paperlint 10.2.0 → 10.4.0

package/src/adapters/study-registry/index.ts

@@ -5,16 +5,45 @@
  *
  * A row is a loose object: a paper merges its own measurement metadata into its rows (`role`, `frame`,
  * `rules_under_test`, `outcome` …), and those fields are kept as they are. The top level is strict, so
- * a misspelt key is an error rather than a key nobody reads.
+ * a misspelt key is an error rather than a key nobody reads. A measurement keeps its extra fields as a
+ * row does; a requirement and an approval are exactly their fields.
+ *
+ * A study's plan (`plan.json`) is parsed here too, strictly: a key of the paper's own goes in `extra`.
+ * Its texts may be empty — the template's are — and the parser says which: a plan comes out ready or
+ * a draft naming its empty texts, so nothing downstream looks at a text again. A plan still named
+ * `prereg.json` has a loose schema of its own.
+ *
+ * A plan's `mode` (docs/design/study-modes.md) is parsed here too, strictly, a union on its `kind`:
+ * one mode at most, a glob that leaves the study's folder or a decision outside the paper refused,
+ * and a measurement's plan ready only with a mode.
  */
 import { z } from "zod";
+import { README } from "../../domain/repro-layout.ts";
 import {
   IN_PAPER,
+  MEASUREMENT_ROLES,
+  PLAN_FIELDS,
+  PLAN_TEXT_FIELDS,
   PREFIX_PATTERN,
   STUDY_KINDS,
   STUDY_STATUSES,
+  type Approval,
+  type AuthorCheck,
+  type Measurement,
+  type ParsedPlan,
   type ParsedRegistry,
+  type Requirement,
+  type Study,
+  type PlanTextField,
+  type StudyKind,
+  type StudyPlan,
+  type StudyRegistry,
 } from "../../domain/study-registry.ts";
+import {
+  needsMode,
+  type Decision,
+  type StudyMode,
+} from "../../domain/study-mode.ts";
 import type { StudyRegistryCodec } from "../../ports/study-registry-codec.ts";
 
 const study = z.looseObject({
@@ -29,15 +58,323 @@ const study = z.looseObject({
   result_file: z.string().optional(),
   superseded_by: z.string().optional(),
   in_paper: z.enum(IN_PAPER),
+  measurement: z.string().optional(),
+  plan: z.string().optional(),
+});
+
+const words = z.string().min(1);
+
+const requirement = z.strictObject({
+  id: words,
+  text: words,
+  date: z.iso.date(),
+  source: words,
+});
+
+const approval = z.strictObject({
+  by: words,
+  date: z.iso.date(),
+  quote: words,
+  source: words.optional(),
+});
+
+const measurement = z.looseObject({
+  id: words,
+  title: words,
+  rq: z.string().optional(),
+  role: z.enum(MEASUREMENT_ROLES),
+  approval: approval.optional(),
+  requirements: z.array(z.string()).optional(),
 });
 
 const registry = z.strictObject({
   prefix: z
     .string()
     .regex(PREFIX_PATTERN, "a capital letter, then capitals or digits (P1)"),
+  author: words.optional(),
+  requirements: z.array(requirement).optional(),
+  measurements: z.array(measurement).optional(),
   studies: z.array(study),
 });
 
