@geonosis/oxlint-plugin-biological-architecture 2.10.0 → 2.11.0

package/CHANGELOG.md

@@ -1,5 +1,308 @@
 # @geonosis/oxlint-plugin-biological-architecture
 
+## 2.11.0
+
+### Minor Changes
+
+- 0f99e26: What one consumer's adoption measured, fixed in the plugin and the parity tool (2026-09-19).
+  
+  **`@geonosis/lint-parity` — a refusal is never reach (row 559).** Since D-084 a rule enabled
+  without an option it requires reports that as an ordinary finding, and `--corpus` counted it as the
+  rule firing: a bare, unconfigured rule read as covered. The finding is read out by its header
+  (`<rule> requires option \`<option>\`.`) and listed under **enabled but unconfigured**, apart from
+  the rules that fire nowhere; the run fails on either. `CorpusReport` gains `unconfigured`,
+  `RuleReach` gains `refusedInA` / `refusedInB`, and `corpusPassed` / `isRefusal` are exported.
+  
+  **Two rules now REQUIRE their option, reporting once a run when enabled without it:**
+  
+  - `no-swallowed-catch` requires `paths` (regex sources: the fetch and refresh modules). It was
+    silent bare while its `fixShape` promised a refusal (row 539). Every config extending
+    `failure-paths` names `paths` or gets the one finding.
+  - `no-runtime-dead-affordance` requires the positional `element→atom map` its twin
+    `no-raw-html-atoms` takes. It was silent bare while the docs said it refused (#8). Every config
+    extending `frontend` / `recommended` that enables it names the map or gets the one finding.
+  
+  **`subpath-over-barrel` no longer requires `packages`.** The map is the package's own
+  `package.json` `exports`, read for the repo's own packages — `node_modules/<name>` is a symlink or
+  its manifest is `private` — with the names behind each door read off its entry file (`export *`
+  followed inside the package). `{ name, subpaths }` still replaces the map for one package;
+  `{ name }` alone opts a third-party package in. Doors written as patterns (`./icons/*`) are not
+  read. Bare, the rule judges every root import of an own package: expect findings a hand-written
+  map never covered.
+  
+  **The seven #12 tree options take a string or a list alike:** `schema`, `tenant`, `queries`,
+  `seam`, `exempt`, `transacts`, `except`. A consumer wrote `seam` as a string and oxlint refused the
+  whole config at options validation — every rule read 0, exit 1. A bare string is a one-element
+  list now; existing configs of either shape keep working.
+  
+  `max-comment-density` and `ssot-no-inline-facts` say in their descriptions which repos they suit
+  and which they drown (3954 and 3056 findings on one consumer's tree, by house style rather than
+  defect). `todo-names-its-plan` no longer reads `XXX` inside `$X,XXX.XX`: a marker is followed by
+  `(`, `:`, whitespace or the end of the comment. The generated skill says how to measure a rule:
+  with a copy of the config, because `oxlint -D` does not lift a config's `"off"`.
+  
+  REFUSAL-IN-MINOR: **no-swallowed-catch and no-runtime-dead-affordance** refuse a bare run where they did not at 2.10.0, which is a break and
+  would normally want a major. It ships in a minor by the owner's ruling of 2026-09-19, on a measured
+  basis: every consumer pins this kit EXACTLY — three consumers, at 2.10.0, 2.6.1 and 2.10.0, no
+  caret anywhere — so nothing auto-upgrades and the version number protects nobody here. The warning
+  lives in this changelog instead, and the two consumers that could be reached were told directly
+  before the cut. The third is three releases behind; it is the one that must be told by hand.
+- 0f99e26: Four bugs a consumer filed against 2.10.0 (#13–#16).
+  
+  `no-void-port` takes `engineCallbacks` — regexes over an exported alias name, empty by default —
+  so a workflow-hook check the engine catches (`HookCheck<TInput> = (input, ctx) => Promise<void>`)
+  can be named as not a port; a `Result` there would never be read.
+  
+  `geonosis-doctor`: the Claude-plugin train is held only against the install that LOADS at the
+  doctored root (user scope, or a project scope naming that root), never another repo's; the
+  spare-declaration question reads the script files scripts and hooks run, CI workflows and
+  `geonosis.json` tiers, sees a bin quoted as an argv string, and says nothing about a package with
+  no bin. Expect four fewer WARNs on a root whose gate lives in a `.mjs`.
+  
+  `geonosis-mcp`: a server started before an in-session `geonosis update` refuses every call naming
+  the version it is running, the version the repo now has, and the restart (`/mcp` → reconnect) —
+  never the install. `geonosis update` ends by saying so where `.mcp.json` names a `geonosis` server.
