@geonosis/doctor 2.9.0 → 2.11.0

package/CHANGELOG.md

@@ -1,5 +1,234 @@
 # @geonosis/doctor
 
+## 2.11.0
+
+### Minor Changes
+
+- 0f99e26: A `formatter` check (#7): the repo's own oxfmt is asked whether it would rewrite the kit's rule files
+  under `.claude/rules/geonosis`. `oxfmt --migrate=prettier` writes `ignorePatterns: []`, and the
+  first `format` of a migrated repo rewrote the generated `tiers.md`. WARN names the ignore entry to
+  add; UNJUDGED when oxfmt could not be asked.
+- 0f99e26: Four rules see what they were blind to, and eleven readings refuse instead of banking a zero.
+  
+  `tissue-no-hooks` and `compound-must-be-stateless` report a hook called as a member —
+  `React.useState(0)`, `hooks.useCart()` — where they read only a bare name. `time-through-the-door`
+  sees the library through every import door (`export * from`, `import()`, `require()`), and
+  `subpath-over-barrel` reads `export { X } from '<root>'` as the import it is. Expect new findings on
+  a tree that spelled a hook through its default React import.
+  
+  `geonosis-ratchet`: a shell killed by a signal, a formatter that exited non-zero naming no file, a
+  `turbo boundaries` that printed no summary, a `geonosis.json` that will not parse, a stale report at
+  a named `reportPath`, and an oxlint run that answered in a shape `expectFormat` did not ask for are
+  each a `CounterError` now. Every one of them read as a number and lowered the baseline to it.
+  
+  `geonosis-doctor`: `deployed`, `seams`, `rails` and `drift` say FAIL over a `geonosis.json` that is
+  there and will not parse, where each had read it as a repo that declared nothing.
+- 0f99e26: An enabled rule missing its option reports ONE finding a run instead of throwing (D-084), and the
+  five rules that chose their files from paths compiled in read them from an option (#12).
+  
+  **The posture.** Up to 2.10.0 a rule enabled without an option it requires threw from `create()`.
+  Measured: the throw erased every other finding in the file it surfaced on, and rendered under
+  `--format=unix` as `:0:0:  [Warning]` naming nothing. It is a finding now — attributable, counted by
+  the ratchet, neighbours intact — reported once per run on the first file oxlint constructs the rule
+  for, with the same `biological-architecture/<rule> requires option \`<option>\`.` header. Nothing the
+  plugin exports throws for a missing option. Expect exactly one new finding per bare rule per run
+  where a run used to be refused whole.
+  
+  **#12 — four rules now REQUIRE a tree option; every config extending `backend-workflows` or
+  `tenant-scoping` must name it or gets the one finding above:**
+  
+  - `tables-declare-their-plane` requires `schema` (a regex over the filename: the schema tree);
+    `control/` and `tenant/` are read under it.
+  - `tenant-tables-carry-org-id` requires `tenant` (a regex: the tenant-plane schema tree).
+  - `queries-require-org-scope` requires `queries` (a regex: the query modules).
+  - `dialect-through-the-seam` requires `seam` (regex sources: the files that may name a dialect);
+    `exempt` defaults to the test paths (`__tests__/`, `.test.`, `.spec.`) — a repo whose test helpers
+    live elsewhere (`testing/`) names them.
+  
+  `no-d1-transaction` takes `transacts` and `except` (regex sources), both defaulting to nothing: the
+  plane the rule exempted was one repo's, and a D1-only repo has no plane to exempt. Expect new
+  findings on every `db.transaction()` that used to sit inside `/packages/db/(src|testing)/`.
+  
+  One consumer's values, verbatim, are in `proofs/issue-12-and-option-posture-2026-09-18.md`.
+  
+  `@geonosis/doctor`: `missingOptionOf` hears a refusal a rule reports as well as one it throws;
+  `exercised` no longer counts a bare rule's refusal finding as reach — it is a FAIL naming the option.
+  `@geonosis/cli`: `optionsNeededBy` reads through the same reader, so `init` still leaves those rules
+  out and names them.
+  
+  REFUSAL-IN-MINOR: **tables-declare-their-plane, tenant-tables-carry-org-id, queries-require-org-scope and dialect-through-the-seam** refuse a bare run where they did not at 2.10.0, which is a break and
+  would normally want a major. It ships in a minor by the owner's ruling of 2026-09-19, on a measured
+  basis: every consumer pins this kit EXACTLY — three consumers, at 2.10.0, 2.6.1 and 2.10.0, no
+  caret anywhere — so nothing auto-upgrades and the version number protects nobody here. The warning
+  lives in this changelog instead, and the two consumers that could be reached were told directly
+  before the cut. The third is three releases behind; it is the one that must be told by hand.
