@jterrazz/test 15.2.0 → 16.0.0

package/dist/checker.js

@@ -1,8 +1,86 @@
 #!/usr/bin/env node
-import { a as assertedStreams, d as isMap, f as isScalar, i as SpecSyntaxError, m as renderYamlSource, n as RUN_KEYS, o as parseSpecDocument, p as isSeq, r as SPEC_EXTENSION, s as readSpecFile, t as DOCUMENT_KEYS, u as Scalar } from "./spec-document.js";
-import { c as GROUND_EXPECTED, l as GROUND_FIXTURES, o as resolveFixtureSource, r as TOKEN_KINDS, s as GROUND_DIRS, u as GROUND_REQUESTS } from "./match.js";
+import { _ as isSeq, a as DOCUMENT_KEYS, c as SpecSyntaxError, d as readSpecFile, g as isScalar, h as isMap, l as assertedStreams, m as Scalar, o as RUN_KEYS, r as TOKEN_KINDS, s as SPEC_EXTENSION, u as parseSpecDocument, v as renderYamlSource } from "./match.js";
+import { a as GROUND_FIXTURES, i as GROUND_EXPECTED, n as resolveFixtureSource, o as GROUND_REQUESTS, r as GROUND_DIRS, s as GROUND_SEEDS } from "./fixtures.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
-import { basename, dirname, join, relative, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { spawnSync } from "node:child_process";
+//#region src/lint/fs-cache.ts
+const kinds = /* @__PURE__ */ new Map();
+function kindOf(path) {
+	const cached = kinds.get(path);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = statSync(path).isDirectory() ? "dir" : "file";
+	} catch {
+		result = "missing";
+	}
+	kinds.set(path, result);
+	return result;
+}
+function isFile(path) {
+	return kindOf(path) === "file";
+}
+//#endregion
+//#region src/lint/ast.ts
+/**
+* The `specs/` directory a file belongs to: the NEAREST ancestor named `specs`,
+* searched no higher than the nearest `package.json`. `undefined` when the file
+* is not under one.
+*
+* One anchor for every specs-aware rule, because two searches are two
+* answers: an innermost match and an outermost one read a nested tree as two
+* different facets, and a bare "is `specs` a segment of this path" test
+* answers about the machine — a checkout living under `~/specs/` would be one
+* whole specs tree, with F2's protection of production code silently off. The
+* package boundary makes the search stop where the project does.
+*/
+function specsAnchor(filename) {
+	const relative = [basename(filename)];
+	let directory = dirname(filename);
+	for (;;) {
+		if (basename(directory) === "specs") return {
+			directory,
+			relative
+		};
+		if (isFile(join(directory, "package.json"))) return;
+		const parent = dirname(directory);
+		if (parent === directory) return;
+		relative.unshift(basename(directory));
+		directory = parent;
+	}
+}
+/** Is this file inside a `specs/` tree? — the predicate form of {@link specsAnchor}. */
+function isUnderSpecs(filename) {
+	return specsAnchor(filename) !== void 0;
+}
+//#endregion
+//#region src/lint/role.ts
+/**
+* The three suffixes that DECLARE tests, as a name-level predicate.
+*
+* `roleOf` is the answer for a rule handed a file; the passes that WALK a tree
+* only ever hold a name, and this is the same vocabulary for them — one place
+* to read, so a tree walk and a rule never disagree on what a test is.
+*/
+function isTestFileName(name) {
+	return name.endsWith(".test.ts") || name.endsWith(".test.tsx") || name.endsWith(".spec.ts");
+}
+/** A test that runs under node's project — a `.test.tsx` renders and is not one. */
+function isNodeTestFileName(name) {
+	return name.endsWith(".test.ts") || name.endsWith(".spec.ts");
+}
+/** The nearest package root at or above a directory, when there is one. */
+function packageRootOf(directory) {
+	let current = directory;
+	for (;;) {
+		if (isFile(join(current, "package.json"))) return current;
+		const parent = dirname(current);
+		if (parent === current) return;
+		current = parent;
+	}
+}
+//#endregion
 //#region src/lint/checker-crossfile.ts
 /**
 * The cross-file checker passes — the analyses oxlint cannot express because
@@ -158,9 +236,10 @@ function blankComments(text) {
 	for (let i = 0; i < text.length; i += 1) {
 		const char = text[i];
 		const next = text[i + 1];
-		if (state === "line") if (char === "\n") state = "";
-		else out[i] = " ";
-		else if (state === "block") {
+		if (state === "line") {
+			if (char === "\n") state = "";
+			else out[i] = " ";
+		} else if (state === "block") {
 			if (char === "*" && next === "/") {
 				out[i] = " ";
 				out[i + 1] = " ";
@@ -200,12 +279,12 @@ function collectSpecLiterals(path) {
 /**
 * Is this a file a leaf's ground may be referenced from?
 *
-* `.test.tsx` counts as much as `.test.ts`: a rendered unit's golden — its ARIA
-* tree — sits in the same `_expected/`, read by a test the suffix alone tells
-* apart.
+* Every test suffix counts, and so does a document: a rendered unit's golden —
+* its ARIA tree — sits in the same `_expected/` as a spec's, read by a file the
+* suffix alone tells apart.
 */
 function isReferrer(name) {
-	return name.endsWith(".test.ts") || name.endsWith(".test.tsx") || name.endsWith(".spec.yaml");
+	return isTestFileName(name) || name.endsWith(".spec.yaml");
 }
 function isDir(path) {
 	try {
@@ -233,6 +312,23 @@ function collectLiterals(text) {
 	}
 	return found;
 }
+const TEMPLATE_WITH_HOLE = /`(?<body>(?:[^`\\]|\\.)*\$\{(?:[^`\\]|\\.)*)`/gu;
+function collectLiteralPatterns(text) {
+	const found = [];
+	for (const match of text.matchAll(TEMPLATE_WITH_HOLE)) {
+		const body = match.groups?.body ?? "";
+		const opens = body.indexOf("${");
+		const closes = body.lastIndexOf("}");
+		if (opens === -1 || closes === -1 || closes < opens) continue;
+		const prefix = body.slice(0, opens);
+		const suffix = body.slice(closes + 1);
+		if (prefix.length > 0 || suffix.length > 0) found.push({
+			prefix,
+			suffix
+		});
+	}
+	return found;
+}
 /**
 * Does the text pass a NON-literal argument to a fixture-ish verb
 * (`.seed`/`.request`/`.fixture`/`toMatch`)? A template with an expression or a
@@ -403,7 +499,7 @@ function checkDockerRunnerAwaitUsing(rootDir) {
 		if (model.dockerAware && model.runnerExports.size > 0) dockerSpecs.set(file, model);
 	}
 	if (dockerSpecs.size === 0) return violations;
-	for (const testFile of listFiles(rootDir, (path) => path.endsWith(".test.ts"))) {
+	for (const testFile of listFiles(rootDir, isNodeTestFileName)) {
 		const text = readSource(testFile);
 		const runners = /* @__PURE__ */ new Set();
 		for (const binding of namedImports(text)) {
@@ -422,7 +518,8 @@ function checkDockerRunnerAwaitUsing(rootDir) {
 			violations.push({
 				file: rel,
 				line,
-				message: `${rel}:${line}: result of docker-aware runner "${runner}" must be bound with \`await using\` so its containers are disposed (B5 — see docs/13-linting.md)`,
+				message: `${rel}:${line}: result of docker-aware runner "${runner}" must be bound with \`await using\` so its containers are disposed (B5 — see docs/19-linting.md)`,
+				rule: "b5",
 				severity: "error"
 			});
 		}
@@ -454,7 +551,7 @@ function checkDatabaseProperty(rootDir) {
 		if (model.sqlDatabaseCount !== null && model.sqlDatabaseCount >= 1 && model.runnerExports.size > 0) enforced.set(file, model);
 	}
 	if (enforced.size === 0) return violations;
-	for (const testFile of listFiles(rootDir, (path) => path.endsWith(".test.ts"))) {
+	for (const testFile of listFiles(rootDir, isNodeTestFileName)) {
 		const text = readSource(testFile);
 		const applicable = /* @__PURE__ */ new Set();
 		for (const binding of namedImports(text)) {
@@ -479,13 +576,15 @@ function checkDatabaseProperty(rootDir) {
 			if (count >= 2 && !hasDatabase) violations.push({
 				file: rel,
 				line,
-				message: `${rel}:${line}: .${verb}() must pass { database } — ${count} SQL databases are declared (A7 — see docs/13-linting.md)`,
+				message: `${rel}:${line}: .${verb}() must pass { database } — ${count} SQL databases are declared (A7 — see docs/19-linting.md)`,
+				rule: "a7",
 				severity: "error"
 			});
 			else if (count === 1 && hasDatabase) violations.push({
 				file: rel,
 				line,
-				message: `${rel}:${line}: .${verb}() must not pass { database } — a single SQL database is declared (A7 — see docs/13-linting.md)`,
+				message: `${rel}:${line}: .${verb}() must not pass { database } — a single SQL database is declared (A7 — see docs/19-linting.md)`,
+				rule: "a7",
 				severity: "error"
 			});
 		}
@@ -493,7 +592,8 @@ function checkDatabaseProperty(rootDir) {
 	return violations;
 }
 /** Is a top-level ground-subdir entry referenced by any test literal? */
-function entryReferenced(entry, entryIsDir, literals) {
+function entryReferenced(entry, entryIsDir, literals, patterns = []) {