+const authorCheck = approval.omit({ source: true });
+
+/** A draw: seeded, its seed part of it, or of all the population, with none. */
+const draw = z.discriminatedUnion("kind", [
+  z.strictObject({
+    kind: z.literal("seeded"),
+    method: z.string(),
+    seed: z.union([z.string(), z.number()]),
+  }),
+  z.strictObject({ kind: z.literal("all"), method: z.string() }),
+]);
+
+/** The values that occur more than once in `values`, each once. */
+const repeated = (values: readonly string[]): readonly string[] => [
+  ...new Set(values.filter((v, i) => values.indexOf(v) !== i)),
+];
+
+/** Arms whose names are unique: a repeated name is an error naming it. */
+const uniquelyNamed = (
+  arms: readonly { readonly name: string }[],
+  ctx: Readonly<z.core.$RefinementCtx>,
+): void => {
+  repeated(arms.map((a) => a.name)).forEach((name) => {
+    ctx.addIssue({
+      code: "custom",
+      message: `more than one arm is named «${name}» — an arm's name is unique`,
+    });
+  });
+};
+
+/** The paper's own keys: none of them a field of the plan, which would say a thing twice. */
+const extra = z.record(z.string(), z.unknown()).superRefine((e, ctx) => {
+  Object.keys(e)
+    .filter((k) => PLAN_FIELDS.some((f) => f === k))
+    .forEach((k) => {
+      ctx.addIssue({
+        code: "custom",
+        path: [k],
+        message: "is a field of the plan itself — set it there, not in extra",
+      });
+    });
+});
+
+/** Every value of `values` once: a repeat is an error naming it. */
+const once =
+  (what: string) =>
+  (values: readonly string[], ctx: Readonly<z.core.$RefinementCtx>): void => {
+    repeated(values).forEach((v) => {
+      ctx.addIssue({
+        code: "custom",
+        message: `${what} «${v}» is listed more than once`,
+      });
+    });
+  };
+
+/** Whether `p` is a relative path that stays where it starts: no backslash, not absolute, no `..`. */
+const staysInside = (p: string): boolean =>
+  !p.includes("\\") && !p.startsWith("/") && !p.split("/").includes("..");
+
+/** An output glob, relative to the study's folder: inside it, and never the study's README. */
+const inFolder = z
+  .string()
+  .min(1)
+  .refine(
+    (p) => staysInside(p) && p !== README,
+    `is not a path inside the study's folder, or names its ${README}`,
+  );
+
+/**
+ * Whether `p` names a file by one or more names joined by `/`, none empty, `.` or `..`: never the
+ * paper's folder itself (`.`) nor a path ending in `/`. Whether a name is a directory on disk is the
+ * gate's and the order rule's to see.
+ */
+const namesAFile = (p: string): boolean =>
+  p.split("/").every((n) => n !== "" && n !== "." && n !== "..");
+
+/**
+ * A decision file, relative to the PAPER's folder: inside it, and a file's path. Empty in a draft (the
+ * parser names it).
+ */
+const inPaper = z
+  .string()
+  .refine(staysInside, "is not a path inside the paper's folder")
+  .refine(
+    (p) => p === "" || !staysInside(p) || namesAFile(p),
+    "is not a path to a file inside the paper's folder: one or more names joined by /, none empty, . or ..",
+  );
+
+const decisionShape = z.strictObject({ file: inPaper, note: z.string() });
+
+/** The output globs: each once; none yet in a draft. */
+const outputs = z.array(inFolder).superRefine(once("the output"));
+
+/** How the outcomes are kept from the decisions: exactly one mode, by its `kind`. */
+const mode = z.discriminatedUnion("kind", [
+  z.strictObject({
+    kind: z.literal("decide_before_run"),
+    outputs,
+    decision: decisionShape,
+  }),
+  z.strictObject({ kind: z.literal("exploratory"), reason: z.string() }),
+]);
+
+/** A plan's shape: closed at every level; the paper's own keys go in `extra`. Null is the one "none". */
+const planShape = z.strictObject({
+  question: z.string(),
+  population: z.strictObject({ source: z.string(), draw }),
+  arms: z.array(z.strictObject({ name: words })).superRefine(uniquelyNamed),
+  primary_outcome: z.string(),
+  author_check: authorCheck.nullable(),
+  extra: extra.optional(),
+  mode: mode.optional(),
+});
+
+/**
+ * A plan under its old name, `prereg.json`, written by hand before the plan had a schema: open at
+ * every level, its own top-level keys kept in `extra`. A seed makes the draw seeded, none (or null) a
+ * draw of all; a size, and keys of its own deeper down, are not read; the file is never rewritten.
+ */
+const legacyAsPlan = z
+  .looseObject({
+    question: z.string(),
+    population: z.looseObject({
+      source: z.string(),
+      draw: z.looseObject({
+        method: z.string(),
+        seed: z.union([z.string(), z.number()]).nullable().optional(),
+      }),
+    }),
+    arms: z.array(z.looseObject({ name: words })).superRefine(uniquelyNamed),
+    primary_outcome: z.string(),
+    author_check: authorCheck.nullable().optional(),
+  })
+  .transform((p): StudyPlan => {
+    const {
+      question,
+      population,
+      arms,
+      primary_outcome,
+      author_check,
+      ...rest
+    } = p;
+    const { method, seed } = population.draw;
+    return {
+      question,
+      population: {
+        source: population.source,
+        draw:
+          seed === undefined || seed === null
+            ? { kind: "all", method }