+- 0f99e26: Two defects the gates found (rows 576, 577) and five frictions one consumer measured (#1, #2, #5,
+  #9, #10), plus the stale-build guard every adopter-from-a-checkout hits.
+  
+  `geonosis-ratchet`: a red test suite is a reading again (row 576). The #18 crash detector ran
+  before a counter's `okExits` and refused every red suite — an `AssertionError` over frames, and
+  Node's trailer whenever a failing assertion quoted the child it ran — so `testFailures` refused
+  at the one moment it had something to say. A crash is now a STREAM whose last lines are a trace
+  (the runtime's trailer, or an error line over at-frames with nothing after), judged at any exit
+  code; a runner that quoted a trace and printed its summary after it is read. `node crash.mjs`
+  still refuses, and so does the same crash hidden behind a pipe's exit 0. And a file-set counter
+  names its offenders (#2): `unformattedFiles` cites the files it named, most recently modified
+  first, under a line that says so. The `evidence` hook receives `cwd`, and the report keeps a
+  counter's FIRST ten citations rather than the tail.
+  
+  `geonosis-doctor`: an `exercised` line per config lists the rules the plugin ships that the
+  config never mentions — absent, told apart from off (#5) — so a release's new rules are a list,
+  not an audit. Expect one new WARN on any config that leaves shipped rules unnamed. A `drift`
+  line reports a `pnpm` block in `package.json` that pnpm 11 does not read (#1): FAIL under a pin
+  of 11 or later, with the keys, the new home and the install repair. The observability age and
+  probe questions SKIP for a sink that reaches nothing (#10) instead of measuring how recently a
+  developer ran the app.
+  
+  `geonosis`: the update's restart line and the MCP skew refusal say the bins in
+  `node_modules/.bin` are already the new release (#9).
+  
+  Every kit bin's stale-build guard compares CONTENT, not only mtime: a checkout rewrites `src`
+  with the same content and the next `pnpm build` is a cache hit that leaves the current `dist`
+  untouched, so every bin refused with "run pnpm build" — the action that had just changed
+  nothing. Each shim keeps a digest of `src` from the last run that found `dist` current; a real
+  change still refuses, and the refusal names `pnpm build --force --filter=<package>`.
+
+### Patch Changes
+
+- 0f99e26: Row 549: `group`'s `declaredGroupsOf` and `exercised`'s `repoCorpusOf` each read `geonosis.json`
+  with their own `catch { return undefined }` — a parse error read as "this repo declares nothing",
+  so an unreadable `geonosis.json` declaring `doctor.groups` had the kit's own default group judged
+  in its place, and `exercised` silently ran without a repo's own reach corpus. Both now read through
+  `geonosis-file.ts`, the same reader `deployed`, `seams`, `rails` and `apparatus` already use, and
+  throw rather than answer `absent` on a file that cannot be parsed; `checkGroup` and the `exercised`
+  check turn that into their own FAIL line, so a corrupt `geonosis.json` no longer reads as a clean
+  tree in either check. `observability` carried a third, already-correct-but-separate reader of its
+  own; routed it through the same one.
+- 0f99e26: Every bin's stale-build guard now sees the workspace dependencies its build read. A `dist`
+  current against its own `src` could still have been built against an older dependency's `dist` —
+  literally, where tsup inlined a workspace devDependency into it — and a dependency whose own `src`
+  had moved past its `dist` was read stale by every bin above it; the guard answered "current" for
+  both. Now each shim holds every `workspace:` dependency, transitively, to the same reading as its
+  own package (never built, stale against its src, current), and refuses when this `dist` is older
+  than a dependency's — by content, so a dependency rebuilt to the same bytes with
+  `--force --filter` is the same build and does not poison the tree. Unknown is still stale: the
+  first run over a tree where a dependency was rebuilt alone, before any record, refuses once and
+  names `--force --filter=<this package>`. Only a checkout with `src/` beside `dist/` sees any of
+  this; the published package ships no `src/` and the guard is skipped. Measured: within noise for a
+  bin with one dependency, +8 ms for `geonosis`, which walks fourteen.
+- 0f99e26: Every bin's stale-build guard decides, and never throws. The digest guard's refusal read
+  `package.json` to name `pnpm build --force --filter=<name>`; over a checkout with no manifest
+  beside the bin it ended with exit 1 and a `node:fs` frame instead of exit 2 and a sentence. The
+  name is now a courtesy the refusal does without. The contract, stated: a source newer by mtime whose
+  content the bin saw beside a current dist is not stale; one whose content differs is, and the
+  refusal names the fix; one the bin has no record for is stale — unknown is stale; a missing dist is
+  "never built". Each is exit 2 with a sentence. Only a checkout with `src/` beside `dist/` sees any
+  of this; the published package ships no `src/` and the guard is skipped.