+	for (const pattern of patterns) if (entry.startsWith(pattern.prefix) && entry.endsWith(pattern.suffix)) return true;
 	for (const literal of literals) {
 		if (entryIsDir) {
 			if (literal === entry || literal.startsWith(`${entry}/`) || literal.includes(`/${entry}`)) return true;
@@ -505,7 +605,7 @@ function entryReferenced(entry, entryIsDir, literals) {
 /** A child named like a ground subdir but actually a fixture container. */
 function isConventionalSubdir(path) {
 	if (!isDir(path)) return false;
-	if (listFiles(path, (candidate) => candidate.endsWith(".test.ts")).length > 0) return false;
+	if (listFiles(path, isTestFileName).length > 0) return false;
 	let children;
 	try {
 		children = readdirSync(path, { withFileTypes: true });
@@ -533,12 +633,14 @@ function checkDeadFixtures(rootDir) {
 			violations.push({
 				file: rel,
 				line: 1,
-				message: `${rel}: domain directory has ground subdirs (${groundSubdirs.join(", ")}) but no *.test.ts(x) or *.spec.yaml (C9 — see docs/13-linting.md)`,
+				message: `${rel}: domain directory has ground subdirs (${groundSubdirs.join(", ")}) but no *.test.ts(x) or *.spec.yaml (C9 — see docs/19-linting.md)`,
+				rule: "c9",
 				severity: "error"
 			});
 			continue;
 		}
 		const literals = /* @__PURE__ */ new Set();
+		const patterns = [];
 		let downgrade = false;
 		for (const testFile of testFiles) {
 			if (testFile.endsWith(".spec.yaml")) {
@@ -547,6 +649,7 @@ function checkDeadFixtures(rootDir) {
 			}
 			const text = readSource(testFile);
 			for (const literal of collectLiterals(text)) literals.add(literal);
+			patterns.push(...collectLiteralPatterns(text));
 			downgrade ||= hasNonLiteralFixtureArg(text);
 		}
 		const severity = downgrade ? "warn" : "error";
@@ -554,12 +657,13 @@ function checkDeadFixtures(rootDir) {
 			const subPath = join(dir, sub);
 			for (const entry of readdirSync(subPath, { withFileTypes: true })) {
 				const entryIsDir = entry.isDirectory();
-				if (entryReferenced(entry.name, entryIsDir, literals)) continue;
+				if (entryReferenced(entry.name, entryIsDir, literals, patterns)) continue;
 				const relEntry = relative(rootDir, join(subPath, entry.name));
 				violations.push({
 					file: relEntry,
 					line: 1,
-					message: `${relEntry}: dead fixture — no test literal in ${feature} references ${sub}/${entry.name} (C9 — see docs/13-linting.md)`,
+					message: `${relEntry}: dead fixture — no test literal in ${feature} references ${sub}/${entry.name} (C9 — see docs/19-linting.md)`,
+					rule: "c9",
 					severity
 				});
 			}
@@ -584,7 +688,8 @@ function checkPoolFixtures(rootDir) {
 			violations.push({
 				file: relEntry,
 				line: 1,
-				message: `${relEntry}: dead pool fixture — no spec under ${relative(rootDir, specsRoot)} references $FIXTURES/${entry.name} (C9 — see docs/13-linting.md)`,
+				message: `${relEntry}: dead pool fixture — no spec under ${relative(rootDir, specsRoot)} references $FIXTURES/${entry.name} (C9 — see docs/19-linting.md)`,
+				rule: "c9",
 				severity: "error"
 			});
 		}
@@ -687,7 +792,8 @@ function checkPoolFixtureSharing(rootDir) {
 		return {
 			file: relEntry,
 			line: 1,
-			message: `${relEntry}: only ${relLeaf} reaches for this pool fixture — the pool is what SEVERAL leaves share; move it to ${relLeaf}/${GROUND_FIXTURES}/${entry} and reference it as '${entry}' (C14 — see docs/13-linting.md, or run the checker with --fix)`,
+			message: `${relEntry}: only ${relLeaf} reaches for this pool fixture — the pool is what SEVERAL leaves share; move it to ${relLeaf}/${GROUND_FIXTURES}/${entry} and reference it as '${entry}' (C14 — see docs/19-linting.md, or run the checker with --fix)`,
+			rule: "c14",
 			severity: "error"
 		};
 	});
@@ -740,7 +846,8 @@ function checkLocalFixtureReach(rootDir) {
 				violations.push({
 					file: rel,
 					line,
-					message: `${rel}:${line}: fixture "${path}" reaches outside ${relative(rootDir, ground)} — a leaf's ground sits beside it; ground several leaves share goes to the $FIXTURES pool at ${relative(rootDir, pool)} (C15 — see docs/13-linting.md)`,
+					message: `${rel}:${line}: fixture "${path}" reaches outside ${relative(rootDir, ground)} — a leaf's ground sits beside it; ground several leaves share goes to the $FIXTURES pool at ${relative(rootDir, pool)} (C15 — see docs/19-linting.md)`,
+					rule: "c15",
 					severity: "error"
 				});
 			}
@@ -748,6 +855,767 @@ function checkLocalFixtureReach(rootDir) {
 	}
 	return violations;
 }
+/** The directive, whatever precedes it on the line, and what follows the ids. */
+const DIRECTIVE = /(?<lead>.*?)checker-disable(?:-next-line|-line)\s+(?<rest>.*)$/iu;
+/**
+* A directive is written in a COMMENT — the word inside a string is a test
+* TALKING about suppressions, which is what this package's own suite does.
+*/
+const COMMENT_LEAD = /(?:^|\s)(?:\/\/|\/\*|\*|#)\s*$/u;
+/** The files a directive can be written in — source, documents, goldens. */
+const READABLE = /\.(?:[cm]?[jt]sx?|ya?ml|json|md|sql|http|txt)$/u;
+/** Is this a file a human writes a directive in? */
+function isReadableText(path) {
+	return READABLE.test(path);
+}
+/** A reason: the `--` separator with something after it. */
+const REASON = /--\s*\S/u;
+/**
+* J9 — every checker suppression says WHY.
+*
+* A suppression with no reason is a rule turned off by someone who is no longer
+* here: the next reader cannot tell whether the pass was wrong, the shape was
+* exceptional, or it was simply in the way — so the line survives every review
+* and the convention quietly stops holding. The toolchain's own
+* `suppressions-reason` gate reads `oxlint-disable*` and nothing else, which is
+* why this channel carries its own.
+*/
+function checkSuppressionReason(rootDir) {
+	const violations = [];
+	for (const file of listFiles(rootDir, isReadableText)) {
+		const text = readText$1(file);
+		if (!text.includes("checker-disable")) continue;
+		for (const [index, line] of text.split("\n").entries()) {
+			const match = DIRECTIVE.exec(line);
+			if (match === null || !COMMENT_LEAD.test(match.groups?.lead ?? "") || REASON.test(match.groups?.rest ?? "")) continue;
+			const rel = relative(rootDir, file);
+			violations.push({
+				file: rel,
+				line: index + 1,
+				message: `${rel}:${index + 1}: say why: \`checker-disable-next-line <id> -- <reason>\` (J9 — see docs/19-linting.md)`,
+				rule: "j9-checker-suppression-reason",
+				severity: "error"
+			});
+		}
+	}
+	return violations;
+}
+//#endregion
+//#region src/lint/checker-facets.ts
+/**
+* The FACET passes — what a tree says about itself, read from the tree.
+*
+* A statique rule sees one file; these three need the shape around it: which
+* folder a file sits under, what the specification at that folder's root
+* constructs, which ground lives below it, and who reads that ground. The four
+* hold the one law the fork rests on — **folder = constructor** — from both
+* sides: a facet folder has the runner its name promises (C20), a spec under it
+* reaches that runner (C18), and ground one spec alone reads belongs to that
+* spec (C21w).
+*
+* A first-level folder that is NOT a facet is a repository suite — it covers a
+* tree rather than a product, C1's declared depth judges its shape, and none of
+* these passes reaches it.
+*/
+/** The six facet folders — a first-level name under `specs/` that IS a constructor. */
+const FACETS$1 = [
+	"api",
+	"cli",
+	"integration",
+	"jobs",
+	"mobile",
+	"website"
+];
+/**
+* Directories no facet walk enters.
+*
+* The `$FIXTURES` pool is verbatim material — the reusable apps AND the trees
+* that fail on purpose — never live specs, so every pass prunes it exactly as
+* the token checker does.
+*/
+const SKIPPED$2 = /* @__PURE__ */ new Set([
+	".git",
+	"dist",
+	GROUND_FIXTURES,
+	"node_modules"
+]);
+/** `readdirSync` that answers `[]` for anything it cannot read. */
+function entriesOf(dir) {
+	try {
+		return readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+}
+/** The specification files at a directory's own level. */
+function specificationsIn(dir) {
+	return entriesOf(dir).filter((entry) => entry.isFile() && entry.name.includes(".specification.")).map((entry) => join(dir, entry.name));
+}
+/**
+* Every import SOURCE a file names — static, dynamic, and re-export.
+*
+* The source, not a substring of the file: `../website.specification` carries
+* no extension, so a scan for `.specification.js` read a spec that reaches its
+* runner as a module test parked in a facet tree, and told the author to move
+* the file that specifies the product.