+- 0f99e26: `no-date-string-compare` also reports a timestamp turned into text by its own method — `toString()`, `toDateString()`, `toUTCString()`, the `toLocale*` forms — and ordered; `toISOString()` is left alone.
+- 0f99e26: `no-hook-in-component-disguise` reads a hook called through a namespace (`React.useEffect`), so such a component is named a hook in disguise and a `page.tsx` running one loses the routing-marker exemption.
+- 0f99e26: Four rules see what they were blind to, and eleven readings refuse instead of banking a zero.
+  
+  `tissue-no-hooks` and `compound-must-be-stateless` report a hook called as a member —
+  `React.useState(0)`, `hooks.useCart()` — where they read only a bare name. `time-through-the-door`
+  sees the library through every import door (`export * from`, `import()`, `require()`), and
+  `subpath-over-barrel` reads `export { X } from '<root>'` as the import it is. Expect new findings on
+  a tree that spelled a hook through its default React import.
+  
+  `geonosis-ratchet`: a shell killed by a signal, a formatter that exited non-zero naming no file, a
+  `turbo boundaries` that printed no summary, a `geonosis.json` that will not parse, a stale report at
+  a named `reportPath`, and an oxlint run that answered in a shape `expectFormat` did not ask for are
+  each a `CounterError` now. Every one of them read as a number and lowered the baseline to it.
+  
+  `geonosis-doctor`: `deployed`, `seams`, `rails` and `drift` say FAIL over a `geonosis.json` that is
+  there and will not parse, where each had read it as a repo that declared nothing.
+- 0f99e26: `ssot-no-process-env` takes `doors` — the repo's own env module, as regex sources — beside the conventional ones, and treats a test beside its source (`x.test.ts`, `x.spec.tsx`) as a door, as it already did a tests folder.
+- 0f99e26: `no-inline-data-in-jsx` reads an array through `as const` and `satisfies` in a prop value as well as before `.map()`, and outside a feature folder points at a `lib/` module beside the component rather than `features//lib/`.
+- 0f99e26: **One declared list of tiers, read by both rules that name them (#5).** `no-ts-in-bio-folders`
+  carried its own idea of which folders belong to the architecture — `atoms, molecules, compounds,
+  cells, tissues`, a CMS-block folder, `emails` and `organs` — and `no-invalid-feature-folders`
+  carried a different one beside it. The first omitted `organelles`, a tier LAW.md declares, and
+  named three folders the law never mentions. Both rules now read `TIERS`, which a test holds against
+  the line in LAW.md that draws it, and neither restates it.
+  
+  **Reach moves in both directions.** `no-ts-in-bio-folders` gains `organelles/`: a `.ts` file
+  sitting directly in an organelle folder is a finding where it was invisible. A `use-*.ts` hook
+  there is NOT — `organelles/` is where every other rule in the plugin sends a hook, and judging the
+  tier without exempting the shape it exists to hold would leave a hook with no legal folder. The
+  barrel and a co-located `<component>.types.ts` stay exempt as before. MEASURED across three
+  consumer trees — two Medusa + Next, one Cloudflare Workers + D1: 115 `.ts` files sit directly in
+  an `organelles/` folder and every one of them is a barrel, a `.types.ts` or a hook, so the widening
+  costs those three trees nothing today.
+  
+  The rule loses the CMS-block folder, `emails/` and `organs/`, which were one repo's vocabulary
+  living in shared code (LAW 6) and are not tiers. A repo that genuinely holds components in a folder
+  the law does not name now says so: `extraFolders` (default: none, so the rule does nothing until
+  someone opts in), taking a bare string or a list like every other list option here.
+  
+  **Two fixes that came with reading the parent folder rather than an unanchored regex.**
+  `subtissues/thing.ts` was read as `tissues/` and is not any more, and a file one folder BELOW a
+  tier (`cells/parts/helper.ts`) is left to the folder it is actually in.
+  
+  `no-invalid-feature-folders` is unchanged in behaviour: the six tiers plus `lib` and `stores`, its
+  own two non-tier neighbours.
+- 0f99e26: An enabled rule missing its option reports ONE finding a run instead of throwing (D-084), and the
+  five rules that chose their files from paths compiled in read them from an option (#12).
+  
+  **The posture.** Up to 2.10.0 a rule enabled without an option it requires threw from `create()`.