+            : { kind: "seeded", method, seed },
+      },
+      arms: arms.map((a) => ({ name: a.name })),
+      primary_outcome,
+      author_check: author_check ?? null,
+      extra: rest,
+    };
+  });
+
+/** A text that says something: more than white space. */
+const filled = z.string().regex(/\S/u);
+
+/** The texts a plan fills before its study runs; what fails here is what is still empty. */
+const readyTexts = z.object({
+  question: filled,
+  population: z.object({
+    source: filled,
+    draw: z.object({ method: filled }),
+  }),
+  primary_outcome: filled,
+});
+
+/** Whether `t` says something. */
+const says = (t: string): boolean => /\S/u.test(t);
+
+/**
+ * The mode's texts that are still empty, by their field: the mode itself when a study of `kind` must
+ * declare one and the plan does not, a decide-first mode's outputs and decision, an exploratory reason.
+ */
+const modeEmpties = (
+  p: StudyPlan,
+  kind: StudyKind,
+): readonly PlanTextField[] => {
+  const m = p.mode;
+  if (m === undefined) return needsMode(kind) ? ["mode"] : [];
+  if (m.kind === "exploratory") return says(m.reason) ? [] : ["mode.reason"];
+  return PLAN_TEXT_FIELDS.filter(
+    (f) =>
+      (f === "mode.outputs" && m.outputs.length === 0) ||
+      (f === "mode.decision.file" && !says(m.decision.file)) ||
+      (f === "mode.decision.note" && !says(m.decision.note)),
+  );
+};
+
+/** A plan that parsed: ready, or a draft. */
+type ReadyOrDraft = Exclude<ParsedPlan, { readonly kind: "unreadable" }>;
+
+/**
+ * A parsed plan, ready when every required text is filled, else a draft naming the empty ones. A
+ * draft that carries the author's check is no plan: the author approved one with empty texts.
+ */
+const readyOrDraft =
+  (kind: StudyKind) =>
+  (p: StudyPlan, ctx: Readonly<z.core.$RefinementCtx>): ReadyOrDraft => {
+    const checked = readyTexts.safeParse(p);
+    const paths = checked.success
+      ? []
+      : checked.error.issues.map((i) => i.path.join("."));
+    const empty = [
+      ...PLAN_TEXT_FIELDS.filter((f) => paths.includes(f)),
+      ...modeEmpties(p, kind),
+    ];
+    if (empty.length === 0) return { kind: "ready", plan: p };
+    if (p.author_check === null)
+      return { kind: "draft", plan: { ...p, author_check: null }, empty };
+    ctx.addIssue({
+      code: "custom",
+      path: ["author_check"],
+      message: `is set, and the plan leaves ${empty.map((f) => `\`${f}\``).join(", ")} empty — the author approves a complete plan: fill them, or set author_check to null`,
+    });
+    return z.NEVER;
+  };
+
+/** A `plan.json` of a study of `kind`: strict, then ready or draft — a measurement's ready only with its mode. */
+const planFor = (kind: StudyKind) => planShape.transform(readyOrDraft(kind));
+
+/**
+ * A `prereg.json`: loose, mapped onto the plan, then ready or draft. Written before modes existed, it
+ * is never asked for one; `repro/study-plan-name` already asks to move it to `plan.json`, where the
+ * strict parser does.
+ */
+const legacyPlan = legacyAsPlan.transform(readyOrDraft("spike"));
+
+// ── the schemas ARE the domain's types ─────────────────────────────────────────
+// Each schema's output and its hand-written domain type are the same type, both ways, once both are
+// made readonly all the way down: a field added to one and not the other stops the build.
+
+/** `T`, readonly all the way down: zod's outputs are mutable, the domain's are not. */
+type Frozen<T> = T extends readonly (infer U)[]
+  ? readonly Frozen<U>[]
+  : T extends object
+    ? { readonly [K in keyof T]: Frozen<T[K]> }
+    : T;
+
+/**
+ * True when `A` and `B`, both made readonly all the way down, are one type, optional modifiers
+ * included: two generic signatures whose returns are deferred conditionals are related only when
+ * the conditionals are identical. Written out, not through an alias: an alias is compared by the
+ * variance of its parameter, which misses a dropped optional field.
+ */
+type Same<A, B> =
+  (<T>() => T extends Frozen<A> ? readonly [T] : 2) extends <
+    T,
+  >() => T extends Frozen<B> ? readonly [T] : 2
+    ? true
+    : false;
+
+/** Compiles only when every schema's output is its domain type. */
+export type SchemasAreTheDomain = [
+  Same<z.output<typeof registry>, StudyRegistry>,
+  Same<z.output<typeof study>, Study>,
+  Same<z.output<typeof measurement>, Measurement>,
+  Same<z.output<typeof requirement>, Requirement>,
+  Same<z.output<typeof approval>, Approval>,
+  Same<z.output<typeof authorCheck>, AuthorCheck>,
+  Same<z.output<typeof planShape>, StudyPlan>,
+  Same<z.output<typeof legacyAsPlan>, StudyPlan>,
+  Same<z.output<ReturnType<typeof planFor>>, ReadyOrDraft>,
+  Same<z.output<typeof legacyPlan>, ReadyOrDraft>,
+  Same<z.output<typeof mode>, StudyMode>,
+  Same<z.output<typeof decisionShape>, Decision>,
+] extends true[]
+  ? true
+  : never;
+
+/** The proof is used, so the build checks it. */
+export const SCHEMAS_ARE_THE_DOMAIN: SchemasAreTheDomain = true;
+
 /** The JSON `text` holds, or undefined when it is not JSON. */
 function jsonOf(text: string): unknown {
   try {
@@ -47,6 +384,20 @@ function jsonOf(text: string): unknown {
   }
 }
 
