@hublo/sentinel 1.5.0 → 1.5.1-alpha.1

package/docs/lint-adoption.md

@@ -17,21 +17,29 @@ pnpm install
 
 Then run `pnpm run lint`.
 
-`--init` with no target adopts **every role sentinel ships**, and for lint that is the
+`--init` with no target on a module that has adopted nothing adopts **every role sentinel
+ships** (on a module that has, it re-inits the roles it has), and for lint that is the
 intended way round: it runs the linter's autofix, then writes the format config and formats
-the module, so the files it generated are already in your module's style. Adopting lint
-ALONE (`--init --lint`) leaves you to format them yourself.
+the module, so the files it generated are already in your module's style.
+
+**Lint and format are adopted together.** `--init --lint`, `--init --format` and
+`--init --lint --format` do the same thing: oxlint AND oxfmt, and the module excluded from the
+root `.prettierignore`, exactly as a bare `--init` does for those two roles. Since 1.5.1; before
+it, lint alone left the module to the root Prettier, which then rejected the `.oxlintrc.json`
+adoption had just written.
 
 `--init` fixes what a machine can fix, once. It does not loop, and it does not edit your code
 beyond what the tools' own fixers do. What is left afterwards is real debt: see
 [Reading the numbers](#reading-the-numbers).
 
-> **Order matters, and `--init` with no target gets it right for you.** The linter's autofix
-> rewrites code, and sentinel writes JSON in its own style, so **formatting has to come after
-> linting**, never before. Run whole-module `--init` and it happens automatically: format runs
-> LAST, over everything every role wrote. If you adopt roles one at a time, run
-> `sentinel --init --format` after `sentinel --init --lint`, or your first `pnpm run lint`
-> fails at a formatting step that has nothing to do with linting.
+**Previewing the source rewrite.** `--init --dry-run` says the autofix can rewrite source, without
+running it. `--init --dry-run --rehearse` runs it in a throwaway copy of the module and names the
+files, at the cost of the real pass (minutes on a large nest module, nearly all of it
+`@nx/enforce-module-boundaries`).
+
+> **Order matters, and `--init` gets it right for you.** The linter's autofix rewrites code,
+> and sentinel writes JSON in its own style, so **formatting has to come after linting**, never
+> before. Whatever targets you name, format runs LAST, over everything every role wrote.
 
 ## What `--init` does
 
@@ -150,6 +158,11 @@ a **layer above the preset**, the way the planning team did:
 Order matters, sentinel's preset first, or your layer cannot override anything. `--inspect`
 reports the layer so it stays visible.
 
+A rule set directly in `.oxlintrc.json` is still reported as drift, and a layer is the place for
+it. Since 1.5.1 a re-`init` no longer deletes it, if the preset does not configure that rule: it
+is kept, in your order, and `--init` says so. A rule the preset does configure is dropped, as
+before, and named: set in the stub, it would override the preset and the baseline both.
+
 Think of it as a queue rather than a fork: a rule promoted into the preset is deleted from the
 layer. It is the exact mirror of `.oxlintrc.baseline.json`, which holds rules **below** the
 preset and empties as debt is fixed, while a layer holds rules **above** it and empties as they
@@ -160,6 +173,56 @@ whatever `extends` it finds, so a layer already there survives and is respected
 that follows. Added afterwards, the autofix has already run, and nothing undoes what it
 rewrote. One team met this as twelve rewritten files.
 
