@systemfsoftware/oxlint-plugin-test-discipline 3.8.1 → 4.0.0

package/dist/index.mjs

@@ -8,7 +8,7 @@ const EMIT_CALLEES = [
 ];
 const EXPECTED$3 = "a span declared once with Span.declare({ id, name, attrs }) and started through the start(attrs) it returns";
 const FIX$3 = "declare the span with Span.declare({ id, name, attrs }) and emit it with SomeSpan.start(attrs)";
-const meta$25 = {
+const meta$28 = {
 	type: "problem",
 	docs: { description: "Ban a raw span name passed to an emit API (startSpan, spanBuilder, startActiveSpan). Span names enter through Span.declare, never as a literal at the emit site." },
 	schema: [],
@@ -18,14 +18,14 @@ const meta$25 = {
 //#region src/rules/ban-raw-span-name-emit.ts
 const INTERPOLATION = "${}";
 const isEmitCallee$1 = (name) => EMIT_CALLEES.some((emit) => emit === name);
-const memberPropertyName = (callee) => {
+const memberPropertyName$1 = (callee) => {
 	if (callee.computed) return null;
 	if (callee.property.type !== "Identifier") return null;
 	return callee.property.name;
 };
-const calleeName$1 = (callee) => {
+const calleeName$2 = (callee) => {
 	if (callee.type === "Identifier") return callee.name;
-	if (callee.type === "MemberExpression") return memberPropertyName(callee);
+	if (callee.type === "MemberExpression") return memberPropertyName$1(callee);
 	return null;
 };
 const templateName = (node) => node.quasis.map((quasi) => quasi.value.raw).join(INTERPOLATION);
@@ -39,7 +39,7 @@ const argName = (arg) => {
 	return inlineName(arg);
 };
 const inspect = (node) => {
-	const callee = calleeName$1(node.callee);
+	const callee = calleeName$2(node.callee);
 	if (callee === null || !isEmitCallee$1(callee)) return null;
 	const name = argName(node.arguments[0]);
 	if (name === null) return null;
@@ -49,7 +49,7 @@ const inspect = (node) => {
 	};
 };
 const banRawSpanNameEmit = defineRule({
-	meta: meta$25,
+	meta: meta$28,
 	create(context) {
 		return { CallExpression(node) {
 			const emitCall = inspect(node);
@@ -71,6 +71,7 @@ const banRawSpanNameEmit = defineRule({
 //#endregion
 //#region src/rules/path.config.ts
 const TEST_BASENAME = /\.(?:test|spec)\.[cm]?tsx?$/;
+const TYPE_TEST_BASENAME = /\.tst\.[cm]?tsx?$/;
 const SANCTIONED_TEST_DIRS = /* @__PURE__ */ new Set(["tests"]);
 /**
 * The only test location sanctioned under `src/`. A workflow property test
@@ -80,7 +81,6 @@ const SANCTIONED_TEST_DIRS = /* @__PURE__ */ new Set(["tests"]);
 const NESTED_TEST_DIR = "__tests__";
 const TEST_TREE_DIRS = /* @__PURE__ */ new Set([...SANCTIONED_TEST_DIRS, NESTED_TEST_DIR]);
 const PROPERTY_SUFFIX = ".property.test.ts";
-const INTEGRATION_SUFFIX = ".integration.test.ts";
 const DIFFERENTIAL_SUFFIX = ".differential.test.ts";
 /**
 * Forbidden outright. A schema's laws are generated, so a hand-written
@@ -97,26 +97,42 @@ const SCHEMA_SUFFIX = ".schema.test.ts";
 const WORKFLOW_TEST_BASENAME = /^[^.]+\.workflow\.property\.test\.ts$/;
 const GHERKIN_PACKAGE = "@systemfsoftware/effect-gherkin-spec";
 const DIFFERENTIAL_PACKAGE = "@systemfsoftware/differential-spec";
+const CONFORMANCE_PACKAGE = "@systemfsoftware/conformance-spec";
 const TRACE_SPEC_PACKAGE = "@systemfsoftware/trace-spec";
-const FOREIGN_RUNNERS = /* @__PURE__ */ new Set(["vitest", "@effect/vitest"]);
+const LAWFUL_RUNNER = "@systemfsoftware/vitest";
+const FOREIGN_VITEST_SOURCES = {
+	"vitest": true,
+	"@effect/vitest": true
+};
+/** Runners a harness-owned test (Gherkin, conformance, differential) must not import directly. */
+const FOREIGN_RUNNERS = {
+	...FOREIGN_VITEST_SOURCES,
+	[LAWFUL_RUNNER]: true
+};
+/** Packages whose own tests drive Vitest directly: the runner and its conformance harness. */
+const RAW_VITEST_PACKAGES = {
+	"effect-spec-runtime": true,
+	"vitest": true,
+	"vitest-conformance": true
+};
 const RUNNER_NAMES = /* @__PURE__ */ new Set([
 	"it",
 	"test",
 	"describe"
 ]);
-const MESSAGE$7 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const MESSAGE$8 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
 const ABSENCE_MESSAGE = "{{name}} is untested. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
 //#endregion
 //#region src/rules/behaviour-exercises-use-case.config.ts
 const NO_SUBJECT_IMPORT_NAME = "a *.integration.test.ts that reaches no package code";
 const NO_SUBJECT_IMPORT_EXPECTED = "an import of the package code under test";
-const NO_SUBJECT_IMPORT_ACTUAL = "a behaviour file whose every runtime import is vitest, @effect/vitest, the gherkin spec package, effect, a Node builtin, or the file itself";
+const NO_SUBJECT_IMPORT_ACTUAL = "a behaviour file whose every runtime import is vitest, @effect/vitest, @systemfsoftware/vitest, the gherkin spec package, effect, a Node builtin, or the file itself";
 const NO_SUBJECT_IMPORT_FIX = "a behaviour test exercises a use case, so it has to reach the package. A file that imports nothing but its runner and effect is asserting over values it built in the same file. Ask whether the assertion tests anything at all: if it restates a literal, delete the scenario; if it states an invariant that holds over generated inputs, move it to a *.property.test.ts beside the cell that decides it. Type-only imports never count - they are erased before anything runs - while a side-effect import (import \"../src/x.js\", import {} from \"../src/x.js\") does count, because it executes that module.";
-const meta$24 = {
+const meta$27 = {
 	type: "problem",
 	docs: { description: "A *.integration.test.ts must import the package under test, not only its runner and effect, so the scenario exercises code that ships rather than values the test built itself." },
 	schema: [],
-	messages: { noSubjectImport: MESSAGE$7 }
+	messages: { noSubjectImport: MESSAGE$8 }
 };
 //#endregion
 //#region src/rules/path.ts
@@ -126,6 +142,7 @@ const basenameOf = (filename) => Array$1.lastNonEmpty(segmentsOf(filename));
 /** Directory segments only — the basename never counts as a directory. */
 const directoriesOf = (filename) => Array$1.initNonEmpty(segmentsOf(filename));
 const isUnderSrc = (filename) => directoriesOf(filename).includes("src");
+const isRawVitestPackage = (filename) => directoriesOf(filename).some((segment) => RAW_VITEST_PACKAGES[segment] === true);
 const isInSanctionedTestDir = (filename) => directoriesOf(filename).some((segment) => SANCTIONED_TEST_DIRS.has(segment));
 const isInTestsImportScope = (filename) => {
 	const segments = segmentsOf(filename);
@@ -135,13 +152,14 @@ const isInTestsImportScope = (filename) => {
 };
 const isInConfiguredTestDir = (filename, dirs) => directoriesOf(filename).some((segment) => dirs.includes(segment));
 const isTestFile = (basename) => TEST_BASENAME.test(basename);
+const isBehaviourBasename = (basename) => basename.endsWith(".integration.test.ts") || basename.endsWith(".contract.test.ts");
 const CELL_SUFFIX = /\.([^.]+)\.[cm]?tsx?$/;
 const cellOf = (basename) => CELL_SUFFIX.exec(basename)?.[1];
 //#endregion
 //#region src/rules/behaviour-exercises-use-case.ts
 const EFFECT_PACKAGE = "effect";
 const FOUNDATION_PACKAGES = /* @__PURE__ */ new Set([
-	...FOREIGN_RUNNERS,
+	...Object.keys(FOREIGN_RUNNERS),
 	GHERKIN_PACKAGE,
 	EFFECT_PACKAGE
 ]);
@@ -164,7 +182,6 @@ const isFoundationImport = (source, filename) => {
 	if (source === "@systemfsoftware/effect-gherkin-spec" && isGherkinPackageTree(filename)) return false;
 	return FOUNDATION_PACKAGES.has(source) || source.startsWith(`${EFFECT_PACKAGE}/`) || source.startsWith("node:");
 };
-const isBehaviourTest$3 = (basename) => basename.endsWith(INTEGRATION_SUFFIX);
 /** The stem of a path with its final extension stripped, for identity comparisons. */
 const stemOf = (file) => file.replace(/\.[^/]+$/, "");
 /**
@@ -216,16 +233,17 @@ const DIST_SEGMENT = /(?:^|\/)dist\//;
 * name documents it for the reader without pretending to be evidence.
 *
 * What counts as reaching: a runtime import from anything that is not the
-* scaffolding - vitest, @effect/vitest, the gherkin spec package, effect or a
-* subpath of it, or a Node builtin - and not the test file itself, or a dynamic
-* `import(...)` of such a source. Type-only specifiers are erased and never
-* count; a side-effect import (`import "./x.js"`, `import {} from "./x.js"`)
-* executes its module and counts for whatever that module is. Whether a named
-* module actually exists is not observable from one file, so an import whose
-* path names nothing satisfies the rule the same way a real one does.
+* scaffolding - vitest, @effect/vitest, @systemfsoftware/vitest, the gherkin
+* spec package, effect or a subpath of it, or a Node builtin - and not the test
+* file itself, or a dynamic `import(...)` of such a source. Type-only
+* specifiers are erased and never count; a side-effect import (`import
+* "./x.js"`, `import {} from "./x.js"`) executes its module and counts for
+* whatever that module is. Whether a named module actually exists is not
+* observable from one file, so an import whose path names nothing satisfies the
+* rule the same way a real one does.
