@geonosis/oxlint-plugin-biological-architecture 2.0.0 → 2.2.0

package/README.md

@@ -201,8 +201,9 @@ Then find the stray copy, and mind that the answer is package-manager-specific:
 
 ## Where to read on
 
-- `RULES.md` — every rule, its preset, which source tree it came from, and how each divergence was
-  resolved.
+- `RULES.md` — in this tarball: every rule, its preset, which source tree it came from, how each
+  divergence was resolved, the option each gated rule refuses without, and a generated line per rule
+  naming every option it accepts.
 - `skills/geonosis-code/SKILL.md` in the repository — **generated** from every rule's `fixShape`:
   the shape each gate accepts, in one short document meant to be read before writing code.
 

package/RULES.md

@@ -0,0 +1,939 @@
+# Rule inventory
+
+Read from the two source trees on 2026-08-29:
+
+- `dielime/packages/eslint-plugin-biological-architecture` — **36 rules**
+- `during.day/packages/eslint-plugin-biological-architecture` — **52 rules** (51 when the union was
+  cut; `step-opens-its-own-cell` landed there hours later and was folded in afterwards)
+
+One plugin name, two rule sets, no shared code. **33 rules had the same filename in both trees; only
+3 of those 33 were byte-identical.** A fix in one never reached the other.
+
+The union here is **54 rules**, plus twenty-two the kit wrote for itself — `layer-walls`,
+`emit-declares-attempts`, `cell-no-cross-feature-organelles`, the `backend-medusa` ten of 1.0.0,
+`no-unregistered-plugin-dir` + `router-schema-parity`, the `themekit` two,
+`no-mock-db-in-integration`, `todo-names-its-plan`, `boundary-time-is-primitive`,
+`durable-body-reads-through-steps` and `subpath-over-barrel` — **76**.
+
+| | count |
+|---|---|
+| in both trees, byte-identical | 3 |
+| in both trees, **diverged** | 30 |
+| dielime only | 3 |
+| during.day only | 18 |
+| **union** | **54** |
+| written here (`layer-walls`, `emit-declares-attempts`, `cell-no-cross-feature-organelles`) | 3 |
+| written here, `backend-medusa` (1.0.0) | 7 |
+| written here, the integration seam (1.0.0) | 2 |
+| **total** | **66** |
+| written here, `backend-medusa` (1.0.0) | 10 |
+| **total** | **67** |
+| written here, `themekit` (1.0.0) | 2 |
+
+## How divergence was resolved
+
+Two shapes of divergence, and one resolution rule each.
+
+**dielime broadened the path patterns.** Every dielime rule scoped its file test as
+`(?:features/[^/]+/)?<tier>/`, so it fires on a FLAT kit (`packages/ui/src/tissues/…`) as well as a
+feature-sliced app. during.day's kept `features/<name>/<tier>/`. **The broader pattern wins** — a
+rule that reaches more files is the stricter rule.
+
+**during.day broadened the node coverage.** Its August 2026 sweep added
+`ExportAllDeclaration` / `ExportNamedDeclaration` handlers to every import-direction rule (a
+re-export names a module exactly as an import does), and turned `tissue-no-hooks` from an import
+check into a hook-CALL check — the hole three review rounds missed was a tissue reaching a store
+through a `lib/` hook. **The wider visitor set wins**, for the same reason.
+
+Where a divergence was a false-positive fix rather than a reach change (own-sibling stem tolerance,
+`.parts.tsx` entrypoint scoping, re-export shims, react-email and Radix as composition sources,
+`Kind`-vocabulary props), it was kept: both repos' fixtures depend on those, and a rule that fires on
+an accepted convention is a rule people learn to ignore.
+
+**Both repos' test suites are ported and green** — during.day's 300-odd hand-built-AST tests, its
+`real-source-tests` cases through the real binary, and dielime's 45-case oxlint fixture lock.
+
+## Named decisions
+
+### `cell-must-be-stateful` (dielime) vs `cell-handles-are-scoped` (during.day) — **both kept, one renamed**
+
+These share only the word "cell", and they mean different things by it.
+
+- dielime's `cell-must-be-stateful` is the **biological tier**: a file in `cells/` whose whole family
+  is props-in / JSX-out is a compound in the wrong folder. It is the inverse of
+  `compound-must-be-stateless`. → kept as-is, `frontend`.
+- during.day's `cell-handles-are-scoped` is a **Cloudflare D1 database cell**: a worker that opens a
+  cell handle must wrap every invocation in `withCells` or it leaks a pool per call. Nothing to do
+  with a tier. → kept, **renamed `worker-handles-are-scoped`**, `backend-d1`.
+
+In this kit "cell" is a tier. A backend rule that means something else by it would teach the wrong
+vocabulary at every diagnostic, so the backend one gave up the word.
+
+### The time door is an option, and its exemption is a LIST OF MODULES (1.5.0)
+
+`time-through-the-door` shipped with `/packages/utils/src/time.ts` and four exemption directories
+compiled in — a rule exactly one repo could enable, and the thing pinning that repo's last
+generic-utility package in place, because moving the door would have silenced the rule guarding it.
+The door is now the `door` option and the directories are `exempt`, both regex sources over the
+normalised filename, and the rule refuses the run when `door` is missing. The LIBRARY it polices was
+compiled in for one release longer — `dayjs`, so a repo on date-fns kept the raw-`Date` half and
+lost the half that catches a second configured formatter, which is the defect that half exists for.
+It is the `libraries` list now, defaulting to `['dayjs']`, and every diagnostic names the library
+the repo declared.
+
+`boundary-time-is-primitive` takes the same fact from the other side and answers it differently on
+purpose. Its exemption is `doors`: modules NAMED IN FULL, one per entry, never a pattern. A rule
+scoped by a glob grants its exemption to wherever the glob stops, and nothing then records who
+decided the boundary or counts what accumulated on the far side — a consumer's path-exempted module
+took on seven unchartered exports, one of them a write, lint-free, in eleven commits. A list of
+module names is a number a reader can hold: a repo has one door, or it has three and knows it.
+
+### An enabled rule that cannot fire **refuses the run** (0.2.0)
+
+This replaces the "does nothing until configured" posture below, and it is the one breaking change
+in 0.2.0 that a consumer will feel.
+
+Making every repo-specific list an option (law 6) has an obvious implementation and a wrong one:
+return an empty visitor when the option is missing. The result is a rule that is enabled, graded
+`"error"`, and **indistinguishable from compliance**. dielime ran `no-raw-html-atoms` at `"error"`
+for months with no element→atom map. 136 raw elements in the tree. Zero findings. A green gate. It
+was found by hand, not by a gate, because there was no gate — only a rule with nothing to compare
+against, which is the silent-fallback class one level up from a counter reading zero under a format
+it cannot parse.
+
+So the posture splits in two:
+
+- a rule **nobody enabled** does nothing — that is oxlint's job, and it needs no help from us;
+- a rule that **is** enabled without the options it needs is a **config error**, and `create()`
+  throws, naming the rule and the missing option. oxlint refuses and exits non-zero.
+
+**Nineteen** rules take this, and the list is not kept by hand: `src/rules/option-gated.ts` names
+each with the option its refusal must say and a bag that makes it run clean, and
+`src/option-gated.test.ts` asks every rule the plugin exports whether it refuses a bare `create()`
+and fails when one of them is not on the list — or is on it and no longer refuses. It found seven
+rules refusing with nobody proving it through the binary, `time-through-the-door` and
+`boundary-time-is-primitive` among them. An empty list counts as missing: it is the same nothing
+spelled longer. One helper, `src/rules/lib/options.ts`, so the
+wording cannot drift rule to rule:
+
+```
+biological-architecture/<rule> is enabled but its `<option>` option is nothing, so it can never
+fire. Configure `<option>`, or turn the rule off — an enabled rule that cannot fire reads exactly
+like a rule that found nothing.
+```
+
+One wrinkle worth knowing before it surprises someone: oxlint renders a plugin error as a diagnostic
+with **no source span**, and `--format=unix` has nowhere to put one, so it prints `:0:0:` and no
+wording. The message is intact in the default and `json` formats. Under unix the run is still
+non-zero, and the summary counts a problem no line accounts for — which is exactly the shape
+`@geonosis/lint-parity` refuses to read as zero findings. Unreadable, never invisible.
+
+**The kit takes its own medicine**: its `.oxlintrc.json` enabled `no-brand-names` and
+`no-raw-html-atoms` bare, and both were inert. `no-brand-names` now names the two brands that must
+never re-enter kit source (the ones the fork had compiled into its regex) — proved reaching by
+adding one to a source file and watching it fire.
+
+### `no-brand-names` (dielime only) — brand list is now an **option**
+
+The rule shipped with a two-brand regex and a matching CDN-host allowance compiled into it. It could
+only ever serve the repo that wrote it. Now:
+
+```jsonc
+"biological-architecture/no-brand-names": [
+  "error",
+  { "brands": ["acme"], "allowedSubstrings": ["media.acme.com"] }
+]
+```
+
+Enabled with no `brands`, it refuses the run — see the decision above.