+*/
+const IMPORT_SOURCE = /(?:\bfrom|\bimport|\brequire)\s*\(?\s*['"](?<source>[^'"]+)['"]/gu;
+/** The framework's own entry — a spec may construct the runner itself. */
+const CONSTRUCTS = /\bspecification\.[a-z]+\s*\(/u;
+/**
+* Does this file reach the runner of the facet it sits under?
+*
+* Two shapes answer yes: importing the facet's `*.specification` module
+* (however the import spells the extension), and constructing the runner in
+* the file itself — a refusal spec proves the constructor that must FAIL to
+* start, and has no specification module to import.
+*/
+function reachesRunner(text) {
+	for (const match of text.matchAll(IMPORT_SOURCE)) {
+		const source = match.groups?.source ?? "";
+		if (source === "@jterrazz/test" || source.startsWith("@jterrazz/test/")) return true;
+		if (source.slice(source.lastIndexOf("/") + 1).includes(".specification")) return true;
+	}
+	return CONSTRUCTS.test(text);
+}
+/** Read a file as text, or `null`. */
+function textOf$1(path) {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		return null;
+	}
+}
+/**
+* Every file under `dir`, depth-first.
+*
+* @yields each file path.
+*/
+function* walkFiles(dir) {
+	for (const entry of entriesOf(dir)) {
+		const path = join(dir, entry.name);
+		if (entry.isDirectory()) {
+			if (!SKIPPED$2.has(entry.name)) yield* walkFiles(path);
+			continue;
+		}
+		yield path;
+	}
+}
+/** The facet folders a specs root actually holds. */
+function facetFoldersOf(specsRoot) {
+	return entriesOf(specsRoot).filter((entry) => entry.isDirectory() && FACETS$1.includes(entry.name)).map((entry) => ({
+		facet: entry.name,
+		path: join(specsRoot, entry.name)
+	}));
+}
+/**
+* C20 — a folder named for a facet holds the specification that constructs it.
+*
+* Positive-only: `specs/api/` promises `specification.api()`, and a reader who
+* opens it expecting a runner and finding none has been told something false by
+* the tree itself. Any OTHER first-level name is a repository suite and is
+* judged by C1's declared depth alone — the folder never has to be a facet.
+*/
+function checkFacetFolder(specsRoot) {
+	const violations = [];
+	for (const { facet, path } of facetFoldersOf(specsRoot)) {
+		if (specificationsIn(path).some((file) => (textOf$1(file) ?? "").includes(`specification.${facet}(`))) continue;
+		const rel = relative(specsRoot, path);
+		violations.push({
+			file: rel,
+			line: 1,
+			message: `${rel}:1: \`specs/${facet}/\` is a facet folder with no \`${facet}.specification.ts\` constructing \`specification.${facet}()\` — create it, or rename the folder (C20 — see docs/19-linting.md)`,
+			rule: "c20-facet-folder",
+			severity: "error"
+		});
+	}
+	return violations;
+}
+/**
+* C18 — a spec under a facet folder reaches the runner that folder promises.
+*
+* A test file that imports neither the facet's specification module nor the
+* framework is a MODULE test parked in a facet tree: it runs under the facet's
+* project, pays its budget and its services, and proves something that belongs
+* beside the module it covers.
+*/
+function checkModuleTestUnderFacet(specsRoot) {
+	const violations = [];
+	for (const { facet, path } of facetFoldersOf(specsRoot)) {
+		if (specificationsIn(path).length === 0) continue;
+		for (const file of walkFiles(path)) {
+			if (!isTestFileName(file.slice(file.lastIndexOf("/") + 1))) continue;
+			if (reachesRunner(textOf$1(file) ?? "")) continue;
+			const rel = relative(specsRoot, file);
+			violations.push({
+				file: rel,
+				line: 1,
+				message: `${rel}:1: reaches no runner under the \`${facet}\` facet: import \`{ ${facet} }\` from \`${facet}.specification.js\`, or move a module test beside its module (C18 — see docs/19-linting.md)`,
+				rule: "c18-module-test-under-facet",
+				severity: "error"
+			});
+		}
+	}
+	return violations;
+}
+/**
+* Every directory under `dir`, depth-first.
+*
+* @yields each directory path.
+*/
+function* walkDirectories(dir) {
+	for (const entry of entriesOf(dir)) {
+		if (!entry.isDirectory() || SKIPPED$2.has(entry.name)) continue;
+		const path = join(dir, entry.name);
+		yield path;
+		yield* walkDirectories(path);
+	}
+}
+/** The ground names a leaf can hold. */
+const GROUND = new Set(GROUND_DIRS);
+/**
+* A golden named by a TEMPLATE rather than by a literal — `toMatch(`${x}.json`)`.
+*
+* Such a test reads whatever the table hands it, so the names under the ground
+* appear nowhere in its source. It is a reader of every golden in its leaf,
+* and counting it as none made a shared `_expected/` read as one spec's own.
+*/
+const COMPUTED_GOLDEN = /\.toMatch\(\s*(?:`|[A-Za-z_$])/u;
+/**
+* C21w (warning) — ground a single spec reads belongs to that spec.
+*
+* A leaf holding several specs and one `_expected/` that only one of them
+* names reads as shared material: the next author assumes someone else depends
+* on it and nobody dares touch it. The fix is C1's — the spec that stands on
+* its own ground earns its own domain folder.
+*/
+function checkGroundOwnedByOne(specsRoot) {
+	const violations = [];
+	for (const directory of [specsRoot, ...walkDirectories(specsRoot)]) {
+		const entries = entriesOf(directory);
+		const tests = entries.filter((entry) => entry.isFile() && isNodeTestFileName(entry.name)).map((entry) => join(directory, entry.name));
+		if (tests.length < 2) continue;
+		const grounds = entries.filter((entry) => entry.isDirectory() && GROUND.has(entry.name)).map((entry) => entry.name);
+		for (const ground of grounds) {
+			const names = [...walkFiles(join(directory, ground))].map((file) => file.slice(file.lastIndexOf("/") + 1));
+			if (names.length === 0) continue;
+			const readers = tests.filter((test) => {
+				const text = textOf$1(test) ?? "";
+				return names.some((name) => text.includes(name)) || text.includes(`${ground}/`) || COMPUTED_GOLDEN.test(text);
+			});
+			if (readers.length !== 1) continue;
+			const reader = readers[0] ?? "";
+			const rel = relative(specsRoot, join(directory, ground));
+			violations.push({
+				file: rel,
+				line: 1,
+				message: `${rel}:1: \`${ground}/\` here is read by \`${relative(directory, reader)}\` alone — give it its own domain folder (C21 — see docs/19-linting.md)`,
+				rule: "c21w-ground-owned-by-one",
+				severity: "warn"
+			});
+		}
+	}
+	return violations;
+}
+//#endregion
+//#region src/lint/checker-placement.ts
+/**
+* C12 placement — the suffix says the kind, so the tree has to agree with it.
+*
+* `.spec.ts` is the ASSEMBLED product's word: the app met through HTTP, a
+* binary run, a page served, a module put against real services. It lives under
+* `specs/<facet>/`. `.test.ts` is the UNIT's word: it sits beside the module it
+* covers. A file wearing one word in the other's place is the one shape that
+* makes the fork unreadable — a reader cannot tell what a test is FOR without
+* opening it — so both directions are errors with a mechanical fix, and the
+* checker's `--fix` performs the move.
+*
+* Two clauses, and each runs where it can see what it judges:
+*
+* - a `.spec.ts` with no `specs/` ancestor — the MEMBER pass, which walks a
+*   package and is the only run that sees a file outside a specs tree. The
+*   ancestor is read by the one anchor every other pass reads (`specsAnchor`),
+*   so a member whose own root IS the specs tree — a workspace declaring
+*   `packages: ['specs']` — holds specs, not strays;
+* - a `.test.ts` under `specs/<facet>/` where `<facet>` is one of the six
+*   constructors — the TREE pass. A first-level folder that is NOT a facet
+*   (the package's own `specs/lint/`, a repository's consistency suites) is a
+*   repository suite: it covers a tree rather than the assembled product, so
+*   it keeps `.test.ts` and C1's declared depth is what judges its shape.
+*/
+/** The six facet folders — a first-level name under `specs/` that IS a constructor. */
+const FACETS = /* @__PURE__ */ new Set([
+	"api",
+	"cli",
+	"integration",
+	"jobs",
+	"mobile",
+	"website"
+]);
+/** Directories no placement walk enters. */
+const SKIPPED$1 = /* @__PURE__ */ new Set([
+	".git",
+	"dist",
+	"node_modules"
+]);
+/**
+* Every file under `dir`, depth-first.
+*
+* `stopAtPackages` bounds the walk at the next `package.json`: the member pass
+* judges ONE member, and a nested member is judged by its own run — without the
+* bound, a workspace root reported every finding of every package below it and
+* the same file was named twice.
+*
+* @yields every file path under `dir`, depth-first.
+*/
+function* walk(dir, stopAtPackages = false) {
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const path = join(dir, entry.name);
+		if (entry.isDirectory()) {
+			if (SKIPPED$1.has(entry.name)) continue;
+			if (stopAtPackages && existsSync(join(path, "package.json"))) continue;
+			yield* walk(path, stopAtPackages);
+			continue;
+		}
+		yield path;
+	}
+}
+/** Read a file as text, or the empty string when it cannot be read. */
+function textOf(path) {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		return "";
+	}
+}
+/**
+* Clause one — a `.spec.ts` that sits outside every `specs/` tree.
