paperlint 2.0.0

package/skills/paper-pipeline/scripts/pipeline-check.mutations.mjs

@@ -0,0 +1,54 @@
+/**
+ * pipeline-check.mutations.mjs — plant the defect `pipeline-check.harness.mjs` claims to catch, and require it to die.
+ *
+ * Run: `node skills/paper-pipeline/scripts/pipeline-check.mutations.mjs` (it rewrites the source and restores
+ * it, so it is not part of the plain test run).
+ *
+ * WHY IT EXISTS. A harness whose success state is silence cannot be observed working: «it passed»
+ * and «it cannot fail» produce identical output. Written 2026-09-12, when the mechanism moved into
+ * this package and `scripts/run-mutations.mjs` reported this harness as one nothing could kill.
+ *
+ * ⚠️ HONEST SCOPE: ONE case. It kills the checker outright — the shape that makes every other
+ * assertion in the harness vacuous at once — and that is the property worth holding first, not the
+ * only one worth holding. Narrower cases were probed and left out DELIBERATELY: the assertions
+ * they trip carry no message of their own (a bare deepEqual diff), so `expect` could only match
+ * text any unrelated failure also prints, and a case killed by someone else's assertion is not
+ * evidence about its own defect. Adding one means giving that assertion a message first.
+ */
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { runMutations } from "../../../lib/mutation-driver.mjs";
+import { consumerRoot } from "./consumer.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SRC = join(HERE, "pipeline-check.mjs");
+const HARNESS = join(HERE, "pipeline-check.harness.mjs");
+
+const MUTATIONS = [
+  [
+    "check() goes blind",
+    [
+      [
+        SRC,
+        "export function check({ sections, header }, { sourceDate, today, dir }) {",
+        "export function check({ sections, header }, { sourceDate, today, dir }) {\n  if (1) return [];",
+      ],
+    ],
+    "stale-continuous: wrong finding set",
+    "every gate-staleness finding: a PIPELINE-STATUS that reports nothing reads as a clean one",
+  ],
+];
+
+process.exit(
+  runMutations({
+    root: consumerRoot(),
+    runner: "vigiles",
+    cases: MUTATIONS.map(([name, edits, expect, disables]) => ({
+      name,
+      disables,
+      edits,
+      harness: HARNESS,
+      expect,
+    })),
+  }),
+);

package/skills/paper-pipeline/scripts/pipeline-edges.mjs

@@ -0,0 +1,169 @@
+/**
+ * pipeline-edges — the ONE declaration of which scorecard row feeds which gate.
+ *
+ * WHY THIS FILE EXISTS. The dependencies between pipeline skills are already enforced: every paper's
+ * `PIPELINE-STATUS.md` has a `Requires` column in its `### GATES` table, and `pipeline-check.mjs`
+ * reads it and reports `gate-missing-input` / `gate-stale-input` / `unknown-input`. The machinery is
+ * right. What was hand-copied is the DECLARATION — each new paper retypes the cells, so a paper can
+ * drop an edge and the checker will then cheerfully confirm a gate that never had its input. That is
+ * not a hypothetical: on 2026-08-08 the live `<paper-a>` scorecard had `structure` requiring
+ * only `render`, while `argument-arc/SKILL.md` says in its own words that it runs *before*
+ * `tighten-paper`.
+ *
+ * WHY ONE TABLE HERE AND NOT A `requires:` FIELD IN EACH SKILL'S FRONTMATTER. The join key is the
+ * SCORECARD ROW ID (`structure`, `writing`, `panel`, …) — that is what the status files and the
+ * checker already speak — and a row id is not a property of a skill:
+ *   - one skill owns two rows: `plan-paper-timeline` owns `access` and `schedule`; `map-prior-work`
+ *     owns `priorwork` (SETUP sweep) and `priordelta` (CONTINUOUS delta); `argument-arc` owns `frame`
+ *     (frame) and `arc` (arc). Frontmatter keyed by skill cannot say which of its rows an edge lands on.