+  Measured: the throw erased every other finding in the file it surfaced on, and rendered under
+  `--format=unix` as `:0:0:  [Warning]` naming nothing. It is a finding now — attributable, counted by
+  the ratchet, neighbours intact — reported once per run on the first file oxlint constructs the rule
+  for, with the same `biological-architecture/<rule> requires option \`<option>\`.` header. Nothing the
+  plugin exports throws for a missing option. Expect exactly one new finding per bare rule per run
+  where a run used to be refused whole.
+  
+  **#12 — four rules now REQUIRE a tree option; every config extending `backend-workflows` or
+  `tenant-scoping` must name it or gets the one finding above:**
+  
+  - `tables-declare-their-plane` requires `schema` (a regex over the filename: the schema tree);
+    `control/` and `tenant/` are read under it.
+  - `tenant-tables-carry-org-id` requires `tenant` (a regex: the tenant-plane schema tree).
+  - `queries-require-org-scope` requires `queries` (a regex: the query modules).
+  - `dialect-through-the-seam` requires `seam` (regex sources: the files that may name a dialect);
+    `exempt` defaults to the test paths (`__tests__/`, `.test.`, `.spec.`) — a repo whose test helpers
+    live elsewhere (`testing/`) names them.
+  
+  `no-d1-transaction` takes `transacts` and `except` (regex sources), both defaulting to nothing: the
+  plane the rule exempted was one repo's, and a D1-only repo has no plane to exempt. Expect new
+  findings on every `db.transaction()` that used to sit inside `/packages/db/(src|testing)/`.
+  
+  One consumer's values, verbatim, are in `proofs/issue-12-and-option-posture-2026-09-18.md`.
+  
+  `@geonosis/doctor`: `missingOptionOf` hears a refusal a rule reports as well as one it throws;
+  `exercised` no longer counts a bare rule's refusal finding as reach — it is a FAIL naming the option.
+  `@geonosis/cli`: `optionsNeededBy` reads through the same reader, so `init` still leaves those rules
+  out and names them.
+  
+  REFUSAL-IN-MINOR: **tables-declare-their-plane, tenant-tables-carry-org-id, queries-require-org-scope and dialect-through-the-seam** refuse a bare run where they did not at 2.10.0, which is a break and
+  would normally want a major. It ships in a minor by the owner's ruling of 2026-09-19, on a measured
+  basis: every consumer pins this kit EXACTLY — three consumers, at 2.10.0, 2.6.1 and 2.10.0, no
+  caret anywhere — so nothing auto-upgrades and the version number protects nobody here. The warning
+  lives in this changelog instead, and the two consumers that could be reached were told directly
+  before the cut. The third is three releases behind; it is the one that must be told by hand.
+- 0f99e26: `no-orm-outside-db` takes the data layer as an option: `dataLayer` holds regex sources over the path, and the default is `/packages/db/`, so an unconfigured repo sees no change. Its message no longer tells every consumer to import from `@app/db`, one repo's package. `ssot-no-inline-facts`'s description drops the same repo's `@app/client` from its examples.
+- 0f99e26: `no-raw-sql-outside-allowed` takes the modules where raw SQL is allowed as an option, `allow` (regex sources over the path). It used to compile in four modules of one repo's data layer, a backup, a dialect module, an app-role file and a search module, and grant them to every repo. Migrations, seeds, scripts and tests stay allowed everywhere. A repo that relied on the old list names those modules in `allow`, for example `["/ops/backup\\.ts$", "/queries/(reads|writes)/search\\.ts$"]`.
+- 0f99e26: `ssot-no-inline-facts` takes the modules that own facts as an option, `owners` (regex sources over the path). It used to compile in one repo's layout as owners: a domains package, a client package, a selectors module, two `paths.ts` modules and a schema directory. The conventions the rule names stay: a constants file, `lib/env.ts`, `lib/routes.ts`, and tests, scripts, seeds, migrations and configs. A repo that relied on the old list names its own owner modules in `owners`.
+- 0f99e26: `store-route-scopes-tenant-data`'s default `entities` no longer carries `planned_order` and `production_order`, which were one repo's own entities: a repo that owns such entities names them in `entities`. The default keeps Medusa's customer-owned entities and the B2B starter's company, employee and quote.
+- 0f99e26: `queries-require-org-scope` and `tenant-tables-carry-org-id` take `tenantKey` — the field a tenant is scoped by, default `orgId` — and read a quoted key as a bare one. Their diagnostics no longer cite one consumer's plan numbers or column helper.
+- 0f99e26: The five blind spots left after #4 and #11 are closed (rows 591–595). Expect new findings on a
+  tree that reaches a tier through a namespace import or `export *`, that hides a stateless compound
+  behind a one-line re-export in `cells/`, `tissues/` or `molecules/`, or that declares its aliases
+  somewhere the resolver did not read.
