paperlint 2.0.0

package/fixtures/pdf-facts/ttf.tex

@@ -0,0 +1,6 @@
+\documentclass{article}
+\usepackage{fontspec}
+\setmainfont{ArsenalSC-Regular.ttf}[Path=./]
+\begin{document}
+Hello TrueType text in a PDF built with LuaLaTeX. $x+y=z$
+\end{document}

package/fixtures/real-markdown-paper/baseline.json

@@ -0,0 +1,24 @@
+{
+  "$comment": [
+    "What the rules say about this article TODAY, as data rather than as a sentence in a docblock.",
+    "It is not a target and not a clean bill of health — the fixture's README says findings here",
+    "are measurements. Its job is the SILENCE half: a rule that starts reporting something new on",
+    "225 lines of real prose has almost certainly gained a false positive, and the harness beside",
+    "this file names the rule. That is not expressible on an eleven-line stub, where every line was",
+    "written by someone who already knew which rule would read it.",
+    "",
+    "Recorded 2026-09-19. Three of the five are about the scorecard being deliberately thin",
+    "(no pdf, no frozen source) rather than about the prose; paper/typography's single entry is",
+    "the 18 p-values of rpp#44. They are real findings against IEEE / ISO 80000-1 style, which",
+    "requires the leading zero, in a blog post written for a general audience rather than for an",
+    "IEEE venue. All 18 sit in prose and table cells, so the count from the parsed tree keeps them.",
+    "The count is expected to stay. A drop is never a failure here, only growth is."
+  ],
+  "findings": {
+    "paper/stages": 2,
+    "paper/source": 1,
+    "paper/author-list": 1,
+    "paper/research-question": 1,
+    "paper/typography": 1
+  }
+}

package/fixtures/real-markdown-paper/baseline.mjs

@@ -0,0 +1,48 @@
+/**
+ * ONE reader of `baseline.json`, shared by the two runs that compare against it: the harness
+ * beside this file (the repository's own `bin/rpp.mjs`) and `test/e2e/install.mjs` (the binary
+ * a consumer actually got). Two copies of "growth fails, a drop never does" would drift the first
+ * time one of them is tightened, and the two runs would then disagree about the same article.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+/** The recorded counts, `{ruleId: n}`. */
+export function recordedFindings() {
+  return JSON.parse(readFileSync(join(HERE, "baseline.json"), "utf8")).findings;
+}
+
+/**
+ * `paperlint lint --json` stdout → `{ruleId: n}`.
+ * 🔴 Output that does not parse THROWS. An empty set read as "clean" is how this repository's
+ * checks have gone hollow before.
+ */
+export function countByRule(stdout) {
+  const out = {};
+  for (const file of JSON.parse(stdout))
+    for (const m of file.messages ?? [])
+      out[m.ruleId] = (out[m.ruleId] ?? 0) + 1;
+  return out;
+}
+
+/**
+ * Compare measured counts with the recording.
+ *   grew     — a rule says MORE about real prose than recorded: a false positive until shown
+ *              otherwise. Always a failure.
+ *   vanished — a recorded rule went fully quiet without the recording being updated: how a check
+ *              dies unnoticed. Also a failure.
+ * A partial drop is neither: it is what a fix looks like (rpp#44 is expected to take typography
+ * to zero, and then the recording is updated in the same change).
+ */
+export function compareToBaseline(found, recorded = recordedFindings()) {
+  const grew = Object.entries(found)
+    .filter(([rule, n]) => n > (recorded[rule] ?? 0))
+    .map(([rule, n]) => ({ rule, now: n, recorded: recorded[rule] ?? 0 }));
+  const vanished = Object.keys(recorded).filter(
+    (r) => recorded[r] > 0 && !(r in found),
+  );
+  return { grew, vanished };
+}