+### Where a team puts its own guards
+
+Lint is always migrated, so a guard your ESLint carried and the preset does not is yours to add,
+in your own config. A re-`init` keeps all of it (since 1.5.1): your `extends` layers in their
+order after sentinel's preset, and in `.oxlintrc.json` your `rules`, `plugins`, `jsPlugins`,
+`settings` and `overrides`. `--init` prints one line per block it kept.
+
+`console` keeps two rules the react preset does not configure, directly in its stub:
+
+```json
+{
+  "extends": ["./node_modules/@hublo/sentinel/lint/react.json"],
+  "rules": {
+    "import/no-cycle": "error",
+    "oxc/no-barrel-file": ["error", { "threshold": 0 }]
+  }
+}
+```
+
+A local plugin and file-scoped rules, the shape a planning layer takes:
+
+```json
+{
+  "extends": ["./node_modules/@hublo/sentinel/lint/react.json"],
+  "jsPlugins": [{ "name": "planning", "specifier": "./lint/planning-plugin.mjs" }],
+  "overrides": [
+    {
+      "files": ["src/modules/planning/**/*.tsx"],
+      "rules": { "planning/no-raw-date": "error", "max-depth": ["error", 3] }
+    }
+  ]
+}
+```
+
+Two limits, both the preset's governance:
+
+- **An entry the preset already has is the preset's.** A rule it configures (top level or in one
+  of its overrides, at any severity), a `jsPlugins` entry it registers under the same name, a
+  `settings` key it sets: written in the stub, it would override sentinel's, so a re-`init` drops
+  it and names it. That includes `no-console` and `no-restricted-imports` in the react preset. To
+  set one of those for your module, put it in an `extends` layer after the preset (above): a
+  layer is reviewed as yours and `--inspect` shows it.
+- **Your `overrides` blocks are kept as written**, with their `files`, and their rules go through
+  the same filter. Two of your blocks with the same `files` are merged into one on re-`init`; a
+  block is never merged into a preset override, which lives behind `extends` where the stub
+  cannot write. Measured on oxlint 1.77.0, the version sentinel ships: an `overrides` block in an
+  extended file DOES apply, and `plugins` and `jsPlugins` in the stub add to the extended ones
+  rather than replace them. The planning layer's notes say overrides do not cross `extends`; that
+  is not what 1.77.0 does.
+
 ## What a preset does not enforce
 
 Every unenforced rule carries a reason, readable with `sentinel --inspect --lint`:
@@ -274,7 +337,7 @@ The numbers come from oxlint's own JSON, not from parsing what it prints for hum
 
 | Symptom                                                    | Cause and fix                                                                                                                                                                                                                       |
 | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pnpm run lint` fails on **Prettier** right after adopting | you adopted lint alone, so the files sentinel generated are not in your module's format. Run `sentinel --init --format` (or your formatter) on them                                                                                 |
+| `pnpm run lint` fails on **Prettier** right after adopting | the module was adopted by a sentinel older than 1.5.1 with lint alone, so it is still formatted by the root Prettier. Re-run `sentinel --init --lint`: it adopts format with it                                                     |
 | `Plugin 'x' not found` / `extends … does not exist`        | the preset path assumes pnpm's isolated layout. Run `pnpm install` in the module; if the workspace switched to a hoisted linker, that breaks every adopted module at once                                                           |
 | A file that was never linted now reports errors            | your ESLint config ignored it. `--init` carries your module's `ignores` across, but it **cannot read a computed one** (e.g. `includeIgnoreFile(gitignorePath)`) and says so when it hits one. Add what you need to `ignorePatterns` |
 | `error: Unexpected token` in a `.svelte` file              | oxlint reads a `<script>` block as JavaScript unless it declares `lang="ts"`. Add it, or ignore the file                                                                                                                            |

package/docs/typescript-adoption.md

@@ -76,6 +76,7 @@ sentinel --inspect --typescript                 # adoption + conformity coverage
 | `--json`                | machine-readable envelope on stdout, for every verb; progress goes to stderr        |
 | `--max-diagnostics <n>` | cap the diagnostics embedded per module in `--run --json` (`0` = no cap)            |
 | `--dry-run`             | preview what `--init` would write, changing nothing                                 |
+| `--rehearse`            | with `--dry-run`: run the autofix passes in a copy and name the source they rewrite |
 | `--runner <tool>`       | override the default runner                                                         |
 | `-- <tool options>`     | `--run` only, one type named: everything after `--` goes to tsc itself (see below)  |
 