 */
 const behaviourExercisesUseCase = defineRule({
-	meta: meta$24,
+	meta: meta$27,
 	create(context) {
 		let reached = false;
 		return {
@@ -240,7 +258,7 @@ const behaviourExercisesUseCase = defineRule({
 				if (typeof node.value === "string" && DIST_SEGMENT.test(node.value)) reached = true;
 			},
 			"Program:exit"(node) {
-				if (!isBehaviourTest$3(basenameOf(context.filename))) return;
+				if (!isBehaviourBasename(basenameOf(context.filename))) return;
 				if (reached) return;
 				for (const statement of node.body) {
 					if (statement.type !== "ImportDeclaration") continue;
@@ -275,13 +293,13 @@ const TOO_MANY_FEATURES_NAME = "a *.integration.test.ts accumulating multiple Fe
 const TOO_MANY_FEATURES_EXPECTED = "exactly one Feature(...) — every additional one signals a junk drawer";
 const TOO_MANY_FEATURES_ACTUAL = "a behaviour file with two or more Feature(...) calls";
 const TOO_MANY_FEATURES_FIX = "splitting a junk drawer into several smaller junk drawers is not an improvement. When separating scenarios surfaces assertions that restate a pure function return value — change detectors against a lookup table or constant — those get deleted, not rehoused. Each surviving capability keeps its own file with exactly one Feature.";
-const meta$23 = {
+const meta$26 = {
 	type: "problem",
 	docs: { description: "A *.integration.test.ts must contain exactly one Feature(...) call. Zero or two-or-more is the junk-drawer signal that produced 41 scenarios of pure-function assertions in a single file." },
 	schema: [],
 	messages: {
-		tooFewFeatures: MESSAGE$7,
-		tooManyFeatures: MESSAGE$7
+		tooFewFeatures: MESSAGE$8,
+		tooManyFeatures: MESSAGE$8
 	}
 };
 //#endregion
@@ -300,7 +318,6 @@ const isFeatureCallStatement = (statement) => {
 	if (statement.expression.type !== "CallExpression") return false;
 	return rootCalleeName(statement.expression.callee) === "Feature";
 };
-const isBehaviourTest$2 = (basename) => basename.endsWith(INTEGRATION_SUFFIX);
 const findSecondFeatureCall = (program) => {
 	let seen = 0;
 	for (const statement of program.body) {
@@ -320,10 +337,10 @@ const hasAnyFeatureCall = (program) => {
 	return false;
 };
 const behaviourOneFeaturePerFile = defineRule({
-	meta: meta$23,
+	meta: meta$26,
 	create(context) {
 		return { "Program:exit"(node) {
-			if (!isBehaviourTest$2(basenameOf(context.filename))) return;
+			if (!isBehaviourBasename(basenameOf(context.filename))) return;
 			const excess = findSecondFeatureCall(node);
 			if (excess !== null) {
 				const total = countFeatureCalls(node);
@@ -355,19 +372,19 @@ const behaviourOneFeaturePerFile = defineRule({
 //#endregion
 //#region src/rules/behaviour-test-requires-gherkin.config.ts
 const FOREIGN_RUNNER_EXPECTED = "it and layer imported from @systemfsoftware/effect-gherkin-spec";
-const FOREIGN_RUNNER_ACTUAL = "a test runner imported directly from vitest or @effect/vitest in a behaviour file";
-const FOREIGN_RUNNER_FIX = "import { it, layer } from @systemfsoftware/effect-gherkin-spec and build the suite with makeFeature({ it, layer })";
+const FOREIGN_RUNNER_ACTUAL = "a test runner imported directly from vitest, @effect/vitest or @systemfsoftware/vitest in a behaviour file";
+const FOREIGN_RUNNER_FIX = "import { it } from @systemfsoftware/effect-gherkin-spec and build the suite with makeFeature({ it })";
 const MISSING_MAKE_FEATURE_NAME = "a *.integration.test.ts without makeFeature";
 const MISSING_MAKE_FEATURE_EXPECTED = "makeFeature imported from @systemfsoftware/effect-gherkin-spec";
 const MISSING_MAKE_FEATURE_ACTUAL = "a behaviour file that never constructs a Gherkin feature";
 const MISSING_MAKE_FEATURE_FIX = "import { makeFeature } from @systemfsoftware/effect-gherkin-spec and declare `const Feature = makeFeature({ it, layer })`";
-const meta$22 = {
+const meta$25 = {
 	type: "problem",
-	docs: { description: "A *.integration.test.ts must drive its suite through makeFeature from @systemfsoftware/effect-gherkin-spec and must not import test runners from vitest or @effect/vitest." },
+	docs: { description: "A *.integration.test.ts must drive its suite through makeFeature from @systemfsoftware/effect-gherkin-spec and must not import test runners from vitest, @effect/vitest or @systemfsoftware/vitest." },
 	schema: [],
 	messages: {
-		foreignRunner: MESSAGE$7,
-		missingMakeFeature: MESSAGE$7
+		foreignRunner: MESSAGE$8,
+		missingMakeFeature: MESSAGE$8
 	}
 };
 //#endregion
@@ -387,13 +404,12 @@ const foreignRunnerNameOf = (specifier) => {
 	const { name } = Schema.decodeSync(ImportedIdentifier)(specifier.imported);
 	return RUNNER_NAMES.has(name) ? name : null;
 };
-const isBehaviourTest$1 = (basename) => basename.endsWith(INTEGRATION_SUFFIX);
 const behaviourTestRequiresGherkin = defineRule({
-	meta: meta$22,
+	meta: meta$25,
 	create(context) {
 		const basename = basenameOf(context.filename);
 		return { Program(node) {
-			if (!isBehaviourTest$1(basename)) return;
+			if (!isBehaviourBasename(basename)) return;
 			let hasMakeFeature = false;
 			for (const statement of node.body) {
 				if (statement.type !== "ImportDeclaration") continue;
@@ -402,7 +418,7 @@ const behaviourTestRequiresGherkin = defineRule({
 					if (specifier.type !== "ImportSpecifier") continue;
 					if (isMakeFeatureSpecifier(specifier)) hasMakeFeature = true;
 				}
-				if (!FOREIGN_RUNNERS.has(sourceValue)) continue;
+				if (FOREIGN_RUNNERS[sourceValue] !== true) continue;
 				for (const specifier of statement.specifiers) {
 					if (specifier.type !== "ImportSpecifier") continue;
 					const runnerName = foreignRunnerNameOf(specifier);
@@ -432,6 +448,145 @@ const behaviourTestRequiresGherkin = defineRule({
 		} };
 	}
 });
+const HARNESS_MEMBERS = {
+	linearizable: true,
+	sequential: true,
+	released: true
+};
+const LEGACY_CHECK_MEMBER = "check";
+const HARNESS_PRESCRIPTION$2 = "import { Conformance } from @systemfsoftware/conformance-spec and express the test as Conformance.linearizable(implementation, { commands, model, run, fibers, operations }) in the scenario body";
+const meta$24 = {
+	type: "problem",
+	docs: { description: "Conformance tests must use the @systemfsoftware/conformance-spec Conformance barrel: Conformance.linearizable, Conformance.sequential, or Conformance.released. Raw runner calls (it, test, describe, and member forms like it.effect) and direct runner imports are forbidden in *.conformance.test.ts files; the retired Linearizable.check / SequentialModel.check / Released.check shapes are rejected, and importing Conformance without invoking a check is equally non-compliant." },
+	schema: [],
+	messages: {
+		rawRunnerCall: MESSAGE$8,
+		runnerImport: MESSAGE$8,
+		missingHarnessImport: MESSAGE$8,
+		legacyHarnessCall: MESSAGE$8,
+		missingHarnessUsage: MESSAGE$8
+	}
+};
+//#endregion
+//#region src/rules/conformance-test-requires-harness.ts
+const memberObjectName$1 = (callee) => callee.type === "MemberExpression" && callee.object.type === "Identifier" ? callee.object.name : void 0;
+const memberPropertyName = (callee) => callee.type === "MemberExpression" && callee.property.type === "Identifier" ? callee.property.name : void 0;
+const memberName = (callee) => callee.type === "Identifier" ? callee.name : memberPropertyName(callee);
+const calleeName$1 = (callee) => callee.type === "Identifier" ? callee.name : memberObjectName$1(callee);
+const isRawRunnerCall = (callee) => {
+	const name = calleeName$1(callee);
+	return name !== void 0 && RUNNER_NAMES.has(name);
+};
+const isForeignRunnerImport$1 = (node) => typeof node.source.value === "string" && FOREIGN_RUNNERS[node.source.value] === true;
+const namesConformanceExport = (specifier) => specifier.imported.type === "Identifier" && specifier.imported.name === "Conformance";
+const recordBindings = (node, packageBindings, conformanceBindings) => {
+	if (node.source.value !== "@systemfsoftware/conformance-spec") return;
+	for (const specifier of node.specifiers) {
+		packageBindings.add(specifier.local.name);
+		if (specifier.type === "ImportSpecifier" && namesConformanceExport(specifier)) conformanceBindings.add(specifier.local.name);
+	}
+};
+const isHarnessInvocation = (callee, conformanceBindings) => {
+	const member = memberName(callee);
+	const root = calleeName$1(callee);
+	return member !== void 0 && HARNESS_MEMBERS[member] === true && root !== void 0 && conformanceBindings.has(root);
+};
+const isLegacyCheck = (callee, packageBindings) => {
+	const root = calleeName$1(callee);
+	return memberName(callee) === "check" && root !== void 0 && packageBindings.has(root);
+};
+const legacyCallText = (callee) => callee.type === "Identifier" ? callee.name : `${calleeName$1(callee)}.${LEGACY_CHECK_MEMBER}`;
+const legacyCheckError = (callee) => ({
+	messageId: "legacyHarnessCall",
+	data: {
+		name: `a .${LEGACY_CHECK_MEMBER}(...) call in a conformance test file`,
+		expected: HARNESS_PRESCRIPTION$2,
+		actual: `${legacyCallText(callee)} is not a check the barrel exposes`,
+		fix: HARNESS_PRESCRIPTION$2
+	}
+});
+const conformanceTestRequiresHarness = defineRule({
+	meta: meta$24,
+	create(context) {
+		if (!context.filename.endsWith(".conformance.test.ts")) return {};
+		const packageBindings = /* @__PURE__ */ new Set();
+		const conformanceBindings = /* @__PURE__ */ new Set();
+		let violations = 0;
+		let hasHarnessInvocation = false;
+		return {
+			ImportDeclaration(node) {
+				if (isForeignRunnerImport$1(node)) {
+					context.report({
+						node,
+						messageId: "runnerImport",
+						data: {
+							name: `runner import from ${String(node.source.value)} in a conformance test file`,
+							expected: HARNESS_PRESCRIPTION$2,
+							actual: "a direct vitest / @effect/vitest / @systemfsoftware/vitest runner import bypasses the conformance check",
+							fix: `delete the runner import; ${HARNESS_PRESCRIPTION$2}`
+						}
+					});
+					violations += 1;
+					return;
+				}
+				recordBindings(node, packageBindings, conformanceBindings);
+			},
+			CallExpression(node) {
+				if (isRawRunnerCall(node.callee)) {
+					const name = calleeName$1(node.callee) ?? "";
+					context.report({
+						node,
+						messageId: "rawRunnerCall",
+						data: {
+							name: `raw runner call (${name}) in a conformance test file`,
+							expected: HARNESS_PRESCRIPTION$2,
+							actual: `${name}(...) bypasses the conformance check`,
+							fix: `rewrite using ${HARNESS_PRESCRIPTION$2}`
+						}
+					});
+					violations += 1;
+					return;
+				}
+				if (isHarnessInvocation(node.callee, conformanceBindings)) {
+					hasHarnessInvocation = true;
+					return;
+				}
+				if (isLegacyCheck(node.callee, packageBindings)) {
+					context.report({
+						node,
+						...legacyCheckError(node.callee)
+					});
+					violations += 1;
+				}
+			},
+			"Program:exit"(node) {
+				if (packageBindings.size === 0) {
+					context.report({
+						node,
+						messageId: "missingHarnessImport",
+						data: {
+							name: `conformance test file without the ${CONFORMANCE_PACKAGE} import`,
+							expected: HARNESS_PRESCRIPTION$2,
+							actual: "no conformance check import found",
+							fix: HARNESS_PRESCRIPTION$2
+						}
+					});
+					return;
+				}
+				if (!hasHarnessInvocation && violations === 0) context.report({