+- 0f99e26: `geonosis-doctor` no longer judges a rule-exercising config as though it governed a product. The
+  `exercised` engine line (#159) read the plugin's shipped corpus config and a fixture tree's config
+  and WARNed, eleven times each, that no manifest they govern declares Medusa — about a tree nobody
+  ships, burying the lines about the tree that is. A config inside a directory the doctor already
+  reads as evidence — the corpus the loaded plugin ships, the corpus `geonosis.json` names under
+  `doctor.corpus` — is apparatus, and gets one SKIP saying so instead. A fixture tree that is the
+  SOURCE of a corpus ships no manifest, so a repo names it under the new `doctor.apparatus` list;
+  the default is empty and every config in a repo that declares nothing is judged as before. A
+  product config beside a corpus is still judged in the same run.
+- 0f99e26: Four bugs a consumer filed against 2.10.0 (#13–#16).
+  
+  `no-void-port` takes `engineCallbacks` — regexes over an exported alias name, empty by default —
+  so a workflow-hook check the engine catches (`HookCheck<TInput> = (input, ctx) => Promise<void>`)
+  can be named as not a port; a `Result` there would never be read.
+  
+  `geonosis-doctor`: the Claude-plugin train is held only against the install that LOADS at the
+  doctored root (user scope, or a project scope naming that root), never another repo's; the
+  spare-declaration question reads the script files scripts and hooks run, CI workflows and
+  `geonosis.json` tiers, sees a bin quoted as an argv string, and says nothing about a package with
+  no bin. Expect four fewer WARNs on a root whose gate lives in a `.mjs`.
+  
+  `geonosis-mcp`: a server started before an in-session `geonosis update` refuses every call naming
+  the version it is running, the version the repo now has, and the restart (`/mcp` → reconnect) —
+  never the install. `geonosis update` ends by saying so where `.mcp.json` names a `geonosis` server.
+- 0f99e26: The kit names no consumer. Docs, doc comments and messages describe the repos a pattern was measured in by their stack (a Medusa storefront, a Workers + D1 app, a Mercur v1 marketplace). Example configs are named the same way: `examples/medusa-storefront.*.json`, `examples/workers-app.*.json`. No behaviour changes.
+- 0f99e26: Three defects a consumer measured against 2.10.0 (#17, #18, #19) and one this tree found.
+  
+  `geonosis-ratchet`: a counter's command that crashed is never a reading (#18). Every counter that
+  runs a tool declares the exit codes it reads — `[0, 1]` for a linter, `[0, 1, 2]` for tsc, `[0]`
+  where nothing is declared — and an entry may override them with `okExits`. Any other exit refuses
+  the counter, and so does a non-zero exit whose output is a Node stack trace, whatever the set says.
+  Before, a counter script that threw had its trace's line numbers summed as findings: reported as a
+  regression when they summed high, and BANKED as a shrink when they summed low — the baseline
+  rewritten to a number no measurement produced. Expect `CANNOT MEASURE` where a command exits with
+  a code its tool never uses for findings; declare `okExits` on that entry if the tool is right.
+  
+  `geonosis-doctor`, `geonosis`, `geonosis-release`, `geonosis-observability`: the bins set
+  `process.exitCode` and let the runtime drain instead of calling `process.exit()` after writing the
+  report (#17). Through a pipe on macOS, anything past 64 KiB was dropped with a clean exit code —
+  the doctor delivered 65,536 of 323,665 bytes, `release migrations` 50 locations for 51 warnings.
+  
+  The Claude plugin's Stop hook (#19): a cached fast-tier report is fresh only while the tree it was
+  judged over is still here, gitignored artifacts included — deleting a `playwright-report/` the
+  lint step had read now relaunches the tier instead of replaying the stale FAIL for ever. And a
+  replayed report says how many of its steps never ran, red or green.
+- 0f99e26: `geonosis-doctor --baseline-against <ref>` parses what `git show` printed on stdout alone. A warning
+  git writes to stderr on its way to a success — a ref name that is both a branch and a tag — was
+  read into the file, and a counter that had grown read as "no readable baseline", a SKIP.
+- 0f99e26: The `rails` check reads `.geonosis/rails-run.json` for denied egress attempts in a repo that allows
+  no egress at all. It returned before the record was read whenever no allowlist was declared, so the
+  deny-all repo — the one where a denied attempt matters most — never had its gate at zero asked.
+- 0f99e26: `deniedEgress` fails a run record that lists no `deniedEgress` array, as it already failed one that was not JSON: `{}` read as zero denied attempts, so a run able to write under `.geonosis/` could clear its own.
+- 0f99e26: An `overrides[].files` glob with a comma outside braces is read as the file name it is. The doctor
+  turned every comma into an alternation, so `src/a,b.ts` claimed `src/abc.ts`, and a stray `}` made
+  the pattern throw.
