE__ */ new Map();
   for (const path of testFilesUnder(root)) {
@@ -916,7 +1024,7 @@ var pathsRunByScript = (script) => script.split(BETWEEN_COMMANDS).map(pathRunBy)
 var scriptPaths = (workspaces) => {
   const missing = workspaces.flatMap(
     (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
-      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync6(join7(one.dir, path))).map((path) => ({ name, path, workspace: one }))
+      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync6(join9(one.dir, path))).map((path) => ({ name, path, workspace: one }))
     )
   );
   if (missing.length === 0) {
@@ -952,7 +1060,9 @@ var linkedBins = (root, workspaces) => {
   }
   const missing = workspaces.flatMap(
     (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
-      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter((name) => !existsSync6(join7(root, "node_modules/.bin", name))).map((name) => ({ name, script, workspace: one }))
+      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter(
+        (name) => !existsSync6(join9(one.dir, "node_modules/.bin", name)) && !existsSync6(join9(root, "node_modules/.bin", name))
+      ).map((name) => ({ name, script, workspace: one }))
     )
   );
   if (missing.length === 0) {
@@ -1018,21 +1128,6 @@ var markerIn = (path) => {
     closeSync(handle);
   }
 };
-var everythingRun = (root, workspaces) => {
-  const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
-  const counters = (readRatchet(root)?.counters ?? []).map((entry) => String(entry.command ?? ""));
-  const workflows = filesUnder(
-    join7(root, WORKFLOWS),
-    (name) => name.endsWith(".yml") || name.endsWith(".yaml")
-  ).map((path) => {
-    try {
-      return readFileSync7(path, "utf8");
-    } catch {
-      return "";
-    }
-  });
-  return [...scripts, ...counters, ...workflows].join("\n");
-};
 var generatedFiles = (root, workspaces) => {
   const marked = filesUnder(root, (name) => CAN_CARRY_A_MARKER.test(name)).map((path) => ({ marker: markerIn(path), path })).filter((one) => one.marker !== void 0);
   if (marked.length === 0) {
@@ -1044,7 +1139,7 @@ var generatedFiles = (root, workspaces) => {
       )
     ];
   }
-  const run = everythingRun(root, workspaces);
+  const { run } = everythingRun(root, workspaces);
   return marked.map(({ marker, path }) => {
     const at = relativePath(root, path);
     if ("writes" in marker) {
@@ -1064,27 +1159,18 @@ var generatedFiles = (root, workspaces) => {
     return run.includes(marker.gate) ? finding4(at, "OK", `generated, and \`${marker.gate}\` reads it back`) : finding4(
       at,
       "FAIL",
-      `generated, and nothing here runs \`${marker.gate}\` \u2014 the gate it names. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Add \`${marker.gate}\` to a script, a counter or a workflow`
+      `generated, and nothing here runs \`${marker.gate}\` \u2014 the gate it names. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Add \`${marker.gate}\` to a script, a verify tier, a counter or a workflow`
     );
   });
 };
-var readGeonosis = (root) => {
-  const path = join7(root, GEONOSIS);
-  if (!existsSync6(path)) return void 0;
-  try {
-    return JSON.parse(readFileSync7(path, "utf8"));
-  } catch {
-    return void 0;
-  }
-};
 var law = (root, config) => {
   const declared = config?.law ?? {};
   const file = typeof declared.file === "string" ? declared.file : LAW;
-  const path = join7(root, file);
+  const path = join9(root, file);
   if (!existsSync6(path)) {
     return [finding4(file, "SKIP", "there is no law file here to measure")];
   }
-  const source = readFileSync7(path, "utf8");
+  const source = readFileSync8(path, "utf8");
   const lines = source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
   if (typeof declared.maxLines !== "number") {
     return [
@@ -1108,7 +1194,7 @@ var KIT_PLUGIN = "geonosis";
 var enablesKit = (path) => {
   if (!existsSync6(path)) return false;
   try {
-    const parsed = JSON.parse(readFileSync7(path, "utf8"));
+    const parsed = JSON.parse(readFileSync8(path, "utf8"));
     const enabled = parsed.enabledPlugins;
     if (typeof enabled !== "object" || enabled === null) return false;
     return Object.entries(enabled).some(
@@ -1119,7 +1205,7 @@ var enablesKit = (path) => {
   }
 };
 var hooks = (root, userSettings) => {
-  const path = join7(root, SETTINGS);
+  const path = join9(root, SETTINGS);
   if (enablesKit(path)) {
     return [finding4(SETTINGS, "OK", `\`enabledPlugins\` here enables the kit\u2019s plugin`)];
   }
@@ -1142,9 +1228,9 @@ var hooks = (root, userSettings) => {
 };
 var ALLOW_BUILDS_KEY = "allowBuilds";
 var allowedBuilds = (root) => {
-  const path = join7(root, WORKSPACE_YAML);
+  const path = join9(root, WORKSPACE_YAML);
   if (!existsSync6(path)) return void 0;
-  const lines = readFileSync7(path, "utf8").split("\n");
+  const lines = readFileSync8(path, "utf8").split("\n");
   const at = lines.findIndex((line) => new RegExp(`^${ALLOW_BUILDS_KEY}\\s*:`).test(line));
   if (at < 0) return void 0;
   const names = [];
@@ -1158,7 +1244,10 @@ var allowedBuilds = (root) => {
   return names;
 };
 var PLATFORM = /(?:^|[-/])(?:darwin|linux|win32|windows|freebsd|openbsd|android|sunos)(?:[-.]|$)|(?:^|[-/])(?:arm64|x64|ia32|ppc64|s390x|riscv64)(?:[-.]|$)/;
-var familyOf = (name) => name.split("/").slice(0, -1).join("/") || name;
+var familyOf = (name) => {
+  const at = name.search(PLATFORM);
+  return at > 0 ? name.slice(0, at) : name;
+};
 var platformSplitBuilds = (root) => {
   const names = allowedBuilds(root);
   if (names === void 0 || names.length === 0) return [];
@@ -1195,7 +1284,7 @@ var pathsLintedBy = (script, dir) => {
     if (word.startsWith("-")) continue;
     const before = words[at - 1] ?? "";
     if (TAKES_A_VALUE.has(before)) continue;
-    if (existsSync6(join7(dir, word))) named2.push(word.replace(/^\.\//, "").replace(/\/$/, ""));
+    if (existsSync6(join9(dir, word))) named2.push(word.replace(/^\.\//, "").replace(/\/$/, ""));
   }
   return named2;
 };
@@ -1203,12 +1292,12 @@ var LINTABLE = /\.[cm]?[jt]sx?$/;
 var sourceDirsIn = (dir) => {
   let entries;
   try {
-    entries = readdirSync3(dir, { withFileTypes: true });
+    entries = readdirSync4(dir, { withFileTypes: true });
   } catch {
     return [];
   }
   return entries.filter(
-    (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NEVER_WALKED.has(entry.name) && filesUnder(join7(dir, entry.name), (name) => LINTABLE.test(name)).length > 0
+    (entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NEVER_WALKED.has(entry.name) && filesUnder(join9(dir, entry.name), (name) => LINTABLE.test(name)).length > 0
   ).map((entry) => entry.name);
 };
 var lintScopes = (root, workspaces) => {
@@ -1248,7 +1337,6 @@ var OBSERVABILITY = "@geonosis/observability";
 var COMPOSITION_ROOT = "src/platform.ts";
 var FLOOR_PACKAGES = [
   "@geonosis/assistant",
-  "@geonosis/buketi-ui",
   "@geonosis/conformance",
   "@geonosis/db",
   "@geonosis/document",
@@ -1262,6 +1350,7 @@ var FLOOR_PACKAGES = [
   "@geonosis/plans",
   "@geonosis/recurring",
   "@geonosis/search",
+  "@geonosis/storefront-ui",
   "@geonosis/ui",
   "@geonosis/workflows"
 ];
@@ -1298,7 +1387,7 @@ var composedHere = (root, workspaces) => {
   for (const path of filesUnder(root, (name) => SOURCE_FILE.test(name))) {
     let body;
     try {
-      body = readFileSync7(path, "utf8");
+      body = readFileSync8(path, "utf8");
     } catch {
       continue;
     }
@@ -1333,8 +1422,8 @@ var doorBringing = (root, name, declared) => DOORS.filter((door) => declared.has
 var dependenciesOf = (root, name) => {
   try {
     return JSON.parse(
-      readFileSync7(
-        join7(packageDirOf(resolveFrom(root, name, root), name), "package.json"),
+      readFileSync8(
+        join9(packageDirOf(resolveFrom(root, name, root), name), "package.json"),
         "utf8"
       )
     ).dependencies ?? {};
@@ -1350,21 +1439,12 @@ var resolves = (root, name) => {
     return false;
   }
 };
-var declaredAnywhere = (workspaces) => new Set(
-  workspaces.flatMap(
-    (one) => [
-      one.manifest.dependencies,
-      one.manifest.devDependencies,
-      one.manifest.optionalDependencies,
-      one.manifest.peerDependencies
-    ].flatMap((field) => Object.keys(field ?? {}))
-  )
-);
+var declaredAnywhere = (workspaces) => new Set(workspaces.flatMap((one) => [...dependencyNamesOf(one.manifest)]));
 var blocks = (root, config, readers, workspaces) => {
   if (config === void 0) {
     return [
       finding4(
-        GEONOSIS,
+        GEONOSIS_FILE,
         "SKIP",
         "there is no geonosis.json here, so no block says what this repo asks the kit to do"
       )
@@ -1437,7 +1517,7 @@ var pluginDirsOf = (level) => {
   return { manifests: options.manifests ?? ["index.ts"], registry, roots: options.roots };
 };
 var pluginDirLayers = (root) => {
-  const path = join7(root, ".oxlintrc.json");
+  const path = join9(root, ".oxlintrc.json");
   if (!existsSync6(path)) return [];
   const layers = [];
   for (const layer of layersOf(readConfig(path, root), PLUGIN_DIR_RULE)) {
@@ -1447,8 +1527,8 @@ var pluginDirLayers = (root) => {
   return layers;
 };
 var layerOver = (layers, root, relative) => {
-  const at = join7(root, relative);
-  const inside = readdirSync3(at, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => `${relative}/${entry.name}`);
+  const at = join9(root, relative);
+  const inside = readdirSync4(at, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => `${relative}/${entry.name}`);
   const paths = inside.length === 0 ? [relative] : inside;
   const wrapped = layers.map((layer) => ({ files: layer.files, level: layer.dirs }));
   for (const path of paths) {
@@ -1469,7 +1549,7 @@ var pluginDirs = (root) => {
     ];
   }
   const missing = [...new Set(layers.flatMap((layer) => layer.dirs.registry))].filter(
-    (registry) => !existsSync6(join7(root, registry))
+    (registry) => !existsSync6(join9(root, registry))
   );
   if (missing.length > 0) {
     return missing.map(
@@ -1479,17 +1559,17 @@ var pluginDirs = (root) => {
   const source = /* @__PURE__ */ new Map();
   const unreachable = /* @__PURE__ */ new Map();
   for (const rootDir of new Set(layers.flatMap((layer) => layer.dirs.roots))) {
-    const at = join7(root, rootDir);
+    const at = join9(root, rootDir);
     if (!existsSync6(at)) continue;
-    for (const entry of readdirSync3(at, { withFileTypes: true })) {
+    for (const entry of readdirSync4(at, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const relative = `${rootDir}/${entry.name}`;
       const governs = layerOver(layers, root, relative);
       if (governs === void 0) continue;
       const key = governs.registry.join(", ");
-      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync7(join7(root, half), "utf8")).join("\n");
+      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync8(join9(root, half), "utf8")).join("\n");
       source.set(key, registry);
-      const hasManifest = governs.manifests.some((name) => existsSync6(join7(at, entry.name, name)));
+      const hasManifest = governs.manifests.some((name) => existsSync6(join9(at, entry.name, name)));
       if (!hasManifest || registry.includes(entry.name)) continue;
       unreachable.set(key, [...unreachable.get(key) ?? [], relative]);
     }
@@ -1505,11 +1585,57 @@ var pluginDirs = (root) => {
 };
 var WORKSPACE_YAML = "pnpm-workspace.yaml";
 var HOIST_KEY = "publicHoistPattern";
+var pnpmMajorOf = (manifest) => {
+  const packageManager = manifest["packageManager"];
+  const pinned = typeof packageManager === "string" ? /^pnpm@(\d+)[\d.]*/.exec(packageManager) : null;
+  if (pinned?.[1] !== void 0) return { major: Number(pinned[1]), said: packageManager };
+  const engine = manifest["engines"]?.["pnpm"];
+  const ranged = typeof engine === "string" ? /(\d+)/.exec(engine) : null;
+  if (ranged?.[1] !== void 0) return { major: Number(ranged[1]), said: `engines.pnpm ${engine}` };
+  return void 0;
+};
+var pnpmBlock = (root) => {
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync8(join9(root, "package.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  const block = manifest["pnpm"];
+  if (typeof block !== "object" || block === null || Array.isArray(block)) return [];
+  const keys = Object.keys(block).map((key) => `pnpm.${key}`);
+  if (keys.length === 0) return [];
+  const pinned = pnpmMajorOf(manifest);
+  const named2 = keys.join(", ");
+  const move = `Move each key to ${WORKSPACE_YAML} (\`overrides:\` at the top level), then ${HOIST_REPAIR} \u2014 a plain install answers "Already up to date" over the old tree.`;
+  if (pinned === void 0) {
+    return [
+      finding4(
+        "package.json",
+        "WARN",
+        `it has a pnpm block (${named2}) and nothing here pins pnpm \u2014 pnpm \u226511 does not read that block at all, so whether these settings apply depends on whichever pnpm is on the machine. ${move}`
+      )
+    ];
+  }
+  return pinned.major >= 11 ? [
+    finding4(
+      "package.json",
+      "FAIL",
+      `it has a pnpm block (${named2}) that pnpm \u226511 does not read, and this repo pins ${pinned.said}: every key in it is silently ignored, and the install still says "Already up to date". ${move}`
+    )
+  ] : [
+    finding4(
+      "package.json",
+      "OK",
+      `its pnpm block (${named2}) is read by the ${pinned.said} pinned here; pnpm 11 stops reading it, so move it to ${WORKSPACE_YAML} before that bump`
+    )
+  ];
+};
 var HOIST_REPAIR = "rm -rf node_modules/.modules.yaml node_modules/.pnpm-workspace-state-v1.json && pnpm install";
 var hoistPatterns = (root) => {
-  const path = join7(root, WORKSPACE_YAML);
+  const path = join9(root, WORKSPACE_YAML);
   if (!existsSync6(path)) return void 0;
-  const lines = readFileSync7(path, "utf8").split("\n");
+  const lines = readFileSync8(path, "utf8").split("\n");
   const at = lines.findIndex((line) => new RegExp(`^${HOIST_KEY}\\s*:`).test(line));
   if (at < 0) return void 0;
   const patterns = [];
@@ -1546,7 +1672,7 @@ var publicHoists = (root, workspaces) => {
         `this ${HOIST_KEY} matches no workspace package here, so what it should have linked at the root is a question this cannot answer`
       );
     }
-    const pruned = hoisted.filter((name) => !existsSync6(join7(root, "node_modules", name)));
+    const pruned = hoisted.filter((name) => !existsSync6(join9(root, "node_modules", name)));
     if (pruned.length === 0) {
       return finding4(
         pattern,
@@ -1564,11 +1690,13 @@ var publicHoists = (root, workspaces) => {
 var checkDrift = ({
   readers = READERS,
   root,
-  userSettings = join7(homedir(), SETTINGS),
+  userSettings = join9(homedir(), SETTINGS),
   workspaces
 }) => {
-  const config = readGeonosis(root);
+  const read = readGeonosisFile(root);
+  const config = read.kind === "present" ? read.config : void 0;
   return [
+    ...read.kind === "unreadable" ? [unreadableGeonosis("drift", read.error)] : [],
     ...ci(root),
     ...orphanTests(root, workspaces),
     ...scriptPaths(workspaces),
@@ -1577,15 +1705,53 @@ var checkDrift = ({
     ...generatedFiles(root, workspaces),
     ...pluginDirs(root),
     ...publicHoists(root, workspaces),
+    ...pnpmBlock(root),
     ...composedHere(root, workspaces),
     ...lintScopes(root, workspaces),
     ...platformSplitBuilds(root),
     ...law(root, config),
     ...hooks(root, userSettings),
-    ...blocks(root, config, readers, workspaces)
+    ...read.kind === "unreadable" ? [] : blocks(root, config, readers, workspaces)
   ];
 };
 