+ *   - one row has no skill at all: `claims` is "Fable diff", a protocol in `references/writing-craft.md`.
+ * Frontmatter would therefore need a second table mapping skills to rows, i.e. this table plus a
+ * layer. So: one table, keyed the way the rest of the system is keyed.
+ *
+ * 🔴 WHY THE IDS ARE WORDS AND NOT TWO LETTERS (renamed 2026-08-09). The join key used to be a
+ * two-letter code (`St`, `Wc`, `Pn`, …). That space was exhausted and had already collided: in
+ * `<paper-a>/PIPELINE-STATUS.md`, `Cr` was BOTH `cold-read-diff` (in the 06.08 gate log)
+ * and `Camera-ready` (in `### AFTER`) — one join key, two rows, and the checker merges rows by id.
+ * A second collision was live and silent: the row id `Id` (research-ideate) is exactly the table's
+ * own header word, so `parseStatus` dropped that row on every paper as if it were a header. Both are
+ * unrepresentable once the ids are words: `coldread` ≠ `cameraready`, and `idea` ≠ `id`.
+ *
+ * SCOPE, deliberately narrow. Only rows in the `### GATES` section appear here, because `Requires` is
+ * a GATES column — SETUP/LOOP/CONTINUOUS rows have nowhere to declare an input, so an edge into them
+ * is unexpressible and listing it would just be prose. The real ones found in the audit are recorded
+ * in `UNEXPRESSED` below rather than dropped.
+ *
+ * ADMISSION RULE (why an edge is here and not in `NOT_EDGES`): the owning skill states a REQUIREMENT
+ * ("required input", "blocked on", "STOP and run those first", "mandatory") or an ORDERING ("run it
+ * before X", "run X first") in normative prose — a `Run me` / axis / when-to-run section. An entry in
+ * a `## Compose with` list is a suggestion and does NOT qualify, even when it contains the word
+ * "first". Every edge carries the sentence that admitted it, so the judgement stays auditable.
+ *
+ * This is a table and a loop on purpose. There is no graph engine here, and there should not be one:
+ * a dozen edges do not need transitive closure, cycle detection or topological sorting, and building
+ * those is how a table nobody can read stops being maintained.
+ */
+
+/** row id → { skill (for the message), requires: { input row id → the sentence that admitted it } } */
+export const CANONICAL_INPUTS = {
+  structure: {
+    skill: "tighten-paper",
+    requires: {
+      render:
+        'render-paper/SKILL.md: "that page count is the hard input the `tighten-paper` structure gate is blocked on"',
+      arc: 'argument-arc/SKILL.md: "Run it *before* them" (them = tighten-paper, grade-paper-writing) — "cutting words inside a broken arc is how a session burns a day"',
+    },
+  },
+  writing: {
+    skill: "grade-paper-writing",
+    requires: {
+      draft:
+        "the template's own cell: the writing grade reads the current draft",
+      arc: 'argument-arc/SKILL.md: "Before `tighten-paper` / `grade-paper-writing` / `pc-panel-review` on any draft whose thesis has changed since those gates last ran"',
+      structure:
+        'tighten-paper/SKILL.md: "Run it BEFORE those on a bloated draft — no point polishing sentences in a section that should be cut"; harden-paper/SKILL.md: "Order matters: STRUCTURE before SENTENCES. Run axis 0 FIRST."',
+    },
+  },
+  panel: {
+    skill: "pc-panel-review",
+    requires: {
+      structure:
+        'pc-panel-review/SKILL.md: "there must exist for THIS draft … the **structural verdict** from `tighten-paper` … If either doesn\'t exist yet, STOP and run those skills first."',
+      writing:
+        'pc-panel-review/SKILL.md: "there must exist for THIS draft: (a) the **persona stall inventory** from `grade-paper-writing`"',
+    },
+  },
+  claims: {