+- 0f99e26: The `group` check prints no OK line for a group whose members disagree inside a workspace. Beside
+  the FAIL naming the split it also said the group held, "at 1.1.0, 1.4.0, one copy each".
+- 0f99e26: `geonosis-doctor --help` says the envelope lists the registry's checks, twelve today, where it said
+  eleven; names observability and deployed where it said "the last two", which the exams and seams
+  checks had pushed down the list; and stops counting the rules only a repo's own corpus can answer.
+- 0f99e26: `drift` and `runner` read what a repo runs through one reader: scripts, `geonosis.json` verify
+  tiers, ratchet counters' commands and workflows. `drift` ignored the tiers, so a generated file
+  whose `geonosis:gated-by:` gate ran only from a verify tier was reported as a gate nothing runs.
+- 0f99e26: The path-grant line counts the files of this tree only. It walked into `.claude/worktrees/`,
+  `.turbo/` and every other dot-directory, counting a worktree's copy of the tree as more exempted
+  files and advising the repo to enumerate them.
+- 0f99e26: The `loaded` check says an installed Claude plugin NEWER than the packages is ahead of them — its
+  hooks and skills can name commands the packages do not have yet — instead of saying every session
+  runs the older hooks, which was the reverse of true.
+- 0f99e26: The `exercised` check says the declared probes could not be run, with what oxlint printed, when the
+  probe run dies or prints nothing it can read. It read such a run as "nothing fired", and FAILed
+  every probed rule as firing nowhere — blaming the rules for the instrument.
+- 0f99e26: The README documents every check the doctor runs — `group`, `envelope` and `rails` had no section —
+  and stops counting them ("seven questions", "the eleven checks"); a test holds a heading per check
+  to the registry. It names `--only` in the usage line, says what a bare option-gated rule does since
+  D-084, and describes `exams` per exam.
+- 0f99e26: The required-options line counts rules, not the layers that configure them: a rule enabled in the
+  base block and again in an override is one rule, and one FAIL when it lacks its option in both. It
+  also says `1 rule requires options, 1 carries them` rather than `1 rules require options`.
+- 0f99e26: `drift` reads an unscoped platform-split family — `turbo-darwin-arm64`, `turbo-linux-x64` — as one
+  family, `turbo`. It took everything before the last `/` as the family, so each unscoped platform
+  package was a family of one and an allow-list naming every platform was warned for each. A
+  `generated` file's FAIL also names a verify tier among the places its gate can run from.
+- 0f99e26: The `loaded` check's nested-copy FAIL tells a repo that declares `^2.10.0` to run
+  `geonosis update --to 2.10.0`; it quoted the range, and `update --to` takes a version.
+- 0f99e26: `drift` finds a workspace bin a script calls in that workspace's own `node_modules/.bin`, where pnpm
+  links it for a package that depends on the bin's workspace. It looked under the root alone, and a
+  workspace that declared the dependency correctly was told the bin was missing.
+- 0f99e26: Every order a tool writes, compares or applies — generated files, migration order, listings, cursors — sorts with the `en-US` collation, named rather than inherited from the machine. On an `en-US` machine nothing moves; on one set to another language (Estonian sorts `z` before `t`) the output is now the same one.
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+- Updated dependencies [0f99e26]
+  - @geonosis/lint-parity@2.11.0
+
+## 2.10.0
+
+### Patch Changes
+
+- Updated dependencies [3863c79]
+  - @geonosis/lint-parity@2.10.0
+
 ## 2.9.0
 
 ### Patch Changes
@@ -224,6 +453,13 @@
   scratch root instead. The kit's own vitest config sets it to the repo root, so a test that writes an
   envelope there names itself — which is how the offender that filed this row was found again.
 - c4c9330: `runDoctor` takes `home` — where `~/.claude` lives for the plugin registry and the user settings — so a doctor run over a scratch tree is judged against the registry a caller names, never against the machine's own plugin. The kit's scaffolded-tree exam read this machine's plugin (2.1.0) against a tree at 2.2.0 and went red for a drift that was the exam's, not the scaffold's.
+- df49097: **Installed-not-composed reads an IMPORT, not a mention (#251).** The line answered OK for any
+  source file whose text contained the package's name, so a comment saying a floor would be used one
+  day counted as composing it. It now looks for the specifier behind `from` / `import` / `require`,
+  subpaths included; an entity declared with `defineEntity` over `@geonosis/db` satisfies it. A repo
+  whose only mention of a kit package is a comment, a string or a doc block flips from `OK` to `WARN`
+  on that package's line. _Added 2026-09-23: the changeset was held for this cut and never released,
+  so 2.2.0 shipped the change without this entry._
 - Updated dependencies [d15a654]
   - @geonosis/lint-parity@2.2.0
 

package/README.md

@@ -3,10 +3,11 @@
 Through the front door: `geonosis doctor` — the metapackage pins this and every other kit tool at
 ONE version, and passes the exit code through unchanged.