+*
+* The facet cannot be guessed (only the author knows whether the file meets the
+* product through HTTP or through a binary), so this clause reports and the
+* mover leaves it alone: `to` is `undefined` and the fix line names the shape.
+*/
+function checkSpecOutsideSpecs(memberDir) {
+	const violations = [];
+	for (const path of walk(memberDir, true)) {
+		if (!path.endsWith(".spec.ts")) continue;
+		if (isUnderSpecs(path)) continue;
+		const rel = relative(memberDir, path);
+		violations.push({
+			file: rel,
+			line: 1,
+			message: `${rel}:1: a \`.spec.ts\` lives under \`specs/<facet>/\` — move it there, or rename it \`.test.ts\` beside the module it covers (C12 — see docs/19-linting.md)`,
+			rule: "c12-spec-file-name",
+			severity: "error"
+		});
+	}
+	return violations;
+}
+/**
+* Clause two — a `.test.ts` under a facet folder of a `specs/` tree.
+*
+* The fix is mechanical and the mover performs it: the facet folder already
+* says what the file specifies, so the only thing missing is the word.
+*
+* A file that reaches no runner is left to C18, whose fix is the opposite move
+* — one file, one finding, and `--fix` never renames a module test into a spec.
+*/
+function checkTestUnderFacet(specsRoot) {
+	return movesUnderFacet(specsRoot).map(({ from }) => {
+		const rel = relative(specsRoot, from);
+		return {
+			file: rel,
+			line: 1,
+			message: `${rel}:1: a \`.test.ts\` under \`specs/${rel.split(/[/\\]/u)[0] ?? ""}/\` specifies the assembled product — rename it \`.spec.ts\` (fixable: \`jterrazz-test-check <root> --fix\`) (C12 — see docs/19-linting.md)`,
+			rule: "c12-spec-file-name",
+			severity: "error"
+		};
+	});
+}
+/** The renames clause two asks for, as absolute from/to pairs. */
+function movesUnderFacet(specsRoot) {
+	const moves = [];
+	for (const path of walk(specsRoot)) {
+		if (!path.endsWith(".test.ts")) continue;
+		const parts = relative(specsRoot, path).split(/[/\\]/u);
+		const facet = parts[0];
+		if (parts.length < 2 || facet === void 0 || !FACETS.has(facet)) continue;
+		if (parts.some((part) => part.startsWith("_"))) continue;
+		if (!reachesRunner(textOf(path))) continue;
+		moves.push({
+			fix: "rename to `.spec.ts`",
+			from: path,
+			to: `${path.slice(0, -8)}.spec.ts`
+		});
+	}
+	return moves;
+}
+//#endregion
+//#region src/lint/checker-member.ts
+/**
+* The MEMBER pass — what a workspace member owes, read from the member itself
+* rather than from a spec tree.
+*
+* The three findings here answer questions no file under `specs/` can: does
+* this member have a vitest config at all, does its config give every test it
+* collects a drawing of a browser, and does it declare a dependency the
+* framework already carries. A member with no `specs/` root is still judged —
+* that is the whole point, since the first of the three is about a member that
+* has tests and no configuration for them.
+*
+* The pass is the toolchain's door: `jterrazz-test-check --member <dir>` runs
+* it for one member, and a path-less `--format json` run at the project root
+* runs it for every member the root manifest declares.
+*/
+/** The two simulated DOMs — the same pair the statique E5b refuses. */
+const SIMULATED_DOM = /\benvironment\s*:\s*['"](?<dom>happy-dom|jsdom)['"]/u;
+/**
+* Dependencies `@jterrazz/test` carries. A member declaring one of these
+* duplicates a transitive it already resolves. Optional peers are not here:
+* `playwright`, `vite`, `react`, `better-sqlite3` and their kin are declared
+* BY the consumer on purpose.
+*/
+const CARRIED = /* @__PURE__ */ new Set(["msw", "vitest-mock-extended"]);
+/**
+* Carried, but only where it can only be the test seam's. `yaml` is a product
+* library as much as a fixture reader: a member that parses YAML at RUNTIME
+* declares it rightly, and a rule that read `dependencies` here would be
+* telling a product to drop a library the framework never ships to it. So the
+* finding is limited to the one declaration that can only mean the seam.
+*/
+const CARRIED_IN_DEV = /* @__PURE__ */ new Set(["yaml"]);
+/**
+* The framework itself. It DECLARES what every other member inherits, so the
+* one manifest F8 must never read is its own — a rule that fired on the
+* package carrying the dependency would be asking it to remove the thing it
+* exists to provide.
+*/
+const FRAMEWORK = "@jterrazz/test";
+const RETIRED = /* @__PURE__ */ new Set([
+	"@playwright/test",
+	"happy-dom",
+	"jsdom",
+	"mockdate"
+]);
+const RETIRED_SCOPES = ["@testing-library/"];
+/**
+* The one retired seam a member may still declare, and what makes it allowed.
+*
+* React Native renders under jest until the react-native-web answer lands, and
+* where jest is the sanctioned runner `@testing-library/react-native` is the
+* only vocabulary there is: the rule would be asking for a facet that does not
+* reach that runtime yet. The allowance is read from the member itself — a
+* declared `jest`, a `jest` field, or a `test` script that calls it — so it
+* lapses the day the member stops running jest.
+*/
+const JEST_ONLY_SEAM = "@testing-library/react-native";
+/** Does this member run jest? */
+function runsJest(manifest) {
+	const declares = (name) => name in (manifest.dependencies ?? {}) || name in (manifest.devDependencies ?? {});
+	return declares("jest") || declares("jest-expo") || manifest.jest !== void 0 || /(?:^|[\s/])jest(?:\s|$)/u.test(manifest.scripts?.test ?? "");
+}
+/** Where a member states what it collects, whatever extension it writes it in. */
+const CONFIG_NAMES$1 = [
+	"vitest.config.ts",
+	"vitest.config.mts",
+	"vitest.config.cts",
+	"vitest.config.js",
+	"vitest.config.mjs",
+	"vitest.config.cjs"
+];
+/** Directories the member walk never enters. */
+const SKIPPED = /* @__PURE__ */ new Set([
+	".git",
+	".artifacts",
+	"coverage",
+	"dist",
+	"node_modules"
+]);
+/** A member's manifest, or null when it has none (it is then not a member). */
+function readManifest(dir) {
+	const path = join(dir, "package.json");
+	if (!existsSync(path)) return null;
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+/** The member's vitest config, by path, or null. */
+function configOf(dir) {
+	for (const name of CONFIG_NAMES$1) {
+		const path = join(dir, name);
+		if (existsSync(path)) return path;
+	}
+	return null;
+}
+/**
+* Does this member hold a test file it OWNS?
+*
+* A directory carrying its own `package.json` is another package's tree — a
+* workspace member, a vendored clone — and its tests are its own to configure.
+* A root that only delegates would otherwise be told to write a config for
+* files it never collects, which is the finding read backwards.
+*/
+function holdsTests(dir) {
+	const stack = [dir];
+	let first = true;
+	while (stack.length > 0) {
+		const current = stack.pop();
+		if (current === void 0) break;
+		if (!first && existsSync(join(current, "package.json"))) continue;
+		first = false;
+		let entries;
+		try {
+			entries = readdirSync(current, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			if (entry.isDirectory()) {
+				if (!SKIPPED.has(entry.name) && !entry.name.startsWith(".")) stack.push(join(current, entry.name));
+				continue;
+			}
+			if (isTestFileName(entry.name)) return true;
+		}
+	}
+	return false;
+}
+/**
+* A `test` script that only hands the work to the members below it. It is not
+* evidence that THIS package runs vitest — `npm run test --workspaces`,
+* `pnpm -r test` and `turbo run test` all read as "ask the members".
+*/
+const DELEGATING_TEST = /--workspaces|(?:^|\s)-r(?:\s|$)|--recursive|turbo\s+run|nx\s+run-many|lerna\s+run/u;
+/** Every seam name this member declares that it should not, and why it should not. */
+function declaredSeams(manifest) {
+	if (manifest.name === FRAMEWORK) return [];
+	const jestRuns = runsJest(manifest);
+	const isRetired = (name) => {
+		if (name === JEST_ONLY_SEAM && jestRuns) return false;
+		return RETIRED.has(name) || RETIRED_SCOPES.some((scope) => name.startsWith(scope));
+	};
+	return [.../* @__PURE__ */ new Set([...Object.keys(manifest.dependencies ?? {}).filter((name) => CARRIED.has(name) || isRetired(name)), ...Object.keys(manifest.devDependencies ?? {}).filter((name) => CARRIED.has(name) || CARRIED_IN_DEV.has(name) || isRetired(name))])].toSorted().map((name) => ({
+		kind: isRetired(name) ? "retired" : "carried",
+		name
+	}));
+}
+/** The line a manifest key is written on — a finding points at the declaration, not at `{`. */
+function lineOfKey(dir, key) {
+	try {
+		const found = readFileSync(join(dir, "package.json"), "utf8").split("\n").findIndex((line) => line.includes(`"${key}"`));
+		return found === -1 ? 1 : found + 1;
+	} catch {
+		return 1;
+	}
+}
+/**
+* Run E3, E5b and F8 over ONE member. `memberDir` is absolute; `rootDir`
+* anchors the paths the findings report, so a member's finding reads the same
+* whether the pass ran over it alone or over the whole workspace.
