@geonosis/ratchet 0.5.0 → 1.1.0

package/README.md

@@ -178,12 +178,30 @@ counter that reads a file rather than running a command (`lawLineCount`) prints
 
 ### `testFailures` reads the runner's summary, never the exit code
 
-The counter looks for the runner's own count — `N failed` — and **refuses when it cannot parse
-one**. It never reads the process exit code, because a test runner exiting 0 over a red suite is
-commoner than anyone expects: `@cloudflare/vitest-pool-workers` 0.22 on vitest 4.1 exited 0 with
-failing tests on every workerd suite of a consumer, and every gate that trusted the exit code
-reported green over red for weeks. A refusal is loud and stops the run; a trusted 0 is silent and
-banks the red as a win.
+The counter looks for the runner's own count and **refuses when it cannot parse one**. It never
+reads the process exit code, because a test runner exiting 0 over a red suite is commoner than
+anyone expects: `@cloudflare/vitest-pool-workers` 0.22 on vitest 4.1 exited 0 with failing tests on
+every workerd suite of a consumer, and every gate that trusted the exit code reported green over red
+for weeks. A refusal is loud and stops the run; a trusted 0 is silent and banks the red as a win.
+
+**The lines it reads are the runner's summary lines, whole, and nothing else** — two dialects, both
+captured from the binary rather than guessed at:
+
+| Runner | The line | Read as |
+| --- | --- | --- |
+| vitest 3.2.7 | `      Tests  1 failed \| 1 passed (2)` | 1 |
+| vitest 3.2.7 | `      Tests  3 passed (3)` · `      Tests  2 skipped (2)` | 0 |
+| vitest 3.2.7 | `      Tests  no tests` (a suite that threw before collecting) | **refused** |
+| bun 1.4.0 | ` 1 fail` on its own line | 1 |
+| bun 1.4.0 | ` 0 fail` | 0 |
+
+Nothing else in the output counts. `Test Files  1 failed (1)` is a count of files, not of tests;
+`(fail) one [11.71ms]` is bun naming one; `naming 4 failing test(s)` is some wrapper counting its
+own findings. All three used to be read as a failure count — a **green run regressing a baseline**,
+the false RED mirroring the false green above (backlog #44). A run that prints no summary line at
+all is unmeasured, and the refusal names the two dialects so a third runner's output is a message
+rather than a wrong number. Summaries **add up**: a command that invokes the runner twice prints
+two, and reading the first and stopping banks the second suite's failures as a win.
 
 For the same reason, **give every test package its own `testFailures` entry**, each with its own
 `key`. One entry over one workspace measures one workspace; the suites it does not run are not zero
@@ -223,9 +241,10 @@ The counter then reads `numFailedTests`, and **refuses** rather than returning a
   mid-run writes. The run did not finish, so there is no number to bank.
 
 The summary mode stays the default; nothing changes for an entry that does not ask for a report.
-`--prove` proves BOTH: `testFailures` ships one probe per reading mode and prints them by name
-(`PROVEN testFailuresApi (vitest-json)`), because proving the mode nobody configured says nothing
-about the mode they did.
+`--prove` proves all three: `testFailures` ships one probe per reading mode — `summary (vitest)`,
+`summary (bun)`, `vitest-json` — and prints them by name (`PROVEN testFailuresApi (vitest-json)`),
+because proving the mode nobody configured says nothing about the mode they did, and a summary
+dialect nobody proved is a dialect nobody has been shown to read.
 
 ### `oxlintRule` counts a warned rule twice, on purpose
 
@@ -262,6 +281,11 @@ been shown to work — and this one guards the running time of every other gate.
   nothing more. If a child command needs `NODE_OPTIONS` — a TypeScript shim, a loader — put it on
   the script that invokes `geonosis-ratchet`, not on the counter's own line, and not only in your
   interactive shell.
+- **A path in a counter's command must be absolute, or `--prove` cannot run it.** A probe runs in a
+  scratch directory with none of your repo in it, so a loader or shim named relatively — `node
+  --import ./scripts/ts5-shim.mjs …` — resolves to nothing there and the counter comes back
+  "command did not run". The command is the same string in both places; write the path as
+  `$PWD/scripts/ts5-shim.mjs` and it works in the repo and in the probe alike.
 - **A `typecheckErrors` counter needs the same precondition CI gives it: build the workspace
   packages first.** In a fresh worktree the `dist/*.d.ts` files do not exist yet, and `tsc` reports
   a false +N of missing-module errors that has nothing to do with the change under test. `pnpm build
@@ -321,10 +345,55 @@ Every counter takes its `command` from the config, so the toolchain stays the re
 | `cloneCount` | jscpd's `Found N clones` | `command` |
 | `knipIssues` | the totals under knip's unused-* headings | `command`, `headings` |
 | `boundaryIssues` | `N issues found` from a boundary scan | `command` |
-| `archViolations` | lines matching a marker your own architecture scan prints | `command`, `match` |
+| `archViolations` | lines matching a marker your own architecture scan prints, refusing a non-zero exit that printed none of them — a scan that could not run is not a clean scan | `command`, `match` |
 | `sumOfCounts` | the total of one capture group across a per-file census (`grep -rc`) | `command`, `match` |
 | `lawLineCount` | the lines of the law file — a ceiling that can only come down | `path` |
 | `runtimeCodeShipped` | 0 when a change shipped runtime code, 1 when it shipped none | `command`, `patterns` |
+| `disabledCiJobs` | lines of `if: false` across the workflow files — a job switched off to get a release through, still off. A condition that merely mentions `false` is not one. No workflows directory at all reads 0 | `dir` |
+| `bundleBytes` | one integer out of whatever your sizing command printed, separators and all; with `match`, the group that pattern names rather than the last integer, refusing when it matches nothing. **Tolerates.** | `command`, `match`, `tolerance` |
+| `fastTierMs` | `finishedAt − startedAt` from the gate report `geonosis-verify` wrote, refusing a report of another tier rather than timing the wrong gate. **Tolerates.** | `report`, `tier`, `tolerance` |
+| `testsWithoutRunner` | workspaces holding `*.test.*`, `*.spec.*` or `__tests__/` with no `test` script — the suites nobody runs, which read exactly like suites that pass | `script` |
+| `packagesWithoutTypecheck` | workspaces with no `typecheck` script | `script` |
+| `walkFindings` | the defects in the report `geonosis-walk` wrote, over every page; with `classes`, only those classes, refusing a class the walk does not have. A missing or unparsable report is a refusal — the walk writes none when it could not run | `report`, `classes` |
+
+### `tolerance`, and the two counters that accept one
+
+Most counters count findings, where one more is one too many. `bundleBytes` and `fastTierMs` measure
+something that moves on a dependency patch nobody chose, and a gate that fails on +40 bytes is a
+gate that gets switched off within a week. `tolerance` is the fraction of the baseline such a number
+may drift up before the ratchet calls it growth:
+
+```jsonc
+{ "counter": "bundleBytes", "command": "…", "tolerance": 0.1 }  // +10 % is noise, +11 % is debt
+```
+
+**Only a counter that declares `tolerates` accepts one, and only `bundleBytes` and `fastTierMs` do.**
+Anything else stops the run:
+
+```
+geonosis-ratchet: "oxlintErrors" does not accept a tolerance — only a counter that measures a
+quantity declares one
+```
+
+That refusal is the point. A band around a findings count is not a tolerance, it is the gate turned
+off from the config file: `"tolerance": 100` on `oxlintErrors` and the run still prints PASS. It is
+law 2 — never downgrade a rule — wearing a friendlier name, and it would be the easiest edit in the
+repo to get past a reviewer. Whether a number is a quantity or a count is the counter's to know, not
+the config's, so the counter declares it.
+
+It forgives noise upward, never downward: a shrink of any size is still a shrink and still lowers
+the baseline, or the number would stop following the artefact down. A `tolerance` that is not a
+non-negative number stops the run and says which entry it was — one that silently became `NaN`
+would make every comparison false, which reads exactly like a counter that can never grow.
+
+The `geonosis` Claude Code plugin puts any write that introduces or raises one in front of a human
+(`permissionDecision: "ask"`): a band somebody chose and a band somebody's agent chose are not the
+same thing.
+
+Tolerance is also why a rewrite lowers only the numbers that **shrank**. While `held` implied
+`now === baseline`, writing every measured key back was a harmless no-op; with a tolerance it is
+not, and a counter that grew inside its tolerance would have had that growth laundered into its new
+floor by the first unrelated win.
 