+  
+  **Where an import lands, read from more places.** A `#ui/*` specifier declared in `package.json`
+  `imports` and nowhere else now lands (row 591) — the manifest is read first for a `#` name, as Node
+  does; a directory with only a `jsconfig.json` has its `paths` read. A `tsconfig.json` whose `extends`
+  names a package (`@repo/tsconfig/base.json`, or `@repo/tsconfig` alone) is followed through
+  `node_modules` (row 592), and `${configDir}` reads as the leaf's directory, so a shared base can
+  declare `paths` and they still land.
+  
+  **A namespace import is no longer judged at the door** (row 593). `import * as cells from
+  '@/components/cells'` is judged by the members the file reaches — `cells.CustomCarousel`,
+  `<cells.CustomCarousel />` — each followed to the file that declares it; taken whole, and for
+  `export *`, `import()` and `require()`, every name the door carries is followed. The message names
+  the home as before: `"@/components/cells (→ src/kit/organelles/carousel.tsx)"`. A namespace whose
+  reached members all live where the door says stays silent.
+  
+  **Three rules stop exempting a re-export shim outright** (row 594). `cell-must-be-stateful`,
+  `tissue-must-compose` and `molecule-must-compose` returned on any pure `export … from` file. Now
+  the alias of a file in the shim's own tier stays exempt, and a shim whose code lives elsewhere is
+  judged as that code: a stateless compound behind one line in `cells/` is a cell with no state, a
+  compound behind one line in `tissues/` is a tissue that composes nothing, an atom behind one line in
+  `molecules/` is an atom filed as a molecule. A Next.js route file that delegates by re-export is the
+  thin delegate another rule demands and stays exempt; a re-export nothing on disk answers stays
+  exempt, as before.
+  
+  **The corpus tally separates named from unnamed findings** (row 595). `CASES` is its own module,
+  `tallyCorpus` reports per rule how many findings a case asked for and which files carry findings no
+  case named, and `pnpm corpus:tally` in the plugin package prints the table a proof reports
+  (`--unnamed` exits 1 on any noise). Today: 131 named, 111 unnamed over 244 cases.
+  
+  Measured read-only on the three consumer trees against each one's own config narrowed to the
+  fourteen affected rules — with the narrowed config placed so that the consumer's `overrides` and
+  `ignorePatterns` are in scope, which the earlier measurements were not (see below) — before (this
+  repo's `main` build) and after: **a second Medusa reference 12 → 12** (1,723 files), **a Medusa +
+  Next consumer 0 → 0** (2,345 files), **a Cloudflare Workers + D1 consumer 0 → 0** (2,566 files).
+  None of the three has a namespace import of a tier barrel, a pure re-export shim in a tier folder
+  outside `dist/`, a `#` map absent from its tsconfig, or `paths` hoisted into a shared base. Each
+  zero stands beside a planted positive that fired in the same run under the same config: on the
+  kit's corpus, and on a scratch copy of one feature of each tree that read zero, where the same
+  barrel, shim and namespace plants read 0 on the installed 2.6.1, 2 on `main` (the namespace still
+  invisible) and 3 on this build. Wall time on the narrowed runs moved within noise (the reference
+  567 → 467 ms, Medusa + Next 1,023 → 891 ms, Workers + D1 842 → 723 ms).
+  
+  **A correction to `where-an-import-lands`.** oxlint resolves an override's `files` and
+  `ignorePatterns` relative to the CONFIG FILE's directory. The consumer numbers in that changeset
+  were taken with a narrowed config written outside each tree, so the Workers + D1 consumer's
+  direction rules — which live only in `overrides` — were never in scope (its "0 → 0" measured
+  nothing), and the Medusa + Next consumer's 39 `cell-must-not-compose-cell` were findings in
+  `__tests__/` and `.stories.tsx` files its own `ignorePatterns` exclude. The reference's 12 were
+  top-level rules on un-ignored files and stand. Rules
+  affected: the eleven direction rules named in `where-an-import-lands`, plus `cell-must-be-stateful`,
+  `tissue-must-compose`, `molecule-must-compose`.
+- 0f99e26: `tissue-no-data-props` reads a handler written as a method signature (`onSelect(id: string): void`) as the handler it is.
+- 0f99e26: Rules that read a config object — steps, emits, subscribers, durable hosts, query steps — read it through `as` and `satisfies`: `{ event: 'order.placed' } satisfies SubscriberConfig` is the object it annotates, not an unreadable one.
+- 0f99e26: Every direction rule judges where an import LANDS, not only how it is spelled (#4, #11). Expect
+  new findings on a tree that reaches a tier through its barrel or through a one-line re-export.
