@geonosis/ratchet 2.3.0 → 2.4.2

package/CHANGELOG.md

@@ -0,0 +1,630 @@
+# @geonosis/ratchet
+
+## 2.4.2
+
+## 2.4.1
+
+## 2.4.0
+
+### Minor Changes
+
+- 3b7b2ae: A `doctorWarnings` counter: the warnings `geonosis-doctor` reports about the repo it runs in, as a number that may only fall. The kit lints itself with its own preset and ratchets itself with its own counters, and pointed the doctor at consumers only — so its findings reached a session-start hook, where nothing fails a gate, and an unfalsifiable FAIL sat unread for as long as the marker had existed.
+  
+  Its unit is the RULE, not the finding. The doctor reports a rule that cannot be exercised once per config that enables it, which is right for a reader — each config is its own edit — and wrong for a ratchet: a repo loading the plugin in twelve configs would read thirteen rules as one hundred and fifty-six, and adding a legitimate twelfth config would fail the gate for a good change. That is the shape that retired `openBacklogRows`, where a shrink-only number over a quantity that rises honestly teaches people to stop being honest. Measured here, it is the difference between 30 and 17. The check stays part of a warning's identity, so two checks with something to say about one file remain two pieces of debt.
+  
+  The FAIL count is deliberately not this counter's business: the doctor's own exit code is, and a repo runs the doctor as its own gate step so the reader gets its tail rather than a counter's summary of it.
+- 56e0f33: A counter the baseline has never held is ADOPTED rather than refused. It used to throw `has no number for "<key>" — add it before enabling the counter`, and the D-007 write guard refuses the agent exactly that edit, because everything that scores the agent is written by the runner — so two of the kit's own rails together made a counter impossible to enable without breaking one of them. The runner measures it, writes it, and reports `ADOPTED` on its own line.
+  
+  What it does NOT do is call that a pass. The run exits 1 and says the number was measured for the first time and not judged: a first reading can be anything (a mis-escaped `match` reading 0 was banked as a floor once), and a floor nobody has looked at is not a floor anybody agreed to. The second run is the one that judges, against a number a reader has now seen. Nothing is adopted over a refusal, because a run that could not measure one counter has not earned the right to write any number.
+  
+  This loosens a refusal rather than tightening one, so no configuration that worked before stops working.
+
+### Patch Changes
+
+- bef73fb: Every shim tells a tree that was never built from a build that fell behind. `newest(dist)` answers 0 for a directory that is not there and for one that is merely old, so both conditions were one comparison and one sentence — and the staleness sentence was printed over trees that had never been built at all. It blocked a session's turn in a fresh git worktree, which has no `dist` because `dist` is not committed, with a message about a build going stale. Only one of the two is evidence of a mistake, and the two send a reader to different places.
+  
+  The test that holds it plants BOTH cases and requires different sentences, which the previous one never did: it planted only a stale `dist`, so the check had never been shown a case whose answer should differ. Named for what it is, since the same gap produced two wrong published numbers the same day — a probe never shown a differing case has not been shown to discriminate, which is this repo's own "a gate never seen red has not been shown to measure", one layer down, applied to the thing doing the observing.
+  
+  (This changeset names four packages of the fixed group deliberately: the group versions as one number and a changeset's description lands only in the packages it names, so naming several puts it in more than one place a reader might look. See #356.)
+
+## 2.3.1
+
+## 2.3.0
+
+### Minor Changes
+
+- 3dac9a7: **`archViolations` declares `match` as a reading param (#30).** Its shipped probe plants a scanner
+  printing `✗` lines, so it proves the command and never a `match` a repo configured for its own
+  scanner's shape — the one counter with a reading param that escaped #140's mechanism. A configured
+  `match` now reads UNPROVEN until the entry declares `probe: { sample, expect }` beside it, and the
+  README says what a probe does and does not prove.
+- 3dac9a7: **A `dx` counter family, fed from the kit's own reports (#93).** `bumpDurationMs` and
+  `timeToGreenDoctorMs` read `.geonosis/bump-report.json` — which now records how long the bump took
+  and how long each step that RAN took; `openBacklogRows` counts the rows of a register nobody has
+  closed, `path` required and `done` the repo's own word. A bump whose doctor was red has no
+  time-to-green, and all three refuse rather than reading a zero.
+- 3dac9a7: **One `--since`, and a report a machine can read (#97).** `--since` names a plan number, a day and
+  a git ref in three commands, and all three took any string: `plan check --since garbage` exempted
+  nothing and printed the verdict it would have printed with no flag, `stats --since notadate` put
+  every recorded day outside the window and printed `0 turns` as a pass rate. One reader now declares
+  which kind each means and refuses an unreadable value by name. `geonosis-ratchet`,
+  `geonosis-verify-arch` and `geonosis-lint-parity` take `--json`: the same report, on stdout,
+  whatever the verdict — `--json` with an explicit `--format` is refused rather than resolved.
+
+### Patch Changes
+
+- 3dac9a7: **Portability measured rather than assumed (#100).** The machine-wide heavy lock honours
+  `XDG_CACHE_HOME` instead of hardcoding `~/.cache`, ignoring a relative value as the spec requires.
+  `onPath` replaces the containment lookup that joined its argument into a `shell: true` command
+  line: a `sandbox-exec`/`bwrap` under a directory with a space in its name read as absent and failed
+  the run open.
+- 3dac9a7: **One documented spelling (#90).** Every README of a package the metapackage fronts now names
+  `geonosis <tool>` — the door that pins the whole toolchain at one version — beside the bare bin, and
+  a `tooling/` test holds it. `#230`'s stamp test lands with it: every flag `docs/orchestration.md`'s
+  adoption loop names has to carry the version it first ships in, because the loop once told a
+  consumer to run a flag the published version did not have.
+
+## 2.2.0
+
+### Minor Changes
+
+- d15a654: **A floor adoption is measured (#280).** The user's rule — a floor is adopted the day it deletes
+  more than it adds — had no instrument: during.day's four db floors came out +222/−225 and its
+  workflows floor +1807/−1493, and both numbers were read by nobody until they were asked for. A
+  consumer declares `adoption.seams: [globs]` in `geonosis.json` (default none, and a repo that
+  declares none gets no figure rather than a figure about everything). `geonosis update` then reports
+  lines deleted against lines added over those globs, `git diff --numstat` between the commit the bump
+  started from and the working tree, in the verdict and in the bump report. `geonosis-ratchet` gains
+  `adoptionSeamLines`, the lines those globs still hold — a number the ratchet already refuses to let
+  grow. A snapshot records the same figure for its consumer and `geonosis-release adoption` carries it
+  per consumer (MEASURED: a consumer's `.geonosis/` is an excluded directory, so their own bump report
+  never reaches a recording — the figure is taken where the tree is read).
+- d15a654: **`floorSurface`: a floor's public surface is a ratchet (#294).** `createConnections` has five doors
+  where a consumer needs two, and #248 was fixed by making one of them open its own frame rather than
+  by removing a door — every added door is a line to learn, a hole to exam and a promise the next
+  major has to keep, and nothing made the growth visible while it happened. The counter reads the
+  exported names out of the built declaration file each door in `exports` promises — declared in
+  place, re-exported from a chunk, or listed in a brace group, since a bundler exposes a name all
+  three ways — and refuses a package whose promised `.d.ts` is not built rather than reading an
+  unbuilt surface as empty.
+
+### Patch Changes
+
+- d15a654: **An envelope writer refuses a root it has been told is not its (#241).** A suite ran one over the