+/** Every reason zod gave, each with the path it is about. */
+const reasons = (
+  issues: readonly {
+    readonly path: readonly PropertyKey[];
+    readonly message: string;
+  }[],
+): string =>
+  issues
+    .map(
+      (i) =>
+        `${i.path.length === 0 ? "(top)" : i.path.join(".")}: ${i.message}`,
+    )
+    .join("; ");
+
 /** A `studies.json`'s text, parsed once at the boundary: the registry, or every reason it is not one. */
 export function parseStudyRegistry(text: string): ParsedRegistry {
   const json = jsonOf(text);
@@ -54,17 +405,30 @@ export function parseStudyRegistry(text: string): ParsedRegistry {
   const parsed = registry.safeParse(json);
   return parsed.success
     ? { ok: true, registry: parsed.data }
-    : {
-        ok: false,
-        why: parsed.error.issues
-          .map(
-            (i) =>
-              `${i.path.length === 0 ? "(top)" : i.path.join(".")}: ${i.message}`,
-          )
-          .join("; "),
-      };
+    : { ok: false, why: reasons(parsed.error.issues) };
 }
 
+/** A plan's text, parsed once at the boundary by `schema`: ready, a draft, or every reason it is neither. */
+const planParser =
+  (schema: Readonly<z.ZodType<ReadyOrDraft>>) =>
+  (text: string): ParsedPlan => {
+    const json = jsonOf(text);
+    if (json === undefined) return { kind: "unreadable", why: "not JSON" };
+    const parsed = schema.safeParse(json);
+    return parsed.success
+      ? parsed.data
+      : { kind: "unreadable", why: reasons(parsed.error.issues) };
+  };
+
+/** A `plan.json` of a study of `kind`: strict. */
+export const parseStudyPlan = (text: string, kind: StudyKind): ParsedPlan =>
+  planParser(planFor(kind))(text);
+
+/** A plan still named `prereg.json`: loose, read only when a row names it. */
+export const parseLegacyPlan = planParser(legacyPlan);
+
 export const studyRegistryCodec: StudyRegistryCodec = {
   parse: parseStudyRegistry,
+  parsePlan: parseStudyPlan,
+  parseLegacyPlan,
 };