 
-Seven questions a version bump is not finished until something has asked. The first four are ways
-enforcement has reported **green while measuring nothing** — in real repos, for weeks at a time.
-`drift` asks whether the gate is still there at all. The last two ask the same question one layer
-out: whether what a pipeline reported is what actually happened.
+The questions a version bump is not finished until something has asked. Most are ways enforcement
+has reported **green while measuring nothing** — in real repos, for weeks at a time. `drift` asks
+whether the gate is still there at all; `observability` and `deployed` ask the same question one
+layer out, whether what a pipeline reported is what actually happened; `exams` and `seams` ask
+whether an adoption can see the floors it took. `geonosis-doctor --help` lists every one.
 
 ```bash
 pnpm add -D @geonosis/doctor
@@ -22,14 +23,14 @@ print is about a gate that is not there. It used to answer `doctor PASS` at exit
 three vacuous OKs — from the tool whose thesis is that a SKIP is not a pass.
 
 ```
-geonosis-doctor [--root <dir>] [--json] [--strict] [--baseline-against [<ref>]] [--oxlint <path>]
+geonosis-doctor [--root <dir>] [--only <check,…>] [--json] [--strict] [--baseline-against [<ref>]] [--oxlint <path>]
 ```
 
 ## One check, asked alone
 
-`geonosis-doctor --only loaded` runs that check and no other, in well under a second: a manifest read and a resolution per config. It exists because the doctor subsumed a consumer's own declared-vs-loaded script that lived in a 2.5 s local gate, and eleven seconds for every check cannot live there — so the question that catches a stale nested copy earliest had fallen out of the gate that runs most often (measured in a consumer, 2026-08-30: a per-workspace `bun add` left one workspace loading 1.0.0 against configs written for 1.1.0, and the script about to be deleted caught it). `--only loaded,runner` takes a list; a name the doctor does not have is refused with the ones it does. A `loaded` FAIL now says the remedy: remove the nested copies and reinstall.
+`geonosis-doctor --only loaded` runs that check and no other, in well under a second: a manifest read and a resolution per config. It exists because the doctor subsumed a consumer's own declared-vs-loaded script that lived in a 2.5 s local gate, and eleven seconds for every check cannot live there — so the question that catches a stale nested copy earliest had fallen out of the gate that runs most often (measured in a consumer, 2026-08-30: a per-workspace `bun add` left one workspace loading 1.0.0 against configs written for 1.1.0, and the script about to be deleted caught it). `--only loaded,runner` takes a list; a name the doctor does not have is refused with the ones it does. A `loaded` FAIL names the remedy: `geonosis update --to <version>`, which removes the nested copies and reinstalls.
 
-## The eleven checks
+## The checks
 
 ### `loaded` — declared ≠ loaded
 
@@ -65,7 +66,7 @@ geonosis bin through `pnpm`, `npx`, `bunx` or `yarn` is a **FAIL** naming the di
 replaces it.
 
 A git hook's PATH is not the shell's: no nvm shim, no corepack shim, nothing a version manager put
-there. dielime's first hooked commit was "refused" on 2026-08-30 and the ledger never ran — `pnpm`
+there. A Medusa storefront's first hooked commit was "refused" on 2026-08-30 and the ledger never ran — `pnpm`
 was not found, and the sentence its author read was a version manager's failure wearing a gate's
 refusal costume. That is the worst shape a gate has, because it is indistinguishable from the gate
 working. `node_modules/.bin/<bin>` is linked by every package manager and needs nothing on PATH.
@@ -79,7 +80,20 @@ in the same commit — a consumer told to do one thing by one gate and undo it b
 neither (#176).
 
 It is a `loaded` line, not a `drift` one: it reads a committed file and nothing else, and
-during.day's fast tier runs `--only loaded`, so as a drift line it fired in CI and never locally.
+a Workers + D1 app's fast tier runs `--only loaded`, so as a drift line it fired in CI and never locally.
+
+### `group` — one version, one copy
+
+The packages published on ONE version, asked of every workspace: one copy repo-wide, and one number
+per workspace. A consumer carried `@geonosis/visual-diff` at 1.1.0 and 1.4.0 in one tree while
+every other line read green, because they are all scoped to the plugin a config names (#158).
+Membership ships with the kit; a repo declares its OWN held-together sets under `doctor.groups` in
+`geonosis.json`. Asked of the resolver, never of `find`, and a SKIP when the tree installs none of
+the group.
+
+It also reads what the ROOT declares: the door (`@geonosis/cli`, or the `geonosis` metapackage)
+plus the bins its own scripts, hooks, script files, workflows and tiers call by name — and WARNs a
+declaration the door already brings that nothing calls (#177).