+  SHARED repo root mid-run: parallel suites made the comparison racy, and the file it left behind is
+  one the next run reads as real. Every one of the seven writer copies now refuses to write when
+  `GEONOSIS_ENVELOPES_FORBIDDEN_ROOT` names the root it was pointed at, saying so and pointing at a
+  scratch root instead. The kit's own vitest config sets it to the repo root, so a test that writes an
+  envelope there names itself — which is how the offender that filed this row was found again.
+- d15a654: **`knipIssues` cites the issues, not just the count (#269).** The same tree read 5 on CI and 6 on a
+  laptop and the envelope carried the number alone, so nobody could see which line had moved. The
+  counter now cites every issue knip printed under the heading it printed it under — quoted, never
+  re-parsed — and the `Unresolved imports` class names what did the resolving: the command and the
+  runtime that ran it, because an unresolved import is a fact about a resolver and not about a tree.
+
+## 2.1.0
+
+## 2.0.0
+
+### Minor Changes
+
+- 97bc8e9: **A debt marker names the plan that owns it.** New rule `todo-names-its-plan` (preset `tooling`): a marker must cite a plan — `TODO(025):` — or it is work nobody scheduled. The marker words are an option and the plan-id shape is an option, both empty-by-default, and enabled with no markers the rule refuses the run. Comments come from the PARSER, so the word in a string literal or after the `//` of a URL is not a finding. New counter `orphanTodos` counts what a repo already has — markers naming no plan, and markers naming a plan that is not on disk — so the law can be adopted as a ratchet rather than as a sweep. The kit enables the rule on itself; every example in the rule's own prose cites a real plan, because exempting a rule's source from the rule is the exemption that never comes back.
+
+### Patch Changes
+
+- 74ae3ec: **`knipIssues`'s refusal names the third way out (#206).** A configured `headings` list that drops a heading knip printed is refused — right, #178 — but the text offered only "add it" or "excuse it", and a repo that never meant to narrow anything read it as an instruction to enumerate every heading it has. The refusal now also says: remove `"headings"` altogether and count every heading knip prints.
+
+## 1.4.0
+
+### Minor Changes
+
+- ce2167f: **`suppressionCount` — lawLineCount's sibling (#134).** Occurrences of eslint/oxlint/biome-disable, @ts-expect-error and @ts-ignore across source files (fixtures, deps and prose excluded; `roots` scopes it), shrink-only like every number. A repo arriving with 261 suppressions cannot adopt law 3 as a wall, but it can adopt it as a ratchet.
+- 0d99139: **`--prove` exercises the reading the config asks for (#140), and a match that reads nothing refuses (#141).** during.day's live incident: a mis-escaped `match` read 0 from the real command, prove said PROVEN off a plant the configured match never saw, and the ratchet lowered the baseline — ten pieces of debt erased with a congratulatory message. Now: a counter declares its `readingParams`; a config customizing one must declare `probe: { sample, expect }` beside it (the sample its reading must count) or the prove line says UNPROVEN and the run does not pass; and `sumOfCounts` throws, naming the match and the first line, when output is present and the match reads none of it — nothing-found and could-not-read are different answers.
+- 5df33fd: **The report envelope, balanced at write time.** `writeEnvelope` writes `{ tool, version, considered, read, refused[], excused[], findings[], durationMs }` to `.geonosis/envelopes/<tool>.json` and refuses — throwing, writing nothing — unless `considered === read + refused.length + excused.length`. Four denominator bugs landed in one day, all of them green, all of them green because the tool published the numerator and nobody published the denominator. A run that has lost count of its own inputs now renders no verdict at all rather than a wrong one. `versionOf(import.meta.url)` answers the same in `src/` and in the bundled `dist/`, so an envelope names the build that wrote it.
+- a430c81: **A counter that blew up no longer hides the ones behind it, and the run writes its envelope.** `runRatchet` collects every counter it could not measure into `refusals` instead of throwing on the first, so one broken tool no longer leaves the rest of the gate unrun and unreported — the fix `migrations` already made for an unreadable file. The run still fails, at exit 2, and each refusal now names its cause AND the command that reproduces it, read back off the run rather than guessed from the config. The baseline rewrite is suppressed whenever anything refused: a win locked in over a census that only half happened buys a lower floor with a number nobody took. `geonosis-ratchet` writes `.geonosis/envelopes/ratchet.json` — every configured counter leaves by exactly one door, measured, left out by `--tier`, or refused — and refuses to render a verdict at all if those do not add up.
+- 3de7f28: **One answer to "where does the baseline live" (#120).** `resolveBaseline(cwd)` is exported from `@geonosis/ratchet` — the ratchet config's `baseline`, else the default, never a throw. The rails deny rail now denies the baseline where `geonosis.ratchet.json` says it LIVES (the default alone let a tampering write land, measured on sandbox-exec, on a repo whose baseline is `scripts/gate-baseline.json`); the mcp preamble reads counters from the declared path instead of saying "no counter is ratcheted" over twenty. The layer walls forbid rails and mcp importing ratchet, so each carries a ten-line reader pinned behaviour-equal to `resolveBaseline` by a conformance test — which also pins the class: the literal filename is greppable only in the resolver, the pinned readers, the writers of the default pair, and documented prose.
+
+### Patch Changes
+
+- 8f5dc0c: **`cloneCount` says when its tool printed nothing at all.** The refusal used to read `no "Found N clones" line:` followed by an empty tail, which tells a reader neither what happened nor what to run — a tool that printed nothing and a tool that printed a paragraph this cannot parse are two different problems. Found by the new refusal-law contract test, which drives each refusal the envelope law introduced and requires the sentence to carry a cause worth acting on and the command that reproduces it.
+- d23aef3: **Each tier records its own gate report (#121).** `geonosis-verify <tier>` writes `.geonosis/gate-report.<tier>.json` beside the shared latest-run report (which stays, for every reader that wants "what ran last"). `fastTierMs` reads its own tier's file first — `fast` straight after `full` refused deterministically while every step printed ok (dielime, reproduced on purpose). The shared file remains a fallback for trees written by an older verify, but a wrong-tier fallback is a refusal naming the file the right tier writes.
+- 565db59: **Regression evidence cites the lines the counter counted (#122).** A counter may now declare `evidence(output, params)`, and the report prints THOSE lines under `<-- REGRESSED` instead of the tail of the run. `oxlintRule` cites findings attributed to its own rule, `oxlintErrors` cites errors and `oxlintWarnings` warnings — dielime read a +2 on one rule with two unrelated WARNING findings underneath it, because those were the last lines oxlint printed while the two real errors sat higher up. The count was right the whole time; the lines sent the reader to the wrong files. A counter that names nothing, or recognises nothing in a run, still falls back to the tail.
+- ef29fc0: READMEs: a tool catalog publishes value vocabularies, not just field names — a zero from a wrong filter reads as good news (#135); and the pairing rule — a scoped fast tier is safe exactly when the full tier is total, every hard cap needs a full-tier counter (#136). Both measured in dielime.
+
+## 1.3.0
+
+### Minor Changes
+
+- 2d1d841: **`geonosis-ratchet --help` ran the full ratchet (#66).** There was no usage, no `--help` branch and
+  no unknown-flag rejection: everything unrecognised fell through to a complete measurement — a run
+  that can rewrite `gate-baseline.json`, started by a typo. Measured at 141 s on the kit's own tree.
+  It now prints its usage at exit 0 for `--help`/`-h`, and refuses any flag outside the known set by
+  name at exit 2, before the lock is taken.
+  