+*/
+/** E3 — a member with tests of its own states how they run. */
+function configPresent(manifest, memberDir, label, subject) {
+	const testScript = manifest.scripts?.test;
+	if (!(typeof testScript === "string" && !DELEGATING_TEST.test(testScript) || holdsTests(memberDir))) return [];
+	return [{
+		file: join(label, "package.json"),
+		line: 1,
+		message: `${subject}: no vitest.config.ts — vitest's 5 s budget and an unexcluded \`_fixtures/\` are running your tests; write \`export default defineSpecConfig()\` (E3 — see docs/19-linting.md#e3-config-present)`,
+		rule: "e3",
+		severity: "error"
+	}];
+}
+/** E5b — a config that gives every file it collects a drawing of a browser. */
+function simulatedDom(config, rootDir) {
+	const text = readFileSync(config, "utf8");
+	const found = SIMULATED_DOM.exec(text);
+	if (found?.groups?.dom === void 0) return [];
+	const relConfig = relative(rootDir, config);
+	return [{
+		file: relConfig,
+		line: text.slice(0, found.index).split("\n").length,
+		message: `${relConfig}: \`environment: '${found.groups.dom}'\` gives every file of this project a drawing of a browser — a rendered thing is a \`.test.tsx\` beside its component, collected by \`component()\` (E5b — see docs/19-linting.md#e5b-no-simulated-dom-config-member)`,
+		rule: "e5b",
+		severity: "error"
+	}];
+}
+/**
+* F8 — a dependency the framework already carries, or a seam it replaced.
+*
+* The two are not the same sentence: removing a transitive changes nothing a
+* test can see, while dropping a retired seam means writing its facet.
+*/
+function seamDependencies(manifest, memberDir, label, subject) {
+	return declaredSeams(manifest).map((seam) => ({
+		file: join(label, "package.json"),
+		line: lineOfKey(memberDir, seam.name),
+		message: seam.kind === "carried" ? `${subject}: \`${seam.name}\` is a transitive of \`@jterrazz/test\` — remove the declaration (F8 — see docs/19-linting.md#f8-no-seam-dependency)` : `${subject}: \`${seam.name}\` is a seam \`@jterrazz/test\` replaced — the facet is \`component()\`, \`website()\`, \`clock\` or \`intercept()\`; remove the declaration (F8 — see docs/19-linting.md#f8-no-seam-dependency)`,
+		rule: "f8",
+		severity: "error"
+	}));
+}
+/**
+* Re-anchor a member-relative finding on the root the run reports against, so
+* one member's path reads the same alone as inside a whole-workspace run.
+*/
+function anchoredToRoot(violations, label) {
+	if (label === ".") return violations;
+	const anchored = [];
+	for (const violation of violations) anchored.push({
+		...violation,
+		file: join(label, violation.file)
+	});
+	return anchored;
+}
+/**
+* Run E3, E5b and F8 over ONE member. `memberDir` is absolute; `rootDir`
+* anchors the paths the findings report, so a member's finding reads the same
+* whether the pass ran over it alone or over the whole workspace.
+*/
+function checkMember(memberDir, rootDir) {
+	const manifest = readManifest(memberDir);
+	if (manifest === null) return [];
+	const label = relative(rootDir, memberDir) || ".";
+	const subject = label === "." ? manifest.name ?? basename(memberDir) : label;
+	const config = configOf(memberDir);
+	return [
+		...config === null ? configPresent(manifest, memberDir, label, subject) : [],
+		...config === null ? [] : simulatedDom(config, rootDir),
+		...seamDependencies(manifest, memberDir, label, subject),
+		...anchoredToRoot(checkSpecOutsideSpecs(memberDir), label)
+	];
+}
+/** The glob-ish workspace patterns a root manifest declares. */
+function workspacePatterns(manifest) {
+	const { workspaces } = manifest;
+	if (Array.isArray(workspaces)) return workspaces;
+	return workspaces?.packages ?? [];
+}
+/**
+* A glob over path SEGMENTS — `*` stops at a separator, `**` does not. The
+* same translation `@jterrazz/typescript`'s `lib/workspace-members.js` makes,
+* because the two lists have to be the same list: a member the toolchain runs
+* `--member` over and the path-less run never discovers is a finding the
+* ratchet can neither record nor clear.
+*/
+function toPattern(glob) {
+	const escaped = glob.replaceAll(/[.+^${}()|[\]\\]/gu, String.raw`\$&`).replaceAll("**", " ").replaceAll("*", "[^/]*").replaceAll(" ", ".*");
+	return new RegExp(`^${escaped}$`, "u");
+}
+/** How deep a member may sit below the root — the toolchain's bound, to the segment. */
+const MEMBER_DEPTH = 6;
+/**
+* Every workspace member declared by the root manifest, plus the root itself —
+* a single-package repository IS its own member, and the pass has to reach it.
+*/
+function discoverMembers(rootDir) {
+	const manifest = readManifest(rootDir);
+	if (manifest === null) return [];
+	const patterns = workspacePatterns(manifest).filter((glob) => typeof glob === "string" && !glob.startsWith("!")).map((glob) => toPattern(glob.replace(/\/+$/u, "")));
+	const members = /* @__PURE__ */ new Set([rootDir]);
+	if (patterns.length === 0) return [...members];
+	const walk = (dir, depth) => {
+		if (depth > MEMBER_DEPTH) return;
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (!entry.isDirectory() || entry.name.startsWith(".") || SKIPPED.has(entry.name)) continue;
+			const child = join(dir, entry.name);
+			const path = relative(rootDir, child).split(sep).join("/");
+			if (patterns.some((pattern) => pattern.test(path)) && readManifest(child) !== null) {
+				members.add(child);
+				continue;
+			}
+			walk(child, depth + 1);
+		}
+	};
+	walk(rootDir, 0);
+	return [...members];
+}
+/** Paths git is told to ignore — the toolchain skips them, so the two lists agree. */
+function ignoredPaths(rootDir, candidates) {
+	if (candidates.length === 0) return /* @__PURE__ */ new Set();
+	try {
+		const answer = spawnSync("git", ["check-ignore", "--stdin"], {
+			cwd: rootDir,
+			encoding: "utf8",
+			input: `${candidates.join("\n")}\n`
+		});
+		if (answer.error !== void 0 || answer.stdout === "") return /* @__PURE__ */ new Set();
+		return new Set(answer.stdout.split("\n").filter(Boolean));
+	} catch {
+		return /* @__PURE__ */ new Set();
+	}
+}
+/** How deep below a member a nested `specs/` may sit before the walk gives up. */
+const SPECS_DEPTH = 6;
+/**
+* Every `specs/` root the tree passes have to walk: the project's own, and
+* each member's — including a member that NESTS its facet tree (`web/specs`).
+* Stated here rather than guessed by the walk, so a path-less run reports
+* exactly what a per-root run would.
+*
+* A `specs/` tree is never descended into (the fixtures under it are not spec
+* roots), and neither is another package's tree: a directory carrying its own
+* `package.json` belongs to whichever member declares it. A member DIRECTORY
+* named `specs` is a root of its own — the tree can be the member.
+*/
+function discoverSpecRoots(rootDir) {
+	const roots = /* @__PURE__ */ new Set();
+	for (const member of discoverMembers(rootDir)) {
+		if (basename(member) === "specs") roots.add(member);
+		const walk = (dir, depth) => {
+			if (depth > SPECS_DEPTH) return;
+			let entries;
+			try {
+				entries = readdirSync(dir, { withFileTypes: true });
+			} catch {
+				return;
+			}
+			for (const entry of entries) {
+				if (!entry.isDirectory() || entry.name.startsWith(".") || SKIPPED.has(entry.name)) continue;
+				const child = join(dir, entry.name);
+				if (entry.name === "specs") {
+					roots.add(child);
+					continue;
+				}
+				if (readManifest(child) !== null) continue;
+				walk(child, depth + 1);
+			}
+		};
+		walk(member, 0);
+	}
+	const found = [...roots].toSorted();
+	const ignored = ignoredPaths(rootDir, found.map((path) => relative(rootDir, path)));
+	return found.filter((path) => !ignored.has(relative(rootDir, path)));
+}
+/** Run the member pass over every member the root declares. */
+function checkMembers(rootDir) {
+	return discoverMembers(rootDir).flatMap((member) => checkMember(member, rootDir));
+}
+//#endregion
+//#region src/lint/rule-code.ts
+/**
+* The convention code a checker pass id carries: `d4b-spec-shape` → `d4b`.
+*
+* It lives alone because BOTH sides need it — the passes that build a finding
+* and the entry that publishes one as `jterrazz-check(<code>)` — and a copy in
+* either would be a second answer to what a finding is called.
+*/
+function codeOf(passId) {
+	return passId.split("-")[0] ?? passId;
+}
 //#endregion
 //#region src/lint/checker-spec.ts
 function finding(rule, line, message, severity = "error") {
@@ -948,27 +1816,99 @@ const VOLATILE = [
 	}
 ];
 /**
+* The volatile literal on this line, if it carries one — the reader BOTH halves
+* of d5's reach use, so a document's expected stream and a file under
+* `_expected/` are judged by one list.
+*
+* A `{{token}}` is removed before the test: the token IS the answer the rule
+* asks for, and a path written after one is the token's tail, not a literal.
+*/
+/**
+* The whole word the match sits inside — the string the pinned-value carve-out
+* looks up.