+
+### `step-opens-its-own-cell` — one law, two spellings, every fact an **option**
+
+The law is one sentence: a durable instance hibernates between steps and replays them on retry, so
+each unit of work opens the handle it uses rather than sharing one opened once per run. WHERE that
+is declared is what has moved, because the org now runs two engines at once.
+
+`@geonosis/workflows` has a seam for it — `scope.perStep` on the runtime a durable host builds — so
+the finding is a host that declares none. `hosts` names the calls that build one (default
+`createRuntime`, `entrypointFor`, the engine's own two) and `scopeKey` the key (default `perStep`);
+`within` is the tree, and is required:
+
+```jsonc
+"biological-architecture/step-opens-its-own-cell": [
+  "error",
+  { "within": "packages/workflows/src/" }
+]
+```
+
+The scope is read anywhere inside the host call rather than at `scope.perStep` exactly, because the
+Cloudflare adapter's entry declares it one closure down —
+`entrypointFor({ runtime: (env) => createRuntime({ scope: … }) })` — and a check anchored on the
+outer object would report every correct one of them. A host whose config cannot be read WHOLE (a
+spread, a variable) is not judged at all: unreadable is not the same as absent, and only one of the
+two is a finding.
+
+`sagaflow-js` has no such seam. A repo still on it wrapped `step` in a file of its own, and the
+finding there is a saga importing the engine's `step` around that wrapper — reachable by naming
+`engine` and `wrapper`, and off entirely for a repo that names no engine:
+
+```jsonc
+"biological-architecture/step-opens-its-own-cell": [
+  "error",
+  {
+    "engine": "sagaflow-js",
+    "within": "packages/workflows/src/",
+    "wrapper": "packages/workflows/src/step\\.ts$"
+  }
+]
+```
+
+Enabled with no `within`, it refuses the run. Type-only imports never fire: they bring no handle, so
+they can share none. The diagnostic quotes the option values rather than any repo's paths, and the
+preset is its own — the invariant is true of a DURABLE run that hibernates between steps and false
+of an inline saga sharing the request's connection, so `backend-workflows` would have been a repo
+fact wearing a preset's name.
+
+### `layer-walls` (written here) — the `no-restricted-imports` factory, as data
+
+Neither source repo had it; a third repo of the user's, musa-loading-plan-engine, hand-rolled it as
+an ESLint `no-restricted-imports` factory in `eslint.config.mjs` (kernel ← auto/manual ← tools;
+manual never imports auto). Every layered repo writes that file, and every one of them writes it in
+a different shape, so it is the kit's job.
+
+The layers are **data**: `{ name, paths, mayImport }`, `paths` being regex sources tested against the
+normalised filename. A layer may always import itself; `mayImport` lists the others. A file in no
+declared layer is unconstrained — walls are declared, never inferred — and a target in no layer is
+not a wall, so a repo can wall one corner of its tree and leave the rest alone.
+
+```jsonc
+"biological-architecture/layer-walls": ["error", {
+  "layers": [
+    { "name": "core", "paths": ["packages/x/src/core/"], "mayImport": [] },
+    { "name": "cli",  "paths": ["packages/x/src/cli\\.ts$"], "mayImport": ["core"] }
+  ]
+}]
+```
+
+Three decisions inside it:
+
+- **A relative source is resolved against the importing file before it is classified.** `../../shell/boot`
+  carries no layer name at all, and a rule matching the string alone lets every wall be walked
+  around with two dots. Only `cell-must-not-compose-cell` in this plugin does this today; plan 018
+  K1.2 gives every direction rule the same resolver.
+- **A package specifier and a `node:` builtin are not walls by default.** A layer that may import no
+  other layer still runs on a machine with a filesystem. `externals: "deny"` is the opt-in for a
+  layer that really must reach nothing outside the declared set. A bare specifier a layer's `paths`
+  claims is still classified by it, which is what lets `parity` be forbidden from importing
+  `@geonosis/oxlint-plugin-biological-architecture` by name.
+- **`ImportExpression` and `require()` are visited too**, beside the two re-export forms. A wall
+  visited only on `ImportDeclaration` is a wall with three doors left open.
+
+Its own preset, `tooling`: it enforces nothing until a repo declares its layers, and a repo can want
+layer discipline in its tooling without wanting a React tier vocabulary anywhere near it. **The kit
+enables it on itself** in the root `.oxlintrc.json` — seven layers across the three packages, the
+load-bearing one being `parity`, which may import nothing, so `@geonosis/lint-parity` cannot grow an
+import of the plugin it exists to check.
+
+### `emit-declares-attempts` (written here, from a consumer's landmine) — 0.3.0
+
+Medusa's `emitEventStep` defaults `attempts` to 1, and the redis worker treats only `attempts > 1`
+as "a retry was configured". An emit that passes `{ priority }` and **no** `attempts` is therefore
+droppable on its first failure while reading as deliberate — it has an options bag, it names a
+priority, a reviewer moves on. The options bag is what hides it.
+
+```ts
+emitEventStep({ data, eventName: 'order.placed', options: { attempts: 3, priority } })
+```
+
+What it judges, and what it refuses to guess:
+
+- no `options` at all, or an `options` with no `attempts` → reported;
+- a literal `attempts` of 1 or less → reported, because that is the default spelled out;
+- a **non-literal** `attempts` — `RETRY_BACKGROUND.attempts`, the shared constant — **passes**. The
+  rule cannot evaluate it, and one that guessed here would push every repo into inlining the number
+  at each call site, which is the opposite of what the shared constant is for;
+- a payload or an options bag it cannot read whole (a variable, a spread) → passes, same reason.
+
+The emitter names are the option `emitters`, default `["emitEventStep"]`: a repo that wraps the emit
+under its own name says so instead of forking the rule. Emptied out (`emitters: []`) it refuses the
+run, like every other option a rule cannot fire without.
+
+Preset `backend-medusa`, which is twelve rules now.
+
+**One correction to the brief that asked for it**: dielime does not guard 50 emit sites this way
+today. It has **four** `emitEventStep` calls (`create-sample-order`, `ingest-shipment-milestone`,
+`convert-sample-to-order` ×2), and **all four would fire** — three carry
+`options: { priority: EventPriority.CRITICAL }` with no attempts, one carries no options at all.
+That is the fixture, and it is worth more than the guarded version would have been.
+
+### The integration seam (1.0.0) — two rules, two new presets, both option-gated
+
+`no-unregistered-plugin-dir` (preset **`integrations`**) and `router-schema-parity` (preset
+**`backend-trpc`**). Each gets its own preset because each enforces nothing until a repo says where
+its directories are, and because having integrations says nothing about having a tRPC mirror.
+
+**`no-unregistered-plugin-dir`.** Midday ships 35 `app-store` directories and **eight are reachable
+from nothing** — `cal`, `deel`, `dropbox`, `google-drive`, `polar`, `raycast`, `stripe`, `zapier`.
+They break nothing, which is why they survived: they read as integrations to anyone counting
+directories. The rule fires on the manifest file of a directory the registry does not name, and the
+registry is read as SOURCE — a rule that had to import it would need the repo's whole resolution set
+up inside a linter, and every string in it is a name the registry knows whether it is spelled as an
+id or as an import path.
+
+dielime is the fixture that matters just as much: measured, **zero** of its provider directories are
+unregistered. A rule that fired on the clean tree would be off within a day. And its third seam has
+no directories at all — `email-gmail.ts` and `whatsapp-360dialog.ts` sit flat beside their registry —
+so it is out of scope because nothing matches `<root>/<dir>/<manifest>`, not by a special case.
+
+*`registry` takes a list, because a registry can be split.* dielime's `medusa-config.ts` imports
+`medusa-config.fulfillment.ts`, and the carrier directories are registered in the half that is
+imported. Reading only the file the option named made two REGISTERED directories a standing FAIL
+there — a false positive on a working tree, which is how a rule gets turned off. The halves are
+listed, not followed: chasing imports out of a registry would need the repo's whole module
+resolution set up inside a linter, and would guess. One unreadable half is the same silence a
+single unreadable file has always bought — a configuration answer, not a partial verdict taken from
+the halves that happened to open. The refusal now names the accepted shape too (#75), because a
+repo that reached for a list was told `should be string` and could not learn from the rejection
+whether a list was a shape the rule had or a shape it lacked.
+
+*The defect the two test layers caught between them.* The rule's first version scanned every quoted
+string in the registry, and the corpus registry's own comment said "the third is `dead-cal`" — in
+backticks. The scanner counted it as a registration and the rule went silent on the one directory
+its fixture exists to catch. The hand-built nodes could not find this: a hand-built registry has no
+prose in it. Comments are stripped first now, and the direction is the point — a name that appears
+only in a comment is usually the note explaining why the directory was abandoned.