+  **It also answers `--print-config-shape` (#75)**: the shape of `geonosis.ratchet.json` and `gate-baseline.json`, including why two counters may not write one key.
+  
+  **The README names the NODE_OPTIONS/nested-pnpm trap (#63)**, with the `env -u NODE_OPTIONS` shape and the doctor line that asks for it.
+
+### Patch Changes
+
+- db1cebd: **The "a scan that could not run is not a clean scan" answer is pinned, permanently (#80).**
+  during.day removed `geonosis.verify-arch.json` deliberately to see what the gate would say, and
+  `archViolations` refused rather than reading zero findings. That answer may never regress: the
+  failure it prevents is silent and self-reinforcing — a zero the ratchet BANKS, rewriting the
+  baseline down off a scan that never happened, green for ever after. The fixture runs the real
+  scanner in a directory with no config and the real counter over exactly what it printed; a captured
+  sample would prove the regex and not the pair, and the pair is what broke. Shown to fail against a
+  planted regression before it was kept.
+- f37950f: Counter output capture no longer drops the tail of large outputs: `spawnSync` replaces the merged subshell, both streams arrive whole (stdout then stderr — cross-stream interleave was never promised on the error path and is no longer promised on success), and a 200k-line output keeps its summary line (dielime Block D, #111).
+
+## 1.2.0
+
+## 1.1.0
+
+## 1.0.1
+
+### Patch Changes
+
+- 1c2ee0b: **Every package ships its declarations and says where they are.** `@geonosis/visual-diff` and
+  `@geonosis/verify` emitted no `.d.ts` at all (TS7016 in a consumer: the comparator every visual test
+  calls became `any` at the one seam that decides whether a screenshot regressed), and no package
+  declared `types` — the nineteen that worked did so through the sibling-file fallback, which ends the
+  day `exports` gains a condition. Every export now carries a `types` condition beside `default`, every
+  manifest a `types` field, and `tooling/types.test.ts` holds all twenty-one to it after the build.
+  
+  `geonosis-verify-arch` prints a check once when its label is its id ("direction, orphan", not
+  "direction direction").
+
+## 1.0.0
+
+### Major Changes
+
+- e6a54d5: **`archViolations` stops reading "could not measure" as zero.** A scanner that found something exits
+  non-zero. So does a scanner that could not run at all, and the counter told them apart by neither —
+  it counted marker lines and returned the number, so a run that printed nothing because it never
+  happened came back 0.
+  
+  That is the silent zero at its most expensive, because the ratchet BANKS it: a baseline of 4 gets
+  rewritten down to 0 and the commit that "earned" it is a config with a typo in it.
+  `geonosis-verify-arch` exits **2** for exactly that — no config, an unknown pack, an unknown format
+  — and under `--format ratchet` prints nothing while doing so. Its exit 2 is now visible.
+  
+  A non-zero exit with zero matching lines is a `CounterError` naming the command, the status and the
+  tail of what it printed. A non-zero exit WITH findings still counts them, which is the normal
+  reading and the half that must not become collateral: a scanner exiting 1 because it found four
+  things is the tool working.
+  
+  The probe changed with it. It used to `cat` a captured sample, which proved the regex and nothing
+  else — a real scanner printing another shape still read 0 and the probe still said PROVEN. It now
+  plants a scanner and runs it: findings on stdout, a non-zero exit because it found them, and the
+  counter has to come back with the number.
+- 9858ee5: `error-page-status`, a ninth probe from a production incident: a page whose body is an error surface
+  and whose status is healthy. Every curl-style health check, uptime monitor and load balancer reads
+  such a page as fine while nobody can use it. The status comes from the page's own response, so
+  `ProbeContext` gains `status` — a second request would ask a different question of a server that may
+  not answer twice the same way. `patterns` is required (D-031); a page that answered 400 or worse is
+  a server telling the truth, and the walk refuses that URL on its own. `walkFindings` counts the new
+  class.
+- c575f44: Five counters, `tolerance`, and a baseline rewrite that only ever goes down.
+  
+  - `disabledCiJobs` — lines of `if: false` across the workflow files (`dir`). A job switched off to
+    get a release through is debt exactly like a lint error: invisible, because the pipeline goes
+    green. A condition that merely mentions `false` is not one, and a repo with no workflows
+    directory reads 0 rather than refusing; a workflow that is there and cannot be read refuses.
+  - `bundleBytes` — one integer out of whatever the repo's sizing command printed (`command`,
+    `match`), separators and all. With `match` it takes the group that pattern names and refuses when
+    it matches nothing, rather than falling back to any integer and reporting the wrong number as
+    confidently as the right one.
+  - `fastTierMs` — `finishedAt − startedAt` from the gate report `geonosis-verify` wrote (`report`,
+    `tier`). It refuses a report of another tier: the full tier takes minutes, and timing it against
+    the fast tier's baseline would report a regression of the wrong thing.
+  - `testsWithoutRunner` — workspaces holding tests with no `test` script. Unmeasured and passing are
+    indistinguishable from outside, so the count of unmeasured things has to be a number of its own.
+  - `packagesWithoutTypecheck` — workspaces with no `typecheck` script (`script`).
+  
+  `tolerance` is new on the verdict: the fraction of the baseline a number may drift UP before the
+  ratchet calls it growth. Bytes and milliseconds move on a dependency patch nobody chose, and a gate
+  that fails on +40 bytes is a gate that gets switched off. It forgives noise upward only — a shrink
+  of any size still lowers the baseline — and a `tolerance` that is not a non-negative number stops
+  the run naming the entry, because one that silently became `NaN` reads exactly like a counter that
+  can never grow.
+  
+  **Fix:** a baseline rewrite now lowers only the numbers that SHRANK. Writing every measured key back
+  was a harmless no-op while `held` implied `now === baseline`. Tolerance breaks that implication, and
+  the blanket rewrite would have laundered growth-within-tolerance into the new floor on the first
+  unrelated win — a baseline going up on a pass.
+  
+  `examples/dielime.ratchet.json` is dielime's Phase 3 config: 36 keys, one `testFailures` entry per
+  workspace. It keeps `--format=unix` and `expectFormat` on the two oxlint counters, which dielime's
+  own config drops — the summary cross-check can tell a misparse from a clean run only when the run
+  printed a summary, and a warnings-only run in an unreadable shape prints one that says nothing
+  about errors. Pinning the format is what closes that window.
+- 90d38ec: **`geonosis-backend` — the landmine list as the mechanical layer for backend work.** Forty-six
+  failures that read as success, each as symptom → cause → detection → fix, grouped by the engine it
+  is TRUE of: nineteen `medusa`, two `sagaflow-cf`, twenty-five `any`. You arrive with a symptom and
+  leave with a fix; that is the whole design, and it is why the entries are a table and not prose.
+  
+  Every entry points at the kit rule or counter that catches it — `emit-declares-attempts`,
+  `plugin-route-namespaced`, `named-when-block`, `mutating-step-declares-retry`,
+  `store-route-scopes-tenant-data`, `no-d1-transaction`, `step-opens-its-own-cell`,
+  `queries-require-org-scope`, `no-unregistered-plugin-dir`, `no-mock-db-in-integration`,
+  `layer-walls`, `ssot-no-process-env`, `disabledCiJobs`, `testsWithoutRunner`, `knipIssues` — or says
+  **`no gate yet`**, and those rows are the backlog's next rules said out loud rather than omitted
+  into what would read as full coverage.
+  
+  Every entry cites a document in this repo: Medusa's seventeen (`docs/analysis-medusa-2026-08.md`
+  §4), Midday's eighteen (`docs/analysis-midday-2026-08.md` §4), nine consumer landmines from
+  `docs/rules-backlog.md`, and two engine facts `RULES.md` states as the reason two presets exist. A
+  landmine that could not be cited was dropped.
+  
+  Pinned by a test that PARSES it rather than reading it: the count, all four fields per entry, a
+  source path that exists on disk, and a gate name that the plugin or the ratchet actually exports —
