paperlint 2.0.0

package/eslint-rules/paper-stages.mjs

@@ -0,0 +1,455 @@
+/**
+ * `paper/stages` — the stage a paper has reached is an author's CLAIM, so it is a FIELD, and
+ * the bytes on disk are the evidence that claim is checked against.
+ *
+ * ── WHAT THIS REPLACES, and why the replacement is not cosmetic ─────────────────────────
+ * The predecessor kept a vocabulary of stage names in a JS const and applied its regexes to
+ * the WHOLE of `PIPELINE-STATUS.md`:
+ *
+ *     { stage: "submitted", declaredBy: /(?<!\bas\s)(?<!\bbe\s)\bsubmitted\b/i }
+ *
+ * The lookbehinds are not decoration — they were added after the only match in one paper's
+ * file turned out to be a reviewer's idiom, "Weak Accept as submitted", which says nothing
+ * about submission. The check then demanded a frozen pdf and was RIGHT BY ACCIDENT.
+ *
+ * 🔴 And it stayed wrong in the other direction, measured 2026-09-16 on the live corpus:
+ * `versions/2026-08-29-camera-ready.pdf` had been on disk for 16 days at 616 175 bytes while
+ * the `camera-ready` pattern matched ZERO times anywhere in the file. The artefact preceded
+ * the declaration, so all three checks gated on that declaration were blind by construction.
+ *
+ * ── TWO DIRECTIONS, and neither alone is the check ──────────────────────────────────────
+ *   declared -> bytes   a record without its file, or with the wrong size, is a false claim
+ *   bytes -> declared   a frozen version nobody declared is the case above, and it is also
+ *                       what stops the whole rule being switched off by deleting a line
+ *
+ * Absence of the field is therefore LEGITIMATE — a paper that has shipped nothing owes
+ * nothing — without being an escape hatch: the second direction still speaks if bytes exist.
+ * That asymmetry is deliberate and is the reason this rule does not copy `doc/fields`, where
+ * a missing frontmatter IS the finding.
+ *
+ * ── WHY A FIELD CANNOT BECOME A TICKED BOX HERE ─────────────────────────────────────────
+ * The usual objection to turning a check into a field is that a field gets ticked instead of
+ * the work being done. It does not apply, and the reason is the direction of the incentive:
+ * a tick normally REMOVES an obligation, while `stages` CREATES them — declare a stage and
+ * you owe a pdf of the right size. Nobody writes a line in order to receive findings. The
+ * real-world pressure is to UNDER-declare, which is exactly what direction two catches.
+ *
+ * ── THE FIELD IS THE ONLY MACHINE-READABLE CARRIER ──────────────────────────────────────
+ * ⚠️ A paper's status file also carries a `State:` line in its header and one or two
+ * scorecard tables. Those are DISPLAY. No consistency check between them is written here on
+ * purpose: one paper in the source corpus carries two scorecards in two different column
+ * formats, and a rule reconciling them would drown in noise within a day.
+ *
+ * ── A LIST, NOT A MAP, and that is load-bearing ─────────────────────────────────────────
+ * A paper can reach the same stage twice: one in the source corpus was submitted to a venue
+ * in August, rejected in September, and is being resubmitted elsewhere in October. A map
+ * keyed by stage name holds one. The `versions/<date>-<stage>.pdf` convention already holds
+ * many, and the field must not be weaker than the filenames it describes.
+ */
+import { existsSync, statSync, readdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { load } from "js-yaml";
+
+const STAGES = ["submitted", "camera-ready", "arxiv"];
+
+/**
+ * A YAML date without quotes parses to a `Date`, not a string — js-yaml honours YAML 1.1
+ * timestamps. Comparing `Date === "2026-08-29"` is silently false, so every date is
+ * normalised before it is compared with one taken from a filename.
+ */
+function isoDate(v) {
+  if (v instanceof Date) return v.toISOString().slice(0, 10);
+  if (typeof v === "string") return /^\d{4}-\d{2}-\d{2}/.exec(v)?.[0] ?? "";
+  return "";
+}
+
+/** Frozen versions on disk, as `{name, date, stage}`. */
+function frozenPdfs(versionsDir) {
+  let names;
+  try {
+    names = readdirSync(versionsDir);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of names) {
+    if (!name.endsWith(".pdf")) continue;
+    // ⚠️ A name carrying `STALE` is a version WITHDRAWN on purpose — one such file records
+    // that the wrong pdf sat in the folder for a month. Demanding a declaration for it would
+    // turn a deliberate record of a mistake into a finding.