+// src/missing-option.ts
+import { pathToFileURL as pathToFileURL2 } from "url";
+var HEADER = /requires option `([^`]+)`/;
+var missingOption = (said2) => {
+  const named2 = said2.option;
+  if (typeof named2 === "string") return named2;
+  const message = said2.message ?? said2.message;
+  return HEADER.exec(String(message))?.[1];
+};
+var PROGRAM = {
+  body: [],
+  loc: { end: { column: 0, line: 1 }, start: { column: 0, line: 1 } },
+  range: [0, 0],
+  type: "Program"
+};
+var missingOptionOf = (rule, options) => {
+  const reported = [];
+  let visitor;
+  try {
+    visitor = rule.create({ options, report: (said2) => reported.push(said2) });
+  } catch (error) {
+    return missingOption(error);
+  }
+  const program = visitor?.Program;
+  if (typeof program !== "function") return void 0;
+  try {
+    program(PROGRAM);
+  } catch {
+    return void 0;
+  }
+  return reported.map(missingOption).find((option) => option !== void 0);
+};
+var constructibleRulesOf = async (entry) => {
+  const loaded = await import(pathToFileURL2(entry).href).catch(() => void 0);
+  return loaded?.default?.rules;
+};
+
 // src/exercised.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import {
@@ -1593,12 +1759,12 @@ import {
   existsSync as existsSync7,
   mkdirSync,
   mkdtempSync,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   rmSync,
   writeFileSync
 } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname2, join as join8, resolve } from "path";
+import { dirname as dirname2, join as join10, resolve as resolve2 } from "path";
 import { corpusOf, readManifest } from "@geonosis/lint-parity";
 