+  so a rule renamed in the plugin fails the suite instead of leaving the skill pointing at a gate
+  nobody has. The two analyses' own numbering is read from the analyses, so an eighteenth Medusa
+  landmine fails the build until the skill carries it.
+  
+  Version-only entry for `@geonosis/ratchet`: the plugin's manifest takes its version from that
+  package, and the release group moves together.
+- c418f91: The `geonosis` Claude Code plugin — the method as enforcement rather than advice.
+  
+  `plugin/` ships five hooks, Node ≥ 22, zero dependencies, every tool resolved from the CONSUMER's
+  `node_modules/.bin` so a repo that has not adopted a tool is never blocked on a tool it lacks:
+  
+  - **SessionStart** runs `geonosis-doctor` if it is installed and prints a one-line digest of
+    `.oxlintrc.json` — which plugins are loaded, how many architecture rules are at `error`. It never
+    fails a session.
+  - **PreToolUse / Bash** refuses `prettier` (law 4) and `--no-verify` (law 7), and hands a
+    `git commit` to `geonosis-ledger` — the message its `-m` flags compose, and whether the staged
+    diff delivers anything but comments. The detectors are the ledger's, never reimplemented here; a
+    repo without it gets a note and no opinion.
+  - **PreToolUse / Edit|Write|MultiEdit** refuses a write that ADDS `eslint-disable`,
+    `oxlint-disable`, `@ts-ignore` or `@ts-expect-error` (law 3), any write to `gate-baseline.json` or
+    under `.geonosis/` (D-007 — the scored agent never writes the scoreboard), and a lint config that
+    sets a rule to `"warn"`, `"off"`, `0` or `1` (law 2). It reads what the call would ADD, never what
+    it removes, so the edit that DELETES a suppression is not refused by the guard against them.
+  - **PostToolUse / Edit|Write** runs oxfmt on the file just written. It never blocks.
+  - **Stop** runs `geonosis-verify fast` and will not let the turn end on a red one, capped at five
+    blocks per session — an agent retrying the same broken thing five times has a problem it will not
+    solve on the sixth, so the sixth prints the report and lets go.
+  
+  `.claude-plugin/marketplace.json` offers it from `./plugin`. `pnpm generate:skill` now writes the
+  plugin's copy of the mechanical skill, the engineer agent with the machine-specific path taken out,
+  and `plugin.json` carrying the kit's own version; staleness tests fail when any of the four drift.
+- 5f09ddc: Every hook is driven end to end, as Claude Code drives it.
+  
+  Each script is SPAWNED with real stdin JSON over a throwaway repo carrying a `geonosis.json`, a
+  `gate-baseline.json`, an `.oxlintrc.json` and a `node_modules/.bin` linked to the BUILT
+  `geonosis-verify` and `geonosis-ratchet`. A hook tested by calling its policy function proves the
+  policy; only a spawn proves the exit code, the JSON on stdout and the tool resolution — which is
+  the whole of what Claude Code actually reads.
+  
+  The Stop hook is exercised against a real fast tier that really goes red: a law file one line over
+  its baseline, so the ratchet grows and the hook blocks with exit 2, the failing step and its tail on
+  stderr. Then the sixth block prints the report and exits 0; a green run clears the session's count;
+  `stop_hook_active` short-circuits; and a repo with a BACKLOG that did not regress is not blocked at
+  all — which is the whole adoption argument, tested rather than asserted.
+  
+  The suite was falsified before it was trusted: making Stop exit 0 instead of 2, dropping the
+  delivery check, and raising the cap to 50 each turned exactly the tests that should have gone red,
+  red.
+- 60f4d8f: **The law ceiling in both consumers, and an instrument for finding out whether cutting the law
+  helped.** `lawLineCount` is now in `examples/dielime.ratchet.json` and
+  `examples/during-day.ratchet.json`, in the **fast** tier — it reads one file, and a law that grew is
+  exactly the regression a turn should not be allowed to end on. Measured read-only 2026-08-30: those
+  two laws are **382** and **1,104** lines against guidance of 200, and those are the baselines each
+  repo starts from.
+  
+  `geonosis-verify stats [--since <YYYY-MM-DD>] [--json]` reports the **first-try pass rate**: the
+  share of turn-ends whose fast tier was green on the first run. `--since` prints that window AND
+  everything before it, so a before/after comes from one command and one instrument.
+  
+  The Stop hook now records what it gated. It had to: `stop-blocks.json` is the block cap's working
+  memory and a **green turn deletes its own row from it**, so a session that never blocked and one
+  that blocked and recovered are both absent — there was no history to read. The new
+  `.geonosis/stop-turns.json` is two integers a day, and the hook writes it itself because a hook is
+  fetched as a git tree with no install step and may import nothing; a test reads the hook's own output
+  back through `readStats` so the two spellings of the format cannot drift apart.
+  
+  Three refusals, all the same refusal — **an empty record is not a perfect score.** No record says so
+  and gives no rate rather than 100 %; a record that will not parse is an error rather than zero turns;
+  and a turn the hook never gated (`stop_hook_active`, where the gate does not run) is not counted,
+  because there was no first try to have.
+  
+  `docs/law-diet.md` is the M6 procedure end to end: arm the ceiling, record a before, cut in one
+  commit on a day you write down, read the after against the same instrument — and write down what
+  happened even when nothing moved, because a cut that changed nothing says the law was not the
+  binding constraint.
+- 89c6769: The ratchet's own layers are walled, and the walls have a door that is proved open.
+  
+  The three ratchet layers named FILE paths only, so `packages/ratchet/src/index.ts` — the published
+  entry — sat in no layer and could import anything, the CLI included, with lint green. It is
+  `ratchet-api` now, and the formatter it shares with the CLI has moved into a `ratchet-report` layer
+  of its own rather than being counted as part of the CLI it is not.
+  
+  The dogfood suite gains a second kind of plant. A wall that refused everything would be as useless
+  as one that refused nothing, so each layer's permitted import — `verify` reaching the lock through
+  `@geonosis/ratchet` — is planted and asserted to stay CLEAN. Without that, the next engineer widens
+  `mayImport` to get their work through and the wall goes with it.
+- b2d915f: **Fix:** a counter's command no longer loses what it wrote to stderr.
+  
+  `<command> 2>&1` binds the redirect to the LAST command of the string. `echo boom >&2; echo fine`
+  therefore merged nothing, and on a ZERO exit `execSync` hands back stdout alone — so a tool that
+  prints its findings to stderr and exits 0 read as a tool that found nothing. That is the exact shape
+  of a gate that has quietly stopped gating, and it is the one direction in which this kind of bug is
+  dangerous: the number comes back lower than the truth and the baseline banks it.
+  
+  On a NON-ZERO exit the line survived, because the failure path concatenates both captured buffers —
+  but concatenation put every stderr line after every stdout line, moving each diagnostic away from
+  the line it was about, which is what the evidence tail on a regression is for.
+  
+  The command now runs in a subshell, so the shell itself merges the streams in the order they were
+  written. Measured before and after: `echo boom >&2` on a zero exit read `""` and now reads `boom`;
+  `echo one; echo two >&2; echo three; exit 4` read `one three two` and now reads `one two three`.
+- 7762a01: **`testFailures` in summary mode reads the runner's summary LINE, not the word "fail" anywhere in
+  the output.** The regex was unanchored, so anything a command printed on its way to the runner was a
+  candidate count. Reproduced: a command that printed `naming 4 failing test(s)` and then a green
+  `Tests  3 passed (3)` was read as **four failures** — a green run regressing a baseline. That is the
+  false RED mirroring the false green `report: "vitest-json"` exists for; both come from reading
+  something that is not the runner's own last word.
+  
+  Two dialects now, and both were captured from the binary rather than guessed at. vitest 3.2.7's
+  `      Tests  1 failed | 1 passed (2)` — its own label, in its own column, closed by the total in