+    if (name.includes("STALE")) continue;
+    const m = /^(\d{4}-\d{2}-\d{2})-(.+)\.pdf$/.exec(name);
+    if (!m) continue;
+    if (!STAGES.includes(m[2])) continue;
+    out.push({ name, date: m[1], stage: m[2] });
+  }
+  return out;
+}
+
+export default {
+  rules: {
+    stages: {
+      meta: {
+        type: "problem",
+        docs: {
+          description:
+            "a paper's stage is declared as a FIELD, and every declaration is checked against the bytes on disk in both directions",
+        },
+        schema: [],
+        messages: {
+          badYaml: "the frontmatter does not parse as YAML: {{reason}}",
+          notAList:
+            "`stages` must be a LIST of entries, not {{got}} — a paper can reach the same stage twice",
+          badStage: "unknown stage «{{stage}}» — the vocabulary is: {{known}}",
+          missingKey: "the «{{stage}}» entry has no `{{key}}` field",
+          badDate:
+            "the date «{{date}}» in the «{{stage}}» entry is not YYYY-MM-DD",
+          declaredNoFile:
+            "stage «{{stage}}» ({{date}}) is declared, but `{{pdf}}` is not on disk",
+          bytesDiffer:
+            "«{{stage}}» ({{date}}): {{want}} bytes declared, {{got}} on disk — this is NOT that file",
+          fileNotDeclared:
+            "`versions/{{file}}` is frozen, but no «{{stage}}» stage on {{date}} is declared in `stages` — the artefact ran ahead of the declaration",
+        },
+      },
+      create(context) {
+        const dir = dirname(context.filename);
+        let declared = null; // null = there was no frontmatter at all
+
+        return {
+          yaml(node) {
+            let data;
+            try {
+              data = load(node.value ?? "");
+            } catch (e) {
+              context.report({
+                node,
+                messageId: "badYaml",
+                data: { reason: String(e.message) },
+              });
+              return;
+            }
+            const raw = data?.stages;
+            if (raw === undefined) return;
+            if (!Array.isArray(raw)) {
+              context.report({
+                node,
+                messageId: "notAList",
+                data: { got: raw === null ? "empty" : typeof raw },
+              });
+              return;
+            }
+            declared = [];
+            for (const rec of raw) {
+              const stage = String(rec?.stage ?? "");
+              if (!STAGES.includes(stage)) {
+                context.report({
+                  node,
+                  messageId: "badStage",
+                  data: { stage, known: STAGES.join(" · ") },
+                });
+                continue;
+              }
+              let complete = true;
+              for (const key of ["date", "pdf", "bytes"]) {
+                if (rec[key] === undefined) {
+                  context.report({
+                    node,
+                    messageId: "missingKey",
+                    data: { stage, key },
+                  });
+                  complete = false;
+                }
+              }
+              if (!complete) continue;
+              const date = isoDate(rec.date);
+              if (date === "") {
+                context.report({
+                  node,
+                  messageId: "badDate",
+                  data: { stage, date: String(rec.date) },
+                });
+                continue;
+              }
+              declared.push({
+                stage,
+                date,
+                pdf: String(rec.pdf),
+                bytes: Number(rec.bytes),
+              });
+
+              // ── direction one: a claim owes its bytes ────────────────────────────────
+              const abs = join(dir, String(rec.pdf));
+              if (!existsSync(abs)) {
+                context.report({
+                  node,
+                  messageId: "declaredNoFile",
+                  data: { stage, date, pdf: String(rec.pdf) },
+                });
+                continue;
+              }
+              const got = statSync(abs).size;
+              if (got !== Number(rec.bytes)) {
+                context.report({
+                  node,
+                  messageId: "bytesDiffer",
+                  data: {
+                    stage,
+                    date,
+                    want: String(rec.bytes),
+                    got: String(got),
+                  },
+                });
+              }
+            }
+          },
+
+          // ── direction two: bytes owe their declaration ────────────────────────────────
+          // 🔴 On `root:exit` rather than inside `yaml`, because the case worth catching is
+          // precisely the one with NO frontmatter at all — where the `yaml` visitor never runs.