+
+**`router-schema-parity`.** during.day holds the mirror by hand at 21 of 22 routers and 21 of 23
+contracts; Midday holds its own at 33 of 37. A router with no schema is a wire contract written
+wherever the handler happens to say it; a schema with no router is a contract nothing serves.
+
+Two facts were measured before the rule was written, and both changed its shape:
+
+1. during.day's two halves are in **different packages** — `apps/api/src/trpc/routers` against
+   `packages/api-contract/src` — so the options are repo-root-relative. A package-relative option
+   could not name them both.
+2. during.day's three apparent gaps are ONE deliberate arrangement: `routers/documents-mounted.ts`
+   mounts the invoice and purchase-order entities and imports both contracts. A strict filename
+   mirror reports all three and is wrong all three times, on the very tree the rule was built from.
+   So `mounts` (`{ "documents-mounted": ["invoice", "purchase-order"] }`) is config, and the corpus
+   carries the case both ways: the mount declared and the three findings it suppresses.
+
+### Two options the consumers forced (1.0.0) — both of them silent zeros
+
+Neither of these came from review. Both came from running the rule read-only over the consumer and
+then running a CONTROL that should have made the same files fire.
+
+**`no-unregistered-plugin-dir.manifests` is required, with no default.** The rule first shipped a
+default entry-file list — `index.ts`, `index.tsx`, `config.ts`. Over dielime's two provider roots it
+reported zero findings, and every directory there IS registered, so the run read as a pass. It was
+not one: dielime's plugin directories contain `service.ts` and no index at all, so the rule matched
+no file and answered a question it had never asked. The control — the same files, with a registry
+naming none of them — also reported zero, which is what exposed it. With `manifests: ["service.ts"]`
+the control fires on all three directories and the real config on none.
+
+**`emit-declares-attempts.budgetHelpers`, empty by default.** The claim this rule carried was that it
+covers dielime's emit sites, so that repo's 132-line source walker could be deleted. Measured: all
+**54** `emitEventStep` sites spell the bag `options: retryableEvent(…)` — zero object literals, zero
+missing bags — and a call is precisely the shape the rule declines to judge. It reported zero, and
+that zero proved only that no bag was absent. Named as a budget helper, a call to `retryableEvent`
+passes and a call to anything else is reported as a budget nobody can check; the control naming a
+helper dielime does not use reports all 54. Empty by default, so no existing consumer moves.
+
+Both are the same failure as a counter that reads zero under a format it cannot parse, and both were
+invisible to the rules' own fixtures — a fixture is written to match the rule, which is exactly what
+a consumer's tree does not do.
+
+### `no-mock-db-in-integration` (1.0.0, preset **`testbed`**) — the rule both consumers pass
+
+The only rule in the plugin whose landmine is in **neither** source repo. Measured on 2026-08-30:
+
+| tree | `mockDb` | `vi.mock('…db…')` | `vi.mock(` in integration suites |
+|---|---:|---:|---:|
+| dielime | 0 | 0 | **0** of 106 integration files |
+| during.day | 0 | 0 | 0 (`vi.mock` appears nowhere in the tree) |
+| Midday | 32 references in 4 files | — | the gate |
+
+Midday's shape: `apps/api/src/__tests__/setup.ts:80` exports `mockDb = createMockDb()`;
+`helpers/test-context.ts:27` sets `db: mockDb`; **35 of the 43** test files under `__tests__/` import
+that helper, and all 35 sit in `__tests__/trpc/`. They assert that a procedure calls what it says it
+calls, and nothing about what the database returns. The repo's own `packages/db/src/test/` layer,
+which runs against a real database, is right — the mocked suites are a supplement that became the
+proof (landmine 11 of `docs/analysis-midday-2026-08.md`).
+
+So **both consumers are the green fixtures**, and that is the whole reason `integrationDirs` and
+`dbModules` are `requireOption`-gated with no defaults: a default drawn from two repos that do not
+have the pattern would match nothing and report a clean tree it had never looked at — the exact
+failure `no-unregistered-plugin-dir.manifests` was already caught by.
+
+Three matching decisions, each with a case in the node layer:
+
+- **the three spellings of one act** — `vi.mock`, `jest.mock`, `mock.module`. A repo on bun with
+  only `vi`/`jest` checked would be entirely unpoliced.
+- **never a containment test.** `@repo/dbt` is not `@repo/db`, and `__tests__/integration-helpers/`
+  is not `__tests__/integration/`. Exact, subpath, or whole path segment.
+- **`mockNames`, empty by default.** Midday's shape has no mock CALL to see: the handle is built in
+  a setup file and threaded through a context helper. A rule cannot infer that an identifier is a
+  mock, so a repo that has one names it — and a repo that does not gets no rule guessing at its
+  identifiers.
+
+### The `backend-medusa` seven (1.0.0) — Medusa's own silences, turned into gates
+### The `backend-medusa` ten (1.0.0) — Medusa's own silences, turned into gates
+
+Every rule below exists because the framework **infers** something instead of making you say it.
+None of them throws at runtime; all of them are found in production, far from the cause. Six were
+scans in dielime's `packages/verify-arch` first and are now also per-file rules; two come from
+Medusa's own source; one from an estimate a route already labels by hand. Three more — the per-file
+halves of R4.3, R3.8 and R5.1 — landed after adoption showed what a text scan misses.
+
+| rule | the silence | source |
+|---|---|---|
+| `mutating-step-declares-retry` | `maxRetries` defaults to **0** (`orchestration/transaction/types.ts:48`), so a transient failure reverts real state a retry would have absorbed | dielime scan R5.2 |
+| `step-declares-compensation-or-none` | `stepConfig.noCompensation = !compensateFn` (`create-step.ts:184`) — a deliberate non-compensation and a forgotten one are the same source | analysis §1.1, "highest-value lint gap"; dielime scan R5.6 |
+| `named-when-block` | an unnamed `when()` derives a `when-then-{ulid}` step name (`composer/when.ts:120-126`), so a resumed run cannot find its checkpoint | dielime scan R5.5 |
+| `subscriber-declares-id` | the loader infers a subscriber id from a function or file name; two that infer alike dedupe each other | dielime scan R5.4 |
+| `no-loader-side-effect-in-index-file` | `ResourceLoader.discoverResources` filters files named `index` (`resource-loader.js:51`) | dielime scan #15442 |
+| `service-name-not-reserved` | a module key matching the `Modules` enum silently REPLACES the built-in (`medusa-app.ts:175-198`); `registerModule` guards only aliases and mains | analysis §1.3 — dielime's `catalog_search` scar |
+| `no-index-count-as-exact` | the index engine's count is an EXPLAIN plan-row estimate and reads as an exact total | analysis §3a; dielime's b2b route labels it by hand |
+| `unique-query-step-name` | the step-handler map is a plain assignment and the orchestrator appends a duplicate action with no dedupe, so two un-named query steps in one body last-win: one read never happens | dielime scan R4.3 |
+| `plugin-route-namespaced` | the routes-loader assigns last-write-wins, so a plugin route with no namespace segment is claimable by any other package with no error | dielime scan R3.8 |
+| `route-no-inline-mutation` | a route that writes directly succeeds, returns 200, and skips the compensation and retry class that live behind the workflow door | dielime scan R5.1 |
+
+Four postures they share, all of them the one `emit-declares-attempts` set:
+
+- **unreadable is not absent.** A config assembled from a spread, or held in a variable, passes —
+  the flag or the budget may be in the base, and a rule that guessed there would fire on every repo
+  that factored its step configs out.
+- **a value the rule cannot evaluate passes.** `maxRetries: BUDGET` says nothing; only a literal is
+  judged, because a rule that demanded a literal would push every repo into inlining numbers.
+- **every framework name is an option** — `stepFactories`, `blocks`, `moduleFactories`,
+  `resourceFactories`, `mutationPrefixes`, `estimateFields`, `labelKey`, `paths`, `directories`,
+  `reserved` — each with the framework's own value as its default, and each refusing the run when
+  emptied out.
+- **arity, not shape, where the framework overloads.** `named-when-block` reads `when(input, cond)`
+  vs `when(name, input, cond)` by argument count. The first version of that rule read the FIRST
+  ARGUMENT'S TYPE and passed every real call site, because the input is a variable — the hand-built
+  test that caught it is `reports the unnamed overload`.
+
+Two of them carry a decision worth naming:
+
+**`no-loader-side-effect-in-index-file` defaults to `["subscribers/", "jobs/"]`, not all three
+kinds** — measured, not assumed. In the installed 2.19 packages,
+`framework/dist/utils/resource-loader.js:51` still filters `parsedName.name !== "index"` unless the
+caller passes `allowIndex`, and `framework/dist/workflows/workflow-loader.js:34` is the **only**
+caller in the whole framework that does (`grep -rn allowIndex` over the dist returns that call, the
+parameter and its doc comment, and nothing else). So a `workflows/index.ts` **is** discovered on
+2.19 and a `subscribers/index.ts` is not. A rule firing on a file the framework reads is a false
+positive, and false positives are how a rule gets ignored — so the default is what was measured, and
+a repo below 2.19 adds `workflows/` back. The `medusa` scanner pack in `@geonosis/verify-arch`
+defaults the same way, and `examples/dielime.verify-arch.json` adds the third kind, which is what
+keeps that repo's numbers identical to today's.