+  parentheses — and bun 1.4.0's ` 1 fail` on a line of its own, which it prints on a green run too,
+  saying 0. Nothing else counts: `Test Files  1 failed (1)` counts FILES, `(fail) one [11.71ms]` is
+  bun naming one, and a wrapper's prose is a wrapper's prose. All three used to be read as failures.
+  
+  Three consequences beyond the fix. A suite vitest skipped whole (`Tests  2 skipped (2)`) reads 0
+  instead of refusing — it is a run that happened and found nothing red. A suite that threw before
+  collecting (`Tests  no tests`, beside `Test Files  1 failed (1)`) is now **refused** instead of
+  being read as one failing test: nothing there is a count of failing tests, and a gate that cannot
+  measure has not passed. And summaries **add up**, so a command that invokes the runner twice no
+  longer banks the second suite's reds as a win.
+  
+  The refusal names both dialects, so a repo whose runner speaks a third one gets a message instead of
+  a wrong number. `--prove` grew a probe: `summary (vitest)`, `summary (bun)` and `vitest-json` are
+  each shown reading their own planted finding, because a dialect nobody proved is a dialect nobody
+  has been shown to read.
+- 48bce0c: **Fix:** only a counter that measures a quantity accepts a `tolerance`.
+  
+  Any counter took one. `{"counter":"lawLineCount","tolerance":0.5}` over a two-line law with a
+  baseline of 2 printed `ratchet PASS` at three lines — a 50 % growth, waved through. The same edit is
+  `"tolerance": 100` on `oxlintErrors`: the gate switched off from the config file, with the run still
+  reporting green. That is law 2 — never downgrade a rule — wearing a friendlier name, and it was the
+  easiest edit in the repo to get past a reviewer.
+  
+  `Counter` gains `tolerates?: true`, declared only by `bundleBytes` and `fastTierMs`. Whether a
+  number is a measured quantity or a count of findings is the counter's to know, not the config's.
+  Anything else now stops the run, naming the entry:
+  
+  ```
+  geonosis-ratchet: "oxlintErrors" does not accept a tolerance — only a counter that measures a
+  quantity declares one
+  ```
+  
+  The plugin's write guard gains its first **ask**. A write to `geonosis.ratchet.json` that introduces
+  or raises a `"tolerance"` is neither refused nor allowed: it goes in front of the human as
+  `permissionDecision: "ask"`. Widening a band is legitimate and is not the agent's call — a band
+  somebody chose and a band somebody's agent chose are not the same thing. A tolerance carried through
+  an edit unchanged is not a change and says nothing.
+- 461233c: Docs for the two new things: `docs/plugin.md` and `packages/verify/README.md`.
+  
+  `docs/plugin.md` covers installing the plugin from a local path and from the remote once it is
+  pushed, what each of the five hooks does and the reason it does it that way, the five-block cap,
+  which files the runner owns and why the agent may not write them, what to put in `geonosis.json`,
+  and — the section every README skips — what the plugin CANNOT do. A `fast` tier of `["true"]` passes
+  for ever; only `geonosis-ratchet --prove` shows a counter can go red.
+  
+  `packages/verify/README.md` is the runner's own: `--prove` first, the config with no default tier,
+  the three exit codes and why a report that could not be written is exit 2, the report shape with the
+  `<tier>/<n>` id rule, and `--exclusive`.
+  
+  `docs/README.md` indexes both. The ratchet README gains rows for the five new counters, a section on
+  `tolerance` and the shrank-only rewrite it forces, and the landmine that cost an afternoon: a
+  loader or shim named RELATIVELY in a counter's command resolves to nothing under `--prove`, whose
+  probes run in a scratch directory. Write it `$PWD/…` and it works in both.
+- e48501b: `@geonosis/verify` — one gate runner, with a report a hook can read.
+  
+  `geonosis-verify <tier>` runs the shell steps a repo declared under `verify` in `geonosis.json`,
+  serially, stopping at the first red, and writes `.geonosis/gate-report.json`:
+  `{ tier, startedAt, finishedAt, ok, steps: [{ id, command, ok, exitCode, ms, tail, skipped? }] }`.
+  A step whose text is another tier's name is that tier, inlined in place; the inlined steps keep the
+  tier that declared them, so `fast/2` is the same command whether the operator ran `fast` or ran the
+  `full` tier that inlines it.
+  
+  There is no default tier and there never will be one: no config, no `verify` object, or an unknown
+  tier is refused by name with exit 2, and so is a green run whose report could not be written — a
+  gate that cannot record has not passed. A failed step is exit 1.
+  
+  `--exclusive` takes the ratchet's machine-wide lock through `@geonosis/ratchet`'s published entry
+  (`--exclusive-timeout <seconds>` bounds the wait), so a verify and a ratchet on one laptop serialise
+  against each other rather than each against itself. `--prove` plants a tier with one passing step
+  and one that exits 3, runs the real binary over it in a temp directory, and checks the failure
+  reached the report — a runner that reports green is worth nothing until it has been watched going
+  red on purpose.
+  
+  The kit walls the new package with its own `layer-walls` rule: `verify` may import `ratchet-api`
+  and nothing behind it, planted against in the dogfood suite like the other walls.
+- 7e8d2c1: `walkFindings`: the defects `geonosis-walk` reported, as debt that may only shrink. Reads the walk's
+  JSON report (`report`), counts findings across every page, and scopes to named classes with
+  `classes` — refusing a class the walk does not have rather than reporting a confident zero for a
+  typo. A missing or unparsable report is a refusal, never a zero (D-030): the walk writes no report
+  when it could not run, and answering zero there would make its loudest failure the best number on
+  the board.
+
+## 0.6.0
+
+### Minor Changes
+
+- **No counter changed.** The version moves because the packages release as one fixed group.
+
+- **Two things this package cannot see about itself now have somewhere to be seen from.** A baseline
+  is lowered in place when a number shrinks, which is also what lets a branch raise one back up and
+  stay green on every gate it runs; and a workspace whose suite no `testFailures` entry covers is
+  unmeasured, which reads exactly like green. `geonosis-doctor --baseline-against <ref>` asks the
+  first from outside the checkout, and its `runner` check names the workspaces the second applies
+  to. Measured on the two consumers the day it shipped: 28 such workspaces in one, 8 in the other.
+  See [`@geonosis/doctor`](https://www.npmjs.com/package/@geonosis/doctor).
+
+## 0.5.0
+
+### Minor Changes
+
+- **New rule `cell-no-cross-feature-organelles` (preset `frontend`).** `organelle-dependency` is scoped
+  to `organelles/` and `no-cross-feature-stores` only judges stores, so a CELL importing another
+  feature's ORGANELLE passed both while both stayed green. Option `sharedFeatures`, default
+  `['shared']` — the same option and the same default as `organelle-dependency`'s, because the two
+  rules draw one boundary from two sides. Measured on a consumer: three findings in two files.
+  
+  **The corpus carries both spellings of every direction rule.** A direction rule judges where an
+  import lands, so `@/features/billing/x` and `../../billing/x` are one breach; the corpus previously
+  carried whichever spelling each rule's author happened to write. Fifteen fixtures added. No rule
+  changed.
+  
+  **`geonosis-lint-parity --corpus --expect-changed <rule,…>`.** A changelog line that names a rule is
+  a claim; this makes it data the corpus judges, and exits 1 on a claim the corpus is silent about or a
+  change nobody claimed. Mandatory for any release whose notes name a rule.
+  
+  **`testFailures` reads the runner's JSON report** with `report: "vitest-json"`, refusing when the
+  report is absent, unparsable, missing `numFailedTests`, or says `success: false` while naming none.
+  `Counter.probe` takes a list, so `--prove` proves each reading mode by name.
+  
+  **`geonosis-ratchet --prove` proves the lock**, by running two children of the CLI over a slow
+  `--hold` and requiring the second to start after the first finished.
+  
+  `@geonosis/ratchet`'s source is layered — `core/`, `counters/`, `report.ts`, `cli.ts` — with no
+  change to what `@geonosis/ratchet` exports or to a single line the CLI prints.
+
+## 0.4.0
+
+### Patch Changes
+