+*
+* A pattern matches the SHAPE that makes a value volatile (`/tmp/`, a loopback
+* origin) and not the value itself, so asking whether the document pinned
+* `/tmp/` would exempt every temp path once any of them was named. The word the
+* match belongs to is what the document either states or does not.
+*/
+function wordAround(text, index) {
+	let start = index;
+	let end = index;
+	while (start > 0 && !/[\s"'(),;=]/u.test(text[start - 1] ?? "")) start -= 1;
+	while (end < text.length && !/[\s"'(),;=]/u.test(text[end] ?? "")) end += 1;
+	return text.slice(start, end);
+}
+function volatileLiteralIn(line) {
+	const bare = line.replaceAll(/\{\{[^}]*\}\}/gu, " ");
+	for (const { pattern, token } of VOLATILE) {
+		const found = pattern.exec(bare);
+		if (found !== null) {
+			const at = found.index + found[0].length - found[0].trimStart().length;
+			return {
+				found: found[0].trim(),
+				token,
+				word: wordAround(bare, at)
+			};
+		}
+	}
+}
+/**
 * A stream that pins a loopback port, a temp directory or somebody's home is a
 * golden that passed once, on one machine: the port was free that second, the
 * temp path belonged to that run. It is the exact shape of a value the update
 * writer would have tokenised, which is why finding one means a token was
 * overwritten by hand.
+*
+* Unless the document FIXED it — the same carve-out d5w rests on, for the same
+* reason: a path the command was handed, or one a `fixture:` ships, is a value
+* the document states rather than one the run minted.
 */
-function checkVolatileLiterals(document) {
+function checkVolatileLiterals(document, dir) {
 	const findings = [];
-	for (const stream of assertedStreams(document)) for (const [index, text] of stream.text.split("\n").entries()) for (const { pattern, token } of VOLATILE) {
-		const found = pattern.exec(text);
-		if (found === null) continue;
-		findings.push(finding("d5-spec-volatile-literal", stream.line + index, `"${found[0].trim()}" is a value the next run will not reproduce — write ${token}`));
-		break;
+	let fixed = null;
+	for (const stream of assertedStreams(document)) for (const [index, text] of stream.text.split("\n").entries()) {
+		const volatileLiteral = volatileLiteralIn(text);
+		if (volatileLiteral === void 0) continue;
+		fixed ??= fixedData(document, dir);
+		if (fixed.includes(volatileLiteral.word)) continue;
+		findings.push(finding("d5-spec-volatile-literal", stream.line + index, `"${volatileLiteral.found}" is a value the next run will not reproduce — write ${volatileLiteral.token}`));
 	}
 	return findings;
 }
 const ISO8601 = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})/u;
 const UUID = /[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/u;
-/** Everything the document itself FIXED: what it feeds in, and what its fixtures hold. */
+/**
+* Everything the document itself FIXED — what it feeds in, what it names, and
+* what its fixtures hold.
+*
+* The first three sources are the document's own words: a literal that appears
+* in a command's arguments or in an `env:`/`serve:` value is one the DOCUMENT
+* put there, not one a run minted — a reader sees it being pinned two lines
+* above the stream that asserts it.
+*
+* The last is the ground beside it. A document's sibling `_fixtures/` is its
+* material whether or not a `fixture:` line names the exact file: the tree is
+* there to be read by the run, and a value it holds is one the repository
+* committed.
+*/
 function fixedData(document, dir) {
-	const parts = document.runs.map((run) => run.stdin ?? "");
+	const parts = document.runs.flatMap((run) => [run.stdin ?? "", run.command]);
+	for (const token of document.env) parts.push(token.kind === "pair" ? `${token.key}=${token.value}` : token.name);
+	for (const entry of document.serve) parts.push(entry.name, ...Object.values(entry.env));
+	const visit = (path) => {
+		let stat;
+		try {
+			stat = statSync(path);
+		} catch {
+			return;
+		}
+		if (!stat.isDirectory()) {
+			parts.push(readText(path));
+			return;
+		}
+		for (const entry of readdirSync(path)) visit(join(path, entry));
+	};
 	for (const fixture of document.fixtures) {
 		let source;
 		try {
@@ -976,21 +1916,9 @@ function fixedData(document, dir) {
 		} catch {
 			continue;
 		}
-		const visit = (path) => {
-			let stat;
-			try {
-				stat = statSync(path);
-			} catch {
-				return;
-			}
-			if (!stat.isDirectory()) {
-				parts.push(readText(path));
-				return;
-			}
-			for (const entry of readdirSync(path)) visit(join(path, entry));
-		};
 		visit(source);
 	}
+	visit(join(dir, GROUND_FIXTURES));
 	return parts.join("\n");
 }
 /**
@@ -1154,7 +2082,7 @@ function checkSpecConventions(text, rel, path) {
 		...checkBlockScalars(file, (scalar) => lineAt(scalar)),
 		...checkFileName(rel),
 		...checkDescription(file.document),
-		...checkVolatileLiterals(file.document),
+		...checkVolatileLiterals(file.document, dir),
 		...checkPinnedValues(file.document, dir),
 		...checkEmptyAssertions(file.document),
 		...checkSilentRefusals(file.document),
@@ -1162,7 +2090,8 @@ function checkSpecConventions(text, rel, path) {
 	].map(({ line, message, rule, severity }) => ({
 		file: rel,
 		line,
-		message: `${rel}:${line}: ${message} (${rule} — see docs/13-linting.md)`,
+		message: `${rel}:${line}: ${message} (${rule} — see docs/19-linting.md)`,
+		rule: codeOf(rule),
 		severity
 	}));
 }
@@ -1193,7 +2122,8 @@ function checkSpecDescriptionsUnique(rootDir) {
 		violations.push({
 			file: rel,
 			line: document.descriptionLine,
-			message: `${rel}:${document.descriptionLine}: "${document.description}" is already the description of ${first} — two documents of one directory cannot share a title (j4-spec-description-unique — see docs/13-linting.md)`,
+			message: `${rel}:${document.descriptionLine}: "${document.description}" is already the description of ${first} — two documents of one directory cannot share a title (j4-spec-description-unique — see docs/19-linting.md)`,
+			rule: "j4",
 			severity: "error"
 		});
 	}
@@ -1268,8 +2198,30 @@ const BRACE_BLOCK = /\{\{(?<inner>[^{}]*)\}\}/gu;
 /** The leading identifier of a brace block, for malformed-ref classification. */
 const LEADING_WORD = /^(?<kind>[A-Za-z][A-Za-z0-9]*)/u;
 const KNOWN = new Set(TOKEN_KINDS);
-/** Directories whose files carry the token grammar (D4). */
-const FIXTURE_DIRS = /* @__PURE__ */ new Set([GROUND_EXPECTED, GROUND_REQUESTS]);
+/** Directories whose files the walk judges, each by its own law. */
+const FIXTURE_DIRS = /* @__PURE__ */ new Set([
+	GROUND_EXPECTED,
+	GROUND_REQUESTS,
+	GROUND_SEEDS
+]);
+/**
+* The ways a seed asks the machine what time it is.
+*
+* Three spellings and nothing else, because each is decidable on sight: the
+* quoted `'now'` argument SQLite's date functions take (`datetime('now')`,
+* `strftime('%s', 'now')`, `julianday('now')`, `date('now', '-1 day')`), the
+* SQL keyword every engine spells the same, and Postgres/MySQL's `NOW()`.
+* The bare word `now` is not one of them — it is a column name as often as a
+* clock read, and a rule that guessed would be refused rather than obeyed.
+*/
+const CLOCK_READ = /'now'|\bCURRENT_(?:TIMESTAMP|DATE|TIME)\b|\bNOW\s*\(\s*\)/iu;
+/** A line comment, and a block comment — a `-- datetime('now')` is prose, not state. */
+const SQL_LINE_COMMENT = /--[^\n]*/gu;
+const SQL_BLOCK_COMMENT = /\/\*[\s\S]*?\*\//gu;
+/** The file with its comments blanked out, line for line so a finding still points. */
+function withoutComments(text) {
+	return text.replaceAll(SQL_BLOCK_COMMENT, (block) => block.replaceAll(/[^\n]/gu, " ")).replaceAll(SQL_LINE_COMMENT, "");
+}
 /**
 * Directories the walk never enters. `_fixtures/` trees (the shared pool and
 * the leaf-local ones) are verbatim `.fixture()` cwd material — file STATE, not
@@ -1281,6 +2233,56 @@ const SKIPPED_DIRS = /* @__PURE__ */ new Set([
 	GROUND_FIXTURES,
 	"node_modules"
 ]);
+/** The four ground names — what a document may never sit under (C16). */
+const GROUND_NAMES = new Set(GROUND_DIRS);
+/**
+* The passes a run over a `specs/` TREE puts on it.
+*
+* The three `d4*`/`d10w` ids are sub-scans of {@link checkConventionFiles}; the
+* rest are the cross-file and facet passes. The CLI prints this list when a run
+* is clean, so what the reader is told ran is the registry itself.
