@jterrazz/test 14.3.0 → 15.1.0

package/dist/oxlint.js

@@ -1,6 +1,5 @@
 import { basename, dirname, join, resolve } from "node:path";
 import { readFileSync, readdirSync, statSync } from "node:fs";
-import { fileURLToPath } from "node:url";
 //#region src/lint/fs-cache.ts
 /**
 * Cached filesystem probes for the fs-anchored rules (a9w, c2, c6, c7, i2).
@@ -66,7 +65,7 @@ function readFileCached(path) {
 */
 /** Split a path into its non-empty segments (posix or win separators). */
 function segments(path) {
-	return path.split(/[/\\]/).filter(Boolean);
+	return path.split(/[/\\]/u).filter(Boolean);
 }
 /**
 * The `specs/` directory a file belongs to: the NEAREST ancestor named `specs`,
@@ -108,7 +107,8 @@ function stringValue(node) {
 	if (node.type === "TemplateLiteral") {
 		const expressions = node.expressions;
 		const quasis = node.quasis;
-		if (expressions?.length === 0 && quasis?.length === 1) return quasis[0].value?.cooked;
+		const onlyQuasi = quasis?.[0];
+		if (expressions?.length === 0 && quasis?.length === 1 && onlyQuasi !== void 0) return onlyQuasi.value?.cooked;
 	}
 }
 /** The property name of a non-computed member expression, if identifiable. */
@@ -194,21 +194,10 @@ function isTestCallee(callee) {
 	if (callee.type === "CallExpression") return isTestCallee(callee.callee);
 	return false;
 }
-/** Does the test callee chain carry a modifier member with the given name? */
-function testCalleeHasModifier(callee, modifier) {
-	if (callee === void 0) return false;
-	if (callee.type === "MemberExpression") return memberPropertyName(callee) === modifier || testCalleeHasModifier(callee.object, modifier);
-	if (callee.type === "CallExpression") return testCalleeHasModifier(callee.callee, modifier);
-	return false;
-}
 /** The callback argument of a test call (arrow or function expression), if any. */
 function findTestCallback(args) {
 	return args.find((arg) => arg.type === "ArrowFunctionExpression" || arg.type === "FunctionExpression");
 }
-/** The static string name of a test call (`test('name', …)`), if a literal. */
-function testName(callNode) {
-	return stringValue((callNode.arguments ?? [])[0]);
-}
 /**
 * Visitor fragment collecting every import-like source: static imports,
 * dynamic `import()`, and re-exports. Rules spread this into their visitor.
@@ -235,6 +224,26 @@ function importSourceVisitor(onSource) {
 * The **statique** channel — one entry per shipped `jterrazz/*` rule. Each rule
 * file attaches its entry as `meta.docs`, so a rule and its normative text can
 * never drift (the completeness meta-test asserts every rule carries one).
+*
+* **What this channel does NOT own.** A convention oxlint's own `vitest` plugin
+* already enforces belongs to that plugin, not here — `@jterrazz/typescript` v10
+* turns the plugin on over the test globs in every profile, so a consumer of the
+* preset gets it without wiring. Four hygiene rules left the channel on that
+* ground (J1, J3, J4, J5 → `vitest/no-focused-tests` + `vitest/no-disabled-tests`,
+* `vitest/expect-expect`, `vitest/no-identical-title`, `vitest/prefer-lowercase-title`).
+* `prefer-lowercase-title` is stricter than J5 was: a title opening on an all-caps
+* identifier (`HTTP 404 …`, `DI …`) now fails, and the rulebook carries no
+* `allowedPrefixes` — a title starts lowercase, whatever its first word. The
+* rest are behaviour-identical on this package's own fixtures. Only J2 (the
+* arbitrary-sleep ban, which has no upstream counterpart) stays statique.
+*
+* **Severity.** The estate's rulebook has no warn tier: a rule is on at `error`
+* or off with a recorded reason, and that law binds `@jterrazz/typescript`'s
+* rulebook. This channel is its one documented exception, and it is narrow — an
+* id shaped `<family><n>w-…` is a REDUNDANCY heuristic (a `root` the walk would
+* have found, a probe cluster that wants a golden), a reading of taste that
+* would block a legitimate shape if it failed the build. Every hard convention
+* here is an `error`; `plugin.test.ts` holds the split.
 */
 const RULE_DOCS = {
 	"a1-specification-file": {
@@ -470,7 +479,7 @@ const RULE_DOCS = {
 	},
 	"f3-specs-public-entry": {
 		channel: "statique",
-		convention: "Depuis `specs/`, seul l’import en profondeur des INTERNES du framework est interdit : un chemin relatif résolvant dans `src/{core,integrations,vitest,lint}/` du dépôt du framework, ou tout `@jterrazz/test/<subpath>` autre que `@jterrazz/test/oxlint`. Les imports de la source de SA PROPRE app par un consommateur sont toujours permis (c’est le motif documenté) ; seul `specs/integrations/` peut importer en profondeur `src/integrations/**`.",
+		convention: "Depuis `specs/`, seul l’import en profondeur des INTERNES du framework est interdit : un chemin relatif résolvant dans `src/{specification,integrations,vitest,lint}/` du dépôt du framework, ou tout `@jterrazz/test/<subpath>` autre que `@jterrazz/test/oxlint`. Les imports de la source de SA PROPRE app par un consommateur sont toujours permis (c’est le motif documenté) ; seul `specs/integrations/` peut importer en profondeur `src/integrations/**`.",
 		family: "F",
 		id: "F3",
 		rationale: "Tester par la surface publique garde les specs découplées des chemins internes du framework, sans gêner le consommateur qui importe sa propre app."
@@ -510,13 +519,6 @@ const RULE_DOCS = {
 		id: "I4",
 		rationale: "Dans les tests de module, mocks et données sont du CODE (`mockOf`, `*.fixtures.ts`) ; un vrai fichier appelle une spec."
 	},
-	"j1-no-only-skip": {
-		channel: "statique",
-		convention: "Aucun `.only` / `.skip` committé (`describe.only`, `test.only`, `test.skip`).",
-		family: "J",
-		id: "J1",
-		rationale: "Un `.only`/`.skip` oublié désactive silencieusement une partie de la suite."
-	},
 	"j2-no-sleep-in-specs": {
 		channel: "statique",
 		convention: "Aucun sleep arbitraire (`setTimeout`/`setInterval`/`Atomics.wait`) sous `specs/**` — la synchronisation passe par `waitFor`.",
@@ -524,27 +526,6 @@ const RULE_DOCS = {
 		id: "J2",
 		rationale: "Un sleep fixe rend les tests lents et instables ; attendre une condition est déterministe."
 	},
-	"j3-no-expectless-test": {
-		channel: "statique",
-		convention: "Un `test(...)` avec callback contient au moins un `expect(…)` ; `test.todo` (sans callback) est ignoré.",
-		family: "J",
-		id: "J3",
-		rationale: "Un test sans assertion est mort ou muet — il passe toujours sans rien vérifier."
-	},
-	"j4-unique-test-names": {
-		channel: "statique",
-		convention: "Deux tests d’un même fichier ne partagent pas un nom littéral (`.each` ignoré).",
-		family: "J",
-		id: "J4",
-		rationale: "Le nom du test est son unique description — deux noms identiques rendent un échec ambigu."
-	},
-	"j5-lowercase-title": {
-		channel: "statique",
-		convention: "La première lettre d’un titre `test()`/`describe()`/`it()` littéral est en minuscule. Exemptés : les titres dont le premier MOT est un identifiant tout en majuscules/underscores (`VALID_CATEGORIES`, `HTTP`, `DI`) et ceux démarrant sur un non-lettre — seuls les premiers mots de prose minusculisables sont contraints.",
-		family: "J",
-		id: "J5",
-		rationale: "Un titre est un fragment de prose, pas une phrase — la casse minuscule le garde fragmentaire ; minusculiser un symbole nommé le mal-orthographierait."
-	},
 	"w1-scenario-pure": {
 		channel: "statique",
 		convention: "Un scénario (`.visit()` website, `.open()` mobile) est le When : le visiteur agit, la capture reflète l’état final ; aucun `expect()` dans le callback — les assertions vivent dans le Then, sur le résultat retourné.",
@@ -903,90 +884,13 @@ const a1SpecificationFile = {
 	},
 	meta: {
 		docs: RULE_DOCS["a1-specification-file"],
-		messages: { outsideSpecification: "specification.{{member}}() must be called from a `*.specification.ts` file under specs/ (A1 — see docs/10-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/core/specification/shared/binding.ts
-/**
-* Compose-binding resolution and the case conversions it shares with the
-* automatic env injection (CONVENTIONS A6 / B6).
-*
-* A services-record key is written in the natural TypeScript style
-* (`analyticsDb`), while a compose service name is kebab-case
-* (`analytics-db`). These helpers bridge the two vocabularies deterministically
-* so the record key stays the single source of truth and `composeService`
-* remains a rare escape hatch.
-*/
-/**
-* Convert a record key to its kebab-case form: camelCase boundaries become
-* `-`, everything is lowercased. `analyticsDb` → `analytics-db`, `db` → `db`.
-*/
-function toKebabCase(key) {
-	return key.replace(/(?<lower>[a-z0-9])(?<upper>[A-Z])/g, "$<lower>-$<upper>").toLowerCase();
-}
-//#endregion
-//#region src/lint/rules/a10-duplicate-binding.ts
-/** The compose service an entry binds to: explicit `composeService`, else the key's kebab form. */
-function canonicalBinding(entry, key) {
-	const factory = entry.value;
-	if (factory?.type === "CallExpression") {
-		const options = factory.arguments?.[0];
-		if (options?.type === "ObjectExpression") {
-			const explicit = stringValue(findProperty(options, "composeService")?.value);
-			if (explicit !== void 0) return explicit;
-		}
-	}
-	return toKebabCase(key);
-}
-/**
-* CONVENTIONS A10 — within one `services` record, two keys that derive (or
-* pin via `composeService`) the SAME compose service name are a silent
-* collision: the record is a map, and the second binding would shadow the
-* first. Detected on the same kebab derivation the runtime binding uses
-* (`analyticsDb` and `analytics-db` both → `analytics-db`), and across explicit
-* `composeService` values.
-*/
-const a10DuplicateBinding = {
-	create(context) {
-		return { CallExpression(node) {
-			if (specificationMember(node) === void 0) return;
-			for (const argument of node.arguments ?? []) {
-				const record = findProperty(argument, "services")?.value;
-				if (record?.type !== "ObjectExpression") continue;
-				const seen = /* @__PURE__ */ new Map();
-				for (const entry of record.properties ?? []) {
-					const key = propertyKeyName(entry);
-					if (key === void 0) continue;
-					const binding = canonicalBinding(entry, key);
-					const first = seen.get(binding);
-					if (first !== void 0) {
-						context.report({
-							data: {
-								binding,
-								first,
-								key
-							},
-							messageId: "duplicate",
-							node: entry
-						});
-						continue;
-					}
-					seen.set(binding, key);
-				}
-			}
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["a10-duplicate-binding"],
-		messages: { duplicate: "Service keys \"{{first}}\" and \"{{key}}\" both bind to compose service \"{{binding}}\" — one shadows the other; rename a key or set distinct composeService values (A10 — see docs/10-linting.md)." },
+		messages: { outsideSpecification: "specification.{{member}}() must be called from a `*.specification.ts` file under specs/ (A1 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/a2-known-constructors.ts
-/** The five constructors, and only five (A2 — see docs/10-linting.md). */
+/** The five constructors, and only five (A2 — see docs/13-linting.md). */
 const KNOWN_CONSTRUCTORS = /* @__PURE__ */ new Set([
 	"api",
 	"cli",
@@ -1015,7 +919,7 @@ const a2KnownConstructors = {
 	},
 	meta: {
 		docs: RULE_DOCS["a2-known-constructors"],
-		messages: { unknownConstructor: "specification.{{member}} does not exist — the only constructors are specification.api(), specification.jobs(), specification.cli(), specification.website() and specification.mobile() (A2 — see docs/10-linting.md)." },
+		messages: { unknownConstructor: "specification.{{member}} does not exist — the only constructors are specification.api(), specification.jobs(), specification.cli(), specification.website() and specification.mobile() (A2 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
@@ -1060,7 +964,7 @@ const a3NoDestructureAlias = {
 	},
 	meta: {
 		docs: RULE_DOCS["a3-no-destructure-alias"],
-		messages: { aliased: "Destructure the specification result with its canonical name: `{{key}}`, not `{{key}}: {{alias}}` (A3 — see docs/10-linting.md). Rename at the import site if a different local name is needed." },
+		messages: { aliased: "Destructure the specification result with its canonical name: `{{key}}`, not `{{key}}: {{alias}}` (A3 — see docs/13-linting.md). Rename at the import site if a different local name is needed." },
 		type: "problem"
 	}
 };
@@ -1112,7 +1016,7 @@ const a4CleanupAfterall = {
 	},
 	meta: {
 		docs: RULE_DOCS["a4-cleanup-afterall"],
-		messages: { unregistered: "`cleanup` is destructured but never passed to afterAll — add `afterAll(cleanup)` to the specification file (A4 — see docs/10-linting.md)." },
+		messages: { unregistered: "`cleanup` is destructured but never passed to afterAll — add `afterAll(cleanup)` to the specification file (A4 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
@@ -1142,11 +1046,30 @@ const a5ModeWithServer = {
 	},
 	meta: {
 		docs: RULE_DOCS["a5-mode-with-server"],
-		messages: { hardcodedMode: "`mode` must not be hardcoded when `server` is defined — the node/compose switch lives in vitest.config.ts via `env: { TEST_MODE: \"compose\" }` (A5 — see docs/10-linting.md)." },
+		messages: { hardcodedMode: "`mode` must not be hardcoded when `server` is defined — the node/compose switch lives in vitest.config.ts via `env: { TEST_MODE: \"compose\" }` (A5 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
+//#region src/specification/facets/_common/binding.ts
+/**
+* Compose-binding resolution and the case conversions it shares with the
+* automatic env injection (CONVENTIONS A6 / B6).
+*
+* A services-record key is written in the natural TypeScript style
+* (`analyticsDb`), while a compose service name is kebab-case
+* (`analytics-db`). These helpers bridge the two vocabularies deterministically
+* so the record key stays the single source of truth and `composeService`
+* remains a rare escape hatch.