+
+**The class an AST rule wins over a text scan.** These three are the per-file halves of scans a
+consumer runs repo-wide, and carrying both is deliberate — but where they disagree, the rule is
+right, and R5.6 is the case that proves what the disagreement costs.
+
+That scan decided whether a step had a compensation function by counting top-level commas in the
+`createStep(` call. The house style closes a multi-line call with a TRAILING comma, so a step with
+two arguments read as three, and "has a compensation function" was true of every step that ended in
+`,)`. The scan reported **0 for its whole life**, with five real violations behind it — two of which
+became real compensations once someone could see them. `step-declares-compensation-or-none` was
+immune from its first day, because an AST does not count commas: it is handed the arguments.
+
+The same class shows up in each of the three added here. `route-no-inline-mutation` reads its
+escape-hatch annotation from the STATEMENT, where the equivalent scan looks on the matching line or
+the one above — and a consumer's own annotated write is spread over six lines by a cast, so the
+annotation lands five lines from the call and the scan is red on a write a person already signed
+off. `unique-query-step-name` tells a name it CANNOT EVALUATE from a name that is absent, which a
+regex over `.config({ name: … })` cannot. And every one of them sees files the scan's collector
+never hands over: a scan reads what its walk collected, a rule is handed every file that compiles.
+
+None of that makes the scans redundant. A scan proves the invariant repo-wide in one command,
+whatever the lint stack is doing that week, and it sees facts no per-file rule can — two packages
+claiming one route, a `serviceName` that must be unique across every module. The split is the
+decision rule, not a ranking: whole-graph facts are scans, per-file facts are rules, and the six
+that are both are defence in depth on purpose.
+
+**`step-declares-compensation-or-none` judges every step, not only mutating ones.** dielime's R5.6
+scan restricts itself to steps whose text contains a write; the rule does not, because
+`noCompensation = !compensateFn` is true of every step and a read-only step declares
+`noCompensation: true` once and is done. The two are therefore not redundant: the scan is the
+repo-wide backstop, the rule is the finer instrument. `noCompensation: false` is the inferred state
+written out and is still reported.
+
+### `store-route-scopes-tenant-data` (dielime only) — Medusa-specific
+
+`/api/store/**/route.ts` is a Medusa convention. It is in `backend-medusa`, and also in
+`tenant-scoping` because that is what it enforces.
+
+### `no-logic-in-component-files` — dielime's narrowed version
+
+during.day's version also reported type re-exports and custom hooks in component files. Both are
+covered by dedicated rules in the union (`no-type-definitions-in-components`,
+`no-hook-in-component-disguise`), and during.day's own suite does not test this rule. dielime's
+narrower "one public component per file" version is the one under test, and the one kept.
+
+### `tissue-must-compose` — dielime's, minus its backstop
+
+dielime added a "renders ANY PascalCase tag" backstop. during.day has a test proving that backstop
+lets a tissue satisfy the gate by rendering a component it imported as a **type** — precisely the
+lint-theater the rule exists for. The backstop is dropped; dielime's broader `COMPOSITION_PATTERNS`
+(feature barrels, `.parts`/`.sections` siblings, react-email primitives) already recognise real
+arrangements, and dielime's fixtures stay green without it.
+
+### `cell-must-not-compose-cell` — the union's two halves collided on the barrel
+
+The kit's version is dielime's scope (`(?:^|/)cells/`, so the rule reaches a `packages/ui` tree with
+no `features/<name>/` segment) plus during.day's visitors (`ExportAllDeclaration` and
+`ExportNamedDeclaration`, so a cell cannot launder an import through `export … from`). Each half is
+right. Together, unguarded, they reported every `cells/index.ts` barrel — because a barrel is
+nothing but `export … from` lines naming sibling cells. dielime's first adoption produced 32 such
+errors, and every one of them was a file obeying `cells-folder-index-is-barrel`, which is also an
+error and demands exactly that shape.
+
+Neither fork could see it:
+
+- **dielime** had the broad scope but visited `ImportDeclaration` only, so the re-exports in its
+  barrels were invisible to the rule;
+- **during.day** visited all three, but scoped to `features/[^/]+/cells/`, and it has no
+  `cells/index.ts` or `cells/dynamic.ts*` anywhere in `apps/` or `packages/` — nothing to collide
+  with.
+
+So: `cell-must-not-compose-cell` returns an empty visitor for the barrel files
+`cells-folder-index-is-barrel` sanctions. A real cell importing — or re-exporting — another cell
+still fires. The list of barrel filenames lives once, in `src/rules/lib/cells-barrel.ts`, and both
+rules read it; two copies of that list is how two rules came to demand opposite things of one file.
+Closing it also fixed a hole in the barrel rule's own pattern, which required a leading `/` and
+therefore no-op'd on the cwd-relative `cells/index.ts` oxlint reports for a package whose own root
+holds `cells/`.
+
+### `documents-share-one-table` — matches `pgTable` as well as `sqliteTable`
+
+during.day's fork matched `literalNamedBy(node, 'sqliteTable')` and nothing else, and every tenant
+table on that tree has been `pgTable` since its plan 037. Its own probe: a well-formed per-kind
+table
+
+```ts
+export const invoices = pgTable('invoices', { id: text('id').primaryKey(), orgId: orgIdColumn() })
+```
+
+under `packages/db/src/schema/tenant/` produced **zero** findings from this rule; only the malformed
+variant was caught, by `tenant-tables-carry-org-id`, and by accident. The fork's rule had been dead
+since the tenant plane moved to Postgres.
+
+The kit matching both constructors is therefore a fix, not a widening for its own sake. It stands
+because the rule is about the second storage a base entity retired — which is true whatever the
+dialect — and because `dialect-through-the-seam` already says the dialect is a seam fact rather than
+a thing a document kind gets to have an opinion about. Both branches are exercised through the real
+binary in `src/rules/__fixtures__/packages/db/src/schema/tenant/`, so neither can go quiet again.
+
+### `no-raw-html-atoms` — the tier it was always documented for (0.3.0)
+
+Its own description said levels 2-6 and it fired at every level, `atoms/` included, where a raw
+`<button>` is not a violation but the whole point of the file. dielime armed it by switching the rule
+off over `**/atoms/**` in its own config: a repo carrying the kit's defect as configuration.
+
+It is now silent inside the atom tier — `(?:^|/)(?:features/[^/]+/)?atoms/`, the merged pattern from
+`src/rules/lib/tiers.ts`, which reaches a flat kit as well as a feature-sliced app.
+
+**The default is not an allow-list of the five upper tiers**, and that is the load-bearing decision.
+A real tree has files in no tier folder at all — a Medusa admin widget, a Next route segment, a
+one-off surface — and the atom exists there too. Scoping to the five named tiers would have dropped
+about a quarter of one consumer's findings in the same commit that called itself a fix, which is a
+rule getting quieter with a fix's clothes on. So: **everywhere except the atom tier**, and a repo that
+wants less says so:
+
+```jsonc
+"biological-architecture/no-raw-html-atoms": [
+  "error",
+  [{ "element": "button", "atom": "Button", "importPath": "@kit/ui/atoms/button" }],
+  { "scope": ["cells", "tissues"] }
+]
+```
+
+A `scope` naming something that is not a tier stops the run rather than matching nothing — the inert
+rule the option refusal exists to stop, one option along.