 Two example configs from real repos live in `examples/` in the repository.
 
@@ -339,4 +408,18 @@ process.stdout.write(formatReport(result))
 
 `counters` is a plain array, so a repo can add its own `{ id, run }` beside the built-ins.
 
+## Two things this cannot see about itself
+
+A baseline is lowered **in place** when a number shrinks; that is what locks a win in, and it is
+also what lets a branch write any number it likes and stay green on every gate it runs. And a
+workspace whose suite no `testFailures` entry covers is unmeasured, which reads exactly like green.
+
+[`@geonosis/doctor`](https://www.npmjs.com/package/@geonosis/doctor) asks both from outside — the
+baseline at HEAD against another ref, and which workspaces have a test script nothing reads a report
+from:
+
+```bash
+npx geonosis-doctor --baseline-against origin/main --strict
+```
+
 Apache-2.0.

package/bin/geonosis-ratchet.mjs

@@ -1,4 +1,27 @@
 #!/usr/bin/env node
 // Committed, so `pnpm install` can link the bin on a fresh clone — before `pnpm build` has
 // produced dist/. A bin that only exists after a build is a bin that is missing when you need it.
-import '../dist/cli.js'
+//
+// In the repo, `src/` sits beside `dist/`, and a dist older than src answered for a fix it did not
+// carry once (#62). The published package ships no src, so there the check is skipped.
+import { existsSync, readdirSync, statSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const newest = (dir) =>
+  existsSync(dir)
+    ? readdirSync(dir, { withFileTypes: true }).reduce((most, entry) => {
+        const at = join(dir, entry.name)
+        return Math.max(most, entry.isDirectory() ? newest(at) : statSync(at).mtimeMs)
+      }, 0)
+    : 0
+const src = join(here, '..', 'src')
+if (existsSync(src) && newest(src) > newest(join(here, '..', 'dist'))) {
+  process.stderr.write(
+    'geonosis-ratchet: dist is older than src — run pnpm build before trusting this bin.\n',
+  )
+  process.exit(2)
+}
+
+await import('../dist/cli.js')

package/dist/{chunk-FM5I6PRT.js → chunk-LSYVFUP4.js}

@@ -140,7 +140,9 @@ import { execSync } from "child_process";
 var ANSI = /\[[0-9;]*m/g;
 var runCommand = (cwd, counterId, env) => (command) => {
   try {
-    const output = execSync(`${command} 2>&1`, {
+    const output = execSync(`(
+${command}
+) 2>&1`, {
       cwd,
       encoding: "utf8",
       env,
@@ -343,11 +345,26 @@ var recorded = (run) => {
     }
   };
 };
-var verdictOf = (now, baseline) => {
-  if (now > baseline) return "grew";
+var verdictOf = (now, baseline, tolerance) => {
+  if (now > baseline * (1 + tolerance)) return "grew";
   if (now < baseline) return "shrank";
   return "held";
 };
+var toleranceOf = (entry, key, counter) => {
+  const declared = entry.tolerance;
+  if (declared === void 0) return 0;
+  if (counter.tolerates !== true) {
+    throw new Error(
+      `"${key}" does not accept a tolerance \u2014 only a counter that measures a quantity declares one`
+    );
+  }
+  if (typeof declared !== "number" || !Number.isFinite(declared) || declared < 0) {
+    throw new Error(
+      `"${key}" has a "tolerance" that is not a non-negative number: ${JSON.stringify(declared)}`
+    );
+  }
+  return declared;
+};
 var outsideTier2 = (entry, tier) => entry.tiers !== void 0 && !entry.tiers.includes(tier);
 var runRatchet = async ({
   counters,
@@ -380,9 +397,10 @@ var runRatchet = async ({
         `${config.baseline} has no number for "${key}" \u2014 add it before enabling the counter`
       );
     }
+    const tolerance = toleranceOf(entry, key, counter);
     const recorder = recorded(runCommand(cwd, entry.counter));
     const now = await counter.run({ cwd, key, params: entry, run: recorder.run });
-    const verdict = verdictOf(now, limit);
+    const verdict = verdictOf(now, limit, tolerance);
     measurements.push({
       baseline: limit,
       evidence: verdict === "grew" ? recorder.last() : [],
@@ -396,7 +414,7 @@ var runRatchet = async ({
   if (shrank && !grew) {
     const next = { ...baseline };
     for (const one of measurements) {
-      if (one.verdict !== "skipped") next[one.key] = one.now;
+      if (one.verdict === "shrank") next[one.key] = one.now;
     }
     writeFileSync2(baselinePath, `${JSON.stringify(next, null, 2)}
 `);
@@ -434,13 +452,120 @@ var captured = (sample) => ({
 });
 