+*/
+/**
+* Convert a record key to its kebab-case form: camelCase boundaries become
+* `-`, everything is lowercased. `analyticsDb` → `analytics-db`, `db` → `db`.
+*/
+function toKebabCase(key) {
+	return key.replaceAll(/(?<lower>[a-z0-9])(?<upper>[A-Z])/gu, "$<lower>-$<upper>").toLowerCase();
+}
+//#endregion
 //#region src/lint/rules/a6w-redundant-compose-service.ts
 /**
 * CONVENTIONS A6 (warning) — `composeService:` is the escape hatch for
@@ -1183,12 +1106,12 @@ const a6wRedundantComposeService = {
 	},
 	meta: {
 		docs: RULE_DOCS["a6w-redundant-compose-service"],
-		messages: { redundant: "composeService: \"{{name}}\" is redundant — the key \"{{key}}\" already binds to it (exact name or kebab-case derivation, A6 — see docs/10-linting.md)." },
+		messages: { redundant: "composeService: \"{{name}}\" is redundant — the key \"{{key}}\" already binds to it (exact name or kebab-case derivation, A6 — see docs/13-linting.md)." },
 		type: "suggestion"
 	}
 };
 //#endregion
-//#region src/core/specification/shared/resolve.ts
+//#region src/specification/facets/_common/resolve.ts
 /** What makes a directory a project root — a manifest, or a test stack. */
 const ROOT_MARKERS = ["package.json", "docker/compose.test.yaml"];
 /**
@@ -1218,7 +1141,7 @@ function findRoot(startDir, exists) {
 //#endregion
 //#region src/lint/rules/a9w-redundant-root.ts
 /**
-* The root the convention would derive (A9 — see docs/10-linting.md): the
+* The root the convention would derive (A9 — see docs/13-linting.md): the
 * framework's own walk-up, run against this layer's cached fs probe. The rule
 * flags a `root` that the runner would have found by itself, so the two MUST
 * be the same function — a private copy of the walk drifted from it before.
@@ -1250,12 +1173,70 @@ const a9wRedundantRoot = {
 	},
 	meta: {
 		docs: RULE_DOCS["a9w-redundant-root"],
-		messages: { redundant: "root: \"{{root}}\" is redundant — walking up from the specification file already resolves to that directory (A9 — see docs/10-linting.md)." },
+		messages: { redundant: "root: \"{{root}}\" is redundant — walking up from the specification file already resolves to that directory (A9 — see docs/13-linting.md)." },
 		type: "suggestion"
 	}
 };
 //#endregion
-//#region src/core/specification/shared/ground.ts
+//#region src/lint/rules/a10-duplicate-binding.ts
+/** The compose service an entry binds to: explicit `composeService`, else the key's kebab form. */
+function canonicalBinding(entry, key) {
+	const factory = entry.value;
+	if (factory?.type === "CallExpression") {
+		const options = factory.arguments?.[0];
+		if (options?.type === "ObjectExpression") {
+			const explicit = stringValue(findProperty(options, "composeService")?.value);
+			if (explicit !== void 0) return explicit;
+		}
+	}
+	return toKebabCase(key);
+}
+/**
+* CONVENTIONS A10 — within one `services` record, two keys that derive (or
+* pin via `composeService`) the SAME compose service name are a silent
+* collision: the record is a map, and the second binding would shadow the
+* first. Detected on the same kebab derivation the runtime binding uses
+* (`analyticsDb` and `analytics-db` both → `analytics-db`), and across explicit
+* `composeService` values.
+*/
+const a10DuplicateBinding = {
+	create(context) {
+		return { CallExpression(node) {
+			if (specificationMember(node) === void 0) return;
+			for (const argument of node.arguments ?? []) {
+				const record = findProperty(argument, "services")?.value;
+				if (record?.type !== "ObjectExpression") continue;
+				const seen = /* @__PURE__ */ new Map();
+				for (const entry of record.properties ?? []) {
+					const key = propertyKeyName(entry);
+					if (key === void 0) continue;
+					const binding = canonicalBinding(entry, key);
+					const first = seen.get(binding);
+					if (first !== void 0) {
+						context.report({
+							data: {
+								binding,
+								first,
+								key
+							},
+							messageId: "duplicate",
+							node: entry
+						});
+						continue;
+					}
+					seen.set(binding, key);
+				}
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a10-duplicate-binding"],
+		messages: { duplicate: "Service keys \"{{first}}\" and \"{{key}}\" both bind to compose service \"{{binding}}\" — one shadows the other; rename a key or set distinct composeService values (A10 — see docs/13-linting.md)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/specification/facets/_common/ground.ts
 /**
 * The GROUND a row of specs stands on — the naming law of a spec tree.
 *
@@ -1296,7 +1277,7 @@ const RENAMED_GROUND_DIRS = {
 	seeds: GROUND_SEEDS
 };
 //#endregion
-//#region src/core/specification/shared/fixtures.ts
+//#region src/specification/facets/_common/fixtures.ts
 /**
 * Fixture path resolution + copy semantics for the `cli` facet's `.fixture()`.
 *
@@ -1343,7 +1324,7 @@ const b2KnownFixtureMarker = {
 			const args = node.arguments ?? [];
 			const path = leadingText(args[0]);
 			if (path === void 0 || !path.startsWith("$")) return;
-			const marker = path.replace(/\/+$/, "").split("/")[0];
+			const marker = path.replace(/\/+$/u, "").split("/")[0] ?? "";
 			if (!KNOWN.has(marker)) context.report({
 				data: {
 					known: [...KNOWN_FIXTURE_MARKERS].join(", "),
@@ -1356,7 +1337,7 @@ const b2KnownFixtureMarker = {
 	},
 	meta: {
 		docs: RULE_DOCS["b2-known-fixture-marker"],
-		messages: { unknownMarker: "Unknown fixture marker \"{{marker}}\" — known markers: {{known}}. A path without a marker is feature-local (B2 — see docs/10-linting.md)." },
+		messages: { unknownMarker: "Unknown fixture marker \"{{marker}}\" — known markers: {{known}}. A path without a marker is feature-local (B2 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
@@ -1421,8 +1402,8 @@ const b4GivenThen = {
 	meta: {
 		docs: RULE_DOCS["b4-given-then"],
 		messages: {
-			givenAfterThen: "The `// Given -` marker comes after `// Then -` — Given describes the setup and must precede Then (B4 — see docs/10-linting.md).",
-			missing: "Test is missing a `// {{marker}} -` comment (B4 — see docs/10-linting.md — every test needs both `// Given -` and `// Then -`)."
+			givenAfterThen: "The `// Given -` marker comes after `// Then -` — Given describes the setup and must precede Then (B4 — see docs/13-linting.md).",
+			missing: "Test is missing a `// {{marker}} -` comment (B4 — see docs/13-linting.md — every test needs both `// Given -` and `// Then -`)."
 		},
 		type: "problem"
 	}
@@ -1463,7 +1444,7 @@ const b5AwaitUsing = {
 	meta: {
 		docs: RULE_DOCS["b5-await-using"],
 		defaultOptions: [{ runners: [] }],
-		messages: { requireAwaitUsing: "The result of docker-aware runner \"{{runner}}\" must be bound with `await using` so its containers are disposed (B5 — see docs/10-linting.md)." },
+		messages: { requireAwaitUsing: "The result of docker-aware runner \"{{runner}}\" must be bound with `await using` so its containers are disposed (B5 — see docs/13-linting.md)." },
 		schema: [{
 			additionalProperties: false,
 			properties: { runners: {
@@ -1477,7 +1458,7 @@ const b5AwaitUsing = {
 };
 //#endregion
 //#region src/lint/rules/b6w-redundant-env-url.ts
-const URL_KEY = /^[A-Z0-9]+(?:_[A-Z0-9]+)*_URL$/;
+const URL_KEY = /^[A-Z0-9]+(?:_[A-Z0-9]+)*_URL$/u;
 /**
 * CONVENTIONS B6 (warning) — in `cli` mode with services, the framework
 * already injects `<KEY>_URL` for every service (plus the unambiguous
@@ -1506,14 +1487,14 @@ const b6wRedundantEnvUrl = {
 	},
 	meta: {
 		docs: RULE_DOCS["b6w-redundant-env-url"],
-		messages: { redundant: ".env({ {{key}}: ….connectionString }) is redundant — the framework already injects <KEY>_URL (and the DATABASE_URL/REDIS_URL aliases) for every service (B6 — see docs/10-linting.md)." },
+		messages: { redundant: ".env({ {{key}}: ….connectionString }) is redundant — the framework already injects <KEY>_URL (and the DATABASE_URL/REDIS_URL aliases) for every service (B6 — see docs/13-linting.md)." },
 		type: "suggestion"
 	}
 };
 //#endregion
 //#region src/lint/rules/b8-kebab-trigger.ts
 /** Stable kebab-case job identifier: `nightly-report`, `send-welcome-emails`. */
-const KEBAB_CASE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const KEBAB_CASE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
 /**
 * CONVENTIONS B8 — a job `name` passed to `.trigger()` is a stable kebab-case
 * identifier; it is a contract between the app and its tests. Only string
@@ -1535,7 +1516,7 @@ const b8KebabTrigger = {
 	},
 	meta: {
 		docs: RULE_DOCS["b8-kebab-trigger"],
-		messages: { notKebab: "Job name \"{{name}}\" must be a stable kebab-case identifier (e.g. \"nightly-report\") — it is a contract between the app and its tests (B8 — see docs/10-linting.md)." },
+		messages: { notKebab: "Job name \"{{name}}\" must be a stable kebab-case identifier (e.g. \"nightly-report\") — it is a contract between the app and its tests (B8 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
@@ -1590,7 +1571,7 @@ const b9wProductCommand = {
 	},
 	meta: {
 		docs: RULE_DOCS["b9w-product-command"],
-		messages: { thirdPartyBinary: "specification.cli() points at a third-party binary in node_modules/.bin — a spec should exercise your product command (cli.exec(\"check\"), …), not the tool underneath (B9 — see docs/10-linting.md). Suppress with a reason if the product genuinely is this binary." },
+		messages: { thirdPartyBinary: "specification.cli() points at a third-party binary in node_modules/.bin — a spec should exercise your product command (cli.exec(\"check\"), …), not the tool underneath (B9 — see docs/13-linting.md). Suppress with a reason if the product genuinely is this binary." },
 		type: "suggestion"
 	}
 };
@@ -1743,14 +1724,14 @@ const c1DomainStructure = {
 		defaultOptions: [{ depth: DEFAULT_DEPTH }],
 		docs: RULE_DOCS["c1-domain-structure"],
 		messages: {
-			specInGround: "A spec must not live under \"{{ground}}/\" — a leading underscore marks GROUND (what the specs of a row stand on: _fixtures/, _expected/, _requests/, _seeds/), never a domain (C1 — see docs/10-linting.md). Ground that is CODE keeps its own unit test: `<module>.test.ts` NEXT to the `<module>.ts` it tests (I2), and nothing else.",
-			specNotAtFacetRoot: "A `*.specification.ts` must sit at the facet root: `specs/<facet>/<name>.specification.ts` (C1 — see docs/10-linting.md).",
-			testAtFacetRoot: "A `*.test.ts` must live in a domain folder: `specs/<facet>/<domain>/<aspect>.test.ts` — tests directly at the facet root are forbidden (C1 — see docs/10-linting.md).",
-			testAtSpecsRoot: "A `*.test.ts` must live in a directory under specs/ — with `depth: \"mirror\"` the tree mirrors a structure, and the specs root mirrors nothing (C1 — see docs/10-linting.md).",
-			testNotMirroringDirectory: "A `*.test.ts` must be named after the directory holding it — `{{directory}}/{{directory}}.test.ts` — with `depth: \"mirror\"` (C1 — see docs/10-linting.md).",
-			testOutsideFacet: "A `*.test.ts` must live in a facet folder — `specs/<facet>/<aspect>.test.ts`, or one domain deeper: with `depth: \"facet\"` the specs root holds facets, not tests (C1 — see docs/10-linting.md).",
-			testTooDeep: "A `*.test.ts` must sit at facet/domain depth: `specs/<facet>/<domain>/<aspect>.test.ts` — no deeper nesting (C1 — see docs/10-linting.md).",
-			testTooDeepForFacet: "A `*.test.ts` must sit at the facet root or one domain folder down — `specs/<facet>/<aspect>.test.ts` or `specs/<facet>/<domain>/<aspect>.test.ts`: with `depth: \"facet\"` nothing nests deeper (C1 — see docs/10-linting.md)."
+			specInGround: "A spec must not live under \"{{ground}}/\" — a leading underscore marks GROUND (what the specs of a row stand on: _fixtures/, _expected/, _requests/, _seeds/), never a domain (C1 — see docs/13-linting.md). Ground that is CODE keeps its own unit test: `<module>.test.ts` NEXT to the `<module>.ts` it tests (I2), and nothing else.",
+			specNotAtFacetRoot: "A `*.specification.ts` must sit at the facet root: `specs/<facet>/<name>.specification.ts` (C1 — see docs/13-linting.md).",
+			testAtFacetRoot: "A `*.test.ts` must live in a domain folder: `specs/<facet>/<domain>/<aspect>.test.ts` — tests directly at the facet root are forbidden (C1 — see docs/13-linting.md).",
+			testAtSpecsRoot: "A `*.test.ts` must live in a directory under specs/ — with `depth: \"mirror\"` the tree mirrors a structure, and the specs root mirrors nothing (C1 — see docs/13-linting.md).",
+			testNotMirroringDirectory: "A `*.test.ts` must be named after the directory holding it — `{{directory}}/{{directory}}.test.ts` — with `depth: \"mirror\"` (C1 — see docs/13-linting.md).",
+			testOutsideFacet: "A `*.test.ts` must live in a facet folder — `specs/<facet>/<aspect>.test.ts`, or one domain deeper: with `depth: \"facet\"` the specs root holds facets, not tests (C1 — see docs/13-linting.md).",
+			testTooDeep: "A `*.test.ts` must sit at facet/domain depth: `specs/<facet>/<domain>/<aspect>.test.ts` — no deeper nesting (C1 — see docs/13-linting.md).",
+			testTooDeepForFacet: "A `*.test.ts` must sit at the facet root or one domain folder down — `specs/<facet>/<aspect>.test.ts` or `specs/<facet>/<domain>/<aspect>.test.ts`: with `depth: \"facet\"` nothing nests deeper (C1 — see docs/13-linting.md)."