package/fixtures/render-paper/build-clean.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# FIXTURE — the CLEAN half of the `build.sh` ladder assertion in
+# `skills/render-paper/render-paper.harness.mjs`.
+#
+# A paper's own build script must not hard-code a path into the agent's skills directory:
+# once the skills move into a package that address points at nothing, and LaTeX's reaction to
+# a missing \input is SILENCE, not an error. So the script resolves the venues directory
+# through the package first, falls back to the in-repo copy, and then VERIFIES that kpsewhich
+# can actually see the file before handing anything to pdflatex.
+set -euo pipefail
+ROOT=$(git rev-parse --show-toplevel)
+
+VENUES_PKG=$(node -e 'try{process.stdout.write(require.resolve("paperlint/venues/paper-guards.tex"))}catch{}' 2>/dev/null || true)
+if [ -n "$VENUES_PKG" ] && [ -f "$VENUES_PKG" ]; then
+  VENUES_DIR=$(dirname "$VENUES_PKG")
+elif [ -f "$ROOT/.claude/skills/submit-paper/references/venues/paper-guards.tex" ]; then
+  VENUES_DIR="$ROOT/.claude/skills/submit-paper/references/venues"
+else
+  echo "✗ paper-guards.tex found neither in the package nor in the repository" >&2
+  exit 1
+fi
+export TEXINPUTS="$VENUES_DIR:"
+kpsewhich paper-guards.tex >/dev/null || { echo "✗ directory found, but kpsewhich cannot see paper-guards.tex"; exit 1; }
+
+pdflatex paper.tex

package/fixtures/render-paper/build-defect.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# FIXTURE — the DEFECT half. This is the shape the real script had before 2026-09-12.
+#
+# ⚠️ The comment below deliberately QUOTES the bad line in prose. That is the point of the
+# fixture: a check that greps for the string anywhere would fire on this explanation instead
+# of on the executable line, and would therefore also fire on a file that was already fixed.
+# The assertion must anchor to the executable line, so this comment must NOT make it fire.
+#
+#   was: export TEXINPUTS="$ROOT/.claude/skills/submit-paper/references/venues:"
+set -euo pipefail
+ROOT=$(git rev-parse --show-toplevel)
+
+export TEXINPUTS="$ROOT/.claude/skills/submit-paper/references/venues:"
+
+pdflatex paper.tex

package/fixtures/review-findings-cause/clean.md

@@ -0,0 +1,17 @@
+---
+title: "Paper review — round 3"
+created: 2026-09-01
+---
+
+# Findings
+
+| # | what | where |
+|---|---|---|
+| 1 | the number in the abstract does not match table 2 | §1 |
+| 2 | a reference to a withdrawn work | §4 |
+| 3 | a past-tense promise about something unpublished | §6 |
+
+## Analysis
+
+Cause: the numbers gate read only `paper.md` and never opened `.tex`, so the table
+and the abstract were compared in different files. Fix the gate, not the paragraph.

package/fixtures/review-findings-cause/defect.md

@@ -0,0 +1,14 @@
+---
+title: "Paper review — round 3"
+created: 2026-09-01
+---
+
+# Findings
+
+| # | what | where |
+|---|---|---|
+| 1 | the number in the abstract does not match table 2 | §1 |
+| 2 | a reference to a withdrawn work | §4 |
+| 3 | a past-tense promise about something unpublished | §6 |
+
+Text edits follow.

package/fixtures/review-findings-cause/old-debt.md

@@ -0,0 +1,14 @@
+---
+title: "Paper review — an old report"
+created: 2026-01-01
+---
+
+# Findings
+
+| # | what | where |
+|---|---|---|
+| 1 | the number does not match | §1 |
+| 2 | a reference to a withdrawn work | §4 |
+| 3 | a promise about something unpublished | §6 |
+
+There is no analysis of causes here — the report predates the rule.

package/fixtures/review-findings-cause/quiet-in-fence.md

@@ -0,0 +1,16 @@
+---
+title: "A note on the report format"
+created: 2026-09-01
+---
+
+An example of WHAT a findings table looks like — not itself a finding:
+
+```markdown
+| # | what | where |
+|---|---|---|
+| 1 | example | §1 |
+| 2 | example | §2 |
+| 3 | example | §3 |
+```
+
+There must be no analysis of causes here: this describes the format, it is not a report.