+*/
+const TREE_PASS_IDS = [
+	"a7-database-property",
+	"b5-await-using-inference",
+	"c12-spec-file-name",
+	"c14-pool-fixture-shared",
+	"c15-local-fixture-reach",
+	"c16-document-outside-ground",
+	"c18-module-test-under-facet",
+	"c20-facet-folder",
+	"c21w-ground-owned-by-one",
+	"c23-seed-no-clock-read",
+	"c8-spec-registered-name",
+	"c9-dead-fixtures",
+	"d10w-tokens-in-requests",
+	"d11w-spec-silent-refusal",
+	"d4-malformed-ref",
+	"d4-unknown-token",
+	"d4b-http-first-line",
+	"d4b-spec-block-scalar",
+	"d4b-spec-key-order",
+	"d4b-spec-shape",
+	"d5-spec-volatile-literal",
+	"d5w-spec-pinned-value",
+	"j3w-spec-empty-assertion",
+	"j4-spec-description-unique",
+	"j9-checker-suppression-reason",
+	"j5-spec-description"
+];
+/**
+* The passes a run over one workspace MEMBER puts on it — what no file under
+* `specs/` can answer: whether the member states how its tests run, whether its
+* config draws a browser, what it declares, and whether a `.spec.ts` of its own
+* ever reached a specs tree.
+*/
+const MEMBER_PASS_IDS = [
+	"c12-spec-file-name",
+	"e3-config-present",
+	"e5b-no-simulated-dom-config-member",
+	"f8-no-seam-dependency"
+];
+[.../* @__PURE__ */ new Set([...TREE_PASS_IDS, ...MEMBER_PASS_IDS])];
 /**
 * Scan one fixture text for tokens outside the grammar: unknown kinds
 * (`{{userid}}`) and malformed captures of a known kind (`{{iso8601#}}`,
@@ -1355,7 +2357,8 @@ function checkSpecFile(text, rel) {
 		return [{
 			file: rel,
 			line: error.line,
-			message: `${error.message} (D4b — see docs/13-linting.md)`,
+			message: `${error.message} (D4b — see docs/19-linting.md)`,
+			rule: "d4b",
 			severity: "error"
 		}];
 	}
@@ -1366,6 +2369,7 @@ function checkSpecFile(text, rel) {
 			file: rel,
 			line: at,
 			message: `${rel}:${at}: unknown token ${token} — the D4 vocabulary is frozen (known: ${[...TOKEN_KINDS].join(", ")})`,
+			rule: "d4",
 			severity: "error",
 			token
 		});
@@ -1373,6 +2377,37 @@ function checkSpecFile(text, rel) {
 	return violations;
 }
 /**
+* C23 — a seed states absolute timestamps; it never reads the clock.
+*
+* A `_seeds/*.sql` that writes `datetime('now')` makes the row's date the date
+* the suite happened to run, so a case about "published yesterday" proves
+* something different every day and nothing at all across midnight. Worse under
+* SQLite, where `datetime('now')` writes a space-separated text while an ORM
+* writes ISO `T`: the two sort against each other, and the ordering breaks on
+* the days the values straddle a calendar boundary.
+*
+* The chain already owns the answer — `.clock()` pins what the code under test
+* reads — so the seed has nothing to ask the machine for.
+*/
+function checkSeedClockReads(path, rel, name) {
+	if (!name.endsWith(".sql")) return [];
+	const text = decodeText(path);
+	if (text === null) return [];
+	const violations = [];
+	for (const [index, line] of withoutComments(text).split("\n").entries()) {
+		const found = CLOCK_READ.exec(line);
+		if (found === null) continue;
+		violations.push({
+			file: rel,
+			line: index + 1,
+			message: `${rel}:${index + 1}: \`${found[0]}\` reads the clock — a seed states the instant the case is about, and the chain pins the run's with \`.clock()\` (C23 — see docs/19-linting.md)`,
+			rule: "c23-seed-no-clock-read",
+			severity: "error"
+		});
+	}
+	return violations;
+}
+/**
 * Walk `rootDir` and check every fixture file. Paths in the result are relative
 * to `rootDir`. Errors fail the checker; warnings are advisory.
 */
@@ -1395,12 +2430,23 @@ function checkConventionFiles(rootDir) {
 				continue;
 			}
 			if (entry.name.endsWith(".spec.yaml")) {
+				if (rel.split(/[/\\]/u).some((segment) => GROUND_NAMES.has(segment))) violations.push({
+					file: rel,
+					line: 1,
+					message: `${rel}:1: a \`${SPEC_EXTENSION}\` document is a SPEC, not ground — move it beside the test that runs it (C16 — see docs/19-linting.md)`,
+					rule: "c16-document-outside-ground",
+					severity: "error"
+				});
 				const text = decodeText(path);
 				if (text !== null) violations.push(...checkSpecFile(text, rel), ...checkSpecConventions(text, rel, path));
 				continue;
 			}
 			if (inside === null) continue;
 			const depth1 = dir.endsWith(`/${inside}`) || dir.endsWith(`\\${inside}`);
+			if (inside === "_seeds") {
+				violations.push(...checkSeedClockReads(path, rel, entry.name));
+				continue;
+			}
 			if (inside === "_requests") {
 				if (!entry.name.endsWith(".http")) continue;
 				const text = decodeText(path);
@@ -1408,13 +2454,15 @@ function checkConventionFiles(rootDir) {
 				if (depth1 && !REQUEST_LINE.test(firstLine(text))) violations.push({
 					file: rel,
 					line: 1,
-					message: `${rel}:1: a _requests/*.http file must start with a request line "METHOD /path" (D4b — see docs/13-linting.md)`,
+					message: `${rel}:1: a _requests/*.http file must start with a request line "METHOD /path" (D4b — see docs/19-linting.md)`,
+					rule: "d4b",
 					severity: "error"
 				});
 				for (const { line, token } of findKnownTokens(text)) violations.push({
 					file: rel,
 					line,
-					message: `${rel}:${line}: token ${token} in a _requests/ file — requests are inputs, never matched; tokens are not validated here (D10 — see docs/13-linting.md)`,
+					message: `${rel}:${line}: token ${token} in a _requests/ file — requests are inputs, never matched; tokens are not validated here (D10 — see docs/19-linting.md)`,
+					rule: "d10w",
 					severity: "warn",
 					token
 				});
@@ -1425,16 +2473,29 @@ function checkConventionFiles(rootDir) {
 			if (depth1 && entry.name.endsWith(".http") && !STATUS_LINE.test(firstLine(text))) violations.push({
 				file: rel,
 				line: 1,
-				message: `${rel}:1: an _expected/*.http file must start with a status line "HTTP/1.1 <status>" (D4b — see docs/13-linting.md)`,
+				message: `${rel}:1: an _expected/*.http file must start with a status line "HTTP/1.1 <status>" (D4b — see docs/19-linting.md)`,
+				rule: "d4b",
 				severity: "error"
 			});
 			for (const { line, token } of findUnknownTokens(text)) violations.push({
 				file: rel,
 				line,
 				message: `${rel}:${line}: unknown token ${token} — the D4 vocabulary is frozen (known: ${[...TOKEN_KINDS].join(", ")})`,
+				rule: "d4",
 				severity: "error",
 				token
 			});
+			for (const [index, line] of text.split("\n").entries()) {
+				const volatileLiteral = volatileLiteralIn(line);
+				if (volatileLiteral === void 0) continue;
+				violations.push({
+					file: rel,
+					line: index + 1,
+					message: `${rel}:${index + 1}: "${volatileLiteral.found}" is a value the next run will not reproduce — write ${volatileLiteral.token} (D5 — see docs/19-linting.md)`,
+					rule: "d5-spec-volatile-literal",
+					severity: "error"
+				});
+			}
 		}
 	};
 	visit(rootDir, null);
@@ -1448,6 +2509,11 @@ function checkConventionFiles(rootDir) {
 */
 function runAllChecks(rootDir) {
 	return [
+		...checkTestUnderFacet(rootDir),
+		...checkFacetFolder(rootDir),
+		...checkModuleTestUnderFacet(rootDir),
+		...checkGroundOwnedByOne(rootDir),
+		...checkSuppressionReason(rootDir),
 		...checkConventionFiles(rootDir),
 		...checkSpecDescriptionsUnique(rootDir),
 		...checkDeadFixtures(rootDir),
@@ -1466,38 +2532,204 @@ function formatViolations(violations) {
 /**
 * CLI entry for the conventions checker (bundled as `dist/checker.js`).
 *
-*     node dist/checker.js [rootDir] [--fix]     # default root: cwd
+*     node dist/checker.js [rootDir] [--fix]          # a specs tree
+*     node dist/checker.js --format json              # every root, every member
+*     node dist/checker.js --member <dir>             # one workspace member
 *
-* Runs every checker pass — the token/HTTP grammar (D4 / D4b / D10), the
+* Three runs, one reporter. With a PATH it walks that tree and runs every
+* checker pass over it — the token/HTTP grammar (D4 / D4b / D10), the
 * `<case>.spec.yaml` document conventions, and the cross-file passes (C9 dead
 * fixtures, C14/C15 fixture placement, B5 await-using inference, A7 database
-* property). Exit 1 on any ERROR-level violation; warnings (D10, a downgraded C9
-* feature) are printed but do not fail the run.
+* property). With `--member <dir>` it runs the member pass (E3 config-present,
+* E5b no simulated DOM in a config, F8 no seam dependency) over one workspace
+* member, whether or not that member has a `specs/` root.
+*
+* With NO path it runs both over the whole project: every `specs/` root it
+* discovers from the root manifest's workspaces, and every member. That is the
+* run `@jterrazz/typescript`'s ratchet rests on, so the contract is exactly
+* "a path-less run reports what the per-root and per-member runs report".