package/docs/typescript-traces.md

@@ -1298,10 +1298,259 @@ $ sentinel --init --dry-run
     +     }
     +   }
     + }
+  dry run: the lint autofix runs on adoption and can rewrite source, as moving to another linter does; add --rehearse to name the files (it runs the pass in a throwaway copy, as long as the real one)
+  dry run: the format autofix runs on adoption and can rewrite source, as moving to another formatter does; add --rehearse to name the files (it runs the pass in a throwaway copy, as long as the real one)
   dry run: would ignore static-analysis-report/ in the root .gitignore
 # exit: 0
 ```
 
+**--init --dry-run --rehearse (runs the autofixes in a copy, names what they rewrite)**
+
+```console
+$ sentinel --init --dry-run --rehearse
+  dry run: no files written
+  wrote .oxlintrc.json extending ./node_modules/@hublo/sentinel/lint/nest.json (@hublo/sentinel@<version>)
+  20 rule(s) not enforced by this preset (17 jest, 1 no-barrel-files, 1 core, 1 vitest). Run --inspect --lint for each rule and why.
+  run `pnpm install`, then `pnpm run lint`
+
+  create .oxlintrc.json
+    + {
+    +   "extends": [
+    +     "./node_modules/@hublo/sentinel/lint/nest.json"
+    +   ],
+    +   "ignorePatterns": [
+    +     "**/dist/**",
+    +     "**/node_modules/**",
+    +     "coverage/**",
+    +     "**/jest.*.{ts,js,cjs,mjs}",
+    +     "**/eslint.config.{js,cjs,mjs}",
+    +     "**/*.timestamp*",
+    +     "**/*.d.ts"
+    +   ]
+    + }
+
+  update package.json
+    - { "name": "bff-admin", "dependencies": { "@nestjs/core": "^10" } }
+    + {
+    +   "name": "bff-admin",
+    +   "dependencies": {
+    +     "@nestjs/core": "^10"
+    +   },
+    +   "scripts": {
+    +     "lint": "sentinel --run --lint"
+    +   },
+    +   "devDependencies": {
+    +     "@hublo/sentinel": "<version>"
+    +   },
+    +   "nx": {
+    +     "targets": {
+    +       "lint": {
+    +         "cache": true,
+    +         "inputs": [
+    +           "default",
+    +           "^default",
+    +           "{projectRoot}/.oxlintrc.json"
+    +         ]
+    +       }
+    +     }
+    +   }
+    + }
+  dry run: no files written
+  run `pnpm install` to fetch @hublo/sentinel (added to the module devDependencies) so `extends` and the typecheck script resolve
+
+  update tsconfig.json
+    - { "extends": "../../tsconfig.base.json", "include": ["src"] }
+    + { "extends": [
+    +     "../../tsconfig.base.json",
+    +     "@hublo/sentinel/typescript/nest"
+    +   ], "include": ["src"] }
+
+  update package.json
+    - { "name": "bff-admin", "dependencies": { "@nestjs/core": "^10" } }
+    + {
+    +   "name": "bff-admin",
+    +   "dependencies": {
+    +     "@nestjs/core": "^10"
+    +   },
+    +   "scripts": {
+    +     "typecheck": "sentinel --run --typescript"
+    +   },
+    +   "devDependencies": {
+    +     "@hublo/sentinel": "<version>"
+    +   },
+    +   "nx": {
+    +     "targets": {
+    +       "typecheck": {
+    +         "cache": true,
+    +         "inputs": [
+    +           "default",
+    +           "^default",
+    +           "{projectRoot}/tsconfig.json"
+    +         ]
+    +       }
+    +     }
+    +   }
+    + }
+  build: no Vite config in this module, so there is nothing to point at sentinel. This role moves an existing config's imports; it does not introduce a bundler. If this module builds another way (38 services here build through `@nx/webpack`), the build role does not apply to it.
+  test: this module has no test and no jest leftovers, so there is nothing to do here.
+  dry run: no files written
+  added the three `static-analysis` scripts and static-analysis.config.mjs; declare this module's entry points there, everything else comes from the role
+
+  create static-analysis.config.mjs
+    + import { defineStaticAnalysis } from '@hublo/sentinel/static-analysis'
+    + 
+    + export default defineStaticAnalysis({
+    +   root: import.meta.dirname,
+    + 
+    +   // Files that RUN although nothing imports them: they are where reachability starts. Added to
+    +   // the patterns sentinel ships, never replacing them.
+    +   entry: [],
+    + 
+    +   // ---------------------------------------------------------------------------------------------
+    +   // What this module can move, with the role's value today. A setting you leave out keeps that
+    +   // value; a setting you write REPLACES it, including inside a list. Anything you set is printed
+    +   // under "measured with" in the report and marked `(module)`, because two modules measured with