 		},
 		schema: [{
 			additionalProperties: false,
@@ -1769,212 +1750,71 @@ const c1DomainStructure = {
 	}
 };
 //#endregion
-//#region src/lint/rules/c10-contracts-boundary.ts
-/** A specifier reaching into a provider folder — the internal half of contracts/. */
-const INTERNAL_UNIT = /(?:^|\/)contracts\/(?:anthropic|http|openai)\//u;
+//#region src/lint/rules/c2-http-only-requests.ts
+const TEST_FILE$12 = /\.test\.[cm]?[jt]sx?$/u;
 /**
-* CONVENTIONS C10 — the contracts boundary. A feature's `contracts/` folder has
-* a PUBLIC half (`*.contracts.ts` facades: the default export is the world, the
-* named exports are its scenarios) and an INTERNAL half (the `http/`, `openai/`
-* and `anthropic/` unit contracts the facades compose). Outside `contracts/`,
-* importing a unit is an error — a test routes through the facade, so a
-* scenario is named once, next to the world it derives from.
+* CONVENTIONS C2 — `_requests/` contains only `.http` files (a request file is
+* a COMPLETE request: method, path, headers, body). Anchored on the feature's
+* visited test file: when `<feature>/<feature>.test.ts` is linted, its sibling
+* `_requests/` directory is probed (cached readdir) and any non-`.http` entry
+* is reported on the test file.
 */
-const c10ContractsBoundary = {
+const c2HttpOnlyRequests = {
 	create(context) {
-		const parts = segments(context.physicalFilename);
-		if (!parts.includes("specs")) return {};
-		if (parts.slice(0, -1).includes("contracts")) return {};
-		return importSourceVisitor(({ node, source }) => {
-			if (INTERNAL_UNIT.test(source)) context.report({
-				data: { source },
-				messageId: "internal",
+		const file = context.physicalFilename;
+		if (!TEST_FILE$12.test(file) || !segments(file).includes("specs")) return {};
+		return { Program(node) {
+			const requestsDir = join(dirname(file), GROUND_REQUESTS);
+			for (const entry of listDirectory(requestsDir) ?? []) if (!entry.endsWith(".http")) context.report({
+				data: { entry },
+				messageId: "notHttp",
 				node
 			});
-		});
+		} };
 	},
 	meta: {
-		docs: RULE_DOCS["c10-contracts-boundary"],
-		messages: { internal: "Import \"{{source}}\" reaches into a provider folder — only contracts/*.contracts.ts is importable from a test; add a named scenario export there instead (C10 — see docs/10-linting.md)." },
+		docs: RULE_DOCS["c2-http-only-requests"],
+		messages: { notHttp: "_requests/{{entry}} is not a .http file — _requests/ contains only complete .http request files (C2 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/c11-contract-data-pairing.ts
-const TEST_FILE$12 = /\.test\.[cm]?[jt]sx?$/;
-/** The provider folders that may carry data files. */
-const PROVIDERS$1 = [
+//#region src/lint/rules/c4-contract-shape.ts
+/** The only directories a `contracts/` root may hold — the provider carriers. */
+const PROVIDERS$1 = /* @__PURE__ */ new Set([
 	"anthropic",
 	"http",
 	"openai"
-];
-/** Data files: served payloads and matched inputs, both owned by a contract. */
-const DATA_SUFFIXES = [".request.ts", ".response.json"];
-/** The owning contract of a data file: its name up to the FIRST dot, `.ts`. */
-function ownerOf(entry) {
-	return `${entry.slice(0, entry.indexOf("."))}.ts`;
+]);
+const TEST_FILE$11 = /\.test\.[cm]?[jt]sx?$/u;
+/** A file oxlint itself visits — the AST half of the rule reports on those. */
+const SOURCE_FILE = /\.[cm]?[jt]sx?$/u;
+/** The public facade of a feature: `contracts/<kebab>.contracts.ts`. */
+const COMPOSITE_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.contracts\.[cm]?ts$/u;
+/** An internal unit contract: `contracts/<provider>/<kebab>.ts`. */
+const UNIT_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[cm]?ts$/u;
+/** Matched data next to its contract: `contracts/<provider>/<stem>.request.ts`. */
+const REQUEST_DATA_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.request\.[cm]?ts$/u;
+/** The name a specifier/declaration exports under, when it is `default`. */
+function exportsDefault(node) {
+	return (node.specifiers ?? []).some((specifier) => {
+		const exported = specifier.exported;
+		return exported?.type === "Identifier" && exported.name === "default" || stringValue(exported) === "default";
+	});
+}
+/** Is this node a `defineContract(...)` call? */
+function isDefineContract(node) {
+	const callee = node.callee;
+	return node.type === "CallExpression" && callee?.type === "Identifier" && callee.name === "defineContract";
+}
+/** A default export that may legitimately produce a contract (value or factory). */
+function producesContract(declaration) {
+	if (declaration === void 0) return false;
+	return isDefineContract(declaration) || declaration.type === "ArrowFunctionExpression" || declaration.type === "FunctionDeclaration" || declaration.type === "FunctionExpression" || declaration.type === "Identifier";
 }
 /**
-* CONVENTIONS C11 — data is owned by a contract. Inside a provider folder every
-* `*.response.json` (served payload) and `*.request.ts` (matched prompt/body)
-* pairs with the sibling `<stem>.ts` that serves it, where the stem is the name
-* up to the FIRST dot: `events.fr.response.json` belongs to `events.ts`. A data
-* file with no owner is dead weight no test can reach — reported on the feature's
-* test file, since oxlint never visits a `.json`.
-*/
-const c11ContractDataPairing = {
-	create(context) {
-		const file = context.physicalFilename;
-		if (!TEST_FILE$12.test(file) || !segments(file).includes("specs")) return {};
-		return { Program(node) {
-			const contractsDir = join(dirname(file), "contracts");
-			for (const provider of PROVIDERS$1) {
-				const entries = listDirectory(join(contractsDir, provider));
-				if (entries === null) continue;
-				const present = new Set(entries);
-				for (const entry of entries) {
-					if (!DATA_SUFFIXES.some((suffix) => entry.endsWith(suffix))) continue;
-					const owner = ownerOf(entry);
-					if (!present.has(owner)) context.report({
-						data: {
-							entry,
-							owner,
-							provider
-						},
-						messageId: "orphan",
-						node
-					});
-				}
-			}
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["c11-contract-data-pairing"],
-		messages: { orphan: "contracts/{{provider}}/{{entry}} has no owning contract — data pairs with the sibling {{owner}} (stem = name up to the first dot) (C11 — see docs/10-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/c13-underscored-ground.ts
-const TEST_FILE$11 = /\.test\.[cm]?[jt]sx?$/;
-/**
-* CONVENTIONS C13 — the ground of a spec carries a leading underscore. A
-* directory named `fixtures/`, `expected/`, `requests/` or `seeds/` under
-* `specs/` is a pre-14 name: since `@jterrazz/test` 14.0.0 the four are
-* `_fixtures/`, `_expected/`, `_requests/` and `_seeds/`, with no compatibility
-* fallback.
-*
-* The catch this rule exists for: a consumer that upgrades and keeps the old
-* names loses nothing loudly. Every resolver — `.fixture()`, `.seed()`,
-* `.request()`, `toMatch()` — looks under the underscored name, finds nothing,
-* and the tree becomes invisible rather than wrong. The failure that follows is
-* "fixture does not exist" on every spec at once, one step removed from the
-* cause; this rule states the cause and the rename.
-*
-* Anchored on the feature's visited test file, exactly as C2/C7/C11 are: the
-* spec's own sibling directories are probed, plus the `$FIXTURES` pool at the
-* nearest specs root. A DOMAIN folder named after the ground it holds
-* (`specs/api/requests/_requests/`) is never a probe target — only what sits
-* beside a spec is.
-*/
-const c13UnderscoredGround = {
-	create(context) {
-		const file = context.physicalFilename;
-		const anchor = specsAnchor(file);
-		if (!TEST_FILE$11.test(file) || anchor === void 0) return {};
-		return { Program(node) {
-			const seen = /* @__PURE__ */ new Set();
-			const probe = (parent, legacy) => {
-				const path = join(parent, legacy);
-				if (seen.has(path) || !isDirectory(path)) return;
-				seen.add(path);
-				context.report({
-					data: {
-						ground: RENAMED_GROUND_DIRS[legacy],
-						legacy
-					},
-					messageId: "notUnderscored",
-					node
-				});
-			};
-			for (const legacy of Object.keys(RENAMED_GROUND_DIRS)) probe(dirname(file), legacy);
-			probe(anchor.directory, "fixtures");
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["c13-underscored-ground"],
-		messages: { notUnderscored: "The directory \"{{legacy}}/\" is a pre-14 ground name — rename it to \"{{ground}}/\" (`git mv {{legacy}} {{ground}}`). What a spec stands on carries the underscore; a spec's own folder never does, and no resolver reads the un-underscored name (C13 — see docs/10-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/c2-http-only-requests.ts
-const TEST_FILE$10 = /\.test\.[cm]?[jt]sx?$/;
-/**
-* CONVENTIONS C2 — `_requests/` contains only `.http` files (a request file is
-* a COMPLETE request: method, path, headers, body). Anchored on the feature's
-* visited test file: when `<feature>/<feature>.test.ts` is linted, its sibling
-* `_requests/` directory is probed (cached readdir) and any non-`.http` entry
-* is reported on the test file.
-*/
-const c2HttpOnlyRequests = {
-	create(context) {
-		const file = context.physicalFilename;
-		if (!TEST_FILE$10.test(file) || !segments(file).includes("specs")) return {};
-		return { Program(node) {
-			const requestsDir = join(dirname(file), GROUND_REQUESTS);
-			for (const entry of listDirectory(requestsDir) ?? []) if (!entry.endsWith(".http")) context.report({
-				data: { entry },
-				messageId: "notHttp",
-				node
-			});
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["c2-http-only-requests"],
-		messages: { notHttp: "_requests/{{entry}} is not a .http file — _requests/ contains only complete .http request files (C2 — see docs/10-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/c4-contract-shape.ts
-/** The only directories a `contracts/` root may hold — the provider carriers. */
-const PROVIDERS = /* @__PURE__ */ new Set([
-	"anthropic",
-	"http",
-	"openai"
-]);
-const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/;
-/** A file oxlint itself visits — the AST half of the rule reports on those. */
-const SOURCE_FILE = /\.[cm]?[jt]sx?$/;
-/** The public facade of a feature: `contracts/<kebab>.contracts.ts`. */
-const COMPOSITE_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.contracts\.[cm]?ts$/u;
-/** An internal unit contract: `contracts/<provider>/<kebab>.ts`. */
-const UNIT_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[cm]?ts$/u;
-/** Matched data next to its contract: `contracts/<provider>/<stem>.request.ts`. */
-const REQUEST_DATA_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.request\.[cm]?ts$/u;
-/** Served data next to its contract: `contracts/<provider>/<stem>[.<qualifier>].response.json`. */
-const RESPONSE_DATA_FILE = /\.response\.json$/;
-/** The name a specifier/declaration exports under, when it is `default`. */
-function exportsDefault(node) {
-	return (node.specifiers ?? []).some((specifier) => {
-		const exported = specifier.exported;
-		return exported?.type === "Identifier" && exported.name === "default" || stringValue(exported) === "default";
-	});
-}
-/** Is this node a `defineContract(...)` call? */
-function isDefineContract(node) {
-	const callee = node.callee;
-	return node.type === "CallExpression" && callee?.type === "Identifier" && callee.name === "defineContract";
-}
-/** A default export that may legitimately produce a contract (value or factory). */
-function producesContract(declaration) {
-	if (declaration === void 0) return false;
-	return isDefineContract(declaration) || declaration.type === "ArrowFunctionExpression" || declaration.type === "FunctionDeclaration" || declaration.type === "FunctionExpression" || declaration.type === "Identifier";
-}
-/**
-* The provider a `request:` value implies, when the builder is written as
-* `<provider>.<verb>(…)` — the only statically decidable form.
+* The provider a `request:` value implies, when the builder is written as
+* `<provider>.<verb>(…)` — the only statically decidable form.
 */
 function requestProvider(request) {
 	if (request?.type !== "CallExpression") return;
@@ -2002,7 +1842,7 @@ function checkLayout(context, node, contractsDir) {
 			});
 			continue;
 		}
-		if (!PROVIDERS.has(entry)) {
+		if (!PROVIDERS$1.has(entry)) {
 			context.report({
 				data: { entry },
 				messageId: "badProviderDir",
@@ -2018,7 +1858,7 @@ function checkLayout(context, node, contractsDir) {
 			messageId: "providerSubfolder",
 			node
 		});
-		else if (!/\.[cm]?ts$/u.test(child) && !RESPONSE_DATA_FILE.test(child)) context.report({
+		else if (!/\.[cm]?ts$/u.test(child) && !child.endsWith(".response.json")) context.report({
 			data: {
 				child,
 				provider: entry
@@ -2087,7 +1927,7 @@ function checkUnit(context, program, base, provider) {
 		if (isDefineContract(node)) {
 			const argument = node.arguments?.[0];
 			const declared = requestProvider(argument === void 0 ? void 0 : findProperty(argument, "request")?.value);
-			if (declared !== void 0 && PROVIDERS.has(declared) && declared !== provider) context.report({
+			if (declared !== void 0 && PROVIDERS$1.has(declared) && declared !== provider) context.report({
 				data: {
 					declared,
 					provider
@@ -2129,7 +1969,7 @@ const c4ContractShape = {
 		if (!parts.includes("specs")) return {};
 		const contractsIndex = parts.lastIndexOf("contracts");
 		if (contractsIndex === -1) {
-			if (!TEST_FILE$9.test(file)) return {};
+			if (!TEST_FILE$11.test(file)) return {};
 			return { Program(node) {
 				checkLayout(context, node, join(dirname(file), "contracts"));
 			} };
@@ -2140,8 +1980,8 @@ const c4ContractShape = {
 			checkComposite(context, node, base);
 		} };
 		if (depth === 2) {
-			const provider = parts[contractsIndex + 1];
-			return PROVIDERS.has(provider) ? { Program(node) {
+			const provider = parts[contractsIndex + 1] ?? "";
+			return PROVIDERS$1.has(provider) ? { Program(node) {
 				checkUnit(context, node, base, provider);
 			} } : {};
 		}
@@ -2156,25 +1996,25 @@ const c4ContractShape = {
 	meta: {
 		docs: RULE_DOCS["c4-contract-shape"],
 		messages: {
-			badName: "Contract unit \"{{base}}\" must be named <kebab-name>.ts — the folder already carries the provider (C4 — see docs/10-linting.md).",
-			badProviderDir: "contracts/{{entry}}/ is not a provider directory — a contracts/ root holds only http/, openai/, anthropic/ and *.contracts.ts files (C4 — see docs/10-linting.md).",
-			missingComposite: "Contract facade \"{{base}}\" has no default export — it must default-export the composed world (C4 — see docs/10-linting.md).",
-			missingDefault: "Contract unit \"{{base}}\" has no default export — a unit default-exports `defineContract(...)` or a factory returning one (C4 — see docs/10-linting.md).",
-			notDefineContract: "The default export of a contract unit must be `defineContract(...)` or a factory returning a contract (C4 — see docs/10-linting.md).",
-			notDefineContracts: "The default export of \"{{base}}\" must be built from `defineContracts(...)` (or a composition re-export) (C4 — see docs/10-linting.md).",
-			providerEntry: "contracts/{{provider}}/{{child}} is neither a *.ts contract nor a *.response.json payload (C4 — see docs/10-linting.md).",
-			providerMismatch: "This contract lives in contracts/{{provider}}/ but its request is a `{{declared}}.*` builder — the folder carries the provider (C4 — see docs/10-linting.md).",
-			providerSubfolder: "contracts/{{provider}}/{{child}}/ is nested — a provider folder is flat (C4 — see docs/10-linting.md).",
-			rootEntry: "contracts/{{entry}} is not a *.contracts.ts facade — data files live in a provider folder next to their contract (C4 — see docs/10-linting.md).",
-			rootFile: "Contract file \"{{base}}\" sits at the contracts/ root, which holds only *.contracts.ts facades — a unit contract belongs in http/, openai/ or anthropic/ (C4 — see docs/10-linting.md).",
-			tooDeep: "Contract file \"{{base}}\" is nested deeper than contracts/<provider>/ (C4 — see docs/10-linting.md)."