 // src/counters/arch.ts
+var refuse = (command, { code, output }) => {
+  const tail = output.trim().split("\n").slice(-10).join("\n");
+  throw new CounterError(
+    "archViolations",
+    `\`${command}\` exited ${code} and printed no findings \u2014 a scan that could not run is not a clean scan:
+${tail === "" ? "(it printed nothing at all)" : tail}`
+  );
+};
+var scannerProbe = {
+  command: () => "node scanner.mjs",
+  input: (dir) => {
+    plant(
+      dir,
+      "scanner.mjs",
+      [
+        "process.stdout.write('\\u2717 packages/a/src/cells/one.tsx cell imports cell\\n')",
+        "process.stdout.write('\\u2717 packages/a/src/tissues/two.tsx tissue holds state\\n')",
+        "process.exit(1)",
+        ""
+      ].join("\n")
+    );
+  }
+};
 var archViolations = {
   id: "archViolations",
-  probe: { ...captured("\u2717 cell imports cell\nok\n"), expect: 1 },
+  probe: { ...scannerProbe, expect: 2 },
   run: async ({ params, run }) => {
     const command = stringParam("archViolations", params, "command");
     const match = new RegExp(stringParam("archViolations", params, "match", "^\u2717"));
-    return run(command).output.split("\n").filter((line) => match.test(line)).length;
+    const result = run(command);
+    const found = result.output.split("\n").filter((line) => match.test(line)).length;
+    if (found === 0 && result.code !== 0) refuse(command, result);
+    return found;
+  }
+};
+
+// src/counters/bundle.ts
+var INTEGER = /\d[\d,_]*/g;
+var asBytes = (digits) => Number(digits.replaceAll(/[,_]/g, ""));
+var bundleBytes = {
+  id: "bundleBytes",
+  tolerates: true,
+  probe: { ...captured("dist/index.js\n  minified 4096\n"), expect: 4096 },
+  run: async ({ params, run }) => {
+    const command = stringParam("bundleBytes", params, "command");
+    const output = run(command).output;
+    const pattern = params.match;
+    if (pattern !== void 0) {
+      if (typeof pattern !== "string") {
+        throw new CounterError("bundleBytes", `"match" must be a regular expression source`);
+      }
+      const found = new RegExp(pattern).exec(output);
+      if (found === null) {
+        throw new CounterError(
+          "bundleBytes",
+          `nothing matched /${pattern}/ in what \`${command}\` printed`
+        );
+      }
+      const digits = found[1] ?? found[0];
+      const value = asBytes(digits);
+      if (!Number.isFinite(value)) {
+        throw new CounterError(
+          "bundleBytes",
+          `/${pattern}/ matched "${digits}", which is no number`
+        );
+      }
+      return value;
+    }
+    const integers = output.match(INTEGER);
+    if (integers === null || integers.length === 0) {
+      throw new CounterError("bundleBytes", `\`${command}\` printed no number to read as bytes`);
+    }
+    return asBytes(integers[integers.length - 1] ?? "");
+  }
+};
+
+// src/counters/ci.ts
+import { readdirSync, readFileSync as readFileSync4 } from "fs";
+import { join as join4, resolve as resolve5 } from "path";
+var DISABLED = /\bif:[ \t]*false\b/;
+var WORKFLOW = /\.ya?ml$/;
+var disabledCiJobs = {
+  id: "disabledCiJobs",
+  probe: {
+    expect: 1,
+    input: (dir) => plant(
+      dir,
+      ".github/workflows/ci.yml",
+      ["jobs:", "  build:", "    if: false", "    steps: []", ""].join("\n")
+    )
+  },
+  run: async ({ cwd, params }) => {
+    const relative = stringParam("disabledCiJobs", params, "dir", ".github/workflows");
+    const dir = resolve5(cwd, relative);
+    let files;
+    try {
+      files = readdirSync(dir, { withFileTypes: true }).filter((entry) => WORKFLOW.test(entry.name)).map((entry) => join4(dir, entry.name));
+    } catch {
+      return 0;
+    }
+    let disabled = 0;
+    for (const file of files) {
+      let contents;
+      try {
+        contents = readFileSync4(file, "utf8");
+      } catch (error) {
+        throw new CounterError(
+          "disabledCiJobs",
+          `could not read ${relative}/${file.split("/").pop() ?? file}: ${error.message}`
+        );
+      }
+      disabled += contents.split("\n").filter((line) => DISABLED.test(line)).length;
+    }
+    return disabled;
   }
 };
 
@@ -491,7 +616,7 @@ var boundaryIssues = {
 
 // src/counters/format.ts
 import { existsSync as existsSync4 } from "fs";
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 var unformattedFiles = {
   id: "unformattedFiles",
   probe: {
@@ -506,13 +631,67 @@ var unformattedFiles = {
       "command",
       "npx oxfmt --config .oxfmtrc.json --list-different ."
     );
-    return run(command).output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && existsSync4(resolve5(cwd, line))).length;
+    return run(command).output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && existsSync4(resolve6(cwd, line))).length;
+  }
+};
+
+// src/counters/gate-report.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve7 } from "path";
+var DEFAULT_REPORT = ".geonosis/gate-report.json";
+var fastTierMs = {
+  id: "fastTierMs",
+  tolerates: true,
+  probe: {
+    expect: 4500,
+    input: (dir) => plant(
+      dir,
+      DEFAULT_REPORT,
+      JSON.stringify({
+        finishedAt: "2026-08-30T10:00:04.500Z",
+        ok: true,
+        startedAt: "2026-08-30T10:00:00.000Z",
+        steps: [],
+        tier: "fast"
+      })
+    )
+  },
+  run: async ({ cwd, params }) => {
+    const relative = stringParam("fastTierMs", params, "report", DEFAULT_REPORT);
+    const wanted = stringParam("fastTierMs", params, "tier", "fast");
+    const path = resolve7(cwd, relative);
+    if (!existsSync5(path)) {
+      throw new CounterError(
+        "fastTierMs",
+        `no gate report at ${relative} \u2014 run \`geonosis-verify ${wanted}\` before measuring it`
+      );
+    }
+    let report;
+    try {
+      report = JSON.parse(readFileSync5(path, "utf8"));
+    } catch (error) {
+      throw new CounterError(
+        "fastTierMs",
+        `${relative} does not parse: ${error.message}`
+      );
+    }
+    if (report.tier !== wanted) {
+      throw new CounterError(
+        "fastTierMs",
+        `${relative} is a report of tier "${String(report.tier)}", not "${wanted}"`
+      );
+    }
+    const spent = Date.parse(String(report.finishedAt)) - Date.parse(String(report.startedAt));
+    if (!Number.isFinite(spent)) {
+      throw new CounterError("fastTierMs", `${relative} has no timestamps a reader can subtract`);
+    }
+    return spent;
   }
 };
 