+    +   // different settings can no longer be compared.
+    +   //
+    +   //   ignore                  19 patterns
+    +   //   languages               javascript, typescript, jsx, tsx, css, scss
+    +   //   duplication.minTokens   50
+    +   //   duplication.minLines    5
+    +   //   duplication.tests       3 patterns
+    +   //   deadCode.minConfidence  60
+    +   //   deadCode.categories     unused-file, unused-export, unused-symbol, unused-import
+    +   //   graph.resolution        1
+    +   //
+    +   // A list shown as a count is not copyable, and replacing one means writing back what you keep,
+    +   // so read the values in full with:
+    +   //
+    +   //   pnpm exec sentinel --inspect --static-analysis --json
+    +   //
+    +   //   duplication.kinds: only `exact` is supported: any other kind overlaps it and double-counts
+    +   //   tools: sentinel's own passthrough to the tool underneath; a module never names the vendor
+    +   //
+    +   // overrides: {
+    +   //   duplication: { minTokens: 100 },
+    +   // },
+    + })
+
+  update package.json
+    - { "name": "bff-admin", "dependencies": { "@nestjs/core": "^10" } }
+    + {
+    +   "name": "bff-admin",
+    +   "dependencies": {
+    +     "@nestjs/core": "^10"
+    +   },
+    +   "scripts": {
+    +     "static-analysis": "sentinel --run --static-analysis",
+    +     "static-analysis:json": "sentinel --run --static-analysis --output json",
+    +     "static-analysis:html": "sentinel --run --static-analysis --output html"
+    +   },
+    +   "devDependencies": {
+    +     "@hublo/sentinel": "<version>"
+    +   },
+    +   "nx": {
+    +     "targets": {
+    +       "static-analysis": {
+    +         "cache": true,
+    +         "inputs": [
+    +           "default",
+    +           "{projectRoot}/static-analysis.config.mjs"
+    +         ]
+    +       }
+    +     }
+    +   }
+    + }
+  dry run: no files written
+  materialized the nest format preset into .oxfmtrc.json (@hublo/sentinel@<version>). oxfmt has no `extends`, so the values live here; `sentinel --status --format` reports modules left behind by a preset change
+
+  create .oxfmtrc.json
+    + {
+    +   "$sentinel": {
+    +     "preset": "nest",
+    +     "version": "<version>",
+    +     "local": []
+    +   },
+    +   "printWidth": 80,
+    +   "semi": false,
+    +   "singleQuote": true,
+    +   "trailingComma": "all",
+    +   "sortPackageJson": false,
+    +   "sortImports": {
+    +     "customGroups": [
+    +       {
+    +         "groupName": "workspace",
+    +         "elementNamePattern": [
+    +           "@hublo/**",
+    +           "@shared/**",
+    +           "@front/**",
+    +           "@network/**"
+    +         ]
+    +       }
+    +     ],
+    +     "groups": [
+    +       "builtin",
+    +       "external",
+    +       "workspace",
+    +       [
+    +         "parent",
+    +         "index"
+    +       ],
+    +       "sibling"
+    +     ],
+    +     "newlinesBetween": true,
+    +     "order": "asc",
+    +     "ignoreCase": false
+    +   },
+    +   "ignorePatterns": [
+    +     "**/*.toml"
+    +   ]
+    + }
+
+  update package.json
+    - { "name": "bff-admin", "dependencies": { "@nestjs/core": "^10" } }
+    + {
+    +   "name": "bff-admin",
+    +   "dependencies": {
+    +     "@nestjs/core": "^10"
+    +   },
+    +   "scripts": {
+    +     "format": "sentinel --run --format",
+    +     "format:fix": "sentinel --run --format --fix"
+    +   },
+    +   "devDependencies": {
+    +     "@hublo/sentinel": "<version>"
+    +   },
+    +   "nx": {
+    +     "targets": {
+    +       "format": {
+    +         "cache": true,
+    +         "inputs": [
+    +           "default",
+    +           "{projectRoot}/.oxfmtrc.json"
+    +         ]
+    +       },
+    +       "format:fix": {
+    +         "cache": false
+    +       }
+    +     }
+    +   }
+    + }
+  dry run: the lint autofix cannot be rehearsed yet: its preset is not installed in this module, which is expected before the first `pnpm install`. After it, this dry-run names what it rewrites
+  dry run: the format autofix would rewrite 1 file beyond the ones above: project.json
+  dry run: would ignore static-analysis-report/ in the root .gitignore
+# exit: 0
+```
+
+**--rehearse without --dry-run**
+
+```console
+$ sentinel --init --rehearse
+--rehearse only applies to --init --dry-run: the real --init runs the autofix passes themselves.
+(run "sentinel --help" for usage)
+# exit: 1
+```
+
 **no module and no workspace root**
 