+			badName: "Contract unit \"{{base}}\" must be named <kebab-name>.ts — the folder already carries the provider (C4 — see docs/13-linting.md).",
+			badProviderDir: "contracts/{{entry}}/ is not a provider directory — a contracts/ root holds only http/, openai/, anthropic/ and *.contracts.ts files (C4 — see docs/13-linting.md).",
+			missingComposite: "Contract facade \"{{base}}\" has no default export — it must default-export the composed world (C4 — see docs/13-linting.md).",
+			missingDefault: "Contract unit \"{{base}}\" has no default export — a unit default-exports `defineContract(...)` or a factory returning one (C4 — see docs/13-linting.md).",
+			notDefineContract: "The default export of a contract unit must be `defineContract(...)` or a factory returning a contract (C4 — see docs/13-linting.md).",
+			notDefineContracts: "The default export of \"{{base}}\" must be built from `defineContracts(...)` (or a composition re-export) (C4 — see docs/13-linting.md).",
+			providerEntry: "contracts/{{provider}}/{{child}} is neither a *.ts contract nor a *.response.json payload (C4 — see docs/13-linting.md).",
+			providerMismatch: "This contract lives in contracts/{{provider}}/ but its request is a `{{declared}}.*` builder — the folder carries the provider (C4 — see docs/13-linting.md).",
+			providerSubfolder: "contracts/{{provider}}/{{child}}/ is nested — a provider folder is flat (C4 — see docs/13-linting.md).",
+			rootEntry: "contracts/{{entry}} is not a *.contracts.ts facade — data files live in a provider folder next to their contract (C4 — see docs/13-linting.md).",
+			rootFile: "Contract file \"{{base}}\" sits at the contracts/ root, which holds only *.contracts.ts facades — a unit contract belongs in http/, openai/ or anthropic/ (C4 — see docs/13-linting.md).",
+			tooDeep: "Contract file \"{{base}}\" is nested deeper than contracts/<provider>/ (C4 — see docs/13-linting.md)."
 		},
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/c6-tomatch-extension.ts
-const TEST_FILE$8 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$10 = /\.test\.[cm]?[jt]sx?$/u;
 /** Does the expect(…) subject chain contain a `.directory(…)` call? */
 function subjectIsDirectory(toMatchCallee) {
 	const expectCall = toMatchCallee.object;
@@ -2199,7 +2039,7 @@ function subjectIsDirectory(toMatchCallee) {
 const c6ToMatchExtension = {
 	create(context) {
 		const file = context.physicalFilename;
-		if (!TEST_FILE$8.test(file) || !segments(file).includes("specs")) return {};
+		if (!TEST_FILE$10.test(file) || !segments(file).includes("specs")) return {};
 		return { CallExpression(node) {
 			const callee = node.callee;
 			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
@@ -2218,13 +2058,13 @@ const c6ToMatchExtension = {
 	},
 	meta: {
 		docs: RULE_DOCS["c6-tomatch-extension"],
-		messages: { missingExtension: "toMatch(\"{{name}}\") is missing its extension — the extension is part of the fixture name (\"help.txt\", never \"help\"); only directory-tree snapshots (_expected/<name>/) omit it (C6 — see docs/10-linting.md)." },
+		messages: { missingExtension: "toMatch(\"{{name}}\") is missing its extension — the extension is part of the fixture name (\"help.txt\", never \"help\"); only directory-tree snapshots (_expected/<name>/) omit it (C6 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/c7-seeds-sql-only.ts
-const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/u;
 /**
 * CONVENTIONS C7 — `.seed()` carries DATABASE state only: `_seeds/` contains
 * nothing but `*.sql` fragments. File state goes through `.fixture()`; there
@@ -2234,7 +2074,7 @@ const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/;
 const c7SeedsSqlOnly = {
 	create(context) {
 		const file = context.physicalFilename;
-		if (!TEST_FILE$7.test(file) || !segments(file).includes("specs")) return {};
+		if (!TEST_FILE$9.test(file) || !segments(file).includes("specs")) return {};
 		return { Program(node) {
 			const seedsDir = join(dirname(file), GROUND_SEEDS);
 			for (const entry of listDirectory(seedsDir) ?? []) if (!entry.endsWith(".sql")) context.report({
@@ -2246,13 +2086,13 @@ const c7SeedsSqlOnly = {
 	},
 	meta: {
 		docs: RULE_DOCS["c7-seeds-sql-only"],
-		messages: { notSql: "_seeds/{{entry}} is not a .sql file — _seeds/ carries database state only; file state goes through .fixture() (C7 — see docs/10-linting.md)." },
+		messages: { notSql: "_seeds/{{entry}} is not a .sql file — _seeds/ carries database state only; file state goes through .fixture() (C7 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/c8-referenced-fixture-exists.ts
-const TEST_FILE$6 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$8 = /\.test\.[cm]?[jt]sx?$/u;
 /** The ground directory each fixture-referencing verb reads from. */
 const VERB_ROOTS = {
 	request: GROUND_REQUESTS,
@@ -2285,7 +2125,7 @@ const c8ReferencedFixtureExists = {
 	create(context) {
 		const file = context.physicalFilename;
 		const anchor = specsAnchor(file);
-		if (!TEST_FILE$6.test(file) || anchor === void 0) return {};
+		if (!TEST_FILE$8.test(file) || anchor === void 0) return {};
 		const featureDir = dirname(file);
 		return { CallExpression(node) {
 			const callee = node.callee;
@@ -2295,7 +2135,7 @@ const c8ReferencedFixtureExists = {
 			if (verb === "fixture") {
 				const value = stringValue(args[0]);
 				if (value === void 0 || !looksLikePath(value)) return;
-				const target = resolveFixture(value.replace(/\/+$/, ""), featureDir, anchor.directory);
+				const target = resolveFixture(value.replace(/\/+$/u, ""), featureDir, anchor.directory);
 				if (target !== void 0 && !isFile(target) && !isDirectory(target)) context.report({
 					data: {
 						path: value,
@@ -2310,7 +2150,7 @@ const c8ReferencedFixtureExists = {
 			if (root === void 0) return;
 			const value = stringValue(args[0]);
 			if (value === void 0 || !looksLikePath(value)) return;
-			const target = join(featureDir, root, value.replace(/\/+$/, ""));
+			const target = join(featureDir, root, value.replace(/\/+$/u, ""));
 			if (!(verb === "toMatch" ? isFile(target) || isDirectory(target) : isFile(target))) context.report({
 				data: {
 					path: `${root}/${value}`,
@@ -2323,236 +2163,147 @@ const c8ReferencedFixtureExists = {
 	},
 	meta: {
 		docs: RULE_DOCS["c8-referenced-fixture-exists"],
-		messages: { missing: "Referenced fixture \"{{path}}\" does not exist on disk under its ground {{root}}/ root (C8 — see docs/10-linting.md). Create it or fix the reference." },
+		messages: { missing: "Referenced fixture \"{{path}}\" does not exist on disk under its ground {{root}}/ root (C8 — see docs/13-linting.md). Create it or fix the reference." },
 		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/d12w-response-body-probe.ts
-/** A test reading the response body this many times (or more) is a cluster. */
-const DEFAULT_THRESHOLD = 3;
-/** Is `node` the `x.response.body` member access itself? */
-function isResponseBody(node) {
-	if (node.type !== "MemberExpression" || memberPropertyName(node) !== "body") return false;
-	const object = node.object;
-	return object !== void 0 && memberPropertyName(object) === "response";
-}
-/** Peel `await`, `as T`, and `!` off an initializer to reach its core expression. */
-function unwrap(node) {
-	let current = node ?? void 0;
-	while (current != null) if (current.type === "AwaitExpression") current = current.argument ?? void 0;
-	else if (current.type === "TSAsExpression" || current.type === "TSNonNullExpression") current = current.expression ?? void 0;
-	else if (current.type === "ParenthesizedExpression") current = current.expression ?? void 0;
-	else return current;
-}
+//#region src/lint/rules/c10-contracts-boundary.ts
+/** A specifier reaching into a provider folder — the internal half of contracts/. */
+const INTERNAL_UNIT = /(?:^|\/)contracts\/(?:anthropic|http|openai)\//u;
 /**
-* CONVENTIONS D12 (warning) — a full-response golden is the norm for API
-* assertions (the D11 boundary, mechanized). A test that accumulates a CLUSTER
-* of raw body probes — reading `.response.body` (or a variable cast from it)
-* `threshold`+ times in one test callback — should collapse into one golden:
-* `expect(result.response).toMatch('case.http')`. One or two probes stay silent
-* (a legitimate scalpel: absence, a single-field delta, third-party output).
-*
-* A probe is a body-rooted read: a direct `.response.body` use, or a field
-* access on the local binding a `const body = result.response.body as {…}`
-* introduces. The count is the same threshold the golden transformation applies.
+* CONVENTIONS C10 — the contracts boundary. A feature's `contracts/` folder has
+* a PUBLIC half (`*.contracts.ts` facades: the default export is the world, the
+* named exports are its scenarios) and an INTERNAL half (the `http/`, `openai/`
+* and `anthropic/` unit contracts the facades compose). Outside `contracts/`,
+* importing a unit is an error — a test routes through the facade, so a
+* scenario is named once, next to the world it derives from.
 */
-const d12wResponseBodyProbe = {
+const c10ContractsBoundary = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
-		const threshold = context.options[0]?.threshold ?? DEFAULT_THRESHOLD;
-		return { CallExpression(node) {
-			if (!isTestCallee(node.callee)) return;
-			const callback = findTestCallback(node.arguments ?? []);
-			if (callback === void 0) return;
-			const aliases = /* @__PURE__ */ new Set();
-			let responseBodyNodes = 0;
-			walk(callback, (inner) => {
-				if (isResponseBody(inner)) responseBodyNodes++;
-				if (inner.type === "VariableDeclarator") {
-					const init = unwrap(inner.init);
-					const id = inner.id;
-					if (init !== void 0 && isResponseBody(init) && id?.type === "Identifier") aliases.add(id.name);
-				}
-			});
-			let aliasReads = 0;
-			walk(callback, (inner) => {
-				if (inner.type !== "MemberExpression") return;
-				const object = inner.object;
-				if (object?.type === "Identifier" && aliases.has(object.name)) aliasReads++;
-			});
-			const probes = responseBodyNodes - aliases.size + aliasReads;
-			if (probes >= threshold) context.report({
-				data: { count: String(probes) },
-				messageId: "bodyProbeCluster",
+		const parts = segments(context.physicalFilename);
+		if (!parts.includes("specs")) return {};
+		if (parts.slice(0, -1).includes("contracts")) return {};
+		return importSourceVisitor(({ node, source }) => {
+			if (INTERNAL_UNIT.test(source)) context.report({
+				data: { source },
+				messageId: "internal",
 				node
 			});
-		} };
+		});
 	},
 	meta: {
-		docs: RULE_DOCS["d12w-response-body-probe"],
-		defaultOptions: [{ threshold: DEFAULT_THRESHOLD }],
-		messages: { bodyProbeCluster: "{{count}} body probes in one test — this wants a full golden: expect(result.response).toMatch('x.http') (D12 — see docs/10-linting.md)." },
-		schema: [{
-			additionalProperties: false,
-			properties: { threshold: {
-				minimum: 1,
-				type: "integer"
-			} },
-			type: "object"
-		}],
-		type: "suggestion"
+		docs: RULE_DOCS["c10-contracts-boundary"],
+		messages: { internal: "Import \"{{source}}\" reaches into a provider folder — only contracts/*.contracts.ts is importable from a test; add a named scenario export there instead (C10 — see docs/13-linting.md)." },
+		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/d13w-unfrozen-negative-fixture.ts
-/**
-* Does `arguments[1]` of a `toMatch(name, options)` call carry `{ frozen: true }`?
-* A frozen fixture opts out of update-mode rewriting, so it is exempt.