package/src/adapters/study-registry/mode.test.ts

@@ -0,0 +1,162 @@
+/**
+ * The schema of a study's mode (`mode` in its plan). Both halves: what `studies new` writes parses back
+ * to itself; a measurement's plan is ready only with exactly one mode; every contradiction is refused
+ * with its reason.
+ */
+import { expect, it } from "vitest";
+import type { StudyMode } from "../../domain/study-mode.ts";
+import {
+  planTemplate,
+  planText,
+  type StudyKind,
+  type StudyPlan,
+} from "../../domain/study-registry.ts";
+import { studyRegistryCodec } from "./index.ts";
+
+const DECIDED: StudyMode = {
+  kind: "decide_before_run",
+  outputs: ["data/outcome/**", "RESULTS.md"],
+  decision: {
+    file: "repro/P1-S01-x/decision.md",
+    note: "exclusions and the sample approved",
+  },
+};
+const EXPLORATORY: StudyMode = {
+  kind: "exploratory",
+  reason: "a first look at the logs, to find the question",
+};
+
+const PLAN: StudyPlan = {
+  question: "Does the hint help?",
+  population: {
+    source: "tasks, 2026-10-01",
+    draw: { kind: "all", method: "census" },
+  },
+  arms: [{ name: "hint" }, { name: "none" }],
+  primary_outcome: "pass rate",
+  author_check: null,
+  mode: DECIDED,
+};
+
+const parse = (text: string, kind: StudyKind = "measurement") =>
+  studyRegistryCodec.parsePlan(text, kind);
+const withMode = (mode: unknown): string => JSON.stringify({ ...PLAN, mode });
+const why = (text: string): string => {
+  const r = parse(text);
+  return r.kind === "unreadable" ? r.why : r.kind;
+};
+const empty = (text: string, kind: StudyKind = "measurement") => {
+  const r = parse(text, kind);
+  return r.kind === "draft" ? r.empty : r.kind;
+};
+
+it("each mode parses to itself, ready", () => {
+  // Guards: the three modes round-trip through the text planText writes.
+  expect(
+    [DECIDED, EXPLORATORY].map((mode) => parse(planText({ ...PLAN, mode }))),
+  ).toEqual(
+    [DECIDED, EXPLORATORY].map((mode) => ({
+      kind: "ready",
+      plan: { ...PLAN, mode },
+    })),
+  );
+});
+
+it("a measurement's plan without a mode is a draft naming `mode`; a spike's is ready", () => {
+  const none: StudyPlan = { ...PLAN, mode: undefined };
+  // Guards: "none" is not a ready state for a measurement — and a spike may omit it.
+  expect(empty(planText(none))).toEqual(["mode"]);
+  expect(empty(planText(none), "spike")).toBe("ready");
+});
+
+it("the template of a measurement is a draft decided before its run, its decision file named", () => {
+  const t = planTemplate("measurement", "P1-S02-x");
+  // Guards: `studies new` scaffolds the default mode; what is left to fill is named.
+  expect(t.mode).toEqual({
+    kind: "decide_before_run",
+    outputs: [],
+    decision: { file: "repro/P1-S02-x/decision.md", note: "" },
+  });
+  expect(empty(planText(t))).toEqual([
+    "question",
+    "population.source",
+    "population.draw.method",
+    "primary_outcome",
+    "mode.outputs",
+    "mode.decision.note",
+  ]);
+  expect(planTemplate("spike", "P1-S03-y").mode).toBeUndefined();
+});
+
+it("each mode's empty texts are named: the decision's, an exploratory reason", () => {
+  // Guards: a mode left half-written is a draft, so a study that has run on it is reported.
+  expect(
+    empty(
+      withMode({ ...DECIDED, outputs: [], decision: { file: " ", note: "" } }),
+    ),
+  ).toEqual(["mode.outputs", "mode.decision.file", "mode.decision.note"]);
+  expect(empty(withMode({ ...EXPLORATORY, reason: "" }))).toEqual([
+    "mode.reason",
+  ]);
+});
+
+it("two modes at once, or a mode that is neither, cannot be written", () => {
+  // Guards: exactly one — a second mode's key is an unknown key, an unknown kind is refused.
+  expect(why(withMode({ ...DECIDED, reason: "r" }))).toBe(
+    'mode: Unrecognized key: "reason"',
+  );
+  expect(why(withMode({ kind: "preregistered" }))).toBe(
+    "mode.kind: Invalid discriminator value. Expected 'decide_before_run' | 'exploratory'",
+  );
+  expect(why(withMode({ kind: "blind" }))).toBe(
+    "mode.kind: Invalid discriminator value. Expected 'decide_before_run' | 'exploratory'",
+  );
+});
+
+it("refuses an output outside the folder or naming the study's README, and a decision outside the paper", () => {
+  const outside =
+    "is not a path inside the study's folder, or names its README.md";
+  // Guards: a glob cannot reach past the study's folder; a decision cannot leave the paper.
+  expect(
+    ["../x", "/abs", "a\\b", "README.md"].map((o) =>
+      why(withMode({ ...DECIDED, outputs: [o] })),
+    ),
+  ).toEqual(Array.from({ length: 4 }, () => `mode.outputs.0: ${outside}`));
+  expect(why(withMode({ ...DECIDED, outputs: ["a", "a"] }))).toBe(
+    "mode.outputs: the output «a» is listed more than once",
+  );
+  expect(
+    ["../d.md", "/d.md", "a\\d.md"].map((file) =>
+      why(withMode({ ...DECIDED, decision: { file, note: "n" } })),
+    ),
+  ).toEqual(
+    Array.from(
+      { length: 3 },
+      () => "mode.decision.file: is not a path inside the paper's folder",
+    ),
+  );
+});
+
+it("refuses a decision path that names the paper's folder or a directory, and keeps an empty one a draft", () => {
+  const notFile =
+    "mode.decision.file: is not a path to a file inside the paper's folder: one or more names joined by /, none empty, . or ..";
+  // Guards: a decision of `.` would make the gate ask git about the whole paper, and the order rule
+  // read the paper's first commit as the decision; such a path cannot be written down.
+  expect(
+    [".", "./", "repro/", "a//d.md", "a/./d.md", "./d.md"].map((file) =>
+      why(withMode({ ...DECIDED, decision: { file, note: "n" } })),
+    ),
+  ).toEqual(Array(6).fill(notFile));
+  expect(
+    empty(withMode({ ...DECIDED, decision: { file: "", note: "n" } })),
+  ).toEqual(["mode.decision.file"]);
+});
+
+it("mode is a field of the plan, so extra cannot carry it", () => {
+  // Guards: one place says how a study is gated.
+  expect(
+    why(JSON.stringify({ ...PLAN, mode: undefined, extra: { mode: {} } })),
+  ).toBe(
+    "extra.mode: is a field of the plan itself — set it there, not in extra",
+  );
+});