+          "root:exit"(node) {
+            const records = declared ?? [];
+            for (const f of frozenPdfs(join(dir, "versions"))) {
+              if (records.some((r) => r.stage === f.stage && r.date === f.date))
+                continue;
+              context.report({
+                node,
+                messageId: "fileNotDeclared",
+                data: { file: f.name, stage: f.stage, date: f.date },
+              });
+            }
+          },
+        };
+      },
+    },
+
+    /**
+     * `paper/source` — a declared stage must have its SOURCE frozen on disk, beside the pdf,
+     * and the bytes must match. Not a commit reference. Not a hash of one.
+     *
+     * ── WHY NOT A COMMIT, measured 2026-09-16 and it is not a close call ──────────────────
+     * The predecessor recorded provenance as `commit <sha>` in prose and checked that the sha
+     * RESOLVED. Its stated premise was "git holds those bytes immutably, materialising a copy
+     * duplicates a guarantee we already have". That premise is false wherever branches are
+     * SQUASH-merged: the squash destroys the branch commits, and the next `git gc` removes
+     * the objects.
+     *
+     * 🔴 Measured on the live corpus, inside ninety minutes of ONE session: two recorded shas
+     * resolved, then stopped resolving after a routine `gc` following a branch reset. Of the
+     * four declared stages in that corpus, THREE had lost their source entirely — including
+     * papers already submitted to a venue, which is exactly the case the check existed for
+     * (a reviewer cites a line number and there is no layout left to resolve it against).
+     *
+     * So a sha is not a pointer to bytes; it is a pointer to a pointer, and the outer one
+     * evaporates. Checking it verifies that the REFERENCE is alive, which is a different
+     * claim from the one anybody wants.
+     *
+     * ── COST, because "duplicating" was the objection ─────────────────────────────────────
+     * A paper source is 57-68 KB of LaTeX beside a pdf of 305-382 KB that is already
+     * committed. Freezing it adds under a fifth to what the folder holds anyway, and turns a
+     * claim about the world into bytes this rule can actually compare.
+     *
+     * ── SEVERITY: nudge, and the reason CHANGED ──────────────────────────────────────────
+     * Still `warn` at the consumer, but no longer because "only the author knows". Now it is
+     * because a stage frozen BEFORE this convention existed cannot be fixed at all — those
+     * bytes are gone. Failing a build over unrecoverable history is a gate nobody can clear.
+     */
+    /**
+     * `paper/author-list` — a shipped paper OWES ITSELF a run of the author-list cross-check.
+     *
+     * The class this cross-check catches is invisible to an existence check on citations: the
+     * citation exists, the identifier resolves, and the authors are taken from the PREPRINT
+     * while the entry declares a conference. On the live corpus this turned up seven records
+     * across three papers, including a DROPPED LIVING PERSON (`schick2023toolformer` — Eric
+     * Hambro is missing; the NeurIPS version has nine authors, the preprint has eight). Two of
+     * the seven were found on a paper ALREADY SUBMITTED.
+     *
+     * 🔴 WHAT THE MOVE FIXED, and this is a measurement, not taste. The predecessor derived the
+     * declared stage with a REGEX OVER THE PROSE of that same file. Remeasured 2026-09-17 on the
+     * live corpus: for `agenticdev-2026` the prose reads `submitted`, the frontmatter declares
+     * `submitted, camera-ready` — the pattern `/camera-ready (?:uploaded|submitted|shipped)/i`
+     * does not catch the form the stage is actually recorded in. Today's set of findings did not
+     * change from this (both checks only asked "is there ANY stage at all"), but the MESSAGE
+     * printed the wrong list of stages. The subject here is the same `stages` field that
+     * `paper/stages` already checks against the bytes in both directions.
+     *
+     * 🔴 THE MARKER IS LOOKED FOR IN TABLE CELLS, NOT GREPPED OVER THE FILE. The first draft did
+     * `context.sourceCode.text.includes(marker)` and justified it with a comment saying "a
+     * footnote cell has no node of its own". That turned out to be SIMPLY WRONG — a 2026-09-17
+     * measurement showed the markdown parser hands back `table`, `tableRow` and `tableCell`
+     * (twelve cells on a three-row table). The base rule says, word for word, "parse markdown
+     * with a parser".