+					node,
+					messageId: "missingHarnessUsage",
+					data: {
+						name: `conformance test file imports ${CONFORMANCE_PACKAGE} but never invokes it`,
+						expected: HARNESS_PRESCRIPTION$2,
+						actual: "no Conformance.linearizable, Conformance.sequential, or Conformance.released call runs",
+						fix: HARNESS_PRESCRIPTION$2
+					}
+				});
+			}
+		};
+	}
+});
 //#endregion
 //#region src/rules/damp-test-naming.config.ts
 const PASCAL_CASE$1 = /^[A-Z][a-z][a-zA-Z0-9]*$/;
@@ -452,7 +607,7 @@ const INVALID_BEHAVIOR_CASE_FIX = "Convert behavior to PascalCase (e.g., throwEr
 const INVALID_CONDITION_CASE_FIX = "Convert condition to PascalCase (e.g., passwordInvalid → PasswordInvalid)";
 const EMPTY_BEHAVIOR_ACTUAL = "Empty string between Should_ and _When_";
 const EMPTY_CONDITION_ACTUAL = "Empty string after _When_";
-const meta$21 = {
+const meta$23 = {
 	type: "suggestion",
 	docs: { description: "Enforce DAMP (Descriptive and Meaningful Phrases) test naming format: Should_[ExpectedBehavior]_When_[Condition]" },
 	schema: [],
@@ -532,8 +687,9 @@ const isTestFunctionCall = (node) => {
 	return false;
 };
 const dampTestNaming = defineRule({
-	meta: meta$21,
+	meta: meta$23,
 	create(context) {
+		if (TYPE_TEST_BASENAME.test(basenameOf(context.filename))) return {};
 		return { CallExpression(node) {
 			if (!isTestFunctionCall(node)) return;
 			const firstArg = node.arguments[0];
@@ -555,7 +711,7 @@ const dampTestNaming = defineRule({
 });
 //#endregion
 //#region src/rules/differential-test-requires-harness.config.ts
-const meta$20 = {
+const meta$22 = {
 	type: "problem",
 	docs: { description: "Differential tests must use @systemfsoftware/differential-spec harness. Raw runner calls (it, test, describe, and member forms like it.effect) and direct runner imports are forbidden in *.differential.test.ts files; importing the harness without invoking it is equally non-compliant." },
 	schema: [],
@@ -568,16 +724,16 @@ const meta$20 = {
 };
 //#endregion
 //#region src/rules/differential-test-requires-harness.ts
-const HARNESS_PRESCRIPTION$1 = "import { Differential, Metamorphic } from @systemfsoftware/differential-spec and express the test as Differential.compare({ reference, candidate }).on(arb).assert(oracle) or Metamorphic.on(system).relation({ transformInput, assertOutput }).on(arb)";
+const HARNESS_PRESCRIPTION$1 = "import { Differential, Metamorphic } from @systemfsoftware/differential-spec and express the test as Differential.compare({ name, reference, candidate }).on(arb).assert(oracle) or Metamorphic.on({ name, system }).relation({ transformInput, assertOutput }).on(arb)";
 const memberObjectName = (callee) => callee.type === "MemberExpression" && callee.object.type === "Identifier" ? callee.object.name : void 0;
 const calleeName = (callee) => callee.type === "Identifier" ? callee.name : memberObjectName(callee);
 const recordHarnessBindings = (node, bindings) => {
 	if (node.source.value !== "@systemfsoftware/differential-spec") return;
 	for (const specifier of node.specifiers) bindings.add(specifier.local.name);
 };
-const isForeignRunnerImport = (node) => typeof node.source.value === "string" && FOREIGN_RUNNERS.has(node.source.value);
+const isForeignRunnerImport = (node) => typeof node.source.value === "string" && FOREIGN_RUNNERS[node.source.value] === true;
 const differentialTestRequiresHarness = defineRule({
-	meta: meta$20,
+	meta: meta$22,
 	create(context) {
 		if (!context.filename.endsWith(".differential.test.ts")) return {};
 		const harnessBindings = /* @__PURE__ */ new Set();
@@ -592,7 +748,7 @@ const differentialTestRequiresHarness = defineRule({
 						data: {
 							name: `runner import from ${String(node.source.value)} in a differential test file`,
 							expected: HARNESS_PRESCRIPTION$1,
-							actual: "a direct vitest / @effect/vitest runner import bypasses the differential oracle",
+							actual: "a direct vitest / @effect/vitest / @systemfsoftware/vitest runner import bypasses the differential oracle",
 							fix: `delete the runner import; ${HARNESS_PRESCRIPTION$1}`
 						}
 					});
@@ -653,11 +809,11 @@ const NON_PROP_CALL_NAME = "a non-property test call inside an `import.meta.vite
 const NON_PROP_CALL_EXPECTED = "only `it.prop` or `it.effect.prop` member-chain calls (standard modifiers included) with boolean predicates";
 const NON_PROP_CALL_ACTUAL = "a bare or member-chain test call other than `it.prop`/`it.effect.prop`";
 const NON_PROP_CALL_FIX = "delete the block — non-property in-source tests belong nowhere in `src/`; re-home a meaningful example through the cell public export as `*.integration.test.ts`, or rewrite a real invariant as `it.prop` over a schema-derived arbitrary";
-const meta$19 = {
+const meta$21 = {
 	type: "problem",
 	docs: { description: "In-source `if (import.meta.vitest)` blocks under src/ must contain only `it.prop` or `it.effect.prop` calls; every other test call fails — delete the block or rewrite the invariant as a property." },
 	schema: [],
-	messages: { nonPropCall: MESSAGE$7 }
+	messages: { nonPropCall: MESSAGE$8 }
 };
 //#endregion
 //#region src/rules/vitest-guard.ts
@@ -717,7 +873,7 @@ const rootNameOf = (node) => {
 	if (node.type === "CallExpression") return rootNameOf(node.callee);
 };
 const inSourceTestPropOnly = defineRule({
-	meta: meta$19,
+	meta: meta$21,
 	create(context) {
 		const filename = context.filename;
 		const basename = basenameOf(filename);
@@ -758,17 +914,17 @@ const NOT_MODULE_LEVEL_NAME = "a nested `import.meta.vitest` block";
 const NOT_MODULE_LEVEL_EXPECTED = "the in-source test block as a direct statement of the module body";
 const NOT_MODULE_LEVEL_ACTUAL = "an `import.meta.vitest` block nested inside another statement";
 const NOT_MODULE_LEVEL_FIX = "move the block to module level — a nested block does not run under vitest includeSource";
-const NO_PRIVATE_TARGET_NAME = "an `import.meta.vitest` block touching no private binding";
-const NO_PRIVATE_TARGET_EXPECTED = "an in-source test exercising a non-exported module-level binding";
-const NO_PRIVATE_TARGET_ACTUAL = "an in-source block referencing only exported or imported names";
+const NO_PRIVATE_TARGET_NAME = "an `import.meta.vitest` block touching no module-level binding";
+const NO_PRIVATE_TARGET_EXPECTED = "an in-source test exercising this module's own code — a private helper, or a module-level function the lawful prop's `subject` names";
+const NO_PRIVATE_TARGET_ACTUAL = "an in-source block referencing only exported-call or imported names";
 const NO_PRIVATE_TARGET_FIX = "test the public surface from tests/ as *.integration.test.ts; in-source blocks exist for private helpers only — if the public behaviour you meant to cover is a pure function, delete the assertion: the type system already proves it";
-const meta$18 = {
+const meta$20 = {
 	type: "problem",
 	docs: { description: "In-source `if (import.meta.vitest)` blocks under src/ must be at module level and exercise at least one non-exported binding; other tests belong in tests/." },
 	schema: [],
 	messages: {
-		notModuleLevel: MESSAGE$7,
-		noPrivateTarget: MESSAGE$7
+		notModuleLevel: MESSAGE$8,
+		noPrivateTarget: MESSAGE$8
 	}
 };
 //#endregion
@@ -795,8 +951,25 @@ const collectPrivateNames = (body, out) => {
 		if (isCollectable(node)) collectDeclaration(node, out);
 	}
 };
+const collectModuleNames = (body, out) => {
+	for (const node of body) {
+		if (node.type === "ExportNamedDeclaration") {
+			if (node.source === null && node.declaration !== null && isCollectable(node.declaration)) collectDeclaration(node.declaration, out);
+			continue;
+		}
+		if (node.type === "ExportDefaultDeclaration" && isCollectable(node.declaration)) {
+			collectDeclaration(node.declaration, out);
+			continue;
+		}
+		if (isCollectable(node)) collectDeclaration(node, out);
+	}
+};
+const isSubjectValue = (node) => {
+	const parent = node.parent;
+	return parent.type === "Property" && parent.computed !== true && parent.key.type === "Identifier" && parent.key.name === "subject" && parent.value === node;
+};
 const inSourceTestTargetsPrivate = defineRule({
-	meta: meta$18,
+	meta: meta$20,
 	create(context) {
 		const filename = context.filename;
 		const basename = basenameOf(filename);
@@ -804,10 +977,12 @@ const inSourceTestTargetsPrivate = defineRule({
 		const inTestFile = isTestFile(basename);
 		if (!underSrc || inTestFile) return {};
 		const privateNames = /* @__PURE__ */ new Set();
+		const moduleNames = /* @__PURE__ */ new Set();
 		const guards = [];
 		return {
 			Program(node) {
 				collectPrivateNames(node.body, privateNames);
+				collectModuleNames(node.body, moduleNames);
 			},
 			IfStatement(node) {
 				if (!isVitestGuard(node.test)) return;
@@ -830,7 +1005,7 @@ const inSourceTestTargetsPrivate = defineRule({
 				});
 			},
 			Identifier(node) {
-				if (!privateNames.has(node.name)) return;
+				if (!(privateNames.has(node.name) || moduleNames.has(node.name) && isSubjectValue(node))) return;
 				const guard = guards.find((g) => isInsideConsequent(node, g.node.consequent));
 				if (guard !== void 0) guard.hit = true;
 			},
@@ -853,16 +1028,132 @@ const inSourceTestTargetsPrivate = defineRule({
 	}
 });
 //#endregion
+//#region src/rules/model-fixture-imports-subject.config.ts
+const SUBJECT_IMPORT_NAME = "a *.model.ts fixture that imports the package under test";
+const SUBJECT_IMPORT_EXPECTED = "a pure model that imports only effect, node builtins, and harness types";
+const SUBJECT_IMPORT_FIX = "delete the import; the model derives its state from the declared Schema it is given, so it needs no symbol from the package it stands in for";
+const RELATIVE_ESCAPE_NAME = "a *.model.ts fixture that climbs out of the tests tree";
+const RELATIVE_ESCAPE_EXPECTED = "a relative import that stays inside the tests tree — a sibling fixture under tests/__fixtures__/";
+const RELATIVE_ESCAPE_FIX = "import the sibling fixture with ./<name>.js, or move the model; a model that reaches src/ is the implementation checking itself";
+const meta$19 = {
+	type: "problem",
+	docs: { description: "A *.model.ts fixture is the pure model a conformance check stands the implementation against, so it may not import the package whose tests it serves. The package is derived from the path: the directory the tests tree lives in. An import, re-export, dynamic import, or require of that package name — or of any subpath of it — is the implementation reaching its own oracle. A relative specifier is judged the same way lexically: resolved against the fixture directory, it must stay inside the tests tree, so ../../src/Lock.js is the implementation again while ./Locks.js is a sibling fixture." },
+	schema: [],
+	messages: {
+		subjectImport: MESSAGE$8,
+		relativeEscape: MESSAGE$8
+	}
+};
+//#endregion
+//#region src/rules/model-fixture-imports-subject.ts
+/**
+* The basename of the directory whose tests tree the fixture lives in. A
+* `*.model.ts` serves that package's tests, so the directory name is the
+* unscoped name of the package under test. Read lexically, the way every rule
+* here reads a path: one file cannot know what else is on disk (OX-TS2), and
+* with no tests tree in the path the subject is unknown — an unknown subject is
+* never reported.