package/src/cli.ts

@@ -190,6 +190,12 @@ import {
   studyRegistryRules,
 } from "./study-registry-rule.ts";
 import { studyRegistryCodec } from "./adapters/study-registry/index.ts";
+import { nodeListEntries, spawnProcess } from "./adapters/node/index.ts";
+import { gitHistory } from "./adapters/git/index.ts";
+import {
+  ORDER_RULE_LEVELS,
+  outputsBeforeDecisionRules,
+} from "./outputs-before-decision-rule.ts";
 import { runStudies } from "./studies.ts";
 import typography from "#eslint-rules/paper-typography";
 import texBuild from "#eslint-rules/tex-build";
@@ -238,10 +244,16 @@ const USAGE = `paperlint — machine-checkable gates for a paper kept in git
                                       change and keeps nothing
   npx paperlint studies new <paper-dir> "<title>" [--kind <kind>]
                                       register a study: the next id in repro/studies.json, the folder
-                                      repro/<id>-<slug>/ with its README.md, the row (status designing,
-                                      today's date), and the index in repro/README.md regenerated
+                                      repro/<id>-<slug>/ with its README.md and plan.json (a template),
+                                      the row (status designing, today's date, its plan), and the
+                                      index in repro/README.md regenerated
   npx paperlint studies index <paper-dir>
                                       regenerate the index in repro/README.md from repro/studies.json
+  npx paperlint studies gate <paper-dir> <id>
+                                      may the study's run start? For a study decided before its run
+                                      (the default mode), exit 0 only once its decision file is
+                                      committed as it stands, printing the commit and date; else exit
+                                      1 saying why. A runner calls it first: gate … && ./run.sh
   npx paperlint hook <name>           run an editor hook (.claude/settings.json calls this)
   npx paperlint --help
 