 // src/rule-level.ts
@@ -1615,9 +1781,9 @@ var refusal = (error) => {
   return said2.length > LIMIT ? `${said2.slice(0, LIMIT)}\u2026` : said2;
 };
 var reasonFrom = (config, oxlint) => {
-  const dir = mkdtempSync(join8(tmpdir(), "geonosis-doctor-why-"));
+  const dir = mkdtempSync(join10(tmpdir(), "geonosis-doctor-why-"));
   try {
-    const probe = join8(dir, "probe.tsx");
+    const probe = join10(dir, "probe.tsx");
     writeFileSync(probe, "export const probe = 1\n");
     const run = spawnSync2(
       oxlint,
@@ -1679,6 +1845,18 @@ var enablingLayersOf = (config, rule) => {
   return layers;
 };
 var under = (config, rule) => `${rule} under ${optionSetsOf(config, rule).map((options) => JSON.stringify(options)).join(" / ")}`;
+var unconfiguredOf = async (config, entry, enabled) => {
+  const rules = await constructibleRulesOf(entry);
+  if (rules === void 0) return [];
+  const found = [];
+  for (const id of enabled) {
+    const rule = rules[id.slice(id.indexOf("/") + 1)];
+    if (rule === void 0) continue;
+    const option = enablingLayersOf(config, id).map((layer) => missingOptionOf(rule, [...layer.options])).find((one) => one !== void 0);
+    if (option !== void 0) found.push([id, option]);
+  }
+  return found;
+};
 var enabledHere = (config, plugin) => [
   .../* @__PURE__ */ new Set([
     ...enabledRulesOf(config.rules, plugin),
@@ -1709,8 +1887,8 @@ var throughProbes = ({
 }) => {
   const refused = /* @__PURE__ */ new Map();
   const placed = /* @__PURE__ */ new Set();
-  const dir = mkdtempSync(join8(tmpdir(), "geonosis-doctor-probe-"));
-  const here = join8(dir, "corpus");
+  const dir = mkdtempSync(join10(tmpdir(), "geonosis-doctor-probe-"));
+  const here = join10(dir, "corpus");
   try {
     cpSync(corpus, here, { recursive: true });
     for (const rule of silent) {
@@ -1747,7 +1925,7 @@ var throughProbes = ({
             mounted = rehomed;
           }
           for (const file of mounted) {
-            const at2 = join8(here, file.path);
+            const at2 = join10(here, file.path);
             if (placed.has(at2)) continue;
             placed.add(at2);
             mkdirSync(dirname2(at2), { recursive: true });
@@ -1760,26 +1938,32 @@ var throughProbes = ({
         refused.set(rule, String(error.message));
       }
     }
-    const probeConfig = JSON.parse(readFileSync8(config.path, "utf8"));
+    const probeConfig = JSON.parse(readFileSync9(config.path, "utf8"));
     const configDir = dirname2(config.path);
     probeConfig.jsPlugins = (probeConfig.jsPlugins ?? []).map(
-      (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve(configDir, spec) : packageDirOf(resolveFrom(configDir, spec, root), spec)
+      (spec) => spec.startsWith(".") || spec.startsWith("/") ? resolve2(configDir, spec) : packageDirOf(resolveFrom(configDir, spec, root), spec)
     );
-    const at = join8(here, ".oxlintrc-geonosis-probe.json");
+    const at = join10(here, ".oxlintrc-geonosis-probe.json");
     writeFileSync(at, JSON.stringify(probeConfig, null, 2));
     const run = spawnSync2(
       oxlint,
       ["-c", at, "--format", "json", "--no-ignore", "--disable-nested-config", here],
       { cwd: dir, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
     );
-    const fired = /* @__PURE__ */ new Set();
+    if (run.error !== void 0) throw new Error(`oxlint could not start: ${run.error.message}`);
+    const said2 = `${run.stdout ?? ""}${run.stderr ?? ""}`.trim().slice(0, LIMIT);
+    let parsed;
     try {
-      const parsed = JSON.parse(run.stdout || "{}");
-      for (const one of parsed.diagnostics ?? []) {
-        const renamed = /^([\w@./-]+)\((.+)\)$/.exec(one.code ?? "");
-        if (renamed !== null) fired.add(`${renamed[1]}/${renamed[2]}`);
-      }
+      parsed = JSON.parse(run.stdout);
     } catch {
+      throw new Error(
+        `oxlint exited ${run.status ?? -1} over the probes, printing ${said2 || "nothing"}`
+      );
+    }
+    const fired = /* @__PURE__ */ new Set();
+    for (const one of parsed.diagnostics ?? []) {
+      const renamed = /^([\w@./-]+)\((.+)\)$/.exec(one.code ?? "");
+      if (renamed !== null) fired.add(`${renamed[1]}/${renamed[2]}`);
     }
     return { fired, refused };
   } finally {
@@ -1826,6 +2010,16 @@ var checkExercised = async ({
   if (enabled.length === 0) {
     return retired.length === 0 ? said2("SKIP", `no ${manifest.plugin} rule is enabled here`) : said2("WARN", `nothing enabled here is a live ${manifest.plugin} rule`);
   }
+  const unconfigured = entry === void 0 ? [] : await unconfiguredOf(config, entry, enabled);
+  if (unconfigured.length > 0) {
+    return said2(
+      "FAIL",
+      `${countOf(
+        unconfigured.map(([rule]) => rule),
+        "judge"
+      )} nothing \u2014 enabled without the option each requires, so its only finding is the refusal, which is not reach: ${unconfigured.map(([rule, option]) => `${rule} (\`${option}\`)`).join(", ")}`
+    );
+  }
   let reach;
   try {
     reach = corpusOf({ configA: config.path, configB: config.path, corpus, oxlint }).reach;
@@ -1904,8 +2098,8 @@ var checkExercised = async ({
 };
 
 // src/envelope.ts
-import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync5, readFileSync as readFileSync10 } from "fs";
+import { join as join11 } from "path";
 var ENVELOPES_DIR = ".geonosis/envelopes";
 var THIS_TOOL = "doctor";
 var OWN = `${THIS_TOOL}.json`;
@@ -1963,14 +2157,14 @@ var judge = (subject, name, parsed) => {
   );
 };
 var checkEnvelopes = ({ root }) => {
-  const dir = join9(root, ENVELOPES_DIR);
-  const files = existsSync8(dir) ? readdirSync4(dir).filter((name) => name.endsWith(".json") && name !== OWN).toSorted() : [];
+  const dir = join11(root, ENVELOPES_DIR);
+  const files = existsSync8(dir) ? readdirSync5(dir).filter((name) => name.endsWith(".json") && name !== OWN).toSorted() : [];
   if (files.length === 0) return [finding6("SKIP", ENVELOPES_DIR, NO_ENVELOPES)];
   return files.map((name) => {
     const subject = `${ENVELOPES_DIR}/${name}`;
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync9(join9(dir, name), "utf8"));
+      parsed = JSON.parse(readFileSync10(join11(dir, name), "utf8"));
     } catch (error) {
       return finding6("FAIL", subject, `is not readable JSON: ${error.message}. ${NEXT}`);
     }
@@ -1979,8 +2173,8 @@ var checkEnvelopes = ({ root }) => {
 };
 
 // src/exams.ts
-import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname3, join as join10 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname3, join as join12 } from "path";
 var SCOPE = "@geonosis/";
 var EXAM = /(?:^|[^$\w])([$\w]*Conformance)\b/g;
 var finding7 = findingMaker("exams");
@@ -2001,12 +2195,12 @@ var declaredBy = (workspaces) => {
       }
     }
   }
-  return [...found].map(([name, from]) => ({ from, name })).toSorted((a, b) => a.name.localeCompare(b.name));
+  return [...found].map(([name, from]) => ({ from, name })).toSorted((a, b) => a.name.localeCompare(b.name, "en-US"));
 };
 var declarationsOf = (dir) => {
-  const at = join10(dir, "package.json");
+  const at = join12(dir, "package.json");
   if (!existsSync9(at)) return "";
-  const manifest = JSON.parse(readFileSync10(at, "utf8"));
+  const manifest = JSON.parse(readFileSync11(at, "utf8"));
   const entries = [];
   const walk2 = (value) => {
     if (typeof value === "string" && value.endsWith(".d.ts")) entries.push(value);
@@ -2017,7 +2211,7 @@ var declarationsOf = (dir) => {
   walk2({ exports: manifest["exports"], types: manifest["types"] });
   return [...new Set(entries)].map((entry) => {
     try {
-      return readFileSync10(join10(dir, entry), "utf8");
+      return readFileSync11(join12(dir, entry), "utf8");
     } catch {
       return "";
     }
@@ -2026,8 +2220,8 @@ var declarationsOf = (dir) => {
 var installedAt = (from, name, root) => {
   let at = from;
   for (; ; ) {
-    const dir = join10(at, "node_modules", name);
-    if (existsSync9(join10(dir, "package.json"))) return dir;
+    const dir = join12(at, "node_modules", name);
+    if (existsSync9(join12(dir, "package.json"))) return dir;
     if (at === root) return void 0;
     const up = dirname3(at);
     if (up === at) return void 0;
@@ -2043,7 +2237,7 @@ var checkExams = ({
   root,
   workspaces
 }) => {
-  const tests = testFilesUnder(root).map((path) => ({ path, source: readFileSync10(path, "utf8") }));
+  const tests = testFilesUnder(root).map((path) => ({ path, source: readFileSync11(path, "utf8") }));
   const found = [];
   for (const { from, name } of declaredBy(workspaces)) {
     const exams = examsShippedBy(from, name, root);
@@ -2069,65 +2263,125 @@ var checkExams = ({
 };
 