+    skill: "Fable diff",
+    requires: {
+      draft:
+        "the template's own cell: the diff is against the pre-pass draft baseline",
+      writing:
+        'grade-paper-writing/SKILL.md: "**After applying sentence fixes, run the `claims` claim-preservation diff** … This step is mandatory after EVERY rewrite, not optional."',
+    },
+  },
+  harden: {
+    skill: "harden-paper",
+    requires: {
+      panel:
+        'harden-paper/SKILL.md axis 1: "run `paper-adversarial-review` (quick) and, as the final decision gate, `pc-panel-review`"',
+      structure:
+        'harden-paper/SKILL.md axis 0: "**Structure / editorial (run FIRST)** — run **`tighten-paper`**"; paper-pipeline/SKILL.md: "Its structure and writing axes are the **re-run/confirm** pass, not the first invocation."',
+      writing:
+        'harden-paper/SKILL.md axis 8: "run **`grade-paper-writing`** … Without it this axis silently does not run"',
+      cites:
+        'harden-paper/SKILL.md axis 4: "**Citations** — run `verify-citations`" under "## The axes (run all; each is a gate)"',
+      priordelta:
+        'map-prior-work/SKILL.md, the `priordelta` row: "**Whenever the contribution\'s framing moves**, and again before `harden-paper`."',
+    },
+  },
+  submit: {
+    skill: "submit-paper",
+    requires: {
+      harden:
+        'submit-paper/SKILL.md: "Harden first: `pc-panel-review` (incl. its venue-fit mode), `paper-adversarial-review`, `render-paper`."',
+      access:
+        'paper-pipeline/SKILL.md GATES table, Submit: "🔴 **The `access` row green.**"',
+    },
+  },
+};
+
+/**
+ * Orderings that are REAL but have nowhere to be declared: they end in a SETUP or LOOP row, and only
+ * GATES rows carry a `Requires` cell. Kept here so the audit is complete and so nobody re-derives
+ * them and then invents a column for them.
+ */
+export const UNEXPRESSED = [
+  [
+    "schedule ← venue",
+    'plan-paper-timeline/SKILL.md: "`find-venue` — the source of the four CFP dates this skill consumes; run it first."',
+  ],
+  [
+    "access ← venue",
+    "same sentence: the portal and its form are venue facts, so the venue is picked first.",
+  ],
+  [
+    "draft ← study",
+    'draft-paper/SKILL.md: "**FAIL** — it declined to draft because a required input was missing: no numbers from build-benchmark"',
+  ],
+  [
+    "priorwork ← idea",
+    'paper-pipeline/SKILL.md SETUP: map-prior-work runs "right after `research-ideate` says go"',
+  ],
+];
+
+/**
+ * Claims read during the audit and JUDGED TOO WEAK to be an edge, with the sentence that made the
+ * call hesitate. Recorded because "we looked and decided no" and "we never looked" are
+ * indistinguishable afterwards, and the first is only worth anything if it is written down.
+ */
+export const NOT_EDGES = [
+  [
+    "panel ← arc",
+    'argument-arc/SKILL.md: "Before `tighten-paper` / `grade-paper-writing` / `pc-panel-review` **on any draft whose thesis has changed since those gates last ran**." — conditional, and panel already requires structure and writing, which both require arc, so declaring it adds no enforcement.',
+  ],
+  [
+    "writing ← render",
+    'grade-paper-writing/SKILL.md: "`render-paper` — build the PDF/PNGs first so you grade what the reviewer will actually see." — it is an entry in the `## Compose with` list and about fidelity of grading, not a block. `tighten-paper` states its render dependency in normative prose; this one does not.',
+  ],
+  [
+    "harden ← siblings",
+    'harden-paper/SKILL.md axis 3: "For every genuine sibling found, run **`analyze-sibling-paper`**" — conditional on a sibling existing, and `siblings` is itself a trigger row that is n/a on a paper with no close neighbour.',