@@ -264,8 +276,12 @@ new:
 
 studies:
   --kind <kind>       new: measurement (the default), spike, tooling, data, artifact or salvage.
-                      A study's status, result and in_paper are edited in repro/studies.json;
-                      the rule repro/study-registered checks them (docs/rules/repro/study-registered.md)
+                      A study's status, result and in_paper are edited in repro/studies.json, its
+                      plan in its plan.json; the rule repro/study-registered checks them
+                      (docs/rules/repro/study-registered.md). A measurement's plan declares its
+                      mode: decide_before_run (written by new) or exploratory;
+                      repro/outputs-before-decision checks the order in git
+                      (docs/design/study-modes.md)
 
 submission:
   The venue preset declares the portal — "portal": { "kind": "hotcrp", "url": "<site>" } — and the
@@ -381,20 +397,43 @@ const FRAGMENT_RULES = {
   "heading-case": REGISTER_AND_CASE_RULES["heading-case"],
 };
 
+/** `names` of this process's environment, and nothing else of it. */
+const envOf =
+  (names: readonly string[]) =>
+  (env: Readonly<NodeJS.ProcessEnv>): Readonly<Record<string, string>> =>
+    Object.fromEntries(
+      Object.entries(env).filter(
+        (e): e is [string, string] =>
+          names.includes(e[0]) && e[1] !== undefined,
+      ),
+    );
+
+/** The environment git runs in: PATH, and HOME for its configuration. */
+const gitEnv = envOf(["PATH", "HOME"]);
+
+/** git's history, as the decide-first rule and the gate read it. */
+const GIT = gitHistory(spawnProcess(), gitEnv(process.env));
+
 /** What the two layout rules read with: the disk and its directory listings. */
 const LAYOUT_RULE_DEPS = { files: nodeFiles, listDir: nodeListDir };
 
 /** What `repro/study-registered` and `paperlint studies` read with: the layout's, and the registry's parser. */
-const STUDY_RULE_DEPS = { ...LAYOUT_RULE_DEPS, codec: studyRegistryCodec };
+const STUDY_RULE_DEPS = {
+  ...LAYOUT_RULE_DEPS,
+  entries: nodeListEntries,
+  codec: studyRegistryCodec,
+};
 
 /** The `repro` plugin's rules, on every `PIPELINE-STATUS.md`: the layout of `repro/`, and its study registry. */
 const REPRO_RULES = {
   ...reproLayoutRules(LAYOUT_RULE_DEPS),
   ...studyRegistryRules(STUDY_RULE_DEPS),
+  ...outputsBeforeDecisionRules({ ...STUDY_RULE_DEPS, git: GIT }),
 };
 const REPRO_RULE_LEVELS = {
   ...REPRO_LAYOUT_RULE_LEVELS,
   ...STUDY_REGISTRY_RULE_LEVELS,
+  ...ORDER_RULE_LEVELS,
 };
 
 /** Today in this machine's time zone, `YYYY-MM-DD`: the date `paperlint studies new` registers a study on. */
@@ -1673,7 +1712,14 @@ const SIMPLE: Readonly<
         extra: a.paths.slice(3),
         kind: a.kind,
       },
-      { ...STUDY_RULE_DEPS, cwd, today: today(), log, err },
+      {
+        ...STUDY_RULE_DEPS,
+        git: GIT,
+        cwd,
+        today: today(),
+        log,
+        err,
+      },
     ),
   submission: (a, { log, err, cwd }) =>
     runSubmission(