 // src/claude-plugin.ts
-import { existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync12, realpathSync as realpathSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join11 } from "path";
+import { join as join13, resolve as resolve3 } from "path";
 var INSTALLED_PLUGINS = ".claude/plugins/installed_plugins.json";
 var PLUGIN_NAME = "geonosis";
-var installedPluginVersions = (home, name) => {
-  const at = join11(home, INSTALLED_PLUGINS);
+var USER_SCOPE = "user";
+var installedPlugins = (home, name) => {
+  const at = join13(home, INSTALLED_PLUGINS);
   if (!existsSync10(at)) return [];
   let record;
   try {
-    record = JSON.parse(readFileSync11(at, "utf8"));
+    record = JSON.parse(readFileSync12(at, "utf8"));
   } catch {
     return [];
   }
-  return Object.entries(record.plugins ?? {}).filter(([key]) => (key.split("@")[0] ?? key) === name).flatMap(([, value]) => Array.isArray(value) ? value : []).flatMap((one) => typeof one.version === "string" ? [one.version] : []);
+  return Object.entries(record.plugins ?? {}).filter(([key]) => (key.split("@")[0] ?? key) === name).flatMap(([, value]) => Array.isArray(value) ? value : []).flatMap(
+    (one) => typeof one.version === "string" ? [
+      {
+        ...typeof one.projectPath === "string" ? { projectPath: one.projectPath } : {},
+        ...typeof one.scope === "string" ? { scope: one.scope } : {},
+        version: one.version
+      }
+    ] : []
+  );
+};
+var installedPluginVersions = (home, name) => installedPlugins(home, name).map((one) => one.version);
+var real3 = (path) => {
+  try {
+    return realpathSync3(path);
+  } catch {
+    return resolve3(path);
+  }
+};
+var RELEASE = /^v?(\d+)\.(\d+)\.(\d+)/;
+var isAhead = (installed, train) => {
+  const mine = RELEASE.exec(installed);
+  const theirs = RELEASE.exec(train);
+  if (mine === null || theirs === null) return false;
+  for (let at = 1; at <= 3; at += 1) {
+    const step = Number(mine[at]) - Number(theirs[at]);
+    if (step !== 0) return step > 0;
+  }
+  return false;
+};
+var isUserScope = (one) => one.scope === void 0 || one.scope === USER_SCOPE;
+var loadedAt = (installs, root) => {
+  const here = real3(root);
+  const scopedHere = installs.filter(
+    (one) => !isUserScope(one) && one.projectPath !== void 0 && real3(one.projectPath) === here
+  );
+  return scopedHere.length > 0 ? scopedHere : installs.filter(isUserScope);
 };
 var checkClaudePlugin = ({
   candidate = false,
   home = homedir2(),
   name = PLUGIN_NAME,
+  root,
   train
 }) => {
   if (train === void 0) return [];
-  const installed = installedPluginVersions(home, name);
+  const subject = `${name} (Claude plugin)`;
+  const installed = installedPlugins(home, name);
   if (installed.length === 0) {
     return [
       {
         check: "loaded",
         message: `this machine has no "${name}" plugin installed, so none of this release's hooks, agents or skills is loaded in any session here \u2014 a bump moved the packages and nothing moved them. Install it, or say out loud that this repo runs without the plugin`,
-        subject: `${name} (Claude plugin)`,
+        subject,
         verdict: "WARN"
       }
     ];
   }
-  const drifted = installed.filter((one) => one !== train);
+  const loaded = root === void 0 ? installed.filter(isUserScope) : loadedAt(installed, root);
+  if (loaded.length === 0) {
+    const elsewhere = installed.map((one) => `${one.version} for ${one.projectPath ?? "an unnamed project"}`).join(", ");
+    return [
+      {
+        check: "loaded",
+        message: `the "${name}" plugin is installed only at project scope for other paths (${elsewhere}), so no session opened here loads it \u2014 none of this release's hooks, agents or skills runs in this repo. Install it at user scope, or for this project`,
+        subject,
+        verdict: "WARN"
+      }
+    ];
+  }
+  const drifted = loaded.filter((one) => one.version !== train).map((one) => one.version);
   if (drifted.length === 0) return [];
   if (candidate) {
     return [
       {
         check: "loaded",
         message: `the packages here are ${train}, a candidate the registry does not have, and the plugin is ${drifted.join(", ")} \u2014 the marketplace is where \`claude plugin update\` looks, so the plugin CANNOT follow a candidate and this is not drift. It becomes a real question the moment ${train} publishes`,
-        subject: `${name} (Claude plugin)`,
+        subject,
         verdict: "OK"
       }
     ];
   }
+  if (drifted.every((one) => isAhead(one, train))) {
+    return [
+      {
+        check: "loaded",
+        message: `the installed plugin is ${drifted.join(", ")} and the packages here are ${train} \u2014 the plugin is ahead, so its hooks, agents and skills can name commands and flags these packages do not have yet. Bump the packages to it, or install the plugin at ${train}`,
+        subject,
+        verdict: "WARN"
+      }
+    ];
+  }
   return [
     {
       check: "loaded",
       message: `the installed plugin is ${drifted.join(", ")} and the packages here are ${train} \u2014 the plugin carries the hooks, the agents and the skills, and it moves on \`claude plugin update\`, never on an install. Every session in this repo is running the older ones`,
-      subject: `${name} (Claude plugin)`,
+      subject,
       verdict: "WARN"
     }
   ];
 };
 
 // src/loaded.ts
-import { readFileSync as readFileSync12 } from "fs";
-import { join as join12, sep as sep3 } from "path";
+import { readFileSync as readFileSync13 } from "fs";
+import { join as join14, sep as sep4 } from "path";
 var SCOPE2 = "@geonosis/";
 var NOT_THE_SCOPE_DIRECTORY = "Deleting only the scope directory inside that node_modules is a repair no pnpm install undoes \u2014 the tree is then missing the package and every install stays green.";
 var BLOCKS = [
@@ -2136,7 +2390,7 @@ var BLOCKS = [
   "optionalDependencies",
   "peerDependencies"
 ];
-var RELEASE = /^v?(\d+)\.(\d+)\.(\d+)$/;
+var RELEASE2 = /^v?(\d+)\.(\d+)\.(\d+)$/;
 var PINNED = /^[=v]?(\d+\.\d+\.\d+(?:[-+][\w.-]+)?)$/;
 var RANGE = /^(\^|~|>=)\s*v?(\d+)\.(\d+)\.(\d+)$/;
 var LINKED = /^(?:file|link|portal|workspace):/;
@@ -2162,7 +2416,7 @@ var satisfies = (version, spec) => {
     const pinned = PINNED.exec(wanted);
     return pinned === null ? void 0 : pinned[1] === version.replace(/^v/, "");
   }
-  const here = RELEASE.exec(version);
+  const here = RELEASE2.exec(version);
   if (here === null) return void 0;
   const at = parts(here);
   const bound = [
@@ -2184,14 +2438,14 @@ var specIn = (manifest, specifier) => {
   }
   return void 0;
 };
-var holds2 = (parent, child) => child === parent || child.startsWith(`${parent}${sep3}`);
+var holds3 = (parent, child) => child === parent || child.startsWith(`${parent}${sep4}`);
 var manifestNameOf = (workspace) => workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`;
 var declaredFor = ({
   dir,
   specifier,
   workspaces
 }) => {
-  const upwards = workspaces.filter((one) => holds2(one.dir, dir)).toSorted((a, b) => b.dir.length - a.dir.length);
+  const upwards = workspaces.filter((one) => holds3(one.dir, dir)).toSorted((a, b) => b.dir.length - a.dir.length);
   for (const workspace of upwards) {
     const spec = specIn(workspace.manifest, specifier);
     if (spec !== void 0) return { at: manifestNameOf(workspace), spec };
@@ -2236,7 +2490,7 @@ var oneConfig = async ({
   }
   return held ? said2("OK", `loaded ${loaded.version} = declared ${declared.spec} (${declared.at})`) : said2(
     "FAIL",
-    `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}. Run \`geonosis update --to ${declared.spec}\`: it removes the WHOLE node_modules of every non-root workspace carrying one, never the root's, and reinstalls. ${NOT_THE_SCOPE_DIRECTORY} The linter is not running what the tree declares until then`
+    `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}. Run \`geonosis update --to ${declared.spec.replace(/^(?:\^|~|>=|=)\s*v?/, "")}\`: it removes the WHOLE node_modules of every non-root workspace carrying one, never the root's, and reinstalls. ${NOT_THE_SCOPE_DIRECTORY} The linter is not running what the tree declares until then`
   );
 };
 var labelOf2 = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
@@ -2275,7 +2529,7 @@ var shipperOf = (root, bin) => {
   const name = bin === "geonosis" ? "@geonosis/cli" : `@geonosis/${bin.replace(/^geonosis-/, "")}`;
   try {
     const manifest = JSON.parse(
-      readFileSync12(join12(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
+      readFileSync13(join14(packageDirOf(resolveFrom(root, name, root), name), "package.json"), "utf8")
     );
     const declared = manifest.bin;
     return typeof declared === "object" && !Object.hasOwn(declared, bin) ? "" : name;
@@ -2365,6 +2619,7 @@ var checkLoaded = async ({
     ...checkClaudePlugin({
       candidate: installedFromCandidate(workspaces),
       home,
+      root,
       train: await trainVersion(root, [...specifiers])
     })
   );
@@ -2382,56 +2637,47 @@ var trainVersion = async (root, specifiers) => {
 };
 