+     *
+     * Parsing is also STRICTER than grep, and the difference is real: a marker mentioned in
+     * prose outside the scorecard — in a heading, in a paragraph saying "still need to run
+     * bib-authors", in a quote from someone else — no longer counts as a record of a run. To
+     * grep, those three cases are indistinguishable from a genuine record.
+     *
+     * ⚠️ WHAT THIS STILL DOES NOT FIX: inside the cell the evidence is still PROSE, and a run
+     * phrased in different words will not be seen by the rule. The real fix is a frontmatter
+     * field (`gates.cites.ran`), not a smarter text search; that's separate work, touching four
+     * live scorecards.
+     *
+     * So severity is set by the CONSUMER, and the default is not `error`: the proof of a run is
+     * prose, and a false positive at a blocking level costs more than a miss.
+     */
+    "author-list": {
+      meta: {
+        type: "suggestion",
+        docs: {
+          description:
+            "a paper that declares a stage records that the author-list check ran — a class the existence check cannot see",
+        },
+        schema: [
+          {
+            type: "object",
+            properties: {
+              // The run marker in the scorecard. This is consumer data: the package cannot
+              // know EXACTLY how a given consumer records that the cross-check happened.
+              marker: { type: "string" },
+              // What to run. This is a CONSUMER-SPECIFIC PATH, and it has no place in a public
+              // package: the predecessor hardcoded
+              // `.claude/skills/verify-citations/scripts/bib-authors.mjs` right into the message text.
+              command: { type: "string" },
+            },
+            additionalProperties: false,
+          },
+        ],
+        messages: {
+          neverRan:
+            "stage «{{stages}}» is declared, but the scorecard records no author-list run (looked for «{{marker}}» in its table). It catches what an existence check cannot see: the citation resolves, the id resolves, and the authors are the PREPRINT's while the entry declares a conference{{how}}",
+        },
+      },
+      create(context) {
+        const opts = context.options?.[0] ?? {};
+        const marker = opts.marker ?? "bib-authors";
+        const command = opts.command ?? "";
+
+        // The verdict is deferred to the end of the file: the frontmatter node arrives FIRST,
+        // and the table comes after it. Reporting on `yaml` would mean a verdict rendered
+        // without ever seeing the scorecard.
+        let declaredAt = null;
+        let stages = [];
+        let recorded = false;
+
+        return {
+          yaml(node) {
+            let data;
+            try {
+              data = load(node.value ?? "");
+            } catch {
+              return; // `paper/stages` has already reported the unreadable YAML
+            }
+            const raw = data?.stages;
+            if (!Array.isArray(raw)) return;
+            stages = raw.map((r) => r?.stage).filter(Boolean);
+            // One guard, not two: `raw.length === 0` would be a SPECIAL CASE of this same
+            // condition, and a mutation against it would turn out unkillable — the second guard
+            // mutes it. This also covers a non-empty list made of records with no `stage` field.
+            if (stages.length === 0) return; // nothing shipped — nothing is owed
+            declaredAt = node;
+          },
+
+          // The evidence is a SCORECARD CELL, not any occurrence of the string in the file. It
+          // has a node of its own; the first draft claimed otherwise and grepped the whole text.
+          tableCell(node) {
+            if (recorded) return;
+            if (context.sourceCode.getText(node).includes(marker))
+              recorded = true;
+          },
+
+          "root:exit"() {
+            if (!declaredAt || recorded) return;
+            context.report({
+              node: declaredAt,
+              messageId: "neverRan",
+              data: {
+                stages: stages.join("/"),
+                marker,
+                how: command ? `. Run: ${command}` : "",
+              },
+            });
+          },
+        };
+      },
+    },
+
+    source: {
+      meta: {
+        type: "problem",
+        docs: {
+          description:
+            "a declared stage freezes its source beside the pdf and is checked by bytes — not by a commit reference",
+        },
+        schema: [],
+        messages: {
+          noSource:
+            "stage «{{stage}}» ({{date}}) carries no frozen source. A commit reference will not do: squash and gc destroy it — three of four sources were lost that way in this corpus",
+          sourceMissing:
+            "«{{stage}}» ({{date}}): source `{{src}}` is declared, but the file is not on disk",
+          sourceBytes:
+            "«{{stage}}» ({{date}}): the source is declared as {{want}} bytes, {{got}} on disk — this is NOT that file",
+          lostAcknowledged:
+            "stage «{{stage}}» ({{date}}): the source is declared LOST. There is nothing left to match a build against a reviewer's line — if a copy turns up, put it in versions/ and clear the flag",
+        },
+      },
+      create(context) {
+        const dir = dirname(context.filename);
+        return {
+          yaml(node) {
+            let data;
+            try {
+              data = load(node.value ?? "");
+            } catch {
+              return; // `paper/stages` has already reported the unreadable YAML
+            }
+            const raw = data?.stages;
+            if (!Array.isArray(raw)) return;
+            for (const rec of raw) {
+              const stage = String(rec?.stage ?? "");
+              if (!STAGES.includes(stage)) continue;
+              const date = isoDate(rec?.date);
+
+              // Acknowledging the loss is a RECORD, not an exemption: the rule keeps speaking,
+              // because the state stays defective, just unfixable today.