+  
+  Two consumer issues were one blindness. `import { X } from '@/components/organelles'` names no file
+  in a tier folder, so `compound-no-stores` and its ten siblings read the string and stopped (#4); a
+  `cells/Carousel.tsx` that is exactly `export { CustomCarousel } from '@/kit/organelles/carousel'`
+  put an organelle in the cell tier for `tissue-no-organelles` and every rule that looked (#11).
+  Both counts were a lower bound of unknown depth on a kit whose number may only shrink.
+  
+  Now the specifier is resolved on disk — relative to the importer, or through the repo's own
+  `tsconfig.json` `paths` (comments, trailing commas and a relative `extends` chain read; nothing
+  this plugin knows by name) — and the file it lands on is judged beside the spelling, so a bare
+  barrel is the tier folder it names. Each name the import takes is then followed through
+  `export … from` and `export *` to the file that declares it, eight hops deep and never twice through
+  one file, and THAT file is judged too; the message says where the name went:
+  `cannot import organelle "@/components/cells (→ src/kit/organelles/carousel.tsx)"`. A landed path
+  is judged from the importer's package root, never as an absolute path, so a checkout under `/app/`
+  does not become a breach. One import is one finding, whichever of its landings is the breach.
+  
+  What is still judged at the door only: a namespace import, `export *`, `import()`, `require()`, a
+  name the door does not export, and a bare package. A specifier nothing on disk answers is judged as
+  before — except that one whose last segment is a tier folder is read as that folder.
+  
+  Measured on the reporter's tree (a second Medusa reference, 1,554 files, baseline 0): **0 → 12**
+  across the eleven direction rules — `tissue-no-organelles` 8, `compound-no-stores` 3,
+  `cell-must-not-compose-cell` 1 — every one a barrel import that was silent. On a Medusa + Next
+  consumer (2,832 files): `molecule-atoms-only` 0 → 4, `atom-no-deps` 0 → 1, `compound-no-stores`
+  0 → 1, and the 39 `cell-must-not-compose-cell` findings already there unchanged. On a Cloudflare
+  Workers + D1 consumer: 0 → 0. The direction rules' share of a run grew by roughly a quarter (the
+  reference +80 ms, Medusa + Next +270 ms), paid once per imported file per process. Nothing that
+  fired before stops firing: the spelled source is still judged first. Rules affected:
+  `atom-no-deps`, `cell-must-not-compose-cell`,
+  `cell-no-cross-feature-organelles`, `cell-no-tissues`, `compound-no-stores`, `molecule-atoms-only`,
+  `no-cross-feature-stores`, `no-orm-outside-db`, `organelle-dependency`, `tissue-no-organelles`,
+  `tissue-no-stores`.
+- 0f99e26: `worker-handles-are-scoped` reads a handler object written `export default { fetch … } satisfies ExportedHandler<Env>` — the shape Cloudflare documents — which it passed unread.
+
+### Patch Changes
+
+- 0f99e26: Every rule reads a tier, `stores`, `domains` or `features` folder as a whole path segment, as `lib/tiers` already did: `subcells/`, `datastores/`, `subdomains/` and `mytissues/` are no longer taken for the tiers they end in.
+- 0f99e26: `no-brand-names` says what it judges (#10): the brands a repo names — its own and its consumers' — so
+  a third-party mark a kit renders, a social network's or a review platform's, is not one of them.
+- 57d794d: The packed corpus is rebuilt from the fixtures at pack time, so a turbo cache restore that left stray files in `corpus/` no longer ships them.
+- 0f99e26: `no-runtime-dead-affordance`'s guidance says its map names only controls: every atom in it is judged as one, so copying `no-raw-html-atoms`' whole map would report a `<Header>` dead.
+- 0f99e26: Atom discovery strips comments with the string-aware scanner, so a glob string like `'icons/*'` no longer swallows the element an atom renders.
+- 0f99e26: `no-duplicate-jsx-patterns` reports a repeated className once when it contains `::` (`[&::-webkit-scrollbar]:hidden`); the split key had cut it and reported the same nodes twice.
+- 0f99e26: `emit-declares-attempts` reads a quoted key (`'attempts': 3`) as the name it spells and a computed key as no name, through the shared object readers.
+- 0f99e26: `no-invalid-feature-folders` names every folder it accepts — `atoms` and `molecules` included — read from the same set it judges by.
+- 0f99e26: `font-roles-only`'s `fixShape` said an enabled rule with no `roles` refuses the run. It reports that
+  once a run and judges nothing, as its own description and every other option-gated rule already
+  said. A test now asks every exported rule that none claims to refuse a run and none throws or
+  reports twice when constructed with no options.