-*/
-function hasFrozenOption(args) {
-	const options = args[1];
-	if (options === void 0 || options.type !== "ObjectExpression") return false;
-	const value = findProperty(options, "frozen")?.value;
-	return value?.type === "Literal" && value.value === true;
+//#region src/lint/rules/c11-contract-data-pairing.ts
+const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/u;
+/** The provider folders that may carry data files. */
+const PROVIDERS = [
+	"anthropic",
+	"http",
+	"openai"
+];
+/** Data files: served payloads and matched inputs, both owned by a contract. */
+const DATA_SUFFIXES = [".request.ts", ".response.json"];
+/** The owning contract of a data file: its name up to the FIRST dot, `.ts`. */
+function ownerOf(entry) {
+	return `${entry.slice(0, entry.indexOf("."))}.ts`;
 }
 /**
-* Is this `toMatch(…)` call nested inside a WRAPPING `expect(…)` — the shape of a
-* negative assertion (`expect(() => …toMatch(…)).toThrow()` or
-* `expect(…toMatch(…)).rejects.toThrow()`)? The subject's own `expect(x)` is the
-* member OBJECT of `.toMatch` (a descendant), never an ancestor, so a positive
-* `expect(x).toMatch('f')` never trips this. The walk stays inside the current
-* expression: it stops at the first statement boundary or non-`expect` call, so
-* a `toMatch` merely written inside `inUpdateMode(() => …)` is NOT flagged.
+* CONVENTIONS C11 — data is owned by a contract. Inside a provider folder every
+* `*.response.json` (served payload) and `*.request.ts` (matched prompt/body)
+* pairs with the sibling `<stem>.ts` that serves it, where the stem is the name
+* up to the FIRST dot: `events.fr.response.json` belongs to `events.ts`. A data
+* file with no owner is dead weight no test can reach — reported on the feature's
+* test file, since oxlint never visits a `.json`.
 */
-const TRANSPARENT_ANCESTORS = /* @__PURE__ */ new Set([
-	"ArrowFunctionExpression",
-	"AwaitExpression",
-	"ChainExpression",
-	"MemberExpression",
-	"ParenthesizedExpression",
-	"TSAsExpression",
-	"TSNonNullExpression"
-]);
-function isWrappedInExpect(node) {
-	let current = node.parent;
-	while (current !== void 0) {
-		if (current.type === "CallExpression") {
-			const callee = current.callee;
-			return callee?.type === "Identifier" && callee.name === "expect";
-		}
-		if (!TRANSPARENT_ANCESTORS.has(current.type)) return false;
-		current = current.parent;
-	}
-	return false;
-}
-/**
-* CONVENTIONS D13 (warning) — a `toMatch` whose failure is the behaviour under
-* test (wrapped in `expect(() => …).toThrow()` or `expect(…).rejects.toThrow()`)
-* asserts a DELIBERATELY-WRONG or MISSING fixture. Under `TEST_UPDATE=1` an
-* unfrozen fixture is silently rewritten with the actual output — the matcher
-* writes instead of throwing — which destroys the negative case (the assertion
-* then no longer throws). Pass `{ frozen: true }` so the fixture is never
-* rewritten and the mismatch/error still throws in update mode.
-*
-* The structural signal is precise for the wrapped forms; a `toMatch` routed
-* through a helper that owns the try/catch (`catchMessage(() => …toMatch(…))`)
-* is out of static reach — see the D13 process note for that residue.
-*/
-const d13wUnfrozenNegativeFixture = {
+const c11ContractDataPairing = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
-		return { CallExpression(node) {
-			const callee = node.callee;
-			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
-			if (!isWrappedInExpect(node)) return;
-			if (hasFrozenOption(node.arguments ?? [])) return;
-			context.report({
-				messageId: "unfrozenNegativeFixture",
-				node
-			});
+		const file = context.physicalFilename;
+		if (!TEST_FILE$7.test(file) || !segments(file).includes("specs")) return {};
+		return { Program(node) {
+			const contractsDir = join(dirname(file), "contracts");
+			for (const provider of PROVIDERS) {
+				const entries = listDirectory(join(contractsDir, provider));
+				if (entries === null) continue;
+				const present = new Set(entries);
+				for (const entry of entries) {
+					if (!DATA_SUFFIXES.some((suffix) => entry.endsWith(suffix))) continue;
+					const owner = ownerOf(entry);
+					if (!present.has(owner)) context.report({
+						data: {
+							entry,
+							owner,
+							provider
+						},
+						messageId: "orphan",
+						node
+					});
+				}
+			}
 		} };
 	},
 	meta: {
-		docs: RULE_DOCS["d13w-unfrozen-negative-fixture"],
-		messages: { unfrozenNegativeFixture: "This toMatch asserts a mismatch (wrapped in expect(…).toThrow/.rejects) — pass { frozen: true } so TEST_UPDATE=1 never overwrites the deliberately-wrong fixture (D13 — see docs/10-linting.md)." },
-		type: "suggestion"
+		docs: RULE_DOCS["c11-contract-data-pairing"],
+		messages: { orphan: "contracts/{{provider}}/{{entry}} has no owning contract — data pairs with the sibling {{owner}} (stem = name up to the first dot) (C11 — see docs/13-linting.md)." },
+		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/d15w-status-only-probe.ts
-/** An HTTP status code lives in this range — the numeric-literal gate. */
-const MIN_STATUS = 100;
-const MAX_STATUS = 599;
-/** Matchers that pin a single value — the shape of a status probe. */
-const EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual"]);
-/** Is `node` an `expect(…)` call (bare `expect` identifier callee)? */
-function isExpectCall(node) {
-	if (node?.type !== "CallExpression") return false;
-	const callee = node.callee;
-	return callee?.type === "Identifier" && callee.name === "expect";
-}
-/** Is `node` a numeric literal in the HTTP status range (100–599)? */
-function isStatusLiteral(node) {
-	if (node?.type !== "Literal" || typeof node.value !== "number") return false;
-	const value = node.value;
-	return Number.isInteger(value) && value >= MIN_STATUS && value <= MAX_STATUS;
-}
-/**
-* Is `node` a status probe — `expect(X.status).toBe(N)` / `.toEqual(N)` where
-* `X.status` is any `.status` member access and `N` is a numeric literal in the
-* HTTP status range? The numeric-literal gate keeps container-status STRINGS
-* (`expect(neo.status).toBe('running')`) out.
-*/
-function isStatusProbe(node) {
-	if (node.type !== "CallExpression") return false;
-	const callee = node.callee;
-	if (callee?.type !== "MemberExpression") return false;
-	const matcher = memberPropertyName(callee);
-	if (matcher === void 0 || !EQUALITY_MATCHERS.has(matcher)) return false;
-	const expectCall = callee.object;
-	if (!isExpectCall(expectCall)) return false;
-	const subject = (expectCall?.arguments ?? [])[0];
-	if (subject?.type !== "MemberExpression" || memberPropertyName(subject) !== "status") return false;
-	const expected = (node.arguments ?? [])[0];
-	return isStatusLiteral(expected);
-}
+//#region src/lint/rules/c13-underscored-ground.ts
+const TEST_FILE$6 = /\.test\.[cm]?[jt]sx?$/u;
 /**
-* CONVENTIONS D11/D15 (warning) — a spec test whose ONLY assertions are HTTP
-* status probes (`expect(X.status).toBe(N)` / `.toEqual(N)`, N a numeric literal
-* 100–599) throws away the full-response golden. Pin the whole response instead:
-* `expect(result.response).toMatch('case.http')`.
+* CONVENTIONS C13 — the ground of a spec carries a leading underscore. A
+* directory named `fixtures/`, `expected/`, `requests/` or `seeds/` under
+* `specs/` is a pre-14 name: since `@jterrazz/test` 14.0.0 the four are
+* `_fixtures/`, `_expected/`, `_requests/` and `_seeds/`, with no compatibility
+* fallback.
 *
-* This complements d12w (which needs a CLUSTER of ≥3 body probes): the lone
-* `expect(result.status).toBe(422)` as a test's sole assertion falls below that
-* threshold yet still hides everything the response carries. The rule fires only
-* when EVERY `expect(…)` in the callback is a status probe — a status probe
-* sitting NEXT TO a real assertion (a golden, `toMatchRows`, `toContain`, …) is
-* the legitimate scalpel and stays silent.
+* The catch this rule exists for: a consumer that upgrades and keeps the old
+* names loses nothing loudly. Every resolver — `.fixture()`, `.seed()`,
+* `.request()`, `toMatch()` — looks under the underscored name, finds nothing,
+* and the tree becomes invisible rather than wrong. The failure that follows is
+* "fixture does not exist" on every spec at once, one step removed from the
+* cause; this rule states the cause and the rename.
+*
+* Anchored on the feature's visited test file, exactly as C2/C7/C11 are: the
+* spec's own sibling directories are probed, plus the `$FIXTURES` pool at the
+* nearest specs root. A DOMAIN folder named after the ground it holds
+* (`specs/api/requests/_requests/`) is never a probe target — only what sits
+* beside a spec is.
 */
-const d15wStatusOnlyProbe = {
+const c13UnderscoredGround = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
-		return { CallExpression(node) {
-			if (!isTestCallee(node.callee)) return;
-			const callback = findTestCallback(node.arguments ?? []);
-			if (callback === void 0) return;
-			let expectCalls = 0;
-			let statusProbes = 0;
-			walk(callback, (inner) => {
-				if (isExpectCall(inner)) expectCalls++;
-				if (isStatusProbe(inner)) statusProbes++;
-			});
-			if (expectCalls >= 1 && statusProbes === expectCalls) context.report({
-				messageId: "statusOnlyProbe",
-				node
-			});
+		const file = context.physicalFilename;
+		const anchor = specsAnchor(file);
+		if (!TEST_FILE$6.test(file) || anchor === void 0) return {};
+		return { Program(node) {
+			const seen = /* @__PURE__ */ new Set();
+			const probe = (parent, legacy) => {
+				const path = join(parent, legacy);
+				if (seen.has(path) || !isDirectory(path)) return;
+				seen.add(path);
+				context.report({
+					data: {
+						ground: RENAMED_GROUND_DIRS[legacy] ?? legacy,
+						legacy
+					},
+					messageId: "notUnderscored",
+					node
+				});
+			};
+			for (const legacy of Object.keys(RENAMED_GROUND_DIRS)) probe(dirname(file), legacy);
+			probe(anchor.directory, "fixtures");
 		} };
 	},
 	meta: {
-		docs: RULE_DOCS["d15w-status-only-probe"],
-		messages: { statusOnlyProbe: "The test's only assertion(s) are status probes — pin the full response: expect(result.response).toMatch('case.http') (D11 — see docs/10-linting.md)." },
-		type: "suggestion"
+		docs: RULE_DOCS["c13-underscored-ground"],
+		messages: { notUnderscored: "The directory \"{{legacy}}/\" is a pre-14 ground name — rename it to \"{{ground}}/\" (`git mv {{legacy}} {{ground}}`). What a spec stands on carries the underscore; a spec's own folder never does, and no resolver reads the un-underscored name (C13 — see docs/13-linting.md)." },
+		type: "problem"
 	}
 };
 //#endregion
@@ -2606,7 +2357,7 @@ const d2AwaitIoMatcher = {
 	},
 	meta: {
 		docs: RULE_DOCS["d2-await-io-matcher"],
-		messages: { mustAwait: "expect(…).{{matcher}}(…) is IO-backed and returns a promise — it must be awaited or returned, else the assertion never runs (D2 — see docs/10-linting.md)." },
+		messages: { mustAwait: "expect(…).{{matcher}}(…) is IO-backed and returns a promise — it must be awaited or returned, else the assertion never runs (D2 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
@@ -2660,7 +2411,7 @@ const d2wAwaitSyncMatcher = {
 	},
 	meta: {
 		docs: RULE_DOCS["d2w-await-sync-matcher"],
-		messages: { redundantAwait: "await on expect(…).{{matcher}}(…) is redundant — that matcher is synchronous; only IO-backed matchers (toMatchRows/toBeEmpty/toBeRunning) are awaited (D2 — see docs/10-linting.md)." },
+		messages: { redundantAwait: "await on expect(…).{{matcher}}(…) is redundant — that matcher is synchronous; only IO-backed matchers (toMatchRows/toBeEmpty/toBeRunning) are awaited (D2 — see docs/13-linting.md)." },
 		type: "suggestion"
 	}
 };
@@ -2688,7 +2439,7 @@ const KNOWN_TOKEN_LITERAL = new RegExp(`^\\{\\{(?:${[
 	"url",
 	"uuid",
 	"workdir"
-].join("|")})(?:#[\\w.-]+)?\\}\\}$`);
+].join("|")})(?:#[\\w.-]+)?\\}\\}$`, "u");
 /**
 * Is this function a pure chain of `.replace(…, '{{token}}')` normalisations?
 * Accepts an arrow with an expression body or a single-return body whose
@@ -2700,8 +2451,9 @@ function isTokenEquivalentTransform(fn) {
 	let expression = fn.body;
 	if (expression?.type === "BlockStatement") {
 		const statements = expression.body ?? [];
-		if (statements.length !== 1 || statements[0].type !== "ReturnStatement") return false;
-		expression = statements[0].argument;
+		const [only] = statements;
+		if (statements.length !== 1 || only?.type !== "ReturnStatement") return false;
+		expression = only.argument;
 	}
 	let sawReplace = false;
 	while (expression?.type === "CallExpression") {
@@ -2737,124 +2489,352 @@ const d6wTransformTokenEquivalent = {
 	},
 	meta: {
 		docs: RULE_DOCS["d6w-transform-token-equivalent"],
-		messages: { tokenEquivalent: "This transform only rewrites output into known token literals — write the tokens in the _expected/ fixture instead; transform is an escape hatch for uncovered noise (D6 — see docs/10-linting.md)." },
+		messages: { tokenEquivalent: "This transform only rewrites output into known token literals — write the tokens in the _expected/ fixture instead; transform is an escape hatch for uncovered noise (D6 — see docs/13-linting.md)." },
 		type: "suggestion"
 	}
-};
-//#endregion
-//#region src/lint/rules/d8w-text-bypass.ts
-/** Text-oriented matchers that tempt a raw `.text` bypass (D8). */
-const TEXT_MATCHERS = /* @__PURE__ */ new Set(["toContain", "toMatch"]);
+};
+//#endregion
+//#region src/lint/rules/d8w-text-bypass.ts
+/** Text-oriented matchers that tempt a raw `.text` bypass (D8). */
+const TEXT_MATCHERS = /* @__PURE__ */ new Set(["toContain", "toMatch"]);
+/**
+* CONVENTIONS D8 (warning) — `.text` is the raw stream escape hatch. Asserting
+* `expect(result.text).toContain(…)` throws away the typed subject (its token
+* grammar, its `toMatch('file.txt')` fixture resolution) for a substring check.