 ```console

package/docs/using-sentinel.md

@@ -34,7 +34,15 @@ everywhere (`--run --json` and `--inspect` answer them), and `--migrate` is refu
 | `--static-analysis` | the config stub + three scripts + nx metadata, and ignores the report directory at the repository root    | measures and reports; never exits non-zero on a finding        | runner, config file, resolved settings, what this module moved   |
 
 `--json` works for every verb, and stdout carries **only** the envelope, so `| jq` always
-parses. `--dry-run` applies to `--init` and writes nothing.
+parses. `--dry-run` applies to `--init` and writes nothing. Besides the config diffs, it says
+that the lint autofix and the formatter run on adoption and can rewrite source, which is what
+moving to another linter or formatter does. It does not run them: on a large module that costs
+what the real pass costs (260 s measured on `network`).
+
+`--init --dry-run --rehearse` runs them, and names the source files they would rewrite
+(`rewrites` in `--json`, absent without `--rehearse`): both run in a throwaway copy of the
+module, outside the workspace, and what changed is read back. `--rehearse` without `--dry-run`
+is refused, because a real `--init` runs the passes itself.
 
 `--output <shape>` is different, and only a role that WRITES a report reads it: `console` is the
 default and writes no file, `html` is the page you open and send, `json` is for CI and for a
@@ -217,5 +225,9 @@ visible. Closing it in one action is [issue #17](https://github.com/hublo/sentin
 today it is one command per module.
 
 **Upgrading:** bump the pin, `pnpm install`, then `sentinel --init` in the module and commit
-what changes. `--init` is idempotent, so on a version that changed nothing relevant it reports
-nothing to change.
+what changes. On a module that has already adopted a role, a bare `--init` re-inits only the roles
+it has adopted, the ones `sentinel --inspect` reports, and names them in one line. It does not
+adopt a new role on the way: adopting the test role, for instance, is a migration of its own, so
+it is asked for by name (`sentinel --init --test`), or every role at once with `--init --all`.
+`--init` is idempotent, so on a version that changed nothing relevant it reports nothing to
+change.

package/docs/validating-a-change.md

@@ -135,6 +135,136 @@ majority of the migration, and only a sweep over every real module found it.
 