+  ],
+  [
+    "harden ← venuebar",
+    'study-accepted-papers/SKILL.md: "`harden-paper` — the multi-axis pre-submit gate; this skill **feeds it** the venue-specific axis" — a compose-with, and harden\'s own axis list never calls it.',
+  ],
+  [
+    "harden ← siblings (via analyze-sibling-paper)",
+    'analyze-sibling-paper/SKILL.md: "Compose with … harden-paper (its nearest-neighbor-scoop axis calls this)" — a compose-with sentence in a description, mirrored by the conditional above.',
+  ],
+  [
+    "structure ← draft",
+    'tighten-paper/SKILL.md description: "The developmental / editorial pass on a **DRAFTED** paper" — states a precondition on the object, not on a scorecard row, and no sentence orders it against `draft`.',
+  ],
+  [
+    "writing ← panel / claims ← panel / harden ← claims (the chain read off the GATES table order)",
+    'paper-pipeline/SKILL.md: "Ordered, and the order is real: every one refuses to run without the output of the one before it." — the same table\'s own `Requires (hard)` column contradicts it (Writing craft requires "The current draft", not the structure verdict). Rhetoric about the table, not a declaration; the column is the declaration.',
+  ],
+];

package/skills/paper-pipeline/scripts/population-map.harness.mjs

@@ -0,0 +1,178 @@
+/**
+ * population-map.harness.mjs — the population gate, made visible to the metric, plus the layer
+ * its own self-test cannot reach. `npx vigiles test .claude/skills/paper-pipeline/scripts/population-map.harness.mjs`.
+ *
+ * 🔴 SCOPE NARROWED 2026-08-26. Two findings out of four (`untied`, `undeclared`) moved to ESLint
+ * rules — `paper/population-untied` and `paper/population-undeclared`, tests for them in
+ * `eslint-rules/paper-registry.harness.mjs`. Two remain here: `stale` and `badref`, both are about
+ * THE REGISTRY ITSELF (`repro/populations.tsv`), both have no address in the paper, and so cannot be expressed by ESLint,
+ * which reports only to the linted file.
+ *
+ * WHY THIS FILE AND NOT MORE CASES IN THE SELF-TEST. `population-map.selftest.mjs` is thorough —
+ * 7 planted cases, both directions. Nothing here duplicates it. Two things were wrong with it
+ * anyway:
+ *
+ *   1. IT IS INVISIBLE TO THE MEASUREMENT. `vigiles audit` scores this repo `Tested: 0`, and the
+ *      metric counts `*.harness.mjs` / `*.eval.mjs`. Verified 2026-08-07: bare `npx vigiles test`
+ *      reports no harness files found — its glob does not descend into dot-dirs AND the self-test
+ *      does not carry a name the collector looks for. Given an explicit path it runs
+ *      fine, which is the trap: it is green, correct, and uncounted, so the repo reads
+ *      as having no test for its own registry hygiene.
+ *
+ *   2. IT ONLY EXERCISES `findings()`. Everything between the command line and that function —
+ *      finding paper.md, finding repro/populations.tsv, `--flags-only` staying silent on a clean
+ *      paper — is what the CI step and `run-mechanical.mjs` actually invoke, and none of it was
+ *      under test. This repository's three dead hooks all had correct logic; what was broken was
+ *      the wiring around it.
+ *
+ * 🔴 THE SELF-TEST IS RUN AS A SUBPROCESS, NEVER IMPORTED. It ends in `process.exit(fail ? 1 : 0)`.
+ * Import it and a PASSING self-test terminates this process at that line — every assertion below it
+ * never runs, and `vigiles test` reports ✓ because nothing threw. That is trap #1 from
+ * hooks.harness.mjs wearing a different hat, and it would have been undetectable from the output.
+ *
+ * Every fixture is a throwaway in a temp dir; nothing here reads or writes a real paper.