+*/
+const packageDirOf = (filename) => {
+	const dirs = directoriesOf(filename);
+	const index = dirs.findIndex((segment) => TEST_TREE_DIRS.has(segment));
+	return index <= 0 ? void 0 : dirs[index - 1];
+};
+/**
+* The unscoped, subpath-stripped head of a package specifier:
+* `@systemfsoftware/effect-lock/testing` -> `effect-lock`. A subpath is still
+* the same dependency, and admitting it would let a fixture reach the
+* implementation through a nested entry.
+*/
+const packageHeadOf = (source) => {
+	const unscoped = source.startsWith("@") ? source.slice(source.indexOf("/") + 1) : source;
+	return unscoped.includes("/") ? unscoped.slice(0, unscoped.indexOf("/")) : unscoped;
+};
+const importsSubject = (source, subjectDir) => subjectDir !== void 0 && packageHeadOf(source) === subjectDir;
+const specifierOf$1 = (node) => node !== void 0 && node.type === "Literal" && typeof node.value === "string" ? node.value : void 0;
+const isRelativeSpecifier = (source) => source.startsWith("./") || source.startsWith("../");
+/**
+* The directory stack a relative specifier resolves to against the linted
+* file's own directory, `..` segments collapsed. Existence is never checked:
+* one file cannot know what else is on disk (OX-TS2), so only the lexical
+* identity is decided.
+*/
+const resolveRelative = (source, filename) => {
+	const stack = [...directoriesOf(filename)];
+	for (const segment of source.split("/")) {
+		if (segment === "" || segment === ".") continue;
+		if (segment === "..") {
+			stack.pop();
+			continue;
+		}
+		stack.push(segment);
+	}
+	return stack;
+};
+const inTestsTree = (segments) => segments.some((segment) => TEST_TREE_DIRS.has(segment));
+const modelFixtureImportsSubject = defineRule({
+	meta: meta$19,
+	create(context) {
+		if (!basenameOf(context.filename).endsWith(".model.ts")) return {};
+		const subjectDir = packageDirOf(context.filename);
+		const fixtureInTestsTree = inTestsTree(directoriesOf(context.filename));
+		const checkSource = (node, source) => {
+			const specifier = specifierOf$1(source);
+			if (specifier === void 0) return;
+			if (importsSubject(specifier, subjectDir)) {
+				context.report({
+					node,
+					messageId: "subjectImport",
+					data: {
+						name: SUBJECT_IMPORT_NAME,
+						expected: SUBJECT_IMPORT_EXPECTED,
+						actual: `a dependency on ${specifier} in a *.model.ts fixture`,
+						fix: SUBJECT_IMPORT_FIX
+					}
+				});
+				return;
+			}
+			if (fixtureInTestsTree && isRelativeSpecifier(specifier) && !inTestsTree(resolveRelative(specifier, context.filename))) context.report({
+				node,
+				messageId: "relativeEscape",
+				data: {
+					name: RELATIVE_ESCAPE_NAME,
+					expected: RELATIVE_ESCAPE_EXPECTED,
+					actual: `a relative import of ${specifier}, resolving outside the tests tree`,
+					fix: RELATIVE_ESCAPE_FIX
+				}
+			});
+		};
+		return {
+			ImportDeclaration(node) {
+				checkSource(node, node.source);
+			},
+			ExportNamedDeclaration(node) {
+				if (node.source !== null) checkSource(node, node.source);
+			},
+			ExportAllDeclaration(node) {
+				checkSource(node, node.source);
+			},
+			ImportExpression(node) {
+				checkSource(node, node.source);
+			},
+			TSImportEqualsDeclaration(node) {
+				if (node.moduleReference.type === "TSExternalModuleReference") checkSource(node, node.moduleReference.expression);
+			}
+		};
+	}
+});
+//#endregion
 //#region src/rules/no-assert-in-property.config.ts
-const MESSAGE$6 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const meta$17 = {
+const MESSAGE$7 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const meta$18 = {
 	type: "problem",
 	docs: { description: "Property predicates (it.prop / it.effect.prop) must never call expect(...), assert*(...), or raw fc.assert/fc.check. The boolean return IS the verdict — assertions fork the failure channel. assert* remains correct in normal (non-property) tests." },
 	schema: [],
 	messages: {
-		expectCall: MESSAGE$6,
-		assertCall: MESSAGE$6,
-		rawFcRun: MESSAGE$6
+		expectCall: MESSAGE$7,
+		assertCall: MESSAGE$7,
+		rawFcRun: MESSAGE$7
 	}
 };
 //#endregion
@@ -893,7 +1184,7 @@ const isInsidePropPredicate = (node) => {
 	return isInsidePropPredicate(parent);
 };
 const noAssertInProperty = defineRule({
-	meta: meta$17,
+	meta: meta$18,
 	create(context) {
 		return { CallExpression(node) {
 			const callee = node.callee;
@@ -932,6 +1223,20 @@ const noAssertInProperty = defineRule({
 	}
 });
 //#endregion
+//#region src/rules/expect-call.ts
+const EXPECT = "expect";
+const isExpectCallee = (callee) => callee.type === "Identifier" && callee.name === EXPECT;
+const expectCallOf = (node, acceptsMember) => {
+	if (node.callee.type !== "MemberExpression") return void 0;
+	let target = node.callee.object;
+	while (target.type === "MemberExpression") {
+		if (acceptsMember !== void 0 && acceptsMember(target) === false) return void 0;
+		target = target.object;
+	}
+	if (target.type !== "CallExpression" || isExpectCallee(target.callee) === false) return void 0;
+	return target;
+};
+//#endregion
 //#region src/rules/no-behaviourless-assertion.config.ts
 const TEST_FILE = /\.(test|spec)\.[cm]?tsx?$/;
 const BEHAVIOUR_NODES = {
@@ -946,7 +1251,7 @@ const SKIP_WALK_KEYS = /* @__PURE__ */ new Set([
 	"range",
 	"parent"
 ]);
-const meta$16 = {
+const meta$17 = {
 	type: "problem",
 	docs: { description: "Flag an assertion whose subject and expectation are both built only from imported declarations and literals. Such an assertion invokes nothing, so no change to the behaviour under test can make it fail." },
 	schema: [],
@@ -996,15 +1301,6 @@ const dependsOnBehaviour = (node, imported) => {
 	}
 	return false;
 };
-const expectCallOf = (node) => {
-	if (node.callee.type !== "MemberExpression") return void 0;
-	let target = node.callee.object;
-	while (target.type === "MemberExpression") target = target.object;
-	if (target.type !== "CallExpression") return void 0;
-	const callee = target.callee;
-	if (!("name" in callee && callee.name === "expect")) return void 0;
-	return target;
-};
 const importedNames = (program) => {
 	const names = /* @__PURE__ */ new Set();
 	for (const statement of program.body) {
@@ -1014,7 +1310,7 @@ const importedNames = (program) => {
 	return names;
 };
 const noBehaviourlessAssertion = defineRule({
-	meta: meta$16,
+	meta: meta$17,
 	create(context) {
 		if (!TEST_FILE.test(context.filename)) return {};
 		const imported = importedNames(context.sourceCode.ast);
@@ -1084,7 +1380,7 @@ const IO_SOURCE_TEST_NAME = "An in-source `import.meta.vitest` test block";
 const IO_SOURCE_TEST_EXPECTED = "the tests of a module whose own source calls an I/O binding to live outside it — a separate test file, or a composition test with a double at the port";
 const IO_SOURCE_TEST_ACTUAL = "this module calls a binding imported from a filesystem, process or network module and guards tests in-source with `import.meta.vitest`";
 const IO_SOURCE_TEST_FIX = "test the module from outside its own source — a separate test file or a composition test doubling the boundary — or, when an assertion merely restates a literal the module already computes, it is a change detector: delete it. The verdict here is the file's own imports and calls, never its name";
-const meta$15 = {
+const meta$16 = {
 	type: "problem",
 	docs: { description: "Reports an in-source `import.meta.vitest` test block in a module whose own syntax shows a called, non-type import from a filesystem, process or network module. Judges only the in-source-test idiom — a module whose tests live in separate files is a no-op for this rule, whatever it imports." },
 	schema: [],
@@ -1105,7 +1401,7 @@ const bindingBase = (callee) => {
 	if (callee.type === "Identifier") return callee.name;
 };
 const noIoModuleInSourceTest = defineRule({
-	meta: meta$15,
+	meta: meta$16,
 	create(context) {
 		/** Local binding name -> specifier it was (non-type) imported from. */
 		const ioBindings = {};
@@ -1147,7 +1443,7 @@ const noIoModuleInSourceTest = defineRule({
 });
 //#endregion
 //#region src/rules/no-nested-quantification.config.ts
-const MESSAGE$5 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const MESSAGE$6 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
 const Options$2 = Schema.Struct({ exempt: Schema.Array(Schema.String).pipe(Schema.annotate({ description: "File basenames this rule stays silent on. An owner who has measured the cost and accepted it names the file here; the property still runs." }), Schema.withDecodingDefaultType(Effect.succeed([]))) });
 const ITERATOR_METHODS = /* @__PURE__ */ new Set([
 	"every",
@@ -1166,15 +1462,15 @@ const ITERATOR_METHODS = /* @__PURE__ */ new Set([
 ]);
 const CONSTANT_POOL_ARBITRARIES = /* @__PURE__ */ new Set(["constant", "constantFrom"]);
 const FASTCHECK_NAMESPACES = /* @__PURE__ */ new Set(["fc"]);
-const VIOLATION_NAME$2 = "quantification nested inside a property predicate";
+const VIOLATION_NAME$3 = "quantification nested inside a property predicate";
 const EXPECTED$2 = "per-case cost bounded by the draw, not by the draw times a second traversal — inspect a generated value with a fold whose body calls nothing, or move the inner quantifier into the generator so the shrinker can see it";
 const ACTUAL$2 = "the predicate iterates a value derived from a generated parameter and calls a free function inside that loop, so cost scales with the drawn size times whatever that call costs";
 const FIX$2 = "hoist the inner call out of the loop when its result does not vary per element; otherwise assert one drawn element per case and let numRuns supply the quantifier, or generate the pair and compare directly. If the cost is understood and accepted, add this file's basename to the rule's exempt option";
-const meta$14 = {
+const meta$15 = {
 	type: "problem",