 ---
 
+## The `--init` matrix for 1.5.1, 29 October 2026
+
+Six fixes, found by re-initializing the monorepo's 63 adopted modules with 1.5.1-alpha.0. Every
+cell below is a test in this repo, against the built CLI unless it says unit, and every fix has a
+negative control: the fix reverted in the source, the cells run again, and the cells that must
+fail do. No existing cell changed: against the alpha, the test tree gains lines and loses none
+(`git diff --numstat` on `tests/`: 0 deletions), in 10 new files and 3 existing ones.
+
+### 1. a bare `--init` re-inits the roles a module has (`init-bare-on-adopted`)
+
+| module state                 | from the module                  | from the root, `--module` |
+| ---------------------------- | -------------------------------- | ------------------------- |
+| nothing adopted              | every role                       | every role                |
+| typescript adopted           | typescript only                  | typescript only           |
+| lint adopted                 | lint and format                  | (pairing, same rule)      |
+| typescript adopted, `--all`  | every role                       |                           |
+| typescript adopted, real run | no lint or format config written |                           |
+
+### 2. the lint baseline runs the lint script's leading commands (`init-lint-baseline-runs-script-prefix`)
+
+| lint script                             | baseline                                   |
+| --------------------------------------- | ------------------------------------------ |
+| `eslint .` (control)                    | holds `typescript/tsconfig-error`          |
+| `node generate.mjs && eslint .`         | nothing held, the command is named         |
+| `node -e "process.exit(3)" && eslint .` | nothing written, says the command exited 3 |
+
+Unit (`leading-commands`): `&&` chains only; `;`, `||` and a script that never reaches sentinel
+return nothing.
+
+### 3. the `$sentinel` stamp follows the content (unit, `format-adoption`)
+
+| re-init                           | stamp                    |
+| --------------------------------- | ------------------------ |
+| same content                      | kept (no diff on a bump) |
+| preset changed (`base` to `nest`) | this release             |
+| a carried ignore pattern added    | this release             |
+
+### 4. two re-init messages (unit `build-init`, e2e `init-tools-defers-every-role`)
+
+| case                                                | said                                                 |
+| --------------------------------------------------- | ---------------------------------------------------- |
+| vite config rewritten, format adopted / not adopted | the format line, naming the rewritten files          |
+| vite config already adopted                         | no format line                                       |
+| lint config declares `tools`, `--init --typescript` | deferred, naming the lint config, tsconfig untouched |
+| same module, bare `--init`                          | every role deferred                                  |
+| same module, `--preset node`                        | not deferred, the explicit preset decides            |
+
+### 5. a deliberate import order survives the sort (`init-format-import-order-matrix`, `init-format-keeps-deliberate-import-order`)
+
+Each file is one cell, run on a first adoption AND on a re-init, nest preset:
+
+| signal in the file                                                                                                                             | order kept                    | pins                                                     |
+| ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- | -------------------------------------------------------- |
+| `eslint-disable-next-line import/order`                                                                                                        | yes                           | 1                                                        |
+| `eslint-disable import/order` region, then `eslint-enable`                                                                                     | inside yes, after it sorted   | 2                                                        |
+| file-wide `/* eslint-disable import/order */`                                                                                                  | yes                           | 3                                                        |
+| `eslint-disable-line import/first`                                                                                                             | yes                           | 1                                                        |
+| `eslint-disable-next-line simple-import-sort/imports`                                                                                          | yes                           | 1                                                        |
+| first import: `dd-trace` (value)                                                                                                               | yes                           | 1                                                        |
+| first import: `@opentelemetry/sdk-node` (value)                                                                                                | yes                           | 1                                                        |
+| first import, side effect: `dd-trace/init`, `reflect-metadata`, `source-map-support/register`, `core-js/stable`, `regenerator-runtime/runtime` | yes                           | 0: oxfmt 0.63.0 does not move a first side-effect import |
+| side-effect `reflect-metadata` with an import the sort crosses                                                                                 | yes                           | 1                                                        |
+| two signals in one file, normal imports between them                                                                                           | pinned yes, the rest sorted   | 2                                                        |
+| a `.tsx` file                                                                                                                                  | yes                           | 1                                                        |
+| the tracer file of monorepo#23314                                                                                                              | yes                           | 3                                                        |
+| no signal at all (two files)                                                                                                                   | byte-identical to oxfmt alone | 0                                                        |
+
+And: the report names exactly the pinned files; `format:fix` then the format check keep every
+order; a second re-init changes no file and adds no pin; a module that does not sort (react
+preset) gets no pin. Unit (`deliberate-import-order`): a type-only import is never pinned, an
+`eslint-disable` naming no order rule is ignored.
+