+
+### Other repo-specific literals turned into options
+
+| Rule | Option | Unconfigured |
+|---|---|---|
+| `organelle-dependency` | `sharedFeatures` | `['shared']` — during.day's `charts`/`document` are config, not law |
+| `mutating-step-declares-retry` | `retryKey` | `maxRetries` — Medusa's key. `@geonosis/workflows` spells the same budget `retry: { limit, backoff }` (`create-step.ts`), and with the key compiled in a correctly budgeted step on that engine was a finding for ever |
+| `mutating-step-declares-retry` | `retryLimitKey` | `limit` — the key that holds the NUMBER when the budget is an object. #191: reading only the bare form let `retry: { limit: 0 }` pass, which is the same silence as `maxRetries: 0` |
+| `documents-share-one-table` | `perKindTables` | **refuses the run** |
+| `worker-handles-are-scoped` | `within` + `wrapper` | **refuses the run** — `withCells` and `/apps/api/src/` were compiled in, so the rule served one repo's layout and one repo's vocabulary and a scope opener called anything else read as unscoped for ever |
+| `subpath-over-barrel` | `packages` (`{ name, subpaths: { <subpath>: string[] } }[]`) | **refuses the run** — which of a repo's own packages expose subpaths, and which names live under each, is a map only that package's owner has |
+| `durable-body-reads-through-steps` | `ports` | **refuses the run** — what a body reaches the outside world through is the repo's vocabulary; `durableKey` / `durableValue` (default `durable: true`) say how a workflow declares itself durable |
+| `document-sagas-are-generic` | `perKindPrefixes` | **refuses the run** |
+| `document-sagas-are-generic` | `within` | **refuses the run** — `/packages/workflows/src/` was compiled in, so the same per-kind saga one directory over was silent and no other layout could enable the rule at all |
+| `document-sagas-are-generic` | `factories` | `['saga', 'createWorkflow']` — the callee was `saga` alone, so a per-entity `createWorkflow('invoice.create', …)` produced no finding (026-W2, measured). A name assembled from the entity is a template literal the rule cannot read: that is the mint the rule sends people to, not a gap in it |
+| `unique-query-step-name` | `queryStepCalls` | **refuses the run** — the two names it shipped with are Medusa framework calls with no counterpart, so on the org engine the rule had zero reach while reading as enforced (026-W2, measured through the binary). There is no second spelling to inherit: `@geonosis/workflows` has no query-step primitive, and a repeated step name there is DEFINED rather than lost — `reserve`, `reserve#2` in call order (`engine.ts:124`) |
+| `no-raw-html-atoms` | (positional) element→atom map | **refuses the run** |
+| `no-raw-html-atoms` | `scope` (second positional, `{ scope: ["cells", …] }`) | every file except the atom tier |
+
+Package specifiers in diagnostics (`@dielime/ui`, `@during/utils/time`) were made generic, and
+`CLAUDE.md §…` citations were removed: they pointed at a law file this package does not ship, and
+the remedy now lives in each rule's `fixShape`.
+
+### The rule core (0.4.0) — `src/rules/lib/`
+
+Measured on 2026-08-29, before any of it existed: **37 of 54 rules normalised the filename
+themselves**, in three spellings, one of which (`replace(/\\/g, …)` without the global flag in an
+earlier fork) fixed only the first separator. **21 parsed an import source themselves**, and each
+covered a different subset of the five ways a file can name another. **11 hand-wrote the same
+re-export visitor.** None of that was decided; it was the order the rules were written in, and one
+fix to how a path is read had to be found rule by rule.
+
+| module | what it is the one door for |
+|---|---|
+| `lib/paths.ts` | `normalise` (backslashes → `/`), `fileOf` (the last segment, as a diagnostic names it) |
+| `lib/tiers.ts` | `TIERS`, `inTier`, `tierOf`, `featureOf`, `requireTiers` — the ONE classification |
+| `lib/imports.ts` | `sourceOf` (import · `export … from` · `export * from` · `import()` · `require()`), `isTypeOnly`, `resolveRelative` |
+| `lib/visitors.ts` | `onImportSource` — one visitor set over all five shapes — and `mergeVisitors` |
+| `lib/direction-rule.ts` | `directionRule()`: a direction rule as a declaration (scope, forbidden, messages) |
+| `lib/options.ts` | `requireOption` — an enabled rule that cannot fire refuses the run |
+| `lib/cells-barrel.ts` | the barrel list two rules must agree on |
+| `lib/literal-call.ts` | the string a `saga('x', …)`-shaped call names |
+
+The **Core** column in the preset table below says which of these each rule stands on. `paths` alone
+means the rule reads a filename and nothing else; `directionRule` means the rule file is a
+declaration and holds no mechanism at all.
+
+`onImportSource` visits a type-only import only when the rule counts one. Four do:
+`no-orm-outside-db` and `dialect-through-the-seam` say why in their docs (a type borrowed from the
+ORM is a line a replacement would still have to rewrite), and `atom-no-deps` and
+`molecule-atoms-only` inherited it from dielime — an atom that borrows a domain's type is an atom
+that knows a domain. The other six direction rules skip them, as they always did.
+
+### Direction rules resolve relative imports (0.4.0)
+
+**Before:** `cell-must-not-compose-cell` and `layer-walls` resolved a relative source against the
+importing file before judging it. The other eight direction rules read the string as written, so
+`../../billing/organelles/totals` — which names no feature and no tier until it is resolved — was
+invisible to them. Whether a relative climb across a feature boundary was a finding depended on
+which rule happened to look at it. during.day's A2b probe found this; it was one resolver in two
+rules and no resolver in eight.
+
+**Now:** the classification every direction rule judges by goes through `resolveRelative` once, in
+the factory. Where an import LANDS is the fact; how it was spelled is what the message prints.
+
+**Corrected in 0.5.0, by measurement.** "Ten rules now resolve relative imports" is true of the
+mechanism and misleading about the effect: resolution changes the ANSWER for only the rules whose
+forbidden pattern is **feature-anchored** — `features/<name>/stores/`, `features/<name>/organelles/`
+— because a relative climb carries no `features/` segment until it is resolved. The other seven
+forbid an unanchored substring (`stores/`, `cells/`, `/organelles/`, `molecules/`) which a relative
+source contains as written, so they caught the relative spelling before 0.4.0 and after it alike.
+0.3.0 against 0.5.0 over a corpus of relative-only cases, one per rule, in
+`proofs/021-relative-spellings/`: three rules answer differently, and one of the three is 0.5.0's own
+new one. Two rules changed in 0.4.0, which is exactly what 0.4.0's parity table measured.
+
+**What 0.5.0 added is reach evidence, not behaviour.** Every direction rule now carries BOTH
+spellings in the shipped corpus — the aliased one and a relative climb — so a consumer who meets one
+of them has a fixture to check their install against. `no-orm-outside-db` is the exception: its
+target is a bare package specifier, so a relative case is not expressible for it.
+
+This is a **widening**, and it is the only behaviour change in K1.2. Its scope is measured, not
+argued — `proofs/018-T3-relative-imports/`:
+
+| tree | A | B | lost | gained |
+|---|---:|---:|---:|---:|
+| the kit's corpus | 99 | 101 | 0 | 2 — `no-cross-feature-stores` and `organelle-dependency`, on the two fixtures written RED for this |
+| dielime, its own config, `apps packages` | 135 | 135 | 0 | 0 |
+
+dielime's zero is not luck: that tree has seven relative cross-feature imports of a store or an
+organelle, five of them into `shared/organelles/*` (which `organelle-dependency`'s `sharedFeatures`
+option permits) and two of them in **cells** reaching another feature's organelle — which no rule
+here polices, because `organelle-dependency` is scoped to `organelles/` and `no-cross-feature-stores`
+only looks at stores. That gap is real and is not this decision's to close — it is closed in 0.5.0
+by `cell-no-cross-feature-organelles`, below.
+
+### `cell-no-cross-feature-organelles` (written here, from the gap above) — 0.5.0
+
+The boundary the two rules above draw from two sides had a hole in the middle. `organelle-dependency`
+is scoped to `organelles/`: it stops an organelle reaching sideways into another feature's organelle,
+and says nothing about who imports it. `no-cross-feature-stores` is scoped to cells AND organelles,
+but only judges `features/<x>/stores/`. So a **cell** importing another feature's **organelle** — a
+hook holding that feature's state, pulled across the boundary — passed both.
+
+It is not hypothetical. dielime, on its own config, with the rule enabled through a temporary config
+and nothing else changed:
+
+| site | import |
+|---|---|
+| `apps/web/src/features/site/cells/site-chrome.tsx:27` | `../../checkout/organelles/use-payment-providers-effect` |
+| `apps/web/src/features/site/cells/site-chrome.tsx:28` | `../../search/organelles/search-autocomplete` |
+| `apps/web/src/features/cart/cells/cart-view.tsx:12` | `../../checkout/organelles/use-payment-providers-effect` |
+
+Three findings in two files — the 0.4.0 note above said "two", counting files rather than imports.
+All three are relative climbs, so none of them would have been visible before 0.4.0's widening; five
+further climbs in that tree land in `shared/organelles/*` and are allowed, which is what the
+`sharedFeatures` option (default `['shared']`, the same default and the same meaning as
+`organelle-dependency`'s) is for.
+
+The rule is a `directionRule()` declaration: scope is the `cells` tier pattern, so it reaches a
+feature-sliced app and a flat kit alike, and the forbidden target is an organelle of a feature that
+is neither the importer's own nor named in `sharedFeatures`. Relative and aliased sources are judged
+the same way, because the factory resolves before it judges. Preset: `frontend`.