+              if (rec?.sourceLost === true) {
+                context.report({
+                  node,
+                  messageId: "lostAcknowledged",
+                  data: { stage, date },
+                });
+                continue;
+              }
+              const src = rec?.source === undefined ? "" : String(rec.source);
+              if (src === "") {
+                context.report({
+                  node,
+                  messageId: "noSource",
+                  data: { stage, date },
+                });
+                continue;
+              }
+              const abs = join(dir, src);
+              if (!existsSync(abs)) {
+                context.report({
+                  node,
+                  messageId: "sourceMissing",
+                  data: { stage, date, src },
+                });
+                continue;
+              }
+              const got = statSync(abs).size;
+              const want = Number(rec?.sourceBytes);
+              if (Number.isFinite(want) && got !== want)
+                context.report({
+                  node,
+                  messageId: "sourceBytes",
+                  data: { stage, date, want: String(want), got: String(got) },
+                });
+            }
+          },
+        };
+      },
+    },
+  },
+};

package/eslint-rules/paper-stages.mutations.mjs

@@ -0,0 +1,157 @@
+/**
+ * Battery for `paper/stages` and `paper/source` — four mutations, chosen so that each one
+ * removes ITS OWN load-bearing property, rather than just breaking the file.
+ *
+ * 🔴 Why the battery matters here specifically. For both rules the success state is SILENCE, and
+ * the harness catches them on fixtures that it lays out itself. "It passed" and "it cannot fail"
+ * look identical from the outside; the battery is the only thing that tells them apart.
+ *
+ * The first two mutations hit the TWO DIRECTIONS of `paper/stages`, and this is not symmetry for
+ * its own sake: without the second direction the rule turns itself off by deleting the
+ * frontmatter — no declarations, so no mismatches, so green. The `declared-without-bytes`
+ * mutation and the `bytes-without-declaration` mutation must die on DIFFERENT asserts, or only
+ * one half is proven.
+ */
+import { fileURLToPath } from "node:url";
+import { dirname, join, resolve } from "node:path";
+import { runMutations } from "../lib/mutation-driver.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(HERE, "..");
+const RULE = join(HERE, "paper-stages.mjs");
+const HARNESS = join(HERE, "paper-stages.harness.mjs");
+
+process.exit(
+  runMutations({
+    root: ROOT,
+    runner: "node",
+    cases: [
+      {
+        name: "the DECLARED→BYTES direction stops checking",
+        harness: HARNESS,
+        expect: "wrong byte count is reported",
+        disables:
+          "the check of declared `bytes` against the file on disk — a stage could declare any " +
+          "number, and the pdf underneath it could be anything",
+        edits: [[RULE, "if (got !== Number(rec.bytes)) {", "if (false) {"]],
+      },
+      {
+        name: "the BYTES→DECLARED direction stops checking",
+        harness: HARNESS,
+        expect: "a frozen version nobody declared is reported",
+        disables:
+          "the second half — the one without which the rule is muted by deleting the " +
+          "frontmatter: no declarations ⇒ no mismatches ⇒ green",
+        edits: [
+          [
+            RULE,
+            "if (records.some((r) => r.stage === f.stage && r.date === f.date))\n                continue;",
+            "if (true)\n                continue;",
+          ],
+        ],
+      },
+      {
+        name: "`paper/source` stops checking the source's size",
+        harness: HARNESS,
+        expect: "a byte mismatch on the source is reported",
+        disables:
+          "the IDENTITY check on a frozen source: `existsSync` answers 'a file exists', " +
+          "and only the size answers 'this is that exact file'",
+        edits: [
+          [RULE, "if (Number.isFinite(want) && got !== want)", "if (false)"],
+        ],
+      },
+      {
+        name: "acknowledging a loss starts EXEMPTING instead of recording",
+        harness: HARNESS,
+        expect: "an acknowledged loss is still reported, not silenced",
+        disables:
+          "the decision that `sourceLost` is a RECORD, not an indulgence: the rule must keep " +
+          "speaking, because the state is still defective, merely unfixable today",
+        edits: [
+          [
+            RULE,
+            "if (rec?.sourceLost === true) {",
+            "if (rec?.sourceLost === true && false) {",
+          ],
+        ],
+      },
+      {
+        // 🔴 A REGRESSION BACK TO GREP. The rule's first draft did exactly this and justified it
+        // by saying "a footnote cell has no node of its own" — a measurement showed the
+        // opposite: the parser hands back `tableCell`. The mutation is caught by ONE fixture out
+        // of six: in the rest the marker already sits in a cell, so grep and parsing are
+        // indistinguishable. Without `marker-in-prose` this regression would have passed
+        // silently, and the rule would again read an intention as a fact.
+        name: "the evidence is grepped over the WHOLE FILE again",
+        harness: HARNESS,
+        expect: "a marker in prose OUTSIDE the table is not a record of a run",
+        disables:
+          "parsing in favor of a string search: 'still need to run bib-authors' — an intention, " +
+          "not a record — counts as a run again, and the paper silently stops being a debtor",
+        edits: [
+          [
+            RULE,
+            "if (context.sourceCode.getText(node).includes(marker))\n              recorded = true;",
+            "if (context.sourceCode.text.includes(marker))\n              recorded = true;",
+          ],
+        ],
+      },
+      {
+        name: "the rule stops requiring an author cross-check run",
+        harness: HARNESS,
+        expect: "a stage is declared, no run — a finding",
+        disables:
+          "the debt itself: a shipped paper no longer owes anything, and the rule stays silent " +
+          "across the whole corpus — silence is its success state, so from the outside this is " +
+          "indistinguishable",
+        // Target retargeted 09-17: the old line disappeared when the rule moved to parsing, and
+        // the driver honestly said UNUSABLE — "the patch did not land", not "the test is weak".
+        // Now the mutation declares the run recorded before the file is even read.
+        edits: [[RULE, "let recorded = false;", "let recorded = true;"]],
+      },
+      {
+        name: "the exemption for an unshipped paper becomes WIDER than it should",
+        harness: HARNESS,
+        expect: "an empty stage list — silent",
+        disables:
+          "the distinction between 'no stages' and 'there are stages': a draft starts getting a " +
+          "finding, and a rule that scolds drafts gets turned off within a week",
+        edits: [
+          [
+            RULE,
+            "if (stages.length === 0) return; // nothing shipped — nothing is owed",
+            "",
+          ],
+        ],
+      },
+      {
+        name: "the stage list is taken from somewhere OTHER than the field again",
+        harness: HARNESS,
+        expect:
+          "the stage list in the message comes from the FIELD and carries all of them",
+        disables:
+          "the exact reason the move was made. The predecessor derived the stage with a regex " +
+          "over the prose, and on agenticdev printed `submitted` where `submitted, " +
+          "camera-ready` was declared. The mutation brings back a hardcoded list — the set of " +
+          "findings does not change, only the TEXT lies, and without this assert the regression " +
+          "would have passed silently",
+        edits: [[RULE, 'stages: stages.join("/"),', 'stages: "submitted",']],
+      },
+      {
+        name: "a consumer-specific path comes back into the package's text",
+        harness: HARNESS,
+        expect:
+          "the run command comes in as an option and lands in the message",
+        disables:
+          "the boundary 'the mechanism goes in the package, the data stays with the consumer': " +
+          "the command stops arriving as an option. The predecessor hardcoded " +
+          "`.claude/skills/verify-citations/...` — the path of one private repository — right " +
+          "into a public rule's message",
+        edits: [
+          [RULE, 'const command = opts.command ?? "";', 'const command = "";'],
+        ],
+      },
+    ],
+  }),
+);