package/fixtures/tex-build/clean.tex

@@ -0,0 +1,21 @@
+% Fixture: a build that is NOT in review mode and promises nothing it has already shipped.
+% The rule must run here and find nothing -- that is the quiet half of `tex/future-promise`.
+%
+% The line below is an AUTHOR NOTE inside a LaTeX comment, and it deliberately carries a
+% promise phrase: the full harness will be released once the table is redrawn.
+% A finding on it would be exactly the false positive that gets a check switched off.
+\documentclass[sigconf,screen]{acmart}
+\settopmatter{printfolios=true}
+\begin{document}
+\title{A short and honest paper}
+
+\begin{abstract}
+We measured one thing and report it plainly. The number is small and we say so.
+The harness that produced these numbers is in the repository named in Availability,
+and we cover 95\% of the cases we set out to cover.
+\end{abstract}
+
+\section{Availability}
+The harness and the raw runs are public in the repository linked above.
+
+\end{document}

package/fixtures/tex-build/defect.tex

@@ -0,0 +1,24 @@
+% Fixture: the defect the rule exists for -- a shipped (non-review) build that still promises
+% a future release of something it has already handed over. Two of these, in the two most
+% read positions of a paper: the end of the abstract and the end of the conclusion.
+%
+% The failure mode this reproduces: a paper printed `(full harness at camera-ready)` in the
+% abstract while its own Availability paragraph three lines down said the harness was already
+% open. The document contradicted itself two against one, and the losing side was the
+% abstract -- the part indexed by the digital library and the only part most people read.
+\documentclass[sigconf,screen]{acmart}
+\settopmatter{printfolios=true}
+\begin{document}
+\title{A short and honest paper}
+
+\begin{abstract}
+We measured one thing and report it plainly (full harness at camera-ready).
+\end{abstract}
+
+\section{Availability}
+The harness and the raw runs are public in the repository linked above.
+
+\section{Conclusion}
+We reported what we counted. The complete data set will be made publicly available.
+
+\end{document}

package/fixtures/tex-build/frontmatter-clean.tex

@@ -0,0 +1,25 @@
+% Fixture: an `acmart` build that leaves ACM's front matter alone. The rule must RUN here and
+% find nothing -- that is the quiet half of `tex/acm-frontmatter-override`.
+%
+% 🔴 The block below is the load-bearing part of this fixture, and it is copied from the shape
+% of a real accepted paper: the three overrides are kept as a COMMENTED RECORD of what the
+% preamble used to do. A finding on a comment would be exactly the false positive that gets a
+% check switched off, and here it would also punish the one habit that saved the sibling paper.
+%   was: \documentclass[sigconf,review]{acmart}
+%        \setcopyright{none}
+%        \renewcommand\footnotetextcopyrightpermission[1]{}
+%        \pagestyle{plain}
+\documentclass[sigconf,screen]{acmart}
+\setcopyright{cc}
+\acmConference[Fixture '26]{A Workshop That Does Not Exist}{October 12--16, 2026}{Nowhere}
+\begin{document}
+\title{A paper that keeps its own front page}
+
+\begin{abstract}
+We measured one thing and report it plainly. The number is small and we say so.
+\end{abstract}
+
+\section{Availability}
+The harness and the raw runs are public in the repository linked above.
+
+\end{document}

package/fixtures/tex-build/frontmatter-defect.tex

@@ -0,0 +1,23 @@
+% Fixture: the defect the rule exists for -- an `acmart` preamble that takes elements OFF the
+% front page. This is the shape of a preamble that was desk-rejected before any content review
+% with the reason "substantially deviating from the specified template... front page lacks
+% elements included in the template".
+%
+% All three lines are on the front page's side of the ledger, and none of them is compensating
+% for something the class does: the `review` option turns on line numbers and folios
+% (acmart.cls:93-99) and touches neither the copyright statement nor the permission footnote.
+\documentclass[sigconf,review,anonymous]{acmart}
+\setcopyright{none}
+\renewcommand\footnotetextcopyrightpermission[1]{}
+\pagestyle{plain}
+\begin{document}
+\title{A paper that deleted its own front page}
+
+\begin{abstract}
+We measured one thing and report it plainly. The number is small and we say so.
+\end{abstract}
+
+\section{Availability}
+The harness and the raw runs are public in the repository linked above.
+
+\end{document}

package/fixtures/toolchain-mirror/catalog.txt

@@ -0,0 +1,5 @@
+latex latex.ltx article.cls
+acmart acmart.cls
+libertine libertine.sty
+texcount bin:texcount
+liar other.sty