+* Prefer asserting on the accessor subject itself.
+*/
+const d8wTextBypass = {
+	create(context) {
+		return { CallExpression(node) {
+			const callee = node.callee;
+			const matcher = callee === void 0 ? void 0 : memberPropertyName(callee);
+			if (matcher === void 0 || !TEXT_MATCHERS.has(matcher)) return;
+			const expectCall = callee?.object;
+			if (expectCall?.type !== "CallExpression") return;
+			const expectCallee = expectCall.callee;
+			if (expectCallee?.type !== "Identifier" || expectCallee.name !== "expect") return;
+			const subject = expectCall.arguments?.[0];
+			if (subject !== void 0 && memberPropertyName(subject) === "text") context.report({
+				data: { matcher },
+				messageId: "textBypass",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d8w-text-bypass"],
+		messages: { textBypass: "expect(x.text).{{matcher}}(…) asserts on the raw stream — prefer the typed accessor subject (expect(x)) so the token grammar and fixture resolution apply (D8 — see docs/13-linting.md)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d9w-single-use-ref.ts
+const TEST_FILE$5 = /\.test\.[cm]?[jt]sx?$/u;
+/** A captured-ref token: `{{kind#ref}}`. Captures the ref name. */
+const REF_TOKEN = /\{\{[A-Za-z][A-Za-z0-9]*#(?<ref>[\w.-]+)\}\}/gu;
+/** Is this call `match.ref(...)`? */
+function isMatchRef(node) {
+	const callee = node.callee;
+	if (callee?.type !== "MemberExpression" || memberPropertyName(callee) !== "ref") return false;
+	const object = callee.object;
+	return object?.type === "Identifier" && object.name === "match";
+}
+/** Ref names captured in a fixture text (or a directory-tree snapshot's files). */
+function refsInFixture(target) {
+	const refs = [];
+	const collect = (text) => {
+		for (const match of text.matchAll(REF_TOKEN)) refs.push(match.groups?.ref ?? "");
+	};
+	if (isFile(target)) {
+		const text = readFileCached(target);
+		if (text !== null) collect(text);
+		return refs;
+	}
+	if (isDirectory(target)) for (const entry of listDirectory(target) ?? []) refs.push(...refsInFixture(join(target, entry)));
+	return refs;
+}
+/**
+* CONVENTIONS D9 (warning) — a capture ref (`match.ref('order')`,
+* `{{uuid#order}}`) earns its keep only when it is asserted more than once (the
+* point of a capture is the equality check on later occurrences). Aggregating
+* per file — code `match.ref` literals plus the `{{kind#ref}}` tokens of the
+* `_expected/` fixtures the file references — a ref that appears exactly once
+* everywhere is a plain matcher wearing a name.
+*/
+const d9wSingleUseRef = {
+	create(context) {
+		const file = context.physicalFilename;
+		if (!TEST_FILE$5.test(file) || !segments(file).includes("specs")) return {};
+		const featureDir = dirname(file);
+		return { Program(program) {
+			const counts = /* @__PURE__ */ new Map();
+			const codeNodes = /* @__PURE__ */ new Map();
+			const fixtureNodes = /* @__PURE__ */ new Map();
+			const bump = (ref) => {
+				counts.set(ref, (counts.get(ref) ?? 0) + 1);
+			};
+			walk(program, (node) => {
+				if (node.type !== "CallExpression") return;
+				if (isMatchRef(node)) {
+					const ref = stringValue(node.arguments?.[0]);
+					if (ref !== void 0) {
+						bump(ref);
+						if (!codeNodes.has(ref)) codeNodes.set(ref, node);
+					}
+					return;
+				}
+				if (memberPropertyName(node.callee) === "toMatch") {
+					const name = stringValue(node.arguments?.[0]);
+					if (name !== void 0) {
+						const target = join(featureDir, GROUND_EXPECTED, name.replace(/\/+$/u, ""));
+						for (const ref of refsInFixture(target)) {
+							bump(ref);
+							if (!fixtureNodes.has(ref)) fixtureNodes.set(ref, node);
+						}
+					}
+				}
+			});
+			for (const [ref, count] of counts) {
+				const node = codeNodes.get(ref) ?? fixtureNodes.get(ref);
+				if (count === 1 && node !== void 0) context.report({
+					data: { ref },
+					messageId: "singleUse",
+					node
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d9w-single-use-ref"],
+		messages: { singleUse: "Capture ref \"{{ref}}\" is used only once in this spec — a ref earns its name by asserting equality across occurrences; use a plain matcher instead (D9 — see docs/13-linting.md)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d12w-response-body-probe.ts
+/** A test reading the response body this many times (or more) is a cluster. */
+const DEFAULT_THRESHOLD = 3;
+/** Is `node` the `x.response.body` member access itself? */
+function isResponseBody(node) {
+	if (node.type !== "MemberExpression" || memberPropertyName(node) !== "body") return false;
+	const object = node.object;
+	return object !== void 0 && memberPropertyName(object) === "response";
+}
+/** Peel `await`, `as T`, and `!` off an initializer to reach its core expression. */
+function unwrap(node) {
+	let current = node ?? void 0;
+	while (current != null) if (current.type === "AwaitExpression") current = current.argument ?? void 0;
+	else if (current.type === "TSAsExpression" || current.type === "TSNonNullExpression") current = current.expression ?? void 0;
+	else if (current.type === "ParenthesizedExpression") current = current.expression ?? void 0;
+	else return current;
+}
+/**
+* CONVENTIONS D12 (warning) — a full-response golden is the norm for API
+* assertions (the D11 boundary, mechanized). A test that accumulates a CLUSTER
+* of raw body probes — reading `.response.body` (or a variable cast from it)
+* `threshold`+ times in one test callback — should collapse into one golden:
+* `expect(result.response).toMatch('case.http')`. One or two probes stay silent
+* (a legitimate scalpel: absence, a single-field delta, third-party output).
+*
+* A probe is a body-rooted read: a direct `.response.body` use, or a field
+* access on the local binding a `const body = result.response.body as {…}`
+* introduces. The count is the same threshold the golden transformation applies.
+*/
+const d12wResponseBodyProbe = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		const threshold = context.options[0]?.threshold ?? DEFAULT_THRESHOLD;
+		return { CallExpression(node) {
+			if (!isTestCallee(node.callee)) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			const aliases = /* @__PURE__ */ new Set();
+			let responseBodyNodes = 0;
+			walk(callback, (inner) => {
+				if (isResponseBody(inner)) responseBodyNodes++;
+				if (inner.type === "VariableDeclarator") {
+					const init = unwrap(inner.init);
+					const id = inner.id;
+					if (init !== void 0 && isResponseBody(init) && id?.type === "Identifier") aliases.add(id.name);
+				}
+			});
+			let aliasReads = 0;
+			walk(callback, (inner) => {
+				if (inner.type !== "MemberExpression") return;
+				const object = inner.object;
+				if (object?.type === "Identifier" && aliases.has(object.name)) aliasReads++;
+			});
+			const probes = responseBodyNodes - aliases.size + aliasReads;
+			if (probes >= threshold) context.report({
+				data: { count: String(probes) },
+				messageId: "bodyProbeCluster",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d12w-response-body-probe"],
+		defaultOptions: [{ threshold: DEFAULT_THRESHOLD }],
+		messages: { bodyProbeCluster: "{{count}} body probes in one test — this wants a full golden: expect(result.response).toMatch('x.http') (D12 — see docs/13-linting.md)." },
+		schema: [{
+			additionalProperties: false,
+			properties: { threshold: {
+				minimum: 1,
+				type: "integer"
+			} },
+			type: "object"
+		}],
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d13w-unfrozen-negative-fixture.ts
+/**
+* Does `arguments[1]` of a `toMatch(name, options)` call carry `{ frozen: true }`?
+* A frozen fixture opts out of update-mode rewriting, so it is exempt.
+*/
+function hasFrozenOption(args) {
+	const options = args[1];
+	if (options === void 0 || options.type !== "ObjectExpression") return false;
+	const value = findProperty(options, "frozen")?.value;
+	return value?.type === "Literal" && value.value === true;
+}
+/**
+* Is this `toMatch(…)` call nested inside a WRAPPING `expect(…)` — the shape of a
+* negative assertion (`expect(() => …toMatch(…)).toThrow()` or
+* `expect(…toMatch(…)).rejects.toThrow()`)? The subject's own `expect(x)` is the
+* member OBJECT of `.toMatch` (a descendant), never an ancestor, so a positive
+* `expect(x).toMatch('f')` never trips this. The walk stays inside the current
+* expression: it stops at the first statement boundary or non-`expect` call, so
+* a `toMatch` merely written inside `inUpdateMode(() => …)` is NOT flagged.
+*/
+const TRANSPARENT_ANCESTORS = /* @__PURE__ */ new Set([
+	"ArrowFunctionExpression",
+	"AwaitExpression",
+	"ChainExpression",
+	"MemberExpression",
+	"ParenthesizedExpression",
+	"TSAsExpression",
+	"TSNonNullExpression"
+]);
+function isWrappedInExpect(node) {
+	let current = node.parent;
+	while (current !== void 0) {
+		if (current.type === "CallExpression") {
+			const callee = current.callee;
+			return callee?.type === "Identifier" && callee.name === "expect";
+		}
+		if (!TRANSPARENT_ANCESTORS.has(current.type)) return false;
+		current = current.parent;
+	}
+	return false;
+}
 /**
-* CONVENTIONS D8 (warning) — `.text` is the raw stream escape hatch. Asserting
-* `expect(result.text).toContain(…)` throws away the typed subject (its token
-* grammar, its `toMatch('file.txt')` fixture resolution) for a substring check.
-* Prefer asserting on the accessor subject itself.
+* CONVENTIONS D13 (warning) — a `toMatch` whose failure is the behaviour under
+* test (wrapped in `expect(() => …).toThrow()` or `expect(…).rejects.toThrow()`)
+* asserts a DELIBERATELY-WRONG or MISSING fixture. Under `TEST_UPDATE=1` an
+* unfrozen fixture is silently rewritten with the actual output — the matcher
+* writes instead of throwing — which destroys the negative case (the assertion
+* then no longer throws). Pass `{ frozen: true }` so the fixture is never
+* rewritten and the mismatch/error still throws in update mode.
+*
+* The structural signal is precise for the wrapped forms; a `toMatch` routed
+* through a helper that owns the try/catch (`catchMessage(() => …toMatch(…))`)
+* is out of static reach — see the D13 process note for that residue.
 */
-const d8wTextBypass = {
+const d13wUnfrozenNegativeFixture = {
 	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
 		return { CallExpression(node) {
 			const callee = node.callee;
-			const matcher = callee === void 0 ? void 0 : memberPropertyName(callee);
-			if (matcher === void 0 || !TEXT_MATCHERS.has(matcher)) return;
-			const expectCall = callee?.object;
-			if (expectCall?.type !== "CallExpression") return;
-			const expectCallee = expectCall.callee;
-			if (expectCallee?.type !== "Identifier" || expectCallee.name !== "expect") return;
-			const subject = expectCall.arguments?.[0];
-			if (subject !== void 0 && memberPropertyName(subject) === "text") context.report({
-				data: { matcher },
-				messageId: "textBypass",
+			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
+			if (!isWrappedInExpect(node)) return;
+			if (hasFrozenOption(node.arguments ?? [])) return;
+			context.report({
+				messageId: "unfrozenNegativeFixture",
 				node
 			});
 		} };
 	},
 	meta: {
-		docs: RULE_DOCS["d8w-text-bypass"],
-		messages: { textBypass: "expect(x.text).{{matcher}}(…) asserts on the raw stream — prefer the typed accessor subject (expect(x)) so the token grammar and fixture resolution apply (D8 — see docs/10-linting.md)." },
+		docs: RULE_DOCS["d13w-unfrozen-negative-fixture"],
+		messages: { unfrozenNegativeFixture: "This toMatch asserts a mismatch (wrapped in expect(…).toThrow/.rejects) — pass { frozen: true } so TEST_UPDATE=1 never overwrites the deliberately-wrong fixture (D13 — see docs/13-linting.md)." },
 		type: "suggestion"
 	}
 };
 //#endregion
-//#region src/lint/rules/d9w-single-use-ref.ts
-const TEST_FILE$5 = /\.test\.[cm]?[jt]sx?$/;
-/** A captured-ref token: `{{kind#ref}}`. Captures the ref name. */
-const REF_TOKEN = /\{\{[A-Za-z][A-Za-z0-9]*#(?<ref>[\w.-]+)\}\}/g;
-/** Is this call `match.ref(...)`? */
-function isMatchRef(node) {
+//#region src/lint/rules/d15w-status-only-probe.ts
+/** An HTTP status code lives in this range — the numeric-literal gate. */
+const MIN_STATUS = 100;
+const MAX_STATUS = 599;
+/** Matchers that pin a single value — the shape of a status probe. */
+const EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual"]);
+/** Is `node` an `expect(…)` call (bare `expect` identifier callee)? */
+function isExpectCall(node) {
+	if (node?.type !== "CallExpression") return false;
 	const callee = node.callee;
-	if (callee?.type !== "MemberExpression" || memberPropertyName(callee) !== "ref") return false;
-	const object = callee.object;
-	return object?.type === "Identifier" && object.name === "match";
+	return callee?.type === "Identifier" && callee.name === "expect";
 }
-/** Ref names captured in a fixture text (or a directory-tree snapshot's files). */
-function refsInFixture(target) {
-	const refs = [];
-	const collect = (text) => {
-		for (const match of text.matchAll(REF_TOKEN)) refs.push(match.groups?.ref ?? "");
-	};
-	if (isFile(target)) {
-		const text = readFileCached(target);
-		if (text !== null) collect(text);
-		return refs;
-	}
-	if (isDirectory(target)) for (const entry of listDirectory(target) ?? []) refs.push(...refsInFixture(join(target, entry)));
-	return refs;
+/** Is `node` a numeric literal in the HTTP status range (100–599)? */
+function isStatusLiteral(node) {
+	if (node?.type !== "Literal" || typeof node.value !== "number") return false;
+	const { value } = node;
+	return Number.isInteger(value) && value >= MIN_STATUS && value <= MAX_STATUS;
 }
 /**
-* CONVENTIONS D9 (warning) — a capture ref (`match.ref('order')`,
-* `{{uuid#order}}`) earns its keep only when it is asserted more than once (the
-* point of a capture is the equality check on later occurrences). Aggregating
-* per file — code `match.ref` literals plus the `{{kind#ref}}` tokens of the
-* `_expected/` fixtures the file references — a ref that appears exactly once
-* everywhere is a plain matcher wearing a name.