+- `--exclusive` did not serialise, and the test that should have said so was blamed for it.
+  
+  `openSync(path, 'wx')` is atomic about the NAME only: the file it creates is empty until the holder
+  lands on the next syscall, and a run polling in that window reads a lock nobody can parse, calls it
+  stale — `taking over a stale heavy lock (pid unreadable is gone)` — removes it and takes it. Two runs,
+  one lock, both certain they held it. It reproduced three times in five on a loaded laptop, which is
+  the only kind of machine the lock is for.
+  
+  The holder is now written under a private name and hard-linked into place: `link` fails `EEXIST`
+  exactly as `'wx'` did, and when it succeeds there was never an instant at which the lock existed
+  without its holder inside it. The staging name is dropped either way, so a contended run leaves
+  nothing behind in `~/.cache/geonosis/`.
+  
+  The test's ordering is causal now rather than temporal: the holding run leaves its critical section
+  only when the test opens a barrier, and the test opens it when the OTHER run says it is waiting.
+
+## 0.3.0
+
+## 0.2.1
+
+### Patch Changes
+
+- Gates prove they can fail (plan 019, K2.1–K2.3).
+  
+  - **`geonosis-ratchet --prove`** — every counter ships a falsification probe: a known-bad input it
+    must be able to read. `--prove` runs each configured counter's probe in a temp directory, never in
+    the repo, and exits 2 on the first counter that reads 0, misreads, throws, or ships no probe.
+    A counter that has never been seen read a planted finding has not been shown to measure (D-029).
+  - **`--exclusive`** — a machine-wide lock at `~/.cache/geonosis/heavy.lock` before anything heavy,
+    with a bounded printed wait (`--exclusive-timeout`, default 1800s), stale-holder takeover, and
+    release on SIGINT/SIGTERM.
+  - **`typecheckErrors` refuses on an unbuilt workspace** — TS2305/TS2307 naming a package of this
+    workspace is a missing build, not debt, and a number there would be wrong (D-030).
+  
+  The plugin and `@geonosis/lint-parity` carry no change in this release; they move because the three
+  packages are a fixed version group.
+
+## 0.2.0
+
+### Minor Changes
+
+- Loose coupling, first slice — and a posture change that will break a config on purpose.
+  
+  **`@geonosis/lint-parity` is a new package.** Findings parity, rule reach, the corpus-manifest
+  contract and the `geonosis-lint-parity` bin now live on their own. The tool knows no rule name and
+  no plugin: two oxlint configs and a tree are the whole input, and a corpus arrives as a directory
+  whose own `manifest.json` says which rules it speaks for. A parity tool welded to one rule plugin
+  can only ever check that plugin.
+  
+  **BREAKING (plugin): the `geonosis-lint-parity` bin and the `./parity` export are gone.** Install
+  `@geonosis/lint-parity` and pass `--corpus node_modules/@geonosis/oxlint-plugin-biological-architecture/corpus`
+  — the plugin still ships the corpus, which is the part that is genuinely its own. `--corpus` now
+  requires its directory.
+  
+  **BREAKING (plugin): a rule enabled without the options it needs refuses the run.** `no-brand-names`,
+  `no-raw-html-atoms`, `documents-share-one-table`, `document-sagas-are-generic`,
+  `step-opens-its-own-cell` and `layer-walls` throw from `create()` naming the missing option, instead
+  of returning an empty visitor. A consumer that enabled one bare will fail lint until it configures
+  the rule or turns it off — which is the point: one consumer ran `no-raw-html-atoms` at "error" for
+  months with no element→atom map, over 136 raw elements, and the gate was green. An enabled rule that
+  cannot fire is indistinguishable from compliance. A rule nobody enabled still does nothing.
+  
+  **New rule `layer-walls`, new preset `tooling`.** A repo declares its own layers as data —
+  `{ name, paths, mayImport }` — and the rule enforces the direction between them: relative sources
+  resolved against the importing file first, `import()`, `require()` and both re-export forms visited,
+  externals not walls unless asked. The kit enables it on itself.
+  
+  The plugin also ships type declarations now, for all three entries.
+
+## 0.1.2
+
+### Patch Changes
+
+- Four findings from the 0.1.1 code review, plus a version that disagreed with itself.
+  
+  **`--corpus` scopes its verdict to the rules its corpus can speak for.** It built the list of
+  configured rules from every rule id in both configs, but the shipped corpus only exercises this
+  plugin's. Any real consumer config also enables `eqeqeq`, `no-throw-literal` and
+  `typescript/no-explicit-any`, so `--corpus` reported `FAIL — fired under neither` on every
+  adoption. A corpus now declares its own scope in a `manifest.json` generated from the plugin's
+  rules export; rules it does not name are listed under "outside this corpus" with no verdict, and
+  neither the exit code nor `neither` considers them. `--corpus <dir>` points the run at another
+  plugin's corpus. Matching is on full `plugin/rule` ids on both sides, so
+  `typescript(no-unused-vars)` can never stand as evidence for somebody else's `no-unused-vars`.
+  
+  **Parity identifies a finding by its place and its rule, not its wording.** `path:line:col` plus
+  `plugin(rule)`; message and severity are excluded. Diffing whole lines meant a rule whose message
+  was copy-edited read as one finding lost and one gained — exit 1, a stopped adoption over a
+  sentence. Those pair up in a new `messageChanged` list, reported under its own heading and written
+  to `changed.txt`, and never reach the exit code. Multiset semantics are unchanged.
+  
+  **`oxlintRule` gets the cross-check the error and warning counters already had.** It counted
+  `(rule)` anywhere in the output, so a format that printed rule ids differently read as 0 and the
+  ratchet banked the "win" by rewriting the baseline down — and a quoted source line containing
+  `(a-rule-name)` counted as a finding. The count now comes off recognised finding lines only, and a
+  run with findings where none attributes itself readably is refused. The strict-config copy also
+  upgrades the `["off", { … }]` array form, which is how every rule with options is parked
+  mid-migration.
+  
+  **The warnings-only window is documented and closable.** oxlint exits 0 when a run found only
+  warnings, so the counters' non-zero-exit backstop cannot catch an unrecognised format on such a
+  run. The README states this plainly and says why `--deny-warnings` is not the fix. New optional
+  counter param `expectFormat: "unix" | "agent" | "default"` refuses output in no known shape even on
+  a clean exit, once npm's own chatter is stripped. Unset is the default and changes nothing.
+  
+  **The plugin reported `meta.version` 0.1.0 while shipping 0.1.1.** It is read from `package.json`
+  now, and a test asserts the two agree.
+
+## 0.1.1
+
+### Patch Changes
+
+- The defects the first real adoption exposed.
+  
+  - **The oxlint counters had never measured anything.** `oxlintErrors` and `oxlintWarnings` matched
+    `/: error /`, which is the shape of oxlint's compact `agent` format alone, while every config asks
+    for `--format=unix`. They now read all three shapes oxlint prints and cross-check the count
+    against the tool's own summary, raising `CounterError` rather than returning a number they cannot
+    corroborate — a blind counter reports 0 and lets the ratchet rewrite the baseline DOWN as a win.
+  - **`cell-must-not-compose-cell` fired on the barrel `cells-folder-index-is-barrel` demands.**
+    dielime's adoption reported 32 errors, every one a `cells/index.ts` re-exporting siblings, which
+    is the shape the other rule requires at the same severity. The two rules now read one shared list
+    of barrel filenames. A real cell importing or re-exporting another cell still fires.
+  - **`geonosis-lint-parity`.** The adoption proof — same tree, two configs, a findings diff — as a
+    bin instead of forty tool calls. Exits 1 when a finding the old config caught is missing under the
+    new one. `--corpus` answers the prior question first: does each configured rule fire anywhere at
+    all? The package now ships the reach corpus that makes that answerable, with a file for every one
+    of its 54 rules.
+  - **The ratchet shows what grew.** A regressed counter prints the last ten lines of its own command
+    output under the `<-- REGRESSED` line, so the report answers the question it used to raise.