 // src/counters/law.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve6 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve8 } from "path";
 var lawLineCount = {
   id: "lawLineCount",
   probe: {
@@ -522,15 +701,15 @@ var lawLineCount = {
   },
   run: async ({ cwd, params }) => {
     const relative = stringParam("lawLineCount", params, "path", "CLAUDE.md");
-    const path = resolve6(cwd, relative);
-    if (!existsSync5(path)) throw new CounterError("lawLineCount", `no law file at ${relative}`);
-    return readFileSync4(path, "utf8").replace(/\n$/, "").split("\n").length;
+    const path = resolve8(cwd, relative);
+    if (!existsSync6(path)) throw new CounterError("lawLineCount", `no law file at ${relative}`);
+    return readFileSync6(path, "utf8").replace(/\n$/, "").split("\n").length;
   }
 };
 
 // src/counters/oxlint.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve9 } from "path";
 var DEFAULT_COMMAND = "npx oxlint --format=unix --config .oxlintrc.json .";
 var PROBE_COMMAND = "oxlint --format=unix --config .oxlintrc.json .";
 var oxlintProbe = (severity, rule, source) => ({
@@ -584,21 +763,21 @@ var readFindings = (counter, { code, output }, expect) => {
   const agent = countFindings(output, AGENT_FINDING, "error");
   const problems = UNIX_SUMMARY.exec(output);
   const found = DEFAULT_SUMMARY.exec(output);
-  const refuse = (why) => {
+  const refuse2 = (why) => {
     throw new CounterError(counter, `${why} \u2014 oxlint's output changed:
 ${output.trim()}`);
   };
   if (total(unix) > 0 || problems !== null) {
-    if (problems?.[1] === void 0) return refuse('unix findings with no "N problems" summary');
+    if (problems?.[1] === void 0) return refuse2('unix findings with no "N problems" summary');
     if (Number(problems[1]) !== total(unix)) {
-      return refuse(`the summary says ${problems[1]} problems, the lines say ${total(unix)}`);
+      return refuse2(`the summary says ${problems[1]} problems, the lines say ${total(unix)}`);
     }
     return unix;
   }
   if (found?.[1] !== void 0 && found[2] !== void 0) {
     const summary = { errors: Number(found[2]), warnings: Number(found[1]) };
     if (total(agent) > 0 && (agent.errors !== summary.errors || agent.warnings !== summary.warnings)) {
-      return refuse(
+      return refuse2(
         `the summary says ${summary.errors} errors and ${summary.warnings} warnings, the lines say ${agent.errors} and ${agent.warnings}`
       );
     }
@@ -607,11 +786,11 @@ ${output.trim()}`);
   if (total(agent) > 0) return agent;
   if (code === 0) {
     if (expect !== void 0 && spokenByTheTool(output) !== "") {
-      return refuse(`asked for --format=${expect} and got output in no shape this counter reads`);
+      return refuse2(`asked for --format=${expect} and got output in no shape this counter reads`);
     }
     return { errors: 0, warnings: 0 };
   }
-  return refuse(`the tool exited ${code} and printed no findings and no summary`);
+  return refuse2(`the tool exited ${code} and printed no findings and no summary`);
 };
 var oxlintErrors = {
   id: "oxlintErrors",
@@ -669,18 +848,18 @@ var oxlintRule = {
     const config = typeof params.config === "string" ? params.config : "";
     const expect = expectedFormat("oxlintRule", params);
     if (config === "") return countRule(run(command), rule, expect);
-    const source = resolve7(cwd, config);
-    if (!existsSync6(source)) throw new CounterError("oxlintRule", `no config at ${config}`);
+    const source = resolve9(cwd, config);
+    if (!existsSync7(source)) throw new CounterError("oxlintRule", `no config at ${config}`);
     const strictName = `.oxlintrc.ratchet-${key}.json`;
-    const strict = readFileSync5(source, "utf8").replace(
+    const strict = readFileSync7(source, "utf8").replace(
       new RegExp(`("[^"]*${escapeForRegex(rule)}"\\s*:\\s*\\[?\\s*)"(warn|off)"`),
       '$1"error"'
     );
-    writeFileSync4(resolve7(cwd, strictName), strict);
+    writeFileSync4(resolve9(cwd, strictName), strict);
     try {
       return countRule(run(command.replace("{config}", strictName)), rule, expect);
     } finally {
-      rmSync3(resolve7(cwd, strictName), { force: true });
+      rmSync3(resolve9(cwd, strictName), { force: true });
     }
   }
 };
@@ -708,6 +887,143 @@ var runtimeCodeShipped = {
   }
 };
 