 	docs: { description: "A property predicate must not quantify over its own generated value and call out again inside that loop. Per-case cost then scales with the drawn size rather than with the draw count, which is the shape Hypothesis reports as nested_given: the suite slows superlinearly as the generator widens, and a CI budget tuned on small draws times out on large ones. Iteration over a bound the generator does not control, and a fold whose body calls nothing, are both fine." },
 	schema: [Schema.toJsonSchemaDocument(Options$2).schema],
-	messages: { nestedQuantification: MESSAGE$5 }
+	messages: { nestedQuantification: MESSAGE$6 }
 };
 //#endregion
 //#region src/rules/no-nested-quantification.ts
@@ -1229,11 +1525,17 @@ const isConstantPool = (element) => {
 };
 const boundedPoolIndices = (call) => {
 	const bounded = /* @__PURE__ */ new Set();
-	const generators = call.arguments.find((argument) => argument.type === "ArrayExpression");
-	if (generators === void 0) return bounded;
-	generators.elements.forEach((element, index) => {
-		if (isConstantPool(element)) bounded.add(index);
-	});
+	const options = call.arguments[1];
+	if (options === void 0 || options.type !== "ObjectExpression") return bounded;
+	for (const property of options.properties) {
+		if (property.type !== "Property" || property.computed) continue;
+		if (property.key.type !== "Identifier" || property.key.name !== "of") continue;
+		if (property.value.type !== "ArrayExpression") return bounded;
+		property.value.elements.forEach((element, index) => {
+			if (isConstantPool(element)) bounded.add(index);
+		});
+		return bounded;
+	}
 	return bounded;
 };
 const drawnNamesIn = (predicate, bounded) => {
@@ -1241,12 +1543,12 @@ const drawnNamesIn = (predicate, bounded) => {
 	const addFrom = (value) => {
 		for (const name of identifiersIn(value)) drawn.add(name);
 	};
-	const [first, ...rest] = predicate.params;
-	if (isNode$3(first) && first.type === "ArrayPattern") first.elements.forEach((element, index) => {
+	const [, values, ...rest] = predicate.params;
+	if (isNode$3(values) && values.type === "ArrayPattern") values.elements.forEach((element, index) => {
 		if (bounded.has(index)) return;
 		addFrom(element);
 	});
-	else addFrom(first);
+	else addFrom(values);
 	addFrom(rest);
 	visit(predicate.body, (node) => {
 		if (node.type !== "VariableDeclarator") return;
@@ -1306,7 +1608,7 @@ const check = (context, call, predicate) => {
 			node: iteration.node,
 			messageId: "nestedQuantification",
 			data: {
-				name: VIOLATION_NAME$2,
+				name: VIOLATION_NAME$3,
 				expected: EXPECTED$2,
 				actual: ACTUAL$2,
 				fix: FIX$2
@@ -1321,7 +1623,7 @@ const check = (context, call, predicate) => {
 * and excluded; DISCHARGED_BY in the suite pins the unbounded recipe shape.
 */
 const noNestedQuantification = defineRule({
-	meta: meta$14,
+	meta: meta$15,
 	create(context) {
 		const options = Schema.decodeUnknownSync(Options$2)(context.options[0] ?? {});
 		const exempt = new Set(options.exempt);
@@ -1342,11 +1644,11 @@ const NO_LAYER_IN_FEATURE_NAME = "a *.integration.test.ts feature with no enviro
 const NO_LAYER_IN_FEATURE_EXPECTED = "a Feature builder chained with .withLayer(layer) or .withScenarioLayer(layer)";
 const NO_LAYER_IN_FEATURE_ACTUAL = "a Feature(...) call without .withLayer or .withScenarioLayer";
 const NO_LAYER_IN_FEATURE_FIX = "an integration test under WGI-CLS1 must declare its collaborator environment via .withLayer(...) or .withScenarioLayer(...). Chain .withLayer(Layer.empty) (or .withScenarioLayer(Layer.empty)) if the feature exercises in-memory collaborators without custom services, or provide the external boundary Layer it exercises (e.g. .withLayer(MyService.Live)).";
-const meta$13 = {
+const meta$14 = {
 	type: "problem",
 	docs: { description: "A *.integration.test.ts Feature builder must configure at least one environment Layer (.withLayer or .withScenarioLayer) to enforce real integration boundaries under WGI-CLS1." },
 	schema: [],
-	messages: { noLayerInFeature: MESSAGE$7 }
+	messages: { noLayerInFeature: MESSAGE$8 }
 };
 //#endregion
 //#region src/rules/no-pseudo-gherkin-unit-tests.ts
@@ -1354,7 +1656,6 @@ const LAYER_METHODS = {
 	withLayer: true,
 	withScenarioLayer: true
 };
-const isBehaviourTest = (basename) => basename.endsWith(INTEGRATION_SUFFIX);
 const hasLayerInChain = (callNode) => {
 	let current = callNode;
 	while (current.type === "CallExpression") {
@@ -1377,9 +1678,9 @@ const findRootFeatureCall = (callNode) => {
 	return null;
 };
 const noPseudoGherkinUnitTests = defineRule({
-	meta: meta$13,
+	meta: meta$14,
 	create(context) {
-		if (!isBehaviourTest(basenameOf(context.filename))) return {};
+		if (!isBehaviourBasename(basenameOf(context.filename))) return {};
 		return { CallExpression(node) {
 			if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier") {
 				if (node.callee.property.name === "body") {
@@ -1401,16 +1702,16 @@ const noPseudoGherkinUnitTests = defineRule({
 });
 //#endregion
 //#region src/rules/no-silent-return.config.ts
-const MESSAGE$4 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const meta$12 = {
+const MESSAGE$5 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const meta$13 = {
 	type: "problem",
-	docs: { description: "Property predicates (it.prop / it.effect.prop from @effect/vitest) must return a boolean verdict on every code path. fast-check counts undefined as success, so a bare return, a non-boolean return, or falling off the end of the body is a silent pass. Opaque values (identifiers, member expressions, calls) are trusted to be boolean; literals and operators are checked." },
+	docs: { description: "Property predicates (it.prop / it.effect.prop from @systemfsoftware/vitest) must return a boolean verdict on every code path. fast-check counts undefined as success, so a bare return, a non-boolean return, or falling off the end of the body is a silent pass. Opaque values (identifiers, member expressions, calls) are trusted to be boolean; literals and operators are checked." },
 	schema: [],
 	messages: {
-		bareReturn: MESSAGE$4,
-		nonBooleanReturn: MESSAGE$4,
-		missingReturn: MESSAGE$4,
-		nonBooleanBody: MESSAGE$4
+		bareReturn: MESSAGE$5,
+		nonBooleanReturn: MESSAGE$5,
+		missingReturn: MESSAGE$5,
+		nonBooleanBody: MESSAGE$5
 	}
 };
 //#endregion
@@ -1550,7 +1851,7 @@ const checkFn = (context, fn) => {
 	if (!Array$1.last(body.body).pipe(Option.exists(pathExits))) report(context, fn, "missingReturn", "the predicate can fall off the end without returning — undefined is a silent pass");
 };
 const noSilentReturn = defineRule({
-	meta: meta$12,
+	meta: meta$13,
 	create(context) {
 		return { CallExpression(node) {
 			if (!isPropCallee(node.callee)) return;
@@ -1579,21 +1880,21 @@ const SCHEMA_TEST_DETAIL = {
 	actual: "an authored *.schema.test.ts restating generated coverage",
 	fix: "delete it. The generated laws already state round-trip identity and encode stability. What they cannot state is rejection — every input they draw comes from the arbitrary the schema itself supplies — so a refusal belongs in an in-source if (import.meta.vitest) block in the schema file, never here"
 };
-const meta$11 = {
+const meta$12 = {
 	type: "problem",
 	docs: { description: "Under src/, the only sanctioned test file is a single-segment <stem>.workflow.property.test.ts inside a sanctioned test directory, plus the generated schema-laws.test.ts entry point. Every other test file is banned: a kernel, policy, or schema suite becomes an in-source import.meta.vitest block, and a public-surface test moves outside src/ as an integration test. The sanctioned directory list is the sanctionedDirs option, defaulting to the one directory this repo runs." },
 	schema: [Schema.toJsonSchemaDocument(Options$1).schema],
 	messages: {
-		testFileInSrc: MESSAGE$7,
-		schemaTestInSrc: MESSAGE$7,
-		propertyTestOutsideTestsDir: MESSAGE$7
+		testFileInSrc: MESSAGE$8,
+		schemaTestInSrc: MESSAGE$8,
+		propertyTestOutsideTestsDir: MESSAGE$8
 	}
 };
 //#endregion
 //#region src/rules/no-test-file-in-src.ts
 const violationOf = (basename, isPropertyTest, dir) => basename.endsWith(".schema.test.ts") ? ["schemaTestInSrc", SCHEMA_TEST_DETAIL] : isPropertyTest ? ["propertyTestOutsideTestsDir", propertyTestLocationDetail(dir)] : ["testFileInSrc", testFileInSrcDetail(dir)];
 const noTestFileInSrc = defineRule({
-	meta: meta$11,
+	meta: meta$12,
 	create(context) {
 		const { sanctionedDirs } = Schema.decodeUnknownSync(Options$1)(context.options[0] ?? {});
 		const basename = basenameOf(context.filename);
@@ -1641,12 +1942,13 @@ const PREDICATE_SYMBOLS = /* @__PURE__ */ new Set([
 	"∘",
 	"∩",
 	"∪",
-	"⊥"
+	"⊥",
+	"⊨"
 ]);
 const NULLARY_PREDICATE_SYMBOLS = /* @__PURE__ */ new Set(["⊥"]);
 const PASCAL_CASE = /^[A-Z][a-z][a-zA-Z0-9]*$/;
 const DAMP_WORDS = /When|Should|Given|Then|Otherwise|After|Before/;
-const meta$10 = {
+const meta$11 = {
 	type: "suggestion",
 	docs: { description: "Enforce a complete formal-specification name for property-based tests (it.prop / it.effect.prop). Format: [ScopeSymbol][binder]_[Domain]_[PredicateSymbol][operand] (e.g., ∀x_DecodeEncode_=x, ∀l_Filter_⊆Input, →Shipped_Cancel_⊥Allowed). Both the quantifier and the predicate must carry an operand — a bare symbol specifies nothing." },
 	schema: [],
@@ -1656,7 +1958,7 @@ const meta$10 = {
 		incompleteScope: "Expected: a bound variable after the quantifier \"{{symbol}}\" in scope segment \"{{scope}}\" (e.g., ∀x, ∀order, ∃e, →Shipped). A property quantifies over a named input drawn from a generator; name it. A lone quantifier binds nothing and specifies no domain.",
 		emptyDomain: "Expected: a non-empty PascalCase domain between the two underscores in \"{{actual}}\". If this isn't a universal invariant, delete the test. Otherwise name the thing under test, e.g., ∀x_DecodeEncode_=x.",
 		domainLeaksDAMP: "Expected: an invariant domain, not scenario language. Actual: domain \"{{domain}}\" contains \"{{word}}\" — that describes one case, not a universal law. Delete this test. It is not a property. Find the actual invariant and write that instead.",