+ */
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  rmSync,
+  realpathSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { consumerRoot } from "./consumer.mjs";
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+const ROOT = consumerRoot();
+const SCRIPT = join(HERE, "population-map.mjs");
+const SELFTEST = join(HERE, "population-map.selftest.mjs");
+const tmp = realpathSync(mkdtempSync(join(tmpdir(), "popmap-harness-")));
+
+/** Run a node script; never throws on a non-zero exit. */
+function run(argv) {
+  try {
+    return {
+      code: 0,
+      out: execFileSync("node", argv, {
+        cwd: ROOT,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+      }),
+    };
+  } catch (e) {
+    return { code: e.status ?? 1, out: (e.stdout || "") + (e.stderr || "") };
+  }
+}
+
+/** A paper dir carrying `body`, and optionally a population registry. */
+function paper(name, body, tsv) {
+  const d = join(tmp, name);
+  mkdirSync(join(d, "repro"), { recursive: true });
+  writeFileSync(
+    join(d, "paper.md"),
+    `## Abstract\n\n${body}\n\n## References\n\n[1] x.\n`,
+  );
+  if (tsv !== undefined)
+    writeFileSync(join(d, "repro", "populations.tsv"), tsv);
+  return d;
+}
+
+const REG = [
+  "id\tprinted\trelation\trelated_to\tgloss",
+  "broad\t1,921\troot\t\tthe corpus",
+  "census\t134\tdisjoint\tbroad\ta separate sample",
+].join("\n");
+
+// ── 1. the self-test still kills every mutant it claims to ─────────────────────────────
+// Owning it from a *.harness.mjs is the whole point: the metric now counts it, and a regression in
+// the self-test itself fails this file rather than passing unnoticed in a step nobody reads.
+{
+  const r = run([SELFTEST]);
+  assert.equal(r.code, 0, "population-map.selftest.mjs failed:\n" + r.out);
+  const m = r.out.match(/(\d+) passed, (\d+) failed/);
+  assert.ok(
+    m,
+    "the self-test printed no result line — it may have exited before running:\n" +
+      r.out,
+  );
+  // A self-test that runs ZERO cases also prints "0 failed" and exits 0. That shape is exactly how
+  // this repo's earlier harness reported ✓ on `assert.equal(1, 2)`, so the count is asserted too.
+  // Threshold lowered 13 → 7 along with the move of two findings to ESLint. The assertion on COUNT is kept:
+  // a self-test that ran zero cases also prints «0 failed» and exits zero.
+  assert.ok(
+    Number(m[1]) >= 7,
+    `the self-test ran only ${m[1]} case(s) — cases have gone missing`,
+  );
+  assert.equal(Number(m[2]), 0, "the self-test reported failures:\n" + r.out);
+}
+
+// ── 2. the CLI finds the paper and the registry, and fires on a stale registry row ─────
+// 🔴 FIXTURE REWRITTEN 2026-08-26. Before that it planted an UNLINKED POPULATION, and that
+// finding moved to `paper/population-untied` — meaning the old «dirty» input became clean, and
+// the block would silently stop checking the argv → findings() wiring while staying green. Exactly that
+// class of failure this file was written for.
+{
+  const dirty = paper(
+    "cli-stale",
+    "The resolver ran over all 1,921 repositories at pinned commits.",
+    REG,
+  );
+  const r = run([SCRIPT, dirty, "--flags-only"]);
+  assert.match(
+    r.out,
+    /134 \(census\) is declared and the body no longer prints it/,
+    "the CLI did not report a stale registry row — the self-test proves findings() sees it, so what " +
+      "is broken is the path from argv to findings():\n" +
+      r.out,
+  );
+}
+
+// ── 3. …and says NOTHING when every declared population is printed ──────────────────────
+// The direction that matters more. A gate that fires on a paper which already obeys the rule gets
+// muted the same week, and a muted gate is indistinguishable from an absent one.
+{
+  const clean = paper(
+    "cli-clean",
+    "The resolver ran over all 1,921 repositories at pinned commits, and a census of 134\nrepositories is a separate sample from those 1,921, overlapping in seven.",
+    REG,
+  );
+  const r = run([SCRIPT, clean, "--flags-only"]);
+  assert.equal(
+    r.out.trim(),
+    "",
+    "--flags-only printed something about a paper whose registry matches its body:\n" +
+      r.out,
+  );
+}
+
+// ── 4. KNOWN GAP, asserted so it stays visible ─────────────────────────────────────────
+// 🔴 A paper with NO repro/populations.tsv exits 0 in silence, and `run-mechanical.mjs` records
+// that silence as PASS for draft-paper. So a paper that never declared its populations scores
+// identically to one that declared them and tied every one. Absence is invisible again — the same
+// shape artifact-coverage.mjs was written to close for the released bundle.