 // src/observability.ts
-import { readFileSync as readFileSync13 } from "fs";
-import { join as join13 } from "path";
-var GEONOSIS_FILE2 = "geonosis.json";
+import { readFileSync as readFileSync14 } from "fs";
+import { join as join15 } from "path";
 var REACHES_NOTHING = /* @__PURE__ */ new Set(["console", "memory", "noop", "none", "null", "swallowing"]);
 var DEFAULT_MAX_AGE_SECONDS = 3600;
 var HEAD_TIMEOUT_MS = 3e3;
 var make3 = findingMaker("observability");
 var finding9 = (verdict, subject, message) => make3(subject, verdict, message);
-var readGeonosis2 = (root) => {
-  let text;
-  try {
-    text = readFileSync13(join13(root, GEONOSIS_FILE2), "utf8");
-  } catch {
+var readGeonosis = (root) => {
+  const read = readGeonosisFile(root);
+  if (read.kind === "unreadable") return { error: read.error, present: false };
+  if (read.kind === "absent") return { present: false };
+  const block = read.config.observability;
+  if (typeof block !== "object" || block === null || Array.isArray(block)) {
     return { present: false };
   }
-  try {
-    const parsed = JSON.parse(text);
-    const block = parsed.observability;
-    if (typeof block !== "object" || block === null || Array.isArray(block)) {
-      return { present: false };
-    }
-    return { config: block, present: true };
-  } catch (error) {
-    return { error: error.message, present: false };
-  }
+  return { config: block, present: true };
 };
 var exporterFinding = (config) => {
   const sink = config.sink;
   if (typeof sink !== "string" || sink.trim() === "") {
     return finding9(
       "FAIL",
-      GEONOSIS_FILE2,
+      GEONOSIS_FILE,
       "observability.sink is not set, so nothing here says where errors are supposed to go \u2014 and a repo that cannot name its exporter has not got one"
     );
   }
   if (REACHES_NOTHING.has(sink.toLowerCase())) {
     return finding9(
       "WARN",
-      GEONOSIS_FILE2,
+      GEONOSIS_FILE,
       `the configured sink is "${sink}", which answers ok and reaches nothing. Correct in a dev tree; in a deployed one it is the instrument that cannot fail.`
     );
   }
-  return finding9("OK", GEONOSIS_FILE2, `the configured sink is "${sink}"`);
+  return finding9("OK", GEONOSIS_FILE, `the configured sink is "${sink}"`);
 };
 var reachableFinding = async (config) => {
   const endpoint = config.endpoint;
   if (typeof endpoint !== "string" || endpoint.trim() === "") {
     return finding9(
       "SKIP",
-      GEONOSIS_FILE2,
+      GEONOSIS_FILE,
       "no observability.endpoint was named, so whether the exporter is reachable was not asked"
     );
   }
@@ -2441,32 +2687,41 @@ var reachableFinding = async (config) => {
     const response = await fetch(endpoint, { method: "HEAD", signal: controller.signal });
     return finding9(
       "OK",
-      GEONOSIS_FILE2,
+      GEONOSIS_FILE,
       `${endpoint} is reachable \u2014 it answered ${response.status} to a HEAD`
     );
   } catch (error) {
     return finding9(
       "FAIL",
-      GEONOSIS_FILE2,
+      GEONOSIS_FILE,
       `${endpoint} is not reachable from here: ${error.message}. Every report this repo sends is going into that.`
     );
   } finally {
     clearTimeout(timer);
   }
 };
+var reachesNothing = (config) => typeof config.sink === "string" && REACHES_NOTHING.has(config.sink.toLowerCase()) ? config.sink : void 0;
 var ageFinding = (config, root, now) => {
   const file = config.lastEventFile;
+  const dead = reachesNothing(config);
+  if (dead !== void 0) {
+    return finding9(
+      "SKIP",
+      GEONOSIS_FILE,
+      `the sink is "${dead}", which reaches nothing, so the age of its last event says when this checkout last ran, not whether anything was delivered \u2014 not judged. Point a real sink here and it will be.`
+    );
+  }
   if (typeof file !== "string" || file.trim() === "") {
     return finding9(
       "SKIP",
-      GEONOSIS_FILE2,
+      GEONOSIS_FILE,
       "no observability.lastEventFile was configured, so when the last event arrived is not a question anything here can answer. Have the sink write { at, id, sink } on every capture and name the file."
     );
   }
   const maxAgeSeconds = typeof config.maxAgeSeconds === "number" && config.maxAgeSeconds > 0 ? config.maxAgeSeconds : DEFAULT_MAX_AGE_SECONDS;
   let record;
   try {
-    record = JSON.parse(readFileSync13(join13(root, file), "utf8"));
+    record = JSON.parse(readFileSync14(join15(root, file), "utf8"));
   } catch (error) {
     return finding9(
       "FAIL",
@@ -2494,19 +2749,27 @@ var ageFinding = (config, root, now) => {
 };
 var probeFinding = (config) => {
   const probe = config.probe;
+  const dead = reachesNothing(config);
+  if (dead !== void 0) {
+    return finding9(
+      "SKIP",
+      GEONOSIS_FILE,
+      `the sink is "${dead}", which reaches nothing, so no probe can prove a report reached it \u2014 not asked`
+    );
+  }
   if (typeof probe === "string" && probe.trim() !== "") {
-    return finding9("OK", GEONOSIS_FILE2, `the probe that proves this exporter is "${probe}"`);
+    return finding9("OK", GEONOSIS_FILE, `the probe that proves this exporter is "${probe}"`);
   }
   if (typeof config.lastEventFile === "string" && config.lastEventFile.trim() !== "") {
     return finding9(
       "OK",
-      GEONOSIS_FILE2,
+      GEONOSIS_FILE,
       "no probe command, but a last event file is read above, so something does look at this exporter"
     );
   }
   return finding9(
     "WARN",
-    GEONOSIS_FILE2,
+    GEONOSIS_FILE,
     "neither observability.probe nor observability.lastEventFile is configured, so nothing in this repo has ever established that a report reaches the sink. Name a probe command \u2014 the doctor reports it, your gate runs it."
   );
 };
@@ -2514,13 +2777,13 @@ var checkObservability = async ({
   now,
   root
 }) => {
-  const read = readGeonosis2(root);
+  const read = readGeonosis(root);
   if (read.error !== void 0) {
     return [
       finding9(
         "FAIL",
-        GEONOSIS_FILE2,
-        `${GEONOSIS_FILE2} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
+        GEONOSIS_FILE,
+        `${GEONOSIS_FILE} could not be parsed: ${read.error}. A config nobody can read has not been read, and every question below would have been answered from a default nobody chose.`
       )
     ];
   }
@@ -2528,8 +2791,8 @@ var checkObservability = async ({
     return [
       finding9(
         "SKIP",
-        GEONOSIS_FILE2,
-        `no observability block in ${GEONOSIS_FILE2}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
+        GEONOSIS_FILE,
+        `no observability block in ${GEONOSIS_FILE}, so nothing here knows where this repo sends its errors. Add { sink, endpoint, lastEventFile | probe, maxAgeSeconds } to have this asked.`
       )
     ];
   }
@@ -2542,19 +2805,77 @@ var checkObservability = async ({
   ];
 };
 