+  
+  The README said the plugin carries 55 rules and that a bare rule refuses the run. It carries 80 a
+  consumer can enable, and a bare rule says so once a run and judges nothing. A test holds both.
+- 0f99e26: `no-index-count-as-exact` judges a nested object as its own payload: an outer object is no longer reported for an estimate its inner payload labels, nor twice for one it does not.
+- 0f99e26: `layer-walls`' probe tries every layer a wall forbids, not only the first, before it refuses.
+- 0f99e26: Two diagnostics printed literal double braces: `step-opens-its-own-cell` suggested `scope: {{ perStep: … }}` and `no-render-prop-reader` named `View={{}}`. They print `scope: { perStep: … }` and `View={…}`, and a test holds every message to placeholders only.
+- 0f99e26: The plugin's text readers share one comment stripper, which blanks a comment to spaces rather than cutting it — so `a/* note */b` stays two tokens — and `store-route-scopes-tenant-data` drops its private copy.
+- 0f99e26: `organelle-single-source` reads a form context imported through a `providers` barrel (`'../providers'`) as a form source, as it already did through a file.
+- 0f99e26: A `tsconfig` `paths` or `package.json` `imports` key that equals the specifier wins over a wildcard that also matches it, whatever order the map lists them in — as tsc and Node resolve it.
+- 0f99e26: Alias resolution follows Node and `tsc` where it had not. A `#` specifier is read only from the nearest `package.json`, Node's package scope: a nested package with no `imports` map no longer borrows its parent's map and lands where Node would refuse. For a tsconfig that `extends` several bases, the later base's `paths` and `baseUrl` win, as `tsc` resolves them.
+- 0f99e26: The `backend-sagaflow-cf` deprecation line says the old preset name resolves "until the next major", which is what the 2.3.0 changelog promised. It used to say "for one release", seven minor releases on. The retired-rule docs and RULES.md now use the same wording.
+- 0f99e26: `cell-no-tissues` and `organelle-dependency` treat an `app/` route as above them wherever the repo keeps its app, the way the other tier rules already did. They used to know only one repo's `apps/web/app/`. This widens them: a cell or organelle importing from `src/app/…` used to pass. `organelle-dependency`'s description and message name the `sharedFeatures` option in place of one repo's shared features, and `compound-must-be-stateless` drops a dead pattern that named one repo's UI package.
+- 0f99e26: A bare `.` or `..` import specifier, which loads that directory's index, is read as relative. The direction rules resolve it against the importer the way they resolve `./x` and `../x`, where they used to treat it as a package name and never see the breach. `layer-walls` under `externals: 'deny'` no longer refuses `import … from '..'` as an external import.
+- 0f99e26: `boundary-time-is-primitive` judges a default-exported arrow or function expression (`export default (at: Date) => …`), which it used to pass unread. A comment claiming the rule's exemption is a list of modules "never a path pattern" is gone: since #204 a door may be a path, a specifier or a regex.
+- 0f99e26: `tokens-only-colors` reads a vendor-prefixed colour property as React spells it (`WebkitTextFillColor`), and Tailwind's logical border utilities (`border-s-[…]`, `border-e-[…]`) and v4's `inset-shadow-[…]` / `inset-ring-[…]` as colour utilities. This widens the rule: a hardcoded colour behind any of those used to pass.
+- 0f99e26: `compound-must-be-stateless` refuses a compound's import from a `contexts/` module, as its description always said, and not only from `providers/`. This widens the rule: a compound importing `../contexts/theme` used to pass.
+- 0f99e26: The plugin names no consumer. Its package description, rule docs, fixShapes, RULES.md and tests describe the repos a rule was measured in by their stack: a Medusa storefront, a Workers + D1 app. Test scopes are neutral (`@shop/`, `@app/`). No rule's behaviour changes.
+- 0f99e26: `no-unregistered-plugin-dir` strips a registry's comments with the string-aware scanner, so a `https://` inside a string no longer hides the registrations after it on that line.
+- 0f99e26: `effect-hook-naming` holds both halves of the name, as its fixShape says. A file already named `-effect.ts` whose export is not `…Effect` now fires; the rule used to return early for every such file. An exported arrow hook (`export const useCart = () => …`) is judged like a function declaration, where it used to pass unread. This widens the rule, and the corpus gains `organelles/use-cart-effect.ts` as its evidence.
+- 0f99e26: The module reader behind barrel and shim resolution strips comments without touching strings. A glob like `'src/*'` in a string used to open a "comment" that ran to the next `*/`, dropping every export between the two from the module's table. A name then landed at the barrel instead of at its home, and the direction rules judged the wrong file. An object literal's computed key (`{ [retries]: 3 }`) is no longer read as a property named after the variable, including where a step's name is read.