+* Is `node` a status probe — `expect(X.status).toBe(N)` / `.toEqual(N)` where
+* `X.status` is any `.status` member access and `N` is a numeric literal in the
+* HTTP status range? The numeric-literal gate keeps container-status STRINGS
+* (`expect(neo.status).toBe('running')`) out.
 */
-const d9wSingleUseRef = {
+function isStatusProbe(node) {
+	if (node.type !== "CallExpression") return false;
+	const callee = node.callee;
+	if (callee?.type !== "MemberExpression") return false;
+	const matcher = memberPropertyName(callee);
+	if (matcher === void 0 || !EQUALITY_MATCHERS.has(matcher)) return false;
+	const expectCall = callee.object;
+	if (!isExpectCall(expectCall)) return false;
+	const subject = (expectCall?.arguments ?? [])[0];
+	if (subject?.type !== "MemberExpression" || memberPropertyName(subject) !== "status") return false;
+	const expected = (node.arguments ?? [])[0];
+	return isStatusLiteral(expected);
+}
+/**
+* CONVENTIONS D11/D15 (warning) — a spec test whose ONLY assertions are HTTP
+* status probes (`expect(X.status).toBe(N)` / `.toEqual(N)`, N a numeric literal
+* 100–599) throws away the full-response golden. Pin the whole response instead:
+* `expect(result.response).toMatch('case.http')`.
+*
+* This complements d12w (which needs a CLUSTER of ≥3 body probes): the lone
+* `expect(result.status).toBe(422)` as a test's sole assertion falls below that
+* threshold yet still hides everything the response carries. The rule fires only
+* when EVERY `expect(…)` in the callback is a status probe — a status probe
+* sitting NEXT TO a real assertion (a golden, `toMatchRows`, `toContain`, …) is
+* the legitimate scalpel and stays silent.
+*/
+const d15wStatusOnlyProbe = {
 	create(context) {
-		const file = context.physicalFilename;
-		if (!TEST_FILE$5.test(file) || !segments(file).includes("specs")) return {};
-		const featureDir = dirname(file);
-		return { Program(program) {
-			const counts = /* @__PURE__ */ new Map();
-			const codeNodes = /* @__PURE__ */ new Map();
-			const fixtureNodes = /* @__PURE__ */ new Map();
-			const bump = (ref) => {
-				counts.set(ref, (counts.get(ref) ?? 0) + 1);
-			};
-			walk(program, (node) => {
-				if (node.type !== "CallExpression") return;
-				if (isMatchRef(node)) {
-					const ref = stringValue(node.arguments?.[0]);
-					if (ref !== void 0) {
-						bump(ref);
-						if (!codeNodes.has(ref)) codeNodes.set(ref, node);
-					}
-					return;
-				}
-				if (memberPropertyName(node.callee) === "toMatch") {
-					const name = stringValue(node.arguments?.[0]);
-					if (name !== void 0) {
-						const target = join(featureDir, GROUND_EXPECTED, name.replace(/\/+$/, ""));
-						for (const ref of refsInFixture(target)) {
-							bump(ref);
-							if (!fixtureNodes.has(ref)) fixtureNodes.set(ref, node);
-						}
-					}
-				}
+		if (!segments(context.filename).includes("specs")) return {};
+		return { CallExpression(node) {
+			if (!isTestCallee(node.callee)) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			let expectCalls = 0;
+			let statusProbes = 0;
+			walk(callback, (inner) => {
+				if (isExpectCall(inner)) expectCalls++;
+				if (isStatusProbe(inner)) statusProbes++;
+			});
+			if (expectCalls >= 1 && statusProbes === expectCalls) context.report({
+				messageId: "statusOnlyProbe",
+				node
 			});
-			for (const [ref, count] of counts) {
-				const node = codeNodes.get(ref) ?? fixtureNodes.get(ref);
-				if (count === 1 && node !== void 0) context.report({
-					data: { ref },
-					messageId: "singleUse",
-					node
-				});
-			}
 		} };
 	},
 	meta: {
-		docs: RULE_DOCS["d9w-single-use-ref"],
-		messages: { singleUse: "Capture ref \"{{ref}}\" is used only once in this spec — a ref earns its name by asserting equality across occurrences; use a plain matcher instead (D9 — see docs/10-linting.md)." },
+		docs: RULE_DOCS["d15w-status-only-probe"],
+		messages: { statusOnlyProbe: "The test's only assertion(s) are status probes — pin the full response: expect(result.response).toMatch('case.http') (D11 — see docs/13-linting.md)." },
 		type: "suggestion"
 	}
 };
@@ -2912,7 +2892,7 @@ function findOwnManifest(startDir) {
 */
 function declaredSubpaths(startDir) {
 	if (startDir === void 0 && cached !== null) return cached;
-	const exports = findOwnManifest(startDir ?? dirname(fileURLToPath(import.meta.url)))?.exports;
+	const exports = findOwnManifest(startDir ?? import.meta.dirname)?.exports;
 	const subpaths = exports !== null && typeof exports === "object" ? Object.keys(exports).filter((key) => key.startsWith("./") && key !== ".").map((key) => `${PACKAGE$2}/${key.slice(2)}`).sort() : [];
 	if (startDir === void 0) cached = subpaths;
 	return subpaths;
@@ -2948,15 +2928,15 @@ const f1NoSubpathImport = {
 	},
 	meta: {
 		docs: RULE_DOCS["f1-no-subpath-import"],
-		messages: { subpath: "Import from \"@jterrazz/test\", not \"{{source}}\" — internal subpaths do not exist (F1 — see docs/10-linting.md). Published subpaths, exempt everywhere: {{published}}." },
+		messages: { subpath: "Import from \"@jterrazz/test\", not \"{{source}}\" — internal subpaths do not exist (F1 — see docs/13-linting.md). Published subpaths, exempt everywhere: {{published}}." },
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/f2-no-test-imports-in-prod.ts
-const TEST_FILE$4 = /\.(?:test|fixtures|specification)\.[cm]?[jt]sx?$/;
-const CONFIG_FILE = /(?:^|[/\\])[\w.-]*\.config\.[cm]?[jt]s$/;
-const TEST_IMPORT$1 = /\.(?:test|fixtures)(?:\.[cm]?[jt]sx?)?$/;
+const TEST_FILE$4 = /\.(?:test|fixtures|specification)\.[cm]?[jt]sx?$/u;
+const CONFIG_FILE = /(?:^|[/\\])[\w.-]*\.config\.[cm]?[jt]s$/u;
+const TEST_IMPORT$1 = /\.(?:test|fixtures)(?:\.[cm]?[jt]sx?)?$/u;
 const TOOL_SUBPATH$1 = "@jterrazz/test/oxlint";
 /**
 * CONVENTIONS F2 — production code never imports a test artefact. In a
@@ -2996,7 +2976,7 @@ const f2NoTestImportsInProd = {
 	},
 	meta: {
 		docs: RULE_DOCS["f2-no-test-imports-in-prod"],
-		messages: { testImport: "Production code must not import the test artefact \"{{source}}\" — test imports are only legal from specs/, *.test.ts, *.fixtures.ts or *.specification.ts (F2 — see docs/10-linting.md)." },
+		messages: { testImport: "Production code must not import the test artefact \"{{source}}\" — test imports are only legal from specs/, *.test.ts, *.fixtures.ts or *.specification.ts (F2 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
@@ -3013,15 +2993,15 @@ const TOOL_SUBPATH = "@jterrazz/test/oxlint";
 * `server: () => createApp()` importing `../../src/app.js`).
 */
 const FRAMEWORK_LAYERS = /* @__PURE__ */ new Set([
-	"core",
 	"integrations",
 	"lint",
+	"specification",
 	"vitest"
 ]);
 /**
 * CONVENTIONS F3 — from `specs/`, deep-importing the FRAMEWORK's internals is
 * forbidden: a relative path resolving inside the framework repo's
-* `src/{core,integrations,vitest,lint}/`, or any `@jterrazz/test/<subpath>`
+* `src/{specification,integrations,vitest,lint}/`, or any `@jterrazz/test/<subpath>`
 * other than the sanctioned tool-facing `@jterrazz/test/oxlint`. A consumer's
 * imports of its OWN app source are always allowed — that is the pattern.
 *
@@ -3047,7 +3027,7 @@ const f3SpecsPublicEntry = {
 			}
 			const marker = source.indexOf("/src/");
 			if (marker === -1 && !source.startsWith("src/")) return;
-			const layer = (marker === -1 ? source.slice(4) : source.slice(marker + 5)).split("/")[0];
+			const layer = (marker === -1 ? source.slice(4) : source.slice(marker + 5)).split("/")[0] ?? "";
 			if (!FRAMEWORK_LAYERS.has(layer)) return;
 			if (underIntegrations && layer === "integrations") return;
 			context.report({
@@ -3059,14 +3039,14 @@ const f3SpecsPublicEntry = {
 	},
 	meta: {
 		docs: RULE_DOCS["f3-specs-public-entry"],
-		messages: { deepImport: "specs/ must not deep-import framework internals — reach the framework via its public entry (@jterrazz/test, or src/index.js in this repo), not \"{{source}}\" (F3 — see docs/10-linting.md; only @jterrazz/test/oxlint, and src/integrations/** from specs/integrations/, are exempt)." },
+		messages: { deepImport: "specs/ must not deep-import framework internals — reach the framework via its public entry (@jterrazz/test, or src/index.js in this repo), not \"{{source}}\" (F3 — see docs/13-linting.md; only @jterrazz/test/oxlint, and src/integrations/** from specs/integrations/, are exempt)." },
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/f4-no-test-to-test-import.ts
-const TEST_FILE$3 = /\.test\.[cm]?[jt]sx?$/;
-const TEST_IMPORT = /\.test(?:\.[cm]?[jt]sx?)?$/;
+const TEST_FILE$3 = /\.test\.[cm]?[jt]sx?$/u;
+const TEST_IMPORT = /\.test(?:\.[cm]?[jt]sx?)?$/u;
 /**
 * CONVENTIONS F4 — a `*.test.ts` never imports another `*.test.ts`. Shared
 * test data belongs in a `*.fixtures.ts` neighbour (F5), shared runners in a
@@ -3085,14 +3065,14 @@ const f4NoTestToTestImport = {
 	},
 	meta: {
 		docs: RULE_DOCS["f4-no-test-to-test-import"],
-		messages: { testToTest: "A test file must not import another test file (\"{{source}}\") — share data via a *.fixtures.ts neighbour or a *.specification.ts runner (F4 — see docs/10-linting.md)." },
+		messages: { testToTest: "A test file must not import another test file (\"{{source}}\") — share data via a *.fixtures.ts neighbour or a *.specification.ts runner (F4 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/f5-fixtures-only-from-tests.ts
-const TEST_FILE$2 = /\.test\.[cm]?[jt]sx?$/;
-const FIXTURES_IMPORT = /\.fixtures(?:\.[cm]?[jt]sx?)?$/;
+const TEST_FILE$2 = /\.test\.[cm]?[jt]sx?$/u;
+const FIXTURES_IMPORT = /\.fixtures(?:\.[cm]?[jt]sx?)?$/u;
 /**
 * CONVENTIONS F5 — a `*.fixtures.ts` module is only importable from
 * `*.test.ts` files. Any other importer (prod code, a specification file,
@@ -3111,13 +3091,13 @@ const f5FixturesOnlyFromTests = {
 	},
 	meta: {
 		docs: RULE_DOCS["f5-fixtures-only-from-tests"],
-		messages: { fixturesImport: "A *.fixtures.ts module (\"{{source}}\") is only importable from *.test.ts files (F5 — see docs/10-linting.md)." },
+		messages: { fixturesImport: "A *.fixtures.ts module (\"{{source}}\") is only importable from *.test.ts files (F5 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/i1-layer-boundaries.ts
-const TEST_OR_FIXTURES = /\.(?:test|fixtures)\.[cm]?[jt]sx?$/;
+const TEST_OR_FIXTURES = /\.(?:test|fixtures)\.[cm]?[jt]sx?$/u;
 function matchesPackage(source, packages) {
 	return packages.some((name) => source === name || source.startsWith(`${name}/`));
 }
@@ -3129,7 +3109,7 @@ function pathInsideSrc(path) {
 }
 /** Strip a `.js`/`.ts`-style extension for exact-path comparison. */
 function withoutExtension(path) {
-	return path.replace(/\.[cm]?[jt]sx?$/, "");
+	return path.replace(/\.[cm]?[jt]sx?$/u, "");
 }
 /** Does `target` match one of the declared paths (prefix, or exact module)? */
 function matchesPath(target, patterns) {
@@ -3203,8 +3183,8 @@ const i1LayerBoundaries = {
 		defaultOptions: [{ layers: {} }],
 		docs: RULE_DOCS["i1-layer-boundaries"],
 		messages: {
-			crossLayer: "Layer \"{{layer}}\" must not import \"{{source}}\" — outside the edges its layer map declares (I1 — see docs/10-linting.md).",
-			foreignDependency: "\"{{source}}\" is not a dependency layer \"{{layer}}\" declares — one layer states the packages it may import (I1 — see docs/10-linting.md)."
+			crossLayer: "Layer \"{{layer}}\" must not import \"{{source}}\" — outside the edges its layer map declares (I1 — see docs/13-linting.md).",
+			foreignDependency: "\"{{source}}\" is not a dependency layer \"{{layer}}\" declares — one layer states the packages it may import (I1 — see docs/13-linting.md)."