+// src/repo-corpus.ts
+import { join as join16 } from "path";
+var corpusFrom = (config, root) => {
+  const declared = config.doctor?.corpus;
+  return typeof declared === "string" && declared !== "" ? join16(root, declared) : void 0;
+};
+var repoCorpusOf = (root) => {
+  const read = readGeonosisFile(root);
+  if (read.kind === "unreadable") {
+    throw new DoctorError(`${GEONOSIS_FILE} could not be parsed: ${read.error}`);
+  }
+  return read.kind === "present" ? corpusFrom(read.config, root) : void 0;
+};
+
+// src/required-options.ts
+import { pathToFileURL as pathToFileURL3 } from "url";
+var optionsOf2 = (level) => Array.isArray(level) ? level.slice(1) : [];
+var refusesBare = (rule) => missingOptionOf(rule, []) !== void 0;
+var configured = (config, namespace) => [config.rules, ...config.overrides.map((one) => one.rules)].flatMap(
+  (rules) => enabledRulesOf(rules, namespace).map((id) => [id, optionsOf2(rules[id])])
+);
+var checkRequiredOptions = async ({
+  config,
+  entry
+}) => {
+  const loaded = await import(pathToFileURL3(entry).href).catch(() => void 0);
+  const namespace = loaded?.default?.meta?.name;
+  const rules = loaded?.default?.rules;
+  if (typeof namespace !== "string" || namespace === "" || rules === void 0) return [];
+  const enabled = configured(config, namespace);
+  if (enabled.length === 0) return [];
+  const missing = [];
+  const said2 = /* @__PURE__ */ new Set();
+  const gated = /* @__PURE__ */ new Set();
+  for (const [id, options] of enabled) {
+    const rule = rules[id.slice(namespace.length + 1)];
+    if (rule === void 0) continue;
+    if (refusesBare(rule)) gated.add(id);
+    const option = missingOptionOf(rule, options);
+    if (option === void 0 || said2.has(`${id} ${option}`)) continue;
+    said2.add(`${id} ${option}`);
+    missing.push({
+      check: "loaded",
+      message: `it is enabled here with no \`${option}\`, and the rule cannot judge a file without one \u2014 every run reports only that it is missing, and nothing about the tree. Configure \`${option}\`, or turn the rule off`,
+      subject: `${config.relative} \u2192 ${id}`,
+      verdict: "FAIL"
+    });
+  }
+  if (missing.length > 0) return missing;
+  return [
+    {
+      check: "loaded",
+      message: gated.size === 1 ? "1 rule requires options, 1 carries them" : `${gated.size} rules require options, ${gated.size} carry them`,
+      subject: config.relative,
+      verdict: "OK"
+    }
+  ];
+};
+
 // src/runner.ts
-import { existsSync as existsSync11, readdirSync as readdirSync5, readFileSync as readFileSync14 } from "fs";
-import { join as join14, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync15 } from "fs";
+import { resolve as resolve4 } from "path";
 var TEST_FAILURES = "testFailures";
 var RUNS_A_RUNNER = /(?:^|[\s;&|(])(?:npx\s+|bunx\s+|pnpm\s+(?:exec\s+)?)?(?:vitest|bun\s+test)(?:\s|$)/;
 var RUNS_BUN_TEST = /(?:^|[\s;&|(])(?:bunx\s+)?bun\s+test(?:\s|$)/;
 var OUTPUT_FILE = /--outputFile[= ](\S+)/i;
-var A_SCRIPT_FILE = /\.(?:[cm]?[jt]sx?|sh|bash)$/;
 var wrapperNamedBy = (script, dir) => {
   for (const token of script.split(/[\s'"]+/)) {
     if (!A_SCRIPT_FILE.test(token)) continue;
     try {
-      return { source: readFileSync14(resolve2(dir, token), "utf8"), where: token };
+      return { source: readFileSync15(resolve4(dir, token), "utf8"), where: token };
     } catch {
       continue;
     }
@@ -2579,34 +2900,13 @@ var reportingCounters = (ratchet) => (ratchet?.counters ?? []).filter(
 var keyOf = (entry) => stringOf(entry.key) === "" ? TEST_FAILURES : stringOf(entry.key);
 var namesReport = (entry, path) => stringOf(entry.reportPath) === path || stringOf(entry.command).includes(path);
 var PROVES = /--prove\b/;
-var everythingRun2 = (root, workspaces) => {
-  const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
-  const dir = join14(root, ".github/workflows");
-  const workflows = (existsSync11(dir) ? readdirSync5(dir) : []).filter((name) => name.endsWith(".yml") || name.endsWith(".yaml")).map((name) => {
-    try {
-      return readFileSync14(join14(dir, name), "utf8");
-    } catch {
-      return "";
-    }
-  });
-  let tiers = {};
-  try {
-    const config = JSON.parse(readFileSync14(join14(root, "geonosis.json"), "utf8"));
-    tiers = config.verify ?? {};
-  } catch {
-  }
-  return {
-    run: [...Object.values(tiers).flat(), ...scripts, ...workflows].join("\n"),
-    tiers: Object.keys(tiers)
-  };
-};
 var proveIsWired = ({
   ratchet,
   root,
   workspaces
 }) => {
   if (ratchet === void 0 || ratchet.counters.length === 0) return [];
-  const { run, tiers } = everythingRun2(root, workspaces);
+  const { run, tiers } = everythingRun(root, workspaces);
   if (PROVES.test(run)) {
     return [
       finding10(
@@ -2690,33 +2990,31 @@ var checkRunner = ({
 
 // src/doctor.ts
 import { homedir as homedir3 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 import { resolveOxlint } from "@geonosis/lint-parity";
 
 // src/engine.ts
-import { sep as sep4 } from "path";
-var declaredIn3 = (manifest) => new Set(
-  [
-    manifest.dependencies,
-    manifest.devDependencies,
-    manifest.optionalDependencies,
-    manifest.peerDependencies
-  ].flatMap((block) => Object.keys(block ?? {}))
-);
-var holds3 = (parent, child) => child === parent || child.startsWith(`${parent}${sep4}`);
+import { sep as sep5 } from "path";
+var holds4 = (parent, child) => child === parent || child.startsWith(`${parent}${sep5}`);
 var labelOf3 = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
-var governedBy = (dir, workspaces) => workspaces.filter((one) => holds3(one.dir, dir) || holds3(dir, one.dir));
-var enabledHere2 = (config, plugin) => [
-  .../* @__PURE__ */ new Set([
-    ...enabledRulesOf(config.rules, plugin),
-    ...config.overrides.flatMap((one) => enabledRulesOf(one.rules, plugin))
-  ])
-];
+var governedBy = (dir, workspaces) => workspaces.filter((one) => holds4(one.dir, dir) || holds4(dir, one.dir));
 var checkEngines = async ({
   config,
   entry,
+  evidence = [],
   workspaces
 }) => {
+  const holding = evidenceHolding(config, evidence);
+  if (holding !== void 0) {
+    return [
+      {
+        check: "exercised",
+        message: "evidence, not a product config \u2014 its directory is one this doctor reads as a corpus of planted files, so it is not asked which engine its manifests presume",
+        subject: config.relative,
+        verdict: "SKIP"
+      }
+    ];
+  }
   const plugin = await presumptionsOf(entry).catch(() => void 0);
   if (plugin === void 0 || plugin.namespace === "" || Object.keys(plugin.presumed).length === 0 && Object.keys(plugin.floors).length === 0) {
     return [];
@@ -2734,9 +3032,9 @@ var checkEngines = async ({
     ];
   };
   const governed = governedBy(config.dir, workspaces);
-  const declared = new Set(governed.flatMap((one) => [...declaredIn3(one.manifest)]));
+  const declared = new Set(governed.flatMap((one) => [...dependencyNamesOf(one.manifest)]));
   const asked = governed.map(labelOf3).join(", ");
-  return enabledHere2(config, plugin.namespace).flatMap((rule) => {
+  return enabledHere(config, plugin.namespace).flatMap((rule) => {
     const floorless = pending(rule);
     const presumes = plugin.presumed[rule.slice(plugin.namespace.length + 1)];
     if (presumes === void 0 || presumes.packages.some((name) => declared.has(name))) {
@@ -2754,26 +3052,53 @@ var checkEngines = async ({
   });
 };
 