+// src/counters/scripts.ts
+import { readdirSync as readdirSync3 } from "fs";
+import { join as join6 } from "path";
+
+// src/counters/workspace.ts
+import { existsSync as existsSync8, readdirSync as readdirSync2, readFileSync as readFileSync8 } from "fs";
+import { join as join5, resolve as resolve10 } from "path";
+var SKIP = /^(node_modules|\.)/;
+var childDirs = (dir) => {
+  try {
+    return readdirSync2(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !SKIP.test(entry.name)).map((entry) => join5(dir, entry.name));
+  } catch {
+    return [];
+  }
+};
+var descendants = (dir, depth) => depth === 0 ? [dir] : [dir, ...childDirs(dir).flatMap((child) => descendants(child, depth - 1))];
+var expand = (root, pattern) => {
+  const segments = pattern.split("/").filter((one) => one !== "" && one !== ".");
+  let dirs = [root];
+  for (const segment of segments) {
+    dirs = segment === "*" ? dirs.flatMap((dir) => childDirs(dir)) : segment === "**" ? dirs.flatMap((dir) => descendants(dir, 3)) : dirs.map((dir) => join5(dir, segment)).filter((dir) => existsSync8(dir));
+  }
+  return dirs;
+};
+var QUOTED = /^['"]|['"]$/g;
+var cleaned = (value) => value.replace(/#.*$/, "").trim().replaceAll(QUOTED, "");
+var pnpmPatterns = (path) => {
+  const lines = readFileSync8(path, "utf8").split("\n");
+  const at = lines.findIndex((line) => line.startsWith("packages:"));
+  if (at === -1) return [];
+  const inline = lines[at]?.slice("packages:".length).trim() ?? "";
+  if (inline.startsWith("[")) {
+    return inline.replace(/^\[|\]$/g, "").split(",").map(cleaned).filter((one) => one !== "");
+  }
+  const patterns = [];
+  for (const line of lines.slice(at + 1)) {
+    const item = /^\s*-\s*(.+)$/.exec(line);
+    if (item?.[1] !== void 0) {
+      patterns.push(cleaned(item[1]));
+      continue;
+    }
+    if (line.trim() !== "") break;
+  }
+  return patterns;
+};
+var npmPatterns = (path) => {
+  const parsed = JSON.parse(readFileSync8(path, "utf8"));
+  const declared = Array.isArray(parsed.workspaces) ? parsed.workspaces : parsed.workspaces?.packages ?? [];
+  return declared.filter((one) => typeof one === "string");
+};
+var nameOf = (dir) => {
+  const manifest = join5(dir, "package.json");
+  if (!existsSync8(manifest)) return void 0;
+  try {
+    const { name } = JSON.parse(readFileSync8(manifest, "utf8"));
+    return typeof name === "string" && name !== "" ? name : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var workspaceDirs = (cwd) => {
+  const root = resolve10(cwd);
+  const pnpm = join5(root, "pnpm-workspace.yaml");
+  const manifest = join5(root, "package.json");
+  const patterns = existsSync8(pnpm) ? pnpmPatterns(pnpm) : existsSync8(manifest) ? npmPatterns(manifest) : [];
+  const dirs = patterns.filter((pattern) => !pattern.startsWith("!")).flatMap((pattern) => expand(root, pattern)).filter((dir) => existsSync8(join5(dir, "package.json")));
+  return [...new Set(dirs)];
+};
+var manifestOf = (dir) => {
+  try {
+    const parsed = JSON.parse(readFileSync8(join5(dir, "package.json"), "utf8"));
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+};
+var scriptsOf = (dir) => {
+  const scripts = manifestOf(dir)?.scripts;
+  return typeof scripts === "object" && scripts !== null ? Object.keys(scripts) : [];
+};
+var workspacePackageNames = (cwd) => {
+  const names = workspaceDirs(cwd).map((dir) => nameOf(dir)).filter((name) => name !== void 0);
+  return [...new Set(names)];
+};
+
+// src/counters/scripts.ts
+var TEST_FILE = /(\.test\.|\.spec\.)/;
+var TEST_DIR = "__tests__";
+var SKIP2 = /^(node_modules|dist|\.)/;
+var holdsTests = (dir, depth = 6) => {
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (entry.name === TEST_DIR) return true;
+      if (SKIP2.test(entry.name) || depth === 0) continue;
+      if (holdsTests(join6(dir, entry.name), depth - 1)) return true;
+      continue;
+    }
+    if (TEST_FILE.test(entry.name)) return true;
+  }
+  return false;
+};
+var testsWithoutRunner = {
+  id: "testsWithoutRunner",
+  probe: {
+    expect: 1,
+    input: (dir) => {
+      plant(dir, "pnpm-workspace.yaml", "packages:\n  - packages/*\n");
+      plant(dir, "packages/lonely/package.json", '{"name":"lonely","scripts":{"build":"tsup"}}');
+      plant(dir, "packages/lonely/src/thing.test.ts", 'test("x", () => {})\n');
+    }
+  },
+  run: async ({ cwd, params }) => {
+    const script = stringParam("testsWithoutRunner", params, "script", "test");
+    return workspaceDirs(cwd).filter((dir) => holdsTests(dir) && !scriptsOf(dir).includes(script)).length;
+  }
+};
+var packagesWithoutTypecheck = {
+  id: "packagesWithoutTypecheck",
+  probe: {
+    expect: 1,
+    input: (dir) => {
+      plant(dir, "pnpm-workspace.yaml", "packages:\n  - packages/*\n");
+      plant(dir, "packages/untyped/package.json", '{"name":"untyped","scripts":{"build":"tsup"}}');
+    }
+  },
+  run: async ({ cwd, params }) => {
+    const script = stringParam("packagesWithoutTypecheck", params, "script", "typecheck");
+    return workspaceDirs(cwd).filter((dir) => !scriptsOf(dir).includes(script)).length;
+  }
+};
+
 // src/counters/sum-of-counts.ts
 var sumOfCounts = {
   id: "sumOfCounts",
@@ -720,26 +1036,41 @@ var sumOfCounts = {
 };
 
 // src/counters/tests.ts
-import { existsSync as existsSync7, mkdtempSync as mkdtempSync2, readFileSync as readFileSync6, rmSync as rmSync4 } from "fs";
+import { existsSync as existsSync9, mkdtempSync as mkdtempSync2, readFileSync as readFileSync9, rmSync as rmSync4 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join4, resolve as resolve8 } from "path";
-var FAILED = /(\d+)\s+fail(?:ed|ing|s)?\b/;
-var PASSED = /(\d+)\s+pass(?:ed|ing|es)?\b/;
+import { join as join7, resolve as resolve11 } from "path";
 var COUNTER = "testFailures";
+var VITEST_LINE = /^\s*Tests {2,}(.+?)\s*$/;
+var VITEST_TOTAL = /\(\d+\)$/;
+var BUN_LINE = /^\s*(\d+) fail\s*$/;
+var FAILED_IN = /(\d+) failed\b/;
+var DIALECTS = 'vitest ("Tests  N failed | M passed (T)") and bun ("N fail")';
 var VITEST_JSON = "vitest-json";
 var PLACEHOLDER = "{report}";
+var summaries = (output) => {
+  const found = [];
+  for (const line of output.split("\n")) {
+    const vitest = VITEST_LINE.exec(line)?.[1];
+    if (vitest !== void 0 && VITEST_TOTAL.test(vitest)) {
+      found.push(Number(FAILED_IN.exec(vitest)?.[1] ?? 0));
+      continue;
+    }
+    const bun = BUN_LINE.exec(line)?.[1];
+    if (bun !== void 0) found.push(Number(bun));
+  }
+  return found;
+};
 var fromSummary = (output) => {
-  const failed = output.match(FAILED)?.[1];
-  if (failed !== void 0) return Number(failed);
-  if (PASSED.test(output)) return 0;
+  const found = summaries(output);
+  if (found.length > 0) return found.reduce((total2, one) => total2 + one, 0);
   throw new CounterError(
     COUNTER,
-    `no pass/fail summary in the runner output:
+    `no runner summary line in the output \u2014 this reads ${DIALECTS}:
 ${output.trim().slice(-500)}`
   );
 };
 var fromReport = (path) => {
-  if (!existsSync7(path)) {
+  if (!existsSync9(path)) {
     throw new CounterError(
       COUNTER,
       `the runner wrote no report at ${path} \u2014 a crash before the reporter is not a pass`
@@ -747,7 +1078,7 @@ var fromReport = (path) => {
   }
   let report;
   try {
-    report = JSON.parse(readFileSync6(path, "utf8"));
+    report = JSON.parse(readFileSync9(path, "utf8"));
   } catch (error) {
     throw new CounterError(
       COUNTER,
@@ -771,19 +1102,32 @@ var fromReport = (path) => {
 };
 var reportPathFor = (cwd, params, command) => {
   const named = params.reportPath;
-  if (typeof named === "string" && named !== "") return { own: false, path: resolve8(cwd, named) };
+  if (typeof named === "string" && named !== "") return { own: false, path: resolve11(cwd, named) };
   if (!command.includes(PLACEHOLDER)) {
     throw new CounterError(
       COUNTER,
       `report: "${VITEST_JSON}" needs somewhere to put the report \u2014 write ${PLACEHOLDER} into the command (--outputFile=${PLACEHOLDER}) or give the entry a "reportPath"`
     );
   }
-  return { own: true, path: join4(mkdtempSync2(join4(tmpdir2(), "geonosis-report-")), "report.json") };
+  return { own: true, path: join7(mkdtempSync2(join7(tmpdir2(), "geonosis-report-")), "report.json") };
 };
 var testFailures = {
   id: COUNTER,
   probe: [
-    { ...captured("  Tests  1 failed | 0 passed (1)\n"), expect: 1, name: "summary" },
+    {
+      ...captured("  Tests  1 failed | 0 passed (1)\n"),
+      expect: 1,
+      name: "summary (vitest)"
+    },
+    {
+      // Captured from bun 1.4.0 over one failing test of two, its per-test line included: the
+      // summary is two lines below one that also says "fail", and only one of them is the count.
+      ...captured(
+        "(fail) one [11.71ms]\n\n 1 pass\n 1 fail\n 2 expect() calls\nRan 2 tests across 1 file. [16.00ms]\n"
+      ),
+      expect: 1,
+      name: "summary (bun)"
+    },
     {
       // `cat` stands in for the runner: the placeholder is substituted into it, so a counter that
       // stopped substituting would hand `cat` the literal token and read nothing.
@@ -814,76 +1158,11 @@ var testFailures = {
       run(command.replaceAll(PLACEHOLDER, path));
       return fromReport(path);
     } finally {
-      if (own) rmSync4(join4(path, ".."), { force: true, recursive: true });
+      if (own) rmSync4(join7(path, ".."), { force: true, recursive: true });
     }
   }
 };
 