+Negative control, `keepDeliberateImportOrder` disabled: 14 cells fail, the ten pinned files in
+both modes, the report, `format:fix` and the tracer cells. The five first-position side-effect
+cells pass without the fix, which is what the measurement above says.
+
+### 6. a re-init keeps what a team added (`init-keeps-team-config-matrix`, `init-keeps-team-lint-config`)
+
+| block in the module's config                                                     | after re-init                                              |
+| -------------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| a rule outside the preset                                                        | kept                                                       |
+| a rule the preset configures                                                     | dropped, named                                             |
+| `jsPlugins`: a local path and a package entry                                    | kept                                                       |
+| `jsPlugins` under a name the preset registers                                    | dropped, named                                             |
+| `overrides` on files no preset override names                                    | kept                                                       |
+| `overrides` on the preset override's own files                                   | kept as the module block, governed rules dropped and named |
+| `plugins`                                                                        | kept, minus the preset's own                               |
+| `settings`                                                                       | kept                                                       |
+| a second `extends` entry                                                         | kept, in order, after sentinel's                           |
+| `.oxfmtrc.json` `sortImports` false / true / a groups object (nest)              | kept, declared in `local`, stamp moves                     |
+| `.oxfmtrc.json` module `ignorePatterns`                                          | kept, stamp unchanged                                      |
+| every block at once                                                              | all kept; a second re-init is a no-op                      |
+| every block at once, bare `--init`                                               | re-inits lint and format only, all kept                    |
+| the same from the workspace root, `--module`                                     | the same                                                   |
+| fixes 5 and 6 together: tracer imports, a team `sortImports`, a second `extends` | all three kept                                             |
+
+Unit (`lint-module-own-config`, `format-adoption`, `extends-preservation`): two module blocks
+with the same `files` merge; a block left with only `files` is not written; a `sortImports`
+equal to what the RECORDED preset sets is sentinel's, so the async-api-types libs corrected from
+base to nest take nest's sort.
+
+Negative controls, one per block, each reverting one read-back: plugins 5 cells fail, jsPlugins
+6, settings 5, overrides 6, extends 5, rules 6, sortImports 7, format `ignorePatterns` 1. Each
+fails its own cells plus the every-block cells, and nothing else.
+
+### against the consumer, the 63 adopted modules
+
+The packed branch, through a pnpm `file:` override, on a fresh worktree of the monorepo at
+7177eb86038, nx graph built first, a BARE `--init` in each module:
+
+|                                                     | result                                                                                                                                                                                                                                                                                                              |
+| --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `--init` exit 0                                     | 63 of 63                                                                                                                                                                                                                                                                                                            |
+| roles re-inited = roles the alpha was given by name | 63 of 63                                                                                                                                                                                                                                                                                                            |
+| files differing from the alpha's explicit-roles run | 8, all `.oxfmtrc.json` stamps (fix 3)                                                                                                                                                                                                                                                                               |
+| files differing from the fixes 1 to 4 run           | 0                                                                                                                                                                                                                                                                                                                   |
+| the ten planning modules' second `extends`          | byte for byte                                                                                                                                                                                                                                                                                                       |
+| lint / format / typecheck / build                   | 62 / 59 / 63 / 31, all green                                                                                                                                                                                                                                                                                        |
+| test                                                | 43 projects, 7 red under `--parallel=3`: the 4 environment reds known on origin/main (the `/private` checkout path in 3 jest suites, no Redis for bff-planning), host-admin's French-locale date, and two load reds that are green run alone (bff-worker, a jest worker SIGSEGV; regulation-balance, 15 s timeouts) |
+
+Run with `--skip-nx-cache` from the workspace root after every `prisma:gen:*`, career's
+`prepare-runtime-artifacts`, `svelte-kit sync` and `VITE_BRAND_ID=hublo`. Run alone, host-admin
+fails only the locale test (1 806 of 1 807 files).
+
+The two PR heads the fixes came from, each in a throwaway worktree, nothing pushed:
+`libs/nest/tracer` at monorepo#23314's head keeps its import order byte for byte, and with the
+pre-adoption `index.ts` restored, the bare `--init` pins it (3 pins) and the format check passes.
+host-admin at monorepo#23342's head now adopts lint with its other roles, which is the rule:
+ESLint is removed, and the guards the react preset does not carry are the team's to add.
+
 ## The static analysis role's validation matrix, 19 October 2026
 