 
 ## The options a rule actually runs under
 
@@ -91,7 +105,7 @@ resolves them the way oxlint does — **measured**, not assumed, against oxlint
 - when several overrides claim one file, the **last** of them wins outright;
 - a rule an override names and the base block never mentions is **enabled**, on those files.
 
-Reading `rules` alone is one config with two answers. dielime registers its Medusa providers from
+Reading `rules` alone is one config with two answers. A Medusa storefront registers its Medusa providers from
 three files — a base `medusa-config.ts` and two carrier registries — and declares that exactly
 where oxlint reads it, in overrides naming the carrier directories. The rule resolved it; `drift`
 read the base object and reported two working carriers as directories the registry "never names";
@@ -119,8 +133,9 @@ The reach engine is [`@geonosis/lint-parity`](https://www.npmjs.com/package/@geo
 `corpusOf`, and the corpus is found on the **loaded** plugin, at `corpus/manifest.json`. A plugin
 that ships no corpus is a SKIP: it never claimed to be evidence about anything.
 
-A rule enabled without the options it needs makes oxlint refuse. That refusal is reported as the
-finding — with the sentence naming the rule, which takes a second run to obtain (see below).
+A rule enabled without the options it needs judges nothing and reports only that it is missing
+(D-084). Here that is a **FAIL** — its one finding is the refusal, and a refusal is not reach — and
+`loaded` names the option.
 
 #### The probe a rule declares for itself
 
@@ -164,7 +179,7 @@ regex, refusing with a sentence rather than placing a file the rule will never l
 
 A probe declares FILES, not a file. `no-unregistered-plugin-dir` reports a directory its registry
 does not name and reads that registry off disk, returning silently when it is not there — so one
-file could never exercise it, and dielime, enforcing it at error over four registries, read as a
+file could never exercise it, and a Medusa storefront, enforcing it at error over four registries, read as a
 permanent FAIL for a gate that was working. Its probe now declares the directory AND the registry,
 and every file a probe declares is mounted into the copy. A probe declaring only `{ path, source }`
 is the one-file case of the same thing and is read unchanged, which matters: this reads probes off
@@ -173,10 +188,10 @@ answers in the bare form.
 
 #### The corpus a shipped one cannot be
 
-Three rules cannot be answered by the plugin's corpus at all, because their reach is a **repo's own
-vocabulary**: `layer-walls` fires on the layers this config declares, `no-brand-names` on the brands
-it names, `plugin-route-namespaced` on its package root — and the shipped corpus says `acme` and
-`layers/core`. Both source repos hit exactly this: dielime's `no-brand-names` and during.day's
+A rule whose reach is a **repo's own vocabulary** cannot be answered by the plugin's corpus at all —
+`layer-walls` fires on the layers this config declares, `no-brand-names` on the brands it names,
+`plugin-route-namespaced` on its package root, `step-opens-its-own-cell` on its `within` — and the
+shipped corpus says `acme` and `layers/core`. Both source repos hit exactly this: a Medusa storefront's `no-brand-names` and a Workers + D1 app's
 `step-opens-its-own-cell` read as firing nowhere in trees that enforce them correctly.
 
 So a repo may ship its own, and point at it:
@@ -201,7 +216,7 @@ A rule that reaches ONE engine carries it in its own metadata — `presumes: { e
 and this asks every manifest the config governs — its own, the ones above it up to the root, and the
 workspaces underneath — whether any of those packages is declared, naming the ones it read. A
 backend one directory BELOW a root config declares the engine for the rules that config enables over
-it (#227). during.day ran three Medusa rules at `error` over sagaflow trees: the default step
+it (#227). A Workers + D1 app ran three Medusa rules at `error` over sagaflow trees: the default step
 factory is `createStep`, sagaflow has none, and the possible findings were zero. Enabled-with-no-
 engine and clean are the identical green.
 
@@ -269,18 +284,27 @@ spend a release reading zero off a mis-escaped match (#140, measured in a consum
 A repo with counters and no `--prove` in any verify tier, script or workflow is a **WARN** naming a
 tier it already declares. A repo with no ratchet configured gets no line at all.
 
+### `envelope` — every gate read as many things as it was handed
+
+For each `.geonosis/envelopes/<tool>.json` a gate wrote, `considered === read + refused + excused`.
+Four denominator bugs landed in one day and every one was green — a migrations run that reported on
+three of four files, a plan check that printed `PASS — 0 plan(s)` over a directory of twenty-one, a
+parity run over a tree the second config ignored. Each published a numerator and no denominator.
+Reads the files and imports nothing of the tools that wrote them; no envelopes at all is a SKIP with
+the sentence.
+
 ### `drift` — the gate that is no longer there
 
-The other four ask whether a gate measures what it names. This one asks whether it still runs.