-// src/counters/workspace.ts
-import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync7 } from "fs";
-import { join as join5, resolve as resolve9 } from "path";
-var SKIP = /^(node_modules|\.)/;
-var childDirs = (dir) => {
-  try {
-    return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !SKIP.test(entry.name)).map((entry) => join5(dir, entry.name));
-  } catch {
-    return [];
-  }
-};
-var descendants = (dir, depth) => depth === 0 ? [dir] : [dir, ...childDirs(dir).flatMap((child) => descendants(child, depth - 1))];
-var expand = (root, pattern) => {
-  const segments = pattern.split("/").filter((one) => one !== "" && one !== ".");
-  let dirs = [root];
-  for (const segment of segments) {
-    dirs = segment === "*" ? dirs.flatMap((dir) => childDirs(dir)) : segment === "**" ? dirs.flatMap((dir) => descendants(dir, 3)) : dirs.map((dir) => join5(dir, segment)).filter((dir) => existsSync8(dir));
-  }
-  return dirs;
-};
-var QUOTED = /^['"]|['"]$/g;
-var cleaned = (value) => value.replace(/#.*$/, "").trim().replaceAll(QUOTED, "");
-var pnpmPatterns = (path) => {
-  const lines = readFileSync7(path, "utf8").split("\n");
-  const at = lines.findIndex((line) => line.startsWith("packages:"));
-  if (at === -1) return [];
-  const inline = lines[at]?.slice("packages:".length).trim() ?? "";
-  if (inline.startsWith("[")) {
-    return inline.replace(/^\[|\]$/g, "").split(",").map(cleaned).filter((one) => one !== "");
-  }
-  const patterns = [];
-  for (const line of lines.slice(at + 1)) {
-    const item = /^\s*-\s*(.+)$/.exec(line);
-    if (item?.[1] !== void 0) {
-      patterns.push(cleaned(item[1]));
-      continue;
-    }
-    if (line.trim() !== "") break;
-  }
-  return patterns;
-};
-var npmPatterns = (path) => {
-  const parsed = JSON.parse(readFileSync7(path, "utf8"));
-  const declared = Array.isArray(parsed.workspaces) ? parsed.workspaces : parsed.workspaces?.packages ?? [];
-  return declared.filter((one) => typeof one === "string");
-};
-var nameOf = (dir) => {
-  const manifest = join5(dir, "package.json");
-  if (!existsSync8(manifest)) return void 0;
-  try {
-    const { name } = JSON.parse(readFileSync7(manifest, "utf8"));
-    return typeof name === "string" && name !== "" ? name : void 0;
-  } catch {
-    return void 0;
-  }
-};
-var workspacePackageNames = (cwd) => {
-  const root = resolve9(cwd);
-  const pnpm = join5(root, "pnpm-workspace.yaml");
-  const manifest = join5(root, "package.json");
-  const patterns = existsSync8(pnpm) ? pnpmPatterns(pnpm) : existsSync8(manifest) ? npmPatterns(manifest) : [];
-  const names = patterns.filter((pattern) => !pattern.startsWith("!")).flatMap((pattern) => expand(root, pattern)).map((dir) => nameOf(dir)).filter((name) => name !== void 0);
-  return [...new Set(names)];
-};
-
 // src/counters/typecheck.ts
 var UNRESOLVED = /error TS(?:2305|2307): ([^\n]*)/g;
 var SPECIFIER = /'([^']+)'/g;
@@ -918,21 +1197,102 @@ var typecheckErrors = {
   }
 };
 
