@orkestrel/scaffold 0.0.23 → 0.0.25

package/dist/host/tests/setupPolicy.ts

@@ -1,19 +1,55 @@
-import { globSync, readFileSync } from 'node:fs'
-import { isBuiltin } from 'node:module'
-import { basename, extname, join } from 'node:path'
+import { globSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
 import * as ts from 'typescript'
 
-/** Centralized source modules whose top-level declarations must all be exported. */
+/** A rule the fleet placement instrument can decide from syntax and a file path. */
+export type PolicyRule =
+	| 'class'
+	| 'constant'
+	| 'data'
+	| 'domain'
+	| 'export'
+	| 'factory'
+	| 'function'
+	| 'mirror'
+	| 'parser'
+	| 'type'
+
+/** One TypeScript source supplied to the placement instrument. */
+export interface PolicySource {
+	readonly path: string
+	readonly content: string
+}
+
+/** One placement failure reported by the instrument. */
+export interface PolicyViolation {
+	readonly rule: PolicyRule
+	readonly path: string
+	readonly line?: number
+	readonly message: string
+}
+
+/** One physical negative control, including the population boundary it attacks. */
+export interface PolicyControl {
+	readonly label: string
+	readonly membership: string
+	readonly rule: PolicyRule
+	readonly files: readonly PolicySource[]
+}
+
+/** Every centralized module named by the architecture kind table. */
 export const CENTRAL_SOURCE_FILES: readonly string[] = Object.freeze([
-	'combinators.ts',
 	'cloners.ts',
+	'combinators.ts',
 	'compilers.ts',
 	'constants.ts',
 	'contracts.ts',
 	'errors.ts',
 	'factories.ts',
-	'helpers.ts',
 	'handlers.ts',
+	'helpers.ts',
+	'index.ts',
 	'inferers.ts',
 	'middlewares.ts',
 	'parsers.ts',
@@ -27,10 +63,10 @@ export const CENTRAL_SOURCE_FILES: readonly string[] = Object.freeze([
 	'validators.ts',
 ])
 
-/** Centralized files that own module-scope function declarations. */
+/** The exhaustive centralized-file set that permits module functions. */
 export const FUNCTION_SOURCE_FILES: readonly string[] = Object.freeze([
-	'combinators.ts',
 	'cloners.ts',
+	'combinators.ts',
 	'compilers.ts',
 	'errors.ts',
 	'factories.ts',
@@ -40,14 +76,13 @@ export const FUNCTION_SOURCE_FILES: readonly string[] = Object.freeze([
 	'middlewares.ts',
 	'parsers.ts',
 	'relations.ts',
-	'routes.ts',
 	'schemas.ts',
 	'seeders.ts',
 	'shapers.ts',
 	'validators.ts',
 ])
 
-/** Centralized files that own module-scope data declarations. */
+/** Centralized files that permit module data by declaration syntax. */
 export const DATA_SOURCE_FILES: readonly string[] = Object.freeze([
 	'combinators.ts',
 	'constants.ts',
@@ -60,837 +95,630 @@ export const DATA_SOURCE_FILES: readonly string[] = Object.freeze([
 	'validators.ts',
 ])
 
-/** Domain folders whose modules each export one named function rather than one class. */
+/** Fleet-registered folders whose direct modules each contain one named function. */
 export const FUNCTION_DOMAIN_FOLDERS: readonly string[] = Object.freeze(['app/browser/composables'])
 
-/** Worker-only value globals that WebWorker typing must not expose to core implementations. */
-export const WORKER_SCOPE_VALUE_GLOBALS: readonly string[] = Object.freeze([
-	'name',
-	'onrtctransform',
-	'close',
-	'postMessage',
-	'dispatchEvent',
-	'location',
-	'onerror',
-	'onlanguagechange',
-	'onoffline',
-	'ononline',
-	'onrejectionhandled',
-	'onunhandledrejection',
-	'self',
-	'importScripts',
-	'fonts',
-	'caches',
-	'crossOriginIsolated',
-	'indexedDB',
-	'isSecureContext',
-	'origin',
-	'scheduler',
-	'createImageBitmap',
-	'reportError',
-	'cancelAnimationFrame',
-	'requestAnimationFrame',
-	'onmessage',
-	'onmessageerror',
-	'addEventListener',
-	'removeEventListener',
-])
-
-/** Source extensions inspected by the repository coding-law sweep. */
-export const CODING_SOURCE_EXTENSIONS: readonly string[] = Object.freeze([
-	'cjs',
+/** TypeScript source extensions whose declaration syntax the sweep reads. */
+export const POLICY_SOURCE_EXTENSIONS: readonly string[] = Object.freeze([
 	'cts',
-	'js',
-	'jsx',
-	'mjs',
 	'mts',
 	'ts',
 	'tsx',
-	'vue',
 ])
 
-/** Production-source glob derived from the complete inspected extension vocabulary. */
-export const CODING_SOURCE_GLOB = `{app,src}/**/*.{${CODING_SOURCE_EXTENSIONS.join(',')}}`
+/** The complete TypeScript source population inspected under either workspace axis. */
+export const POLICY_SOURCE_GLOB = `{app,src}/**/*.{${POLICY_SOURCE_EXTENSIONS.join(',')}}`
 
-/** Fleet-owned policy files that must stay free of any one package's architecture. */
-export const POLICY_INFRASTRUCTURE_FILES: readonly string[] = Object.freeze([
-	'tests/policy.test.ts',
-	'tests/setupPolicy.ts',
-])
-
-/** Source environments whose prefixed paths fleet policy must not name in a literal. */
-export const POLICY_SOURCE_ENVIRONMENTS: readonly string[] = Object.freeze([
-	'browser',
-	'core',
-	'server',
-])
+/** The mirrored module-test population inspected under either workspace axis. */
+export const POLICY_TEST_GLOB = 'tests/{app,src}/**/*.test.ts'
 
 /**
- * The prefixed source-environment path fleet policy must not name in a literal.
+ * Normalize platform separators for stable matching and diagnostics.
  *
- * @remarks
- * Built rather than written, so this file states no matching literal of its own
- * and can never report itself. Policy names an environment without the source
- * prefix when it must name one at all, which is why the prefix is the rule.
+ * @param path - The workspace-relative path to normalize.
+ * @returns The path with forward slashes and no duplicate separators.
  */
-export const POLICY_ENVIRONMENT_PATTERN: RegExp = new RegExp(
-	`src/(?:${POLICY_SOURCE_ENVIRONMENTS.join('|')})/`,
-	'u',
-)
-
-/** Virtual source text used while binding one policy-inspected module. */
-export const POLICY_SOURCE_TEXTS: Map<string, string> = new Map()
-
-/** One script block extracted from a Vue SFC by the official compiler. */
-export interface VueScriptBlockInterface {
-	readonly content: string
-	readonly lang?: string
-}
-
-/** An injected official Vue SFC script-block extractor. */
-export interface VueScriptExtractorInterface {
-	(path: string, content: string): readonly VueScriptBlockInterface[]
-}
-
-/** Normalize platform separators and duplicate glob segments for stable diagnostics. */
 export function normalizePolicyPath(path: string): string {
 	return path.replaceAll('\\', '/').replace(/\/+/gu, '/')
 }
 