+//
+// This asserts the CURRENT behaviour. When population-map learns to say "this paper has no
+// registry", this assertion flips and must be updated; writing the gap down is how it stops being
+// mistaken for coverage.
+{
+  const bare = paper(
+    "cli-no-registry",
+    "We measured 1,921 repositories and a census of 134 repositories.",
+    undefined,
+  );
+  const r = run([SCRIPT, bare, "--flags-only"]);
+  assert.equal(
+    r.out.trim(),
+    "",
+    "population-map now says something about a paper with no registry — good; update this assertion",
+  );
+}
+
+rmSync(tmp, { recursive: true, force: true });
+console.log(
+  "✓ population-map: self-test owned (7 cases), CLI wiring fires on a stale row and stays quiet, 1 known gap recorded",
+);

package/skills/paper-pipeline/scripts/population-map.mjs

@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+/**
+ * population-map.mjs — does the population registry keep its link to the body of the paper?
+ *
+ * (Before 2026-08-26 this file answered the question "can the reader tell WHICH SET each number
+ *  counts" in full; half of the answer now lives in ESLint rules — see below.)
+ *
+ *   node population-map.mjs <paper-dir>              report
+ *   node population-map.mjs <paper-dir> --flags-only for hooks and pre-commit
+ *
+ * 🔴 WHY THIS EXISTS. `papers/CLAUDE.md` has carried this as writing rule #3 since 2026-08-05:
+ *
+ *     "A number arrives together with what it counts, and out of what. […] If two numbers come
+ *      from different experiments — say so IN THE SAME SENTENCE."
+ *
+ * It was written after a cold reader gave up tracking the abstract's populations halfway through.
+ * It is prose. Nothing enforced it. On 2026-08-06 the author read the finished paper and said he
+ * could not follow his own §4 — and the cause was not the count of measurements, it was that §4
+ * moves between TWO SAMPLES THAT BARELY OVERLAP (a targeted census of 134 repositories and a broad
+ * corpus of 1,921; seven repositories are in both) and never says so. §4.1's rate and §4.3's rate
+ * read as if one replicated the other. They cannot: they are different populations.
+ *
+ * That is this repository's own thesis turned on its own manuscript — a rule written in a rules
+ * file, with no mechanism behind it, that therefore did nothing for a year of edits. So the rule
+ * gets a leg.
+ *
+ * 🔴 TWO OF THE FOUR FINDINGS MOVED INTO ESLint RULES ON 2026-08-26. What is left here is only
+ * what speaks about THE REGISTRY ITSELF, not about the paper:
+ *
+ *   stale    a registry row for a quantity the body NO LONGER PRINTS. The registry shrinks together
+ *            with the paper and does not rot.
+ *   badref   a row points at a `related_to` that is not a row anywhere.
+ *
+ * Both are inseparable from the file `repro/populations.tsv` and HAVE NO ADDRESS IN THE PAPER:
+ * `stale` by definition speaks about a number that is not in the paper, and `badref` about two
+ * fields of one TSV row. An ESLint rule can only report into the file being linted, so moving them
+ * would mean pointing a finger at the paper while talking about a different file.
+ *
+ * MOVED INTO `eslint-rules/paper-registry.mjs` (the rules `paper/population-untied` and
+ * `paper/population-undeclared`):
+ *   untied      — a population is not named IN THE SAME SENTENCE as the one it is derived from;
+ *   undeclared  — a number is printed in the shape of a population, and no registry row declares it.
+ * Both speak about a place IN THE PAPER, and for them the registry is configuration, exactly like a
+ * venue profile for `pdf/profile`. Parity was proved before the deletion (the real paper + 17
+ * fixtures), the write-up is in `the author's private research notes`.
+ *
+ * Advisory.