+- 0f99e26: `molecule-must-compose` reads a path that arrives with backslashes, as every other rule does through the shared `normalise`. It leaves a co-located `<component>.types.ts` alone, the file `no-ts-in-bio-folders` sanctions in a tier folder. The two rules used to demand opposite things of it.
+- 0f99e26: The README's preset table names every preset the plugin ships with the rules it carries — six were missing and four counts were wrong — and a test holds it to `PRESETS`. The hand-kept options table, six rules of twenty-two, points at `RULES.md`'s generated one instead.
+- 0f99e26: `plugin-route-namespaced` derives a route from the path inside its package, so an `api/` directory in the checkout path above it no longer becomes the scope, and reads `under` as whole segments.
+- 0f99e26: `no-card-shaped-div`, `no-renamed-html-props` and `queue-loop-is-the-library` read the filename through the shared `normalise`, as every other rule does. On a Windows path the first two used to judge no file, and the third reported the `__tests__` files it exempts.
+- 0f99e26: The style reader behind `tokens-only-colors` and `font-roles-only` leaves a computed key (`style={{ [prop]: 'red' }}`) alone, as its doc always said. It used to read the key as a property named after the variable. `font-roles-only`'s fixShape quotes an invented family, not a real brand's font.
+- 0f99e26: `no-swallowed-catch` reports `.catch(console.error)` and the rest of the logger family handed over by name. That is the log-only handler the rule already refused when it was written inline, and it used to pass unread as a named function.
+- 0f99e26: `no-react-namespace` suggests `import { useState }` for a value and `import type { ReactNode }` for a type; it suggested `import type` for both, which erases a value.
+- 0f99e26: A name read into a regular expression is escaped: verify-arch's Medusa pack reads a module named through an identifier holding `$` (it read `$` as an anchor and named no module), and `store-route-scopes-tenant-data` matches a configured entity or scoping name literally.
+- 0f99e26: `service-name-not-reserved` says its default is the 32 keys of Medusa 2.19's `Modules` enum — which is what it ships, checked against the installed enum; the prose said 33.
+- 0f99e26: `router-schema-parity` leaves a co-located test (`x.test.ts`, `x.spec.ts`) and a declaration file (`x.d.ts`) beside the routers or schemas alone; neither is half of the mirror.
+- 0f99e26: `tissue-no-stores` no longer sends a reader to `organ-no-stores`, a rule that does not exist; a test now holds every rule's prose to rule names the plugin ships or has retired.
+- 0f99e26: Every order a tool writes, compares or applies — generated files, migration order, listings, cursors — sorts with the `en-US` collation, named rather than inherited from the machine. On an `en-US` machine nothing moves; on one set to another language (Estonian sorts `z` before `t`) the output is now the same one.
+- 0f99e26: `subpath-over-barrel` no longer reads a third-party package as the repo's own because pnpm linked it: a link counts only when it leaves `node_modules`, as a workspace link does.
+- 0f99e26: `next-route-segment-is-thin-delegate` accepts a tissue imported through its barrel (`…/tissues`), and judges a default-exported arrow or function expression by what it returns.
+- 0f99e26: `time-through-the-door`'s probe reads the door and the enumerated exemptions the way the rule does: a door that is a path but no valid regex no longer crashes it, and it never plants where `exemptModules` already reaches.
+- 0f99e26: `todo-names-its-plan` holds a whole citation to the whole `id` shape — an alternation no longer lets `TODO(025abc)` pass — and names the line the marker is on inside a block comment, not the comment's first line.
+- 0f99e26: `tokens-only-colors` reports a `var()` default as a foreign colour only when the prop it defaults is a colour property: `gap = 'var(--app-space)'` is spacing, not a bypassed token. A written-out colour default is still reported under any name.
+- 0f99e26: `no-trivial-wrapper-component` lets a tissue bridge to a cell, compound, organelle, molecule or atom imported through its barrel (`'../cells'`), as it already did through a file.
+- 0f99e26: `no-type-definitions-in-components` points outside a feature folder at a co-located `<component>.types.ts` rather than `features//lib/types.ts`.
+- 0f99e26: The shared AST walk visits nodes in source order. `unique-query-step-name` now reports the SECOND of two same-named steps — the one that replaced the first — and every rule that reports "the first" of something reports the first in the file.
+- 0f99e26: `zustand-v5-best-practices` never reads a hook the file imported from `react` as a store: `useSyncExternalStore` matched the `use…Store` shape and was reported as a store read twice.