-/** Whether a path belongs to the production-source coding-law corpus. */
-export function isCodingSourcePath(path: string): boolean {
-	const normalized = normalizePolicyPath(path)
-	const extension = normalized.split('.').pop()
-	return (
-		(normalized.startsWith('app/') || normalized.startsWith('src/')) &&
-		extension !== undefined &&
-		CODING_SOURCE_EXTENSIONS.includes(extension)
-	)
-}
-
 /**
- * Whether a path is an eligible function-domain module.
+ * Whether a declaration carries a specified TypeScript modifier.
  *
- * @param path - The workspace-relative source path to inspect
- * @returns `true` when the path is a direct module of a registered function domain
+ * @param node - The declaration to inspect.
+ * @param modifier - The modifier syntax to find.
+ * @returns `true` when the declaration carries the modifier.
  */
-export function isFunctionDomainPath(path: string): boolean {
-	const normalized = normalizePolicyPath(path)
-	const file = basename(normalized)
-	const separator = normalized.lastIndexOf('/')
-	const parent = separator < 0 ? '' : normalized.slice(0, separator)
-	return (
-		FUNCTION_DOMAIN_FOLDERS.includes(parent) &&
-		/^[a-z][A-Za-z0-9]*\.ts$/u.test(file) &&
-		file !== 'index.ts' &&
-		file !== 'main.ts' &&
-		!CENTRAL_SOURCE_FILES.includes(file) &&
-		!FUNCTION_SOURCE_FILES.includes(file) &&
-		!DATA_SOURCE_FILES.includes(file)
-	)
-}
-
-/** Whether a declaration carries an explicit export modifier. */
-export function hasExportModifier(node: ts.Node): boolean {
-	return (
-		ts.canHaveModifiers(node) &&
-		ts.getModifiers(node)?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) ===
-			true
-	)
-}
-
-/** Whether a declaration carries a specified modifier. */
-export function hasModifier(node: ts.Node, modifier: ts.SyntaxKind): boolean {
+export function hasPolicyModifier(node: ts.Node, modifier: ts.SyntaxKind): boolean {
 	return (
 		ts.canHaveModifiers(node) &&
 		ts.getModifiers(node)?.some((candidate) => candidate.kind === modifier) === true
 	)
 }
 
-/** Whether a module specifier uses a URL scheme other than Node's builtin namespace. */
-export function isUnsupportedModuleSpecifier(specifier: string): boolean {
-	return /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(specifier) && !specifier.startsWith('node:')
-}
-
-/** Whether an arrow/function expression is an anonymous callback passed directly as an argument. */
-export function isDirectCallback(node: ts.ArrowFunction | ts.FunctionExpression): boolean {
-	const parent = node.parent
-	return (
-		(ts.isCallExpression(parent) || ts.isNewExpression(parent)) &&
-		parent.arguments?.some((argument) => argument === node) === true
-	)
-}
-
 /**
- * Whether an arrow/function expression is returned directly as a factory or combinator result.
+ * Return the one-based line where a syntax node begins.
  *
- * @param node - The function expression to inspect
- * @returns `true` when the node is a direct return value, including one parenthesized layer
+ * @param node - The syntax node to locate.
+ * @returns Its one-based source line.
  */
-export function isDirectReturn(node: ts.ArrowFunction | ts.FunctionExpression): boolean {
-	const parent = node.parent
-	if (ts.isReturnStatement(parent)) return true
-	if (ts.isArrowFunction(parent) && parent.body === node) return true
-	if (!ts.isParenthesizedExpression(parent)) return false
-	const container = parent.parent
-	return (
-		ts.isReturnStatement(container) || (ts.isArrowFunction(container) && container.body === parent)
-	)
-}
-
-/** Whether a function expression is assigned by one module-scope variable declaration. */
-export function isModuleFunction(node: ts.ArrowFunction | ts.FunctionExpression): boolean {
-	const declaration = node.parent
-	const list = declaration.parent
-	const statement = list.parent
-	return (
-		ts.isVariableDeclaration(declaration) &&
-		ts.isVariableDeclarationList(list) &&
-		ts.isVariableStatement(statement) &&
-		ts.isSourceFile(statement.parent)
-	)
+export function getPolicyLine(node: ts.Node): number {
+	const position = node.getSourceFile().getLineAndCharacterOfPosition(node.getStart())
+	return position.line + 1
 }
 
 /**
- * Format a syntax node's source position as a one-based line and character.
+ * Whether a path is a direct module of a fleet-registered function domain.
  *
- * @param node - The syntax node whose starting position to format
- * @returns The node's one-based `line:character` position
+ * @param path - The workspace-relative source path to inspect.
+ * @returns `true` when the path has the registered function-module shape.
  */
-export function formatPolicyPosition(node: ts.Node): string {
-	const source = node.getSourceFile()
-	const position = source.getLineAndCharacterOfPosition(node.getStart())
-	return `${String(position.line + 1)}:${String(position.character + 1)}`
-}
-
-/** Whether a property signature belongs to a centralized interface or type alias contract. */
-export function isContractProperty(node: ts.PropertySignature): boolean {
-	let parent: ts.Node = node.parent
-	while (ts.isTypeLiteralNode(parent)) parent = parent.parent
-	return ts.isInterfaceDeclaration(parent) || ts.isTypeAliasDeclaration(parent)
-}
-
-/** Whether the sole production triple-slash reference is the generated browser Vite contract. */
-export function hasAllowedTripleSlashReference(path: string, source: ts.SourceFile): boolean {
+export function isFunctionDomainPath(path: string): boolean {
+	const normalized = normalizePolicyPath(path)
+	const file = basename(normalized)
 	return (
-		path.replaceAll('\\', '/') === 'app/browser/env.d.ts' &&
-		source.referencedFiles.length === 0 &&
-		source.libReferenceDirectives.length === 0 &&
-		source.typeReferenceDirectives.length === 1 &&
-		source.typeReferenceDirectives[0]?.fileName === 'vite/client'
+		FUNCTION_DOMAIN_FOLDERS.includes(dirname(normalized).replaceAll('\\', '/')) &&
+		/^[a-z][A-Za-z0-9]*\.ts$/u.test(file) &&
+		file !== 'index.ts' &&
+		file !== 'main.ts' &&
+		!CENTRAL_SOURCE_FILES.includes(file)
 	)
 }
 