+*
+* `--format json` prints `[{ code, file, line, severity, message }]` on stdout
+* and nothing else, where `code` is `jterrazz-check(<id>)` — the namespace the
+* ratchet records under. Exit 1 on any ERROR-level violation either way;
+* warnings are reported but never fail the run.
 *
 * `--fix` applies the rewritable passes — the two document ones (key order and
-* block scalars) and C14, which MOVES a single-reader pool fixture beside its
-* leaf and rewrites the literals that named it — then checks what is left, so a
-* run that fixes everything exits 0. The move is a plain rename: the checker
-* never runs git, and the author stages what the working tree now shows.
-*/
-const fix = process.argv.includes("--fix");
-const root = resolve(process.argv.slice(2).find((arg) => !arg.startsWith("--")) ?? ".");
-if (!existsSync(root) || !statSync(root).isDirectory()) {
-	console.error(`conventions checker: no such directory: ${root}`);
-	process.exit(1);
-}
-if (fix) {
+* block scalars), C14, which MOVES a single-reader pool fixture beside its leaf
+* and rewrites the literals that named it, and C12, which RENAMES a `.test.ts`
+* under a facet folder to `.spec.ts` — then checks what is left, so a run that
+* fixes everything exits 0. With no path it applies them to every `specs/` root
+* it discovers: `--fix` means the same thing whichever run the operator typed.
+*
+* After a C12 rename it NAMES every include glob of the owning member that
+* still says `.test.ts`. A glob the rename left behind collects nothing, the
+* run stays green with fewer files, and nothing else in the toolchain would
+* have said a word.
+*
+* C12's rename goes through `git mv` where the tree is a git working tree, so
+* the history follows the file across a migration that touches hundreds of
+* them; outside one it falls back to a plain rename. C14's move stays a plain
+* rename and the author stages what the working tree now shows.
+*/
+const argv = process.argv.slice(2);
+const fix = argv.includes("--fix");
+const json = valueOf("--format") === "json";
+const member = valueOf("--member");
+const positional = argv.find((argument, index) => {
+	if (argument.startsWith("--")) return false;
+	const previous = argv[index - 1];
+	return previous !== "--format" && previous !== "--member";
+});
+/** The value of `--flag value` or `--flag=value`, or undefined. */
+function valueOf(flag) {
+	const inline = argv.find((argument) => argument.startsWith(`${flag}=`));
+	if (inline !== void 0) return inline.slice(flag.length + 1);
+	const index = argv.indexOf(flag);
+	return index === -1 ? void 0 : argv[index + 1];
+}
+/**
+* What a run names when it is clean — the pass REGISTRY, never a sentence
+* written beside it.
+*
+* The hand-written list stopped at the cross-file passes of 15.x while the
+* channel grew four tree passes and a suppression gate, so the summary
+* under-reported exactly what it exists to report.
+*/
+const TREE_PASSES = TREE_PASS_IDS.join(", ");
+/** The passes a member run puts over a package. */
+const MEMBER_PASSES = MEMBER_PASS_IDS.join(", ");
+/**
+* Print the findings and exit on the first error-level one. `passes` names the
+* ones that ACTUALLY ran: a member run that claimed the tree passes would be
+* telling the reader a `specs/` tree was judged when none was walked.
+*/
+function report(violations, what, passes) {
+	const errors = violations.filter((violation) => violation.severity === "error");
+	if (json) {
+		console.log(JSON.stringify(violations.map((violation) => ({
+			code: `jterrazz-check(${codeOf(violation.rule)})`,
+			file: violation.file,
+			line: violation.line,
+			message: violation.message,
+			severity: violation.severity
+		}))));
+		process.exit(errors.length > 0 ? 1 : 0);
+	}
+	if (violations.length > 0) (errors.length > 0 ? console.error : console.warn)(formatViolations(violations));
+	if (errors.length > 0) {
+		console.error(`\nconventions checker: ${errors.length} error(s) found ${what}`);
+		process.exit(1);
+	}
+	console.log(`conventions checker: all passes clean ${what} (${passes})${violations.length > 0 ? ` — ${violations.length} warning(s)` : ""}`);
+	process.exit(0);
+}
+/** A directory that must exist — a typo'd path is operator error, not a clean tree. */
+function requireDirectory(path, what) {
+	const resolved = resolve(path);
+	if (!existsSync(resolved) || !statSync(resolved).isDirectory()) {
+		console.error(`conventions checker: no such ${what}: ${resolved}`);
+		process.exit(1);
+	}
+	return resolved;
+}
+if (member !== void 0) {
+	const root = resolve(positional ?? ".");
+	const dir = requireDirectory(member, "member directory");
+	report(checkMember(dir, root), `for member ${relative(root, dir) || "."}`, MEMBER_PASSES);
+}
+/**
+* Rename one file, keeping git's record of it where there is one.
+*
+* `git mv` is tried first and its failure is not an error: a path outside a
+* working tree, or one git does not track yet, renames exactly as well with
+* `renameSync` — what must not happen is a migration that loses the history of
+* every spec it touches because the tool reached for the blunter call.
+*/
+function renameKeepingHistory(from, to) {
+	if (spawnSync("git", [
+		"mv",
+		from,
+		to
+	], {
+		cwd: dirname(from),
+		stdio: "ignore"
+	}).status !== 0) renameSync(from, to);
+}
+/** C12's mover: every `.test.ts` under a facet folder becomes a `.spec.ts`. */
+function fixSpecSuffixes(root) {
+	const renamed = [];
+	for (const { from, to } of movesUnderFacet(root)) {
+		if (to === void 0 || existsSync(to)) continue;
+		renameKeepingHistory(from, to);
+		renamed.push(`${relative(root, from)} → ${relative(root, to)}`);
+	}
+	return renamed;
+}
+/** Where a member states what it collects, whatever extension it writes it in. */
+const CONFIG_NAMES = [
+	"vitest.config.ts",
+	"vitest.config.mts",
+	"vitest.config.cts",
+	"vitest.config.js",
+	"vitest.config.mjs",
+	"vitest.config.cjs"
+];
+/** Any string in a config that ends in the suffix the mover just retired. */
+const TEST_GLOB = /['"`](?<glob>[^'"`]*\*[^'"`]*\.test\.ts)['"`]/gu;
+/**
+* The include globs a rename leaves behind.
+*
+* A consumer that names its suffix in an `include` loses the whole suite the
+* moment the mover renames it: vitest collects fewer files, exits 0, and the
+* only trace is a number nobody compares. The mover owns that consequence —
+* it cannot rewrite a config it does not parse, so it NAMES every glob that
+* still says `.test.ts` in the configs of the member it just moved files
+* under, and the author updates them in the same commit as the rename.
+*/
+function staleIncludes(root) {
+	const owner = packageRootOf(root) ?? dirname(root);
+	const found = [];
+	for (const directory of /* @__PURE__ */ new Set([
+		root,
+		owner,
+		dirname(root)
+	])) for (const name of CONFIG_NAMES) {
+		const path = join(directory, name);
+		if (!existsSync(path)) continue;
+		const text = readFileSync(path, "utf8");
+		for (const match of text.matchAll(TEST_GLOB)) {
+			const glob = match.groups?.glob ?? "";
+			if (glob !== "") found.push(`${relative(owner, path)}: ${glob}`);
+		}
+	}
+	return found;
+}
+/** Apply every rewritable pass over one tree, printing what it did. */
+function applyFixes(root) {
+	const renamed = fixSpecSuffixes(root);
+	for (const rename of renamed) console.log(`conventions checker: renamed ${rename} (C12)`);
+	for (const glob of renamed.length === 0 ? [] : staleIncludes(root)) console.log(`conventions checker: ${glob} still names \`.test.ts\` — the files it collected are \`.spec.ts\` now, and the project collects nothing until the glob follows (C12)`);
 	const written = fixSpecFiles(root);
 	if (written.length > 0) console.log(`conventions checker: rewrote ${written.length} spec document(s)`);
 	for (const move of fixPoolFixtures(root)) console.log(`conventions checker: moved ${move} (C14) — stage the rename`);
 }
-const violations = runAllChecks(root);
-const errors = violations.filter((violation) => violation.severity === "error");
-if (violations.length > 0) (errors.length > 0 ? console.error : console.warn)(formatViolations(violations));
-if (errors.length > 0) {
-	console.error(`\nconventions checker: ${errors.length} error(s) found under ${root}`);
-	process.exit(1);
+if (positional !== void 0) {
+	const root = requireDirectory(positional, "directory");
+	if (fix) applyFixes(root);
+	report(runAllChecks(root), `under ${root}`, TREE_PASSES);
+}
+const root = resolve(".");
+const found = [];
+for (const specsRoot of discoverSpecRoots(root)) {
+	const prefix = relative(root, specsRoot);
+	if (fix) applyFixes(specsRoot);
+	for (const violation of runAllChecks(specsRoot)) found.push({
+		...violation,
+		file: `${prefix}/${violation.file}`,
+		message: `${prefix}/${violation.message}`
+	});
 }
-console.log(`conventions checker: all passes clean under ${root} (D4/D4b/D10 grammar, spec documents, C9 dead fixtures, C14/C15 fixture placement, B5 await-using, A7 database)${violations.length > 0 ? ` — ${violations.length} warning(s)` : ""}`);
+found.push(...checkMembers(root));
+report(found, `under ${root}`, `${TREE_PASSES}, ${MEMBER_PASSES}`);
 //#endregion
 export {};