-// src/path-grants.ts
-import { readdirSync as readdirSync6 } from "fs";
-import { join as join15 } from "path";
-var NEVER_WALKED2 = /* @__PURE__ */ new Set([".git", "coverage", "dist", "node_modules"]);
-var LINTABLE2 = /\.[cm]?[jt]sx?$/;
-var filesUnder2 = (root, at = "") => {
-  let entries;
-  try {
-    entries = readdirSync6(join15(root, at), { withFileTypes: true });
-  } catch {
-    return [];
+// src/formatter.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync11, readdirSync as readdirSync6 } from "fs";
+import { join as join17 } from "path";
+var KIT_RULES = ".claude/rules/geonosis";
+var finding11 = findingMaker("formatter");
+var ALL_PATHS_IGNORED = 2;
+var checkFormatter = ({ root }) => {
+  if (!existsSync11(join17(root, KIT_RULES))) {
+    return [
+      finding11(KIT_RULES, "SKIP", "no kit rules are installed here for a formatter to rewrite")
+    ];
   }
-  return entries.flatMap((entry) => {
-    const here = at === "" ? entry.name : `${at}/${entry.name}`;
-    if (entry.isDirectory()) {
-      return NEVER_WALKED2.has(entry.name) ? [] : filesUnder2(root, here);
-    }
-    return LINTABLE2.test(entry.name) ? [here] : [];
+  const oxfmt = join17(root, "node_modules/.bin/oxfmt");
+  if (!existsSync11(oxfmt)) {
+    return [finding11(KIT_RULES, "SKIP", "this repo has no oxfmt, the formatter the kit speaks for")];
+  }
+  const files = readdirSync6(join17(root, KIT_RULES)).filter((name) => name.endsWith(".md")).map((name) => join17(KIT_RULES, name));
+  const run = spawnSync3(oxfmt, ["--list-different", ...files], {
+    maxBuffer: Infinity,
+    cwd: root,
+    encoding: "utf8"
   });
+  const named2 = run.stdout.split("\n").filter((line) => files.includes(line.trim()));
+  if (run.status === ALL_PATHS_IGNORED && run.stderr.includes("excluded by ignore rules")) {
+    return [finding11(KIT_RULES, "OK", "oxfmt leaves the kit\u2019s rule files alone")];
+  }
+  if (run.status === 0 || run.status === 1 && named2.length > 0) {
+    return [
+      finding11(
+        KIT_RULES,
+        "WARN",
+        `oxfmt would format the kit's rule files, and the next \`format\` rewrites them \u2014 tiers.md is generated. Add "${KIT_RULES}" to the ignorePatterns in .oxfmtrc.json`
+      )
+    ];
+  }
+  return [
+    finding11(
+      KIT_RULES,
+      "UNJUDGED",
+      `oxfmt could not be asked (exit ${String(run.status)}): ${run.stderr.trim() || run.stdout.trim()}`
+    )
+  ];
 };
+
+// src/path-grants.ts
+var LINTABLE2 = /\.[cm]?[jt]sx?$/;
 var stringsOf2 = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
 var bagOf = (level) => {
   if (!Array.isArray(level)) return {};
@@ -2795,7 +3120,9 @@ var checkPathGrants = ({
 }) => {
   const declared = Object.entries(grants);
   if (declared.length === 0) return [];
-  const files = filesUnder2(root);
+  const files = filesUnder(root, (name) => LINTABLE2.test(name)).map(
+    (path) => relativePath(root, path)
+  );
   const found = [];
   for (const [id, grant] of declared) {
     for (const layer of layersOf(config, id)) {
@@ -2818,14 +3145,13 @@ var checkPathGrants = ({
 };
 
 // src/rails.ts
-import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
-import { join as join16 } from "path";
-var GEONOSIS2 = "geonosis.json";
+import { existsSync as existsSync12, readFileSync as readFileSync16 } from "fs";
+import { join as join18 } from "path";
 var PROJECT = ".claude/settings.json";
 var LOCAL = ".claude/settings.local.json";
 var RUN_RECORD = ".geonosis/rails-run.json";
 var managedSettingsPath = (platform = process.platform) => platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json" : "/etc/claude-code/managed-settings.json";
-var finding11 = findingMaker("rails");
+var finding12 = findingMaker("rails");
 var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var networkIn = (parsed) => {
   if (!isRecord3(parsed)) return void 0;
@@ -2843,7 +3169,7 @@ var sourceAt = (path, label) => {
   if (!existsSync12(path)) return { network: void 0, path: label, unreadable: false };
   try {
     return {
-      network: networkIn(JSON.parse(readFileSync15(path, "utf8"))),
+      network: networkIn(JSON.parse(readFileSync16(path, "utf8"))),
       path: label,
       unreadable: false
     };
@@ -2851,16 +3177,8 @@ var sourceAt = (path, label) => {
     return { network: void 0, path: label, unreadable: true };
   }
 };
-var declaredEgress = (root) => {
-  const at = join16(root, GEONOSIS2);
-  if (!existsSync12(at)) return void 0;
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync15(at, "utf8"));
-  } catch {
-    return void 0;
-  }
-  const egress = parsed?.rails?.egress;
+var declaredEgress = (config) => {
+  const egress = config.rails?.egress;
   if (!isRecord3(egress)) return void 0;
   const allow = egress["allow"];
   return {
@@ -2868,10 +3186,10 @@ var declaredEgress = (root) => {
   };
 };
 var deniedEgress = (root) => {
-  const at = join16(root, RUN_RECORD);
+  const at = join18(root, RUN_RECORD);
   if (!existsSync12(at)) {
     return [
-      finding11(
+      finding12(
         "deniedEgress",
         "SKIP",
         `there is no ${RUN_RECORD} here, so no run has been recorded for this to be a gate over`
@@ -2880,23 +3198,32 @@ var deniedEgress = (root) => {
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync15(at, "utf8"));
+    parsed = JSON.parse(readFileSync16(at, "utf8"));
   } catch (error) {
     return [
-      finding11(
+      finding12(
         "deniedEgress",
         "FAIL",
         `${RUN_RECORD} is not readable JSON (${error.message}) \u2014 a record nobody can read is not a record of zero denied attempts`
       )
     ];
   }
-  const denied = isRecord3(parsed) && Array.isArray(parsed["deniedEgress"]) ? parsed["deniedEgress"] : [];
+  if (!isRecord3(parsed) || !Array.isArray(parsed["deniedEgress"])) {
+    return [
+      finding12(
+        "deniedEgress",
+        "FAIL",
+        `${RUN_RECORD} lists no deniedEgress \u2014 a record that does not say what it records is not a record of zero denied attempts`
+      )
+    ];
+  }
+  const denied = parsed["deniedEgress"];
   if (denied.length === 0) {
-    return [finding11("deniedEgress", "OK", "no run recorded a denied egress attempt")];
+    return [finding12("deniedEgress", "OK", "no run recorded a denied egress attempt")];
   }
   const hosts = denied.map((one) => isRecord3(one) && typeof one["host"] === "string" ? one["host"] : "(unnamed)").join(", ");
   return [
-    finding11(
+    finding12(
       "deniedEgress",
       "FAIL",
       `${denied.length} denied egress attempt(s) in this run's record \u2014 ${hosts}. This is a gate at ZERO and never a counter to hold flat: a run that reached for a host this repo does not allow is a run somebody reads, whatever the number was yesterday`
@@ -2908,24 +3235,27 @@ var checkRails = ({
   root,
   userSettings
 }) => {
-  const declared = declaredEgress(root);
+  const read = readGeonosisFile(root);
+  if (read.kind === "unreadable") return [unreadableGeonosis("rails", read.error)];
+  const declared = read.kind === "absent" ? void 0 : declaredEgress(read.config);
   if (declared === void 0 || declared.allow.length === 0) {
     return [
-      finding11(
-        `${GEONOSIS2} \u2192 rails.egress`,
+      finding12(
+        `${GEONOSIS_FILE} \u2192 rails.egress`,
         "SKIP",
         "this repo declares no egress allowlist, so there is no rendered setting for this to read back"
-      )
+      ),
+      ...deniedEgress(root)
     ];
   }
   const sources = [
     sourceAt(managedSettings, managedSettings),
     sourceAt(userSettings, userSettings),
-    sourceAt(join16(root, PROJECT), PROJECT),
-    sourceAt(join16(root, LOCAL), LOCAL)
+    sourceAt(join18(root, PROJECT), PROJECT),
+    sourceAt(join18(root, LOCAL), LOCAL)
   ];
   const unreadable = sources.filter((one) => one.unreadable).map(
-    (one) => finding11(
+    (one) => finding12(
       one.path,
       "FAIL",
       "is not readable JSON, and Claude Code SILENTLY ignores a settings file that fails validation \u2014 every setting rendered into this file loads as nothing, with no error anywhere. Fix the file, then render the allowlist again"
@@ -2940,93 +3270,22 @@ var checkRails = ({
   return [
     ...unreadable,
     ...declared.allow.map(
-      (domain) => effective.has(domain) ? finding11(domain, "OK", "declared, and in the settings that actually load") : finding11(
+      (domain) => effective.has(domain) ? finding12(domain, "OK", "declared, and in the settings that actually load") : finding12(
         domain,
         "FAIL",
-        `declared in ${GEONOSIS2} \u2192 rails.egress and absent from every settings file that loads, so the run has no allowance for it.${why}`
+        `declared in ${GEONOSIS_FILE} \u2192 rails.egress and absent from every settings file that loads, so the run has no allowance for it.${why}`
       )
     ),
     ...deniedEgress(root)
   ];
 };
 