 /**
- * Whether a source is self-contained around a positively identified Node runtime dependency.
+ * Whether a variable initializer is directly a function expression.
  *
- * @param source - The parsed source file to inspect.
- * @returns `true` when at least one value import names a real `node:` builtin and no sibling,
- * re-exported, or dynamic runtime dependency is present; type-only imports are erased.
- *
- * @example
- * ```ts
- * const source = ts.createSourceFile(
- * 	'serve.ts',
- * 	"import { parentPort } from 'node:worker_threads'",
- * 	ts.ScriptTarget.Latest,
- * 	true,
- * )
- * isSelfContained(source) // true
- * ```
+ * @param initializer - The initializer to inspect.
+ * @returns `true` for a direct arrow or function expression.
  */
-export function isSelfContained(source: ts.SourceFile): boolean {
-	const pending: ts.Node[] = [source]
-	while (pending.length > 0) {
-		const node = pending.pop()
-		if (node === undefined) continue
-		if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
-			return false
-		}
-		ts.forEachChild(node, (child) => {
-			pending.push(child)
-		})
+export function isPolicyFunctionInitializer(initializer: ts.Expression | undefined): boolean {
+	let expression = initializer
+	while (expression !== undefined && ts.isParenthesizedExpression(expression)) {
+		expression = expression.expression
 	}
-
-	let builtin = false
-	for (const statement of source.statements) {
-		if (ts.isExportDeclaration(statement) && statement.moduleSpecifier !== undefined) {
-			return false
-		}
-		if (ts.isImportDeclaration(statement)) {
-			const clause = statement.importClause
-			const named = clause?.namedBindings
-			const erased =
-				clause?.phaseModifier === ts.SyntaxKind.TypeKeyword ||
-				(clause !== undefined &&
-					clause.name === undefined &&
-					named !== undefined &&
-					ts.isNamedImports(named) &&
-					named.elements.length > 0 &&
-					named.elements.every((element) => element.isTypeOnly))
-			if (erased) continue
-			const moduleSpecifier = statement.moduleSpecifier
-			if (!ts.isStringLiteral(moduleSpecifier)) return false
-			const specifier = moduleSpecifier.text
-			if (!specifier.startsWith('node:') || !isBuiltin(specifier)) return false
-			builtin = true
-		}
-		if (ts.isImportEqualsDeclaration(statement)) {
-			if (statement.isTypeOnly) continue
-			const reference = statement.moduleReference
-			if (
-				!ts.isExternalModuleReference(reference) ||
-				reference.expression === undefined ||
-				!ts.isStringLiteral(reference.expression)
-			) {
-				return false
-			}
-			const specifier = reference.expression.text
-			if (!specifier.startsWith('node:') || !isBuiltin(specifier)) return false
-			builtin = true
-		}
-	}
-	return builtin
+	return (
+		expression !== undefined &&
+		(ts.isArrowFunction(expression) || ts.isFunctionExpression(expression))
+	)
 }
 
 /**
- * Whether the policy compiler can read one source path.
+ * Whether an expression contains module-level function syntax.
  *
- * @param path - The source path to inspect
- * @returns `true` when the virtual or physical source exists
+ * @param node - The initializer subtree to inspect.
+ * @returns `true` when the subtree contains an arrow or function expression.
  */
-export function hasPolicySource(path: string): boolean {
-	return POLICY_SOURCE_TEXTS.has(path) || ts.sys.fileExists(path)
+export function hasPolicyFunctionExpression(node: ts.Node | undefined): boolean {
+	if (node === undefined) return false
+	if (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) return true
+	if (ts.isClassExpression(node)) return false
+	let found = false
+	ts.forEachChild(node, (child) => {
+		if (!found && hasPolicyFunctionExpression(child)) found = true
+	})
+	return found
 }
 
 /**
- * Read one virtual or physical policy source.
+ * Create one stable violation for an inspection result.
  *
- * @param path - The source path to read
- * @returns The source text when present
+ * @param rule - The rule that failed.
+ * @param path - The workspace-relative source path.
+ * @param message - The failure text.
+ * @param node - The syntax node that failed, when one exists.
+ * @returns The stable violation record.
  */
-export function readPolicySource(path: string): string | undefined {
-	return POLICY_SOURCE_TEXTS.get(path) ?? ts.sys.readFile(path)
+export function createPolicyViolation(
+	rule: PolicyRule,
+	path: string,
+	message: string,
+	node?: ts.Node,
+): PolicyViolation {
+	return {
+		rule,
+		path,
+		...(node === undefined ? {} : { line: getPolicyLine(node) }),
+		message,
+	}
 }
 
 /**
- * Parse one virtual or physical policy source for the compiler host.
+ * Inspect a registered function module's exact declaration shape.
  *
- * @param path - The source path to parse
- * @param language - The requested TypeScript language target
- * @returns The parsed source file when present
+ * @param path - The workspace-relative source path.
+ * @param source - The parsed TypeScript source.
+ * @returns A domain-shape violation when the module is malformed.
  */
-export function createPolicySource(
+export function inspectFunctionDomain(
 	path: string,
-	language: ts.ScriptTarget | ts.CreateSourceFileOptions,
-): ts.SourceFile | undefined {
-	const content = readPolicySource(path)
-	return content === undefined ? undefined : ts.createSourceFile(path, content, language, true)
+	source: ts.SourceFile,
+): readonly PolicyViolation[] {
+	const expected = basename(path, '.ts')
+	const declarations = source.statements.filter(ts.isFunctionDeclaration)
+	const implementations = declarations.filter((declaration) => declaration.body !== undefined)
+	const invalid = source.statements.filter(
+		(statement) => !ts.isImportDeclaration(statement) && !ts.isFunctionDeclaration(statement),
+	)
+	const valid =
+		implementations.length === 1 &&
+		invalid.length === 0 &&
+		declarations.length > 0 &&
+		declarations.every(
+			(declaration) =>
+				declaration.name?.text === expected &&
+				hasPolicyModifier(declaration, ts.SyntaxKind.ExportKeyword) &&
+				!hasPolicyModifier(declaration, ts.SyntaxKind.DefaultKeyword),
+		)
+	return valid
+		? []
+		: [
+				createPolicyViolation(
+					'domain',
+					path,
+					'registered function modules contain imports and one matching named export',
+				),
+			]
 }
 
 /**
- * Bind one policy-inspected module without loading ambient host declarations.
+ * Inspect parser and factory function names without inferring their meaning.
  *
- * @param path - The source path used in diagnostics
- * @param content - The TypeScript source text to bind
- * @returns A one-file TypeScript program whose checker resolves lexical bindings
+ * @param path - The workspace-relative source path.
+ * @param file - The source filename.
+ * @param name - The declared function name, when present.
+ * @param node - The function declaration or binding.
+ * @returns A parser or factory name violation when the prefix is wrong.
  */
-export function createPolicyProgram(path: string, content: string): ts.Program {
-	const options: ts.CompilerOptions = {
-		allowJs: true,
-		noLib: true,
-		noResolve: true,
-		target: ts.ScriptTarget.Latest,
-		types: [],
+export function inspectPolicyFunctionName(
+	path: string,
+	file: string,
+	name: string | undefined,
+	node: ts.Node,
+): readonly PolicyViolation[] {
+	if (file === 'parsers.ts' && (name === undefined || !name.startsWith('parse'))) {
+		return [createPolicyViolation('parser', path, 'parser functions use the parse prefix', node)]
+	}
+	if (file === 'factories.ts' && (name === undefined || !name.startsWith('create'))) {
+		return [createPolicyViolation('factory', path, 'factory functions use the create prefix', node)]
 	}
-	POLICY_SOURCE_TEXTS.set(path, content)
-	const host = ts.createCompilerHost(options)
-	host.fileExists = hasPolicySource
-	host.readFile = readPolicySource
-	host.getSourceFile = createPolicySource
-	const program = ts.createProgram([path], options, host)
-	POLICY_SOURCE_TEXTS.delete(path)
-	return program
+	return []
 }
 