-		invalidPredicateSymbol: "Expected: a relation symbol (≡ ≠ = ≤ ≥ ∈ ⊆ ⊇ → ¬ ∘ ∩ ∪ ⊥) starting the last segment of \"{{actual}}\". Actual: it ends with \"{{firstChar}}\". If this isn't a universal invariant, delete the test. Otherwise relate the output: = / ≡ (roundtrip or oracle), ⊆ / ∈ (invariant), ≠ (distinctness), ⊥ (impossibility).",
+		invalidPredicateSymbol: "Expected: a relation symbol (≡ ≠ = ≤ ≥ ∈ ⊆ ⊇ → ¬ ∘ ∩ ∪ ⊥ ⊨) starting the last segment of \"{{actual}}\". Actual: it ends with \"{{firstChar}}\". If this isn't a universal invariant, delete the test. Otherwise relate the output: = / ≡ (roundtrip or oracle), ⊆ / ∈ (invariant), ≠ (distinctness), ⊨ (satisfies a declared model), ⊥ (impossibility).",
 		incompletePredicate: "Expected: an operand after the relation symbol \"{{symbol}}\" in predicate \"{{predicate}}\", naming what the output is related to: =x / ≡Oracle (roundtrip or reference), ⊆Input / ∈Ignored (invariant), ≠Zero (distinctness), ⊥Cancellable (impossibility — name the outcome that cannot occur). A bare symbol relates the output to nothing and so asserts no property."
 	}
 };
@@ -1690,7 +1992,7 @@ const parseSegments = (name) => {
 	};
 };
 const pbtNaming = defineRule({
-	meta: meta$10,
+	meta: meta$11,
 	create(context) {
 		return { CallExpression(node) {
 			if (!isPropCall(node)) return;
@@ -1782,8 +2084,8 @@ const pbtNaming = defineRule({
 });
 //#endregion
 //#region src/rules/prop-arbitrary-schema-origin.config.ts
-const MESSAGE$3 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const VIOLATION_NAME$1 = "a hand-built fast-check arbitrary with no schema underneath";
+const MESSAGE$4 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const VIOLATION_NAME$2 = "a hand-built fast-check arbitrary with no schema underneath";
 const EXPECTED$1 = "every in-source it.prop arbitrary derives from an Effect Schema — a schema reference, a schema-attached arbitrary annotation, or a pipe/map/oneof chain rooted in one; an input with no schema grows one first";
 const ACTUAL$1 = "the arbitrary is assembled from fast-check constructors alone, so the generator can emit shapes the schema never declared and the suite stays green while exercising almost nothing";
 const FIX$1 = "delete the block, or grow the schema the input needs and derive the arbitrary from it — Arbitrary.schema(schema) is the sanctioned derivation; nothing rewrites a hand-built generator into a property";
@@ -1798,13 +2100,13 @@ const SCHEMA_NAMESPACE_NAMES = {
 };
 const FASTCHECK_NAMESPACE_NAMES = { FastCheck: true };
 const COMBINATOR_CALLEES = { pipe: true };
-const meta$9 = {
+const meta$10 = {
 	type: "problem",
 	docs: { description: "Inside an import.meta.vitest in-source block, every it.prop / it.effect.prop arbitrary must derive from an Effect Schema — a schema reference, a schema-attached arbitrary annotation, or a chain rooted in one. A hand-built fast-check construction with no schema underneath reports; statically opaque arbitraries (unresolved or foreign bindings) fail open into the runtime domain audit." },
 	schema: [],
 	messages: {
-		handBuiltArbitrary: MESSAGE$3,
-		stockDerivedArbitrary: MESSAGE$3
+		handBuiltArbitrary: MESSAGE$4,
+		stockDerivedArbitrary: MESSAGE$4
 	}
 };
 //#endregion
@@ -2062,26 +2364,49 @@ const checkArbitraryFactory = (provenance, context, call) => {
 		}
 	});
 };
-const checkPropCall$1 = (provenance, context, call) => {
-	const arbitraries = call.arguments.find((argument) => argument.type === "ArrayExpression");
-	if (arbitraries === void 0) return;
-	for (const element of arbitraries.elements) {
+const reportHandBuilt = (provenance, context, node) => {
+	if (provenance.verdictOf(node, 0) !== "handBuilt") return;
+	context.report({
+		node,
+		messageId: "handBuiltArbitrary",
+		data: {
+			name: VIOLATION_NAME$2,
+			expected: EXPECTED$1,
+			actual: ACTUAL$1,
+			fix: FIX$1
+		}
+	});
+};
+const checkArrayOf = (provenance, context, of) => {
+	for (const element of of.elements) {
 		if (element === null) continue;
-		if (provenance.verdictOf(element, 0) !== "handBuilt") continue;
-		context.report({
-			node: element,
-			messageId: "handBuiltArbitrary",
-			data: {
-				name: VIOLATION_NAME$1,
-				expected: EXPECTED$1,
-				actual: ACTUAL$1,
-				fix: FIX$1
-			}
-		});
+		reportHandBuilt(provenance, context, element);
+	}
+};
+const checkRecordOf = (provenance, context, of) => {
+	for (const member of of.properties) {
+		if (member.type !== "Property" || member.computed) continue;
+		reportHandBuilt(provenance, context, member.value);
+	}
+};
+const checkPropCall$1 = (provenance, context, call) => {
+	const options = call.arguments[1];
+	if (options === void 0 || options.type !== "ObjectExpression") return;
+	for (const property of options.properties) {
+		if (property.type !== "Property" || property.computed) continue;
+		if (property.key.type !== "Identifier" || property.key.name !== "of") continue;
+		if (property.value.type === "ArrayExpression") {
+			checkArrayOf(provenance, context, property.value);
+			return;
+		}
+		if (property.value.type === "ObjectExpression") {
+			checkRecordOf(provenance, context, property.value);
+			return;
+		}
 	}
 };
 const propArbitrarySchemaOrigin = defineRule({
-	meta: meta$9,
+	meta: meta$10,
 	create(context) {
 		const provenance = new Provenance(context.sourceCode.getScope);
 		const collect = (value, out) => {
@@ -2140,16 +2465,16 @@ const propArbitrarySchemaOrigin = defineRule({
 });
 //#endregion
 //#region src/rules/prop-fixture-schema-origin.config.ts
-const MESSAGE$2 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const VIOLATION_NAME = "a hand-rolled recursive schema fixture inside a test block";
+const MESSAGE$3 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const VIOLATION_NAME$1 = "a hand-rolled recursive schema fixture inside a test block";
 const EXPECTED = "a recursive fixture schema enters the block through a named local builder call, or its recursion point declares its generation with a visible toCodecArbitrary derivation or a recursionBudget ceiling";
 const ACTUAL = "the union and its recursion cycle are assembled inline, so the suite exercises a surrogate universe the shipped schema contract never declared and no budget gate grades";
 const FIX = "hoist the members into a named builder the annotated and counterfactual fixtures share, or declare the recursion point's generation in its annotation";
-const meta$8 = {
+const meta$9 = {
 	type: "problem",
 	docs: { description: "Inside an import.meta.vitest in-source block or a *.test.ts file, a recursive schema union must enter through a named local builder or an imported helper, or its recursion point must declare its generation with a visible toCodecArbitrary derivation or recursionBudget ceiling. An inline hand-rolled recursive union reports; outside test scope the rule is silent, because production schemas are the derivation-cost rule domain." },
 	schema: [],
-	messages: { handRolledRecursiveFixture: MESSAGE$2 }
+	messages: { handRolledRecursiveFixture: MESSAGE$3 }
 };
 //#endregion
 //#region src/rules/prop-fixture-schema-origin.ts
@@ -2323,7 +2648,7 @@ const isNamedBuilderOrigin = (union, getScope) => {
 	return false;
 };
 const propFixtureSchemaOrigin = defineRule({
-	meta: meta$8,
+	meta: meta$9,
 	create(context) {
 		const getScope = context.sourceCode.getScope;
 		return { CallExpression(node) {
@@ -2340,7 +2665,7 @@ const propFixtureSchemaOrigin = defineRule({
 				node,
 				messageId: "handRolledRecursiveFixture",
 				data: {
-					name: VIOLATION_NAME,
+					name: VIOLATION_NAME$1,
 					expected: EXPECTED,
 					actual: ACTUAL,
 					fix: FIX
@@ -2351,7 +2676,7 @@ const propFixtureSchemaOrigin = defineRule({
 });
 //#endregion
 //#region src/rules/prop-generated-law-duplicate.config.ts
-const MESSAGE$1 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const MESSAGE$2 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
 const COMPILER_NAME = "a runtime probe of a compile-time guarantee";
 const COMPILER_EXPECTED = "the type checker owns brand and nominal-identity contracts — a dropped brand is a compile error at the consumer brand gate, not a failing property";
 const COMPILER_ACTUAL = "the predicate reflects over brand symbols at runtime, so it re-asserts what tsc already enforces and passes whenever the type system passes";
@@ -2360,13 +2685,13 @@ const NO_FUNCTION_NAME = "a property that tests no function";
 const NO_FUNCTION_EXPECTED = "every in-source property exercises domain logic — at least one call to a module-local function that is not a schema codec accessor — because a predicate that only feeds values through encode or decode tests the schema declaration, not code, and decode acceptance and refusal alike are generated or declared elsewhere";
 const NO_FUNCTION_ACTUAL = "no call in the predicate reaches module code — every call is a codec accessor, a schema wrapper, or an iteration combinator — so the property cannot fail unless the declaration it restates changes meaning";
 const NO_FUNCTION_FIX = "delete the prop; test the function that owns the decision — the workflow or a private helper in this module — with its input derived from a domain schema";
-const meta$7 = {
+const meta$8 = {
 	type: "problem",
 	docs: { description: "Inside an import.meta.vitest in-source block: a predicate that reflects over brand symbols re-asserts a compile-time guarantee, and a predicate containing no module-local non-codec function call tests a schema declaration instead of code. Both report." },
 	schema: [],
 	messages: {
-		compilerDuplicate: MESSAGE$1,
-		noDomainFunction: MESSAGE$1
+		compilerDuplicate: MESSAGE$2,
+		noDomainFunction: MESSAGE$2
 	}
 };
 //#endregion
@@ -2433,6 +2758,16 @@ const NEUTRAL_METHODS = {
 	match: true,
 	gen: true
 };
+/**
+* The fork's lawful `it.prop(name, { of, subject }, holds)` hands the function
+* under test to `holds` as its first parameter. Calling that parameter is
+* calling the subject, so it reaches this module's code by construction — even
+* when the parameter name would otherwise read as a codec accessor.