+The checks above ask whether a gate measures what it names. This one asks whether it still runs.
 
 | Line | Verdict | What it is |
 |---|---|---|
 | `.github/workflows/*.yml` | FAIL | a job or step switched off by a condition that can never be true. One consumer carried 90 tests, a pgvector container and an E2E suite and ran none of it, the disablement documented as "TEMPORARY" in a comment. It is "never downgrade a rule", one level up |
 | test files | FAIL | a `*.test.*` file with no `test` script in any workspace from it up to the root. A monorepo that runs one vitest over the whole tree has no orphan in it, and this says so |
-| script paths | FAIL | a `scripts` entry that hands `bun`, `node` or `tsx` a file that is not on disk. during.day's `bun run fast` began `bun scripts/check-plugin-version.ts && …` and the script had been deleted: the 2.5 s gate had failed at its first command for as long as nobody looked. Only a word with a file extension is asked about, so `bun test`, `bun run lint` and `node --version` are not paths |
-| generated files | FAIL | a file carrying `geonosis:gated-by: <gate>` that nothing here runs the gate for — checked against every manifest script, every ratchet counter command and every workflow, because what matters is that SOMETHING runs it. A file that names its **writer** and no gate at all fails on that alone: during.day's AGENTS.md is a 1,117-line byte-copy of its own law, written by `geonosis sync`, and nothing ever ran `sync --check` — the doctor stood beside it warning about the shorter original |
-| `NODE_OPTIONS` | WARN | a manifest script preloading through `NODE_OPTIONS` beside a ratchet counter whose command shells to `pnpm`. The nested pnpm inherits the option: dielime's ts5 shim sent it looking for a `.pnpmfile.mjs` that is not there, the counter died, the ratchet refused correctly, and nothing in the message was near the cause. Both halves must be present, and the line names the script and the counter |
-| workspace bins | FAIL | a script calling a bin THIS repo's own workspaces declare, with no `node_modules/.bin/<name>` at the root. pnpm links a workspace bin only for the packages that depend on it: dielime's `@dielime/gate-tools` had to become an explicit root devDependency before the gate scripts could find it, and naming that took a debugging session. External commands are not judged — that would be a guess |
+| script paths | FAIL | a `scripts` entry that hands `bun`, `node` or `tsx` a file that is not on disk. A Workers + D1 app's `bun run fast` began `bun scripts/check-plugin-version.ts && …` and the script had been deleted: the 2.5 s gate had failed at its first command for as long as nobody looked. Only a word with a file extension is asked about, so `bun test`, `bun run lint` and `node --version` are not paths |
+| generated files | FAIL | a file carrying `geonosis:gated-by: <gate>` that nothing here runs the gate for — checked against every manifest script, every ratchet counter command and every workflow, because what matters is that SOMETHING runs it. A file that names its **writer** and no gate at all fails on that alone: a Workers + D1 app's AGENTS.md is a 1,117-line byte-copy of its own law, written by `geonosis sync`, and nothing ever ran `sync --check` — the doctor stood beside it warning about the shorter original |
+| `NODE_OPTIONS` | WARN | a manifest script preloading through `NODE_OPTIONS` beside a ratchet counter whose command shells to `pnpm`. The nested pnpm inherits the option: a Medusa storefront's ts5 shim sent it looking for a `.pnpmfile.mjs` that is not there, the counter died, the ratchet refused correctly, and nothing in the message was near the cause. Both halves must be present, and the line names the script and the counter |
+| workspace bins | FAIL | a script calling a bin THIS repo's own workspaces declare, with no `node_modules/.bin/<name>` at the root. pnpm links a workspace bin only for the packages that depend on it: a Medusa storefront's `@shop/gate-tools` had to become an explicit root devDependency before the gate scripts could find it, and naming that took a debugging session. External commands are not judged — that would be a guess |
 | plugin directories | FAIL | a manifest directory under the roots `no-unregistered-plugin-dir` names that the registry never mentions. SKIP when the rule is not configured — the roots are the repo's, read from the rule it already wrote, never a list invented here |
 | `publicHoistPattern` | FAIL / SKIP | a pattern in `pnpm-workspace.yaml` with no root `node_modules` link for a workspace package it matches. pnpm dropped one during an **unrelated** `add`, then answered "Already up to date" to every install afterwards over a clean `git status` — the tree was fixed only by deleting `.modules.yaml` and `.pnpm-workspace-state-v1.json`, which the line carries verbatim. Only workspace packages are judged, because one exists on disk by construction and a missing link for it cannot be "the install never ran"; the root package is never asked about, since no package manager puts a repo's root inside its own `node_modules`. A pattern matching no workspace package is SKIP, never a pass |
 | `@geonosis/observability` | WARN | it is declared in a manifest here and **no source file imports it** — installed is not composed. The kit ships the sink adapter and the reference consumer sent production errors nowhere, because nothing at its composition root ever built one; from outside the process that reads exactly like a project with nothing to report (#165). No line at all in a repo that never installed it |
@@ -329,6 +353,15 @@ environments inherit nothing per binding) and `release.secrets`.