 Re-run from scratch because **53 commits landed on the role since 13 October**, and three of them

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.5.0",
+  "version": "1.5.1-alpha.1",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -12,6 +12,7 @@
   "engines": {
     "node": ">=24.15.0"
   },
+  "packageManager": "pnpm@10.26.0",
   "bin": {
     "sentinel": "./dist/bin/sentinel.js"
   },
@@ -107,6 +108,28 @@
     "oxlint",
     "plugins"
   ],
+  "scripts": {
+    "build": "tsup && tsx scripts/build-presets.ts",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "lint": "node dist/bin/sentinel.js --run --lint && node dist/bin/sentinel.js --run --format",
+    "lint:fix": "node dist/bin/sentinel.js --run --lint --fix && node dist/bin/sentinel.js --run --format --fix",
+    "format": "node dist/bin/sentinel.js --run --format",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:e2e": "vitest run tests/e2e",
+    "test:coverage": "vitest run --coverage --testTimeout=60000",
+    "cli": "node --import tsx bin/sentinel.ts",
+    "docs:traces": "pnpm build && bash scripts/gen-traces.sh",
+    "docs:traces:check": "pnpm build && bash scripts/gen-traces.sh --check",
+    "format:fix": "node dist/bin/sentinel.js --run --format --fix",
+    "bench": "node scripts/bench.mjs",
+    "deps:trust": "tsx scripts/check-trust-policy.ts",
+    "prepack": "tsx scripts/prune-sourcemaps.ts",
+    "static-analysis": "sentinel --run --static-analysis",
+    "static-analysis:json": "sentinel --run --static-analysis --output json",
+    "static-analysis:html": "sentinel --run --static-analysis --output html"
+  },
   "dependencies": {
     "@nx/eslint-plugin": "23.0.1",
     "@tailwindcss/vite": "4.1.18",
@@ -155,6 +178,11 @@
     "tsup": "^8.3.0",
     "tsx": "^4.19.0"
   },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",
     "access": "public"
@@ -191,26 +219,5 @@
     "nx": {
       "optional": true
     }
-  },
-  "scripts": {
-    "build": "tsup && tsx scripts/build-presets.ts",
-    "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
-    "lint": "node dist/bin/sentinel.js --run --lint && node dist/bin/sentinel.js --run --format",
-    "lint:fix": "node dist/bin/sentinel.js --run --lint --fix && node dist/bin/sentinel.js --run --format --fix",
-    "format": "node dist/bin/sentinel.js --run --format",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:e2e": "vitest run tests/e2e",
-    "test:coverage": "vitest run --coverage --testTimeout=60000",
-    "cli": "node --import tsx bin/sentinel.ts",
-    "docs:traces": "pnpm build && bash scripts/gen-traces.sh",
-    "docs:traces:check": "pnpm build && bash scripts/gen-traces.sh --check",
-    "format:fix": "node dist/bin/sentinel.js --run --format --fix",
-    "bench": "node scripts/bench.mjs",
-    "deps:trust": "tsx scripts/check-trust-policy.ts",
-    "static-analysis": "sentinel --run --static-analysis",
-    "static-analysis:json": "sentinel --run --static-analysis --output json",
-    "static-analysis:html": "sentinel --run --static-analysis --output html"
   }
-}
+}