+*/
+const subjectParameterOf = (predicate) => {
+	const first = predicate.params[0];
+	return first !== void 0 && first.type === "Identifier" ? first.name : void 0;
+};
 const isNode = (value) => value !== null && typeof value === "object" && "type" in value;
 const mentionsImportMetaVitest = (value) => {
 	if (Array.isArray(value)) return value.some((item) => mentionsImportMetaVitest(item));
@@ -2444,9 +2779,9 @@ const mentionsImportMetaVitest = (value) => {
 	}
 	return false;
 };
-const collectPredicateShape = (provenance, node, shape) => {
+const collectPredicateShape = (provenance, node, shape, subjectParameter) => {
 	if (Array.isArray(node)) {
-		for (const item of node) collectPredicateShape(provenance, item, shape);
+		for (const item of node) collectPredicateShape(provenance, item, shape, subjectParameter);
 		return;
 	}
 	if (!isNode(node)) return;
@@ -2464,12 +2799,12 @@ const collectPredicateShape = (provenance, node, shape) => {
 				if (provenance.classifyCall(name, node) === "domain" || receiverIsLocal) shape.callsDomainFunction = true;
 			}
 		} else if (callee.type === "Identifier") {
-			if (CODEC_ACCESSORS[callee.name] !== true && NEUTRAL_METHODS[callee.name] !== true && provenance.classifyCall(callee.name, node) === "domain") shape.callsDomainFunction = true;
+			if (subjectParameter !== void 0 && callee.name === subjectParameter || CODEC_ACCESSORS[callee.name] !== true && NEUTRAL_METHODS[callee.name] !== true && provenance.classifyCall(callee.name, node) === "domain") shape.callsDomainFunction = true;
 		}
 	}
 	for (const [key, child] of Object.entries(node)) {
 		if (key === "parent") continue;
-		collectPredicateShape(provenance, child, shape);
+		collectPredicateShape(provenance, child, shape, subjectParameter);
 	}
 };
 const checkPropCall = (provenance, context, call) => {
@@ -2479,7 +2814,7 @@ const checkPropCall = (provenance, context, call) => {
 		usesCompilerProbe: false,
 		callsDomainFunction: false
 	};
-	collectPredicateShape(provenance, predicate.body, shape);
+	collectPredicateShape(provenance, predicate.body, shape, subjectParameterOf(predicate));
 	if (shape.usesCompilerProbe) {
 		context.report({
 			node: call,
@@ -2506,7 +2841,7 @@ const checkPropCall = (provenance, context, call) => {
 	});
 };
 const propGeneratedLawDuplicate = defineRule({
-	meta: meta$7,
+	meta: meta$8,
 	create(context) {
 		const provenance = new Provenance(context.sourceCode.getScope);
 		const collect = (value, out) => {
@@ -2549,17 +2884,17 @@ const propGeneratedLawDuplicate = defineRule({
 //#endregion
 //#region src/rules/property-file-purity.config.ts
 const PROPERTY_TEST_SUFFIX = ".property.test.ts";
-const MESSAGE = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
-const meta$6 = {
+const MESSAGE$1 = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const meta$7 = {
 	type: "problem",
 	docs: { description: "Property tests live ONLY in *.property.test.ts files, and those files contain ONLY property tests. In a property file: no plain it()/test()/it.effect(), no raw fc.assert/fc.check/fc.property/fc.asyncProperty. In any other test file: no FastCheck import and no it.prop/it.effect.prop — move the property to a *.property.test.ts file." },
 	schema: [],
 	messages: {
-		plainIt: MESSAGE,
-		plainEffectIt: MESSAGE,
-		rawFastCheck: MESSAGE,
-		fastCheckImport: MESSAGE,
-		propCall: MESSAGE
+		plainIt: MESSAGE$1,
+		plainEffectIt: MESSAGE$1,
+		rawFastCheck: MESSAGE$1,
+		fastCheckImport: MESSAGE$1,
+		propCall: MESSAGE$1
 	}
 };
 //#endregion
@@ -2574,9 +2909,9 @@ const PROPERTY_FILE_KIND = {
 	suffix: PROPERTY_TEST_SUFFIX,
 	plainExpected: "it.prop(...) or it.effect.prop(...) — property files never mix with scenario tests",
 	plainFix: "move the scenario test to a plain *.test.ts file, or rewrite it as a property with arbitraries and a boolean-returning predicate",
-	rawFcExpected: "it.prop(...) or it.effect.prop(...) from @effect/vitest",
+	rawFcExpected: "it.prop(...) or it.effect.prop(...) from @systemfsoftware/vitest",
 	rawFcActualSuffix: "bypasses the vitest/Effect integration",
-	rawFcFix: "rewrite as it.prop(name, [arbitraries], predicate) returning a boolean; fc.* stays for building arbitraries (fc.pre, fc.stringMatching, ...)"
+	rawFcFix: "rewrite as it.prop(name, { of, subject, runs }, holds) returning a boolean; fc.* stays for building arbitraries (fc.pre, fc.stringMatching, ...)"