+// src/counters/walk.ts
+import { existsSync as existsSync10, readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve12 } from "path";
+var DEFAULT_REPORT2 = ".geonosis/walk-report.json";
+var CLASSES = /* @__PURE__ */ new Set([
+  "buy-box-above-fold",
+  "error-page-status",
+  "fabricated-claim",
+  "fake-session",
+  "light-on-light",
+  "link-integrity",
+  "ops-leakage",
+  "placeholder-asset",
+  "stub-only-entity"
+]);
+var walkFindings = {
+  id: "walkFindings",
+  probe: {
+    expect: 1,
+    input: (dir) => plant(
+      dir,
+      DEFAULT_REPORT2,
+      JSON.stringify({
+        counts: { "fabricated-claim": 1 },
+        finishedAt: "2026-08-30T10:00:01.000Z",
+        pages: [
+          {
+            findings: [
+              {
+                class: "fabricated-claim",
+                evidence: '"4.9/5" is on the page',
+                severity: "blocking",
+                url: "http://localhost:3000/"
+              }
+            ],
+            url: "http://localhost:3000/"
+          }
+        ],
+        probes: ["fabricated-claim"],
+        startedAt: "2026-08-30T10:00:00.000Z",
+        viewport: { height: 900, width: 1440 }
+      })
+    )
+  },
+  run: async ({ cwd, params }) => {
+    const relative = stringParam("walkFindings", params, "report", DEFAULT_REPORT2);
+    const path = resolve12(cwd, relative);
+    if (!existsSync10(path)) {
+      throw new CounterError(
+        "walkFindings",
+        `no walk report at ${relative} \u2014 run \`geonosis-walk\` before measuring it`
+      );
+    }
+    let report;
+    try {
+      report = JSON.parse(readFileSync10(path, "utf8"));
+    } catch (error) {
+      throw new CounterError(
+        "walkFindings",
+        `${relative} does not parse: ${error.message}`
+      );
+    }
+    if (!Array.isArray(report.pages)) {
+      throw new CounterError("walkFindings", `${relative} has no pages \u2014 it is not a walk report`);
+    }
+    const wanted = stringsParam(params, "classes", []);
+    for (const one of wanted) {
+      if (!CLASSES.has(one)) {
+        throw new CounterError("walkFindings", `"${one}" is not one of the walk's defect classes`);
+      }
+    }
+    return report.pages.flatMap((page) => page.findings ?? []).filter((finding) => wanted.length === 0 || wanted.includes(String(finding.class))).length;
+  }
+};
+
 // src/counters/index.ts
 var COUNTERS = [
   archViolations,
   boundaryIssues,
+  bundleBytes,
   cloneCount,
+  disabledCiJobs,
+  fastTierMs,
   knipIssues,
   lawLineCount,
   oxlintErrors,
   oxlintRule,
   oxlintWarnings,
+  packagesWithoutTypecheck,
   runtimeCodeShipped,
   sumOfCounts,
   testFailures,
+  testsWithoutRunner,
   typecheckErrors,
-  unformattedFiles
+  unformattedFiles,
+  walkFindings
 ];
 var counterById = (id) => {
   const counter = COUNTERS.find((one) => one.id === id);

package/dist/cli.js

@@ -5,7 +5,7 @@ import {
   formatReport,
   runProve,
   runRatchet
-} from "./chunk-FM5I6PRT.js";
+} from "./chunk-LSYVFUP4.js";
 