-// src/required-options.ts
-import { pathToFileURL as pathToFileURL2 } from "url";
-var HEADER = /requires option `([^`]+)`/;
-var optionsOf2 = (level) => Array.isArray(level) ? level.slice(1) : [];
-var missingOption = (error) => {
-  const named2 = error.option;
-  return typeof named2 === "string" ? named2 : HEADER.exec(String(error.message))?.[1];
-};
-var refusesBare = (rule) => {
-  try {
-    rule.create({ options: [], report: () => {
-    } });
-    return false;
-  } catch (error) {
-    return missingOption(error) !== void 0;
-  }
-};
-var configured = (config, namespace) => [config.rules, ...config.overrides.map((one) => one.rules)].flatMap(
-  (rules) => enabledRulesOf(rules, namespace).map((id) => [id, optionsOf2(rules[id])])
-);
-var checkRequiredOptions = async ({
-  config,
-  entry
-}) => {
-  const loaded = await import(pathToFileURL2(entry).href).catch(() => void 0);
-  const namespace = loaded?.default?.meta?.name;
-  const rules = loaded?.default?.rules;
-  if (typeof namespace !== "string" || namespace === "" || rules === void 0) return [];
-  const enabled = configured(config, namespace);
-  if (enabled.length === 0) return [];
-  const missing = [];
-  let gated = 0;
-  for (const [id, options] of enabled) {
-    const rule = rules[id.slice(namespace.length + 1)];
-    if (rule === void 0) continue;
-    if (refusesBare(rule)) gated += 1;
-    try {
-      rule.create({ options, report: () => {
-      } });
-    } catch (error) {
-      const option = missingOption(error);
-      if (option === void 0) continue;
-      missing.push({
-        check: "loaded",
-        message: `it is enabled here with no \`${option}\`, and the rule refuses to be constructed without one \u2014 oxlint stops the whole run at load, linting nothing. Configure \`${option}\`, or turn the rule off`,
-        subject: `${config.relative} \u2192 ${id}`,
-        verdict: "FAIL"
-      });
-    }
-  }
-  if (missing.length > 0) return missing;
-  return [
-    {
-      check: "loaded",
-      message: `${gated} rules require options, ${gated} carry them`,
-      subject: config.relative,
-      verdict: "OK"
-    }
-  ];
-};
-
 // src/seams.ts
-import { existsSync as existsSync13, globSync, readFileSync as readFileSync16 } from "fs";
-import { join as join17 } from "path";
-var CONFIG = "geonosis.json";
-var finding12 = findingMaker("seams");
-var NO_SEAMS = `${CONFIG} declares no adoption.seams \u2014 nothing here says which files hold a floor's shape, so no bump can measure what it deleted; declare them when a floor is adopted`;
-var declaredSeams = (root) => {
-  const at = join17(root, CONFIG);
-  if (!existsSync13(at)) return void 0;
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync16(at, "utf8"));
-  } catch {
-    return void 0;
-  }
-  const seams = parsed.adoption?.seams;
+import { globSync } from "fs";
+var finding13 = findingMaker("seams");
+var NO_SEAMS = `${GEONOSIS_FILE} declares no adoption.seams \u2014 nothing here says which files hold a floor's shape, so no bump can measure what it deleted; declare them when a floor is adopted`;
+var declaredSeams = (config) => {
+  const seams = config.adoption?.seams;
   return Array.isArray(seams) ? seams.filter((one) => typeof one === "string") : void 0;
 };
 var namesAFile = (root, glob) => globSync(glob, {
@@ -3034,25 +3293,32 @@ var namesAFile = (root, glob) => globSync(glob, {
   exclude: (name) => name === "node_modules" || name.startsWith("node_modules/")
 }).length > 0;
 var checkSeams = ({ root }) => {
-  const seams = declaredSeams(root);
-  if (seams === void 0 || seams.length === 0) return [finding12(CONFIG, "SKIP", NO_SEAMS)];
+  const read = readGeonosisFile(root);
+  if (read.kind === "unreadable") return [unreadableGeonosis("seams", read.error)];
+  const seams = read.kind === "absent" ? void 0 : declaredSeams(read.config);
+  if (seams === void 0 || seams.length === 0) return [finding13(GEONOSIS_FILE, "SKIP", NO_SEAMS)];
   const dead = seams.filter((glob) => !namesAFile(root, glob)).toSorted();
   if (dead.length === 0) {
     return [
-      finding12(CONFIG, "OK", `adoption.seams: ${seams.length} seam glob(s), every one names a file`)
+      finding13(
+        GEONOSIS_FILE,
+        "OK",
+        `adoption.seams: ${seams.length} seam glob(s), every one names a file`
+      )
     ];
   }
   return dead.map(
-    (glob) => finding12(
+    (glob) => finding13(
       glob,
       "WARN",
-      `names no file in this tree, so the seam measures nothing and every bump reads 0 deleted, 0 added over it. Next: take it out of adoption.seams in ${CONFIG}, or name the file that replaced it`
+      `names no file in this tree, so the seam measures nothing and every bump reads 0 deleted, 0 added over it. Next: take it out of adoption.seams in ${GEONOSIS_FILE}, or name the file that replaced it`
     )
   );
 };
 
 // src/doctor.ts
 var exercisedOf = ({
+  apparatus,
   configs,
   oxlint,
   repoCorpus,
@@ -3088,8 +3354,14 @@ var exercisedOf = ({
           root
         }),
         // #159: the rules whose engine this tree has not got. Beside the reach line rather than
-        // inside it — one is about the corpus, the other about this repo's own manifests.
-        checkEngines({ config, entry, workspaces })
+        // inside it — one is about the corpus, the other about this repo's own manifests. A
+        // config inside a corpus is evidence, not a product, and is not asked (row 585).
+        checkEngines({
+          config,
+          entry,
+          evidence: [corpus, ...repoCorpus === void 0 ? [] : [repoCorpus], ...apparatus],
+          workspaces
+        })
       ]);
       return [reach, ...engines, ...checkPathGrants({ config, grants, root })];
     })
@@ -3156,22 +3428,15 @@ var runDoctor = async ({
         ...await requiredOptionsOf(configs, root)
       ]
     ],
-    [
-      "group",
-      () => {
-        const declared = declaredGroupsOf(root);
-        return checkGroup({
-          ...declared === void 0 ? {} : { groups: declared },
-          root,
-          workspaces
-        });
-      }
-    ],
+    ["group", () => checkGroup({ root, workspaces })],
     [
       "exercised",
       () => {
+        const read = readGeonosisFile(root);
+        if (read.kind === "unreadable") return [unreadableGeonosis("exercised", read.error)];
         const repoCorpus = repoCorpusOf(root);
         return exercisedOf({
+          apparatus: declaredApparatusOf(root),
           configs,
           oxlint: oxlint ?? resolveOxlint(root),
           ...repoCorpus === void 0 ? {} : { repoCorpus },
@@ -3186,9 +3451,10 @@ var runDoctor = async ({
     ["observability", () => checkObservability({ now: Date.now(), root })],
     ["drift", () => checkDrift({ root, workspaces })],
     ["deployed", () => checkDeployed({ root })],
-    ["rails", () => checkRails({ root, userSettings: join18(home, USER_SETTINGS) })],
+    ["rails", () => checkRails({ root, userSettings: join19(home, USER_SETTINGS) })],
     ["exams", () => checkExams({ root, workspaces })],
-    ["seams", () => checkSeams({ root })]
+    ["seams", () => checkSeams({ root })],
+    ["formatter", () => checkFormatter({ root })]
   ];
   const collected = [];
   const ran = [];
@@ -3217,6 +3483,7 @@ var ABOUT = {
   exams: "every adopted floor has a test file that runs its exam",
   seams: "the seam globs adoption.seams declares each name a file",
   exercised: "every enabled rule fires on at least one corpus file",
+  formatter: "the formatter leaves the kit\u2019s installed rule files alone",
   group: "the packages published on one version resolve to one version",
   loaded: "the plugin oxlint would load is the one the manifest pins",
   observability: "an exporter is configured, reachable, and something arrived through it lately",
@@ -3249,6 +3516,12 @@ var formatJson = (report) => `${JSON.stringify(report, null, 2)}
 var ranOf = (findings) => new Set(findings.map((one) => one.check)).size;
 
 export {
+  CHECKS,
+  DoctorError,
+  GEONOSIS_FILE,
+  APPARATUS_KEY,
+  declaredApparatusOf,
+  evidenceHolding,
   CONFIG_FILE,
   MANIFEST_FILE,
   RATCHET_FILE,
@@ -3257,15 +3530,11 @@ export {
   discoverConfigs,
   discoverWorkspaces,
   readRatchet,
-  CHECKS,
-  DoctorError,
   defaultRef,
   checkBaseline,
   DEPLOYED_FILE,
   NOT_WRITTEN,
   checkDeployed,
-  GEONOSIS_FILE,
-  repoCorpusOf,
   resolveFrom,
   packageDirOf,
   pluginVersionOf,
@@ -3279,6 +3548,7 @@ export {
   FLOOR_PACKAGES,
   READERS,
   checkDrift,
+  missingOptionOf,
   enabledRulesOf,
   checkExercised,
   ENVELOPES_DIR,
@@ -3287,13 +3557,17 @@ export {
   checkExams,
   INSTALLED_PLUGINS,
   PLUGIN_NAME,
+  installedPlugins,
   installedPluginVersions,
+  loadedAt,
   checkClaudePlugin,
   SCOPE2 as SCOPE,
   satisfies,
   declaredFor,
   checkLoaded,
   checkObservability,
+  repoCorpusOf,
+  checkRequiredOptions,
   checkRunner,
   runDoctor,
   formatDoctor,