 /**
- * Whether an identifier is a standalone runtime value reference.
+ * Inspect one variable statement for data and function placement.
  *
- * @param node - The identifier occurrence to classify
- * @param checker - The binder used to distinguish lexical values from ambient globals
- * @returns `true` only when the occurrence reads or writes a runtime value
+ * @param path - The workspace-relative source path.
+ * @param file - The source filename.
+ * @param statement - The variable statement to inspect.
+ * @param functionDomain - Whether the path is a registered function module.
+ * @returns Every data, function, parser, and factory violation in declaration order.
  */
-export function isValueReferenceIdentifier(node: ts.Identifier, checker: ts.TypeChecker): boolean {
-	if (ts.isPartOfTypeNode(node)) return false
-
-	let ancestor: ts.Node = node.parent
-	while (!ts.isSourceFile(ancestor) && !ts.isStatement(ancestor)) {
-		if (ts.isTypeQueryNode(ancestor)) return false
-		if (ts.isComputedPropertyName(ancestor) && ts.isTypeElement(ancestor.parent)) return false
-		ancestor = ancestor.parent
-	}
-
-	const parent = node.parent
-	if (
-		(ts.isPropertyAccessExpression(parent) && parent.name === node) ||
-		(ts.isPropertyAssignment(parent) && parent.name === node) ||
-		(ts.isPropertyDeclaration(parent) && parent.name === node) ||
-		(ts.isPropertySignature(parent) && parent.name === node) ||
-		(ts.isMethodDeclaration(parent) && parent.name === node) ||
-		(ts.isMethodSignature(parent) && parent.name === node) ||
-		(ts.isGetAccessorDeclaration(parent) && parent.name === node) ||
-		(ts.isSetAccessorDeclaration(parent) && parent.name === node) ||
-		(ts.isVariableDeclaration(parent) && parent.name === node) ||
-		(ts.isParameter(parent) && parent.name === node) ||
-		(ts.isBindingElement(parent) && (parent.name === node || parent.propertyName === node)) ||
-		(ts.isFunctionDeclaration(parent) && parent.name === node) ||
-		(ts.isFunctionExpression(parent) && parent.name === node) ||
-		(ts.isClassDeclaration(parent) && parent.name === node) ||
-		(ts.isClassExpression(parent) && parent.name === node) ||
-		(ts.isInterfaceDeclaration(parent) && parent.name === node) ||
-		(ts.isTypeAliasDeclaration(parent) && parent.name === node) ||
-		(ts.isTypeParameterDeclaration(parent) && parent.name === node) ||
-		(ts.isEnumDeclaration(parent) && parent.name === node) ||
-		(ts.isEnumMember(parent) && parent.name === node) ||
-		(ts.isModuleDeclaration(parent) && parent.name === node) ||
-		ts.isImportClause(parent) ||
-		ts.isImportSpecifier(parent) ||
-		ts.isNamespaceImport(parent) ||
-		ts.isImportEqualsDeclaration(parent) ||
-		ts.isExportSpecifier(parent) ||
-		ts.isNamespaceExport(parent) ||
-		ts.isNamespaceExportDeclaration(parent) ||
-		(ts.isLabeledStatement(parent) && parent.label === node) ||
-		(ts.isBreakOrContinueStatement(parent) && parent.label === node) ||
-		(ts.isJsxAttribute(parent) && parent.name === node)
-	) {
-		return false
-	}
-	return (
-		(ts.isShorthandPropertyAssignment(parent)
-			? checker.getShorthandAssignmentValueSymbol(parent)
-			: checker.getSymbolAtLocation(node)) === undefined
-	)
-}
-
-/** Inspect a Vue single-file component for syntax that can bypass declared import policy. */
-export function inspectVueCodingLaw(
+export function inspectPolicyVariables(
 	path: string,
-	scripts: readonly VueScriptBlockInterface[] = [],
-): readonly string[] {
-	const violations: string[] = []
-	for (const [index, script] of scripts.entries()) {
-		if (
-			script.lang !== 'ts' &&
-			script.lang !== 'tsx' &&
-			script.lang !== 'mts' &&
-			script.lang !== 'cts'
-		) {
-			violations.push(`${path}.script-${String(index)} requires a TypeScript script language`)
+	file: string,
+	statement: ts.VariableStatement,
+	functionDomain: boolean,
+): readonly PolicyViolation[] {
+	const violations: PolicyViolation[] = []
+	for (const declaration of statement.declarationList.declarations) {
+		const directFunction = isPolicyFunctionInitializer(declaration.initializer)
+		const containsFunction = hasPolicyFunctionExpression(declaration.initializer)
+		if (!directFunction && !DATA_SOURCE_FILES.includes(file)) {
+			violations.push(
+				createPolicyViolation('data', path, 'module data sits in a data-kind file', declaration),
+			)
+		}
+		if (containsFunction && !functionDomain && !FUNCTION_SOURCE_FILES.includes(file)) {
+			violations.push(
+				createPolicyViolation(
+					'function',
+					path,
+					'module function syntax sits in a function-kind file',
+					declaration,
+				),
+			)
+		}
+		if (directFunction && ts.isIdentifier(declaration.name)) {
+			violations.push(...inspectPolicyFunctionName(path, file, declaration.name.text, declaration))
 		}
-		const extension =
-			script.lang === 'tsx' || script.lang === 'mts' || script.lang === 'cts' ? script.lang : 'ts'
-		violations.push(
-			...inspectCodingLaw(`${path}.script-${String(index)}.${extension}`, script.content),
-		)
-	}
-	return violations
-}
-
-/** Inspect one production source through the shared coding-law route. */
-export function inspectCodingSource(
-	path: string,
-	content: string,
-	vueScripts?: VueScriptExtractorInterface,
-): readonly string[] {
-	const normalizedPath = normalizePolicyPath(path)
-	if (!normalizedPath.endsWith('.vue')) return inspectCodingLaw(normalizedPath, content)
-	const violations: string[] = []
-	if (!normalizedPath.startsWith('app/browser/')) {
-		violations.push(`${normalizedPath} Vue components belong in app/browser`)
-	}
-	// A missing extractor is reported, never absorbed. Returning [] here would make
-	// every SFC's script block silently unchecked while the surrounding sweep still
-	// reported success — an instrument claiming a coverage it does not have.
-	if (vueScripts === undefined) {
-		violations.push(
-			`${normalizedPath} requires a Vue script extractor; its script blocks were not inspected`,
-		)
-		return violations
 	}
-	violations.push(...inspectVueCodingLaw(normalizedPath, vueScripts(normalizedPath, content)))
 	return violations
 }
 