 		},
 		schema: [{
 			additionalProperties: false,
@@ -3246,7 +3226,7 @@ const i1LayerBoundaries = {
 };
 //#endregion
 //#region src/lint/rules/i2-sibling-test-naming.ts
-const TEST_FILE$1 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$1 = /\.test\.[cm]?[jt]sx?$/u;
 /**
 * CONVENTIONS I2 — module tests are NEIGHBOURS: the test of `<file>.ts` is
 * `<file>.test.ts` next to it (Go's `foo_test.go` parity). Flags, on visited
@@ -3274,7 +3254,7 @@ const i2SiblingTestNaming = {
 						".js"
 					].map((extension) => file.replace(TEST_FILE$1, extension));
 					if (!neighbours.some(isFile)) context.report({
-						data: { expected: neighbours[0].split(/[/\\]/).at(-1) ?? "" },
+						data: { expected: neighbours[0]?.split(/[/\\]/u).at(-1) ?? "" },
 						messageId: "orphanTest",
 						node
 					});
@@ -3292,16 +3272,16 @@ const i2SiblingTestNaming = {
 	meta: {
 		docs: RULE_DOCS["i2-sibling-test-naming"],
 		messages: {
-			orphanTest: "A src/ module test must sit NEXT to the module it tests — no neighbour \"{{expected}}\" found (I2 — see docs/10-linting.md). A test needing more than its module is a specification: move it to specs/.",
-			rootTests: "A root-level tests/ directory is banned — module tests are siblings under src/, product specifications live in specs/ (I2 — see docs/10-linting.md).",
-			testsDir: "__tests__/ directories are banned under src/ — the test of <file>.ts is its neighbour <file>.test.ts (I2 — see docs/10-linting.md)."
+			orphanTest: "A src/ module test must sit NEXT to the module it tests — no neighbour \"{{expected}}\" found (I2 — see docs/13-linting.md). A test needing more than its module is a specification: move it to specs/.",
+			rootTests: "A root-level tests/ directory is banned — module tests are siblings under src/, product specifications live in specs/ (I2 — see docs/13-linting.md).",
+			testsDir: "__tests__/ directories are banned under src/ — the test of <file>.ts is its neighbour <file>.test.ts (I2 — see docs/13-linting.md)."
 		},
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/i4-no-vi-mock-in-src.ts
-const TEST_FILE = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE = /\.test\.[cm]?[jt]sx?$/u;
 const DATA_ASSET = new RegExp(`\\.(?:${[
 	"avif",
 	"bin",
@@ -3339,10 +3319,10 @@ const DATA_ASSET = new RegExp(`\\.(?:${[
 	"yaml",
 	"yml",
 	"zip"
-].join("|")})$`, "i");
+].join("|")})$`, "iu");
 /** A bundler suffix (`./payload.json?raw`, `./doc.md#frag`) is not part of the extension. */
 function withoutSuffix(source) {
-	return source.replace(/[?#].*$/, "");
+	return source.replace(/[?#].*$/u, "");
 }
 /**
 * CONVENTIONS I4 — in module tests under `src/`, mocks and data are CODE:
@@ -3394,57 +3374,14 @@ const i4NoViMockInSrc = {
 	meta: {
 		docs: RULE_DOCS["i4-no-vi-mock-in-src"],
 		messages: {
-			assetImport: "A src/ module test must not import the data asset \"{{source}}\" — inline it as code or move the test to specs/ (I4 — see docs/10-linting.md).",
-			bannedDir: "`{{dir}}/` directories are banned under src/ — mocks and data are code: mockOf/mockOfDate inline, payloads in a *.fixtures.ts neighbour (I4 — see docs/10-linting.md).",
-			viMock: "`vi.mock` is banned under src/ — use mockOf/mockOfDate (I4 — see docs/10-linting.md)."
+			assetImport: "A src/ module test must not import the data asset \"{{source}}\" — inline it as code or move the test to specs/ (I4 — see docs/13-linting.md).",
+			bannedDir: "`{{dir}}/` directories are banned under src/ — mocks and data are code: mockOf/mockOfDate inline, payloads in a *.fixtures.ts neighbour (I4 — see docs/13-linting.md).",
+			viMock: "`vi.mock` is banned under src/ — use mockOf/mockOfDate (I4 — see docs/13-linting.md)."
 		},
 		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/j1-no-only-skip.ts
-/** Test runners whose `.only` / `.skip` modifiers must never be committed. */
-const RUNNERS = /* @__PURE__ */ new Set([
-	"describe",
-	"it",
-	"test"
-]);
-/** The focus/skip modifiers CONVENTIONS J1 forbids. */
-const FORBIDDEN = /* @__PURE__ */ new Set(["only", "skip"]);
-/**
-* CONVENTIONS J1 — no committed `.only` / `.skip`.
-*
-* Flags the member form used across the specs: `describe.only`, `test.only`,
-* `it.only` and their `.skip` counterparts. Modifiers that legitimately gate a
-* test (`test.skipIf`, `test.runIf`) are untouched — only the bare `only`/`skip`
-* that pin or disable a test in a commit are reported.
-*/
-const j1NoOnlySkip = {
-	create(context) {
-		return { MemberExpression(node) {
-			if (node.computed === true) return;
-			const object = node.object;
-			const property = node.property;
-			if (object?.type !== "Identifier" || property?.type !== "Identifier") return;
-			const runner = object.name;
-			const modifier = property.name;
-			if (RUNNERS.has(runner) && FORBIDDEN.has(modifier)) context.report({
-				data: {
-					modifier,
-					runner
-				},
-				messageId: "forbidden",
-				node
-			});
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["j1-no-only-skip"],
-		messages: { forbidden: "Committed `{{runner}}.{{modifier}}` is not allowed (J1 — see docs/10-linting.md). Remove it before committing." },
-		type: "problem"
-	}
-};
-//#endregion
 //#region src/lint/rules/j2-no-sleep-in-specs.ts
 /**
 * CONVENTIONS J2 — spec files (`specs/**`) contain no arbitrary sleeps:
@@ -3483,138 +3420,13 @@ const j2NoSleepInSpecs = {
 	meta: {
 		docs: RULE_DOCS["j2-no-sleep-in-specs"],
 		messages: {
-			sleep: "No arbitrary sleeps in specs — synchronise via `waitFor` or the framework (J2 — see docs/10-linting.md).",
-			timersImport: "No timer-based sleeps in specs — synchronise via `waitFor` or the framework (J2 — see docs/10-linting.md)."
+			sleep: "No arbitrary sleeps in specs — synchronise via `waitFor` or the framework (J2 — see docs/13-linting.md).",
+			timersImport: "No timer-based sleeps in specs — synchronise via `waitFor` or the framework (J2 — see docs/13-linting.md)."
 		},
 		type: "problem"
 	}
 };
 //#endregion
-//#region src/lint/rules/j3-no-expectless-test.ts
-/** Does `callback` contain at least one `expect(…)` call? */
-function hasExpect(callback) {
-	let found = false;
-	walk(callback, (node) => {
-		if (found || node.type !== "CallExpression") return;
-		const callee = node.callee;
-		if (callee?.type === "Identifier" && callee.name === "expect") found = true;
-	});
-	return found;
-}
-/**
-* CONVENTIONS J3 — a test asserts something. A `test('…', () => { … })` whose
-* body contains no `expect(…)` is either dead or a silent no-op.
-*
-* Reuses the shared B4 test-shape helpers. `test.todo(...)` (and any other
-* callback-less form) is skipped — there is nothing to assert yet.
-*/
-const j3NoExpectlessTest = {
-	create(context) {
-		return { CallExpression(node) {
-			const callee = node.callee;
-			if (!isTestCallee(callee)) return;
-			if (testCalleeHasModifier(callee, "todo")) return;
-			const callback = findTestCallback(node.arguments ?? []);
-			if (callback === void 0) return;
-			if (!hasExpect(callback)) context.report({
-				messageId: "noExpect",
-				node
-			});
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["j3-no-expectless-test"],
-		messages: { noExpect: "Test has no `expect(…)` — a test must assert something (J3 — see docs/10-linting.md). Use `test.todo` for a pending test." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/j4-unique-test-names.ts
-/**
-* CONVENTIONS J4 — test names are the sole description of behaviour (B3), so two
-* tests sharing a literal name in one file are a copy-paste smell: one shadows
-* the other in the reporter. Flags the second (and later) occurrence.
-*
-* `.each` / parametrized tests are skipped — their name is a template expanded
-* per row, collisions there are by construction.
-*/
-const j4UniqueTestNames = {
-	create(context) {
-		const seen = /* @__PURE__ */ new Set();
-		return { CallExpression(node) {
-			const callee = node.callee;
-			if (!isTestCallee(callee)) return;
-			if (testCalleeHasModifier(callee, "each")) return;
-			const name = testName(node);
-			if (name === void 0) return;
-			if (seen.has(name)) {
-				context.report({
-					data: { name },
-					messageId: "duplicate",
-					node
-				});
-				return;
-			}
-			seen.add(name);
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["j4-unique-test-names"],
-		messages: { duplicate: "Duplicate test name \"{{name}}\" in this file — the test name is the sole description of behaviour, so it must be unique (J4 — see docs/10-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
-//#region src/lint/rules/j5-lowercase-title.ts
-/** The block/test introducers whose title literal C1' constrains. */
-const TITLED = /* @__PURE__ */ new Set([
-	"describe",
-	"it",
-	"test"
-]);
-/** An identifier-shaped, all-caps/underscored first word: `VALID_CATEGORIES`,
-* `HTTP`, `DI`. Such a word names a symbol verbatim — lowercasing it would
-* misspell it — so it is exempt. A prose word (`Rejects`, `Builds`) is not. */
-const ALL_CAPS_IDENTIFIER = /^[A-Z][A-Z0-9_]*$/u;
-/**
-* CONVENTIONS J5 — the first character of a `test('…')` / `describe('…')` title
-* literal must be lowercase.
-*
-* The test name is the sole description of behaviour (B3): a sentence fragment,
-* lowercase-led like prose (`'rejects an unknown job'`). Exempt are titles
-* whose first WORD is an identifier-shaped all-caps/underscored token
-* (`'VALID_CATEGORIES is rejected'`, `'HTTP is upgraded'`, `'DI wires …'`) —
-* lowercasing a named symbol would misspell it — and titles opening on a
-* non-letter (a `$`, a `{`, a `%s` placeholder). Only lowercase-able prose
-* first words are enforced. Covers the modifier and parametrized forms
-* (`test.only`, `describe.each(...)(...)`) via the chain root.
-*/
-const j5LowercaseTitle = {
-	create(context) {
-		return { CallExpression(node) {
-			const callee = node.callee;
-			const root = chainRootName(callee);
-			if (root === void 0 || !TITLED.has(root)) return;
-			const title = stringValue(node.arguments?.[0]);
-			if (title === void 0) return;
-			const first = [...title][0];
-			if (first === void 0 || !/\p{L}/u.test(first)) return;
-			const firstWord = title.split(/\s+/u)[0];
-			if (ALL_CAPS_IDENTIFIER.test(firstWord)) return;
-			if (first !== first.toLocaleLowerCase()) context.report({
-				data: { runner: root },
-				messageId: "uppercase",
-				node
-			});
-		} };
-	},
-	meta: {
-		docs: RULE_DOCS["j5-lowercase-title"],
-		messages: { uppercase: "A {{runner}}() title must start lowercase — the test name is a prose fragment, not a sentence (J5 — see docs/10-linting.md)." },
-		type: "problem"
-	}
-};
-//#endregion
 //#region src/lint/rules/w1-scenario-pure.ts
 /** The scenario-carrying terminal actions: `.visit()` (website) and `.open()` (mobile). */
 const SCENARIO_ACTIONS$1 = /* @__PURE__ */ new Set(["open", "visit"]);
@@ -3644,7 +3456,7 @@ const w1ScenarioPure = {
 	},
 	meta: {
 		docs: RULE_DOCS["w1-scenario-pure"],
-		messages: { expectInScenario: "No expect() inside a scenario — the scenario is the When; assert the final state on the returned result in the Then (W1 — see docs/10-linting.md)." },
+		messages: { expectInScenario: "No expect() inside a scenario — the scenario is the When; assert the final state on the returned result in the Then (W1 — see docs/13-linting.md)." },
 		type: "problem"
 	}
 };
@@ -3660,7 +3472,7 @@ const SCENARIO_ACTIONS = /* @__PURE__ */ new Set(["open", "visit"]);
 *
 * Registered in a consumer's (or this repo's own) `oxlint.config.ts` via
 * `jsPlugins: ['@jterrazz/test/oxlint']` and referenced as `jterrazz/<rule>` in
-* the `rules` map, e.g. `'jterrazz/j1-no-only-skip': 'error'` — or enabled
+* the `rules` map, e.g. `'jterrazz/j2-no-sleep-in-specs': 'error'` — or enabled
 * wholesale by spreading {@link recommendedRules}.
 *
 * This entry is bundled by tsdown (`dist/oxlint.js`); rules import nothing from
@@ -3710,11 +3522,7 @@ const plugin = {
 		"i1-layer-boundaries": i1LayerBoundaries,
 		"i2-sibling-test-naming": i2SiblingTestNaming,
 		"i4-no-vi-mock-in-src": i4NoViMockInSrc,
-		"j1-no-only-skip": j1NoOnlySkip,
 		"j2-no-sleep-in-specs": j2NoSleepInSpecs,
-		"j3-no-expectless-test": j3NoExpectlessTest,
-		"j4-unique-test-names": j4UniqueTestNames,
-		"j5-lowercase-title": j5LowercaseTitle,
 		"w1-scenario-pure": w1ScenarioPure,
 		"w2w-user-facing-elements": {
 			create(context) {
@@ -3736,7 +3544,7 @@ const plugin = {
 			},
 			meta: {
 				docs: RULE_DOCS["w2w-user-facing-elements"],
-				messages: { testIdElement: "Prefer a user-facing element (button, link, field, heading, content) over testId() — the escape hatch hides what the user actually sees (W2 — see docs/10-linting.md)." },
+				messages: { testIdElement: "Prefer a user-facing element (button, link, field, heading, content) over testId() — the escape hatch hides what the user actually sees (W2 — see docs/13-linting.md)." },
 				type: "suggestion"
 			}
 		}
@@ -3754,7 +3562,7 @@ const plugin = {
 *
 *     'jterrazz/b5-await-using': ['error', { runners: ['dockerCli'] }]
 */
-const recommendedRules = Object.fromEntries(Object.keys(plugin.rules).map((rule) => [`jterrazz/${rule}`, /^\w+w-/.test(rule) ? "warn" : "error"]));
+const recommendedRules = Object.fromEntries(Object.keys(plugin.rules).map((rule) => [`jterrazz/${rule}`, /^\w+w-/u.test(rule) ? "warn" : "error"]));
 /**
 * The composable testing fragment — wire the plugin, enable the whole
 * catalogue, and ship the one override every strict consumer needs. Designed