+
 ## 2.10.0
 
 ### Minor Changes

package/README.md

@@ -1,9 +1,9 @@
 # @geonosis/oxlint-plugin-biological-architecture
 
-55 architecture rules as an oxlint JS plugin: which tier a file belongs to, what it may import,
+80 architecture rules as an oxlint JS plugin: which tier a file belongs to, what it may import,
 where state is allowed to live, and the backend invariants that go with them. Nothing is hardcoded
 to a repo — every list of brands, features, tables or paths is an option. A rule enabled without the
-options it needs refuses the run rather than passing silently.
+options it needs says so once a run and judges nothing, rather than passing silently.
 
 ## Install
 
@@ -57,13 +57,19 @@ everything below the organelle is inert. A cell never composes another cell.
 
 | preset | rules | what it is |
 | --- | --- | --- |
-| `frontend` (= `recommended`) | 35 | tier direction, state placement, element choice, file shape |
-| `backend-workflows` | 12 | workflows, the data layer, single source of truth |
-| `tenant-scoping` | 4 | every row placed, scoped and narrowed to one organisation |
+| `frontend` (= `recommended`) | 37 | tier direction, state placement, element choice, file shape |
+| `backend-workflows` | 15 | workflows, time, the data layer, single source of truth |
+| `backend-medusa` | 13 | Medusa steps, emits, subscribers, loaders and the store route surface |
+| `tenant-scoping` | 4 | every row placed, scoped and narrowed to one tenant |
+| `tooling` | 3 | a repo's own layers as data, no generic `utils` package, debt markers name a plan |
 | `backend-d1` | 2 | Cloudflare D1 facts — false on an engine with transactions |
-| `backend-medusa` | 1 | the storefront route surface |
+| `themekit` | 2 | colours and fonts only through the theme's tokens and roles |
+| `testbed` | 2 | integration suites run on a real database; tests await rather than poll |
+| `backend-trpc` | 1 | every router has its schema, and every schema its router |
 | `backend-workflows-cf` | 1 | durable runs on Cloudflare Workflows — false of an inline run |
-| `tooling` | 1 | `layer-walls` — a repo's OWN layers, declared as data and walled |
+| `failure-paths` | 1 | no catch that swallows the failure it caught |
+| `integrations` | 1 | every plugin directory is named by the registry |
+| `package-subpaths` | 1 | import the subpath that owns a name, not the package root |
 | `comment-ceiling` | 1 | the comment posture, opt-in (+ oxlint's `capitalized-comments`) |
 
 A rule that is false on another stack gets its own preset rather than riding along in a generic
@@ -126,19 +132,15 @@ not is a defect, not a difference.
 ### What the two configs must say for the findings to match
 
 A fork usually had its repo's vocabulary compiled in. Here it is configuration — and **a rule
-enabled without the options it needs refuses the run**, naming itself and the missing option, rather
-than quietly finding nothing. That is deliberate: a rule enabled at `"error"` with nothing to
-compare against is indistinguishable from a clean tree, and one consumer shipped exactly that for
-months. Carry these across, or turn the rule off:
-
-| Rule | Option | Enabled without it |
-| --- | --- | --- |
-| `no-brand-names` | `{ brands, allowedSubstrings }` | refuses the run |
-| `organelle-dependency` | `{ sharedFeatures }` | only `shared` crosses a feature boundary |
-| `cell-no-cross-feature-organelles` | `{ sharedFeatures }` | only `shared` crosses a feature boundary |
-| `step-opens-its-own-cell` | `{ engine, within, wrapper }` | refuses the run |
-| `no-raw-html-atoms` | the positional element→atom map | refuses the run |
-| `layer-walls` | `{ layers: [{ name, paths, mayImport }], externals? }` | refuses the run |
+enabled without the options it needs says so once a run**, naming itself and the missing option,
+and judges no file, rather than quietly finding nothing. That is deliberate: a rule enabled at
+`"error"` with nothing to compare against is indistinguishable from a clean tree, and one consumer
+shipped exactly that for months. Carry these across, or turn the rule off:
+
+Which rules refuse a bare run, and the option each one names, is in `RULES.md` — generated from
+the rules themselves, so it cannot fall behind them. Two defaults are worth knowing before a diff
+surprises you: `organelle-dependency` and `cell-no-cross-feature-organelles` let only a feature
+called `shared` cross a feature boundary until `sharedFeatures` names others.
 
 An empty list counts as unconfigured. A rule set to `"off"`, or never named, is untouched — "does
 nothing until configured" survives for a rule nobody enabled, which is oxlint's job, not ours.