package/bin/geonosis-ratchet.mjs

@@ -17,11 +17,25 @@ const newest = (dir) =>
       }, 0)
     : 0
 const src = join(here, '..', 'src')
-if (existsSync(src) && newest(src) > newest(join(here, '..', 'dist'))) {
-  process.stderr.write(
-    'geonosis-ratchet: dist is older than src — run pnpm build before trusting this bin.\n',
-  )
-  process.exit(2)
+const dist = join(here, '..', 'dist')
+// `newest` answers 0 for a directory that is NOT THERE and for one that is merely old, so the
+// two conditions were one comparison and one sentence — and the staleness sentence was printed
+// over trees that had never been built at all, blocking a turn in a fresh git worktree, which
+// has no dist because dist is not committed (#357). Only the second is evidence of a mistake.
+if (existsSync(src)) {
+  const built = newest(dist)
+  if (built === 0) {
+    process.stderr.write(
+      'geonosis-ratchet: this tree has never been built — run pnpm build. No dist here at all, which is what a fresh clone or a linked git worktree starts with; nothing is stale.\n',
+    )
+    process.exit(2)
+  }
+  if (newest(src) > built) {
+    process.stderr.write(
+      'geonosis-ratchet: dist is older than src — run pnpm build before trusting this bin.\n',
+    )
+    process.exit(2)
+  }
 }
 
 await import('../dist/cli.js')

package/dist/{chunk-E55APSHM.js → chunk-2EAYMSC5.js}

@@ -516,11 +516,6 @@ var runRatchet = async ({
       continue;
     }
     const limit = baseline[key];
-    if (typeof limit !== "number") {
-      throw new Error(
-        `${config.baseline} has no number for "${key}" \u2014 add it before enabling the counter`
-      );
-    }
     const tolerance = toleranceOf(entry, key, counter);
     const recorder = recorded(counter, entry, runCommand(cwd, entry.counter));
     let now;
@@ -534,6 +529,10 @@ var runRatchet = async ({
       });
       continue;
     }
+    if (typeof limit !== "number") {
+      measurements.push({ baseline: now, evidence: [], key, now, verdict: "adopted" });
+      continue;
+    }
     const verdict = verdictOf(now, limit, tolerance);
     measurements.push({
       baseline: limit,
@@ -545,16 +544,24 @@ var runRatchet = async ({
   }
   const grew = measurements.some((one) => one.verdict === "grew");
   const shrank = measurements.some((one) => one.verdict === "shrank");
-  if (shrank && !grew && refusals.length === 0) {
+  const measuredNew = measurements.flatMap((one) => one.verdict === "adopted" ? [one.key] : []);
+  const adopted = refusals.length === 0 ? measuredNew : [];
+  if (adopted.length > 0 || shrank && !grew && refusals.length === 0) {
     const next = { ...baseline };
     for (const one of measurements) {
-      if (one.verdict === "shrank") next[one.key] = one.now;
+      if (one.verdict === "adopted" || one.verdict === "shrank" && !grew) next[one.key] = one.now;
     }
     writeFileSync4(baselinePath, `${JSON.stringify(next, null, 2)}
 `);
-    return { considered: config.counters.length, measurements, refusals, rewritten: true };
+    return {
+      adopted,
+      considered: config.counters.length,
+      measurements,
+      refusals,
+      rewritten: true
+    };
   }
-  return { considered: config.counters.length, measurements, refusals, rewritten: false };
+  return { adopted, considered: config.counters.length, measurements, refusals, rewritten: false };
 };
 
 // src/counters/params.ts
@@ -707,6 +714,62 @@ var disabledCiJobs = {
   }
 };
 