-/** Add syntax-wide coding-law violations while traversing one source tree. */
-export function inspectCodingNode(
+/**
+ * Inspect the const, name, and bare-collection rules for constants.ts.
+ *
+ * @param path - The workspace-relative source path.
+ * @param statement - The variable statement to inspect.
+ * @returns Every constants.ts syntax violation in declaration order.
+ */
+export function inspectPolicyConstants(
 	path: string,
-	node: ts.Node,
-	violations: string[],
-	checker: ts.TypeChecker,
-): void {
-	if (
-		/^(?:app|src)[\\/]core[\\/]/u.test(path) &&
-		ts.isIdentifier(node) &&
-		WORKER_SCOPE_VALUE_GLOBALS.includes(node.text) &&
-		isValueReferenceIdentifier(node, checker)
-	) {
+	statement: ts.VariableStatement,
+): readonly PolicyViolation[] {
+	const violations: PolicyViolation[] = []
+	if ((statement.declarationList.flags & ts.NodeFlags.Const) === 0) {
 		violations.push(
-			`${path}:${formatPolicyPosition(node)} forbids worker-scope global ${node.text} in core`,
+			createPolicyViolation(
+				'constant',
+				path,
+				'constants.ts permits only const declarations',
+				statement,
+			),
 		)
 	}
-	if (
-		ts.isAsExpression(node) ||
-		ts.isTypeAssertionExpression(node) ||
-		ts.isNonNullExpression(node)
-	) {
-		violations.push(`${path}:${formatPolicyPosition(node)} forbids type/non-null assertions`)
-	}
-	if (node.kind === ts.SyntaxKind.AnyKeyword) {
-		violations.push(`${path}:${formatPolicyPosition(node)} forbids any`)
-	}
-	if (
-		(ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) &&
-		node.moduleSpecifier !== undefined &&
-		ts.isStringLiteral(node.moduleSpecifier) &&
-		isUnsupportedModuleSpecifier(node.moduleSpecifier.text)
-	) {
-		violations.push(`${path}:${formatPolicyPosition(node)} forbids non-Node URL module specifiers`)
-	}
-	if (
-		ts.isPropertySignature(node) &&
-		isContractProperty(node) &&
-		!hasModifier(node, ts.SyntaxKind.ReadonlyKeyword)
-	) {
-		violations.push(`${path}:${formatPolicyPosition(node)} requires readonly contract properties`)
-	}
-	if (
-		ts.isCallExpression(node) &&
-		node.expression.kind === ts.SyntaxKind.ImportKeyword &&
-		(node.arguments.length !== 1 || !node.arguments.every(ts.isStringLiteral))
-	) {
-		violations.push(
-			`${path}:${formatPolicyPosition(node)} requires dynamic imports to use string literals so import policy remains enforceable`,
-		)
-	}
-	if (
-		ts.isCallExpression(node) &&
-		node.expression.kind === ts.SyntaxKind.ImportKeyword &&
-		node.arguments.length === 1 &&
-		node.arguments.every(ts.isStringLiteral) &&
-		isUnsupportedModuleSpecifier(node.arguments[0]?.text ?? '')
-	) {
-		violations.push(`${path}:${formatPolicyPosition(node)} forbids non-Node URL module specifiers`)
-	}
-	if (ts.isFunctionDeclaration(node) && !ts.isSourceFile(node.parent)) {
-		violations.push(`${path}:${formatPolicyPosition(node)} forbids nested function declarations`)
-	}
-	if (
-		(ts.isArrowFunction(node) || ts.isFunctionExpression(node)) &&
-		!isDirectCallback(node) &&
-		!isDirectReturn(node) &&
-		!isModuleFunction(node)
-	) {
-		violations.push(`${path}:${formatPolicyPosition(node)} forbids hidden function assignments`)
+	for (const declaration of statement.declarationList.declarations) {
+		if (!ts.isIdentifier(declaration.name) || !/^[A-Z][A-Z0-9_]*$/u.test(declaration.name.text)) {
+			violations.push(
+				createPolicyViolation(
+					'constant',
+					path,
+					'constants.ts names declarations in UPPER_SNAKE_CASE',
+					declaration,
+				),
+			)
+		}
+		if (
+			declaration.initializer !== undefined &&
+			(ts.isArrayLiteralExpression(declaration.initializer) ||
+				ts.isObjectLiteralExpression(declaration.initializer))
+		) {
+			violations.push(
+				createPolicyViolation(
+					'constant',
+					path,
+					'constants.ts forbids bare collection literals',
+					declaration,
+				),
+			)
+		}
 	}
-	ts.forEachChild(node, (child) => inspectCodingNode(path, child, violations, checker))
+	return violations
 }
 
 /**
- * Inspect one eligible function-domain module for its required declaration shape.
+ * Whether a top-level statement declares a centralized symbol.
  *
- * @param path - The source path used in diagnostics
- * @param source - The parsed source file to inspect
- * @returns A shape violation when the module is not imports plus one matching named export
+ * @param statement - The top-level statement to classify.
+ * @returns `true` when the statement declares a symbol governed by the export rule.
  */
-export function inspectFunctionModule(path: string, source: ts.SourceFile): readonly string[] {
-	const file = basename(normalizePolicyPath(path))
-	const declarations = source.statements.filter(ts.isFunctionDeclaration)
-	const functions = declarations.filter((declaration) => declaration.body !== undefined)
-	const invalid = source.statements.filter(
-		(statement) => !ts.isImportDeclaration(statement) && !ts.isFunctionDeclaration(statement),
+export function isPolicyDeclaration(statement: ts.Statement): boolean {
+	return (
+		ts.isClassDeclaration(statement) ||
+		ts.isEnumDeclaration(statement) ||
+		ts.isFunctionDeclaration(statement) ||
+		ts.isInterfaceDeclaration(statement) ||
+		ts.isModuleDeclaration(statement) ||
+		ts.isTypeAliasDeclaration(statement) ||
+		ts.isVariableStatement(statement)
 	)
-	const declaration = functions[0]
-	if (
-		functions.length === 1 &&
-		invalid.length === 0 &&
-		declarations.every((candidate) => candidate.name?.text === file.slice(0, -3)) &&
-		declaration !== undefined &&
-		hasExportModifier(declaration) &&
-		!hasModifier(declaration, ts.SyntaxKind.DefaultKeyword)
-	) {
-		return []
-	}
-	return [`${path} declarations do not form one matching exported function implementation`]
 }
 