+
+## Presets
+
+`recommended` = `frontend`. `themekit` exists because both its rules are **inert until a repo says
+how its own tokens are spelled** — the custom-property prefix and the font role names are that
+repo's data, and either one guessed at would be one stylesheet wearing a preset's name. It is also
+the preset a repo can want without wanting a tier vocabulary: a component library conforms to a
+theme whether or not it is organised biologically. `backend-d1` exists because `no-d1-transaction` and
+`worker-handles-are-scoped` are **false** on any other engine — a generic backend preset carrying
+them would be a repo fact wearing a preset's name. `backend-workflows-cf` exists for the same reason:
+`step-opens-its-own-cell` is true of a durable run on Cloudflare Workflows and false of an inline
+one. It was called `backend-sagaflow-cf` until 1.5.0, after the engine it was written for; the old
+name resolves to the same rules for ONE release and says so once, then goes. `package-subpaths` exists because `subpath-over-barrel` is inert until a repo writes out which
+of ITS packages expose subpaths and which names live under each — a map only that package's owner
+has, and one a kit that guessed at it would keep stale on somebody else's behalf.
+
+| Rule | Preset(s) | Requires | Core | In dielime | In during.day | Same code |
+|---|---|---|---|---|---|---|
+| `atom-no-deps` | frontend | — | `directionRule` | yes | yes | diverged |
+| `boundary-time-is-primitive` | backend-workflows | `types` | `nodes` + `paths` + `options` | — | — | **written here** (D-050, #145) |
+| `cell-must-be-stateful` | frontend | — | `paths` | yes | — | dielime only |
+| `cell-must-not-compose-cell` | frontend | — | `directionRule` + `cells-barrel` | yes | yes | diverged |
+| `cell-no-cross-feature-organelles` | frontend | — | `directionRule` | — | — | **written here** |
+| `cell-no-tissues` | frontend | — | `directionRule` | yes | yes | diverged |
+| `cells-folder-index-is-barrel` | frontend | — | `paths` + `cells-barrel` | yes | yes | diverged |
+| `compound-must-be-stateless` | frontend | — | `paths` | yes | yes | diverged |
+| `compound-no-stores` | frontend | — | `directionRule` | yes | yes | diverged |
+| `constants-in-constants-file` | backend-workflows | — | `paths` | — | yes | during only |
+| `dialect-through-the-seam` | backend-workflows | — | `onImportSource` + `mergeVisitors` + `paths` | — | yes | during only |
+| `document-sagas-are-generic` | backend-workflows | `perKindPrefixes` | `paths` + `options` + `literal-call` | — | yes | during only |
+| `documents-share-one-table` | backend-workflows | `perKindTables` | `paths` + `options` + `literal-call` | — | yes | during only |
+| `durable-body-reads-through-steps` | backend-workflows | `ports` | `nodes` + `objects` + `steps` + `options` | — | — | **written here** (#167, design-026 §8) |
+| `effect-hook-naming` | frontend | — | `paths` | yes | yes | diverged |
+| `emit-declares-attempts` | backend-medusa | — | `options` | — | — | **written here** |
+| `font-roles-only` | themekit | `roles` | `paths` + `options` + `styling` | — | — | **written here** (U2) |
+| `layer-walls` | tooling | `layers` | `onImportSource` + `imports` + `paths` + `options` | — | — | **written here** |
+| `max-comment-density` | comment-ceiling | — | `paths` | — | yes | during only |
+| `molecule-atoms-only` | frontend | — | `directionRule` | yes | yes | diverged |
+| `molecule-must-compose` | frontend | — | — | yes | yes | diverged |
+| `mutating-step-declares-retry` | backend-medusa + backend-workflows | — | `nodes` + `objects` + `steps` + `options` | — | — | **written here** (dielime scan R5.2) |
+| `named-when-block` | backend-medusa | — | `nodes` + `options` | — | — | **written here** (dielime scan R5.5) |
+| `next-route-segment-is-thin-delegate` | frontend | — | `paths` | yes | yes | diverged |
+| `no-unregistered-plugin-dir` | integrations | `roots` | `options` + `paths` | — | — | **written here** (Midday's 8 dead dirs) |
+| `no-mock-db-in-integration` | testbed | `integrationDirs` | `options` + `paths` | — | — | **written here** (Midday's 35 mocked router suites) |
+| `router-schema-parity` | backend-trpc | `routers` | `options` + `paths` | — | — | **written here** (during.day's mirror) |
+| `no-brand-names` | frontend | `brands` | `paths` + `options` | yes | — | dielime only |
+| `no-card-shaped-div` | frontend | — | — | yes | yes | diverged |
+| `no-cross-feature-stores` | frontend | — | `directionRule` | yes | yes | diverged |
+| `no-d1-transaction` | backend-d1 | — | `paths` | — | yes | during only |
+| `no-duplicate-jsx-patterns` | frontend | — | `paths` | yes | yes | diverged |
+| `no-hook-in-component-disguise` | frontend | — | `paths` | yes | yes | diverged |
+| `no-index-count-as-exact` | backend-medusa | — | `nodes` + `objects` + `options` | — | — | **written here** (Medusa source) |
+| `no-inert-hidden-jsx` | frontend | — | `paths` | yes | yes | diverged |
+| `no-inline-data-in-jsx` | frontend | — | `paths` | yes | yes | diverged |
+| `no-invalid-feature-folders` | frontend | — | `paths` | yes | yes | diverged |
+| `no-loader-side-effect-in-index-file` | backend-medusa | — | `nodes` + `paths` + `options` | — | — | **written here** (dielime scan #15442) |
+| `no-logic-in-component-files` | frontend | — | `paths` | yes | yes | diverged |
+| `plugin-route-namespaced` | backend-medusa | `packages` | `paths` + `options` | — | — | **written here** (dielime scan R3.8) |
+| `no-orm-outside-db` | backend-workflows | — | `directionRule` | — | yes | during only |
+| `no-raw-html-atoms` | frontend | `element→atom map` | `tiers` + `options` | yes | yes | diverged |
+| `no-raw-sql-outside-allowed` | backend-workflows | — | `paths` | — | yes | during only |
+| `no-react-namespace` | frontend | — | — | yes | yes | **identical** |
+| `no-renamed-html-props` | frontend | — | — | yes | yes | **identical** |
+| `no-render-prop-reader` | frontend | — | `paths` | yes | yes | diverged |
+| `no-trivial-wrapper-component` | frontend | — | `paths` | yes | yes | diverged |
+| `no-ts-in-bio-folders` | frontend | — | `paths` | yes | yes | diverged |
+| `no-type-definitions-in-components` | frontend | — | `paths` | yes | yes | diverged |
+| `no-void-port` | backend-workflows | — | — | — | yes | during only |
+| `organelle-dependency` | frontend | — | `directionRule` | yes | yes | diverged |
+| `organelle-single-source` | frontend | — | `onImportSource` + `mergeVisitors` + `paths` | yes | yes | diverged |
+| `queries-require-org-scope` | tenant-scoping | — | `paths` | — | yes | during only |
+| `queue-loop-is-the-library` | backend-workflows | — | — | — | yes | during only |
+| `route-no-inline-mutation` | backend-medusa | — | `nodes` + `paths` + `comments` + `options` | — | — | **written here** (dielime scan R5.1) |
+| `service-name-not-reserved` | backend-medusa | — | `nodes` + `objects` + `options` | — | — | **written here** (Medusa source) |
+| `ssot-no-inline-facts` | backend-workflows | — | `paths` | — | yes | during only |
+| `ssot-no-process-env` | backend-workflows | — | `paths` | — | yes | during only |
+| `step-declares-compensation-or-none` | backend-medusa + backend-workflows | — | `nodes` + `objects` + `steps` + `options` | — | — | **written here** (Medusa source) |
+| `step-opens-its-own-cell` | backend-workflows-cf | `within` | `nodes` + `objects` + `paths` + `options` | — | yes | during only, re-targeted |
+| `store-route-scopes-tenant-data` | backend-medusa + tenant-scoping | — | `paths` | yes | — | dielime only |
+| `subpath-over-barrel` | package-subpaths | `packages` | `nodes` + `options` | — | — | **written here** (#180, during.day asked) |
+| `subscriber-declares-id` | backend-medusa | — | `objects` + `paths` + `options` | — | — | **written here** (dielime scan R5.4) |
+| `tables-declare-their-plane` | backend-workflows + tenant-scoping | — | `paths` + `literal-call` | — | yes | during only |
+| `tenant-tables-carry-org-id` | tenant-scoping | — | `paths` + `literal-call` | — | yes | during only |
+| `tokens-only-colors` | themekit | `tokenPrefix` | `paths` + `options` + `styling` + `colors` | — | — | **written here** (U2) |
+| `time-through-the-door` | backend-workflows | `door` | `paths` + `options` | — | yes | during only, de-hardcoded |
+| `tissue-must-compose` | frontend | — | `paths` | yes | yes | diverged |
+| `tissue-no-data-props` | frontend | — | `paths` | yes | yes | diverged |
+| `tissue-no-hooks` | frontend | — | `paths` | yes | yes | diverged |
+| `tissue-no-organelles` | frontend | — | `directionRule` | yes | yes | diverged |
+| `tissue-no-stores` | frontend | — | `directionRule` | yes | yes | diverged |
+| `todo-names-its-plan` | tooling | `markers` | `comments` + `options` | — | — | **written here** (W28) |
+| `unique-query-step-name` | backend-medusa | `queryStepCalls` | `nodes` + `objects` + `options` | — | — | **written here** (dielime scan R4.3) |
+| `worker-handles-are-scoped` | backend-d1 | `within` | `paths` + `options` | — | yes (as `cell-handles-are-scoped`) | during only, de-hardcoded |
+| `zustand-v5-best-practices` | frontend | — | — | yes | yes | **identical** |
+
+Preset sizes: frontend 36 · backend-workflows 16 · backend-medusa 12 · tenant-scoping 4 ·
+backend-d1 2 · tooling 2 · themekit 2 · backend-workflows-cf 1 · backend-trpc 1 · integrations 1 ·
+package-subpaths 1 · testbed 1 · comment-ceiling 1 (+ `capitalized-comments`, which is oxlint's own
+and only makes sense alongside the density rule).