 // src/cli.ts
 var numberAfter = (flag) => {

package/dist/index.d.ts

@@ -0,0 +1,247 @@
+/** What a command did. `code` is the exit status; `output` is stdout and stderr, merged. */
+type CommandResult = {
+    code: number;
+    output: string;
+};
+/**
+ * A tool that reports findings exits non-zero — that is the tool working, not failing. A tool that
+ * could not be spawned at all, or whose output no longer parses, is a gate that cannot measure, and
+ * a gate that cannot measure has not passed. Counters throw this rather than returning zero.
+ */
+declare class CounterError extends Error {
+    readonly counter: string;
+    constructor(counter: string, message: string);
+}
+type CounterContext = {
+    /** The repo root every command runs in and every relative path resolves against. */
+    cwd: string;
+    /** The baseline key this instance writes — several instances of one counter can coexist. */
+    key: string;
+    /** Whatever the config gave this instance. Each counter validates its own. */
+    params: Record<string, unknown>;
+    run: (command: string) => CommandResult;
+};
+/**
+ * A counter's falsification probe: the known-bad input it must be able to read.
+ *
+ * `input` plants it in a scratch directory, `command` is the command shape to run THERE (absent for
+ * a counter that reads a file instead), `params` is whatever else that counter needs, and `expect`
+ * is the reading the planted input is worth — at least 1, because a probe that plants nothing
+ * proves nothing.
+ */
+type CounterProbe = {
+    command?: (dir: string) => string;
+    expect: number;
+    input: (dir: string) => void;
+    /**
+     * What this probe proves, when the counter has more than one way of reading. It is printed beside
+     * the key, so a report says WHICH mode was seen red rather than that the counter was.
+     */
+    name?: string;
+    params?: Record<string, unknown>;
+};
+type Counter = {
+    id: string;
+    /**
+     * Whether this counter's number is a measured QUANTITY — bytes, milliseconds — rather than a
+     * count of findings, and may therefore carry a `tolerance`.
+     *
+     * Opt-in, and declared by the counter rather than by the config, because the config is the wrong
+     * place to decide it: `"tolerance": 100` on a findings counter switches that gate off and the run
+     * still prints PASS. One more lint error is always one too many; forty more bytes is a dependency
+     * patch nobody chose. Only the counter knows which of those its number is.
+     */
+    tolerates?: true;
+    /**
+     * Absent only for a counter written outside this package. A gate that has never been seen red has
+     * not been shown to measure, so `--prove` refuses a configured counter that ships no probe.
+     *
+     * A counter that reads its tool in more than one way ships one probe per way: proving the mode
+     * nobody configured says nothing about the mode they did.
+     */
+    probe?: CounterProbe | CounterProbe[];
+    run: (context: CounterContext) => Promise<number>;
+};
+/** One line of `geonosis.ratchet.json`'s `counters` array. */
+type CounterConfig = {
+    counter: string;
+    /** The baseline key. Defaults to `counter`; required when a counter is used more than once. */
+    key?: string;
+    /**
+     * The tiers this counter belongs to — free-form names a repo chooses, `fast` and `full` by
+     * convention. Absent means every tier, so a repo that never asks for one is unaffected.
+     */
+    tiers?: string[];
+} & Record<string, unknown>;
+type RatchetConfig = {
+    baseline: string;
+    counters: CounterConfig[];
+};
+type Verdict = 'grew' | 'held' | 'shrank' | 'skipped';
+/**
+ * A counter that ran carries its number; a counter the tier left out carries none — deliberately,
+ * so nothing downstream can mistake a census nobody took for one that came back equal.
+ */
+type Measurement = {
+    baseline: number;
+    /**
+     * The tail of what this counter's command printed, kept only when the number GREW. A report
+     * that says a number went up and nothing else sends the reader back to re-run the tool; the
+     * lines that made it go up are the answer they were going to look for.
+     */
+    evidence: string[];
+    key: string;
+    now: number;
+    verdict: 'grew' | 'held' | 'shrank';
+} | {
+    key: string;
+    tier: string;
+    verdict: 'skipped';
+};
+/**
+ * What one counter's probe did. A reading of 0 is the finding this exists to catch: the counter ran,
+ * the input was planted, and the number came back the same as it does on a clean tree.
+ */
+type Proof = {
+    counter: string;
+    expected: number;
+    key: string;
+    reading: number;
+    verdict: 'misread';
+} | {
+    counter: string;
+    key: string;
+    reading: number;
+    verdict: 'cannot-fail' | 'proven';
+} | {
+    counter: string;
+    key: string;
+    reason: string;
+    verdict: 'cannot-measure';
+}
+/**
+ * Not a counter: `--exclusive` itself, measured by running two of it. A lock is a claim about the
+ * machine, and the only place that claim can be checked is the machine.
+ */
+ | {
+    key: string;
+    reason: string;
+    verdict: 'interleaved';
+} | {
+    key: string;
+    reason: string;
+    verdict: 'serialised';
+} | {
+    key: string;
+    tier: string;
+    verdict: 'skipped';
+};
+type ProveResult = {
+    proofs: Proof[];
+    /** False as soon as one counter could not be shown to read its own planted finding. */
+    proven: boolean;
+};
+type RatchetResult = {
+    measurements: Measurement[];
+    /** True when the baseline file was rewritten because something shrank. */
+    rewritten: boolean;
+};
+
+declare const CONFIG_FILE = "geonosis.ratchet.json";
+/** The baseline key an entry writes. Defaults to the counter's own id. */
+declare const keyOf: (entry: CounterConfig) => string;
+declare const loadConfig: (cwd: string) => RatchetConfig;
+
+declare const COUNTERS: Counter[];
+declare const counterById: (id: string) => Counter;
+
+/** Who is running the heavy thing, since when, and where from. */
+type Holder = {
+    cwd: string;
+    pid: number;
+    startedAt: string;
+};
+/**
+ * One path for the whole machine, because the contention is for the machine: three sessions on one
+ * laptop, each starting a verify, each slowing the other two down until a 25-minute run took two
+ * hours and produced failures that were about the load and not the code.
+ */
+declare const heavyLockPath: () => string;
+/**
+ * Takes the machine-wide lock, waiting for whoever has it, and gives back the release.
+ *
+ * A holder whose process is gone — killed, crashed, a laptop closed mid-run — is stale and is taken
+ * over with a printed note; so is a lock file nobody can parse, because a lock that can never be
+ * cleared is worse than no lock. The wait is bounded and says who it is waiting for: a run that
+ * hangs silently for half an hour is indistinguishable from a run that is broken.
+ */
+declare const acquireExclusive: ({ noticeMs, path, pollMs, say, timeoutSeconds, }?: {
+    noticeMs?: number;
+    path?: string;
+    pollMs?: number;
+    say?: (line: string) => void;
+    timeoutSeconds?: number;
+}) => Promise<() => void>;
+
+/**
+ * D-029: every gate ships its own falsification probe. The ratchet compares a number against a
+ * number and cannot tell a counter that found nothing from a counter that CAN find nothing — the
+ * kit's own `oxlintErrors` read 0 under the format its config asked for, from inception, and every
+ * baseline it wrote was a census nobody took.
+ *
+ * So each counter plants a known-bad input and must read it. The run stops at the first counter that
+ * reads 0 or throws: the rest of the report would be about a gate whose first gate is not a gate.
+ */
+declare const runProve: ({ counters, cwd, exclusiveVia, tier, }: {
+    counters: Counter[];
+    cwd: string;
+    /**
+     * The CLI to run two of, to see whether `--exclusive` serialises on this machine. Absent means
+     * the caller is a library and there is no process to run twice, so the lock is not proved.
+     */
+    exclusiveVia?: string;
+    tier?: string;
+}) => Promise<ProveResult>;
+
+/**
+ * A binary gate has two bad modes: ignore the debt, or block every commit until it is zero. Neither
+ * works mid-migration. This measures the debt, compares it against the baseline, and fails ONLY on
+ * regression — so a repo that predates a rule can adopt it the same day, and no NEW debt can land
+ * behind it.
+ *
+ * A `tier` runs only the counters that declare it; the rest are reported as skipped and take no
+ * part in the verdict, the exit code or a baseline rewrite. An iteration gate that took eleven
+ * seconds gets run less often than one that takes four, and a gate nobody runs enforces nothing —
+ * but a skipped counter that printed OK would be worse than not running at all.
+ */
+declare const runRatchet: ({ counters, cwd, tier, }: {
+    counters: Counter[];
+    cwd: string;
+    tier?: string;
+}) => Promise<RatchetResult>;
+
+/**
+ * One line per counter, then the verdict. Reads the same in a terminal and in a CI log. A counter
+ * the tier left out says so by name — printing a number for it would be the stale OK this exists
+ * to prevent.
+ */
+declare const formatReport: ({ measurements, rewritten }: RatchetResult) => string;
+declare const formatProve: ({ proofs, proven }: ProveResult) => string;
+
+/**
+ * Runs a command and merges stderr into stdout — most of these tools write their summary line to
+ * stderr, and on a zero exit `execSync` would otherwise hand back only stdout and the parse would
+ * fail. A non-zero exit is NOT an error here: a linter that found something exits non-zero, and
+ * that is the whole reason we are asking. Counters decide what an unparseable answer means.
+ *
+ * The command runs inside a SUBSHELL, because `<command> 2>&1` binds the redirect to the last
+ * command of the string only. `echo boom >&2; echo fine` merged nothing, and on a zero exit
+ * execSync hands back stdout alone — so a tool that prints its findings to stderr and exits 0 read
+ * as a tool that found nothing. That is the exact shape of a gate that has quietly stopped gating.
+ * On a non-zero exit the two buffers were concatenated instead, which put every stderr line after
+ * every stdout line and moved each diagnostic away from the line it was about. The shell keeps
+ * them in the order they were written. The newlines let a command end in a comment.
+ */
+declare const runCommand: (cwd: string, counterId: string, env?: NodeJS.ProcessEnv) => (command: string) => CommandResult;
+
+export { CONFIG_FILE, COUNTERS, type CommandResult, type Counter, type CounterConfig, type CounterContext, CounterError, type CounterProbe, type Holder, type Measurement, type Proof, type ProveResult, type RatchetConfig, type RatchetResult, type Verdict, acquireExclusive, counterById, formatProve, formatReport, heavyLockPath, keyOf, loadConfig, runCommand, runProve, runRatchet };

package/dist/index.js

@@ -12,7 +12,7 @@ import {
   runCommand,
   runProve,
   runRatchet
-} from "./chunk-FM5I6PRT.js";
+} from "./chunk-LSYVFUP4.js";
 export {
   CONFIG_FILE,
   COUNTERS,

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@geonosis/ratchet",
-  "version": "0.5.0",
+  "version": "1.1.0",
+  "types": "./dist/index.d.ts",
   "description": "Debt as a number that may only shrink — one ratchet, pluggable counters.",
   "keywords": [
     "ratchet",
@@ -24,7 +25,10 @@
     "geonosis-ratchet": "bin/geonosis-ratchet.mjs"
   },
   "exports": {
-    ".": "./dist/index.js"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
   },
   "files": [
     "bin",