-/** Inspect one TypeScript source module for repository coding-law violations. */
-export function inspectCodingLaw(path: string, content: string): readonly string[] {
-	const violations: string[] = []
-	const program = createPolicyProgram(path, content)
-	const source = program.getSourceFile(path)
-	if (source === undefined) throw new Error(`Policy source was not bound at ${path}`)
-	const checker = program.getTypeChecker()
+/**
+ * Inspect one source file against the fleet's syntactic placement register.
+ *
+ * @param source - The path and TypeScript text to inspect.
+ * @returns Every syntactic placement violation in source order.
+ */
+export function inspectPolicySource(source: PolicySource): readonly PolicyViolation[] {
+	const path = normalizePolicyPath(source.path)
 	const file = basename(path)
-	const stem = basename(file, extname(file))
-	const functionModule = isFunctionDomainPath(path)
-	const placementExempt =
-		!CENTRAL_SOURCE_FILES.includes(file) &&
-		!FUNCTION_SOURCE_FILES.includes(file) &&
-		!DATA_SOURCE_FILES.includes(file) &&
-		isSelfContained(source)
-
-	if (/\.[cm]?jsx?$/u.test(path)) {
-		violations.push(`${path} production modules use TypeScript source extensions`)
-	}
-	if (FUNCTION_DOMAIN_FOLDERS.some((folder) => basename(folder) === stem)) {
-		violations.push(`${path} names a function domain, which belongs in a folder rather than a file`)
-	}
-	if (/@ts-(?:expect-error|ignore|nocheck)|eslint-disable|oxlint-disable/u.test(content)) {
-		violations.push(`${path} forbids suppression directives`)
-	}
-	if (
-		(source.referencedFiles.length > 0 ||
-			source.libReferenceDirectives.length > 0 ||
-			source.typeReferenceDirectives.length > 0) &&
-		!hasAllowedTripleSlashReference(path, source)
-	) {
-		violations.push(`${path} forbids triple-slash references outside app/browser/env.d.ts`)
-	}
+	const syntax = ts.createSourceFile(path, source.content, ts.ScriptTarget.Latest, true)
+	const violations: PolicyViolation[] = []
+	const functionDomain = isFunctionDomainPath(path)
+	const domainNames = FUNCTION_DOMAIN_FOLDERS.map((folder) => basename(folder))
 
-	if (file === 'index.ts') {
-		for (const statement of source.statements) {
-			if (
-				!ts.isExportDeclaration(statement) ||
-				statement.exportClause !== undefined ||
-				statement.isTypeOnly ||
-				statement.moduleSpecifier === undefined
-			) {
-				violations.push(`${path} barrels contain only export * declarations`)
-			}
-		}
+	if (domainNames.includes(basename(file, '.ts'))) {
+		violations.push(
+			createPolicyViolation(
+				'domain',
+				path,
+				'a registered function domain is a folder rather than a source file',
+			),
+		)
 	}
 
-	for (const statement of source.statements) {
-		if (
-			(ts.isInterfaceDeclaration(statement) || ts.isTypeAliasDeclaration(statement)) &&
-			file !== 'types.ts'
-		) {
-			violations.push(`${path} centralizes interfaces and type aliases in types.ts`)
-		}
+	for (const statement of syntax.statements) {
 		if (
 			CENTRAL_SOURCE_FILES.includes(file) &&
-			(ts.isClassDeclaration(statement) ||
-				ts.isFunctionDeclaration(statement) ||
-				ts.isInterfaceDeclaration(statement) ||
-				ts.isTypeAliasDeclaration(statement) ||
-				ts.isVariableStatement(statement)) &&
-			!hasExportModifier(statement)
-		) {
-			violations.push(`${path} exports every centralized declaration`)
-		}
-		if (
-			!placementExempt &&
-			!functionModule &&
-			ts.isFunctionDeclaration(statement) &&
-			!FUNCTION_SOURCE_FILES.includes(file)
-		) {
-			violations.push(`${path} places module functions in their centralized kind file`)
-		}
-		if (
-			!placementExempt &&
-			!functionModule &&
-			ts.isVariableStatement(statement) &&
-			!DATA_SOURCE_FILES.includes(file)
+			isPolicyDeclaration(statement) &&
+			!hasPolicyModifier(statement, ts.SyntaxKind.ExportKeyword)
 		) {
-			violations.push(`${path} places module data in its centralized kind file`)
+			violations.push(
+				createPolicyViolation(
+					'export',
+					path,
+					'every centralized declaration is exported',
+					statement,
+				),
+			)
 		}
+
 		if (
-			ts.isClassDeclaration(statement) &&
-			file !== 'errors.ts' &&
-			!/^[A-Z][A-Za-z0-9]*\.ts$/u.test(file)
+			(ts.isEnumDeclaration(statement) ||
+				ts.isInterfaceDeclaration(statement) ||
+				ts.isModuleDeclaration(statement) ||
+				ts.isTypeAliasDeclaration(statement)) &&
+			file !== 'types.ts'
 		) {
-			violations.push(`${path} places each class in its matching implementation or errors file`)
-		}
-		if (ts.isEnumDeclaration(statement) && file !== 'types.ts') {
-			violations.push(`${path} centralizes enum contracts in types.ts`)
+			violations.push(
+				createPolicyViolation('type', path, 'type declarations sit in types.ts', statement),
+			)
 		}
-		if (file === 'constants.ts' && ts.isVariableStatement(statement)) {
-			if ((statement.declarationList.flags & ts.NodeFlags.Const) === 0) {
-				violations.push(`${path} constants.ts permits only const declarations`)
-			}
-			for (const declaration of statement.declarationList.declarations) {
-				if (
-					!ts.isIdentifier(declaration.name) ||
-					!/^[A-Z][A-Z0-9_]*$/u.test(declaration.name.text)
-				) {
-					violations.push(
-						`${path}:${formatPolicyPosition(declaration)} requires UPPER_SNAKE_CASE constants`,
-					)
-				}
-				if (
-					declaration.initializer !== undefined &&
-					(ts.isArrayLiteralExpression(declaration.initializer) ||
-						ts.isObjectLiteralExpression(declaration.initializer))
-				) {
-					violations.push(
-						`${path}:${formatPolicyPosition(declaration)} freezes collection constants`,
-					)
-				}
+
+		if (ts.isFunctionDeclaration(statement)) {
+			if (!functionDomain && !FUNCTION_SOURCE_FILES.includes(file)) {
+				violations.push(
+					createPolicyViolation(
+						'function',
+						path,
+						'module functions sit in a function-kind file',
+						statement,
+					),
+				)
 			}
+			violations.push(...inspectPolicyFunctionName(path, file, statement.name?.text, statement))
 		}
-	}
 
-	if (functionModule) {
-		violations.push(...inspectFunctionModule(path, source))
-	}
-
-	if (/^[A-Z][A-Za-z0-9]*\.ts$/u.test(file)) {
-		const classes = source.statements.filter(ts.isClassDeclaration)
-		const invalid = source.statements.filter(
-			(statement) => !ts.isImportDeclaration(statement) && !ts.isClassDeclaration(statement),
-		)
-		if (
-			classes.length !== 1 ||
-			invalid.length !== 0 ||
-			classes[0]?.name?.text !== file.slice(0, -3) ||
-			classes[0] === undefined ||
-			!hasExportModifier(classes[0])
-		) {
-			violations.push(
-				`${path} implementation modules contain imports and one matching exported class`,
-			)
+		if (ts.isVariableStatement(statement)) {
+			violations.push(...inspectPolicyVariables(path, file, statement, functionDomain))
+			if (file === 'constants.ts') violations.push(...inspectPolicyConstants(path, statement))
 		}
-		for (const member of classes[0]?.members ?? []) {
-			if (hasModifier(member, ts.SyntaxKind.PrivateKeyword)) {
-				violations.push(`${path}:${formatPolicyPosition(member)} uses runtime # privacy`)
+
+		if (ts.isClassDeclaration(statement)) {
+			const expected = basename(file, '.ts')
+			if (
+				file !== 'errors.ts' &&
+				(!/^[A-Z][A-Za-z0-9]*\.ts$/u.test(file) || statement.name?.text !== expected)
+			) {
+				violations.push(
+					createPolicyViolation(
+						'class',
+						path,
+						'classes sit in their matching implementation or errors file',
+						statement,
+					),
+				)
 			}
 		}
 	}
 