+ */
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import {
+  headings as mdHeadings,
+  requireMarkdown,
+} from "../../../lib/markdown.mjs";
+import { isMain } from "./consumer.mjs";
+
+// Markup is parsed with a parser (`CLAUDE.md`, 2026-08-11). We fail rather than degrade: without
+// the body boundaries `bodyOf()` would return an empty string, and out of an empty string this
+// check concludes "not a single registry number is printed", that is, ALL rows stale — a confident
+// list of findings about a paper nobody read.
+requireMarkdown();
+
+/** The body is everything before the bibliography; appendices sit after it in this paper and are
+ *  not under the page limit, so a relation stated only there does not reach the reader who stops
+ *  at the References. That asymmetry is the whole point of checking the body separately. */
+export function bodyOf(md) {
+  const stripped = md.replace(/<!--[\s\S]*?-->/g, "");
+  // 2026-08-11: both body boundaries come from the parser. `/^##\s+References\s*$/m` opened and
+  // closed the body on hashes at the start of a line — including hashes inside a ```-block, and this
+  // paper quotes whole chunks of other people's papers. The `-1` convention and the `< 0`
+  // comparisons are left as they were.
+  const at = (re) => {
+    const h = mdHeadings(stripped).find(
+      (x) => x.depth === 2 && re.test(x.text),
+    );
+    return h ? h.offset : -1;
+  };
+  const cut = at(/^References$/u);
+  const start = at(/^Abstract$/u);
+  return stripped.slice(start < 0 ? 0 : start, cut < 0 ? stripped.length : cut);
+}
+
+const asLiteral = (n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** A printed quantity, not a substring of a longer one: 189 must not match inside 1,189 or 1893.
+ *  The trailing guard must still allow ORDINARY PUNCTUATION after the number — "of the 1,921, we
+ *  could enumerate 189" and a sentence-final "...over all 1,921." are both the number being
+ *  printed. Forbidding any following `.` or `,` silently loses exactly the positions a summary
+ *  figure lands in; only a DIGIT after the separator makes it part of a longer quantity. */
+const printed = (n) => new RegExp(`(?<![\\d,.])${asLiteral(n)}(?!\\d|[,.]\\d)`);
+
+export function parseRegistry(tsv) {
+  const rows = [];
+  for (const line of tsv.split("\n")) {
+    if (!line.trim() || line.startsWith("#")) continue;
+    const [id, print, relation, relatedTo, gloss] = line
+      .split("\t")
+      .map((c) => (c ?? "").trim());
+    if (!id || id === "id") continue;
+    rows.push({ id, print, relation, relatedTo, gloss });
+  }
+  return rows;
+}
+
+export function findings(md, tsv) {
+  const body = bodyOf(md);
+  const reg = parseRegistry(tsv);
+  const byId = new Map(reg.map((r) => [r.id, r]));
+  const out = [];
+
+  for (const row of reg) {
+    const appears = printed(row.print).test(body);
+    if (!appears) {
+      // A registry row for a quantity the body no longer prints. Same discipline as the
+      // grandfathered numbers list: the registry shrinks when the paper does, and never rots.
+      if (row.relation !== "retired") out.push({ kind: "stale", row });
+      continue;
+    }
+    if (row.relation === "root" || row.relation === "external") continue;
+    // The order is preserved from the original: `untied` was computed AFTER this check and moved
+    // into `paper/population-untied`; the dangling reference stayed here because it is about a TSV
+    // row.
+    if (!byId.get(row.relatedTo)) out.push({ kind: "badref", row });
+  }
+  return out;
+}
+
+/* Importable above this line; the CLI only runs when this file is the entry point, so the selftest
+ * can exercise findings() without the argv handling firing. */
+if (!isMain(import.meta.url)) {
+  // imported — nothing to do
+} else main();
+
+function main() {
+  const args = process.argv.slice(2);
+  const dir = args.find((a) => !a.startsWith("--"));
+  const flagsOnly = args.includes("--flags-only");
+  if (!dir) {
+    console.error("usage: node population-map.mjs <paper-dir> [--flags-only]");
+    process.exit(0);
+  }
+
+  const paperPath = ["paper.md", "draft.md"]
+    .map((f) => join(dir, f))
+    .find(existsSync);
+  const regPath = join(dir, "repro", "populations.tsv");
+  // Same silent-skip class as artifact-coverage.mjs — see the note there (measured 2026-08-25).