 };
 const DIFFERENTIAL_FILE_KIND = {
 	suffix: DIFFERENTIAL_SUFFIX,
@@ -2666,7 +3001,7 @@ const createScenarioFileVisitors = (context) => ({
 });
 const kindOf = (filename) => filename.endsWith(".differential.test.ts") ? DIFFERENTIAL_FILE_KIND : PROPERTY_FILE_KIND;
 const propertyFilePurity = defineRule({
-	meta: meta$6,
+	meta: meta$7,
 	create(context) {
 		if (!isTestFile(basenameOf(context.filename))) return {};
 		if (context.filename.endsWith(".property.test.ts") || context.filename.endsWith(".differential.test.ts")) return createPropertyFileVisitors(context, kindOf(context.filename));
@@ -2682,12 +3017,12 @@ const UNSANCTIONED_CELL_FIX = "rename it <stem>.workflow.property.test.ts beside
 const MISSING_CELL_TEST_EXPECTED = "a test for every cell suffix the consumer lists in cellsRequiringTest";
 const MISSING_CELL_TEST_ACTUAL = "a declared cell whose own module carries no `if (import.meta.vitest)` block";
 const MISSING_CELL_TEST_FIX = "add an `if (import.meta.vitest)` block to this module, or drop this cell from cellsRequiringTest and cover it with a colocated test in a sanctioned test directory — the rule reads the file it is given, so a sibling test file is invisible to it and a declared cell must satisfy the requirement from its own source";
-const meta$5 = {
+const meta$6 = {
 	type: "problem",
 	docs: { description: "A property test under src/ must be a single-segment <stem>.workflow.property.test.ts beside the <stem>.workflow.ts it covers; every other property-test basename is unsanctioned. A source file whose suffix names a cell listed in the cellsRequiringTest option must additionally carry an in-source vitest block; that list is empty by default, so the presence arm is opt-in per consumer." },
 	schema: [Schema.toJsonSchemaDocument(Options).schema],
 	messages: {
-		unsanctionedCell: MESSAGE$7,
+		unsanctionedCell: MESSAGE$8,
 		missingCellTest: ABSENCE_MESSAGE
 	}
 };
@@ -2695,7 +3030,7 @@ const meta$5 = {
 //#region src/rules/src-property-test-cell.ts
 const carriesInSourceBlock = (body) => body.some((statement) => statement.type === "IfStatement" && isVitestGuard(statement.test));
 const srcPropertyTestCell = defineRule({
-	meta: meta$5,
+	meta: meta$6,
 	create(context) {
 		const { cellsRequiringTest } = Schema.decodeUnknownSync(Options)(context.options[0] ?? {});
 		const filename = context.filename;
@@ -2748,7 +3083,7 @@ const testFileOutsideTestsDir = defineRule({
 		type: "problem",
 		docs: { description: "Test files outside src/ must live under a tests/ directory; free-standing test files have no sanctioned home." },
 		schema: [],
-		messages: { strayTestFile: MESSAGE$7 }
+		messages: { strayTestFile: MESSAGE$8 }
 	},
 	create(context) {
 		if (isUnderSrc(context.filename)) return {};
@@ -2770,24 +3105,25 @@ const testFileOutsideTestsDir = defineRule({
 });
 //#endregion
 //#region src/rules/test-suffix-outside-src.config.ts
-const UNSANCTIONED_SUFFIX_EXPECTED = "*.integration.test.ts, *.differential.test.ts, or *.trace.test.ts";
+const UNSANCTIONED_SUFFIX_EXPECTED = "*.integration.test.ts, *.contract.test.ts, *.differential.test.ts, *.trace.test.ts, or *.conformance.test.ts";
 const UNSANCTIONED_SUFFIX_ACTUAL = "another test suffix outside src/";
-const UNSANCTIONED_SUFFIX_FIX = "public surface -> *.integration.test.ts; parity -> *.differential.test.ts; span graph -> *.trace.test.ts; pure-cell property -> in-source; restated literal -> delete";
+const UNSANCTIONED_SUFFIX_FIX = "public surface -> *.integration.test.ts; real-oracle medium -> *.contract.test.ts (contract lane); parity -> *.differential.test.ts; span graph -> *.trace.test.ts; concurrent or stateful behaviour -> *.conformance.test.ts; pure-cell property -> in-source; restated literal -> delete";
 //#endregion
 //#region src/rules/test-suffix-outside-src.ts
 const testSuffixOutsideSrc = defineRule({
 	meta: {
 		type: "problem",
-		docs: { description: "Outside src/, a test file ends .integration.test.ts, .differential.test.ts, or .trace.test.ts." },
+		docs: { description: "Outside src/, a test file ends .integration.test.ts, .differential.test.ts, .trace.test.ts, or .conformance.test.ts. A runner-driving package (Vitest itself, the fork, effect-spec-runtime) keeps plain *.test.ts runners and nested-run probes, so the lane taxonomy does not apply there." },
 		schema: [],
-		messages: { unsanctionedSuffix: MESSAGE$7 }
+		messages: { unsanctionedSuffix: MESSAGE$8 }
 	},
 	create(context) {
 		const filename = context.filename;
 		if (isUnderSrc(filename)) return {};
+		if (isRawVitestPackage(filename)) return {};
 		const basename = basenameOf(filename);
 		if (!isTestFile(basename)) return {};
-		if (basename.endsWith(".integration.test.ts") || basename.endsWith(".differential.test.ts") || basename.endsWith(".trace.test.ts")) return {};
+		if (isBehaviourBasename(basename) || basename.endsWith(".differential.test.ts") || basename.endsWith(".trace.test.ts") || basename.endsWith(".conformance.test.ts")) return {};
 		return { Program(node) {
 			context.report({
 				node,
@@ -2814,7 +3150,7 @@ const testsDirHelpersInFixtures = defineRule({
 		type: "problem",
 		docs: { description: "Under tests/, the only non-test modules are helpers and fixtures, and they live inside tests/__fixtures__/." },
 		schema: [],
-		messages: { helperOutsideFixtures: MESSAGE$7 }
+		messages: { helperOutsideFixtures: MESSAGE$8 }
 	},
 	create(context) {
 		const filename = context.filename;
@@ -2843,11 +3179,11 @@ const testsDirHelpersInFixtures = defineRule({
 const REACH_IN_EXPECTED = "a package name or subpath, or a sibling helper under the test tree";
 const REACH_IN_ACTUAL = "a relative import that reaches src or climbs into an internal folder";
 const REACH_IN_FIX = "rewrite onto the published package name when the binding is public. Delete the test when the subject is an internal";
-const meta$1 = {
+const meta$2 = {
 	type: "problem",
 	docs: { description: "Forbid package-level tests from relative-importing src or climbing into an internal folder" },
 	schema: [],
-	messages: { sourceReachIn: MESSAGE$7 }
+	messages: { sourceReachIn: MESSAGE$8 }
 };
 //#endregion
 //#region src/rules/tests-import-public-api.ts
@@ -2865,7 +3201,7 @@ const specifierOf = (node) => {
 	if (node.type === "Literal" && typeof node.value === "string") return node.value;
 };
 const testsImportPublicApi = defineRule({
-	meta: meta$1,
+	meta: meta$2,
 	create(context) {
 		if (!isInTestsImportScope(context.filename)) return {};
 		const reportIfForbidden = (sourceNode) => {
@@ -2923,14 +3259,14 @@ const HTTP_TERMINATION_FIX = "replace the HTTP assertion with a relation over th
 const RAW_EMIT_EXPECTED = "spans declared once with Span.declare({ id, name, attrs }) inside the traced cell; the spec observes the decoded graph";
 const RAW_EMIT_ACTUAL = "a raw span emit call inside a trace spec";
 const RAW_EMIT_FIX = "delete the emit; declare the span with Span.declare in the system under test and assert on the graph the spec receives";
-const meta = {
+const meta$1 = {
 	type: "problem",
 	docs: { description: "A *.trace.test.ts must import its harness from @systemfsoftware/trace-spec and terminate cases on relation holds over the declared span graph. Raw emit calls (startSpan, spanBuilder, startActiveSpan) and HTTP status, statusText, or body assertions (expect(res.status).toBe(200), expect(res).toHaveProperty(\"status\", 200), expect(res).resolves.toMatchObject({ status: 200 }), expect(res).toEqual(expect.objectContaining({ status: 200 }))) are forbidden — replacing that altitude is what a trace spec exists for." },
 	schema: [],
 	messages: {
-		missingHarnessImport: MESSAGE$7,
-		httpTermination: MESSAGE$7,
-		rawEmitCall: MESSAGE$7
+		missingHarnessImport: MESSAGE$8,
+		httpTermination: MESSAGE$8,
+		rawEmitCall: MESSAGE$8
 	}
 };
 //#endregion
@@ -3097,7 +3433,7 @@ const reportHttpTermination = (context, node) => {
 	});
 };
 const traceTestRequiresTaxonomy = defineRule({
-	meta,
+	meta: meta$1,
 	create(context) {
 		if (!context.filename.endsWith(".trace.test.ts")) return {};
 		let hasHarnessImport = false;
@@ -3126,6 +3462,66 @@ const traceTestRequiresTaxonomy = defineRule({
 	}
 });
 //#endregion
+//#region src/rules/vitest-from-systemfsoftware-vitest.config.ts
+const MESSAGE = "{{name}} is forbidden. Expected: {{expected}}. Actual: {{actual}}. Fix: {{fix}}.";
+const VIOLATION_NAME = "a value import from a foreign vitest runner";
+const VIOLATION_EXPECTED = "every test value imported from @systemfsoftware/vitest, which re-exports all of Vitest";
+const VIOLATION_ACTUAL = "a named, namespace, default, side-effect or dynamic value import from vitest or @effect/vitest";
+const VIOLATION_FIX = "import it from @systemfsoftware/vitest instead of vitest or @effect/vitest";
+const meta = {
+	type: "problem",
+	docs: { description: "Every value a test uses from Vitest is imported from @systemfsoftware/vitest, which re-exports all of Vitest. Any value import from vitest or the upstream @effect/vitest — named, namespace, default, side-effect or dynamic — is refused; a type-only import stays legal." },
+	schema: [],
+	messages: { vitestImport: MESSAGE }
+};
+//#endregion
+//#region src/rules/vitest-from-systemfsoftware-vitest.ts
+const isTypeOnly = (node) => {
+	if (node.importKind === "type") return true;
+	if (node.specifiers.length === 0) return false;
+	return node.specifiers.every((specifier) => specifier.type === "ImportSpecifier" && specifier.importKind === "type");
+};
+const isForeignVitestLiteral = (node) => node.type === "Literal" && typeof node.value === "string" && FOREIGN_VITEST_SOURCES[node.value] === true;
+const vitestFromSystemfsoftwareVitest = defineRule({
+	meta,
+	create(context) {
+		if (isRawVitestPackage(context.filename)) return {};
+		const report = (node) => {
+			context.report({
+				node,
+				messageId: "vitestImport",
+				data: {
+					name: VIOLATION_NAME,
+					expected: VIOLATION_EXPECTED,
+					actual: VIOLATION_ACTUAL,
+					fix: VIOLATION_FIX
+				}
+			});
+		};
+		return {
+			ImportDeclaration(node) {
+				if (FOREIGN_VITEST_SOURCES[node.source.value] !== true) return;
+				if (isTypeOnly(node)) return;
+				report(node);
+			},
+			ImportExpression(node) {
+				if (!isForeignVitestLiteral(node.source)) return;
+				report(node);
+			},
+			ExportAllDeclaration(node) {
+				if (node.exportKind === "type") return;
+				if (FOREIGN_VITEST_SOURCES[node.source.value] !== true) return;
+				report(node);
+			},
+			ExportNamedDeclaration(node) {
+				if (node.source === null || node.exportKind === "type") return;
+				if (FOREIGN_VITEST_SOURCES[node.source.value] !== true) return;
+				report(node);
+			}
+		};
+	}
+});
+//#endregion
 //#region src/index.ts
 const PLUGIN_NAME = "@systemfsoftware/oxlint-plugin-test-discipline";
 const rule = (name) => `${PLUGIN_NAME}/${name}`;
@@ -3150,9 +3546,12 @@ const recommendedRules = {
 	[rule("behaviour-exercises-use-case")]: "error",
 	[rule("behaviour-one-feature-per-file")]: "error",
 	[rule("tests-dir-helpers-in-fixtures")]: "error",
+	[rule("vitest-from-systemfsoftware-vitest")]: "error",
 	[rule("no-io-module-in-source-test")]: "error",
 	[rule("tests-import-public-api")]: "error",
 	[rule("differential-test-requires-harness")]: "error",
+	[rule("conformance-test-requires-harness")]: "error",
+	[rule("model-fixture-imports-subject")]: "error",
 	[rule("no-pseudo-gherkin-unit-tests")]: "error",
 	[rule("ban-raw-span-name-emit")]: "error",
 	[rule("trace-test-requires-taxonomy")]: "error"
@@ -3181,9 +3580,12 @@ var src_default = {
 		"behaviour-one-feature-per-file": behaviourOneFeaturePerFile,
 		"no-pseudo-gherkin-unit-tests": noPseudoGherkinUnitTests,
 		"tests-dir-helpers-in-fixtures": testsDirHelpersInFixtures,
+		"vitest-from-systemfsoftware-vitest": vitestFromSystemfsoftwareVitest,
 		"no-io-module-in-source-test": noIoModuleInSourceTest,
 		"tests-import-public-api": testsImportPublicApi,
 		"differential-test-requires-harness": differentialTestRequiresHarness,
+		"conformance-test-requires-harness": conformanceTestRequiresHarness,
+		"model-fixture-imports-subject": modelFixtureImportsSubject,
 		"ban-raw-span-name-emit": banRawSpanNameEmit,
 		"trace-test-requires-taxonomy": traceTestRequiresTaxonomy
 	},