package/fixtures/toolchain-mirror/install-tl

@@ -0,0 +1,27 @@
+#!/bin/sh
+# STANDS IN FOR install-tl in src/toolchain.harness.mjs. It reads TEXDIR from the profile rpp
+# wrote and lays out a tree whose kpsewhich and tlmgr are the stubs shipped beside it, so the
+# harness drives rpp's real download, unpack, install and verify logic without the network.
+set -eu
+here=$(cd "$(dirname "$0")" && pwd)
+profile=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -profile) profile=$2; shift 2 ;;
+    *) shift ;;
+  esac
+done
+dir=$(sed -n 's/^TEXDIR //p' "$profile")
+if [ -n "${FAKE_INSTALL_TL_FAIL:-}" ]; then
+  echo "install-tl: simulated failure"
+  exit 1
+fi
+mkdir -p "$dir/bin/x86_64-linux"
+for t in pdflatex kpsewhich tlmgr; do
+  cp "$here/stub-$t" "$dir/bin/x86_64-linux/$t"
+  chmod +x "$dir/bin/x86_64-linux/$t"
+done
+: > "$dir/files.txt"
+# The real install-tl leaves release-texlive.txt at TEXDIR; stub-tlmgr reads the tree's year there.
+cp "$here/release-texlive.txt" "$dir/release-texlive.txt"
+echo "fake install-tl: scheme-basic into $dir"

package/fixtures/toolchain-mirror/release-texlive.txt

@@ -0,0 +1,3 @@
+TeX Live (https://tug.org/texlive) version 2026
+
+This file is public domain.

package/fixtures/toolchain-mirror/release-year

@@ -0,0 +1 @@
+2026

package/fixtures/toolchain-mirror/stub-kpsewhich

@@ -0,0 +1,8 @@
+#!/bin/sh
+# Answers like kpsewhich: one path per name it finds, nothing for the rest. "Installed" files
+# are the lines of files.txt at the tree root, which stub-tlmgr appends to.
+tree=$(cd "$(dirname "$0")/../.." && pwd)
+for f in "$@"; do
+  if grep -qx "$f" "$tree/files.txt"; then echo "$tree/texmf-dist/$f"; fi
+done
+exit 0

package/fixtures/toolchain-mirror/stub-pdflatex

@@ -0,0 +1,3 @@
+#!/bin/sh
+# Only its presence matters: rpp finds a tree by the pdflatex in its bin directory.
+exit 0

package/fixtures/toolchain-mirror/stub-tlmgr

@@ -0,0 +1,44 @@
+#!/bin/sh
+# Answers like tlmgr install: each package is looked up in the repository's catalog.txt
+# ("name file…", a "bin:NAME" item creates an executable). An unknown name gets tlmgr's own
+# wording, which is what rpp parses. Every call is appended to tlmgr.log at the tree root.
+bin=$(cd "$(dirname "$0")" && pwd)
+tree=$(cd "$bin/../.." && pwd)
+repo=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --repository) repo=$2; shift 2 ;;
+    install) shift; break ;;
+    *) shift ;;
+  esac
+done
+echo "$repo $*" >> "$tree/tlmgr.log"
+catalog="${repo#file://}/catalog.txt"
+# A repository for a NEWER TeX Live than the tree: tlmgr refuses before installing anything, in
+# the wording of tlmgr.pl (TeX Live 2026, lines 7644-7648). The repository's year is the file
+# release-year beside catalog.txt; a mirror without one is not checked.
+remote=$(cat "${repo#file://}/release-year" 2>/dev/null || true)
+local=$(sed -n '1s/.*version \([0-9]\{4\}\).*/\1/p' "$tree/release-texlive.txt")
+if [ -n "$remote" ] && [ "$remote" -gt "$local" ]; then
+  echo "tlmgr: Local TeX Live ($local) is older than remote repository ($remote)."
+  echo "Cross release updates are only supported with"
+  echo "  update-tlmgr-latest(.sh/.exe) -- --upgrade"
+  echo "See https://tug.org/texlive/upgrade.html for details."
+  exit 1
+fi
+status=0
+for p in "$@"; do
+  line=$(grep "^$p " "$catalog" || true)
+  if [ -z "$line" ]; then
+    echo "tlmgr install: package $p not present in repository."
+    status=1
+    continue
+  fi
+  for item in ${line#* }; do
+    case "$item" in
+      bin:*) : > "$bin/${item#bin:}"; chmod +x "$bin/${item#bin:}" ;;
+      *) echo "$item" >> "$tree/files.txt" ;;
+    esac
+  done
+done
+exit $status