+// src/counters/doctor.ts
+var ID = "doctorWarnings";
+var reportIn = (output) => {
+  let found;
+  for (let at = output.indexOf("{"); at !== -1; at = output.indexOf("{", at + 1)) {
+    try {
+      const parsed = JSON.parse(output.slice(at));
+      if (typeof parsed === "object" && parsed !== null) found = parsed;
+    } catch {
+      continue;
+    }
+  }
+  return found;
+};
+var CONFIG_AND_RULE = " \u2192 ";
+var about = (one) => {
+  const subject = String(one.subject ?? "");
+  const at = subject.indexOf(CONFIG_AND_RULE);
+  return `${String(one.check ?? "")}:${at === -1 ? subject : subject.slice(at + CONFIG_AND_RULE.length)}`;
+};
+var doctorWarnings = {
+  id: ID,
+  probe: {
+    command: () => `node -p "require('fs').readFileSync('doctor.json','utf8')"`,
+    expect: 2,
+    input: (dir) => plant(
+      dir,
+      "doctor.json",
+      `${JSON.stringify({
+        findings: [
+          { check: "exercised", subject: "a/.oxlintrc.json \u2192 ns/one", verdict: "WARN" },
+          { check: "exercised", subject: "b/.oxlintrc.json \u2192 ns/one", verdict: "WARN" },
+          { check: "drift", subject: "LAW.md", verdict: "WARN" },
+          { check: "drift", subject: "fine.md", verdict: "OK" }
+        ]
+      })}
+`
+    )
+  },
+  run: async ({ params, run }) => {
+    const command = stringParam(ID, params, "command", "npx geonosis-doctor --json");
+    const output = run(command).output;
+    const findings = reportIn(output)?.findings;
+    if (!Array.isArray(findings)) {
+      throw new CounterError(
+        ID,
+        `\`${command}\` printed no doctor report with a findings list \u2014 a gate that cannot measure has not passed. Its output began: ${output.trim().slice(0, 200)}`
+      );
+    }
+    const warned = new Set(
+      findings.filter((one) => typeof one === "object" && one !== null).filter((one) => one.verdict === "WARN").map(about)
+    );
+    return warned.size;
+  }
+};
+
 // src/counters/duplication.ts
 var CLONES = /Found (\d+) clones?/;
 var cloneCount = {
@@ -1191,7 +1254,7 @@ import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
 import { createRequire } from "module";
 import { join as join6, resolve as resolve12 } from "path";
 import { pathToFileURL } from "url";
-var ID = "probelessRules";
+var ID2 = "probelessRules";
 var OFF = /* @__PURE__ */ new Set([0, "0", "allow", "off", false]);
 var severityOf2 = (level) => Array.isArray(level) ? level[0] : level;
 var enabledIn = (config, namespace) => {
@@ -1214,7 +1277,7 @@ var probedBy = async (cwd, plugin) => {
     entry = createRequire(join6(cwd, "noop.js")).resolve(plugin);
   } catch (error) {
     throw new CounterError(
-      ID,
+      ID2,
       `could not resolve ${plugin} from ${cwd} \u2014 ${String(error.message).split("\n")[0]}. A plugin nobody can load says nothing about which rules ship a probe, and it is not zero of them`
     );
   }
@@ -1222,12 +1285,12 @@ var probedBy = async (cwd, plugin) => {
   try {
     loaded = await import(pathToFileURL(entry).href);
   } catch (error) {
-    throw new CounterError(ID, `could not import ${entry} \u2014 ${error.message}`);
+    throw new CounterError(ID2, `could not import ${entry} \u2014 ${error.message}`);
   }
   const namespace = loaded.default?.meta?.name;
   if (typeof namespace !== "string" || namespace === "") {
     throw new CounterError(
-      ID,
+      ID2,
       `${plugin} declares no meta.name, so nothing says which rule ids in the config are its own`
     );
   }
@@ -1240,7 +1303,7 @@ var probedBy = async (cwd, plugin) => {
 };
 var PLUGIN = "@geonosis/oxlint-plugin-biological-architecture";
 var probelessRules = {
-  id: ID,
+  id: ID2,
   probe: {
     expect: 1,
     input: (dir) => {
@@ -1266,16 +1329,16 @@ var probelessRules = {
     params: { plugin: "probe-plugin" }
   },
   run: async ({ cwd, params }) => {
-    const relative = stringParam(ID, params, "config", ".oxlintrc.json");
+    const relative = stringParam(ID2, params, "config", ".oxlintrc.json");
     const path = resolve12(cwd, relative);
-    if (!existsSync9(path)) throw new CounterError(ID, `no oxlint config at ${relative}`);
+    if (!existsSync9(path)) throw new CounterError(ID2, `no oxlint config at ${relative}`);
     let config;
     try {
       config = JSON.parse(readFileSync10(path, "utf8"));
     } catch (error) {
-      throw new CounterError(ID, `${relative} does not parse: ${error.message}`);
+      throw new CounterError(ID2, `${relative} does not parse: ${error.message}`);
     }
-    const { namespace, probed } = await probedBy(cwd, stringParam(ID, params, "plugin", PLUGIN));
+    const { namespace, probed } = await probedBy(cwd, stringParam(ID2, params, "plugin", PLUGIN));
     return enabledIn(config, namespace).filter((rule) => !probed.has(rule)).length;
   }
 };
@@ -1956,6 +2019,7 @@ var COUNTERS = [
   bundleBytes,
   cloneCount,
   disabledCiJobs,
+  doctorWarnings,
   fastTierMs,
   floorSurface,
   knipIssues,
@@ -1989,7 +2053,12 @@ var counterById = (id) => {
 
 // src/report.ts
 var WIDTH = 28;
-var formatReport = ({ measurements, refusals, rewritten }) => {
+var formatReport = ({
+  adopted,
+  measurements,
+  refusals,
+  rewritten
+}) => {
   const lines = measurements.map((one) => {
     if (one.verdict === "skipped") {
       return `  SKIP ${one.key}: not measured by --tier ${one.tier}`;
@@ -2000,6 +2069,9 @@ var formatReport = ({ measurements, refusals, rewritten }) => {
       return [regressed, ...one.evidence.map((line) => `      ${line}`)].join("\n");
     }
     if (one.verdict === "shrank") return `${head}  <-- improved -${one.baseline - one.now}`;
+    if (one.verdict === "adopted") {
+      return `${head}  <-- ADOPTED: measured for the first time and written, not judged`;
+    }
     return head;
   });
   lines.push(...refusals.map((one) => `  CANNOT MEASURE ${one.key}: ${one.reason}`));
@@ -2014,6 +2086,11 @@ var formatReport = ({ measurements, refusals, rewritten }) => {
       "",
       "ratchet FAIL \u2014 debt grew. Fix it, or say in the commit message why the baseline goes up."
     );
+  } else if (adopted.length > 0) {
+    lines.push(
+      "",
+      `ratchet DID NOT PASS \u2014 ${adopted.join(", ")} measured for the first time and written, not judged. Nothing shrank and nothing was lowered. Read the number, commit it, and run again.`
+    );
   } else if (rewritten) {
     lines.push("", "ratchet PASS \u2014 debt shrank; the baseline was lowered to lock the win in.");
   } else {

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   runRatchet,
   versionOf,
   writeEnvelope
-} from "./chunk-E55APSHM.js";
+} from "./chunk-2EAYMSC5.js";
 
 // src/cli.ts
 import process from "process";
@@ -143,6 +143,13 @@ var measure = async () => {
 ` : `envelope: ${at}
 `);
   if (result.refusals.length > 0) return 2;
+  if (result.adopted.length > 0) {
+    process.stdout.write(
+      `adopted ${result.adopted.join(", ")} \u2014 measured for the first time and written to the baseline, not judged. Read the number, commit it, and run again: this run does not pass on a floor nobody has seen.
+`
+    );
+    return 1;
+  }
   return result.measurements.some((one) => one.verdict === "grew") ? 1 : 0;
 };
 try {

package/dist/index.d.ts

@@ -116,7 +116,11 @@ type Measurement = {
     evidence: string[];
     key: string;
     now: number;
-    verdict: 'grew' | 'held' | 'shrank';
+    /**
+     * `adopted` is a key the baseline had never held: measured, written by the runner, and NOT
+     * judged. It carries no `baseline` of its own, because there was none to compare against.
+     */
+    verdict: 'adopted' | 'grew' | 'held' | 'shrank';
 } | {
     key: string;
     tier: string;
@@ -176,6 +180,12 @@ type Refusal = {
     reason: string;
 };
 type RatchetResult = {
+    /**
+     * The keys this run measured for the FIRST time and wrote into the baseline. Never empty on a run
+     * that passed: an adopted key makes the run refuse, because a first number nobody has looked at
+     * is not a floor anybody agreed to.
+     */
+    adopted: string[];
     /**
      * How many counters the config named. The denominator: `considered === measurements.length +
      * refusals.length`, and a run whose two do not add up has lost one somewhere between the config
@@ -348,7 +358,7 @@ declare const runRatchet: ({ counters, cwd, tier, }: {
  * the tier left out says so by name — printing a number for it would be the stale OK this exists
  * to prevent.
  */
-declare const formatReport: ({ measurements, refusals, rewritten }: RatchetResult) => string;
+declare const formatReport: ({ adopted, measurements, refusals, rewritten, }: RatchetResult) => string;
 declare const formatProve: ({ proofs, proven }: ProveResult) => string;
 
 /**

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   runRatchet,
   versionOf,
   writeEnvelope
-} from "./chunk-E55APSHM.js";
+} from "./chunk-2EAYMSC5.js";
 export {
   CONFIG_FILE,
   COUNTERS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geonosis/ratchet",
-  "version": "2.3.0",
+  "version": "2.4.2",
   "types": "./dist/index.d.ts",
   "description": "Debt as a number that may only shrink — one ratchet, pluggable counters.",
   "keywords": [
@@ -31,6 +31,7 @@
     }
   },
   "files": [
+    "CHANGELOG.md",
     "bin",
     "dist"
   ],