-	inspectCodingNode(path, source, violations, checker)
+	if (functionDomain) violations.push(...inspectFunctionDomain(path, syntax))
 	return violations
 }
 
 /**
- * Inspect every production source under one workspace.
+ * Inspect an explicit source population through the same per-file route as the workspace sweep.
  *
- * @remarks
- * `vueScripts` is required whenever the workspace contains a `.vue` file: script
- * blocks cannot be read without it, and omitting it is reported as a violation
- * against each SFC rather than passing silently.
+ * @param sources - The TypeScript files to inspect.
+ * @returns Every syntactic placement violation in source order.
  */
-export function inspectCodingWorkspace(
-	root: string,
-	vueScripts?: VueScriptExtractorInterface,
-): readonly string[] {
-	const violations: string[] = []
-	for (const path of globSync(CODING_SOURCE_GLOB, {
-		cwd: root,
-	})) {
-		const content = readFileSync(join(root, path), 'utf8')
-		violations.push(...inspectCodingSource(path, content, vueScripts))
-	}
+export function inspectPolicySources(sources: readonly PolicySource[]): readonly PolicyViolation[] {
+	const violations: PolicyViolation[] = []
+	for (const source of sources) violations.push(...inspectPolicySource(source))
 	return violations
 }
 
 /**
- * Read one workspace's declared package name.
+ * Read the complete TypeScript source population beneath one workspace.
  *
- * @param root - The workspace root holding the package manifest
- * @returns The declared package name
+ * @param root - The workspace root to read.
+ * @returns Every TypeScript source under the src and app axes, sorted by path.
  */
-export function readPackageName(root: string): string {
-	const manifest: unknown = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
-	const name =
-		typeof manifest === 'object' && manifest !== null && 'name' in manifest
-			? manifest.name
-			: undefined
-	if (typeof name !== 'string') throw new Error(`Package manifest at ${root} declares no name`)
-	return name
+export function readPolicySources(root: string): readonly PolicySource[] {
+	return globSync(POLICY_SOURCE_GLOB, { cwd: root })
+		.sort()
+		.map((path) => ({
+			path: normalizePolicyPath(path),
+			content: readFileSync(join(root, path), 'utf8'),
+		}))
 }
 
 /**
- * Derive the identifier prefixes fleet policy must not use from a package name.
+ * Derive the required source module for one mirrored module test.
  *
- * @param name - The declared package name, scoped or bare
- * @returns The short name's upper-snake and Pascal spellings, deduped
- *
- * @example
- * ```ts
- * derivePolicyTokens('@orkestrel/my-router') // ['MY_ROUTER', 'MyRouter']
- * ```
+ * @param path - The workspace-relative test path.
+ * @returns The required TypeScript source path, or `undefined` for a reserved scope test.
  */
-export function derivePolicyTokens(name: string): readonly string[] {
-	const short = name.slice(name.lastIndexOf('/') + 1)
-	const words = short.split(/[^A-Za-z0-9]+/u).filter((word) => word.length > 0)
-	const upper = words.map((word) => word.toUpperCase()).join('_')
-	const pascal = words.map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join('')
-	return [...new Set([upper, pascal])].filter((token) => token.length > 0)
+export function testToPolicySource(path: string): string | undefined {
+	const normalized = normalizePolicyPath(path)
+	if (basename(normalized) === 'integration.test.ts') return undefined
+	if (!normalized.startsWith('tests/') || !normalized.endsWith('.test.ts')) return undefined
+	return `${normalized.slice('tests/'.length, -'.test.ts'.length)}.ts`
 }
 
 /**
- * Add package-architecture violations while traversing one fleet policy source tree.
+ * Inspect mirrored test paths against an explicit source-path population.
  *
- * @remarks
- * An identifier carries a package's architecture when it is named for that package,
- * so it must begin with the token. A word that merely holds the token somewhere
- * inside it belongs to the fleet's own vocabulary and is left alone.
+ * @param tests - The module-test paths to inspect.
+ * @param sources - The existing TypeScript source paths.
+ * @returns Every missing mirror violation in test-path order.
  */
-export function inspectPolicyNode(
-	path: string,
-	node: ts.Node,
-	violations: string[],
-	tokens: readonly string[],
-): void {
-	if (ts.isIdentifier(node)) {
-		const token = tokens.find((candidate) => node.text.startsWith(candidate))
-		if (token !== undefined) {
-			violations.push(`${path}:${formatPolicyPosition(node)} forbids the ${token} package token`)
+export function inspectPolicyMirrorPaths(
+	tests: readonly string[],
+	sources: ReadonlySet<string>,
+): readonly PolicyViolation[] {
+	const violations: PolicyViolation[] = []
+	for (const test of tests) {
+		const path = normalizePolicyPath(test)
+		const source = testToPolicySource(path)
+		if (source !== undefined && !sources.has(source)) {
+			violations.push(
+				createPolicyViolation('mirror', path, `module test requires matching source ${source}`),
+			)
 		}
 	}
-	if (
-		(ts.isStringLiteral(node) || ts.isTemplateLiteralToken(node)) &&
-		POLICY_ENVIRONMENT_PATTERN.test(node.text)
-	) {
-		violations.push(
-			`${path}:${formatPolicyPosition(node)} forbids a source-environment path literal`,
-		)
-	}
-	ts.forEachChild(node, (child) => inspectPolicyNode(path, child, violations, tokens))
+	return violations
 }
 
 /**
- * Inspect one fleet policy module for a single package's architecture.
+ * Inspect every mirrored module test beneath one workspace.
  *
- * @param path - The workspace-relative source path used in diagnostics
- * @param content - The TypeScript source text to inspect
- * @param tokens - The package identifier tokens no identifier may begin with
- * @returns Every violation, in source-position order
+ * @param root - The workspace root to inspect.
+ * @returns Every missing mirror violation in test-path order.
  */
-export function inspectPolicyPurity(
-	path: string,
-	content: string,
-	tokens: readonly string[],
-): readonly string[] {
-	const violations: string[] = []
-	const source = ts.createSourceFile(path, content, ts.ScriptTarget.Latest, true)
-	inspectPolicyNode(path, source, violations, tokens)
-	return violations
+export function inspectPolicyMirrors(root: string): readonly PolicyViolation[] {
+	const tests = globSync(POLICY_TEST_GLOB, { cwd: root }).sort().map(normalizePolicyPath)
+	const sources = new Set(
+		globSync('{app,src}/**/*.ts', { cwd: root }).sort().map(normalizePolicyPath),
+	)
+	return inspectPolicyMirrorPaths(tests, sources)
+}
+
+/**
+ * Inspect source placement and test mirrors across one workspace.
+ *
+ * @param root - The workspace root to inspect.
+ * @returns Every source-placement and mirror violation.
+ */
+export function inspectPolicyWorkspace(root: string): readonly PolicyViolation[] {
+	return [...inspectPolicySources(readPolicySources(root)), ...inspectPolicyMirrors(root)]
 }
 