+
+`backend-workflows` and `backend-medusa` OVERLAP by two: `mutating-step-declares-retry` and
+`step-declares-compensation-or-none` reach both engines' spellings — measured in 026-W2, and true of
+the retry rule only since its key became an option — so both presets carry them. Moving either out
+of `backend-medusa` would take a live rule away from the repo it was written for, which is a
+downgrade wearing a preset change. `unique-query-step-name` stays Medusa's alone: the collision it
+reports is that framework's step-handler map last-winning, and a repeated step name on the org
+engine is DEFINED rather than lost (`reserve`, `reserve#2`, `engine.ts:124`).
+
+## The build
+
+Two builds existed. during.day's `package.json` resolves `.` through a `bun` condition to
+`src/index.ts` and only falls back to `dist/index.js`; without bun, oxlint gets the fallback anyway.
+dielime's is the plain one — `tsup … --format esm --no-dts --platform node --out-dir dist` with
+`"exports": { ".": "./dist/index.js" }` — and that is what this package uses.
+
+It is **source-proven**, not assumed: `src/rules/fixtures.test.ts` runs the real `oxlint` binary with
+`jsPlugins: ["@geonosis/oxlint-plugin-biological-architecture"]` over the fixture tree and asserts
+first that *something* fired. A plugin oxlint cannot load reports nothing, and every "should NOT
+fire" case would pass silently without that assertion.
+
+## `fixShape`
+
+Every rule exports `{ meta, create, fixShape }`. `fixShape` is a short Markdown string in the voice
+of during.day's `during-code` skill: what the gate rejects and what to write instead.
+`pnpm generate:skill` assembles them into `skills/geonosis-code/SKILL.md`, grouped by preset. A
+staleness test fails when the committed skill is not what the rules generate, so the skill and the
+rules cannot drift.
+
+## `probe`
+
+The twenty-six rules whose reach depends on an option also export `probe(options)`, beside `fixShape`. It
+returns `{ path, source }` — the smallest file that MUST fire the rule under the options it was
+handed, at a path satisfying every PATH option the rule reads — or `{ files: [{ path, source }, …] }`
+when one file cannot be enough. A single-file probe stays the bare form; readers accept both, and
+must, because a consumer runs whatever plugin build it has installed.
+
+It exists because a rule whose REACH is an option can never fire on a FIXED corpus. The fixtures
+here say `acme` and `corpus/workflows/`; a repo says its own brand and `packages/workflows/src/`,
+so `no-brand-names` and `step-opens-its-own-cell` read as firing nowhere in the two trees that
+enforce them on every file — which is what both source repos reported against themselves on
+2026-08-30. `@geonosis/doctor`'s `exercised` check reads `probe` off the plugin a config loads,
+writes it into a copy of the corpus, and runs again.
+
+A probe is a CLAIM, so `src/probes.test.ts` tries to break every one of them through the real
+binary, under consumer-shaped options, and requires exactly one finding. Two rules deserve the
+detail:
+
+- `no-unregistered-plugin-dir` reads its registry off disk, so its probe fires only when the
+  configured registry is also in the tree. One file cannot be both the plugin directory and the
+  registry, so its probe declares BOTH — the directory under `roots`, and a registry carrying no
+  string literal at all, so nothing in it can name the directory beside it. It was a single file
+  until 2026-08-30 and fired nothing, which was the truth about the probe and a lie about every
+  consumer: dielime enforces this rule at error over four registries and read as a permanent FAIL
+  for it.
+- `layer-walls` and the path-regex options are inverted by `lib/probe.ts`'s `pathMatching`, which
+  builds a path back out of the pattern and then TESTS it against that pattern, refusing with a
+  sentence when the inversion does not hold. It is deliberately not a general regex inverse, and it
+  is never trusted.
+
+<!-- GENERATED: the options each rule accepts -->
+
+## The options each rule accepts
+
+One line per rule, from the rule’s own schema — the shape oxlint validates a config against.
+Which of them a rule REFUSES to run without is the `Requires` column of the inventory above; an
+option not named here is one no rule reads.
+
+| Rule | Options it accepts |
+|---|---|
+| `atom-no-deps` | — |
+| `boundary-time-is-primitive` | `doors`, `types` |
+| `cell-must-be-stateful` | — |
+| `cell-must-not-compose-cell` | — |
+| `cell-no-cross-feature-organelles` | `sharedFeatures` |
+| `cell-no-tissues` | — |
+| `cells-folder-index-is-barrel` | — |
+| `compound-must-be-stateless` | — |
+| `compound-no-stores` | — |
+| `constants-in-constants-file` | — |
+| `dialect-through-the-seam` | — |
+| `document-sagas-are-generic` | `factories`, `perKindPrefixes`, `within` |
+| `documents-share-one-table` | `perKindTables` |
+| `durable-body-reads-through-steps` | `durableKey`, `durableValue`, `ports`, `stepFactories`, `workflowFactories` |
+| `effect-hook-naming` | — |
+| `emit-declares-attempts` | `budgetHelpers`, `emitters` |
+| `font-roles-only` | `allow`, `prefix`, `roles` |
+| `layer-walls` | `externals`, `layers`, `typeOnly` |
+| `max-comment-density` | — |
+| `molecule-atoms-only` | — |
+| `molecule-must-compose` | — |
+| `mutating-step-declares-retry` | `mutationPrefixes`, `retryKey`, `retryLimitKey`, `stepFactories` |
+| `named-when-block` | `blocks` |
+| `next-route-segment-is-thin-delegate` | — |
+| `no-brand-names` | `allowedSubstrings`, `brands` |
+| `no-card-shaped-div` | — |
+| `no-cross-feature-stores` | — |
+| `no-d1-transaction` | — |
+| `no-duplicate-jsx-patterns` | — |
+| `no-hook-in-component-disguise` | — |
+| `no-index-count-as-exact` | `estimateFields`, `labelKey` |
+| `no-inert-hidden-jsx` | — |
+| `no-inline-data-in-jsx` | — |
+| `no-invalid-feature-folders` | — |
+| `no-loader-side-effect-in-index-file` | `directories`, `resourceFactories` |
+| `no-logic-in-component-files` | — |
+| `no-mock-db-in-integration` | `dbModules`, `integrationDirs`, `mockNames` |
+| `no-orm-outside-db` | — |
+| `no-raw-html-atoms` | (a positional list), `scope` |
+| `no-raw-sql-outside-allowed` | — |
+| `no-react-namespace` | — |
+| `no-renamed-html-props` | — |
+| `no-render-prop-reader` | — |
+| `no-trivial-wrapper-component` | — |
+| `no-ts-in-bio-folders` | — |
+| `no-type-definitions-in-components` | — |
+| `no-unregistered-plugin-dir` | `manifests`, `registry`, `roots` |
+| `no-void-port` | — |
+| `organelle-dependency` | `sharedFeatures` |
+| `organelle-single-source` | — |
+| `plugin-route-namespaced` | `packages`, `scopes` |
+| `queries-require-org-scope` | — |
+| `queue-loop-is-the-library` | — |
+| `route-no-inline-mutation` | `inlineMutationOk`, `mutationPrefixes`, `paths` |
+| `router-schema-parity` | `ignore`, `mounts`, `routers`, `schemas`, `suffix` |
+| `service-name-not-reserved` | `moduleFactories`, `reserved` |
+| `ssot-no-inline-facts` | — |
+| `ssot-no-process-env` | — |
+| `step-declares-compensation-or-none` | `stepFactories` |
+| `step-opens-its-own-cell` | `engine`, `hosts`, `scopeKey`, `within`, `wrapper` |
+| `store-route-scopes-tenant-data` | — |
+| `subpath-over-barrel` | `packages` |
+| `subscriber-declares-id` | `paths` |
+| `tables-declare-their-plane` | — |
+| `tenant-tables-carry-org-id` | — |
+| `time-through-the-door` | `door`, `exempt`, `libraries` |
+| `tissue-must-compose` | — |
+| `tissue-no-data-props` | — |
+| `tissue-no-hooks` | — |
+| `tissue-no-organelles` | — |
+| `tissue-no-stores` | — |
+| `todo-names-its-plan` | `id`, `markers` |
+| `tokens-only-colors` | `allow`, `tokenPrefix` |
+| `unique-query-step-name` | `queryStepCalls`, `workflowFactories` |
+| `worker-handles-are-scoped` | `within`, `wrapper` |
+| `zustand-v5-best-practices` | — |
+
+<!-- END GENERATED -->
+
+<!-- GENERATED: the floor each rule’s pattern belongs to -->
+
+## The floor each rule’s pattern belongs to
+
+A rule here lints a pattern one of the kit’s floors implements. While the floor is PENDING the
+rule is a requirement with nothing to install behind it — a repo enabling it writes the pattern
+itself, and the doctor says so on the `exercised` line.