 It reads the file, and imports nothing of `@geonosis/release` — the same wall `observability` keeps,
 held by the kit's own `layer-walls` config, so a repo can install either package alone.
 
+### `rails` — the egress a run is bounded by, in the settings that load
+
+The hosts `geonosis.json` → `rails.egress.allow` declares, read back out of the settings that
+actually LOAD rather than the file this repo rendered. Claude Code merges
+`sandbox.network.allowedDomains` across the managed, user, project and local scopes; a settings file
+that fails validation is silently ignored under `-p`, and a managed `allowManagedDomainsOnly` makes
+every other scope's list ignored. `deniedEgress` in `.geonosis/rails-run.json` is a **gate at zero**
+(D-025), asked whether or not an allowlist is declared: one denied attempt fails.
+
 ### `exams` — a floor adopted and never examined
 
 A floor bump that breaks search is invisible to a tier that never runs the search exam. A verify
@@ -343,12 +376,33 @@ for a fact the floors already state, and wrong the day a floor adds one.
 | | |
 |---|---|
 | no declared package ships an exam | **SKIP** — nothing here to ask about |
-| a test file imports one of the floor's exams | **OK**, naming the file and the exams it runs |
-| the floor is declared and no test file imports any of its exams | **WARN**, naming the floor and every exam it ships |
+| a test file imports an exam | **OK** for that exam, naming the file |
+| the floor is declared and no test file imports an exam it ships | **WARN** for that exam — one line per exam, never one per package (#353) |
 
 It WARNs rather than FAILs: the check cannot tell a floor adopted last week from one whose exam
 somebody deleted, and a FAIL on every fresh install is the shape that teaches a reader to skim.
 
+### `seams` — a declared seam that names nothing
+
+`adoption.seams` in `geonosis.json` is what `geonosis update` measures a floor's adoption by:
+lines deleted against lines added in the files a consumer says hold a floor's shape. A glob whose
+file was deleted and never undeclared measures nothing, and every bump report reads `0 deleted,
+0 added` over it — a Workers + D1 app carried three of eight that way for a month.
+
+| Seen                                            | Line                                                |
+| ----------------------------------------------- | --------------------------------------------------- |
+| no `adoption.seams`                             | **SKIP**, naming the key                            |
+| every glob names a file (never in node_modules) | **OK**, with the count                              |
+| a glob names no file                            | **WARN** per glob, saying to drop or replace it      |
+
+### `formatter` — the kit's rules, out of the formatter's reach
+
+A consumer links or copies the plugin's rule files into `.claude/rules/geonosis`, and `tiers.md`
+there is generated. `oxfmt --migrate=prettier` writes `ignorePatterns: []`, so the first `format` of
+a repo that migrated rather than scaffolded rewrote them. The repo's own oxfmt is asked with
+`--list-different`, so its ignore rules are read by the tool that applies them: WARN, naming the
+entry to add, when the files are within its reach; UNJUDGED when oxfmt could not be asked.
+
 ## What `--format=unix` does not tell you
 
 Measured on oxlint 1.80: a JS plugin rule that throws from `create()` is reported **once per file**,
@@ -374,6 +428,7 @@ The whole report, for a CI step to read:
   "counts": { "FAIL": 1, "OK": 12, "SKIP": 2, "UNJUDGED": 0, "WARN": 0 },
   "findings": [{ "check": "loaded", "message": "…", "subject": "apps/web/.oxlintrc.json", "verdict": "FAIL" }],
   "ok": false,
+  "ran": ["loaded", "group", "exercised"],
   "root": "/repo"
 }
 ```
@@ -387,16 +442,3 @@ consumer wrote. It depends on `@geonosis/lint-parity` for the reach engine and o
 the kit's own `layer-walls` config holds every one of those walls.
 
 Apache-2.0.
-
-### `seams` — a declared seam that names nothing
-
-`adoption.seams` in `geonosis.json` is what `geonosis update` measures a floor's adoption by:
-lines deleted against lines added in the files a consumer says hold a floor's shape. A glob whose
-file was deleted and never undeclared measures nothing, and every bump report reads `0 deleted,
-0 added` over it — during.day carried three of eight that way for a month.
-
-| Seen                                            | Line                                                |
-| ----------------------------------------------- | --------------------------------------------------- |
-| no `adoption.seams`                             | **SKIP**, naming the key                            |
-| every glob names a file (never in node_modules) | **OK**, with the count                              |
-| a glob names no file                            | **WARN** per glob, saying to drop or replace it      |