 /**
- * Inspect every fleet policy module under one workspace.
+ * Write a control to a real temporary workspace and run the production sweep over it.
  *
- * @param root - The workspace root whose manifest names the consuming package
- * @returns Every violation across the fleet policy files, in file and position order
+ * @param control - The physical fixture and expected rule boundary.
+ * @returns Every violation reported through the production workspace route.
  */
-export function inspectPolicyWorkspace(root: string): readonly string[] {
-	const tokens = derivePolicyTokens(readPackageName(root))
-	const violations: string[] = []
-	for (const path of POLICY_INFRASTRUCTURE_FILES) {
-		const content = readFileSync(join(root, path), 'utf8')
-		violations.push(...inspectPolicyPurity(path, content, tokens))
+export function inspectPolicyControl(control: PolicyControl): readonly PolicyViolation[] {
+	const root = mkdtempSync(join(tmpdir(), 'orkestrel-policy-'))
+	try {
+		for (const file of control.files) {
+			const path = join(root, ...normalizePolicyPath(file.path).split('/'))
+			mkdirSync(dirname(path), { recursive: true })
+			writeFileSync(path, file.content, 'utf8')
+		}
+		return inspectPolicyWorkspace(root)
+	} finally {
+		rmSync(root, { recursive: true, force: true })
 	}
-	return violations
 }
+
+/** Physical negative controls, one for each rule the instrument claims to enforce. */
+export const POLICY_CONTROLS: readonly PolicyControl[] = Object.freeze([
+	{
+		label: 'rejects a type outside types.ts',
+		membership: 'top-level type declarations whose filename is not types.ts',
+		rule: 'type',
+		files: [{ path: 'src/mobile/helpers.ts', content: 'export interface ValueInterface {}\n' }],
+	},
+	{
+		label: 'rejects an inline function in routes.ts',
+		membership: 'module-level function syntax whose filename is absent from the function register',
+		rule: 'function',
+		files: [
+			{
+				path: 'src/worker/routes.ts',
+				content: 'export const ROUTES = Object.freeze([{ handler: () => undefined }])\n',
+			},
+		],
+	},
+	{
+		label: 'rejects data in handlers.ts',
+		membership: 'module data whose filename is absent from the data register',
+		rule: 'data',
+		files: [{ path: 'app/edge/handlers.ts', content: "export const STATUS = 'ready'\n" }],
+	},
+	{
+		label: 'rejects a hidden centralized declaration',
+		membership: 'centralized declarations without an export modifier',
+		rule: 'export',
+		files: [{ path: 'src/worker/helpers.ts', content: 'function buildValue(): void {}\n' }],
+	},
+	{
+		label: 'rejects a class that differs from its file',
+		membership: 'class declarations outside errors.ts whose names differ from their filename',
+		rule: 'class',
+		files: [{ path: 'app/desktop/Widget.ts', content: 'export class Other {}\n' }],
+	},
+	{
+		label: 'rejects mutable constants',
+		membership: 'variable statements in constants.ts that are not const',
+		rule: 'constant',
+		files: [{ path: 'src/worker/constants.ts', content: 'export let COUNT = 1\n' }],
+	},
+	{
+		label: 'rejects lower-case constants',
+		membership: 'declarations in constants.ts whose names are not UPPER_SNAKE_CASE',
+		rule: 'constant',
+		files: [{ path: 'src/worker/constants.ts', content: 'export const count = 1\n' }],
+	},
+	{
+		label: 'rejects bare collection constants',
+		membership: 'declarations in constants.ts with direct array or object literal initializers',
+		rule: 'constant',
+		files: [{ path: 'src/worker/constants.ts', content: 'export const VALUES = []\n' }],
+	},
+	{
+		label: 'rejects a parser without the parse prefix',
+		membership: 'function declarations in parsers.ts whose names do not start with parse',
+		rule: 'parser',
+		files: [{ path: 'app/edge/parsers.ts', content: 'export function coerceValue(): void {}\n' }],
+	},
+	{
+		label: 'rejects a factory without the create prefix',
+		membership: 'function declarations in factories.ts whose names do not start with create',
+		rule: 'factory',
+		files: [{ path: 'app/edge/factories.ts', content: 'export function buildValue(): void {}\n' }],
+	},
+	{
+		label: 'rejects a malformed registered function module',
+		membership: 'direct camelCase modules in a registered function-domain folder',
+		rule: 'domain',
+		files: [
+			{
+				path: 'app/browser/composables/useTheme.ts',
+				content: 'export function useMode(): void {}\n',
+			},
+		],
+	},
+	{
+		label: 'rejects a file named for a function domain',
+		membership: 'source files whose stem is registered as a function-domain folder name',
+		rule: 'domain',
+		files: [{ path: 'app/edge/composables.ts', content: '' }],
+	},
+	{
+		label: 'rejects a function in an unregistered domain',
+		membership: 'function modules whose parent path is absent from the domain register',
+		rule: 'function',
+		files: [
+			{ path: 'src/worker/jobs/runTask.ts', content: 'export function runTask(): void {}\n' },
+		],
+	},
+	{
+		label: 'rejects an unmirrored module test',
+		membership: 'module tests below tests/src or tests/app except integration.test.ts',
+		rule: 'mirror',
+		files: [
+			{
+				path: 'tests/app/worker/jobs/probe.test.ts',
+				content: "import { it } from 'vitest'\nit('runs', () => {})\n",
+			},
+		],
+	},
+])
+
+/** A differently shaped workspace with app, browser, and worker environments but no core. */
+export const GENERIC_POLICY_SOURCES: readonly PolicySource[] = Object.freeze([
+	{
+		path: 'src/worker/types.ts',
+		content: 'export interface TaskInterface { readonly id: string }\n',
+	},
+	{ path: 'src/worker/Worker.ts', content: 'export class Worker {}\n' },
+	{
+		path: 'app/browser/composables/useTheme.ts',
+		content: 'export function useTheme(): void {}\n',
+	},
+	{ path: 'app/browser/handlers.ts', content: 'export function open(): void {}\n' },
+	{
+		path: 'app/browser/routes.ts',
+		content:
+			"import { open } from './handlers.js'\nexport const ROUTES = Object.freeze([{ method: 'GET', path: '/', handler: open }])\n",
+	},
+	{
+		path: 'src/worker/constants.ts',
+		content: "export const LABELS = Object.freeze(['ready'])\n",
+	},
+])