+  if (!paperPath || !existsSync(regPath)) {
+    const why = !paperPath
+      ? "no paper.md/draft.md — this checker reads markdown only, a .tex paper is NOT covered"
+      : `no registry at ${regPath}`;
+    console.error(`⏭️  population map SKIPPED for ${dir} — ${why}.`);
+    process.exit(0);
+  }
+
+  const found = findings(
+    readFileSync(paperPath, "utf8"),
+    readFileSync(regPath, "utf8"),
+  );
+
+  if (!found.length) {
+    if (!flagsOnly)
+      console.log(
+        "population map: the registry matches the body — no stale rows, no dangling related_to.",
+      );
+    process.exit(0);
+  }
+
+  console.log(`population map — ${found.length} finding(s) in ${paperPath}`);
+  for (const f of found) {
+    if (f.kind === "stale") {
+      console.log(
+        `  ·  ${f.row.print} (${f.row.id}) is declared and the body no longer prints it — drop the row or mark it retired`,
+      );
+    } else if (f.kind === "badref") {
+      console.log(
+        `  🔴 ${f.row.id} says it relates to "${f.row.relatedTo}", which is not a row in populations.tsv`,
+      );
+    }
+  }
+  process.exit(0);
+}

package/skills/paper-pipeline/scripts/population-map.mutations.mjs

@@ -0,0 +1,65 @@
+/**
+ * population-map.mutations.mjs — plant each defect `population-map.harness.mjs` claims to catch, and require it to die.
+ *
+ * Run: `node skills/paper-pipeline/scripts/population-map.mutations.mjs` (~1 min; it rewrites the source and
+ * restores it, so it is not part of the plain test run).
+ *
+ * WHY IT EXISTS. A harness whose success state is silence cannot be observed working: «it passed»
+ * and «it cannot fail» produce identical output. This battery is the difference. It was written on
+ * 2026-09-12, when the mechanism moved into this package and `scripts/run-mutations.mjs` reported
+ * this harness as one nothing could kill — a gap that had been open for as long as the harness had
+ * existed, invisible because nothing asked the question.
+ *
+ * Every replacement below differs from the text it replaces (the driver refuses a no-op, which
+ * would leave a green harness proving nothing), every case names the assertion that must fire, and
+ * the driver verifies the patch actually landed before believing a result.
+ */
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { runMutations } from "../../../lib/mutation-driver.mjs";
+import { consumerRoot } from "./consumer.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const SRC = join(HERE, "population-map.mjs");
+const HARNESS = join(HERE, "population-map.harness.mjs");
+
+const MUTATIONS = [
+  [
+    "findings() goes blind",
+    [
+      [
+        SRC,
+        "export function findings(md, tsv) {",
+        "export function findings(md, tsv) {\n  if (1) return [];",
+      ],
+    ],
+    "population-map.selftest.mjs failed",
+    "the whole checker: a registry map that reports nothing reads exactly like a clean paper",
+  ],
+  [
+    "the registry is never parsed",
+    [
+      [
+        SRC,
+        "export function parseRegistry(tsv) {",
+        "export function parseRegistry(tsv) {\n  if (1) return [];",
+      ],
+    ],
+    "population-map.selftest.mjs failed",
+    "every row-level finding — an empty registry makes stale rows and dangling refs unrepresentable",
+  ],
+];
+
+process.exit(
+  runMutations({
+    root: consumerRoot(),
+    runner: "vigiles",
+    cases: MUTATIONS.map(([name, edits, expect, disables]) => ({
+      name,
+      disables,
+      edits,
+      harness: HARNESS,
+      expect,
+    })),
+  }),
+);