+
+| Rule | Floor | Shipped |
+|---|---|---|
+| `document-sagas-are-generic` | `document` | PENDING |
+| `documents-share-one-table` | `document` | PENDING |
+| `step-opens-its-own-cell` | `workflows` | yes |
+
+<!-- END GENERATED FLOORS -->

package/corpus/engine/bad-nested-zero-retry.ts

@@ -0,0 +1,9 @@
+import { createStep } from '@corpus/workflows'
+
+// BREACH: the default spelled out one level down. `limit: 0` inside this engine's budget object is
+// the same silence as Medusa's `maxRetries: 0` — the first dropped connection reverts the write.
+export const publish = createStep(
+  { name: 'publish', retry: { backoff: 'exponential', limit: 0 } },
+  async (input, { store }) => store.createDocument(input),
+  async ({ id }, { store }) => store.deleteDocument(id),
+)

package/dist/index.js

@@ -899,6 +899,7 @@ through \`perKindPrefixes\`, the tree that holds the flows through \`within\` (a
 filename), and \`factories\` if the repo declares them under other names; enabled without
 \`perKindPrefixes\` or \`within\` the rule refuses the run.`,
   meta: {
+    floor: { name: "document", pending: true },
     docs: {
       description: "Document sagas are minted, not written: `documentSagas(entity, effects)` gives every entity that extends Document its create/save/setStatus/remove/send/convert/duplicate/share from one body. A saga or workflow named with a LITERAL for one entity is a fork; a name assembled from the entity is the mint and is unreadable here on purpose. `factories`, `perKindPrefixes` and `within` are options."
     },
@@ -963,6 +964,7 @@ the dialect is a seam fact, not a reason for a kind to own storage. The forbidde
 \`perKindTables\` option; enabled without it the rule refuses the run rather than passing every
 schema silently.`,
   meta: {
+    floor: { name: "document", pending: true },
     docs: {
       description: "Documents share ONE table: `documents` holds the head every kind derives and the body its kind declares. A table named for one kind of document is a second storage."
     },
@@ -1842,6 +1844,7 @@ var writeNameOf = (node) => propertyNameOf(node.callee ?? {}) ?? "a service writ
 // src/rules/mutating-step-declares-retry.ts
 var RULE5 = "mutating-step-declares-retry";
 var DEFAULT_RETRY_KEY = "maxRetries";
+var DEFAULT_RETRY_LIMIT_KEY = "limit";
 var NO_RETRY2 = 0;
 var mutatingStepDeclaresRetry = {
   create(context) {
@@ -1852,6 +1855,11 @@ var mutatingStepDeclaresRetry = {
       context.options?.[0]?.retryKey ?? DEFAULT_RETRY_KEY,
       "retryKey"
     );
+    const retryLimitKey = requireOption(
+      RULE5,
+      context.options?.[0]?.retryLimitKey ?? DEFAULT_RETRY_LIMIT_KEY,
+      "retryLimitKey"
+    );
     return {
       CallExpression(node) {
         if (!isStepCall(node, factories)) return;
@@ -1874,10 +1882,13 @@ var mutatingStepDeclaresRetry = {
           context.report({ data: { key: retryKey, step }, messageId: "noRetry", node });
           return;
         }
-        if (budget.type !== "Literal" || typeof budget.value !== "number") return;
-        if (budget.value > NO_RETRY2) return;
+        const nested = propertiesOf(budget);
+        const declared = nested === null ? budget : valueOf(nested, retryLimitKey);
+        if (declared === void 0) return;
+        if (declared.type !== "Literal" || typeof declared.value !== "number") return;
+        if (declared.value > NO_RETRY2) return;
         context.report({
-          data: { budget: String(budget.value), key: retryKey, step },
+          data: { budget: String(declared.value), key: retryKey, step },
           messageId: "zeroRetries",
           node
         });
@@ -1888,14 +1899,16 @@ var mutatingStepDeclaresRetry = {
 \`createStep({ name: 'place-order', ...RETRY_DB }, invoke, compensate)\`. A retry budget defaults to
 none, so a step named with a bare string cannot have one \u2014 take the object form and put the budget in
 it, from the repo's shared retry constants rather than as a number at the call site. A budget the
-rule cannot evaluate (a constant, a spread, a nested \`{ limit, backoff }\`) passes: it says nothing
-rather than pushing the number back inline. Read-only and compute steps are exempt \u2014 there is nothing
-to revert. Configure \`retryKey\` to the key this engine writes the budget under (Medusa's
-\`maxRetries\`, the org engine's \`retry\`), \`stepFactories\` if the repo wraps \`createStep\`, and
-\`mutationPrefixes\` if its writes are named otherwise.`,
+rule cannot evaluate (a constant, a spread) passes: it says nothing rather than pushing the number
+back inline. A budget written as an OBJECT is read one level down \u2014 \`retry: { limit: 0 }\` is the
+default spelled out and is reported, \`{ limit: 3 }\` is not, and an object naming no limit at all
+says nothing. Read-only and compute steps are exempt \u2014 there is nothing to revert. Configure
+\`retryKey\` to the key this engine writes the budget under (Medusa's \`maxRetries\`, the org engine's
+\`retry\`), \`retryLimitKey\` if the number inside that object is not \`limit\`, \`stepFactories\` if
+the repo wraps \`createStep\`, and \`mutationPrefixes\` if its writes are named otherwise.`,
   meta: {
     docs: {
-      description: "A mutating step declares a retry class. A budget left unsaid defaults to zero retries, so a transient failure reverts real state a retry would have absorbed. Read-only steps are exempt; a non-literal budget passes. `retryKey`, `stepFactories` and `mutationPrefixes` are options."
+      description: "A mutating step declares a retry class. A budget left unsaid defaults to zero retries, so a transient failure reverts real state a retry would have absorbed. Read-only steps are exempt; a non-literal budget passes, and an object budget is read one level down. `retryKey`, `retryLimitKey`, `stepFactories` and `mutationPrefixes` are options."
     },
     messages: {
       noConfig: 'Step "{{step}}" writes but is named with a bare string, so it carries no retry class \u2014 and `{{key}}` defaults to 0, which means a transient failure reverts real state. Take the object form and give it a retry class from the shared constants.',
@@ -1908,6 +1921,7 @@ to revert. Configure \`retryKey\` to the key this engine writes the budget under
         properties: {
           mutationPrefixes: { items: { type: "string" }, type: "array" },
           retryKey: { type: "string" },
+          retryLimitKey: { type: "string" },
           stepFactories: { items: { type: "string" }, type: "array" }
         },
         type: "object"
@@ -4991,6 +5005,7 @@ On \`sagaflow-js\` there is no such seam and the older shape stays reachable: se
 Configure \`within\`; \`hosts\`, \`scopeKey\`, \`engine\` and \`wrapper\` have defaults or are off. Enabled
 without \`within\` the rule refuses the run.`,
   meta: {
+    floor: { name: "workflows" },
     docs: {
       description: "A durable host declares the scope its steps run in \u2014 `scope.perStep` on the runtime it builds \u2014 because a durable run hibernates and retries, so a handle opened once per run is dead by the time a later step uses it. A repo on an engine with no such seam names its `engine` and `wrapper` instead, and a saga importing the engine's `step` around that wrapper is the finding. The guarded tree is required; enabled without it the rule refuses the run."
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/oxlint-plugin-biological-architecture",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "types": "./dist/index.d.ts",
   "description": "Biological tier architecture as lint — the union of the dielime and during.day rule sets, shipped as presets.",
   "keywords": [
@@ -36,6 +36,7 @@
     }
   },
   "files": [
+    "RULES.md",
     "corpus",
     "dist"
   ],
@@ -43,7 +44,7 @@
     "oxlint": ">=1.77"
   },
   "devDependencies": {
-    "@geonosis/lint-parity": "2.0.0"
+    "@geonosis/lint-parity": "2.2.0"
   },
   "engines": {
     "node": ">=22"